Groups > linux.debian.bugs.dist > #1198132

Bug#1071480: libldap: sends some IPv6 addresses as server name

From	Elliott Mitchell <ehem+debian@m5p.com>
Newsgroups	linux.debian.bugs.dist
Subject	Bug#1071480: libldap: sends some IPv6 addresses as server name
Date	2024-05-21 07:00 +0200
Message-ID	<IGpLr-eMiL-1@gated-at.bofh.it> (permalink)
References	(4 earlier) <IGj3j-eI7o-3@gated-at.bofh.it> <IGj3j-eI7o-1@gated-at.bofh.it> <IGpLr-eMiL-3@gated-at.bofh.it> <IyoMx-9HZT-1@gated-at.bofh.it> <IGpLr-eMiL-3@gated-at.bofh.it>
Organization	linux.* mail to news gateway

Show all headers | View raw

On Mon, May 20, 2024 at 04:25:57PM -0700, Quanah Gibson-Mount wrote:
> 
> --On Monday, May 20, 2024 3:45 PM -0700 Elliott Mitchell 
> <ehem+debian@m5p.com> wrote:
> 
> Side note - I did raise this issue with the rest of the OpenLDAP project, 
> and Howard noted:
> 
> "DNS names are required to begin with a letter. RFC 1035, sec 2.3.1. The 
> fact that gnutls allows names that are all numeric is certainly their bug".
> 
> So I guess two bugs here.

According to what I found, that requirement was removed.  This doesn't
invalidate the fact that no top-level domain consists exclusively of
numbers (in fact I'm pretty sure none have any numbers).

I'm proposing checking only for nul-characters and passing everything
else through.  Principle being anything handling SNI must handle the
case of a string which fails to match a known entry.  If a server program
chose to honor strings which violate RFC 6066, GnuTLS doesn't need to get
in the way of that.  Simply terminating the connection really isn't to
helpful (it could simply be a bug).

-- 
(\___(\___(\______          --=> 8-) EHM <=--          ______/)___/)___/)
 \BS (    |         ehem+sigmsg@m5p.com  PGP 87145445         |    )   /
  \_CS\   |  _____  -O #include <stddisclaimer.h> O-   _____  |   /  _/
8A19\___\_|_/58D2 7E3D DDF4 7BA6 <-PGP-> 41D1 B375 37D0 8714\_|_/___/5445

Back to linux.debian.bugs.dist | Previous | Next — Previous in thread | Find similar | Unroll thread

Thread

Bug#1070033: libgnutls30: rejects numeric IPv6 addresses during connection Elliott Mitchell <ehem+debian@m5p.com> - 2024-04-29 04:20 +0200
  Bug#1070033: libgnutls30: rejects numeric IPv6 addresses during connection Andreas Metzler <ametzler@bebt.de> - 2024-04-30 06:00 +0200
    Bug#1070033: libgnutls30: rejects numeric IPv6 addresses during connection Elliott Mitchell <ehem+debian@m5p.com> - 2024-04-30 07:40 +0200
      Bug#1070033: libgnutls30: rejects numeric IPv6 addresses during connection Andreas Metzler <ametzler@bebt.de> - 2024-05-01 13:50 +0200
        Bug#1070033: libgnutls30: rejects numeric IPv6 addresses during connection Elliott Mitchell <ehem+debian@m5p.com> - 2024-05-14 03:20 +0200
          Bug#1070033: libgnutls30: rejects numeric IPv6 addresses during connection Andreas Metzler <ametzler@bebt.de> - 2024-05-14 18:30 +0200
            Bug#1070033: libgnutls30: rejects numeric IPv6 addresses during connection Elliott Mitchell <ehem+debian@m5p.com> - 2024-05-17 04:10 +0200
              Bug#1070033: libgnutls30: rejects numeric IPv6 addresses during connection Elliott Mitchell <ehem+debian@m5p.com> - 2024-05-17 19:00 +0200
                Bug#1070033: libgnutls30: rejects numeric IPv6 addresses during connection Andreas Metzler <ametzler@bebt.de> - 2024-05-18 07:00 +0200
                Bug#1070033: libgnutls30: rejects numeric IPv6 addresses during connection Elliott Mitchell <ehem+debian@m5p.com> - 2024-05-18 07:30 +0200
                Bug#1070033: libgnutls30: rejects numeric IPv6 addresses during connection Andreas Metzler <ametzler@bebt.de> - 2024-05-18 07:50 +0200
                Bug#1070033: libgnutls30: rejects numeric IPv6 addresses during connection Elliott Mitchell <ehem+debian@m5p.com> - 2024-05-18 08:10 +0200
                Bug#1070033: libgnutls30: rejects numeric IPv6 addresses during connection Andreas Metzler <ametzler@bebt.de> - 2024-05-18 08:30 +0200
                Bug#1070033: libgnutls30: rejects numeric IPv6 addresses during connection Elliott Mitchell <ehem+debian@m5p.com> - 2024-05-18 09:00 +0200
                Bug#1070033: libgnutls30: rejects numeric IPv6 addresses during connection Andreas Metzler <ametzler@bebt.de> - 2024-05-18 11:00 +0200
                Bug#1070033: libgnutls30: rejects numeric IPv6 addresses during connection Elliott Mitchell <ehem+debian@m5p.com> - 2024-05-18 22:20 +0200
  Bug#1071480: libldap: sends some IPv6 addresses as server name Elliott Mitchell <ehem+debian@m5p.com> - 2024-05-20 02:10 +0200
    Bug#1071480: libldap: sends some IPv6 addresses as server name Ryan Tandy <ryan@nardis.ca> - 2024-05-20 22:00 +0200
  Bug#1071480: libldap: sends some IPv6 addresses as server name Elliott Mitchell <ehem+debian@m5p.com> - 2024-05-20 23:50 +0200
  Bug#1071480: libldap: sends some IPv6 addresses as server name Elliott Mitchell <ehem+debian@m5p.com> - 2024-05-21 07:00 +0200

csiph-web