421634 - Don't send an SNI Client Hello extension bearing an IPv6 address

Status: RESOLVED FIXED

(NSS :: Libraries, defect)

Description

[Nelson Bolyard (seldom reads bugmail)]

When a client attempts to connect to a user using TLS, it typically sends 
a "Server Name Indication" (SNI) extension to the server, bearing the DNS 
name for the virtual server whose certificate it wants to see.  

If the client has not been given a DNS name by its calling app, but rather 
has been given an IP address, it's supposed to be smart and recognize that 
the string is an IP address and not send a Server Name Indication bearing 
that IP address.

The code that composes the SNI extension detects IPv4 address strings, but
does not detect IPv6 address strings, so it may send an IPv6 address string
inside the SNI client hello extension to the server.  Servers can rightfully
barf on that.

Comment 1

[Nelson Bolyard (seldom reads bugmail)]

Attachment: patch v1 for NSS_3_11_BRANCH (checked in)

untested patch for branch. Will test before requesting review.

Comment 2

[Nelson Bolyard (seldom reads bugmail)]

Attachment: Patch v1 for NSS Trunk (checked in)

Comment 3

[Nelson Bolyard (seldom reads bugmail)]

Comment on attachment 308099 [details] [diff] [review]
Patch v1 for NSS Trunk (checked in)

I finally tested this patch.  
Wan-Teh, please review.

Comment 4

[Nelson Bolyard (seldom reads bugmail)]

Comment on attachment 308098 [details] [diff] [review]
patch v1 for NSS_3_11_BRANCH (checked in)

Julien,  This patch is the same as the other one, but applies cleanly to the branch.  Please give this a second review for the branch.

Comment 5

[Wan-Teh Chang]

Comment on attachment 308099 [details] [diff] [review]
Patch v1 for NSS Trunk (checked in)

r=wtc.

Comment 6

[Wan-Teh Chang]

Comment on attachment 308098 [details] [diff] [review]
patch v1 for NSS_3_11_BRANCH (checked in)

r=wtc.

Comment 7

[Nelson Bolyard (seldom reads bugmail)]

Comment on attachment 308099 [details] [diff] [review]
Patch v1 for NSS Trunk (checked in)

Checking in ssl/ssl3ext.c; new revision: 1.3; previous revision: 1.2

Comment 8

[Nelson Bolyard (seldom reads bugmail)]

Comment on attachment 308098 [details] [diff] [review]
patch v1 for NSS_3_11_BRANCH (checked in)

nss/lib/ssl/ssl3ecc.c; new revision: 1.3.2.14; previous revision: 1.3.2.13