Bug 49491 - SSL module does not do the case insensitive URI comparison
Summary: SSL module does not do the case insensitive URI comparison
Status: RESOLVED FIXED
Alias: None
Product: Apache httpd-2
Classification: Unclassified
Component: mod_ssl (show other bugs)
Version: 2.2.21
Hardware: PC Linux
: P2 normal with 5 votes (vote)
Target Milestone: ---
Assignee: Apache HTTPD Bugs Mailing List
URL:
Keywords: FixedInTrunk
Depends on:
Blocks:
 
Reported: 2010-06-22 10:13 UTC by Mayank Agrawal
Modified: 2013-08-19 19:27 UTC (History)
3 users (show)


Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Mayank Agrawal 2010-06-22 10:13:12 UTC 
Hi,


In our test server when I try to access URI "https://DTGTEST.ORG/ukdtt2/IC008/PATH/file" then the request is denied with error code 400. The error.log says:

"[error] Hostname dTgTeSt.OrG provided via SNI and hostname dtgtest.org provided via HTTP are different"

The error here is that the function ssl_hook_ReadReq in file ssl_engine_kernal.c at line number 205 {if (strcmp(host, servername))} uses case sensitive URI comparison. But the RFC 4366 specifies that all the URI comparison shall be case-insensitive. So I suggest to change this line to 
     if (strcasecmp(host, servername))


Thanks you very much for your help and wonderful work at Apache.

Best Regards,

Mayank
Comment 1 Ruediger Pluem 2010-06-22 11:28:08 UTC 
What browser are you using? I am curious why it sents the hostname in the SNI extension in a different case than in the HTTP host header.
Comment 2 Mayank Agrawal 2010-06-22 12:08:52 UTC 
Hi Ruediger,

This is a Set Top Box device that uses latest version of cURL and OpenSSL libraries. Strangely it seems that cURL is sending the following HTTP request after the TLS connection setup and the host name looks correct in it:

GET /ukdtt2/IC008/PATH/file HTTP/1.1
Host: DTGTEST.ORG
User-Agent: UK-MHEG/2 S&TITK/001 MHGS&T/260
Cache-Control: no-transform


Regards,

Mayank
Comment 3 Joe Orton 2011-03-16 12:33:11 UTC 
I can't see any harm from doing that, even if it is pretty odd behaviour on the client's part. Hostnames are generally supposed to be compared case-insensitively.

Committed in r1082189 - thanks.
Comment 4 thorsten.blankenstein 2011-07-15 09:49:26 UTC 
This bug is still in the current version 2.2.19.
In line 139 of the file ssl_engine_kernel.c the comparisson is still case sensitive.
Comment 5 james 2011-12-22 12:12:29 UTC 
This change was not applied to the 2.2.x branch. Can we have this in the next 2.2.x release?
Comment 6 jrmoreno 2012-04-10 19:23:01 UTC 
Does FixedInTrunk mean that it has been fixed in the 2.2 branch or the 2.4 branch?
Comment 7 Rainer Jung 2012-04-11 07:51:32 UTC 
It is currently only fixed in 2.4.x and trunk.
Comment 8 David Bird 2012-10-26 00:32:13 UTC 
AFAICT this issue is purely an Apache problem, not the client, since the Host is lowercased by vhost.c - fix_hostname() and then compared with strcmp() in ssl_engine_kernel.c ssl_hook_ReadReq()
Comment 9 Joe Orton 2013-08-19 19:27:40 UTC 
Fixed in 2.2.x: http://svn.apache.org/r1515565