Mailing-List: contact dev-help@httpd.apache.org; run by ezmlm
Precedence: bulk
Reply-To: dev@httpd.apache.org
Received-SPF: pass (nike.apache.org: local policy includes SPF record at
 spf.trusted-forwarder.org)
Date: Thu, 12 Dec 2013 13:00:53 -0600
From: "William A. Rowe Jr." <wrowe@rowe-clan.net>
To: dev@httpd.apache.org
Cc: peter.sylvester@edelweb.fr
Subject: Re: [SPAM?]:  Re: Behavior of Host: vs. SNI Hostname in proxy
 CONNECT requests
Message-ID: <20131212130053.3d725a79@hub>
In-Reply-To: <52A969D8.5060306@edelweb.fr>
References: <20131125155541.66e19919@hub>
	<CAKQ1sVPv86nzsbCk4Cyz-CG2qkhi1ioJwiig-3yLXpUU+=68qg@mail.gmail.com>
	<52943239.9080607@velox.ch>
	<CAKQ1sVNF=RV28cpD7YgET2zpNgpzB2B5tOya3PkL7-ABmqJ57g@mail.gmail.com>
	<CAKQ1sVNuNjes+JptasxBOzrppTatZ6504oHvzcwABCngmkcfZw@mail.gmail.com>
	<20131211171545.2012e83b@hub>
	<52A969D8.5060306@edelweb.fr>
Mime-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 7bit

On Thu, 12 Dec 2013 08:46:32 +0100
Peter Sylvester <peter.sylvester@edelweb.fr> wrote:

> > The rest of the SNI hostname processing steps are where the problem
> > lies.  We still need to perform http headers -> vhost translation
> > after the connection is established.  If there's any desire to do
> > SNI hostname validation, that has to be limited to comparing that
> > hostname to the ServerName/ServerAlias entries, not to the HTTP
> > Host: which has a different semantic meaning and is the only
> > hostname of interest to httpd as an HTTP server.

> this part was always a bit strange: the initial idea was: When the
> code sees the Host: and when there was no sni, to force a
> renegotiation with the right cert/key.

That doesn't doesn't as user agents won't proceed with a request
because they had not established trust, and the user agent then
rightfully ends this attempt with an error (or sufficiently painful
'ignore this error' action on the part of the user).

But again, the Host: field is not defined as the dns name of this
next-hop server, but the hostname component of the requested URI.