Mailing-List: contact dev-help@httpd.apache.org; run by ezmlm
Precedence: bulk
Reply-To: dev@httpd.apache.org
From: Stefan Eissing <stefan.eissing@greenbytes.de>
Content-Type: text/plain;
	charset=us-ascii
Content-Transfer-Encoding: quoted-printable
Mime-Version: 1.0 (1.0)
Subject: Re: SNI Host: header mismatch
Message-Id: <0DC2853F-6376-4E56-9F62-49E4E13278F9@greenbytes.de>
Date: Thu, 11 Jun 2015 18:08:28 +0200
References: <6A48855E-B573-4946-8BC7-AE914B94BE90@greenbytes.de>
 <CAKQ1sVPBxaHCMCzjf3p-pTpPhQk-dcrASvy6Zs-wgpqYD=YVXg@mail.gmail.com>
 <CAKQ1sVNcZZKfitUiKBX7BW_zGwJprOQ21Nv_xyVCu3mU+PKZdQ@mail.gmail.com>
 <CAKQ1sVMXkG33C1R7vw28bCvk+eh_W0-Zpy1o=wnijaB7BkBpxQ@mail.gmail.com>
 <718405ED-C623-44CA-BFE7-BC899CA088FD@greenbytes.de>
 <CAKQ1sVPN=KcnhTm4JO6J+EJGBevkZ=4PQxm1vtE_M9P+PM3Frw@mail.gmail.com>
In-Reply-To: 
 <CAKQ1sVPN=KcnhTm4JO6J+EJGBevkZ=4PQxm1vtE_M9P+PM3Frw@mail.gmail.com>
To: "dev@httpd.apache.org" <dev@httpd.apache.org>

Yes, it will work with the cert checks, not without. Sorry, if that was conf=
using.=20


> Am 11.06.2015 um 17:56 schrieb Yann Ylavic <ylavic.dev@gmail.com>:
>=20
> On Thu, Jun 11, 2015 at 4:33 PM, Stefan Eissing
> <stefan.eissing@greenbytes.de> wrote:
>> Two things:
>>=20
>> 1. the minimal thing to fix the situation is to return 421 instead of 400=
. H2 clients will then open a new TLS connection for the request host. I don=
't know if this breaks any HTTP/1 clients, however it should not.
>=20
> I think this should be OK, HTTP/1 clients are prepared to received
> unknown error codes AFAICT.
>=20
>>=20
>> 2. Given that we answer not matching combinations with 421, the admin sho=
uld be given the opportunity to allow this via some directive. This makes it=
 easier for her to do "anti-sharding" for h2 clients.
>>=20
>> ap_matches_request_vhost() / ServerAlias is not the right choice, if I un=
derstand it correctly, since the non-matching request is really intended for=
 another vhost and not just a using a fancy name for the real SNI one.
>>=20
>> If there were named SSL configurations, httpd could allow connection reus=
e for all vhosts with the same SSL config. Alternatively, is there a good wa=
y to check that two vhosts use the same certificate (key)? That could work a=
s well.
>=20
> That's why I (also) proposed to check the SNI against the current
> vhost's certificate's subject CN and/or AltNames (for wildcard certs).
> AIUI, the client should not reuse connections unless one of those matches.=

>=20
> Why wouldn't that work?
>=20
> Regards,
> Yann.