crypto/tls: don't send IP literals as SNI values.

(This relands commit a4dcc692011bf1ceca9b1a363fd83f3e59e399ee.)

https://tools.ietf.org/html/rfc6066#section-3 states:

  “Literal IPv4 and IPv6 addresses are not permitted in "HostName".”

However, if an IP literal was set as Config.ServerName (which could
happen as easily as calling Dial with an IP address) then the code would
send the IP literal as the SNI value.

This change filters out IP literals, as recognised by net.ParseIP, from
being sent as the SNI value.

Fixes #13111.

Change-Id: I6e544a78a01388f8fe98150589d073b917087f75
Reviewed-on: https://go-review.googlesource.com/16776
Run-TryBot: Adam Langley <agl@golang.org>
Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>
Reviewed-by: Russ Cox <rsc@golang.org>
TryBot-Result: Gobot Gobot <gobot@golang.org>

diff --git a/src/crypto/tls/common.go b/src/crypto/tls/common.go
index d47dc6182f0d91c2aad1da67a1030edca9448cc3..c68ebfe188b41a9609f40cccb4c2c93720e12602 100644 (file)
--- a/src/crypto/tls/common.go
+++ b/src/crypto/tls/common.go
@@ -286,7 +286,8 @@ type Config struct {
 
        // ServerName is used to verify the hostname on the returned
        // certificates unless InsecureSkipVerify is given. It is also included
-       // in the client's handshake to support virtual hosting.
+       // in the client's handshake to support virtual hosting unless it is
+       // an IP address.
        ServerName string
 
        // ClientAuth determines the server's policy for

diff --git a/src/crypto/tls/handshake_client.go b/src/crypto/tls/handshake_client.go
index 0b591d7309c2592b9067b8ba796519806260e1fd..462acfd1a121ac12eebcd6a89db622355347fe36 100644 (file)
--- a/src/crypto/tls/handshake_client.go
+++ b/src/crypto/tls/handshake_client.go
@@ -49,13 +49,20 @@ func (c *Conn) clientHandshake() error {
                return errors.New("tls: NextProtos values too large")
        }
 
+       sni := c.config.ServerName
+       // IP address literals are not permitted as SNI values. See
+       // https://tools.ietf.org/html/rfc6066#section-3.
+       if net.ParseIP(sni) != nil {
+               sni = ""
+       }
+
        hello := &clientHelloMsg{
                vers:                c.config.maxVersion(),
                compressionMethods:  []uint8{compressionNone},
                random:              make([]byte, 32),
                ocspStapling:        true,
                scts:                true,
-               serverName:          c.config.ServerName,
+               serverName:          sni,
                supportedCurves:     c.config.curvePreferences(),
                supportedPoints:     []uint8{pointFormatUncompressed},
                nextProtoNeg:        len(c.config.NextProtos) > 0,

diff --git a/src/crypto/tls/handshake_client_test.go b/src/crypto/tls/handshake_client_test.go
index 664fe8de6a0c73b0439cffcc5621955f49c955fd..b275da15d02cef502826d10a5d10183984096137 100644 (file)
--- a/src/crypto/tls/handshake_client_test.go
+++ b/src/crypto/tls/handshake_client_test.go
@@ -600,3 +600,30 @@ func TestHandshakClientSCTs(t *testing.T) {
        }
        runClientTestTLS12(t, test)
 }
+
+func TestNoIPAddressesInSNI(t *testing.T) {
+       for _, ipLiteral := range []string{"1.2.3.4", "::1"} {
+               c, s := net.Pipe()
+
+               go func() {
+                       client := Client(c, &Config{ServerName: ipLiteral})
+                       client.Handshake()
+               }()
+
+               var header [5]byte
+               if _, err := io.ReadFull(s, header[:]); err != nil {
+                       t.Fatal(err)
+               }
+               recordLen := int(header[3])<<8 | int(header[4])
+
+               record := make([]byte, recordLen)
+               if _, err := io.ReadFull(s, record[:]); err != nil {
+                       t.Fatal(err)
+               }
+               s.Close()
+
+               if bytes.Index(record, []byte(ipLiteral)) != -1 {
+                       t.Errorf("IP literal %q found in ClientHello: %x", ipLiteral, record)
+               }
+       }
+}

diff --git a/src/net/http/client_test.go b/src/net/http/client_test.go
index 86ec83add10591fe4d731bb3e1d41a9147310f41..01f8cbaa2dfdcb9241e2e88da3eec6c029ede12f 100644 (file)
--- a/src/net/http/client_test.go
+++ b/src/net/http/client_test.go
@@ -642,14 +642,18 @@ func newTLSTransport(t *testing.T, ts *httptest.Server) *Transport {
 
 func TestClientWithCorrectTLSServerName(t *testing.T) {
        defer afterTest(t)
+
+       const serverName = "example.com"
        ts := httptest.NewTLSServer(HandlerFunc(func(w ResponseWriter, r *Request) {
-               if r.TLS.ServerName != "127.0.0.1" {
-                       t.Errorf("expected client to set ServerName 127.0.0.1, got: %q", r.TLS.ServerName)
+               if r.TLS.ServerName != serverName {
+                       t.Errorf("expected client to set ServerName %q, got: %q", serverName, r.TLS.ServerName)
                }
        }))
        defer ts.Close()
 
-       c := &Client{Transport: newTLSTransport(t, ts)}
+       trans := newTLSTransport(t, ts)
+       trans.TLSClientConfig.ServerName = serverName
+       c := &Client{Transport: trans}
        if _, err := c.Get(ts.URL); err != nil {
                t.Fatalf("expected successful TLS connection, got error: %v", err)
        }