[TLS] 4366bis TLSext SNI -- case-sensitivity, permitted chars

[Martin Rex <[e-mail]>]

Looking at the OpenSSL diffs for CVE-2010-3864 and crosschecking with
rfc4366 and rfc4366bis I noticed that some text was removed or lost
from the description of the Server Name Indication extension
for rfc4366->rfc4366bis.


The IMHO most important part that was lost is:

    "MUST compare ... case-insensitively."

and OpenSSL appears to perform a case-sensitive match (strncmp) only.


A fairly superficial "grep" TLS Email archives didn't highlight any
discussion that led to the dismissal of that text, but I might well
be overlooking messages.

Original Text text is:
https://tools.ietf.org/html/rfc4366#page-10

   "HostName" contains the fully qualified DNS hostname of the server,
   as understood by the client.  The hostname is represented as a byte
   string using UTF-8 encoding [UTF8], without a trailing dot.

   If the hostname labels contain only US-ASCII characters, then the
   client MUST ensure that labels are separated only by the byte 0x2E,
   representing the dot character U+002E (requirement 1 in Section 3.1
   of [IDNA] notwithstanding).  If the server needs to match the
   HostName against names that contain non-US-ASCII characters, it MUST
   perform the conversion operation described in Section 4 of [IDNA],
   treating the HostName as a "query string" (i.e., the AllowUnassigned
   flag MUST be set).  Note that IDNA allows labels to be separated by
   any of the Unicode characters U+002E, U+3002, U+FF0E, and U+FF61;
   therefore, servers MUST accept any of these characters as a label
   separator.  If the server only needs to match the HostName against
   names containing exclusively ASCII characters, it MUST compare ASCII
   names case-insensitively.

   Literal IPv4 and IPv6 addresses are not permitted in "HostName".

New text is:
https://tools.ietf.org/html/draft-ietf-tls-rfc4366-bis-12#page-8

  "HostName" contains the fully qualified DNS hostname of the server,
   as understood by the client. The hostname is represented as a byte
   string using ASCII encoding without a trailing dot. This allows the
   support of internationalized domain names through the use of A-labels
   defined in [RFC5890].

   Literal IPv4 and IPv6 addresses are not permitted in "HostName".


-Martin