Re: [TLS] 4366bis TLSext SNI -- case-sensitivity, permitted chars

[Martin Rex <[e-mail]>]

Martin Rex wrote:
> 
> 
> 
> Looking at the OpenSSL diffs for CVE-2010-3864 and crosschecking with
> rfc4366 and rfc4366bis I noticed that some text was removed or lost
> from the description of the Server Name Indication extension
> for rfc4366->rfc4366bis.
> 
> 
> The IMHO most important part that was lost is:
> 
>     "MUST compare ... case-insensitively."
> 
> and OpenSSL appears to perform a case-sensitive match (strncmp) only.

To avoid confusions--the comparison that I'm talking about is the
one required by this check (now explicitly spelled out in rfc4366bis):

                                                                      A
   server that implements this extension MUST NOT accept the request to
   resume the session if the server_name extension contains a different
   name. Instead, it proceeds with a full handshake to establish a new
   session. When resuming a session, the server MUST NOT include a
   server_name extension in the server hello.

Case-insensitivity also affects any other comparisons involving the
SNI hostname value, e.g. related to selecting a server credential, 

-Martin