Re: [TLS] Server Name Indication (SNI) in an IPv6 world?

[Marsh Ray <[e-mail]>]

On 10/27/2010 12:22 PM, Steingruebl, Andy wrote:
>> What?! If clients are willing to make non-SSL connections and are
>> also subject to DNS rebinding, then Host headers are the least of
>> your problems.
>
> Sorry, my point is that preventing DNS rebinding relies on client
> security in many ways, but to make it happen a server also has to
> serve content for hostnames it doesn't really serve content for.
> With TLS this is hard(er) to make happen because of certificate
> warnings.  For non-TLS, there aren't any indicators.  Servers should
> be configured to only serve data for their hostnames.  Or, so I'd
> argue.

Ah that makes sense, I was not fully getting your meaning.

Still, who's to say that the thing that gets the incoming connection at 
the re-bound DNS name will necessarily even be an HTTP server? I know 
browsers are increasingly blacklisting known ports, to try to mitigate 
this sort of thing.

It could be mildly discomforting to see an invalid host header printed 
on the address label of an item returned by the postal service after 
installing that high-speed check printer/stuffer/mailer!

- Marsh