[issue17997] ssl.match_hostname(): sub string wildcard should not match IDNA prefix
Christian Heimes
report at bugs.python.org
Sat May 18 16:35:44 CEST 2013
Christian Heimes added the comment:
It's called "internationalized domain name for APPLICATIONS". ;) It's up to the application to interpret the ASCII text as IDNA encoded FQDNs. As far as I know DNS, SSL's CNAME and OS interfaces etc. always use ASCII labels. It's an elegant solution. Just the UI part of an application needs to understand IDNA.
http://tools.ietf.org/html/rfc6125#section-6.4.2
If the DNS domain name portion of a reference identifier is an
internationalized domain name, then an implementation MUST convert
any U-labels [IDNA-DEFS] in the domain name to A-labels before
checking the domain name. In accordance with [IDNA-PROTO], A-labels
MUST be compared as case-insensitive ASCII. Each label MUST match in
order for the domain names to be considered to match, except as
supplemented by the rule about checking of wildcard labels
(Section 6.4.3; but see also Section 7.2 regarding wildcards in
internationalized domain names).
Coincidentally the same RFC contains matching rules for wild card certs
http://tools.ietf.org/html/rfc6125#section-6.4.3
If a client matches the reference identifier against a presented
identifier whose DNS domain name portion contains the wildcard
character '*', the following rules apply:
1. The client SHOULD NOT attempt to match a presented identifier in
which the wildcard character comprises a label other than the
left-most label (e.g., do not match bar.*.example.net).
2. If the wildcard character is the only character of the left-most
label in the presented identifier, the client SHOULD NOT compare
against anything but the left-most label of the reference
identifier (e.g., *.example.com would match foo.example.com but
not bar.foo.example.com or example.com).
3. The client MAY match a presented identifier in which the wildcard
character is not the only character of the label (e.g.,
baz*.example.net and *baz.example.net and b*z.example.net would
be taken to match baz1.example.net and foobaz.example.net and
buzz.example.net, respectively). However, the client SHOULD NOT
attempt to match a presented identifier where the wildcard
character is embedded within an A-label or U-label [IDNA-DEFS] of
an internationalized domain name [IDNA-PROTO].
----------
_______________________________________
Python tracker <report at bugs.python.org>
<http://bugs.python.org/issue17997>
_______________________________________
More information about the Python-bugs-list
mailing list