Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix(s2n-tls-hyper): Add proper IPv6 address formatting #4938

Merged
merged 4 commits into from
Dec 3, 2024

Conversation

goatgoose
Copy link
Contributor

@goatgoose goatgoose commented Nov 26, 2024

Description of changes:

s2n-tls-hyper provides s2n-tls-tokio with a server name by parsing the host out of the URI for an HTTP request. s2n-tls uses the http::uri:::Uri::host() API to do this:

let host = req.host().unwrap_or("").to_owned();

Per RFC 3986, IPv6 addresses are enclosed with square brackets in the host section of a URI:
https://datatracker.ietf.org/doc/html/rfc3986#section-3.2.2

   IP-literal = "[" ( IPv6address / IPvFuture  ) "]"

The value returned by the Uri::host() API includes these square brackets. While the square brackets are part of the "host" URI content, they aren't part of the actual address, and should not be sent in the server name or matched against identities in the server's certificate. This PR trims out these square brackets so that s2n-tls-tokio is provided the proper server name when an IPv6 address is specified in an HTTP request.

Call-outs:

None

Testing:

A new test was added that uses a certificate with an IPv6 identity to check that the server name is properly formatted. This test also generally tests s2n-tls-hyper connecting to an IPv6 endpoint.

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.

AaunssA40QcjQFQYI8ADTiQHW20rZcsVRKkwRkNVps/vMDpLBCyBp96xhTAtkoDH
Xs/Zi1bJiJ8xw3TkDeJFShpP+cQPYHI36qWqNjTei9eHrNX8sNFAdNZVyitoZ3/W
FrPdms/ivlvgQbWWB3EKxD+PsQXoYvjkGhMNmg==
-----END CERTIFICATE-----
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Certificate content:

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            4f:58:57:a5:76:45:86:96:de:ab:a5:24:6e:a9:67:38:a0:1e:52:8a
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C=US, ST=MA, L=Boston, O=Amazon, OU=AmazonWebServices, CN=localhost
        Validity
            Not Before: Nov 26 04:52:47 2024 GMT
            Not After : Nov  2 04:52:47 2124 GMT
        Subject: C=US, ST=MA, L=Boston, O=Amazon, OU=AmazonWebServices, CN=localhost
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Modulus:
                    ...
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Key Identifier: 
                4E:BE:C7:F2:CF:FC:A3:6C:A4:A4:A3:B8:E6:3B:EC:A1:BE:BB:F7:80
            X509v3 Authority Key Identifier: 
                4E:BE:C7:F2:CF:FC:A3:6C:A4:A4:A3:B8:E6:3B:EC:A1:BE:BB:F7:80
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Subject Alternative Name: 
                IP Address:0:0:0:0:0:0:0:1
    Signature Algorithm: sha256WithRSAEncryption
    Signature Value:
        ...

@goatgoose goatgoose marked this pull request as ready for review November 26, 2024 05:39
bindings/rust/s2n-tls-hyper/src/connector.rs Outdated Show resolved Hide resolved
bindings/rust/certs/generate.sh Outdated Show resolved Hide resolved
@goatgoose goatgoose enabled auto-merge (squash) December 2, 2024 15:54
@goatgoose goatgoose merged commit 68e5508 into aws:main Dec 3, 2024
38 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants