Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add check to prevent the use of IP addresses as SNI hostnames #7483

Merged
merged 1 commit into from
Jan 12, 2024
Merged

Add check to prevent the use of IP addresses as SNI hostnames #7483

merged 1 commit into from
Jan 12, 2024

Conversation

new-sashok724
Copy link

@new-sashok724 new-sashok724 commented Jan 6, 2024

Fixes #3676 (kind of).

When I attempt to add my mail server using a literal IPv6 address, I get the following error:

Screenshot

The error occurs because the constructor of javax.net.ssl.SNIHostName fails to parse the hostname. This behavior is consistent with RFC 6066, which explicitly prohibits using literal IPv4 or IPv6 addresses as SNI hostnames.

This PR fixes the problem by adding the corresponding check before setting the SNI hostname for the SSL/TLS connection.
The other problems mentioned in the original issue are no longer relevant, since the server settings validator was recently updated to accept literal IPv6 addresses.

Copy link
Member

@cketti cketti left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for the pull request ❤️

Can you please move the IP address check outside of setSniHost() so we end up with

if (HostNameUtils.INSTANCE.isLegalIPAddress(host) == null) {
    setSniHost(socketFactory, sslSocket, host);
}

@new-sashok724 new-sashok724 requested a review from cketti January 12, 2024 07:00
@cketti cketti merged commit d02c7c0 into thunderbird:main Jan 12, 2024
2 checks passed
@cketti
Copy link
Member

cketti commented Jan 12, 2024

Thanks 👍

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Ipv6 address not possible for server
2 participants