Subject: [TLS] Server name extension extensibility problem

From: Mike <[email-masked]>
Date: Wed, 07 May 2008 08:02:57 -0700

Hi,

The server_name extension contains a ServerNameList, where:

   struct {
       NameType name_type;
       select (name_type) {
           case host_name: HostName;
       } name;
   } ServerName;

   enum {
       host_name(0), (255)
   } NameType;

   opaque HostName<1..2^16-1>;

   struct {
       ServerName server_name_list<1..2^16-1>
   } ServerNameList;

The text states that this may be extended in the future to
other name types, but I don't think that would be possible.

Suppose you were to add a new NameType and define a new
structure to hold the name.  Software that doesn't know
about the new name type won't know how to skip past it
while parsing the server_name_list, since ServerName is
currently only fully specified for a host_name.

I suppose you could restrict server_name_list to list the
ServerNames in order (host_name first, then the next-
defined name type, and so on), so software could simply
stop decoding once it encounters a type it doesn't know
about, but it's probably too late to do that since there
is already an installed base.

Mike
_______________________________________________
TLS mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/tls

---

From: "[email-masked]" <[email-masked]>
Date: Thu, 8 May 2008 14:40:06 +0300

Good catch! 

I think this could be solved by requiring that all future
name types start with two-byte length field (same as
host_name), so implementations would be able to skip 
past it.

Best regards,
Pasi 

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] On 
> Behalf Of ext Mike
> Sent: 07 May, 2008 18:03
> To: [email-masked]
> Subject: [TLS] Server name extension extensibility problem
> 
> Hi,
>

---

From: Mike <[email-masked]>
Date: Fri, 09 May 2008 11:49:46 -0700

> This sounds good to me as well.

Then the definition could be changed to:

   struct {
       NameType name_type;
       Name     server_name;
   } ServerName;

   enum {
       host_name(0), (255)
   } NameType;

   opaque Name<1..2^16-1>;

   struct {

With text along the lines of, "when name_type is host_name,
server_name is interpreted as an ASCII domain name...."

Mike

---

From: Eric Rescorla <[email-masked]>
Date: Fri, 09 May 2008 11:35:48 -0700

-Ekr