Subject: Re: [TLS] Connection diversion to other subdomains

From: "Jeffrey A. Williams" <[email-masked]>
Date: Fri, 5 Nov 2010 13:11:39 -0500 (GMT-05:00)

Joe and all,

-----Original Message-----
>From: Joe Orton <[email-masked]>
>Sent: Nov 5, 2010 1:04 PM
>To: Marsh Ray <[email-masked]>
>Cc: IETF TLS WG <[email-masked]>
>Subject: Re: [TLS] Connection diversion to other subdomains
>
>On Fri, Nov 05, 2010 at 12:00:46PM -0500, Marsh Ray wrote:
>> More worryingly,
>> http://www.alphastate.com/x-host-vs-host-headers-in-apache   says:
>> "Apache picks the X-Host header over the Host header, so if there
>> are two different virtual hosts for origin.example.com and
>> www.example.com the request ends up at www.example.com instead of
>> the intended origin.example.com."
>
>That's complete fiction, Apache httpd does no such thing.

  Yeah, I've never seen Apache do as Marsh suggests.  Thanks
for the clairfication Joe.
>
>Regards, Joe
>_______________________________________________
>TLS mailing list
>[email-masked]
>https://www.ietf.org/mailman/listinfo/tls

Regards,
Jeffrey A. Williams
"Obedience of the law is the greatest freedom" -
   Abraham Lincoln

"Credit should go with the performance of duty and not with what is very
often the accident of glory" - Theodore Roosevelt

"If the probability be called P; the injury, L; and the burden, B; liability
depends upon whether B is less than L multiplied by
P: i.e., whether B is less than PL."
United States v. Carroll Towing  (159 F.2d 169 [2d Cir. 1947]
===============================================================
Updated 1/26/04
Network Eng. SR. Eng. Network data security
ABA member in good standing member ID 01257402 
E-Mail [email-masked]
Phone: 214-244-4827

---

From: Matt McCutchen <[email-masked]>
Date: Sun, 07 Nov 2010 01:35:15 -0500

On Sun, 2010-10-31 at 23:42 -0400, Matt McCutchen wrote:
> If the server gets a TLS connection with a bad server_name extension, it
> would be even better to go ahead and fail the handshake with an
> "unrecognized_name" error.  Apache mod_ssl currently is not capable of
> doing this; I might enter an enhancement request.

For anyone interested:

https://issues.apache.org/bugzilla/show_bug.cgi?id=50227

-- 
Matt