Re: request for change handling hostStrictVerify

On 26/10/2021 22:46, [email protected] wrote:

> - Squid enforces the Client to use SNI! (currently, this is not done and 
> can be considered as a security issue, because you can bypass any 
> hostname rules)

I don't think you can get away with requiring SNI everywhere.  There is 
still software in the wild which doesn't present an SNI.

Worse: there is software in the wild that presents an SNI that doesn't 
have a matching DNS record!  (I'm looking at you Apple).

However, you can probably change to an improved behaviour if there is an 
SNI which resolves and matches the URI and Host: header, whilst still 
supporting broken clients.

-- 
- Steve Hill
    Technical Director | Cyfarwyddwr Technegol
    Opendium    Online Safety & Web Filtering     http://www.opendium.com
                Diogelwch Ar-Lein a Hidlo Gwefan

    Enquiries | Ymholiadau:   [email protected]     +44-1792-824568
    Support   | Cefnogi:      [email protected]   +44-1792-825748

------------------------------------------------------------------------
Opendium Limited is a company registered in England and Wales.
Mae Opendium Limited yn gwmni sydd wedi'i gofrestru yn Lloegr a Chymru.

Company No. | Rhif Cwmni:   5465437
Highfield House, 1 Brue Close, Bruton, Somerset, BA10 0HY, England.

_______________________________________________
squid-dev mailing list
[email protected]
http://lists.squid-cache.org/listinfo/squid-dev

begin:vcard
fn:Steve Hill
n:Hill;Steve
org:Opendium Limited
adr:1 Brue Close;;Highfield House;Bruton;Somerset;BA10 0HY;England
email;internet:[email protected]
title:Technical Director
x-mozilla-html:FALSE
url:https://www.opendium.com
version:2.1
end:vcard