Subject: [Tools-discuss] https for xml2rfc.ietf.org [was: Re: Something odd going on with DNS for xml.resource.org]

From: Daniel Kahn Gillmor <[email-masked]>
Date: Mon, 07 Jul 2014 16:49:14 -0400

On Mon 2014-06-02 07:35:57 -0400, Henrik Levkowetz wrote:
> Not sure why this would be, but I'd recommend you to start using xml2rfc.ietf.org
> for the online xml2rfc service -- we're headed that way.

The domain xml2rfc.ietf.org doesn't work properly under https, even if
i ignore the certificate mismatch:

8 dkg@alice:/tmp/cdtemp.aQm9lJ$ wget https://xml2rfc.ietf.org/public/rfc/bibxml/reference.RFC.2119.xml
--2014-07-07 16:43:09--  https://xml2rfc.ietf.org/public/rfc/bibxml/reference.RFC.2119.xml
Resolving xml2rfc.ietf.org (xml2rfc.ietf.org)... 64.170.98.42, 2001:1890:123a::1:2a
Connecting to xml2rfc.ietf.org (xml2rfc.ietf.org)|64.170.98.42|:443... connected.
GnuTLS: A TLS warning alert has been received.
GnuTLS: received alert [112]: The server name sent was not recognized
The certificate's owner does not match hostname ‘xml2rfc.ietf.org’
5 dkg@alice:/tmp/cdtemp.aQm9lJ$ wget --no-check-certificate  https://xml2rfc.ietf.org/public/rfc/bibxml/reference.RFC.2119.xml
--2014-07-07 16:43:14--  https://xml2rfc.ietf.org/public/rfc/bibxml/reference.RFC.2119.xml
Resolving xml2rfc.ietf.org (xml2rfc.ietf.org)... 64.170.98.42, 2001:1890:123a::1:2a
Connecting to xml2rfc.ietf.org (xml2rfc.ietf.org)|64.170.98.42|:443... connected.
GnuTLS: A TLS warning alert has been received.
GnuTLS: received alert [112]: The server name sent was not recognized
The certificate's owner does not match hostname ‘xml2rfc.ietf.org’
HTTP request sent, awaiting response... 404 Not Found
2014-07-07 16:43:15 ERROR 404: Not Found.

8 dkg@alice:/tmp/cdtemp.aQm9lJ$ 

Given that xml2rfc uses this domain to fetch critical data over the
network, it seems like we should get this working with https.

i note that the cert actually matches if i use the domain name
xml2rfc.tools.ietf.org, but the web server still doesn't provide the
data under https (it only provides the data via http).

xml2rfc fetches this data over the network and uses it directly, which
creates a fairly large attack surface for the tool.  Using cleartext
http instead of https expands the attack surface for xml2rfc to the
entire network path :/

can we use https for this?  I'd be fine with the slightly longer
hostname xml2rfc.tools.ietf.org if it meant we got to use https.

         --dkg

---

From: Henrik Levkowetz <[email-masked]>
Date: Mon, 07 Jul 2014 22:53:56 +0200

Hi Daniel,

> i ignore the certificate mismatch:

Yes, I know.  No disagreement at all.  I'm simply a bit overwhelmed with
things that need to be taken care of.  I'll get there.

Best regards,

	Henrik

---

From: [email-masked] (Dale R. Worley)
Date: Mon, 7 Jul 2014 17:15:46 -0400

> From: Daniel Kahn Gillmor <[email-masked]>

> i ignore the certificate mismatch:

More exactly, the server presents a certificate with "Common name:
*.tools.ietf.org", which of course, doesn't match xml2rfc.ietf.org.

You can see this with
http://www.sslshopper.com/ssl-checker.html#hostname=xml2rfc.ietf.org

Dale