Uploaded image for project: 'WildFly EJB HTTP Client'
  1. WildFly EJB HTTP Client
  2. WEJBHTTP-74

The http ejb client should use the servers hostname for the TLS SNI extension during handshake

    XMLWordPrintable

Details

    Description

      Currently the IP address of the server used for the Server Name Indication (SNI) during the handshake. In setups with multiple virtual severs on the same IP the handshake might fail.

       

       

      Quotes from Transport Layer Security (TLS) Extensions: Extension Definitions RFC:

      3. Server Name Indication

      TLS does not provide a mechanism for a client to tell a server the name of the server it is contacting.  It may be desirable for clients to provide this information to facilitate secure connections to servers that host multiple 'virtual' servers at a single underlying network address… 

      and

      … "HostName" contains the fully qualified DNS hostname of the server, as understood by the client… 

      and

      … Literal IPv4 and IPv6 addresses are not permitted in "HostName”…

      Source: https://datatracker.ietf.org/doc/html/rfc6066#page-6

       

      In our setup we use a single Apache httpd to load balance several virtual servers with different DNS records, so when the client uses the IP address of the Apache load balancer during the handshake, the Apache server doesn’t know which virtual server the client is attempting to connect to and the connection is dropped by Apache during the handshake.

      So far we have worked around the issue by patching the HttpConnectionPool to use the hostname instead IP when creating connections. This of course breaks the HostPool in setups where multiple IPs serve a single DNS, but in our case that's not an issue.

      Attachments

        Issue Links

          depends on

          Feature Request - Feature requests from customers and/or users UNDERTOW-2198 Add Option to force the SNIHostName

          • Critical - To be worked on immediately following BLOCKER issues.
          • Closed
          is cloned by

          Bug - A problem that impairs or prevents the functions of the product. JBEAP-24157 [GSS](7.4.z) WEJBHTTP-74 - The http ejb client should use the servers hostname for the TLS SNI extension during handshake

          • Major - To be worked after higher priority work items are addressed. When the severity is high and the effort to change it is low to moderate, this term is chosen. Issues in this category likely have an existing workaround but implementation or execution may be non-trivial.
          • Verified
          is incorporated by

          Component Upgrade - A task tracking an update to a bundled component or revision of component upstream of the project. WFLY-17415 Upgrade WildFly HTTP Client from 2.0.0.Final to 2.0.1.Final

          • Major - To be worked after higher priority work items are addressed. When the severity is high and the effort to change it is low to moderate, this term is chosen. Issues in this category likely have an existing workaround but implementation or execution may be non-trivial.
          • Closed

          Activity

            People

              rhn-support-rmartinc Ricardo Martin Camarero
              ab-exerp Andreas Bube (Inactive)
              Votes:
              1 Vote for this issue
              Watchers:
              6 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved: