2 ms·
During the development of rustls, we also found a similar bug in Apple's TLS stack. We reported that to Apple and they fixed it. So it is feasible -- at scale
by ctz 5y ago
During the development of rustls, we also found a similar bug in Apple's TLS stack. We reported that to Apple and they fixed it.
So it is feasible -- at scale -- for TLS clients to validate that DNS names in the SNI extension really are DNS names, and are not IP addresses or bits of URL.
- opheliate 5y agoThank you so much for your work on rustls by the way, such a great library, and the results of the last audit were very impressive :)
- zinekeller 5y ago> During the development of rustls, we also found a similar bug in Apple's TLS stack. Was Windows' Schannel also tested? Or this is simply due to the dev team having access to Linux and macOS?