fluent / fluent/fluent-bit

TLS handshakes failure when connecting to a specific rsyslog server via IPv6

Open
#11,815 3 comments 0 reactions 1 assignee Claimed by @edsiper View on GitHub
bug fixed
Dominant language
C
Stars
8.1k
Forks
2k
Avg merge
4d 20h
Merged PRs (30d)
71

Description

## Bug Report

**Describe the bug**
In our setup, fluent-bit has to forward logs to a rsyslog server running with a valid certificate for the IPv6 address its bound to.

We're attempting to use the fluent-bit to connect directly to this server via its IPv6 address and port directly, rather than using a fully qualified domain name. When doing so the fluent-bit incorrectly sets the Server Name Indicator (SNI) in its TLS handshake to the target IPv6 address.

GnuTls in rsyslog server rejects the request due to the SNI being invalid. Below error seen:
`rsyslogd[989975]: GnuTLS handshake retry returned error: A disallowed SNI server name has been received. [v8.2112.0 try https://www.rsyslog.com/e/2083 ]`

Always uses the SNI extension, regardless of whether its connecting to an IP address or a hostname.

Image

**To Reproduce**

**Expected behavior**
Background on the TLS Server Name Indication extension

Server Name Indication (SNI) is an extension to the Transport Layer Security (TLS) computer networking protocol by which a client indicates which hostname it is attempting to connect to at the start of the handshaking process.[1] This allows a server to present multiple certificates on the same IP address and TCP port number and hence allows multiple secure (HTTPS) websites (or any other service over TLS) to be served by the same IP address without requiring all those sites to use the same certificate.

https://en.wikipedia.org/wiki/Server_Name_Indication

According to the SNI TLS extension spec the SNI in a TLS handshake must be set to a fully qualified domain name, not an IP address:

"HostName" contains the fully qualified DNS hostname of the server, as understood by the client. ... Literal IPv4 and IPv6 addresses are not permitted in "HostName".

https://tools.ietf.org/html/rfc6066#section-3

I expect fluent-bit only use the SNI TLS extension when its connecting to a domain name. This will make fluent-bit use of SNI spec compliant.

**Your Environment**
**Screenshots**
Image

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.