hostnames with trailing dot, testcases, fix for gnutls

[icing]

• add test_01_07 for successful verification with a trailing dot
• add test_01_08 for expected failure with double dot
• fix gnutls to use the normalized SNI name for checking when available
• refs domain name with trailing dot fails the certificate check when using gnutls #13428

[bagder]

Back to the never-ending mess that is trailing dots. AFAIK, it should not use the SNI name to verify the host name in the certificates.

RFC 2818 section 3.1 says:

In general, HTTP/TLS requests are generated by dereferencing a URI.
As a consequence, the hostname for the server is known to the client.
If the hostname is available, the client MUST check it against the
server's identity as presented in the server's Certificate message,
in order to prevent man-in-the-middle attacks.

The hostname here has a trailing dot. The SNI name does not. Should the verification not get done with the hostname?

RFC 9525 section 6.1 is less specific but says:

The inputs used by the client to construct its list of reference identifiers might be a URI that a user has typed into an interface (e.g., an HTTPS URL for a website)

Again, that is the hostname. Not the SNI name.

But... clearly these TLS libraries fail to verify the name with the dot...

[icing]

Yes, the mess with trailing dots in dns names. Not sure what is the best way forward.

We set peer->sni if it is a DNS name, do a strlower and remove one trailing dot if present. We have then two options

1. always use peer->hostname and let verification fail if the TLS library does not handle a trailing dot.
2. use our peer->sni to work around for these libraries.

I am not sure what is better. Please advise and I adapt the PR. At least we'll have test cases then.

[bagder]

I've asked GnuTLS to clarify the situation (they want the name provided without a trailing dot) in their docs: https://gitlab.com/gnutls/gnutls/-/issues/1548

[bagder]

A TLS server cannot make a difference between name and name. since the latter is not legal and thus it will always assume the name has no trailing dot. I think we can (under protest) agree to passing in the SNI name in the hostname field if that is what the TLS library insists we need to do.

[icing]

I am closing this. I moved the test cases over to #13386 and reverted the gnutls workaround (for now).