[Author Prev][Author Next][Thread Prev][Thread Next][Author Index][Thread Index]
Re: [tor-bugs] #12208 [meek]: Make it possible to use an IP address as a front (no DNS request and no SNI)
#12208: Make it possible to use an IP address as a front (no DNS request and no
SNI)
-----------------------------+-----------------
Reporter: dcf | Owner: dcf
Type: enhancement | Status: new
Priority: normal | Milestone:
Component: meek | Version:
Resolution: | Keywords:
Actual Points: | Parent ID:
Points: |
-----------------------------+-----------------
Comment (by dcf):
A way to do this in Firefox may be
[http://www.oxymoronical.com/experiments/apidocs/interface/nsICertOverrideService
nsICertOverrideService], specifically hasMatchingOverride.
nsiCertOverrideService is the service that manages the overrides that get
added when you click through a certificate warning (which are visible
through PreferencesâAdvancedâCertificatesâView Certificates,
Lifetime=Temporary).
It looks like we can define hasMatchingOverride and request HTTPS to a
CloudFront IP (for example). hasMatchingOverride will get called back. We
check that the error is only ERROR_MISMATCH (and not ERROR_UNTRUSTED or
ERROR_TIME). We check that the commonName in the cert is
"*.cloudfront.net", and return true. In effect, we defer to the normal
verification mechanisms for everything but hostname verification, and for
that we check that the wildcard is what we expect.
[https://github.com/foudfou/skipCertError skipCertError] is a third-party
Firefox extension to automatically ignore certificate errors.
[https://code.google.com/p/selenium/wiki/UntrustedSSLCertificates
Selenium's docs] on hasMatchingOverride.
--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/12208#comment:2>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online
_______________________________________________
tor-bugs mailing list
tor-bugs@xxxxxxxxxxxxxxxxxxxx
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs