Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

.ipfs/api and --api does not parse SNI #9897

Closed
Jorropo opened this issue May 25, 2023 · 5 comments
Closed

.ipfs/api and --api does not parse SNI #9897

Jorropo opened this issue May 25, 2023 · 5 comments
Labels
dif/medium good first issue Good issue for new contributors help wanted Seeking public contribution on this issue kind/bug A bug in existing code (including security flaws) P2 Medium: Good to have, but can wait until someone steps up

Comments

@Jorropo
Copy link
Contributor

Jorropo commented May 25, 2023

If you try to use /dns4/example.com/tcp/443/https you would expect SNI and Host to be properly set but thoses are left blank.

This is because we are directly opening a tcp stream using manet.Dial. We should instead translate the multiaddress to an url and give the correct URL to net/http's client.
Example code that handle properly doing the conversion in libp2p: https://github.com/libp2p/go-libp2p/blob/305282b0cdda802712be5dbcf3b6921912613414/p2p/transport/websocket/addrs.go#L49

@MatthewCroughan
Copy link

More context:

It appears header appears that when using a dns or ip4 multiaddress with the --api flag kubo does not pass the Host: header along to the webserver on the other side. This means that if you're using a reverse proxy then you may not be proxied to the correct location, since the Host: header is used to determine how the network connection is routed.

An example CLI usage would be

ipfs --api /dns4/example.org/tcp/443/tls/http add ./file
ipfs --api /dns4/example.org/tcp/443/https add ./file

Kubo version: 0.21.0-dev
Repo version: 13
System version: amd64/linux
Golang version: go1.19.9

@Jorropo Jorropo added kind/bug A bug in existing code (including security flaws) help wanted Seeking public contribution on this issue good first issue Good issue for new contributors dif/medium P2 Medium: Good to have, but can wait until someone steps up labels Jun 8, 2023
@MattSilvaa
Copy link

Hello! I'm willing to take this on if no one has started yet.

@Kiggins26
Copy link

@MattSilvaa have you done any work towards this, if not we can work on it together?

@MattSilvaa
Copy link

@Kiggins26 I have not started on this, feel free to take it.

@lidel
Copy link
Member

lidel commented Jan 10, 2025

This should be fixed by #10659ipfs id --api /dns/kubo-rpc.example.net/tcp/port/tls/http should hit https://kubo-rpc.example.net:port

Feel free to test latest master branch or docker image ipfs/kubo:master-2025-01-10-3b098b9, or wait for 0.33 (#10580) to be released

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
dif/medium good first issue Good issue for new contributors help wanted Seeking public contribution on this issue kind/bug A bug in existing code (including security flaws) P2 Medium: Good to have, but can wait until someone steps up
Projects
None yet
Development

No branches or pull requests

5 participants