Re: A selection of SSL bugs...

At 20:24 22.10.98 +0200, Henrik Nordstrom wrote:
>rstagg@csc.com wrote:
>> If I try browsing to https://c123456:98765@www.wibble.com, Squid
>> does a CONNECT c123456.ourcomp.co.uk:98 which is clearly duff.
>
>This is most likely not Squid's fault. It is a browser bug. In both
>cases the connect request should be
>
>CONNECT www.wibble.com:443 HTTP/1.0
[...]
>Check what the browser sends to Squid on these requests. My Netscape
>versions sends:
>
>CONNECT c123456:98765@www.wibble.com HTTP/1.0
[...]

Yes, it's a browser bug, but Squid's handling of the situation isn't
perfect, either. It should just refuse to process such a request with
an error message, not try to extract a semblance of a proper host name
and port number from it.

-- 
Tilman Schmidt          E-Mail: Tilman.Schmidt@sema.de (office)
Sema Group Koeln, Germany       tilman@schmidt.bn.uunet.de (private)
"newfs leaves the filesystem in a well known state (empty)."
                                                - Henrik Nordstrom