<div dir="ltr"><div dir="ltr"><br></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Thu, Sep 23, 2021 at 9:34 AM Peter van Dijk <<a href="mailto:peter.van.dijk@powerdns.com">peter.van.dijk@powerdns.com</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">On Wed, 2021-09-22 at 20:13 -0400, Warren Kumari wrote:<br>
> Oh, testing now gives a different / working result:<br>
> <br>
> $ curl -v <a href="https://www.deltamath.com" rel="noreferrer" target="_blank">https://www.deltamath.com</a> --connect-to deltamath.com:443:172.64.80.1 2>&1 | grep "HTTP/2 200"<br>
> <br>
<br>
This one sends a Server Name Indication of <a href="http://www.deltamath.com" rel="noreferrer" target="_blank">www.deltamath.com</a> (like with<br>
'openssl s_client -connect <a href="http://172.64.80.1:443" rel="noreferrer" target="_blank">172.64.80.1:443</a> -servername <a href="http://deltapath.com" rel="noreferrer" target="_blank">deltapath.com</a>').<br>
<br>
> <br>
> > Yes, 172.64.80.1 is a CF address, but it was being returned for <a href="http://deltamath.com" rel="noreferrer" target="_blank">deltamath.com</a>.<br>
> > Doing a GET / over TLS with the host set to <a href="http://deltamath.com" rel="noreferrer" target="_blank">deltamath.com</a> was giving a 403 Forbidden:<br>
> > HTTP/1.1 403 Forbidden<br>
<br>
This one is reproducible by not sending an SNI (like with 'openssl<br>
s_client -connect 172.64.80.1:443').<br>
<br>
As far as I can tell -right now-, the IP is entirely valid for the<br>
site, as long as the client sends the correct SNI and Host header<br>
(which web browsers do!).<br></blockquote><div><br></div><div>Hah! That explains at least some of my testing issues.</div><div>When I was testing this issue it was from a machine without curl -- and so I used openssl and manually typed the HTTP, I didn't include -servername:</div><div>$ echo -e "GET / HTTP/1.1\r\nHost:<a href="http://deltamath.com">deltamath.com</a>\r\n\r\n" | openssl 2>&1 s_client -quiet -connect <a href="http://172.64.80.1:443">172.64.80.1:443</a><br>depth=2 C = IE, O = Baltimore, OU = CyberTrust, CN = Baltimore CyberTrust Root<br>verify return:1<br>depth=1 C = US, O = "Cloudflare, Inc.", CN = Cloudflare Inc ECC CA-3<br>verify return:1<br>depth=0 C = US, ST = California, L = San Francisco, O = "Cloudflare, Inc.", CN = <a href="http://sni.cloudflaressl.com">sni.cloudflaressl.com</a><br>verify return:1<br>HTTP/1.1 403 Forbidden<br>Server: cloudflare<br>Date: Wed, 22 Sep 2021 18:36:57 GMT<br>Content-Type: text/html<br>Content-Length: 151<br>Connection: keep-alive<br>CF-RAY: 692da44bb84eeb39-LAX<br><br><html><br><head><title>403 Forbidden</title></head><br><body><br><center><h1>403 Forbidden</h1></center><br><hr><center>cloudflare</center><br></body><br></html><br>^C<br></div><div><br></div><div>This gave a different result to testing against the other addresses, which just error out:</div><div>$ echo -e "GET / HTTP/1.1\r\nHost:<a href="http://deltamath.com">deltamath.com</a>\r\n\r\n" | openssl 2>&1 s_client -quiet -connect <a href="http://104.26.2.229:443">104.26.2.229:443</a></div>140607395013952:error:14094410:SSL routines:ssl3_read_bytes:sslv3 alert handshake failure:../ssl/record/rec_layer_s3.c:1544:SSL alert number 40</div><div class="gmail_quote"><br></div><div class="gmail_quote">I didn't really bother wondering *why* the "working" ones were giving me an SSL failure though. </div><div class="gmail_quote"><br></div><div class="gmail_quote">Adding '-servername <a href="http://deltamath.com">deltamath.com</a>' does at least fix that, but now I've made CF sufficiently grumpy by sending odd requests that it's popping up a CAPTCHA :-)</div><div class="gmail_quote"><br></div><div class="gmail_quote">Whatever the case, the fact that William was experiencing issues when this particular address was returned, and it seems to be the only one that responds in this way when no SNI is provided is, um, interesting. Perhaps whatever his customer was using isn't a web browser, or is really old, or (being part of a school system) passes through some sort of interception proxy which doesn't interact well, or...</div><div class="gmail_quote"><br></div><div class="gmail_quote">W</div><div class="gmail_quote"><br><div><br></div><div><br></div><div><br></div><div> </div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
<br>
Kind regards,<br>
-- <br>
Peter van Dijk<br>
PowerDNS.COM BV - <a href="https://www.powerdns.com/" rel="noreferrer" target="_blank">https://www.powerdns.com/</a><br>
<br>
_______________________________________________<br>
dns-operations mailing list<br>
<a href="mailto:dns-operations@lists.dns-oarc.net" target="_blank">dns-operations@lists.dns-oarc.net</a><br>
<a href="https://lists.dns-oarc.net/mailman/listinfo/dns-operations" rel="noreferrer" target="_blank">https://lists.dns-oarc.net/mailman/listinfo/dns-operations</a><br>
</blockquote></div><br clear="all"><div><br></div>-- <br><div dir="ltr" class="gmail_signature"><div dir="ltr">The computing scientist’s main challenge is not to get confused by the<br>complexities of his own making. <br> -- E. W. Dijkstra</div></div></div>