Skip to content

DNS target fails due to hostname checks #572

Description

@Linuus

Describe the bug

I'm trying to connect to GRPC (logging etc) at Google. I tried using the dns:// target. When I try to connect to Google I get this error

[error] unable to establish a connection to https://216.58.207.106:443. reason: %Mint.TransportError{reason: {:tls_alert, {:handshake_failure, ~c"TLS client: In state wait_cert_cr at ssl_handshake.erl:2207 generated CLIENT ALERT: Fatal - Handshake Failure\n {bad_cert,\n     {hostname_check_failed,\n         {requested,\"216.58.207.106\"},\n         {received,\n             [{dNSName,\"*.googleapis.com\"},\n              {dNSName,\"googleapis.com\"},\n
[....]

As you can see it's a hostname check error. The issue is that the grpc library resolves the DNS to an IP and tries to connect to that, so the hostname check fails (IP vs the google domains in certs).

I believe the fix here would be to keep the hostname around and pass it as the hostname option to mint's connect/4 function. See https://mint.hexdocs.pm/Mint.HTTP.html#connect/4

To Reproduce
Steps to reproduce the behavior:

Connect using dns://

Expected behavior

It should connect and not fail the SNI check :)

Logs
If applicable, add logs to help explain your problem.

Protos
If applicable, add protos to help explain your problem.

Versions:

  • OS: -
  • Erlang: 27
  • Elixir: 1.19
  • mix.lock(grpc, gun, cowboy, cowlib): grpc 1.0.3 with Mint adapter

Additional context
Add any other context about the problem here.

Metadata

Metadata

Assignees

No one assigned

    Labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions