runtime: IPv6 addresses not correctly formatted in Host headers

The new SocketsHttpHandler does not correctly format IPv6 addresses in host headers.

Repro:

            var client = new HttpClient();
            var response = await client.GetAsync("http://[::1]:5001");

Actual output:

      GET / HTTP/1.1
      Host: ::1:5001

Expected output: Host: [::1]:5001

Always include the brackets, even if there isn’t a port.

Code: https://github.com/dotnet/corefx/blob/f14366baaa80a893e53934b98e9786dac54c136f/src/System.Net.Http/src/System/Net/Http/SocketsHttpHandler/HttpConnectionPool.cs#L124 https://github.com/dotnet/corefx/blob/f14366baaa80a893e53934b98e9786dac54c136f/src/System.Net.Http/src/System/Net/Http/SocketsHttpHandler/HttpConnectionPoolManager.cs#L191-L195

Found by ASP.NET Core Kestrel functional tests. https://github.com/aspnet/KestrelHttpServer/issues/2406

Priority: Not preview blocking, but RTM blocking.

@karelz

About this issue

Original URL
State: closed
Created 6 years ago
Comments: 15 (15 by maintainers)

Most upvoted comments

From MSDN: https://msdn.microsoft.com/en-us/library/system.uri.dnssafehost(v=vs.110).aspx

For IPv6 addresses, the brackets ([]) are removed and the ScopeId property is set, if one was specified when this instance was constructed.

Probably we cannot fix it in the Uri level.

caesar-chen on Mar 28, 2018

Actually, that is a bug. Passing in Uri.Host will potentially pass in Unicode host names to the WinHTTP API. And that API can’t accept that. Unfortunately, we have no tests around this.

We should use Uri.IdnHost for passing into WinHTTP.

See: https://msdn.microsoft.com/en-us/library/windows/desktop/aa384091(v=vs.85).aspx

pswzServerName [in] Pointer to a null-terminated string that contains the host name of an HTTP server. Alternately, the string can contain the IP address of the site in ASCII, for example, 10.0.1.45. Note that WinHttp does not accept international host names without converting them first to Punycode. For more information, see Handling Internationalized Domain Names (IDNs).

davidsh on Mar 29, 2018

The help for Uri class says: The RFC 3490 compliant International Domain Name of the host, using Punycode as appropriate. This string, after being unescaped if necessary, is safe to use for DNS resolution.

I think that should not include [] as they are not legal in DNS.

wfurt on Mar 29, 2018

According to https://tools.ietf.org/html/rfc7230#section-5.4 https://tools.ietf.org/html/rfc3986#section-3.2.2

IPv6 addresses in Host header should be enclosed in square brackets.

I will fix it.

caesar-chen on Mar 28, 2018