Bug 1410130 - Underscore in virtualhost servername or serveralias
Summary: Underscore in virtualhost servername or serveralias
Alias: None
Product: Fedora
Classification: Fedora
Component: httpd
Version: 24
Hardware: x86_64
OS: Linux
Target Milestone: ---
Assignee: Luboš Uhliarik
QA Contact: Fedora Extras Quality Assurance
Depends On:
TreeView+ depends on / blocked
Reported: 2017-01-04 14:36 UTC by anothergituser
Modified: 2017-02-10 15:29 UTC (History)
4 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Last Closed: 2017-02-10 15:29:37 UTC
Type: Bug

Attachments (Terms of Use)

Description anothergituser 2017-01-04 14:36:39 UTC
Description of problem:
Using underscores in servername will result in a 400 Bad Request

Version-Release number of selected component (if applicable):

Steps to Reproduce:

1. add a virtual host with servername and serveralias like test_this.local

2. add to /etc/hosts   test_this.local 

Restart httpd and check http://test_this.local

Actual results:
Will result in 400 Bad Request

Expected results:
A 200 response.

Additional info:

After installing fedora 24 and finding this problem the solution was
dnf downgrade httpd --allowerasing

Which downgraded httpd to version 2.4.18-2.fc24 that accepts underscores.

PS: I'm using a ProxyPassMatch directive in my virtualhost in order to use php54-fpm from remi's repo, but still, the error i report was solved by downgrading httpd to the mentioned version. 

Also 2.4.25-1.fc24 will also work if no underscore is found in the name, like test.local

Comment 1 Joe Orton 2017-02-10 15:29:37 UTC
Underscores are not permitted in hostnames and are now rejected.  RFC 3986 sec 3.2.2 - https://tools.ietf.org/html/rfc3986#section-3.2.2 --

   A registered name intended for lookup in the DNS uses the syntax
   defined in Section 3.5 of [RFC1034] and Section 2.1 of [RFC1123].
   Such a name consists of a sequence of domain labels separated by ".",
   each domain label starting and ending with an alphanumeric character
   and possibly also containing "-" characters.

Using "HttpProtocolOptions unsafe" should allow the old behaviour.


Note You need to log in before you can comment on or make changes to this bug.