iOS HomeKit client uses invalid characters in the http host header field value for hap requests

Originator:matthias.hochgatterer
Number:rdar://25163791 Date Originated:2016-03-16
Status:Open Resolved:
Product:iOS Product Version:9.2
Classification:Serious Bug Reproducible:Always
 
Summary:
HAP requests are based on HTTP/1.1. iOS uses the published accessory name as the http host header field value for hap requests.
For example, if the accessory name "Test Accessory" is published using mDNS, the iOS HomeKit client establishes a connection with a host header field

    Host: Test\032Accessory._hap._tcp.local

The whitespace (" ") is encoded as \032. But host names must not include a backslash character ("\").

RFC7230 defines Host as

    Host = uri-host [ ":" port ]
    uri-host = <host, see [RFC3986], Section 3.2.2>
    
where uri-host is defined in RFC3986 as

    host = IP-literal / IPv4address / reg-name
    reg-name = *( unreserved / pct-encoded / sub-delims )
    unreserved  = ALPHA / DIGIT / "-" / "." / "_" / "~"
    pct-encoded   = "%" HEXDIG HEXDIG
    sub-delims    = "!" / "$" / "&" / "'" / "(" / ")"
                     / "*" / "+" / "," / ";" / "="

[RFC7230] http://tools.ietf.org/html/rfc7230#section-5.4
[RFC3986] http://tools.ietf.org/html/rfc3986#section-3.2.2

Steps to Reproduce:
1. Publish a HomeKit accessory mDNS service containing whitespaces (" ") in the name
2. Check host header field value of hap request

Expected Results:
Whitespaces in the host header field value should be percentage encoded.

Actual Results:
Whitespace are encoded as "\032"

Version:
iOS 9.2

Notes:
Go1.6 check for valid host names

https://github.com/golang/go/commit/6e11f45ebdbc7b0ee1367c80ea0a0c0ec52d6db5#diff-b97af51863ce82bf2a13003b52034aa9R1088

Configuration:
iPhone 6s

Attachments:

Comments


Please note: Reports posted here will not necessarily be seen by Apple. All problems should be submitted at bugreport.apple.com before they are posted here. Please only post information for Radars that you have filed yourself, and please do not include Apple confidential information in your posts. Thank you!