[tor-bugs] #12208 [meek]: Make it possible to use an IP address as a front (no DNS request and no SNI)

[Tor Bug Tracker & Wiki]

#12208: Make it possible to use an IP address as a front (no DNS request and no
SNI)
-----------------------------+-----------------
     Reporter:  dcf          |      Owner:  dcf
         Type:  enhancement  |     Status:  new
     Priority:  normal       |  Milestone:
    Component:  meek         |    Version:
   Resolution:               |   Keywords:
Actual Points:               |  Parent ID:
       Points:               |
-----------------------------+-----------------

Comment (by dcf):

 A way to do this in Firefox may be
 [http://www.oxymoronical.com/experiments/apidocs/interface/nsICertOverrideService
 nsICertOverrideService], specifically hasMatchingOverride.
 nsiCertOverrideService is the service that manages the overrides that get
 added when you click through a certificate warning (which are visible
 through Preferences→Advanced→Certificates→View Certificates,
 Lifetime=Temporary).

 It looks like we can define hasMatchingOverride and request HTTPS to a
 CloudFront IP (for example). hasMatchingOverride will get called back. We
 check that the error is only ERROR_MISMATCH (and not ERROR_UNTRUSTED or
 ERROR_TIME). We check that the commonName in the cert is
 "*.cloudfront.net", and return true. In effect, we defer to the normal
 verification mechanisms for everything but hostname verification, and for
 that we check that the wildcard is what we expect.

 [https://github.com/foudfou/skipCertError skipCertError] is a third-party
 Firefox extension to automatically ignore certificate errors.

 [https://code.google.com/p/selenium/wiki/UntrustedSSLCertificates
 Selenium's docs] on hasMatchingOverride.

--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/12208#comment:2>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online