Subject: [Tools-discuss] FYI: tools.ietf.org over plain HTTP may present wrong site

From: Edwin Balani <[email-masked]>
Date: Wed, 13 Apr 2022 17:31:07 +0100

I originally sent a wordier version of the below to 
[email-masked] a few months ago, but saw nothing out of it.  
It is an issue with web redirect configuration on one of the hosts 
serving tools.ietf.org.

Short of re-mailing the same people, I did stumble upon the notice [1] 
regarding tools.ietf.org.  I guess the above address might not be so 
closely watched any more, so tools-discuss can have this instead.  I 
can't find mention in the list archive, so please consider it both a 
problem report and a general FYI.

--

Depending on which server you hit for any page on http://tools.ietf.org/ 
you are either redirected to the same path under HTTPS, or you get the 
content for Henrik's personal site, http://levkowetz.com/ .

Currently I see tools.ietf.org served by two hosts, dechaunac and 
zinfandel.  The http -> https redirect is only missing on zinfandel.  
Compare
     curl -i http://dechaunac.tools.ietf.org -H 'Host: tools.ietf.org'
and
     curl -i http://zinfandel.tools.ietf.org -H 'Host: tools.ietf.org'

Accordingly, anything under http://tools.ietf.org/ appears to be a dead 
link if your client happens to hit zinfandel:
     curl -i http://zinfandel.tools.ietf.org/html/rfc5822 -H 'Host: tools.ietf.org'

I think the issue is as plain as zinfandel serving levkowetz.com content 
under HTTP (not HTTPS) virtualhost tools.ietf.org:
     curl -i http://zinfandel.tools.ietf.org/pets.html -H 'Host: tools.ietf.org'

(compare http://levkowetz.com/pets.html )

As for how I chanced upon this: I followed hyperlinks in the wild to 
RFCs [2] [3] from [4].

[1]: https://mailarchive.ietf.org/arch/msg/ietf/0n-6EXEmkTp3Uv_vj-5Vnm3o0bo/
[2]: http://tools.ietf.org/html/rfc4408
[3]: http://tools.ietf.org/html/rfc4871
[4]: https://sendersupport.olc.protection.outlook.com/pm/policies.aspx

-- 
Edwin Balani

---

From: Robert Sparks <[email-masked]>
Date: Wed, 13 Apr 2022 11:52:11 -0500

Yes, this occasionally happens, only over http. Henrik hasn't been able 
to fix it, but we're very close to the point where we will de-delegate 
tools.ietf.org (I'm expecting by mid-May at this point). The workaround 
in the meantime is to use https:

RjS

On 4/13/22 11:31 AM, Edwin Balani wrote:
> Depending on which server you hit for any page on 
> http://tools.ietf.org/ you are either redirected to the same path 
> under HTTPS, or you get the content for Henrik's personal site, 
> http://levkowetz.com/ .
>
> Accordingly, anything under http://tools.ietf.org/ appears to be a 
> dead link if your client happens to hit zinfandel:
> I think the issue is as plain as zinfandel serving levkowetz.com 
> content under HTTP (not HTTPS) virtualhost tools.ietf.org:
> [1]: 
> https://mailarchive.ietf.org/arch/msg/ietf/0n-6EXEmkTp3Uv_vj-5Vnm3o0bo/