<html><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; "><br><div><div>On 14 Jul 2009, at 23:10, Christian Schneemann wrote:</div><br class="Apple-interchange-newline"><blockquote type="cite"><div>On Tuesday 14 July 2009 23:36:45 Ton Voon wrote:<br><blockquote type="cite">On 11 Jul 2009, at 21:07, Hendrik Baecker wrote:<br></blockquote><blockquote type="cite"><blockquote type="cite">-----BEGIN PGP SIGNED MESSAGE-----<br></blockquote></blockquote>[...]<br><blockquote type="cite"><blockquote type="cite"><br></blockquote></blockquote><blockquote type="cite"><blockquote type="cite">Your comment related to the IDN Domains is attached to the post, if<br></blockquote></blockquote><blockquote type="cite"><blockquote type="cite">you<br></blockquote></blockquote><blockquote type="cite"><blockquote type="cite">have more ideas on it, please send a message off-list to Ethan,<br></blockquote></blockquote><blockquote type="cite"><blockquote type="cite">Andreas<br></blockquote></blockquote><blockquote type="cite"><blockquote type="cite">Ericsson and Ton Voon.<br></blockquote></blockquote><blockquote type="cite"><br></blockquote><blockquote type="cite">Is there a definitive list of all characters used in IDN Domains?<br></blockquote>"Yes", every character that is possible in a language can be used in an <br>internationalized domain name of that country, that makes a simple whitelist <br>impossible I think.</div></blockquote><div><br></div>I would rather do a whitelist than a blacklist, especially given the nature of the security bug.</div><div><br></div><div>However, I guess a blacklist of "bad shell characters" could be possible.</div><div><br></div><div>Another option is possibly that we scan the nagios objects.dat file and only allow host addresses that have been specified there, which is another form of whitelisting, but allows IDNs.</div><div><br><blockquote type="cite"><div>The iana has special character tables for every possible domain-name. <br><a href="http://www.iana.org/domains/idn-tables/">http://www.iana.org/domains/idn-tables/</a><br><br>I'm playing around with libidn [1], they have functions to check for an <br>allowed IDN domain. Maybe that could help here.<br><br>[1] <a href="http://www.gnu.org/software/libidn/">http://www.gnu.org/software/libidn/</a></div></blockquote><div><br></div>This doesn't appear to be easy to embed into a third party app, but I'd be happy to be proven wrong.</div><div><br></div><div>Ton</div><div><br></div></body></html>