Changes/IDNA2008

Switch libidn-using applications to IDNA2008

Summary

The proposed change is about deprecating libidn, which supports IDNA2003, and switch all applications using libidn, to libidn2 2.0.0, which supports IDNA2008.

Owner

• Name: Nikos Mavrogiannopoulos, Robert Scheck
• Email: nmav@redhat.com, robert@fedoraproject.org
• Release notes owner:

Current status

• Targeted release: Fedora 28
• Last updated: 2017-09-06
• Tracker bug: #1445151

• Package conversion tracker bug: #1439723

Detailed Description

Internationalized domain names exist for quite some time (IDNA2003), although the protocols describing them have evolved in an incompatible way (IDNA2008). These incompatibilities will prevent applications written for IDNA2003 to access certain problematic domain names defined with IDNA2008, e.g., faß.de is translated to domain xn--fa-hia.de with IDNA2008, while in IDNA2003 it is translated to fass.de domain. That not only causes incompatibility problems, but may be used as an attack vector to redirect users to different web sites.

The proposed change is about deprecating libidn, which supports IDNA2003, and switch all applications using libidn, to libidn2 2.0.0, which supports IDNA2008. The switch should be transparent as the libidn2 library is API compatible.

Note that even in the web browsers, field there is much confusion on the topic. Chromium appears to use IDNA2008 transitional (i.e., IDNA2003 mapping for the problematic characters), while Firefox and Safari have already moved to IDNA2008.

For more information see:

• http://nmav.gnutls.org/2017/04/the-mess-with-internationalized-domain.html
• https://www.plesk.com/blog/what-is-the-problem-with-s/
• http://unicode.org/faq/idn.html#6

Benefit to Fedora

The transparent nature of the switch, ensures that application users, will benefit from the switch to the new protocol, avoid any incompatibilities with certain parts of the domain system, and prevent attacks to domain system related with IDNA2003 and IDNA2008 incompatibilities.

Scope

• Proposal owners:

The proposal owner is expected to co-ordinate and fill the required bugs on the distribution.

• Other developers:

Maintainers, should

* Verify that their software is linked with the libidn library
* Update the software from upstream if it already has been converted to libidn2
* Check the libidn2 instructions on converting a package to libidn2.
* Propose patches (trivial task) to convert to libidn2, and notify upstream about it.

In short switch software from libidn to libidn2, it is sufficient replacing idna.h header with idn2.h.

• Release engineering: #Releng issue number (a check of an impact with Release Engeneering is needed)

This feature requires not action from release engineering.

• • List of deliverables:

This will bring:

* An updated libidn2 library in Fedora 27 (2.0.0 or later) - already in F25
* A switch of all applications to libidn2
* libidn will be deprecated but not removed as applications may explicitly require IDNA2003 support (e.g., for compatibility)

• Policies and guidelines:

Currently Fedora has no guidelines for IDNA support. With this change the recommended guideline for applications would be to support IDNA2008 by default.

• Trademark approval:

N/A (not needed for this Change)

Upgrade/compatibility impact

This will not have any upgrade/compatibility impact.

How To Test

* Verify whether access to 'faß.de' resolves to 'xn--fa-hia.com'; that is application dependent

User Experience

This should not have noticeable user experience impact. Users impacted are the ones already using IDNA2003, though given the current state of the protocol, and the fact that registrars and NICs already support IDNA2008, this experience is already broken.

Dependencies

All packages depending on libidn: cone, echoping, fedfs-utils-lib, finch, freeDiameter, getdns, ghostscript-core, gloox, hesiod, iris, jabberd, kdelibs3, lftp, libcurl, libgsasl, libpsl, libpurple, loudmouth, perdition, php-pecl-http, swiften, systemd

Contingency Plan

• Contingency mechanism: (What to do? Who will do it?) N/A (not a System Wide Change)
• Contingency deadline: N/A (not a System Wide Change)
• Blocks release? N/A (not a System Wide Change), Yes/No
• Blocks product? product

Documentation

N/A (not a System Wide Change)

Release Notes

The Fedora system switches libidn users from IDNA2003 to IDNA2008.