Troubleshooting Tip: Issue with case sensitivity in domain fronting

Description

This article describes an issue in domain fronting related with a mismatch in case sensitivity between the SNI and host header.

Scope

FortiOS 7.6.6.

Solution

On FortiOS 7.6.6, the domain fronting denies the traffic which can come with a Server Name Indication (SNI) in uppercase, while the host header in the request is in lowercase.

For example, the SNI of the traffic is: 'EXAMPLE.COM' and the host header is: 'example.com'. In this case, the FortiGate will deny the traffic through domain fronting and on the traffic logs will be shown the message: 'Traffic denied because of domain fronting'. On the Web filter, UTM logs will be shown: 'Domain fronting detected' and 'HTTP Host <http://example.com> does not match SNI <http://EXAMPLE.COM>':

Traffic log:

date=YYYY-MM-DD time=HH:MM:SS eventtime=<event_time> tz <time_zone> 
logid="0000000013" type="traffic" subtype="forward" level="notice" vd=<VDOM_name> 
srcip=<Source_IP> srcport <Source_Port> srcintf <Source_Interface> 
srcintfrole="undefined" dstip <Destnation_IP> dstport=<Destination_Port> 
dstintf <Destination_Interface> dstintfrole="undefined" srccountry="Reserved" 
dstcountry <Destination_Country> sessionid=<Session_ID> proto=6 action="deny" 
policyid <Policy_ID> policytype="policy_type" poluuid=<Policy_UUID> service="HTTPS" 
trandisp="noop" duration=<duration> sentbyte=<sent_byte> rcvdbyte=<received_byte> 
sentpkt=<sent_packet> rcvdpkt=<received_packet> appcat="unscanned" utmaction="block" 
countweb=1 msg="Traffic denied because of domain fronting" utmref=65498-0

Web filter UTM log:

date=YYYY-MM-DD time=HH:MM:SS eventtime=<event_time> tz=<time_zone> 
logid="0320013318" type="utm" subtype="webfilter" eventtype="domain-fronting" 
level="notice" vd=<VDOM_name> policyid=<Policy_ID> poluuid=<Policy_UUID> 
policytype="policy_type" sessionid=<Session_ID> 
srcip=<Source_IP> srcport=<Source_Port> srccountry="Reserved" 
srcintf=<Source_Interface> srcintfrole="undefined" srcuuid=<Source_UUID> 
dstip=<Destnation_IP> dstport <Destination_Port> dstcountry=<Destination_Country> 
dstintf=<Destination_Interface> dstintfrole="undefined" dstuuid=<Destination_UUID> 
proto=6 httpmethod="GET" service="HTTPS" hostname="example.com" agent="curl/7.68.0" 
profile="protocol" action="blocked" reqtype="direct" url="https://EXAMPLE.COM/" 
sentbyte=<sent_byte> rcvdbyte=<received_byte> direction="outgoing" msg="Domain 
fronting detected" rawdata="HTTP Host <http://example.com> does not match SNI 
<http://EXAMPLE.COM>"

This issue is fixed in FortiOS 7.6.7 and 8.0.0.