Apache
/
httpcomponents-client
mirror of https://github.com/apache/httpcomponents-client.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

HTTPCLIENT-1097 BrowserCompatHostnameVerifier and StrictHostnameVerifier should handle wildcards in SSL certificates better. 

git-svn-id: https://svn.apache.org/repos/asf/httpcomponents/httpclient/trunk@1130531 13f79535-47bb-0310-9956-ffa450edef68
This commit is contained in:
Sebastian Bazley 2011-06-02 13:08:15 +00:00
parent 4acba49325
commit a41eccec14
3 changed files with 20 additions and 18 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
RELEASE_NOTES.txt
View File

@ -1,5 +1,8 @@
Changes since 4.1.1
* [HTTPCLIENT-1097] BrowserCompatHostnameVerifier and StrictHostnameVerifier should handle wildcards in SSL certificates better.
Contributed by Sebastian Bazley <sebb at apache.org>
* [HTTPCLIENT-1092] If ClientPNames.VIRTUAL_HOST does not provide the port, derive it from the current request.
Contributed by Sebastian Bazley <sebb at apache.org>

29
httpclient/src/main/java/org/apache/http/conn/ssl/AbstractVerifier.java
View File

@ -197,13 +197,21 @@ public abstract class AbstractVerifier implements X509HostnameVerifier {
// The CN better have at least two dots if it wants wildcard
// action. It also can't be [*.co.uk] or [*.co.jp] or
// [*.org.uk], etc...
boolean doWildcard = cn.startsWith("*.") &&
cn.lastIndexOf('.') >= 0 &&
String parts[] = cn.split("\\.");
boolean doWildcard = parts.length >= 3 &&
parts[0].endsWith("*") &&
acceptableCountryWildcard(cn) &&
!isIPAddress(host);
if(doWildcard) {
match = hostName.endsWith(cn.substring(1));
if (parts[0].length() > 1) { // e.g. server*
String prefix = parts[0].substring(0, parts.length-2); // e.g. server
String suffix = cn.substring(parts[0].length()); // skip wildcard part from cn
String hostSuffix = hostName.substring(prefix.length()); // skip wildcard part from host
match = hostName.startsWith(prefix) && hostSuffix.endsWith(suffix);
} else {
match = hostName.endsWith(cn.substring(1));
}
if(match && strictWithSubDomains) {
// If we're in strict mode, then [*.foo.com] is not
// allowed to match [a.b.foo.com]
@ -222,18 +230,11 @@ public abstract class AbstractVerifier implements X509HostnameVerifier {
}
public static boolean acceptableCountryWildcard(String cn) {
int cnLen = cn.length();
if(cnLen >= 7 && cnLen <= 9) {
// Look for the '.' in the 3rd-last position:
if(cn.charAt(cnLen - 3) == '.') {
// Trim off the [*.] and the [.XX].
String s = cn.substring(2, cnLen - 3);
// And test against the sorted array of bad 2lds:
int x = Arrays.binarySearch(BAD_COUNTRY_2LDS, s);
return x < 0;
}
String parts[] = cn.split("\\.");
if (parts.length != 3 || parts[2].length() != 2) {
return true; // it's not an attempt to wildcard a 2TLD within a country code
}
return true;
return Arrays.binarySearch(BAD_COUNTRY_2LDS, parts[1]) < 0;
}
public static String[] getCNs(X509Certificate cert) {

6
httpclient/src/test/java/org/apache/http/conn/ssl/TestHostnameVerifier.java
View File

@ -36,7 +36,6 @@ import java.util.Arrays;
import javax.net.ssl.SSLException;
import org.junit.Assert;
import org.junit.Ignore;
import org.junit.Test;
/**
@ -301,7 +300,6 @@ public class TestHostnameVerifier {
}
@Test
@Ignore("not yet implemented")
public void HTTPCLIENT_1097() {
String cns[];
String alt[] = {};
@ -312,8 +310,8 @@ public class TestHostnameVerifier {
checkMatching(bhv, "a.b.c", cns, alt, false); // OK
checkMatching(shv, "a.b.c", cns, alt, false); // OK
checkMatching(bhv, "s.a.b.c", cns, alt, false); // OK
checkMatching(shv, "s.a.b.c", cns, alt, true); // subdomain not OK
checkMatching(bhv, "a.a.b.c", cns, alt, false); // OK
checkMatching(shv, "a.a.b.c", cns, alt, true); // subdomain not OK
checkWildcard("s*.co.uk", false); // 2 character TLD, invalid 2TLD
checkWildcard("s*.gov.uk", false); // 2 character TLD, invalid 2TLD