[jbosstools-issues] [JBoss JIRA] (JBIDE-19594) SSL callback: provide meaningful hostname verifier, drop always accepting hostnames

[ https://issues.jboss.org/browse/JBIDE-19594?page=com.atlassian.jira.plugi... ] Andre Dietisheim edited comment on JBIDE-19594 at 4/15/15 5:15 AM: ------------------------------------------------------------------- An example of such a hostname verifier can be found in android land: http://developer.android.com/reference/org/apache/http/conn/ssl/BrowserCo... Another one can be found here: https://tersesystems.com/2014/03/23/fixing-hostname-verification/ {code} class DefaultHostnameVerifier extends HostnameVerifier { private val logger = LoggerFactory.getLogger(getClass) def hostnameChecker: HostnameChecker = HostnameChecker.getInstance(HostnameChecker.TYPE_TLS) def matchKerberos(hostname: String, principal: Principal) = HostnameChecker.`match`(hostname, principal.asInstanceOf[KerberosPrincipal]) def isKerberos(principal: Principal): Boolean = principal != null && principal.isInstanceOf[KerberosPrincipal] def verify(hostname: String, session: SSLSession): Boolean = { logger.debug(s"verify: hostname = $hostname") val checker = hostnameChecker val result = try { session.getPeerCertificates match { case Array(cert: X509Certificate, _*) => try { checker.`match`(hostname, cert) // Certificate matches hostname true } catch { case e: CertificateException => // Certificate does not match hostname logger.debug("verify: Certificate does not match hostname", e) false } case notMatch => // Peer does not have any certificates or they aren't X.509 logger.debug(s"verify: Peer does not have any certificates: $notMatch") false } } catch { case _: SSLPeerUnverifiedException => // Not using certificates for verification, try verifying the principal try { val principal = session.getPeerPrincipal if (isKerberos(principal)) { matchKerberos(hostname, principal) } else { // Can't verify principal, not Kerberos logger.debug(s"verify: Can't verify principal, not Kerberos") false } } catch { case e: SSLPeerUnverifiedException => // Can't verify principal, no principal logger.debug("Can't verify principal, no principal", e) false } } logger.debug("verify: returning {}", result) result } } {code} was (Author: adietish): An example of such a hostname verifier can be found in android land: http://developer.android.com/reference/org/apache/http/conn/ssl/BrowserCo... -- This message was sent by Atlassian JIRA (v6.3.11#6341)