public class SMProxyHostnameVerifier
extends java.lang.Object
implements javax.net.ssl.HostnameVerifier
3.1. Server Identity
In general, HTTP/TLS requests are generated by dereferencing a URI. As a consequence, the hostname for the server is known to the client. If the hostname is available, the client MUST check it against the server's identity as presented in the server's Certificate message, in order to prevent man-in-the-middle attacks.
If the client has external information as to the expected identity of the server, the hostname check MAY be omitted. (For instance, a client may be connecting to a machine whose address and hostname are dynamic but the client knows the certificate that the server will present.) In such cases, it is important to narrow the scope of acceptable certificates as much as possible in order to prevent man in the middle attacks. In special cases, it may be appropriate for the client to simply ignore the server's identity, but it must be understood that this leaves the connection open to active attack.
If a subjectAltName extension of type dNSName is present, that MUST be used as the identity. Otherwise, the (most specific) Common Name field in the Subject field of the certificate MUST be used. Although the use of the Common Name is existing practice, it is deprecated and Certification Authorities are encouraged to use the dNSName instead.
Matching is performed using the matching rules specified by [RFC2459]. If more than one identity of a given type is present in the certificate (e.g., more than one dNSName name, a match in any one of the set is considered acceptable.) Names may contain the wildcard character * which is considered to match any single domain name component or component fragment. E.g., *.a.com matches foo.a.com but not bar.foo.a.com. f*.com matches foo.com but not bar.com.
In some cases, the URI is specified as an IP address rather than a hostname. In this case, the iPAddress subjectAltName must be present in the certificate and must exactly match the IP in the URI.
| Constructor and Description |
|---|
SMProxyHostnameVerifier() |
| Modifier and Type | Method and Description |
|---|---|
static SMProxySSLSocketFactory.InetHandling |
getInetHandlingForName(java.lang.String host)
This method checks the given hostname and returns the appropriate type
of InetHandling mode, which will be one of the following:
InetHandling.HOSTNAME
InetHandling.IPADDRESS
This method should be used when creating a socket using the
EntrustSSLSocketFactory when the EntrustSSLSocketFactory.create() method uses
a java.net.InetAddress or the unconnected Socket's connect() method uses
java.net.SocketAddress. |
protected boolean |
getTLSServerNameAndMatch(java.lang.String hostname,
X509Certificate cert)
Extract the TLS servername(s) from the certificate and compare it against the
hostname for a match.
|
boolean |
verify(java.lang.String hostname,
javax.net.ssl.SSLSession sslSession)
Given a hostname and the SSLSession, determine if the Server Identity
check passes according to HTTP Over TLS
RFC 2830.
|
protected boolean |
verifyServer(java.lang.String hostname,
java.lang.String[] names)
Do the comparison using a String array of candidate DNS.
|
boolean |
verifyServer(java.lang.String hostname,
X509Certificate[] certs)
Do the actual Hostname verification.
|
protected boolean |
verifyServerIP(java.lang.String IPString,
java.lang.String[] names)
Do the comparison using the IP address strings converted to network
byte order.
|
public boolean verify(java.lang.String hostname,
javax.net.ssl.SSLSession sslSession)
Matching is performed according to these rules:
verify in interface javax.net.ssl.HostnameVerifierhostname - the hostname being verifiedsslSession - the SSLSession which will be verified against the hostnameHostnameVerifierprotected boolean getTLSServerNameAndMatch(java.lang.String hostname,
X509Certificate cert)
hostname - The hostname being verified in String formatcert - the Certificate whose server names are being checkedpublic boolean verifyServer(java.lang.String hostname,
X509Certificate[] certs)
hostname - the hostname which will be verifiedcerts - the array of certificates which will be verifiedprotected boolean verifyServer(java.lang.String hostname,
java.lang.String[] names)
hostname - the hostname which will be verifiednames - the array of hostnames that will be used to try and find a matchprotected boolean verifyServerIP(java.lang.String IPString,
java.lang.String[] names)
IPString - the IP String that will be converted to a byte[] in
network byte ordernames - The array of IPStrings that will be used to try and find a matchpublic static SMProxySSLSocketFactory.InetHandling getInetHandlingForName(java.lang.String host)
InetHandling.HOSTNAMEInetHandling.IPADDRESSEntrustSSLSocketFactory factory = new EntrustSSLSocketFactory(tm,km,sr); InetSocketAddress address = new InetSocketAddress(host, port); InetHandling inet = EntrustHostnameVerifier.getInetHandlingFor(host); factory.setInetAddressHandling(inet); SSLSocket s = (SSLSocket)factory.createSocket(); s.setEnabledCipherSuites(CIPHER_SUITES); s.connect(address, m_timeout);
host - The hostname String which can either be in a hostname format
(for example 'test.example.com') or IP address format (192.0.2.4).