more checks for xmppdomainverifier and better wildcard handling

1 files changed, 10 insertions, 4 deletions

diff --git a/src/main/java/eu/siacs/conversations/crypto/XmppDomainVerifier.java b/src/main/java/eu/siacs/conversations/crypto/XmppDomainVerifier.java
index 0052998e9..f882e04e9 100644
--- a/src/main/java/eu/siacs/conversations/crypto/XmppDomainVerifier.java
+++ b/src/main/java/eu/siacs/conversations/crypto/XmppDomainVerifier.java
@@ -14,6 +14,7 @@ import org.bouncycastle.asn1.x500.style.IETFUtils;
 import org.bouncycastle.cert.jcajce.JcaX509CertificateHolder;
 
 import java.io.IOException;
+import java.security.cert.Certificate;
 import java.security.cert.X509Certificate;
 import java.util.ArrayList;
 import java.util.Collection;
@@ -29,8 +30,12 @@ public class XmppDomainVerifier implements HostnameVerifier {
 	@Override
 	public boolean verify(String domain, SSLSession sslSession) {
 		try {
-			X509Certificate[] chain = (X509Certificate[]) sslSession.getPeerCertificates();
-			Collection<List<?>> alternativeNames = chain[0].getSubjectAlternativeNames();
+			Certificate[] chain = sslSession.getPeerCertificates();
+			if (chain.length == 0 || !(chain[0] instanceof X509Certificate)) {
+				return false;
+			}
+			X509Certificate certificate = (X509Certificate) chain[0];
+			Collection<List<?>> alternativeNames = certificate.getSubjectAlternativeNames();
 			List<String> xmppAddrs = new ArrayList<>();
 			List<String> srvNames = new ArrayList<>();
 			List<String> domains = new ArrayList<>();
@@ -80,7 +85,7 @@ public class XmppDomainVerifier implements HostnameVerifier {
 				}
 			}
 			if (srvNames.size() == 0 && xmppAddrs.size() == 0 && domains.size() == 0) {
-				X500Name x500name = new JcaX509CertificateHolder(chain[0]).getSubject();
+				X500Name x500name = new JcaX509CertificateHolder(certificate).getSubject();
 				RDN[] rdns = x500name.getRDNs(BCStyle.CN);
 				for(int i = 0; i < rdns.length; ++i) {
 					domains.add(IETFUtils.valueToString(x500name.getRDNs(BCStyle.CN)[i].getFirst().getValue()));
@@ -97,7 +102,8 @@ public class XmppDomainVerifier implements HostnameVerifier {
 		for(String entry : haystack) {
 			if (entry.startsWith("*.")) {
 				int i = needle.indexOf('.');
-				if (i != -1 && needle.substring(i).equals(entry.substring(2))) {
+				Log.d(LOGTAG,"comparing "+needle.substring(i)+ " and "+entry.substring(1));
+				if (i != -1 && needle.substring(i).equals(entry.substring(1))) {
 					Log.d(LOGTAG,"domain "+needle+" matched "+entry);
 					return true;
 				}