aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorDaniel Gultsch <daniel@gultsch.de>2015-10-15 18:06:26 +0200
committerDaniel Gultsch <daniel@gultsch.de>2015-10-15 18:06:26 +0200
commit5b271e1ed8b4b51f4bddc1cf088ebb80d51e5566 (patch)
tree1446475162a5099f23fe5c30f271c3ffa715c631
parente75c2cd731fd7fa55d5f57a07af42911f271a5cc (diff)
more checks for xmppdomainverifier and better wildcard handling
Diffstat (limited to '')
-rw-r--r--src/main/java/eu/siacs/conversations/crypto/XmppDomainVerifier.java14
1 files changed, 10 insertions, 4 deletions
diff --git a/src/main/java/eu/siacs/conversations/crypto/XmppDomainVerifier.java b/src/main/java/eu/siacs/conversations/crypto/XmppDomainVerifier.java
index 0052998e..f882e04e 100644
--- a/src/main/java/eu/siacs/conversations/crypto/XmppDomainVerifier.java
+++ b/src/main/java/eu/siacs/conversations/crypto/XmppDomainVerifier.java
@@ -14,6 +14,7 @@ import org.bouncycastle.asn1.x500.style.IETFUtils;
import org.bouncycastle.cert.jcajce.JcaX509CertificateHolder;
import java.io.IOException;
+import java.security.cert.Certificate;
import java.security.cert.X509Certificate;
import java.util.ArrayList;
import java.util.Collection;
@@ -29,8 +30,12 @@ public class XmppDomainVerifier implements HostnameVerifier {
@Override
public boolean verify(String domain, SSLSession sslSession) {
try {
- X509Certificate[] chain = (X509Certificate[]) sslSession.getPeerCertificates();
- Collection<List<?>> alternativeNames = chain[0].getSubjectAlternativeNames();
+ Certificate[] chain = sslSession.getPeerCertificates();
+ if (chain.length == 0 || !(chain[0] instanceof X509Certificate)) {
+ return false;
+ }
+ X509Certificate certificate = (X509Certificate) chain[0];
+ Collection<List<?>> alternativeNames = certificate.getSubjectAlternativeNames();
List<String> xmppAddrs = new ArrayList<>();
List<String> srvNames = new ArrayList<>();
List<String> domains = new ArrayList<>();
@@ -80,7 +85,7 @@ public class XmppDomainVerifier implements HostnameVerifier {
}
}
if (srvNames.size() == 0 && xmppAddrs.size() == 0 && domains.size() == 0) {
- X500Name x500name = new JcaX509CertificateHolder(chain[0]).getSubject();
+ X500Name x500name = new JcaX509CertificateHolder(certificate).getSubject();
RDN[] rdns = x500name.getRDNs(BCStyle.CN);
for(int i = 0; i < rdns.length; ++i) {
domains.add(IETFUtils.valueToString(x500name.getRDNs(BCStyle.CN)[i].getFirst().getValue()));
@@ -97,7 +102,8 @@ public class XmppDomainVerifier implements HostnameVerifier {
for(String entry : haystack) {
if (entry.startsWith("*.")) {
int i = needle.indexOf('.');
- if (i != -1 && needle.substring(i).equals(entry.substring(2))) {
+ Log.d(LOGTAG,"comparing "+needle.substring(i)+ " and "+entry.substring(1));
+ if (i != -1 && needle.substring(i).equals(entry.substring(1))) {
Log.d(LOGTAG,"domain "+needle+" matched "+entry);
return true;
}