[java-openws COMMIT] /branches/REL_1/src/main/java/org/opensaml/ws/soap/client/http/TLSProtocolSocketFactory.java

[noreply at shibboleth.net]

Author: putmanb
Date: Mon Sep 28 20:29:52 2015
New Revision: 481

URL: http://svn.shibboleth.net/view/java-openws?rev=481&view=rev
Log:
JOWS-47: TLSProtocolSocketFactory should not verify hostname from SSLSession getPeerHost()

This is provisional fix. Will do more testing before we finalize it.

Modified:
    branches/REL_1/src/main/java/org/opensaml/ws/soap/client/http/TLSProtocolSocketFactory.java

Modified: branches/REL_1/src/main/java/org/opensaml/ws/soap/client/http/TLSProtocolSocketFactory.java
URL: http://svn.shibboleth.net/view/java-openws/branches/REL_1/src/main/java/org/opensaml/ws/soap/client/http/TLSProtocolSocketFactory.java?rev=481&r1=480&r2=481&view=diff
==============================================================================
--- branches/REL_1/src/main/java/org/opensaml/ws/soap/client/http/TLSProtocolSocketFactory.java	(original)
+++ branches/REL_1/src/main/java/org/opensaml/ws/soap/client/http/TLSProtocolSocketFactory.java	Mon Sep 28 20:29:52 2015
@@ -155,21 +155,21 @@
     /** {@inheritDoc} */
     public Socket createSocket(String host, int port) throws IOException {
         Socket socket = sslContext.getSocketFactory().createSocket(host, port);
-        verifyHostname(socket);
+        verifyHostname(socket, host);
         return socket;
     }
 
     /** {@inheritDoc} */
     public Socket createSocket(String host, int port, InetAddress localHost, int clientPort) throws IOException {
         Socket socket = sslContext.getSocketFactory().createSocket(host, port, localHost, clientPort);
-        verifyHostname(socket);
+        verifyHostname(socket, host);
         return socket;
     }
 
     /** {@inheritDoc} */
     public Socket createSocket(Socket socket, String host, int port, boolean autoClose) throws IOException {
         Socket newSocket = sslContext.getSocketFactory().createSocket(socket, host, port, autoClose);
-        verifyHostname(socket);
+        verifyHostname(socket, host);
         return newSocket;
     }
 
@@ -183,7 +183,7 @@
         SocketFactory socketfactory = sslContext.getSocketFactory();
         if (timeout == 0) {
             Socket socket = socketfactory.createSocket(host, port, localHost, localPort);
-            verifyHostname(socket);
+            verifyHostname(socket, host);
             return socket;
         } else {
             Socket socket = socketfactory.createSocket();
@@ -191,7 +191,7 @@
             SocketAddress remoteaddr = new InetSocketAddress(host, port);
             socket.bind(localaddr);
             socket.connect(remoteaddr, timeout);
-            verifyHostname(socket);
+            verifyHostname(socket, host);
             return socket;
         }
     }
@@ -213,10 +213,42 @@
      * 
      * @throws SSLException if the hostname does not verify against the peer's certificate, 
      *          or if there is an error in performing the evaluation
+     *          
+     * @deprecated Use instead {@link #verifyHostname(Socket, String)
      */
     protected void verifyHostname(Socket socket) throws SSLException {
+        if (!(socket instanceof SSLSocket)) {
+            return;
+        }
+        
+        SSLSocket sslSocket = (SSLSocket) socket;
+        
+        try {
+            SSLSession sslSession = sslSocket.getSession();
+            verifyHostname(sslSocket, sslSession.getPeerHost());
+        } catch (Throwable t) {
+            // Make sure we close the socket on any kind of Exception, RuntimeException or Error.
+            cleanUpFailedSocket(sslSocket);
+            throw new SSLException("Error in deprecated verifyHostname(Socket)", t);
+        }
+    }
+    
+    /**
+     * Verifies the peer's hostname using the configured {@link HostnameVerifier}.
+     * 
+     * @param socket the socket connected to the peer whose hostname is to be verified.
+     * @param hostname the caller-supplied hostname to verify
+     * 
+     * @throws SSLException if the hostname does not verify against the peer's certificate, 
+     *          or if there is an error in performing the evaluation
+     */
+    protected void verifyHostname(Socket socket, String hostname) throws SSLException {
         if (hostnameVerifier == null) {
             return;
+        }
+        
+        if (hostname == null) {
+            throw new SSLException("Supplied hostname was null, skipping hostname verification and terminating");
         }
         
         if (!(socket instanceof SSLSocket)) {
@@ -230,11 +262,6 @@
             if (!sslSession.isValid()) {
                 throw new SSLException("SSLSession was invalid: Likely implicit handshake failure: " 
                         + "Set system property javax.net.debug=all for details");
-            }
-            
-            String hostname = sslSession.getPeerHost();
-            if (hostname == null) {
-                throw new SSLException("SSLSession peerHost was null, skipping hostname verification and terminating");
             }
             
             if (!hostnameVerifier.verify(hostname, sslSession)) {