Shib IdP - Metadata Download and Java 1.7.0_85

[Takeshi NISHIMURA]

I think you should not rely on sslSession.getPeerHost() returning original hostnames. It seems like returning IP addresses on the latest versions of JDK.

This issue may be resolved if you pass the original hostname to verifyHostname() in [1].

Sincerely,
Takeshi

[1] http://svn.shibboleth.net/view/java-openws/branches/REL_1/src/main/java/org/opensaml/ws/soap/client/http/TLSProtocolSocketFactory.java?view=markup

On 2015/07/23 10:16, Cantor, Scott wrote:
> On 7/22/15, 6:39 PM, "users on behalf of Brent Putman" <users-bounces at shibboleth.net on behalf of putmanb at georgetown.edu> wrote:
>
>
>>
>> For the original issue in v2 where someone noticed IP address metadata URLs mysteriously passing validation [1], I'm still not 100% sure why it was.  Only thing I can think of is:  we evaluate the cert against what is returned from SSLSession#getPeerHost().
>> If *that* is the place (or one of the places) where they were doing the reverse lookup, then that makes sense.  If not, then I still don't know how it was working there.
>
> That seems plausible. What a mess.
>
>> That's correct.  I'm not seeing how this change affects our hostname verification process in either v2 or v3, given that we aren't using AFAIK any JDK code for that, nor does not-yet-commons-ssl nor HttpClient v4 (modulo SSLSession#getPeerHost() in v2. Not
>> applicable in v3).  Based on the log, the OP seems to be on v2.
>
> That confirms my understanding. I didn't think we were routing anything through that code.
>
> -- Scott