Velocity Reviews - Computer Hardware Reviews

Velocity Reviews > Newsgroups > Programming > Java > Adding hostname verification to SSLSocket

Reply
Thread Tools

Adding hostname verification to SSLSocket

 
 
Ian Pilcher
Guest
Posts: n/a
 
      03-02-2013
I am working with a library that can use an application-provided
SSLSocketFactory to create its SSL connections. I would like to ensure
that all of its connections enforce hostname verification, which the
default SSLSocket implementation does not do.

It's tempting to simply write an SSLSocketFactory that does the hostname
verification in its various createSocket(...) methods, but this
obviously won't cover the case where a socket is created in an
unconnected state with createSocket() and connected later. (It's also
not at all clear from the documentation that connect(...) can't be
called on a connected socket to connect it to a different server.)

So it seems that doing this the "right" way is going to require an
SSLSocket implementation -- something like this:

public final class HostVerifyingSSLSocketextends SSLSocket
{
private final SSLSocket socket;
private final HostnameVerifier verifier;

public HostVerifyingSSLSocket(SSLSocket socket,
HostnameVerifier verifier)
throws SSLHandshakeException
{
this.socket = socket;
this.verifier = verifier;
if (socket.isConnected()) {
verify();
}
}

private void verify() throws SSLHandshakeException
{
SSLSession session = socket.getSession();
if (!verifier.verify(session.getPeerHost(), session)) {
IOException closeException = null;
try {
socket.close();
} catch (IOException ioe) {
closeException = ioe;
}
SSLHandshakeException she =
new SSLHandshakeException("Bummer");
if (closeException != null) {
she.addSuppressed(closeException);
}
throw she;
}
}

// Delegate all Socket and SSLSocket methods to socket ...


The question is which of the delegated methods need a call to verify().
I'm thinking that connect(), startHandshake(), and getSession() are the
only methods that need this. (And getHandshakeSession() is right out.)

public void connect(SocketAddress endpoint) throws IOException
{
socket.connect(endpoint);
verify();
}

public void connect(SocketAddress endpoint, int timeout)
throws IOException
{
socket.connect(endpoint, timeout);
verify();
}

public void startHandshake() throws IOException
{
socket.startHandshake();
verify();
}

public SSLSession getSession()
{
try {
Session session = socket.getSession();
validate();
return session;
} catch (SSLHandshakeException she) {
return ERROR_SESSION; // Need to create this. Uugh.
}
}

public SSLSession getHandshakeSession()
{
throw new UnsupportedOperationException("Sorry");
}

Any others? Anyone see any fundamental problem with this approach
(other than the fact that it's a ton of mostly boilerplate code to work
around the fact that HandshakeCompletedListener.handShakeCompleted(...)
isn't allowed to throw a checked exception)?

Thanks!

--
================================================== ======================
Ian Pilcher http://www.velocityreviews.com/forums/(E-Mail Removed)
Sometimes there's nothing left to do but crash and burn...or die trying.
================================================== ======================
 
Reply With Quote
 
 
 
 
Roedy Green
Guest
Posts: n/a
 
      03-04-2013
On Sat, 02 Mar 2013 13:02:51 -0600, Ian Pilcher <(E-Mail Removed)>
wrote, quoted or indirectly quoted someone who said :

> I would like to ensure
>that all of its connections enforce hostname verification, which the
>default SSLSocket implementation does not do.



Are you sure about that? IIRC I had the opposite problem link
checking with links with a mismatch considered bad. Mis-matches are
extremely common, particularly for large companies with many servers.
--
Roedy Green Canadian Mind Products http://mindprod.com
One thing I love about having a website, is that when I complain about
something, I only have to do it once. It saves me endless hours of
grumbling.
 
Reply With Quote
 
 
 
 
Arne Vajh°j
Guest
Posts: n/a
 
      03-07-2013
On 3/2/2013 2:02 PM, Ian Pilcher wrote:
> I am working with a library that can use an application-provided
> SSLSocketFactory to create its SSL connections. I would like to ensure
> that all of its connections enforce hostname verification, which the
> default SSLSocket implementation does not do.
>
> It's tempting to simply write an SSLSocketFactory that does the hostname
> verification in its various createSocket(...) methods, but this
> obviously won't cover the case where a socket is created in an
> unconnected state with createSocket() and connected later. (It's also
> not at all clear from the documentation that connect(...) can't be
> called on a connected socket to connect it to a different server.)
>
> So it seems that doing this the "right" way is going to require an
> SSLSocket implementation -- something like this:


> Any others? Anyone see any fundamental problem with this approach
> (other than the fact that it's a ton of mostly boilerplate code to work
> around the fact that HandshakeCompletedListener.handShakeCompleted(...)
> isn't allowed to throw a checked exception)?


If you are using SSL for HTTPS, then I think that
HttpsURLConnection.setDefaultHostnameVerifier would be obvious. But
I assume that is not the case.

Arne




 
Reply With Quote
 
 
 
Reply

Thread Tools

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Trackbacks are On
Pingbacks are On
Refbacks are Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
sslsocket getInputStream() == Slow ? cmk128@hotmail.com Java 4 08-03-2005 01:04 PM
RMI: take ip/hostname what client was using and give it back as aremote objects hostname AWieminer Java 0 07-12-2005 08:05 PM
Disable SSL-encryption on a SSLSocket Elian Kool Java 3 03-11-2005 05:44 AM
SSLSocket Exception in javamail news Java 1 11-20-2003 05:43 PM
adding hostname to iis 6 Fabien Dehopre ASP .Net 0 08-12-2003 09:56 AM



Advertisments