Changeset: 361441253305 for monetdb-java
URL: https://dev.monetdb.org/hg/monetdb-java/rev/361441253305
Modified Files:
src/main/java/org/monetdb/mcl/net/SecureSocket.java
tests/TLSTester.java
Branch: monetdbs
Log Message:
Send SNI (Server Name Indication)
diffs (75 lines):
diff --git a/src/main/java/org/monetdb/mcl/net/SecureSocket.java
b/src/main/java/org/monetdb/mcl/net/SecureSocket.java
--- a/src/main/java/org/monetdb/mcl/net/SecureSocket.java
+++ b/src/main/java/org/monetdb/mcl/net/SecureSocket.java
@@ -8,6 +8,8 @@ import java.security.*;
import java.security.cert.CertificateException;
import java.security.cert.CertificateFactory;
import java.security.cert.X509Certificate;
+import java.util.Collections;
+import java.util.List;
public class SecureSocket {
private static final String[] ENABLED_PROTOCOLS = {"TLSv1.3"};
@@ -16,32 +18,29 @@ public class SecureSocket {
public static Socket wrap(Target.Validated validated, Socket inner) throws
IOException {
Target.Verify verify = validated.connectVerify();
SSLSocketFactory socketFactory;
+ boolean checkName = true;
try {
switch (verify) {
case System:
socketFactory = (SSLSocketFactory)
SSLSocketFactory.getDefault();
- return wrapSocket(inner, validated, socketFactory, true);
+ break;
case Cert:
- KeyStore keyStore =
keyStoreForCert(validated.getCert());
- socketFactory = certBasedSocketFactory(keyStore);
- return wrapSocket(inner, validated, socketFactory, true);
+ KeyStore keyStore = keyStoreForCert(validated.getCert());
+ socketFactory = certBasedSocketFactory(keyStore);
+ break;
case Hash:
- return wrapHash(validated, inner);
+ socketFactory =
hashBasedSocketFactory(validated.connectCertHashDigits());
+ checkName = false;
+ break;
default:
throw new RuntimeException("unreachable: unexpected
verification strategy " + verify.name());
}
+ return wrapSocket(inner, validated, socketFactory, checkName);
} catch (CertificateException e) {
throw new SSLException(e.getMessage(), e);
}
}
- private static Socket wrapHash(Target.Validated validated, Socket inner)
throws IOException, CertificateException {
- SSLSocketFactory socketFactory =
hashBasedSocketFactory(validated.connectCertHashDigits());
- SSLSocket sock = wrapSocket(inner, validated, socketFactory, false);
-
- return sock;
- }
-
private static SSLSocket wrapSocket(Socket inner, Target.Validated
validated, SSLSocketFactory socketFactory, boolean checkName) throws
IOException {
SSLSocket sock = (SSLSocket) socketFactory.createSocket(inner,
validated.connectTcp(), validated.connectPort(), true);
@@ -50,6 +49,8 @@ public class SecureSocket {
if (checkName) {
SSLParameters parameters = sock.getSSLParameters();
+ SNIServerName serverName = new SNIHostName(validated.connectTcp());
+ parameters.setServerNames(Collections.singletonList(serverName));
parameters.setEndpointIdentificationAlgorithm("HTTPS");
sock.setSSLParameters(parameters);
}
diff --git a/tests/TLSTester.java b/tests/TLSTester.java
--- a/tests/TLSTester.java
+++ b/tests/TLSTester.java
@@ -132,7 +132,7 @@ public class TLSTester {
// test_connect_client_auth2();
test_fail_tls_to_plain();
test_fail_plain_to_tls();
-// test_connect_server_name();
+ test_connect_server_name();
// test_connect_alpn_mapi9();
test_connect_trusted();
test_refuse_trusted_wrong_host();
_______________________________________________
checkin-list mailing list -- [email protected]
To unsubscribe send an email to [email protected]
