Hello,
while playing around(*) with JSSE and howismyssl.com I noticed, that the
Java 8 hostname verifier (algorithm https configured) will reverse
resolve hostnames and use them.
This has two problems, for one it is a performance problem, but for
two, it will verify the cert against an untrusted (DNS response)
parameter. I dont think it is speced that way (at least I could not
find it). So it could fall back to IP literal instead.
This is not a problem if I generate the InetAddr with a ip literal:
destination = InetAddr.getByName("54.245.228.141");
but it is a problem if I construct an unresolved address:
destination = InetAddress.getByAddress(
new byte[] {54,(byte)245,(byte)228,(byte)141});
In the first case, it will result in (expected):
Caused by: java.security.cert.CertificateException: No subject
alternative names matching IP address 54.245.228.141 found
In the second case, however it will result in:
Caused by: java.security.cert.CertificateException:
No subject alternative DNS name matching
ec2-54-245-228-141.us-west-2.compute.amazonaws.com found.
I typically use the getByAddress form as it allows me to control
resolving. It is enough to use this form:
destination = InetAddress.getByAddress("54.245.228.141",
new byte[] {54,(byte)245,(byte)228,(byte)141});
However I noticed in the code there are some conditionals for
unresolved peer addresses. I just wonder if they should catch this and
avoid the reverse lookup, or not?
(I actually wanted to make sure hostname verification is not skipped,
no matter how I configure it).
Gruss
Bernd
(*)
https://github.com/ecki/JavaCryptoTest/blob/master/src/main/java/net/eckenfels/test/howsmyssl/Client.java#L31
