You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@hc.apache.org by ol...@apache.org on 2018/10/23 07:33:28 UTC
httpcomponents-client git commit: Hack to make hostname verification
work with TLSv1.3 resumed sessions
Repository: httpcomponents-client
Updated Branches:
refs/heads/master 3e5df337c -> d799a588e
Hack to make hostname verification work with TLSv1.3 resumed sessions
Project: http://git-wip-us.apache.org/repos/asf/httpcomponents-client/repo
Commit: http://git-wip-us.apache.org/repos/asf/httpcomponents-client/commit/d799a588
Tree: http://git-wip-us.apache.org/repos/asf/httpcomponents-client/tree/d799a588
Diff: http://git-wip-us.apache.org/repos/asf/httpcomponents-client/diff/d799a588
Branch: refs/heads/master
Commit: d799a588efe3d58ca7a7f04602f1b927ceda9476
Parents: 3e5df33
Author: Oleg Kalnichevski <ol...@apache.org>
Authored: Sun Oct 21 19:47:11 2018 +0200
Committer: Oleg Kalnichevski <ol...@apache.org>
Committed: Tue Oct 23 09:28:40 2018 +0200
----------------------------------------------------------------------
.../client5/http/ssl/TlsSessionValidator.java | 24 +++++++++++++++++++-
1 file changed, 23 insertions(+), 1 deletion(-)
----------------------------------------------------------------------
http://git-wip-us.apache.org/repos/asf/httpcomponents-client/blob/d799a588/httpclient5/src/main/java/org/apache/hc/client5/http/ssl/TlsSessionValidator.java
----------------------------------------------------------------------
diff --git a/httpclient5/src/main/java/org/apache/hc/client5/http/ssl/TlsSessionValidator.java b/httpclient5/src/main/java/org/apache/hc/client5/http/ssl/TlsSessionValidator.java
index 8ddea11..380e138 100644
--- a/httpclient5/src/main/java/org/apache/hc/client5/http/ssl/TlsSessionValidator.java
+++ b/httpclient5/src/main/java/org/apache/hc/client5/http/ssl/TlsSessionValidator.java
@@ -39,6 +39,8 @@ import javax.net.ssl.SSLPeerUnverifiedException;
import javax.net.ssl.SSLSession;
import javax.security.auth.x500.X500Principal;
+import org.apache.hc.core5.http.ParseException;
+import org.apache.hc.core5.http.ProtocolVersion;
import org.slf4j.Logger;
final class TlsSessionValidator {
@@ -97,7 +99,27 @@ final class TlsSessionValidator {
}
if (hostnameVerifier != null) {
- final Certificate[] certs = sslsession.getPeerCertificates();
+ final Certificate[] certs;
+ try {
+ certs = sslsession.getPeerCertificates();
+ } catch (final SSLPeerUnverifiedException ex) {
+
+ // FIXME: This is very dodgy.
+ // If peer certificates are unavailable and the TLS version is 1.3 or greater
+ // _assume_ this is due to PSK (pre-shared key) TLS session resumption
+ // Resumed TLS sessions do not include server certificates.
+
+ try {
+ final ProtocolVersion tls = TLS.parse(sslsession.getProtocol());
+ if (tls.greaterEquals(TLS.V_1_3.version)) {
+ return;
+ } else {
+ throw ex;
+ }
+ } catch (final ParseException ex2) {
+ throw ex;
+ }
+ }
if (certs.length < 1) {
throw new SSLPeerUnverifiedException("Peer ceritifate chain is empty");
}