grpc
/
grpc-java
mirror of https://github.com/grpc/grpc-java.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

okhttp: Skip enabling SNI and session ticket for fake/test host names (#6949) 

Work around for cases (usually for tests) where hostname is overridden for test certs and it is in invalid syntax.
This commit is contained in:
Chengyuan Zhang 2020-04-21 00:30:01 +00:00 committed by GitHub
parent 6bcc182b1b
commit eb8e31409e
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 15 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

16
okhttp/src/main/java/io/grpc/okhttp/OkHttpProtocolNegotiator.java
View File

@ -19,6 +19,7 @@ package io.grpc.okhttp;
import static com.google.common.base.Preconditions.checkNotNull;
import com.google.common.annotations.VisibleForTesting;
import io.grpc.internal.GrpcUtil;
import io.grpc.okhttp.internal.OptionalMethod;
import io.grpc.okhttp.internal.Platform;
import io.grpc.okhttp.internal.Platform.TlsExtensionType;
@ -235,7 +236,11 @@ class OkHttpProtocolNegotiator {
SSLParameters sslParams = sslSocket.getSSLParameters();
try {
// Enable SNI and session tickets.
if (hostname != null) {
// Hostname is normally validated in the builder (see checkAuthority) and it should
// virtually always succeed. Check again here to avoid troubles (e.g., hostname with
// underscore) enabling SNI, which works around cases where checkAuthority is disabled.
// See b/154375837.
if (hostname != null && isValidHostName(hostname)) {
if (SSL_SOCKETS_IS_SUPPORTED_SOCKET != null
&& (boolean) SSL_SOCKETS_IS_SUPPORTED_SOCKET.invoke(null, sslSocket)) {
SSL_SOCKETS_SET_USE_SESSION_TICKET.invoke(null, sslSocket, true);
@ -356,4 +361,13 @@ class OkHttpProtocolNegotiator {
}
return result.toArray(new String[0]);
}
private static boolean isValidHostName(String name) {
try {
GrpcUtil.checkAuthority(name);
return true;
} catch (IllegalArgumentException e) {
return false;
}
}
}