java.lang.Object
net.i2p.apache.http.conn.ssl.DefaultHostnameVerifier
All Implemented Interfaces:
HostnameVerifier
public final class DefaultHostnameVerifierextends Object implements HostnameVerifier
Default HostnameVerifier implementation.

  • Field Details

    • DNS_NAME_TYPE

      static final int DNS_NAME_TYPE
      DNS name type constant.
      See Also:

    • IP_ADDRESS_TYPE

      static final int IP_ADDRESS_TYPE
      IP address type constant.
      See Also:

    • log

      private final Log log
      Logger instance.

    • publicSuffixMatcher

      private final PublicSuffixMatcher publicSuffixMatcher
      Public suffix matcher.

  • Constructor Details

    • DefaultHostnameVerifier

      public DefaultHostnameVerifier(PublicSuffixMatcher publicSuffixMatcher)
      Create hostname verifier with public suffix matcher.
      Parameters:
      publicSuffixMatcher - public suffix matcher

    • DefaultHostnameVerifier

      public DefaultHostnameVerifier()
      Create hostname verifier with default settings.

  • Method Details

    • verify

      public final boolean verify(String host, SSLSession session)
      Specified by:
      verify in interface HostnameVerifier

    • verify

      public final void verify(String host, X509Certificate cert) throws SSLException
      Verify the hostname against the certificate.
      Parameters:
      host - the DNS name or IP literal to match against the certificate
      cert - the server certificate that must be valid for host
      Throws:
      SSLException - if verification fails

    • matchIPAddress

      static void matchIPAddress(String host, List<String> subjectAlts) throws SSLException
      Match the IP address against subject alternative names.
      Parameters:
      host - the IP address to look for
      subjectAlts - the certificate's subject alternative names, each a bare IP string
      Throws:
      SSLException - if no alternative name equals host

    • matchIPv6Address

      static void matchIPv6Address(String host, List<String> subjectAlts) throws SSLException
      Match the IPv6 address against subject alternative names.
      Parameters:
      host - the IPv6 address to look for
      subjectAlts - the certificate's subject alternative names, in any IPv6 form
      Throws:
      SSLException - if no alternative name normalises to host

    • matchDNSName

      static void matchDNSName(String host, List<String> subjectAlts, PublicSuffixMatcher publicSuffixMatcher) throws SSLException
      Match the DNS name against subject alternative names.
      Parameters:
      host - the DNS name to look for, compared case-insensitively
      subjectAlts - the certificate's subject alternative names
      publicSuffixMatcher - rejects names in a public suffix, null to skip that check
      Throws:
      SSLException - if no alternative name matches host

    • matchCN

      static void matchCN(String host, String cn, PublicSuffixMatcher publicSuffixMatcher) throws SSLException
      Match the common name against the hostname.
      Parameters:
      host - the DNS name the certificate was presented for
      cn - the common name taken from the certificate subject
      publicSuffixMatcher - rejects names in a public suffix, null to skip that check
      Throws:
      SSLException - if cn does not match host

    • matchDomainRoot

      static boolean matchDomainRoot(String host, String domainRoot)
      Match the host against a domain root.
      Parameters:
      host - the name being tested
      domainRoot - the suffix to require, or null, which never matches
      Returns:
      true if host equals domainRoot or ends with it at a label boundary

    • matchIdentity

      private static boolean matchIdentity(String host, String identity, PublicSuffixMatcher publicSuffixMatcher, boolean strict)
      True when the certificate identity may be used for the host.
      Parameters:
      host - the host name being connected to
      identity - the name from the certificate
      publicSuffixMatcher - the public suffix matcher, or null
      strict - whether a wildcard must match a single label
      Returns:
      true if the identity matches the host

    • matchIdentity

      static boolean matchIdentity(String host, String identity, PublicSuffixMatcher publicSuffixMatcher)
      Match the host against the identity with public suffix matching.
      Parameters:
      host - the name being tested
      identity - the certificate identity, which may hold one wildcard per label
      publicSuffixMatcher - rejects identities in a public suffix, null to skip it
      Returns:
      true if host matches identity under RFC 2818 rules

    • matchIdentity

      static boolean matchIdentity(String host, String identity)
      Match the host against the identity.
      Parameters:
      host - the name being tested
      identity - the certificate identity, compared case-insensitively
      Returns:
      true if host equals identity

    • matchIdentityStrict

      static boolean matchIdentityStrict(String host, String identity, PublicSuffixMatcher publicSuffixMatcher)
      Strictly match the host against the identity with public suffix matching.
      Parameters:
      host - the name being tested
      identity - the certificate identity, which may hold one wildcard per label
      publicSuffixMatcher - rejects identities in a public suffix, null to skip it
      Returns:
      true if host matches identity and any wildcard spans exactly one label

    • matchIdentityStrict

      static boolean matchIdentityStrict(String host, String identity)
      Strictly match the host against the identity.
      Parameters:
      host - the name being tested
      identity - the certificate identity, compared case-insensitively
      Returns:
      true if host equals identity

    • extractCN

      static String extractCN(String subjectPrincipal) throws SSLException
      Extract the Common Name from the subject principal.
      Parameters:
      subjectPrincipal - the X500 principal name
      Returns:
      the CN, or null if not found
      Throws:
      SSLException - if the name is invalid

    • extractSubjectAlts

      static List<String> extractSubjectAlts(X509Certificate cert, int subjectType)
      Extract subject alternative names from the certificate.
      Parameters:
      cert - the certificate to read the subject alternative names from
      subjectType - the subject type (DNS or IP)
      Returns:
      the list of subject alternative names, or null

    • normaliseAddress

      static String normaliseAddress(String hostname)
      Normalize an IPv6 or DNS name.
      Parameters:
      hostname - the hostname to normalize
      Returns:
      the normalized address