From cc278e61634608f9146ef2e72fca3577db370ef4 Mon Sep 17 00:00:00 2001 From: Eric Anderson Date: Tue, 2 Apr 2024 09:53:28 -0700 Subject: [PATCH] Use empty string instead of null for endpoint identification algorithm to disable server hostname verification, since null value gets ignored in Sun's SSLEngine implementation. (#11058) Co-authored-by: Kannan J --- .../grpc/xds/internal/security/trust/XdsX509TrustManager.java | 4 ++-- .../xds/internal/security/trust/XdsX509TrustManagerTest.java | 2 ++ 2 files changed, 4 insertions(+), 2 deletions(-) diff --git a/xds/src/main/java/io/grpc/xds/internal/security/trust/XdsX509TrustManager.java b/xds/src/main/java/io/grpc/xds/internal/security/trust/XdsX509TrustManager.java index d5c6c174f04..6181d70fa51 100644 --- a/xds/src/main/java/io/grpc/xds/internal/security/trust/XdsX509TrustManager.java +++ b/xds/src/main/java/io/grpc/xds/internal/security/trust/XdsX509TrustManager.java @@ -229,7 +229,7 @@ public void checkServerTrusted(X509Certificate[] chain, String authType, Socket SSLSocket sslSocket = (SSLSocket) socket; SSLParameters sslParams = sslSocket.getSSLParameters(); if (sslParams != null) { - sslParams.setEndpointIdentificationAlgorithm(null); + sslParams.setEndpointIdentificationAlgorithm(""); sslSocket.setSSLParameters(sslParams); } } @@ -242,7 +242,7 @@ public void checkServerTrusted(X509Certificate[] chain, String authType, SSLEngi throws CertificateException { SSLParameters sslParams = sslEngine.getSSLParameters(); if (sslParams != null) { - sslParams.setEndpointIdentificationAlgorithm(null); + sslParams.setEndpointIdentificationAlgorithm(""); sslEngine.setSSLParameters(sslParams); } delegate.checkServerTrusted(chain, authType, sslEngine); diff --git a/xds/src/test/java/io/grpc/xds/internal/security/trust/XdsX509TrustManagerTest.java b/xds/src/test/java/io/grpc/xds/internal/security/trust/XdsX509TrustManagerTest.java index 08512396a4f..9ceb6f706fe 100644 --- a/xds/src/test/java/io/grpc/xds/internal/security/trust/XdsX509TrustManagerTest.java +++ b/xds/src/test/java/io/grpc/xds/internal/security/trust/XdsX509TrustManagerTest.java @@ -534,6 +534,7 @@ public void checkServerTrustedSslEngine() CertificateUtils.toX509Certificates(TlsTesting.loadCert(SERVER_1_PEM_FILE)); trustManager.checkServerTrusted(serverCerts, "ECDHE_ECDSA", sslEngine); verify(sslEngine, times(1)).getHandshakeSession(); + assertThat(sslEngine.getSSLParameters().getEndpointIdentificationAlgorithm()).isEmpty(); } @Test @@ -561,6 +562,7 @@ public void checkServerTrustedSslSocket() trustManager.checkServerTrusted(serverCerts, "ECDHE_ECDSA", sslSocket); verify(sslSocket, times(1)).isConnected(); verify(sslSocket, times(1)).getHandshakeSession(); + assertThat(sslSocket.getSSLParameters().getEndpointIdentificationAlgorithm()).isEmpty(); } @Test