laantungir/sparrow
1
0
Fork 0
mirror of https://github.com/sparrowwallet/sparrow.git synced 2026-08-09 16:24:53 +00:00
Code Issues Packages Projects Releases Wiki Activity

add hostname verification for ca-validated tls connections

Browse Source
This commit is contained in:
Craig Raw
2026-02-28 12:38:58 +02:00
parent a478edfad7
commit dc88dc4ede
2 changed files with 11 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/main/java/com/sparrowwallet/sparrow/net/ProxyTcpOverTlsTransport.java
+1 -1
View File
@@ -33,7 +33,7 @@ public class ProxyTcpOverTlsTransport extends TcpOverTlsTransport {
InetSocketAddress proxyAddr = new InetSocketAddress(proxy.getHost(), proxy.getPortOrDefault(DEFAULT_PROXY_PORT));
socket = new Socket(new Proxy(Proxy.Type.SOCKS, proxyAddr));
socket.connect(InetSocketAddress.createUnresolved(server.getHost(), server.getPortOrDefault(getDefaultPort())));
socket = sslSocketFactory.createSocket(socket, proxy.getHost(), proxy.getPortOrDefault(DEFAULT_PROXY_PORT), true);
socket = sslSocketFactory.createSocket(socket, server.getHost(), server.getPortOrDefault(getDefaultPort()), true);
startHandshake((SSLSocket)socket);
}
}
src/main/java/com/sparrowwallet/sparrow/net/TcpOverTlsTransport.java
+10
View File
@@ -20,6 +20,7 @@ public class TcpOverTlsTransport extends TcpTransport {
public static final int PAD_TO_MULTIPLE_OF_BYTES = 96;
protected final SSLSocketFactory sslSocketFactory;
protected final boolean usingCaTrust;
public TcpOverTlsTransport(HostAndPort server) throws NoSuchAlgorithmException, KeyManagementException, CertificateException, KeyStoreException, IOException {
super(server);
@@ -27,8 +28,10 @@ public class TcpOverTlsTransport extends TcpTransport {
TrustManager[] trustManagers;
if(Storage.getCaCertificateFile(server.getHost()) != null) {
trustManagers = getCaTrustManagers();
this.usingCaTrust = true;
} else {
trustManagers = getTrustManagers(Storage.getCertificateFile(server.getHost()), server.getHost());
this.usingCaTrust = false;
}
SSLContext sslContext = SSLContext.getInstance("TLS");
@@ -40,6 +43,7 @@ public class TcpOverTlsTransport extends TcpTransport {
public TcpOverTlsTransport(HostAndPort server, File crtFile) throws IOException, CertificateException, NoSuchAlgorithmException, KeyStoreException, KeyManagementException {
super(server);
this.usingCaTrust = false;
TrustManager[] trustManagers = getTrustManagers(crtFile, server.getHost());
SSLContext sslContext = SSLContext.getInstance("TLS");
@@ -148,6 +152,12 @@ public class TcpOverTlsTransport extends TcpTransport {
}
});
if(usingCaTrust && !Protocol.isOnionAddress(server)) {
SSLParameters sslParameters = sslSocket.getSSLParameters();
sslParameters.setEndpointIdentificationAlgorithm("HTTPS");
sslSocket.setSSLParameters(sslParameters);
}
sslSocket.startHandshake();
}