Enable hostname verification for absolute hostnames.

This makes the DefaultHostnameVerifier (the platform default
HostnameVerifier) match relative hostname patterns from CN and DNS
SubjectAltNames fields of TLS/SSL server certificates against
absolute hostnames. Absolute hostname patterns will still never match
relative hostnames because it is not known to what absolute name a
relative name was resolved by DNS.

For example, if hostname is "www.android.com." and server certificate
is for "www.android.com", hostname verification will now pass.
Whereas, if hostname is "www.android.com" and server certificate is
for "www.android.com.", hostname verification will still fail.

All of this is needed because server certificates do not normally
contain absolute hostnames or hostname patterns. At the same time,
connections via absolute hostnames should be supported and even
preferred in most cases, to avoid DNS search suffixes being added.

Bug: 17482685
Change-Id: I3f2006fa1110004b18ce627675334d2a54805c7a

1 files changed, 27 insertions, 0 deletions

diff --git a/luni/src/test/java/libcore/javax/net/ssl/DefaultHostnameVerifierTest.java b/luni/src/test/java/libcore/javax/net/ssl/DefaultHostnameVerifierTest.java
index e1c9fe3..6ad9ac2 100644
--- a/luni/src/test/java/libcore/javax/net/ssl/DefaultHostnameVerifierTest.java
+++ b/luni/src/test/java/libcore/javax/net/ssl/DefaultHostnameVerifierTest.java
@@ -142,6 +142,33 @@ public final class DefaultHostnameVerifierTest extends TestCase {
         assertFalse(verifier.verifyHostName("imap.google.com", "a*.google.com"));
         assertFalse(verifier.verifyHostName("imap.google.com", "ix*.google.com"));
         assertTrue(verifier.verifyHostName("imap.google.com", "iMap.Google.Com"));
+        assertTrue(verifier.verifyHostName("weird", "weird"));
+        assertFalse(verifier.verifyHostName("weird", "weird*"));
+        assertFalse(verifier.verifyHostName("weird", "*weird"));
+        assertFalse(verifier.verifyHostName("weird", "weird."));
+        assertFalse(verifier.verifyHostName("weird", "weird*."));
+        assertFalse(verifier.verifyHostName("weird", "weird.*"));
+    }
+
+    public void testVerifyAbsoluteHostName() {
+        assertTrue(verifier.verifyHostName("a.b.c.d.", "a.b.c.d"));
+        assertTrue(verifier.verifyHostName("a.b.c.d.", "*.b.c.d"));
+        assertFalse(verifier.verifyHostName("a.b.c.d.", "*.*.c.d"));
+        assertTrue(verifier.verifyHostName("imap.google.com.", "imap.google.com"));
+        assertFalse(verifier.verifyHostName("imap2.google.com.", "imap.google.com"));
+        assertTrue(verifier.verifyHostName("imap.google.com.", "*.google.com"));
+        assertTrue(verifier.verifyHostName("imap2.google.com.", "*.google.com"));
+        assertFalse(verifier.verifyHostName("imap.google.com.", "*.googl.com"));
+        assertFalse(verifier.verifyHostName("imap2.google2.com.", "*.google3.com"));
+        assertFalse(verifier.verifyHostName("imap.google.com.", "a*.google.com"));
+        assertFalse(verifier.verifyHostName("imap.google.com.", "ix*.google.com"));
+        assertTrue(verifier.verifyHostName("imap.google.com.", "iMap.Google.Com"));
+        assertTrue(verifier.verifyHostName("weird.", "weird"));
+        assertTrue(verifier.verifyHostName("weird.", "weird*"));
+        assertTrue(verifier.verifyHostName("weird.", "*weird"));
+        assertTrue(verifier.verifyHostName("weird.", "weird."));
+        assertTrue(verifier.verifyHostName("weird.", "weird*."));
+        assertFalse(verifier.verifyHostName("weird.", "weird.*"));
     }
 
     public void testSubjectOnlyCert() throws Exception {