Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 007392a8 authored by Costin Manolache's avatar Costin Manolache
Browse files

Remove the warning if the caller gets the insecure variant and add hostname verification (SNI) 

For insecure - not doing verifiaction is normal and documented behavior, no need for extra warnings.
When upgrading the socket - we need to set SNI before the handshake, with the other options.

Change-Id: I494ca8e783deb1387dc11e21422d2141a6d5a617
parent dcea5eb5

core/java/android/net/SSLCertificateSocketFactory.java

+3 −3
Original line number Diff line number Diff line
@@ -135,7 +135,8 @@ public class SSLCertificateSocketFactory extends SSLSocketFactory { 
     * disabled, using an optional handshake timeout and SSL session cache.

     *

     * <p class="caution"><b>Warning:</b> Sockets created using this factory

     * are vulnerable to man-in-the-middle attacks!</p>

     * are vulnerable to man-in-the-middle attacks!</p>. The caller must implement

     * its own verification.

     *

     * @param handshakeTimeoutMillis to use for SSL connection handshake, or 0

     *         for none.  The socket timeout is reset to 0 after the handshake.
@@ -223,8 +224,6 @@ public class SSLCertificateSocketFactory extends SSLSocketFactory { 
            if (mInsecureFactory == null) {

                if (mSecure) {

                    Log.w(TAG, "*** BYPASSING SSL SECURITY CHECKS (socket.relaxsslcheck=yes) ***");

                } else {

                    Log.w(TAG, "Bypassing SSL security checks at caller's request");

                }

                mInsecureFactory = makeSocketFactory(mKeyManagers, INSECURE_TRUST_MANAGER);

            }
@@ -431,6 +430,7 @@ public class SSLCertificateSocketFactory extends SSLSocketFactory { 
        s.setAlpnProtocols(mAlpnProtocols);

        s.setHandshakeTimeout(mHandshakeTimeoutMillis);

        s.setChannelIdPrivateKey(mChannelIdPrivateKey);

        s.setHostname(host);

        if (mSecure) {

            verifyHostname(s, host);

        }