SSL Hostname verify incompatible with Netty 4.2.0.Final

[Croway]

Version

4.5.13, 4.5.14

Context

The hostname verify defaults changed in Netty 4.2.0 https://github.com/netty/netty/blob/4.2/handler/src/main/java/io/netty/handler/ssl/SslUtils.java#L68

Do you have a reproducer?

WebClient.create(vertx, clientOptions), where clientOptions has verifyHost = false.

Even if verify Host is false, the hostname verification is still executed.

Extra

I think the issue may be in https://github.com/eclipse-vertx/vert.x/blob/master/vertx-core/src/main/java/io/vertx/core/http/impl/HttpClientBase.java#L81 most probably, instead of "", "NONE" should be used.

[vietj]

vertx 4.5 still uses Netty 4.1

do you have a reproducer with 5.0 ?

[vietj]

@Croway ping

[Croway]

Hi @vietj sorry for the late reply, I've been executing vert.x tests, in particular ResolvingHttpClientTest.testSSLOverridePeerNoVerify, that tests pretty much what I reported, and the test is successful. therefore the issue is solved in Vert.x 5.0, but I did some debug, and I still have some concerne, in particular related to https://github.com/netty/netty/blob/4.2/handler/src/main/java/io/netty/handler/ssl/SslUtils.java#L67-L77 When Netty SslUtils is initialized, it uses the default value for defaultEndpointVerificationAlgorithm which is "", therefore it ends up in defaultEndpointVerificationAlgorithm = "HTTPS"; and, per comment "HTTPS" — verify subject by DNS hostnames; this is the Netty 4.2 default. even if in Vert.x the verifyHost is set to false like:

HttpClient client = vertx.httpClientBuilder()
      .with(new HttpClientOptions()
        .setSsl(true)
        .setTrustOptions(Trust.SERVER_JKS.get())
        .setVerifyHost(false)
      )

Is it a potential issue?.. or am I totally off the track?

[vietj]

I don't know yet, this should be studied

[vietj]

@Croway as I understand NONE is a Netty construct to disable hostname verification, you can see at https://github.com/netty/netty/blob/1fa1b7e7ef5e955251c6789dfbaa7c09b8f3fd7d/handler/src/main/java/io/netty/handler/ssl/SslUtils.java#L208 that when NONE is matched then defaultEndpointVerificationAlgorithm becomes null which most likely lead to set empty string on SSLParameters#setEndpointIdentificationAlgorithm.