[io.net] Add support for acting based on the hostname/port as supplied by sslEngine

[martinvw]

Also-by: Matthew Bowman github@otr.mx
Signed-off-by: Martin van Wingerden martin@martinvw.nl

[openhab-bot]

This pull request has been mentioned on openHAB Community. There might be relevant details there:

https://community.openhab.org/t/ubiquiti-unifi-binding-feature-discussion/14520/677

[mgbowman]

With these changes, we now have TlsProvider.getHostName() potentially returning two different values: the CN (common name) from the certificate or host:port from the actual connection.

Maybe we should expand the TlsProvider interface with more specific calls based on the TLS attributes that are actually getting checked:

TlsProvider.getCommonName()
TlsProvider.getPeerHost()
TlsProvider.getPeerPort()

This way depending on which checkServerTrusted(...) method is called in ExtensibleTrustManager, the proper format can be constructed internally.

[mgbowman]

Just some ideas...

[mgbowman]

Possible NPE?

[martinvw]

Note to self the tests have not yet been adapted, to the changed class name.

[martinvw]

With these changes, we now have TlsProvider.getHostName() potentially returning two different values: the CN (common name) from the certificate or host:port from the actual connection.

It is a little more complex, because it could also be matched against the subject-alternative-name, but conceptionally they are all hostnames so that should not matter too much.

Would it address your concern it we just map them on hostname (being peer, common-name, subject-alternative-name or whatever) and have port as a separate method defaulting to 443 but only being used when checking based on peer.

This way depending on which checkServerTrusted(...) method is called in ExtensibleTrustManager, the proper format can be constructed internally.

I do now fallback to both, which is imho a proper (backwards compatible) implementation

[kaikreuzer]

Seems this needs to be rebased.

[martinvw]

Indeed, but we also have decisions to be made and the build is broken 😊

Hope to work on it tonight, should I mark it WIP? Do you have an opinion about splitting up the host related methods?

[martinvw]

I updated the PR, what remains is a decision about the host / common name / port methods.

[kaikreuzer]

I don't have any opinion as I didn't look into the details of this PR so far. As it isn't relevant for the openHAB 2.4 release (correct?), I don't have it at the top of my prio list right now...

[martinvw]

As it isn't relevant for the openHAB 2.4 release (correct?), I don't have it at the top of my prio list right now...

Correct and thus 👍

[kaikreuzer]

lgtm, thanks!

[openhab-bot]

This pull request has been mentioned on openHAB Community. There might be relevant details there:

https://community.openhab.org/t/ubiquiti-unifi-binding-feature-discussion/14520/834