From 0f2f7e24544ee6c4f8412d9e600f375c268cb824 Mon Sep 17 00:00:00 2001 From: zzz Date: Tue, 3 Sep 2019 15:34:21 +0000 Subject: [PATCH] Utils: Fix SAN verification for IPv6 hostnames Add Quad9 DoH servers Change Google DoH server hostname --- core/java/src/net/i2p/util/DNSOverHTTPS.java | 15 +++++++++++---- .../src/net/i2p/util/I2PSSLSocketFactory.java | 4 +++- core/java/src/net/i2p/util/SSLEepGet.java | 7 ++++++- 3 files changed, 20 insertions(+), 6 deletions(-) diff --git a/core/java/src/net/i2p/util/DNSOverHTTPS.java b/core/java/src/net/i2p/util/DNSOverHTTPS.java index 42761e07b..186c04783 100644 --- a/core/java/src/net/i2p/util/DNSOverHTTPS.java +++ b/core/java/src/net/i2p/util/DNSOverHTTPS.java @@ -63,9 +63,10 @@ public class DNSOverHTTPS implements EepGet.StatusListener { static { // Warning: All hostnames MUST be in loop check in lookup() below // Google - // Certs for 8.8.8.8 and 8.8.4.4 don't work - v4urls.add("https://dns.google.com/resolve?edns_client_subnet=0.0.0.0/0&"); - v6urls.add("https://dns.google.com/resolve?edns_client_subnet=0.0.0.0/0&"); + // https://developers.google.com/speed/public-dns/docs/doh/ + // 8.8.8.8 and 8.8.4.4 now redirect to dns.google, but SSLEepGet doesn't support redirect + v4urls.add("https://dns.google/resolve?edns_client_subnet=0.0.0.0/0&"); + v6urls.add("https://dns.google/resolve?edns_client_subnet=0.0.0.0/0&"); // Cloudflare cloudflare-dns.com // https://developers.cloudflare.com/1.1.1.1/nitty-gritty-details/ // 1.1.1.1 is a privacy centric resolver so it does not send any client IP information @@ -74,6 +75,12 @@ public class DNSOverHTTPS implements EepGet.StatusListener { v4urls.add("https://1.0.0.1/dns-query?ct=application/dns-json&"); v6urls.add("https://[2606:4700:4700::1111]/dns-query?ct=application/dns-json&"); v6urls.add("https://[2606:4700:4700::1001]/dns-query?ct=application/dns-json&"); + // Quad9 + // https://quad9.net/doh-quad9-dns-servers/ + v4urls.add("https://9.9.9.9:5053/dns-query?"); + v4urls.add("https://149.112.112.112:5053/dns-query?"); + v6urls.add("https://[2620:fe::fe]:5053/dns-query?"); + v6urls.add("https://[2620:fe::fe:9]:5053/dns-query?"); } // keep the timeout very short, as we try multiple addresses, @@ -138,7 +145,7 @@ public class DNSOverHTTPS implements EepGet.StatusListener { } } // don't loop via SSLEepGet - if (host.equals("dns.google.com")) + if (host.equals("dns.google")) return "8.8.8.8"; if (type == Type.V4_ONLY || type == Type.V4_PREFERRED) { // v4 lookup diff --git a/core/java/src/net/i2p/util/I2PSSLSocketFactory.java b/core/java/src/net/i2p/util/I2PSSLSocketFactory.java index aa6f2203a..406b289fe 100644 --- a/core/java/src/net/i2p/util/I2PSSLSocketFactory.java +++ b/core/java/src/net/i2p/util/I2PSSLSocketFactory.java @@ -285,7 +285,9 @@ public class I2PSSLSocketFactory { } /** - * Validate the hostname + * Validate the hostname. + * Warning - be sure to remove [] from IPv6 addresses in host parameter if you + * got it from URI.getHost(). * * ref: https://developer.android.com/training/articles/security-ssl.html * ref: http://op-co.de/blog/posts/java_sslsocket_mitm/ diff --git a/core/java/src/net/i2p/util/SSLEepGet.java b/core/java/src/net/i2p/util/SSLEepGet.java index e40024d8f..b25a75b17 100644 --- a/core/java/src/net/i2p/util/SSLEepGet.java +++ b/core/java/src/net/i2p/util/SSLEepGet.java @@ -769,8 +769,13 @@ public class SSLEepGet extends EepGet { SSLSocket socket = (SSLSocket) _proxy; I2PSSLSocketFactory.setProtocolsAndCiphers(socket); if (!_bypassVerification) { + String vhost = originalHost; + if (vhost.startsWith("[") && vhost.endsWith("]")) { + // URI.getHost() does not strip [] + vhost = vhost.substring(1, vhost.length() - 1); + } try { - I2PSSLSocketFactory.verifyHostname(_context, socket, originalHost); + I2PSSLSocketFactory.verifyHostname(_context, socket, vhost); } catch (SSLException ssle) { if (_saveCerts > 0 && _stm != null) saveCerts(host, _stm);