From de4493d1f7c2532e2fdec7da360090795e80b38b Mon Sep 17 00:00:00 2001 From: Tim Perry Date: Mon, 13 Nov 2023 22:47:25 +0100 Subject: [PATCH] Disable hostname verification for our CA certificate only We previously left this in, since it's generally better to follow TLS rules, but there's one case where it matters: when a client sends a request without using SNI, and so the proxy may not show the right certificate. We want to allow that, and to do so we need to ensure that hostname checks are skipped (but only for our CA - not for any others, which must still follow normal TLS rules). --- android/android-certificate-unpinning.js | 34 ++++++++++++++++++++++++ 1 file changed, 34 insertions(+) diff --git a/android/android-certificate-unpinning.js b/android/android-certificate-unpinning.js index 9377d26..4df1c91 100644 --- a/android/android-certificate-unpinning.js +++ b/android/android-certificate-unpinning.js @@ -150,6 +150,40 @@ const PINNING_FIXES = { // --- Native HostnameVerification override (n.b. Android contains its own vendored OkHttp v2!) + 'com.android.okhttp.internal.tls.OkHostnameVerifier': [ + { + methodName: 'verify', + overload: [ + 'java.lang.String', + 'javax.net.ssl.SSLSession' + ], + replacement: (targetMethod) => { + // Our trust manager - this trusts *only* our extra CA + const trustManager = getCustomX509TrustManager(); + + return function (hostname, sslSession) { + try { + const certs = sslSession.getPeerCertificates(); + + // https://stackoverflow.com/a/70469741/68051 + const authType = "RSA"; + + // This throws if the certificate isn't trusted (i.e. if it's + // not signed by our extra CA specifically): + trustManager.checkServerTrusted(certs, authType); + + // If the cert is from our CA, great! Skip hostname checks entirely. + return true; + } catch (e) {} // Ignore errors and fallback to default behaviour + + // We fallback to ensure that connections with other CAs (e.g. direct + // connections allowed past the proxy) validate as normal. + return targetMethod.call(this, ...arguments); + } + } + } + ], + 'com.android.okhttp.Address': [ { methodName: '$init',