BCJSSE: Strip trailing dot from hostname for SNI, endpointID checks

Author: peterdettman

tls/src/main/java/org/bouncycastle/jsse/provider/JsseUtils.java

@@ -937,6 +937,19 @@ private static String stripOuterChars(String s, char openChar, char closeChar)
         return s;
     }
 
+    static String stripTrailingDot(String s)
+    {
+        if (s != null && s.endsWith("."))
+        {
+            int sLast = s.length() - 1;
+            if (sLast >= 0 && s.charAt(sLast) == '.')
+            {
+                return s.substring(0, sLast);
+            }
+        }
+        return s;
+    }
+
     static boolean useCompatibilityMode()
     {
         return provTlsUseCompatibilityMode;

tls/src/main/java/org/bouncycastle/jsse/provider/ProvTlsClient.java

@@ -174,7 +174,11 @@ protected Vector<ServerName> getSNIServerNames()
             List<BCSNIServerName> sniServerNames = sslParameters.getServerNames();
             if (null == sniServerNames)
             {
-                String peerHostSNI = manager.getPeerHostSNI();
+                /*
+                 * A fully qualified domain name (FQDN) may contain a trailing dot. We remove it for the
+                 * purpose of SNI and endpoint ID checks (e.g. SNIHostName doesn't permit it).
+                 */
+                String peerHostSNI = JsseUtils.stripTrailingDot(manager.getPeerHostSNI());
 
                 /*
                  * TODO[jsse] Consider removing the restriction that the name must contain a '.'

tls/src/main/java/org/bouncycastle/jsse/provider/ProvX509TrustManager.java

@@ -427,6 +427,13 @@ private static void checkEndpointID(X509Certificate certificate, String endpoint
         BCExtendedSSLSession sslSession) throws CertificateException
     {
         String peerHost = sslSession.getPeerHost();
+
+        /*
+         * A fully qualified domain name (FQDN) may contain a trailing dot. We remove it for the purpose of
+         * SNI and endpoint ID checks (e.g. SNIHostName doesn't permit it).
+         */
+        peerHost = JsseUtils.stripTrailingDot(peerHost);
+
         if (checkServerTrusted)
         {
             BCSNIHostName sniHostName = JsseUtils.getSNIHostName(sslSession.getRequestedServerNames());