TLS hostname verifier: reverse resolves peer addresses?

[Bernd Eckenfels]

Hello,

while playing around(*) with JSSE and howismyssl.com I noticed, that the
Java 8 hostname verifier (algorithm https configured) will reverse
resolve hostnames and use them.

This has two problems, for one it is a performance problem, but for
two, it will verify the cert against an untrusted (DNS response)
parameter. I dont think it is speced that way (at least I could not
find it). So it could fall back to IP literal instead.

This is not a problem if I generate the InetAddr with a ip literal:

destination = InetAddr.getByName("54.245.228.141");

but it is a problem if I construct an unresolved address:

destination = InetAddress.getByAddress(
  new byte[] {54,(byte)245,(byte)228,(byte)141});

In the first case, it will result in (expected):

Caused by: java.security.cert.CertificateException: No subject
  alternative names matching IP address 54.245.228.141 found

In the second case, however it will result in:

Caused by: java.security.cert.CertificateException:
  No subject alternative DNS name matching
    ec2-54-245-228-141.us-west-2.compute.amazonaws.com found.

I typically use the getByAddress form as it allows me to control
resolving. It is enough to use this form:

destination = InetAddress.getByAddress("54.245.228.141",
  new byte[] {54,(byte)245,(byte)228,(byte)141});

However I noticed in the code there are some conditionals for
unresolved peer addresses. I just wonder if they should catch this and
avoid the reverse lookup, or not?

(I actually wanted to make sure hostname verification is not skipped,
no matter how I configure it).

Gruss
Bernd

(*)
https://github.com/ecki/JavaCryptoTest/blob/master/src/main/java/net/eckenfels/test/howsmyssl/Client.java#L31