[NET-688] FTPSClient converts hostname to IP, making hostname verification difficult

• Type: Bug
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 3.7
• Fix Version/s: 3.7.2
• Component/s: FTP
• Assignee: Unassigned
• Reporter: Dave Nice
• Created: 23/Sep/20 10:16
• Updated: 29/Oct/20 00:32
• Resolved: 29/Oct/20 00:32

Description

Related to NET-593, FTPS converts the provided hostname into an IP address before attempting the connection.

 

This means that a registered hostname verifier gets passed the IP address, instead of the hostname, and is likely to fail.

 

I believe the issue is in FTPSClient.java, in sslNegotiation.

 

at line 294 we call the hostnameverifier, but using socket.getInetAddress().getHostAddress() - this will return us the IP address of the socket. The certificate presented by the server will almost certainly not have the IP address as a valid name and therefore hostname verification will likely fail.

 

We ought to use the hostname the user provided, if possible.