commit 27c55fb61450b3d971ce45836c938beb7389b7de
author Alex Klyubin <klyubin@google.com> Tue Jul 29 20:39:34 2014 +0000
committer The Android Automerger <android-build@google.com> Tue Jul 29 14:52:32 2014 -0700
tree 2c34275c676f38ef7d8a5c2392bb5316f3c80a94
parent 654078f583bcd58ba1c73986a455e444c12080fe

DO NOT MERGE Revert "Remove workaround for *.clients.google.com."

This reverts commit 319e20e0b273b64fb567f73912f71dd33f77b516.

Turns out some apps that connect to android.clients.google.com
still do not use SNI and thus get served a server cert for
*.google.com.

Bug: 5426333
Bug: 16635883
Change-Id: I0b2b106c04aeb46f76d2e6a89076390bec3ef00f

luni/src/main/java/javax/net/ssl/DefaultHostnameVerifier.java

diff --git a/luni/src/main/java/javax/net/ssl/DefaultHostnameVerifier.java b/luni/src/main/java/javax/net/ssl/DefaultHostnameVerifier.java
index 65c8b03..fa11371 100644
--- a/luni/src/main/java/javax/net/ssl/DefaultHostnameVerifier.java
+++ b/luni/src/main/java/javax/net/ssl/DefaultHostnameVerifier.java
@@ -154,7 +154,10 @@
         int suffixLength = cn.length() - (asterisk + 1);
         int suffixStart = hostName.length() - suffixLength;
         if (hostName.indexOf('.', asterisk) < suffixStart) {
-            return false; // wildcard '*' can't match a '.'
+            // TODO: remove workaround for *.clients.google.com http://b/5426333
+            if (!hostName.endsWith(".clients.google.com")) {
+                return false; // wildcard '*' can't match a '.'
+            }
         }
 
         if (!hostName.regionMatches(suffixStart, cn, asterisk + 1, suffixLength)) {