[Cronet] Public key pinning for Java API

components/cronet/android/api/src/org/chromium/net/CronetUtil.java

+// Copyright 2015 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+package org.chromium.net;
+
+import java.net.IDN;
+import java.util.regex.Pattern;
+
+/**
+ * A set of generic utility methods.
+ */
+class CronetUtil {
+    private static final String VALID_IP_EXPR = "^(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])"
+            + "\\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])$";
+    private static final String VALID_HOST_EXPR = "^(([a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9\\-]*"
+            + "[a-zA-Z0-9])\\.)*([a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9\\-]*[a-zA-Z0-9])$";

[pauljensen, 2015/11/17 19:01:23]

Let's not reinvent the wheel.  Please use either some java.* function (it
doesn't look like java.net.URL or java.net.InetSocketAddress validates the host
name, maybe something else does) or even better would be to call to some native
code that is going to be used later to validate it, like GURL.
Same goes for isValidIPv4.

[kapishnikov, 2015/11/18 00:10:31]

Calling native implementation would eliminate the duplication of validation
logic. Ideally we would like to verify the hostname when the client makes a call
to addPublicKeyPins() method. However, when addPublicKeyPins() is called, the
native library may not be loaded yet. We could postpone the verification until
the context is created.

[mef, 2015/11/18 22:41:38]

We've chatted with Andrei about it, and another option is to do additional
config validation on the native side when UrlRequestContext gets created.
This will allow us to use native method without needs to load it explicitly. I
think it might be better done separately, after Paul's CL that removes JSON.

I agree that having multiple subtly different validators is not great, so maybe
we should just remove the java-side validation from  this CL?

[pauljensen, 2015/11/19 04:07:43]

I looked around and I don't think we have any native side hostname validation. 
I think Chrome just generally passes things along to getaddrinfo().  There is
some code in GURL to identify the hostname but I don't think its intent is to
validate it.

[pauljensen, 2015/11/19 04:07:43]

For IPv4 validation, you can use Os.inet_pton():
http://developer.android.com/reference/android/system/Os.html#inet_pton(int,
java.lang.String)

[kapishnikov, 2015/11/19 15:12:29]

It looks that the Os class was added in Android 21. In our sample app manifest
we specify minSdkVersion="14".

+    private static final Pattern VALID_IP_PATTERN = Pattern.compile(VALID_IP_EXPR);
+    private static final Pattern VALID_HOST_PATTERN = Pattern.compile(VALID_HOST_EXPR);
+
+    private CronetUtil() {}
+
+    /**
+     * Checks whether a given string that represents a host name is valid.
+     *
+     * @param hostName host name to check.
+     * @return true if the string is a valid host name.
+     */
+    static boolean isValidHostName(String hostName) {
+        String ascii = IDN.toASCII(hostName);
+        return VALID_HOST_PATTERN.matcher(ascii).matches();
+    }
+
+    /**
+     * Checks whether a given string that represents an IPv4 address is valid.
+     *
+     * @param addr IPv4 address to check.
+     * @return true if the string is a valid IPv4 address.
+     */
+    static boolean isValidIPv4(String addr) {
+        return VALID_IP_PATTERN.matcher(addr).matches();
+    }
+}