vert-x/vert.x — pull request #424 by haughki (2012-11-16 01:32:05+00:00)
Title: Fix for hostname verification security vulnerability

Hostname verification is an essential part of the HTTPS specification (rfc 2818 - http://tools.ietf.org/html/rfc2818#section-3.1). Without it, vert-x is fundamentally insecure and open to man-in-the-middle attacks as clearly explained/substantiated in this article: "The most dangerous code in the world: validating SSL certificates in non-browser software" (https://crypto.stanford.edu/~dabo/pubs/abstracts/ssl-client-bugs.html).

The fix adds hostname verification to the vertx DefaultHttpClient (along with accessors to disable it). It does this by adding the "HTTPS" endpoint identification algorithm to the SSLParameters, if SSL is enabled on the client. Note that creating the SSLEngine object now takes the request host and port; this is really only a requirement if hostname verification is enabled, but I didn't see any harm in including it for all SSL cases.