Better hash algorithm in FingerprintTrustManagerFactory

FingerprintTrustManagerFactory checks if a certificate is trusted by comparing its SHA-1 hash to a list of pre-configured ones:

https://github.com/netty/netty/blob/0cde4d9cb4d19ddc0ecafc5be7c5f7c781a1f6e9/handler/src/main/java/io/netty/handler/ssl/util/FingerprintTrustManagerFactory.java#L85

Unfortunately, nowadays SHA-1 is considered insecure. The issue was reported by LGTM.

I see the following ways to fix it:

1. Update FingerprintTrustManagerFactory to use a stronger algorithm such as SHA-512. Unfortunately, most likely it’ll break applications that pass a SHA-1 hash to the class.
2. Deprecate FingerprintTrustManagerFactory and add a new implementation that use a stronger algorithm.
3. Updated FingerprintTrustManagerFactory to determine a hash algorithm based on a length of a hash passed to the constructor. If a caller passes a SHA-1 hash, the class can also print a warning.

Please let me know if one of the options above is fine (or, you see a better option), and I’ll open a pull request.

[artem-smotrakov]

I like the idea with a builder and deprecating only the public constructor suggested by @trustin

FingerprintTrustManagerFactory f =
  FingerprintTrustManagerFactory
    .builder("SHA256") // Always require the algorithm name
    .fingerprint("deadbeef...")
    .fingerprint("cafecafe...")
    .build();

If no objections, I’ll implement this logic then.

[trustin]

I don’t see a reason to introduce a new TrustManagerFactory implementation class. We could deprecate the public constructors in favor of builders and static factory methods. e.g.

FingerprintTrustManagerFactory f =
  FingerprintTrustManagerFactory
    .builder("SHA256") // Always require the algorithm name
    .fingerprint("deadbeef...")
    .fingerprint("cafecafe...")
    .build();

The public constructors could call the internal constructor that passes the message digest function, e.g.

@Deprecated
public FingerprintTrustManagerFactory(String... fingerprints) {
    this(FingerprintTrustManagerFactory::sha1Fingerprint, fingerprints);
}

// Called by the builder or the legacy public constructors.
// The example uses Java 8 Function but we can define a dedicated interface if necessary.
FingerprintTrustManagerFactory(
    Function<? super X509Certificate, byte[]> fingerprintFunc,
    String... fingerprints) {
    ...
}

We could also consider implementing more versatile TrustManagerFactory by extracting the verification logic out of the TrustManagerFactory, e.g.

SomeTrustManagerFactory
  .builder()
  .add(CertificateMatchers.fingerprint("SHA256", "deadbeef..."))
  .add("bar.foo.com", CertificateMatchers.strict())
  .add("*.foo.com", CertificateMatchers.any());
  .build();