archive/jdk
1
0
Fork 0
mirror of https://github.com/openjdk/jdk.git synced 2025-08-27 06:45:07 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions

8213952: Relax DNSName restriction as per RFC 1123

Browse source 
Reviewed-by: weijun, mullan, chegar
This commit is contained in:
Sean Coffey 2018-12-05 17:33:01 +00:00
parent 69f0bf41d9
commit 441d285620
7 changed files with 138 additions and 41 deletions
Download patch file Download diff file Expand all files Collapse all files

75
src/java.base/share/classes/sun/security/x509/DNSName.java
View file

@ -1,5 +1,5 @@
/*
* Copyright (c) 1997, 2011, Oracle and/or its affiliates. All rights reserved.
* Copyright (c) 1997, 2018, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
@ -34,16 +34,17 @@ import sun.security.util.*;
* This class implements the DNSName as required by the GeneralNames
* ASN.1 object.
* <p>
* [RFC2459] When the subjectAltName extension contains a domain name service
* [RFC5280] When the subjectAltName extension contains a domain name system
* label, the domain name MUST be stored in the dNSName (an IA5String).
* The name MUST be in the "preferred name syntax," as specified by RFC
* 1034 [RFC 1034]. Note that while upper and lower case letters are
* allowed in domain names, no signifigance is attached to the case. In
* The name MUST be in the "preferred name syntax", as specified by
* Section 3.5 of [RFC1034] and as modified by Section 2.1 of
* [RFC1123]. Note that while uppercase and lowercase letters are
* allowed in domain names, no significance is attached to the case. In
* addition, while the string " " is a legal domain name, subjectAltName
* extensions with a dNSName " " are not permitted. Finally, the use of
* the DNS representation for Internet mail addresses (wpolk.nist.gov
* instead of wpolk@nist.gov) is not permitted; such identities are to
* be encoded as rfc822Name.
* extensions with a dNSName of " " MUST NOT be used. Finally, the use
* of the DNS representation for Internet mail addresses
* (subscriber.example.com instead of subscriber@example.com) MUST NOT
* be used; such identities are to be encoded as rfc822Name.
*
* @author Amit Kapoor
* @author Hemma Prafullchandra
@ -51,9 +52,8 @@ import sun.security.util.*;
public class DNSName implements GeneralNameInterface {
private String name;
private static final String alpha = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz";
private static final String digitsAndHyphen = "0123456789-";
private static final String alphaDigitsAndHyphen = alpha + digitsAndHyphen;
private static final String alphaDigits =
"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789";
/**
* Create the DNSName object from the passed encoded Der value.
@ -73,35 +73,38 @@ public class DNSName implements GeneralNameInterface {
*/
public DNSName(String name) throws IOException {
if (name == null || name.length() == 0)
throw new IOException("DNS name must not be null");
if (name.indexOf(' ') != -1)
throw new IOException("DNS names or NameConstraints with blank components are not permitted");
if (name.charAt(0) == '.' || name.charAt(name.length() -1) == '.')
throw new IOException("DNS names or NameConstraints may not begin or end with a .");
//Name will consist of label components separated by "."
//startIndex is the index of the first character of a component
//endIndex is the index of the last character of a component plus 1
for (int endIndex,startIndex=0; startIndex < name.length(); startIndex = endIndex+1) {
throw new IOException("DNSName must not be null or empty");
if (name.contains(" "))
throw new IOException("DNSName with blank components is not permitted");
if (name.startsWith(".") || name.endsWith("."))
throw new IOException("DNSName may not begin or end with a .");
/*
* Name will consist of label components separated by "."
* startIndex is the index of the first character of a component
* endIndex is the index of the last character of a component plus 1
*/
for (int endIndex,startIndex = 0; startIndex < name.length(); startIndex = endIndex+1) {
endIndex = name.indexOf('.', startIndex);
if (endIndex < 0) {
endIndex = name.length();
}
if ((endIndex-startIndex) < 1)
throw new IOException("DNSName SubjectAltNames with empty components are not permitted");
if (endIndex - startIndex < 1)
throw new IOException("DNSName with empty components are not permitted");
//DNSName components must begin with a letter A-Z or a-z
if (alpha.indexOf(name.charAt(startIndex)) < 0)
throw new IOException("DNSName components must begin with a letter");
// RFC 1123: DNSName components must begin with a letter or digit
if (alphaDigits.indexOf(name.charAt(startIndex)) < 0)
throw new IOException("DNSName components must begin with a letter or digit");
//nonStartIndex: index for characters in the component beyond the first one
for (int nonStartIndex=startIndex+1; nonStartIndex < endIndex; nonStartIndex++) {
char x = name.charAt(nonStartIndex);
if ((alphaDigitsAndHyphen).indexOf(x) < 0)
if ((alphaDigits).indexOf(x) < 0 && x != '-')
throw new IOException("DNSName components must consist of letters, digits, and hyphens");
}
}
this.name = name;
}
/**
* Return the type of the GeneralName.
*/
@ -117,7 +120,7 @@ public class DNSName implements GeneralNameInterface {
}
/**
* Encode the DNS name into the DerOutputStream.
* Encode the DNSName into the DerOutputStream.
*
* @param out the DER stream to encode the DNSName to.
* @exception IOException on encoding errors.
@ -137,7 +140,7 @@ public class DNSName implements GeneralNameInterface {
* Compares this name with another, for equality.
*
* @return true iff the names are equivalent
* according to RFC2459.
* according to RFC5280.
*/
public boolean equals(Object obj) {
if (this == obj)
@ -148,7 +151,7 @@ public class DNSName implements GeneralNameInterface {
DNSName other = (DNSName)obj;
// RFC2459 mandates that these names are
// RFC5280 mandates that these names are
// not case-sensitive
return name.equalsIgnoreCase(other.name);
}
@ -172,12 +175,14 @@ public class DNSName implements GeneralNameInterface {
* </ul>. These results are used in checking NameConstraints during
* certification path verification.
* <p>
* RFC2459: DNS name restrictions are expressed as foo.bar.com. Any subdomain
* satisfies the name constraint. For example, www.foo.bar.com would
* satisfy the constraint but bigfoo.bar.com would not.
* RFC5280: DNS name restrictions are expressed as host.example.com.
* Any DNS name that can be constructed by simply adding zero or more
* labels to the left-hand side of the name satisfies the name constraint.
* For example, www.host.example.com would satisfy the constraint but
* host1.example.com would not.
* <p>
* draft-ietf-pkix-new-part1-00.txt: DNS name restrictions are expressed as foo.bar.com.
* Any DNS name that
* draft-ietf-pkix-new-part1-00.txt: DNSName restrictions are expressed as foo.bar.com.
* Any DNSName that
* can be constructed by simply adding to the left hand side of the name
* satisfies the name constraint. For example, www.foo.bar.com would
* satisfy the constraint but foo1.bar.com would not.