archive/jdk
1
0
Fork 0
mirror of https://github.com/openjdk/jdk.git synced 2025-08-28 07:14:30 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions

8277976: Break up SEQUENCE in X509Certificate::getSubjectAlternativeNames and X509Certificate::getIssuerAlternativeNames in otherName

Browse source 
6776681: Invalid encoding of an OtherName in X509Certificate.getAlternativeNames()

Reviewed-by: mullan
This commit is contained in:
Weijun Wang 2022-02-28 17:00:47 +00:00
parent 4e7fb41daf
commit 59b3ecc591
4 changed files with 154 additions and 22 deletions
Download patch file Download diff file Expand all files Collapse all files

30
src/java.base/share/classes/java/security/cert/X509Certificate.java
View file

@ -1,5 +1,5 @@
/*
* Copyright (c) 1997, 2020, Oracle and/or its affiliates. All rights reserved.
* Copyright (c) 1997, 2022, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
@ -562,6 +562,10 @@ implements X509Extension {
* uniformResourceIdentifier [6] IA5String,
* iPAddress [7] OCTET STRING,
* registeredID [8] OBJECT IDENTIFIER}
*
* OtherName ::= SEQUENCE {
* type-id OBJECT IDENTIFIER,
* value [0] EXPLICIT ANY DEFINED BY type-id }
* </pre>
* <p>
* If this certificate does not contain a {@code SubjectAltName}
@ -571,7 +575,7 @@ implements X509Extension {
* {@code List} whose first entry is an {@code Integer}
* (the name type, 0-8) and whose second entry is a {@code String}
* or a byte array (the name, in string or ASN.1 DER encoded form,
* respectively).
* respectively). More entries may exist depending on the name type.
* <p>
* <a href="http://www.ietf.org/rfc/rfc822.txt">RFC 822</a>, DNS, and URI
* names are returned as {@code String}s,
@ -581,12 +585,18 @@ implements X509Extension {
* in the form "a1:a2:...:a8", where a1-a8 are hexadecimal values
* representing the eight 16-bit pieces of the address. OID names are
* returned as {@code String}s represented as a series of nonnegative
* integers separated by periods. And directory names (distinguished names)
* integers separated by periods. Directory names (distinguished names)
* are returned in <a href="http://www.ietf.org/rfc/rfc2253.txt">
* RFC 2253</a> string format. No standard string format is
* defined for otherNames, X.400 names, EDI party names, or any
* other type of names. They are returned as byte arrays
* containing the ASN.1 DER encoded form of the name.
* RFC 2253</a> string format. No standard string format is defined for
* X.400 names or EDI party names. They are returned as byte arrays
* containing the ASN.1 DER encoded form of the name. otherNames are also
* returned as byte arrays containing the ASN.1 DER encoded form of the
* name. A third entry may also be present in the list containing the
* {@code type-id} of the otherName in string form, and a fourth entry
* containing its {@code value} as either a string (if the value is
* a valid supported character string) or a byte array containing the
* ASN.1 DER encoded form of the value without the context-specific
* constructed tag with number 0.
* <p>
* Note that the {@code Collection} returned may contain more
* than one name of the same type. Also, note that the returned
@ -599,6 +609,9 @@ implements X509Extension {
* and it provides a default implementation. Subclasses
* should override this method with a correct implementation.
*
* @implNote The JDK SUN provider supports the third and fourth
* otherName entries.
*
* @return an immutable {@code Collection} of subject alternative
* names (or {@code null})
* @throws CertificateParsingException if the extension cannot be decoded
@ -627,7 +640,8 @@ implements X509Extension {
* {@code List} whose first entry is an {@code Integer}
* (the name type, 0-8) and whose second entry is a {@code String}
* or a byte array (the name, in string or ASN.1 DER encoded form,
* respectively). For more details about the formats used for each
* respectively). More entries may exist depending on the name type.
* For more details about the formats used for each
* name type, see the {@code getSubjectAlternativeNames} method.
* <p>
* Note that the {@code Collection} returned may contain more

31
src/java.base/share/classes/sun/security/x509/OtherName.java
View file

@ -1,5 +1,5 @@
/*
* Copyright (c) 1998, 2015, Oracle and/or its affiliates. All rights reserved.
* Copyright (c) 1998, 2022, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
@ -48,10 +48,10 @@ import sun.security.util.*;
*/
public class OtherName implements GeneralNameInterface {
private String name;
private ObjectIdentifier oid;
private byte[] nameValue = null;
private GeneralNameInterface gni = null;
private final ObjectIdentifier oid;
private final String name;
private final byte[] nameValue; // value inside [0]
private final GeneralNameInterface gni;
private static final byte TAG_VALUE = 0;
@ -89,8 +89,12 @@ public class OtherName implements GeneralNameInterface {
DerInputStream in = derValue.toDerInputStream();
oid = in.getOID();
DerValue val = in.getDerValue();
nameValue = val.toByteArray();
DerValue derValue1 = in.getDerValue();
if (derValue1.isContextSpecific((byte) 0) && derValue1.isConstructed()) {
nameValue = derValue1.data.toByteArray();
} else {
throw new IOException("value is not EXPLICTly tagged [0]");
}
gni = getGNI(oid, nameValue);
if (gni != null) {
name = gni.toString();
@ -125,12 +129,13 @@ public class OtherName implements GeneralNameInterface {
return null;
}
Class<?>[] params = { Object.class };
Constructor<?> cons = extClass.getConstructor(params);
Object[] passed = new Object[] { nameValue };
GeneralNameInterface gni =
(GeneralNameInterface)cons.newInstance(passed);
return gni;
Constructor<?> cons;
try {
cons = extClass.getConstructor(Object.class);
} catch (NoSuchMethodException e) {
cons = extClass.getConstructor(byte[].class);
}
return (GeneralNameInterface)cons.newInstance(nameValue);
} catch (Exception e) {
throw new IOException("Instantiation error: " + e, e);
}

13
src/java.base/share/classes/sun/security/x509/X509CertImpl.java
View file

@ -1,5 +1,5 @@
/*
* Copyright (c) 1996, 2021, Oracle and/or its affiliates. All rights reserved.
* Copyright (c) 1996, 2022, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
@ -1584,6 +1584,17 @@ public class X509CertImpl extends X509Certificate implements DerEncoder {
throw new RuntimeException("name cannot be encoded", ioe);
}
nameEntry.add(derOut.toByteArray());
if (name.getType() == GeneralNameInterface.NAME_ANY
&& name instanceof OtherName oname) {
nameEntry.add(oname.getOID().toString());
byte[] nameValue = oname.getNameValue();
try {
String v = new DerValue(nameValue).getAsString();
nameEntry.add(v == null ? nameValue : v);
} catch (IOException ioe) {
nameEntry.add(nameValue);
}
}
break;
}
newNames.add(Collections.unmodifiableList(nameEntry));