| /* |
| * Copyright (c) 2012, 2013, Oracle and/or its affiliates. All rights reserved. |
| * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. |
| * |
| * This code is free software; you can redistribute it and/or modify it |
| * under the terms of the GNU General Public License version 2 only, as |
| * published by the Free Software Foundation. Oracle designates this |
| * particular file as subject to the "Classpath" exception as provided |
| * by Oracle in the LICENSE file that accompanied this code. |
| * |
| * This code is distributed in the hope that it will be useful, but WITHOUT |
| * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or |
| * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License |
| * version 2 for more details (a copy is included in the LICENSE file that |
| * accompanied this code). |
| * |
| * You should have received a copy of the GNU General Public License version |
| * 2 along with this work; if not, write to the Free Software Foundation, |
| * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA. |
| * |
| * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA |
| * or visit www.oracle.com if you need additional information or have any |
| * questions. |
| */ |
| |
| package javax.net.ssl; |
| |
| import java.net.IDN; |
| import java.nio.ByteBuffer; |
| import java.nio.charset.CodingErrorAction; |
| import java.nio.charset.StandardCharsets; |
| import java.nio.charset.CharsetDecoder; |
| import java.nio.charset.CharacterCodingException; |
| import java.util.Locale; |
| import java.util.Objects; |
| import java.util.regex.Pattern; |
| |
| /** |
| * Instances of this class represent a server name of type |
| * {@link StandardConstants#SNI_HOST_NAME host_name} in a Server Name |
| * Indication (SNI) extension. |
| * <P> |
| * As described in section 3, "Server Name Indication", of |
| * <A HREF="http://www.ietf.org/rfc/rfc6066.txt">TLS Extensions (RFC 6066)</A>, |
| * "HostName" contains the fully qualified DNS hostname of the server, as |
| * understood by the client. The encoded server name value of a hostname is |
| * represented as a byte string using ASCII encoding without a trailing dot. |
| * This allows the support of Internationalized Domain Names (IDN) through |
| * the use of A-labels (the ASCII-Compatible Encoding (ACE) form of a valid |
| * string of Internationalized Domain Names for Applications (IDNA)) defined |
| * in <A HREF="http://www.ietf.org/rfc/rfc5890.txt">RFC 5890</A>. |
| * <P> |
| * Note that {@code SNIHostName} objects are immutable. |
| * |
| * @see SNIServerName |
| * @see StandardConstants#SNI_HOST_NAME |
| * |
| * @since 1.8 |
| */ |
| public final class SNIHostName extends SNIServerName { |
| |
| // the decoded string value of the server name |
| private final String hostname; |
| |
| /** |
| * Creates an {@code SNIHostName} using the specified hostname. |
| * <P> |
| * Note that per <A HREF="http://www.ietf.org/rfc/rfc6066.txt">RFC 6066</A>, |
| * the encoded server name value of a hostname is |
| * {@link StandardCharsets#US_ASCII}-compliant. In this method, |
| * {@code hostname} can be a user-friendly Internationalized Domain Name |
| * (IDN). {@link IDN#toASCII(String, int)} is used to enforce the |
| * restrictions on ASCII characters in hostnames (see |
| * <A HREF="http://www.ietf.org/rfc/rfc3490.txt">RFC 3490</A>, |
| * <A HREF="http://www.ietf.org/rfc/rfc1122.txt">RFC 1122</A>, |
| * <A HREF="http://www.ietf.org/rfc/rfc1123.txt">RFC 1123</A>) and |
| * translate the {@code hostname} into ASCII Compatible Encoding (ACE), as: |
| * <pre> |
| * IDN.toASCII(hostname, IDN.USE_STD3_ASCII_RULES); |
| * </pre> |
| * <P> |
| * The {@code hostname} argument is illegal if it: |
| * <ul> |
| * <li> {@code hostname} is empty,</li> |
| * <li> {@code hostname} ends with a trailing dot,</li> |
| * <li> {@code hostname} is not a valid Internationalized |
| * Domain Name (IDN) compliant with the RFC 3490 specification.</li> |
| * </ul> |
| * @param hostname |
| * the hostname of this server name |
| * |
| * @throws NullPointerException if {@code hostname} is {@code null} |
| * @throws IllegalArgumentException if {@code hostname} is illegal |
| */ |
| public SNIHostName(String hostname) { |
| // IllegalArgumentException will be thrown if {@code hostname} is |
| // not a valid IDN. |
| super(StandardConstants.SNI_HOST_NAME, |
| (hostname = IDN.toASCII( |
| Objects.requireNonNull(hostname, |
| "Server name value of host_name cannot be null"), |
| IDN.USE_STD3_ASCII_RULES)) |
| .getBytes(StandardCharsets.US_ASCII)); |
| |
| this.hostname = hostname; |
| |
| // check the validity of the string hostname |
| checkHostName(); |
| } |
| |
| /** |
| * Creates an {@code SNIHostName} using the specified encoded value. |
| * <P> |
| * This method is normally used to parse the encoded name value in a |
| * requested SNI extension. |
| * <P> |
| * Per <A HREF="http://www.ietf.org/rfc/rfc6066.txt">RFC 6066</A>, |
| * the encoded name value of a hostname is |
| * {@link StandardCharsets#US_ASCII}-compliant. However, in the previous |
| * version of the SNI extension ( |
| * <A HREF="http://www.ietf.org/rfc/rfc4366.txt">RFC 4366</A>), |
| * the encoded hostname is represented as a byte string using UTF-8 |
| * encoding. For the purpose of version tolerance, this method allows |
| * that the charset of {@code encoded} argument can be |
| * {@link StandardCharsets#UTF_8}, as well as |
| * {@link StandardCharsets#US_ASCII}. {@link IDN#toASCII(String)} is used |
| * to translate the {@code encoded} argument into ASCII Compatible |
| * Encoding (ACE) hostname. |
| * <P> |
| * It is strongly recommended that this constructor is only used to parse |
| * the encoded name value in a requested SNI extension. Otherwise, to |
| * comply with <A HREF="http://www.ietf.org/rfc/rfc6066.txt">RFC 6066</A>, |
| * please always use {@link StandardCharsets#US_ASCII}-compliant charset |
| * and enforce the restrictions on ASCII characters in hostnames (see |
| * <A HREF="http://www.ietf.org/rfc/rfc3490.txt">RFC 3490</A>, |
| * <A HREF="http://www.ietf.org/rfc/rfc1122.txt">RFC 1122</A>, |
| * <A HREF="http://www.ietf.org/rfc/rfc1123.txt">RFC 1123</A>) |
| * for {@code encoded} argument, or use |
| * {@link SNIHostName#SNIHostName(String)} instead. |
| * <P> |
| * The {@code encoded} argument is illegal if it: |
| * <ul> |
| * <li> {@code encoded} is empty,</li> |
| * <li> {@code encoded} ends with a trailing dot,</li> |
| * <li> {@code encoded} is not encoded in |
| * {@link StandardCharsets#US_ASCII} or |
| * {@link StandardCharsets#UTF_8}-compliant charset,</li> |
| * <li> {@code encoded} is not a valid Internationalized |
| * Domain Name (IDN) compliant with the RFC 3490 specification.</li> |
| * </ul> |
| * |
| * <P> |
| * Note that the {@code encoded} byte array is cloned |
| * to protect against subsequent modification. |
| * |
| * @param encoded |
| * the encoded hostname of this server name |
| * |
| * @throws NullPointerException if {@code encoded} is {@code null} |
| * @throws IllegalArgumentException if {@code encoded} is illegal |
| */ |
| public SNIHostName(byte[] encoded) { |
| // NullPointerException will be thrown if {@code encoded} is null |
| super(StandardConstants.SNI_HOST_NAME, encoded); |
| |
| // Compliance: RFC 4366 requires that the hostname is represented |
| // as a byte string using UTF_8 encoding [UTF8] |
| try { |
| // Please don't use {@link String} constructors because they |
| // do not report coding errors. |
| CharsetDecoder decoder = StandardCharsets.UTF_8.newDecoder() |
| .onMalformedInput(CodingErrorAction.REPORT) |
| .onUnmappableCharacter(CodingErrorAction.REPORT); |
| |
| this.hostname = IDN.toASCII( |
| decoder.decode(ByteBuffer.wrap(encoded)).toString()); |
| } catch (RuntimeException | CharacterCodingException e) { |
| throw new IllegalArgumentException( |
| "The encoded server name value is invalid", e); |
| } |
| |
| // check the validity of the string hostname |
| checkHostName(); |
| } |
| |
| /** |
| * Returns the {@link StandardCharsets#US_ASCII}-compliant hostname of |
| * this {@code SNIHostName} object. |
| * <P> |
| * Note that, per |
| * <A HREF="http://www.ietf.org/rfc/rfc6066.txt">RFC 6066</A>, the |
| * returned hostname may be an internationalized domain name that |
| * contains A-labels. See |
| * <A HREF="http://www.ietf.org/rfc/rfc5890.txt">RFC 5890</A> |
| * for more information about the detailed A-label specification. |
| * |
| * @return the {@link StandardCharsets#US_ASCII}-compliant hostname |
| * of this {@code SNIHostName} object |
| */ |
| public String getAsciiName() { |
| return hostname; |
| } |
| |
| /** |
| * Compares this server name to the specified object. |
| * <P> |
| * Per <A HREF="http://www.ietf.org/rfc/rfc6066.txt">RFC 6066</A>, DNS |
| * hostnames are case-insensitive. Two server hostnames are equal if, |
| * and only if, they have the same name type, and the hostnames are |
| * equal in a case-independent comparison. |
| * |
| * @param other |
| * the other server name object to compare with. |
| * @return true if, and only if, the {@code other} is considered |
| * equal to this instance |
| */ |
| @Override |
| public boolean equals(Object other) { |
| if (this == other) { |
| return true; |
| } |
| |
| if (other instanceof SNIHostName) { |
| return hostname.equalsIgnoreCase(((SNIHostName)other).hostname); |
| } |
| |
| return false; |
| } |
| |
| /** |
| * Returns a hash code value for this {@code SNIHostName}. |
| * <P> |
| * The hash code value is generated using the case-insensitive hostname |
| * of this {@code SNIHostName}. |
| * |
| * @return a hash code value for this {@code SNIHostName}. |
| */ |
| @Override |
| public int hashCode() { |
| int result = 17; // 17/31: prime number to decrease collisions |
| result = 31 * result + hostname.toUpperCase(Locale.ENGLISH).hashCode(); |
| |
| return result; |
| } |
| |
| /** |
| * Returns a string representation of the object, including the DNS |
| * hostname in this {@code SNIHostName} object. |
| * <P> |
| * The exact details of the representation are unspecified and subject |
| * to change, but the following may be regarded as typical: |
| * <pre> |
| * "type=host_name (0), value={@literal <hostname>}" |
| * </pre> |
| * The "{@literal <hostname>}" is an ASCII representation of the hostname, |
| * which may contains A-labels. For example, a returned value of an pseudo |
| * hostname may look like: |
| * <pre> |
| * "type=host_name (0), value=www.example.com" |
| * </pre> |
| * or |
| * <pre> |
| * "type=host_name (0), value=xn--fsqu00a.xn--0zwm56d" |
| * </pre> |
| * <P> |
| * Please NOTE that the exact details of the representation are unspecified |
| * and subject to change. |
| * |
| * @return a string representation of the object. |
| */ |
| @Override |
| public String toString() { |
| return "type=host_name (0), value=" + hostname; |
| } |
| |
| /** |
| * Creates an {@link SNIMatcher} object for {@code SNIHostName}s. |
| * <P> |
| * This method can be used by a server to verify the acceptable |
| * {@code SNIHostName}s. For example, |
| * <pre> |
| * SNIMatcher matcher = |
| * SNIHostName.createSNIMatcher("www\\.example\\.com"); |
| * </pre> |
| * will accept the hostname "www.example.com". |
| * <pre> |
| * SNIMatcher matcher = |
| * SNIHostName.createSNIMatcher("www\\.example\\.(com|org)"); |
| * </pre> |
| * will accept hostnames "www.example.com" and "www.example.org". |
| * |
| * @param regex |
| * the <a href="{@docRoot}/java/util/regex/Pattern.html#sum"> |
| * regular expression pattern</a> |
| * representing the hostname(s) to match |
| * @return a {@code SNIMatcher} object for {@code SNIHostName}s |
| * @throws NullPointerException if {@code regex} is |
| * {@code null} |
| * @throws java.util.regex.PatternSyntaxException if the regular expression's |
| * syntax is invalid |
| */ |
| public static SNIMatcher createSNIMatcher(String regex) { |
| if (regex == null) { |
| throw new NullPointerException( |
| "The regular expression cannot be null"); |
| } |
| |
| return new SNIHostNameMatcher(regex); |
| } |
| |
| // check the validity of the string hostname |
| private void checkHostName() { |
| if (hostname.isEmpty()) { |
| throw new IllegalArgumentException( |
| "Server name value of host_name cannot be empty"); |
| } |
| |
| if (hostname.endsWith(".")) { |
| throw new IllegalArgumentException( |
| "Server name value of host_name cannot have the trailing dot"); |
| } |
| } |
| |
| private final static class SNIHostNameMatcher extends SNIMatcher { |
| |
| // the compiled representation of a regular expression. |
| private final Pattern pattern; |
| |
| /** |
| * Creates an SNIHostNameMatcher object. |
| * |
| * @param regex |
| * the <a href="{@docRoot}/java/util/regex/Pattern.html#sum"> |
| * regular expression pattern</a> |
| * representing the hostname(s) to match |
| * @throws NullPointerException if {@code regex} is |
| * {@code null} |
| * @throws PatternSyntaxException if the regular expression's syntax |
| * is invalid |
| */ |
| SNIHostNameMatcher(String regex) { |
| super(StandardConstants.SNI_HOST_NAME); |
| pattern = Pattern.compile(regex, Pattern.CASE_INSENSITIVE); |
| } |
| |
| /** |
| * Attempts to match the given {@link SNIServerName}. |
| * |
| * @param serverName |
| * the {@link SNIServerName} instance on which this matcher |
| * performs match operations |
| * |
| * @return {@code true} if, and only if, the matcher matches the |
| * given {@code serverName} |
| * |
| * @throws NullPointerException if {@code serverName} is {@code null} |
| * @throws IllegalArgumentException if {@code serverName} is |
| * not of {@code StandardConstants#SNI_HOST_NAME} type |
| * |
| * @see SNIServerName |
| */ |
| @Override |
| public boolean matches(SNIServerName serverName) { |
| if (serverName == null) { |
| throw new NullPointerException( |
| "The SNIServerName argument cannot be null"); |
| } |
| |
| SNIHostName hostname; |
| if (!(serverName instanceof SNIHostName)) { |
| if (serverName.getType() != StandardConstants.SNI_HOST_NAME) { |
| throw new IllegalArgumentException( |
| "The server name type is not host_name"); |
| } |
| |
| try { |
| hostname = new SNIHostName(serverName.getEncoded()); |
| } catch (NullPointerException | IllegalArgumentException e) { |
| return false; |
| } |
| } else { |
| hostname = (SNIHostName)serverName; |
| } |
| |
| // Let's first try the ascii name matching |
| String asciiName = hostname.getAsciiName(); |
| if (pattern.matcher(asciiName).matches()) { |
| return true; |
| } |
| |
| // May be an internationalized domain name, check the Unicode |
| // representations. |
| return pattern.matcher(IDN.toUnicode(asciiName)).matches(); |
| } |
| } |
| } |
