| /* |
| * Copyright (c) 1997, 2004, Oracle and/or its affiliates. All rights reserved. |
| * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. |
| * |
| * This code is free software; you can redistribute it and/or modify it |
| * under the terms of the GNU General Public License version 2 only, as |
| * published by the Free Software Foundation. Oracle designates this |
| * particular file as subject to the "Classpath" exception as provided |
| * by Oracle in the LICENSE file that accompanied this code. |
| * |
| * This code is distributed in the hope that it will be useful, but WITHOUT |
| * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or |
| * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License |
| * version 2 for more details (a copy is included in the LICENSE file that |
| * accompanied this code). |
| * |
| * You should have received a copy of the GNU General Public License version |
| * 2 along with this work; if not, write to the Free Software Foundation, |
| * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA. |
| * |
| * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA |
| * or visit www.oracle.com if you need additional information or have any |
| * questions. |
| */ |
| |
| package sun.security.x509; |
| |
| import java.io.IOException; |
| import java.net.URI; |
| import java.net.URISyntaxException; |
| |
| import sun.security.util.*; |
| |
| /** |
| * This class implements the URIName as required by the GeneralNames |
| * ASN.1 object. |
| * <p> |
| * [RFC3280] When the subjectAltName extension contains a URI, the name MUST be |
| * stored in the uniformResourceIdentifier (an IA5String). The name MUST |
| * be a non-relative URL, and MUST follow the URL syntax and encoding |
| * rules specified in [RFC 1738]. The name must include both a scheme |
| * (e.g., "http" or "ftp") and a scheme-specific-part. The scheme- |
| * specific-part must include a fully qualified domain name or IP |
| * address as the host. |
| * <p> |
| * As specified in [RFC 1738], the scheme name is not case-sensitive |
| * (e.g., "http" is equivalent to "HTTP"). The host part is also not |
| * case-sensitive, but other components of the scheme-specific-part may |
| * be case-sensitive. When comparing URIs, conforming implementations |
| * MUST compare the scheme and host without regard to case, but assume |
| * the remainder of the scheme-specific-part is case sensitive. |
| * <p> |
| * [RFC1738] In general, URLs are written as follows: |
| * <pre> |
| * <scheme>:<scheme-specific-part> |
| * </pre> |
| * A URL contains the name of the scheme being used (<scheme>) followed |
| * by a colon and then a string (the <scheme-specific-part>) whose |
| * interpretation depends on the scheme. |
| * <p> |
| * While the syntax for the rest of the URL may vary depending on the |
| * particular scheme selected, URL schemes that involve the direct use |
| * of an IP-based protocol to a specified host on the Internet use a |
| * common syntax for the scheme-specific data: |
| * <pre> |
| * //<user>:<password>@<host>:<port>/<url-path> |
| * </pre> |
| * [RFC2732] specifies that an IPv6 address contained inside a URL |
| * must be enclosed in square brackets (to allow distinguishing the |
| * colons that separate IPv6 components from the colons that separate |
| * scheme-specific data. |
| * <p> |
| * @author Amit Kapoor |
| * @author Hemma Prafullchandra |
| * @author Sean Mullan |
| * @author Steve Hanna |
| * @see GeneralName |
| * @see GeneralNames |
| * @see GeneralNameInterface |
| */ |
| public class URIName implements GeneralNameInterface { |
| |
| // private attributes |
| private URI uri; |
| private String host; |
| private DNSName hostDNS; |
| private IPAddressName hostIP; |
| |
| /** |
| * Create the URIName object from the passed encoded Der value. |
| * |
| * @param derValue the encoded DER URIName. |
| * @exception IOException on error. |
| */ |
| public URIName(DerValue derValue) throws IOException { |
| this(derValue.getIA5String()); |
| } |
| |
| /** |
| * Create the URIName object with the specified name. |
| * |
| * @param name the URIName. |
| * @throws IOException if name is not a proper URIName |
| */ |
| public URIName(String name) throws IOException { |
| try { |
| uri = new URI(name); |
| } catch (URISyntaxException use) { |
| throw (IOException) new IOException |
| ("invalid URI name:" + name).initCause(use); |
| } |
| if (uri.getScheme() == null) { |
| throw new IOException("URI name must include scheme:" + name); |
| } |
| |
| host = uri.getHost(); |
| // RFC 3280 says that the host should be non-null, but we allow it to |
| // be null because some widely deployed certificates contain CDP |
| // extensions with URIs that have no hostname (see bugs 4802236 and |
| // 5107944). |
| if (host != null) { |
| if (host.charAt(0) == '[') { |
| // Verify host is a valid IPv6 address name |
| String ipV6Host = host.substring(1, host.length()-1); |
| try { |
| hostIP = new IPAddressName(ipV6Host); |
| } catch (IOException ioe) { |
| throw new IOException("invalid URI name (host " + |
| "portion is not a valid IPv6 address):" + name); |
| } |
| } else { |
| try { |
| hostDNS = new DNSName(host); |
| } catch (IOException ioe) { |
| // Not a valid DNS Name; see if it is a valid IPv4 |
| // IPAddressName |
| try { |
| hostIP = new IPAddressName(host); |
| } catch (Exception ioe2) { |
| throw new IOException("invalid URI name (host " + |
| "portion is not a valid DNS name, IPv4 address," + |
| " or IPv6 address):" + name); |
| } |
| } |
| } |
| } |
| } |
| |
| /** |
| * Create the URIName object with the specified name constraint. URI |
| * name constraints syntax is different than SubjectAltNames, etc. See |
| * 4.2.1.11 of RFC 3280. |
| * |
| * @param value the URI name constraint |
| * @throws IOException if name is not a proper URI name constraint |
| */ |
| public static URIName nameConstraint(DerValue value) throws IOException { |
| URI uri; |
| String name = value.getIA5String(); |
| try { |
| uri = new URI(name); |
| } catch (URISyntaxException use) { |
| throw (IOException) new IOException |
| ("invalid URI name constraint:" + name).initCause(use); |
| } |
| if (uri.getScheme() == null) { |
| String host = uri.getSchemeSpecificPart(); |
| try { |
| DNSName hostDNS; |
| if (host.charAt(0) == '.') { |
| hostDNS = new DNSName(host.substring(1)); |
| } else { |
| hostDNS = new DNSName(host); |
| } |
| return new URIName(uri, host, hostDNS); |
| } catch (IOException ioe) { |
| throw (IOException) new IOException |
| ("invalid URI name constraint:" + name).initCause(ioe); |
| } |
| } else { |
| throw new IOException("invalid URI name constraint (should not " + |
| "include scheme):" + name); |
| } |
| } |
| |
| URIName(URI uri, String host, DNSName hostDNS) { |
| this.uri = uri; |
| this.host = host; |
| this.hostDNS = hostDNS; |
| } |
| |
| /** |
| * Return the type of the GeneralName. |
| */ |
| public int getType() { |
| return GeneralNameInterface.NAME_URI; |
| } |
| |
| /** |
| * Encode the URI name into the DerOutputStream. |
| * |
| * @param out the DER stream to encode the URIName to. |
| * @exception IOException on encoding errors. |
| */ |
| public void encode(DerOutputStream out) throws IOException { |
| out.putIA5String(uri.toASCIIString()); |
| } |
| |
| /** |
| * Convert the name into user readable string. |
| */ |
| public String toString() { |
| return "URIName: " + uri.toString(); |
| } |
| |
| /** |
| * Compares this name with another, for equality. |
| * |
| * @return true iff the names are equivalent according to RFC2459. |
| */ |
| public boolean equals(Object obj) { |
| if (this == obj) { |
| return true; |
| } |
| |
| if (!(obj instanceof URIName)) { |
| return false; |
| } |
| |
| URIName other = (URIName) obj; |
| |
| return uri.equals(other.getURI()); |
| } |
| |
| /** |
| * Returns the URIName as a java.net.URI object |
| */ |
| public URI getURI() { |
| return uri; |
| } |
| |
| /** |
| * Returns this URI name. |
| */ |
| public String getName() { |
| return uri.toString(); |
| } |
| |
| /** |
| * Return the scheme name portion of a URIName |
| * |
| * @returns scheme portion of full name |
| */ |
| public String getScheme() { |
| return uri.getScheme(); |
| } |
| |
| /** |
| * Return the host name or IP address portion of the URIName |
| * |
| * @returns host name or IP address portion of full name |
| */ |
| public String getHost() { |
| return host; |
| } |
| |
| /** |
| * Return the host object type; if host name is a |
| * DNSName, then this host object does not include any |
| * initial "." on the name. |
| * |
| * @returns host name as DNSName or IPAddressName |
| */ |
| public Object getHostObject() { |
| if (hostIP != null) { |
| return hostIP; |
| } else { |
| return hostDNS; |
| } |
| } |
| |
| /** |
| * Returns the hash code value for this object. |
| * |
| * @return a hash code value for this object. |
| */ |
| public int hashCode() { |
| return uri.hashCode(); |
| } |
| |
| /** |
| * Return type of constraint inputName places on this name:<ul> |
| * <li>NAME_DIFF_TYPE = -1: input name is different type from name |
| * (i.e. does not constrain). |
| * <li>NAME_MATCH = 0: input name matches name. |
| * <li>NAME_NARROWS = 1: input name narrows name (is lower in the naming |
| * subtree) |
| * <li>NAME_WIDENS = 2: input name widens name (is higher in the naming |
| * subtree) |
| * <li>NAME_SAME_TYPE = 3: input name does not match or narrow name, but |
| * is same type. |
| * </ul>. |
| * These results are used in checking NameConstraints during |
| * certification path verification. |
| * <p> |
| * RFC3280: For URIs, the constraint applies to the host part of the name. |
| * The constraint may specify a host or a domain. Examples would be |
| * "foo.bar.com"; and ".xyz.com". When the the constraint begins with |
| * a period, it may be expanded with one or more subdomains. That is, |
| * the constraint ".xyz.com" is satisfied by both abc.xyz.com and |
| * abc.def.xyz.com. However, the constraint ".xyz.com" is not satisfied |
| * by "xyz.com". When the constraint does not begin with a period, it |
| * specifies a host. |
| * <p> |
| * @param inputName to be checked for being constrained |
| * @returns constraint type above |
| * @throws UnsupportedOperationException if name is not exact match, but |
| * narrowing and widening are not supported for this name type. |
| */ |
| public int constrains(GeneralNameInterface inputName) |
| throws UnsupportedOperationException { |
| int constraintType; |
| if (inputName == null) { |
| constraintType = NAME_DIFF_TYPE; |
| } else if (inputName.getType() != NAME_URI) { |
| constraintType = NAME_DIFF_TYPE; |
| } else { |
| // Assuming from here on that one or both of these is |
| // actually a URI name constraint (not a URI), so we |
| // only need to compare the host portion of the name |
| |
| String otherHost = ((URIName)inputName).getHost(); |
| |
| // Quick check for equality |
| if (otherHost.equalsIgnoreCase(host)) { |
| constraintType = NAME_MATCH; |
| } else { |
| Object otherHostObject = ((URIName)inputName).getHostObject(); |
| |
| if ((hostDNS == null) || |
| !(otherHostObject instanceof DNSName)) { |
| // If one (or both) is an IP address, only same type |
| constraintType = NAME_SAME_TYPE; |
| } else { |
| // Both host portions are DNS names. Are they domains? |
| boolean thisDomain = (host.charAt(0) == '.'); |
| boolean otherDomain = (otherHost.charAt(0) == '.'); |
| DNSName otherDNS = (DNSName) otherHostObject; |
| |
| // Run DNSName.constrains. |
| constraintType = hostDNS.constrains(otherDNS); |
| // If neither one is a domain, then they can't |
| // widen or narrow. That's just SAME_TYPE. |
| if ((!thisDomain && !otherDomain) && |
| ((constraintType == NAME_WIDENS) || |
| (constraintType == NAME_NARROWS))) { |
| constraintType = NAME_SAME_TYPE; |
| } |
| |
| // If one is a domain and the other isn't, |
| // then they can't match. The one that's a |
| // domain doesn't include the one that's |
| // not a domain. |
| if ((thisDomain != otherDomain) && |
| (constraintType == NAME_MATCH)) { |
| if (thisDomain) { |
| constraintType = NAME_WIDENS; |
| } else { |
| constraintType = NAME_NARROWS; |
| } |
| } |
| } |
| } |
| } |
| return constraintType; |
| } |
| |
| /** |
| * Return subtree depth of this name for purposes of determining |
| * NameConstraints minimum and maximum bounds and for calculating |
| * path lengths in name subtrees. |
| * |
| * @returns distance of name from root |
| * @throws UnsupportedOperationException if not supported for this name type |
| */ |
| public int subtreeDepth() throws UnsupportedOperationException { |
| DNSName dnsName = null; |
| try { |
| dnsName = new DNSName(host); |
| } catch (IOException ioe) { |
| throw new UnsupportedOperationException(ioe.getMessage()); |
| } |
| return dnsName.subtreeDepth(); |
| } |
| } |
