1 /* 2 * Copyright (c) 1997, 2018, Oracle and/or its affiliates. All rights reserved. 3 * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. 4 * 5 * This code is free software; you can redistribute it and/or modify it 6 * under the terms of the GNU General Public License version 2 only, as 7 * published by the Free Software Foundation. Oracle designates this 8 * particular file as subject to the "Classpath" exception as provided 9 * by Oracle in the LICENSE file that accompanied this code. 10 * 11 * This code is distributed in the hope that it will be useful, but WITHOUT 12 * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or 13 * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License 14 * version 2 for more details (a copy is included in the LICENSE file that 15 * accompanied this code). 16 * 17 * You should have received a copy of the GNU General Public License version 18 * 2 along with this work; if not, write to the Free Software Foundation, 19 * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA. 20 * 21 * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA 22 * or visit www.oracle.com if you need additional information or have any 23 * questions. 24 */ 25 26 package sun.security.x509; 27 28 import java.io.IOException; 29 import java.util.Locale; 30 31 import sun.security.util.*; 32 33 /** 34 * This class implements the DNSName as required by the GeneralNames 35 * ASN.1 object. 36 * <p> 37 * [RFC5280] When the subjectAltName extension contains a domain name system 38 * label, the domain name MUST be stored in the dNSName (an IA5String). 39 * The name MUST be in the "preferred name syntax", as specified by 40 * Section 3.5 of [RFC1034] and as modified by Section 2.1 of 41 * [RFC1123]. Note that while uppercase and lowercase letters are 42 * allowed in domain names, no significance is attached to the case. In 43 * addition, while the string " " is a legal domain name, subjectAltName 44 * extensions with a dNSName of " " MUST NOT be used. Finally, the use 45 * of the DNS representation for Internet mail addresses 46 * (subscriber.example.com instead of subscriber@example.com) MUST NOT 47 * be used; such identities are to be encoded as rfc822Name. 48 * 49 * @author Amit Kapoor 50 * @author Hemma Prafullchandra 51 */ 52 public class DNSName implements GeneralNameInterface { 53 private String name; 54 55 private static final String alphaDigits = 56 "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789"; 57 58 /** 59 * Create the DNSName object from the passed encoded Der value. 60 * 61 * @param derValue the encoded DER DNSName. 62 * @exception IOException on error. 63 */ 64 public DNSName(DerValue derValue) throws IOException { 65 name = derValue.getIA5String(); 66 } 67 68 /** 69 * Create the DNSName object with the specified name. 70 * 71 * @param name the DNSName. 72 * @throws IOException if the name is not a valid DNSName subjectAltName 73 */ 74 public DNSName(String name) throws IOException { 75 if (name == null || name.isEmpty()) 76 throw new IOException("DNSName must not be null or empty"); 77 if (name.contains(" ")) 78 throw new IOException("DNSName with blank components is not permitted"); 79 if (name.startsWith(".") || name.endsWith(".")) 80 throw new IOException("DNSName may not begin or end with a ."); 81 /* 82 * Name will consist of label components separated by "." 83 * startIndex is the index of the first character of a component 84 * endIndex is the index of the last character of a component plus 1 85 */ 86 for (int endIndex,startIndex = 0; startIndex < name.length(); startIndex = endIndex+1) { 87 endIndex = name.indexOf('.', startIndex); 88 if (endIndex < 0) { 89 endIndex = name.length(); 90 } 91 if (endIndex - startIndex < 1) 92 throw new IOException("DNSName with empty components are not permitted"); 93 94 // RFC 1123: DNSName components must begin with a letter or digit 95 if (alphaDigits.indexOf(name.charAt(startIndex)) < 0) 96 throw new IOException("DNSName components must begin with a letter or digit"); 97 //nonStartIndex: index for characters in the component beyond the first one 98 for (int nonStartIndex=startIndex+1; nonStartIndex < endIndex; nonStartIndex++) { 99 char x = name.charAt(nonStartIndex); 100 if ((alphaDigits).indexOf(x) < 0 && x != '-') 101 throw new IOException("DNSName components must consist of letters, digits, and hyphens"); 102 } 103 } 104 this.name = name; 105 } 106 107 108 /** 109 * Return the type of the GeneralName. 110 */ 111 public int getType() { 112 return (GeneralNameInterface.NAME_DNS); 113 } 114 115 /** 116 * Return the actual name value of the GeneralName. 117 */ 118 public String getName() { 119 return name; 120 } 121 122 /** 123 * Encode the DNSName into the DerOutputStream. 124 * 125 * @param out the DER stream to encode the DNSName to. 126 * @exception IOException on encoding errors. 127 */ 128 public void encode(DerOutputStream out) throws IOException { 129 out.putIA5String(name); 130 } 131 132 /** 133 * Convert the name into user readable string. 134 */ 135 public String toString() { 136 return ("DNSName: " + name); 137 } 138 139 /** 140 * Compares this name with another, for equality. 141 * 142 * @return true iff the names are equivalent 143 * according to RFC5280. 144 */ 145 public boolean equals(Object obj) { 146 if (this == obj) 147 return true; 148 149 if (!(obj instanceof DNSName)) 150 return false; 151 152 DNSName other = (DNSName)obj; 153 154 // RFC5280 mandates that these names are 155 // not case-sensitive 156 return name.equalsIgnoreCase(other.name); 157 } 158 159 /** 160 * Returns the hash code value for this object. 161 * 162 * @return a hash code value for this object. 163 */ 164 public int hashCode() { 165 return name.toUpperCase(Locale.ENGLISH).hashCode(); 166 } 167 168 /** 169 * Return type of constraint inputName places on this name:<ul> 170 * <li>NAME_DIFF_TYPE = -1: input name is different type from name (i.e. does not constrain). 171 * <li>NAME_MATCH = 0: input name matches name. 172 * <li>NAME_NARROWS = 1: input name narrows name (is lower in the naming subtree) 173 * <li>NAME_WIDENS = 2: input name widens name (is higher in the naming subtree) 174 * <li>NAME_SAME_TYPE = 3: input name does not match or narrow name, but is same type. 175 * </ul>. These results are used in checking NameConstraints during 176 * certification path verification. 177 * <p> 178 * RFC5280: DNS name restrictions are expressed as host.example.com. 179 * Any DNS name that can be constructed by simply adding zero or more 180 * labels to the left-hand side of the name satisfies the name constraint. 181 * For example, www.host.example.com would satisfy the constraint but 182 * host1.example.com would not. 183 * <p> 184 * draft-ietf-pkix-new-part1-00.txt: DNSName restrictions are expressed as foo.bar.com. 185 * Any DNSName that 186 * can be constructed by simply adding to the left hand side of the name 187 * satisfies the name constraint. For example, www.foo.bar.com would 188 * satisfy the constraint but foo1.bar.com would not. 189 * <p> 190 * RFC1034: By convention, domain names can be stored with arbitrary case, but 191 * domain name comparisons for all present domain functions are done in a 192 * case-insensitive manner, assuming an ASCII character set, and a high 193 * order zero bit. 194 * 195 * @param inputName to be checked for being constrained 196 * @return constraint type above 197 * @throws UnsupportedOperationException if name is not exact match, but narrowing and widening are 198 * not supported for this name type. 199 */ 200 public int constrains(GeneralNameInterface inputName) throws UnsupportedOperationException { 201 int constraintType; 202 if (inputName == null) 203 constraintType = NAME_DIFF_TYPE; 204 else if (inputName.getType() != NAME_DNS) 205 constraintType = NAME_DIFF_TYPE; 206 else { 207 String inName = 208 (((DNSName)inputName).getName()).toLowerCase(Locale.ENGLISH); 209 String thisName = name.toLowerCase(Locale.ENGLISH); 210 if (inName.equals(thisName)) 211 constraintType = NAME_MATCH; 212 else if (thisName.endsWith(inName)) { 213 int inNdx = thisName.lastIndexOf(inName); 214 if (thisName.charAt(inNdx-1) == '.' ) 215 constraintType = NAME_WIDENS; 216 else 217 constraintType = NAME_SAME_TYPE; 218 } else if (inName.endsWith(thisName)) { 219 int ndx = inName.lastIndexOf(thisName); 220 if (inName.charAt(ndx-1) == '.' ) 221 constraintType = NAME_NARROWS; 222 else 223 constraintType = NAME_SAME_TYPE; 224 } else { 225 constraintType = NAME_SAME_TYPE; 226 } 227 } 228 return constraintType; 229 } 230 231 /** 232 * Return subtree depth of this name for purposes of determining 233 * NameConstraints minimum and maximum bounds and for calculating 234 * path lengths in name subtrees. 235 * 236 * @return distance of name from root 237 * @throws UnsupportedOperationException if not supported for this name type 238 */ 239 public int subtreeDepth() throws UnsupportedOperationException { 240 // subtree depth is always at least 1 241 int sum = 1; 242 243 // count dots 244 for (int i = name.indexOf('.'); i >= 0; i = name.indexOf('.', i + 1)) { 245 ++sum; 246 } 247 248 return sum; 249 } 250 251 }