/*
* Copyright (c) 1997, 2004, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License version 2 only, as
* published by the Free Software Foundation. Oracle designates this
* particular file as subject to the "Classpath" exception as provided
* by Oracle in the LICENSE file that accompanied this code.
*
* This code is distributed in the hope that it will be useful, but WITHOUT
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* version 2 for more details (a copy is included in the LICENSE file that
* accompanied this code).
*
* You should have received a copy of the GNU General Public License version
* 2 along with this work; if not, write to the Free Software Foundation,
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
*
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
* or visit www.oracle.com if you need additional information or have any
* questions.
*/
package sun.security.x509;
import java.io.IOException;
import java.net.URI;
import java.net.URISyntaxException;
import sun.security.util.*;
/**
* This class implements the URIName as required by the GeneralNames
* ASN.1 object.
* <p>
* [RFC3280] When the subjectAltName extension contains a URI, the name MUST be
* stored in the uniformResourceIdentifier (an IA5String). The name MUST
* be a non-relative URL, and MUST follow the URL syntax and encoding
* rules specified in [RFC 1738]. The name must include both a scheme
* (e.g., "http" or "ftp") and a scheme-specific-part. The scheme-
* specific-part must include a fully qualified domain name or IP
* address as the host.
* <p>
* As specified in [RFC 1738], the scheme name is not case-sensitive
* (e.g., "http" is equivalent to "HTTP"). The host part is also not
* case-sensitive, but other components of the scheme-specific-part may
* be case-sensitive. When comparing URIs, conforming implementations
* MUST compare the scheme and host without regard to case, but assume
* the remainder of the scheme-specific-part is case sensitive.
* <p>
* [RFC1738] In general, URLs are written as follows:
* <pre>
* <scheme>:<scheme-specific-part>
* </pre>
* A URL contains the name of the scheme being used (<scheme>) followed
* by a colon and then a string (the <scheme-specific-part>) whose
* interpretation depends on the scheme.
* <p>
* While the syntax for the rest of the URL may vary depending on the
* particular scheme selected, URL schemes that involve the direct use
* of an IP-based protocol to a specified host on the Internet use a
* common syntax for the scheme-specific data:
* <pre>
* //<user>:<password>@<host>:<port>/<url-path>
* </pre>
* [RFC2732] specifies that an IPv6 address contained inside a URL
* must be enclosed in square brackets (to allow distinguishing the
* colons that separate IPv6 components from the colons that separate
* scheme-specific data.
* <p>
* @author Amit Kapoor
* @author Hemma Prafullchandra
* @author Sean Mullan
* @author Steve Hanna
* @see GeneralName
* @see GeneralNames
* @see GeneralNameInterface
*/
public class URIName implements GeneralNameInterface {
// private attributes
private URI uri;
private String host;
private DNSName hostDNS;
private IPAddressName hostIP;
/**
* Create the URIName object from the passed encoded Der value.
*
* @param derValue the encoded DER URIName.
* @exception IOException on error.
*/
public URIName(DerValue derValue) throws IOException {
this(derValue.getIA5String());
}
/**
* Create the URIName object with the specified name.
*
* @param name the URIName.
* @throws IOException if name is not a proper URIName
*/
public URIName(String name) throws IOException {
try {
uri = new URI(name);
} catch (URISyntaxException use) {
throw (IOException) new IOException
("invalid URI name:" + name).initCause(use);
}
if (uri.getScheme() == null) {
throw new IOException("URI name must include scheme:" + name);
}
host = uri.getHost();
// RFC 3280 says that the host should be non-null, but we allow it to
// be null because some widely deployed certificates contain CDP
// extensions with URIs that have no hostname (see bugs 4802236 and
// 5107944).
if (host != null) {
if (host.charAt(0) == '[') {
// Verify host is a valid IPv6 address name
String ipV6Host = host.substring(1, host.length()-1);
try {
hostIP = new IPAddressName(ipV6Host);
} catch (IOException ioe) {
throw new IOException("invalid URI name (host " +
"portion is not a valid IPv6 address):" + name);
}
} else {
try {
hostDNS = new DNSName(host);
} catch (IOException ioe) {
// Not a valid DNS Name; see if it is a valid IPv4
// IPAddressName
try {
hostIP = new IPAddressName(host);
} catch (Exception ioe2) {
throw new IOException("invalid URI name (host " +
"portion is not a valid DNS name, IPv4 address," +
" or IPv6 address):" + name);
}
}
}
}
}
/**
* Create the URIName object with the specified name constraint. URI
* name constraints syntax is different than SubjectAltNames, etc. See
* 4.2.1.11 of RFC 3280.
*
* @param value the URI name constraint
* @throws IOException if name is not a proper URI name constraint
*/
public static URIName nameConstraint(DerValue value) throws IOException {
URI uri;
String name = value.getIA5String();
try {
uri = new URI(name);
} catch (URISyntaxException use) {
throw (IOException) new IOException
("invalid URI name constraint:" + name).initCause(use);
}
if (uri.getScheme() == null) {
String host = uri.getSchemeSpecificPart();
try {
DNSName hostDNS;
if (host.charAt(0) == '.') {
hostDNS = new DNSName(host.substring(1));
} else {
hostDNS = new DNSName(host);
}
return new URIName(uri, host, hostDNS);
} catch (IOException ioe) {
throw (IOException) new IOException
("invalid URI name constraint:" + name).initCause(ioe);
}
} else {
throw new IOException("invalid URI name constraint (should not " +
"include scheme):" + name);
}
}
URIName(URI uri, String host, DNSName hostDNS) {
this.uri = uri;
this.host = host;
this.hostDNS = hostDNS;
}
/**
* Return the type of the GeneralName.
*/
public int getType() {
return GeneralNameInterface.NAME_URI;
}
/**
* Encode the URI name into the DerOutputStream.
*
* @param out the DER stream to encode the URIName to.
* @exception IOException on encoding errors.
*/
public void encode(DerOutputStream out) throws IOException {
out.putIA5String(uri.toASCIIString());
}
/**
* Convert the name into user readable string.
*/
public String toString() {
return "URIName: " + uri.toString();
}
/**
* Compares this name with another, for equality.
*
* @return true iff the names are equivalent according to RFC2459.
*/
public boolean equals(Object obj) {
if (this == obj) {
return true;
}
if (!(obj instanceof URIName)) {
return false;
}
URIName other = (URIName) obj;
return uri.equals(other.getURI());
}
/**
* Returns the URIName as a java.net.URI object
*/
public URI getURI() {
return uri;
}
/**
* Returns this URI name.
*/
public String getName() {
return uri.toString();
}
/**
* Return the scheme name portion of a URIName
*
* @returns scheme portion of full name
*/
public String getScheme() {
return uri.getScheme();
}
/**
* Return the host name or IP address portion of the URIName
*
* @returns host name or IP address portion of full name
*/
public String getHost() {
return host;
}
/**
* Return the host object type; if host name is a
* DNSName, then this host object does not include any
* initial "." on the name.
*
* @returns host name as DNSName or IPAddressName
*/
public Object getHostObject() {
if (hostIP != null) {
return hostIP;
} else {
return hostDNS;
}
}
/**
* Returns the hash code value for this object.
*
* @return a hash code value for this object.
*/
public int hashCode() {
return uri.hashCode();
}
/**
* Return type of constraint inputName places on this name:<ul>
* <li>NAME_DIFF_TYPE = -1: input name is different type from name
* (i.e. does not constrain).
* <li>NAME_MATCH = 0: input name matches name.
* <li>NAME_NARROWS = 1: input name narrows name (is lower in the naming
* subtree)
* <li>NAME_WIDENS = 2: input name widens name (is higher in the naming
* subtree)
* <li>NAME_SAME_TYPE = 3: input name does not match or narrow name, but
* is same type.
* </ul>.
* These results are used in checking NameConstraints during
* certification path verification.
* <p>
* RFC3280: For URIs, the constraint applies to the host part of the name.
* The constraint may specify a host or a domain. Examples would be
* "foo.bar.com"; and ".xyz.com". When the the constraint begins with
* a period, it may be expanded with one or more subdomains. That is,
* the constraint ".xyz.com" is satisfied by both abc.xyz.com and
* abc.def.xyz.com. However, the constraint ".xyz.com" is not satisfied
* by "xyz.com". When the constraint does not begin with a period, it
* specifies a host.
* <p>
* @param inputName to be checked for being constrained
* @returns constraint type above
* @throws UnsupportedOperationException if name is not exact match, but
* narrowing and widening are not supported for this name type.
*/
public int constrains(GeneralNameInterface inputName)
throws UnsupportedOperationException {
int constraintType;
if (inputName == null) {
constraintType = NAME_DIFF_TYPE;
} else if (inputName.getType() != NAME_URI) {
constraintType = NAME_DIFF_TYPE;
} else {
// Assuming from here on that one or both of these is
// actually a URI name constraint (not a URI), so we
// only need to compare the host portion of the name
String otherHost = ((URIName)inputName).getHost();
// Quick check for equality
if (otherHost.equalsIgnoreCase(host)) {
constraintType = NAME_MATCH;
} else {
Object otherHostObject = ((URIName)inputName).getHostObject();
if ((hostDNS == null) ||
!(otherHostObject instanceof DNSName)) {
// If one (or both) is an IP address, only same type
constraintType = NAME_SAME_TYPE;
} else {
// Both host portions are DNS names. Are they domains?
boolean thisDomain = (host.charAt(0) == '.');
boolean otherDomain = (otherHost.charAt(0) == '.');
DNSName otherDNS = (DNSName) otherHostObject;
// Run DNSName.constrains.
constraintType = hostDNS.constrains(otherDNS);
// If neither one is a domain, then they can't
// widen or narrow. That's just SAME_TYPE.
if ((!thisDomain && !otherDomain) &&
((constraintType == NAME_WIDENS) ||
(constraintType == NAME_NARROWS))) {
constraintType = NAME_SAME_TYPE;
}
// If one is a domain and the other isn't,
// then they can't match. The one that's a
// domain doesn't include the one that's
// not a domain.
if ((thisDomain != otherDomain) &&
(constraintType == NAME_MATCH)) {
if (thisDomain) {
constraintType = NAME_WIDENS;
} else {
constraintType = NAME_NARROWS;
}
}
}
}
}
return constraintType;
}
/**
* Return subtree depth of this name for purposes of determining
* NameConstraints minimum and maximum bounds and for calculating
* path lengths in name subtrees.
*
* @returns distance of name from root
* @throws UnsupportedOperationException if not supported for this name type
*/
public int subtreeDepth() throws UnsupportedOperationException {
DNSName dnsName = null;
try {
dnsName = new DNSName(host);
} catch (IOException ioe) {
throw new UnsupportedOperationException(ioe.getMessage());
}
return dnsName.subtreeDepth();
}
}