+ * [RFC2459] When the subjectAltName extension contains a domain name service + * label, the domain name MUST be stored in the dNSName (an IA5String). + * The name MUST be in the "preferred name syntax," as specified by RFC + * 1034 [RFC 1034]. Note that while upper and lower case letters are + * allowed in domain names, no signifigance is attached to the case. In + * addition, while the string " " is a legal domain name, subjectAltName + * extensions with a dNSName " " are not permitted. Finally, the use of + * the DNS representation for Internet mail addresses (wpolk.nist.gov + * instead of wpolk@nist.gov) is not permitted; such identities are to + * be encoded as rfc822Name. + * + * This class has been copied from OpenJDK7u repository and modified + * in order to fix Java bug 8016345: + * https://bugs.openjdk.java.net/browse/JDK-8016345 + * + * It can be deleted after a migration to a Java release fixing this bug. + *
+ * @author Amit Kapoor + * @author Hemma Prafullchandra + * @author JOSM developers + * @since 7347 + */ +public class DNSName implements GeneralNameInterface { + private final String name; + + private static final String alpha = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz"; + private static final String digitsAndHyphen = "0123456789-"; + private static final String alphaDigitsAndHyphen = alpha + digitsAndHyphen; + + /** + * Create the DNSName object with the specified name. + * + * @param name the DNSName. + * @throws IOException if the name is not a valid DNSName subjectAltName + */ + public DNSName(String name) throws IOException { + if (name == null || name.length() == 0) + throw new IOException("DNS name must not be null"); + if (name.indexOf(' ') != -1) + throw new IOException("DNS names or NameConstraints with blank components are not permitted"); + if (name.charAt(0) == '.' || name.charAt(name.length() -1) == '.') + throw new IOException("DNS names or NameConstraints may not begin or end with a ."); + //Name will consist of label components separated by "." + //startIndex is the index of the first character of a component + //endIndex is the index of the last character of a component plus 1 + for (int endIndex,startIndex=0; startIndex < name.length(); startIndex = endIndex+1) { + endIndex = name.indexOf('.', startIndex); + if (endIndex < 0) { + endIndex = name.length(); + } + if ((endIndex-startIndex) < 1) + throw new IOException("DNSName SubjectAltNames with empty components are not permitted"); + + //nonStartIndex: index for characters in the component beyond the first one + for (int nonStartIndex=startIndex+1; nonStartIndex < endIndex; nonStartIndex++) { + char x = name.charAt(nonStartIndex); + if ((alphaDigitsAndHyphen).indexOf(x) < 0) + throw new IOException("DNSName components must consist of letters, digits, and hyphens"); + } + } + this.name = name; + } + + /** + * Return the type of the GeneralName. + */ + public int getType() { + return (GeneralNameInterface.NAME_DNS); + } + + /** + * Return the actual name value of the GeneralName. + * @return the actual name value of the GeneralName + */ + public String getName() { + return name; + } + + /** + * Encode the DNS name into the DerOutputStream. + * + * @param out the DER stream to encode the DNSName to. + * @exception IOException on encoding errors. + */ + public void encode(DerOutputStream out) throws IOException { + out.putIA5String(name); + } + + /** + * Convert the name into user readable string. + */ + @Override + public String toString() { + return ("DNSName: " + name); + } + + /** + * Compares this name with another, for equality. + * + * @return true iff the names are equivalent + * according to RFC2459. + */ + @Override + public boolean equals(Object obj) { + if (this == obj) + return true; + + if (!(obj instanceof DNSName)) + return false; + + DNSName other = (DNSName)obj; + + // RFC2459 mandates that these names are + // not case-sensitive + return name.equalsIgnoreCase(other.name); + } + + /** + * Returns the hash code value for this object. + * + * @return a hash code value for this object. + */ + @Override + public int hashCode() { + return name.toUpperCase().hashCode(); + } + + /** + * Return type of constraint inputName places on this name:
+ * RFC2459: DNS name restrictions are expressed as foo.bar.com. Any subdomain + * satisfies the name constraint. For example, www.foo.bar.com would + * satisfy the constraint but bigfoo.bar.com would not. + *
+ * draft-ietf-pkix-new-part1-00.txt: DNS name restrictions are expressed as foo.bar.com. + * Any DNS name that + * can be constructed by simply adding to the left hand side of the name + * satisfies the name constraint. For example, www.foo.bar.com would + * satisfy the constraint but foo1.bar.com would not. + *
+ * RFC1034: By convention, domain names can be stored with arbitrary case, but + * domain name comparisons for all present domain functions are done in a + * case-insensitive manner, assuming an ASCII character set, and a high + * order zero bit. + *
+ * @param inputName to be checked for being constrained + * @returns constraint type above + * @throws UnsupportedOperationException if name is not exact match, but narrowing and widening are + * not supported for this name type. + */ + public int constrains(GeneralNameInterface inputName) throws UnsupportedOperationException { + int constraintType; + if (inputName == null) + constraintType = NAME_DIFF_TYPE; + else if (inputName.getType() != NAME_DNS) + constraintType = NAME_DIFF_TYPE; + else { + String inName = + (((DNSName)inputName).getName()).toLowerCase(Locale.ENGLISH); + String thisName = name.toLowerCase(Locale.ENGLISH); + if (inName.equals(thisName)) + constraintType = NAME_MATCH; + else if (thisName.endsWith(inName)) { + int inNdx = thisName.lastIndexOf(inName); + if (thisName.charAt(inNdx-1) == '.' ) + constraintType = NAME_WIDENS; + else + constraintType = NAME_SAME_TYPE; + } else if (inName.endsWith(thisName)) { + int ndx = inName.lastIndexOf(thisName); + if (inName.charAt(ndx-1) == '.' ) + constraintType = NAME_NARROWS; + else + constraintType = NAME_SAME_TYPE; + } else { + constraintType = NAME_SAME_TYPE; + } + } + return constraintType; + } + + /** + * Return subtree depth of this name for purposes of determining + * NameConstraints minimum and maximum bounds and for calculating + * path lengths in name subtrees. + * + * @returns distance of name from root + * @throws UnsupportedOperationException if not supported for this name type + */ + public int subtreeDepth() throws UnsupportedOperationException { + String subtree=name; + int i=1; + + /* count dots */ + for (; subtree.lastIndexOf('.') >= 0; i++) { + subtree=subtree.substring(0,subtree.lastIndexOf('.')); + } + + return i; + } +} Index: trunk/src/org/openstreetmap/josm/io/remotecontrol/RemoteControlHttpsServer.java =================================================================== --- trunk/src/org/openstreetmap/josm/io/remotecontrol/RemoteControlHttpsServer.java (revision 7346) +++ trunk/src/org/openstreetmap/josm/io/remotecontrol/RemoteControlHttpsServer.java (revision 7347) @@ -54,5 +54,4 @@ import sun.security.x509.CertificateVersion; import sun.security.x509.CertificateX509Key; -import sun.security.x509.DNSName; import sun.security.x509.ExtendedKeyUsageExtension; import sun.security.x509.GeneralName; @@ -230,5 +229,7 @@ X509Certificate cert = generateCertificate("CN=localhost, OU=JOSM, O=OpenStreetMap", pair, 1825, "SHA256withRSA", - "dns:localhost,ip:127.0.0.1,ip:::1,uri:https://127.0.0.1:"+HTTPS_PORT+",uri:https://::1:"+HTTPS_PORT); + // see #10033#comment:20: All browsers respect "ip" in SAN, except IE which only understands DNS entries: + // https://connect.microsoft.com/IE/feedback/details/814744/the-ie-doesnt-trust-a-san-certificate-when-connecting-to-ip-address + "dns:localhost,ip:127.0.0.1,dns:127.0.0.1,ip:::1,uri:https://127.0.0.1:"+HTTPS_PORT+",uri:https://::1:"+HTTPS_PORT); KeyStore ks = KeyStore.getInstance("JKS");