Skip to content

Commit aa602a1

Browse files
arturobernalgarturobernalg
committed
Decode Subject Alternative Names for IP, DNS, and binary data
Supports DNS names as plain text, IPv4 and IPv6 addresses in binary form, and falls back to hex encoding for unknown types.
1 parent 8b1ee82 commit aa602a1

File tree

2 files changed

+238
-1
lines changed

2 files changed

+238
-1
lines changed

‎httpclient5/src/main/java/org/apache/hc/client5/http/ssl/DefaultHostnameVerifier.java

+33-1
Original file line numberDiff line numberDiff line change
@@ -355,7 +355,14 @@ static List<SubjectName> getSubjectAltNames(final X509Certificate cert, final in
355355
if (o instanceof String) {
356356
result.add(new SubjectName((String) o, type));
357357
} else if (o instanceof byte[]) {
358-
// TODO ASN.1 DER encoded form
358+
final byte[] bytes = (byte[]) o;
359+
if (type == SubjectName.IP) {
360+
if (bytes.length == 4) {
361+
result.add(new SubjectName(byteArrayToIp(bytes), type)); // IPv4
362+
} else if (bytes.length == 16) {
363+
result.add(new SubjectName(byteArrayToIPv6(bytes), type)); // IPv6
364+
}
365+
}
359366
}
360367
}
361368
}
@@ -380,4 +387,29 @@ static String normaliseAddress(final String hostname) {
380387
return hostname;
381388
}
382389
}
390+
391+
private static String byteArrayToIp(final byte[] bytes) {
392+
if (bytes.length != 4) {
393+
throw new IllegalArgumentException("Invalid byte array length for IPv4 address");
394+
}
395+
return (bytes[0] & 0xFF) + "." +
396+
(bytes[1] & 0xFF) + "." +
397+
(bytes[2] & 0xFF) + "." +
398+
(bytes[3] & 0xFF);
399+
}
400+
401+
private static String byteArrayToIPv6(final byte[] bytes) {
402+
if (bytes.length != 16) {
403+
throw new IllegalArgumentException("Invalid byte array length for IPv6 address");
404+
}
405+
final StringBuilder sb = new StringBuilder();
406+
for (int i = 0; i < bytes.length; i += 2) {
407+
sb.append(String.format("%02x%02x", bytes[i], bytes[i + 1]));
408+
if (i < bytes.length - 2) {
409+
sb.append(":");
410+
}
411+
}
412+
return sb.toString();
413+
}
414+
383415
}

‎httpclient5/src/test/java/org/apache/hc/client5/http/ssl/TestDefaultHostnameVerifier.java

+205
Original file line numberDiff line numberDiff line change
@@ -31,12 +31,28 @@
3131
import java.io.IOException;
3232
import java.io.InputStream;
3333
import java.io.InputStreamReader;
34+
import java.math.BigInteger;
35+
import java.net.InetAddress;
3436
import java.nio.charset.StandardCharsets;
37+
import java.security.InvalidKeyException;
38+
import java.security.NoSuchAlgorithmException;
39+
import java.security.NoSuchProviderException;
40+
import java.security.Principal;
41+
import java.security.PublicKey;
42+
import java.security.SignatureException;
43+
import java.security.cert.CertificateEncodingException;
44+
import java.security.cert.CertificateException;
45+
import java.security.cert.CertificateExpiredException;
3546
import java.security.cert.CertificateFactory;
47+
import java.security.cert.CertificateNotYetValidException;
3648
import java.security.cert.X509Certificate;
49+
import java.util.ArrayList;
3750
import java.util.Arrays;
51+
import java.util.Collection;
3852
import java.util.Collections;
53+
import java.util.Date;
3954
import java.util.List;
55+
import java.util.Set;
4056

4157
import javax.net.ssl.SSLException;
4258

@@ -548,4 +564,193 @@ void testMatchIdentity() {
548564
);
549565
}
550566

567+
568+
@Test
569+
void testSimulatedByteProperties() throws Exception {
570+
// Simulated byte array for an IP address
571+
final byte[] ipAsByteArray = {1, 1, 1, 1}; // 1.1.1.1 in byte form
572+
573+
final List<List<?>> entries = new ArrayList<>();
574+
final List<Object> entry = new ArrayList<>();
575+
entry.add(SubjectName.IP);
576+
entry.add(ipAsByteArray);
577+
entries.add(entry);
578+
579+
// Mocking the certificate behavior
580+
final X509Certificate mockCert = generateX509Certificate(entries);
581+
582+
final List<SubjectName> result = DefaultHostnameVerifier.getSubjectAltNames(mockCert, -1);
583+
Assertions.assertEquals(1, result.size(), "Should have one SubjectAltName");
584+
585+
final SubjectName sn = result.get(0);
586+
Assertions.assertEquals(SubjectName.IP, sn.getType(), "Should be an IP type");
587+
// Here, you'll need logic to convert byte array to string for assertion
588+
Assertions.assertEquals("1.1.1.1", sn.getValue(), "IP address should match after conversion");
589+
}
590+
591+
@Test
592+
void testSimulatedBytePropertiesIPv6() throws Exception {
593+
final byte[] ipv6AsByteArray = InetAddress.getByName("2001:db8:85a3::8a2e:370:7334").getAddress();
594+
// IPv6 2001:db8:85a3::8a2e:370:7334
595+
596+
final List<List<?>> entries = new ArrayList<>();
597+
final List<Object> entry = new ArrayList<>();
598+
entry.add(SubjectName.IP);
599+
entry.add(ipv6AsByteArray);
600+
entries.add(entry);
601+
602+
// Mocking the certificate behavior
603+
final X509Certificate mockCert = generateX509Certificate(entries);
604+
605+
final List<SubjectName> result = DefaultHostnameVerifier.getSubjectAltNames(mockCert, -1);
606+
Assertions.assertEquals(1, result.size(), "Should have one SubjectAltName");
607+
608+
final SubjectName sn = result.get(0);
609+
Assertions.assertEquals(SubjectName.IP, sn.getType(), "Should be an IP type");
610+
// Here, you'll need logic to convert byte array to string for assertion
611+
Assertions.assertEquals("2001:0db8:85a3:0000:0000:8a2e:0370:7334", sn.getValue(), "IP address should match after conversion");
612+
}
613+
614+
615+
private X509Certificate generateX509Certificate(final List<List<?>> entries) {
616+
return new X509Certificate() {
617+
618+
@Override
619+
public boolean hasUnsupportedCriticalExtension() {
620+
return false;
621+
}
622+
623+
@Override
624+
public Set<String> getCriticalExtensionOIDs() {
625+
return null;
626+
}
627+
628+
@Override
629+
public Set<String> getNonCriticalExtensionOIDs() {
630+
return null;
631+
}
632+
633+
@Override
634+
public byte[] getExtensionValue(final String oid) {
635+
return new byte[0];
636+
}
637+
638+
@Override
639+
public byte[] getEncoded() throws CertificateEncodingException {
640+
return new byte[0];
641+
}
642+
643+
@Override
644+
public void verify(final PublicKey key) throws CertificateException, NoSuchAlgorithmException, InvalidKeyException, NoSuchProviderException, SignatureException {
645+
646+
}
647+
648+
@Override
649+
public void verify(final PublicKey key, final String sigProvider) throws CertificateException, NoSuchAlgorithmException, InvalidKeyException, NoSuchProviderException, SignatureException {
650+
651+
}
652+
653+
@Override
654+
public String toString() {
655+
return "";
656+
}
657+
658+
@Override
659+
public PublicKey getPublicKey() {
660+
return null;
661+
}
662+
663+
@Override
664+
public void checkValidity() throws CertificateExpiredException, CertificateNotYetValidException {
665+
666+
}
667+
668+
@Override
669+
public void checkValidity(final Date date) throws CertificateExpiredException, CertificateNotYetValidException {
670+
671+
}
672+
673+
@Override
674+
public int getVersion() {
675+
return 0;
676+
}
677+
678+
@Override
679+
public BigInteger getSerialNumber() {
680+
return null;
681+
}
682+
683+
@Override
684+
public Principal getIssuerDN() {
685+
return null;
686+
}
687+
688+
@Override
689+
public Principal getSubjectDN() {
690+
return null;
691+
}
692+
693+
@Override
694+
public Date getNotBefore() {
695+
return null;
696+
}
697+
698+
@Override
699+
public Date getNotAfter() {
700+
return null;
701+
}
702+
703+
@Override
704+
public byte[] getTBSCertificate() throws CertificateEncodingException {
705+
return new byte[0];
706+
}
707+
708+
@Override
709+
public byte[] getSignature() {
710+
return new byte[0];
711+
}
712+
713+
@Override
714+
public String getSigAlgName() {
715+
return "";
716+
}
717+
718+
@Override
719+
public String getSigAlgOID() {
720+
return "";
721+
}
722+
723+
@Override
724+
public byte[] getSigAlgParams() {
725+
return new byte[0];
726+
}
727+
728+
@Override
729+
public boolean[] getIssuerUniqueID() {
730+
return new boolean[0];
731+
}
732+
733+
@Override
734+
public boolean[] getSubjectUniqueID() {
735+
return new boolean[0];
736+
}
737+
738+
@Override
739+
public boolean[] getKeyUsage() {
740+
return new boolean[0];
741+
}
742+
743+
@Override
744+
public int getBasicConstraints() {
745+
return 0;
746+
}
747+
748+
@Override
749+
public Collection<List<?>> getSubjectAlternativeNames() {
750+
return entries;
751+
}
752+
};
753+
754+
}
755+
551756
}

0 commit comments

Comments
 (0)