diff options
| -rw-r--r-- | src/main/java/eu/siacs/conversations/crypto/XmppDomainVerifier.java | 85 |
1 files changed, 45 insertions, 40 deletions
diff --git a/src/main/java/eu/siacs/conversations/crypto/XmppDomainVerifier.java b/src/main/java/eu/siacs/conversations/crypto/XmppDomainVerifier.java index 47d4b459..1fca865e 100644 --- a/src/main/java/eu/siacs/conversations/crypto/XmppDomainVerifier.java +++ b/src/main/java/eu/siacs/conversations/crypto/XmppDomainVerifier.java @@ -1,6 +1,7 @@ package eu.siacs.conversations.crypto; import android.util.Log; +import android.util.Pair; import org.bouncycastle.asn1.ASN1Primitive; import org.bouncycastle.asn1.DERIA5String; @@ -25,7 +26,7 @@ import javax.net.ssl.SSLSession; public class XmppDomainVerifier implements HostnameVerifier { - private final String LOGTAG = "XmppDomainVerifier"; + private static final String LOGTAG = "XmppDomainVerifier"; private final String SRVName = "1.3.6.1.5.5.7.8.7"; private final String xmppAddr = "1.3.6.1.5.5.7.8.5"; @@ -43,41 +44,21 @@ public class XmppDomainVerifier implements HostnameVerifier { List<String> srvNames = new ArrayList<>(); List<String> domains = new ArrayList<>(); if (alternativeNames != null) { - for(List<?> san : alternativeNames) { + for (List<?> san : alternativeNames) { Integer type = (Integer) san.get(0); if (type == 0) { - try { - ASN1Primitive asn1Primitive = ASN1Primitive.fromByteArray((byte[]) san.get(1)); - if (asn1Primitive instanceof DERTaggedObject) { - ASN1Primitive inner = ((DERTaggedObject) asn1Primitive).getObject(); - if (inner instanceof DLSequence) { - DLSequence sequence = (DLSequence) inner; - if (sequence.size() >= 2 && sequence.getObjectAt(1) instanceof DERTaggedObject) { - String oid = sequence.getObjectAt(0).toString(); - ASN1Primitive value = ((DERTaggedObject) sequence.getObjectAt(1)).getObject(); - switch (oid) { - case xmppAddr: - if (value instanceof DERUTF8String) { - xmppAddrs.add(((DERUTF8String) value).getString()); - } else if (value instanceof DERIA5String) { - xmppAddrs.add(((DERIA5String) value).getString()); - } - break; - case SRVName: - if (value instanceof DERUTF8String) { - srvNames.add(((DERUTF8String) value).getString()); - } else if (value instanceof DERIA5String) { - srvNames.add(((DERIA5String) value).getString()); - } - break; - default: - Log.d(LOGTAG,"value was of type:"+value.getClass().getName()+ " oid was:"+oid); - } - } - } + Pair<String, String> otherName = parseOtherName((byte[]) san.get(1)); + if (otherName != null) { + switch (otherName.first) { + case SRVName: + srvNames.add(otherName.second); + break; + case xmppAddr: + xmppAddrs.add(otherName.second); + break; + default: + Log.d(LOGTAG, "oid: " + otherName.first + " value: " + otherName.second); } - } catch (IOException e) { - //ignored } } else if (type == 2) { Object value = san.get(1); @@ -90,29 +71,53 @@ public class XmppDomainVerifier implements HostnameVerifier { if (srvNames.size() == 0 && xmppAddrs.size() == 0 && domains.size() == 0) { X500Name x500name = new JcaX509CertificateHolder(certificate).getSubject(); RDN[] rdns = x500name.getRDNs(BCStyle.CN); - for(int i = 0; i < rdns.length; ++i) { + for (int i = 0; i < rdns.length; ++i) { domains.add(IETFUtils.valueToString(x500name.getRDNs(BCStyle.CN)[i].getFirst().getValue())); } } Log.d(LOGTAG, "searching for " + domain + " in srvNames: " + srvNames + " xmppAddrs: " + xmppAddrs + " domains:" + domains); - return xmppAddrs.contains(domain) || srvNames.contains("_xmpp-client."+domain) || matchDomain(domain, domains); + return xmppAddrs.contains(domain) || srvNames.contains("_xmpp-client." + domain) || matchDomain(domain, domains); } catch (Exception e) { return false; } } - private boolean matchDomain(String needle, List<String> haystack) { - for(String entry : haystack) { + private static Pair<String, String> parseOtherName(byte[] otherName) { + try { + ASN1Primitive asn1Primitive = ASN1Primitive.fromByteArray(otherName); + if (asn1Primitive instanceof DERTaggedObject) { + ASN1Primitive inner = ((DERTaggedObject) asn1Primitive).getObject(); + if (inner instanceof DLSequence) { + DLSequence sequence = (DLSequence) inner; + if (sequence.size() >= 2 && sequence.getObjectAt(1) instanceof DERTaggedObject) { + String oid = sequence.getObjectAt(0).toString(); + ASN1Primitive value = ((DERTaggedObject) sequence.getObjectAt(1)).getObject(); + if (value instanceof DERUTF8String) { + return new Pair<>(oid, ((DERUTF8String) value).getString()); + } else if (value instanceof DERIA5String) { + return new Pair<>(oid, ((DERIA5String) value).getString()); + } + } + } + } + return null; + } catch (IOException e) { + return null; + } + } + + private static boolean matchDomain(String needle, List<String> haystack) { + for (String entry : haystack) { if (entry.startsWith("*.")) { int i = needle.indexOf('.'); - Log.d(LOGTAG,"comparing "+needle.substring(i)+ " and "+entry.substring(1)); + Log.d(LOGTAG, "comparing " + needle.substring(i) + " and " + entry.substring(1)); if (i != -1 && needle.substring(i).equals(entry.substring(1))) { - Log.d(LOGTAG,"domain "+needle+" matched "+entry); + Log.d(LOGTAG, "domain " + needle + " matched " + entry); return true; } } else { if (entry.equals(needle)) { - Log.d(LOGTAG,"domain "+needle+" matched "+entry); + Log.d(LOGTAG, "domain " + needle + " matched " + entry); return true; } } |