[java-xmltooling COMMIT] in /branches/REL_1/src: main/java/org/opensaml/xml/security/x509/tls/ main/java/org/opensaml...

[noreply at shibboleth.net]

Author: putmanb
Date: Fri Sep 12 22:04:25 2014
New Revision: 829

URL: http://svn.shibboleth.net/view/java-xmltooling?rev=829&view=rev
Log:
Add HostnameVerifier impl, based on not-yet-commons-ssl STRICT verifier, except extracts CN from cert DN using ASN.1 parsing via our X509Util.
Add some additional test cases for X509Util.

Added:
    branches/REL_1/src/main/java/org/opensaml/xml/security/x509/tls/
    branches/REL_1/src/main/java/org/opensaml/xml/security/x509/tls/StrictHostnameVerifier.java   (with props)
    branches/REL_1/src/test/java/org/opensaml/xml/security/x509/tls/
    branches/REL_1/src/test/java/org/opensaml/xml/security/x509/tls/MockSSLSession.java   (with props)
    branches/REL_1/src/test/java/org/opensaml/xml/security/x509/tls/MockX509Certificate.java   (with props)
    branches/REL_1/src/test/java/org/opensaml/xml/security/x509/tls/StrictHostnameVerifierTest.java   (with props)
Modified:
    branches/REL_1/src/test/java/org/opensaml/xml/security/x509/X509UtilTest.java

Modified: branches/REL_1/src/test/java/org/opensaml/xml/security/x509/X509UtilTest.java
URL: http://svn.shibboleth.net/view/java-xmltooling/branches/REL_1/src/test/java/org/opensaml/xml/security/x509/X509UtilTest.java?rev=829&r1=828&r2=829&view=diff
==============================================================================
--- branches/REL_1/src/test/java/org/opensaml/xml/security/x509/X509UtilTest.java (original)
+++ branches/REL_1/src/test/java/org/opensaml/xml/security/x509/X509UtilTest.java Fri Sep 12 22:04:25 2014
@@ -340,6 +340,25 @@
         commonNames = X509Util.getCommonNames(new X500Principal("uid=foo, o=MyOrg"));
         assertNotNull(commonNames);
         assertEquals(0, commonNames.size());
+        
+        // Test input of raw OID
+        commonNames = X509Util.getCommonNames(new X500Principal("2.5.4.3=foo.example.org"));
+        assertNotNull(commonNames);
+        assertEquals(1, commonNames.size());
+        assertTrue(commonNames.contains("foo.example.org"));
+        
+        // Test attack DNs per CVE-2014-3577
+        commonNames = X509Util.getCommonNames(new X500Principal("cn=foo.example.org, o=foo \\,cn=www.apache.org"));
+        assertNotNull(commonNames);
+        assertEquals(1, commonNames.size());
+        assertFalse(commonNames.contains("www.apache.org"));
+        assertTrue(commonNames.contains("foo.example.org"));
+        
+        commonNames = X509Util.getCommonNames(new X500Principal("cn=foo.example.org, o=cn=www.apache.org\\, foo"));
+        assertNotNull(commonNames);
+        assertEquals(1, commonNames.size());
+        assertFalse(commonNames.contains("www.apache.org"));
+        assertTrue(commonNames.contains("foo.example.org"));
     }
     
     /**