[java-xmltooling COMMIT] in /branches/REL_1/src: main/java/org/opensaml/xml/security/x509/X509Util.java test/java/org...

[noreply at shibboleth.net]

Author: putmanb
Date: Thu Sep 18 17:03:33 2014
New Revision: 835

URL: http://svn.shibboleth.net/view/java-xmltooling?rev=835&view=rev
Log:
In X509Util getCommonNames, instead of reversing the returned list, walk the DN sequence from last to first.  This eliminates the overhead of list reversal, and also preserves the original encoded ordering for the case of multiple CNs within one RDN. 

Modified:
    branches/REL_1/src/main/java/org/opensaml/xml/security/x509/X509Util.java
    branches/REL_1/src/test/java/org/opensaml/xml/security/x509/X509UtilTest.java

Modified: branches/REL_1/src/main/java/org/opensaml/xml/security/x509/X509Util.java
URL: http://svn.shibboleth.net/view/java-xmltooling/branches/REL_1/src/main/java/org/opensaml/xml/security/x509/X509Util.java?rev=835&r1=834&r2=835&view=diff
==============================================================================
--- branches/REL_1/src/main/java/org/opensaml/xml/security/x509/X509Util.java (original)
+++ branches/REL_1/src/main/java/org/opensaml/xml/security/x509/X509Util.java Thu Sep 18 17:03:33 2014
@@ -161,7 +161,9 @@
             ASN1InputStream asn1Stream = new ASN1InputStream(dn.getEncoded());
             ASN1Sequence dnSequence = (ASN1Sequence) asn1Stream.readObject();
 
-            for (int i = 0; i < dnSequence.size(); i++) {
+            // Walk the DN sequence in reverse order from last to first, so that the CN(s) from the most-specific RDN
+            // are first in the returned list, consistent with RFC 1779/2253 RDN ordering.
+            for (int i = dnSequence.size()-1; i >= 0; i--) {
                 ASN1Primitive rdn = dnSequence.getObjectAt(i).toASN1Primitive();
                 if (!(rdn instanceof ASN1Set)) {
                     log.debug("DN RDN was not an instance of ASN1Set.");
@@ -171,6 +173,7 @@
                 // Each RDN is an ASN.1 set (note: unordered)
                 ASN1Set rdnSet = (ASN1Set) rdn;
 
+                // Walk the attributes within the RDN from first to last, to preserve the ordering of the encoded form.
                 for (int j = 0; j < rdnSet.size(); j++) {
                     ASN1Sequence attributeTypeAndValue = (ASN1Sequence) rdnSet.getObjectAt(j).toASN1Primitive();
 
@@ -193,10 +196,6 @@
 
             asn1Stream.close();
 
-            // Reverse the order so that the most-specific CN is first in the list, 
-            // consistent with RFC 1779/2253 RDN ordering.
-            Collections.reverse(commonNames);
-            
             return commonNames;
 
         } catch (IOException e) {

Modified: branches/REL_1/src/test/java/org/opensaml/xml/security/x509/X509UtilTest.java
URL: http://svn.shibboleth.net/view/java-xmltooling/branches/REL_1/src/test/java/org/opensaml/xml/security/x509/X509UtilTest.java?rev=835&r1=834&r2=835&view=diff
==============================================================================
--- branches/REL_1/src/test/java/org/opensaml/xml/security/x509/X509UtilTest.java (original)
+++ branches/REL_1/src/test/java/org/opensaml/xml/security/x509/X509UtilTest.java Thu Sep 18 17:03:33 2014
@@ -326,6 +326,13 @@
         assertEquals("WebServers", commonNames.get(1));
         assertEquals("Hosts", commonNames.get(2));
         
+        // 4 components, 2 cn, a cn is not first nor last
+        commonNames = X509Util.getCommonNames(new X500Principal("uid=foo, cn=Admins, cn=People, o=MyOrg"));
+        assertNotNull(commonNames);
+        assertEquals(2, commonNames.size());
+        assertEquals("Admins", commonNames.get(0));
+        assertEquals("People", commonNames.get(1));
+        
         // 2 components, one of them with multiple cn AVAs. 
         // Note: The set of AVAs in a DN component is unordered, so can't test returned ordering.
         commonNames = X509Util.getCommonNames(new X500Principal("cn=foo.example.org+cn=bar.example.org+cn=baz.example.org, o=MyOrg"));
@@ -340,11 +347,11 @@
         commonNames = X509Util.getCommonNames(new X500Principal("cn=foo.example.org+cn=bar.example.org+cn=baz.example.org, cn=Org1+cn=Org2"));
         assertNotNull(commonNames);
         assertEquals(5, commonNames.size());
-        assertTrue(commonNames.contains("foo.example.org"));
-        assertTrue(commonNames.contains("bar.example.org"));
-        assertTrue(commonNames.contains("baz.example.org"));
-        assertTrue(commonNames.contains("Org1"));
-        assertTrue(commonNames.contains("Org2"));
+        assertTrue(commonNames.subList(0, 3).contains("foo.example.org"));
+        assertTrue(commonNames.subList(0, 3).contains("bar.example.org"));
+        assertTrue(commonNames.subList(0, 3).contains("baz.example.org"));
+        assertTrue(commonNames.subList(3, 5).contains("Org1"));
+        assertTrue(commonNames.subList(3, 5).contains("Org2"));
         
         // No cn at all
         commonNames = X509Util.getCommonNames(new X500Principal("uid=foo, o=MyOrg"));