JNI: add X.509 Name Constraints extension support and new classes WolfSSLNameConstraints, WolfSSLGeneralName
Chris Conlon
parent
2f86e786fe
commit
214fab3a7e
|
|
@ -347,6 +347,7 @@ add_library(wolfssljni SHARED
|
|||
${wolfssljni_DIR}/native/com_wolfssl_WolfSSLSession.c
|
||||
${wolfssljni_DIR}/native/com_wolfssl_WolfSSLX509Name.c
|
||||
${wolfssljni_DIR}/native/com_wolfssl_WolfSSLX509StoreCtx.c
|
||||
${wolfssljni_DIR}/native/com_wolfssl_WolfSSLNameConstraints.c
|
||||
${wolfssljni_DIR}/native/com_wolfssl_WolfCryptECC.c
|
||||
${wolfssljni_DIR}/native/com_wolfssl_WolfCryptEccKey.c
|
||||
${wolfssljni_DIR}/native/com_wolfssl_WolfCryptRSA.c
|
||||
|
|
|
|||
|
|
@ -46,6 +46,7 @@
|
|||
<ClCompile Include="..\..\native\com_wolfssl_WolfSSLSession.c" />
|
||||
<ClCompile Include="..\..\native\com_wolfssl_WolfSSLX509Name.c" />
|
||||
<ClCompile Include="..\..\native\com_wolfssl_WolfSSLX509StoreCtx.c" />
|
||||
<ClCompile Include="..\..\native\com_wolfssl_WolfSSLNameConstraints.c" />
|
||||
</ItemGroup>
|
||||
<ItemGroup>
|
||||
<ClInclude Include="..\..\native\com_wolfssl_globals.h" />
|
||||
|
|
@ -60,6 +61,7 @@
|
|||
<ClInclude Include="..\..\native\com_wolfssl_WolfSSLSession.h" />
|
||||
<ClInclude Include="..\..\native\com_wolfssl_WolfSSLX509Name.h" />
|
||||
<ClInclude Include="..\..\native\com_wolfssl_WolfSSLX509StoreCtx.h" />
|
||||
<ClInclude Include="..\..\native\com_wolfssl_WolfSSLNameConstraints.h" />
|
||||
<ClInclude Include="..\..\native\com_wolfssl_WolfSSL_TLS_VERSION.h" />
|
||||
</ItemGroup>
|
||||
<PropertyGroup Label="Globals">
|
||||
|
|
|
|||
|
|
@ -48,6 +48,9 @@
|
|||
<ClCompile Include="..\..\native\com_wolfssl_WolfSSLX509Name.c">
|
||||
<Filter>Source Files</Filter>
|
||||
</ClCompile>
|
||||
<ClCompile Include="..\..\native\com_wolfssl_WolfSSLNameConstraints.c">
|
||||
<Filter>Source Files</Filter>
|
||||
</ClCompile>
|
||||
</ItemGroup>
|
||||
<ItemGroup>
|
||||
<ClInclude Include="..\..\native\com_wolfssl_globals.h">
|
||||
|
|
@ -89,5 +92,8 @@
|
|||
<ClInclude Include="..\..\native\com_wolfssl_WolfSSLX509Name.h">
|
||||
<Filter>Header Files</Filter>
|
||||
</ClInclude>
|
||||
<ClInclude Include="..\..\native\com_wolfssl_WolfSSLNameConstraints.h">
|
||||
<Filter>Header Files</Filter>
|
||||
</ClInclude>
|
||||
</ItemGroup>
|
||||
</Project>
|
||||
|
|
|
|||
|
|
@ -0,0 +1,26 @@
|
|||
-----BEGIN CERTIFICATE-----
|
||||
MIIEWjCCA0KgAwIBAgIUVxNILYrtvic5fahe1thKz5+9MBkwDQYJKoZIhvcNAQEL
|
||||
BQAwezELMAkGA1UEBhMCVVMxEDAOBgNVBAgMB01vbnRhbmExEDAOBgNVBAcMB0Jv
|
||||
emVtYW4xFDASBgNVBAoMC3dvbGZTU0wgSW5jMRgwFgYDVQQLDA9EZXYgYW5kIFRl
|
||||
c3RpbmcxGDAWBgNVBAMMD3d3dy53b2xmc3NsLmNvbTAeFw0yNjAxMjIyMTE4MjJa
|
||||
Fw0yODEwMTgyMTE4MjJaMHsxCzAJBgNVBAYTAlVTMRAwDgYDVQQIDAdNb250YW5h
|
||||
MRAwDgYDVQQHDAdCb3plbWFuMRQwEgYDVQQKDAt3b2xmU1NMIEluYzEYMBYGA1UE
|
||||
CwwPRGV2IGFuZCBUZXN0aW5nMRgwFgYDVQQDDA93d3cud29sZnNzbC5jb20wggEi
|
||||
MA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDAlQjhV0HycW230kVBJwFlxkWu
|
||||
8rwkMLiVzi9O1vYciLx8n/uoZ3/+XJxRdfeKygfnNS+P4b17wC98q2SoF/zKXXu6
|
||||
4CHlci5vLobYlXParBtTuV8/1xkNJU/hY2NRiwtkP61DuKUcXDSzrgCgY8X2fwtZ
|
||||
aHhzpowYqQJtr8MZAS64EOPGzEC0aaNGM2mHbsS7F6bz6N2tc7x7LyG1/WZRDL1U
|
||||
s+FtXxy8I3PRCQOJFNIQuWTDKtChlkq84dQaW8egwMFjeA9ENzAyloAyI5Whd7oT
|
||||
0pdz4l0lyWoNwzlgpLSwaUJCCenYCLwzILNYIqeq68Th5mGDxdKW39nQT63XAgMB
|
||||
AAGjgdUwgdIwHQYDVR0OBBYEFLMRMsmSmITiyfjQO24DQsofDo48MB8GA1UdIwQY
|
||||
MBaAFLMRMsmSmITiyfjQO24DQsofDo48MBIGA1UdEwEB/wQIMAYBAf8CAQAwDgYD
|
||||
VR0PAQH/BAQDAgGGMC4GA1UdHgEB/wQkMCKgIDAOhgwud29sZnNzbC5jb20wDoIM
|
||||
LndvbGZzc2wuY29tMDwGCWCGSAGG+EIBDQQvFi1UZXN0aW5nIGNvbWJpbmVkIFVS
|
||||
SSBhbmQgRE5TIG5hbWUgY29uc3RyYWludHMwDQYJKoZIhvcNAQELBQADggEBAKA5
|
||||
4xPLP6RVWnOSkHYi+Cr6KegUOQNxmPVoaAwph+QMR8Z2sdLKIWt9U1xL4lkH6L51
|
||||
S54kLMH/jnv2WD9bYvDe+CjWZEM97Nm+YURHDv5QAoqxY9gw9Y8TMGi8xOC5cubR
|
||||
JXpjN4U60N/mdHbxMQbcuHJLowjXSlCp3q6S+iz2Bh7TaP8w7EoTR6pQEK6nMo6L
|
||||
C/CRztvpaFgOZ4ia8O8C3EHBaBSECWWtPMyh6WappneKkT2p9wh8LdMB58AjKqoJ
|
||||
/Zg6lp0Qj+NOhpVYXiT2+RlxVkttZJmLv3DIYH9LMsS8jhnTriIXpx2DaS56dEVn
|
||||
aFzrG/ecf3YLPUrKgHw=
|
||||
-----END CERTIFICATE-----
|
||||
|
|
@ -0,0 +1,25 @@
|
|||
-----BEGIN CERTIFICATE-----
|
||||
MIIENTCCAx2gAwIBAgIUEDvbvuHcGVHjlPIttWw43Oom21wwDQYJKoZIhvcNAQEL
|
||||
BQAwezELMAkGA1UEBhMCQVUxEzARBgNVBAgMClF1ZWVuc2xhbmQxETAPBgNVBAcM
|
||||
CEJyaXNiYW5lMRQwEgYDVQQKDAt3b2xmU1NMIEluYzEUMBIGA1UECwwLRW5naW5l
|
||||
ZXJpbmcxGDAWBgNVBAMMD3d3dy53b2xmc3NsLmNvbTAeFw0yNjAxMjIyMDEyNTVa
|
||||
Fw0yODEwMTgyMDEyNTVaMHsxCzAJBgNVBAYTAkFVMRMwEQYDVQQIDApRdWVlbnNs
|
||||
YW5kMREwDwYDVQQHDAhCcmlzYmFuZTEUMBIGA1UECgwLd29sZlNTTCBJbmMxFDAS
|
||||
BgNVBAsMC0VuZ2luZWVyaW5nMRgwFgYDVQQDDA93d3cud29sZnNzbC5jb20wggEi
|
||||
MA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDAlQjhV0HycW230kVBJwFlxkWu
|
||||
8rwkMLiVzi9O1vYciLx8n/uoZ3/+XJxRdfeKygfnNS+P4b17wC98q2SoF/zKXXu6
|
||||
4CHlci5vLobYlXParBtTuV8/1xkNJU/hY2NRiwtkP61DuKUcXDSzrgCgY8X2fwtZ
|
||||
aHhzpowYqQJtr8MZAS64EOPGzEC0aaNGM2mHbsS7F6bz6N2tc7x7LyG1/WZRDL1U
|
||||
s+FtXxy8I3PRCQOJFNIQuWTDKtChlkq84dQaW8egwMFjeA9ENzAyloAyI5Whd7oT
|
||||
0pdz4l0lyWoNwzlgpLSwaUJCCenYCLwzILNYIqeq68Th5mGDxdKW39nQT63XAgMB
|
||||
AAGjgbAwga0wHQYDVR0OBBYEFLMRMsmSmITiyfjQO24DQsofDo48MB8GA1UdIwQY
|
||||
MBaAFLMRMsmSmITiyfjQO24DQsofDo48MBIGA1UdEwEB/wQIMAYBAf8CAQAwDgYD
|
||||
VR0PAQH/BAQDAgGGMB4GA1UdHgEB/wQUMBKgEDAOgQwud29sZnNzbC5jb20wJwYJ
|
||||
YIZIAYb4QgENBBoWGFRlc3RpbmcgbmFtZSBjb25zdHJhaW50czANBgkqhkiG9w0B
|
||||
AQsFAAOCAQEAZr1QdQEjFkF37DvrZvnXDq6+DXGBiCtQpiezqw/5UhQUAHR1cUrx
|
||||
YrkZz4qyFNCFa+zRSSpn2VJ6bi+B2Ue40FXBzdIUgYpRkwZSDL6/0Wqpp8JV4WMt
|
||||
0YuMsHbQFJ5ASTcAHWvxdlSgQVx45Ug/axwmzueIbysMim9ySampUH88338MoGEi
|
||||
oJ19y2rwjuTaACHOEsoBvPtsIibqy8ZpA/5tSCcqOxvxniRGjb7xITgQdqxR70zy
|
||||
/FXEWPPWWnyfhE0Mv+tyGdRJfKOUDPJsGl6R5TOw1jtqLSjI+T1r2Xnv1NC0iOTI
|
||||
oyAQmOkGGCyO4OYBUWekiXSOyrgRIrI5+Q==
|
||||
-----END CERTIFICATE-----
|
||||
|
|
@ -0,0 +1,25 @@
|
|||
-----BEGIN CERTIFICATE-----
|
||||
MIIEQzCCAyugAwIBAgIUBkUQq/NH1VHepfFamdk7iXl5niEwDQYJKoZIhvcNAQEL
|
||||
BQAwezELMAkGA1UEBhMCQVUxEzARBgNVBAgMClF1ZWVuc2xhbmQxETAPBgNVBAcM
|
||||
CEJyaXNiYW5lMRQwEgYDVQQKDAt3b2xmU1NMIEluYzEUMBIGA1UECwwLRW5naW5l
|
||||
ZXJpbmcxGDAWBgNVBAMMD3d3dy53b2xmc3NsLmNvbTAeFw0yNjAxMjIyMDEyNTVa
|
||||
Fw0yODEwMTgyMDEyNTVaMHsxCzAJBgNVBAYTAkFVMRMwEQYDVQQIDApRdWVlbnNs
|
||||
YW5kMREwDwYDVQQHDAhCcmlzYmFuZTEUMBIGA1UECgwLd29sZlNTTCBJbmMxFDAS
|
||||
BgNVBAsMC0VuZ2luZWVyaW5nMRgwFgYDVQQDDA93d3cud29sZnNzbC5jb20wggEi
|
||||
MA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDAlQjhV0HycW230kVBJwFlxkWu
|
||||
8rwkMLiVzi9O1vYciLx8n/uoZ3/+XJxRdfeKygfnNS+P4b17wC98q2SoF/zKXXu6
|
||||
4CHlci5vLobYlXParBtTuV8/1xkNJU/hY2NRiwtkP61DuKUcXDSzrgCgY8X2fwtZ
|
||||
aHhzpowYqQJtr8MZAS64EOPGzEC0aaNGM2mHbsS7F6bz6N2tc7x7LyG1/WZRDL1U
|
||||
s+FtXxy8I3PRCQOJFNIQuWTDKtChlkq84dQaW8egwMFjeA9ENzAyloAyI5Whd7oT
|
||||
0pdz4l0lyWoNwzlgpLSwaUJCCenYCLwzILNYIqeq68Th5mGDxdKW39nQT63XAgMB
|
||||
AAGjgb4wgbswHQYDVR0OBBYEFLMRMsmSmITiyfjQO24DQsofDo48MB8GA1UdIwQY
|
||||
MBaAFLMRMsmSmITiyfjQO24DQsofDo48MBIGA1UdEwEB/wQIMAYBAf8CAQAwDgYD
|
||||
VR0PAQH/BAQDAgGGMCwGA1UdHgEB/wQiMCCgHjANggt3b2xmc3NsLmNvbTANggtl
|
||||
eGFtcGxlLmNvbTAnBglghkgBhvhCAQ0EGhYYVGVzdGluZyBuYW1lIGNvbnN0cmFp
|
||||
bnRzMA0GCSqGSIb3DQEBCwUAA4IBAQCj6rtZeP/U3uhoYVR9k+9PR1xGY8UBaD5g
|
||||
ZzO+PvUsaEiVIXANC4nV8e7wZSiymvUZJYFBnsX/4NFON3imMsKmTxDTHNFpiy+x
|
||||
1F/G52e+kAxHo1FFALnhXK/Erg0op1eKypvIl2VGdu8l3+QPPs7wPTlJJ2Zd9YOs
|
||||
dSZp8Sx/HhK6GSptatclrdoCkeBFKTM8+W+s9shHf+DCmRvqh8p4d7mPfBGC1yK1
|
||||
734rSai1BrfGz2VmghfbiWD6ybRJRDRzZRoDnNGsaDoaLPVzZmfzXUnqDnbxoWZE
|
||||
6O7457JUZTR4CB5ja/8JcIqPKzl4twqYZZf9uZIwdA8AR28JtbJ6
|
||||
-----END CERTIFICATE-----
|
||||
|
|
@ -0,0 +1,25 @@
|
|||
-----BEGIN CERTIFICATE-----
|
||||
MIIENDCCAxygAwIBAgIUZ/zoSUnAsG/99KbvBbFEHIg8j9EwDQYJKoZIhvcNAQEL
|
||||
BQAwezELMAkGA1UEBhMCQVUxEzARBgNVBAgMClF1ZWVuc2xhbmQxETAPBgNVBAcM
|
||||
CEJyaXNiYW5lMRQwEgYDVQQKDAt3b2xmU1NMIEluYzEUMBIGA1UECwwLRW5naW5l
|
||||
ZXJpbmcxGDAWBgNVBAMMD3d3dy53b2xmc3NsLmNvbTAeFw0yNjAxMjIyMDEyNTVa
|
||||
Fw0yODEwMTgyMDEyNTVaMHsxCzAJBgNVBAYTAkFVMRMwEQYDVQQIDApRdWVlbnNs
|
||||
YW5kMREwDwYDVQQHDAhCcmlzYmFuZTEUMBIGA1UECgwLd29sZlNTTCBJbmMxFDAS
|
||||
BgNVBAsMC0VuZ2luZWVyaW5nMRgwFgYDVQQDDA93d3cud29sZnNzbC5jb20wggEi
|
||||
MA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDAlQjhV0HycW230kVBJwFlxkWu
|
||||
8rwkMLiVzi9O1vYciLx8n/uoZ3/+XJxRdfeKygfnNS+P4b17wC98q2SoF/zKXXu6
|
||||
4CHlci5vLobYlXParBtTuV8/1xkNJU/hY2NRiwtkP61DuKUcXDSzrgCgY8X2fwtZ
|
||||
aHhzpowYqQJtr8MZAS64EOPGzEC0aaNGM2mHbsS7F6bz6N2tc7x7LyG1/WZRDL1U
|
||||
s+FtXxy8I3PRCQOJFNIQuWTDKtChlkq84dQaW8egwMFjeA9ENzAyloAyI5Whd7oT
|
||||
0pdz4l0lyWoNwzlgpLSwaUJCCenYCLwzILNYIqeq68Th5mGDxdKW39nQT63XAgMB
|
||||
AAGjga8wgawwHQYDVR0OBBYEFLMRMsmSmITiyfjQO24DQsofDo48MB8GA1UdIwQY
|
||||
MBaAFLMRMsmSmITiyfjQO24DQsofDo48MBIGA1UdEwEB/wQIMAYBAf8CAQAwDgYD
|
||||
VR0PAQH/BAQDAgGGMBoGA1UdHgEB/wQQMA6gDDAKhwjAqAEA////ADAqBglghkgB
|
||||
hvhCAQ0EHRYbVGVzdGluZyBJUCBuYW1lIGNvbnN0cmFpbnRzMA0GCSqGSIb3DQEB
|
||||
CwUAA4IBAQAE5m4ZVb6udg9UdC1lOlYRbPRN7XlloF8MWY4q1fgADAe6Yb5M4r8m
|
||||
IeXsH5qtVuyISrntagHOnMmsuGdFc64scLGQZeEB7nDzga5D3CnrrLsDZznI9Z9B
|
||||
JIAAsxRF2E5AIsqweEQ2ArSAxpmcyv1jw3TrxEU5tW/SPcZJIPpWAQbGw2jnjzzu
|
||||
5Gw6Tr5rywmub1n8a+xiDIT7Dsohcnr07tXvH+XLtkw88aZbyDYbLQSiwENCgj+j
|
||||
iMiRRnbUkvlX6kq6NjTw7+SmKroSGR9TNNdf9NbVre3744nmAfYrOEVThXMhKczI
|
||||
xPUXgewPDmhtzfMqvQnngHY57Qn65C4l
|
||||
-----END CERTIFICATE-----
|
||||
|
|
@ -0,0 +1,27 @@
|
|||
-----BEGIN CERTIFICATE-----
|
||||
MIIEljCCA36gAwIBAgIUL0V4sh34dBCPx7JGnW1VkkjOB4wwDQYJKoZIhvcNAQEL
|
||||
BQAwezELMAkGA1UEBhMCVVMxEDAOBgNVBAgMB01vbnRhbmExEDAOBgNVBAcMB0Jv
|
||||
emVtYW4xFDASBgNVBAoMC3dvbGZTU0wgSW5jMRgwFgYDVQQLDA9EZXYgYW5kIFRl
|
||||
c3RpbmcxGDAWBgNVBAMMD3d3dy53b2xmc3NsLmNvbTAeFw0yNjAxMjIyMTE4MjJa
|
||||
Fw0yODEwMTgyMTE4MjJaMHsxCzAJBgNVBAYTAlVTMRAwDgYDVQQIDAdNb250YW5h
|
||||
MRAwDgYDVQQHDAdCb3plbWFuMRQwEgYDVQQKDAt3b2xmU1NMIEluYzEYMBYGA1UE
|
||||
CwwPRGV2IGFuZCBUZXN0aW5nMRgwFgYDVQQDDA93d3cud29sZnNzbC5jb20wggEi
|
||||
MA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDAlQjhV0HycW230kVBJwFlxkWu
|
||||
8rwkMLiVzi9O1vYciLx8n/uoZ3/+XJxRdfeKygfnNS+P4b17wC98q2SoF/zKXXu6
|
||||
4CHlci5vLobYlXParBtTuV8/1xkNJU/hY2NRiwtkP61DuKUcXDSzrgCgY8X2fwtZ
|
||||
aHhzpowYqQJtr8MZAS64EOPGzEC0aaNGM2mHbsS7F6bz6N2tc7x7LyG1/WZRDL1U
|
||||
s+FtXxy8I3PRCQOJFNIQuWTDKtChlkq84dQaW8egwMFjeA9ENzAyloAyI5Whd7oT
|
||||
0pdz4l0lyWoNwzlgpLSwaUJCCenYCLwzILNYIqeq68Th5mGDxdKW39nQT63XAgMB
|
||||
AAGjggEQMIIBDDAdBgNVHQ4EFgQUsxEyyZKYhOLJ+NA7bgNCyh8OjjwwHwYDVR0j
|
||||
BBgwFoAUsxEyyZKYhOLJ+NA7bgNCyh8OjjwwEgYDVR0TAQH/BAgwBgEB/wIBADAO
|
||||
BgNVHQ8BAf8EBAMCAYYwYAYDVR0eAQH/BFYwVKAgMA6CDC5leGFtcGxlLmNvbTAO
|
||||
gQwuZXhhbXBsZS5jb22hMDAWghQuYmxvY2tlZC5leGFtcGxlLmNvbTAWgRQuYmxv
|
||||
Y2tlZC5leGFtcGxlLmNvbTBEBglghkgBhvhCAQ0ENxY1VGVzdGluZyBtaXhlZCBw
|
||||
ZXJtaXR0ZWQgYW5kIGV4Y2x1ZGVkIG5hbWUgY29uc3RyYWludHMwDQYJKoZIhvcN
|
||||
AQELBQADggEBAEULvBMSjm5ENjZ7WNDnSPXwKm3ka1eK7AUCTmZdMl3Op1ge/yqq
|
||||
rdkG2xvX4cfAe8iPOUDMyvh/Jf9B8T2njOGnpUTueslRzDvOs7qBo/0VYRalkye9
|
||||
Qw0ysgKcvvnevMHMnErGCkLEvL0VmTTmSR9HA8YxRih962fBrv38GZytqmFw/TEm
|
||||
s0KMQRumxQWPHHAQ/AbWbzCIXZo0kOsZlIZV3geCf9M0klDhG/XLgFJqihwGDeT4
|
||||
Yvy1mtqJu87LduC03UKKqbMR0ltTOkoCm5xTjKQuTbHxPBw2q8UVZ7Ud2iE47UXi
|
||||
c4Zd4IxO9TTO5SCQaZLPq0dhp3SxjgtZ3tw=
|
||||
-----END CERTIFICATE-----
|
||||
|
|
@ -58,6 +58,11 @@ certList=(
|
|||
"intermediate/ca-int-ecc-cert.pem"
|
||||
"intermediate/server-int-cert.pem"
|
||||
"intermediate/server-int-ecc-cert.pem"
|
||||
"test/cert-ext-nc.pem"
|
||||
"test/cert-ext-ncip.pem"
|
||||
"test/cert-ext-ncdns.pem"
|
||||
"test/cert-ext-nc-combined.pem"
|
||||
"test/cert-ext-ncmulti.pem"
|
||||
)
|
||||
|
||||
for i in ${!certList[@]};
|
||||
|
|
@ -104,7 +109,7 @@ sed -i.bak -n '/-----BEGIN CERTIFICATE-----/,$p' intermediate/ca-int-ecc-cert.pe
|
|||
sed -i.bak -n '/-----BEGIN CERTIFICATE-----/,$p' intermediate/server-int-cert.pem
|
||||
sed -i.bak -n '/-----BEGIN CERTIFICATE-----/,$p' intermediate/server-int-ecc-cert.pem
|
||||
|
||||
# Remvoe sed .bak files
|
||||
# Remove sed .bak files
|
||||
rm intermediate/ca-int2-cert.pem.bak
|
||||
rm intermediate/ca-int2-ecc-cert.pem.bak
|
||||
rm intermediate/ca-int-cert.pem.bak
|
||||
|
|
|
|||
3
java.sh
3
java.sh
|
|
@ -117,7 +117,8 @@ gcc -Wall -c $fpic $CFLAGS ./native/com_wolfssl_WolfSSLCertRequest.c -o ./native
|
|||
gcc -Wall -c $fpic $CFLAGS ./native/com_wolfssl_WolfSSLCertificate.c -o ./native/com_wolfssl_WolfSSLCertificate.o $javaIncludes
|
||||
gcc -Wall -c $fpic $CFLAGS ./native/com_wolfssl_WolfSSLX509Name.c -o ./native/com_wolfssl_WolfSSLX509Name.o $javaIncludes
|
||||
gcc -Wall -c $fpic $CFLAGS ./native/com_wolfssl_WolfSSLX509StoreCtx.c -o ./native/com_wolfssl_WolfSSLX509StoreCtx.o $javaIncludes
|
||||
gcc -Wall $javaLibs $CFLAGS -o ./lib/$jniLibName ./native/com_wolfssl_WolfSSL.o ./native/com_wolfssl_WolfSSLSession.o ./native/com_wolfssl_WolfSSLContext.o ./native/com_wolfssl_WolfCryptRSA.o ./native/com_wolfssl_WolfCryptECC.o ./native/com_wolfssl_WolfCryptEccKey.o ./native/com_wolfssl_WolfSSLCertManager.o ./native/com_wolfssl_WolfSSLCertRequest.o ./native/com_wolfssl_WolfSSLCertificate.o ./native/com_wolfssl_WolfSSLX509Name.o ./native/com_wolfssl_WolfSSLX509StoreCtx.o -L$WOLFSSL_INSTALL_DIR/lib -L$WOLFSSL_INSTALL_DIR/lib64 -l$WOLFSSL_LIBNAME
|
||||
gcc -Wall -c $fpic $CFLAGS ./native/com_wolfssl_WolfSSLNameConstraints.c -o ./native/com_wolfssl_WolfSSLNameConstraints.o $javaIncludes
|
||||
gcc -Wall $javaLibs $CFLAGS -o ./lib/$jniLibName ./native/com_wolfssl_WolfSSL.o ./native/com_wolfssl_WolfSSLSession.o ./native/com_wolfssl_WolfSSLContext.o ./native/com_wolfssl_WolfCryptRSA.o ./native/com_wolfssl_WolfCryptECC.o ./native/com_wolfssl_WolfCryptEccKey.o ./native/com_wolfssl_WolfSSLCertManager.o ./native/com_wolfssl_WolfSSLCertRequest.o ./native/com_wolfssl_WolfSSLCertificate.o ./native/com_wolfssl_WolfSSLX509Name.o ./native/com_wolfssl_WolfSSLX509StoreCtx.o ./native/com_wolfssl_WolfSSLNameConstraints.o -L$WOLFSSL_INSTALL_DIR/lib -L$WOLFSSL_INSTALL_DIR/lib64 -l$WOLFSSL_LIBNAME
|
||||
if [ $? != 0 ]; then
|
||||
echo "Error creating native JNI library"
|
||||
exit 1
|
||||
|
|
|
|||
|
|
@ -1090,6 +1090,24 @@ JNIEXPORT jboolean JNICALL Java_com_wolfssl_WolfSSL_encryptThenMacEnabled
|
|||
#endif
|
||||
}
|
||||
|
||||
JNIEXPORT jboolean JNICALL Java_com_wolfssl_WolfSSL_NameConstraintsEnabled
|
||||
(JNIEnv* jenv, jclass jcl)
|
||||
{
|
||||
(void)jenv;
|
||||
(void)jcl;
|
||||
|
||||
/* Name Constraints API was added after wolfSSL 5.8.4 in PR 9705. Version
|
||||
* check must be greater than 5.8.4 or patch from PR 9705 must be applied
|
||||
* and WOLFSSL_PR9705_PATCH_APPLIED defined when compiling this wrapper. */
|
||||
#if defined(OPENSSL_EXTRA) && !defined(IGNORE_NAME_CONSTRAINTS) && \
|
||||
((LIBWOLFSSL_VERSION_HEX > 0x05008004) || \
|
||||
defined(WOLFSSL_PR9705_PATCH_APPLIED))
|
||||
return JNI_TRUE;
|
||||
#else
|
||||
return JNI_FALSE;
|
||||
#endif
|
||||
}
|
||||
|
||||
JNIEXPORT jlong JNICALL Java_com_wolfssl_WolfSSL_SSLv3_1ServerMethod
|
||||
(JNIEnv* jenv, jclass jcl)
|
||||
{
|
||||
|
|
|
|||
|
|
@ -833,6 +833,14 @@ JNIEXPORT jboolean JNICALL Java_com_wolfssl_WolfSSL_secretCallbackEnabled
|
|||
JNIEXPORT jboolean JNICALL Java_com_wolfssl_WolfSSL_encryptThenMacEnabled
|
||||
(JNIEnv *, jclass);
|
||||
|
||||
/*
|
||||
* Class: com_wolfssl_WolfSSL
|
||||
* Method: NameConstraintsEnabled
|
||||
* Signature: ()Z
|
||||
*/
|
||||
JNIEXPORT jboolean JNICALL Java_com_wolfssl_WolfSSL_NameConstraintsEnabled
|
||||
(JNIEnv *, jclass);
|
||||
|
||||
/*
|
||||
* Class: com_wolfssl_WolfSSL
|
||||
* Method: SSLv3_ServerMethod
|
||||
|
|
|
|||
|
|
@ -2352,7 +2352,6 @@ JNIEXPORT jobjectArray JNICALL Java_com_wolfssl_WolfSSLCertificate_X509_1get_1su
|
|||
}
|
||||
|
||||
return outerArray;
|
||||
|
||||
#else
|
||||
(void)jenv;
|
||||
(void)jcl;
|
||||
|
|
@ -2361,3 +2360,29 @@ JNIEXPORT jobjectArray JNICALL Java_com_wolfssl_WolfSSLCertificate_X509_1get_1su
|
|||
#endif /* !WOLFCRYPT_ONLY && !NO_CERTS && OPENSSL_EXTRA */
|
||||
}
|
||||
|
||||
JNIEXPORT jlong JNICALL Java_com_wolfssl_WolfSSLCertificate_X509_1get_1ext_1d2i_1name_1constraints
|
||||
(JNIEnv* jenv, jclass jcl, jlong x509Ptr)
|
||||
{
|
||||
/* Name Constraints API was added after wolfSSL 5.8.4 in PR 9705. Version
|
||||
* check must be greater than 5.8.4 or patch from PR 9705 must be applied
|
||||
* and WOLFSSL_PR9705_PATCH_APPLIED defined when compiling this wrapper. */
|
||||
#if defined(OPENSSL_EXTRA) && !defined(IGNORE_NAME_CONSTRAINTS) && \
|
||||
((LIBWOLFSSL_VERSION_HEX > 0x05008004) || \
|
||||
defined(WOLFSSL_PR9705_PATCH_APPLIED))
|
||||
WOLFSSL_X509* x509 = (WOLFSSL_X509*)(uintptr_t)x509Ptr;
|
||||
(void)jcl;
|
||||
|
||||
if (jenv == NULL || x509 == NULL) {
|
||||
return 0;
|
||||
}
|
||||
|
||||
return (jlong)(uintptr_t)wolfSSL_X509_get_ext_d2i(x509,
|
||||
NID_name_constraints, NULL, NULL);
|
||||
#else
|
||||
(void)jenv;
|
||||
(void)jcl;
|
||||
(void)x509Ptr;
|
||||
return 0;
|
||||
#endif
|
||||
}
|
||||
|
||||
|
|
|
|||
|
|
@ -261,6 +261,14 @@ JNIEXPORT jlong JNICALL Java_com_wolfssl_WolfSSLCertificate_X509_1load_1certific
|
|||
JNIEXPORT jint JNICALL Java_com_wolfssl_WolfSSLCertificate_X509_1check_1host
|
||||
(JNIEnv *, jclass, jlong, jstring, jlong, jlong);
|
||||
|
||||
/*
|
||||
* Class: com_wolfssl_WolfSSLCertificate
|
||||
* Method: X509_get_ext_d2i_name_constraints
|
||||
* Signature: (J)J
|
||||
*/
|
||||
JNIEXPORT jlong JNICALL Java_com_wolfssl_WolfSSLCertificate_X509_1get_1ext_1d2i_1name_1constraints
|
||||
(JNIEnv *, jclass, jlong);
|
||||
|
||||
/*
|
||||
* Class: com_wolfssl_WolfSSLCertificate
|
||||
* Method: X509_new
|
||||
|
|
|
|||
|
|
@ -0,0 +1,366 @@
|
|||
/* com_wolfssl_WolfSSLNameConstraints.c
|
||||
*
|
||||
* Copyright (C) 2006-2026 wolfSSL Inc.
|
||||
*
|
||||
* This file is part of wolfSSL.
|
||||
*
|
||||
* wolfSSL is free software; you can redistribute it and/or modify
|
||||
* it under the terms of the GNU General Public License as published by
|
||||
* the Free Software Foundation; either version 2 of the License, or
|
||||
* (at your option) any later version.
|
||||
*
|
||||
* wolfSSL is distributed in the hope that it will be useful,
|
||||
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
* GNU General Public License for more details.
|
||||
*
|
||||
* You should have received a copy of the GNU General Public License
|
||||
* along with this program; if not, write to the Free Software
|
||||
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1335, USA
|
||||
*/
|
||||
|
||||
#include <stdio.h>
|
||||
#include <stdint.h>
|
||||
|
||||
#ifdef WOLFSSL_USER_SETTINGS
|
||||
#include <wolfssl/wolfcrypt/settings.h>
|
||||
#else
|
||||
#include <wolfssl/options.h>
|
||||
#endif
|
||||
#include <wolfssl/ssl.h>
|
||||
#include <wolfssl/version.h>
|
||||
#include <wolfssl/openssl/x509v3.h>
|
||||
|
||||
#include "com_wolfssl_globals.h"
|
||||
#include "com_wolfssl_WolfSSLNameConstraints.h"
|
||||
|
||||
/* Maximum reasonable string length to prevent excessive allocation (64KB) */
|
||||
#define NC_MAX_STRING_LEN 65536
|
||||
|
||||
/* Name Constraints API was added after wolfSSL 5.8.4 in PR 9705. Version
|
||||
* check must be greater than 5.8.4 or patch from PR 9705 must be applied
|
||||
* and WOLFSSL_PR9705_PATCH_APPLIED defined when compiling this JNI wrapper. */
|
||||
|
||||
JNIEXPORT void JNICALL Java_com_wolfssl_WolfSSLNameConstraints_wolfSSL_1NAME_1CONSTRAINTS_1free
|
||||
(JNIEnv* jenv, jclass jcl, jlong ncPtr)
|
||||
{
|
||||
#if defined(OPENSSL_EXTRA) && !defined(IGNORE_NAME_CONSTRAINTS) && \
|
||||
((LIBWOLFSSL_VERSION_HEX > 0x05008004) || \
|
||||
defined(WOLFSSL_PR9705_PATCH_APPLIED))
|
||||
(void)jenv;
|
||||
(void)jcl;
|
||||
|
||||
if (ncPtr != 0) {
|
||||
wolfSSL_NAME_CONSTRAINTS_free(
|
||||
(WOLFSSL_NAME_CONSTRAINTS*)(uintptr_t)ncPtr);
|
||||
}
|
||||
#else
|
||||
(void)jenv;
|
||||
(void)jcl;
|
||||
(void)ncPtr;
|
||||
#endif
|
||||
}
|
||||
|
||||
JNIEXPORT jint JNICALL Java_com_wolfssl_WolfSSLNameConstraints_wolfSSL_1NAME_1CONSTRAINTS_1permittedNum
|
||||
(JNIEnv* jenv, jclass jcl, jlong ncPtr)
|
||||
{
|
||||
#if defined(OPENSSL_EXTRA) && !defined(IGNORE_NAME_CONSTRAINTS) && \
|
||||
((LIBWOLFSSL_VERSION_HEX > 0x05008004) || \
|
||||
defined(WOLFSSL_PR9705_PATCH_APPLIED))
|
||||
WOLFSSL_NAME_CONSTRAINTS* nc =
|
||||
(WOLFSSL_NAME_CONSTRAINTS*)(uintptr_t)ncPtr;
|
||||
(void)jenv;
|
||||
(void)jcl;
|
||||
|
||||
if (nc == NULL || nc->permittedSubtrees == NULL) {
|
||||
return 0;
|
||||
}
|
||||
return (jint)wolfSSL_sk_GENERAL_SUBTREE_num(nc->permittedSubtrees);
|
||||
#else
|
||||
(void)jenv;
|
||||
(void)jcl;
|
||||
(void)ncPtr;
|
||||
return 0;
|
||||
#endif
|
||||
}
|
||||
|
||||
JNIEXPORT jint JNICALL Java_com_wolfssl_WolfSSLNameConstraints_wolfSSL_1NAME_1CONSTRAINTS_1excludedNum
|
||||
(JNIEnv* jenv, jclass jcl, jlong ncPtr)
|
||||
{
|
||||
#if defined(OPENSSL_EXTRA) && !defined(IGNORE_NAME_CONSTRAINTS) && \
|
||||
((LIBWOLFSSL_VERSION_HEX > 0x05008004) || \
|
||||
defined(WOLFSSL_PR9705_PATCH_APPLIED))
|
||||
WOLFSSL_NAME_CONSTRAINTS* nc =
|
||||
(WOLFSSL_NAME_CONSTRAINTS*)(uintptr_t)ncPtr;
|
||||
(void)jenv;
|
||||
(void)jcl;
|
||||
|
||||
if (nc == NULL || nc->excludedSubtrees == NULL) {
|
||||
return 0;
|
||||
}
|
||||
return (jint)wolfSSL_sk_GENERAL_SUBTREE_num(nc->excludedSubtrees);
|
||||
#else
|
||||
(void)jenv;
|
||||
(void)jcl;
|
||||
(void)ncPtr;
|
||||
return 0;
|
||||
#endif
|
||||
}
|
||||
|
||||
JNIEXPORT jint JNICALL Java_com_wolfssl_WolfSSLNameConstraints_wolfSSL_1GENERAL_1SUBTREE_1getBaseType
|
||||
(JNIEnv* jenv, jclass jcl, jlong ncPtr, jboolean permitted, jint idx)
|
||||
{
|
||||
#if defined(OPENSSL_EXTRA) && !defined(IGNORE_NAME_CONSTRAINTS) && \
|
||||
((LIBWOLFSSL_VERSION_HEX > 0x05008004) || \
|
||||
defined(WOLFSSL_PR9705_PATCH_APPLIED))
|
||||
WOLFSSL_NAME_CONSTRAINTS* nc =
|
||||
(WOLFSSL_NAME_CONSTRAINTS*)(uintptr_t)ncPtr;
|
||||
WOLFSSL_STACK* sk;
|
||||
WOLFSSL_GENERAL_SUBTREE* subtree;
|
||||
int skNum;
|
||||
(void)jenv;
|
||||
(void)jcl;
|
||||
|
||||
if (nc == NULL) {
|
||||
return -1;
|
||||
}
|
||||
|
||||
sk = permitted ? nc->permittedSubtrees : nc->excludedSubtrees;
|
||||
if (sk == NULL) {
|
||||
return -1;
|
||||
}
|
||||
|
||||
/* Bounds check for idx to prevent out-of-bounds access */
|
||||
skNum = wolfSSL_sk_GENERAL_SUBTREE_num(sk);
|
||||
if (idx < 0 || idx >= skNum) {
|
||||
return -1;
|
||||
}
|
||||
|
||||
subtree = wolfSSL_sk_GENERAL_SUBTREE_value(sk, (int)idx);
|
||||
if (subtree == NULL || subtree->base == NULL) {
|
||||
return -1;
|
||||
}
|
||||
|
||||
return (jint)subtree->base->type;
|
||||
#else
|
||||
(void)jenv;
|
||||
(void)jcl;
|
||||
(void)ncPtr;
|
||||
(void)permitted;
|
||||
(void)idx;
|
||||
return -1;
|
||||
#endif
|
||||
}
|
||||
|
||||
JNIEXPORT jstring JNICALL Java_com_wolfssl_WolfSSLNameConstraints_wolfSSL_1GENERAL_1SUBTREE_1getBaseValue
|
||||
(JNIEnv* jenv, jclass jcl, jlong ncPtr, jboolean permitted, jint idx)
|
||||
{
|
||||
#if defined(OPENSSL_EXTRA) && !defined(IGNORE_NAME_CONSTRAINTS) && \
|
||||
((LIBWOLFSSL_VERSION_HEX > 0x05008004) || \
|
||||
defined(WOLFSSL_PR9705_PATCH_APPLIED))
|
||||
WOLFSSL_NAME_CONSTRAINTS* nc =
|
||||
(WOLFSSL_NAME_CONSTRAINTS*)(uintptr_t)ncPtr;
|
||||
WOLFSSL_STACK* sk;
|
||||
WOLFSSL_GENERAL_SUBTREE* subtree;
|
||||
WOLFSSL_GENERAL_NAME* gn;
|
||||
const unsigned char* str = NULL;
|
||||
int strLen = 0;
|
||||
int skNum;
|
||||
char* buf = NULL;
|
||||
jstring result = NULL;
|
||||
(void)jcl;
|
||||
|
||||
if (nc == NULL || jenv == NULL) {
|
||||
return NULL;
|
||||
}
|
||||
|
||||
sk = permitted ? nc->permittedSubtrees : nc->excludedSubtrees;
|
||||
if (sk == NULL) {
|
||||
return NULL;
|
||||
}
|
||||
|
||||
/* Bounds check for idx to prevent out-of-bounds access */
|
||||
skNum = wolfSSL_sk_GENERAL_SUBTREE_num(sk);
|
||||
if (idx < 0 || idx >= skNum) {
|
||||
return NULL;
|
||||
}
|
||||
|
||||
subtree = wolfSSL_sk_GENERAL_SUBTREE_value(sk, (int)idx);
|
||||
if (subtree == NULL || subtree->base == NULL) {
|
||||
return NULL;
|
||||
}
|
||||
|
||||
gn = subtree->base;
|
||||
|
||||
switch (gn->type) {
|
||||
case WOLFSSL_GEN_DNS:
|
||||
case WOLFSSL_GEN_EMAIL:
|
||||
case WOLFSSL_GEN_URI:
|
||||
if (gn->d.ia5 != NULL) {
|
||||
str = wolfSSL_ASN1_STRING_get0_data(gn->d.ia5);
|
||||
strLen = wolfSSL_ASN1_STRING_length(gn->d.ia5);
|
||||
}
|
||||
break;
|
||||
|
||||
case WOLFSSL_GEN_DIRNAME:
|
||||
if (gn->d.directoryName != NULL) {
|
||||
/* Convert X509_NAME to one-line string */
|
||||
buf = wolfSSL_X509_NAME_oneline(gn->d.directoryName, NULL, 0);
|
||||
if (buf != NULL) {
|
||||
result = (*jenv)->NewStringUTF(jenv, buf);
|
||||
XFREE(buf, NULL, DYNAMIC_TYPE_OPENSSL);
|
||||
return result;
|
||||
}
|
||||
}
|
||||
return NULL;
|
||||
|
||||
case WOLFSSL_GEN_IPADD:
|
||||
/* For IP addresses, return address/mask notation.
|
||||
* IPv4 (8 bytes): "192.168.1.0/255.255.255.0"
|
||||
* IPv6 (32 bytes): "fe80:0000:...:0001/ffff:ffff:...:0000" */
|
||||
if (gn->d.ip != NULL) {
|
||||
int i;
|
||||
int ipLen = wolfSSL_ASN1_STRING_length(gn->d.ip);
|
||||
const unsigned char* ipData =
|
||||
wolfSSL_ASN1_STRING_get0_data(gn->d.ip);
|
||||
|
||||
if (ipData != NULL && ipLen > 0 && ipLen <= 32) {
|
||||
if (ipLen == 8) {
|
||||
/* IPv4: 4 bytes IP + 4 bytes mask */
|
||||
/* Max: "255.255.255.255/255.255.255.255" = 31 chars */
|
||||
buf = (char*)XMALLOC(40, NULL, DYNAMIC_TYPE_TMP_BUFFER);
|
||||
if (buf != NULL) {
|
||||
XSNPRINTF(buf, 40, "%d.%d.%d.%d/%d.%d.%d.%d",
|
||||
ipData[0], ipData[1], ipData[2], ipData[3],
|
||||
ipData[4], ipData[5], ipData[6], ipData[7]);
|
||||
result = (*jenv)->NewStringUTF(jenv, buf);
|
||||
XFREE(buf, NULL, DYNAMIC_TYPE_TMP_BUFFER);
|
||||
return result;
|
||||
}
|
||||
}
|
||||
else if (ipLen == 32) {
|
||||
/* IPv6: 16 bytes IP + 16 bytes mask
|
||||
* Format: "xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx/
|
||||
* yyyy:yyyy:yyyy:yyyy:yyyy:yyyy:yyyy:yyyy"
|
||||
* 8 groups * 4 chars + 7 colons = 39 chars per addr
|
||||
* 39 + 1 (slash) + 39 = 79 chars + null = 80 */
|
||||
buf = (char*)XMALLOC(80, NULL, DYNAMIC_TYPE_TMP_BUFFER);
|
||||
if (buf != NULL) {
|
||||
int pos = 0;
|
||||
/* Format address (first 16 bytes) */
|
||||
for (i = 0; i < 16; i += 2) {
|
||||
if (i > 0) {
|
||||
buf[pos++] = ':';
|
||||
}
|
||||
XSNPRINTF(buf + pos, 5, "%02x%02x",
|
||||
ipData[i], ipData[i + 1]);
|
||||
pos += 4;
|
||||
}
|
||||
buf[pos++] = '/';
|
||||
/* Format mask (next 16 bytes) */
|
||||
for (i = 16; i < 32; i += 2) {
|
||||
if (i > 16) {
|
||||
buf[pos++] = ':';
|
||||
}
|
||||
XSNPRINTF(buf + pos, 5, "%02x%02x",
|
||||
ipData[i], ipData[i + 1]);
|
||||
pos += 4;
|
||||
}
|
||||
buf[pos] = '\0';
|
||||
result = (*jenv)->NewStringUTF(jenv, buf);
|
||||
XFREE(buf, NULL, DYNAMIC_TYPE_TMP_BUFFER);
|
||||
return result;
|
||||
}
|
||||
}
|
||||
else {
|
||||
/* Other lengths: return colon-separated hex bytes */
|
||||
int bufLen = ipLen * 3;
|
||||
buf = (char*)XMALLOC(bufLen, NULL,
|
||||
DYNAMIC_TYPE_TMP_BUFFER);
|
||||
if (buf != NULL) {
|
||||
int pos = 0;
|
||||
for (i = 0; i < ipLen; i++) {
|
||||
if (i > 0) {
|
||||
buf[pos++] = ':';
|
||||
}
|
||||
XSNPRINTF(buf + pos, 3, "%02X", ipData[i]);
|
||||
pos += 2;
|
||||
}
|
||||
buf[pos] = '\0';
|
||||
result = (*jenv)->NewStringUTF(jenv, buf);
|
||||
XFREE(buf, NULL, DYNAMIC_TYPE_TMP_BUFFER);
|
||||
return result;
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
return NULL;
|
||||
|
||||
default:
|
||||
return NULL;
|
||||
}
|
||||
|
||||
/* Validate strLen to prevent excessive allocation */
|
||||
if (str != NULL && strLen > 0 && strLen <= NC_MAX_STRING_LEN) {
|
||||
/* Create null-terminated copy for JNI NewStringUTF */
|
||||
buf = (char*)XMALLOC(strLen + 1, NULL, DYNAMIC_TYPE_TMP_BUFFER);
|
||||
if (buf != NULL) {
|
||||
XMEMCPY(buf, str, strLen);
|
||||
buf[strLen] = '\0';
|
||||
result = (*jenv)->NewStringUTF(jenv, buf);
|
||||
XFREE(buf, NULL, DYNAMIC_TYPE_TMP_BUFFER);
|
||||
}
|
||||
}
|
||||
|
||||
return result;
|
||||
#else
|
||||
(void)jenv;
|
||||
(void)jcl;
|
||||
(void)ncPtr;
|
||||
(void)permitted;
|
||||
(void)idx;
|
||||
return NULL;
|
||||
#endif
|
||||
}
|
||||
|
||||
JNIEXPORT jint JNICALL Java_com_wolfssl_WolfSSLNameConstraints_wolfSSL_1NAME_1CONSTRAINTS_1check_1name
|
||||
(JNIEnv* jenv, jclass jcl, jlong ncPtr, jint type, jstring name)
|
||||
{
|
||||
#if defined(OPENSSL_EXTRA) && !defined(IGNORE_NAME_CONSTRAINTS) && \
|
||||
((LIBWOLFSSL_VERSION_HEX > 0x05008004) || \
|
||||
defined(WOLFSSL_PR9705_PATCH_APPLIED))
|
||||
WOLFSSL_NAME_CONSTRAINTS* nc =
|
||||
(WOLFSSL_NAME_CONSTRAINTS*)(uintptr_t)ncPtr;
|
||||
const char* nameStr = NULL;
|
||||
int nameLen = 0;
|
||||
int ret = 0;
|
||||
(void)jcl;
|
||||
|
||||
if (nc == NULL || jenv == NULL || name == NULL) {
|
||||
return 0;
|
||||
}
|
||||
|
||||
/* Get the name string from Java */
|
||||
nameStr = (*jenv)->GetStringUTFChars(jenv, name, NULL);
|
||||
if (nameStr == NULL) {
|
||||
return 0;
|
||||
}
|
||||
nameLen = (int)(*jenv)->GetStringUTFLength(jenv, name);
|
||||
|
||||
/* Call native wolfSSL function */
|
||||
ret = wolfSSL_NAME_CONSTRAINTS_check_name(nc, (int)type, nameStr, nameLen);
|
||||
|
||||
/* Release the string */
|
||||
(*jenv)->ReleaseStringUTFChars(jenv, name, nameStr);
|
||||
|
||||
return (jint)ret;
|
||||
#else
|
||||
(void)jenv;
|
||||
(void)jcl;
|
||||
(void)ncPtr;
|
||||
(void)type;
|
||||
(void)name;
|
||||
return 0;
|
||||
#endif
|
||||
}
|
||||
|
||||
|
|
@ -0,0 +1,61 @@
|
|||
/* DO NOT EDIT THIS FILE - it is machine generated */
|
||||
#include <jni.h>
|
||||
/* Header for class com_wolfssl_WolfSSLNameConstraints */
|
||||
|
||||
#ifndef _Included_com_wolfssl_WolfSSLNameConstraints
|
||||
#define _Included_com_wolfssl_WolfSSLNameConstraints
|
||||
#ifdef __cplusplus
|
||||
extern "C" {
|
||||
#endif
|
||||
/*
|
||||
* Class: com_wolfssl_WolfSSLNameConstraints
|
||||
* Method: wolfSSL_NAME_CONSTRAINTS_free
|
||||
* Signature: (J)V
|
||||
*/
|
||||
JNIEXPORT void JNICALL Java_com_wolfssl_WolfSSLNameConstraints_wolfSSL_1NAME_1CONSTRAINTS_1free
|
||||
(JNIEnv *, jclass, jlong);
|
||||
|
||||
/*
|
||||
* Class: com_wolfssl_WolfSSLNameConstraints
|
||||
* Method: wolfSSL_NAME_CONSTRAINTS_permittedNum
|
||||
* Signature: (J)I
|
||||
*/
|
||||
JNIEXPORT jint JNICALL Java_com_wolfssl_WolfSSLNameConstraints_wolfSSL_1NAME_1CONSTRAINTS_1permittedNum
|
||||
(JNIEnv *, jclass, jlong);
|
||||
|
||||
/*
|
||||
* Class: com_wolfssl_WolfSSLNameConstraints
|
||||
* Method: wolfSSL_NAME_CONSTRAINTS_excludedNum
|
||||
* Signature: (J)I
|
||||
*/
|
||||
JNIEXPORT jint JNICALL Java_com_wolfssl_WolfSSLNameConstraints_wolfSSL_1NAME_1CONSTRAINTS_1excludedNum
|
||||
(JNIEnv *, jclass, jlong);
|
||||
|
||||
/*
|
||||
* Class: com_wolfssl_WolfSSLNameConstraints
|
||||
* Method: wolfSSL_GENERAL_SUBTREE_getBaseType
|
||||
* Signature: (JZI)I
|
||||
*/
|
||||
JNIEXPORT jint JNICALL Java_com_wolfssl_WolfSSLNameConstraints_wolfSSL_1GENERAL_1SUBTREE_1getBaseType
|
||||
(JNIEnv *, jclass, jlong, jboolean, jint);
|
||||
|
||||
/*
|
||||
* Class: com_wolfssl_WolfSSLNameConstraints
|
||||
* Method: wolfSSL_GENERAL_SUBTREE_getBaseValue
|
||||
* Signature: (JZI)Ljava/lang/String;
|
||||
*/
|
||||
JNIEXPORT jstring JNICALL Java_com_wolfssl_WolfSSLNameConstraints_wolfSSL_1GENERAL_1SUBTREE_1getBaseValue
|
||||
(JNIEnv *, jclass, jlong, jboolean, jint);
|
||||
|
||||
/*
|
||||
* Class: com_wolfssl_WolfSSLNameConstraints
|
||||
* Method: wolfSSL_NAME_CONSTRAINTS_check_name
|
||||
* Signature: (JILjava/lang/String;)I
|
||||
*/
|
||||
JNIEXPORT jint JNICALL Java_com_wolfssl_WolfSSLNameConstraints_wolfSSL_1NAME_1CONSTRAINTS_1check_1name
|
||||
(JNIEnv *, jclass, jlong, jint, jstring);
|
||||
|
||||
#ifdef __cplusplus
|
||||
}
|
||||
#endif
|
||||
#endif
|
||||
|
|
@ -50,12 +50,14 @@ infer --fail-on-issue run -- javac \
|
|||
src/java/com/wolfssl/WolfSSLException.java \
|
||||
src/java/com/wolfssl/WolfSSLFIPSErrorCallback.java \
|
||||
src/java/com/wolfssl/WolfSSLGenCookieCallback.java \
|
||||
src/java/com/wolfssl/WolfSSLGeneralName.java \
|
||||
src/java/com/wolfssl/WolfSSLIORecvCallback.java \
|
||||
src/java/com/wolfssl/WolfSSLIOSendCallback.java \
|
||||
src/java/com/wolfssl/WolfSSLJNIException.java \
|
||||
src/java/com/wolfssl/WolfSSLLoggingCallback.java \
|
||||
src/java/com/wolfssl/WolfSSLMacEncryptCallback.java \
|
||||
src/java/com/wolfssl/WolfSSLMissingCRLCallback.java \
|
||||
src/java/com/wolfssl/WolfSSLNameConstraints.java \
|
||||
src/java/com/wolfssl/WolfSSLNativeLoggingCallback.java \
|
||||
src/java/com/wolfssl/WolfSSLPskClientCallback.java \
|
||||
src/java/com/wolfssl/WolfSSLPskServerCallback.java \
|
||||
|
|
|
|||
|
|
@ -1021,6 +1021,15 @@ public class WolfSSL {
|
|||
*/
|
||||
public static native boolean encryptThenMacEnabled();
|
||||
|
||||
/**
|
||||
* Tests if native wolfSSL has been compiled with X.509 Name Constraints
|
||||
* extension support (OPENSSL_EXTRA and not IGNORE_NAME_CONSTRAINTS).
|
||||
*
|
||||
* @return true if enabled, otherwise false if Name Constraints support
|
||||
* has not been compiled in.
|
||||
*/
|
||||
public static native boolean NameConstraintsEnabled();
|
||||
|
||||
/* ---------------- native SSL/TLS version functions ---------------- */
|
||||
|
||||
/**
|
||||
|
|
|
|||
|
|
@ -111,6 +111,7 @@ public class WolfSSLCertificate implements Serializable {
|
|||
static native long X509_load_certificate_file(String path, int format);
|
||||
static native int X509_check_host(long x509, String chk, long flags,
|
||||
long peerName);
|
||||
static native long X509_get_ext_d2i_name_constraints(long x509);
|
||||
|
||||
/* native functions used for X509v3 certificate generation */
|
||||
static native long X509_new();
|
||||
|
|
@ -2074,6 +2075,43 @@ public class WolfSSLCertificate implements Serializable {
|
|||
return this.altNamesArray;
|
||||
}
|
||||
|
||||
/**
|
||||
* Get the Name Constraints extension from this certificate.
|
||||
*
|
||||
* Returns the Name Constraints extension if present, which specifies
|
||||
* permitted and excluded name subtrees for certificates issued by
|
||||
* this CA. See RFC 5280 Section 4.2.1.10.
|
||||
*
|
||||
* Caller should call {@link WolfSSLNameConstraints#free()} when done,
|
||||
* although free() will also be called upon garbage collection of the
|
||||
* WolfSSLNameConstraints object.
|
||||
*
|
||||
* @return WolfSSLNameConstraints object, or null if extension not present
|
||||
* or native wolfSSL was compiled with IGNORE_NAME_CONSTRAINTS.
|
||||
*
|
||||
* @throws IllegalStateException if WolfSSLCertificate has been freed.
|
||||
*/
|
||||
public WolfSSLNameConstraints getNameConstraints()
|
||||
throws IllegalStateException {
|
||||
|
||||
long ncPtr = 0;
|
||||
|
||||
confirmObjectIsActive();
|
||||
|
||||
synchronized (x509Lock) {
|
||||
WolfSSLDebug.log(getClass(), WolfSSLDebug.Component.JNI,
|
||||
WolfSSLDebug.INFO, this.x509Ptr,
|
||||
() -> "entering getNameConstraints()");
|
||||
|
||||
ncPtr = X509_get_ext_d2i_name_constraints(this.x509Ptr);
|
||||
}
|
||||
|
||||
if (ncPtr == 0) {
|
||||
return null;
|
||||
}
|
||||
return new WolfSSLNameConstraints(ncPtr);
|
||||
}
|
||||
|
||||
/**
|
||||
* Returns X509Certificate object based on this certificate.
|
||||
*
|
||||
|
|
|
|||
|
|
@ -0,0 +1,107 @@
|
|||
/* WolfSSLGeneralName.java
|
||||
*
|
||||
* Copyright (C) 2006-2026 wolfSSL Inc.
|
||||
*
|
||||
* This file is part of wolfSSL.
|
||||
*
|
||||
* wolfSSL is free software; you can redistribute it and/or modify
|
||||
* it under the terms of the GNU General Public License as published by
|
||||
* the Free Software Foundation; either version 2 of the License, or
|
||||
* (at your option) any later version.
|
||||
*
|
||||
* wolfSSL is distributed in the hope that it will be useful,
|
||||
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
* GNU General Public License for more details.
|
||||
*
|
||||
* You should have received a copy of the GNU General Public License
|
||||
* along with this program; if not, write to the Free Software
|
||||
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1335, USA
|
||||
*/
|
||||
package com.wolfssl;
|
||||
|
||||
/**
|
||||
* Represents an X.509 GeneralName (RFC 5280).
|
||||
* Used as the base type in name constraints.
|
||||
*
|
||||
* @author wolfSSL
|
||||
*/
|
||||
public class WolfSSLGeneralName {
|
||||
|
||||
/** otherName */
|
||||
public static final int GEN_OTHERNAME = 0;
|
||||
/** rfc822Name */
|
||||
public static final int GEN_EMAIL = 1;
|
||||
/** dNSName */
|
||||
public static final int GEN_DNS = 2;
|
||||
/** x400Address */
|
||||
public static final int GEN_X400 = 3;
|
||||
/** directoryName */
|
||||
public static final int GEN_DIRNAME = 4;
|
||||
/** ediPartyName */
|
||||
public static final int GEN_EDIPARTY = 5;
|
||||
/** uniformResourceIdentifier */
|
||||
public static final int GEN_URI = 6;
|
||||
/** iPAddress */
|
||||
public static final int GEN_IPADD = 7;
|
||||
/** registeredID */
|
||||
public static final int GEN_RID = 8;
|
||||
|
||||
private int type;
|
||||
private String value;
|
||||
|
||||
/**
|
||||
* Create a new GeneralName.
|
||||
*
|
||||
* @param type GeneralName type (GEN_DNS, GEN_EMAIL, etc.)
|
||||
* @param value String representation of the name
|
||||
*/
|
||||
public WolfSSLGeneralName(int type, String value) {
|
||||
this.type = type;
|
||||
this.value = value;
|
||||
}
|
||||
|
||||
/**
|
||||
* Get the GeneralName type.
|
||||
*
|
||||
* @return One of the GEN_* constants
|
||||
*/
|
||||
public int getType() {
|
||||
return type;
|
||||
}
|
||||
|
||||
/**
|
||||
* Get the name value as a string.
|
||||
*
|
||||
* @return The name value
|
||||
*/
|
||||
public String getValue() {
|
||||
return value;
|
||||
}
|
||||
|
||||
/**
|
||||
* Get human-readable type name.
|
||||
*
|
||||
* @return String representation of the type
|
||||
*/
|
||||
public String getTypeName() {
|
||||
switch (type) {
|
||||
case GEN_OTHERNAME: return "otherName";
|
||||
case GEN_EMAIL: return "email";
|
||||
case GEN_DNS: return "DNS";
|
||||
case GEN_X400: return "x400";
|
||||
case GEN_DIRNAME: return "dirName";
|
||||
case GEN_EDIPARTY: return "ediParty";
|
||||
case GEN_URI: return "URI";
|
||||
case GEN_IPADD: return "IP";
|
||||
case GEN_RID: return "RID";
|
||||
default: return "unknown(" + type + ")";
|
||||
}
|
||||
}
|
||||
|
||||
@Override
|
||||
public String toString() {
|
||||
return getTypeName() + ":" + value;
|
||||
}
|
||||
}
|
||||
|
||||
|
|
@ -0,0 +1,251 @@
|
|||
/* WolfSSLNameConstraints.java
|
||||
*
|
||||
* Copyright (C) 2006-2026 wolfSSL Inc.
|
||||
*
|
||||
* This file is part of wolfSSL.
|
||||
*
|
||||
* wolfSSL is free software; you can redistribute it and/or modify
|
||||
* it under the terms of the GNU General Public License as published by
|
||||
* the Free Software Foundation; either version 2 of the License, or
|
||||
* (at your option) any later version.
|
||||
*
|
||||
* wolfSSL is distributed in the hope that it will be useful,
|
||||
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
* GNU General Public License for more details.
|
||||
*
|
||||
* You should have received a copy of the GNU General Public License
|
||||
* along with this program; if not, write to the Free Software
|
||||
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1335, USA
|
||||
*/
|
||||
package com.wolfssl;
|
||||
|
||||
import java.util.List;
|
||||
import java.util.ArrayList;
|
||||
import java.util.Collections;
|
||||
|
||||
/**
|
||||
* Represents X.509 Name Constraints extension (OID 2.5.29.30), wraps
|
||||
* native wolfSSL WOLFSSL_NAME_CONSTRAINTS structure.
|
||||
*
|
||||
* The name constraints extension indicates a name space within which all
|
||||
* subject names in subsequent certificates in a certification path must
|
||||
* be located. See RFC 5280 Section 4.2.1.10.
|
||||
*
|
||||
* Use {@link WolfSSLCertificate#getNameConstraints()} to obtain an instance.
|
||||
* Caller must call {@link #free()} when done to release native resources,
|
||||
* or let the garbage collector handle it via finalize().
|
||||
*
|
||||
* @author wolfSSL
|
||||
*/
|
||||
public class WolfSSLNameConstraints {
|
||||
|
||||
/* Lock for synchronizing access to ncPtr and active state */
|
||||
private final Object ncLock = new Object();
|
||||
private long ncPtr = 0;
|
||||
private boolean active = false;
|
||||
|
||||
/* Cached Java lists, loaded once from native on construction */
|
||||
private List<WolfSSLGeneralName> permittedSubtrees;
|
||||
private List<WolfSSLGeneralName> excludedSubtrees;
|
||||
|
||||
private static native void wolfSSL_NAME_CONSTRAINTS_free(long ncPtr);
|
||||
private static native int wolfSSL_NAME_CONSTRAINTS_permittedNum(long ncPtr);
|
||||
private static native int wolfSSL_NAME_CONSTRAINTS_excludedNum(long ncPtr);
|
||||
private static native int wolfSSL_GENERAL_SUBTREE_getBaseType(long ncPtr,
|
||||
boolean permitted, int idx);
|
||||
private static native String wolfSSL_GENERAL_SUBTREE_getBaseValue(
|
||||
long ncPtr, boolean permitted, int idx);
|
||||
private static native int wolfSSL_NAME_CONSTRAINTS_check_name(long ncPtr,
|
||||
int type, String name);
|
||||
|
||||
/**
|
||||
* Internal constructor, called from WolfSSLCertificate.
|
||||
*
|
||||
* @param ncPtr Native pointer to WOLFSSL_NAME_CONSTRAINTS
|
||||
*
|
||||
* @throws IllegalArgumentException if ncPtr is 0
|
||||
*/
|
||||
WolfSSLNameConstraints(long ncPtr) {
|
||||
if (ncPtr == 0) {
|
||||
throw new IllegalArgumentException(
|
||||
"Invalid native NAME_CONSTRAINTS pointer");
|
||||
}
|
||||
this.ncPtr = ncPtr;
|
||||
this.active = true;
|
||||
loadSubtrees();
|
||||
}
|
||||
|
||||
/**
|
||||
* Load subtrees from native struct into Java lists.
|
||||
* Called once during construction to cache data.
|
||||
*/
|
||||
private void loadSubtrees() {
|
||||
int i, type, permCount, exclCount;
|
||||
String value;
|
||||
|
||||
/* Load permitted subtrees */
|
||||
permCount = wolfSSL_NAME_CONSTRAINTS_permittedNum(ncPtr);
|
||||
permittedSubtrees = new ArrayList<>(permCount);
|
||||
for (i = 0; i < permCount; i++) {
|
||||
type = wolfSSL_GENERAL_SUBTREE_getBaseType(ncPtr, true, i);
|
||||
value = wolfSSL_GENERAL_SUBTREE_getBaseValue(ncPtr, true, i);
|
||||
if (type >= 0 && value != null) {
|
||||
permittedSubtrees.add(new WolfSSLGeneralName(type, value));
|
||||
}
|
||||
}
|
||||
|
||||
/* Load excluded subtrees */
|
||||
exclCount = wolfSSL_NAME_CONSTRAINTS_excludedNum(ncPtr);
|
||||
excludedSubtrees = new ArrayList<>(exclCount);
|
||||
for (i = 0; i < exclCount; i++) {
|
||||
type = wolfSSL_GENERAL_SUBTREE_getBaseType(ncPtr, false, i);
|
||||
value = wolfSSL_GENERAL_SUBTREE_getBaseValue(ncPtr, false, i);
|
||||
if (type >= 0 && value != null) {
|
||||
excludedSubtrees.add(new WolfSSLGeneralName(type, value));
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Get permitted subtrees.
|
||||
*
|
||||
* @return Unmodifiable list of permitted GeneralName entries
|
||||
*
|
||||
* @throws IllegalStateException if object has been freed
|
||||
*/
|
||||
public List<WolfSSLGeneralName> getPermittedSubtrees() {
|
||||
|
||||
synchronized (ncLock) {
|
||||
checkActive();
|
||||
return Collections.unmodifiableList(permittedSubtrees);
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Get excluded subtrees.
|
||||
*
|
||||
* @return Unmodifiable list of excluded GeneralName entries
|
||||
*
|
||||
* @throws IllegalStateException if object has been freed
|
||||
*/
|
||||
public List<WolfSSLGeneralName> getExcludedSubtrees() {
|
||||
|
||||
synchronized (ncLock) {
|
||||
checkActive();
|
||||
return Collections.unmodifiableList(excludedSubtrees);
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Check if a name satisfies these constraints.
|
||||
*
|
||||
* A name is valid if it matches at least one permitted subtree (if any
|
||||
* exist for that type) and it does not match any excluded subtree.
|
||||
*
|
||||
* @param type GeneralName type (GEN_DNS, GEN_EMAIL, GEN_IPADD, GEN_URI)
|
||||
* @param name The name to validate
|
||||
*
|
||||
* @return true if name satisfies constraints, false otherwise
|
||||
*
|
||||
* @throws IllegalStateException if object has been freed
|
||||
* @throws IllegalArgumentException if name is null
|
||||
*/
|
||||
public boolean checkName(int type, String name) {
|
||||
|
||||
if (name == null) {
|
||||
throw new IllegalArgumentException("name cannot be null");
|
||||
}
|
||||
|
||||
synchronized (ncLock) {
|
||||
checkActive();
|
||||
return wolfSSL_NAME_CONSTRAINTS_check_name(ncPtr, type, name) == 1;
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Check if a DNS name satisfies these constraints.
|
||||
*
|
||||
* @param dnsName The DNS name to validate
|
||||
*
|
||||
* @return true if permitted, false if excluded or not permitted
|
||||
*/
|
||||
public boolean checkDnsName(String dnsName) {
|
||||
|
||||
return checkName(WolfSSLGeneralName.GEN_DNS, dnsName);
|
||||
}
|
||||
|
||||
/**
|
||||
* Check if an email address satisfies these constraints.
|
||||
*
|
||||
* @param email The email address to validate
|
||||
*
|
||||
* @return true if permitted, false if excluded or not permitted
|
||||
*/
|
||||
public boolean checkEmail(String email) {
|
||||
|
||||
return checkName(WolfSSLGeneralName.GEN_EMAIL, email);
|
||||
}
|
||||
|
||||
/**
|
||||
* Check if an IP address satisfies these constraints.
|
||||
*
|
||||
* @param ipAddress The IP address to validate (e.g., "192.168.1.50")
|
||||
*
|
||||
* @return true if permitted, false if excluded or not permitted
|
||||
*/
|
||||
public boolean checkIpAddress(String ipAddress) {
|
||||
|
||||
return checkName(WolfSSLGeneralName.GEN_IPADD, ipAddress);
|
||||
}
|
||||
|
||||
/**
|
||||
* Check if a URI satisfies these constraints.
|
||||
*
|
||||
* @param uri The URI to validate
|
||||
*
|
||||
* @return true if permitted, false if excluded or not permitted
|
||||
*/
|
||||
public boolean checkUri(String uri) {
|
||||
|
||||
return checkName(WolfSSLGeneralName.GEN_URI, uri);
|
||||
}
|
||||
|
||||
/**
|
||||
* Check if object is active (not freed).
|
||||
*
|
||||
* @throws IllegalStateException if object has been freed
|
||||
*/
|
||||
private void checkActive() {
|
||||
if (!active) {
|
||||
throw new IllegalStateException(
|
||||
"WolfSSLNameConstraints has been freed");
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Free native resources. Must be called when done with this object,
|
||||
* although garbage collector will also call it via finalize().
|
||||
*/
|
||||
public void free() {
|
||||
|
||||
synchronized (ncLock) {
|
||||
if (active && ncPtr != 0) {
|
||||
wolfSSL_NAME_CONSTRAINTS_free(ncPtr);
|
||||
ncPtr = 0;
|
||||
active = false;
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
@Override
|
||||
@SuppressWarnings("deprecation")
|
||||
protected void finalize() throws Throwable {
|
||||
try {
|
||||
free();
|
||||
} finally {
|
||||
super.finalize();
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
File diff suppressed because it is too large
Load Diff
|
|
@ -37,7 +37,8 @@ import com.wolfssl.WolfSSLException;
|
|||
WolfCryptECCTest.class,
|
||||
WolfSSLCertificateTest.class,
|
||||
WolfSSLCertRequestTest.class,
|
||||
WolfSSLCertManagerTest.class
|
||||
WolfSSLCertManagerTest.class,
|
||||
WolfSSLNameConstraintsTest.class
|
||||
})
|
||||
|
||||
|
||||
|
|
|
|||
Loading…
Reference in New Issue