Use "CN" correctly as dns or as real name.

[gigi.git] / src / org / cacert / gigi / pages / account / CertificateIssueForm.java

diff --git a/src/org/cacert/gigi/pages/account/CertificateIssueForm.java b/src/org/cacert/gigi/pages/account/CertificateIssueForm.java
index 6b5dee9a420537b68bb2760b5fe0fb412515098d..936ced84f52ad8e98576428bce73c85a54ca9fcc 100644 (file)
--- a/src/org/cacert/gigi/pages/account/CertificateIssueForm.java
+++ b/src/org/cacert/gigi/pages/account/CertificateIssueForm.java
@@ -51,6 +51,7 @@ import sun.security.x509.Extension;
 import sun.security.x509.GeneralName;
 import sun.security.x509.GeneralNameInterface;
 import sun.security.x509.GeneralNames;
+import sun.security.x509.PKIXExtensions;
 import sun.security.x509.RDN;
 import sun.security.x509.RFC822Name;
 import sun.security.x509.SubjectAlternativeNameExtension;
@@ -62,6 +63,8 @@ import sun.security.x509.X500Name;
  */
 public class CertificateIssueForm extends Form {
 
+    private static final String DEFAULT_CN = "CAcert WoT User";
+
     private final static Template t = new Template(CertificateIssueForm.class.getResource("CertificateIssueForm.templ"));
 
     private final static Template tIni = new Template(CertificateAdd.class.getResource("RequestCertificate.templ"));
@@ -74,7 +77,7 @@ public class CertificateIssueForm extends Form {
 
     String spkacChallenge;
 
-    String CN = "";
+    public String CN = DEFAULT_CN;
 
     Set<SubjectAlternateName> SANs = new LinkedHashSet<>();
 
@@ -82,6 +85,8 @@ public class CertificateIssueForm extends Form {
 
     boolean login;
 
+    CertificateProfile profile = CertificateProfile.getById(1);
+
     public CertificateIssueForm(HttpServletRequest hsr) {
         super(hsr);
         u = Page.getUser(hsr);
@@ -117,7 +122,14 @@ public class CertificateIssueForm extends Form {
                                 if (a.getObjectIdentifier().equals((Object) PKCS9Attribute.EMAIL_ADDRESS_OID)) {
                                     SANs.add(new SubjectAlternateName(SANType.EMAIL, a.getValueString()));
                                 } else if (a.getObjectIdentifier().equals((Object) X500Name.commonName_oid)) {
-                                    CN = a.getValueString();
+                                    String value = a.getValueString();
+                                    if (value.contains(".") && !value.contains(" ")) {
+                                        SANs.add(new SubjectAlternateName(SANType.DNS, value));
+                                    } else {
+                                        CN = value;
+                                    }
+                                } else if (a.getObjectIdentifier().equals((Object) PKIXExtensions.SubjectAlternativeName_Id)) {
+                                    // parse invalid SANs
                                 }
                             }
                         }
@@ -188,18 +200,70 @@ public class CertificateIssueForm extends Form {
                 } else {
                     login = "1".equals(req.getParameter("login"));
                     CN = req.getParameter("CN");
-                    SANs = parseSANBox(req.getParameter("SANs"));
                     String hashAlg = req.getParameter("hash_alg");
                     if (hashAlg != null) {
                         selectedDigest = Digest.valueOf(hashAlg);
                     }
+                    profile = CertificateProfile.getByName(req.getParameter("profile"));
+
+                    String pDNS = null;
+                    String pMail = null;
+                    Set<SubjectAlternateName> filteredSANs = new LinkedHashSet<>();
+                    boolean server = profile.getKeyName().equals("server");
+                    for (SubjectAlternateName san : parseSANBox(req.getParameter("SANs"))) {
+                        if (san.getType() == SANType.DNS) {
+                            if (u.isValidDomain(san.getName()) && server) {
+                                if (pDNS == null) {
+                                    pDNS = san.getName();
+                                }
+                                filteredSANs.add(san);
+                                continue;
+                            }
+                        } else if (san.getType() == SANType.EMAIL) {
+                            if (u.isValidEmail(san.getName()) && !server) {
+                                if (pMail == null) {
+                                    pMail = san.getName();
+                                }
+                                filteredSANs.add(san);
+                                continue;
+                            }
+                        }
+                        outputError(out, req, "The requested Subject alternate name \"%s\" has been removed.",//
+                                san.getType().toString().toLowerCase() + ":" + san.getName());
+                    }
+                    SANs = filteredSANs;
+                    if ( !u.isValidName(CN) && !server && !CN.equals(DEFAULT_CN)) {
+                        CN = DEFAULT_CN;
+                        outputError(out, req, "The real name entered cannot be verified with your account.");
+                    }
+
+                    final StringBuffer subject = new StringBuffer();
+                    if (server && pDNS != null) {
+                        subject.append("/commonName=");
+                        subject.append(pDNS);
+                        if (pMail != null) {
+                            outputError(out, req, "No email is included in this certificate.");
+                        }
+                        if (CN.equals("")) {
+                            CN = "";
+                            outputError(out, req, "No real name is included in this certificate.");
+                        }
+                    } else {
+                        subject.append("/commonName=");
+                        subject.append(CN);
+                        if (pMail != null) {
+                            subject.append("/emailAddress=");
+                            subject.append(pMail);
+                        }
+                    }
                     if (req.getParameter("CCA") == null) {
                         outputError(out, req, "You need to accept the CCA.");
+                    }
+                    if (isFailed(out)) {
                         return false;
                     }
-                    CertificateProfile profile = CertificateProfile.getByName(req.getParameter("profile"));
 
-                    result = new Certificate(LoginPage.getUser(req).getId(), "/commonName=CAcert WoT User", selectedDigest.toString(), //
+                    result = new Certificate(LoginPage.getUser(req).getId(), subject.toString(), selectedDigest.toString(), //
                             this.csr, this.csrType, profile, SANs.toArray(new SubjectAlternateName[SANs.size()]));
                     result.issue().waitFor(60000);
                     return true;
@@ -207,8 +271,10 @@ public class CertificateIssueForm extends Form {
             } catch (IOException e) {
                 e.printStackTrace();
             } catch (IllegalArgumentException e) {
+                e.printStackTrace();
                 throw new GigiApiException("Certificate Request format is invalid.");
             } catch (GeneralSecurityException e) {
+                e.printStackTrace();
                 throw new GigiApiException("Certificate Request format is invalid.");
             } catch (InterruptedException e) {
                 e.printStackTrace();
@@ -222,15 +288,31 @@ public class CertificateIssueForm extends Form {
     }
 
     private TreeSet<SubjectAlternateName> parseSANBox(String SANs) {
-        String[] SANparts = SANs.split("[\r\n]+");
+        String[] SANparts = SANs.split("[\r\n]+|, *");
         TreeSet<SubjectAlternateName> parsedNames = new TreeSet<>();
         for (String SANline : SANparts) {
             String[] parts = SANline.split(":", 2);
-            SANType t = Certificate.SANType.valueOf(parts[0].toUpperCase());
-            if (t == null || parts.length == 1) {
+            if (parts.length == 1) {
+                if (parts[0].trim().equals("")) {
+                    continue;
+                }
+                if (parts[0].contains("@")) {
+                    parsedNames.add(new SubjectAlternateName(SANType.EMAIL, parts[0]));
+                } else {
+                    parsedNames.add(new SubjectAlternateName(SANType.DNS, parts[0]));
+                }
+                continue;
+            }
+            try {
+                SANType t = Certificate.SANType.valueOf(parts[0].toUpperCase());
+                if (t == null) {
+                    continue;
+                }
+                parsedNames.add(new SubjectAlternateName(t, parts[1]));
+            } catch (IllegalArgumentException e) {
+                // invalid enum type
                 continue;
             }
-            parsedNames.add(new SubjectAlternateName(t, parts[1]));
         }
         return parsedNames;
     }
@@ -298,6 +380,11 @@ public class CertificateIssueForm extends Form {
                 if (cp == null) {
                     return false;
                 }
+                if (cp.getId() == profile.getId()) {
+                    vars.put("selected", " selected");
+                } else {
+                    vars.put("selected", "");
+                }
                 vars.put("key", cp.getKeyName());
                 vars.put("name", cp.getVisibleName());
                 return true;