OF-1100: Allow for subjectAltNames of type 'DNS'

In addition to subjectAltNames of type otherName with an ASN.1 Object Identifier of
"id-on-xmppAddr", subjectAltNames of type DNS should also be evaluated when processing
identities from a certificate.

src/java/org/jivesoftware/util/cert/SANCertificateIdentityMapping.java

 package org.jivesoftware.util.cert;
 
-import java.io.IOException;
 import java.security.cert.CertificateParsingException;
 import java.security.cert.X509Certificate;
 import java.util.ArrayList;
@@ -19,8 +18,9 @@ import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
 /**
- * Certificate identity mapping that uses XMPP-OtherName SubjectAlternativeName
- * as the identity credentials
+ * Certificate identity mapping that uses SubjectAlternativeName as the identity credentials. This implementation
+ * combines subjectAltName entries of type otherName with an ASN.1 Object Identifier of "id-on-xmppAddr" with entries
+ * of type DNS.
  *
  * @author Victor Hong
  *
@@ -48,19 +48,63 @@ public class SANCertificateIdentityMapping implements CertificateIdentityMapping
             if (altNames == null) {
                 return Collections.emptyList();
             }
-            // Use the type OtherName to search for the certified server name
             for (List<?> item : altNames) {
-                Integer type = (Integer) item.get(0);
-                if (type == 0) {
+                final Integer type = (Integer) item.get(0);
+                final Object value = item.get(1);
+                final String result;
+                switch ( type ) {
+                    case 0:
+                        // OtherName: search for "id-on-xmppAddr"
+                        result = parseOtherName( (byte[]) value );
+                        break;
+                    case 2:
+                        // DNS
+                        result = (String) value;
+                        break;
+                    default:
+                        // Other types are not applicable for XMPP, so silently ignore them
+                        result = null;
+                        break;
+                }
+
+                if ( result != null ) {
+                    identities.add( result );
+                }
+            }
+        }
+        catch (CertificateParsingException e) {
+            Log.error("Error parsing SubjectAltName in certificate: " + certificate.getSubjectDN(), e);
+        }
+        return identities;
+	}
+
+	/**
+	 * Returns the short name of mapping.
+	 * 
+	 * @return The short name of the mapping (never null).
+	 */
+	@Override
+	public String name() {
+		return "Subject Alternative Name Mapping";
+	}
+
+    /**
+     * Parses the byte-array representation of a subjectAltName 'otherName' entry, returning the "id-on-xmppAddr" value
+     * when that is in the entry.
+     *
+     * @param item A byte array representation of a subjectAltName 'otherName' entry (cannot be null).
+     * @return an "id-on-xmppAddr" value (which is expected to be a JID), or null.
+     */
+    public static String parseOtherName( byte[] item ) {
         // Type OtherName found so return the associated value
-                    try (ASN1InputStream decoder = new ASN1InputStream((byte[]) item.get(1))) {
+        try (ASN1InputStream decoder = new ASN1InputStream(item)) {
             // Value is encoded using ASN.1 so decode it to get the server's identity
             Object object = decoder.readObject();
             ASN1Sequence otherNameSeq = null;
             if (object != null && object instanceof ASN1Sequence) {
                 otherNameSeq = (ASN1Sequence) object;
             } else {
-                        	continue;
+                return null;
             }
             // Check the object identifier
             ASN1ObjectIdentifier objectId = (ASN1ObjectIdentifier) otherNameSeq.getObjectAt(0);
@@ -69,7 +113,7 @@ public class SANCertificateIdentityMapping implements CertificateIdentityMapping
             if ( !OTHERNAME_XMPP_OID.equals(objectId.getId())) {
                 // Not a XMPP otherName
                 Log.debug("Ignoring non-XMPP otherName, " + objectId.getId());
-                            continue;
+                return null;
             }
 
             // Get identity string
@@ -87,36 +131,17 @@ public class SANCertificateIdentityMapping implements CertificateIdentityMapping
                 }
                 if (identity != null && identity.length() > 0) {
                     // Add the decoded server name to the list of identities
-	                            identities.add(identity);
+                    return identity;
                 }
             } catch (IllegalArgumentException ex) {
                 // OF-517: othername formats are extensible. If we don't recognize the format, skip it.
                 Log.debug("Cannot parse altName, likely because of unknown record format.", ex);
             }
-                    } catch (IOException e) {
-                        // Ignore
         }
         catch (Exception e) {
             Log.error("Error decoding subjectAltName", e);
         }
-                }
-                // Other types are not applicable for XMPP, so silently ignore them
-            }
-        }
-        catch (CertificateParsingException e) {
-            Log.error("Error parsing SubjectAltName in certificate: " + certificate.getSubjectDN(), e);
-        }
-        return identities;
-	}
-
-	/**
-	 * Returns the short name of mapping
-	 * 
-	 * @return The short name of the mapping
-	 */
-	@Override
-	public String name() {
-		return "Subject Alternative Name Mapping";
+        return null;
     }
 
 }