mirror of
https://github.com/openjdk/jdk.git
synced 2025-08-26 22:34:27 +02:00
217 lines
8.5 KiB
Java
217 lines
8.5 KiB
Java
/*
|
|
* Copyright (c) 2000, 2024, Oracle and/or its affiliates. All rights reserved.
|
|
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
|
|
*
|
|
* This code is free software; you can redistribute it and/or modify it
|
|
* under the terms of the GNU General Public License version 2 only, as
|
|
* published by the Free Software Foundation. Oracle designates this
|
|
* particular file as subject to the "Classpath" exception as provided
|
|
* by Oracle in the LICENSE file that accompanied this code.
|
|
*
|
|
* This code is distributed in the hope that it will be useful, but WITHOUT
|
|
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
|
|
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
|
|
* version 2 for more details (a copy is included in the LICENSE file that
|
|
* accompanied this code).
|
|
*
|
|
* You should have received a copy of the GNU General Public License version
|
|
* 2 along with this work; if not, write to the Free Software Foundation,
|
|
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
|
|
*
|
|
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
|
|
* or visit www.oracle.com if you need additional information or have any
|
|
* questions.
|
|
*/
|
|
|
|
package sun.security.provider.certpath;
|
|
|
|
import java.io.IOException;
|
|
import java.security.GeneralSecurityException;
|
|
import java.security.cert.*;
|
|
import java.util.*;
|
|
|
|
import sun.security.provider.certpath.PKIX.BuilderParams;
|
|
import sun.security.util.Debug;
|
|
|
|
/**
|
|
* Abstract class representing a builder, which is able to retrieve
|
|
* matching certificates and is able to verify a particular certificate.
|
|
*
|
|
* @since 1.4
|
|
* @author Sean Mullan
|
|
* @author Yassir Elley
|
|
*/
|
|
|
|
abstract class Builder {
|
|
|
|
private static final Debug debug = Debug.getInstance("certpath");
|
|
private Set<String> matchingPolicies;
|
|
final BuilderParams buildParams;
|
|
final X509CertSelector targetCertConstraints;
|
|
|
|
/**
|
|
* Flag indicating whether support for the caIssuers field of the
|
|
* Authority Information Access extension shall be enabled. Currently
|
|
* disabled by default for compatibility reasons.
|
|
*/
|
|
static final boolean USE_AIA =
|
|
Boolean.getBoolean("com.sun.security.enableAIAcaIssuers");
|
|
|
|
/**
|
|
* Initialize the builder with the input parameters.
|
|
*
|
|
* @param buildParams the parameter set used to build a certification path
|
|
*/
|
|
Builder(BuilderParams buildParams) {
|
|
this.buildParams = buildParams;
|
|
this.targetCertConstraints =
|
|
(X509CertSelector)buildParams.targetCertConstraints();
|
|
}
|
|
|
|
/**
|
|
* Retrieves certificates from the list of certStores using the buildParams
|
|
* and the currentState as a filter
|
|
*
|
|
* @param currentState the current State
|
|
* @param certStores list of CertStores
|
|
*/
|
|
abstract Collection<X509Certificate> getMatchingCerts
|
|
(State currentState, List<CertStore> certStores)
|
|
throws CertStoreException, CertificateException, IOException;
|
|
|
|
/**
|
|
* Verifies the cert against the currentState, using the certPathList
|
|
* generated thus far to help with loop detection
|
|
*
|
|
* @param cert the certificate to be verified
|
|
* @param currentState the current state against which the cert is verified
|
|
* @param certPathList the certPathList generated thus far
|
|
*/
|
|
abstract void verifyCert(X509Certificate cert, State currentState,
|
|
List<X509Certificate> certPathList)
|
|
throws GeneralSecurityException;
|
|
|
|
/**
|
|
* Verifies whether the input certificate completes the path.
|
|
* When building in the forward direction, a trust anchor will
|
|
* complete the path.
|
|
*
|
|
* @param cert the certificate to test
|
|
* @return a boolean value indicating whether the cert completes the path.
|
|
*/
|
|
abstract boolean isPathCompleted(X509Certificate cert);
|
|
|
|
/**
|
|
* Adds the certificate to the certPathList
|
|
*
|
|
* @param cert the certificate to be added
|
|
* @param certPathList the certification path list
|
|
*/
|
|
abstract void addCertToPath(X509Certificate cert,
|
|
LinkedList<X509Certificate> certPathList);
|
|
|
|
/**
|
|
* Removes final certificate from the certPathList
|
|
*
|
|
* @param certPathList the certification path list
|
|
*/
|
|
abstract void removeFinalCertFromPath
|
|
(LinkedList<X509Certificate> certPathList);
|
|
|
|
/**
|
|
* This method can be used as an optimization to filter out
|
|
* certificates that do not have policies which are valid.
|
|
* It returns the set of policies (String OIDs) that should exist in
|
|
* the certificate policies extension of the certificate that is
|
|
* needed by the builder. The logic applied is as follows:
|
|
* <p>
|
|
* 1) If some initial policies have been set *and* policy mappings are
|
|
* inhibited, then acceptable certificates are those that include
|
|
* the ANY_POLICY OID or with policies that intersect with the
|
|
* initial policies.
|
|
* 2) If no initial policies have been set *or* policy mappings are
|
|
* not inhibited then we don't have much to work with. All we know is
|
|
* that a certificate must have *some* policy because if it didn't
|
|
* have any policy then the policy tree would become null (and validation
|
|
* would fail).
|
|
*
|
|
* @return the Set of policies any of which must exist in a
|
|
* cert's certificate policies extension in order for a cert to be selected.
|
|
*/
|
|
Set<String> getMatchingPolicies() {
|
|
if (matchingPolicies != null) {
|
|
Set<String> initialPolicies = buildParams.initialPolicies();
|
|
if ((!initialPolicies.isEmpty()) &&
|
|
(!initialPolicies.contains(PolicyChecker.ANY_POLICY)) &&
|
|
(buildParams.policyMappingInhibited()))
|
|
{
|
|
matchingPolicies = new HashSet<>(initialPolicies);
|
|
matchingPolicies.add(PolicyChecker.ANY_POLICY);
|
|
} else {
|
|
// we just return an empty set to make sure that there is
|
|
// at least a certificate policies extension in the cert
|
|
matchingPolicies = Collections.emptySet();
|
|
}
|
|
}
|
|
return matchingPolicies;
|
|
}
|
|
|
|
/**
|
|
* Search the specified CertStores and add all certificates matching
|
|
* selector to resultCerts.
|
|
*
|
|
* If the targetCert criterion of the selector is set, only that cert
|
|
* is examined and the CertStores are not searched.
|
|
*
|
|
* If checkAll is true, all CertStores are searched for matching certs.
|
|
* If false, the method returns as soon as the first CertStore returns
|
|
* a matching cert(s).
|
|
*
|
|
* Returns true iff resultCerts changed (a cert was added to the collection)
|
|
*/
|
|
boolean addMatchingCerts(X509CertSelector selector,
|
|
Collection<CertStore> certStores,
|
|
Collection<X509Certificate> resultCerts,
|
|
boolean checkAll)
|
|
{
|
|
X509Certificate targetCert = selector.getCertificate();
|
|
if (targetCert != null) {
|
|
// no need to search CertStores
|
|
if (selector.match(targetCert)) {
|
|
if (debug != null) {
|
|
debug.println("Builder.addMatchingCerts: " +
|
|
"adding target cert" +
|
|
"\n SN: " + Debug.toString(targetCert.getSerialNumber()) +
|
|
"\n Subject: " + targetCert.getSubjectX500Principal() +
|
|
"\n Issuer: " + targetCert.getIssuerX500Principal());
|
|
}
|
|
return resultCerts.add(targetCert);
|
|
}
|
|
return false;
|
|
}
|
|
boolean add = false;
|
|
for (CertStore store : certStores) {
|
|
try {
|
|
Collection<? extends Certificate> certs =
|
|
store.getCertificates(selector);
|
|
for (Certificate cert : certs) {
|
|
if (resultCerts.add((X509Certificate)cert)) {
|
|
add = true;
|
|
}
|
|
}
|
|
if (!checkAll && add) {
|
|
return true;
|
|
}
|
|
} catch (CertStoreException cse) {
|
|
// if getCertificates throws a CertStoreException, we ignore
|
|
// it and move on to the next CertStore
|
|
if (debug != null) {
|
|
debug.println("Builder.addMatchingCerts, non-fatal " +
|
|
"exception retrieving certs: " + cse);
|
|
cse.printStackTrace();
|
|
}
|
|
}
|
|
}
|
|
return add;
|
|
}
|
|
}
|