SecureRandom sr) throws KeyManagementException {            throw new KeyManagementException                ("Default SSLContext is initialized automatically");        }         static synchronized SSLContextImpl getDefaultImpl() throws Exception {            if (defaultImpl == null) {                new DefaultSSLContext();            }            return defaultImpl;        }         private static synchronized TrustManager[] getDefaultTrustManager()                throws Exception {            if (defaultTrustManagers != null) {                return defaultTrustManagers;            }             KeyStore ks =                TrustManagerFactoryImpl.getCacertsKeyStore("defaultctx");             TrustManagerFactory tmf = TrustManagerFactory.getInstance(                TrustManagerFactory.getDefaultAlgorithm());            tmf.init(ks);            defaultTrustManagers = tmf.getTrustManagers();            return defaultTrustManagers;        }         private static synchronized KeyManager[] getDefaultKeyManager()                throws Exception {            if (defaultKeyManagers != null) {                return defaultKeyManagers;            }             final Map<String,String> props = new HashMap<>();            AccessController.doPrivileged(                        new PrivilegedExceptionAction<Object>() {                public Object run() throws Exception {                    props.put("keyStore",  System.getProperty(                                "javax.net.ssl.keyStore", ""));                    props.put("keyStoreType", System.getProperty(                                "javax.net.ssl.keyStoreType",                                KeyStore.getDefaultType()));                    props.put("keyStoreProvider", System.getProperty(                                "javax.net.ssl.keyStoreProvider", ""));                    props.put("keyStorePasswd", System.getProperty(                                "javax.net.ssl.keyStorePassword", ""));                    return null;                }            });             final String defaultKeyStore = props.get("keyStore");            String defaultKeyStoreType = props.get("keyStoreType");            String defaultKeyStoreProvider = props.get("keyStoreProvider");            if (debug != null && Debug.isOn("defaultctx")) {                System.out.println("keyStore is : " + defaultKeyStore);                System.out.println("keyStore type is : " +                                        defaultKeyStoreType);                System.out.println("keyStore provider is : " +                                        defaultKeyStoreProvider);            }             if (P11KEYSTORE.equals(defaultKeyStoreType) &&                    !NONE.equals(defaultKeyStore)) {                throw new IllegalArgumentException("if keyStoreType is "                    + P11KEYSTORE + ", then keyStore must be " + NONE);            }             FileInputStream fs = null;            if (defaultKeyStore.length() != 0 && !NONE.equals(defaultKeyStore)) {                fs = AccessController.doPrivileged(                        new PrivilegedExceptionAction<FileInputStream>() {                    public FileInputStream run() throws Exception {                        return new FileInputStream(defaultKeyStore);                    }                });            }             String defaultKeyStorePassword = props.get("keyStorePasswd");            char[] passwd = null;            if (defaultKeyStorePassword.length() != 0) {                passwd = defaultKeyStorePassword.toCharArray();            }             /**             * Try to initialize key store.             */            KeyStore ks = null;            if ((defaultKeyStoreType.length()) != 0) {                if (debug != null && Debug.isOn("defaultctx")) {                    System.out.println("init keystore");                }                if (defaultKeyStoreProvider.length() == 0) {                    ks = KeyStore.getInstance(defaultKeyStoreType);                } else {                    ks = KeyStore.getInstance(defaultKeyStoreType,                                        defaultKeyStoreProvider);                }                 // if defaultKeyStore is NONE, fs will be null                ks.load(fs, passwd);            }            if (fs != null) {                fs.close();                fs = null;            }             /*             * Try to initialize key manager.             */            if (debug != null && Debug.isOn("defaultctx")) {                System.out.println("init keymanager of type " +                    KeyManagerFactory.getDefaultAlgorithm());            }            KeyManagerFactory kmf = KeyManagerFactory.getInstance(                KeyManagerFactory.getDefaultAlgorithm());             if (P11KEYSTORE.equals(defaultKeyStoreType)) {                kmf.init(ks, null); // do not pass key passwd if using token            } else {                kmf.init(ks, passwd);            }             defaultKeyManagers = kmf.getKeyManagers();            return defaultKeyManagers;        }    }     /*     * The SSLContext implementation for TLS, SSL, SSLv3 and TLS10 algorithm     *     * @see SSLContext     */    public static final class TLS10Context extends ConservativeSSLContext {        // use the default constructor and methods    }     /*     * The SSLContext implementation for TLS11 algorithm     *     * @see SSLContext     */    public static final class TLS11Context extends SSLContextImpl {        // parameters        private static SSLParameters defaultServerSSLParams;        private static SSLParameters defaultClientSSLParams;        private static SSLParameters supportedSSLParams;         static {            if (SunJSSE.isFIPS()) {                supportedSSLParams = new SSLParameters();                supportedSSLParams.setProtocols(new String[] {                    ProtocolVersion.TLS10.name,                    ProtocolVersion.TLS11.name,                    ProtocolVersion.TLS12.name                });                 defaultServerSSLParams = supportedSSLParams;                 defaultClientSSLParams = new SSLParameters();                defaultClientSSLParams.setProtocols(new String[] {                    ProtocolVersion.TLS10.name,                    ProtocolVersion.TLS11.name                });             } else {                supportedSSLParams = new SSLParameters();                supportedSSLParams.setProtocols(new String[] {                    ProtocolVersion.SSL20Hello.name,                    ProtocolVersion.SSL30.name,                    ProtocolVersion.TLS10.name,                    ProtocolVersion.TLS11.name,                    ProtocolVersion.TLS12.name                });                 defaultServerSSLParams = supportedSSLParams;                 defaultClientSSLParams = new SSLParameters();                defaultClientSSLParams.setProtocols(new String[] {                    ProtocolVersion.SSL30.name,                    ProtocolVersion.TLS10.name,                    ProtocolVersion.TLS11.name                });            }        }         SSLParameters getDefaultServerSSLParams() {            return defaultServerSSLParams;        }         SSLParameters getDefaultClientSSLParams() {            return defaultClientSSLParams;        }         SSLParameters getSupportedSSLParams() {            return supportedSSLParams;        }    }     /*     * The SSLContext implementation for TLS12 algorithm     *     * @see SSLContext     */    public static final class TLS12Context extends SSLContextImpl {        // parameters        private static SSLParameters defaultServerSSLParams;        private static SSLParameters defaultClientSSLParams;        private static SSLParameters supportedSSLParams;         static {            if (SunJSSE.isFIPS()) {                supportedSSLParams = new SSLParameters();                supportedSSLParams.setProtocols(new String[] {                    ProtocolVersion.TLS10.name,                    ProtocolVersion.TLS11.name,                    ProtocolVersion.TLS12.name                });                 defaultServerSSLParams = supportedSSLParams;                 defaultClientSSLParams = new SSLParameters();                defaultClientSSLParams.setProtocols(new String[] {                    ProtocolVersion.TLS10.name,                    ProtocolVersion.TLS11.name,                    ProtocolVersion.TLS12.name                });             } else {                supportedSSLParams = new SSLParameters();                supportedSSLParams.setProtocols(new String[] {                    ProtocolVersion.SSL20Hello.name,                    ProtocolVersion.SSL30.name,                    ProtocolVersion.TLS10.name,                    ProtocolVersion.TLS11.name,                    ProtocolVersion.TLS12.name                });                 defaultServerSSLParams = supportedSSLParams;                 defaultClientSSLParams = new SSLParameters();                defaultClientSSLParams.setProtocols(new String[] {                    ProtocolVersion.SSL30.name,                    ProtocolVersion.TLS10.name,                    ProtocolVersion.TLS11.name,                    ProtocolVersion.TLS12.name                });            }        }         SSLParameters getDefaultServerSSLParams() {            return defaultServerSSLParams;        }         SSLParameters getDefaultClientSSLParams() {            return defaultClientSSLParams;        }         SSLParameters getSupportedSSLParams() {            return supportedSSLParams;        }    } }  final class AbstractTrustManagerWrapper extends X509ExtendedTrustManager            implements X509TrustManager {     private final X509TrustManager tm;     AbstractTrustManagerWrapper(X509TrustManager tm) {        this.tm = tm;    }     @Override    public void checkClientTrusted(X509Certificate[] chain, String authType)        throws CertificateException {        tm.checkClientTrusted(chain, authType);    }     @Override    public void checkServerTrusted(X509Certificate[] chain, String authType)        throws CertificateException {        tm.checkServerTrusted(chain, authType);    }     @Override    public X509Certificate[] getAcceptedIssuers() {        return tm.getAcceptedIssuers();    }     @Override    public void checkClientTrusted(X509Certificate[] chain, String authType,                Socket socket) throws CertificateException {        tm.checkClientTrusted(chain, authType);        checkAdditionalTrust(chain, authType, socket, true);    }     @Override    public void checkServerTrusted(X509Certificate[] chain, String authType,            Socket socket) throws CertificateException {        tm.checkServerTrusted(chain, authType);        checkAdditionalTrust(chain, authType, socket, false);    }     @Override    public void checkClientTrusted(X509Certificate[] chain, String authType,            SSLEngine engine) throws CertificateException {        tm.checkClientTrusted(chain, authType);        checkAdditionalTrust(chain, authType, engine, true);    }     @Override    public void checkServerTrusted(X509Certificate[] chain, String authType,            SSLEngine engine) throws CertificateException {        tm.checkServerTrusted(chain, authType);        checkAdditionalTrust(chain, authType, engine, false);    }     private void checkAdditionalTrust(X509Certificate[] chain, String authType,                Socket socket, boolean isClient) throws CertificateException {        if (socket != null && socket.isConnected() &&                                    socket instanceof SSLSocket) {             SSLSocket sslSocket = (SSLSocket)socket;            SSLSession session = sslSocket.getHandshakeSession();            if (session == null) {                throw new CertificateException("No handshake session");            }             // check endpoint identity            String identityAlg = sslSocket.getSSLParameters().                                        getEndpointIdentificationAlgorithm();            if (identityAlg != null && identityAlg.length() != 0) {                String hostname = session.getPeerHost();                X509TrustManagerImpl.checkIdentity(                                    hostname, chain[0], identityAlg);            }             // try the best to check the algorithm constraints            ProtocolVersion protocolVersion =                ProtocolVersion.valueOf(session.getProtocol());            AlgorithmConstraints constraints = null;            if (protocolVersion.v >= ProtocolVersion.TLS12.v) {                if (session instanceof ExtendedSSLSession) {                    ExtendedSSLSession extSession =                                    (ExtendedSSLSession)session;                    String[] peerSupportedSignAlgs =                            extSession.getLocalSupportedSignatureAlgorithms();                     constraints = new SSLAlgorithmConstraints(                                    sslSocket, peerSupportedSignAlgs, true);                } else {                    constraints =                            new SSLAlgorithmConstraints(sslSocket, true);                }            } else {                constraints = new SSLAlgorithmConstraints(sslSocket, true);            }             AlgorithmChecker checker = new AlgorithmChecker(constraints);            try {                checker.init(false);                 // a forward checker, need to check from trust to target                for (int i = chain.length - 1; i >= 0; i--) {                    Certificate cert = chain[i];                    // We don't care about the unresolved critical extensions.                    checker.check(cert, Collections.<String>emptySet());                }            } catch (CertPathValidatorException cpve) {                throw new CertificateException(                    "Certificates does not conform to algorithm constraints");            }        }    }     private void checkAdditionalTrust(X509Certificate[] chain, String authType,            SSLEngine engine, boolean isClient) throws CertificateException {        if (engine != null) {            SSLSession session = engine.getHandshakeSession();            if (session == null) {                throw new CertificateException("No handshake session");            }             // check endpoint identity            String identityAlg = engine.getSSLParameters().                                        getEndpointIdentificationAlgorithm();            if (identityAlg != null && identityAlg.length() != 0) {                String hostname = session.getPeerHost();                X509TrustManagerImpl.checkIdentity(                                    hostname, chain[0], identityAlg);            }             // try the best to check the algorithm constraints            ProtocolVersion protocolVersion =                ProtocolVersion.valueOf(session.getProtocol());            AlgorithmConstraints constraints = null;            if (protocolVersion.v >= ProtocolVersion.TLS12.v) {                if (session instanceof ExtendedSSLSession) {                    ExtendedSSLSession extSession =                                    (ExtendedSSLSession)session;                    String[] peerSupportedSignAlgs =                            extSession.getLocalSupportedSignatureAlgorithms();                     constraints = new SSLAlgorithmConstraints(                                    engine, peerSupportedSignAlgs, true);                } else {                    constraints =                            new SSLAlgorithmConstraints(engine, true);                }            } else {                constraints = new SSLAlgorithmConstraints(engine, true);            }             AlgorithmChecker checker = new AlgorithmChecker(constraints);            try {                checker.init(false);                 // A forward checker, need to check from trust to target                for (int i = chain.length - 1; i >= 0; i--) {                    Certificate cert = chain[i];                    // We don't care about the unresolved critical extensions.                    checker.check(cert, Collections.<String>emptySet());                }            } catch (CertPathValidatorException cpve) {                throw new CertificateException(                    "Certificates does not conform to algorithm constraints");            }        }    }} // Dummy X509TrustManager implementation, rejects all peer certificates.// Used if the application did not specify a proper X509TrustManager.final class DummyX509TrustManager extends X509ExtendedTrustManager            implements X509TrustManager {     static final X509TrustManager INSTANCE = new DummyX509TrustManager();     private DummyX509TrustManager() {        // empty    }     /*     * Given the partial or complete certificate chain     * provided by the peer, build a certificate path     * to a trusted root and return if it can be     * validated and is trusted for client SSL authentication.     * If not, it throws an exception.     */    @Override    public void checkClientTrusted(X509Certificate[] chain, String authType)        throws CertificateException {        throw new CertificateException(            "No X509TrustManager implementation avaiable");    }     /*     * Given the partial or complete certificate chain     * provided by the peer, build a certificate path     * to a trusted root and return if it can be     * validated and is trusted for server SSL authentication.     * If not, it throws an exception.     */    @Override    public void checkServerTrusted(X509Certificate[] chain, String authType)        throws CertificateException {        throw new CertificateException(            "No X509TrustManager implementation available");    }     /*     * Return an array of issuer certificates which are trusted     * for authenticating peers.     */    @Override    public X509Certificate[] getAcceptedIssuers() {        return new X509Certificate[0];    }     @Override    public void checkClientTrusted(X509Certificate[] chain, String authType,                Socket socket) throws CertificateException {        throw new CertificateException(            "No X509TrustManager implementation available");    }     @Override    public void checkServerTrusted(X509Certificate[] chain, String authType,            Socket socket) throws CertificateException {        throw new CertificateException(            "No X509TrustManager implementation available");    }     @Override    public void checkClientTrusted(X509Certificate[] chain, String authType,            SSLEngine engine) throws CertificateException {        throw new CertificateException(

Lines 501–1000 of 1145. Previous lines Load more