History

My first initial commit with all of mine experimental changes.

Dmitry Kabak (userdima committed 13 years ago

Commit d37b88d1 parent 3f5b46618352 files · +2598093 −-8690Browse files

Showing the changes to java/pkg/sun/security/ssl/SSLAlgorithmConstraints.java (1 of 18352 files). Show all

Unified · Split

java/pkg/sun/security/ssl/SSLAlgorithmConstraints.java+469−0
@@ -0,0 +1,469 @@
1/*
2 * Copyright (c) 2010, 2011, Oracle and/or its affiliates. All rights reserved.
3 * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
4 *
5 * This code is free software; you can redistribute it and/or modify it
6 * under the terms of the GNU General Public License version 2 only, as
7 * published by the Free Software Foundation. Oracle designates this
8 * particular file as subject to the "Classpath" exception as provided
9 * by Oracle in the LICENSE file that accompanied this code.
10 *
11 * This code is distributed in the hope that it will be useful, but WITHOUT
12 * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
13 * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
14 * version 2 for more details (a copy is included in the LICENSE file that
15 * accompanied this code).
16 *
17 * You should have received a copy of the GNU General Public License version
18 * 2 along with this work; if not, write to the Free Software Foundation,
19 * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
20 *
21 * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
22 * or visit www.oracle.com if you need additional information or have any
23 * questions.
24 */
25
26package sun.security.ssl;
27
28import java.security.AlgorithmConstraints;
29import java.security.CryptoPrimitive;
30import java.security.AlgorithmParameters;
31
32import javax.net.ssl.*;
33
34import java.security.Key;
35
36import java.util.Set;
37import java.util.HashSet;
38
39import sun.security.util.DisabledAlgorithmConstraints;
40import sun.security.ssl.CipherSuite.*;
41
42/**
43 * Algorithm constraints for disabled algorithms property
44 *
45 * See the "jdk.certpath.disabledAlgorithms" specification in java.security
46 * for the syntax of the disabled algorithm string.
47 */
48final class SSLAlgorithmConstraints implements AlgorithmConstraints {
49 private final static AlgorithmConstraints tlsDisabledAlgConstraints =
50 new TLSDisabledAlgConstraints();
51 private final static AlgorithmConstraints x509DisabledAlgConstraints =
52 new X509DisabledAlgConstraints();
53 private AlgorithmConstraints userAlgConstraints = null;
54 private AlgorithmConstraints peerAlgConstraints = null;
55
56 private boolean enabledX509DisabledAlgConstraints = true;
57
58 SSLAlgorithmConstraints(AlgorithmConstraints algorithmConstraints) {
59 userAlgConstraints = algorithmConstraints;
60 }
61
62 SSLAlgorithmConstraints(SSLSocket socket,
63 boolean withDefaultCertPathConstraints) {
64 if (socket != null) {
65 userAlgConstraints =
66 socket.getSSLParameters().getAlgorithmConstraints();
67 }
68
69 if (!withDefaultCertPathConstraints) {
70 enabledX509DisabledAlgConstraints = false;
71 }
72 }
73
74 SSLAlgorithmConstraints(SSLEngine engine,
75 boolean withDefaultCertPathConstraints) {
76 if (engine != null) {
77 userAlgConstraints =
78 engine.getSSLParameters().getAlgorithmConstraints();
79 }
80
81 if (!withDefaultCertPathConstraints) {
82 enabledX509DisabledAlgConstraints = false;
83 }
84 }
85
86 SSLAlgorithmConstraints(SSLSocket socket, String[] supportedAlgorithms,
87 boolean withDefaultCertPathConstraints) {
88 if (socket != null) {
89 userAlgConstraints =
90 socket.getSSLParameters().getAlgorithmConstraints();
91 peerAlgConstraints =
92 new SupportedSignatureAlgorithmConstraints(supportedAlgorithms);
93 }
94
95 if (!withDefaultCertPathConstraints) {
96 enabledX509DisabledAlgConstraints = false;
97 }
98 }
99
100 SSLAlgorithmConstraints(SSLEngine engine, String[] supportedAlgorithms,
101 boolean withDefaultCertPathConstraints) {
102 if (engine != null) {
103 userAlgConstraints =
104 engine.getSSLParameters().getAlgorithmConstraints();
105 peerAlgConstraints =
106 new SupportedSignatureAlgorithmConstraints(supportedAlgorithms);
107 }
108
109 if (!withDefaultCertPathConstraints) {
110 enabledX509DisabledAlgConstraints = false;
111 }
112 }
113
114 public boolean permits(Set<CryptoPrimitive> primitives,
115 String algorithm, AlgorithmParameters parameters) {
116
117 boolean permitted = true;
118
119 if (peerAlgConstraints != null) {
120 permitted = peerAlgConstraints.permits(
121 primitives, algorithm, parameters);
122 }
123
124 if (permitted && userAlgConstraints != null) {
125 permitted = userAlgConstraints.permits(
126 primitives, algorithm, parameters);
127 }
128
129 if (permitted) {
130 permitted = tlsDisabledAlgConstraints.permits(
131 primitives, algorithm, parameters);
132 }
133
134 if (permitted && enabledX509DisabledAlgConstraints) {
135 permitted = x509DisabledAlgConstraints.permits(
136 primitives, algorithm, parameters);
137 }
138
139 return permitted;
140 }
141
142 public boolean permits(Set<CryptoPrimitive> primitives, Key key) {
143
144 boolean permitted = true;
145
146 if (peerAlgConstraints != null) {
147 permitted = peerAlgConstraints.permits(primitives, key);
148 }
149
150 if (permitted && userAlgConstraints != null) {
151 permitted = userAlgConstraints.permits(primitives, key);
152 }
153
154 if (permitted) {
155 permitted = tlsDisabledAlgConstraints.permits(primitives, key);
156 }
157
158 if (permitted && enabledX509DisabledAlgConstraints) {
159 permitted = x509DisabledAlgConstraints.permits(primitives, key);
160 }
161
162 return permitted;
163 }
164
165 public boolean permits(Set<CryptoPrimitive> primitives,
166 String algorithm, Key key, AlgorithmParameters parameters) {
167
168 boolean permitted = true;
169
170 if (peerAlgConstraints != null) {
171 permitted = peerAlgConstraints.permits(
172 primitives, algorithm, key, parameters);
173 }
174
175 if (permitted && userAlgConstraints != null) {
176 permitted = userAlgConstraints.permits(
177 primitives, algorithm, key, parameters);
178 }
179
180 if (permitted) {
181 permitted = tlsDisabledAlgConstraints.permits(
182 primitives, algorithm, key, parameters);
183 }
184
185 if (permitted && enabledX509DisabledAlgConstraints) {
186 permitted = x509DisabledAlgConstraints.permits(
187 primitives, algorithm, key, parameters);
188 }
189
190 return permitted;
191 }
192
193
194 static private class SupportedSignatureAlgorithmConstraints
195 implements AlgorithmConstraints {
196 // supported signature algorithms
197 private String[] supportedAlgorithms;
198
199 SupportedSignatureAlgorithmConstraints(String[] supportedAlgorithms) {
200 if (supportedAlgorithms != null) {
201 this.supportedAlgorithms = supportedAlgorithms.clone();
202 } else {
203 this.supportedAlgorithms = null;
204 }
205 }
206
207 public boolean permits(Set<CryptoPrimitive> primitives,
208 String algorithm, AlgorithmParameters parameters) {
209
210 if (algorithm == null || algorithm.length() == 0) {
211 throw new IllegalArgumentException(
212 "No algorithm name specified");
213 }
214
215 if (primitives == null || primitives.isEmpty()) {
216 throw new IllegalArgumentException(
217 "No cryptographic primitive specified");
218 }
219
220 if (supportedAlgorithms == null ||
221 supportedAlgorithms.length == 0) {
222 return false;
223 }
224
225 // trim the MGF part: <digest>with<encryption>and<mgf>
226 int position = algorithm.indexOf("and");
227 if (position > 0) {
228 algorithm = algorithm.substring(0, position);
229 }
230
231 for (String supportedAlgorithm : supportedAlgorithms) {
232 if (algorithm.equalsIgnoreCase(supportedAlgorithm)) {
233 return true;
234 }
235 }
236
237 return false;
238 }
239
240 final public boolean permits(Set<CryptoPrimitive> primitives, Key key) {
241 return true;
242 }
243
244 final public boolean permits(Set<CryptoPrimitive> primitives,
245 String algorithm, Key key, AlgorithmParameters parameters) {
246
247 if (algorithm == null || algorithm.length() == 0) {
248 throw new IllegalArgumentException(
249 "No algorithm name specified");
250 }
251
252 return permits(primitives, algorithm, parameters);
253 }
254 }
255
256 static private class BasicDisabledAlgConstraints
257 extends DisabledAlgorithmConstraints {
258 BasicDisabledAlgConstraints(String propertyName) {
259 super(propertyName);
260 }
261
262 protected Set<String> decomposes(KeyExchange keyExchange,
263 boolean forCertPathOnly) {
264 Set<String> components = new HashSet<>();
265 switch (keyExchange) {
266 case K_NULL:
267 if (!forCertPathOnly) {
268 components.add("NULL");
269 }
270 break;
271 case K_RSA:
272 components.add("RSA");
273 break;
274 case K_RSA_EXPORT:
275 components.add("RSA");
276 components.add("RSA_EXPORT");
277 break;
278 case K_DH_RSA:
279 components.add("RSA");
280 components.add("DH");
281 components.add("DiffieHellman");
282 components.add("DH_RSA");
283 break;
284 case K_DH_DSS:
285 components.add("DSA");
286 components.add("DSS");
287 components.add("DH");
288 components.add("DiffieHellman");
289 components.add("DH_DSS");
290 break;
291 case K_DHE_DSS:
292 components.add("DSA");
293 components.add("DSS");
294 components.add("DH");
295 components.add("DHE");
296 components.add("DiffieHellman");
297 components.add("DHE_DSS");
298 break;
299 case K_DHE_RSA:
300 components.add("RSA");
301 components.add("DH");
302 components.add("DHE");
303 components.add("DiffieHellman");
304 components.add("DHE_RSA");
305 break;
306 case K_DH_ANON:
307 if (!forCertPathOnly) {
308 components.add("ANON");
309 components.add("DH");
310 components.add("DiffieHellman");
311 components.add("DH_ANON");
312 }
313 break;
314 case K_ECDH_ECDSA:
315 components.add("ECDH");
316 components.add("ECDSA");
317 components.add("ECDH_ECDSA");
318 break;
319 case K_ECDH_RSA:
320 components.add("ECDH");
321 components.add("RSA");
322 components.add("ECDH_RSA");
323 break;
324 case K_ECDHE_ECDSA:
325 components.add("ECDHE");
326 components.add("ECDSA");
327 components.add("ECDHE_ECDSA");
328 break;
329 case K_ECDHE_RSA:
330 components.add("ECDHE");
331 components.add("RSA");
332 components.add("ECDHE_RSA");
333 break;
334 case K_ECDH_ANON:
335 if (!forCertPathOnly) {
336 components.add("ECDH");
337 components.add("ANON");
338 components.add("ECDH_ANON");
339 }
340 break;
341 case K_KRB5:
342 if (!forCertPathOnly) {
343 components.add("KRB5");
344 }
345 break;
346 case K_KRB5_EXPORT:
347 if (!forCertPathOnly) {
348 components.add("KRB5_EXPORT");
349 }
350 break;
351 default:
352 // ignore
353 }
354
355 return components;
356 }
357
358 protected Set<String> decomposes(BulkCipher bulkCipher) {
359 Set<String> components = new HashSet<>();
360
361 if (bulkCipher.transformation != null) {
362 components.addAll(super.decomposes(bulkCipher.transformation));
363 }
364
365 return components;
366 }
367
368 protected Set<String> decomposes(MacAlg macAlg) {
369 Set<String> components = new HashSet<>();
370
371 if (macAlg == CipherSuite.M_MD5) {
372 components.add("MD5");
373 components.add("HmacMD5");
374 } else if (macAlg == CipherSuite.M_SHA) {
375 components.add("SHA1");
376 components.add("SHA-1");
377 components.add("HmacSHA1");
378 } else if (macAlg == CipherSuite.M_SHA256) {
379 components.add("SHA256");
380 components.add("SHA-256");
381 components.add("HmacSHA256");
382 } else if (macAlg == CipherSuite.M_SHA384) {
383 components.add("SHA384");
384 components.add("SHA-384");
385 components.add("HmacSHA384");
386 }
387
388 return components;
389 }
390 }
391
392 static private class TLSDisabledAlgConstraints
393 extends BasicDisabledAlgConstraints {
394
395 TLSDisabledAlgConstraints() {
396 super(DisabledAlgorithmConstraints.PROPERTY_TLS_DISABLED_ALGS);
397 }
398
399 @Override
400 protected Set<String> decomposes(String algorithm) {
401 if (algorithm.startsWith("SSL_") || algorithm.startsWith("TLS_")) {
402 CipherSuite cipherSuite = null;
403 try {
404 cipherSuite = CipherSuite.valueOf(algorithm);
405 } catch (IllegalArgumentException iae) {
406 // ignore: unknown or unsupported ciphersuite
407 }
408
409 if (cipherSuite != null) {
410 Set<String> components = new HashSet<>();
411
412 if(cipherSuite.keyExchange != null) {
413 components.addAll(
414 decomposes(cipherSuite.keyExchange, false));
415 }
416
417 if (cipherSuite.cipher != null) {
418 components.addAll(decomposes(cipherSuite.cipher));
419 }
420
421 if (cipherSuite.macAlg != null) {
422 components.addAll(decomposes(cipherSuite.macAlg));
423 }
424
425 return components;
426 }
427 }
428
429 return super.decomposes(algorithm);
430 }
431 }
432
433 static private class X509DisabledAlgConstraints
434 extends BasicDisabledAlgConstraints {
435
436 X509DisabledAlgConstraints() {
437 super(DisabledAlgorithmConstraints.PROPERTY_CERTPATH_DISABLED_ALGS);
438 }
439
440 @Override
441 protected Set<String> decomposes(String algorithm) {
442 if (algorithm.startsWith("SSL_") || algorithm.startsWith("TLS_")) {
443 CipherSuite cipherSuite = null;
444 try {
445 cipherSuite = CipherSuite.valueOf(algorithm);
446 } catch (IllegalArgumentException iae) {
447 // ignore: unknown or unsupported ciphersuite
448 }
449
450 if (cipherSuite != null) {
451 Set<String> components = new HashSet<>();
452
453 if(cipherSuite.keyExchange != null) {
454 components.addAll(
455 decomposes(cipherSuite.keyExchange, true));
456 }
457
458 // Certification path algorithm constraints do not apply
459 // to cipherSuite.cipher and cipherSuite.macAlg.
460
461 return components;
462 }
463 }
464
465 return super.decomposes(algorithm);
466 }
467 }
468}
469