History

My first initial commit with all of mine experimental changes.

Dmitry Kabak (userdima committed 13 years ago

Commit d37b88d1 parent 3f5b46618352 files · +2598093 −-8690Browse files

Showing the changes to java/pkg/sun/security/ssl/SSLContextImpl.java (1 of 18352 files). Show all

Unified · Split

java/pkg/sun/security/ssl/SSLContextImpl.java+1145−0
@@ -0,0 +1,1145 @@
1/*
2 * Copyright (c) 1999, 2011, Oracle and/or its affiliates. All rights reserved.
3 * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
4 *
5 * This code is free software; you can redistribute it and/or modify it
6 * under the terms of the GNU General Public License version 2 only, as
7 * published by the Free Software Foundation. Oracle designates this
8 * particular file as subject to the "Classpath" exception as provided
9 * by Oracle in the LICENSE file that accompanied this code.
10 *
11 * This code is distributed in the hope that it will be useful, but WITHOUT
12 * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
13 * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
14 * version 2 for more details (a copy is included in the LICENSE file that
15 * accompanied this code).
16 *
17 * You should have received a copy of the GNU General Public License version
18 * 2 along with this work; if not, write to the Free Software Foundation,
19 * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
20 *
21 * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
22 * or visit www.oracle.com if you need additional information or have any
23 * questions.
24 */
25
26package sun.security.ssl;
27
28import java.net.Socket;
29
30import java.io.*;
31import java.util.*;
32import java.security.*;
33import java.security.cert.*;
34import java.security.cert.Certificate;
35
36import javax.net.ssl.*;
37
38import sun.security.provider.certpath.AlgorithmChecker;
39
40public abstract class SSLContextImpl extends SSLContextSpi {
41
42 private static final Debug debug = Debug.getInstance("ssl");
43
44 private final EphemeralKeyManager ephemeralKeyManager;
45 private final SSLSessionContextImpl clientCache;
46 private final SSLSessionContextImpl serverCache;
47
48 private boolean isInitialized;
49
50 private X509ExtendedKeyManager keyManager;
51 private X509TrustManager trustManager;
52 private SecureRandom secureRandom;
53
54 // The default algrithm constraints
55 private AlgorithmConstraints defaultAlgorithmConstraints =
56 new SSLAlgorithmConstraints(null);
57
58 // supported and default protocols
59 private ProtocolList defaultServerProtocolList;
60 private ProtocolList defaultClientProtocolList;
61 private ProtocolList supportedProtocolList;
62
63 // supported and default cipher suites
64 private CipherSuiteList defaultServerCipherSuiteList;
65 private CipherSuiteList defaultClientCipherSuiteList;
66 private CipherSuiteList supportedCipherSuiteList;
67
68 SSLContextImpl() {
69 ephemeralKeyManager = new EphemeralKeyManager();
70 clientCache = new SSLSessionContextImpl();
71 serverCache = new SSLSessionContextImpl();
72 }
73
74 protected void engineInit(KeyManager[] km, TrustManager[] tm,
75 SecureRandom sr) throws KeyManagementException {
76 isInitialized = false;
77 keyManager = chooseKeyManager(km);
78
79 if (tm == null) {
80 try {
81 TrustManagerFactory tmf = TrustManagerFactory.getInstance(
82 TrustManagerFactory.getDefaultAlgorithm());
83 tmf.init((KeyStore)null);
84 tm = tmf.getTrustManagers();
85 } catch (Exception e) {
86 // eat
87 }
88 }
89 trustManager = chooseTrustManager(tm);
90
91 if (sr == null) {
92 secureRandom = JsseJce.getSecureRandom();
93 } else {
94 if (SunJSSE.isFIPS() &&
95 (sr.getProvider() != SunJSSE.cryptoProvider)) {
96 throw new KeyManagementException
97 ("FIPS mode: SecureRandom must be from provider "
98 + SunJSSE.cryptoProvider.getName());
99 }
100 secureRandom = sr;
101 }
102
103 /*
104 * The initial delay of seeding the random number generator
105 * could be long enough to cause the initial handshake on our
106 * first connection to timeout and fail. Make sure it is
107 * primed and ready by getting some initial output from it.
108 */
109 if (debug != null && Debug.isOn("sslctx")) {
110 System.out.println("trigger seeding of SecureRandom");
111 }
112 secureRandom.nextInt();
113 if (debug != null && Debug.isOn("sslctx")) {
114 System.out.println("done seeding SecureRandom");
115 }
116 isInitialized = true;
117 }
118
119 private X509TrustManager chooseTrustManager(TrustManager[] tm)
120 throws KeyManagementException {
121 // We only use the first instance of X509TrustManager passed to us.
122 for (int i = 0; tm != null && i < tm.length; i++) {
123 if (tm[i] instanceof X509TrustManager) {
124 if (SunJSSE.isFIPS() &&
125 !(tm[i] instanceof X509TrustManagerImpl)) {
126 throw new KeyManagementException
127 ("FIPS mode: only SunJSSE TrustManagers may be used");
128 }
129
130 if (tm[i] instanceof X509ExtendedTrustManager) {
131 return (X509TrustManager)tm[i];
132 } else {
133 return new AbstractTrustManagerWrapper(
134 (X509TrustManager)tm[i]);
135 }
136 }
137 }
138
139 // nothing found, return a dummy X509TrustManager.
140 return DummyX509TrustManager.INSTANCE;
141 }
142
143 private X509ExtendedKeyManager chooseKeyManager(KeyManager[] kms)
144 throws KeyManagementException {
145 for (int i = 0; kms != null && i < kms.length; i++) {
146 KeyManager km = kms[i];
147 if (km instanceof X509KeyManager == false) {
148 continue;
149 }
150 if (SunJSSE.isFIPS()) {
151 // In FIPS mode, require that one of SunJSSE's own keymanagers
152 // is used. Otherwise, we cannot be sure that only keys from
153 // the FIPS token are used.
154 if ((km instanceof X509KeyManagerImpl)
155 || (km instanceof SunX509KeyManagerImpl)) {
156 return (X509ExtendedKeyManager)km;
157 } else {
158 // throw exception, we don't want to silently use the
159 // dummy keymanager without telling the user.
160 throw new KeyManagementException
161 ("FIPS mode: only SunJSSE KeyManagers may be used");
162 }
163 }
164 if (km instanceof X509ExtendedKeyManager) {
165 return (X509ExtendedKeyManager)km;
166 }
167 if (debug != null && Debug.isOn("sslctx")) {
168 System.out.println(
169 "X509KeyManager passed to " +
170 "SSLContext.init(): need an " +
171 "X509ExtendedKeyManager for SSLEngine use");
172 }
173 return new AbstractKeyManagerWrapper((X509KeyManager)km);
174 }
175
176 // nothing found, return a dummy X509ExtendedKeyManager
177 return DummyX509KeyManager.INSTANCE;
178 }
179
180 protected SSLSocketFactory engineGetSocketFactory() {
181 if (!isInitialized) {
182 throw new IllegalStateException(
183 "SSLContextImpl is not initialized");
184 }
185 return new SSLSocketFactoryImpl(this);
186 }
187
188 protected SSLServerSocketFactory engineGetServerSocketFactory() {
189 if (!isInitialized) {
190 throw new IllegalStateException("SSLContext is not initialized");
191 }
192 return new SSLServerSocketFactoryImpl(this);
193 }
194
195 protected SSLEngine engineCreateSSLEngine() {
196 if (!isInitialized) {
197 throw new IllegalStateException(
198 "SSLContextImpl is not initialized");
199 }
200 return new SSLEngineImpl(this);
201 }
202
203 protected SSLEngine engineCreateSSLEngine(String host, int port) {
204 if (!isInitialized) {
205 throw new IllegalStateException(
206 "SSLContextImpl is not initialized");
207 }
208 return new SSLEngineImpl(this, host, port);
209 }
210
211 protected SSLSessionContext engineGetClientSessionContext() {
212 return clientCache;
213 }
214
215 protected SSLSessionContext engineGetServerSessionContext() {
216 return serverCache;
217 }
218
219 SecureRandom getSecureRandom() {
220 return secureRandom;
221 }
222
223 X509ExtendedKeyManager getX509KeyManager() {
224 return keyManager;
225 }
226
227 X509TrustManager getX509TrustManager() {
228 return trustManager;
229 }
230
231 EphemeralKeyManager getEphemeralKeyManager() {
232 return ephemeralKeyManager;
233 }
234
235 abstract SSLParameters getDefaultServerSSLParams();
236 abstract SSLParameters getDefaultClientSSLParams();
237 abstract SSLParameters getSupportedSSLParams();
238
239 // Get suported ProtoclList.
240 ProtocolList getSuportedProtocolList() {
241 if (supportedProtocolList == null) {
242 supportedProtocolList =
243 new ProtocolList(getSupportedSSLParams().getProtocols());
244 }
245
246 return supportedProtocolList;
247 }
248
249 // Get default ProtoclList.
250 ProtocolList getDefaultProtocolList(boolean roleIsServer) {
251 if (roleIsServer) {
252 if (defaultServerProtocolList == null) {
253 defaultServerProtocolList = new ProtocolList(
254 getDefaultServerSSLParams().getProtocols());
255 }
256
257 return defaultServerProtocolList;
258 } else {
259 if (defaultClientProtocolList == null) {
260 defaultClientProtocolList = new ProtocolList(
261 getDefaultClientSSLParams().getProtocols());
262 }
263
264 return defaultClientProtocolList;
265 }
266 }
267
268 // Get suported CipherSuiteList.
269 CipherSuiteList getSuportedCipherSuiteList() {
270 // Clear cache of available ciphersuites.
271 clearAvailableCache();
272
273 if (supportedCipherSuiteList == null) {
274 supportedCipherSuiteList =
275 getApplicableCipherSuiteList(getSuportedProtocolList(), false);
276 }
277
278 return supportedCipherSuiteList;
279 }
280
281 // Get default CipherSuiteList.
282 CipherSuiteList getDefaultCipherSuiteList(boolean roleIsServer) {
283 // Clear cache of available ciphersuites.
284 clearAvailableCache();
285
286 if (roleIsServer) {
287 if (defaultServerCipherSuiteList == null) {
288 defaultServerCipherSuiteList = getApplicableCipherSuiteList(
289 getDefaultProtocolList(true), true);
290 }
291
292 return defaultServerCipherSuiteList;
293 } else {
294 if (defaultClientCipherSuiteList == null) {
295 defaultClientCipherSuiteList = getApplicableCipherSuiteList(
296 getDefaultProtocolList(false), true);
297 }
298
299 return defaultClientCipherSuiteList;
300 }
301 }
302
303 /**
304 * Return whether a protocol list is the original default enabled
305 * protocols. See: SSLSocket/SSLEngine.setEnabledProtocols()
306 */
307 boolean isDefaultProtocolList(ProtocolList protocols) {
308 return (protocols == defaultServerProtocolList) ||
309 (protocols == defaultClientProtocolList);
310 }
311
312
313 /*
314 * Return the list of all available CipherSuites with a priority of
315 * minPriority or above.
316 */
317 private CipherSuiteList getApplicableCipherSuiteList(
318 ProtocolList protocols, boolean onlyEnabled) {
319
320 int minPriority = CipherSuite.SUPPORTED_SUITES_PRIORITY;
321 if (onlyEnabled) {
322 minPriority = CipherSuite.DEFAULT_SUITES_PRIORITY;
323 }
324
325 Collection<CipherSuite> allowedCipherSuites =
326 CipherSuite.allowedCipherSuites();
327
328 ArrayList<CipherSuite> suites = new ArrayList<>();
329 if (!(protocols.collection().isEmpty()) &&
330 protocols.min.v != ProtocolVersion.NONE.v) {
331 for (CipherSuite suite : allowedCipherSuites) {
332 if (suite.allowed == false || suite.priority < minPriority) {
333 continue;
334 }
335
336 if (suite.isAvailable() &&
337 suite.obsoleted > protocols.min.v &&
338 suite.supported <= protocols.max.v) {
339 if (defaultAlgorithmConstraints.permits(
340 EnumSet.of(CryptoPrimitive.KEY_AGREEMENT),
341 suite.name, null)) {
342 suites.add(suite);
343 }
344 } else if (debug != null &&
345 Debug.isOn("sslctx") && Debug.isOn("verbose")) {
346 if (suite.obsoleted <= protocols.min.v) {
347 System.out.println(
348 "Ignoring obsoleted cipher suite: " + suite);
349 } else if (suite.supported > protocols.max.v) {
350 System.out.println(
351 "Ignoring unsupported cipher suite: " + suite);
352 } else {
353 System.out.println(
354 "Ignoring unavailable cipher suite: " + suite);
355 }
356 }
357 }
358 }
359
360 return new CipherSuiteList(suites);
361 }
362
363 /**
364 * Clear cache of available ciphersuites. If we support all ciphers
365 * internally, there is no need to clear the cache and calling this
366 * method has no effect.
367 */
368 synchronized void clearAvailableCache() {
369 if (CipherSuite.DYNAMIC_AVAILABILITY) {
370 supportedCipherSuiteList = null;
371 defaultServerCipherSuiteList = null;
372 defaultClientCipherSuiteList = null;
373 CipherSuite.BulkCipher.clearAvailableCache();
374 JsseJce.clearEcAvailable();
375 }
376 }
377
378 /*
379 * The SSLContext implementation for TLS/SSL algorithm
380 *
381 * SSL/TLS protocols specify the forward compatibility and version
382 * roll-back attack protections, however, a number of SSL/TLS server
383 * vendors did not implement these aspects properly, and some current
384 * SSL/TLS servers may refuse to talk to a TLS 1.1 or later client.
385 *
386 * Considering above interoperability issues, SunJSSE will not set
387 * TLS 1.1 and TLS 1.2 as the enabled protocols for client by default.
388 *
389 * For SSL/TLS servers, there is no such interoperability issues as
390 * SSL/TLS clients. In SunJSSE, TLS 1.1 or later version will be the
391 * enabled protocols for server by default.
392 *
393 * We may change the behavior when popular TLS/SSL vendors support TLS
394 * forward compatibility properly.
395 *
396 * SSLv2Hello is no longer necessary. This interoperability option was
397 * put in place in the late 90's when SSLv3/TLS1.0 were relatively new
398 * and there were a fair number of SSLv2-only servers deployed. Because
399 * of the security issues in SSLv2, it is rarely (if ever) used, as
400 * deployments should now be using SSLv3 and TLSv1.
401 *
402 * Considering the issues of SSLv2Hello, we should not enable SSLv2Hello
403 * by default. Applications still can use it by enabling SSLv2Hello with
404 * the series of setEnabledProtocols APIs.
405 */
406
407 /*
408 * The conservative SSLContext implementation for TLS, SSL, SSLv3 and
409 * TLS10 algorithm.
410 *
411 * This is a super class of DefaultSSLContext and TLS10Context.
412 *
413 * @see SSLContext
414 */
415 private static class ConservativeSSLContext extends SSLContextImpl {
416 // parameters
417 private static SSLParameters defaultServerSSLParams;
418 private static SSLParameters defaultClientSSLParams;
419 private static SSLParameters supportedSSLParams;
420
421 static {
422 if (SunJSSE.isFIPS()) {
423 supportedSSLParams = new SSLParameters();
424 supportedSSLParams.setProtocols(new String[] {
425 ProtocolVersion.TLS10.name,
426 ProtocolVersion.TLS11.name,
427 ProtocolVersion.TLS12.name
428 });
429
430 defaultServerSSLParams = supportedSSLParams;
431
432 defaultClientSSLParams = new SSLParameters();
433 defaultClientSSLParams.setProtocols(new String[] {
434 ProtocolVersion.TLS10.name
435 });
436
437 } else {
438 supportedSSLParams = new SSLParameters();
439 supportedSSLParams.setProtocols(new String[] {
440 ProtocolVersion.SSL20Hello.name,
441 ProtocolVersion.SSL30.name,
442 ProtocolVersion.TLS10.name,
443 ProtocolVersion.TLS11.name,
444 ProtocolVersion.TLS12.name
445 });
446
447 defaultServerSSLParams = supportedSSLParams;
448
449 defaultClientSSLParams = new SSLParameters();
450 defaultClientSSLParams.setProtocols(new String[] {
451 ProtocolVersion.SSL30.name,
452 ProtocolVersion.TLS10.name
453 });
454 }
455 }
456
457 SSLParameters getDefaultServerSSLParams() {
458 return defaultServerSSLParams;
459 }
460
461 SSLParameters getDefaultClientSSLParams() {
462 return defaultClientSSLParams;
463 }
464
465 SSLParameters getSupportedSSLParams() {
466 return supportedSSLParams;
467 }
468 }
469
470 /*
471 * The SSLContext implementation for default algorithm
472 *
473 * @see SSLContext
474 */
475 public static final class DefaultSSLContext extends ConservativeSSLContext {
476 private static final String NONE = "NONE";
477 private static final String P11KEYSTORE = "PKCS11";
478
479 private static volatile SSLContextImpl defaultImpl;
480
481 private static TrustManager[] defaultTrustManagers;
482 private static KeyManager[] defaultKeyManagers;
483
484 public DefaultSSLContext() throws Exception {
485 try {
486 super.engineInit(getDefaultKeyManager(),
487 getDefaultTrustManager(), null);
488 } catch (Exception e) {
489 if (debug != null && Debug.isOn("defaultctx")) {
490 System.out.println("default context init failed: " + e);
491 }
492 throw e;
493 }
494
495 if (defaultImpl == null) {
496 defaultImpl = this;
497 }
498 }
499
500 protected void engineInit(KeyManager[] km, TrustManager[] tm,
501 SecureRandom sr) throws KeyManagementException {
502 throw new KeyManagementException
503 ("Default SSLContext is initialized automatically");
504 }
505
506 static synchronized SSLContextImpl getDefaultImpl() throws Exception {
507 if (defaultImpl == null) {
508 new DefaultSSLContext();
509 }
510 return defaultImpl;
511 }
512
513 private static synchronized TrustManager[] getDefaultTrustManager()
514 throws Exception {
515 if (defaultTrustManagers != null) {
516 return defaultTrustManagers;
517 }
518
519 KeyStore ks =
520 TrustManagerFactoryImpl.getCacertsKeyStore("defaultctx");
521
522 TrustManagerFactory tmf = TrustManagerFactory.getInstance(
523 TrustManagerFactory.getDefaultAlgorithm());
524 tmf.init(ks);
525 defaultTrustManagers = tmf.getTrustManagers();
526 return defaultTrustManagers;
527 }
528
529 private static synchronized KeyManager[] getDefaultKeyManager()
530 throws Exception {
531 if (defaultKeyManagers != null) {
532 return defaultKeyManagers;
533 }
534
535 final Map<String,String> props = new HashMap<>();
536 AccessController.doPrivileged(
537 new PrivilegedExceptionAction<Object>() {
538 public Object run() throws Exception {
539 props.put("keyStore", System.getProperty(
540 "javax.net.ssl.keyStore", ""));
541 props.put("keyStoreType", System.getProperty(
542 "javax.net.ssl.keyStoreType",
543 KeyStore.getDefaultType()));
544 props.put("keyStoreProvider", System.getProperty(
545 "javax.net.ssl.keyStoreProvider", ""));
546 props.put("keyStorePasswd", System.getProperty(
547 "javax.net.ssl.keyStorePassword", ""));
548 return null;
549 }
550 });
551
552 final String defaultKeyStore = props.get("keyStore");
553 String defaultKeyStoreType = props.get("keyStoreType");
554 String defaultKeyStoreProvider = props.get("keyStoreProvider");
555 if (debug != null && Debug.isOn("defaultctx")) {
556 System.out.println("keyStore is : " + defaultKeyStore);
557 System.out.println("keyStore type is : " +
558 defaultKeyStoreType);
559 System.out.println("keyStore provider is : " +
560 defaultKeyStoreProvider);
561 }
562
563 if (P11KEYSTORE.equals(defaultKeyStoreType) &&
564 !NONE.equals(defaultKeyStore)) {
565 throw new IllegalArgumentException("if keyStoreType is "
566 + P11KEYSTORE + ", then keyStore must be " + NONE);
567 }
568
569 FileInputStream fs = null;
570 if (defaultKeyStore.length() != 0 && !NONE.equals(defaultKeyStore)) {
571 fs = AccessController.doPrivileged(
572 new PrivilegedExceptionAction<FileInputStream>() {
573 public FileInputStream run() throws Exception {
574 return new FileInputStream(defaultKeyStore);
575 }
576 });
577 }
578
579 String defaultKeyStorePassword = props.get("keyStorePasswd");
580 char[] passwd = null;
581 if (defaultKeyStorePassword.length() != 0) {
582 passwd = defaultKeyStorePassword.toCharArray();
583 }
584
585 /**
586 * Try to initialize key store.
587 */
588 KeyStore ks = null;
589 if ((defaultKeyStoreType.length()) != 0) {
590 if (debug != null && Debug.isOn("defaultctx")) {
591 System.out.println("init keystore");
592 }
593 if (defaultKeyStoreProvider.length() == 0) {
594 ks = KeyStore.getInstance(defaultKeyStoreType);
595 } else {
596 ks = KeyStore.getInstance(defaultKeyStoreType,
597 defaultKeyStoreProvider);
598 }
599
600 // if defaultKeyStore is NONE, fs will be null
601 ks.load(fs, passwd);
602 }
603 if (fs != null) {
604 fs.close();
605 fs = null;
606 }
607
608 /*
609 * Try to initialize key manager.
610 */
611 if (debug != null && Debug.isOn("defaultctx")) {
612 System.out.println("init keymanager of type " +
613 KeyManagerFactory.getDefaultAlgorithm());
614 }
615 KeyManagerFactory kmf = KeyManagerFactory.getInstance(
616 KeyManagerFactory.getDefaultAlgorithm());
617
618 if (P11KEYSTORE.equals(defaultKeyStoreType)) {
619 kmf.init(ks, null); // do not pass key passwd if using token
620 } else {
621 kmf.init(ks, passwd);
622 }
623
624 defaultKeyManagers = kmf.getKeyManagers();
625 return defaultKeyManagers;
626 }
627 }
628
629 /*
630 * The SSLContext implementation for TLS, SSL, SSLv3 and TLS10 algorithm
631 *
632 * @see SSLContext
633 */
634 public static final class TLS10Context extends ConservativeSSLContext {
635 // use the default constructor and methods
636 }
637
638 /*
639 * The SSLContext implementation for TLS11 algorithm
640 *
641 * @see SSLContext
642 */
643 public static final class TLS11Context extends SSLContextImpl {
644 // parameters
645 private static SSLParameters defaultServerSSLParams;
646 private static SSLParameters defaultClientSSLParams;
647 private static SSLParameters supportedSSLParams;
648
649 static {
650 if (SunJSSE.isFIPS()) {
651 supportedSSLParams = new SSLParameters();
652 supportedSSLParams.setProtocols(new String[] {
653 ProtocolVersion.TLS10.name,
654 ProtocolVersion.TLS11.name,
655 ProtocolVersion.TLS12.name
656 });
657
658 defaultServerSSLParams = supportedSSLParams;
659
660 defaultClientSSLParams = new SSLParameters();
661 defaultClientSSLParams.setProtocols(new String[] {
662 ProtocolVersion.TLS10.name,
663 ProtocolVersion.TLS11.name
664 });
665
666 } else {
667 supportedSSLParams = new SSLParameters();
668 supportedSSLParams.setProtocols(new String[] {
669 ProtocolVersion.SSL20Hello.name,
670 ProtocolVersion.SSL30.name,
671 ProtocolVersion.TLS10.name,
672 ProtocolVersion.TLS11.name,
673 ProtocolVersion.TLS12.name
674 });
675
676 defaultServerSSLParams = supportedSSLParams;
677
678 defaultClientSSLParams = new SSLParameters();
679 defaultClientSSLParams.setProtocols(new String[] {
680 ProtocolVersion.SSL30.name,
681 ProtocolVersion.TLS10.name,
682 ProtocolVersion.TLS11.name
683 });
684 }
685 }
686
687 SSLParameters getDefaultServerSSLParams() {
688 return defaultServerSSLParams;
689 }
690
691 SSLParameters getDefaultClientSSLParams() {
692 return defaultClientSSLParams;
693 }
694
695 SSLParameters getSupportedSSLParams() {
696 return supportedSSLParams;
697 }
698 }
699
700 /*
701 * The SSLContext implementation for TLS12 algorithm
702 *
703 * @see SSLContext
704 */
705 public static final class TLS12Context extends SSLContextImpl {
706 // parameters
707 private static SSLParameters defaultServerSSLParams;
708 private static SSLParameters defaultClientSSLParams;
709 private static SSLParameters supportedSSLParams;
710
711 static {
712 if (SunJSSE.isFIPS()) {
713 supportedSSLParams = new SSLParameters();
714 supportedSSLParams.setProtocols(new String[] {
715 ProtocolVersion.TLS10.name,
716 ProtocolVersion.TLS11.name,
717 ProtocolVersion.TLS12.name
718 });
719
720 defaultServerSSLParams = supportedSSLParams;
721
722 defaultClientSSLParams = new SSLParameters();
723 defaultClientSSLParams.setProtocols(new String[] {
724 ProtocolVersion.TLS10.name,
725 ProtocolVersion.TLS11.name,
726 ProtocolVersion.TLS12.name
727 });
728
729 } else {
730 supportedSSLParams = new SSLParameters();
731 supportedSSLParams.setProtocols(new String[] {
732 ProtocolVersion.SSL20Hello.name,
733 ProtocolVersion.SSL30.name,
734 ProtocolVersion.TLS10.name,
735 ProtocolVersion.TLS11.name,
736 ProtocolVersion.TLS12.name
737 });
738
739 defaultServerSSLParams = supportedSSLParams;
740
741 defaultClientSSLParams = new SSLParameters();
742 defaultClientSSLParams.setProtocols(new String[] {
743 ProtocolVersion.SSL30.name,
744 ProtocolVersion.TLS10.name,
745 ProtocolVersion.TLS11.name,
746 ProtocolVersion.TLS12.name
747 });
748 }
749 }
750
751 SSLParameters getDefaultServerSSLParams() {
752 return defaultServerSSLParams;
753 }
754
755 SSLParameters getDefaultClientSSLParams() {
756 return defaultClientSSLParams;
757 }
758
759 SSLParameters getSupportedSSLParams() {
760 return supportedSSLParams;
761 }
762 }
763
764}
765
766
767final class AbstractTrustManagerWrapper extends X509ExtendedTrustManager
768 implements X509TrustManager {
769
770 private final X509TrustManager tm;
771
772 AbstractTrustManagerWrapper(X509TrustManager tm) {
773 this.tm = tm;
774 }
775
776 @Override
777 public void checkClientTrusted(X509Certificate[] chain, String authType)
778 throws CertificateException {
779 tm.checkClientTrusted(chain, authType);
780 }
781
782 @Override
783 public void checkServerTrusted(X509Certificate[] chain, String authType)
784 throws CertificateException {
785 tm.checkServerTrusted(chain, authType);
786 }
787
788 @Override
789 public X509Certificate[] getAcceptedIssuers() {
790 return tm.getAcceptedIssuers();
791 }
792
793 @Override
794 public void checkClientTrusted(X509Certificate[] chain, String authType,
795 Socket socket) throws CertificateException {
796 tm.checkClientTrusted(chain, authType);
797 checkAdditionalTrust(chain, authType, socket, true);
798 }
799
800 @Override
801 public void checkServerTrusted(X509Certificate[] chain, String authType,
802 Socket socket) throws CertificateException {
803 tm.checkServerTrusted(chain, authType);
804 checkAdditionalTrust(chain, authType, socket, false);
805 }
806
807 @Override
808 public void checkClientTrusted(X509Certificate[] chain, String authType,
809 SSLEngine engine) throws CertificateException {
810 tm.checkClientTrusted(chain, authType);
811 checkAdditionalTrust(chain, authType, engine, true);
812 }
813
814 @Override
815 public void checkServerTrusted(X509Certificate[] chain, String authType,
816 SSLEngine engine) throws CertificateException {
817 tm.checkServerTrusted(chain, authType);
818 checkAdditionalTrust(chain, authType, engine, false);
819 }
820
821 private void checkAdditionalTrust(X509Certificate[] chain, String authType,
822 Socket socket, boolean isClient) throws CertificateException {
823 if (socket != null && socket.isConnected() &&
824 socket instanceof SSLSocket) {
825
826 SSLSocket sslSocket = (SSLSocket)socket;
827 SSLSession session = sslSocket.getHandshakeSession();
828 if (session == null) {
829 throw new CertificateException("No handshake session");
830 }
831
832 // check endpoint identity
833 String identityAlg = sslSocket.getSSLParameters().
834 getEndpointIdentificationAlgorithm();
835 if (identityAlg != null && identityAlg.length() != 0) {
836 String hostname = session.getPeerHost();
837 X509TrustManagerImpl.checkIdentity(
838 hostname, chain[0], identityAlg);
839 }
840
841 // try the best to check the algorithm constraints
842 ProtocolVersion protocolVersion =
843 ProtocolVersion.valueOf(session.getProtocol());
844 AlgorithmConstraints constraints = null;
845 if (protocolVersion.v >= ProtocolVersion.TLS12.v) {
846 if (session instanceof ExtendedSSLSession) {
847 ExtendedSSLSession extSession =
848 (ExtendedSSLSession)session;
849 String[] peerSupportedSignAlgs =
850 extSession.getLocalSupportedSignatureAlgorithms();
851
852 constraints = new SSLAlgorithmConstraints(
853 sslSocket, peerSupportedSignAlgs, true);
854 } else {
855 constraints =
856 new SSLAlgorithmConstraints(sslSocket, true);
857 }
858 } else {
859 constraints = new SSLAlgorithmConstraints(sslSocket, true);
860 }
861
862 AlgorithmChecker checker = new AlgorithmChecker(constraints);
863 try {
864 checker.init(false);
865
866 // a forward checker, need to check from trust to target
867 for (int i = chain.length - 1; i >= 0; i--) {
868 Certificate cert = chain[i];
869 // We don't care about the unresolved critical extensions.
870 checker.check(cert, Collections.<String>emptySet());
871 }
872 } catch (CertPathValidatorException cpve) {
873 throw new CertificateException(
874 "Certificates does not conform to algorithm constraints");
875 }
876 }
877 }
878
879 private void checkAdditionalTrust(X509Certificate[] chain, String authType,
880 SSLEngine engine, boolean isClient) throws CertificateException {
881 if (engine != null) {
882 SSLSession session = engine.getHandshakeSession();
883 if (session == null) {
884 throw new CertificateException("No handshake session");
885 }
886
887 // check endpoint identity
888 String identityAlg = engine.getSSLParameters().
889 getEndpointIdentificationAlgorithm();
890 if (identityAlg != null && identityAlg.length() != 0) {
891 String hostname = session.getPeerHost();
892 X509TrustManagerImpl.checkIdentity(
893 hostname, chain[0], identityAlg);
894 }
895
896 // try the best to check the algorithm constraints
897 ProtocolVersion protocolVersion =
898 ProtocolVersion.valueOf(session.getProtocol());
899 AlgorithmConstraints constraints = null;
900 if (protocolVersion.v >= ProtocolVersion.TLS12.v) {
901 if (session instanceof ExtendedSSLSession) {
902 ExtendedSSLSession extSession =
903 (ExtendedSSLSession)session;
904 String[] peerSupportedSignAlgs =
905 extSession.getLocalSupportedSignatureAlgorithms();
906
907 constraints = new SSLAlgorithmConstraints(
908 engine, peerSupportedSignAlgs, true);
909 } else {
910 constraints =
911 new SSLAlgorithmConstraints(engine, true);
912 }
913 } else {
914 constraints = new SSLAlgorithmConstraints(engine, true);
915 }
916
917 AlgorithmChecker checker = new AlgorithmChecker(constraints);
918 try {
919 checker.init(false);
920
921 // A forward checker, need to check from trust to target
922 for (int i = chain.length - 1; i >= 0; i--) {
923 Certificate cert = chain[i];
924 // We don't care about the unresolved critical extensions.
925 checker.check(cert, Collections.<String>emptySet());
926 }
927 } catch (CertPathValidatorException cpve) {
928 throw new CertificateException(
929 "Certificates does not conform to algorithm constraints");
930 }
931 }
932 }
933}
934
935// Dummy X509TrustManager implementation, rejects all peer certificates.
936// Used if the application did not specify a proper X509TrustManager.
937final class DummyX509TrustManager extends X509ExtendedTrustManager
938 implements X509TrustManager {
939
940 static final X509TrustManager INSTANCE = new DummyX509TrustManager();
941
942 private DummyX509TrustManager() {
943 // empty
944 }
945
946 /*
947 * Given the partial or complete certificate chain
948 * provided by the peer, build a certificate path
949 * to a trusted root and return if it can be
950 * validated and is trusted for client SSL authentication.
951 * If not, it throws an exception.
952 */
953 @Override
954 public void checkClientTrusted(X509Certificate[] chain, String authType)
955 throws CertificateException {
956 throw new CertificateException(
957 "No X509TrustManager implementation avaiable");
958 }
959
960 /*
961 * Given the partial or complete certificate chain
962 * provided by the peer, build a certificate path
963 * to a trusted root and return if it can be
964 * validated and is trusted for server SSL authentication.
965 * If not, it throws an exception.
966 */
967 @Override
968 public void checkServerTrusted(X509Certificate[] chain, String authType)
969 throws CertificateException {
970 throw new CertificateException(
971 "No X509TrustManager implementation available");
972 }
973
974 /*
975 * Return an array of issuer certificates which are trusted
976 * for authenticating peers.
977 */
978 @Override
979 public X509Certificate[] getAcceptedIssuers() {
980 return new X509Certificate[0];
981 }
982
983 @Override
984 public void checkClientTrusted(X509Certificate[] chain, String authType,
985 Socket socket) throws CertificateException {
986 throw new CertificateException(
987 "No X509TrustManager implementation available");
988 }
989
990 @Override
991 public void checkServerTrusted(X509Certificate[] chain, String authType,
992 Socket socket) throws CertificateException {
993 throw new CertificateException(
994 "No X509TrustManager implementation available");
995 }
996
997 @Override
998 public void checkClientTrusted(X509Certificate[] chain, String authType,
999 SSLEngine engine) throws CertificateException {
1000 throw new CertificateException(
1001 "No X509TrustManager implementation available");
1002 }
1003
1004 @Override
1005 public void checkServerTrusted(X509Certificate[] chain, String authType,
1006 SSLEngine engine) throws CertificateException {
1007 throw new CertificateException(
1008 "No X509TrustManager implementation available");
1009 }
1010}
1011
1012/*
1013 * A wrapper class to turn a X509KeyManager into an X509ExtendedKeyManager
1014 */
1015final class AbstractKeyManagerWrapper extends X509ExtendedKeyManager {
1016
1017 private final X509KeyManager km;
1018
1019 AbstractKeyManagerWrapper(X509KeyManager km) {
1020 this.km = km;
1021 }
1022
1023 public String[] getClientAliases(String keyType, Principal[] issuers) {
1024 return km.getClientAliases(keyType, issuers);
1025 }
1026
1027 public String chooseClientAlias(String[] keyType, Principal[] issuers,
1028 Socket socket) {
1029 return km.chooseClientAlias(keyType, issuers, socket);
1030 }
1031
1032 public String[] getServerAliases(String keyType, Principal[] issuers) {
1033 return km.getServerAliases(keyType, issuers);
1034 }
1035
1036 public String chooseServerAlias(String keyType, Principal[] issuers,
1037 Socket socket) {
1038 return km.chooseServerAlias(keyType, issuers, socket);
1039 }
1040
1041 public X509Certificate[] getCertificateChain(String alias) {
1042 return km.getCertificateChain(alias);
1043 }
1044
1045 public PrivateKey getPrivateKey(String alias) {
1046 return km.getPrivateKey(alias);
1047 }
1048
1049 // Inherit chooseEngineClientAlias() and chooseEngineServerAlias() from
1050 // X509ExtendedKeymanager. It defines them to return null;
1051}
1052
1053
1054// Dummy X509KeyManager implementation, never returns any certificates/keys.
1055// Used if the application did not specify a proper X509TrustManager.
1056final class DummyX509KeyManager extends X509ExtendedKeyManager {
1057
1058 static final X509ExtendedKeyManager INSTANCE = new DummyX509KeyManager();
1059
1060 private DummyX509KeyManager() {
1061 // empty
1062 }
1063
1064 /*
1065 * Get the matching aliases for authenticating the client side of a secure
1066 * socket given the public key type and the list of
1067 * certificate issuer authorities recognized by the peer (if any).
1068 */
1069 public String[] getClientAliases(String keyType, Principal[] issuers) {
1070 return null;
1071 }
1072
1073 /*
1074 * Choose an alias to authenticate the client side of a secure
1075 * socket given the public key type and the list of
1076 * certificate issuer authorities recognized by the peer (if any).
1077 */
1078 public String chooseClientAlias(String[] keyTypes, Principal[] issuers,
1079 Socket socket) {
1080 return null;
1081 }
1082
1083 /*
1084 * Choose an alias to authenticate the client side of an
1085 * engine given the public key type and the list of
1086 * certificate issuer authorities recognized by the peer (if any).
1087 */
1088 public String chooseEngineClientAlias(
1089 String[] keyTypes, Principal[] issuers, SSLEngine engine) {
1090 return null;
1091 }
1092
1093 /*
1094 * Get the matching aliases for authenticating the server side of a secure
1095 * socket given the public key type and the list of
1096 * certificate issuer authorities recognized by the peer (if any).
1097 */
1098 public String[] getServerAliases(String keyType, Principal[] issuers) {
1099 return null;
1100 }
1101
1102 /*
1103 * Choose an alias to authenticate the server side of a secure
1104 * socket given the public key type and the list of
1105 * certificate issuer authorities recognized by the peer (if any).
1106 */
1107 public String chooseServerAlias(String keyType, Principal[] issuers,
1108 Socket socket) {
1109 return null;
1110 }
1111
1112 /*
1113 * Choose an alias to authenticate the server side of an engine
1114 * given the public key type and the list of
1115 * certificate issuer authorities recognized by the peer (if any).
1116 */
1117 public String chooseEngineServerAlias(
1118 String keyType, Principal[] issuers, SSLEngine engine) {
1119 return null;
1120 }
1121
1122 /**
1123 * Returns the certificate chain associated with the given alias.
1124 *
1125 * @param alias the alias name
1126 *
1127 * @return the certificate chain (ordered with the user's certificate first
1128 * and the root certificate authority last)
1129 */
1130 public X509Certificate[] getCertificateChain(String alias) {
1131 return null;
1132 }
1133
1134 /*
1135 * Returns the key associated with the given alias, using the given
1136 * password to recover it.
1137 *
1138 * @param alias the alias name
1139 *
1140 * @return the requested key
1141 */
1142 public PrivateKey getPrivateKey(String alias) {
1143 return null;
1144 }
1145}