History

My first initial commit with all of mine experimental changes.

Dmitry Kabak (userdima committed 13 years ago

Commit d37b88d1 parent 3f5b46618352 files · +2598093 −-8690Browse files

Showing the changes to java/pkg/sun/security/provider/certpath/PKIXMasterCertPathValidator.java (1 of 18352 files). Show all

Unified · Split

java/pkg/sun/security/provider/certpath/PKIXMasterCertPathValidator.java+225−0
@@ -0,0 +1,225 @@
1+/*
2+ * Copyright (c) 2000, 2009, Oracle and/or its affiliates. All rights reserved.
3+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
4+ *
5+ * This code is free software; you can redistribute it and/or modify it
6+ * under the terms of the GNU General Public License version 2 only, as
7+ * published by the Free Software Foundation. Oracle designates this
8+ * particular file as subject to the "Classpath" exception as provided
9+ * by Oracle in the LICENSE file that accompanied this code.
10+ *
11+ * This code is distributed in the hope that it will be useful, but WITHOUT
12+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
13+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
14+ * version 2 for more details (a copy is included in the LICENSE file that
15+ * accompanied this code).
16+ *
17+ * You should have received a copy of the GNU General Public License version
18+ * 2 along with this work; if not, write to the Free Software Foundation,
19+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
20+ *
21+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
22+ * or visit www.oracle.com if you need additional information or have any
23+ * questions.
24+ */
25+
26+package sun.security.provider.certpath;
27+
28+import sun.security.util.Debug;
29+
30+import java.util.Collections;
31+import java.util.List;
32+import java.util.Set;
33+import java.security.cert.CertificateRevokedException;
34+import java.security.cert.CertPath;
35+import java.security.cert.CertPathValidatorException;
36+import java.security.cert.CertPathValidatorException.BasicReason;
37+import java.security.cert.PKIXCertPathChecker;
38+import java.security.cert.PKIXReason;
39+import java.security.cert.X509Certificate;
40+
41+/**
42+ * This class is initialized with a list of <code>PKIXCertPathChecker</code>s
43+ * and is used to verify the certificates in a <code>CertPath</code> by
44+ * feeding each certificate to each <code>PKIXCertPathChecker</code>.
45+ *
46+ * @since 1.4
47+ * @author Yassir Elley
48+ */
49+class PKIXMasterCertPathValidator {
50+
51+ private static final Debug debug = Debug.getInstance("certpath");
52+ private List<PKIXCertPathChecker> certPathCheckers;
53+
54+ /**
55+ * Initializes the list of PKIXCertPathCheckers whose checks
56+ * will be performed on each certificate in the certpath.
57+ *
58+ * @param certPathCheckers a List of checkers to use
59+ */
60+ PKIXMasterCertPathValidator(List<PKIXCertPathChecker> certPathCheckers) {
61+ this.certPathCheckers = certPathCheckers;
62+ }
63+
64+ /**
65+ * Validates a certification path consisting exclusively of
66+ * <code>X509Certificate</code>s using the
67+ * <code>PKIXCertPathChecker</code>s specified
68+ * in the constructor. It is assumed that the
69+ * <code>PKIXCertPathChecker</code>s
70+ * have been initialized with any input parameters they may need.
71+ *
72+ * @param cpOriginal the original X509 CertPath passed in by the user
73+ * @param reversedCertList the reversed X509 CertPath (as a List)
74+ * @exception CertPathValidatorException Exception thrown if cert
75+ * path does not validate.
76+ */
77+ void validate(CertPath cpOriginal, List<X509Certificate> reversedCertList)
78+ throws CertPathValidatorException
79+ {
80+ // we actually process reversedCertList, but we keep cpOriginal because
81+ // we need to return the original certPath when we throw an exception.
82+ // we will also need to modify the index appropriately when we
83+ // throw an exception.
84+
85+ int cpSize = reversedCertList.size();
86+
87+ if (debug != null) {
88+ debug.println("--------------------------------------------------"
89+ + "------------");
90+ debug.println("Executing PKIX certification path validation "
91+ + "algorithm.");
92+ }
93+
94+ for (int i = 0; i < cpSize; i++) {
95+
96+ /* The basic loop algorithm is that we get the
97+ * current certificate, we verify the current certificate using
98+ * information from the previous certificate and from the state,
99+ * and we modify the state for the next loop by setting the
100+ * current certificate of this loop to be the previous certificate
101+ * of the next loop. The state is initialized during first loop.
102+ */
103+ if (debug != null)
104+ debug.println("Checking cert" + (i+1) + " ...");
105+
106+ X509Certificate currCert = reversedCertList.get(i);
107+ Set<String> unresolvedCritExts =
108+ currCert.getCriticalExtensionOIDs();
109+ if (unresolvedCritExts == null) {
110+ unresolvedCritExts = Collections.<String>emptySet();
111+ }
112+
113+ if (debug != null && !unresolvedCritExts.isEmpty()) {
114+ debug.println("Set of critical extensions:");
115+ for (String oid : unresolvedCritExts) {
116+ debug.println(oid);
117+ }
118+ }
119+
120+ CertPathValidatorException ocspCause = null;
121+ for (int j = 0; j < certPathCheckers.size(); j++) {
122+
123+ PKIXCertPathChecker currChecker = certPathCheckers.get(j);
124+ if (debug != null) {
125+ debug.println("-Using checker" + (j + 1) + " ... [" +
126+ currChecker.getClass().getName() + "]");
127+ }
128+
129+ if (i == 0)
130+ currChecker.init(false);
131+
132+ try {
133+ currChecker.check(currCert, unresolvedCritExts);
134+
135+ // OCSP has validated the cert so skip the CRL check
136+ if (isRevocationCheck(currChecker, j, certPathCheckers)) {
137+ if (debug != null) {
138+ debug.println("-checker" + (j + 1) +
139+ " validation succeeded");
140+ }
141+ j++;
142+ continue; // skip
143+ }
144+
145+ } catch (CertPathValidatorException cpve) {
146+ // Throw the saved OCSP exception unless the CRL
147+ // checker has determined that the cert is revoked
148+ if (ocspCause != null &&
149+ currChecker instanceof CrlRevocationChecker) {
150+ if (cpve.getReason() == BasicReason.REVOKED) {
151+ throw cpve;
152+ } else {
153+ throw ocspCause;
154+ }
155+ }
156+ /*
157+ * Handle failover from OCSP to CRLs
158+ */
159+ CertPathValidatorException currentCause =
160+ new CertPathValidatorException(cpve.getMessage(),
161+ cpve.getCause(), cpOriginal, cpSize - (i + 1),
162+ cpve.getReason());
163+
164+ // Check if OCSP has confirmed that the cert was revoked
165+ if (cpve.getReason() == BasicReason.REVOKED) {
166+ throw currentCause;
167+ }
168+ // Check if it is appropriate to failover
169+ if (! isRevocationCheck(currChecker, j, certPathCheckers)) {
170+ // no failover
171+ throw currentCause;
172+ }
173+ // Save the current exception
174+ // (in case the CRL check also fails)
175+ ocspCause = currentCause;
176+
177+ // Otherwise, failover to CRLs
178+ if (debug != null) {
179+ debug.println(cpve.getMessage());
180+ debug.println(
181+ "preparing to failover (from OCSP to CRLs)");
182+ }
183+ }
184+
185+ if (debug != null)
186+ debug.println("-checker" + (j+1) + " validation succeeded");
187+ }
188+
189+ if (debug != null)
190+ debug.println("checking for unresolvedCritExts");
191+ if (!unresolvedCritExts.isEmpty()) {
192+ throw new CertPathValidatorException("unrecognized " +
193+ "critical extension(s)", null, cpOriginal, cpSize-(i+1),
194+ PKIXReason.UNRECOGNIZED_CRIT_EXT);
195+ }
196+
197+ if (debug != null)
198+ debug.println("\ncert" + (i+1) + " validation succeeded.\n");
199+ }
200+
201+ if (debug != null) {
202+ debug.println("Cert path validation succeeded. (PKIX validation "
203+ + "algorithm)");
204+ debug.println("-------------------------------------------------"
205+ + "-------------");
206+ }
207+ }
208+
209+ /*
210+ * Examines the list of PKIX cert path checkers to determine whether
211+ * both the current checker and the next checker are revocation checkers.
212+ * OCSPChecker and CrlRevocationChecker are both revocation checkers.
213+ */
214+ private static boolean isRevocationCheck(PKIXCertPathChecker checker,
215+ int index, List<PKIXCertPathChecker> checkers) {
216+
217+ if (checker instanceof OCSPChecker && index + 1 < checkers.size()) {
218+ PKIXCertPathChecker nextChecker = checkers.get(index + 1);
219+ if (nextChecker instanceof CrlRevocationChecker) {
220+ return true;
221+ }
222+ }
223+ return false;
224+ }
225+}