/*
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* under the terms of the GNU General Public License version 2 only, as
* published by the Free Software Foundation. Oracle designates this
* particular file as subject to the "Classpath" exception as provided
* by Oracle in the LICENSE file that accompanied this code.
*
* This code is distributed in the hope that it will be useful, but WITHOUT
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* version 2 for more details (a copy is included in the LICENSE file that
* accompanied this code).
*
* You should have received a copy of the GNU General Public License version
* 2 along with this work; if not, write to the Free Software Foundation,
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
*
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
* or visit www.oracle.com if you need additional information or have any
* questions.
*/
/**
*
* <p>This class extends the concept of a codebase to
* encapsulate not only the location (URL) but also the certificate chains
* that were used to verify signed code originating from that location.
*
* @author Li Gong
* @author Roland Schemers
*/
/**
* The code location.
*
* @serial
*/
/*
* The code signers.
*/
/*
* The code signers. Certificate chains are concatenated.
*/
// cached SocketPermission used for matchLocation
// for generating cert paths
/**
* Constructs a CodeSource and associates it with the specified
* location and set of certificates.
*
* @param url the location (URL).
*
* @param certs the certificate(s). It may be null. The contents of the
* array are copied to protect against subsequent modification.
*/
// Copy the supplied certs
}
}
/**
* Constructs a CodeSource and associates it with the specified
* location and set of code signers.
*
* @param url the location (URL).
* @param signers the code signers. It may be null. The contents of the
* array are copied to protect against subsequent modification.
*
* @since 1.5
*/
// Copy the supplied signers
}
}
/**
* Returns the hash code value for this object.
*
* @return a hash code value for this object.
*/
public int hashCode() {
else
return 0;
}
/**
* Tests for equality between the specified object and this
* object. Two CodeSource objects are considered equal if their
* locations are of identical value and if their signer certificate
* chains are of identical value. It is not required that
* the certificate chains be in the same order.
*
* @param obj the object to test for equality with this object.
*
* @return true if the objects are considered equal, false otherwise.
*/
if (obj == this)
return true;
// objects types must be equal
if (!(obj instanceof CodeSource))
return false;
// URLs must match
// if location is null, then cs.location must be null as well
} else {
// if location is not null, then it must equal cs.location
}
// certs must match
return matchCerts(cs, true);
}
/**
* Returns the location associated with this CodeSource.
*
* @return the location (URL).
*/
/* since URL is practically immutable, returning itself is not
a security problem */
return this.location;
}
/**
* Returns the certificates associated with this CodeSource.
* <p>
* If this CodeSource object was created using the
* {@link #CodeSource(URL url, CodeSigner[] signers)}
* constructor then its certificate chains are extracted and used to
* create an array of Certificate objects. Each signer certificate is
* followed by its supporting certificate chain (which may be empty).
* Each signer certificate and its supporting certificate chain is ordered
* bottom-to-top (i.e., with the signer certificate first and the (root)
* certificate authority last).
*
* @return A copy of the certificates array, or null if there is none.
*/
// Convert the code signers to certs
new ArrayList<>();
}
} else {
return null;
}
}
/**
* Returns the code signers associated with this CodeSource.
* <p>
* If this CodeSource object was created using the
* {@link #CodeSource(URL url, Certificate[] certs)}
* constructor then its certificate chains are extracted and used to
* create an array of CodeSigner objects. Note that only X.509 certificates
* are examined - all other certificate types are ignored.
*
* @return A copy of the code signer array, or null if there is none.
*
* @since 1.5
*/
// Convert the certs to code signers
} else {
return null;
}
}
/**
* Returns true if this CodeSource object "implies" the specified CodeSource.
* <P>
* More specifically, this method makes the following checks, in order.
* If any fail, it returns false. If they all succeed, it returns true.<p>
* <ol>
* <li> <i>codesource</i> must not be null.
* <li> If this object's certificates are not null, then all
* of this object's certificates must be present in <i>codesource</i>'s
* certificates.
* <li> If this object's location (getLocation()) is not null, then the
* following checks are made against this object's location and
* <i>codesource</i>'s:<p>
* <ol>
* <li> <i>codesource</i>'s location must not be null.
*
* <li> If this object's location
* equals <i>codesource</i>'s location, then return true.
*
* <li> This object's protocol (getLocation().getProtocol()) must be
* equal to <i>codesource</i>'s protocol.
*
* <li> If this object's host (getLocation().getHost()) is not null,
* then the SocketPermission
* constructed with this object's host must imply the
* SocketPermission constructed with <i>codesource</i>'s host.
*
* <li> If this object's port (getLocation().getPort()) is not
* equal to -1 (that is, if a port is specified), it must equal
* <i>codesource</i>'s port.
*
* <li> If this object's file (getLocation().getFile()) doesn't equal
* <i>codesource</i>'s file, then the following checks are made:
* If this object's file ends with "/-",
* then <i>codesource</i>'s file must start with this object's
* file (exclusive the trailing "-").
* If this object's file ends with a "/*",
* then <i>codesource</i>'s file must start with this object's
* file and must not have any further "/" separators.
* If this object's file doesn't end with a "/",
* then <i>codesource</i>'s file must match this object's
* file with a '/' appended.
*
* <li> If this object's reference (getLocation().getRef()) is
* not null, it must equal <i>codesource</i>'s reference.
*
* </ol>
* </ol>
* <p>
* For example, the codesource objects with the following locations
* and null certificates all imply
* the codesource with the location "http://java.sun.com/classes/foo.jar"
* and null certificates:
* <pre>
* http:
* </pre>
*
* Note that if this CodeSource has a null location and a null
* certificate chain, then it implies every other CodeSource.
*
* @param codesource CodeSource to compare against.
*
* @return true if the specified codesource is implied by this codesource,
* false if not.
*/
{
if (codesource == null)
return false;
}
/**
* Returns true if all the certs in this
* CodeSource are also in <i>that</i>.
*
* @param that the CodeSource to check against.
* @param strict If true then a strict equality match is performed.
* Otherwise a subset match is performed.
*/
{
boolean match;
// match any key
if (strict) {
} else {
return true;
}
// both have signers
return false;
}
match = false;
match = true;
break;
}
}
if (!match) return false;
}
return true;
// both have certs
return false;
}
match = false;
match = true;
break;
}
}
if (!match) return false;
}
return true;
}
return false;
}
/**
* Returns true if two CodeSource's have the "same" location.
*
* @param that CodeSource to compare against
*/
{
return true;
return false;
return true;
return false;
return false;
}
// Matches the directory and (recursively) all files
// and subdirectories contained in that directory.
// For example, "/a/b/-" implies anything that starts with
// "/a/b/"
return false;
// Matches the directory and all the files contained in that
// directory.
// For example, "/a/b/*" implies anything that starts with
// "/a/b/" but has no further slashes
if (last == -1)
return false;
return false;
} else {
// Exact matches only.
// For example, "/a/b" and "/a/b/" both imply "/a/b/"
return false;
}
}
return false;
}
// ok
return false;
}
}
}
return false;
}
}
}
// everything matches
return true;
}
/**
* Returns a string describing this CodeSource, telling its
* URL and certificates.
*
* @return information about this CodeSource.
*/
}
}
} else {
}
}
/**
* Writes this object out to a stream (i.e., serializes it).
*
* @serialData An initial <code>URL</code> is followed by an
* <code>int</code> indicating the number of certificates to follow
* (a value of "zero" denotes that there are no certificates associated
* with this object).
* Each certificate is written out starting with a <code>String</code>
* denoting the certificate type, followed by an
* <code>int</code> specifying the length of the certificate encoding,
* followed by the certificate encoding itself which is written out as an
* array of bytes. Finally, if any code signers are present then the array
* of code signers is serialized and written out too.
*/
throws IOException
{
// Serialize the array of certs
} else {
// write out the total number of certs
// write out each cert, including its type
try {
} catch (CertificateEncodingException cee) {
}
}
}
// Serialize the array of code signers (if any)
}
}
/**
* Restores this object from a stream (i.e., deserializes it).
*/
throws IOException, ClassNotFoundException
{
// process any new-style certs in the stream (if present)
if (size > 0) {
// we know of 3 different cert types: X.509, PGP, SDSI, which
// could all be present in the stream at the same time
}
for (int i = 0; i < size; i++) {
// read the certificate type, and instantiate a certificate
// factory of that type (reuse existing factory if possible)
// reuse certificate factory
} else {
// create new certificate factory
try {
} catch (CertificateException ce) {
throw new ClassNotFoundException
}
// store the certificate factory so we can reuse it later
}
// parse the certificate
try {
} catch (OutOfMemoryError oome) {
throw new IOException("Certificate too big");
}
try {
} catch (CertificateException ce) {
}
}
// Deserialize array of code signers (if any)
try {
} catch (IOException ioe) {
// no signers present
}
}
/*
* Convert an array of certificates to an array of code signers.
* The array of certificates is a concatenation of certificate chains
* where the initial certificate in each chain is the end-entity cert.
*
* @return An array of code signers or null if none are generated.
*/
return null;
}
try {
// Initialize certificate factory
}
// Iterate through all the certificates
int i = 0;
new ArrayList<>();
int j = i;
// Extract chain of certificates
// (loop while certs are not end-entity certs)
certs[j] instanceof X509Certificate &&
j++;
}
i = j;
}
return null;
} else {
}
} catch (CertificateException e) {
return null; //TODO - may be better to throw an ex. here
}
}
}