/*
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* under the terms of the GNU General Public License version 2 only, as
* published by the Free Software Foundation. Oracle designates this
* particular file as subject to the "Classpath" exception as provided
* by Oracle in the LICENSE file that accompanied this code.
*
* This code is distributed in the hope that it will be useful, but WITHOUT
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* version 2 for more details (a copy is included in the LICENSE file that
* accompanied this code).
*
* You should have received a copy of the GNU General Public License version
* 2 along with this work; if not, write to the Free Software Foundation,
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
*
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
* or visit www.oracle.com if you need additional information or have any
* questions.
*/
/**
* Abstract class representing a builder, which is able to retrieve
* matching certificates and is able to verify a particular certificate.
*
* @since 1.4
* @author Sean Mullan
* @author Yassir Elley
*/
public abstract class Builder {
/**
* Flag indicating whether support for the caIssuers field of the
* Authority Information Access extension shall be enabled. Currently
* disabled by default for compatibility reasons.
*/
(new GetBooleanAction("com.sun.security.enableAIAcaIssuers"));
/**
* Initialize the builder with the input parameters.
*
* @param params the parameter set used to build a certification path
*/
this.buildParams = buildParams;
this.targetSubjectDN = targetSubjectDN;
// Initialize date if not specified
this.targetCertConstraints =
}
/**
* Retrieves certificates from the list of certStores using the buildParams
* and the currentState as a filter
*
* @param currentState the current State
* @param certStores list of CertStores
*/
/**
* Verifies the cert against the currentState, using the certPathList
* generated thus far to help with loop detection
*
* @param cert the certificate to be verified
* @param currentState the current state against which the cert is verified
* @param certPathList the certPathList generated thus far
*/
/**
* Verifies whether the input certificate completes the path.
* When building forward, a trust anchor will complete the path.
* When building reverse, the target certificate will complete the path.
*
* @param cert the certificate to test
* @return a boolean value indicating whether the cert completes the path.
*/
/**
* Adds the certificate to the certPathList
*
* @param cert the certificate to be added
* @param certPathList the certification path list
*/
/**
* Removes final certificate from the certPathList
*
* @param certPathList the certification path list
*/
abstract void removeFinalCertFromPath
/**
* get distance of one GeneralName from another
*
* @param base GeneralName at base of subtree
* @param test GeneralName to be tested against base
* @param incomparable the value to return if the names are
* incomparable
* @return distance of test name from base, where 0
* means exact match, 1 means test is an immediate
* child of base, 2 means test is a grandchild, etc.
* -1 means test is a parent of base, -2 means test
* is a grandparent, etc.
*/
}
"in different subtrees");
}
return incomparable;
return 0;
break;
break;
default: // should never occur
return incomparable;
}
/* names are in same subtree */
}
/**
* get hop distance of one GeneralName from another in links where
* the names need not have an ancestor/descendant relationship.
* For example, the hop distance from ou=D,ou=C,o=B,c=US to
* ou=F,ou=E,ou=C,o=B,c=US is 3: D->C, C->E, E->F. The hop distance
* from ou=C,o=B,c=US to ou=D,ou=C,o=B,c=US is -1: C->D
*
* @param base GeneralName
* @param test GeneralName to be tested against base
* @param incomparable the value to return if the names are
* incomparable
* @return distance of test name from base measured in hops in the
* namespace hierarchy, where 0 means exact match. Result
* is positive if path is some number of up hops followed by
* some number of down hops; result is negative if path is
* some number of down hops.
*/
int incomparable) {
switch (baseRtest) {
}
return incomparable;
/* base and test are in different subtrees */
break;
/* base matches test */
return 0;
/* base is ancestor of test */
/* base is descendant of test */
default: // should never occur
return incomparable;
}
/* names are in different subtrees */
"for this name type");
}
return incomparable;
}
if (commonName == null) {
"namespaces");
}
return incomparable;
} else {
}
}
/**
* Determine how close a given certificate gets you toward
* a given target.
*
* @param constraints Current NameConstraints; if null,
* then caller must verify NameConstraints
* independently, realizing that this certificate
* may not actually lead to the target at all.
* @param cert Candidate certificate for chain
* @param target GeneralNameInterface name of target
* @return distance from this certificate to target:
* <ul>
* <li>-1 means certificate could be CA for target, but
* there are no NameConstraints limiting how close
* <li> 0 means certificate subject or subjectAltName
* matches target
* <li> 1 means certificate is permitted to be CA for
* target.
* <li> 2 means certificate is permitted to be CA for
* parent of target.
* <li>>0 in general, means certificate is permitted
* to be a CA for this distance higher in the naming
* hierarchy than the target, plus 1.
* </ul>
* candidate cert does not have to be an ancestor of the
* target in order to be a CA that can issue a certificate to
* the target. In these cases, the target distance is calculated
* by inspecting the NameConstraints extension in the candidate
* certificate. For example, suppose the target is an X.500 DN with
* a value of "CN=mullan,OU=ireland,O=sun,C=us" and the
* NameConstraints extension in the candidate certificate
* includes a permitted component of "O=sun,C=us", which implies
* that the candidate certificate is allowed to issue certs in
* the "O=sun,C=us" namespace. The target distance is 3
* ((distance of permitted NC from target) + 1).
* The (+1) is added to distinguish the result from the case
* which returns (0).
* @throws IOException if certificate does not get closer
*/
throws IOException {
/* ensure that certificate satisfies existing name constraints */
throw new IOException("certificate does not satisfy existing name "
+ "constraints");
}
try {
} catch (CertificateException e) {
}
/* see if certificate subject matches target */
/* match! */
return 0;
}
if (altNameExt != null) {
/* see if any alternative name matches target */
return 0;
}
}
}
}
/* no exact match; see if certificate can get us to target */
/* first, get NameConstraints out of certificate */
return -1;
}
/* merge certificate's NameConstraints with current NameConstraints */
if (constraints != null) {
} else {
// Make sure we do a clone here, because we're probably
// going to modify this object later and we don't want to
// be sharing it with a Certificate object!
}
}
/* reduce permitted by excluded */
}
+ permitted);
}
/* see if new merged constraints allow target */
throw new IOException("New certificate not allowed to sign "
+ "certificate for target");
}
/* find distance to target, if any, in permitted */
/* certificate is unconstrained; could sign for anything */
return -1;
}
if (distance >= 0) {
return (distance + 1);
}
}
/* no matching type in permitted; cert holder could certify target */
return -1;
}
/**
* This method can be used as an optimization to filter out
* certificates that do not have policies which are valid.
* It returns the set of policies (String OIDs) that should exist in
* the certificate policies extension of the certificate that is
* needed by the builder. The logic applied is as follows:
* <p>
* 1) If some initial policies have been set *and* policy mappings are
* inhibited, then acceptable certificates are those that include
* the ANY_POLICY OID or with policies that intersect with the
* initial policies.
* 2) If no initial policies have been set *or* policy mappings are
* not inhibited then we don't have much to work with. All we know is
* that a certificate must have *some* policy because if it didn't
* have any policy then the policy tree would become null (and validation
* would fail).
*
* @return the Set of policies any of which must exist in a
* cert's certificate policies extension in order for a cert to be selected.
*/
if (matchingPolicies != null) {
if ((!initialPolicies.isEmpty()) &&
{
} else {
// we just return an empty set to make sure that there is
// at least a certificate policies extension in the cert
}
}
return matchingPolicies;
}
/**
* Search the specified CertStores and add all certificates matching
* selector to resultCerts. Self-signed certs are not useful here
* and therefore ignored.
*
* If the targetCert criterion of the selector is set, only that cert
* is examined and the CertStores are not searched.
*
* If checkAll is true, all CertStores are searched for matching certs.
* If false, the method returns as soon as the first CertStore returns
* a matching cert(s).
*
* Returns true iff resultCerts changed (a cert was added to the collection)
*/
if (targetCert != null) {
// no need to search CertStores
}
}
return false;
}
boolean add = false;
try {
if (!X509CertImpl.isSelfSigned
add = true;
}
}
}
return true;
}
} catch (CertStoreException cse) {
// if getCertificates throws a CertStoreException, we ignore
// it and move on to the next CertStore
"exception retrieving certs: " + cse);
}
}
}
return add;
}
/**
* Returns true if CertStore is local. Currently, returns true if
* type is Collection or if it has been initialized with
* CollectionCertStoreParameters. A new API method should be added
* to CertStore that returns local or remote.
*/
certStore.getCertStoreParameters() instanceof
}
}