/*
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* under the terms of the GNU General Public License version 2 only, as
* published by the Free Software Foundation. Oracle designates this
* particular file as subject to the "Classpath" exception as provided
* by Oracle in the LICENSE file that accompanied this code.
*
* This code is distributed in the hope that it will be useful, but WITHOUT
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* version 2 for more details (a copy is included in the LICENSE file that
* accompanied this code).
*
* You should have received a copy of the GNU General Public License version
* 2 along with this work; if not, write to the Free Software Foundation,
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
*
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
* or visit www.oracle.com if you need additional information or have any
* questions.
*/
/**
* Class to obtain CRLs via the CRLDistributionPoints extension.
* Note that the functionality of this class must be explicitly enabled
* via a system property, see the USE_CRLDP variable below.
*
* This class uses the URICertStore class to fetch CRLs. The URICertStore
* class also implements CRL caching: see the class description for more
* information.
*
* @author Andreas Sterbenz
* @author Sean Mullan
* @since 1.4.2
*/
public class DistributionPointFetcher {
private static final boolean[] ALL_REASONS =
{true, true, true, true, true, true, true, true, true};
/**
* Flag indicating whether support for the CRL distribution point
* extension shall be enabled. Currently disabled by default for
* compatibility and legal reasons.
*/
(new GetBooleanAction("com.sun.security.enableCRLDP"));
/**
* Private instantiation only.
*/
private DistributionPointFetcher() {}
/**
* Return the X509CRLs matching this selector. The selector must be
* an X509CRLSelector with certificateChecking set.
*
* If CRLDP support is disabled, this method always returns an
* empty set.
*/
boolean signFlag,
boolean[] reasonsMask,
throws CertStoreException
{
if (USE_CRLDP == false) {
return Collections.emptySet();
}
return Collections.emptySet();
}
try {
}
}
return Collections.emptySet();
}
}
}
return results;
} catch (CertificateException e) {
return Collections.emptySet();
} catch (IOException e) {
return Collections.emptySet();
}
}
/**
* Download CRLs from the given distribution point, verify and return them.
* See the top of the class for current limitations.
*/
// check for full name
// check for relative name
if (relativeName == null) {
return Collections.emptySet();
}
try {
if (crlIssuers == null) {
} else {
// should only be one CRL Issuer
return Collections.emptySet();
} else {
}
}
} catch (IOException ioe) {
return Collections.emptySet();
}
}
certStores));
}
}
}
try {
// make sure issuer is not set
// we check the issuer in verifyCRLs method
certStores, validity)) {
}
} catch (Exception e) {
// don't add the CRL
e.printStackTrace();
}
}
}
return crls;
}
/**
* Download CRL from given URI.
*/
}
try {
return null;
} else {
}
} catch (Exception e) {
e.printStackTrace();
}
}
return null;
}
/**
* Fetch CRLs from certStores.
*/
{
}
try {
}
} catch (CertStoreException cse) {
// don't add the CRL
"CRLs: " + cse);
}
}
}
return crls;
}
/**
* Verifies a CRL for the given certificate's Distribution Point to
* ensure it is appropriate for checking the revocation status.
*
* @param certImpl the certificate whose revocation status is being checked
* @param point one of the distribution points of the certificate
* @param crl the CRL
* @param reasonsMask the interim reasons mask
* @param signFlag true if prevKey can be used to verify the CRL
* @param prevKey the public key that verifies the certificate's signature
* @param provider the Signature provider to use
* @param trustAnchors a {@code Set} of {@code TrustAnchor}s
* @param certStores a {@code List} of {@code CertStore}s to be used in
* finding certificates and CRLs
* @param validity the time for which the validity of the CRL issuer's
* certification path should be determined
* @return true if ok, false if not
*/
boolean indirectCRL = false;
// if crlIssuer is set, verify that it matches the issuer of the
// CRL and the CRL contains an IDP extension with the indirectCRL
// boolean asserted. Otherwise, verify that the CRL issuer matches the
// certificate issuer.
if (pointCrlIssuers != null) {
return false;
}
boolean match = false;
match = true;
}
}
if (match == false) {
return false;
}
// we accept the case that a CRL issuer provide status
// information for itself.
// reset the public key used to verify the CRL's signature
} else {
indirectCRL = true;
}
}
return false;
} else {
// in case of self-issued indirect CRL issuer.
// cannot recognize indirect CRL without AKID
// we accept the case that a CRL issuer provide status
// information for itself.
// reset the public key used to verify the CRL's signature
}
// we accept the case that a CRL issuer provide status
// information for itself.
// reset the public key used to verify the CRL's signature
} else {
indirectCRL = true;
}
}
}
if (!indirectCRL && !signFlag) {
// cert's key cannot be used to verify the CRL
return false;
}
if (relativeName == null) {
}
return false;
}
}
}
// if the DP name is present in the IDP CRL extension and the
// DP field is present in the DP, then verify that one of the
// names in the IDP matches one of the names in the DP
if (pointNames == null) {
if (relativeName == null) {
}
return false;
}
}
if (indirectCRL) {
// RFC 3280: there must be only 1 CRL issuer
// name when relativeName is present
"issuer when relative name present");
}
return false;
}
} else {
}
}
boolean match = false;
}
}
}
}
if (!match) {
}
return false;
}
// if the DP name is present in the IDP CRL extension and the
// DP field is absent from the DP, then verify that one of the
// names in the IDP matches one of the names in the crlIssuer
// field of the DP
} else {
// verify that one of the names in the IDP matches one of
// the names in the cRLIssuer of the cert's DP
boolean match = false;
}
}
if (!match) {
return false;
}
}
}
// if the onlyContainsUserCerts boolean is asserted, verify that the
// cert is not a CA cert
}
return false;
}
// if the onlyContainsCACerts boolean is asserted, verify that the
// cert is a CA cert
b = (Boolean)
}
return false;
}
// verify that the onlyContainsAttributeCerts boolean is not
// asserted
}
return false;
}
}
// compute interim reasons mask
boolean[] interimReasonsMask = new boolean[9];
reasons = (ReasonFlags)
}
if (pointReasonFlags != null) {
// set interim reasons mask to the intersection of
// reasons in the DP and onlySomeReasons in the IDP
if (idpReasonFlags[i] && pointReasonFlags[i]) {
interimReasonsMask[i] = true;
}
}
} else {
// set interim reasons mask to the value of
// onlySomeReasons in the IDP (and clone it since we may
// modify it)
}
if (pointReasonFlags != null) {
// set interim reasons mask to the value of DP reasons
} else {
// set interim reasons mask to the special value all-reasons
interimReasonsMask = new boolean[9];
}
}
// verify that interim reasons mask includes one or more reasons
// not included in the reasons mask
boolean oneOrMore = false;
if (!reasonsMask[i] && interimReasonsMask[i]) {
oneOrMore = true;
}
}
if (!oneOrMore) {
return false;
}
// Obtain and validate the certification path for the complete
// CRL issuer (if indirect CRL). If a key usage extension is present
// in the CRL issuer's certificate, verify that the cRLSign bit is set.
if (indirectCRL) {
boolean[] crlSign = {false,false,false,false,false,false,true};
// Currently by default, forward builder does not enable
// certificate, instead, it only compares the CRL issuer and
// the target certificate subject. If the certificate of the
// delegated CRL issuer is a self-issued certificate, the
// builder is unable to find the proper CRL issuer by issuer
// name only, there is a potential dead loop on finding the
// proper issuer. It is of great help to narrow the target
// scope down to aware of authority key identifiers in the
// selector, for the purposes of breaking the dead loop.
}
}
// the subject criterion will be set by builder automatically.
}
// by far, we have validated the previous certificate, we can
// trust it during validating the CRL issuer.
// Except the performance improvement, another benefit is to break
// the dead loop while looking for the issuer back and forth
// between the delegated self-issued certificate and its issuer.
// Add the previous certificate as a trust anchor.
}
try {
} catch (InvalidAlgorithmParameterException iape) {
throw new CRLException(iape);
}
try {
} catch (Exception e) {
throw new CRLException(e);
}
}
// check the crl signature algorithm
try {
} catch (CertPathValidatorException cpve) {
}
return false;
}
// validate the signature on the CRL
try {
} catch (Exception e) {
}
return false;
}
// reject CRL if any unresolved critical extensions remain in the CRL.
// remove any that we have processed
if (unresCritExts != null) {
if (!unresCritExts.isEmpty()) {
+ unresCritExts);
while (i.hasNext())
}
return false;
}
}
// update reasonsMask
if (!reasonsMask[i] && interimReasonsMask[i]) {
reasonsMask[i] = true;
}
}
return true;
}
/**
* Append relative name to the issuer name and return a new
* GeneralNames object.
*/
throws IOException {
return fullNames;
}
/** Verifies whether a CRL is issued by a certain certificate
*
* @param cert the certificate
* @param crl the CRL to be verified
* @param provider the name of the signature provider
*/
boolean matched = false;
new AdaptableX509CertSelector();
// check certificate's key usage
}
// check certificate's subject
/*
* Facilitate certification path construction with authority
* key identifier and subject key identifier.
*
* In practice, conforming CAs MUST use the key identifier method,
* and MUST include authority key identifier extension in all CRLs
* issued. [section 5.2.1, RFC 2459]
*/
}
// if AKID is unreliable, verify the CRL signature with the cert
try {
matched = true;
} catch (Exception e) {
matched = false;
}
}
return matched;
}
}