0N/A/*
2362N/A * Copyright (c) 2000, 2008, Oracle and/or its affiliates. All rights reserved.
0N/A * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
0N/A *
0N/A * This code is free software; you can redistribute it and/or modify it
0N/A * under the terms of the GNU General Public License version 2 only, as
2362N/A * published by the Free Software Foundation. Oracle designates this
0N/A * particular file as subject to the "Classpath" exception as provided
2362N/A * by Oracle in the LICENSE file that accompanied this code.
0N/A *
0N/A * This code is distributed in the hope that it will be useful, but WITHOUT
0N/A * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
0N/A * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
0N/A * version 2 for more details (a copy is included in the LICENSE file that
0N/A * accompanied this code).
0N/A *
0N/A * You should have received a copy of the GNU General Public License version
0N/A * 2 along with this work; if not, write to the Free Software Foundation,
0N/A * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
0N/A *
2362N/A * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
2362N/A * or visit www.oracle.com if you need additional information or have any
2362N/A * questions.
0N/A */
0N/A
0N/Apackage sun.security.provider.certpath;
0N/A
0N/Aimport java.util.*;
0N/Aimport java.security.cert.*;
585N/Aimport java.security.cert.PKIXReason;
0N/A
0N/Aimport sun.security.util.Debug;
0N/Aimport sun.security.x509.PKIXExtensions;
0N/A
0N/A/**
0N/A * KeyChecker is a <code>PKIXCertPathChecker</code> that checks that the
0N/A * keyCertSign bit is set in the keyUsage extension in an intermediate CA
0N/A * certificate. It also checks whether the final certificate in a
0N/A * certification path meets the specified target constraints specified as
0N/A * a CertSelector in the PKIXParameters passed to the CertPathValidator.
0N/A *
0N/A * @since 1.4
0N/A * @author Yassir Elley
0N/A */
0N/Aclass KeyChecker extends PKIXCertPathChecker {
0N/A
0N/A private static final Debug debug = Debug.getInstance("certpath");
0N/A // the index of keyCertSign in the boolean KeyUsage array
0N/A private static final int keyCertSign = 5;
0N/A private final int certPathLen;
0N/A private CertSelector targetConstraints;
0N/A private int remainingCerts;
0N/A
389N/A private Set<String> supportedExts;
0N/A
0N/A /**
0N/A * Default Constructor
0N/A *
0N/A * @param certPathLen allowable cert path length
0N/A * @param targetCertSel a CertSelector object specifying the constraints
0N/A * on the target certificate
0N/A */
0N/A KeyChecker(int certPathLen, CertSelector targetCertSel)
0N/A throws CertPathValidatorException
0N/A {
0N/A this.certPathLen = certPathLen;
0N/A this.targetConstraints = targetCertSel;
0N/A init(false);
0N/A }
0N/A
0N/A /**
0N/A * Initializes the internal state of the checker from parameters
0N/A * specified in the constructor
0N/A */
0N/A public void init(boolean forward) throws CertPathValidatorException {
0N/A if (!forward) {
0N/A remainingCerts = certPathLen;
0N/A } else {
585N/A throw new CertPathValidatorException
585N/A ("forward checking not supported");
0N/A }
0N/A }
0N/A
585N/A public final boolean isForwardCheckingSupported() {
0N/A return false;
0N/A }
0N/A
0N/A public Set<String> getSupportedExtensions() {
0N/A if (supportedExts == null) {
0N/A supportedExts = new HashSet<String>();
0N/A supportedExts.add(PKIXExtensions.KeyUsage_Id.toString());
0N/A supportedExts.add(PKIXExtensions.ExtendedKeyUsage_Id.toString());
0N/A supportedExts.add(PKIXExtensions.SubjectAlternativeName_Id.toString());
0N/A supportedExts = Collections.unmodifiableSet(supportedExts);
0N/A }
0N/A return supportedExts;
0N/A }
0N/A
0N/A /**
0N/A * Checks that keyUsage and target constraints are satisfied by
0N/A * the specified certificate.
0N/A *
0N/A * @param cert the Certificate
0N/A * @param unresolvedCritExts the unresolved critical extensions
0N/A * @exception CertPathValidatorException Exception thrown if certificate
0N/A * does not verify
0N/A */
0N/A public void check(Certificate cert, Collection<String> unresCritExts)
0N/A throws CertPathValidatorException
0N/A {
0N/A X509Certificate currCert = (X509Certificate) cert;
0N/A
0N/A remainingCerts--;
0N/A
0N/A // if final certificate, check that target constraints are satisfied
0N/A if (remainingCerts == 0) {
0N/A if ((targetConstraints != null) &&
0N/A (targetConstraints.match(currCert) == false)) {
0N/A throw new CertPathValidatorException("target certificate " +
0N/A "constraints check failed");
0N/A }
0N/A } else {
0N/A // otherwise, verify that keyCertSign bit is set in CA certificate
0N/A verifyCAKeyUsage(currCert);
0N/A }
0N/A
0N/A // remove the extensions that we have checked
0N/A if (unresCritExts != null && !unresCritExts.isEmpty()) {
0N/A unresCritExts.remove(PKIXExtensions.KeyUsage_Id.toString());
0N/A unresCritExts.remove(PKIXExtensions.ExtendedKeyUsage_Id.toString());
0N/A unresCritExts.remove(
0N/A PKIXExtensions.SubjectAlternativeName_Id.toString());
0N/A }
0N/A }
0N/A
0N/A /**
0N/A * Static method to verify that the key usage and extended key usage
0N/A * extension in a CA cert. The key usage extension, if present, must
0N/A * assert the keyCertSign bit. The extended key usage extension, if
0N/A * present, must include anyExtendedKeyUsage.
0N/A */
0N/A static void verifyCAKeyUsage(X509Certificate cert)
0N/A throws CertPathValidatorException {
0N/A String msg = "CA key usage";
0N/A if (debug != null) {
0N/A debug.println("KeyChecker.verifyCAKeyUsage() ---checking " + msg
0N/A + "...");
0N/A }
0N/A
0N/A boolean[] keyUsageBits = cert.getKeyUsage();
0N/A
0N/A // getKeyUsage returns null if the KeyUsage extension is not present
0N/A // in the certificate - in which case there is nothing to check
0N/A if (keyUsageBits == null) {
0N/A return;
0N/A }
0N/A
0N/A // throw an exception if the keyCertSign bit is not set
0N/A if (!keyUsageBits[keyCertSign]) {
585N/A throw new CertPathValidatorException
585N/A (msg + " check failed: keyCertSign bit is not set", null,
585N/A null, -1, PKIXReason.INVALID_KEY_USAGE);
0N/A }
0N/A
0N/A if (debug != null) {
0N/A debug.println("KeyChecker.verifyCAKeyUsage() " + msg
0N/A + " verified.");
0N/A }
0N/A }
0N/A}