/*
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* under the terms of the GNU General Public License version 2 only, as
* published by the Free Software Foundation. Oracle designates this
* particular file as subject to the "Classpath" exception as provided
* by Oracle in the LICENSE file that accompanied this code.
*
* This code is distributed in the hope that it will be useful, but WITHOUT
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* version 2 for more details (a copy is included in the LICENSE file that
* accompanied this code).
*
* You should have received a copy of the GNU General Public License version
* 2 along with this work; if not, write to the Free Software Foundation,
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
*
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
* or visit www.oracle.com if you need additional information or have any
* questions.
*/
/**
* Validator implementation built on the PKIX CertPath API. This
* implementation will be emphasized going forward.<p>
* <p>
* Note that the validate() implementation tries to use a PKIX validator
* if that appears possible and a PKIX builder otherwise. This increases
* performance and currently also leads to better exception messages
* in case of failures.
* <p>
* {@code PKIXValidator} objects are immutable once they have been created.
* Please DO NOT add methods that can change the state of an instance once
* it has been created.
*
* @author Andreas Sterbenz
*/
/**
* Flag indicating whether to enable revocation check for the PKIX trust
* manager. Typically, this will only work if the PKIX implementation
* supports CRL distribution points as we do not manually setup CertStores.
*/
private final static boolean checkTLSRevocation =
(new GetBooleanAction("com.sun.net.ssl.checkRevocation"));
// enable use of the validator if possible
private final static boolean TRY_VALIDATOR = true;
// needed only for the validator
private final boolean plugin;
if (trustedCerts instanceof Set) {
} else {
}
}
try {
} catch (InvalidAlgorithmParameterException e) {
}
// initCommon();
if (TRY_VALIDATOR) {
if (TRY_VALIDATOR == false) {
return;
}
} else {
}
}
try {
} catch (CertificateException e) {
throw new RuntimeException("Internal error", e);
}
} else {
plugin = false;
}
}
}
}
// initCommon();
if (TRY_VALIDATOR) {
if (TRY_VALIDATOR == false) {
return;
}
} else {
}
}
try {
} catch (CertificateException e) {
throw new RuntimeException("Internal error", e);
}
} else {
plugin = false;
}
}
return trustedCerts;
}
/**
* Returns the length of the last certification path that is validated by
* CertPathValidator. This is intended primarily as a callback mechanism
* for PKIXCertPathCheckers to determine the length of the certification
* path that is being validated. It is necessary since engineValidate()
* may modify the length of the path.
*
* @return the length of the last certification path passed to
* CertPathValidator.validate, or -1 if it has not been invoked yet
*/
return certPathLength;
}
/**
* Set J2SE global default PKIX parameters. Currently, hardcoded to disable
* revocation checking. In the future, this should be configurable.
*/
} else {
}
}
/**
* Return the PKIX parameters used by this instance. An application may
* modify the parameters but must make sure not to perform any concurrent
* validations.
*/
return parameterTemplate;
}
throw new CertificateException
("null or zero-length certificate chain");
}
// add new algorithm constraints checker
if (constraints != null) {
}
if (TRY_VALIDATOR) {
// check that chain is in correct order and check if chain contains
// trust anchor
if (i != 0 &&
// chain is not ordered correctly, call builder instead
}
// Check if chain[i] is already trusted. It may be inside
// trustedCerts, or has the same dn and public key as a cert
// inside trustedCerts. The latter happens when a CA has
// updated its cert with a stronger signature algorithm in JRE
// but the weak one is still in circulation.
cert.getPublicKey()))) {
if (i == 0) {
}
// Remove and call validator on partial chain [0 .. i-1]
}
}
// apparently issued by trust anchor?
}
if (plugin) {
// Validate chain even if no trust anchor is found. This
// otherwise valid
// temporarily set last cert as sole trust anchor
try {
} catch (InvalidAlgorithmParameterException iape) {
// should never occur, but ...
throw new CertificateException(iape);
}
}
// if the rest of the chain is valid, throw exception
// indicating no trust anchor was found
throw new ValidatorException
}
// otherwise, fall back to builder
}
}
if (plugin) {
try {
return true;
continue;
}
}
return false;
}
return true; // only check if PLUGIN is set
}
throws CertificateException {
if (trustedCert == null) {
throw new ValidatorException
("TrustAnchor must be specified as certificate");
}
return chain;
}
/**
* Set the check date (for debugging).
*/
}
}
try {
// do the validation
} catch (GeneralSecurityException e) {
throw new ValidatorException
("PKIX path validation failed: " + e.toString(), e);
}
}
try {
// setup target constraints
// setup CertStores
new ArrayList<X509Certificate>();
if (otherCerts != null) {
}
// do the build
} catch (GeneralSecurityException e) {
throw new ValidatorException
("PKIX path building failed: " + e.toString(), e);
}
}
}