/*
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* under the terms of the GNU General Public License version 2 only, as
* published by the Free Software Foundation. Oracle designates this
* particular file as subject to the "Classpath" exception as provided
* by Oracle in the LICENSE file that accompanied this code.
*
* This code is distributed in the hope that it will be useful, but WITHOUT
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* version 2 for more details (a copy is included in the LICENSE file that
* accompanied this code).
*
* You should have received a copy of the GNU General Public License version
* 2 along with this work; if not, write to the Free Software Foundation,
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
*
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
* or visit www.oracle.com if you need additional information or have any
* questions.
*/
/**
* A simple validator implementation. It is based on code from the JSSE
* X509TrustManagerImpl. This implementation is designed for compatibility with
* deployed certificates and previous J2SE versions. It will never support
* more advanced features and will be deemphasized in favor of the PKIX
* validator going forward.
* <p>
* {@code SimpleValidator} objects are immutable once they have been created.
* Please DO NOT add methods that can change the state of an instance once
* it has been created.
*
* @author Andreas Sterbenz
*/
// Constants for the OIDs we need
/**
* The trusted certificates as:
* Map (X500Principal)subject of trusted cert -> List of X509Certificate
* The list is used because there may be multiple certificates
* with an identical subject DN.
*/
/**
* Set of the trusted certificates. Present only for
* getTrustedCertificates().
*/
super(TYPE_SIMPLE, variant);
this.trustedCerts = trustedCerts;
// this actually should be a set, but duplicate entries
// are not a problem and we can avoid the Set overhead
}
}
}
return trustedCerts;
}
/**
* Perform simple validation of chain. The arguments otherCerts and
* parameter are ignored.
*/
throw new CertificateException
("null or zero-length certificate chain");
}
// make sure chain includes a trusted cert
}
// create distrusted certificates checker
// create default algorithm constraints checker
// create application level algorithm constraints checker
if (constraints != null) {
}
// verify top down, starting at the certificate issued by
// the trust anchor
// check untrusted certificate
try {
// Untrusted checker does not care about the unresolved
// critical extensions.
} catch (CertPathValidatorException cpve) {
throw new ValidatorException(
}
// check certificate algorithm
try {
// Algorithm checker does not care about the unresolved
// critical extensions.
if (appAlgChecker != null) {
}
} catch (CertPathValidatorException cpve) {
throw new ValidatorException
}
// no validity check for code signing certs
}
// check name chaining
issuerCert.getSubjectX500Principal()) == false) {
throw new ValidatorException
}
// check signature
try {
} catch (GeneralSecurityException e) {
throw new ValidatorException
}
// check extensions for CA certs
if (i != 0) {
}
}
return chain;
}
throws CertificateException {
}
// Check the basic constraints extension
int pathLenConstraint =
// Check the key usage and extended key usage extensions
// check Netscape certificate type extension
throw new ValidatorException
("Certificate contains unknown critical extensions: " + critSet,
}
return pathLenConstraint;
}
// nothing
throw new ValidatorException
("Invalid Netscape CertType extension for SSL CA "
+ "certificate",
}
throw new ValidatorException
("Invalid Netscape CertType extension for code "
+ "signing CA certificate",
}
} else {
}
}
/**
* Get the value of the specified bit in the Netscape certificate type
* extension. If the extension is not present at all, we return true.
*/
try {
if (cert instanceof X509CertImpl) {
return true;
}
} else {
return true;
}
.toByteArray();
}
return val.booleanValue();
} catch (IOException e) {
return false;
}
}
// reject, if extension missing or not a CA (constraints == -1)
if (constraints < 0) {
throw new ValidatorException("End user tried to act as a CA",
}
// if the certificate is self-issued, ignore the pathLenConstraint
// checking.
if (maxPathLen <= 0) {
throw new ValidatorException("Violated path length constraints",
}
maxPathLen--;
}
if (maxPathLen > constraints) {
}
return maxPathLen;
}
/*
* Verify the key usage and extended key usage for intermediate
* certificates.
*/
throws CertificateException {
// EKU irrelevant in CA certificates
// check key usage extension
if (keyUsageInfo != null) {
// keyUsageInfo[5] is for keyCertSign.
throw new ValidatorException
("Wrong key usage: expected keyCertSign",
}
}
}
/**
* Build a trusted certificate chain. This method always returns a chain
* with a trust anchor as the final cert in the chain. If no trust anchor
* could be found, a CertificateException is thrown.
*/
throws CertificateException {
// scan chain starting at EE cert
// if a trusted certificate is found, append it and return
if (trustedCert != null) {
c.add(trustedCert);
}
}
// check if we can append a trusted cert
c.add(trustedCert);
}
// no trusted cert found, error
}
/**
* Return a trusted certificate that matches the input certificate,
* or null if no such certificate can be found. This method also handles
* cases where a CA re-issues a trust anchor with the same public key and
* same subject and issuer names but a new validity period, etc.
*/
return null;
}
return cert;
}
continue;
}
continue;
}
// All tests pass, this must be the one to use...
return mycert;
}
return null;
}
}