| /* |
| * Copyright (c) 2003, 2012, Oracle and/or its affiliates. All rights reserved. |
| * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. |
| * |
| * This code is free software; you can redistribute it and/or modify it |
| * under the terms of the GNU General Public License version 2 only, as |
| * published by the Free Software Foundation. Oracle designates this |
| * particular file as subject to the "Classpath" exception as provided |
| * by Oracle in the LICENSE file that accompanied this code. |
| * |
| * This code is distributed in the hope that it will be useful, but WITHOUT |
| * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or |
| * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License |
| * version 2 for more details (a copy is included in the LICENSE file that |
| * accompanied this code). |
| * |
| * You should have received a copy of the GNU General Public License version |
| * 2 along with this work; if not, write to the Free Software Foundation, |
| * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA. |
| * |
| * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA |
| * or visit www.oracle.com if you need additional information or have any |
| * questions. |
| */ |
| |
| package sun.security.provider.certpath; |
| |
| import java.io.IOException; |
| import java.math.BigInteger; |
| import java.util.*; |
| import java.security.AccessController; |
| import java.security.PrivilegedAction; |
| import java.security.Security; |
| import java.security.cert.Certificate; |
| import java.security.cert.CertificateException; |
| import java.security.cert.CertificateRevokedException; |
| import java.security.cert.CertPath; |
| import java.security.cert.CertPathValidatorException; |
| import java.security.cert.CertPathValidatorException.BasicReason; |
| import java.security.cert.CertStore; |
| import java.security.cert.CertStoreException; |
| import java.security.cert.PKIXCertPathChecker; |
| import java.security.cert.PKIXParameters; |
| import java.security.cert.TrustAnchor; |
| import java.security.cert.X509Certificate; |
| import java.security.cert.X509CertSelector; |
| import java.net.URI; |
| import java.net.URISyntaxException; |
| import javax.security.auth.x500.X500Principal; |
| |
| import static sun.security.provider.certpath.OCSP.*; |
| import sun.security.util.Debug; |
| import sun.security.x509.*; |
| |
| /** |
| * OCSPChecker is a <code>PKIXCertPathChecker</code> that uses the |
| * Online Certificate Status Protocol (OCSP) as specified in RFC 2560 |
| * <a href="http://www.ietf.org/rfc/rfc2560.txt"> |
| * http://www.ietf.org/rfc/rfc2560.txt</a>. |
| * |
| * @author Ram Marti |
| */ |
| class OCSPChecker extends PKIXCertPathChecker { |
| |
| static final String OCSP_ENABLE_PROP = "ocsp.enable"; |
| static final String OCSP_URL_PROP = "ocsp.responderURL"; |
| static final String OCSP_CERT_SUBJECT_PROP = |
| "ocsp.responderCertSubjectName"; |
| static final String OCSP_CERT_ISSUER_PROP = "ocsp.responderCertIssuerName"; |
| static final String OCSP_CERT_NUMBER_PROP = |
| "ocsp.responderCertSerialNumber"; |
| |
| private static final String HEX_DIGITS = "0123456789ABCDEFabcdef"; |
| private static final Debug DEBUG = Debug.getInstance("certpath"); |
| private static final boolean dump = false; |
| |
| private int remainingCerts; |
| |
| private X509Certificate[] certs; |
| |
| private CertPath cp; |
| |
| private PKIXParameters pkixParams; |
| |
| private boolean onlyEECert = false; |
| |
| /** |
| * Default Constructor |
| * |
| * @param certPath the X509 certification path |
| * @param pkixParams the input PKIX parameter set |
| * @throws CertPathValidatorException if OCSPChecker can not be created |
| */ |
| OCSPChecker(CertPath certPath, PKIXParameters pkixParams) |
| throws CertPathValidatorException { |
| this(certPath, pkixParams, false); |
| } |
| |
| OCSPChecker(CertPath certPath, PKIXParameters pkixParams, boolean onlyEECert) |
| throws CertPathValidatorException { |
| |
| this.cp = certPath; |
| this.pkixParams = pkixParams; |
| this.onlyEECert = onlyEECert; |
| List<? extends Certificate> tmp = cp.getCertificates(); |
| certs = tmp.toArray(new X509Certificate[tmp.size()]); |
| init(false); |
| } |
| |
| /** |
| * Initializes the internal state of the checker from parameters |
| * specified in the constructor |
| */ |
| @Override |
| public void init(boolean forward) throws CertPathValidatorException { |
| if (!forward) { |
| remainingCerts = certs.length + 1; |
| } else { |
| throw new CertPathValidatorException( |
| "Forward checking not supported"); |
| } |
| } |
| |
| @Override public boolean isForwardCheckingSupported() { |
| return false; |
| } |
| |
| @Override public Set<String> getSupportedExtensions() { |
| return Collections.<String>emptySet(); |
| } |
| |
| /** |
| * Sends an OCSPRequest for the certificate to the OCSP Server and |
| * processes the response back from the OCSP Server. |
| * |
| * @param cert the Certificate |
| * @param unresolvedCritExts the unresolved critical extensions |
| * @exception CertPathValidatorException Exception is thrown if the |
| * certificate has been revoked. |
| */ |
| @Override |
| public void check(Certificate cert, Collection<String> unresolvedCritExts) |
| throws CertPathValidatorException { |
| |
| // Decrement the certificate counter |
| remainingCerts--; |
| |
| X509CertImpl currCertImpl = null; |
| try { |
| currCertImpl = X509CertImpl.toImpl((X509Certificate)cert); |
| } catch (CertificateException ce) { |
| throw new CertPathValidatorException(ce); |
| } |
| |
| if (onlyEECert && currCertImpl.getBasicConstraints() != -1) { |
| if (DEBUG != null) { |
| DEBUG.println("Skipping revocation check, not end entity cert"); |
| } |
| return; |
| } |
| |
| /* |
| * OCSP security property values, in the following order: |
| * 1. ocsp.responderURL |
| * 2. ocsp.responderCertSubjectName |
| * 3. ocsp.responderCertIssuerName |
| * 4. ocsp.responderCertSerialNumber |
| */ |
| // should cache these properties to avoid calling every time? |
| String[] properties = getOCSPProperties(); |
| |
| // Check whether OCSP is feasible before seeking cert information |
| URI uri = getOCSPServerURI(currCertImpl, properties[0]); |
| |
| // When responder's subject name is set then the issuer/serial |
| // properties are ignored |
| X500Principal responderSubjectName = null; |
| X500Principal responderIssuerName = null; |
| BigInteger responderSerialNumber = null; |
| if (properties[1] != null) { |
| responderSubjectName = new X500Principal(properties[1]); |
| } else if (properties[2] != null && properties[3] != null) { |
| responderIssuerName = new X500Principal(properties[2]); |
| // remove colon or space separators |
| String value = stripOutSeparators(properties[3]); |
| responderSerialNumber = new BigInteger(value, 16); |
| } else if (properties[2] != null || properties[3] != null) { |
| throw new CertPathValidatorException( |
| "Must specify both ocsp.responderCertIssuerName and " + |
| "ocsp.responderCertSerialNumber properties"); |
| } |
| |
| // If the OCSP responder cert properties are set then the |
| // identified cert must be located in the trust anchors or |
| // in the cert stores. |
| boolean seekResponderCert = false; |
| if (responderSubjectName != null || responderIssuerName != null) { |
| seekResponderCert = true; |
| } |
| |
| // Set the issuer certificate to the next cert in the chain |
| // (unless we're processing the final cert). |
| X509Certificate issuerCert = null; |
| boolean seekIssuerCert = true; |
| List<X509Certificate> responderCerts = new ArrayList<X509Certificate>(); |
| |
| if (remainingCerts < certs.length) { |
| issuerCert = certs[remainingCerts]; |
| seekIssuerCert = false; // done |
| |
| // By default, the OCSP responder's cert is the same as the |
| // issuer of the cert being validated. |
| if (!seekResponderCert) { |
| responderCerts.add(issuerCert); |
| if (DEBUG != null) { |
| DEBUG.println("Responder's certificate is the same " + |
| "as the issuer of the certificate being validated"); |
| } |
| } |
| } |
| |
| // Check anchor certs for: |
| // - the issuer cert (of the cert being validated) |
| // - the OCSP responder's cert |
| if (seekIssuerCert || seekResponderCert) { |
| |
| if (DEBUG != null && seekResponderCert) { |
| DEBUG.println("Searching trust anchors for issuer or " + |
| "responder certificate"); |
| } |
| |
| // Extract the anchor certs |
| Iterator<TrustAnchor> anchors |
| = pkixParams.getTrustAnchors().iterator(); |
| if (!anchors.hasNext()) { |
| throw new CertPathValidatorException( |
| "Must specify at least one trust anchor"); |
| } |
| |
| X500Principal certIssuerName = |
| currCertImpl.getIssuerX500Principal(); |
| byte[] certIssuerKeyId = null; |
| |
| while (anchors.hasNext() && (seekIssuerCert || seekResponderCert)) { |
| |
| TrustAnchor anchor = anchors.next(); |
| X509Certificate anchorCert = anchor.getTrustedCert(); |
| X500Principal anchorSubjectName = |
| anchorCert.getSubjectX500Principal(); |
| |
| if (dump) { |
| System.out.println("Issuer DN is " + certIssuerName); |
| System.out.println("Subject DN is " + anchorSubjectName); |
| } |
| |
| // Check if anchor cert is the issuer cert |
| if (seekIssuerCert && |
| certIssuerName.equals(anchorSubjectName)) { |
| |
| // Retrieve the issuer's key identifier |
| if (certIssuerKeyId == null) { |
| certIssuerKeyId = currCertImpl.getIssuerKeyIdentifier(); |
| if (certIssuerKeyId == null) { |
| if (DEBUG != null) { |
| DEBUG.println("No issuer key identifier (AKID) " |
| + "in the certificate being validated"); |
| } |
| } |
| } |
| |
| // Check that the key identifiers match, if both are present |
| byte[] anchorKeyId = null; |
| if (certIssuerKeyId != null && |
| (anchorKeyId = |
| OCSPChecker.getKeyId(anchorCert)) != null) { |
| if (!Arrays.equals(certIssuerKeyId, anchorKeyId)) { |
| continue; // try next cert |
| } |
| |
| if (DEBUG != null) { |
| DEBUG.println("Issuer certificate key ID: " + |
| String.format("0x%0" + |
| (certIssuerKeyId.length * 2) + "x", |
| new BigInteger(1, certIssuerKeyId))); |
| } |
| } |
| |
| issuerCert = anchorCert; |
| seekIssuerCert = false; // done |
| |
| // By default, the OCSP responder's cert is the same as |
| // the issuer of the cert being validated. |
| if (!seekResponderCert && responderCerts.isEmpty()) { |
| responderCerts.add(anchorCert); |
| if (DEBUG != null) { |
| DEBUG.println("Responder's certificate is the" + |
| " same as the issuer of the certificate " + |
| "being validated"); |
| } |
| } |
| } |
| |
| // Check if anchor cert is the responder cert |
| if (seekResponderCert) { |
| // Satisfy the responder subject name property only, or |
| // satisfy the responder issuer name and serial number |
| // properties only |
| if ((responderSubjectName != null && |
| responderSubjectName.equals(anchorSubjectName)) || |
| (responderIssuerName != null && |
| responderSerialNumber != null && |
| responderIssuerName.equals( |
| anchorCert.getIssuerX500Principal()) && |
| responderSerialNumber.equals( |
| anchorCert.getSerialNumber()))) { |
| |
| responderCerts.add(anchorCert); |
| } |
| } |
| } |
| if (issuerCert == null) { |
| throw new CertPathValidatorException( |
| "No trusted certificate for " + currCertImpl.getIssuerDN()); |
| } |
| |
| // Check cert stores if responder cert has not yet been found |
| if (seekResponderCert) { |
| if (DEBUG != null) { |
| DEBUG.println("Searching cert stores for responder's " + |
| "certificate"); |
| } |
| X509CertSelector filter = null; |
| if (responderSubjectName != null) { |
| filter = new X509CertSelector(); |
| filter.setSubject(responderSubjectName); |
| } else if (responderIssuerName != null && |
| responderSerialNumber != null) { |
| filter = new X509CertSelector(); |
| filter.setIssuer(responderIssuerName); |
| filter.setSerialNumber(responderSerialNumber); |
| } |
| if (filter != null) { |
| List<CertStore> certStores = pkixParams.getCertStores(); |
| for (CertStore certStore : certStores) { |
| try { |
| responderCerts.addAll( |
| (Collection<X509Certificate>) |
| certStore.getCertificates(filter)); |
| } catch (CertStoreException cse) { |
| // ignore and try next certStore |
| if (DEBUG != null) { |
| DEBUG.println("CertStore exception:" + cse); |
| } |
| continue; |
| } |
| } |
| } |
| } |
| } |
| |
| // Could not find the certificate identified in the OCSP properties |
| if (seekResponderCert && responderCerts.isEmpty()) { |
| throw new CertPathValidatorException( |
| "Cannot find the responder's certificate " + |
| "(set using the OCSP security properties)."); |
| } |
| |
| if (DEBUG != null) { |
| DEBUG.println("Located " + responderCerts.size() + |
| " trusted responder certificate(s)"); |
| } |
| |
| // The algorithm constraints of the OCSP trusted responder certificate |
| // does not need to be checked in this code. The constraints will be |
| // checked when the responder's certificate is validated. |
| |
| CertId certId = null; |
| OCSPResponse response = null; |
| try { |
| certId = new CertId |
| (issuerCert, currCertImpl.getSerialNumberObject()); |
| response = OCSP.check(Collections.singletonList(certId), uri, |
| responderCerts, pkixParams.getDate()); |
| } catch (Exception e) { |
| if (e instanceof CertPathValidatorException) { |
| throw (CertPathValidatorException) e; |
| } else { |
| // Wrap exceptions in CertPathValidatorException so that |
| // we can fallback to CRLs, if enabled. |
| throw new CertPathValidatorException(e); |
| } |
| } |
| |
| RevocationStatus rs = (RevocationStatus) response.getSingleResponse(certId); |
| RevocationStatus.CertStatus certStatus = rs.getCertStatus(); |
| if (certStatus == RevocationStatus.CertStatus.REVOKED) { |
| Throwable t = new CertificateRevokedException( |
| rs.getRevocationTime(), rs.getRevocationReason(), |
| responderCerts.get(0).getSubjectX500Principal(), |
| rs.getSingleExtensions()); |
| throw new CertPathValidatorException(t.getMessage(), t, |
| null, -1, BasicReason.REVOKED); |
| } else if (certStatus == RevocationStatus.CertStatus.UNKNOWN) { |
| throw new CertPathValidatorException( |
| "Certificate's revocation status is unknown", null, cp, |
| (remainingCerts - 1), |
| BasicReason.UNDETERMINED_REVOCATION_STATUS); |
| } |
| } |
| |
| /* |
| * The OCSP security property values are in the following order: |
| * 1. ocsp.responderURL |
| * 2. ocsp.responderCertSubjectName |
| * 3. ocsp.responderCertIssuerName |
| * 4. ocsp.responderCertSerialNumber |
| */ |
| private static URI getOCSPServerURI(X509CertImpl currCertImpl, |
| String responderURL) throws CertPathValidatorException { |
| |
| if (responderURL != null) { |
| try { |
| return new URI(responderURL); |
| } catch (URISyntaxException e) { |
| throw new CertPathValidatorException(e); |
| } |
| } |
| |
| // Examine the certificate's AuthorityInfoAccess extension |
| AuthorityInfoAccessExtension aia = |
| currCertImpl.getAuthorityInfoAccessExtension(); |
| if (aia == null) { |
| throw new CertPathValidatorException( |
| "Must specify the location of an OCSP Responder"); |
| } |
| |
| List<AccessDescription> descriptions = aia.getAccessDescriptions(); |
| for (AccessDescription description : descriptions) { |
| if (description.getAccessMethod().equals((Object) |
| AccessDescription.Ad_OCSP_Id)) { |
| |
| GeneralName generalName = description.getAccessLocation(); |
| if (generalName.getType() == GeneralNameInterface.NAME_URI) { |
| URIName uri = (URIName) generalName.getName(); |
| return uri.getURI(); |
| } |
| } |
| } |
| |
| throw new CertPathValidatorException( |
| "Cannot find the location of the OCSP Responder"); |
| } |
| |
| /* |
| * Retrieves the values of the OCSP security properties. |
| */ |
| private static String[] getOCSPProperties() { |
| final String[] properties = new String[4]; |
| |
| AccessController.doPrivileged( |
| new PrivilegedAction<Void>() { |
| public Void run() { |
| properties[0] = Security.getProperty(OCSP_URL_PROP); |
| properties[1] = |
| Security.getProperty(OCSP_CERT_SUBJECT_PROP); |
| properties[2] = |
| Security.getProperty(OCSP_CERT_ISSUER_PROP); |
| properties[3] = |
| Security.getProperty(OCSP_CERT_NUMBER_PROP); |
| return null; |
| } |
| }); |
| |
| return properties; |
| } |
| |
| /* |
| * Removes any non-hexadecimal characters from a string. |
| */ |
| private static String stripOutSeparators(String value) { |
| char[] chars = value.toCharArray(); |
| StringBuilder hexNumber = new StringBuilder(); |
| for (int i = 0; i < chars.length; i++) { |
| if (HEX_DIGITS.indexOf(chars[i]) != -1) { |
| hexNumber.append(chars[i]); |
| } |
| } |
| return hexNumber.toString(); |
| } |
| |
| /* |
| * Returns the subject key identifier for the supplied certificate, or null |
| */ |
| static byte[] getKeyId(X509Certificate cert) { |
| X509CertImpl certImpl = null; |
| byte[] certSubjectKeyId = null; |
| |
| try { |
| certImpl = X509CertImpl.toImpl(cert); |
| certSubjectKeyId = certImpl.getSubjectKeyIdentifier(); |
| |
| if (certSubjectKeyId == null) { |
| if (DEBUG != null) { |
| DEBUG.println("No subject key identifier (SKID) in the " + |
| "certificate (Subject: " + |
| cert.getSubjectX500Principal() + ")"); |
| } |
| } |
| |
| } catch (CertificateException e) { |
| // Ignore certificate |
| if (DEBUG != null) { |
| DEBUG.println("Error parsing X.509 certificate (Subject: " + |
| cert.getSubjectX500Principal() + ") " + e); |
| } |
| } |
| |
| return certSubjectKeyId; |
| } |
| } |
