| /* |
| * Copyright (c) 2010, 2011, Oracle and/or its affiliates. All rights reserved. |
| * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. |
| * |
| * This code is free software; you can redistribute it and/or modify it |
| * under the terms of the GNU General Public License version 2 only, as |
| * published by the Free Software Foundation. Oracle designates this |
| * particular file as subject to the "Classpath" exception as provided |
| * by Oracle in the LICENSE file that accompanied this code. |
| * |
| * This code is distributed in the hope that it will be useful, but WITHOUT |
| * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or |
| * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License |
| * version 2 for more details (a copy is included in the LICENSE file that |
| * accompanied this code). |
| * |
| * You should have received a copy of the GNU General Public License version |
| * 2 along with this work; if not, write to the Free Software Foundation, |
| * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA. |
| * |
| * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA |
| * or visit www.oracle.com if you need additional information or have any |
| * questions. |
| */ |
| |
| package sun.security.ssl; |
| |
| import java.security.AlgorithmConstraints; |
| import java.security.CryptoPrimitive; |
| import java.security.AlgorithmParameters; |
| |
| import javax.net.ssl.*; |
| |
| import java.security.Key; |
| |
| import java.util.Set; |
| import java.util.HashSet; |
| |
| import sun.security.util.DisabledAlgorithmConstraints; |
| import sun.security.ssl.CipherSuite.*; |
| |
| /** |
| * Algorithm constraints for disabled algorithms property |
| * |
| * See the "jdk.certpath.disabledAlgorithms" specification in java.security |
| * for the syntax of the disabled algorithm string. |
| */ |
| final class SSLAlgorithmConstraints implements AlgorithmConstraints { |
| private final static AlgorithmConstraints tlsDisabledAlgConstraints = |
| new TLSDisabledAlgConstraints(); |
| private final static AlgorithmConstraints x509DisabledAlgConstraints = |
| new X509DisabledAlgConstraints(); |
| private AlgorithmConstraints userAlgConstraints = null; |
| private AlgorithmConstraints peerAlgConstraints = null; |
| |
| private boolean enabledX509DisabledAlgConstraints = true; |
| |
| SSLAlgorithmConstraints(AlgorithmConstraints algorithmConstraints) { |
| userAlgConstraints = algorithmConstraints; |
| } |
| |
| SSLAlgorithmConstraints(SSLSocket socket, |
| boolean withDefaultCertPathConstraints) { |
| if (socket != null) { |
| userAlgConstraints = |
| socket.getSSLParameters().getAlgorithmConstraints(); |
| } |
| |
| if (!withDefaultCertPathConstraints) { |
| enabledX509DisabledAlgConstraints = false; |
| } |
| } |
| |
| SSLAlgorithmConstraints(SSLEngine engine, |
| boolean withDefaultCertPathConstraints) { |
| if (engine != null) { |
| userAlgConstraints = |
| engine.getSSLParameters().getAlgorithmConstraints(); |
| } |
| |
| if (!withDefaultCertPathConstraints) { |
| enabledX509DisabledAlgConstraints = false; |
| } |
| } |
| |
| SSLAlgorithmConstraints(SSLSocket socket, String[] supportedAlgorithms, |
| boolean withDefaultCertPathConstraints) { |
| if (socket != null) { |
| userAlgConstraints = |
| socket.getSSLParameters().getAlgorithmConstraints(); |
| peerAlgConstraints = |
| new SupportedSignatureAlgorithmConstraints(supportedAlgorithms); |
| } |
| |
| if (!withDefaultCertPathConstraints) { |
| enabledX509DisabledAlgConstraints = false; |
| } |
| } |
| |
| SSLAlgorithmConstraints(SSLEngine engine, String[] supportedAlgorithms, |
| boolean withDefaultCertPathConstraints) { |
| if (engine != null) { |
| userAlgConstraints = |
| engine.getSSLParameters().getAlgorithmConstraints(); |
| peerAlgConstraints = |
| new SupportedSignatureAlgorithmConstraints(supportedAlgorithms); |
| } |
| |
| if (!withDefaultCertPathConstraints) { |
| enabledX509DisabledAlgConstraints = false; |
| } |
| } |
| |
| public boolean permits(Set<CryptoPrimitive> primitives, |
| String algorithm, AlgorithmParameters parameters) { |
| |
| boolean permitted = true; |
| |
| if (peerAlgConstraints != null) { |
| permitted = peerAlgConstraints.permits( |
| primitives, algorithm, parameters); |
| } |
| |
| if (permitted && userAlgConstraints != null) { |
| permitted = userAlgConstraints.permits( |
| primitives, algorithm, parameters); |
| } |
| |
| if (permitted) { |
| permitted = tlsDisabledAlgConstraints.permits( |
| primitives, algorithm, parameters); |
| } |
| |
| if (permitted && enabledX509DisabledAlgConstraints) { |
| permitted = x509DisabledAlgConstraints.permits( |
| primitives, algorithm, parameters); |
| } |
| |
| return permitted; |
| } |
| |
| public boolean permits(Set<CryptoPrimitive> primitives, Key key) { |
| |
| boolean permitted = true; |
| |
| if (peerAlgConstraints != null) { |
| permitted = peerAlgConstraints.permits(primitives, key); |
| } |
| |
| if (permitted && userAlgConstraints != null) { |
| permitted = userAlgConstraints.permits(primitives, key); |
| } |
| |
| if (permitted) { |
| permitted = tlsDisabledAlgConstraints.permits(primitives, key); |
| } |
| |
| if (permitted && enabledX509DisabledAlgConstraints) { |
| permitted = x509DisabledAlgConstraints.permits(primitives, key); |
| } |
| |
| return permitted; |
| } |
| |
| public boolean permits(Set<CryptoPrimitive> primitives, |
| String algorithm, Key key, AlgorithmParameters parameters) { |
| |
| boolean permitted = true; |
| |
| if (peerAlgConstraints != null) { |
| permitted = peerAlgConstraints.permits( |
| primitives, algorithm, key, parameters); |
| } |
| |
| if (permitted && userAlgConstraints != null) { |
| permitted = userAlgConstraints.permits( |
| primitives, algorithm, key, parameters); |
| } |
| |
| if (permitted) { |
| permitted = tlsDisabledAlgConstraints.permits( |
| primitives, algorithm, key, parameters); |
| } |
| |
| if (permitted && enabledX509DisabledAlgConstraints) { |
| permitted = x509DisabledAlgConstraints.permits( |
| primitives, algorithm, key, parameters); |
| } |
| |
| return permitted; |
| } |
| |
| |
| static private class SupportedSignatureAlgorithmConstraints |
| implements AlgorithmConstraints { |
| // supported signature algorithms |
| private String[] supportedAlgorithms; |
| |
| SupportedSignatureAlgorithmConstraints(String[] supportedAlgorithms) { |
| if (supportedAlgorithms != null) { |
| this.supportedAlgorithms = supportedAlgorithms.clone(); |
| } else { |
| this.supportedAlgorithms = null; |
| } |
| } |
| |
| public boolean permits(Set<CryptoPrimitive> primitives, |
| String algorithm, AlgorithmParameters parameters) { |
| |
| if (algorithm == null || algorithm.length() == 0) { |
| throw new IllegalArgumentException( |
| "No algorithm name specified"); |
| } |
| |
| if (primitives == null || primitives.isEmpty()) { |
| throw new IllegalArgumentException( |
| "No cryptographic primitive specified"); |
| } |
| |
| if (supportedAlgorithms == null || |
| supportedAlgorithms.length == 0) { |
| return false; |
| } |
| |
| // trim the MGF part: <digest>with<encryption>and<mgf> |
| int position = algorithm.indexOf("and"); |
| if (position > 0) { |
| algorithm = algorithm.substring(0, position); |
| } |
| |
| for (String supportedAlgorithm : supportedAlgorithms) { |
| if (algorithm.equalsIgnoreCase(supportedAlgorithm)) { |
| return true; |
| } |
| } |
| |
| return false; |
| } |
| |
| final public boolean permits(Set<CryptoPrimitive> primitives, Key key) { |
| return true; |
| } |
| |
| final public boolean permits(Set<CryptoPrimitive> primitives, |
| String algorithm, Key key, AlgorithmParameters parameters) { |
| |
| if (algorithm == null || algorithm.length() == 0) { |
| throw new IllegalArgumentException( |
| "No algorithm name specified"); |
| } |
| |
| return permits(primitives, algorithm, parameters); |
| } |
| } |
| |
| static private class BasicDisabledAlgConstraints |
| extends DisabledAlgorithmConstraints { |
| BasicDisabledAlgConstraints(String propertyName) { |
| super(propertyName); |
| } |
| |
| protected Set<String> decomposes(KeyExchange keyExchange, |
| boolean forCertPathOnly) { |
| Set<String> components = new HashSet<>(); |
| switch (keyExchange) { |
| case K_NULL: |
| if (!forCertPathOnly) { |
| components.add("NULL"); |
| } |
| break; |
| case K_RSA: |
| components.add("RSA"); |
| break; |
| case K_RSA_EXPORT: |
| components.add("RSA"); |
| components.add("RSA_EXPORT"); |
| break; |
| case K_DH_RSA: |
| components.add("RSA"); |
| components.add("DH"); |
| components.add("DiffieHellman"); |
| components.add("DH_RSA"); |
| break; |
| case K_DH_DSS: |
| components.add("DSA"); |
| components.add("DSS"); |
| components.add("DH"); |
| components.add("DiffieHellman"); |
| components.add("DH_DSS"); |
| break; |
| case K_DHE_DSS: |
| components.add("DSA"); |
| components.add("DSS"); |
| components.add("DH"); |
| components.add("DHE"); |
| components.add("DiffieHellman"); |
| components.add("DHE_DSS"); |
| break; |
| case K_DHE_RSA: |
| components.add("RSA"); |
| components.add("DH"); |
| components.add("DHE"); |
| components.add("DiffieHellman"); |
| components.add("DHE_RSA"); |
| break; |
| case K_DH_ANON: |
| if (!forCertPathOnly) { |
| components.add("ANON"); |
| components.add("DH"); |
| components.add("DiffieHellman"); |
| components.add("DH_ANON"); |
| } |
| break; |
| case K_ECDH_ECDSA: |
| components.add("ECDH"); |
| components.add("ECDSA"); |
| components.add("ECDH_ECDSA"); |
| break; |
| case K_ECDH_RSA: |
| components.add("ECDH"); |
| components.add("RSA"); |
| components.add("ECDH_RSA"); |
| break; |
| case K_ECDHE_ECDSA: |
| components.add("ECDHE"); |
| components.add("ECDSA"); |
| components.add("ECDHE_ECDSA"); |
| break; |
| case K_ECDHE_RSA: |
| components.add("ECDHE"); |
| components.add("RSA"); |
| components.add("ECDHE_RSA"); |
| break; |
| case K_ECDH_ANON: |
| if (!forCertPathOnly) { |
| components.add("ECDH"); |
| components.add("ANON"); |
| components.add("ECDH_ANON"); |
| } |
| break; |
| case K_KRB5: |
| if (!forCertPathOnly) { |
| components.add("KRB5"); |
| } |
| break; |
| case K_KRB5_EXPORT: |
| if (!forCertPathOnly) { |
| components.add("KRB5_EXPORT"); |
| } |
| break; |
| default: |
| // ignore |
| } |
| |
| return components; |
| } |
| |
| protected Set<String> decomposes(BulkCipher bulkCipher) { |
| Set<String> components = new HashSet<>(); |
| |
| if (bulkCipher.transformation != null) { |
| components.addAll(super.decomposes(bulkCipher.transformation)); |
| } |
| |
| return components; |
| } |
| |
| protected Set<String> decomposes(MacAlg macAlg) { |
| Set<String> components = new HashSet<>(); |
| |
| if (macAlg == CipherSuite.M_MD5) { |
| components.add("MD5"); |
| components.add("HmacMD5"); |
| } else if (macAlg == CipherSuite.M_SHA) { |
| components.add("SHA1"); |
| components.add("SHA-1"); |
| components.add("HmacSHA1"); |
| } else if (macAlg == CipherSuite.M_SHA256) { |
| components.add("SHA256"); |
| components.add("SHA-256"); |
| components.add("HmacSHA256"); |
| } else if (macAlg == CipherSuite.M_SHA384) { |
| components.add("SHA384"); |
| components.add("SHA-384"); |
| components.add("HmacSHA384"); |
| } |
| |
| return components; |
| } |
| } |
| |
| static private class TLSDisabledAlgConstraints |
| extends BasicDisabledAlgConstraints { |
| |
| TLSDisabledAlgConstraints() { |
| super(DisabledAlgorithmConstraints.PROPERTY_TLS_DISABLED_ALGS); |
| } |
| |
| @Override |
| protected Set<String> decomposes(String algorithm) { |
| if (algorithm.startsWith("SSL_") || algorithm.startsWith("TLS_")) { |
| CipherSuite cipherSuite = null; |
| try { |
| cipherSuite = CipherSuite.valueOf(algorithm); |
| } catch (IllegalArgumentException iae) { |
| // ignore: unknown or unsupported ciphersuite |
| } |
| |
| if (cipherSuite != null) { |
| Set<String> components = new HashSet<>(); |
| |
| if(cipherSuite.keyExchange != null) { |
| components.addAll( |
| decomposes(cipherSuite.keyExchange, false)); |
| } |
| |
| if (cipherSuite.cipher != null) { |
| components.addAll(decomposes(cipherSuite.cipher)); |
| } |
| |
| if (cipherSuite.macAlg != null) { |
| components.addAll(decomposes(cipherSuite.macAlg)); |
| } |
| |
| return components; |
| } |
| } |
| |
| return super.decomposes(algorithm); |
| } |
| } |
| |
| static private class X509DisabledAlgConstraints |
| extends BasicDisabledAlgConstraints { |
| |
| X509DisabledAlgConstraints() { |
| super(DisabledAlgorithmConstraints.PROPERTY_CERTPATH_DISABLED_ALGS); |
| } |
| |
| @Override |
| protected Set<String> decomposes(String algorithm) { |
| if (algorithm.startsWith("SSL_") || algorithm.startsWith("TLS_")) { |
| CipherSuite cipherSuite = null; |
| try { |
| cipherSuite = CipherSuite.valueOf(algorithm); |
| } catch (IllegalArgumentException iae) { |
| // ignore: unknown or unsupported ciphersuite |
| } |
| |
| if (cipherSuite != null) { |
| Set<String> components = new HashSet<>(); |
| |
| if(cipherSuite.keyExchange != null) { |
| components.addAll( |
| decomposes(cipherSuite.keyExchange, true)); |
| } |
| |
| // Certification path algorithm constraints do not apply |
| // to cipherSuite.cipher and cipherSuite.macAlg. |
| |
| return components; |
| } |
| } |
| |
| return super.decomposes(algorithm); |
| } |
| } |
| } |
| |
