| /* |
| * Copyright (c) 2000, 2009, Oracle and/or its affiliates. All rights reserved. |
| * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. |
| * |
| * This code is free software; you can redistribute it and/or modify it |
| * under the terms of the GNU General Public License version 2 only, as |
| * published by the Free Software Foundation. Oracle designates this |
| * particular file as subject to the "Classpath" exception as provided |
| * by Oracle in the LICENSE file that accompanied this code. |
| * |
| * This code is distributed in the hope that it will be useful, but WITHOUT |
| * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or |
| * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License |
| * version 2 for more details (a copy is included in the LICENSE file that |
| * accompanied this code). |
| * |
| * You should have received a copy of the GNU General Public License version |
| * 2 along with this work; if not, write to the Free Software Foundation, |
| * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA. |
| * |
| * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA |
| * or visit www.oracle.com if you need additional information or have any |
| * questions. |
| */ |
| |
| package sun.security.provider.certpath; |
| |
| import java.io.IOException; |
| import java.security.AccessController; |
| import java.security.GeneralSecurityException; |
| import java.security.cert.*; |
| import java.util.*; |
| |
| import javax.security.auth.x500.X500Principal; |
| |
| import sun.security.action.GetBooleanAction; |
| import sun.security.util.Debug; |
| import sun.security.x509.GeneralNames; |
| import sun.security.x509.GeneralNameInterface; |
| import sun.security.x509.GeneralSubtrees; |
| import sun.security.x509.NameConstraintsExtension; |
| import sun.security.x509.SubjectAlternativeNameExtension; |
| import sun.security.x509.X500Name; |
| import sun.security.x509.X509CertImpl; |
| |
| /** |
| * Abstract class representing a builder, which is able to retrieve |
| * matching certificates and is able to verify a particular certificate. |
| * |
| * @since 1.4 |
| * @author Sean Mullan |
| * @author Yassir Elley |
| */ |
| |
| public abstract class Builder { |
| |
| private static final Debug debug = Debug.getInstance("certpath"); |
| private Set<String> matchingPolicies; |
| final PKIXBuilderParameters buildParams; |
| final X500Principal targetSubjectDN; |
| final Date date; |
| final X509CertSelector targetCertConstraints; |
| |
| /** |
| * Flag indicating whether support for the caIssuers field of the |
| * Authority Information Access extension shall be enabled. Currently |
| * disabled by default for compatibility reasons. |
| */ |
| final static boolean USE_AIA = AccessController.doPrivileged |
| (new GetBooleanAction("com.sun.security.enableAIAcaIssuers")); |
| |
| /** |
| * Initialize the builder with the input parameters. |
| * |
| * @param params the parameter set used to build a certification path |
| */ |
| Builder(PKIXBuilderParameters buildParams, X500Principal targetSubjectDN) { |
| this.buildParams = buildParams; |
| this.targetSubjectDN = targetSubjectDN; |
| // Initialize date if not specified |
| Date paramsDate = buildParams.getDate(); |
| this.date = paramsDate != null ? paramsDate : new Date(); |
| this.targetCertConstraints = |
| (X509CertSelector) buildParams.getTargetCertConstraints(); |
| } |
| |
| /** |
| * Retrieves certificates from the list of certStores using the buildParams |
| * and the currentState as a filter |
| * |
| * @param currentState the current State |
| * @param certStores list of CertStores |
| */ |
| abstract Collection<X509Certificate> getMatchingCerts |
| (State currentState, List<CertStore> certStores) |
| throws CertStoreException, CertificateException, IOException; |
| |
| /** |
| * Verifies the cert against the currentState, using the certPathList |
| * generated thus far to help with loop detection |
| * |
| * @param cert the certificate to be verified |
| * @param currentState the current state against which the cert is verified |
| * @param certPathList the certPathList generated thus far |
| */ |
| abstract void verifyCert(X509Certificate cert, State currentState, |
| List<X509Certificate> certPathList) throws GeneralSecurityException; |
| |
| /** |
| * Verifies whether the input certificate completes the path. |
| * When building forward, a trust anchor will complete the path. |
| * When building reverse, the target certificate will complete the path. |
| * |
| * @param cert the certificate to test |
| * @return a boolean value indicating whether the cert completes the path. |
| */ |
| abstract boolean isPathCompleted(X509Certificate cert); |
| |
| /** |
| * Adds the certificate to the certPathList |
| * |
| * @param cert the certificate to be added |
| * @param certPathList the certification path list |
| */ |
| abstract void addCertToPath(X509Certificate cert, |
| LinkedList<X509Certificate> certPathList); |
| |
| /** |
| * Removes final certificate from the certPathList |
| * |
| * @param certPathList the certification path list |
| */ |
| abstract void removeFinalCertFromPath |
| (LinkedList<X509Certificate> certPathList); |
| |
| /** |
| * get distance of one GeneralName from another |
| * |
| * @param base GeneralName at base of subtree |
| * @param test GeneralName to be tested against base |
| * @param incomparable the value to return if the names are |
| * incomparable |
| * @return distance of test name from base, where 0 |
| * means exact match, 1 means test is an immediate |
| * child of base, 2 means test is a grandchild, etc. |
| * -1 means test is a parent of base, -2 means test |
| * is a grandparent, etc. |
| */ |
| static int distance(GeneralNameInterface base, |
| GeneralNameInterface test, int incomparable) { |
| switch (base.constrains(test)) { |
| case GeneralNameInterface.NAME_DIFF_TYPE: |
| if (debug != null) { |
| debug.println("Builder.distance(): Names are different types"); |
| } |
| case GeneralNameInterface.NAME_SAME_TYPE: |
| if (debug != null) { |
| debug.println("Builder.distance(): Names are same type but " + |
| "in different subtrees"); |
| } |
| return incomparable; |
| case GeneralNameInterface.NAME_MATCH: |
| return 0; |
| case GeneralNameInterface.NAME_WIDENS: |
| break; |
| case GeneralNameInterface.NAME_NARROWS: |
| break; |
| default: // should never occur |
| return incomparable; |
| } |
| |
| /* names are in same subtree */ |
| return test.subtreeDepth() - base.subtreeDepth(); |
| } |
| |
| /** |
| * get hop distance of one GeneralName from another in links where |
| * the names need not have an ancestor/descendant relationship. |
| * For example, the hop distance from ou=D,ou=C,o=B,c=US to |
| * ou=F,ou=E,ou=C,o=B,c=US is 3: D->C, C->E, E->F. The hop distance |
| * from ou=C,o=B,c=US to ou=D,ou=C,o=B,c=US is -1: C->D |
| * |
| * @param base GeneralName |
| * @param test GeneralName to be tested against base |
| * @param incomparable the value to return if the names are |
| * incomparable |
| * @return distance of test name from base measured in hops in the |
| * namespace hierarchy, where 0 means exact match. Result |
| * is positive if path is some number of up hops followed by |
| * some number of down hops; result is negative if path is |
| * some number of down hops. |
| */ |
| static int hops(GeneralNameInterface base, GeneralNameInterface test, |
| int incomparable) { |
| int baseRtest = base.constrains(test); |
| switch (baseRtest) { |
| case GeneralNameInterface.NAME_DIFF_TYPE: |
| if (debug != null) { |
| debug.println("Builder.hops(): Names are different types"); |
| } |
| return incomparable; |
| case GeneralNameInterface.NAME_SAME_TYPE: |
| /* base and test are in different subtrees */ |
| break; |
| case GeneralNameInterface.NAME_MATCH: |
| /* base matches test */ |
| return 0; |
| case GeneralNameInterface.NAME_WIDENS: |
| /* base is ancestor of test */ |
| return (test.subtreeDepth()-base.subtreeDepth()); |
| case GeneralNameInterface.NAME_NARROWS: |
| /* base is descendant of test */ |
| return (test.subtreeDepth()-base.subtreeDepth()); |
| default: // should never occur |
| return incomparable; |
| } |
| |
| /* names are in different subtrees */ |
| if (base.getType() != GeneralNameInterface.NAME_DIRECTORY) { |
| if (debug != null) { |
| debug.println("Builder.hops(): hopDistance not implemented " + |
| "for this name type"); |
| } |
| return incomparable; |
| } |
| X500Name baseName = (X500Name)base; |
| X500Name testName = (X500Name)test; |
| X500Name commonName = baseName.commonAncestor(testName); |
| if (commonName == null) { |
| if (debug != null) { |
| debug.println("Builder.hops(): Names are in different " + |
| "namespaces"); |
| } |
| return incomparable; |
| } else { |
| int commonDistance = commonName.subtreeDepth(); |
| int baseDistance = baseName.subtreeDepth(); |
| int testDistance = testName.subtreeDepth(); |
| return (baseDistance + testDistance - (2 * commonDistance)); |
| } |
| } |
| |
| /** |
| * Determine how close a given certificate gets you toward |
| * a given target. |
| * |
| * @param constraints Current NameConstraints; if null, |
| * then caller must verify NameConstraints |
| * independently, realizing that this certificate |
| * may not actually lead to the target at all. |
| * @param cert Candidate certificate for chain |
| * @param target GeneralNameInterface name of target |
| * @return distance from this certificate to target: |
| * <ul> |
| * <li>-1 means certificate could be CA for target, but |
| * there are no NameConstraints limiting how close |
| * <li> 0 means certificate subject or subjectAltName |
| * matches target |
| * <li> 1 means certificate is permitted to be CA for |
| * target. |
| * <li> 2 means certificate is permitted to be CA for |
| * parent of target. |
| * <li>>0 in general, means certificate is permitted |
| * to be a CA for this distance higher in the naming |
| * hierarchy than the target, plus 1. |
| * </ul> |
| * <p>Note that the subject and/or subjectAltName of the |
| * candidate cert does not have to be an ancestor of the |
| * target in order to be a CA that can issue a certificate to |
| * the target. In these cases, the target distance is calculated |
| * by inspecting the NameConstraints extension in the candidate |
| * certificate. For example, suppose the target is an X.500 DN with |
| * a value of "CN=mullan,OU=ireland,O=sun,C=us" and the |
| * NameConstraints extension in the candidate certificate |
| * includes a permitted component of "O=sun,C=us", which implies |
| * that the candidate certificate is allowed to issue certs in |
| * the "O=sun,C=us" namespace. The target distance is 3 |
| * ((distance of permitted NC from target) + 1). |
| * The (+1) is added to distinguish the result from the case |
| * which returns (0). |
| * @throws IOException if certificate does not get closer |
| */ |
| static int targetDistance(NameConstraintsExtension constraints, |
| X509Certificate cert, GeneralNameInterface target) |
| throws IOException { |
| |
| /* ensure that certificate satisfies existing name constraints */ |
| if (constraints != null && !constraints.verify(cert)) { |
| throw new IOException("certificate does not satisfy existing name " |
| + "constraints"); |
| } |
| |
| X509CertImpl certImpl; |
| try { |
| certImpl = X509CertImpl.toImpl(cert); |
| } catch (CertificateException e) { |
| throw (IOException)new IOException("Invalid certificate").initCause(e); |
| } |
| /* see if certificate subject matches target */ |
| X500Name subject = X500Name.asX500Name(certImpl.getSubjectX500Principal()); |
| if (subject.equals(target)) { |
| /* match! */ |
| return 0; |
| } |
| |
| SubjectAlternativeNameExtension altNameExt = |
| certImpl.getSubjectAlternativeNameExtension(); |
| if (altNameExt != null) { |
| GeneralNames altNames = |
| (GeneralNames)altNameExt.get(altNameExt.SUBJECT_NAME); |
| /* see if any alternative name matches target */ |
| if (altNames != null) { |
| for (int j = 0, n = altNames.size(); j < n; j++) { |
| GeneralNameInterface altName = altNames.get(j).getName(); |
| if (altName.equals(target)) { |
| return 0; |
| } |
| } |
| } |
| } |
| |
| |
| /* no exact match; see if certificate can get us to target */ |
| |
| /* first, get NameConstraints out of certificate */ |
| NameConstraintsExtension ncExt = certImpl.getNameConstraintsExtension(); |
| if (ncExt == null) { |
| return -1; |
| } |
| |
| /* merge certificate's NameConstraints with current NameConstraints */ |
| if (constraints != null) { |
| constraints.merge(ncExt); |
| } else { |
| // Make sure we do a clone here, because we're probably |
| // going to modify this object later and we don't want to |
| // be sharing it with a Certificate object! |
| constraints = (NameConstraintsExtension) ncExt.clone(); |
| } |
| |
| if (debug != null) { |
| debug.println("Builder.targetDistance() merged constraints: " |
| + String.valueOf(constraints)); |
| } |
| /* reduce permitted by excluded */ |
| GeneralSubtrees permitted = (GeneralSubtrees) |
| constraints.get(constraints.PERMITTED_SUBTREES); |
| GeneralSubtrees excluded = (GeneralSubtrees) |
| constraints.get(constraints.EXCLUDED_SUBTREES); |
| if (permitted != null) { |
| permitted.reduce(excluded); |
| } |
| if (debug != null) { |
| debug.println("Builder.targetDistance() reduced constraints: " |
| + permitted); |
| } |
| /* see if new merged constraints allow target */ |
| if (!constraints.verify(target)) { |
| throw new IOException("New certificate not allowed to sign " |
| + "certificate for target"); |
| } |
| /* find distance to target, if any, in permitted */ |
| if (permitted == null) { |
| /* certificate is unconstrained; could sign for anything */ |
| return -1; |
| } |
| for (int i = 0, n = permitted.size(); i < n; i++) { |
| GeneralNameInterface perName = permitted.get(i).getName().getName(); |
| int distance = distance(perName, target, -1); |
| if (distance >= 0) { |
| return (distance + 1); |
| } |
| } |
| /* no matching type in permitted; cert holder could certify target */ |
| return -1; |
| } |
| |
| /** |
| * This method can be used as an optimization to filter out |
| * certificates that do not have policies which are valid. |
| * It returns the set of policies (String OIDs) that should exist in |
| * the certificate policies extension of the certificate that is |
| * needed by the builder. The logic applied is as follows: |
| * <p> |
| * 1) If some initial policies have been set *and* policy mappings are |
| * inhibited, then acceptable certificates are those that include |
| * the ANY_POLICY OID or with policies that intersect with the |
| * initial policies. |
| * 2) If no initial policies have been set *or* policy mappings are |
| * not inhibited then we don't have much to work with. All we know is |
| * that a certificate must have *some* policy because if it didn't |
| * have any policy then the policy tree would become null (and validation |
| * would fail). |
| * |
| * @return the Set of policies any of which must exist in a |
| * cert's certificate policies extension in order for a cert to be selected. |
| */ |
| Set<String> getMatchingPolicies() { |
| if (matchingPolicies != null) { |
| Set<String> initialPolicies = buildParams.getInitialPolicies(); |
| if ((!initialPolicies.isEmpty()) && |
| (!initialPolicies.contains(PolicyChecker.ANY_POLICY)) && |
| (buildParams.isPolicyMappingInhibited())) |
| { |
| initialPolicies.add(PolicyChecker.ANY_POLICY); |
| matchingPolicies = initialPolicies; |
| } else { |
| // we just return an empty set to make sure that there is |
| // at least a certificate policies extension in the cert |
| matchingPolicies = Collections.<String>emptySet(); |
| } |
| } |
| return matchingPolicies; |
| } |
| |
| /** |
| * Search the specified CertStores and add all certificates matching |
| * selector to resultCerts. Self-signed certs are not useful here |
| * and therefore ignored. |
| * |
| * If the targetCert criterion of the selector is set, only that cert |
| * is examined and the CertStores are not searched. |
| * |
| * If checkAll is true, all CertStores are searched for matching certs. |
| * If false, the method returns as soon as the first CertStore returns |
| * a matching cert(s). |
| * |
| * Returns true iff resultCerts changed (a cert was added to the collection) |
| */ |
| boolean addMatchingCerts(X509CertSelector selector, |
| Collection<CertStore> certStores, |
| Collection<X509Certificate> resultCerts, boolean checkAll) { |
| X509Certificate targetCert = selector.getCertificate(); |
| if (targetCert != null) { |
| // no need to search CertStores |
| if (selector.match(targetCert) && !X509CertImpl.isSelfSigned |
| (targetCert, buildParams.getSigProvider())) { |
| if (debug != null) { |
| debug.println("Builder.addMatchingCerts: adding target cert"); |
| } |
| return resultCerts.add(targetCert); |
| } |
| return false; |
| } |
| boolean add = false; |
| for (CertStore store : certStores) { |
| try { |
| Collection<? extends Certificate> certs = |
| store.getCertificates(selector); |
| for (Certificate cert : certs) { |
| if (!X509CertImpl.isSelfSigned |
| ((X509Certificate)cert, buildParams.getSigProvider())) { |
| if (resultCerts.add((X509Certificate)cert)) { |
| add = true; |
| } |
| } |
| } |
| if (!checkAll && add) { |
| return true; |
| } |
| } catch (CertStoreException cse) { |
| // if getCertificates throws a CertStoreException, we ignore |
| // it and move on to the next CertStore |
| if (debug != null) { |
| debug.println("Builder.addMatchingCerts, non-fatal " + |
| "exception retrieving certs: " + cse); |
| cse.printStackTrace(); |
| } |
| } |
| } |
| return add; |
| } |
| |
| /** |
| * Returns true if CertStore is local. Currently, returns true if |
| * type is Collection or if it has been initialized with |
| * CollectionCertStoreParameters. A new API method should be added |
| * to CertStore that returns local or remote. |
| */ |
| static boolean isLocalCertStore(CertStore certStore) { |
| return (certStore.getType().equals("Collection") || |
| certStore.getCertStoreParameters() instanceof |
| CollectionCertStoreParameters); |
| } |
| } |
