| /* |
| * Copyright (c) 1999, 2011, Oracle and/or its affiliates. All rights reserved. |
| * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. |
| * |
| * This code is free software; you can redistribute it and/or modify it |
| * under the terms of the GNU General Public License version 2 only, as |
| * published by the Free Software Foundation. Oracle designates this |
| * particular file as subject to the "Classpath" exception as provided |
| * by Oracle in the LICENSE file that accompanied this code. |
| * |
| * This code is distributed in the hope that it will be useful, but WITHOUT |
| * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or |
| * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License |
| * version 2 for more details (a copy is included in the LICENSE file that |
| * accompanied this code). |
| * |
| * You should have received a copy of the GNU General Public License version |
| * 2 along with this work; if not, write to the Free Software Foundation, |
| * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA. |
| * |
| * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA |
| * or visit www.oracle.com if you need additional information or have any |
| * questions. |
| */ |
| |
| package sun.security.ssl; |
| |
| import java.util.*; |
| import java.io.*; |
| import java.math.*; |
| import java.security.*; |
| import java.security.cert.*; |
| import javax.net.ssl.*; |
| import java.security.spec.AlgorithmParameterSpec; |
| |
| import sun.security.validator.Validator; |
| |
| abstract class TrustManagerFactoryImpl extends TrustManagerFactorySpi { |
| |
| private static final Debug debug = Debug.getInstance("ssl"); |
| private X509TrustManager trustManager = null; |
| private boolean isInitialized = false; |
| |
| TrustManagerFactoryImpl() { |
| // empty |
| } |
| |
| protected void engineInit(KeyStore ks) throws KeyStoreException { |
| if (ks == null) { |
| try { |
| ks = getCacertsKeyStore("trustmanager"); |
| } catch (SecurityException se) { |
| // eat security exceptions but report other throwables |
| if (debug != null && Debug.isOn("trustmanager")) { |
| System.out.println( |
| "SunX509: skip default keystore: " + se); |
| } |
| } catch (Error err) { |
| if (debug != null && Debug.isOn("trustmanager")) { |
| System.out.println( |
| "SunX509: skip default keystore: " + err); |
| } |
| throw err; |
| } catch (RuntimeException re) { |
| if (debug != null && Debug.isOn("trustmanager")) { |
| System.out.println( |
| "SunX509: skip default keystore: " + re); |
| } |
| throw re; |
| } catch (Exception e) { |
| if (debug != null && Debug.isOn("trustmanager")) { |
| System.out.println( |
| "SunX509: skip default keystore: " + e); |
| } |
| throw new KeyStoreException( |
| "problem accessing trust store" + e); |
| } |
| } |
| trustManager = getInstance(ks); |
| isInitialized = true; |
| } |
| |
| abstract X509TrustManager getInstance(KeyStore ks) throws KeyStoreException; |
| |
| abstract X509TrustManager getInstance(ManagerFactoryParameters spec) |
| throws InvalidAlgorithmParameterException; |
| |
| protected void engineInit(ManagerFactoryParameters spec) throws |
| InvalidAlgorithmParameterException { |
| trustManager = getInstance(spec); |
| isInitialized = true; |
| } |
| |
| /** |
| * Returns one trust manager for each type of trust material. |
| */ |
| protected TrustManager[] engineGetTrustManagers() { |
| if (!isInitialized) { |
| throw new IllegalStateException( |
| "TrustManagerFactoryImpl is not initialized"); |
| } |
| return new TrustManager[] { trustManager }; |
| } |
| |
| /* |
| * Try to get an InputStream based on the file we pass in. |
| */ |
| private static FileInputStream getFileInputStream(final File file) |
| throws Exception { |
| return AccessController.doPrivileged( |
| new PrivilegedExceptionAction<FileInputStream>() { |
| public FileInputStream run() throws Exception { |
| try { |
| if (file.exists()) { |
| return new FileInputStream(file); |
| } else { |
| return null; |
| } |
| } catch (FileNotFoundException e) { |
| // couldn't find it, oh well. |
| return null; |
| } |
| } |
| }); |
| } |
| |
| /** |
| * Returns the keystore with the configured CA certificates. |
| */ |
| static KeyStore getCacertsKeyStore(String dbgname) throws Exception |
| { |
| String storeFileName = null; |
| File storeFile = null; |
| FileInputStream fis = null; |
| String defaultTrustStoreType; |
| String defaultTrustStoreProvider; |
| final HashMap<String,String> props = new HashMap<>(); |
| final String sep = File.separator; |
| KeyStore ks = null; |
| |
| AccessController.doPrivileged(new PrivilegedExceptionAction<Void>() { |
| public Void run() throws Exception { |
| props.put("trustStore", System.getProperty( |
| "javax.net.ssl.trustStore")); |
| props.put("javaHome", System.getProperty( |
| "java.home")); |
| props.put("trustStoreType", System.getProperty( |
| "javax.net.ssl.trustStoreType", |
| KeyStore.getDefaultType())); |
| props.put("trustStoreProvider", System.getProperty( |
| "javax.net.ssl.trustStoreProvider", "")); |
| props.put("trustStorePasswd", System.getProperty( |
| "javax.net.ssl.trustStorePassword", "")); |
| return null; |
| } |
| }); |
| |
| /* |
| * Try: |
| * javax.net.ssl.trustStore (if this variable exists, stop) |
| * jssecacerts |
| * cacerts |
| * |
| * If none exists, we use an empty keystore. |
| */ |
| |
| storeFileName = props.get("trustStore"); |
| if (!"NONE".equals(storeFileName)) { |
| if (storeFileName != null) { |
| storeFile = new File(storeFileName); |
| fis = getFileInputStream(storeFile); |
| } else { |
| String javaHome = props.get("javaHome"); |
| storeFile = new File(javaHome + sep + "lib" + sep |
| + "security" + sep + |
| "jssecacerts"); |
| if ((fis = getFileInputStream(storeFile)) == null) { |
| storeFile = new File(javaHome + sep + "lib" + sep |
| + "security" + sep + |
| "cacerts"); |
| fis = getFileInputStream(storeFile); |
| } |
| } |
| |
| if (fis != null) { |
| storeFileName = storeFile.getPath(); |
| } else { |
| storeFileName = "No File Available, using empty keystore."; |
| } |
| } |
| |
| defaultTrustStoreType = props.get("trustStoreType"); |
| defaultTrustStoreProvider = props.get("trustStoreProvider"); |
| if (debug != null && Debug.isOn(dbgname)) { |
| System.out.println("trustStore is: " + storeFileName); |
| System.out.println("trustStore type is : " + |
| defaultTrustStoreType); |
| System.out.println("trustStore provider is : " + |
| defaultTrustStoreProvider); |
| } |
| |
| /* |
| * Try to initialize trust store. |
| */ |
| if (defaultTrustStoreType.length() != 0) { |
| if (debug != null && Debug.isOn(dbgname)) { |
| System.out.println("init truststore"); |
| } |
| if (defaultTrustStoreProvider.length() == 0) { |
| ks = KeyStore.getInstance(defaultTrustStoreType); |
| } else { |
| ks = KeyStore.getInstance(defaultTrustStoreType, |
| defaultTrustStoreProvider); |
| } |
| char[] passwd = null; |
| String defaultTrustStorePassword = props.get("trustStorePasswd"); |
| if (defaultTrustStorePassword.length() != 0) |
| passwd = defaultTrustStorePassword.toCharArray(); |
| |
| // if trustStore is NONE, fis will be null |
| ks.load(fis, passwd); |
| |
| // Zero out the temporary password storage |
| if (passwd != null) { |
| for (int i = 0; i < passwd.length; i++) { |
| passwd[i] = (char)0; |
| } |
| } |
| } |
| |
| if (fis != null) { |
| fis.close(); |
| } |
| |
| return ks; |
| } |
| |
| public static final class SimpleFactory extends TrustManagerFactoryImpl { |
| X509TrustManager getInstance(KeyStore ks) throws KeyStoreException { |
| return new X509TrustManagerImpl(Validator.TYPE_SIMPLE, ks); |
| } |
| X509TrustManager getInstance(ManagerFactoryParameters spec) |
| throws InvalidAlgorithmParameterException { |
| throw new InvalidAlgorithmParameterException |
| ("SunX509 TrustManagerFactory does not use " |
| + "ManagerFactoryParameters"); |
| } |
| } |
| |
| public static final class PKIXFactory extends TrustManagerFactoryImpl { |
| X509TrustManager getInstance(KeyStore ks) throws KeyStoreException { |
| return new X509TrustManagerImpl(Validator.TYPE_PKIX, ks); |
| } |
| X509TrustManager getInstance(ManagerFactoryParameters spec) |
| throws InvalidAlgorithmParameterException { |
| if (spec instanceof CertPathTrustManagerParameters == false) { |
| throw new InvalidAlgorithmParameterException |
| ("Parameters must be CertPathTrustManagerParameters"); |
| } |
| CertPathParameters params = |
| ((CertPathTrustManagerParameters)spec).getParameters(); |
| if (params instanceof PKIXBuilderParameters == false) { |
| throw new InvalidAlgorithmParameterException |
| ("Encapsulated parameters must be PKIXBuilderParameters"); |
| } |
| PKIXBuilderParameters pkixParams = (PKIXBuilderParameters)params; |
| return new X509TrustManagerImpl(Validator.TYPE_PKIX, pkixParams); |
| } |
| } |
| } |
