| /* |
| * Copyright (C) 2018 The Android Open Source Project |
| * |
| * Licensed under the Apache License, Version 2.0 (the "License"); |
| * you may not use this file except in compliance with the License. |
| * You may obtain a copy of the License at |
| * |
| * http://www.apache.org/licenses/LICENSE-2.0 |
| * |
| * Unless required by applicable law or agreed to in writing, software |
| * distributed under the License is distributed on an "AS IS" BASIS, |
| * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
| * See the License for the specific language governing permissions and |
| * limitations under the License. |
| */ |
| |
| package android.net.ipsec.ike; |
| |
| import android.annotation.IntDef; |
| import android.annotation.NonNull; |
| import android.net.ipsec.ike.exceptions.AuthenticationFailedException; |
| import android.os.PersistableBundle; |
| import android.util.ArraySet; |
| |
| import java.lang.annotation.Retention; |
| import java.lang.annotation.RetentionPolicy; |
| import java.security.cert.CertificateParsingException; |
| import java.security.cert.X509Certificate; |
| import java.util.Collection; |
| import java.util.List; |
| import java.util.Set; |
| |
| /** |
| * IkeIdentification is abstract base class that represents the common information for all types of |
| * IKE entity identification. |
| * |
| * <p>{@link IkeIdentification} is used in IKE authentication. |
| * |
| * @see <a href="https://tools.ietf.org/html/rfc7296#section-3.5">RFC 7296, Internet Key Exchange |
| * Protocol Version 2 (IKEv2)</a> |
| */ |
| public abstract class IkeIdentification { |
| // Set of supported ID types. |
| private static final Set<Integer> SUPPORTED_ID_TYPES; |
| |
| private static final int INDEX_SAN_TYPE = 0; |
| private static final int INDEX_SAN_DATA = 1; |
| |
| /** @hide */ |
| @Retention(RetentionPolicy.SOURCE) |
| @IntDef({ |
| ID_TYPE_IPV4_ADDR, |
| ID_TYPE_FQDN, |
| ID_TYPE_RFC822_ADDR, |
| ID_TYPE_IPV6_ADDR, |
| ID_TYPE_DER_ASN1_DN, |
| ID_TYPE_KEY_ID |
| }) |
| public @interface IdType {} |
| |
| /** @hide */ |
| public static final int ID_TYPE_IPV4_ADDR = 1; |
| /** @hide */ |
| public static final int ID_TYPE_FQDN = 2; |
| /** @hide */ |
| public static final int ID_TYPE_RFC822_ADDR = 3; |
| /** @hide */ |
| public static final int ID_TYPE_IPV6_ADDR = 5; |
| /** @hide */ |
| public static final int ID_TYPE_DER_ASN1_DN = 9; |
| /** @hide */ |
| public static final int ID_TYPE_KEY_ID = 11; |
| |
| static { |
| SUPPORTED_ID_TYPES = new ArraySet(); |
| SUPPORTED_ID_TYPES.add(ID_TYPE_IPV4_ADDR); |
| SUPPORTED_ID_TYPES.add(ID_TYPE_FQDN); |
| SUPPORTED_ID_TYPES.add(ID_TYPE_RFC822_ADDR); |
| SUPPORTED_ID_TYPES.add(ID_TYPE_IPV6_ADDR); |
| SUPPORTED_ID_TYPES.add(ID_TYPE_DER_ASN1_DN); |
| SUPPORTED_ID_TYPES.add(ID_TYPE_KEY_ID); |
| } |
| |
| /** @hide Subject Alternative Name Type for RFC822 Email Address defined in RFC 5280 */ |
| protected static final int SAN_TYPE_RFC822_NAME = 1; |
| /** @hide Subject Alternative Name Type for DNS Name defined in RFC 5280 */ |
| protected static final int SAN_TYPE_DNS = 2; |
| /** @hide Subject Alternative Name Type for IP Address defined in RFC 5280 */ |
| protected static final int SAN_TYPE_IP_ADDRESS = 7; |
| |
| private static final String ID_TYPE_KEY = "idType"; |
| /** @hide */ |
| public final int idType; |
| |
| /** @hide */ |
| protected IkeIdentification(@IdType int type) { |
| idType = type; |
| } |
| |
| /** |
| * Constructs this object by deserializing a PersistableBundle |
| * |
| * @hide |
| */ |
| @NonNull |
| public static IkeIdentification fromPersistableBundle(@NonNull PersistableBundle in) { |
| int idType = in.getInt(ID_TYPE_KEY); |
| switch (idType) { |
| case ID_TYPE_IPV4_ADDR: |
| return IkeIpv4AddrIdentification.fromPersistableBundle(in); |
| case ID_TYPE_FQDN: |
| return IkeFqdnIdentification.fromPersistableBundle(in); |
| case ID_TYPE_RFC822_ADDR: |
| return IkeRfc822AddrIdentification.fromPersistableBundle(in); |
| case ID_TYPE_IPV6_ADDR: |
| return IkeIpv6AddrIdentification.fromPersistableBundle(in); |
| case ID_TYPE_DER_ASN1_DN: |
| return IkeDerAsn1DnIdentification.fromPersistableBundle(in); |
| case ID_TYPE_KEY_ID: |
| return IkeKeyIdIdentification.fromPersistableBundle(in); |
| default: |
| throw new IllegalArgumentException("Invalid ID type: " + idType); |
| } |
| } |
| |
| /** |
| * Serializes this object to a PersistableBundle |
| * |
| * @hide |
| */ |
| @NonNull |
| public PersistableBundle toPersistableBundle() { |
| final PersistableBundle result = new PersistableBundle(); |
| result.putInt(ID_TYPE_KEY, idType); |
| return result; |
| } |
| |
| /** |
| * Returns ID type as a String |
| * |
| * @hide |
| */ |
| public abstract String getIdTypeString(); |
| |
| /** |
| * Check if the end certificate's subject DN or SAN matches this identification |
| * |
| * @hide |
| */ |
| public abstract void validateEndCertIdOrThrow(X509Certificate endCert) |
| throws AuthenticationFailedException; |
| |
| /** |
| * Check if the end certificate SAN matches the identification |
| * |
| * <p>According to RFC 7296, the received IKE ID that types are FQDN, IPv4/IPv6 Address and |
| * RFC822 Address should match the end certificate Subject Alternative Name (SAN). |
| * |
| * @hide |
| */ |
| protected void validateEndCertSanOrThrow( |
| X509Certificate endCert, int expectedSanType, Object expectedSanData) |
| throws AuthenticationFailedException { |
| try { |
| // Each List is one SAN whose first entry is an Integer that represents a SAN type and |
| // second entry is a String or a byte array that represents the SAN data |
| Collection<List<?>> allSans = endCert.getSubjectAlternativeNames(); |
| if (allSans == null) { |
| throw new AuthenticationFailedException("End certificate does not contain SAN"); |
| } |
| |
| for (List<?> san : allSans) { |
| if ((Integer) san.get(INDEX_SAN_TYPE) == expectedSanType) { |
| Object item = san.get(INDEX_SAN_DATA); |
| if (expectedSanData.equals(item)) { |
| return; |
| } |
| } |
| } |
| throw new AuthenticationFailedException( |
| "End certificate SAN and " + getIdTypeString() + " ID mismatched"); |
| } catch (CertificateParsingException e) { |
| throw new AuthenticationFailedException(e); |
| } |
| } |
| /** |
| * Return the encoded identification data in a byte array. |
| * |
| * @return the encoded identification data. |
| * @hide |
| */ |
| public abstract byte[] getEncodedIdData(); |
| } |