Home | History | Annotate | Download | only in certpath 
      1 /*
      2  * Copyright (c) 2000, 2012, Oracle and/or its affiliates. All rights reserved.
      3  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
      4  *
      5  * This code is free software; you can redistribute it and/or modify it
      6  * under the terms of the GNU General Public License version 2 only, as
      7  * published by the Free Software Foundation.  Oracle designates this
      8  * particular file as subject to the "Classpath" exception as provided
      9  * by Oracle in the LICENSE file that accompanied this code.
     10  *
     11  * This code is distributed in the hope that it will be useful, but WITHOUT
     12  * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
     13  * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
     14  * version 2 for more details (a copy is included in the LICENSE file that
     15  * accompanied this code).
     16  *
     17  * You should have received a copy of the GNU General Public License version
     18  * 2 along with this work; if not, write to the Free Software Foundation,
     19  * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
     20  *
     21  * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
     22  * or visit www.oracle.com if you need additional information or have any
     23  * questions.
     24  */
     25 
     26 package sun.security.provider.certpath;
     27 
     28 import sun.security.util.Debug;
     29 
     30 import java.util.Collections;
     31 import java.util.List;
     32 import java.util.Set;
     33 import java.security.cert.CertPath;
     34 import java.security.cert.CertPathValidatorException;
     35 import java.security.cert.PKIXCertPathChecker;
     36 import java.security.cert.PKIXReason;
     37 import java.security.cert.X509Certificate;
     38 
     39 /**
     40  * This class is initialized with a list of <code>PKIXCertPathChecker</code>s
     41  * and is used to verify the certificates in a <code>CertPath</code> by
     42  * feeding each certificate to each <code>PKIXCertPathChecker</code>.
     43  *
     44  * @since       1.4
     45  * @author      Yassir Elley
     46  */
     47 class PKIXMasterCertPathValidator {
     48 
     49     private static final Debug debug = Debug.getInstance("certpath");
     50 
     51     /**
     52      * Validates a certification path consisting exclusively of
     53      * <code>X509Certificate</code>s using the specified
     54      * <code>PKIXCertPathChecker</code>s. It is assumed that the
     55      * <code>PKIXCertPathChecker</code>s
     56      * have been initialized with any input parameters they may need.
     57      *
     58      * @param cpOriginal the original X509 CertPath passed in by the user
     59      * @param reversedCertList the reversed X509 CertPath (as a List)
     60      * @param certPathCheckers the PKIXCertPathCheckers
     61      * @throws CertPathValidatorException if cert path does not validate
     62      */
     63     static void validate(CertPath cpOriginal,
     64                          List<X509Certificate> reversedCertList,
     65                          List<PKIXCertPathChecker> certPathCheckers)
     66         throws CertPathValidatorException
     67     {
     68         // we actually process reversedCertList, but we keep cpOriginal because
     69         // we need to return the original certPath when we throw an exception.
     70         // we will also need to modify the index appropriately when we
     71         // throw an exception.
     72 
     73         int cpSize = reversedCertList.size();
     74 
     75         if (debug != null) {
     76             debug.println("--------------------------------------------------"
     77                   + "------------");
     78             debug.println("Executing PKIX certification path validation "
     79                   + "algorithm.");
     80         }
     81 
     82         for (int i = 0; i < cpSize; i++) {
     83 
     84             /* The basic loop algorithm is that we get the
     85              * current certificate, we verify the current certificate using
     86              * information from the previous certificate and from the state,
     87              * and we modify the state for the next loop by setting the
     88              * current certificate of this loop to be the previous certificate
     89              * of the next loop. The state is initialized during first loop.
     90              */
     91             if (debug != null)
     92                 debug.println("Checking cert" + (i+1) + " ...");
     93 
     94             X509Certificate currCert = reversedCertList.get(i);
     95             Set<String> unresCritExts = currCert.getCriticalExtensionOIDs();
     96             if (unresCritExts == null) {
     97                 unresCritExts = Collections.<String>emptySet();
     98             }
     99 
    100             if (debug != null && !unresCritExts.isEmpty()) {
    101                 debug.println("Set of critical extensions:");
    102                 for (String oid : unresCritExts) {
    103                     debug.println(oid);
    104                 }
    105             }
    106 
    107             for (int j = 0; j < certPathCheckers.size(); j++) {
    108 
    109                 PKIXCertPathChecker currChecker = certPathCheckers.get(j);
    110                 if (debug != null) {
    111                     debug.println("-Using checker" + (j + 1) + " ... [" +
    112                         currChecker.getClass().getName() + "]");
    113                 }
    114 
    115                 if (i == 0)
    116                     currChecker.init(false);
    117 
    118                 try {
    119                     currChecker.check(currCert, unresCritExts);
    120 
    121                     if (debug != null) {
    122                         debug.println("-checker" + (j + 1) +
    123                             " validation succeeded");
    124                     }
    125 
    126                 } catch (CertPathValidatorException cpve) {
    127                     throw new CertPathValidatorException(cpve.getMessage(),
    128                         cpve.getCause(), cpOriginal, cpSize - (i + 1),
    129                         cpve.getReason());
    130                 }
    131             }
    132 
    133             if (!unresCritExts.isEmpty()) {
    134                 throw new CertPathValidatorException("unrecognized " +
    135                     "critical extension(s)", null, cpOriginal, cpSize-(i+1),
    136                     PKIXReason.UNRECOGNIZED_CRIT_EXT);
    137             }
    138 
    139             if (debug != null)
    140                 debug.println("\ncert" + (i+1) + " validation succeeded.\n");
    141         }
    142 
    143         if (debug != null) {
    144             debug.println("Cert path validation succeeded. (PKIX validation "
    145                           + "algorithm)");
    146             debug.println("-------------------------------------------------"
    147                           + "-------------");
    148         }
    149     }
    150 }
    151