Home | History | Annotate | Download | only in http 
      1 /*
      2  * Copyright (C) 2012 The Android Open Source Project
      3  *
      4  * Licensed under the Apache License, Version 2.0 (the "License");
      5  * you may not use this file except in compliance with the License.
      6  * You may obtain a copy of the License at
      7  *
      8  *      http://www.apache.org/licenses/LICENSE-2.0
      9  *
     10  * Unless required by applicable law or agreed to in writing, software
     11  * distributed under the License is distributed on an "AS IS" BASIS,
     12  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
     13  * See the License for the specific language governing permissions and
     14  * limitations under the License.
     15  */
     16 
     17 package android.net.http;
     18 
     19 import android.annotation.SystemApi;
     20 import android.security.net.config.UserCertificateSource;
     21 
     22 import com.android.org.conscrypt.TrustManagerImpl;
     23 
     24 import java.lang.reflect.Field;
     25 import java.lang.reflect.InvocationTargetException;
     26 import java.lang.reflect.Method;
     27 import java.security.cert.CertificateException;
     28 import java.security.cert.X509Certificate;
     29 import java.util.List;
     30 
     31 import javax.net.ssl.X509TrustManager;
     32 
     33 /**
     34  * X509TrustManager wrapper exposing Android-added features.
     35  * <p>
     36  * The checkServerTrusted method allows callers to perform additional
     37  * verification of certificate chains after they have been successfully verified
     38  * by the platform.
     39  * </p>
     40  */
     41 public class X509TrustManagerExtensions {
     42 
     43     private final TrustManagerImpl mDelegate;
     44     // Methods to use when mDelegate is not a TrustManagerImpl and duck typing is being used.
     45     private final X509TrustManager mTrustManager;
     46     private final Method mCheckServerTrusted;
     47     private final Method mIsSameTrustConfiguration;
     48 
     49     /**
     50      * Constructs a new X509TrustManagerExtensions wrapper.
     51      *
     52      * @param tm A {@link X509TrustManager} as returned by TrustManagerFactory.getInstance();
     53      * @throws IllegalArgumentException If tm is an unsupported TrustManager type.
     54      */
     55     public X509TrustManagerExtensions(X509TrustManager tm) throws IllegalArgumentException {
     56         if (tm instanceof TrustManagerImpl) {
     57             mDelegate = (TrustManagerImpl) tm;
     58             mTrustManager = null;
     59             mCheckServerTrusted = null;
     60             mIsSameTrustConfiguration = null;
     61             return;
     62         }
     63         // Use duck typing if possible.
     64         mDelegate = null;
     65         mTrustManager = tm;
     66         // Check that the hostname aware checkServerTrusted is present.
     67         try {
     68             mCheckServerTrusted = tm.getClass().getMethod("checkServerTrusted",
     69                     X509Certificate[].class,
     70                     String.class,
     71                     String.class);
     72         } catch (NoSuchMethodException e) {
     73             throw new IllegalArgumentException("Required method"
     74                     + " checkServerTrusted(X509Certificate[], String, String, String) missing");
     75         }
     76         // Get the option isSameTrustConfiguration method.
     77         Method isSameTrustConfiguration = null;
     78         try {
     79             isSameTrustConfiguration = tm.getClass().getMethod("isSameTrustConfiguration",
     80                     String.class,
     81                     String.class);
     82         } catch (ReflectiveOperationException ignored) {
     83         }
     84         mIsSameTrustConfiguration = isSameTrustConfiguration;
     85     }
     86 
     87     /**
     88      * Verifies the given certificate chain.
     89      *
     90      * <p>See {@link X509TrustManager#checkServerTrusted(X509Certificate[], String)} for a
     91      * description of the chain and authType parameters. The final parameter, host, should be the
     92      * hostname of the server.</p>
     93      *
     94      * @throws CertificateException if the chain does not verify correctly.
     95      * @return the properly ordered chain used for verification as a list of X509Certificates.
     96      */
     97     public List<X509Certificate> checkServerTrusted(X509Certificate[] chain, String authType,
     98                                                     String host) throws CertificateException {
     99         if (mDelegate != null) {
    100             return mDelegate.checkServerTrusted(chain, authType, host);
    101         } else {
    102             try {
    103                 return (List<X509Certificate>) mCheckServerTrusted.invoke(mTrustManager, chain,
    104                         authType, host);
    105             } catch (IllegalAccessException e) {
    106                 throw new CertificateException("Failed to call checkServerTrusted", e);
    107             } catch (InvocationTargetException e) {
    108                 if (e.getCause() instanceof CertificateException) {
    109                     throw (CertificateException) e.getCause();
    110                 }
    111                 if (e.getCause() instanceof RuntimeException) {
    112                     throw (RuntimeException) e.getCause();
    113                 }
    114                 throw new CertificateException("checkServerTrusted failed", e.getCause());
    115             }
    116         }
    117     }
    118 
    119     /**
    120      * Checks whether a CA certificate is added by an user.
    121      *
    122      * <p>Since {@link X509TrustManager#checkServerTrusted} may allow its parameter {@code chain} to
    123      * chain up to user-added CA certificates, this method can be used to perform additional
    124      * policies for user-added CA certificates.
    125      *
    126      * @return {@code true} to indicate that the certificate authority exists in the user added
    127      * certificate store, {@code false} otherwise.
    128      */
    129     public boolean isUserAddedCertificate(X509Certificate cert) {
    130         return UserCertificateSource.getInstance().findBySubjectAndPublicKey(cert) != null;
    131     }
    132 
    133     /**
    134      * Returns {@code true} if the TrustManager uses the same trust configuration for the provided
    135      * hostnames.
    136      *
    137      * @hide
    138      */
    139     @SystemApi
    140     public boolean isSameTrustConfiguration(String hostname1, String hostname2) {
    141         if (mIsSameTrustConfiguration == null) {
    142             return true;
    143         }
    144         try {
    145             return (Boolean) mIsSameTrustConfiguration.invoke(mTrustManager, hostname1, hostname2);
    146         } catch (IllegalAccessException e) {
    147             throw new RuntimeException("Failed to call isSameTrustConfiguration", e);
    148         } catch (InvocationTargetException e) {
    149             if (e.getCause() instanceof RuntimeException) {
    150                 throw (RuntimeException) e.getCause();
    151             } else {
    152                 throw new RuntimeException("isSameTrustConfiguration failed", e.getCause());
    153             }
    154         }
    155     }
    156 }
    157