1 |
14 |
jlechner |
/* PKIXCertPathValidatorImpl.java -- PKIX certificate path validator.
|
2 |
|
|
Copyright (C) 2004, 2005 Free Software Foundation, Inc.
|
3 |
|
|
|
4 |
|
|
This file is part of GNU Classpath.
|
5 |
|
|
|
6 |
|
|
GNU Classpath is free software; you can redistribute it and/or modify
|
7 |
|
|
it under the terms of the GNU General Public License as published by
|
8 |
|
|
the Free Software Foundation; either version 2, or (at your option)
|
9 |
|
|
any later version.
|
10 |
|
|
|
11 |
|
|
GNU Classpath is distributed in the hope that it will be useful, but
|
12 |
|
|
WITHOUT ANY WARRANTY; without even the implied warranty of
|
13 |
|
|
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
|
14 |
|
|
General Public License for more details.
|
15 |
|
|
|
16 |
|
|
You should have received a copy of the GNU General Public License
|
17 |
|
|
along with GNU Classpath; see the file COPYING. If not, write to the
|
18 |
|
|
Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
|
19 |
|
|
02110-1301 USA.
|
20 |
|
|
|
21 |
|
|
Linking this library statically or dynamically with other modules is
|
22 |
|
|
making a combined work based on this library. Thus, the terms and
|
23 |
|
|
conditions of the GNU General Public License cover the whole
|
24 |
|
|
combination.
|
25 |
|
|
|
26 |
|
|
As a special exception, the copyright holders of this library give you
|
27 |
|
|
permission to link this library with independent modules to produce an
|
28 |
|
|
executable, regardless of the license terms of these independent
|
29 |
|
|
modules, and to copy and distribute the resulting executable under
|
30 |
|
|
terms of your choice, provided that you also meet, for each linked
|
31 |
|
|
independent module, the terms and conditions of the license of that
|
32 |
|
|
module. An independent module is a module which is not derived from
|
33 |
|
|
or based on this library. If you modify this library, you may extend
|
34 |
|
|
this exception to your version of the library, but you are not
|
35 |
|
|
obligated to do so. If you do not wish to do so, delete this
|
36 |
|
|
exception statement from your version. */
|
37 |
|
|
|
38 |
|
|
|
39 |
|
|
package gnu.java.security.provider;
|
40 |
|
|
|
41 |
|
|
import gnu.java.security.OID;
|
42 |
|
|
import gnu.java.security.x509.GnuPKIExtension;
|
43 |
|
|
import gnu.java.security.x509.PolicyNodeImpl;
|
44 |
|
|
import gnu.java.security.x509.X509CRLSelectorImpl;
|
45 |
|
|
import gnu.java.security.x509.X509CertSelectorImpl;
|
46 |
|
|
import gnu.java.security.x509.ext.BasicConstraints;
|
47 |
|
|
import gnu.java.security.x509.ext.CertificatePolicies;
|
48 |
|
|
import gnu.java.security.x509.ext.Extension;
|
49 |
|
|
import gnu.java.security.x509.ext.KeyUsage;
|
50 |
|
|
import gnu.java.security.x509.ext.PolicyConstraint;
|
51 |
|
|
|
52 |
|
|
import java.io.IOException;
|
53 |
|
|
import java.security.InvalidAlgorithmParameterException;
|
54 |
|
|
import java.security.InvalidKeyException;
|
55 |
|
|
import java.security.PublicKey;
|
56 |
|
|
import java.security.cert.CRL;
|
57 |
|
|
import java.security.cert.CertPath;
|
58 |
|
|
import java.security.cert.CertPathParameters;
|
59 |
|
|
import java.security.cert.CertPathValidatorException;
|
60 |
|
|
import java.security.cert.CertPathValidatorResult;
|
61 |
|
|
import java.security.cert.CertPathValidatorSpi;
|
62 |
|
|
import java.security.cert.CertStore;
|
63 |
|
|
import java.security.cert.CertStoreException;
|
64 |
|
|
import java.security.cert.CertificateException;
|
65 |
|
|
import java.security.cert.PKIXCertPathChecker;
|
66 |
|
|
import java.security.cert.PKIXCertPathValidatorResult;
|
67 |
|
|
import java.security.cert.PKIXParameters;
|
68 |
|
|
import java.security.cert.TrustAnchor;
|
69 |
|
|
import java.security.cert.X509CRL;
|
70 |
|
|
import java.security.cert.X509Certificate;
|
71 |
|
|
import java.security.interfaces.DSAParams;
|
72 |
|
|
import java.security.interfaces.DSAPublicKey;
|
73 |
|
|
import java.util.Arrays;
|
74 |
|
|
import java.util.Collection;
|
75 |
|
|
import java.util.Collections;
|
76 |
|
|
import java.util.Date;
|
77 |
|
|
import java.util.HashSet;
|
78 |
|
|
import java.util.Iterator;
|
79 |
|
|
import java.util.LinkedList;
|
80 |
|
|
import java.util.List;
|
81 |
|
|
import java.util.Set;
|
82 |
|
|
|
83 |
|
|
/**
|
84 |
|
|
* An implementation of the Public Key Infrastructure's X.509
|
85 |
|
|
* certificate path validation algorithm.
|
86 |
|
|
*
|
87 |
|
|
* <p>See <a href="http://www.ietf.org/rfc/rfc3280.txt">RFC 3280:
|
88 |
|
|
* Internet X.509 Public Key Infrastructure Certificate and
|
89 |
|
|
* Certificate Revocation List (CRL) Profile</a>.
|
90 |
|
|
*
|
91 |
|
|
* @author Casey Marshall (rsdio@metastatic.org)
|
92 |
|
|
*/
|
93 |
|
|
public class PKIXCertPathValidatorImpl extends CertPathValidatorSpi
|
94 |
|
|
{
|
95 |
|
|
|
96 |
|
|
// Constants.
|
97 |
|
|
// -------------------------------------------------------------------------
|
98 |
|
|
|
99 |
|
|
private static final boolean DEBUG = false;
|
100 |
|
|
private static void debug (String msg)
|
101 |
|
|
{
|
102 |
|
|
System.err.print (">> PKIXCertPathValidatorImpl: ");
|
103 |
|
|
System.err.println (msg);
|
104 |
|
|
}
|
105 |
|
|
|
106 |
|
|
public static final String ANY_POLICY = "2.5.29.32.0";
|
107 |
|
|
|
108 |
|
|
// Constructor.
|
109 |
|
|
// -------------------------------------------------------------------------
|
110 |
|
|
|
111 |
|
|
public PKIXCertPathValidatorImpl()
|
112 |
|
|
{
|
113 |
|
|
super();
|
114 |
|
|
}
|
115 |
|
|
|
116 |
|
|
// Instance methods.
|
117 |
|
|
// -------------------------------------------------------------------------
|
118 |
|
|
|
119 |
|
|
public CertPathValidatorResult engineValidate(CertPath path,
|
120 |
|
|
CertPathParameters params)
|
121 |
|
|
throws CertPathValidatorException, InvalidAlgorithmParameterException
|
122 |
|
|
{
|
123 |
|
|
if (!(params instanceof PKIXParameters))
|
124 |
|
|
throw new InvalidAlgorithmParameterException("not a PKIXParameters object");
|
125 |
|
|
|
126 |
|
|
// First check if the certificate path is valid.
|
127 |
|
|
//
|
128 |
|
|
// This means that:
|
129 |
|
|
//
|
130 |
|
|
// (a) for all x in {1, ..., n-1}, the subject of certificate x is
|
131 |
|
|
// the issuer of certificate x+1;
|
132 |
|
|
//
|
133 |
|
|
// (b) for all x in {1, ..., n}, the certificate was valid at the
|
134 |
|
|
// time in question.
|
135 |
|
|
//
|
136 |
|
|
// Because this is the X.509 algorithm, we also check if all
|
137 |
|
|
// cerificates are of type X509Certificate.
|
138 |
|
|
|
139 |
|
|
PolicyNodeImpl rootNode = new PolicyNodeImpl();
|
140 |
|
|
Set initPolicies = ((PKIXParameters) params).getInitialPolicies();
|
141 |
|
|
rootNode.setValidPolicy(ANY_POLICY);
|
142 |
|
|
rootNode.setCritical(false);
|
143 |
|
|
rootNode.setDepth(0);
|
144 |
|
|
if (initPolicies != null)
|
145 |
|
|
rootNode.addAllExpectedPolicies(initPolicies);
|
146 |
|
|
else
|
147 |
|
|
rootNode.addExpectedPolicy(ANY_POLICY);
|
148 |
|
|
List checks = ((PKIXParameters) params).getCertPathCheckers();
|
149 |
|
|
List l = path.getCertificates();
|
150 |
|
|
if (l == null || l.size() == 0)
|
151 |
|
|
throw new CertPathValidatorException();
|
152 |
|
|
X509Certificate[] p = null;
|
153 |
|
|
try
|
154 |
|
|
{
|
155 |
|
|
p = (X509Certificate[]) l.toArray(new X509Certificate[l.size()]);
|
156 |
|
|
}
|
157 |
|
|
catch (ClassCastException cce)
|
158 |
|
|
{
|
159 |
|
|
throw new CertPathValidatorException("invalid certificate path");
|
160 |
|
|
}
|
161 |
|
|
|
162 |
|
|
String sigProvider = ((PKIXParameters) params).getSigProvider();
|
163 |
|
|
PublicKey prevKey = null;
|
164 |
|
|
Date now = ((PKIXParameters) params).getDate();
|
165 |
|
|
if (now == null)
|
166 |
|
|
now = new Date();
|
167 |
|
|
LinkedList policyConstraints = new LinkedList();
|
168 |
|
|
for (int i = p.length - 1; i >= 0; i--)
|
169 |
|
|
{
|
170 |
|
|
try
|
171 |
|
|
{
|
172 |
|
|
p[i].checkValidity(now);
|
173 |
|
|
}
|
174 |
|
|
catch (CertificateException ce)
|
175 |
|
|
{
|
176 |
|
|
throw new CertPathValidatorException(ce.toString());
|
177 |
|
|
}
|
178 |
|
|
Set uce = getCritExts(p[i]);
|
179 |
|
|
for (Iterator check = checks.iterator(); check.hasNext(); )
|
180 |
|
|
{
|
181 |
|
|
try
|
182 |
|
|
{
|
183 |
|
|
((PKIXCertPathChecker) check.next()).check(p[i], uce);
|
184 |
|
|
}
|
185 |
|
|
catch (Exception x)
|
186 |
|
|
{
|
187 |
|
|
}
|
188 |
|
|
}
|
189 |
|
|
|
190 |
|
|
PolicyConstraint constr = null;
|
191 |
|
|
if (p[i] instanceof GnuPKIExtension)
|
192 |
|
|
{
|
193 |
|
|
Extension pcx =
|
194 |
|
|
((GnuPKIExtension) p[i]).getExtension (PolicyConstraint.ID);
|
195 |
|
|
if (pcx != null)
|
196 |
|
|
constr = (PolicyConstraint) pcx.getValue();
|
197 |
|
|
}
|
198 |
|
|
else
|
199 |
|
|
{
|
200 |
|
|
byte[] pcx = p[i].getExtensionValue (PolicyConstraint.ID.toString());
|
201 |
|
|
if (pcx != null)
|
202 |
|
|
{
|
203 |
|
|
try
|
204 |
|
|
{
|
205 |
|
|
constr = new PolicyConstraint (pcx);
|
206 |
|
|
}
|
207 |
|
|
catch (Exception x)
|
208 |
|
|
{
|
209 |
|
|
}
|
210 |
|
|
}
|
211 |
|
|
}
|
212 |
|
|
if (constr != null && constr.getRequireExplicitPolicy() >= 0)
|
213 |
|
|
{
|
214 |
|
|
policyConstraints.add (new int[]
|
215 |
|
|
{ p.length-i, constr.getRequireExplicitPolicy() });
|
216 |
|
|
}
|
217 |
|
|
|
218 |
|
|
updatePolicyTree(p[i], rootNode, p.length-i, (PKIXParameters) params,
|
219 |
|
|
checkExplicitPolicy (p.length-i, policyConstraints));
|
220 |
|
|
|
221 |
|
|
// The rest of the tests involve this cert's relationship with the
|
222 |
|
|
// next in the path. If this cert is the end entity, we can stop.
|
223 |
|
|
if (i == 0)
|
224 |
|
|
break;
|
225 |
|
|
|
226 |
|
|
basicSanity(p, i);
|
227 |
|
|
PublicKey pubKey = null;
|
228 |
|
|
try
|
229 |
|
|
{
|
230 |
|
|
pubKey = p[i].getPublicKey();
|
231 |
|
|
if (pubKey instanceof DSAPublicKey)
|
232 |
|
|
{
|
233 |
|
|
DSAParams dsa = ((DSAPublicKey) pubKey).getParams();
|
234 |
|
|
// If the DSA public key is missing its parameters, use those
|
235 |
|
|
// from the previous cert's key.
|
236 |
|
|
if (dsa == null || dsa.getP() == null || dsa.getG() == null
|
237 |
|
|
|| dsa.getQ() == null)
|
238 |
|
|
{
|
239 |
|
|
if (prevKey == null)
|
240 |
|
|
throw new InvalidKeyException("DSA keys not chainable");
|
241 |
|
|
if (!(prevKey instanceof DSAPublicKey))
|
242 |
|
|
throw new InvalidKeyException("DSA keys not chainable");
|
243 |
|
|
dsa = ((DSAPublicKey) prevKey).getParams();
|
244 |
|
|
pubKey = new GnuDSAPublicKey(((DSAPublicKey) pubKey).getY(),
|
245 |
|
|
dsa.getP(), dsa.getQ(), dsa.getG());
|
246 |
|
|
}
|
247 |
|
|
}
|
248 |
|
|
if (sigProvider == null)
|
249 |
|
|
p[i-1].verify(pubKey);
|
250 |
|
|
else
|
251 |
|
|
p[i-1].verify(pubKey, sigProvider);
|
252 |
|
|
prevKey = pubKey;
|
253 |
|
|
}
|
254 |
|
|
catch (Exception e)
|
255 |
|
|
{
|
256 |
|
|
throw new CertPathValidatorException(e.toString());
|
257 |
|
|
}
|
258 |
|
|
if (!p[i].getSubjectDN().equals(p[i-1].getIssuerDN()))
|
259 |
|
|
throw new CertPathValidatorException("issuer DN mismatch");
|
260 |
|
|
boolean[] issuerUid = p[i-1].getIssuerUniqueID();
|
261 |
|
|
boolean[] subjectUid = p[i].getSubjectUniqueID();
|
262 |
|
|
if (issuerUid != null && subjectUid != null)
|
263 |
|
|
if (!Arrays.equals(issuerUid, subjectUid))
|
264 |
|
|
throw new CertPathValidatorException("UID mismatch");
|
265 |
|
|
|
266 |
|
|
// Check the certificate against the revocation lists.
|
267 |
|
|
if (((PKIXParameters) params).isRevocationEnabled())
|
268 |
|
|
{
|
269 |
|
|
X509CRLSelectorImpl selector = new X509CRLSelectorImpl();
|
270 |
|
|
try
|
271 |
|
|
{
|
272 |
|
|
selector.addIssuerName(p[i].getSubjectDN());
|
273 |
|
|
}
|
274 |
|
|
catch (IOException ioe)
|
275 |
|
|
{
|
276 |
|
|
throw new CertPathValidatorException("error selecting CRLs");
|
277 |
|
|
}
|
278 |
|
|
List certStores = ((PKIXParameters) params).getCertStores();
|
279 |
|
|
List crls = new LinkedList();
|
280 |
|
|
for (Iterator it = certStores.iterator(); it.hasNext(); )
|
281 |
|
|
{
|
282 |
|
|
CertStore cs = (CertStore) it.next();
|
283 |
|
|
try
|
284 |
|
|
{
|
285 |
|
|
Collection c = cs.getCRLs(selector);
|
286 |
|
|
crls.addAll(c);
|
287 |
|
|
}
|
288 |
|
|
catch (CertStoreException cse)
|
289 |
|
|
{
|
290 |
|
|
}
|
291 |
|
|
}
|
292 |
|
|
if (crls.isEmpty())
|
293 |
|
|
throw new CertPathValidatorException("no CRLs for issuer");
|
294 |
|
|
boolean certOk = false;
|
295 |
|
|
for (Iterator it = crls.iterator(); it.hasNext(); )
|
296 |
|
|
{
|
297 |
|
|
CRL crl = (CRL) it.next();
|
298 |
|
|
if (!(crl instanceof X509CRL))
|
299 |
|
|
continue;
|
300 |
|
|
X509CRL xcrl = (X509CRL) crl;
|
301 |
|
|
if (!checkCRL(xcrl, p, now, p[i], pubKey, certStores))
|
302 |
|
|
continue;
|
303 |
|
|
if (xcrl.isRevoked(p[i-1]))
|
304 |
|
|
throw new CertPathValidatorException("certificate is revoked");
|
305 |
|
|
else
|
306 |
|
|
certOk = true;
|
307 |
|
|
}
|
308 |
|
|
if (!certOk)
|
309 |
|
|
throw new CertPathValidatorException("certificate's validity could not be determined");
|
310 |
|
|
}
|
311 |
|
|
}
|
312 |
|
|
rootNode.setReadOnly();
|
313 |
|
|
|
314 |
|
|
// Now ensure that the first certificate in the chain was issued
|
315 |
|
|
// by a trust anchor.
|
316 |
|
|
Exception cause = null;
|
317 |
|
|
Set anchors = ((PKIXParameters) params).getTrustAnchors();
|
318 |
|
|
for (Iterator i = anchors.iterator(); i.hasNext(); )
|
319 |
|
|
{
|
320 |
|
|
TrustAnchor anchor = (TrustAnchor) i.next();
|
321 |
|
|
X509Certificate anchorCert = null;
|
322 |
|
|
PublicKey anchorKey = null;
|
323 |
|
|
if (anchor.getTrustedCert() != null)
|
324 |
|
|
{
|
325 |
|
|
anchorCert = anchor.getTrustedCert();
|
326 |
|
|
anchorKey = anchorCert.getPublicKey();
|
327 |
|
|
}
|
328 |
|
|
else
|
329 |
|
|
anchorKey = anchor.getCAPublicKey();
|
330 |
|
|
if (anchorKey == null)
|
331 |
|
|
continue;
|
332 |
|
|
try
|
333 |
|
|
{
|
334 |
|
|
if (anchorCert != null)
|
335 |
|
|
anchorCert.checkValidity(now);
|
336 |
|
|
p[p.length-1].verify(anchorKey);
|
337 |
|
|
if (anchorCert != null && anchorCert.getBasicConstraints() >= 0
|
338 |
|
|
&& anchorCert.getBasicConstraints() < p.length)
|
339 |
|
|
continue;
|
340 |
|
|
|
341 |
|
|
if (((PKIXParameters) params).isRevocationEnabled())
|
342 |
|
|
{
|
343 |
|
|
X509CRLSelectorImpl selector = new X509CRLSelectorImpl();
|
344 |
|
|
if (anchorCert != null)
|
345 |
|
|
try
|
346 |
|
|
{
|
347 |
|
|
selector.addIssuerName(anchorCert.getSubjectDN());
|
348 |
|
|
}
|
349 |
|
|
catch (IOException ioe)
|
350 |
|
|
{
|
351 |
|
|
}
|
352 |
|
|
else
|
353 |
|
|
selector.addIssuerName(anchor.getCAName());
|
354 |
|
|
List certStores = ((PKIXParameters) params).getCertStores();
|
355 |
|
|
List crls = new LinkedList();
|
356 |
|
|
for (Iterator it = certStores.iterator(); it.hasNext(); )
|
357 |
|
|
{
|
358 |
|
|
CertStore cs = (CertStore) it.next();
|
359 |
|
|
try
|
360 |
|
|
{
|
361 |
|
|
Collection c = cs.getCRLs(selector);
|
362 |
|
|
crls.addAll(c);
|
363 |
|
|
}
|
364 |
|
|
catch (CertStoreException cse)
|
365 |
|
|
{
|
366 |
|
|
}
|
367 |
|
|
}
|
368 |
|
|
if (crls.isEmpty())
|
369 |
|
|
continue;
|
370 |
|
|
for (Iterator it = crls.iterator(); it.hasNext(); )
|
371 |
|
|
{
|
372 |
|
|
CRL crl = (CRL) it.next();
|
373 |
|
|
if (!(crl instanceof X509CRL))
|
374 |
|
|
continue;
|
375 |
|
|
X509CRL xcrl = (X509CRL) crl;
|
376 |
|
|
try
|
377 |
|
|
{
|
378 |
|
|
xcrl.verify(anchorKey);
|
379 |
|
|
}
|
380 |
|
|
catch (Exception x)
|
381 |
|
|
{
|
382 |
|
|
continue;
|
383 |
|
|
}
|
384 |
|
|
Date nextUpdate = xcrl.getNextUpdate();
|
385 |
|
|
if (nextUpdate != null && nextUpdate.compareTo(now) < 0)
|
386 |
|
|
continue;
|
387 |
|
|
if (xcrl.isRevoked(p[p.length-1]))
|
388 |
|
|
throw new CertPathValidatorException("certificate is revoked");
|
389 |
|
|
}
|
390 |
|
|
}
|
391 |
|
|
|
392 |
|
|
// The chain is valid; return the result.
|
393 |
|
|
return new PKIXCertPathValidatorResult(anchor, rootNode,
|
394 |
|
|
p[0].getPublicKey());
|
395 |
|
|
}
|
396 |
|
|
catch (Exception ignored)
|
397 |
|
|
{
|
398 |
|
|
cause = ignored;
|
399 |
|
|
continue;
|
400 |
|
|
}
|
401 |
|
|
}
|
402 |
|
|
|
403 |
|
|
// The path is not valid.
|
404 |
|
|
CertPathValidatorException cpve =
|
405 |
|
|
new CertPathValidatorException("path validation failed");
|
406 |
|
|
if (cause != null)
|
407 |
|
|
cpve.initCause (cause);
|
408 |
|
|
throw cpve;
|
409 |
|
|
}
|
410 |
|
|
|
411 |
|
|
// Own methods.
|
412 |
|
|
// -------------------------------------------------------------------------
|
413 |
|
|
|
414 |
|
|
/**
|
415 |
|
|
* Check if a given CRL is acceptable for checking the revocation status
|
416 |
|
|
* of certificates in the path being checked.
|
417 |
|
|
*
|
418 |
|
|
* <p>The CRL is accepted iff:</p>
|
419 |
|
|
*
|
420 |
|
|
* <ol>
|
421 |
|
|
* <li>The <i>nextUpdate</i> field (if present) is in the future.</li>
|
422 |
|
|
* <li>The CRL does not contain any unsupported critical extensions.</li>
|
423 |
|
|
* <li>The CRL is signed by one of the certificates in the path, or,</li>
|
424 |
|
|
* <li>The CRL is signed by the given public key and was issued by the
|
425 |
|
|
* public key's subject, or,</li>
|
426 |
|
|
* <li>The CRL is signed by a certificate in the given cert stores, and
|
427 |
|
|
* that cert is signed by one of the certificates in the path.</li>
|
428 |
|
|
* </ol>
|
429 |
|
|
*
|
430 |
|
|
* @param crl The CRL being checked.
|
431 |
|
|
* @param path The path this CRL is being checked against.
|
432 |
|
|
* @param now The value to use as 'now'.
|
433 |
|
|
* @param pubKeySubject The subject of the public key.
|
434 |
|
|
* @param pubKey The public key to check.
|
435 |
|
|
* @return True if the CRL is acceptable.
|
436 |
|
|
*/
|
437 |
|
|
private static boolean checkCRL(X509CRL crl, X509Certificate[] path, Date now,
|
438 |
|
|
X509Certificate pubKeyCert, PublicKey pubKey,
|
439 |
|
|
List certStores)
|
440 |
|
|
{
|
441 |
|
|
Date nextUpdate = crl.getNextUpdate();
|
442 |
|
|
if (nextUpdate != null && nextUpdate.compareTo(now) < 0)
|
443 |
|
|
return false;
|
444 |
|
|
if (crl.hasUnsupportedCriticalExtension())
|
445 |
|
|
return false;
|
446 |
|
|
for (int i = 0; i < path.length; i++)
|
447 |
|
|
{
|
448 |
|
|
if (!path[i].getSubjectDN().equals(crl.getIssuerDN()))
|
449 |
|
|
continue;
|
450 |
|
|
boolean[] keyUsage = path[i].getKeyUsage();
|
451 |
|
|
if (keyUsage != null)
|
452 |
|
|
{
|
453 |
|
|
if (!keyUsage[KeyUsage.CRL_SIGN])
|
454 |
|
|
continue;
|
455 |
|
|
}
|
456 |
|
|
try
|
457 |
|
|
{
|
458 |
|
|
crl.verify(path[i].getPublicKey());
|
459 |
|
|
return true;
|
460 |
|
|
}
|
461 |
|
|
catch (Exception x)
|
462 |
|
|
{
|
463 |
|
|
}
|
464 |
|
|
}
|
465 |
|
|
if (crl.getIssuerDN().equals(pubKeyCert.getSubjectDN()))
|
466 |
|
|
{
|
467 |
|
|
try
|
468 |
|
|
{
|
469 |
|
|
boolean[] keyUsage = pubKeyCert.getKeyUsage();
|
470 |
|
|
if (keyUsage != null)
|
471 |
|
|
{
|
472 |
|
|
if (!keyUsage[KeyUsage.CRL_SIGN])
|
473 |
|
|
throw new Exception();
|
474 |
|
|
}
|
475 |
|
|
crl.verify(pubKey);
|
476 |
|
|
return true;
|
477 |
|
|
}
|
478 |
|
|
catch (Exception x)
|
479 |
|
|
{
|
480 |
|
|
}
|
481 |
|
|
}
|
482 |
|
|
try
|
483 |
|
|
{
|
484 |
|
|
X509CertSelectorImpl select = new X509CertSelectorImpl();
|
485 |
|
|
select.addSubjectName(crl.getIssuerDN());
|
486 |
|
|
List certs = new LinkedList();
|
487 |
|
|
for (Iterator it = certStores.iterator(); it.hasNext(); )
|
488 |
|
|
{
|
489 |
|
|
CertStore cs = (CertStore) it.next();
|
490 |
|
|
try
|
491 |
|
|
{
|
492 |
|
|
certs.addAll(cs.getCertificates(select));
|
493 |
|
|
}
|
494 |
|
|
catch (CertStoreException cse)
|
495 |
|
|
{
|
496 |
|
|
}
|
497 |
|
|
}
|
498 |
|
|
for (Iterator it = certs.iterator(); it.hasNext(); )
|
499 |
|
|
{
|
500 |
|
|
X509Certificate c = (X509Certificate) it.next();
|
501 |
|
|
for (int i = 0; i < path.length; i++)
|
502 |
|
|
{
|
503 |
|
|
if (!c.getIssuerDN().equals(path[i].getSubjectDN()))
|
504 |
|
|
continue;
|
505 |
|
|
boolean[] keyUsage = c.getKeyUsage();
|
506 |
|
|
if (keyUsage != null)
|
507 |
|
|
{
|
508 |
|
|
if (!keyUsage[KeyUsage.CRL_SIGN])
|
509 |
|
|
continue;
|
510 |
|
|
}
|
511 |
|
|
try
|
512 |
|
|
{
|
513 |
|
|
c.verify(path[i].getPublicKey());
|
514 |
|
|
crl.verify(c.getPublicKey());
|
515 |
|
|
return true;
|
516 |
|
|
}
|
517 |
|
|
catch (Exception x)
|
518 |
|
|
{
|
519 |
|
|
}
|
520 |
|
|
}
|
521 |
|
|
if (c.getIssuerDN().equals(pubKeyCert.getSubjectDN()))
|
522 |
|
|
{
|
523 |
|
|
c.verify(pubKey);
|
524 |
|
|
crl.verify(c.getPublicKey());
|
525 |
|
|
}
|
526 |
|
|
}
|
527 |
|
|
}
|
528 |
|
|
catch (Exception x)
|
529 |
|
|
{
|
530 |
|
|
}
|
531 |
|
|
return false;
|
532 |
|
|
}
|
533 |
|
|
|
534 |
|
|
private static Set getCritExts(X509Certificate cert)
|
535 |
|
|
{
|
536 |
|
|
HashSet s = new HashSet();
|
537 |
|
|
if (cert instanceof GnuPKIExtension)
|
538 |
|
|
{
|
539 |
|
|
Collection exts = ((GnuPKIExtension) cert).getExtensions();
|
540 |
|
|
for (Iterator it = exts.iterator(); it.hasNext(); )
|
541 |
|
|
{
|
542 |
|
|
Extension ext = (Extension) it.next();
|
543 |
|
|
if (ext.isCritical() && !ext.isSupported())
|
544 |
|
|
s.add(ext.getOid().toString());
|
545 |
|
|
}
|
546 |
|
|
}
|
547 |
|
|
else
|
548 |
|
|
s.addAll(cert.getCriticalExtensionOIDs());
|
549 |
|
|
return s;
|
550 |
|
|
}
|
551 |
|
|
|
552 |
|
|
/**
|
553 |
|
|
* Perform a basic sanity check on the CA certificate at <code>index</code>.
|
554 |
|
|
*/
|
555 |
|
|
private static void basicSanity(X509Certificate[] path, int index)
|
556 |
|
|
throws CertPathValidatorException
|
557 |
|
|
{
|
558 |
|
|
X509Certificate cert = path[index];
|
559 |
|
|
int pathLen = 0;
|
560 |
|
|
for (int i = index - 1; i > 0; i--)
|
561 |
|
|
{
|
562 |
|
|
if (!path[i].getIssuerDN().equals(path[i].getSubjectDN()))
|
563 |
|
|
pathLen++;
|
564 |
|
|
}
|
565 |
|
|
Extension e = null;
|
566 |
|
|
if (cert instanceof GnuPKIExtension)
|
567 |
|
|
{
|
568 |
|
|
e = ((GnuPKIExtension) cert).getExtension(BasicConstraints.ID);
|
569 |
|
|
}
|
570 |
|
|
else
|
571 |
|
|
{
|
572 |
|
|
try
|
573 |
|
|
{
|
574 |
|
|
e = new Extension(cert.getExtensionValue(BasicConstraints.ID.toString()));
|
575 |
|
|
}
|
576 |
|
|
catch (Exception x)
|
577 |
|
|
{
|
578 |
|
|
}
|
579 |
|
|
}
|
580 |
|
|
if (e == null)
|
581 |
|
|
throw new CertPathValidatorException("no basicConstraints");
|
582 |
|
|
BasicConstraints bc = (BasicConstraints) e.getValue();
|
583 |
|
|
if (!bc.isCA())
|
584 |
|
|
throw new CertPathValidatorException("certificate cannot be used to verify signatures");
|
585 |
|
|
if (bc.getPathLengthConstraint() >= 0 && bc.getPathLengthConstraint() < pathLen)
|
586 |
|
|
throw new CertPathValidatorException("path is too long");
|
587 |
|
|
|
588 |
|
|
boolean[] keyUsage = cert.getKeyUsage();
|
589 |
|
|
if (keyUsage != null)
|
590 |
|
|
{
|
591 |
|
|
if (!keyUsage[KeyUsage.KEY_CERT_SIGN])
|
592 |
|
|
throw new CertPathValidatorException("certificate cannot be used to sign certificates");
|
593 |
|
|
}
|
594 |
|
|
}
|
595 |
|
|
|
596 |
|
|
private static void updatePolicyTree(X509Certificate cert, PolicyNodeImpl root,
|
597 |
|
|
int depth, PKIXParameters params,
|
598 |
|
|
boolean explicitPolicy)
|
599 |
|
|
throws CertPathValidatorException
|
600 |
|
|
{
|
601 |
|
|
if (DEBUG) debug("updatePolicyTree depth == " + depth);
|
602 |
|
|
Set nodes = new HashSet();
|
603 |
|
|
LinkedList stack = new LinkedList();
|
604 |
|
|
Iterator current = null;
|
605 |
|
|
stack.addLast(Collections.singleton(root).iterator());
|
606 |
|
|
do
|
607 |
|
|
{
|
608 |
|
|
current = (Iterator) stack.removeLast();
|
609 |
|
|
while (current.hasNext())
|
610 |
|
|
{
|
611 |
|
|
PolicyNodeImpl p = (PolicyNodeImpl) current.next();
|
612 |
|
|
if (DEBUG) debug("visiting node == " + p);
|
613 |
|
|
if (p.getDepth() == depth - 1)
|
614 |
|
|
{
|
615 |
|
|
if (DEBUG) debug("added node");
|
616 |
|
|
nodes.add(p);
|
617 |
|
|
}
|
618 |
|
|
else
|
619 |
|
|
{
|
620 |
|
|
if (DEBUG) debug("skipped node");
|
621 |
|
|
stack.addLast(current);
|
622 |
|
|
current = p.getChildren();
|
623 |
|
|
}
|
624 |
|
|
}
|
625 |
|
|
}
|
626 |
|
|
while (!stack.isEmpty());
|
627 |
|
|
|
628 |
|
|
Extension e = null;
|
629 |
|
|
CertificatePolicies policies = null;
|
630 |
|
|
List qualifierInfos = null;
|
631 |
|
|
if (cert instanceof GnuPKIExtension)
|
632 |
|
|
{
|
633 |
|
|
e = ((GnuPKIExtension) cert).getExtension(CertificatePolicies.ID);
|
634 |
|
|
if (e != null)
|
635 |
|
|
policies = (CertificatePolicies) e.getValue();
|
636 |
|
|
}
|
637 |
|
|
|
638 |
|
|
List cp = null;
|
639 |
|
|
if (policies != null)
|
640 |
|
|
cp = policies.getPolicies();
|
641 |
|
|
else
|
642 |
|
|
cp = Collections.EMPTY_LIST;
|
643 |
|
|
boolean match = false;
|
644 |
|
|
if (DEBUG) debug("nodes are == " + nodes);
|
645 |
|
|
if (DEBUG) debug("cert policies are == " + cp);
|
646 |
|
|
for (Iterator it = nodes.iterator(); it.hasNext(); )
|
647 |
|
|
{
|
648 |
|
|
PolicyNodeImpl parent = (PolicyNodeImpl) it.next();
|
649 |
|
|
if (DEBUG) debug("adding policies to " + parent);
|
650 |
|
|
for (Iterator it2 = cp.iterator(); it2.hasNext(); )
|
651 |
|
|
{
|
652 |
|
|
OID policy = (OID) it2.next();
|
653 |
|
|
if (DEBUG) debug("trying to add policy == " + policy);
|
654 |
|
|
if (policy.toString().equals(ANY_POLICY) &&
|
655 |
|
|
params.isAnyPolicyInhibited())
|
656 |
|
|
continue;
|
657 |
|
|
PolicyNodeImpl child = new PolicyNodeImpl();
|
658 |
|
|
child.setValidPolicy(policy.toString());
|
659 |
|
|
child.addExpectedPolicy(policy.toString());
|
660 |
|
|
if (parent.getExpectedPolicies().contains(policy.toString()))
|
661 |
|
|
{
|
662 |
|
|
parent.addChild(child);
|
663 |
|
|
match = true;
|
664 |
|
|
}
|
665 |
|
|
else if (parent.getExpectedPolicies().contains(ANY_POLICY))
|
666 |
|
|
{
|
667 |
|
|
parent.addChild(child);
|
668 |
|
|
match = true;
|
669 |
|
|
}
|
670 |
|
|
else if (ANY_POLICY.equals (policy.toString()))
|
671 |
|
|
{
|
672 |
|
|
parent.addChild (child);
|
673 |
|
|
match = true;
|
674 |
|
|
}
|
675 |
|
|
if (match && policies != null)
|
676 |
|
|
{
|
677 |
|
|
List qualifiers = policies.getPolicyQualifierInfos (policy);
|
678 |
|
|
if (qualifiers != null)
|
679 |
|
|
child.addAllPolicyQualifiers (qualifiers);
|
680 |
|
|
}
|
681 |
|
|
}
|
682 |
|
|
}
|
683 |
|
|
if (!match && (params.isExplicitPolicyRequired() || explicitPolicy))
|
684 |
|
|
throw new CertPathValidatorException("policy tree building failed");
|
685 |
|
|
}
|
686 |
|
|
|
687 |
|
|
private boolean checkExplicitPolicy (int depth, List explicitPolicies)
|
688 |
|
|
{
|
689 |
|
|
if (DEBUG) debug ("checkExplicitPolicy depth=" + depth);
|
690 |
|
|
for (Iterator it = explicitPolicies.iterator(); it.hasNext(); )
|
691 |
|
|
{
|
692 |
|
|
int[] i = (int[]) it.next();
|
693 |
|
|
int caDepth = i[0];
|
694 |
|
|
int limit = i[1];
|
695 |
|
|
if (DEBUG) debug (" caDepth=" + caDepth + " limit=" + limit);
|
696 |
|
|
if (depth - caDepth >= limit)
|
697 |
|
|
return true;
|
698 |
|
|
}
|
699 |
|
|
return false;
|
700 |
|
|
}
|
701 |
|
|
}
|