1 /* 2 * Copyright (c) 2000, 2012, Oracle and/or its affiliates. All rights reserved. 3 * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. 4 * 5 * This code is free software; you can redistribute it and/or modify it 6 * under the terms of the GNU General Public License version 2 only, as 7 * published by the Free Software Foundation. Oracle designates this 8 * particular file as subject to the "Classpath" exception as provided 9 * by Oracle in the LICENSE file that accompanied this code. 10 * 11 * This code is distributed in the hope that it will be useful, but WITHOUT 12 * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or 13 * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License 14 * version 2 for more details (a copy is included in the LICENSE file that 15 * accompanied this code). 16 * 17 * You should have received a copy of the GNU General Public License version 18 * 2 along with this work; if not, write to the Free Software Foundation, 19 * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA. 20 * 21 * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA 22 * or visit www.oracle.com if you need additional information or have any 23 * questions. 24 */ 25 26 package sun.security.provider.certpath; 27 28 import sun.security.util.Debug; 29 30 import java.util.Collections; 31 import java.util.List; 32 import java.util.Set; 33 import java.security.cert.CertPath; 34 import java.security.cert.CertPathValidatorException; 35 import java.security.cert.PKIXCertPathChecker; 36 import java.security.cert.PKIXReason; 37 import java.security.cert.X509Certificate; 38 39 /** 40 * This class is initialized with a list of <code>PKIXCertPathChecker</code>s 41 * and is used to verify the certificates in a <code>CertPath</code> by 42 * feeding each certificate to each <code>PKIXCertPathChecker</code>. 43 * 44 * @since 1.4 45 * @author Yassir Elley 46 */ 47 class PKIXMasterCertPathValidator { 48 49 private static final Debug debug = Debug.getInstance("certpath"); 50 51 /** 52 * Validates a certification path consisting exclusively of 53 * <code>X509Certificate</code>s using the specified 54 * <code>PKIXCertPathChecker</code>s. It is assumed that the 55 * <code>PKIXCertPathChecker</code>s 56 * have been initialized with any input parameters they may need. 57 * 58 * @param cpOriginal the original X509 CertPath passed in by the user 59 * @param reversedCertList the reversed X509 CertPath (as a List) 60 * @param certPathCheckers the PKIXCertPathCheckers 61 * @throws CertPathValidatorException if cert path does not validate 62 */ validate(CertPath cpOriginal, List<X509Certificate> reversedCertList, List<PKIXCertPathChecker> certPathCheckers)63 static void validate(CertPath cpOriginal, 64 List<X509Certificate> reversedCertList, 65 List<PKIXCertPathChecker> certPathCheckers) 66 throws CertPathValidatorException 67 { 68 // we actually process reversedCertList, but we keep cpOriginal because 69 // we need to return the original certPath when we throw an exception. 70 // we will also need to modify the index appropriately when we 71 // throw an exception. 72 73 int cpSize = reversedCertList.size(); 74 75 if (debug != null) { 76 debug.println("--------------------------------------------------" 77 + "------------"); 78 debug.println("Executing PKIX certification path validation " 79 + "algorithm."); 80 } 81 82 for (int i = 0; i < cpSize; i++) { 83 84 /* The basic loop algorithm is that we get the 85 * current certificate, we verify the current certificate using 86 * information from the previous certificate and from the state, 87 * and we modify the state for the next loop by setting the 88 * current certificate of this loop to be the previous certificate 89 * of the next loop. The state is initialized during first loop. 90 */ 91 if (debug != null) 92 debug.println("Checking cert" + (i+1) + " ..."); 93 94 X509Certificate currCert = reversedCertList.get(i); 95 Set<String> unresCritExts = currCert.getCriticalExtensionOIDs(); 96 if (unresCritExts == null) { 97 unresCritExts = Collections.<String>emptySet(); 98 } 99 100 if (debug != null && !unresCritExts.isEmpty()) { 101 debug.println("Set of critical extensions:"); 102 for (String oid : unresCritExts) { 103 debug.println(oid); 104 } 105 } 106 107 for (int j = 0; j < certPathCheckers.size(); j++) { 108 109 PKIXCertPathChecker currChecker = certPathCheckers.get(j); 110 if (debug != null) { 111 debug.println("-Using checker" + (j + 1) + " ... [" + 112 currChecker.getClass().getName() + "]"); 113 } 114 115 if (i == 0) 116 currChecker.init(false); 117 118 try { 119 currChecker.check(currCert, unresCritExts); 120 121 if (debug != null) { 122 debug.println("-checker" + (j + 1) + 123 " validation succeeded"); 124 } 125 126 } catch (CertPathValidatorException cpve) { 127 throw new CertPathValidatorException(cpve.getMessage(), 128 cpve.getCause(), cpOriginal, cpSize - (i + 1), 129 cpve.getReason()); 130 } 131 } 132 133 if (!unresCritExts.isEmpty()) { 134 throw new CertPathValidatorException("unrecognized " + 135 "critical extension(s)", null, cpOriginal, cpSize-(i+1), 136 PKIXReason.UNRECOGNIZED_CRIT_EXT); 137 } 138 139 if (debug != null) 140 debug.println("\ncert" + (i+1) + " validation succeeded.\n"); 141 } 142 143 if (debug != null) { 144 debug.println("Cert path validation succeeded. (PKIX validation " 145 + "algorithm)"); 146 debug.println("-------------------------------------------------" 147 + "-------------"); 148 } 149 } 150 } 151