331 lines
12 KiB
Java
331 lines
12 KiB
Java
/*
|
|
* Copyright (c) 2000, 2012, Oracle and/or its affiliates. All rights reserved.
|
|
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
|
|
*
|
|
* This code is free software; you can redistribute it and/or modify it
|
|
* under the terms of the GNU General Public License version 2 only, as
|
|
* published by the Free Software Foundation. Oracle designates this
|
|
* particular file as subject to the "Classpath" exception as provided
|
|
* by Oracle in the LICENSE file that accompanied this code.
|
|
*
|
|
* This code is distributed in the hope that it will be useful, but WITHOUT
|
|
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
|
|
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
|
|
* version 2 for more details (a copy is included in the LICENSE file that
|
|
* accompanied this code).
|
|
*
|
|
* You should have received a copy of the GNU General Public License version
|
|
* 2 along with this work; if not, write to the Free Software Foundation,
|
|
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
|
|
*
|
|
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
|
|
* or visit www.oracle.com if you need additional information or have any
|
|
* questions.
|
|
*/
|
|
package sun.security.provider.certpath;
|
|
|
|
import java.io.IOException;
|
|
import java.security.GeneralSecurityException;
|
|
import java.security.PublicKey;
|
|
import java.security.cert.CertificateEncodingException;
|
|
import java.security.cert.CertificateException;
|
|
import java.security.cert.X509Certificate;
|
|
import java.security.interfaces.DSAPublicKey;
|
|
|
|
import javax.security.auth.x500.X500Principal;
|
|
|
|
import sun.security.util.DerOutputStream;
|
|
import sun.security.util.DerValue;
|
|
import sun.security.util.Cache;
|
|
import sun.security.x509.X509CertImpl;
|
|
import sun.security.provider.X509Factory;
|
|
|
|
/**
|
|
* This class represents an X.509 Certificate Pair object, which is primarily
|
|
* used to hold a pair of cross certificates issued between Certification
|
|
* Authorities. The ASN.1 structure is listed below. The forward certificate
|
|
* of the CertificatePair contains a certificate issued to this CA by another
|
|
* CA. The reverse certificate of the CertificatePair contains a certificate
|
|
* issued by this CA to another CA. When both the forward and the reverse
|
|
* certificates are present in the CertificatePair, the issuer name in one
|
|
* certificate shall match the subject name in the other and vice versa, and
|
|
* the subject public key in one certificate shall be capable of verifying the
|
|
* digital signature on the other certificate and vice versa. If a subject
|
|
* public key in one certificate does not contain required key algorithm
|
|
* parameters, then the signature check involving that key is not done.<p>
|
|
*
|
|
* The ASN.1 syntax for this object is:
|
|
* <pre>
|
|
* CertificatePair ::= SEQUENCE {
|
|
* forward [0] Certificate OPTIONAL,
|
|
* reverse [1] Certificate OPTIONAL
|
|
* -- at least one of the pair shall be present -- }
|
|
* </pre><p>
|
|
*
|
|
* This structure uses EXPLICIT tagging. References: Annex A of
|
|
* X.509(2000), X.509(1997).
|
|
*
|
|
* @author Sean Mullan
|
|
* @since 1.4
|
|
*/
|
|
|
|
public class X509CertificatePair {
|
|
|
|
/* ASN.1 explicit tags */
|
|
private static final byte TAG_FORWARD = 0;
|
|
private static final byte TAG_REVERSE = 1;
|
|
|
|
private X509Certificate forward;
|
|
private X509Certificate reverse;
|
|
private byte[] encoded;
|
|
|
|
private static final Cache<Object, X509CertificatePair> cache
|
|
= Cache.newSoftMemoryCache(750);
|
|
|
|
/**
|
|
* Creates an empty instance of X509CertificatePair.
|
|
*/
|
|
public X509CertificatePair() {}
|
|
|
|
/**
|
|
* Creates an instance of X509CertificatePair. At least one of
|
|
* the pair must be non-null.
|
|
*
|
|
* @param forward The forward component of the certificate pair
|
|
* which represents a certificate issued to this CA by other CAs.
|
|
* @param reverse The reverse component of the certificate pair
|
|
* which represents a certificate issued by this CA to other CAs.
|
|
* @throws CertificateException If an exception occurs.
|
|
*/
|
|
public X509CertificatePair(X509Certificate forward, X509Certificate reverse)
|
|
throws CertificateException {
|
|
if (forward == null && reverse == null) {
|
|
throw new CertificateException("at least one of certificate pair "
|
|
+ "must be non-null");
|
|
}
|
|
|
|
this.forward = forward;
|
|
this.reverse = reverse;
|
|
|
|
checkPair();
|
|
}
|
|
|
|
/**
|
|
* Create a new X509CertificatePair from its encoding.
|
|
*
|
|
* For internal use only, external code should use generateCertificatePair.
|
|
*/
|
|
private X509CertificatePair(byte[] encoded) throws CertificateException {
|
|
try {
|
|
parse(new DerValue(encoded));
|
|
this.encoded = encoded;
|
|
} catch (IOException ex) {
|
|
throw new CertificateException(ex.toString());
|
|
}
|
|
checkPair();
|
|
}
|
|
|
|
/**
|
|
* Clear the cache for debugging.
|
|
*/
|
|
public static synchronized void clearCache() {
|
|
cache.clear();
|
|
}
|
|
|
|
/**
|
|
* Create a X509CertificatePair from its encoding. Uses cache lookup
|
|
* if possible.
|
|
*/
|
|
public static synchronized X509CertificatePair generateCertificatePair
|
|
(byte[] encoded) throws CertificateException {
|
|
Object key = new Cache.EqualByteArray(encoded);
|
|
X509CertificatePair pair = cache.get(key);
|
|
if (pair != null) {
|
|
return pair;
|
|
}
|
|
pair = new X509CertificatePair(encoded);
|
|
key = new Cache.EqualByteArray(pair.encoded);
|
|
cache.put(key, pair);
|
|
return pair;
|
|
}
|
|
|
|
/**
|
|
* Sets the forward component of the certificate pair.
|
|
*/
|
|
public void setForward(X509Certificate cert) throws CertificateException {
|
|
checkPair();
|
|
forward = cert;
|
|
}
|
|
|
|
/**
|
|
* Sets the reverse component of the certificate pair.
|
|
*/
|
|
public void setReverse(X509Certificate cert) throws CertificateException {
|
|
checkPair();
|
|
reverse = cert;
|
|
}
|
|
|
|
/**
|
|
* Returns the forward component of the certificate pair.
|
|
*
|
|
* @return The forward certificate, or null if not set.
|
|
*/
|
|
public X509Certificate getForward() {
|
|
return forward;
|
|
}
|
|
|
|
/**
|
|
* Returns the reverse component of the certificate pair.
|
|
*
|
|
* @return The reverse certificate, or null if not set.
|
|
*/
|
|
public X509Certificate getReverse() {
|
|
return reverse;
|
|
}
|
|
|
|
/**
|
|
* Return the DER encoded form of the certificate pair.
|
|
*
|
|
* @return The encoded form of the certificate pair.
|
|
* @throws CerticateEncodingException If an encoding exception occurs.
|
|
*/
|
|
public byte[] getEncoded() throws CertificateEncodingException {
|
|
try {
|
|
if (encoded == null) {
|
|
DerOutputStream tmp = new DerOutputStream();
|
|
emit(tmp);
|
|
encoded = tmp.toByteArray();
|
|
}
|
|
} catch (IOException ex) {
|
|
throw new CertificateEncodingException(ex.toString());
|
|
}
|
|
return encoded;
|
|
}
|
|
|
|
/**
|
|
* Return a printable representation of the certificate pair.
|
|
*
|
|
* @return A String describing the contents of the pair.
|
|
*/
|
|
@Override
|
|
public String toString() {
|
|
StringBuilder sb = new StringBuilder();
|
|
sb.append("X.509 Certificate Pair: [\n");
|
|
if (forward != null)
|
|
sb.append(" Forward: ").append(forward).append("\n");
|
|
if (reverse != null)
|
|
sb.append(" Reverse: ").append(reverse).append("\n");
|
|
sb.append("]");
|
|
return sb.toString();
|
|
}
|
|
|
|
/* Parse the encoded bytes */
|
|
private void parse(DerValue val)
|
|
throws IOException, CertificateException
|
|
{
|
|
if (val.tag != DerValue.tag_Sequence) {
|
|
throw new IOException
|
|
("Sequence tag missing for X509CertificatePair");
|
|
}
|
|
|
|
while (val.data != null && val.data.available() != 0) {
|
|
DerValue opt = val.data.getDerValue();
|
|
short tag = (byte) (opt.tag & 0x01f);
|
|
switch (tag) {
|
|
case TAG_FORWARD:
|
|
if (opt.isContextSpecific() && opt.isConstructed()) {
|
|
if (forward != null) {
|
|
throw new IOException("Duplicate forward "
|
|
+ "certificate in X509CertificatePair");
|
|
}
|
|
opt = opt.data.getDerValue();
|
|
forward = X509Factory.intern
|
|
(new X509CertImpl(opt.toByteArray()));
|
|
}
|
|
break;
|
|
case TAG_REVERSE:
|
|
if (opt.isContextSpecific() && opt.isConstructed()) {
|
|
if (reverse != null) {
|
|
throw new IOException("Duplicate reverse "
|
|
+ "certificate in X509CertificatePair");
|
|
}
|
|
opt = opt.data.getDerValue();
|
|
reverse = X509Factory.intern
|
|
(new X509CertImpl(opt.toByteArray()));
|
|
}
|
|
break;
|
|
default:
|
|
throw new IOException("Invalid encoding of "
|
|
+ "X509CertificatePair");
|
|
}
|
|
}
|
|
if (forward == null && reverse == null) {
|
|
throw new CertificateException("at least one of certificate pair "
|
|
+ "must be non-null");
|
|
}
|
|
}
|
|
|
|
/* Translate to encoded bytes */
|
|
private void emit(DerOutputStream out)
|
|
throws IOException, CertificateEncodingException
|
|
{
|
|
DerOutputStream tagged = new DerOutputStream();
|
|
|
|
if (forward != null) {
|
|
DerOutputStream tmp = new DerOutputStream();
|
|
tmp.putDerValue(new DerValue(forward.getEncoded()));
|
|
tagged.write(DerValue.createTag(DerValue.TAG_CONTEXT,
|
|
true, TAG_FORWARD), tmp);
|
|
}
|
|
|
|
if (reverse != null) {
|
|
DerOutputStream tmp = new DerOutputStream();
|
|
tmp.putDerValue(new DerValue(reverse.getEncoded()));
|
|
tagged.write(DerValue.createTag(DerValue.TAG_CONTEXT,
|
|
true, TAG_REVERSE), tmp);
|
|
}
|
|
|
|
out.write(DerValue.tag_Sequence, tagged);
|
|
}
|
|
|
|
/*
|
|
* Check for a valid certificate pair
|
|
*/
|
|
private void checkPair() throws CertificateException {
|
|
|
|
/* if either of pair is missing, return w/o error */
|
|
if (forward == null || reverse == null) {
|
|
return;
|
|
}
|
|
/*
|
|
* If both elements of the pair are present, check that they
|
|
* are a valid pair.
|
|
*/
|
|
X500Principal fwSubject = forward.getSubjectX500Principal();
|
|
X500Principal fwIssuer = forward.getIssuerX500Principal();
|
|
X500Principal rvSubject = reverse.getSubjectX500Principal();
|
|
X500Principal rvIssuer = reverse.getIssuerX500Principal();
|
|
if (!fwIssuer.equals(rvSubject) || !rvIssuer.equals(fwSubject)) {
|
|
throw new CertificateException("subject and issuer names in "
|
|
+ "forward and reverse certificates do not match");
|
|
}
|
|
|
|
/* check signatures unless key parameters are missing */
|
|
try {
|
|
PublicKey pk = reverse.getPublicKey();
|
|
if (!(pk instanceof DSAPublicKey) ||
|
|
((DSAPublicKey)pk).getParams() != null) {
|
|
forward.verify(pk);
|
|
}
|
|
pk = forward.getPublicKey();
|
|
if (!(pk instanceof DSAPublicKey) ||
|
|
((DSAPublicKey)pk).getParams() != null) {
|
|
reverse.verify(pk);
|
|
}
|
|
} catch (GeneralSecurityException e) {
|
|
throw new CertificateException("invalid signature: "
|
|
+ e.getMessage());
|
|
}
|
|
}
|
|
}
|