src/java.base/share/classes/sun/security/ssl/SunX509KeyManagerImpl.java
author erikj
Tue, 12 Sep 2017 19:03:39 +0200
changeset 47216 71c04702a3d5
parent 25859 jdk/src/java.base/share/classes/sun/security/ssl/SunX509KeyManagerImpl.java@3317bb8137f4
child 50768 68fa3d4026ea
permissions -rw-r--r--
8187443: Forest Consolidation: Move files to unified layout Reviewed-by: darcy, ihse
Ignore whitespace changes - Everywhere: Within whitespace: At end of lines:
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
     1
/*
23010
6dadb192ad81 8029235: Update copyright year to match last edit in jdk8 jdk repository for 2013
lana
parents: 21278
diff changeset
     2
 * Copyright (c) 1999, 2013, Oracle and/or its affiliates. All rights reserved.
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
     3
 * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
90ce3da70b43 Initial load
duke
parents:
diff changeset
     4
 *
90ce3da70b43 Initial load
duke
parents:
diff changeset
     5
 * This code is free software; you can redistribute it and/or modify it
90ce3da70b43 Initial load
duke
parents:
diff changeset
     6
 * under the terms of the GNU General Public License version 2 only, as
5506
202f599c92aa 6943119: Rebrand source copyright notices
ohair
parents: 715
diff changeset
     7
 * published by the Free Software Foundation.  Oracle designates this
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
     8
 * particular file as subject to the "Classpath" exception as provided
5506
202f599c92aa 6943119: Rebrand source copyright notices
ohair
parents: 715
diff changeset
     9
 * by Oracle in the LICENSE file that accompanied this code.
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
    10
 *
90ce3da70b43 Initial load
duke
parents:
diff changeset
    11
 * This code is distributed in the hope that it will be useful, but WITHOUT
90ce3da70b43 Initial load
duke
parents:
diff changeset
    12
 * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
90ce3da70b43 Initial load
duke
parents:
diff changeset
    13
 * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
90ce3da70b43 Initial load
duke
parents:
diff changeset
    14
 * version 2 for more details (a copy is included in the LICENSE file that
90ce3da70b43 Initial load
duke
parents:
diff changeset
    15
 * accompanied this code).
90ce3da70b43 Initial load
duke
parents:
diff changeset
    16
 *
90ce3da70b43 Initial load
duke
parents:
diff changeset
    17
 * You should have received a copy of the GNU General Public License version
90ce3da70b43 Initial load
duke
parents:
diff changeset
    18
 * 2 along with this work; if not, write to the Free Software Foundation,
90ce3da70b43 Initial load
duke
parents:
diff changeset
    19
 * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
90ce3da70b43 Initial load
duke
parents:
diff changeset
    20
 *
5506
202f599c92aa 6943119: Rebrand source copyright notices
ohair
parents: 715
diff changeset
    21
 * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
202f599c92aa 6943119: Rebrand source copyright notices
ohair
parents: 715
diff changeset
    22
 * or visit www.oracle.com if you need additional information or have any
202f599c92aa 6943119: Rebrand source copyright notices
ohair
parents: 715
diff changeset
    23
 * questions.
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
    24
 */
90ce3da70b43 Initial load
duke
parents:
diff changeset
    25
90ce3da70b43 Initial load
duke
parents:
diff changeset
    26
package sun.security.ssl;
90ce3da70b43 Initial load
duke
parents:
diff changeset
    27
90ce3da70b43 Initial load
duke
parents:
diff changeset
    28
import javax.net.ssl.*;
90ce3da70b43 Initial load
duke
parents:
diff changeset
    29
import java.security.*;
90ce3da70b43 Initial load
duke
parents:
diff changeset
    30
import java.security.cert.*;
90ce3da70b43 Initial load
duke
parents:
diff changeset
    31
import java.security.cert.Certificate;
90ce3da70b43 Initial load
duke
parents:
diff changeset
    32
import java.util.*;
90ce3da70b43 Initial load
duke
parents:
diff changeset
    33
import java.net.Socket;
90ce3da70b43 Initial load
duke
parents:
diff changeset
    34
90ce3da70b43 Initial load
duke
parents:
diff changeset
    35
import javax.security.auth.x500.X500Principal;
90ce3da70b43 Initial load
duke
parents:
diff changeset
    36
90ce3da70b43 Initial load
duke
parents:
diff changeset
    37
90ce3da70b43 Initial load
duke
parents:
diff changeset
    38
/**
21278
ef8a3a2a72f2 8022746: List of spelling errors in API doc
malenkov
parents: 14664
diff changeset
    39
 * An implementation of X509KeyManager backed by a KeyStore.
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
    40
 *
90ce3da70b43 Initial load
duke
parents:
diff changeset
    41
 * The backing KeyStore is inspected when this object is constructed.
90ce3da70b43 Initial load
duke
parents:
diff changeset
    42
 * All key entries containing a PrivateKey and a non-empty chain of
90ce3da70b43 Initial load
duke
parents:
diff changeset
    43
 * X509Certificate are then copied into an internal store. This means
90ce3da70b43 Initial load
duke
parents:
diff changeset
    44
 * that subsequent modifications of the KeyStore have no effect on the
90ce3da70b43 Initial load
duke
parents:
diff changeset
    45
 * X509KeyManagerImpl object.
90ce3da70b43 Initial load
duke
parents:
diff changeset
    46
 *
90ce3da70b43 Initial load
duke
parents:
diff changeset
    47
 * Note that this class assumes that all keys are protected by the same
90ce3da70b43 Initial load
duke
parents:
diff changeset
    48
 * password.
90ce3da70b43 Initial load
duke
parents:
diff changeset
    49
 *
90ce3da70b43 Initial load
duke
parents:
diff changeset
    50
 * The JSSE handshake code currently calls into this class via
90ce3da70b43 Initial load
duke
parents:
diff changeset
    51
 * chooseClientAlias() and chooseServerAlias() to find the certificates to
90ce3da70b43 Initial load
duke
parents:
diff changeset
    52
 * use. As implemented here, both always return the first alias returned by
90ce3da70b43 Initial load
duke
parents:
diff changeset
    53
 * getClientAliases() and getServerAliases(). In turn, these methods are
90ce3da70b43 Initial load
duke
parents:
diff changeset
    54
 * implemented by calling getAliases(), which performs the actual lookup.
90ce3da70b43 Initial load
duke
parents:
diff changeset
    55
 *
90ce3da70b43 Initial load
duke
parents:
diff changeset
    56
 * Note that this class currently implements no checking of the local
90ce3da70b43 Initial load
duke
parents:
diff changeset
    57
 * certificates. In particular, it is *not* guaranteed that:
90ce3da70b43 Initial load
duke
parents:
diff changeset
    58
 *  . the certificates are within their validity period and not revoked
90ce3da70b43 Initial load
duke
parents:
diff changeset
    59
 *  . the signatures verify
90ce3da70b43 Initial load
duke
parents:
diff changeset
    60
 *  . they form a PKIX compliant chain.
90ce3da70b43 Initial load
duke
parents:
diff changeset
    61
 *  . the certificate extensions allow the certificate to be used for
90ce3da70b43 Initial load
duke
parents:
diff changeset
    62
 *    the desired purpose.
90ce3da70b43 Initial load
duke
parents:
diff changeset
    63
 *
90ce3da70b43 Initial load
duke
parents:
diff changeset
    64
 * Chains that fail any of these criteria will probably be rejected by
90ce3da70b43 Initial load
duke
parents:
diff changeset
    65
 * the remote peer.
90ce3da70b43 Initial load
duke
parents:
diff changeset
    66
 *
90ce3da70b43 Initial load
duke
parents:
diff changeset
    67
 */
90ce3da70b43 Initial load
duke
parents:
diff changeset
    68
final class SunX509KeyManagerImpl extends X509ExtendedKeyManager {
90ce3da70b43 Initial load
duke
parents:
diff changeset
    69
90ce3da70b43 Initial load
duke
parents:
diff changeset
    70
    private static final Debug debug = Debug.getInstance("ssl");
90ce3da70b43 Initial load
duke
parents:
diff changeset
    71
90ce3da70b43 Initial load
duke
parents:
diff changeset
    72
    private static final String[] STRING0 = new String[0];
90ce3da70b43 Initial load
duke
parents:
diff changeset
    73
90ce3da70b43 Initial load
duke
parents:
diff changeset
    74
    /*
90ce3da70b43 Initial load
duke
parents:
diff changeset
    75
     * The credentials from the KeyStore as
90ce3da70b43 Initial load
duke
parents:
diff changeset
    76
     * Map: String(alias) -> X509Credentials(credentials)
90ce3da70b43 Initial load
duke
parents:
diff changeset
    77
     */
90ce3da70b43 Initial load
duke
parents:
diff changeset
    78
    private Map<String,X509Credentials> credentialsMap;
90ce3da70b43 Initial load
duke
parents:
diff changeset
    79
90ce3da70b43 Initial load
duke
parents:
diff changeset
    80
    /*
90ce3da70b43 Initial load
duke
parents:
diff changeset
    81
     * Cached server aliases for the case issuers == null.
90ce3da70b43 Initial load
duke
parents:
diff changeset
    82
     * (in the current JSSE implementation, issuers are always null for
90ce3da70b43 Initial load
duke
parents:
diff changeset
    83
     * server certs). See chooseServerAlias() for details.
90ce3da70b43 Initial load
duke
parents:
diff changeset
    84
     *
90ce3da70b43 Initial load
duke
parents:
diff changeset
    85
     * Map: String(keyType) -> String[](alias)
90ce3da70b43 Initial load
duke
parents:
diff changeset
    86
     */
10334
26b816b3f236 7063647: To use synchronized map in key manager
xuelei
parents: 9035
diff changeset
    87
    private final Map<String,String[]> serverAliasCache;
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
    88
90ce3da70b43 Initial load
duke
parents:
diff changeset
    89
    /*
90ce3da70b43 Initial load
duke
parents:
diff changeset
    90
     * Basic container for credentials implemented as an inner class.
90ce3da70b43 Initial load
duke
parents:
diff changeset
    91
     */
90ce3da70b43 Initial load
duke
parents:
diff changeset
    92
    private static class X509Credentials {
90ce3da70b43 Initial load
duke
parents:
diff changeset
    93
        PrivateKey privateKey;
90ce3da70b43 Initial load
duke
parents:
diff changeset
    94
        X509Certificate[] certificates;
90ce3da70b43 Initial load
duke
parents:
diff changeset
    95
        private Set<X500Principal> issuerX500Principals;
90ce3da70b43 Initial load
duke
parents:
diff changeset
    96
90ce3da70b43 Initial load
duke
parents:
diff changeset
    97
        X509Credentials(PrivateKey privateKey, X509Certificate[] certificates) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
    98
            // assert privateKey and certificates != null
90ce3da70b43 Initial load
duke
parents:
diff changeset
    99
            this.privateKey = privateKey;
90ce3da70b43 Initial load
duke
parents:
diff changeset
   100
            this.certificates = certificates;
90ce3da70b43 Initial load
duke
parents:
diff changeset
   101
        }
90ce3da70b43 Initial load
duke
parents:
diff changeset
   102
90ce3da70b43 Initial load
duke
parents:
diff changeset
   103
        synchronized Set<X500Principal> getIssuerX500Principals() {
90ce3da70b43 Initial load
duke
parents:
diff changeset
   104
            // lazy initialization
90ce3da70b43 Initial load
duke
parents:
diff changeset
   105
            if (issuerX500Principals == null) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
   106
                issuerX500Principals = new HashSet<X500Principal>();
90ce3da70b43 Initial load
duke
parents:
diff changeset
   107
                for (int i = 0; i < certificates.length; i++) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
   108
                    issuerX500Principals.add(
90ce3da70b43 Initial load
duke
parents:
diff changeset
   109
                                certificates[i].getIssuerX500Principal());
90ce3da70b43 Initial load
duke
parents:
diff changeset
   110
                }
90ce3da70b43 Initial load
duke
parents:
diff changeset
   111
            }
90ce3da70b43 Initial load
duke
parents:
diff changeset
   112
            return issuerX500Principals;
90ce3da70b43 Initial load
duke
parents:
diff changeset
   113
        }
90ce3da70b43 Initial load
duke
parents:
diff changeset
   114
    }
90ce3da70b43 Initial load
duke
parents:
diff changeset
   115
10334
26b816b3f236 7063647: To use synchronized map in key manager
xuelei
parents: 9035
diff changeset
   116
    SunX509KeyManagerImpl(KeyStore ks, char[] password)
26b816b3f236 7063647: To use synchronized map in key manager
xuelei
parents: 9035
diff changeset
   117
            throws KeyStoreException,
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
   118
            NoSuchAlgorithmException, UnrecoverableKeyException {
90ce3da70b43 Initial load
duke
parents:
diff changeset
   119
90ce3da70b43 Initial load
duke
parents:
diff changeset
   120
        credentialsMap = new HashMap<String,X509Credentials>();
10334
26b816b3f236 7063647: To use synchronized map in key manager
xuelei
parents: 9035
diff changeset
   121
        serverAliasCache = Collections.synchronizedMap(
26b816b3f236 7063647: To use synchronized map in key manager
xuelei
parents: 9035
diff changeset
   122
                            new HashMap<String,String[]>());
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
   123
        if (ks == null) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
   124
            return;
90ce3da70b43 Initial load
duke
parents:
diff changeset
   125
        }
90ce3da70b43 Initial load
duke
parents:
diff changeset
   126
90ce3da70b43 Initial load
duke
parents:
diff changeset
   127
        for (Enumeration<String> aliases = ks.aliases();
90ce3da70b43 Initial load
duke
parents:
diff changeset
   128
                                        aliases.hasMoreElements(); ) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
   129
            String alias = aliases.nextElement();
90ce3da70b43 Initial load
duke
parents:
diff changeset
   130
            if (!ks.isKeyEntry(alias)) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
   131
                continue;
90ce3da70b43 Initial load
duke
parents:
diff changeset
   132
            }
90ce3da70b43 Initial load
duke
parents:
diff changeset
   133
            Key key = ks.getKey(alias, password);
90ce3da70b43 Initial load
duke
parents:
diff changeset
   134
            if (key instanceof PrivateKey == false) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
   135
                continue;
90ce3da70b43 Initial load
duke
parents:
diff changeset
   136
            }
90ce3da70b43 Initial load
duke
parents:
diff changeset
   137
            Certificate[] certs = ks.getCertificateChain(alias);
90ce3da70b43 Initial load
duke
parents:
diff changeset
   138
            if ((certs == null) || (certs.length == 0) ||
90ce3da70b43 Initial load
duke
parents:
diff changeset
   139
                    !(certs[0] instanceof X509Certificate)) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
   140
                continue;
90ce3da70b43 Initial load
duke
parents:
diff changeset
   141
            }
90ce3da70b43 Initial load
duke
parents:
diff changeset
   142
            if (!(certs instanceof X509Certificate[])) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
   143
                Certificate[] tmp = new X509Certificate[certs.length];
90ce3da70b43 Initial load
duke
parents:
diff changeset
   144
                System.arraycopy(certs, 0, tmp, 0, certs.length);
90ce3da70b43 Initial load
duke
parents:
diff changeset
   145
                certs = tmp;
90ce3da70b43 Initial load
duke
parents:
diff changeset
   146
            }
90ce3da70b43 Initial load
duke
parents:
diff changeset
   147
90ce3da70b43 Initial load
duke
parents:
diff changeset
   148
            X509Credentials cred = new X509Credentials((PrivateKey)key,
90ce3da70b43 Initial load
duke
parents:
diff changeset
   149
                (X509Certificate[])certs);
90ce3da70b43 Initial load
duke
parents:
diff changeset
   150
            credentialsMap.put(alias, cred);
90ce3da70b43 Initial load
duke
parents:
diff changeset
   151
            if (debug != null && Debug.isOn("keymanager")) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
   152
                System.out.println("***");
90ce3da70b43 Initial load
duke
parents:
diff changeset
   153
                System.out.println("found key for : " + alias);
90ce3da70b43 Initial load
duke
parents:
diff changeset
   154
                for (int i = 0; i < certs.length; i++) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
   155
                    System.out.println("chain [" + i + "] = "
90ce3da70b43 Initial load
duke
parents:
diff changeset
   156
                    + certs[i]);
90ce3da70b43 Initial load
duke
parents:
diff changeset
   157
                }
90ce3da70b43 Initial load
duke
parents:
diff changeset
   158
                System.out.println("***");
90ce3da70b43 Initial load
duke
parents:
diff changeset
   159
            }
90ce3da70b43 Initial load
duke
parents:
diff changeset
   160
        }
90ce3da70b43 Initial load
duke
parents:
diff changeset
   161
    }
90ce3da70b43 Initial load
duke
parents:
diff changeset
   162
90ce3da70b43 Initial load
duke
parents:
diff changeset
   163
    /*
90ce3da70b43 Initial load
duke
parents:
diff changeset
   164
     * Returns the certificate chain associated with the given alias.
90ce3da70b43 Initial load
duke
parents:
diff changeset
   165
     *
90ce3da70b43 Initial load
duke
parents:
diff changeset
   166
     * @return the certificate chain (ordered with the user's certificate first
90ce3da70b43 Initial load
duke
parents:
diff changeset
   167
     * and the root certificate authority last)
90ce3da70b43 Initial load
duke
parents:
diff changeset
   168
     */
14664
e71aa0962e70 8003950: Adds missing Override annotations and removes unnecessary imports in sun.security.ssl
xuelei
parents: 10334
diff changeset
   169
    @Override
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
   170
    public X509Certificate[] getCertificateChain(String alias) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
   171
        if (alias == null) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
   172
            return null;
90ce3da70b43 Initial load
duke
parents:
diff changeset
   173
        }
90ce3da70b43 Initial load
duke
parents:
diff changeset
   174
        X509Credentials cred = credentialsMap.get(alias);
90ce3da70b43 Initial load
duke
parents:
diff changeset
   175
        if (cred == null) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
   176
            return null;
90ce3da70b43 Initial load
duke
parents:
diff changeset
   177
        } else {
51
6fe31bc95bbc 6600143: Remove another 450 unnecessary casts
martin
parents: 2
diff changeset
   178
            return cred.certificates.clone();
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
   179
        }
90ce3da70b43 Initial load
duke
parents:
diff changeset
   180
    }
90ce3da70b43 Initial load
duke
parents:
diff changeset
   181
90ce3da70b43 Initial load
duke
parents:
diff changeset
   182
    /*
90ce3da70b43 Initial load
duke
parents:
diff changeset
   183
     * Returns the key associated with the given alias
90ce3da70b43 Initial load
duke
parents:
diff changeset
   184
     */
14664
e71aa0962e70 8003950: Adds missing Override annotations and removes unnecessary imports in sun.security.ssl
xuelei
parents: 10334
diff changeset
   185
    @Override
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
   186
    public PrivateKey getPrivateKey(String alias) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
   187
        if (alias == null) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
   188
            return null;
90ce3da70b43 Initial load
duke
parents:
diff changeset
   189
        }
90ce3da70b43 Initial load
duke
parents:
diff changeset
   190
        X509Credentials cred = credentialsMap.get(alias);
90ce3da70b43 Initial load
duke
parents:
diff changeset
   191
        if (cred == null) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
   192
            return null;
90ce3da70b43 Initial load
duke
parents:
diff changeset
   193
        } else {
90ce3da70b43 Initial load
duke
parents:
diff changeset
   194
            return cred.privateKey;
90ce3da70b43 Initial load
duke
parents:
diff changeset
   195
        }
90ce3da70b43 Initial load
duke
parents:
diff changeset
   196
    }
90ce3da70b43 Initial load
duke
parents:
diff changeset
   197
90ce3da70b43 Initial load
duke
parents:
diff changeset
   198
    /*
90ce3da70b43 Initial load
duke
parents:
diff changeset
   199
     * Choose an alias to authenticate the client side of a secure
90ce3da70b43 Initial load
duke
parents:
diff changeset
   200
     * socket given the public key type and the list of
90ce3da70b43 Initial load
duke
parents:
diff changeset
   201
     * certificate issuer authorities recognized by the peer (if any).
90ce3da70b43 Initial load
duke
parents:
diff changeset
   202
     */
14664
e71aa0962e70 8003950: Adds missing Override annotations and removes unnecessary imports in sun.security.ssl
xuelei
parents: 10334
diff changeset
   203
    @Override
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
   204
    public String chooseClientAlias(String[] keyTypes, Principal[] issuers,
90ce3da70b43 Initial load
duke
parents:
diff changeset
   205
            Socket socket) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
   206
        /*
90ce3da70b43 Initial load
duke
parents:
diff changeset
   207
         * We currently don't do anything with socket, but
90ce3da70b43 Initial load
duke
parents:
diff changeset
   208
         * someday we might.  It might be a useful hint for
90ce3da70b43 Initial load
duke
parents:
diff changeset
   209
         * selecting one of the aliases we get back from
90ce3da70b43 Initial load
duke
parents:
diff changeset
   210
         * getClientAliases().
90ce3da70b43 Initial load
duke
parents:
diff changeset
   211
         */
90ce3da70b43 Initial load
duke
parents:
diff changeset
   212
90ce3da70b43 Initial load
duke
parents:
diff changeset
   213
        if (keyTypes == null) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
   214
            return null;
90ce3da70b43 Initial load
duke
parents:
diff changeset
   215
        }
90ce3da70b43 Initial load
duke
parents:
diff changeset
   216
90ce3da70b43 Initial load
duke
parents:
diff changeset
   217
        for (int i = 0; i < keyTypes.length; i++) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
   218
            String[] aliases = getClientAliases(keyTypes[i], issuers);
90ce3da70b43 Initial load
duke
parents:
diff changeset
   219
            if ((aliases != null) && (aliases.length > 0)) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
   220
                return aliases[0];
90ce3da70b43 Initial load
duke
parents:
diff changeset
   221
            }
90ce3da70b43 Initial load
duke
parents:
diff changeset
   222
        }
90ce3da70b43 Initial load
duke
parents:
diff changeset
   223
        return null;
90ce3da70b43 Initial load
duke
parents:
diff changeset
   224
    }
90ce3da70b43 Initial load
duke
parents:
diff changeset
   225
90ce3da70b43 Initial load
duke
parents:
diff changeset
   226
    /*
90ce3da70b43 Initial load
duke
parents:
diff changeset
   227
     * Choose an alias to authenticate the client side of an
90ce3da70b43 Initial load
duke
parents:
diff changeset
   228
     * <code>SSLEngine</code> connection given the public key type
90ce3da70b43 Initial load
duke
parents:
diff changeset
   229
     * and the list of certificate issuer authorities recognized by
90ce3da70b43 Initial load
duke
parents:
diff changeset
   230
     * the peer (if any).
90ce3da70b43 Initial load
duke
parents:
diff changeset
   231
     *
90ce3da70b43 Initial load
duke
parents:
diff changeset
   232
     * @since 1.5
90ce3da70b43 Initial load
duke
parents:
diff changeset
   233
     */
14664
e71aa0962e70 8003950: Adds missing Override annotations and removes unnecessary imports in sun.security.ssl
xuelei
parents: 10334
diff changeset
   234
    @Override
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
   235
    public String chooseEngineClientAlias(String[] keyType,
90ce3da70b43 Initial load
duke
parents:
diff changeset
   236
            Principal[] issuers, SSLEngine engine) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
   237
        /*
90ce3da70b43 Initial load
duke
parents:
diff changeset
   238
         * If we ever start using socket as a selection criteria,
90ce3da70b43 Initial load
duke
parents:
diff changeset
   239
         * we'll need to adjust this.
90ce3da70b43 Initial load
duke
parents:
diff changeset
   240
         */
90ce3da70b43 Initial load
duke
parents:
diff changeset
   241
        return chooseClientAlias(keyType, issuers, null);
90ce3da70b43 Initial load
duke
parents:
diff changeset
   242
    }
90ce3da70b43 Initial load
duke
parents:
diff changeset
   243
90ce3da70b43 Initial load
duke
parents:
diff changeset
   244
    /*
90ce3da70b43 Initial load
duke
parents:
diff changeset
   245
     * Choose an alias to authenticate the server side of a secure
90ce3da70b43 Initial load
duke
parents:
diff changeset
   246
     * socket given the public key type and the list of
90ce3da70b43 Initial load
duke
parents:
diff changeset
   247
     * certificate issuer authorities recognized by the peer (if any).
90ce3da70b43 Initial load
duke
parents:
diff changeset
   248
     */
14664
e71aa0962e70 8003950: Adds missing Override annotations and removes unnecessary imports in sun.security.ssl
xuelei
parents: 10334
diff changeset
   249
    @Override
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
   250
    public String chooseServerAlias(String keyType,
90ce3da70b43 Initial load
duke
parents:
diff changeset
   251
            Principal[] issuers, Socket socket) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
   252
        /*
90ce3da70b43 Initial load
duke
parents:
diff changeset
   253
         * We currently don't do anything with socket, but
90ce3da70b43 Initial load
duke
parents:
diff changeset
   254
         * someday we might.  It might be a useful hint for
90ce3da70b43 Initial load
duke
parents:
diff changeset
   255
         * selecting one of the aliases we get back from
90ce3da70b43 Initial load
duke
parents:
diff changeset
   256
         * getServerAliases().
90ce3da70b43 Initial load
duke
parents:
diff changeset
   257
         */
90ce3da70b43 Initial load
duke
parents:
diff changeset
   258
        if (keyType == null) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
   259
            return null;
90ce3da70b43 Initial load
duke
parents:
diff changeset
   260
        }
90ce3da70b43 Initial load
duke
parents:
diff changeset
   261
90ce3da70b43 Initial load
duke
parents:
diff changeset
   262
        String[] aliases;
90ce3da70b43 Initial load
duke
parents:
diff changeset
   263
90ce3da70b43 Initial load
duke
parents:
diff changeset
   264
        if (issuers == null || issuers.length == 0) {
51
6fe31bc95bbc 6600143: Remove another 450 unnecessary casts
martin
parents: 2
diff changeset
   265
            aliases = serverAliasCache.get(keyType);
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
   266
            if (aliases == null) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
   267
                aliases = getServerAliases(keyType, issuers);
90ce3da70b43 Initial load
duke
parents:
diff changeset
   268
                // Cache the result (positive and negative lookups)
90ce3da70b43 Initial load
duke
parents:
diff changeset
   269
                if (aliases == null) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
   270
                    aliases = STRING0;
90ce3da70b43 Initial load
duke
parents:
diff changeset
   271
                }
90ce3da70b43 Initial load
duke
parents:
diff changeset
   272
                serverAliasCache.put(keyType, aliases);
90ce3da70b43 Initial load
duke
parents:
diff changeset
   273
            }
90ce3da70b43 Initial load
duke
parents:
diff changeset
   274
        } else {
90ce3da70b43 Initial load
duke
parents:
diff changeset
   275
            aliases = getServerAliases(keyType, issuers);
90ce3da70b43 Initial load
duke
parents:
diff changeset
   276
        }
90ce3da70b43 Initial load
duke
parents:
diff changeset
   277
        if ((aliases != null) && (aliases.length > 0)) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
   278
            return aliases[0];
90ce3da70b43 Initial load
duke
parents:
diff changeset
   279
        }
90ce3da70b43 Initial load
duke
parents:
diff changeset
   280
        return null;
90ce3da70b43 Initial load
duke
parents:
diff changeset
   281
    }
90ce3da70b43 Initial load
duke
parents:
diff changeset
   282
90ce3da70b43 Initial load
duke
parents:
diff changeset
   283
    /*
90ce3da70b43 Initial load
duke
parents:
diff changeset
   284
     * Choose an alias to authenticate the server side of an
90ce3da70b43 Initial load
duke
parents:
diff changeset
   285
     * <code>SSLEngine</code> connection given the public key type
90ce3da70b43 Initial load
duke
parents:
diff changeset
   286
     * and the list of certificate issuer authorities recognized by
90ce3da70b43 Initial load
duke
parents:
diff changeset
   287
     * the peer (if any).
90ce3da70b43 Initial load
duke
parents:
diff changeset
   288
     *
90ce3da70b43 Initial load
duke
parents:
diff changeset
   289
     * @since 1.5
90ce3da70b43 Initial load
duke
parents:
diff changeset
   290
     */
14664
e71aa0962e70 8003950: Adds missing Override annotations and removes unnecessary imports in sun.security.ssl
xuelei
parents: 10334
diff changeset
   291
    @Override
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
   292
    public String chooseEngineServerAlias(String keyType,
90ce3da70b43 Initial load
duke
parents:
diff changeset
   293
            Principal[] issuers, SSLEngine engine) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
   294
        /*
90ce3da70b43 Initial load
duke
parents:
diff changeset
   295
         * If we ever start using socket as a selection criteria,
90ce3da70b43 Initial load
duke
parents:
diff changeset
   296
         * we'll need to adjust this.
90ce3da70b43 Initial load
duke
parents:
diff changeset
   297
         */
90ce3da70b43 Initial load
duke
parents:
diff changeset
   298
        return chooseServerAlias(keyType, issuers, null);
90ce3da70b43 Initial load
duke
parents:
diff changeset
   299
    }
90ce3da70b43 Initial load
duke
parents:
diff changeset
   300
90ce3da70b43 Initial load
duke
parents:
diff changeset
   301
    /*
90ce3da70b43 Initial load
duke
parents:
diff changeset
   302
     * Get the matching aliases for authenticating the client side of a secure
90ce3da70b43 Initial load
duke
parents:
diff changeset
   303
     * socket given the public key type and the list of
90ce3da70b43 Initial load
duke
parents:
diff changeset
   304
     * certificate issuer authorities recognized by the peer (if any).
90ce3da70b43 Initial load
duke
parents:
diff changeset
   305
     */
14664
e71aa0962e70 8003950: Adds missing Override annotations and removes unnecessary imports in sun.security.ssl
xuelei
parents: 10334
diff changeset
   306
    @Override
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
   307
    public String[] getClientAliases(String keyType, Principal[] issuers) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
   308
        return getAliases(keyType, issuers);
90ce3da70b43 Initial load
duke
parents:
diff changeset
   309
    }
90ce3da70b43 Initial load
duke
parents:
diff changeset
   310
90ce3da70b43 Initial load
duke
parents:
diff changeset
   311
    /*
90ce3da70b43 Initial load
duke
parents:
diff changeset
   312
     * Get the matching aliases for authenticating the server side of a secure
90ce3da70b43 Initial load
duke
parents:
diff changeset
   313
     * socket given the public key type and the list of
90ce3da70b43 Initial load
duke
parents:
diff changeset
   314
     * certificate issuer authorities recognized by the peer (if any).
90ce3da70b43 Initial load
duke
parents:
diff changeset
   315
     */
14664
e71aa0962e70 8003950: Adds missing Override annotations and removes unnecessary imports in sun.security.ssl
xuelei
parents: 10334
diff changeset
   316
    @Override
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
   317
    public String[] getServerAliases(String keyType, Principal[] issuers) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
   318
        return getAliases(keyType, issuers);
90ce3da70b43 Initial load
duke
parents:
diff changeset
   319
    }
90ce3da70b43 Initial load
duke
parents:
diff changeset
   320
90ce3da70b43 Initial load
duke
parents:
diff changeset
   321
    /*
90ce3da70b43 Initial load
duke
parents:
diff changeset
   322
     * Get the matching aliases for authenticating the either side of a secure
90ce3da70b43 Initial load
duke
parents:
diff changeset
   323
     * socket given the public key type and the list of
90ce3da70b43 Initial load
duke
parents:
diff changeset
   324
     * certificate issuer authorities recognized by the peer (if any).
90ce3da70b43 Initial load
duke
parents:
diff changeset
   325
     *
90ce3da70b43 Initial load
duke
parents:
diff changeset
   326
     * Issuers comes to us in the form of X500Principal[].
90ce3da70b43 Initial load
duke
parents:
diff changeset
   327
     */
90ce3da70b43 Initial load
duke
parents:
diff changeset
   328
    private String[] getAliases(String keyType, Principal[] issuers) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
   329
        if (keyType == null) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
   330
            return null;
90ce3da70b43 Initial load
duke
parents:
diff changeset
   331
        }
90ce3da70b43 Initial load
duke
parents:
diff changeset
   332
        if (issuers == null) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
   333
            issuers = new X500Principal[0];
90ce3da70b43 Initial load
duke
parents:
diff changeset
   334
        }
90ce3da70b43 Initial load
duke
parents:
diff changeset
   335
        if (issuers instanceof X500Principal[] == false) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
   336
            // normally, this will never happen but try to recover if it does
90ce3da70b43 Initial load
duke
parents:
diff changeset
   337
            issuers = convertPrincipals(issuers);
90ce3da70b43 Initial load
duke
parents:
diff changeset
   338
        }
90ce3da70b43 Initial load
duke
parents:
diff changeset
   339
        String sigType;
90ce3da70b43 Initial load
duke
parents:
diff changeset
   340
        if (keyType.contains("_")) {
24685
215fa91e1b4c 8044461: Cleanup new Boolean and single character strings
rriggs
parents: 23010
diff changeset
   341
            int k = keyType.indexOf('_');
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
   342
            sigType = keyType.substring(k + 1);
90ce3da70b43 Initial load
duke
parents:
diff changeset
   343
            keyType = keyType.substring(0, k);
90ce3da70b43 Initial load
duke
parents:
diff changeset
   344
        } else {
90ce3da70b43 Initial load
duke
parents:
diff changeset
   345
            sigType = null;
90ce3da70b43 Initial load
duke
parents:
diff changeset
   346
        }
90ce3da70b43 Initial load
duke
parents:
diff changeset
   347
90ce3da70b43 Initial load
duke
parents:
diff changeset
   348
        X500Principal[] x500Issuers = (X500Principal[])issuers;
90ce3da70b43 Initial load
duke
parents:
diff changeset
   349
        // the algorithm below does not produce duplicates, so avoid Set
7990
57019dc81b66 7012003: diamond conversion for ssl
smarks
parents: 5506
diff changeset
   350
        List<String> aliases = new ArrayList<>();
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
   351
90ce3da70b43 Initial load
duke
parents:
diff changeset
   352
        for (Map.Entry<String,X509Credentials> entry :
90ce3da70b43 Initial load
duke
parents:
diff changeset
   353
                                                credentialsMap.entrySet()) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
   354
90ce3da70b43 Initial load
duke
parents:
diff changeset
   355
            String alias = entry.getKey();
90ce3da70b43 Initial load
duke
parents:
diff changeset
   356
            X509Credentials credentials = entry.getValue();
90ce3da70b43 Initial load
duke
parents:
diff changeset
   357
            X509Certificate[] certs = credentials.certificates;
90ce3da70b43 Initial load
duke
parents:
diff changeset
   358
90ce3da70b43 Initial load
duke
parents:
diff changeset
   359
            if (!keyType.equals(certs[0].getPublicKey().getAlgorithm())) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
   360
                continue;
90ce3da70b43 Initial load
duke
parents:
diff changeset
   361
            }
90ce3da70b43 Initial load
duke
parents:
diff changeset
   362
            if (sigType != null) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
   363
                if (certs.length > 1) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
   364
                    // if possible, check the public key in the issuer cert
10334
26b816b3f236 7063647: To use synchronized map in key manager
xuelei
parents: 9035
diff changeset
   365
                    if (!sigType.equals(
26b816b3f236 7063647: To use synchronized map in key manager
xuelei
parents: 9035
diff changeset
   366
                            certs[1].getPublicKey().getAlgorithm())) {
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
   367
                        continue;
90ce3da70b43 Initial load
duke
parents:
diff changeset
   368
                    }
90ce3da70b43 Initial load
duke
parents:
diff changeset
   369
                } else {
90ce3da70b43 Initial load
duke
parents:
diff changeset
   370
                    // Check the signature algorithm of the certificate itself.
90ce3da70b43 Initial load
duke
parents:
diff changeset
   371
                    // Look for the "withRSA" in "SHA1withRSA", etc.
90ce3da70b43 Initial load
duke
parents:
diff changeset
   372
                    String sigAlgName =
10334
26b816b3f236 7063647: To use synchronized map in key manager
xuelei
parents: 9035
diff changeset
   373
                        certs[0].getSigAlgName().toUpperCase(Locale.ENGLISH);
26b816b3f236 7063647: To use synchronized map in key manager
xuelei
parents: 9035
diff changeset
   374
                    String pattern = "WITH" +
26b816b3f236 7063647: To use synchronized map in key manager
xuelei
parents: 9035
diff changeset
   375
                        sigType.toUpperCase(Locale.ENGLISH);
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
   376
                    if (sigAlgName.contains(pattern) == false) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
   377
                        continue;
90ce3da70b43 Initial load
duke
parents:
diff changeset
   378
                    }
90ce3da70b43 Initial load
duke
parents:
diff changeset
   379
                }
90ce3da70b43 Initial load
duke
parents:
diff changeset
   380
            }
90ce3da70b43 Initial load
duke
parents:
diff changeset
   381
90ce3da70b43 Initial load
duke
parents:
diff changeset
   382
            if (issuers.length == 0) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
   383
                // no issuer specified, match all
90ce3da70b43 Initial load
duke
parents:
diff changeset
   384
                aliases.add(alias);
90ce3da70b43 Initial load
duke
parents:
diff changeset
   385
                if (debug != null && Debug.isOn("keymanager")) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
   386
                    System.out.println("matching alias: " + alias);
90ce3da70b43 Initial load
duke
parents:
diff changeset
   387
                }
90ce3da70b43 Initial load
duke
parents:
diff changeset
   388
            } else {
90ce3da70b43 Initial load
duke
parents:
diff changeset
   389
                Set<X500Principal> certIssuers =
90ce3da70b43 Initial load
duke
parents:
diff changeset
   390
                                        credentials.getIssuerX500Principals();
90ce3da70b43 Initial load
duke
parents:
diff changeset
   391
                for (int i = 0; i < x500Issuers.length; i++) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
   392
                    if (certIssuers.contains(issuers[i])) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
   393
                        aliases.add(alias);
90ce3da70b43 Initial load
duke
parents:
diff changeset
   394
                        if (debug != null && Debug.isOn("keymanager")) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
   395
                            System.out.println("matching alias: " + alias);
90ce3da70b43 Initial load
duke
parents:
diff changeset
   396
                        }
90ce3da70b43 Initial load
duke
parents:
diff changeset
   397
                        break;
90ce3da70b43 Initial load
duke
parents:
diff changeset
   398
                    }
90ce3da70b43 Initial load
duke
parents:
diff changeset
   399
                }
90ce3da70b43 Initial load
duke
parents:
diff changeset
   400
            }
90ce3da70b43 Initial load
duke
parents:
diff changeset
   401
        }
90ce3da70b43 Initial load
duke
parents:
diff changeset
   402
51
6fe31bc95bbc 6600143: Remove another 450 unnecessary casts
martin
parents: 2
diff changeset
   403
        String[] aliasStrings = aliases.toArray(STRING0);
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
   404
        return ((aliasStrings.length == 0) ? null : aliasStrings);
90ce3da70b43 Initial load
duke
parents:
diff changeset
   405
    }
90ce3da70b43 Initial load
duke
parents:
diff changeset
   406
90ce3da70b43 Initial load
duke
parents:
diff changeset
   407
    /*
90ce3da70b43 Initial load
duke
parents:
diff changeset
   408
     * Convert an array of Principals to an array of X500Principals, if
90ce3da70b43 Initial load
duke
parents:
diff changeset
   409
     * possible. Principals that cannot be converted are ignored.
90ce3da70b43 Initial load
duke
parents:
diff changeset
   410
     */
90ce3da70b43 Initial load
duke
parents:
diff changeset
   411
    private static X500Principal[] convertPrincipals(Principal[] principals) {
7990
57019dc81b66 7012003: diamond conversion for ssl
smarks
parents: 5506
diff changeset
   412
        List<X500Principal> list = new ArrayList<>(principals.length);
2
90ce3da70b43 Initial load
duke
parents:
diff changeset
   413
        for (int i = 0; i < principals.length; i++) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
   414
            Principal p = principals[i];
90ce3da70b43 Initial load
duke
parents:
diff changeset
   415
            if (p instanceof X500Principal) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
   416
                list.add((X500Principal)p);
90ce3da70b43 Initial load
duke
parents:
diff changeset
   417
            } else {
90ce3da70b43 Initial load
duke
parents:
diff changeset
   418
                try {
90ce3da70b43 Initial load
duke
parents:
diff changeset
   419
                    list.add(new X500Principal(p.getName()));
90ce3da70b43 Initial load
duke
parents:
diff changeset
   420
                } catch (IllegalArgumentException e) {
90ce3da70b43 Initial load
duke
parents:
diff changeset
   421
                    // ignore
90ce3da70b43 Initial load
duke
parents:
diff changeset
   422
                }
90ce3da70b43 Initial load
duke
parents:
diff changeset
   423
            }
90ce3da70b43 Initial load
duke
parents:
diff changeset
   424
        }
90ce3da70b43 Initial load
duke
parents:
diff changeset
   425
        return list.toArray(new X500Principal[list.size()]);
90ce3da70b43 Initial load
duke
parents:
diff changeset
   426
    }
90ce3da70b43 Initial load
duke
parents:
diff changeset
   427
}