author | chegar |
Thu, 17 Oct 2019 20:54:25 +0100 | |
branch | datagramsocketimpl-branch |
changeset 58679 | 9c3209ff7550 |
parent 58678 | 9cf78a70fa4f |
parent 57950 | 4612a3cfb927 |
permissions | -rw-r--r-- |
2 | 1 |
/* |
57950
4612a3cfb927
8229999: Apply java.io.Serial annotations to security types in java.base
darcy
parents:
57792
diff
changeset
|
2 |
* Copyright (c) 1997, 2019, Oracle and/or its affiliates. All rights reserved. |
2 | 3 |
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. |
4 |
* |
|
5 |
* This code is free software; you can redistribute it and/or modify it |
|
6 |
* under the terms of the GNU General Public License version 2 only, as |
|
5506 | 7 |
* published by the Free Software Foundation. Oracle designates this |
2 | 8 |
* particular file as subject to the "Classpath" exception as provided |
5506 | 9 |
* by Oracle in the LICENSE file that accompanied this code. |
2 | 10 |
* |
11 |
* This code is distributed in the hope that it will be useful, but WITHOUT |
|
12 |
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or |
|
13 |
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License |
|
14 |
* version 2 for more details (a copy is included in the LICENSE file that |
|
15 |
* accompanied this code). |
|
16 |
* |
|
17 |
* You should have received a copy of the GNU General Public License version |
|
18 |
* 2 along with this work; if not, write to the Free Software Foundation, |
|
19 |
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA. |
|
20 |
* |
|
5506 | 21 |
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA |
22 |
* or visit www.oracle.com if you need additional information or have any |
|
23 |
* questions. |
|
2 | 24 |
*/ |
25 |
||
26 |
package java.security; |
|
27 |
||
28 |
||
29 |
import java.net.URL; |
|
30 |
import java.net.SocketPermission; |
|
31 |
import java.util.ArrayList; |
|
32 |
import java.util.List; |
|
33 |
import java.util.Hashtable; |
|
34 |
import java.io.ByteArrayInputStream; |
|
35 |
import java.io.IOException; |
|
36 |
import java.security.cert.*; |
|
31141
ef5ddf021137
6826789: SecureClassLoader should not use CodeSource URLs as HashMap keys
mullan
parents:
30033
diff
changeset
|
37 |
import sun.net.util.URLUtil; |
47418
6993f9f1ff83
8181432: Better processing of unresolved permissions
weijun
parents:
47216
diff
changeset
|
38 |
import sun.security.util.IOUtils; |
2 | 39 |
|
40 |
/** |
|
41 |
* |
|
42 |
* <p>This class extends the concept of a codebase to |
|
43 |
* encapsulate not only the location (URL) but also the certificate chains |
|
44 |
* that were used to verify signed code originating from that location. |
|
45 |
* |
|
46 |
* @author Li Gong |
|
47 |
* @author Roland Schemers |
|
45434
4582657c7260
8181082: class-level since tag issues in java.base & java.datatransfer module
mli
parents:
39560
diff
changeset
|
48 |
* @since 1.2 |
2 | 49 |
*/ |
50 |
||
51 |
public class CodeSource implements java.io.Serializable { |
|
52 |
||
57950
4612a3cfb927
8229999: Apply java.io.Serial annotations to security types in java.base
darcy
parents:
57792
diff
changeset
|
53 |
@java.io.Serial |
2 | 54 |
private static final long serialVersionUID = 4977541819976013951L; |
55 |
||
56 |
/** |
|
57 |
* The code location. |
|
58 |
* |
|
59 |
* @serial |
|
60 |
*/ |
|
57792
1b6806340400
8229773: Resolve permissions for code source URLs lazily
redestad
parents:
52700
diff
changeset
|
61 |
private final URL location; |
2 | 62 |
|
63 |
/* |
|
64 |
* The code signers. |
|
65 |
*/ |
|
66 |
private transient CodeSigner[] signers = null; |
|
67 |
||
68 |
/* |
|
69 |
* The code signers. Certificate chains are concatenated. |
|
70 |
*/ |
|
31538
0981099a3e54
8130022: Use Java-style array declarations consistently
igerasim
parents:
31141
diff
changeset
|
71 |
private transient java.security.cert.Certificate[] certs = null; |
2 | 72 |
|
73 |
// cached SocketPermission used for matchLocation |
|
74 |
private transient SocketPermission sp; |
|
75 |
||
76 |
// for generating cert paths |
|
77 |
private transient CertificateFactory factory = null; |
|
78 |
||
79 |
/** |
|
31141
ef5ddf021137
6826789: SecureClassLoader should not use CodeSource URLs as HashMap keys
mullan
parents:
30033
diff
changeset
|
80 |
* A String form of the URL for use as a key in HashMaps/Sets. The String |
ef5ddf021137
6826789: SecureClassLoader should not use CodeSource URLs as HashMap keys
mullan
parents:
30033
diff
changeset
|
81 |
* form should be behave in the same manner as the URL when compared for |
ef5ddf021137
6826789: SecureClassLoader should not use CodeSource URLs as HashMap keys
mullan
parents:
30033
diff
changeset
|
82 |
* equality in a HashMap/Set, except that no nameservice lookup is done |
ef5ddf021137
6826789: SecureClassLoader should not use CodeSource URLs as HashMap keys
mullan
parents:
30033
diff
changeset
|
83 |
* on the hostname (only string comparison), and the fragment is not |
ef5ddf021137
6826789: SecureClassLoader should not use CodeSource URLs as HashMap keys
mullan
parents:
30033
diff
changeset
|
84 |
* considered. |
ef5ddf021137
6826789: SecureClassLoader should not use CodeSource URLs as HashMap keys
mullan
parents:
30033
diff
changeset
|
85 |
*/ |
ef5ddf021137
6826789: SecureClassLoader should not use CodeSource URLs as HashMap keys
mullan
parents:
30033
diff
changeset
|
86 |
private transient String locationNoFragString; |
ef5ddf021137
6826789: SecureClassLoader should not use CodeSource URLs as HashMap keys
mullan
parents:
30033
diff
changeset
|
87 |
|
ef5ddf021137
6826789: SecureClassLoader should not use CodeSource URLs as HashMap keys
mullan
parents:
30033
diff
changeset
|
88 |
/** |
2 | 89 |
* Constructs a CodeSource and associates it with the specified |
90 |
* location and set of certificates. |
|
91 |
* |
|
39560
e6ec33bddfcc
8129972: Clarify the javadoc of java.security.CodeSource as to the nullability of 'location'
jnimeh
parents:
31804
diff
changeset
|
92 |
* @param url the location (URL). It may be {@code null}. |
e6ec33bddfcc
8129972: Clarify the javadoc of java.security.CodeSource as to the nullability of 'location'
jnimeh
parents:
31804
diff
changeset
|
93 |
* @param certs the certificate(s). It may be {@code null}. The contents |
e6ec33bddfcc
8129972: Clarify the javadoc of java.security.CodeSource as to the nullability of 'location'
jnimeh
parents:
31804
diff
changeset
|
94 |
* of the array are copied to protect against subsequent modification. |
2 | 95 |
*/ |
31538
0981099a3e54
8130022: Use Java-style array declarations consistently
igerasim
parents:
31141
diff
changeset
|
96 |
public CodeSource(URL url, java.security.cert.Certificate[] certs) { |
2 | 97 |
this.location = url; |
31141
ef5ddf021137
6826789: SecureClassLoader should not use CodeSource URLs as HashMap keys
mullan
parents:
30033
diff
changeset
|
98 |
if (url != null) { |
ef5ddf021137
6826789: SecureClassLoader should not use CodeSource URLs as HashMap keys
mullan
parents:
30033
diff
changeset
|
99 |
this.locationNoFragString = URLUtil.urlNoFragString(url); |
ef5ddf021137
6826789: SecureClassLoader should not use CodeSource URLs as HashMap keys
mullan
parents:
30033
diff
changeset
|
100 |
} |
2 | 101 |
|
102 |
// Copy the supplied certs |
|
103 |
if (certs != null) { |
|
104 |
this.certs = certs.clone(); |
|
105 |
} |
|
106 |
} |
|
107 |
||
108 |
/** |
|
109 |
* Constructs a CodeSource and associates it with the specified |
|
110 |
* location and set of code signers. |
|
111 |
* |
|
39560
e6ec33bddfcc
8129972: Clarify the javadoc of java.security.CodeSource as to the nullability of 'location'
jnimeh
parents:
31804
diff
changeset
|
112 |
* @param url the location (URL). It may be {@code null}. |
e6ec33bddfcc
8129972: Clarify the javadoc of java.security.CodeSource as to the nullability of 'location'
jnimeh
parents:
31804
diff
changeset
|
113 |
* @param signers the code signers. It may be {@code null}. The contents |
e6ec33bddfcc
8129972: Clarify the javadoc of java.security.CodeSource as to the nullability of 'location'
jnimeh
parents:
31804
diff
changeset
|
114 |
* of the array are copied to protect against subsequent modification. |
2 | 115 |
* |
116 |
* @since 1.5 |
|
117 |
*/ |
|
118 |
public CodeSource(URL url, CodeSigner[] signers) { |
|
119 |
this.location = url; |
|
31141
ef5ddf021137
6826789: SecureClassLoader should not use CodeSource URLs as HashMap keys
mullan
parents:
30033
diff
changeset
|
120 |
if (url != null) { |
ef5ddf021137
6826789: SecureClassLoader should not use CodeSource URLs as HashMap keys
mullan
parents:
30033
diff
changeset
|
121 |
this.locationNoFragString = URLUtil.urlNoFragString(url); |
ef5ddf021137
6826789: SecureClassLoader should not use CodeSource URLs as HashMap keys
mullan
parents:
30033
diff
changeset
|
122 |
} |
2 | 123 |
|
124 |
// Copy the supplied signers |
|
125 |
if (signers != null) { |
|
126 |
this.signers = signers.clone(); |
|
127 |
} |
|
128 |
} |
|
129 |
||
130 |
/** |
|
131 |
* Returns the hash code value for this object. |
|
132 |
* |
|
133 |
* @return a hash code value for this object. |
|
134 |
*/ |
|
12434
fed433bd7b71
7152564: Improve CodeSource.matchLocation(CodeSource) performance
mullan
parents:
8784
diff
changeset
|
135 |
@Override |
2 | 136 |
public int hashCode() { |
137 |
if (location != null) |
|
138 |
return location.hashCode(); |
|
139 |
else |
|
140 |
return 0; |
|
141 |
} |
|
142 |
||
143 |
/** |
|
144 |
* Tests for equality between the specified object and this |
|
145 |
* object. Two CodeSource objects are considered equal if their |
|
146 |
* locations are of identical value and if their signer certificate |
|
147 |
* chains are of identical value. It is not required that |
|
148 |
* the certificate chains be in the same order. |
|
149 |
* |
|
150 |
* @param obj the object to test for equality with this object. |
|
151 |
* |
|
152 |
* @return true if the objects are considered equal, false otherwise. |
|
153 |
*/ |
|
12434
fed433bd7b71
7152564: Improve CodeSource.matchLocation(CodeSource) performance
mullan
parents:
8784
diff
changeset
|
154 |
@Override |
2 | 155 |
public boolean equals(Object obj) { |
156 |
if (obj == this) |
|
157 |
return true; |
|
158 |
||
159 |
// objects types must be equal |
|
160 |
if (!(obj instanceof CodeSource)) |
|
161 |
return false; |
|
162 |
||
163 |
CodeSource cs = (CodeSource) obj; |
|
164 |
||
165 |
// URLs must match |
|
166 |
if (location == null) { |
|
167 |
// if location is null, then cs.location must be null as well |
|
168 |
if (cs.location != null) return false; |
|
169 |
} else { |
|
170 |
// if location is not null, then it must equal cs.location |
|
171 |
if (!location.equals(cs.location)) return false; |
|
172 |
} |
|
173 |
||
174 |
// certs must match |
|
175 |
return matchCerts(cs, true); |
|
176 |
} |
|
177 |
||
178 |
/** |
|
179 |
* Returns the location associated with this CodeSource. |
|
180 |
* |
|
39560
e6ec33bddfcc
8129972: Clarify the javadoc of java.security.CodeSource as to the nullability of 'location'
jnimeh
parents:
31804
diff
changeset
|
181 |
* @return the location (URL), or {@code null} if no URL was supplied |
e6ec33bddfcc
8129972: Clarify the javadoc of java.security.CodeSource as to the nullability of 'location'
jnimeh
parents:
31804
diff
changeset
|
182 |
* during construction. |
2 | 183 |
*/ |
184 |
public final URL getLocation() { |
|
185 |
/* since URL is practically immutable, returning itself is not |
|
186 |
a security problem */ |
|
187 |
return this.location; |
|
188 |
} |
|
189 |
||
190 |
/** |
|
31141
ef5ddf021137
6826789: SecureClassLoader should not use CodeSource URLs as HashMap keys
mullan
parents:
30033
diff
changeset
|
191 |
* Returns a String form of the URL for use as a key in HashMaps/Sets. |
ef5ddf021137
6826789: SecureClassLoader should not use CodeSource URLs as HashMap keys
mullan
parents:
30033
diff
changeset
|
192 |
*/ |
ef5ddf021137
6826789: SecureClassLoader should not use CodeSource URLs as HashMap keys
mullan
parents:
30033
diff
changeset
|
193 |
String getLocationNoFragString() { |
ef5ddf021137
6826789: SecureClassLoader should not use CodeSource URLs as HashMap keys
mullan
parents:
30033
diff
changeset
|
194 |
return locationNoFragString; |
ef5ddf021137
6826789: SecureClassLoader should not use CodeSource URLs as HashMap keys
mullan
parents:
30033
diff
changeset
|
195 |
} |
ef5ddf021137
6826789: SecureClassLoader should not use CodeSource URLs as HashMap keys
mullan
parents:
30033
diff
changeset
|
196 |
|
ef5ddf021137
6826789: SecureClassLoader should not use CodeSource URLs as HashMap keys
mullan
parents:
30033
diff
changeset
|
197 |
/** |
2 | 198 |
* Returns the certificates associated with this CodeSource. |
199 |
* <p> |
|
200 |
* If this CodeSource object was created using the |
|
201 |
* {@link #CodeSource(URL url, CodeSigner[] signers)} |
|
202 |
* constructor then its certificate chains are extracted and used to |
|
203 |
* create an array of Certificate objects. Each signer certificate is |
|
204 |
* followed by its supporting certificate chain (which may be empty). |
|
205 |
* Each signer certificate and its supporting certificate chain is ordered |
|
206 |
* bottom-to-top (i.e., with the signer certificate first and the (root) |
|
207 |
* certificate authority last). |
|
208 |
* |
|
39560
e6ec33bddfcc
8129972: Clarify the javadoc of java.security.CodeSource as to the nullability of 'location'
jnimeh
parents:
31804
diff
changeset
|
209 |
* @return a copy of the certificate array, or {@code null} if there |
e6ec33bddfcc
8129972: Clarify the javadoc of java.security.CodeSource as to the nullability of 'location'
jnimeh
parents:
31804
diff
changeset
|
210 |
* is none. |
2 | 211 |
*/ |
212 |
public final java.security.cert.Certificate[] getCertificates() { |
|
213 |
if (certs != null) { |
|
214 |
return certs.clone(); |
|
215 |
||
216 |
} else if (signers != null) { |
|
217 |
// Convert the code signers to certs |
|
218 |
ArrayList<java.security.cert.Certificate> certChains = |
|
7970
af1579474d16
7008728: diamond conversion of basic security, permissions, authentication
smarks
parents:
5506
diff
changeset
|
219 |
new ArrayList<>(); |
2 | 220 |
for (int i = 0; i < signers.length; i++) { |
221 |
certChains.addAll( |
|
222 |
signers[i].getSignerCertPath().getCertificates()); |
|
223 |
} |
|
224 |
certs = certChains.toArray( |
|
225 |
new java.security.cert.Certificate[certChains.size()]); |
|
226 |
return certs.clone(); |
|
227 |
||
228 |
} else { |
|
229 |
return null; |
|
230 |
} |
|
231 |
} |
|
232 |
||
233 |
/** |
|
234 |
* Returns the code signers associated with this CodeSource. |
|
235 |
* <p> |
|
236 |
* If this CodeSource object was created using the |
|
14014 | 237 |
* {@link #CodeSource(URL url, java.security.cert.Certificate[] certs)} |
2 | 238 |
* constructor then its certificate chains are extracted and used to |
239 |
* create an array of CodeSigner objects. Note that only X.509 certificates |
|
240 |
* are examined - all other certificate types are ignored. |
|
241 |
* |
|
39560
e6ec33bddfcc
8129972: Clarify the javadoc of java.security.CodeSource as to the nullability of 'location'
jnimeh
parents:
31804
diff
changeset
|
242 |
* @return a copy of the code signer array, or {@code null} if there |
e6ec33bddfcc
8129972: Clarify the javadoc of java.security.CodeSource as to the nullability of 'location'
jnimeh
parents:
31804
diff
changeset
|
243 |
* is none. |
2 | 244 |
* |
245 |
* @since 1.5 |
|
246 |
*/ |
|
247 |
public final CodeSigner[] getCodeSigners() { |
|
248 |
if (signers != null) { |
|
249 |
return signers.clone(); |
|
250 |
||
251 |
} else if (certs != null) { |
|
252 |
// Convert the certs to code signers |
|
253 |
signers = convertCertArrayToSignerArray(certs); |
|
254 |
return signers.clone(); |
|
255 |
||
256 |
} else { |
|
257 |
return null; |
|
258 |
} |
|
259 |
} |
|
260 |
||
261 |
/** |
|
262 |
* Returns true if this CodeSource object "implies" the specified CodeSource. |
|
12434
fed433bd7b71
7152564: Improve CodeSource.matchLocation(CodeSource) performance
mullan
parents:
8784
diff
changeset
|
263 |
* <p> |
fed433bd7b71
7152564: Improve CodeSource.matchLocation(CodeSource) performance
mullan
parents:
8784
diff
changeset
|
264 |
* More specifically, this method makes the following checks. |
21334 | 265 |
* If any fail, it returns false. If they all succeed, it returns true. |
12434
fed433bd7b71
7152564: Improve CodeSource.matchLocation(CodeSource) performance
mullan
parents:
8784
diff
changeset
|
266 |
* <ul> |
2 | 267 |
* <li> <i>codesource</i> must not be null. |
268 |
* <li> If this object's certificates are not null, then all |
|
269 |
* of this object's certificates must be present in <i>codesource</i>'s |
|
270 |
* certificates. |
|
271 |
* <li> If this object's location (getLocation()) is not null, then the |
|
272 |
* following checks are made against this object's location and |
|
21334 | 273 |
* <i>codesource</i>'s: |
12434
fed433bd7b71
7152564: Improve CodeSource.matchLocation(CodeSource) performance
mullan
parents:
8784
diff
changeset
|
274 |
* <ul> |
2 | 275 |
* <li> <i>codesource</i>'s location must not be null. |
276 |
* |
|
277 |
* <li> If this object's location |
|
278 |
* equals <i>codesource</i>'s location, then return true. |
|
279 |
* |
|
280 |
* <li> This object's protocol (getLocation().getProtocol()) must be |
|
12434
fed433bd7b71
7152564: Improve CodeSource.matchLocation(CodeSource) performance
mullan
parents:
8784
diff
changeset
|
281 |
* equal to <i>codesource</i>'s protocol, ignoring case. |
2 | 282 |
* |
283 |
* <li> If this object's host (getLocation().getHost()) is not null, |
|
284 |
* then the SocketPermission |
|
285 |
* constructed with this object's host must imply the |
|
286 |
* SocketPermission constructed with <i>codesource</i>'s host. |
|
287 |
* |
|
288 |
* <li> If this object's port (getLocation().getPort()) is not |
|
289 |
* equal to -1 (that is, if a port is specified), it must equal |
|
12434
fed433bd7b71
7152564: Improve CodeSource.matchLocation(CodeSource) performance
mullan
parents:
8784
diff
changeset
|
290 |
* <i>codesource</i>'s port or default port |
fed433bd7b71
7152564: Improve CodeSource.matchLocation(CodeSource) performance
mullan
parents:
8784
diff
changeset
|
291 |
* (codesource.getLocation().getDefaultPort()). |
2 | 292 |
* |
293 |
* <li> If this object's file (getLocation().getFile()) doesn't equal |
|
294 |
* <i>codesource</i>'s file, then the following checks are made: |
|
295 |
* If this object's file ends with "/-", |
|
296 |
* then <i>codesource</i>'s file must start with this object's |
|
297 |
* file (exclusive the trailing "-"). |
|
298 |
* If this object's file ends with a "/*", |
|
299 |
* then <i>codesource</i>'s file must start with this object's |
|
300 |
* file and must not have any further "/" separators. |
|
301 |
* If this object's file doesn't end with a "/", |
|
302 |
* then <i>codesource</i>'s file must match this object's |
|
303 |
* file with a '/' appended. |
|
304 |
* |
|
305 |
* <li> If this object's reference (getLocation().getRef()) is |
|
306 |
* not null, it must equal <i>codesource</i>'s reference. |
|
307 |
* |
|
12434
fed433bd7b71
7152564: Improve CodeSource.matchLocation(CodeSource) performance
mullan
parents:
8784
diff
changeset
|
308 |
* </ul> |
fed433bd7b71
7152564: Improve CodeSource.matchLocation(CodeSource) performance
mullan
parents:
8784
diff
changeset
|
309 |
* </ul> |
2 | 310 |
* <p> |
311 |
* For example, the codesource objects with the following locations |
|
312 |
* and null certificates all imply |
|
52700
b206bdfb9fe2
8213911: Use example.com in java.net and other examples
darcy
parents:
47418
diff
changeset
|
313 |
* the codesource with the location "http://www.example.com/classes/foo.jar" |
2 | 314 |
* and null certificates: |
315 |
* <pre> |
|
316 |
* http: |
|
52700
b206bdfb9fe2
8213911: Use example.com in java.net and other examples
darcy
parents:
47418
diff
changeset
|
317 |
* http://*.example.com/classes/* |
b206bdfb9fe2
8213911: Use example.com in java.net and other examples
darcy
parents:
47418
diff
changeset
|
318 |
* http://www.example.com/classes/- |
b206bdfb9fe2
8213911: Use example.com in java.net and other examples
darcy
parents:
47418
diff
changeset
|
319 |
* http://www.example.com/classes/foo.jar |
2 | 320 |
* </pre> |
321 |
* |
|
322 |
* Note that if this CodeSource has a null location and a null |
|
323 |
* certificate chain, then it implies every other CodeSource. |
|
324 |
* |
|
325 |
* @param codesource CodeSource to compare against. |
|
326 |
* |
|
327 |
* @return true if the specified codesource is implied by this codesource, |
|
328 |
* false if not. |
|
329 |
*/ |
|
330 |
public boolean implies(CodeSource codesource) |
|
331 |
{ |
|
332 |
if (codesource == null) |
|
333 |
return false; |
|
334 |
||
335 |
return matchCerts(codesource, false) && matchLocation(codesource); |
|
336 |
} |
|
337 |
||
338 |
/** |
|
339 |
* Returns true if all the certs in this |
|
340 |
* CodeSource are also in <i>that</i>. |
|
341 |
* |
|
342 |
* @param that the CodeSource to check against. |
|
39560
e6ec33bddfcc
8129972: Clarify the javadoc of java.security.CodeSource as to the nullability of 'location'
jnimeh
parents:
31804
diff
changeset
|
343 |
* @param strict if true then a strict equality match is performed. |
2 | 344 |
* Otherwise a subset match is performed. |
345 |
*/ |
|
31804
013c14047253
8131486: SecureClassLoader key for ProtectionDomain cache also needs to take into account certificates
mullan
parents:
31538
diff
changeset
|
346 |
boolean matchCerts(CodeSource that, boolean strict) |
2 | 347 |
{ |
348 |
boolean match; |
|
349 |
||
350 |
// match any key |
|
351 |
if (certs == null && signers == null) { |
|
352 |
if (strict) { |
|
353 |
return (that.certs == null && that.signers == null); |
|
354 |
} else { |
|
355 |
return true; |
|
356 |
} |
|
357 |
// both have signers |
|
358 |
} else if (signers != null && that.signers != null) { |
|
359 |
if (strict && signers.length != that.signers.length) { |
|
360 |
return false; |
|
361 |
} |
|
362 |
for (int i = 0; i < signers.length; i++) { |
|
363 |
match = false; |
|
364 |
for (int j = 0; j < that.signers.length; j++) { |
|
365 |
if (signers[i].equals(that.signers[j])) { |
|
366 |
match = true; |
|
367 |
break; |
|
368 |
} |
|
369 |
} |
|
370 |
if (!match) return false; |
|
371 |
} |
|
372 |
return true; |
|
373 |
||
374 |
// both have certs |
|
375 |
} else if (certs != null && that.certs != null) { |
|
376 |
if (strict && certs.length != that.certs.length) { |
|
377 |
return false; |
|
378 |
} |
|
379 |
for (int i = 0; i < certs.length; i++) { |
|
380 |
match = false; |
|
381 |
for (int j = 0; j < that.certs.length; j++) { |
|
382 |
if (certs[i].equals(that.certs[j])) { |
|
383 |
match = true; |
|
384 |
break; |
|
385 |
} |
|
386 |
} |
|
387 |
if (!match) return false; |
|
388 |
} |
|
389 |
return true; |
|
390 |
} |
|
391 |
||
392 |
return false; |
|
393 |
} |
|
394 |
||
395 |
||
396 |
/** |
|
397 |
* Returns true if two CodeSource's have the "same" location. |
|
398 |
* |
|
399 |
* @param that CodeSource to compare against |
|
400 |
*/ |
|
12434
fed433bd7b71
7152564: Improve CodeSource.matchLocation(CodeSource) performance
mullan
parents:
8784
diff
changeset
|
401 |
private boolean matchLocation(CodeSource that) { |
fed433bd7b71
7152564: Improve CodeSource.matchLocation(CodeSource) performance
mullan
parents:
8784
diff
changeset
|
402 |
if (location == null) |
fed433bd7b71
7152564: Improve CodeSource.matchLocation(CodeSource) performance
mullan
parents:
8784
diff
changeset
|
403 |
return true; |
2 | 404 |
|
12434
fed433bd7b71
7152564: Improve CodeSource.matchLocation(CodeSource) performance
mullan
parents:
8784
diff
changeset
|
405 |
if ((that == null) || (that.location == null)) |
fed433bd7b71
7152564: Improve CodeSource.matchLocation(CodeSource) performance
mullan
parents:
8784
diff
changeset
|
406 |
return false; |
fed433bd7b71
7152564: Improve CodeSource.matchLocation(CodeSource) performance
mullan
parents:
8784
diff
changeset
|
407 |
|
fed433bd7b71
7152564: Improve CodeSource.matchLocation(CodeSource) performance
mullan
parents:
8784
diff
changeset
|
408 |
if (location.equals(that.location)) |
fed433bd7b71
7152564: Improve CodeSource.matchLocation(CodeSource) performance
mullan
parents:
8784
diff
changeset
|
409 |
return true; |
2 | 410 |
|
12434
fed433bd7b71
7152564: Improve CodeSource.matchLocation(CodeSource) performance
mullan
parents:
8784
diff
changeset
|
411 |
if (!location.getProtocol().equalsIgnoreCase(that.location.getProtocol())) |
fed433bd7b71
7152564: Improve CodeSource.matchLocation(CodeSource) performance
mullan
parents:
8784
diff
changeset
|
412 |
return false; |
2 | 413 |
|
12434
fed433bd7b71
7152564: Improve CodeSource.matchLocation(CodeSource) performance
mullan
parents:
8784
diff
changeset
|
414 |
int thisPort = location.getPort(); |
fed433bd7b71
7152564: Improve CodeSource.matchLocation(CodeSource) performance
mullan
parents:
8784
diff
changeset
|
415 |
if (thisPort != -1) { |
fed433bd7b71
7152564: Improve CodeSource.matchLocation(CodeSource) performance
mullan
parents:
8784
diff
changeset
|
416 |
int thatPort = that.location.getPort(); |
fed433bd7b71
7152564: Improve CodeSource.matchLocation(CodeSource) performance
mullan
parents:
8784
diff
changeset
|
417 |
int port = thatPort != -1 ? thatPort |
fed433bd7b71
7152564: Improve CodeSource.matchLocation(CodeSource) performance
mullan
parents:
8784
diff
changeset
|
418 |
: that.location.getDefaultPort(); |
fed433bd7b71
7152564: Improve CodeSource.matchLocation(CodeSource) performance
mullan
parents:
8784
diff
changeset
|
419 |
if (thisPort != port) |
2 | 420 |
return false; |
12434
fed433bd7b71
7152564: Improve CodeSource.matchLocation(CodeSource) performance
mullan
parents:
8784
diff
changeset
|
421 |
} |
2 | 422 |
|
12434
fed433bd7b71
7152564: Improve CodeSource.matchLocation(CodeSource) performance
mullan
parents:
8784
diff
changeset
|
423 |
if (location.getFile().endsWith("/-")) { |
fed433bd7b71
7152564: Improve CodeSource.matchLocation(CodeSource) performance
mullan
parents:
8784
diff
changeset
|
424 |
// Matches the directory and (recursively) all files |
fed433bd7b71
7152564: Improve CodeSource.matchLocation(CodeSource) performance
mullan
parents:
8784
diff
changeset
|
425 |
// and subdirectories contained in that directory. |
fed433bd7b71
7152564: Improve CodeSource.matchLocation(CodeSource) performance
mullan
parents:
8784
diff
changeset
|
426 |
// For example, "/a/b/-" implies anything that starts with |
fed433bd7b71
7152564: Improve CodeSource.matchLocation(CodeSource) performance
mullan
parents:
8784
diff
changeset
|
427 |
// "/a/b/" |
fed433bd7b71
7152564: Improve CodeSource.matchLocation(CodeSource) performance
mullan
parents:
8784
diff
changeset
|
428 |
String thisPath = location.getFile().substring(0, |
fed433bd7b71
7152564: Improve CodeSource.matchLocation(CodeSource) performance
mullan
parents:
8784
diff
changeset
|
429 |
location.getFile().length()-1); |
fed433bd7b71
7152564: Improve CodeSource.matchLocation(CodeSource) performance
mullan
parents:
8784
diff
changeset
|
430 |
if (!that.location.getFile().startsWith(thisPath)) |
fed433bd7b71
7152564: Improve CodeSource.matchLocation(CodeSource) performance
mullan
parents:
8784
diff
changeset
|
431 |
return false; |
fed433bd7b71
7152564: Improve CodeSource.matchLocation(CodeSource) performance
mullan
parents:
8784
diff
changeset
|
432 |
} else if (location.getFile().endsWith("/*")) { |
fed433bd7b71
7152564: Improve CodeSource.matchLocation(CodeSource) performance
mullan
parents:
8784
diff
changeset
|
433 |
// Matches the directory and all the files contained in that |
fed433bd7b71
7152564: Improve CodeSource.matchLocation(CodeSource) performance
mullan
parents:
8784
diff
changeset
|
434 |
// directory. |
fed433bd7b71
7152564: Improve CodeSource.matchLocation(CodeSource) performance
mullan
parents:
8784
diff
changeset
|
435 |
// For example, "/a/b/*" implies anything that starts with |
fed433bd7b71
7152564: Improve CodeSource.matchLocation(CodeSource) performance
mullan
parents:
8784
diff
changeset
|
436 |
// "/a/b/" but has no further slashes |
fed433bd7b71
7152564: Improve CodeSource.matchLocation(CodeSource) performance
mullan
parents:
8784
diff
changeset
|
437 |
int last = that.location.getFile().lastIndexOf('/'); |
fed433bd7b71
7152564: Improve CodeSource.matchLocation(CodeSource) performance
mullan
parents:
8784
diff
changeset
|
438 |
if (last == -1) |
fed433bd7b71
7152564: Improve CodeSource.matchLocation(CodeSource) performance
mullan
parents:
8784
diff
changeset
|
439 |
return false; |
fed433bd7b71
7152564: Improve CodeSource.matchLocation(CodeSource) performance
mullan
parents:
8784
diff
changeset
|
440 |
String thisPath = location.getFile().substring(0, |
fed433bd7b71
7152564: Improve CodeSource.matchLocation(CodeSource) performance
mullan
parents:
8784
diff
changeset
|
441 |
location.getFile().length()-1); |
fed433bd7b71
7152564: Improve CodeSource.matchLocation(CodeSource) performance
mullan
parents:
8784
diff
changeset
|
442 |
String thatPath = that.location.getFile().substring(0, last+1); |
fed433bd7b71
7152564: Improve CodeSource.matchLocation(CodeSource) performance
mullan
parents:
8784
diff
changeset
|
443 |
if (!thatPath.equals(thisPath)) |
fed433bd7b71
7152564: Improve CodeSource.matchLocation(CodeSource) performance
mullan
parents:
8784
diff
changeset
|
444 |
return false; |
fed433bd7b71
7152564: Improve CodeSource.matchLocation(CodeSource) performance
mullan
parents:
8784
diff
changeset
|
445 |
} else { |
fed433bd7b71
7152564: Improve CodeSource.matchLocation(CodeSource) performance
mullan
parents:
8784
diff
changeset
|
446 |
// Exact matches only. |
fed433bd7b71
7152564: Improve CodeSource.matchLocation(CodeSource) performance
mullan
parents:
8784
diff
changeset
|
447 |
// For example, "/a/b" and "/a/b/" both imply "/a/b/" |
fed433bd7b71
7152564: Improve CodeSource.matchLocation(CodeSource) performance
mullan
parents:
8784
diff
changeset
|
448 |
if ((!that.location.getFile().equals(location.getFile())) |
fed433bd7b71
7152564: Improve CodeSource.matchLocation(CodeSource) performance
mullan
parents:
8784
diff
changeset
|
449 |
&& (!that.location.getFile().equals(location.getFile()+"/"))) { |
fed433bd7b71
7152564: Improve CodeSource.matchLocation(CodeSource) performance
mullan
parents:
8784
diff
changeset
|
450 |
return false; |
2 | 451 |
} |
12434
fed433bd7b71
7152564: Improve CodeSource.matchLocation(CodeSource) performance
mullan
parents:
8784
diff
changeset
|
452 |
} |
2 | 453 |
|
12434
fed433bd7b71
7152564: Improve CodeSource.matchLocation(CodeSource) performance
mullan
parents:
8784
diff
changeset
|
454 |
if (location.getRef() != null |
fed433bd7b71
7152564: Improve CodeSource.matchLocation(CodeSource) performance
mullan
parents:
8784
diff
changeset
|
455 |
&& !location.getRef().equals(that.location.getRef())) { |
fed433bd7b71
7152564: Improve CodeSource.matchLocation(CodeSource) performance
mullan
parents:
8784
diff
changeset
|
456 |
return false; |
fed433bd7b71
7152564: Improve CodeSource.matchLocation(CodeSource) performance
mullan
parents:
8784
diff
changeset
|
457 |
} |
fed433bd7b71
7152564: Improve CodeSource.matchLocation(CodeSource) performance
mullan
parents:
8784
diff
changeset
|
458 |
|
fed433bd7b71
7152564: Improve CodeSource.matchLocation(CodeSource) performance
mullan
parents:
8784
diff
changeset
|
459 |
String thisHost = location.getHost(); |
fed433bd7b71
7152564: Improve CodeSource.matchLocation(CodeSource) performance
mullan
parents:
8784
diff
changeset
|
460 |
String thatHost = that.location.getHost(); |
fed433bd7b71
7152564: Improve CodeSource.matchLocation(CodeSource) performance
mullan
parents:
8784
diff
changeset
|
461 |
if (thisHost != null) { |
fed433bd7b71
7152564: Improve CodeSource.matchLocation(CodeSource) performance
mullan
parents:
8784
diff
changeset
|
462 |
if (("".equals(thisHost) || "localhost".equals(thisHost)) && |
fed433bd7b71
7152564: Improve CodeSource.matchLocation(CodeSource) performance
mullan
parents:
8784
diff
changeset
|
463 |
("".equals(thatHost) || "localhost".equals(thatHost))) { |
fed433bd7b71
7152564: Improve CodeSource.matchLocation(CodeSource) performance
mullan
parents:
8784
diff
changeset
|
464 |
// ok |
fed433bd7b71
7152564: Improve CodeSource.matchLocation(CodeSource) performance
mullan
parents:
8784
diff
changeset
|
465 |
} else if (!thisHost.equals(thatHost)) { |
fed433bd7b71
7152564: Improve CodeSource.matchLocation(CodeSource) performance
mullan
parents:
8784
diff
changeset
|
466 |
if (thatHost == null) { |
2 | 467 |
return false; |
12434
fed433bd7b71
7152564: Improve CodeSource.matchLocation(CodeSource) performance
mullan
parents:
8784
diff
changeset
|
468 |
} |
fed433bd7b71
7152564: Improve CodeSource.matchLocation(CodeSource) performance
mullan
parents:
8784
diff
changeset
|
469 |
if (this.sp == null) { |
fed433bd7b71
7152564: Improve CodeSource.matchLocation(CodeSource) performance
mullan
parents:
8784
diff
changeset
|
470 |
this.sp = new SocketPermission(thisHost, "resolve"); |
fed433bd7b71
7152564: Improve CodeSource.matchLocation(CodeSource) performance
mullan
parents:
8784
diff
changeset
|
471 |
} |
fed433bd7b71
7152564: Improve CodeSource.matchLocation(CodeSource) performance
mullan
parents:
8784
diff
changeset
|
472 |
if (that.sp == null) { |
fed433bd7b71
7152564: Improve CodeSource.matchLocation(CodeSource) performance
mullan
parents:
8784
diff
changeset
|
473 |
that.sp = new SocketPermission(thatHost, "resolve"); |
fed433bd7b71
7152564: Improve CodeSource.matchLocation(CodeSource) performance
mullan
parents:
8784
diff
changeset
|
474 |
} |
fed433bd7b71
7152564: Improve CodeSource.matchLocation(CodeSource) performance
mullan
parents:
8784
diff
changeset
|
475 |
if (!this.sp.implies(that.sp)) { |
2 | 476 |
return false; |
477 |
} |
|
478 |
} |
|
479 |
} |
|
12434
fed433bd7b71
7152564: Improve CodeSource.matchLocation(CodeSource) performance
mullan
parents:
8784
diff
changeset
|
480 |
// everything matches |
fed433bd7b71
7152564: Improve CodeSource.matchLocation(CodeSource) performance
mullan
parents:
8784
diff
changeset
|
481 |
return true; |
fed433bd7b71
7152564: Improve CodeSource.matchLocation(CodeSource) performance
mullan
parents:
8784
diff
changeset
|
482 |
} |
2 | 483 |
|
484 |
/** |
|
485 |
* Returns a string describing this CodeSource, telling its |
|
486 |
* URL and certificates. |
|
487 |
* |
|
488 |
* @return information about this CodeSource. |
|
489 |
*/ |
|
12434
fed433bd7b71
7152564: Improve CodeSource.matchLocation(CodeSource) performance
mullan
parents:
8784
diff
changeset
|
490 |
@Override |
2 | 491 |
public String toString() { |
492 |
StringBuilder sb = new StringBuilder(); |
|
493 |
sb.append("("); |
|
494 |
sb.append(this.location); |
|
495 |
||
496 |
if (this.certs != null && this.certs.length > 0) { |
|
497 |
for (int i = 0; i < this.certs.length; i++) { |
|
498 |
sb.append( " " + this.certs[i]); |
|
499 |
} |
|
500 |
||
501 |
} else if (this.signers != null && this.signers.length > 0) { |
|
502 |
for (int i = 0; i < this.signers.length; i++) { |
|
503 |
sb.append( " " + this.signers[i]); |
|
504 |
} |
|
505 |
} else { |
|
506 |
sb.append(" <no signer certificates>"); |
|
507 |
} |
|
508 |
sb.append(")"); |
|
509 |
return sb.toString(); |
|
510 |
} |
|
511 |
||
512 |
/** |
|
513 |
* Writes this object out to a stream (i.e., serializes it). |
|
514 |
* |
|
18579
b678846778ad
8019360: Cleanup of the javadoc <code> tag in java.security.*
juh
parents:
14014
diff
changeset
|
515 |
* @serialData An initial {@code URL} is followed by an |
b678846778ad
8019360: Cleanup of the javadoc <code> tag in java.security.*
juh
parents:
14014
diff
changeset
|
516 |
* {@code int} indicating the number of certificates to follow |
2 | 517 |
* (a value of "zero" denotes that there are no certificates associated |
518 |
* with this object). |
|
18579
b678846778ad
8019360: Cleanup of the javadoc <code> tag in java.security.*
juh
parents:
14014
diff
changeset
|
519 |
* Each certificate is written out starting with a {@code String} |
2 | 520 |
* denoting the certificate type, followed by an |
18579
b678846778ad
8019360: Cleanup of the javadoc <code> tag in java.security.*
juh
parents:
14014
diff
changeset
|
521 |
* {@code int} specifying the length of the certificate encoding, |
2 | 522 |
* followed by the certificate encoding itself which is written out as an |
523 |
* array of bytes. Finally, if any code signers are present then the array |
|
524 |
* of code signers is serialized and written out too. |
|
525 |
*/ |
|
57950
4612a3cfb927
8229999: Apply java.io.Serial annotations to security types in java.base
darcy
parents:
57792
diff
changeset
|
526 |
@java.io.Serial |
2 | 527 |
private void writeObject(java.io.ObjectOutputStream oos) |
528 |
throws IOException |
|
529 |
{ |
|
530 |
oos.defaultWriteObject(); // location |
|
531 |
||
532 |
// Serialize the array of certs |
|
533 |
if (certs == null || certs.length == 0) { |
|
534 |
oos.writeInt(0); |
|
535 |
} else { |
|
536 |
// write out the total number of certs |
|
537 |
oos.writeInt(certs.length); |
|
538 |
// write out each cert, including its type |
|
539 |
for (int i = 0; i < certs.length; i++) { |
|
540 |
java.security.cert.Certificate cert = certs[i]; |
|
541 |
try { |
|
542 |
oos.writeUTF(cert.getType()); |
|
543 |
byte[] encoded = cert.getEncoded(); |
|
544 |
oos.writeInt(encoded.length); |
|
545 |
oos.write(encoded); |
|
546 |
} catch (CertificateEncodingException cee) { |
|
547 |
throw new IOException(cee.getMessage()); |
|
548 |
} |
|
549 |
} |
|
550 |
} |
|
551 |
||
552 |
// Serialize the array of code signers (if any) |
|
553 |
if (signers != null && signers.length > 0) { |
|
554 |
oos.writeObject(signers); |
|
555 |
} |
|
556 |
} |
|
557 |
||
558 |
/** |
|
559 |
* Restores this object from a stream (i.e., deserializes it). |
|
560 |
*/ |
|
57950
4612a3cfb927
8229999: Apply java.io.Serial annotations to security types in java.base
darcy
parents:
57792
diff
changeset
|
561 |
@java.io.Serial |
2 | 562 |
private void readObject(java.io.ObjectInputStream ois) |
563 |
throws IOException, ClassNotFoundException |
|
564 |
{ |
|
565 |
CertificateFactory cf; |
|
566 |
Hashtable<String, CertificateFactory> cfs = null; |
|
45980 | 567 |
List<java.security.cert.Certificate> certList = null; |
2 | 568 |
|
569 |
ois.defaultReadObject(); // location |
|
570 |
||
571 |
// process any new-style certs in the stream (if present) |
|
572 |
int size = ois.readInt(); |
|
573 |
if (size > 0) { |
|
574 |
// we know of 3 different cert types: X.509, PGP, SDSI, which |
|
575 |
// could all be present in the stream at the same time |
|
30033
b9c86c17164a
8078468: Update security libraries to use diamond with anonymous classes
darcy
parents:
25859
diff
changeset
|
576 |
cfs = new Hashtable<>(3); |
45980 | 577 |
certList = new ArrayList<>(size > 20 ? 20 : size); |
47418
6993f9f1ff83
8181432: Better processing of unresolved permissions
weijun
parents:
47216
diff
changeset
|
578 |
} else if (size < 0) { |
6993f9f1ff83
8181432: Better processing of unresolved permissions
weijun
parents:
47216
diff
changeset
|
579 |
throw new IOException("size cannot be negative"); |
2 | 580 |
} |
581 |
||
582 |
for (int i = 0; i < size; i++) { |
|
583 |
// read the certificate type, and instantiate a certificate |
|
584 |
// factory of that type (reuse existing factory if possible) |
|
585 |
String certType = ois.readUTF(); |
|
586 |
if (cfs.containsKey(certType)) { |
|
587 |
// reuse certificate factory |
|
588 |
cf = cfs.get(certType); |
|
589 |
} else { |
|
590 |
// create new certificate factory |
|
591 |
try { |
|
592 |
cf = CertificateFactory.getInstance(certType); |
|
593 |
} catch (CertificateException ce) { |
|
594 |
throw new ClassNotFoundException |
|
595 |
("Certificate factory for " + certType + " not found"); |
|
596 |
} |
|
597 |
// store the certificate factory so we can reuse it later |
|
598 |
cfs.put(certType, cf); |
|
599 |
} |
|
600 |
// parse the certificate |
|
47418
6993f9f1ff83
8181432: Better processing of unresolved permissions
weijun
parents:
47216
diff
changeset
|
601 |
byte[] encoded = IOUtils.readNBytes(ois, ois.readInt()); |
2 | 602 |
ByteArrayInputStream bais = new ByteArrayInputStream(encoded); |
603 |
try { |
|
45980 | 604 |
certList.add(cf.generateCertificate(bais)); |
2 | 605 |
} catch (CertificateException ce) { |
606 |
throw new IOException(ce.getMessage()); |
|
607 |
} |
|
608 |
bais.close(); |
|
609 |
} |
|
610 |
||
45980 | 611 |
if (certList != null) { |
612 |
this.certs = certList.toArray( |
|
613 |
new java.security.cert.Certificate[size]); |
|
614 |
} |
|
2 | 615 |
// Deserialize array of code signers (if any) |
616 |
try { |
|
8784
29a6801dcf6f
6686215: Some mutables not defensively copied when deserializing java.security.CodeSource & Timestamp objects
vinnie
parents:
7970
diff
changeset
|
617 |
this.signers = ((CodeSigner[])ois.readObject()).clone(); |
2 | 618 |
} catch (IOException ioe) { |
619 |
// no signers present |
|
620 |
} |
|
31141
ef5ddf021137
6826789: SecureClassLoader should not use CodeSource URLs as HashMap keys
mullan
parents:
30033
diff
changeset
|
621 |
|
ef5ddf021137
6826789: SecureClassLoader should not use CodeSource URLs as HashMap keys
mullan
parents:
30033
diff
changeset
|
622 |
if (location != null) { |
ef5ddf021137
6826789: SecureClassLoader should not use CodeSource URLs as HashMap keys
mullan
parents:
30033
diff
changeset
|
623 |
locationNoFragString = URLUtil.urlNoFragString(location); |
ef5ddf021137
6826789: SecureClassLoader should not use CodeSource URLs as HashMap keys
mullan
parents:
30033
diff
changeset
|
624 |
} |
2 | 625 |
} |
626 |
||
627 |
/* |
|
628 |
* Convert an array of certificates to an array of code signers. |
|
629 |
* The array of certificates is a concatenation of certificate chains |
|
630 |
* where the initial certificate in each chain is the end-entity cert. |
|
631 |
* |
|
39560
e6ec33bddfcc
8129972: Clarify the javadoc of java.security.CodeSource as to the nullability of 'location'
jnimeh
parents:
31804
diff
changeset
|
632 |
* @return an array of code signers or null if none are generated. |
2 | 633 |
*/ |
634 |
private CodeSigner[] convertCertArrayToSignerArray( |
|
635 |
java.security.cert.Certificate[] certs) { |
|
636 |
||
637 |
if (certs == null) { |
|
638 |
return null; |
|
639 |
} |
|
640 |
||
641 |
try { |
|
642 |
// Initialize certificate factory |
|
643 |
if (factory == null) { |
|
644 |
factory = CertificateFactory.getInstance("X.509"); |
|
645 |
} |
|
646 |
||
647 |
// Iterate through all the certificates |
|
648 |
int i = 0; |
|
7970
af1579474d16
7008728: diamond conversion of basic security, permissions, authentication
smarks
parents:
5506
diff
changeset
|
649 |
List<CodeSigner> signers = new ArrayList<>(); |
2 | 650 |
while (i < certs.length) { |
651 |
List<java.security.cert.Certificate> certChain = |
|
7970
af1579474d16
7008728: diamond conversion of basic security, permissions, authentication
smarks
parents:
5506
diff
changeset
|
652 |
new ArrayList<>(); |
2 | 653 |
certChain.add(certs[i++]); // first cert is an end-entity cert |
654 |
int j = i; |
|
655 |
||
656 |
// Extract chain of certificates |
|
657 |
// (loop while certs are not end-entity certs) |
|
658 |
while (j < certs.length && |
|
659 |
certs[j] instanceof X509Certificate && |
|
660 |
((X509Certificate)certs[j]).getBasicConstraints() != -1) { |
|
661 |
certChain.add(certs[j]); |
|
662 |
j++; |
|
663 |
} |
|
664 |
i = j; |
|
665 |
CertPath certPath = factory.generateCertPath(certChain); |
|
666 |
signers.add(new CodeSigner(certPath, null)); |
|
667 |
} |
|
668 |
||
669 |
if (signers.isEmpty()) { |
|
670 |
return null; |
|
671 |
} else { |
|
672 |
return signers.toArray(new CodeSigner[signers.size()]); |
|
673 |
} |
|
674 |
||
675 |
} catch (CertificateException e) { |
|
676 |
return null; //TODO - may be better to throw an ex. here |
|
677 |
} |
|
678 |
} |
|
679 |
} |