jdk/src/java.base/share/classes/sun/security/util/CertConstraintParameters.java
author ascarpino
Thu, 26 May 2016 13:33:27 -0700
changeset 38576 ccaac80108c5
parent 37726 bbecfff95ec3
child 39465 8c06651d9138
permissions -rw-r--r--
8154005: Add algorithm constraint that specifies the restriction date Reviewed-by: mullan, igerasim
Ignore whitespace changes - Everywhere: Within whitespace: At end of lines:
37726
bbecfff95ec3 8140422: Add mechanism to allow non default root CAs to be not subject to algorithm restrictions
ascarpino
parents:
diff changeset
     1
/*
bbecfff95ec3 8140422: Add mechanism to allow non default root CAs to be not subject to algorithm restrictions
ascarpino
parents:
diff changeset
     2
 * Copyright (c) 2016, Oracle and/or its affiliates. All rights reserved.
bbecfff95ec3 8140422: Add mechanism to allow non default root CAs to be not subject to algorithm restrictions
ascarpino
parents:
diff changeset
     3
 * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
bbecfff95ec3 8140422: Add mechanism to allow non default root CAs to be not subject to algorithm restrictions
ascarpino
parents:
diff changeset
     4
 *
bbecfff95ec3 8140422: Add mechanism to allow non default root CAs to be not subject to algorithm restrictions
ascarpino
parents:
diff changeset
     5
 * This code is free software; you can redistribute it and/or modify it
bbecfff95ec3 8140422: Add mechanism to allow non default root CAs to be not subject to algorithm restrictions
ascarpino
parents:
diff changeset
     6
 * under the terms of the GNU General Public License version 2 only, as
bbecfff95ec3 8140422: Add mechanism to allow non default root CAs to be not subject to algorithm restrictions
ascarpino
parents:
diff changeset
     7
 * published by the Free Software Foundation.  Oracle designates this
bbecfff95ec3 8140422: Add mechanism to allow non default root CAs to be not subject to algorithm restrictions
ascarpino
parents:
diff changeset
     8
 * particular file as subject to the "Classpath" exception as provided
bbecfff95ec3 8140422: Add mechanism to allow non default root CAs to be not subject to algorithm restrictions
ascarpino
parents:
diff changeset
     9
 * by Oracle in the LICENSE file that accompanied this code.
bbecfff95ec3 8140422: Add mechanism to allow non default root CAs to be not subject to algorithm restrictions
ascarpino
parents:
diff changeset
    10
 *
bbecfff95ec3 8140422: Add mechanism to allow non default root CAs to be not subject to algorithm restrictions
ascarpino
parents:
diff changeset
    11
 * This code is distributed in the hope that it will be useful, but WITHOUT
bbecfff95ec3 8140422: Add mechanism to allow non default root CAs to be not subject to algorithm restrictions
ascarpino
parents:
diff changeset
    12
 * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
bbecfff95ec3 8140422: Add mechanism to allow non default root CAs to be not subject to algorithm restrictions
ascarpino
parents:
diff changeset
    13
 * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
bbecfff95ec3 8140422: Add mechanism to allow non default root CAs to be not subject to algorithm restrictions
ascarpino
parents:
diff changeset
    14
 * version 2 for more details (a copy is included in the LICENSE file that
bbecfff95ec3 8140422: Add mechanism to allow non default root CAs to be not subject to algorithm restrictions
ascarpino
parents:
diff changeset
    15
 * accompanied this code).
bbecfff95ec3 8140422: Add mechanism to allow non default root CAs to be not subject to algorithm restrictions
ascarpino
parents:
diff changeset
    16
 *
bbecfff95ec3 8140422: Add mechanism to allow non default root CAs to be not subject to algorithm restrictions
ascarpino
parents:
diff changeset
    17
 * You should have received a copy of the GNU General Public License version
bbecfff95ec3 8140422: Add mechanism to allow non default root CAs to be not subject to algorithm restrictions
ascarpino
parents:
diff changeset
    18
 * 2 along with this work; if not, write to the Free Software Foundation,
bbecfff95ec3 8140422: Add mechanism to allow non default root CAs to be not subject to algorithm restrictions
ascarpino
parents:
diff changeset
    19
 * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
bbecfff95ec3 8140422: Add mechanism to allow non default root CAs to be not subject to algorithm restrictions
ascarpino
parents:
diff changeset
    20
 *
bbecfff95ec3 8140422: Add mechanism to allow non default root CAs to be not subject to algorithm restrictions
ascarpino
parents:
diff changeset
    21
 * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
bbecfff95ec3 8140422: Add mechanism to allow non default root CAs to be not subject to algorithm restrictions
ascarpino
parents:
diff changeset
    22
 * or visit www.oracle.com if you need additional information or have any
bbecfff95ec3 8140422: Add mechanism to allow non default root CAs to be not subject to algorithm restrictions
ascarpino
parents:
diff changeset
    23
 * questions.
bbecfff95ec3 8140422: Add mechanism to allow non default root CAs to be not subject to algorithm restrictions
ascarpino
parents:
diff changeset
    24
 */
bbecfff95ec3 8140422: Add mechanism to allow non default root CAs to be not subject to algorithm restrictions
ascarpino
parents:
diff changeset
    25
bbecfff95ec3 8140422: Add mechanism to allow non default root CAs to be not subject to algorithm restrictions
ascarpino
parents:
diff changeset
    26
package sun.security.util;
bbecfff95ec3 8140422: Add mechanism to allow non default root CAs to be not subject to algorithm restrictions
ascarpino
parents:
diff changeset
    27
bbecfff95ec3 8140422: Add mechanism to allow non default root CAs to be not subject to algorithm restrictions
ascarpino
parents:
diff changeset
    28
import java.security.cert.X509Certificate;
38576
ccaac80108c5 8154005: Add algorithm constraint that specifies the restriction date
ascarpino
parents: 37726
diff changeset
    29
import java.util.Date;
37726
bbecfff95ec3 8140422: Add mechanism to allow non default root CAs to be not subject to algorithm restrictions
ascarpino
parents:
diff changeset
    30
bbecfff95ec3 8140422: Add mechanism to allow non default root CAs to be not subject to algorithm restrictions
ascarpino
parents:
diff changeset
    31
/**
bbecfff95ec3 8140422: Add mechanism to allow non default root CAs to be not subject to algorithm restrictions
ascarpino
parents:
diff changeset
    32
 * This class is a wrapper for keeping state and passing objects between PKIX,
bbecfff95ec3 8140422: Add mechanism to allow non default root CAs to be not subject to algorithm restrictions
ascarpino
parents:
diff changeset
    33
 * AlgorithmChecker, and DisabledAlgorithmConstraints.
bbecfff95ec3 8140422: Add mechanism to allow non default root CAs to be not subject to algorithm restrictions
ascarpino
parents:
diff changeset
    34
 */
bbecfff95ec3 8140422: Add mechanism to allow non default root CAs to be not subject to algorithm restrictions
ascarpino
parents:
diff changeset
    35
public class CertConstraintParameters {
bbecfff95ec3 8140422: Add mechanism to allow non default root CAs to be not subject to algorithm restrictions
ascarpino
parents:
diff changeset
    36
    // A certificate being passed to check against constraints.
bbecfff95ec3 8140422: Add mechanism to allow non default root CAs to be not subject to algorithm restrictions
ascarpino
parents:
diff changeset
    37
    private final X509Certificate cert;
bbecfff95ec3 8140422: Add mechanism to allow non default root CAs to be not subject to algorithm restrictions
ascarpino
parents:
diff changeset
    38
    // This is true if the trust anchor in the certificate chain matches a cert
bbecfff95ec3 8140422: Add mechanism to allow non default root CAs to be not subject to algorithm restrictions
ascarpino
parents:
diff changeset
    39
    // in AnchorCertificates
bbecfff95ec3 8140422: Add mechanism to allow non default root CAs to be not subject to algorithm restrictions
ascarpino
parents:
diff changeset
    40
    private final boolean trustedMatch;
38576
ccaac80108c5 8154005: Add algorithm constraint that specifies the restriction date
ascarpino
parents: 37726
diff changeset
    41
    // PKIXParameter date
ccaac80108c5 8154005: Add algorithm constraint that specifies the restriction date
ascarpino
parents: 37726
diff changeset
    42
    private final Date pkixDate;
37726
bbecfff95ec3 8140422: Add mechanism to allow non default root CAs to be not subject to algorithm restrictions
ascarpino
parents:
diff changeset
    43
38576
ccaac80108c5 8154005: Add algorithm constraint that specifies the restriction date
ascarpino
parents: 37726
diff changeset
    44
    public CertConstraintParameters(X509Certificate c, boolean match,
ccaac80108c5 8154005: Add algorithm constraint that specifies the restriction date
ascarpino
parents: 37726
diff changeset
    45
            Date pkixdate) {
37726
bbecfff95ec3 8140422: Add mechanism to allow non default root CAs to be not subject to algorithm restrictions
ascarpino
parents:
diff changeset
    46
        cert = c;
bbecfff95ec3 8140422: Add mechanism to allow non default root CAs to be not subject to algorithm restrictions
ascarpino
parents:
diff changeset
    47
        trustedMatch = match;
38576
ccaac80108c5 8154005: Add algorithm constraint that specifies the restriction date
ascarpino
parents: 37726
diff changeset
    48
        pkixDate = pkixdate;
37726
bbecfff95ec3 8140422: Add mechanism to allow non default root CAs to be not subject to algorithm restrictions
ascarpino
parents:
diff changeset
    49
    }
bbecfff95ec3 8140422: Add mechanism to allow non default root CAs to be not subject to algorithm restrictions
ascarpino
parents:
diff changeset
    50
bbecfff95ec3 8140422: Add mechanism to allow non default root CAs to be not subject to algorithm restrictions
ascarpino
parents:
diff changeset
    51
    public CertConstraintParameters(X509Certificate c) {
38576
ccaac80108c5 8154005: Add algorithm constraint that specifies the restriction date
ascarpino
parents: 37726
diff changeset
    52
        this(c, false, null);
37726
bbecfff95ec3 8140422: Add mechanism to allow non default root CAs to be not subject to algorithm restrictions
ascarpino
parents:
diff changeset
    53
    }
bbecfff95ec3 8140422: Add mechanism to allow non default root CAs to be not subject to algorithm restrictions
ascarpino
parents:
diff changeset
    54
bbecfff95ec3 8140422: Add mechanism to allow non default root CAs to be not subject to algorithm restrictions
ascarpino
parents:
diff changeset
    55
    // Returns if the trust anchor has a match if anchor checking is enabled.
bbecfff95ec3 8140422: Add mechanism to allow non default root CAs to be not subject to algorithm restrictions
ascarpino
parents:
diff changeset
    56
    public boolean isTrustedMatch() {
bbecfff95ec3 8140422: Add mechanism to allow non default root CAs to be not subject to algorithm restrictions
ascarpino
parents:
diff changeset
    57
        return trustedMatch;
bbecfff95ec3 8140422: Add mechanism to allow non default root CAs to be not subject to algorithm restrictions
ascarpino
parents:
diff changeset
    58
    }
bbecfff95ec3 8140422: Add mechanism to allow non default root CAs to be not subject to algorithm restrictions
ascarpino
parents:
diff changeset
    59
bbecfff95ec3 8140422: Add mechanism to allow non default root CAs to be not subject to algorithm restrictions
ascarpino
parents:
diff changeset
    60
    public X509Certificate getCertificate() {
bbecfff95ec3 8140422: Add mechanism to allow non default root CAs to be not subject to algorithm restrictions
ascarpino
parents:
diff changeset
    61
        return cert;
bbecfff95ec3 8140422: Add mechanism to allow non default root CAs to be not subject to algorithm restrictions
ascarpino
parents:
diff changeset
    62
    }
38576
ccaac80108c5 8154005: Add algorithm constraint that specifies the restriction date
ascarpino
parents: 37726
diff changeset
    63
ccaac80108c5 8154005: Add algorithm constraint that specifies the restriction date
ascarpino
parents: 37726
diff changeset
    64
    public Date getPKIXParamDate() {
ccaac80108c5 8154005: Add algorithm constraint that specifies the restriction date
ascarpino
parents: 37726
diff changeset
    65
        return pkixDate;
ccaac80108c5 8154005: Add algorithm constraint that specifies the restriction date
ascarpino
parents: 37726
diff changeset
    66
    }
ccaac80108c5 8154005: Add algorithm constraint that specifies the restriction date
ascarpino
parents: 37726
diff changeset
    67
37726
bbecfff95ec3 8140422: Add mechanism to allow non default root CAs to be not subject to algorithm restrictions
ascarpino
parents:
diff changeset
    68
}