1 /*

     2  * Copyright (c) 2018, Oracle and/or its affiliates. All rights reserved.

     3  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.

     4  *

     5  * This code is free software; you can redistribute it and/or modify it

     6  * under the terms of the GNU General Public License version 2 only, as

     7  * published by the Free Software Foundation.  Oracle designates this

     8  * particular file as subject to the "Classpath" exception as provided

     9  * by Oracle in the LICENSE file that accompanied this code.

    10  *

    11  * This code is distributed in the hope that it will be useful, but WITHOUT

    12  * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or

    13  * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License

    14  * version 2 for more details (a copy is included in the LICENSE file that

    15  * accompanied this code).

    16  *

    17  * You should have received a copy of the GNU General Public License version

    18  * 2 along with this work; if not, write to the Free Software Foundation,

    19  * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.

    20  *

    21  * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA

    22  * or visit www.oracle.com if you need additional information or have any

    23  * questions.

    24  */

    25 package sun.security.validator;

    26 

    27 import java.security.AccessController;

    28 import java.security.PrivilegedAction;

    29 import java.security.Security;

    30 import java.security.cert.X509Certificate;

    31 import java.util.EnumSet;

    32 

    33 import sun.security.util.Debug;

    34 

    35 /**

    36  * Policies for distrusting a certificate authority (CA). See the

    37  * jdk.security.caDistrustPolicies security property for more information.

    38  */

    39 enum CADistrustPolicy {

    40     /**

    41      * Distrust TLS Server certificates anchored by a Symantec root CA and

    42      * issued after April 16, 2019. If enabled, this policy is currently

    43      * enforced by the PKIX and SunX509 TrustManager implementations of the

    44      * SunJSSE provider implementation.

    45      */

    46     SYMANTEC_TLS {

    47         void checkDistrust(String variant, X509Certificate anchor,

    48                            X509Certificate ee) throws ValidatorException {

    49             if (!variant.equals(Validator.VAR_TLS_SERVER)) {

    50                 return;

    51             }

    52             SymantecTLSPolicy.checkDistrust(anchor, ee);

    53         }

    54     };

    55 

    56     /**

    57      * Checks if the end-entity certificate is distrusted.

    58      *

    59      * @param variant the type of certificate being checked

    60      * @param anchor the trust anchor certificate

    61      * @param ee the end-entity certificate to check

    62      * @throws ValidatorException if the end-entity certificate is distrusted

    63      */

    64     abstract void checkDistrust(String variant,

    65                                 X509Certificate anchor,

    66                                 X509Certificate ee) throws ValidatorException;

    67 

    68     // The policies set in the jdk.security.caDistrustPolicies property.

    69     static final EnumSet<CADistrustPolicy> POLICIES = parseProperty();

    70     private static EnumSet<CADistrustPolicy> parseProperty() {

    71         String property = AccessController.doPrivileged(

    72             new PrivilegedAction<>() {

    73                 @Override

    74                 public String run() {

    75                     return Security.getProperty(

    76                         "jdk.security.caDistrustPolicies");

    77                 }

    78             });

    79         EnumSet<CADistrustPolicy> set = EnumSet.noneOf(CADistrustPolicy.class);

    80         // if property is null or empty, the restrictions are not enforced

    81         if (property == null || property.isEmpty()) {

    82             return set;

    83         }

    84         String[] policies = property.split(",");

    85         for (String policy : policies) {

    86             policy = policy.trim();

    87             try {

    88                 CADistrustPolicy caPolicy =

    89                     Enum.valueOf(CADistrustPolicy.class, policy);

    90                 set.add(caPolicy);

    91             } catch (IllegalArgumentException iae) {

    92                 // ignore unknown values but log it

    93                 Debug debug = Debug.getInstance("certpath");

    94                 if (debug != null) {

    95                     debug.println("Unknown value for the " +

    96                                   "jdk.security.caDistrustPolicies property: "

    97                                   + policy);

    98                 }

    99             }

   100         }

   101         return set;

   102     }

   103 }