1 /* 2 * Copyright (c) 2005, 2007, Oracle and/or its affiliates. All rights reserved. 3 * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. 4 * 5 * This code is free software; you can redistribute it and/or modify it 6 * under the terms of the GNU General Public License version 2 only, as 7 * published by the Free Software Foundation. Oracle designates this 8 * particular file as subject to the "Classpath" exception as provided 9 * by Oracle in the LICENSE file that accompanied this code. 10 * 11 * This code is distributed in the hope that it will be useful, but WITHOUT 12 * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or 13 * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License 14 * version 2 for more details (a copy is included in the LICENSE file that 15 * accompanied this code). 16 * 17 * You should have received a copy of the GNU General Public License version 18 * 2 along with this work; if not, write to the Free Software Foundation, 19 * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA. 20 * 21 * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA 22 * or visit www.oracle.com if you need additional information or have any 23 * questions. 24 */ 25 26 package com.sun.net.ssl.internal.ssl; 27 28 import javax.net.ssl.X509TrustManager; 29 30 import java.security.cert.X509Certificate; 31 import java.security.cert.CertificateException; 32 33 /** 34 * Instance of this class is an extension of <code>X509TrustManager</code>. 35 * <p> 36 * Note that this class is referenced by the Deploy workspace. Any updates 37 * must make sure that they do not cause any breakage there. 38 * <p> 39 * It takes the responsiblity of checking the peer identity with its 40 * principal declared in the cerificate. 41 * <p> 42 * The class provides an alternative to <code>HostnameVerifer</code>. 43 * If application customizes its <code>HostnameVerifer</code> for 44 * <code>HttpsURLConnection</code>, the peer identity will be checked 45 * by the customized <code>HostnameVerifer</code>; otherwise, it will 46 * be checked by the extended trust manager. 47 * <p> 48 * RFC2830 defines the server identification specification for "LDAP" 49 * algorithm. RFC2818 defines both the server identification and the 50 * client identification specification for "HTTPS" algorithm. 51 * 52 * @see X509TrustManager 53 * @see HostnameVerifier 54 * 55 * @since 1.6 56 * @author Xuelei Fan 57 */ 58 public abstract class X509ExtendedTrustManager implements X509TrustManager { 59 /** 60 * Constructor used by subclasses only. 61 */ X509ExtendedTrustManager()62 protected X509ExtendedTrustManager() { 63 } 64 65 /** 66 * Given the partial or complete certificate chain provided by the 67 * peer, check its identity and build a certificate path to a trusted 68 * root, return if it can be validated and is trusted for client SSL 69 * authentication based on the authentication type. 70 * <p> 71 * The authentication type is determined by the actual certificate 72 * used. For instance, if RSAPublicKey is used, the authType 73 * should be "RSA". Checking is case-sensitive. 74 * <p> 75 * The algorithm parameter specifies the client identification protocol 76 * to use. If the algorithm and the peer hostname are available, the 77 * peer hostname is checked against the peer's identity presented in 78 * the X509 certificate, in order to prevent masquerade attacks. 79 * 80 * @param chain the peer certificate chain 81 * @param authType the authentication type based on the client certificate 82 * @param hostname the peer hostname 83 * @param algorithm the identification algorithm 84 * @throws IllegalArgumentException if null or zero-length chain 85 * is passed in for the chain parameter or if null or zero-length 86 * string is passed in for the authType parameter 87 * @throws CertificateException if the certificate chain is not trusted 88 * by this TrustManager. 89 */ checkClientTrusted(X509Certificate[] chain, String authType, String hostname, String algorithm)90 public abstract void checkClientTrusted(X509Certificate[] chain, 91 String authType, String hostname, String algorithm) 92 throws CertificateException; 93 94 /** 95 * Given the partial or complete certificate chain provided by the 96 * peer, check its identity and build a certificate path to a trusted 97 * root, return if it can be validated and is trusted for server SSL 98 * authentication based on the authentication type. 99 * <p> 100 * The authentication type is the key exchange algorithm portion 101 * of the cipher suites represented as a String, such as "RSA", 102 * "DHE_DSS". Checking is case-sensitive. 103 * <p> 104 * The algorithm parameter specifies the server identification protocol 105 * to use. If the algorithm and the peer hostname are available, the 106 * peer hostname is checked against the peer's identity presented in 107 * the X509 certificate, in order to prevent masquerade attacks. 108 * 109 * @param chain the peer certificate chain 110 * @param authType the key exchange algorithm used 111 * @param hostname the peer hostname 112 * @param algorithm the identification algorithm 113 * @throws IllegalArgumentException if null or zero-length chain 114 * is passed in for the chain parameter or if null or zero-length 115 * string is passed in for the authType parameter 116 * @throws CertificateException if the certificate chain is not trusted 117 * by this TrustManager. 118 */ checkServerTrusted(X509Certificate[] chain, String authType, String hostname, String algorithm)119 public abstract void checkServerTrusted(X509Certificate[] chain, 120 String authType, String hostname, String algorithm) 121 throws CertificateException; 122 } 123