Java Validator类代码示例

import sun.security.validator.Validator; //导入依赖的package包/类
@Override
X509TrustManager getInstance(ManagerFactoryParameters spec)
        throws InvalidAlgorithmParameterException {
    if (spec instanceof CertPathTrustManagerParameters == false) {
        throw new InvalidAlgorithmParameterException
            ("Parameters must be CertPathTrustManagerParameters");
    }
    CertPathParameters params =
        ((CertPathTrustManagerParameters)spec).getParameters();
    if (params instanceof PKIXBuilderParameters == false) {
        throw new InvalidAlgorithmParameterException
            ("Encapsulated parameters must be PKIXBuilderParameters");
    }
    PKIXBuilderParameters pkixParams = (PKIXBuilderParameters)params;
    return new X509TrustManagerImpl(Validator.TYPE_PKIX, pkixParams);
}
 

import sun.security.validator.Validator; //导入依赖的package包/类
/**
 * @param args {cacerts keystore, cert chain}
 */
public static void main(String[] args) throws Exception {

    KeyStore ks = KeyStore.getInstance("JKS");
    ks.load(new FileInputStream(args[0]), "changeit".toCharArray());
    Validator v = Validator.getInstance
        (Validator.TYPE_PKIX, Validator.VAR_GENERIC, ks);
    X509Certificate[] chain = createPath(args[1]);
    System.out.println("Chain: ");
    for (X509Certificate c: v.validate(chain)) {
        System.out.println("   " + c.getSubjectX500Principal() +
                " issued by " + c.getIssuerX500Principal());
    }
}
 

import sun.security.validator.Validator; //导入依赖的package包/类
public String getValidator() {
    if (this == CLIENT) {
        return Validator.VAR_TLS_CLIENT;
    } else if (this == SERVER) {
        return Validator.VAR_TLS_SERVER;
    }
    return Validator.VAR_GENERIC;
}
 

import sun.security.validator.Validator; //导入依赖的package包/类
private void checkAlgorithmConstraints(X509Certificate[] chain,
        AlgorithmConstraints constraints, boolean isClient) throws CertificateException {

    try {
        // Does the certificate chain end with a trusted certificate?
        int checkedLength = chain.length - 1;

        Collection<X509Certificate> trustedCerts = new HashSet<>();
        X509Certificate[] certs = tm.getAcceptedIssuers();
        if ((certs != null) && (certs.length > 0)){
            Collections.addAll(trustedCerts, certs);
        }

        if (trustedCerts.contains(chain[checkedLength])) {
                checkedLength--;
        }

        // A forward checker, need to check from trust to target
        if (checkedLength >= 0) {
            AlgorithmChecker checker =
                    new AlgorithmChecker(constraints, null,
                            (isClient ? Validator.VAR_TLS_CLIENT : Validator.VAR_TLS_SERVER));
            checker.init(false);
            for (int i = checkedLength; i >= 0; i--) {
                Certificate cert = chain[i];
                // We don't care about the unresolved critical extensions.
                checker.check(cert, Collections.<String>emptySet());
            }
        }
    } catch (CertPathValidatorException cpve) {
        throw new CertificateException(
            "Certificates do not conform to algorithm constraints", cpve);
    }
}
 

import sun.security.validator.Validator; //导入依赖的package包/类
/**
 * Create a new {@code AlgorithmChecker} with the
 * given {@code TrustAnchor}, {@code AlgorithmConstraints},
 * {@code Timestamp}, and {@code String} variant.
 *
 * @param anchor the trust anchor selected to validate the target
 *     certificate
 * @param constraints the algorithm constraints (or null)
 * @param pkixdate The date specified by the PKIXParameters date.  If the
 *                 PKIXParameters is null, the current date is used.  This
 *                 should be null when jar files are being checked.
 * @param jarTimestamp Timestamp passed for JAR timestamp constraint
 *                     checking. Set to null if not applicable.
 * @param variant is the Validator variants of the operation. A null value
 *                passed will set it to Validator.GENERIC.
 */
public AlgorithmChecker(TrustAnchor anchor,
        AlgorithmConstraints constraints, Date pkixdate,
        Timestamp jarTimestamp, String variant) {

    if (anchor != null) {
        if (anchor.getTrustedCert() != null) {
            this.trustedPubKey = anchor.getTrustedCert().getPublicKey();
            // Check for anchor certificate restrictions
            trustedMatch = checkFingerprint(anchor.getTrustedCert());
            if (trustedMatch && debug != null) {
                debug.println("trustedMatch = true");
            }
        } else {
            this.trustedPubKey = anchor.getCAPublicKey();
        }
    } else {
        this.trustedPubKey = null;
        if (debug != null) {
            debug.println("TrustAnchor is null, trustedMatch is false.");
        }
    }

    this.prevPubKey = this.trustedPubKey;
    this.constraints = (constraints == null ? certPathDefaultConstraints :
            constraints);
    // If we are checking jar files, set pkixdate the same as the timestamp
    // for certificate checking
    this.pkixdate = (jarTimestamp != null ? jarTimestamp.getTimestamp() :
            pkixdate);
    this.jarTimestamp = jarTimestamp;
    this.variant = (variant == null ? Validator.VAR_GENERIC : variant);
}
 

import sun.security.validator.Validator; //导入依赖的package包/类
/**
 * Return the X509CRLs matching this selector. The selector must be
 * an X509CRLSelector with certificateChecking set.
 */
// Called by com.sun.deploy.security.RevocationChecker
public static Collection<X509CRL> getCRLs(X509CRLSelector selector,
                                          boolean signFlag,
                                          PublicKey prevKey,
                                          String provider,
                                          List<CertStore> certStores,
                                          boolean[] reasonsMask,
                                          Set<TrustAnchor> trustAnchors,
                                          Date validity)
    throws CertStoreException
{
    return getCRLs(selector, signFlag, prevKey, null, provider, certStores,
            reasonsMask, trustAnchors, validity, Validator.VAR_GENERIC);
}
 

import sun.security.validator.Validator; //导入依赖的package包/类
String extendedMsg(ConstraintsParameters cp) {
    return (cp.getCertificate() == null ? "." :
            " used with certificate: " +
                    cp.getCertificate().getSubjectX500Principal() +
            (cp.getVariant() != Validator.VAR_GENERIC ?
                    ".  Usage was " + cp.getVariant() : "."));
}
 

import sun.security.validator.Validator; //导入依赖的package包/类
@Override
public void permits(ConstraintsParameters cp)
        throws CertPathValidatorException {
    for (String usage : usages) {

        String v = null;
        if (usage.compareToIgnoreCase("TLSServer") == 0) {
            v = Validator.VAR_TLS_SERVER;
        } else if (usage.compareToIgnoreCase("TLSClient") == 0) {
            v = Validator.VAR_TLS_CLIENT;
        } else if (usage.compareToIgnoreCase("SignedJAR") == 0) {
            v = Validator.VAR_PLUGIN_CODE_SIGNING;
        }

        if (debug != null) {
            debug.println("Checking if usage constraint \"" + v +
                    "\" matches \"" + cp.getVariant() + "\"");
            if (Debug.isVerbose()) {
                // Because usage checking can come from many places
                // a stack trace is very helpful.
                (new Exception()).printStackTrace(debug.getPrintStream());
            }
        }
        if (cp.getVariant().compareTo(v) == 0) {
            if (next(cp)) {
                return;
            }
            throw new CertPathValidatorException("Usage constraint " +
                    usage + " check failed: " + algorithm +
                    extendedMsg(cp),
                    null, null, -1, BasicReason.ALGORITHM_CONSTRAINED);
        }
    }
}
 

import sun.security.validator.Validator; //导入依赖的package包/类
public ConstraintsParameters(X509Certificate c, boolean match,
        Date pkixdate, Timestamp jarTime, String variant) {
    cert = c;
    trustedMatch = match;
    pkixDate = pkixdate;
    jarTimestamp = jarTime;
    this.variant = (variant == null ? Validator.VAR_GENERIC : variant);
    algorithm = null;
    algParams = null;
    publicKey = null;
}
 

import sun.security.validator.Validator; //导入依赖的package包/类
void validateCertChain(List<? extends Certificate> certs) throws Exception {
    try {
        Validator.getInstance(Validator.TYPE_PKIX,
                Validator.VAR_CODE_SIGNING,
                pkixParameters)
                .validate(certs.toArray(new X509Certificate[certs.size()]));
    } catch (Exception e) {
        if (debug) {
            e.printStackTrace();
        }
        if (e instanceof ValidatorException) {
            // Throw cause if it's CertPathValidatorException,
            if (e.getCause() != null &&
                    e.getCause() instanceof CertPathValidatorException) {
                e = (Exception) e.getCause();
                Throwable t = e.getCause();
                if ((t instanceof CertificateExpiredException &&
                            hasExpiredCert) ||
                        (t instanceof CertificateNotYetValidException &&
                                notYetValidCert)) {
                    // we already have hasExpiredCert and notYetValidCert
                    return;
                }
            }
            if (e instanceof ValidatorException) {
                ValidatorException ve = (ValidatorException)e;
                if (ve.getErrorType() == ValidatorException.T_EE_EXTENSIONS &&
                        (badKeyUsage || badExtendedKeyUsage || badNetscapeCertType)) {
                    // We already have badKeyUsage, badExtendedKeyUsage
                    // and badNetscapeCertType
                    return;
                }
            }
        }
        throw e;
    }
}
 

import sun.security.validator.Validator; //导入依赖的package包/类
public static void showValidatedChain(Validator v, X509Certificate[] chain,
        Set<X509Certificate> otherCerts) throws Exception {
    for (X509Certificate cert : v.validate(chain, otherCerts)) {
        System.out.println("\tSubj: " + cert.getSubjectX500Principal() +
                " Iss: " + cert.getIssuerX500Principal());
    }
}
 

import sun.security.validator.Validator; //导入依赖的package包/类
public void permits(ConstraintsParameters cp)
        throws CertPathValidatorException {
    for (String usage : usages) {

        String v = null;
        if (usage.compareToIgnoreCase("TLSServer") == 0) {
            v = Validator.VAR_TLS_SERVER;
        } else if (usage.compareToIgnoreCase("TLSClient") == 0) {
            v = Validator.VAR_TLS_CLIENT;
        } else if (usage.compareToIgnoreCase("SignedJAR") == 0) {
            v = Validator.VAR_PLUGIN_CODE_SIGNING;
        }

        if (debug != null) {
            debug.println("Checking if usage constraint \"" + v +
                    "\" matches \"" + cp.getVariant() + "\"");
            // Because usage checking can come from many places
            // a stack trace is very helpful.
            ByteArrayOutputStream ba = new ByteArrayOutputStream();
            PrintStream ps = new PrintStream(ba);
            (new Exception()).printStackTrace(ps);
            debug.println(ba.toString());
        }
        if (cp.getVariant().compareTo(v) == 0) {
            if (next(cp)) {
                return;
            }
            throw new CertPathValidatorException("Usage constraint " +
                    usage + " check failed: " + algorithm +
                    extendedMsg(cp),
                    null, null, -1, BasicReason.ALGORITHM_CONSTRAINED);
        }
    }
}
 

import sun.security.validator.Validator; //导入依赖的package包/类
private void checkAlgorithmConstraints(X509Certificate[] chain,
        AlgorithmConstraints constraints, boolean isClient) throws CertificateException {

    try {
        // Does the certificate chain end with a trusted certificate?
        int checkedLength = chain.length - 1;

        Collection<X509Certificate> trustedCerts = new HashSet<>();
        X509Certificate[] certs = tm.getAcceptedIssuers();
        if ((certs != null) && (certs.length > 0)){
            Collections.addAll(trustedCerts, certs);
        }

        if (trustedCerts.contains(chain[checkedLength])) {
                checkedLength--;
        }

        // A forward checker, need to check from trust to target
        if (checkedLength >= 0) {
            AlgorithmChecker checker =
                    new AlgorithmChecker(constraints, null,
                            (isClient ? Validator.VAR_TLS_CLIENT : Validator.VAR_TLS_SERVER));
            checker.init(false);
            for (int i = checkedLength; i >= 0; i--) {
                Certificate cert = chain[i];
                // We don't care about the unresolved critical extensions.
                checker.check(cert, Collections.<String>emptySet());
            }
        }
    } catch (CertPathValidatorException cpve) {
        throw new CertificateException(
            "Certificates does not conform to algorithm constraints");
    }
}