diff options
author | Bernard Normier <bernard@zeroc.com> | 2007-02-01 17:09:49 +0000 |
---|---|---|
committer | Bernard Normier <bernard@zeroc.com> | 2007-02-01 17:09:49 +0000 |
commit | abada90e3f84dc703b8ddc9efcbed8a946fadead (patch) | |
tree | 2c6f9dccd510ea97cb927a7bd635422efaae547a /java/ssl/jdk1.4/IceSSL/TrustManager.java | |
parent | removing trace message (diff) | |
download | ice-abada90e3f84dc703b8ddc9efcbed8a946fadead.tar.bz2 ice-abada90e3f84dc703b8ddc9efcbed8a946fadead.tar.xz ice-abada90e3f84dc703b8ddc9efcbed8a946fadead.zip |
Expanded tabs into spaces
Diffstat (limited to 'java/ssl/jdk1.4/IceSSL/TrustManager.java')
-rw-r--r-- | java/ssl/jdk1.4/IceSSL/TrustManager.java | 484 |
1 files changed, 242 insertions, 242 deletions
diff --git a/java/ssl/jdk1.4/IceSSL/TrustManager.java b/java/ssl/jdk1.4/IceSSL/TrustManager.java index 19c5f1ae6e6..1374b99dfec 100644 --- a/java/ssl/jdk1.4/IceSSL/TrustManager.java +++ b/java/ssl/jdk1.4/IceSSL/TrustManager.java @@ -13,277 +13,277 @@ class TrustManager { TrustManager(Ice.Communicator communicator) { - assert communicator != null; - _communicator = communicator; - Ice.Properties properties = communicator.getProperties(); - _traceLevel = properties.getPropertyAsInt("IceSSL.Trace.Security"); - String key = null; - try - { - key = "IceSSL.TrustOnly"; - _all = parse(properties.getProperty(key)); - key = "IceSSL.TrustOnly.Client"; - _client = parse(properties.getProperty(key)); - key = "IceSSL.TrustOnly.Server"; - _allServer = parse(properties.getProperty(key)); - java.util.Map dict = properties.getPropertiesForPrefix("IceSSL.TrustOnly.Server."); - java.util.Iterator p = dict.entrySet().iterator(); - while(p.hasNext()) - { - java.util.Map.Entry entry = (java.util.Map.Entry)p.next(); - key = (String)entry.getKey(); - String name = key.substring("IceSSL.TrustOnly.Server.".length()); - _server.put(name, parse((String)entry.getValue())); - } - } - catch(RFC2253.ParseException e) - { - Ice.PluginInitializationException ex = new Ice.PluginInitializationException(); - ex.reason = "IceSSL: invalid property " + key + ":\n" + e.reason; - throw ex; - } + assert communicator != null; + _communicator = communicator; + Ice.Properties properties = communicator.getProperties(); + _traceLevel = properties.getPropertyAsInt("IceSSL.Trace.Security"); + String key = null; + try + { + key = "IceSSL.TrustOnly"; + _all = parse(properties.getProperty(key)); + key = "IceSSL.TrustOnly.Client"; + _client = parse(properties.getProperty(key)); + key = "IceSSL.TrustOnly.Server"; + _allServer = parse(properties.getProperty(key)); + java.util.Map dict = properties.getPropertiesForPrefix("IceSSL.TrustOnly.Server."); + java.util.Iterator p = dict.entrySet().iterator(); + while(p.hasNext()) + { + java.util.Map.Entry entry = (java.util.Map.Entry)p.next(); + key = (String)entry.getKey(); + String name = key.substring("IceSSL.TrustOnly.Server.".length()); + _server.put(name, parse((String)entry.getValue())); + } + } + catch(RFC2253.ParseException e) + { + Ice.PluginInitializationException ex = new Ice.PluginInitializationException(); + ex.reason = "IceSSL: invalid property " + key + ":\n" + e.reason; + throw ex; + } } boolean verify(ConnectionInfo info) { - java.util.List trustset = new java.util.LinkedList(); - if(!_all.isEmpty()) - { - trustset.add(_all); - } + java.util.List trustset = new java.util.LinkedList(); + if(!_all.isEmpty()) + { + trustset.add(_all); + } - if(info.incoming) - { - if(!_allServer.isEmpty()) - { - trustset.add(_allServer); - } - if(info.adapterName.length() > 0) - { - java.util.List p = (java.util.List)_server.get(info.adapterName); - if(p != null) - { - trustset.add(p); - } - } - } - else - { - if(!_client.isEmpty()) - { - trustset.add(_client); - } - } + if(info.incoming) + { + if(!_allServer.isEmpty()) + { + trustset.add(_allServer); + } + if(info.adapterName.length() > 0) + { + java.util.List p = (java.util.List)_server.get(info.adapterName); + if(p != null) + { + trustset.add(p); + } + } + } + else + { + if(!_client.isEmpty()) + { + trustset.add(_client); + } + } - // - // If there is nothing to match against, then we accept the cert. - // - if(trustset.isEmpty()) - { - return true; - } + // + // If there is nothing to match against, then we accept the cert. + // + if(trustset.isEmpty()) + { + return true; + } - // - // If there is no certificate then we match false. - // - if(info.certs.length != 0) - { - javax.security.auth.x500.X500Principal subjectDN = (javax.security.auth.x500.X500Principal) - ((java.security.cert.X509Certificate)info.certs[0]).getSubjectX500Principal(); - String subjectName = subjectDN.getName(javax.security.auth.x500.X500Principal.RFC2253); - assert subjectName != null; - try - { - // - // Decompose the subject DN into the RDNs. - // - if(_traceLevel > 0) - { - if(info.incoming) - { - _communicator.getLogger().trace("Security", "trust manager evaluating client:\n" + - "subject = " + subjectName + "\n" + - "adapter = " + info.adapterName + "\n" + - "local addr = " + IceInternal.Network.addrToString(info.localAddr) + "\n" + - "remote addr = " + IceInternal.Network.addrToString(info.remoteAddr)); - } - else - { - _communicator.getLogger().trace("Security", "trust manager evaluating server:\n" + - "subject = " + subjectName + "\n" + - "local addr = " + IceInternal.Network.addrToString(info.localAddr) + "\n" + - "remote addr = " + IceInternal.Network.addrToString(info.remoteAddr)); - } - } - java.util.List dn = RFC2253.parseStrict(subjectName); + // + // If there is no certificate then we match false. + // + if(info.certs.length != 0) + { + javax.security.auth.x500.X500Principal subjectDN = (javax.security.auth.x500.X500Principal) + ((java.security.cert.X509Certificate)info.certs[0]).getSubjectX500Principal(); + String subjectName = subjectDN.getName(javax.security.auth.x500.X500Principal.RFC2253); + assert subjectName != null; + try + { + // + // Decompose the subject DN into the RDNs. + // + if(_traceLevel > 0) + { + if(info.incoming) + { + _communicator.getLogger().trace("Security", "trust manager evaluating client:\n" + + "subject = " + subjectName + "\n" + + "adapter = " + info.adapterName + "\n" + + "local addr = " + IceInternal.Network.addrToString(info.localAddr) + "\n" + + "remote addr = " + IceInternal.Network.addrToString(info.remoteAddr)); + } + else + { + _communicator.getLogger().trace("Security", "trust manager evaluating server:\n" + + "subject = " + subjectName + "\n" + + "local addr = " + IceInternal.Network.addrToString(info.localAddr) + "\n" + + "remote addr = " + IceInternal.Network.addrToString(info.remoteAddr)); + } + } + java.util.List dn = RFC2253.parseStrict(subjectName); - // - // Try matching against everything in the trust set. - // - java.util.Iterator p = trustset.iterator(); - while(p.hasNext()) - { - java.util.List matchSet = (java.util.List)p.next(); - if(_traceLevel > 1) - { - String s = "trust manager matching PDNs:\n"; - java.util.Iterator q = matchSet.iterator(); - boolean addSemi = false; - while(q.hasNext()) - { - if(addSemi) - { - s += ';'; - } - addSemi = true; - java.util.List rdnSet = (java.util.List)q.next(); - java.util.Iterator r = rdnSet.iterator(); - boolean addComma = false; - while(r.hasNext()) - { - if(addComma) - { - s += ','; - } - addComma = true; - RFC2253.RDNPair rdn = (RFC2253.RDNPair)r.next(); - s += rdn.key; - s += '='; - s += rdn.value; - } - } - _communicator.getLogger().trace("Security", s); - } + // + // Try matching against everything in the trust set. + // + java.util.Iterator p = trustset.iterator(); + while(p.hasNext()) + { + java.util.List matchSet = (java.util.List)p.next(); + if(_traceLevel > 1) + { + String s = "trust manager matching PDNs:\n"; + java.util.Iterator q = matchSet.iterator(); + boolean addSemi = false; + while(q.hasNext()) + { + if(addSemi) + { + s += ';'; + } + addSemi = true; + java.util.List rdnSet = (java.util.List)q.next(); + java.util.Iterator r = rdnSet.iterator(); + boolean addComma = false; + while(r.hasNext()) + { + if(addComma) + { + s += ','; + } + addComma = true; + RFC2253.RDNPair rdn = (RFC2253.RDNPair)r.next(); + s += rdn.key; + s += '='; + s += rdn.value; + } + } + _communicator.getLogger().trace("Security", s); + } - if(match(matchSet, dn)) - { - return true; - } - } - } - catch(RFC2253.ParseException e) - { - _communicator.getLogger().warning( - "IceSSL: unable to parse certificate DN `" + subjectName + "'\nreason: " + e.reason); - } - } + if(match(matchSet, dn)) + { + return true; + } + } + } + catch(RFC2253.ParseException e) + { + _communicator.getLogger().warning( + "IceSSL: unable to parse certificate DN `" + subjectName + "'\nreason: " + e.reason); + } + } - return false; + return false; } private boolean match(java.util.List matchSet, java.util.List subject) { - java.util.Iterator r = matchSet.iterator(); - while(r.hasNext()) - { - if(matchRDNs((java.util.List)r.next(), subject)) - { - return true; - } - } - return false; + java.util.Iterator r = matchSet.iterator(); + while(r.hasNext()) + { + if(matchRDNs((java.util.List)r.next(), subject)) + { + return true; + } + } + return false; } private boolean matchRDNs(java.util.List match, java.util.List subject) { - java.util.Iterator p = match.iterator(); - while(p.hasNext()) - { - RFC2253.RDNPair matchRDN = (RFC2253.RDNPair)p.next(); - boolean found = false; - java.util.Iterator q = subject.iterator(); - while(q.hasNext()) - { - RFC2253.RDNPair subjectRDN = (RFC2253.RDNPair)q.next(); - if(matchRDN.key.equals(subjectRDN.key)) - { - found = true; - if(!matchRDN.value.equals(subjectRDN.value)) - { - return false; - } - } - } - if(!found) - { - return false; - } - } - return true; + java.util.Iterator p = match.iterator(); + while(p.hasNext()) + { + RFC2253.RDNPair matchRDN = (RFC2253.RDNPair)p.next(); + boolean found = false; + java.util.Iterator q = subject.iterator(); + while(q.hasNext()) + { + RFC2253.RDNPair subjectRDN = (RFC2253.RDNPair)q.next(); + if(matchRDN.key.equals(subjectRDN.key)) + { + found = true; + if(!matchRDN.value.equals(subjectRDN.value)) + { + return false; + } + } + } + if(!found) + { + return false; + } + } + return true; } java.util.List parse(String value) - throws RFC2253.ParseException + throws RFC2253.ParseException { - // - // Java X500Principal.getName says: - // - // If "RFC2253" is specified as the format, this method emits - // the attribute type keywords defined in RFC 2253 (CN, L, ST, - // O, OU, C, STREET, DC, UID). Any other attribute type is - // emitted as an OID. Under a strict reading, RFC 2253 only - // specifies a UTF-8 string representation. The String - // returned by this method is the Unicode string achieved by - // decoding this UTF-8 representation. - // - // This means that things like emailAddress and such will be turned into - // something like: - // - // 1.2.840.113549.1.9.1=#160e696e666f407a65726f632e636f6d - // - // The left hand side is the OID (see - // http://www.columbia.edu/~ariel/ssleay/asn1-oids.html) for a - // list. The right hand side is a BER encoding of the value. - // - // This means that the user input, unless it uses the - // unfriendly OID format, will not directly match the - // principal. - // - // Two possible solutions: - // - // Have the RFC2253 parser convert anything that is not CN, L, - // ST, O, OU, C, STREET, DC, UID into OID format, and have it - // convert the values into a BER encoding. - // + // + // Java X500Principal.getName says: + // + // If "RFC2253" is specified as the format, this method emits + // the attribute type keywords defined in RFC 2253 (CN, L, ST, + // O, OU, C, STREET, DC, UID). Any other attribute type is + // emitted as an OID. Under a strict reading, RFC 2253 only + // specifies a UTF-8 string representation. The String + // returned by this method is the Unicode string achieved by + // decoding this UTF-8 representation. + // + // This means that things like emailAddress and such will be turned into + // something like: + // + // 1.2.840.113549.1.9.1=#160e696e666f407a65726f632e636f6d + // + // The left hand side is the OID (see + // http://www.columbia.edu/~ariel/ssleay/asn1-oids.html) for a + // list. The right hand side is a BER encoding of the value. + // + // This means that the user input, unless it uses the + // unfriendly OID format, will not directly match the + // principal. + // + // Two possible solutions: + // + // Have the RFC2253 parser convert anything that is not CN, L, + // ST, O, OU, C, STREET, DC, UID into OID format, and have it + // convert the values into a BER encoding. + // // Send the user data through X500Principal to string form and // then through the RFC2253 encoder. This uses the // X500Principal to do the encoding for us. - // - // The latter is much simpler, however, it means we need to - // send the data through the parser twice because we split the - // DNs on ';' which cannot be blindly split because of quotes, - // \ and such. - // - java.util.List l = RFC2253.parse(value); - java.util.List result = new java.util.LinkedList(); - java.util.Iterator p = l.iterator(); - while(p.hasNext()) - { - java.util.List dn = (java.util.List)p.next(); - String v = new String(); - boolean first = true; - java.util.Iterator q = dn.iterator(); - while(q.hasNext()) - { - if(!first) - { - v += ","; - } - first = false; - RFC2253.RDNPair pair = (RFC2253.RDNPair)q.next(); - v += pair.key; - v += "="; - v += pair.value; - } - javax.security.auth.x500.X500Principal princ = new javax.security.auth.x500.X500Principal(v); - String subjectName = princ.getName(javax.security.auth.x500.X500Principal.RFC2253); - result.add(RFC2253.parseStrict(subjectName)); - } - return result; + // + // The latter is much simpler, however, it means we need to + // send the data through the parser twice because we split the + // DNs on ';' which cannot be blindly split because of quotes, + // \ and such. + // + java.util.List l = RFC2253.parse(value); + java.util.List result = new java.util.LinkedList(); + java.util.Iterator p = l.iterator(); + while(p.hasNext()) + { + java.util.List dn = (java.util.List)p.next(); + String v = new String(); + boolean first = true; + java.util.Iterator q = dn.iterator(); + while(q.hasNext()) + { + if(!first) + { + v += ","; + } + first = false; + RFC2253.RDNPair pair = (RFC2253.RDNPair)q.next(); + v += pair.key; + v += "="; + v += pair.value; + } + javax.security.auth.x500.X500Principal princ = new javax.security.auth.x500.X500Principal(v); + String subjectName = princ.getName(javax.security.auth.x500.X500Principal.RFC2253); + result.add(RFC2253.parseStrict(subjectName)); + } + return result; } private Ice.Communicator _communicator; |