151b1b6997fd3f980076b8081f7f1165ccc2a4008Piotr Jastrzebski/* 251b1b6997fd3f980076b8081f7f1165ccc2a4008Piotr Jastrzebski * Copyright (c) 2002, 2006, Oracle and/or its affiliates. All rights reserved. 351b1b6997fd3f980076b8081f7f1165ccc2a4008Piotr Jastrzebski * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. 451b1b6997fd3f980076b8081f7f1165ccc2a4008Piotr Jastrzebski * 551b1b6997fd3f980076b8081f7f1165ccc2a4008Piotr Jastrzebski * This code is free software; you can redistribute it and/or modify it 651b1b6997fd3f980076b8081f7f1165ccc2a4008Piotr Jastrzebski * under the terms of the GNU General Public License version 2 only, as 751b1b6997fd3f980076b8081f7f1165ccc2a4008Piotr Jastrzebski * published by the Free Software Foundation. Oracle designates this 851b1b6997fd3f980076b8081f7f1165ccc2a4008Piotr Jastrzebski * particular file as subject to the "Classpath" exception as provided 951b1b6997fd3f980076b8081f7f1165ccc2a4008Piotr Jastrzebski * by Oracle in the LICENSE file that accompanied this code. 1051b1b6997fd3f980076b8081f7f1165ccc2a4008Piotr Jastrzebski * 1151b1b6997fd3f980076b8081f7f1165ccc2a4008Piotr Jastrzebski * This code is distributed in the hope that it will be useful, but WITHOUT 1251b1b6997fd3f980076b8081f7f1165ccc2a4008Piotr Jastrzebski * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or 1351b1b6997fd3f980076b8081f7f1165ccc2a4008Piotr Jastrzebski * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License 1451b1b6997fd3f980076b8081f7f1165ccc2a4008Piotr Jastrzebski * version 2 for more details (a copy is included in the LICENSE file that 1551b1b6997fd3f980076b8081f7f1165ccc2a4008Piotr Jastrzebski * accompanied this code). 1651b1b6997fd3f980076b8081f7f1165ccc2a4008Piotr Jastrzebski * 1751b1b6997fd3f980076b8081f7f1165ccc2a4008Piotr Jastrzebski * You should have received a copy of the GNU General Public License version 1851b1b6997fd3f980076b8081f7f1165ccc2a4008Piotr Jastrzebski * 2 along with this work; if not, write to the Free Software Foundation, 1951b1b6997fd3f980076b8081f7f1165ccc2a4008Piotr Jastrzebski * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA. 2051b1b6997fd3f980076b8081f7f1165ccc2a4008Piotr Jastrzebski * 2151b1b6997fd3f980076b8081f7f1165ccc2a4008Piotr Jastrzebski * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA 2251b1b6997fd3f980076b8081f7f1165ccc2a4008Piotr Jastrzebski * or visit www.oracle.com if you need additional information or have any 2351b1b6997fd3f980076b8081f7f1165ccc2a4008Piotr Jastrzebski * questions. 2451b1b6997fd3f980076b8081f7f1165ccc2a4008Piotr Jastrzebski */ 2551b1b6997fd3f980076b8081f7f1165ccc2a4008Piotr Jastrzebski 2651b1b6997fd3f980076b8081f7f1165ccc2a4008Piotr Jastrzebskipackage sun.security.validator; 2751b1b6997fd3f980076b8081f7f1165ccc2a4008Piotr Jastrzebski 2851b1b6997fd3f980076b8081f7f1165ccc2a4008Piotr Jastrzebskiimport java.io.*; 2951b1b6997fd3f980076b8081f7f1165ccc2a4008Piotr Jastrzebskiimport java.util.*; 3051b1b6997fd3f980076b8081f7f1165ccc2a4008Piotr Jastrzebski 3151b1b6997fd3f980076b8081f7f1165ccc2a4008Piotr Jastrzebskiimport java.security.*; 3251b1b6997fd3f980076b8081f7f1165ccc2a4008Piotr Jastrzebskiimport java.security.cert.*; 3351b1b6997fd3f980076b8081f7f1165ccc2a4008Piotr Jastrzebskiimport java.security.cert.Certificate; 3451b1b6997fd3f980076b8081f7f1165ccc2a4008Piotr Jastrzebski 3551b1b6997fd3f980076b8081f7f1165ccc2a4008Piotr Jastrzebskiimport sun.security.action.*; 3651b1b6997fd3f980076b8081f7f1165ccc2a4008Piotr Jastrzebski 3751b1b6997fd3f980076b8081f7f1165ccc2a4008Piotr Jastrzebski/** 3851b1b6997fd3f980076b8081f7f1165ccc2a4008Piotr Jastrzebski * Collection of static utility methods related to KeyStores. 3951b1b6997fd3f980076b8081f7f1165ccc2a4008Piotr Jastrzebski * 4051b1b6997fd3f980076b8081f7f1165ccc2a4008Piotr Jastrzebski * @author Andreas Sterbenz 4151b1b6997fd3f980076b8081f7f1165ccc2a4008Piotr Jastrzebski */ 4251b1b6997fd3f980076b8081f7f1165ccc2a4008Piotr Jastrzebskipublic class KeyStores { 4351b1b6997fd3f980076b8081f7f1165ccc2a4008Piotr Jastrzebski 4451b1b6997fd3f980076b8081f7f1165ccc2a4008Piotr Jastrzebski private KeyStores() { 4551b1b6997fd3f980076b8081f7f1165ccc2a4008Piotr Jastrzebski // empty 4651b1b6997fd3f980076b8081f7f1165ccc2a4008Piotr Jastrzebski } 4751b1b6997fd3f980076b8081f7f1165ccc2a4008Piotr Jastrzebski 4851b1b6997fd3f980076b8081f7f1165ccc2a4008Piotr Jastrzebski // in the future, all accesses to the system cacerts keystore should 4951b1b6997fd3f980076b8081f7f1165ccc2a4008Piotr Jastrzebski // go through this class. but not right now. 5051b1b6997fd3f980076b8081f7f1165ccc2a4008Piotr Jastrzebski/* 5151b1b6997fd3f980076b8081f7f1165ccc2a4008Piotr Jastrzebski private final static String javaHome = 5251b1b6997fd3f980076b8081f7f1165ccc2a4008Piotr Jastrzebski (String)AccessController.doPrivileged(new GetPropertyAction("java.home")); 5351b1b6997fd3f980076b8081f7f1165ccc2a4008Piotr Jastrzebski 5451b1b6997fd3f980076b8081f7f1165ccc2a4008Piotr Jastrzebski private final static char SEP = File.separatorChar; 5551b1b6997fd3f980076b8081f7f1165ccc2a4008Piotr Jastrzebski 5651b1b6997fd3f980076b8081f7f1165ccc2a4008Piotr Jastrzebski private static KeyStore caCerts; 5751b1b6997fd3f980076b8081f7f1165ccc2a4008Piotr Jastrzebski 5851b1b6997fd3f980076b8081f7f1165ccc2a4008Piotr Jastrzebski private static KeyStore getKeyStore(String type, String name, 5951b1b6997fd3f980076b8081f7f1165ccc2a4008Piotr Jastrzebski char[] password) throws IOException { 6051b1b6997fd3f980076b8081f7f1165ccc2a4008Piotr Jastrzebski if (type == null) { 6151b1b6997fd3f980076b8081f7f1165ccc2a4008Piotr Jastrzebski type = "JKS"; 6251b1b6997fd3f980076b8081f7f1165ccc2a4008Piotr Jastrzebski } 6351b1b6997fd3f980076b8081f7f1165ccc2a4008Piotr Jastrzebski try { 6451b1b6997fd3f980076b8081f7f1165ccc2a4008Piotr Jastrzebski KeyStore ks = KeyStore.getInstance(type); 6551b1b6997fd3f980076b8081f7f1165ccc2a4008Piotr Jastrzebski FileInputStream in = (FileInputStream)AccessController.doPrivileged 6651b1b6997fd3f980076b8081f7f1165ccc2a4008Piotr Jastrzebski (new OpenFileInputStreamAction(name)); 6751b1b6997fd3f980076b8081f7f1165ccc2a4008Piotr Jastrzebski ks.load(in, password); 6851b1b6997fd3f980076b8081f7f1165ccc2a4008Piotr Jastrzebski return ks; 6951b1b6997fd3f980076b8081f7f1165ccc2a4008Piotr Jastrzebski } catch (GeneralSecurityException e) { 7051b1b6997fd3f980076b8081f7f1165ccc2a4008Piotr Jastrzebski // XXX 7151b1b6997fd3f980076b8081f7f1165ccc2a4008Piotr Jastrzebski throw new IOException(); 7251b1b6997fd3f980076b8081f7f1165ccc2a4008Piotr Jastrzebski } catch (PrivilegedActionException e) { 7351b1b6997fd3f980076b8081f7f1165ccc2a4008Piotr Jastrzebski throw (IOException)e.getCause(); 7451b1b6997fd3f980076b8081f7f1165ccc2a4008Piotr Jastrzebski } 7551b1b6997fd3f980076b8081f7f1165ccc2a4008Piotr Jastrzebski } 7651b1b6997fd3f980076b8081f7f1165ccc2a4008Piotr Jastrzebski 7751b1b6997fd3f980076b8081f7f1165ccc2a4008Piotr Jastrzebski /** 7851b1b6997fd3f980076b8081f7f1165ccc2a4008Piotr Jastrzebski * Return a KeyStore with the contents of the lib/security/cacerts file. 7951b1b6997fd3f980076b8081f7f1165ccc2a4008Piotr Jastrzebski * The file is only opened once per JVM invocation and the contents 8051b1b6997fd3f980076b8081f7f1165ccc2a4008Piotr Jastrzebski * cached subsequently. 8151b1b6997fd3f980076b8081f7f1165ccc2a4008Piotr Jastrzebski * 8251b1b6997fd3f980076b8081f7f1165ccc2a4008Piotr Jastrzebski public synchronized static KeyStore getCaCerts() throws IOException { 8351b1b6997fd3f980076b8081f7f1165ccc2a4008Piotr Jastrzebski if (caCerts != null) { 8451b1b6997fd3f980076b8081f7f1165ccc2a4008Piotr Jastrzebski return caCerts; 8551b1b6997fd3f980076b8081f7f1165ccc2a4008Piotr Jastrzebski } 8651b1b6997fd3f980076b8081f7f1165ccc2a4008Piotr Jastrzebski String name = javaHome + SEP + "lib" + SEP + "security" + SEP + "cacerts"; 8751b1b6997fd3f980076b8081f7f1165ccc2a4008Piotr Jastrzebski caCerts = getKeyStore(null, name, null); 8851b1b6997fd3f980076b8081f7f1165ccc2a4008Piotr Jastrzebski return caCerts; 8951b1b6997fd3f980076b8081f7f1165ccc2a4008Piotr Jastrzebski } 9051b1b6997fd3f980076b8081f7f1165ccc2a4008Piotr Jastrzebski*/ 9151b1b6997fd3f980076b8081f7f1165ccc2a4008Piotr Jastrzebski 9251b1b6997fd3f980076b8081f7f1165ccc2a4008Piotr Jastrzebski /** 9351b1b6997fd3f980076b8081f7f1165ccc2a4008Piotr Jastrzebski * Return a Set with all trusted X509Certificates contained in 9451b1b6997fd3f980076b8081f7f1165ccc2a4008Piotr Jastrzebski * this KeyStore. 9551b1b6997fd3f980076b8081f7f1165ccc2a4008Piotr Jastrzebski */ 9651b1b6997fd3f980076b8081f7f1165ccc2a4008Piotr Jastrzebski public static Set<X509Certificate> getTrustedCerts(KeyStore ks) { 9751b1b6997fd3f980076b8081f7f1165ccc2a4008Piotr Jastrzebski Set<X509Certificate> set = new HashSet<X509Certificate>(); 9851b1b6997fd3f980076b8081f7f1165ccc2a4008Piotr Jastrzebski try { 9951b1b6997fd3f980076b8081f7f1165ccc2a4008Piotr Jastrzebski for (Enumeration<String> e = ks.aliases(); e.hasMoreElements(); ) { 10051b1b6997fd3f980076b8081f7f1165ccc2a4008Piotr Jastrzebski String alias = e.nextElement(); 10151b1b6997fd3f980076b8081f7f1165ccc2a4008Piotr Jastrzebski if (ks.isCertificateEntry(alias)) { 10251b1b6997fd3f980076b8081f7f1165ccc2a4008Piotr Jastrzebski Certificate cert = ks.getCertificate(alias); 10351b1b6997fd3f980076b8081f7f1165ccc2a4008Piotr Jastrzebski if (cert instanceof X509Certificate) { 10451b1b6997fd3f980076b8081f7f1165ccc2a4008Piotr Jastrzebski set.add((X509Certificate)cert); 10551b1b6997fd3f980076b8081f7f1165ccc2a4008Piotr Jastrzebski } 10651b1b6997fd3f980076b8081f7f1165ccc2a4008Piotr Jastrzebski } else if (ks.isKeyEntry(alias)) { 10751b1b6997fd3f980076b8081f7f1165ccc2a4008Piotr Jastrzebski Certificate[] certs = ks.getCertificateChain(alias); 10851b1b6997fd3f980076b8081f7f1165ccc2a4008Piotr Jastrzebski if ((certs != null) && (certs.length > 0) && 10951b1b6997fd3f980076b8081f7f1165ccc2a4008Piotr Jastrzebski (certs[0] instanceof X509Certificate)) { 11051b1b6997fd3f980076b8081f7f1165ccc2a4008Piotr Jastrzebski set.add((X509Certificate)certs[0]); 11151b1b6997fd3f980076b8081f7f1165ccc2a4008Piotr Jastrzebski } 11251b1b6997fd3f980076b8081f7f1165ccc2a4008Piotr Jastrzebski } 11351b1b6997fd3f980076b8081f7f1165ccc2a4008Piotr Jastrzebski } 11451b1b6997fd3f980076b8081f7f1165ccc2a4008Piotr Jastrzebski } catch (KeyStoreException e) { 11551b1b6997fd3f980076b8081f7f1165ccc2a4008Piotr Jastrzebski // ignore 11651b1b6997fd3f980076b8081f7f1165ccc2a4008Piotr Jastrzebski } 11751b1b6997fd3f980076b8081f7f1165ccc2a4008Piotr Jastrzebski return set; 11851b1b6997fd3f980076b8081f7f1165ccc2a4008Piotr Jastrzebski } 11951b1b6997fd3f980076b8081f7f1165ccc2a4008Piotr Jastrzebski 12051b1b6997fd3f980076b8081f7f1165ccc2a4008Piotr Jastrzebski} 121