source: axis/net/deterlab/fedd/XTrustProvider.java @ 31aa1ee

/*
 * The contents of this file are subject to the "END USER LICENSE AGREEMENT FOR F5
 * Software Development Kit for iControl"; you may not use this file except in
 * compliance with the License. The License is included in the iControl
 * Software Development Kit.
 *
 * Software distributed under the License is distributed on an "AS IS"
 * basis, WITHOUT WARRANTY OF ANY KIND, either express or implied. See
 * the License for the specific language governing rights and limitations
 * under the License.
 *
 * The Original Code is iControl Code and related documentation
 * distributed by F5.
 *
 * Portions created by F5 are Copyright (C) 1996-2004 F5 Networks
 * Inc. All Rights Reserved.  iControl (TM) is a registered trademark of
 * F5 Networks, Inc.
 *
 * Alternatively, the contents of this file may be used under the terms
 * of the GNU General Public License (the "GPL"), in which case the
 * provisions of GPL are applicable instead of those above.  If you wish
 * to allow use of your version of this file only under the terms of the
 * GPL and not to allow others to use your version of this file under the
 * License, indicate your decision by deleting the provisions above and
 * replace them with the notice and other provisions required by the GPL.
 * If you do not delete the provisions above, a recipient may use your
 * version of this file under either the License or the GPL.
 *
 * This code has been slightly tweaked from that implementation described
 * above.  Comments are mostly mine (tvf) and are more notes of what I
 * understand of it.
 */

package net.deterlab.isi;

import java.security.AccessController; 
import java.security.InvalidAlgorithmParameterException; 
import java.security.KeyStore; 
import java.security.KeyStoreException; 
import java.security.PrivilegedAction; 
import java.security.Security; 
import java.security.cert.X509Certificate; 
  
import javax.net.ssl.ManagerFactoryParameters; 
import javax.net.ssl.TrustManager; 
import javax.net.ssl.TrustManagerFactorySpi; 
import javax.net.ssl.X509TrustManager; 

import java.math.BigInteger;
import java.util.Date;
import java.security.Principal;
import java.security.PublicKey;
import java.util.Set;
import java.util.TreeSet;

import java.io.File;
import java.io.IOException;
import java.io.PrintStream;
  
public final class XTrustProvider extends java.security.Provider { 
    private final static String NAME = "XTrustJSSE"; 
    private final static String INFO =
        "XTrust JSSE Provider (implements trust factory with " + 
        "truststore validation disabled)"; 
    private final static double VERSION = 1.0D; 
    private static PrintStream log = null;
    
    /**
     * Constructor
     */
    public XTrustProvider() { 
       super(NAME, VERSION, INFO); 
        
       AccessController.doPrivileged(new PrivilegedAction() { 
         public Object run() { 
             put("TrustManagerFactory." + 
                 TrustManagerFactoryImpl.getAlgorithm(),  
                 TrustManagerFactoryImpl.class.getName()); 
             return null; 
         } 
       }); 
    } 

    /**
     * Install this null provider as an SSL truststore validator.
     */
    public static void install() {
       if(Security.getProvider(NAME) == null) { 
          Security.insertProviderAt(new XTrustProvider(), 2); 
          Security.setProperty("ssl.TrustManagerFactory.algorithm",
              TrustManagerFactoryImpl.getAlgorithm()); 
       } 
    } 
    
    /**
     * The TrustManager implementation.
     */
    public final static class TrustManagerFactoryImpl 
            extends TrustManagerFactorySpi { 
       public TrustManagerFactoryImpl() { } 
       public static String getAlgorithm() { return "XTrust509"; } 
       protected void engineInit(KeyStore keystore) throws KeyStoreException { } 
       protected void engineInit(ManagerFactoryParameters mgrparams)
         throws InvalidAlgorithmParameterException { 
          throw new InvalidAlgorithmParameterException(
              XTrustProvider.NAME + " does not use ManagerFactoryParameters"); 
       } 

       /**
        * The getAcceptedIssuers method below needs to return an empty array of
        * X509Certificates, but to do that we need a concrete X509Certificate
        * Class.  This is a null implementation of that bastract class so we
        * can return an empty array of them.  Java's funny sometimes.
        */
       public static class NullX509Certificate extends X509Certificate {
           public NullX509Certificate() { super(); }

           public byte[] getEncoded() { return new byte[0]; }
           public PublicKey getPublicKey() { return null; }
           public String toString() { 
               return "Where'd you get this??? " + 
                   "Dummy class for allocating a null array";
           }
           public void verify(PublicKey key) { }
           public void verify(PublicKey key, String prov) { }

           public void checkValidity() { }
           public void checkValidity(Date d) { }
           public int getBasicConstraints() { return 0; }
           public Principal getIssuerDN() { return null; }
           public boolean[] getIssuerUniqueID() { return new boolean[0]; }
           public boolean[] getKeyUsage() { return new boolean[0]; }
           public Date getNotAfter() { return null; }
           public Date getNotBefore() { return null; }
           public BigInteger getSerialNumber() { return null; }
           public String getSigAlgName() { return null;} 
           public String getSigAlgOID() { return null;} 
           public byte[] getSigAlgParams() { return new byte[0]; }
           public byte[] getSignature() { return new byte[0]; }
           public Principal getSubjectDN() { return null; }
           public boolean[] getSubjectUniqueID() { return new boolean[0]; }
           public byte[] getTBSCertificate() { return new byte[0]; }
           public int getVersion() { return 0;}

           public Set<String> getCriticalExtensionOIDs() { 
               return new TreeSet<String>();
           } 
           public byte[] getExtensionValue(String o) { return null; }
           public Set<String> getNonCriticalExtensionOIDs() { 
               return new TreeSet<String>();
           } 
           public boolean hasUnsupportedCriticalExtension() { return true; }
       }

       /**
        * This is some fairly aggressive inlining to return a TrustManager that
        * accepts all chains (it throws no exceptions out of the check
        * functions) and returns no trusted issuers.
        */
       protected TrustManager[] engineGetTrustManagers() { 
            return new TrustManager[] { new X509TrustManager() { 
                public X509Certificate[] getAcceptedIssuers() {
                    return new NullX509Certificate[0];
                } 
                 public void checkClientTrusted(X509Certificate[] certs,
                         String authType) { } 
                 public void checkServerTrusted(X509Certificate[] certs,
                         String authType) { } 
            }}; 
        } 
    } 
}