| OLD | NEW |
| 1 // Copyright 2012 The Chromium Authors. All rights reserved. | 1 // Copyright 2012 The Chromium Authors. All rights reserved. |
| 2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
| 3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
| 4 | 4 |
| 5 package org.chromium.net; | 5 package org.chromium.net; |
| 6 | 6 |
| 7 import android.annotation.SuppressLint; | 7 import android.annotation.SuppressLint; |
| 8 import android.content.BroadcastReceiver; | 8 import android.content.BroadcastReceiver; |
| 9 import android.content.Context; | 9 import android.content.Context; |
| 10 import android.content.Intent; | 10 import android.content.Intent; |
| (...skipping 354 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 365 | 365 |
| 366 if (!(anchor instanceof X509Certificate)) { | 366 if (!(anchor instanceof X509Certificate)) { |
| 367 // This should never happen. | 367 // This should never happen. |
| 368 String className = anchor.getClass().getName(); | 368 String className = anchor.getClass().getName(); |
| 369 Log.e(TAG, "Anchor " + alias + " not an X509Certificate: " + cla
ssName); | 369 Log.e(TAG, "Anchor " + alias + " not an X509Certificate: " + cla
ssName); |
| 370 continue; | 370 continue; |
| 371 } | 371 } |
| 372 | 372 |
| 373 // If the subject and public key match, this is a system root. | 373 // If the subject and public key match, this is a system root. |
| 374 X509Certificate anchorX509 = (X509Certificate) anchor; | 374 X509Certificate anchorX509 = (X509Certificate) anchor; |
| 375 if (root.getSubjectX500Principal().equals(anchorX509.getSubjectX500P
rincipal()) && | 375 if (root.getSubjectX500Principal().equals(anchorX509.getSubjectX500P
rincipal()) |
| 376 root.getPublicKey().equals(anchorX509.getPublicKey())) { | 376 && root.getPublicKey().equals(anchorX509.getPublicKey())) { |
| 377 sSystemTrustAnchorCache.add(key); | 377 sSystemTrustAnchorCache.add(key); |
| 378 return true; | 378 return true; |
| 379 } | 379 } |
| 380 } | 380 } |
| 381 | 381 |
| 382 return false; | 382 return false; |
| 383 } | 383 } |
| 384 | 384 |
| 385 /** | 385 /** |
| 386 * If an EKU extension is present in the end-entity certificate, it MUST con
tain either the | 386 * If an EKU extension is present in the end-entity certificate, it MUST con
tain either the |
| (...skipping 11 matching lines...) Expand all Loading... |
| 398 ekuOids = certificate.getExtendedKeyUsage(); | 398 ekuOids = certificate.getExtendedKeyUsage(); |
| 399 } catch (NullPointerException e) { | 399 } catch (NullPointerException e) { |
| 400 // getExtendedKeyUsage() can crash due to an Android platform bug. T
his probably | 400 // getExtendedKeyUsage() can crash due to an Android platform bug. T
his probably |
| 401 // happens when the EKU extension data is malformed so return false
here. | 401 // happens when the EKU extension data is malformed so return false
here. |
| 402 // See http://crbug.com/233610 | 402 // See http://crbug.com/233610 |
| 403 return false; | 403 return false; |
| 404 } | 404 } |
| 405 if (ekuOids == null) return true; | 405 if (ekuOids == null) return true; |
| 406 | 406 |
| 407 for (String ekuOid : ekuOids) { | 407 for (String ekuOid : ekuOids) { |
| 408 if (ekuOid.equals(OID_TLS_SERVER_AUTH) || | 408 if (ekuOid.equals(OID_TLS_SERVER_AUTH) |
| 409 ekuOid.equals(OID_ANY_EKU) || | 409 || ekuOid.equals(OID_ANY_EKU) |
| 410 ekuOid.equals(OID_SERVER_GATED_NETSCAPE) || | 410 || ekuOid.equals(OID_SERVER_GATED_NETSCAPE) |
| 411 ekuOid.equals(OID_SERVER_GATED_MICROSOFT)) { | 411 || ekuOid.equals(OID_SERVER_GATED_MICROSOFT)) { |
| 412 return true; | 412 return true; |
| 413 } | 413 } |
| 414 } | 414 } |
| 415 | 415 |
| 416 return false; | 416 return false; |
| 417 } | 417 } |
| 418 | 418 |
| 419 public static AndroidCertVerifyResult verifyServerCertificates(byte[][] cert
Chain, | 419 public static AndroidCertVerifyResult verifyServerCertificates(byte[][] cert
Chain, |
| 420 String authTy
pe, | 420 String authTy
pe, |
| 421 String host) | 421 String host) |
| 422 throws KeyStoreException, NoSuchAlgorithmException { | 422 throws KeyStoreException, NoSuchAlgorithmException { |
| 423 if (certChain == null || certChain.length == 0 || certChain[0] == null)
{ | 423 if (certChain == null || certChain.length == 0 || certChain[0] == null)
{ |
| 424 throw new IllegalArgumentException("Expected non-null and non-empty
certificate " + | 424 throw new IllegalArgumentException("Expected non-null and non-empty
certificate " |
| 425 "chain passed as |certChain|. |certChain|=" + Arrays.deepToS
tring(certChain)); | 425 + "chain passed as |certChain|. |certChain|=" + Arrays.deepT
oString(certChain)); |
| 426 } | 426 } |
| 427 | 427 |
| 428 | 428 |
| 429 try { | 429 try { |
| 430 ensureInitialized(); | 430 ensureInitialized(); |
| 431 } catch (CertificateException e) { | 431 } catch (CertificateException e) { |
| 432 return new AndroidCertVerifyResult(CertVerifyStatusAndroid.FAILED); | 432 return new AndroidCertVerifyResult(CertVerifyStatusAndroid.FAILED); |
| 433 } | 433 } |
| 434 | 434 |
| 435 X509Certificate[] serverCertificates = new X509Certificate[certChain.len
gth]; | 435 X509Certificate[] serverCertificates = new X509Certificate[certChain.len
gth]; |
| (...skipping 32 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 468 try { | 468 try { |
| 469 verifiedChain = sDefaultTrustManager.checkServerTrusted(serverCe
rtificates, | 469 verifiedChain = sDefaultTrustManager.checkServerTrusted(serverCe
rtificates, |
| 470 authType
, host); | 470 authType
, host); |
| 471 } catch (CertificateException eDefaultManager) { | 471 } catch (CertificateException eDefaultManager) { |
| 472 try { | 472 try { |
| 473 verifiedChain = sTestTrustManager.checkServerTrusted(serverC
ertificates, | 473 verifiedChain = sTestTrustManager.checkServerTrusted(serverC
ertificates, |
| 474 authTyp
e, host); | 474 authTyp
e, host); |
| 475 } catch (CertificateException eTestManager) { | 475 } catch (CertificateException eTestManager) { |
| 476 // Neither of the trust managers confirms the validity of th
e certificate chain, | 476 // Neither of the trust managers confirms the validity of th
e certificate chain, |
| 477 // log the error message returned by the system trust manage
r. | 477 // log the error message returned by the system trust manage
r. |
| 478 Log.i(TAG, "Failed to validate the certificate chain, error:
" + | 478 Log.i(TAG, "Failed to validate the certificate chain, error:
" |
| 479 eDefaultManager.getMessage()); | 479 + eDefaultManager.getMessage()); |
| 480 return new AndroidCertVerifyResult( | 480 return new AndroidCertVerifyResult( |
| 481 CertVerifyStatusAndroid.NO_TRUSTED_ROOT); | 481 CertVerifyStatusAndroid.NO_TRUSTED_ROOT); |
| 482 } | 482 } |
| 483 } | 483 } |
| 484 | 484 |
| 485 boolean isIssuedByKnownRoot = false; | 485 boolean isIssuedByKnownRoot = false; |
| 486 if (verifiedChain.size() > 0) { | 486 if (verifiedChain.size() > 0) { |
| 487 X509Certificate root = verifiedChain.get(verifiedChain.size() -
1); | 487 X509Certificate root = verifiedChain.get(verifiedChain.size() -
1); |
| 488 isIssuedByKnownRoot = isKnownRoot(root); | 488 isIssuedByKnownRoot = isKnownRoot(root); |
| 489 } | 489 } |
| (...skipping 16 matching lines...) Expand all Loading... |
| 506 */ | 506 */ |
| 507 private static native void nativeRecordCertVerifyCapabilitiesHistogram( | 507 private static native void nativeRecordCertVerifyCapabilitiesHistogram( |
| 508 boolean foundSystemTrustRoots); | 508 boolean foundSystemTrustRoots); |
| 509 | 509 |
| 510 /** | 510 /** |
| 511 * Returns the application context. | 511 * Returns the application context. |
| 512 */ | 512 */ |
| 513 private static native Context nativeGetApplicationContext(); | 513 private static native Context nativeGetApplicationContext(); |
| 514 | 514 |
| 515 } | 515 } |
| OLD | NEW |