Class CertifiedTarget<A extends Address>

java.lang.Object
org.snmp4j.AbstractTarget<A>
org.snmp4j.SecureTarget<A>
org.snmp4j.CertifiedTarget<A>
All Implemented Interfaces:
Serializable, Cloneable, CertifiedIdentity, Target<A>
Direct Known Subclasses:
TlsX509CertifiedTarget
public class CertifiedTarget<A extends Address> extends SecureTarget<A> implements CertifiedIdentity, Serializable
The CertifiedTarget class implements a SecureTarget for usage with SecurityModels that support secured connections using client and server certificates.

Such a target holds two independent names, following the split RFC 6353 makes between the snmpTargetParamsTable and the snmpTlstmAddrTable:

  • The security name (AbstractTarget.getSecurityName()) is the tmSecurityName that TSM copies into msgSecurityName, i.e. the principal used for access control. It corresponds to snmpTargetParamsSecurityName.
  • The identity (getIdentity()) is the identity the peer is expected to prove with its certificate. It is matched against the dNSName and iPAddress subject alternative names of the server certificate as required by RFC 6353 §5.3.1 and corresponds to snmpTlstmAddrServerIdentity.
If no identity is set explicitly, the security name is used as identity too, which is the behavior of this class before version 3.13.0.
Since:
2.0
Version:
3.13.0
Author:
Frank Fock
See Also:

  • Constructor Details

    • CertifiedTarget

      public CertifiedTarget(OctetString securityName)
      Creates a CertifiedTarget with an unspecified TlsAddress and the given security name.
      Parameters:
      securityName - the tmSecurityName of the target. It is used as expected peer identity too, unless setIdentity(OctetString) is called.

    • CertifiedTarget

      public CertifiedTarget(A address, OctetString securityName, OctetString serverFingerprint, OctetString clientFingerprint)
      Creates a CertifiedTarget with the given address, security name, and certificate fingerprints.
      Parameters:
      address - the transport address of the target.
      securityName - the tmSecurityName of the target. It is used as expected peer identity too, unless setIdentity(OctetString) is called.
      serverFingerprint - the fingerprint of the server certificate to pin, or null/empty if the server certificate is to be validated by its certification path instead.
      clientFingerprint - the fingerprint of the client certificate to pin, or null/empty if the client certificate is to be validated by its certification path instead.

  • Method Details

    • getServerFingerprint

      public OctetString getServerFingerprint()
      Description copied from interface: CertifiedIdentity
      Gets the server certificate fingerprint.
      Specified by:
      getServerFingerprint in interface CertifiedIdentity
      Returns:
      the server certificate fingerprint or null if no fingerprint has been configured.

    • getClientFingerprint

      public OctetString getClientFingerprint()
      Description copied from interface: CertifiedIdentity
      Gets the client certificate fingerprint.
      Specified by:
      getClientFingerprint in interface CertifiedIdentity
      Returns:
      the client certificate fingerprint or null if no fingerprint has been configured.

    • getIdentity

      public OctetString getIdentity()
      Gets the identity the peer is expected to prove with its certificate. If no identity has been set with setIdentity(OctetString), the security name of this target is returned, as it was the case before version 3.13.0.

      Note that the RFC 6353 §5.3.1 verification of a server certificate uses getConfiguredIdentity() instead, so that a security name which is not a host name or IP address does not fail that verification.

      Specified by:
      getIdentity in interface CertifiedIdentity
      Returns:
      the expected peer identity, which may be null or empty if neither an identity nor a security name has been set. Then no identity comparison is performed.

    • setIdentity

      public void setIdentity(OctetString identity)
      Sets the identity the peer is expected to prove with its certificate, independently from the security name of this target. The identity is matched against the dNSName and iPAddress subject alternative names of the peer certificate, where the left-most label of a dNSName may be a wildcard (RFC 6353 snmpTlstmAddrServerIdentity).
      Parameters:
      identity - the expected peer identity, or null to fall back to the security name of this target.
      Since:
      3.13.0

    • getConfiguredIdentity

      public OctetString getConfiguredIdentity()
      Gets the identity that has been set explicitly with setIdentity(OctetString), without falling back to the security name of this target. The RFC 6353 §5.3.1 verification of a server certificate is based on this value, thus it is only performed if an identity has been set on purpose.
      Specified by:
      getConfiguredIdentity in interface CertifiedIdentity
      Returns:
      the explicitly configured expected peer identity or null if none has been configured.
      Since:
      3.13.0

    • toString

      public String toString()
      Overrides:
      toString in class SecureTarget<A extends Address>

    • duplicate

      public Target<A> duplicate()
      Description copied from interface: Target
      Creates a new copy of this target with the same address type.
      Specified by:
      duplicate in interface Target<A extends Address>
      Returns:
      a copy of this target with the same address type.