Class TLSTMExtendedTrustManager

java.lang.Object

javax.net.ssl.X509ExtendedTrustManager

org.snmp4j.transport.tls.TLSTMExtendedTrustManager

All Implemented Interfaces:

TrustManager, X509TrustManager

public class TLSTMExtendedTrustManager
extends X509ExtendedTrustManager

TLSTM trust manager that implements the X509ExtendedTrustManager interface.

Since:

2.5.7

Author:

Frank Fock

Constructor Summary

Constructors

Constructor	Description
TLSTMExtendedTrustManager(CounterSupport tlstmCounters, TlsTmSecurityCallback<X509Certificate> securityCallback, X509TrustManager trustManager, boolean useClientMode, TransportStateReference tmStateReference)

Method Summary

Modifier and Type	Method	Description
void	checkClientTrusted(X509Certificate[] x509Certificates, String s)
void	checkClientTrusted(X509Certificate[] x509Certificates, String s, Socket socket)
void	checkClientTrusted(X509Certificate[] x509Certificates, String s, SSLEngine sslEngine)
protected void	checkServerIdentity(X509Certificate[] x509Certificates)	Verifies the identity of the (D)TLS server as required by RFC 6353 §5.3.1 step 4, if the target provides an expected identity through CertifiedIdentity.getConfiguredIdentity().
void	checkServerTrusted(X509Certificate[] x509Certificates, String s)
void	checkServerTrusted(X509Certificate[] x509Certificates, String s, Socket socket)
void	checkServerTrusted(X509Certificate[] x509Certificates, String s, SSLEngine sslEngine)
X509Certificate[]	getAcceptedIssuers()
static X509Certificate[]	getAcceptedIssuers(X509TrustManager trustManager, TlsTmSecurityCallback<X509Certificate> securityCallback)	Gets the accepted X509Certificates from the given X509TrustManager and security callback.
protected TlsTmSecurityCallback<X509Certificate>	getSecurityCallback()	Returns the security callback to be used for the peer of the associated transport state reference.
protected static boolean	isMatchingDnsName(String expected, String dNSName)	Matches an expected host name against a dNSName subject alternative name, where the dNSName may use a wildcard for its left-most label only (RFC 6353, snmpTlstmAddrTable).

Methods inherited from class Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Details

TLSTMExtendedTrustManager

public TLSTMExtendedTrustManager(CounterSupport tlstmCounters,
 TlsTmSecurityCallback<X509Certificate> securityCallback,
 X509TrustManager trustManager,
 boolean useClientMode,
 TransportStateReference tmStateReference)

Method Details

checkClientTrusted

public void checkClientTrusted(X509Certificate[] x509Certificates,
 String s)
                        throws CertificateException

Throws:

CertificateException

checkServerTrusted

public void checkServerTrusted(X509Certificate[] x509Certificates,
 String s)
                        throws CertificateException

Throws:

CertificateException

getAcceptedIssuers

public X509Certificate[] getAcceptedIssuers()

getAcceptedIssuers

public static X509Certificate[] getAcceptedIssuers(X509TrustManager trustManager,
 TlsTmSecurityCallback<X509Certificate> securityCallback)

Gets the accepted X509Certificates from the given X509TrustManager and security callback.

Parameters:

trustManager - a X509TrustManager providing the accepted issuers.

securityCallback - a security callback that is ask to accept any returned issuer.

Returns:

a probably empty or null array of accepted issuers.

Since:

3.6.0

checkClientTrusted

public void checkClientTrusted(X509Certificate[] x509Certificates,
 String s,
 Socket socket)
                        throws CertificateException

Specified by:

checkClientTrusted in class X509ExtendedTrustManager

Throws:

CertificateException

checkServerTrusted

public void checkServerTrusted(X509Certificate[] x509Certificates,
 String s,
 Socket socket)
                        throws CertificateException

Specified by:

checkServerTrusted in class X509ExtendedTrustManager

Throws:

CertificateException

getSecurityCallback

protected TlsTmSecurityCallback<X509Certificate> getSecurityCallback()

Returns the security callback to be used for the peer of the associated transport state reference. A callback configured on the target itself, see TlsX509CertifiedTarget.getTlsTmSecurityCallback(), takes precedence over the transport mapping wide callback.

Returns:

the security callback to use or null if none is configured.

Since:

3.13.0

checkServerIdentity

protected void checkServerIdentity(X509Certificate[] x509Certificates)
                            throws CertificateException

Verifies the identity of the (D)TLS server as required by RFC 6353 §5.3.1 step 4, if the target provides an expected identity through CertifiedIdentity.getConfiguredIdentity(). The expected identity is matched against the dNSName and the iPAddress subject alternative names of the server certificate, where a dNSName may use a wildcard for its left-most label only.

Note that CertifiedIdentity.getConfiguredIdentity() is used instead of CertifiedIdentity.getIdentity() on purpose: the latter falls back to the security name of the target for backwards compatibility, and a security name is a principal for access control which is usually neither a host name nor an IP address. Only an identity that has been configured deliberately, for example with CertifiedTarget.setIdentity(OctetString), is verified here.

If the target does not provide an expected identity, no comparison is performed. That case is left to certification path validation, the fingerprint pinning of checkServerTrustedByFingerprint(X509Certificate[]), the security callback, and - for client mode engines - to the endpoint identification algorithm configured by DefaultSSLEngineConfiguration.setEndpointIdentificationAlgorithm(String), which makes JSSE match the certificate against the address of the target by default.

Parameters:

x509Certificates - the certificate chain of the server, where the first element is the server certificate.

Throws:

CertificateException - if an expected identity is configured, but the server certificate does not match it.

Since:

3.13.0

isMatchingDnsName

protected static boolean isMatchingDnsName(String expected,
 String dNSName)

Matches an expected host name against a dNSName subject alternative name, where the dNSName may use a wildcard for its left-most label only (RFC 6353, snmpTlstmAddrTable).

Parameters:

expected - the expected host name.

dNSName - the dNSName of the certificate.

Returns:

true if expected matches dNSName.

Since:

3.13.0

checkClientTrusted

public void checkClientTrusted(X509Certificate[] x509Certificates,
 String s,
 SSLEngine sslEngine)
                        throws CertificateException

Specified by:

checkClientTrusted in class X509ExtendedTrustManager

Throws:

CertificateException

checkServerTrusted

public void checkServerTrusted(X509Certificate[] x509Certificates,
 String s,
 SSLEngine sslEngine)
                        throws CertificateException

Specified by:

checkServerTrusted in class X509ExtendedTrustManager

Throws:

CertificateException