src/com/owncloud/android/network/AdvancedX509TrustManager.java

   1 /* ownCloud Android client application
   2  *   Copyright (C) 2012-2013 ownCloud Inc.
   3  *
   4  *   This program is free software: you can redistribute it and/or modify
   5  *   it under the terms of the GNU General Public License version 2,
   6  *   as published by the Free Software Foundation.
   7  *
   8  *   This program is distributed in the hope that it will be useful,
   9  *   but WITHOUT ANY WARRANTY; without even the implied warranty of
  10  *   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  11  *   GNU General Public License for more details.
  12  *
  13  *   You should have received a copy of the GNU General Public License
  14  *   along with this program.  If not, see <http://www.gnu.org/licenses/>.
  15  *
  16  */
  17
  18 package com.owncloud.android.network;
  19
  20 import java.security.KeyStore;
  21 import java.security.KeyStoreException;
  22 import java.security.NoSuchAlgorithmException;
  23 import java.security.cert.CertPathValidatorException;
  24 import java.security.cert.CertStoreException;
  25 import java.security.cert.CertificateException;
  26 import java.security.cert.CertificateExpiredException;
  27 import java.security.cert.CertificateNotYetValidException;
  28 import java.security.cert.X509Certificate;
  29
  30 import javax.net.ssl.TrustManager;
  31 import javax.net.ssl.TrustManagerFactory;
  32 import javax.net.ssl.X509TrustManager;
  33
  34 import com.owncloud.android.Log_OC;
  35
  36 import android.util.Log;
  37
  38 /**
  39  * @author David A. Velasco
  40  */
  41 public class AdvancedX509TrustManager implements X509TrustManager {
  42
  43     private static final String TAG = AdvancedX509TrustManager.class.getSimpleName();
  44
  45     private X509TrustManager mStandardTrustManager = null;
  46     private KeyStore mKnownServersKeyStore;
  47
  48     /**
  49      * Constructor for AdvancedX509TrustManager
  50      *
  51      * @param  knownServersCertStore    Local certificates store with server certificates explicitly trusted by the user.
  52      * @throws CertStoreException       When no default X509TrustManager instance was found in the system.
  53      */
  54     public AdvancedX509TrustManager(KeyStore knownServersKeyStore)
  55             throws NoSuchAlgorithmException, KeyStoreException, CertStoreException {
  56         super();
  57         TrustManagerFactory factory = TrustManagerFactory
  58                 .getInstance(TrustManagerFactory.getDefaultAlgorithm());
  59         factory.init((KeyStore)null);
  60         mStandardTrustManager = findX509TrustManager(factory);
  61
  62         mKnownServersKeyStore = knownServersKeyStore;
  63     }
  64
  65
  66     /**
  67      * Locates the first X509TrustManager provided by a given TrustManagerFactory
  68      * @param factory               TrustManagerFactory to inspect in the search for a X509TrustManager
  69      * @return                      The first X509TrustManager found in factory.
  70      * @throws CertStoreException   When no X509TrustManager instance was found in factory
  71      */
  72     private X509TrustManager findX509TrustManager(TrustManagerFactory factory) throws CertStoreException {
  73         TrustManager tms[] = factory.getTrustManagers();
  74         for (int i = 0; i < tms.length; i++) {
  75             if (tms[i] instanceof X509TrustManager) {
  76                 return (X509TrustManager) tms[i];
  77             }
  78         }
  79         return null;
  80     }
  81
  82
  83     /**
  84      * @see javax.net.ssl.X509TrustManager#checkClientTrusted(X509Certificate[],
  85      *      String authType)
  86      */
  87     public void checkClientTrusted(X509Certificate[] certificates, String authType) throws CertificateException {
  88         mStandardTrustManager.checkClientTrusted(certificates, authType);
  89     }
  90
  91
  92     /**
  93      * @see javax.net.ssl.X509TrustManager#checkServerTrusted(X509Certificate[],
  94      *      String authType)
  95      */
  96     public void checkServerTrusted(X509Certificate[] certificates, String authType) throws CertificateException {
  97         if (!isKnownServer(certificates[0])) {
  98                 CertificateCombinedException result = new CertificateCombinedException(certificates[0]);
  99                 try {
 100                         certificates[0].checkValidity();
 101                 } catch (CertificateExpiredException c) {
 102                         result.setCertificateExpiredException(c);
 103
 104                 } catch (CertificateNotYetValidException c) {
 105                 result.setCertificateNotYetException(c);
 106                 }
 107
 108                 try {
 109                     mStandardTrustManager.checkServerTrusted(certificates, authType);
 110                 } catch (CertificateException c) {
 111                 Throwable cause = c.getCause();
 112                 Throwable previousCause = null;
 113                 while (cause != null && cause != previousCause && !(cause instanceof CertPathValidatorException)) {     // getCause() is not funny
 114                     previousCause = cause;
 115                     cause = cause.getCause();
 116                 }
 117                 if (cause != null && cause instanceof CertPathValidatorException) {
 118                         result.setCertPathValidatorException((CertPathValidatorException)cause);
 119                 } else {
 120                         result.setOtherCertificateException(c);
 121                 }
 122                 }
 123
 124                 if (result.isException())
 125                         throw result;
 126
 127         }
 128     }
 129
 130
 131     /**
 132      * @see javax.net.ssl.X509TrustManager#getAcceptedIssuers()
 133      */
 134     public X509Certificate[] getAcceptedIssuers() {
 135         return mStandardTrustManager.getAcceptedIssuers();
 136     }
 137
 138
 139     public boolean isKnownServer(X509Certificate cert) {
 140         try {
 141             return (mKnownServersKeyStore.getCertificateAlias(cert) != null);
 142         } catch (KeyStoreException e) {
 143             Log_OC.d(TAG, "Fail while checking certificate in the known-servers store");
 144             return false;
 145         }
 146     }
 147
 148 }