src/com/owncloud/android/network/AdvancedX509TrustManager.java

   1 /* ownCloud Android client application
   2  *   Copyright (C) 2012-2013 ownCloud Inc.
   3  *
   4  *   This program is free software: you can redistribute it and/or modify
   5  *   it under the terms of the GNU General Public License version 2,
   6  *   as published by the Free Software Foundation.
   7  *
   8  *   This program is distributed in the hope that it will be useful,
   9  *   but WITHOUT ANY WARRANTY; without even the implied warranty of
  10  *   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  11  *   GNU General Public License for more details.
  12  *
  13  *   You should have received a copy of the GNU General Public License
  14  *   along with this program.  If not, see <http://www.gnu.org/licenses/>.
  15  *
  16  */
  17
  18 package com.owncloud.android.network;
  19
  20 import java.security.KeyStore;
  21 import java.security.KeyStoreException;
  22 import java.security.NoSuchAlgorithmException;
  23 import java.security.cert.CertPathValidatorException;
  24 import java.security.cert.CertStoreException;
  25 import java.security.cert.CertificateException;
  26 import java.security.cert.CertificateExpiredException;
  27 import java.security.cert.CertificateNotYetValidException;
  28 import java.security.cert.X509Certificate;
  29
  30 import javax.net.ssl.TrustManager;
  31 import javax.net.ssl.TrustManagerFactory;
  32 import javax.net.ssl.X509TrustManager;
  33
  34 import com.owncloud.android.Log_OC;
  35
  36 /**
  37  * @author David A. Velasco
  38  */
  39 public class AdvancedX509TrustManager implements X509TrustManager {
  40
  41     private static final String TAG = AdvancedX509TrustManager.class.getSimpleName();
  42
  43     private X509TrustManager mStandardTrustManager = null;
  44     private KeyStore mKnownServersKeyStore;
  45
  46     /**
  47      * Constructor for AdvancedX509TrustManager
  48      *
  49      * @param  knownServersCertStore    Local certificates store with server certificates explicitly trusted by the user.
  50      * @throws CertStoreException       When no default X509TrustManager instance was found in the system.
  51      */
  52     public AdvancedX509TrustManager(KeyStore knownServersKeyStore)
  53             throws NoSuchAlgorithmException, KeyStoreException, CertStoreException {
  54         super();
  55         TrustManagerFactory factory = TrustManagerFactory
  56                 .getInstance(TrustManagerFactory.getDefaultAlgorithm());
  57         factory.init((KeyStore)null);
  58         mStandardTrustManager = findX509TrustManager(factory);
  59
  60         mKnownServersKeyStore = knownServersKeyStore;
  61     }
  62
  63
  64     /**
  65      * Locates the first X509TrustManager provided by a given TrustManagerFactory
  66      * @param factory               TrustManagerFactory to inspect in the search for a X509TrustManager
  67      * @return                      The first X509TrustManager found in factory.
  68      * @throws CertStoreException   When no X509TrustManager instance was found in factory
  69      */
  70     private X509TrustManager findX509TrustManager(TrustManagerFactory factory) throws CertStoreException {
  71         TrustManager tms[] = factory.getTrustManagers();
  72         for (int i = 0; i < tms.length; i++) {
  73             if (tms[i] instanceof X509TrustManager) {
  74                 return (X509TrustManager) tms[i];
  75             }
  76         }
  77         return null;
  78     }
  79
  80
  81     /**
  82      * @see javax.net.ssl.X509TrustManager#checkClientTrusted(X509Certificate[],
  83      *      String authType)
  84      */
  85     public void checkClientTrusted(X509Certificate[] certificates, String authType) throws CertificateException {
  86         mStandardTrustManager.checkClientTrusted(certificates, authType);
  87     }
  88
  89
  90     /**
  91      * @see javax.net.ssl.X509TrustManager#checkServerTrusted(X509Certificate[],
  92      *      String authType)
  93      */
  94     public void checkServerTrusted(X509Certificate[] certificates, String authType) throws CertificateException {
  95         if (!isKnownServer(certificates[0])) {
  96                 CertificateCombinedException result = new CertificateCombinedException(certificates[0]);
  97                 try {
  98                         certificates[0].checkValidity();
  99                 } catch (CertificateExpiredException c) {
 100                         result.setCertificateExpiredException(c);
 101
 102                 } catch (CertificateNotYetValidException c) {
 103                 result.setCertificateNotYetException(c);
 104                 }
 105
 106                 try {
 107                     mStandardTrustManager.checkServerTrusted(certificates, authType);
 108                 } catch (CertificateException c) {
 109                 Throwable cause = c.getCause();
 110                 Throwable previousCause = null;
 111                 while (cause != null && cause != previousCause && !(cause instanceof CertPathValidatorException)) {     // getCause() is not funny
 112                     previousCause = cause;
 113                     cause = cause.getCause();
 114                 }
 115                 if (cause != null && cause instanceof CertPathValidatorException) {
 116                         result.setCertPathValidatorException((CertPathValidatorException)cause);
 117                 } else {
 118                         result.setOtherCertificateException(c);
 119                 }
 120                 }
 121
 122                 if (result.isException())
 123                         throw result;
 124
 125         }
 126     }
 127
 128
 129     /**
 130      * @see javax.net.ssl.X509TrustManager#getAcceptedIssuers()
 131      */
 132     public X509Certificate[] getAcceptedIssuers() {
 133         return mStandardTrustManager.getAcceptedIssuers();
 134     }
 135
 136
 137     public boolean isKnownServer(X509Certificate cert) {
 138         try {
 139             return (mKnownServersKeyStore.getCertificateAlias(cert) != null);
 140         } catch (KeyStoreException e) {
 141             Log_OC.d(TAG, "Fail while checking certificate in the known-servers store");
 142             return false;
 143         }
 144     }
 145
 146 }