eu.emi.security.authn.x509.impl
Class AbstractHostnameToCertificateChecker

java.lang.Object
  extended by eu.emi.security.authn.x509.impl.AbstractHostnameToCertificateChecker
All Implemented Interfaces:
EventListener, HandshakeCompletedListener

public abstract class AbstractHostnameToCertificateChecker
extends Object
implements HandshakeCompletedListener

Abstract implementation of the JSSE HandshakeCompletedListener which can be registered on a SSLSocket to verify if a peer's host name matches a DN of its certificate. It is useful on client side when connecting to a server.

By default the implementation checks the certificate's Subject Alternative Name and Common Name, following the server identity part of RFC 2818. Additionally the 'service/hostname' syntax is supported (the service prefix is simply ignored).

If there is a name mismatch the nameMismatch() method is called. User of this class must extend it and provide the application specific reaction in this method.

Note that this class should be used only on SSL connections which are authenticated with X.509 certificates.

Author:
Joni Hahkala, K. Benedyczak

Nested Class Summary
protected static class AbstractHostnameToCertificateChecker.ResultWrapper
           
 
Constructor Summary
AbstractHostnameToCertificateChecker()
           
 
Method Summary
protected  boolean checkAltNameMatching(AbstractHostnameToCertificateChecker.ResultWrapper result, String hostname, X509Certificate certificate)
           
protected  boolean checkCNMatching(String hostname, X509Certificate certificate)
           
 boolean checkMatching(String hostname, X509Certificate certificate)
           
 String getMostSpecificCN(X500Principal srcP)
           
 void handshakeCompleted(HandshakeCompletedEvent hce)
           
static String makeRegexpHostWildcard(String pattern)
          Converts hostname wildcard string to Java regexp, ensuring that literal sequences are correctly escaped.
protected static boolean matchesDNS(String hostname, String pattern)
           
protected  boolean matchesIP(String what, String pattern)
           
protected abstract  void nameMismatch(HandshakeCompletedEvent hce, X509Certificate peerCertificate, String hostName)
          This method is called whenever peer's host name is not matching the peer's certificate DN.
protected  void processingError(HandshakeCompletedEvent hce, Exception e)
          This method is called whenever there is an error when processing the peer's certificate and hostname.
 
Methods inherited from class java.lang.Object
clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait
 

Constructor Detail

AbstractHostnameToCertificateChecker

public AbstractHostnameToCertificateChecker()
Method Detail

handshakeCompleted

public void handshakeCompleted(HandshakeCompletedEvent hce)
Specified by:
handshakeCompleted in interface HandshakeCompletedListener

nameMismatch

protected abstract void nameMismatch(HandshakeCompletedEvent hce,
                                     X509Certificate peerCertificate,
                                     String hostName)
This method is called whenever peer's host name is not matching the peer's certificate DN.

Parameters:
hce - the original event object
peerCertificate - peer's certificate (for convenience)
hostName - peer's host name (for convenience)

processingError

protected void processingError(HandshakeCompletedEvent hce,
                               Exception e)
This method is called whenever there is an error when processing the peer's certificate and hostname. Generally it should never happen, and the implementation should simply close the socket and report the error. The default implementation simply throws an IllegalStateException.

Parameters:
hce - the original event object
e - error

checkMatching

public boolean checkMatching(String hostname,
                             X509Certificate certificate)
                      throws CertificateParsingException,
                             UnknownHostException
Throws:
CertificateParsingException
UnknownHostException

checkAltNameMatching

protected boolean checkAltNameMatching(AbstractHostnameToCertificateChecker.ResultWrapper result,
                                       String hostname,
                                       X509Certificate certificate)
                                throws CertificateParsingException,
                                       UnknownHostException
Returns:
true iff a dNSName in altName was found (not if the matching was successful) RFC is unclear whether IP AltName presence is also taking the precedence over CN so we are not enforcing such a rule.
Throws:
CertificateParsingException
UnknownHostException

checkCNMatching

protected boolean checkCNMatching(String hostname,
                                  X509Certificate certificate)
Returns:
true if a CN was found and the matching was successful ;-)

matchesDNS

protected static boolean matchesDNS(String hostname,
                                    String pattern)

makeRegexpHostWildcard

public static String makeRegexpHostWildcard(String pattern)
Converts hostname wildcard string to Java regexp, ensuring that literal sequences are correctly escaped.

Parameters:
pattern - hostname wildcard
Returns:
Java regular expression

matchesIP

protected boolean matchesIP(String what,
                            String pattern)
                     throws UnknownHostException
Throws:
UnknownHostException

getMostSpecificCN

public String getMostSpecificCN(X500Principal srcP)


Copyright © 2012 European Middleware Initiative. All Rights Reserved.