* See the "jdk.certpath.disabledAlgorithms" specification in java.security * for the syntax of the disabled algorithm string. */ final class SSLAlgorithmConstraints implements AlgorithmConstraints { public enum SIGNATURE_CONSTRAINTS_MODE { PEER, // Check against peer supported signatures LOCAL // Check against local supported signatures } private static final DisabledAlgorithmConstraints tlsDisabledAlgConstraints = new DisabledAlgorithmConstraints(PROPERTY_TLS_DISABLED_ALGS, new SSLAlgorithmDecomposer()); private static final DisabledAlgorithmConstraints x509DisabledAlgConstraints = new DisabledAlgorithmConstraints(PROPERTY_CERTPATH_DISABLED_ALGS, new SSLAlgorithmDecomposer(true)); private final AlgorithmConstraints userSpecifiedConstraints; private final AlgorithmConstraints peerSpecifiedConstraints; private final boolean enabledX509DisabledAlgConstraints; // the default algorithm constraints static final SSLAlgorithmConstraints DEFAULT = new SSLAlgorithmConstraints(null, true); // the default SSL only algorithm constraints static final SSLAlgorithmConstraints DEFAULT_SSL_ONLY = new SSLAlgorithmConstraints(null, false); private SSLAlgorithmConstraints( AlgorithmConstraints userSpecifiedConstraints, boolean enabledX509DisabledAlgConstraints) { this(userSpecifiedConstraints, null, enabledX509DisabledAlgConstraints); } private SSLAlgorithmConstraints( AlgorithmConstraints userSpecifiedConstraints, SupportedSignatureAlgorithmConstraints peerSpecifiedConstraints, boolean withDefaultCertPathConstraints) { this.userSpecifiedConstraints = userSpecifiedConstraints; this.peerSpecifiedConstraints = peerSpecifiedConstraints; this.enabledX509DisabledAlgConstraints = withDefaultCertPathConstraints; } /** * Returns a SSLAlgorithmConstraints instance that checks the provided * {@code userSpecifiedConstraints} in addition to standard checks. * Returns a singleton instance if parameter is null or DEFAULT. * * @param userSpecifiedConstraints additional constraints to check * @return a SSLAlgorithmConstraints instance */ static SSLAlgorithmConstraints wrap( AlgorithmConstraints userSpecifiedConstraints) { return wrap(userSpecifiedConstraints, true); } private static SSLAlgorithmConstraints wrap( AlgorithmConstraints userSpecifiedConstraints, boolean withDefaultCertPathConstraints) { if (nullIfDefault(userSpecifiedConstraints) == null) { return withDefaultCertPathConstraints ? DEFAULT : DEFAULT_SSL_ONLY; } return new SSLAlgorithmConstraints(userSpecifiedConstraints, withDefaultCertPathConstraints); } /** * Returns a SSLAlgorithmConstraints instance that checks the constraints * configured for the given {@code socket} in addition to standard checks. * Returns a singleton instance if the constraints are null or DEFAULT. * * @param socket socket with configured constraints * @param mode SIGNATURE_CONSTRAINTS_MODE * @return a SSLAlgorithmConstraints instance */ static SSLAlgorithmConstraints forSocket( SSLSocket socket, SIGNATURE_CONSTRAINTS_MODE mode, boolean withDefaultCertPathConstraints) { if (socket == null) { return wrap(null, withDefaultCertPathConstraints); } return new SSLAlgorithmConstraints( nullIfDefault(getUserSpecifiedConstraints(socket)), new SupportedSignatureAlgorithmConstraints( socket.getHandshakeSession(), mode), withDefaultCertPathConstraints); } /** * Returns a SSLAlgorithmConstraints instance that checks the constraints * configured for the given {@code engine} in addition to standard checks. * Returns a singleton instance if the constraints are null or DEFAULT. * * @param engine engine with configured constraints * @param mode SIGNATURE_CONSTRAINTS_MODE * @return a SSLAlgorithmConstraints instance */ static SSLAlgorithmConstraints forEngine( SSLEngine engine, SIGNATURE_CONSTRAINTS_MODE mode, boolean withDefaultCertPathConstraints) { if (engine == null) { return wrap(null, withDefaultCertPathConstraints); } return new SSLAlgorithmConstraints( nullIfDefault(getUserSpecifiedConstraints(engine)), new SupportedSignatureAlgorithmConstraints( engine.getHandshakeSession(), mode), withDefaultCertPathConstraints); } /** * Returns an {@link AlgorithmConstraints} instance that uses the * constraints configured for the given {@code engine} in addition * to the platform configured constraints. *
* If the given {@code allowedAlgorithms} is non-null then the returned
* {@code AlgorithmConstraints} will only permit those allowed algorithms.
*
* @param engine QuicTLSEngine used to determine the constraints
* @param mode SIGNATURE_CONSTRAINTS_MODE
* @param withDefaultCertPathConstraints whether or not to apply the default certpath
* algorithm constraints too
* @return a AlgorithmConstraints instance
*/
static AlgorithmConstraints forQUIC(QuicTLSEngine engine,
SIGNATURE_CONSTRAINTS_MODE mode,
boolean withDefaultCertPathConstraints) {
if (engine == null) {
return wrap(null, withDefaultCertPathConstraints);
}
return new SSLAlgorithmConstraints(
nullIfDefault(getUserSpecifiedConstraints(engine)),
new SupportedSignatureAlgorithmConstraints(engine.getHandshakeSession(), mode),
withDefaultCertPathConstraints);
}
private static AlgorithmConstraints nullIfDefault(
AlgorithmConstraints constraints) {
return constraints == DEFAULT ? null : constraints;
}
private static AlgorithmConstraints getUserSpecifiedConstraints(
SSLEngine engine) {
if (engine != null) {
// Note that the KeyManager or TrustManager implementation may be
// not implemented in the same provider as SSLSocket/SSLEngine.
// Please check the instance before casting to use SSLEngineImpl.
if (engine instanceof SSLEngineImpl) {
HandshakeContext hc =
((SSLEngineImpl) engine).conContext.handshakeContext;
if (hc != null) {
return hc.sslConfig.userSpecifiedAlgorithmConstraints;
}
}
return engine.getSSLParameters().getAlgorithmConstraints();
}
return null;
}
private static AlgorithmConstraints getUserSpecifiedConstraints(
SSLSocket socket) {
if (socket != null) {
// Note that the KeyManager or TrustManager implementation may be
// not implemented in the same provider as SSLSocket/SSLEngine.
// Please check the instance before casting to use SSLSocketImpl.
if (socket instanceof SSLSocketImpl) {
HandshakeContext hc =
((SSLSocketImpl) socket).conContext.handshakeContext;
if (hc != null) {
return hc.sslConfig.userSpecifiedAlgorithmConstraints;
}
}
return socket.getSSLParameters().getAlgorithmConstraints();
}
return null;
}
private static AlgorithmConstraints getUserSpecifiedConstraints(
QuicTLSEngine quicEngine) {
if (quicEngine != null) {
if (quicEngine instanceof QuicTLSEngineImpl engineImpl) {
return engineImpl.getAlgorithmConstraints();
}
return quicEngine.getSSLParameters().getAlgorithmConstraints();
}
return null;
}
@Override
public boolean permits(Set