001/** 002 * 003 * Copyright 2015-2016 Florian Schmaus 004 * 005 * Licensed under the Apache License, Version 2.0 (the "License"); 006 * you may not use this file except in compliance with the License. 007 * You may obtain a copy of the License at 008 * 009 * http://www.apache.org/licenses/LICENSE-2.0 010 * 011 * Unless required by applicable law or agreed to in writing, software 012 * distributed under the License is distributed on an "AS IS" BASIS, 013 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 014 * See the License for the specific language governing permissions and 015 * limitations under the License. 016 */ 017package org.jivesoftware.smack.util.dns.minidns; 018 019import java.io.IOException; 020import java.security.KeyManagementException; 021import java.security.SecureRandom; 022import java.security.cert.CertificateException; 023import java.util.logging.Level; 024import java.util.logging.Logger; 025 026import javax.net.ssl.KeyManager; 027import javax.net.ssl.SSLContext; 028import javax.net.ssl.SSLSocket; 029import javax.net.ssl.TrustManager; 030import javax.net.ssl.X509TrustManager; 031 032import org.jivesoftware.smack.util.dns.SmackDaneVerifier; 033 034import org.minidns.dane.DaneVerifier; 035import org.minidns.dane.ExpectingTrustManager; 036 037public class MiniDnsDaneVerifier implements SmackDaneVerifier { 038 private static final Logger LOGGER = Logger.getLogger(MiniDnsDaneVerifier.class.getName()); 039 040 private static final DaneVerifier VERIFIER = new DaneVerifier(); 041 042 private ExpectingTrustManager expectingTrustManager; 043 044 // Package protected constructor. Use MiniDnsDane.newInstance() to create the verifier. 045 MiniDnsDaneVerifier() { 046 } 047 048 @Override 049 public void init(SSLContext context, KeyManager[] km, X509TrustManager tm, SecureRandom random) throws KeyManagementException { 050 if (expectingTrustManager != null) { 051 throw new IllegalStateException("DaneProvider was initialized before. Use newInstance() instead."); 052 } 053 expectingTrustManager = new ExpectingTrustManager(tm); 054 context.init(km, new TrustManager[] {expectingTrustManager}, random); 055 } 056 057 @Override 058 public void finish(SSLSocket sslSocket) throws CertificateException { 059 if (VERIFIER.verify(sslSocket)) { 060 // DANE verification was the only requirement according to the TLSA RR. We can return here. 061 return; 062 } 063 064 // DANE verification was successful, but according to the TLSA RR we also must perform PKIX validation. 065 if (expectingTrustManager.hasException()) { 066 // PKIX validation has failed. Throw an exception but close the socket first. 067 try { 068 sslSocket.close(); 069 } catch (IOException e) { 070 LOGGER.log(Level.FINER, "Closing TLS socket failed", e); 071 } 072 throw expectingTrustManager.getException(); 073 } 074 } 075 076}