FingerprintTrustManagerFactory Class — netty Architecture

Source Code

handler/src/main/java/io/netty/handler/ssl/util/FingerprintTrustManagerFactory.java lines 82–267

public final class FingerprintTrustManagerFactory extends SimpleTrustManagerFactory {

    private static final Pattern FINGERPRINT_PATTERN = Pattern.compile("^[0-9a-fA-F:]+$");
    private static final Pattern FINGERPRINT_STRIP_PATTERN = Pattern.compile(":");

    /**
     * Creates a builder for {@link FingerprintTrustManagerFactory}.
     *
     * @param algorithm a hash algorithm
     * @return a builder
     */
    public static FingerprintTrustManagerFactoryBuilder builder(String algorithm) {
        return new FingerprintTrustManagerFactoryBuilder(algorithm);
    }

    private final FastThreadLocal<MessageDigest> tlmd;

    private final TrustManager tm = new X509TrustManager() {

        @Override
        public void checkClientTrusted(X509Certificate[] chain, String s) throws CertificateException {
            checkTrusted("client", chain);
        }

        @Override
        public void checkServerTrusted(X509Certificate[] chain, String s) throws CertificateException {
            checkTrusted("server", chain);
        }

        private void checkTrusted(String type, X509Certificate[] chain) throws CertificateException {
            X509Certificate cert = chain[0];
            byte[] fingerprint = fingerprint(cert);
            boolean found = false;
            for (byte[] allowedFingerprint: fingerprints) {
                if (Arrays.equals(fingerprint, allowedFingerprint)) {
                    found = true;
                    break;
                }
            }

            if (!found) {
                throw new CertificateException(
                        type + " certificate with unknown fingerprint: " + cert.getSubjectDN());
            }
        }

        private byte[] fingerprint(X509Certificate cert) throws CertificateEncodingException {
            MessageDigest md = tlmd.get();
            md.reset();
            return md.digest(cert.getEncoded());
        }

        @Override
        public X509Certificate[] getAcceptedIssuers() {
            return EmptyArrays.EMPTY_X509_CERTIFICATES;
        }
    };

    private final byte[][] fingerprints;

    /**
     * Creates a new instance.
     *
     * @deprecated This deprecated constructor uses SHA-1 that is considered insecure.
     *      It is recommended to specify a stronger hash algorithm, such as SHA-256,
     *      by calling {@link FingerprintTrustManagerFactory#builder(String)} method.
     *
     * @param fingerprints a list of SHA1 fingerprints in hexadecimal form
     */
    @Deprecated
    public FingerprintTrustManagerFactory(Iterable<String> fingerprints) {
        this("SHA1", toFingerprintArray(fingerprints));
    }

    /**
     * Creates a new instance.
     *
     * @deprecated This deprecated constructor uses SHA-1 that is considered insecure.
     *      It is recommended to specify a stronger hash algorithm, such as SHA-256,
     *      by calling {@link FingerprintTrustManagerFactory#builder(String)} method.
     *