import org.globus.gsi.TrustedCertificates; //导入依赖的package包/类
protected X509Certificate getCaCert(X509Certificate userCert) throws InvalidSecurityContextException {
    TrustedCertificates tc = TrustedCertificates.getDefaultTrustedCertificates();
        
    X509Certificate caCert = tc.getCertificate(userCert.getIssuerDN().getName());
    if (caCert == null) {
        logger.warn("Cannot find root CA certificate for proxy");
        logger.warn("DNs of trusted certificates:");
        X509Certificate[] roots = tc.getCertificates();
        for (X509Certificate root : roots) {
            logger.warn("\t" + root.getSubjectDN());
        }
        throw new InvalidSecurityContextException("Failed to find root CA certificate (" + userCert.getIssuerDN().getName() + ")");
    }
    else {
        return caCert;
    }
}
 

import org.globus.gsi.TrustedCertificates; //导入依赖的package包/类
public void setCertList(String certList) {
certificates = new Vector();
if (certList == null) return;
StringTokenizer tokens = new StringTokenizer(certList, ",");	
File certFile;
while(tokens.hasMoreTokens()) {
    certFile = new File(tokens.nextToken().trim());
    
    if (certFile.isDirectory()) {
	File[] caCertFiles = 
	    certFile.listFiles(TrustedCertificates.getCertFilter());
	for (int i=0;i<caCertFiles.length;i++) {
	    loadCert(caCertFiles[i].getAbsolutePath());
	}
    } else {
	loadCert(certFile.getAbsolutePath());
    }
}
   }
 

import org.globus.gsi.TrustedCertificates; //导入依赖的package包/类
public void testNoBasicConstraintsExtension() throws Exception {
X509Certificate [] chain = null;
// EEC, EEC, CA - that should fail
chain = new X509Certificate[] {goodCertsArr[1], goodCertsArr[1], goodCertsArr[0]};
validateChain(chain);

TestProxyPathValidator v = new TestProxyPathValidator();
TrustedCertificates trustedCert =
    new TrustedCertificates(new X509Certificate[] {goodCertsArr[1]});

// this makes the PathValidator think the chain is:
// CA, CA, CA - which is ok
try {
    v.validate(chain, trustedCert);
} catch (ProxyPathValidatorException e) {
    e.printStackTrace();
    fail("Unexpected exception: " + e.getMessage());
}
   }
 

import org.globus.gsi.TrustedCertificates; //导入依赖的package包/类
protected void setTrustedCertificates(Object value) 
    throws GSSException {
    if (!(value instanceof TrustedCertificates)) {
        throw new GlobusGSSException(GSSException.FAILURE,
                                     GlobusGSSException.BAD_OPTION_TYPE,
                                     "badType",
                                     new Object[] {"Trusted certificates", 
                                                   TrustedCertificates.class});
    }
    this.tc = (TrustedCertificates)value;
}
 

import org.globus.gsi.TrustedCertificates; //导入依赖的package包/类
public static synchronized PureTLSTrustedCertificates 
getDefaultPureTLSTrustedCertificates() {
if (ptlsCerts == null) {
    ptlsCerts = new PureTLSTrustedCertificates();
}
ptlsCerts.setTrustedCertificates(TrustedCertificates.getDefault());
return ptlsCerts;
   }
 

import org.globus.gsi.TrustedCertificates; //导入依赖的package包/类
public void testGetCertificateType3() throws Exception {
X509Certificate cert = getCertificate(1);
int type = Integer.parseInt(ProxyPathValidatorTest.certs[1][0]);
assertEquals(GSIConstants.EEC, BouncyCastleUtil.getCertificateType(cert));

TrustedCertificates trustedCerts =
    new TrustedCertificates(new X509Certificate[] {cert});

assertEquals(GSIConstants.CA, BouncyCastleUtil.getCertificateType(cert, trustedCerts));
   }
 

import org.globus.gsi.TrustedCertificates; //导入依赖的package包/类
private X509Certificate[] loadTrustedCerts() {
	X509Certificate[] trustedCerts;
	String trustStoreLocation = getTrustStorePath();
	if (trustStoreLocation != null && trustStoreLocation.length() != 0) {
		trustedCerts = TrustedCertificates
				.loadCertificates(trustStoreLocation);
	} else {
		trustedCerts = TrustedCertificates.getDefaultTrustedCertificates()
				.getCertificates();
	}
	return trustedCerts;
}
 

import org.globus.gsi.TrustedCertificates; //导入依赖的package包/类
private GlobusCredential getDelegatedCredentialAndValidate(
		DelegatedCredentialManager dcm, String gridIdentity,
		DelegationIdentifier id, CertificateChain chain) throws Exception {
	X509Certificate[] signingChain = org.cagrid.gaards.cds.common.Utils
			.toCertificateArray(chain);
	KeyPair pair = KeyUtil.generateRSAKeyPair1024();
	org.cagrid.gaards.cds.common.PublicKey pKey = new org.cagrid.gaards.cds.common.PublicKey();
	pKey.setKeyAsString(KeyUtil.writePublicKey(pair.getPublic()));
	X509Certificate[] delegatedProxy = org.cagrid.gaards.cds.common.Utils
			.toCertificateArray(dcm.getDelegatedCredential(GRID_IDENTITY,
					id, pKey));
	assertNotNull(delegatedProxy);
	assertEquals(delegatedProxy.length, (signingChain.length + 1));
	for (int i = 0; i < signingChain.length; i++) {
		assertEquals(signingChain[i], delegatedProxy[i + 1]);
	}

	ProxyPathValidator validator = new ProxyPathValidator();
	validator.validate(delegatedProxy, TrustedCertificates
			.getDefaultTrustedCertificates().getCertificates(),
			CertificateRevocationLists
					.getDefaultCertificateRevocationLists());

	DelegatedCredentialAuditRecord[] ar = dcm.searchAuditLog(Utils
			.getIssuedAuditFilter(id));
	assertEquals(1, ar.length);
	assertEquals(id, ar[0].getDelegationIdentifier());
	assertEquals(GRID_IDENTITY, ar[0].getSourceGridIdentity());
	assertEquals(DelegatedCredentialEvent.DelegatedCredentialIssued, ar[0]
			.getEvent());

	return new GlobusCredential(pair.getPrivate(), delegatedProxy);
}
 

import org.globus.gsi.TrustedCertificates; //导入依赖的package包/类
private GlobusCredential getDelegatedCredentialAndValidate(
		DelegatedCredentialManager dcm, String gridIdentity,
		DelegationIdentifier id, CertificateChain chain) throws Exception {
	X509Certificate[] signingChain = org.cagrid.cds.service.impl.util.Utils
			.toCertificateArray(chain);
	KeyPair pair = KeyUtil.generateRSAKeyPair1024();
       org.cagrid.cds.model.PublicKey pKey = new org.cagrid.cds.model.PublicKey();
	pKey.setKeyAsString(KeyUtil.writePublicKey(pair.getPublic()));
	X509Certificate[] delegatedProxy = org.cagrid.cds.service.impl.util.Utils
			.toCertificateArray(dcm.getDelegatedCredential(GRID_IDENTITY,
					id, pKey));
	assertNotNull(delegatedProxy);
	assertEquals(delegatedProxy.length, (signingChain.length + 1));
	for (int i = 0; i < signingChain.length; i++) {
		assertEquals(signingChain[i], delegatedProxy[i + 1]);
	}

	ProxyPathValidator validator = new ProxyPathValidator();
	validator.validate(delegatedProxy, TrustedCertificates
			.getDefaultTrustedCertificates().getCertificates(),
			CertificateRevocationLists
					.getDefaultCertificateRevocationLists());

	List<DelegatedCredentialAuditRecord> ar = dcm.searchAuditLog(Utils
			.getIssuedAuditFilter(id));
	assertEquals(1, ar.size());
	assertEquals(id, ar.get(0).getDelegationIdentifier());
	assertEquals(GRID_IDENTITY, ar.get(0).getSourceGridIdentity());
	assertEquals(DelegatedCredentialEvent.DELEGATED_CREDENTIAL_ISSUED, ar.get(0)
			.getEvent());

	return new GlobusCredential(pair.getPrivate(), delegatedProxy);
}
 

import org.globus.gsi.TrustedCertificates; //导入依赖的package包/类
public static void validateCertificateChain(X509Certificate[] chain)
		throws ProxyPathValidatorException {
	ProxyPathValidator validator = new ProxyPathValidator();
	validator.validate(chain, TrustedCertificates
			.getDefaultTrustedCertificates().getCertificates(),
			CertificateRevocationLists
					.getDefaultCertificateRevocationLists());

}
 

import org.globus.gsi.TrustedCertificates; //导入依赖的package包/类
protected SigningPolicy getSigningPolicy(X509Certificate userCert) {
    TrustedCertificates tc = TrustedCertificates.getDefaultTrustedCertificates();
    return tc.getSigningPolicy('/' + userCert.getIssuerDN().getName().replace(',', '/'));
}
 

import org.globus.gsi.TrustedCertificates; //导入依赖的package包/类
public void validate(X509Certificate [] certPath,
                     TrustedCertificates trustedCerts,
                     CertificateRevocationLists crlsList)
    throws ProxyPathValidatorException {
    super.validate(certPath, trustedCerts, crlsList);
}
 

import org.globus.gsi.TrustedCertificates; //导入依赖的package包/类
public PureTLSTrustedCertificates(TrustedCertificates tc) {
this.tc = tc;
   }
 

import org.globus.gsi.TrustedCertificates; //导入依赖的package包/类
protected void setTrustedCertificates(TrustedCertificates tc) {
this.tc = tc;
   }
 

import org.globus.gsi.TrustedCertificates; //导入依赖的package包/类
/**
    * Returns certificate type of the given certificate. 
    * This function calls {@link #getCertificateType(TBSCertificateStructure) 
    * getCertificateType} to get the certificate type. In case
    * the certificate type was initially determined as 
    * {@link GSIConstants#EEC GSIConstants.EEC} it is checked
    * against the trusted certificate list to see if it really
    * is a CA certificate. If the certificate is present in the
    * trusted certificate list the certificate type is changed
    * to {@link GSIConstants#CA GSIConstants.CA}. Otherwise, it is
    * left as it is (This is useful in cases where a valid CA
    * certificate does not have a BasicConstraints extension)
    *
    * @param crt the certificate to get the type of.
    * @param trustedCerts the trusted certificates to double check the 
    *                     {@link GSIConstants#EEC GSIConstants.EEC} 
    *                     certificate against. If null, a default
    *                     set of trusted certificate will be loaded
    *                     from a standard location.
    * @return the certificate type. The certificate type is determined
    *         by rules described above.
    * @exception IOException if something goes wrong.
    * @exception CertificateException for proxy certificates, if 
    *            the issuer DN of the certificate does not match
    *            the subject DN of the certificate without the
    *            last <I>CN</I> component. Also, for GSI-3 proxies
    *            when the <code>ProxyCertInfo</code> extension is 
    *            not marked as critical.
    */
   public static int getCertificateType(TBSCertificateStructure crt,
				 TrustedCertificates trustedCerts) 
throws CertificateException, IOException {
int type = getCertificateType(crt);

// check subject of the cert in trusted cert list
// to make sure the cert is not a ca cert
if (type == GSIConstants.EEC) {
    if (trustedCerts == null) {
	trustedCerts = 
	    TrustedCertificates.getDefaultTrustedCertificates();
    } 
    if (trustedCerts != null && 
	trustedCerts.getCertificate(crt.getSubject().toString()) != null) {
	type = GSIConstants.CA;
    }
}

return type;
   }
 

import org.globus.gsi.TrustedCertificates; //导入依赖的package包/类
protected void checkCRL(X509Certificate cert, 
		    CertificateRevocationLists crlsList, 
		    TrustedCertificates trustedCerts) 
throws ProxyPathValidatorException {
if (crlsList == null) {
    return;
}

logger.debug("checkCRLs: enter");
// Should not happen, just a sanity check.
if (trustedCerts == null) {
    String err = "Trusted certificates are null, cannot verify CRLs";
    logger.error(err);
    throw new ProxyPathValidatorException(
		ProxyPathValidatorException.FAILURE, null, err);
}

String issuerName = cert.getIssuerDN().getName();
X509CRL crl = crlsList.getCrl(issuerName);
if (crl == null) {
    logger.debug("No CRL for certificate");
    return;
}

// get CA cert for the CRL
X509Certificate x509Cert = 
    trustedCerts.getCertificate(issuerName);
if (x509Cert == null) {
    // if there is no trusted certs from that CA, then
    // the chain cannot contain a cert from that CA,
    // which implies not checking this CRL should be fine.
    logger.debug("No trusted cert with this CA signature");
    return;
}

// validate CRL
try {
    crl.verify(x509Cert.getPublicKey());
} catch (Exception exp) {
    logger.error("CRL verification failed");
    throw new ProxyPathValidatorException(
		    ProxyPathValidatorException.FAILURE, exp);
}

Date now = new Date();
//check date validity of CRL
if ((crl.getThisUpdate().before(now)) ||
    ((crl.getNextUpdate()!=null) && 
     (crl.getNextUpdate().after(now)))) {
    if (crl.isRevoked(cert)) {
	throw new ProxyPathValidatorException(
			      ProxyPathValidatorException.REVOKED, 
			      cert, "This cert " 
			      + cert.getSubjectDN().getName() 
			      + " is on a CRL");
    }
}

logger.debug("checkCRLs: exit");
   }
 

import org.globus.gsi.TrustedCertificates; //导入依赖的package包/类
public void validate(X509Certificate [] certPath,
		     TrustedCertificates trustedCerts) 
    throws ProxyPathValidatorException {
    super.validate(certPath, trustedCerts);
}
 

import org.globus.gsi.TrustedCertificates; //导入依赖的package包/类
protected void checkCRL(X509Certificate cert, CertificateRevocationLists crlsList, TrustedCertificates trustedCerts)
	throws ProxyPathValidatorException {
	if (crlsList == null) {
		return;
	}

	logger.debug("checkCRLs: enter");
	// Should not happen, just a sanity check.
	if (trustedCerts == null) {
		String err = "Trusted certificates are null, cannot verify CRLs";
		logger.error(err);
		throw new ProxyPathValidatorException(ProxyPathValidatorException.FAILURE, null, err);
	}

	String issuerName = cert.getIssuerDN().getName();
	X509CRL crl = crlsList.getCrl(issuerName);
	if (crl == null) {
		logger.debug("No CRL for certificate");
		return;
	}

	// get CA cert for the CRL
	X509Certificate x509Cert = trustedCerts.getCertificate(issuerName);
	if (x509Cert == null) {
		// if there is no trusted certs from that CA, then
		// the chain cannot contain a cert from that CA,
		// which implies not checking this CRL should be fine.
		logger.debug("No trusted cert with this CA signature");
		return;
	}

	// validate CRL
	try {
		crl.verify(x509Cert.getPublicKey());
	} catch (Exception exp) {
		logger.error("CRL verification failed");
		throw new ProxyPathValidatorException(ProxyPathValidatorException.FAILURE, exp);
	}

	Date now = new Date();
	// check date validity of CRL
	if ((crl.getThisUpdate().before(now)) || ((crl.getNextUpdate() != null) && (crl.getNextUpdate().after(now)))) {
		if (crl.isRevoked(cert)) {
			throw new ProxyPathValidatorException(ProxyPathValidatorException.REVOKED, cert, "This cert "
				+ cert.getSubjectDN().getName() + " is on a CRL");
		}
	}

	logger.debug("checkCRLs: exit");
}
 

import org.globus.gsi.TrustedCertificates; //导入依赖的package包/类
public static void validateCertificateChain(X509Certificate[] chain) throws ProxyPathValidatorException {
    ProxyPathValidator validator = new ProxyPathValidator();
    validator.validate(chain, TrustedCertificates.getDefaultTrustedCertificates().getCertificates(),
        CertificateRevocationLists.getDefaultCertificateRevocationLists());

}
 

import org.globus.gsi.TrustedCertificates; //导入依赖的package包/类
/**
    * Performs certificate path validation. Does <B>not</B> check
    * the cert signatures but it performs all other checks like 
    * the extension checking, validity checking, restricted policy
    * checking, CRL checking, etc.
    * 
    * @param certPath the certificate path to validate.
    * @exception ProxyPathValidatorException if certificate
    *            path validation fails.
    */
   protected void validate(X509Certificate [] certPath) 
throws ProxyPathValidatorException {
validate(certPath, 
	 (TrustedCertificates)null, 
	 (CertificateRevocationLists)null);
   }