001/*
002 * Copyright 2015-2024 the original author or authors
003 *
004 * This software is licensed under the Apache License, Version 2.0,
005 * the GNU Lesser General Public License version 2 or later ("LGPL")
006 * and the WTFPL.
007 * You may choose either license to govern your use of this software only
008 * upon the condition that you accept all of the terms of either
009 * the Apache License 2.0, the LGPL 2.1+ or the WTFPL.
010 */
011package org.minidns.dane;
012
013import java.security.cert.CertificateException;
014import java.util.Collections;
015import java.util.List;
016
017import org.minidns.dnssec.DnssecValidationFailedException;
018import org.minidns.record.TLSA;
019
020public abstract class DaneCertificateException extends CertificateException {
021
022    /**
023     * 
024     */
025    private static final long serialVersionUID = 1L;
026
027    protected DaneCertificateException() {
028    }
029
030    protected DaneCertificateException(String message) {
031        super(message);
032    }
033
034    protected DaneCertificateException(String message, Throwable cause) {
035        super(message, cause);
036    }
037
038    /**
039     * The DNSSEC validation of the TLSA response failed, i.e., the response is bogus (RFC 6698 ยง 4.1).
040     */
041    public static class DnssecValidationFailed extends DaneCertificateException {
042
043        /**
044         *
045         */
046        private static final long serialVersionUID = 1L;
047
048        public final DnssecValidationFailedException dnssecValidationFailedException;
049
050        public DnssecValidationFailed(DnssecValidationFailedException dnssecValidationFailedException) {
051            super("DNSSEC validation of the TLSA response failed", dnssecValidationFailedException);
052            this.dnssecValidationFailedException = dnssecValidationFailedException;
053        }
054    }
055
056    public static class CertificateMismatch extends DaneCertificateException {
057
058        /**
059         * 
060         */
061        private static final long serialVersionUID = 1L;
062
063        public final TLSA tlsa;
064        public final byte[] computed;
065
066        public CertificateMismatch(TLSA tlsa, byte[] computed) {
067            super("The TLSA RR does not match the certificate");
068            this.tlsa = tlsa;
069            this.computed = computed;
070        }
071    }
072
073    public static class MultipleCertificateMismatchExceptions extends DaneCertificateException {
074
075        /**
076         * 
077         */
078        private static final long serialVersionUID = 1L;
079
080        public final List<CertificateMismatch> certificateMismatchExceptions;
081
082        public MultipleCertificateMismatchExceptions(List<CertificateMismatch> certificateMismatchExceptions) {
083            super("There where multiple CertificateMismatch exceptions because none of the TLSA RR does match the certificate");
084            assert !certificateMismatchExceptions.isEmpty();
085            this.certificateMismatchExceptions = Collections.unmodifiableList(certificateMismatchExceptions);
086        }
087    }
088}