plan9-archive/inferno-java

java/pkg/java/security/cert/CRL.class+0−0

Binary file not shown.

java/pkg/java/security/cert/CRL.java+88−0

@@ -0,0 +1,88 @@
	1	/*
	2	* Copyright (c) 1998, 2006, Oracle and/or its affiliates. All rights reserved.
	3	* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
	4	*
	5	* This code is free software; you can redistribute it and/or modify it
	6	* under the terms of the GNU General Public License version 2 only, as
	7	* published by the Free Software Foundation. Oracle designates this
	8	* particular file as subject to the "Classpath" exception as provided
	9	* by Oracle in the LICENSE file that accompanied this code.
	10	*
	11	* This code is distributed in the hope that it will be useful, but WITHOUT
	12	* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
	13	* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
	14	* version 2 for more details (a copy is included in the LICENSE file that
	15	* accompanied this code).
	16	*
	17	* You should have received a copy of the GNU General Public License version
	18	* 2 along with this work; if not, write to the Free Software Foundation,
	19	* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
	20	*
	21	* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
	22	* or visit www.oracle.com if you need additional information or have any
	23	* questions.
	24	*/
	25
	26	package java.security.cert;
	27
	28	/**
	29	* This class is an abstraction of certificate revocation lists (CRLs) that
	30	* have different formats but important common uses. For example, all CRLs
	31	* share the functionality of listing revoked certificates, and can be queried
	32	* on whether or not they list a given certificate.
	33	* <p>
	34	* Specialized CRL types can be defined by subclassing off of this abstract
	35	* class.
	36	*
	37	* @author Hemma Prafullchandra
	38	*
	39	*
	40	* @see X509CRL
	41	* @see CertificateFactory
	42	*
	43	* @since 1.2
	44	*/
	45
	46	public abstract class CRL {
	47
	48	// the CRL type
	49	private String type;
	50
	51	/**
	52	* Creates a CRL of the specified type.
	53	*
	54	* @param type the standard name of the CRL type.
	55	* See Appendix A in the <a href=
	56	* "../../../../technotes/guides/security/crypto/CryptoSpec.html#AppA">
	57	* Java Cryptography Architecture API Specification & Reference </a>
	58	* for information about standard CRL types.
	59	*/
	60	protected CRL(String type) {
	61	this.type = type;
	62	}
	63
	64	/**
	65	* Returns the type of this CRL.
	66	*
	67	* @return the type of this CRL.
	68	*/
	69	public final String getType() {
	70	return this.type;
	71	}
	72
	73	/**
	74	* Returns a string representation of this CRL.
	75	*
	76	* @return a string representation of this CRL.
	77	*/
	78	public abstract String toString();
	79
	80	/**
	81	* Checks whether the given certificate is on this CRL.
	82	*
	83	* @param cert the certificate to check for.
	84	* @return true if the given certificate is on this CRL,
	85	* false otherwise.
	86	*/
	87	public abstract boolean isRevoked(Certificate cert);
	88	}

java/pkg/java/security/cert/CRLException.class+0−0

Binary file not shown.

java/pkg/java/security/cert/CRLException.java+88−0

@@ -0,0 +1,88 @@
	1	/*
	2	* Copyright (c) 1997, 2003, Oracle and/or its affiliates. All rights reserved.
	3	* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
	4	*
	5	* This code is free software; you can redistribute it and/or modify it
	6	* under the terms of the GNU General Public License version 2 only, as
	7	* published by the Free Software Foundation. Oracle designates this
	8	* particular file as subject to the "Classpath" exception as provided
	9	* by Oracle in the LICENSE file that accompanied this code.
	10	*
	11	* This code is distributed in the hope that it will be useful, but WITHOUT
	12	* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
	13	* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
	14	* version 2 for more details (a copy is included in the LICENSE file that
	15	* accompanied this code).
	16	*
	17	* You should have received a copy of the GNU General Public License version
	18	* 2 along with this work; if not, write to the Free Software Foundation,
	19	* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
	20	*
	21	* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
	22	* or visit www.oracle.com if you need additional information or have any
	23	* questions.
	24	*/
	25
	26	package java.security.cert;
	27
	28	import java.security.GeneralSecurityException;
	29
	30	/**
	31	* CRL (Certificate Revocation List) Exception.
	32	*
	33	* @author Hemma Prafullchandra
	34	*/
	35	public class CRLException extends GeneralSecurityException {
	36
	37	private static final long serialVersionUID = -6694728944094197147L;
	38
	39	/**
	40	* Constructs a CRLException with no detail message. A
	41	* detail message is a String that describes this particular
	42	* exception.
	43	*/
	44	public CRLException() {
	45	super();
	46	}
	47
	48	/**
	49	* Constructs a CRLException with the specified detail
	50	* message. A detail message is a String that describes this
	51	* particular exception.
	52	*
	53	* @param message the detail message.
	54	*/
	55	public CRLException(String message) {
	56	super(message);
	57	}
	58
	59	/**
	60	* Creates a <code>CRLException</code> with the specified
	61	* detail message and cause.
	62	*
	63	* @param message the detail message (which is saved for later retrieval
	64	* by the {@link #getMessage()} method).
	65	* @param cause the cause (which is saved for later retrieval by the
	66	* {@link #getCause()} method). (A <tt>null</tt> value is permitted,
	67	* and indicates that the cause is nonexistent or unknown.)
	68	* @since 1.5
	69	*/
	70	public CRLException(String message, Throwable cause) {
	71	super(message, cause);
	72	}
	73
	74	/**
	75	* Creates a <code>CRLException</code> with the specified cause
	76	* and a detail message of <tt>(cause==null ? null : cause.toString())</tt>
	77	* (which typically contains the class and detail message of
	78	* <tt>cause</tt>).
	79	*
	80	* @param cause the cause (which is saved for later retrieval by the
	81	* {@link #getCause()} method). (A <tt>null</tt> value is permitted,
	82	* and indicates that the cause is nonexistent or unknown.)
	83	* @since 1.5
	84	*/
	85	public CRLException(Throwable cause) {
	86	super(cause);
	87	}
	88	}

java/pkg/java/security/cert/CRLReason.class+0−0

Binary file not shown.

java/pkg/java/security/cert/CRLReason.java+104−0

@@ -0,0 +1,104 @@
	1	/*
	2	* Copyright (c) 2007, Oracle and/or its affiliates. All rights reserved.
	3	* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
	4	*
	5	* This code is free software; you can redistribute it and/or modify it
	6	* under the terms of the GNU General Public License version 2 only, as
	7	* published by the Free Software Foundation. Oracle designates this
	8	* particular file as subject to the "Classpath" exception as provided
	9	* by Oracle in the LICENSE file that accompanied this code.
	10	*
	11	* This code is distributed in the hope that it will be useful, but WITHOUT
	12	* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
	13	* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
	14	* version 2 for more details (a copy is included in the LICENSE file that
	15	* accompanied this code).
	16	*
	17	* You should have received a copy of the GNU General Public License version
	18	* 2 along with this work; if not, write to the Free Software Foundation,
	19	* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
	20	*
	21	* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
	22	* or visit www.oracle.com if you need additional information or have any
	23	* questions.
	24	*/
	25
	26	package java.security.cert;
	27
	28	/**
	29	* The CRLReason enumeration specifies the reason that a certificate
	30	* is revoked, as defined in <a href="http://www.ietf.org/rfc/rfc3280.txt">
	31	* RFC 3280: Internet X.509 Public Key Infrastructure Certificate and CRL
	32	* Profile</a>.
	33	*
	34	* @author Sean Mullan
	35	* @since 1.7
	36	* @see X509CRLEntry#getRevocationReason
	37	* @see CertificateRevokedException#getRevocationReason
	38	*/
	39	public enum CRLReason {
	40	/**
	41	* This reason indicates that it is unspecified as to why the
	42	* certificate has been revoked.
	43	*/
	44	UNSPECIFIED,
	45
	46	/**
	47	* This reason indicates that it is known or suspected that the
	48	* certificate subject's private key has been compromised. It applies
	49	* to end-entity certificates only.
	50	*/
	51	KEY_COMPROMISE,
	52
	53	/**
	54	* This reason indicates that it is known or suspected that the
	55	* certificate subject's private key has been compromised. It applies
	56	* to certificate authority (CA) certificates only.
	57	*/
	58	CA_COMPROMISE,
	59
	60	/**
	61	* This reason indicates that the subject's name or other information
	62	* has changed.
	63	*/
	64	AFFILIATION_CHANGED,
	65
	66	/**
	67	* This reason indicates that the certificate has been superseded.
	68	*/
	69	SUPERSEDED,
	70
	71	/**
	72	* This reason indicates that the certificate is no longer needed.
	73	*/
	74	CESSATION_OF_OPERATION,
	75
	76	/**
	77	* This reason indicates that the certificate has been put on hold.
	78	*/
	79	CERTIFICATE_HOLD,
	80
	81	/**
	82	* Unused reason.
	83	*/
	84	UNUSED,
	85
	86	/**
	87	* This reason indicates that the certificate was previously on hold
	88	* and should be removed from the CRL. It is for use with delta CRLs.
	89	*/
	90	REMOVE_FROM_CRL,
	91
	92	/**
	93	* This reason indicates that the privileges granted to the subject of
	94	* the certificate have been withdrawn.
	95	*/
	96	PRIVILEGE_WITHDRAWN,
	97
	98	/**
	99	* This reason indicates that it is known or suspected that the
	100	* certificate subject's private key has been compromised. It applies
	101	* to authority attribute (AA) certificates only.
	102	*/
	103	AA_COMPROMISE
	104	}

java/pkg/java/security/cert/CRLSelector.class+0−0

Binary file not shown.

java/pkg/java/security/cert/CRLSelector.java+66−0

@@ -0,0 +1,66 @@
	1	/*
	2	* Copyright (c) 2000, 2001, Oracle and/or its affiliates. All rights reserved.
	3	* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
	4	*
	5	* This code is free software; you can redistribute it and/or modify it
	6	* under the terms of the GNU General Public License version 2 only, as
	7	* published by the Free Software Foundation. Oracle designates this
	8	* particular file as subject to the "Classpath" exception as provided
	9	* by Oracle in the LICENSE file that accompanied this code.
	10	*
	11	* This code is distributed in the hope that it will be useful, but WITHOUT
	12	* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
	13	* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
	14	* version 2 for more details (a copy is included in the LICENSE file that
	15	* accompanied this code).
	16	*
	17	* You should have received a copy of the GNU General Public License version
	18	* 2 along with this work; if not, write to the Free Software Foundation,
	19	* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
	20	*
	21	* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
	22	* or visit www.oracle.com if you need additional information or have any
	23	* questions.
	24	*/
	25
	26	package java.security.cert;
	27
	28	/**
	29	* A selector that defines a set of criteria for selecting <code>CRL</code>s.
	30	* Classes that implement this interface are often used to specify
	31	* which <code>CRL</code>s should be retrieved from a <code>CertStore</code>.
	32	* <p>
	33	* <b>Concurrent Access</b>
	34	* <p>
	35	* Unless otherwise specified, the methods defined in this interface are not
	36	* thread-safe. Multiple threads that need to access a single
	37	* object concurrently should synchronize amongst themselves and
	38	* provide the necessary locking. Multiple threads each manipulating
	39	* separate objects need not synchronize.
	40	*
	41	* @see CRL
	42	* @see CertStore
	43	* @see CertStore#getCRLs
	44	*
	45	* @author Steve Hanna
	46	* @since 1.4
	47	*/
	48	public interface CRLSelector extends Cloneable {
	49
	50	/**
	51	* Decides whether a <code>CRL</code> should be selected.
	52	*
	53	* @param crl the <code>CRL</code> to be checked
	54	* @return <code>true</code> if the <code>CRL</code> should be selected,
	55	* <code>false</code> otherwise
	56	*/
	57	boolean match(CRL crl);
	58
	59	/**
	60	* Makes a copy of this <code>CRLSelector</code>. Changes to the
	61	* copy will not affect the original and vice versa.
	62	*
	63	* @return a copy of this <code>CRLSelector</code>
	64	*/
	65	Object clone();
	66	}

java/pkg/java/security/cert/CertPath$CertPathRep.class+0−0

Binary file not shown.

java/pkg/java/security/cert/CertPath.class+0−0

Binary file not shown.

java/pkg/java/security/cert/CertPath.java+343−0

@@ -0,0 +1,343 @@
	1	/*
	2	* Copyright (c) 2000, 2011, Oracle and/or its affiliates. All rights reserved.
	3	* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
	4	*
	5	* This code is free software; you can redistribute it and/or modify it
	6	* under the terms of the GNU General Public License version 2 only, as
	7	* published by the Free Software Foundation. Oracle designates this
	8	* particular file as subject to the "Classpath" exception as provided
	9	* by Oracle in the LICENSE file that accompanied this code.
	10	*
	11	* This code is distributed in the hope that it will be useful, but WITHOUT
	12	* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
	13	* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
	14	* version 2 for more details (a copy is included in the LICENSE file that
	15	* accompanied this code).
	16	*
	17	* You should have received a copy of the GNU General Public License version
	18	* 2 along with this work; if not, write to the Free Software Foundation,
	19	* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
	20	*
	21	* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
	22	* or visit www.oracle.com if you need additional information or have any
	23	* questions.
	24	*/
	25
	26	package java.security.cert;
	27
	28	import java.io.ByteArrayInputStream;
	29	import java.io.NotSerializableException;
	30	import java.io.ObjectStreamException;
	31	import java.io.Serializable;
	32	import java.util.Iterator;
	33	import java.util.List;
	34
	35	/**
	36	* An immutable sequence of certificates (a certification path).
	37	* <p>
	38	* This is an abstract class that defines the methods common to all
	39	* <code>CertPath</code>s. Subclasses can handle different kinds of
	40	* certificates (X.509, PGP, etc.).
	41	* <p>
	42	* All <code>CertPath</code> objects have a type, a list of
	43	* <code>Certificate</code>s, and one or more supported encodings. Because the
	44	* <code>CertPath</code> class is immutable, a <code>CertPath</code> cannot
	45	* change in any externally visible way after being constructed. This
	46	* stipulation applies to all public fields and methods of this class and any
	47	* added or overridden by subclasses.
	48	* <p>
	49	* The type is a <code>String</code> that identifies the type of
	50	* <code>Certificate</code>s in the certification path. For each
	51	* certificate <code>cert</code> in a certification path <code>certPath</code>,
	52	* <code>cert.getType().equals(certPath.getType())</code> must be
	53	* <code>true</code>.
	54	* <p>
	55	* The list of <code>Certificate</code>s is an ordered <code>List</code> of
	56	* zero or more <code>Certificate</code>s. This <code>List</code> and all
	57	* of the <code>Certificate</code>s contained in it must be immutable.
	58	* <p>
	59	* Each <code>CertPath</code> object must support one or more encodings
	60	* so that the object can be translated into a byte array for storage or
	61	* transmission to other parties. Preferably, these encodings should be
	62	* well-documented standards (such as PKCS#7). One of the encodings supported
	63	* by a <code>CertPath</code> is considered the default encoding. This
	64	* encoding is used if no encoding is explicitly requested (for the
	65	* {@link #getEncoded() getEncoded()} method, for instance).
	66	* <p>
	67	* All <code>CertPath</code> objects are also <code>Serializable</code>.
	68	* <code>CertPath</code> objects are resolved into an alternate
	69	* {@link CertPathRep CertPathRep} object during serialization. This allows
	70	* a <code>CertPath</code> object to be serialized into an equivalent
	71	* representation regardless of its underlying implementation.
	72	* <p>
	73	* <code>CertPath</code> objects can be created with a
	74	* <code>CertificateFactory</code> or they can be returned by other classes,
	75	* such as a <code>CertPathBuilder</code>.
	76	* <p>
	77	* By convention, X.509 <code>CertPath</code>s (consisting of
	78	* <code>X509Certificate</code>s), are ordered starting with the target
	79	* certificate and ending with a certificate issued by the trust anchor. That
	80	* is, the issuer of one certificate is the subject of the following one. The
	81	* certificate representing the {@link TrustAnchor TrustAnchor} should not be
	82	* included in the certification path. Unvalidated X.509 <code>CertPath</code>s
	83	* may not follow these conventions. PKIX <code>CertPathValidator</code>s will
	84	* detect any departure from these conventions that cause the certification
	85	* path to be invalid and throw a <code>CertPathValidatorException</code>.
	86	*
	87	* <p> Every implementation of the Java platform is required to support the
	88	* following standard <code>CertPath</code> encodings:
	89	* <ul>
	90	* <li><tt>PKCS7</tt></li>
	91	* <li><tt>PkiPath</tt></li>
	92	* </ul>
	93	* These encodings are described in the <a href=
	94	* "{@docRoot}/../technotes/guides/security/StandardNames.html#CertPathEncodings">
	95	* CertPath Encodings section</a> of the
	96	* Java Cryptography Architecture Standard Algorithm Name Documentation.
	97	* Consult the release documentation for your implementation to see if any
	98	* other encodings are supported.
	99	* <p>
	100	* <b>Concurrent Access</b>
	101	* <p>
	102	* All <code>CertPath</code> objects must be thread-safe. That is, multiple
	103	* threads may concurrently invoke the methods defined in this class on a
	104	* single <code>CertPath</code> object (or more than one) with no
	105	* ill effects. This is also true for the <code>List</code> returned by
	106	* <code>CertPath.getCertificates</code>.
	107	* <p>
	108	* Requiring <code>CertPath</code> objects to be immutable and thread-safe
	109	* allows them to be passed around to various pieces of code without worrying
	110	* about coordinating access. Providing this thread-safety is
	111	* generally not difficult, since the <code>CertPath</code> and
	112	* <code>List</code> objects in question are immutable.
	113	*
	114	* @see CertificateFactory
	115	* @see CertPathBuilder
	116	*
	117	* @author Yassir Elley
	118	* @since 1.4
	119	*/
	120	public abstract class CertPath implements Serializable {
	121
	122	private static final long serialVersionUID = 6068470306649138683L;
	123
	124	private String type; // the type of certificates in this chain
	125
	126	/**
	127	* Creates a <code>CertPath</code> of the specified type.
	128	* <p>
	129	* This constructor is protected because most users should use a
	130	* <code>CertificateFactory</code> to create <code>CertPath</code>s.
	131	*
	132	* @param type the standard name of the type of
	133	* <code>Certificate</code>s in this path
	134	*/
	135	protected CertPath(String type) {
	136	this.type = type;
	137	}
	138
	139	/**
	140	* Returns the type of <code>Certificate</code>s in this certification
	141	* path. This is the same string that would be returned by
	142	* {@link java.security.cert.Certificate#getType() cert.getType()}
	143	* for all <code>Certificate</code>s in the certification path.
	144	*
	145	* @return the type of <code>Certificate</code>s in this certification
	146	* path (never null)
	147	*/
	148	public String getType() {
	149	return type;
	150	}
	151
	152	/**
	153	* Returns an iteration of the encodings supported by this certification
	154	* path, with the default encoding first. Attempts to modify the returned
	155	* <code>Iterator</code> via its <code>remove</code> method result in an
	156	* <code>UnsupportedOperationException</code>.
	157	*
	158	* @return an <code>Iterator</code> over the names of the supported
	159	* encodings (as Strings)
	160	*/
	161	public abstract Iterator<String> getEncodings();
	162
	163	/**
	164	* Compares this certification path for equality with the specified
	165	* object. Two <code>CertPath</code>s are equal if and only if their
	166	* types are equal and their certificate <code>List</code>s (and by
	167	* implication the <code>Certificate</code>s in those <code>List</code>s)
	168	* are equal. A <code>CertPath</code> is never equal to an object that is
	169	* not a <code>CertPath</code>.
	170	* <p>
	171	* This algorithm is implemented by this method. If it is overridden,
	172	* the behavior specified here must be maintained.
	173	*
	174	* @param other the object to test for equality with this certification path
	175	* @return true if the specified object is equal to this certification path,
	176	* false otherwise
	177	*/
	178	public boolean equals(Object other) {
	179	if (this == other)
	180	return true;
	181
	182	if (! (other instanceof CertPath))
	183	return false;
	184
	185	CertPath otherCP = (CertPath) other;
	186	if (! otherCP.getType().equals(type))
	187	return false;
	188
	189	List<? extends Certificate> thisCertList = this.getCertificates();
	190	List<? extends Certificate> otherCertList = otherCP.getCertificates();
	191	return(thisCertList.equals(otherCertList));
	192	}
	193
	194	/**
	195	* Returns the hashcode for this certification path. The hash code of
	196	* a certification path is defined to be the result of the following
	197	* calculation:
	198	* <pre><code>
	199	* hashCode = path.getType().hashCode();
	200	* hashCode = 31*hashCode + path.getCertificates().hashCode();
	201	* </code></pre>
	202	* This ensures that <code>path1.equals(path2)</code> implies that
	203	* <code>path1.hashCode()==path2.hashCode()</code> for any two certification
	204	* paths, <code>path1</code> and <code>path2</code>, as required by the
	205	* general contract of <code>Object.hashCode</code>.
	206	*
	207	* @return the hashcode value for this certification path
	208	*/
	209	public int hashCode() {
	210	int hashCode = type.hashCode();
	211	hashCode = 31*hashCode + getCertificates().hashCode();
	212	return hashCode;
	213	}
	214
	215	/**
	216	* Returns a string representation of this certification path.
	217	* This calls the <code>toString</code> method on each of the
	218	* <code>Certificate</code>s in the path.
	219	*
	220	* @return a string representation of this certification path
	221	*/
	222	public String toString() {
	223	StringBuffer sb = new StringBuffer();
	224	Iterator<? extends Certificate> stringIterator =
	225	getCertificates().iterator();
	226
	227	sb.append("\n" + type + " Cert Path: length = "
	228	+ getCertificates().size() + ".\n");
	229	sb.append("[\n");
	230	int i = 1;
	231	while (stringIterator.hasNext()) {
	232	sb.append("=========================================="
	233	+ "===============Certificate " + i + " start.\n");
	234	Certificate stringCert = stringIterator.next();
	235	sb.append(stringCert.toString());
	236	sb.append("\n========================================"
	237	+ "=================Certificate " + i + " end.\n\n\n");
	238	i++;
	239	}
	240
	241	sb.append("\n]");
	242	return sb.toString();
	243	}
	244
	245	/**
	246	* Returns the encoded form of this certification path, using the default
	247	* encoding.
	248	*
	249	* @return the encoded bytes
	250	* @exception CertificateEncodingException if an encoding error occurs
	251	*/
	252	public abstract byte[] getEncoded()
	253	throws CertificateEncodingException;
	254
	255	/**
	256	* Returns the encoded form of this certification path, using the
	257	* specified encoding.
	258	*
	259	* @param encoding the name of the encoding to use
	260	* @return the encoded bytes
	261	* @exception CertificateEncodingException if an encoding error occurs or
	262	* the encoding requested is not supported
	263	*/
	264	public abstract byte[] getEncoded(String encoding)
	265	throws CertificateEncodingException;
	266
	267	/**
	268	* Returns the list of certificates in this certification path.
	269	* The <code>List</code> returned must be immutable and thread-safe.
	270	*
	271	* @return an immutable <code>List</code> of <code>Certificate</code>s
	272	* (may be empty, but not null)
	273	*/
	274	public abstract List<? extends Certificate> getCertificates();
	275
	276	/**
	277	* Replaces the <code>CertPath</code> to be serialized with a
	278	* <code>CertPathRep</code> object.
	279	*
	280	* @return the <code>CertPathRep</code> to be serialized
	281	*
	282	* @throws ObjectStreamException if a <code>CertPathRep</code> object
	283	* representing this certification path could not be created
	284	*/
	285	protected Object writeReplace() throws ObjectStreamException {
	286	try {
	287	return new CertPathRep(type, getEncoded());
	288	} catch (CertificateException ce) {
	289	NotSerializableException nse =
	290	new NotSerializableException
	291	("java.security.cert.CertPath: " + type);
	292	nse.initCause(ce);
	293	throw nse;
	294	}
	295	}
	296
	297	/**
	298	* Alternate <code>CertPath</code> class for serialization.
	299	* @since 1.4
	300	*/
	301	protected static class CertPathRep implements Serializable {
	302
	303	private static final long serialVersionUID = 3015633072427920915L;
	304
	305	/** The Certificate type */
	306	private String type;
	307	/** The encoded form of the cert path */
	308	private byte[] data;
	309
	310	/**
	311	* Creates a <code>CertPathRep</code> with the specified
	312	* type and encoded form of a certification path.
	313	*
	314	* @param type the standard name of a <code>CertPath</code> type
	315	* @param data the encoded form of the certification path
	316	*/
	317	protected CertPathRep(String type, byte[] data) {
	318	this.type = type;
	319	this.data = data;
	320	}
	321
	322	/**
	323	* Returns a <code>CertPath</code> constructed from the type and data.
	324	*
	325	* @return the resolved <code>CertPath</code> object
	326	*
	327	* @throws ObjectStreamException if a <code>CertPath</code> could not
	328	* be constructed
	329	*/
	330	protected Object readResolve() throws ObjectStreamException {
	331	try {
	332	CertificateFactory cf = CertificateFactory.getInstance(type);
	333	return cf.generateCertPath(new ByteArrayInputStream(data));
	334	} catch (CertificateException ce) {
	335	NotSerializableException nse =
	336	new NotSerializableException
	337	("java.security.cert.CertPath: " + type);
	338	nse.initCause(ce);
	339	throw nse;
	340	}
	341	}
	342	}
	343	}

java/pkg/java/security/cert/CertPathBuilder$1.class+0−0

Binary file not shown.

java/pkg/java/security/cert/CertPathBuilder.class+0−0

Binary file not shown.

java/pkg/java/security/cert/CertPathBuilder.java+304−0

@@ -0,0 +1,304 @@
	1	/*
	2	* Copyright (c) 2000, 2011, Oracle and/or its affiliates. All rights reserved.
	3	* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
	4	*
	5	* This code is free software; you can redistribute it and/or modify it
	6	* under the terms of the GNU General Public License version 2 only, as
	7	* published by the Free Software Foundation. Oracle designates this
	8	* particular file as subject to the "Classpath" exception as provided
	9	* by Oracle in the LICENSE file that accompanied this code.
	10	*
	11	* This code is distributed in the hope that it will be useful, but WITHOUT
	12	* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
	13	* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
	14	* version 2 for more details (a copy is included in the LICENSE file that
	15	* accompanied this code).
	16	*
	17	* You should have received a copy of the GNU General Public License version
	18	* 2 along with this work; if not, write to the Free Software Foundation,
	19	* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
	20	*
	21	* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
	22	* or visit www.oracle.com if you need additional information or have any
	23	* questions.
	24	*/
	25
	26	package java.security.cert;
	27
	28	import java.security.AccessController;
	29	import java.security.InvalidAlgorithmParameterException;
	30	import java.security.NoSuchAlgorithmException;
	31	import java.security.NoSuchProviderException;
	32	import java.security.PrivilegedAction;
	33	import java.security.Provider;
	34	import java.security.Security;
	35	import sun.security.util.Debug;
	36
	37	import sun.security.jca.*;
	38	import sun.security.jca.GetInstance.Instance;
	39
	40	/**
	41	* A class for building certification paths (also known as certificate chains).
	42	* <p>
	43	* This class uses a provider-based architecture.
	44	* To create a <code>CertPathBuilder</code>, call
	45	* one of the static <code>getInstance</code> methods, passing in the
	46	* algorithm name of the <code>CertPathBuilder</code> desired and optionally
	47	* the name of the provider desired.
	48	* <p>
	49	* Once a <code>CertPathBuilder</code> object has been created, certification
	50	* paths can be constructed by calling the {@link #build build} method and
	51	* passing it an algorithm-specific set of parameters. If successful, the
	52	* result (including the <code>CertPath</code> that was built) is returned
	53	* in an object that implements the <code>CertPathBuilderResult</code>
	54	* interface.
	55	*
	56	* <p> Every implementation of the Java platform is required to support the
	57	* following standard <code>CertPathBuilder</code> algorithm:
	58	* <ul>
	59	* <li><tt>PKIX</tt></li>
	60	* </ul>
	61	* This algorithm is described in the <a href=
	62	* "{@docRoot}/../technotes/guides/security/StandardNames.html#CertPathBuilder">
	63	* CertPathBuilder section</a> of the
	64	* Java Cryptography Architecture Standard Algorithm Name Documentation.
	65	* Consult the release documentation for your implementation to see if any
	66	* other algorithms are supported.
	67	*
	68	* <p>
	69	* <b>Concurrent Access</b>
	70	* <p>
	71	* The static methods of this class are guaranteed to be thread-safe.
	72	* Multiple threads may concurrently invoke the static methods defined in
	73	* this class with no ill effects.
	74	* <p>
	75	* However, this is not true for the non-static methods defined by this class.
	76	* Unless otherwise documented by a specific provider, threads that need to
	77	* access a single <code>CertPathBuilder</code> instance concurrently should
	78	* synchronize amongst themselves and provide the necessary locking. Multiple
	79	* threads each manipulating a different <code>CertPathBuilder</code> instance
	80	* need not synchronize.
	81	*
	82	* @see CertPath
	83	*
	84	* @since 1.4
	85	* @author Sean Mullan
	86	* @author Yassir Elley
	87	*/
	88	public class CertPathBuilder {
	89
	90	/*
	91	* Constant to lookup in the Security properties file to determine
	92	* the default certpathbuilder type. In the Security properties file,
	93	* the default certpathbuilder type is given as:
	94	* <pre>
	95	* certpathbuilder.type=PKIX
	96	* </pre>
	97	*/
	98	private static final String CPB_TYPE = "certpathbuilder.type";
	99	private static final Debug debug = Debug.getInstance("certpath");
	100	private CertPathBuilderSpi builderSpi;
	101	private Provider provider;
	102	private String algorithm;
	103
	104	/**
	105	* Creates a <code>CertPathBuilder</code> object of the given algorithm,
	106	* and encapsulates the given provider implementation (SPI object) in it.
	107	*
	108	* @param builderSpi the provider implementation
	109	* @param provider the provider
	110	* @param algorithm the algorithm name
	111	*/
	112	protected CertPathBuilder(CertPathBuilderSpi builderSpi, Provider provider,
	113	String algorithm)
	114	{
	115	this.builderSpi = builderSpi;
	116	this.provider = provider;
	117	this.algorithm = algorithm;
	118	}
	119
	120	/**
	121	* Returns a <code>CertPathBuilder</code> object that implements the
	122	* specified algorithm.
	123	*
	124	* <p> This method traverses the list of registered security Providers,
	125	* starting with the most preferred Provider.
	126	* A new CertPathBuilder object encapsulating the
	127	* CertPathBuilderSpi implementation from the first
	128	* Provider that supports the specified algorithm is returned.
	129	*
	130	* <p> Note that the list of registered providers may be retrieved via
	131	* the {@link Security#getProviders() Security.getProviders()} method.
	132	*
	133	* @param algorithm the name of the requested <code>CertPathBuilder</code>
	134	* algorithm. See the CertPathBuilder section in the <a href=
	135	* "{@docRoot}/../technotes/guides/security/StandardNames.html#CertPathBuilder">
	136	* Java Cryptography Architecture Standard Algorithm Name Documentation</a>
	137	* for information about standard algorithm names.
	138	*
	139	* @return a <code>CertPathBuilder</code> object that implements the
	140	* specified algorithm.
	141	*
	142	* @throws NoSuchAlgorithmException if no Provider supports a
	143	* CertPathBuilderSpi implementation for the
	144	* specified algorithm.
	145	*
	146	* @see java.security.Provider
	147	*/
	148	public static CertPathBuilder getInstance(String algorithm)
	149	throws NoSuchAlgorithmException {
	150	Instance instance = GetInstance.getInstance("CertPathBuilder",
	151	CertPathBuilderSpi.class, algorithm);
	152	return new CertPathBuilder((CertPathBuilderSpi)instance.impl,
	153	instance.provider, algorithm);
	154	}
	155
	156	/**
	157	* Returns a <code>CertPathBuilder</code> object that implements the
	158	* specified algorithm.
	159	*
	160	* <p> A new CertPathBuilder object encapsulating the
	161	* CertPathBuilderSpi implementation from the specified provider
	162	* is returned. The specified provider must be registered
	163	* in the security provider list.
	164	*
	165	* <p> Note that the list of registered providers may be retrieved via
	166	* the {@link Security#getProviders() Security.getProviders()} method.
	167	*
	168	* @param algorithm the name of the requested <code>CertPathBuilder</code>
	169	* algorithm. See the CertPathBuilder section in the <a href=
	170	* "{@docRoot}/../technotes/guides/security/StandardNames.html#CertPathBuilder">
	171	* Java Cryptography Architecture Standard Algorithm Name Documentation</a>
	172	* for information about standard algorithm names.
	173	*
	174	* @param provider the name of the provider.
	175	*
	176	* @return a <code>CertPathBuilder</code> object that implements the
	177	* specified algorithm.
	178	*
	179	* @throws NoSuchAlgorithmException if a CertPathBuilderSpi
	180	* implementation for the specified algorithm is not
	181	* available from the specified provider.
	182	*
	183	* @throws NoSuchProviderException if the specified provider is not
	184	* registered in the security provider list.
	185	*
	186	* @exception IllegalArgumentException if the <code>provider</code> is
	187	* null or empty.
	188	*
	189	* @see java.security.Provider
	190	*/
	191	public static CertPathBuilder getInstance(String algorithm, String provider)
	192	throws NoSuchAlgorithmException, NoSuchProviderException {
	193	Instance instance = GetInstance.getInstance("CertPathBuilder",
	194	CertPathBuilderSpi.class, algorithm, provider);
	195	return new CertPathBuilder((CertPathBuilderSpi)instance.impl,
	196	instance.provider, algorithm);
	197	}
	198
	199	/**
	200	* Returns a <code>CertPathBuilder</code> object that implements the
	201	* specified algorithm.
	202	*
	203	* <p> A new CertPathBuilder object encapsulating the
	204	* CertPathBuilderSpi implementation from the specified Provider
	205	* object is returned. Note that the specified Provider object
	206	* does not have to be registered in the provider list.
	207	*
	208	* @param algorithm the name of the requested <code>CertPathBuilder</code>
	209	* algorithm. See the CertPathBuilder section in the <a href=
	210	* "{@docRoot}/../technotes/guides/security/StandardNames.html#CertPathBuilder">
	211	* Java Cryptography Architecture Standard Algorithm Name Documentation</a>
	212	* for information about standard algorithm names.
	213	*
	214	* @param provider the provider.
	215	*
	216	* @return a <code>CertPathBuilder</code> object that implements the
	217	* specified algorithm.
	218	*
	219	* @exception NoSuchAlgorithmException if a CertPathBuilderSpi
	220	* implementation for the specified algorithm is not available
	221	* from the specified Provider object.
	222	*
	223	* @exception IllegalArgumentException if the <code>provider</code> is
	224	* null.
	225	*
	226	* @see java.security.Provider
	227	*/
	228	public static CertPathBuilder getInstance(String algorithm,
	229	Provider provider) throws NoSuchAlgorithmException {
	230	Instance instance = GetInstance.getInstance("CertPathBuilder",
	231	CertPathBuilderSpi.class, algorithm, provider);
	232	return new CertPathBuilder((CertPathBuilderSpi)instance.impl,
	233	instance.provider, algorithm);
	234	}
	235
	236	/**
	237	* Returns the provider of this <code>CertPathBuilder</code>.
	238	*
	239	* @return the provider of this <code>CertPathBuilder</code>
	240	*/
	241	public final Provider getProvider() {
	242	return this.provider;
	243	}
	244
	245	/**
	246	* Returns the name of the algorithm of this <code>CertPathBuilder</code>.
	247	*
	248	* @return the name of the algorithm of this <code>CertPathBuilder</code>
	249	*/
	250	public final String getAlgorithm() {
	251	return this.algorithm;
	252	}
	253
	254	/**
	255	* Attempts to build a certification path using the specified algorithm
	256	* parameter set.
	257	*
	258	* @param params the algorithm parameters
	259	* @return the result of the build algorithm
	260	* @throws CertPathBuilderException if the builder is unable to construct
	261	* a certification path that satisfies the specified parameters
	262	* @throws InvalidAlgorithmParameterException if the specified parameters
	263	* are inappropriate for this <code>CertPathBuilder</code>
	264	*/
	265	public final CertPathBuilderResult build(CertPathParameters params)
	266	throws CertPathBuilderException, InvalidAlgorithmParameterException
	267	{
	268	return builderSpi.engineBuild(params);
	269	}
	270
	271	/**
	272	* Returns the default <code>CertPathBuilder</code> type as specified in
	273	* the Java security properties file, or the string "PKIX"
	274	* if no such property exists. The Java security properties file is
	275	* located in the file named <JAVA_HOME>/lib/security/java.security.
	276	* <JAVA_HOME> refers to the value of the java.home system property,
	277	* and specifies the directory where the JRE is installed.
	278	*
	279	* <p>The default <code>CertPathBuilder</code> type can be used by
	280	* applications that do not want to use a hard-coded type when calling one
	281	* of the <code>getInstance</code> methods, and want to provide a default
	282	* type in case a user does not specify its own.
	283	*
	284	* <p>The default <code>CertPathBuilder</code> type can be changed by
	285	* setting the value of the "certpathbuilder.type" security property
	286	* (in the Java security properties file) to the desired type.
	287	*
	288	* @return the default <code>CertPathBuilder</code> type as specified
	289	* in the Java security properties file, or the string "PKIX"
	290	* if no such property exists.
	291	*/
	292	public final static String getDefaultType() {
	293	String cpbtype;
	294	cpbtype = AccessController.doPrivileged(new PrivilegedAction<String>() {
	295	public String run() {
	296	return Security.getProperty(CPB_TYPE);
	297	}
	298	});
	299	if (cpbtype == null) {
	300	cpbtype = "PKIX";
	301	}
	302	return cpbtype;
	303	}
	304	}

java/pkg/java/security/cert/CertPathBuilderException.class+0−0

Binary file not shown.

java/pkg/java/security/cert/CertPathBuilderException.java+104−0

@@ -0,0 +1,104 @@
	1	/*
	2	* Copyright (c) 2000, 2003, Oracle and/or its affiliates. All rights reserved.
	3	* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
	4	*
	5	* This code is free software; you can redistribute it and/or modify it
	6	* under the terms of the GNU General Public License version 2 only, as
	7	* published by the Free Software Foundation. Oracle designates this
	8	* particular file as subject to the "Classpath" exception as provided
	9	* by Oracle in the LICENSE file that accompanied this code.
	10	*
	11	* This code is distributed in the hope that it will be useful, but WITHOUT
	12	* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
	13	* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
	14	* version 2 for more details (a copy is included in the LICENSE file that
	15	* accompanied this code).
	16	*
	17	* You should have received a copy of the GNU General Public License version
	18	* 2 along with this work; if not, write to the Free Software Foundation,
	19	* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
	20	*
	21	* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
	22	* or visit www.oracle.com if you need additional information or have any
	23	* questions.
	24	*/
	25
	26	package java.security.cert;
	27
	28	import java.security.GeneralSecurityException;
	29
	30	/**
	31	* An exception indicating one of a variety of problems encountered when
	32	* building a certification path with a <code>CertPathBuilder</code>.
	33	* <p>
	34	* A <code>CertPathBuilderException</code> provides support for wrapping
	35	* exceptions. The {@link #getCause getCause} method returns the throwable,
	36	* if any, that caused this exception to be thrown.
	37	* <p>
	38	* <b>Concurrent Access</b>
	39	* <p>
	40	* Unless otherwise specified, the methods defined in this class are not
	41	* thread-safe. Multiple threads that need to access a single
	42	* object concurrently should synchronize amongst themselves and
	43	* provide the necessary locking. Multiple threads each manipulating
	44	* separate objects need not synchronize.
	45	*
	46	* @see CertPathBuilder
	47	*
	48	* @since 1.4
	49	* @author Sean Mullan
	50	*/
	51	public class CertPathBuilderException extends GeneralSecurityException {
	52
	53	private static final long serialVersionUID = 5316471420178794402L;
	54
	55	/**
	56	* Creates a <code>CertPathBuilderException</code> with <code>null</code>
	57	* as its detail message.
	58	*/
	59	public CertPathBuilderException() {
	60	super();
	61	}
	62
	63	/**
	64	* Creates a <code>CertPathBuilderException</code> with the given
	65	* detail message. The detail message is a <code>String</code> that
	66	* describes this particular exception in more detail.
	67	*
	68	* @param msg the detail message
	69	*/
	70	public CertPathBuilderException(String msg) {
	71	super(msg);
	72	}
	73
	74	/**
	75	* Creates a <code>CertPathBuilderException</code> that wraps the specified
	76	* throwable. This allows any exception to be converted into a
	77	* <code>CertPathBuilderException</code>, while retaining information
	78	* about the wrapped exception, which may be useful for debugging. The
	79	* detail message is set to (<code>cause==null ? null : cause.toString()
	80	* </code>) (which typically contains the class and detail message of
	81	* cause).
	82	*
	83	* @param cause the cause (which is saved for later retrieval by the
	84	* {@link #getCause getCause()} method). (A <code>null</code> value is
	85	* permitted, and indicates that the cause is nonexistent or unknown.)
	86	*/
	87	public CertPathBuilderException(Throwable cause) {
	88	super(cause);
	89	}
	90
	91	/**
	92	* Creates a <code>CertPathBuilderException</code> with the specified
	93	* detail message and cause.
	94	*
	95	* @param msg the detail message
	96	* @param cause the cause (which is saved for later retrieval by the
	97	* {@link #getCause getCause()} method). (A <code>null</code> value is
	98	* permitted, and indicates that the cause is nonexistent or unknown.)
	99	*/
	100	public CertPathBuilderException(String msg, Throwable cause) {
	101	super(msg, cause);
	102	}
	103
	104	}

java/pkg/java/security/cert/CertPathBuilderResult.class+0−0

Binary file not shown.

java/pkg/java/security/cert/CertPathBuilderResult.java+68−0

@@ -0,0 +1,68 @@
	1	/*
	2	* Copyright (c) 2000, 2001, Oracle and/or its affiliates. All rights reserved.
	3	* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
	4	*
	5	* This code is free software; you can redistribute it and/or modify it
	6	* under the terms of the GNU General Public License version 2 only, as
	7	* published by the Free Software Foundation. Oracle designates this
	8	* particular file as subject to the "Classpath" exception as provided
	9	* by Oracle in the LICENSE file that accompanied this code.
	10	*
	11	* This code is distributed in the hope that it will be useful, but WITHOUT
	12	* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
	13	* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
	14	* version 2 for more details (a copy is included in the LICENSE file that
	15	* accompanied this code).
	16	*
	17	* You should have received a copy of the GNU General Public License version
	18	* 2 along with this work; if not, write to the Free Software Foundation,
	19	* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
	20	*
	21	* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
	22	* or visit www.oracle.com if you need additional information or have any
	23	* questions.
	24	*/
	25
	26	package java.security.cert;
	27
	28	/**
	29	* A specification of the result of a certification path builder algorithm.
	30	* All results returned by the {@link CertPathBuilder#build
	31	* CertPathBuilder.build} method must implement this interface.
	32	* <p>
	33	* At a minimum, a <code>CertPathBuilderResult</code> contains the
	34	* <code>CertPath</code> built by the <code>CertPathBuilder</code> instance.
	35	* Implementations of this interface may add methods to return implementation
	36	* or algorithm specific information, such as debugging information or
	37	* certification path validation results.
	38	* <p>
	39	* <b>Concurrent Access</b>
	40	* <p>
	41	* Unless otherwise specified, the methods defined in this interface are not
	42	* thread-safe. Multiple threads that need to access a single
	43	* object concurrently should synchronize amongst themselves and
	44	* provide the necessary locking. Multiple threads each manipulating
	45	* separate objects need not synchronize.
	46	*
	47	* @see CertPathBuilder
	48	*
	49	* @since 1.4
	50	* @author Sean Mullan
	51	*/
	52	public interface CertPathBuilderResult extends Cloneable {
	53
	54	/**
	55	* Returns the built certification path.
	56	*
	57	* @return the certification path (never <code>null</code>)
	58	*/
	59	CertPath getCertPath();
	60
	61	/**
	62	* Makes a copy of this <code>CertPathBuilderResult</code>. Changes to the
	63	* copy will not affect the original and vice versa.
	64	*
	65	* @return a copy of this <code>CertPathBuilderResult</code>
	66	*/
	67	Object clone();
	68	}

java/pkg/java/security/cert/CertPathBuilderSpi.class+0−0

Binary file not shown.

java/pkg/java/security/cert/CertPathBuilderSpi.java+75−0

@@ -0,0 +1,75 @@
	1	/*
	2	* Copyright (c) 2000, 2001, Oracle and/or its affiliates. All rights reserved.
	3	* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
	4	*
	5	* This code is free software; you can redistribute it and/or modify it
	6	* under the terms of the GNU General Public License version 2 only, as
	7	* published by the Free Software Foundation. Oracle designates this
	8	* particular file as subject to the "Classpath" exception as provided
	9	* by Oracle in the LICENSE file that accompanied this code.
	10	*
	11	* This code is distributed in the hope that it will be useful, but WITHOUT
	12	* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
	13	* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
	14	* version 2 for more details (a copy is included in the LICENSE file that
	15	* accompanied this code).
	16	*
	17	* You should have received a copy of the GNU General Public License version
	18	* 2 along with this work; if not, write to the Free Software Foundation,
	19	* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
	20	*
	21	* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
	22	* or visit www.oracle.com if you need additional information or have any
	23	* questions.
	24	*/
	25
	26	package java.security.cert;
	27
	28	import java.security.InvalidAlgorithmParameterException;
	29
	30	/**
	31	* The <i>Service Provider Interface</i> (<b>SPI</b>)
	32	* for the {@link CertPathBuilder CertPathBuilder} class. All
	33	* <code>CertPathBuilder</code> implementations must include a class (the
	34	* SPI class) that extends this class (<code>CertPathBuilderSpi</code>) and
	35	* implements all of its methods. In general, instances of this class should
	36	* only be accessed through the <code>CertPathBuilder</code> class. For
	37	* details, see the Java Cryptography Architecture.
	38	* <p>
	39	* <b>Concurrent Access</b>
	40	* <p>
	41	* Instances of this class need not be protected against concurrent
	42	* access from multiple threads. Threads that need to access a single
	43	* <code>CertPathBuilderSpi</code> instance concurrently should synchronize
	44	* amongst themselves and provide the necessary locking before calling the
	45	* wrapping <code>CertPathBuilder</code> object.
	46	* <p>
	47	* However, implementations of <code>CertPathBuilderSpi</code> may still
	48	* encounter concurrency issues, since multiple threads each
	49	* manipulating a different <code>CertPathBuilderSpi</code> instance need not
	50	* synchronize.
	51	*
	52	* @since 1.4
	53	* @author Sean Mullan
	54	*/
	55	public abstract class CertPathBuilderSpi {
	56
	57	/**
	58	* The default constructor.
	59	*/
	60	public CertPathBuilderSpi() { }
	61
	62	/**
	63	* Attempts to build a certification path using the specified
	64	* algorithm parameter set.
	65	*
	66	* @param params the algorithm parameters
	67	* @return the result of the build algorithm
	68	* @throws CertPathBuilderException if the builder is unable to construct
	69	* a certification path that satisfies the specified parameters
	70	* @throws InvalidAlgorithmParameterException if the specified parameters
	71	* are inappropriate for this <code>CertPathBuilder</code>
	72	*/
	73	public abstract CertPathBuilderResult engineBuild(CertPathParameters params)
	74	throws CertPathBuilderException, InvalidAlgorithmParameterException;
	75	}

java/pkg/java/security/cert/CertPathHelperImpl.class+0−0

Binary file not shown.

java/pkg/java/security/cert/CertPathHelperImpl.java+66−0

@@ -0,0 +1,66 @@
	1	/*
	2	* Copyright (c) 2002, 2009, Oracle and/or its affiliates. All rights reserved.
	3	* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
	4	*
	5	* This code is free software; you can redistribute it and/or modify it
	6	* under the terms of the GNU General Public License version 2 only, as
	7	* published by the Free Software Foundation. Oracle designates this
	8	* particular file as subject to the "Classpath" exception as provided
	9	* by Oracle in the LICENSE file that accompanied this code.
	10	*
	11	* This code is distributed in the hope that it will be useful, but WITHOUT
	12	* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
	13	* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
	14	* version 2 for more details (a copy is included in the LICENSE file that
	15	* accompanied this code).
	16	*
	17	* You should have received a copy of the GNU General Public License version
	18	* 2 along with this work; if not, write to the Free Software Foundation,
	19	* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
	20	*
	21	* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
	22	* or visit www.oracle.com if you need additional information or have any
	23	* questions.
	24	*/
	25
	26	package java.security.cert;
	27
	28	import java.util.*;
	29
	30	import sun.security.provider.certpath.CertPathHelper;
	31
	32	import sun.security.x509.GeneralNameInterface;
	33
	34	/**
	35	* Helper class that allows the Sun CertPath provider to access
	36	* implementation dependent APIs in CertPath framework.
	37	*
	38	* @author Andreas Sterbenz
	39	*/
	40	class CertPathHelperImpl extends CertPathHelper {
	41
	42	private CertPathHelperImpl() {
	43	// empty
	44	}
	45
	46	/**
	47	* Initialize the helper framework. This method must be called from
	48	* the static initializer of each class that is the target of one of
	49	* the methods in this class. This ensures that the helper is initialized
	50	* prior to a tunneled call from the Sun provider.
	51	*/
	52	synchronized static void initialize() {
	53	if (CertPathHelper.instance == null) {
	54	CertPathHelper.instance = new CertPathHelperImpl();
	55	}
	56	}
	57
	58	protected void implSetPathToNames(X509CertSelector sel,
	59	Set<GeneralNameInterface> names) {
	60	sel.setPathToNamesInternal(names);
	61	}
	62
	63	protected void implSetDateAndTime(X509CRLSelector sel, Date date, long skew) {
	64	sel.setDateAndTime(date, skew);
	65	}
	66	}

java/pkg/java/security/cert/CertPathParameters.class+0−0

Binary file not shown.

java/pkg/java/security/cert/CertPathParameters.java+49−0

@@ -0,0 +1,49 @@
	1	/*
	2	* Copyright (c) 2000, 2001, Oracle and/or its affiliates. All rights reserved.
	3	* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
	4	*
	5	* This code is free software; you can redistribute it and/or modify it
	6	* under the terms of the GNU General Public License version 2 only, as
	7	* published by the Free Software Foundation. Oracle designates this
	8	* particular file as subject to the "Classpath" exception as provided
	9	* by Oracle in the LICENSE file that accompanied this code.
	10	*
	11	* This code is distributed in the hope that it will be useful, but WITHOUT
	12	* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
	13	* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
	14	* version 2 for more details (a copy is included in the LICENSE file that
	15	* accompanied this code).
	16	*
	17	* You should have received a copy of the GNU General Public License version
	18	* 2 along with this work; if not, write to the Free Software Foundation,
	19	* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
	20	*
	21	* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
	22	* or visit www.oracle.com if you need additional information or have any
	23	* questions.
	24	*/
	25
	26	package java.security.cert;
	27
	28	/**
	29	* A specification of certification path algorithm parameters.
	30	* The purpose of this interface is to group (and provide type safety for)
	31	* all <code>CertPath</code> parameter specifications. All
	32	* <code>CertPath</code> parameter specifications must implement this
	33	* interface.
	34	*
	35	* @author Yassir Elley
	36	* @see CertPathValidator#validate(CertPath, CertPathParameters)
	37	* @see CertPathBuilder#build(CertPathParameters)
	38	* @since 1.4
	39	*/
	40	public interface CertPathParameters extends Cloneable {
	41
	42	/**
	43	* Makes a copy of this <code>CertPathParameters</code>. Changes to the
	44	* copy will not affect the original and vice versa.
	45	*
	46	* @return a copy of this <code>CertPathParameters</code>
	47	*/
	48	Object clone();
	49	}

java/pkg/java/security/cert/CertPathValidator$1.class+0−0

Binary file not shown.

java/pkg/java/security/cert/CertPathValidator.class+0−0

Binary file not shown.

java/pkg/java/security/cert/CertPathValidator.java+315−0

@@ -0,0 +1,315 @@
	1	/*
	2	* Copyright (c) 2000, 2011, Oracle and/or its affiliates. All rights reserved.
	3	* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
	4	*
	5	* This code is free software; you can redistribute it and/or modify it
	6	* under the terms of the GNU General Public License version 2 only, as
	7	* published by the Free Software Foundation. Oracle designates this
	8	* particular file as subject to the "Classpath" exception as provided
	9	* by Oracle in the LICENSE file that accompanied this code.
	10	*
	11	* This code is distributed in the hope that it will be useful, but WITHOUT
	12	* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
	13	* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
	14	* version 2 for more details (a copy is included in the LICENSE file that
	15	* accompanied this code).
	16	*
	17	* You should have received a copy of the GNU General Public License version
	18	* 2 along with this work; if not, write to the Free Software Foundation,
	19	* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
	20	*
	21	* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
	22	* or visit www.oracle.com if you need additional information or have any
	23	* questions.
	24	*/
	25
	26	package java.security.cert;
	27
	28	import java.security.AccessController;
	29	import java.security.InvalidAlgorithmParameterException;
	30	import java.security.NoSuchAlgorithmException;
	31	import java.security.NoSuchProviderException;
	32	import java.security.PrivilegedAction;
	33	import java.security.Provider;
	34	import java.security.Security;
	35	import sun.security.util.Debug;
	36
	37	import sun.security.jca.*;
	38	import sun.security.jca.GetInstance.Instance;
	39
	40	/**
	41	* A class for validating certification paths (also known as certificate
	42	* chains).
	43	* <p>
	44	* This class uses a provider-based architecture.
	45	* To create a <code>CertPathValidator</code>,
	46	* call one of the static <code>getInstance</code> methods, passing in the
	47	* algorithm name of the <code>CertPathValidator</code> desired and
	48	* optionally the name of the provider desired.
	49	* <p>
	50	* Once a <code>CertPathValidator</code> object has been created, it can
	51	* be used to validate certification paths by calling the {@link #validate
	52	* validate} method and passing it the <code>CertPath</code> to be validated
	53	* and an algorithm-specific set of parameters. If successful, the result is
	54	* returned in an object that implements the
	55	* <code>CertPathValidatorResult</code> interface.
	56	*
	57	* <p> Every implementation of the Java platform is required to support the
	58	* following standard <code>CertPathValidator</code> algorithm:
	59	* <ul>
	60	* <li><tt>PKIX</tt></li>
	61	* </ul>
	62	* This algorithm is described in the <a href=
	63	* "{@docRoot}/../technotes/guides/security/StandardNames.html#CertPathValidator">
	64	* CertPathValidator section</a> of the
	65	* Java Cryptography Architecture Standard Algorithm Name Documentation.
	66	* Consult the release documentation for your implementation to see if any
	67	* other algorithms are supported.
	68	*
	69	* <p>
	70	* <b>Concurrent Access</b>
	71	* <p>
	72	* The static methods of this class are guaranteed to be thread-safe.
	73	* Multiple threads may concurrently invoke the static methods defined in
	74	* this class with no ill effects.
	75	* <p>
	76	* However, this is not true for the non-static methods defined by this class.
	77	* Unless otherwise documented by a specific provider, threads that need to
	78	* access a single <code>CertPathValidator</code> instance concurrently should
	79	* synchronize amongst themselves and provide the necessary locking. Multiple
	80	* threads each manipulating a different <code>CertPathValidator</code>
	81	* instance need not synchronize.
	82	*
	83	* @see CertPath
	84	*
	85	* @since 1.4
	86	* @author Yassir Elley
	87	*/
	88	public class CertPathValidator {
	89
	90	/*
	91	* Constant to lookup in the Security properties file to determine
	92	* the default certpathvalidator type. In the Security properties file,
	93	* the default certpathvalidator type is given as:
	94	* <pre>
	95	* certpathvalidator.type=PKIX
	96	* </pre>
	97	*/
	98	private static final String CPV_TYPE = "certpathvalidator.type";
	99	private static final Debug debug = Debug.getInstance("certpath");
	100	private CertPathValidatorSpi validatorSpi;
	101	private Provider provider;
	102	private String algorithm;
	103
	104	/**
	105	* Creates a <code>CertPathValidator</code> object of the given algorithm,
	106	* and encapsulates the given provider implementation (SPI object) in it.
	107	*
	108	* @param validatorSpi the provider implementation
	109	* @param provider the provider
	110	* @param algorithm the algorithm name
	111	*/
	112	protected CertPathValidator(CertPathValidatorSpi validatorSpi,
	113	Provider provider, String algorithm)
	114	{
	115	this.validatorSpi = validatorSpi;
	116	this.provider = provider;
	117	this.algorithm = algorithm;
	118	}
	119
	120	/**
	121	* Returns a <code>CertPathValidator</code> object that implements the
	122	* specified algorithm.
	123	*
	124	* <p> This method traverses the list of registered security Providers,
	125	* starting with the most preferred Provider.
	126	* A new CertPathValidator object encapsulating the
	127	* CertPathValidatorSpi implementation from the first
	128	* Provider that supports the specified algorithm is returned.
	129	*
	130	* <p> Note that the list of registered providers may be retrieved via
	131	* the {@link Security#getProviders() Security.getProviders()} method.
	132	*
	133	* @param algorithm the name of the requested <code>CertPathValidator</code>
	134	* algorithm. See the CertPathValidator section in the <a href=
	135	* "{@docRoot}/../technotes/guides/security/StandardNames.html#CertPathValidator">
	136	* Java Cryptography Architecture Standard Algorithm Name Documentation</a>
	137	* for information about standard algorithm names.
	138	*
	139	* @return a <code>CertPathValidator</code> object that implements the
	140	* specified algorithm.
	141	*
	142	* @exception NoSuchAlgorithmException if no Provider supports a
	143	* CertPathValidatorSpi implementation for the
	144	* specified algorithm.
	145	*
	146	* @see java.security.Provider
	147	*/
	148	public static CertPathValidator getInstance(String algorithm)
	149	throws NoSuchAlgorithmException {
	150	Instance instance = GetInstance.getInstance("CertPathValidator",
	151	CertPathValidatorSpi.class, algorithm);
	152	return new CertPathValidator((CertPathValidatorSpi)instance.impl,
	153	instance.provider, algorithm);
	154	}
	155
	156	/**
	157	* Returns a <code>CertPathValidator</code> object that implements the
	158	* specified algorithm.
	159	*
	160	* <p> A new CertPathValidator object encapsulating the
	161	* CertPathValidatorSpi implementation from the specified provider
	162	* is returned. The specified provider must be registered
	163	* in the security provider list.
	164	*
	165	* <p> Note that the list of registered providers may be retrieved via
	166	* the {@link Security#getProviders() Security.getProviders()} method.
	167	*
	168	* @param algorithm the name of the requested <code>CertPathValidator</code>
	169	* algorithm. See the CertPathValidator section in the <a href=
	170	* "{@docRoot}/../technotes/guides/security/StandardNames.html#CertPathValidator">
	171	* Java Cryptography Architecture Standard Algorithm Name Documentation</a>
	172	* for information about standard algorithm names.
	173	*
	174	* @param provider the name of the provider.
	175	*
	176	* @return a <code>CertPathValidator</code> object that implements the
	177	* specified algorithm.
	178	*
	179	* @exception NoSuchAlgorithmException if a CertPathValidatorSpi
	180	* implementation for the specified algorithm is not
	181	* available from the specified provider.
	182	*
	183	* @exception NoSuchProviderException if the specified provider is not
	184	* registered in the security provider list.
	185	*
	186	* @exception IllegalArgumentException if the <code>provider</code> is
	187	* null or empty.
	188	*
	189	* @see java.security.Provider
	190	*/
	191	public static CertPathValidator getInstance(String algorithm,
	192	String provider) throws NoSuchAlgorithmException,
	193	NoSuchProviderException {
	194	Instance instance = GetInstance.getInstance("CertPathValidator",
	195	CertPathValidatorSpi.class, algorithm, provider);
	196	return new CertPathValidator((CertPathValidatorSpi)instance.impl,
	197	instance.provider, algorithm);
	198	}
	199
	200	/**
	201	* Returns a <code>CertPathValidator</code> object that implements the
	202	* specified algorithm.
	203	*
	204	* <p> A new CertPathValidator object encapsulating the
	205	* CertPathValidatorSpi implementation from the specified Provider
	206	* object is returned. Note that the specified Provider object
	207	* does not have to be registered in the provider list.
	208	*
	209	* @param algorithm the name of the requested <code>CertPathValidator</code>
	210	* algorithm. See the CertPathValidator section in the <a href=
	211	* "{@docRoot}/../technotes/guides/security/StandardNames.html#CertPathValidator">
	212	* Java Cryptography Architecture Standard Algorithm Name Documentation</a>
	213	* for information about standard algorithm names.
	214	*
	215	* @param provider the provider.
	216	*
	217	* @return a <code>CertPathValidator</code> object that implements the
	218	* specified algorithm.
	219	*
	220	* @exception NoSuchAlgorithmException if a CertPathValidatorSpi
	221	* implementation for the specified algorithm is not available
	222	* from the specified Provider object.
	223	*
	224	* @exception IllegalArgumentException if the <code>provider</code> is
	225	* null.
	226	*
	227	* @see java.security.Provider
	228	*/
	229	public static CertPathValidator getInstance(String algorithm,
	230	Provider provider) throws NoSuchAlgorithmException {
	231	Instance instance = GetInstance.getInstance("CertPathValidator",
	232	CertPathValidatorSpi.class, algorithm, provider);
	233	return new CertPathValidator((CertPathValidatorSpi)instance.impl,
	234	instance.provider, algorithm);
	235	}
	236
	237	/**
	238	* Returns the <code>Provider</code> of this
	239	* <code>CertPathValidator</code>.
	240	*
	241	* @return the <code>Provider</code> of this <code>CertPathValidator</code>
	242	*/
	243	public final Provider getProvider() {
	244	return this.provider;
	245	}
	246
	247	/**
	248	* Returns the algorithm name of this <code>CertPathValidator</code>.
	249	*
	250	* @return the algorithm name of this <code>CertPathValidator</code>
	251	*/
	252	public final String getAlgorithm() {
	253	return this.algorithm;
	254	}
	255
	256	/**
	257	* Validates the specified certification path using the specified
	258	* algorithm parameter set.
	259	* <p>
	260	* The <code>CertPath</code> specified must be of a type that is
	261	* supported by the validation algorithm, otherwise an
	262	* <code>InvalidAlgorithmParameterException</code> will be thrown. For
	263	* example, a <code>CertPathValidator</code> that implements the PKIX
	264	* algorithm validates <code>CertPath</code> objects of type X.509.
	265	*
	266	* @param certPath the <code>CertPath</code> to be validated
	267	* @param params the algorithm parameters
	268	* @return the result of the validation algorithm
	269	* @exception CertPathValidatorException if the <code>CertPath</code>
	270	* does not validate
	271	* @exception InvalidAlgorithmParameterException if the specified
	272	* parameters or the type of the specified <code>CertPath</code> are
	273	* inappropriate for this <code>CertPathValidator</code>
	274	*/
	275	public final CertPathValidatorResult validate(CertPath certPath,
	276	CertPathParameters params)
	277	throws CertPathValidatorException, InvalidAlgorithmParameterException
	278	{
	279	return validatorSpi.engineValidate(certPath, params);
	280	}
	281
	282	/**
	283	* Returns the default <code>CertPathValidator</code> type as specified in
	284	* the Java security properties file, or the string "PKIX"
	285	* if no such property exists. The Java security properties file is
	286	* located in the file named <JAVA_HOME>/lib/security/java.security.
	287	* <JAVA_HOME> refers to the value of the java.home system property,
	288	* and specifies the directory where the JRE is installed.
	289	*
	290	* <p>The default <code>CertPathValidator</code> type can be used by
	291	* applications that do not want to use a hard-coded type when calling one
	292	* of the <code>getInstance</code> methods, and want to provide a default
	293	* type in case a user does not specify its own.
	294	*
	295	* <p>The default <code>CertPathValidator</code> type can be changed by
	296	* setting the value of the "certpathvalidator.type" security property
	297	* (in the Java security properties file) to the desired type.
	298	*
	299	* @return the default <code>CertPathValidator</code> type as specified
	300	* in the Java security properties file, or the string "PKIX"
	301	* if no such property exists.
	302	*/
	303	public final static String getDefaultType() {
	304	String cpvtype;
	305	cpvtype = AccessController.doPrivileged(new PrivilegedAction<String>() {
	306	public String run() {
	307	return Security.getProperty(CPV_TYPE);
	308	}
	309	});
	310	if (cpvtype == null) {
	311	cpvtype = "PKIX";
	312	}
	313	return cpvtype;
	314	}
	315	}

java/pkg/java/security/cert/CertPathValidatorException$BasicReason.class+0−0

Binary file not shown.

java/pkg/java/security/cert/CertPathValidatorException$Reason.class+0−0

Binary file not shown.

java/pkg/java/security/cert/CertPathValidatorException.class+0−0

Binary file not shown.

java/pkg/java/security/cert/CertPathValidatorException.java+296−0

@@ -0,0 +1,296 @@
	1	/*
	2	* Copyright (c) 2000, 2011, Oracle and/or its affiliates. All rights reserved.
	3	* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
	4	*
	5	* This code is free software; you can redistribute it and/or modify it
	6	* under the terms of the GNU General Public License version 2 only, as
	7	* published by the Free Software Foundation. Oracle designates this
	8	* particular file as subject to the "Classpath" exception as provided
	9	* by Oracle in the LICENSE file that accompanied this code.
	10	*
	11	* This code is distributed in the hope that it will be useful, but WITHOUT
	12	* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
	13	* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
	14	* version 2 for more details (a copy is included in the LICENSE file that
	15	* accompanied this code).
	16	*
	17	* You should have received a copy of the GNU General Public License version
	18	* 2 along with this work; if not, write to the Free Software Foundation,
	19	* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
	20	*
	21	* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
	22	* or visit www.oracle.com if you need additional information or have any
	23	* questions.
	24	*/
	25
	26	package java.security.cert;
	27
	28	import java.io.InvalidObjectException;
	29	import java.io.IOException;
	30	import java.io.ObjectInputStream;
	31	import java.security.GeneralSecurityException;
	32
	33	/**
	34	* An exception indicating one of a variety of problems encountered when
	35	* validating a certification path.
	36	* <p>
	37	* A <code>CertPathValidatorException</code> provides support for wrapping
	38	* exceptions. The {@link #getCause getCause} method returns the throwable,
	39	* if any, that caused this exception to be thrown.
	40	* <p>
	41	* A <code>CertPathValidatorException</code> may also include the
	42	* certification path that was being validated when the exception was thrown,
	43	* the index of the certificate in the certification path that caused the
	44	* exception to be thrown, and the reason that caused the failure. Use the
	45	* {@link #getCertPath getCertPath}, {@link #getIndex getIndex}, and
	46	* {@link #getReason getReason} methods to retrieve this information.
	47	*
	48	* <p>
	49	* <b>Concurrent Access</b>
	50	* <p>
	51	* Unless otherwise specified, the methods defined in this class are not
	52	* thread-safe. Multiple threads that need to access a single
	53	* object concurrently should synchronize amongst themselves and
	54	* provide the necessary locking. Multiple threads each manipulating
	55	* separate objects need not synchronize.
	56	*
	57	* @see CertPathValidator
	58	*
	59	* @since 1.4
	60	* @author Yassir Elley
	61	*/
	62	public class CertPathValidatorException extends GeneralSecurityException {
	63
	64	private static final long serialVersionUID = -3083180014971893139L;
	65
	66	/**
	67	* @serial the index of the certificate in the certification path
	68	* that caused the exception to be thrown
	69	*/
	70	private int index = -1;
	71
	72	/**
	73	* @serial the <code>CertPath</code> that was being validated when
	74	* the exception was thrown
	75	*/
	76	private CertPath certPath;
	77
	78	/**
	79	* @serial the reason the validation failed
	80	*/
	81	private Reason reason = BasicReason.UNSPECIFIED;
	82
	83	/**
	84	* Creates a <code>CertPathValidatorException</code> with
	85	* no detail message.
	86	*/
	87	public CertPathValidatorException() {
	88	this(null, null);
	89	}
	90
	91	/**
	92	* Creates a <code>CertPathValidatorException</code> with the given
	93	* detail message. A detail message is a <code>String</code> that
	94	* describes this particular exception.
	95	*
	96	* @param msg the detail message
	97	*/
	98	public CertPathValidatorException(String msg) {
	99	this(msg, null);
	100	}
	101
	102	/**
	103	* Creates a <code>CertPathValidatorException</code> that wraps the
	104	* specified throwable. This allows any exception to be converted into a
	105	* <code>CertPathValidatorException</code>, while retaining information
	106	* about the wrapped exception, which may be useful for debugging. The
	107	* detail message is set to (<code>cause==null ? null : cause.toString()
	108	* </code>) (which typically contains the class and detail message of
	109	* cause).
	110	*
	111	* @param cause the cause (which is saved for later retrieval by the
	112	* {@link #getCause getCause()} method). (A <code>null</code> value is
	113	* permitted, and indicates that the cause is nonexistent or unknown.)
	114	*/
	115	public CertPathValidatorException(Throwable cause) {
	116	this((cause == null ? null : cause.toString()), cause);
	117	}
	118
	119	/**
	120	* Creates a <code>CertPathValidatorException</code> with the specified
	121	* detail message and cause.
	122	*
	123	* @param msg the detail message
	124	* @param cause the cause (which is saved for later retrieval by the
	125	* {@link #getCause getCause()} method). (A <code>null</code> value is
	126	* permitted, and indicates that the cause is nonexistent or unknown.)
	127	*/
	128	public CertPathValidatorException(String msg, Throwable cause) {
	129	this(msg, cause, null, -1);
	130	}
	131
	132	/**
	133	* Creates a <code>CertPathValidatorException</code> with the specified
	134	* detail message, cause, certification path, and index.
	135	*
	136	* @param msg the detail message (or <code>null</code> if none)
	137	* @param cause the cause (or <code>null</code> if none)
	138	* @param certPath the certification path that was in the process of
	139	* being validated when the error was encountered
	140	* @param index the index of the certificate in the certification path
	141	* that caused the error (or -1 if not applicable). Note that
	142	* the list of certificates in a <code>CertPath</code> is zero based.
	143	* @throws IndexOutOfBoundsException if the index is out of range
	144	* <code>(index < -1 \|\| (certPath != null && index >=
	145	* certPath.getCertificates().size())</code>
	146	* @throws IllegalArgumentException if <code>certPath</code> is
	147	* <code>null</code> and <code>index</code> is not -1
	148	*/
	149	public CertPathValidatorException(String msg, Throwable cause,
	150	CertPath certPath, int index) {
	151	this(msg, cause, certPath, index, BasicReason.UNSPECIFIED);
	152	}
	153
	154	/**
	155	* Creates a <code>CertPathValidatorException</code> with the specified
	156	* detail message, cause, certification path, index, and reason.
	157	*
	158	* @param msg the detail message (or <code>null</code> if none)
	159	* @param cause the cause (or <code>null</code> if none)
	160	* @param certPath the certification path that was in the process of
	161	* being validated when the error was encountered
	162	* @param index the index of the certificate in the certification path
	163	* that caused the error (or -1 if not applicable). Note that
	164	* the list of certificates in a <code>CertPath</code> is zero based.
	165	* @param reason the reason the validation failed
	166	* @throws IndexOutOfBoundsException if the index is out of range
	167	* <code>(index < -1 \|\| (certPath != null && index >=
	168	* certPath.getCertificates().size())</code>
	169	* @throws IllegalArgumentException if <code>certPath</code> is
	170	* <code>null</code> and <code>index</code> is not -1
	171	* @throws NullPointerException if <code>reason</code> is <code>null</code>
	172	*
	173	* @since 1.7
	174	*/
	175	public CertPathValidatorException(String msg, Throwable cause,
	176	CertPath certPath, int index, Reason reason) {
	177	super(msg, cause);
	178	if (certPath == null && index != -1) {
	179	throw new IllegalArgumentException();
	180	}
	181	if (index < -1 \|\|
	182	(certPath != null && index >= certPath.getCertificates().size())) {
	183	throw new IndexOutOfBoundsException();
	184	}
	185	if (reason == null) {
	186	throw new NullPointerException("reason can't be null");
	187	}
	188	this.certPath = certPath;
	189	this.index = index;
	190	this.reason = reason;
	191	}
	192
	193	/**
	194	* Returns the certification path that was being validated when
	195	* the exception was thrown.
	196	*
	197	* @return the <code>CertPath</code> that was being validated when
	198	* the exception was thrown (or <code>null</code> if not specified)
	199	*/
	200	public CertPath getCertPath() {
	201	return this.certPath;
	202	}
	203
	204	/**
	205	* Returns the index of the certificate in the certification path
	206	* that caused the exception to be thrown. Note that the list of
	207	* certificates in a <code>CertPath</code> is zero based. If no
	208	* index has been set, -1 is returned.
	209	*
	210	* @return the index that has been set, or -1 if none has been set
	211	*/
	212	public int getIndex() {
	213	return this.index;
	214	}
	215
	216	/**
	217	* Returns the reason that the validation failed. The reason is
	218	* associated with the index of the certificate returned by
	219	* {@link #getIndex}.
	220	*
	221	* @return the reason that the validation failed, or
	222	* <code>BasicReason.UNSPECIFIED</code> if a reason has not been
	223	* specified
	224	*
	225	* @since 1.7
	226	*/
	227	public Reason getReason() {
	228	return this.reason;
	229	}
	230
	231	private void readObject(ObjectInputStream stream)
	232	throws ClassNotFoundException, IOException {
	233	stream.defaultReadObject();
	234	if (reason == null) {
	235	reason = BasicReason.UNSPECIFIED;
	236	}
	237	if (certPath == null && index != -1) {
	238	throw new InvalidObjectException("certpath is null and index != -1");
	239	}
	240	if (index < -1 \|\|
	241	(certPath != null && index >= certPath.getCertificates().size())) {
	242	throw new InvalidObjectException("index out of range");
	243	}
	244	}
	245
	246	/**
	247	* The reason the validation algorithm failed.
	248	*
	249	* @since 1.7
	250	*/
	251	public static interface Reason extends java.io.Serializable { }
	252
	253
	254	/**
	255	* The BasicReason enumerates the potential reasons that a certification
	256	* path of any type may be invalid.
	257	*
	258	* @since 1.7
	259	*/
	260	public static enum BasicReason implements Reason {
	261	/**
	262	* Unspecified reason.
	263	*/
	264	UNSPECIFIED,
	265
	266	/**
	267	* The certificate is expired.
	268	*/
	269	EXPIRED,
	270
	271	/**
	272	* The certificate is not yet valid.
	273	*/
	274	NOT_YET_VALID,
	275
	276	/**
	277	* The certificate is revoked.
	278	*/
	279	REVOKED,
	280
	281	/**
	282	* The revocation status of the certificate could not be determined.
	283	*/
	284	UNDETERMINED_REVOCATION_STATUS,
	285
	286	/**
	287	* The signature is invalid.
	288	*/
	289	INVALID_SIGNATURE,
	290
	291	/**
	292	* The public key or the signature algorithm has been constrained.
	293	*/
	294	ALGORITHM_CONSTRAINED
	295	}
	296	}

java/pkg/java/security/cert/CertPathValidatorResult.class+0−0

Binary file not shown.

java/pkg/java/security/cert/CertPathValidatorResult.java+50−0

@@ -0,0 +1,50 @@
	1	/*
	2	* Copyright (c) 2000, 2001, Oracle and/or its affiliates. All rights reserved.
	3	* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
	4	*
	5	* This code is free software; you can redistribute it and/or modify it
	6	* under the terms of the GNU General Public License version 2 only, as
	7	* published by the Free Software Foundation. Oracle designates this
	8	* particular file as subject to the "Classpath" exception as provided
	9	* by Oracle in the LICENSE file that accompanied this code.
	10	*
	11	* This code is distributed in the hope that it will be useful, but WITHOUT
	12	* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
	13	* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
	14	* version 2 for more details (a copy is included in the LICENSE file that
	15	* accompanied this code).
	16	*
	17	* You should have received a copy of the GNU General Public License version
	18	* 2 along with this work; if not, write to the Free Software Foundation,
	19	* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
	20	*
	21	* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
	22	* or visit www.oracle.com if you need additional information or have any
	23	* questions.
	24	*/
	25
	26	package java.security.cert;
	27
	28	/**
	29	* A specification of the result of a certification path validator algorithm.
	30	* <p>
	31	* The purpose of this interface is to group (and provide type safety
	32	* for) all certification path validator results. All results returned
	33	* by the {@link CertPathValidator#validate CertPathValidator.validate}
	34	* method must implement this interface.
	35	*
	36	* @see CertPathValidator
	37	*
	38	* @since 1.4
	39	* @author Yassir Elley
	40	*/
	41	public interface CertPathValidatorResult extends Cloneable {
	42
	43	/**
	44	* Makes a copy of this <code>CertPathValidatorResult</code>. Changes to the
	45	* copy will not affect the original and vice versa.
	46	*
	47	* @return a copy of this <code>CertPathValidatorResult</code>
	48	*/
	49	Object clone();
	50	}

java/pkg/java/security/cert/CertPathValidatorSpi.class+0−0

Binary file not shown.

java/pkg/java/security/cert/CertPathValidatorSpi.java+85−0

@@ -0,0 +1,85 @@
	1	/*
	2	* Copyright (c) 2000, 2001, Oracle and/or its affiliates. All rights reserved.
	3	* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
	4	*
	5	* This code is free software; you can redistribute it and/or modify it
	6	* under the terms of the GNU General Public License version 2 only, as
	7	* published by the Free Software Foundation. Oracle designates this
	8	* particular file as subject to the "Classpath" exception as provided
	9	* by Oracle in the LICENSE file that accompanied this code.
	10	*
	11	* This code is distributed in the hope that it will be useful, but WITHOUT
	12	* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
	13	* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
	14	* version 2 for more details (a copy is included in the LICENSE file that
	15	* accompanied this code).
	16	*
	17	* You should have received a copy of the GNU General Public License version
	18	* 2 along with this work; if not, write to the Free Software Foundation,
	19	* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
	20	*
	21	* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
	22	* or visit www.oracle.com if you need additional information or have any
	23	* questions.
	24	*/
	25
	26	package java.security.cert;
	27
	28	import java.security.InvalidAlgorithmParameterException;
	29
	30	/**
	31	*
	32	* The <i>Service Provider Interface</i> (<b>SPI</b>)
	33	* for the {@link CertPathValidator CertPathValidator} class. All
	34	* <code>CertPathValidator</code> implementations must include a class (the
	35	* SPI class) that extends this class (<code>CertPathValidatorSpi</code>)
	36	* and implements all of its methods. In general, instances of this class
	37	* should only be accessed through the <code>CertPathValidator</code> class.
	38	* For details, see the Java Cryptography Architecture.
	39	* <p>
	40	* <b>Concurrent Access</b>
	41	* <p>
	42	* Instances of this class need not be protected against concurrent
	43	* access from multiple threads. Threads that need to access a single
	44	* <code>CertPathValidatorSpi</code> instance concurrently should synchronize
	45	* amongst themselves and provide the necessary locking before calling the
	46	* wrapping <code>CertPathValidator</code> object.
	47	* <p>
	48	* However, implementations of <code>CertPathValidatorSpi</code> may still
	49	* encounter concurrency issues, since multiple threads each
	50	* manipulating a different <code>CertPathValidatorSpi</code> instance need not
	51	* synchronize.
	52	*
	53	* @since 1.4
	54	* @author Yassir Elley
	55	*/
	56	public abstract class CertPathValidatorSpi {
	57
	58	/**
	59	* The default constructor.
	60	*/
	61	public CertPathValidatorSpi() {}
	62
	63	/**
	64	* Validates the specified certification path using the specified
	65	* algorithm parameter set.
	66	* <p>
	67	* The <code>CertPath</code> specified must be of a type that is
	68	* supported by the validation algorithm, otherwise an
	69	* <code>InvalidAlgorithmParameterException</code> will be thrown. For
	70	* example, a <code>CertPathValidator</code> that implements the PKIX
	71	* algorithm validates <code>CertPath</code> objects of type X.509.
	72	*
	73	* @param certPath the <code>CertPath</code> to be validated
	74	* @param params the algorithm parameters
	75	* @return the result of the validation algorithm
	76	* @exception CertPathValidatorException if the <code>CertPath</code>
	77	* does not validate
	78	* @exception InvalidAlgorithmParameterException if the specified
	79	* parameters or the type of the specified <code>CertPath</code> are
	80	* inappropriate for this <code>CertPathValidator</code>
	81	*/
	82	public abstract CertPathValidatorResult
	83	engineValidate(CertPath certPath, CertPathParameters params)
	84	throws CertPathValidatorException, InvalidAlgorithmParameterException;
	85	}

java/pkg/java/security/cert/CertSelector.class+0−0

Binary file not shown.

java/pkg/java/security/cert/CertSelector.java+67−0

@@ -0,0 +1,67 @@
	1	/*
	2	* Copyright (c) 2000, 2001, Oracle and/or its affiliates. All rights reserved.
	3	* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
	4	*
	5	* This code is free software; you can redistribute it and/or modify it
	6	* under the terms of the GNU General Public License version 2 only, as
	7	* published by the Free Software Foundation. Oracle designates this
	8	* particular file as subject to the "Classpath" exception as provided
	9	* by Oracle in the LICENSE file that accompanied this code.
	10	*
	11	* This code is distributed in the hope that it will be useful, but WITHOUT
	12	* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
	13	* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
	14	* version 2 for more details (a copy is included in the LICENSE file that
	15	* accompanied this code).
	16	*
	17	* You should have received a copy of the GNU General Public License version
	18	* 2 along with this work; if not, write to the Free Software Foundation,
	19	* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
	20	*
	21	* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
	22	* or visit www.oracle.com if you need additional information or have any
	23	* questions.
	24	*/
	25
	26	package java.security.cert;
	27
	28	/**
	29	* A selector that defines a set of criteria for selecting
	30	* <code>Certificate</code>s. Classes that implement this interface
	31	* are often used to specify which <code>Certificate</code>s should
	32	* be retrieved from a <code>CertStore</code>.
	33	* <p>
	34	* <b>Concurrent Access</b>
	35	* <p>
	36	* Unless otherwise specified, the methods defined in this interface are not
	37	* thread-safe. Multiple threads that need to access a single
	38	* object concurrently should synchronize amongst themselves and
	39	* provide the necessary locking. Multiple threads each manipulating
	40	* separate objects need not synchronize.
	41	*
	42	* @see Certificate
	43	* @see CertStore
	44	* @see CertStore#getCertificates
	45	*
	46	* @author Steve Hanna
	47	* @since 1.4
	48	*/
	49	public interface CertSelector extends Cloneable {
	50
	51	/**
	52	* Decides whether a <code>Certificate</code> should be selected.
	53	*
	54	* @param cert the <code>Certificate</code> to be checked
	55	* @return <code>true</code> if the <code>Certificate</code>
	56	* should be selected, <code>false</code> otherwise
	57	*/
	58	boolean match(Certificate cert);
	59
	60	/**
	61	* Makes a copy of this <code>CertSelector</code>. Changes to the
	62	* copy will not affect the original and vice versa.
	63	*
	64	* @return a copy of this <code>CertSelector</code>
	65	*/
	66	Object clone();
	67	}

java/pkg/java/security/cert/CertStore$1.class+0−0

Binary file not shown.

java/pkg/java/security/cert/CertStore.class+0−0

Binary file not shown.

java/pkg/java/security/cert/CertStore.java+424−0

@@ -0,0 +1,424 @@
	1	/*
	2	* Copyright (c) 2000, 2011, Oracle and/or its affiliates. All rights reserved.
	3	* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
	4	*
	5	* This code is free software; you can redistribute it and/or modify it
	6	* under the terms of the GNU General Public License version 2 only, as
	7	* published by the Free Software Foundation. Oracle designates this
	8	* particular file as subject to the "Classpath" exception as provided
	9	* by Oracle in the LICENSE file that accompanied this code.
	10	*
	11	* This code is distributed in the hope that it will be useful, but WITHOUT
	12	* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
	13	* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
	14	* version 2 for more details (a copy is included in the LICENSE file that
	15	* accompanied this code).
	16	*
	17	* You should have received a copy of the GNU General Public License version
	18	* 2 along with this work; if not, write to the Free Software Foundation,
	19	* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
	20	*
	21	* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
	22	* or visit www.oracle.com if you need additional information or have any
	23	* questions.
	24	*/
	25
	26	package java.security.cert;
	27
	28	import java.security.AccessController;
	29	import java.security.InvalidAlgorithmParameterException;
	30	import java.security.NoSuchAlgorithmException;
	31	import java.security.NoSuchProviderException;
	32	import java.security.PrivilegedAction;
	33	import java.security.Provider;
	34	import java.security.Security;
	35	import java.util.Collection;
	36
	37	import sun.security.jca.*;
	38	import sun.security.jca.GetInstance.Instance;
	39
	40	/**
	41	* A class for retrieving <code>Certificate</code>s and <code>CRL</code>s
	42	* from a repository.
	43	* <p>
	44	* This class uses a provider-based architecture.
	45	* To create a <code>CertStore</code>, call one of the static
	46	* <code>getInstance</code> methods, passing in the type of
	47	* <code>CertStore</code> desired, any applicable initialization parameters
	48	* and optionally the name of the provider desired.
	49	* <p>
	50	* Once the <code>CertStore</code> has been created, it can be used to
	51	* retrieve <code>Certificate</code>s and <code>CRL</code>s by calling its
	52	* {@link #getCertificates(CertSelector selector) getCertificates} and
	53	* {@link #getCRLs(CRLSelector selector) getCRLs} methods.
	54	* <p>
	55	* Unlike a {@link java.security.KeyStore KeyStore}, which provides access
	56	* to a cache of private keys and trusted certificates, a
	57	* <code>CertStore</code> is designed to provide access to a potentially
	58	* vast repository of untrusted certificates and CRLs. For example, an LDAP
	59	* implementation of <code>CertStore</code> provides access to certificates
	60	* and CRLs stored in one or more directories using the LDAP protocol and the
	61	* schema as defined in the RFC service attribute.
	62	*
	63	* <p> Every implementation of the Java platform is required to support the
	64	* following standard <code>CertStore</code> type:
	65	* <ul>
	66	* <li><tt>Collection</tt></li>
	67	* </ul>
	68	* This type is described in the <a href=
	69	* "{@docRoot}/../technotes/guides/security/StandardNames.html#CertStore">
	70	* CertStore section</a> of the
	71	* Java Cryptography Architecture Standard Algorithm Name Documentation.
	72	* Consult the release documentation for your implementation to see if any
	73	* other types are supported.
	74	*
	75	* <p>
	76	* <b>Concurrent Access</b>
	77	* <p>
	78	* All public methods of <code>CertStore</code> objects must be thread-safe.
	79	* That is, multiple threads may concurrently invoke these methods on a
	80	* single <code>CertStore</code> object (or more than one) with no
	81	* ill effects. This allows a <code>CertPathBuilder</code> to search for a
	82	* CRL while simultaneously searching for further certificates, for instance.
	83	* <p>
	84	* The static methods of this class are also guaranteed to be thread-safe.
	85	* Multiple threads may concurrently invoke the static methods defined in
	86	* this class with no ill effects.
	87	*
	88	* @since 1.4
	89	* @author Sean Mullan, Steve Hanna
	90	*/
	91	public class CertStore {
	92	/*
	93	* Constant to lookup in the Security properties file to determine
	94	* the default certstore type. In the Security properties file, the
	95	* default certstore type is given as:
	96	* <pre>
	97	* certstore.type=LDAP
	98	* </pre>
	99	*/
	100	private static final String CERTSTORE_TYPE = "certstore.type";
	101	private CertStoreSpi storeSpi;
	102	private Provider provider;
	103	private String type;
	104	private CertStoreParameters params;
	105
	106	/**
	107	* Creates a <code>CertStore</code> object of the given type, and
	108	* encapsulates the given provider implementation (SPI object) in it.
	109	*
	110	* @param storeSpi the provider implementation
	111	* @param provider the provider
	112	* @param type the type
	113	* @param params the initialization parameters (may be <code>null</code>)
	114	*/
	115	protected CertStore(CertStoreSpi storeSpi, Provider provider,
	116	String type, CertStoreParameters params) {
	117	this.storeSpi = storeSpi;
	118	this.provider = provider;
	119	this.type = type;
	120	if (params != null)
	121	this.params = (CertStoreParameters) params.clone();
	122	}
	123
	124	/**
	125	* Returns a <code>Collection</code> of <code>Certificate</code>s that
	126	* match the specified selector. If no <code>Certificate</code>s
	127	* match the selector, an empty <code>Collection</code> will be returned.
	128	* <p>
	129	* For some <code>CertStore</code> types, the resulting
	130	* <code>Collection</code> may not contain <b>all</b> of the
	131	* <code>Certificate</code>s that match the selector. For instance,
	132	* an LDAP <code>CertStore</code> may not search all entries in the
	133	* directory. Instead, it may just search entries that are likely to
	134	* contain the <code>Certificate</code>s it is looking for.
	135	* <p>
	136	* Some <code>CertStore</code> implementations (especially LDAP
	137	* <code>CertStore</code>s) may throw a <code>CertStoreException</code>
	138	* unless a non-null <code>CertSelector</code> is provided that
	139	* includes specific criteria that can be used to find the certificates.
	140	* Issuer and/or subject names are especially useful criteria.
	141	*
	142	* @param selector A <code>CertSelector</code> used to select which
	143	* <code>Certificate</code>s should be returned. Specify <code>null</code>
	144	* to return all <code>Certificate</code>s (if supported).
	145	* @return A <code>Collection</code> of <code>Certificate</code>s that
	146	* match the specified selector (never <code>null</code>)
	147	* @throws CertStoreException if an exception occurs
	148	*/
	149	public final Collection<? extends Certificate> getCertificates
	150	(CertSelector selector) throws CertStoreException {
	151	return storeSpi.engineGetCertificates(selector);
	152	}
	153
	154	/**
	155	* Returns a <code>Collection</code> of <code>CRL</code>s that
	156	* match the specified selector. If no <code>CRL</code>s
	157	* match the selector, an empty <code>Collection</code> will be returned.
	158	* <p>
	159	* For some <code>CertStore</code> types, the resulting
	160	* <code>Collection</code> may not contain <b>all</b> of the
	161	* <code>CRL</code>s that match the selector. For instance,
	162	* an LDAP <code>CertStore</code> may not search all entries in the
	163	* directory. Instead, it may just search entries that are likely to
	164	* contain the <code>CRL</code>s it is looking for.
	165	* <p>
	166	* Some <code>CertStore</code> implementations (especially LDAP
	167	* <code>CertStore</code>s) may throw a <code>CertStoreException</code>
	168	* unless a non-null <code>CRLSelector</code> is provided that
	169	* includes specific criteria that can be used to find the CRLs.
	170	* Issuer names and/or the certificate to be checked are especially useful.
	171	*
	172	* @param selector A <code>CRLSelector</code> used to select which
	173	* <code>CRL</code>s should be returned. Specify <code>null</code>
	174	* to return all <code>CRL</code>s (if supported).
	175	* @return A <code>Collection</code> of <code>CRL</code>s that
	176	* match the specified selector (never <code>null</code>)
	177	* @throws CertStoreException if an exception occurs
	178	*/
	179	public final Collection<? extends CRL> getCRLs(CRLSelector selector)
	180	throws CertStoreException {
	181	return storeSpi.engineGetCRLs(selector);
	182	}
	183
	184	/**
	185	* Returns a <code>CertStore</code> object that implements the specified
	186	* <code>CertStore</code> type and is initialized with the specified
	187	* parameters.
	188	*
	189	* <p> This method traverses the list of registered security Providers,
	190	* starting with the most preferred Provider.
	191	* A new CertStore object encapsulating the
	192	* CertStoreSpi implementation from the first
	193	* Provider that supports the specified type is returned.
	194	*
	195	* <p> Note that the list of registered providers may be retrieved via
	196	* the {@link Security#getProviders() Security.getProviders()} method.
	197	*
	198	* <p>The <code>CertStore</code> that is returned is initialized with the
	199	* specified <code>CertStoreParameters</code>. The type of parameters
	200	* needed may vary between different types of <code>CertStore</code>s.
	201	* Note that the specified <code>CertStoreParameters</code> object is
	202	* cloned.
	203	*
	204	* @param type the name of the requested <code>CertStore</code> type.
	205	* See the CertStore section in the <a href=
	206	* "{@docRoot}/../technotes/guides/security/StandardNames.html#CertStore">
	207	* Java Cryptography Architecture Standard Algorithm Name Documentation</a>
	208	* for information about standard types.
	209	*
	210	* @param params the initialization parameters (may be <code>null</code>).
	211	*
	212	* @return a <code>CertStore</code> object that implements the specified
	213	* <code>CertStore</code> type.
	214	*
	215	* @throws NoSuchAlgorithmException if no Provider supports a
	216	* CertStoreSpi implementation for the specified type.
	217	*
	218	* @throws InvalidAlgorithmParameterException if the specified
	219	* initialization parameters are inappropriate for this
	220	* <code>CertStore</code>.
	221	*
	222	* @see java.security.Provider
	223	*/
	224	public static CertStore getInstance(String type, CertStoreParameters params)
	225	throws InvalidAlgorithmParameterException,
	226	NoSuchAlgorithmException {
	227	try {
	228	Instance instance = GetInstance.getInstance("CertStore",
	229	CertStoreSpi.class, type, params);
	230	return new CertStore((CertStoreSpi)instance.impl,
	231	instance.provider, type, params);
	232	} catch (NoSuchAlgorithmException e) {
	233	return handleException(e);
	234	}
	235	}
	236
	237	private static CertStore handleException(NoSuchAlgorithmException e)
	238	throws NoSuchAlgorithmException, InvalidAlgorithmParameterException {
	239	Throwable cause = e.getCause();
	240	if (cause instanceof InvalidAlgorithmParameterException) {
	241	throw (InvalidAlgorithmParameterException)cause;
	242	}
	243	throw e;
	244	}
	245
	246	/**
	247	* Returns a <code>CertStore</code> object that implements the specified
	248	* <code>CertStore</code> type.
	249	*
	250	* <p> A new CertStore object encapsulating the
	251	* CertStoreSpi implementation from the specified provider
	252	* is returned. The specified provider must be registered
	253	* in the security provider list.
	254	*
	255	* <p> Note that the list of registered providers may be retrieved via
	256	* the {@link Security#getProviders() Security.getProviders()} method.
	257	*
	258	* <p>The <code>CertStore</code> that is returned is initialized with the
	259	* specified <code>CertStoreParameters</code>. The type of parameters
	260	* needed may vary between different types of <code>CertStore</code>s.
	261	* Note that the specified <code>CertStoreParameters</code> object is
	262	* cloned.
	263	*
	264	* @param type the requested <code>CertStore</code> type.
	265	* See the CertStore section in the <a href=
	266	* "{@docRoot}/../technotes/guides/security/StandardNames.html#CertStore">
	267	* Java Cryptography Architecture Standard Algorithm Name Documentation</a>
	268	* for information about standard types.
	269	*
	270	* @param params the initialization parameters (may be <code>null</code>).
	271	*
	272	* @param provider the name of the provider.
	273	*
	274	* @return a <code>CertStore</code> object that implements the
	275	* specified type.
	276	*
	277	* @throws NoSuchAlgorithmException if a CertStoreSpi
	278	* implementation for the specified type is not
	279	* available from the specified provider.
	280	*
	281	* @throws InvalidAlgorithmParameterException if the specified
	282	* initialization parameters are inappropriate for this
	283	* <code>CertStore</code>.
	284	*
	285	* @throws NoSuchProviderException if the specified provider is not
	286	* registered in the security provider list.
	287	*
	288	* @exception IllegalArgumentException if the <code>provider</code> is
	289	* null or empty.
	290	*
	291	* @see java.security.Provider
	292	*/
	293	public static CertStore getInstance(String type,
	294	CertStoreParameters params, String provider)
	295	throws InvalidAlgorithmParameterException,
	296	NoSuchAlgorithmException, NoSuchProviderException {
	297	try {
	298	Instance instance = GetInstance.getInstance("CertStore",
	299	CertStoreSpi.class, type, params, provider);
	300	return new CertStore((CertStoreSpi)instance.impl,
	301	instance.provider, type, params);
	302	} catch (NoSuchAlgorithmException e) {
	303	return handleException(e);
	304	}
	305	}
	306
	307	/**
	308	* Returns a <code>CertStore</code> object that implements the specified
	309	* <code>CertStore</code> type.
	310	*
	311	* <p> A new CertStore object encapsulating the
	312	* CertStoreSpi implementation from the specified Provider
	313	* object is returned. Note that the specified Provider object
	314	* does not have to be registered in the provider list.
	315	*
	316	* <p>The <code>CertStore</code> that is returned is initialized with the
	317	* specified <code>CertStoreParameters</code>. The type of parameters
	318	* needed may vary between different types of <code>CertStore</code>s.
	319	* Note that the specified <code>CertStoreParameters</code> object is
	320	* cloned.
	321	*
	322	* @param type the requested <code>CertStore</code> type.
	323	* See the CertStore section in the <a href=
	324	* "{@docRoot}/../technotes/guides/security/StandardNames.html#CertStore">
	325	* Java Cryptography Architecture Standard Algorithm Name Documentation</a>
	326	* for information about standard types.
	327	*
	328	* @param params the initialization parameters (may be <code>null</code>).
	329	*
	330	* @param provider the provider.
	331	*
	332	* @return a <code>CertStore</code> object that implements the
	333	* specified type.
	334	*
	335	* @exception NoSuchAlgorithmException if a CertStoreSpi
	336	* implementation for the specified type is not available
	337	* from the specified Provider object.
	338	*
	339	* @throws InvalidAlgorithmParameterException if the specified
	340	* initialization parameters are inappropriate for this
	341	* <code>CertStore</code>
	342	*
	343	* @exception IllegalArgumentException if the <code>provider</code> is
	344	* null.
	345	*
	346	* @see java.security.Provider
	347	*/
	348	public static CertStore getInstance(String type, CertStoreParameters params,
	349	Provider provider) throws NoSuchAlgorithmException,
	350	InvalidAlgorithmParameterException {
	351	try {
	352	Instance instance = GetInstance.getInstance("CertStore",
	353	CertStoreSpi.class, type, params, provider);
	354	return new CertStore((CertStoreSpi)instance.impl,
	355	instance.provider, type, params);
	356	} catch (NoSuchAlgorithmException e) {
	357	return handleException(e);
	358	}
	359	}
	360
	361	/**
	362	* Returns the parameters used to initialize this <code>CertStore</code>.
	363	* Note that the <code>CertStoreParameters</code> object is cloned before
	364	* it is returned.
	365	*
	366	* @return the parameters used to initialize this <code>CertStore</code>
	367	* (may be <code>null</code>)
	368	*/
	369	public final CertStoreParameters getCertStoreParameters() {
	370	return (params == null ? null : (CertStoreParameters) params.clone());
	371	}
	372
	373	/**
	374	* Returns the type of this <code>CertStore</code>.
	375	*
	376	* @return the type of this <code>CertStore</code>
	377	*/
	378	public final String getType() {
	379	return this.type;
	380	}
	381
	382	/**
	383	* Returns the provider of this <code>CertStore</code>.
	384	*
	385	* @return the provider of this <code>CertStore</code>
	386	*/
	387	public final Provider getProvider() {
	388	return this.provider;
	389	}
	390
	391	/**
	392	* Returns the default <code>CertStore</code> type as specified in the
	393	* Java security properties file, or the string "LDAP" if no
	394	* such property exists. The Java security properties file is located in
	395	* the file named <JAVA_HOME>/lib/security/java.security.
	396	* <JAVA_HOME> refers to the value of the java.home system property,
	397	* and specifies the directory where the JRE is installed.
	398	*
	399	* <p>The default <code>CertStore</code> type can be used by applications
	400	* that do not want to use a hard-coded type when calling one of the
	401	* <code>getInstance</code> methods, and want to provide a default
	402	* <code>CertStore</code> type in case a user does not specify its own.
	403	*
	404	* <p>The default <code>CertStore</code> type can be changed by setting
	405	* the value of the "certstore.type" security property (in the Java
	406	* security properties file) to the desired type.
	407	*
	408	* @return the default <code>CertStore</code> type as specified in the
	409	* Java security properties file, or the string "LDAP"
	410	* if no such property exists.
	411	*/
	412	public final static String getDefaultType() {
	413	String cstype;
	414	cstype = AccessController.doPrivileged(new PrivilegedAction<String>() {
	415	public String run() {
	416	return Security.getProperty(CERTSTORE_TYPE);
	417	}
	418	});
	419	if (cstype == null) {
	420	cstype = "LDAP";
	421	}
	422	return cstype;
	423	}
	424	}

java/pkg/java/security/cert/CertStoreException.class+0−0

Binary file not shown.

java/pkg/java/security/cert/CertStoreException.java+103−0

@@ -0,0 +1,103 @@
	1	/*
	2	* Copyright (c) 2000, 2003, Oracle and/or its affiliates. All rights reserved.
	3	* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
	4	*
	5	* This code is free software; you can redistribute it and/or modify it
	6	* under the terms of the GNU General Public License version 2 only, as
	7	* published by the Free Software Foundation. Oracle designates this
	8	* particular file as subject to the "Classpath" exception as provided
	9	* by Oracle in the LICENSE file that accompanied this code.
	10	*
	11	* This code is distributed in the hope that it will be useful, but WITHOUT
	12	* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
	13	* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
	14	* version 2 for more details (a copy is included in the LICENSE file that
	15	* accompanied this code).
	16	*
	17	* You should have received a copy of the GNU General Public License version
	18	* 2 along with this work; if not, write to the Free Software Foundation,
	19	* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
	20	*
	21	* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
	22	* or visit www.oracle.com if you need additional information or have any
	23	* questions.
	24	*/
	25
	26	package java.security.cert;
	27
	28	import java.security.GeneralSecurityException;
	29
	30	/**
	31	* An exception indicating one of a variety of problems retrieving
	32	* certificates and CRLs from a <code>CertStore</code>.
	33	* <p>
	34	* A <code>CertStoreException</code> provides support for wrapping
	35	* exceptions. The {@link #getCause getCause} method returns the throwable,
	36	* if any, that caused this exception to be thrown.
	37	* <p>
	38	* <b>Concurrent Access</b>
	39	* <p>
	40	* Unless otherwise specified, the methods defined in this class are not
	41	* thread-safe. Multiple threads that need to access a single
	42	* object concurrently should synchronize amongst themselves and
	43	* provide the necessary locking. Multiple threads each manipulating
	44	* separate objects need not synchronize.
	45	*
	46	* @see CertStore
	47	*
	48	* @since 1.4
	49	* @author Sean Mullan
	50	*/
	51	public class CertStoreException extends GeneralSecurityException {
	52
	53	private static final long serialVersionUID = 2395296107471573245L;
	54
	55	/**
	56	* Creates a <code>CertStoreException</code> with <code>null</code> as
	57	* its detail message.
	58	*/
	59	public CertStoreException() {
	60	super();
	61	}
	62
	63	/**
	64	* Creates a <code>CertStoreException</code> with the given detail
	65	* message. A detail message is a <code>String</code> that describes this
	66	* particular exception.
	67	*
	68	* @param msg the detail message
	69	*/
	70	public CertStoreException(String msg) {
	71	super(msg);
	72	}
	73
	74	/**
	75	* Creates a <code>CertStoreException</code> that wraps the specified
	76	* throwable. This allows any exception to be converted into a
	77	* <code>CertStoreException</code>, while retaining information about the
	78	* cause, which may be useful for debugging. The detail message is
	79	* set to (<code>cause==null ? null : cause.toString()</code>) (which
	80	* typically contains the class and detail message of cause).
	81	*
	82	* @param cause the cause (which is saved for later retrieval by the
	83	* {@link #getCause getCause()} method). (A <code>null</code> value is
	84	* permitted, and indicates that the cause is nonexistent or unknown.)
	85	*/
	86	public CertStoreException(Throwable cause) {
	87	super(cause);
	88	}
	89
	90	/**
	91	* Creates a <code>CertStoreException</code> with the specified detail
	92	* message and cause.
	93	*
	94	* @param msg the detail message
	95	* @param cause the cause (which is saved for later retrieval by the
	96	* {@link #getCause getCause()} method). (A <code>null</code> value is
	97	* permitted, and indicates that the cause is nonexistent or unknown.)
	98	*/
	99	public CertStoreException(String msg, Throwable cause) {
	100	super(msg, cause);
	101	}
	102
	103	}

java/pkg/java/security/cert/CertStoreParameters.class+0−0

Binary file not shown.

java/pkg/java/security/cert/CertStoreParameters.java+80−0

@@ -0,0 +1,80 @@
	1	/*
	2	* Copyright (c) 2000, 2001, Oracle and/or its affiliates. All rights reserved.
	3	* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
	4	*
	5	* This code is free software; you can redistribute it and/or modify it
	6	* under the terms of the GNU General Public License version 2 only, as
	7	* published by the Free Software Foundation. Oracle designates this
	8	* particular file as subject to the "Classpath" exception as provided
	9	* by Oracle in the LICENSE file that accompanied this code.
	10	*
	11	* This code is distributed in the hope that it will be useful, but WITHOUT
	12	* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
	13	* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
	14	* version 2 for more details (a copy is included in the LICENSE file that
	15	* accompanied this code).
	16	*
	17	* You should have received a copy of the GNU General Public License version
	18	* 2 along with this work; if not, write to the Free Software Foundation,
	19	* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
	20	*
	21	* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
	22	* or visit www.oracle.com if you need additional information or have any
	23	* questions.
	24	*/
	25
	26	package java.security.cert;
	27
	28	/**
	29	* A specification of <code>CertStore</code> parameters.
	30	* <p>
	31	* The purpose of this interface is to group (and provide type safety for)
	32	* all <code>CertStore</code> parameter specifications. All
	33	* <code>CertStore</code> parameter specifications must implement this
	34	* interface.
	35	* <p>
	36	* Typically, a <code>CertStoreParameters</code> object is passed as a parameter
	37	* to one of the {@link CertStore#getInstance CertStore.getInstance} methods.
	38	* The <code>getInstance</code> method returns a <code>CertStore</code> that
	39	* is used for retrieving <code>Certificate</code>s and <code>CRL</code>s. The
	40	* <code>CertStore</code> that is returned is initialized with the specified
	41	* parameters. The type of parameters needed may vary between different types
	42	* of <code>CertStore</code>s.
	43	*
	44	* @see CertStore#getInstance
	45	*
	46	* @since 1.4
	47	* @author Steve Hanna
	48	*/
	49	public interface CertStoreParameters extends Cloneable {
	50
	51	/**
	52	* Makes a copy of this <code>CertStoreParameters</code>.
	53	* <p>
	54	* The precise meaning of "copy" may depend on the class of
	55	* the <code>CertStoreParameters</code> object. A typical implementation
	56	* performs a "deep copy" of this object, but this is not an absolute
	57	* requirement. Some implementations may perform a "shallow copy" of some
	58	* or all of the fields of this object.
	59	* <p>
	60	* Note that the <code>CertStore.getInstance</code> methods make a copy
	61	* of the specified <code>CertStoreParameters</code>. A deep copy
	62	* implementation of <code>clone</code> is safer and more robust, as it
	63	* prevents the caller from corrupting a shared <code>CertStore</code> by
	64	* subsequently modifying the contents of its initialization parameters.
	65	* However, a shallow copy implementation of <code>clone</code> is more
	66	* appropriate for applications that need to hold a reference to a
	67	* parameter contained in the <code>CertStoreParameters</code>. For example,
	68	* a shallow copy clone allows an application to release the resources of
	69	* a particular <code>CertStore</code> initialization parameter immediately,
	70	* rather than waiting for the garbage collection mechanism. This should
	71	* be done with the utmost care, since the <code>CertStore</code> may still
	72	* be in use by other threads.
	73	* <p>
	74	* Each subclass should state the precise behavior of this method so
	75	* that users and developers know what to expect.
	76	*
	77	* @return a copy of this <code>CertStoreParameters</code>
	78	*/
	79	Object clone();
	80	}

java/pkg/java/security/cert/CertStoreSpi.class+0−0

Binary file not shown.

java/pkg/java/security/cert/CertStoreSpi.java+125−0

@@ -0,0 +1,125 @@
	1	/*
	2	* Copyright (c) 2000, 2003, Oracle and/or its affiliates. All rights reserved.
	3	* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
	4	*
	5	* This code is free software; you can redistribute it and/or modify it
	6	* under the terms of the GNU General Public License version 2 only, as
	7	* published by the Free Software Foundation. Oracle designates this
	8	* particular file as subject to the "Classpath" exception as provided
	9	* by Oracle in the LICENSE file that accompanied this code.
	10	*
	11	* This code is distributed in the hope that it will be useful, but WITHOUT
	12	* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
	13	* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
	14	* version 2 for more details (a copy is included in the LICENSE file that
	15	* accompanied this code).
	16	*
	17	* You should have received a copy of the GNU General Public License version
	18	* 2 along with this work; if not, write to the Free Software Foundation,
	19	* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
	20	*
	21	* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
	22	* or visit www.oracle.com if you need additional information or have any
	23	* questions.
	24	*/
	25
	26	package java.security.cert;
	27
	28	import java.security.InvalidAlgorithmParameterException;
	29	import java.util.Collection;
	30
	31	/**
	32	* The <i>Service Provider Interface</i> (<b>SPI</b>)
	33	* for the {@link CertStore CertStore} class. All <code>CertStore</code>
	34	* implementations must include a class (the SPI class) that extends
	35	* this class (<code>CertStoreSpi</code>), provides a constructor with
	36	* a single argument of type <code>CertStoreParameters</code>, and implements
	37	* all of its methods. In general, instances of this class should only be
	38	* accessed through the <code>CertStore</code> class.
	39	* For details, see the Java Cryptography Architecture.
	40	* <p>
	41	* <b>Concurrent Access</b>
	42	* <p>
	43	* The public methods of all <code>CertStoreSpi</code> objects must be
	44	* thread-safe. That is, multiple threads may concurrently invoke these
	45	* methods on a single <code>CertStoreSpi</code> object (or more than one)
	46	* with no ill effects. This allows a <code>CertPathBuilder</code> to search
	47	* for a CRL while simultaneously searching for further certificates, for
	48	* instance.
	49	* <p>
	50	* Simple <code>CertStoreSpi</code> implementations will probably ensure
	51	* thread safety by adding a <code>synchronized</code> keyword to their
	52	* <code>engineGetCertificates</code> and <code>engineGetCRLs</code> methods.
	53	* More sophisticated ones may allow truly concurrent access.
	54	*
	55	* @since 1.4
	56	* @author Steve Hanna
	57	*/
	58	public abstract class CertStoreSpi {
	59
	60	/**
	61	* The sole constructor.
	62	*
	63	* @param params the initialization parameters (may be <code>null</code>)
	64	* @throws InvalidAlgorithmParameterException if the initialization
	65	* parameters are inappropriate for this <code>CertStoreSpi</code>
	66	*/
	67	public CertStoreSpi(CertStoreParameters params)
	68	throws InvalidAlgorithmParameterException { }
	69
	70	/**
	71	* Returns a <code>Collection</code> of <code>Certificate</code>s that
	72	* match the specified selector. If no <code>Certificate</code>s
	73	* match the selector, an empty <code>Collection</code> will be returned.
	74	* <p>
	75	* For some <code>CertStore</code> types, the resulting
	76	* <code>Collection</code> may not contain <b>all</b> of the
	77	* <code>Certificate</code>s that match the selector. For instance,
	78	* an LDAP <code>CertStore</code> may not search all entries in the
	79	* directory. Instead, it may just search entries that are likely to
	80	* contain the <code>Certificate</code>s it is looking for.
	81	* <p>
	82	* Some <code>CertStore</code> implementations (especially LDAP
	83	* <code>CertStore</code>s) may throw a <code>CertStoreException</code>
	84	* unless a non-null <code>CertSelector</code> is provided that includes
	85	* specific criteria that can be used to find the certificates. Issuer
	86	* and/or subject names are especially useful criteria.
	87	*
	88	* @param selector A <code>CertSelector</code> used to select which
	89	* <code>Certificate</code>s should be returned. Specify <code>null</code>
	90	* to return all <code>Certificate</code>s (if supported).
	91	* @return A <code>Collection</code> of <code>Certificate</code>s that
	92	* match the specified selector (never <code>null</code>)
	93	* @throws CertStoreException if an exception occurs
	94	*/
	95	public abstract Collection<? extends Certificate> engineGetCertificates
	96	(CertSelector selector) throws CertStoreException;
	97
	98	/**
	99	* Returns a <code>Collection</code> of <code>CRL</code>s that
	100	* match the specified selector. If no <code>CRL</code>s
	101	* match the selector, an empty <code>Collection</code> will be returned.
	102	* <p>
	103	* For some <code>CertStore</code> types, the resulting
	104	* <code>Collection</code> may not contain <b>all</b> of the
	105	* <code>CRL</code>s that match the selector. For instance,
	106	* an LDAP <code>CertStore</code> may not search all entries in the
	107	* directory. Instead, it may just search entries that are likely to
	108	* contain the <code>CRL</code>s it is looking for.
	109	* <p>
	110	* Some <code>CertStore</code> implementations (especially LDAP
	111	* <code>CertStore</code>s) may throw a <code>CertStoreException</code>
	112	* unless a non-null <code>CRLSelector</code> is provided that includes
	113	* specific criteria that can be used to find the CRLs. Issuer names
	114	* and/or the certificate to be checked are especially useful.
	115	*
	116	* @param selector A <code>CRLSelector</code> used to select which
	117	* <code>CRL</code>s should be returned. Specify <code>null</code>
	118	* to return all <code>CRL</code>s (if supported).
	119	* @return A <code>Collection</code> of <code>CRL</code>s that
	120	* match the specified selector (never <code>null</code>)
	121	* @throws CertStoreException if an exception occurs
	122	*/
	123	public abstract Collection<? extends CRL> engineGetCRLs
	124	(CRLSelector selector) throws CertStoreException;
	125	}

java/pkg/java/security/cert/Certificate$CertificateRep.class+0−0

Binary file not shown.

java/pkg/java/security/cert/Certificate.class+0−0

Binary file not shown.

java/pkg/java/security/cert/Certificate.java+274−0

@@ -0,0 +1,274 @@
	1	/*
	2	* Copyright (c) 1997, 2011, Oracle and/or its affiliates. All rights reserved.
	3	* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
	4	*
	5	* This code is free software; you can redistribute it and/or modify it
	6	* under the terms of the GNU General Public License version 2 only, as
	7	* published by the Free Software Foundation. Oracle designates this
	8	* particular file as subject to the "Classpath" exception as provided
	9	* by Oracle in the LICENSE file that accompanied this code.
	10	*
	11	* This code is distributed in the hope that it will be useful, but WITHOUT
	12	* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
	13	* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
	14	* version 2 for more details (a copy is included in the LICENSE file that
	15	* accompanied this code).
	16	*
	17	* You should have received a copy of the GNU General Public License version
	18	* 2 along with this work; if not, write to the Free Software Foundation,
	19	* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
	20	*
	21	* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
	22	* or visit www.oracle.com if you need additional information or have any
	23	* questions.
	24	*/
	25
	26	package java.security.cert;
	27
	28	import java.util.Arrays;
	29
	30	import java.security.PublicKey;
	31	import java.security.NoSuchAlgorithmException;
	32	import java.security.NoSuchProviderException;
	33	import java.security.InvalidKeyException;
	34	import java.security.SignatureException;
	35
	36	import sun.security.x509.X509CertImpl;
	37
	38	/**
	39	* <p>Abstract class for managing a variety of identity certificates.
	40	* An identity certificate is a binding of a principal to a public key which
	41	* is vouched for by another principal. (A principal represents
	42	* an entity such as an individual user, a group, or a corporation.)
	43	*<p>
	44	* This class is an abstraction for certificates that have different
	45	* formats but important common uses. For example, different types of
	46	* certificates, such as X.509 and PGP, share general certificate
	47	* functionality (like encoding and verifying) and
	48	* some types of information (like a public key).
	49	* <p>
	50	* X.509, PGP, and SDSI certificates can all be implemented by
	51	* subclassing the Certificate class, even though they contain different
	52	* sets of information, and they store and retrieve the information in
	53	* different ways.
	54	*
	55	* @see X509Certificate
	56	* @see CertificateFactory
	57	*
	58	* @author Hemma Prafullchandra
	59	*/
	60
	61	public abstract class Certificate implements java.io.Serializable {
	62
	63	private static final long serialVersionUID = -3585440601605666277L;
	64
	65	// the certificate type
	66	private final String type;
	67
	68	/**
	69	* Creates a certificate of the specified type.
	70	*
	71	* @param type the standard name of the certificate type.
	72	* See the CertificateFactory section in the <a href=
	73	* "{@docRoot}/../technotes/guides/security/StandardNames.html#CertificateFactory">
	74	* Java Cryptography Architecture Standard Algorithm Name Documentation</a>
	75	* for information about standard certificate types.
	76	*/
	77	protected Certificate(String type) {
	78	this.type = type;
	79	}
	80
	81	/**
	82	* Returns the type of this certificate.
	83	*
	84	* @return the type of this certificate.
	85	*/
	86	public final String getType() {
	87	return this.type;
	88	}
	89
	90	/**
	91	* Compares this certificate for equality with the specified
	92	* object. If the <code>other</code> object is an
	93	* <code>instanceof</code> <code>Certificate</code>, then
	94	* its encoded form is retrieved and compared with the
	95	* encoded form of this certificate.
	96	*
	97	* @param other the object to test for equality with this certificate.
	98	* @return true iff the encoded forms of the two certificates
	99	* match, false otherwise.
	100	*/
	101	public boolean equals(Object other) {
	102	if (this == other) {
	103	return true;
	104	}
	105	if (!(other instanceof Certificate)) {
	106	return false;
	107	}
	108	try {
	109	byte[] thisCert = X509CertImpl.getEncodedInternal(this);
	110	byte[] otherCert = X509CertImpl.getEncodedInternal((Certificate)other);
	111
	112	return Arrays.equals(thisCert, otherCert);
	113	} catch (CertificateException e) {
	114	return false;
	115	}
	116	}
	117
	118	/**
	119	* Returns a hashcode value for this certificate from its
	120	* encoded form.
	121	*
	122	* @return the hashcode value.
	123	*/
	124	public int hashCode() {
	125	int retval = 0;
	126	try {
	127	byte[] certData = X509CertImpl.getEncodedInternal(this);
	128	for (int i = 1; i < certData.length; i++) {
	129	retval += certData[i] * i;
	130	}
	131	return retval;
	132	} catch (CertificateException e) {
	133	return retval;
	134	}
	135	}
	136
	137	/**
	138	* Returns the encoded form of this certificate. It is
	139	* assumed that each certificate type would have only a single
	140	* form of encoding; for example, X.509 certificates would
	141	* be encoded as ASN.1 DER.
	142	*
	143	* @return the encoded form of this certificate
	144	*
	145	* @exception CertificateEncodingException if an encoding error occurs.
	146	*/
	147	public abstract byte[] getEncoded()
	148	throws CertificateEncodingException;
	149
	150	/**
	151	* Verifies that this certificate was signed using the
	152	* private key that corresponds to the specified public key.
	153	*
	154	* @param key the PublicKey used to carry out the verification.
	155	*
	156	* @exception NoSuchAlgorithmException on unsupported signature
	157	* algorithms.
	158	* @exception InvalidKeyException on incorrect key.
	159	* @exception NoSuchProviderException if there's no default provider.
	160	* @exception SignatureException on signature errors.
	161	* @exception CertificateException on encoding errors.
	162	*/
	163	public abstract void verify(PublicKey key)
	164	throws CertificateException, NoSuchAlgorithmException,
	165	InvalidKeyException, NoSuchProviderException,
	166	SignatureException;
	167
	168	/**
	169	* Verifies that this certificate was signed using the
	170	* private key that corresponds to the specified public key.
	171	* This method uses the signature verification engine
	172	* supplied by the specified provider.
	173	*
	174	* @param key the PublicKey used to carry out the verification.
	175	* @param sigProvider the name of the signature provider.
	176	*
	177	* @exception NoSuchAlgorithmException on unsupported signature
	178	* algorithms.
	179	* @exception InvalidKeyException on incorrect key.
	180	* @exception NoSuchProviderException on incorrect provider.
	181	* @exception SignatureException on signature errors.
	182	* @exception CertificateException on encoding errors.
	183	*/
	184	public abstract void verify(PublicKey key, String sigProvider)
	185	throws CertificateException, NoSuchAlgorithmException,
	186	InvalidKeyException, NoSuchProviderException,
	187	SignatureException;
	188
	189	/**
	190	* Returns a string representation of this certificate.
	191	*
	192	* @return a string representation of this certificate.
	193	*/
	194	public abstract String toString();
	195
	196	/**
	197	* Gets the public key from this certificate.
	198	*
	199	* @return the public key.
	200	*/
	201	public abstract PublicKey getPublicKey();
	202
	203	/**
	204	* Alternate Certificate class for serialization.
	205	* @since 1.3
	206	*/
	207	protected static class CertificateRep implements java.io.Serializable {
	208
	209	private static final long serialVersionUID = -8563758940495660020L;
	210
	211	private String type;
	212	private byte[] data;
	213
	214	/**
	215	* Construct the alternate Certificate class with the Certificate
	216	* type and Certificate encoding bytes.
	217	*
	218	* <p>
	219	*
	220	* @param type the standard name of the Certificate type. <p>
	221	*
	222	* @param data the Certificate data.
	223	*/
	224	protected CertificateRep(String type, byte[] data) {
	225	this.type = type;
	226	this.data = data;
	227	}
	228
	229	/**
	230	* Resolve the Certificate Object.
	231	*
	232	* <p>
	233	*
	234	* @return the resolved Certificate Object
	235	*
	236	* @throws java.io.ObjectStreamException if the Certificate
	237	* could not be resolved
	238	*/
	239	protected Object readResolve() throws java.io.ObjectStreamException {
	240	try {
	241	CertificateFactory cf = CertificateFactory.getInstance(type);
	242	return cf.generateCertificate
	243	(new java.io.ByteArrayInputStream(data));
	244	} catch (CertificateException e) {
	245	throw new java.io.NotSerializableException
	246	("java.security.cert.Certificate: " +
	247	type +
	248	": " +
	249	e.getMessage());
	250	}
	251	}
	252	}
	253
	254	/**
	255	* Replace the Certificate to be serialized.
	256	*
	257	* @return the alternate Certificate object to be serialized
	258	*
	259	* @throws java.io.ObjectStreamException if a new object representing
	260	* this Certificate could not be created
	261	* @since 1.3
	262	*/
	263	protected Object writeReplace() throws java.io.ObjectStreamException {
	264	try {
	265	return new CertificateRep(type, getEncoded());
	266	} catch (CertificateException e) {
	267	throw new java.io.NotSerializableException
	268	("java.security.cert.Certificate: " +
	269	type +
	270	": " +
	271	e.getMessage());
	272	}
	273	}
	274	}

java/pkg/java/security/cert/CertificateEncodingException.class+0−0

Binary file not shown.

java/pkg/java/security/cert/CertificateEncodingException.java+88−0

@@ -0,0 +1,88 @@
	1	/*
	2	* Copyright (c) 1997, 2003, Oracle and/or its affiliates. All rights reserved.
	3	* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
	4	*
	5	* This code is free software; you can redistribute it and/or modify it
	6	* under the terms of the GNU General Public License version 2 only, as
	7	* published by the Free Software Foundation. Oracle designates this
	8	* particular file as subject to the "Classpath" exception as provided
	9	* by Oracle in the LICENSE file that accompanied this code.
	10	*
	11	* This code is distributed in the hope that it will be useful, but WITHOUT
	12	* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
	13	* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
	14	* version 2 for more details (a copy is included in the LICENSE file that
	15	* accompanied this code).
	16	*
	17	* You should have received a copy of the GNU General Public License version
	18	* 2 along with this work; if not, write to the Free Software Foundation,
	19	* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
	20	*
	21	* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
	22	* or visit www.oracle.com if you need additional information or have any
	23	* questions.
	24	*/
	25
	26	package java.security.cert;
	27
	28	/**
	29	* Certificate Encoding Exception. This is thrown whenever an error
	30	* occurs while attempting to encode a certificate.
	31	*
	32	* @author Hemma Prafullchandra
	33	*/
	34	public class CertificateEncodingException extends CertificateException {
	35
	36	private static final long serialVersionUID = 6219492851589449162L;
	37
	38	/**
	39	* Constructs a CertificateEncodingException with no detail message. A
	40	* detail message is a String that describes this particular
	41	* exception.
	42	*/
	43	public CertificateEncodingException() {
	44	super();
	45	}
	46
	47	/**
	48	* Constructs a CertificateEncodingException with the specified detail
	49	* message. A detail message is a String that describes this
	50	* particular exception.
	51	*
	52	* @param message the detail message.
	53	*/
	54	public CertificateEncodingException(String message) {
	55	super(message);
	56	}
	57
	58	/**
	59	* Creates a <code>CertificateEncodingException</code> with the specified
	60	* detail message and cause.
	61	*
	62	* @param message the detail message (which is saved for later retrieval
	63	* by the {@link #getMessage()} method).
	64	* @param cause the cause (which is saved for later retrieval by the
	65	* {@link #getCause()} method). (A <tt>null</tt> value is permitted,
	66	* and indicates that the cause is nonexistent or unknown.)
	67	* @since 1.5
	68	*/
	69	public CertificateEncodingException(String message, Throwable cause) {
	70	super(message, cause);
	71	}
	72
	73	/**
	74	* Creates a <code>CertificateEncodingException</code>
	75	* with the specified cause and a detail message of
	76	* <tt>(cause==null ? null : cause.toString())</tt>
	77	* (which typically contains the class and detail message of
	78	* <tt>cause</tt>).
	79	*
	80	* @param cause the cause (which is saved for later retrieval by the
	81	* {@link #getCause()} method). (A <tt>null</tt> value is permitted,
	82	* and indicates that the cause is nonexistent or unknown.)
	83	* @since 1.5
	84	*/
	85	public CertificateEncodingException(Throwable cause) {
	86	super(cause);
	87	}
	88	}

java/pkg/java/security/cert/CertificateException.class+0−0

Binary file not shown.

java/pkg/java/security/cert/CertificateException.java+88−0

@@ -0,0 +1,88 @@
	1	/*
	2	* Copyright (c) 1996, 2003, Oracle and/or its affiliates. All rights reserved.
	3	* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
	4	*
	5	* This code is free software; you can redistribute it and/or modify it
	6	* under the terms of the GNU General Public License version 2 only, as
	7	* published by the Free Software Foundation. Oracle designates this
	8	* particular file as subject to the "Classpath" exception as provided
	9	* by Oracle in the LICENSE file that accompanied this code.
	10	*
	11	* This code is distributed in the hope that it will be useful, but WITHOUT
	12	* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
	13	* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
	14	* version 2 for more details (a copy is included in the LICENSE file that
	15	* accompanied this code).
	16	*
	17	* You should have received a copy of the GNU General Public License version
	18	* 2 along with this work; if not, write to the Free Software Foundation,
	19	* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
	20	*
	21	* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
	22	* or visit www.oracle.com if you need additional information or have any
	23	* questions.
	24	*/
	25
	26	package java.security.cert;
	27
	28	import java.security.GeneralSecurityException;
	29
	30	/**
	31	* This exception indicates one of a variety of certificate problems.
	32	*
	33	* @author Hemma Prafullchandra
	34	* @see Certificate
	35	*/
	36	public class CertificateException extends GeneralSecurityException {
	37
	38	private static final long serialVersionUID = 3192535253797119798L;
	39
	40	/**
	41	* Constructs a certificate exception with no detail message. A detail
	42	* message is a String that describes this particular exception.
	43	*/
	44	public CertificateException() {
	45	super();
	46	}
	47
	48	/**
	49	* Constructs a certificate exception with the given detail
	50	* message. A detail message is a String that describes this
	51	* particular exception.
	52	*
	53	* @param msg the detail message.
	54	*/
	55	public CertificateException(String msg) {
	56	super(msg);
	57	}
	58
	59	/**
	60	* Creates a <code>CertificateException</code> with the specified
	61	* detail message and cause.
	62	*
	63	* @param message the detail message (which is saved for later retrieval
	64	* by the {@link #getMessage()} method).
	65	* @param cause the cause (which is saved for later retrieval by the
	66	* {@link #getCause()} method). (A <tt>null</tt> value is permitted,
	67	* and indicates that the cause is nonexistent or unknown.)
	68	* @since 1.5
	69	*/
	70	public CertificateException(String message, Throwable cause) {
	71	super(message, cause);
	72	}
	73
	74	/**
	75	* Creates a <code>CertificateException</code> with the specified cause
	76	* and a detail message of <tt>(cause==null ? null : cause.toString())</tt>
	77	* (which typically contains the class and detail message of
	78	* <tt>cause</tt>).
	79	*
	80	* @param cause the cause (which is saved for later retrieval by the
	81	* {@link #getCause()} method). (A <tt>null</tt> value is permitted,
	82	* and indicates that the cause is nonexistent or unknown.)
	83	* @since 1.5
	84	*/
	85	public CertificateException(Throwable cause) {
	86	super(cause);
	87	}
	88	}

java/pkg/java/security/cert/CertificateExpiredException.class+0−0

Binary file not shown.

java/pkg/java/security/cert/CertificateExpiredException.java+59−0

@@ -0,0 +1,59 @@
	1	/*
	2	* Copyright (c) 1997, 2003, Oracle and/or its affiliates. All rights reserved.
	3	* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
	4	*
	5	* This code is free software; you can redistribute it and/or modify it
	6	* under the terms of the GNU General Public License version 2 only, as
	7	* published by the Free Software Foundation. Oracle designates this
	8	* particular file as subject to the "Classpath" exception as provided
	9	* by Oracle in the LICENSE file that accompanied this code.
	10	*
	11	* This code is distributed in the hope that it will be useful, but WITHOUT
	12	* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
	13	* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
	14	* version 2 for more details (a copy is included in the LICENSE file that
	15	* accompanied this code).
	16	*
	17	* You should have received a copy of the GNU General Public License version
	18	* 2 along with this work; if not, write to the Free Software Foundation,
	19	* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
	20	*
	21	* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
	22	* or visit www.oracle.com if you need additional information or have any
	23	* questions.
	24	*/
	25
	26	package java.security.cert;
	27
	28	/**
	29	* Certificate Expired Exception. This is thrown whenever the current
	30	* <code>Date</code> or the specified <code>Date</code> is after the
	31	* <code>notAfter</code> date/time specified in the validity period
	32	* of the certificate.
	33	*
	34	* @author Hemma Prafullchandra
	35	*/
	36	public class CertificateExpiredException extends CertificateException {
	37
	38	private static final long serialVersionUID = 9071001339691533771L;
	39
	40	/**
	41	* Constructs a CertificateExpiredException with no detail message. A
	42	* detail message is a String that describes this particular
	43	* exception.
	44	*/
	45	public CertificateExpiredException() {
	46	super();
	47	}
	48
	49	/**
	50	* Constructs a CertificateExpiredException with the specified detail
	51	* message. A detail message is a String that describes this
	52	* particular exception.
	53	*
	54	* @param message the detail message.
	55	*/
	56	public CertificateExpiredException(String message) {
	57	super(message);
	58	}
	59	}

java/pkg/java/security/cert/CertificateFactory.class+0−0

Binary file not shown.

java/pkg/java/security/cert/CertificateFactory.java+537−0

@@ -0,0 +1,537 @@
	1	/*
	2	* Copyright (c) 1998, 2011, Oracle and/or its affiliates. All rights reserved.
	3	* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
	4	*
	5	* This code is free software; you can redistribute it and/or modify it
	6	* under the terms of the GNU General Public License version 2 only, as
	7	* published by the Free Software Foundation. Oracle designates this
	8	* particular file as subject to the "Classpath" exception as provided
	9	* by Oracle in the LICENSE file that accompanied this code.
	10	*
	11	* This code is distributed in the hope that it will be useful, but WITHOUT
	12	* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
	13	* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
	14	* version 2 for more details (a copy is included in the LICENSE file that
	15	* accompanied this code).
	16	*
	17	* You should have received a copy of the GNU General Public License version
	18	* 2 along with this work; if not, write to the Free Software Foundation,
	19	* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
	20	*
	21	* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
	22	* or visit www.oracle.com if you need additional information or have any
	23	* questions.
	24	*/
	25
	26	package java.security.cert;
	27
	28	import java.io.InputStream;
	29	import java.util.Collection;
	30	import java.util.Iterator;
	31	import java.util.List;
	32	import java.security.Provider;
	33	import java.security.Security;
	34	import java.security.AccessController;
	35	import java.security.PrivilegedAction;
	36	import java.security.NoSuchAlgorithmException;
	37	import java.security.NoSuchProviderException;
	38
	39	import sun.security.jca.*;
	40	import sun.security.jca.GetInstance.Instance;
	41
	42	/**
	43	* This class defines the functionality of a certificate factory, which is
	44	* used to generate certificate, certification path (<code>CertPath</code>)
	45	* and certificate revocation list (CRL) objects from their encodings.
	46	*
	47	* <p>For encodings consisting of multiple certificates, use
	48	* <code>generateCertificates</code> when you want to
	49	* parse a collection of possibly unrelated certificates. Otherwise,
	50	* use <code>generateCertPath</code> when you want to generate
	51	* a <code>CertPath</code> (a certificate chain) and subsequently
	52	* validate it with a <code>CertPathValidator</code>.
	53	*
	54	* <p>A certificate factory for X.509 must return certificates that are an
	55	* instance of <code>java.security.cert.X509Certificate</code>, and CRLs
	56	* that are an instance of <code>java.security.cert.X509CRL</code>.
	57	*
	58	* <p>The following example reads a file with Base64 encoded certificates,
	59	* which are each bounded at the beginning by -----BEGIN CERTIFICATE-----, and
	60	* bounded at the end by -----END CERTIFICATE-----. We convert the
	61	* <code>FileInputStream</code> (which does not support <code>mark</code>
	62	* and <code>reset</code>) to a <code>BufferedInputStream</code> (which
	63	* supports those methods), so that each call to
	64	* <code>generateCertificate</code> consumes only one certificate, and the
	65	* read position of the input stream is positioned to the next certificate in
	66	* the file:<p>
	67	*
	68	* <pre>
	69	* FileInputStream fis = new FileInputStream(filename);
	70	* BufferedInputStream bis = new BufferedInputStream(fis);
	71	*
	72	* CertificateFactory cf = CertificateFactory.getInstance("X.509");
	73	*
	74	* while (bis.available() > 0) {
	75	* Certificate cert = cf.generateCertificate(bis);
	76	* System.out.println(cert.toString());
	77	* }
	78	* </pre>
	79	*
	80	* <p>The following example parses a PKCS#7-formatted certificate reply stored
	81	* in a file and extracts all the certificates from it:<p>
	82	*
	83	* <pre>
	84	* FileInputStream fis = new FileInputStream(filename);
	85	* CertificateFactory cf = CertificateFactory.getInstance("X.509");
	86	* Collection c = cf.generateCertificates(fis);
	87	* Iterator i = c.iterator();
	88	* while (i.hasNext()) {
	89	* Certificate cert = (Certificate)i.next();
	90	* System.out.println(cert);
	91	* }
	92	* </pre>
	93	*
	94	* <p> Every implementation of the Java platform is required to support the
	95	* following standard <code>CertificateFactory</code> type:
	96	* <ul>
	97	* <li><tt>X.509</tt></li>
	98	* </ul>
	99	* and the following standard <code>CertPath</code> encodings:
	100	* <ul>
	101	* <li><tt>PKCS7</tt></li>
	102	* <li><tt>PkiPath</tt></li>
	103	* </ul>
	104	* The type and encodings are described in the <a href=
	105	* "{@docRoot}/../technotes/guides/security/StandardNames.html#CertificateFactory">
	106	* CertificateFactory section</a> and the <a href=
	107	* "{@docRoot}/../technotes/guides/security/StandardNames.html#CertPathEncodings">
	108	* CertPath Encodings section</a> of the
	109	* Java Cryptography Architecture Standard Algorithm Name Documentation.
	110	* Consult the release documentation for your implementation to see if any
	111	* other types or encodings are supported.
	112	*
	113	* @author Hemma Prafullchandra
	114	* @author Jan Luehe
	115	* @author Sean Mullan
	116	*
	117	* @see Certificate
	118	* @see X509Certificate
	119	* @see CertPath
	120	* @see CRL
	121	* @see X509CRL
	122	*
	123	* @since 1.2
	124	*/
	125
	126	public class CertificateFactory {
	127
	128	// The certificate type
	129	private String type;
	130
	131	// The provider
	132	private Provider provider;
	133
	134	// The provider implementation
	135	private CertificateFactorySpi certFacSpi;
	136
	137	/**
	138	* Creates a CertificateFactory object of the given type, and encapsulates
	139	* the given provider implementation (SPI object) in it.
	140	*
	141	* @param certFacSpi the provider implementation.
	142	* @param provider the provider.
	143	* @param type the certificate type.
	144	*/
	145	protected CertificateFactory(CertificateFactorySpi certFacSpi,
	146	Provider provider, String type)
	147	{
	148	this.certFacSpi = certFacSpi;
	149	this.provider = provider;
	150	this.type = type;
	151	}
	152
	153	/**
	154	* Returns a certificate factory object that implements the
	155	* specified certificate type.
	156	*
	157	* <p> This method traverses the list of registered security Providers,
	158	* starting with the most preferred Provider.
	159	* A new CertificateFactory object encapsulating the
	160	* CertificateFactorySpi implementation from the first
	161	* Provider that supports the specified type is returned.
	162	*
	163	* <p> Note that the list of registered providers may be retrieved via
	164	* the {@link Security#getProviders() Security.getProviders()} method.
	165	*
	166	* @param type the name of the requested certificate type.
	167	* See the CertificateFactory section in the <a href=
	168	* "{@docRoot}/../technotes/guides/security/StandardNames.html#CertificateFactory">
	169	* Java Cryptography Architecture Standard Algorithm Name Documentation</a>
	170	* for information about standard certificate types.
	171	*
	172	* @return a certificate factory object for the specified type.
	173	*
	174	* @exception CertificateException if no Provider supports a
	175	* CertificateFactorySpi implementation for the
	176	* specified type.
	177	*
	178	* @see java.security.Provider
	179	*/
	180	public static final CertificateFactory getInstance(String type)
	181	throws CertificateException {
	182	try {
	183	Instance instance = GetInstance.getInstance("CertificateFactory",
	184	CertificateFactorySpi.class, type);
	185	return new CertificateFactory((CertificateFactorySpi)instance.impl,
	186	instance.provider, type);
	187	} catch (NoSuchAlgorithmException e) {
	188	throw new CertificateException(type + " not found", e);
	189	}
	190	}
	191
	192	/**
	193	* Returns a certificate factory object for the specified
	194	* certificate type.
	195	*
	196	* <p> A new CertificateFactory object encapsulating the
	197	* CertificateFactorySpi implementation from the specified provider
	198	* is returned. The specified provider must be registered
	199	* in the security provider list.
	200	*
	201	* <p> Note that the list of registered providers may be retrieved via
	202	* the {@link Security#getProviders() Security.getProviders()} method.
	203	*
	204	* @param type the certificate type.
	205	* See the CertificateFactory section in the <a href=
	206	* "{@docRoot}/../technotes/guides/security/StandardNames.html#CertificateFactory">
	207	* Java Cryptography Architecture Standard Algorithm Name Documentation</a>
	208	* for information about standard certificate types.
	209	*
	210	* @param provider the name of the provider.
	211	*
	212	* @return a certificate factory object for the specified type.
	213	*
	214	* @exception CertificateException if a CertificateFactorySpi
	215	* implementation for the specified algorithm is not
	216	* available from the specified provider.
	217	*
	218	* @exception NoSuchProviderException if the specified provider is not
	219	* registered in the security provider list.
	220	*
	221	* @exception IllegalArgumentException if the provider name is null
	222	* or empty.
	223	*
	224	* @see java.security.Provider
	225	*/
	226	public static final CertificateFactory getInstance(String type,
	227	String provider) throws CertificateException,
	228	NoSuchProviderException {
	229	try {
	230	Instance instance = GetInstance.getInstance("CertificateFactory",
	231	CertificateFactorySpi.class, type, provider);
	232	return new CertificateFactory((CertificateFactorySpi)instance.impl,
	233	instance.provider, type);
	234	} catch (NoSuchAlgorithmException e) {
	235	throw new CertificateException(type + " not found", e);
	236	}
	237	}
	238
	239	/**
	240	* Returns a certificate factory object for the specified
	241	* certificate type.
	242	*
	243	* <p> A new CertificateFactory object encapsulating the
	244	* CertificateFactorySpi implementation from the specified Provider
	245	* object is returned. Note that the specified Provider object
	246	* does not have to be registered in the provider list.
	247	*
	248	* @param type the certificate type.
	249	* See the CertificateFactory section in the <a href=
	250	* "{@docRoot}/../technotes/guides/security/StandardNames.html#CertificateFactory">
	251	* Java Cryptography Architecture Standard Algorithm Name Documentation</a>
	252	* for information about standard certificate types.
	253	* @param provider the provider.
	254	*
	255	* @return a certificate factory object for the specified type.
	256	*
	257	* @exception CertificateException if a CertificateFactorySpi
	258	* implementation for the specified algorithm is not available
	259	* from the specified Provider object.
	260	*
	261	* @exception IllegalArgumentException if the <code>provider</code> is
	262	* null.
	263	*
	264	* @see java.security.Provider
	265	*
	266	* @since 1.4
	267	*/
	268	public static final CertificateFactory getInstance(String type,
	269	Provider provider) throws CertificateException {
	270	try {
	271	Instance instance = GetInstance.getInstance("CertificateFactory",
	272	CertificateFactorySpi.class, type, provider);
	273	return new CertificateFactory((CertificateFactorySpi)instance.impl,
	274	instance.provider, type);
	275	} catch (NoSuchAlgorithmException e) {
	276	throw new CertificateException(type + " not found", e);
	277	}
	278	}
	279
	280	/**
	281	* Returns the provider of this certificate factory.
	282	*
	283	* @return the provider of this certificate factory.
	284	*/
	285	public final Provider getProvider() {
	286	return this.provider;
	287	}
	288
	289	/**
	290	* Returns the name of the certificate type associated with this
	291	* certificate factory.
	292	*
	293	* @return the name of the certificate type associated with this
	294	* certificate factory.
	295	*/
	296	public final String getType() {
	297	return this.type;
	298	}
	299
	300	/**
	301	* Generates a certificate object and initializes it with
	302	* the data read from the input stream <code>inStream</code>.
	303	*
	304	* <p>In order to take advantage of the specialized certificate format
	305	* supported by this certificate factory,
	306	* the returned certificate object can be typecast to the corresponding
	307	* certificate class. For example, if this certificate
	308	* factory implements X.509 certificates, the returned certificate object
	309	* can be typecast to the <code>X509Certificate</code> class.
	310	*
	311	* <p>In the case of a certificate factory for X.509 certificates, the
	312	* certificate provided in <code>inStream</code> must be DER-encoded and
	313	* may be supplied in binary or printable (Base64) encoding. If the
	314	* certificate is provided in Base64 encoding, it must be bounded at
	315	* the beginning by -----BEGIN CERTIFICATE-----, and must be bounded at
	316	* the end by -----END CERTIFICATE-----.
	317	*
	318	* <p>Note that if the given input stream does not support
	319	* {@link java.io.InputStream#mark(int) mark} and
	320	* {@link java.io.InputStream#reset() reset}, this method will
	321	* consume the entire input stream. Otherwise, each call to this
	322	* method consumes one certificate and the read position of the
	323	* input stream is positioned to the next available byte after
	324	* the inherent end-of-certificate marker. If the data in the input stream
	325	* does not contain an inherent end-of-certificate marker (other
	326	* than EOF) and there is trailing data after the certificate is parsed, a
	327	* <code>CertificateException</code> is thrown.
	328	*
	329	* @param inStream an input stream with the certificate data.
	330	*
	331	* @return a certificate object initialized with the data
	332	* from the input stream.
	333	*
	334	* @exception CertificateException on parsing errors.
	335	*/
	336	public final Certificate generateCertificate(InputStream inStream)
	337	throws CertificateException
	338	{
	339	return certFacSpi.engineGenerateCertificate(inStream);
	340	}
	341
	342	/**
	343	* Returns an iteration of the <code>CertPath</code> encodings supported
	344	* by this certificate factory, with the default encoding first. See
	345	* the CertPath Encodings section in the <a href=
	346	* "{@docRoot}/../technotes/guides/security/StandardNames.html#CertPathEncodings">
	347	* Java Cryptography Architecture Standard Algorithm Name Documentation</a>
	348	* for information about standard encoding names and their formats.
	349	* <p>
	350	* Attempts to modify the returned <code>Iterator</code> via its
	351	* <code>remove</code> method result in an
	352	* <code>UnsupportedOperationException</code>.
	353	*
	354	* @return an <code>Iterator</code> over the names of the supported
	355	* <code>CertPath</code> encodings (as <code>String</code>s)
	356	* @since 1.4
	357	*/
	358	public final Iterator<String> getCertPathEncodings() {
	359	return(certFacSpi.engineGetCertPathEncodings());
	360	}
	361
	362	/**
	363	* Generates a <code>CertPath</code> object and initializes it with
	364	* the data read from the <code>InputStream</code> inStream. The data
	365	* is assumed to be in the default encoding. The name of the default
	366	* encoding is the first element of the <code>Iterator</code> returned by
	367	* the {@link #getCertPathEncodings getCertPathEncodings} method.
	368	*
	369	* @param inStream an <code>InputStream</code> containing the data
	370	* @return a <code>CertPath</code> initialized with the data from the
	371	* <code>InputStream</code>
	372	* @exception CertificateException if an exception occurs while decoding
	373	* @since 1.4
	374	*/
	375	public final CertPath generateCertPath(InputStream inStream)
	376	throws CertificateException
	377	{
	378	return(certFacSpi.engineGenerateCertPath(inStream));
	379	}
	380
	381	/**
	382	* Generates a <code>CertPath</code> object and initializes it with
	383	* the data read from the <code>InputStream</code> inStream. The data
	384	* is assumed to be in the specified encoding. See
	385	* the CertPath Encodings section in the <a href=
	386	* "{@docRoot}/../technotes/guides/security/StandardNames.html#CertPathEncodings">
	387	* Java Cryptography Architecture Standard Algorithm Name Documentation</a>
	388	* for information about standard encoding names and their formats.
	389	*
	390	* @param inStream an <code>InputStream</code> containing the data
	391	* @param encoding the encoding used for the data
	392	* @return a <code>CertPath</code> initialized with the data from the
	393	* <code>InputStream</code>
	394	* @exception CertificateException if an exception occurs while decoding or
	395	* the encoding requested is not supported
	396	* @since 1.4
	397	*/
	398	public final CertPath generateCertPath(InputStream inStream,
	399	String encoding) throws CertificateException
	400	{
	401	return(certFacSpi.engineGenerateCertPath(inStream, encoding));
	402	}
	403
	404	/**
	405	* Generates a <code>CertPath</code> object and initializes it with
	406	* a <code>List</code> of <code>Certificate</code>s.
	407	* <p>
	408	* The certificates supplied must be of a type supported by the
	409	* <code>CertificateFactory</code>. They will be copied out of the supplied
	410	* <code>List</code> object.
	411	*
	412	* @param certificates a <code>List</code> of <code>Certificate</code>s
	413	* @return a <code>CertPath</code> initialized with the supplied list of
	414	* certificates
	415	* @exception CertificateException if an exception occurs
	416	* @since 1.4
	417	*/
	418	public final CertPath
	419	generateCertPath(List<? extends Certificate> certificates)
	420	throws CertificateException
	421	{
	422	return(certFacSpi.engineGenerateCertPath(certificates));
	423	}
	424
	425	/**
	426	* Returns a (possibly empty) collection view of the certificates read
	427	* from the given input stream <code>inStream</code>.
	428	*
	429	* <p>In order to take advantage of the specialized certificate format
	430	* supported by this certificate factory, each element in
	431	* the returned collection view can be typecast to the corresponding
	432	* certificate class. For example, if this certificate
	433	* factory implements X.509 certificates, the elements in the returned
	434	* collection can be typecast to the <code>X509Certificate</code> class.
	435	*
	436	* <p>In the case of a certificate factory for X.509 certificates,
	437	* <code>inStream</code> may contain a sequence of DER-encoded certificates
	438	* in the formats described for
	439	* {@link #generateCertificate(java.io.InputStream) generateCertificate}.
	440	* In addition, <code>inStream</code> may contain a PKCS#7 certificate
	441	* chain. This is a PKCS#7 <i>SignedData</i> object, with the only
	442	* significant field being <i>certificates</i>. In particular, the
	443	* signature and the contents are ignored. This format allows multiple
	444	* certificates to be downloaded at once. If no certificates are present,
	445	* an empty collection is returned.
	446	*
	447	* <p>Note that if the given input stream does not support
	448	* {@link java.io.InputStream#mark(int) mark} and
	449	* {@link java.io.InputStream#reset() reset}, this method will
	450	* consume the entire input stream.
	451	*
	452	* @param inStream the input stream with the certificates.
	453	*
	454	* @return a (possibly empty) collection view of
	455	* java.security.cert.Certificate objects
	456	* initialized with the data from the input stream.
	457	*
	458	* @exception CertificateException on parsing errors.
	459	*/
	460	public final Collection<? extends Certificate> generateCertificates
	461	(InputStream inStream) throws CertificateException {
	462	return certFacSpi.engineGenerateCertificates(inStream);
	463	}
	464
	465	/**
	466	* Generates a certificate revocation list (CRL) object and initializes it
	467	* with the data read from the input stream <code>inStream</code>.
	468	*
	469	* <p>In order to take advantage of the specialized CRL format
	470	* supported by this certificate factory,
	471	* the returned CRL object can be typecast to the corresponding
	472	* CRL class. For example, if this certificate
	473	* factory implements X.509 CRLs, the returned CRL object
	474	* can be typecast to the <code>X509CRL</code> class.
	475	*
	476	* <p>Note that if the given input stream does not support
	477	* {@link java.io.InputStream#mark(int) mark} and
	478	* {@link java.io.InputStream#reset() reset}, this method will
	479	* consume the entire input stream. Otherwise, each call to this
	480	* method consumes one CRL and the read position of the input stream
	481	* is positioned to the next available byte after the inherent
	482	* end-of-CRL marker. If the data in the
	483	* input stream does not contain an inherent end-of-CRL marker (other
	484	* than EOF) and there is trailing data after the CRL is parsed, a
	485	* <code>CRLException</code> is thrown.
	486	*
	487	* @param inStream an input stream with the CRL data.
	488	*
	489	* @return a CRL object initialized with the data
	490	* from the input stream.
	491	*
	492	* @exception CRLException on parsing errors.
	493	*/
	494	public final CRL generateCRL(InputStream inStream)
	495	throws CRLException
	496	{
	497	return certFacSpi.engineGenerateCRL(inStream);
	498	}
	499
	500	/**
	501	* Returns a (possibly empty) collection view of the CRLs read
	502	* from the given input stream <code>inStream</code>.
	503	*
	504	* <p>In order to take advantage of the specialized CRL format
	505	* supported by this certificate factory, each element in
	506	* the returned collection view can be typecast to the corresponding
	507	* CRL class. For example, if this certificate
	508	* factory implements X.509 CRLs, the elements in the returned
	509	* collection can be typecast to the <code>X509CRL</code> class.
	510	*
	511	* <p>In the case of a certificate factory for X.509 CRLs,
	512	* <code>inStream</code> may contain a sequence of DER-encoded CRLs.
	513	* In addition, <code>inStream</code> may contain a PKCS#7 CRL
	514	* set. This is a PKCS#7 <i>SignedData</i> object, with the only
	515	* significant field being <i>crls</i>. In particular, the
	516	* signature and the contents are ignored. This format allows multiple
	517	* CRLs to be downloaded at once. If no CRLs are present,
	518	* an empty collection is returned.
	519	*
	520	* <p>Note that if the given input stream does not support
	521	* {@link java.io.InputStream#mark(int) mark} and
	522	* {@link java.io.InputStream#reset() reset}, this method will
	523	* consume the entire input stream.
	524	*
	525	* @param inStream the input stream with the CRLs.
	526	*
	527	* @return a (possibly empty) collection view of
	528	* java.security.cert.CRL objects initialized with the data from the input
	529	* stream.
	530	*
	531	* @exception CRLException on parsing errors.
	532	*/
	533	public final Collection<? extends CRL> generateCRLs(InputStream inStream)
	534	throws CRLException {
	535	return certFacSpi.engineGenerateCRLs(inStream);
	536	}
	537	}

java/pkg/java/security/cert/CertificateFactorySpi.class+0−0

Binary file not shown.

java/pkg/java/security/cert/CertificateFactorySpi.java+315−0

@@ -0,0 +1,315 @@
	1	/*
	2	* Copyright (c) 1998, 2011, Oracle and/or its affiliates. All rights reserved.
	3	* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
	4	*
	5	* This code is free software; you can redistribute it and/or modify it
	6	* under the terms of the GNU General Public License version 2 only, as
	7	* published by the Free Software Foundation. Oracle designates this
	8	* particular file as subject to the "Classpath" exception as provided
	9	* by Oracle in the LICENSE file that accompanied this code.
	10	*
	11	* This code is distributed in the hope that it will be useful, but WITHOUT
	12	* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
	13	* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
	14	* version 2 for more details (a copy is included in the LICENSE file that
	15	* accompanied this code).
	16	*
	17	* You should have received a copy of the GNU General Public License version
	18	* 2 along with this work; if not, write to the Free Software Foundation,
	19	* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
	20	*
	21	* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
	22	* or visit www.oracle.com if you need additional information or have any
	23	* questions.
	24	*/
	25
	26	package java.security.cert;
	27
	28	import java.io.InputStream;
	29	import java.util.Collection;
	30	import java.util.Iterator;
	31	import java.util.List;
	32	import java.security.Provider;
	33	import java.security.NoSuchAlgorithmException;
	34	import java.security.NoSuchProviderException;
	35
	36	/**
	37	* This class defines the <i>Service Provider Interface</i> (<b>SPI</b>)
	38	* for the <code>CertificateFactory</code> class.
	39	* All the abstract methods in this class must be implemented by each
	40	* cryptographic service provider who wishes to supply the implementation
	41	* of a certificate factory for a particular certificate type, e.g., X.509.
	42	*
	43	* <p>Certificate factories are used to generate certificate, certification path
	44	* (<code>CertPath</code>) and certificate revocation list (CRL) objects from
	45	* their encodings.
	46	*
	47	* <p>A certificate factory for X.509 must return certificates that are an
	48	* instance of <code>java.security.cert.X509Certificate</code>, and CRLs
	49	* that are an instance of <code>java.security.cert.X509CRL</code>.
	50	*
	51	* @author Hemma Prafullchandra
	52	* @author Jan Luehe
	53	* @author Sean Mullan
	54	*
	55	*
	56	* @see CertificateFactory
	57	* @see Certificate
	58	* @see X509Certificate
	59	* @see CertPath
	60	* @see CRL
	61	* @see X509CRL
	62	*
	63	* @since 1.2
	64	*/
	65
	66	public abstract class CertificateFactorySpi {
	67
	68	/**
	69	* Generates a certificate object and initializes it with
	70	* the data read from the input stream <code>inStream</code>.
	71	*
	72	* <p>In order to take advantage of the specialized certificate format
	73	* supported by this certificate factory,
	74	* the returned certificate object can be typecast to the corresponding
	75	* certificate class. For example, if this certificate
	76	* factory implements X.509 certificates, the returned certificate object
	77	* can be typecast to the <code>X509Certificate</code> class.
	78	*
	79	* <p>In the case of a certificate factory for X.509 certificates, the
	80	* certificate provided in <code>inStream</code> must be DER-encoded and
	81	* may be supplied in binary or printable (Base64) encoding. If the
	82	* certificate is provided in Base64 encoding, it must be bounded at
	83	* the beginning by -----BEGIN CERTIFICATE-----, and must be bounded at
	84	* the end by -----END CERTIFICATE-----.
	85	*
	86	* <p>Note that if the given input stream does not support
	87	* {@link java.io.InputStream#mark(int) mark} and
	88	* {@link java.io.InputStream#reset() reset}, this method will
	89	* consume the entire input stream. Otherwise, each call to this
	90	* method consumes one certificate and the read position of the input stream
	91	* is positioned to the next available byte after the inherent
	92	* end-of-certificate marker. If the data in the
	93	* input stream does not contain an inherent end-of-certificate marker (other
	94	* than EOF) and there is trailing data after the certificate is parsed, a
	95	* <code>CertificateException</code> is thrown.
	96	*
	97	* @param inStream an input stream with the certificate data.
	98	*
	99	* @return a certificate object initialized with the data
	100	* from the input stream.
	101	*
	102	* @exception CertificateException on parsing errors.
	103	*/
	104	public abstract Certificate engineGenerateCertificate(InputStream inStream)
	105	throws CertificateException;
	106
	107	/**
	108	* Generates a <code>CertPath</code> object and initializes it with
	109	* the data read from the <code>InputStream</code> inStream. The data
	110	* is assumed to be in the default encoding.
	111	*
	112	* <p> This method was added to version 1.4 of the Java 2 Platform
	113	* Standard Edition. In order to maintain backwards compatibility with
	114	* existing service providers, this method cannot be <code>abstract</code>
	115	* and by default throws an <code>UnsupportedOperationException</code>.
	116	*
	117	* @param inStream an <code>InputStream</code> containing the data
	118	* @return a <code>CertPath</code> initialized with the data from the
	119	* <code>InputStream</code>
	120	* @exception CertificateException if an exception occurs while decoding
	121	* @exception UnsupportedOperationException if the method is not supported
	122	* @since 1.4
	123	*/
	124	public CertPath engineGenerateCertPath(InputStream inStream)
	125	throws CertificateException
	126	{
	127	throw new UnsupportedOperationException();
	128	}
	129
	130	/**
	131	* Generates a <code>CertPath</code> object and initializes it with
	132	* the data read from the <code>InputStream</code> inStream. The data
	133	* is assumed to be in the specified encoding.
	134	*
	135	* <p> This method was added to version 1.4 of the Java 2 Platform
	136	* Standard Edition. In order to maintain backwards compatibility with
	137	* existing service providers, this method cannot be <code>abstract</code>
	138	* and by default throws an <code>UnsupportedOperationException</code>.
	139	*
	140	* @param inStream an <code>InputStream</code> containing the data
	141	* @param encoding the encoding used for the data
	142	* @return a <code>CertPath</code> initialized with the data from the
	143	* <code>InputStream</code>
	144	* @exception CertificateException if an exception occurs while decoding or
	145	* the encoding requested is not supported
	146	* @exception UnsupportedOperationException if the method is not supported
	147	* @since 1.4
	148	*/
	149	public CertPath engineGenerateCertPath(InputStream inStream,
	150	String encoding) throws CertificateException
	151	{
	152	throw new UnsupportedOperationException();
	153	}
	154
	155	/**
	156	* Generates a <code>CertPath</code> object and initializes it with
	157	* a <code>List</code> of <code>Certificate</code>s.
	158	* <p>
	159	* The certificates supplied must be of a type supported by the
	160	* <code>CertificateFactory</code>. They will be copied out of the supplied
	161	* <code>List</code> object.
	162	*
	163	* <p> This method was added to version 1.4 of the Java 2 Platform
	164	* Standard Edition. In order to maintain backwards compatibility with
	165	* existing service providers, this method cannot be <code>abstract</code>
	166	* and by default throws an <code>UnsupportedOperationException</code>.
	167	*
	168	* @param certificates a <code>List</code> of <code>Certificate</code>s
	169	* @return a <code>CertPath</code> initialized with the supplied list of
	170	* certificates
	171	* @exception CertificateException if an exception occurs
	172	* @exception UnsupportedOperationException if the method is not supported
	173	* @since 1.4
	174	*/
	175	public CertPath
	176	engineGenerateCertPath(List<? extends Certificate> certificates)
	177	throws CertificateException
	178	{
	179	throw new UnsupportedOperationException();
	180	}
	181
	182	/**
	183	* Returns an iteration of the <code>CertPath</code> encodings supported
	184	* by this certificate factory, with the default encoding first. See
	185	* the CertPath Encodings section in the <a href=
	186	* "{@docRoot}/../technotes/guides/security/StandardNames.html#CertPathEncodings">
	187	* Java Cryptography Architecture Standard Algorithm Name Documentation</a>
	188	* for information about standard encoding names.
	189	* <p>
	190	* Attempts to modify the returned <code>Iterator</code> via its
	191	* <code>remove</code> method result in an
	192	* <code>UnsupportedOperationException</code>.
	193	*
	194	* <p> This method was added to version 1.4 of the Java 2 Platform
	195	* Standard Edition. In order to maintain backwards compatibility with
	196	* existing service providers, this method cannot be <code>abstract</code>
	197	* and by default throws an <code>UnsupportedOperationException</code>.
	198	*
	199	* @return an <code>Iterator</code> over the names of the supported
	200	* <code>CertPath</code> encodings (as <code>String</code>s)
	201	* @exception UnsupportedOperationException if the method is not supported
	202	* @since 1.4
	203	*/
	204	public Iterator<String> engineGetCertPathEncodings() {
	205	throw new UnsupportedOperationException();
	206	}
	207
	208	/**
	209	* Returns a (possibly empty) collection view of the certificates read
	210	* from the given input stream <code>inStream</code>.
	211	*
	212	* <p>In order to take advantage of the specialized certificate format
	213	* supported by this certificate factory, each element in
	214	* the returned collection view can be typecast to the corresponding
	215	* certificate class. For example, if this certificate
	216	* factory implements X.509 certificates, the elements in the returned
	217	* collection can be typecast to the <code>X509Certificate</code> class.
	218	*
	219	* <p>In the case of a certificate factory for X.509 certificates,
	220	* <code>inStream</code> may contain a single DER-encoded certificate
	221	* in the formats described for
	222	* {@link CertificateFactory#generateCertificate(java.io.InputStream)
	223	* generateCertificate}.
	224	* In addition, <code>inStream</code> may contain a PKCS#7 certificate
	225	* chain. This is a PKCS#7 <i>SignedData</i> object, with the only
	226	* significant field being <i>certificates</i>. In particular, the
	227	* signature and the contents are ignored. This format allows multiple
	228	* certificates to be downloaded at once. If no certificates are present,
	229	* an empty collection is returned.
	230	*
	231	* <p>Note that if the given input stream does not support
	232	* {@link java.io.InputStream#mark(int) mark} and
	233	* {@link java.io.InputStream#reset() reset}, this method will
	234	* consume the entire input stream.
	235	*
	236	* @param inStream the input stream with the certificates.
	237	*
	238	* @return a (possibly empty) collection view of
	239	* java.security.cert.Certificate objects
	240	* initialized with the data from the input stream.
	241	*
	242	* @exception CertificateException on parsing errors.
	243	*/
	244	public abstract Collection<? extends Certificate>
	245	engineGenerateCertificates(InputStream inStream)
	246	throws CertificateException;
	247
	248	/**
	249	* Generates a certificate revocation list (CRL) object and initializes it
	250	* with the data read from the input stream <code>inStream</code>.
	251	*
	252	* <p>In order to take advantage of the specialized CRL format
	253	* supported by this certificate factory,
	254	* the returned CRL object can be typecast to the corresponding
	255	* CRL class. For example, if this certificate
	256	* factory implements X.509 CRLs, the returned CRL object
	257	* can be typecast to the <code>X509CRL</code> class.
	258	*
	259	* <p>Note that if the given input stream does not support
	260	* {@link java.io.InputStream#mark(int) mark} and
	261	* {@link java.io.InputStream#reset() reset}, this method will
	262	* consume the entire input stream. Otherwise, each call to this
	263	* method consumes one CRL and the read position of the input stream
	264	* is positioned to the next available byte after the inherent
	265	* end-of-CRL marker. If the data in the
	266	* input stream does not contain an inherent end-of-CRL marker (other
	267	* than EOF) and there is trailing data after the CRL is parsed, a
	268	* <code>CRLException</code> is thrown.
	269	*
	270	* @param inStream an input stream with the CRL data.
	271	*
	272	* @return a CRL object initialized with the data
	273	* from the input stream.
	274	*
	275	* @exception CRLException on parsing errors.
	276	*/
	277	public abstract CRL engineGenerateCRL(InputStream inStream)
	278	throws CRLException;
	279
	280	/**
	281	* Returns a (possibly empty) collection view of the CRLs read
	282	* from the given input stream <code>inStream</code>.
	283	*
	284	* <p>In order to take advantage of the specialized CRL format
	285	* supported by this certificate factory, each element in
	286	* the returned collection view can be typecast to the corresponding
	287	* CRL class. For example, if this certificate
	288	* factory implements X.509 CRLs, the elements in the returned
	289	* collection can be typecast to the <code>X509CRL</code> class.
	290	*
	291	* <p>In the case of a certificate factory for X.509 CRLs,
	292	* <code>inStream</code> may contain a single DER-encoded CRL.
	293	* In addition, <code>inStream</code> may contain a PKCS#7 CRL
	294	* set. This is a PKCS#7 <i>SignedData</i> object, with the only
	295	* significant field being <i>crls</i>. In particular, the
	296	* signature and the contents are ignored. This format allows multiple
	297	* CRLs to be downloaded at once. If no CRLs are present,
	298	* an empty collection is returned.
	299	*
	300	* <p>Note that if the given input stream does not support
	301	* {@link java.io.InputStream#mark(int) mark} and
	302	* {@link java.io.InputStream#reset() reset}, this method will
	303	* consume the entire input stream.
	304	*
	305	* @param inStream the input stream with the CRLs.
	306	*
	307	* @return a (possibly empty) collection view of
	308	* java.security.cert.CRL objects initialized with the data from the input
	309	* stream.
	310	*
	311	* @exception CRLException on parsing errors.
	312	*/
	313	public abstract Collection<? extends CRL> engineGenerateCRLs
	314	(InputStream inStream) throws CRLException;
	315	}

java/pkg/java/security/cert/CertificateNotYetValidException.class+0−0

Binary file not shown.

java/pkg/java/security/cert/CertificateNotYetValidException.java+59−0

@@ -0,0 +1,59 @@
	1	/*
	2	* Copyright (c) 1997, 2003, Oracle and/or its affiliates. All rights reserved.
	3	* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
	4	*
	5	* This code is free software; you can redistribute it and/or modify it
	6	* under the terms of the GNU General Public License version 2 only, as
	7	* published by the Free Software Foundation. Oracle designates this
	8	* particular file as subject to the "Classpath" exception as provided
	9	* by Oracle in the LICENSE file that accompanied this code.
	10	*
	11	* This code is distributed in the hope that it will be useful, but WITHOUT
	12	* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
	13	* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
	14	* version 2 for more details (a copy is included in the LICENSE file that
	15	* accompanied this code).
	16	*
	17	* You should have received a copy of the GNU General Public License version
	18	* 2 along with this work; if not, write to the Free Software Foundation,
	19	* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
	20	*
	21	* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
	22	* or visit www.oracle.com if you need additional information or have any
	23	* questions.
	24	*/
	25
	26	package java.security.cert;
	27
	28	/**
	29	* Certificate is not yet valid exception. This is thrown whenever
	30	* the current <code>Date</code> or the specified <code>Date</code>
	31	* is before the <code>notBefore</code> date/time in the Certificate
	32	* validity period.
	33	*
	34	* @author Hemma Prafullchandra
	35	*/
	36	public class CertificateNotYetValidException extends CertificateException {
	37
	38	static final long serialVersionUID = 4355919900041064702L;
	39
	40	/**
	41	* Constructs a CertificateNotYetValidException with no detail message. A
	42	* detail message is a String that describes this particular
	43	* exception.
	44	*/
	45	public CertificateNotYetValidException() {
	46	super();
	47	}
	48
	49	/**
	50	* Constructs a CertificateNotYetValidException with the specified detail
	51	* message. A detail message is a String that describes this
	52	* particular exception.
	53	*
	54	* @param message the detail message.
	55	*/
	56	public CertificateNotYetValidException(String message) {
	57	super(message);
	58	}
	59	}

java/pkg/java/security/cert/CertificateParsingException.class+0−0

Binary file not shown.

java/pkg/java/security/cert/CertificateParsingException.java+89−0

@@ -0,0 +1,89 @@
	1	/*
	2	* Copyright (c) 1997, 2003, Oracle and/or its affiliates. All rights reserved.
	3	* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
	4	*
	5	* This code is free software; you can redistribute it and/or modify it
	6	* under the terms of the GNU General Public License version 2 only, as
	7	* published by the Free Software Foundation. Oracle designates this
	8	* particular file as subject to the "Classpath" exception as provided
	9	* by Oracle in the LICENSE file that accompanied this code.
	10	*
	11	* This code is distributed in the hope that it will be useful, but WITHOUT
	12	* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
	13	* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
	14	* version 2 for more details (a copy is included in the LICENSE file that
	15	* accompanied this code).
	16	*
	17	* You should have received a copy of the GNU General Public License version
	18	* 2 along with this work; if not, write to the Free Software Foundation,
	19	* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
	20	*
	21	* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
	22	* or visit www.oracle.com if you need additional information or have any
	23	* questions.
	24	*/
	25
	26	package java.security.cert;
	27
	28	/**
	29	* Certificate Parsing Exception. This is thrown whenever an
	30	* invalid DER-encoded certificate is parsed or unsupported DER features
	31	* are found in the Certificate.
	32	*
	33	* @author Hemma Prafullchandra
	34	*/
	35	public class CertificateParsingException extends CertificateException {
	36
	37	private static final long serialVersionUID = -7989222416793322029L;
	38
	39	/**
	40	* Constructs a CertificateParsingException with no detail message. A
	41	* detail message is a String that describes this particular
	42	* exception.
	43	*/
	44	public CertificateParsingException() {
	45	super();
	46	}
	47
	48	/**
	49	* Constructs a CertificateParsingException with the specified detail
	50	* message. A detail message is a String that describes this
	51	* particular exception.
	52	*
	53	* @param message the detail message.
	54	*/
	55	public CertificateParsingException(String message) {
	56	super(message);
	57	}
	58
	59	/**
	60	* Creates a <code>CertificateParsingException</code> with the specified
	61	* detail message and cause.
	62	*
	63	* @param message the detail message (which is saved for later retrieval
	64	* by the {@link #getMessage()} method).
	65	* @param cause the cause (which is saved for later retrieval by the
	66	* {@link #getCause()} method). (A <tt>null</tt> value is permitted,
	67	* and indicates that the cause is nonexistent or unknown.)
	68	* @since 1.5
	69	*/
	70	public CertificateParsingException(String message, Throwable cause) {
	71	super(message, cause);
	72	}
	73
	74	/**
	75	* Creates a <code>CertificateParsingException</code> with the
	76	* specified cause and a detail message of
	77	* <tt>(cause==null ? null : cause.toString())</tt>
	78	* (which typically contains the class and detail message of
	79	* <tt>cause</tt>).
	80	*
	81	* @param cause the cause (which is saved for later retrieval by the
	82	* {@link #getCause()} method). (A <tt>null</tt> value is permitted,
	83	* and indicates that the cause is nonexistent or unknown.)
	84	* @since 1.5
	85	*/
	86	public CertificateParsingException(Throwable cause) {
	87	super(cause);
	88	}
	89	}

java/pkg/java/security/cert/CertificateRevokedException.class+0−0

Binary file not shown.

java/pkg/java/security/cert/CertificateRevokedException.java+245−0

@@ -0,0 +1,245 @@
	1	/*
	2	* Copyright (c) 2007, 2010, Oracle and/or its affiliates. All rights reserved.
	3	* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
	4	*
	5	* This code is free software; you can redistribute it and/or modify it
	6	* under the terms of the GNU General Public License version 2 only, as
	7	* published by the Free Software Foundation. Oracle designates this
	8	* particular file as subject to the "Classpath" exception as provided
	9	* by Oracle in the LICENSE file that accompanied this code.
	10	*
	11	* This code is distributed in the hope that it will be useful, but WITHOUT
	12	* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
	13	* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
	14	* version 2 for more details (a copy is included in the LICENSE file that
	15	* accompanied this code).
	16	*
	17	* You should have received a copy of the GNU General Public License version
	18	* 2 along with this work; if not, write to the Free Software Foundation,
	19	* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
	20	*
	21	* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
	22	* or visit www.oracle.com if you need additional information or have any
	23	* questions.
	24	*/
	25
	26	package java.security.cert;
	27
	28	import java.io.ObjectInputStream;
	29	import java.io.ObjectOutputStream;
	30	import java.io.IOException;
	31	import java.util.Collections;
	32	import java.util.Date;
	33	import java.util.HashMap;
	34	import java.util.Map;
	35	import java.util.Map.Entry;
	36	import javax.security.auth.x500.X500Principal;
	37
	38	import sun.security.util.ObjectIdentifier;
	39	import sun.security.x509.InvalidityDateExtension;
	40
	41	/**
	42	* An exception that indicates an X.509 certificate is revoked. A
	43	* <code>CertificateRevokedException</code> contains additional information
	44	* about the revoked certificate, such as the date on which the
	45	* certificate was revoked and the reason it was revoked.
	46	*
	47	* @author Sean Mullan
	48	* @since 1.7
	49	* @see CertPathValidatorException
	50	*/
	51	public class CertificateRevokedException extends CertificateException {
	52
	53	private static final long serialVersionUID = 7839996631571608627L;
	54
	55	/**
	56	* @serial the date on which the certificate was revoked
	57	*/
	58	private Date revocationDate;
	59	/**
	60	* @serial the revocation reason
	61	*/
	62	private final CRLReason reason;
	63	/**
	64	* @serial the <code>X500Principal</code> that represents the name of the
	65	* authority that signed the certificate's revocation status information
	66	*/
	67	private final X500Principal authority;
	68
	69	private transient Map<String, Extension> extensions;
	70
	71	/**
	72	* Constructs a <code>CertificateRevokedException</code> with
	73	* the specified revocation date, reason code, authority name, and map
	74	* of extensions.
	75	*
	76	* @param revocationDate the date on which the certificate was revoked. The
	77	* date is copied to protect against subsequent modification.
	78	* @param reason the revocation reason
	79	* @param extensions a map of X.509 Extensions. Each key is an OID String
	80	* that maps to the corresponding Extension. The map is copied to
	81	* prevent subsequent modification.
	82	* @param authority the <code>X500Principal</code> that represents the name
	83	* of the authority that signed the certificate's revocation status
	84	* information
	85	* @throws NullPointerException if <code>revocationDate</code>,
	86	* <code>reason</code>, <code>authority</code>, or
	87	* <code>extensions</code> is <code>null</code>
	88	*/
	89	public CertificateRevokedException(Date revocationDate, CRLReason reason,
	90	X500Principal authority, Map<String, Extension> extensions) {
	91	if (revocationDate == null \|\| reason == null \|\| authority == null \|\|
	92	extensions == null) {
	93	throw new NullPointerException();
	94	}
	95	this.revocationDate = new Date(revocationDate.getTime());
	96	this.reason = reason;
	97	this.authority = authority;
	98	this.extensions = new HashMap(extensions);
	99	}
	100
	101	/**
	102	* Returns the date on which the certificate was revoked. A new copy is
	103	* returned each time the method is invoked to protect against subsequent
	104	* modification.
	105	*
	106	* @return the revocation date
	107	*/
	108	public Date getRevocationDate() {
	109	return (Date) revocationDate.clone();
	110	}
	111
	112	/**
	113	* Returns the reason the certificate was revoked.
	114	*
	115	* @return the revocation reason
	116	*/
	117	public CRLReason getRevocationReason() {
	118	return reason;
	119	}
	120
	121	/**
	122	* Returns the name of the authority that signed the certificate's
	123	* revocation status information.
	124	*
	125	* @return the <code>X500Principal</code> that represents the name of the
	126	* authority that signed the certificate's revocation status information
	127	*/
	128	public X500Principal getAuthorityName() {
	129	return authority;
	130	}
	131
	132	/**
	133	* Returns the invalidity date, as specifed in the Invalidity Date
	134	* extension of this <code>CertificateRevokedException</code>. The
	135	* invalidity date is the date on which it is known or suspected that the
	136	* private key was compromised or that the certificate otherwise became
	137	* invalid. This implementation calls <code>getExtensions()</code> and
	138	* checks the returned map for an entry for the Invalidity Date extension
	139	* OID ("2.5.29.24"). If found, it returns the invalidity date in the
	140	* extension; otherwise null. A new Date object is returned each time the
	141	* method is invoked to protect against subsequent modification.
	142	*
	143	* @return the invalidity date, or <code>null</code> if not specified
	144	*/
	145	public Date getInvalidityDate() {
	146	Extension ext = getExtensions().get("2.5.29.24");
	147	if (ext == null) {
	148	return null;
	149	} else {
	150	try {
	151	Date invalidity =
	152	(Date) InvalidityDateExtension.toImpl(ext).get("DATE");
	153	return new Date(invalidity.getTime());
	154	} catch (IOException ioe) {
	155	return null;
	156	}
	157	}
	158	}
	159
	160	/**
	161	* Returns a map of X.509 extensions containing additional information
	162	* about the revoked certificate, such as the Invalidity Date
	163	* Extension. Each key is an OID String that maps to the corresponding
	164	* Extension.
	165	*
	166	* @return an unmodifiable map of X.509 extensions, or an empty map
	167	* if there are no extensions
	168	*/
	169	public Map<String, Extension> getExtensions() {
	170	return Collections.unmodifiableMap(extensions);
	171	}
	172
	173	@Override
	174	public String getMessage() {
	175	return "Certificate has been revoked, reason: "
	176	+ reason + ", revocation date: " + revocationDate
	177	+ ", authority: " + authority + ", extensions: " + extensions;
	178	}
	179
	180	/**
	181	* Serialize this <code>CertificateRevokedException</code> instance.
	182	*
	183	* @serialData the size of the extensions map (int), followed by all of
	184	* the extensions in the map, in no particular order. For each extension,
	185	* the following data is emitted: the OID String (Object), the criticality
	186	* flag (boolean), the length of the encoded extension value byte array
	187	* (int), and the encoded extension value bytes.
	188	*/
	189	private void writeObject(ObjectOutputStream oos) throws IOException {
	190	// Write out the non-transient fields
	191	// (revocationDate, reason, authority)
	192	oos.defaultWriteObject();
	193
	194	// Write out the size (number of mappings) of the extensions map
	195	oos.writeInt(extensions.size());
	196
	197	// For each extension in the map, the following are emitted (in order):
	198	// the OID String (Object), the criticality flag (boolean), the length
	199	// of the encoded extension value byte array (int), and the encoded
	200	// extension value byte array. The extensions themselves are emitted
	201	// in no particular order.
	202	for (Map.Entry<String, Extension> entry : extensions.entrySet()) {
	203	Extension ext = entry.getValue();
	204	oos.writeObject(ext.getId());
	205	oos.writeBoolean(ext.isCritical());
	206	byte[] extVal = ext.getValue();
	207	oos.writeInt(extVal.length);
	208	oos.write(extVal);
	209	}
	210	}
	211
	212	/**
	213	* Deserialize the <code>CertificateRevokedException</code> instance.
	214	*/
	215	private void readObject(ObjectInputStream ois)
	216	throws IOException, ClassNotFoundException {
	217	// Read in the non-transient fields
	218	// (revocationDate, reason, authority)
	219	ois.defaultReadObject();
	220
	221	// Defensively copy the revocation date
	222	revocationDate = new Date(revocationDate.getTime());
	223
	224	// Read in the size (number of mappings) of the extensions map
	225	// and create the extensions map
	226	int size = ois.readInt();
	227	if (size == 0) {
	228	extensions = Collections.emptyMap();
	229	} else {
	230	extensions = new HashMap<String, Extension>(size);
	231	}
	232
	233	// Read in the extensions and put the mappings in the extensions map
	234	for (int i = 0; i < size; i++) {
	235	String oid = (String) ois.readObject();
	236	boolean critical = ois.readBoolean();
	237	int length = ois.readInt();
	238	byte[] extVal = new byte[length];
	239	ois.readFully(extVal);
	240	Extension ext = sun.security.x509.Extension.newExtension
	241	(new ObjectIdentifier(oid), critical, extVal);
	242	extensions.put(oid, ext);
	243	}
	244	}
	245	}

java/pkg/java/security/cert/CollectionCertStoreParameters.class+0−0

Binary file not shown.

java/pkg/java/security/cert/CollectionCertStoreParameters.java+141−0

@@ -0,0 +1,141 @@
	1	/*
	2	* Copyright (c) 2000, 2006, Oracle and/or its affiliates. All rights reserved.
	3	* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
	4	*
	5	* This code is free software; you can redistribute it and/or modify it
	6	* under the terms of the GNU General Public License version 2 only, as
	7	* published by the Free Software Foundation. Oracle designates this
	8	* particular file as subject to the "Classpath" exception as provided
	9	* by Oracle in the LICENSE file that accompanied this code.
	10	*
	11	* This code is distributed in the hope that it will be useful, but WITHOUT
	12	* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
	13	* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
	14	* version 2 for more details (a copy is included in the LICENSE file that
	15	* accompanied this code).
	16	*
	17	* You should have received a copy of the GNU General Public License version
	18	* 2 along with this work; if not, write to the Free Software Foundation,
	19	* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
	20	*
	21	* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
	22	* or visit www.oracle.com if you need additional information or have any
	23	* questions.
	24	*/
	25
	26	package java.security.cert;
	27
	28	import java.io.Serializable;
	29	import java.util.Collection;
	30	import java.util.Collections;
	31
	32	/**
	33	* Parameters used as input for the Collection <code>CertStore</code>
	34	* algorithm.
	35	* <p>
	36	* This class is used to provide necessary configuration parameters
	37	* to implementations of the Collection <code>CertStore</code>
	38	* algorithm. The only parameter included in this class is the
	39	* <code>Collection</code> from which the <code>CertStore</code> will
	40	* retrieve certificates and CRLs.
	41	* <p>
	42	* <b>Concurrent Access</b>
	43	* <p>
	44	* Unless otherwise specified, the methods defined in this class are not
	45	* thread-safe. Multiple threads that need to access a single
	46	* object concurrently should synchronize amongst themselves and
	47	* provide the necessary locking. Multiple threads each manipulating
	48	* separate objects need not synchronize.
	49	*
	50	* @since 1.4
	51	* @author Steve Hanna
	52	* @see java.util.Collection
	53	* @see CertStore
	54	*/
	55	public class CollectionCertStoreParameters
	56	implements CertStoreParameters {
	57
	58	private Collection<?> coll;
	59
	60	/**
	61	* Creates an instance of <code>CollectionCertStoreParameters</code>
	62	* which will allow certificates and CRLs to be retrieved from the
	63	* specified <code>Collection</code>. If the specified
	64	* <code>Collection</code> contains an object that is not a
	65	* <code>Certificate</code> or <code>CRL</code>, that object will be
	66	* ignored by the Collection <code>CertStore</code>.
	67	* <p>
	68	* The <code>Collection</code> is <b>not</b> copied. Instead, a
	69	* reference is used. This allows the caller to subsequently add or
	70	* remove <code>Certificates</code> or <code>CRL</code>s from the
	71	* <code>Collection</code>, thus changing the set of
	72	* <code>Certificates</code> or <code>CRL</code>s available to the
	73	* Collection <code>CertStore</code>. The Collection <code>CertStore</code>
	74	* will not modify the contents of the <code>Collection</code>.
	75	* <p>
	76	* If the <code>Collection</code> will be modified by one thread while
	77	* another thread is calling a method of a Collection <code>CertStore</code>
	78	* that has been initialized with this <code>Collection</code>, the
	79	* <code>Collection</code> must have fail-fast iterators.
	80	*
	81	* @param collection a <code>Collection</code> of
	82	* <code>Certificate</code>s and <code>CRL</code>s
	83	* @exception NullPointerException if <code>collection</code> is
	84	* <code>null</code>
	85	*/
	86	public CollectionCertStoreParameters(Collection<?> collection) {
	87	if (collection == null)
	88	throw new NullPointerException();
	89	coll = collection;
	90	}
	91
	92	/**
	93	* Creates an instance of <code>CollectionCertStoreParameters</code> with
	94	* the default parameter values (an empty and immutable
	95	* <code>Collection</code>).
	96	*/
	97	public CollectionCertStoreParameters() {
	98	coll = Collections.EMPTY_SET;
	99	}
	100
	101	/**
	102	* Returns the <code>Collection</code> from which <code>Certificate</code>s
	103	* and <code>CRL</code>s are retrieved. This is <b>not</b> a copy of the
	104	* <code>Collection</code>, it is a reference. This allows the caller to
	105	* subsequently add or remove <code>Certificates</code> or
	106	* <code>CRL</code>s from the <code>Collection</code>.
	107	*
	108	* @return the <code>Collection</code> (never null)
	109	*/
	110	public Collection<?> getCollection() {
	111	return coll;
	112	}
	113
	114	/**
	115	* Returns a copy of this object. Note that only a reference to the
	116	* <code>Collection</code> is copied, and not the contents.
	117	*
	118	* @return the copy
	119	*/
	120	public Object clone() {
	121	try {
	122	return super.clone();
	123	} catch (CloneNotSupportedException e) {
	124	/* Cannot happen */
	125	throw new InternalError(e.toString());
	126	}
	127	}
	128
	129	/**
	130	* Returns a formatted string describing the parameters.
	131	*
	132	* @return a formatted string describing the parameters
	133	*/
	134	public String toString() {
	135	StringBuffer sb = new StringBuffer();
	136	sb.append("CollectionCertStoreParameters: [\n");
	137	sb.append(" collection: " + coll + "\n");
	138	sb.append("]");
	139	return sb.toString();
	140	}
	141	}

java/pkg/java/security/cert/Extension.class+0−0

Binary file not shown.

java/pkg/java/security/cert/Extension.java+101−0

@@ -0,0 +1,101 @@
	1	/*
	2	* Copyright (c) 2007, Oracle and/or its affiliates. All rights reserved.
	3	* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
	4	*
	5	* This code is free software; you can redistribute it and/or modify it
	6	* under the terms of the GNU General Public License version 2 only, as
	7	* published by the Free Software Foundation. Oracle designates this
	8	* particular file as subject to the "Classpath" exception as provided
	9	* by Oracle in the LICENSE file that accompanied this code.
	10	*
	11	* This code is distributed in the hope that it will be useful, but WITHOUT
	12	* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
	13	* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
	14	* version 2 for more details (a copy is included in the LICENSE file that
	15	* accompanied this code).
	16	*
	17	* You should have received a copy of the GNU General Public License version
	18	* 2 along with this work; if not, write to the Free Software Foundation,
	19	* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
	20	*
	21	* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
	22	* or visit www.oracle.com if you need additional information or have any
	23	* questions.
	24	*/
	25
	26	package java.security.cert;
	27
	28	import java.io.IOException;
	29	import java.io.OutputStream;
	30	import java.io.Serializable;
	31
	32	/**
	33	* This interface represents an X.509 extension.
	34	*
	35	* <p>
	36	* Extensions provide a means of associating additional attributes with users
	37	* or public keys and for managing a certification hierarchy. The extension
	38	* format also allows communities to define private extensions to carry
	39	* information unique to those communities.
	40	*
	41	* <p>
	42	* Each extension contains an object identifier, a criticality setting
	43	* indicating whether it is a critical or a non-critical extension, and
	44	* and an ASN.1 DER-encoded value. Its ASN.1 definition is:
	45	*
	46	* <pre>
	47	*
	48	* Extension ::= SEQUENCE {
	49	* extnId OBJECT IDENTIFIER,
	50	* critical BOOLEAN DEFAULT FALSE,
	51	* extnValue OCTET STRING
	52	* -- contains a DER encoding of a value
	53	* -- of the type registered for use with
	54	* -- the extnId object identifier value
	55	* }
	56	*
	57	* </pre>
	58	*
	59	* <p>
	60	* This interface is designed to provide access to a single extension,
	61	* unlike {@link java.security.cert.X509Extension} which is more suitable
	62	* for accessing a set of extensions.
	63	*
	64	* @since 1.7
	65	*/
	66	public interface Extension {
	67
	68	/**
	69	* Gets the extensions's object identifier.
	70	*
	71	* @return the object identifier as a String
	72	*/
	73	String getId();
	74
	75	/**
	76	* Gets the extension's criticality setting.
	77	*
	78	* @return true if this is a critical extension.
	79	*/
	80	boolean isCritical();
	81
	82	/**
	83	* Gets the extensions's DER-encoded value. Note, this is the bytes
	84	* that are encoded as an OCTET STRING. It does not include the OCTET
	85	* STRING tag and length.
	86	*
	87	* @return a copy of the extension's value, or <code>null</code> if no
	88	* extension value is present.
	89	*/
	90	byte[] getValue();
	91
	92	/**
	93	* Generates the extension's DER encoding and writes it to the output
	94	* stream.
	95	*
	96	* @param out the output stream
	97	* @exception IOException on encoding or output error.
	98	* @exception NullPointerException if <code>out</code> is <code>null</code>.
	99	*/
	100	void encode(OutputStream out) throws IOException;
	101	}

java/pkg/java/security/cert/LDAPCertStoreParameters.class+0−0

Binary file not shown.

java/pkg/java/security/cert/LDAPCertStoreParameters.java+149−0

@@ -0,0 +1,149 @@
	1	/*
	2	* Copyright (c) 2000, 2001, Oracle and/or its affiliates. All rights reserved.
	3	* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
	4	*
	5	* This code is free software; you can redistribute it and/or modify it
	6	* under the terms of the GNU General Public License version 2 only, as
	7	* published by the Free Software Foundation. Oracle designates this
	8	* particular file as subject to the "Classpath" exception as provided
	9	* by Oracle in the LICENSE file that accompanied this code.
	10	*
	11	* This code is distributed in the hope that it will be useful, but WITHOUT
	12	* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
	13	* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
	14	* version 2 for more details (a copy is included in the LICENSE file that
	15	* accompanied this code).
	16	*
	17	* You should have received a copy of the GNU General Public License version
	18	* 2 along with this work; if not, write to the Free Software Foundation,
	19	* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
	20	*
	21	* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
	22	* or visit www.oracle.com if you need additional information or have any
	23	* questions.
	24	*/
	25
	26	package java.security.cert;
	27
	28	/**
	29	* Parameters used as input for the LDAP <code>CertStore</code> algorithm.
	30	* <p>
	31	* This class is used to provide necessary configuration parameters (server
	32	* name and port number) to implementations of the LDAP <code>CertStore</code>
	33	* algorithm.
	34	* <p>
	35	* <b>Concurrent Access</b>
	36	* <p>
	37	* Unless otherwise specified, the methods defined in this class are not
	38	* thread-safe. Multiple threads that need to access a single
	39	* object concurrently should synchronize amongst themselves and
	40	* provide the necessary locking. Multiple threads each manipulating
	41	* separate objects need not synchronize.
	42	*
	43	* @since 1.4
	44	* @author Steve Hanna
	45	* @see CertStore
	46	*/
	47	public class LDAPCertStoreParameters implements CertStoreParameters {
	48
	49	private static final int LDAP_DEFAULT_PORT = 389;
	50
	51	/**
	52	* the port number of the LDAP server
	53	*/
	54	private int port;
	55
	56	/**
	57	* the DNS name of the LDAP server
	58	*/
	59	private String serverName;
	60
	61	/**
	62	* Creates an instance of <code>LDAPCertStoreParameters</code> with the
	63	* specified parameter values.
	64	*
	65	* @param serverName the DNS name of the LDAP server
	66	* @param port the port number of the LDAP server
	67	* @exception NullPointerException if <code>serverName</code> is
	68	* <code>null</code>
	69	*/
	70	public LDAPCertStoreParameters(String serverName, int port) {
	71	if (serverName == null)
	72	throw new NullPointerException();
	73	this.serverName = serverName;
	74	this.port = port;
	75	}
	76
	77	/**
	78	* Creates an instance of <code>LDAPCertStoreParameters</code> with the
	79	* specified server name and a default port of 389.
	80	*
	81	* @param serverName the DNS name of the LDAP server
	82	* @exception NullPointerException if <code>serverName</code> is
	83	* <code>null</code>
	84	*/
	85	public LDAPCertStoreParameters(String serverName) {
	86	this(serverName, LDAP_DEFAULT_PORT);
	87	}
	88
	89	/**
	90	* Creates an instance of <code>LDAPCertStoreParameters</code> with the
	91	* default parameter values (server name "localhost", port 389).
	92	*/
	93	public LDAPCertStoreParameters() {
	94	this("localhost", LDAP_DEFAULT_PORT);
	95	}
	96
	97	/**
	98	* Returns the DNS name of the LDAP server.
	99	*
	100	* @return the name (not <code>null</code>)
	101	*/
	102	public String getServerName() {
	103	return serverName;
	104	}
	105
	106	/**
	107	* Returns the port number of the LDAP server.
	108	*
	109	* @return the port number
	110	*/
	111	public int getPort() {
	112	return port;
	113	}
	114
	115	/**
	116	* Returns a copy of this object. Changes to the copy will not affect
	117	* the original and vice versa.
	118	* <p>
	119	* Note: this method currently performs a shallow copy of the object
	120	* (simply calls <code>Object.clone()</code>). This may be changed in a
	121	* future revision to perform a deep copy if new parameters are added
	122	* that should not be shared.
	123	*
	124	* @return the copy
	125	*/
	126	public Object clone() {
	127	try {
	128	return super.clone();
	129	} catch (CloneNotSupportedException e) {
	130	/* Cannot happen */
	131	throw new InternalError(e.toString());
	132	}
	133	}
	134
	135	/**
	136	* Returns a formatted string describing the parameters.
	137	*
	138	* @return a formatted string describing the parameters
	139	*/
	140	public String toString() {
	141	StringBuffer sb = new StringBuffer();
	142	sb.append("LDAPCertStoreParameters: [\n");
	143
	144	sb.append(" serverName: " + serverName + "\n");
	145	sb.append(" port: " + port + "\n");
	146	sb.append("]");
	147	return sb.toString();
	148	}
	149	}

java/pkg/java/security/cert/PKIXBuilderParameters.class+0−0

Binary file not shown.

java/pkg/java/security/cert/PKIXBuilderParameters.java+199−0

@@ -0,0 +1,199 @@
	1	/*
	2	* Copyright (c) 2000, 2003, Oracle and/or its affiliates. All rights reserved.
	3	* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
	4	*
	5	* This code is free software; you can redistribute it and/or modify it
	6	* under the terms of the GNU General Public License version 2 only, as
	7	* published by the Free Software Foundation. Oracle designates this
	8	* particular file as subject to the "Classpath" exception as provided
	9	* by Oracle in the LICENSE file that accompanied this code.
	10	*
	11	* This code is distributed in the hope that it will be useful, but WITHOUT
	12	* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
	13	* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
	14	* version 2 for more details (a copy is included in the LICENSE file that
	15	* accompanied this code).
	16	*
	17	* You should have received a copy of the GNU General Public License version
	18	* 2 along with this work; if not, write to the Free Software Foundation,
	19	* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
	20	*
	21	* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
	22	* or visit www.oracle.com if you need additional information or have any
	23	* questions.
	24	*/
	25
	26	package java.security.cert;
	27
	28	import java.security.KeyStore;
	29	import java.security.KeyStoreException;
	30	import java.security.InvalidAlgorithmParameterException;
	31	import java.security.InvalidParameterException;
	32	import java.util.Set;
	33
	34	/**
	35	* Parameters used as input for the PKIX <code>CertPathBuilder</code>
	36	* algorithm.
	37	* <p>
	38	* A PKIX <code>CertPathBuilder</code> uses these parameters to {@link
	39	* CertPathBuilder#build build} a <code>CertPath</code> which has been
	40	* validated according to the PKIX certification path validation algorithm.
	41	*
	42	* <p>To instantiate a <code>PKIXBuilderParameters</code> object, an
	43	* application must specify one or more <i>most-trusted CAs</i> as defined by
	44	* the PKIX certification path validation algorithm. The most-trusted CA
	45	* can be specified using one of two constructors. An application
	46	* can call {@link #PKIXBuilderParameters(Set, CertSelector)
	47	* PKIXBuilderParameters(Set, CertSelector)}, specifying a
	48	* <code>Set</code> of <code>TrustAnchor</code> objects, each of which
	49	* identifies a most-trusted CA. Alternatively, an application can call
	50	* {@link #PKIXBuilderParameters(KeyStore, CertSelector)
	51	* PKIXBuilderParameters(KeyStore, CertSelector)}, specifying a
	52	* <code>KeyStore</code> instance containing trusted certificate entries, each
	53	* of which will be considered as a most-trusted CA.
	54	*
	55	* <p>In addition, an application must specify constraints on the target
	56	* certificate that the <code>CertPathBuilder</code> will attempt
	57	* to build a path to. The constraints are specified as a
	58	* <code>CertSelector</code> object. These constraints should provide the
	59	* <code>CertPathBuilder</code> with enough search criteria to find the target
	60	* certificate. Minimal criteria for an <code>X509Certificate</code> usually
	61	* include the subject name and/or one or more subject alternative names.
	62	* If enough criteria is not specified, the <code>CertPathBuilder</code>
	63	* may throw a <code>CertPathBuilderException</code>.
	64	* <p>
	65	* <b>Concurrent Access</b>
	66	* <p>
	67	* Unless otherwise specified, the methods defined in this class are not
	68	* thread-safe. Multiple threads that need to access a single
	69	* object concurrently should synchronize amongst themselves and
	70	* provide the necessary locking. Multiple threads each manipulating
	71	* separate objects need not synchronize.
	72	*
	73	* @see CertPathBuilder
	74	*
	75	* @since 1.4
	76	* @author Sean Mullan
	77	*/
	78	public class PKIXBuilderParameters extends PKIXParameters {
	79
	80	private int maxPathLength = 5;
	81
	82	/**
	83	* Creates an instance of <code>PKIXBuilderParameters</code> with
	84	* the specified <code>Set</code> of most-trusted CAs.
	85	* Each element of the set is a {@link TrustAnchor TrustAnchor}.
	86	*
	87	* <p>Note that the <code>Set</code> is copied to protect against
	88	* subsequent modifications.
	89	*
	90	* @param trustAnchors a <code>Set</code> of <code>TrustAnchor</code>s
	91	* @param targetConstraints a <code>CertSelector</code> specifying the
	92	* constraints on the target certificate
	93	* @throws InvalidAlgorithmParameterException if <code>trustAnchors</code>
	94	* is empty <code>(trustAnchors.isEmpty() == true)</code>
	95	* @throws NullPointerException if <code>trustAnchors</code> is
	96	* <code>null</code>
	97	* @throws ClassCastException if any of the elements of
	98	* <code>trustAnchors</code> are not of type
	99	* <code>java.security.cert.TrustAnchor</code>
	100	*/
	101	public PKIXBuilderParameters(Set<TrustAnchor> trustAnchors, CertSelector
	102	targetConstraints) throws InvalidAlgorithmParameterException
	103	{
	104	super(trustAnchors);
	105	setTargetCertConstraints(targetConstraints);
	106	}
	107
	108	/**
	109	* Creates an instance of <code>PKIXBuilderParameters</code> that
	110	* populates the set of most-trusted CAs from the trusted
	111	* certificate entries contained in the specified <code>KeyStore</code>.
	112	* Only keystore entries that contain trusted <code>X509Certificate</code>s
	113	* are considered; all other certificate types are ignored.
	114	*
	115	* @param keystore a <code>KeyStore</code> from which the set of
	116	* most-trusted CAs will be populated
	117	* @param targetConstraints a <code>CertSelector</code> specifying the
	118	* constraints on the target certificate
	119	* @throws KeyStoreException if <code>keystore</code> has not been
	120	* initialized
	121	* @throws InvalidAlgorithmParameterException if <code>keystore</code> does
	122	* not contain at least one trusted certificate entry
	123	* @throws NullPointerException if <code>keystore</code> is
	124	* <code>null</code>
	125	*/
	126	public PKIXBuilderParameters(KeyStore keystore,
	127	CertSelector targetConstraints)
	128	throws KeyStoreException, InvalidAlgorithmParameterException
	129	{
	130	super(keystore);
	131	setTargetCertConstraints(targetConstraints);
	132	}
	133
	134	/**
	135	* Sets the value of the maximum number of non-self-issued intermediate
	136	* certificates that may exist in a certification path. A certificate
	137	* is self-issued if the DNs that appear in the subject and issuer
	138	* fields are identical and are not empty. Note that the last certificate
	139	* in a certification path is not an intermediate certificate, and is not
	140	* included in this limit. Usually the last certificate is an end entity
	141	* certificate, but it can be a CA certificate. A PKIX
	142	* <code>CertPathBuilder</code> instance must not build
	143	* paths longer than the length specified.
	144	*
	145	* <p> A value of 0 implies that the path can only contain
	146	* a single certificate. A value of -1 implies that the
	147	* path length is unconstrained (i.e. there is no maximum).
	148	* The default maximum path length, if not specified, is 5.
	149	* Setting a value less than -1 will cause an exception to be thrown.
	150	*
	151	* <p> If any of the CA certificates contain the
	152	* <code>BasicConstraintsExtension</code>, the value of the
	153	* <code>pathLenConstraint</code> field of the extension overrides
	154	* the maximum path length parameter whenever the result is a
	155	* certification path of smaller length.
	156	*
	157	* @param maxPathLength the maximum number of non-self-issued intermediate
	158	* certificates that may exist in a certification path
	159	* @throws InvalidParameterException if <code>maxPathLength</code> is set
	160	* to a value less than -1
	161	*
	162	* @see #getMaxPathLength
	163	*/
	164	public void setMaxPathLength(int maxPathLength) {
	165	if (maxPathLength < -1) {
	166	throw new InvalidParameterException("the maximum path "
	167	+ "length parameter can not be less than -1");
	168	}
	169	this.maxPathLength = maxPathLength;
	170	}
	171
	172	/**
	173	* Returns the value of the maximum number of intermediate non-self-issued
	174	* certificates that may exist in a certification path. See
	175	* the {@link #setMaxPathLength} method for more details.
	176	*
	177	* @return the maximum number of non-self-issued intermediate certificates
	178	* that may exist in a certification path, or -1 if there is no limit
	179	*
	180	* @see #setMaxPathLength
	181	*/
	182	public int getMaxPathLength() {
	183	return maxPathLength;
	184	}
	185
	186	/**
	187	* Returns a formatted string describing the parameters.
	188	*
	189	* @return a formatted string describing the parameters
	190	*/
	191	public String toString() {
	192	StringBuffer sb = new StringBuffer();
	193	sb.append("[\n");
	194	sb.append(super.toString());
	195	sb.append(" Maximum Path Length: " + maxPathLength + "\n");
	196	sb.append("]\n");
	197	return sb.toString();
	198	}
	199	}

java/pkg/java/security/cert/PKIXCertPathBuilderResult.class+0−0

Binary file not shown.

java/pkg/java/security/cert/PKIXCertPathBuilderResult.java+119−0

@@ -0,0 +1,119 @@
	1	/*
	2	* Copyright (c) 2000, 2001, Oracle and/or its affiliates. All rights reserved.
	3	* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
	4	*
	5	* This code is free software; you can redistribute it and/or modify it
	6	* under the terms of the GNU General Public License version 2 only, as
	7	* published by the Free Software Foundation. Oracle designates this
	8	* particular file as subject to the "Classpath" exception as provided
	9	* by Oracle in the LICENSE file that accompanied this code.
	10	*
	11	* This code is distributed in the hope that it will be useful, but WITHOUT
	12	* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
	13	* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
	14	* version 2 for more details (a copy is included in the LICENSE file that
	15	* accompanied this code).
	16	*
	17	* You should have received a copy of the GNU General Public License version
	18	* 2 along with this work; if not, write to the Free Software Foundation,
	19	* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
	20	*
	21	* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
	22	* or visit www.oracle.com if you need additional information or have any
	23	* questions.
	24	*/
	25
	26	package java.security.cert;
	27
	28	import java.security.PublicKey;
	29
	30	/**
	31	* This class represents the successful result of the PKIX certification
	32	* path builder algorithm. All certification paths that are built and
	33	* returned using this algorithm are also validated according to the PKIX
	34	* certification path validation algorithm.
	35	*
	36	* <p>Instances of <code>PKIXCertPathBuilderResult</code> are returned by
	37	* the <code>build</code> method of <code>CertPathBuilder</code>
	38	* objects implementing the PKIX algorithm.
	39	*
	40	* <p>All <code>PKIXCertPathBuilderResult</code> objects contain the
	41	* certification path constructed by the build algorithm, the
	42	* valid policy tree and subject public key resulting from the build
	43	* algorithm, and a <code>TrustAnchor</code> describing the certification
	44	* authority (CA) that served as a trust anchor for the certification path.
	45	* <p>
	46	* <b>Concurrent Access</b>
	47	* <p>
	48	* Unless otherwise specified, the methods defined in this class are not
	49	* thread-safe. Multiple threads that need to access a single
	50	* object concurrently should synchronize amongst themselves and
	51	* provide the necessary locking. Multiple threads each manipulating
	52	* separate objects need not synchronize.
	53	*
	54	* @see CertPathBuilderResult
	55	*
	56	* @since 1.4
	57	* @author Anne Anderson
	58	*/
	59	public class PKIXCertPathBuilderResult extends PKIXCertPathValidatorResult
	60	implements CertPathBuilderResult {
	61
	62	private CertPath certPath;
	63
	64	/**
	65	* Creates an instance of <code>PKIXCertPathBuilderResult</code>
	66	* containing the specified parameters.
	67	*
	68	* @param certPath the validated <code>CertPath</code>
	69	* @param trustAnchor a <code>TrustAnchor</code> describing the CA that
	70	* served as a trust anchor for the certification path
	71	* @param policyTree the immutable valid policy tree, or <code>null</code>
	72	* if there are no valid policies
	73	* @param subjectPublicKey the public key of the subject
	74	* @throws NullPointerException if the <code>certPath</code>,
	75	* <code>trustAnchor</code> or <code>subjectPublicKey</code> parameters
	76	* are <code>null</code>
	77	*/
	78	public PKIXCertPathBuilderResult(CertPath certPath,
	79	TrustAnchor trustAnchor, PolicyNode policyTree,
	80	PublicKey subjectPublicKey)
	81	{
	82	super(trustAnchor, policyTree, subjectPublicKey);
	83	if (certPath == null)
	84	throw new NullPointerException("certPath must be non-null");
	85	this.certPath = certPath;
	86	}
	87
	88	/**
	89	* Returns the built and validated certification path. The
	90	* <code>CertPath</code> object does not include the trust anchor.
	91	* Instead, use the {@link #getTrustAnchor() getTrustAnchor()} method to
	92	* obtain the <code>TrustAnchor</code> that served as the trust anchor
	93	* for the certification path.
	94	*
	95	* @return the built and validated <code>CertPath</code> (never
	96	* <code>null</code>)
	97	*/
	98	public CertPath getCertPath() {
	99	return certPath;
	100	}
	101
	102	/**
	103	* Return a printable representation of this
	104	* <code>PKIXCertPathBuilderResult</code>.
	105	*
	106	* @return a <code>String</code> describing the contents of this
	107	* <code>PKIXCertPathBuilderResult</code>
	108	*/
	109	public String toString() {
	110	StringBuffer sb = new StringBuffer();
	111	sb.append("PKIXCertPathBuilderResult: [\n");
	112	sb.append(" Certification Path: " + certPath + "\n");
	113	sb.append(" Trust Anchor: " + getTrustAnchor().toString() + "\n");
	114	sb.append(" Policy Tree: " + String.valueOf(getPolicyTree()) + "\n");
	115	sb.append(" Subject Public Key: " + getPublicKey() + "\n");
	116	sb.append("]");
	117	return sb.toString();
	118	}
	119	}

java/pkg/java/security/cert/PKIXCertPathChecker.class+0−0

Binary file not shown.

java/pkg/java/security/cert/PKIXCertPathChecker.java+181−0

@@ -0,0 +1,181 @@
	1	/*
	2	* Copyright (c) 2000, 2003, Oracle and/or its affiliates. All rights reserved.
	3	* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
	4	*
	5	* This code is free software; you can redistribute it and/or modify it
	6	* under the terms of the GNU General Public License version 2 only, as
	7	* published by the Free Software Foundation. Oracle designates this
	8	* particular file as subject to the "Classpath" exception as provided
	9	* by Oracle in the LICENSE file that accompanied this code.
	10	*
	11	* This code is distributed in the hope that it will be useful, but WITHOUT
	12	* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
	13	* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
	14	* version 2 for more details (a copy is included in the LICENSE file that
	15	* accompanied this code).
	16	*
	17	* You should have received a copy of the GNU General Public License version
	18	* 2 along with this work; if not, write to the Free Software Foundation,
	19	* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
	20	*
	21	* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
	22	* or visit www.oracle.com if you need additional information or have any
	23	* questions.
	24	*/
	25
	26	package java.security.cert;
	27
	28	import java.util.Collection;
	29	import java.util.Set;
	30
	31	/**
	32	* An abstract class that performs one or more checks on an
	33	* <code>X509Certificate</code>.
	34	*
	35	* <p>A concrete implementation of the <code>PKIXCertPathChecker</code> class
	36	* can be created to extend the PKIX certification path validation algorithm.
	37	* For example, an implementation may check for and process a critical private
	38	* extension of each certificate in a certification path.
	39	*
	40	* <p>Instances of <code>PKIXCertPathChecker</code> are passed as parameters
	41	* using the {@link PKIXParameters#setCertPathCheckers setCertPathCheckers}
	42	* or {@link PKIXParameters#addCertPathChecker addCertPathChecker} methods
	43	* of the <code>PKIXParameters</code> and <code>PKIXBuilderParameters</code>
	44	* class. Each of the <code>PKIXCertPathChecker</code>s {@link #check check}
	45	* methods will be called, in turn, for each certificate processed by a PKIX
	46	* <code>CertPathValidator</code> or <code>CertPathBuilder</code>
	47	* implementation.
	48	*
	49	* <p>A <code>PKIXCertPathChecker</code> may be called multiple times on
	50	* successive certificates in a certification path. Concrete subclasses
	51	* are expected to maintain any internal state that may be necessary to
	52	* check successive certificates. The {@link #init init} method is used
	53	* to initialize the internal state of the checker so that the certificates
	54	* of a new certification path may be checked. A stateful implementation
	55	* <b>must</b> override the {@link #clone clone} method if necessary in
	56	* order to allow a PKIX <code>CertPathBuilder</code> to efficiently
	57	* backtrack and try other paths. In these situations, the
	58	* <code>CertPathBuilder</code> is able to restore prior path validation
	59	* states by restoring the cloned <code>PKIXCertPathChecker</code>s.
	60	*
	61	* <p>The order in which the certificates are presented to the
	62	* <code>PKIXCertPathChecker</code> may be either in the forward direction
	63	* (from target to most-trusted CA) or in the reverse direction (from
	64	* most-trusted CA to target). A <code>PKIXCertPathChecker</code> implementation
	65	* <b>must</b> support reverse checking (the ability to perform its checks when
	66	* it is presented with certificates in the reverse direction) and <b>may</b>
	67	* support forward checking (the ability to perform its checks when it is
	68	* presented with certificates in the forward direction). The
	69	* {@link #isForwardCheckingSupported isForwardCheckingSupported} method
	70	* indicates whether forward checking is supported.
	71	* <p>
	72	* Additional input parameters required for executing the check may be
	73	* specified through constructors of concrete implementations of this class.
	74	* <p>
	75	* <b>Concurrent Access</b>
	76	* <p>
	77	* Unless otherwise specified, the methods defined in this class are not
	78	* thread-safe. Multiple threads that need to access a single
	79	* object concurrently should synchronize amongst themselves and
	80	* provide the necessary locking. Multiple threads each manipulating
	81	* separate objects need not synchronize.
	82	*
	83	* @see PKIXParameters
	84	* @see PKIXBuilderParameters
	85	*
	86	* @since 1.4
	87	* @author Yassir Elley
	88	* @author Sean Mullan
	89	*/
	90	public abstract class PKIXCertPathChecker implements Cloneable {
	91
	92	/**
	93	* Default constructor.
	94	*/
	95	protected PKIXCertPathChecker() {}
	96
	97	/**
	98	* Initializes the internal state of this <code>PKIXCertPathChecker</code>.
	99	* <p>
	100	* The <code>forward</code> flag specifies the order that
	101	* certificates will be passed to the {@link #check check} method
	102	* (forward or reverse). A <code>PKIXCertPathChecker</code> <b>must</b>
	103	* support reverse checking and <b>may</b> support forward checking.
	104	*
	105	* @param forward the order that certificates are presented to
	106	* the <code>check</code> method. If <code>true</code>, certificates
	107	* are presented from target to most-trusted CA (forward); if
	108	* <code>false</code>, from most-trusted CA to target (reverse).
	109	* @throws CertPathValidatorException if this
	110	* <code>PKIXCertPathChecker</code> is unable to check certificates in
	111	* the specified order; it should never be thrown if the forward flag
	112	* is false since reverse checking must be supported
	113	*/
	114	public abstract void init(boolean forward)
	115	throws CertPathValidatorException;
	116
	117	/**
	118	* Indicates if forward checking is supported. Forward checking refers
	119	* to the ability of the <code>PKIXCertPathChecker</code> to perform
	120	* its checks when certificates are presented to the <code>check</code>
	121	* method in the forward direction (from target to most-trusted CA).
	122	*
	123	* @return <code>true</code> if forward checking is supported,
	124	* <code>false</code> otherwise
	125	*/
	126	public abstract boolean isForwardCheckingSupported();
	127
	128	/**
	129	* Returns an immutable <code>Set</code> of X.509 certificate extensions
	130	* that this <code>PKIXCertPathChecker</code> supports (i.e. recognizes, is
	131	* able to process), or <code>null</code> if no extensions are supported.
	132	* <p>
	133	* Each element of the set is a <code>String</code> representing the
	134	* Object Identifier (OID) of the X.509 extension that is supported.
	135	* The OID is represented by a set of nonnegative integers separated by
	136	* periods.
	137	* <p>
	138	* All X.509 certificate extensions that a <code>PKIXCertPathChecker</code>
	139	* might possibly be able to process should be included in the set.
	140	*
	141	* @return an immutable <code>Set</code> of X.509 extension OIDs (in
	142	* <code>String</code> format) supported by this
	143	* <code>PKIXCertPathChecker</code>, or <code>null</code> if no
	144	* extensions are supported
	145	*/
	146	public abstract Set<String> getSupportedExtensions();
	147
	148	/**
	149	* Performs the check(s) on the specified certificate using its internal
	150	* state and removes any critical extensions that it processes from the
	151	* specified collection of OID strings that represent the unresolved
	152	* critical extensions. The certificates are presented in the order
	153	* specified by the <code>init</code> method.
	154	*
	155	* @param cert the <code>Certificate</code> to be checked
	156	* @param unresolvedCritExts a <code>Collection</code> of OID strings
	157	* representing the current set of unresolved critical extensions
	158	* @exception CertPathValidatorException if the specified certificate does
	159	* not pass the check
	160	*/
	161	public abstract void check(Certificate cert,
	162	Collection<String> unresolvedCritExts)
	163	throws CertPathValidatorException;
	164
	165	/**
	166	* Returns a clone of this object. Calls the <code>Object.clone()</code>
	167	* method.
	168	* All subclasses which maintain state must support and
	169	* override this method, if necessary.
	170	*
	171	* @return a copy of this <code>PKIXCertPathChecker</code>
	172	*/
	173	public Object clone() {
	174	try {
	175	return super.clone();
	176	} catch (CloneNotSupportedException e) {
	177	/* Cannot happen */
	178	throw new InternalError(e.toString());
	179	}
	180	}
	181	}

java/pkg/java/security/cert/PKIXCertPathValidatorResult.class+0−0

Binary file not shown.

java/pkg/java/security/cert/PKIXCertPathValidatorResult.java+159−0

@@ -0,0 +1,159 @@
	1	/*
	2	* Copyright (c) 2000, 2001, Oracle and/or its affiliates. All rights reserved.
	3	* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
	4	*
	5	* This code is free software; you can redistribute it and/or modify it
	6	* under the terms of the GNU General Public License version 2 only, as
	7	* published by the Free Software Foundation. Oracle designates this
	8	* particular file as subject to the "Classpath" exception as provided
	9	* by Oracle in the LICENSE file that accompanied this code.
	10	*
	11	* This code is distributed in the hope that it will be useful, but WITHOUT
	12	* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
	13	* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
	14	* version 2 for more details (a copy is included in the LICENSE file that
	15	* accompanied this code).
	16	*
	17	* You should have received a copy of the GNU General Public License version
	18	* 2 along with this work; if not, write to the Free Software Foundation,
	19	* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
	20	*
	21	* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
	22	* or visit www.oracle.com if you need additional information or have any
	23	* questions.
	24	*/
	25
	26	package java.security.cert;
	27
	28	import java.security.PublicKey;
	29
	30	/**
	31	* This class represents the successful result of the PKIX certification
	32	* path validation algorithm.
	33	*
	34	* <p>Instances of <code>PKIXCertPathValidatorResult</code> are returned by the
	35	* {@link CertPathValidator#validate validate} method of
	36	* <code>CertPathValidator</code> objects implementing the PKIX algorithm.
	37	*
	38	* <p> All <code>PKIXCertPathValidatorResult</code> objects contain the
	39	* valid policy tree and subject public key resulting from the
	40	* validation algorithm, as well as a <code>TrustAnchor</code> describing
	41	* the certification authority (CA) that served as a trust anchor for the
	42	* certification path.
	43	* <p>
	44	* <b>Concurrent Access</b>
	45	* <p>
	46	* Unless otherwise specified, the methods defined in this class are not
	47	* thread-safe. Multiple threads that need to access a single
	48	* object concurrently should synchronize amongst themselves and
	49	* provide the necessary locking. Multiple threads each manipulating
	50	* separate objects need not synchronize.
	51	*
	52	* @see CertPathValidatorResult
	53	*
	54	* @since 1.4
	55	* @author Yassir Elley
	56	* @author Sean Mullan
	57	*/
	58	public class PKIXCertPathValidatorResult implements CertPathValidatorResult {
	59
	60	private TrustAnchor trustAnchor;
	61	private PolicyNode policyTree;
	62	private PublicKey subjectPublicKey;
	63
	64	/**
	65	* Creates an instance of <code>PKIXCertPathValidatorResult</code>
	66	* containing the specified parameters.
	67	*
	68	* @param trustAnchor a <code>TrustAnchor</code> describing the CA that
	69	* served as a trust anchor for the certification path
	70	* @param policyTree the immutable valid policy tree, or <code>null</code>
	71	* if there are no valid policies
	72	* @param subjectPublicKey the public key of the subject
	73	* @throws NullPointerException if the <code>subjectPublicKey</code> or
	74	* <code>trustAnchor</code> parameters are <code>null</code>
	75	*/
	76	public PKIXCertPathValidatorResult(TrustAnchor trustAnchor,
	77	PolicyNode policyTree, PublicKey subjectPublicKey)
	78	{
	79	if (subjectPublicKey == null)
	80	throw new NullPointerException("subjectPublicKey must be non-null");
	81	if (trustAnchor == null)
	82	throw new NullPointerException("trustAnchor must be non-null");
	83	this.trustAnchor = trustAnchor;
	84	this.policyTree = policyTree;
	85	this.subjectPublicKey = subjectPublicKey;
	86	}
	87
	88	/**
	89	* Returns the <code>TrustAnchor</code> describing the CA that served
	90	* as a trust anchor for the certification path.
	91	*
	92	* @return the <code>TrustAnchor</code> (never <code>null</code>)
	93	*/
	94	public TrustAnchor getTrustAnchor() {
	95	return trustAnchor;
	96	}
	97
	98	/**
	99	* Returns the root node of the valid policy tree resulting from the
	100	* PKIX certification path validation algorithm. The
	101	* <code>PolicyNode</code> object that is returned and any objects that
	102	* it returns through public methods are immutable.
	103	*
	104	* <p>Most applications will not need to examine the valid policy tree.
	105	* They can achieve their policy processing goals by setting the
	106	* policy-related parameters in <code>PKIXParameters</code>. However, more
	107	* sophisticated applications, especially those that process policy
	108	* qualifiers, may need to traverse the valid policy tree using the
	109	* {@link PolicyNode#getParent PolicyNode.getParent} and
	110	* {@link PolicyNode#getChildren PolicyNode.getChildren} methods.
	111	*
	112	* @return the root node of the valid policy tree, or <code>null</code>
	113	* if there are no valid policies
	114	*/
	115	public PolicyNode getPolicyTree() {
	116	return policyTree;
	117	}
	118
	119	/**
	120	* Returns the public key of the subject (target) of the certification
	121	* path, including any inherited public key parameters if applicable.
	122	*
	123	* @return the public key of the subject (never <code>null</code>)
	124	*/
	125	public PublicKey getPublicKey() {
	126	return subjectPublicKey;
	127	}
	128
	129	/**
	130	* Returns a copy of this object.
	131	*
	132	* @return the copy
	133	*/
	134	public Object clone() {
	135	try {
	136	return super.clone();
	137	} catch (CloneNotSupportedException e) {
	138	/* Cannot happen */
	139	throw new InternalError(e.toString());
	140	}
	141	}
	142
	143	/**
	144	* Return a printable representation of this
	145	* <code>PKIXCertPathValidatorResult</code>.
	146	*
	147	* @return a <code>String</code> describing the contents of this
	148	* <code>PKIXCertPathValidatorResult</code>
	149	*/
	150	public String toString() {
	151	StringBuffer sb = new StringBuffer();
	152	sb.append("PKIXCertPathValidatorResult: [\n");
	153	sb.append(" Trust Anchor: " + trustAnchor.toString() + "\n");
	154	sb.append(" Policy Tree: " + String.valueOf(policyTree) + "\n");
	155	sb.append(" Subject Public Key: " + subjectPublicKey + "\n");
	156	sb.append("]");
	157	return sb.toString();
	158	}
	159	}

java/pkg/java/security/cert/PKIXParameters.class+0−0

Binary file not shown.

java/pkg/java/security/cert/PKIXParameters.java+736−0

@@ -0,0 +1,736 @@
	1	/*
	2	* Copyright (c) 2000, 2010, Oracle and/or its affiliates. All rights reserved.
	3	* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
	4	*
	5	* This code is free software; you can redistribute it and/or modify it
	6	* under the terms of the GNU General Public License version 2 only, as
	7	* published by the Free Software Foundation. Oracle designates this
	8	* particular file as subject to the "Classpath" exception as provided
	9	* by Oracle in the LICENSE file that accompanied this code.
	10	*
	11	* This code is distributed in the hope that it will be useful, but WITHOUT
	12	* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
	13	* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
	14	* version 2 for more details (a copy is included in the LICENSE file that
	15	* accompanied this code).
	16	*
	17	* You should have received a copy of the GNU General Public License version
	18	* 2 along with this work; if not, write to the Free Software Foundation,
	19	* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
	20	*
	21	* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
	22	* or visit www.oracle.com if you need additional information or have any
	23	* questions.
	24	*/
	25
	26	package java.security.cert;
	27
	28	import java.security.InvalidAlgorithmParameterException;
	29	import java.security.KeyStore;
	30	import java.security.KeyStoreException;
	31	import java.util.ArrayList;
	32	import java.util.Collections;
	33	import java.util.Date;
	34	import java.util.Enumeration;
	35	import java.util.HashSet;
	36	import java.util.Iterator;
	37	import java.util.List;
	38	import java.util.Set;
	39
	40	/**
	41	* Parameters used as input for the PKIX <code>CertPathValidator</code>
	42	* algorithm.
	43	* <p>
	44	* A PKIX <code>CertPathValidator</code> uses these parameters to
	45	* validate a <code>CertPath</code> according to the PKIX certification path
	46	* validation algorithm.
	47	*
	48	* <p>To instantiate a <code>PKIXParameters</code> object, an
	49	* application must specify one or more <i>most-trusted CAs</i> as defined by
	50	* the PKIX certification path validation algorithm. The most-trusted CAs
	51	* can be specified using one of two constructors. An application
	52	* can call {@link #PKIXParameters(Set) PKIXParameters(Set)},
	53	* specifying a <code>Set</code> of <code>TrustAnchor</code> objects, each
	54	* of which identify a most-trusted CA. Alternatively, an application can call
	55	* {@link #PKIXParameters(KeyStore) PKIXParameters(KeyStore)}, specifying a
	56	* <code>KeyStore</code> instance containing trusted certificate entries, each
	57	* of which will be considered as a most-trusted CA.
	58	* <p>
	59	* Once a <code>PKIXParameters</code> object has been created, other parameters
	60	* can be specified (by calling {@link #setInitialPolicies setInitialPolicies}
	61	* or {@link #setDate setDate}, for instance) and then the
	62	* <code>PKIXParameters</code> is passed along with the <code>CertPath</code>
	63	* to be validated to {@link CertPathValidator#validate
	64	* CertPathValidator.validate}.
	65	* <p>
	66	* Any parameter that is not set (or is set to <code>null</code>) will
	67	* be set to the default value for that parameter. The default value for the
	68	* <code>date</code> parameter is <code>null</code>, which indicates
	69	* the current time when the path is validated. The default for the
	70	* remaining parameters is the least constrained.
	71	* <p>
	72	* <b>Concurrent Access</b>
	73	* <p>
	74	* Unless otherwise specified, the methods defined in this class are not
	75	* thread-safe. Multiple threads that need to access a single
	76	* object concurrently should synchronize amongst themselves and
	77	* provide the necessary locking. Multiple threads each manipulating
	78	* separate objects need not synchronize.
	79	*
	80	* @see CertPathValidator
	81	*
	82	* @since 1.4
	83	* @author Sean Mullan
	84	* @author Yassir Elley
	85	*/
	86	public class PKIXParameters implements CertPathParameters {
	87
	88	private Set<TrustAnchor> unmodTrustAnchors;
	89	private Date date;
	90	private List<PKIXCertPathChecker> certPathCheckers;
	91	private String sigProvider;
	92	private boolean revocationEnabled = true;
	93	private Set<String> unmodInitialPolicies;
	94	private boolean explicitPolicyRequired = false;
	95	private boolean policyMappingInhibited = false;
	96	private boolean anyPolicyInhibited = false;
	97	private boolean policyQualifiersRejected = true;
	98	private List<CertStore> certStores;
	99	private CertSelector certSelector;
	100
	101	/**
	102	* Creates an instance of <code>PKIXParameters</code> with the specified
	103	* <code>Set</code> of most-trusted CAs. Each element of the
	104	* set is a {@link TrustAnchor TrustAnchor}.
	105	* <p>
	106	* Note that the <code>Set</code> is copied to protect against
	107	* subsequent modifications.
	108	*
	109	* @param trustAnchors a <code>Set</code> of <code>TrustAnchor</code>s
	110	* @throws InvalidAlgorithmParameterException if the specified
	111	* <code>Set</code> is empty <code>(trustAnchors.isEmpty() == true)</code>
	112	* @throws NullPointerException if the specified <code>Set</code> is
	113	* <code>null</code>
	114	* @throws ClassCastException if any of the elements in the <code>Set</code>
	115	* are not of type <code>java.security.cert.TrustAnchor</code>
	116	*/
	117	public PKIXParameters(Set<TrustAnchor> trustAnchors)
	118	throws InvalidAlgorithmParameterException
	119	{
	120	setTrustAnchors(trustAnchors);
	121
	122	this.unmodInitialPolicies = Collections.<String>emptySet();
	123	this.certPathCheckers = new ArrayList<PKIXCertPathChecker>();
	124	this.certStores = new ArrayList<CertStore>();
	125	}
	126
	127	/**
	128	* Creates an instance of <code>PKIXParameters</code> that
	129	* populates the set of most-trusted CAs from the trusted
	130	* certificate entries contained in the specified <code>KeyStore</code>.
	131	* Only keystore entries that contain trusted <code>X509Certificates</code>
	132	* are considered; all other certificate types are ignored.
	133	*
	134	* @param keystore a <code>KeyStore</code> from which the set of
	135	* most-trusted CAs will be populated
	136	* @throws KeyStoreException if the keystore has not been initialized
	137	* @throws InvalidAlgorithmParameterException if the keystore does
	138	* not contain at least one trusted certificate entry
	139	* @throws NullPointerException if the keystore is <code>null</code>
	140	*/
	141	public PKIXParameters(KeyStore keystore)
	142	throws KeyStoreException, InvalidAlgorithmParameterException
	143	{
	144	if (keystore == null)
	145	throw new NullPointerException("the keystore parameter must be " +
	146	"non-null");
	147	Set<TrustAnchor> hashSet = new HashSet<TrustAnchor>();
	148	Enumeration<String> aliases = keystore.aliases();
	149	while (aliases.hasMoreElements()) {
	150	String alias = aliases.nextElement();
	151	if (keystore.isCertificateEntry(alias)) {
	152	Certificate cert = keystore.getCertificate(alias);
	153	if (cert instanceof X509Certificate)
	154	hashSet.add(new TrustAnchor((X509Certificate)cert, null));
	155	}
	156	}
	157	setTrustAnchors(hashSet);
	158	this.unmodInitialPolicies = Collections.<String>emptySet();
	159	this.certPathCheckers = new ArrayList<PKIXCertPathChecker>();
	160	this.certStores = new ArrayList<CertStore>();
	161	}
	162
	163	/**
	164	* Returns an immutable <code>Set</code> of the most-trusted
	165	* CAs.
	166	*
	167	* @return an immutable <code>Set</code> of <code>TrustAnchor</code>s
	168	* (never <code>null</code>)
	169	*
	170	* @see #setTrustAnchors
	171	*/
	172	public Set<TrustAnchor> getTrustAnchors() {
	173	return this.unmodTrustAnchors;
	174	}
	175
	176	/**
	177	* Sets the <code>Set</code> of most-trusted CAs.
	178	* <p>
	179	* Note that the <code>Set</code> is copied to protect against
	180	* subsequent modifications.
	181	*
	182	* @param trustAnchors a <code>Set</code> of <code>TrustAnchor</code>s
	183	* @throws InvalidAlgorithmParameterException if the specified
	184	* <code>Set</code> is empty <code>(trustAnchors.isEmpty() == true)</code>
	185	* @throws NullPointerException if the specified <code>Set</code> is
	186	* <code>null</code>
	187	* @throws ClassCastException if any of the elements in the set
	188	* are not of type <code>java.security.cert.TrustAnchor</code>
	189	*
	190	* @see #getTrustAnchors
	191	*/
	192	public void setTrustAnchors(Set<TrustAnchor> trustAnchors)
	193	throws InvalidAlgorithmParameterException
	194	{
	195	if (trustAnchors == null) {
	196	throw new NullPointerException("the trustAnchors parameters must" +
	197	" be non-null");
	198	}
	199	if (trustAnchors.isEmpty()) {
	200	throw new InvalidAlgorithmParameterException("the trustAnchors " +
	201	"parameter must be non-empty");
	202	}
	203	for (Iterator<TrustAnchor> i = trustAnchors.iterator(); i.hasNext(); ) {
	204	if (!(i.next() instanceof TrustAnchor)) {
	205	throw new ClassCastException("all elements of set must be "
	206	+ "of type java.security.cert.TrustAnchor");
	207	}
	208	}
	209	this.unmodTrustAnchors = Collections.unmodifiableSet
	210	(new HashSet<TrustAnchor>(trustAnchors));
	211	}
	212
	213	/**
	214	* Returns an immutable <code>Set</code> of initial
	215	* policy identifiers (OID strings), indicating that any one of these
	216	* policies would be acceptable to the certificate user for the purposes of
	217	* certification path processing. The default return value is an empty
	218	* <code>Set</code>, which is interpreted as meaning that any policy would
	219	* be acceptable.
	220	*
	221	* @return an immutable <code>Set</code> of initial policy OIDs in
	222	* <code>String</code> format, or an empty <code>Set</code> (implying any
	223	* policy is acceptable). Never returns <code>null</code>.
	224	*
	225	* @see #setInitialPolicies
	226	*/
	227	public Set<String> getInitialPolicies() {
	228	return this.unmodInitialPolicies;
	229	}
	230
	231	/**
	232	* Sets the <code>Set</code> of initial policy identifiers
	233	* (OID strings), indicating that any one of these
	234	* policies would be acceptable to the certificate user for the purposes of
	235	* certification path processing. By default, any policy is acceptable
	236	* (i.e. all policies), so a user that wants to allow any policy as
	237	* acceptable does not need to call this method, or can call it
	238	* with an empty <code>Set</code> (or <code>null</code>).
	239	* <p>
	240	* Note that the <code>Set</code> is copied to protect against
	241	* subsequent modifications.
	242	*
	243	* @param initialPolicies a <code>Set</code> of initial policy
	244	* OIDs in <code>String</code> format (or <code>null</code>)
	245	* @throws ClassCastException if any of the elements in the set are
	246	* not of type <code>String</code>
	247	*
	248	* @see #getInitialPolicies
	249	*/
	250	public void setInitialPolicies(Set<String> initialPolicies) {
	251	if (initialPolicies != null) {
	252	for (Iterator<String> i = initialPolicies.iterator();
	253	i.hasNext();) {
	254	if (!(i.next() instanceof String))
	255	throw new ClassCastException("all elements of set must be "
	256	+ "of type java.lang.String");
	257	}
	258	this.unmodInitialPolicies =
	259	Collections.unmodifiableSet(new HashSet<String>(initialPolicies));
	260	} else
	261	this.unmodInitialPolicies = Collections.<String>emptySet();
	262	}
	263
	264	/**
	265	* Sets the list of <code>CertStore</code>s to be used in finding
	266	* certificates and CRLs. May be <code>null</code>, in which case
	267	* no <code>CertStore</code>s will be used. The first
	268	* <code>CertStore</code>s in the list may be preferred to those that
	269	* appear later.
	270	* <p>
	271	* Note that the <code>List</code> is copied to protect against
	272	* subsequent modifications.
	273	*
	274	* @param stores a <code>List</code> of <code>CertStore</code>s (or
	275	* <code>null</code>)
	276	* @throws ClassCastException if any of the elements in the list are
	277	* not of type <code>java.security.cert.CertStore</code>
	278	*
	279	* @see #getCertStores
	280	*/
	281	public void setCertStores(List<CertStore> stores) {
	282	if (stores == null) {
	283	this.certStores = new ArrayList<CertStore>();
	284	} else {
	285	for (Iterator<CertStore> i = stores.iterator(); i.hasNext();) {
	286	if (!(i.next() instanceof CertStore)) {
	287	throw new ClassCastException("all elements of list must be "
	288	+ "of type java.security.cert.CertStore");
	289	}
	290	}
	291	this.certStores = new ArrayList<CertStore>(stores);
	292	}
	293	}
	294
	295	/**
	296	* Adds a <code>CertStore</code> to the end of the list of
	297	* <code>CertStore</code>s used in finding certificates and CRLs.
	298	*
	299	* @param store the <code>CertStore</code> to add. If <code>null</code>,
	300	* the store is ignored (not added to list).
	301	*/
	302	public void addCertStore(CertStore store) {
	303	if (store != null) {
	304	this.certStores.add(store);
	305	}
	306	}
	307
	308	/**
	309	* Returns an immutable <code>List</code> of <code>CertStore</code>s that
	310	* are used to find certificates and CRLs.
	311	*
	312	* @return an immutable <code>List</code> of <code>CertStore</code>s
	313	* (may be empty, but never <code>null</code>)
	314	*
	315	* @see #setCertStores
	316	*/
	317	public List<CertStore> getCertStores() {
	318	return Collections.unmodifiableList
	319	(new ArrayList<CertStore>(this.certStores));
	320	}
	321
	322	/**
	323	* Sets the RevocationEnabled flag. If this flag is true, the default
	324	* revocation checking mechanism of the underlying PKIX service provider
	325	* will be used. If this flag is false, the default revocation checking
	326	* mechanism will be disabled (not used).
	327	* <p>
	328	* When a <code>PKIXParameters</code> object is created, this flag is set
	329	* to true. This setting reflects the most common strategy for checking
	330	* revocation, since each service provider must support revocation
	331	* checking to be PKIX compliant. Sophisticated applications should set
	332	* this flag to false when it is not practical to use a PKIX service
	333	* provider's default revocation checking mechanism or when an alternative
	334	* revocation checking mechanism is to be substituted (by also calling the
	335	* {@link #addCertPathChecker addCertPathChecker} or {@link
	336	* #setCertPathCheckers setCertPathCheckers} methods).
	337	*
	338	* @param val the new value of the RevocationEnabled flag
	339	*/
	340	public void setRevocationEnabled(boolean val) {
	341	revocationEnabled = val;
	342	}
	343
	344	/**
	345	* Checks the RevocationEnabled flag. If this flag is true, the default
	346	* revocation checking mechanism of the underlying PKIX service provider
	347	* will be used. If this flag is false, the default revocation checking
	348	* mechanism will be disabled (not used). See the {@link
	349	* #setRevocationEnabled setRevocationEnabled} method for more details on
	350	* setting the value of this flag.
	351	*
	352	* @return the current value of the RevocationEnabled flag
	353	*/
	354	public boolean isRevocationEnabled() {
	355	return revocationEnabled;
	356	}
	357
	358	/**
	359	* Sets the ExplicitPolicyRequired flag. If this flag is true, an
	360	* acceptable policy needs to be explicitly identified in every certificate.
	361	* By default, the ExplicitPolicyRequired flag is false.
	362	*
	363	* @param val <code>true</code> if explicit policy is to be required,
	364	* <code>false</code> otherwise
	365	*/
	366	public void setExplicitPolicyRequired(boolean val) {
	367	explicitPolicyRequired = val;
	368	}
	369
	370	/**
	371	* Checks if explicit policy is required. If this flag is true, an
	372	* acceptable policy needs to be explicitly identified in every certificate.
	373	* By default, the ExplicitPolicyRequired flag is false.
	374	*
	375	* @return <code>true</code> if explicit policy is required,
	376	* <code>false</code> otherwise
	377	*/
	378	public boolean isExplicitPolicyRequired() {
	379	return explicitPolicyRequired;
	380	}
	381
	382	/**
	383	* Sets the PolicyMappingInhibited flag. If this flag is true, policy
	384	* mapping is inhibited. By default, policy mapping is not inhibited (the
	385	* flag is false).
	386	*
	387	* @param val <code>true</code> if policy mapping is to be inhibited,
	388	* <code>false</code> otherwise
	389	*/
	390	public void setPolicyMappingInhibited(boolean val) {
	391	policyMappingInhibited = val;
	392	}
	393
	394	/**
	395	* Checks if policy mapping is inhibited. If this flag is true, policy
	396	* mapping is inhibited. By default, policy mapping is not inhibited (the
	397	* flag is false).
	398	*
	399	* @return true if policy mapping is inhibited, false otherwise
	400	*/
	401	public boolean isPolicyMappingInhibited() {
	402	return policyMappingInhibited;
	403	}
	404
	405	/**
	406	* Sets state to determine if the any policy OID should be processed
	407	* if it is included in a certificate. By default, the any policy OID
	408	* is not inhibited ({@link #isAnyPolicyInhibited isAnyPolicyInhibited()}
	409	* returns <code>false</code>).
	410	*
	411	* @param val <code>true</code> if the any policy OID is to be
	412	* inhibited, <code>false</code> otherwise
	413	*/
	414	public void setAnyPolicyInhibited(boolean val) {
	415	anyPolicyInhibited = val;
	416	}
	417
	418	/**
	419	* Checks whether the any policy OID should be processed if it
	420	* is included in a certificate.
	421	*
	422	* @return <code>true</code> if the any policy OID is inhibited,
	423	* <code>false</code> otherwise
	424	*/
	425	public boolean isAnyPolicyInhibited() {
	426	return anyPolicyInhibited;
	427	}
	428
	429	/**
	430	* Sets the PolicyQualifiersRejected flag. If this flag is true,
	431	* certificates that include policy qualifiers in a certificate
	432	* policies extension that is marked critical are rejected.
	433	* If the flag is false, certificates are not rejected on this basis.
	434	*
	435	* <p> When a <code>PKIXParameters</code> object is created, this flag is
	436	* set to true. This setting reflects the most common (and simplest)
	437	* strategy for processing policy qualifiers. Applications that want to use
	438	* a more sophisticated policy must set this flag to false.
	439	* <p>
	440	* Note that the PKIX certification path validation algorithm specifies
	441	* that any policy qualifier in a certificate policies extension that is
	442	* marked critical must be processed and validated. Otherwise the
	443	* certification path must be rejected. If the policyQualifiersRejected flag
	444	* is set to false, it is up to the application to validate all policy
	445	* qualifiers in this manner in order to be PKIX compliant.
	446	*
	447	* @param qualifiersRejected the new value of the PolicyQualifiersRejected
	448	* flag
	449	* @see #getPolicyQualifiersRejected
	450	* @see PolicyQualifierInfo
	451	*/
	452	public void setPolicyQualifiersRejected(boolean qualifiersRejected) {
	453	policyQualifiersRejected = qualifiersRejected;
	454	}
	455
	456	/**
	457	* Gets the PolicyQualifiersRejected flag. If this flag is true,
	458	* certificates that include policy qualifiers in a certificate policies
	459	* extension that is marked critical are rejected.
	460	* If the flag is false, certificates are not rejected on this basis.
	461	*
	462	* <p> When a <code>PKIXParameters</code> object is created, this flag is
	463	* set to true. This setting reflects the most common (and simplest)
	464	* strategy for processing policy qualifiers. Applications that want to use
	465	* a more sophisticated policy must set this flag to false.
	466	*
	467	* @return the current value of the PolicyQualifiersRejected flag
	468	* @see #setPolicyQualifiersRejected
	469	*/
	470	public boolean getPolicyQualifiersRejected() {
	471	return policyQualifiersRejected;
	472	}
	473
	474	/**
	475	* Returns the time for which the validity of the certification path
	476	* should be determined. If <code>null</code>, the current time is used.
	477	* <p>
	478	* Note that the <code>Date</code> returned is copied to protect against
	479	* subsequent modifications.
	480	*
	481	* @return the <code>Date</code>, or <code>null</code> if not set
	482	* @see #setDate
	483	*/
	484	public Date getDate() {
	485	if (date == null)
	486	return null;
	487	else
	488	return (Date) this.date.clone();
	489	}
	490
	491	/**
	492	* Sets the time for which the validity of the certification path
	493	* should be determined. If <code>null</code>, the current time is used.
	494	* <p>
	495	* Note that the <code>Date</code> supplied here is copied to protect
	496	* against subsequent modifications.
	497	*
	498	* @param date the <code>Date</code>, or <code>null</code> for the
	499	* current time
	500	* @see #getDate
	501	*/
	502	public void setDate(Date date) {
	503	if (date != null)
	504	this.date = (Date) date.clone();
	505	else
	506	date = null;
	507	}
	508
	509	/**
	510	* Sets a <code>List</code> of additional certification path checkers. If
	511	* the specified <code>List</code> contains an object that is not a
	512	* <code>PKIXCertPathChecker</code>, it is ignored.
	513	* <p>
	514	* Each <code>PKIXCertPathChecker</code> specified implements
	515	* additional checks on a certificate. Typically, these are checks to
	516	* process and verify private extensions contained in certificates.
	517	* Each <code>PKIXCertPathChecker</code> should be instantiated with any
	518	* initialization parameters needed to execute the check.
	519	* <p>
	520	* This method allows sophisticated applications to extend a PKIX
	521	* <code>CertPathValidator</code> or <code>CertPathBuilder</code>.
	522	* Each of the specified <code>PKIXCertPathChecker</code>s will be called,
	523	* in turn, by a PKIX <code>CertPathValidator</code> or
	524	* <code>CertPathBuilder</code> for each certificate processed or
	525	* validated.
	526	* <p>
	527	* Regardless of whether these additional <code>PKIXCertPathChecker</code>s
	528	* are set, a PKIX <code>CertPathValidator</code> or
	529	* <code>CertPathBuilder</code> must perform all of the required PKIX
	530	* checks on each certificate. The one exception to this rule is if the
	531	* RevocationEnabled flag is set to false (see the {@link
	532	* #setRevocationEnabled setRevocationEnabled} method).
	533	* <p>
	534	* Note that the <code>List</code> supplied here is copied and each
	535	* <code>PKIXCertPathChecker</code> in the list is cloned to protect
	536	* against subsequent modifications.
	537	*
	538	* @param checkers a <code>List</code> of <code>PKIXCertPathChecker</code>s.
	539	* May be <code>null</code>, in which case no additional checkers will be
	540	* used.
	541	* @throws ClassCastException if any of the elements in the list
	542	* are not of type <code>java.security.cert.PKIXCertPathChecker</code>
	543	* @see #getCertPathCheckers
	544	*/
	545	public void setCertPathCheckers(List<PKIXCertPathChecker> checkers) {
	546	if (checkers != null) {
	547	List<PKIXCertPathChecker> tmpList =
	548	new ArrayList<PKIXCertPathChecker>();
	549	for (PKIXCertPathChecker checker : checkers) {
	550	tmpList.add((PKIXCertPathChecker)checker.clone());
	551	}
	552	this.certPathCheckers = tmpList;
	553	} else {
	554	this.certPathCheckers = new ArrayList<PKIXCertPathChecker>();
	555	}
	556	}
	557
	558	/**
	559	* Returns the <code>List</code> of certification path checkers.
	560	* The returned <code>List</code> is immutable, and each
	561	* <code>PKIXCertPathChecker</code> in the <code>List</code> is cloned
	562	* to protect against subsequent modifications.
	563	*
	564	* @return an immutable <code>List</code> of
	565	* <code>PKIXCertPathChecker</code>s (may be empty, but not
	566	* <code>null</code>)
	567	* @see #setCertPathCheckers
	568	*/
	569	public List<PKIXCertPathChecker> getCertPathCheckers() {
	570	List<PKIXCertPathChecker> tmpList = new ArrayList<PKIXCertPathChecker>();
	571	for (PKIXCertPathChecker ck : certPathCheckers) {
	572	tmpList.add((PKIXCertPathChecker)ck.clone());
	573	}
	574	return Collections.unmodifiableList(tmpList);
	575	}
	576
	577	/**
	578	* Adds a <code>PKIXCertPathChecker</code> to the list of certification
	579	* path checkers. See the {@link #setCertPathCheckers setCertPathCheckers}
	580	* method for more details.
	581	* <p>
	582	* Note that the <code>PKIXCertPathChecker</code> is cloned to protect
	583	* against subsequent modifications.
	584	*
	585	* @param checker a <code>PKIXCertPathChecker</code> to add to the list of
	586	* checks. If <code>null</code>, the checker is ignored (not added to list).
	587	*/
	588	public void addCertPathChecker(PKIXCertPathChecker checker) {
	589	if (checker != null) {
	590	certPathCheckers.add((PKIXCertPathChecker)checker.clone());
	591	}
	592	}
	593
	594	/**
	595	* Returns the signature provider's name, or <code>null</code>
	596	* if not set.
	597	*
	598	* @return the signature provider's name (or <code>null</code>)
	599	* @see #setSigProvider
	600	*/
	601	public String getSigProvider() {
	602	return this.sigProvider;
	603	}
	604
	605	/**
	606	* Sets the signature provider's name. The specified provider will be
	607	* preferred when creating {@link java.security.Signature Signature}
	608	* objects. If <code>null</code> or not set, the first provider found
	609	* supporting the algorithm will be used.
	610	*
	611	* @param sigProvider the signature provider's name (or <code>null</code>)
	612	* @see #getSigProvider
	613	*/
	614	public void setSigProvider(String sigProvider) {
	615	this.sigProvider = sigProvider;
	616	}
	617
	618	/**
	619	* Returns the required constraints on the target certificate.
	620	* The constraints are returned as an instance of <code>CertSelector</code>.
	621	* If <code>null</code>, no constraints are defined.
	622	*
	623	* <p>Note that the <code>CertSelector</code> returned is cloned
	624	* to protect against subsequent modifications.
	625	*
	626	* @return a <code>CertSelector</code> specifying the constraints
	627	* on the target certificate (or <code>null</code>)
	628	* @see #setTargetCertConstraints
	629	*/
	630	public CertSelector getTargetCertConstraints() {
	631	if (certSelector != null) {
	632	return (CertSelector) certSelector.clone();
	633	} else {
	634	return null;
	635	}
	636	}
	637
	638	/**
	639	* Sets the required constraints on the target certificate.
	640	* The constraints are specified as an instance of
	641	* <code>CertSelector</code>. If <code>null</code>, no constraints are
	642	* defined.
	643	*
	644	* <p>Note that the <code>CertSelector</code> specified is cloned
	645	* to protect against subsequent modifications.
	646	*
	647	* @param selector a <code>CertSelector</code> specifying the constraints
	648	* on the target certificate (or <code>null</code>)
	649	* @see #getTargetCertConstraints
	650	*/
	651	public void setTargetCertConstraints(CertSelector selector) {
	652	if (selector != null)
	653	certSelector = (CertSelector) selector.clone();
	654	else
	655	certSelector = null;
	656	}
	657
	658	/**
	659	* Makes a copy of this <code>PKIXParameters</code> object. Changes
	660	* to the copy will not affect the original and vice versa.
	661	*
	662	* @return a copy of this <code>PKIXParameters</code> object
	663	*/
	664	public Object clone() {
	665	try {
	666	PKIXParameters copy = (PKIXParameters)super.clone();
	667
	668	// must clone these because addCertStore, et al. modify them
	669	if (certStores != null) {
	670	copy.certStores = new ArrayList<CertStore>(certStores);
	671	}
	672	if (certPathCheckers != null) {
	673	copy.certPathCheckers =
	674	new ArrayList<PKIXCertPathChecker>(certPathCheckers.size());
	675	for (PKIXCertPathChecker checker : certPathCheckers) {
	676	copy.certPathCheckers.add(
	677	(PKIXCertPathChecker)checker.clone());
	678	}
	679	}
	680
	681	// other class fields are immutable to public, don't bother
	682	// to clone the read-only fields.
	683	return copy;
	684	} catch (CloneNotSupportedException e) {
	685	/* Cannot happen */
	686	throw new InternalError(e.toString());
	687	}
	688	}
	689
	690	/**
	691	* Returns a formatted string describing the parameters.
	692	*
	693	* @return a formatted string describing the parameters.
	694	*/
	695	public String toString() {
	696	StringBuffer sb = new StringBuffer();
	697	sb.append("[\n");
	698
	699	/* start with trusted anchor info */
	700	if (unmodTrustAnchors != null) {
	701	sb.append(" Trust Anchors: " + unmodTrustAnchors.toString()
	702	+ "\n");
	703	}
	704
	705	/* now, append initial state information */
	706	if (unmodInitialPolicies != null) {
	707	if (unmodInitialPolicies.isEmpty()) {
	708	sb.append(" Initial Policy OIDs: any\n");
	709	} else {
	710	sb.append(" Initial Policy OIDs: ["
	711	+ unmodInitialPolicies.toString() + "]\n");
	712	}
	713	}
	714
	715	/* now, append constraints on all certificates in the path */
	716	sb.append(" Validity Date: " + String.valueOf(date) + "\n");
	717	sb.append(" Signature Provider: " + String.valueOf(sigProvider) + "\n");
	718	sb.append(" Default Revocation Enabled: " + revocationEnabled + "\n");
	719	sb.append(" Explicit Policy Required: " + explicitPolicyRequired + "\n");
	720	sb.append(" Policy Mapping Inhibited: " + policyMappingInhibited + "\n");
	721	sb.append(" Any Policy Inhibited: " + anyPolicyInhibited + "\n");
	722	sb.append(" Policy Qualifiers Rejected: " + policyQualifiersRejected + "\n");
	723
	724	/* now, append target cert requirements */
	725	sb.append(" Target Cert Constraints: " + String.valueOf(certSelector) + "\n");
	726
	727	/* finally, append miscellaneous parameters */
	728	if (certPathCheckers != null)
	729	sb.append(" Certification Path Checkers: ["
	730	+ certPathCheckers.toString() + "]\n");
	731	if (certStores != null)
	732	sb.append(" CertStores: [" + certStores.toString() + "]\n");
	733	sb.append("]");
	734	return sb.toString();
	735	}
	736	}

java/pkg/java/security/cert/PKIXReason.class+0−0

Binary file not shown.

java/pkg/java/security/cert/PKIXReason.java+77−0

@@ -0,0 +1,77 @@
	1	/*
	2	* Copyright (c) 2008, Oracle and/or its affiliates. All rights reserved.
	3	* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
	4	*
	5	* This code is free software; you can redistribute it and/or modify it
	6	* under the terms of the GNU General Public License version 2 only, as
	7	* published by the Free Software Foundation. Oracle designates this
	8	* particular file as subject to the "Classpath" exception as provided
	9	* by Oracle in the LICENSE file that accompanied this code.
	10	*
	11	* This code is distributed in the hope that it will be useful, but WITHOUT
	12	* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
	13	* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
	14	* version 2 for more details (a copy is included in the LICENSE file that
	15	* accompanied this code).
	16	*
	17	* You should have received a copy of the GNU General Public License version
	18	* 2 along with this work; if not, write to the Free Software Foundation,
	19	* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
	20	*
	21	* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
	22	* or visit www.oracle.com if you need additional information or have any
	23	* questions.
	24	*/
	25
	26	package java.security.cert;
	27
	28	/**
	29	* The <code>PKIXReason</code> enumerates the potential PKIX-specific reasons
	30	* that an X.509 certification path may be invalid according to the PKIX
	31	* (RFC 3280) standard. These reasons are in addition to those of the
	32	* <code>CertPathValidatorException.BasicReason</code> enumeration.
	33	*
	34	* @since 1.7
	35	*/
	36	public enum PKIXReason implements CertPathValidatorException.Reason {
	37	/**
	38	* The certificate does not chain correctly.
	39	*/
	40	NAME_CHAINING,
	41
	42	/**
	43	* The certificate's key usage is invalid.
	44	*/
	45	INVALID_KEY_USAGE,
	46
	47	/**
	48	* The policy constraints have been violated.
	49	*/
	50	INVALID_POLICY,
	51
	52	/**
	53	* No acceptable trust anchor found.
	54	*/
	55	NO_TRUST_ANCHOR,
	56
	57	/**
	58	* The certificate contains one or more unrecognized critical
	59	* extensions.
	60	*/
	61	UNRECOGNIZED_CRIT_EXT,
	62
	63	/**
	64	* The certificate is not a CA certificate.
	65	*/
	66	NOT_CA_CERT,
	67
	68	/**
	69	* The path length constraint has been violated.
	70	*/
	71	PATH_TOO_LONG,
	72
	73	/**
	74	* The name constraints have been violated.
	75	*/
	76	INVALID_NAME
	77	}

java/pkg/java/security/cert/PolicyNode.class+0−0

Binary file not shown.

java/pkg/java/security/cert/PolicyNode.java+133−0

@@ -0,0 +1,133 @@
	1	/*
	2	* Copyright (c) 2000, 2003, Oracle and/or its affiliates. All rights reserved.
	3	* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
	4	*
	5	* This code is free software; you can redistribute it and/or modify it
	6	* under the terms of the GNU General Public License version 2 only, as
	7	* published by the Free Software Foundation. Oracle designates this
	8	* particular file as subject to the "Classpath" exception as provided
	9	* by Oracle in the LICENSE file that accompanied this code.
	10	*
	11	* This code is distributed in the hope that it will be useful, but WITHOUT
	12	* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
	13	* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
	14	* version 2 for more details (a copy is included in the LICENSE file that
	15	* accompanied this code).
	16	*
	17	* You should have received a copy of the GNU General Public License version
	18	* 2 along with this work; if not, write to the Free Software Foundation,
	19	* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
	20	*
	21	* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
	22	* or visit www.oracle.com if you need additional information or have any
	23	* questions.
	24	*/
	25
	26	package java.security.cert;
	27
	28	import java.util.Iterator;
	29	import java.util.Set;
	30
	31	/**
	32	* An immutable valid policy tree node as defined by the PKIX certification
	33	* path validation algorithm.
	34	*
	35	* <p>One of the outputs of the PKIX certification path validation
	36	* algorithm is a valid policy tree, which includes the policies that
	37	* were determined to be valid, how this determination was reached,
	38	* and any policy qualifiers encountered. This tree is of depth
	39	* <i>n</i>, where <i>n</i> is the length of the certification
	40	* path that has been validated.
	41	*
	42	* <p>Most applications will not need to examine the valid policy tree.
	43	* They can achieve their policy processing goals by setting the
	44	* policy-related parameters in <code>PKIXParameters</code>. However,
	45	* the valid policy tree is available for more sophisticated applications,
	46	* especially those that process policy qualifiers.
	47	*
	48	* <p>{@link PKIXCertPathValidatorResult#getPolicyTree()
	49	* PKIXCertPathValidatorResult.getPolicyTree} returns the root node of the
	50	* valid policy tree. The tree can be traversed using the
	51	* {@link #getChildren getChildren} and {@link #getParent getParent} methods.
	52	* Data about a particular node can be retrieved using other methods of
	53	* <code>PolicyNode</code>.
	54	*
	55	* <p><b>Concurrent Access</b>
	56	* <p>All <code>PolicyNode</code> objects must be immutable and
	57	* thread-safe. Multiple threads may concurrently invoke the methods defined
	58	* in this class on a single <code>PolicyNode</code> object (or more than one)
	59	* with no ill effects. This stipulation applies to all public fields and
	60	* methods of this class and any added or overridden by subclasses.
	61	*
	62	* @since 1.4
	63	* @author Sean Mullan
	64	*/
	65	public interface PolicyNode {
	66
	67	/**
	68	* Returns the parent of this node, or <code>null</code> if this is the
	69	* root node.
	70	*
	71	* @return the parent of this node, or <code>null</code> if this is the
	72	* root node
	73	*/
	74	PolicyNode getParent();
	75
	76	/**
	77	* Returns an iterator over the children of this node. Any attempts to
	78	* modify the children of this node through the
	79	* <code>Iterator</code>'s remove method must throw an
	80	* <code>UnsupportedOperationException</code>.
	81	*
	82	* @return an iterator over the children of this node
	83	*/
	84	Iterator<? extends PolicyNode> getChildren();
	85
	86	/**
	87	* Returns the depth of this node in the valid policy tree.
	88	*
	89	* @return the depth of this node (0 for the root node, 1 for its
	90	* children, and so on)
	91	*/
	92	int getDepth();
	93
	94	/**
	95	* Returns the valid policy represented by this node.
	96	*
	97	* @return the <code>String</code> OID of the valid policy
	98	* represented by this node. For the root node, this method always returns
	99	* the special anyPolicy OID: "2.5.29.32.0".
	100	*/
	101	String getValidPolicy();
	102
	103	/**
	104	* Returns the set of policy qualifiers associated with the
	105	* valid policy represented by this node.
	106	*
	107	* @return an immutable <code>Set</code> of
	108	* <code>PolicyQualifierInfo</code>s. For the root node, this
	109	* is always an empty <code>Set</code>.
	110	*/
	111	Set<? extends PolicyQualifierInfo> getPolicyQualifiers();
	112
	113	/**
	114	* Returns the set of expected policies that would satisfy this
	115	* node's valid policy in the next certificate to be processed.
	116	*
	117	* @return an immutable <code>Set</code> of expected policy
	118	* <code>String</code> OIDs. For the root node, this method
	119	* always returns a <code>Set</code> with one element, the
	120	* special anyPolicy OID: "2.5.29.32.0".
	121	*/
	122	Set<String> getExpectedPolicies();
	123
	124	/**
	125	* Returns the criticality indicator of the certificate policy extension
	126	* in the most recently processed certificate.
	127	*
	128	* @return <code>true</code> if extension marked critical,
	129	* <code>false</code> otherwise. For the root node, <code>false</code>
	130	* is always returned.
	131	*/
	132	boolean isCritical();
	133	}

java/pkg/java/security/cert/PolicyQualifierInfo.class+0−0

Binary file not shown.

java/pkg/java/security/cert/PolicyQualifierInfo.java+173−0

@@ -0,0 +1,173 @@
	1	/*
	2	* Copyright (c) 2000, 2003, Oracle and/or its affiliates. All rights reserved.
	3	* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
	4	*
	5	* This code is free software; you can redistribute it and/or modify it
	6	* under the terms of the GNU General Public License version 2 only, as
	7	* published by the Free Software Foundation. Oracle designates this
	8	* particular file as subject to the "Classpath" exception as provided
	9	* by Oracle in the LICENSE file that accompanied this code.
	10	*
	11	* This code is distributed in the hope that it will be useful, but WITHOUT
	12	* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
	13	* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
	14	* version 2 for more details (a copy is included in the LICENSE file that
	15	* accompanied this code).
	16	*
	17	* You should have received a copy of the GNU General Public License version
	18	* 2 along with this work; if not, write to the Free Software Foundation,
	19	* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
	20	*
	21	* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
	22	* or visit www.oracle.com if you need additional information or have any
	23	* questions.
	24	*/
	25
	26	package java.security.cert;
	27
	28	import java.io.IOException;
	29
	30	import sun.misc.HexDumpEncoder;
	31	import sun.security.util.DerValue;
	32
	33	/**
	34	* An immutable policy qualifier represented by the ASN.1 PolicyQualifierInfo
	35	* structure.
	36	*
	37	* <p>The ASN.1 definition is as follows:
	38	* <p><pre>
	39	* PolicyQualifierInfo ::= SEQUENCE {
	40	* policyQualifierId PolicyQualifierId,
	41	* qualifier ANY DEFINED BY policyQualifierId }
	42	* </pre>
	43	* <p>
	44	* A certificate policies extension, if present in an X.509 version 3
	45	* certificate, contains a sequence of one or more policy information terms,
	46	* each of which consists of an object identifier (OID) and optional
	47	* qualifiers. In an end-entity certificate, these policy information terms
	48	* indicate the policy under which the certificate has been issued and the
	49	* purposes for which the certificate may be used. In a CA certificate, these
	50	* policy information terms limit the set of policies for certification paths
	51	* which include this certificate.
	52	* <p>
	53	* A <code>Set</code> of <code>PolicyQualifierInfo</code> objects are returned
	54	* by the {@link PolicyNode#getPolicyQualifiers PolicyNode.getPolicyQualifiers}
	55	* method. This allows applications with specific policy requirements to
	56	* process and validate each policy qualifier. Applications that need to
	57	* process policy qualifiers should explicitly set the
	58	* <code>policyQualifiersRejected</code> flag to false (by calling the
	59	* {@link PKIXParameters#setPolicyQualifiersRejected
	60	* PKIXParameters.setPolicyQualifiersRejected} method) before validating
	61	* a certification path.
	62	*
	63	* <p>Note that the PKIX certification path validation algorithm specifies
	64	* that any policy qualifier in a certificate policies extension that is
	65	* marked critical must be processed and validated. Otherwise the
	66	* certification path must be rejected. If the
	67	* <code>policyQualifiersRejected</code> flag is set to false, it is up to
	68	* the application to validate all policy qualifiers in this manner in order
	69	* to be PKIX compliant.
	70	*
	71	* <p><b>Concurrent Access</b>
	72	*
	73	* <p>All <code>PolicyQualifierInfo</code> objects must be immutable and
	74	* thread-safe. That is, multiple threads may concurrently invoke the
	75	* methods defined in this class on a single <code>PolicyQualifierInfo</code>
	76	* object (or more than one) with no ill effects. Requiring
	77	* <code>PolicyQualifierInfo</code> objects to be immutable and thread-safe
	78	* allows them to be passed around to various pieces of code without
	79	* worrying about coordinating access.
	80	*
	81	* @author seth proctor
	82	* @author Sean Mullan
	83	* @since 1.4
	84	*/
	85	public class PolicyQualifierInfo {
	86
	87	private byte [] mEncoded;
	88	private String mId;
	89	private byte [] mData;
	90	private String pqiString;
	91
	92	/**
	93	* Creates an instance of <code>PolicyQualifierInfo</code> from the
	94	* encoded bytes. The encoded byte array is copied on construction.
	95	*
	96	* @param encoded a byte array containing the qualifier in DER encoding
	97	* @exception IOException thrown if the byte array does not represent a
	98	* valid and parsable policy qualifier
	99	*/
	100	public PolicyQualifierInfo(byte[] encoded) throws IOException {
	101	mEncoded = encoded.clone();
	102
	103	DerValue val = new DerValue(mEncoded);
	104	if (val.tag != DerValue.tag_Sequence)
	105	throw new IOException("Invalid encoding for PolicyQualifierInfo");
	106
	107	mId = (val.data.getDerValue()).getOID().toString();
	108	byte [] tmp = val.data.toByteArray();
	109	if (tmp == null) {
	110	mData = null;
	111	} else {
	112	mData = new byte[tmp.length];
	113	System.arraycopy(tmp, 0, mData, 0, tmp.length);
	114	}
	115	}
	116
	117	/**
	118	* Returns the <code>policyQualifierId</code> field of this
	119	* <code>PolicyQualifierInfo</code>. The <code>policyQualifierId</code>
	120	* is an Object Identifier (OID) represented by a set of nonnegative
	121	* integers separated by periods.
	122	*
	123	* @return the OID (never <code>null</code>)
	124	*/
	125	public final String getPolicyQualifierId() {
	126	return mId;
	127	}
	128
	129	/**
	130	* Returns the ASN.1 DER encoded form of this
	131	* <code>PolicyQualifierInfo</code>.
	132	*
	133	* @return the ASN.1 DER encoded bytes (never <code>null</code>).
	134	* Note that a copy is returned, so the data is cloned each time
	135	* this method is called.
	136	*/
	137	public final byte[] getEncoded() {
	138	return mEncoded.clone();
	139	}
	140
	141	/**
	142	* Returns the ASN.1 DER encoded form of the <code>qualifier</code>
	143	* field of this <code>PolicyQualifierInfo</code>.
	144	*
	145	* @return the ASN.1 DER encoded bytes of the <code>qualifier</code>
	146	* field. Note that a copy is returned, so the data is cloned each
	147	* time this method is called.
	148	*/
	149	public final byte[] getPolicyQualifier() {
	150	return (mData == null ? null : mData.clone());
	151	}
	152
	153	/**
	154	* Return a printable representation of this
	155	* <code>PolicyQualifierInfo</code>.
	156	*
	157	* @return a <code>String</code> describing the contents of this
	158	* <code>PolicyQualifierInfo</code>
	159	*/
	160	public String toString() {
	161	if (pqiString != null)
	162	return pqiString;
	163	HexDumpEncoder enc = new HexDumpEncoder();
	164	StringBuffer sb = new StringBuffer();
	165	sb.append("PolicyQualifierInfo: [\n");
	166	sb.append(" qualifierID: " + mId + "\n");
	167	sb.append(" qualifier: " +
	168	(mData == null ? "null" : enc.encodeBuffer(mData)) + "\n");
	169	sb.append("]");
	170	pqiString = sb.toString();
	171	return pqiString;
	172	}
	173	}

java/pkg/java/security/cert/TrustAnchor.class+0−0

Binary file not shown.

java/pkg/java/security/cert/TrustAnchor.java+334−0

@@ -0,0 +1,334 @@
	1	/*
	2	* Copyright (c) 2001, 2008, Oracle and/or its affiliates. All rights reserved.
	3	* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
	4	*
	5	* This code is free software; you can redistribute it and/or modify it
	6	* under the terms of the GNU General Public License version 2 only, as
	7	* published by the Free Software Foundation. Oracle designates this
	8	* particular file as subject to the "Classpath" exception as provided
	9	* by Oracle in the LICENSE file that accompanied this code.
	10	*
	11	* This code is distributed in the hope that it will be useful, but WITHOUT
	12	* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
	13	* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
	14	* version 2 for more details (a copy is included in the LICENSE file that
	15	* accompanied this code).
	16	*
	17	* You should have received a copy of the GNU General Public License version
	18	* 2 along with this work; if not, write to the Free Software Foundation,
	19	* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
	20	*
	21	* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
	22	* or visit www.oracle.com if you need additional information or have any
	23	* questions.
	24	*/
	25
	26	package java.security.cert;
	27
	28	import java.io.IOException;
	29	import java.security.PublicKey;
	30
	31	import javax.security.auth.x500.X500Principal;
	32
	33	import sun.security.x509.NameConstraintsExtension;
	34	import sun.security.x509.X500Name;
	35
	36	/**
	37	* A trust anchor or most-trusted Certification Authority (CA).
	38	* <p>
	39	* This class represents a "most-trusted CA", which is used as a trust anchor
	40	* for validating X.509 certification paths. A most-trusted CA includes the
	41	* public key of the CA, the CA's name, and any constraints upon the set of
	42	* paths which may be validated using this key. These parameters can be
	43	* specified in the form of a trusted <code>X509Certificate</code> or as
	44	* individual parameters.
	45	* <p>
	46	* <b>Concurrent Access</b>
	47	* <p>
	48	* <p>All <code>TrustAnchor</code> objects must be immutable and
	49	* thread-safe. That is, multiple threads may concurrently invoke the
	50	* methods defined in this class on a single <code>TrustAnchor</code>
	51	* object (or more than one) with no ill effects. Requiring
	52	* <code>TrustAnchor</code> objects to be immutable and thread-safe
	53	* allows them to be passed around to various pieces of code without
	54	* worrying about coordinating access. This stipulation applies to all
	55	* public fields and methods of this class and any added or overridden
	56	* by subclasses.
	57	*
	58	* @see PKIXParameters#PKIXParameters(Set)
	59	* @see PKIXBuilderParameters#PKIXBuilderParameters(Set, CertSelector)
	60	*
	61	* @since 1.4
	62	* @author Sean Mullan
	63	*/
	64	public class TrustAnchor {
	65
	66	private final PublicKey pubKey;
	67	private final String caName;
	68	private final X500Principal caPrincipal;
	69	private final X509Certificate trustedCert;
	70	private byte[] ncBytes;
	71	private NameConstraintsExtension nc;
	72
	73	/**
	74	* Creates an instance of <code>TrustAnchor</code> with the specified
	75	* <code>X509Certificate</code> and optional name constraints, which
	76	* are intended to be used as additional constraints when validating
	77	* an X.509 certification path.
	78	* <p>
	79	* The name constraints are specified as a byte array. This byte array
	80	* should contain the DER encoded form of the name constraints, as they
	81	* would appear in the NameConstraints structure defined in
	82	* <a href="http://www.ietf.org/rfc/rfc3280">RFC 3280</a>
	83	* and X.509. The ASN.1 definition of this structure appears below.
	84	*
	85	* <pre><code>
	86	* NameConstraints ::= SEQUENCE {
	87	* permittedSubtrees [0] GeneralSubtrees OPTIONAL,
	88	* excludedSubtrees [1] GeneralSubtrees OPTIONAL }
	89	*
	90	* GeneralSubtrees ::= SEQUENCE SIZE (1..MAX) OF GeneralSubtree
	91	*
	92	* GeneralSubtree ::= SEQUENCE {
	93	* base GeneralName,
	94	* minimum [0] BaseDistance DEFAULT 0,
	95	* maximum [1] BaseDistance OPTIONAL }
	96	*
	97	* BaseDistance ::= INTEGER (0..MAX)
	98	*
	99	* GeneralName ::= CHOICE {
	100	* otherName [0] OtherName,
	101	* rfc822Name [1] IA5String,
	102	* dNSName [2] IA5String,
	103	* x400Address [3] ORAddress,
	104	* directoryName [4] Name,
	105	* ediPartyName [5] EDIPartyName,
	106	* uniformResourceIdentifier [6] IA5String,
	107	* iPAddress [7] OCTET STRING,
	108	* registeredID [8] OBJECT IDENTIFIER}
	109	* </code></pre>
	110	* <p>
	111	* Note that the name constraints byte array supplied is cloned to protect
	112	* against subsequent modifications.
	113	*
	114	* @param trustedCert a trusted <code>X509Certificate</code>
	115	* @param nameConstraints a byte array containing the ASN.1 DER encoding of
	116	* a NameConstraints extension to be used for checking name constraints.
	117	* Only the value of the extension is included, not the OID or criticality
	118	* flag. Specify <code>null</code> to omit the parameter.
	119	* @throws IllegalArgumentException if the name constraints cannot be
	120	* decoded
	121	* @throws NullPointerException if the specified
	122	* <code>X509Certificate</code> is <code>null</code>
	123	*/
	124	public TrustAnchor(X509Certificate trustedCert, byte[] nameConstraints)
	125	{
	126	if (trustedCert == null)
	127	throw new NullPointerException("the trustedCert parameter must " +
	128	"be non-null");
	129	this.trustedCert = trustedCert;
	130	this.pubKey = null;
	131	this.caName = null;
	132	this.caPrincipal = null;
	133	setNameConstraints(nameConstraints);
	134	}
	135
	136	/**
	137	* Creates an instance of <code>TrustAnchor</code> where the
	138	* most-trusted CA is specified as an X500Principal and public key.
	139	* Name constraints are an optional parameter, and are intended to be used
	140	* as additional constraints when validating an X.509 certification path.
	141	* <p>
	142	* The name constraints are specified as a byte array. This byte array
	143	* contains the DER encoded form of the name constraints, as they
	144	* would appear in the NameConstraints structure defined in RFC 3280
	145	* and X.509. The ASN.1 notation for this structure is supplied in the
	146	* documentation for
	147	* {@link #TrustAnchor(X509Certificate, byte[])
	148	* TrustAnchor(X509Certificate trustedCert, byte[] nameConstraints) }.
	149	* <p>
	150	* Note that the name constraints byte array supplied here is cloned to
	151	* protect against subsequent modifications.
	152	*
	153	* @param caPrincipal the name of the most-trusted CA as X500Principal
	154	* @param pubKey the public key of the most-trusted CA
	155	* @param nameConstraints a byte array containing the ASN.1 DER encoding of
	156	* a NameConstraints extension to be used for checking name constraints.
	157	* Only the value of the extension is included, not the OID or criticality
	158	* flag. Specify <code>null</code> to omit the parameter.
	159	* @throws NullPointerException if the specified <code>caPrincipal</code> or
	160	* <code>pubKey</code> parameter is <code>null</code>
	161	* @since 1.5
	162	*/
	163	public TrustAnchor(X500Principal caPrincipal, PublicKey pubKey,
	164	byte[] nameConstraints) {
	165	if ((caPrincipal == null) \|\| (pubKey == null)) {
	166	throw new NullPointerException();
	167	}
	168	this.trustedCert = null;
	169	this.caPrincipal = caPrincipal;
	170	this.caName = caPrincipal.getName();
	171	this.pubKey = pubKey;
	172	setNameConstraints(nameConstraints);
	173	}
	174
	175	/**
	176	* Creates an instance of <code>TrustAnchor</code> where the
	177	* most-trusted CA is specified as a distinguished name and public key.
	178	* Name constraints are an optional parameter, and are intended to be used
	179	* as additional constraints when validating an X.509 certification path.
	180	* <p>
	181	* The name constraints are specified as a byte array. This byte array
	182	* contains the DER encoded form of the name constraints, as they
	183	* would appear in the NameConstraints structure defined in RFC 3280
	184	* and X.509. The ASN.1 notation for this structure is supplied in the
	185	* documentation for
	186	* {@link #TrustAnchor(X509Certificate, byte[])
	187	* TrustAnchor(X509Certificate trustedCert, byte[] nameConstraints) }.
	188	* <p>
	189	* Note that the name constraints byte array supplied here is cloned to
	190	* protect against subsequent modifications.
	191	*
	192	* @param caName the X.500 distinguished name of the most-trusted CA in
	193	* <a href="http://www.ietf.org/rfc/rfc2253.txt">RFC 2253</a>
	194	* <code>String</code> format
	195	* @param pubKey the public key of the most-trusted CA
	196	* @param nameConstraints a byte array containing the ASN.1 DER encoding of
	197	* a NameConstraints extension to be used for checking name constraints.
	198	* Only the value of the extension is included, not the OID or criticality
	199	* flag. Specify <code>null</code> to omit the parameter.
	200	* @throws IllegalArgumentException if the specified <code>
	201	* caName</code> parameter is empty <code>(caName.length() == 0)</code>
	202	* or incorrectly formatted or the name constraints cannot be decoded
	203	* @throws NullPointerException if the specified <code>caName</code> or
	204	* <code>pubKey</code> parameter is <code>null</code>
	205	*/
	206	public TrustAnchor(String caName, PublicKey pubKey, byte[] nameConstraints)
	207	{
	208	if (pubKey == null)
	209	throw new NullPointerException("the pubKey parameter must be " +
	210	"non-null");
	211	if (caName == null)
	212	throw new NullPointerException("the caName parameter must be " +
	213	"non-null");
	214	if (caName.length() == 0)
	215	throw new IllegalArgumentException("the caName " +
	216	"parameter must be a non-empty String");
	217	// check if caName is formatted correctly
	218	this.caPrincipal = new X500Principal(caName);
	219	this.pubKey = pubKey;
	220	this.caName = caName;
	221	this.trustedCert = null;
	222	setNameConstraints(nameConstraints);
	223	}
	224
	225	/**
	226	* Returns the most-trusted CA certificate.
	227	*
	228	* @return a trusted <code>X509Certificate</code> or <code>null</code>
	229	* if the trust anchor was not specified as a trusted certificate
	230	*/
	231	public final X509Certificate getTrustedCert() {
	232	return this.trustedCert;
	233	}
	234
	235	/**
	236	* Returns the name of the most-trusted CA as an X500Principal.
	237	*
	238	* @return the X.500 distinguished name of the most-trusted CA, or
	239	* <code>null</code> if the trust anchor was not specified as a trusted
	240	* public key and name or X500Principal pair
	241	* @since 1.5
	242	*/
	243	public final X500Principal getCA() {
	244	return this.caPrincipal;
	245	}
	246
	247	/**
	248	* Returns the name of the most-trusted CA in RFC 2253 <code>String</code>
	249	* format.
	250	*
	251	* @return the X.500 distinguished name of the most-trusted CA, or
	252	* <code>null</code> if the trust anchor was not specified as a trusted
	253	* public key and name or X500Principal pair
	254	*/
	255	public final String getCAName() {
	256	return this.caName;
	257	}
	258
	259	/**
	260	* Returns the public key of the most-trusted CA.
	261	*
	262	* @return the public key of the most-trusted CA, or <code>null</code>
	263	* if the trust anchor was not specified as a trusted public key and name
	264	* or X500Principal pair
	265	*/
	266	public final PublicKey getCAPublicKey() {
	267	return this.pubKey;
	268	}
	269
	270	/**
	271	* Decode the name constraints and clone them if not null.
	272	*/
	273	private void setNameConstraints(byte[] bytes) {
	274	if (bytes == null) {
	275	ncBytes = null;
	276	nc = null;
	277	} else {
	278	ncBytes = bytes.clone();
	279	// validate DER encoding
	280	try {
	281	nc = new NameConstraintsExtension(Boolean.FALSE, bytes);
	282	} catch (IOException ioe) {
	283	IllegalArgumentException iae =
	284	new IllegalArgumentException(ioe.getMessage());
	285	iae.initCause(ioe);
	286	throw iae;
	287	}
	288	}
	289	}
	290
	291	/**
	292	* Returns the name constraints parameter. The specified name constraints
	293	* are associated with this trust anchor and are intended to be used
	294	* as additional constraints when validating an X.509 certification path.
	295	* <p>
	296	* The name constraints are returned as a byte array. This byte array
	297	* contains the DER encoded form of the name constraints, as they
	298	* would appear in the NameConstraints structure defined in RFC 3280
	299	* and X.509. The ASN.1 notation for this structure is supplied in the
	300	* documentation for
	301	* {@link #TrustAnchor(X509Certificate, byte[])
	302	* TrustAnchor(X509Certificate trustedCert, byte[] nameConstraints) }.
	303	* <p>
	304	* Note that the byte array returned is cloned to protect against
	305	* subsequent modifications.
	306	*
	307	* @return a byte array containing the ASN.1 DER encoding of
	308	* a NameConstraints extension used for checking name constraints,
	309	* or <code>null</code> if not set.
	310	*/
	311	public final byte [] getNameConstraints() {
	312	return ncBytes == null ? null : ncBytes.clone();
	313	}
	314
	315	/**
	316	* Returns a formatted string describing the <code>TrustAnchor</code>.
	317	*
	318	* @return a formatted string describing the <code>TrustAnchor</code>
	319	*/
	320	public String toString() {
	321	StringBuffer sb = new StringBuffer();
	322	sb.append("[\n");
	323	if (pubKey != null) {
	324	sb.append(" Trusted CA Public Key: " + pubKey.toString() + "\n");
	325	sb.append(" Trusted CA Issuer Name: "
	326	+ String.valueOf(caName) + "\n");
	327	} else {
	328	sb.append(" Trusted CA cert: " + trustedCert.toString() + "\n");
	329	}
	330	if (nc != null)
	331	sb.append(" Name Constraints: " + nc.toString() + "\n");
	332	return sb.toString();
	333	}
	334	}

java/pkg/java/security/cert/X509CRL.class+0−0

Binary file not shown.

java/pkg/java/security/cert/X509CRL.java+443−0

@@ -0,0 +1,443 @@
	1	/*
	2	* Copyright (c) 1997, 2010, Oracle and/or its affiliates. All rights reserved.
	3	* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
	4	*
	5	* This code is free software; you can redistribute it and/or modify it
	6	* under the terms of the GNU General Public License version 2 only, as
	7	* published by the Free Software Foundation. Oracle designates this
	8	* particular file as subject to the "Classpath" exception as provided
	9	* by Oracle in the LICENSE file that accompanied this code.
	10	*
	11	* This code is distributed in the hope that it will be useful, but WITHOUT
	12	* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
	13	* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
	14	* version 2 for more details (a copy is included in the LICENSE file that
	15	* accompanied this code).
	16	*
	17	* You should have received a copy of the GNU General Public License version
	18	* 2 along with this work; if not, write to the Free Software Foundation,
	19	* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
	20	*
	21	* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
	22	* or visit www.oracle.com if you need additional information or have any
	23	* questions.
	24	*/
	25
	26	package java.security.cert;
	27
	28	import java.security.NoSuchAlgorithmException;
	29	import java.security.NoSuchProviderException;
	30	import java.security.InvalidKeyException;
	31	import java.security.SignatureException;
	32	import java.security.Principal;
	33	import java.security.PublicKey;
	34	import javax.security.auth.x500.X500Principal;
	35
	36	import java.math.BigInteger;
	37	import java.util.Date;
	38	import java.util.Set;
	39	import java.util.Arrays;
	40
	41	import sun.security.x509.X509CRLImpl;
	42
	43	/**
	44	* <p>
	45	* Abstract class for an X.509 Certificate Revocation List (CRL).
	46	* A CRL is a time-stamped list identifying revoked certificates.
	47	* It is signed by a Certificate Authority (CA) and made freely
	48	* available in a public repository.
	49	*
	50	* <p>Each revoked certificate is
	51	* identified in a CRL by its certificate serial number. When a
	52	* certificate-using system uses a certificate (e.g., for verifying a
	53	* remote user's digital signature), that system not only checks the
	54	* certificate signature and validity but also acquires a suitably-
	55	* recent CRL and checks that the certificate serial number is not on
	56	* that CRL. The meaning of "suitably-recent" may vary with local
	57	* policy, but it usually means the most recently-issued CRL. A CA
	58	* issues a new CRL on a regular periodic basis (e.g., hourly, daily, or
	59	* weekly). Entries are added to CRLs as revocations occur, and an
	60	* entry may be removed when the certificate expiration date is reached.
	61	* <p>
	62	* The X.509 v2 CRL format is described below in ASN.1:
	63	* <pre>
	64	* CertificateList ::= SEQUENCE {
	65	* tbsCertList TBSCertList,
	66	* signatureAlgorithm AlgorithmIdentifier,
	67	* signature BIT STRING }
	68	* </pre>
	69	* <p>
	70	* More information can be found in
	71	* <a href="http://www.ietf.org/rfc/rfc3280.txt">RFC 3280: Internet X.509
	72	* Public Key Infrastructure Certificate and CRL Profile</a>.
	73	* <p>
	74	* The ASN.1 definition of <code>tbsCertList</code> is:
	75	* <pre>
	76	* TBSCertList ::= SEQUENCE {
	77	* version Version OPTIONAL,
	78	* -- if present, must be v2
	79	* signature AlgorithmIdentifier,
	80	* issuer Name,
	81	* thisUpdate ChoiceOfTime,
	82	* nextUpdate ChoiceOfTime OPTIONAL,
	83	* revokedCertificates SEQUENCE OF SEQUENCE {
	84	* userCertificate CertificateSerialNumber,
	85	* revocationDate ChoiceOfTime,
	86	* crlEntryExtensions Extensions OPTIONAL
	87	* -- if present, must be v2
	88	* } OPTIONAL,
	89	* crlExtensions [0] EXPLICIT Extensions OPTIONAL
	90	* -- if present, must be v2
	91	* }
	92	* </pre>
	93	* <p>
	94	* CRLs are instantiated using a certificate factory. The following is an
	95	* example of how to instantiate an X.509 CRL:
	96	* <pre><code>
	97	* InputStream inStream = null;
	98	* try {
	99	* inStream = new FileInputStream("fileName-of-crl");
	100	* CertificateFactory cf = CertificateFactory.getInstance("X.509");
	101	* X509CRL crl = (X509CRL)cf.generateCRL(inStream);
	102	* } finally {
	103	* if (inStream != null) {
	104	* inStream.close();
	105	* }
	106	* }
	107	* </code></pre>
	108	*
	109	* @author Hemma Prafullchandra
	110	*
	111	*
	112	* @see CRL
	113	* @see CertificateFactory
	114	* @see X509Extension
	115	*/
	116
	117	public abstract class X509CRL extends CRL implements X509Extension {
	118
	119	private transient X500Principal issuerPrincipal;
	120
	121	/**
	122	* Constructor for X.509 CRLs.
	123	*/
	124	protected X509CRL() {
	125	super("X.509");
	126	}
	127
	128	/**
	129	* Compares this CRL for equality with the given
	130	* object. If the <code>other</code> object is an
	131	* <code>instanceof</code> <code>X509CRL</code>, then
	132	* its encoded form is retrieved and compared with the
	133	* encoded form of this CRL.
	134	*
	135	* @param other the object to test for equality with this CRL.
	136	*
	137	* @return true iff the encoded forms of the two CRLs
	138	* match, false otherwise.
	139	*/
	140	public boolean equals(Object other) {
	141	if (this == other) {
	142	return true;
	143	}
	144	if (!(other instanceof X509CRL)) {
	145	return false;
	146	}
	147	try {
	148	byte[] thisCRL = X509CRLImpl.getEncodedInternal(this);
	149	byte[] otherCRL = X509CRLImpl.getEncodedInternal((X509CRL)other);
	150
	151	return Arrays.equals(thisCRL, otherCRL);
	152	} catch (CRLException e) {
	153	return false;
	154	}
	155	}
	156
	157	/**
	158	* Returns a hashcode value for this CRL from its
	159	* encoded form.
	160	*
	161	* @return the hashcode value.
	162	*/
	163	public int hashCode() {
	164	int retval = 0;
	165	try {
	166	byte[] crlData = X509CRLImpl.getEncodedInternal(this);
	167	for (int i = 1; i < crlData.length; i++) {
	168	retval += crlData[i] * i;
	169	}
	170	return retval;
	171	} catch (CRLException e) {
	172	return retval;
	173	}
	174	}
	175
	176	/**
	177	* Returns the ASN.1 DER-encoded form of this CRL.
	178	*
	179	* @return the encoded form of this certificate
	180	* @exception CRLException if an encoding error occurs.
	181	*/
	182	public abstract byte[] getEncoded()
	183	throws CRLException;
	184
	185	/**
	186	* Verifies that this CRL was signed using the
	187	* private key that corresponds to the given public key.
	188	*
	189	* @param key the PublicKey used to carry out the verification.
	190	*
	191	* @exception NoSuchAlgorithmException on unsupported signature
	192	* algorithms.
	193	* @exception InvalidKeyException on incorrect key.
	194	* @exception NoSuchProviderException if there's no default provider.
	195	* @exception SignatureException on signature errors.
	196	* @exception CRLException on encoding errors.
	197	*/
	198	public abstract void verify(PublicKey key)
	199	throws CRLException, NoSuchAlgorithmException,
	200	InvalidKeyException, NoSuchProviderException,
	201	SignatureException;
	202
	203	/**
	204	* Verifies that this CRL was signed using the
	205	* private key that corresponds to the given public key.
	206	* This method uses the signature verification engine
	207	* supplied by the given provider.
	208	*
	209	* @param key the PublicKey used to carry out the verification.
	210	* @param sigProvider the name of the signature provider.
	211	*
	212	* @exception NoSuchAlgorithmException on unsupported signature
	213	* algorithms.
	214	* @exception InvalidKeyException on incorrect key.
	215	* @exception NoSuchProviderException on incorrect provider.
	216	* @exception SignatureException on signature errors.
	217	* @exception CRLException on encoding errors.
	218	*/
	219	public abstract void verify(PublicKey key, String sigProvider)
	220	throws CRLException, NoSuchAlgorithmException,
	221	InvalidKeyException, NoSuchProviderException,
	222	SignatureException;
	223
	224	/**
	225	* Gets the <code>version</code> (version number) value from the CRL.
	226	* The ASN.1 definition for this is:
	227	* <pre>
	228	* version Version OPTIONAL,
	229	* -- if present, must be v2<p>
	230	* Version ::= INTEGER { v1(0), v2(1), v3(2) }
	231	* -- v3 does not apply to CRLs but appears for consistency
	232	* -- with definition of Version for certs
	233	* </pre>
	234	*
	235	* @return the version number, i.e. 1 or 2.
	236	*/
	237	public abstract int getVersion();
	238
	239	/**
	240	* <strong>Denigrated</strong>, replaced by {@linkplain
	241	* #getIssuerX500Principal()}. This method returns the <code>issuer</code>
	242	* as an implementation specific Principal object, which should not be
	243	* relied upon by portable code.
	244	*
	245	* <p>
	246	* Gets the <code>issuer</code> (issuer distinguished name) value from
	247	* the CRL. The issuer name identifies the entity that signed (and
	248	* issued) the CRL.
	249	*
	250	* <p>The issuer name field contains an
	251	* X.500 distinguished name (DN).
	252	* The ASN.1 definition for this is:
	253	* <pre>
	254	* issuer Name
	255	*
	256	* Name ::= CHOICE { RDNSequence }
	257	* RDNSequence ::= SEQUENCE OF RelativeDistinguishedName
	258	* RelativeDistinguishedName ::=
	259	* SET OF AttributeValueAssertion
	260	*
	261	* AttributeValueAssertion ::= SEQUENCE {
	262	* AttributeType,
	263	* AttributeValue }
	264	* AttributeType ::= OBJECT IDENTIFIER
	265	* AttributeValue ::= ANY
	266	* </pre>
	267	* The <code>Name</code> describes a hierarchical name composed of
	268	* attributes,
	269	* such as country name, and corresponding values, such as US.
	270	* The type of the <code>AttributeValue</code> component is determined by
	271	* the <code>AttributeType</code>; in general it will be a
	272	* <code>directoryString</code>. A <code>directoryString</code> is usually
	273	* one of <code>PrintableString</code>,
	274	* <code>TeletexString</code> or <code>UniversalString</code>.
	275	*
	276	* @return a Principal whose name is the issuer distinguished name.
	277	*/
	278	public abstract Principal getIssuerDN();
	279
	280	/**
	281	* Returns the issuer (issuer distinguished name) value from the
	282	* CRL as an <code>X500Principal</code>.
	283	* <p>
	284	* It is recommended that subclasses override this method.
	285	*
	286	* @return an <code>X500Principal</code> representing the issuer
	287	* distinguished name
	288	* @since 1.4
	289	*/
	290	public X500Principal getIssuerX500Principal() {
	291	if (issuerPrincipal == null) {
	292	issuerPrincipal = X509CRLImpl.getIssuerX500Principal(this);
	293	}
	294	return issuerPrincipal;
	295	}
	296
	297	/**
	298	* Gets the <code>thisUpdate</code> date from the CRL.
	299	* The ASN.1 definition for this is:
	300	* <pre>
	301	* thisUpdate ChoiceOfTime
	302	* ChoiceOfTime ::= CHOICE {
	303	* utcTime UTCTime,
	304	* generalTime GeneralizedTime }
	305	* </pre>
	306	*
	307	* @return the <code>thisUpdate</code> date from the CRL.
	308	*/
	309	public abstract Date getThisUpdate();
	310
	311	/**
	312	* Gets the <code>nextUpdate</code> date from the CRL.
	313	*
	314	* @return the <code>nextUpdate</code> date from the CRL, or null if
	315	* not present.
	316	*/
	317	public abstract Date getNextUpdate();
	318
	319	/**
	320	* Gets the CRL entry, if any, with the given certificate serialNumber.
	321	*
	322	* @param serialNumber the serial number of the certificate for which a CRL entry
	323	* is to be looked up
	324	* @return the entry with the given serial number, or null if no such entry
	325	* exists in this CRL.
	326	* @see X509CRLEntry
	327	*/
	328	public abstract X509CRLEntry
	329	getRevokedCertificate(BigInteger serialNumber);
	330
	331	/**
	332	* Get the CRL entry, if any, for the given certificate.
	333	*
	334	* <p>This method can be used to lookup CRL entries in indirect CRLs,
	335	* that means CRLs that contain entries from issuers other than the CRL
	336	* issuer. The default implementation will only return entries for
	337	* certificates issued by the CRL issuer. Subclasses that wish to
	338	* support indirect CRLs should override this method.
	339	*
	340	* @param certificate the certificate for which a CRL entry is to be looked
	341	* up
	342	* @return the entry for the given certificate, or null if no such entry
	343	* exists in this CRL.
	344	* @exception NullPointerException if certificate is null
	345	*
	346	* @since 1.5
	347	*/
	348	public X509CRLEntry getRevokedCertificate(X509Certificate certificate) {
	349	X500Principal certIssuer = certificate.getIssuerX500Principal();
	350	X500Principal crlIssuer = getIssuerX500Principal();
	351	if (certIssuer.equals(crlIssuer) == false) {
	352	return null;
	353	}
	354	return getRevokedCertificate(certificate.getSerialNumber());
	355	}
	356
	357	/**
	358	* Gets all the entries from this CRL.
	359	* This returns a Set of X509CRLEntry objects.
	360	*
	361	* @return all the entries or null if there are none present.
	362	* @see X509CRLEntry
	363	*/
	364	public abstract Set<? extends X509CRLEntry> getRevokedCertificates();
	365
	366	/**
	367	* Gets the DER-encoded CRL information, the
	368	* <code>tbsCertList</code> from this CRL.
	369	* This can be used to verify the signature independently.
	370	*
	371	* @return the DER-encoded CRL information.
	372	* @exception CRLException if an encoding error occurs.
	373	*/
	374	public abstract byte[] getTBSCertList() throws CRLException;
	375
	376	/**
	377	* Gets the <code>signature</code> value (the raw signature bits) from
	378	* the CRL.
	379	* The ASN.1 definition for this is:
	380	* <pre>
	381	* signature BIT STRING
	382	* </pre>
	383	*
	384	* @return the signature.
	385	*/
	386	public abstract byte[] getSignature();
	387
	388	/**
	389	* Gets the signature algorithm name for the CRL
	390	* signature algorithm. An example is the string "SHA256withRSA".
	391	* The ASN.1 definition for this is:
	392	* <pre>
	393	* signatureAlgorithm AlgorithmIdentifier<p>
	394	* AlgorithmIdentifier ::= SEQUENCE {
	395	* algorithm OBJECT IDENTIFIER,
	396	* parameters ANY DEFINED BY algorithm OPTIONAL }
	397	* -- contains a value of the type
	398	* -- registered for use with the
	399	* -- algorithm object identifier value
	400	* </pre>
	401	*
	402	* <p>The algorithm name is determined from the <code>algorithm</code>
	403	* OID string.
	404	*
	405	* @return the signature algorithm name.
	406	*/
	407	public abstract String getSigAlgName();
	408
	409	/**
	410	* Gets the signature algorithm OID string from the CRL.
	411	* An OID is represented by a set of nonnegative whole numbers separated
	412	* by periods.
	413	* For example, the string "1.2.840.10040.4.3" identifies the SHA-1
	414	* with DSA signature algorithm defined in
	415	* <a href="http://www.ietf.org/rfc/rfc3279.txt">RFC 3279: Algorithms and
	416	* Identifiers for the Internet X.509 Public Key Infrastructure Certificate
	417	* and CRL Profile</a>.
	418	*
	419	* <p>See {@link #getSigAlgName() getSigAlgName} for
	420	* relevant ASN.1 definitions.
	421	*
	422	* @return the signature algorithm OID string.
	423	*/
	424	public abstract String getSigAlgOID();
	425
	426	/**
	427	* Gets the DER-encoded signature algorithm parameters from this
	428	* CRL's signature algorithm. In most cases, the signature
	429	* algorithm parameters are null; the parameters are usually
	430	* supplied with the public key.
	431	* If access to individual parameter values is needed then use
	432	* {@link java.security.AlgorithmParameters AlgorithmParameters}
	433	* and instantiate with the name returned by
	434	* {@link #getSigAlgName() getSigAlgName}.
	435	*
	436	* <p>See {@link #getSigAlgName() getSigAlgName} for
	437	* relevant ASN.1 definitions.
	438	*
	439	* @return the DER-encoded signature algorithm parameters, or
	440	* null if no parameters are present.
	441	*/
	442	public abstract byte[] getSigAlgParams();
	443	}

java/pkg/java/security/cert/X509CRLEntry.class+0−0

Binary file not shown.

java/pkg/java/security/cert/X509CRLEntry.java+191−0

@@ -0,0 +1,191 @@
	1	/*
	2	* Copyright (c) 1997, 2003, Oracle and/or its affiliates. All rights reserved.
	3	* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
	4	*
	5	* This code is free software; you can redistribute it and/or modify it
	6	* under the terms of the GNU General Public License version 2 only, as
	7	* published by the Free Software Foundation. Oracle designates this
	8	* particular file as subject to the "Classpath" exception as provided
	9	* by Oracle in the LICENSE file that accompanied this code.
	10	*
	11	* This code is distributed in the hope that it will be useful, but WITHOUT
	12	* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
	13	* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
	14	* version 2 for more details (a copy is included in the LICENSE file that
	15	* accompanied this code).
	16	*
	17	* You should have received a copy of the GNU General Public License version
	18	* 2 along with this work; if not, write to the Free Software Foundation,
	19	* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
	20	*
	21	* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
	22	* or visit www.oracle.com if you need additional information or have any
	23	* questions.
	24	*/
	25
	26	package java.security.cert;
	27
	28	import java.math.BigInteger;
	29	import java.util.Date;
	30	import javax.security.auth.x500.X500Principal;
	31
	32	import sun.security.x509.X509CRLEntryImpl;
	33
	34	/**
	35	* <p>Abstract class for a revoked certificate in a CRL (Certificate
	36	* Revocation List).
	37	*
	38	* The ASN.1 definition for <em>revokedCertificates</em> is:
	39	* <pre>
	40	* revokedCertificates SEQUENCE OF SEQUENCE {
	41	* userCertificate CertificateSerialNumber,
	42	* revocationDate ChoiceOfTime,
	43	* crlEntryExtensions Extensions OPTIONAL
	44	* -- if present, must be v2
	45	* } OPTIONAL
	46	*<p>
	47	* CertificateSerialNumber ::= INTEGER
	48	*<p>
	49	* Extensions ::= SEQUENCE SIZE (1..MAX) OF Extension
	50	*<p>
	51	* Extension ::= SEQUENCE {
	52	* extnId OBJECT IDENTIFIER,
	53	* critical BOOLEAN DEFAULT FALSE,
	54	* extnValue OCTET STRING
	55	* -- contains a DER encoding of a value
	56	* -- of the type registered for use with
	57	* -- the extnId object identifier value
	58	* }
	59	* </pre>
	60	*
	61	* @see X509CRL
	62	* @see X509Extension
	63	*
	64	* @author Hemma Prafullchandra
	65	*/
	66
	67	public abstract class X509CRLEntry implements X509Extension {
	68
	69	/**
	70	* Compares this CRL entry for equality with the given
	71	* object. If the <code>other</code> object is an
	72	* <code>instanceof</code> <code>X509CRLEntry</code>, then
	73	* its encoded form (the inner SEQUENCE) is retrieved and compared
	74	* with the encoded form of this CRL entry.
	75	*
	76	* @param other the object to test for equality with this CRL entry.
	77	* @return true iff the encoded forms of the two CRL entries
	78	* match, false otherwise.
	79	*/
	80	public boolean equals(Object other) {
	81	if (this == other)
	82	return true;
	83	if (!(other instanceof X509CRLEntry))
	84	return false;
	85	try {
	86	byte[] thisCRLEntry = this.getEncoded();
	87	byte[] otherCRLEntry = ((X509CRLEntry)other).getEncoded();
	88
	89	if (thisCRLEntry.length != otherCRLEntry.length)
	90	return false;
	91	for (int i = 0; i < thisCRLEntry.length; i++)
	92	if (thisCRLEntry[i] != otherCRLEntry[i])
	93	return false;
	94	} catch (CRLException ce) {
	95	return false;
	96	}
	97	return true;
	98	}
	99
	100	/**
	101	* Returns a hashcode value for this CRL entry from its
	102	* encoded form.
	103	*
	104	* @return the hashcode value.
	105	*/
	106	public int hashCode() {
	107	int retval = 0;
	108	try {
	109	byte[] entryData = this.getEncoded();
	110	for (int i = 1; i < entryData.length; i++)
	111	retval += entryData[i] * i;
	112
	113	} catch (CRLException ce) {
	114	return(retval);
	115	}
	116	return(retval);
	117	}
	118
	119	/**
	120	* Returns the ASN.1 DER-encoded form of this CRL Entry,
	121	* that is the inner SEQUENCE.
	122	*
	123	* @return the encoded form of this certificate
	124	* @exception CRLException if an encoding error occurs.
	125	*/
	126	public abstract byte[] getEncoded() throws CRLException;
	127
	128	/**
	129	* Gets the serial number from this X509CRLEntry,
	130	* the <em>userCertificate</em>.
	131	*
	132	* @return the serial number.
	133	*/
	134	public abstract BigInteger getSerialNumber();
	135
	136	/**
	137	* Get the issuer of the X509Certificate described by this entry. If
	138	* the certificate issuer is also the CRL issuer, this method returns
	139	* null.
	140	*
	141	* <p>This method is used with indirect CRLs. The default implementation
	142	* always returns null. Subclasses that wish to support indirect CRLs
	143	* should override it.
	144	*
	145	* @return the issuer of the X509Certificate described by this entry
	146	* or null if it is issued by the CRL issuer.
	147	*
	148	* @since 1.5
	149	*/
	150	public X500Principal getCertificateIssuer() {
	151	return null;
	152	}
	153
	154	/**
	155	* Gets the revocation date from this X509CRLEntry,
	156	* the <em>revocationDate</em>.
	157	*
	158	* @return the revocation date.
	159	*/
	160	public abstract Date getRevocationDate();
	161
	162	/**
	163	* Returns true if this CRL entry has extensions.
	164	*
	165	* @return true if this entry has extensions, false otherwise.
	166	*/
	167	public abstract boolean hasExtensions();
	168
	169	/**
	170	* Returns a string representation of this CRL entry.
	171	*
	172	* @return a string representation of this CRL entry.
	173	*/
	174	public abstract String toString();
	175
	176	/**
	177	* Returns the reason the certificate has been revoked, as specified
	178	* in the Reason Code extension of this CRL entry.
	179	*
	180	* @return the reason the certificate has been revoked, or
	181	* <code>null</code> if this CRL entry does not have
	182	* a Reason Code extension
	183	* @since 1.7
	184	*/
	185	public CRLReason getRevocationReason() {
	186	if (!hasExtensions()) {
	187	return null;
	188	}
	189	return X509CRLEntryImpl.getRevocationReason(this);
	190	}
	191	}

java/pkg/java/security/cert/X509CRLSelector.class+0−0

Binary file not shown.

java/pkg/java/security/cert/X509CRLSelector.java+714−0

@@ -0,0 +1,714 @@
	1	/*
	2	* Copyright (c) 2000, 2009, Oracle and/or its affiliates. All rights reserved.
	3	* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
	4	*
	5	* This code is free software; you can redistribute it and/or modify it
	6	* under the terms of the GNU General Public License version 2 only, as
	7	* published by the Free Software Foundation. Oracle designates this
	8	* particular file as subject to the "Classpath" exception as provided
	9	* by Oracle in the LICENSE file that accompanied this code.
	10	*
	11	* This code is distributed in the hope that it will be useful, but WITHOUT
	12	* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
	13	* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
	14	* version 2 for more details (a copy is included in the LICENSE file that
	15	* accompanied this code).
	16	*
	17	* You should have received a copy of the GNU General Public License version
	18	* 2 along with this work; if not, write to the Free Software Foundation,
	19	* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
	20	*
	21	* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
	22	* or visit www.oracle.com if you need additional information or have any
	23	* questions.
	24	*/
	25
	26	package java.security.cert;
	27
	28	import java.io.IOException;
	29	import java.math.BigInteger;
	30	import java.util.*;
	31
	32	import javax.security.auth.x500.X500Principal;
	33
	34	import sun.security.util.Debug;
	35	import sun.security.util.DerInputStream;
	36	import sun.security.x509.CRLNumberExtension;
	37	import sun.security.x509.X500Name;
	38
	39	/**
	40	* A <code>CRLSelector</code> that selects <code>X509CRLs</code> that
	41	* match all specified criteria. This class is particularly useful when
	42	* selecting CRLs from a <code>CertStore</code> to check revocation status
	43	* of a particular certificate.
	44	* <p>
	45	* When first constructed, an <code>X509CRLSelector</code> has no criteria
	46	* enabled and each of the <code>get</code> methods return a default
	47	* value (<code>null</code>). Therefore, the {@link #match match} method
	48	* would return <code>true</code> for any <code>X509CRL</code>. Typically,
	49	* several criteria are enabled (by calling {@link #setIssuers setIssuers}
	50	* or {@link #setDateAndTime setDateAndTime}, for instance) and then the
	51	* <code>X509CRLSelector</code> is passed to
	52	* {@link CertStore#getCRLs CertStore.getCRLs} or some similar
	53	* method.
	54	* <p>
	55	* Please refer to <a href="http://www.ietf.org/rfc/rfc3280.txt">RFC 3280:
	56	* Internet X.509 Public Key Infrastructure Certificate and CRL Profile</a>
	57	* for definitions of the X.509 CRL fields and extensions mentioned below.
	58	* <p>
	59	* <b>Concurrent Access</b>
	60	* <p>
	61	* Unless otherwise specified, the methods defined in this class are not
	62	* thread-safe. Multiple threads that need to access a single
	63	* object concurrently should synchronize amongst themselves and
	64	* provide the necessary locking. Multiple threads each manipulating
	65	* separate objects need not synchronize.
	66	*
	67	* @see CRLSelector
	68	* @see X509CRL
	69	*
	70	* @since 1.4
	71	* @author Steve Hanna
	72	*/
	73	public class X509CRLSelector implements CRLSelector {
	74
	75	static {
	76	CertPathHelperImpl.initialize();
	77	}
	78
	79	private static final Debug debug = Debug.getInstance("certpath");
	80	private HashSet<Object> issuerNames;
	81	private HashSet<X500Principal> issuerX500Principals;
	82	private BigInteger minCRL;
	83	private BigInteger maxCRL;
	84	private Date dateAndTime;
	85	private X509Certificate certChecking;
	86	private long skew = 0;
	87
	88	/**
	89	* Creates an <code>X509CRLSelector</code>. Initially, no criteria are set
	90	* so any <code>X509CRL</code> will match.
	91	*/
	92	public X509CRLSelector() {}
	93
	94	/**
	95	* Sets the issuerNames criterion. The issuer distinguished name in the
	96	* <code>X509CRL</code> must match at least one of the specified
	97	* distinguished names. If <code>null</code>, any issuer distinguished name
	98	* will do.
	99	* <p>
	100	* This method allows the caller to specify, with a single method call,
	101	* the complete set of issuer names which <code>X509CRLs</code> may contain.
	102	* The specified value replaces the previous value for the issuerNames
	103	* criterion.
	104	* <p>
	105	* The <code>names</code> parameter (if not <code>null</code>) is a
	106	* <code>Collection</code> of <code>X500Principal</code>s.
	107	* <p>
	108	* Note that the <code>names</code> parameter can contain duplicate
	109	* distinguished names, but they may be removed from the
	110	* <code>Collection</code> of names returned by the
	111	* {@link #getIssuers getIssuers} method.
	112	* <p>
	113	* Note that a copy is performed on the <code>Collection</code> to
	114	* protect against subsequent modifications.
	115	*
	116	* @param issuers a <code>Collection</code> of X500Principals
	117	* (or <code>null</code>)
	118	* @see #getIssuers
	119	* @since 1.5
	120	*/
	121	public void setIssuers(Collection<X500Principal> issuers) {
	122	if ((issuers == null) \|\| issuers.isEmpty()) {
	123	issuerNames = null;
	124	issuerX500Principals = null;
	125	} else {
	126	// clone
	127	issuerX500Principals = new HashSet<X500Principal>(issuers);
	128	issuerNames = new HashSet<Object>();
	129	for (X500Principal p : issuerX500Principals) {
	130	issuerNames.add(p.getEncoded());
	131	}
	132	}
	133	}
	134
	135	/**
	136	* <strong>Note:</strong> use {@linkplain #setIssuers(Collection)} instead
	137	* or only specify the byte array form of distinguished names when using
	138	* this method. See {@link #addIssuerName(String)} for more information.
	139	* <p>
	140	* Sets the issuerNames criterion. The issuer distinguished name in the
	141	* <code>X509CRL</code> must match at least one of the specified
	142	* distinguished names. If <code>null</code>, any issuer distinguished name
	143	* will do.
	144	* <p>
	145	* This method allows the caller to specify, with a single method call,
	146	* the complete set of issuer names which <code>X509CRLs</code> may contain.
	147	* The specified value replaces the previous value for the issuerNames
	148	* criterion.
	149	* <p>
	150	* The <code>names</code> parameter (if not <code>null</code>) is a
	151	* <code>Collection</code> of names. Each name is a <code>String</code>
	152	* or a byte array representing a distinguished name (in
	153	* <a href="http://www.ietf.org/rfc/rfc2253.txt">RFC 2253</a> or
	154	* ASN.1 DER encoded form, respectively). If <code>null</code> is supplied
	155	* as the value for this argument, no issuerNames check will be performed.
	156	* <p>
	157	* Note that the <code>names</code> parameter can contain duplicate
	158	* distinguished names, but they may be removed from the
	159	* <code>Collection</code> of names returned by the
	160	* {@link #getIssuerNames getIssuerNames} method.
	161	* <p>
	162	* If a name is specified as a byte array, it should contain a single DER
	163	* encoded distinguished name, as defined in X.501. The ASN.1 notation for
	164	* this structure is as follows.
	165	* <pre><code>
	166	* Name ::= CHOICE {
	167	* RDNSequence }
	168	*
	169	* RDNSequence ::= SEQUENCE OF RelativeDistinguishedName
	170	*
	171	* RelativeDistinguishedName ::=
	172	* SET SIZE (1 .. MAX) OF AttributeTypeAndValue
	173	*
	174	* AttributeTypeAndValue ::= SEQUENCE {
	175	* type AttributeType,
	176	* value AttributeValue }
	177	*
	178	* AttributeType ::= OBJECT IDENTIFIER
	179	*
	180	* AttributeValue ::= ANY DEFINED BY AttributeType
	181	* ....
	182	* DirectoryString ::= CHOICE {
	183	* teletexString TeletexString (SIZE (1..MAX)),
	184	* printableString PrintableString (SIZE (1..MAX)),
	185	* universalString UniversalString (SIZE (1..MAX)),
	186	* utf8String UTF8String (SIZE (1.. MAX)),
	187	* bmpString BMPString (SIZE (1..MAX)) }
	188	* </code></pre>
	189	* <p>
	190	* Note that a deep copy is performed on the <code>Collection</code> to
	191	* protect against subsequent modifications.
	192	*
	193	* @param names a <code>Collection</code> of names (or <code>null</code>)
	194	* @throws IOException if a parsing error occurs
	195	* @see #getIssuerNames
	196	*/
	197	public void setIssuerNames(Collection<?> names) throws IOException {
	198	if (names == null \|\| names.size() == 0) {
	199	issuerNames = null;
	200	issuerX500Principals = null;
	201	} else {
	202	HashSet<Object> tempNames = cloneAndCheckIssuerNames(names);
	203	// Ensure that we either set both of these or neither
	204	issuerX500Principals = parseIssuerNames(tempNames);
	205	issuerNames = tempNames;
	206	}
	207	}
	208
	209	/**
	210	* Adds a name to the issuerNames criterion. The issuer distinguished
	211	* name in the <code>X509CRL</code> must match at least one of the specified
	212	* distinguished names.
	213	* <p>
	214	* This method allows the caller to add a name to the set of issuer names
	215	* which <code>X509CRLs</code> may contain. The specified name is added to
	216	* any previous value for the issuerNames criterion.
	217	* If the specified name is a duplicate, it may be ignored.
	218	*
	219	* @param issuer the issuer as X500Principal
	220	* @since 1.5
	221	*/
	222	public void addIssuer(X500Principal issuer) {
	223	addIssuerNameInternal(issuer.getEncoded(), issuer);
	224	}
	225
	226	/**
	227	* <strong>Denigrated</strong>, use
	228	* {@linkplain #addIssuer(X500Principal)} or
	229	* {@linkplain #addIssuerName(byte[])} instead. This method should not be
	230	* relied on as it can fail to match some CRLs because of a loss of
	231	* encoding information in the RFC 2253 String form of some distinguished
	232	* names.
	233	* <p>
	234	* Adds a name to the issuerNames criterion. The issuer distinguished
	235	* name in the <code>X509CRL</code> must match at least one of the specified
	236	* distinguished names.
	237	* <p>
	238	* This method allows the caller to add a name to the set of issuer names
	239	* which <code>X509CRLs</code> may contain. The specified name is added to
	240	* any previous value for the issuerNames criterion.
	241	* If the specified name is a duplicate, it may be ignored.
	242	*
	243	* @param name the name in RFC 2253 form
	244	* @throws IOException if a parsing error occurs
	245	*/
	246	public void addIssuerName(String name) throws IOException {
	247	addIssuerNameInternal(name, new X500Name(name).asX500Principal());
	248	}
	249
	250	/**
	251	* Adds a name to the issuerNames criterion. The issuer distinguished
	252	* name in the <code>X509CRL</code> must match at least one of the specified
	253	* distinguished names.
	254	* <p>
	255	* This method allows the caller to add a name to the set of issuer names
	256	* which <code>X509CRLs</code> may contain. The specified name is added to
	257	* any previous value for the issuerNames criterion. If the specified name
	258	* is a duplicate, it may be ignored.
	259	* If a name is specified as a byte array, it should contain a single DER
	260	* encoded distinguished name, as defined in X.501. The ASN.1 notation for
	261	* this structure is as follows.
	262	* <p>
	263	* The name is provided as a byte array. This byte array should contain
	264	* a single DER encoded distinguished name, as defined in X.501. The ASN.1
	265	* notation for this structure appears in the documentation for
	266	* {@link #setIssuerNames setIssuerNames(Collection names)}.
	267	* <p>
	268	* Note that the byte array supplied here is cloned to protect against
	269	* subsequent modifications.
	270	*
	271	* @param name a byte array containing the name in ASN.1 DER encoded form
	272	* @throws IOException if a parsing error occurs
	273	*/
	274	public void addIssuerName(byte[] name) throws IOException {
	275	// clone because byte arrays are modifiable
	276	addIssuerNameInternal(name.clone(), new X500Name(name).asX500Principal());
	277	}
	278
	279	/**
	280	* A private method that adds a name (String or byte array) to the
	281	* issuerNames criterion. The issuer distinguished
	282	* name in the <code>X509CRL</code> must match at least one of the specified
	283	* distinguished names.
	284	*
	285	* @param name the name in string or byte array form
	286	* @param principal the name in X500Principal form
	287	* @throws IOException if a parsing error occurs
	288	*/
	289	private void addIssuerNameInternal(Object name, X500Principal principal) {
	290	if (issuerNames == null) {
	291	issuerNames = new HashSet<Object>();
	292	}
	293	if (issuerX500Principals == null) {
	294	issuerX500Principals = new HashSet<X500Principal>();
	295	}
	296	issuerNames.add(name);
	297	issuerX500Principals.add(principal);
	298	}
	299
	300	/**
	301	* Clone and check an argument of the form passed to
	302	* setIssuerNames. Throw an IOException if the argument is malformed.
	303	*
	304	* @param names a <code>Collection</code> of names. Each entry is a
	305	* String or a byte array (the name, in string or ASN.1
	306	* DER encoded form, respectively). <code>null</code> is
	307	* not an acceptable value.
	308	* @return a deep copy of the specified <code>Collection</code>
	309	* @throws IOException if a parsing error occurs
	310	*/
	311	private static HashSet<Object> cloneAndCheckIssuerNames(Collection<?> names)
	312	throws IOException
	313	{
	314	HashSet<Object> namesCopy = new HashSet<Object>();
	315	Iterator<?> i = names.iterator();
	316	while (i.hasNext()) {
	317	Object nameObject = i.next();
	318	if (!(nameObject instanceof byte []) &&
	319	!(nameObject instanceof String))
	320	throw new IOException("name not byte array or String");
	321	if (nameObject instanceof byte [])
	322	namesCopy.add(((byte []) nameObject).clone());
	323	else
	324	namesCopy.add(nameObject);
	325	}
	326	return(namesCopy);
	327	}
	328
	329	/**
	330	* Clone an argument of the form passed to setIssuerNames.
	331	* Throw a RuntimeException if the argument is malformed.
	332	* <p>
	333	* This method wraps cloneAndCheckIssuerNames, changing any IOException
	334	* into a RuntimeException. This method should be used when the object being
	335	* cloned has already been checked, so there should never be any exceptions.
	336	*
	337	* @param names a <code>Collection</code> of names. Each entry is a
	338	* String or a byte array (the name, in string or ASN.1
	339	* DER encoded form, respectively). <code>null</code> is
	340	* not an acceptable value.
	341	* @return a deep copy of the specified <code>Collection</code>
	342	* @throws RuntimeException if a parsing error occurs
	343	*/
	344	private static HashSet<Object> cloneIssuerNames(Collection<Object> names) {
	345	try {
	346	return cloneAndCheckIssuerNames(names);
	347	} catch (IOException ioe) {
	348	throw new RuntimeException(ioe);
	349	}
	350	}
	351
	352	/**
	353	* Parse an argument of the form passed to setIssuerNames,
	354	* returning a Collection of issuerX500Principals.
	355	* Throw an IOException if the argument is malformed.
	356	*
	357	* @param names a <code>Collection</code> of names. Each entry is a
	358	* String or a byte array (the name, in string or ASN.1
	359	* DER encoded form, respectively). <Code>Null</Code> is
	360	* not an acceptable value.
	361	* @return a HashSet of issuerX500Principals
	362	* @throws IOException if a parsing error occurs
	363	*/
	364	private static HashSet<X500Principal> parseIssuerNames(Collection<Object> names)
	365	throws IOException {
	366	HashSet<X500Principal> x500Principals = new HashSet<X500Principal>();
	367	for (Iterator<Object> t = names.iterator(); t.hasNext(); ) {
	368	Object nameObject = t.next();
	369	if (nameObject instanceof String) {
	370	x500Principals.add(new X500Name((String)nameObject).asX500Principal());
	371	} else {
	372	try {
	373	x500Principals.add(new X500Principal((byte[])nameObject));
	374	} catch (IllegalArgumentException e) {
	375	throw (IOException)new IOException("Invalid name").initCause(e);
	376	}
	377	}
	378	}
	379	return x500Principals;
	380	}
	381
	382	/**
	383	* Sets the minCRLNumber criterion. The <code>X509CRL</code> must have a
	384	* CRL number extension whose value is greater than or equal to the
	385	* specified value. If <code>null</code>, no minCRLNumber check will be
	386	* done.
	387	*
	388	* @param minCRL the minimum CRL number accepted (or <code>null</code>)
	389	*/
	390	public void setMinCRLNumber(BigInteger minCRL) {
	391	this.minCRL = minCRL;
	392	}
	393
	394	/**
	395	* Sets the maxCRLNumber criterion. The <code>X509CRL</code> must have a
	396	* CRL number extension whose value is less than or equal to the
	397	* specified value. If <code>null</code>, no maxCRLNumber check will be
	398	* done.
	399	*
	400	* @param maxCRL the maximum CRL number accepted (or <code>null</code>)
	401	*/
	402	public void setMaxCRLNumber(BigInteger maxCRL) {
	403	this.maxCRL = maxCRL;
	404	}
	405
	406	/**
	407	* Sets the dateAndTime criterion. The specified date must be
	408	* equal to or later than the value of the thisUpdate component
	409	* of the <code>X509CRL</code> and earlier than the value of the
	410	* nextUpdate component. There is no match if the <code>X509CRL</code>
	411	* does not contain a nextUpdate component.
	412	* If <code>null</code>, no dateAndTime check will be done.
	413	* <p>
	414	* Note that the <code>Date</code> supplied here is cloned to protect
	415	* against subsequent modifications.
	416	*
	417	* @param dateAndTime the <code>Date</code> to match against
	418	* (or <code>null</code>)
	419	* @see #getDateAndTime
	420	*/
	421	public void setDateAndTime(Date dateAndTime) {
	422	if (dateAndTime == null)
	423	this.dateAndTime = null;
	424	else
	425	this.dateAndTime = new Date(dateAndTime.getTime());
	426	this.skew = 0;
	427	}
	428
	429	/**
	430	* Sets the dateAndTime criterion and allows for the specified clock skew
	431	* (in milliseconds) when checking against the validity period of the CRL.
	432	*/
	433	void setDateAndTime(Date dateAndTime, long skew) {
	434	this.dateAndTime =
	435	(dateAndTime == null ? null : new Date(dateAndTime.getTime()));
	436	this.skew = skew;
	437	}
	438
	439	/**
	440	* Sets the certificate being checked. This is not a criterion. Rather,
	441	* it is optional information that may help a <code>CertStore</code>
	442	* find CRLs that would be relevant when checking revocation for the
	443	* specified certificate. If <code>null</code> is specified, then no
	444	* such optional information is provided.
	445	*
	446	* @param cert the <code>X509Certificate</code> being checked
	447	* (or <code>null</code>)
	448	* @see #getCertificateChecking
	449	*/
	450	public void setCertificateChecking(X509Certificate cert) {
	451	certChecking = cert;
	452	}
	453
	454	/**
	455	* Returns the issuerNames criterion. The issuer distinguished
	456	* name in the <code>X509CRL</code> must match at least one of the specified
	457	* distinguished names. If the value returned is <code>null</code>, any
	458	* issuer distinguished name will do.
	459	* <p>
	460	* If the value returned is not <code>null</code>, it is a
	461	* unmodifiable <code>Collection</code> of <code>X500Principal</code>s.
	462	*
	463	* @return an unmodifiable <code>Collection</code> of names
	464	* (or <code>null</code>)
	465	* @see #setIssuers
	466	* @since 1.5
	467	*/
	468	public Collection<X500Principal> getIssuers() {
	469	if (issuerX500Principals == null) {
	470	return null;
	471	}
	472	return Collections.unmodifiableCollection(issuerX500Principals);
	473	}
	474
	475	/**
	476	* Returns a copy of the issuerNames criterion. The issuer distinguished
	477	* name in the <code>X509CRL</code> must match at least one of the specified
	478	* distinguished names. If the value returned is <code>null</code>, any
	479	* issuer distinguished name will do.
	480	* <p>
	481	* If the value returned is not <code>null</code>, it is a
	482	* <code>Collection</code> of names. Each name is a <code>String</code>
	483	* or a byte array representing a distinguished name (in RFC 2253 or
	484	* ASN.1 DER encoded form, respectively). Note that the
	485	* <code>Collection</code> returned may contain duplicate names.
	486	* <p>
	487	* If a name is specified as a byte array, it should contain a single DER
	488	* encoded distinguished name, as defined in X.501. The ASN.1 notation for
	489	* this structure is given in the documentation for
	490	* {@link #setIssuerNames setIssuerNames(Collection names)}.
	491	* <p>
	492	* Note that a deep copy is performed on the <code>Collection</code> to
	493	* protect against subsequent modifications.
	494	*
	495	* @return a <code>Collection</code> of names (or <code>null</code>)
	496	* @see #setIssuerNames
	497	*/
	498	public Collection<Object> getIssuerNames() {
	499	if (issuerNames == null) {
	500	return null;
	501	}
	502	return cloneIssuerNames(issuerNames);
	503	}
	504
	505	/**
	506	* Returns the minCRLNumber criterion. The <code>X509CRL</code> must have a
	507	* CRL number extension whose value is greater than or equal to the
	508	* specified value. If <code>null</code>, no minCRLNumber check will be done.
	509	*
	510	* @return the minimum CRL number accepted (or <code>null</code>)
	511	*/
	512	public BigInteger getMinCRL() {
	513	return minCRL;
	514	}
	515
	516	/**
	517	* Returns the maxCRLNumber criterion. The <code>X509CRL</code> must have a
	518	* CRL number extension whose value is less than or equal to the
	519	* specified value. If <code>null</code>, no maxCRLNumber check will be
	520	* done.
	521	*
	522	* @return the maximum CRL number accepted (or <code>null</code>)
	523	*/
	524	public BigInteger getMaxCRL() {
	525	return maxCRL;
	526	}
	527
	528	/**
	529	* Returns the dateAndTime criterion. The specified date must be
	530	* equal to or later than the value of the thisUpdate component
	531	* of the <code>X509CRL</code> and earlier than the value of the
	532	* nextUpdate component. There is no match if the
	533	* <code>X509CRL</code> does not contain a nextUpdate component.
	534	* If <code>null</code>, no dateAndTime check will be done.
	535	* <p>
	536	* Note that the <code>Date</code> returned is cloned to protect against
	537	* subsequent modifications.
	538	*
	539	* @return the <code>Date</code> to match against (or <code>null</code>)
	540	* @see #setDateAndTime
	541	*/
	542	public Date getDateAndTime() {
	543	if (dateAndTime == null)
	544	return null;
	545	return (Date) dateAndTime.clone();
	546	}
	547
	548	/**
	549	* Returns the certificate being checked. This is not a criterion. Rather,
	550	* it is optional information that may help a <code>CertStore</code>
	551	* find CRLs that would be relevant when checking revocation for the
	552	* specified certificate. If the value returned is <code>null</code>, then
	553	* no such optional information is provided.
	554	*
	555	* @return the certificate being checked (or <code>null</code>)
	556	* @see #setCertificateChecking
	557	*/
	558	public X509Certificate getCertificateChecking() {
	559	return certChecking;
	560	}
	561
	562	/**
	563	* Returns a printable representation of the <code>X509CRLSelector</code>.
	564	*
	565	* @return a <code>String</code> describing the contents of the
	566	* <code>X509CRLSelector</code>.
	567	*/
	568	public String toString() {
	569	StringBuffer sb = new StringBuffer();
	570	sb.append("X509CRLSelector: [\n");
	571	if (issuerNames != null) {
	572	sb.append(" IssuerNames:\n");
	573	Iterator<Object> i = issuerNames.iterator();
	574	while (i.hasNext())
	575	sb.append(" " + i.next() + "\n");
	576	}
	577	if (minCRL != null)
	578	sb.append(" minCRLNumber: " + minCRL + "\n");
	579	if (maxCRL != null)
	580	sb.append(" maxCRLNumber: " + maxCRL + "\n");
	581	if (dateAndTime != null)
	582	sb.append(" dateAndTime: " + dateAndTime + "\n");
	583	if (certChecking != null)
	584	sb.append(" Certificate being checked: " + certChecking + "\n");
	585	sb.append("]");
	586	return sb.toString();
	587	}
	588
	589	/**
	590	* Decides whether a <code>CRL</code> should be selected.
	591	*
	592	* @param crl the <code>CRL</code> to be checked
	593	* @return <code>true</code> if the <code>CRL</code> should be selected,
	594	* <code>false</code> otherwise
	595	*/
	596	public boolean match(CRL crl) {
	597	if (!(crl instanceof X509CRL)) {
	598	return false;
	599	}
	600	X509CRL xcrl = (X509CRL)crl;
	601
	602	/* match on issuer name */
	603	if (issuerNames != null) {
	604	X500Principal issuer = xcrl.getIssuerX500Principal();
	605	Iterator<X500Principal> i = issuerX500Principals.iterator();
	606	boolean found = false;
	607	while (!found && i.hasNext()) {
	608	if (i.next().equals(issuer)) {
	609	found = true;
	610	}
	611	}
	612	if (!found) {
	613	if (debug != null) {
	614	debug.println("X509CRLSelector.match: issuer DNs "
	615	+ "don't match");
	616	}
	617	return false;
	618	}
	619	}
	620
	621	if ((minCRL != null) \|\| (maxCRL != null)) {
	622	/* Get CRL number extension from CRL */
	623	byte[] crlNumExtVal = xcrl.getExtensionValue("2.5.29.20");
	624	if (crlNumExtVal == null) {
	625	if (debug != null) {
	626	debug.println("X509CRLSelector.match: no CRLNumber");
	627	}
	628	}
	629	BigInteger crlNum;
	630	try {
	631	DerInputStream in = new DerInputStream(crlNumExtVal);
	632	byte[] encoded = in.getOctetString();
	633	CRLNumberExtension crlNumExt =
	634	new CRLNumberExtension(Boolean.FALSE, encoded);
	635	crlNum = (BigInteger)crlNumExt.get(CRLNumberExtension.NUMBER);
	636	} catch (IOException ex) {
	637	if (debug != null) {
	638	debug.println("X509CRLSelector.match: exception in "
	639	+ "decoding CRL number");
	640	}
	641	return false;
	642	}
	643
	644	/* match on minCRLNumber */
	645	if (minCRL != null) {
	646	if (crlNum.compareTo(minCRL) < 0) {
	647	if (debug != null) {
	648	debug.println("X509CRLSelector.match: CRLNumber too small");
	649	}
	650	return false;
	651	}
	652	}
	653
	654	/* match on maxCRLNumber */
	655	if (maxCRL != null) {
	656	if (crlNum.compareTo(maxCRL) > 0) {
	657	if (debug != null) {
	658	debug.println("X509CRLSelector.match: CRLNumber too large");
	659	}
	660	return false;
	661	}
	662	}
	663	}
	664
	665
	666	/* match on dateAndTime */
	667	if (dateAndTime != null) {
	668	Date crlThisUpdate = xcrl.getThisUpdate();
	669	Date nextUpdate = xcrl.getNextUpdate();
	670	if (nextUpdate == null) {
	671	if (debug != null) {
	672	debug.println("X509CRLSelector.match: nextUpdate null");
	673	}
	674	return false;
	675	}
	676	Date nowPlusSkew = dateAndTime;
	677	Date nowMinusSkew = dateAndTime;
	678	if (skew > 0) {
	679	nowPlusSkew = new Date(dateAndTime.getTime() + skew);
	680	nowMinusSkew = new Date(dateAndTime.getTime() - skew);
	681	}
	682	if (nowMinusSkew.after(nextUpdate)
	683	\|\| nowPlusSkew.before(crlThisUpdate)) {
	684	if (debug != null) {
	685	debug.println("X509CRLSelector.match: update out of range");
	686	}
	687	return false;
	688	}
	689	}
	690
	691	return true;
	692	}
	693
	694	/**
	695	* Returns a copy of this object.
	696	*
	697	* @return the copy
	698	*/
	699	public Object clone() {
	700	try {
	701	X509CRLSelector copy = (X509CRLSelector)super.clone();
	702	if (issuerNames != null) {
	703	copy.issuerNames =
	704	new HashSet<Object>(issuerNames);
	705	copy.issuerX500Principals =
	706	new HashSet<X500Principal>(issuerX500Principals);
	707	}
	708	return copy;
	709	} catch (CloneNotSupportedException e) {
	710	/* Cannot happen */
	711	throw new InternalError(e.toString());
	712	}
	713	}
	714	}

java/pkg/java/security/cert/X509CertSelector.class+0−0

Binary file not shown.

java/pkg/java/security/cert/X509CertSelector.java+2638−0

@@ -0,0 +1,2638 @@
	1	/*
	2	* Copyright (c) 2000, 2008, Oracle and/or its affiliates. All rights reserved.
	3	* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
	4	*
	5	* This code is free software; you can redistribute it and/or modify it
	6	* under the terms of the GNU General Public License version 2 only, as
	7	* published by the Free Software Foundation. Oracle designates this
	8	* particular file as subject to the "Classpath" exception as provided
	9	* by Oracle in the LICENSE file that accompanied this code.
	10	*
	11	* This code is distributed in the hope that it will be useful, but WITHOUT
	12	* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
	13	* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
	14	* version 2 for more details (a copy is included in the LICENSE file that
	15	* accompanied this code).
	16	*
	17	* You should have received a copy of the GNU General Public License version
	18	* 2 along with this work; if not, write to the Free Software Foundation,
	19	* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
	20	*
	21	* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
	22	* or visit www.oracle.com if you need additional information or have any
	23	* questions.
	24	*/
	25
	26	package java.security.cert;
	27
	28	import java.io.IOException;
	29	import java.math.BigInteger;
	30	import java.security.PublicKey;
	31	import java.util.*;
	32	import javax.security.auth.x500.X500Principal;
	33
	34	import sun.misc.HexDumpEncoder;
	35	import sun.security.util.Debug;
	36	import sun.security.util.DerInputStream;
	37	import sun.security.util.DerValue;
	38	import sun.security.util.ObjectIdentifier;
	39	import sun.security.x509.*;
	40
	41	/**
	42	* A <code>CertSelector</code> that selects <code>X509Certificates</code> that
	43	* match all specified criteria. This class is particularly useful when
	44	* selecting certificates from a <code>CertStore</code> to build a
	45	* PKIX-compliant certification path.
	46	* <p>
	47	* When first constructed, an <code>X509CertSelector</code> has no criteria
	48	* enabled and each of the <code>get</code> methods return a default value
	49	* (<code>null</code>, or <code>-1</code> for the {@link #getBasicConstraints
	50	* getBasicConstraints} method). Therefore, the {@link #match match}
	51	* method would return <code>true</code> for any <code>X509Certificate</code>.
	52	* Typically, several criteria are enabled (by calling
	53	* {@link #setIssuer setIssuer} or
	54	* {@link #setKeyUsage setKeyUsage}, for instance) and then the
	55	* <code>X509CertSelector</code> is passed to
	56	* {@link CertStore#getCertificates CertStore.getCertificates} or some similar
	57	* method.
	58	* <p>
	59	* Several criteria can be enabled (by calling {@link #setIssuer setIssuer}
	60	* and {@link #setSerialNumber setSerialNumber},
	61	* for example) such that the <code>match</code> method
	62	* usually uniquely matches a single <code>X509Certificate</code>. We say
	63	* usually, since it is possible for two issuing CAs to have the same
	64	* distinguished name and each issue a certificate with the same serial
	65	* number. Other unique combinations include the issuer, subject,
	66	* subjectKeyIdentifier and/or the subjectPublicKey criteria.
	67	* <p>
	68	* Please refer to <a href="http://www.ietf.org/rfc/rfc3280.txt">RFC 3280:
	69	* Internet X.509 Public Key Infrastructure Certificate and CRL Profile</a> for
	70	* definitions of the X.509 certificate extensions mentioned below.
	71	* <p>
	72	* <b>Concurrent Access</b>
	73	* <p>
	74	* Unless otherwise specified, the methods defined in this class are not
	75	* thread-safe. Multiple threads that need to access a single
	76	* object concurrently should synchronize amongst themselves and
	77	* provide the necessary locking. Multiple threads each manipulating
	78	* separate objects need not synchronize.
	79	*
	80	* @see CertSelector
	81	* @see X509Certificate
	82	*
	83	* @since 1.4
	84	* @author Steve Hanna
	85	*/
	86	public class X509CertSelector implements CertSelector {
	87
	88	private static final Debug debug = Debug.getInstance("certpath");
	89
	90	private final static ObjectIdentifier ANY_EXTENDED_KEY_USAGE =
	91	ObjectIdentifier.newInternal(new int[] {2, 5, 29, 37, 0});
	92
	93	static {
	94	CertPathHelperImpl.initialize();
	95	}
	96
	97	private BigInteger serialNumber;
	98	private X500Principal issuer;
	99	private X500Principal subject;
	100	private byte[] subjectKeyID;
	101	private byte[] authorityKeyID;
	102	private Date certificateValid;
	103	private Date privateKeyValid;
	104	private ObjectIdentifier subjectPublicKeyAlgID;
	105	private PublicKey subjectPublicKey;
	106	private byte[] subjectPublicKeyBytes;
	107	private boolean[] keyUsage;
	108	private Set<String> keyPurposeSet;
	109	private Set<ObjectIdentifier> keyPurposeOIDSet;
	110	private Set<List<?>> subjectAlternativeNames;
	111	private Set<GeneralNameInterface> subjectAlternativeGeneralNames;
	112	private CertificatePolicySet policy;
	113	private Set<String> policySet;
	114	private Set<List<?>> pathToNames;
	115	private Set<GeneralNameInterface> pathToGeneralNames;
	116	private NameConstraintsExtension nc;
	117	private byte[] ncBytes;
	118	private int basicConstraints = -1;
	119	private X509Certificate x509Cert;
	120	private boolean matchAllSubjectAltNames = true;
	121
	122	private static final Boolean FALSE = Boolean.FALSE;
	123
	124	private static final int PRIVATE_KEY_USAGE_ID = 0;
	125	private static final int SUBJECT_ALT_NAME_ID = 1;
	126	private static final int NAME_CONSTRAINTS_ID = 2;
	127	private static final int CERT_POLICIES_ID = 3;
	128	private static final int EXTENDED_KEY_USAGE_ID = 4;
	129	private static final int NUM_OF_EXTENSIONS = 5;
	130	private static final String[] EXTENSION_OIDS = new String[NUM_OF_EXTENSIONS];
	131
	132	static {
	133	EXTENSION_OIDS[PRIVATE_KEY_USAGE_ID] = "2.5.29.16";
	134	EXTENSION_OIDS[SUBJECT_ALT_NAME_ID] = "2.5.29.17";
	135	EXTENSION_OIDS[NAME_CONSTRAINTS_ID] = "2.5.29.30";
	136	EXTENSION_OIDS[CERT_POLICIES_ID] = "2.5.29.32";
	137	EXTENSION_OIDS[EXTENDED_KEY_USAGE_ID] = "2.5.29.37";
	138	};
	139
	140	/* Constants representing the GeneralName types */
	141	static final int NAME_ANY = 0;
	142	static final int NAME_RFC822 = 1;
	143	static final int NAME_DNS = 2;
	144	static final int NAME_X400 = 3;
	145	static final int NAME_DIRECTORY = 4;
	146	static final int NAME_EDI = 5;
	147	static final int NAME_URI = 6;
	148	static final int NAME_IP = 7;
	149	static final int NAME_OID = 8;
	150
	151	/**
	152	* Creates an <code>X509CertSelector</code>. Initially, no criteria are set
	153	* so any <code>X509Certificate</code> will match.
	154	*/
	155	public X509CertSelector() {
	156	// empty
	157	}
	158
	159	/**
	160	* Sets the certificateEquals criterion. The specified
	161	* <code>X509Certificate</code> must be equal to the
	162	* <code>X509Certificate</code> passed to the <code>match</code> method.
	163	* If <code>null</code>, then this check is not applied.
	164	*
	165	* <p>This method is particularly useful when it is necessary to
	166	* match a single certificate. Although other criteria can be specified
	167	* in conjunction with the certificateEquals criterion, it is usually not
	168	* practical or necessary.
	169	*
	170	* @param cert the <code>X509Certificate</code> to match (or
	171	* <code>null</code>)
	172	* @see #getCertificate
	173	*/
	174	public void setCertificate(X509Certificate cert) {
	175	x509Cert = cert;
	176	}
	177
	178	/**
	179	* Sets the serialNumber criterion. The specified serial number
	180	* must match the certificate serial number in the
	181	* <code>X509Certificate</code>. If <code>null</code>, any certificate
	182	* serial number will do.
	183	*
	184	* @param serial the certificate serial number to match
	185	* (or <code>null</code>)
	186	* @see #getSerialNumber
	187	*/
	188	public void setSerialNumber(BigInteger serial) {
	189	serialNumber = serial;
	190	}
	191
	192	/**
	193	* Sets the issuer criterion. The specified distinguished name
	194	* must match the issuer distinguished name in the
	195	* <code>X509Certificate</code>. If <code>null</code>, any issuer
	196	* distinguished name will do.
	197	*
	198	* @param issuer a distinguished name as X500Principal
	199	* (or <code>null</code>)
	200	* @since 1.5
	201	*/
	202	public void setIssuer(X500Principal issuer) {
	203	this.issuer = issuer;
	204	}
	205
	206	/**
	207	* <strong>Denigrated</strong>, use {@linkplain #setIssuer(X500Principal)}
	208	* or {@linkplain #setIssuer(byte[])} instead. This method should not be
	209	* relied on as it can fail to match some certificates because of a loss of
	210	* encoding information in the
	211	* <a href="http://www.ietf.org/rfc/rfc2253.txt">RFC 2253</a> String form
	212	* of some distinguished names.
	213	* <p>
	214	* Sets the issuer criterion. The specified distinguished name
	215	* must match the issuer distinguished name in the
	216	* <code>X509Certificate</code>. If <code>null</code>, any issuer
	217	* distinguished name will do.
	218	* <p>
	219	* If <code>issuerDN</code> is not <code>null</code>, it should contain a
	220	* distinguished name, in RFC 2253 format.
	221	*
	222	* @param issuerDN a distinguished name in RFC 2253 format
	223	* (or <code>null</code>)
	224	* @throws IOException if a parsing error occurs (incorrect form for DN)
	225	*/
	226	public void setIssuer(String issuerDN) throws IOException {
	227	if (issuerDN == null) {
	228	issuer = null;
	229	} else {
	230	issuer = new X500Name(issuerDN).asX500Principal();
	231	}
	232	}
	233
	234	/**
	235	* Sets the issuer criterion. The specified distinguished name
	236	* must match the issuer distinguished name in the
	237	* <code>X509Certificate</code>. If <code>null</code> is specified,
	238	* the issuer criterion is disabled and any issuer distinguished name will
	239	* do.
	240	* <p>
	241	* If <code>issuerDN</code> is not <code>null</code>, it should contain a
	242	* single DER encoded distinguished name, as defined in X.501. The ASN.1
	243	* notation for this structure is as follows.
	244	* <pre><code>
	245	* Name ::= CHOICE {
	246	* RDNSequence }
	247	*
	248	* RDNSequence ::= SEQUENCE OF RelativeDistinguishedName
	249	*
	250	* RelativeDistinguishedName ::=
	251	* SET SIZE (1 .. MAX) OF AttributeTypeAndValue
	252	*
	253	* AttributeTypeAndValue ::= SEQUENCE {
	254	* type AttributeType,
	255	* value AttributeValue }
	256	*
	257	* AttributeType ::= OBJECT IDENTIFIER
	258	*
	259	* AttributeValue ::= ANY DEFINED BY AttributeType
	260	* ....
	261	* DirectoryString ::= CHOICE {
	262	* teletexString TeletexString (SIZE (1..MAX)),
	263	* printableString PrintableString (SIZE (1..MAX)),
	264	* universalString UniversalString (SIZE (1..MAX)),
	265	* utf8String UTF8String (SIZE (1.. MAX)),
	266	* bmpString BMPString (SIZE (1..MAX)) }
	267	* </code></pre>
	268	* <p>
	269	* Note that the byte array specified here is cloned to protect against
	270	* subsequent modifications.
	271	*
	272	* @param issuerDN a byte array containing the distinguished name
	273	* in ASN.1 DER encoded form (or <code>null</code>)
	274	* @throws IOException if an encoding error occurs (incorrect form for DN)
	275	*/
	276	public void setIssuer(byte[] issuerDN) throws IOException {
	277	try {
	278	issuer = (issuerDN == null ? null : new X500Principal(issuerDN));
	279	} catch (IllegalArgumentException e) {
	280	throw (IOException)new IOException("Invalid name").initCause(e);
	281	}
	282	}
	283
	284	/**
	285	* Sets the subject criterion. The specified distinguished name
	286	* must match the subject distinguished name in the
	287	* <code>X509Certificate</code>. If <code>null</code>, any subject
	288	* distinguished name will do.
	289	*
	290	* @param subject a distinguished name as X500Principal
	291	* (or <code>null</code>)
	292	* @since 1.5
	293	*/
	294	public void setSubject(X500Principal subject) {
	295	this.subject = subject;
	296	}
	297
	298	/**
	299	* <strong>Denigrated</strong>, use {@linkplain #setSubject(X500Principal)}
	300	* or {@linkplain #setSubject(byte[])} instead. This method should not be
	301	* relied on as it can fail to match some certificates because of a loss of
	302	* encoding information in the RFC 2253 String form of some distinguished
	303	* names.
	304	* <p>
	305	* Sets the subject criterion. The specified distinguished name
	306	* must match the subject distinguished name in the
	307	* <code>X509Certificate</code>. If <code>null</code>, any subject
	308	* distinguished name will do.
	309	* <p>
	310	* If <code>subjectDN</code> is not <code>null</code>, it should contain a
	311	* distinguished name, in RFC 2253 format.
	312	*
	313	* @param subjectDN a distinguished name in RFC 2253 format
	314	* (or <code>null</code>)
	315	* @throws IOException if a parsing error occurs (incorrect form for DN)
	316	*/
	317	public void setSubject(String subjectDN) throws IOException {
	318	if (subjectDN == null) {
	319	subject = null;
	320	} else {
	321	subject = new X500Name(subjectDN).asX500Principal();
	322	}
	323	}
	324
	325	/**
	326	* Sets the subject criterion. The specified distinguished name
	327	* must match the subject distinguished name in the
	328	* <code>X509Certificate</code>. If <code>null</code>, any subject
	329	* distinguished name will do.
	330	* <p>
	331	* If <code>subjectDN</code> is not <code>null</code>, it should contain a
	332	* single DER encoded distinguished name, as defined in X.501. For the ASN.1
	333	* notation for this structure, see
	334	* {@link #setIssuer(byte [] issuerDN) setIssuer(byte [] issuerDN)}.
	335	*
	336	* @param subjectDN a byte array containing the distinguished name in
	337	* ASN.1 DER format (or <code>null</code>)
	338	* @throws IOException if an encoding error occurs (incorrect form for DN)
	339	*/
	340	public void setSubject(byte[] subjectDN) throws IOException {
	341	try {
	342	subject = (subjectDN == null ? null : new X500Principal(subjectDN));
	343	} catch (IllegalArgumentException e) {
	344	throw (IOException)new IOException("Invalid name").initCause(e);
	345	}
	346	}
	347
	348	/**
	349	* Sets the subjectKeyIdentifier criterion. The
	350	* <code>X509Certificate</code> must contain a SubjectKeyIdentifier
	351	* extension for which the contents of the extension
	352	* matches the specified criterion value.
	353	* If the criterion value is <code>null</code>, no
	354	* subjectKeyIdentifier check will be done.
	355	* <p>
	356	* If <code>subjectKeyID</code> is not <code>null</code>, it
	357	* should contain a single DER encoded value corresponding to the contents
	358	* of the extension value (not including the object identifier,
	359	* criticality setting, and encapsulating OCTET STRING)
	360	* for a SubjectKeyIdentifier extension.
	361	* The ASN.1 notation for this structure follows.
	362	* <p>
	363	* <pre><code>
	364	* SubjectKeyIdentifier ::= KeyIdentifier
	365	*
	366	* KeyIdentifier ::= OCTET STRING
	367	* </code></pre>
	368	* <p>
	369	* Since the format of subject key identifiers is not mandated by
	370	* any standard, subject key identifiers are not parsed by the
	371	* <code>X509CertSelector</code>. Instead, the values are compared using
	372	* a byte-by-byte comparison.
	373	* <p>
	374	* Note that the byte array supplied here is cloned to protect against
	375	* subsequent modifications.
	376	*
	377	* @param subjectKeyID the subject key identifier (or <code>null</code>)
	378	* @see #getSubjectKeyIdentifier
	379	*/
	380	public void setSubjectKeyIdentifier(byte[] subjectKeyID) {
	381	if (subjectKeyID == null) {
	382	this.subjectKeyID = null;
	383	} else {
	384	this.subjectKeyID = subjectKeyID.clone();
	385	}
	386	}
	387
	388	/**
	389	* Sets the authorityKeyIdentifier criterion. The
	390	* <code>X509Certificate</code> must contain an
	391	* AuthorityKeyIdentifier extension for which the contents of the
	392	* extension value matches the specified criterion value.
	393	* If the criterion value is <code>null</code>, no
	394	* authorityKeyIdentifier check will be done.
	395	* <p>
	396	* If <code>authorityKeyID</code> is not <code>null</code>, it
	397	* should contain a single DER encoded value corresponding to the contents
	398	* of the extension value (not including the object identifier,
	399	* criticality setting, and encapsulating OCTET STRING)
	400	* for an AuthorityKeyIdentifier extension.
	401	* The ASN.1 notation for this structure follows.
	402	* <p>
	403	* <pre><code>
	404	* AuthorityKeyIdentifier ::= SEQUENCE {
	405	* keyIdentifier [0] KeyIdentifier OPTIONAL,
	406	* authorityCertIssuer [1] GeneralNames OPTIONAL,
	407	* authorityCertSerialNumber [2] CertificateSerialNumber OPTIONAL }
	408	*
	409	* KeyIdentifier ::= OCTET STRING
	410	* </code></pre>
	411	* <p>
	412	* Authority key identifiers are not parsed by the
	413	* <code>X509CertSelector</code>. Instead, the values are
	414	* compared using a byte-by-byte comparison.
	415	* <p>
	416	* When the <code>keyIdentifier</code> field of
	417	* <code>AuthorityKeyIdentifier</code> is populated, the value is
	418	* usually taken from the <code>SubjectKeyIdentifier</code> extension
	419	* in the issuer's certificate. Note, however, that the result of
	420	* <code>X509Certificate.getExtensionValue(<SubjectKeyIdentifier Object
	421	* Identifier>)</code> on the issuer's certificate may NOT be used
	422	* directly as the input to <code>setAuthorityKeyIdentifier</code>.
	423	* This is because the SubjectKeyIdentifier contains
	424	* only a KeyIdentifier OCTET STRING, and not a SEQUENCE of
	425	* KeyIdentifier, GeneralNames, and CertificateSerialNumber.
	426	* In order to use the extension value of the issuer certificate's
	427	* <code>SubjectKeyIdentifier</code>
	428	* extension, it will be necessary to extract the value of the embedded
	429	* <code>KeyIdentifier</code> OCTET STRING, then DER encode this OCTET
	430	* STRING inside a SEQUENCE.
	431	* For more details on SubjectKeyIdentifier, see
	432	* {@link #setSubjectKeyIdentifier(byte[] subjectKeyID)}.
	433	* <p>
	434	* Note also that the byte array supplied here is cloned to protect against
	435	* subsequent modifications.
	436	*
	437	* @param authorityKeyID the authority key identifier
	438	* (or <code>null</code>)
	439	* @see #getAuthorityKeyIdentifier
	440	*/
	441	public void setAuthorityKeyIdentifier(byte[] authorityKeyID) {
	442	if (authorityKeyID == null) {
	443	this.authorityKeyID = null;
	444	} else {
	445	this.authorityKeyID = authorityKeyID.clone();
	446	}
	447	}
	448
	449	/**
	450	* Sets the certificateValid criterion. The specified date must fall
	451	* within the certificate validity period for the
	452	* <code>X509Certificate</code>. If <code>null</code>, no certificateValid
	453	* check will be done.
	454	* <p>
	455	* Note that the <code>Date</code> supplied here is cloned to protect
	456	* against subsequent modifications.
	457	*
	458	* @param certValid the <code>Date</code> to check (or <code>null</code>)
	459	* @see #getCertificateValid
	460	*/
	461	public void setCertificateValid(Date certValid) {
	462	if (certValid == null) {
	463	certificateValid = null;
	464	} else {
	465	certificateValid = (Date)certValid.clone();
	466	}
	467	}
	468
	469	/**
	470	* Sets the privateKeyValid criterion. The specified date must fall
	471	* within the private key validity period for the
	472	* <code>X509Certificate</code>. If <code>null</code>, no privateKeyValid
	473	* check will be done.
	474	* <p>
	475	* Note that the <code>Date</code> supplied here is cloned to protect
	476	* against subsequent modifications.
	477	*
	478	* @param privateKeyValid the <code>Date</code> to check (or
	479	* <code>null</code>)
	480	* @see #getPrivateKeyValid
	481	*/
	482	public void setPrivateKeyValid(Date privateKeyValid) {
	483	if (privateKeyValid == null) {
	484	this.privateKeyValid = null;
	485	} else {
	486	this.privateKeyValid = (Date)privateKeyValid.clone();
	487	}
	488	}
	489
	490	/**
	491	* Sets the subjectPublicKeyAlgID criterion. The
	492	* <code>X509Certificate</code> must contain a subject public key
	493	* with the specified algorithm. If <code>null</code>, no
	494	* subjectPublicKeyAlgID check will be done.
	495	*
	496	* @param oid The object identifier (OID) of the algorithm to check
	497	* for (or <code>null</code>). An OID is represented by a
	498	* set of nonnegative integers separated by periods.
	499	* @throws IOException if the OID is invalid, such as
	500	* the first component being not 0, 1 or 2 or the second component
	501	* being greater than 39.
	502	*
	503	* @see #getSubjectPublicKeyAlgID
	504	*/
	505	public void setSubjectPublicKeyAlgID(String oid) throws IOException {
	506	if (oid == null) {
	507	subjectPublicKeyAlgID = null;
	508	} else {
	509	subjectPublicKeyAlgID = new ObjectIdentifier(oid);
	510	}
	511	}
	512
	513	/**
	514	* Sets the subjectPublicKey criterion. The
	515	* <code>X509Certificate</code> must contain the specified subject public
	516	* key. If <code>null</code>, no subjectPublicKey check will be done.
	517	*
	518	* @param key the subject public key to check for (or <code>null</code>)
	519	* @see #getSubjectPublicKey
	520	*/
	521	public void setSubjectPublicKey(PublicKey key) {
	522	if (key == null) {
	523	subjectPublicKey = null;
	524	subjectPublicKeyBytes = null;
	525	} else {
	526	subjectPublicKey = key;
	527	subjectPublicKeyBytes = key.getEncoded();
	528	}
	529	}
	530
	531	/**
	532	* Sets the subjectPublicKey criterion. The <code>X509Certificate</code>
	533	* must contain the specified subject public key. If <code>null</code>,
	534	* no subjectPublicKey check will be done.
	535	* <p>
	536	* Because this method allows the public key to be specified as a byte
	537	* array, it may be used for unknown key types.
	538	* <p>
	539	* If <code>key</code> is not <code>null</code>, it should contain a
	540	* single DER encoded SubjectPublicKeyInfo structure, as defined in X.509.
	541	* The ASN.1 notation for this structure is as follows.
	542	* <pre><code>
	543	* SubjectPublicKeyInfo ::= SEQUENCE {
	544	* algorithm AlgorithmIdentifier,
	545	* subjectPublicKey BIT STRING }
	546	*
	547	* AlgorithmIdentifier ::= SEQUENCE {
	548	* algorithm OBJECT IDENTIFIER,
	549	* parameters ANY DEFINED BY algorithm OPTIONAL }
	550	* -- contains a value of the type
	551	* -- registered for use with the
	552	* -- algorithm object identifier value
	553	* </code></pre>
	554	* <p>
	555	* Note that the byte array supplied here is cloned to protect against
	556	* subsequent modifications.
	557	*
	558	* @param key a byte array containing the subject public key in ASN.1 DER
	559	* form (or <code>null</code>)
	560	* @throws IOException if an encoding error occurs (incorrect form for
	561	* subject public key)
	562	* @see #getSubjectPublicKey
	563	*/
	564	public void setSubjectPublicKey(byte[] key) throws IOException {
	565	if (key == null) {
	566	subjectPublicKey = null;
	567	subjectPublicKeyBytes = null;
	568	} else {
	569	subjectPublicKeyBytes = key.clone();
	570	subjectPublicKey = X509Key.parse(new DerValue(subjectPublicKeyBytes));
	571	}
	572	}
	573
	574	/**
	575	* Sets the keyUsage criterion. The <code>X509Certificate</code>
	576	* must allow the specified keyUsage values. If <code>null</code>, no
	577	* keyUsage check will be done. Note that an <code>X509Certificate</code>
	578	* that has no keyUsage extension implicitly allows all keyUsage values.
	579	* <p>
	580	* Note that the boolean array supplied here is cloned to protect against
	581	* subsequent modifications.
	582	*
	583	* @param keyUsage a boolean array in the same format as the boolean
	584	* array returned by
	585	* {@link X509Certificate#getKeyUsage() X509Certificate.getKeyUsage()}.
	586	* Or <code>null</code>.
	587	* @see #getKeyUsage
	588	*/
	589	public void setKeyUsage(boolean[] keyUsage) {
	590	if (keyUsage == null) {
	591	this.keyUsage = null;
	592	} else {
	593	this.keyUsage = keyUsage.clone();
	594	}
	595	}
	596
	597	/**
	598	* Sets the extendedKeyUsage criterion. The <code>X509Certificate</code>
	599	* must allow the specified key purposes in its extended key usage
	600	* extension. If <code>keyPurposeSet</code> is empty or <code>null</code>,
	601	* no extendedKeyUsage check will be done. Note that an
	602	* <code>X509Certificate</code> that has no extendedKeyUsage extension
	603	* implicitly allows all key purposes.
	604	* <p>
	605	* Note that the <code>Set</code> is cloned to protect against
	606	* subsequent modifications.
	607	*
	608	* @param keyPurposeSet a <code>Set</code> of key purpose OIDs in string
	609	* format (or <code>null</code>). Each OID is represented by a set of
	610	* nonnegative integers separated by periods.
	611	* @throws IOException if the OID is invalid, such as
	612	* the first component being not 0, 1 or 2 or the second component
	613	* being greater than 39.
	614	* @see #getExtendedKeyUsage
	615	*/
	616	public void setExtendedKeyUsage(Set<String> keyPurposeSet) throws IOException {
	617	if ((keyPurposeSet == null) \|\| keyPurposeSet.isEmpty()) {
	618	this.keyPurposeSet = null;
	619	keyPurposeOIDSet = null;
	620	} else {
	621	this.keyPurposeSet =
	622	Collections.unmodifiableSet(new HashSet<String>(keyPurposeSet));
	623	keyPurposeOIDSet = new HashSet<ObjectIdentifier>();
	624	for (String s : this.keyPurposeSet) {
	625	keyPurposeOIDSet.add(new ObjectIdentifier(s));
	626	}
	627	}
	628	}
	629
	630	/**
	631	* Enables/disables matching all of the subjectAlternativeNames
	632	* specified in the {@link #setSubjectAlternativeNames
	633	* setSubjectAlternativeNames} or {@link #addSubjectAlternativeName
	634	* addSubjectAlternativeName} methods. If enabled,
	635	* the <code>X509Certificate</code> must contain all of the
	636	* specified subject alternative names. If disabled, the
	637	* <code>X509Certificate</code> must contain at least one of the
	638	* specified subject alternative names.
	639	*
	640	* <p>The matchAllNames flag is <code>true</code> by default.
	641	*
	642	* @param matchAllNames if <code>true</code>, the flag is enabled;
	643	* if <code>false</code>, the flag is disabled.
	644	* @see #getMatchAllSubjectAltNames
	645	*/
	646	public void setMatchAllSubjectAltNames(boolean matchAllNames) {
	647	this.matchAllSubjectAltNames = matchAllNames;
	648	}
	649
	650	/**
	651	* Sets the subjectAlternativeNames criterion. The
	652	* <code>X509Certificate</code> must contain all or at least one of the
	653	* specified subjectAlternativeNames, depending on the value of
	654	* the matchAllNames flag (see {@link #setMatchAllSubjectAltNames
	655	* setMatchAllSubjectAltNames}).
	656	* <p>
	657	* This method allows the caller to specify, with a single method call,
	658	* the complete set of subject alternative names for the
	659	* subjectAlternativeNames criterion. The specified value replaces
	660	* the previous value for the subjectAlternativeNames criterion.
	661	* <p>
	662	* The <code>names</code> parameter (if not <code>null</code>) is a
	663	* <code>Collection</code> with one
	664	* entry for each name to be included in the subject alternative name
	665	* criterion. Each entry is a <code>List</code> whose first entry is an
	666	* <code>Integer</code> (the name type, 0-8) and whose second
	667	* entry is a <code>String</code> or a byte array (the name, in
	668	* string or ASN.1 DER encoded form, respectively).
	669	* There can be multiple names of the same type. If <code>null</code>
	670	* is supplied as the value for this argument, no
	671	* subjectAlternativeNames check will be performed.
	672	* <p>
	673	* Each subject alternative name in the <code>Collection</code>
	674	* may be specified either as a <code>String</code> or as an ASN.1 encoded
	675	* byte array. For more details about the formats used, see
	676	* {@link #addSubjectAlternativeName(int type, String name)
	677	* addSubjectAlternativeName(int type, String name)} and
	678	* {@link #addSubjectAlternativeName(int type, byte [] name)
	679	* addSubjectAlternativeName(int type, byte [] name)}.
	680	* <p>
	681	* <strong>Note:</strong> for distinguished names, specify the byte
	682	* array form instead of the String form. See the note in
	683	* {@link #addSubjectAlternativeName(int, String)} for more information.
	684	* <p>
	685	* Note that the <code>names</code> parameter can contain duplicate
	686	* names (same name and name type), but they may be removed from the
	687	* <code>Collection</code> of names returned by the
	688	* {@link #getSubjectAlternativeNames getSubjectAlternativeNames} method.
	689	* <p>
	690	* Note that a deep copy is performed on the <code>Collection</code> to
	691	* protect against subsequent modifications.
	692	*
	693	* @param names a <code>Collection</code> of names (or <code>null</code>)
	694	* @throws IOException if a parsing error occurs
	695	* @see #getSubjectAlternativeNames
	696	*/
	697	public void setSubjectAlternativeNames(Collection<List<?>> names)
	698	throws IOException {
	699	if (names == null) {
	700	subjectAlternativeNames = null;
	701	subjectAlternativeGeneralNames = null;
	702	} else {
	703	if (names.isEmpty()) {
	704	subjectAlternativeNames = null;
	705	subjectAlternativeGeneralNames = null;
	706	return;
	707	}
	708	Set<List<?>> tempNames = cloneAndCheckNames(names);
	709	// Ensure that we either set both of these or neither
	710	subjectAlternativeGeneralNames = parseNames(tempNames);
	711	subjectAlternativeNames = tempNames;
	712	}
	713	}
	714
	715	/**
	716	* Adds a name to the subjectAlternativeNames criterion. The
	717	* <code>X509Certificate</code> must contain all or at least one
	718	* of the specified subjectAlternativeNames, depending on the value of
	719	* the matchAllNames flag (see {@link #setMatchAllSubjectAltNames
	720	* setMatchAllSubjectAltNames}).
	721	* <p>
	722	* This method allows the caller to add a name to the set of subject
	723	* alternative names.
	724	* The specified name is added to any previous value for the
	725	* subjectAlternativeNames criterion. If the specified name is a
	726	* duplicate, it may be ignored.
	727	* <p>
	728	* The name is provided in string format.
	729	* <a href="http://www.ietf.org/rfc/rfc822.txt">RFC 822</a>, DNS, and URI
	730	* names use the well-established string formats for those types (subject to
	731	* the restrictions included in RFC 3280). IPv4 address names are
	732	* supplied using dotted quad notation. OID address names are represented
	733	* as a series of nonnegative integers separated by periods. And
	734	* directory names (distinguished names) are supplied in RFC 2253 format.
	735	* No standard string format is defined for otherNames, X.400 names,
	736	* EDI party names, IPv6 address names, or any other type of names. They
	737	* should be specified using the
	738	* {@link #addSubjectAlternativeName(int type, byte [] name)
	739	* addSubjectAlternativeName(int type, byte [] name)}
	740	* method.
	741	* <p>
	742	* <strong>Note:</strong> for distinguished names, use
	743	* {@linkplain #addSubjectAlternativeName(int, byte[])} instead.
	744	* This method should not be relied on as it can fail to match some
	745	* certificates because of a loss of encoding information in the RFC 2253
	746	* String form of some distinguished names.
	747	*
	748	* @param type the name type (0-8, as specified in
	749	* RFC 3280, section 4.2.1.7)
	750	* @param name the name in string form (not <code>null</code>)
	751	* @throws IOException if a parsing error occurs
	752	*/
	753	public void addSubjectAlternativeName(int type, String name)
	754	throws IOException {
	755	addSubjectAlternativeNameInternal(type, name);
	756	}
	757
	758	/**
	759	* Adds a name to the subjectAlternativeNames criterion. The
	760	* <code>X509Certificate</code> must contain all or at least one
	761	* of the specified subjectAlternativeNames, depending on the value of
	762	* the matchAllNames flag (see {@link #setMatchAllSubjectAltNames
	763	* setMatchAllSubjectAltNames}).
	764	* <p>
	765	* This method allows the caller to add a name to the set of subject
	766	* alternative names.
	767	* The specified name is added to any previous value for the
	768	* subjectAlternativeNames criterion. If the specified name is a
	769	* duplicate, it may be ignored.
	770	* <p>
	771	* The name is provided as a byte array. This byte array should contain
	772	* the DER encoded name, as it would appear in the GeneralName structure
	773	* defined in RFC 3280 and X.509. The encoded byte array should only contain
	774	* the encoded value of the name, and should not include the tag associated
	775	* with the name in the GeneralName structure. The ASN.1 definition of this
	776	* structure appears below.
	777	* <pre><code>
	778	* GeneralName ::= CHOICE {
	779	* otherName [0] OtherName,
	780	* rfc822Name [1] IA5String,
	781	* dNSName [2] IA5String,
	782	* x400Address [3] ORAddress,
	783	* directoryName [4] Name,
	784	* ediPartyName [5] EDIPartyName,
	785	* uniformResourceIdentifier [6] IA5String,
	786	* iPAddress [7] OCTET STRING,
	787	* registeredID [8] OBJECT IDENTIFIER}
	788	* </code></pre>
	789	* <p>
	790	* Note that the byte array supplied here is cloned to protect against
	791	* subsequent modifications.
	792	*
	793	* @param type the name type (0-8, as listed above)
	794	* @param name a byte array containing the name in ASN.1 DER encoded form
	795	* @throws IOException if a parsing error occurs
	796	*/
	797	public void addSubjectAlternativeName(int type, byte[] name)
	798	throws IOException {
	799	// clone because byte arrays are modifiable
	800	addSubjectAlternativeNameInternal(type, name.clone());
	801	}
	802
	803	/**
	804	* A private method that adds a name (String or byte array) to the
	805	* subjectAlternativeNames criterion. The <code>X509Certificate</code>
	806	* must contain the specified subjectAlternativeName.
	807	*
	808	* @param type the name type (0-8, as specified in
	809	* RFC 3280, section 4.2.1.7)
	810	* @param name the name in string or byte array form
	811	* @throws IOException if a parsing error occurs
	812	*/
	813	private void addSubjectAlternativeNameInternal(int type, Object name)
	814	throws IOException {
	815	// First, ensure that the name parses
	816	GeneralNameInterface tempName = makeGeneralNameInterface(type, name);
	817	if (subjectAlternativeNames == null) {
	818	subjectAlternativeNames = new HashSet<List<?>>();
	819	}
	820	if (subjectAlternativeGeneralNames == null) {
	821	subjectAlternativeGeneralNames = new HashSet<GeneralNameInterface>();
	822	}
	823	List<Object> list = new ArrayList<Object>(2);
	824	list.add(Integer.valueOf(type));
	825	list.add(name);
	826	subjectAlternativeNames.add(list);
	827	subjectAlternativeGeneralNames.add(tempName);
	828	}
	829
	830	/**
	831	* Parse an argument of the form passed to setSubjectAlternativeNames,
	832	* returning a <code>Collection</code> of
	833	* <code>GeneralNameInterface</code>s.
	834	* Throw an IllegalArgumentException or a ClassCastException
	835	* if the argument is malformed.
	836	*
	837	* @param names a Collection with one entry per name.
	838	* Each entry is a <code>List</code> whose first entry
	839	* is an Integer (the name type, 0-8) and whose second
	840	* entry is a String or a byte array (the name, in
	841	* string or ASN.1 DER encoded form, respectively).
	842	* There can be multiple names of the same type. Null is
	843	* not an acceptable value.
	844	* @return a Set of <code>GeneralNameInterface</code>s
	845	* @throws IOException if a parsing error occurs
	846	*/
	847	private static Set<GeneralNameInterface> parseNames(Collection<List<?>> names) throws IOException {
	848	Set<GeneralNameInterface> genNames = new HashSet<GeneralNameInterface>();
	849	for (List<?> nameList : names) {
	850	if (nameList.size() != 2) {
	851	throw new IOException("name list size not 2");
	852	}
	853	Object o = nameList.get(0);
	854	if (!(o instanceof Integer)) {
	855	throw new IOException("expected an Integer");
	856	}
	857	int nameType = ((Integer)o).intValue();
	858	o = nameList.get(1);
	859	genNames.add(makeGeneralNameInterface(nameType, o));
	860	}
	861
	862	return genNames;
	863	}
	864
	865	/**
	866	* Compare for equality two objects of the form passed to
	867	* setSubjectAlternativeNames (or X509CRLSelector.setIssuerNames).
	868	* Throw an <code>IllegalArgumentException</code> or a
	869	* <code>ClassCastException</code> if one of the objects is malformed.
	870	*
	871	* @param object1 a Collection containing the first object to compare
	872	* @param object2 a Collection containing the second object to compare
	873	* @return true if the objects are equal, false otherwise
	874	*/
	875	static boolean equalNames(Collection object1, Collection object2) {
	876	if ((object1 == null) \|\| (object2 == null)) {
	877	return object1 == object2;
	878	}
	879	return object1.equals(object2);
	880	}
	881
	882	/**
	883	* Make a <code>GeneralNameInterface</code> out of a name type (0-8) and an
	884	* Object that may be a byte array holding the ASN.1 DER encoded
	885	* name or a String form of the name. Except for X.509
	886	* Distinguished Names, the String form of the name must not be the
	887	* result from calling toString on an existing GeneralNameInterface
	888	* implementing class. The output of toString is not compatible
	889	* with the String constructors for names other than Distinguished
	890	* Names.
	891	*
	892	* @param type name type (0-8)
	893	* @param name name as ASN.1 Der-encoded byte array or String
	894	* @return a GeneralNameInterface name
	895	* @throws IOException if a parsing error occurs
	896	*/
	897	static GeneralNameInterface makeGeneralNameInterface(int type, Object name)
	898	throws IOException {
	899	GeneralNameInterface result;
	900	if (debug != null) {
	901	debug.println("X509CertSelector.makeGeneralNameInterface("
	902	+ type + ")...");
	903	}
	904
	905	if (name instanceof String) {
	906	if (debug != null) {
	907	debug.println("X509CertSelector.makeGeneralNameInterface() "
	908	+ "name is String: " + name);
	909	}
	910	switch (type) {
	911	case NAME_RFC822:
	912	result = new RFC822Name((String)name);
	913	break;
	914	case NAME_DNS:
	915	result = new DNSName((String)name);
	916	break;
	917	case NAME_DIRECTORY:
	918	result = new X500Name((String)name);
	919	break;
	920	case NAME_URI:
	921	result = new URIName((String)name);
	922	break;
	923	case NAME_IP:
	924	result = new IPAddressName((String)name);
	925	break;
	926	case NAME_OID:
	927	result = new OIDName((String)name);
	928	break;
	929	default:
	930	throw new IOException("unable to parse String names of type "
	931	+ type);
	932	}
	933	if (debug != null) {
	934	debug.println("X509CertSelector.makeGeneralNameInterface() "
	935	+ "result: " + result.toString());
	936	}
	937	} else if (name instanceof byte[]) {
	938	DerValue val = new DerValue((byte[]) name);
	939	if (debug != null) {
	940	debug.println
	941	("X509CertSelector.makeGeneralNameInterface() is byte[]");
	942	}
	943
	944	switch (type) {
	945	case NAME_ANY:
	946	result = new OtherName(val);
	947	break;
	948	case NAME_RFC822:
	949	result = new RFC822Name(val);
	950	break;
	951	case NAME_DNS:
	952	result = new DNSName(val);
	953	break;
	954	case NAME_X400:
	955	result = new X400Address(val);
	956	break;
	957	case NAME_DIRECTORY:
	958	result = new X500Name(val);
	959	break;
	960	case NAME_EDI:
	961	result = new EDIPartyName(val);
	962	break;
	963	case NAME_URI:
	964	result = new URIName(val);
	965	break;
	966	case NAME_IP:
	967	result = new IPAddressName(val);
	968	break;
	969	case NAME_OID:
	970	result = new OIDName(val);
	971	break;
	972	default:
	973	throw new IOException("unable to parse byte array names of "
	974	+ "type " + type);
	975	}
	976	if (debug != null) {
	977	debug.println("X509CertSelector.makeGeneralNameInterface() result: "
	978	+ result.toString());
	979	}
	980	} else {
	981	if (debug != null) {
	982	debug.println("X509CertSelector.makeGeneralName() input name "
	983	+ "not String or byte array");
	984	}
	985	throw new IOException("name not String or byte array");
	986	}
	987	return result;
	988	}
	989
	990
	991	/**
	992	* Sets the name constraints criterion. The <code>X509Certificate</code>
	993	* must have subject and subject alternative names that
	994	* meet the specified name constraints.
	995	* <p>
	996	* The name constraints are specified as a byte array. This byte array
	997	* should contain the DER encoded form of the name constraints, as they
	998	* would appear in the NameConstraints structure defined in RFC 3280
	999	* and X.509. The ASN.1 definition of this structure appears below.
	1000	*
	1001	* <pre><code>
	1002	* NameConstraints ::= SEQUENCE {
	1003	* permittedSubtrees [0] GeneralSubtrees OPTIONAL,
	1004	* excludedSubtrees [1] GeneralSubtrees OPTIONAL }
	1005	*
	1006	* GeneralSubtrees ::= SEQUENCE SIZE (1..MAX) OF GeneralSubtree
	1007	*
	1008	* GeneralSubtree ::= SEQUENCE {
	1009	* base GeneralName,
	1010	* minimum [0] BaseDistance DEFAULT 0,
	1011	* maximum [1] BaseDistance OPTIONAL }
	1012	*
	1013	* BaseDistance ::= INTEGER (0..MAX)
	1014	*
	1015	* GeneralName ::= CHOICE {
	1016	* otherName [0] OtherName,
	1017	* rfc822Name [1] IA5String,
	1018	* dNSName [2] IA5String,
	1019	* x400Address [3] ORAddress,
	1020	* directoryName [4] Name,
	1021	* ediPartyName [5] EDIPartyName,
	1022	* uniformResourceIdentifier [6] IA5String,
	1023	* iPAddress [7] OCTET STRING,
	1024	* registeredID [8] OBJECT IDENTIFIER}
	1025	* </code></pre>
	1026	* <p>
	1027	* Note that the byte array supplied here is cloned to protect against
	1028	* subsequent modifications.
	1029	*
	1030	* @param bytes a byte array containing the ASN.1 DER encoding of
	1031	* a NameConstraints extension to be used for checking
	1032	* name constraints. Only the value of the extension is
	1033	* included, not the OID or criticality flag. Can be
	1034	* <code>null</code>,
	1035	* in which case no name constraints check will be performed.
	1036	* @throws IOException if a parsing error occurs
	1037	* @see #getNameConstraints
	1038	*/
	1039	public void setNameConstraints(byte[] bytes) throws IOException {
	1040	if (bytes == null) {
	1041	ncBytes = null;
	1042	nc = null;
	1043	} else {
	1044	ncBytes = bytes.clone();
	1045	nc = new NameConstraintsExtension(FALSE, bytes);
	1046	}
	1047	}
	1048
	1049	/**
	1050	* Sets the basic constraints constraint. If the value is greater than or
	1051	* equal to zero, <code>X509Certificates</code> must include a
	1052	* basicConstraints extension with
	1053	* a pathLen of at least this value. If the value is -2, only end-entity
	1054	* certificates are accepted. If the value is -1, no check is done.
	1055	* <p>
	1056	* This constraint is useful when building a certification path forward
	1057	* (from the target toward the trust anchor. If a partial path has been
	1058	* built, any candidate certificate must have a maxPathLen value greater
	1059	* than or equal to the number of certificates in the partial path.
	1060	*
	1061	* @param minMaxPathLen the value for the basic constraints constraint
	1062	* @throws IllegalArgumentException if the value is less than -2
	1063	* @see #getBasicConstraints
	1064	*/
	1065	public void setBasicConstraints(int minMaxPathLen) {
	1066	if (minMaxPathLen < -2) {
	1067	throw new IllegalArgumentException("basic constraints less than -2");
	1068	}
	1069	basicConstraints = minMaxPathLen;
	1070	}
	1071
	1072	/**
	1073	* Sets the policy constraint. The <code>X509Certificate</code> must
	1074	* include at least one of the specified policies in its certificate
	1075	* policies extension. If <code>certPolicySet</code> is empty, then the
	1076	* <code>X509Certificate</code> must include at least some specified policy
	1077	* in its certificate policies extension. If <code>certPolicySet</code> is
	1078	* <code>null</code>, no policy check will be performed.
	1079	* <p>
	1080	* Note that the <code>Set</code> is cloned to protect against
	1081	* subsequent modifications.
	1082	*
	1083	* @param certPolicySet a <code>Set</code> of certificate policy OIDs in
	1084	* string format (or <code>null</code>). Each OID is
	1085	* represented by a set of nonnegative integers
	1086	* separated by periods.
	1087	* @throws IOException if a parsing error occurs on the OID such as
	1088	* the first component is not 0, 1 or 2 or the second component is
	1089	* greater than 39.
	1090	* @see #getPolicy
	1091	*/
	1092	public void setPolicy(Set<String> certPolicySet) throws IOException {
	1093	if (certPolicySet == null) {
	1094	policySet = null;
	1095	policy = null;
	1096	} else {
	1097	// Snapshot set and parse it
	1098	Set<String> tempSet = Collections.unmodifiableSet
	1099	(new HashSet<String>(certPolicySet));
	1100	/* Convert to Vector of ObjectIdentifiers */
	1101	Iterator<String> i = tempSet.iterator();
	1102	Vector<CertificatePolicyId> polIdVector = new Vector<CertificatePolicyId>();
	1103	while (i.hasNext()) {
	1104	Object o = i.next();
	1105	if (!(o instanceof String)) {
	1106	throw new IOException("non String in certPolicySet");
	1107	}
	1108	polIdVector.add(new CertificatePolicyId(new ObjectIdentifier(
	1109	(String)o)));
	1110	}
	1111	// If everything went OK, make the changes
	1112	policySet = tempSet;
	1113	policy = new CertificatePolicySet(polIdVector);
	1114	}
	1115	}
	1116
	1117	/**
	1118	* Sets the pathToNames criterion. The <code>X509Certificate</code> must
	1119	* not include name constraints that would prohibit building a
	1120	* path to the specified names.
	1121	* <p>
	1122	* This method allows the caller to specify, with a single method call,
	1123	* the complete set of names which the <code>X509Certificates</code>'s
	1124	* name constraints must permit. The specified value replaces
	1125	* the previous value for the pathToNames criterion.
	1126	* <p>
	1127	* This constraint is useful when building a certification path forward
	1128	* (from the target toward the trust anchor. If a partial path has been
	1129	* built, any candidate certificate must not include name constraints that
	1130	* would prohibit building a path to any of the names in the partial path.
	1131	* <p>
	1132	* The <code>names</code> parameter (if not <code>null</code>) is a
	1133	* <code>Collection</code> with one
	1134	* entry for each name to be included in the pathToNames
	1135	* criterion. Each entry is a <code>List</code> whose first entry is an
	1136	* <code>Integer</code> (the name type, 0-8) and whose second
	1137	* entry is a <code>String</code> or a byte array (the name, in
	1138	* string or ASN.1 DER encoded form, respectively).
	1139	* There can be multiple names of the same type. If <code>null</code>
	1140	* is supplied as the value for this argument, no
	1141	* pathToNames check will be performed.
	1142	* <p>
	1143	* Each name in the <code>Collection</code>
	1144	* may be specified either as a <code>String</code> or as an ASN.1 encoded
	1145	* byte array. For more details about the formats used, see
	1146	* {@link #addPathToName(int type, String name)
	1147	* addPathToName(int type, String name)} and
	1148	* {@link #addPathToName(int type, byte [] name)
	1149	* addPathToName(int type, byte [] name)}.
	1150	* <p>
	1151	* <strong>Note:</strong> for distinguished names, specify the byte
	1152	* array form instead of the String form. See the note in
	1153	* {@link #addPathToName(int, String)} for more information.
	1154	* <p>
	1155	* Note that the <code>names</code> parameter can contain duplicate
	1156	* names (same name and name type), but they may be removed from the
	1157	* <code>Collection</code> of names returned by the
	1158	* {@link #getPathToNames getPathToNames} method.
	1159	* <p>
	1160	* Note that a deep copy is performed on the <code>Collection</code> to
	1161	* protect against subsequent modifications.
	1162	*
	1163	* @param names a <code>Collection</code> with one entry per name
	1164	* (or <code>null</code>)
	1165	* @throws IOException if a parsing error occurs
	1166	* @see #getPathToNames
	1167	*/
	1168	public void setPathToNames(Collection<List<?>> names) throws IOException {
	1169	if ((names == null) \|\| names.isEmpty()) {
	1170	pathToNames = null;
	1171	pathToGeneralNames = null;
	1172	} else {
	1173	Set<List<?>> tempNames = cloneAndCheckNames(names);
	1174	pathToGeneralNames = parseNames(tempNames);
	1175	// Ensure that we either set both of these or neither
	1176	pathToNames = tempNames;
	1177	}
	1178	}
	1179
	1180	// called from CertPathHelper
	1181	void setPathToNamesInternal(Set<GeneralNameInterface> names) {
	1182	// set names to non-null dummy value
	1183	// this breaks getPathToNames()
	1184	pathToNames = Collections.<List<?>>emptySet();
	1185	pathToGeneralNames = names;
	1186	}
	1187
	1188	/**
	1189	* Adds a name to the pathToNames criterion. The <code>X509Certificate</code>
	1190	* must not include name constraints that would prohibit building a
	1191	* path to the specified name.
	1192	* <p>
	1193	* This method allows the caller to add a name to the set of names which
	1194	* the <code>X509Certificates</code>'s name constraints must permit.
	1195	* The specified name is added to any previous value for the
	1196	* pathToNames criterion. If the name is a duplicate, it may be ignored.
	1197	* <p>
	1198	* The name is provided in string format. RFC 822, DNS, and URI names
	1199	* use the well-established string formats for those types (subject to
	1200	* the restrictions included in RFC 3280). IPv4 address names are
	1201	* supplied using dotted quad notation. OID address names are represented
	1202	* as a series of nonnegative integers separated by periods. And
	1203	* directory names (distinguished names) are supplied in RFC 2253 format.
	1204	* No standard string format is defined for otherNames, X.400 names,
	1205	* EDI party names, IPv6 address names, or any other type of names. They
	1206	* should be specified using the
	1207	* {@link #addPathToName(int type, byte [] name)
	1208	* addPathToName(int type, byte [] name)} method.
	1209	* <p>
	1210	* <strong>Note:</strong> for distinguished names, use
	1211	* {@linkplain #addPathToName(int, byte[])} instead.
	1212	* This method should not be relied on as it can fail to match some
	1213	* certificates because of a loss of encoding information in the RFC 2253
	1214	* String form of some distinguished names.
	1215	*
	1216	* @param type the name type (0-8, as specified in
	1217	* RFC 3280, section 4.2.1.7)
	1218	* @param name the name in string form
	1219	* @throws IOException if a parsing error occurs
	1220	*/
	1221	public void addPathToName(int type, String name) throws IOException {
	1222	addPathToNameInternal(type, name);
	1223	}
	1224
	1225	/**
	1226	* Adds a name to the pathToNames criterion. The <code>X509Certificate</code>
	1227	* must not include name constraints that would prohibit building a
	1228	* path to the specified name.
	1229	* <p>
	1230	* This method allows the caller to add a name to the set of names which
	1231	* the <code>X509Certificates</code>'s name constraints must permit.
	1232	* The specified name is added to any previous value for the
	1233	* pathToNames criterion. If the name is a duplicate, it may be ignored.
	1234	* <p>
	1235	* The name is provided as a byte array. This byte array should contain
	1236	* the DER encoded name, as it would appear in the GeneralName structure
	1237	* defined in RFC 3280 and X.509. The ASN.1 definition of this structure
	1238	* appears in the documentation for
	1239	* {@link #addSubjectAlternativeName(int type, byte [] name)
	1240	* addSubjectAlternativeName(int type, byte [] name)}.
	1241	* <p>
	1242	* Note that the byte array supplied here is cloned to protect against
	1243	* subsequent modifications.
	1244	*
	1245	* @param type the name type (0-8, as specified in
	1246	* RFC 3280, section 4.2.1.7)
	1247	* @param name a byte array containing the name in ASN.1 DER encoded form
	1248	* @throws IOException if a parsing error occurs
	1249	*/
	1250	public void addPathToName(int type, byte [] name) throws IOException {
	1251	// clone because byte arrays are modifiable
	1252	addPathToNameInternal(type, name.clone());
	1253	}
	1254
	1255	/**
	1256	* A private method that adds a name (String or byte array) to the
	1257	* pathToNames criterion. The <code>X509Certificate</code> must contain
	1258	* the specified pathToName.
	1259	*
	1260	* @param type the name type (0-8, as specified in
	1261	* RFC 3280, section 4.2.1.7)
	1262	* @param name the name in string or byte array form
	1263	* @throws IOException if an encoding error occurs (incorrect form for DN)
	1264	*/
	1265	private void addPathToNameInternal(int type, Object name)
	1266	throws IOException {
	1267	// First, ensure that the name parses
	1268	GeneralNameInterface tempName = makeGeneralNameInterface(type, name);
	1269	if (pathToGeneralNames == null) {
	1270	pathToNames = new HashSet<List<?>>();
	1271	pathToGeneralNames = new HashSet<GeneralNameInterface>();
	1272	}
	1273	List<Object> list = new ArrayList<Object>(2);
	1274	list.add(Integer.valueOf(type));
	1275	list.add(name);
	1276	pathToNames.add(list);
	1277	pathToGeneralNames.add(tempName);
	1278	}
	1279
	1280	/**
	1281	* Returns the certificateEquals criterion. The specified
	1282	* <code>X509Certificate</code> must be equal to the
	1283	* <code>X509Certificate</code> passed to the <code>match</code> method.
	1284	* If <code>null</code>, this check is not applied.
	1285	*
	1286	* @return the <code>X509Certificate</code> to match (or <code>null</code>)
	1287	* @see #setCertificate
	1288	*/
	1289	public X509Certificate getCertificate() {
	1290	return x509Cert;
	1291	}
	1292
	1293	/**
	1294	* Returns the serialNumber criterion. The specified serial number
	1295	* must match the certificate serial number in the
	1296	* <code>X509Certificate</code>. If <code>null</code>, any certificate
	1297	* serial number will do.
	1298	*
	1299	* @return the certificate serial number to match
	1300	* (or <code>null</code>)
	1301	* @see #setSerialNumber
	1302	*/
	1303	public BigInteger getSerialNumber() {
	1304	return serialNumber;
	1305	}
	1306
	1307	/**
	1308	* Returns the issuer criterion as an <code>X500Principal</code>. This
	1309	* distinguished name must match the issuer distinguished name in the
	1310	* <code>X509Certificate</code>. If <code>null</code>, the issuer criterion
	1311	* is disabled and any issuer distinguished name will do.
	1312	*
	1313	* @return the required issuer distinguished name as X500Principal
	1314	* (or <code>null</code>)
	1315	* @since 1.5
	1316	*/
	1317	public X500Principal getIssuer() {
	1318	return issuer;
	1319	}
	1320
	1321	/**
	1322	* <strong>Denigrated</strong>, use {@linkplain #getIssuer()} or
	1323	* {@linkplain #getIssuerAsBytes()} instead. This method should not be
	1324	* relied on as it can fail to match some certificates because of a loss of
	1325	* encoding information in the RFC 2253 String form of some distinguished
	1326	* names.
	1327	* <p>
	1328	* Returns the issuer criterion as a <code>String</code>. This
	1329	* distinguished name must match the issuer distinguished name in the
	1330	* <code>X509Certificate</code>. If <code>null</code>, the issuer criterion
	1331	* is disabled and any issuer distinguished name will do.
	1332	* <p>
	1333	* If the value returned is not <code>null</code>, it is a
	1334	* distinguished name, in RFC 2253 format.
	1335	*
	1336	* @return the required issuer distinguished name in RFC 2253 format
	1337	* (or <code>null</code>)
	1338	*/
	1339	public String getIssuerAsString() {
	1340	return (issuer == null ? null : issuer.getName());
	1341	}
	1342
	1343	/**
	1344	* Returns the issuer criterion as a byte array. This distinguished name
	1345	* must match the issuer distinguished name in the
	1346	* <code>X509Certificate</code>. If <code>null</code>, the issuer criterion
	1347	* is disabled and any issuer distinguished name will do.
	1348	* <p>
	1349	* If the value returned is not <code>null</code>, it is a byte
	1350	* array containing a single DER encoded distinguished name, as defined in
	1351	* X.501. The ASN.1 notation for this structure is supplied in the
	1352	* documentation for
	1353	* {@link #setIssuer(byte [] issuerDN) setIssuer(byte [] issuerDN)}.
	1354	* <p>
	1355	* Note that the byte array returned is cloned to protect against
	1356	* subsequent modifications.
	1357	*
	1358	* @return a byte array containing the required issuer distinguished name
	1359	* in ASN.1 DER format (or <code>null</code>)
	1360	* @throws IOException if an encoding error occurs
	1361	*/
	1362	public byte[] getIssuerAsBytes() throws IOException {
	1363	return (issuer == null ? null: issuer.getEncoded());
	1364	}
	1365
	1366	/**
	1367	* Returns the subject criterion as an <code>X500Principal</code>. This
	1368	* distinguished name must match the subject distinguished name in the
	1369	* <code>X509Certificate</code>. If <code>null</code>, the subject criterion
	1370	* is disabled and any subject distinguished name will do.
	1371	*
	1372	* @return the required subject distinguished name as X500Principal
	1373	* (or <code>null</code>)
	1374	* @since 1.5
	1375	*/
	1376	public X500Principal getSubject() {
	1377	return subject;
	1378	}
	1379
	1380	/**
	1381	* <strong>Denigrated</strong>, use {@linkplain #getSubject()} or
	1382	* {@linkplain #getSubjectAsBytes()} instead. This method should not be
	1383	* relied on as it can fail to match some certificates because of a loss of
	1384	* encoding information in the RFC 2253 String form of some distinguished
	1385	* names.
	1386	* <p>
	1387	* Returns the subject criterion as a <code>String</code>. This
	1388	* distinguished name must match the subject distinguished name in the
	1389	* <code>X509Certificate</code>. If <code>null</code>, the subject criterion
	1390	* is disabled and any subject distinguished name will do.
	1391	* <p>
	1392	* If the value returned is not <code>null</code>, it is a
	1393	* distinguished name, in RFC 2253 format.
	1394	*
	1395	* @return the required subject distinguished name in RFC 2253 format
	1396	* (or <code>null</code>)
	1397	*/
	1398	public String getSubjectAsString() {
	1399	return (subject == null ? null : subject.getName());
	1400	}
	1401
	1402	/**
	1403	* Returns the subject criterion as a byte array. This distinguished name
	1404	* must match the subject distinguished name in the
	1405	* <code>X509Certificate</code>. If <code>null</code>, the subject criterion
	1406	* is disabled and any subject distinguished name will do.
	1407	* <p>
	1408	* If the value returned is not <code>null</code>, it is a byte
	1409	* array containing a single DER encoded distinguished name, as defined in
	1410	* X.501. The ASN.1 notation for this structure is supplied in the
	1411	* documentation for
	1412	* {@link #setSubject(byte [] subjectDN) setSubject(byte [] subjectDN)}.
	1413	* <p>
	1414	* Note that the byte array returned is cloned to protect against
	1415	* subsequent modifications.
	1416	*
	1417	* @return a byte array containing the required subject distinguished name
	1418	* in ASN.1 DER format (or <code>null</code>)
	1419	* @throws IOException if an encoding error occurs
	1420	*/
	1421	public byte[] getSubjectAsBytes() throws IOException {
	1422	return (subject == null ? null : subject.getEncoded());
	1423	}
	1424
	1425	/**
	1426	* Returns the subjectKeyIdentifier criterion. The
	1427	* <code>X509Certificate</code> must contain a SubjectKeyIdentifier
	1428	* extension with the specified value. If <code>null</code>, no
	1429	* subjectKeyIdentifier check will be done.
	1430	* <p>
	1431	* Note that the byte array returned is cloned to protect against
	1432	* subsequent modifications.
	1433	*
	1434	* @return the key identifier (or <code>null</code>)
	1435	* @see #setSubjectKeyIdentifier
	1436	*/
	1437	public byte[] getSubjectKeyIdentifier() {
	1438	if (subjectKeyID == null) {
	1439	return null;
	1440	}
	1441	return subjectKeyID.clone();
	1442	}
	1443
	1444	/**
	1445	* Returns the authorityKeyIdentifier criterion. The
	1446	* <code>X509Certificate</code> must contain a AuthorityKeyIdentifier
	1447	* extension with the specified value. If <code>null</code>, no
	1448	* authorityKeyIdentifier check will be done.
	1449	* <p>
	1450	* Note that the byte array returned is cloned to protect against
	1451	* subsequent modifications.
	1452	*
	1453	* @return the key identifier (or <code>null</code>)
	1454	* @see #setAuthorityKeyIdentifier
	1455	*/
	1456	public byte[] getAuthorityKeyIdentifier() {
	1457	if (authorityKeyID == null) {
	1458	return null;
	1459	}
	1460	return authorityKeyID.clone();
	1461	}
	1462
	1463	/**
	1464	* Returns the certificateValid criterion. The specified date must fall
	1465	* within the certificate validity period for the
	1466	* <code>X509Certificate</code>. If <code>null</code>, no certificateValid
	1467	* check will be done.
	1468	* <p>
	1469	* Note that the <code>Date</code> returned is cloned to protect against
	1470	* subsequent modifications.
	1471	*
	1472	* @return the <code>Date</code> to check (or <code>null</code>)
	1473	* @see #setCertificateValid
	1474	*/
	1475	public Date getCertificateValid() {
	1476	if (certificateValid == null) {
	1477	return null;
	1478	}
	1479	return (Date)certificateValid.clone();
	1480	}
	1481
	1482	/**
	1483	* Returns the privateKeyValid criterion. The specified date must fall
	1484	* within the private key validity period for the
	1485	* <code>X509Certificate</code>. If <code>null</code>, no privateKeyValid
	1486	* check will be done.
	1487	* <p>
	1488	* Note that the <code>Date</code> returned is cloned to protect against
	1489	* subsequent modifications.
	1490	*
	1491	* @return the <code>Date</code> to check (or <code>null</code>)
	1492	* @see #setPrivateKeyValid
	1493	*/
	1494	public Date getPrivateKeyValid() {
	1495	if (privateKeyValid == null) {
	1496	return null;
	1497	}
	1498	return (Date)privateKeyValid.clone();
	1499	}
	1500
	1501	/**
	1502	* Returns the subjectPublicKeyAlgID criterion. The
	1503	* <code>X509Certificate</code> must contain a subject public key
	1504	* with the specified algorithm. If <code>null</code>, no
	1505	* subjectPublicKeyAlgID check will be done.
	1506	*
	1507	* @return the object identifier (OID) of the signature algorithm to check
	1508	* for (or <code>null</code>). An OID is represented by a set of
	1509	* nonnegative integers separated by periods.
	1510	* @see #setSubjectPublicKeyAlgID
	1511	*/
	1512	public String getSubjectPublicKeyAlgID() {
	1513	if (subjectPublicKeyAlgID == null) {
	1514	return null;
	1515	}
	1516	return subjectPublicKeyAlgID.toString();
	1517	}
	1518
	1519	/**
	1520	* Returns the subjectPublicKey criterion. The
	1521	* <code>X509Certificate</code> must contain the specified subject
	1522	* public key. If <code>null</code>, no subjectPublicKey check will be done.
	1523	*
	1524	* @return the subject public key to check for (or <code>null</code>)
	1525	* @see #setSubjectPublicKey
	1526	*/
	1527	public PublicKey getSubjectPublicKey() {
	1528	return subjectPublicKey;
	1529	}
	1530
	1531	/**
	1532	* Returns the keyUsage criterion. The <code>X509Certificate</code>
	1533	* must allow the specified keyUsage values. If null, no keyUsage
	1534	* check will be done.
	1535	* <p>
	1536	* Note that the boolean array returned is cloned to protect against
	1537	* subsequent modifications.
	1538	*
	1539	* @return a boolean array in the same format as the boolean
	1540	* array returned by
	1541	* {@link X509Certificate#getKeyUsage() X509Certificate.getKeyUsage()}.
	1542	* Or <code>null</code>.
	1543	* @see #setKeyUsage
	1544	*/
	1545	public boolean[] getKeyUsage() {
	1546	if (keyUsage == null) {
	1547	return null;
	1548	}
	1549	return keyUsage.clone();
	1550	}
	1551
	1552	/**
	1553	* Returns the extendedKeyUsage criterion. The <code>X509Certificate</code>
	1554	* must allow the specified key purposes in its extended key usage
	1555	* extension. If the <code>keyPurposeSet</code> returned is empty or
	1556	* <code>null</code>, no extendedKeyUsage check will be done. Note that an
	1557	* <code>X509Certificate</code> that has no extendedKeyUsage extension
	1558	* implicitly allows all key purposes.
	1559	*
	1560	* @return an immutable <code>Set</code> of key purpose OIDs in string
	1561	* format (or <code>null</code>)
	1562	* @see #setExtendedKeyUsage
	1563	*/
	1564	public Set<String> getExtendedKeyUsage() {
	1565	return keyPurposeSet;
	1566	}
	1567
	1568	/**
	1569	* Indicates if the <code>X509Certificate</code> must contain all
	1570	* or at least one of the subjectAlternativeNames
	1571	* specified in the {@link #setSubjectAlternativeNames
	1572	* setSubjectAlternativeNames} or {@link #addSubjectAlternativeName
	1573	* addSubjectAlternativeName} methods. If <code>true</code>,
	1574	* the <code>X509Certificate</code> must contain all of the
	1575	* specified subject alternative names. If <code>false</code>, the
	1576	* <code>X509Certificate</code> must contain at least one of the
	1577	* specified subject alternative names.
	1578	*
	1579	* @return <code>true</code> if the flag is enabled;
	1580	* <code>false</code> if the flag is disabled. The flag is
	1581	* <code>true</code> by default.
	1582	* @see #setMatchAllSubjectAltNames
	1583	*/
	1584	public boolean getMatchAllSubjectAltNames() {
	1585	return matchAllSubjectAltNames;
	1586	}
	1587
	1588	/**
	1589	* Returns a copy of the subjectAlternativeNames criterion.
	1590	* The <code>X509Certificate</code> must contain all or at least one
	1591	* of the specified subjectAlternativeNames, depending on the value
	1592	* of the matchAllNames flag (see {@link #getMatchAllSubjectAltNames
	1593	* getMatchAllSubjectAltNames}). If the value returned is
	1594	* <code>null</code>, no subjectAlternativeNames check will be performed.
	1595	* <p>
	1596	* If the value returned is not <code>null</code>, it is a
	1597	* <code>Collection</code> with
	1598	* one entry for each name to be included in the subject alternative name
	1599	* criterion. Each entry is a <code>List</code> whose first entry is an
	1600	* <code>Integer</code> (the name type, 0-8) and whose second
	1601	* entry is a <code>String</code> or a byte array (the name, in
	1602	* string or ASN.1 DER encoded form, respectively).
	1603	* There can be multiple names of the same type. Note that the
	1604	* <code>Collection</code> returned may contain duplicate names (same name
	1605	* and name type).
	1606	* <p>
	1607	* Each subject alternative name in the <code>Collection</code>
	1608	* may be specified either as a <code>String</code> or as an ASN.1 encoded
	1609	* byte array. For more details about the formats used, see
	1610	* {@link #addSubjectAlternativeName(int type, String name)
	1611	* addSubjectAlternativeName(int type, String name)} and
	1612	* {@link #addSubjectAlternativeName(int type, byte [] name)
	1613	* addSubjectAlternativeName(int type, byte [] name)}.
	1614	* <p>
	1615	* Note that a deep copy is performed on the <code>Collection</code> to
	1616	* protect against subsequent modifications.
	1617	*
	1618	* @return a <code>Collection</code> of names (or <code>null</code>)
	1619	* @see #setSubjectAlternativeNames
	1620	*/
	1621	public Collection<List<?>> getSubjectAlternativeNames() {
	1622	if (subjectAlternativeNames == null) {
	1623	return null;
	1624	}
	1625	return cloneNames(subjectAlternativeNames);
	1626	}
	1627
	1628	/**
	1629	* Clone an object of the form passed to
	1630	* setSubjectAlternativeNames and setPathToNames.
	1631	* Throw a <code>RuntimeException</code> if the argument is malformed.
	1632	* <p>
	1633	* This method wraps cloneAndCheckNames, changing any
	1634	* <code>IOException</code> into a <code>RuntimeException</code>. This
	1635	* method should be used when the object being
	1636	* cloned has already been checked, so there should never be any exceptions.
	1637	*
	1638	* @param names a <code>Collection</code> with one entry per name.
	1639	* Each entry is a <code>List</code> whose first entry
	1640	* is an Integer (the name type, 0-8) and whose second
	1641	* entry is a String or a byte array (the name, in
	1642	* string or ASN.1 DER encoded form, respectively).
	1643	* There can be multiple names of the same type. Null
	1644	* is not an acceptable value.
	1645	* @return a deep copy of the specified <code>Collection</code>
	1646	* @throws RuntimeException if a parsing error occurs
	1647	*/
	1648	private static Set<List<?>> cloneNames(Collection<List<?>> names) {
	1649	try {
	1650	return cloneAndCheckNames(names);
	1651	} catch (IOException e) {
	1652	throw new RuntimeException("cloneNames encountered IOException: " +
	1653	e.getMessage());
	1654	}
	1655	}
	1656
	1657	/**
	1658	* Clone and check an argument of the form passed to
	1659	* setSubjectAlternativeNames and setPathToNames.
	1660	* Throw an <code>IOException</code> if the argument is malformed.
	1661	*
	1662	* @param names a <code>Collection</code> with one entry per name.
	1663	* Each entry is a <code>List</code> whose first entry
	1664	* is an Integer (the name type, 0-8) and whose second
	1665	* entry is a String or a byte array (the name, in
	1666	* string or ASN.1 DER encoded form, respectively).
	1667	* There can be multiple names of the same type.
	1668	* <code>null</code> is not an acceptable value.
	1669	* @return a deep copy of the specified <code>Collection</code>
	1670	* @throws IOException if a parsing error occurs
	1671	*/
	1672	private static Set<List<?>> cloneAndCheckNames(Collection<List<?>> names) throws IOException {
	1673	// Copy the Lists and Collection
	1674	Set<List<?>> namesCopy = new HashSet<List<?>>();
	1675	Iterator<List<?>> i = names.iterator();
	1676	while (i.hasNext()) {
	1677	Object o = i.next();
	1678	if (!(o instanceof List)) {
	1679	throw new IOException("expected a List");
	1680	}
	1681	namesCopy.add(new ArrayList<Object>((List<?>)o));
	1682	}
	1683
	1684	// Check the contents of the Lists and clone any byte arrays
	1685	i = namesCopy.iterator();
	1686	while (i.hasNext()) {
	1687	List<Object> nameList = (List<Object>)i.next();
	1688	if (nameList.size() != 2) {
	1689	throw new IOException("name list size not 2");
	1690	}
	1691	Object o = nameList.get(0);
	1692	if (!(o instanceof Integer)) {
	1693	throw new IOException("expected an Integer");
	1694	}
	1695	int nameType = ((Integer)o).intValue();
	1696	if ((nameType < 0) \|\| (nameType > 8)) {
	1697	throw new IOException("name type not 0-8");
	1698	}
	1699	Object nameObject = nameList.get(1);
	1700	if (!(nameObject instanceof byte[]) &&
	1701	!(nameObject instanceof String)) {
	1702	if (debug != null) {
	1703	debug.println("X509CertSelector.cloneAndCheckNames() "
	1704	+ "name not byte array");
	1705	}
	1706	throw new IOException("name not byte array or String");
	1707	}
	1708	if (nameObject instanceof byte[]) {
	1709	nameList.set(1, ((byte[]) nameObject).clone());
	1710	}
	1711	}
	1712	return namesCopy;
	1713	}
	1714
	1715	/**
	1716	* Returns the name constraints criterion. The <code>X509Certificate</code>
	1717	* must have subject and subject alternative names that
	1718	* meet the specified name constraints.
	1719	* <p>
	1720	* The name constraints are returned as a byte array. This byte array
	1721	* contains the DER encoded form of the name constraints, as they
	1722	* would appear in the NameConstraints structure defined in RFC 3280
	1723	* and X.509. The ASN.1 notation for this structure is supplied in the
	1724	* documentation for
	1725	* {@link #setNameConstraints(byte [] bytes) setNameConstraints(byte [] bytes)}.
	1726	* <p>
	1727	* Note that the byte array returned is cloned to protect against
	1728	* subsequent modifications.
	1729	*
	1730	* @return a byte array containing the ASN.1 DER encoding of
	1731	* a NameConstraints extension used for checking name constraints.
	1732	* <code>null</code> if no name constraints check will be performed.
	1733	* @see #setNameConstraints
	1734	*/
	1735	public byte[] getNameConstraints() {
	1736	if (ncBytes == null) {
	1737	return null;
	1738	} else {
	1739	return ncBytes.clone();
	1740	}
	1741	}
	1742
	1743	/**
	1744	* Returns the basic constraints constraint. If the value is greater than
	1745	* or equal to zero, the <code>X509Certificates</code> must include a
	1746	* basicConstraints extension with a pathLen of at least this value.
	1747	* If the value is -2, only end-entity certificates are accepted. If
	1748	* the value is -1, no basicConstraints check is done.
	1749	*
	1750	* @return the value for the basic constraints constraint
	1751	* @see #setBasicConstraints
	1752	*/
	1753	public int getBasicConstraints() {
	1754	return basicConstraints;
	1755	}
	1756
	1757	/**
	1758	* Returns the policy criterion. The <code>X509Certificate</code> must
	1759	* include at least one of the specified policies in its certificate policies
	1760	* extension. If the <code>Set</code> returned is empty, then the
	1761	* <code>X509Certificate</code> must include at least some specified policy
	1762	* in its certificate policies extension. If the <code>Set</code> returned is
	1763	* <code>null</code>, no policy check will be performed.
	1764	*
	1765	* @return an immutable <code>Set</code> of certificate policy OIDs in
	1766	* string format (or <code>null</code>)
	1767	* @see #setPolicy
	1768	*/
	1769	public Set<String> getPolicy() {
	1770	return policySet;
	1771	}
	1772
	1773	/**
	1774	* Returns a copy of the pathToNames criterion. The
	1775	* <code>X509Certificate</code> must not include name constraints that would
	1776	* prohibit building a path to the specified names. If the value
	1777	* returned is <code>null</code>, no pathToNames check will be performed.
	1778	* <p>
	1779	* If the value returned is not <code>null</code>, it is a
	1780	* <code>Collection</code> with one
	1781	* entry for each name to be included in the pathToNames
	1782	* criterion. Each entry is a <code>List</code> whose first entry is an
	1783	* <code>Integer</code> (the name type, 0-8) and whose second
	1784	* entry is a <code>String</code> or a byte array (the name, in
	1785	* string or ASN.1 DER encoded form, respectively).
	1786	* There can be multiple names of the same type. Note that the
	1787	* <code>Collection</code> returned may contain duplicate names (same
	1788	* name and name type).
	1789	* <p>
	1790	* Each name in the <code>Collection</code>
	1791	* may be specified either as a <code>String</code> or as an ASN.1 encoded
	1792	* byte array. For more details about the formats used, see
	1793	* {@link #addPathToName(int type, String name)
	1794	* addPathToName(int type, String name)} and
	1795	* {@link #addPathToName(int type, byte [] name)
	1796	* addPathToName(int type, byte [] name)}.
	1797	* <p>
	1798	* Note that a deep copy is performed on the <code>Collection</code> to
	1799	* protect against subsequent modifications.
	1800	*
	1801	* @return a <code>Collection</code> of names (or <code>null</code>)
	1802	* @see #setPathToNames
	1803	*/
	1804	public Collection<List<?>> getPathToNames() {
	1805	if (pathToNames == null) {
	1806	return null;
	1807	}
	1808	return cloneNames(pathToNames);
	1809	}
	1810
	1811	/**
	1812	* Return a printable representation of the <code>CertSelector</code>.
	1813	*
	1814	* @return a <code>String</code> describing the contents of the
	1815	* <code>CertSelector</code>
	1816	*/
	1817	public String toString() {
	1818	StringBuffer sb = new StringBuffer();
	1819	sb.append("X509CertSelector: [\n");
	1820	if (x509Cert != null) {
	1821	sb.append(" Certificate: " + x509Cert.toString() + "\n");
	1822	}
	1823	if (serialNumber != null) {
	1824	sb.append(" Serial Number: " + serialNumber.toString() + "\n");
	1825	}
	1826	if (issuer != null) {
	1827	sb.append(" Issuer: " + getIssuerAsString() + "\n");
	1828	}
	1829	if (subject != null) {
	1830	sb.append(" Subject: " + getSubjectAsString() + "\n");
	1831	}
	1832	sb.append(" matchAllSubjectAltNames flag: "
	1833	+ String.valueOf(matchAllSubjectAltNames) + "\n");
	1834	if (subjectAlternativeNames != null) {
	1835	sb.append(" SubjectAlternativeNames:\n");
	1836	Iterator<List<?>> i = subjectAlternativeNames.iterator();
	1837	while (i.hasNext()) {
	1838	List<?> list = i.next();
	1839	sb.append(" type " + list.get(0) +
	1840	", name " + list.get(1) + "\n");
	1841	}
	1842	}
	1843	if (subjectKeyID != null) {
	1844	HexDumpEncoder enc = new HexDumpEncoder();
	1845	sb.append(" Subject Key Identifier: " +
	1846	enc.encodeBuffer(subjectKeyID) + "\n");
	1847	}
	1848	if (authorityKeyID != null) {
	1849	HexDumpEncoder enc = new HexDumpEncoder();
	1850	sb.append(" Authority Key Identifier: " +
	1851	enc.encodeBuffer(authorityKeyID) + "\n");
	1852	}
	1853	if (certificateValid != null) {
	1854	sb.append(" Certificate Valid: " +
	1855	certificateValid.toString() + "\n");
	1856	}
	1857	if (privateKeyValid != null) {
	1858	sb.append(" Private Key Valid: " +
	1859	privateKeyValid.toString() + "\n");
	1860	}
	1861	if (subjectPublicKeyAlgID != null) {
	1862	sb.append(" Subject Public Key AlgID: " +
	1863	subjectPublicKeyAlgID.toString() + "\n");
	1864	}
	1865	if (subjectPublicKey != null) {
	1866	sb.append(" Subject Public Key: " +
	1867	subjectPublicKey.toString() + "\n");
	1868	}
	1869	if (keyUsage != null) {
	1870	sb.append(" Key Usage: " + keyUsageToString(keyUsage) + "\n");
	1871	}
	1872	if (keyPurposeSet != null) {
	1873	sb.append(" Extended Key Usage: " +
	1874	keyPurposeSet.toString() + "\n");
	1875	}
	1876	if (policy != null) {
	1877	sb.append(" Policy: " + policy.toString() + "\n");
	1878	}
	1879	if (pathToGeneralNames != null) {
	1880	sb.append(" Path to names:\n");
	1881	Iterator<GeneralNameInterface> i = pathToGeneralNames.iterator();
	1882	while (i.hasNext()) {
	1883	sb.append(" " + i.next() + "\n");
	1884	}
	1885	}
	1886	sb.append("]");
	1887	return sb.toString();
	1888	}
	1889
	1890	// Copied from sun.security.x509.KeyUsageExtension
	1891	// (without calling the superclass)
	1892	/**
	1893	* Returns a printable representation of the KeyUsage.
	1894	*/
	1895	private static String keyUsageToString(boolean[] k) {
	1896	String s = "KeyUsage [\n";
	1897	try {
	1898	if (k[0]) {
	1899	s += " DigitalSignature\n";
	1900	}
	1901	if (k[1]) {
	1902	s += " Non_repudiation\n";
	1903	}
	1904	if (k[2]) {
	1905	s += " Key_Encipherment\n";
	1906	}
	1907	if (k[3]) {
	1908	s += " Data_Encipherment\n";
	1909	}
	1910	if (k[4]) {
	1911	s += " Key_Agreement\n";
	1912	}
	1913	if (k[5]) {
	1914	s += " Key_CertSign\n";
	1915	}
	1916	if (k[6]) {
	1917	s += " Crl_Sign\n";
	1918	}
	1919	if (k[7]) {
	1920	s += " Encipher_Only\n";
	1921	}
	1922	if (k[8]) {
	1923	s += " Decipher_Only\n";
	1924	}
	1925	} catch (ArrayIndexOutOfBoundsException ex) {}
	1926
	1927	s += "]\n";
	1928
	1929	return (s);
	1930	}
	1931
	1932	/**
	1933	* Returns an Extension object given any X509Certificate and extension oid.
	1934	* Throw an <code>IOException</code> if the extension byte value is
	1935	* malformed.
	1936	*
	1937	* @param cert a <code>X509Certificate</code>
	1938	* @param extId an <code>integer</code> which specifies the extension index.
	1939	* Currently, the supported extensions are as follows:
	1940	* index 0 - PrivateKeyUsageExtension
	1941	* index 1 - SubjectAlternativeNameExtension
	1942	* index 2 - NameConstraintsExtension
	1943	* index 3 - CertificatePoliciesExtension
	1944	* index 4 - ExtendedKeyUsageExtension
	1945	* @return an <code>Extension</code> object whose real type is as specified
	1946	* by the extension oid.
	1947	* @throws IOException if cannot construct the <code>Extension</code>
	1948	* object with the extension encoding retrieved from the passed in
	1949	* <code>X509Certificate</code>.
	1950	*/
	1951	private static Extension getExtensionObject(X509Certificate cert, int extId)
	1952	throws IOException {
	1953	if (cert instanceof X509CertImpl) {
	1954	X509CertImpl impl = (X509CertImpl)cert;
	1955	switch (extId) {
	1956	case PRIVATE_KEY_USAGE_ID:
	1957	return impl.getPrivateKeyUsageExtension();
	1958	case SUBJECT_ALT_NAME_ID:
	1959	return impl.getSubjectAlternativeNameExtension();
	1960	case NAME_CONSTRAINTS_ID:
	1961	return impl.getNameConstraintsExtension();
	1962	case CERT_POLICIES_ID:
	1963	return impl.getCertificatePoliciesExtension();
	1964	case EXTENDED_KEY_USAGE_ID:
	1965	return impl.getExtendedKeyUsageExtension();
	1966	default:
	1967	return null;
	1968	}
	1969	}
	1970	byte[] rawExtVal = cert.getExtensionValue(EXTENSION_OIDS[extId]);
	1971	if (rawExtVal == null) {
	1972	return null;
	1973	}
	1974	DerInputStream in = new DerInputStream(rawExtVal);
	1975	byte[] encoded = in.getOctetString();
	1976	switch (extId) {
	1977	case PRIVATE_KEY_USAGE_ID:
	1978	try {
	1979	return new PrivateKeyUsageExtension(FALSE, encoded);
	1980	} catch (CertificateException ex) {
	1981	throw new IOException(ex.getMessage());
	1982	}
	1983	case SUBJECT_ALT_NAME_ID:
	1984	return new SubjectAlternativeNameExtension(FALSE, encoded);
	1985	case NAME_CONSTRAINTS_ID:
	1986	return new NameConstraintsExtension(FALSE, encoded);
	1987	case CERT_POLICIES_ID:
	1988	return new CertificatePoliciesExtension(FALSE, encoded);
	1989	case EXTENDED_KEY_USAGE_ID:
	1990	return new ExtendedKeyUsageExtension(FALSE, encoded);
	1991	default:
	1992	return null;
	1993	}
	1994	}
	1995
	1996	/**
	1997	* Decides whether a <code>Certificate</code> should be selected.
	1998	*
	1999	* @param cert the <code>Certificate</code> to be checked
	2000	* @return <code>true</code> if the <code>Certificate</code> should be
	2001	* selected, <code>false</code> otherwise
	2002	*/
	2003	public boolean match(Certificate cert) {
	2004	if (!(cert instanceof X509Certificate)) {
	2005	return false;
	2006	}
	2007	X509Certificate xcert = (X509Certificate)cert;
	2008
	2009	if (debug != null) {
	2010	debug.println("X509CertSelector.match(SN: "
	2011	+ (xcert.getSerialNumber()).toString(16) + "\n Issuer: "
	2012	+ xcert.getIssuerDN() + "\n Subject: " + xcert.getSubjectDN()
	2013	+ ")");
	2014	}
	2015
	2016	/* match on X509Certificate */
	2017	if (x509Cert != null) {
	2018	if (!x509Cert.equals(xcert)) {
	2019	if (debug != null) {
	2020	debug.println("X509CertSelector.match: "
	2021	+ "certs don't match");
	2022	}
	2023	return false;
	2024	}
	2025	}
	2026
	2027	/* match on serial number */
	2028	if (serialNumber != null) {
	2029	if (!serialNumber.equals(xcert.getSerialNumber())) {
	2030	if (debug != null) {
	2031	debug.println("X509CertSelector.match: "
	2032	+ "serial numbers don't match");
	2033	}
	2034	return false;
	2035	}
	2036	}
	2037
	2038	/* match on issuer name */
	2039	if (issuer != null) {
	2040	if (!issuer.equals(xcert.getIssuerX500Principal())) {
	2041	if (debug != null) {
	2042	debug.println("X509CertSelector.match: "
	2043	+ "issuer DNs don't match");
	2044	}
	2045	return false;
	2046	}
	2047	}
	2048
	2049	/* match on subject name */
	2050	if (subject != null) {
	2051	if (!subject.equals(xcert.getSubjectX500Principal())) {
	2052	if (debug != null) {
	2053	debug.println("X509CertSelector.match: "
	2054	+ "subject DNs don't match");
	2055	}
	2056	return false;
	2057	}
	2058	}
	2059
	2060	/* match on certificate validity range */
	2061	if (certificateValid != null) {
	2062	try {
	2063	xcert.checkValidity(certificateValid);
	2064	} catch (CertificateException e) {
	2065	if (debug != null) {
	2066	debug.println("X509CertSelector.match: "
	2067	+ "certificate not within validity period");
	2068	}
	2069	return false;
	2070	}
	2071	}
	2072
	2073	/* match on subject public key */
	2074	if (subjectPublicKeyBytes != null) {
	2075	byte[] certKey = xcert.getPublicKey().getEncoded();
	2076	if (!Arrays.equals(subjectPublicKeyBytes, certKey)) {
	2077	if (debug != null) {
	2078	debug.println("X509CertSelector.match: "
	2079	+ "subject public keys don't match");
	2080	}
	2081	return false;
	2082	}
	2083	}
	2084
	2085	boolean result = matchBasicConstraints(xcert)
	2086	&& matchKeyUsage(xcert)
	2087	&& matchExtendedKeyUsage(xcert)
	2088	&& matchSubjectKeyID(xcert)
	2089	&& matchAuthorityKeyID(xcert)
	2090	&& matchPrivateKeyValid(xcert)
	2091	&& matchSubjectPublicKeyAlgID(xcert)
	2092	&& matchPolicy(xcert)
	2093	&& matchSubjectAlternativeNames(xcert)
	2094	&& matchPathToNames(xcert)
	2095	&& matchNameConstraints(xcert);
	2096
	2097	if (result && (debug != null)) {
	2098	debug.println("X509CertSelector.match returning: true");
	2099	}
	2100	return result;
	2101	}
	2102
	2103	/* match on subject key identifier extension value */
	2104	private boolean matchSubjectKeyID(X509Certificate xcert) {
	2105	if (subjectKeyID == null) {
	2106	return true;
	2107	}
	2108	try {
	2109	byte[] extVal = xcert.getExtensionValue("2.5.29.14");
	2110	if (extVal == null) {
	2111	if (debug != null) {
	2112	debug.println("X509CertSelector.match: "
	2113	+ "no subject key ID extension");
	2114	}
	2115	return false;
	2116	}
	2117	DerInputStream in = new DerInputStream(extVal);
	2118	byte[] certSubjectKeyID = in.getOctetString();
	2119	if (certSubjectKeyID == null \|\|
	2120	!Arrays.equals(subjectKeyID, certSubjectKeyID)) {
	2121	if (debug != null) {
	2122	debug.println("X509CertSelector.match: "
	2123	+ "subject key IDs don't match");
	2124	}
	2125	return false;
	2126	}
	2127	} catch (IOException ex) {
	2128	if (debug != null) {
	2129	debug.println("X509CertSelector.match: "
	2130	+ "exception in subject key ID check");
	2131	}
	2132	return false;
	2133	}
	2134	return true;
	2135	}
	2136
	2137	/* match on authority key identifier extension value */
	2138	private boolean matchAuthorityKeyID(X509Certificate xcert) {
	2139	if (authorityKeyID == null) {
	2140	return true;
	2141	}
	2142	try {
	2143	byte[] extVal = xcert.getExtensionValue("2.5.29.35");
	2144	if (extVal == null) {
	2145	if (debug != null) {
	2146	debug.println("X509CertSelector.match: "
	2147	+ "no authority key ID extension");
	2148	}
	2149	return false;
	2150	}
	2151	DerInputStream in = new DerInputStream(extVal);
	2152	byte[] certAuthKeyID = in.getOctetString();
	2153	if (certAuthKeyID == null \|\|
	2154	!Arrays.equals(authorityKeyID, certAuthKeyID)) {
	2155	if (debug != null) {
	2156	debug.println("X509CertSelector.match: "
	2157	+ "authority key IDs don't match");
	2158	}
	2159	return false;
	2160	}
	2161	} catch (IOException ex) {
	2162	if (debug != null) {
	2163	debug.println("X509CertSelector.match: "
	2164	+ "exception in authority key ID check");
	2165	}
	2166	return false;
	2167	}
	2168	return true;
	2169	}
	2170
	2171	/* match on private key usage range */
	2172	private boolean matchPrivateKeyValid(X509Certificate xcert) {
	2173	if (privateKeyValid == null) {
	2174	return true;
	2175	}
	2176	PrivateKeyUsageExtension ext = null;
	2177	try {
	2178	ext = (PrivateKeyUsageExtension)
	2179	getExtensionObject(xcert, PRIVATE_KEY_USAGE_ID);
	2180	if (ext != null) {
	2181	ext.valid(privateKeyValid);
	2182	}
	2183	} catch (CertificateExpiredException e1) {
	2184	if (debug != null) {
	2185	String time = "n/a";
	2186	try {
	2187	Date notAfter =
	2188	(Date)ext.get(PrivateKeyUsageExtension.NOT_AFTER);
	2189	time = notAfter.toString();
	2190	} catch (CertificateException ex) {
	2191	// not able to retrieve notAfter value
	2192	}
	2193	debug.println("X509CertSelector.match: private key usage not "
	2194	+ "within validity date; ext.NOT_After: "
	2195	+ time + "; X509CertSelector: "
	2196	+ this.toString());
	2197	e1.printStackTrace();
	2198	}
	2199	return false;
	2200	} catch (CertificateNotYetValidException e2) {
	2201	if (debug != null) {
	2202	String time = "n/a";
	2203	try {
	2204	Date notBefore = (Date)
	2205	ext.get(PrivateKeyUsageExtension.NOT_BEFORE);
	2206	time = notBefore.toString();
	2207	} catch (CertificateException ex) {
	2208	// not able to retrieve notBefore value
	2209	}
	2210	debug.println("X509CertSelector.match: private key usage not "
	2211	+ "within validity date; ext.NOT_BEFORE: "
	2212	+ time + "; X509CertSelector: "
	2213	+ this.toString());
	2214	e2.printStackTrace();
	2215	}
	2216	return false;
	2217	} catch (CertificateException e3) {
	2218	if (debug != null) {
	2219	debug.println("X509CertSelector.match: CertificateException "
	2220	+ "in private key usage check; X509CertSelector: "
	2221	+ this.toString());
	2222	e3.printStackTrace();
	2223	}
	2224	return false;
	2225	} catch (IOException e4) {
	2226	if (debug != null) {
	2227	debug.println("X509CertSelector.match: IOException in "
	2228	+ "private key usage check; X509CertSelector: "
	2229	+ this.toString());
	2230	e4.printStackTrace();
	2231	}
	2232	return false;
	2233	}
	2234	return true;
	2235	}
	2236
	2237	/* match on subject public key algorithm OID */
	2238	private boolean matchSubjectPublicKeyAlgID(X509Certificate xcert) {
	2239	if (subjectPublicKeyAlgID == null) {
	2240	return true;
	2241	}
	2242	try {
	2243	byte[] encodedKey = xcert.getPublicKey().getEncoded();
	2244	DerValue val = new DerValue(encodedKey);
	2245	if (val.tag != DerValue.tag_Sequence) {
	2246	throw new IOException("invalid key format");
	2247	}
	2248
	2249	AlgorithmId algID = AlgorithmId.parse(val.data.getDerValue());
	2250	if (debug != null) {
	2251	debug.println("X509CertSelector.match: subjectPublicKeyAlgID = "
	2252	+ subjectPublicKeyAlgID + ", xcert subjectPublicKeyAlgID = "
	2253	+ algID.getOID());
	2254	}
	2255	if (!subjectPublicKeyAlgID.equals(algID.getOID())) {
	2256	if (debug != null) {
	2257	debug.println("X509CertSelector.match: "
	2258	+ "subject public key alg IDs don't match");
	2259	}
	2260	return false;
	2261	}
	2262	} catch (IOException e5) {
	2263	if (debug != null) {
	2264	debug.println("X509CertSelector.match: IOException in subject "
	2265	+ "public key algorithm OID check");
	2266	}
	2267	return false;
	2268	}
	2269	return true;
	2270	}
	2271
	2272	/* match on key usage extension value */
	2273	private boolean matchKeyUsage(X509Certificate xcert) {
	2274	if (keyUsage == null) {
	2275	return true;
	2276	}
	2277	boolean[] certKeyUsage = xcert.getKeyUsage();
	2278	if (certKeyUsage != null) {
	2279	for (int keyBit = 0; keyBit < keyUsage.length; keyBit++) {
	2280	if (keyUsage[keyBit] &&
	2281	((keyBit >= certKeyUsage.length) \|\| !certKeyUsage[keyBit])) {
	2282	if (debug != null) {
	2283	debug.println("X509CertSelector.match: "
	2284	+ "key usage bits don't match");
	2285	}
	2286	return false;
	2287	}
	2288	}
	2289	}
	2290	return true;
	2291	}
	2292
	2293	/* match on extended key usage purpose OIDs */
	2294	private boolean matchExtendedKeyUsage(X509Certificate xcert) {
	2295	if ((keyPurposeSet == null) \|\| keyPurposeSet.isEmpty()) {
	2296	return true;
	2297	}
	2298	try {
	2299	ExtendedKeyUsageExtension ext =
	2300	(ExtendedKeyUsageExtension)getExtensionObject(xcert,
	2301	EXTENDED_KEY_USAGE_ID);
	2302	if (ext != null) {
	2303	Vector<ObjectIdentifier> certKeyPurposeVector =
	2304	(Vector<ObjectIdentifier>)ext.get(ExtendedKeyUsageExtension.USAGES);
	2305	if (!certKeyPurposeVector.contains(ANY_EXTENDED_KEY_USAGE)
	2306	&& !certKeyPurposeVector.containsAll(keyPurposeOIDSet)) {
	2307	if (debug != null) {
	2308	debug.println("X509CertSelector.match: cert failed "
	2309	+ "extendedKeyUsage criterion");
	2310	}
	2311	return false;
	2312	}
	2313	}
	2314	} catch (IOException ex) {
	2315	if (debug != null) {
	2316	debug.println("X509CertSelector.match: "
	2317	+ "IOException in extended key usage check");
	2318	}
	2319	return false;
	2320	}
	2321	return true;
	2322	}
	2323
	2324	/* match on subject alternative name extension names */
	2325	private boolean matchSubjectAlternativeNames(X509Certificate xcert) {
	2326	if ((subjectAlternativeNames == null) \|\| subjectAlternativeNames.isEmpty()) {
	2327	return true;
	2328	}
	2329	try {
	2330	SubjectAlternativeNameExtension sanExt =
	2331	(SubjectAlternativeNameExtension) getExtensionObject(xcert,
	2332	SUBJECT_ALT_NAME_ID);
	2333	if (sanExt == null) {
	2334	if (debug != null) {
	2335	debug.println("X509CertSelector.match: "
	2336	+ "no subject alternative name extension");
	2337	}
	2338	return false;
	2339	}
	2340	GeneralNames certNames = (GeneralNames)
	2341	sanExt.get(SubjectAlternativeNameExtension.SUBJECT_NAME);
	2342	Iterator<GeneralNameInterface> i =
	2343	subjectAlternativeGeneralNames.iterator();
	2344	while (i.hasNext()) {
	2345	GeneralNameInterface matchName = i.next();
	2346	boolean found = false;
	2347	for (Iterator<GeneralName> t = certNames.iterator();
	2348	t.hasNext() && !found; ) {
	2349	GeneralNameInterface certName = (t.next()).getName();
	2350	found = certName.equals(matchName);
	2351	}
	2352	if (!found && (matchAllSubjectAltNames \|\| !i.hasNext())) {
	2353	if (debug != null) {
	2354	debug.println("X509CertSelector.match: subject alternative "
	2355	+ "name " + matchName + " not found");
	2356	}
	2357	return false;
	2358	} else if (found && !matchAllSubjectAltNames) {
	2359	break;
	2360	}
	2361	}
	2362	} catch (IOException ex) {
	2363	if (debug != null)
	2364	debug.println("X509CertSelector.match: IOException in subject "
	2365	+ "alternative name check");
	2366	return false;
	2367	}
	2368	return true;
	2369	}
	2370
	2371	/* match on name constraints */
	2372	private boolean matchNameConstraints(X509Certificate xcert) {
	2373	if (nc == null) {
	2374	return true;
	2375	}
	2376	try {
	2377	if (!nc.verify(xcert)) {
	2378	if (debug != null) {
	2379	debug.println("X509CertSelector.match: "
	2380	+ "name constraints not satisfied");
	2381	}
	2382	return false;
	2383	}
	2384	} catch (IOException e) {
	2385	if (debug != null) {
	2386	debug.println("X509CertSelector.match: "
	2387	+ "IOException in name constraints check");
	2388	}
	2389	return false;
	2390	}
	2391	return true;
	2392	}
	2393
	2394	/* match on policy OIDs */
	2395	private boolean matchPolicy(X509Certificate xcert) {
	2396	if (policy == null) {
	2397	return true;
	2398	}
	2399	try {
	2400	CertificatePoliciesExtension ext = (CertificatePoliciesExtension)
	2401	getExtensionObject(xcert, CERT_POLICIES_ID);
	2402	if (ext == null) {
	2403	if (debug != null) {
	2404	debug.println("X509CertSelector.match: "
	2405	+ "no certificate policy extension");
	2406	}
	2407	return false;
	2408	}
	2409	List<PolicyInformation> policies = (List<PolicyInformation>)ext.get(CertificatePoliciesExtension.POLICIES);
	2410	/*
	2411	* Convert the Vector of PolicyInformation to a Vector
	2412	* of CertificatePolicyIds for easier comparison.
	2413	*/
	2414	List<CertificatePolicyId> policyIDs = new ArrayList<CertificatePolicyId>(policies.size());
	2415	for (PolicyInformation info : policies) {
	2416	policyIDs.add(info.getPolicyIdentifier());
	2417	}
	2418	if (policy != null) {
	2419	boolean foundOne = false;
	2420	/*
	2421	* if the user passes in an empty policy Set, then
	2422	* we just want to make sure that the candidate certificate
	2423	* has some policy OID in its CertPoliciesExtension
	2424	*/
	2425	if (policy.getCertPolicyIds().isEmpty()) {
	2426	if (policyIDs.isEmpty()) {
	2427	if (debug != null) {
	2428	debug.println("X509CertSelector.match: "
	2429	+ "cert failed policyAny criterion");
	2430	}
	2431	return false;
	2432	}
	2433	} else {
	2434	for (CertificatePolicyId id : policy.getCertPolicyIds()) {
	2435	if (policyIDs.contains(id)) {
	2436	foundOne = true;
	2437	break;
	2438	}
	2439	}
	2440	if (!foundOne) {
	2441	if (debug != null) {
	2442	debug.println("X509CertSelector.match: "
	2443	+ "cert failed policyAny criterion");
	2444	}
	2445	return false;
	2446	}
	2447	}
	2448	}
	2449	} catch (IOException ex) {
	2450	if (debug != null) {
	2451	debug.println("X509CertSelector.match: "
	2452	+ "IOException in certificate policy ID check");
	2453	}
	2454	return false;
	2455	}
	2456	return true;
	2457	}
	2458
	2459	/* match on pathToNames */
	2460	private boolean matchPathToNames(X509Certificate xcert) {
	2461	if (pathToGeneralNames == null) {
	2462	return true;
	2463	}
	2464	try {
	2465	NameConstraintsExtension ext = (NameConstraintsExtension)
	2466	getExtensionObject(xcert, NAME_CONSTRAINTS_ID);
	2467	if (ext == null) {
	2468	return true;
	2469	}
	2470	if ((debug != null) && debug.isOn("certpath")) {
	2471	debug.println("X509CertSelector.match pathToNames:\n");
	2472	Iterator<GeneralNameInterface> i =
	2473	pathToGeneralNames.iterator();
	2474	while (i.hasNext()) {
	2475	debug.println(" " + i.next() + "\n");
	2476	}
	2477	}
	2478
	2479	GeneralSubtrees permitted = (GeneralSubtrees)
	2480	ext.get(NameConstraintsExtension.PERMITTED_SUBTREES);
	2481	GeneralSubtrees excluded = (GeneralSubtrees)
	2482	ext.get(NameConstraintsExtension.EXCLUDED_SUBTREES);
	2483	if (excluded != null) {
	2484	if (matchExcluded(excluded) == false) {
	2485	return false;
	2486	}
	2487	}
	2488	if (permitted != null) {
	2489	if (matchPermitted(permitted) == false) {
	2490	return false;
	2491	}
	2492	}
	2493	} catch (IOException ex) {
	2494	if (debug != null) {
	2495	debug.println("X509CertSelector.match: "
	2496	+ "IOException in name constraints check");
	2497	}
	2498	return false;
	2499	}
	2500	return true;
	2501	}
	2502
	2503	private boolean matchExcluded(GeneralSubtrees excluded) {
	2504	/*
	2505	* Enumerate through excluded and compare each entry
	2506	* to all pathToNames. If any pathToName is within any of the
	2507	* subtrees listed in excluded, return false.
	2508	*/
	2509	for (Iterator<GeneralSubtree> t = excluded.iterator(); t.hasNext(); ) {
	2510	GeneralSubtree tree = t.next();
	2511	GeneralNameInterface excludedName = tree.getName().getName();
	2512	Iterator<GeneralNameInterface> i = pathToGeneralNames.iterator();
	2513	while (i.hasNext()) {
	2514	GeneralNameInterface pathToName = i.next();
	2515	if (excludedName.getType() == pathToName.getType()) {
	2516	switch (pathToName.constrains(excludedName)) {
	2517	case GeneralNameInterface.NAME_WIDENS:
	2518	case GeneralNameInterface.NAME_MATCH:
	2519	if (debug != null) {
	2520	debug.println("X509CertSelector.match: name constraints "
	2521	+ "inhibit path to specified name");
	2522	debug.println("X509CertSelector.match: excluded name: " +
	2523	pathToName);
	2524	}
	2525	return false;
	2526	default:
	2527	}
	2528	}
	2529	}
	2530	}
	2531	return true;
	2532	}
	2533
	2534	private boolean matchPermitted(GeneralSubtrees permitted) {
	2535	/*
	2536	* Enumerate through pathToNames, checking that each pathToName
	2537	* is in at least one of the subtrees listed in permitted.
	2538	* If not, return false. However, if no subtrees of a given type
	2539	* are listed, all names of that type are permitted.
	2540	*/
	2541	Iterator<GeneralNameInterface> i = pathToGeneralNames.iterator();
	2542	while (i.hasNext()) {
	2543	GeneralNameInterface pathToName = i.next();
	2544	Iterator<GeneralSubtree> t = permitted.iterator();
	2545	boolean permittedNameFound = false;
	2546	boolean nameTypeFound = false;
	2547	String names = "";
	2548	while (t.hasNext() && !permittedNameFound) {
	2549	GeneralSubtree tree = t.next();
	2550	GeneralNameInterface permittedName = tree.getName().getName();
	2551	if (permittedName.getType() == pathToName.getType()) {
	2552	nameTypeFound = true;
	2553	names = names + " " + permittedName;
	2554	switch (pathToName.constrains(permittedName)) {
	2555	case GeneralNameInterface.NAME_WIDENS:
	2556	case GeneralNameInterface.NAME_MATCH:
	2557	permittedNameFound = true;
	2558	break;
	2559	default:
	2560	}
	2561	}
	2562	}
	2563	if (!permittedNameFound && nameTypeFound) {
	2564	if (debug != null)
	2565	debug.println("X509CertSelector.match: " +
	2566	"name constraints inhibit path to specified name; " +
	2567	"permitted names of type " + pathToName.getType() +
	2568	": " + names);
	2569	return false;
	2570	}
	2571	}
	2572	return true;
	2573	}
	2574
	2575	/* match on basic constraints */
	2576	private boolean matchBasicConstraints(X509Certificate xcert) {
	2577	if (basicConstraints == -1) {
	2578	return true;
	2579	}
	2580	int maxPathLen = xcert.getBasicConstraints();
	2581	if (basicConstraints == -2) {
	2582	if (maxPathLen != -1) {
	2583	if (debug != null) {
	2584	debug.println("X509CertSelector.match: not an EE cert");
	2585	}
	2586	return false;
	2587	}
	2588	} else {
	2589	if (maxPathLen < basicConstraints) {
	2590	if (debug != null) {
	2591	debug.println("X509CertSelector.match: maxPathLen too small ("
	2592	+ maxPathLen + " < " + basicConstraints + ")");
	2593	}
	2594	return false;
	2595	}
	2596	}
	2597	return true;
	2598	}
	2599
	2600	private static Set<?> cloneSet(Set<?> set) {
	2601	if (set instanceof HashSet) {
	2602	Object clone = ((HashSet<?>)set).clone();
	2603	return (Set<?>)clone;
	2604	} else {
	2605	return new HashSet<Object>(set);
	2606	}
	2607	}
	2608
	2609	/**
	2610	* Returns a copy of this object.
	2611	*
	2612	* @return the copy
	2613	*/
	2614	public Object clone() {
	2615	try {
	2616	X509CertSelector copy = (X509CertSelector)super.clone();
	2617	// Must clone these because addPathToName et al. modify them
	2618	if (subjectAlternativeNames != null) {
	2619	copy.subjectAlternativeNames =
	2620	(Set<List<?>>)cloneSet(subjectAlternativeNames);
	2621	copy.subjectAlternativeGeneralNames =
	2622	(Set<GeneralNameInterface>)cloneSet
	2623	(subjectAlternativeGeneralNames);
	2624	}
	2625	if (pathToGeneralNames != null) {
	2626	copy.pathToNames =
	2627	(Set<List<?>>)cloneSet(pathToNames);
	2628	copy.pathToGeneralNames =
	2629	(Set<GeneralNameInterface>)cloneSet
	2630	(pathToGeneralNames);
	2631	}
	2632	return copy;
	2633	} catch (CloneNotSupportedException e) {
	2634	/* Cannot happen */
	2635	throw new InternalError(e.toString());
	2636	}
	2637	}
	2638	}

java/pkg/java/security/cert/X509Certificate.class+0−0

Binary file not shown.

java/pkg/java/security/cert/X509Certificate.java+649−0

@@ -0,0 +1,649 @@
	1	/*
	2	* Copyright (c) 1997, 2010, Oracle and/or its affiliates. All rights reserved.
	3	* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
	4	*
	5	* This code is free software; you can redistribute it and/or modify it
	6	* under the terms of the GNU General Public License version 2 only, as
	7	* published by the Free Software Foundation. Oracle designates this
	8	* particular file as subject to the "Classpath" exception as provided
	9	* by Oracle in the LICENSE file that accompanied this code.
	10	*
	11	* This code is distributed in the hope that it will be useful, but WITHOUT
	12	* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
	13	* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
	14	* version 2 for more details (a copy is included in the LICENSE file that
	15	* accompanied this code).
	16	*
	17	* You should have received a copy of the GNU General Public License version
	18	* 2 along with this work; if not, write to the Free Software Foundation,
	19	* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
	20	*
	21	* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
	22	* or visit www.oracle.com if you need additional information or have any
	23	* questions.
	24	*/
	25
	26	package java.security.cert;
	27
	28	import java.math.BigInteger;
	29	import java.security.Principal;
	30	import java.security.PublicKey;
	31	import java.util.Collection;
	32	import java.util.Date;
	33	import java.util.List;
	34	import javax.security.auth.x500.X500Principal;
	35
	36	import sun.security.x509.X509CertImpl;
	37
	38	/**
	39	* <p>
	40	* Abstract class for X.509 certificates. This provides a standard
	41	* way to access all the attributes of an X.509 certificate.
	42	* <p>
	43	* In June of 1996, the basic X.509 v3 format was completed by
	44	* ISO/IEC and ANSI X9, which is described below in ASN.1:
	45	* <pre>
	46	* Certificate ::= SEQUENCE {
	47	* tbsCertificate TBSCertificate,
	48	* signatureAlgorithm AlgorithmIdentifier,
	49	* signature BIT STRING }
	50	* </pre>
	51	* <p>
	52	* These certificates are widely used to support authentication and
	53	* other functionality in Internet security systems. Common applications
	54	* include Privacy Enhanced Mail (PEM), Transport Layer Security (SSL),
	55	* code signing for trusted software distribution, and Secure Electronic
	56	* Transactions (SET).
	57	* <p>
	58	* These certificates are managed and vouched for by <em>Certificate
	59	* Authorities</em> (CAs). CAs are services which create certificates by
	60	* placing data in the X.509 standard format and then digitally signing
	61	* that data. CAs act as trusted third parties, making introductions
	62	* between principals who have no direct knowledge of each other.
	63	* CA certificates are either signed by themselves, or by some other
	64	* CA such as a "root" CA.
	65	* <p>
	66	* More information can be found in
	67	* <a href="http://www.ietf.org/rfc/rfc3280.txt">RFC 3280: Internet X.509
	68	* Public Key Infrastructure Certificate and CRL Profile</a>.
	69	* <p>
	70	* The ASN.1 definition of <code>tbsCertificate</code> is:
	71	* <pre>
	72	* TBSCertificate ::= SEQUENCE {
	73	* version [0] EXPLICIT Version DEFAULT v1,
	74	* serialNumber CertificateSerialNumber,
	75	* signature AlgorithmIdentifier,
	76	* issuer Name,
	77	* validity Validity,
	78	* subject Name,
	79	* subjectPublicKeyInfo SubjectPublicKeyInfo,
	80	* issuerUniqueID [1] IMPLICIT UniqueIdentifier OPTIONAL,
	81	* -- If present, version must be v2 or v3
	82	* subjectUniqueID [2] IMPLICIT UniqueIdentifier OPTIONAL,
	83	* -- If present, version must be v2 or v3
	84	* extensions [3] EXPLICIT Extensions OPTIONAL
	85	* -- If present, version must be v3
	86	* }
	87	* </pre>
	88	* <p>
	89	* Certificates are instantiated using a certificate factory. The following is
	90	* an example of how to instantiate an X.509 certificate:
	91	* <pre>
	92	* InputStream inStream = null;
	93	* try {
	94	* inStream = new FileInputStream("fileName-of-cert");
	95	* CertificateFactory cf = CertificateFactory.getInstance("X.509");
	96	* X509Certificate cert = (X509Certificate)cf.generateCertificate(inStream);
	97	* } finally {
	98	* if (inStream != null) {
	99	* inStream.close();
	100	* }
	101	* }
	102	* </pre>
	103	*
	104	* @author Hemma Prafullchandra
	105	*
	106	*
	107	* @see Certificate
	108	* @see CertificateFactory
	109	* @see X509Extension
	110	*/
	111
	112	public abstract class X509Certificate extends Certificate
	113	implements X509Extension {
	114
	115	private static final long serialVersionUID = -2491127588187038216L;
	116
	117	private transient X500Principal subjectX500Principal, issuerX500Principal;
	118
	119	/**
	120	* Constructor for X.509 certificates.
	121	*/
	122	protected X509Certificate() {
	123	super("X.509");
	124	}
	125
	126	/**
	127	* Checks that the certificate is currently valid. It is if
	128	* the current date and time are within the validity period given in the
	129	* certificate.
	130	* <p>
	131	* The validity period consists of two date/time values:
	132	* the first and last dates (and times) on which the certificate
	133	* is valid. It is defined in
	134	* ASN.1 as:
	135	* <pre>
	136	* validity Validity<p>
	137	* Validity ::= SEQUENCE {
	138	* notBefore CertificateValidityDate,
	139	* notAfter CertificateValidityDate }<p>
	140	* CertificateValidityDate ::= CHOICE {
	141	* utcTime UTCTime,
	142	* generalTime GeneralizedTime }
	143	* </pre>
	144	*
	145	* @exception CertificateExpiredException if the certificate has expired.
	146	* @exception CertificateNotYetValidException if the certificate is not
	147	* yet valid.
	148	*/
	149	public abstract void checkValidity()
	150	throws CertificateExpiredException, CertificateNotYetValidException;
	151
	152	/**
	153	* Checks that the given date is within the certificate's
	154	* validity period. In other words, this determines whether the
	155	* certificate would be valid at the given date/time.
	156	*
	157	* @param date the Date to check against to see if this certificate
	158	* is valid at that date/time.
	159	*
	160	* @exception CertificateExpiredException if the certificate has expired
	161	* with respect to the <code>date</code> supplied.
	162	* @exception CertificateNotYetValidException if the certificate is not
	163	* yet valid with respect to the <code>date</code> supplied.
	164	*
	165	* @see #checkValidity()
	166	*/
	167	public abstract void checkValidity(Date date)
	168	throws CertificateExpiredException, CertificateNotYetValidException;
	169
	170	/**
	171	* Gets the <code>version</code> (version number) value from the
	172	* certificate.
	173	* The ASN.1 definition for this is:
	174	* <pre>
	175	* version [0] EXPLICIT Version DEFAULT v1<p>
	176	* Version ::= INTEGER { v1(0), v2(1), v3(2) }
	177	* </pre>
	178	* @return the version number, i.e. 1, 2 or 3.
	179	*/
	180	public abstract int getVersion();
	181
	182	/**
	183	* Gets the <code>serialNumber</code> value from the certificate.
	184	* The serial number is an integer assigned by the certification
	185	* authority to each certificate. It must be unique for each
	186	* certificate issued by a given CA (i.e., the issuer name and
	187	* serial number identify a unique certificate).
	188	* The ASN.1 definition for this is:
	189	* <pre>
	190	* serialNumber CertificateSerialNumber<p>
	191	*
	192	* CertificateSerialNumber ::= INTEGER
	193	* </pre>
	194	*
	195	* @return the serial number.
	196	*/
	197	public abstract BigInteger getSerialNumber();
	198
	199	/**
	200	* <strong>Denigrated</strong>, replaced by {@linkplain
	201	* #getIssuerX500Principal()}. This method returns the <code>issuer</code>
	202	* as an implementation specific Principal object, which should not be
	203	* relied upon by portable code.
	204	*
	205	* <p>
	206	* Gets the <code>issuer</code> (issuer distinguished name) value from
	207	* the certificate. The issuer name identifies the entity that signed (and
	208	* issued) the certificate.
	209	*
	210	* <p>The issuer name field contains an
	211	* X.500 distinguished name (DN).
	212	* The ASN.1 definition for this is:
	213	* <pre>
	214	* issuer Name<p>
	215	*
	216	* Name ::= CHOICE { RDNSequence }
	217	* RDNSequence ::= SEQUENCE OF RelativeDistinguishedName
	218	* RelativeDistinguishedName ::=
	219	* SET OF AttributeValueAssertion
	220	*
	221	* AttributeValueAssertion ::= SEQUENCE {
	222	* AttributeType,
	223	* AttributeValue }
	224	* AttributeType ::= OBJECT IDENTIFIER
	225	* AttributeValue ::= ANY
	226	* </pre>
	227	* The <code>Name</code> describes a hierarchical name composed of
	228	* attributes,
	229	* such as country name, and corresponding values, such as US.
	230	* The type of the <code>AttributeValue</code> component is determined by
	231	* the <code>AttributeType</code>; in general it will be a
	232	* <code>directoryString</code>. A <code>directoryString</code> is usually
	233	* one of <code>PrintableString</code>,
	234	* <code>TeletexString</code> or <code>UniversalString</code>.
	235	*
	236	* @return a Principal whose name is the issuer distinguished name.
	237	*/
	238	public abstract Principal getIssuerDN();
	239
	240	/**
	241	* Returns the issuer (issuer distinguished name) value from the
	242	* certificate as an <code>X500Principal</code>.
	243	* <p>
	244	* It is recommended that subclasses override this method.
	245	*
	246	* @return an <code>X500Principal</code> representing the issuer
	247	* distinguished name
	248	* @since 1.4
	249	*/
	250	public X500Principal getIssuerX500Principal() {
	251	if (issuerX500Principal == null) {
	252	issuerX500Principal = X509CertImpl.getIssuerX500Principal(this);
	253	}
	254	return issuerX500Principal;
	255	}
	256
	257	/**
	258	* <strong>Denigrated</strong>, replaced by {@linkplain
	259	* #getSubjectX500Principal()}. This method returns the <code>subject</code>
	260	* as an implementation specific Principal object, which should not be
	261	* relied upon by portable code.
	262	*
	263	* <p>
	264	* Gets the <code>subject</code> (subject distinguished name) value
	265	* from the certificate. If the <code>subject</code> value is empty,
	266	* then the <code>getName()</code> method of the returned
	267	* <code>Principal</code> object returns an empty string ("").
	268	*
	269	* <p> The ASN.1 definition for this is:
	270	* <pre>
	271	* subject Name
	272	* </pre>
	273	*
	274	* <p>See {@link #getIssuerDN() getIssuerDN} for <code>Name</code>
	275	* and other relevant definitions.
	276	*
	277	* @return a Principal whose name is the subject name.
	278	*/
	279	public abstract Principal getSubjectDN();
	280
	281	/**
	282	* Returns the subject (subject distinguished name) value from the
	283	* certificate as an <code>X500Principal</code>. If the subject value
	284	* is empty, then the <code>getName()</code> method of the returned
	285	* <code>X500Principal</code> object returns an empty string ("").
	286	* <p>
	287	* It is recommended that subclasses override this method.
	288	*
	289	* @return an <code>X500Principal</code> representing the subject
	290	* distinguished name
	291	* @since 1.4
	292	*/
	293	public X500Principal getSubjectX500Principal() {
	294	if (subjectX500Principal == null) {
	295	subjectX500Principal = X509CertImpl.getSubjectX500Principal(this);
	296	}
	297	return subjectX500Principal;
	298	}
	299
	300	/**
	301	* Gets the <code>notBefore</code> date from the validity period of
	302	* the certificate.
	303	* The relevant ASN.1 definitions are:
	304	* <pre>
	305	* validity Validity<p>
	306	*
	307	* Validity ::= SEQUENCE {
	308	* notBefore CertificateValidityDate,
	309	* notAfter CertificateValidityDate }<p>
	310	* CertificateValidityDate ::= CHOICE {
	311	* utcTime UTCTime,
	312	* generalTime GeneralizedTime }
	313	* </pre>
	314	*
	315	* @return the start date of the validity period.
	316	* @see #checkValidity
	317	*/
	318	public abstract Date getNotBefore();
	319
	320	/**
	321	* Gets the <code>notAfter</code> date from the validity period of
	322	* the certificate. See {@link #getNotBefore() getNotBefore}
	323	* for relevant ASN.1 definitions.
	324	*
	325	* @return the end date of the validity period.
	326	* @see #checkValidity
	327	*/
	328	public abstract Date getNotAfter();
	329
	330	/**
	331	* Gets the DER-encoded certificate information, the
	332	* <code>tbsCertificate</code> from this certificate.
	333	* This can be used to verify the signature independently.
	334	*
	335	* @return the DER-encoded certificate information.
	336	* @exception CertificateEncodingException if an encoding error occurs.
	337	*/
	338	public abstract byte[] getTBSCertificate()
	339	throws CertificateEncodingException;
	340
	341	/**
	342	* Gets the <code>signature</code> value (the raw signature bits) from
	343	* the certificate.
	344	* The ASN.1 definition for this is:
	345	* <pre>
	346	* signature BIT STRING
	347	* </pre>
	348	*
	349	* @return the signature.
	350	*/
	351	public abstract byte[] getSignature();
	352
	353	/**
	354	* Gets the signature algorithm name for the certificate
	355	* signature algorithm. An example is the string "SHA256withRSA".
	356	* The ASN.1 definition for this is:
	357	* <pre>
	358	* signatureAlgorithm AlgorithmIdentifier<p>
	359	* AlgorithmIdentifier ::= SEQUENCE {
	360	* algorithm OBJECT IDENTIFIER,
	361	* parameters ANY DEFINED BY algorithm OPTIONAL }
	362	* -- contains a value of the type
	363	* -- registered for use with the
	364	* -- algorithm object identifier value
	365	* </pre>
	366	*
	367	* <p>The algorithm name is determined from the <code>algorithm</code>
	368	* OID string.
	369	*
	370	* @return the signature algorithm name.
	371	*/
	372	public abstract String getSigAlgName();
	373
	374	/**
	375	* Gets the signature algorithm OID string from the certificate.
	376	* An OID is represented by a set of nonnegative whole numbers separated
	377	* by periods.
	378	* For example, the string "1.2.840.10040.4.3" identifies the SHA-1
	379	* with DSA signature algorithm defined in
	380	* <a href="http://www.ietf.org/rfc/rfc3279.txt">RFC 3279: Algorithms and
	381	* Identifiers for the Internet X.509 Public Key Infrastructure Certificate
	382	* and CRL Profile</a>.
	383	*
	384	* <p>See {@link #getSigAlgName() getSigAlgName} for
	385	* relevant ASN.1 definitions.
	386	*
	387	* @return the signature algorithm OID string.
	388	*/
	389	public abstract String getSigAlgOID();
	390
	391	/**
	392	* Gets the DER-encoded signature algorithm parameters from this
	393	* certificate's signature algorithm. In most cases, the signature
	394	* algorithm parameters are null; the parameters are usually
	395	* supplied with the certificate's public key.
	396	* If access to individual parameter values is needed then use
	397	* {@link java.security.AlgorithmParameters AlgorithmParameters}
	398	* and instantiate with the name returned by
	399	* {@link #getSigAlgName() getSigAlgName}.
	400	*
	401	* <p>See {@link #getSigAlgName() getSigAlgName} for
	402	* relevant ASN.1 definitions.
	403	*
	404	* @return the DER-encoded signature algorithm parameters, or
	405	* null if no parameters are present.
	406	*/
	407	public abstract byte[] getSigAlgParams();
	408
	409	/**
	410	* Gets the <code>issuerUniqueID</code> value from the certificate.
	411	* The issuer unique identifier is present in the certificate
	412	* to handle the possibility of reuse of issuer names over time.
	413	* RFC 3280 recommends that names not be reused and that
	414	* conforming certificates not make use of unique identifiers.
	415	* Applications conforming to that profile should be capable of
	416	* parsing unique identifiers and making comparisons.
	417	*
	418	* <p>The ASN.1 definition for this is:
	419	* <pre>
	420	* issuerUniqueID [1] IMPLICIT UniqueIdentifier OPTIONAL<p>
	421	* UniqueIdentifier ::= BIT STRING
	422	* </pre>
	423	*
	424	* @return the issuer unique identifier or null if it is not
	425	* present in the certificate.
	426	*/
	427	public abstract boolean[] getIssuerUniqueID();
	428
	429	/**
	430	* Gets the <code>subjectUniqueID</code> value from the certificate.
	431	*
	432	* <p>The ASN.1 definition for this is:
	433	* <pre>
	434	* subjectUniqueID [2] IMPLICIT UniqueIdentifier OPTIONAL<p>
	435	* UniqueIdentifier ::= BIT STRING
	436	* </pre>
	437	*
	438	* @return the subject unique identifier or null if it is not
	439	* present in the certificate.
	440	*/
	441	public abstract boolean[] getSubjectUniqueID();
	442
	443	/**
	444	* Gets a boolean array representing bits of
	445	* the <code>KeyUsage</code> extension, (OID = 2.5.29.15).
	446	* The key usage extension defines the purpose (e.g., encipherment,
	447	* signature, certificate signing) of the key contained in the
	448	* certificate.
	449	* The ASN.1 definition for this is:
	450	* <pre>
	451	* KeyUsage ::= BIT STRING {
	452	* digitalSignature (0),
	453	* nonRepudiation (1),
	454	* keyEncipherment (2),
	455	* dataEncipherment (3),
	456	* keyAgreement (4),
	457	* keyCertSign (5),
	458	* cRLSign (6),
	459	* encipherOnly (7),
	460	* decipherOnly (8) }
	461	* </pre>
	462	* RFC 3280 recommends that when used, this be marked
	463	* as a critical extension.
	464	*
	465	* @return the KeyUsage extension of this certificate, represented as
	466	* an array of booleans. The order of KeyUsage values in the array is
	467	* the same as in the above ASN.1 definition. The array will contain a
	468	* value for each KeyUsage defined above. If the KeyUsage list encoded
	469	* in the certificate is longer than the above list, it will not be
	470	* truncated. Returns null if this certificate does not
	471	* contain a KeyUsage extension.
	472	*/
	473	public abstract boolean[] getKeyUsage();
	474
	475	/**
	476	* Gets an unmodifiable list of Strings representing the OBJECT
	477	* IDENTIFIERs of the <code>ExtKeyUsageSyntax</code> field of the
	478	* extended key usage extension, (OID = 2.5.29.37). It indicates
	479	* one or more purposes for which the certified public key may be
	480	* used, in addition to or in place of the basic purposes
	481	* indicated in the key usage extension field. The ASN.1
	482	* definition for this is:
	483	* <pre>
	484	* ExtKeyUsageSyntax ::= SEQUENCE SIZE (1..MAX) OF KeyPurposeId<p>
	485	*
	486	* KeyPurposeId ::= OBJECT IDENTIFIER<p>
	487	* </pre>
	488	*
	489	* Key purposes may be defined by any organization with a
	490	* need. Object identifiers used to identify key purposes shall be
	491	* assigned in accordance with IANA or ITU-T Rec. X.660 \|
	492	* ISO/IEC/ITU 9834-1.
	493	* <p>
	494	* This method was added to version 1.4 of the Java 2 Platform Standard
	495	* Edition. In order to maintain backwards compatibility with existing
	496	* service providers, this method is not <code>abstract</code>
	497	* and it provides a default implementation. Subclasses
	498	* should override this method with a correct implementation.
	499	*
	500	* @return the ExtendedKeyUsage extension of this certificate,
	501	* as an unmodifiable list of object identifiers represented
	502	* as Strings. Returns null if this certificate does not
	503	* contain an ExtendedKeyUsage extension.
	504	* @throws CertificateParsingException if the extension cannot be decoded
	505	* @since 1.4
	506	*/
	507	public List<String> getExtendedKeyUsage() throws CertificateParsingException {
	508	return X509CertImpl.getExtendedKeyUsage(this);
	509	}
	510
	511	/**
	512	* Gets the certificate constraints path length from the
	513	* critical <code>BasicConstraints</code> extension, (OID = 2.5.29.19).
	514	* <p>
	515	* The basic constraints extension identifies whether the subject
	516	* of the certificate is a Certificate Authority (CA) and
	517	* how deep a certification path may exist through that CA. The
	518	* <code>pathLenConstraint</code> field (see below) is meaningful
	519	* only if <code>cA</code> is set to TRUE. In this case, it gives the
	520	* maximum number of CA certificates that may follow this certificate in a
	521	* certification path. A value of zero indicates that only an end-entity
	522	* certificate may follow in the path.
	523	* <p>
	524	* The ASN.1 definition for this is:
	525	* <pre>
	526	* BasicConstraints ::= SEQUENCE {
	527	* cA BOOLEAN DEFAULT FALSE,
	528	* pathLenConstraint INTEGER (0..MAX) OPTIONAL }
	529	* </pre>
	530	*
	531	* @return the value of <code>pathLenConstraint</code> if the
	532	* BasicConstraints extension is present in the certificate and the
	533	* subject of the certificate is a CA, otherwise -1.
	534	* If the subject of the certificate is a CA and
	535	* <code>pathLenConstraint</code> does not appear,
	536	* <code>Integer.MAX_VALUE</code> is returned to indicate that there is no
	537	* limit to the allowed length of the certification path.
	538	*/
	539	public abstract int getBasicConstraints();
	540
	541	/**
	542	* Gets an immutable collection of subject alternative names from the
	543	* <code>SubjectAltName</code> extension, (OID = 2.5.29.17).
	544	* <p>
	545	* The ASN.1 definition of the <code>SubjectAltName</code> extension is:
	546	* <pre>
	547	* SubjectAltName ::= GeneralNames
	548	*
	549	* GeneralNames :: = SEQUENCE SIZE (1..MAX) OF GeneralName
	550	*
	551	* GeneralName ::= CHOICE {
	552	* otherName [0] OtherName,
	553	* rfc822Name [1] IA5String,
	554	* dNSName [2] IA5String,
	555	* x400Address [3] ORAddress,
	556	* directoryName [4] Name,
	557	* ediPartyName [5] EDIPartyName,
	558	* uniformResourceIdentifier [6] IA5String,
	559	* iPAddress [7] OCTET STRING,
	560	* registeredID [8] OBJECT IDENTIFIER}
	561	* </pre>
	562	* <p>
	563	* If this certificate does not contain a <code>SubjectAltName</code>
	564	* extension, <code>null</code> is returned. Otherwise, a
	565	* <code>Collection</code> is returned with an entry representing each
	566	* <code>GeneralName</code> included in the extension. Each entry is a
	567	* <code>List</code> whose first entry is an <code>Integer</code>
	568	* (the name type, 0-8) and whose second entry is a <code>String</code>
	569	* or a byte array (the name, in string or ASN.1 DER encoded form,
	570	* respectively).
	571	* <p>
	572	* <a href="http://www.ietf.org/rfc/rfc822.txt">RFC 822</a>, DNS, and URI
	573	* names are returned as <code>String</code>s,
	574	* using the well-established string formats for those types (subject to
	575	* the restrictions included in RFC 3280). IPv4 address names are
	576	* returned using dotted quad notation. IPv6 address names are returned
	577	* in the form "a1:a2:...:a8", where a1-a8 are hexadecimal values
	578	* representing the eight 16-bit pieces of the address. OID names are
	579	* returned as <code>String</code>s represented as a series of nonnegative
	580	* integers separated by periods. And directory names (distinguished names)
	581	* are returned in <a href="http://www.ietf.org/rfc/rfc2253.txt">
	582	* RFC 2253</a> string format. No standard string format is
	583	* defined for otherNames, X.400 names, EDI party names, or any
	584	* other type of names. They are returned as byte arrays
	585	* containing the ASN.1 DER encoded form of the name.
	586	* <p>
	587	* Note that the <code>Collection</code> returned may contain more
	588	* than one name of the same type. Also, note that the returned
	589	* <code>Collection</code> is immutable and any entries containing byte
	590	* arrays are cloned to protect against subsequent modifications.
	591	* <p>
	592	* This method was added to version 1.4 of the Java 2 Platform Standard
	593	* Edition. In order to maintain backwards compatibility with existing
	594	* service providers, this method is not <code>abstract</code>
	595	* and it provides a default implementation. Subclasses
	596	* should override this method with a correct implementation.
	597	*
	598	* @return an immutable <code>Collection</code> of subject alternative
	599	* names (or <code>null</code>)
	600	* @throws CertificateParsingException if the extension cannot be decoded
	601	* @since 1.4
	602	*/
	603	public Collection<List<?>> getSubjectAlternativeNames()
	604	throws CertificateParsingException {
	605	return X509CertImpl.getSubjectAlternativeNames(this);
	606	}
	607
	608	/**
	609	* Gets an immutable collection of issuer alternative names from the
	610	* <code>IssuerAltName</code> extension, (OID = 2.5.29.18).
	611	* <p>
	612	* The ASN.1 definition of the <code>IssuerAltName</code> extension is:
	613	* <pre>
	614	* IssuerAltName ::= GeneralNames
	615	* </pre>
	616	* The ASN.1 definition of <code>GeneralNames</code> is defined
	617	* in {@link #getSubjectAlternativeNames getSubjectAlternativeNames}.
	618	* <p>
	619	* If this certificate does not contain an <code>IssuerAltName</code>
	620	* extension, <code>null</code> is returned. Otherwise, a
	621	* <code>Collection</code> is returned with an entry representing each
	622	* <code>GeneralName</code> included in the extension. Each entry is a
	623	* <code>List</code> whose first entry is an <code>Integer</code>
	624	* (the name type, 0-8) and whose second entry is a <code>String</code>
	625	* or a byte array (the name, in string or ASN.1 DER encoded form,
	626	* respectively). For more details about the formats used for each
	627	* name type, see the <code>getSubjectAlternativeNames</code> method.
	628	* <p>
	629	* Note that the <code>Collection</code> returned may contain more
	630	* than one name of the same type. Also, note that the returned
	631	* <code>Collection</code> is immutable and any entries containing byte
	632	* arrays are cloned to protect against subsequent modifications.
	633	* <p>
	634	* This method was added to version 1.4 of the Java 2 Platform Standard
	635	* Edition. In order to maintain backwards compatibility with existing
	636	* service providers, this method is not <code>abstract</code>
	637	* and it provides a default implementation. Subclasses
	638	* should override this method with a correct implementation.
	639	*
	640	* @return an immutable <code>Collection</code> of issuer alternative
	641	* names (or <code>null</code>)
	642	* @throws CertificateParsingException if the extension cannot be decoded
	643	* @since 1.4
	644	*/
	645	public Collection<List<?>> getIssuerAlternativeNames()
	646	throws CertificateParsingException {
	647	return X509CertImpl.getIssuerAlternativeNames(this);
	648	}
	649	}

java/pkg/java/security/cert/X509Extension.class+0−0

Binary file not shown.

java/pkg/java/security/cert/X509Extension.java+199−0

@@ -0,0 +1,199 @@
	1	/*
	2	* Copyright (c) 1997, 2006, Oracle and/or its affiliates. All rights reserved.
	3	* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
	4	*
	5	* This code is free software; you can redistribute it and/or modify it
	6	* under the terms of the GNU General Public License version 2 only, as
	7	* published by the Free Software Foundation. Oracle designates this
	8	* particular file as subject to the "Classpath" exception as provided
	9	* by Oracle in the LICENSE file that accompanied this code.
	10	*
	11	* This code is distributed in the hope that it will be useful, but WITHOUT
	12	* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
	13	* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
	14	* version 2 for more details (a copy is included in the LICENSE file that
	15	* accompanied this code).
	16	*
	17	* You should have received a copy of the GNU General Public License version
	18	* 2 along with this work; if not, write to the Free Software Foundation,
	19	* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
	20	*
	21	* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
	22	* or visit www.oracle.com if you need additional information or have any
	23	* questions.
	24	*/
	25
	26	package java.security.cert;
	27
	28	import java.util.Set;
	29
	30	/**
	31	* Interface for an X.509 extension.
	32	*
	33	* <p>The extensions defined for X.509 v3
	34	* {@link X509Certificate Certificates} and v2
	35	* {@link X509CRL CRLs} (Certificate Revocation
	36	* Lists) provide methods
	37	* for associating additional attributes with users or public keys,
	38	* for managing the certification hierarchy, and for managing CRL
	39	* distribution. The X.509 extensions format also allows communities
	40	* to define private extensions to carry information unique to those
	41	* communities.
	42	*
	43	* <p>Each extension in a certificate/CRL may be designated as
	44	* critical or non-critical. A certificate/CRL-using system (an application
	45	* validating a certificate/CRL) must reject the certificate/CRL if it
	46	* encounters a critical extension it does not recognize. A non-critical
	47	* extension may be ignored if it is not recognized.
	48	* <p>
	49	* The ASN.1 definition for this is:
	50	* <pre>
	51	* Extensions ::= SEQUENCE SIZE (1..MAX) OF Extension
	52	*
	53	* Extension ::= SEQUENCE {
	54	* extnId OBJECT IDENTIFIER,
	55	* critical BOOLEAN DEFAULT FALSE,
	56	* extnValue OCTET STRING
	57	* -- contains a DER encoding of a value
	58	* -- of the type registered for use with
	59	* -- the extnId object identifier value
	60	* }
	61	* </pre>
	62	* Since not all extensions are known, the <code>getExtensionValue</code>
	63	* method returns the DER-encoded OCTET STRING of the
	64	* extension value (i.e., the <code>extnValue</code>). This can then
	65	* be handled by a <em>Class</em> that understands the extension.
	66	*
	67	* @author Hemma Prafullchandra
	68	*/
	69
	70	public interface X509Extension {
	71
	72	/**
	73	* Check if there is a critical extension that is not supported.
	74	*
	75	* @return <tt>true</tt> if a critical extension is found that is
	76	* not supported, otherwise <tt>false</tt>.
	77	*/
	78	public boolean hasUnsupportedCriticalExtension();
	79
	80	/**
	81	* Gets a Set of the OID strings for the extension(s) marked
	82	* CRITICAL in the certificate/CRL managed by the object
	83	* implementing this interface.
	84	*
	85	* Here is sample code to get a Set of critical extensions from an
	86	* X509Certificate and print the OIDs:
	87	* <pre><code>
	88	* InputStream inStrm = null;
	89	* X509Certificate cert = null;
	90	* try {
	91	* inStrm = new FileInputStream("DER-encoded-Cert");
	92	* CertificateFactory cf = CertificateFactory.getInstance("X.509");
	93	* cert = (X509Certificate)cf.generateCertificate(inStrm);
	94	* } finally {
	95	* if (inStrm != null) {
	96	* inStrm.close();
	97	* }
	98	* }<p>
	99	*
	100	* Set<String> critSet = cert.getCriticalExtensionOIDs();
	101	* if (critSet != null && !critSet.isEmpty()) {
	102	* System.out.println("Set of critical extensions:");
	103	* for (String oid : critSet) {
	104	* System.out.println(oid);
	105	* }
	106	* }
	107	* </code></pre>
	108	* @return a Set (or an empty Set if none are marked critical) of
	109	* the extension OID strings for extensions that are marked critical.
	110	* If there are no extensions present at all, then this method returns
	111	* null.
	112	*/
	113	public Set<String> getCriticalExtensionOIDs();
	114
	115	/**
	116	* Gets a Set of the OID strings for the extension(s) marked
	117	* NON-CRITICAL in the certificate/CRL managed by the object
	118	* implementing this interface.
	119	*
	120	* Here is sample code to get a Set of non-critical extensions from an
	121	* X509CRL revoked certificate entry and print the OIDs:
	122	* <pre><code>
	123	* InputStream inStrm = null;
	124	* CertificateFactory cf = null;
	125	* X509CRL crl = null;
	126	* try {
	127	* inStrm = new FileInputStream("DER-encoded-CRL");
	128	* cf = CertificateFactory.getInstance("X.509");
	129	* crl = (X509CRL)cf.generateCRL(inStrm);
	130	* } finally {
	131	* if (inStrm != null) {
	132	* inStrm.close();
	133	* }
	134	* }<p>
	135	*
	136	* byte[] certData = <DER-encoded certificate data>
	137	* ByteArrayInputStream bais = new ByteArrayInputStream(certData);
	138	* X509Certificate cert = (X509Certificate)cf.generateCertificate(bais);
	139	* bais.close();
	140	* X509CRLEntry badCert =
	141	* crl.getRevokedCertificate(cert.getSerialNumber());<p>
	142	*
	143	* if (badCert != null) {
	144	* Set<String> nonCritSet = badCert.getNonCriticalExtensionOIDs();<p>
	145	* if (nonCritSet != null)
	146	* for (String oid : nonCritSet) {
	147	* System.out.println(oid);
	148	* }
	149	* }
	150	* </code></pre>
	151	*
	152	* @return a Set (or an empty Set if none are marked non-critical) of
	153	* the extension OID strings for extensions that are marked non-critical.
	154	* If there are no extensions present at all, then this method returns
	155	* null.
	156	*/
	157	public Set<String> getNonCriticalExtensionOIDs();
	158
	159	/**
	160	* Gets the DER-encoded OCTET string for the extension value
	161	* (<em>extnValue</em>) identified by the passed-in <code>oid</code>
	162	* String.
	163	* The <code>oid</code> string is
	164	* represented by a set of nonnegative whole numbers separated
	165	* by periods.
	166	*
	167	* <p>For example:<br>
	168	* <table border=groove summary="Examples of OIDs and extension names">
	169	* <tr>
	170	* <th>OID <em>(Object Identifier)</em></th>
	171	* <th>Extension Name</th></tr>
	172	* <tr><td>2.5.29.14</td>
	173	* <td>SubjectKeyIdentifier</td></tr>
	174	* <tr><td>2.5.29.15</td>
	175	* <td>KeyUsage</td></tr>
	176	* <tr><td>2.5.29.16</td>
	177	* <td>PrivateKeyUsage</td></tr>
	178	* <tr><td>2.5.29.17</td>
	179	* <td>SubjectAlternativeName</td></tr>
	180	* <tr><td>2.5.29.18</td>
	181	* <td>IssuerAlternativeName</td></tr>
	182	* <tr><td>2.5.29.19</td>
	183	* <td>BasicConstraints</td></tr>
	184	* <tr><td>2.5.29.30</td>
	185	* <td>NameConstraints</td></tr>
	186	* <tr><td>2.5.29.33</td>
	187	* <td>PolicyMappings</td></tr>
	188	* <tr><td>2.5.29.35</td>
	189	* <td>AuthorityKeyIdentifier</td></tr>
	190	* <tr><td>2.5.29.36</td>
	191	* <td>PolicyConstraints</td></tr>
	192	* </table>
	193	*
	194	* @param oid the Object Identifier value for the extension.
	195	* @return the DER-encoded octet string of the extension value or
	196	* null if it is not present.
	197	*/
	198	public byte[] getExtensionValue(String oid);
	199	}

java/pkg/java/security/cert/mkfile+54−0

@@ -0,0 +1,54 @@
	1	<../../../../../mkconfig
	2
	3	TARG=\
	4	Certificate.dis\
	5	CertificateEncodingException.dis\
	6	CertificateException.dis\
	7	CertificateExpiredException.dis\
	8	CertificateFactory.dis\
	9	CertificateFactorySpi.dis\
	10	CertificateNotYetValidException.dis\
	11	CertificateParsingException.dis\
	12	CertificateRevokedException.dis\
	13	CertPath.dis\
	14	CertPathBuilder.dis\
	15	CertPathBuilderException.dis\
	16	CertPathBuilderResult.dis\
	17	CertPathBuilderSpi.dis\
	18	CertPathHelperImpl.dis\
	19	CertPathParameters.dis\
	20	CertPathValidator.dis\
	21	CertPathValidatorException.dis\
	22	CertPathValidatorResult.dis\
	23	CertPathValidatorSpi.dis\
	24	CertSelector.dis\
	25	CertStore.dis\
	26	CertStoreException.dis\
	27	CertStoreParameters.dis\
	28	CertStoreSpi.dis\
	29	CollectionCertStoreParameters.dis\
	30	CRL.dis\
	31	CRLException.dis\
	32	CRLReason.dis\
	33	CRLSelector.dis\
	34	Extension.dis\
	35	LDAPCertStoreParameters.dis\
	36	PKIXBuilderParameters.dis\
	37	PKIXCertPathBuilderResult.dis\
	38	PKIXCertPathChecker.dis\
	39	PKIXCertPathValidatorResult.dis\
	40	PKIXParameters.dis\
	41	PKIXReason.dis\
	42	PolicyNode.dis\
	43	PolicyQualifierInfo.dis\
	44	TrustAnchor.dis\
	45	X509Certificate.dis\
	46	X509CertSelector.dis\
	47	X509CRL.dis\
	48	X509CRLEntry.dis\
	49	X509CRLSelector.dis\
	50	X509Extension.dis\
	51
	52	DISBIN=$ROOT/java/dis/java/java/java/security/cert
	53
	54	<$ROOT/mkfiles/mkjava

java/pkg/java/security/cert/package.html+65−0

@@ -0,0 +1,65 @@
	1	<!--
	2	Copyright (c) 1998, 2011, Oracle and/or its affiliates. All rights reserved.
	3	DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
	4
	5	This code is free software; you can redistribute it and/or modify it
	6	under the terms of the GNU General Public License version 2 only, as
	7	published by the Free Software Foundation. Oracle designates this
	8	particular file as subject to the "Classpath" exception as provided
	9	by Oracle in the LICENSE file that accompanied this code.
	10
	11	This code is distributed in the hope that it will be useful, but WITHOUT
	12	ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
	13	FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
	14	version 2 for more details (a copy is included in the LICENSE file that
	15	accompanied this code).
	16
	17	You should have received a copy of the GNU General Public License version
	18	2 along with this work; if not, write to the Free Software Foundation,
	19	Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
	20
	21	Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
	22	or visit www.oracle.com if you need additional information or have any
	23	questions.
	24	-->
	25
	26	<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2 Final//EN">
	27	<html>
	28	<body bgcolor="white">
	29
	30	Provides classes and interfaces for parsing and managing
	31	certificates, certificate revocation lists (CRLs), and
	32	certification paths. It contains support for X.509 v3
	33	certificates and X.509 v2 CRLs.
	34
	35	<h2>Package Specification</h2>
	36
	37	<ul>
	38	<li><a href="{@docRoot}/../technotes/guides/security/crypto/CryptoSpec.html">
	39	<b>Java<FONT SIZE=-2><SUP>TM</SUP></FONT>
	40	Cryptography Architecture (JCA) Reference Guide</b></a>
	41	<li>RFC 3280: Internet X.509 Public Key Infrastructure Certificate and
	42	Certificate Revocation List (CRL) Profile
	43	<li><a href="{@docRoot}/../technotes/guides/security/StandardNames.html">
	44	<b>Java<FONT SIZE=-2><SUP>TM</SUP></FONT>
	45	Cryptography Architecture Standard Algorithm Name
	46	Documentation</b></a></li>
	47	</ul>
	48
	49	<h2>Related Documentation</h2>
	50
	51	For information about X.509 certificates and CRLs, please see:
	52	<ul>
	53	<li><a href="http://www.ietf.org/rfc/rfc3280.txt">
	54	http://www.ietf.org/rfc/rfc3280.txt</a>
	55	<li><a href=
	56	"{@docRoot}/../technotes/guides/security/certpath/CertPathProgGuide.html">
	57	<b>Java<FONT SIZE=-2><SUP>TM</SUP></FONT>
	58	PKI Programmer's Guide</a>
	59	<li><a href="{@docRoot}/../technotes/guides/security/cert3.html">
	60	X.509 Certificates and Certificate Revocation Lists (CRLs)</a>
	61	</ul>
	62
	63	@since 1.2
	64	</body>
	65	</html>