History

My first initial commit with all of mine experimental changes.

Dmitry Kabak (userdima committed 13 years ago

Commit d37b88d1 parent 3f5b46618352 files · +2598093 −-8690Browse files

Showing the changes to java/pkg/java/security/cert (103 of 18352 files). Show all

Unified · Split

103 files
  1. java/pkg/java/security/cert/CRL.class +0 −0
  2. java/pkg/java/security/cert/CRL.java +88 −0
  3. java/pkg/java/security/cert/CRLException.class +0 −0
  4. java/pkg/java/security/cert/CRLException.java +88 −0
  5. java/pkg/java/security/cert/CRLReason.class +0 −0
  6. java/pkg/java/security/cert/CRLReason.java +104 −0
  7. java/pkg/java/security/cert/CRLSelector.class +0 −0
  8. java/pkg/java/security/cert/CRLSelector.java +66 −0
  9. java/pkg/java/security/cert/CertPath$CertPathRep.class +0 −0
  10. java/pkg/java/security/cert/CertPath.class +0 −0
  11. java/pkg/java/security/cert/CertPath.java +343 −0
  12. java/pkg/java/security/cert/CertPathBuilder$1.class +0 −0
  13. java/pkg/java/security/cert/CertPathBuilder.class +0 −0
  14. java/pkg/java/security/cert/CertPathBuilder.java +304 −0
  15. java/pkg/java/security/cert/CertPathBuilderException.class +0 −0
  16. java/pkg/java/security/cert/CertPathBuilderException.java +104 −0
  17. java/pkg/java/security/cert/CertPathBuilderResult.class +0 −0
  18. java/pkg/java/security/cert/CertPathBuilderResult.java +68 −0
  19. java/pkg/java/security/cert/CertPathBuilderSpi.class +0 −0
  20. java/pkg/java/security/cert/CertPathBuilderSpi.java +75 −0
  21. java/pkg/java/security/cert/CertPathHelperImpl.class +0 −0
  22. java/pkg/java/security/cert/CertPathHelperImpl.java +66 −0
  23. java/pkg/java/security/cert/CertPathParameters.class +0 −0
  24. java/pkg/java/security/cert/CertPathParameters.java +49 −0
  25. java/pkg/java/security/cert/CertPathValidator$1.class +0 −0
  26. java/pkg/java/security/cert/CertPathValidator.class +0 −0
  27. java/pkg/java/security/cert/CertPathValidator.java +315 −0
  28. java/pkg/java/security/cert/CertPathValidatorException$BasicReason.class +0 −0
  29. java/pkg/java/security/cert/CertPathValidatorException$Reason.class +0 −0
  30. java/pkg/java/security/cert/CertPathValidatorException.class +0 −0
  31. java/pkg/java/security/cert/CertPathValidatorException.java +296 −0
  32. java/pkg/java/security/cert/CertPathValidatorResult.class +0 −0
  33. java/pkg/java/security/cert/CertPathValidatorResult.java +50 −0
  34. java/pkg/java/security/cert/CertPathValidatorSpi.class +0 −0
  35. java/pkg/java/security/cert/CertPathValidatorSpi.java +85 −0
  36. java/pkg/java/security/cert/CertSelector.class +0 −0
  37. java/pkg/java/security/cert/CertSelector.java +67 −0
  38. java/pkg/java/security/cert/CertStore$1.class +0 −0
  39. java/pkg/java/security/cert/CertStore.class +0 −0
  40. java/pkg/java/security/cert/CertStore.java +424 −0
  41. java/pkg/java/security/cert/CertStoreException.class +0 −0
  42. java/pkg/java/security/cert/CertStoreException.java +103 −0
  43. java/pkg/java/security/cert/CertStoreParameters.class +0 −0
  44. java/pkg/java/security/cert/CertStoreParameters.java +80 −0
  45. java/pkg/java/security/cert/CertStoreSpi.class +0 −0
  46. java/pkg/java/security/cert/CertStoreSpi.java +125 −0
  47. java/pkg/java/security/cert/Certificate$CertificateRep.class +0 −0
  48. java/pkg/java/security/cert/Certificate.class +0 −0
  49. java/pkg/java/security/cert/Certificate.java +274 −0
  50. java/pkg/java/security/cert/CertificateEncodingException.class +0 −0
  51. java/pkg/java/security/cert/CertificateEncodingException.java +88 −0
  52. java/pkg/java/security/cert/CertificateException.class +0 −0
  53. java/pkg/java/security/cert/CertificateException.java +88 −0
  54. java/pkg/java/security/cert/CertificateExpiredException.class +0 −0
  55. java/pkg/java/security/cert/CertificateExpiredException.java +59 −0
  56. java/pkg/java/security/cert/CertificateFactory.class +0 −0
  57. java/pkg/java/security/cert/CertificateFactory.java +537 −0
  58. java/pkg/java/security/cert/CertificateFactorySpi.class +0 −0
  59. java/pkg/java/security/cert/CertificateFactorySpi.java +315 −0
  60. java/pkg/java/security/cert/CertificateNotYetValidException.class +0 −0
  61. java/pkg/java/security/cert/CertificateNotYetValidException.java +59 −0
  62. java/pkg/java/security/cert/CertificateParsingException.class +0 −0
  63. java/pkg/java/security/cert/CertificateParsingException.java +89 −0
  64. java/pkg/java/security/cert/CertificateRevokedException.class +0 −0
  65. java/pkg/java/security/cert/CertificateRevokedException.java +245 −0
  66. java/pkg/java/security/cert/CollectionCertStoreParameters.class +0 −0
  67. java/pkg/java/security/cert/CollectionCertStoreParameters.java +141 −0
  68. java/pkg/java/security/cert/Extension.class +0 −0
  69. java/pkg/java/security/cert/Extension.java +101 −0
  70. java/pkg/java/security/cert/LDAPCertStoreParameters.class +0 −0
  71. java/pkg/java/security/cert/LDAPCertStoreParameters.java +149 −0
  72. java/pkg/java/security/cert/PKIXBuilderParameters.class +0 −0
  73. java/pkg/java/security/cert/PKIXBuilderParameters.java +199 −0
  74. java/pkg/java/security/cert/PKIXCertPathBuilderResult.class +0 −0
  75. java/pkg/java/security/cert/PKIXCertPathBuilderResult.java +119 −0
  76. java/pkg/java/security/cert/PKIXCertPathChecker.class +0 −0
  77. java/pkg/java/security/cert/PKIXCertPathChecker.java +181 −0
  78. java/pkg/java/security/cert/PKIXCertPathValidatorResult.class +0 −0
  79. java/pkg/java/security/cert/PKIXCertPathValidatorResult.java +159 −0
  80. java/pkg/java/security/cert/PKIXParameters.class +0 −0
  81. java/pkg/java/security/cert/PKIXParameters.java +736 −0
  82. java/pkg/java/security/cert/PKIXReason.class +0 −0
  83. java/pkg/java/security/cert/PKIXReason.java +77 −0
  84. java/pkg/java/security/cert/PolicyNode.class +0 −0
  85. java/pkg/java/security/cert/PolicyNode.java +133 −0
  86. java/pkg/java/security/cert/PolicyQualifierInfo.class +0 −0
  87. java/pkg/java/security/cert/PolicyQualifierInfo.java +173 −0
  88. java/pkg/java/security/cert/TrustAnchor.class +0 −0
  89. java/pkg/java/security/cert/TrustAnchor.java +334 −0
  90. java/pkg/java/security/cert/X509CRL.class +0 −0
  91. java/pkg/java/security/cert/X509CRL.java +443 −0
  92. java/pkg/java/security/cert/X509CRLEntry.class +0 −0
  93. java/pkg/java/security/cert/X509CRLEntry.java +191 −0
  94. java/pkg/java/security/cert/X509CRLSelector.class +0 −0
  95. java/pkg/java/security/cert/X509CRLSelector.java +714 −0
  96. java/pkg/java/security/cert/X509CertSelector.class +0 −0
  97. java/pkg/java/security/cert/X509CertSelector.java +2638 −0
  98. java/pkg/java/security/cert/X509Certificate.class +0 −0
  99. java/pkg/java/security/cert/X509Certificate.java +649 −0
  100. java/pkg/java/security/cert/X509Extension.class +0 −0
  101. java/pkg/java/security/cert/X509Extension.java +199 −0
  102. java/pkg/java/security/cert/mkfile +54 −0
  103. java/pkg/java/security/cert/package.html +65 −0
java/pkg/java/security/cert/CRL.class+0−0

Binary file not shown.

java/pkg/java/security/cert/CRL.java+88−0
@@ -0,0 +1,88 @@
1+/*
2+ * Copyright (c) 1998, 2006, Oracle and/or its affiliates. All rights reserved.
3+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
4+ *
5+ * This code is free software; you can redistribute it and/or modify it
6+ * under the terms of the GNU General Public License version 2 only, as
7+ * published by the Free Software Foundation. Oracle designates this
8+ * particular file as subject to the "Classpath" exception as provided
9+ * by Oracle in the LICENSE file that accompanied this code.
10+ *
11+ * This code is distributed in the hope that it will be useful, but WITHOUT
12+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
13+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
14+ * version 2 for more details (a copy is included in the LICENSE file that
15+ * accompanied this code).
16+ *
17+ * You should have received a copy of the GNU General Public License version
18+ * 2 along with this work; if not, write to the Free Software Foundation,
19+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
20+ *
21+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
22+ * or visit www.oracle.com if you need additional information or have any
23+ * questions.
24+ */
25+
26+package java.security.cert;
27+
28+/**
29+ * This class is an abstraction of certificate revocation lists (CRLs) that
30+ * have different formats but important common uses. For example, all CRLs
31+ * share the functionality of listing revoked certificates, and can be queried
32+ * on whether or not they list a given certificate.
33+ * <p>
34+ * Specialized CRL types can be defined by subclassing off of this abstract
35+ * class.
36+ *
37+ * @author Hemma Prafullchandra
38+ *
39+ *
40+ * @see X509CRL
41+ * @see CertificateFactory
42+ *
43+ * @since 1.2
44+ */
45+
46+public abstract class CRL {
47+
48+ // the CRL type
49+ private String type;
50+
51+ /**
52+ * Creates a CRL of the specified type.
53+ *
54+ * @param type the standard name of the CRL type.
55+ * See Appendix A in the <a href=
56+ * "../../../../technotes/guides/security/crypto/CryptoSpec.html#AppA">
57+ * Java Cryptography Architecture API Specification &amp; Reference </a>
58+ * for information about standard CRL types.
59+ */
60+ protected CRL(String type) {
61+ this.type = type;
62+ }
63+
64+ /**
65+ * Returns the type of this CRL.
66+ *
67+ * @return the type of this CRL.
68+ */
69+ public final String getType() {
70+ return this.type;
71+ }
72+
73+ /**
74+ * Returns a string representation of this CRL.
75+ *
76+ * @return a string representation of this CRL.
77+ */
78+ public abstract String toString();
79+
80+ /**
81+ * Checks whether the given certificate is on this CRL.
82+ *
83+ * @param cert the certificate to check for.
84+ * @return true if the given certificate is on this CRL,
85+ * false otherwise.
86+ */
87+ public abstract boolean isRevoked(Certificate cert);
88+}
java/pkg/java/security/cert/CRLException.class+0−0

Binary file not shown.

java/pkg/java/security/cert/CRLException.java+88−0
@@ -0,0 +1,88 @@
1+/*
2+ * Copyright (c) 1997, 2003, Oracle and/or its affiliates. All rights reserved.
3+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
4+ *
5+ * This code is free software; you can redistribute it and/or modify it
6+ * under the terms of the GNU General Public License version 2 only, as
7+ * published by the Free Software Foundation. Oracle designates this
8+ * particular file as subject to the "Classpath" exception as provided
9+ * by Oracle in the LICENSE file that accompanied this code.
10+ *
11+ * This code is distributed in the hope that it will be useful, but WITHOUT
12+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
13+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
14+ * version 2 for more details (a copy is included in the LICENSE file that
15+ * accompanied this code).
16+ *
17+ * You should have received a copy of the GNU General Public License version
18+ * 2 along with this work; if not, write to the Free Software Foundation,
19+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
20+ *
21+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
22+ * or visit www.oracle.com if you need additional information or have any
23+ * questions.
24+ */
25+
26+package java.security.cert;
27+
28+import java.security.GeneralSecurityException;
29+
30+/**
31+ * CRL (Certificate Revocation List) Exception.
32+ *
33+ * @author Hemma Prafullchandra
34+ */
35+public class CRLException extends GeneralSecurityException {
36+
37+ private static final long serialVersionUID = -6694728944094197147L;
38+
39+ /**
40+ * Constructs a CRLException with no detail message. A
41+ * detail message is a String that describes this particular
42+ * exception.
43+ */
44+ public CRLException() {
45+ super();
46+ }
47+
48+ /**
49+ * Constructs a CRLException with the specified detail
50+ * message. A detail message is a String that describes this
51+ * particular exception.
52+ *
53+ * @param message the detail message.
54+ */
55+ public CRLException(String message) {
56+ super(message);
57+ }
58+
59+ /**
60+ * Creates a <code>CRLException</code> with the specified
61+ * detail message and cause.
62+ *
63+ * @param message the detail message (which is saved for later retrieval
64+ * by the {@link #getMessage()} method).
65+ * @param cause the cause (which is saved for later retrieval by the
66+ * {@link #getCause()} method). (A <tt>null</tt> value is permitted,
67+ * and indicates that the cause is nonexistent or unknown.)
68+ * @since 1.5
69+ */
70+ public CRLException(String message, Throwable cause) {
71+ super(message, cause);
72+ }
73+
74+ /**
75+ * Creates a <code>CRLException</code> with the specified cause
76+ * and a detail message of <tt>(cause==null ? null : cause.toString())</tt>
77+ * (which typically contains the class and detail message of
78+ * <tt>cause</tt>).
79+ *
80+ * @param cause the cause (which is saved for later retrieval by the
81+ * {@link #getCause()} method). (A <tt>null</tt> value is permitted,
82+ * and indicates that the cause is nonexistent or unknown.)
83+ * @since 1.5
84+ */
85+ public CRLException(Throwable cause) {
86+ super(cause);
87+ }
88+}
java/pkg/java/security/cert/CRLReason.class+0−0

Binary file not shown.

java/pkg/java/security/cert/CRLReason.java+104−0
@@ -0,0 +1,104 @@
1+/*
2+ * Copyright (c) 2007, Oracle and/or its affiliates. All rights reserved.
3+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
4+ *
5+ * This code is free software; you can redistribute it and/or modify it
6+ * under the terms of the GNU General Public License version 2 only, as
7+ * published by the Free Software Foundation. Oracle designates this
8+ * particular file as subject to the "Classpath" exception as provided
9+ * by Oracle in the LICENSE file that accompanied this code.
10+ *
11+ * This code is distributed in the hope that it will be useful, but WITHOUT
12+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
13+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
14+ * version 2 for more details (a copy is included in the LICENSE file that
15+ * accompanied this code).
16+ *
17+ * You should have received a copy of the GNU General Public License version
18+ * 2 along with this work; if not, write to the Free Software Foundation,
19+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
20+ *
21+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
22+ * or visit www.oracle.com if you need additional information or have any
23+ * questions.
24+ */
25+
26+package java.security.cert;
27+
28+/**
29+ * The CRLReason enumeration specifies the reason that a certificate
30+ * is revoked, as defined in <a href="http://www.ietf.org/rfc/rfc3280.txt">
31+ * RFC 3280: Internet X.509 Public Key Infrastructure Certificate and CRL
32+ * Profile</a>.
33+ *
34+ * @author Sean Mullan
35+ * @since 1.7
36+ * @see X509CRLEntry#getRevocationReason
37+ * @see CertificateRevokedException#getRevocationReason
38+ */
39+public enum CRLReason {
40+ /**
41+ * This reason indicates that it is unspecified as to why the
42+ * certificate has been revoked.
43+ */
44+ UNSPECIFIED,
45+
46+ /**
47+ * This reason indicates that it is known or suspected that the
48+ * certificate subject's private key has been compromised. It applies
49+ * to end-entity certificates only.
50+ */
51+ KEY_COMPROMISE,
52+
53+ /**
54+ * This reason indicates that it is known or suspected that the
55+ * certificate subject's private key has been compromised. It applies
56+ * to certificate authority (CA) certificates only.
57+ */
58+ CA_COMPROMISE,
59+
60+ /**
61+ * This reason indicates that the subject's name or other information
62+ * has changed.
63+ */
64+ AFFILIATION_CHANGED,
65+
66+ /**
67+ * This reason indicates that the certificate has been superseded.
68+ */
69+ SUPERSEDED,
70+
71+ /**
72+ * This reason indicates that the certificate is no longer needed.
73+ */
74+ CESSATION_OF_OPERATION,
75+
76+ /**
77+ * This reason indicates that the certificate has been put on hold.
78+ */
79+ CERTIFICATE_HOLD,
80+
81+ /**
82+ * Unused reason.
83+ */
84+ UNUSED,
85+
86+ /**
87+ * This reason indicates that the certificate was previously on hold
88+ * and should be removed from the CRL. It is for use with delta CRLs.
89+ */
90+ REMOVE_FROM_CRL,
91+
92+ /**
93+ * This reason indicates that the privileges granted to the subject of
94+ * the certificate have been withdrawn.
95+ */
96+ PRIVILEGE_WITHDRAWN,
97+
98+ /**
99+ * This reason indicates that it is known or suspected that the
100+ * certificate subject's private key has been compromised. It applies
101+ * to authority attribute (AA) certificates only.
102+ */
103+ AA_COMPROMISE
104+}
java/pkg/java/security/cert/CRLSelector.class+0−0

Binary file not shown.

java/pkg/java/security/cert/CRLSelector.java+66−0
@@ -0,0 +1,66 @@
1+/*
2+ * Copyright (c) 2000, 2001, Oracle and/or its affiliates. All rights reserved.
3+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
4+ *
5+ * This code is free software; you can redistribute it and/or modify it
6+ * under the terms of the GNU General Public License version 2 only, as
7+ * published by the Free Software Foundation. Oracle designates this
8+ * particular file as subject to the "Classpath" exception as provided
9+ * by Oracle in the LICENSE file that accompanied this code.
10+ *
11+ * This code is distributed in the hope that it will be useful, but WITHOUT
12+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
13+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
14+ * version 2 for more details (a copy is included in the LICENSE file that
15+ * accompanied this code).
16+ *
17+ * You should have received a copy of the GNU General Public License version
18+ * 2 along with this work; if not, write to the Free Software Foundation,
19+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
20+ *
21+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
22+ * or visit www.oracle.com if you need additional information or have any
23+ * questions.
24+ */
25+
26+package java.security.cert;
27+
28+/**
29+ * A selector that defines a set of criteria for selecting <code>CRL</code>s.
30+ * Classes that implement this interface are often used to specify
31+ * which <code>CRL</code>s should be retrieved from a <code>CertStore</code>.
32+ * <p>
33+ * <b>Concurrent Access</b>
34+ * <p>
35+ * Unless otherwise specified, the methods defined in this interface are not
36+ * thread-safe. Multiple threads that need to access a single
37+ * object concurrently should synchronize amongst themselves and
38+ * provide the necessary locking. Multiple threads each manipulating
39+ * separate objects need not synchronize.
40+ *
41+ * @see CRL
42+ * @see CertStore
43+ * @see CertStore#getCRLs
44+ *
45+ * @author Steve Hanna
46+ * @since 1.4
47+ */
48+public interface CRLSelector extends Cloneable {
49+
50+ /**
51+ * Decides whether a <code>CRL</code> should be selected.
52+ *
53+ * @param crl the <code>CRL</code> to be checked
54+ * @return <code>true</code> if the <code>CRL</code> should be selected,
55+ * <code>false</code> otherwise
56+ */
57+ boolean match(CRL crl);
58+
59+ /**
60+ * Makes a copy of this <code>CRLSelector</code>. Changes to the
61+ * copy will not affect the original and vice versa.
62+ *
63+ * @return a copy of this <code>CRLSelector</code>
64+ */
65+ Object clone();
66+}
java/pkg/java/security/cert/CertPath$CertPathRep.class+0−0

Binary file not shown.

java/pkg/java/security/cert/CertPath.class+0−0

Binary file not shown.

java/pkg/java/security/cert/CertPath.java+343−0
@@ -0,0 +1,343 @@
1+/*
2+ * Copyright (c) 2000, 2011, Oracle and/or its affiliates. All rights reserved.
3+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
4+ *
5+ * This code is free software; you can redistribute it and/or modify it
6+ * under the terms of the GNU General Public License version 2 only, as
7+ * published by the Free Software Foundation. Oracle designates this
8+ * particular file as subject to the "Classpath" exception as provided
9+ * by Oracle in the LICENSE file that accompanied this code.
10+ *
11+ * This code is distributed in the hope that it will be useful, but WITHOUT
12+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
13+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
14+ * version 2 for more details (a copy is included in the LICENSE file that
15+ * accompanied this code).
16+ *
17+ * You should have received a copy of the GNU General Public License version
18+ * 2 along with this work; if not, write to the Free Software Foundation,
19+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
20+ *
21+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
22+ * or visit www.oracle.com if you need additional information or have any
23+ * questions.
24+ */
25+
26+package java.security.cert;
27+
28+import java.io.ByteArrayInputStream;
29+import java.io.NotSerializableException;
30+import java.io.ObjectStreamException;
31+import java.io.Serializable;
32+import java.util.Iterator;
33+import java.util.List;
34+
35+/**
36+ * An immutable sequence of certificates (a certification path).
37+ * <p>
38+ * This is an abstract class that defines the methods common to all
39+ * <code>CertPath</code>s. Subclasses can handle different kinds of
40+ * certificates (X.509, PGP, etc.).
41+ * <p>
42+ * All <code>CertPath</code> objects have a type, a list of
43+ * <code>Certificate</code>s, and one or more supported encodings. Because the
44+ * <code>CertPath</code> class is immutable, a <code>CertPath</code> cannot
45+ * change in any externally visible way after being constructed. This
46+ * stipulation applies to all public fields and methods of this class and any
47+ * added or overridden by subclasses.
48+ * <p>
49+ * The type is a <code>String</code> that identifies the type of
50+ * <code>Certificate</code>s in the certification path. For each
51+ * certificate <code>cert</code> in a certification path <code>certPath</code>,
52+ * <code>cert.getType().equals(certPath.getType())</code> must be
53+ * <code>true</code>.
54+ * <p>
55+ * The list of <code>Certificate</code>s is an ordered <code>List</code> of
56+ * zero or more <code>Certificate</code>s. This <code>List</code> and all
57+ * of the <code>Certificate</code>s contained in it must be immutable.
58+ * <p>
59+ * Each <code>CertPath</code> object must support one or more encodings
60+ * so that the object can be translated into a byte array for storage or
61+ * transmission to other parties. Preferably, these encodings should be
62+ * well-documented standards (such as PKCS#7). One of the encodings supported
63+ * by a <code>CertPath</code> is considered the default encoding. This
64+ * encoding is used if no encoding is explicitly requested (for the
65+ * {@link #getEncoded() getEncoded()} method, for instance).
66+ * <p>
67+ * All <code>CertPath</code> objects are also <code>Serializable</code>.
68+ * <code>CertPath</code> objects are resolved into an alternate
69+ * {@link CertPathRep CertPathRep} object during serialization. This allows
70+ * a <code>CertPath</code> object to be serialized into an equivalent
71+ * representation regardless of its underlying implementation.
72+ * <p>
73+ * <code>CertPath</code> objects can be created with a
74+ * <code>CertificateFactory</code> or they can be returned by other classes,
75+ * such as a <code>CertPathBuilder</code>.
76+ * <p>
77+ * By convention, X.509 <code>CertPath</code>s (consisting of
78+ * <code>X509Certificate</code>s), are ordered starting with the target
79+ * certificate and ending with a certificate issued by the trust anchor. That
80+ * is, the issuer of one certificate is the subject of the following one. The
81+ * certificate representing the {@link TrustAnchor TrustAnchor} should not be
82+ * included in the certification path. Unvalidated X.509 <code>CertPath</code>s
83+ * may not follow these conventions. PKIX <code>CertPathValidator</code>s will
84+ * detect any departure from these conventions that cause the certification
85+ * path to be invalid and throw a <code>CertPathValidatorException</code>.
86+ *
87+ * <p> Every implementation of the Java platform is required to support the
88+ * following standard <code>CertPath</code> encodings:
89+ * <ul>
90+ * <li><tt>PKCS7</tt></li>
91+ * <li><tt>PkiPath</tt></li>
92+ * </ul>
93+ * These encodings are described in the <a href=
94+ * "{@docRoot}/../technotes/guides/security/StandardNames.html#CertPathEncodings">
95+ * CertPath Encodings section</a> of the
96+ * Java Cryptography Architecture Standard Algorithm Name Documentation.
97+ * Consult the release documentation for your implementation to see if any
98+ * other encodings are supported.
99+ * <p>
100+ * <b>Concurrent Access</b>
101+ * <p>
102+ * All <code>CertPath</code> objects must be thread-safe. That is, multiple
103+ * threads may concurrently invoke the methods defined in this class on a
104+ * single <code>CertPath</code> object (or more than one) with no
105+ * ill effects. This is also true for the <code>List</code> returned by
106+ * <code>CertPath.getCertificates</code>.
107+ * <p>
108+ * Requiring <code>CertPath</code> objects to be immutable and thread-safe
109+ * allows them to be passed around to various pieces of code without worrying
110+ * about coordinating access. Providing this thread-safety is
111+ * generally not difficult, since the <code>CertPath</code> and
112+ * <code>List</code> objects in question are immutable.
113+ *
114+ * @see CertificateFactory
115+ * @see CertPathBuilder
116+ *
117+ * @author Yassir Elley
118+ * @since 1.4
119+ */
120+public abstract class CertPath implements Serializable {
121+
122+ private static final long serialVersionUID = 6068470306649138683L;
123+
124+ private String type; // the type of certificates in this chain
125+
126+ /**
127+ * Creates a <code>CertPath</code> of the specified type.
128+ * <p>
129+ * This constructor is protected because most users should use a
130+ * <code>CertificateFactory</code> to create <code>CertPath</code>s.
131+ *
132+ * @param type the standard name of the type of
133+ * <code>Certificate</code>s in this path
134+ */
135+ protected CertPath(String type) {
136+ this.type = type;
137+ }
138+
139+ /**
140+ * Returns the type of <code>Certificate</code>s in this certification
141+ * path. This is the same string that would be returned by
142+ * {@link java.security.cert.Certificate#getType() cert.getType()}
143+ * for all <code>Certificate</code>s in the certification path.
144+ *
145+ * @return the type of <code>Certificate</code>s in this certification
146+ * path (never null)
147+ */
148+ public String getType() {
149+ return type;
150+ }
151+
152+ /**
153+ * Returns an iteration of the encodings supported by this certification
154+ * path, with the default encoding first. Attempts to modify the returned
155+ * <code>Iterator</code> via its <code>remove</code> method result in an
156+ * <code>UnsupportedOperationException</code>.
157+ *
158+ * @return an <code>Iterator</code> over the names of the supported
159+ * encodings (as Strings)
160+ */
161+ public abstract Iterator<String> getEncodings();
162+
163+ /**
164+ * Compares this certification path for equality with the specified
165+ * object. Two <code>CertPath</code>s are equal if and only if their
166+ * types are equal and their certificate <code>List</code>s (and by
167+ * implication the <code>Certificate</code>s in those <code>List</code>s)
168+ * are equal. A <code>CertPath</code> is never equal to an object that is
169+ * not a <code>CertPath</code>.
170+ * <p>
171+ * This algorithm is implemented by this method. If it is overridden,
172+ * the behavior specified here must be maintained.
173+ *
174+ * @param other the object to test for equality with this certification path
175+ * @return true if the specified object is equal to this certification path,
176+ * false otherwise
177+ */
178+ public boolean equals(Object other) {
179+ if (this == other)
180+ return true;
181+
182+ if (! (other instanceof CertPath))
183+ return false;
184+
185+ CertPath otherCP = (CertPath) other;
186+ if (! otherCP.getType().equals(type))
187+ return false;
188+
189+ List<? extends Certificate> thisCertList = this.getCertificates();
190+ List<? extends Certificate> otherCertList = otherCP.getCertificates();
191+ return(thisCertList.equals(otherCertList));
192+ }
193+
194+ /**
195+ * Returns the hashcode for this certification path. The hash code of
196+ * a certification path is defined to be the result of the following
197+ * calculation:
198+ * <pre><code>
199+ * hashCode = path.getType().hashCode();
200+ * hashCode = 31*hashCode + path.getCertificates().hashCode();
201+ * </code></pre>
202+ * This ensures that <code>path1.equals(path2)</code> implies that
203+ * <code>path1.hashCode()==path2.hashCode()</code> for any two certification
204+ * paths, <code>path1</code> and <code>path2</code>, as required by the
205+ * general contract of <code>Object.hashCode</code>.
206+ *
207+ * @return the hashcode value for this certification path
208+ */
209+ public int hashCode() {
210+ int hashCode = type.hashCode();
211+ hashCode = 31*hashCode + getCertificates().hashCode();
212+ return hashCode;
213+ }
214+
215+ /**
216+ * Returns a string representation of this certification path.
217+ * This calls the <code>toString</code> method on each of the
218+ * <code>Certificate</code>s in the path.
219+ *
220+ * @return a string representation of this certification path
221+ */
222+ public String toString() {
223+ StringBuffer sb = new StringBuffer();
224+ Iterator<? extends Certificate> stringIterator =
225+ getCertificates().iterator();
226+
227+ sb.append("\n" + type + " Cert Path: length = "
228+ + getCertificates().size() + ".\n");
229+ sb.append("[\n");
230+ int i = 1;
231+ while (stringIterator.hasNext()) {
232+ sb.append("=========================================="
233+ + "===============Certificate " + i + " start.\n");
234+ Certificate stringCert = stringIterator.next();
235+ sb.append(stringCert.toString());
236+ sb.append("\n========================================"
237+ + "=================Certificate " + i + " end.\n\n\n");
238+ i++;
239+ }
240+
241+ sb.append("\n]");
242+ return sb.toString();
243+ }
244+
245+ /**
246+ * Returns the encoded form of this certification path, using the default
247+ * encoding.
248+ *
249+ * @return the encoded bytes
250+ * @exception CertificateEncodingException if an encoding error occurs
251+ */
252+ public abstract byte[] getEncoded()
253+ throws CertificateEncodingException;
254+
255+ /**
256+ * Returns the encoded form of this certification path, using the
257+ * specified encoding.
258+ *
259+ * @param encoding the name of the encoding to use
260+ * @return the encoded bytes
261+ * @exception CertificateEncodingException if an encoding error occurs or
262+ * the encoding requested is not supported
263+ */
264+ public abstract byte[] getEncoded(String encoding)
265+ throws CertificateEncodingException;
266+
267+ /**
268+ * Returns the list of certificates in this certification path.
269+ * The <code>List</code> returned must be immutable and thread-safe.
270+ *
271+ * @return an immutable <code>List</code> of <code>Certificate</code>s
272+ * (may be empty, but not null)
273+ */
274+ public abstract List<? extends Certificate> getCertificates();
275+
276+ /**
277+ * Replaces the <code>CertPath</code> to be serialized with a
278+ * <code>CertPathRep</code> object.
279+ *
280+ * @return the <code>CertPathRep</code> to be serialized
281+ *
282+ * @throws ObjectStreamException if a <code>CertPathRep</code> object
283+ * representing this certification path could not be created
284+ */
285+ protected Object writeReplace() throws ObjectStreamException {
286+ try {
287+ return new CertPathRep(type, getEncoded());
288+ } catch (CertificateException ce) {
289+ NotSerializableException nse =
290+ new NotSerializableException
291+ ("java.security.cert.CertPath: " + type);
292+ nse.initCause(ce);
293+ throw nse;
294+ }
295+ }
296+
297+ /**
298+ * Alternate <code>CertPath</code> class for serialization.
299+ * @since 1.4
300+ */
301+ protected static class CertPathRep implements Serializable {
302+
303+ private static final long serialVersionUID = 3015633072427920915L;
304+
305+ /** The Certificate type */
306+ private String type;
307+ /** The encoded form of the cert path */
308+ private byte[] data;
309+
310+ /**
311+ * Creates a <code>CertPathRep</code> with the specified
312+ * type and encoded form of a certification path.
313+ *
314+ * @param type the standard name of a <code>CertPath</code> type
315+ * @param data the encoded form of the certification path
316+ */
317+ protected CertPathRep(String type, byte[] data) {
318+ this.type = type;
319+ this.data = data;
320+ }
321+
322+ /**
323+ * Returns a <code>CertPath</code> constructed from the type and data.
324+ *
325+ * @return the resolved <code>CertPath</code> object
326+ *
327+ * @throws ObjectStreamException if a <code>CertPath</code> could not
328+ * be constructed
329+ */
330+ protected Object readResolve() throws ObjectStreamException {
331+ try {
332+ CertificateFactory cf = CertificateFactory.getInstance(type);
333+ return cf.generateCertPath(new ByteArrayInputStream(data));
334+ } catch (CertificateException ce) {
335+ NotSerializableException nse =
336+ new NotSerializableException
337+ ("java.security.cert.CertPath: " + type);
338+ nse.initCause(ce);
339+ throw nse;
340+ }
341+ }
342+ }
343+}
java/pkg/java/security/cert/CertPathBuilder$1.class+0−0

Binary file not shown.

java/pkg/java/security/cert/CertPathBuilder.class+0−0

Binary file not shown.

java/pkg/java/security/cert/CertPathBuilder.java+304−0
@@ -0,0 +1,304 @@
1+/*
2+ * Copyright (c) 2000, 2011, Oracle and/or its affiliates. All rights reserved.
3+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
4+ *
5+ * This code is free software; you can redistribute it and/or modify it
6+ * under the terms of the GNU General Public License version 2 only, as
7+ * published by the Free Software Foundation. Oracle designates this
8+ * particular file as subject to the "Classpath" exception as provided
9+ * by Oracle in the LICENSE file that accompanied this code.
10+ *
11+ * This code is distributed in the hope that it will be useful, but WITHOUT
12+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
13+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
14+ * version 2 for more details (a copy is included in the LICENSE file that
15+ * accompanied this code).
16+ *
17+ * You should have received a copy of the GNU General Public License version
18+ * 2 along with this work; if not, write to the Free Software Foundation,
19+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
20+ *
21+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
22+ * or visit www.oracle.com if you need additional information or have any
23+ * questions.
24+ */
25+
26+package java.security.cert;
27+
28+import java.security.AccessController;
29+import java.security.InvalidAlgorithmParameterException;
30+import java.security.NoSuchAlgorithmException;
31+import java.security.NoSuchProviderException;
32+import java.security.PrivilegedAction;
33+import java.security.Provider;
34+import java.security.Security;
35+import sun.security.util.Debug;
36+
37+import sun.security.jca.*;
38+import sun.security.jca.GetInstance.Instance;
39+
40+/**
41+ * A class for building certification paths (also known as certificate chains).
42+ * <p>
43+ * This class uses a provider-based architecture.
44+ * To create a <code>CertPathBuilder</code>, call
45+ * one of the static <code>getInstance</code> methods, passing in the
46+ * algorithm name of the <code>CertPathBuilder</code> desired and optionally
47+ * the name of the provider desired.
48+ * <p>
49+ * Once a <code>CertPathBuilder</code> object has been created, certification
50+ * paths can be constructed by calling the {@link #build build} method and
51+ * passing it an algorithm-specific set of parameters. If successful, the
52+ * result (including the <code>CertPath</code> that was built) is returned
53+ * in an object that implements the <code>CertPathBuilderResult</code>
54+ * interface.
55+ *
56+ * <p> Every implementation of the Java platform is required to support the
57+ * following standard <code>CertPathBuilder</code> algorithm:
58+ * <ul>
59+ * <li><tt>PKIX</tt></li>
60+ * </ul>
61+ * This algorithm is described in the <a href=
62+ * "{@docRoot}/../technotes/guides/security/StandardNames.html#CertPathBuilder">
63+ * CertPathBuilder section</a> of the
64+ * Java Cryptography Architecture Standard Algorithm Name Documentation.
65+ * Consult the release documentation for your implementation to see if any
66+ * other algorithms are supported.
67+ *
68+ * <p>
69+ * <b>Concurrent Access</b>
70+ * <p>
71+ * The static methods of this class are guaranteed to be thread-safe.
72+ * Multiple threads may concurrently invoke the static methods defined in
73+ * this class with no ill effects.
74+ * <p>
75+ * However, this is not true for the non-static methods defined by this class.
76+ * Unless otherwise documented by a specific provider, threads that need to
77+ * access a single <code>CertPathBuilder</code> instance concurrently should
78+ * synchronize amongst themselves and provide the necessary locking. Multiple
79+ * threads each manipulating a different <code>CertPathBuilder</code> instance
80+ * need not synchronize.
81+ *
82+ * @see CertPath
83+ *
84+ * @since 1.4
85+ * @author Sean Mullan
86+ * @author Yassir Elley
87+ */
88+public class CertPathBuilder {
89+
90+ /*
91+ * Constant to lookup in the Security properties file to determine
92+ * the default certpathbuilder type. In the Security properties file,
93+ * the default certpathbuilder type is given as:
94+ * <pre>
95+ * certpathbuilder.type=PKIX
96+ * </pre>
97+ */
98+ private static final String CPB_TYPE = "certpathbuilder.type";
99+ private static final Debug debug = Debug.getInstance("certpath");
100+ private CertPathBuilderSpi builderSpi;
101+ private Provider provider;
102+ private String algorithm;
103+
104+ /**
105+ * Creates a <code>CertPathBuilder</code> object of the given algorithm,
106+ * and encapsulates the given provider implementation (SPI object) in it.
107+ *
108+ * @param builderSpi the provider implementation
109+ * @param provider the provider
110+ * @param algorithm the algorithm name
111+ */
112+ protected CertPathBuilder(CertPathBuilderSpi builderSpi, Provider provider,
113+ String algorithm)
114+ {
115+ this.builderSpi = builderSpi;
116+ this.provider = provider;
117+ this.algorithm = algorithm;
118+ }
119+
120+ /**
121+ * Returns a <code>CertPathBuilder</code> object that implements the
122+ * specified algorithm.
123+ *
124+ * <p> This method traverses the list of registered security Providers,
125+ * starting with the most preferred Provider.
126+ * A new CertPathBuilder object encapsulating the
127+ * CertPathBuilderSpi implementation from the first
128+ * Provider that supports the specified algorithm is returned.
129+ *
130+ * <p> Note that the list of registered providers may be retrieved via
131+ * the {@link Security#getProviders() Security.getProviders()} method.
132+ *
133+ * @param algorithm the name of the requested <code>CertPathBuilder</code>
134+ * algorithm. See the CertPathBuilder section in the <a href=
135+ * "{@docRoot}/../technotes/guides/security/StandardNames.html#CertPathBuilder">
136+ * Java Cryptography Architecture Standard Algorithm Name Documentation</a>
137+ * for information about standard algorithm names.
138+ *
139+ * @return a <code>CertPathBuilder</code> object that implements the
140+ * specified algorithm.
141+ *
142+ * @throws NoSuchAlgorithmException if no Provider supports a
143+ * CertPathBuilderSpi implementation for the
144+ * specified algorithm.
145+ *
146+ * @see java.security.Provider
147+ */
148+ public static CertPathBuilder getInstance(String algorithm)
149+ throws NoSuchAlgorithmException {
150+ Instance instance = GetInstance.getInstance("CertPathBuilder",
151+ CertPathBuilderSpi.class, algorithm);
152+ return new CertPathBuilder((CertPathBuilderSpi)instance.impl,
153+ instance.provider, algorithm);
154+ }
155+
156+ /**
157+ * Returns a <code>CertPathBuilder</code> object that implements the
158+ * specified algorithm.
159+ *
160+ * <p> A new CertPathBuilder object encapsulating the
161+ * CertPathBuilderSpi implementation from the specified provider
162+ * is returned. The specified provider must be registered
163+ * in the security provider list.
164+ *
165+ * <p> Note that the list of registered providers may be retrieved via
166+ * the {@link Security#getProviders() Security.getProviders()} method.
167+ *
168+ * @param algorithm the name of the requested <code>CertPathBuilder</code>
169+ * algorithm. See the CertPathBuilder section in the <a href=
170+ * "{@docRoot}/../technotes/guides/security/StandardNames.html#CertPathBuilder">
171+ * Java Cryptography Architecture Standard Algorithm Name Documentation</a>
172+ * for information about standard algorithm names.
173+ *
174+ * @param provider the name of the provider.
175+ *
176+ * @return a <code>CertPathBuilder</code> object that implements the
177+ * specified algorithm.
178+ *
179+ * @throws NoSuchAlgorithmException if a CertPathBuilderSpi
180+ * implementation for the specified algorithm is not
181+ * available from the specified provider.
182+ *
183+ * @throws NoSuchProviderException if the specified provider is not
184+ * registered in the security provider list.
185+ *
186+ * @exception IllegalArgumentException if the <code>provider</code> is
187+ * null or empty.
188+ *
189+ * @see java.security.Provider
190+ */
191+ public static CertPathBuilder getInstance(String algorithm, String provider)
192+ throws NoSuchAlgorithmException, NoSuchProviderException {
193+ Instance instance = GetInstance.getInstance("CertPathBuilder",
194+ CertPathBuilderSpi.class, algorithm, provider);
195+ return new CertPathBuilder((CertPathBuilderSpi)instance.impl,
196+ instance.provider, algorithm);
197+ }
198+
199+ /**
200+ * Returns a <code>CertPathBuilder</code> object that implements the
201+ * specified algorithm.
202+ *
203+ * <p> A new CertPathBuilder object encapsulating the
204+ * CertPathBuilderSpi implementation from the specified Provider
205+ * object is returned. Note that the specified Provider object
206+ * does not have to be registered in the provider list.
207+ *
208+ * @param algorithm the name of the requested <code>CertPathBuilder</code>
209+ * algorithm. See the CertPathBuilder section in the <a href=
210+ * "{@docRoot}/../technotes/guides/security/StandardNames.html#CertPathBuilder">
211+ * Java Cryptography Architecture Standard Algorithm Name Documentation</a>
212+ * for information about standard algorithm names.
213+ *
214+ * @param provider the provider.
215+ *
216+ * @return a <code>CertPathBuilder</code> object that implements the
217+ * specified algorithm.
218+ *
219+ * @exception NoSuchAlgorithmException if a CertPathBuilderSpi
220+ * implementation for the specified algorithm is not available
221+ * from the specified Provider object.
222+ *
223+ * @exception IllegalArgumentException if the <code>provider</code> is
224+ * null.
225+ *
226+ * @see java.security.Provider
227+ */
228+ public static CertPathBuilder getInstance(String algorithm,
229+ Provider provider) throws NoSuchAlgorithmException {
230+ Instance instance = GetInstance.getInstance("CertPathBuilder",
231+ CertPathBuilderSpi.class, algorithm, provider);
232+ return new CertPathBuilder((CertPathBuilderSpi)instance.impl,
233+ instance.provider, algorithm);
234+ }
235+
236+ /**
237+ * Returns the provider of this <code>CertPathBuilder</code>.
238+ *
239+ * @return the provider of this <code>CertPathBuilder</code>
240+ */
241+ public final Provider getProvider() {
242+ return this.provider;
243+ }
244+
245+ /**
246+ * Returns the name of the algorithm of this <code>CertPathBuilder</code>.
247+ *
248+ * @return the name of the algorithm of this <code>CertPathBuilder</code>
249+ */
250+ public final String getAlgorithm() {
251+ return this.algorithm;
252+ }
253+
254+ /**
255+ * Attempts to build a certification path using the specified algorithm
256+ * parameter set.
257+ *
258+ * @param params the algorithm parameters
259+ * @return the result of the build algorithm
260+ * @throws CertPathBuilderException if the builder is unable to construct
261+ * a certification path that satisfies the specified parameters
262+ * @throws InvalidAlgorithmParameterException if the specified parameters
263+ * are inappropriate for this <code>CertPathBuilder</code>
264+ */
265+ public final CertPathBuilderResult build(CertPathParameters params)
266+ throws CertPathBuilderException, InvalidAlgorithmParameterException
267+ {
268+ return builderSpi.engineBuild(params);
269+ }
270+
271+ /**
272+ * Returns the default <code>CertPathBuilder</code> type as specified in
273+ * the Java security properties file, or the string &quot;PKIX&quot;
274+ * if no such property exists. The Java security properties file is
275+ * located in the file named &lt;JAVA_HOME&gt;/lib/security/java.security.
276+ * &lt;JAVA_HOME&gt; refers to the value of the java.home system property,
277+ * and specifies the directory where the JRE is installed.
278+ *
279+ * <p>The default <code>CertPathBuilder</code> type can be used by
280+ * applications that do not want to use a hard-coded type when calling one
281+ * of the <code>getInstance</code> methods, and want to provide a default
282+ * type in case a user does not specify its own.
283+ *
284+ * <p>The default <code>CertPathBuilder</code> type can be changed by
285+ * setting the value of the "certpathbuilder.type" security property
286+ * (in the Java security properties file) to the desired type.
287+ *
288+ * @return the default <code>CertPathBuilder</code> type as specified
289+ * in the Java security properties file, or the string &quot;PKIX&quot;
290+ * if no such property exists.
291+ */
292+ public final static String getDefaultType() {
293+ String cpbtype;
294+ cpbtype = AccessController.doPrivileged(new PrivilegedAction<String>() {
295+ public String run() {
296+ return Security.getProperty(CPB_TYPE);
297+ }
298+ });
299+ if (cpbtype == null) {
300+ cpbtype = "PKIX";
301+ }
302+ return cpbtype;
303+ }
304+}
java/pkg/java/security/cert/CertPathBuilderException.class+0−0

Binary file not shown.

java/pkg/java/security/cert/CertPathBuilderException.java+104−0
@@ -0,0 +1,104 @@
1+/*
2+ * Copyright (c) 2000, 2003, Oracle and/or its affiliates. All rights reserved.
3+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
4+ *
5+ * This code is free software; you can redistribute it and/or modify it
6+ * under the terms of the GNU General Public License version 2 only, as
7+ * published by the Free Software Foundation. Oracle designates this
8+ * particular file as subject to the "Classpath" exception as provided
9+ * by Oracle in the LICENSE file that accompanied this code.
10+ *
11+ * This code is distributed in the hope that it will be useful, but WITHOUT
12+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
13+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
14+ * version 2 for more details (a copy is included in the LICENSE file that
15+ * accompanied this code).
16+ *
17+ * You should have received a copy of the GNU General Public License version
18+ * 2 along with this work; if not, write to the Free Software Foundation,
19+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
20+ *
21+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
22+ * or visit www.oracle.com if you need additional information or have any
23+ * questions.
24+ */
25+
26+package java.security.cert;
27+
28+import java.security.GeneralSecurityException;
29+
30+/**
31+ * An exception indicating one of a variety of problems encountered when
32+ * building a certification path with a <code>CertPathBuilder</code>.
33+ * <p>
34+ * A <code>CertPathBuilderException</code> provides support for wrapping
35+ * exceptions. The {@link #getCause getCause} method returns the throwable,
36+ * if any, that caused this exception to be thrown.
37+ * <p>
38+ * <b>Concurrent Access</b>
39+ * <p>
40+ * Unless otherwise specified, the methods defined in this class are not
41+ * thread-safe. Multiple threads that need to access a single
42+ * object concurrently should synchronize amongst themselves and
43+ * provide the necessary locking. Multiple threads each manipulating
44+ * separate objects need not synchronize.
45+ *
46+ * @see CertPathBuilder
47+ *
48+ * @since 1.4
49+ * @author Sean Mullan
50+ */
51+public class CertPathBuilderException extends GeneralSecurityException {
52+
53+ private static final long serialVersionUID = 5316471420178794402L;
54+
55+ /**
56+ * Creates a <code>CertPathBuilderException</code> with <code>null</code>
57+ * as its detail message.
58+ */
59+ public CertPathBuilderException() {
60+ super();
61+ }
62+
63+ /**
64+ * Creates a <code>CertPathBuilderException</code> with the given
65+ * detail message. The detail message is a <code>String</code> that
66+ * describes this particular exception in more detail.
67+ *
68+ * @param msg the detail message
69+ */
70+ public CertPathBuilderException(String msg) {
71+ super(msg);
72+ }
73+
74+ /**
75+ * Creates a <code>CertPathBuilderException</code> that wraps the specified
76+ * throwable. This allows any exception to be converted into a
77+ * <code>CertPathBuilderException</code>, while retaining information
78+ * about the wrapped exception, which may be useful for debugging. The
79+ * detail message is set to (<code>cause==null ? null : cause.toString()
80+ * </code>) (which typically contains the class and detail message of
81+ * cause).
82+ *
83+ * @param cause the cause (which is saved for later retrieval by the
84+ * {@link #getCause getCause()} method). (A <code>null</code> value is
85+ * permitted, and indicates that the cause is nonexistent or unknown.)
86+ */
87+ public CertPathBuilderException(Throwable cause) {
88+ super(cause);
89+ }
90+
91+ /**
92+ * Creates a <code>CertPathBuilderException</code> with the specified
93+ * detail message and cause.
94+ *
95+ * @param msg the detail message
96+ * @param cause the cause (which is saved for later retrieval by the
97+ * {@link #getCause getCause()} method). (A <code>null</code> value is
98+ * permitted, and indicates that the cause is nonexistent or unknown.)
99+ */
100+ public CertPathBuilderException(String msg, Throwable cause) {
101+ super(msg, cause);
102+ }
103+
104+}
java/pkg/java/security/cert/CertPathBuilderResult.class+0−0

Binary file not shown.

java/pkg/java/security/cert/CertPathBuilderResult.java+68−0
@@ -0,0 +1,68 @@
1+/*
2+ * Copyright (c) 2000, 2001, Oracle and/or its affiliates. All rights reserved.
3+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
4+ *
5+ * This code is free software; you can redistribute it and/or modify it
6+ * under the terms of the GNU General Public License version 2 only, as
7+ * published by the Free Software Foundation. Oracle designates this
8+ * particular file as subject to the "Classpath" exception as provided
9+ * by Oracle in the LICENSE file that accompanied this code.
10+ *
11+ * This code is distributed in the hope that it will be useful, but WITHOUT
12+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
13+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
14+ * version 2 for more details (a copy is included in the LICENSE file that
15+ * accompanied this code).
16+ *
17+ * You should have received a copy of the GNU General Public License version
18+ * 2 along with this work; if not, write to the Free Software Foundation,
19+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
20+ *
21+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
22+ * or visit www.oracle.com if you need additional information or have any
23+ * questions.
24+ */
25+
26+package java.security.cert;
27+
28+/**
29+ * A specification of the result of a certification path builder algorithm.
30+ * All results returned by the {@link CertPathBuilder#build
31+ * CertPathBuilder.build} method must implement this interface.
32+ * <p>
33+ * At a minimum, a <code>CertPathBuilderResult</code> contains the
34+ * <code>CertPath</code> built by the <code>CertPathBuilder</code> instance.
35+ * Implementations of this interface may add methods to return implementation
36+ * or algorithm specific information, such as debugging information or
37+ * certification path validation results.
38+ * <p>
39+ * <b>Concurrent Access</b>
40+ * <p>
41+ * Unless otherwise specified, the methods defined in this interface are not
42+ * thread-safe. Multiple threads that need to access a single
43+ * object concurrently should synchronize amongst themselves and
44+ * provide the necessary locking. Multiple threads each manipulating
45+ * separate objects need not synchronize.
46+ *
47+ * @see CertPathBuilder
48+ *
49+ * @since 1.4
50+ * @author Sean Mullan
51+ */
52+public interface CertPathBuilderResult extends Cloneable {
53+
54+ /**
55+ * Returns the built certification path.
56+ *
57+ * @return the certification path (never <code>null</code>)
58+ */
59+ CertPath getCertPath();
60+
61+ /**
62+ * Makes a copy of this <code>CertPathBuilderResult</code>. Changes to the
63+ * copy will not affect the original and vice versa.
64+ *
65+ * @return a copy of this <code>CertPathBuilderResult</code>
66+ */
67+ Object clone();
68+}
java/pkg/java/security/cert/CertPathBuilderSpi.class+0−0

Binary file not shown.

java/pkg/java/security/cert/CertPathBuilderSpi.java+75−0
@@ -0,0 +1,75 @@
1+/*
2+ * Copyright (c) 2000, 2001, Oracle and/or its affiliates. All rights reserved.
3+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
4+ *
5+ * This code is free software; you can redistribute it and/or modify it
6+ * under the terms of the GNU General Public License version 2 only, as
7+ * published by the Free Software Foundation. Oracle designates this
8+ * particular file as subject to the "Classpath" exception as provided
9+ * by Oracle in the LICENSE file that accompanied this code.
10+ *
11+ * This code is distributed in the hope that it will be useful, but WITHOUT
12+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
13+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
14+ * version 2 for more details (a copy is included in the LICENSE file that
15+ * accompanied this code).
16+ *
17+ * You should have received a copy of the GNU General Public License version
18+ * 2 along with this work; if not, write to the Free Software Foundation,
19+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
20+ *
21+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
22+ * or visit www.oracle.com if you need additional information or have any
23+ * questions.
24+ */
25+
26+package java.security.cert;
27+
28+import java.security.InvalidAlgorithmParameterException;
29+
30+/**
31+ * The <i>Service Provider Interface</i> (<b>SPI</b>)
32+ * for the {@link CertPathBuilder CertPathBuilder} class. All
33+ * <code>CertPathBuilder</code> implementations must include a class (the
34+ * SPI class) that extends this class (<code>CertPathBuilderSpi</code>) and
35+ * implements all of its methods. In general, instances of this class should
36+ * only be accessed through the <code>CertPathBuilder</code> class. For
37+ * details, see the Java Cryptography Architecture.
38+ * <p>
39+ * <b>Concurrent Access</b>
40+ * <p>
41+ * Instances of this class need not be protected against concurrent
42+ * access from multiple threads. Threads that need to access a single
43+ * <code>CertPathBuilderSpi</code> instance concurrently should synchronize
44+ * amongst themselves and provide the necessary locking before calling the
45+ * wrapping <code>CertPathBuilder</code> object.
46+ * <p>
47+ * However, implementations of <code>CertPathBuilderSpi</code> may still
48+ * encounter concurrency issues, since multiple threads each
49+ * manipulating a different <code>CertPathBuilderSpi</code> instance need not
50+ * synchronize.
51+ *
52+ * @since 1.4
53+ * @author Sean Mullan
54+ */
55+public abstract class CertPathBuilderSpi {
56+
57+ /**
58+ * The default constructor.
59+ */
60+ public CertPathBuilderSpi() { }
61+
62+ /**
63+ * Attempts to build a certification path using the specified
64+ * algorithm parameter set.
65+ *
66+ * @param params the algorithm parameters
67+ * @return the result of the build algorithm
68+ * @throws CertPathBuilderException if the builder is unable to construct
69+ * a certification path that satisfies the specified parameters
70+ * @throws InvalidAlgorithmParameterException if the specified parameters
71+ * are inappropriate for this <code>CertPathBuilder</code>
72+ */
73+ public abstract CertPathBuilderResult engineBuild(CertPathParameters params)
74+ throws CertPathBuilderException, InvalidAlgorithmParameterException;
75+}
java/pkg/java/security/cert/CertPathHelperImpl.class+0−0

Binary file not shown.

java/pkg/java/security/cert/CertPathHelperImpl.java+66−0
@@ -0,0 +1,66 @@
1+/*
2+ * Copyright (c) 2002, 2009, Oracle and/or its affiliates. All rights reserved.
3+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
4+ *
5+ * This code is free software; you can redistribute it and/or modify it
6+ * under the terms of the GNU General Public License version 2 only, as
7+ * published by the Free Software Foundation. Oracle designates this
8+ * particular file as subject to the "Classpath" exception as provided
9+ * by Oracle in the LICENSE file that accompanied this code.
10+ *
11+ * This code is distributed in the hope that it will be useful, but WITHOUT
12+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
13+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
14+ * version 2 for more details (a copy is included in the LICENSE file that
15+ * accompanied this code).
16+ *
17+ * You should have received a copy of the GNU General Public License version
18+ * 2 along with this work; if not, write to the Free Software Foundation,
19+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
20+ *
21+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
22+ * or visit www.oracle.com if you need additional information or have any
23+ * questions.
24+ */
25+
26+package java.security.cert;
27+
28+import java.util.*;
29+
30+import sun.security.provider.certpath.CertPathHelper;
31+
32+import sun.security.x509.GeneralNameInterface;
33+
34+/**
35+ * Helper class that allows the Sun CertPath provider to access
36+ * implementation dependent APIs in CertPath framework.
37+ *
38+ * @author Andreas Sterbenz
39+ */
40+class CertPathHelperImpl extends CertPathHelper {
41+
42+ private CertPathHelperImpl() {
43+ // empty
44+ }
45+
46+ /**
47+ * Initialize the helper framework. This method must be called from
48+ * the static initializer of each class that is the target of one of
49+ * the methods in this class. This ensures that the helper is initialized
50+ * prior to a tunneled call from the Sun provider.
51+ */
52+ synchronized static void initialize() {
53+ if (CertPathHelper.instance == null) {
54+ CertPathHelper.instance = new CertPathHelperImpl();
55+ }
56+ }
57+
58+ protected void implSetPathToNames(X509CertSelector sel,
59+ Set<GeneralNameInterface> names) {
60+ sel.setPathToNamesInternal(names);
61+ }
62+
63+ protected void implSetDateAndTime(X509CRLSelector sel, Date date, long skew) {
64+ sel.setDateAndTime(date, skew);
65+ }
66+}
java/pkg/java/security/cert/CertPathParameters.class+0−0

Binary file not shown.

java/pkg/java/security/cert/CertPathParameters.java+49−0
@@ -0,0 +1,49 @@
1+/*
2+ * Copyright (c) 2000, 2001, Oracle and/or its affiliates. All rights reserved.
3+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
4+ *
5+ * This code is free software; you can redistribute it and/or modify it
6+ * under the terms of the GNU General Public License version 2 only, as
7+ * published by the Free Software Foundation. Oracle designates this
8+ * particular file as subject to the "Classpath" exception as provided
9+ * by Oracle in the LICENSE file that accompanied this code.
10+ *
11+ * This code is distributed in the hope that it will be useful, but WITHOUT
12+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
13+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
14+ * version 2 for more details (a copy is included in the LICENSE file that
15+ * accompanied this code).
16+ *
17+ * You should have received a copy of the GNU General Public License version
18+ * 2 along with this work; if not, write to the Free Software Foundation,
19+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
20+ *
21+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
22+ * or visit www.oracle.com if you need additional information or have any
23+ * questions.
24+ */
25+
26+package java.security.cert;
27+
28+/**
29+ * A specification of certification path algorithm parameters.
30+ * The purpose of this interface is to group (and provide type safety for)
31+ * all <code>CertPath</code> parameter specifications. All
32+ * <code>CertPath</code> parameter specifications must implement this
33+ * interface.
34+ *
35+ * @author Yassir Elley
36+ * @see CertPathValidator#validate(CertPath, CertPathParameters)
37+ * @see CertPathBuilder#build(CertPathParameters)
38+ * @since 1.4
39+ */
40+public interface CertPathParameters extends Cloneable {
41+
42+ /**
43+ * Makes a copy of this <code>CertPathParameters</code>. Changes to the
44+ * copy will not affect the original and vice versa.
45+ *
46+ * @return a copy of this <code>CertPathParameters</code>
47+ */
48+ Object clone();
49+}
java/pkg/java/security/cert/CertPathValidator$1.class+0−0

Binary file not shown.

java/pkg/java/security/cert/CertPathValidator.class+0−0

Binary file not shown.

java/pkg/java/security/cert/CertPathValidator.java+315−0
@@ -0,0 +1,315 @@
1+/*
2+ * Copyright (c) 2000, 2011, Oracle and/or its affiliates. All rights reserved.
3+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
4+ *
5+ * This code is free software; you can redistribute it and/or modify it
6+ * under the terms of the GNU General Public License version 2 only, as
7+ * published by the Free Software Foundation. Oracle designates this
8+ * particular file as subject to the "Classpath" exception as provided
9+ * by Oracle in the LICENSE file that accompanied this code.
10+ *
11+ * This code is distributed in the hope that it will be useful, but WITHOUT
12+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
13+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
14+ * version 2 for more details (a copy is included in the LICENSE file that
15+ * accompanied this code).
16+ *
17+ * You should have received a copy of the GNU General Public License version
18+ * 2 along with this work; if not, write to the Free Software Foundation,
19+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
20+ *
21+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
22+ * or visit www.oracle.com if you need additional information or have any
23+ * questions.
24+ */
25+
26+package java.security.cert;
27+
28+import java.security.AccessController;
29+import java.security.InvalidAlgorithmParameterException;
30+import java.security.NoSuchAlgorithmException;
31+import java.security.NoSuchProviderException;
32+import java.security.PrivilegedAction;
33+import java.security.Provider;
34+import java.security.Security;
35+import sun.security.util.Debug;
36+
37+import sun.security.jca.*;
38+import sun.security.jca.GetInstance.Instance;
39+
40+/**
41+ * A class for validating certification paths (also known as certificate
42+ * chains).
43+ * <p>
44+ * This class uses a provider-based architecture.
45+ * To create a <code>CertPathValidator</code>,
46+ * call one of the static <code>getInstance</code> methods, passing in the
47+ * algorithm name of the <code>CertPathValidator</code> desired and
48+ * optionally the name of the provider desired.
49+ * <p>
50+ * Once a <code>CertPathValidator</code> object has been created, it can
51+ * be used to validate certification paths by calling the {@link #validate
52+ * validate} method and passing it the <code>CertPath</code> to be validated
53+ * and an algorithm-specific set of parameters. If successful, the result is
54+ * returned in an object that implements the
55+ * <code>CertPathValidatorResult</code> interface.
56+ *
57+ * <p> Every implementation of the Java platform is required to support the
58+ * following standard <code>CertPathValidator</code> algorithm:
59+ * <ul>
60+ * <li><tt>PKIX</tt></li>
61+ * </ul>
62+ * This algorithm is described in the <a href=
63+ * "{@docRoot}/../technotes/guides/security/StandardNames.html#CertPathValidator">
64+ * CertPathValidator section</a> of the
65+ * Java Cryptography Architecture Standard Algorithm Name Documentation.
66+ * Consult the release documentation for your implementation to see if any
67+ * other algorithms are supported.
68+ *
69+ * <p>
70+ * <b>Concurrent Access</b>
71+ * <p>
72+ * The static methods of this class are guaranteed to be thread-safe.
73+ * Multiple threads may concurrently invoke the static methods defined in
74+ * this class with no ill effects.
75+ * <p>
76+ * However, this is not true for the non-static methods defined by this class.
77+ * Unless otherwise documented by a specific provider, threads that need to
78+ * access a single <code>CertPathValidator</code> instance concurrently should
79+ * synchronize amongst themselves and provide the necessary locking. Multiple
80+ * threads each manipulating a different <code>CertPathValidator</code>
81+ * instance need not synchronize.
82+ *
83+ * @see CertPath
84+ *
85+ * @since 1.4
86+ * @author Yassir Elley
87+ */
88+public class CertPathValidator {
89+
90+ /*
91+ * Constant to lookup in the Security properties file to determine
92+ * the default certpathvalidator type. In the Security properties file,
93+ * the default certpathvalidator type is given as:
94+ * <pre>
95+ * certpathvalidator.type=PKIX
96+ * </pre>
97+ */
98+ private static final String CPV_TYPE = "certpathvalidator.type";
99+ private static final Debug debug = Debug.getInstance("certpath");
100+ private CertPathValidatorSpi validatorSpi;
101+ private Provider provider;
102+ private String algorithm;
103+
104+ /**
105+ * Creates a <code>CertPathValidator</code> object of the given algorithm,
106+ * and encapsulates the given provider implementation (SPI object) in it.
107+ *
108+ * @param validatorSpi the provider implementation
109+ * @param provider the provider
110+ * @param algorithm the algorithm name
111+ */
112+ protected CertPathValidator(CertPathValidatorSpi validatorSpi,
113+ Provider provider, String algorithm)
114+ {
115+ this.validatorSpi = validatorSpi;
116+ this.provider = provider;
117+ this.algorithm = algorithm;
118+ }
119+
120+ /**
121+ * Returns a <code>CertPathValidator</code> object that implements the
122+ * specified algorithm.
123+ *
124+ * <p> This method traverses the list of registered security Providers,
125+ * starting with the most preferred Provider.
126+ * A new CertPathValidator object encapsulating the
127+ * CertPathValidatorSpi implementation from the first
128+ * Provider that supports the specified algorithm is returned.
129+ *
130+ * <p> Note that the list of registered providers may be retrieved via
131+ * the {@link Security#getProviders() Security.getProviders()} method.
132+ *
133+ * @param algorithm the name of the requested <code>CertPathValidator</code>
134+ * algorithm. See the CertPathValidator section in the <a href=
135+ * "{@docRoot}/../technotes/guides/security/StandardNames.html#CertPathValidator">
136+ * Java Cryptography Architecture Standard Algorithm Name Documentation</a>
137+ * for information about standard algorithm names.
138+ *
139+ * @return a <code>CertPathValidator</code> object that implements the
140+ * specified algorithm.
141+ *
142+ * @exception NoSuchAlgorithmException if no Provider supports a
143+ * CertPathValidatorSpi implementation for the
144+ * specified algorithm.
145+ *
146+ * @see java.security.Provider
147+ */
148+ public static CertPathValidator getInstance(String algorithm)
149+ throws NoSuchAlgorithmException {
150+ Instance instance = GetInstance.getInstance("CertPathValidator",
151+ CertPathValidatorSpi.class, algorithm);
152+ return new CertPathValidator((CertPathValidatorSpi)instance.impl,
153+ instance.provider, algorithm);
154+ }
155+
156+ /**
157+ * Returns a <code>CertPathValidator</code> object that implements the
158+ * specified algorithm.
159+ *
160+ * <p> A new CertPathValidator object encapsulating the
161+ * CertPathValidatorSpi implementation from the specified provider
162+ * is returned. The specified provider must be registered
163+ * in the security provider list.
164+ *
165+ * <p> Note that the list of registered providers may be retrieved via
166+ * the {@link Security#getProviders() Security.getProviders()} method.
167+ *
168+ * @param algorithm the name of the requested <code>CertPathValidator</code>
169+ * algorithm. See the CertPathValidator section in the <a href=
170+ * "{@docRoot}/../technotes/guides/security/StandardNames.html#CertPathValidator">
171+ * Java Cryptography Architecture Standard Algorithm Name Documentation</a>
172+ * for information about standard algorithm names.
173+ *
174+ * @param provider the name of the provider.
175+ *
176+ * @return a <code>CertPathValidator</code> object that implements the
177+ * specified algorithm.
178+ *
179+ * @exception NoSuchAlgorithmException if a CertPathValidatorSpi
180+ * implementation for the specified algorithm is not
181+ * available from the specified provider.
182+ *
183+ * @exception NoSuchProviderException if the specified provider is not
184+ * registered in the security provider list.
185+ *
186+ * @exception IllegalArgumentException if the <code>provider</code> is
187+ * null or empty.
188+ *
189+ * @see java.security.Provider
190+ */
191+ public static CertPathValidator getInstance(String algorithm,
192+ String provider) throws NoSuchAlgorithmException,
193+ NoSuchProviderException {
194+ Instance instance = GetInstance.getInstance("CertPathValidator",
195+ CertPathValidatorSpi.class, algorithm, provider);
196+ return new CertPathValidator((CertPathValidatorSpi)instance.impl,
197+ instance.provider, algorithm);
198+ }
199+
200+ /**
201+ * Returns a <code>CertPathValidator</code> object that implements the
202+ * specified algorithm.
203+ *
204+ * <p> A new CertPathValidator object encapsulating the
205+ * CertPathValidatorSpi implementation from the specified Provider
206+ * object is returned. Note that the specified Provider object
207+ * does not have to be registered in the provider list.
208+ *
209+ * @param algorithm the name of the requested <code>CertPathValidator</code>
210+ * algorithm. See the CertPathValidator section in the <a href=
211+ * "{@docRoot}/../technotes/guides/security/StandardNames.html#CertPathValidator">
212+ * Java Cryptography Architecture Standard Algorithm Name Documentation</a>
213+ * for information about standard algorithm names.
214+ *
215+ * @param provider the provider.
216+ *
217+ * @return a <code>CertPathValidator</code> object that implements the
218+ * specified algorithm.
219+ *
220+ * @exception NoSuchAlgorithmException if a CertPathValidatorSpi
221+ * implementation for the specified algorithm is not available
222+ * from the specified Provider object.
223+ *
224+ * @exception IllegalArgumentException if the <code>provider</code> is
225+ * null.
226+ *
227+ * @see java.security.Provider
228+ */
229+ public static CertPathValidator getInstance(String algorithm,
230+ Provider provider) throws NoSuchAlgorithmException {
231+ Instance instance = GetInstance.getInstance("CertPathValidator",
232+ CertPathValidatorSpi.class, algorithm, provider);
233+ return new CertPathValidator((CertPathValidatorSpi)instance.impl,
234+ instance.provider, algorithm);
235+ }
236+
237+ /**
238+ * Returns the <code>Provider</code> of this
239+ * <code>CertPathValidator</code>.
240+ *
241+ * @return the <code>Provider</code> of this <code>CertPathValidator</code>
242+ */
243+ public final Provider getProvider() {
244+ return this.provider;
245+ }
246+
247+ /**
248+ * Returns the algorithm name of this <code>CertPathValidator</code>.
249+ *
250+ * @return the algorithm name of this <code>CertPathValidator</code>
251+ */
252+ public final String getAlgorithm() {
253+ return this.algorithm;
254+ }
255+
256+ /**
257+ * Validates the specified certification path using the specified
258+ * algorithm parameter set.
259+ * <p>
260+ * The <code>CertPath</code> specified must be of a type that is
261+ * supported by the validation algorithm, otherwise an
262+ * <code>InvalidAlgorithmParameterException</code> will be thrown. For
263+ * example, a <code>CertPathValidator</code> that implements the PKIX
264+ * algorithm validates <code>CertPath</code> objects of type X.509.
265+ *
266+ * @param certPath the <code>CertPath</code> to be validated
267+ * @param params the algorithm parameters
268+ * @return the result of the validation algorithm
269+ * @exception CertPathValidatorException if the <code>CertPath</code>
270+ * does not validate
271+ * @exception InvalidAlgorithmParameterException if the specified
272+ * parameters or the type of the specified <code>CertPath</code> are
273+ * inappropriate for this <code>CertPathValidator</code>
274+ */
275+ public final CertPathValidatorResult validate(CertPath certPath,
276+ CertPathParameters params)
277+ throws CertPathValidatorException, InvalidAlgorithmParameterException
278+ {
279+ return validatorSpi.engineValidate(certPath, params);
280+ }
281+
282+ /**
283+ * Returns the default <code>CertPathValidator</code> type as specified in
284+ * the Java security properties file, or the string &quot;PKIX&quot;
285+ * if no such property exists. The Java security properties file is
286+ * located in the file named &lt;JAVA_HOME&gt;/lib/security/java.security.
287+ * &lt;JAVA_HOME&gt; refers to the value of the java.home system property,
288+ * and specifies the directory where the JRE is installed.
289+ *
290+ * <p>The default <code>CertPathValidator</code> type can be used by
291+ * applications that do not want to use a hard-coded type when calling one
292+ * of the <code>getInstance</code> methods, and want to provide a default
293+ * type in case a user does not specify its own.
294+ *
295+ * <p>The default <code>CertPathValidator</code> type can be changed by
296+ * setting the value of the "certpathvalidator.type" security property
297+ * (in the Java security properties file) to the desired type.
298+ *
299+ * @return the default <code>CertPathValidator</code> type as specified
300+ * in the Java security properties file, or the string &quot;PKIX&quot;
301+ * if no such property exists.
302+ */
303+ public final static String getDefaultType() {
304+ String cpvtype;
305+ cpvtype = AccessController.doPrivileged(new PrivilegedAction<String>() {
306+ public String run() {
307+ return Security.getProperty(CPV_TYPE);
308+ }
309+ });
310+ if (cpvtype == null) {
311+ cpvtype = "PKIX";
312+ }
313+ return cpvtype;
314+ }
315+}
java/pkg/java/security/cert/CertPathValidatorException$BasicReason.class+0−0

Binary file not shown.

java/pkg/java/security/cert/CertPathValidatorException$Reason.class+0−0

Binary file not shown.

java/pkg/java/security/cert/CertPathValidatorException.class+0−0

Binary file not shown.

java/pkg/java/security/cert/CertPathValidatorException.java+296−0
@@ -0,0 +1,296 @@
1+/*
2+ * Copyright (c) 2000, 2011, Oracle and/or its affiliates. All rights reserved.
3+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
4+ *
5+ * This code is free software; you can redistribute it and/or modify it
6+ * under the terms of the GNU General Public License version 2 only, as
7+ * published by the Free Software Foundation. Oracle designates this
8+ * particular file as subject to the "Classpath" exception as provided
9+ * by Oracle in the LICENSE file that accompanied this code.
10+ *
11+ * This code is distributed in the hope that it will be useful, but WITHOUT
12+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
13+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
14+ * version 2 for more details (a copy is included in the LICENSE file that
15+ * accompanied this code).
16+ *
17+ * You should have received a copy of the GNU General Public License version
18+ * 2 along with this work; if not, write to the Free Software Foundation,
19+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
20+ *
21+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
22+ * or visit www.oracle.com if you need additional information or have any
23+ * questions.
24+ */
25+
26+package java.security.cert;
27+
28+import java.io.InvalidObjectException;
29+import java.io.IOException;
30+import java.io.ObjectInputStream;
31+import java.security.GeneralSecurityException;
32+
33+/**
34+ * An exception indicating one of a variety of problems encountered when
35+ * validating a certification path.
36+ * <p>
37+ * A <code>CertPathValidatorException</code> provides support for wrapping
38+ * exceptions. The {@link #getCause getCause} method returns the throwable,
39+ * if any, that caused this exception to be thrown.
40+ * <p>
41+ * A <code>CertPathValidatorException</code> may also include the
42+ * certification path that was being validated when the exception was thrown,
43+ * the index of the certificate in the certification path that caused the
44+ * exception to be thrown, and the reason that caused the failure. Use the
45+ * {@link #getCertPath getCertPath}, {@link #getIndex getIndex}, and
46+ * {@link #getReason getReason} methods to retrieve this information.
47+ *
48+ * <p>
49+ * <b>Concurrent Access</b>
50+ * <p>
51+ * Unless otherwise specified, the methods defined in this class are not
52+ * thread-safe. Multiple threads that need to access a single
53+ * object concurrently should synchronize amongst themselves and
54+ * provide the necessary locking. Multiple threads each manipulating
55+ * separate objects need not synchronize.
56+ *
57+ * @see CertPathValidator
58+ *
59+ * @since 1.4
60+ * @author Yassir Elley
61+ */
62+public class CertPathValidatorException extends GeneralSecurityException {
63+
64+ private static final long serialVersionUID = -3083180014971893139L;
65+
66+ /**
67+ * @serial the index of the certificate in the certification path
68+ * that caused the exception to be thrown
69+ */
70+ private int index = -1;
71+
72+ /**
73+ * @serial the <code>CertPath</code> that was being validated when
74+ * the exception was thrown
75+ */
76+ private CertPath certPath;
77+
78+ /**
79+ * @serial the reason the validation failed
80+ */
81+ private Reason reason = BasicReason.UNSPECIFIED;
82+
83+ /**
84+ * Creates a <code>CertPathValidatorException</code> with
85+ * no detail message.
86+ */
87+ public CertPathValidatorException() {
88+ this(null, null);
89+ }
90+
91+ /**
92+ * Creates a <code>CertPathValidatorException</code> with the given
93+ * detail message. A detail message is a <code>String</code> that
94+ * describes this particular exception.
95+ *
96+ * @param msg the detail message
97+ */
98+ public CertPathValidatorException(String msg) {
99+ this(msg, null);
100+ }
101+
102+ /**
103+ * Creates a <code>CertPathValidatorException</code> that wraps the
104+ * specified throwable. This allows any exception to be converted into a
105+ * <code>CertPathValidatorException</code>, while retaining information
106+ * about the wrapped exception, which may be useful for debugging. The
107+ * detail message is set to (<code>cause==null ? null : cause.toString()
108+ * </code>) (which typically contains the class and detail message of
109+ * cause).
110+ *
111+ * @param cause the cause (which is saved for later retrieval by the
112+ * {@link #getCause getCause()} method). (A <code>null</code> value is
113+ * permitted, and indicates that the cause is nonexistent or unknown.)
114+ */
115+ public CertPathValidatorException(Throwable cause) {
116+ this((cause == null ? null : cause.toString()), cause);
117+ }
118+
119+ /**
120+ * Creates a <code>CertPathValidatorException</code> with the specified
121+ * detail message and cause.
122+ *
123+ * @param msg the detail message
124+ * @param cause the cause (which is saved for later retrieval by the
125+ * {@link #getCause getCause()} method). (A <code>null</code> value is
126+ * permitted, and indicates that the cause is nonexistent or unknown.)
127+ */
128+ public CertPathValidatorException(String msg, Throwable cause) {
129+ this(msg, cause, null, -1);
130+ }
131+
132+ /**
133+ * Creates a <code>CertPathValidatorException</code> with the specified
134+ * detail message, cause, certification path, and index.
135+ *
136+ * @param msg the detail message (or <code>null</code> if none)
137+ * @param cause the cause (or <code>null</code> if none)
138+ * @param certPath the certification path that was in the process of
139+ * being validated when the error was encountered
140+ * @param index the index of the certificate in the certification path
141+ * that caused the error (or -1 if not applicable). Note that
142+ * the list of certificates in a <code>CertPath</code> is zero based.
143+ * @throws IndexOutOfBoundsException if the index is out of range
144+ * <code>(index < -1 || (certPath != null && index >=
145+ * certPath.getCertificates().size())</code>
146+ * @throws IllegalArgumentException if <code>certPath</code> is
147+ * <code>null</code> and <code>index</code> is not -1
148+ */
149+ public CertPathValidatorException(String msg, Throwable cause,
150+ CertPath certPath, int index) {
151+ this(msg, cause, certPath, index, BasicReason.UNSPECIFIED);
152+ }
153+
154+ /**
155+ * Creates a <code>CertPathValidatorException</code> with the specified
156+ * detail message, cause, certification path, index, and reason.
157+ *
158+ * @param msg the detail message (or <code>null</code> if none)
159+ * @param cause the cause (or <code>null</code> if none)
160+ * @param certPath the certification path that was in the process of
161+ * being validated when the error was encountered
162+ * @param index the index of the certificate in the certification path
163+ * that caused the error (or -1 if not applicable). Note that
164+ * the list of certificates in a <code>CertPath</code> is zero based.
165+ * @param reason the reason the validation failed
166+ * @throws IndexOutOfBoundsException if the index is out of range
167+ * <code>(index < -1 || (certPath != null && index >=
168+ * certPath.getCertificates().size())</code>
169+ * @throws IllegalArgumentException if <code>certPath</code> is
170+ * <code>null</code> and <code>index</code> is not -1
171+ * @throws NullPointerException if <code>reason</code> is <code>null</code>
172+ *
173+ * @since 1.7
174+ */
175+ public CertPathValidatorException(String msg, Throwable cause,
176+ CertPath certPath, int index, Reason reason) {
177+ super(msg, cause);
178+ if (certPath == null && index != -1) {
179+ throw new IllegalArgumentException();
180+ }
181+ if (index < -1 ||
182+ (certPath != null && index >= certPath.getCertificates().size())) {
183+ throw new IndexOutOfBoundsException();
184+ }
185+ if (reason == null) {
186+ throw new NullPointerException("reason can't be null");
187+ }
188+ this.certPath = certPath;
189+ this.index = index;
190+ this.reason = reason;
191+ }
192+
193+ /**
194+ * Returns the certification path that was being validated when
195+ * the exception was thrown.
196+ *
197+ * @return the <code>CertPath</code> that was being validated when
198+ * the exception was thrown (or <code>null</code> if not specified)
199+ */
200+ public CertPath getCertPath() {
201+ return this.certPath;
202+ }
203+
204+ /**
205+ * Returns the index of the certificate in the certification path
206+ * that caused the exception to be thrown. Note that the list of
207+ * certificates in a <code>CertPath</code> is zero based. If no
208+ * index has been set, -1 is returned.
209+ *
210+ * @return the index that has been set, or -1 if none has been set
211+ */
212+ public int getIndex() {
213+ return this.index;
214+ }
215+
216+ /**
217+ * Returns the reason that the validation failed. The reason is
218+ * associated with the index of the certificate returned by
219+ * {@link #getIndex}.
220+ *
221+ * @return the reason that the validation failed, or
222+ * <code>BasicReason.UNSPECIFIED</code> if a reason has not been
223+ * specified
224+ *
225+ * @since 1.7
226+ */
227+ public Reason getReason() {
228+ return this.reason;
229+ }
230+
231+ private void readObject(ObjectInputStream stream)
232+ throws ClassNotFoundException, IOException {
233+ stream.defaultReadObject();
234+ if (reason == null) {
235+ reason = BasicReason.UNSPECIFIED;
236+ }
237+ if (certPath == null && index != -1) {
238+ throw new InvalidObjectException("certpath is null and index != -1");
239+ }
240+ if (index < -1 ||
241+ (certPath != null && index >= certPath.getCertificates().size())) {
242+ throw new InvalidObjectException("index out of range");
243+ }
244+ }
245+
246+ /**
247+ * The reason the validation algorithm failed.
248+ *
249+ * @since 1.7
250+ */
251+ public static interface Reason extends java.io.Serializable { }
252+
253+
254+ /**
255+ * The BasicReason enumerates the potential reasons that a certification
256+ * path of any type may be invalid.
257+ *
258+ * @since 1.7
259+ */
260+ public static enum BasicReason implements Reason {
261+ /**
262+ * Unspecified reason.
263+ */
264+ UNSPECIFIED,
265+
266+ /**
267+ * The certificate is expired.
268+ */
269+ EXPIRED,
270+
271+ /**
272+ * The certificate is not yet valid.
273+ */
274+ NOT_YET_VALID,
275+
276+ /**
277+ * The certificate is revoked.
278+ */
279+ REVOKED,
280+
281+ /**
282+ * The revocation status of the certificate could not be determined.
283+ */
284+ UNDETERMINED_REVOCATION_STATUS,
285+
286+ /**
287+ * The signature is invalid.
288+ */
289+ INVALID_SIGNATURE,
290+
291+ /**
292+ * The public key or the signature algorithm has been constrained.
293+ */
294+ ALGORITHM_CONSTRAINED
295+ }
296+}
java/pkg/java/security/cert/CertPathValidatorResult.class+0−0

Binary file not shown.

java/pkg/java/security/cert/CertPathValidatorResult.java+50−0
@@ -0,0 +1,50 @@
1+/*
2+ * Copyright (c) 2000, 2001, Oracle and/or its affiliates. All rights reserved.
3+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
4+ *
5+ * This code is free software; you can redistribute it and/or modify it
6+ * under the terms of the GNU General Public License version 2 only, as
7+ * published by the Free Software Foundation. Oracle designates this
8+ * particular file as subject to the "Classpath" exception as provided
9+ * by Oracle in the LICENSE file that accompanied this code.
10+ *
11+ * This code is distributed in the hope that it will be useful, but WITHOUT
12+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
13+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
14+ * version 2 for more details (a copy is included in the LICENSE file that
15+ * accompanied this code).
16+ *
17+ * You should have received a copy of the GNU General Public License version
18+ * 2 along with this work; if not, write to the Free Software Foundation,
19+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
20+ *
21+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
22+ * or visit www.oracle.com if you need additional information or have any
23+ * questions.
24+ */
25+
26+package java.security.cert;
27+
28+/**
29+ * A specification of the result of a certification path validator algorithm.
30+ * <p>
31+ * The purpose of this interface is to group (and provide type safety
32+ * for) all certification path validator results. All results returned
33+ * by the {@link CertPathValidator#validate CertPathValidator.validate}
34+ * method must implement this interface.
35+ *
36+ * @see CertPathValidator
37+ *
38+ * @since 1.4
39+ * @author Yassir Elley
40+ */
41+public interface CertPathValidatorResult extends Cloneable {
42+
43+ /**
44+ * Makes a copy of this <code>CertPathValidatorResult</code>. Changes to the
45+ * copy will not affect the original and vice versa.
46+ *
47+ * @return a copy of this <code>CertPathValidatorResult</code>
48+ */
49+ Object clone();
50+}
java/pkg/java/security/cert/CertPathValidatorSpi.class+0−0

Binary file not shown.

java/pkg/java/security/cert/CertPathValidatorSpi.java+85−0
@@ -0,0 +1,85 @@
1+/*
2+ * Copyright (c) 2000, 2001, Oracle and/or its affiliates. All rights reserved.
3+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
4+ *
5+ * This code is free software; you can redistribute it and/or modify it
6+ * under the terms of the GNU General Public License version 2 only, as
7+ * published by the Free Software Foundation. Oracle designates this
8+ * particular file as subject to the "Classpath" exception as provided
9+ * by Oracle in the LICENSE file that accompanied this code.
10+ *
11+ * This code is distributed in the hope that it will be useful, but WITHOUT
12+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
13+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
14+ * version 2 for more details (a copy is included in the LICENSE file that
15+ * accompanied this code).
16+ *
17+ * You should have received a copy of the GNU General Public License version
18+ * 2 along with this work; if not, write to the Free Software Foundation,
19+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
20+ *
21+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
22+ * or visit www.oracle.com if you need additional information or have any
23+ * questions.
24+ */
25+
26+package java.security.cert;
27+
28+import java.security.InvalidAlgorithmParameterException;
29+
30+/**
31+ *
32+ * The <i>Service Provider Interface</i> (<b>SPI</b>)
33+ * for the {@link CertPathValidator CertPathValidator} class. All
34+ * <code>CertPathValidator</code> implementations must include a class (the
35+ * SPI class) that extends this class (<code>CertPathValidatorSpi</code>)
36+ * and implements all of its methods. In general, instances of this class
37+ * should only be accessed through the <code>CertPathValidator</code> class.
38+ * For details, see the Java Cryptography Architecture.
39+ * <p>
40+ * <b>Concurrent Access</b>
41+ * <p>
42+ * Instances of this class need not be protected against concurrent
43+ * access from multiple threads. Threads that need to access a single
44+ * <code>CertPathValidatorSpi</code> instance concurrently should synchronize
45+ * amongst themselves and provide the necessary locking before calling the
46+ * wrapping <code>CertPathValidator</code> object.
47+ * <p>
48+ * However, implementations of <code>CertPathValidatorSpi</code> may still
49+ * encounter concurrency issues, since multiple threads each
50+ * manipulating a different <code>CertPathValidatorSpi</code> instance need not
51+ * synchronize.
52+ *
53+ * @since 1.4
54+ * @author Yassir Elley
55+ */
56+public abstract class CertPathValidatorSpi {
57+
58+ /**
59+ * The default constructor.
60+ */
61+ public CertPathValidatorSpi() {}
62+
63+ /**
64+ * Validates the specified certification path using the specified
65+ * algorithm parameter set.
66+ * <p>
67+ * The <code>CertPath</code> specified must be of a type that is
68+ * supported by the validation algorithm, otherwise an
69+ * <code>InvalidAlgorithmParameterException</code> will be thrown. For
70+ * example, a <code>CertPathValidator</code> that implements the PKIX
71+ * algorithm validates <code>CertPath</code> objects of type X.509.
72+ *
73+ * @param certPath the <code>CertPath</code> to be validated
74+ * @param params the algorithm parameters
75+ * @return the result of the validation algorithm
76+ * @exception CertPathValidatorException if the <code>CertPath</code>
77+ * does not validate
78+ * @exception InvalidAlgorithmParameterException if the specified
79+ * parameters or the type of the specified <code>CertPath</code> are
80+ * inappropriate for this <code>CertPathValidator</code>
81+ */
82+ public abstract CertPathValidatorResult
83+ engineValidate(CertPath certPath, CertPathParameters params)
84+ throws CertPathValidatorException, InvalidAlgorithmParameterException;
85+}
java/pkg/java/security/cert/CertSelector.class+0−0

Binary file not shown.

java/pkg/java/security/cert/CertSelector.java+67−0
@@ -0,0 +1,67 @@
1+/*
2+ * Copyright (c) 2000, 2001, Oracle and/or its affiliates. All rights reserved.
3+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
4+ *
5+ * This code is free software; you can redistribute it and/or modify it
6+ * under the terms of the GNU General Public License version 2 only, as
7+ * published by the Free Software Foundation. Oracle designates this
8+ * particular file as subject to the "Classpath" exception as provided
9+ * by Oracle in the LICENSE file that accompanied this code.
10+ *
11+ * This code is distributed in the hope that it will be useful, but WITHOUT
12+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
13+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
14+ * version 2 for more details (a copy is included in the LICENSE file that
15+ * accompanied this code).
16+ *
17+ * You should have received a copy of the GNU General Public License version
18+ * 2 along with this work; if not, write to the Free Software Foundation,
19+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
20+ *
21+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
22+ * or visit www.oracle.com if you need additional information or have any
23+ * questions.
24+ */
25+
26+package java.security.cert;
27+
28+/**
29+ * A selector that defines a set of criteria for selecting
30+ * <code>Certificate</code>s. Classes that implement this interface
31+ * are often used to specify which <code>Certificate</code>s should
32+ * be retrieved from a <code>CertStore</code>.
33+ * <p>
34+ * <b>Concurrent Access</b>
35+ * <p>
36+ * Unless otherwise specified, the methods defined in this interface are not
37+ * thread-safe. Multiple threads that need to access a single
38+ * object concurrently should synchronize amongst themselves and
39+ * provide the necessary locking. Multiple threads each manipulating
40+ * separate objects need not synchronize.
41+ *
42+ * @see Certificate
43+ * @see CertStore
44+ * @see CertStore#getCertificates
45+ *
46+ * @author Steve Hanna
47+ * @since 1.4
48+ */
49+public interface CertSelector extends Cloneable {
50+
51+ /**
52+ * Decides whether a <code>Certificate</code> should be selected.
53+ *
54+ * @param cert the <code>Certificate</code> to be checked
55+ * @return <code>true</code> if the <code>Certificate</code>
56+ * should be selected, <code>false</code> otherwise
57+ */
58+ boolean match(Certificate cert);
59+
60+ /**
61+ * Makes a copy of this <code>CertSelector</code>. Changes to the
62+ * copy will not affect the original and vice versa.
63+ *
64+ * @return a copy of this <code>CertSelector</code>
65+ */
66+ Object clone();
67+}
java/pkg/java/security/cert/CertStore$1.class+0−0

Binary file not shown.

java/pkg/java/security/cert/CertStore.class+0−0

Binary file not shown.

java/pkg/java/security/cert/CertStore.java+424−0
@@ -0,0 +1,424 @@
1+/*
2+ * Copyright (c) 2000, 2011, Oracle and/or its affiliates. All rights reserved.
3+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
4+ *
5+ * This code is free software; you can redistribute it and/or modify it
6+ * under the terms of the GNU General Public License version 2 only, as
7+ * published by the Free Software Foundation. Oracle designates this
8+ * particular file as subject to the "Classpath" exception as provided
9+ * by Oracle in the LICENSE file that accompanied this code.
10+ *
11+ * This code is distributed in the hope that it will be useful, but WITHOUT
12+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
13+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
14+ * version 2 for more details (a copy is included in the LICENSE file that
15+ * accompanied this code).
16+ *
17+ * You should have received a copy of the GNU General Public License version
18+ * 2 along with this work; if not, write to the Free Software Foundation,
19+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
20+ *
21+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
22+ * or visit www.oracle.com if you need additional information or have any
23+ * questions.
24+ */
25+
26+package java.security.cert;
27+
28+import java.security.AccessController;
29+import java.security.InvalidAlgorithmParameterException;
30+import java.security.NoSuchAlgorithmException;
31+import java.security.NoSuchProviderException;
32+import java.security.PrivilegedAction;
33+import java.security.Provider;
34+import java.security.Security;
35+import java.util.Collection;
36+
37+import sun.security.jca.*;
38+import sun.security.jca.GetInstance.Instance;
39+
40+/**
41+ * A class for retrieving <code>Certificate</code>s and <code>CRL</code>s
42+ * from a repository.
43+ * <p>
44+ * This class uses a provider-based architecture.
45+ * To create a <code>CertStore</code>, call one of the static
46+ * <code>getInstance</code> methods, passing in the type of
47+ * <code>CertStore</code> desired, any applicable initialization parameters
48+ * and optionally the name of the provider desired.
49+ * <p>
50+ * Once the <code>CertStore</code> has been created, it can be used to
51+ * retrieve <code>Certificate</code>s and <code>CRL</code>s by calling its
52+ * {@link #getCertificates(CertSelector selector) getCertificates} and
53+ * {@link #getCRLs(CRLSelector selector) getCRLs} methods.
54+ * <p>
55+ * Unlike a {@link java.security.KeyStore KeyStore}, which provides access
56+ * to a cache of private keys and trusted certificates, a
57+ * <code>CertStore</code> is designed to provide access to a potentially
58+ * vast repository of untrusted certificates and CRLs. For example, an LDAP
59+ * implementation of <code>CertStore</code> provides access to certificates
60+ * and CRLs stored in one or more directories using the LDAP protocol and the
61+ * schema as defined in the RFC service attribute.
62+ *
63+ * <p> Every implementation of the Java platform is required to support the
64+ * following standard <code>CertStore</code> type:
65+ * <ul>
66+ * <li><tt>Collection</tt></li>
67+ * </ul>
68+ * This type is described in the <a href=
69+ * "{@docRoot}/../technotes/guides/security/StandardNames.html#CertStore">
70+ * CertStore section</a> of the
71+ * Java Cryptography Architecture Standard Algorithm Name Documentation.
72+ * Consult the release documentation for your implementation to see if any
73+ * other types are supported.
74+ *
75+ * <p>
76+ * <b>Concurrent Access</b>
77+ * <p>
78+ * All public methods of <code>CertStore</code> objects must be thread-safe.
79+ * That is, multiple threads may concurrently invoke these methods on a
80+ * single <code>CertStore</code> object (or more than one) with no
81+ * ill effects. This allows a <code>CertPathBuilder</code> to search for a
82+ * CRL while simultaneously searching for further certificates, for instance.
83+ * <p>
84+ * The static methods of this class are also guaranteed to be thread-safe.
85+ * Multiple threads may concurrently invoke the static methods defined in
86+ * this class with no ill effects.
87+ *
88+ * @since 1.4
89+ * @author Sean Mullan, Steve Hanna
90+ */
91+public class CertStore {
92+ /*
93+ * Constant to lookup in the Security properties file to determine
94+ * the default certstore type. In the Security properties file, the
95+ * default certstore type is given as:
96+ * <pre>
97+ * certstore.type=LDAP
98+ * </pre>
99+ */
100+ private static final String CERTSTORE_TYPE = "certstore.type";
101+ private CertStoreSpi storeSpi;
102+ private Provider provider;
103+ private String type;
104+ private CertStoreParameters params;
105+
106+ /**
107+ * Creates a <code>CertStore</code> object of the given type, and
108+ * encapsulates the given provider implementation (SPI object) in it.
109+ *
110+ * @param storeSpi the provider implementation
111+ * @param provider the provider
112+ * @param type the type
113+ * @param params the initialization parameters (may be <code>null</code>)
114+ */
115+ protected CertStore(CertStoreSpi storeSpi, Provider provider,
116+ String type, CertStoreParameters params) {
117+ this.storeSpi = storeSpi;
118+ this.provider = provider;
119+ this.type = type;
120+ if (params != null)
121+ this.params = (CertStoreParameters) params.clone();
122+ }
123+
124+ /**
125+ * Returns a <code>Collection</code> of <code>Certificate</code>s that
126+ * match the specified selector. If no <code>Certificate</code>s
127+ * match the selector, an empty <code>Collection</code> will be returned.
128+ * <p>
129+ * For some <code>CertStore</code> types, the resulting
130+ * <code>Collection</code> may not contain <b>all</b> of the
131+ * <code>Certificate</code>s that match the selector. For instance,
132+ * an LDAP <code>CertStore</code> may not search all entries in the
133+ * directory. Instead, it may just search entries that are likely to
134+ * contain the <code>Certificate</code>s it is looking for.
135+ * <p>
136+ * Some <code>CertStore</code> implementations (especially LDAP
137+ * <code>CertStore</code>s) may throw a <code>CertStoreException</code>
138+ * unless a non-null <code>CertSelector</code> is provided that
139+ * includes specific criteria that can be used to find the certificates.
140+ * Issuer and/or subject names are especially useful criteria.
141+ *
142+ * @param selector A <code>CertSelector</code> used to select which
143+ * <code>Certificate</code>s should be returned. Specify <code>null</code>
144+ * to return all <code>Certificate</code>s (if supported).
145+ * @return A <code>Collection</code> of <code>Certificate</code>s that
146+ * match the specified selector (never <code>null</code>)
147+ * @throws CertStoreException if an exception occurs
148+ */
149+ public final Collection<? extends Certificate> getCertificates
150+ (CertSelector selector) throws CertStoreException {
151+ return storeSpi.engineGetCertificates(selector);
152+ }
153+
154+ /**
155+ * Returns a <code>Collection</code> of <code>CRL</code>s that
156+ * match the specified selector. If no <code>CRL</code>s
157+ * match the selector, an empty <code>Collection</code> will be returned.
158+ * <p>
159+ * For some <code>CertStore</code> types, the resulting
160+ * <code>Collection</code> may not contain <b>all</b> of the
161+ * <code>CRL</code>s that match the selector. For instance,
162+ * an LDAP <code>CertStore</code> may not search all entries in the
163+ * directory. Instead, it may just search entries that are likely to
164+ * contain the <code>CRL</code>s it is looking for.
165+ * <p>
166+ * Some <code>CertStore</code> implementations (especially LDAP
167+ * <code>CertStore</code>s) may throw a <code>CertStoreException</code>
168+ * unless a non-null <code>CRLSelector</code> is provided that
169+ * includes specific criteria that can be used to find the CRLs.
170+ * Issuer names and/or the certificate to be checked are especially useful.
171+ *
172+ * @param selector A <code>CRLSelector</code> used to select which
173+ * <code>CRL</code>s should be returned. Specify <code>null</code>
174+ * to return all <code>CRL</code>s (if supported).
175+ * @return A <code>Collection</code> of <code>CRL</code>s that
176+ * match the specified selector (never <code>null</code>)
177+ * @throws CertStoreException if an exception occurs
178+ */
179+ public final Collection<? extends CRL> getCRLs(CRLSelector selector)
180+ throws CertStoreException {
181+ return storeSpi.engineGetCRLs(selector);
182+ }
183+
184+ /**
185+ * Returns a <code>CertStore</code> object that implements the specified
186+ * <code>CertStore</code> type and is initialized with the specified
187+ * parameters.
188+ *
189+ * <p> This method traverses the list of registered security Providers,
190+ * starting with the most preferred Provider.
191+ * A new CertStore object encapsulating the
192+ * CertStoreSpi implementation from the first
193+ * Provider that supports the specified type is returned.
194+ *
195+ * <p> Note that the list of registered providers may be retrieved via
196+ * the {@link Security#getProviders() Security.getProviders()} method.
197+ *
198+ * <p>The <code>CertStore</code> that is returned is initialized with the
199+ * specified <code>CertStoreParameters</code>. The type of parameters
200+ * needed may vary between different types of <code>CertStore</code>s.
201+ * Note that the specified <code>CertStoreParameters</code> object is
202+ * cloned.
203+ *
204+ * @param type the name of the requested <code>CertStore</code> type.
205+ * See the CertStore section in the <a href=
206+ * "{@docRoot}/../technotes/guides/security/StandardNames.html#CertStore">
207+ * Java Cryptography Architecture Standard Algorithm Name Documentation</a>
208+ * for information about standard types.
209+ *
210+ * @param params the initialization parameters (may be <code>null</code>).
211+ *
212+ * @return a <code>CertStore</code> object that implements the specified
213+ * <code>CertStore</code> type.
214+ *
215+ * @throws NoSuchAlgorithmException if no Provider supports a
216+ * CertStoreSpi implementation for the specified type.
217+ *
218+ * @throws InvalidAlgorithmParameterException if the specified
219+ * initialization parameters are inappropriate for this
220+ * <code>CertStore</code>.
221+ *
222+ * @see java.security.Provider
223+ */
224+ public static CertStore getInstance(String type, CertStoreParameters params)
225+ throws InvalidAlgorithmParameterException,
226+ NoSuchAlgorithmException {
227+ try {
228+ Instance instance = GetInstance.getInstance("CertStore",
229+ CertStoreSpi.class, type, params);
230+ return new CertStore((CertStoreSpi)instance.impl,
231+ instance.provider, type, params);
232+ } catch (NoSuchAlgorithmException e) {
233+ return handleException(e);
234+ }
235+ }
236+
237+ private static CertStore handleException(NoSuchAlgorithmException e)
238+ throws NoSuchAlgorithmException, InvalidAlgorithmParameterException {
239+ Throwable cause = e.getCause();
240+ if (cause instanceof InvalidAlgorithmParameterException) {
241+ throw (InvalidAlgorithmParameterException)cause;
242+ }
243+ throw e;
244+ }
245+
246+ /**
247+ * Returns a <code>CertStore</code> object that implements the specified
248+ * <code>CertStore</code> type.
249+ *
250+ * <p> A new CertStore object encapsulating the
251+ * CertStoreSpi implementation from the specified provider
252+ * is returned. The specified provider must be registered
253+ * in the security provider list.
254+ *
255+ * <p> Note that the list of registered providers may be retrieved via
256+ * the {@link Security#getProviders() Security.getProviders()} method.
257+ *
258+ * <p>The <code>CertStore</code> that is returned is initialized with the
259+ * specified <code>CertStoreParameters</code>. The type of parameters
260+ * needed may vary between different types of <code>CertStore</code>s.
261+ * Note that the specified <code>CertStoreParameters</code> object is
262+ * cloned.
263+ *
264+ * @param type the requested <code>CertStore</code> type.
265+ * See the CertStore section in the <a href=
266+ * "{@docRoot}/../technotes/guides/security/StandardNames.html#CertStore">
267+ * Java Cryptography Architecture Standard Algorithm Name Documentation</a>
268+ * for information about standard types.
269+ *
270+ * @param params the initialization parameters (may be <code>null</code>).
271+ *
272+ * @param provider the name of the provider.
273+ *
274+ * @return a <code>CertStore</code> object that implements the
275+ * specified type.
276+ *
277+ * @throws NoSuchAlgorithmException if a CertStoreSpi
278+ * implementation for the specified type is not
279+ * available from the specified provider.
280+ *
281+ * @throws InvalidAlgorithmParameterException if the specified
282+ * initialization parameters are inappropriate for this
283+ * <code>CertStore</code>.
284+ *
285+ * @throws NoSuchProviderException if the specified provider is not
286+ * registered in the security provider list.
287+ *
288+ * @exception IllegalArgumentException if the <code>provider</code> is
289+ * null or empty.
290+ *
291+ * @see java.security.Provider
292+ */
293+ public static CertStore getInstance(String type,
294+ CertStoreParameters params, String provider)
295+ throws InvalidAlgorithmParameterException,
296+ NoSuchAlgorithmException, NoSuchProviderException {
297+ try {
298+ Instance instance = GetInstance.getInstance("CertStore",
299+ CertStoreSpi.class, type, params, provider);
300+ return new CertStore((CertStoreSpi)instance.impl,
301+ instance.provider, type, params);
302+ } catch (NoSuchAlgorithmException e) {
303+ return handleException(e);
304+ }
305+ }
306+
307+ /**
308+ * Returns a <code>CertStore</code> object that implements the specified
309+ * <code>CertStore</code> type.
310+ *
311+ * <p> A new CertStore object encapsulating the
312+ * CertStoreSpi implementation from the specified Provider
313+ * object is returned. Note that the specified Provider object
314+ * does not have to be registered in the provider list.
315+ *
316+ * <p>The <code>CertStore</code> that is returned is initialized with the
317+ * specified <code>CertStoreParameters</code>. The type of parameters
318+ * needed may vary between different types of <code>CertStore</code>s.
319+ * Note that the specified <code>CertStoreParameters</code> object is
320+ * cloned.
321+ *
322+ * @param type the requested <code>CertStore</code> type.
323+ * See the CertStore section in the <a href=
324+ * "{@docRoot}/../technotes/guides/security/StandardNames.html#CertStore">
325+ * Java Cryptography Architecture Standard Algorithm Name Documentation</a>
326+ * for information about standard types.
327+ *
328+ * @param params the initialization parameters (may be <code>null</code>).
329+ *
330+ * @param provider the provider.
331+ *
332+ * @return a <code>CertStore</code> object that implements the
333+ * specified type.
334+ *
335+ * @exception NoSuchAlgorithmException if a CertStoreSpi
336+ * implementation for the specified type is not available
337+ * from the specified Provider object.
338+ *
339+ * @throws InvalidAlgorithmParameterException if the specified
340+ * initialization parameters are inappropriate for this
341+ * <code>CertStore</code>
342+ *
343+ * @exception IllegalArgumentException if the <code>provider</code> is
344+ * null.
345+ *
346+ * @see java.security.Provider
347+ */
348+ public static CertStore getInstance(String type, CertStoreParameters params,
349+ Provider provider) throws NoSuchAlgorithmException,
350+ InvalidAlgorithmParameterException {
351+ try {
352+ Instance instance = GetInstance.getInstance("CertStore",
353+ CertStoreSpi.class, type, params, provider);
354+ return new CertStore((CertStoreSpi)instance.impl,
355+ instance.provider, type, params);
356+ } catch (NoSuchAlgorithmException e) {
357+ return handleException(e);
358+ }
359+ }
360+
361+ /**
362+ * Returns the parameters used to initialize this <code>CertStore</code>.
363+ * Note that the <code>CertStoreParameters</code> object is cloned before
364+ * it is returned.
365+ *
366+ * @return the parameters used to initialize this <code>CertStore</code>
367+ * (may be <code>null</code>)
368+ */
369+ public final CertStoreParameters getCertStoreParameters() {
370+ return (params == null ? null : (CertStoreParameters) params.clone());
371+ }
372+
373+ /**
374+ * Returns the type of this <code>CertStore</code>.
375+ *
376+ * @return the type of this <code>CertStore</code>
377+ */
378+ public final String getType() {
379+ return this.type;
380+ }
381+
382+ /**
383+ * Returns the provider of this <code>CertStore</code>.
384+ *
385+ * @return the provider of this <code>CertStore</code>
386+ */
387+ public final Provider getProvider() {
388+ return this.provider;
389+ }
390+
391+ /**
392+ * Returns the default <code>CertStore</code> type as specified in the
393+ * Java security properties file, or the string &quot;LDAP&quot; if no
394+ * such property exists. The Java security properties file is located in
395+ * the file named &lt;JAVA_HOME&gt;/lib/security/java.security.
396+ * &lt;JAVA_HOME&gt; refers to the value of the java.home system property,
397+ * and specifies the directory where the JRE is installed.
398+ *
399+ * <p>The default <code>CertStore</code> type can be used by applications
400+ * that do not want to use a hard-coded type when calling one of the
401+ * <code>getInstance</code> methods, and want to provide a default
402+ * <code>CertStore</code> type in case a user does not specify its own.
403+ *
404+ * <p>The default <code>CertStore</code> type can be changed by setting
405+ * the value of the "certstore.type" security property (in the Java
406+ * security properties file) to the desired type.
407+ *
408+ * @return the default <code>CertStore</code> type as specified in the
409+ * Java security properties file, or the string &quot;LDAP&quot;
410+ * if no such property exists.
411+ */
412+ public final static String getDefaultType() {
413+ String cstype;
414+ cstype = AccessController.doPrivileged(new PrivilegedAction<String>() {
415+ public String run() {
416+ return Security.getProperty(CERTSTORE_TYPE);
417+ }
418+ });
419+ if (cstype == null) {
420+ cstype = "LDAP";
421+ }
422+ return cstype;
423+ }
424+}
java/pkg/java/security/cert/CertStoreException.class+0−0

Binary file not shown.

java/pkg/java/security/cert/CertStoreException.java+103−0
@@ -0,0 +1,103 @@
1+/*
2+ * Copyright (c) 2000, 2003, Oracle and/or its affiliates. All rights reserved.
3+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
4+ *
5+ * This code is free software; you can redistribute it and/or modify it
6+ * under the terms of the GNU General Public License version 2 only, as
7+ * published by the Free Software Foundation. Oracle designates this
8+ * particular file as subject to the "Classpath" exception as provided
9+ * by Oracle in the LICENSE file that accompanied this code.
10+ *
11+ * This code is distributed in the hope that it will be useful, but WITHOUT
12+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
13+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
14+ * version 2 for more details (a copy is included in the LICENSE file that
15+ * accompanied this code).
16+ *
17+ * You should have received a copy of the GNU General Public License version
18+ * 2 along with this work; if not, write to the Free Software Foundation,
19+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
20+ *
21+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
22+ * or visit www.oracle.com if you need additional information or have any
23+ * questions.
24+ */
25+
26+package java.security.cert;
27+
28+import java.security.GeneralSecurityException;
29+
30+/**
31+ * An exception indicating one of a variety of problems retrieving
32+ * certificates and CRLs from a <code>CertStore</code>.
33+ * <p>
34+ * A <code>CertStoreException</code> provides support for wrapping
35+ * exceptions. The {@link #getCause getCause} method returns the throwable,
36+ * if any, that caused this exception to be thrown.
37+ * <p>
38+ * <b>Concurrent Access</b>
39+ * <p>
40+ * Unless otherwise specified, the methods defined in this class are not
41+ * thread-safe. Multiple threads that need to access a single
42+ * object concurrently should synchronize amongst themselves and
43+ * provide the necessary locking. Multiple threads each manipulating
44+ * separate objects need not synchronize.
45+ *
46+ * @see CertStore
47+ *
48+ * @since 1.4
49+ * @author Sean Mullan
50+ */
51+public class CertStoreException extends GeneralSecurityException {
52+
53+ private static final long serialVersionUID = 2395296107471573245L;
54+
55+ /**
56+ * Creates a <code>CertStoreException</code> with <code>null</code> as
57+ * its detail message.
58+ */
59+ public CertStoreException() {
60+ super();
61+ }
62+
63+ /**
64+ * Creates a <code>CertStoreException</code> with the given detail
65+ * message. A detail message is a <code>String</code> that describes this
66+ * particular exception.
67+ *
68+ * @param msg the detail message
69+ */
70+ public CertStoreException(String msg) {
71+ super(msg);
72+ }
73+
74+ /**
75+ * Creates a <code>CertStoreException</code> that wraps the specified
76+ * throwable. This allows any exception to be converted into a
77+ * <code>CertStoreException</code>, while retaining information about the
78+ * cause, which may be useful for debugging. The detail message is
79+ * set to (<code>cause==null ? null : cause.toString()</code>) (which
80+ * typically contains the class and detail message of cause).
81+ *
82+ * @param cause the cause (which is saved for later retrieval by the
83+ * {@link #getCause getCause()} method). (A <code>null</code> value is
84+ * permitted, and indicates that the cause is nonexistent or unknown.)
85+ */
86+ public CertStoreException(Throwable cause) {
87+ super(cause);
88+ }
89+
90+ /**
91+ * Creates a <code>CertStoreException</code> with the specified detail
92+ * message and cause.
93+ *
94+ * @param msg the detail message
95+ * @param cause the cause (which is saved for later retrieval by the
96+ * {@link #getCause getCause()} method). (A <code>null</code> value is
97+ * permitted, and indicates that the cause is nonexistent or unknown.)
98+ */
99+ public CertStoreException(String msg, Throwable cause) {
100+ super(msg, cause);
101+ }
102+
103+}
java/pkg/java/security/cert/CertStoreParameters.class+0−0

Binary file not shown.

java/pkg/java/security/cert/CertStoreParameters.java+80−0
@@ -0,0 +1,80 @@
1+/*
2+ * Copyright (c) 2000, 2001, Oracle and/or its affiliates. All rights reserved.
3+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
4+ *
5+ * This code is free software; you can redistribute it and/or modify it
6+ * under the terms of the GNU General Public License version 2 only, as
7+ * published by the Free Software Foundation. Oracle designates this
8+ * particular file as subject to the "Classpath" exception as provided
9+ * by Oracle in the LICENSE file that accompanied this code.
10+ *
11+ * This code is distributed in the hope that it will be useful, but WITHOUT
12+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
13+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
14+ * version 2 for more details (a copy is included in the LICENSE file that
15+ * accompanied this code).
16+ *
17+ * You should have received a copy of the GNU General Public License version
18+ * 2 along with this work; if not, write to the Free Software Foundation,
19+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
20+ *
21+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
22+ * or visit www.oracle.com if you need additional information or have any
23+ * questions.
24+ */
25+
26+package java.security.cert;
27+
28+/**
29+ * A specification of <code>CertStore</code> parameters.
30+ * <p>
31+ * The purpose of this interface is to group (and provide type safety for)
32+ * all <code>CertStore</code> parameter specifications. All
33+ * <code>CertStore</code> parameter specifications must implement this
34+ * interface.
35+ * <p>
36+ * Typically, a <code>CertStoreParameters</code> object is passed as a parameter
37+ * to one of the {@link CertStore#getInstance CertStore.getInstance} methods.
38+ * The <code>getInstance</code> method returns a <code>CertStore</code> that
39+ * is used for retrieving <code>Certificate</code>s and <code>CRL</code>s. The
40+ * <code>CertStore</code> that is returned is initialized with the specified
41+ * parameters. The type of parameters needed may vary between different types
42+ * of <code>CertStore</code>s.
43+ *
44+ * @see CertStore#getInstance
45+ *
46+ * @since 1.4
47+ * @author Steve Hanna
48+ */
49+public interface CertStoreParameters extends Cloneable {
50+
51+ /**
52+ * Makes a copy of this <code>CertStoreParameters</code>.
53+ * <p>
54+ * The precise meaning of "copy" may depend on the class of
55+ * the <code>CertStoreParameters</code> object. A typical implementation
56+ * performs a "deep copy" of this object, but this is not an absolute
57+ * requirement. Some implementations may perform a "shallow copy" of some
58+ * or all of the fields of this object.
59+ * <p>
60+ * Note that the <code>CertStore.getInstance</code> methods make a copy
61+ * of the specified <code>CertStoreParameters</code>. A deep copy
62+ * implementation of <code>clone</code> is safer and more robust, as it
63+ * prevents the caller from corrupting a shared <code>CertStore</code> by
64+ * subsequently modifying the contents of its initialization parameters.
65+ * However, a shallow copy implementation of <code>clone</code> is more
66+ * appropriate for applications that need to hold a reference to a
67+ * parameter contained in the <code>CertStoreParameters</code>. For example,
68+ * a shallow copy clone allows an application to release the resources of
69+ * a particular <code>CertStore</code> initialization parameter immediately,
70+ * rather than waiting for the garbage collection mechanism. This should
71+ * be done with the utmost care, since the <code>CertStore</code> may still
72+ * be in use by other threads.
73+ * <p>
74+ * Each subclass should state the precise behavior of this method so
75+ * that users and developers know what to expect.
76+ *
77+ * @return a copy of this <code>CertStoreParameters</code>
78+ */
79+ Object clone();
80+}
java/pkg/java/security/cert/CertStoreSpi.class+0−0

Binary file not shown.

java/pkg/java/security/cert/CertStoreSpi.java+125−0
@@ -0,0 +1,125 @@
1+/*
2+ * Copyright (c) 2000, 2003, Oracle and/or its affiliates. All rights reserved.
3+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
4+ *
5+ * This code is free software; you can redistribute it and/or modify it
6+ * under the terms of the GNU General Public License version 2 only, as
7+ * published by the Free Software Foundation. Oracle designates this
8+ * particular file as subject to the "Classpath" exception as provided
9+ * by Oracle in the LICENSE file that accompanied this code.
10+ *
11+ * This code is distributed in the hope that it will be useful, but WITHOUT
12+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
13+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
14+ * version 2 for more details (a copy is included in the LICENSE file that
15+ * accompanied this code).
16+ *
17+ * You should have received a copy of the GNU General Public License version
18+ * 2 along with this work; if not, write to the Free Software Foundation,
19+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
20+ *
21+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
22+ * or visit www.oracle.com if you need additional information or have any
23+ * questions.
24+ */
25+
26+package java.security.cert;
27+
28+import java.security.InvalidAlgorithmParameterException;
29+import java.util.Collection;
30+
31+/**
32+ * The <i>Service Provider Interface</i> (<b>SPI</b>)
33+ * for the {@link CertStore CertStore} class. All <code>CertStore</code>
34+ * implementations must include a class (the SPI class) that extends
35+ * this class (<code>CertStoreSpi</code>), provides a constructor with
36+ * a single argument of type <code>CertStoreParameters</code>, and implements
37+ * all of its methods. In general, instances of this class should only be
38+ * accessed through the <code>CertStore</code> class.
39+ * For details, see the Java Cryptography Architecture.
40+ * <p>
41+ * <b>Concurrent Access</b>
42+ * <p>
43+ * The public methods of all <code>CertStoreSpi</code> objects must be
44+ * thread-safe. That is, multiple threads may concurrently invoke these
45+ * methods on a single <code>CertStoreSpi</code> object (or more than one)
46+ * with no ill effects. This allows a <code>CertPathBuilder</code> to search
47+ * for a CRL while simultaneously searching for further certificates, for
48+ * instance.
49+ * <p>
50+ * Simple <code>CertStoreSpi</code> implementations will probably ensure
51+ * thread safety by adding a <code>synchronized</code> keyword to their
52+ * <code>engineGetCertificates</code> and <code>engineGetCRLs</code> methods.
53+ * More sophisticated ones may allow truly concurrent access.
54+ *
55+ * @since 1.4
56+ * @author Steve Hanna
57+ */
58+public abstract class CertStoreSpi {
59+
60+ /**
61+ * The sole constructor.
62+ *
63+ * @param params the initialization parameters (may be <code>null</code>)
64+ * @throws InvalidAlgorithmParameterException if the initialization
65+ * parameters are inappropriate for this <code>CertStoreSpi</code>
66+ */
67+ public CertStoreSpi(CertStoreParameters params)
68+ throws InvalidAlgorithmParameterException { }
69+
70+ /**
71+ * Returns a <code>Collection</code> of <code>Certificate</code>s that
72+ * match the specified selector. If no <code>Certificate</code>s
73+ * match the selector, an empty <code>Collection</code> will be returned.
74+ * <p>
75+ * For some <code>CertStore</code> types, the resulting
76+ * <code>Collection</code> may not contain <b>all</b> of the
77+ * <code>Certificate</code>s that match the selector. For instance,
78+ * an LDAP <code>CertStore</code> may not search all entries in the
79+ * directory. Instead, it may just search entries that are likely to
80+ * contain the <code>Certificate</code>s it is looking for.
81+ * <p>
82+ * Some <code>CertStore</code> implementations (especially LDAP
83+ * <code>CertStore</code>s) may throw a <code>CertStoreException</code>
84+ * unless a non-null <code>CertSelector</code> is provided that includes
85+ * specific criteria that can be used to find the certificates. Issuer
86+ * and/or subject names are especially useful criteria.
87+ *
88+ * @param selector A <code>CertSelector</code> used to select which
89+ * <code>Certificate</code>s should be returned. Specify <code>null</code>
90+ * to return all <code>Certificate</code>s (if supported).
91+ * @return A <code>Collection</code> of <code>Certificate</code>s that
92+ * match the specified selector (never <code>null</code>)
93+ * @throws CertStoreException if an exception occurs
94+ */
95+ public abstract Collection<? extends Certificate> engineGetCertificates
96+ (CertSelector selector) throws CertStoreException;
97+
98+ /**
99+ * Returns a <code>Collection</code> of <code>CRL</code>s that
100+ * match the specified selector. If no <code>CRL</code>s
101+ * match the selector, an empty <code>Collection</code> will be returned.
102+ * <p>
103+ * For some <code>CertStore</code> types, the resulting
104+ * <code>Collection</code> may not contain <b>all</b> of the
105+ * <code>CRL</code>s that match the selector. For instance,
106+ * an LDAP <code>CertStore</code> may not search all entries in the
107+ * directory. Instead, it may just search entries that are likely to
108+ * contain the <code>CRL</code>s it is looking for.
109+ * <p>
110+ * Some <code>CertStore</code> implementations (especially LDAP
111+ * <code>CertStore</code>s) may throw a <code>CertStoreException</code>
112+ * unless a non-null <code>CRLSelector</code> is provided that includes
113+ * specific criteria that can be used to find the CRLs. Issuer names
114+ * and/or the certificate to be checked are especially useful.
115+ *
116+ * @param selector A <code>CRLSelector</code> used to select which
117+ * <code>CRL</code>s should be returned. Specify <code>null</code>
118+ * to return all <code>CRL</code>s (if supported).
119+ * @return A <code>Collection</code> of <code>CRL</code>s that
120+ * match the specified selector (never <code>null</code>)
121+ * @throws CertStoreException if an exception occurs
122+ */
123+ public abstract Collection<? extends CRL> engineGetCRLs
124+ (CRLSelector selector) throws CertStoreException;
125+}
java/pkg/java/security/cert/Certificate$CertificateRep.class+0−0

Binary file not shown.

java/pkg/java/security/cert/Certificate.class+0−0

Binary file not shown.

java/pkg/java/security/cert/Certificate.java+274−0
@@ -0,0 +1,274 @@
1+/*
2+ * Copyright (c) 1997, 2011, Oracle and/or its affiliates. All rights reserved.
3+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
4+ *
5+ * This code is free software; you can redistribute it and/or modify it
6+ * under the terms of the GNU General Public License version 2 only, as
7+ * published by the Free Software Foundation. Oracle designates this
8+ * particular file as subject to the "Classpath" exception as provided
9+ * by Oracle in the LICENSE file that accompanied this code.
10+ *
11+ * This code is distributed in the hope that it will be useful, but WITHOUT
12+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
13+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
14+ * version 2 for more details (a copy is included in the LICENSE file that
15+ * accompanied this code).
16+ *
17+ * You should have received a copy of the GNU General Public License version
18+ * 2 along with this work; if not, write to the Free Software Foundation,
19+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
20+ *
21+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
22+ * or visit www.oracle.com if you need additional information or have any
23+ * questions.
24+ */
25+
26+package java.security.cert;
27+
28+import java.util.Arrays;
29+
30+import java.security.PublicKey;
31+import java.security.NoSuchAlgorithmException;
32+import java.security.NoSuchProviderException;
33+import java.security.InvalidKeyException;
34+import java.security.SignatureException;
35+
36+import sun.security.x509.X509CertImpl;
37+
38+/**
39+ * <p>Abstract class for managing a variety of identity certificates.
40+ * An identity certificate is a binding of a principal to a public key which
41+ * is vouched for by another principal. (A principal represents
42+ * an entity such as an individual user, a group, or a corporation.)
43+ *<p>
44+ * This class is an abstraction for certificates that have different
45+ * formats but important common uses. For example, different types of
46+ * certificates, such as X.509 and PGP, share general certificate
47+ * functionality (like encoding and verifying) and
48+ * some types of information (like a public key).
49+ * <p>
50+ * X.509, PGP, and SDSI certificates can all be implemented by
51+ * subclassing the Certificate class, even though they contain different
52+ * sets of information, and they store and retrieve the information in
53+ * different ways.
54+ *
55+ * @see X509Certificate
56+ * @see CertificateFactory
57+ *
58+ * @author Hemma Prafullchandra
59+ */
60+
61+public abstract class Certificate implements java.io.Serializable {
62+
63+ private static final long serialVersionUID = -3585440601605666277L;
64+
65+ // the certificate type
66+ private final String type;
67+
68+ /**
69+ * Creates a certificate of the specified type.
70+ *
71+ * @param type the standard name of the certificate type.
72+ * See the CertificateFactory section in the <a href=
73+ * "{@docRoot}/../technotes/guides/security/StandardNames.html#CertificateFactory">
74+ * Java Cryptography Architecture Standard Algorithm Name Documentation</a>
75+ * for information about standard certificate types.
76+ */
77+ protected Certificate(String type) {
78+ this.type = type;
79+ }
80+
81+ /**
82+ * Returns the type of this certificate.
83+ *
84+ * @return the type of this certificate.
85+ */
86+ public final String getType() {
87+ return this.type;
88+ }
89+
90+ /**
91+ * Compares this certificate for equality with the specified
92+ * object. If the <code>other</code> object is an
93+ * <code>instanceof</code> <code>Certificate</code>, then
94+ * its encoded form is retrieved and compared with the
95+ * encoded form of this certificate.
96+ *
97+ * @param other the object to test for equality with this certificate.
98+ * @return true iff the encoded forms of the two certificates
99+ * match, false otherwise.
100+ */
101+ public boolean equals(Object other) {
102+ if (this == other) {
103+ return true;
104+ }
105+ if (!(other instanceof Certificate)) {
106+ return false;
107+ }
108+ try {
109+ byte[] thisCert = X509CertImpl.getEncodedInternal(this);
110+ byte[] otherCert = X509CertImpl.getEncodedInternal((Certificate)other);
111+
112+ return Arrays.equals(thisCert, otherCert);
113+ } catch (CertificateException e) {
114+ return false;
115+ }
116+ }
117+
118+ /**
119+ * Returns a hashcode value for this certificate from its
120+ * encoded form.
121+ *
122+ * @return the hashcode value.
123+ */
124+ public int hashCode() {
125+ int retval = 0;
126+ try {
127+ byte[] certData = X509CertImpl.getEncodedInternal(this);
128+ for (int i = 1; i < certData.length; i++) {
129+ retval += certData[i] * i;
130+ }
131+ return retval;
132+ } catch (CertificateException e) {
133+ return retval;
134+ }
135+ }
136+
137+ /**
138+ * Returns the encoded form of this certificate. It is
139+ * assumed that each certificate type would have only a single
140+ * form of encoding; for example, X.509 certificates would
141+ * be encoded as ASN.1 DER.
142+ *
143+ * @return the encoded form of this certificate
144+ *
145+ * @exception CertificateEncodingException if an encoding error occurs.
146+ */
147+ public abstract byte[] getEncoded()
148+ throws CertificateEncodingException;
149+
150+ /**
151+ * Verifies that this certificate was signed using the
152+ * private key that corresponds to the specified public key.
153+ *
154+ * @param key the PublicKey used to carry out the verification.
155+ *
156+ * @exception NoSuchAlgorithmException on unsupported signature
157+ * algorithms.
158+ * @exception InvalidKeyException on incorrect key.
159+ * @exception NoSuchProviderException if there's no default provider.
160+ * @exception SignatureException on signature errors.
161+ * @exception CertificateException on encoding errors.
162+ */
163+ public abstract void verify(PublicKey key)
164+ throws CertificateException, NoSuchAlgorithmException,
165+ InvalidKeyException, NoSuchProviderException,
166+ SignatureException;
167+
168+ /**
169+ * Verifies that this certificate was signed using the
170+ * private key that corresponds to the specified public key.
171+ * This method uses the signature verification engine
172+ * supplied by the specified provider.
173+ *
174+ * @param key the PublicKey used to carry out the verification.
175+ * @param sigProvider the name of the signature provider.
176+ *
177+ * @exception NoSuchAlgorithmException on unsupported signature
178+ * algorithms.
179+ * @exception InvalidKeyException on incorrect key.
180+ * @exception NoSuchProviderException on incorrect provider.
181+ * @exception SignatureException on signature errors.
182+ * @exception CertificateException on encoding errors.
183+ */
184+ public abstract void verify(PublicKey key, String sigProvider)
185+ throws CertificateException, NoSuchAlgorithmException,
186+ InvalidKeyException, NoSuchProviderException,
187+ SignatureException;
188+
189+ /**
190+ * Returns a string representation of this certificate.
191+ *
192+ * @return a string representation of this certificate.
193+ */
194+ public abstract String toString();
195+
196+ /**
197+ * Gets the public key from this certificate.
198+ *
199+ * @return the public key.
200+ */
201+ public abstract PublicKey getPublicKey();
202+
203+ /**
204+ * Alternate Certificate class for serialization.
205+ * @since 1.3
206+ */
207+ protected static class CertificateRep implements java.io.Serializable {
208+
209+ private static final long serialVersionUID = -8563758940495660020L;
210+
211+ private String type;
212+ private byte[] data;
213+
214+ /**
215+ * Construct the alternate Certificate class with the Certificate
216+ * type and Certificate encoding bytes.
217+ *
218+ * <p>
219+ *
220+ * @param type the standard name of the Certificate type. <p>
221+ *
222+ * @param data the Certificate data.
223+ */
224+ protected CertificateRep(String type, byte[] data) {
225+ this.type = type;
226+ this.data = data;
227+ }
228+
229+ /**
230+ * Resolve the Certificate Object.
231+ *
232+ * <p>
233+ *
234+ * @return the resolved Certificate Object
235+ *
236+ * @throws java.io.ObjectStreamException if the Certificate
237+ * could not be resolved
238+ */
239+ protected Object readResolve() throws java.io.ObjectStreamException {
240+ try {
241+ CertificateFactory cf = CertificateFactory.getInstance(type);
242+ return cf.generateCertificate
243+ (new java.io.ByteArrayInputStream(data));
244+ } catch (CertificateException e) {
245+ throw new java.io.NotSerializableException
246+ ("java.security.cert.Certificate: " +
247+ type +
248+ ": " +
249+ e.getMessage());
250+ }
251+ }
252+ }
253+
254+ /**
255+ * Replace the Certificate to be serialized.
256+ *
257+ * @return the alternate Certificate object to be serialized
258+ *
259+ * @throws java.io.ObjectStreamException if a new object representing
260+ * this Certificate could not be created
261+ * @since 1.3
262+ */
263+ protected Object writeReplace() throws java.io.ObjectStreamException {
264+ try {
265+ return new CertificateRep(type, getEncoded());
266+ } catch (CertificateException e) {
267+ throw new java.io.NotSerializableException
268+ ("java.security.cert.Certificate: " +
269+ type +
270+ ": " +
271+ e.getMessage());
272+ }
273+ }
274+}
java/pkg/java/security/cert/CertificateEncodingException.class+0−0

Binary file not shown.

java/pkg/java/security/cert/CertificateEncodingException.java+88−0
@@ -0,0 +1,88 @@
1+/*
2+ * Copyright (c) 1997, 2003, Oracle and/or its affiliates. All rights reserved.
3+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
4+ *
5+ * This code is free software; you can redistribute it and/or modify it
6+ * under the terms of the GNU General Public License version 2 only, as
7+ * published by the Free Software Foundation. Oracle designates this
8+ * particular file as subject to the "Classpath" exception as provided
9+ * by Oracle in the LICENSE file that accompanied this code.
10+ *
11+ * This code is distributed in the hope that it will be useful, but WITHOUT
12+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
13+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
14+ * version 2 for more details (a copy is included in the LICENSE file that
15+ * accompanied this code).
16+ *
17+ * You should have received a copy of the GNU General Public License version
18+ * 2 along with this work; if not, write to the Free Software Foundation,
19+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
20+ *
21+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
22+ * or visit www.oracle.com if you need additional information or have any
23+ * questions.
24+ */
25+
26+package java.security.cert;
27+
28+/**
29+ * Certificate Encoding Exception. This is thrown whenever an error
30+ * occurs while attempting to encode a certificate.
31+ *
32+ * @author Hemma Prafullchandra
33+ */
34+public class CertificateEncodingException extends CertificateException {
35+
36+ private static final long serialVersionUID = 6219492851589449162L;
37+
38+ /**
39+ * Constructs a CertificateEncodingException with no detail message. A
40+ * detail message is a String that describes this particular
41+ * exception.
42+ */
43+ public CertificateEncodingException() {
44+ super();
45+ }
46+
47+ /**
48+ * Constructs a CertificateEncodingException with the specified detail
49+ * message. A detail message is a String that describes this
50+ * particular exception.
51+ *
52+ * @param message the detail message.
53+ */
54+ public CertificateEncodingException(String message) {
55+ super(message);
56+ }
57+
58+ /**
59+ * Creates a <code>CertificateEncodingException</code> with the specified
60+ * detail message and cause.
61+ *
62+ * @param message the detail message (which is saved for later retrieval
63+ * by the {@link #getMessage()} method).
64+ * @param cause the cause (which is saved for later retrieval by the
65+ * {@link #getCause()} method). (A <tt>null</tt> value is permitted,
66+ * and indicates that the cause is nonexistent or unknown.)
67+ * @since 1.5
68+ */
69+ public CertificateEncodingException(String message, Throwable cause) {
70+ super(message, cause);
71+ }
72+
73+ /**
74+ * Creates a <code>CertificateEncodingException</code>
75+ * with the specified cause and a detail message of
76+ * <tt>(cause==null ? null : cause.toString())</tt>
77+ * (which typically contains the class and detail message of
78+ * <tt>cause</tt>).
79+ *
80+ * @param cause the cause (which is saved for later retrieval by the
81+ * {@link #getCause()} method). (A <tt>null</tt> value is permitted,
82+ * and indicates that the cause is nonexistent or unknown.)
83+ * @since 1.5
84+ */
85+ public CertificateEncodingException(Throwable cause) {
86+ super(cause);
87+ }
88+}
java/pkg/java/security/cert/CertificateException.class+0−0

Binary file not shown.

java/pkg/java/security/cert/CertificateException.java+88−0
@@ -0,0 +1,88 @@
1+/*
2+ * Copyright (c) 1996, 2003, Oracle and/or its affiliates. All rights reserved.
3+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
4+ *
5+ * This code is free software; you can redistribute it and/or modify it
6+ * under the terms of the GNU General Public License version 2 only, as
7+ * published by the Free Software Foundation. Oracle designates this
8+ * particular file as subject to the "Classpath" exception as provided
9+ * by Oracle in the LICENSE file that accompanied this code.
10+ *
11+ * This code is distributed in the hope that it will be useful, but WITHOUT
12+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
13+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
14+ * version 2 for more details (a copy is included in the LICENSE file that
15+ * accompanied this code).
16+ *
17+ * You should have received a copy of the GNU General Public License version
18+ * 2 along with this work; if not, write to the Free Software Foundation,
19+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
20+ *
21+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
22+ * or visit www.oracle.com if you need additional information or have any
23+ * questions.
24+ */
25+
26+package java.security.cert;
27+
28+import java.security.GeneralSecurityException;
29+
30+/**
31+ * This exception indicates one of a variety of certificate problems.
32+ *
33+ * @author Hemma Prafullchandra
34+ * @see Certificate
35+ */
36+public class CertificateException extends GeneralSecurityException {
37+
38+ private static final long serialVersionUID = 3192535253797119798L;
39+
40+ /**
41+ * Constructs a certificate exception with no detail message. A detail
42+ * message is a String that describes this particular exception.
43+ */
44+ public CertificateException() {
45+ super();
46+ }
47+
48+ /**
49+ * Constructs a certificate exception with the given detail
50+ * message. A detail message is a String that describes this
51+ * particular exception.
52+ *
53+ * @param msg the detail message.
54+ */
55+ public CertificateException(String msg) {
56+ super(msg);
57+ }
58+
59+ /**
60+ * Creates a <code>CertificateException</code> with the specified
61+ * detail message and cause.
62+ *
63+ * @param message the detail message (which is saved for later retrieval
64+ * by the {@link #getMessage()} method).
65+ * @param cause the cause (which is saved for later retrieval by the
66+ * {@link #getCause()} method). (A <tt>null</tt> value is permitted,
67+ * and indicates that the cause is nonexistent or unknown.)
68+ * @since 1.5
69+ */
70+ public CertificateException(String message, Throwable cause) {
71+ super(message, cause);
72+ }
73+
74+ /**
75+ * Creates a <code>CertificateException</code> with the specified cause
76+ * and a detail message of <tt>(cause==null ? null : cause.toString())</tt>
77+ * (which typically contains the class and detail message of
78+ * <tt>cause</tt>).
79+ *
80+ * @param cause the cause (which is saved for later retrieval by the
81+ * {@link #getCause()} method). (A <tt>null</tt> value is permitted,
82+ * and indicates that the cause is nonexistent or unknown.)
83+ * @since 1.5
84+ */
85+ public CertificateException(Throwable cause) {
86+ super(cause);
87+ }
88+}
java/pkg/java/security/cert/CertificateExpiredException.class+0−0

Binary file not shown.

java/pkg/java/security/cert/CertificateExpiredException.java+59−0
@@ -0,0 +1,59 @@
1+/*
2+ * Copyright (c) 1997, 2003, Oracle and/or its affiliates. All rights reserved.
3+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
4+ *
5+ * This code is free software; you can redistribute it and/or modify it
6+ * under the terms of the GNU General Public License version 2 only, as
7+ * published by the Free Software Foundation. Oracle designates this
8+ * particular file as subject to the "Classpath" exception as provided
9+ * by Oracle in the LICENSE file that accompanied this code.
10+ *
11+ * This code is distributed in the hope that it will be useful, but WITHOUT
12+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
13+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
14+ * version 2 for more details (a copy is included in the LICENSE file that
15+ * accompanied this code).
16+ *
17+ * You should have received a copy of the GNU General Public License version
18+ * 2 along with this work; if not, write to the Free Software Foundation,
19+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
20+ *
21+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
22+ * or visit www.oracle.com if you need additional information or have any
23+ * questions.
24+ */
25+
26+package java.security.cert;
27+
28+/**
29+ * Certificate Expired Exception. This is thrown whenever the current
30+ * <code>Date</code> or the specified <code>Date</code> is after the
31+ * <code>notAfter</code> date/time specified in the validity period
32+ * of the certificate.
33+ *
34+ * @author Hemma Prafullchandra
35+ */
36+public class CertificateExpiredException extends CertificateException {
37+
38+ private static final long serialVersionUID = 9071001339691533771L;
39+
40+ /**
41+ * Constructs a CertificateExpiredException with no detail message. A
42+ * detail message is a String that describes this particular
43+ * exception.
44+ */
45+ public CertificateExpiredException() {
46+ super();
47+ }
48+
49+ /**
50+ * Constructs a CertificateExpiredException with the specified detail
51+ * message. A detail message is a String that describes this
52+ * particular exception.
53+ *
54+ * @param message the detail message.
55+ */
56+ public CertificateExpiredException(String message) {
57+ super(message);
58+ }
59+}
java/pkg/java/security/cert/CertificateFactory.class+0−0

Binary file not shown.

java/pkg/java/security/cert/CertificateFactory.java+537−0
@@ -0,0 +1,537 @@
1+/*
2+ * Copyright (c) 1998, 2011, Oracle and/or its affiliates. All rights reserved.
3+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
4+ *
5+ * This code is free software; you can redistribute it and/or modify it
6+ * under the terms of the GNU General Public License version 2 only, as
7+ * published by the Free Software Foundation. Oracle designates this
8+ * particular file as subject to the "Classpath" exception as provided
9+ * by Oracle in the LICENSE file that accompanied this code.
10+ *
11+ * This code is distributed in the hope that it will be useful, but WITHOUT
12+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
13+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
14+ * version 2 for more details (a copy is included in the LICENSE file that
15+ * accompanied this code).
16+ *
17+ * You should have received a copy of the GNU General Public License version
18+ * 2 along with this work; if not, write to the Free Software Foundation,
19+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
20+ *
21+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
22+ * or visit www.oracle.com if you need additional information or have any
23+ * questions.
24+ */
25+
26+package java.security.cert;
27+
28+import java.io.InputStream;
29+import java.util.Collection;
30+import java.util.Iterator;
31+import java.util.List;
32+import java.security.Provider;
33+import java.security.Security;
34+import java.security.AccessController;
35+import java.security.PrivilegedAction;
36+import java.security.NoSuchAlgorithmException;
37+import java.security.NoSuchProviderException;
38+
39+import sun.security.jca.*;
40+import sun.security.jca.GetInstance.Instance;
41+
42+/**
43+ * This class defines the functionality of a certificate factory, which is
44+ * used to generate certificate, certification path (<code>CertPath</code>)
45+ * and certificate revocation list (CRL) objects from their encodings.
46+ *
47+ * <p>For encodings consisting of multiple certificates, use
48+ * <code>generateCertificates</code> when you want to
49+ * parse a collection of possibly unrelated certificates. Otherwise,
50+ * use <code>generateCertPath</code> when you want to generate
51+ * a <code>CertPath</code> (a certificate chain) and subsequently
52+ * validate it with a <code>CertPathValidator</code>.
53+ *
54+ * <p>A certificate factory for X.509 must return certificates that are an
55+ * instance of <code>java.security.cert.X509Certificate</code>, and CRLs
56+ * that are an instance of <code>java.security.cert.X509CRL</code>.
57+ *
58+ * <p>The following example reads a file with Base64 encoded certificates,
59+ * which are each bounded at the beginning by -----BEGIN CERTIFICATE-----, and
60+ * bounded at the end by -----END CERTIFICATE-----. We convert the
61+ * <code>FileInputStream</code> (which does not support <code>mark</code>
62+ * and <code>reset</code>) to a <code>BufferedInputStream</code> (which
63+ * supports those methods), so that each call to
64+ * <code>generateCertificate</code> consumes only one certificate, and the
65+ * read position of the input stream is positioned to the next certificate in
66+ * the file:<p>
67+ *
68+ * <pre>
69+ * FileInputStream fis = new FileInputStream(filename);
70+ * BufferedInputStream bis = new BufferedInputStream(fis);
71+ *
72+ * CertificateFactory cf = CertificateFactory.getInstance("X.509");
73+ *
74+ * while (bis.available() > 0) {
75+ * Certificate cert = cf.generateCertificate(bis);
76+ * System.out.println(cert.toString());
77+ * }
78+ * </pre>
79+ *
80+ * <p>The following example parses a PKCS#7-formatted certificate reply stored
81+ * in a file and extracts all the certificates from it:<p>
82+ *
83+ * <pre>
84+ * FileInputStream fis = new FileInputStream(filename);
85+ * CertificateFactory cf = CertificateFactory.getInstance("X.509");
86+ * Collection c = cf.generateCertificates(fis);
87+ * Iterator i = c.iterator();
88+ * while (i.hasNext()) {
89+ * Certificate cert = (Certificate)i.next();
90+ * System.out.println(cert);
91+ * }
92+ * </pre>
93+ *
94+ * <p> Every implementation of the Java platform is required to support the
95+ * following standard <code>CertificateFactory</code> type:
96+ * <ul>
97+ * <li><tt>X.509</tt></li>
98+ * </ul>
99+ * and the following standard <code>CertPath</code> encodings:
100+ * <ul>
101+ * <li><tt>PKCS7</tt></li>
102+ * <li><tt>PkiPath</tt></li>
103+ * </ul>
104+ * The type and encodings are described in the <a href=
105+ * "{@docRoot}/../technotes/guides/security/StandardNames.html#CertificateFactory">
106+ * CertificateFactory section</a> and the <a href=
107+ * "{@docRoot}/../technotes/guides/security/StandardNames.html#CertPathEncodings">
108+ * CertPath Encodings section</a> of the
109+ * Java Cryptography Architecture Standard Algorithm Name Documentation.
110+ * Consult the release documentation for your implementation to see if any
111+ * other types or encodings are supported.
112+ *
113+ * @author Hemma Prafullchandra
114+ * @author Jan Luehe
115+ * @author Sean Mullan
116+ *
117+ * @see Certificate
118+ * @see X509Certificate
119+ * @see CertPath
120+ * @see CRL
121+ * @see X509CRL
122+ *
123+ * @since 1.2
124+ */
125+
126+public class CertificateFactory {
127+
128+ // The certificate type
129+ private String type;
130+
131+ // The provider
132+ private Provider provider;
133+
134+ // The provider implementation
135+ private CertificateFactorySpi certFacSpi;
136+
137+ /**
138+ * Creates a CertificateFactory object of the given type, and encapsulates
139+ * the given provider implementation (SPI object) in it.
140+ *
141+ * @param certFacSpi the provider implementation.
142+ * @param provider the provider.
143+ * @param type the certificate type.
144+ */
145+ protected CertificateFactory(CertificateFactorySpi certFacSpi,
146+ Provider provider, String type)
147+ {
148+ this.certFacSpi = certFacSpi;
149+ this.provider = provider;
150+ this.type = type;
151+ }
152+
153+ /**
154+ * Returns a certificate factory object that implements the
155+ * specified certificate type.
156+ *
157+ * <p> This method traverses the list of registered security Providers,
158+ * starting with the most preferred Provider.
159+ * A new CertificateFactory object encapsulating the
160+ * CertificateFactorySpi implementation from the first
161+ * Provider that supports the specified type is returned.
162+ *
163+ * <p> Note that the list of registered providers may be retrieved via
164+ * the {@link Security#getProviders() Security.getProviders()} method.
165+ *
166+ * @param type the name of the requested certificate type.
167+ * See the CertificateFactory section in the <a href=
168+ * "{@docRoot}/../technotes/guides/security/StandardNames.html#CertificateFactory">
169+ * Java Cryptography Architecture Standard Algorithm Name Documentation</a>
170+ * for information about standard certificate types.
171+ *
172+ * @return a certificate factory object for the specified type.
173+ *
174+ * @exception CertificateException if no Provider supports a
175+ * CertificateFactorySpi implementation for the
176+ * specified type.
177+ *
178+ * @see java.security.Provider
179+ */
180+ public static final CertificateFactory getInstance(String type)
181+ throws CertificateException {
182+ try {
183+ Instance instance = GetInstance.getInstance("CertificateFactory",
184+ CertificateFactorySpi.class, type);
185+ return new CertificateFactory((CertificateFactorySpi)instance.impl,
186+ instance.provider, type);
187+ } catch (NoSuchAlgorithmException e) {
188+ throw new CertificateException(type + " not found", e);
189+ }
190+ }
191+
192+ /**
193+ * Returns a certificate factory object for the specified
194+ * certificate type.
195+ *
196+ * <p> A new CertificateFactory object encapsulating the
197+ * CertificateFactorySpi implementation from the specified provider
198+ * is returned. The specified provider must be registered
199+ * in the security provider list.
200+ *
201+ * <p> Note that the list of registered providers may be retrieved via
202+ * the {@link Security#getProviders() Security.getProviders()} method.
203+ *
204+ * @param type the certificate type.
205+ * See the CertificateFactory section in the <a href=
206+ * "{@docRoot}/../technotes/guides/security/StandardNames.html#CertificateFactory">
207+ * Java Cryptography Architecture Standard Algorithm Name Documentation</a>
208+ * for information about standard certificate types.
209+ *
210+ * @param provider the name of the provider.
211+ *
212+ * @return a certificate factory object for the specified type.
213+ *
214+ * @exception CertificateException if a CertificateFactorySpi
215+ * implementation for the specified algorithm is not
216+ * available from the specified provider.
217+ *
218+ * @exception NoSuchProviderException if the specified provider is not
219+ * registered in the security provider list.
220+ *
221+ * @exception IllegalArgumentException if the provider name is null
222+ * or empty.
223+ *
224+ * @see java.security.Provider
225+ */
226+ public static final CertificateFactory getInstance(String type,
227+ String provider) throws CertificateException,
228+ NoSuchProviderException {
229+ try {
230+ Instance instance = GetInstance.getInstance("CertificateFactory",
231+ CertificateFactorySpi.class, type, provider);
232+ return new CertificateFactory((CertificateFactorySpi)instance.impl,
233+ instance.provider, type);
234+ } catch (NoSuchAlgorithmException e) {
235+ throw new CertificateException(type + " not found", e);
236+ }
237+ }
238+
239+ /**
240+ * Returns a certificate factory object for the specified
241+ * certificate type.
242+ *
243+ * <p> A new CertificateFactory object encapsulating the
244+ * CertificateFactorySpi implementation from the specified Provider
245+ * object is returned. Note that the specified Provider object
246+ * does not have to be registered in the provider list.
247+ *
248+ * @param type the certificate type.
249+ * See the CertificateFactory section in the <a href=
250+ * "{@docRoot}/../technotes/guides/security/StandardNames.html#CertificateFactory">
251+ * Java Cryptography Architecture Standard Algorithm Name Documentation</a>
252+ * for information about standard certificate types.
253+ * @param provider the provider.
254+ *
255+ * @return a certificate factory object for the specified type.
256+ *
257+ * @exception CertificateException if a CertificateFactorySpi
258+ * implementation for the specified algorithm is not available
259+ * from the specified Provider object.
260+ *
261+ * @exception IllegalArgumentException if the <code>provider</code> is
262+ * null.
263+ *
264+ * @see java.security.Provider
265+ *
266+ * @since 1.4
267+ */
268+ public static final CertificateFactory getInstance(String type,
269+ Provider provider) throws CertificateException {
270+ try {
271+ Instance instance = GetInstance.getInstance("CertificateFactory",
272+ CertificateFactorySpi.class, type, provider);
273+ return new CertificateFactory((CertificateFactorySpi)instance.impl,
274+ instance.provider, type);
275+ } catch (NoSuchAlgorithmException e) {
276+ throw new CertificateException(type + " not found", e);
277+ }
278+ }
279+
280+ /**
281+ * Returns the provider of this certificate factory.
282+ *
283+ * @return the provider of this certificate factory.
284+ */
285+ public final Provider getProvider() {
286+ return this.provider;
287+ }
288+
289+ /**
290+ * Returns the name of the certificate type associated with this
291+ * certificate factory.
292+ *
293+ * @return the name of the certificate type associated with this
294+ * certificate factory.
295+ */
296+ public final String getType() {
297+ return this.type;
298+ }
299+
300+ /**
301+ * Generates a certificate object and initializes it with
302+ * the data read from the input stream <code>inStream</code>.
303+ *
304+ * <p>In order to take advantage of the specialized certificate format
305+ * supported by this certificate factory,
306+ * the returned certificate object can be typecast to the corresponding
307+ * certificate class. For example, if this certificate
308+ * factory implements X.509 certificates, the returned certificate object
309+ * can be typecast to the <code>X509Certificate</code> class.
310+ *
311+ * <p>In the case of a certificate factory for X.509 certificates, the
312+ * certificate provided in <code>inStream</code> must be DER-encoded and
313+ * may be supplied in binary or printable (Base64) encoding. If the
314+ * certificate is provided in Base64 encoding, it must be bounded at
315+ * the beginning by -----BEGIN CERTIFICATE-----, and must be bounded at
316+ * the end by -----END CERTIFICATE-----.
317+ *
318+ * <p>Note that if the given input stream does not support
319+ * {@link java.io.InputStream#mark(int) mark} and
320+ * {@link java.io.InputStream#reset() reset}, this method will
321+ * consume the entire input stream. Otherwise, each call to this
322+ * method consumes one certificate and the read position of the
323+ * input stream is positioned to the next available byte after
324+ * the inherent end-of-certificate marker. If the data in the input stream
325+ * does not contain an inherent end-of-certificate marker (other
326+ * than EOF) and there is trailing data after the certificate is parsed, a
327+ * <code>CertificateException</code> is thrown.
328+ *
329+ * @param inStream an input stream with the certificate data.
330+ *
331+ * @return a certificate object initialized with the data
332+ * from the input stream.
333+ *
334+ * @exception CertificateException on parsing errors.
335+ */
336+ public final Certificate generateCertificate(InputStream inStream)
337+ throws CertificateException
338+ {
339+ return certFacSpi.engineGenerateCertificate(inStream);
340+ }
341+
342+ /**
343+ * Returns an iteration of the <code>CertPath</code> encodings supported
344+ * by this certificate factory, with the default encoding first. See
345+ * the CertPath Encodings section in the <a href=
346+ * "{@docRoot}/../technotes/guides/security/StandardNames.html#CertPathEncodings">
347+ * Java Cryptography Architecture Standard Algorithm Name Documentation</a>
348+ * for information about standard encoding names and their formats.
349+ * <p>
350+ * Attempts to modify the returned <code>Iterator</code> via its
351+ * <code>remove</code> method result in an
352+ * <code>UnsupportedOperationException</code>.
353+ *
354+ * @return an <code>Iterator</code> over the names of the supported
355+ * <code>CertPath</code> encodings (as <code>String</code>s)
356+ * @since 1.4
357+ */
358+ public final Iterator<String> getCertPathEncodings() {
359+ return(certFacSpi.engineGetCertPathEncodings());
360+ }
361+
362+ /**
363+ * Generates a <code>CertPath</code> object and initializes it with
364+ * the data read from the <code>InputStream</code> inStream. The data
365+ * is assumed to be in the default encoding. The name of the default
366+ * encoding is the first element of the <code>Iterator</code> returned by
367+ * the {@link #getCertPathEncodings getCertPathEncodings} method.
368+ *
369+ * @param inStream an <code>InputStream</code> containing the data
370+ * @return a <code>CertPath</code> initialized with the data from the
371+ * <code>InputStream</code>
372+ * @exception CertificateException if an exception occurs while decoding
373+ * @since 1.4
374+ */
375+ public final CertPath generateCertPath(InputStream inStream)
376+ throws CertificateException
377+ {
378+ return(certFacSpi.engineGenerateCertPath(inStream));
379+ }
380+
381+ /**
382+ * Generates a <code>CertPath</code> object and initializes it with
383+ * the data read from the <code>InputStream</code> inStream. The data
384+ * is assumed to be in the specified encoding. See
385+ * the CertPath Encodings section in the <a href=
386+ * "{@docRoot}/../technotes/guides/security/StandardNames.html#CertPathEncodings">
387+ * Java Cryptography Architecture Standard Algorithm Name Documentation</a>
388+ * for information about standard encoding names and their formats.
389+ *
390+ * @param inStream an <code>InputStream</code> containing the data
391+ * @param encoding the encoding used for the data
392+ * @return a <code>CertPath</code> initialized with the data from the
393+ * <code>InputStream</code>
394+ * @exception CertificateException if an exception occurs while decoding or
395+ * the encoding requested is not supported
396+ * @since 1.4
397+ */
398+ public final CertPath generateCertPath(InputStream inStream,
399+ String encoding) throws CertificateException
400+ {
401+ return(certFacSpi.engineGenerateCertPath(inStream, encoding));
402+ }
403+
404+ /**
405+ * Generates a <code>CertPath</code> object and initializes it with
406+ * a <code>List</code> of <code>Certificate</code>s.
407+ * <p>
408+ * The certificates supplied must be of a type supported by the
409+ * <code>CertificateFactory</code>. They will be copied out of the supplied
410+ * <code>List</code> object.
411+ *
412+ * @param certificates a <code>List</code> of <code>Certificate</code>s
413+ * @return a <code>CertPath</code> initialized with the supplied list of
414+ * certificates
415+ * @exception CertificateException if an exception occurs
416+ * @since 1.4
417+ */
418+ public final CertPath
419+ generateCertPath(List<? extends Certificate> certificates)
420+ throws CertificateException
421+ {
422+ return(certFacSpi.engineGenerateCertPath(certificates));
423+ }
424+
425+ /**
426+ * Returns a (possibly empty) collection view of the certificates read
427+ * from the given input stream <code>inStream</code>.
428+ *
429+ * <p>In order to take advantage of the specialized certificate format
430+ * supported by this certificate factory, each element in
431+ * the returned collection view can be typecast to the corresponding
432+ * certificate class. For example, if this certificate
433+ * factory implements X.509 certificates, the elements in the returned
434+ * collection can be typecast to the <code>X509Certificate</code> class.
435+ *
436+ * <p>In the case of a certificate factory for X.509 certificates,
437+ * <code>inStream</code> may contain a sequence of DER-encoded certificates
438+ * in the formats described for
439+ * {@link #generateCertificate(java.io.InputStream) generateCertificate}.
440+ * In addition, <code>inStream</code> may contain a PKCS#7 certificate
441+ * chain. This is a PKCS#7 <i>SignedData</i> object, with the only
442+ * significant field being <i>certificates</i>. In particular, the
443+ * signature and the contents are ignored. This format allows multiple
444+ * certificates to be downloaded at once. If no certificates are present,
445+ * an empty collection is returned.
446+ *
447+ * <p>Note that if the given input stream does not support
448+ * {@link java.io.InputStream#mark(int) mark} and
449+ * {@link java.io.InputStream#reset() reset}, this method will
450+ * consume the entire input stream.
451+ *
452+ * @param inStream the input stream with the certificates.
453+ *
454+ * @return a (possibly empty) collection view of
455+ * java.security.cert.Certificate objects
456+ * initialized with the data from the input stream.
457+ *
458+ * @exception CertificateException on parsing errors.
459+ */
460+ public final Collection<? extends Certificate> generateCertificates
461+ (InputStream inStream) throws CertificateException {
462+ return certFacSpi.engineGenerateCertificates(inStream);
463+ }
464+
465+ /**
466+ * Generates a certificate revocation list (CRL) object and initializes it
467+ * with the data read from the input stream <code>inStream</code>.
468+ *
469+ * <p>In order to take advantage of the specialized CRL format
470+ * supported by this certificate factory,
471+ * the returned CRL object can be typecast to the corresponding
472+ * CRL class. For example, if this certificate
473+ * factory implements X.509 CRLs, the returned CRL object
474+ * can be typecast to the <code>X509CRL</code> class.
475+ *
476+ * <p>Note that if the given input stream does not support
477+ * {@link java.io.InputStream#mark(int) mark} and
478+ * {@link java.io.InputStream#reset() reset}, this method will
479+ * consume the entire input stream. Otherwise, each call to this
480+ * method consumes one CRL and the read position of the input stream
481+ * is positioned to the next available byte after the inherent
482+ * end-of-CRL marker. If the data in the
483+ * input stream does not contain an inherent end-of-CRL marker (other
484+ * than EOF) and there is trailing data after the CRL is parsed, a
485+ * <code>CRLException</code> is thrown.
486+ *
487+ * @param inStream an input stream with the CRL data.
488+ *
489+ * @return a CRL object initialized with the data
490+ * from the input stream.
491+ *
492+ * @exception CRLException on parsing errors.
493+ */
494+ public final CRL generateCRL(InputStream inStream)
495+ throws CRLException
496+ {
497+ return certFacSpi.engineGenerateCRL(inStream);
498+ }
499+
500+ /**
501+ * Returns a (possibly empty) collection view of the CRLs read
502+ * from the given input stream <code>inStream</code>.
503+ *
504+ * <p>In order to take advantage of the specialized CRL format
505+ * supported by this certificate factory, each element in
506+ * the returned collection view can be typecast to the corresponding
507+ * CRL class. For example, if this certificate
508+ * factory implements X.509 CRLs, the elements in the returned
509+ * collection can be typecast to the <code>X509CRL</code> class.
510+ *
511+ * <p>In the case of a certificate factory for X.509 CRLs,
512+ * <code>inStream</code> may contain a sequence of DER-encoded CRLs.
513+ * In addition, <code>inStream</code> may contain a PKCS#7 CRL
514+ * set. This is a PKCS#7 <i>SignedData</i> object, with the only
515+ * significant field being <i>crls</i>. In particular, the
516+ * signature and the contents are ignored. This format allows multiple
517+ * CRLs to be downloaded at once. If no CRLs are present,
518+ * an empty collection is returned.
519+ *
520+ * <p>Note that if the given input stream does not support
521+ * {@link java.io.InputStream#mark(int) mark} and
522+ * {@link java.io.InputStream#reset() reset}, this method will
523+ * consume the entire input stream.
524+ *
525+ * @param inStream the input stream with the CRLs.
526+ *
527+ * @return a (possibly empty) collection view of
528+ * java.security.cert.CRL objects initialized with the data from the input
529+ * stream.
530+ *
531+ * @exception CRLException on parsing errors.
532+ */
533+ public final Collection<? extends CRL> generateCRLs(InputStream inStream)
534+ throws CRLException {
535+ return certFacSpi.engineGenerateCRLs(inStream);
536+ }
537+}
java/pkg/java/security/cert/CertificateFactorySpi.class+0−0

Binary file not shown.

java/pkg/java/security/cert/CertificateFactorySpi.java+315−0
@@ -0,0 +1,315 @@
1+/*
2+ * Copyright (c) 1998, 2011, Oracle and/or its affiliates. All rights reserved.
3+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
4+ *
5+ * This code is free software; you can redistribute it and/or modify it
6+ * under the terms of the GNU General Public License version 2 only, as
7+ * published by the Free Software Foundation. Oracle designates this
8+ * particular file as subject to the "Classpath" exception as provided
9+ * by Oracle in the LICENSE file that accompanied this code.
10+ *
11+ * This code is distributed in the hope that it will be useful, but WITHOUT
12+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
13+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
14+ * version 2 for more details (a copy is included in the LICENSE file that
15+ * accompanied this code).
16+ *
17+ * You should have received a copy of the GNU General Public License version
18+ * 2 along with this work; if not, write to the Free Software Foundation,
19+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
20+ *
21+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
22+ * or visit www.oracle.com if you need additional information or have any
23+ * questions.
24+ */
25+
26+package java.security.cert;
27+
28+import java.io.InputStream;
29+import java.util.Collection;
30+import java.util.Iterator;
31+import java.util.List;
32+import java.security.Provider;
33+import java.security.NoSuchAlgorithmException;
34+import java.security.NoSuchProviderException;
35+
36+/**
37+ * This class defines the <i>Service Provider Interface</i> (<b>SPI</b>)
38+ * for the <code>CertificateFactory</code> class.
39+ * All the abstract methods in this class must be implemented by each
40+ * cryptographic service provider who wishes to supply the implementation
41+ * of a certificate factory for a particular certificate type, e.g., X.509.
42+ *
43+ * <p>Certificate factories are used to generate certificate, certification path
44+ * (<code>CertPath</code>) and certificate revocation list (CRL) objects from
45+ * their encodings.
46+ *
47+ * <p>A certificate factory for X.509 must return certificates that are an
48+ * instance of <code>java.security.cert.X509Certificate</code>, and CRLs
49+ * that are an instance of <code>java.security.cert.X509CRL</code>.
50+ *
51+ * @author Hemma Prafullchandra
52+ * @author Jan Luehe
53+ * @author Sean Mullan
54+ *
55+ *
56+ * @see CertificateFactory
57+ * @see Certificate
58+ * @see X509Certificate
59+ * @see CertPath
60+ * @see CRL
61+ * @see X509CRL
62+ *
63+ * @since 1.2
64+ */
65+
66+public abstract class CertificateFactorySpi {
67+
68+ /**
69+ * Generates a certificate object and initializes it with
70+ * the data read from the input stream <code>inStream</code>.
71+ *
72+ * <p>In order to take advantage of the specialized certificate format
73+ * supported by this certificate factory,
74+ * the returned certificate object can be typecast to the corresponding
75+ * certificate class. For example, if this certificate
76+ * factory implements X.509 certificates, the returned certificate object
77+ * can be typecast to the <code>X509Certificate</code> class.
78+ *
79+ * <p>In the case of a certificate factory for X.509 certificates, the
80+ * certificate provided in <code>inStream</code> must be DER-encoded and
81+ * may be supplied in binary or printable (Base64) encoding. If the
82+ * certificate is provided in Base64 encoding, it must be bounded at
83+ * the beginning by -----BEGIN CERTIFICATE-----, and must be bounded at
84+ * the end by -----END CERTIFICATE-----.
85+ *
86+ * <p>Note that if the given input stream does not support
87+ * {@link java.io.InputStream#mark(int) mark} and
88+ * {@link java.io.InputStream#reset() reset}, this method will
89+ * consume the entire input stream. Otherwise, each call to this
90+ * method consumes one certificate and the read position of the input stream
91+ * is positioned to the next available byte after the inherent
92+ * end-of-certificate marker. If the data in the
93+ * input stream does not contain an inherent end-of-certificate marker (other
94+ * than EOF) and there is trailing data after the certificate is parsed, a
95+ * <code>CertificateException</code> is thrown.
96+ *
97+ * @param inStream an input stream with the certificate data.
98+ *
99+ * @return a certificate object initialized with the data
100+ * from the input stream.
101+ *
102+ * @exception CertificateException on parsing errors.
103+ */
104+ public abstract Certificate engineGenerateCertificate(InputStream inStream)
105+ throws CertificateException;
106+
107+ /**
108+ * Generates a <code>CertPath</code> object and initializes it with
109+ * the data read from the <code>InputStream</code> inStream. The data
110+ * is assumed to be in the default encoding.
111+ *
112+ * <p> This method was added to version 1.4 of the Java 2 Platform
113+ * Standard Edition. In order to maintain backwards compatibility with
114+ * existing service providers, this method cannot be <code>abstract</code>
115+ * and by default throws an <code>UnsupportedOperationException</code>.
116+ *
117+ * @param inStream an <code>InputStream</code> containing the data
118+ * @return a <code>CertPath</code> initialized with the data from the
119+ * <code>InputStream</code>
120+ * @exception CertificateException if an exception occurs while decoding
121+ * @exception UnsupportedOperationException if the method is not supported
122+ * @since 1.4
123+ */
124+ public CertPath engineGenerateCertPath(InputStream inStream)
125+ throws CertificateException
126+ {
127+ throw new UnsupportedOperationException();
128+ }
129+
130+ /**
131+ * Generates a <code>CertPath</code> object and initializes it with
132+ * the data read from the <code>InputStream</code> inStream. The data
133+ * is assumed to be in the specified encoding.
134+ *
135+ * <p> This method was added to version 1.4 of the Java 2 Platform
136+ * Standard Edition. In order to maintain backwards compatibility with
137+ * existing service providers, this method cannot be <code>abstract</code>
138+ * and by default throws an <code>UnsupportedOperationException</code>.
139+ *
140+ * @param inStream an <code>InputStream</code> containing the data
141+ * @param encoding the encoding used for the data
142+ * @return a <code>CertPath</code> initialized with the data from the
143+ * <code>InputStream</code>
144+ * @exception CertificateException if an exception occurs while decoding or
145+ * the encoding requested is not supported
146+ * @exception UnsupportedOperationException if the method is not supported
147+ * @since 1.4
148+ */
149+ public CertPath engineGenerateCertPath(InputStream inStream,
150+ String encoding) throws CertificateException
151+ {
152+ throw new UnsupportedOperationException();
153+ }
154+
155+ /**
156+ * Generates a <code>CertPath</code> object and initializes it with
157+ * a <code>List</code> of <code>Certificate</code>s.
158+ * <p>
159+ * The certificates supplied must be of a type supported by the
160+ * <code>CertificateFactory</code>. They will be copied out of the supplied
161+ * <code>List</code> object.
162+ *
163+ * <p> This method was added to version 1.4 of the Java 2 Platform
164+ * Standard Edition. In order to maintain backwards compatibility with
165+ * existing service providers, this method cannot be <code>abstract</code>
166+ * and by default throws an <code>UnsupportedOperationException</code>.
167+ *
168+ * @param certificates a <code>List</code> of <code>Certificate</code>s
169+ * @return a <code>CertPath</code> initialized with the supplied list of
170+ * certificates
171+ * @exception CertificateException if an exception occurs
172+ * @exception UnsupportedOperationException if the method is not supported
173+ * @since 1.4
174+ */
175+ public CertPath
176+ engineGenerateCertPath(List<? extends Certificate> certificates)
177+ throws CertificateException
178+ {
179+ throw new UnsupportedOperationException();
180+ }
181+
182+ /**
183+ * Returns an iteration of the <code>CertPath</code> encodings supported
184+ * by this certificate factory, with the default encoding first. See
185+ * the CertPath Encodings section in the <a href=
186+ * "{@docRoot}/../technotes/guides/security/StandardNames.html#CertPathEncodings">
187+ * Java Cryptography Architecture Standard Algorithm Name Documentation</a>
188+ * for information about standard encoding names.
189+ * <p>
190+ * Attempts to modify the returned <code>Iterator</code> via its
191+ * <code>remove</code> method result in an
192+ * <code>UnsupportedOperationException</code>.
193+ *
194+ * <p> This method was added to version 1.4 of the Java 2 Platform
195+ * Standard Edition. In order to maintain backwards compatibility with
196+ * existing service providers, this method cannot be <code>abstract</code>
197+ * and by default throws an <code>UnsupportedOperationException</code>.
198+ *
199+ * @return an <code>Iterator</code> over the names of the supported
200+ * <code>CertPath</code> encodings (as <code>String</code>s)
201+ * @exception UnsupportedOperationException if the method is not supported
202+ * @since 1.4
203+ */
204+ public Iterator<String> engineGetCertPathEncodings() {
205+ throw new UnsupportedOperationException();
206+ }
207+
208+ /**
209+ * Returns a (possibly empty) collection view of the certificates read
210+ * from the given input stream <code>inStream</code>.
211+ *
212+ * <p>In order to take advantage of the specialized certificate format
213+ * supported by this certificate factory, each element in
214+ * the returned collection view can be typecast to the corresponding
215+ * certificate class. For example, if this certificate
216+ * factory implements X.509 certificates, the elements in the returned
217+ * collection can be typecast to the <code>X509Certificate</code> class.
218+ *
219+ * <p>In the case of a certificate factory for X.509 certificates,
220+ * <code>inStream</code> may contain a single DER-encoded certificate
221+ * in the formats described for
222+ * {@link CertificateFactory#generateCertificate(java.io.InputStream)
223+ * generateCertificate}.
224+ * In addition, <code>inStream</code> may contain a PKCS#7 certificate
225+ * chain. This is a PKCS#7 <i>SignedData</i> object, with the only
226+ * significant field being <i>certificates</i>. In particular, the
227+ * signature and the contents are ignored. This format allows multiple
228+ * certificates to be downloaded at once. If no certificates are present,
229+ * an empty collection is returned.
230+ *
231+ * <p>Note that if the given input stream does not support
232+ * {@link java.io.InputStream#mark(int) mark} and
233+ * {@link java.io.InputStream#reset() reset}, this method will
234+ * consume the entire input stream.
235+ *
236+ * @param inStream the input stream with the certificates.
237+ *
238+ * @return a (possibly empty) collection view of
239+ * java.security.cert.Certificate objects
240+ * initialized with the data from the input stream.
241+ *
242+ * @exception CertificateException on parsing errors.
243+ */
244+ public abstract Collection<? extends Certificate>
245+ engineGenerateCertificates(InputStream inStream)
246+ throws CertificateException;
247+
248+ /**
249+ * Generates a certificate revocation list (CRL) object and initializes it
250+ * with the data read from the input stream <code>inStream</code>.
251+ *
252+ * <p>In order to take advantage of the specialized CRL format
253+ * supported by this certificate factory,
254+ * the returned CRL object can be typecast to the corresponding
255+ * CRL class. For example, if this certificate
256+ * factory implements X.509 CRLs, the returned CRL object
257+ * can be typecast to the <code>X509CRL</code> class.
258+ *
259+ * <p>Note that if the given input stream does not support
260+ * {@link java.io.InputStream#mark(int) mark} and
261+ * {@link java.io.InputStream#reset() reset}, this method will
262+ * consume the entire input stream. Otherwise, each call to this
263+ * method consumes one CRL and the read position of the input stream
264+ * is positioned to the next available byte after the inherent
265+ * end-of-CRL marker. If the data in the
266+ * input stream does not contain an inherent end-of-CRL marker (other
267+ * than EOF) and there is trailing data after the CRL is parsed, a
268+ * <code>CRLException</code> is thrown.
269+ *
270+ * @param inStream an input stream with the CRL data.
271+ *
272+ * @return a CRL object initialized with the data
273+ * from the input stream.
274+ *
275+ * @exception CRLException on parsing errors.
276+ */
277+ public abstract CRL engineGenerateCRL(InputStream inStream)
278+ throws CRLException;
279+
280+ /**
281+ * Returns a (possibly empty) collection view of the CRLs read
282+ * from the given input stream <code>inStream</code>.
283+ *
284+ * <p>In order to take advantage of the specialized CRL format
285+ * supported by this certificate factory, each element in
286+ * the returned collection view can be typecast to the corresponding
287+ * CRL class. For example, if this certificate
288+ * factory implements X.509 CRLs, the elements in the returned
289+ * collection can be typecast to the <code>X509CRL</code> class.
290+ *
291+ * <p>In the case of a certificate factory for X.509 CRLs,
292+ * <code>inStream</code> may contain a single DER-encoded CRL.
293+ * In addition, <code>inStream</code> may contain a PKCS#7 CRL
294+ * set. This is a PKCS#7 <i>SignedData</i> object, with the only
295+ * significant field being <i>crls</i>. In particular, the
296+ * signature and the contents are ignored. This format allows multiple
297+ * CRLs to be downloaded at once. If no CRLs are present,
298+ * an empty collection is returned.
299+ *
300+ * <p>Note that if the given input stream does not support
301+ * {@link java.io.InputStream#mark(int) mark} and
302+ * {@link java.io.InputStream#reset() reset}, this method will
303+ * consume the entire input stream.
304+ *
305+ * @param inStream the input stream with the CRLs.
306+ *
307+ * @return a (possibly empty) collection view of
308+ * java.security.cert.CRL objects initialized with the data from the input
309+ * stream.
310+ *
311+ * @exception CRLException on parsing errors.
312+ */
313+ public abstract Collection<? extends CRL> engineGenerateCRLs
314+ (InputStream inStream) throws CRLException;
315+}
java/pkg/java/security/cert/CertificateNotYetValidException.class+0−0

Binary file not shown.

java/pkg/java/security/cert/CertificateNotYetValidException.java+59−0
@@ -0,0 +1,59 @@
1+/*
2+ * Copyright (c) 1997, 2003, Oracle and/or its affiliates. All rights reserved.
3+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
4+ *
5+ * This code is free software; you can redistribute it and/or modify it
6+ * under the terms of the GNU General Public License version 2 only, as
7+ * published by the Free Software Foundation. Oracle designates this
8+ * particular file as subject to the "Classpath" exception as provided
9+ * by Oracle in the LICENSE file that accompanied this code.
10+ *
11+ * This code is distributed in the hope that it will be useful, but WITHOUT
12+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
13+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
14+ * version 2 for more details (a copy is included in the LICENSE file that
15+ * accompanied this code).
16+ *
17+ * You should have received a copy of the GNU General Public License version
18+ * 2 along with this work; if not, write to the Free Software Foundation,
19+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
20+ *
21+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
22+ * or visit www.oracle.com if you need additional information or have any
23+ * questions.
24+ */
25+
26+package java.security.cert;
27+
28+/**
29+ * Certificate is not yet valid exception. This is thrown whenever
30+ * the current <code>Date</code> or the specified <code>Date</code>
31+ * is before the <code>notBefore</code> date/time in the Certificate
32+ * validity period.
33+ *
34+ * @author Hemma Prafullchandra
35+ */
36+public class CertificateNotYetValidException extends CertificateException {
37+
38+ static final long serialVersionUID = 4355919900041064702L;
39+
40+ /**
41+ * Constructs a CertificateNotYetValidException with no detail message. A
42+ * detail message is a String that describes this particular
43+ * exception.
44+ */
45+ public CertificateNotYetValidException() {
46+ super();
47+ }
48+
49+ /**
50+ * Constructs a CertificateNotYetValidException with the specified detail
51+ * message. A detail message is a String that describes this
52+ * particular exception.
53+ *
54+ * @param message the detail message.
55+ */
56+ public CertificateNotYetValidException(String message) {
57+ super(message);
58+ }
59+}
java/pkg/java/security/cert/CertificateParsingException.class+0−0

Binary file not shown.

java/pkg/java/security/cert/CertificateParsingException.java+89−0
@@ -0,0 +1,89 @@
1+/*
2+ * Copyright (c) 1997, 2003, Oracle and/or its affiliates. All rights reserved.
3+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
4+ *
5+ * This code is free software; you can redistribute it and/or modify it
6+ * under the terms of the GNU General Public License version 2 only, as
7+ * published by the Free Software Foundation. Oracle designates this
8+ * particular file as subject to the "Classpath" exception as provided
9+ * by Oracle in the LICENSE file that accompanied this code.
10+ *
11+ * This code is distributed in the hope that it will be useful, but WITHOUT
12+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
13+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
14+ * version 2 for more details (a copy is included in the LICENSE file that
15+ * accompanied this code).
16+ *
17+ * You should have received a copy of the GNU General Public License version
18+ * 2 along with this work; if not, write to the Free Software Foundation,
19+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
20+ *
21+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
22+ * or visit www.oracle.com if you need additional information or have any
23+ * questions.
24+ */
25+
26+package java.security.cert;
27+
28+/**
29+ * Certificate Parsing Exception. This is thrown whenever an
30+ * invalid DER-encoded certificate is parsed or unsupported DER features
31+ * are found in the Certificate.
32+ *
33+ * @author Hemma Prafullchandra
34+ */
35+public class CertificateParsingException extends CertificateException {
36+
37+ private static final long serialVersionUID = -7989222416793322029L;
38+
39+ /**
40+ * Constructs a CertificateParsingException with no detail message. A
41+ * detail message is a String that describes this particular
42+ * exception.
43+ */
44+ public CertificateParsingException() {
45+ super();
46+ }
47+
48+ /**
49+ * Constructs a CertificateParsingException with the specified detail
50+ * message. A detail message is a String that describes this
51+ * particular exception.
52+ *
53+ * @param message the detail message.
54+ */
55+ public CertificateParsingException(String message) {
56+ super(message);
57+ }
58+
59+ /**
60+ * Creates a <code>CertificateParsingException</code> with the specified
61+ * detail message and cause.
62+ *
63+ * @param message the detail message (which is saved for later retrieval
64+ * by the {@link #getMessage()} method).
65+ * @param cause the cause (which is saved for later retrieval by the
66+ * {@link #getCause()} method). (A <tt>null</tt> value is permitted,
67+ * and indicates that the cause is nonexistent or unknown.)
68+ * @since 1.5
69+ */
70+ public CertificateParsingException(String message, Throwable cause) {
71+ super(message, cause);
72+ }
73+
74+ /**
75+ * Creates a <code>CertificateParsingException</code> with the
76+ * specified cause and a detail message of
77+ * <tt>(cause==null ? null : cause.toString())</tt>
78+ * (which typically contains the class and detail message of
79+ * <tt>cause</tt>).
80+ *
81+ * @param cause the cause (which is saved for later retrieval by the
82+ * {@link #getCause()} method). (A <tt>null</tt> value is permitted,
83+ * and indicates that the cause is nonexistent or unknown.)
84+ * @since 1.5
85+ */
86+ public CertificateParsingException(Throwable cause) {
87+ super(cause);
88+ }
89+}
java/pkg/java/security/cert/CertificateRevokedException.class+0−0

Binary file not shown.

java/pkg/java/security/cert/CertificateRevokedException.java+245−0
@@ -0,0 +1,245 @@
1+/*
2+ * Copyright (c) 2007, 2010, Oracle and/or its affiliates. All rights reserved.
3+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
4+ *
5+ * This code is free software; you can redistribute it and/or modify it
6+ * under the terms of the GNU General Public License version 2 only, as
7+ * published by the Free Software Foundation. Oracle designates this
8+ * particular file as subject to the "Classpath" exception as provided
9+ * by Oracle in the LICENSE file that accompanied this code.
10+ *
11+ * This code is distributed in the hope that it will be useful, but WITHOUT
12+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
13+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
14+ * version 2 for more details (a copy is included in the LICENSE file that
15+ * accompanied this code).
16+ *
17+ * You should have received a copy of the GNU General Public License version
18+ * 2 along with this work; if not, write to the Free Software Foundation,
19+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
20+ *
21+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
22+ * or visit www.oracle.com if you need additional information or have any
23+ * questions.
24+ */
25+
26+package java.security.cert;
27+
28+import java.io.ObjectInputStream;
29+import java.io.ObjectOutputStream;
30+import java.io.IOException;
31+import java.util.Collections;
32+import java.util.Date;
33+import java.util.HashMap;
34+import java.util.Map;
35+import java.util.Map.Entry;
36+import javax.security.auth.x500.X500Principal;
37+
38+import sun.security.util.ObjectIdentifier;
39+import sun.security.x509.InvalidityDateExtension;
40+
41+/**
42+ * An exception that indicates an X.509 certificate is revoked. A
43+ * <code>CertificateRevokedException</code> contains additional information
44+ * about the revoked certificate, such as the date on which the
45+ * certificate was revoked and the reason it was revoked.
46+ *
47+ * @author Sean Mullan
48+ * @since 1.7
49+ * @see CertPathValidatorException
50+ */
51+public class CertificateRevokedException extends CertificateException {
52+
53+ private static final long serialVersionUID = 7839996631571608627L;
54+
55+ /**
56+ * @serial the date on which the certificate was revoked
57+ */
58+ private Date revocationDate;
59+ /**
60+ * @serial the revocation reason
61+ */
62+ private final CRLReason reason;
63+ /**
64+ * @serial the <code>X500Principal</code> that represents the name of the
65+ * authority that signed the certificate's revocation status information
66+ */
67+ private final X500Principal authority;
68+
69+ private transient Map<String, Extension> extensions;
70+
71+ /**
72+ * Constructs a <code>CertificateRevokedException</code> with
73+ * the specified revocation date, reason code, authority name, and map
74+ * of extensions.
75+ *
76+ * @param revocationDate the date on which the certificate was revoked. The
77+ * date is copied to protect against subsequent modification.
78+ * @param reason the revocation reason
79+ * @param extensions a map of X.509 Extensions. Each key is an OID String
80+ * that maps to the corresponding Extension. The map is copied to
81+ * prevent subsequent modification.
82+ * @param authority the <code>X500Principal</code> that represents the name
83+ * of the authority that signed the certificate's revocation status
84+ * information
85+ * @throws NullPointerException if <code>revocationDate</code>,
86+ * <code>reason</code>, <code>authority</code>, or
87+ * <code>extensions</code> is <code>null</code>
88+ */
89+ public CertificateRevokedException(Date revocationDate, CRLReason reason,
90+ X500Principal authority, Map<String, Extension> extensions) {
91+ if (revocationDate == null || reason == null || authority == null ||
92+ extensions == null) {
93+ throw new NullPointerException();
94+ }
95+ this.revocationDate = new Date(revocationDate.getTime());
96+ this.reason = reason;
97+ this.authority = authority;
98+ this.extensions = new HashMap(extensions);
99+ }
100+
101+ /**
102+ * Returns the date on which the certificate was revoked. A new copy is
103+ * returned each time the method is invoked to protect against subsequent
104+ * modification.
105+ *
106+ * @return the revocation date
107+ */
108+ public Date getRevocationDate() {
109+ return (Date) revocationDate.clone();
110+ }
111+
112+ /**
113+ * Returns the reason the certificate was revoked.
114+ *
115+ * @return the revocation reason
116+ */
117+ public CRLReason getRevocationReason() {
118+ return reason;
119+ }
120+
121+ /**
122+ * Returns the name of the authority that signed the certificate's
123+ * revocation status information.
124+ *
125+ * @return the <code>X500Principal</code> that represents the name of the
126+ * authority that signed the certificate's revocation status information
127+ */
128+ public X500Principal getAuthorityName() {
129+ return authority;
130+ }
131+
132+ /**
133+ * Returns the invalidity date, as specifed in the Invalidity Date
134+ * extension of this <code>CertificateRevokedException</code>. The
135+ * invalidity date is the date on which it is known or suspected that the
136+ * private key was compromised or that the certificate otherwise became
137+ * invalid. This implementation calls <code>getExtensions()</code> and
138+ * checks the returned map for an entry for the Invalidity Date extension
139+ * OID ("2.5.29.24"). If found, it returns the invalidity date in the
140+ * extension; otherwise null. A new Date object is returned each time the
141+ * method is invoked to protect against subsequent modification.
142+ *
143+ * @return the invalidity date, or <code>null</code> if not specified
144+ */
145+ public Date getInvalidityDate() {
146+ Extension ext = getExtensions().get("2.5.29.24");
147+ if (ext == null) {
148+ return null;
149+ } else {
150+ try {
151+ Date invalidity =
152+ (Date) InvalidityDateExtension.toImpl(ext).get("DATE");
153+ return new Date(invalidity.getTime());
154+ } catch (IOException ioe) {
155+ return null;
156+ }
157+ }
158+ }
159+
160+ /**
161+ * Returns a map of X.509 extensions containing additional information
162+ * about the revoked certificate, such as the Invalidity Date
163+ * Extension. Each key is an OID String that maps to the corresponding
164+ * Extension.
165+ *
166+ * @return an unmodifiable map of X.509 extensions, or an empty map
167+ * if there are no extensions
168+ */
169+ public Map<String, Extension> getExtensions() {
170+ return Collections.unmodifiableMap(extensions);
171+ }
172+
173+ @Override
174+ public String getMessage() {
175+ return "Certificate has been revoked, reason: "
176+ + reason + ", revocation date: " + revocationDate
177+ + ", authority: " + authority + ", extensions: " + extensions;
178+ }
179+
180+ /**
181+ * Serialize this <code>CertificateRevokedException</code> instance.
182+ *
183+ * @serialData the size of the extensions map (int), followed by all of
184+ * the extensions in the map, in no particular order. For each extension,
185+ * the following data is emitted: the OID String (Object), the criticality
186+ * flag (boolean), the length of the encoded extension value byte array
187+ * (int), and the encoded extension value bytes.
188+ */
189+ private void writeObject(ObjectOutputStream oos) throws IOException {
190+ // Write out the non-transient fields
191+ // (revocationDate, reason, authority)
192+ oos.defaultWriteObject();
193+
194+ // Write out the size (number of mappings) of the extensions map
195+ oos.writeInt(extensions.size());
196+
197+ // For each extension in the map, the following are emitted (in order):
198+ // the OID String (Object), the criticality flag (boolean), the length
199+ // of the encoded extension value byte array (int), and the encoded
200+ // extension value byte array. The extensions themselves are emitted
201+ // in no particular order.
202+ for (Map.Entry<String, Extension> entry : extensions.entrySet()) {
203+ Extension ext = entry.getValue();
204+ oos.writeObject(ext.getId());
205+ oos.writeBoolean(ext.isCritical());
206+ byte[] extVal = ext.getValue();
207+ oos.writeInt(extVal.length);
208+ oos.write(extVal);
209+ }
210+ }
211+
212+ /**
213+ * Deserialize the <code>CertificateRevokedException</code> instance.
214+ */
215+ private void readObject(ObjectInputStream ois)
216+ throws IOException, ClassNotFoundException {
217+ // Read in the non-transient fields
218+ // (revocationDate, reason, authority)
219+ ois.defaultReadObject();
220+
221+ // Defensively copy the revocation date
222+ revocationDate = new Date(revocationDate.getTime());
223+
224+ // Read in the size (number of mappings) of the extensions map
225+ // and create the extensions map
226+ int size = ois.readInt();
227+ if (size == 0) {
228+ extensions = Collections.emptyMap();
229+ } else {
230+ extensions = new HashMap<String, Extension>(size);
231+ }
232+
233+ // Read in the extensions and put the mappings in the extensions map
234+ for (int i = 0; i < size; i++) {
235+ String oid = (String) ois.readObject();
236+ boolean critical = ois.readBoolean();
237+ int length = ois.readInt();
238+ byte[] extVal = new byte[length];
239+ ois.readFully(extVal);
240+ Extension ext = sun.security.x509.Extension.newExtension
241+ (new ObjectIdentifier(oid), critical, extVal);
242+ extensions.put(oid, ext);
243+ }
244+ }
245+}
java/pkg/java/security/cert/CollectionCertStoreParameters.class+0−0

Binary file not shown.

java/pkg/java/security/cert/CollectionCertStoreParameters.java+141−0
@@ -0,0 +1,141 @@
1+/*
2+ * Copyright (c) 2000, 2006, Oracle and/or its affiliates. All rights reserved.
3+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
4+ *
5+ * This code is free software; you can redistribute it and/or modify it
6+ * under the terms of the GNU General Public License version 2 only, as
7+ * published by the Free Software Foundation. Oracle designates this
8+ * particular file as subject to the "Classpath" exception as provided
9+ * by Oracle in the LICENSE file that accompanied this code.
10+ *
11+ * This code is distributed in the hope that it will be useful, but WITHOUT
12+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
13+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
14+ * version 2 for more details (a copy is included in the LICENSE file that
15+ * accompanied this code).
16+ *
17+ * You should have received a copy of the GNU General Public License version
18+ * 2 along with this work; if not, write to the Free Software Foundation,
19+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
20+ *
21+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
22+ * or visit www.oracle.com if you need additional information or have any
23+ * questions.
24+ */
25+
26+package java.security.cert;
27+
28+import java.io.Serializable;
29+import java.util.Collection;
30+import java.util.Collections;
31+
32+/**
33+ * Parameters used as input for the Collection <code>CertStore</code>
34+ * algorithm.
35+ * <p>
36+ * This class is used to provide necessary configuration parameters
37+ * to implementations of the Collection <code>CertStore</code>
38+ * algorithm. The only parameter included in this class is the
39+ * <code>Collection</code> from which the <code>CertStore</code> will
40+ * retrieve certificates and CRLs.
41+ * <p>
42+ * <b>Concurrent Access</b>
43+ * <p>
44+ * Unless otherwise specified, the methods defined in this class are not
45+ * thread-safe. Multiple threads that need to access a single
46+ * object concurrently should synchronize amongst themselves and
47+ * provide the necessary locking. Multiple threads each manipulating
48+ * separate objects need not synchronize.
49+ *
50+ * @since 1.4
51+ * @author Steve Hanna
52+ * @see java.util.Collection
53+ * @see CertStore
54+ */
55+public class CollectionCertStoreParameters
56+ implements CertStoreParameters {
57+
58+ private Collection<?> coll;
59+
60+ /**
61+ * Creates an instance of <code>CollectionCertStoreParameters</code>
62+ * which will allow certificates and CRLs to be retrieved from the
63+ * specified <code>Collection</code>. If the specified
64+ * <code>Collection</code> contains an object that is not a
65+ * <code>Certificate</code> or <code>CRL</code>, that object will be
66+ * ignored by the Collection <code>CertStore</code>.
67+ * <p>
68+ * The <code>Collection</code> is <b>not</b> copied. Instead, a
69+ * reference is used. This allows the caller to subsequently add or
70+ * remove <code>Certificates</code> or <code>CRL</code>s from the
71+ * <code>Collection</code>, thus changing the set of
72+ * <code>Certificates</code> or <code>CRL</code>s available to the
73+ * Collection <code>CertStore</code>. The Collection <code>CertStore</code>
74+ * will not modify the contents of the <code>Collection</code>.
75+ * <p>
76+ * If the <code>Collection</code> will be modified by one thread while
77+ * another thread is calling a method of a Collection <code>CertStore</code>
78+ * that has been initialized with this <code>Collection</code>, the
79+ * <code>Collection</code> must have fail-fast iterators.
80+ *
81+ * @param collection a <code>Collection</code> of
82+ * <code>Certificate</code>s and <code>CRL</code>s
83+ * @exception NullPointerException if <code>collection</code> is
84+ * <code>null</code>
85+ */
86+ public CollectionCertStoreParameters(Collection<?> collection) {
87+ if (collection == null)
88+ throw new NullPointerException();
89+ coll = collection;
90+ }
91+
92+ /**
93+ * Creates an instance of <code>CollectionCertStoreParameters</code> with
94+ * the default parameter values (an empty and immutable
95+ * <code>Collection</code>).
96+ */
97+ public CollectionCertStoreParameters() {
98+ coll = Collections.EMPTY_SET;
99+ }
100+
101+ /**
102+ * Returns the <code>Collection</code> from which <code>Certificate</code>s
103+ * and <code>CRL</code>s are retrieved. This is <b>not</b> a copy of the
104+ * <code>Collection</code>, it is a reference. This allows the caller to
105+ * subsequently add or remove <code>Certificates</code> or
106+ * <code>CRL</code>s from the <code>Collection</code>.
107+ *
108+ * @return the <code>Collection</code> (never null)
109+ */
110+ public Collection<?> getCollection() {
111+ return coll;
112+ }
113+
114+ /**
115+ * Returns a copy of this object. Note that only a reference to the
116+ * <code>Collection</code> is copied, and not the contents.
117+ *
118+ * @return the copy
119+ */
120+ public Object clone() {
121+ try {
122+ return super.clone();
123+ } catch (CloneNotSupportedException e) {
124+ /* Cannot happen */
125+ throw new InternalError(e.toString());
126+ }
127+ }
128+
129+ /**
130+ * Returns a formatted string describing the parameters.
131+ *
132+ * @return a formatted string describing the parameters
133+ */
134+ public String toString() {
135+ StringBuffer sb = new StringBuffer();
136+ sb.append("CollectionCertStoreParameters: [\n");
137+ sb.append(" collection: " + coll + "\n");
138+ sb.append("]");
139+ return sb.toString();
140+ }
141+}
java/pkg/java/security/cert/Extension.class+0−0

Binary file not shown.

java/pkg/java/security/cert/Extension.java+101−0
@@ -0,0 +1,101 @@
1+/*
2+ * Copyright (c) 2007, Oracle and/or its affiliates. All rights reserved.
3+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
4+ *
5+ * This code is free software; you can redistribute it and/or modify it
6+ * under the terms of the GNU General Public License version 2 only, as
7+ * published by the Free Software Foundation. Oracle designates this
8+ * particular file as subject to the "Classpath" exception as provided
9+ * by Oracle in the LICENSE file that accompanied this code.
10+ *
11+ * This code is distributed in the hope that it will be useful, but WITHOUT
12+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
13+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
14+ * version 2 for more details (a copy is included in the LICENSE file that
15+ * accompanied this code).
16+ *
17+ * You should have received a copy of the GNU General Public License version
18+ * 2 along with this work; if not, write to the Free Software Foundation,
19+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
20+ *
21+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
22+ * or visit www.oracle.com if you need additional information or have any
23+ * questions.
24+ */
25+
26+package java.security.cert;
27+
28+import java.io.IOException;
29+import java.io.OutputStream;
30+import java.io.Serializable;
31+
32+/**
33+ * This interface represents an X.509 extension.
34+ *
35+ * <p>
36+ * Extensions provide a means of associating additional attributes with users
37+ * or public keys and for managing a certification hierarchy. The extension
38+ * format also allows communities to define private extensions to carry
39+ * information unique to those communities.
40+ *
41+ * <p>
42+ * Each extension contains an object identifier, a criticality setting
43+ * indicating whether it is a critical or a non-critical extension, and
44+ * and an ASN.1 DER-encoded value. Its ASN.1 definition is:
45+ *
46+ * <pre>
47+ *
48+ * Extension ::= SEQUENCE {
49+ * extnId OBJECT IDENTIFIER,
50+ * critical BOOLEAN DEFAULT FALSE,
51+ * extnValue OCTET STRING
52+ * -- contains a DER encoding of a value
53+ * -- of the type registered for use with
54+ * -- the extnId object identifier value
55+ * }
56+ *
57+ * </pre>
58+ *
59+ * <p>
60+ * This interface is designed to provide access to a single extension,
61+ * unlike {@link java.security.cert.X509Extension} which is more suitable
62+ * for accessing a set of extensions.
63+ *
64+ * @since 1.7
65+ */
66+public interface Extension {
67+
68+ /**
69+ * Gets the extensions's object identifier.
70+ *
71+ * @return the object identifier as a String
72+ */
73+ String getId();
74+
75+ /**
76+ * Gets the extension's criticality setting.
77+ *
78+ * @return true if this is a critical extension.
79+ */
80+ boolean isCritical();
81+
82+ /**
83+ * Gets the extensions's DER-encoded value. Note, this is the bytes
84+ * that are encoded as an OCTET STRING. It does not include the OCTET
85+ * STRING tag and length.
86+ *
87+ * @return a copy of the extension's value, or <code>null</code> if no
88+ * extension value is present.
89+ */
90+ byte[] getValue();
91+
92+ /**
93+ * Generates the extension's DER encoding and writes it to the output
94+ * stream.
95+ *
96+ * @param out the output stream
97+ * @exception IOException on encoding or output error.
98+ * @exception NullPointerException if <code>out</code> is <code>null</code>.
99+ */
100+ void encode(OutputStream out) throws IOException;
101+}
java/pkg/java/security/cert/LDAPCertStoreParameters.class+0−0

Binary file not shown.

java/pkg/java/security/cert/LDAPCertStoreParameters.java+149−0
@@ -0,0 +1,149 @@
1+/*
2+ * Copyright (c) 2000, 2001, Oracle and/or its affiliates. All rights reserved.
3+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
4+ *
5+ * This code is free software; you can redistribute it and/or modify it
6+ * under the terms of the GNU General Public License version 2 only, as
7+ * published by the Free Software Foundation. Oracle designates this
8+ * particular file as subject to the "Classpath" exception as provided
9+ * by Oracle in the LICENSE file that accompanied this code.
10+ *
11+ * This code is distributed in the hope that it will be useful, but WITHOUT
12+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
13+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
14+ * version 2 for more details (a copy is included in the LICENSE file that
15+ * accompanied this code).
16+ *
17+ * You should have received a copy of the GNU General Public License version
18+ * 2 along with this work; if not, write to the Free Software Foundation,
19+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
20+ *
21+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
22+ * or visit www.oracle.com if you need additional information or have any
23+ * questions.
24+ */
25+
26+package java.security.cert;
27+
28+/**
29+ * Parameters used as input for the LDAP <code>CertStore</code> algorithm.
30+ * <p>
31+ * This class is used to provide necessary configuration parameters (server
32+ * name and port number) to implementations of the LDAP <code>CertStore</code>
33+ * algorithm.
34+ * <p>
35+ * <b>Concurrent Access</b>
36+ * <p>
37+ * Unless otherwise specified, the methods defined in this class are not
38+ * thread-safe. Multiple threads that need to access a single
39+ * object concurrently should synchronize amongst themselves and
40+ * provide the necessary locking. Multiple threads each manipulating
41+ * separate objects need not synchronize.
42+ *
43+ * @since 1.4
44+ * @author Steve Hanna
45+ * @see CertStore
46+ */
47+public class LDAPCertStoreParameters implements CertStoreParameters {
48+
49+ private static final int LDAP_DEFAULT_PORT = 389;
50+
51+ /**
52+ * the port number of the LDAP server
53+ */
54+ private int port;
55+
56+ /**
57+ * the DNS name of the LDAP server
58+ */
59+ private String serverName;
60+
61+ /**
62+ * Creates an instance of <code>LDAPCertStoreParameters</code> with the
63+ * specified parameter values.
64+ *
65+ * @param serverName the DNS name of the LDAP server
66+ * @param port the port number of the LDAP server
67+ * @exception NullPointerException if <code>serverName</code> is
68+ * <code>null</code>
69+ */
70+ public LDAPCertStoreParameters(String serverName, int port) {
71+ if (serverName == null)
72+ throw new NullPointerException();
73+ this.serverName = serverName;
74+ this.port = port;
75+ }
76+
77+ /**
78+ * Creates an instance of <code>LDAPCertStoreParameters</code> with the
79+ * specified server name and a default port of 389.
80+ *
81+ * @param serverName the DNS name of the LDAP server
82+ * @exception NullPointerException if <code>serverName</code> is
83+ * <code>null</code>
84+ */
85+ public LDAPCertStoreParameters(String serverName) {
86+ this(serverName, LDAP_DEFAULT_PORT);
87+ }
88+
89+ /**
90+ * Creates an instance of <code>LDAPCertStoreParameters</code> with the
91+ * default parameter values (server name "localhost", port 389).
92+ */
93+ public LDAPCertStoreParameters() {
94+ this("localhost", LDAP_DEFAULT_PORT);
95+ }
96+
97+ /**
98+ * Returns the DNS name of the LDAP server.
99+ *
100+ * @return the name (not <code>null</code>)
101+ */
102+ public String getServerName() {
103+ return serverName;
104+ }
105+
106+ /**
107+ * Returns the port number of the LDAP server.
108+ *
109+ * @return the port number
110+ */
111+ public int getPort() {
112+ return port;
113+ }
114+
115+ /**
116+ * Returns a copy of this object. Changes to the copy will not affect
117+ * the original and vice versa.
118+ * <p>
119+ * Note: this method currently performs a shallow copy of the object
120+ * (simply calls <code>Object.clone()</code>). This may be changed in a
121+ * future revision to perform a deep copy if new parameters are added
122+ * that should not be shared.
123+ *
124+ * @return the copy
125+ */
126+ public Object clone() {
127+ try {
128+ return super.clone();
129+ } catch (CloneNotSupportedException e) {
130+ /* Cannot happen */
131+ throw new InternalError(e.toString());
132+ }
133+ }
134+
135+ /**
136+ * Returns a formatted string describing the parameters.
137+ *
138+ * @return a formatted string describing the parameters
139+ */
140+ public String toString() {
141+ StringBuffer sb = new StringBuffer();
142+ sb.append("LDAPCertStoreParameters: [\n");
143+
144+ sb.append(" serverName: " + serverName + "\n");
145+ sb.append(" port: " + port + "\n");
146+ sb.append("]");
147+ return sb.toString();
148+ }
149+}
java/pkg/java/security/cert/PKIXBuilderParameters.class+0−0

Binary file not shown.

java/pkg/java/security/cert/PKIXBuilderParameters.java+199−0
@@ -0,0 +1,199 @@
1+/*
2+ * Copyright (c) 2000, 2003, Oracle and/or its affiliates. All rights reserved.
3+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
4+ *
5+ * This code is free software; you can redistribute it and/or modify it
6+ * under the terms of the GNU General Public License version 2 only, as
7+ * published by the Free Software Foundation. Oracle designates this
8+ * particular file as subject to the "Classpath" exception as provided
9+ * by Oracle in the LICENSE file that accompanied this code.
10+ *
11+ * This code is distributed in the hope that it will be useful, but WITHOUT
12+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
13+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
14+ * version 2 for more details (a copy is included in the LICENSE file that
15+ * accompanied this code).
16+ *
17+ * You should have received a copy of the GNU General Public License version
18+ * 2 along with this work; if not, write to the Free Software Foundation,
19+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
20+ *
21+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
22+ * or visit www.oracle.com if you need additional information or have any
23+ * questions.
24+ */
25+
26+package java.security.cert;
27+
28+import java.security.KeyStore;
29+import java.security.KeyStoreException;
30+import java.security.InvalidAlgorithmParameterException;
31+import java.security.InvalidParameterException;
32+import java.util.Set;
33+
34+/**
35+ * Parameters used as input for the PKIX <code>CertPathBuilder</code>
36+ * algorithm.
37+ * <p>
38+ * A PKIX <code>CertPathBuilder</code> uses these parameters to {@link
39+ * CertPathBuilder#build build} a <code>CertPath</code> which has been
40+ * validated according to the PKIX certification path validation algorithm.
41+ *
42+ * <p>To instantiate a <code>PKIXBuilderParameters</code> object, an
43+ * application must specify one or more <i>most-trusted CAs</i> as defined by
44+ * the PKIX certification path validation algorithm. The most-trusted CA
45+ * can be specified using one of two constructors. An application
46+ * can call {@link #PKIXBuilderParameters(Set, CertSelector)
47+ * PKIXBuilderParameters(Set, CertSelector)}, specifying a
48+ * <code>Set</code> of <code>TrustAnchor</code> objects, each of which
49+ * identifies a most-trusted CA. Alternatively, an application can call
50+ * {@link #PKIXBuilderParameters(KeyStore, CertSelector)
51+ * PKIXBuilderParameters(KeyStore, CertSelector)}, specifying a
52+ * <code>KeyStore</code> instance containing trusted certificate entries, each
53+ * of which will be considered as a most-trusted CA.
54+ *
55+ * <p>In addition, an application must specify constraints on the target
56+ * certificate that the <code>CertPathBuilder</code> will attempt
57+ * to build a path to. The constraints are specified as a
58+ * <code>CertSelector</code> object. These constraints should provide the
59+ * <code>CertPathBuilder</code> with enough search criteria to find the target
60+ * certificate. Minimal criteria for an <code>X509Certificate</code> usually
61+ * include the subject name and/or one or more subject alternative names.
62+ * If enough criteria is not specified, the <code>CertPathBuilder</code>
63+ * may throw a <code>CertPathBuilderException</code>.
64+ * <p>
65+ * <b>Concurrent Access</b>
66+ * <p>
67+ * Unless otherwise specified, the methods defined in this class are not
68+ * thread-safe. Multiple threads that need to access a single
69+ * object concurrently should synchronize amongst themselves and
70+ * provide the necessary locking. Multiple threads each manipulating
71+ * separate objects need not synchronize.
72+ *
73+ * @see CertPathBuilder
74+ *
75+ * @since 1.4
76+ * @author Sean Mullan
77+ */
78+public class PKIXBuilderParameters extends PKIXParameters {
79+
80+ private int maxPathLength = 5;
81+
82+ /**
83+ * Creates an instance of <code>PKIXBuilderParameters</code> with
84+ * the specified <code>Set</code> of most-trusted CAs.
85+ * Each element of the set is a {@link TrustAnchor TrustAnchor}.
86+ *
87+ * <p>Note that the <code>Set</code> is copied to protect against
88+ * subsequent modifications.
89+ *
90+ * @param trustAnchors a <code>Set</code> of <code>TrustAnchor</code>s
91+ * @param targetConstraints a <code>CertSelector</code> specifying the
92+ * constraints on the target certificate
93+ * @throws InvalidAlgorithmParameterException if <code>trustAnchors</code>
94+ * is empty <code>(trustAnchors.isEmpty() == true)</code>
95+ * @throws NullPointerException if <code>trustAnchors</code> is
96+ * <code>null</code>
97+ * @throws ClassCastException if any of the elements of
98+ * <code>trustAnchors</code> are not of type
99+ * <code>java.security.cert.TrustAnchor</code>
100+ */
101+ public PKIXBuilderParameters(Set<TrustAnchor> trustAnchors, CertSelector
102+ targetConstraints) throws InvalidAlgorithmParameterException
103+ {
104+ super(trustAnchors);
105+ setTargetCertConstraints(targetConstraints);
106+ }
107+
108+ /**
109+ * Creates an instance of <code>PKIXBuilderParameters</code> that
110+ * populates the set of most-trusted CAs from the trusted
111+ * certificate entries contained in the specified <code>KeyStore</code>.
112+ * Only keystore entries that contain trusted <code>X509Certificate</code>s
113+ * are considered; all other certificate types are ignored.
114+ *
115+ * @param keystore a <code>KeyStore</code> from which the set of
116+ * most-trusted CAs will be populated
117+ * @param targetConstraints a <code>CertSelector</code> specifying the
118+ * constraints on the target certificate
119+ * @throws KeyStoreException if <code>keystore</code> has not been
120+ * initialized
121+ * @throws InvalidAlgorithmParameterException if <code>keystore</code> does
122+ * not contain at least one trusted certificate entry
123+ * @throws NullPointerException if <code>keystore</code> is
124+ * <code>null</code>
125+ */
126+ public PKIXBuilderParameters(KeyStore keystore,
127+ CertSelector targetConstraints)
128+ throws KeyStoreException, InvalidAlgorithmParameterException
129+ {
130+ super(keystore);
131+ setTargetCertConstraints(targetConstraints);
132+ }
133+
134+ /**
135+ * Sets the value of the maximum number of non-self-issued intermediate
136+ * certificates that may exist in a certification path. A certificate
137+ * is self-issued if the DNs that appear in the subject and issuer
138+ * fields are identical and are not empty. Note that the last certificate
139+ * in a certification path is not an intermediate certificate, and is not
140+ * included in this limit. Usually the last certificate is an end entity
141+ * certificate, but it can be a CA certificate. A PKIX
142+ * <code>CertPathBuilder</code> instance must not build
143+ * paths longer than the length specified.
144+ *
145+ * <p> A value of 0 implies that the path can only contain
146+ * a single certificate. A value of -1 implies that the
147+ * path length is unconstrained (i.e. there is no maximum).
148+ * The default maximum path length, if not specified, is 5.
149+ * Setting a value less than -1 will cause an exception to be thrown.
150+ *
151+ * <p> If any of the CA certificates contain the
152+ * <code>BasicConstraintsExtension</code>, the value of the
153+ * <code>pathLenConstraint</code> field of the extension overrides
154+ * the maximum path length parameter whenever the result is a
155+ * certification path of smaller length.
156+ *
157+ * @param maxPathLength the maximum number of non-self-issued intermediate
158+ * certificates that may exist in a certification path
159+ * @throws InvalidParameterException if <code>maxPathLength</code> is set
160+ * to a value less than -1
161+ *
162+ * @see #getMaxPathLength
163+ */
164+ public void setMaxPathLength(int maxPathLength) {
165+ if (maxPathLength < -1) {
166+ throw new InvalidParameterException("the maximum path "
167+ + "length parameter can not be less than -1");
168+ }
169+ this.maxPathLength = maxPathLength;
170+ }
171+
172+ /**
173+ * Returns the value of the maximum number of intermediate non-self-issued
174+ * certificates that may exist in a certification path. See
175+ * the {@link #setMaxPathLength} method for more details.
176+ *
177+ * @return the maximum number of non-self-issued intermediate certificates
178+ * that may exist in a certification path, or -1 if there is no limit
179+ *
180+ * @see #setMaxPathLength
181+ */
182+ public int getMaxPathLength() {
183+ return maxPathLength;
184+ }
185+
186+ /**
187+ * Returns a formatted string describing the parameters.
188+ *
189+ * @return a formatted string describing the parameters
190+ */
191+ public String toString() {
192+ StringBuffer sb = new StringBuffer();
193+ sb.append("[\n");
194+ sb.append(super.toString());
195+ sb.append(" Maximum Path Length: " + maxPathLength + "\n");
196+ sb.append("]\n");
197+ return sb.toString();
198+ }
199+}
java/pkg/java/security/cert/PKIXCertPathBuilderResult.class+0−0

Binary file not shown.

java/pkg/java/security/cert/PKIXCertPathBuilderResult.java+119−0
@@ -0,0 +1,119 @@
1+/*
2+ * Copyright (c) 2000, 2001, Oracle and/or its affiliates. All rights reserved.
3+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
4+ *
5+ * This code is free software; you can redistribute it and/or modify it
6+ * under the terms of the GNU General Public License version 2 only, as
7+ * published by the Free Software Foundation. Oracle designates this
8+ * particular file as subject to the "Classpath" exception as provided
9+ * by Oracle in the LICENSE file that accompanied this code.
10+ *
11+ * This code is distributed in the hope that it will be useful, but WITHOUT
12+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
13+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
14+ * version 2 for more details (a copy is included in the LICENSE file that
15+ * accompanied this code).
16+ *
17+ * You should have received a copy of the GNU General Public License version
18+ * 2 along with this work; if not, write to the Free Software Foundation,
19+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
20+ *
21+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
22+ * or visit www.oracle.com if you need additional information or have any
23+ * questions.
24+ */
25+
26+package java.security.cert;
27+
28+import java.security.PublicKey;
29+
30+/**
31+ * This class represents the successful result of the PKIX certification
32+ * path builder algorithm. All certification paths that are built and
33+ * returned using this algorithm are also validated according to the PKIX
34+ * certification path validation algorithm.
35+ *
36+ * <p>Instances of <code>PKIXCertPathBuilderResult</code> are returned by
37+ * the <code>build</code> method of <code>CertPathBuilder</code>
38+ * objects implementing the PKIX algorithm.
39+ *
40+ * <p>All <code>PKIXCertPathBuilderResult</code> objects contain the
41+ * certification path constructed by the build algorithm, the
42+ * valid policy tree and subject public key resulting from the build
43+ * algorithm, and a <code>TrustAnchor</code> describing the certification
44+ * authority (CA) that served as a trust anchor for the certification path.
45+ * <p>
46+ * <b>Concurrent Access</b>
47+ * <p>
48+ * Unless otherwise specified, the methods defined in this class are not
49+ * thread-safe. Multiple threads that need to access a single
50+ * object concurrently should synchronize amongst themselves and
51+ * provide the necessary locking. Multiple threads each manipulating
52+ * separate objects need not synchronize.
53+ *
54+ * @see CertPathBuilderResult
55+ *
56+ * @since 1.4
57+ * @author Anne Anderson
58+ */
59+public class PKIXCertPathBuilderResult extends PKIXCertPathValidatorResult
60+ implements CertPathBuilderResult {
61+
62+ private CertPath certPath;
63+
64+ /**
65+ * Creates an instance of <code>PKIXCertPathBuilderResult</code>
66+ * containing the specified parameters.
67+ *
68+ * @param certPath the validated <code>CertPath</code>
69+ * @param trustAnchor a <code>TrustAnchor</code> describing the CA that
70+ * served as a trust anchor for the certification path
71+ * @param policyTree the immutable valid policy tree, or <code>null</code>
72+ * if there are no valid policies
73+ * @param subjectPublicKey the public key of the subject
74+ * @throws NullPointerException if the <code>certPath</code>,
75+ * <code>trustAnchor</code> or <code>subjectPublicKey</code> parameters
76+ * are <code>null</code>
77+ */
78+ public PKIXCertPathBuilderResult(CertPath certPath,
79+ TrustAnchor trustAnchor, PolicyNode policyTree,
80+ PublicKey subjectPublicKey)
81+ {
82+ super(trustAnchor, policyTree, subjectPublicKey);
83+ if (certPath == null)
84+ throw new NullPointerException("certPath must be non-null");
85+ this.certPath = certPath;
86+ }
87+
88+ /**
89+ * Returns the built and validated certification path. The
90+ * <code>CertPath</code> object does not include the trust anchor.
91+ * Instead, use the {@link #getTrustAnchor() getTrustAnchor()} method to
92+ * obtain the <code>TrustAnchor</code> that served as the trust anchor
93+ * for the certification path.
94+ *
95+ * @return the built and validated <code>CertPath</code> (never
96+ * <code>null</code>)
97+ */
98+ public CertPath getCertPath() {
99+ return certPath;
100+ }
101+
102+ /**
103+ * Return a printable representation of this
104+ * <code>PKIXCertPathBuilderResult</code>.
105+ *
106+ * @return a <code>String</code> describing the contents of this
107+ * <code>PKIXCertPathBuilderResult</code>
108+ */
109+ public String toString() {
110+ StringBuffer sb = new StringBuffer();
111+ sb.append("PKIXCertPathBuilderResult: [\n");
112+ sb.append(" Certification Path: " + certPath + "\n");
113+ sb.append(" Trust Anchor: " + getTrustAnchor().toString() + "\n");
114+ sb.append(" Policy Tree: " + String.valueOf(getPolicyTree()) + "\n");
115+ sb.append(" Subject Public Key: " + getPublicKey() + "\n");
116+ sb.append("]");
117+ return sb.toString();
118+ }
119+}
java/pkg/java/security/cert/PKIXCertPathChecker.class+0−0

Binary file not shown.

java/pkg/java/security/cert/PKIXCertPathChecker.java+181−0
@@ -0,0 +1,181 @@
1+/*
2+ * Copyright (c) 2000, 2003, Oracle and/or its affiliates. All rights reserved.
3+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
4+ *
5+ * This code is free software; you can redistribute it and/or modify it
6+ * under the terms of the GNU General Public License version 2 only, as
7+ * published by the Free Software Foundation. Oracle designates this
8+ * particular file as subject to the "Classpath" exception as provided
9+ * by Oracle in the LICENSE file that accompanied this code.
10+ *
11+ * This code is distributed in the hope that it will be useful, but WITHOUT
12+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
13+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
14+ * version 2 for more details (a copy is included in the LICENSE file that
15+ * accompanied this code).
16+ *
17+ * You should have received a copy of the GNU General Public License version
18+ * 2 along with this work; if not, write to the Free Software Foundation,
19+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
20+ *
21+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
22+ * or visit www.oracle.com if you need additional information or have any
23+ * questions.
24+ */
25+
26+package java.security.cert;
27+
28+import java.util.Collection;
29+import java.util.Set;
30+
31+/**
32+ * An abstract class that performs one or more checks on an
33+ * <code>X509Certificate</code>.
34+ *
35+ * <p>A concrete implementation of the <code>PKIXCertPathChecker</code> class
36+ * can be created to extend the PKIX certification path validation algorithm.
37+ * For example, an implementation may check for and process a critical private
38+ * extension of each certificate in a certification path.
39+ *
40+ * <p>Instances of <code>PKIXCertPathChecker</code> are passed as parameters
41+ * using the {@link PKIXParameters#setCertPathCheckers setCertPathCheckers}
42+ * or {@link PKIXParameters#addCertPathChecker addCertPathChecker} methods
43+ * of the <code>PKIXParameters</code> and <code>PKIXBuilderParameters</code>
44+ * class. Each of the <code>PKIXCertPathChecker</code>s {@link #check check}
45+ * methods will be called, in turn, for each certificate processed by a PKIX
46+ * <code>CertPathValidator</code> or <code>CertPathBuilder</code>
47+ * implementation.
48+ *
49+ * <p>A <code>PKIXCertPathChecker</code> may be called multiple times on
50+ * successive certificates in a certification path. Concrete subclasses
51+ * are expected to maintain any internal state that may be necessary to
52+ * check successive certificates. The {@link #init init} method is used
53+ * to initialize the internal state of the checker so that the certificates
54+ * of a new certification path may be checked. A stateful implementation
55+ * <b>must</b> override the {@link #clone clone} method if necessary in
56+ * order to allow a PKIX <code>CertPathBuilder</code> to efficiently
57+ * backtrack and try other paths. In these situations, the
58+ * <code>CertPathBuilder</code> is able to restore prior path validation
59+ * states by restoring the cloned <code>PKIXCertPathChecker</code>s.
60+ *
61+ * <p>The order in which the certificates are presented to the
62+ * <code>PKIXCertPathChecker</code> may be either in the forward direction
63+ * (from target to most-trusted CA) or in the reverse direction (from
64+ * most-trusted CA to target). A <code>PKIXCertPathChecker</code> implementation
65+ * <b>must</b> support reverse checking (the ability to perform its checks when
66+ * it is presented with certificates in the reverse direction) and <b>may</b>
67+ * support forward checking (the ability to perform its checks when it is
68+ * presented with certificates in the forward direction). The
69+ * {@link #isForwardCheckingSupported isForwardCheckingSupported} method
70+ * indicates whether forward checking is supported.
71+ * <p>
72+ * Additional input parameters required for executing the check may be
73+ * specified through constructors of concrete implementations of this class.
74+ * <p>
75+ * <b>Concurrent Access</b>
76+ * <p>
77+ * Unless otherwise specified, the methods defined in this class are not
78+ * thread-safe. Multiple threads that need to access a single
79+ * object concurrently should synchronize amongst themselves and
80+ * provide the necessary locking. Multiple threads each manipulating
81+ * separate objects need not synchronize.
82+ *
83+ * @see PKIXParameters
84+ * @see PKIXBuilderParameters
85+ *
86+ * @since 1.4
87+ * @author Yassir Elley
88+ * @author Sean Mullan
89+ */
90+public abstract class PKIXCertPathChecker implements Cloneable {
91+
92+ /**
93+ * Default constructor.
94+ */
95+ protected PKIXCertPathChecker() {}
96+
97+ /**
98+ * Initializes the internal state of this <code>PKIXCertPathChecker</code>.
99+ * <p>
100+ * The <code>forward</code> flag specifies the order that
101+ * certificates will be passed to the {@link #check check} method
102+ * (forward or reverse). A <code>PKIXCertPathChecker</code> <b>must</b>
103+ * support reverse checking and <b>may</b> support forward checking.
104+ *
105+ * @param forward the order that certificates are presented to
106+ * the <code>check</code> method. If <code>true</code>, certificates
107+ * are presented from target to most-trusted CA (forward); if
108+ * <code>false</code>, from most-trusted CA to target (reverse).
109+ * @throws CertPathValidatorException if this
110+ * <code>PKIXCertPathChecker</code> is unable to check certificates in
111+ * the specified order; it should never be thrown if the forward flag
112+ * is false since reverse checking must be supported
113+ */
114+ public abstract void init(boolean forward)
115+ throws CertPathValidatorException;
116+
117+ /**
118+ * Indicates if forward checking is supported. Forward checking refers
119+ * to the ability of the <code>PKIXCertPathChecker</code> to perform
120+ * its checks when certificates are presented to the <code>check</code>
121+ * method in the forward direction (from target to most-trusted CA).
122+ *
123+ * @return <code>true</code> if forward checking is supported,
124+ * <code>false</code> otherwise
125+ */
126+ public abstract boolean isForwardCheckingSupported();
127+
128+ /**
129+ * Returns an immutable <code>Set</code> of X.509 certificate extensions
130+ * that this <code>PKIXCertPathChecker</code> supports (i.e. recognizes, is
131+ * able to process), or <code>null</code> if no extensions are supported.
132+ * <p>
133+ * Each element of the set is a <code>String</code> representing the
134+ * Object Identifier (OID) of the X.509 extension that is supported.
135+ * The OID is represented by a set of nonnegative integers separated by
136+ * periods.
137+ * <p>
138+ * All X.509 certificate extensions that a <code>PKIXCertPathChecker</code>
139+ * might possibly be able to process should be included in the set.
140+ *
141+ * @return an immutable <code>Set</code> of X.509 extension OIDs (in
142+ * <code>String</code> format) supported by this
143+ * <code>PKIXCertPathChecker</code>, or <code>null</code> if no
144+ * extensions are supported
145+ */
146+ public abstract Set<String> getSupportedExtensions();
147+
148+ /**
149+ * Performs the check(s) on the specified certificate using its internal
150+ * state and removes any critical extensions that it processes from the
151+ * specified collection of OID strings that represent the unresolved
152+ * critical extensions. The certificates are presented in the order
153+ * specified by the <code>init</code> method.
154+ *
155+ * @param cert the <code>Certificate</code> to be checked
156+ * @param unresolvedCritExts a <code>Collection</code> of OID strings
157+ * representing the current set of unresolved critical extensions
158+ * @exception CertPathValidatorException if the specified certificate does
159+ * not pass the check
160+ */
161+ public abstract void check(Certificate cert,
162+ Collection<String> unresolvedCritExts)
163+ throws CertPathValidatorException;
164+
165+ /**
166+ * Returns a clone of this object. Calls the <code>Object.clone()</code>
167+ * method.
168+ * All subclasses which maintain state must support and
169+ * override this method, if necessary.
170+ *
171+ * @return a copy of this <code>PKIXCertPathChecker</code>
172+ */
173+ public Object clone() {
174+ try {
175+ return super.clone();
176+ } catch (CloneNotSupportedException e) {
177+ /* Cannot happen */
178+ throw new InternalError(e.toString());
179+ }
180+ }
181+}
java/pkg/java/security/cert/PKIXCertPathValidatorResult.class+0−0

Binary file not shown.

java/pkg/java/security/cert/PKIXCertPathValidatorResult.java+159−0
@@ -0,0 +1,159 @@
1+/*
2+ * Copyright (c) 2000, 2001, Oracle and/or its affiliates. All rights reserved.
3+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
4+ *
5+ * This code is free software; you can redistribute it and/or modify it
6+ * under the terms of the GNU General Public License version 2 only, as
7+ * published by the Free Software Foundation. Oracle designates this
8+ * particular file as subject to the "Classpath" exception as provided
9+ * by Oracle in the LICENSE file that accompanied this code.
10+ *
11+ * This code is distributed in the hope that it will be useful, but WITHOUT
12+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
13+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
14+ * version 2 for more details (a copy is included in the LICENSE file that
15+ * accompanied this code).
16+ *
17+ * You should have received a copy of the GNU General Public License version
18+ * 2 along with this work; if not, write to the Free Software Foundation,
19+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
20+ *
21+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
22+ * or visit www.oracle.com if you need additional information or have any
23+ * questions.
24+ */
25+
26+package java.security.cert;
27+
28+import java.security.PublicKey;
29+
30+/**
31+ * This class represents the successful result of the PKIX certification
32+ * path validation algorithm.
33+ *
34+ * <p>Instances of <code>PKIXCertPathValidatorResult</code> are returned by the
35+ * {@link CertPathValidator#validate validate} method of
36+ * <code>CertPathValidator</code> objects implementing the PKIX algorithm.
37+ *
38+ * <p> All <code>PKIXCertPathValidatorResult</code> objects contain the
39+ * valid policy tree and subject public key resulting from the
40+ * validation algorithm, as well as a <code>TrustAnchor</code> describing
41+ * the certification authority (CA) that served as a trust anchor for the
42+ * certification path.
43+ * <p>
44+ * <b>Concurrent Access</b>
45+ * <p>
46+ * Unless otherwise specified, the methods defined in this class are not
47+ * thread-safe. Multiple threads that need to access a single
48+ * object concurrently should synchronize amongst themselves and
49+ * provide the necessary locking. Multiple threads each manipulating
50+ * separate objects need not synchronize.
51+ *
52+ * @see CertPathValidatorResult
53+ *
54+ * @since 1.4
55+ * @author Yassir Elley
56+ * @author Sean Mullan
57+ */
58+public class PKIXCertPathValidatorResult implements CertPathValidatorResult {
59+
60+ private TrustAnchor trustAnchor;
61+ private PolicyNode policyTree;
62+ private PublicKey subjectPublicKey;
63+
64+ /**
65+ * Creates an instance of <code>PKIXCertPathValidatorResult</code>
66+ * containing the specified parameters.
67+ *
68+ * @param trustAnchor a <code>TrustAnchor</code> describing the CA that
69+ * served as a trust anchor for the certification path
70+ * @param policyTree the immutable valid policy tree, or <code>null</code>
71+ * if there are no valid policies
72+ * @param subjectPublicKey the public key of the subject
73+ * @throws NullPointerException if the <code>subjectPublicKey</code> or
74+ * <code>trustAnchor</code> parameters are <code>null</code>
75+ */
76+ public PKIXCertPathValidatorResult(TrustAnchor trustAnchor,
77+ PolicyNode policyTree, PublicKey subjectPublicKey)
78+ {
79+ if (subjectPublicKey == null)
80+ throw new NullPointerException("subjectPublicKey must be non-null");
81+ if (trustAnchor == null)
82+ throw new NullPointerException("trustAnchor must be non-null");
83+ this.trustAnchor = trustAnchor;
84+ this.policyTree = policyTree;
85+ this.subjectPublicKey = subjectPublicKey;
86+ }
87+
88+ /**
89+ * Returns the <code>TrustAnchor</code> describing the CA that served
90+ * as a trust anchor for the certification path.
91+ *
92+ * @return the <code>TrustAnchor</code> (never <code>null</code>)
93+ */
94+ public TrustAnchor getTrustAnchor() {
95+ return trustAnchor;
96+ }
97+
98+ /**
99+ * Returns the root node of the valid policy tree resulting from the
100+ * PKIX certification path validation algorithm. The
101+ * <code>PolicyNode</code> object that is returned and any objects that
102+ * it returns through public methods are immutable.
103+ *
104+ * <p>Most applications will not need to examine the valid policy tree.
105+ * They can achieve their policy processing goals by setting the
106+ * policy-related parameters in <code>PKIXParameters</code>. However, more
107+ * sophisticated applications, especially those that process policy
108+ * qualifiers, may need to traverse the valid policy tree using the
109+ * {@link PolicyNode#getParent PolicyNode.getParent} and
110+ * {@link PolicyNode#getChildren PolicyNode.getChildren} methods.
111+ *
112+ * @return the root node of the valid policy tree, or <code>null</code>
113+ * if there are no valid policies
114+ */
115+ public PolicyNode getPolicyTree() {
116+ return policyTree;
117+ }
118+
119+ /**
120+ * Returns the public key of the subject (target) of the certification
121+ * path, including any inherited public key parameters if applicable.
122+ *
123+ * @return the public key of the subject (never <code>null</code>)
124+ */
125+ public PublicKey getPublicKey() {
126+ return subjectPublicKey;
127+ }
128+
129+ /**
130+ * Returns a copy of this object.
131+ *
132+ * @return the copy
133+ */
134+ public Object clone() {
135+ try {
136+ return super.clone();
137+ } catch (CloneNotSupportedException e) {
138+ /* Cannot happen */
139+ throw new InternalError(e.toString());
140+ }
141+ }
142+
143+ /**
144+ * Return a printable representation of this
145+ * <code>PKIXCertPathValidatorResult</code>.
146+ *
147+ * @return a <code>String</code> describing the contents of this
148+ * <code>PKIXCertPathValidatorResult</code>
149+ */
150+ public String toString() {
151+ StringBuffer sb = new StringBuffer();
152+ sb.append("PKIXCertPathValidatorResult: [\n");
153+ sb.append(" Trust Anchor: " + trustAnchor.toString() + "\n");
154+ sb.append(" Policy Tree: " + String.valueOf(policyTree) + "\n");
155+ sb.append(" Subject Public Key: " + subjectPublicKey + "\n");
156+ sb.append("]");
157+ return sb.toString();
158+ }
159+}
java/pkg/java/security/cert/PKIXParameters.class+0−0

Binary file not shown.

java/pkg/java/security/cert/PKIXParameters.java+736−0
@@ -0,0 +1,736 @@
1+/*
2+ * Copyright (c) 2000, 2010, Oracle and/or its affiliates. All rights reserved.
3+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
4+ *
5+ * This code is free software; you can redistribute it and/or modify it
6+ * under the terms of the GNU General Public License version 2 only, as
7+ * published by the Free Software Foundation. Oracle designates this
8+ * particular file as subject to the "Classpath" exception as provided
9+ * by Oracle in the LICENSE file that accompanied this code.
10+ *
11+ * This code is distributed in the hope that it will be useful, but WITHOUT
12+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
13+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
14+ * version 2 for more details (a copy is included in the LICENSE file that
15+ * accompanied this code).
16+ *
17+ * You should have received a copy of the GNU General Public License version
18+ * 2 along with this work; if not, write to the Free Software Foundation,
19+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
20+ *
21+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
22+ * or visit www.oracle.com if you need additional information or have any
23+ * questions.
24+ */
25+
26+package java.security.cert;
27+
28+import java.security.InvalidAlgorithmParameterException;
29+import java.security.KeyStore;
30+import java.security.KeyStoreException;
31+import java.util.ArrayList;
32+import java.util.Collections;
33+import java.util.Date;
34+import java.util.Enumeration;
35+import java.util.HashSet;
36+import java.util.Iterator;
37+import java.util.List;
38+import java.util.Set;
39+
40+/**
41+ * Parameters used as input for the PKIX <code>CertPathValidator</code>
42+ * algorithm.
43+ * <p>
44+ * A PKIX <code>CertPathValidator</code> uses these parameters to
45+ * validate a <code>CertPath</code> according to the PKIX certification path
46+ * validation algorithm.
47+ *
48+ * <p>To instantiate a <code>PKIXParameters</code> object, an
49+ * application must specify one or more <i>most-trusted CAs</i> as defined by
50+ * the PKIX certification path validation algorithm. The most-trusted CAs
51+ * can be specified using one of two constructors. An application
52+ * can call {@link #PKIXParameters(Set) PKIXParameters(Set)},
53+ * specifying a <code>Set</code> of <code>TrustAnchor</code> objects, each
54+ * of which identify a most-trusted CA. Alternatively, an application can call
55+ * {@link #PKIXParameters(KeyStore) PKIXParameters(KeyStore)}, specifying a
56+ * <code>KeyStore</code> instance containing trusted certificate entries, each
57+ * of which will be considered as a most-trusted CA.
58+ * <p>
59+ * Once a <code>PKIXParameters</code> object has been created, other parameters
60+ * can be specified (by calling {@link #setInitialPolicies setInitialPolicies}
61+ * or {@link #setDate setDate}, for instance) and then the
62+ * <code>PKIXParameters</code> is passed along with the <code>CertPath</code>
63+ * to be validated to {@link CertPathValidator#validate
64+ * CertPathValidator.validate}.
65+ * <p>
66+ * Any parameter that is not set (or is set to <code>null</code>) will
67+ * be set to the default value for that parameter. The default value for the
68+ * <code>date</code> parameter is <code>null</code>, which indicates
69+ * the current time when the path is validated. The default for the
70+ * remaining parameters is the least constrained.
71+ * <p>
72+ * <b>Concurrent Access</b>
73+ * <p>
74+ * Unless otherwise specified, the methods defined in this class are not
75+ * thread-safe. Multiple threads that need to access a single
76+ * object concurrently should synchronize amongst themselves and
77+ * provide the necessary locking. Multiple threads each manipulating
78+ * separate objects need not synchronize.
79+ *
80+ * @see CertPathValidator
81+ *
82+ * @since 1.4
83+ * @author Sean Mullan
84+ * @author Yassir Elley
85+ */
86+public class PKIXParameters implements CertPathParameters {
87+
88+ private Set<TrustAnchor> unmodTrustAnchors;
89+ private Date date;
90+ private List<PKIXCertPathChecker> certPathCheckers;
91+ private String sigProvider;
92+ private boolean revocationEnabled = true;
93+ private Set<String> unmodInitialPolicies;
94+ private boolean explicitPolicyRequired = false;
95+ private boolean policyMappingInhibited = false;
96+ private boolean anyPolicyInhibited = false;
97+ private boolean policyQualifiersRejected = true;
98+ private List<CertStore> certStores;
99+ private CertSelector certSelector;
100+
101+ /**
102+ * Creates an instance of <code>PKIXParameters</code> with the specified
103+ * <code>Set</code> of most-trusted CAs. Each element of the
104+ * set is a {@link TrustAnchor TrustAnchor}.
105+ * <p>
106+ * Note that the <code>Set</code> is copied to protect against
107+ * subsequent modifications.
108+ *
109+ * @param trustAnchors a <code>Set</code> of <code>TrustAnchor</code>s
110+ * @throws InvalidAlgorithmParameterException if the specified
111+ * <code>Set</code> is empty <code>(trustAnchors.isEmpty() == true)</code>
112+ * @throws NullPointerException if the specified <code>Set</code> is
113+ * <code>null</code>
114+ * @throws ClassCastException if any of the elements in the <code>Set</code>
115+ * are not of type <code>java.security.cert.TrustAnchor</code>
116+ */
117+ public PKIXParameters(Set<TrustAnchor> trustAnchors)
118+ throws InvalidAlgorithmParameterException
119+ {
120+ setTrustAnchors(trustAnchors);
121+
122+ this.unmodInitialPolicies = Collections.<String>emptySet();
123+ this.certPathCheckers = new ArrayList<PKIXCertPathChecker>();
124+ this.certStores = new ArrayList<CertStore>();
125+ }
126+
127+ /**
128+ * Creates an instance of <code>PKIXParameters</code> that
129+ * populates the set of most-trusted CAs from the trusted
130+ * certificate entries contained in the specified <code>KeyStore</code>.
131+ * Only keystore entries that contain trusted <code>X509Certificates</code>
132+ * are considered; all other certificate types are ignored.
133+ *
134+ * @param keystore a <code>KeyStore</code> from which the set of
135+ * most-trusted CAs will be populated
136+ * @throws KeyStoreException if the keystore has not been initialized
137+ * @throws InvalidAlgorithmParameterException if the keystore does
138+ * not contain at least one trusted certificate entry
139+ * @throws NullPointerException if the keystore is <code>null</code>
140+ */
141+ public PKIXParameters(KeyStore keystore)
142+ throws KeyStoreException, InvalidAlgorithmParameterException
143+ {
144+ if (keystore == null)
145+ throw new NullPointerException("the keystore parameter must be " +
146+ "non-null");
147+ Set<TrustAnchor> hashSet = new HashSet<TrustAnchor>();
148+ Enumeration<String> aliases = keystore.aliases();
149+ while (aliases.hasMoreElements()) {
150+ String alias = aliases.nextElement();
151+ if (keystore.isCertificateEntry(alias)) {
152+ Certificate cert = keystore.getCertificate(alias);
153+ if (cert instanceof X509Certificate)
154+ hashSet.add(new TrustAnchor((X509Certificate)cert, null));
155+ }
156+ }
157+ setTrustAnchors(hashSet);
158+ this.unmodInitialPolicies = Collections.<String>emptySet();
159+ this.certPathCheckers = new ArrayList<PKIXCertPathChecker>();
160+ this.certStores = new ArrayList<CertStore>();
161+ }
162+
163+ /**
164+ * Returns an immutable <code>Set</code> of the most-trusted
165+ * CAs.
166+ *
167+ * @return an immutable <code>Set</code> of <code>TrustAnchor</code>s
168+ * (never <code>null</code>)
169+ *
170+ * @see #setTrustAnchors
171+ */
172+ public Set<TrustAnchor> getTrustAnchors() {
173+ return this.unmodTrustAnchors;
174+ }
175+
176+ /**
177+ * Sets the <code>Set</code> of most-trusted CAs.
178+ * <p>
179+ * Note that the <code>Set</code> is copied to protect against
180+ * subsequent modifications.
181+ *
182+ * @param trustAnchors a <code>Set</code> of <code>TrustAnchor</code>s
183+ * @throws InvalidAlgorithmParameterException if the specified
184+ * <code>Set</code> is empty <code>(trustAnchors.isEmpty() == true)</code>
185+ * @throws NullPointerException if the specified <code>Set</code> is
186+ * <code>null</code>
187+ * @throws ClassCastException if any of the elements in the set
188+ * are not of type <code>java.security.cert.TrustAnchor</code>
189+ *
190+ * @see #getTrustAnchors
191+ */
192+ public void setTrustAnchors(Set<TrustAnchor> trustAnchors)
193+ throws InvalidAlgorithmParameterException
194+ {
195+ if (trustAnchors == null) {
196+ throw new NullPointerException("the trustAnchors parameters must" +
197+ " be non-null");
198+ }
199+ if (trustAnchors.isEmpty()) {
200+ throw new InvalidAlgorithmParameterException("the trustAnchors " +
201+ "parameter must be non-empty");
202+ }
203+ for (Iterator<TrustAnchor> i = trustAnchors.iterator(); i.hasNext(); ) {
204+ if (!(i.next() instanceof TrustAnchor)) {
205+ throw new ClassCastException("all elements of set must be "
206+ + "of type java.security.cert.TrustAnchor");
207+ }
208+ }
209+ this.unmodTrustAnchors = Collections.unmodifiableSet
210+ (new HashSet<TrustAnchor>(trustAnchors));
211+ }
212+
213+ /**
214+ * Returns an immutable <code>Set</code> of initial
215+ * policy identifiers (OID strings), indicating that any one of these
216+ * policies would be acceptable to the certificate user for the purposes of
217+ * certification path processing. The default return value is an empty
218+ * <code>Set</code>, which is interpreted as meaning that any policy would
219+ * be acceptable.
220+ *
221+ * @return an immutable <code>Set</code> of initial policy OIDs in
222+ * <code>String</code> format, or an empty <code>Set</code> (implying any
223+ * policy is acceptable). Never returns <code>null</code>.
224+ *
225+ * @see #setInitialPolicies
226+ */
227+ public Set<String> getInitialPolicies() {
228+ return this.unmodInitialPolicies;
229+ }
230+
231+ /**
232+ * Sets the <code>Set</code> of initial policy identifiers
233+ * (OID strings), indicating that any one of these
234+ * policies would be acceptable to the certificate user for the purposes of
235+ * certification path processing. By default, any policy is acceptable
236+ * (i.e. all policies), so a user that wants to allow any policy as
237+ * acceptable does not need to call this method, or can call it
238+ * with an empty <code>Set</code> (or <code>null</code>).
239+ * <p>
240+ * Note that the <code>Set</code> is copied to protect against
241+ * subsequent modifications.
242+ *
243+ * @param initialPolicies a <code>Set</code> of initial policy
244+ * OIDs in <code>String</code> format (or <code>null</code>)
245+ * @throws ClassCastException if any of the elements in the set are
246+ * not of type <code>String</code>
247+ *
248+ * @see #getInitialPolicies
249+ */
250+ public void setInitialPolicies(Set<String> initialPolicies) {
251+ if (initialPolicies != null) {
252+ for (Iterator<String> i = initialPolicies.iterator();
253+ i.hasNext();) {
254+ if (!(i.next() instanceof String))
255+ throw new ClassCastException("all elements of set must be "
256+ + "of type java.lang.String");
257+ }
258+ this.unmodInitialPolicies =
259+ Collections.unmodifiableSet(new HashSet<String>(initialPolicies));
260+ } else
261+ this.unmodInitialPolicies = Collections.<String>emptySet();
262+ }
263+
264+ /**
265+ * Sets the list of <code>CertStore</code>s to be used in finding
266+ * certificates and CRLs. May be <code>null</code>, in which case
267+ * no <code>CertStore</code>s will be used. The first
268+ * <code>CertStore</code>s in the list may be preferred to those that
269+ * appear later.
270+ * <p>
271+ * Note that the <code>List</code> is copied to protect against
272+ * subsequent modifications.
273+ *
274+ * @param stores a <code>List</code> of <code>CertStore</code>s (or
275+ * <code>null</code>)
276+ * @throws ClassCastException if any of the elements in the list are
277+ * not of type <code>java.security.cert.CertStore</code>
278+ *
279+ * @see #getCertStores
280+ */
281+ public void setCertStores(List<CertStore> stores) {
282+ if (stores == null) {
283+ this.certStores = new ArrayList<CertStore>();
284+ } else {
285+ for (Iterator<CertStore> i = stores.iterator(); i.hasNext();) {
286+ if (!(i.next() instanceof CertStore)) {
287+ throw new ClassCastException("all elements of list must be "
288+ + "of type java.security.cert.CertStore");
289+ }
290+ }
291+ this.certStores = new ArrayList<CertStore>(stores);
292+ }
293+ }
294+
295+ /**
296+ * Adds a <code>CertStore</code> to the end of the list of
297+ * <code>CertStore</code>s used in finding certificates and CRLs.
298+ *
299+ * @param store the <code>CertStore</code> to add. If <code>null</code>,
300+ * the store is ignored (not added to list).
301+ */
302+ public void addCertStore(CertStore store) {
303+ if (store != null) {
304+ this.certStores.add(store);
305+ }
306+ }
307+
308+ /**
309+ * Returns an immutable <code>List</code> of <code>CertStore</code>s that
310+ * are used to find certificates and CRLs.
311+ *
312+ * @return an immutable <code>List</code> of <code>CertStore</code>s
313+ * (may be empty, but never <code>null</code>)
314+ *
315+ * @see #setCertStores
316+ */
317+ public List<CertStore> getCertStores() {
318+ return Collections.unmodifiableList
319+ (new ArrayList<CertStore>(this.certStores));
320+ }
321+
322+ /**
323+ * Sets the RevocationEnabled flag. If this flag is true, the default
324+ * revocation checking mechanism of the underlying PKIX service provider
325+ * will be used. If this flag is false, the default revocation checking
326+ * mechanism will be disabled (not used).
327+ * <p>
328+ * When a <code>PKIXParameters</code> object is created, this flag is set
329+ * to true. This setting reflects the most common strategy for checking
330+ * revocation, since each service provider must support revocation
331+ * checking to be PKIX compliant. Sophisticated applications should set
332+ * this flag to false when it is not practical to use a PKIX service
333+ * provider's default revocation checking mechanism or when an alternative
334+ * revocation checking mechanism is to be substituted (by also calling the
335+ * {@link #addCertPathChecker addCertPathChecker} or {@link
336+ * #setCertPathCheckers setCertPathCheckers} methods).
337+ *
338+ * @param val the new value of the RevocationEnabled flag
339+ */
340+ public void setRevocationEnabled(boolean val) {
341+ revocationEnabled = val;
342+ }
343+
344+ /**
345+ * Checks the RevocationEnabled flag. If this flag is true, the default
346+ * revocation checking mechanism of the underlying PKIX service provider
347+ * will be used. If this flag is false, the default revocation checking
348+ * mechanism will be disabled (not used). See the {@link
349+ * #setRevocationEnabled setRevocationEnabled} method for more details on
350+ * setting the value of this flag.
351+ *
352+ * @return the current value of the RevocationEnabled flag
353+ */
354+ public boolean isRevocationEnabled() {
355+ return revocationEnabled;
356+ }
357+
358+ /**
359+ * Sets the ExplicitPolicyRequired flag. If this flag is true, an
360+ * acceptable policy needs to be explicitly identified in every certificate.
361+ * By default, the ExplicitPolicyRequired flag is false.
362+ *
363+ * @param val <code>true</code> if explicit policy is to be required,
364+ * <code>false</code> otherwise
365+ */
366+ public void setExplicitPolicyRequired(boolean val) {
367+ explicitPolicyRequired = val;
368+ }
369+
370+ /**
371+ * Checks if explicit policy is required. If this flag is true, an
372+ * acceptable policy needs to be explicitly identified in every certificate.
373+ * By default, the ExplicitPolicyRequired flag is false.
374+ *
375+ * @return <code>true</code> if explicit policy is required,
376+ * <code>false</code> otherwise
377+ */
378+ public boolean isExplicitPolicyRequired() {
379+ return explicitPolicyRequired;
380+ }
381+
382+ /**
383+ * Sets the PolicyMappingInhibited flag. If this flag is true, policy
384+ * mapping is inhibited. By default, policy mapping is not inhibited (the
385+ * flag is false).
386+ *
387+ * @param val <code>true</code> if policy mapping is to be inhibited,
388+ * <code>false</code> otherwise
389+ */
390+ public void setPolicyMappingInhibited(boolean val) {
391+ policyMappingInhibited = val;
392+ }
393+
394+ /**
395+ * Checks if policy mapping is inhibited. If this flag is true, policy
396+ * mapping is inhibited. By default, policy mapping is not inhibited (the
397+ * flag is false).
398+ *
399+ * @return true if policy mapping is inhibited, false otherwise
400+ */
401+ public boolean isPolicyMappingInhibited() {
402+ return policyMappingInhibited;
403+ }
404+
405+ /**
406+ * Sets state to determine if the any policy OID should be processed
407+ * if it is included in a certificate. By default, the any policy OID
408+ * is not inhibited ({@link #isAnyPolicyInhibited isAnyPolicyInhibited()}
409+ * returns <code>false</code>).
410+ *
411+ * @param val <code>true</code> if the any policy OID is to be
412+ * inhibited, <code>false</code> otherwise
413+ */
414+ public void setAnyPolicyInhibited(boolean val) {
415+ anyPolicyInhibited = val;
416+ }
417+
418+ /**
419+ * Checks whether the any policy OID should be processed if it
420+ * is included in a certificate.
421+ *
422+ * @return <code>true</code> if the any policy OID is inhibited,
423+ * <code>false</code> otherwise
424+ */
425+ public boolean isAnyPolicyInhibited() {
426+ return anyPolicyInhibited;
427+ }
428+
429+ /**
430+ * Sets the PolicyQualifiersRejected flag. If this flag is true,
431+ * certificates that include policy qualifiers in a certificate
432+ * policies extension that is marked critical are rejected.
433+ * If the flag is false, certificates are not rejected on this basis.
434+ *
435+ * <p> When a <code>PKIXParameters</code> object is created, this flag is
436+ * set to true. This setting reflects the most common (and simplest)
437+ * strategy for processing policy qualifiers. Applications that want to use
438+ * a more sophisticated policy must set this flag to false.
439+ * <p>
440+ * Note that the PKIX certification path validation algorithm specifies
441+ * that any policy qualifier in a certificate policies extension that is
442+ * marked critical must be processed and validated. Otherwise the
443+ * certification path must be rejected. If the policyQualifiersRejected flag
444+ * is set to false, it is up to the application to validate all policy
445+ * qualifiers in this manner in order to be PKIX compliant.
446+ *
447+ * @param qualifiersRejected the new value of the PolicyQualifiersRejected
448+ * flag
449+ * @see #getPolicyQualifiersRejected
450+ * @see PolicyQualifierInfo
451+ */
452+ public void setPolicyQualifiersRejected(boolean qualifiersRejected) {
453+ policyQualifiersRejected = qualifiersRejected;
454+ }
455+
456+ /**
457+ * Gets the PolicyQualifiersRejected flag. If this flag is true,
458+ * certificates that include policy qualifiers in a certificate policies
459+ * extension that is marked critical are rejected.
460+ * If the flag is false, certificates are not rejected on this basis.
461+ *
462+ * <p> When a <code>PKIXParameters</code> object is created, this flag is
463+ * set to true. This setting reflects the most common (and simplest)
464+ * strategy for processing policy qualifiers. Applications that want to use
465+ * a more sophisticated policy must set this flag to false.
466+ *
467+ * @return the current value of the PolicyQualifiersRejected flag
468+ * @see #setPolicyQualifiersRejected
469+ */
470+ public boolean getPolicyQualifiersRejected() {
471+ return policyQualifiersRejected;
472+ }
473+
474+ /**
475+ * Returns the time for which the validity of the certification path
476+ * should be determined. If <code>null</code>, the current time is used.
477+ * <p>
478+ * Note that the <code>Date</code> returned is copied to protect against
479+ * subsequent modifications.
480+ *
481+ * @return the <code>Date</code>, or <code>null</code> if not set
482+ * @see #setDate
483+ */
484+ public Date getDate() {
485+ if (date == null)
486+ return null;
487+ else
488+ return (Date) this.date.clone();
489+ }
490+
491+ /**
492+ * Sets the time for which the validity of the certification path
493+ * should be determined. If <code>null</code>, the current time is used.
494+ * <p>
495+ * Note that the <code>Date</code> supplied here is copied to protect
496+ * against subsequent modifications.
497+ *
498+ * @param date the <code>Date</code>, or <code>null</code> for the
499+ * current time
500+ * @see #getDate
501+ */
502+ public void setDate(Date date) {
503+ if (date != null)
504+ this.date = (Date) date.clone();
505+ else
506+ date = null;
507+ }
508+
509+ /**
510+ * Sets a <code>List</code> of additional certification path checkers. If
511+ * the specified <code>List</code> contains an object that is not a
512+ * <code>PKIXCertPathChecker</code>, it is ignored.
513+ * <p>
514+ * Each <code>PKIXCertPathChecker</code> specified implements
515+ * additional checks on a certificate. Typically, these are checks to
516+ * process and verify private extensions contained in certificates.
517+ * Each <code>PKIXCertPathChecker</code> should be instantiated with any
518+ * initialization parameters needed to execute the check.
519+ * <p>
520+ * This method allows sophisticated applications to extend a PKIX
521+ * <code>CertPathValidator</code> or <code>CertPathBuilder</code>.
522+ * Each of the specified <code>PKIXCertPathChecker</code>s will be called,
523+ * in turn, by a PKIX <code>CertPathValidator</code> or
524+ * <code>CertPathBuilder</code> for each certificate processed or
525+ * validated.
526+ * <p>
527+ * Regardless of whether these additional <code>PKIXCertPathChecker</code>s
528+ * are set, a PKIX <code>CertPathValidator</code> or
529+ * <code>CertPathBuilder</code> must perform all of the required PKIX
530+ * checks on each certificate. The one exception to this rule is if the
531+ * RevocationEnabled flag is set to false (see the {@link
532+ * #setRevocationEnabled setRevocationEnabled} method).
533+ * <p>
534+ * Note that the <code>List</code> supplied here is copied and each
535+ * <code>PKIXCertPathChecker</code> in the list is cloned to protect
536+ * against subsequent modifications.
537+ *
538+ * @param checkers a <code>List</code> of <code>PKIXCertPathChecker</code>s.
539+ * May be <code>null</code>, in which case no additional checkers will be
540+ * used.
541+ * @throws ClassCastException if any of the elements in the list
542+ * are not of type <code>java.security.cert.PKIXCertPathChecker</code>
543+ * @see #getCertPathCheckers
544+ */
545+ public void setCertPathCheckers(List<PKIXCertPathChecker> checkers) {
546+ if (checkers != null) {
547+ List<PKIXCertPathChecker> tmpList =
548+ new ArrayList<PKIXCertPathChecker>();
549+ for (PKIXCertPathChecker checker : checkers) {
550+ tmpList.add((PKIXCertPathChecker)checker.clone());
551+ }
552+ this.certPathCheckers = tmpList;
553+ } else {
554+ this.certPathCheckers = new ArrayList<PKIXCertPathChecker>();
555+ }
556+ }
557+
558+ /**
559+ * Returns the <code>List</code> of certification path checkers.
560+ * The returned <code>List</code> is immutable, and each
561+ * <code>PKIXCertPathChecker</code> in the <code>List</code> is cloned
562+ * to protect against subsequent modifications.
563+ *
564+ * @return an immutable <code>List</code> of
565+ * <code>PKIXCertPathChecker</code>s (may be empty, but not
566+ * <code>null</code>)
567+ * @see #setCertPathCheckers
568+ */
569+ public List<PKIXCertPathChecker> getCertPathCheckers() {
570+ List<PKIXCertPathChecker> tmpList = new ArrayList<PKIXCertPathChecker>();
571+ for (PKIXCertPathChecker ck : certPathCheckers) {
572+ tmpList.add((PKIXCertPathChecker)ck.clone());
573+ }
574+ return Collections.unmodifiableList(tmpList);
575+ }
576+
577+ /**
578+ * Adds a <code>PKIXCertPathChecker</code> to the list of certification
579+ * path checkers. See the {@link #setCertPathCheckers setCertPathCheckers}
580+ * method for more details.
581+ * <p>
582+ * Note that the <code>PKIXCertPathChecker</code> is cloned to protect
583+ * against subsequent modifications.
584+ *
585+ * @param checker a <code>PKIXCertPathChecker</code> to add to the list of
586+ * checks. If <code>null</code>, the checker is ignored (not added to list).
587+ */
588+ public void addCertPathChecker(PKIXCertPathChecker checker) {
589+ if (checker != null) {
590+ certPathCheckers.add((PKIXCertPathChecker)checker.clone());
591+ }
592+ }
593+
594+ /**
595+ * Returns the signature provider's name, or <code>null</code>
596+ * if not set.
597+ *
598+ * @return the signature provider's name (or <code>null</code>)
599+ * @see #setSigProvider
600+ */
601+ public String getSigProvider() {
602+ return this.sigProvider;
603+ }
604+
605+ /**
606+ * Sets the signature provider's name. The specified provider will be
607+ * preferred when creating {@link java.security.Signature Signature}
608+ * objects. If <code>null</code> or not set, the first provider found
609+ * supporting the algorithm will be used.
610+ *
611+ * @param sigProvider the signature provider's name (or <code>null</code>)
612+ * @see #getSigProvider
613+ */
614+ public void setSigProvider(String sigProvider) {
615+ this.sigProvider = sigProvider;
616+ }
617+
618+ /**
619+ * Returns the required constraints on the target certificate.
620+ * The constraints are returned as an instance of <code>CertSelector</code>.
621+ * If <code>null</code>, no constraints are defined.
622+ *
623+ * <p>Note that the <code>CertSelector</code> returned is cloned
624+ * to protect against subsequent modifications.
625+ *
626+ * @return a <code>CertSelector</code> specifying the constraints
627+ * on the target certificate (or <code>null</code>)
628+ * @see #setTargetCertConstraints
629+ */
630+ public CertSelector getTargetCertConstraints() {
631+ if (certSelector != null) {
632+ return (CertSelector) certSelector.clone();
633+ } else {
634+ return null;
635+ }
636+ }
637+
638+ /**
639+ * Sets the required constraints on the target certificate.
640+ * The constraints are specified as an instance of
641+ * <code>CertSelector</code>. If <code>null</code>, no constraints are
642+ * defined.
643+ *
644+ * <p>Note that the <code>CertSelector</code> specified is cloned
645+ * to protect against subsequent modifications.
646+ *
647+ * @param selector a <code>CertSelector</code> specifying the constraints
648+ * on the target certificate (or <code>null</code>)
649+ * @see #getTargetCertConstraints
650+ */
651+ public void setTargetCertConstraints(CertSelector selector) {
652+ if (selector != null)
653+ certSelector = (CertSelector) selector.clone();
654+ else
655+ certSelector = null;
656+ }
657+
658+ /**
659+ * Makes a copy of this <code>PKIXParameters</code> object. Changes
660+ * to the copy will not affect the original and vice versa.
661+ *
662+ * @return a copy of this <code>PKIXParameters</code> object
663+ */
664+ public Object clone() {
665+ try {
666+ PKIXParameters copy = (PKIXParameters)super.clone();
667+
668+ // must clone these because addCertStore, et al. modify them
669+ if (certStores != null) {
670+ copy.certStores = new ArrayList<CertStore>(certStores);
671+ }
672+ if (certPathCheckers != null) {
673+ copy.certPathCheckers =
674+ new ArrayList<PKIXCertPathChecker>(certPathCheckers.size());
675+ for (PKIXCertPathChecker checker : certPathCheckers) {
676+ copy.certPathCheckers.add(
677+ (PKIXCertPathChecker)checker.clone());
678+ }
679+ }
680+
681+ // other class fields are immutable to public, don't bother
682+ // to clone the read-only fields.
683+ return copy;
684+ } catch (CloneNotSupportedException e) {
685+ /* Cannot happen */
686+ throw new InternalError(e.toString());
687+ }
688+ }
689+
690+ /**
691+ * Returns a formatted string describing the parameters.
692+ *
693+ * @return a formatted string describing the parameters.
694+ */
695+ public String toString() {
696+ StringBuffer sb = new StringBuffer();
697+ sb.append("[\n");
698+
699+ /* start with trusted anchor info */
700+ if (unmodTrustAnchors != null) {
701+ sb.append(" Trust Anchors: " + unmodTrustAnchors.toString()
702+ + "\n");
703+ }
704+
705+ /* now, append initial state information */
706+ if (unmodInitialPolicies != null) {
707+ if (unmodInitialPolicies.isEmpty()) {
708+ sb.append(" Initial Policy OIDs: any\n");
709+ } else {
710+ sb.append(" Initial Policy OIDs: ["
711+ + unmodInitialPolicies.toString() + "]\n");
712+ }
713+ }
714+
715+ /* now, append constraints on all certificates in the path */
716+ sb.append(" Validity Date: " + String.valueOf(date) + "\n");
717+ sb.append(" Signature Provider: " + String.valueOf(sigProvider) + "\n");
718+ sb.append(" Default Revocation Enabled: " + revocationEnabled + "\n");
719+ sb.append(" Explicit Policy Required: " + explicitPolicyRequired + "\n");
720+ sb.append(" Policy Mapping Inhibited: " + policyMappingInhibited + "\n");
721+ sb.append(" Any Policy Inhibited: " + anyPolicyInhibited + "\n");
722+ sb.append(" Policy Qualifiers Rejected: " + policyQualifiersRejected + "\n");
723+
724+ /* now, append target cert requirements */
725+ sb.append(" Target Cert Constraints: " + String.valueOf(certSelector) + "\n");
726+
727+ /* finally, append miscellaneous parameters */
728+ if (certPathCheckers != null)
729+ sb.append(" Certification Path Checkers: ["
730+ + certPathCheckers.toString() + "]\n");
731+ if (certStores != null)
732+ sb.append(" CertStores: [" + certStores.toString() + "]\n");
733+ sb.append("]");
734+ return sb.toString();
735+ }
736+}
java/pkg/java/security/cert/PKIXReason.class+0−0

Binary file not shown.

java/pkg/java/security/cert/PKIXReason.java+77−0
@@ -0,0 +1,77 @@
1+/*
2+ * Copyright (c) 2008, Oracle and/or its affiliates. All rights reserved.
3+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
4+ *
5+ * This code is free software; you can redistribute it and/or modify it
6+ * under the terms of the GNU General Public License version 2 only, as
7+ * published by the Free Software Foundation. Oracle designates this
8+ * particular file as subject to the "Classpath" exception as provided
9+ * by Oracle in the LICENSE file that accompanied this code.
10+ *
11+ * This code is distributed in the hope that it will be useful, but WITHOUT
12+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
13+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
14+ * version 2 for more details (a copy is included in the LICENSE file that
15+ * accompanied this code).
16+ *
17+ * You should have received a copy of the GNU General Public License version
18+ * 2 along with this work; if not, write to the Free Software Foundation,
19+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
20+ *
21+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
22+ * or visit www.oracle.com if you need additional information or have any
23+ * questions.
24+ */
25+
26+package java.security.cert;
27+
28+/**
29+ * The <code>PKIXReason</code> enumerates the potential PKIX-specific reasons
30+ * that an X.509 certification path may be invalid according to the PKIX
31+ * (RFC 3280) standard. These reasons are in addition to those of the
32+ * <code>CertPathValidatorException.BasicReason</code> enumeration.
33+ *
34+ * @since 1.7
35+ */
36+public enum PKIXReason implements CertPathValidatorException.Reason {
37+ /**
38+ * The certificate does not chain correctly.
39+ */
40+ NAME_CHAINING,
41+
42+ /**
43+ * The certificate's key usage is invalid.
44+ */
45+ INVALID_KEY_USAGE,
46+
47+ /**
48+ * The policy constraints have been violated.
49+ */
50+ INVALID_POLICY,
51+
52+ /**
53+ * No acceptable trust anchor found.
54+ */
55+ NO_TRUST_ANCHOR,
56+
57+ /**
58+ * The certificate contains one or more unrecognized critical
59+ * extensions.
60+ */
61+ UNRECOGNIZED_CRIT_EXT,
62+
63+ /**
64+ * The certificate is not a CA certificate.
65+ */
66+ NOT_CA_CERT,
67+
68+ /**
69+ * The path length constraint has been violated.
70+ */
71+ PATH_TOO_LONG,
72+
73+ /**
74+ * The name constraints have been violated.
75+ */
76+ INVALID_NAME
77+}
java/pkg/java/security/cert/PolicyNode.class+0−0

Binary file not shown.

java/pkg/java/security/cert/PolicyNode.java+133−0
@@ -0,0 +1,133 @@
1+/*
2+ * Copyright (c) 2000, 2003, Oracle and/or its affiliates. All rights reserved.
3+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
4+ *
5+ * This code is free software; you can redistribute it and/or modify it
6+ * under the terms of the GNU General Public License version 2 only, as
7+ * published by the Free Software Foundation. Oracle designates this
8+ * particular file as subject to the "Classpath" exception as provided
9+ * by Oracle in the LICENSE file that accompanied this code.
10+ *
11+ * This code is distributed in the hope that it will be useful, but WITHOUT
12+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
13+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
14+ * version 2 for more details (a copy is included in the LICENSE file that
15+ * accompanied this code).
16+ *
17+ * You should have received a copy of the GNU General Public License version
18+ * 2 along with this work; if not, write to the Free Software Foundation,
19+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
20+ *
21+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
22+ * or visit www.oracle.com if you need additional information or have any
23+ * questions.
24+ */
25+
26+package java.security.cert;
27+
28+import java.util.Iterator;
29+import java.util.Set;
30+
31+/**
32+ * An immutable valid policy tree node as defined by the PKIX certification
33+ * path validation algorithm.
34+ *
35+ * <p>One of the outputs of the PKIX certification path validation
36+ * algorithm is a valid policy tree, which includes the policies that
37+ * were determined to be valid, how this determination was reached,
38+ * and any policy qualifiers encountered. This tree is of depth
39+ * <i>n</i>, where <i>n</i> is the length of the certification
40+ * path that has been validated.
41+ *
42+ * <p>Most applications will not need to examine the valid policy tree.
43+ * They can achieve their policy processing goals by setting the
44+ * policy-related parameters in <code>PKIXParameters</code>. However,
45+ * the valid policy tree is available for more sophisticated applications,
46+ * especially those that process policy qualifiers.
47+ *
48+ * <p>{@link PKIXCertPathValidatorResult#getPolicyTree()
49+ * PKIXCertPathValidatorResult.getPolicyTree} returns the root node of the
50+ * valid policy tree. The tree can be traversed using the
51+ * {@link #getChildren getChildren} and {@link #getParent getParent} methods.
52+ * Data about a particular node can be retrieved using other methods of
53+ * <code>PolicyNode</code>.
54+ *
55+ * <p><b>Concurrent Access</b>
56+ * <p>All <code>PolicyNode</code> objects must be immutable and
57+ * thread-safe. Multiple threads may concurrently invoke the methods defined
58+ * in this class on a single <code>PolicyNode</code> object (or more than one)
59+ * with no ill effects. This stipulation applies to all public fields and
60+ * methods of this class and any added or overridden by subclasses.
61+ *
62+ * @since 1.4
63+ * @author Sean Mullan
64+ */
65+public interface PolicyNode {
66+
67+ /**
68+ * Returns the parent of this node, or <code>null</code> if this is the
69+ * root node.
70+ *
71+ * @return the parent of this node, or <code>null</code> if this is the
72+ * root node
73+ */
74+ PolicyNode getParent();
75+
76+ /**
77+ * Returns an iterator over the children of this node. Any attempts to
78+ * modify the children of this node through the
79+ * <code>Iterator</code>'s remove method must throw an
80+ * <code>UnsupportedOperationException</code>.
81+ *
82+ * @return an iterator over the children of this node
83+ */
84+ Iterator<? extends PolicyNode> getChildren();
85+
86+ /**
87+ * Returns the depth of this node in the valid policy tree.
88+ *
89+ * @return the depth of this node (0 for the root node, 1 for its
90+ * children, and so on)
91+ */
92+ int getDepth();
93+
94+ /**
95+ * Returns the valid policy represented by this node.
96+ *
97+ * @return the <code>String</code> OID of the valid policy
98+ * represented by this node. For the root node, this method always returns
99+ * the special anyPolicy OID: "2.5.29.32.0".
100+ */
101+ String getValidPolicy();
102+
103+ /**
104+ * Returns the set of policy qualifiers associated with the
105+ * valid policy represented by this node.
106+ *
107+ * @return an immutable <code>Set</code> of
108+ * <code>PolicyQualifierInfo</code>s. For the root node, this
109+ * is always an empty <code>Set</code>.
110+ */
111+ Set<? extends PolicyQualifierInfo> getPolicyQualifiers();
112+
113+ /**
114+ * Returns the set of expected policies that would satisfy this
115+ * node's valid policy in the next certificate to be processed.
116+ *
117+ * @return an immutable <code>Set</code> of expected policy
118+ * <code>String</code> OIDs. For the root node, this method
119+ * always returns a <code>Set</code> with one element, the
120+ * special anyPolicy OID: "2.5.29.32.0".
121+ */
122+ Set<String> getExpectedPolicies();
123+
124+ /**
125+ * Returns the criticality indicator of the certificate policy extension
126+ * in the most recently processed certificate.
127+ *
128+ * @return <code>true</code> if extension marked critical,
129+ * <code>false</code> otherwise. For the root node, <code>false</code>
130+ * is always returned.
131+ */
132+ boolean isCritical();
133+}
java/pkg/java/security/cert/PolicyQualifierInfo.class+0−0

Binary file not shown.

java/pkg/java/security/cert/PolicyQualifierInfo.java+173−0
@@ -0,0 +1,173 @@
1+/*
2+ * Copyright (c) 2000, 2003, Oracle and/or its affiliates. All rights reserved.
3+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
4+ *
5+ * This code is free software; you can redistribute it and/or modify it
6+ * under the terms of the GNU General Public License version 2 only, as
7+ * published by the Free Software Foundation. Oracle designates this
8+ * particular file as subject to the "Classpath" exception as provided
9+ * by Oracle in the LICENSE file that accompanied this code.
10+ *
11+ * This code is distributed in the hope that it will be useful, but WITHOUT
12+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
13+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
14+ * version 2 for more details (a copy is included in the LICENSE file that
15+ * accompanied this code).
16+ *
17+ * You should have received a copy of the GNU General Public License version
18+ * 2 along with this work; if not, write to the Free Software Foundation,
19+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
20+ *
21+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
22+ * or visit www.oracle.com if you need additional information or have any
23+ * questions.
24+ */
25+
26+package java.security.cert;
27+
28+import java.io.IOException;
29+
30+import sun.misc.HexDumpEncoder;
31+import sun.security.util.DerValue;
32+
33+/**
34+ * An immutable policy qualifier represented by the ASN.1 PolicyQualifierInfo
35+ * structure.
36+ *
37+ * <p>The ASN.1 definition is as follows:
38+ * <p><pre>
39+ * PolicyQualifierInfo ::= SEQUENCE {
40+ * policyQualifierId PolicyQualifierId,
41+ * qualifier ANY DEFINED BY policyQualifierId }
42+ * </pre>
43+ * <p>
44+ * A certificate policies extension, if present in an X.509 version 3
45+ * certificate, contains a sequence of one or more policy information terms,
46+ * each of which consists of an object identifier (OID) and optional
47+ * qualifiers. In an end-entity certificate, these policy information terms
48+ * indicate the policy under which the certificate has been issued and the
49+ * purposes for which the certificate may be used. In a CA certificate, these
50+ * policy information terms limit the set of policies for certification paths
51+ * which include this certificate.
52+ * <p>
53+ * A <code>Set</code> of <code>PolicyQualifierInfo</code> objects are returned
54+ * by the {@link PolicyNode#getPolicyQualifiers PolicyNode.getPolicyQualifiers}
55+ * method. This allows applications with specific policy requirements to
56+ * process and validate each policy qualifier. Applications that need to
57+ * process policy qualifiers should explicitly set the
58+ * <code>policyQualifiersRejected</code> flag to false (by calling the
59+ * {@link PKIXParameters#setPolicyQualifiersRejected
60+ * PKIXParameters.setPolicyQualifiersRejected} method) before validating
61+ * a certification path.
62+ *
63+ * <p>Note that the PKIX certification path validation algorithm specifies
64+ * that any policy qualifier in a certificate policies extension that is
65+ * marked critical must be processed and validated. Otherwise the
66+ * certification path must be rejected. If the
67+ * <code>policyQualifiersRejected</code> flag is set to false, it is up to
68+ * the application to validate all policy qualifiers in this manner in order
69+ * to be PKIX compliant.
70+ *
71+ * <p><b>Concurrent Access</b>
72+ *
73+ * <p>All <code>PolicyQualifierInfo</code> objects must be immutable and
74+ * thread-safe. That is, multiple threads may concurrently invoke the
75+ * methods defined in this class on a single <code>PolicyQualifierInfo</code>
76+ * object (or more than one) with no ill effects. Requiring
77+ * <code>PolicyQualifierInfo</code> objects to be immutable and thread-safe
78+ * allows them to be passed around to various pieces of code without
79+ * worrying about coordinating access.
80+ *
81+ * @author seth proctor
82+ * @author Sean Mullan
83+ * @since 1.4
84+ */
85+public class PolicyQualifierInfo {
86+
87+ private byte [] mEncoded;
88+ private String mId;
89+ private byte [] mData;
90+ private String pqiString;
91+
92+ /**
93+ * Creates an instance of <code>PolicyQualifierInfo</code> from the
94+ * encoded bytes. The encoded byte array is copied on construction.
95+ *
96+ * @param encoded a byte array containing the qualifier in DER encoding
97+ * @exception IOException thrown if the byte array does not represent a
98+ * valid and parsable policy qualifier
99+ */
100+ public PolicyQualifierInfo(byte[] encoded) throws IOException {
101+ mEncoded = encoded.clone();
102+
103+ DerValue val = new DerValue(mEncoded);
104+ if (val.tag != DerValue.tag_Sequence)
105+ throw new IOException("Invalid encoding for PolicyQualifierInfo");
106+
107+ mId = (val.data.getDerValue()).getOID().toString();
108+ byte [] tmp = val.data.toByteArray();
109+ if (tmp == null) {
110+ mData = null;
111+ } else {
112+ mData = new byte[tmp.length];
113+ System.arraycopy(tmp, 0, mData, 0, tmp.length);
114+ }
115+ }
116+
117+ /**
118+ * Returns the <code>policyQualifierId</code> field of this
119+ * <code>PolicyQualifierInfo</code>. The <code>policyQualifierId</code>
120+ * is an Object Identifier (OID) represented by a set of nonnegative
121+ * integers separated by periods.
122+ *
123+ * @return the OID (never <code>null</code>)
124+ */
125+ public final String getPolicyQualifierId() {
126+ return mId;
127+ }
128+
129+ /**
130+ * Returns the ASN.1 DER encoded form of this
131+ * <code>PolicyQualifierInfo</code>.
132+ *
133+ * @return the ASN.1 DER encoded bytes (never <code>null</code>).
134+ * Note that a copy is returned, so the data is cloned each time
135+ * this method is called.
136+ */
137+ public final byte[] getEncoded() {
138+ return mEncoded.clone();
139+ }
140+
141+ /**
142+ * Returns the ASN.1 DER encoded form of the <code>qualifier</code>
143+ * field of this <code>PolicyQualifierInfo</code>.
144+ *
145+ * @return the ASN.1 DER encoded bytes of the <code>qualifier</code>
146+ * field. Note that a copy is returned, so the data is cloned each
147+ * time this method is called.
148+ */
149+ public final byte[] getPolicyQualifier() {
150+ return (mData == null ? null : mData.clone());
151+ }
152+
153+ /**
154+ * Return a printable representation of this
155+ * <code>PolicyQualifierInfo</code>.
156+ *
157+ * @return a <code>String</code> describing the contents of this
158+ * <code>PolicyQualifierInfo</code>
159+ */
160+ public String toString() {
161+ if (pqiString != null)
162+ return pqiString;
163+ HexDumpEncoder enc = new HexDumpEncoder();
164+ StringBuffer sb = new StringBuffer();
165+ sb.append("PolicyQualifierInfo: [\n");
166+ sb.append(" qualifierID: " + mId + "\n");
167+ sb.append(" qualifier: " +
168+ (mData == null ? "null" : enc.encodeBuffer(mData)) + "\n");
169+ sb.append("]");
170+ pqiString = sb.toString();
171+ return pqiString;
172+ }
173+}
java/pkg/java/security/cert/TrustAnchor.class+0−0

Binary file not shown.

java/pkg/java/security/cert/TrustAnchor.java+334−0
@@ -0,0 +1,334 @@
1+/*
2+ * Copyright (c) 2001, 2008, Oracle and/or its affiliates. All rights reserved.
3+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
4+ *
5+ * This code is free software; you can redistribute it and/or modify it
6+ * under the terms of the GNU General Public License version 2 only, as
7+ * published by the Free Software Foundation. Oracle designates this
8+ * particular file as subject to the "Classpath" exception as provided
9+ * by Oracle in the LICENSE file that accompanied this code.
10+ *
11+ * This code is distributed in the hope that it will be useful, but WITHOUT
12+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
13+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
14+ * version 2 for more details (a copy is included in the LICENSE file that
15+ * accompanied this code).
16+ *
17+ * You should have received a copy of the GNU General Public License version
18+ * 2 along with this work; if not, write to the Free Software Foundation,
19+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
20+ *
21+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
22+ * or visit www.oracle.com if you need additional information or have any
23+ * questions.
24+ */
25+
26+package java.security.cert;
27+
28+import java.io.IOException;
29+import java.security.PublicKey;
30+
31+import javax.security.auth.x500.X500Principal;
32+
33+import sun.security.x509.NameConstraintsExtension;
34+import sun.security.x509.X500Name;
35+
36+/**
37+ * A trust anchor or most-trusted Certification Authority (CA).
38+ * <p>
39+ * This class represents a "most-trusted CA", which is used as a trust anchor
40+ * for validating X.509 certification paths. A most-trusted CA includes the
41+ * public key of the CA, the CA's name, and any constraints upon the set of
42+ * paths which may be validated using this key. These parameters can be
43+ * specified in the form of a trusted <code>X509Certificate</code> or as
44+ * individual parameters.
45+ * <p>
46+ * <b>Concurrent Access</b>
47+ * <p>
48+ * <p>All <code>TrustAnchor</code> objects must be immutable and
49+ * thread-safe. That is, multiple threads may concurrently invoke the
50+ * methods defined in this class on a single <code>TrustAnchor</code>
51+ * object (or more than one) with no ill effects. Requiring
52+ * <code>TrustAnchor</code> objects to be immutable and thread-safe
53+ * allows them to be passed around to various pieces of code without
54+ * worrying about coordinating access. This stipulation applies to all
55+ * public fields and methods of this class and any added or overridden
56+ * by subclasses.
57+ *
58+ * @see PKIXParameters#PKIXParameters(Set)
59+ * @see PKIXBuilderParameters#PKIXBuilderParameters(Set, CertSelector)
60+ *
61+ * @since 1.4
62+ * @author Sean Mullan
63+ */
64+public class TrustAnchor {
65+
66+ private final PublicKey pubKey;
67+ private final String caName;
68+ private final X500Principal caPrincipal;
69+ private final X509Certificate trustedCert;
70+ private byte[] ncBytes;
71+ private NameConstraintsExtension nc;
72+
73+ /**
74+ * Creates an instance of <code>TrustAnchor</code> with the specified
75+ * <code>X509Certificate</code> and optional name constraints, which
76+ * are intended to be used as additional constraints when validating
77+ * an X.509 certification path.
78+ * <p>
79+ * The name constraints are specified as a byte array. This byte array
80+ * should contain the DER encoded form of the name constraints, as they
81+ * would appear in the NameConstraints structure defined in
82+ * <a href="http://www.ietf.org/rfc/rfc3280">RFC 3280</a>
83+ * and X.509. The ASN.1 definition of this structure appears below.
84+ *
85+ * <pre><code>
86+ * NameConstraints ::= SEQUENCE {
87+ * permittedSubtrees [0] GeneralSubtrees OPTIONAL,
88+ * excludedSubtrees [1] GeneralSubtrees OPTIONAL }
89+ *
90+ * GeneralSubtrees ::= SEQUENCE SIZE (1..MAX) OF GeneralSubtree
91+ *
92+ * GeneralSubtree ::= SEQUENCE {
93+ * base GeneralName,
94+ * minimum [0] BaseDistance DEFAULT 0,
95+ * maximum [1] BaseDistance OPTIONAL }
96+ *
97+ * BaseDistance ::= INTEGER (0..MAX)
98+ *
99+ * GeneralName ::= CHOICE {
100+ * otherName [0] OtherName,
101+ * rfc822Name [1] IA5String,
102+ * dNSName [2] IA5String,
103+ * x400Address [3] ORAddress,
104+ * directoryName [4] Name,
105+ * ediPartyName [5] EDIPartyName,
106+ * uniformResourceIdentifier [6] IA5String,
107+ * iPAddress [7] OCTET STRING,
108+ * registeredID [8] OBJECT IDENTIFIER}
109+ * </code></pre>
110+ * <p>
111+ * Note that the name constraints byte array supplied is cloned to protect
112+ * against subsequent modifications.
113+ *
114+ * @param trustedCert a trusted <code>X509Certificate</code>
115+ * @param nameConstraints a byte array containing the ASN.1 DER encoding of
116+ * a NameConstraints extension to be used for checking name constraints.
117+ * Only the value of the extension is included, not the OID or criticality
118+ * flag. Specify <code>null</code> to omit the parameter.
119+ * @throws IllegalArgumentException if the name constraints cannot be
120+ * decoded
121+ * @throws NullPointerException if the specified
122+ * <code>X509Certificate</code> is <code>null</code>
123+ */
124+ public TrustAnchor(X509Certificate trustedCert, byte[] nameConstraints)
125+ {
126+ if (trustedCert == null)
127+ throw new NullPointerException("the trustedCert parameter must " +
128+ "be non-null");
129+ this.trustedCert = trustedCert;
130+ this.pubKey = null;
131+ this.caName = null;
132+ this.caPrincipal = null;
133+ setNameConstraints(nameConstraints);
134+ }
135+
136+ /**
137+ * Creates an instance of <code>TrustAnchor</code> where the
138+ * most-trusted CA is specified as an X500Principal and public key.
139+ * Name constraints are an optional parameter, and are intended to be used
140+ * as additional constraints when validating an X.509 certification path.
141+ * <p>
142+ * The name constraints are specified as a byte array. This byte array
143+ * contains the DER encoded form of the name constraints, as they
144+ * would appear in the NameConstraints structure defined in RFC 3280
145+ * and X.509. The ASN.1 notation for this structure is supplied in the
146+ * documentation for
147+ * {@link #TrustAnchor(X509Certificate, byte[])
148+ * TrustAnchor(X509Certificate trustedCert, byte[] nameConstraints) }.
149+ * <p>
150+ * Note that the name constraints byte array supplied here is cloned to
151+ * protect against subsequent modifications.
152+ *
153+ * @param caPrincipal the name of the most-trusted CA as X500Principal
154+ * @param pubKey the public key of the most-trusted CA
155+ * @param nameConstraints a byte array containing the ASN.1 DER encoding of
156+ * a NameConstraints extension to be used for checking name constraints.
157+ * Only the value of the extension is included, not the OID or criticality
158+ * flag. Specify <code>null</code> to omit the parameter.
159+ * @throws NullPointerException if the specified <code>caPrincipal</code> or
160+ * <code>pubKey</code> parameter is <code>null</code>
161+ * @since 1.5
162+ */
163+ public TrustAnchor(X500Principal caPrincipal, PublicKey pubKey,
164+ byte[] nameConstraints) {
165+ if ((caPrincipal == null) || (pubKey == null)) {
166+ throw new NullPointerException();
167+ }
168+ this.trustedCert = null;
169+ this.caPrincipal = caPrincipal;
170+ this.caName = caPrincipal.getName();
171+ this.pubKey = pubKey;
172+ setNameConstraints(nameConstraints);
173+ }
174+
175+ /**
176+ * Creates an instance of <code>TrustAnchor</code> where the
177+ * most-trusted CA is specified as a distinguished name and public key.
178+ * Name constraints are an optional parameter, and are intended to be used
179+ * as additional constraints when validating an X.509 certification path.
180+ * <p>
181+ * The name constraints are specified as a byte array. This byte array
182+ * contains the DER encoded form of the name constraints, as they
183+ * would appear in the NameConstraints structure defined in RFC 3280
184+ * and X.509. The ASN.1 notation for this structure is supplied in the
185+ * documentation for
186+ * {@link #TrustAnchor(X509Certificate, byte[])
187+ * TrustAnchor(X509Certificate trustedCert, byte[] nameConstraints) }.
188+ * <p>
189+ * Note that the name constraints byte array supplied here is cloned to
190+ * protect against subsequent modifications.
191+ *
192+ * @param caName the X.500 distinguished name of the most-trusted CA in
193+ * <a href="http://www.ietf.org/rfc/rfc2253.txt">RFC 2253</a>
194+ * <code>String</code> format
195+ * @param pubKey the public key of the most-trusted CA
196+ * @param nameConstraints a byte array containing the ASN.1 DER encoding of
197+ * a NameConstraints extension to be used for checking name constraints.
198+ * Only the value of the extension is included, not the OID or criticality
199+ * flag. Specify <code>null</code> to omit the parameter.
200+ * @throws IllegalArgumentException if the specified <code>
201+ * caName</code> parameter is empty <code>(caName.length() == 0)</code>
202+ * or incorrectly formatted or the name constraints cannot be decoded
203+ * @throws NullPointerException if the specified <code>caName</code> or
204+ * <code>pubKey</code> parameter is <code>null</code>
205+ */
206+ public TrustAnchor(String caName, PublicKey pubKey, byte[] nameConstraints)
207+ {
208+ if (pubKey == null)
209+ throw new NullPointerException("the pubKey parameter must be " +
210+ "non-null");
211+ if (caName == null)
212+ throw new NullPointerException("the caName parameter must be " +
213+ "non-null");
214+ if (caName.length() == 0)
215+ throw new IllegalArgumentException("the caName " +
216+ "parameter must be a non-empty String");
217+ // check if caName is formatted correctly
218+ this.caPrincipal = new X500Principal(caName);
219+ this.pubKey = pubKey;
220+ this.caName = caName;
221+ this.trustedCert = null;
222+ setNameConstraints(nameConstraints);
223+ }
224+
225+ /**
226+ * Returns the most-trusted CA certificate.
227+ *
228+ * @return a trusted <code>X509Certificate</code> or <code>null</code>
229+ * if the trust anchor was not specified as a trusted certificate
230+ */
231+ public final X509Certificate getTrustedCert() {
232+ return this.trustedCert;
233+ }
234+
235+ /**
236+ * Returns the name of the most-trusted CA as an X500Principal.
237+ *
238+ * @return the X.500 distinguished name of the most-trusted CA, or
239+ * <code>null</code> if the trust anchor was not specified as a trusted
240+ * public key and name or X500Principal pair
241+ * @since 1.5
242+ */
243+ public final X500Principal getCA() {
244+ return this.caPrincipal;
245+ }
246+
247+ /**
248+ * Returns the name of the most-trusted CA in RFC 2253 <code>String</code>
249+ * format.
250+ *
251+ * @return the X.500 distinguished name of the most-trusted CA, or
252+ * <code>null</code> if the trust anchor was not specified as a trusted
253+ * public key and name or X500Principal pair
254+ */
255+ public final String getCAName() {
256+ return this.caName;
257+ }
258+
259+ /**
260+ * Returns the public key of the most-trusted CA.
261+ *
262+ * @return the public key of the most-trusted CA, or <code>null</code>
263+ * if the trust anchor was not specified as a trusted public key and name
264+ * or X500Principal pair
265+ */
266+ public final PublicKey getCAPublicKey() {
267+ return this.pubKey;
268+ }
269+
270+ /**
271+ * Decode the name constraints and clone them if not null.
272+ */
273+ private void setNameConstraints(byte[] bytes) {
274+ if (bytes == null) {
275+ ncBytes = null;
276+ nc = null;
277+ } else {
278+ ncBytes = bytes.clone();
279+ // validate DER encoding
280+ try {
281+ nc = new NameConstraintsExtension(Boolean.FALSE, bytes);
282+ } catch (IOException ioe) {
283+ IllegalArgumentException iae =
284+ new IllegalArgumentException(ioe.getMessage());
285+ iae.initCause(ioe);
286+ throw iae;
287+ }
288+ }
289+ }
290+
291+ /**
292+ * Returns the name constraints parameter. The specified name constraints
293+ * are associated with this trust anchor and are intended to be used
294+ * as additional constraints when validating an X.509 certification path.
295+ * <p>
296+ * The name constraints are returned as a byte array. This byte array
297+ * contains the DER encoded form of the name constraints, as they
298+ * would appear in the NameConstraints structure defined in RFC 3280
299+ * and X.509. The ASN.1 notation for this structure is supplied in the
300+ * documentation for
301+ * {@link #TrustAnchor(X509Certificate, byte[])
302+ * TrustAnchor(X509Certificate trustedCert, byte[] nameConstraints) }.
303+ * <p>
304+ * Note that the byte array returned is cloned to protect against
305+ * subsequent modifications.
306+ *
307+ * @return a byte array containing the ASN.1 DER encoding of
308+ * a NameConstraints extension used for checking name constraints,
309+ * or <code>null</code> if not set.
310+ */
311+ public final byte [] getNameConstraints() {
312+ return ncBytes == null ? null : ncBytes.clone();
313+ }
314+
315+ /**
316+ * Returns a formatted string describing the <code>TrustAnchor</code>.
317+ *
318+ * @return a formatted string describing the <code>TrustAnchor</code>
319+ */
320+ public String toString() {
321+ StringBuffer sb = new StringBuffer();
322+ sb.append("[\n");
323+ if (pubKey != null) {
324+ sb.append(" Trusted CA Public Key: " + pubKey.toString() + "\n");
325+ sb.append(" Trusted CA Issuer Name: "
326+ + String.valueOf(caName) + "\n");
327+ } else {
328+ sb.append(" Trusted CA cert: " + trustedCert.toString() + "\n");
329+ }
330+ if (nc != null)
331+ sb.append(" Name Constraints: " + nc.toString() + "\n");
332+ return sb.toString();
333+ }
334+}
java/pkg/java/security/cert/X509CRL.class+0−0

Binary file not shown.

java/pkg/java/security/cert/X509CRL.java+443−0
@@ -0,0 +1,443 @@
1+/*
2+ * Copyright (c) 1997, 2010, Oracle and/or its affiliates. All rights reserved.
3+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
4+ *
5+ * This code is free software; you can redistribute it and/or modify it
6+ * under the terms of the GNU General Public License version 2 only, as
7+ * published by the Free Software Foundation. Oracle designates this
8+ * particular file as subject to the "Classpath" exception as provided
9+ * by Oracle in the LICENSE file that accompanied this code.
10+ *
11+ * This code is distributed in the hope that it will be useful, but WITHOUT
12+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
13+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
14+ * version 2 for more details (a copy is included in the LICENSE file that
15+ * accompanied this code).
16+ *
17+ * You should have received a copy of the GNU General Public License version
18+ * 2 along with this work; if not, write to the Free Software Foundation,
19+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
20+ *
21+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
22+ * or visit www.oracle.com if you need additional information or have any
23+ * questions.
24+ */
25+
26+package java.security.cert;
27+
28+import java.security.NoSuchAlgorithmException;
29+import java.security.NoSuchProviderException;
30+import java.security.InvalidKeyException;
31+import java.security.SignatureException;
32+import java.security.Principal;
33+import java.security.PublicKey;
34+import javax.security.auth.x500.X500Principal;
35+
36+import java.math.BigInteger;
37+import java.util.Date;
38+import java.util.Set;
39+import java.util.Arrays;
40+
41+import sun.security.x509.X509CRLImpl;
42+
43+/**
44+ * <p>
45+ * Abstract class for an X.509 Certificate Revocation List (CRL).
46+ * A CRL is a time-stamped list identifying revoked certificates.
47+ * It is signed by a Certificate Authority (CA) and made freely
48+ * available in a public repository.
49+ *
50+ * <p>Each revoked certificate is
51+ * identified in a CRL by its certificate serial number. When a
52+ * certificate-using system uses a certificate (e.g., for verifying a
53+ * remote user's digital signature), that system not only checks the
54+ * certificate signature and validity but also acquires a suitably-
55+ * recent CRL and checks that the certificate serial number is not on
56+ * that CRL. The meaning of "suitably-recent" may vary with local
57+ * policy, but it usually means the most recently-issued CRL. A CA
58+ * issues a new CRL on a regular periodic basis (e.g., hourly, daily, or
59+ * weekly). Entries are added to CRLs as revocations occur, and an
60+ * entry may be removed when the certificate expiration date is reached.
61+ * <p>
62+ * The X.509 v2 CRL format is described below in ASN.1:
63+ * <pre>
64+ * CertificateList ::= SEQUENCE {
65+ * tbsCertList TBSCertList,
66+ * signatureAlgorithm AlgorithmIdentifier,
67+ * signature BIT STRING }
68+ * </pre>
69+ * <p>
70+ * More information can be found in
71+ * <a href="http://www.ietf.org/rfc/rfc3280.txt">RFC 3280: Internet X.509
72+ * Public Key Infrastructure Certificate and CRL Profile</a>.
73+ * <p>
74+ * The ASN.1 definition of <code>tbsCertList</code> is:
75+ * <pre>
76+ * TBSCertList ::= SEQUENCE {
77+ * version Version OPTIONAL,
78+ * -- if present, must be v2
79+ * signature AlgorithmIdentifier,
80+ * issuer Name,
81+ * thisUpdate ChoiceOfTime,
82+ * nextUpdate ChoiceOfTime OPTIONAL,
83+ * revokedCertificates SEQUENCE OF SEQUENCE {
84+ * userCertificate CertificateSerialNumber,
85+ * revocationDate ChoiceOfTime,
86+ * crlEntryExtensions Extensions OPTIONAL
87+ * -- if present, must be v2
88+ * } OPTIONAL,
89+ * crlExtensions [0] EXPLICIT Extensions OPTIONAL
90+ * -- if present, must be v2
91+ * }
92+ * </pre>
93+ * <p>
94+ * CRLs are instantiated using a certificate factory. The following is an
95+ * example of how to instantiate an X.509 CRL:
96+ * <pre><code>
97+ * InputStream inStream = null;
98+ * try {
99+ * inStream = new FileInputStream("fileName-of-crl");
100+ * CertificateFactory cf = CertificateFactory.getInstance("X.509");
101+ * X509CRL crl = (X509CRL)cf.generateCRL(inStream);
102+ * } finally {
103+ * if (inStream != null) {
104+ * inStream.close();
105+ * }
106+ * }
107+ * </code></pre>
108+ *
109+ * @author Hemma Prafullchandra
110+ *
111+ *
112+ * @see CRL
113+ * @see CertificateFactory
114+ * @see X509Extension
115+ */
116+
117+public abstract class X509CRL extends CRL implements X509Extension {
118+
119+ private transient X500Principal issuerPrincipal;
120+
121+ /**
122+ * Constructor for X.509 CRLs.
123+ */
124+ protected X509CRL() {
125+ super("X.509");
126+ }
127+
128+ /**
129+ * Compares this CRL for equality with the given
130+ * object. If the <code>other</code> object is an
131+ * <code>instanceof</code> <code>X509CRL</code>, then
132+ * its encoded form is retrieved and compared with the
133+ * encoded form of this CRL.
134+ *
135+ * @param other the object to test for equality with this CRL.
136+ *
137+ * @return true iff the encoded forms of the two CRLs
138+ * match, false otherwise.
139+ */
140+ public boolean equals(Object other) {
141+ if (this == other) {
142+ return true;
143+ }
144+ if (!(other instanceof X509CRL)) {
145+ return false;
146+ }
147+ try {
148+ byte[] thisCRL = X509CRLImpl.getEncodedInternal(this);
149+ byte[] otherCRL = X509CRLImpl.getEncodedInternal((X509CRL)other);
150+
151+ return Arrays.equals(thisCRL, otherCRL);
152+ } catch (CRLException e) {
153+ return false;
154+ }
155+ }
156+
157+ /**
158+ * Returns a hashcode value for this CRL from its
159+ * encoded form.
160+ *
161+ * @return the hashcode value.
162+ */
163+ public int hashCode() {
164+ int retval = 0;
165+ try {
166+ byte[] crlData = X509CRLImpl.getEncodedInternal(this);
167+ for (int i = 1; i < crlData.length; i++) {
168+ retval += crlData[i] * i;
169+ }
170+ return retval;
171+ } catch (CRLException e) {
172+ return retval;
173+ }
174+ }
175+
176+ /**
177+ * Returns the ASN.1 DER-encoded form of this CRL.
178+ *
179+ * @return the encoded form of this certificate
180+ * @exception CRLException if an encoding error occurs.
181+ */
182+ public abstract byte[] getEncoded()
183+ throws CRLException;
184+
185+ /**
186+ * Verifies that this CRL was signed using the
187+ * private key that corresponds to the given public key.
188+ *
189+ * @param key the PublicKey used to carry out the verification.
190+ *
191+ * @exception NoSuchAlgorithmException on unsupported signature
192+ * algorithms.
193+ * @exception InvalidKeyException on incorrect key.
194+ * @exception NoSuchProviderException if there's no default provider.
195+ * @exception SignatureException on signature errors.
196+ * @exception CRLException on encoding errors.
197+ */
198+ public abstract void verify(PublicKey key)
199+ throws CRLException, NoSuchAlgorithmException,
200+ InvalidKeyException, NoSuchProviderException,
201+ SignatureException;
202+
203+ /**
204+ * Verifies that this CRL was signed using the
205+ * private key that corresponds to the given public key.
206+ * This method uses the signature verification engine
207+ * supplied by the given provider.
208+ *
209+ * @param key the PublicKey used to carry out the verification.
210+ * @param sigProvider the name of the signature provider.
211+ *
212+ * @exception NoSuchAlgorithmException on unsupported signature
213+ * algorithms.
214+ * @exception InvalidKeyException on incorrect key.
215+ * @exception NoSuchProviderException on incorrect provider.
216+ * @exception SignatureException on signature errors.
217+ * @exception CRLException on encoding errors.
218+ */
219+ public abstract void verify(PublicKey key, String sigProvider)
220+ throws CRLException, NoSuchAlgorithmException,
221+ InvalidKeyException, NoSuchProviderException,
222+ SignatureException;
223+
224+ /**
225+ * Gets the <code>version</code> (version number) value from the CRL.
226+ * The ASN.1 definition for this is:
227+ * <pre>
228+ * version Version OPTIONAL,
229+ * -- if present, must be v2<p>
230+ * Version ::= INTEGER { v1(0), v2(1), v3(2) }
231+ * -- v3 does not apply to CRLs but appears for consistency
232+ * -- with definition of Version for certs
233+ * </pre>
234+ *
235+ * @return the version number, i.e. 1 or 2.
236+ */
237+ public abstract int getVersion();
238+
239+ /**
240+ * <strong>Denigrated</strong>, replaced by {@linkplain
241+ * #getIssuerX500Principal()}. This method returns the <code>issuer</code>
242+ * as an implementation specific Principal object, which should not be
243+ * relied upon by portable code.
244+ *
245+ * <p>
246+ * Gets the <code>issuer</code> (issuer distinguished name) value from
247+ * the CRL. The issuer name identifies the entity that signed (and
248+ * issued) the CRL.
249+ *
250+ * <p>The issuer name field contains an
251+ * X.500 distinguished name (DN).
252+ * The ASN.1 definition for this is:
253+ * <pre>
254+ * issuer Name
255+ *
256+ * Name ::= CHOICE { RDNSequence }
257+ * RDNSequence ::= SEQUENCE OF RelativeDistinguishedName
258+ * RelativeDistinguishedName ::=
259+ * SET OF AttributeValueAssertion
260+ *
261+ * AttributeValueAssertion ::= SEQUENCE {
262+ * AttributeType,
263+ * AttributeValue }
264+ * AttributeType ::= OBJECT IDENTIFIER
265+ * AttributeValue ::= ANY
266+ * </pre>
267+ * The <code>Name</code> describes a hierarchical name composed of
268+ * attributes,
269+ * such as country name, and corresponding values, such as US.
270+ * The type of the <code>AttributeValue</code> component is determined by
271+ * the <code>AttributeType</code>; in general it will be a
272+ * <code>directoryString</code>. A <code>directoryString</code> is usually
273+ * one of <code>PrintableString</code>,
274+ * <code>TeletexString</code> or <code>UniversalString</code>.
275+ *
276+ * @return a Principal whose name is the issuer distinguished name.
277+ */
278+ public abstract Principal getIssuerDN();
279+
280+ /**
281+ * Returns the issuer (issuer distinguished name) value from the
282+ * CRL as an <code>X500Principal</code>.
283+ * <p>
284+ * It is recommended that subclasses override this method.
285+ *
286+ * @return an <code>X500Principal</code> representing the issuer
287+ * distinguished name
288+ * @since 1.4
289+ */
290+ public X500Principal getIssuerX500Principal() {
291+ if (issuerPrincipal == null) {
292+ issuerPrincipal = X509CRLImpl.getIssuerX500Principal(this);
293+ }
294+ return issuerPrincipal;
295+ }
296+
297+ /**
298+ * Gets the <code>thisUpdate</code> date from the CRL.
299+ * The ASN.1 definition for this is:
300+ * <pre>
301+ * thisUpdate ChoiceOfTime
302+ * ChoiceOfTime ::= CHOICE {
303+ * utcTime UTCTime,
304+ * generalTime GeneralizedTime }
305+ * </pre>
306+ *
307+ * @return the <code>thisUpdate</code> date from the CRL.
308+ */
309+ public abstract Date getThisUpdate();
310+
311+ /**
312+ * Gets the <code>nextUpdate</code> date from the CRL.
313+ *
314+ * @return the <code>nextUpdate</code> date from the CRL, or null if
315+ * not present.
316+ */
317+ public abstract Date getNextUpdate();
318+
319+ /**
320+ * Gets the CRL entry, if any, with the given certificate serialNumber.
321+ *
322+ * @param serialNumber the serial number of the certificate for which a CRL entry
323+ * is to be looked up
324+ * @return the entry with the given serial number, or null if no such entry
325+ * exists in this CRL.
326+ * @see X509CRLEntry
327+ */
328+ public abstract X509CRLEntry
329+ getRevokedCertificate(BigInteger serialNumber);
330+
331+ /**
332+ * Get the CRL entry, if any, for the given certificate.
333+ *
334+ * <p>This method can be used to lookup CRL entries in indirect CRLs,
335+ * that means CRLs that contain entries from issuers other than the CRL
336+ * issuer. The default implementation will only return entries for
337+ * certificates issued by the CRL issuer. Subclasses that wish to
338+ * support indirect CRLs should override this method.
339+ *
340+ * @param certificate the certificate for which a CRL entry is to be looked
341+ * up
342+ * @return the entry for the given certificate, or null if no such entry
343+ * exists in this CRL.
344+ * @exception NullPointerException if certificate is null
345+ *
346+ * @since 1.5
347+ */
348+ public X509CRLEntry getRevokedCertificate(X509Certificate certificate) {
349+ X500Principal certIssuer = certificate.getIssuerX500Principal();
350+ X500Principal crlIssuer = getIssuerX500Principal();
351+ if (certIssuer.equals(crlIssuer) == false) {
352+ return null;
353+ }
354+ return getRevokedCertificate(certificate.getSerialNumber());
355+ }
356+
357+ /**
358+ * Gets all the entries from this CRL.
359+ * This returns a Set of X509CRLEntry objects.
360+ *
361+ * @return all the entries or null if there are none present.
362+ * @see X509CRLEntry
363+ */
364+ public abstract Set<? extends X509CRLEntry> getRevokedCertificates();
365+
366+ /**
367+ * Gets the DER-encoded CRL information, the
368+ * <code>tbsCertList</code> from this CRL.
369+ * This can be used to verify the signature independently.
370+ *
371+ * @return the DER-encoded CRL information.
372+ * @exception CRLException if an encoding error occurs.
373+ */
374+ public abstract byte[] getTBSCertList() throws CRLException;
375+
376+ /**
377+ * Gets the <code>signature</code> value (the raw signature bits) from
378+ * the CRL.
379+ * The ASN.1 definition for this is:
380+ * <pre>
381+ * signature BIT STRING
382+ * </pre>
383+ *
384+ * @return the signature.
385+ */
386+ public abstract byte[] getSignature();
387+
388+ /**
389+ * Gets the signature algorithm name for the CRL
390+ * signature algorithm. An example is the string "SHA256withRSA".
391+ * The ASN.1 definition for this is:
392+ * <pre>
393+ * signatureAlgorithm AlgorithmIdentifier<p>
394+ * AlgorithmIdentifier ::= SEQUENCE {
395+ * algorithm OBJECT IDENTIFIER,
396+ * parameters ANY DEFINED BY algorithm OPTIONAL }
397+ * -- contains a value of the type
398+ * -- registered for use with the
399+ * -- algorithm object identifier value
400+ * </pre>
401+ *
402+ * <p>The algorithm name is determined from the <code>algorithm</code>
403+ * OID string.
404+ *
405+ * @return the signature algorithm name.
406+ */
407+ public abstract String getSigAlgName();
408+
409+ /**
410+ * Gets the signature algorithm OID string from the CRL.
411+ * An OID is represented by a set of nonnegative whole numbers separated
412+ * by periods.
413+ * For example, the string "1.2.840.10040.4.3" identifies the SHA-1
414+ * with DSA signature algorithm defined in
415+ * <a href="http://www.ietf.org/rfc/rfc3279.txt">RFC 3279: Algorithms and
416+ * Identifiers for the Internet X.509 Public Key Infrastructure Certificate
417+ * and CRL Profile</a>.
418+ *
419+ * <p>See {@link #getSigAlgName() getSigAlgName} for
420+ * relevant ASN.1 definitions.
421+ *
422+ * @return the signature algorithm OID string.
423+ */
424+ public abstract String getSigAlgOID();
425+
426+ /**
427+ * Gets the DER-encoded signature algorithm parameters from this
428+ * CRL's signature algorithm. In most cases, the signature
429+ * algorithm parameters are null; the parameters are usually
430+ * supplied with the public key.
431+ * If access to individual parameter values is needed then use
432+ * {@link java.security.AlgorithmParameters AlgorithmParameters}
433+ * and instantiate with the name returned by
434+ * {@link #getSigAlgName() getSigAlgName}.
435+ *
436+ * <p>See {@link #getSigAlgName() getSigAlgName} for
437+ * relevant ASN.1 definitions.
438+ *
439+ * @return the DER-encoded signature algorithm parameters, or
440+ * null if no parameters are present.
441+ */
442+ public abstract byte[] getSigAlgParams();
443+}
java/pkg/java/security/cert/X509CRLEntry.class+0−0

Binary file not shown.

java/pkg/java/security/cert/X509CRLEntry.java+191−0
@@ -0,0 +1,191 @@
1+/*
2+ * Copyright (c) 1997, 2003, Oracle and/or its affiliates. All rights reserved.
3+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
4+ *
5+ * This code is free software; you can redistribute it and/or modify it
6+ * under the terms of the GNU General Public License version 2 only, as
7+ * published by the Free Software Foundation. Oracle designates this
8+ * particular file as subject to the "Classpath" exception as provided
9+ * by Oracle in the LICENSE file that accompanied this code.
10+ *
11+ * This code is distributed in the hope that it will be useful, but WITHOUT
12+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
13+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
14+ * version 2 for more details (a copy is included in the LICENSE file that
15+ * accompanied this code).
16+ *
17+ * You should have received a copy of the GNU General Public License version
18+ * 2 along with this work; if not, write to the Free Software Foundation,
19+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
20+ *
21+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
22+ * or visit www.oracle.com if you need additional information or have any
23+ * questions.
24+ */
25+
26+package java.security.cert;
27+
28+import java.math.BigInteger;
29+import java.util.Date;
30+import javax.security.auth.x500.X500Principal;
31+
32+import sun.security.x509.X509CRLEntryImpl;
33+
34+/**
35+ * <p>Abstract class for a revoked certificate in a CRL (Certificate
36+ * Revocation List).
37+ *
38+ * The ASN.1 definition for <em>revokedCertificates</em> is:
39+ * <pre>
40+ * revokedCertificates SEQUENCE OF SEQUENCE {
41+ * userCertificate CertificateSerialNumber,
42+ * revocationDate ChoiceOfTime,
43+ * crlEntryExtensions Extensions OPTIONAL
44+ * -- if present, must be v2
45+ * } OPTIONAL
46+ *<p>
47+ * CertificateSerialNumber ::= INTEGER
48+ *<p>
49+ * Extensions ::= SEQUENCE SIZE (1..MAX) OF Extension
50+ *<p>
51+ * Extension ::= SEQUENCE {
52+ * extnId OBJECT IDENTIFIER,
53+ * critical BOOLEAN DEFAULT FALSE,
54+ * extnValue OCTET STRING
55+ * -- contains a DER encoding of a value
56+ * -- of the type registered for use with
57+ * -- the extnId object identifier value
58+ * }
59+ * </pre>
60+ *
61+ * @see X509CRL
62+ * @see X509Extension
63+ *
64+ * @author Hemma Prafullchandra
65+ */
66+
67+public abstract class X509CRLEntry implements X509Extension {
68+
69+ /**
70+ * Compares this CRL entry for equality with the given
71+ * object. If the <code>other</code> object is an
72+ * <code>instanceof</code> <code>X509CRLEntry</code>, then
73+ * its encoded form (the inner SEQUENCE) is retrieved and compared
74+ * with the encoded form of this CRL entry.
75+ *
76+ * @param other the object to test for equality with this CRL entry.
77+ * @return true iff the encoded forms of the two CRL entries
78+ * match, false otherwise.
79+ */
80+ public boolean equals(Object other) {
81+ if (this == other)
82+ return true;
83+ if (!(other instanceof X509CRLEntry))
84+ return false;
85+ try {
86+ byte[] thisCRLEntry = this.getEncoded();
87+ byte[] otherCRLEntry = ((X509CRLEntry)other).getEncoded();
88+
89+ if (thisCRLEntry.length != otherCRLEntry.length)
90+ return false;
91+ for (int i = 0; i < thisCRLEntry.length; i++)
92+ if (thisCRLEntry[i] != otherCRLEntry[i])
93+ return false;
94+ } catch (CRLException ce) {
95+ return false;
96+ }
97+ return true;
98+ }
99+
100+ /**
101+ * Returns a hashcode value for this CRL entry from its
102+ * encoded form.
103+ *
104+ * @return the hashcode value.
105+ */
106+ public int hashCode() {
107+ int retval = 0;
108+ try {
109+ byte[] entryData = this.getEncoded();
110+ for (int i = 1; i < entryData.length; i++)
111+ retval += entryData[i] * i;
112+
113+ } catch (CRLException ce) {
114+ return(retval);
115+ }
116+ return(retval);
117+ }
118+
119+ /**
120+ * Returns the ASN.1 DER-encoded form of this CRL Entry,
121+ * that is the inner SEQUENCE.
122+ *
123+ * @return the encoded form of this certificate
124+ * @exception CRLException if an encoding error occurs.
125+ */
126+ public abstract byte[] getEncoded() throws CRLException;
127+
128+ /**
129+ * Gets the serial number from this X509CRLEntry,
130+ * the <em>userCertificate</em>.
131+ *
132+ * @return the serial number.
133+ */
134+ public abstract BigInteger getSerialNumber();
135+
136+ /**
137+ * Get the issuer of the X509Certificate described by this entry. If
138+ * the certificate issuer is also the CRL issuer, this method returns
139+ * null.
140+ *
141+ * <p>This method is used with indirect CRLs. The default implementation
142+ * always returns null. Subclasses that wish to support indirect CRLs
143+ * should override it.
144+ *
145+ * @return the issuer of the X509Certificate described by this entry
146+ * or null if it is issued by the CRL issuer.
147+ *
148+ * @since 1.5
149+ */
150+ public X500Principal getCertificateIssuer() {
151+ return null;
152+ }
153+
154+ /**
155+ * Gets the revocation date from this X509CRLEntry,
156+ * the <em>revocationDate</em>.
157+ *
158+ * @return the revocation date.
159+ */
160+ public abstract Date getRevocationDate();
161+
162+ /**
163+ * Returns true if this CRL entry has extensions.
164+ *
165+ * @return true if this entry has extensions, false otherwise.
166+ */
167+ public abstract boolean hasExtensions();
168+
169+ /**
170+ * Returns a string representation of this CRL entry.
171+ *
172+ * @return a string representation of this CRL entry.
173+ */
174+ public abstract String toString();
175+
176+ /**
177+ * Returns the reason the certificate has been revoked, as specified
178+ * in the Reason Code extension of this CRL entry.
179+ *
180+ * @return the reason the certificate has been revoked, or
181+ * <code>null</code> if this CRL entry does not have
182+ * a Reason Code extension
183+ * @since 1.7
184+ */
185+ public CRLReason getRevocationReason() {
186+ if (!hasExtensions()) {
187+ return null;
188+ }
189+ return X509CRLEntryImpl.getRevocationReason(this);
190+ }
191+}
java/pkg/java/security/cert/X509CRLSelector.class+0−0

Binary file not shown.

java/pkg/java/security/cert/X509CRLSelector.java+714−0
@@ -0,0 +1,714 @@
1+/*
2+ * Copyright (c) 2000, 2009, Oracle and/or its affiliates. All rights reserved.
3+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
4+ *
5+ * This code is free software; you can redistribute it and/or modify it
6+ * under the terms of the GNU General Public License version 2 only, as
7+ * published by the Free Software Foundation. Oracle designates this
8+ * particular file as subject to the "Classpath" exception as provided
9+ * by Oracle in the LICENSE file that accompanied this code.
10+ *
11+ * This code is distributed in the hope that it will be useful, but WITHOUT
12+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
13+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
14+ * version 2 for more details (a copy is included in the LICENSE file that
15+ * accompanied this code).
16+ *
17+ * You should have received a copy of the GNU General Public License version
18+ * 2 along with this work; if not, write to the Free Software Foundation,
19+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
20+ *
21+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
22+ * or visit www.oracle.com if you need additional information or have any
23+ * questions.
24+ */
25+
26+package java.security.cert;
27+
28+import java.io.IOException;
29+import java.math.BigInteger;
30+import java.util.*;
31+
32+import javax.security.auth.x500.X500Principal;
33+
34+import sun.security.util.Debug;
35+import sun.security.util.DerInputStream;
36+import sun.security.x509.CRLNumberExtension;
37+import sun.security.x509.X500Name;
38+
39+/**
40+ * A <code>CRLSelector</code> that selects <code>X509CRLs</code> that
41+ * match all specified criteria. This class is particularly useful when
42+ * selecting CRLs from a <code>CertStore</code> to check revocation status
43+ * of a particular certificate.
44+ * <p>
45+ * When first constructed, an <code>X509CRLSelector</code> has no criteria
46+ * enabled and each of the <code>get</code> methods return a default
47+ * value (<code>null</code>). Therefore, the {@link #match match} method
48+ * would return <code>true</code> for any <code>X509CRL</code>. Typically,
49+ * several criteria are enabled (by calling {@link #setIssuers setIssuers}
50+ * or {@link #setDateAndTime setDateAndTime}, for instance) and then the
51+ * <code>X509CRLSelector</code> is passed to
52+ * {@link CertStore#getCRLs CertStore.getCRLs} or some similar
53+ * method.
54+ * <p>
55+ * Please refer to <a href="http://www.ietf.org/rfc/rfc3280.txt">RFC 3280:
56+ * Internet X.509 Public Key Infrastructure Certificate and CRL Profile</a>
57+ * for definitions of the X.509 CRL fields and extensions mentioned below.
58+ * <p>
59+ * <b>Concurrent Access</b>
60+ * <p>
61+ * Unless otherwise specified, the methods defined in this class are not
62+ * thread-safe. Multiple threads that need to access a single
63+ * object concurrently should synchronize amongst themselves and
64+ * provide the necessary locking. Multiple threads each manipulating
65+ * separate objects need not synchronize.
66+ *
67+ * @see CRLSelector
68+ * @see X509CRL
69+ *
70+ * @since 1.4
71+ * @author Steve Hanna
72+ */
73+public class X509CRLSelector implements CRLSelector {
74+
75+ static {
76+ CertPathHelperImpl.initialize();
77+ }
78+
79+ private static final Debug debug = Debug.getInstance("certpath");
80+ private HashSet<Object> issuerNames;
81+ private HashSet<X500Principal> issuerX500Principals;
82+ private BigInteger minCRL;
83+ private BigInteger maxCRL;
84+ private Date dateAndTime;
85+ private X509Certificate certChecking;
86+ private long skew = 0;
87+
88+ /**
89+ * Creates an <code>X509CRLSelector</code>. Initially, no criteria are set
90+ * so any <code>X509CRL</code> will match.
91+ */
92+ public X509CRLSelector() {}
93+
94+ /**
95+ * Sets the issuerNames criterion. The issuer distinguished name in the
96+ * <code>X509CRL</code> must match at least one of the specified
97+ * distinguished names. If <code>null</code>, any issuer distinguished name
98+ * will do.
99+ * <p>
100+ * This method allows the caller to specify, with a single method call,
101+ * the complete set of issuer names which <code>X509CRLs</code> may contain.
102+ * The specified value replaces the previous value for the issuerNames
103+ * criterion.
104+ * <p>
105+ * The <code>names</code> parameter (if not <code>null</code>) is a
106+ * <code>Collection</code> of <code>X500Principal</code>s.
107+ * <p>
108+ * Note that the <code>names</code> parameter can contain duplicate
109+ * distinguished names, but they may be removed from the
110+ * <code>Collection</code> of names returned by the
111+ * {@link #getIssuers getIssuers} method.
112+ * <p>
113+ * Note that a copy is performed on the <code>Collection</code> to
114+ * protect against subsequent modifications.
115+ *
116+ * @param issuers a <code>Collection</code> of X500Principals
117+ * (or <code>null</code>)
118+ * @see #getIssuers
119+ * @since 1.5
120+ */
121+ public void setIssuers(Collection<X500Principal> issuers) {
122+ if ((issuers == null) || issuers.isEmpty()) {
123+ issuerNames = null;
124+ issuerX500Principals = null;
125+ } else {
126+ // clone
127+ issuerX500Principals = new HashSet<X500Principal>(issuers);
128+ issuerNames = new HashSet<Object>();
129+ for (X500Principal p : issuerX500Principals) {
130+ issuerNames.add(p.getEncoded());
131+ }
132+ }
133+ }
134+
135+ /**
136+ * <strong>Note:</strong> use {@linkplain #setIssuers(Collection)} instead
137+ * or only specify the byte array form of distinguished names when using
138+ * this method. See {@link #addIssuerName(String)} for more information.
139+ * <p>
140+ * Sets the issuerNames criterion. The issuer distinguished name in the
141+ * <code>X509CRL</code> must match at least one of the specified
142+ * distinguished names. If <code>null</code>, any issuer distinguished name
143+ * will do.
144+ * <p>
145+ * This method allows the caller to specify, with a single method call,
146+ * the complete set of issuer names which <code>X509CRLs</code> may contain.
147+ * The specified value replaces the previous value for the issuerNames
148+ * criterion.
149+ * <p>
150+ * The <code>names</code> parameter (if not <code>null</code>) is a
151+ * <code>Collection</code> of names. Each name is a <code>String</code>
152+ * or a byte array representing a distinguished name (in
153+ * <a href="http://www.ietf.org/rfc/rfc2253.txt">RFC 2253</a> or
154+ * ASN.1 DER encoded form, respectively). If <code>null</code> is supplied
155+ * as the value for this argument, no issuerNames check will be performed.
156+ * <p>
157+ * Note that the <code>names</code> parameter can contain duplicate
158+ * distinguished names, but they may be removed from the
159+ * <code>Collection</code> of names returned by the
160+ * {@link #getIssuerNames getIssuerNames} method.
161+ * <p>
162+ * If a name is specified as a byte array, it should contain a single DER
163+ * encoded distinguished name, as defined in X.501. The ASN.1 notation for
164+ * this structure is as follows.
165+ * <pre><code>
166+ * Name ::= CHOICE {
167+ * RDNSequence }
168+ *
169+ * RDNSequence ::= SEQUENCE OF RelativeDistinguishedName
170+ *
171+ * RelativeDistinguishedName ::=
172+ * SET SIZE (1 .. MAX) OF AttributeTypeAndValue
173+ *
174+ * AttributeTypeAndValue ::= SEQUENCE {
175+ * type AttributeType,
176+ * value AttributeValue }
177+ *
178+ * AttributeType ::= OBJECT IDENTIFIER
179+ *
180+ * AttributeValue ::= ANY DEFINED BY AttributeType
181+ * ....
182+ * DirectoryString ::= CHOICE {
183+ * teletexString TeletexString (SIZE (1..MAX)),
184+ * printableString PrintableString (SIZE (1..MAX)),
185+ * universalString UniversalString (SIZE (1..MAX)),
186+ * utf8String UTF8String (SIZE (1.. MAX)),
187+ * bmpString BMPString (SIZE (1..MAX)) }
188+ * </code></pre>
189+ * <p>
190+ * Note that a deep copy is performed on the <code>Collection</code> to
191+ * protect against subsequent modifications.
192+ *
193+ * @param names a <code>Collection</code> of names (or <code>null</code>)
194+ * @throws IOException if a parsing error occurs
195+ * @see #getIssuerNames
196+ */
197+ public void setIssuerNames(Collection<?> names) throws IOException {
198+ if (names == null || names.size() == 0) {
199+ issuerNames = null;
200+ issuerX500Principals = null;
201+ } else {
202+ HashSet<Object> tempNames = cloneAndCheckIssuerNames(names);
203+ // Ensure that we either set both of these or neither
204+ issuerX500Principals = parseIssuerNames(tempNames);
205+ issuerNames = tempNames;
206+ }
207+ }
208+
209+ /**
210+ * Adds a name to the issuerNames criterion. The issuer distinguished
211+ * name in the <code>X509CRL</code> must match at least one of the specified
212+ * distinguished names.
213+ * <p>
214+ * This method allows the caller to add a name to the set of issuer names
215+ * which <code>X509CRLs</code> may contain. The specified name is added to
216+ * any previous value for the issuerNames criterion.
217+ * If the specified name is a duplicate, it may be ignored.
218+ *
219+ * @param issuer the issuer as X500Principal
220+ * @since 1.5
221+ */
222+ public void addIssuer(X500Principal issuer) {
223+ addIssuerNameInternal(issuer.getEncoded(), issuer);
224+ }
225+
226+ /**
227+ * <strong>Denigrated</strong>, use
228+ * {@linkplain #addIssuer(X500Principal)} or
229+ * {@linkplain #addIssuerName(byte[])} instead. This method should not be
230+ * relied on as it can fail to match some CRLs because of a loss of
231+ * encoding information in the RFC 2253 String form of some distinguished
232+ * names.
233+ * <p>
234+ * Adds a name to the issuerNames criterion. The issuer distinguished
235+ * name in the <code>X509CRL</code> must match at least one of the specified
236+ * distinguished names.
237+ * <p>
238+ * This method allows the caller to add a name to the set of issuer names
239+ * which <code>X509CRLs</code> may contain. The specified name is added to
240+ * any previous value for the issuerNames criterion.
241+ * If the specified name is a duplicate, it may be ignored.
242+ *
243+ * @param name the name in RFC 2253 form
244+ * @throws IOException if a parsing error occurs
245+ */
246+ public void addIssuerName(String name) throws IOException {
247+ addIssuerNameInternal(name, new X500Name(name).asX500Principal());
248+ }
249+
250+ /**
251+ * Adds a name to the issuerNames criterion. The issuer distinguished
252+ * name in the <code>X509CRL</code> must match at least one of the specified
253+ * distinguished names.
254+ * <p>
255+ * This method allows the caller to add a name to the set of issuer names
256+ * which <code>X509CRLs</code> may contain. The specified name is added to
257+ * any previous value for the issuerNames criterion. If the specified name
258+ * is a duplicate, it may be ignored.
259+ * If a name is specified as a byte array, it should contain a single DER
260+ * encoded distinguished name, as defined in X.501. The ASN.1 notation for
261+ * this structure is as follows.
262+ * <p>
263+ * The name is provided as a byte array. This byte array should contain
264+ * a single DER encoded distinguished name, as defined in X.501. The ASN.1
265+ * notation for this structure appears in the documentation for
266+ * {@link #setIssuerNames setIssuerNames(Collection names)}.
267+ * <p>
268+ * Note that the byte array supplied here is cloned to protect against
269+ * subsequent modifications.
270+ *
271+ * @param name a byte array containing the name in ASN.1 DER encoded form
272+ * @throws IOException if a parsing error occurs
273+ */
274+ public void addIssuerName(byte[] name) throws IOException {
275+ // clone because byte arrays are modifiable
276+ addIssuerNameInternal(name.clone(), new X500Name(name).asX500Principal());
277+ }
278+
279+ /**
280+ * A private method that adds a name (String or byte array) to the
281+ * issuerNames criterion. The issuer distinguished
282+ * name in the <code>X509CRL</code> must match at least one of the specified
283+ * distinguished names.
284+ *
285+ * @param name the name in string or byte array form
286+ * @param principal the name in X500Principal form
287+ * @throws IOException if a parsing error occurs
288+ */
289+ private void addIssuerNameInternal(Object name, X500Principal principal) {
290+ if (issuerNames == null) {
291+ issuerNames = new HashSet<Object>();
292+ }
293+ if (issuerX500Principals == null) {
294+ issuerX500Principals = new HashSet<X500Principal>();
295+ }
296+ issuerNames.add(name);
297+ issuerX500Principals.add(principal);
298+ }
299+
300+ /**
301+ * Clone and check an argument of the form passed to
302+ * setIssuerNames. Throw an IOException if the argument is malformed.
303+ *
304+ * @param names a <code>Collection</code> of names. Each entry is a
305+ * String or a byte array (the name, in string or ASN.1
306+ * DER encoded form, respectively). <code>null</code> is
307+ * not an acceptable value.
308+ * @return a deep copy of the specified <code>Collection</code>
309+ * @throws IOException if a parsing error occurs
310+ */
311+ private static HashSet<Object> cloneAndCheckIssuerNames(Collection<?> names)
312+ throws IOException
313+ {
314+ HashSet<Object> namesCopy = new HashSet<Object>();
315+ Iterator<?> i = names.iterator();
316+ while (i.hasNext()) {
317+ Object nameObject = i.next();
318+ if (!(nameObject instanceof byte []) &&
319+ !(nameObject instanceof String))
320+ throw new IOException("name not byte array or String");
321+ if (nameObject instanceof byte [])
322+ namesCopy.add(((byte []) nameObject).clone());
323+ else
324+ namesCopy.add(nameObject);
325+ }
326+ return(namesCopy);
327+ }
328+
329+ /**
330+ * Clone an argument of the form passed to setIssuerNames.
331+ * Throw a RuntimeException if the argument is malformed.
332+ * <p>
333+ * This method wraps cloneAndCheckIssuerNames, changing any IOException
334+ * into a RuntimeException. This method should be used when the object being
335+ * cloned has already been checked, so there should never be any exceptions.
336+ *
337+ * @param names a <code>Collection</code> of names. Each entry is a
338+ * String or a byte array (the name, in string or ASN.1
339+ * DER encoded form, respectively). <code>null</code> is
340+ * not an acceptable value.
341+ * @return a deep copy of the specified <code>Collection</code>
342+ * @throws RuntimeException if a parsing error occurs
343+ */
344+ private static HashSet<Object> cloneIssuerNames(Collection<Object> names) {
345+ try {
346+ return cloneAndCheckIssuerNames(names);
347+ } catch (IOException ioe) {
348+ throw new RuntimeException(ioe);
349+ }
350+ }
351+
352+ /**
353+ * Parse an argument of the form passed to setIssuerNames,
354+ * returning a Collection of issuerX500Principals.
355+ * Throw an IOException if the argument is malformed.
356+ *
357+ * @param names a <code>Collection</code> of names. Each entry is a
358+ * String or a byte array (the name, in string or ASN.1
359+ * DER encoded form, respectively). <Code>Null</Code> is
360+ * not an acceptable value.
361+ * @return a HashSet of issuerX500Principals
362+ * @throws IOException if a parsing error occurs
363+ */
364+ private static HashSet<X500Principal> parseIssuerNames(Collection<Object> names)
365+ throws IOException {
366+ HashSet<X500Principal> x500Principals = new HashSet<X500Principal>();
367+ for (Iterator<Object> t = names.iterator(); t.hasNext(); ) {
368+ Object nameObject = t.next();
369+ if (nameObject instanceof String) {
370+ x500Principals.add(new X500Name((String)nameObject).asX500Principal());
371+ } else {
372+ try {
373+ x500Principals.add(new X500Principal((byte[])nameObject));
374+ } catch (IllegalArgumentException e) {
375+ throw (IOException)new IOException("Invalid name").initCause(e);
376+ }
377+ }
378+ }
379+ return x500Principals;
380+ }
381+
382+ /**
383+ * Sets the minCRLNumber criterion. The <code>X509CRL</code> must have a
384+ * CRL number extension whose value is greater than or equal to the
385+ * specified value. If <code>null</code>, no minCRLNumber check will be
386+ * done.
387+ *
388+ * @param minCRL the minimum CRL number accepted (or <code>null</code>)
389+ */
390+ public void setMinCRLNumber(BigInteger minCRL) {
391+ this.minCRL = minCRL;
392+ }
393+
394+ /**
395+ * Sets the maxCRLNumber criterion. The <code>X509CRL</code> must have a
396+ * CRL number extension whose value is less than or equal to the
397+ * specified value. If <code>null</code>, no maxCRLNumber check will be
398+ * done.
399+ *
400+ * @param maxCRL the maximum CRL number accepted (or <code>null</code>)
401+ */
402+ public void setMaxCRLNumber(BigInteger maxCRL) {
403+ this.maxCRL = maxCRL;
404+ }
405+
406+ /**
407+ * Sets the dateAndTime criterion. The specified date must be
408+ * equal to or later than the value of the thisUpdate component
409+ * of the <code>X509CRL</code> and earlier than the value of the
410+ * nextUpdate component. There is no match if the <code>X509CRL</code>
411+ * does not contain a nextUpdate component.
412+ * If <code>null</code>, no dateAndTime check will be done.
413+ * <p>
414+ * Note that the <code>Date</code> supplied here is cloned to protect
415+ * against subsequent modifications.
416+ *
417+ * @param dateAndTime the <code>Date</code> to match against
418+ * (or <code>null</code>)
419+ * @see #getDateAndTime
420+ */
421+ public void setDateAndTime(Date dateAndTime) {
422+ if (dateAndTime == null)
423+ this.dateAndTime = null;
424+ else
425+ this.dateAndTime = new Date(dateAndTime.getTime());
426+ this.skew = 0;
427+ }
428+
429+ /**
430+ * Sets the dateAndTime criterion and allows for the specified clock skew
431+ * (in milliseconds) when checking against the validity period of the CRL.
432+ */
433+ void setDateAndTime(Date dateAndTime, long skew) {
434+ this.dateAndTime =
435+ (dateAndTime == null ? null : new Date(dateAndTime.getTime()));
436+ this.skew = skew;
437+ }
438+
439+ /**
440+ * Sets the certificate being checked. This is not a criterion. Rather,
441+ * it is optional information that may help a <code>CertStore</code>
442+ * find CRLs that would be relevant when checking revocation for the
443+ * specified certificate. If <code>null</code> is specified, then no
444+ * such optional information is provided.
445+ *
446+ * @param cert the <code>X509Certificate</code> being checked
447+ * (or <code>null</code>)
448+ * @see #getCertificateChecking
449+ */
450+ public void setCertificateChecking(X509Certificate cert) {
451+ certChecking = cert;
452+ }
453+
454+ /**
455+ * Returns the issuerNames criterion. The issuer distinguished
456+ * name in the <code>X509CRL</code> must match at least one of the specified
457+ * distinguished names. If the value returned is <code>null</code>, any
458+ * issuer distinguished name will do.
459+ * <p>
460+ * If the value returned is not <code>null</code>, it is a
461+ * unmodifiable <code>Collection</code> of <code>X500Principal</code>s.
462+ *
463+ * @return an unmodifiable <code>Collection</code> of names
464+ * (or <code>null</code>)
465+ * @see #setIssuers
466+ * @since 1.5
467+ */
468+ public Collection<X500Principal> getIssuers() {
469+ if (issuerX500Principals == null) {
470+ return null;
471+ }
472+ return Collections.unmodifiableCollection(issuerX500Principals);
473+ }
474+
475+ /**
476+ * Returns a copy of the issuerNames criterion. The issuer distinguished
477+ * name in the <code>X509CRL</code> must match at least one of the specified
478+ * distinguished names. If the value returned is <code>null</code>, any
479+ * issuer distinguished name will do.
480+ * <p>
481+ * If the value returned is not <code>null</code>, it is a
482+ * <code>Collection</code> of names. Each name is a <code>String</code>
483+ * or a byte array representing a distinguished name (in RFC 2253 or
484+ * ASN.1 DER encoded form, respectively). Note that the
485+ * <code>Collection</code> returned may contain duplicate names.
486+ * <p>
487+ * If a name is specified as a byte array, it should contain a single DER
488+ * encoded distinguished name, as defined in X.501. The ASN.1 notation for
489+ * this structure is given in the documentation for
490+ * {@link #setIssuerNames setIssuerNames(Collection names)}.
491+ * <p>
492+ * Note that a deep copy is performed on the <code>Collection</code> to
493+ * protect against subsequent modifications.
494+ *
495+ * @return a <code>Collection</code> of names (or <code>null</code>)
496+ * @see #setIssuerNames
497+ */
498+ public Collection<Object> getIssuerNames() {
499+ if (issuerNames == null) {
500+ return null;
501+ }
502+ return cloneIssuerNames(issuerNames);
503+ }
504+
505+ /**
506+ * Returns the minCRLNumber criterion. The <code>X509CRL</code> must have a
507+ * CRL number extension whose value is greater than or equal to the
508+ * specified value. If <code>null</code>, no minCRLNumber check will be done.
509+ *
510+ * @return the minimum CRL number accepted (or <code>null</code>)
511+ */
512+ public BigInteger getMinCRL() {
513+ return minCRL;
514+ }
515+
516+ /**
517+ * Returns the maxCRLNumber criterion. The <code>X509CRL</code> must have a
518+ * CRL number extension whose value is less than or equal to the
519+ * specified value. If <code>null</code>, no maxCRLNumber check will be
520+ * done.
521+ *
522+ * @return the maximum CRL number accepted (or <code>null</code>)
523+ */
524+ public BigInteger getMaxCRL() {
525+ return maxCRL;
526+ }
527+
528+ /**
529+ * Returns the dateAndTime criterion. The specified date must be
530+ * equal to or later than the value of the thisUpdate component
531+ * of the <code>X509CRL</code> and earlier than the value of the
532+ * nextUpdate component. There is no match if the
533+ * <code>X509CRL</code> does not contain a nextUpdate component.
534+ * If <code>null</code>, no dateAndTime check will be done.
535+ * <p>
536+ * Note that the <code>Date</code> returned is cloned to protect against
537+ * subsequent modifications.
538+ *
539+ * @return the <code>Date</code> to match against (or <code>null</code>)
540+ * @see #setDateAndTime
541+ */
542+ public Date getDateAndTime() {
543+ if (dateAndTime == null)
544+ return null;
545+ return (Date) dateAndTime.clone();
546+ }
547+
548+ /**
549+ * Returns the certificate being checked. This is not a criterion. Rather,
550+ * it is optional information that may help a <code>CertStore</code>
551+ * find CRLs that would be relevant when checking revocation for the
552+ * specified certificate. If the value returned is <code>null</code>, then
553+ * no such optional information is provided.
554+ *
555+ * @return the certificate being checked (or <code>null</code>)
556+ * @see #setCertificateChecking
557+ */
558+ public X509Certificate getCertificateChecking() {
559+ return certChecking;
560+ }
561+
562+ /**
563+ * Returns a printable representation of the <code>X509CRLSelector</code>.
564+ *
565+ * @return a <code>String</code> describing the contents of the
566+ * <code>X509CRLSelector</code>.
567+ */
568+ public String toString() {
569+ StringBuffer sb = new StringBuffer();
570+ sb.append("X509CRLSelector: [\n");
571+ if (issuerNames != null) {
572+ sb.append(" IssuerNames:\n");
573+ Iterator<Object> i = issuerNames.iterator();
574+ while (i.hasNext())
575+ sb.append(" " + i.next() + "\n");
576+ }
577+ if (minCRL != null)
578+ sb.append(" minCRLNumber: " + minCRL + "\n");
579+ if (maxCRL != null)
580+ sb.append(" maxCRLNumber: " + maxCRL + "\n");
581+ if (dateAndTime != null)
582+ sb.append(" dateAndTime: " + dateAndTime + "\n");
583+ if (certChecking != null)
584+ sb.append(" Certificate being checked: " + certChecking + "\n");
585+ sb.append("]");
586+ return sb.toString();
587+ }
588+
589+ /**
590+ * Decides whether a <code>CRL</code> should be selected.
591+ *
592+ * @param crl the <code>CRL</code> to be checked
593+ * @return <code>true</code> if the <code>CRL</code> should be selected,
594+ * <code>false</code> otherwise
595+ */
596+ public boolean match(CRL crl) {
597+ if (!(crl instanceof X509CRL)) {
598+ return false;
599+ }
600+ X509CRL xcrl = (X509CRL)crl;
601+
602+ /* match on issuer name */
603+ if (issuerNames != null) {
604+ X500Principal issuer = xcrl.getIssuerX500Principal();
605+ Iterator<X500Principal> i = issuerX500Principals.iterator();
606+ boolean found = false;
607+ while (!found && i.hasNext()) {
608+ if (i.next().equals(issuer)) {
609+ found = true;
610+ }
611+ }
612+ if (!found) {
613+ if (debug != null) {
614+ debug.println("X509CRLSelector.match: issuer DNs "
615+ + "don't match");
616+ }
617+ return false;
618+ }
619+ }
620+
621+ if ((minCRL != null) || (maxCRL != null)) {
622+ /* Get CRL number extension from CRL */
623+ byte[] crlNumExtVal = xcrl.getExtensionValue("2.5.29.20");
624+ if (crlNumExtVal == null) {
625+ if (debug != null) {
626+ debug.println("X509CRLSelector.match: no CRLNumber");
627+ }
628+ }
629+ BigInteger crlNum;
630+ try {
631+ DerInputStream in = new DerInputStream(crlNumExtVal);
632+ byte[] encoded = in.getOctetString();
633+ CRLNumberExtension crlNumExt =
634+ new CRLNumberExtension(Boolean.FALSE, encoded);
635+ crlNum = (BigInteger)crlNumExt.get(CRLNumberExtension.NUMBER);
636+ } catch (IOException ex) {
637+ if (debug != null) {
638+ debug.println("X509CRLSelector.match: exception in "
639+ + "decoding CRL number");
640+ }
641+ return false;
642+ }
643+
644+ /* match on minCRLNumber */
645+ if (minCRL != null) {
646+ if (crlNum.compareTo(minCRL) < 0) {
647+ if (debug != null) {
648+ debug.println("X509CRLSelector.match: CRLNumber too small");
649+ }
650+ return false;
651+ }
652+ }
653+
654+ /* match on maxCRLNumber */
655+ if (maxCRL != null) {
656+ if (crlNum.compareTo(maxCRL) > 0) {
657+ if (debug != null) {
658+ debug.println("X509CRLSelector.match: CRLNumber too large");
659+ }
660+ return false;
661+ }
662+ }
663+ }
664+
665+
666+ /* match on dateAndTime */
667+ if (dateAndTime != null) {
668+ Date crlThisUpdate = xcrl.getThisUpdate();
669+ Date nextUpdate = xcrl.getNextUpdate();
670+ if (nextUpdate == null) {
671+ if (debug != null) {
672+ debug.println("X509CRLSelector.match: nextUpdate null");
673+ }
674+ return false;
675+ }
676+ Date nowPlusSkew = dateAndTime;
677+ Date nowMinusSkew = dateAndTime;
678+ if (skew > 0) {
679+ nowPlusSkew = new Date(dateAndTime.getTime() + skew);
680+ nowMinusSkew = new Date(dateAndTime.getTime() - skew);
681+ }
682+ if (nowMinusSkew.after(nextUpdate)
683+ || nowPlusSkew.before(crlThisUpdate)) {
684+ if (debug != null) {
685+ debug.println("X509CRLSelector.match: update out of range");
686+ }
687+ return false;
688+ }
689+ }
690+
691+ return true;
692+ }
693+
694+ /**
695+ * Returns a copy of this object.
696+ *
697+ * @return the copy
698+ */
699+ public Object clone() {
700+ try {
701+ X509CRLSelector copy = (X509CRLSelector)super.clone();
702+ if (issuerNames != null) {
703+ copy.issuerNames =
704+ new HashSet<Object>(issuerNames);
705+ copy.issuerX500Principals =
706+ new HashSet<X500Principal>(issuerX500Principals);
707+ }
708+ return copy;
709+ } catch (CloneNotSupportedException e) {
710+ /* Cannot happen */
711+ throw new InternalError(e.toString());
712+ }
713+ }
714+}
java/pkg/java/security/cert/X509CertSelector.class+0−0

Binary file not shown.

java/pkg/java/security/cert/X509CertSelector.java+2638−0
@@ -0,0 +1,2638 @@
1+/*
2+ * Copyright (c) 2000, 2008, Oracle and/or its affiliates. All rights reserved.
3+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
4+ *
5+ * This code is free software; you can redistribute it and/or modify it
6+ * under the terms of the GNU General Public License version 2 only, as
7+ * published by the Free Software Foundation. Oracle designates this
8+ * particular file as subject to the "Classpath" exception as provided
9+ * by Oracle in the LICENSE file that accompanied this code.
10+ *
11+ * This code is distributed in the hope that it will be useful, but WITHOUT
12+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
13+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
14+ * version 2 for more details (a copy is included in the LICENSE file that
15+ * accompanied this code).
16+ *
17+ * You should have received a copy of the GNU General Public License version
18+ * 2 along with this work; if not, write to the Free Software Foundation,
19+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
20+ *
21+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
22+ * or visit www.oracle.com if you need additional information or have any
23+ * questions.
24+ */
25+
26+package java.security.cert;
27+
28+import java.io.IOException;
29+import java.math.BigInteger;
30+import java.security.PublicKey;
31+import java.util.*;
32+import javax.security.auth.x500.X500Principal;
33+
34+import sun.misc.HexDumpEncoder;
35+import sun.security.util.Debug;
36+import sun.security.util.DerInputStream;
37+import sun.security.util.DerValue;
38+import sun.security.util.ObjectIdentifier;
39+import sun.security.x509.*;
40+
41+/**
42+ * A <code>CertSelector</code> that selects <code>X509Certificates</code> that
43+ * match all specified criteria. This class is particularly useful when
44+ * selecting certificates from a <code>CertStore</code> to build a
45+ * PKIX-compliant certification path.
46+ * <p>
47+ * When first constructed, an <code>X509CertSelector</code> has no criteria
48+ * enabled and each of the <code>get</code> methods return a default value
49+ * (<code>null</code>, or <code>-1</code> for the {@link #getBasicConstraints
50+ * getBasicConstraints} method). Therefore, the {@link #match match}
51+ * method would return <code>true</code> for any <code>X509Certificate</code>.
52+ * Typically, several criteria are enabled (by calling
53+ * {@link #setIssuer setIssuer} or
54+ * {@link #setKeyUsage setKeyUsage}, for instance) and then the
55+ * <code>X509CertSelector</code> is passed to
56+ * {@link CertStore#getCertificates CertStore.getCertificates} or some similar
57+ * method.
58+ * <p>
59+ * Several criteria can be enabled (by calling {@link #setIssuer setIssuer}
60+ * and {@link #setSerialNumber setSerialNumber},
61+ * for example) such that the <code>match</code> method
62+ * usually uniquely matches a single <code>X509Certificate</code>. We say
63+ * usually, since it is possible for two issuing CAs to have the same
64+ * distinguished name and each issue a certificate with the same serial
65+ * number. Other unique combinations include the issuer, subject,
66+ * subjectKeyIdentifier and/or the subjectPublicKey criteria.
67+ * <p>
68+ * Please refer to <a href="http://www.ietf.org/rfc/rfc3280.txt">RFC 3280:
69+ * Internet X.509 Public Key Infrastructure Certificate and CRL Profile</a> for
70+ * definitions of the X.509 certificate extensions mentioned below.
71+ * <p>
72+ * <b>Concurrent Access</b>
73+ * <p>
74+ * Unless otherwise specified, the methods defined in this class are not
75+ * thread-safe. Multiple threads that need to access a single
76+ * object concurrently should synchronize amongst themselves and
77+ * provide the necessary locking. Multiple threads each manipulating
78+ * separate objects need not synchronize.
79+ *
80+ * @see CertSelector
81+ * @see X509Certificate
82+ *
83+ * @since 1.4
84+ * @author Steve Hanna
85+ */
86+public class X509CertSelector implements CertSelector {
87+
88+ private static final Debug debug = Debug.getInstance("certpath");
89+
90+ private final static ObjectIdentifier ANY_EXTENDED_KEY_USAGE =
91+ ObjectIdentifier.newInternal(new int[] {2, 5, 29, 37, 0});
92+
93+ static {
94+ CertPathHelperImpl.initialize();
95+ }
96+
97+ private BigInteger serialNumber;
98+ private X500Principal issuer;
99+ private X500Principal subject;
100+ private byte[] subjectKeyID;
101+ private byte[] authorityKeyID;
102+ private Date certificateValid;
103+ private Date privateKeyValid;
104+ private ObjectIdentifier subjectPublicKeyAlgID;
105+ private PublicKey subjectPublicKey;
106+ private byte[] subjectPublicKeyBytes;
107+ private boolean[] keyUsage;
108+ private Set<String> keyPurposeSet;
109+ private Set<ObjectIdentifier> keyPurposeOIDSet;
110+ private Set<List<?>> subjectAlternativeNames;
111+ private Set<GeneralNameInterface> subjectAlternativeGeneralNames;
112+ private CertificatePolicySet policy;
113+ private Set<String> policySet;
114+ private Set<List<?>> pathToNames;
115+ private Set<GeneralNameInterface> pathToGeneralNames;
116+ private NameConstraintsExtension nc;
117+ private byte[] ncBytes;
118+ private int basicConstraints = -1;
119+ private X509Certificate x509Cert;
120+ private boolean matchAllSubjectAltNames = true;
121+
122+ private static final Boolean FALSE = Boolean.FALSE;
123+
124+ private static final int PRIVATE_KEY_USAGE_ID = 0;
125+ private static final int SUBJECT_ALT_NAME_ID = 1;
126+ private static final int NAME_CONSTRAINTS_ID = 2;
127+ private static final int CERT_POLICIES_ID = 3;
128+ private static final int EXTENDED_KEY_USAGE_ID = 4;
129+ private static final int NUM_OF_EXTENSIONS = 5;
130+ private static final String[] EXTENSION_OIDS = new String[NUM_OF_EXTENSIONS];
131+
132+ static {
133+ EXTENSION_OIDS[PRIVATE_KEY_USAGE_ID] = "2.5.29.16";
134+ EXTENSION_OIDS[SUBJECT_ALT_NAME_ID] = "2.5.29.17";
135+ EXTENSION_OIDS[NAME_CONSTRAINTS_ID] = "2.5.29.30";
136+ EXTENSION_OIDS[CERT_POLICIES_ID] = "2.5.29.32";
137+ EXTENSION_OIDS[EXTENDED_KEY_USAGE_ID] = "2.5.29.37";
138+ };
139+
140+ /* Constants representing the GeneralName types */
141+ static final int NAME_ANY = 0;
142+ static final int NAME_RFC822 = 1;
143+ static final int NAME_DNS = 2;
144+ static final int NAME_X400 = 3;
145+ static final int NAME_DIRECTORY = 4;
146+ static final int NAME_EDI = 5;
147+ static final int NAME_URI = 6;
148+ static final int NAME_IP = 7;
149+ static final int NAME_OID = 8;
150+
151+ /**
152+ * Creates an <code>X509CertSelector</code>. Initially, no criteria are set
153+ * so any <code>X509Certificate</code> will match.
154+ */
155+ public X509CertSelector() {
156+ // empty
157+ }
158+
159+ /**
160+ * Sets the certificateEquals criterion. The specified
161+ * <code>X509Certificate</code> must be equal to the
162+ * <code>X509Certificate</code> passed to the <code>match</code> method.
163+ * If <code>null</code>, then this check is not applied.
164+ *
165+ * <p>This method is particularly useful when it is necessary to
166+ * match a single certificate. Although other criteria can be specified
167+ * in conjunction with the certificateEquals criterion, it is usually not
168+ * practical or necessary.
169+ *
170+ * @param cert the <code>X509Certificate</code> to match (or
171+ * <code>null</code>)
172+ * @see #getCertificate
173+ */
174+ public void setCertificate(X509Certificate cert) {
175+ x509Cert = cert;
176+ }
177+
178+ /**
179+ * Sets the serialNumber criterion. The specified serial number
180+ * must match the certificate serial number in the
181+ * <code>X509Certificate</code>. If <code>null</code>, any certificate
182+ * serial number will do.
183+ *
184+ * @param serial the certificate serial number to match
185+ * (or <code>null</code>)
186+ * @see #getSerialNumber
187+ */
188+ public void setSerialNumber(BigInteger serial) {
189+ serialNumber = serial;
190+ }
191+
192+ /**
193+ * Sets the issuer criterion. The specified distinguished name
194+ * must match the issuer distinguished name in the
195+ * <code>X509Certificate</code>. If <code>null</code>, any issuer
196+ * distinguished name will do.
197+ *
198+ * @param issuer a distinguished name as X500Principal
199+ * (or <code>null</code>)
200+ * @since 1.5
201+ */
202+ public void setIssuer(X500Principal issuer) {
203+ this.issuer = issuer;
204+ }
205+
206+ /**
207+ * <strong>Denigrated</strong>, use {@linkplain #setIssuer(X500Principal)}
208+ * or {@linkplain #setIssuer(byte[])} instead. This method should not be
209+ * relied on as it can fail to match some certificates because of a loss of
210+ * encoding information in the
211+ * <a href="http://www.ietf.org/rfc/rfc2253.txt">RFC 2253</a> String form
212+ * of some distinguished names.
213+ * <p>
214+ * Sets the issuer criterion. The specified distinguished name
215+ * must match the issuer distinguished name in the
216+ * <code>X509Certificate</code>. If <code>null</code>, any issuer
217+ * distinguished name will do.
218+ * <p>
219+ * If <code>issuerDN</code> is not <code>null</code>, it should contain a
220+ * distinguished name, in RFC 2253 format.
221+ *
222+ * @param issuerDN a distinguished name in RFC 2253 format
223+ * (or <code>null</code>)
224+ * @throws IOException if a parsing error occurs (incorrect form for DN)
225+ */
226+ public void setIssuer(String issuerDN) throws IOException {
227+ if (issuerDN == null) {
228+ issuer = null;
229+ } else {
230+ issuer = new X500Name(issuerDN).asX500Principal();
231+ }
232+ }
233+
234+ /**
235+ * Sets the issuer criterion. The specified distinguished name
236+ * must match the issuer distinguished name in the
237+ * <code>X509Certificate</code>. If <code>null</code> is specified,
238+ * the issuer criterion is disabled and any issuer distinguished name will
239+ * do.
240+ * <p>
241+ * If <code>issuerDN</code> is not <code>null</code>, it should contain a
242+ * single DER encoded distinguished name, as defined in X.501. The ASN.1
243+ * notation for this structure is as follows.
244+ * <pre><code>
245+ * Name ::= CHOICE {
246+ * RDNSequence }
247+ *
248+ * RDNSequence ::= SEQUENCE OF RelativeDistinguishedName
249+ *
250+ * RelativeDistinguishedName ::=
251+ * SET SIZE (1 .. MAX) OF AttributeTypeAndValue
252+ *
253+ * AttributeTypeAndValue ::= SEQUENCE {
254+ * type AttributeType,
255+ * value AttributeValue }
256+ *
257+ * AttributeType ::= OBJECT IDENTIFIER
258+ *
259+ * AttributeValue ::= ANY DEFINED BY AttributeType
260+ * ....
261+ * DirectoryString ::= CHOICE {
262+ * teletexString TeletexString (SIZE (1..MAX)),
263+ * printableString PrintableString (SIZE (1..MAX)),
264+ * universalString UniversalString (SIZE (1..MAX)),
265+ * utf8String UTF8String (SIZE (1.. MAX)),
266+ * bmpString BMPString (SIZE (1..MAX)) }
267+ * </code></pre>
268+ * <p>
269+ * Note that the byte array specified here is cloned to protect against
270+ * subsequent modifications.
271+ *
272+ * @param issuerDN a byte array containing the distinguished name
273+ * in ASN.1 DER encoded form (or <code>null</code>)
274+ * @throws IOException if an encoding error occurs (incorrect form for DN)
275+ */
276+ public void setIssuer(byte[] issuerDN) throws IOException {
277+ try {
278+ issuer = (issuerDN == null ? null : new X500Principal(issuerDN));
279+ } catch (IllegalArgumentException e) {
280+ throw (IOException)new IOException("Invalid name").initCause(e);
281+ }
282+ }
283+
284+ /**
285+ * Sets the subject criterion. The specified distinguished name
286+ * must match the subject distinguished name in the
287+ * <code>X509Certificate</code>. If <code>null</code>, any subject
288+ * distinguished name will do.
289+ *
290+ * @param subject a distinguished name as X500Principal
291+ * (or <code>null</code>)
292+ * @since 1.5
293+ */
294+ public void setSubject(X500Principal subject) {
295+ this.subject = subject;
296+ }
297+
298+ /**
299+ * <strong>Denigrated</strong>, use {@linkplain #setSubject(X500Principal)}
300+ * or {@linkplain #setSubject(byte[])} instead. This method should not be
301+ * relied on as it can fail to match some certificates because of a loss of
302+ * encoding information in the RFC 2253 String form of some distinguished
303+ * names.
304+ * <p>
305+ * Sets the subject criterion. The specified distinguished name
306+ * must match the subject distinguished name in the
307+ * <code>X509Certificate</code>. If <code>null</code>, any subject
308+ * distinguished name will do.
309+ * <p>
310+ * If <code>subjectDN</code> is not <code>null</code>, it should contain a
311+ * distinguished name, in RFC 2253 format.
312+ *
313+ * @param subjectDN a distinguished name in RFC 2253 format
314+ * (or <code>null</code>)
315+ * @throws IOException if a parsing error occurs (incorrect form for DN)
316+ */
317+ public void setSubject(String subjectDN) throws IOException {
318+ if (subjectDN == null) {
319+ subject = null;
320+ } else {
321+ subject = new X500Name(subjectDN).asX500Principal();
322+ }
323+ }
324+
325+ /**
326+ * Sets the subject criterion. The specified distinguished name
327+ * must match the subject distinguished name in the
328+ * <code>X509Certificate</code>. If <code>null</code>, any subject
329+ * distinguished name will do.
330+ * <p>
331+ * If <code>subjectDN</code> is not <code>null</code>, it should contain a
332+ * single DER encoded distinguished name, as defined in X.501. For the ASN.1
333+ * notation for this structure, see
334+ * {@link #setIssuer(byte [] issuerDN) setIssuer(byte [] issuerDN)}.
335+ *
336+ * @param subjectDN a byte array containing the distinguished name in
337+ * ASN.1 DER format (or <code>null</code>)
338+ * @throws IOException if an encoding error occurs (incorrect form for DN)
339+ */
340+ public void setSubject(byte[] subjectDN) throws IOException {
341+ try {
342+ subject = (subjectDN == null ? null : new X500Principal(subjectDN));
343+ } catch (IllegalArgumentException e) {
344+ throw (IOException)new IOException("Invalid name").initCause(e);
345+ }
346+ }
347+
348+ /**
349+ * Sets the subjectKeyIdentifier criterion. The
350+ * <code>X509Certificate</code> must contain a SubjectKeyIdentifier
351+ * extension for which the contents of the extension
352+ * matches the specified criterion value.
353+ * If the criterion value is <code>null</code>, no
354+ * subjectKeyIdentifier check will be done.
355+ * <p>
356+ * If <code>subjectKeyID</code> is not <code>null</code>, it
357+ * should contain a single DER encoded value corresponding to the contents
358+ * of the extension value (not including the object identifier,
359+ * criticality setting, and encapsulating OCTET STRING)
360+ * for a SubjectKeyIdentifier extension.
361+ * The ASN.1 notation for this structure follows.
362+ * <p>
363+ * <pre><code>
364+ * SubjectKeyIdentifier ::= KeyIdentifier
365+ *
366+ * KeyIdentifier ::= OCTET STRING
367+ * </code></pre>
368+ * <p>
369+ * Since the format of subject key identifiers is not mandated by
370+ * any standard, subject key identifiers are not parsed by the
371+ * <code>X509CertSelector</code>. Instead, the values are compared using
372+ * a byte-by-byte comparison.
373+ * <p>
374+ * Note that the byte array supplied here is cloned to protect against
375+ * subsequent modifications.
376+ *
377+ * @param subjectKeyID the subject key identifier (or <code>null</code>)
378+ * @see #getSubjectKeyIdentifier
379+ */
380+ public void setSubjectKeyIdentifier(byte[] subjectKeyID) {
381+ if (subjectKeyID == null) {
382+ this.subjectKeyID = null;
383+ } else {
384+ this.subjectKeyID = subjectKeyID.clone();
385+ }
386+ }
387+
388+ /**
389+ * Sets the authorityKeyIdentifier criterion. The
390+ * <code>X509Certificate</code> must contain an
391+ * AuthorityKeyIdentifier extension for which the contents of the
392+ * extension value matches the specified criterion value.
393+ * If the criterion value is <code>null</code>, no
394+ * authorityKeyIdentifier check will be done.
395+ * <p>
396+ * If <code>authorityKeyID</code> is not <code>null</code>, it
397+ * should contain a single DER encoded value corresponding to the contents
398+ * of the extension value (not including the object identifier,
399+ * criticality setting, and encapsulating OCTET STRING)
400+ * for an AuthorityKeyIdentifier extension.
401+ * The ASN.1 notation for this structure follows.
402+ * <p>
403+ * <pre><code>
404+ * AuthorityKeyIdentifier ::= SEQUENCE {
405+ * keyIdentifier [0] KeyIdentifier OPTIONAL,
406+ * authorityCertIssuer [1] GeneralNames OPTIONAL,
407+ * authorityCertSerialNumber [2] CertificateSerialNumber OPTIONAL }
408+ *
409+ * KeyIdentifier ::= OCTET STRING
410+ * </code></pre>
411+ * <p>
412+ * Authority key identifiers are not parsed by the
413+ * <code>X509CertSelector</code>. Instead, the values are
414+ * compared using a byte-by-byte comparison.
415+ * <p>
416+ * When the <code>keyIdentifier</code> field of
417+ * <code>AuthorityKeyIdentifier</code> is populated, the value is
418+ * usually taken from the <code>SubjectKeyIdentifier</code> extension
419+ * in the issuer's certificate. Note, however, that the result of
420+ * <code>X509Certificate.getExtensionValue(&lt;SubjectKeyIdentifier Object
421+ * Identifier&gt;)</code> on the issuer's certificate may NOT be used
422+ * directly as the input to <code>setAuthorityKeyIdentifier</code>.
423+ * This is because the SubjectKeyIdentifier contains
424+ * only a KeyIdentifier OCTET STRING, and not a SEQUENCE of
425+ * KeyIdentifier, GeneralNames, and CertificateSerialNumber.
426+ * In order to use the extension value of the issuer certificate's
427+ * <code>SubjectKeyIdentifier</code>
428+ * extension, it will be necessary to extract the value of the embedded
429+ * <code>KeyIdentifier</code> OCTET STRING, then DER encode this OCTET
430+ * STRING inside a SEQUENCE.
431+ * For more details on SubjectKeyIdentifier, see
432+ * {@link #setSubjectKeyIdentifier(byte[] subjectKeyID)}.
433+ * <p>
434+ * Note also that the byte array supplied here is cloned to protect against
435+ * subsequent modifications.
436+ *
437+ * @param authorityKeyID the authority key identifier
438+ * (or <code>null</code>)
439+ * @see #getAuthorityKeyIdentifier
440+ */
441+ public void setAuthorityKeyIdentifier(byte[] authorityKeyID) {
442+ if (authorityKeyID == null) {
443+ this.authorityKeyID = null;
444+ } else {
445+ this.authorityKeyID = authorityKeyID.clone();
446+ }
447+ }
448+
449+ /**
450+ * Sets the certificateValid criterion. The specified date must fall
451+ * within the certificate validity period for the
452+ * <code>X509Certificate</code>. If <code>null</code>, no certificateValid
453+ * check will be done.
454+ * <p>
455+ * Note that the <code>Date</code> supplied here is cloned to protect
456+ * against subsequent modifications.
457+ *
458+ * @param certValid the <code>Date</code> to check (or <code>null</code>)
459+ * @see #getCertificateValid
460+ */
461+ public void setCertificateValid(Date certValid) {
462+ if (certValid == null) {
463+ certificateValid = null;
464+ } else {
465+ certificateValid = (Date)certValid.clone();
466+ }
467+ }
468+
469+ /**
470+ * Sets the privateKeyValid criterion. The specified date must fall
471+ * within the private key validity period for the
472+ * <code>X509Certificate</code>. If <code>null</code>, no privateKeyValid
473+ * check will be done.
474+ * <p>
475+ * Note that the <code>Date</code> supplied here is cloned to protect
476+ * against subsequent modifications.
477+ *
478+ * @param privateKeyValid the <code>Date</code> to check (or
479+ * <code>null</code>)
480+ * @see #getPrivateKeyValid
481+ */
482+ public void setPrivateKeyValid(Date privateKeyValid) {
483+ if (privateKeyValid == null) {
484+ this.privateKeyValid = null;
485+ } else {
486+ this.privateKeyValid = (Date)privateKeyValid.clone();
487+ }
488+ }
489+
490+ /**
491+ * Sets the subjectPublicKeyAlgID criterion. The
492+ * <code>X509Certificate</code> must contain a subject public key
493+ * with the specified algorithm. If <code>null</code>, no
494+ * subjectPublicKeyAlgID check will be done.
495+ *
496+ * @param oid The object identifier (OID) of the algorithm to check
497+ * for (or <code>null</code>). An OID is represented by a
498+ * set of nonnegative integers separated by periods.
499+ * @throws IOException if the OID is invalid, such as
500+ * the first component being not 0, 1 or 2 or the second component
501+ * being greater than 39.
502+ *
503+ * @see #getSubjectPublicKeyAlgID
504+ */
505+ public void setSubjectPublicKeyAlgID(String oid) throws IOException {
506+ if (oid == null) {
507+ subjectPublicKeyAlgID = null;
508+ } else {
509+ subjectPublicKeyAlgID = new ObjectIdentifier(oid);
510+ }
511+ }
512+
513+ /**
514+ * Sets the subjectPublicKey criterion. The
515+ * <code>X509Certificate</code> must contain the specified subject public
516+ * key. If <code>null</code>, no subjectPublicKey check will be done.
517+ *
518+ * @param key the subject public key to check for (or <code>null</code>)
519+ * @see #getSubjectPublicKey
520+ */
521+ public void setSubjectPublicKey(PublicKey key) {
522+ if (key == null) {
523+ subjectPublicKey = null;
524+ subjectPublicKeyBytes = null;
525+ } else {
526+ subjectPublicKey = key;
527+ subjectPublicKeyBytes = key.getEncoded();
528+ }
529+ }
530+
531+ /**
532+ * Sets the subjectPublicKey criterion. The <code>X509Certificate</code>
533+ * must contain the specified subject public key. If <code>null</code>,
534+ * no subjectPublicKey check will be done.
535+ * <p>
536+ * Because this method allows the public key to be specified as a byte
537+ * array, it may be used for unknown key types.
538+ * <p>
539+ * If <code>key</code> is not <code>null</code>, it should contain a
540+ * single DER encoded SubjectPublicKeyInfo structure, as defined in X.509.
541+ * The ASN.1 notation for this structure is as follows.
542+ * <pre><code>
543+ * SubjectPublicKeyInfo ::= SEQUENCE {
544+ * algorithm AlgorithmIdentifier,
545+ * subjectPublicKey BIT STRING }
546+ *
547+ * AlgorithmIdentifier ::= SEQUENCE {
548+ * algorithm OBJECT IDENTIFIER,
549+ * parameters ANY DEFINED BY algorithm OPTIONAL }
550+ * -- contains a value of the type
551+ * -- registered for use with the
552+ * -- algorithm object identifier value
553+ * </code></pre>
554+ * <p>
555+ * Note that the byte array supplied here is cloned to protect against
556+ * subsequent modifications.
557+ *
558+ * @param key a byte array containing the subject public key in ASN.1 DER
559+ * form (or <code>null</code>)
560+ * @throws IOException if an encoding error occurs (incorrect form for
561+ * subject public key)
562+ * @see #getSubjectPublicKey
563+ */
564+ public void setSubjectPublicKey(byte[] key) throws IOException {
565+ if (key == null) {
566+ subjectPublicKey = null;
567+ subjectPublicKeyBytes = null;
568+ } else {
569+ subjectPublicKeyBytes = key.clone();
570+ subjectPublicKey = X509Key.parse(new DerValue(subjectPublicKeyBytes));
571+ }
572+ }
573+
574+ /**
575+ * Sets the keyUsage criterion. The <code>X509Certificate</code>
576+ * must allow the specified keyUsage values. If <code>null</code>, no
577+ * keyUsage check will be done. Note that an <code>X509Certificate</code>
578+ * that has no keyUsage extension implicitly allows all keyUsage values.
579+ * <p>
580+ * Note that the boolean array supplied here is cloned to protect against
581+ * subsequent modifications.
582+ *
583+ * @param keyUsage a boolean array in the same format as the boolean
584+ * array returned by
585+ * {@link X509Certificate#getKeyUsage() X509Certificate.getKeyUsage()}.
586+ * Or <code>null</code>.
587+ * @see #getKeyUsage
588+ */
589+ public void setKeyUsage(boolean[] keyUsage) {
590+ if (keyUsage == null) {
591+ this.keyUsage = null;
592+ } else {
593+ this.keyUsage = keyUsage.clone();
594+ }
595+ }
596+
597+ /**
598+ * Sets the extendedKeyUsage criterion. The <code>X509Certificate</code>
599+ * must allow the specified key purposes in its extended key usage
600+ * extension. If <code>keyPurposeSet</code> is empty or <code>null</code>,
601+ * no extendedKeyUsage check will be done. Note that an
602+ * <code>X509Certificate</code> that has no extendedKeyUsage extension
603+ * implicitly allows all key purposes.
604+ * <p>
605+ * Note that the <code>Set</code> is cloned to protect against
606+ * subsequent modifications.
607+ *
608+ * @param keyPurposeSet a <code>Set</code> of key purpose OIDs in string
609+ * format (or <code>null</code>). Each OID is represented by a set of
610+ * nonnegative integers separated by periods.
611+ * @throws IOException if the OID is invalid, such as
612+ * the first component being not 0, 1 or 2 or the second component
613+ * being greater than 39.
614+ * @see #getExtendedKeyUsage
615+ */
616+ public void setExtendedKeyUsage(Set<String> keyPurposeSet) throws IOException {
617+ if ((keyPurposeSet == null) || keyPurposeSet.isEmpty()) {
618+ this.keyPurposeSet = null;
619+ keyPurposeOIDSet = null;
620+ } else {
621+ this.keyPurposeSet =
622+ Collections.unmodifiableSet(new HashSet<String>(keyPurposeSet));
623+ keyPurposeOIDSet = new HashSet<ObjectIdentifier>();
624+ for (String s : this.keyPurposeSet) {
625+ keyPurposeOIDSet.add(new ObjectIdentifier(s));
626+ }
627+ }
628+ }
629+
630+ /**
631+ * Enables/disables matching all of the subjectAlternativeNames
632+ * specified in the {@link #setSubjectAlternativeNames
633+ * setSubjectAlternativeNames} or {@link #addSubjectAlternativeName
634+ * addSubjectAlternativeName} methods. If enabled,
635+ * the <code>X509Certificate</code> must contain all of the
636+ * specified subject alternative names. If disabled, the
637+ * <code>X509Certificate</code> must contain at least one of the
638+ * specified subject alternative names.
639+ *
640+ * <p>The matchAllNames flag is <code>true</code> by default.
641+ *
642+ * @param matchAllNames if <code>true</code>, the flag is enabled;
643+ * if <code>false</code>, the flag is disabled.
644+ * @see #getMatchAllSubjectAltNames
645+ */
646+ public void setMatchAllSubjectAltNames(boolean matchAllNames) {
647+ this.matchAllSubjectAltNames = matchAllNames;
648+ }
649+
650+ /**
651+ * Sets the subjectAlternativeNames criterion. The
652+ * <code>X509Certificate</code> must contain all or at least one of the
653+ * specified subjectAlternativeNames, depending on the value of
654+ * the matchAllNames flag (see {@link #setMatchAllSubjectAltNames
655+ * setMatchAllSubjectAltNames}).
656+ * <p>
657+ * This method allows the caller to specify, with a single method call,
658+ * the complete set of subject alternative names for the
659+ * subjectAlternativeNames criterion. The specified value replaces
660+ * the previous value for the subjectAlternativeNames criterion.
661+ * <p>
662+ * The <code>names</code> parameter (if not <code>null</code>) is a
663+ * <code>Collection</code> with one
664+ * entry for each name to be included in the subject alternative name
665+ * criterion. Each entry is a <code>List</code> whose first entry is an
666+ * <code>Integer</code> (the name type, 0-8) and whose second
667+ * entry is a <code>String</code> or a byte array (the name, in
668+ * string or ASN.1 DER encoded form, respectively).
669+ * There can be multiple names of the same type. If <code>null</code>
670+ * is supplied as the value for this argument, no
671+ * subjectAlternativeNames check will be performed.
672+ * <p>
673+ * Each subject alternative name in the <code>Collection</code>
674+ * may be specified either as a <code>String</code> or as an ASN.1 encoded
675+ * byte array. For more details about the formats used, see
676+ * {@link #addSubjectAlternativeName(int type, String name)
677+ * addSubjectAlternativeName(int type, String name)} and
678+ * {@link #addSubjectAlternativeName(int type, byte [] name)
679+ * addSubjectAlternativeName(int type, byte [] name)}.
680+ * <p>
681+ * <strong>Note:</strong> for distinguished names, specify the byte
682+ * array form instead of the String form. See the note in
683+ * {@link #addSubjectAlternativeName(int, String)} for more information.
684+ * <p>
685+ * Note that the <code>names</code> parameter can contain duplicate
686+ * names (same name and name type), but they may be removed from the
687+ * <code>Collection</code> of names returned by the
688+ * {@link #getSubjectAlternativeNames getSubjectAlternativeNames} method.
689+ * <p>
690+ * Note that a deep copy is performed on the <code>Collection</code> to
691+ * protect against subsequent modifications.
692+ *
693+ * @param names a <code>Collection</code> of names (or <code>null</code>)
694+ * @throws IOException if a parsing error occurs
695+ * @see #getSubjectAlternativeNames
696+ */
697+ public void setSubjectAlternativeNames(Collection<List<?>> names)
698+ throws IOException {
699+ if (names == null) {
700+ subjectAlternativeNames = null;
701+ subjectAlternativeGeneralNames = null;
702+ } else {
703+ if (names.isEmpty()) {
704+ subjectAlternativeNames = null;
705+ subjectAlternativeGeneralNames = null;
706+ return;
707+ }
708+ Set<List<?>> tempNames = cloneAndCheckNames(names);
709+ // Ensure that we either set both of these or neither
710+ subjectAlternativeGeneralNames = parseNames(tempNames);
711+ subjectAlternativeNames = tempNames;
712+ }
713+ }
714+
715+ /**
716+ * Adds a name to the subjectAlternativeNames criterion. The
717+ * <code>X509Certificate</code> must contain all or at least one
718+ * of the specified subjectAlternativeNames, depending on the value of
719+ * the matchAllNames flag (see {@link #setMatchAllSubjectAltNames
720+ * setMatchAllSubjectAltNames}).
721+ * <p>
722+ * This method allows the caller to add a name to the set of subject
723+ * alternative names.
724+ * The specified name is added to any previous value for the
725+ * subjectAlternativeNames criterion. If the specified name is a
726+ * duplicate, it may be ignored.
727+ * <p>
728+ * The name is provided in string format.
729+ * <a href="http://www.ietf.org/rfc/rfc822.txt">RFC 822</a>, DNS, and URI
730+ * names use the well-established string formats for those types (subject to
731+ * the restrictions included in RFC 3280). IPv4 address names are
732+ * supplied using dotted quad notation. OID address names are represented
733+ * as a series of nonnegative integers separated by periods. And
734+ * directory names (distinguished names) are supplied in RFC 2253 format.
735+ * No standard string format is defined for otherNames, X.400 names,
736+ * EDI party names, IPv6 address names, or any other type of names. They
737+ * should be specified using the
738+ * {@link #addSubjectAlternativeName(int type, byte [] name)
739+ * addSubjectAlternativeName(int type, byte [] name)}
740+ * method.
741+ * <p>
742+ * <strong>Note:</strong> for distinguished names, use
743+ * {@linkplain #addSubjectAlternativeName(int, byte[])} instead.
744+ * This method should not be relied on as it can fail to match some
745+ * certificates because of a loss of encoding information in the RFC 2253
746+ * String form of some distinguished names.
747+ *
748+ * @param type the name type (0-8, as specified in
749+ * RFC 3280, section 4.2.1.7)
750+ * @param name the name in string form (not <code>null</code>)
751+ * @throws IOException if a parsing error occurs
752+ */
753+ public void addSubjectAlternativeName(int type, String name)
754+ throws IOException {
755+ addSubjectAlternativeNameInternal(type, name);
756+ }
757+
758+ /**
759+ * Adds a name to the subjectAlternativeNames criterion. The
760+ * <code>X509Certificate</code> must contain all or at least one
761+ * of the specified subjectAlternativeNames, depending on the value of
762+ * the matchAllNames flag (see {@link #setMatchAllSubjectAltNames
763+ * setMatchAllSubjectAltNames}).
764+ * <p>
765+ * This method allows the caller to add a name to the set of subject
766+ * alternative names.
767+ * The specified name is added to any previous value for the
768+ * subjectAlternativeNames criterion. If the specified name is a
769+ * duplicate, it may be ignored.
770+ * <p>
771+ * The name is provided as a byte array. This byte array should contain
772+ * the DER encoded name, as it would appear in the GeneralName structure
773+ * defined in RFC 3280 and X.509. The encoded byte array should only contain
774+ * the encoded value of the name, and should not include the tag associated
775+ * with the name in the GeneralName structure. The ASN.1 definition of this
776+ * structure appears below.
777+ * <pre><code>
778+ * GeneralName ::= CHOICE {
779+ * otherName [0] OtherName,
780+ * rfc822Name [1] IA5String,
781+ * dNSName [2] IA5String,
782+ * x400Address [3] ORAddress,
783+ * directoryName [4] Name,
784+ * ediPartyName [5] EDIPartyName,
785+ * uniformResourceIdentifier [6] IA5String,
786+ * iPAddress [7] OCTET STRING,
787+ * registeredID [8] OBJECT IDENTIFIER}
788+ * </code></pre>
789+ * <p>
790+ * Note that the byte array supplied here is cloned to protect against
791+ * subsequent modifications.
792+ *
793+ * @param type the name type (0-8, as listed above)
794+ * @param name a byte array containing the name in ASN.1 DER encoded form
795+ * @throws IOException if a parsing error occurs
796+ */
797+ public void addSubjectAlternativeName(int type, byte[] name)
798+ throws IOException {
799+ // clone because byte arrays are modifiable
800+ addSubjectAlternativeNameInternal(type, name.clone());
801+ }
802+
803+ /**
804+ * A private method that adds a name (String or byte array) to the
805+ * subjectAlternativeNames criterion. The <code>X509Certificate</code>
806+ * must contain the specified subjectAlternativeName.
807+ *
808+ * @param type the name type (0-8, as specified in
809+ * RFC 3280, section 4.2.1.7)
810+ * @param name the name in string or byte array form
811+ * @throws IOException if a parsing error occurs
812+ */
813+ private void addSubjectAlternativeNameInternal(int type, Object name)
814+ throws IOException {
815+ // First, ensure that the name parses
816+ GeneralNameInterface tempName = makeGeneralNameInterface(type, name);
817+ if (subjectAlternativeNames == null) {
818+ subjectAlternativeNames = new HashSet<List<?>>();
819+ }
820+ if (subjectAlternativeGeneralNames == null) {
821+ subjectAlternativeGeneralNames = new HashSet<GeneralNameInterface>();
822+ }
823+ List<Object> list = new ArrayList<Object>(2);
824+ list.add(Integer.valueOf(type));
825+ list.add(name);
826+ subjectAlternativeNames.add(list);
827+ subjectAlternativeGeneralNames.add(tempName);
828+ }
829+
830+ /**
831+ * Parse an argument of the form passed to setSubjectAlternativeNames,
832+ * returning a <code>Collection</code> of
833+ * <code>GeneralNameInterface</code>s.
834+ * Throw an IllegalArgumentException or a ClassCastException
835+ * if the argument is malformed.
836+ *
837+ * @param names a Collection with one entry per name.
838+ * Each entry is a <code>List</code> whose first entry
839+ * is an Integer (the name type, 0-8) and whose second
840+ * entry is a String or a byte array (the name, in
841+ * string or ASN.1 DER encoded form, respectively).
842+ * There can be multiple names of the same type. Null is
843+ * not an acceptable value.
844+ * @return a Set of <code>GeneralNameInterface</code>s
845+ * @throws IOException if a parsing error occurs
846+ */
847+ private static Set<GeneralNameInterface> parseNames(Collection<List<?>> names) throws IOException {
848+ Set<GeneralNameInterface> genNames = new HashSet<GeneralNameInterface>();
849+ for (List<?> nameList : names) {
850+ if (nameList.size() != 2) {
851+ throw new IOException("name list size not 2");
852+ }
853+ Object o = nameList.get(0);
854+ if (!(o instanceof Integer)) {
855+ throw new IOException("expected an Integer");
856+ }
857+ int nameType = ((Integer)o).intValue();
858+ o = nameList.get(1);
859+ genNames.add(makeGeneralNameInterface(nameType, o));
860+ }
861+
862+ return genNames;
863+ }
864+
865+ /**
866+ * Compare for equality two objects of the form passed to
867+ * setSubjectAlternativeNames (or X509CRLSelector.setIssuerNames).
868+ * Throw an <code>IllegalArgumentException</code> or a
869+ * <code>ClassCastException</code> if one of the objects is malformed.
870+ *
871+ * @param object1 a Collection containing the first object to compare
872+ * @param object2 a Collection containing the second object to compare
873+ * @return true if the objects are equal, false otherwise
874+ */
875+ static boolean equalNames(Collection object1, Collection object2) {
876+ if ((object1 == null) || (object2 == null)) {
877+ return object1 == object2;
878+ }
879+ return object1.equals(object2);
880+ }
881+
882+ /**
883+ * Make a <code>GeneralNameInterface</code> out of a name type (0-8) and an
884+ * Object that may be a byte array holding the ASN.1 DER encoded
885+ * name or a String form of the name. Except for X.509
886+ * Distinguished Names, the String form of the name must not be the
887+ * result from calling toString on an existing GeneralNameInterface
888+ * implementing class. The output of toString is not compatible
889+ * with the String constructors for names other than Distinguished
890+ * Names.
891+ *
892+ * @param type name type (0-8)
893+ * @param name name as ASN.1 Der-encoded byte array or String
894+ * @return a GeneralNameInterface name
895+ * @throws IOException if a parsing error occurs
896+ */
897+ static GeneralNameInterface makeGeneralNameInterface(int type, Object name)
898+ throws IOException {
899+ GeneralNameInterface result;
900+ if (debug != null) {
901+ debug.println("X509CertSelector.makeGeneralNameInterface("
902+ + type + ")...");
903+ }
904+
905+ if (name instanceof String) {
906+ if (debug != null) {
907+ debug.println("X509CertSelector.makeGeneralNameInterface() "
908+ + "name is String: " + name);
909+ }
910+ switch (type) {
911+ case NAME_RFC822:
912+ result = new RFC822Name((String)name);
913+ break;
914+ case NAME_DNS:
915+ result = new DNSName((String)name);
916+ break;
917+ case NAME_DIRECTORY:
918+ result = new X500Name((String)name);
919+ break;
920+ case NAME_URI:
921+ result = new URIName((String)name);
922+ break;
923+ case NAME_IP:
924+ result = new IPAddressName((String)name);
925+ break;
926+ case NAME_OID:
927+ result = new OIDName((String)name);
928+ break;
929+ default:
930+ throw new IOException("unable to parse String names of type "
931+ + type);
932+ }
933+ if (debug != null) {
934+ debug.println("X509CertSelector.makeGeneralNameInterface() "
935+ + "result: " + result.toString());
936+ }
937+ } else if (name instanceof byte[]) {
938+ DerValue val = new DerValue((byte[]) name);
939+ if (debug != null) {
940+ debug.println
941+ ("X509CertSelector.makeGeneralNameInterface() is byte[]");
942+ }
943+
944+ switch (type) {
945+ case NAME_ANY:
946+ result = new OtherName(val);
947+ break;
948+ case NAME_RFC822:
949+ result = new RFC822Name(val);
950+ break;
951+ case NAME_DNS:
952+ result = new DNSName(val);
953+ break;
954+ case NAME_X400:
955+ result = new X400Address(val);
956+ break;
957+ case NAME_DIRECTORY:
958+ result = new X500Name(val);
959+ break;
960+ case NAME_EDI:
961+ result = new EDIPartyName(val);
962+ break;
963+ case NAME_URI:
964+ result = new URIName(val);
965+ break;
966+ case NAME_IP:
967+ result = new IPAddressName(val);
968+ break;
969+ case NAME_OID:
970+ result = new OIDName(val);
971+ break;
972+ default:
973+ throw new IOException("unable to parse byte array names of "
974+ + "type " + type);
975+ }
976+ if (debug != null) {
977+ debug.println("X509CertSelector.makeGeneralNameInterface() result: "
978+ + result.toString());
979+ }
980+ } else {
981+ if (debug != null) {
982+ debug.println("X509CertSelector.makeGeneralName() input name "
983+ + "not String or byte array");
984+ }
985+ throw new IOException("name not String or byte array");
986+ }
987+ return result;
988+ }
989+
990+
991+ /**
992+ * Sets the name constraints criterion. The <code>X509Certificate</code>
993+ * must have subject and subject alternative names that
994+ * meet the specified name constraints.
995+ * <p>
996+ * The name constraints are specified as a byte array. This byte array
997+ * should contain the DER encoded form of the name constraints, as they
998+ * would appear in the NameConstraints structure defined in RFC 3280
999+ * and X.509. The ASN.1 definition of this structure appears below.
1000+ *
1001+ * <pre><code>
1002+ * NameConstraints ::= SEQUENCE {
1003+ * permittedSubtrees [0] GeneralSubtrees OPTIONAL,
1004+ * excludedSubtrees [1] GeneralSubtrees OPTIONAL }
1005+ *
1006+ * GeneralSubtrees ::= SEQUENCE SIZE (1..MAX) OF GeneralSubtree
1007+ *
1008+ * GeneralSubtree ::= SEQUENCE {
1009+ * base GeneralName,
1010+ * minimum [0] BaseDistance DEFAULT 0,
1011+ * maximum [1] BaseDistance OPTIONAL }
1012+ *
1013+ * BaseDistance ::= INTEGER (0..MAX)
1014+ *
1015+ * GeneralName ::= CHOICE {
1016+ * otherName [0] OtherName,
1017+ * rfc822Name [1] IA5String,
1018+ * dNSName [2] IA5String,
1019+ * x400Address [3] ORAddress,
1020+ * directoryName [4] Name,
1021+ * ediPartyName [5] EDIPartyName,
1022+ * uniformResourceIdentifier [6] IA5String,
1023+ * iPAddress [7] OCTET STRING,
1024+ * registeredID [8] OBJECT IDENTIFIER}
1025+ * </code></pre>
1026+ * <p>
1027+ * Note that the byte array supplied here is cloned to protect against
1028+ * subsequent modifications.
1029+ *
1030+ * @param bytes a byte array containing the ASN.1 DER encoding of
1031+ * a NameConstraints extension to be used for checking
1032+ * name constraints. Only the value of the extension is
1033+ * included, not the OID or criticality flag. Can be
1034+ * <code>null</code>,
1035+ * in which case no name constraints check will be performed.
1036+ * @throws IOException if a parsing error occurs
1037+ * @see #getNameConstraints
1038+ */
1039+ public void setNameConstraints(byte[] bytes) throws IOException {
1040+ if (bytes == null) {
1041+ ncBytes = null;
1042+ nc = null;
1043+ } else {
1044+ ncBytes = bytes.clone();
1045+ nc = new NameConstraintsExtension(FALSE, bytes);
1046+ }
1047+ }
1048+
1049+ /**
1050+ * Sets the basic constraints constraint. If the value is greater than or
1051+ * equal to zero, <code>X509Certificates</code> must include a
1052+ * basicConstraints extension with
1053+ * a pathLen of at least this value. If the value is -2, only end-entity
1054+ * certificates are accepted. If the value is -1, no check is done.
1055+ * <p>
1056+ * This constraint is useful when building a certification path forward
1057+ * (from the target toward the trust anchor. If a partial path has been
1058+ * built, any candidate certificate must have a maxPathLen value greater
1059+ * than or equal to the number of certificates in the partial path.
1060+ *
1061+ * @param minMaxPathLen the value for the basic constraints constraint
1062+ * @throws IllegalArgumentException if the value is less than -2
1063+ * @see #getBasicConstraints
1064+ */
1065+ public void setBasicConstraints(int minMaxPathLen) {
1066+ if (minMaxPathLen < -2) {
1067+ throw new IllegalArgumentException("basic constraints less than -2");
1068+ }
1069+ basicConstraints = minMaxPathLen;
1070+ }
1071+
1072+ /**
1073+ * Sets the policy constraint. The <code>X509Certificate</code> must
1074+ * include at least one of the specified policies in its certificate
1075+ * policies extension. If <code>certPolicySet</code> is empty, then the
1076+ * <code>X509Certificate</code> must include at least some specified policy
1077+ * in its certificate policies extension. If <code>certPolicySet</code> is
1078+ * <code>null</code>, no policy check will be performed.
1079+ * <p>
1080+ * Note that the <code>Set</code> is cloned to protect against
1081+ * subsequent modifications.
1082+ *
1083+ * @param certPolicySet a <code>Set</code> of certificate policy OIDs in
1084+ * string format (or <code>null</code>). Each OID is
1085+ * represented by a set of nonnegative integers
1086+ * separated by periods.
1087+ * @throws IOException if a parsing error occurs on the OID such as
1088+ * the first component is not 0, 1 or 2 or the second component is
1089+ * greater than 39.
1090+ * @see #getPolicy
1091+ */
1092+ public void setPolicy(Set<String> certPolicySet) throws IOException {
1093+ if (certPolicySet == null) {
1094+ policySet = null;
1095+ policy = null;
1096+ } else {
1097+ // Snapshot set and parse it
1098+ Set<String> tempSet = Collections.unmodifiableSet
1099+ (new HashSet<String>(certPolicySet));
1100+ /* Convert to Vector of ObjectIdentifiers */
1101+ Iterator<String> i = tempSet.iterator();
1102+ Vector<CertificatePolicyId> polIdVector = new Vector<CertificatePolicyId>();
1103+ while (i.hasNext()) {
1104+ Object o = i.next();
1105+ if (!(o instanceof String)) {
1106+ throw new IOException("non String in certPolicySet");
1107+ }
1108+ polIdVector.add(new CertificatePolicyId(new ObjectIdentifier(
1109+ (String)o)));
1110+ }
1111+ // If everything went OK, make the changes
1112+ policySet = tempSet;
1113+ policy = new CertificatePolicySet(polIdVector);
1114+ }
1115+ }
1116+
1117+ /**
1118+ * Sets the pathToNames criterion. The <code>X509Certificate</code> must
1119+ * not include name constraints that would prohibit building a
1120+ * path to the specified names.
1121+ * <p>
1122+ * This method allows the caller to specify, with a single method call,
1123+ * the complete set of names which the <code>X509Certificates</code>'s
1124+ * name constraints must permit. The specified value replaces
1125+ * the previous value for the pathToNames criterion.
1126+ * <p>
1127+ * This constraint is useful when building a certification path forward
1128+ * (from the target toward the trust anchor. If a partial path has been
1129+ * built, any candidate certificate must not include name constraints that
1130+ * would prohibit building a path to any of the names in the partial path.
1131+ * <p>
1132+ * The <code>names</code> parameter (if not <code>null</code>) is a
1133+ * <code>Collection</code> with one
1134+ * entry for each name to be included in the pathToNames
1135+ * criterion. Each entry is a <code>List</code> whose first entry is an
1136+ * <code>Integer</code> (the name type, 0-8) and whose second
1137+ * entry is a <code>String</code> or a byte array (the name, in
1138+ * string or ASN.1 DER encoded form, respectively).
1139+ * There can be multiple names of the same type. If <code>null</code>
1140+ * is supplied as the value for this argument, no
1141+ * pathToNames check will be performed.
1142+ * <p>
1143+ * Each name in the <code>Collection</code>
1144+ * may be specified either as a <code>String</code> or as an ASN.1 encoded
1145+ * byte array. For more details about the formats used, see
1146+ * {@link #addPathToName(int type, String name)
1147+ * addPathToName(int type, String name)} and
1148+ * {@link #addPathToName(int type, byte [] name)
1149+ * addPathToName(int type, byte [] name)}.
1150+ * <p>
1151+ * <strong>Note:</strong> for distinguished names, specify the byte
1152+ * array form instead of the String form. See the note in
1153+ * {@link #addPathToName(int, String)} for more information.
1154+ * <p>
1155+ * Note that the <code>names</code> parameter can contain duplicate
1156+ * names (same name and name type), but they may be removed from the
1157+ * <code>Collection</code> of names returned by the
1158+ * {@link #getPathToNames getPathToNames} method.
1159+ * <p>
1160+ * Note that a deep copy is performed on the <code>Collection</code> to
1161+ * protect against subsequent modifications.
1162+ *
1163+ * @param names a <code>Collection</code> with one entry per name
1164+ * (or <code>null</code>)
1165+ * @throws IOException if a parsing error occurs
1166+ * @see #getPathToNames
1167+ */
1168+ public void setPathToNames(Collection<List<?>> names) throws IOException {
1169+ if ((names == null) || names.isEmpty()) {
1170+ pathToNames = null;
1171+ pathToGeneralNames = null;
1172+ } else {
1173+ Set<List<?>> tempNames = cloneAndCheckNames(names);
1174+ pathToGeneralNames = parseNames(tempNames);
1175+ // Ensure that we either set both of these or neither
1176+ pathToNames = tempNames;
1177+ }
1178+ }
1179+
1180+ // called from CertPathHelper
1181+ void setPathToNamesInternal(Set<GeneralNameInterface> names) {
1182+ // set names to non-null dummy value
1183+ // this breaks getPathToNames()
1184+ pathToNames = Collections.<List<?>>emptySet();
1185+ pathToGeneralNames = names;
1186+ }
1187+
1188+ /**
1189+ * Adds a name to the pathToNames criterion. The <code>X509Certificate</code>
1190+ * must not include name constraints that would prohibit building a
1191+ * path to the specified name.
1192+ * <p>
1193+ * This method allows the caller to add a name to the set of names which
1194+ * the <code>X509Certificates</code>'s name constraints must permit.
1195+ * The specified name is added to any previous value for the
1196+ * pathToNames criterion. If the name is a duplicate, it may be ignored.
1197+ * <p>
1198+ * The name is provided in string format. RFC 822, DNS, and URI names
1199+ * use the well-established string formats for those types (subject to
1200+ * the restrictions included in RFC 3280). IPv4 address names are
1201+ * supplied using dotted quad notation. OID address names are represented
1202+ * as a series of nonnegative integers separated by periods. And
1203+ * directory names (distinguished names) are supplied in RFC 2253 format.
1204+ * No standard string format is defined for otherNames, X.400 names,
1205+ * EDI party names, IPv6 address names, or any other type of names. They
1206+ * should be specified using the
1207+ * {@link #addPathToName(int type, byte [] name)
1208+ * addPathToName(int type, byte [] name)} method.
1209+ * <p>
1210+ * <strong>Note:</strong> for distinguished names, use
1211+ * {@linkplain #addPathToName(int, byte[])} instead.
1212+ * This method should not be relied on as it can fail to match some
1213+ * certificates because of a loss of encoding information in the RFC 2253
1214+ * String form of some distinguished names.
1215+ *
1216+ * @param type the name type (0-8, as specified in
1217+ * RFC 3280, section 4.2.1.7)
1218+ * @param name the name in string form
1219+ * @throws IOException if a parsing error occurs
1220+ */
1221+ public void addPathToName(int type, String name) throws IOException {
1222+ addPathToNameInternal(type, name);
1223+ }
1224+
1225+ /**
1226+ * Adds a name to the pathToNames criterion. The <code>X509Certificate</code>
1227+ * must not include name constraints that would prohibit building a
1228+ * path to the specified name.
1229+ * <p>
1230+ * This method allows the caller to add a name to the set of names which
1231+ * the <code>X509Certificates</code>'s name constraints must permit.
1232+ * The specified name is added to any previous value for the
1233+ * pathToNames criterion. If the name is a duplicate, it may be ignored.
1234+ * <p>
1235+ * The name is provided as a byte array. This byte array should contain
1236+ * the DER encoded name, as it would appear in the GeneralName structure
1237+ * defined in RFC 3280 and X.509. The ASN.1 definition of this structure
1238+ * appears in the documentation for
1239+ * {@link #addSubjectAlternativeName(int type, byte [] name)
1240+ * addSubjectAlternativeName(int type, byte [] name)}.
1241+ * <p>
1242+ * Note that the byte array supplied here is cloned to protect against
1243+ * subsequent modifications.
1244+ *
1245+ * @param type the name type (0-8, as specified in
1246+ * RFC 3280, section 4.2.1.7)
1247+ * @param name a byte array containing the name in ASN.1 DER encoded form
1248+ * @throws IOException if a parsing error occurs
1249+ */
1250+ public void addPathToName(int type, byte [] name) throws IOException {
1251+ // clone because byte arrays are modifiable
1252+ addPathToNameInternal(type, name.clone());
1253+ }
1254+
1255+ /**
1256+ * A private method that adds a name (String or byte array) to the
1257+ * pathToNames criterion. The <code>X509Certificate</code> must contain
1258+ * the specified pathToName.
1259+ *
1260+ * @param type the name type (0-8, as specified in
1261+ * RFC 3280, section 4.2.1.7)
1262+ * @param name the name in string or byte array form
1263+ * @throws IOException if an encoding error occurs (incorrect form for DN)
1264+ */
1265+ private void addPathToNameInternal(int type, Object name)
1266+ throws IOException {
1267+ // First, ensure that the name parses
1268+ GeneralNameInterface tempName = makeGeneralNameInterface(type, name);
1269+ if (pathToGeneralNames == null) {
1270+ pathToNames = new HashSet<List<?>>();
1271+ pathToGeneralNames = new HashSet<GeneralNameInterface>();
1272+ }
1273+ List<Object> list = new ArrayList<Object>(2);
1274+ list.add(Integer.valueOf(type));
1275+ list.add(name);
1276+ pathToNames.add(list);
1277+ pathToGeneralNames.add(tempName);
1278+ }
1279+
1280+ /**
1281+ * Returns the certificateEquals criterion. The specified
1282+ * <code>X509Certificate</code> must be equal to the
1283+ * <code>X509Certificate</code> passed to the <code>match</code> method.
1284+ * If <code>null</code>, this check is not applied.
1285+ *
1286+ * @return the <code>X509Certificate</code> to match (or <code>null</code>)
1287+ * @see #setCertificate
1288+ */
1289+ public X509Certificate getCertificate() {
1290+ return x509Cert;
1291+ }
1292+
1293+ /**
1294+ * Returns the serialNumber criterion. The specified serial number
1295+ * must match the certificate serial number in the
1296+ * <code>X509Certificate</code>. If <code>null</code>, any certificate
1297+ * serial number will do.
1298+ *
1299+ * @return the certificate serial number to match
1300+ * (or <code>null</code>)
1301+ * @see #setSerialNumber
1302+ */
1303+ public BigInteger getSerialNumber() {
1304+ return serialNumber;
1305+ }
1306+
1307+ /**
1308+ * Returns the issuer criterion as an <code>X500Principal</code>. This
1309+ * distinguished name must match the issuer distinguished name in the
1310+ * <code>X509Certificate</code>. If <code>null</code>, the issuer criterion
1311+ * is disabled and any issuer distinguished name will do.
1312+ *
1313+ * @return the required issuer distinguished name as X500Principal
1314+ * (or <code>null</code>)
1315+ * @since 1.5
1316+ */
1317+ public X500Principal getIssuer() {
1318+ return issuer;
1319+ }
1320+
1321+ /**
1322+ * <strong>Denigrated</strong>, use {@linkplain #getIssuer()} or
1323+ * {@linkplain #getIssuerAsBytes()} instead. This method should not be
1324+ * relied on as it can fail to match some certificates because of a loss of
1325+ * encoding information in the RFC 2253 String form of some distinguished
1326+ * names.
1327+ * <p>
1328+ * Returns the issuer criterion as a <code>String</code>. This
1329+ * distinguished name must match the issuer distinguished name in the
1330+ * <code>X509Certificate</code>. If <code>null</code>, the issuer criterion
1331+ * is disabled and any issuer distinguished name will do.
1332+ * <p>
1333+ * If the value returned is not <code>null</code>, it is a
1334+ * distinguished name, in RFC 2253 format.
1335+ *
1336+ * @return the required issuer distinguished name in RFC 2253 format
1337+ * (or <code>null</code>)
1338+ */
1339+ public String getIssuerAsString() {
1340+ return (issuer == null ? null : issuer.getName());
1341+ }
1342+
1343+ /**
1344+ * Returns the issuer criterion as a byte array. This distinguished name
1345+ * must match the issuer distinguished name in the
1346+ * <code>X509Certificate</code>. If <code>null</code>, the issuer criterion
1347+ * is disabled and any issuer distinguished name will do.
1348+ * <p>
1349+ * If the value returned is not <code>null</code>, it is a byte
1350+ * array containing a single DER encoded distinguished name, as defined in
1351+ * X.501. The ASN.1 notation for this structure is supplied in the
1352+ * documentation for
1353+ * {@link #setIssuer(byte [] issuerDN) setIssuer(byte [] issuerDN)}.
1354+ * <p>
1355+ * Note that the byte array returned is cloned to protect against
1356+ * subsequent modifications.
1357+ *
1358+ * @return a byte array containing the required issuer distinguished name
1359+ * in ASN.1 DER format (or <code>null</code>)
1360+ * @throws IOException if an encoding error occurs
1361+ */
1362+ public byte[] getIssuerAsBytes() throws IOException {
1363+ return (issuer == null ? null: issuer.getEncoded());
1364+ }
1365+
1366+ /**
1367+ * Returns the subject criterion as an <code>X500Principal</code>. This
1368+ * distinguished name must match the subject distinguished name in the
1369+ * <code>X509Certificate</code>. If <code>null</code>, the subject criterion
1370+ * is disabled and any subject distinguished name will do.
1371+ *
1372+ * @return the required subject distinguished name as X500Principal
1373+ * (or <code>null</code>)
1374+ * @since 1.5
1375+ */
1376+ public X500Principal getSubject() {
1377+ return subject;
1378+ }
1379+
1380+ /**
1381+ * <strong>Denigrated</strong>, use {@linkplain #getSubject()} or
1382+ * {@linkplain #getSubjectAsBytes()} instead. This method should not be
1383+ * relied on as it can fail to match some certificates because of a loss of
1384+ * encoding information in the RFC 2253 String form of some distinguished
1385+ * names.
1386+ * <p>
1387+ * Returns the subject criterion as a <code>String</code>. This
1388+ * distinguished name must match the subject distinguished name in the
1389+ * <code>X509Certificate</code>. If <code>null</code>, the subject criterion
1390+ * is disabled and any subject distinguished name will do.
1391+ * <p>
1392+ * If the value returned is not <code>null</code>, it is a
1393+ * distinguished name, in RFC 2253 format.
1394+ *
1395+ * @return the required subject distinguished name in RFC 2253 format
1396+ * (or <code>null</code>)
1397+ */
1398+ public String getSubjectAsString() {
1399+ return (subject == null ? null : subject.getName());
1400+ }
1401+
1402+ /**
1403+ * Returns the subject criterion as a byte array. This distinguished name
1404+ * must match the subject distinguished name in the
1405+ * <code>X509Certificate</code>. If <code>null</code>, the subject criterion
1406+ * is disabled and any subject distinguished name will do.
1407+ * <p>
1408+ * If the value returned is not <code>null</code>, it is a byte
1409+ * array containing a single DER encoded distinguished name, as defined in
1410+ * X.501. The ASN.1 notation for this structure is supplied in the
1411+ * documentation for
1412+ * {@link #setSubject(byte [] subjectDN) setSubject(byte [] subjectDN)}.
1413+ * <p>
1414+ * Note that the byte array returned is cloned to protect against
1415+ * subsequent modifications.
1416+ *
1417+ * @return a byte array containing the required subject distinguished name
1418+ * in ASN.1 DER format (or <code>null</code>)
1419+ * @throws IOException if an encoding error occurs
1420+ */
1421+ public byte[] getSubjectAsBytes() throws IOException {
1422+ return (subject == null ? null : subject.getEncoded());
1423+ }
1424+
1425+ /**
1426+ * Returns the subjectKeyIdentifier criterion. The
1427+ * <code>X509Certificate</code> must contain a SubjectKeyIdentifier
1428+ * extension with the specified value. If <code>null</code>, no
1429+ * subjectKeyIdentifier check will be done.
1430+ * <p>
1431+ * Note that the byte array returned is cloned to protect against
1432+ * subsequent modifications.
1433+ *
1434+ * @return the key identifier (or <code>null</code>)
1435+ * @see #setSubjectKeyIdentifier
1436+ */
1437+ public byte[] getSubjectKeyIdentifier() {
1438+ if (subjectKeyID == null) {
1439+ return null;
1440+ }
1441+ return subjectKeyID.clone();
1442+ }
1443+
1444+ /**
1445+ * Returns the authorityKeyIdentifier criterion. The
1446+ * <code>X509Certificate</code> must contain a AuthorityKeyIdentifier
1447+ * extension with the specified value. If <code>null</code>, no
1448+ * authorityKeyIdentifier check will be done.
1449+ * <p>
1450+ * Note that the byte array returned is cloned to protect against
1451+ * subsequent modifications.
1452+ *
1453+ * @return the key identifier (or <code>null</code>)
1454+ * @see #setAuthorityKeyIdentifier
1455+ */
1456+ public byte[] getAuthorityKeyIdentifier() {
1457+ if (authorityKeyID == null) {
1458+ return null;
1459+ }
1460+ return authorityKeyID.clone();
1461+ }
1462+
1463+ /**
1464+ * Returns the certificateValid criterion. The specified date must fall
1465+ * within the certificate validity period for the
1466+ * <code>X509Certificate</code>. If <code>null</code>, no certificateValid
1467+ * check will be done.
1468+ * <p>
1469+ * Note that the <code>Date</code> returned is cloned to protect against
1470+ * subsequent modifications.
1471+ *
1472+ * @return the <code>Date</code> to check (or <code>null</code>)
1473+ * @see #setCertificateValid
1474+ */
1475+ public Date getCertificateValid() {
1476+ if (certificateValid == null) {
1477+ return null;
1478+ }
1479+ return (Date)certificateValid.clone();
1480+ }
1481+
1482+ /**
1483+ * Returns the privateKeyValid criterion. The specified date must fall
1484+ * within the private key validity period for the
1485+ * <code>X509Certificate</code>. If <code>null</code>, no privateKeyValid
1486+ * check will be done.
1487+ * <p>
1488+ * Note that the <code>Date</code> returned is cloned to protect against
1489+ * subsequent modifications.
1490+ *
1491+ * @return the <code>Date</code> to check (or <code>null</code>)
1492+ * @see #setPrivateKeyValid
1493+ */
1494+ public Date getPrivateKeyValid() {
1495+ if (privateKeyValid == null) {
1496+ return null;
1497+ }
1498+ return (Date)privateKeyValid.clone();
1499+ }
1500+
1501+ /**
1502+ * Returns the subjectPublicKeyAlgID criterion. The
1503+ * <code>X509Certificate</code> must contain a subject public key
1504+ * with the specified algorithm. If <code>null</code>, no
1505+ * subjectPublicKeyAlgID check will be done.
1506+ *
1507+ * @return the object identifier (OID) of the signature algorithm to check
1508+ * for (or <code>null</code>). An OID is represented by a set of
1509+ * nonnegative integers separated by periods.
1510+ * @see #setSubjectPublicKeyAlgID
1511+ */
1512+ public String getSubjectPublicKeyAlgID() {
1513+ if (subjectPublicKeyAlgID == null) {
1514+ return null;
1515+ }
1516+ return subjectPublicKeyAlgID.toString();
1517+ }
1518+
1519+ /**
1520+ * Returns the subjectPublicKey criterion. The
1521+ * <code>X509Certificate</code> must contain the specified subject
1522+ * public key. If <code>null</code>, no subjectPublicKey check will be done.
1523+ *
1524+ * @return the subject public key to check for (or <code>null</code>)
1525+ * @see #setSubjectPublicKey
1526+ */
1527+ public PublicKey getSubjectPublicKey() {
1528+ return subjectPublicKey;
1529+ }
1530+
1531+ /**
1532+ * Returns the keyUsage criterion. The <code>X509Certificate</code>
1533+ * must allow the specified keyUsage values. If null, no keyUsage
1534+ * check will be done.
1535+ * <p>
1536+ * Note that the boolean array returned is cloned to protect against
1537+ * subsequent modifications.
1538+ *
1539+ * @return a boolean array in the same format as the boolean
1540+ * array returned by
1541+ * {@link X509Certificate#getKeyUsage() X509Certificate.getKeyUsage()}.
1542+ * Or <code>null</code>.
1543+ * @see #setKeyUsage
1544+ */
1545+ public boolean[] getKeyUsage() {
1546+ if (keyUsage == null) {
1547+ return null;
1548+ }
1549+ return keyUsage.clone();
1550+ }
1551+
1552+ /**
1553+ * Returns the extendedKeyUsage criterion. The <code>X509Certificate</code>
1554+ * must allow the specified key purposes in its extended key usage
1555+ * extension. If the <code>keyPurposeSet</code> returned is empty or
1556+ * <code>null</code>, no extendedKeyUsage check will be done. Note that an
1557+ * <code>X509Certificate</code> that has no extendedKeyUsage extension
1558+ * implicitly allows all key purposes.
1559+ *
1560+ * @return an immutable <code>Set</code> of key purpose OIDs in string
1561+ * format (or <code>null</code>)
1562+ * @see #setExtendedKeyUsage
1563+ */
1564+ public Set<String> getExtendedKeyUsage() {
1565+ return keyPurposeSet;
1566+ }
1567+
1568+ /**
1569+ * Indicates if the <code>X509Certificate</code> must contain all
1570+ * or at least one of the subjectAlternativeNames
1571+ * specified in the {@link #setSubjectAlternativeNames
1572+ * setSubjectAlternativeNames} or {@link #addSubjectAlternativeName
1573+ * addSubjectAlternativeName} methods. If <code>true</code>,
1574+ * the <code>X509Certificate</code> must contain all of the
1575+ * specified subject alternative names. If <code>false</code>, the
1576+ * <code>X509Certificate</code> must contain at least one of the
1577+ * specified subject alternative names.
1578+ *
1579+ * @return <code>true</code> if the flag is enabled;
1580+ * <code>false</code> if the flag is disabled. The flag is
1581+ * <code>true</code> by default.
1582+ * @see #setMatchAllSubjectAltNames
1583+ */
1584+ public boolean getMatchAllSubjectAltNames() {
1585+ return matchAllSubjectAltNames;
1586+ }
1587+
1588+ /**
1589+ * Returns a copy of the subjectAlternativeNames criterion.
1590+ * The <code>X509Certificate</code> must contain all or at least one
1591+ * of the specified subjectAlternativeNames, depending on the value
1592+ * of the matchAllNames flag (see {@link #getMatchAllSubjectAltNames
1593+ * getMatchAllSubjectAltNames}). If the value returned is
1594+ * <code>null</code>, no subjectAlternativeNames check will be performed.
1595+ * <p>
1596+ * If the value returned is not <code>null</code>, it is a
1597+ * <code>Collection</code> with
1598+ * one entry for each name to be included in the subject alternative name
1599+ * criterion. Each entry is a <code>List</code> whose first entry is an
1600+ * <code>Integer</code> (the name type, 0-8) and whose second
1601+ * entry is a <code>String</code> or a byte array (the name, in
1602+ * string or ASN.1 DER encoded form, respectively).
1603+ * There can be multiple names of the same type. Note that the
1604+ * <code>Collection</code> returned may contain duplicate names (same name
1605+ * and name type).
1606+ * <p>
1607+ * Each subject alternative name in the <code>Collection</code>
1608+ * may be specified either as a <code>String</code> or as an ASN.1 encoded
1609+ * byte array. For more details about the formats used, see
1610+ * {@link #addSubjectAlternativeName(int type, String name)
1611+ * addSubjectAlternativeName(int type, String name)} and
1612+ * {@link #addSubjectAlternativeName(int type, byte [] name)
1613+ * addSubjectAlternativeName(int type, byte [] name)}.
1614+ * <p>
1615+ * Note that a deep copy is performed on the <code>Collection</code> to
1616+ * protect against subsequent modifications.
1617+ *
1618+ * @return a <code>Collection</code> of names (or <code>null</code>)
1619+ * @see #setSubjectAlternativeNames
1620+ */
1621+ public Collection<List<?>> getSubjectAlternativeNames() {
1622+ if (subjectAlternativeNames == null) {
1623+ return null;
1624+ }
1625+ return cloneNames(subjectAlternativeNames);
1626+ }
1627+
1628+ /**
1629+ * Clone an object of the form passed to
1630+ * setSubjectAlternativeNames and setPathToNames.
1631+ * Throw a <code>RuntimeException</code> if the argument is malformed.
1632+ * <p>
1633+ * This method wraps cloneAndCheckNames, changing any
1634+ * <code>IOException</code> into a <code>RuntimeException</code>. This
1635+ * method should be used when the object being
1636+ * cloned has already been checked, so there should never be any exceptions.
1637+ *
1638+ * @param names a <code>Collection</code> with one entry per name.
1639+ * Each entry is a <code>List</code> whose first entry
1640+ * is an Integer (the name type, 0-8) and whose second
1641+ * entry is a String or a byte array (the name, in
1642+ * string or ASN.1 DER encoded form, respectively).
1643+ * There can be multiple names of the same type. Null
1644+ * is not an acceptable value.
1645+ * @return a deep copy of the specified <code>Collection</code>
1646+ * @throws RuntimeException if a parsing error occurs
1647+ */
1648+ private static Set<List<?>> cloneNames(Collection<List<?>> names) {
1649+ try {
1650+ return cloneAndCheckNames(names);
1651+ } catch (IOException e) {
1652+ throw new RuntimeException("cloneNames encountered IOException: " +
1653+ e.getMessage());
1654+ }
1655+ }
1656+
1657+ /**
1658+ * Clone and check an argument of the form passed to
1659+ * setSubjectAlternativeNames and setPathToNames.
1660+ * Throw an <code>IOException</code> if the argument is malformed.
1661+ *
1662+ * @param names a <code>Collection</code> with one entry per name.
1663+ * Each entry is a <code>List</code> whose first entry
1664+ * is an Integer (the name type, 0-8) and whose second
1665+ * entry is a String or a byte array (the name, in
1666+ * string or ASN.1 DER encoded form, respectively).
1667+ * There can be multiple names of the same type.
1668+ * <code>null</code> is not an acceptable value.
1669+ * @return a deep copy of the specified <code>Collection</code>
1670+ * @throws IOException if a parsing error occurs
1671+ */
1672+ private static Set<List<?>> cloneAndCheckNames(Collection<List<?>> names) throws IOException {
1673+ // Copy the Lists and Collection
1674+ Set<List<?>> namesCopy = new HashSet<List<?>>();
1675+ Iterator<List<?>> i = names.iterator();
1676+ while (i.hasNext()) {
1677+ Object o = i.next();
1678+ if (!(o instanceof List)) {
1679+ throw new IOException("expected a List");
1680+ }
1681+ namesCopy.add(new ArrayList<Object>((List<?>)o));
1682+ }
1683+
1684+ // Check the contents of the Lists and clone any byte arrays
1685+ i = namesCopy.iterator();
1686+ while (i.hasNext()) {
1687+ List<Object> nameList = (List<Object>)i.next();
1688+ if (nameList.size() != 2) {
1689+ throw new IOException("name list size not 2");
1690+ }
1691+ Object o = nameList.get(0);
1692+ if (!(o instanceof Integer)) {
1693+ throw new IOException("expected an Integer");
1694+ }
1695+ int nameType = ((Integer)o).intValue();
1696+ if ((nameType < 0) || (nameType > 8)) {
1697+ throw new IOException("name type not 0-8");
1698+ }
1699+ Object nameObject = nameList.get(1);
1700+ if (!(nameObject instanceof byte[]) &&
1701+ !(nameObject instanceof String)) {
1702+ if (debug != null) {
1703+ debug.println("X509CertSelector.cloneAndCheckNames() "
1704+ + "name not byte array");
1705+ }
1706+ throw new IOException("name not byte array or String");
1707+ }
1708+ if (nameObject instanceof byte[]) {
1709+ nameList.set(1, ((byte[]) nameObject).clone());
1710+ }
1711+ }
1712+ return namesCopy;
1713+ }
1714+
1715+ /**
1716+ * Returns the name constraints criterion. The <code>X509Certificate</code>
1717+ * must have subject and subject alternative names that
1718+ * meet the specified name constraints.
1719+ * <p>
1720+ * The name constraints are returned as a byte array. This byte array
1721+ * contains the DER encoded form of the name constraints, as they
1722+ * would appear in the NameConstraints structure defined in RFC 3280
1723+ * and X.509. The ASN.1 notation for this structure is supplied in the
1724+ * documentation for
1725+ * {@link #setNameConstraints(byte [] bytes) setNameConstraints(byte [] bytes)}.
1726+ * <p>
1727+ * Note that the byte array returned is cloned to protect against
1728+ * subsequent modifications.
1729+ *
1730+ * @return a byte array containing the ASN.1 DER encoding of
1731+ * a NameConstraints extension used for checking name constraints.
1732+ * <code>null</code> if no name constraints check will be performed.
1733+ * @see #setNameConstraints
1734+ */
1735+ public byte[] getNameConstraints() {
1736+ if (ncBytes == null) {
1737+ return null;
1738+ } else {
1739+ return ncBytes.clone();
1740+ }
1741+ }
1742+
1743+ /**
1744+ * Returns the basic constraints constraint. If the value is greater than
1745+ * or equal to zero, the <code>X509Certificates</code> must include a
1746+ * basicConstraints extension with a pathLen of at least this value.
1747+ * If the value is -2, only end-entity certificates are accepted. If
1748+ * the value is -1, no basicConstraints check is done.
1749+ *
1750+ * @return the value for the basic constraints constraint
1751+ * @see #setBasicConstraints
1752+ */
1753+ public int getBasicConstraints() {
1754+ return basicConstraints;
1755+ }
1756+
1757+ /**
1758+ * Returns the policy criterion. The <code>X509Certificate</code> must
1759+ * include at least one of the specified policies in its certificate policies
1760+ * extension. If the <code>Set</code> returned is empty, then the
1761+ * <code>X509Certificate</code> must include at least some specified policy
1762+ * in its certificate policies extension. If the <code>Set</code> returned is
1763+ * <code>null</code>, no policy check will be performed.
1764+ *
1765+ * @return an immutable <code>Set</code> of certificate policy OIDs in
1766+ * string format (or <code>null</code>)
1767+ * @see #setPolicy
1768+ */
1769+ public Set<String> getPolicy() {
1770+ return policySet;
1771+ }
1772+
1773+ /**
1774+ * Returns a copy of the pathToNames criterion. The
1775+ * <code>X509Certificate</code> must not include name constraints that would
1776+ * prohibit building a path to the specified names. If the value
1777+ * returned is <code>null</code>, no pathToNames check will be performed.
1778+ * <p>
1779+ * If the value returned is not <code>null</code>, it is a
1780+ * <code>Collection</code> with one
1781+ * entry for each name to be included in the pathToNames
1782+ * criterion. Each entry is a <code>List</code> whose first entry is an
1783+ * <code>Integer</code> (the name type, 0-8) and whose second
1784+ * entry is a <code>String</code> or a byte array (the name, in
1785+ * string or ASN.1 DER encoded form, respectively).
1786+ * There can be multiple names of the same type. Note that the
1787+ * <code>Collection</code> returned may contain duplicate names (same
1788+ * name and name type).
1789+ * <p>
1790+ * Each name in the <code>Collection</code>
1791+ * may be specified either as a <code>String</code> or as an ASN.1 encoded
1792+ * byte array. For more details about the formats used, see
1793+ * {@link #addPathToName(int type, String name)
1794+ * addPathToName(int type, String name)} and
1795+ * {@link #addPathToName(int type, byte [] name)
1796+ * addPathToName(int type, byte [] name)}.
1797+ * <p>
1798+ * Note that a deep copy is performed on the <code>Collection</code> to
1799+ * protect against subsequent modifications.
1800+ *
1801+ * @return a <code>Collection</code> of names (or <code>null</code>)
1802+ * @see #setPathToNames
1803+ */
1804+ public Collection<List<?>> getPathToNames() {
1805+ if (pathToNames == null) {
1806+ return null;
1807+ }
1808+ return cloneNames(pathToNames);
1809+ }
1810+
1811+ /**
1812+ * Return a printable representation of the <code>CertSelector</code>.
1813+ *
1814+ * @return a <code>String</code> describing the contents of the
1815+ * <code>CertSelector</code>
1816+ */
1817+ public String toString() {
1818+ StringBuffer sb = new StringBuffer();
1819+ sb.append("X509CertSelector: [\n");
1820+ if (x509Cert != null) {
1821+ sb.append(" Certificate: " + x509Cert.toString() + "\n");
1822+ }
1823+ if (serialNumber != null) {
1824+ sb.append(" Serial Number: " + serialNumber.toString() + "\n");
1825+ }
1826+ if (issuer != null) {
1827+ sb.append(" Issuer: " + getIssuerAsString() + "\n");
1828+ }
1829+ if (subject != null) {
1830+ sb.append(" Subject: " + getSubjectAsString() + "\n");
1831+ }
1832+ sb.append(" matchAllSubjectAltNames flag: "
1833+ + String.valueOf(matchAllSubjectAltNames) + "\n");
1834+ if (subjectAlternativeNames != null) {
1835+ sb.append(" SubjectAlternativeNames:\n");
1836+ Iterator<List<?>> i = subjectAlternativeNames.iterator();
1837+ while (i.hasNext()) {
1838+ List<?> list = i.next();
1839+ sb.append(" type " + list.get(0) +
1840+ ", name " + list.get(1) + "\n");
1841+ }
1842+ }
1843+ if (subjectKeyID != null) {
1844+ HexDumpEncoder enc = new HexDumpEncoder();
1845+ sb.append(" Subject Key Identifier: " +
1846+ enc.encodeBuffer(subjectKeyID) + "\n");
1847+ }
1848+ if (authorityKeyID != null) {
1849+ HexDumpEncoder enc = new HexDumpEncoder();
1850+ sb.append(" Authority Key Identifier: " +
1851+ enc.encodeBuffer(authorityKeyID) + "\n");
1852+ }
1853+ if (certificateValid != null) {
1854+ sb.append(" Certificate Valid: " +
1855+ certificateValid.toString() + "\n");
1856+ }
1857+ if (privateKeyValid != null) {
1858+ sb.append(" Private Key Valid: " +
1859+ privateKeyValid.toString() + "\n");
1860+ }
1861+ if (subjectPublicKeyAlgID != null) {
1862+ sb.append(" Subject Public Key AlgID: " +
1863+ subjectPublicKeyAlgID.toString() + "\n");
1864+ }
1865+ if (subjectPublicKey != null) {
1866+ sb.append(" Subject Public Key: " +
1867+ subjectPublicKey.toString() + "\n");
1868+ }
1869+ if (keyUsage != null) {
1870+ sb.append(" Key Usage: " + keyUsageToString(keyUsage) + "\n");
1871+ }
1872+ if (keyPurposeSet != null) {
1873+ sb.append(" Extended Key Usage: " +
1874+ keyPurposeSet.toString() + "\n");
1875+ }
1876+ if (policy != null) {
1877+ sb.append(" Policy: " + policy.toString() + "\n");
1878+ }
1879+ if (pathToGeneralNames != null) {
1880+ sb.append(" Path to names:\n");
1881+ Iterator<GeneralNameInterface> i = pathToGeneralNames.iterator();
1882+ while (i.hasNext()) {
1883+ sb.append(" " + i.next() + "\n");
1884+ }
1885+ }
1886+ sb.append("]");
1887+ return sb.toString();
1888+ }
1889+
1890+ // Copied from sun.security.x509.KeyUsageExtension
1891+ // (without calling the superclass)
1892+ /**
1893+ * Returns a printable representation of the KeyUsage.
1894+ */
1895+ private static String keyUsageToString(boolean[] k) {
1896+ String s = "KeyUsage [\n";
1897+ try {
1898+ if (k[0]) {
1899+ s += " DigitalSignature\n";
1900+ }
1901+ if (k[1]) {
1902+ s += " Non_repudiation\n";
1903+ }
1904+ if (k[2]) {
1905+ s += " Key_Encipherment\n";
1906+ }
1907+ if (k[3]) {
1908+ s += " Data_Encipherment\n";
1909+ }
1910+ if (k[4]) {
1911+ s += " Key_Agreement\n";
1912+ }
1913+ if (k[5]) {
1914+ s += " Key_CertSign\n";
1915+ }
1916+ if (k[6]) {
1917+ s += " Crl_Sign\n";
1918+ }
1919+ if (k[7]) {
1920+ s += " Encipher_Only\n";
1921+ }
1922+ if (k[8]) {
1923+ s += " Decipher_Only\n";
1924+ }
1925+ } catch (ArrayIndexOutOfBoundsException ex) {}
1926+
1927+ s += "]\n";
1928+
1929+ return (s);
1930+ }
1931+
1932+ /**
1933+ * Returns an Extension object given any X509Certificate and extension oid.
1934+ * Throw an <code>IOException</code> if the extension byte value is
1935+ * malformed.
1936+ *
1937+ * @param cert a <code>X509Certificate</code>
1938+ * @param extId an <code>integer</code> which specifies the extension index.
1939+ * Currently, the supported extensions are as follows:
1940+ * index 0 - PrivateKeyUsageExtension
1941+ * index 1 - SubjectAlternativeNameExtension
1942+ * index 2 - NameConstraintsExtension
1943+ * index 3 - CertificatePoliciesExtension
1944+ * index 4 - ExtendedKeyUsageExtension
1945+ * @return an <code>Extension</code> object whose real type is as specified
1946+ * by the extension oid.
1947+ * @throws IOException if cannot construct the <code>Extension</code>
1948+ * object with the extension encoding retrieved from the passed in
1949+ * <code>X509Certificate</code>.
1950+ */
1951+ private static Extension getExtensionObject(X509Certificate cert, int extId)
1952+ throws IOException {
1953+ if (cert instanceof X509CertImpl) {
1954+ X509CertImpl impl = (X509CertImpl)cert;
1955+ switch (extId) {
1956+ case PRIVATE_KEY_USAGE_ID:
1957+ return impl.getPrivateKeyUsageExtension();
1958+ case SUBJECT_ALT_NAME_ID:
1959+ return impl.getSubjectAlternativeNameExtension();
1960+ case NAME_CONSTRAINTS_ID:
1961+ return impl.getNameConstraintsExtension();
1962+ case CERT_POLICIES_ID:
1963+ return impl.getCertificatePoliciesExtension();
1964+ case EXTENDED_KEY_USAGE_ID:
1965+ return impl.getExtendedKeyUsageExtension();
1966+ default:
1967+ return null;
1968+ }
1969+ }
1970+ byte[] rawExtVal = cert.getExtensionValue(EXTENSION_OIDS[extId]);
1971+ if (rawExtVal == null) {
1972+ return null;
1973+ }
1974+ DerInputStream in = new DerInputStream(rawExtVal);
1975+ byte[] encoded = in.getOctetString();
1976+ switch (extId) {
1977+ case PRIVATE_KEY_USAGE_ID:
1978+ try {
1979+ return new PrivateKeyUsageExtension(FALSE, encoded);
1980+ } catch (CertificateException ex) {
1981+ throw new IOException(ex.getMessage());
1982+ }
1983+ case SUBJECT_ALT_NAME_ID:
1984+ return new SubjectAlternativeNameExtension(FALSE, encoded);
1985+ case NAME_CONSTRAINTS_ID:
1986+ return new NameConstraintsExtension(FALSE, encoded);
1987+ case CERT_POLICIES_ID:
1988+ return new CertificatePoliciesExtension(FALSE, encoded);
1989+ case EXTENDED_KEY_USAGE_ID:
1990+ return new ExtendedKeyUsageExtension(FALSE, encoded);
1991+ default:
1992+ return null;
1993+ }
1994+ }
1995+
1996+ /**
1997+ * Decides whether a <code>Certificate</code> should be selected.
1998+ *
1999+ * @param cert the <code>Certificate</code> to be checked
2000+ * @return <code>true</code> if the <code>Certificate</code> should be
2001+ * selected, <code>false</code> otherwise
2002+ */
2003+ public boolean match(Certificate cert) {
2004+ if (!(cert instanceof X509Certificate)) {
2005+ return false;
2006+ }
2007+ X509Certificate xcert = (X509Certificate)cert;
2008+
2009+ if (debug != null) {
2010+ debug.println("X509CertSelector.match(SN: "
2011+ + (xcert.getSerialNumber()).toString(16) + "\n Issuer: "
2012+ + xcert.getIssuerDN() + "\n Subject: " + xcert.getSubjectDN()
2013+ + ")");
2014+ }
2015+
2016+ /* match on X509Certificate */
2017+ if (x509Cert != null) {
2018+ if (!x509Cert.equals(xcert)) {
2019+ if (debug != null) {
2020+ debug.println("X509CertSelector.match: "
2021+ + "certs don't match");
2022+ }
2023+ return false;
2024+ }
2025+ }
2026+
2027+ /* match on serial number */
2028+ if (serialNumber != null) {
2029+ if (!serialNumber.equals(xcert.getSerialNumber())) {
2030+ if (debug != null) {
2031+ debug.println("X509CertSelector.match: "
2032+ + "serial numbers don't match");
2033+ }
2034+ return false;
2035+ }
2036+ }
2037+
2038+ /* match on issuer name */
2039+ if (issuer != null) {
2040+ if (!issuer.equals(xcert.getIssuerX500Principal())) {
2041+ if (debug != null) {
2042+ debug.println("X509CertSelector.match: "
2043+ + "issuer DNs don't match");
2044+ }
2045+ return false;
2046+ }
2047+ }
2048+
2049+ /* match on subject name */
2050+ if (subject != null) {
2051+ if (!subject.equals(xcert.getSubjectX500Principal())) {
2052+ if (debug != null) {
2053+ debug.println("X509CertSelector.match: "
2054+ + "subject DNs don't match");
2055+ }
2056+ return false;
2057+ }
2058+ }
2059+
2060+ /* match on certificate validity range */
2061+ if (certificateValid != null) {
2062+ try {
2063+ xcert.checkValidity(certificateValid);
2064+ } catch (CertificateException e) {
2065+ if (debug != null) {
2066+ debug.println("X509CertSelector.match: "
2067+ + "certificate not within validity period");
2068+ }
2069+ return false;
2070+ }
2071+ }
2072+
2073+ /* match on subject public key */
2074+ if (subjectPublicKeyBytes != null) {
2075+ byte[] certKey = xcert.getPublicKey().getEncoded();
2076+ if (!Arrays.equals(subjectPublicKeyBytes, certKey)) {
2077+ if (debug != null) {
2078+ debug.println("X509CertSelector.match: "
2079+ + "subject public keys don't match");
2080+ }
2081+ return false;
2082+ }
2083+ }
2084+
2085+ boolean result = matchBasicConstraints(xcert)
2086+ && matchKeyUsage(xcert)
2087+ && matchExtendedKeyUsage(xcert)
2088+ && matchSubjectKeyID(xcert)
2089+ && matchAuthorityKeyID(xcert)
2090+ && matchPrivateKeyValid(xcert)
2091+ && matchSubjectPublicKeyAlgID(xcert)
2092+ && matchPolicy(xcert)
2093+ && matchSubjectAlternativeNames(xcert)
2094+ && matchPathToNames(xcert)
2095+ && matchNameConstraints(xcert);
2096+
2097+ if (result && (debug != null)) {
2098+ debug.println("X509CertSelector.match returning: true");
2099+ }
2100+ return result;
2101+ }
2102+
2103+ /* match on subject key identifier extension value */
2104+ private boolean matchSubjectKeyID(X509Certificate xcert) {
2105+ if (subjectKeyID == null) {
2106+ return true;
2107+ }
2108+ try {
2109+ byte[] extVal = xcert.getExtensionValue("2.5.29.14");
2110+ if (extVal == null) {
2111+ if (debug != null) {
2112+ debug.println("X509CertSelector.match: "
2113+ + "no subject key ID extension");
2114+ }
2115+ return false;
2116+ }
2117+ DerInputStream in = new DerInputStream(extVal);
2118+ byte[] certSubjectKeyID = in.getOctetString();
2119+ if (certSubjectKeyID == null ||
2120+ !Arrays.equals(subjectKeyID, certSubjectKeyID)) {
2121+ if (debug != null) {
2122+ debug.println("X509CertSelector.match: "
2123+ + "subject key IDs don't match");
2124+ }
2125+ return false;
2126+ }
2127+ } catch (IOException ex) {
2128+ if (debug != null) {
2129+ debug.println("X509CertSelector.match: "
2130+ + "exception in subject key ID check");
2131+ }
2132+ return false;
2133+ }
2134+ return true;
2135+ }
2136+
2137+ /* match on authority key identifier extension value */
2138+ private boolean matchAuthorityKeyID(X509Certificate xcert) {
2139+ if (authorityKeyID == null) {
2140+ return true;
2141+ }
2142+ try {
2143+ byte[] extVal = xcert.getExtensionValue("2.5.29.35");
2144+ if (extVal == null) {
2145+ if (debug != null) {
2146+ debug.println("X509CertSelector.match: "
2147+ + "no authority key ID extension");
2148+ }
2149+ return false;
2150+ }
2151+ DerInputStream in = new DerInputStream(extVal);
2152+ byte[] certAuthKeyID = in.getOctetString();
2153+ if (certAuthKeyID == null ||
2154+ !Arrays.equals(authorityKeyID, certAuthKeyID)) {
2155+ if (debug != null) {
2156+ debug.println("X509CertSelector.match: "
2157+ + "authority key IDs don't match");
2158+ }
2159+ return false;
2160+ }
2161+ } catch (IOException ex) {
2162+ if (debug != null) {
2163+ debug.println("X509CertSelector.match: "
2164+ + "exception in authority key ID check");
2165+ }
2166+ return false;
2167+ }
2168+ return true;
2169+ }
2170+
2171+ /* match on private key usage range */
2172+ private boolean matchPrivateKeyValid(X509Certificate xcert) {
2173+ if (privateKeyValid == null) {
2174+ return true;
2175+ }
2176+ PrivateKeyUsageExtension ext = null;
2177+ try {
2178+ ext = (PrivateKeyUsageExtension)
2179+ getExtensionObject(xcert, PRIVATE_KEY_USAGE_ID);
2180+ if (ext != null) {
2181+ ext.valid(privateKeyValid);
2182+ }
2183+ } catch (CertificateExpiredException e1) {
2184+ if (debug != null) {
2185+ String time = "n/a";
2186+ try {
2187+ Date notAfter =
2188+ (Date)ext.get(PrivateKeyUsageExtension.NOT_AFTER);
2189+ time = notAfter.toString();
2190+ } catch (CertificateException ex) {
2191+ // not able to retrieve notAfter value
2192+ }
2193+ debug.println("X509CertSelector.match: private key usage not "
2194+ + "within validity date; ext.NOT_After: "
2195+ + time + "; X509CertSelector: "
2196+ + this.toString());
2197+ e1.printStackTrace();
2198+ }
2199+ return false;
2200+ } catch (CertificateNotYetValidException e2) {
2201+ if (debug != null) {
2202+ String time = "n/a";
2203+ try {
2204+ Date notBefore = (Date)
2205+ ext.get(PrivateKeyUsageExtension.NOT_BEFORE);
2206+ time = notBefore.toString();
2207+ } catch (CertificateException ex) {
2208+ // not able to retrieve notBefore value
2209+ }
2210+ debug.println("X509CertSelector.match: private key usage not "
2211+ + "within validity date; ext.NOT_BEFORE: "
2212+ + time + "; X509CertSelector: "
2213+ + this.toString());
2214+ e2.printStackTrace();
2215+ }
2216+ return false;
2217+ } catch (CertificateException e3) {
2218+ if (debug != null) {
2219+ debug.println("X509CertSelector.match: CertificateException "
2220+ + "in private key usage check; X509CertSelector: "
2221+ + this.toString());
2222+ e3.printStackTrace();
2223+ }
2224+ return false;
2225+ } catch (IOException e4) {
2226+ if (debug != null) {
2227+ debug.println("X509CertSelector.match: IOException in "
2228+ + "private key usage check; X509CertSelector: "
2229+ + this.toString());
2230+ e4.printStackTrace();
2231+ }
2232+ return false;
2233+ }
2234+ return true;
2235+ }
2236+
2237+ /* match on subject public key algorithm OID */
2238+ private boolean matchSubjectPublicKeyAlgID(X509Certificate xcert) {
2239+ if (subjectPublicKeyAlgID == null) {
2240+ return true;
2241+ }
2242+ try {
2243+ byte[] encodedKey = xcert.getPublicKey().getEncoded();
2244+ DerValue val = new DerValue(encodedKey);
2245+ if (val.tag != DerValue.tag_Sequence) {
2246+ throw new IOException("invalid key format");
2247+ }
2248+
2249+ AlgorithmId algID = AlgorithmId.parse(val.data.getDerValue());
2250+ if (debug != null) {
2251+ debug.println("X509CertSelector.match: subjectPublicKeyAlgID = "
2252+ + subjectPublicKeyAlgID + ", xcert subjectPublicKeyAlgID = "
2253+ + algID.getOID());
2254+ }
2255+ if (!subjectPublicKeyAlgID.equals(algID.getOID())) {
2256+ if (debug != null) {
2257+ debug.println("X509CertSelector.match: "
2258+ + "subject public key alg IDs don't match");
2259+ }
2260+ return false;
2261+ }
2262+ } catch (IOException e5) {
2263+ if (debug != null) {
2264+ debug.println("X509CertSelector.match: IOException in subject "
2265+ + "public key algorithm OID check");
2266+ }
2267+ return false;
2268+ }
2269+ return true;
2270+ }
2271+
2272+ /* match on key usage extension value */
2273+ private boolean matchKeyUsage(X509Certificate xcert) {
2274+ if (keyUsage == null) {
2275+ return true;
2276+ }
2277+ boolean[] certKeyUsage = xcert.getKeyUsage();
2278+ if (certKeyUsage != null) {
2279+ for (int keyBit = 0; keyBit < keyUsage.length; keyBit++) {
2280+ if (keyUsage[keyBit] &&
2281+ ((keyBit >= certKeyUsage.length) || !certKeyUsage[keyBit])) {
2282+ if (debug != null) {
2283+ debug.println("X509CertSelector.match: "
2284+ + "key usage bits don't match");
2285+ }
2286+ return false;
2287+ }
2288+ }
2289+ }
2290+ return true;
2291+ }
2292+
2293+ /* match on extended key usage purpose OIDs */
2294+ private boolean matchExtendedKeyUsage(X509Certificate xcert) {
2295+ if ((keyPurposeSet == null) || keyPurposeSet.isEmpty()) {
2296+ return true;
2297+ }
2298+ try {
2299+ ExtendedKeyUsageExtension ext =
2300+ (ExtendedKeyUsageExtension)getExtensionObject(xcert,
2301+ EXTENDED_KEY_USAGE_ID);
2302+ if (ext != null) {
2303+ Vector<ObjectIdentifier> certKeyPurposeVector =
2304+ (Vector<ObjectIdentifier>)ext.get(ExtendedKeyUsageExtension.USAGES);
2305+ if (!certKeyPurposeVector.contains(ANY_EXTENDED_KEY_USAGE)
2306+ && !certKeyPurposeVector.containsAll(keyPurposeOIDSet)) {
2307+ if (debug != null) {
2308+ debug.println("X509CertSelector.match: cert failed "
2309+ + "extendedKeyUsage criterion");
2310+ }
2311+ return false;
2312+ }
2313+ }
2314+ } catch (IOException ex) {
2315+ if (debug != null) {
2316+ debug.println("X509CertSelector.match: "
2317+ + "IOException in extended key usage check");
2318+ }
2319+ return false;
2320+ }
2321+ return true;
2322+ }
2323+
2324+ /* match on subject alternative name extension names */
2325+ private boolean matchSubjectAlternativeNames(X509Certificate xcert) {
2326+ if ((subjectAlternativeNames == null) || subjectAlternativeNames.isEmpty()) {
2327+ return true;
2328+ }
2329+ try {
2330+ SubjectAlternativeNameExtension sanExt =
2331+ (SubjectAlternativeNameExtension) getExtensionObject(xcert,
2332+ SUBJECT_ALT_NAME_ID);
2333+ if (sanExt == null) {
2334+ if (debug != null) {
2335+ debug.println("X509CertSelector.match: "
2336+ + "no subject alternative name extension");
2337+ }
2338+ return false;
2339+ }
2340+ GeneralNames certNames = (GeneralNames)
2341+ sanExt.get(SubjectAlternativeNameExtension.SUBJECT_NAME);
2342+ Iterator<GeneralNameInterface> i =
2343+ subjectAlternativeGeneralNames.iterator();
2344+ while (i.hasNext()) {
2345+ GeneralNameInterface matchName = i.next();
2346+ boolean found = false;
2347+ for (Iterator<GeneralName> t = certNames.iterator();
2348+ t.hasNext() && !found; ) {
2349+ GeneralNameInterface certName = (t.next()).getName();
2350+ found = certName.equals(matchName);
2351+ }
2352+ if (!found && (matchAllSubjectAltNames || !i.hasNext())) {
2353+ if (debug != null) {
2354+ debug.println("X509CertSelector.match: subject alternative "
2355+ + "name " + matchName + " not found");
2356+ }
2357+ return false;
2358+ } else if (found && !matchAllSubjectAltNames) {
2359+ break;
2360+ }
2361+ }
2362+ } catch (IOException ex) {
2363+ if (debug != null)
2364+ debug.println("X509CertSelector.match: IOException in subject "
2365+ + "alternative name check");
2366+ return false;
2367+ }
2368+ return true;
2369+ }
2370+
2371+ /* match on name constraints */
2372+ private boolean matchNameConstraints(X509Certificate xcert) {
2373+ if (nc == null) {
2374+ return true;
2375+ }
2376+ try {
2377+ if (!nc.verify(xcert)) {
2378+ if (debug != null) {
2379+ debug.println("X509CertSelector.match: "
2380+ + "name constraints not satisfied");
2381+ }
2382+ return false;
2383+ }
2384+ } catch (IOException e) {
2385+ if (debug != null) {
2386+ debug.println("X509CertSelector.match: "
2387+ + "IOException in name constraints check");
2388+ }
2389+ return false;
2390+ }
2391+ return true;
2392+ }
2393+
2394+ /* match on policy OIDs */
2395+ private boolean matchPolicy(X509Certificate xcert) {
2396+ if (policy == null) {
2397+ return true;
2398+ }
2399+ try {
2400+ CertificatePoliciesExtension ext = (CertificatePoliciesExtension)
2401+ getExtensionObject(xcert, CERT_POLICIES_ID);
2402+ if (ext == null) {
2403+ if (debug != null) {
2404+ debug.println("X509CertSelector.match: "
2405+ + "no certificate policy extension");
2406+ }
2407+ return false;
2408+ }
2409+ List<PolicyInformation> policies = (List<PolicyInformation>)ext.get(CertificatePoliciesExtension.POLICIES);
2410+ /*
2411+ * Convert the Vector of PolicyInformation to a Vector
2412+ * of CertificatePolicyIds for easier comparison.
2413+ */
2414+ List<CertificatePolicyId> policyIDs = new ArrayList<CertificatePolicyId>(policies.size());
2415+ for (PolicyInformation info : policies) {
2416+ policyIDs.add(info.getPolicyIdentifier());
2417+ }
2418+ if (policy != null) {
2419+ boolean foundOne = false;
2420+ /*
2421+ * if the user passes in an empty policy Set, then
2422+ * we just want to make sure that the candidate certificate
2423+ * has some policy OID in its CertPoliciesExtension
2424+ */
2425+ if (policy.getCertPolicyIds().isEmpty()) {
2426+ if (policyIDs.isEmpty()) {
2427+ if (debug != null) {
2428+ debug.println("X509CertSelector.match: "
2429+ + "cert failed policyAny criterion");
2430+ }
2431+ return false;
2432+ }
2433+ } else {
2434+ for (CertificatePolicyId id : policy.getCertPolicyIds()) {
2435+ if (policyIDs.contains(id)) {
2436+ foundOne = true;
2437+ break;
2438+ }
2439+ }
2440+ if (!foundOne) {
2441+ if (debug != null) {
2442+ debug.println("X509CertSelector.match: "
2443+ + "cert failed policyAny criterion");
2444+ }
2445+ return false;
2446+ }
2447+ }
2448+ }
2449+ } catch (IOException ex) {
2450+ if (debug != null) {
2451+ debug.println("X509CertSelector.match: "
2452+ + "IOException in certificate policy ID check");
2453+ }
2454+ return false;
2455+ }
2456+ return true;
2457+ }
2458+
2459+ /* match on pathToNames */
2460+ private boolean matchPathToNames(X509Certificate xcert) {
2461+ if (pathToGeneralNames == null) {
2462+ return true;
2463+ }
2464+ try {
2465+ NameConstraintsExtension ext = (NameConstraintsExtension)
2466+ getExtensionObject(xcert, NAME_CONSTRAINTS_ID);
2467+ if (ext == null) {
2468+ return true;
2469+ }
2470+ if ((debug != null) && debug.isOn("certpath")) {
2471+ debug.println("X509CertSelector.match pathToNames:\n");
2472+ Iterator<GeneralNameInterface> i =
2473+ pathToGeneralNames.iterator();
2474+ while (i.hasNext()) {
2475+ debug.println(" " + i.next() + "\n");
2476+ }
2477+ }
2478+
2479+ GeneralSubtrees permitted = (GeneralSubtrees)
2480+ ext.get(NameConstraintsExtension.PERMITTED_SUBTREES);
2481+ GeneralSubtrees excluded = (GeneralSubtrees)
2482+ ext.get(NameConstraintsExtension.EXCLUDED_SUBTREES);
2483+ if (excluded != null) {
2484+ if (matchExcluded(excluded) == false) {
2485+ return false;
2486+ }
2487+ }
2488+ if (permitted != null) {
2489+ if (matchPermitted(permitted) == false) {
2490+ return false;
2491+ }
2492+ }
2493+ } catch (IOException ex) {
2494+ if (debug != null) {
2495+ debug.println("X509CertSelector.match: "
2496+ + "IOException in name constraints check");
2497+ }
2498+ return false;
2499+ }
2500+ return true;
2501+ }
2502+
2503+ private boolean matchExcluded(GeneralSubtrees excluded) {
2504+ /*
2505+ * Enumerate through excluded and compare each entry
2506+ * to all pathToNames. If any pathToName is within any of the
2507+ * subtrees listed in excluded, return false.
2508+ */
2509+ for (Iterator<GeneralSubtree> t = excluded.iterator(); t.hasNext(); ) {
2510+ GeneralSubtree tree = t.next();
2511+ GeneralNameInterface excludedName = tree.getName().getName();
2512+ Iterator<GeneralNameInterface> i = pathToGeneralNames.iterator();
2513+ while (i.hasNext()) {
2514+ GeneralNameInterface pathToName = i.next();
2515+ if (excludedName.getType() == pathToName.getType()) {
2516+ switch (pathToName.constrains(excludedName)) {
2517+ case GeneralNameInterface.NAME_WIDENS:
2518+ case GeneralNameInterface.NAME_MATCH:
2519+ if (debug != null) {
2520+ debug.println("X509CertSelector.match: name constraints "
2521+ + "inhibit path to specified name");
2522+ debug.println("X509CertSelector.match: excluded name: " +
2523+ pathToName);
2524+ }
2525+ return false;
2526+ default:
2527+ }
2528+ }
2529+ }
2530+ }
2531+ return true;
2532+ }
2533+
2534+ private boolean matchPermitted(GeneralSubtrees permitted) {
2535+ /*
2536+ * Enumerate through pathToNames, checking that each pathToName
2537+ * is in at least one of the subtrees listed in permitted.
2538+ * If not, return false. However, if no subtrees of a given type
2539+ * are listed, all names of that type are permitted.
2540+ */
2541+ Iterator<GeneralNameInterface> i = pathToGeneralNames.iterator();
2542+ while (i.hasNext()) {
2543+ GeneralNameInterface pathToName = i.next();
2544+ Iterator<GeneralSubtree> t = permitted.iterator();
2545+ boolean permittedNameFound = false;
2546+ boolean nameTypeFound = false;
2547+ String names = "";
2548+ while (t.hasNext() && !permittedNameFound) {
2549+ GeneralSubtree tree = t.next();
2550+ GeneralNameInterface permittedName = tree.getName().getName();
2551+ if (permittedName.getType() == pathToName.getType()) {
2552+ nameTypeFound = true;
2553+ names = names + " " + permittedName;
2554+ switch (pathToName.constrains(permittedName)) {
2555+ case GeneralNameInterface.NAME_WIDENS:
2556+ case GeneralNameInterface.NAME_MATCH:
2557+ permittedNameFound = true;
2558+ break;
2559+ default:
2560+ }
2561+ }
2562+ }
2563+ if (!permittedNameFound && nameTypeFound) {
2564+ if (debug != null)
2565+ debug.println("X509CertSelector.match: " +
2566+ "name constraints inhibit path to specified name; " +
2567+ "permitted names of type " + pathToName.getType() +
2568+ ": " + names);
2569+ return false;
2570+ }
2571+ }
2572+ return true;
2573+ }
2574+
2575+ /* match on basic constraints */
2576+ private boolean matchBasicConstraints(X509Certificate xcert) {
2577+ if (basicConstraints == -1) {
2578+ return true;
2579+ }
2580+ int maxPathLen = xcert.getBasicConstraints();
2581+ if (basicConstraints == -2) {
2582+ if (maxPathLen != -1) {
2583+ if (debug != null) {
2584+ debug.println("X509CertSelector.match: not an EE cert");
2585+ }
2586+ return false;
2587+ }
2588+ } else {
2589+ if (maxPathLen < basicConstraints) {
2590+ if (debug != null) {
2591+ debug.println("X509CertSelector.match: maxPathLen too small ("
2592+ + maxPathLen + " < " + basicConstraints + ")");
2593+ }
2594+ return false;
2595+ }
2596+ }
2597+ return true;
2598+ }
2599+
2600+ private static Set<?> cloneSet(Set<?> set) {
2601+ if (set instanceof HashSet) {
2602+ Object clone = ((HashSet<?>)set).clone();
2603+ return (Set<?>)clone;
2604+ } else {
2605+ return new HashSet<Object>(set);
2606+ }
2607+ }
2608+
2609+ /**
2610+ * Returns a copy of this object.
2611+ *
2612+ * @return the copy
2613+ */
2614+ public Object clone() {
2615+ try {
2616+ X509CertSelector copy = (X509CertSelector)super.clone();
2617+ // Must clone these because addPathToName et al. modify them
2618+ if (subjectAlternativeNames != null) {
2619+ copy.subjectAlternativeNames =
2620+ (Set<List<?>>)cloneSet(subjectAlternativeNames);
2621+ copy.subjectAlternativeGeneralNames =
2622+ (Set<GeneralNameInterface>)cloneSet
2623+ (subjectAlternativeGeneralNames);
2624+ }
2625+ if (pathToGeneralNames != null) {
2626+ copy.pathToNames =
2627+ (Set<List<?>>)cloneSet(pathToNames);
2628+ copy.pathToGeneralNames =
2629+ (Set<GeneralNameInterface>)cloneSet
2630+ (pathToGeneralNames);
2631+ }
2632+ return copy;
2633+ } catch (CloneNotSupportedException e) {
2634+ /* Cannot happen */
2635+ throw new InternalError(e.toString());
2636+ }
2637+ }
2638+}
java/pkg/java/security/cert/X509Certificate.class+0−0

Binary file not shown.

java/pkg/java/security/cert/X509Certificate.java+649−0
@@ -0,0 +1,649 @@
1+/*
2+ * Copyright (c) 1997, 2010, Oracle and/or its affiliates. All rights reserved.
3+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
4+ *
5+ * This code is free software; you can redistribute it and/or modify it
6+ * under the terms of the GNU General Public License version 2 only, as
7+ * published by the Free Software Foundation. Oracle designates this
8+ * particular file as subject to the "Classpath" exception as provided
9+ * by Oracle in the LICENSE file that accompanied this code.
10+ *
11+ * This code is distributed in the hope that it will be useful, but WITHOUT
12+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
13+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
14+ * version 2 for more details (a copy is included in the LICENSE file that
15+ * accompanied this code).
16+ *
17+ * You should have received a copy of the GNU General Public License version
18+ * 2 along with this work; if not, write to the Free Software Foundation,
19+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
20+ *
21+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
22+ * or visit www.oracle.com if you need additional information or have any
23+ * questions.
24+ */
25+
26+package java.security.cert;
27+
28+import java.math.BigInteger;
29+import java.security.Principal;
30+import java.security.PublicKey;
31+import java.util.Collection;
32+import java.util.Date;
33+import java.util.List;
34+import javax.security.auth.x500.X500Principal;
35+
36+import sun.security.x509.X509CertImpl;
37+
38+/**
39+ * <p>
40+ * Abstract class for X.509 certificates. This provides a standard
41+ * way to access all the attributes of an X.509 certificate.
42+ * <p>
43+ * In June of 1996, the basic X.509 v3 format was completed by
44+ * ISO/IEC and ANSI X9, which is described below in ASN.1:
45+ * <pre>
46+ * Certificate ::= SEQUENCE {
47+ * tbsCertificate TBSCertificate,
48+ * signatureAlgorithm AlgorithmIdentifier,
49+ * signature BIT STRING }
50+ * </pre>
51+ * <p>
52+ * These certificates are widely used to support authentication and
53+ * other functionality in Internet security systems. Common applications
54+ * include Privacy Enhanced Mail (PEM), Transport Layer Security (SSL),
55+ * code signing for trusted software distribution, and Secure Electronic
56+ * Transactions (SET).
57+ * <p>
58+ * These certificates are managed and vouched for by <em>Certificate
59+ * Authorities</em> (CAs). CAs are services which create certificates by
60+ * placing data in the X.509 standard format and then digitally signing
61+ * that data. CAs act as trusted third parties, making introductions
62+ * between principals who have no direct knowledge of each other.
63+ * CA certificates are either signed by themselves, or by some other
64+ * CA such as a "root" CA.
65+ * <p>
66+ * More information can be found in
67+ * <a href="http://www.ietf.org/rfc/rfc3280.txt">RFC 3280: Internet X.509
68+ * Public Key Infrastructure Certificate and CRL Profile</a>.
69+ * <p>
70+ * The ASN.1 definition of <code>tbsCertificate</code> is:
71+ * <pre>
72+ * TBSCertificate ::= SEQUENCE {
73+ * version [0] EXPLICIT Version DEFAULT v1,
74+ * serialNumber CertificateSerialNumber,
75+ * signature AlgorithmIdentifier,
76+ * issuer Name,
77+ * validity Validity,
78+ * subject Name,
79+ * subjectPublicKeyInfo SubjectPublicKeyInfo,
80+ * issuerUniqueID [1] IMPLICIT UniqueIdentifier OPTIONAL,
81+ * -- If present, version must be v2 or v3
82+ * subjectUniqueID [2] IMPLICIT UniqueIdentifier OPTIONAL,
83+ * -- If present, version must be v2 or v3
84+ * extensions [3] EXPLICIT Extensions OPTIONAL
85+ * -- If present, version must be v3
86+ * }
87+ * </pre>
88+ * <p>
89+ * Certificates are instantiated using a certificate factory. The following is
90+ * an example of how to instantiate an X.509 certificate:
91+ * <pre>
92+ * InputStream inStream = null;
93+ * try {
94+ * inStream = new FileInputStream("fileName-of-cert");
95+ * CertificateFactory cf = CertificateFactory.getInstance("X.509");
96+ * X509Certificate cert = (X509Certificate)cf.generateCertificate(inStream);
97+ * } finally {
98+ * if (inStream != null) {
99+ * inStream.close();
100+ * }
101+ * }
102+ * </pre>
103+ *
104+ * @author Hemma Prafullchandra
105+ *
106+ *
107+ * @see Certificate
108+ * @see CertificateFactory
109+ * @see X509Extension
110+ */
111+
112+public abstract class X509Certificate extends Certificate
113+implements X509Extension {
114+
115+ private static final long serialVersionUID = -2491127588187038216L;
116+
117+ private transient X500Principal subjectX500Principal, issuerX500Principal;
118+
119+ /**
120+ * Constructor for X.509 certificates.
121+ */
122+ protected X509Certificate() {
123+ super("X.509");
124+ }
125+
126+ /**
127+ * Checks that the certificate is currently valid. It is if
128+ * the current date and time are within the validity period given in the
129+ * certificate.
130+ * <p>
131+ * The validity period consists of two date/time values:
132+ * the first and last dates (and times) on which the certificate
133+ * is valid. It is defined in
134+ * ASN.1 as:
135+ * <pre>
136+ * validity Validity<p>
137+ * Validity ::= SEQUENCE {
138+ * notBefore CertificateValidityDate,
139+ * notAfter CertificateValidityDate }<p>
140+ * CertificateValidityDate ::= CHOICE {
141+ * utcTime UTCTime,
142+ * generalTime GeneralizedTime }
143+ * </pre>
144+ *
145+ * @exception CertificateExpiredException if the certificate has expired.
146+ * @exception CertificateNotYetValidException if the certificate is not
147+ * yet valid.
148+ */
149+ public abstract void checkValidity()
150+ throws CertificateExpiredException, CertificateNotYetValidException;
151+
152+ /**
153+ * Checks that the given date is within the certificate's
154+ * validity period. In other words, this determines whether the
155+ * certificate would be valid at the given date/time.
156+ *
157+ * @param date the Date to check against to see if this certificate
158+ * is valid at that date/time.
159+ *
160+ * @exception CertificateExpiredException if the certificate has expired
161+ * with respect to the <code>date</code> supplied.
162+ * @exception CertificateNotYetValidException if the certificate is not
163+ * yet valid with respect to the <code>date</code> supplied.
164+ *
165+ * @see #checkValidity()
166+ */
167+ public abstract void checkValidity(Date date)
168+ throws CertificateExpiredException, CertificateNotYetValidException;
169+
170+ /**
171+ * Gets the <code>version</code> (version number) value from the
172+ * certificate.
173+ * The ASN.1 definition for this is:
174+ * <pre>
175+ * version [0] EXPLICIT Version DEFAULT v1<p>
176+ * Version ::= INTEGER { v1(0), v2(1), v3(2) }
177+ * </pre>
178+ * @return the version number, i.e. 1, 2 or 3.
179+ */
180+ public abstract int getVersion();
181+
182+ /**
183+ * Gets the <code>serialNumber</code> value from the certificate.
184+ * The serial number is an integer assigned by the certification
185+ * authority to each certificate. It must be unique for each
186+ * certificate issued by a given CA (i.e., the issuer name and
187+ * serial number identify a unique certificate).
188+ * The ASN.1 definition for this is:
189+ * <pre>
190+ * serialNumber CertificateSerialNumber<p>
191+ *
192+ * CertificateSerialNumber ::= INTEGER
193+ * </pre>
194+ *
195+ * @return the serial number.
196+ */
197+ public abstract BigInteger getSerialNumber();
198+
199+ /**
200+ * <strong>Denigrated</strong>, replaced by {@linkplain
201+ * #getIssuerX500Principal()}. This method returns the <code>issuer</code>
202+ * as an implementation specific Principal object, which should not be
203+ * relied upon by portable code.
204+ *
205+ * <p>
206+ * Gets the <code>issuer</code> (issuer distinguished name) value from
207+ * the certificate. The issuer name identifies the entity that signed (and
208+ * issued) the certificate.
209+ *
210+ * <p>The issuer name field contains an
211+ * X.500 distinguished name (DN).
212+ * The ASN.1 definition for this is:
213+ * <pre>
214+ * issuer Name<p>
215+ *
216+ * Name ::= CHOICE { RDNSequence }
217+ * RDNSequence ::= SEQUENCE OF RelativeDistinguishedName
218+ * RelativeDistinguishedName ::=
219+ * SET OF AttributeValueAssertion
220+ *
221+ * AttributeValueAssertion ::= SEQUENCE {
222+ * AttributeType,
223+ * AttributeValue }
224+ * AttributeType ::= OBJECT IDENTIFIER
225+ * AttributeValue ::= ANY
226+ * </pre>
227+ * The <code>Name</code> describes a hierarchical name composed of
228+ * attributes,
229+ * such as country name, and corresponding values, such as US.
230+ * The type of the <code>AttributeValue</code> component is determined by
231+ * the <code>AttributeType</code>; in general it will be a
232+ * <code>directoryString</code>. A <code>directoryString</code> is usually
233+ * one of <code>PrintableString</code>,
234+ * <code>TeletexString</code> or <code>UniversalString</code>.
235+ *
236+ * @return a Principal whose name is the issuer distinguished name.
237+ */
238+ public abstract Principal getIssuerDN();
239+
240+ /**
241+ * Returns the issuer (issuer distinguished name) value from the
242+ * certificate as an <code>X500Principal</code>.
243+ * <p>
244+ * It is recommended that subclasses override this method.
245+ *
246+ * @return an <code>X500Principal</code> representing the issuer
247+ * distinguished name
248+ * @since 1.4
249+ */
250+ public X500Principal getIssuerX500Principal() {
251+ if (issuerX500Principal == null) {
252+ issuerX500Principal = X509CertImpl.getIssuerX500Principal(this);
253+ }
254+ return issuerX500Principal;
255+ }
256+
257+ /**
258+ * <strong>Denigrated</strong>, replaced by {@linkplain
259+ * #getSubjectX500Principal()}. This method returns the <code>subject</code>
260+ * as an implementation specific Principal object, which should not be
261+ * relied upon by portable code.
262+ *
263+ * <p>
264+ * Gets the <code>subject</code> (subject distinguished name) value
265+ * from the certificate. If the <code>subject</code> value is empty,
266+ * then the <code>getName()</code> method of the returned
267+ * <code>Principal</code> object returns an empty string ("").
268+ *
269+ * <p> The ASN.1 definition for this is:
270+ * <pre>
271+ * subject Name
272+ * </pre>
273+ *
274+ * <p>See {@link #getIssuerDN() getIssuerDN} for <code>Name</code>
275+ * and other relevant definitions.
276+ *
277+ * @return a Principal whose name is the subject name.
278+ */
279+ public abstract Principal getSubjectDN();
280+
281+ /**
282+ * Returns the subject (subject distinguished name) value from the
283+ * certificate as an <code>X500Principal</code>. If the subject value
284+ * is empty, then the <code>getName()</code> method of the returned
285+ * <code>X500Principal</code> object returns an empty string ("").
286+ * <p>
287+ * It is recommended that subclasses override this method.
288+ *
289+ * @return an <code>X500Principal</code> representing the subject
290+ * distinguished name
291+ * @since 1.4
292+ */
293+ public X500Principal getSubjectX500Principal() {
294+ if (subjectX500Principal == null) {
295+ subjectX500Principal = X509CertImpl.getSubjectX500Principal(this);
296+ }
297+ return subjectX500Principal;
298+ }
299+
300+ /**
301+ * Gets the <code>notBefore</code> date from the validity period of
302+ * the certificate.
303+ * The relevant ASN.1 definitions are:
304+ * <pre>
305+ * validity Validity<p>
306+ *
307+ * Validity ::= SEQUENCE {
308+ * notBefore CertificateValidityDate,
309+ * notAfter CertificateValidityDate }<p>
310+ * CertificateValidityDate ::= CHOICE {
311+ * utcTime UTCTime,
312+ * generalTime GeneralizedTime }
313+ * </pre>
314+ *
315+ * @return the start date of the validity period.
316+ * @see #checkValidity
317+ */
318+ public abstract Date getNotBefore();
319+
320+ /**
321+ * Gets the <code>notAfter</code> date from the validity period of
322+ * the certificate. See {@link #getNotBefore() getNotBefore}
323+ * for relevant ASN.1 definitions.
324+ *
325+ * @return the end date of the validity period.
326+ * @see #checkValidity
327+ */
328+ public abstract Date getNotAfter();
329+
330+ /**
331+ * Gets the DER-encoded certificate information, the
332+ * <code>tbsCertificate</code> from this certificate.
333+ * This can be used to verify the signature independently.
334+ *
335+ * @return the DER-encoded certificate information.
336+ * @exception CertificateEncodingException if an encoding error occurs.
337+ */
338+ public abstract byte[] getTBSCertificate()
339+ throws CertificateEncodingException;
340+
341+ /**
342+ * Gets the <code>signature</code> value (the raw signature bits) from
343+ * the certificate.
344+ * The ASN.1 definition for this is:
345+ * <pre>
346+ * signature BIT STRING
347+ * </pre>
348+ *
349+ * @return the signature.
350+ */
351+ public abstract byte[] getSignature();
352+
353+ /**
354+ * Gets the signature algorithm name for the certificate
355+ * signature algorithm. An example is the string "SHA256withRSA".
356+ * The ASN.1 definition for this is:
357+ * <pre>
358+ * signatureAlgorithm AlgorithmIdentifier<p>
359+ * AlgorithmIdentifier ::= SEQUENCE {
360+ * algorithm OBJECT IDENTIFIER,
361+ * parameters ANY DEFINED BY algorithm OPTIONAL }
362+ * -- contains a value of the type
363+ * -- registered for use with the
364+ * -- algorithm object identifier value
365+ * </pre>
366+ *
367+ * <p>The algorithm name is determined from the <code>algorithm</code>
368+ * OID string.
369+ *
370+ * @return the signature algorithm name.
371+ */
372+ public abstract String getSigAlgName();
373+
374+ /**
375+ * Gets the signature algorithm OID string from the certificate.
376+ * An OID is represented by a set of nonnegative whole numbers separated
377+ * by periods.
378+ * For example, the string "1.2.840.10040.4.3" identifies the SHA-1
379+ * with DSA signature algorithm defined in
380+ * <a href="http://www.ietf.org/rfc/rfc3279.txt">RFC 3279: Algorithms and
381+ * Identifiers for the Internet X.509 Public Key Infrastructure Certificate
382+ * and CRL Profile</a>.
383+ *
384+ * <p>See {@link #getSigAlgName() getSigAlgName} for
385+ * relevant ASN.1 definitions.
386+ *
387+ * @return the signature algorithm OID string.
388+ */
389+ public abstract String getSigAlgOID();
390+
391+ /**
392+ * Gets the DER-encoded signature algorithm parameters from this
393+ * certificate's signature algorithm. In most cases, the signature
394+ * algorithm parameters are null; the parameters are usually
395+ * supplied with the certificate's public key.
396+ * If access to individual parameter values is needed then use
397+ * {@link java.security.AlgorithmParameters AlgorithmParameters}
398+ * and instantiate with the name returned by
399+ * {@link #getSigAlgName() getSigAlgName}.
400+ *
401+ * <p>See {@link #getSigAlgName() getSigAlgName} for
402+ * relevant ASN.1 definitions.
403+ *
404+ * @return the DER-encoded signature algorithm parameters, or
405+ * null if no parameters are present.
406+ */
407+ public abstract byte[] getSigAlgParams();
408+
409+ /**
410+ * Gets the <code>issuerUniqueID</code> value from the certificate.
411+ * The issuer unique identifier is present in the certificate
412+ * to handle the possibility of reuse of issuer names over time.
413+ * RFC 3280 recommends that names not be reused and that
414+ * conforming certificates not make use of unique identifiers.
415+ * Applications conforming to that profile should be capable of
416+ * parsing unique identifiers and making comparisons.
417+ *
418+ * <p>The ASN.1 definition for this is:
419+ * <pre>
420+ * issuerUniqueID [1] IMPLICIT UniqueIdentifier OPTIONAL<p>
421+ * UniqueIdentifier ::= BIT STRING
422+ * </pre>
423+ *
424+ * @return the issuer unique identifier or null if it is not
425+ * present in the certificate.
426+ */
427+ public abstract boolean[] getIssuerUniqueID();
428+
429+ /**
430+ * Gets the <code>subjectUniqueID</code> value from the certificate.
431+ *
432+ * <p>The ASN.1 definition for this is:
433+ * <pre>
434+ * subjectUniqueID [2] IMPLICIT UniqueIdentifier OPTIONAL<p>
435+ * UniqueIdentifier ::= BIT STRING
436+ * </pre>
437+ *
438+ * @return the subject unique identifier or null if it is not
439+ * present in the certificate.
440+ */
441+ public abstract boolean[] getSubjectUniqueID();
442+
443+ /**
444+ * Gets a boolean array representing bits of
445+ * the <code>KeyUsage</code> extension, (OID = 2.5.29.15).
446+ * The key usage extension defines the purpose (e.g., encipherment,
447+ * signature, certificate signing) of the key contained in the
448+ * certificate.
449+ * The ASN.1 definition for this is:
450+ * <pre>
451+ * KeyUsage ::= BIT STRING {
452+ * digitalSignature (0),
453+ * nonRepudiation (1),
454+ * keyEncipherment (2),
455+ * dataEncipherment (3),
456+ * keyAgreement (4),
457+ * keyCertSign (5),
458+ * cRLSign (6),
459+ * encipherOnly (7),
460+ * decipherOnly (8) }
461+ * </pre>
462+ * RFC 3280 recommends that when used, this be marked
463+ * as a critical extension.
464+ *
465+ * @return the KeyUsage extension of this certificate, represented as
466+ * an array of booleans. The order of KeyUsage values in the array is
467+ * the same as in the above ASN.1 definition. The array will contain a
468+ * value for each KeyUsage defined above. If the KeyUsage list encoded
469+ * in the certificate is longer than the above list, it will not be
470+ * truncated. Returns null if this certificate does not
471+ * contain a KeyUsage extension.
472+ */
473+ public abstract boolean[] getKeyUsage();
474+
475+ /**
476+ * Gets an unmodifiable list of Strings representing the OBJECT
477+ * IDENTIFIERs of the <code>ExtKeyUsageSyntax</code> field of the
478+ * extended key usage extension, (OID = 2.5.29.37). It indicates
479+ * one or more purposes for which the certified public key may be
480+ * used, in addition to or in place of the basic purposes
481+ * indicated in the key usage extension field. The ASN.1
482+ * definition for this is:
483+ * <pre>
484+ * ExtKeyUsageSyntax ::= SEQUENCE SIZE (1..MAX) OF KeyPurposeId<p>
485+ *
486+ * KeyPurposeId ::= OBJECT IDENTIFIER<p>
487+ * </pre>
488+ *
489+ * Key purposes may be defined by any organization with a
490+ * need. Object identifiers used to identify key purposes shall be
491+ * assigned in accordance with IANA or ITU-T Rec. X.660 |
492+ * ISO/IEC/ITU 9834-1.
493+ * <p>
494+ * This method was added to version 1.4 of the Java 2 Platform Standard
495+ * Edition. In order to maintain backwards compatibility with existing
496+ * service providers, this method is not <code>abstract</code>
497+ * and it provides a default implementation. Subclasses
498+ * should override this method with a correct implementation.
499+ *
500+ * @return the ExtendedKeyUsage extension of this certificate,
501+ * as an unmodifiable list of object identifiers represented
502+ * as Strings. Returns null if this certificate does not
503+ * contain an ExtendedKeyUsage extension.
504+ * @throws CertificateParsingException if the extension cannot be decoded
505+ * @since 1.4
506+ */
507+ public List<String> getExtendedKeyUsage() throws CertificateParsingException {
508+ return X509CertImpl.getExtendedKeyUsage(this);
509+ }
510+
511+ /**
512+ * Gets the certificate constraints path length from the
513+ * critical <code>BasicConstraints</code> extension, (OID = 2.5.29.19).
514+ * <p>
515+ * The basic constraints extension identifies whether the subject
516+ * of the certificate is a Certificate Authority (CA) and
517+ * how deep a certification path may exist through that CA. The
518+ * <code>pathLenConstraint</code> field (see below) is meaningful
519+ * only if <code>cA</code> is set to TRUE. In this case, it gives the
520+ * maximum number of CA certificates that may follow this certificate in a
521+ * certification path. A value of zero indicates that only an end-entity
522+ * certificate may follow in the path.
523+ * <p>
524+ * The ASN.1 definition for this is:
525+ * <pre>
526+ * BasicConstraints ::= SEQUENCE {
527+ * cA BOOLEAN DEFAULT FALSE,
528+ * pathLenConstraint INTEGER (0..MAX) OPTIONAL }
529+ * </pre>
530+ *
531+ * @return the value of <code>pathLenConstraint</code> if the
532+ * BasicConstraints extension is present in the certificate and the
533+ * subject of the certificate is a CA, otherwise -1.
534+ * If the subject of the certificate is a CA and
535+ * <code>pathLenConstraint</code> does not appear,
536+ * <code>Integer.MAX_VALUE</code> is returned to indicate that there is no
537+ * limit to the allowed length of the certification path.
538+ */
539+ public abstract int getBasicConstraints();
540+
541+ /**
542+ * Gets an immutable collection of subject alternative names from the
543+ * <code>SubjectAltName</code> extension, (OID = 2.5.29.17).
544+ * <p>
545+ * The ASN.1 definition of the <code>SubjectAltName</code> extension is:
546+ * <pre>
547+ * SubjectAltName ::= GeneralNames
548+ *
549+ * GeneralNames :: = SEQUENCE SIZE (1..MAX) OF GeneralName
550+ *
551+ * GeneralName ::= CHOICE {
552+ * otherName [0] OtherName,
553+ * rfc822Name [1] IA5String,
554+ * dNSName [2] IA5String,
555+ * x400Address [3] ORAddress,
556+ * directoryName [4] Name,
557+ * ediPartyName [5] EDIPartyName,
558+ * uniformResourceIdentifier [6] IA5String,
559+ * iPAddress [7] OCTET STRING,
560+ * registeredID [8] OBJECT IDENTIFIER}
561+ * </pre>
562+ * <p>
563+ * If this certificate does not contain a <code>SubjectAltName</code>
564+ * extension, <code>null</code> is returned. Otherwise, a
565+ * <code>Collection</code> is returned with an entry representing each
566+ * <code>GeneralName</code> included in the extension. Each entry is a
567+ * <code>List</code> whose first entry is an <code>Integer</code>
568+ * (the name type, 0-8) and whose second entry is a <code>String</code>
569+ * or a byte array (the name, in string or ASN.1 DER encoded form,
570+ * respectively).
571+ * <p>
572+ * <a href="http://www.ietf.org/rfc/rfc822.txt">RFC 822</a>, DNS, and URI
573+ * names are returned as <code>String</code>s,
574+ * using the well-established string formats for those types (subject to
575+ * the restrictions included in RFC 3280). IPv4 address names are
576+ * returned using dotted quad notation. IPv6 address names are returned
577+ * in the form "a1:a2:...:a8", where a1-a8 are hexadecimal values
578+ * representing the eight 16-bit pieces of the address. OID names are
579+ * returned as <code>String</code>s represented as a series of nonnegative
580+ * integers separated by periods. And directory names (distinguished names)
581+ * are returned in <a href="http://www.ietf.org/rfc/rfc2253.txt">
582+ * RFC 2253</a> string format. No standard string format is
583+ * defined for otherNames, X.400 names, EDI party names, or any
584+ * other type of names. They are returned as byte arrays
585+ * containing the ASN.1 DER encoded form of the name.
586+ * <p>
587+ * Note that the <code>Collection</code> returned may contain more
588+ * than one name of the same type. Also, note that the returned
589+ * <code>Collection</code> is immutable and any entries containing byte
590+ * arrays are cloned to protect against subsequent modifications.
591+ * <p>
592+ * This method was added to version 1.4 of the Java 2 Platform Standard
593+ * Edition. In order to maintain backwards compatibility with existing
594+ * service providers, this method is not <code>abstract</code>
595+ * and it provides a default implementation. Subclasses
596+ * should override this method with a correct implementation.
597+ *
598+ * @return an immutable <code>Collection</code> of subject alternative
599+ * names (or <code>null</code>)
600+ * @throws CertificateParsingException if the extension cannot be decoded
601+ * @since 1.4
602+ */
603+ public Collection<List<?>> getSubjectAlternativeNames()
604+ throws CertificateParsingException {
605+ return X509CertImpl.getSubjectAlternativeNames(this);
606+ }
607+
608+ /**
609+ * Gets an immutable collection of issuer alternative names from the
610+ * <code>IssuerAltName</code> extension, (OID = 2.5.29.18).
611+ * <p>
612+ * The ASN.1 definition of the <code>IssuerAltName</code> extension is:
613+ * <pre>
614+ * IssuerAltName ::= GeneralNames
615+ * </pre>
616+ * The ASN.1 definition of <code>GeneralNames</code> is defined
617+ * in {@link #getSubjectAlternativeNames getSubjectAlternativeNames}.
618+ * <p>
619+ * If this certificate does not contain an <code>IssuerAltName</code>
620+ * extension, <code>null</code> is returned. Otherwise, a
621+ * <code>Collection</code> is returned with an entry representing each
622+ * <code>GeneralName</code> included in the extension. Each entry is a
623+ * <code>List</code> whose first entry is an <code>Integer</code>
624+ * (the name type, 0-8) and whose second entry is a <code>String</code>
625+ * or a byte array (the name, in string or ASN.1 DER encoded form,
626+ * respectively). For more details about the formats used for each
627+ * name type, see the <code>getSubjectAlternativeNames</code> method.
628+ * <p>
629+ * Note that the <code>Collection</code> returned may contain more
630+ * than one name of the same type. Also, note that the returned
631+ * <code>Collection</code> is immutable and any entries containing byte
632+ * arrays are cloned to protect against subsequent modifications.
633+ * <p>
634+ * This method was added to version 1.4 of the Java 2 Platform Standard
635+ * Edition. In order to maintain backwards compatibility with existing
636+ * service providers, this method is not <code>abstract</code>
637+ * and it provides a default implementation. Subclasses
638+ * should override this method with a correct implementation.
639+ *
640+ * @return an immutable <code>Collection</code> of issuer alternative
641+ * names (or <code>null</code>)
642+ * @throws CertificateParsingException if the extension cannot be decoded
643+ * @since 1.4
644+ */
645+ public Collection<List<?>> getIssuerAlternativeNames()
646+ throws CertificateParsingException {
647+ return X509CertImpl.getIssuerAlternativeNames(this);
648+ }
649+}
java/pkg/java/security/cert/X509Extension.class+0−0

Binary file not shown.

java/pkg/java/security/cert/X509Extension.java+199−0
@@ -0,0 +1,199 @@
1+/*
2+ * Copyright (c) 1997, 2006, Oracle and/or its affiliates. All rights reserved.
3+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
4+ *
5+ * This code is free software; you can redistribute it and/or modify it
6+ * under the terms of the GNU General Public License version 2 only, as
7+ * published by the Free Software Foundation. Oracle designates this
8+ * particular file as subject to the "Classpath" exception as provided
9+ * by Oracle in the LICENSE file that accompanied this code.
10+ *
11+ * This code is distributed in the hope that it will be useful, but WITHOUT
12+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
13+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
14+ * version 2 for more details (a copy is included in the LICENSE file that
15+ * accompanied this code).
16+ *
17+ * You should have received a copy of the GNU General Public License version
18+ * 2 along with this work; if not, write to the Free Software Foundation,
19+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
20+ *
21+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
22+ * or visit www.oracle.com if you need additional information or have any
23+ * questions.
24+ */
25+
26+package java.security.cert;
27+
28+import java.util.Set;
29+
30+/**
31+ * Interface for an X.509 extension.
32+ *
33+ * <p>The extensions defined for X.509 v3
34+ * {@link X509Certificate Certificates} and v2
35+ * {@link X509CRL CRLs} (Certificate Revocation
36+ * Lists) provide methods
37+ * for associating additional attributes with users or public keys,
38+ * for managing the certification hierarchy, and for managing CRL
39+ * distribution. The X.509 extensions format also allows communities
40+ * to define private extensions to carry information unique to those
41+ * communities.
42+ *
43+ * <p>Each extension in a certificate/CRL may be designated as
44+ * critical or non-critical. A certificate/CRL-using system (an application
45+ * validating a certificate/CRL) must reject the certificate/CRL if it
46+ * encounters a critical extension it does not recognize. A non-critical
47+ * extension may be ignored if it is not recognized.
48+ * <p>
49+ * The ASN.1 definition for this is:
50+ * <pre>
51+ * Extensions ::= SEQUENCE SIZE (1..MAX) OF Extension
52+ *
53+ * Extension ::= SEQUENCE {
54+ * extnId OBJECT IDENTIFIER,
55+ * critical BOOLEAN DEFAULT FALSE,
56+ * extnValue OCTET STRING
57+ * -- contains a DER encoding of a value
58+ * -- of the type registered for use with
59+ * -- the extnId object identifier value
60+ * }
61+ * </pre>
62+ * Since not all extensions are known, the <code>getExtensionValue</code>
63+ * method returns the DER-encoded OCTET STRING of the
64+ * extension value (i.e., the <code>extnValue</code>). This can then
65+ * be handled by a <em>Class</em> that understands the extension.
66+ *
67+ * @author Hemma Prafullchandra
68+ */
69+
70+public interface X509Extension {
71+
72+ /**
73+ * Check if there is a critical extension that is not supported.
74+ *
75+ * @return <tt>true</tt> if a critical extension is found that is
76+ * not supported, otherwise <tt>false</tt>.
77+ */
78+ public boolean hasUnsupportedCriticalExtension();
79+
80+ /**
81+ * Gets a Set of the OID strings for the extension(s) marked
82+ * CRITICAL in the certificate/CRL managed by the object
83+ * implementing this interface.
84+ *
85+ * Here is sample code to get a Set of critical extensions from an
86+ * X509Certificate and print the OIDs:
87+ * <pre><code>
88+ * InputStream inStrm = null;
89+ * X509Certificate cert = null;
90+ * try {
91+ * inStrm = new FileInputStream("DER-encoded-Cert");
92+ * CertificateFactory cf = CertificateFactory.getInstance("X.509");
93+ * cert = (X509Certificate)cf.generateCertificate(inStrm);
94+ * } finally {
95+ * if (inStrm != null) {
96+ * inStrm.close();
97+ * }
98+ * }<p>
99+ *
100+ * Set<String> critSet = cert.getCriticalExtensionOIDs();
101+ * if (critSet != null && !critSet.isEmpty()) {
102+ * System.out.println("Set of critical extensions:");
103+ * for (String oid : critSet) {
104+ * System.out.println(oid);
105+ * }
106+ * }
107+ * </code></pre>
108+ * @return a Set (or an empty Set if none are marked critical) of
109+ * the extension OID strings for extensions that are marked critical.
110+ * If there are no extensions present at all, then this method returns
111+ * null.
112+ */
113+ public Set<String> getCriticalExtensionOIDs();
114+
115+ /**
116+ * Gets a Set of the OID strings for the extension(s) marked
117+ * NON-CRITICAL in the certificate/CRL managed by the object
118+ * implementing this interface.
119+ *
120+ * Here is sample code to get a Set of non-critical extensions from an
121+ * X509CRL revoked certificate entry and print the OIDs:
122+ * <pre><code>
123+ * InputStream inStrm = null;
124+ * CertificateFactory cf = null;
125+ * X509CRL crl = null;
126+ * try {
127+ * inStrm = new FileInputStream("DER-encoded-CRL");
128+ * cf = CertificateFactory.getInstance("X.509");
129+ * crl = (X509CRL)cf.generateCRL(inStrm);
130+ * } finally {
131+ * if (inStrm != null) {
132+ * inStrm.close();
133+ * }
134+ * }<p>
135+ *
136+ * byte[] certData = &lt;DER-encoded certificate data&gt;
137+ * ByteArrayInputStream bais = new ByteArrayInputStream(certData);
138+ * X509Certificate cert = (X509Certificate)cf.generateCertificate(bais);
139+ * bais.close();
140+ * X509CRLEntry badCert =
141+ * crl.getRevokedCertificate(cert.getSerialNumber());<p>
142+ *
143+ * if (badCert != null) {
144+ * Set<String> nonCritSet = badCert.getNonCriticalExtensionOIDs();<p>
145+ * if (nonCritSet != null)
146+ * for (String oid : nonCritSet) {
147+ * System.out.println(oid);
148+ * }
149+ * }
150+ * </code></pre>
151+ *
152+ * @return a Set (or an empty Set if none are marked non-critical) of
153+ * the extension OID strings for extensions that are marked non-critical.
154+ * If there are no extensions present at all, then this method returns
155+ * null.
156+ */
157+ public Set<String> getNonCriticalExtensionOIDs();
158+
159+ /**
160+ * Gets the DER-encoded OCTET string for the extension value
161+ * (<em>extnValue</em>) identified by the passed-in <code>oid</code>
162+ * String.
163+ * The <code>oid</code> string is
164+ * represented by a set of nonnegative whole numbers separated
165+ * by periods.
166+ *
167+ * <p>For example:<br>
168+ * <table border=groove summary="Examples of OIDs and extension names">
169+ * <tr>
170+ * <th>OID <em>(Object Identifier)</em></th>
171+ * <th>Extension Name</th></tr>
172+ * <tr><td>2.5.29.14</td>
173+ * <td>SubjectKeyIdentifier</td></tr>
174+ * <tr><td>2.5.29.15</td>
175+ * <td>KeyUsage</td></tr>
176+ * <tr><td>2.5.29.16</td>
177+ * <td>PrivateKeyUsage</td></tr>
178+ * <tr><td>2.5.29.17</td>
179+ * <td>SubjectAlternativeName</td></tr>
180+ * <tr><td>2.5.29.18</td>
181+ * <td>IssuerAlternativeName</td></tr>
182+ * <tr><td>2.5.29.19</td>
183+ * <td>BasicConstraints</td></tr>
184+ * <tr><td>2.5.29.30</td>
185+ * <td>NameConstraints</td></tr>
186+ * <tr><td>2.5.29.33</td>
187+ * <td>PolicyMappings</td></tr>
188+ * <tr><td>2.5.29.35</td>
189+ * <td>AuthorityKeyIdentifier</td></tr>
190+ * <tr><td>2.5.29.36</td>
191+ * <td>PolicyConstraints</td></tr>
192+ * </table>
193+ *
194+ * @param oid the Object Identifier value for the extension.
195+ * @return the DER-encoded octet string of the extension value or
196+ * null if it is not present.
197+ */
198+ public byte[] getExtensionValue(String oid);
199+}
java/pkg/java/security/cert/mkfile+54−0
@@ -0,0 +1,54 @@
1+<../../../../../mkconfig
2+
3+TARG=\
4+ Certificate.dis\
5+ CertificateEncodingException.dis\
6+ CertificateException.dis\
7+ CertificateExpiredException.dis\
8+ CertificateFactory.dis\
9+ CertificateFactorySpi.dis\
10+ CertificateNotYetValidException.dis\
11+ CertificateParsingException.dis\
12+ CertificateRevokedException.dis\
13+ CertPath.dis\
14+ CertPathBuilder.dis\
15+ CertPathBuilderException.dis\
16+ CertPathBuilderResult.dis\
17+ CertPathBuilderSpi.dis\
18+ CertPathHelperImpl.dis\
19+ CertPathParameters.dis\
20+ CertPathValidator.dis\
21+ CertPathValidatorException.dis\
22+ CertPathValidatorResult.dis\
23+ CertPathValidatorSpi.dis\
24+ CertSelector.dis\
25+ CertStore.dis\
26+ CertStoreException.dis\
27+ CertStoreParameters.dis\
28+ CertStoreSpi.dis\
29+ CollectionCertStoreParameters.dis\
30+ CRL.dis\
31+ CRLException.dis\
32+ CRLReason.dis\
33+ CRLSelector.dis\
34+ Extension.dis\
35+ LDAPCertStoreParameters.dis\
36+ PKIXBuilderParameters.dis\
37+ PKIXCertPathBuilderResult.dis\
38+ PKIXCertPathChecker.dis\
39+ PKIXCertPathValidatorResult.dis\
40+ PKIXParameters.dis\
41+ PKIXReason.dis\
42+ PolicyNode.dis\
43+ PolicyQualifierInfo.dis\
44+ TrustAnchor.dis\
45+ X509Certificate.dis\
46+ X509CertSelector.dis\
47+ X509CRL.dis\
48+ X509CRLEntry.dis\
49+ X509CRLSelector.dis\
50+ X509Extension.dis\
51+
52+DISBIN=$ROOT/java/dis/java/java/java/security/cert
53+
54+<$ROOT/mkfiles/mkjava
java/pkg/java/security/cert/package.html+65−0
@@ -0,0 +1,65 @@
1+<!--
2+ Copyright (c) 1998, 2011, Oracle and/or its affiliates. All rights reserved.
3+ DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
4+
5+ This code is free software; you can redistribute it and/or modify it
6+ under the terms of the GNU General Public License version 2 only, as
7+ published by the Free Software Foundation. Oracle designates this
8+ particular file as subject to the "Classpath" exception as provided
9+ by Oracle in the LICENSE file that accompanied this code.
10+
11+ This code is distributed in the hope that it will be useful, but WITHOUT
12+ ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
13+ FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
14+ version 2 for more details (a copy is included in the LICENSE file that
15+ accompanied this code).
16+
17+ You should have received a copy of the GNU General Public License version
18+ 2 along with this work; if not, write to the Free Software Foundation,
19+ Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
20+
21+ Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
22+ or visit www.oracle.com if you need additional information or have any
23+ questions.
24+-->
25+
26+<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2 Final//EN">
27+<html>
28+<body bgcolor="white">
29+
30+Provides classes and interfaces for parsing and managing
31+certificates, certificate revocation lists (CRLs), and
32+certification paths. It contains support for X.509 v3
33+certificates and X.509 v2 CRLs.
34+
35+<h2>Package Specification</h2>
36+
37+<ul>
38+ <li><a href="{@docRoot}/../technotes/guides/security/crypto/CryptoSpec.html">
39+ <b>Java<FONT SIZE=-2><SUP>TM</SUP></FONT>
40+ Cryptography Architecture (JCA) Reference Guide</b></a>
41+ <li>RFC 3280: Internet X.509 Public Key Infrastructure Certificate and
42+ Certificate Revocation List (CRL) Profile
43+ <li><a href="{@docRoot}/../technotes/guides/security/StandardNames.html">
44+ <b>Java<FONT SIZE=-2><SUP>TM</SUP></FONT>
45+ Cryptography Architecture Standard Algorithm Name
46+ Documentation</b></a></li>
47+</ul>
48+
49+<h2>Related Documentation</h2>
50+
51+For information about X.509 certificates and CRLs, please see:
52+<ul>
53+ <li><a href="http://www.ietf.org/rfc/rfc3280.txt">
54+ http://www.ietf.org/rfc/rfc3280.txt</a>
55+ <li><a href=
56+ "{@docRoot}/../technotes/guides/security/certpath/CertPathProgGuide.html">
57+ <b>Java<FONT SIZE=-2><SUP>TM</SUP></FONT>
58+ PKI Programmer's Guide</a>
59+ <li><a href="{@docRoot}/../technotes/guides/security/cert3.html">
60+ X.509 Certificates and Certificate Revocation Lists (CRLs)</a>
61+</ul>
62+
63+@since 1.2
64+</body>
65+</html>