plan9-archive/inferno-java

java/pkg/org/ietf/jgss/ChannelBinding.class+0−0

Binary file not shown.

java/pkg/org/ietf/jgss/ChannelBinding.java+212−0

@@ -0,0 +1,212 @@
	1	+/*
	2	+ * Copyright (c) 2000, 2001, Oracle and/or its affiliates. All rights reserved.
	3	+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
	4	+ *
	5	+ * This code is free software; you can redistribute it and/or modify it
	6	+ * under the terms of the GNU General Public License version 2 only, as
	7	+ * published by the Free Software Foundation. Oracle designates this
	8	+ * particular file as subject to the "Classpath" exception as provided
	9	+ * by Oracle in the LICENSE file that accompanied this code.
	10	+ *
	11	+ * This code is distributed in the hope that it will be useful, but WITHOUT
	12	+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
	13	+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
	14	+ * version 2 for more details (a copy is included in the LICENSE file that
	15	+ * accompanied this code).
	16	+ *
	17	+ * You should have received a copy of the GNU General Public License version
	18	+ * 2 along with this work; if not, write to the Free Software Foundation,
	19	+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
	20	+ *
	21	+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
	22	+ * or visit www.oracle.com if you need additional information or have any
	23	+ * questions.
	24	+ */
	25	+
	26	+package org.ietf.jgss;
	27	+
	28	+import java.net.InetAddress;
	29	+import java.util.Arrays;
	30	+
	31	+/**
	32	+ * This class encapsulates the concept of caller-provided channel
	33	+ * binding information. Channel bindings are used to strengthen the
	34	+ * quality with which peer entity authentication is provided during
	35	+ * context establishment. They enable the GSS-API callers to bind the
	36	+ * establishment of the security context to relevant characteristics
	37	+ * like addresses or to application specific data.<p>
	38	+ *
	39	+ * The caller initiating the security context must determine the
	40	+ * appropriate channel binding values to set in the GSSContext object.
	41	+ * The acceptor must provide an identical binding in order to validate
	42	+ * that received tokens possess correct channel-related characteristics.<p>
	43	+ *
	44	+ * Use of channel bindings is optional in GSS-API. ChannelBinding can be
	45	+ * set for the {@link GSSContext GSSContext} using the {@link
	46	+ * GSSContext#setChannelBinding(ChannelBinding) setChannelBinding} method
	47	+ * before the first call to {@link GSSContext#initSecContext(byte[], int, int)
	48	+ * initSecContext} or {@link GSSContext#acceptSecContext(byte[], int, int)
	49	+ * acceptSecContext} has been performed. Unless the <code>setChannelBinding</code>
	50	+ * method has been used to set the ChannelBinding for a GSSContext object,
	51	+ * <code>null</code> ChannelBinding will be assumed. <p>
	52	+ *
	53	+ * Conceptually, the GSS-API concatenates the initiator and acceptor
	54	+ * address information, and the application supplied byte array to form an
	55	+ * octet string. The mechanism calculates a MIC over this octet string and
	56	+ * binds the MIC to the context establishment token emitted by
	57	+ * <code>initSecContext</code> method of the <code>GSSContext</code>
	58	+ * interface. The same bindings are set by the context acceptor for its
	59	+ * <code>GSSContext</code> object and during processing of the
	60	+ * <code>acceptSecContext</code> method a MIC is calculated in the same
	61	+ * way. The calculated MIC is compared with that found in the token, and if
	62	+ * the MICs differ, accept will throw a <code>GSSException</code> with the
	63	+ * major code set to {@link GSSException#BAD_BINDINGS BAD_BINDINGS}, and
	64	+ * the context will not be established. Some mechanisms may include the
	65	+ * actual channel binding data in the token (rather than just a MIC);
	66	+ * applications should therefore not use confidential data as
	67	+ * channel-binding components.<p>
	68	+ *
	69	+ * Individual mechanisms may impose additional constraints on addresses
	70	+ * that may appear in channel bindings. For example, a mechanism may
	71	+ * verify that the initiator address field of the channel binding
	72	+ * contains the correct network address of the host system. Portable
	73	+ * applications should therefore ensure that they either provide correct
	74	+ * information for the address fields, or omit setting of the addressing
	75	+ * information.
	76	+ *
	77	+ * @author Mayank Upadhyay
	78	+ * @since 1.4
	79	+ */
	80	+public class ChannelBinding {
	81	+
	82	+ private InetAddress initiator;
	83	+ private InetAddress acceptor;
	84	+ private byte[] appData;
	85	+
	86	+ /**
	87	+ * Create a ChannelBinding object with user supplied address information
	88	+ * and data. <code>null</code> values can be used for any fields which the
	89	+ * application does not want to specify.
	90	+ *
	91	+ * @param initAddr the address of the context initiator.
	92	+ * <code>null</code> value can be supplied to indicate that the
	93	+ * application does not want to set this value.
	94	+ * @param acceptAddr the address of the context
	95	+ * acceptor. <code>null</code> value can be supplied to indicate that
	96	+ * the application does not want to set this value.
	97	+ * @param appData application supplied data to be used as part of the
	98	+ * channel bindings. <code>null</code> value can be supplied to
	99	+ * indicate that the application does not want to set this value.
	100	+ */
	101	+ public ChannelBinding(InetAddress initAddr, InetAddress acceptAddr,
	102	+ byte[] appData) {
	103	+
	104	+ initiator = initAddr;
	105	+ acceptor = acceptAddr;
	106	+
	107	+ if (appData != null) {
	108	+ this.appData = new byte[appData.length];
	109	+ java.lang.System.arraycopy(appData, 0, this.appData, 0,
	110	+ appData.length);
	111	+ }
	112	+ }
	113	+
	114	+ /**
	115	+ * Creates a ChannelBinding object without any addressing information.
	116	+ *
	117	+ * @param appData application supplied data to be used as part of the
	118	+ * channel bindings.
	119	+ */
	120	+ public ChannelBinding(byte[] appData) {
	121	+ this(null, null, appData);
	122	+ }
	123	+
	124	+ /**
	125	+ * Get the initiator's address for this channel binding.
	126	+ *
	127	+ * @return the initiator's address. <code>null</code> is returned if
	128	+ * the address has not been set.
	129	+ */
	130	+ public InetAddress getInitiatorAddress() {
	131	+ return initiator;
	132	+ }
	133	+
	134	+ /**
	135	+ * Get the acceptor's address for this channel binding.
	136	+ *
	137	+ * @return the acceptor's address. null is returned if the address has
	138	+ * not been set.
	139	+ */
	140	+ public InetAddress getAcceptorAddress() {
	141	+ return acceptor;
	142	+ }
	143	+
	144	+ /**
	145	+ * Get the application specified data for this channel binding.
	146	+ *
	147	+ * @return the application data being used as part of the
	148	+ * ChannelBinding. <code>null</code> is returned if no application data
	149	+ * has been specified for the channel binding.
	150	+ */
	151	+ public byte[] getApplicationData() {
	152	+
	153	+ if (appData == null) {
	154	+ return null;
	155	+ }
	156	+
	157	+ byte[] retVal = new byte[appData.length];
	158	+ System.arraycopy(appData, 0, retVal, 0, appData.length);
	159	+ return retVal;
	160	+ }
	161	+
	162	+ /**
	163	+ * Compares two instances of ChannelBinding.
	164	+ *
	165	+ * @param obj another ChannelBinding to compare this one with
	166	+ * @return true if the two ChannelBinding's contain
	167	+ * the same values for the initiator and acceptor addresses and the
	168	+ * application data.
	169	+ */
	170	+ public boolean equals(Object obj) {
	171	+
	172	+ if (this == obj)
	173	+ return true;
	174	+
	175	+ if (! (obj instanceof ChannelBinding))
	176	+ return false;
	177	+
	178	+ ChannelBinding cb = (ChannelBinding) obj;
	179	+
	180	+ if ((initiator != null && cb.initiator == null) \|\|
	181	+ (initiator == null && cb.initiator != null))
	182	+ return false;
	183	+
	184	+ if (initiator != null && !initiator.equals(cb.initiator))
	185	+ return false;
	186	+
	187	+ if ((acceptor != null && cb.acceptor == null) \|\|
	188	+ (acceptor == null && cb.acceptor != null))
	189	+ return false;
	190	+
	191	+ if (acceptor != null && !acceptor.equals(cb.acceptor))
	192	+ return false;
	193	+
	194	+ return Arrays.equals(appData, cb.appData);
	195	+ }
	196	+
	197	+ /**
	198	+ * Returns a hashcode value for this ChannelBinding object.
	199	+ *
	200	+ * @return a hashCode value
	201	+ */
	202	+ public int hashCode() {
	203	+ if (initiator != null)
	204	+ return initiator.hashCode();
	205	+ else if (acceptor != null)
	206	+ return acceptor.hashCode();
	207	+ else if (appData != null)
	208	+ return new String(appData).hashCode();
	209	+ else
	210	+ return 1;
	211	+ }
	212	+}

java/pkg/org/ietf/jgss/GSSContext.class+0−0

Binary file not shown.

java/pkg/org/ietf/jgss/GSSContext.java+1347−0

@@ -0,0 +1,1347 @@
	1	+/*
	2	+ * Copyright (c) 2000, 2009, Oracle and/or its affiliates. All rights reserved.
	3	+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
	4	+ *
	5	+ * This code is free software; you can redistribute it and/or modify it
	6	+ * under the terms of the GNU General Public License version 2 only, as
	7	+ * published by the Free Software Foundation. Oracle designates this
	8	+ * particular file as subject to the "Classpath" exception as provided
	9	+ * by Oracle in the LICENSE file that accompanied this code.
	10	+ *
	11	+ * This code is distributed in the hope that it will be useful, but WITHOUT
	12	+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
	13	+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
	14	+ * version 2 for more details (a copy is included in the LICENSE file that
	15	+ * accompanied this code).
	16	+ *
	17	+ * You should have received a copy of the GNU General Public License version
	18	+ * 2 along with this work; if not, write to the Free Software Foundation,
	19	+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
	20	+ *
	21	+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
	22	+ * or visit www.oracle.com if you need additional information or have any
	23	+ * questions.
	24	+ */
	25	+
	26	+package org.ietf.jgss;
	27	+
	28	+import sun.security.jgss.spi.*;
	29	+import java.io.InputStream;
	30	+import java.io.OutputStream;
	31	+
	32	+/**
	33	+ * This interface encapsulates the GSS-API security context and provides
	34	+ * the security services that are available over the context. Security
	35	+ * contexts are established between peers using locally acquired
	36	+ * credentials. Multiple contexts may exist simultaneously between a pair
	37	+ * of peers, using the same or different set of credentials. GSS-API
	38	+ * functions in a manner independent of the underlying transport protocol
	39	+ * and depends on its calling application to transport the tokens that are
	40	+ * generated by the security context between the peers.<p>
	41	+ *
	42	+ * If the caller instantiates the context using the default
	43	+ * <code>GSSManager</code> instance, then the Kerberos v5 GSS-API mechanism
	44	+ * is guaranteed to be available for context establishment. This mechanism
	45	+ * is identified by the Oid "1.2.840.113554.1.2.2" and is defined in RFC
	46	+ * 1964.<p>
	47	+ *
	48	+ * Before the context establishment phase is initiated, the context
	49	+ * initiator may request specific characteristics desired of the
	50	+ * established context. Not all underlying mechanisms support all
	51	+ * characteristics that a caller might desire. After the context is
	52	+ * established, the caller can check the actual characteristics and services
	53	+ * offered by that context by means of various query methods. When using
	54	+ * the Kerberos v5 GSS-API mechanism offered by the default
	55	+ * <code>GSSManager</code> instance, all optional services will be
	56	+ * available locally. They are mutual authentication, credential
	57	+ * delegation, confidentiality and integrity protection, and per-message
	58	+ * replay detection and sequencing. Note that in the GSS-API, message integrity
	59	+ * is a prerequisite for message confidentiality.<p>
	60	+ *
	61	+ * The context establishment occurs in a loop where the
	62	+ * initiator calls {@link #initSecContext(byte[], int, int) initSecContext}
	63	+ * and the acceptor calls {@link #acceptSecContext(byte[], int, int)
	64	+ * acceptSecContext} until the context is established. While in this loop
	65	+ * the <code>initSecContext</code> and <code>acceptSecContext</code>
	66	+ * methods produce tokens that the application sends over to the peer. The
	67	+ * peer passes any such token as input to its <code>acceptSecContext</code>
	68	+ * or <code>initSecContext</code> as the case may be.<p>
	69	+ *
	70	+ * During the context establishment phase, the {@link
	71	+ * #isProtReady() isProtReady} method may be called to determine if the
	72	+ * context can be used for the per-message operations of {@link
	73	+ * #wrap(byte[], int, int, MessageProp) wrap} and {@link #getMIC(byte[],
	74	+ * int, int, MessageProp) getMIC}. This allows applications to use
	75	+ * per-message operations on contexts which aren't yet fully
	76	+ * established.<p>
	77	+ *
	78	+ * After the context has been established or the <code>isProtReady</code>
	79	+ * method returns <code>true</code>, the query routines can be invoked to
	80	+ * determine the actual characteristics and services of the established
	81	+ * context. The application can also start using the per-message methods
	82	+ * of {@link #wrap(byte[], int, int, MessageProp) wrap} and
	83	+ * {@link #getMIC(byte[], int, int, MessageProp) getMIC} to obtain
	84	+ * cryptographic operations on application supplied data.<p>
	85	+ *
	86	+ * When the context is no longer needed, the application should call
	87	+ * {@link #dispose() dispose} to release any system resources the context
	88	+ * may be using.<p>
	89	+ *
	90	+ * A security context typically maintains sequencing and replay detection
	91	+ * information about the tokens it processes. Therefore, the sequence in
	92	+ * which any tokens are presented to this context for processing can be
	93	+ * important. Also note that none of the methods in this interface are
	94	+ * synchronized. Therefore, it is not advisable to share a
	95	+ * <code>GSSContext</code> among several threads unless some application
	96	+ * level synchronization is in place.<p>
	97	+ *
	98	+ * Finally, different mechanism providers might place different security
	99	+ * restrictions on using GSS-API contexts. These will be documented by the
	100	+ * mechanism provider. The application will need to ensure that it has the
	101	+ * appropriate permissions if such checks are made in the mechanism layer.<p>
	102	+ *
	103	+ * The example code presented below demonstrates the usage of the
	104	+ * <code>GSSContext</code> interface for the initiating peer. Different
	105	+ * operations on the <code>GSSContext</code> object are presented,
	106	+ * including: object instantiation, setting of desired flags, context
	107	+ * establishment, query of actual context flags, per-message operations on
	108	+ * application data, and finally context deletion.<p>
	109	+ *
	110	+ * <pre>
	111	+ * // Create a context using default credentials
	112	+ * // and the implementation specific default mechanism
	113	+ * GSSManager manager ...
	114	+ * GSSName targetName ...
	115	+ * GSSContext context = manager.createContext(targetName, null, null,
	116	+ * GSSContext.INDEFINITE_LIFETIME);
	117	+ *
	118	+ * // set desired context options prior to context establishment
	119	+ * context.requestConf(true);
	120	+ * context.requestMutualAuth(true);
	121	+ * context.requestReplayDet(true);
	122	+ * context.requestSequenceDet(true);
	123	+ *
	124	+ * // establish a context between peers
	125	+ *
	126	+ * byte []inToken = new byte[0];
	127	+ *
	128	+ * // Loop while there still is a token to be processed
	129	+ *
	130	+ * while (!context.isEstablished()) {
	131	+ *
	132	+ * byte[] outToken
	133	+ * = context.initSecContext(inToken, 0, inToken.length);
	134	+ *
	135	+ * // send the output token if generated
	136	+ * if (outToken != null)
	137	+ * sendToken(outToken);
	138	+ *
	139	+ * if (!context.isEstablished()) {
	140	+ * inToken = readToken();
	141	+ * }
	142	+ *
	143	+ * // display context information
	144	+ * System.out.println("Remaining lifetime in seconds = "
	145	+ * + context.getLifetime());
	146	+ * System.out.println("Context mechanism = " + context.getMech());
	147	+ * System.out.println("Initiator = " + context.getSrcName());
	148	+ * System.out.println("Acceptor = " + context.getTargName());
	149	+ *
	150	+ * if (context.getConfState())
	151	+ * System.out.println("Confidentiality (i.e., privacy) is available");
	152	+ *
	153	+ * if (context.getIntegState())
	154	+ * System.out.println("Integrity is available");
	155	+ *
	156	+ * // perform wrap on an application supplied message, appMsg,
	157	+ * // using QOP = 0, and requesting privacy service
	158	+ * byte [] appMsg ...
	159	+ *
	160	+ * MessageProp mProp = new MessageProp(0, true);
	161	+ *
	162	+ * byte []tok = context.wrap(appMsg, 0, appMsg.length, mProp);
	163	+ *
	164	+ * sendToken(tok);
	165	+ *
	166	+ * // release the local-end of the context
	167	+ * context.dispose();
	168	+ *
	169	+ * </pre>
	170	+ *
	171	+ * @author Mayank Upadhyay
	172	+ * @since 1.4
	173	+ */
	174	+public interface GSSContext {
	175	+
	176	+ /**
	177	+ * A lifetime constant representing the default context lifetime. This
	178	+ * value is set to 0.
	179	+ */
	180	+ public static final int DEFAULT_LIFETIME = 0;
	181	+
	182	+ /**
	183	+ * A lifetime constant representing indefinite context lifetime.
	184	+ * This value must is set to the maximum integer value in Java -
	185	+ * {@link java.lang.Integer#MAX_VALUE Integer.MAX_VALUE}.
	186	+ */
	187	+ public static final int INDEFINITE_LIFETIME = Integer.MAX_VALUE;
	188	+
	189	+ /**
	190	+ * Called by the context initiator to start the context creation
	191	+ * phase and process any tokens generated
	192	+ * by the peer's <code>acceptSecContext</code> method.
	193	+ * This method may return an output token which the application will need
	194	+ * to send to the peer for processing by its <code>acceptSecContext</code>
	195	+ * method. The application can call {@link #isEstablished()
	196	+ * isEstablished} to determine if the context establishment phase is
	197	+ * complete on this side of the context. A return value of
	198	+ * <code>false</code> from <code>isEstablished</code> indicates that
	199	+ * more tokens are expected to be supplied to
	200	+ * <code>initSecContext</code>. Upon completion of the context
	201	+ * establishment, the available context options may be queried through
	202	+ * the get methods.<p>
	203	+ *
	204	+ * Note that it is possible that the <code>initSecContext</code> method
	205	+ * return a token for the peer, and <code>isEstablished</code> return
	206	+ * <code>true</code> also. This indicates that the token needs to be sent
	207	+ * to the peer, but the local end of the context is now fully
	208	+ * established.<p>
	209	+ *
	210	+ * Some mechanism providers might require that the caller be granted
	211	+ * permission to initiate a security context. A failed permission check
	212	+ * might cause a {@link java.lang.SecurityException SecurityException}
	213	+ * to be thrown from this method.<p>
	214	+ *
	215	+ * @return a byte[] containing the token to be sent to the
	216	+ * peer. <code>null</code> indicates that no token is generated.
	217	+ * @param inputBuf token generated by the peer. This parameter is ignored
	218	+ * on the first call since no token has been received from the peer.
	219	+ * @param offset the offset within the inputBuf where the token begins.
	220	+ * @param len the length of the token.
	221	+ *
	222	+ * @throws GSSException containing the following
	223	+ * major error codes:
	224	+ * {@link GSSException#DEFECTIVE_TOKEN GSSException.DEFECTIVE_TOKEN},
	225	+ * {@link GSSException#BAD_MIC GSSException.BAD_MIC},
	226	+ * {@link GSSException#NO_CRED GSSException.NO_CRED},
	227	+ * {@link GSSException#CREDENTIALS_EXPIRED
	228	+ * GSSException.CREDENTIALS_EXPIRED},
	229	+ * {@link GSSException#BAD_BINDINGS GSSException.BAD_BINDINGS},
	230	+ * {@link GSSException#OLD_TOKEN GSSException.OLD_TOKEN},
	231	+ * {@link GSSException#DUPLICATE_TOKEN GSSException.DUPLICATE_TOKEN},
	232	+ * {@link GSSException#BAD_NAMETYPE GSSException.BAD_NAMETYPE},
	233	+ * {@link GSSException#BAD_MECH GSSException.BAD_MECH},
	234	+ * {@link GSSException#FAILURE GSSException.FAILURE}
	235	+ */
	236	+ public byte[] initSecContext(byte inputBuf[], int offset, int len)
	237	+ throws GSSException;
	238	+
	239	+ /**
	240	+ * Called by the context initiator to start the context creation
	241	+ * phase and process any tokens generated
	242	+ * by the peer's <code>acceptSecContext</code> method using
	243	+ * streams. This method may write an output token to the
	244	+ * <code>OutpuStream</code>, which the application will
	245	+ * need to send to the peer for processing by its
	246	+ * <code>acceptSecContext</code> call. Typically, the application would
	247	+ * ensure this by calling the {@link java.io.OutputStream#flush() flush}
	248	+ * method on an <code>OutputStream</code> that encapsulates the
	249	+ * connection between the two peers. The application can
	250	+ * determine if a token is written to the OutputStream from the return
	251	+ * value of this method. A return value of <code>0</code> indicates that
	252	+ * no token was written. The application can call
	253	+ * {@link #isEstablished() isEstablished} to determine if the context
	254	+ * establishment phase is complete on this side of the context. A
	255	+ * return value of <code>false</code> from <code>isEstablished</code>
	256	+ * indicates that more tokens are expected to be supplied to
	257	+ * <code>initSecContext</code>.
	258	+ * Upon completion of the context establishment, the available context
	259	+ * options may be queried through the get methods.<p>
	260	+ *
	261	+ * Note that it is possible that the <code>initSecContext</code> method
	262	+ * return a token for the peer, and <code>isEstablished</code> return
	263	+ * <code>true</code> also. This indicates that the token needs to be sent
	264	+ * to the peer, but the local end of the context is now fully
	265	+ * established.<p>
	266	+ *
	267	+ * The GSS-API authentication tokens contain a definitive start and
	268	+ * end. This method will attempt to read one of these tokens per
	269	+ * invocation, and may block on the stream if only part of the token is
	270	+ * available. In all other respects this method is equivalent to the
	271	+ * byte array based {@link #initSecContext(byte[], int, int)
	272	+ * initSecContext}.<p>
	273	+ *
	274	+ * Some mechanism providers might require that the caller be granted
	275	+ * permission to initiate a security context. A failed permission check
	276	+ * might cause a {@link java.lang.SecurityException SecurityException}
	277	+ * to be thrown from this method.<p>
	278	+ *
	279	+ * The following example code demonstrates how this method might be
	280	+ * used:<p>
	281	+ * <pre>
	282	+ * InputStream is ...
	283	+ * OutputStream os ...
	284	+ * GSSContext context ...
	285	+ *
	286	+ * // Loop while there is still a token to be processed
	287	+ *
	288	+ * while (!context.isEstablished()) {
	289	+ *
	290	+ * context.initSecContext(is, os);
	291	+ *
	292	+ * // send output token if generated
	293	+ * os.flush();
	294	+ * }
	295	+ * </pre>
	296	+ *
	297	+ *
	298	+ * @return the number of bytes written to the OutputStream as part of the
	299	+ * token to be sent to the peer. A value of 0 indicates that no token
	300	+ * needs to be sent.
	301	+ * @param inStream an InputStream that contains the token generated by
	302	+ * the peer. This parameter is ignored on the first call since no token
	303	+ * has been or will be received from the peer at that point.
	304	+ * @param outStream an OutputStream where the output token will be
	305	+ * written. During the final stage of context establishment, there may be
	306	+ * no bytes written.
	307	+ *
	308	+ * @throws GSSException containing the following
	309	+ * major error codes:
	310	+ * {@link GSSException#DEFECTIVE_TOKEN GSSException.DEFECTIVE_TOKEN},
	311	+ * {@link GSSException#BAD_MIC GSSException.BAD_MIC},
	312	+ * {@link GSSException#NO_CRED GSSException.NO_CRED},
	313	+ * {@link GSSException#CREDENTIALS_EXPIRED GSSException.CREDENTIALS_EXPIRED},
	314	+ * {@link GSSException#BAD_BINDINGS GSSException.BAD_BINDINGS},
	315	+ * {@link GSSException#OLD_TOKEN GSSException.OLD_TOKEN},
	316	+ * {@link GSSException#DUPLICATE_TOKEN GSSException.DUPLICATE_TOKEN},
	317	+ * {@link GSSException#BAD_NAMETYPE GSSException.BAD_NAMETYPE},
	318	+ * {@link GSSException#BAD_MECH GSSException.BAD_MECH},
	319	+ * {@link GSSException#FAILURE GSSException.FAILURE}
	320	+ */
	321	+ public int initSecContext(InputStream inStream,
	322	+ OutputStream outStream) throws GSSException;
	323	+
	324	+ /**
	325	+ * Called by the context acceptor upon receiving a token from the
	326	+ * peer. This method may return an output token which the application
	327	+ * will need to send to the peer for further processing by its
	328	+ * <code>initSecContext</code> call.<p>
	329	+ *
	330	+ * The application can call {@link #isEstablished() isEstablished} to
	331	+ * determine if the context establishment phase is complete for this
	332	+ * peer. A return value of <code>false</code> from
	333	+ * <code>isEstablished</code> indicates that more tokens are expected to
	334	+ * be supplied to this method. Upon completion of the context
	335	+ * establishment, the available context options may be queried through
	336	+ * the get methods.<p>
	337	+ *
	338	+ * Note that it is possible that <code>acceptSecContext</code> return a
	339	+ * token for the peer, and <code>isEstablished</code> return
	340	+ * <code>true</code> also. This indicates that the token needs to be
	341	+ * sent to the peer, but the local end of the context is now fully
	342	+ * established.<p>
	343	+ *
	344	+ * Some mechanism providers might require that the caller be granted
	345	+ * permission to accept a security context. A failed permission check
	346	+ * might cause a {@link java.lang.SecurityException SecurityException}
	347	+ * to be thrown from this method.<p>
	348	+ *
	349	+ * The following example code demonstrates how this method might be
	350	+ * used:<p>
	351	+ * <pre>
	352	+ * byte[] inToken;
	353	+ * byte[] outToken;
	354	+ * GSSContext context ...
	355	+ *
	356	+ * // Loop while there is still a token to be processed
	357	+ *
	358	+ * while (!context.isEstablished()) {
	359	+ * inToken = readToken();
	360	+ * outToken = context.acceptSecContext(inToken, 0,
	361	+ * inToken.length);
	362	+ * // send output token if generated
	363	+ * if (outToken != null)
	364	+ * sendToken(outToken);
	365	+ * }
	366	+ * </pre>
	367	+ *
	368	+ *
	369	+ * @return a byte[] containing the token to be sent to the
	370	+ * peer. <code>null</code> indicates that no token is generated.
	371	+ * @param inToken token generated by the peer.
	372	+ * @param offset the offset within the inToken where the token begins.
	373	+ * @param len the length of the token.
	374	+ *
	375	+ * @throws GSSException containing the following
	376	+ * major error codes:
	377	+ * {@link GSSException#DEFECTIVE_TOKEN GSSException.DEFECTIVE_TOKEN},
	378	+ * {@link GSSException#BAD_MIC GSSException.BAD_MIC},
	379	+ * {@link GSSException#NO_CRED GSSException.NO_CRED},
	380	+ * {@link GSSException#CREDENTIALS_EXPIRED
	381	+ * GSSException.CREDENTIALS_EXPIRED},
	382	+ * {@link GSSException#BAD_BINDINGS GSSException.BAD_BINDINGS},
	383	+ * {@link GSSException#OLD_TOKEN GSSException.OLD_TOKEN},
	384	+ * {@link GSSException#DUPLICATE_TOKEN GSSException.DUPLICATE_TOKEN},
	385	+ * {@link GSSException#BAD_MECH GSSException.BAD_MECH},
	386	+ * {@link GSSException#FAILURE GSSException.FAILURE}
	387	+ */
	388	+ public byte[] acceptSecContext(byte inToken[], int offset, int len)
	389	+ throws GSSException;
	390	+
	391	+ /**
	392	+ * Called by the context acceptor to process a token from the peer using
	393	+ * streams. It may write an output token to the
	394	+ * <code>OutputStream</code>, which the application
	395	+ * will need to send to the peer for processing by its
	396	+ * <code>initSecContext</code> method. Typically, the application would
	397	+ * ensure this by calling the {@link java.io.OutputStream#flush() flush}
	398	+ * method on an <code>OutputStream</code> that encapsulates the
	399	+ * connection between the two peers. The application can call
	400	+ * {@link #isEstablished() isEstablished} to determine if the context
	401	+ * establishment phase is complete on this side of the context. A
	402	+ * return value of <code>false</code> from <code>isEstablished</code>
	403	+ * indicates that more tokens are expected to be supplied to
	404	+ * <code>acceptSecContext</code>.
	405	+ * Upon completion of the context establishment, the available context
	406	+ * options may be queried through the get methods.<p>
	407	+ *
	408	+ * Note that it is possible that <code>acceptSecContext</code> return a
	409	+ * token for the peer, and <code>isEstablished</code> return
	410	+ * <code>true</code> also. This indicates that the token needs to be
	411	+ * sent to the peer, but the local end of the context is now fully
	412	+ * established.<p>
	413	+ *
	414	+ * The GSS-API authentication tokens contain a definitive start and
	415	+ * end. This method will attempt to read one of these tokens per
	416	+ * invocation, and may block on the stream if only part of the token is
	417	+ * available. In all other respects this method is equivalent to the byte
	418	+ * array based {@link #acceptSecContext(byte[], int, int)
	419	+ * acceptSecContext}.<p>
	420	+ *
	421	+ * Some mechanism providers might require that the caller be granted
	422	+ * permission to accept a security context. A failed permission check
	423	+ * might cause a {@link java.lang.SecurityException SecurityException}
	424	+ * to be thrown from this method.<p>
	425	+ *
	426	+ * The following example code demonstrates how this method might be
	427	+ * used:<p>
	428	+ * <pre>
	429	+ * InputStream is ...
	430	+ * OutputStream os ...
	431	+ * GSSContext context ...
	432	+ *
	433	+ * // Loop while there is still a token to be processed
	434	+ *
	435	+ * while (!context.isEstablished()) {
	436	+ *
	437	+ * context.acceptSecContext(is, os);
	438	+ *
	439	+ * // send output token if generated
	440	+ * os.flush();
	441	+ * }
	442	+ * </pre>
	443	+ *
	444	+ *
	445	+ * @param inStream an InputStream that contains the token generated by
	446	+ * the peer.
	447	+ * @param outStream an OutputStream where the output token will be
	448	+ * written. During the final stage of context establishment, there may be
	449	+ * no bytes written.
	450	+ *
	451	+ * @throws GSSException containing the following
	452	+ * major error codes:
	453	+ * {@link GSSException#DEFECTIVE_TOKEN GSSException.DEFECTIVE_TOKEN},
	454	+ * {@link GSSException#BAD_MIC GSSException.BAD_MIC},
	455	+ * {@link GSSException#NO_CRED GSSException.NO_CRED},
	456	+ * {@link GSSException#CREDENTIALS_EXPIRED
	457	+ * GSSException.CREDENTIALS_EXPIRED},
	458	+ * {@link GSSException#BAD_BINDINGS GSSException.BAD_BINDINGS},
	459	+ * {@link GSSException#OLD_TOKEN GSSException.OLD_TOKEN},
	460	+ * {@link GSSException#DUPLICATE_TOKEN GSSException.DUPLICATE_TOKEN},
	461	+ * {@link GSSException#BAD_MECH GSSException.BAD_MECH},
	462	+ * {@link GSSException#FAILURE GSSException.FAILURE}
	463	+ */
	464	+ /* Missing return value in RFC. int should have been returned.
	465	+ * -----------------------------------------------------------
	466	+ *
	467	+ * The application can determine if a token is written to the
	468	+ * OutputStream from the return value of this method. A return value of
	469	+ * <code>0</code> indicates that no token was written.
	470	+ *
	471	+ * @return <strong>the number of bytes written to the
	472	+ * OutputStream as part of the token to be sent to the peer. A value of
	473	+ * 0 indicates that no token needs to be
	474	+ * sent.</strong>
	475	+ */
	476	+ public void acceptSecContext(InputStream inStream,
	477	+ OutputStream outStream) throws GSSException;
	478	+
	479	+ /**
	480	+ * Used during context establishment to determine the state of the
	481	+ * context.
	482	+ *
	483	+ * @return <code>true</code> if this is a fully established context on
	484	+ * the caller's side and no more tokens are needed from the peer.
	485	+ */
	486	+ public boolean isEstablished();
	487	+
	488	+ /**
	489	+ * Releases any system resources and cryptographic information stored in
	490	+ * the context object and invalidates the context.
	491	+ *
	492	+ *
	493	+ * @throws GSSException containing the following
	494	+ * major error codes:
	495	+ * {@link GSSException#FAILURE GSSException.FAILURE}
	496	+ */
	497	+ public void dispose() throws GSSException;
	498	+
	499	+ /**
	500	+ * Used to determine limits on the size of the message
	501	+ * that can be passed to <code>wrap</code>. Returns the maximum
	502	+ * message size that, if presented to the <code>wrap</code> method with
	503	+ * the same <code>confReq</code> and <code>qop</code> parameters, will
	504	+ * result in an output token containing no more
	505	+ * than <code>maxTokenSize</code> bytes.<p>
	506	+ *
	507	+ * This call is intended for use by applications that communicate over
	508	+ * protocols that impose a maximum message size. It enables the
	509	+ * application to fragment messages prior to applying protection.<p>
	510	+ *
	511	+ * GSS-API implementations are recommended but not required to detect
	512	+ * invalid QOP values when <code>getWrapSizeLimit</code> is called.
	513	+ * This routine guarantees only a maximum message size, not the
	514	+ * availability of specific QOP values for message protection.<p>
	515	+ *
	516	+ * @param qop the level of protection wrap will be asked to provide.
	517	+ * @param confReq <code>true</code> if wrap will be asked to provide
	518	+ * privacy, <code>false</code> otherwise.
	519	+ * @param maxTokenSize the desired maximum size of the token emitted by
	520	+ * wrap.
	521	+ * @return the maximum size of the input token for the given output
	522	+ * token size
	523	+ *
	524	+ * @throws GSSException containing the following
	525	+ * major error codes:
	526	+ * {@link GSSException#CONTEXT_EXPIRED GSSException.CONTEXT_EXPIRED},
	527	+ * {@link GSSException#BAD_QOP GSSException.BAD_QOP},
	528	+ * {@link GSSException#FAILURE GSSException.FAILURE}
	529	+ */
	530	+ public int getWrapSizeLimit(int qop, boolean confReq,
	531	+ int maxTokenSize) throws GSSException;
	532	+
	533	+ /**
	534	+ * Applies per-message security services over the established security
	535	+ * context. The method will return a token with the
	536	+ * application supplied data and a cryptographic MIC over it.
	537	+ * The data may be encrypted if confidentiality (privacy) was
	538	+ * requested.<p>
	539	+ *
	540	+ * The MessageProp object is instantiated by the application and used
	541	+ * to specify a QOP value which selects cryptographic algorithms, and a
	542	+ * privacy service to optionally encrypt the message. The underlying
	543	+ * mechanism that is used in the call may not be able to provide the
	544	+ * privacy service. It sets the actual privacy service that it does
	545	+ * provide in this MessageProp object which the caller should then
	546	+ * query upon return. If the mechanism is not able to provide the
	547	+ * requested QOP, it throws a GSSException with the BAD_QOP code.<p>
	548	+ *
	549	+ * Since some application-level protocols may wish to use tokens
	550	+ * emitted by wrap to provide "secure framing", implementations should
	551	+ * support the wrapping of zero-length messages.<p>
	552	+ *
	553	+ * The application will be responsible for sending the token to the
	554	+ * peer.
	555	+ *
	556	+ * @param inBuf application data to be protected.
	557	+ * @param offset the offset within the inBuf where the data begins.
	558	+ * @param len the length of the data
	559	+ * @param msgProp instance of MessageProp that is used by the
	560	+ * application to set the desired QOP and privacy state. Set the
	561	+ * desired QOP to 0 to request the default QOP. Upon return from this
	562	+ * method, this object will contain the the actual privacy state that
	563	+ * was applied to the message by the underlying mechanism.
	564	+ * @return a byte[] containing the token to be sent to the peer.
	565	+ *
	566	+ * @throws GSSException containing the following major error codes:
	567	+ * {@link GSSException#CONTEXT_EXPIRED GSSException.CONTEXT_EXPIRED},
	568	+ * {@link GSSException#BAD_QOP GSSException.BAD_QOP},
	569	+ * {@link GSSException#FAILURE GSSException.FAILURE}
	570	+ */
	571	+ public byte[] wrap(byte inBuf[], int offset, int len,
	572	+ MessageProp msgProp) throws GSSException;
	573	+
	574	+ /**
	575	+ * Applies per-message security services over the established security
	576	+ * context using streams. The method will return a
	577	+ * token with the application supplied data and a cryptographic MIC over it.
	578	+ * The data may be encrypted if confidentiality
	579	+ * (privacy) was requested. This method is equivalent to the byte array
	580	+ * based {@link #wrap(byte[], int, int, MessageProp) wrap} method.<p>
	581	+ *
	582	+ * The application will be responsible for sending the token to the
	583	+ * peer. Typically, the application would
	584	+ * ensure this by calling the {@link java.io.OutputStream#flush() flush}
	585	+ * method on an <code>OutputStream</code> that encapsulates the
	586	+ * connection between the two peers.<p>
	587	+ *
	588	+ * The MessageProp object is instantiated by the application and used
	589	+ * to specify a QOP value which selects cryptographic algorithms, and a
	590	+ * privacy service to optionally encrypt the message. The underlying
	591	+ * mechanism that is used in the call may not be able to provide the
	592	+ * privacy service. It sets the actual privacy service that it does
	593	+ * provide in this MessageProp object which the caller should then
	594	+ * query upon return. If the mechanism is not able to provide the
	595	+ * requested QOP, it throws a GSSException with the BAD_QOP code.<p>
	596	+ *
	597	+ * Since some application-level protocols may wish to use tokens
	598	+ * emitted by wrap to provide "secure framing", implementations should
	599	+ * support the wrapping of zero-length messages.<p>
	600	+ *
	601	+ * @param inStream an InputStream containing the application data to be
	602	+ * protected. All of the data that is available in
	603	+ * inStream is used.
	604	+ * @param outStream an OutputStream to write the protected message
	605	+ * to.
	606	+ * @param msgProp instance of MessageProp that is used by the
	607	+ * application to set the desired QOP and privacy state. Set the
	608	+ * desired QOP to 0 to request the default QOP. Upon return from this
	609	+ * method, this object will contain the the actual privacy state that
	610	+ * was applied to the message by the underlying mechanism.
	611	+ *
	612	+ * @throws GSSException containing the following
	613	+ * major error codes:
	614	+ * {@link GSSException#CONTEXT_EXPIRED GSSException.CONTEXT_EXPIRED},
	615	+ * {@link GSSException#BAD_QOP GSSException.BAD_QOP},
	616	+ * {@link GSSException#FAILURE GSSException.FAILURE}
	617	+ */
	618	+ public void wrap(InputStream inStream, OutputStream outStream,
	619	+ MessageProp msgProp) throws GSSException;
	620	+
	621	+ /**
	622	+ * Used to process tokens generated by the <code>wrap</code> method on
	623	+ * the other side of the context. The method will return the message
	624	+ * supplied by the peer application to its wrap call, while at the same
	625	+ * time verifying the embedded MIC for that message.<p>
	626	+ *
	627	+ * The MessageProp object is instantiated by the application and is
	628	+ * used by the underlying mechanism to return information to the caller
	629	+ * such as the QOP, whether confidentiality was applied to the message,
	630	+ * and other supplementary message state information.<p>
	631	+ *
	632	+ * Since some application-level protocols may wish to use tokens
	633	+ * emitted by wrap to provide "secure framing", implementations should
	634	+ * support the wrapping and unwrapping of zero-length messages.<p>
	635	+ *
	636	+ * @param inBuf a byte array containing the wrap token received from
	637	+ * peer.
	638	+ * @param offset the offset where the token begins.
	639	+ * @param len the length of the token
	640	+ * @param msgProp upon return from the method, this object will contain
	641	+ * the applied QOP, the privacy state of the message, and supplementary
	642	+ * information stating if the token was a duplicate, old, out of
	643	+ * sequence or arriving after a gap.
	644	+ * @return a byte[] containing the message unwrapped from the input
	645	+ * token.
	646	+ *
	647	+ * @throws GSSException containing the following
	648	+ * major error codes:
	649	+ * {@link GSSException#DEFECTIVE_TOKEN GSSException.DEFECTIVE_TOKEN},
	650	+ * {@link GSSException#BAD_MIC GSSException.BAD_MIC},
	651	+ * {@link GSSException#CONTEXT_EXPIRED GSSException.CONTEXT_EXPIRED},
	652	+ * {@link GSSException#FAILURE GSSException.FAILURE}
	653	+ */
	654	+ public byte [] unwrap(byte[] inBuf, int offset, int len,
	655	+ MessageProp msgProp) throws GSSException;
	656	+
	657	+ /**
	658	+ * Uses streams to process tokens generated by the <code>wrap</code>
	659	+ * method on the other side of the context. The method will return the
	660	+ * message supplied by the peer application to its wrap call, while at
	661	+ * the same time verifying the embedded MIC for that message.<p>
	662	+ *
	663	+ * The MessageProp object is instantiated by the application and is
	664	+ * used by the underlying mechanism to return information to the caller
	665	+ * such as the QOP, whether confidentiality was applied to the message,
	666	+ * and other supplementary message state information.<p>
	667	+ *
	668	+ * Since some application-level protocols may wish to use tokens
	669	+ * emitted by wrap to provide "secure framing", implementations should
	670	+ * support the wrapping and unwrapping of zero-length messages.<p>
	671	+ *
	672	+ * The format of the input token that this method
	673	+ * reads is defined in the specification for the underlying mechanism that
	674	+ * will be used. This method will attempt to read one of these tokens per
	675	+ * invocation. If the mechanism token contains a definitive start and
	676	+ * end this method may block on the <code>InputStream</code> if only
	677	+ * part of the token is available. If the start and end of the token
	678	+ * are not definitive then the method will attempt to treat all
	679	+ * available bytes as part of the token.<p>
	680	+ *
	681	+ * Other than the possible blocking behavior described above, this
	682	+ * method is equivalent to the byte array based {@link #unwrap(byte[],
	683	+ * int, int, MessageProp) unwrap} method.<p>
	684	+ *
	685	+ * @param inStream an InputStream that contains the wrap token generated
	686	+ * by the peer.
	687	+ * @param outStream an OutputStream to write the application message
	688	+ * to.
	689	+ * @param msgProp upon return from the method, this object will contain
	690	+ * the applied QOP, the privacy state of the message, and supplementary
	691	+ * information stating if the token was a duplicate, old, out of
	692	+ * sequence or arriving after a gap.
	693	+ *
	694	+ * @throws GSSException containing the following
	695	+ * major error codes:
	696	+ * {@link GSSException#DEFECTIVE_TOKEN GSSException.DEFECTIVE_TOKEN},
	697	+ * {@link GSSException#BAD_MIC GSSException.BAD_MIC},
	698	+ * {@link GSSException#CONTEXT_EXPIRED GSSException.CONTEXT_EXPIRED},
	699	+ * {@link GSSException#FAILURE GSSException.FAILURE}
	700	+ */
	701	+ public void unwrap(InputStream inStream, OutputStream outStream,
	702	+ MessageProp msgProp) throws GSSException;
	703	+
	704	+ /**
	705	+ * Returns a token containing a cryptographic Message Integrity Code
	706	+ * (MIC) for the supplied message, for transfer to the peer
	707	+ * application. Unlike wrap, which encapsulates the user message in the
	708	+ * returned token, only the message MIC is returned in the output
	709	+ * token.<p>
	710	+ *
	711	+ * Note that privacy can only be applied through the wrap call.<p>
	712	+ *
	713	+ * Since some application-level protocols may wish to use tokens emitted
	714	+ * by getMIC to provide "secure framing", implementations should support
	715	+ * derivation of MICs from zero-length messages.
	716	+ *
	717	+ * @param inMsg the message to generate the MIC over.
	718	+ * @param offset offset within the inMsg where the message begins.
	719	+ * @param len the length of the message
	720	+ * @param msgProp an instance of <code>MessageProp</code> that is used
	721	+ * by the application to set the desired QOP. Set the desired QOP to
	722	+ * <code>0</code> in <code>msgProp</code> to request the default
	723	+ * QOP. Alternatively pass in <code>null</code> for <code>msgProp</code>
	724	+ * to request the default QOP.
	725	+ * @return a byte[] containing the token to be sent to the peer.
	726	+ *
	727	+ * @throws GSSException containing the following
	728	+ * major error codes:
	729	+ * {@link GSSException#CONTEXT_EXPIRED GSSException.CONTEXT_EXPIRED},
	730	+ * {@link GSSException#BAD_QOP GSSException.BAD_QOP},
	731	+ * {@link GSSException#FAILURE GSSException.FAILURE}
	732	+ */
	733	+ public byte[] getMIC(byte []inMsg, int offset, int len,
	734	+ MessageProp msgProp) throws GSSException;
	735	+
	736	+ /**
	737	+ * Uses streams to produce a token containing a cryptographic MIC for
	738	+ * the supplied message, for transfer to the peer application.
	739	+ * Unlike wrap, which encapsulates the user message in the returned
	740	+ * token, only the message MIC is produced in the output token. This
	741	+ * method is equivalent to the byte array based {@link #getMIC(byte[],
	742	+ * int, int, MessageProp) getMIC} method.
	743	+ *
	744	+ * Note that privacy can only be applied through the wrap call.<p>
	745	+ *
	746	+ * Since some application-level protocols may wish to use tokens emitted
	747	+ * by getMIC to provide "secure framing", implementations should support
	748	+ * derivation of MICs from zero-length messages.
	749	+ *
	750	+ * @param inStream an InputStream containing the message to generate the
	751	+ * MIC over. All of the data that is available in
	752	+ * inStream is used.
	753	+ * @param outStream an OutputStream to write the output token to.
	754	+ * @param msgProp an instance of <code>MessageProp</code> that is used
	755	+ * by the application to set the desired QOP. Set the desired QOP to
	756	+ * <code>0</code> in <code>msgProp</code> to request the default
	757	+ * QOP. Alternatively pass in <code>null</code> for <code>msgProp</code>
	758	+ * to request the default QOP.
	759	+ *
	760	+ * @throws GSSException containing the following
	761	+ * major error codes:
	762	+ * {@link GSSException#CONTEXT_EXPIRED GSSException.CONTEXT_EXPIRED},
	763	+ * {@link GSSException#BAD_QOP GSSException.BAD_QOP},
	764	+ * {@link GSSException#FAILURE GSSException.FAILURE}
	765	+ */
	766	+ public void getMIC(InputStream inStream, OutputStream outStream,
	767	+ MessageProp msgProp) throws GSSException;
	768	+
	769	+ /**
	770	+ * Verifies the cryptographic MIC, contained in the token parameter,
	771	+ * over the supplied message.<p>
	772	+ *
	773	+ * The MessageProp object is instantiated by the application and is used
	774	+ * by the underlying mechanism to return information to the caller such
	775	+ * as the QOP indicating the strength of protection that was applied to
	776	+ * the message and other supplementary message state information.<p>
	777	+ *
	778	+ * Since some application-level protocols may wish to use tokens emitted
	779	+ * by getMIC to provide "secure framing", implementations should support
	780	+ * the calculation and verification of MICs over zero-length messages.
	781	+ *
	782	+ * @param inToken the token generated by peer's getMIC method.
	783	+ * @param tokOffset the offset within the inToken where the token
	784	+ * begins.
	785	+ * @param tokLen the length of the token.
	786	+ * @param inMsg the application message to verify the cryptographic MIC
	787	+ * over.
	788	+ * @param msgOffset the offset in inMsg where the message begins.
	789	+ * @param msgLen the length of the message.
	790	+ * @param msgProp upon return from the method, this object will contain
	791	+ * the applied QOP and supplementary information stating if the token
	792	+ * was a duplicate, old, out of sequence or arriving after a gap.
	793	+ *
	794	+ * @throws GSSException containing the following
	795	+ * major error codes:
	796	+ * {@link GSSException#DEFECTIVE_TOKEN GSSException.DEFECTIVE_TOKEN}
	797	+ * {@link GSSException#BAD_MIC GSSException.BAD_MIC}
	798	+ * {@link GSSException#CONTEXT_EXPIRED GSSException.CONTEXT_EXPIRED}
	799	+ * {@link GSSException#FAILURE GSSException.FAILURE}
	800	+ */
	801	+ public void verifyMIC(byte[] inToken, int tokOffset, int tokLen,
	802	+ byte[] inMsg, int msgOffset, int msgLen,
	803	+ MessageProp msgProp) throws GSSException;
	804	+
	805	+ /**
	806	+ * Uses streams to verify the cryptographic MIC, contained in the token
	807	+ * parameter, over the supplied message. This method is equivalent to
	808	+ * the byte array based {@link #verifyMIC(byte[], int, int, byte[], int,
	809	+ * int, MessageProp) verifyMIC} method.
	810	+ *
	811	+ * The MessageProp object is instantiated by the application and is used
	812	+ * by the underlying mechanism to return information to the caller such
	813	+ * as the QOP indicating the strength of protection that was applied to
	814	+ * the message and other supplementary message state information.<p>
	815	+ *
	816	+ * Since some application-level protocols may wish to use tokens emitted
	817	+ * by getMIC to provide "secure framing", implementations should support
	818	+ * the calculation and verification of MICs over zero-length messages.<p>
	819	+ *
	820	+ * The format of the input token that this method
	821	+ * reads is defined in the specification for the underlying mechanism that
	822	+ * will be used. This method will attempt to read one of these tokens per
	823	+ * invocation. If the mechanism token contains a definitive start and
	824	+ * end this method may block on the <code>InputStream</code> if only
	825	+ * part of the token is available. If the start and end of the token
	826	+ * are not definitive then the method will attempt to treat all
	827	+ * available bytes as part of the token.<p>
	828	+ *
	829	+ * Other than the possible blocking behavior described above, this
	830	+ * method is equivalent to the byte array based {@link #verifyMIC(byte[],
	831	+ * int, int, byte[], int, int, MessageProp) verifyMIC} method.<p>
	832	+ *
	833	+ * @param tokStream an InputStream containing the token generated by the
	834	+ * peer's getMIC method.
	835	+ * @param msgStream an InputStream containing the application message to
	836	+ * verify the cryptographic MIC over. All of the data
	837	+ * that is available in msgStream is used.
	838	+ * @param msgProp upon return from the method, this object will contain
	839	+ * the applied QOP and supplementary information stating if the token
	840	+ * was a duplicate, old, out of sequence or arriving after a gap.
	841	+ *
	842	+ * @throws GSSException containing the following
	843	+ * major error codes:
	844	+ * {@link GSSException#DEFECTIVE_TOKEN GSSException.DEFECTIVE_TOKEN}
	845	+ * {@link GSSException#BAD_MIC GSSException.BAD_MIC}
	846	+ * {@link GSSException#CONTEXT_EXPIRED GSSException.CONTEXT_EXPIRED}
	847	+ * {@link GSSException#FAILURE GSSException.FAILURE}
	848	+ */
	849	+ public void verifyMIC(InputStream tokStream, InputStream msgStream,
	850	+ MessageProp msgProp) throws GSSException;
	851	+
	852	+ /**
	853	+ * Exports this context so that another process may
	854	+ * import it.. Provided to support the sharing of work between
	855	+ * multiple processes. This routine will typically be used by the
	856	+ * context-acceptor, in an application where a single process receives
	857	+ * incoming connection requests and accepts security contexts over
	858	+ * them, then passes the established context to one or more other
	859	+ * processes for message exchange.<p>
	860	+ *
	861	+ * This method deactivates the security context and creates an
	862	+ * interprocess token which, when passed to {@link
	863	+ * GSSManager#createContext(byte[]) GSSManager.createContext} in
	864	+ * another process, will re-activate the context in the second process.
	865	+ * Only a single instantiation of a given context may be active at any
	866	+ * one time; a subsequent attempt by a context exporter to access the
	867	+ * exported security context will fail.<p>
	868	+ *
	869	+ * The implementation may constrain the set of processes by which the
	870	+ * interprocess token may be imported, either as a function of local
	871	+ * security policy, or as a result of implementation decisions. For
	872	+ * example, some implementations may constrain contexts to be passed
	873	+ * only between processes that run under the same account, or which are
	874	+ * part of the same process group.<p>
	875	+ *
	876	+ * The interprocess token may contain security-sensitive information
	877	+ * (for example cryptographic keys). While mechanisms are encouraged
	878	+ * to either avoid placing such sensitive information within
	879	+ * interprocess tokens, or to encrypt the token before returning it to
	880	+ * the application, in a typical GSS-API implementation this may not be
	881	+ * possible. Thus the application must take care to protect the
	882	+ * interprocess token, and ensure that any process to which the token
	883	+ * is transferred is trustworthy. <p>
	884	+ *
	885	+ * Implementations are not required to support the inter-process
	886	+ * transfer of security contexts. Calling the {@link #isTransferable()
	887	+ * isTransferable} method will indicate if the context object is
	888	+ * transferable.<p>
	889	+ *
	890	+ * Calling this method on a context that
	891	+ * is not exportable will result in this exception being thrown with
	892	+ * the error code {@link GSSException#UNAVAILABLE
	893	+ * GSSException.UNAVAILABLE}.
	894	+ *
	895	+ * @return a byte[] containing the exported context
	896	+ * @see GSSManager#createContext(byte[])
	897	+ *
	898	+ * @throws GSSException containing the following
	899	+ * major error codes:
	900	+ * {@link GSSException#UNAVAILABLE GSSException.UNAVAILABLE},
	901	+ * {@link GSSException#CONTEXT_EXPIRED GSSException.CONTEXT_EXPIRED},
	902	+ * {@link GSSException#NO_CONTEXT GSSException.NO_CONTEXT},
	903	+ * {@link GSSException#FAILURE GSSException.FAILURE}
	904	+ */
	905	+ public byte [] export() throws GSSException;
	906	+
	907	+ /**
	908	+ * Requests that mutual authentication be done during
	909	+ * context establishment. This request can only be made on the context
	910	+ * initiator's side and it has to be done prior to the first call to
	911	+ * <code>initSecContext</code>.<p>
	912	+ *
	913	+ * Not all mechanisms support mutual authentication and some mechanisms
	914	+ * might require mutual authentication even if the application
	915	+ * doesn't. Therefore, the application should check to see if the
	916	+ * request was honored with the {@link #getMutualAuthState()
	917	+ * getMutualAuthState} method.<p>
	918	+ *
	919	+ * @param state a boolean value indicating whether mutual
	920	+ * authentication should be used or not.
	921	+ * @see #getMutualAuthState()
	922	+ *
	923	+ * @throws GSSException containing the following
	924	+ * major error codes:
	925	+ * {@link GSSException#FAILURE GSSException.FAILURE}
	926	+ */
	927	+ public void requestMutualAuth(boolean state) throws GSSException;
	928	+
	929	+ /**
	930	+ * Requests that replay detection be enabled for the
	931	+ * per-message security services after context establishment. This
	932	+ * request can only be made on the context initiator's side and it has
	933	+ * to be done prior to the first call to
	934	+ * <code>initSecContext</code>. During context establishment replay
	935	+ * detection is not an option and is a function of the underlying
	936	+ * mechanism's capabilities.<p>
	937	+ *
	938	+ * Not all mechanisms support replay detection and some mechanisms
	939	+ * might require replay detection even if the application
	940	+ * doesn't. Therefore, the application should check to see if the
	941	+ * request was honored with the {@link #getReplayDetState()
	942	+ * getReplayDetState} method. If replay detection is enabled then the
	943	+ * {@link MessageProp#isDuplicateToken() MessageProp.isDuplicateToken} and {@link
	944	+ * MessageProp#isOldToken() MessageProp.isOldToken} methods will return
	945	+ * valid results for the <code>MessageProp</code> object that is passed
	946	+ * in to the <code>unwrap</code> method or the <code>verifyMIC</code>
	947	+ * method.<p>
	948	+ *
	949	+ * @param state a boolean value indicating whether replay detection
	950	+ * should be enabled over the established context or not.
	951	+ * @see #getReplayDetState()
	952	+ *
	953	+ * @throws GSSException containing the following
	954	+ * major error codes:
	955	+ * {@link GSSException#FAILURE GSSException.FAILURE}
	956	+ */
	957	+ public void requestReplayDet(boolean state) throws GSSException;
	958	+
	959	+ /**
	960	+ * Requests that sequence checking be enabled for the
	961	+ * per-message security services after context establishment. This
	962	+ * request can only be made on the context initiator's side and it has
	963	+ * to be done prior to the first call to
	964	+ * <code>initSecContext</code>. During context establishment sequence
	965	+ * checking is not an option and is a function of the underlying
	966	+ * mechanism's capabilities.<p>
	967	+ *
	968	+ * Not all mechanisms support sequence checking and some mechanisms
	969	+ * might require sequence checking even if the application
	970	+ * doesn't. Therefore, the application should check to see if the
	971	+ * request was honored with the {@link #getSequenceDetState()
	972	+ * getSequenceDetState} method. If sequence checking is enabled then the
	973	+ * {@link MessageProp#isDuplicateToken() MessageProp.isDuplicateToken},
	974	+ * {@link MessageProp#isOldToken() MessageProp.isOldToken},
	975	+ * {@link MessageProp#isUnseqToken() MessageProp.isUnseqToken}, and
	976	+ * {@link MessageProp#isGapToken() MessageProp.isGapToken} methods will return
	977	+ * valid results for the <code>MessageProp</code> object that is passed
	978	+ * in to the <code>unwrap</code> method or the <code>verifyMIC</code>
	979	+ * method.<p>
	980	+ *
	981	+ * @param state a boolean value indicating whether sequence checking
	982	+ * should be enabled over the established context or not.
	983	+ * @see #getSequenceDetState()
	984	+ *
	985	+ * @throws GSSException containing the following
	986	+ * major error codes:
	987	+ * {@link GSSException#FAILURE GSSException.FAILURE}
	988	+ */
	989	+ public void requestSequenceDet(boolean state) throws GSSException;
	990	+
	991	+ /**
	992	+ * Requests that the initiator's credentials be
	993	+ * delegated to the acceptor during context establishment. This
	994	+ * request can only be made on the context initiator's side and it has
	995	+ * to be done prior to the first call to
	996	+ * <code>initSecContext</code>.
	997	+ *
	998	+ * Not all mechanisms support credential delegation. Therefore, an
	999	+ * application that desires delegation should check to see if the
	1000	+ * request was honored with the {@link #getCredDelegState()
	1001	+ * getCredDelegState} method. If the application indicates that
	1002	+ * delegation must not be used, then the mechanism will honor the
	1003	+ * request and delegation will not occur. This is an exception
	1004	+ * to the general rule that a mechanism may enable a service even if it
	1005	+ * is not requested.<p>
	1006	+ *
	1007	+ * @param state a boolean value indicating whether the credentials
	1008	+ * should be delegated or not.
	1009	+ * @see #getCredDelegState()
	1010	+ *
	1011	+ * @throws GSSException containing the following
	1012	+ * major error codes:
	1013	+ * {@link GSSException#FAILURE GSSException.FAILURE}
	1014	+ */
	1015	+ public void requestCredDeleg(boolean state) throws GSSException;
	1016	+
	1017	+ /**
	1018	+ * Requests that the initiator's identity not be
	1019	+ * disclosed to the acceptor. This request can only be made on the
	1020	+ * context initiator's side and it has to be done prior to the first
	1021	+ * call to <code>initSecContext</code>.
	1022	+ *
	1023	+ * Not all mechanisms support anonymity for the initiator. Therefore, the
	1024	+ * application should check to see if the request was honored with the
	1025	+ * {@link #getAnonymityState() getAnonymityState} method.<p>
	1026	+ *
	1027	+ * @param state a boolean value indicating if the initiator should
	1028	+ * be authenticated to the acceptor as an anonymous principal.
	1029	+ * @see #getAnonymityState
	1030	+ *
	1031	+ * @throws GSSException containing the following
	1032	+ * major error codes:
	1033	+ * {@link GSSException#FAILURE GSSException.FAILURE}
	1034	+ */
	1035	+ public void requestAnonymity(boolean state) throws GSSException;
	1036	+
	1037	+ /**
	1038	+ * Requests that data confidentiality be enabled
	1039	+ * for the <code>wrap</code> method. This request can only be made on
	1040	+ * the context initiator's side and it has to be done prior to the
	1041	+ * first call to <code>initSecContext</code>.
	1042	+ *
	1043	+ * Not all mechanisms support confidentiality and other mechanisms
	1044	+ * might enable it even if the application doesn't request
	1045	+ * it. The application may check to see if the request was honored with
	1046	+ * the {@link #getConfState() getConfState} method. If confidentiality
	1047	+ * is enabled, only then will the mechanism honor a request for privacy
	1048	+ * in the {@link MessageProp#MessageProp(int, boolean) MessageProp}
	1049	+ * object that is passed in to the <code>wrap</code> method.<p>
	1050	+ *
	1051	+ * Enabling confidentiality will also automatically enable
	1052	+ * integrity.<p>
	1053	+ *
	1054	+ * @param state a boolean value indicating whether confidentiality
	1055	+ * should be enabled or not.
	1056	+ * @see #getConfState()
	1057	+ * @see #getIntegState()
	1058	+ * @see #requestInteg(boolean)
	1059	+ * @see MessageProp
	1060	+ *
	1061	+ * @throws GSSException containing the following
	1062	+ * major error codes:
	1063	+ * {@link GSSException#FAILURE GSSException.FAILURE}
	1064	+ */
	1065	+ public void requestConf(boolean state) throws GSSException;
	1066	+
	1067	+ /**
	1068	+ * Requests that data integrity be enabled
	1069	+ * for the <code>wrap</code> and <code>getMIC</code>methods. This
	1070	+ * request can only be made on the context initiator's side and it has
	1071	+ * to be done prior to the first call to <code>initSecContext</code>.
	1072	+ *
	1073	+ * Not all mechanisms support integrity and other mechanisms
	1074	+ * might enable it even if the application doesn't request
	1075	+ * it. The application may check to see if the request was honored with
	1076	+ * the {@link #getIntegState() getIntegState} method.<p>
	1077	+ *
	1078	+ * Disabling integrity will also automatically disable
	1079	+ * confidentiality.<p>
	1080	+ *
	1081	+ * @param state a boolean value indicating whether integrity
	1082	+ * should be enabled or not.
	1083	+ * @see #getIntegState()
	1084	+ *
	1085	+ * @throws GSSException containing the following
	1086	+ * major error codes:
	1087	+ * {@link GSSException#FAILURE GSSException.FAILURE}
	1088	+ */
	1089	+ public void requestInteg(boolean state) throws GSSException;
	1090	+
	1091	+ /**
	1092	+ * Requests a lifetime in seconds for the
	1093	+ * context. This method can only be called on the context initiator's
	1094	+ * side and it has to be done prior to the first call to
	1095	+ * <code>initSecContext</code>.<p>
	1096	+ *
	1097	+ * The actual lifetime of the context will depend on the capabilites of
	1098	+ * the underlying mechanism and the application should call the {@link
	1099	+ * #getLifetime() getLifetime} method to determine this.<p>
	1100	+ *
	1101	+ * @param lifetime the desired context lifetime in seconds. Use
	1102	+ * <code>INDEFINITE_LIFETIME</code> to request an indefinite lifetime
	1103	+ * and <code>DEFAULT_LIFETIME</code> to request a default lifetime.
	1104	+ * @see #getLifetime()
	1105	+ *
	1106	+ * @throws GSSException containing the following
	1107	+ * major error codes:
	1108	+ * {@link GSSException#FAILURE GSSException.FAILURE}
	1109	+ */
	1110	+ public void requestLifetime(int lifetime) throws GSSException;
	1111	+
	1112	+ /**
	1113	+ * Sets the channel bindings to be used during context
	1114	+ * establishment. This method can be called on both
	1115	+ * the context initiator's and the context acceptor's side, but it must
	1116	+ * be called before context establishment begins. This means that an
	1117	+ * initiator must call it before the first call to
	1118	+ * <code>initSecContext</code> and the acceptor must call it before the
	1119	+ * first call to <code>acceptSecContext</code>.
	1120	+ *
	1121	+ * @param cb the channel bindings to use.
	1122	+ *
	1123	+ * @throws GSSException containing the following
	1124	+ * major error codes:
	1125	+ * {@link GSSException#FAILURE GSSException.FAILURE}
	1126	+ */
	1127	+ public void setChannelBinding(ChannelBinding cb) throws GSSException;
	1128	+
	1129	+ /**
	1130	+ * Determines if credential delegation is enabled on
	1131	+ * this context. It can be called by both the context initiator and the
	1132	+ * context acceptor. For a definitive answer this method must be
	1133	+ * called only after context establishment is complete. Note that if an
	1134	+ * initiator requests that delegation not be allowed the {@link
	1135	+ * #requestCredDeleg(boolean) requestCredDeleg} method will honor that
	1136	+ * request and this method will return <code>false</code> on the
	1137	+ * initiator's side from that point onwards. <p>
	1138	+ *
	1139	+ * @return true if delegation is enabled, false otherwise.
	1140	+ * @see #requestCredDeleg(boolean)
	1141	+ */
	1142	+ public boolean getCredDelegState();
	1143	+
	1144	+ /**
	1145	+ * Determines if mutual authentication is enabled on
	1146	+ * this context. It can be called by both the context initiator and the
	1147	+ * context acceptor. For a definitive answer this method must be
	1148	+ * called only after context establishment is complete. An initiator
	1149	+ * that requests mutual authentication can call this method after
	1150	+ * context completion and dispose the context if its request was not
	1151	+ * honored.<p>
	1152	+ *
	1153	+ * @return true if mutual authentication is enabled, false otherwise.
	1154	+ * @see #requestMutualAuth(boolean)
	1155	+ */
	1156	+ public boolean getMutualAuthState();
	1157	+
	1158	+ /**
	1159	+ * Determines if replay detection is enabled for the
	1160	+ * per-message security services from this context. It can be called by
	1161	+ * both the context initiator and the context acceptor. For a
	1162	+ * definitive answer this method must be called only after context
	1163	+ * establishment is complete. An initiator that requests replay
	1164	+ * detection can call this method after context completion and
	1165	+ * dispose the context if its request was not honored.<p>
	1166	+ *
	1167	+ * @return true if replay detection is enabled, false otherwise.
	1168	+ * @see #requestReplayDet(boolean)
	1169	+ */
	1170	+ public boolean getReplayDetState();
	1171	+
	1172	+ /**
	1173	+ * Determines if sequence checking is enabled for the
	1174	+ * per-message security services from this context. It can be called by
	1175	+ * both the context initiator and the context acceptor. For a
	1176	+ * definitive answer this method must be called only after context
	1177	+ * establishment is complete. An initiator that requests sequence
	1178	+ * checking can call this method after context completion and
	1179	+ * dispose the context if its request was not honored.<p>
	1180	+ *
	1181	+ * @return true if sequence checking is enabled, false otherwise.
	1182	+ * @see #requestSequenceDet(boolean)
	1183	+ */
	1184	+ public boolean getSequenceDetState();
	1185	+
	1186	+ /**
	1187	+ * Determines if the context initiator is
	1188	+ * anonymously authenticated to the context acceptor. It can be called by
	1189	+ * both the context initiator and the context acceptor, and at any
	1190	+ * time. <strong>On the initiator side, a call to this method determines
	1191	+ * if the identity of the initiator has been disclosed in any of the
	1192	+ * context establishment tokens that might have been generated thus far
	1193	+ * by <code>initSecContext</code>. An initiator that absolutely must be
	1194	+ * authenticated anonymously should call this method after each call to
	1195	+ * <code>initSecContext</code> to determine if the generated token
	1196	+ * should be sent to the peer or the context aborted.</strong> On the
	1197	+ * acceptor side, a call to this method determines if any of the tokens
	1198	+ * processed by <code>acceptSecContext</code> thus far have divulged
	1199	+ * the identity of the initiator.<p>
	1200	+ *
	1201	+ * @return true if the context initiator is still anonymous, false
	1202	+ * otherwise.
	1203	+ * @see #requestAnonymity(boolean)
	1204	+ */
	1205	+ public boolean getAnonymityState();
	1206	+
	1207	+ /**
	1208	+ * Determines if the context is transferable to other processes
	1209	+ * through the use of the {@link #export() export} method. This call
	1210	+ * is only valid on fully established contexts.
	1211	+ *
	1212	+ * @return true if this context can be exported, false otherwise.
	1213	+ *
	1214	+ * @throws GSSException containing the following
	1215	+ * major error codes:
	1216	+ * {@link GSSException#FAILURE GSSException.FAILURE}
	1217	+ */
	1218	+ public boolean isTransferable() throws GSSException;
	1219	+
	1220	+ /**
	1221	+ * Determines if the context is ready for per message operations to be
	1222	+ * used over it. Some mechanisms may allow the usage of the
	1223	+ * per-message operations before the context is fully established.
	1224	+ *
	1225	+ * @return true if methods like <code>wrap</code>, <code>unwrap</code>,
	1226	+ * <code>getMIC</code>, and <code>verifyMIC</code> can be used with
	1227	+ * this context at the current stage of context establishment, false
	1228	+ * otherwise.
	1229	+ */
	1230	+ public boolean isProtReady();
	1231	+
	1232	+ /**
	1233	+ * Determines if data confidentiality is available
	1234	+ * over the context. This method can be called by both the context
	1235	+ * initiator and the context acceptor, but only after one of {@link
	1236	+ * #isProtReady() isProtReady} or {@link #isEstablished()
	1237	+ * isEstablished} return <code>true</code>. If this method returns
	1238	+ * <code>true</code>, so will {@link #getIntegState()
	1239	+ * getIntegState}<p>
	1240	+ *
	1241	+ * @return true if confidentiality services are available, false
	1242	+ * otherwise.
	1243	+ * @see #requestConf(boolean)
	1244	+ */
	1245	+ public boolean getConfState();
	1246	+
	1247	+ /**
	1248	+ * Determines if data integrity is available
	1249	+ * over the context. This method can be called by both the context
	1250	+ * initiator and the context acceptor, but only after one of {@link
	1251	+ * #isProtReady() isProtReady} or {@link #isEstablished()
	1252	+ * isEstablished} return <code>true</code>. This method will always
	1253	+ * return <code>true</code> if {@link #getConfState() getConfState}
	1254	+ * returns true.<p>
	1255	+ *
	1256	+ * @return true if integrity services are available, false otherwise.
	1257	+ * @see #requestInteg(boolean)
	1258	+ */
	1259	+ public boolean getIntegState();
	1260	+
	1261	+ /**
	1262	+ * Determines what the remaining lifetime for this
	1263	+ * context is. It can be called by both the context initiator and the
	1264	+ * context acceptor, but for a definitive answer it should be called
	1265	+ * only after {@link #isEstablished() isEstablished} returns
	1266	+ * true.<p>
	1267	+ *
	1268	+ * @return the remaining lifetime in seconds
	1269	+ * @see #requestLifetime(int)
	1270	+ */
	1271	+ public int getLifetime();
	1272	+
	1273	+ /**
	1274	+ * Returns the name of the context initiator. This call is valid only
	1275	+ * after one of {@link #isProtReady() isProtReady} or {@link
	1276	+ * #isEstablished() isEstablished} return <code>true</code>.
	1277	+ *
	1278	+ * @return a GSSName that is an MN containing the name of the context
	1279	+ * initiator.
	1280	+ * @see GSSName
	1281	+ *
	1282	+ * @throws GSSException containing the following
	1283	+ * major error codes:
	1284	+ * {@link GSSException#FAILURE GSSException.FAILURE}
	1285	+ */
	1286	+ public GSSName getSrcName() throws GSSException;
	1287	+
	1288	+ /**
	1289	+ * Returns the name of the context acceptor. This call is valid only
	1290	+ * after one of {@link #isProtReady() isProtReady} or {@link
	1291	+ * #isEstablished() isEstablished} return <code>true</code>.
	1292	+ *
	1293	+ * @return a GSSName that is an MN containing the name of the context
	1294	+ * acceptor.
	1295	+ *
	1296	+ * @throws GSSException containing the following
	1297	+ * major error codes:
	1298	+ * {@link GSSException#FAILURE GSSException.FAILURE}
	1299	+ */
	1300	+ public GSSName getTargName() throws GSSException;
	1301	+
	1302	+ /**
	1303	+ * Determines what mechanism is being used for this
	1304	+ * context. This method may be called before the context is fully
	1305	+ * established, but the mechanism returned may change on successive
	1306	+ * calls in the negotiated mechanism case.
	1307	+ *
	1308	+ * @return the Oid of the mechanism being used
	1309	+ *
	1310	+ * @throws GSSException containing the following
	1311	+ * major error codes:
	1312	+ * {@link GSSException#FAILURE GSSException.FAILURE}
	1313	+ */
	1314	+ public Oid getMech() throws GSSException;
	1315	+
	1316	+ /**
	1317	+ * Obtains the credentials delegated by the context
	1318	+ * initiator to the context acceptor. It should be called only on the
	1319	+ * context acceptor's side, and once the context is fully
	1320	+ * established. The caller can use the method {@link
	1321	+ * #getCredDelegState() getCredDelegState} to determine if there are
	1322	+ * any delegated credentials.
	1323	+ *
	1324	+ * @return a GSSCredential containing the initiator's delegated
	1325	+ * credentials, or <code>null</code> is no credentials
	1326	+ * were delegated.
	1327	+ *
	1328	+ * @throws GSSException containing the following
	1329	+ * major error codes:
	1330	+ * {@link GSSException#FAILURE GSSException.FAILURE}
	1331	+ */
	1332	+ public GSSCredential getDelegCred() throws GSSException;
	1333	+
	1334	+ /**
	1335	+ * Determines if this is the context initiator. This
	1336	+ * can be called on both the context initiator's and context acceptor's
	1337	+ * side.
	1338	+ *
	1339	+ * @return true if this is the context initiator, false if it is the
	1340	+ * context acceptor.
	1341	+ *
	1342	+ * @throws GSSException containing the following
	1343	+ * major error codes:
	1344	+ * {@link GSSException#FAILURE GSSException.FAILURE}
	1345	+ */
	1346	+ public boolean isInitiator() throws GSSException;
	1347	+}

java/pkg/org/ietf/jgss/GSSCredential.class+0−0

Binary file not shown.

java/pkg/org/ietf/jgss/GSSCredential.java+370−0

@@ -0,0 +1,370 @@
	1	+/*
	2	+ * Copyright (c) 2000, 2006, Oracle and/or its affiliates. All rights reserved.
	3	+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
	4	+ *
	5	+ * This code is free software; you can redistribute it and/or modify it
	6	+ * under the terms of the GNU General Public License version 2 only, as
	7	+ * published by the Free Software Foundation. Oracle designates this
	8	+ * particular file as subject to the "Classpath" exception as provided
	9	+ * by Oracle in the LICENSE file that accompanied this code.
	10	+ *
	11	+ * This code is distributed in the hope that it will be useful, but WITHOUT
	12	+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
	13	+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
	14	+ * version 2 for more details (a copy is included in the LICENSE file that
	15	+ * accompanied this code).
	16	+ *
	17	+ * You should have received a copy of the GNU General Public License version
	18	+ * 2 along with this work; if not, write to the Free Software Foundation,
	19	+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
	20	+ *
	21	+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
	22	+ * or visit www.oracle.com if you need additional information or have any
	23	+ * questions.
	24	+ */
	25	+
	26	+package org.ietf.jgss;
	27	+
	28	+/**
	29	+ * This interface encapsulates the GSS-API credentials for an entity. A
	30	+ * credential contains all the necessary cryptographic information to
	31	+ * enable the creation of a context on behalf of the entity that it
	32	+ * represents. It may contain multiple, distinct, mechanism specific
	33	+ * credential elements, each containing information for a specific
	34	+ * security mechanism, but all referring to the same entity. A credential
	35	+ * may be used to perform context initiation, acceptance, or both.<p>
	36	+ *
	37	+ * Credentials are instantiated using one of the
	38	+ * <code>createCredential</code> methods in the {@link GSSManager
	39	+ * GSSManager} class. GSS-API credential creation is not
	40	+ * intended to provide a "login to the network" function, as such a
	41	+ * function would involve the creation of new credentials rather than
	42	+ * merely acquiring a handle to existing credentials. The
	43	+ * <a href=package-summary.html#useSubjectCredsOnly>section on credential
	44	+ * acquisition</a> in the package level description describes
	45	+ * how existing credentials are acquired in the Java platform. GSS-API
	46	+ * implementations must impose a local access-control policy on callers to
	47	+ * prevent unauthorized callers from acquiring credentials to which they
	48	+ * are not entitled. <p>
	49	+ *
	50	+ * Applications will create a credential object passing the desired
	51	+ * parameters. The application can then use the query methods to obtain
	52	+ * specific information about the instantiated credential object.
	53	+ * When the credential is no longer needed, the application should call
	54	+ * the {@link #dispose() dispose} method to release any resources held by
	55	+ * the credential object and to destroy any cryptographically sensitive
	56	+ * information.<p>
	57	+ *
	58	+ * This example code demonstrates the creation of a GSSCredential
	59	+ * implementation for a specific entity, querying of its fields, and its
	60	+ * release when it is no longer needed:<p>
	61	+ * <pre>
	62	+ * GSSManager manager = GSSManager.getInstance();
	63	+ *
	64	+ * // start by creating a name object for the entity
	65	+ * GSSName name = manager.createName("myusername", GSSName.NT_USER_NAME);
	66	+ *
	67	+ * // now acquire credentials for the entity
	68	+ * GSSCredential cred = manager.createCredential(name,
	69	+ * GSSCredential.ACCEPT_ONLY);
	70	+ *
	71	+ * // display credential information - name, remaining lifetime,
	72	+ * // and the mechanisms it has been acquired over
	73	+ * System.out.println(cred.getName().toString());
	74	+ * System.out.println(cred.getRemainingLifetime());
	75	+ *
	76	+ * Oid [] mechs = cred.getMechs();
	77	+ * if (mechs != null) {
	78	+ * for (int i = 0; i < mechs.length; i++)
	79	+ * System.out.println(mechs[i].toString());
	80	+ * }
	81	+ *
	82	+ * // release system resources held by the credential
	83	+ * cred.dispose();
	84	+ * </pre>
	85	+ *
	86	+ * @see GSSManager#createCredential(int)
	87	+ * @see GSSManager#createCredential(GSSName, int, Oid, int)
	88	+ * @see GSSManager#createCredential(GSSName, int, Oid[], int)
	89	+ * @see #dispose()
	90	+ *
	91	+ * @author Mayank Upadhyay
	92	+ * @since 1.4
	93	+ */
	94	+public interface GSSCredential extends Cloneable{
	95	+
	96	+ /**
	97	+ * Credential usage flag requesting that it be usable
	98	+ * for both context initiation and acceptance.
	99	+ *
	100	+ */
	101	+ public static final int INITIATE_AND_ACCEPT = 0;
	102	+
	103	+
	104	+ /**
	105	+ * Credential usage flag requesting that it be usable
	106	+ * for context initiation only.
	107	+ *
	108	+ */
	109	+ public static final int INITIATE_ONLY = 1;
	110	+
	111	+
	112	+ /**
	113	+ * Credential usage flag requesting that it be usable
	114	+ * for context acceptance only.
	115	+ *
	116	+ */
	117	+ public static final int ACCEPT_ONLY = 2;
	118	+
	119	+
	120	+ /**
	121	+ * A lifetime constant representing the default credential lifetime. This
	122	+ * value it set to 0.
	123	+ */
	124	+ public static final int DEFAULT_LIFETIME = 0;
	125	+
	126	+ /**
	127	+ * A lifetime constant representing indefinite credential lifetime.
	128	+ * This value must is set to the maximum integer value in Java -
	129	+ * {@link java.lang.Integer#MAX_VALUE Integer.MAX_VALUE}.
	130	+ */
	131	+ public static final int INDEFINITE_LIFETIME = Integer.MAX_VALUE;
	132	+
	133	+ /**
	134	+ * Releases any sensitive information that the GSSCredential object may
	135	+ * be containing. Applications should call this method as soon as the
	136	+ * credential is no longer needed to minimize the time any sensitive
	137	+ * information is maintained.
	138	+ *
	139	+ * @throws GSSException containing the following
	140	+ * major error codes:
	141	+ * {@link GSSException#FAILURE GSSException.FAILURE}
	142	+ */
	143	+ public void dispose() throws GSSException;
	144	+
	145	+ /**
	146	+ * Retrieves the name of the entity that the credential asserts.
	147	+ *
	148	+ * @return a GSSName representing the entity
	149	+ *
	150	+ * @throws GSSException containing the following
	151	+ * major error codes:
	152	+ * {@link GSSException#FAILURE GSSException.FAILURE}
	153	+ */
	154	+ public GSSName getName() throws GSSException;
	155	+
	156	+ /**
	157	+ * Retrieves a Mechanism Name of the entity that the credential
	158	+ * asserts. This is equivalent to calling {@link
	159	+ * GSSName#canonicalize(Oid) canonicalize} on the value returned by
	160	+ * the other form of {@link #getName() getName}.
	161	+ *
	162	+ * @param mech the Oid of the mechanism for which the Mechanism Name
	163	+ * should be returned.
	164	+ * @return a GSSName representing the entity canonicalized for the
	165	+ * desired mechanism
	166	+ *
	167	+ * @throws GSSException containing the following
	168	+ * major error codes:
	169	+ * {@link GSSException#BAD_MECH GSSException.BAD_MECH},
	170	+ * {@link GSSException#FAILURE GSSException.FAILURE}
	171	+ */
	172	+ public GSSName getName(Oid mech) throws GSSException;
	173	+
	174	+ /**
	175	+ * Returns the remaining lifetime in seconds for a credential. The
	176	+ * remaining lifetime is the minimum lifetime amongst all of the underlying
	177	+ * mechanism specific credential elements.
	178	+ *
	179	+ * @return the minimum remaining lifetime in seconds for this
	180	+ * credential. A return value of {@link #INDEFINITE_LIFETIME
	181	+ * INDEFINITE_LIFETIME} indicates that the credential does
	182	+ * not expire. A return value of 0 indicates that the credential is
	183	+ * already expired.
	184	+ *
	185	+ * @see #getRemainingInitLifetime(Oid)
	186	+ * @see #getRemainingAcceptLifetime(Oid)
	187	+ *
	188	+ * @throws GSSException containing the following
	189	+ * major error codes:
	190	+ * {@link GSSException#FAILURE GSSException.FAILURE}
	191	+ */
	192	+ public int getRemainingLifetime() throws GSSException;
	193	+
	194	+ /**
	195	+ * Returns the lifetime in seconds for the credential to remain capable
	196	+ * of initiating security contexts using the specified mechanism. This
	197	+ * method queries the initiator credential element that belongs to the
	198	+ * specified mechanism.
	199	+ *
	200	+ * @return the number of seconds remaining in the life of this credential
	201	+ * element. A return value of {@link #INDEFINITE_LIFETIME
	202	+ * INDEFINITE_LIFETIME} indicates that the credential element does not
	203	+ * expire. A return value of 0 indicates that the credential element is
	204	+ * already expired.
	205	+ *
	206	+ * @param mech the Oid of the mechanism whose intiator credential element
	207	+ * should be queried.
	208	+ *
	209	+ * @throws GSSException containing the following
	210	+ * major error codes:
	211	+ * {@link GSSException#BAD_MECH GSSException.BAD_MECH},
	212	+ * {@link GSSException#FAILURE GSSException.FAILURE}
	213	+ */
	214	+ public int getRemainingInitLifetime(Oid mech) throws GSSException;
	215	+
	216	+ /**
	217	+ * Returns the lifetime in seconds for the credential to remain capable
	218	+ * of accepting security contexts using the specified mechanism. This
	219	+ * method queries the acceptor credential element that belongs to the
	220	+ * specified mechanism.
	221	+ *
	222	+ * @return the number of seconds remaining in the life of this credential
	223	+ * element. A return value of {@link #INDEFINITE_LIFETIME
	224	+ * INDEFINITE_LIFETIME} indicates that the credential element does not
	225	+ * expire. A return value of 0 indicates that the credential element is
	226	+ * already expired.
	227	+ *
	228	+ * @param mech the Oid of the mechanism whose acceptor credential element
	229	+ * should be queried.
	230	+ *
	231	+ * @throws GSSException containing the following
	232	+ * major error codes:
	233	+ * {@link GSSException#BAD_MECH GSSException.BAD_MECH},
	234	+ * {@link GSSException#FAILURE GSSException.FAILURE}
	235	+ */
	236	+ public int getRemainingAcceptLifetime(Oid mech) throws GSSException;
	237	+
	238	+ /**
	239	+ * Returns the credential usage mode. In other words, it
	240	+ * tells us if this credential can be used for initiating or accepting
	241	+ * security contexts. It does not tell us which mechanism(s) has to be
	242	+ * used in order to do so. It is expected that an application will allow
	243	+ * the GSS-API to pick a default mechanism after calling this method.
	244	+ *
	245	+ * @return The return value will be one of {@link #INITIATE_ONLY
	246	+ * INITIATE_ONLY}, {@link #ACCEPT_ONLY ACCEPT_ONLY}, and {@link
	247	+ * #INITIATE_AND_ACCEPT INITIATE_AND_ACCEPT}.
	248	+ *
	249	+ * @throws GSSException containing the following
	250	+ * major error codes:
	251	+ * {@link GSSException#FAILURE GSSException.FAILURE}
	252	+ */
	253	+ public int getUsage() throws GSSException;
	254	+
	255	+ /**
	256	+ * Returns the credential usage mode for a specific mechanism. In other
	257	+ * words, it tells us if this credential can be used
	258	+ * for initiating or accepting security contexts with a given underlying
	259	+ * mechanism.
	260	+ *
	261	+ * @return The return value will be one of {@link #INITIATE_ONLY
	262	+ * INITIATE_ONLY}, {@link #ACCEPT_ONLY ACCEPT_ONLY}, and {@link
	263	+ * #INITIATE_AND_ACCEPT INITIATE_AND_ACCEPT}.
	264	+ * @param mech the Oid of the mechanism whose credentials usage mode is
	265	+ * to be determined.
	266	+ *
	267	+ * @throws GSSException containing the following
	268	+ * major error codes:
	269	+ * {@link GSSException#BAD_MECH GSSException.BAD_MECH},
	270	+ * {@link GSSException#FAILURE GSSException.FAILURE}
	271	+ */
	272	+ public int getUsage(Oid mech) throws GSSException;
	273	+
	274	+ /**
	275	+ * Returns a list of mechanisms supported by this credential. It does
	276	+ * not tell us which ones can be used to initiate
	277	+ * contexts and which ones can be used to accept contexts. The
	278	+ * application must call the {@link #getUsage(Oid) getUsage} method with
	279	+ * each of the returned Oid's to determine the possible modes of
	280	+ * usage.
	281	+ *
	282	+ * @return an array of Oid's corresponding to the supported mechanisms.
	283	+ *
	284	+ * @throws GSSException containing the following
	285	+ * major error codes:
	286	+ * {@link GSSException#FAILURE GSSException.FAILURE}
	287	+ */
	288	+ public Oid[] getMechs() throws GSSException;
	289	+
	290	+ /**
	291	+ * Adds a mechanism specific credential-element to an existing
	292	+ * credential. This method allows the construction of credentials, one
	293	+ * mechanism at a time.<p>
	294	+ *
	295	+ * This routine is envisioned to be used mainly by context acceptors
	296	+ * during the creation of acceptor credentials which are to be used
	297	+ * with a variety of clients using different security mechanisms.<p>
	298	+ *
	299	+ * This routine adds the new credential element "in-place". To add the
	300	+ * element in a new credential, first call <code>clone</code> to obtain a
	301	+ * copy of this credential, then call its <code>add</code> method.<p>
	302	+ *
	303	+ * As always, GSS-API implementations must impose a local access-control
	304	+ * policy on callers to prevent unauthorized callers from acquiring
	305	+ * credentials to which they are not entitled.
	306	+ *
	307	+ * Non-default values for initLifetime and acceptLifetime cannot always
	308	+ * be honored by the underlying mechanisms, thus callers should be
	309	+ * prepared to call {@link #getRemainingInitLifetime(Oid)
	310	+ * getRemainingInitLifetime} and {@link #getRemainingAcceptLifetime(Oid)
	311	+ * getRemainingAcceptLifetime} on the credential.
	312	+ *
	313	+ * @param name the name of the principal for whom this credential is to
	314	+ * be acquired. Use <code>null</code> to specify the default
	315	+ * principal.
	316	+ * @param initLifetime the number of seconds that the credential element
	317	+ * should remain valid for initiating of security contexts. Use {@link
	318	+ * GSSCredential#INDEFINITE_LIFETIME GSSCredential.INDEFINITE_LIFETIME}
	319	+ * to request that the credentials have the maximum permitted lifetime
	320	+ * for this. Use {@link GSSCredential#DEFAULT_LIFETIME
	321	+ * GSSCredential.DEFAULT_LIFETIME} to request default credential lifetime
	322	+ * for this.
	323	+ * @param acceptLifetime the number of seconds that the credential
	324	+ * element should remain valid for accepting security contexts. Use {@link
	325	+ * GSSCredential#INDEFINITE_LIFETIME GSSCredential.INDEFINITE_LIFETIME}
	326	+ * to request that the credentials have the maximum permitted lifetime
	327	+ * for this. Use {@link GSSCredential#DEFAULT_LIFETIME
	328	+ * GSSCredential.DEFAULT_LIFETIME} to request default credential lifetime
	329	+ * for this.
	330	+ * @param mech the mechanism over which the credential is to be acquired.
	331	+ * @param usage the usage mode that this credential
	332	+ * element should add to the credential. The value
	333	+ * of this parameter must be one of:
	334	+ * {@link #INITIATE_AND_ACCEPT INITIATE_AND_ACCEPT},
	335	+ * {@link #ACCEPT_ONLY ACCEPT_ONLY}, and
	336	+ * {@link #INITIATE_ONLY INITIATE_ONLY}.
	337	+ *
	338	+ * @throws GSSException containing the following
	339	+ * major error codes:
	340	+ * {@link GSSException#DUPLICATE_ELEMENT
	341	+ * GSSException.DUPLICATE_ELEMENT},
	342	+ * {@link GSSException#BAD_MECH GSSException.BAD_MECH},
	343	+ * {@link GSSException#BAD_NAMETYPE GSSException.BAD_NAMETYPE},
	344	+ * {@link GSSException#NO_CRED GSSException.NO_CRED},
	345	+ * {@link GSSException#CREDENTIALS_EXPIRED
	346	+ * GSSException.CREDENTIALS_EXPIRED},
	347	+ * {@link GSSException#FAILURE GSSException.FAILURE}
	348	+ */
	349	+ public void add(GSSName name, int initLifetime, int acceptLifetime,
	350	+ Oid mech, int usage) throws GSSException;
	351	+
	352	+ /**
	353	+ * Tests if this GSSCredential asserts the same entity as the supplied
	354	+ * object. The two credentials must be acquired over the same
	355	+ * mechanisms and must refer to the same principal.
	356	+ *
	357	+ * @return <code>true</code> if the two GSSCredentials assert the same
	358	+ * entity; <code>false</code> otherwise.
	359	+ * @param another another GSSCredential for comparison to this one
	360	+ */
	361	+ public boolean equals(Object another);
	362	+
	363	+ /**
	364	+ * Returns a hashcode value for this GSSCredential.
	365	+ *
	366	+ * @return a hashCode value
	367	+ */
	368	+ public int hashCode();
	369	+
	370	+}

java/pkg/org/ietf/jgss/GSSException.class+0−0

Binary file not shown.

java/pkg/org/ietf/jgss/GSSException.java+403−0

@@ -0,0 +1,403 @@
	1	+/*
	2	+ * Copyright (c) 2000, 2003, Oracle and/or its affiliates. All rights reserved.
	3	+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
	4	+ *
	5	+ * This code is free software; you can redistribute it and/or modify it
	6	+ * under the terms of the GNU General Public License version 2 only, as
	7	+ * published by the Free Software Foundation. Oracle designates this
	8	+ * particular file as subject to the "Classpath" exception as provided
	9	+ * by Oracle in the LICENSE file that accompanied this code.
	10	+ *
	11	+ * This code is distributed in the hope that it will be useful, but WITHOUT
	12	+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
	13	+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
	14	+ * version 2 for more details (a copy is included in the LICENSE file that
	15	+ * accompanied this code).
	16	+ *
	17	+ * You should have received a copy of the GNU General Public License version
	18	+ * 2 along with this work; if not, write to the Free Software Foundation,
	19	+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
	20	+ *
	21	+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
	22	+ * or visit www.oracle.com if you need additional information or have any
	23	+ * questions.
	24	+ */
	25	+
	26	+package org.ietf.jgss;
	27	+
	28	+/**
	29	+ * This exception is thrown whenever a GSS-API error occurs, including
	30	+ * any mechanism specific error. It may contain both the major and the
	31	+ * minor GSS-API status codes. Major error codes are those defined at the
	32	+ * GSS-API level in this class. Minor error codes are mechanism specific
	33	+ * error codes that can provide additional information. The underlying
	34	+ * mechanism implementation is responsible for setting appropriate minor
	35	+ * status codes when throwing this exception. Aside from delivering the
	36	+ * numeric error codes to the caller, this class performs the mapping from
	37	+ * their numeric values to textual representations. <p>
	38	+ *
	39	+ * @author Mayank Upadhyay
	40	+ * @since 1.4
	41	+ */
	42	+public class GSSException extends Exception {
	43	+
	44	+ private static final long serialVersionUID = -2706218945227726672L;
	45	+
	46	+ /**
	47	+ * Channel bindings mismatch.
	48	+ */
	49	+ public static final int BAD_BINDINGS = 1; //start with 1
	50	+
	51	+ /**
	52	+ * Unsupported mechanism requested.
	53	+ */
	54	+ public static final int BAD_MECH = 2;
	55	+
	56	+ /**
	57	+ * Invalid name provided.
	58	+ */
	59	+ public static final int BAD_NAME = 3;
	60	+
	61	+ /**
	62	+ * Name of unsupported type provided.
	63	+ */
	64	+ public static final int BAD_NAMETYPE = 4;
	65	+
	66	+ /**
	67	+ * Invalid status code.
	68	+ */
	69	+ /*
	70	+ * This is meant to be thrown by display_status which displays
	71	+ * major/minor status when an incorrect status type is passed in to it!
	72	+ */
	73	+ public static final int BAD_STATUS = 5;
	74	+
	75	+ /**
	76	+ * Token had invalid integrity check.
	77	+ */
	78	+ public static final int BAD_MIC = 6;
	79	+
	80	+ /**
	81	+ * Security context expired.
	82	+ */
	83	+ public static final int CONTEXT_EXPIRED = 7;
	84	+
	85	+ /**
	86	+ * Expired credentials.
	87	+ */
	88	+ public static final int CREDENTIALS_EXPIRED = 8;
	89	+
	90	+ /**
	91	+ * Defective credentials.
	92	+ *
	93	+ */
	94	+ public static final int DEFECTIVE_CREDENTIAL = 9;
	95	+
	96	+ /**
	97	+ * Defective token.
	98	+ *
	99	+ */
	100	+ public static final int DEFECTIVE_TOKEN = 10;
	101	+
	102	+ /**
	103	+ * General failure, unspecified at GSS-API level.
	104	+ */
	105	+ public static final int FAILURE = 11;
	106	+
	107	+ /**
	108	+ * Invalid security context.
	109	+ */
	110	+ public static final int NO_CONTEXT = 12;
	111	+
	112	+ /**
	113	+ * Invalid credentials.
	114	+ */
	115	+ public static final int NO_CRED = 13;
	116	+
	117	+ /**
	118	+ * Unsupported QOP value.
	119	+ */
	120	+ public static final int BAD_QOP = 14;
	121	+
	122	+ /**
	123	+ * Operation unauthorized.
	124	+ */
	125	+ public static final int UNAUTHORIZED = 15;
	126	+
	127	+ /**
	128	+ * Operation unavailable.
	129	+ */
	130	+ public static final int UNAVAILABLE = 16;
	131	+
	132	+ /**
	133	+ * Duplicate credential element requested.
	134	+ */
	135	+ public static final int DUPLICATE_ELEMENT = 17;
	136	+
	137	+ /**
	138	+ * Name contains multi-mechanism elements.
	139	+ */
	140	+ public static final int NAME_NOT_MN = 18;
	141	+
	142	+ /**
	143	+ * The token was a duplicate of an earlier token.
	144	+ * This is a fatal error code that may occur during
	145	+ * context establishment. It is not used to indicate
	146	+ * supplementary status values. The MessageProp object is
	147	+ * used for that purpose.
	148	+ */
	149	+ public static final int DUPLICATE_TOKEN = 19;
	150	+
	151	+ /**
	152	+ * The token's validity period has expired. This is a
	153	+ * fatal error code that may occur during context establishment.
	154	+ * It is not used to indicate supplementary status values.
	155	+ * The MessageProp object is used for that purpose.
	156	+ */
	157	+ public static final int OLD_TOKEN = 20;
	158	+
	159	+
	160	+ /**
	161	+ * A later token has already been processed. This is a
	162	+ * fatal error code that may occur during context establishment.
	163	+ * It is not used to indicate supplementary status values.
	164	+ * The MessageProp object is used for that purpose.
	165	+ */
	166	+ public static final int UNSEQ_TOKEN = 21;
	167	+
	168	+
	169	+ /**
	170	+ * An expected per-message token was not received. This is a
	171	+ * fatal error code that may occur during context establishment.
	172	+ * It is not used to indicate supplementary status values.
	173	+ * The MessageProp object is used for that purpose.
	174	+ */
	175	+ public static final int GAP_TOKEN = 22;
	176	+
	177	+
	178	+ private static String[] messages = {
	179	+ "Channel binding mismatch", // BAD_BINDINGS
	180	+ "Unsupported mechanism requested", // BAD_MECH
	181	+ "Invalid name provided", // BAD_NAME
	182	+ "Name of unsupported type provided", //BAD_NAMETYPE
	183	+ "Invalid input status selector", // BAD_STATUS
	184	+ "Token had invalid integrity check", // BAD_SIG
	185	+ "Specified security context expired", // CONTEXT_EXPIRED
	186	+ "Expired credentials detected", // CREDENTIALS_EXPIRED
	187	+ "Defective credential detected", // DEFECTIVE_CREDENTIAL
	188	+ "Defective token detected", // DEFECTIVE_TOKEN
	189	+ "Failure unspecified at GSS-API level", // FAILURE
	190	+ "Security context init/accept not yet called or context deleted",
	191	+ // NO_CONTEXT
	192	+ "No valid credentials provided", // NO_CRED
	193	+ "Unsupported QOP value", // BAD_QOP
	194	+ "Operation unauthorized", // UNAUTHORIZED
	195	+ "Operation unavailable", // UNAVAILABLE
	196	+ "Duplicate credential element requested", //DUPLICATE_ELEMENT
	197	+ "Name contains multi-mechanism elements", // NAME_NOT_MN
	198	+ "The token was a duplicate of an earlier token", //DUPLICATE_TOKEN
	199	+ "The token's validity period has expired", //OLD_TOKEN
	200	+ "A later token has already been processed", //UNSEQ_TOKEN
	201	+ "An expected per-message token was not received", //GAP_TOKEN
	202	+ };
	203	+
	204	+ /**
	205	+ * The major code for this exception
	206	+ *
	207	+ * @serial
	208	+ */
	209	+ private int major;
	210	+
	211	+ /**
	212	+ * The minor code for this exception
	213	+ *
	214	+ * @serial
	215	+ */
	216	+ private int minor = 0;
	217	+
	218	+ /**
	219	+ * The text string for minor code
	220	+ *
	221	+ * @serial
	222	+ */
	223	+ private String minorMessage = null;
	224	+
	225	+ /**
	226	+ * Alternate text string for major code
	227	+ *
	228	+ * @serial
	229	+ */
	230	+
	231	+ private String majorString = null;
	232	+
	233	+ /**
	234	+ * Creates a GSSException object with a specified major code.
	235	+ *
	236	+ * @param majorCode the The GSS error code for the problem causing this
	237	+ * exception to be thrown.
	238	+ */
	239	+ public GSSException (int majorCode) {
	240	+
	241	+ if (validateMajor(majorCode))
	242	+ major = majorCode;
	243	+ else
	244	+ major = FAILURE;
	245	+ }
	246	+
	247	+ /**
	248	+ * Construct a GSSException object with a specified major code and a
	249	+ * specific major string for it.
	250	+ *
	251	+ * @param majorCode the fatal error code causing this exception.
	252	+ * @param majorString an expicit message to be included in this exception
	253	+ */
	254	+ GSSException (int majorCode, String majorString) {
	255	+
	256	+ if (validateMajor(majorCode))
	257	+ major = majorCode;
	258	+ else
	259	+ major = FAILURE;
	260	+ this.majorString = majorString;
	261	+ }
	262	+
	263	+
	264	+ /**
	265	+ * Creates a GSSException object with the specified major code, minor
	266	+ * code, and minor code textual explanation. This constructor is to be
	267	+ * used when the exception is originating from the underlying mechanism
	268	+ * level. It allows the setting of both the GSS code and the mechanism
	269	+ * code.
	270	+ *
	271	+ * @param majorCode the GSS error code for the problem causing this
	272	+ * exception to be thrown.
	273	+ * @param minorCode the mechanism level error code for the problem
	274	+ * causing this exception to be thrown.
	275	+ * @param minorString the textual explanation of the mechanism error
	276	+ * code.
	277	+ */
	278	+ public GSSException (int majorCode, int minorCode, String minorString) {
	279	+
	280	+ if (validateMajor(majorCode))
	281	+ major = majorCode;
	282	+ else
	283	+ major = FAILURE;
	284	+
	285	+ minor = minorCode;
	286	+ minorMessage = minorString;
	287	+ }
	288	+
	289	+ /**
	290	+ * Returns the GSS-API level major error code for the problem causing
	291	+ * this exception to be thrown. Major error codes are
	292	+ * defined at the mechanism independent GSS-API level in this
	293	+ * class. Mechanism specific error codes that might provide more
	294	+ * information aer set as the minor error code.
	295	+ *
	296	+ * @return int the GSS-API level major error code causing this exception
	297	+ * @see #getMajorString
	298	+ * @see #getMinor
	299	+ * @see #getMinorString
	300	+ */
	301	+ public int getMajor() {
	302	+ return major;
	303	+ }
	304	+
	305	+ /**
	306	+ * Returns the mechanism level error code for the problem causing this
	307	+ * exception to be thrown. The minor code is set by the underlying
	308	+ * mechanism.
	309	+ *
	310	+ * @return int the mechanism error code; 0 indicates that it has not
	311	+ * been set.
	312	+ * @see #getMinorString
	313	+ * @see #setMinor
	314	+ */
	315	+ public int getMinor(){
	316	+ return minor;
	317	+ }
	318	+
	319	+ /**
	320	+ * Returns a string explaining the GSS-API level major error code in
	321	+ * this exception.
	322	+ *
	323	+ * @return String explanation string for the major error code
	324	+ * @see #getMajor
	325	+ * @see #toString
	326	+ */
	327	+ public String getMajorString() {
	328	+
	329	+ if (majorString != null)
	330	+ return majorString;
	331	+ else
	332	+ return messages[major - 1];
	333	+ }
	334	+
	335	+
	336	+ /**
	337	+ * Returns a string explaining the mechanism specific error code.
	338	+ * If the minor status code is 0, then no mechanism level error details
	339	+ * will be available.
	340	+ *
	341	+ * @return String a textual explanation of mechanism error code
	342	+ * @see #getMinor
	343	+ * @see #getMajorString
	344	+ * @see #toString
	345	+ */
	346	+ public String getMinorString() {
	347	+
	348	+ return minorMessage;
	349	+ }
	350	+
	351	+
	352	+ /**
	353	+ * Used by the exception thrower to set the mechanism
	354	+ * level minor error code and its string explanation. This is used by
	355	+ * mechanism providers to indicate error details.
	356	+ *
	357	+ * @param minorCode the mechanism specific error code
	358	+ * @param message textual explanation of the mechanism error code
	359	+ * @see #getMinor
	360	+ */
	361	+ public void setMinor(int minorCode, String message) {
	362	+
	363	+ minor = minorCode;
	364	+ minorMessage = message;
	365	+ }
	366	+
	367	+
	368	+ /**
	369	+ * Returns a textual representation of both the major and the minor
	370	+ * status codes.
	371	+ *
	372	+ * @return a String with the error descriptions
	373	+ */
	374	+ public String toString() {
	375	+ return ("GSSException: " + getMessage());
	376	+ }
	377	+
	378	+ /**
	379	+ * Returns a textual representation of both the major and the minor
	380	+ * status codes.
	381	+ *
	382	+ * @return a String with the error descriptions
	383	+ */
	384	+ public String getMessage() {
	385	+ if (minor == 0)
	386	+ return (getMajorString());
	387	+
	388	+ return (getMajorString()
	389	+ + " (Mechanism level: " + getMinorString() + ")");
	390	+ }
	391	+
	392	+
	393	+ /*
	394	+ * Validates the major code in the proper range.
	395	+ */
	396	+ private boolean validateMajor(int major) {
	397	+
	398	+ if (major > 0 && major <= messages.length)
	399	+ return (true);
	400	+
	401	+ return (false);
	402	+ }
	403	+}

java/pkg/org/ietf/jgss/GSSManager.class+0−0

Binary file not shown.

java/pkg/org/ietf/jgss/GSSManager.java+729−0

@@ -0,0 +1,729 @@
	1	+/*
	2	+ * Copyright (c) 2000, 2001, Oracle and/or its affiliates. All rights reserved.
	3	+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
	4	+ *
	5	+ * This code is free software; you can redistribute it and/or modify it
	6	+ * under the terms of the GNU General Public License version 2 only, as
	7	+ * published by the Free Software Foundation. Oracle designates this
	8	+ * particular file as subject to the "Classpath" exception as provided
	9	+ * by Oracle in the LICENSE file that accompanied this code.
	10	+ *
	11	+ * This code is distributed in the hope that it will be useful, but WITHOUT
	12	+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
	13	+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
	14	+ * version 2 for more details (a copy is included in the LICENSE file that
	15	+ * accompanied this code).
	16	+ *
	17	+ * You should have received a copy of the GNU General Public License version
	18	+ * 2 along with this work; if not, write to the Free Software Foundation,
	19	+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
	20	+ *
	21	+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
	22	+ * or visit www.oracle.com if you need additional information or have any
	23	+ * questions.
	24	+ */
	25	+
	26	+package org.ietf.jgss;
	27	+
	28	+import java.security.Provider;
	29	+
	30	+/**
	31	+ * This class serves as a factory for other important
	32	+ * GSS-API classes and also provides information about the mechanisms that
	33	+ * are supported. It can create instances of classes
	34	+ * implementing the following three GSS-API interfaces: {@link
	35	+ * GSSName GSSName}, {@link GSSCredential GSSCredential}, and {@link
	36	+ * GSSContext GSSContext}. It also has methods to query for the list
	37	+ * of available mechanisms and the nametypes that each mechanism
	38	+ * supports.<p>
	39	+ *
	40	+ * An instance of the default <code>GSSManager</code> subclass
	41	+ * may be obtained through the static method {@link #getInstance()
	42	+ * getInstance}, but applications are free to instantiate other subclasses
	43	+ * of <code>GSSManager</code>. The default <code>GSSManager</code> instance
	44	+ * will support the Kerberos v5 GSS-API mechanism in addition to any
	45	+ * others. This mechanism is identified by the Oid "1.2.840.113554.1.2.2"
	46	+ * and is defined in RFC 1964.<p>
	47	+ *
	48	+ * A subclass extending the <code>GSSManager</code> abstract class may be
	49	+ * implemented as a modular provider based layer that utilizes some well
	50	+ * known service provider specification. The <code>GSSManager</code> API
	51	+ * allows the application to set provider preferences on
	52	+ * such an implementation. These methods also allow the implementation to
	53	+ * throw a well-defined exception in case provider based configuration is
	54	+ * not supported. Applications that expect to be portable should be aware
	55	+ * of this and recover cleanly by catching the exception.<p>
	56	+ *
	57	+ * It is envisioned that there will be three most common ways in which
	58	+ * providers will be used:<p>
	59	+ * <ol>
	60	+ * <li> The application does not care about what provider is used (the
	61	+ * default case).
	62	+ * <li> The application wants a particular provider to be used
	63	+ * preferentially, either for a particular mechanism or all the
	64	+ * time, irrespective of mechanism.
	65	+ * <li> The application wants to use the locally configured providers
	66	+ * as far as possible but if support is missing for one or more
	67	+ * mechanisms then it wants to fall back on its own provider.
	68	+ *</ol><p>
	69	+ *
	70	+ * The <code>GSSManager</code> class has two methods that enable these modes of
	71	+ * usage: {@link #addProviderAtFront(Provider, Oid) addProviderAtFront} and
	72	+ * {@link #addProviderAtEnd(Provider, Oid) addProviderAtEnd}. These methods
	73	+ * have the effect of creating an ordered list of <i><provider,
	74	+ * oid></i> pairs where each pair indicates a preference of provider
	75	+ * for a given oid.<p>
	76	+ *
	77	+ * It is important to note that there are certain interactions
	78	+ * between the different GSS-API objects that are created by a
	79	+ * GSSManager, where the provider that is used for a particular mechanism
	80	+ * might need to be consistent across all objects. For instance, if a
	81	+ * GSSCredential contains elements from a provider <i>p</i> for a mechanism
	82	+ * <i>m</i>, it should generally be passed in to a GSSContext that will use
	83	+ * provider <i>p</i> for the mechanism <i>m</i>. A simple rule of thumb
	84	+ * that will maximize portability is that objects created from different
	85	+ * GSSManager's should not be mixed, and if possible, a different
	86	+ * GSSManager instance should be created if the application wants to invoke
	87	+ * the <code>addProviderAtFront</code> method on a GSSManager that has
	88	+ * already created an object.<p>
	89	+ *
	90	+ * Here is some sample code showing how the GSSManager might be used: <p>
	91	+ * <pre>
	92	+ * GSSManager manager = GSSManager.getInstance();
	93	+ *
	94	+ * Oid krb5Mechanism = new Oid("1.2.840.113554.1.2.2");
	95	+ * Oid krb5PrincipalNameType = new Oid("1.2.840.113554.1.2.2.1");
	96	+ *
	97	+ * // Identify who the client wishes to be
	98	+ * GSSName userName = manager.createName("duke", GSSName.NT_USER_NAME);
	99	+ *
	100	+ * // Identify the name of the server. This uses a Kerberos specific
	101	+ * // name format.
	102	+ * GSSName serverName = manager.createName("nfs/foo.sun.com",
	103	+ * krb5PrincipalNameType);
	104	+ *
	105	+ * // Acquire credentials for the user
	106	+ * GSSCredential userCreds = manager.createCredential(userName,
	107	+ * GSSCredential.DEFAULT_LIFETIME,
	108	+ * krb5Mechanism,
	109	+ * GSSCredential.INITIATE_ONLY);
	110	+ *
	111	+ * // Instantiate and initialize a security context that will be
	112	+ * // established with the server
	113	+ * GSSContext context = manager.createContext(serverName,
	114	+ * krb5Mechanism,
	115	+ * userCreds,
	116	+ * GSSContext.DEFAULT_LIFETIME);
	117	+ * </pre><p>
	118	+ *
	119	+ * The server side might use the following variation of this source:<p>
	120	+ *
	121	+ * <pre>
	122	+ * // Acquire credentials for the server
	123	+ * GSSCredential serverCreds = manager.createCredential(serverName,
	124	+ * GSSCredential.DEFAULT_LIFETIME,
	125	+ * krb5Mechanism,
	126	+ * GSSCredential.ACCEPT_ONLY);
	127	+ *
	128	+ * // Instantiate and initialize a security context that will
	129	+ * // wait for an establishment request token from the client
	130	+ * GSSContext context = manager.createContext(serverCreds);
	131	+ * </pre>
	132	+ *
	133	+ * @author Mayank Upadhyay
	134	+ * @see GSSName
	135	+ * @see GSSCredential
	136	+ * @see GSSContext
	137	+ * @since 1.4
	138	+ */
	139	+public abstract class GSSManager {
	140	+
	141	+ /**
	142	+ * Returns the default GSSManager implementation.
	143	+ *
	144	+ * @return a GSSManager implementation
	145	+ */
	146	+ public static GSSManager getInstance() {
	147	+ return new sun.security.jgss.GSSManagerImpl();
	148	+ }
	149	+
	150	+ /**
	151	+ * Returns a list of mechanisms that are available to GSS-API callers
	152	+ * through this GSSManager. The default GSSManager obtained from the
	153	+ * {@link #getInstance() getInstance()} method includes the Oid
	154	+ * "1.2.840.113554.1.2.2" in its list. This Oid identifies the Kerberos
	155	+ * v5 GSS-API mechanism that is defined in RFC 1964.
	156	+ *
	157	+ * @return an array of Oid objects corresponding to the mechanisms that
	158	+ * are available. A <code>null</code> value is returned when no
	159	+ * mechanism are available (an example of this would be when mechanism
	160	+ * are dynamically configured, and currently no mechanisms are
	161	+ * installed).
	162	+ */
	163	+ public abstract Oid[] getMechs();
	164	+
	165	+ /**
	166	+ * Returns then name types supported by the indicated mechanism.<p>
	167	+ *
	168	+ * The default GSSManager instance includes support for the Kerberos v5
	169	+ * mechanism. When this mechanism ("1.2.840.113554.1.2.2") is indicated,
	170	+ * the returned list will contain at least the following nametypes:
	171	+ * {@link GSSName#NT_HOSTBASED_SERVICE GSSName.NT_HOSTBASED_SERVICE},
	172	+ * {@link GSSName#NT_EXPORT_NAME GSSName.NT_EXPORT_NAME}, and the
	173	+ * Kerberos v5 specific Oid "1.2.840.113554.1.2.2.1". The namespace for
	174	+ * the Oid "1.2.840.113554.1.2.2.1" is defined in RFC 1964.
	175	+ *
	176	+ * @return an array of Oid objects corresponding to the name types that
	177	+ * the mechanism supports.
	178	+ * @param mech the Oid of the mechanism to query
	179	+ *
	180	+ * @see #getMechsForName(Oid)
	181	+ *
	182	+ * @throws GSSException containing the following
	183	+ * major error codes:
	184	+ * {@link GSSException#BAD_MECH GSSException.BAD_MECH}
	185	+ * {@link GSSException#FAILURE GSSException.FAILURE}
	186	+ */
	187	+ public abstract Oid[] getNamesForMech(Oid mech)
	188	+ throws GSSException;
	189	+
	190	+ /**
	191	+ * Returns a list of mechanisms that support the indicated name type.<p>
	192	+ *
	193	+ * The Kerberos v5 mechanism ("1.2.840.113554.1.2.2") will always be
	194	+ * returned in this list when the indicated nametype is one of
	195	+ * {@link GSSName#NT_HOSTBASED_SERVICE GSSName.NT_HOSTBASED_SERVICE},
	196	+ * {@link GSSName#NT_EXPORT_NAME GSSName.NT_EXPORT_NAME}, or
	197	+ * "1.2.840.113554.1.2.2.1".
	198	+ *
	199	+ * @return an array of Oid objects corresponding to the mechanisms that
	200	+ * support the specified name type. <code>null</code> is returned when no
	201	+ * mechanisms are found to support the specified name type.
	202	+ * @param nameType the Oid of the name type to look for
	203	+ *
	204	+ * @see #getNamesForMech(Oid)
	205	+ */
	206	+ public abstract Oid[] getMechsForName(Oid nameType);
	207	+
	208	+ /**
	209	+ * Factory method to convert a string name from the
	210	+ * specified namespace to a GSSName object. In general, the
	211	+ * <code>GSSName</code> object created will contain multiple
	212	+ * representations of the name, one for each mechanism that is
	213	+ * supported; two examples that are exceptions to this are when
	214	+ * the namespace type parameter indicates NT_EXPORT_NAME or when the
	215	+ * GSS-API implementation is not multi-mechanism. It is
	216	+ * not recommended to use this method with a NT_EXPORT_NAME type because
	217	+ * representing a previously exported name consisting of abitrary bytes
	218	+ * as a String might cause problems with character encoding schemes. In
	219	+ * such cases it is recommended that the bytes be passed in directly to
	220	+ * the overloaded form of this method {@link #createName(byte[],
	221	+ * Oid) createName}.
	222	+ *
	223	+ * @param nameStr the string representing a printable form of the name to
	224	+ * create.
	225	+ * @param nameType the Oid specifying the namespace of the printable name
	226	+ * supplied. <code>null</code> can be used to specify
	227	+ * that a mechanism specific default printable syntax should
	228	+ * be assumed by each mechanism that examines nameStr.
	229	+ * It is not advisable to use the nametype NT_EXPORT_NAME with this
	230	+ * method.
	231	+ * @return a GSSName representing the indicated principal
	232	+ *
	233	+ * @see GSSName
	234	+ * @see GSSName#NT_EXPORT_NAME
	235	+ *
	236	+ * @throws GSSException containing the following
	237	+ * major error codes:
	238	+ * {@link GSSException#BAD_NAMETYPE GSSException.BAD_NAMETYPE},
	239	+ * {@link GSSException#BAD_NAME GSSException.BAD_NAME},
	240	+ * {@link GSSException#BAD_MECH GSSException.BAD_MECH},
	241	+ * {@link GSSException#FAILURE GSSException.FAILURE}
	242	+ */
	243	+ public abstract GSSName createName(String nameStr, Oid nameType)
	244	+ throws GSSException;
	245	+
	246	+ /**
	247	+ * Factory method to convert a byte array containing a
	248	+ * name from the specified namespace to a GSSName object. In general,
	249	+ * the <code>GSSName</code> object created will contain multiple
	250	+ * representations of the name, one for each mechanism that is
	251	+ * supported; two examples that are exceptions to this are when the
	252	+ * namespace type parameter indicates NT_EXPORT_NAME or when the
	253	+ * GSS-API implementation is not multi-mechanism. The bytes that are
	254	+ * passed in are interpreted by each underlying mechanism according to
	255	+ * some encoding scheme of its choice for the given nametype.
	256	+ *
	257	+ * @param name the byte array containing the name to create
	258	+ * @param nameType the Oid specifying the namespace of the name supplied
	259	+ * in the byte array. <code>null</code> can be used to specify that a
	260	+ * mechanism specific default syntax should be assumed by each mechanism
	261	+ * that examines the byte array.
	262	+ * @return a GSSName representing the indicated principal
	263	+ *
	264	+ * @see GSSName
	265	+ * @see GSSName#NT_EXPORT_NAME
	266	+ *
	267	+ * @throws GSSException containing the following
	268	+ * major error codes:
	269	+ * {@link GSSException#BAD_NAMETYPE GSSException.BAD_NAMETYPE},
	270	+ * {@link GSSException#BAD_NAME GSSException.BAD_NAME},
	271	+ * {@link GSSException#BAD_MECH GSSException.BAD_MECH},
	272	+ * {@link GSSException#FAILURE GSSException.FAILURE}
	273	+ */
	274	+ public abstract GSSName createName(byte name[], Oid nameType)
	275	+ throws GSSException;
	276	+
	277	+ /**
	278	+ * Factory method to convert a string name from the
	279	+ * specified namespace to a GSSName object and canonicalize it at the
	280	+ * same time for a mechanism. In other words, this method is
	281	+ * a utility that does the equivalent of two steps: the {@link
	282	+ * #createName(String, Oid) createName} and then also the {@link
	283	+ * GSSName#canonicalize(Oid) GSSName.canonicalize}.
	284	+ *
	285	+ * @param nameStr the string representing a printable form of the name to
	286	+ * create.
	287	+ * @param nameType the Oid specifying the namespace of the printable name
	288	+ * supplied. <code>null</code> can be used to specify
	289	+ * that a mechanism specific default printable syntax should
	290	+ * be assumed by each mechanism that examines nameStr.
	291	+ * It is not advisable to use the nametype NT_EXPORT_NAME with this
	292	+ * method.
	293	+ * @param mech Oid specifying the mechanism for which the name should be
	294	+ * canonicalized
	295	+ * @return a GSSName representing the indicated principal
	296	+ *
	297	+ * @see GSSName#canonicalize(Oid)
	298	+ * @see GSSName#NT_EXPORT_NAME
	299	+ *
	300	+ * @throws GSSException containing the following
	301	+ * major error codes:
	302	+ * {@link GSSException#BAD_NAMETYPE GSSException.BAD_NAMETYPE},
	303	+ * {@link GSSException#BAD_NAME GSSException.BAD_NAME},
	304	+ * {@link GSSException#BAD_MECH GSSException.BAD_MECH},
	305	+ * {@link GSSException#FAILURE GSSException.FAILURE}
	306	+ */
	307	+ public abstract GSSName createName(String nameStr, Oid nameType,
	308	+ Oid mech) throws GSSException;
	309	+
	310	+ /**
	311	+ * Factory method to convert a byte array containing a
	312	+ * name from the specified namespace to a GSSName object and canonicalize
	313	+ * it at the same time for a mechanism. In other words, this method is a
	314	+ * utility that does the equivalent of two steps: the {@link
	315	+ * #createName(byte[], Oid) createName} and then also {@link
	316	+ * GSSName#canonicalize(Oid) GSSName.canonicalize}.
	317	+ *
	318	+ * @param name the byte array containing the name to create
	319	+ * @param nameType the Oid specifying the namespace of the name supplied
	320	+ * in the byte array. <code>null</code> can be used to specify that a
	321	+ * mechanism specific default syntax should be assumed by each mechanism
	322	+ * that examines the byte array.
	323	+ * @param mech Oid specifying the mechanism for which the name should be
	324	+ * canonicalized
	325	+ * @return a GSSName representing the indicated principal
	326	+ *
	327	+ * @see GSSName#canonicalize(Oid)
	328	+ * @see GSSName#NT_EXPORT_NAME
	329	+ *
	330	+ * @throws GSSException containing the following
	331	+ * major error codes:
	332	+ * {@link GSSException#BAD_NAMETYPE GSSException.BAD_NAMETYPE},
	333	+ * {@link GSSException#BAD_NAME GSSException.BAD_NAME},
	334	+ * {@link GSSException#BAD_MECH GSSException.BAD_MECH},
	335	+ * {@link GSSException#FAILURE GSSException.FAILURE}
	336	+ */
	337	+ public abstract GSSName createName(byte name[], Oid nameType, Oid mech)
	338	+ throws GSSException;
	339	+
	340	+ /**
	341	+ * Factory method for acquiring default credentials. This will cause
	342	+ * the GSS-API to use system specific defaults for the set of mechanisms,
	343	+ * name, and lifetime.<p>
	344	+ *
	345	+ * GSS-API mechanism providers must impose a local access-control
	346	+ * policy on callers to prevent unauthorized callers from acquiring
	347	+ * credentials to which they are not entitled. The kinds of permissions
	348	+ * needed by different mechanism providers will be documented on a
	349	+ * per-mechanism basis. A failed permission check might cause a {@link
	350	+ * java.lang.SecurityException SecurityException} to be thrown from
	351	+ * this method.
	352	+ *
	353	+ * @param usage The intended usage for this credential object. The value
	354	+ * of this parameter must be one of:
	355	+ * {@link GSSCredential#INITIATE_AND_ACCEPT
	356	+ * GSSCredential.INITIATE_AND_ACCEPT},
	357	+ * {@link GSSCredential#ACCEPT_ONLY GSSCredential.ACCEPT_ONLY}, and
	358	+ * {@link GSSCredential#INITIATE_ONLY GSSCredential.INITIATE_ONLY}.
	359	+ * @return a GSSCredential of the requested type.
	360	+ *
	361	+ * @see GSSCredential
	362	+ *
	363	+ * @throws GSSException containing the following
	364	+ * major error codes:
	365	+ * {@link GSSException#BAD_MECH GSSException.BAD_MECH},
	366	+ * {@link GSSException#BAD_NAMETYPE GSSException.BAD_NAMETYPE},
	367	+ * {@link GSSException#BAD_NAME GSSException.BAD_NAME},
	368	+ * {@link GSSException#CREDENTIALS_EXPIRED
	369	+ * GSSException.CREDENTIALS_EXPIRED},
	370	+ * {@link GSSException#NO_CRED GSSException.NO_CRED},
	371	+ * {@link GSSException#FAILURE GSSException.FAILURE}
	372	+ */
	373	+ public abstract GSSCredential createCredential (int usage)
	374	+ throws GSSException;
	375	+
	376	+ /**
	377	+ * Factory method for acquiring a single mechanism credential.<p>
	378	+ *
	379	+ * GSS-API mechanism providers must impose a local access-control
	380	+ * policy on callers to prevent unauthorized callers from acquiring
	381	+ * credentials to which they are not entitled. The kinds of permissions
	382	+ * needed by different mechanism providers will be documented on a
	383	+ * per-mechanism basis. A failed permission check might cause a {@link
	384	+ * java.lang.SecurityException SecurityException} to be thrown from
	385	+ * this method. <p>
	386	+ *
	387	+ * Non-default values for lifetime cannot always be honored by the
	388	+ * underlying mechanisms, thus applications should be prepared to call
	389	+ * {@link GSSCredential#getRemainingLifetime() getRemainingLifetime}
	390	+ * on the returned credential.<p>
	391	+ *
	392	+ * @param name the name of the principal for whom this credential is to be
	393	+ * acquired. Use <code>null</code> to specify the default principal.
	394	+ * @param lifetime The number of seconds that credentials should remain
	395	+ * valid. Use {@link GSSCredential#INDEFINITE_LIFETIME
	396	+ * GSSCredential.INDEFINITE_LIFETIME} to request that the credentials
	397	+ * have the maximum permitted lifetime. Use {@link
	398	+ * GSSCredential#DEFAULT_LIFETIME GSSCredential.DEFAULT_LIFETIME} to
	399	+ * request default credential lifetime.
	400	+ * @param mech the Oid of the desired mechanism. Use <code>(Oid) null
	401	+ * </code> to request the default mechanism.
	402	+ * @param usage The intended usage for this credential object. The value
	403	+ * of this parameter must be one of:
	404	+ * {@link GSSCredential#INITIATE_AND_ACCEPT
	405	+ * GSSCredential.INITIATE_AND_ACCEPT},
	406	+ * {@link GSSCredential#ACCEPT_ONLY GSSCredential.ACCEPT_ONLY}, and
	407	+ * {@link GSSCredential#INITIATE_ONLY GSSCredential.INITIATE_ONLY}.
	408	+ * @return a GSSCredential of the requested type.
	409	+ *
	410	+ * @see GSSCredential
	411	+ *
	412	+ * @throws GSSException containing the following
	413	+ * major error codes:
	414	+ * {@link GSSException#BAD_MECH GSSException.BAD_MECH},
	415	+ * {@link GSSException#BAD_NAMETYPE GSSException.BAD_NAMETYPE},
	416	+ * {@link GSSException#BAD_NAME GSSException.BAD_NAME},
	417	+ * {@link GSSException#CREDENTIALS_EXPIRED
	418	+ * GSSException.CREDENTIALS_EXPIRED},
	419	+ * {@link GSSException#NO_CRED GSSException.NO_CRED},
	420	+ * {@link GSSException#FAILURE GSSException.FAILURE}
	421	+ */
	422	+ public abstract GSSCredential createCredential (GSSName name,
	423	+ int lifetime, Oid mech, int usage)
	424	+ throws GSSException;
	425	+
	426	+ /**
	427	+ * Factory method for acquiring credentials over a set of
	428	+ * mechanisms. This method attempts to acquire credentials for
	429	+ * each of the mechanisms specified in the array called mechs. To
	430	+ * determine the list of mechanisms for which the acquisition of
	431	+ * credentials succeeded, the caller should use the {@link
	432	+ * GSSCredential#getMechs() GSSCredential.getMechs} method.<p>
	433	+ *
	434	+ * GSS-API mechanism providers must impose a local access-control
	435	+ * policy on callers to prevent unauthorized callers from acquiring
	436	+ * credentials to which they are not entitled. The kinds of permissions
	437	+ * needed by different mechanism providers will be documented on a
	438	+ * per-mechanism basis. A failed permission check might cause a {@link
	439	+ * java.lang.SecurityException SecurityException} to be thrown from
	440	+ * this method.<p>
	441	+ *
	442	+ * Non-default values for lifetime cannot always be honored by the
	443	+ * underlying mechanisms, thus applications should be prepared to call
	444	+ * {@link GSSCredential#getRemainingLifetime() getRemainingLifetime}
	445	+ * on the returned credential.<p>
	446	+ *
	447	+ * @param name the name of the principal for whom this credential is to
	448	+ * be acquired. Use <code>null</code> to specify the default
	449	+ * principal.
	450	+ * @param lifetime The number of seconds that credentials should remain
	451	+ * valid. Use {@link GSSCredential#INDEFINITE_LIFETIME
	452	+ * GSSCredential.INDEFINITE_LIFETIME} to request that the credentials
	453	+ * have the maximum permitted lifetime. Use {@link
	454	+ * GSSCredential#DEFAULT_LIFETIME GSSCredential.DEFAULT_LIFETIME} to
	455	+ * request default credential lifetime.
	456	+ * @param mechs an array of Oid's indicating the mechanisms over which
	457	+ * the credential is to be acquired. Use <code>(Oid[]) null</code> for
	458	+ * requesting a system specific default set of mechanisms.
	459	+ * @param usage The intended usage for this credential object. The value
	460	+ * of this parameter must be one of:
	461	+ * {@link GSSCredential#INITIATE_AND_ACCEPT
	462	+ * GSSCredential.INITIATE_AND_ACCEPT},
	463	+ * {@link GSSCredential#ACCEPT_ONLY GSSCredential.ACCEPT_ONLY}, and
	464	+ * {@link GSSCredential#INITIATE_ONLY GSSCredential.INITIATE_ONLY}.
	465	+ * @return a GSSCredential of the requested type.
	466	+ *
	467	+ * @see GSSCredential
	468	+ *
	469	+ * @throws GSSException containing the following
	470	+ * major error codes:
	471	+ * {@link GSSException#BAD_MECH GSSException.BAD_MECH},
	472	+ * {@link GSSException#BAD_NAMETYPE GSSException.BAD_NAMETYPE},
	473	+ * {@link GSSException#BAD_NAME GSSException.BAD_NAME},
	474	+ * {@link GSSException#CREDENTIALS_EXPIRED
	475	+ * GSSException.CREDENTIALS_EXPIRED},
	476	+ * {@link GSSException#NO_CRED GSSException.NO_CRED},
	477	+ * {@link GSSException#FAILURE GSSException.FAILURE}
	478	+ */
	479	+ public abstract GSSCredential createCredential(GSSName name,
	480	+ int lifetime, Oid mechs[], int usage)
	481	+ throws GSSException;
	482	+
	483	+ /**
	484	+ * Factory method for creating a context on the initiator's
	485	+ * side.
	486	+ *
	487	+ * Some mechanism providers might require that the caller be granted
	488	+ * permission to initiate a security context. A failed permission check
	489	+ * might cause a {@link java.lang.SecurityException SecurityException}
	490	+ * to be thrown from this method.<p>
	491	+ *
	492	+ * Non-default values for lifetime cannot always be honored by the
	493	+ * underlying mechanism, thus applications should be prepared to call
	494	+ * {@link GSSContext#getLifetime() getLifetime} on the returned
	495	+ * context.<p>
	496	+ *
	497	+ * @param peer the name of the target peer.
	498	+ * @param mech the Oid of the desired mechanism. Use <code>null</code>
	499	+ * to request the default mechanism.
	500	+ * @param myCred the credentials of the initiator. Use
	501	+ * <code>null</code> to act as the default initiator principal.
	502	+ * @param lifetime the lifetime, in seconds, requested for the
	503	+ * context. Use {@link GSSContext#INDEFINITE_LIFETIME
	504	+ * GSSContext.INDEFINITE_LIFETIME} to request that the context have the
	505	+ * maximum permitted lifetime. Use {@link GSSContext#DEFAULT_LIFETIME
	506	+ * GSSContext.DEFAULT_LIFETIME} to request a default lifetime for the
	507	+ * context.
	508	+ * @return an unestablished GSSContext
	509	+ *
	510	+ * @see GSSContext
	511	+ *
	512	+ * @throws GSSException containing the following
	513	+ * major error codes:
	514	+ * {@link GSSException#NO_CRED GSSException.NO_CRED}
	515	+ * {@link GSSException#CREDENTIALS_EXPIRED
	516	+ * GSSException.CREDENTIALS_EXPIRED}
	517	+ * {@link GSSException#BAD_NAMETYPE GSSException.BAD_NAMETYPE}
	518	+ * {@link GSSException#BAD_MECH GSSException.BAD_MECH}
	519	+ * {@link GSSException#FAILURE GSSException.FAILURE}
	520	+ */
	521	+ public abstract GSSContext createContext(GSSName peer, Oid mech,
	522	+ GSSCredential myCred, int lifetime)
	523	+ throws GSSException;
	524	+
	525	+ /**
	526	+ * Factory method for creating a context on the acceptor' side. The
	527	+ * context's properties will be determined from the input token supplied
	528	+ * to the accept method.
	529	+ *
	530	+ * Some mechanism providers might require that the caller be granted
	531	+ * permission to accept a security context. A failed permission check
	532	+ * might cause a {@link java.lang.SecurityException SecurityException}
	533	+ * to be thrown from this method.
	534	+ *
	535	+ * @param myCred the credentials for the acceptor. Use
	536	+ * <code>null</code> to act as a default acceptor principal.
	537	+ * @return an unestablished GSSContext
	538	+ *
	539	+ * @see GSSContext
	540	+ *
	541	+ * @throws GSSException containing the following
	542	+ * major error codes:
	543	+ * {@link GSSException#NO_CRED GSSException.NO_CRED}
	544	+ * {@link GSSException#CREDENTIALS_EXPIRED
	545	+ * GSSException.CREDENTIALS_EXPIRED}
	546	+ * {@link GSSException#BAD_MECH GSSException.BAD_MECH}
	547	+ * {@link GSSException#FAILURE GSSException.FAILURE}
	548	+ */
	549	+ public abstract GSSContext createContext(GSSCredential myCred)
	550	+ throws GSSException;
	551	+
	552	+ /**
	553	+ * Factory method for creating a previously exported context. The
	554	+ * context properties will be determined from the input token and
	555	+ * cannot be modified through the set methods.<p>
	556	+ *
	557	+ * Implementations are not required to support the inter-process
	558	+ * transfer of security contexts. Before exporting a context, calling
	559	+ * the {@link GSSContext#isTransferable() GSSContext.isTransferable}
	560	+ * will indicate if the context is transferable. Calling this method in
	561	+ * an implementation that does not support it will result in a
	562	+ * <code>GSSException</code> with the error
	563	+ * code {@link GSSException#UNAVAILABLE GSSException.UNAVAILABLE}.
	564	+ *
	565	+ * Some mechanism providers might require that the caller be granted
	566	+ * permission to initiate or accept a security context. A failed
	567	+ * permission check might cause a {@link java.lang.SecurityException
	568	+ * SecurityException} to be thrown from this method.
	569	+ *
	570	+ * @param interProcessToken the token previously emitted from the
	571	+ * export method.
	572	+ * @return the previously established GSSContext
	573	+ *
	574	+ * @see GSSContext
	575	+ *
	576	+ * @throws GSSException containing the following
	577	+ * major error codes:
	578	+ * {@link GSSException#NO_CONTEXT GSSException.NO_CONTEXT},
	579	+ * {@link GSSException#DEFECTIVE_TOKEN GSSException.DEFECTIVE_TOKEN},
	580	+ * {@link GSSException#UNAVAILABLE GSSException.UNAVAILABLE},
	581	+ * {@link GSSException#UNAUTHORIZED GSSException.UNAUTHORIZED},
	582	+ * {@link GSSException#FAILURE GSSException.FAILURE}
	583	+ */
	584	+ public abstract GSSContext createContext(byte [] interProcessToken)
	585	+ throws GSSException;
	586	+
	587	+ /**
	588	+ * This method is used to indicate to the GSSManager that the
	589	+ * application would like a particular provider to be used ahead of all
	590	+ * others when support is desired for the given mechanism. When a value
	591	+ * of null is used instead of an <code>Oid</code> for the mechanism,
	592	+ * the GSSManager must use the indicated provider ahead of all others
	593	+ * no matter what the mechanism is. Only when the indicated provider
	594	+ * does not support the needed mechanism should the GSSManager move on
	595	+ * to a different provider.<p>
	596	+ *
	597	+ * Calling this method repeatedly preserves the older settings but
	598	+ * lowers them in preference thus forming an ordered list of provider
	599	+ * and <code>Oid</code> pairs that grows at the top.<p>
	600	+ *
	601	+ * Calling addProviderAtFront with a null <code>Oid</code> will remove
	602	+ * all previous preferences that were set for this provider in the
	603	+ * GSSManager instance. Calling addProviderAtFront with a non-null
	604	+ * <code>Oid</code> will remove any previous preference that was set
	605	+ * using this mechanism and this provider together.<p>
	606	+ *
	607	+ * If the GSSManager implementation does not support an SPI with a
	608	+ * pluggable provider architecture it should throw a GSSException with
	609	+ * the status code GSSException.UNAVAILABLE to indicate that the
	610	+ * operation is unavailable.<p>
	611	+ *
	612	+ * Suppose an application desired that the provider A always be checked
	613	+ * first when any mechanism is needed, it would call:<p>
	614	+ * <pre>
	615	+ * GSSManager mgr = GSSManager.getInstance();
	616	+ * // mgr may at this point have its own pre-configured list
	617	+ * // of provider preferences. The following will prepend to
	618	+ * // any such list:
	619	+ *
	620	+ * mgr.addProviderAtFront(A, null);
	621	+ * </pre>
	622	+ * Now if it also desired that the mechanism of Oid m1 always be
	623	+ * obtained from the provider B before the previously set A was checked,
	624	+ * it would call:<p>
	625	+ * <pre>
	626	+ * mgr.addProviderAtFront(B, m1);
	627	+ * </pre>
	628	+ * The GSSManager would then first check with B if m1 was needed. In
	629	+ * case B did not provide support for m1, the GSSManager would continue
	630	+ * on to check with A. If any mechanism m2 is needed where m2 is
	631	+ * different from m1 then the GSSManager would skip B and check with A
	632	+ * directly.<p>
	633	+ *
	634	+ * Suppose at a later time the following call is made to the same
	635	+ * GSSManager instance:<p>
	636	+ * <pre>
	637	+ * mgr.addProviderAtFront(B, null)
	638	+ * </pre>
	639	+ * then the previous setting with the pair (B, m1) is subsumed by this
	640	+ * and should be removed. Effectively the list of preferences now
	641	+ * becomes {(B, null), (A, null),
	642	+ * ... //followed by the pre-configured list.<p>
	643	+ *
	644	+ * Please note, however, that the following call:
	645	+ * <pre>
	646	+ * mgr.addProviderAtFront(A, m3)
	647	+ * </pre>
	648	+ * does not subsume the previous setting of (A, null) and the list will
	649	+ * effectively become {(A, m3), (B, null), (A, null), ...}
	650	+ *
	651	+ * @param p the provider instance that should be used whenever support
	652	+ * is needed for mech.
	653	+ * @param mech the mechanism for which the provider is being set
	654	+ *
	655	+ * @throws GSSException containing the following
	656	+ * major error codes:
	657	+ * {@link GSSException#UNAVAILABLE GSSException.UNAVAILABLE},
	658	+ * {@link GSSException#FAILURE GSSException.FAILURE}
	659	+ */
	660	+ public abstract void addProviderAtFront(Provider p, Oid mech)
	661	+ throws GSSException;
	662	+
	663	+ /**
	664	+ * This method is used to indicate to the GSSManager that the
	665	+ * application would like a particular provider to be used if no other
	666	+ * provider can be found that supports the given mechanism. When a value
	667	+ * of null is used instead of an Oid for the mechanism, the GSSManager
	668	+ * must use the indicated provider for any mechanism.<p>
	669	+ *
	670	+ * Calling this method repeatedly preserves the older settings but
	671	+ * raises them above newer ones in preference thus forming an ordered
	672	+ * list of providers and Oid pairs that grows at the bottom. Thus the
	673	+ * older provider settings will be utilized first before this one is.<p>
	674	+ *
	675	+ * If there are any previously existing preferences that conflict with
	676	+ * the preference being set here, then the GSSManager should ignore this
	677	+ * request.<p>
	678	+ *
	679	+ * If the GSSManager implementation does not support an SPI with a
	680	+ * pluggable provider architecture it should throw a GSSException with
	681	+ * the status code GSSException.UNAVAILABLE to indicate that the
	682	+ * operation is unavailable.<p>
	683	+ *
	684	+ * Suppose an application desired that when a mechanism of Oid m1 is
	685	+ * needed the system default providers always be checked first, and only
	686	+ * when they do not support m1 should a provider A be checked. It would
	687	+ * then make the call:<p>
	688	+ * <pre>
	689	+ * GSSManager mgr = GSSManager.getInstance();
	690	+ * mgr.addProviderAtEnd(A, m1);
	691	+ * </pre>
	692	+ * Now, if it also desired that for all mechanisms the provider B be
	693	+ * checked after all configured providers have been checked, it would
	694	+ * then call:<p>
	695	+ * <pre>
	696	+ * mgr.addProviderAtEnd(B, null);
	697	+ * </pre>
	698	+ * Effectively the list of preferences now becomes {..., (A, m1), (B,
	699	+ * null)}.<p>
	700	+ *
	701	+ * Suppose at a later time the following call is made to the same
	702	+ * GSSManager instance:<p>
	703	+ * <pre>
	704	+ * mgr.addProviderAtEnd(B, m2)
	705	+ * </pre>
	706	+ * then the previous setting with the pair (B, null) subsumes this and
	707	+ * therefore this request should be ignored. The same would happen if a
	708	+ * request is made for the already existing pairs of (A, m1) or (B,
	709	+ * null).<p>
	710	+ *
	711	+ * Please note, however, that the following call:<p>
	712	+ * <pre>
	713	+ * mgr.addProviderAtEnd(A, null)
	714	+ * </pre>
	715	+ * is not subsumed by the previous setting of (A, m1) and the list will
	716	+ * effectively become {..., (A, m1), (B, null), (A, null)}
	717	+ *
	718	+ * @param p the provider instance that should be used whenever support
	719	+ * is needed for mech.
	720	+ * @param mech the mechanism for which the provider is being set
	721	+ *
	722	+ * @throws GSSException containing the following
	723	+ * major error codes:
	724	+ * {@link GSSException#UNAVAILABLE GSSException.UNAVAILABLE},
	725	+ * {@link GSSException#FAILURE GSSException.FAILURE}
	726	+ */
	727	+ public abstract void addProviderAtEnd(Provider p, Oid mech)
	728	+ throws GSSException;
	729	+}

java/pkg/org/ietf/jgss/GSSName.class+0−0

Binary file not shown.

java/pkg/org/ietf/jgss/GSSName.java+295−0

@@ -0,0 +1,295 @@
	1	+/*
	2	+ * Copyright (c) 2000, 2010, Oracle and/or its affiliates. All rights reserved.
	3	+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
	4	+ *
	5	+ * This code is free software; you can redistribute it and/or modify it
	6	+ * under the terms of the GNU General Public License version 2 only, as
	7	+ * published by the Free Software Foundation. Oracle designates this
	8	+ * particular file as subject to the "Classpath" exception as provided
	9	+ * by Oracle in the LICENSE file that accompanied this code.
	10	+ *
	11	+ * This code is distributed in the hope that it will be useful, but WITHOUT
	12	+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
	13	+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
	14	+ * version 2 for more details (a copy is included in the LICENSE file that
	15	+ * accompanied this code).
	16	+ *
	17	+ * You should have received a copy of the GNU General Public License version
	18	+ * 2 along with this work; if not, write to the Free Software Foundation,
	19	+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
	20	+ *
	21	+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
	22	+ * or visit www.oracle.com if you need additional information or have any
	23	+ * questions.
	24	+ */
	25	+
	26	+package org.ietf.jgss;
	27	+
	28	+import sun.security.jgss.spi.*;
	29	+import java.util.Vector;
	30	+import java.util.Enumeration;
	31	+
	32	+/**
	33	+ * This interface encapsulates a single GSS-API principal entity. The
	34	+ * application obtains an implementation of this interface
	35	+ * through one of the <code>createName</code> methods that exist in the {@link
	36	+ * GSSManager GSSManager} class. Conceptually a GSSName contains many
	37	+ * representations of the entity or many primitive name elements, one for
	38	+ * each supported underlying mechanism. In GSS terminology, a GSSName that
	39	+ * contains an element from just one mechanism is called a Mechanism Name
	40	+ * (MN)<p>
	41	+ *
	42	+ * Since different authentication mechanisms may employ different
	43	+ * namespaces for identifying their principals, GSS-API's naming support is
	44	+ * necessarily complex in multi-mechanism environments (or even in some
	45	+ * single-mechanism environments where the underlying mechanism supports
	46	+ * multiple namespaces). Different name formats and their definitions are
	47	+ * identified with {@link Oid Oid's} and some standard types
	48	+ * are defind in this interface. The format of the names can be derived
	49	+ * based on the unique <code>Oid</code> of its name type.<p>
	50	+ *
	51	+ * Included below are code examples utilizing the <code>GSSName</code> interface.
	52	+ * The code below creates a <code>GSSName</code>, converts it to an MN, performs a
	53	+ * comparison, obtains a printable representation of the name, exports it
	54	+ * to a byte array and then re-imports to obtain a
	55	+ * new <code>GSSName</code>.<p>
	56	+ * <pre>
	57	+ * GSSManager manager = GSSManager.getInstance();
	58	+ *
	59	+ * // create a host based service name
	60	+ * GSSName name = manager.createName("service@host",
	61	+ * GSSName.NT_HOSTBASED_SERVICE);
	62	+ *
	63	+ * Oid krb5 = new Oid("1.2.840.113554.1.2.2");
	64	+ *
	65	+ * GSSName mechName = name.canonicalize(krb5);
	66	+ *
	67	+ * // the above two steps are equivalent to the following
	68	+ * GSSName mechName = manager.createName("service@host",
	69	+ * GSSName.NT_HOSTBASED_SERVICE, krb5);
	70	+ *
	71	+ * // perform name comparison
	72	+ * if (name.equals(mechName))
	73	+ * print("Names are equals.");
	74	+ *
	75	+ * // obtain textual representation of name and its printable
	76	+ * // name type
	77	+ * print(mechName.toString() +
	78	+ * mechName.getStringNameType().toString());
	79	+ *
	80	+ * // export and re-import the name
	81	+ * byte [] exportName = mechName.export();
	82	+ *
	83	+ * // create a new name object from the exported buffer
	84	+ * GSSName newName = manager.createName(exportName,
	85	+ * GSSName.NT_EXPORT_NAME);
	86	+ *
	87	+ * </pre>
	88	+ * @see #export()
	89	+ * @see #equals(GSSName)
	90	+ * @see GSSManager#createName(String, Oid)
	91	+ * @see GSSManager#createName(String, Oid, Oid)
	92	+ * @see GSSManager#createName(byte[], Oid)
	93	+ *
	94	+ * @author Mayank Upadhyay
	95	+ * @since 1.4
	96	+ */
	97	+public interface GSSName {
	98	+
	99	+ /**
	100	+ * Oid indicating a host-based service name form. It is used to
	101	+ * represent services associated with host computers. This name form
	102	+ * is constructed using two elements, "service" and "hostname", as
	103	+ * follows: service@hostname.<p>
	104	+ *
	105	+ * It represents the following Oid value:<br>
	106	+ * <code>{ iso(1) member-body(2) United
	107	+ * States(840) mit(113554) infosys(1) gssapi(2) generic(1) service_name(4)
	108	+ * }</code>
	109	+ */
	110	+ public static final Oid NT_HOSTBASED_SERVICE
	111	+ = Oid.getInstance("1.2.840.113554.1.2.1.4");
	112	+
	113	+ /**
	114	+ * Name type to indicate a named user on a local system.<p>
	115	+ * It represents the following Oid value:<br>
	116	+ * <code>{ iso(1) member-body(2) United
	117	+ * States(840) mit(113554) infosys(1) gssapi(2) generic(1) user_name(1)
	118	+ * }</code>
	119	+ */
	120	+ public static final Oid NT_USER_NAME
	121	+ = Oid.getInstance("1.2.840.113554.1.2.1.1");
	122	+
	123	+ /**
	124	+ * Name type to indicate a numeric user identifier corresponding to a
	125	+ * user on a local system. (e.g. Uid).<p>
	126	+ *
	127	+ * It represents the following Oid value:<br>
	128	+ * <code>{ iso(1) member-body(2) United States(840) mit(113554)
	129	+ * infosys(1) gssapi(2) generic(1) machine_uid_name(2) }</code>
	130	+ */
	131	+ public static final Oid NT_MACHINE_UID_NAME
	132	+ = Oid.getInstance("1.2.840.113554.1.2.1.2");
	133	+
	134	+ /**
	135	+ * Name type to indicate a string of digits representing the numeric
	136	+ * user identifier of a user on a local system.<p>
	137	+ *
	138	+ * It represents the following Oid value:<br>
	139	+ * <code>{ iso(1) member-body(2) United
	140	+ * States(840) mit(113554) infosys(1) gssapi(2) generic(1)
	141	+ * string_uid_name(3) }</code>
	142	+ */
	143	+ public static final Oid NT_STRING_UID_NAME
	144	+ = Oid.getInstance("1.2.840.113554.1.2.1.3");
	145	+
	146	+ /**
	147	+ * Name type for representing an anonymous entity.<p>
	148	+ * It represents the following Oid value:<br>
	149	+ * <code>{ 1(iso), 3(org), 6(dod), 1(internet),
	150	+ * 5(security), 6(nametypes), 3(gss-anonymous-name) }</code>
	151	+ */
	152	+ public static final Oid NT_ANONYMOUS
	153	+ = Oid.getInstance("1.3.6.1.5.6.3");
	154	+
	155	+ /**
	156	+ * Name type used to indicate an exported name produced by the export
	157	+ * method.<p>
	158	+ *
	159	+ * It represents the following Oid value:<br> <code>{ 1(iso),
	160	+ * 3(org), 6(dod), 1(internet), 5(security), 6(nametypes),
	161	+ * 4(gss-api-exported-name) }</code>
	162	+ */
	163	+ public static final Oid NT_EXPORT_NAME
	164	+ = Oid.getInstance("1.3.6.1.5.6.4");
	165	+
	166	+ /**
	167	+ * Compares two <code>GSSName</code> objects to determine if they refer to the
	168	+ * same entity.
	169	+ *
	170	+ * @param another the <code>GSSName</code> to compare this name with
	171	+ * @return true if the two names contain at least one primitive element
	172	+ * in common. If either of the names represents an anonymous entity, the
	173	+ * method will return false.
	174	+ *
	175	+ * @throws GSSException when the names cannot be compared, containing the following
	176	+ * major error codes:
	177	+ * {@link GSSException#BAD_NAMETYPE GSSException.BAD_NAMETYPE},
	178	+ * {@link GSSException#FAILURE GSSException.FAILURE}
	179	+ */
	180	+ public boolean equals(GSSName another) throws GSSException;
	181	+
	182	+ /**
	183	+ * Compares this <code>GSSName</code> object to another Object that might be a
	184	+ * <code>GSSName</code>. The behaviour is exactly the same as in {@link
	185	+ * #equals(GSSName) equals} except that no GSSException is thrown;
	186	+ * instead, false will be returned in the situation where an error
	187	+ * occurs.
	188	+ * @return true if the object to compare to is also a <code>GSSName</code> and the two
	189	+ * names refer to the same entity.
	190	+ * @param another the object to compare this name to
	191	+ * @see #equals(GSSName)
	192	+ */
	193	+ public boolean equals(Object another);
	194	+
	195	+ /**
	196	+ * Returns a hashcode value for this GSSName.
	197	+ *
	198	+ * @return a hashCode value
	199	+ */
	200	+ public int hashCode();
	201	+
	202	+ /**
	203	+ * Creates a name that is canonicalized for some
	204	+ * mechanism.
	205	+ *
	206	+ * @return a <code>GSSName</code> that contains just one primitive
	207	+ * element representing this name in a canonicalized form for the desired
	208	+ * mechanism.
	209	+ * @param mech the oid for the mechanism for which the canonical form of
	210	+ * the name is requested.
	211	+ *
	212	+ * @throws GSSException containing the following
	213	+ * major error codes:
	214	+ * {@link GSSException#BAD_MECH GSSException.BAD_MECH},
	215	+ * {@link GSSException#BAD_NAMETYPE GSSException.BAD_NAMETYPE},
	216	+ * {@link GSSException#BAD_NAME GSSException.BAD_NAME},
	217	+ * {@link GSSException#FAILURE GSSException.FAILURE}
	218	+ */
	219	+ public GSSName canonicalize(Oid mech) throws GSSException;
	220	+
	221	+ /**
	222	+ * Returns a canonical contiguous byte representation of a mechanism name
	223	+ * (MN), suitable for direct, byte by byte comparison by authorization
	224	+ * functions. If the name is not an MN, implementations may throw a
	225	+ * GSSException with the NAME_NOT_MN status code. If an implementation
	226	+ * chooses not to throw an exception, it should use some system specific
	227	+ * default mechanism to canonicalize the name and then export
	228	+ * it. Structurally, an exported name object consists of a header
	229	+ * containing an OID identifying the mechanism that authenticated the
	230	+ * name, and a trailer containing the name itself, where the syntax of
	231	+ * the trailer is defined by the individual mechanism specification. The
	232	+ * format of the header of the output buffer is specified in RFC 2743.<p>
	233	+ *
	234	+ * The exported name is useful when used in large access control lists
	235	+ * where the overhead of creating a <code>GSSName</code> object on each
	236	+ * name and invoking the equals method on each name from the ACL may be
	237	+ * prohibitive.<p>
	238	+ *
	239	+ * Exported names may be re-imported by using the byte array factory
	240	+ * method {@link GSSManager#createName(byte[], Oid)
	241	+ * GSSManager.createName} and specifying the NT_EXPORT_NAME as the name
	242	+ * type object identifier. The resulting <code>GSSName</code> name will
	243	+ * also be a MN.<p>
	244	+ * @return a byte[] containing the exported name. RFC 2743 defines the
	245	+ * "Mechanism-Independent Exported Name Object Format" for these bytes.
	246	+ *
	247	+ * @throws GSSException containing the following
	248	+ * major error codes:
	249	+ * {@link GSSException#BAD_NAME GSSException.BAD_NAME},
	250	+ * {@link GSSException#BAD_NAMETYPE GSSException.BAD_NAMETYPE},
	251	+ * {@link GSSException#FAILURE GSSException.FAILURE}
	252	+ */
	253	+ public byte[] export() throws GSSException;
	254	+
	255	+ /**
	256	+ * Returns a textual representation of the <code>GSSName</code> object. To retrieve
	257	+ * the printed name format, which determines the syntax of the returned
	258	+ * string, use the {@link #getStringNameType() getStringNameType}
	259	+ * method.
	260	+ *
	261	+ * @return a String representing this name in printable form.
	262	+ */
	263	+ public String toString();
	264	+
	265	+ /**
	266	+ * Returns the name type of the printable
	267	+ * representation of this name that can be obtained from the <code>
	268	+ * toString</code> method.
	269	+ *
	270	+ * @return an Oid representing the namespace of the name returned
	271	+ * from the toString method.
	272	+ *
	273	+ * @throws GSSException containing the following
	274	+ * major error codes:
	275	+ * {@link GSSException#FAILURE GSSException.FAILURE}
	276	+ */
	277	+ public Oid getStringNameType() throws GSSException;
	278	+
	279	+ /**
	280	+ * Tests if this name object represents an anonymous entity.
	281	+ *
	282	+ * @return true if this is an anonymous name, false otherwise.
	283	+ */
	284	+ public boolean isAnonymous();
	285	+
	286	+ /**
	287	+ * Tests if this name object represents a Mechanism Name (MN). An MN is
	288	+ * a GSSName the contains exactly one mechanism's primitive name
	289	+ * element.
	290	+ *
	291	+ * @return true if this is an MN, false otherwise.
	292	+ */
	293	+ public boolean isMN();
	294	+
	295	+}

java/pkg/org/ietf/jgss/MessageProp.class+0−0

Binary file not shown.

java/pkg/org/ietf/jgss/MessageProp.java+235−0

@@ -0,0 +1,235 @@
	1	+/*
	2	+ * Copyright (c) 2000, 2001, Oracle and/or its affiliates. All rights reserved.
	3	+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
	4	+ *
	5	+ * This code is free software; you can redistribute it and/or modify it
	6	+ * under the terms of the GNU General Public License version 2 only, as
	7	+ * published by the Free Software Foundation. Oracle designates this
	8	+ * particular file as subject to the "Classpath" exception as provided
	9	+ * by Oracle in the LICENSE file that accompanied this code.
	10	+ *
	11	+ * This code is distributed in the hope that it will be useful, but WITHOUT
	12	+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
	13	+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
	14	+ * version 2 for more details (a copy is included in the LICENSE file that
	15	+ * accompanied this code).
	16	+ *
	17	+ * You should have received a copy of the GNU General Public License version
	18	+ * 2 along with this work; if not, write to the Free Software Foundation,
	19	+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
	20	+ *
	21	+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
	22	+ * or visit www.oracle.com if you need additional information or have any
	23	+ * questions.
	24	+ */
	25	+
	26	+package org.ietf.jgss;
	27	+
	28	+/**
	29	+ * This is a utility class used within the per-message GSSContext
	30	+ * methods to convey per-message properties.<p>
	31	+ *
	32	+ * When used with the GSSContext interface's wrap and getMIC methods, an
	33	+ * instance of this class is used to indicate the desired
	34	+ * Quality-of-Protection (QOP) and to request if confidentiality services
	35	+ * are to be applied to caller supplied data (wrap only). To request
	36	+ * default QOP, the value of 0 should be used for QOP.<p>
	37	+ *
	38	+ * When used with the unwrap and verifyMIC methods of the GSSContext
	39	+ * interface, an instance of this class will be used to indicate the
	40	+ * applied QOP and confidentiality services over the supplied message.
	41	+ * In the case of verifyMIC, the confidentiality state will always be
	42	+ * <code>false</code>. Upon return from these methods, this object will also
	43	+ * contain any supplementary status values applicable to the processed
	44	+ * token. The supplementary status values can indicate old tokens, out
	45	+ * of sequence tokens, gap tokens or duplicate tokens.<p>
	46	+ *
	47	+ * @see GSSContext#wrap
	48	+ * @see GSSContext#unwrap
	49	+ * @see GSSContext#getMIC
	50	+ * @see GSSContext#verifyMIC
	51	+ *
	52	+ * @author Mayank Upadhyay
	53	+ * @since 1.4
	54	+ */
	55	+public class MessageProp {
	56	+
	57	+ private boolean privacyState;
	58	+ private int qop;
	59	+ private boolean dupToken;
	60	+ private boolean oldToken;
	61	+ private boolean unseqToken;
	62	+ private boolean gapToken;
	63	+ private int minorStatus;
	64	+ private String minorString;
	65	+
	66	+ /**
	67	+ * Constructor which sets the desired privacy state. The QOP value used
	68	+ * is 0.
	69	+ *
	70	+ * @param privState the privacy (i.e. confidentiality) state
	71	+ */
	72	+ public MessageProp(boolean privState) {
	73	+ this(0, privState);
	74	+ }
	75	+
	76	+ /**
	77	+ * Constructor which sets the values for the qop and privacy state.
	78	+ *
	79	+ * @param qop the QOP value
	80	+ * @param privState the privacy (i.e. confidentiality) state
	81	+ */
	82	+ public MessageProp(int qop, boolean privState) {
	83	+ this.qop = qop;
	84	+ this.privacyState = privState;
	85	+ resetStatusValues();
	86	+ }
	87	+
	88	+ /**
	89	+ * Retrieves the QOP value.
	90	+ *
	91	+ * @return an int representing the QOP value
	92	+ * @see #setQOP
	93	+ */
	94	+ public int getQOP() {
	95	+ return qop;
	96	+ }
	97	+
	98	+ /**
	99	+ * Retrieves the privacy state.
	100	+ *
	101	+ * @return true if the privacy (i.e., confidentiality) state is true,
	102	+ * false otherwise.
	103	+ * @see #setPrivacy
	104	+ */
	105	+ public boolean getPrivacy() {
	106	+
	107	+ return (privacyState);
	108	+ }
	109	+
	110	+ /**
	111	+ * Sets the QOP value.
	112	+ *
	113	+ * @param qop the int value to set the QOP to
	114	+ * @see #getQOP
	115	+ */
	116	+ public void setQOP(int qop) {
	117	+ this.qop = qop;
	118	+ }
	119	+
	120	+
	121	+ /**
	122	+ * Sets the privacy state.
	123	+ *
	124	+ * @param privState true is the privacy (i.e., confidentiality) state
	125	+ * is true, false otherwise.
	126	+ * @see #getPrivacy
	127	+ */
	128	+ public void setPrivacy(boolean privState) {
	129	+
	130	+ this.privacyState = privState;
	131	+ }
	132	+
	133	+
	134	+ /**
	135	+ * Tests if this is a duplicate of an earlier token.
	136	+ *
	137	+ * @return true if this is a duplicate, false otherwise.
	138	+ */
	139	+ public boolean isDuplicateToken() {
	140	+ return dupToken;
	141	+ }
	142	+
	143	+ /**
	144	+ * Tests if this token's validity period has expired, i.e., the token
	145	+ * is too old to be checked for duplication.
	146	+ *
	147	+ * @return true if the token's validity period has expired, false
	148	+ * otherwise.
	149	+ */
	150	+ public boolean isOldToken() {
	151	+ return oldToken;
	152	+ }
	153	+
	154	+ /**
	155	+ * Tests if a later token had already been processed.
	156	+ *
	157	+ * @return true if a later token had already been processed, false otherwise.
	158	+ */
	159	+ public boolean isUnseqToken() {
	160	+ return unseqToken;
	161	+ }
	162	+
	163	+ /**
	164	+ * Tests if an expected token was not received, i.e., one or more
	165	+ * predecessor tokens have not yet been successfully processed.
	166	+ *
	167	+ * @return true if an expected per-message token was not received,
	168	+ * false otherwise.
	169	+ */
	170	+ public boolean isGapToken() {
	171	+ return gapToken;
	172	+ }
	173	+
	174	+ /**
	175	+ * Retrieves the minor status code that the underlying mechanism might
	176	+ * have set for this per-message operation.
	177	+ *
	178	+ * @return the int minor status
	179	+ */
	180	+ public int getMinorStatus(){
	181	+ return minorStatus;
	182	+ }
	183	+
	184	+ /**
	185	+ * Retrieves a string explaining the minor status code.
	186	+ *
	187	+ * @return a String corresponding to the minor status
	188	+ * code. <code>null</code> will be returned when no minor status code
	189	+ * has been set.
	190	+ */
	191	+ public String getMinorString(){
	192	+ return minorString;
	193	+ }
	194	+
	195	+ /**
	196	+ * This method sets the state for the supplementary information flags
	197	+ * and the minor status in MessageProp. It is not used by the
	198	+ * application but by the GSS implementation to return this information
	199	+ * to the caller of a per-message context method.
	200	+ *
	201	+ * @param duplicate true if the token was a duplicate of an earlier
	202	+ * token, false otherwise
	203	+ * @param old true if the token's validity period has expired, false
	204	+ * otherwise
	205	+ * @param unseq true if a later token has already been processed, false
	206	+ * otherwise
	207	+ * @param gap true if one or more predecessor tokens have not yet been
	208	+ * successfully processed, false otherwise
	209	+ * @param minorStatus the int minor status code for the per-message
	210	+ * operation
	211	+ * @param minorString the textual representation of the minorStatus value
	212	+ */
	213	+ public void setSupplementaryStates(boolean duplicate,
	214	+ boolean old, boolean unseq, boolean gap,
	215	+ int minorStatus, String minorString) {
	216	+ this.dupToken = duplicate;
	217	+ this.oldToken = old;
	218	+ this.unseqToken = unseq;
	219	+ this.gapToken = gap;
	220	+ this.minorStatus = minorStatus;
	221	+ this.minorString = minorString;
	222	+ }
	223	+
	224	+ /**
	225	+ * Resets the supplementary status values to false.
	226	+ */
	227	+ private void resetStatusValues() {
	228	+ dupToken = false;
	229	+ oldToken = false;
	230	+ unseqToken = false;
	231	+ gapToken = false;
	232	+ minorStatus = 0;
	233	+ minorString = null;
	234	+ }
	235	+}

java/pkg/org/ietf/jgss/Oid.class+0−0

Binary file not shown.

java/pkg/org/ietf/jgss/Oid.java+216−0

@@ -0,0 +1,216 @@
	1	+/*
	2	+ * Copyright (c) 2000, 2006, Oracle and/or its affiliates. All rights reserved.
	3	+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
	4	+ *
	5	+ * This code is free software; you can redistribute it and/or modify it
	6	+ * under the terms of the GNU General Public License version 2 only, as
	7	+ * published by the Free Software Foundation. Oracle designates this
	8	+ * particular file as subject to the "Classpath" exception as provided
	9	+ * by Oracle in the LICENSE file that accompanied this code.
	10	+ *
	11	+ * This code is distributed in the hope that it will be useful, but WITHOUT
	12	+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
	13	+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
	14	+ * version 2 for more details (a copy is included in the LICENSE file that
	15	+ * accompanied this code).
	16	+ *
	17	+ * You should have received a copy of the GNU General Public License version
	18	+ * 2 along with this work; if not, write to the Free Software Foundation,
	19	+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
	20	+ *
	21	+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
	22	+ * or visit www.oracle.com if you need additional information or have any
	23	+ * questions.
	24	+ */
	25	+
	26	+package org.ietf.jgss;
	27	+
	28	+import java.io.InputStream;
	29	+import java.io.IOException;
	30	+import sun.security.util.DerValue;
	31	+import sun.security.util.DerOutputStream;
	32	+import sun.security.util.ObjectIdentifier;
	33	+
	34	+/**
	35	+ * This class represents Universal Object Identifiers (Oids) and their
	36	+ * associated operations.<p>
	37	+ *
	38	+ * Oids are hierarchically globally-interpretable identifiers used
	39	+ * within the GSS-API framework to identify mechanisms and name formats.<p>
	40	+ *
	41	+ * The structure and encoding of Oids is defined in ISOIEC-8824 and
	42	+ * ISOIEC-8825. For example the Oid representation of Kerberos V5
	43	+ * mechanism is "1.2.840.113554.1.2.2"<p>
	44	+ *
	45	+ * The GSSName name class contains public static Oid objects
	46	+ * representing the standard name types defined in GSS-API.
	47	+ *
	48	+ * @author Mayank Upadhyay
	49	+ * @since 1.4
	50	+ */
	51	+public class Oid {
	52	+
	53	+ private ObjectIdentifier oid;
	54	+ private byte[] derEncoding;
	55	+
	56	+ /**
	57	+ * Constructs an Oid object from a string representation of its
	58	+ * integer components.
	59	+ *
	60	+ * @param strOid the dot separated string representation of the oid.
	61	+ * For instance, "1.2.840.113554.1.2.2".
	62	+ * @exception GSSException may be thrown when the string is incorrectly
	63	+ * formatted
	64	+ */
	65	+ public Oid(String strOid) throws GSSException {
	66	+
	67	+ try {
	68	+ oid = new ObjectIdentifier(strOid);
	69	+ derEncoding = null;
	70	+ } catch (Exception e) {
	71	+ throw new GSSException(GSSException.FAILURE,
	72	+ "Improperly formatted Object Identifier String - "
	73	+ + strOid);
	74	+ }
	75	+ }
	76	+
	77	+ /**
	78	+ * Creates an Oid object from its ASN.1 DER encoding. This refers to
	79	+ * the full encoding including tag and length. The structure and
	80	+ * encoding of Oids is defined in ISOIEC-8824 and ISOIEC-8825. This
	81	+ * method is identical in functionality to its byte array counterpart.
	82	+ *
	83	+ * @param derOid stream containing the DER encoded oid
	84	+ * @exception GSSException may be thrown when the DER encoding does not
	85	+ * follow the prescribed format.
	86	+ */
	87	+ public Oid(InputStream derOid) throws GSSException {
	88	+ try {
	89	+ DerValue derVal = new DerValue(derOid);
	90	+ derEncoding = derVal.toByteArray();
	91	+ oid = derVal.getOID();
	92	+ } catch (IOException e) {
	93	+ throw new GSSException(GSSException.FAILURE,
	94	+ "Improperly formatted ASN.1 DER encoding for Oid");
	95	+ }
	96	+ }
	97	+
	98	+
	99	+ /**
	100	+ * Creates an Oid object from its ASN.1 DER encoding. This refers to
	101	+ * the full encoding including tag and length. The structure and
	102	+ * encoding of Oids is defined in ISOIEC-8824 and ISOIEC-8825. This
	103	+ * method is identical in functionality to its InputStream conterpart.
	104	+ *
	105	+ * @param data byte array containing the DER encoded oid
	106	+ * @exception GSSException may be thrown when the DER encoding does not
	107	+ * follow the prescribed format.
	108	+ */
	109	+ public Oid(byte [] data) throws GSSException {
	110	+ try {
	111	+ DerValue derVal = new DerValue(data);
	112	+ derEncoding = derVal.toByteArray();
	113	+ oid = derVal.getOID();
	114	+ } catch (IOException e) {
	115	+ throw new GSSException(GSSException.FAILURE,
	116	+ "Improperly formatted ASN.1 DER encoding for Oid");
	117	+ }
	118	+ }
	119	+
	120	+ /**
	121	+ * Only for calling by initializators used with declarations.
	122	+ *
	123	+ * @param strOid
	124	+ */
	125	+ static Oid getInstance(String strOid) {
	126	+ Oid retVal = null;
	127	+ try {
	128	+ retVal = new Oid(strOid);
	129	+ } catch (GSSException e) {
	130	+ // squelch it!
	131	+ }
	132	+ return retVal;
	133	+ }
	134	+
	135	+ /**
	136	+ * Returns a string representation of the oid's integer components
	137	+ * in dot separated notation.
	138	+ *
	139	+ * @return string representation in the following format: "1.2.3.4.5"
	140	+ */
	141	+ public String toString() {
	142	+ return oid.toString();
	143	+ }
	144	+
	145	+ /**
	146	+ * Tests if two Oid objects represent the same Object identifier
	147	+ * value.
	148	+ *
	149	+ * @return <code>true</code> if the two Oid objects represent the same
	150	+ * value, <code>false</code> otherwise.
	151	+ * @param other the Oid object that has to be compared to this one
	152	+ */
	153	+ public boolean equals(Object other) {
	154	+
	155	+ //check if both reference the same object
	156	+ if (this == other)
	157	+ return (true);
	158	+
	159	+ if (other instanceof Oid)
	160	+ return this.oid.equals(((Oid) other).oid);
	161	+ else if (other instanceof ObjectIdentifier)
	162	+ return this.oid.equals(other);
	163	+ else
	164	+ return false;
	165	+ }
	166	+
	167	+
	168	+ /**
	169	+ * Returns the full ASN.1 DER encoding for this oid object, which
	170	+ * includes the tag and length.
	171	+ *
	172	+ * @return byte array containing the DER encoding of this oid object.
	173	+ * @exception GSSException may be thrown when the oid can't be encoded
	174	+ */
	175	+ public byte[] getDER() throws GSSException {
	176	+
	177	+ if (derEncoding == null) {
	178	+ DerOutputStream dout = new DerOutputStream();
	179	+ try {
	180	+ dout.putOID(oid);
	181	+ } catch (IOException e) {
	182	+ throw new GSSException(GSSException.FAILURE, e.getMessage());
	183	+ }
	184	+ derEncoding = dout.toByteArray();
	185	+ }
	186	+
	187	+ return derEncoding.clone();
	188	+ }
	189	+
	190	+ /**
	191	+ * A utility method to test if this Oid value is contained within the
	192	+ * supplied Oid array.
	193	+ *
	194	+ * @param oids the array of Oid's to search
	195	+ * @return true if the array contains this Oid value, false otherwise
	196	+ */
	197	+ public boolean containedIn(Oid[] oids) {
	198	+
	199	+ for (int i = 0; i < oids.length; i++) {
	200	+ if (oids[i].equals(this))
	201	+ return (true);
	202	+ }
	203	+
	204	+ return (false);
	205	+ }
	206	+
	207	+
	208	+ /**
	209	+ * Returns a hashcode value for this Oid.
	210	+ *
	211	+ * @return a hashCode value
	212	+ */
	213	+ public int hashCode() {
	214	+ return oid.hashCode();
	215	+ }
	216	+}

java/pkg/org/ietf/jgss/mkfile+15−0

@@ -0,0 +1,15 @@
	1	+<../../../../../mkconfig
	2	+
	3	+TARG=\
	4	+ ChannelBinding.dis\
	5	+ GSSContext.dis\
	6	+ GSSCredential.dis\
	7	+ GSSException.dis\
	8	+ GSSManager.dis\
	9	+ GSSName.dis\
	10	+ MessageProp.dis\
	11	+ Oid.dis\
	12	+
	13	+DISBIN=$ROOT/java/dis/java/java/org/ietf/jgss
	14	+
	15	+<$ROOT/mkfiles/mkjava

java/pkg/org/ietf/jgss/package.html+127−0

@@ -0,0 +1,127 @@
	1	+<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2 Final//EN">
	2	+<html>
	3	+<head>
	4	+<!--
	5	+Copyright (c) 2000, 2006, Oracle and/or its affiliates. All rights reserved.
	6	+DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
	7	+
	8	+This code is free software; you can redistribute it and/or modify it
	9	+under the terms of the GNU General Public License version 2 only, as
	10	+published by the Free Software Foundation. Oracle designates this
	11	+particular file as subject to the "Classpath" exception as provided
	12	+by Oracle in the LICENSE file that accompanied this code.
	13	+
	14	+This code is distributed in the hope that it will be useful, but WITHOUT
	15	+ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
	16	+FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
	17	+version 2 for more details (a copy is included in the LICENSE file that
	18	+accompanied this code).
	19	+
	20	+You should have received a copy of the GNU General Public License version
	21	+2 along with this work; if not, write to the Free Software Foundation,
	22	+Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
	23	+
	24	+Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
	25	+or visit www.oracle.com if you need additional information or have any
	26	+questions.
	27	+-->
	28	+
	29	+</head>
	30	+<body bgcolor="white">
	31	+
	32	+ This package presents a framework that allows application developers to
	33	+ make use of security services like authentication, data integrity and
	34	+ data confidentiality from a variety of underlying security mechanisms
	35	+ like Kerberos, using a unified API. The security mechanisms that an
	36	+ application can
	37	+ chose to use are identified with unique object identifiers. One example
	38	+ of such a mechanism is the Kerberos v5 GSS-API mechanism (object
	39	+ identifier 1.2.840.113554.1.2.2). This mechanism is available through
	40	+ the default instance of the GSSManager class.<p>
	41	+
	42	+ The GSS-API is defined in a language independent way in
	43	+ <a href=http://www.ietf.org/rfc/rfc2743.txt>RFC 2743</a>. The Java
	44	+ language bindings are defined in
	45	+ <a href=http://www.ietf.org/rfc/rfc2853.txt>RFC 2853</a><p>
	46	+
	47	+ An application starts out by instantiating a <code>GSSManager</code>
	48	+ which then serves as a factory for a security context. An application
	49	+ can use specific principal names and credentials that are also created
	50	+ using the GSSManager; or it can instantiate a
	51	+ context with system defaults. It then goes through a context
	52	+ establishment loop. Once a context is established with the
	53	+ peer, authentication is complete. Data protection such as integrity
	54	+ and confidentiality can then be obtained from this context.<p>
	55	+
	56	+ The GSS-API does not perform any communication with the peer. It merely
	57	+ produces tokens that the application must somehow transport to the
	58	+ other end.<p>
	59	+
	60	+<h3>Credential Acquisition</h3>
	61	+<a name=useSubjectCredsOnly>
	62	+ The GSS-API itself does not dictate how an underlying mechanism
	63	+ obtains the credentials that are needed for authentication. It is
	64	+ assumed that prior to calling the GSS-API, these credentials are
	65	+ obtained and stored in a location that the mechanism provider is
	66	+ aware of. However, the default model in the Java platform will be
	67	+ that mechanism providers must obtain credentials only from the private
	68	+ or public credential sets associated with the
	69	+ {@link javax.security.auth.Subject Subject} in the
	70	+ current access control context. The Kerberos v5
	71	+ mechanism will search for the required INITIATE and ACCEPT credentials
	72	+ ({@link javax.security.auth.kerberos.KerberosTicket KerberosTicket} and
	73	+ {@link javax.security.auth.kerberos.KerberosKey KerberosKey}) in
	74	+ the private credential set where as some other mechanism might look
	75	+ in the public set or in both. If the desired credential is not
	76	+ present in the appropriate sets of the current Subject, the GSS-API
	77	+ call must fail.<p>
	78	+
	79	+ This model has the advantage that credential management
	80	+ is simple and predictable from the applications point of view. An
	81	+ application, given the right permissions, can purge the credentials in
	82	+ the Subject or renew them using standard Java API's. If it purged
	83	+ the credentials, it would be sure that the JGSS mechanism would fail,
	84	+ or if it renewed a time based credential it would be sure that a JGSS
	85	+ mechanism would succeed.<p>
	86	+
	87	+ This model does require that a {@link
	88	+ javax.security.auth.login JAAS login} be performed in order to
	89	+ authenticate and populate a Subject that the JGSS mechnanism can later
	90	+ utilize. However, applications have the ability to relax this
	91	+ restiction by means of a system property:
	92	+ <code>javax.security.auth.useSubjectCredsOnly</code>. By default
	93	+ this system property will be assumed to be <code>true</code> (even when
	94	+ it is unset) indicating that providers must only use the credentials
	95	+ that are present in the current Subject. However, if this property is
	96	+ explicitly set to false by the application, then it indicates that
	97	+ the provider is free to use any credentials cache of its choice. Such
	98	+ a credential cache might be a disk cache, an in-memory cache, or even
	99	+ just the current Subject itself.
	100	+</a>
	101	+
	102	+<h2>Related Documentation</h2>
	103	+<p>
	104	+For an online tutorial on using Java GSS-API, please see
	105	+<a href="../../../../technotes/guides/security/jgss/tutorials/index.html">Introduction to JAAS and Java GSS-API</a>.
	106	+</p>
	107	+
	108	+<!--
	109	+<h2>Package Specification</h2>
	110	+
	111	+##### FILL IN ANY SPECS NEEDED BY JAVA COMPATIBILITY KIT #####
	112	+<ul>
	113	+ <li><a href="">##### REFER TO ANY FRAMEMAKER SPECIFICATION HERE #####</a>
	114	+</ul>
	115	+
	116	+<h2>Related Documentation</h2>
	117	+
	118	+For overviews, tutorials, examples, guides, and tool documentation, please see:
	119	+<ul>
	120	+ <li><a href="">##### REFER TO NON-SPEC DOCUMENTATION HERE #####</a>
	121	+</ul>
	122	+
	123	+-->
	124	+
	125	+@since 1.4
	126	+</body>
	127	+</html>

java/pkg/org/ietf/mkfile+6−0

@@ -0,0 +1,6 @@
	1	+<../../../../mkconfig
	2	+
	3	+DIRS=\
	4	+ jgss\
	5	+
	6	+<$ROOT/mkfiles/mksubdirs

java/pkg/org/jcp/mkfile+6−0

@@ -0,0 +1,6 @@
	1	+<../../../../mkconfig
	2	+
	3	+DIRS=\
	4	+ xml\
	5	+
	6	+<$ROOT/mkfiles/mksubdirs

java/pkg/org/jcp/xml/dsig/internal/DigesterOutputStream.class+0−0

Binary file not shown.

java/pkg/org/jcp/xml/dsig/internal/DigesterOutputStream.java+123−0

@@ -0,0 +1,123 @@
	1	+/*
	2	+ * reserved comment block
	3	+ * DO NOT REMOVE OR ALTER!
	4	+ */
	5	+/*
	6	+ * Copyright 1999-2005 The Apache Software Foundation.
	7	+ *
	8	+ * Licensed under the Apache License, Version 2.0 (the "License");
	9	+ * you may not use this file except in compliance with the License.
	10	+ * You may obtain a copy of the License at
	11	+ *
	12	+ * http://www.apache.org/licenses/LICENSE-2.0
	13	+ *
	14	+ * Unless required by applicable law or agreed to in writing, software
	15	+ * distributed under the License is distributed on an "AS IS" BASIS,
	16	+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
	17	+ * See the License for the specific language governing permissions and
	18	+ * limitations under the License.
	19	+ *
	20	+ */
	21	+/*
	22	+ * Copyright (c) 2005, 2008, Oracle and/or its affiliates. All rights reserved.
	23	+ */
	24	+/*
	25	+ * $Id: DigesterOutputStream.java,v 1.2 2008/07/24 15:20:31 mullan Exp $
	26	+ */
	27	+package org.jcp.xml.dsig.internal;
	28	+
	29	+import java.io.ByteArrayInputStream;
	30	+import java.io.InputStream;
	31	+import java.io.OutputStream;
	32	+import java.security.MessageDigest;
	33	+import java.util.logging.Logger;
	34	+import java.util.logging.Level;
	35	+
	36	+import com.sun.org.apache.xml.internal.security.utils.UnsyncByteArrayOutputStream;
	37	+
	38	+/**
	39	+ * This class has been modified slightly to use java.security.MessageDigest
	40	+ * objects as input, rather than
	41	+ * com.sun.org.apache.xml.internal.security.algorithms.MessageDigestAlgorithm objects.
	42	+ * It also optionally caches the input bytes.
	43	+ *
	44	+ * @author raul
	45	+ * @author Sean Mullan
	46	+ */
	47	+public class DigesterOutputStream extends OutputStream {
	48	+ private boolean buffer = false;
	49	+ private UnsyncByteArrayOutputStream bos;
	50	+ private final MessageDigest md;
	51	+ private static Logger log = Logger.getLogger("org.jcp.xml.dsig.internal");
	52	+
	53	+ /**
	54	+ * Creates a DigesterOutputStream.
	55	+ *
	56	+ * @param md the MessageDigest
	57	+ */
	58	+ public DigesterOutputStream(MessageDigest md) {
	59	+ this(md, false);
	60	+ }
	61	+
	62	+ /**
	63	+ * Creates a DigesterOutputStream.
	64	+ *
	65	+ * @param md the MessageDigest
	66	+ * @param buffer if true, caches the input bytes
	67	+ */
	68	+ public DigesterOutputStream(MessageDigest md, boolean buffer) {
	69	+ this.md = md;
	70	+ this.buffer = buffer;
	71	+ if (buffer) {
	72	+ bos = new UnsyncByteArrayOutputStream();
	73	+ }
	74	+ }
	75	+
	76	+ /** @inheritDoc */
	77	+ public void write(byte[] input) {
	78	+ write(input, 0, input.length);
	79	+ }
	80	+
	81	+ /** @inheritDoc */
	82	+ public void write(int input) {
	83	+ if (buffer) {
	84	+ bos.write(input);
	85	+ }
	86	+ md.update((byte)input);
	87	+ }
	88	+
	89	+ /** @inheritDoc */
	90	+ public void write(byte[] input, int offset, int len) {
	91	+ if (buffer) {
	92	+ bos.write(input, offset, len);
	93	+ }
	94	+ if (log.isLoggable(Level.FINER)) {
	95	+ log.log(Level.FINER, "Pre-digested input:");
	96	+ StringBuffer sb = new StringBuffer(len);
	97	+ for (int i=offset; i<(offset+len); i++) {
	98	+ sb.append((char) input[i]);
	99	+ }
	100	+ log.log(Level.FINER, sb.toString());
	101	+ }
	102	+ md.update(input, offset, len);
	103	+ }
	104	+
	105	+ /**
	106	+ * @return the digest value
	107	+ */
	108	+ public byte[] getDigestValue() {
	109	+ return md.digest();
	110	+ }
	111	+
	112	+ /**
	113	+ * @return an input stream containing the cached bytes, or
	114	+ * null if not cached
	115	+ */
	116	+ public InputStream getInputStream() {
	117	+ if (buffer) {
	118	+ return new ByteArrayInputStream(bos.toByteArray());
	119	+ } else {
	120	+ return null;
	121	+ }
	122	+ }
	123	+}

java/pkg/org/jcp/xml/dsig/internal/MacOutputStream.class+0−0

Binary file not shown.

java/pkg/org/jcp/xml/dsig/internal/MacOutputStream.java+58−0

@@ -0,0 +1,58 @@
	1	+/*
	2	+ * reserved comment block
	3	+ * DO NOT REMOVE OR ALTER!
	4	+ */
	5	+/*
	6	+ * Copyright 1999-2005 The Apache Software Foundation.
	7	+ *
	8	+ * Licensed under the Apache License, Version 2.0 (the "License");
	9	+ * you may not use this file except in compliance with the License.
	10	+ * You may obtain a copy of the License at
	11	+ *
	12	+ * http://www.apache.org/licenses/LICENSE-2.0
	13	+ *
	14	+ * Unless required by applicable law or agreed to in writing, software
	15	+ * distributed under the License is distributed on an "AS IS" BASIS,
	16	+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
	17	+ * See the License for the specific language governing permissions and
	18	+ * limitations under the License.
	19	+ *
	20	+ */
	21	+package org.jcp.xml.dsig.internal;
	22	+
	23	+import java.io.ByteArrayOutputStream;
	24	+import javax.crypto.Mac;
	25	+
	26	+/**
	27	+ * Derived from Apache sources and changed to use Mac objects instead of
	28	+ * com.sun.org.apache.xml.internal.security.algorithms.SignatureAlgorithm objects.
	29	+ *
	30	+ * @author raul
	31	+ * @author Sean Mullan
	32	+ *
	33	+ */
	34	+public class MacOutputStream extends ByteArrayOutputStream {
	35	+ private final Mac mac;
	36	+
	37	+ public MacOutputStream(Mac mac) {
	38	+ this.mac = mac;
	39	+ }
	40	+
	41	+ /** @inheritDoc */
	42	+ public void write(byte[] arg0) {
	43	+ super.write(arg0, 0, arg0.length);
	44	+ mac.update(arg0);
	45	+ }
	46	+
	47	+ /** @inheritDoc */
	48	+ public void write(int arg0) {
	49	+ super.write(arg0);
	50	+ mac.update((byte) arg0);
	51	+ }
	52	+
	53	+ /** @inheritDoc */
	54	+ public void write(byte[] arg0, int arg1, int arg2) {
	55	+ super.write(arg0, arg1, arg2);
	56	+ mac.update(arg0, arg1, arg2);
	57	+ }
	58	+}

java/pkg/org/jcp/xml/dsig/internal/SignerOutputStream.class+0−0

Binary file not shown.

java/pkg/org/jcp/xml/dsig/internal/SignerOutputStream.java+77−0

@@ -0,0 +1,77 @@
	1	+/*
	2	+ * reserved comment block
	3	+ * DO NOT REMOVE OR ALTER!
	4	+ */
	5	+/*
	6	+ * Copyright 1999-2005 The Apache Software Foundation.
	7	+ *
	8	+ * Licensed under the Apache License, Version 2.0 (the "License");
	9	+ * you may not use this file except in compliance with the License.
	10	+ * You may obtain a copy of the License at
	11	+ *
	12	+ * http://www.apache.org/licenses/LICENSE-2.0
	13	+ *
	14	+ * Unless required by applicable law or agreed to in writing, software
	15	+ * distributed under the License is distributed on an "AS IS" BASIS,
	16	+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
	17	+ * See the License for the specific language governing permissions and
	18	+ * limitations under the License.
	19	+ *
	20	+ */
	21	+/*
	22	+ * Copyright (c) 2005, 2008, Oracle and/or its affiliates. All rights reserved.
	23	+ */
	24	+/*
	25	+ * $Id: SignerOutputStream.java,v 1.2 2008/07/24 15:20:31 mullan Exp $
	26	+ */
	27	+package org.jcp.xml.dsig.internal;
	28	+
	29	+import java.io.ByteArrayOutputStream;
	30	+import java.security.Signature;
	31	+import java.security.SignatureException;
	32	+
	33	+/**
	34	+ * Derived from Apache sources and changed to use java.security.Signature
	35	+ * objects as input instead of com.sun.org.apache.xml.internal.security.algorithms.SignatureAlgorithm
	36	+ * objects.
	37	+ *
	38	+ * @author raul
	39	+ * @author Sean Mullan
	40	+ */
	41	+public class SignerOutputStream extends ByteArrayOutputStream {
	42	+ private final Signature sig;
	43	+
	44	+ public SignerOutputStream(Signature sig) {
	45	+ this.sig=sig;
	46	+ }
	47	+
	48	+ /** @inheritDoc */
	49	+ public void write(byte[] arg0) {
	50	+ super.write(arg0, 0, arg0.length);
	51	+ try {
	52	+ sig.update(arg0);
	53	+ } catch (SignatureException e) {
	54	+ throw new RuntimeException(""+e);
	55	+ }
	56	+ }
	57	+
	58	+ /** @inheritDoc */
	59	+ public void write(int arg0) {
	60	+ super.write(arg0);
	61	+ try {
	62	+ sig.update((byte)arg0);
	63	+ } catch (SignatureException e) {
	64	+ throw new RuntimeException(""+e);
	65	+ }
	66	+ }
	67	+
	68	+ /** @inheritDoc */
	69	+ public void write(byte[] arg0, int arg1, int arg2) {
	70	+ super.write(arg0, arg1, arg2);
	71	+ try {
	72	+ sig.update(arg0,arg1,arg2);
	73	+ } catch (SignatureException e) {
	74	+ throw new RuntimeException(""+e);
	75	+ }
	76	+ }
	77	+}

java/pkg/org/jcp/xml/dsig/internal/dom/ApacheCanonicalizer.class+0−0

Binary file not shown.

java/pkg/org/jcp/xml/dsig/internal/dom/ApacheCanonicalizer.java+262−0

@@ -0,0 +1,262 @@
	1	+/*
	2	+ * reserved comment block
	3	+ * DO NOT REMOVE OR ALTER!
	4	+ */
	5	+/*
	6	+ * Copyright 2005 The Apache Software Foundation.
	7	+ *
	8	+ * Licensed under the Apache License, Version 2.0 (the "License");
	9	+ * you may not use this file except in compliance with the License.
	10	+ * You may obtain a copy of the License at
	11	+ *
	12	+ * http://www.apache.org/licenses/LICENSE-2.0
	13	+ *
	14	+ * Unless required by applicable law or agreed to in writing, software
	15	+ * distributed under the License is distributed on an "AS IS" BASIS,
	16	+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
	17	+ * See the License for the specific language governing permissions and
	18	+ * limitations under the License.
	19	+ *
	20	+ */
	21	+/*
	22	+ * Copyright (c) 2005, 2008, Oracle and/or its affiliates. All rights reserved.
	23	+ */
	24	+/*
	25	+ * $Id: ApacheCanonicalizer.java,v 1.2 2008/07/24 15:20:32 mullan Exp $
	26	+ */
	27	+package org.jcp.xml.dsig.internal.dom;
	28	+
	29	+import java.io.ByteArrayInputStream;
	30	+import java.io.ByteArrayOutputStream;
	31	+import java.io.IOException;
	32	+import java.io.OutputStream;
	33	+import java.security.spec.AlgorithmParameterSpec;
	34	+import java.security.InvalidAlgorithmParameterException;
	35	+import java.util.Set;
	36	+import java.util.logging.Logger;
	37	+import java.util.logging.Level;
	38	+import javax.xml.crypto.*;
	39	+import javax.xml.crypto.dom.DOMCryptoContext;
	40	+import javax.xml.crypto.dsig.TransformException;
	41	+import javax.xml.crypto.dsig.TransformService;
	42	+import javax.xml.crypto.dsig.XMLSignatureException;
	43	+import javax.xml.crypto.dsig.spec.C14NMethodParameterSpec;
	44	+
	45	+import com.sun.org.apache.xml.internal.security.c14n.Canonicalizer;
	46	+import com.sun.org.apache.xml.internal.security.c14n.InvalidCanonicalizerException;
	47	+import com.sun.org.apache.xml.internal.security.signature.XMLSignatureInput;
	48	+import com.sun.org.apache.xml.internal.security.transforms.Transform;
	49	+import org.w3c.dom.Document;
	50	+import org.w3c.dom.Element;
	51	+import org.w3c.dom.NodeList;
	52	+
	53	+public abstract class ApacheCanonicalizer extends TransformService {
	54	+
	55	+ static {
	56	+ com.sun.org.apache.xml.internal.security.Init.init();
	57	+ }
	58	+
	59	+ private static Logger log = Logger.getLogger("org.jcp.xml.dsig.internal.dom");
	60	+ protected Canonicalizer apacheCanonicalizer;
	61	+ private Transform apacheTransform;
	62	+ protected String inclusiveNamespaces;
	63	+ protected C14NMethodParameterSpec params;
	64	+ protected Document ownerDoc;
	65	+ protected Element transformElem;
	66	+
	67	+ public final AlgorithmParameterSpec getParameterSpec() {
	68	+ return params;
	69	+ }
	70	+
	71	+ public void init(XMLStructure parent, XMLCryptoContext context)
	72	+ throws InvalidAlgorithmParameterException {
	73	+ if (context != null && !(context instanceof DOMCryptoContext)) {
	74	+ throw new ClassCastException
	75	+ ("context must be of type DOMCryptoContext");
	76	+ }
	77	+ transformElem = (Element)
	78	+ ((javax.xml.crypto.dom.DOMStructure) parent).getNode();
	79	+ ownerDoc = DOMUtils.getOwnerDocument(transformElem);
	80	+ }
	81	+
	82	+ public void marshalParams(XMLStructure parent, XMLCryptoContext context)
	83	+ throws MarshalException {
	84	+ if (context != null && !(context instanceof DOMCryptoContext)) {
	85	+ throw new ClassCastException
	86	+ ("context must be of type DOMCryptoContext");
	87	+ }
	88	+ transformElem = (Element)
	89	+ ((javax.xml.crypto.dom.DOMStructure) parent).getNode();
	90	+ ownerDoc = DOMUtils.getOwnerDocument(transformElem);
	91	+ }
	92	+
	93	+ public Data canonicalize(Data data, XMLCryptoContext xc)
	94	+ throws TransformException {
	95	+ return canonicalize(data, xc, null);
	96	+ }
	97	+
	98	+ public Data canonicalize(Data data, XMLCryptoContext xc, OutputStream os)
	99	+ throws TransformException {
	100	+
	101	+ if (apacheCanonicalizer == null) {
	102	+ try {
	103	+ apacheCanonicalizer = Canonicalizer.getInstance(getAlgorithm());
	104	+ if (log.isLoggable(Level.FINE)) {
	105	+ log.log(Level.FINE, "Created canonicalizer for algorithm: "
	106	+ + getAlgorithm());
	107	+ }
	108	+ } catch (InvalidCanonicalizerException ice) {
	109	+ throw new TransformException
	110	+ ("Couldn't find Canonicalizer for: " + getAlgorithm() +
	111	+ ": " + ice.getMessage(), ice);
	112	+ }
	113	+ }
	114	+
	115	+ if (os != null) {
	116	+ apacheCanonicalizer.setWriter(os);
	117	+ } else {
	118	+ apacheCanonicalizer.setWriter(new ByteArrayOutputStream());
	119	+ }
	120	+
	121	+ try {
	122	+ Set nodeSet = null;
	123	+ if (data instanceof ApacheData) {
	124	+ XMLSignatureInput in =
	125	+ ((ApacheData) data).getXMLSignatureInput();
	126	+ if (in.isElement()) {
	127	+ if (inclusiveNamespaces != null) {
	128	+ return new OctetStreamData(new ByteArrayInputStream
	129	+ (apacheCanonicalizer.canonicalizeSubtree
	130	+ (in.getSubNode(), inclusiveNamespaces)));
	131	+ } else {
	132	+ return new OctetStreamData(new ByteArrayInputStream
	133	+ (apacheCanonicalizer.canonicalizeSubtree
	134	+ (in.getSubNode())));
	135	+ }
	136	+ } else if (in.isNodeSet()) {
	137	+ nodeSet = in.getNodeSet();
	138	+ } else {
	139	+ return new OctetStreamData(new ByteArrayInputStream(
	140	+ apacheCanonicalizer.canonicalize(
	141	+ Utils.readBytesFromStream(in.getOctetStream()))));
	142	+ }
	143	+ } else if (data instanceof DOMSubTreeData) {
	144	+ DOMSubTreeData subTree = (DOMSubTreeData) data;
	145	+ if (inclusiveNamespaces != null) {
	146	+ return new OctetStreamData(new ByteArrayInputStream
	147	+ (apacheCanonicalizer.canonicalizeSubtree
	148	+ (subTree.getRoot(), inclusiveNamespaces)));
	149	+ } else {
	150	+ return new OctetStreamData(new ByteArrayInputStream
	151	+ (apacheCanonicalizer.canonicalizeSubtree
	152	+ (subTree.getRoot())));
	153	+ }
	154	+ } else if (data instanceof NodeSetData) {
	155	+ NodeSetData nsd = (NodeSetData) data;
	156	+ // convert Iterator to Set
	157	+ nodeSet = Utils.toNodeSet(nsd.iterator());
	158	+ if (log.isLoggable(Level.FINE)) {
	159	+ log.log(Level.FINE, "Canonicalizing " + nodeSet.size()
	160	+ + " nodes");
	161	+ }
	162	+ } else {
	163	+ return new OctetStreamData(new ByteArrayInputStream(
	164	+ apacheCanonicalizer.canonicalize(
	165	+ Utils.readBytesFromStream(
	166	+ ((OctetStreamData)data).getOctetStream()))));
	167	+ }
	168	+ if (inclusiveNamespaces != null) {
	169	+ return new OctetStreamData(new ByteArrayInputStream(
	170	+ apacheCanonicalizer.canonicalizeXPathNodeSet
	171	+ (nodeSet, inclusiveNamespaces)));
	172	+ } else {
	173	+ return new OctetStreamData(new ByteArrayInputStream(
	174	+ apacheCanonicalizer.canonicalizeXPathNodeSet(nodeSet)));
	175	+ }
	176	+ } catch (Exception e) {
	177	+ throw new TransformException(e);
	178	+ }
	179	+ }
	180	+
	181	+ public Data transform(Data data, XMLCryptoContext xc, OutputStream os)
	182	+ throws TransformException {
	183	+ if (data == null) {
	184	+ throw new NullPointerException("data must not be null");
	185	+ }
	186	+ if (os == null) {
	187	+ throw new NullPointerException("output stream must not be null");
	188	+ }
	189	+
	190	+ if (ownerDoc == null) {
	191	+ throw new TransformException("transform must be marshalled");
	192	+ }
	193	+
	194	+ if (apacheTransform == null) {
	195	+ try {
	196	+ apacheTransform = Transform.getInstance
	197	+ (ownerDoc, getAlgorithm(), transformElem.getChildNodes());
	198	+ apacheTransform.setElement(transformElem, xc.getBaseURI());
	199	+ if (log.isLoggable(Level.FINE)) {
	200	+ log.log(Level.FINE, "Created transform for algorithm: "
	201	+ + getAlgorithm());
	202	+ }
	203	+ } catch (Exception ex) {
	204	+ throw new TransformException
	205	+ ("Couldn't find Transform for: " + getAlgorithm(), ex);
	206	+ }
	207	+ }
	208	+
	209	+ XMLSignatureInput in;
	210	+ if (data instanceof ApacheData) {
	211	+ if (log.isLoggable(Level.FINE)) {
	212	+ log.log(Level.FINE, "ApacheData = true");
	213	+ }
	214	+ in = ((ApacheData) data).getXMLSignatureInput();
	215	+ } else if (data instanceof NodeSetData) {
	216	+ if (log.isLoggable(Level.FINE)) {
	217	+ log.log(Level.FINE, "isNodeSet() = true");
	218	+ }
	219	+ if (data instanceof DOMSubTreeData) {
	220	+ DOMSubTreeData subTree = (DOMSubTreeData) data;
	221	+ in = new XMLSignatureInput(subTree.getRoot());
	222	+ in.setExcludeComments(subTree.excludeComments());
	223	+ } else {
	224	+ Set nodeSet =
	225	+ Utils.toNodeSet(((NodeSetData) data).iterator());
	226	+ in = new XMLSignatureInput(nodeSet);
	227	+ }
	228	+ } else {
	229	+ if (log.isLoggable(Level.FINE)) {
	230	+ log.log(Level.FINE, "isNodeSet() = false");
	231	+ }
	232	+ try {
	233	+ in = new XMLSignatureInput
	234	+ (((OctetStreamData)data).getOctetStream());
	235	+ } catch (Exception ex) {
	236	+ throw new TransformException(ex);
	237	+ }
	238	+ }
	239	+
	240	+ try {
	241	+ in = apacheTransform.performTransform(in, os);
	242	+ if (!in.isNodeSet() && !in.isElement()) {
	243	+ return null;
	244	+ }
	245	+ if (in.isOctetStream()) {
	246	+ return new ApacheOctetStreamData(in);
	247	+ } else {
	248	+ return new ApacheNodeSetData(in);
	249	+ }
	250	+ } catch (Exception ex) {
	251	+ throw new TransformException(ex);
	252	+ }
	253	+ }
	254	+
	255	+ public final boolean isFeatureSupported(String feature) {
	256	+ if (feature == null) {
	257	+ throw new NullPointerException();
	258	+ } else {
	259	+ return false;
	260	+ }
	261	+ }
	262	+}

java/pkg/org/jcp/xml/dsig/internal/dom/ApacheData.class+0−0

Binary file not shown.

java/pkg/org/jcp/xml/dsig/internal/dom/ApacheData.java+43−0

@@ -0,0 +1,43 @@
	1	+/*
	2	+ * reserved comment block
	3	+ * DO NOT REMOVE OR ALTER!
	4	+ */
	5	+/*
	6	+ * Copyright 2005 The Apache Software Foundation.
	7	+ *
	8	+ * Licensed under the Apache License, Version 2.0 (the "License");
	9	+ * you may not use this file except in compliance with the License.
	10	+ * You may obtain a copy of the License at
	11	+ *
	12	+ * http://www.apache.org/licenses/LICENSE-2.0
	13	+ *
	14	+ * Unless required by applicable law or agreed to in writing, software
	15	+ * distributed under the License is distributed on an "AS IS" BASIS,
	16	+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
	17	+ * See the License for the specific language governing permissions and
	18	+ * limitations under the License.
	19	+ *
	20	+ */
	21	+/*
	22	+ * Copyright (c) 2005, 2008, Oracle and/or its affiliates. All rights reserved.
	23	+ */
	24	+/*
	25	+ * $Id: ApacheData.java,v 1.2 2008/07/24 15:20:32 mullan Exp $
	26	+ */
	27	+package org.jcp.xml.dsig.internal.dom;
	28	+
	29	+import javax.xml.crypto.Data;
	30	+import com.sun.org.apache.xml.internal.security.signature.XMLSignatureInput;
	31	+
	32	+/**
	33	+ * XMLSignatureInput Data wrapper.
	34	+ *
	35	+ * @author Sean Mullan
	36	+ */
	37	+public interface ApacheData extends Data {
	38	+
	39	+ /**
	40	+ * Returns the XMLSignatureInput.
	41	+ */
	42	+ public XMLSignatureInput getXMLSignatureInput();
	43	+}

java/pkg/org/jcp/xml/dsig/internal/dom/ApacheNodeSetData.class+0−0

Binary file not shown.

java/pkg/org/jcp/xml/dsig/internal/dom/ApacheNodeSetData.java+95−0

@@ -0,0 +1,95 @@
	1	+/*
	2	+ * reserved comment block
	3	+ * DO NOT REMOVE OR ALTER!
	4	+ */
	5	+/*
	6	+ * Copyright 2005 The Apache Software Foundation.
	7	+ *
	8	+ * Licensed under the Apache License, Version 2.0 (the "License");
	9	+ * you may not use this file except in compliance with the License.
	10	+ * You may obtain a copy of the License at
	11	+ *
	12	+ * http://www.apache.org/licenses/LICENSE-2.0
	13	+ *
	14	+ * Unless required by applicable law or agreed to in writing, software
	15	+ * distributed under the License is distributed on an "AS IS" BASIS,
	16	+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
	17	+ * See the License for the specific language governing permissions and
	18	+ * limitations under the License.
	19	+ *
	20	+ */
	21	+/*
	22	+ * Copyright (c) 2005, 2008, Oracle and/or its affiliates. All rights reserved.
	23	+ */
	24	+/*
	25	+ * $Id: ApacheNodeSetData.java,v 1.2 2008/07/24 15:20:32 mullan Exp $
	26	+ */
	27	+package org.jcp.xml.dsig.internal.dom;
	28	+
	29	+import java.util.Collections;
	30	+import java.util.HashSet;
	31	+import java.util.Iterator;
	32	+import java.util.LinkedHashSet;
	33	+import java.util.List;
	34	+import java.util.Set;
	35	+import javax.xml.crypto.NodeSetData;
	36	+import org.w3c.dom.Node;
	37	+import com.sun.org.apache.xml.internal.security.signature.NodeFilter;
	38	+import com.sun.org.apache.xml.internal.security.signature.XMLSignatureInput;
	39	+import com.sun.org.apache.xml.internal.security.utils.XMLUtils;
	40	+
	41	+public class ApacheNodeSetData implements ApacheData, NodeSetData {
	42	+
	43	+ private XMLSignatureInput xi;
	44	+
	45	+ public ApacheNodeSetData(XMLSignatureInput xi) {
	46	+ this.xi = xi;
	47	+ }
	48	+
	49	+ public Iterator iterator() {
	50	+ // If nodefilters are set, must execute them first to create node-set
	51	+ if (xi.getNodeFilters() != null) {
	52	+ return Collections.unmodifiableSet
	53	+ (getNodeSet(xi.getNodeFilters())).iterator();
	54	+ }
	55	+ try {
	56	+ return Collections.unmodifiableSet(xi.getNodeSet()).iterator();
	57	+ } catch (Exception e) {
	58	+ // should not occur
	59	+ throw new RuntimeException
	60	+ ("unrecoverable error retrieving nodeset", e);
	61	+ }
	62	+ }
	63	+
	64	+ public XMLSignatureInput getXMLSignatureInput() {
	65	+ return xi;
	66	+ }
	67	+
	68	+ private Set getNodeSet(List nodeFilters) {
	69	+ if (xi.isNeedsToBeExpanded()) {
	70	+ XMLUtils.circumventBug2650
	71	+ (XMLUtils.getOwnerDocument(xi.getSubNode()));
	72	+ }
	73	+
	74	+ Set inputSet = new LinkedHashSet();
	75	+ XMLUtils.getSet
	76	+ (xi.getSubNode(), inputSet, null, !xi.isExcludeComments());
	77	+ Set nodeSet = new LinkedHashSet();
	78	+ Iterator i = inputSet.iterator();
	79	+ while (i.hasNext()) {
	80	+ Node currentNode = (Node) i.next();
	81	+ Iterator it = nodeFilters.iterator();
	82	+ boolean skipNode = false;
	83	+ while (it.hasNext() && !skipNode) {
	84	+ NodeFilter nf = (NodeFilter) it.next();
	85	+ if (nf.isNodeInclude(currentNode)!=1) {
	86	+ skipNode = true;
	87	+ }
	88	+ }
	89	+ if (!skipNode) {
	90	+ nodeSet.add(currentNode);
	91	+ }
	92	+ }
	93	+ return nodeSet;
	94	+ }
	95	+}

java/pkg/org/jcp/xml/dsig/internal/dom/ApacheOctetStreamData.class+0−0

Binary file not shown.

java/pkg/org/jcp/xml/dsig/internal/dom/ApacheOctetStreamData.java+48−0

@@ -0,0 +1,48 @@
	1	+/*
	2	+ * reserved comment block
	3	+ * DO NOT REMOVE OR ALTER!
	4	+ */
	5	+/*
	6	+ * Copyright 2005 The Apache Software Foundation.
	7	+ *
	8	+ * Licensed under the Apache License, Version 2.0 (the "License");
	9	+ * you may not use this file except in compliance with the License.
	10	+ * You may obtain a copy of the License at
	11	+ *
	12	+ * http://www.apache.org/licenses/LICENSE-2.0
	13	+ *
	14	+ * Unless required by applicable law or agreed to in writing, software
	15	+ * distributed under the License is distributed on an "AS IS" BASIS,
	16	+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
	17	+ * See the License for the specific language governing permissions and
	18	+ * limitations under the License.
	19	+ *
	20	+ */
	21	+/*
	22	+ * Copyright (c) 2005, 2008, Oracle and/or its affiliates. All rights reserved.
	23	+ */
	24	+/*
	25	+ * $Id: ApacheOctetStreamData.java,v 1.2 2008/07/24 15:20:32 mullan Exp $
	26	+ */
	27	+package org.jcp.xml.dsig.internal.dom;
	28	+
	29	+import java.io.IOException;
	30	+import javax.xml.crypto.OctetStreamData;
	31	+import com.sun.org.apache.xml.internal.security.c14n.CanonicalizationException;
	32	+import com.sun.org.apache.xml.internal.security.signature.XMLSignatureInput;
	33	+
	34	+public class ApacheOctetStreamData extends OctetStreamData
	35	+ implements ApacheData {
	36	+
	37	+ private XMLSignatureInput xi;
	38	+
	39	+ public ApacheOctetStreamData(XMLSignatureInput xi)
	40	+ throws CanonicalizationException, IOException {
	41	+ super(xi.getOctetStream(), xi.getSourceURI(), xi.getMIMEType());
	42	+ this.xi = xi;
	43	+ }
	44	+
	45	+ public XMLSignatureInput getXMLSignatureInput() {
	46	+ return xi;
	47	+ }
	48	+}

java/pkg/org/jcp/xml/dsig/internal/dom/ApacheTransform.class+0−0

Binary file not shown.

java/pkg/org/jcp/xml/dsig/internal/dom/ApacheTransform.java+193−0

@@ -0,0 +1,193 @@
	1	+/*
	2	+ * reserved comment block
	3	+ * DO NOT REMOVE OR ALTER!
	4	+ */
	5	+/*
	6	+ * Copyright 2005 The Apache Software Foundation.
	7	+ *
	8	+ * Licensed under the Apache License, Version 2.0 (the "License");
	9	+ * you may not use this file except in compliance with the License.
	10	+ * You may obtain a copy of the License at
	11	+ *
	12	+ * http://www.apache.org/licenses/LICENSE-2.0
	13	+ *
	14	+ * Unless required by applicable law or agreed to in writing, software
	15	+ * distributed under the License is distributed on an "AS IS" BASIS,
	16	+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
	17	+ * See the License for the specific language governing permissions and
	18	+ * limitations under the License.
	19	+ *
	20	+ */
	21	+/*
	22	+ * Copyright (c) 2005, 2008, Oracle and/or its affiliates. All rights reserved.
	23	+ */
	24	+/*
	25	+ * $Id: ApacheTransform.java,v 1.2 2008/07/24 15:20:32 mullan Exp $
	26	+ */
	27	+package org.jcp.xml.dsig.internal.dom;
	28	+
	29	+import java.io.OutputStream;
	30	+import java.security.InvalidAlgorithmParameterException;
	31	+import java.security.spec.AlgorithmParameterSpec;
	32	+import java.util.Set;
	33	+import java.util.logging.Level;
	34	+import java.util.logging.Logger;
	35	+import org.w3c.dom.Document;
	36	+import org.w3c.dom.Element;
	37	+import org.w3c.dom.NodeList;
	38	+
	39	+import com.sun.org.apache.xml.internal.security.signature.XMLSignatureInput;
	40	+import com.sun.org.apache.xml.internal.security.transforms.Transform;
	41	+
	42	+import javax.xml.crypto.*;
	43	+import javax.xml.crypto.dom.DOMCryptoContext;
	44	+import javax.xml.crypto.dsig.*;
	45	+import javax.xml.crypto.dsig.spec.TransformParameterSpec;
	46	+
	47	+/**
	48	+ * This is a wrapper/glue class which invokes the Apache XML-Security
	49	+ * Transform.
	50	+ *
	51	+ * @author Sean Mullan
	52	+ * @author Erwin van der Koogh
	53	+ */
	54	+public abstract class ApacheTransform extends TransformService {
	55	+
	56	+ static {
	57	+ com.sun.org.apache.xml.internal.security.Init.init();
	58	+ }
	59	+
	60	+ private static Logger log = Logger.getLogger("org.jcp.xml.dsig.internal.dom");
	61	+ private Transform apacheTransform;
	62	+ protected Document ownerDoc;
	63	+ protected Element transformElem;
	64	+ protected TransformParameterSpec params;
	65	+
	66	+ public final AlgorithmParameterSpec getParameterSpec() {
	67	+ return params;
	68	+ }
	69	+
	70	+ public void init(XMLStructure parent, XMLCryptoContext context)
	71	+ throws InvalidAlgorithmParameterException {
	72	+ if (context != null && !(context instanceof DOMCryptoContext)) {
	73	+ throw new ClassCastException
	74	+ ("context must be of type DOMCryptoContext");
	75	+ }
	76	+ transformElem = (Element)
	77	+ ((javax.xml.crypto.dom.DOMStructure) parent).getNode();
	78	+ ownerDoc = DOMUtils.getOwnerDocument(transformElem);
	79	+ }
	80	+
	81	+ public void marshalParams(XMLStructure parent, XMLCryptoContext context)
	82	+ throws MarshalException {
	83	+ if (context != null && !(context instanceof DOMCryptoContext)) {
	84	+ throw new ClassCastException
	85	+ ("context must be of type DOMCryptoContext");
	86	+ }
	87	+ transformElem = (Element)
	88	+ ((javax.xml.crypto.dom.DOMStructure) parent).getNode();
	89	+ ownerDoc = DOMUtils.getOwnerDocument(transformElem);
	90	+ }
	91	+
	92	+ public Data transform(Data data, XMLCryptoContext xc)
	93	+ throws TransformException {
	94	+ if (data == null) {
	95	+ throw new NullPointerException("data must not be null");
	96	+ }
	97	+ return transformIt(data, xc, (OutputStream) null);
	98	+ }
	99	+
	100	+ public Data transform(Data data, XMLCryptoContext xc, OutputStream os)
	101	+ throws TransformException {
	102	+ if (data == null) {
	103	+ throw new NullPointerException("data must not be null");
	104	+ }
	105	+ if (os == null) {
	106	+ throw new NullPointerException("output stream must not be null");
	107	+ }
	108	+ return transformIt(data, xc, os);
	109	+ }
	110	+
	111	+ private Data transformIt(Data data, XMLCryptoContext xc, OutputStream os)
	112	+ throws TransformException {
	113	+
	114	+ if (ownerDoc == null) {
	115	+ throw new TransformException("transform must be marshalled");
	116	+ }
	117	+
	118	+ if (apacheTransform == null) {
	119	+ try {
	120	+ apacheTransform = Transform.getInstance
	121	+ (ownerDoc, getAlgorithm(), transformElem.getChildNodes());
	122	+ apacheTransform.setElement(transformElem, xc.getBaseURI());
	123	+ if (log.isLoggable(Level.FINE)) {
	124	+ log.log(Level.FINE, "Created transform for algorithm: "
	125	+ + getAlgorithm());
	126	+ }
	127	+ } catch (Exception ex) {
	128	+ throw new TransformException
	129	+ ("Couldn't find Transform for: " + getAlgorithm(), ex);
	130	+ }
	131	+ }
	132	+
	133	+ XMLSignatureInput in;
	134	+ if (data instanceof ApacheData) {
	135	+ if (log.isLoggable(Level.FINE)) {
	136	+ log.log(Level.FINE, "ApacheData = true");
	137	+ }
	138	+ in = ((ApacheData) data).getXMLSignatureInput();
	139	+ } else if (data instanceof NodeSetData) {
	140	+ if (log.isLoggable(Level.FINE)) {
	141	+ log.log(Level.FINE, "isNodeSet() = true");
	142	+ }
	143	+ if (data instanceof DOMSubTreeData) {
	144	+ if (log.isLoggable(Level.FINE)) {
	145	+ log.log(Level.FINE, "DOMSubTreeData = true");
	146	+ }
	147	+ DOMSubTreeData subTree = (DOMSubTreeData) data;
	148	+ in = new XMLSignatureInput(subTree.getRoot());
	149	+ in.setExcludeComments(subTree.excludeComments());
	150	+ } else {
	151	+ Set nodeSet =
	152	+ Utils.toNodeSet(((NodeSetData) data).iterator());
	153	+ in = new XMLSignatureInput(nodeSet);
	154	+ }
	155	+ } else {
	156	+ if (log.isLoggable(Level.FINE)) {
	157	+ log.log(Level.FINE, "isNodeSet() = false");
	158	+ }
	159	+ try {
	160	+ in = new XMLSignatureInput
	161	+ (((OctetStreamData)data).getOctetStream());
	162	+ } catch (Exception ex) {
	163	+ throw new TransformException(ex);
	164	+ }
	165	+ }
	166	+
	167	+ try {
	168	+ if (os != null) {
	169	+ in = apacheTransform.performTransform(in, os);
	170	+ if (!in.isNodeSet() && !in.isElement()) {
	171	+ return null;
	172	+ }
	173	+ } else {
	174	+ in = apacheTransform.performTransform(in);
	175	+ }
	176	+ if (in.isOctetStream()) {
	177	+ return new ApacheOctetStreamData(in);
	178	+ } else {
	179	+ return new ApacheNodeSetData(in);
	180	+ }
	181	+ } catch (Exception ex) {
	182	+ throw new TransformException(ex);
	183	+ }
	184	+ }
	185	+
	186	+ public final boolean isFeatureSupported(String feature) {
	187	+ if (feature == null) {
	188	+ throw new NullPointerException();
	189	+ } else {
	190	+ return false;
	191	+ }
	192	+ }
	193	+}

java/pkg/org/jcp/xml/dsig/internal/dom/DOMBase64Transform.class+0−0

Binary file not shown.

java/pkg/org/jcp/xml/dsig/internal/dom/DOMBase64Transform.java+48−0

@@ -0,0 +1,48 @@
	1	+/*
	2	+ * reserved comment block
	3	+ * DO NOT REMOVE OR ALTER!
	4	+ */
	5	+/*
	6	+ * Copyright 2005 The Apache Software Foundation.
	7	+ *
	8	+ * Licensed under the Apache License, Version 2.0 (the "License");
	9	+ * you may not use this file except in compliance with the License.
	10	+ * You may obtain a copy of the License at
	11	+ *
	12	+ * http://www.apache.org/licenses/LICENSE-2.0
	13	+ *
	14	+ * Unless required by applicable law or agreed to in writing, software
	15	+ * distributed under the License is distributed on an "AS IS" BASIS,
	16	+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
	17	+ * See the License for the specific language governing permissions and
	18	+ * limitations under the License.
	19	+ *
	20	+ */
	21	+/*
	22	+ * Copyright (c) 2005, 2008, Oracle and/or its affiliates. All rights reserved.
	23	+ */
	24	+/*
	25	+ * $Id: DOMBase64Transform.java,v 1.2 2008/07/24 15:20:32 mullan Exp $
	26	+ */
	27	+package org.jcp.xml.dsig.internal.dom;
	28	+
	29	+import java.security.InvalidAlgorithmParameterException;
	30	+
	31	+import javax.xml.crypto.XMLStructure;
	32	+import javax.xml.crypto.dsig.spec.TransformParameterSpec;
	33	+
	34	+/**
	35	+ * DOM-based implementation of Base64 Encoding Transform.
	36	+ * (Uses Apache XML-Sec Transform implementation)
	37	+ *
	38	+ * @author Sean Mullan
	39	+ */
	40	+public final class DOMBase64Transform extends ApacheTransform {
	41	+
	42	+ public void init(TransformParameterSpec params)
	43	+ throws InvalidAlgorithmParameterException {
	44	+ if (params != null) {
	45	+ throw new InvalidAlgorithmParameterException("params must be null");
	46	+ }
	47	+ }
	48	+}

java/pkg/org/jcp/xml/dsig/internal/dom/DOMCanonicalXMLC14N11Method.class+0−0

Binary file not shown.

java/pkg/org/jcp/xml/dsig/internal/dom/DOMCanonicalXMLC14N11Method.java+79−0

@@ -0,0 +1,79 @@
	1	+/*
	2	+ * reserved comment block
	3	+ * DO NOT REMOVE OR ALTER!
	4	+ */
	5	+/*
	6	+ * Copyright 2008 The Apache Software Foundation.
	7	+ *
	8	+ * Licensed under the Apache License, Version 2.0 (the "License");
	9	+ * you may not use this file except in compliance with the License.
	10	+ * You may obtain a copy of the License at
	11	+ *
	12	+ * http://www.apache.org/licenses/LICENSE-2.0
	13	+ *
	14	+ * Unless required by applicable law or agreed to in writing, software
	15	+ * distributed under the License is distributed on an "AS IS" BASIS,
	16	+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
	17	+ * See the License for the specific language governing permissions and
	18	+ * limitations under the License.
	19	+ *
	20	+ */
	21	+/*
	22	+ * Copyright (c) 2008, Oracle and/or its affiliates. All rights reserved.
	23	+ */
	24	+/*
	25	+ * $Id: DOMCanonicalXMLC14N11Method.java,v 1.2 2008/07/24 15:20:32 mullan Exp $
	26	+ */
	27	+package org.jcp.xml.dsig.internal.dom;
	28	+
	29	+import javax.xml.crypto.*;
	30	+import javax.xml.crypto.dsig.*;
	31	+import javax.xml.crypto.dsig.spec.TransformParameterSpec;
	32	+
	33	+import java.security.InvalidAlgorithmParameterException;
	34	+
	35	+import com.sun.org.apache.xml.internal.security.c14n.Canonicalizer;
	36	+import com.sun.org.apache.xml.internal.security.c14n.InvalidCanonicalizerException;
	37	+
	38	+/**
	39	+ * DOM-based implementation of CanonicalizationMethod for Canonical XML 1.1
	40	+ * (with or without comments). Uses Apache XML-Sec Canonicalizer.
	41	+ *
	42	+ * @author Sean Mullan
	43	+ */
	44	+public final class DOMCanonicalXMLC14N11Method extends ApacheCanonicalizer {
	45	+
	46	+ public static final String C14N_11 = "http://www.w3.org/2006/12/xml-c14n11";
	47	+ public static final String C14N_11_WITH_COMMENTS
	48	+ = "http://www.w3.org/2006/12/xml-c14n11#WithComments";
	49	+
	50	+ public void init(TransformParameterSpec params)
	51	+ throws InvalidAlgorithmParameterException {
	52	+ if (params != null) {
	53	+ throw new InvalidAlgorithmParameterException("no parameters " +
	54	+ "should be specified for Canonical XML 1.1 algorithm");
	55	+ }
	56	+ }
	57	+
	58	+ public Data transform(Data data, XMLCryptoContext xc)
	59	+ throws TransformException {
	60	+
	61	+ // ignore comments if dereferencing same-document URI that requires
	62	+ // you to omit comments, even if the Transform says otherwise -
	63	+ // this is to be compliant with section 4.3.3.3 of W3C Rec.
	64	+ if (data instanceof DOMSubTreeData) {
	65	+ DOMSubTreeData subTree = (DOMSubTreeData) data;
	66	+ if (subTree.excludeComments()) {
	67	+ try {
	68	+ apacheCanonicalizer = Canonicalizer.getInstance(C14N_11);
	69	+ } catch (InvalidCanonicalizerException ice) {
	70	+ throw new TransformException
	71	+ ("Couldn't find Canonicalizer for: " +
	72	+ C14N_11 + ": " + ice.getMessage(), ice);
	73	+ }
	74	+ }
	75	+ }
	76	+
	77	+ return canonicalize(data, xc);
	78	+ }
	79	+}

java/pkg/org/jcp/xml/dsig/internal/dom/DOMCanonicalXMLC14NMethod.class+0−0

Binary file not shown.

java/pkg/org/jcp/xml/dsig/internal/dom/DOMCanonicalXMLC14NMethod.java+77−0

@@ -0,0 +1,77 @@
	1	+/*
	2	+ * reserved comment block
	3	+ * DO NOT REMOVE OR ALTER!
	4	+ */
	5	+/*
	6	+ * Copyright 2005 The Apache Software Foundation.
	7	+ *
	8	+ * Licensed under the Apache License, Version 2.0 (the "License");
	9	+ * you may not use this file except in compliance with the License.
	10	+ * You may obtain a copy of the License at
	11	+ *
	12	+ * http://www.apache.org/licenses/LICENSE-2.0
	13	+ *
	14	+ * Unless required by applicable law or agreed to in writing, software
	15	+ * distributed under the License is distributed on an "AS IS" BASIS,
	16	+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
	17	+ * See the License for the specific language governing permissions and
	18	+ * limitations under the License.
	19	+ *
	20	+ */
	21	+/*
	22	+ * Copyright (c) 2005, 2008, Oracle and/or its affiliates. All rights reserved.
	23	+ */
	24	+/*
	25	+ * $Id: DOMCanonicalXMLC14NMethod.java,v 1.2 2008/07/24 15:20:32 mullan Exp $
	26	+ */
	27	+package org.jcp.xml.dsig.internal.dom;
	28	+
	29	+import javax.xml.crypto.*;
	30	+import javax.xml.crypto.dsig.*;
	31	+import javax.xml.crypto.dsig.spec.TransformParameterSpec;
	32	+
	33	+import java.security.InvalidAlgorithmParameterException;
	34	+
	35	+import com.sun.org.apache.xml.internal.security.c14n.Canonicalizer;
	36	+import com.sun.org.apache.xml.internal.security.c14n.InvalidCanonicalizerException;
	37	+
	38	+/**
	39	+ * DOM-based implementation of CanonicalizationMethod for Canonical XML
	40	+ * (with or without comments). Uses Apache XML-Sec Canonicalizer.
	41	+ *
	42	+ * @author Sean Mullan
	43	+ */
	44	+public final class DOMCanonicalXMLC14NMethod extends ApacheCanonicalizer {
	45	+
	46	+ public void init(TransformParameterSpec params)
	47	+ throws InvalidAlgorithmParameterException {
	48	+ if (params != null) {
	49	+ throw new InvalidAlgorithmParameterException("no parameters " +
	50	+ "should be specified for Canonical XML C14N algorithm");
	51	+ }
	52	+ }
	53	+
	54	+ public Data transform(Data data, XMLCryptoContext xc)
	55	+ throws TransformException {
	56	+
	57	+ // ignore comments if dereferencing same-document URI that requires
	58	+ // you to omit comments, even if the Transform says otherwise -
	59	+ // this is to be compliant with section 4.3.3.3 of W3C Rec.
	60	+ if (data instanceof DOMSubTreeData) {
	61	+ DOMSubTreeData subTree = (DOMSubTreeData) data;
	62	+ if (subTree.excludeComments()) {
	63	+ try {
	64	+ apacheCanonicalizer = Canonicalizer.getInstance
	65	+ (CanonicalizationMethod.INCLUSIVE);
	66	+ } catch (InvalidCanonicalizerException ice) {
	67	+ throw new TransformException
	68	+ ("Couldn't find Canonicalizer for: " +
	69	+ CanonicalizationMethod.INCLUSIVE + ": " +
	70	+ ice.getMessage(), ice);
	71	+ }
	72	+ }
	73	+ }
	74	+
	75	+ return canonicalize(data, xc);
	76	+ }
	77	+}

java/pkg/org/jcp/xml/dsig/internal/dom/DOMCanonicalizationMethod.class+0−0

Binary file not shown.

java/pkg/org/jcp/xml/dsig/internal/dom/DOMCanonicalizationMethod.java+104−0

@@ -0,0 +1,104 @@
	1	+/*
	2	+ * reserved comment block
	3	+ * DO NOT REMOVE OR ALTER!
	4	+ */
	5	+/*
	6	+ * Copyright 2005 The Apache Software Foundation.
	7	+ *
	8	+ * Licensed under the Apache License, Version 2.0 (the "License");
	9	+ * you may not use this file except in compliance with the License.
	10	+ * You may obtain a copy of the License at
	11	+ *
	12	+ * http://www.apache.org/licenses/LICENSE-2.0
	13	+ *
	14	+ * Unless required by applicable law or agreed to in writing, software
	15	+ * distributed under the License is distributed on an "AS IS" BASIS,
	16	+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
	17	+ * See the License for the specific language governing permissions and
	18	+ * limitations under the License.
	19	+ *
	20	+ */
	21	+/*
	22	+ * Copyright (c) 2005, 2008, Oracle and/or its affiliates. All rights reserved.
	23	+ */
	24	+/*
	25	+ * $Id: DOMCanonicalizationMethod.java,v 1.2 2008/07/24 15:20:32 mullan Exp $
	26	+ */
	27	+package org.jcp.xml.dsig.internal.dom;
	28	+
	29	+import java.io.OutputStream;
	30	+import java.security.InvalidAlgorithmParameterException;
	31	+import java.security.Provider;
	32	+
	33	+import org.w3c.dom.Element;
	34	+
	35	+import javax.xml.crypto.*;
	36	+import javax.xml.crypto.dsig.*;
	37	+
	38	+/**
	39	+ * DOM-based abstract implementation of CanonicalizationMethod.
	40	+ *
	41	+ * @author Sean Mullan
	42	+ */
	43	+public class DOMCanonicalizationMethod extends DOMTransform
	44	+ implements CanonicalizationMethod {
	45	+
	46	+ /**
	47	+ * Creates a <code>DOMCanonicalizationMethod</code>.
	48	+ *
	49	+ * @param spi TransformService
	50	+ */
	51	+ public DOMCanonicalizationMethod(TransformService spi)
	52	+ throws InvalidAlgorithmParameterException {
	53	+ super(spi);
	54	+ }
	55	+
	56	+ /**
	57	+ * Creates a <code>DOMCanonicalizationMethod</code> from an element. This
	58	+ * ctor invokes the abstract {@link #unmarshalParams unmarshalParams}
	59	+ * method to unmarshal any algorithm-specific input parameters.
	60	+ *
	61	+ * @param cmElem a CanonicalizationMethod element
	62	+ */
	63	+ public DOMCanonicalizationMethod(Element cmElem, XMLCryptoContext context,
	64	+ Provider provider) throws MarshalException {
	65	+ super(cmElem, context, provider);
	66	+ }
	67	+
	68	+ /**
	69	+ * Canonicalizes the specified data using the underlying canonicalization
	70	+ * algorithm. This is a convenience method that is equivalent to invoking
	71	+ * the {@link #transform transform} method.
	72	+ *
	73	+ * @param data the data to be canonicalized
	74	+ * @param xc the <code>XMLCryptoContext</code> containing
	75	+ * additional context (may be <code>null</code> if not applicable)
	76	+ * @return the canonicalized data
	77	+ * @throws NullPointerException if <code>data</code> is <code>null</code>
	78	+ * @throws TransformException if an unexpected error occurs while
	79	+ * canonicalizing the data
	80	+ */
	81	+ public Data canonicalize(Data data, XMLCryptoContext xc)
	82	+ throws TransformException {
	83	+ return transform(data, xc);
	84	+ }
	85	+
	86	+ public Data canonicalize(Data data, XMLCryptoContext xc, OutputStream os)
	87	+ throws TransformException {
	88	+ return transform(data, xc, os);
	89	+ }
	90	+
	91	+ public boolean equals(Object o) {
	92	+ if (this == o) {
	93	+ return true;
	94	+ }
	95	+
	96	+ if (!(o instanceof CanonicalizationMethod)) {
	97	+ return false;
	98	+ }
	99	+ CanonicalizationMethod ocm = (CanonicalizationMethod) o;
	100	+
	101	+ return (getAlgorithm().equals(ocm.getAlgorithm()) &&
	102	+ DOMUtils.paramsEqual(getParameterSpec(), ocm.getParameterSpec()));
	103	+ }
	104	+}

java/pkg/org/jcp/xml/dsig/internal/dom/DOMCryptoBinary.class+0−0

Binary file not shown.

java/pkg/org/jcp/xml/dsig/internal/dom/DOMCryptoBinary.java+102−0

@@ -0,0 +1,102 @@
	1	+/*
	2	+ * reserved comment block
	3	+ * DO NOT REMOVE OR ALTER!
	4	+ */
	5	+/*
	6	+ * Copyright 2005 The Apache Software Foundation.
	7	+ *
	8	+ * Licensed under the Apache License, Version 2.0 (the "License");
	9	+ * you may not use this file except in compliance with the License.
	10	+ * You may obtain a copy of the License at
	11	+ *
	12	+ * http://www.apache.org/licenses/LICENSE-2.0
	13	+ *
	14	+ * Unless required by applicable law or agreed to in writing, software
	15	+ * distributed under the License is distributed on an "AS IS" BASIS,
	16	+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
	17	+ * See the License for the specific language governing permissions and
	18	+ * limitations under the License.
	19	+ *
	20	+ */
	21	+/*
	22	+ * Copyright (c) 2005, 2008, Oracle and/or its affiliates. All rights reserved.
	23	+ */
	24	+/*
	25	+ * $Id: DOMCryptoBinary.java,v 1.2 2008/07/24 15:20:32 mullan Exp $
	26	+ */
	27	+package org.jcp.xml.dsig.internal.dom;
	28	+
	29	+import java.math.BigInteger;
	30	+import javax.xml.crypto.*;
	31	+import javax.xml.crypto.dom.DOMCryptoContext;
	32	+import javax.xml.crypto.dsig.*;
	33	+import org.w3c.dom.Node;
	34	+import org.w3c.dom.Text;
	35	+
	36	+import com.sun.org.apache.xml.internal.security.utils.Base64;
	37	+
	38	+/**
	39	+ * A DOM-based representation of the XML <code>CryptoBinary</code> simple type
	40	+ * as defined in the W3C specification for XML-Signature Syntax and Processing.
	41	+ * The XML Schema Definition is defined as:
	42	+ *
	43	+ * <xmp>
	44	+ * <simpleType name="CryptoBinary">
	45	+ * <restriction base = "base64Binary">
	46	+ * </restriction>
	47	+ * </simpleType>
	48	+ * </xmp>
	49	+ *
	50	+ * @author Sean Mullan
	51	+ */
	52	+public final class DOMCryptoBinary extends DOMStructure {
	53	+
	54	+ private final BigInteger bigNum;
	55	+ private final String value;
	56	+
	57	+ /**
	58	+ * Create a <code>DOMCryptoBinary</code> instance from the specified
	59	+ * <code>BigInteger</code>
	60	+ *
	61	+ * @param bigNum the arbitrary-length integer
	62	+ * @throws NullPointerException if <code>bigNum</code> is <code>null</code>
	63	+ */
	64	+ public DOMCryptoBinary(BigInteger bigNum) {
	65	+ if (bigNum == null) {
	66	+ throw new NullPointerException("bigNum is null");
	67	+ }
	68	+ this.bigNum = bigNum;
	69	+ // convert to bitstring
	70	+ value = Base64.encode(bigNum);
	71	+ }
	72	+
	73	+ /**
	74	+ * Creates a <code>DOMCryptoBinary</code> from a node.
	75	+ *
	76	+ * @param cbNode a CryptoBinary text node
	77	+ * @throws MarshalException if value cannot be decoded (invalid format)
	78	+ */
	79	+ public DOMCryptoBinary(Node cbNode) throws MarshalException {
	80	+ value = cbNode.getNodeValue();
	81	+ try {
	82	+ bigNum = Base64.decodeBigIntegerFromText((Text) cbNode);
	83	+ } catch (Exception ex) {
	84	+ throw new MarshalException(ex);
	85	+ }
	86	+ }
	87	+
	88	+ /**
	89	+ * Returns the <code>BigInteger</code> that this object contains.
	90	+ *
	91	+ * @return the <code>BigInteger</code> that this object contains
	92	+ */
	93	+ public BigInteger getBigNum() {
	94	+ return bigNum;
	95	+ }
	96	+
	97	+ public void marshal(Node parent, String prefix, DOMCryptoContext context)
	98	+ throws MarshalException {
	99	+ parent.appendChild
	100	+ (DOMUtils.getOwnerDocument(parent).createTextNode(value));
	101	+ }
	102	+}

java/pkg/org/jcp/xml/dsig/internal/dom/DOMDigestMethod$SHA1.class+0−0

Binary file not shown.

java/pkg/org/jcp/xml/dsig/internal/dom/DOMDigestMethod$SHA256.class+0−0

Binary file not shown.

java/pkg/org/jcp/xml/dsig/internal/dom/DOMDigestMethod$SHA384.class+0−0

Binary file not shown.

java/pkg/org/jcp/xml/dsig/internal/dom/DOMDigestMethod$SHA512.class+0−0

Binary file not shown.

java/pkg/org/jcp/xml/dsig/internal/dom/DOMDigestMethod.class+0−0

Binary file not shown.

java/pkg/org/jcp/xml/dsig/internal/dom/DOMDigestMethod.java+264−0

@@ -0,0 +1,264 @@
	1	+/*
	2	+ * reserved comment block
	3	+ * DO NOT REMOVE OR ALTER!
	4	+ */
	5	+/*
	6	+ * Copyright 2005 The Apache Software Foundation.
	7	+ *
	8	+ * Licensed under the Apache License, Version 2.0 (the "License");
	9	+ * you may not use this file except in compliance with the License.
	10	+ * You may obtain a copy of the License at
	11	+ *
	12	+ * http://www.apache.org/licenses/LICENSE-2.0
	13	+ *
	14	+ * Unless required by applicable law or agreed to in writing, software
	15	+ * distributed under the License is distributed on an "AS IS" BASIS,
	16	+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
	17	+ * See the License for the specific language governing permissions and
	18	+ * limitations under the License.
	19	+ *
	20	+ */
	21	+/*
	22	+ * Copyright (c) 2005, 2008, Oracle and/or its affiliates. All rights reserved.
	23	+ */
	24	+/*
	25	+ * $Id: DOMDigestMethod.java,v 1.2 2008/07/24 15:20:32 mullan Exp $
	26	+ */
	27	+package org.jcp.xml.dsig.internal.dom;
	28	+
	29	+import javax.xml.crypto.*;
	30	+import javax.xml.crypto.dom.DOMCryptoContext;
	31	+import javax.xml.crypto.dsig.*;
	32	+import javax.xml.crypto.dsig.spec.DigestMethodParameterSpec;
	33	+
	34	+import java.security.InvalidAlgorithmParameterException;
	35	+import java.security.spec.AlgorithmParameterSpec;
	36	+import org.w3c.dom.Document;
	37	+import org.w3c.dom.Element;
	38	+import org.w3c.dom.Node;
	39	+
	40	+/**
	41	+ * DOM-based abstract implementation of DigestMethod.
	42	+ *
	43	+ * @author Sean Mullan
	44	+ */
	45	+public abstract class DOMDigestMethod extends DOMStructure
	46	+ implements DigestMethod {
	47	+
	48	+ final static String SHA384 =
	49	+ "http://www.w3.org/2001/04/xmldsig-more#sha384"; // see RFC 4051
	50	+ private DigestMethodParameterSpec params;
	51	+
	52	+ /**
	53	+ * Creates a <code>DOMDigestMethod</code>.
	54	+ *
	55	+ * @param params the algorithm-specific params (may be <code>null</code>)
	56	+ * @throws InvalidAlgorithmParameterException if the parameters are not
	57	+ * appropriate for this digest method
	58	+ */
	59	+ DOMDigestMethod(AlgorithmParameterSpec params)
	60	+ throws InvalidAlgorithmParameterException {
	61	+ if (params != null && !(params instanceof DigestMethodParameterSpec)) {
	62	+ throw new InvalidAlgorithmParameterException
	63	+ ("params must be of type DigestMethodParameterSpec");
	64	+ }
	65	+ checkParams((DigestMethodParameterSpec) params);
	66	+ this.params = (DigestMethodParameterSpec) params;
	67	+ }
	68	+
	69	+ /**
	70	+ * Creates a <code>DOMDigestMethod</code> from an element. This constructor
	71	+ * invokes the abstract {@link #unmarshalParams unmarshalParams} method to
	72	+ * unmarshal any algorithm-specific input parameters.
	73	+ *
	74	+ * @param dmElem a DigestMethod element
	75	+ */
	76	+ DOMDigestMethod(Element dmElem) throws MarshalException {
	77	+ Element paramsElem = DOMUtils.getFirstChildElement(dmElem);
	78	+ if (paramsElem != null) {
	79	+ params = unmarshalParams(paramsElem);
	80	+ }
	81	+ try {
	82	+ checkParams(params);
	83	+ } catch (InvalidAlgorithmParameterException iape) {
	84	+ throw new MarshalException(iape);
	85	+ }
	86	+ }
	87	+
	88	+ static DigestMethod unmarshal(Element dmElem) throws MarshalException {
	89	+ String alg = DOMUtils.getAttributeValue(dmElem, "Algorithm");
	90	+ if (alg.equals(DigestMethod.SHA1)) {
	91	+ return new SHA1(dmElem);
	92	+ } else if (alg.equals(DigestMethod.SHA256)) {
	93	+ return new SHA256(dmElem);
	94	+ } else if (alg.equals(SHA384)) {
	95	+ return new SHA384(dmElem);
	96	+ } else if (alg.equals(DigestMethod.SHA512)) {
	97	+ return new SHA512(dmElem);
	98	+ } else {
	99	+ throw new MarshalException
	100	+ ("unsupported DigestMethod algorithm: " + alg);
	101	+ }
	102	+ }
	103	+
	104	+ /**
	105	+ * Checks if the specified parameters are valid for this algorithm. By
	106	+ * default, this method throws an exception if parameters are specified
	107	+ * since most DigestMethod algorithms do not have parameters. Subclasses
	108	+ * should override it if they have parameters.
	109	+ *
	110	+ * @param params the algorithm-specific params (may be <code>null</code>)
	111	+ * @throws InvalidAlgorithmParameterException if the parameters are not
	112	+ * appropriate for this digest method
	113	+ */
	114	+ void checkParams(DigestMethodParameterSpec params)
	115	+ throws InvalidAlgorithmParameterException {
	116	+ if (params != null) {
	117	+ throw new InvalidAlgorithmParameterException("no parameters " +
	118	+ "should be specified for the " + getMessageDigestAlgorithm()
	119	+ + " DigestMethod algorithm");
	120	+ }
	121	+ }
	122	+
	123	+ public final AlgorithmParameterSpec getParameterSpec() {
	124	+ return params;
	125	+ }
	126	+
	127	+ /**
	128	+ * Unmarshals <code>DigestMethodParameterSpec</code> from the specified
	129	+ * <code>Element</code>. By default, this method throws an exception since
	130	+ * most DigestMethod algorithms do not have parameters. Subclasses should
	131	+ * override it if they have parameters.
	132	+ *
	133	+ * @param paramsElem the <code>Element</code> holding the input params
	134	+ * @return the algorithm-specific <code>DigestMethodParameterSpec</code>
	135	+ * @throws MarshalException if the parameters cannot be unmarshalled
	136	+ */
	137	+ DigestMethodParameterSpec
	138	+ unmarshalParams(Element paramsElem) throws MarshalException {
	139	+ throw new MarshalException("no parameters should " +
	140	+ "be specified for the " + getMessageDigestAlgorithm() +
	141	+ " DigestMethod algorithm");
	142	+ }
	143	+
	144	+ /**
	145	+ * This method invokes the abstract {@link #marshalParams marshalParams}
	146	+ * method to marshal any algorithm-specific parameters.
	147	+ */
	148	+ public void marshal(Node parent, String prefix, DOMCryptoContext context)
	149	+ throws MarshalException {
	150	+ Document ownerDoc = DOMUtils.getOwnerDocument(parent);
	151	+
	152	+ Element dmElem = DOMUtils.createElement
	153	+ (ownerDoc, "DigestMethod", XMLSignature.XMLNS, prefix);
	154	+ DOMUtils.setAttribute(dmElem, "Algorithm", getAlgorithm());
	155	+
	156	+ if (params != null) {
	157	+ marshalParams(dmElem, prefix);
	158	+ }
	159	+
	160	+ parent.appendChild(dmElem);
	161	+ }
	162	+
	163	+ public boolean equals(Object o) {
	164	+ if (this == o) {
	165	+ return true;
	166	+ }
	167	+
	168	+ if (!(o instanceof DigestMethod)) {
	169	+ return false;
	170	+ }
	171	+ DigestMethod odm = (DigestMethod) o;
	172	+
	173	+ boolean paramsEqual = (params == null ? odm.getParameterSpec() == null :
	174	+ params.equals(odm.getParameterSpec()));
	175	+
	176	+ return (getAlgorithm().equals(odm.getAlgorithm()) && paramsEqual);
	177	+ }
	178	+
	179	+ /**
	180	+ * Marshals the algorithm-specific parameters to an Element and
	181	+ * appends it to the specified parent element. By default, this method
	182	+ * throws an exception since most DigestMethod algorithms do not have
	183	+ * parameters. Subclasses should override it if they have parameters.
	184	+ *
	185	+ * @param parent the parent element to append the parameters to
	186	+ * @param the namespace prefix to use
	187	+ * @throws MarshalException if the parameters cannot be marshalled
	188	+ */
	189	+ void marshalParams(Element parent, String prefix)
	190	+ throws MarshalException {
	191	+ throw new MarshalException("no parameters should " +
	192	+ "be specified for the " + getMessageDigestAlgorithm() +
	193	+ " DigestMethod algorithm");
	194	+ }
	195	+
	196	+ /**
	197	+ * Returns the MessageDigest standard algorithm name.
	198	+ */
	199	+ abstract String getMessageDigestAlgorithm();
	200	+
	201	+ static final class SHA1 extends DOMDigestMethod {
	202	+ SHA1(AlgorithmParameterSpec params)
	203	+ throws InvalidAlgorithmParameterException {
	204	+ super(params);
	205	+ }
	206	+ SHA1(Element dmElem) throws MarshalException {
	207	+ super(dmElem);
	208	+ }
	209	+ public String getAlgorithm() {
	210	+ return DigestMethod.SHA1;
	211	+ }
	212	+ String getMessageDigestAlgorithm() {
	213	+ return "SHA-1";
	214	+ }
	215	+ }
	216	+
	217	+ static final class SHA256 extends DOMDigestMethod {
	218	+ SHA256(AlgorithmParameterSpec params)
	219	+ throws InvalidAlgorithmParameterException {
	220	+ super(params);
	221	+ }
	222	+ SHA256(Element dmElem) throws MarshalException {
	223	+ super(dmElem);
	224	+ }
	225	+ public String getAlgorithm() {
	226	+ return DigestMethod.SHA256;
	227	+ }
	228	+ String getMessageDigestAlgorithm() {
	229	+ return "SHA-256";
	230	+ }
	231	+ }
	232	+
	233	+ static final class SHA384 extends DOMDigestMethod {
	234	+ SHA384(AlgorithmParameterSpec params)
	235	+ throws InvalidAlgorithmParameterException {
	236	+ super(params);
	237	+ }
	238	+ SHA384(Element dmElem) throws MarshalException {
	239	+ super(dmElem);
	240	+ }
	241	+ public String getAlgorithm() {
	242	+ return SHA384;
	243	+ }
	244	+ String getMessageDigestAlgorithm() {
	245	+ return "SHA-384";
	246	+ }
	247	+ }
	248	+
	249	+ static final class SHA512 extends DOMDigestMethod {
	250	+ SHA512(AlgorithmParameterSpec params)
	251	+ throws InvalidAlgorithmParameterException {
	252	+ super(params);
	253	+ }
	254	+ SHA512(Element dmElem) throws MarshalException {
	255	+ super(dmElem);
	256	+ }
	257	+ public String getAlgorithm() {
	258	+ return DigestMethod.SHA512;
	259	+ }
	260	+ String getMessageDigestAlgorithm() {
	261	+ return "SHA-512";
	262	+ }
	263	+ }
	264	+}

java/pkg/org/jcp/xml/dsig/internal/dom/DOMEnvelopedTransform.class+0−0

Binary file not shown.

java/pkg/org/jcp/xml/dsig/internal/dom/DOMEnvelopedTransform.java+46−0

@@ -0,0 +1,46 @@
	1	+/*
	2	+ * reserved comment block
	3	+ * DO NOT REMOVE OR ALTER!
	4	+ */
	5	+/*
	6	+ * Copyright 2005 The Apache Software Foundation.
	7	+ *
	8	+ * Licensed under the Apache License, Version 2.0 (the "License");
	9	+ * you may not use this file except in compliance with the License.
	10	+ * You may obtain a copy of the License at
	11	+ *
	12	+ * http://www.apache.org/licenses/LICENSE-2.0
	13	+ *
	14	+ * Unless required by applicable law or agreed to in writing, software
	15	+ * distributed under the License is distributed on an "AS IS" BASIS,
	16	+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
	17	+ * See the License for the specific language governing permissions and
	18	+ * limitations under the License.
	19	+ *
	20	+ */
	21	+/*
	22	+ * Copyright (c) 2005, 2008, Oracle and/or its affiliates. All rights reserved.
	23	+ */
	24	+/*
	25	+ * $Id: DOMEnvelopedTransform.java,v 1.2 2008/07/24 15:20:32 mullan Exp $
	26	+ */
	27	+package org.jcp.xml.dsig.internal.dom;
	28	+
	29	+import java.security.InvalidAlgorithmParameterException;
	30	+import javax.xml.crypto.dsig.spec.TransformParameterSpec;
	31	+
	32	+/**
	33	+ * DOM-based implementation of Enveloped Signature Transform.
	34	+ * (Uses Apache XML-Sec Transform implementation)
	35	+ *
	36	+ * @author Sean Mullan
	37	+ */
	38	+public final class DOMEnvelopedTransform extends ApacheTransform {
	39	+
	40	+ public void init(TransformParameterSpec params)
	41	+ throws InvalidAlgorithmParameterException {
	42	+ if (params != null) {
	43	+ throw new InvalidAlgorithmParameterException("params must be null");
	44	+ }
	45	+ }
	46	+}

java/pkg/org/jcp/xml/dsig/internal/dom/DOMExcC14NMethod.class+0−0

Binary file not shown.

java/pkg/org/jcp/xml/dsig/internal/dom/DOMExcC14NMethod.java+155−0

@@ -0,0 +1,155 @@
	1	+/*
	2	+ * reserved comment block
	3	+ * DO NOT REMOVE OR ALTER!
	4	+ */
	5	+/*
	6	+ * Copyright 2005 The Apache Software Foundation.
	7	+ *
	8	+ * Licensed under the Apache License, Version 2.0 (the "License");
	9	+ * you may not use this file except in compliance with the License.
	10	+ * You may obtain a copy of the License at
	11	+ *
	12	+ * http://www.apache.org/licenses/LICENSE-2.0
	13	+ *
	14	+ * Unless required by applicable law or agreed to in writing, software
	15	+ * distributed under the License is distributed on an "AS IS" BASIS,
	16	+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
	17	+ * See the License for the specific language governing permissions and
	18	+ * limitations under the License.
	19	+ *
	20	+ */
	21	+/*
	22	+ * Copyright (c) 2005, 2008, Oracle and/or its affiliates. All rights reserved.
	23	+ */
	24	+/*
	25	+ * $Id: DOMExcC14NMethod.java,v 1.2 2008/07/24 15:20:32 mullan Exp $
	26	+ */
	27	+package org.jcp.xml.dsig.internal.dom;
	28	+
	29	+import javax.xml.crypto.*;
	30	+import javax.xml.crypto.dsig.*;
	31	+import javax.xml.crypto.dsig.spec.C14NMethodParameterSpec;
	32	+import javax.xml.crypto.dsig.spec.ExcC14NParameterSpec;
	33	+import javax.xml.crypto.dsig.spec.TransformParameterSpec;
	34	+
	35	+import java.security.InvalidAlgorithmParameterException;
	36	+import java.security.spec.AlgorithmParameterSpec;
	37	+import java.util.*;
	38	+import org.w3c.dom.Element;
	39	+
	40	+import com.sun.org.apache.xml.internal.security.c14n.Canonicalizer;
	41	+import com.sun.org.apache.xml.internal.security.c14n.InvalidCanonicalizerException;
	42	+
	43	+/**
	44	+ * DOM-based implementation of CanonicalizationMethod for Exclusive
	45	+ * Canonical XML algorithm (with or without comments).
	46	+ * Uses Apache XML-Sec Canonicalizer.
	47	+ *
	48	+ * @author Sean Mullan
	49	+ */
	50	+public final class DOMExcC14NMethod extends ApacheCanonicalizer {
	51	+
	52	+ public void init(TransformParameterSpec params)
	53	+ throws InvalidAlgorithmParameterException {
	54	+ if (params != null) {
	55	+ if (!(params instanceof ExcC14NParameterSpec)) {
	56	+ throw new InvalidAlgorithmParameterException
	57	+ ("params must be of type ExcC14NParameterSpec");
	58	+ }
	59	+ this.params = (C14NMethodParameterSpec) params;
	60	+ }
	61	+ }
	62	+
	63	+ public void init(XMLStructure parent, XMLCryptoContext context)
	64	+ throws InvalidAlgorithmParameterException {
	65	+ super.init(parent, context);
	66	+ Element paramsElem = DOMUtils.getFirstChildElement(transformElem);
	67	+ if (paramsElem == null) {
	68	+ this.params = null;
	69	+ this.inclusiveNamespaces = null;
	70	+ return;
	71	+ }
	72	+ unmarshalParams(paramsElem);
	73	+ }
	74	+
	75	+ private void unmarshalParams(Element paramsElem) {
	76	+ String prefixListAttr = paramsElem.getAttributeNS(null, "PrefixList");
	77	+ this.inclusiveNamespaces = prefixListAttr;
	78	+ int begin = 0;
	79	+ int end = prefixListAttr.indexOf(' ');
	80	+ List prefixList = new ArrayList();
	81	+ while (end != -1) {
	82	+ prefixList.add(prefixListAttr.substring(begin, end));
	83	+ begin = end + 1;
	84	+ end = prefixListAttr.indexOf(' ', begin);
	85	+ }
	86	+ if (begin <= prefixListAttr.length()) {
	87	+ prefixList.add(prefixListAttr.substring(begin));
	88	+ }
	89	+ this.params = new ExcC14NParameterSpec(prefixList);
	90	+ }
	91	+
	92	+ public void marshalParams(XMLStructure parent, XMLCryptoContext context)
	93	+ throws MarshalException {
	94	+
	95	+ super.marshalParams(parent, context);
	96	+ AlgorithmParameterSpec spec = getParameterSpec();
	97	+ if (spec == null) {
	98	+ return;
	99	+ }
	100	+
	101	+ String prefix =
	102	+ DOMUtils.getNSPrefix(context, CanonicalizationMethod.EXCLUSIVE);
	103	+ Element excElem = DOMUtils.createElement
	104	+ (ownerDoc, "InclusiveNamespaces",
	105	+ CanonicalizationMethod.EXCLUSIVE, prefix);
	106	+ if (prefix == null \|\| prefix.length() == 0) {
	107	+ excElem.setAttributeNS("http://www.w3.org/2000/xmlns/", "xmlns",
	108	+ CanonicalizationMethod.EXCLUSIVE);
	109	+ } else {
	110	+ excElem.setAttributeNS("http://www.w3.org/2000/xmlns/",
	111	+ "xmlns:" + prefix, CanonicalizationMethod.EXCLUSIVE);
	112	+ }
	113	+
	114	+ ExcC14NParameterSpec params = (ExcC14NParameterSpec) spec;
	115	+ StringBuffer prefixListAttr = new StringBuffer("");
	116	+ List prefixList = params.getPrefixList();
	117	+ for (int i = 0, size = prefixList.size(); i < size; i++) {
	118	+ prefixListAttr.append((String) prefixList.get(i));
	119	+ if (i < size - 1) {
	120	+ prefixListAttr.append(" ");
	121	+ }
	122	+ }
	123	+ DOMUtils.setAttribute(excElem, "PrefixList", prefixListAttr.toString());
	124	+ this.inclusiveNamespaces = prefixListAttr.toString();
	125	+ transformElem.appendChild(excElem);
	126	+ }
	127	+
	128	+ public String getParamsNSURI() {
	129	+ return CanonicalizationMethod.EXCLUSIVE;
	130	+ }
	131	+
	132	+ public Data transform(Data data, XMLCryptoContext xc)
	133	+ throws TransformException {
	134	+
	135	+ // ignore comments if dereferencing same-document URI that require
	136	+ // you to omit comments, even if the Transform says otherwise -
	137	+ // this is to be compliant with section 4.3.3.3 of W3C Rec.
	138	+ if (data instanceof DOMSubTreeData) {
	139	+ DOMSubTreeData subTree = (DOMSubTreeData) data;
	140	+ if (subTree.excludeComments()) {
	141	+ try {
	142	+ apacheCanonicalizer = Canonicalizer.getInstance
	143	+ (CanonicalizationMethod.EXCLUSIVE);
	144	+ } catch (InvalidCanonicalizerException ice) {
	145	+ throw new TransformException
	146	+ ("Couldn't find Canonicalizer for: " +
	147	+ CanonicalizationMethod.EXCLUSIVE + ": " +
	148	+ ice.getMessage(), ice);
	149	+ }
	150	+ }
	151	+ }
	152	+
	153	+ return canonicalize(data, xc);
	154	+ }
	155	+}

java/pkg/org/jcp/xml/dsig/internal/dom/DOMHMACSignatureMethod$SHA1.class+0−0

Binary file not shown.

java/pkg/org/jcp/xml/dsig/internal/dom/DOMHMACSignatureMethod$SHA256.class+0−0

Binary file not shown.

java/pkg/org/jcp/xml/dsig/internal/dom/DOMHMACSignatureMethod$SHA384.class+0−0

Binary file not shown.

java/pkg/org/jcp/xml/dsig/internal/dom/DOMHMACSignatureMethod$SHA512.class+0−0

Binary file not shown.

java/pkg/org/jcp/xml/dsig/internal/dom/DOMHMACSignatureMethod.class+0−0

Binary file not shown.

java/pkg/org/jcp/xml/dsig/internal/dom/DOMHMACSignatureMethod.java+268−0

@@ -0,0 +1,268 @@
	1	+/*
	2	+ * reserved comment block
	3	+ * DO NOT REMOVE OR ALTER!
	4	+ */
	5	+/*
	6	+ * Copyright 2005 The Apache Software Foundation.
	7	+ *
	8	+ * Licensed under the Apache License, Version 2.0 (the "License");
	9	+ * you may not use this file except in compliance with the License.
	10	+ * You may obtain a copy of the License at
	11	+ *
	12	+ * http://www.apache.org/licenses/LICENSE-2.0
	13	+ *
	14	+ * Unless required by applicable law or agreed to in writing, software
	15	+ * distributed under the License is distributed on an "AS IS" BASIS,
	16	+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
	17	+ * See the License for the specific language governing permissions and
	18	+ * limitations under the License.
	19	+ *
	20	+ */
	21	+/*
	22	+ * Copyright (c) 2005, 2009, Oracle and/or its affiliates. All rights reserved.
	23	+ */
	24	+/*
	25	+ * $Id: DOMHMACSignatureMethod.java,v 1.2 2008/07/24 15:20:32 mullan Exp $
	26	+ */
	27	+package org.jcp.xml.dsig.internal.dom;
	28	+
	29	+import javax.xml.crypto.*;
	30	+import javax.xml.crypto.dsig.*;
	31	+import javax.xml.crypto.dsig.spec.HMACParameterSpec;
	32	+import javax.xml.crypto.dsig.spec.SignatureMethodParameterSpec;
	33	+
	34	+import java.security.InvalidAlgorithmParameterException;
	35	+import java.security.InvalidKeyException;
	36	+import java.security.Key;
	37	+import java.security.MessageDigest;
	38	+import java.security.NoSuchAlgorithmException;
	39	+import java.security.SignatureException;
	40	+import java.security.spec.AlgorithmParameterSpec;
	41	+import java.util.logging.Level;
	42	+import java.util.logging.Logger;
	43	+import javax.crypto.Mac;
	44	+import javax.crypto.SecretKey;
	45	+import org.w3c.dom.Document;
	46	+import org.w3c.dom.Element;
	47	+
	48	+import org.jcp.xml.dsig.internal.MacOutputStream;
	49	+
	50	+/**
	51	+ * DOM-based implementation of HMAC SignatureMethod.
	52	+ *
	53	+ * @author Sean Mullan
	54	+ */
	55	+public abstract class DOMHMACSignatureMethod extends DOMSignatureMethod {
	56	+
	57	+ private static Logger log =
	58	+ Logger.getLogger("org.jcp.xml.dsig.internal.dom");
	59	+ private Mac hmac;
	60	+ private int outputLength;
	61	+ private boolean outputLengthSet;
	62	+
	63	+ /**
	64	+ * Creates a <code>DOMHMACSignatureMethod</code> with the specified params
	65	+ *
	66	+ * @param params algorithm-specific parameters (may be <code>null</code>)
	67	+ * @throws InvalidAlgorithmParameterException if params are inappropriate
	68	+ */
	69	+ DOMHMACSignatureMethod(AlgorithmParameterSpec params)
	70	+ throws InvalidAlgorithmParameterException {
	71	+ super(params);
	72	+ }
	73	+
	74	+ /**
	75	+ * Creates a <code>DOMHMACSignatureMethod</code> from an element.
	76	+ *
	77	+ * @param smElem a SignatureMethod element
	78	+ */
	79	+ DOMHMACSignatureMethod(Element smElem) throws MarshalException {
	80	+ super(smElem);
	81	+ }
	82	+
	83	+ void checkParams(SignatureMethodParameterSpec params)
	84	+ throws InvalidAlgorithmParameterException {
	85	+ if (params != null) {
	86	+ if (!(params instanceof HMACParameterSpec)) {
	87	+ throw new InvalidAlgorithmParameterException
	88	+ ("params must be of type HMACParameterSpec");
	89	+ }
	90	+ outputLength = ((HMACParameterSpec) params).getOutputLength();
	91	+ outputLengthSet = true;
	92	+ if (log.isLoggable(Level.FINE)) {
	93	+ log.log(Level.FINE,
	94	+ "Setting outputLength from HMACParameterSpec to: "
	95	+ + outputLength);
	96	+ }
	97	+ } else {
	98	+ outputLength = -1;
	99	+ }
	100	+ }
	101	+
	102	+ SignatureMethodParameterSpec unmarshalParams(Element paramsElem)
	103	+ throws MarshalException {
	104	+ outputLength = new Integer
	105	+ (paramsElem.getFirstChild().getNodeValue()).intValue();
	106	+ outputLengthSet = true;
	107	+ if (log.isLoggable(Level.FINE)) {
	108	+ log.log(Level.FINE, "unmarshalled outputLength: " + outputLength);
	109	+ }
	110	+ return new HMACParameterSpec(outputLength);
	111	+ }
	112	+
	113	+ void marshalParams(Element parent, String prefix)
	114	+ throws MarshalException {
	115	+
	116	+ Document ownerDoc = DOMUtils.getOwnerDocument(parent);
	117	+ Element hmacElem = DOMUtils.createElement(ownerDoc, "HMACOutputLength",
	118	+ XMLSignature.XMLNS, prefix);
	119	+ hmacElem.appendChild(ownerDoc.createTextNode
	120	+ (String.valueOf(outputLength)));
	121	+
	122	+ parent.appendChild(hmacElem);
	123	+ }
	124	+
	125	+ boolean verify(Key key, DOMSignedInfo si, byte[] sig,
	126	+ XMLValidateContext context)
	127	+ throws InvalidKeyException, SignatureException, XMLSignatureException {
	128	+ if (key == null \|\| si == null \|\| sig == null) {
	129	+ throw new NullPointerException();
	130	+ }
	131	+ if (!(key instanceof SecretKey)) {
	132	+ throw new InvalidKeyException("key must be SecretKey");
	133	+ }
	134	+ if (hmac == null) {
	135	+ try {
	136	+ hmac = Mac.getInstance(getSignatureAlgorithm());
	137	+ } catch (NoSuchAlgorithmException nsae) {
	138	+ throw new XMLSignatureException(nsae);
	139	+ }
	140	+ }
	141	+ if (outputLengthSet && outputLength < getDigestLength()) {
	142	+ throw new XMLSignatureException
	143	+ ("HMACOutputLength must not be less than " + getDigestLength());
	144	+ }
	145	+ hmac.init((SecretKey) key);
	146	+ si.canonicalize(context, new MacOutputStream(hmac));
	147	+ byte[] result = hmac.doFinal();
	148	+
	149	+ return MessageDigest.isEqual(sig, result);
	150	+ }
	151	+
	152	+ byte[] sign(Key key, DOMSignedInfo si, XMLSignContext context)
	153	+ throws InvalidKeyException, XMLSignatureException {
	154	+ if (key == null \|\| si == null) {
	155	+ throw new NullPointerException();
	156	+ }
	157	+ if (!(key instanceof SecretKey)) {
	158	+ throw new InvalidKeyException("key must be SecretKey");
	159	+ }
	160	+ if (hmac == null) {
	161	+ try {
	162	+ hmac = Mac.getInstance(getSignatureAlgorithm());
	163	+ } catch (NoSuchAlgorithmException nsae) {
	164	+ throw new XMLSignatureException(nsae);
	165	+ }
	166	+ }
	167	+ if (outputLengthSet && outputLength < getDigestLength()) {
	168	+ throw new XMLSignatureException
	169	+ ("HMACOutputLength must not be less than " + getDigestLength());
	170	+ }
	171	+ hmac.init((SecretKey) key);
	172	+ si.canonicalize(context, new MacOutputStream(hmac));
	173	+ return hmac.doFinal();
	174	+ }
	175	+
	176	+ boolean paramsEqual(AlgorithmParameterSpec spec) {
	177	+ if (getParameterSpec() == spec) {
	178	+ return true;
	179	+ }
	180	+ if (!(spec instanceof HMACParameterSpec)) {
	181	+ return false;
	182	+ }
	183	+ HMACParameterSpec ospec = (HMACParameterSpec) spec;
	184	+
	185	+ return (outputLength == ospec.getOutputLength());
	186	+ }
	187	+
	188	+ /**
	189	+ * Returns the output length of the hash/digest.
	190	+ */
	191	+ abstract int getDigestLength();
	192	+
	193	+ static final class SHA1 extends DOMHMACSignatureMethod {
	194	+ SHA1(AlgorithmParameterSpec params)
	195	+ throws InvalidAlgorithmParameterException {
	196	+ super(params);
	197	+ }
	198	+ SHA1(Element dmElem) throws MarshalException {
	199	+ super(dmElem);
	200	+ }
	201	+ public String getAlgorithm() {
	202	+ return SignatureMethod.HMAC_SHA1;
	203	+ }
	204	+ String getSignatureAlgorithm() {
	205	+ return "HmacSHA1";
	206	+ }
	207	+ int getDigestLength() {
	208	+ return 160;
	209	+ }
	210	+ }
	211	+
	212	+ static final class SHA256 extends DOMHMACSignatureMethod {
	213	+ SHA256(AlgorithmParameterSpec params)
	214	+ throws InvalidAlgorithmParameterException {
	215	+ super(params);
	216	+ }
	217	+ SHA256(Element dmElem) throws MarshalException {
	218	+ super(dmElem);
	219	+ }
	220	+ public String getAlgorithm() {
	221	+ return HMAC_SHA256;
	222	+ }
	223	+ String getSignatureAlgorithm() {
	224	+ return "HmacSHA256";
	225	+ }
	226	+ int getDigestLength() {
	227	+ return 256;
	228	+ }
	229	+ }
	230	+
	231	+ static final class SHA384 extends DOMHMACSignatureMethod {
	232	+ SHA384(AlgorithmParameterSpec params)
	233	+ throws InvalidAlgorithmParameterException {
	234	+ super(params);
	235	+ }
	236	+ SHA384(Element dmElem) throws MarshalException {
	237	+ super(dmElem);
	238	+ }
	239	+ public String getAlgorithm() {
	240	+ return HMAC_SHA384;
	241	+ }
	242	+ String getSignatureAlgorithm() {
	243	+ return "HmacSHA384";
	244	+ }
	245	+ int getDigestLength() {
	246	+ return 384;
	247	+ }
	248	+ }
	249	+
	250	+ static final class SHA512 extends DOMHMACSignatureMethod {
	251	+ SHA512(AlgorithmParameterSpec params)
	252	+ throws InvalidAlgorithmParameterException {
	253	+ super(params);
	254	+ }
	255	+ SHA512(Element dmElem) throws MarshalException {
	256	+ super(dmElem);
	257	+ }
	258	+ public String getAlgorithm() {
	259	+ return HMAC_SHA512;
	260	+ }
	261	+ String getSignatureAlgorithm() {
	262	+ return "HmacSHA512";
	263	+ }
	264	+ int getDigestLength() {
	265	+ return 512;
	266	+ }
	267	+ }
	268	+}

java/pkg/org/jcp/xml/dsig/internal/dom/DOMKeyInfo.class+0−0

Binary file not shown.

java/pkg/org/jcp/xml/dsig/internal/dom/DOMKeyInfo.java+204−0

@@ -0,0 +1,204 @@
	1	+/*
	2	+ * reserved comment block
	3	+ * DO NOT REMOVE OR ALTER!
	4	+ */
	5	+/*
	6	+ * Copyright 2005 The Apache Software Foundation.
	7	+ *
	8	+ * Licensed under the Apache License, Version 2.0 (the "License");
	9	+ * you may not use this file except in compliance with the License.
	10	+ * You may obtain a copy of the License at
	11	+ *
	12	+ * http://www.apache.org/licenses/LICENSE-2.0
	13	+ *
	14	+ * Unless required by applicable law or agreed to in writing, software
	15	+ * distributed under the License is distributed on an "AS IS" BASIS,
	16	+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
	17	+ * See the License for the specific language governing permissions and
	18	+ * limitations under the License.
	19	+ *
	20	+ */
	21	+/*
	22	+ * Copyright (c) 2005, 2008, Oracle and/or its affiliates. All rights reserved.
	23	+ */
	24	+/*
	25	+ * $Id: DOMKeyInfo.java,v 1.2 2008/07/24 15:20:32 mullan Exp $
	26	+ */
	27	+package org.jcp.xml.dsig.internal.dom;
	28	+
	29	+import javax.xml.crypto.*;
	30	+import javax.xml.crypto.dsig.*;
	31	+import javax.xml.crypto.dsig.dom.DOMSignContext;
	32	+import javax.xml.crypto.dsig.keyinfo.KeyInfo;
	33	+import javax.xml.crypto.dom.*;
	34	+
	35	+import java.security.Provider;
	36	+import java.util.*;
	37	+import org.w3c.dom.Document;
	38	+import org.w3c.dom.Element;
	39	+import org.w3c.dom.Node;
	40	+import org.w3c.dom.NodeList;
	41	+
	42	+/**
	43	+ * DOM-based implementation of KeyInfo.
	44	+ *
	45	+ * @author Sean Mullan
	46	+ */
	47	+public final class DOMKeyInfo extends DOMStructure implements KeyInfo {
	48	+
	49	+ private final String id;
	50	+ private final List keyInfoTypes;
	51	+
	52	+ /**
	53	+ * Creates a <code>DOMKeyInfo</code>.
	54	+ *
	55	+ * @param content a list of one or more {@link XMLStructure}s representing
	56	+ * key information types. The list is defensively copied to protect
	57	+ * against subsequent modification.
	58	+ * @param id an ID attribute
	59	+ * @throws NullPointerException if <code>content</code> is <code>null</code>
	60	+ * @throws IllegalArgumentException if <code>content</code> is empty
	61	+ * @throws ClassCastException if <code>content</code> contains any entries
	62	+ * that are not of type {@link XMLStructure}
	63	+ */
	64	+ public DOMKeyInfo(List content, String id) {
	65	+ if (content == null) {
	66	+ throw new NullPointerException("content cannot be null");
	67	+ }
	68	+ List typesCopy = new ArrayList(content);
	69	+ if (typesCopy.isEmpty()) {
	70	+ throw new IllegalArgumentException("content cannot be empty");
	71	+ }
	72	+ for (int i = 0, size = typesCopy.size(); i < size; i++) {
	73	+ if (!(typesCopy.get(i) instanceof XMLStructure)) {
	74	+ throw new ClassCastException
	75	+ ("content["+i+"] is not a valid KeyInfo type");
	76	+ }
	77	+ }
	78	+ this.keyInfoTypes = Collections.unmodifiableList(typesCopy);
	79	+ this.id = id;
	80	+ }
	81	+
	82	+ /**
	83	+ * Creates a <code>DOMKeyInfo</code> from XML.
	84	+ *
	85	+ * @param kiElem KeyInfo element
	86	+ */
	87	+ public DOMKeyInfo(Element kiElem, XMLCryptoContext context,
	88	+ Provider provider) throws MarshalException {
	89	+ // get Id attribute, if specified
	90	+ id = DOMUtils.getAttributeValue(kiElem, "Id");
	91	+
	92	+ // get all children nodes
	93	+ NodeList nl = kiElem.getChildNodes();
	94	+ int length = nl.getLength();
	95	+ if (length < 1) {
	96	+ throw new MarshalException
	97	+ ("KeyInfo must contain at least one type");
	98	+ }
	99	+ List content = new ArrayList(length);
	100	+ for (int i = 0; i < length; i++) {
	101	+ Node child = nl.item(i);
	102	+ // ignore all non-Element nodes
	103	+ if (child.getNodeType() != Node.ELEMENT_NODE) {
	104	+ continue;
	105	+ }
	106	+ Element childElem = (Element) child;
	107	+ String localName = childElem.getLocalName();
	108	+ if (localName.equals("X509Data")) {
	109	+ content.add(new DOMX509Data(childElem));
	110	+ } else if (localName.equals("KeyName")) {
	111	+ content.add(new DOMKeyName(childElem));
	112	+ } else if (localName.equals("KeyValue")) {
	113	+ content.add(new DOMKeyValue(childElem));
	114	+ } else if (localName.equals("RetrievalMethod")) {
	115	+ content.add
	116	+ (new DOMRetrievalMethod(childElem, context, provider));
	117	+ } else if (localName.equals("PGPData")) {
	118	+ content.add(new DOMPGPData(childElem));
	119	+ } else { //may be MgmtData, SPKIData or element from other namespace
	120	+ content.add(new javax.xml.crypto.dom.DOMStructure((childElem)));
	121	+ }
	122	+ }
	123	+ keyInfoTypes = Collections.unmodifiableList(content);
	124	+ }
	125	+
	126	+ public String getId() {
	127	+ return id;
	128	+ }
	129	+
	130	+ public List getContent() {
	131	+ return keyInfoTypes;
	132	+ }
	133	+
	134	+ public void marshal(XMLStructure parent, XMLCryptoContext context)
	135	+ throws MarshalException {
	136	+ if (parent == null) {
	137	+ throw new NullPointerException("parent is null");
	138	+ }
	139	+
	140	+ Node pNode = ((javax.xml.crypto.dom.DOMStructure) parent).getNode();
	141	+ String dsPrefix = DOMUtils.getSignaturePrefix(context);
	142	+ Element kiElem = DOMUtils.createElement
	143	+ (DOMUtils.getOwnerDocument(pNode), "KeyInfo",
	144	+ XMLSignature.XMLNS, dsPrefix);
	145	+ if (dsPrefix == null \|\| dsPrefix.length() == 0) {
	146	+ kiElem.setAttributeNS
	147	+ ("http://www.w3.org/2000/xmlns/", "xmlns", XMLSignature.XMLNS);
	148	+ } else {
	149	+ kiElem.setAttributeNS
	150	+ ("http://www.w3.org/2000/xmlns/", "xmlns:" + dsPrefix,
	151	+ XMLSignature.XMLNS);
	152	+ }
	153	+ marshal(pNode, kiElem, null, dsPrefix, (DOMCryptoContext) context);
	154	+ }
	155	+
	156	+ public void marshal(Node parent, String dsPrefix,
	157	+ DOMCryptoContext context) throws MarshalException {
	158	+ marshal(parent, null, dsPrefix, context);
	159	+ }
	160	+
	161	+ public void marshal(Node parent, Node nextSibling, String dsPrefix,
	162	+ DOMCryptoContext context) throws MarshalException {
	163	+ Document ownerDoc = DOMUtils.getOwnerDocument(parent);
	164	+
	165	+ Element kiElem = DOMUtils.createElement
	166	+ (ownerDoc, "KeyInfo", XMLSignature.XMLNS, dsPrefix);
	167	+ marshal(parent, kiElem, nextSibling, dsPrefix, context);
	168	+ }
	169	+
	170	+ private void marshal(Node parent, Element kiElem, Node nextSibling,
	171	+ String dsPrefix, DOMCryptoContext context) throws MarshalException {
	172	+ // create and append KeyInfoType elements
	173	+ for (int i = 0, size = keyInfoTypes.size(); i < size; i++) {
	174	+ XMLStructure kiType = (XMLStructure) keyInfoTypes.get(i);
	175	+ if (kiType instanceof DOMStructure) {
	176	+ ((DOMStructure) kiType).marshal(kiElem, dsPrefix, context);
	177	+ } else {
	178	+ DOMUtils.appendChild(kiElem,
	179	+ ((javax.xml.crypto.dom.DOMStructure) kiType).getNode());
	180	+ }
	181	+ }
	182	+
	183	+ // append id attribute
	184	+ DOMUtils.setAttributeID(kiElem, "Id", id);
	185	+
	186	+ parent.insertBefore(kiElem, nextSibling);
	187	+ }
	188	+
	189	+ public boolean equals(Object o) {
	190	+ if (this == o) {
	191	+ return true;
	192	+ }
	193	+
	194	+ if (!(o instanceof KeyInfo)) {
	195	+ return false;
	196	+ }
	197	+ KeyInfo oki = (KeyInfo) o;
	198	+
	199	+ boolean idsEqual = (id == null ? oki.getId() == null :
	200	+ id.equals(oki.getId()));
	201	+
	202	+ return (keyInfoTypes.equals(oki.getContent()) && idsEqual);
	203	+ }
	204	+}

java/pkg/org/jcp/xml/dsig/internal/dom/DOMKeyInfoFactory.class+0−0

Binary file not shown.

java/pkg/org/jcp/xml/dsig/internal/dom/DOMKeyInfoFactory.java+142−0

@@ -0,0 +1,142 @@
	1	+/*
	2	+ * reserved comment block
	3	+ * DO NOT REMOVE OR ALTER!
	4	+ */
	5	+/*
	6	+ * Copyright 2005 The Apache Software Foundation.
	7	+ *
	8	+ * Licensed under the Apache License, Version 2.0 (the "License");
	9	+ * you may not use this file except in compliance with the License.
	10	+ * You may obtain a copy of the License at
	11	+ *
	12	+ * http://www.apache.org/licenses/LICENSE-2.0
	13	+ *
	14	+ * Unless required by applicable law or agreed to in writing, software
	15	+ * distributed under the License is distributed on an "AS IS" BASIS,
	16	+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
	17	+ * See the License for the specific language governing permissions and
	18	+ * limitations under the License.
	19	+ *
	20	+ */
	21	+/*
	22	+ * Copyright (c) 2005, 2008, Oracle and/or its affiliates. All rights reserved.
	23	+ */
	24	+/*
	25	+ * $Id: DOMKeyInfoFactory.java,v 1.2 2008/07/24 15:20:32 mullan Exp $
	26	+ */
	27	+package org.jcp.xml.dsig.internal.dom;
	28	+
	29	+import java.math.BigInteger;
	30	+import java.security.KeyException;
	31	+import java.security.PublicKey;
	32	+import java.util.List;
	33	+import javax.xml.crypto.*;
	34	+import javax.xml.crypto.dsig.*;
	35	+import javax.xml.crypto.dom.*;
	36	+import javax.xml.crypto.dsig.keyinfo.*;
	37	+import org.w3c.dom.Document;
	38	+import org.w3c.dom.Element;
	39	+import org.w3c.dom.Node;
	40	+
	41	+/**
	42	+ * DOM-based implementation of KeyInfoFactory.
	43	+ *
	44	+ * @author Sean Mullan
	45	+ */
	46	+public final class DOMKeyInfoFactory extends KeyInfoFactory {
	47	+
	48	+ public DOMKeyInfoFactory() { }
	49	+
	50	+ public KeyInfo newKeyInfo(List content) {
	51	+ return newKeyInfo(content, null);
	52	+ }
	53	+
	54	+ public KeyInfo newKeyInfo(List content, String id) {
	55	+ return new DOMKeyInfo(content, id);
	56	+ }
	57	+
	58	+ public KeyName newKeyName(String name) {
	59	+ return new DOMKeyName(name);
	60	+ }
	61	+
	62	+ public KeyValue newKeyValue(PublicKey key) throws KeyException {
	63	+ return new DOMKeyValue(key);
	64	+ }
	65	+
	66	+ public PGPData newPGPData(byte[] keyId) {
	67	+ return newPGPData(keyId, null, null);
	68	+ }
	69	+
	70	+ public PGPData newPGPData(byte[] keyId, byte[] keyPacket, List other) {
	71	+ return new DOMPGPData(keyId, keyPacket, other);
	72	+ }
	73	+
	74	+ public PGPData newPGPData(byte[] keyPacket, List other) {
	75	+ return new DOMPGPData(keyPacket, other);
	76	+ }
	77	+
	78	+ public RetrievalMethod newRetrievalMethod(String uri) {
	79	+ return newRetrievalMethod(uri, null, null);
	80	+ }
	81	+
	82	+ public RetrievalMethod newRetrievalMethod(String uri, String type,
	83	+ List transforms) {
	84	+ if (uri == null) {
	85	+ throw new NullPointerException("uri must not be null");
	86	+ }
	87	+ return new DOMRetrievalMethod(uri, type, transforms);
	88	+ }
	89	+
	90	+ public X509Data newX509Data(List content) {
	91	+ return new DOMX509Data(content);
	92	+ }
	93	+
	94	+ public X509IssuerSerial newX509IssuerSerial(String issuerName,
	95	+ BigInteger serialNumber) {
	96	+ return new DOMX509IssuerSerial(issuerName, serialNumber);
	97	+ }
	98	+
	99	+ public boolean isFeatureSupported(String feature) {
	100	+ if (feature == null) {
	101	+ throw new NullPointerException();
	102	+ } else {
	103	+ return false;
	104	+ }
	105	+ }
	106	+
	107	+ public URIDereferencer getURIDereferencer() {
	108	+ return DOMURIDereferencer.INSTANCE;
	109	+ }
	110	+
	111	+ public KeyInfo unmarshalKeyInfo(XMLStructure xmlStructure)
	112	+ throws MarshalException {
	113	+ if (xmlStructure == null) {
	114	+ throw new NullPointerException("xmlStructure cannot be null");
	115	+ }
	116	+ Node node =
	117	+ ((javax.xml.crypto.dom.DOMStructure) xmlStructure).getNode();
	118	+ node.normalize();
	119	+
	120	+ Element element = null;
	121	+ if (node.getNodeType() == Node.DOCUMENT_NODE) {
	122	+ element = ((Document) node).getDocumentElement();
	123	+ } else if (node.getNodeType() == Node.ELEMENT_NODE) {
	124	+ element = (Element) node;
	125	+ } else {
	126	+ throw new MarshalException
	127	+ ("xmlStructure does not contain a proper Node");
	128	+ }
	129	+
	130	+ // check tag
	131	+ String tag = element.getLocalName();
	132	+ if (tag == null) {
	133	+ throw new MarshalException("Document implementation must " +
	134	+ "support DOM Level 2 and be namespace aware");
	135	+ }
	136	+ if (tag.equals("KeyInfo")) {
	137	+ return new DOMKeyInfo(element, null, getProvider());
	138	+ } else {
	139	+ throw new MarshalException("invalid KeyInfo tag: " + tag);
	140	+ }
	141	+ }
	142	+}

java/pkg/org/jcp/xml/dsig/internal/dom/DOMKeyName.class+0−0

Binary file not shown.

java/pkg/org/jcp/xml/dsig/internal/dom/DOMKeyName.java+93−0

@@ -0,0 +1,93 @@
	1	+/*
	2	+ * reserved comment block
	3	+ * DO NOT REMOVE OR ALTER!
	4	+ */
	5	+/*
	6	+ * Copyright 2005 The Apache Software Foundation.
	7	+ *
	8	+ * Licensed under the Apache License, Version 2.0 (the "License");
	9	+ * you may not use this file except in compliance with the License.
	10	+ * You may obtain a copy of the License at
	11	+ *
	12	+ * http://www.apache.org/licenses/LICENSE-2.0
	13	+ *
	14	+ * Unless required by applicable law or agreed to in writing, software
	15	+ * distributed under the License is distributed on an "AS IS" BASIS,
	16	+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
	17	+ * See the License for the specific language governing permissions and
	18	+ * limitations under the License.
	19	+ *
	20	+ */
	21	+/*
	22	+ * Copyright (c) 2005, 2008, Oracle and/or its affiliates. All rights reserved.
	23	+ */
	24	+/*
	25	+ * $Id: DOMKeyName.java,v 1.2 2008/07/24 15:20:32 mullan Exp $
	26	+ */
	27	+package org.jcp.xml.dsig.internal.dom;
	28	+
	29	+import javax.xml.crypto.*;
	30	+import javax.xml.crypto.dom.DOMCryptoContext;
	31	+import javax.xml.crypto.dsig.*;
	32	+import javax.xml.crypto.dsig.keyinfo.KeyName;
	33	+
	34	+import org.w3c.dom.Document;
	35	+import org.w3c.dom.Element;
	36	+import org.w3c.dom.Node;
	37	+
	38	+/**
	39	+ * DOM-based implementation of KeyName.
	40	+ *
	41	+ * @author Sean Mullan
	42	+ */
	43	+public final class DOMKeyName extends DOMStructure implements KeyName {
	44	+
	45	+ private final String name;
	46	+
	47	+ /**
	48	+ * Creates a <code>DOMKeyName</code>.
	49	+ *
	50	+ * @param name the name of the key identifier
	51	+ * @throws NullPointerException if <code>name</code> is null
	52	+ */
	53	+ public DOMKeyName(String name) {
	54	+ if (name == null) {
	55	+ throw new NullPointerException("name cannot be null");
	56	+ }
	57	+ this.name = name;
	58	+ }
	59	+
	60	+ /**
	61	+ * Creates a <code>DOMKeyName</code> from a KeyName element.
	62	+ *
	63	+ * @param knElem a KeyName element
	64	+ */
	65	+ public DOMKeyName(Element knElem) {
	66	+ name = knElem.getFirstChild().getNodeValue();
	67	+ }
	68	+
	69	+ public String getName() {
	70	+ return name;
	71	+ }
	72	+
	73	+ public void marshal(Node parent, String dsPrefix, DOMCryptoContext context)
	74	+ throws MarshalException {
	75	+ Document ownerDoc = DOMUtils.getOwnerDocument(parent);
	76	+ // prepend namespace prefix, if necessary
	77	+ Element knElem = DOMUtils.createElement
	78	+ (ownerDoc, "KeyName", XMLSignature.XMLNS, dsPrefix);
	79	+ knElem.appendChild(ownerDoc.createTextNode(name));
	80	+ parent.appendChild(knElem);
	81	+ }
	82	+
	83	+ public boolean equals(Object obj) {
	84	+ if (this == obj) {
	85	+ return true;
	86	+ }
	87	+ if (!(obj instanceof KeyName)) {
	88	+ return false;
	89	+ }
	90	+ KeyName okn = (KeyName) obj;
	91	+ return name.equals(okn.getName());
	92	+ }
	93	+}

java/pkg/org/jcp/xml/dsig/internal/dom/DOMKeyValue.class+0−0

Binary file not shown.

java/pkg/org/jcp/xml/dsig/internal/dom/DOMKeyValue.java+272−0

@@ -0,0 +1,272 @@
	1	+/*
	2	+ * reserved comment block
	3	+ * DO NOT REMOVE OR ALTER!
	4	+ */
	5	+/*
	6	+ * Copyright 2005 The Apache Software Foundation.
	7	+ *
	8	+ * Licensed under the Apache License, Version 2.0 (the "License");
	9	+ * you may not use this file except in compliance with the License.
	10	+ * You may obtain a copy of the License at
	11	+ *
	12	+ * http://www.apache.org/licenses/LICENSE-2.0
	13	+ *
	14	+ * Unless required by applicable law or agreed to in writing, software
	15	+ * distributed under the License is distributed on an "AS IS" BASIS,
	16	+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
	17	+ * See the License for the specific language governing permissions and
	18	+ * limitations under the License.
	19	+ *
	20	+ */
	21	+/*
	22	+ * Copyright (c) 2005, 2008, Oracle and/or its affiliates. All rights reserved.
	23	+ */
	24	+/*
	25	+ * $Id: DOMKeyValue.java,v 1.2 2008/07/24 15:20:32 mullan Exp $
	26	+ */
	27	+package org.jcp.xml.dsig.internal.dom;
	28	+
	29	+import javax.xml.crypto.*;
	30	+import javax.xml.crypto.dom.DOMCryptoContext;
	31	+import javax.xml.crypto.dsig.*;
	32	+import javax.xml.crypto.dsig.keyinfo.KeyValue;
	33	+
	34	+import java.security.KeyException;
	35	+import java.security.KeyFactory;
	36	+import java.security.NoSuchAlgorithmException;
	37	+import java.security.PublicKey;
	38	+import java.security.interfaces.DSAParams;
	39	+import java.security.interfaces.DSAPublicKey;
	40	+import java.security.interfaces.RSAPublicKey;
	41	+import java.security.spec.DSAPublicKeySpec;
	42	+import java.security.spec.InvalidKeySpecException;
	43	+import java.security.spec.KeySpec;
	44	+import java.security.spec.RSAPublicKeySpec;
	45	+import org.w3c.dom.Document;
	46	+import org.w3c.dom.Element;
	47	+import org.w3c.dom.Node;
	48	+
	49	+/**
	50	+ * DOM-based implementation of KeyValue.
	51	+ *
	52	+ * @author Sean Mullan
	53	+ */
	54	+public final class DOMKeyValue extends DOMStructure implements KeyValue {
	55	+
	56	+ private KeyFactory rsakf, dsakf;
	57	+ private PublicKey publicKey;
	58	+ private javax.xml.crypto.dom.DOMStructure externalPublicKey;
	59	+
	60	+ // DSAKeyValue CryptoBinaries
	61	+ private DOMCryptoBinary p, q, g, y, j, seed, pgen;
	62	+
	63	+ // RSAKeyValue CryptoBinaries
	64	+ private DOMCryptoBinary modulus, exponent;
	65	+
	66	+ public DOMKeyValue(PublicKey key) throws KeyException {
	67	+ if (key == null) {
	68	+ throw new NullPointerException("key cannot be null");
	69	+ }
	70	+ this.publicKey = key;
	71	+ if (key instanceof DSAPublicKey) {
	72	+ DSAPublicKey dkey = (DSAPublicKey) key;
	73	+ DSAParams params = dkey.getParams();
	74	+ p = new DOMCryptoBinary(params.getP());
	75	+ q = new DOMCryptoBinary(params.getQ());
	76	+ g = new DOMCryptoBinary(params.getG());
	77	+ y = new DOMCryptoBinary(dkey.getY());
	78	+ } else if (key instanceof RSAPublicKey) {
	79	+ RSAPublicKey rkey = (RSAPublicKey) key;
	80	+ exponent = new DOMCryptoBinary(rkey.getPublicExponent());
	81	+ modulus = new DOMCryptoBinary(rkey.getModulus());
	82	+ } else {
	83	+ throw new KeyException("unsupported key algorithm: " +
	84	+ key.getAlgorithm());
	85	+ }
	86	+ }
	87	+
	88	+ /**
	89	+ * Creates a <code>DOMKeyValue</code> from an element.
	90	+ *
	91	+ * @param kvElem a KeyValue element
	92	+ */
	93	+ public DOMKeyValue(Element kvElem) throws MarshalException {
	94	+ Element kvtElem = DOMUtils.getFirstChildElement(kvElem);
	95	+ if (kvtElem.getLocalName().equals("DSAKeyValue")) {
	96	+ publicKey = unmarshalDSAKeyValue(kvtElem);
	97	+ } else if (kvtElem.getLocalName().equals("RSAKeyValue")) {
	98	+ publicKey = unmarshalRSAKeyValue(kvtElem);
	99	+ } else {
	100	+ publicKey = null;
	101	+ externalPublicKey = new javax.xml.crypto.dom.DOMStructure(kvtElem);
	102	+ }
	103	+ }
	104	+
	105	+ public PublicKey getPublicKey() throws KeyException {
	106	+ if (publicKey == null) {
	107	+ throw new KeyException("can't convert KeyValue to PublicKey");
	108	+ } else {
	109	+ return publicKey;
	110	+ }
	111	+ }
	112	+
	113	+ public void marshal(Node parent, String dsPrefix, DOMCryptoContext context)
	114	+ throws MarshalException {
	115	+ Document ownerDoc = DOMUtils.getOwnerDocument(parent);
	116	+
	117	+ // create KeyValue element
	118	+ Element kvElem = DOMUtils.createElement
	119	+ (ownerDoc, "KeyValue", XMLSignature.XMLNS, dsPrefix);
	120	+ marshalPublicKey(kvElem, ownerDoc, dsPrefix, context);
	121	+
	122	+ parent.appendChild(kvElem);
	123	+ }
	124	+
	125	+ private void marshalPublicKey(Node parent, Document doc, String dsPrefix,
	126	+ DOMCryptoContext context) throws MarshalException {
	127	+ if (publicKey != null) {
	128	+ if (publicKey instanceof DSAPublicKey) {
	129	+ // create and append DSAKeyValue element
	130	+ marshalDSAPublicKey(parent, doc, dsPrefix, context);
	131	+ } else if (publicKey instanceof RSAPublicKey) {
	132	+ // create and append RSAKeyValue element
	133	+ marshalRSAPublicKey(parent, doc, dsPrefix, context);
	134	+ } else {
	135	+ throw new MarshalException(publicKey.getAlgorithm() +
	136	+ " public key algorithm not supported");
	137	+ }
	138	+ } else {
	139	+ parent.appendChild(externalPublicKey.getNode());
	140	+ }
	141	+ }
	142	+
	143	+ private void marshalDSAPublicKey(Node parent, Document doc,
	144	+ String dsPrefix, DOMCryptoContext context) throws MarshalException {
	145	+ Element dsaElem = DOMUtils.createElement
	146	+ (doc, "DSAKeyValue", XMLSignature.XMLNS, dsPrefix);
	147	+ // parameters J, Seed & PgenCounter are not included
	148	+ Element pElem = DOMUtils.createElement
	149	+ (doc, "P", XMLSignature.XMLNS, dsPrefix);
	150	+ Element qElem = DOMUtils.createElement
	151	+ (doc, "Q", XMLSignature.XMLNS, dsPrefix);
	152	+ Element gElem = DOMUtils.createElement
	153	+ (doc, "G", XMLSignature.XMLNS, dsPrefix);
	154	+ Element yElem = DOMUtils.createElement
	155	+ (doc, "Y", XMLSignature.XMLNS, dsPrefix);
	156	+ p.marshal(pElem, dsPrefix, context);
	157	+ q.marshal(qElem, dsPrefix, context);
	158	+ g.marshal(gElem, dsPrefix, context);
	159	+ y.marshal(yElem, dsPrefix, context);
	160	+ dsaElem.appendChild(pElem);
	161	+ dsaElem.appendChild(qElem);
	162	+ dsaElem.appendChild(gElem);
	163	+ dsaElem.appendChild(yElem);
	164	+ parent.appendChild(dsaElem);
	165	+ }
	166	+
	167	+ private void marshalRSAPublicKey(Node parent, Document doc,
	168	+ String dsPrefix, DOMCryptoContext context) throws MarshalException {
	169	+ Element rsaElem = DOMUtils.createElement
	170	+ (doc, "RSAKeyValue", XMLSignature.XMLNS, dsPrefix);
	171	+ Element modulusElem = DOMUtils.createElement
	172	+ (doc, "Modulus", XMLSignature.XMLNS, dsPrefix);
	173	+ Element exponentElem = DOMUtils.createElement
	174	+ (doc, "Exponent", XMLSignature.XMLNS, dsPrefix);
	175	+ modulus.marshal(modulusElem, dsPrefix, context);
	176	+ exponent.marshal(exponentElem, dsPrefix, context);
	177	+ rsaElem.appendChild(modulusElem);
	178	+ rsaElem.appendChild(exponentElem);
	179	+ parent.appendChild(rsaElem);
	180	+ }
	181	+
	182	+ private DSAPublicKey unmarshalDSAKeyValue(Element kvtElem)
	183	+ throws MarshalException {
	184	+ if (dsakf == null) {
	185	+ try {
	186	+ dsakf = KeyFactory.getInstance("DSA");
	187	+ } catch (NoSuchAlgorithmException e) {
	188	+ throw new RuntimeException("unable to create DSA KeyFactory: " +
	189	+ e.getMessage());
	190	+ }
	191	+ }
	192	+ Element curElem = DOMUtils.getFirstChildElement(kvtElem);
	193	+ // check for P and Q
	194	+ if (curElem.getLocalName().equals("P")) {
	195	+ p = new DOMCryptoBinary(curElem.getFirstChild());
	196	+ curElem = DOMUtils.getNextSiblingElement(curElem);
	197	+ q = new DOMCryptoBinary(curElem.getFirstChild());
	198	+ curElem = DOMUtils.getNextSiblingElement(curElem);
	199	+ }
	200	+ if (curElem.getLocalName().equals("G")) {
	201	+ g = new DOMCryptoBinary(curElem.getFirstChild());
	202	+ curElem = DOMUtils.getNextSiblingElement(curElem);
	203	+ }
	204	+ y = new DOMCryptoBinary(curElem.getFirstChild());
	205	+ curElem = DOMUtils.getNextSiblingElement(curElem);
	206	+ if (curElem != null && curElem.getLocalName().equals("J")) {
	207	+ j = new DOMCryptoBinary(curElem.getFirstChild());
	208	+ curElem = DOMUtils.getNextSiblingElement(curElem);
	209	+ }
	210	+ if (curElem != null) {
	211	+ seed = new DOMCryptoBinary(curElem.getFirstChild());
	212	+ curElem = DOMUtils.getNextSiblingElement(curElem);
	213	+ pgen = new DOMCryptoBinary(curElem.getFirstChild());
	214	+ }
	215	+ //@@@ do we care about j, pgenCounter or seed?
	216	+ DSAPublicKeySpec spec = new DSAPublicKeySpec
	217	+ (y.getBigNum(), p.getBigNum(), q.getBigNum(), g.getBigNum());
	218	+ return (DSAPublicKey) generatePublicKey(dsakf, spec);
	219	+ }
	220	+
	221	+ private RSAPublicKey unmarshalRSAKeyValue(Element kvtElem)
	222	+ throws MarshalException {
	223	+ if (rsakf == null) {
	224	+ try {
	225	+ rsakf = KeyFactory.getInstance("RSA");
	226	+ } catch (NoSuchAlgorithmException e) {
	227	+ throw new RuntimeException("unable to create RSA KeyFactory: " +
	228	+ e.getMessage());
	229	+ }
	230	+ }
	231	+ Element modulusElem = DOMUtils.getFirstChildElement(kvtElem);
	232	+ modulus = new DOMCryptoBinary(modulusElem.getFirstChild());
	233	+ Element exponentElem = DOMUtils.getNextSiblingElement(modulusElem);
	234	+ exponent = new DOMCryptoBinary(exponentElem.getFirstChild());
	235	+ RSAPublicKeySpec spec = new RSAPublicKeySpec
	236	+ (modulus.getBigNum(), exponent.getBigNum());
	237	+ return (RSAPublicKey) generatePublicKey(rsakf, spec);
	238	+ }
	239	+
	240	+ private PublicKey generatePublicKey(KeyFactory kf, KeySpec keyspec) {
	241	+ try {
	242	+ return kf.generatePublic(keyspec);
	243	+ } catch (InvalidKeySpecException e) {
	244	+ //@@@ should dump exception to log
	245	+ return null;
	246	+ }
	247	+ }
	248	+
	249	+ public boolean equals(Object obj) {
	250	+ if (this == obj) {
	251	+ return true;
	252	+ }
	253	+ if (!(obj instanceof KeyValue)) {
	254	+ return false;
	255	+ }
	256	+ try {
	257	+ KeyValue kv = (KeyValue) obj;
	258	+ if (publicKey == null ) {
	259	+ if (kv.getPublicKey() != null) {
	260	+ return false;
	261	+ }
	262	+ } else if (!publicKey.equals(kv.getPublicKey())) {
	263	+ return false;
	264	+ }
	265	+ } catch (KeyException ke) {
	266	+ // no practical way to determine if the keys are equal
	267	+ return false;
	268	+ }
	269	+
	270	+ return true;
	271	+ }
	272	+}

java/pkg/org/jcp/xml/dsig/internal/dom/DOMManifest.class+0−0

Binary file not shown.

java/pkg/org/jcp/xml/dsig/internal/dom/DOMManifest.java+138−0

@@ -0,0 +1,138 @@
	1	+/*
	2	+ * reserved comment block
	3	+ * DO NOT REMOVE OR ALTER!
	4	+ */
	5	+/*
	6	+ * Copyright 2005 The Apache Software Foundation.
	7	+ *
	8	+ * Licensed under the Apache License, Version 2.0 (the "License");
	9	+ * you may not use this file except in compliance with the License.
	10	+ * You may obtain a copy of the License at
	11	+ *
	12	+ * http://www.apache.org/licenses/LICENSE-2.0
	13	+ *
	14	+ * Unless required by applicable law or agreed to in writing, software
	15	+ * distributed under the License is distributed on an "AS IS" BASIS,
	16	+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
	17	+ * See the License for the specific language governing permissions and
	18	+ * limitations under the License.
	19	+ *
	20	+ */
	21	+/*
	22	+ * Copyright (c) 2005, 2008, Oracle and/or its affiliates. All rights reserved.
	23	+ */
	24	+/*
	25	+ * $Id: DOMManifest.java,v 1.2 2008/07/24 15:20:32 mullan Exp $
	26	+ */
	27	+package org.jcp.xml.dsig.internal.dom;
	28	+
	29	+import javax.xml.crypto.*;
	30	+import javax.xml.crypto.dom.DOMCryptoContext;
	31	+import javax.xml.crypto.dsig.*;
	32	+
	33	+import java.security.Provider;
	34	+import java.util.*;
	35	+import org.w3c.dom.Document;
	36	+import org.w3c.dom.Element;
	37	+import org.w3c.dom.Node;
	38	+
	39	+/**
	40	+ * DOM-based implementation of Manifest.
	41	+ *
	42	+ * @author Sean Mullan
	43	+ */
	44	+public final class DOMManifest extends DOMStructure implements Manifest {
	45	+
	46	+ private final List references;
	47	+ private final String id;
	48	+
	49	+ /**
	50	+ * Creates a <code>DOMManifest</code> containing the specified
	51	+ * list of {@link Reference}s and optional id.
	52	+ *
	53	+ * @param references a list of one or more <code>Reference</code>s. The list
	54	+ * is defensively copied to protect against subsequent modification.
	55	+ * @param id the id (may be <code>null</code>
	56	+ * @throws NullPointerException if <code>references</code> is
	57	+ * <code>null</code>
	58	+ * @throws IllegalArgumentException if <code>references</code> is empty
	59	+ * @throws ClassCastException if <code>references</code> contains any
	60	+ * entries that are not of type {@link Reference}
	61	+ */
	62	+ public DOMManifest(List references, String id) {
	63	+ if (references == null) {
	64	+ throw new NullPointerException("references cannot be null");
	65	+ }
	66	+ List refCopy = new ArrayList(references);
	67	+ if (refCopy.isEmpty()) {
	68	+ throw new IllegalArgumentException("list of references must " +
	69	+ "contain at least one entry");
	70	+ }
	71	+ for (int i = 0, size = refCopy.size(); i < size; i++) {
	72	+ if (!(refCopy.get(i) instanceof Reference)) {
	73	+ throw new ClassCastException
	74	+ ("references["+i+"] is not a valid type");
	75	+ }
	76	+ }
	77	+ this.references = Collections.unmodifiableList(refCopy);
	78	+ this.id = id;
	79	+ }
	80	+
	81	+ /**
	82	+ * Creates a <code>DOMManifest</code> from an element.
	83	+ *
	84	+ * @param manElem a Manifest element
	85	+ */
	86	+ public DOMManifest(Element manElem, XMLCryptoContext context,
	87	+ Provider provider) throws MarshalException {
	88	+ this.id = DOMUtils.getAttributeValue(manElem, "Id");
	89	+ Element refElem = DOMUtils.getFirstChildElement(manElem);
	90	+ List refs = new ArrayList();
	91	+ while (refElem != null) {
	92	+ refs.add(new DOMReference(refElem, context, provider));
	93	+ refElem = DOMUtils.getNextSiblingElement(refElem);
	94	+ }
	95	+ this.references = Collections.unmodifiableList(refs);
	96	+ }
	97	+
	98	+ public String getId() {
	99	+ return id;
	100	+ }
	101	+
	102	+ public List getReferences() {
	103	+ return references;
	104	+ }
	105	+
	106	+ public void marshal(Node parent, String dsPrefix, DOMCryptoContext context)
	107	+ throws MarshalException {
	108	+ Document ownerDoc = DOMUtils.getOwnerDocument(parent);
	109	+
	110	+ Element manElem = DOMUtils.createElement
	111	+ (ownerDoc, "Manifest", XMLSignature.XMLNS, dsPrefix);
	112	+
	113	+ DOMUtils.setAttributeID(manElem, "Id", id);
	114	+
	115	+ // add references
	116	+ for (int i = 0, size = references.size(); i < size; i++) {
	117	+ DOMReference ref = (DOMReference) references.get(i);
	118	+ ref.marshal(manElem, dsPrefix, context);
	119	+ }
	120	+ parent.appendChild(manElem);
	121	+ }
	122	+
	123	+ public boolean equals(Object o) {
	124	+ if (this == o) {
	125	+ return true;
	126	+ }
	127	+
	128	+ if (!(o instanceof Manifest)) {
	129	+ return false;
	130	+ }
	131	+ Manifest oman = (Manifest) o;
	132	+
	133	+ boolean idsEqual = (id == null ? oman.getId() == null :
	134	+ id.equals(oman.getId()));
	135	+
	136	+ return (idsEqual && references.equals(oman.getReferences()));
	137	+ }
	138	+}

java/pkg/org/jcp/xml/dsig/internal/dom/DOMPGPData.class+0−0

Binary file not shown.

java/pkg/org/jcp/xml/dsig/internal/dom/DOMPGPData.java+254−0

@@ -0,0 +1,254 @@
	1	+/*
	2	+ * reserved comment block
	3	+ * DO NOT REMOVE OR ALTER!
	4	+ */
	5	+/*
	6	+ * Copyright 2005 The Apache Software Foundation.
	7	+ *
	8	+ * Licensed under the Apache License, Version 2.0 (the "License");
	9	+ * you may not use this file except in compliance with the License.
	10	+ * You may obtain a copy of the License at
	11	+ *
	12	+ * http://www.apache.org/licenses/LICENSE-2.0
	13	+ *
	14	+ * Unless required by applicable law or agreed to in writing, software
	15	+ * distributed under the License is distributed on an "AS IS" BASIS,
	16	+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
	17	+ * See the License for the specific language governing permissions and
	18	+ * limitations under the License.
	19	+ *
	20	+ */
	21	+/*
	22	+ * Copyright (c) 2005, 2008, Oracle and/or its affiliates. All rights reserved.
	23	+ */
	24	+/*
	25	+ * $Id: DOMPGPData.java,v 1.2 2008/07/24 15:20:32 mullan Exp $
	26	+ */
	27	+package org.jcp.xml.dsig.internal.dom;
	28	+
	29	+import java.util.*;
	30	+import javax.xml.crypto.*;
	31	+import javax.xml.crypto.dom.DOMCryptoContext;
	32	+import javax.xml.crypto.dsig.*;
	33	+import javax.xml.crypto.dsig.keyinfo.PGPData;
	34	+import org.w3c.dom.Document;
	35	+import org.w3c.dom.Element;
	36	+import org.w3c.dom.Node;
	37	+import org.w3c.dom.NodeList;
	38	+
	39	+import com.sun.org.apache.xml.internal.security.exceptions.Base64DecodingException;
	40	+import com.sun.org.apache.xml.internal.security.utils.Base64;
	41	+
	42	+/**
	43	+ * DOM-based implementation of PGPData.
	44	+ *
	45	+ * @author Sean Mullan
	46	+ */
	47	+public final class DOMPGPData extends DOMStructure implements PGPData {
	48	+
	49	+ private final byte[] keyId;
	50	+ private final byte[] keyPacket;
	51	+ private final List externalElements;
	52	+
	53	+ /**
	54	+ * Creates a <code>DOMPGPData</code> containing the specified key packet.
	55	+ * and optional list of external elements.
	56	+ *
	57	+ * @param keyPacket a PGP Key Material Packet as defined in section 5.5 of
	58	+ * <a href="http://www.ietf.org/rfc/rfc2440.txt"/>RFC 2440</a>. The
	59	+ * array is cloned to prevent subsequent modification.
	60	+ * @param other a list of {@link XMLStructure}s representing elements from
	61	+ * an external namespace. The list is defensively copied to prevent
	62	+ * subsequent modification. May be <code>null</code> or empty.
	63	+ * @throws NullPointerException if <code>keyPacket</code> is
	64	+ * <code>null</code>
	65	+ * @throws IllegalArgumentException if the key packet is not in the
	66	+ * correct format
	67	+ * @throws ClassCastException if <code>other</code> contains any
	68	+ * entries that are not of type {@link XMLStructure}
	69	+ */
	70	+ public DOMPGPData(byte[] keyPacket, List other) {
	71	+ if (keyPacket == null) {
	72	+ throw new NullPointerException("keyPacket cannot be null");
	73	+ }
	74	+ if (other == null \|\| other.isEmpty()) {
	75	+ this.externalElements = Collections.EMPTY_LIST;
	76	+ } else {
	77	+ List otherCopy = new ArrayList(other);
	78	+ for (int i = 0, size = otherCopy.size(); i < size; i++) {
	79	+ if (!(otherCopy.get(i) instanceof XMLStructure)) {
	80	+ throw new ClassCastException
	81	+ ("other["+i+"] is not a valid PGPData type");
	82	+ }
	83	+ }
	84	+ this.externalElements = Collections.unmodifiableList(otherCopy);
	85	+ }
	86	+ this.keyPacket = (byte []) keyPacket.clone();
	87	+ checkKeyPacket(keyPacket);
	88	+ this.keyId = null;
	89	+ }
	90	+
	91	+ /**
	92	+ * Creates a <code>DOMPGPData</code> containing the specified key id and
	93	+ * optional key packet and list of external elements.
	94	+ *
	95	+ * @param keyId a PGP public key id as defined in section 11.2 of
	96	+ * <a href="http://www.ietf.org/rfc/rfc2440.txt"/>RFC 2440</a>. The
	97	+ * array is cloned to prevent subsequent modification.
	98	+ * @param keyPacket a PGP Key Material Packet as defined in section 5.5 of
	99	+ * <a href="http://www.ietf.org/rfc/rfc2440.txt"/>RFC 2440</a> (may
	100	+ * be <code>null</code>). The array is cloned to prevent subsequent
	101	+ * modification.
	102	+ * @param other a list of {@link XMLStructure}s representing elements from
	103	+ * an external namespace. The list is defensively copied to prevent
	104	+ * subsequent modification. May be <code>null</code> or empty.
	105	+ * @throws NullPointerException if <code>keyId</code> is <code>null</code>
	106	+ * @throws IllegalArgumentException if the key id or packet is not in the
	107	+ * correct format
	108	+ * @throws ClassCastException if <code>other</code> contains any
	109	+ * entries that are not of type {@link XMLStructure}
	110	+ */
	111	+ public DOMPGPData(byte[] keyId, byte[] keyPacket, List other) {
	112	+ if (keyId == null) {
	113	+ throw new NullPointerException("keyId cannot be null");
	114	+ }
	115	+ // key ids must be 8 bytes
	116	+ if (keyId.length != 8) {
	117	+ throw new IllegalArgumentException("keyId must be 8 bytes long");
	118	+ }
	119	+ if (other == null \|\| other.isEmpty()) {
	120	+ this.externalElements = Collections.EMPTY_LIST;
	121	+ } else {
	122	+ List otherCopy = new ArrayList(other);
	123	+ for (int i = 0, size = otherCopy.size(); i < size; i++) {
	124	+ if (!(otherCopy.get(i) instanceof XMLStructure)) {
	125	+ throw new ClassCastException
	126	+ ("other["+i+"] is not a valid PGPData type");
	127	+ }
	128	+ }
	129	+ this.externalElements = Collections.unmodifiableList(otherCopy);
	130	+ }
	131	+ this.keyId = (byte []) keyId.clone();
	132	+ this.keyPacket = keyPacket == null ? null : (byte []) keyPacket.clone();
	133	+ if (keyPacket != null) {
	134	+ checkKeyPacket(keyPacket);
	135	+ }
	136	+ }
	137	+
	138	+ /**
	139	+ * Creates a <code>DOMPGPData</code> from an element.
	140	+ *
	141	+ * @param pdElem a PGPData element
	142	+ */
	143	+ public DOMPGPData(Element pdElem) throws MarshalException {
	144	+ // get all children nodes
	145	+ byte[] keyId = null;
	146	+ byte[] keyPacket = null;
	147	+ NodeList nl = pdElem.getChildNodes();
	148	+ int length = nl.getLength();
	149	+ List other = new ArrayList(length);
	150	+ for (int x = 0; x < length; x++) {
	151	+ Node n = nl.item(x);
	152	+ if (n.getNodeType() == Node.ELEMENT_NODE) {
	153	+ Element childElem = (Element) n;
	154	+ String localName = childElem.getLocalName();
	155	+ try {
	156	+ if (localName.equals("PGPKeyID")) {
	157	+ keyId = Base64.decode(childElem);
	158	+ } else if (localName.equals("PGPKeyPacket")){
	159	+ keyPacket = Base64.decode(childElem);
	160	+ } else {
	161	+ other.add
	162	+ (new javax.xml.crypto.dom.DOMStructure(childElem));
	163	+ }
	164	+ } catch (Base64DecodingException bde) {
	165	+ throw new MarshalException(bde);
	166	+ }
	167	+ }
	168	+ }
	169	+ this.keyId = keyId;
	170	+ this.keyPacket = keyPacket;
	171	+ this.externalElements = Collections.unmodifiableList(other);
	172	+ }
	173	+
	174	+ public byte[] getKeyId() {
	175	+ return (keyId == null ? null : (byte []) keyId.clone());
	176	+ }
	177	+
	178	+ public byte[] getKeyPacket() {
	179	+ return (keyPacket == null ? null : (byte []) keyPacket.clone());
	180	+ }
	181	+
	182	+ public List getExternalElements() {
	183	+ return externalElements;
	184	+ }
	185	+
	186	+ public void marshal(Node parent, String dsPrefix, DOMCryptoContext context)
	187	+ throws MarshalException {
	188	+ Document ownerDoc = DOMUtils.getOwnerDocument(parent);
	189	+
	190	+ Element pdElem = DOMUtils.createElement
	191	+ (ownerDoc, "PGPData", XMLSignature.XMLNS, dsPrefix);
	192	+
	193	+ // create and append PGPKeyID element
	194	+ if (keyId != null) {
	195	+ Element keyIdElem = DOMUtils.createElement
	196	+ (ownerDoc, "PGPKeyID", XMLSignature.XMLNS, dsPrefix);
	197	+ keyIdElem.appendChild
	198	+ (ownerDoc.createTextNode(Base64.encode(keyId)));
	199	+ pdElem.appendChild(keyIdElem);
	200	+ }
	201	+
	202	+ // create and append PGPKeyPacket element
	203	+ if (keyPacket != null) {
	204	+ Element keyPktElem = DOMUtils.createElement
	205	+ (ownerDoc, "PGPKeyPacket", XMLSignature.XMLNS, dsPrefix);
	206	+ keyPktElem.appendChild
	207	+ (ownerDoc.createTextNode(Base64.encode(keyPacket)));
	208	+ pdElem.appendChild(keyPktElem);
	209	+ }
	210	+
	211	+ // create and append any elements
	212	+ for (int i = 0, size = externalElements.size(); i < size; i++) {
	213	+ DOMUtils.appendChild(pdElem, ((javax.xml.crypto.dom.DOMStructure)
	214	+ externalElements.get(i)).getNode());
	215	+ }
	216	+
	217	+ parent.appendChild(pdElem);
	218	+ }
	219	+
	220	+ /**
	221	+ * We assume packets use the new format packet syntax, as specified in
	222	+ * section 4 of RFC 2440.
	223	+ *
	224	+ * This method only checks if the packet contains a valid tag. The
	225	+ * contents of the packet should be checked by the application.
	226	+ */
	227	+ private void checkKeyPacket(byte[] keyPacket) {
	228	+ // length must be at least 3 (one byte for tag, one byte for length,
	229	+ // and minimally one byte of content
	230	+ if (keyPacket.length < 3) {
	231	+ throw new IllegalArgumentException("keypacket must be at least " +
	232	+ "3 bytes long");
	233	+ }
	234	+
	235	+ int tag = keyPacket[0];
	236	+ // first bit must be set
	237	+ if ((tag & 128) != 128) {
	238	+ throw new IllegalArgumentException("keypacket tag is invalid: " +
	239	+ "bit 7 is not set");
	240	+ }
	241	+ // make sure using new format
	242	+ if ((tag & 64) != 64) {
	243	+ throw new IllegalArgumentException("old keypacket tag format is " +
	244	+ "unsupported");
	245	+ }
	246	+
	247	+ // tag value must be 6, 14, 5 or 7
	248	+ if (((tag & 6) != 6) && ((tag & 14) != 14) &&
	249	+ ((tag & 5) != 5) && ((tag & 7) != 7)) {
	250	+ throw new IllegalArgumentException("keypacket tag is invalid: " +
	251	+ "must be 6, 14, 5, or 7");
	252	+ }
	253	+ }
	254	+}

java/pkg/org/jcp/xml/dsig/internal/dom/DOMReference$1.class+0−0

Binary file not shown.

java/pkg/org/jcp/xml/dsig/internal/dom/DOMReference$2.class+0−0

Binary file not shown.

java/pkg/org/jcp/xml/dsig/internal/dom/DOMReference.class+0−0

Binary file not shown.

java/pkg/org/jcp/xml/dsig/internal/dom/DOMReference.java+555−0

@@ -0,0 +1,555 @@
	1	+/*
	2	+ * reserved comment block
	3	+ * DO NOT REMOVE OR ALTER!
	4	+ */
	5	+/*
	6	+ * Copyright 2005 The Apache Software Foundation.
	7	+ *
	8	+ * Licensed under the Apache License, Version 2.0 (the "License");
	9	+ * you may not use this file except in compliance with the License.
	10	+ * You may obtain a copy of the License at
	11	+ *
	12	+ * http://www.apache.org/licenses/LICENSE-2.0
	13	+ *
	14	+ * Unless required by applicable law or agreed to in writing, software
	15	+ * distributed under the License is distributed on an "AS IS" BASIS,
	16	+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
	17	+ * See the License for the specific language governing permissions and
	18	+ * limitations under the License.
	19	+ *
	20	+ */
	21	+/*
	22	+ * Copyright (c) 2005, Oracle and/or its affiliates. All rights reserved.
	23	+ */
	24	+/*
	25	+ * ===========================================================================
	26	+ *
	27	+ * (C) Copyright IBM Corp. 2003 All Rights Reserved.
	28	+ *
	29	+ * ===========================================================================
	30	+ */
	31	+/*
	32	+ * $Id: DOMReference.java,v 1.2 2008/07/24 15:20:32 mullan Exp $
	33	+ */
	34	+package org.jcp.xml.dsig.internal.dom;
	35	+
	36	+import javax.xml.crypto.*;
	37	+import javax.xml.crypto.dsig.*;
	38	+import javax.xml.crypto.dom.DOMCryptoContext;
	39	+import javax.xml.crypto.dom.DOMURIReference;
	40	+
	41	+import java.io.*;
	42	+import java.net.URI;
	43	+import java.net.URISyntaxException;
	44	+import java.security.*;
	45	+import java.util.*;
	46	+import java.util.logging.Level;
	47	+import java.util.logging.Logger;
	48	+import org.w3c.dom.Attr;
	49	+import org.w3c.dom.Document;
	50	+import org.w3c.dom.Element;
	51	+import org.w3c.dom.Node;
	52	+
	53	+import org.jcp.xml.dsig.internal.DigesterOutputStream;
	54	+import com.sun.org.apache.xml.internal.security.exceptions.Base64DecodingException;
	55	+import com.sun.org.apache.xml.internal.security.signature.XMLSignatureInput;
	56	+import com.sun.org.apache.xml.internal.security.utils.Base64;
	57	+import com.sun.org.apache.xml.internal.security.utils.UnsyncBufferedOutputStream;
	58	+
	59	+/**
	60	+ * DOM-based implementation of Reference.
	61	+ *
	62	+ * @author Sean Mullan
	63	+ * @author Joyce Leung
	64	+ */
	65	+public final class DOMReference extends DOMStructure
	66	+ implements Reference, DOMURIReference {
	67	+
	68	+ /**
	69	+ * Look up useC14N11 system property. If true, an explicit C14N11 transform
	70	+ * will be added if necessary when generating the signature. See section
	71	+ * 3.1.1 of http://www.w3.org/2007/xmlsec/Drafts/xmldsig-core/ for more info.
	72	+ *
	73	+ * If true, overrides the same property if set in the XMLSignContext.
	74	+ */
	75	+ private static boolean useC14N11 =
	76	+ AccessController.doPrivileged(new PrivilegedAction<Boolean>() {
	77	+ public Boolean run() {
	78	+ return Boolean.getBoolean
	79	+ ("com.sun.org.apache.xml.internal.security.useC14N11");
	80	+ }
	81	+ });
	82	+
	83	+ private static Logger log = Logger.getLogger("org.jcp.xml.dsig.internal.dom");
	84	+
	85	+ private final DigestMethod digestMethod;
	86	+ private final String id;
	87	+ private final List transforms;
	88	+ private List allTransforms;
	89	+ private final Data appliedTransformData;
	90	+ private Attr here;
	91	+ private final String uri;
	92	+ private final String type;
	93	+ private byte[] digestValue;
	94	+ private byte[] calcDigestValue;
	95	+ private Element refElem;
	96	+ private boolean digested = false;
	97	+ private boolean validated = false;
	98	+ private boolean validationStatus;
	99	+ private Data derefData;
	100	+ private InputStream dis;
	101	+ private MessageDigest md;
	102	+ private Provider provider;
	103	+
	104	+ /**
	105	+ * Creates a <code>Reference</code> from the specified parameters.
	106	+ *
	107	+ * @param uri the URI (may be null)
	108	+ * @param type the type (may be null)
	109	+ * @param dm the digest method
	110	+ * @param transforms a list of {@link Transform}s. The list
	111	+ * is defensively copied to protect against subsequent modification.
	112	+ * May be <code>null</code> or empty.
	113	+ * @param id the reference ID (may be <code>null</code>)
	114	+ * @return a <code>Reference</code>
	115	+ * @throws NullPointerException if <code>dm</code> is <code>null</code>
	116	+ * @throws ClassCastException if any of the <code>transforms</code> are
	117	+ * not of type <code>Transform</code>
	118	+ */
	119	+ public DOMReference(String uri, String type, DigestMethod dm,
	120	+ List transforms, String id, Provider provider) {
	121	+ this(uri, type, dm, null, null, transforms, id, null, provider);
	122	+ }
	123	+
	124	+ public DOMReference(String uri, String type, DigestMethod dm,
	125	+ List appliedTransforms, Data result, List transforms, String id,
	126	+ Provider provider) {
	127	+ this(uri, type, dm, appliedTransforms,
	128	+ result, transforms, id, null, provider);
	129	+ }
	130	+
	131	+ public DOMReference(String uri, String type, DigestMethod dm,
	132	+ List appliedTransforms, Data result, List transforms, String id,
	133	+ byte[] digestValue, Provider provider) {
	134	+ if (dm == null) {
	135	+ throw new NullPointerException("DigestMethod must be non-null");
	136	+ }
	137	+ this.allTransforms = new ArrayList();
	138	+ if (appliedTransforms != null) {
	139	+ List transformsCopy = new ArrayList(appliedTransforms);
	140	+ for (int i = 0, size = transformsCopy.size(); i < size; i++) {
	141	+ if (!(transformsCopy.get(i) instanceof Transform)) {
	142	+ throw new ClassCastException
	143	+ ("appliedTransforms["+i+"] is not a valid type");
	144	+ }
	145	+ }
	146	+ this.allTransforms = transformsCopy;
	147	+ }
	148	+ if (transforms == null) {
	149	+ this.transforms = Collections.EMPTY_LIST;
	150	+ } else {
	151	+ List transformsCopy = new ArrayList(transforms);
	152	+ for (int i = 0, size = transformsCopy.size(); i < size; i++) {
	153	+ if (!(transformsCopy.get(i) instanceof Transform)) {
	154	+ throw new ClassCastException
	155	+ ("transforms["+i+"] is not a valid type");
	156	+ }
	157	+ }
	158	+ this.transforms = transformsCopy;
	159	+ this.allTransforms.addAll(transformsCopy);
	160	+ }
	161	+ this.digestMethod = dm;
	162	+ this.uri = uri;
	163	+ if ((uri != null) && (!uri.equals(""))) {
	164	+ try {
	165	+ new URI(uri);
	166	+ } catch (URISyntaxException e) {
	167	+ throw new IllegalArgumentException(e.getMessage());
	168	+ }
	169	+ }
	170	+ this.type = type;
	171	+ this.id = id;
	172	+ if (digestValue != null) {
	173	+ this.digestValue = (byte[]) digestValue.clone();
	174	+ this.digested = true;
	175	+ }
	176	+ this.appliedTransformData = result;
	177	+ this.provider = provider;
	178	+ }
	179	+
	180	+ /**
	181	+ * Creates a <code>DOMReference</code> from an element.
	182	+ *
	183	+ * @param refElem a Reference element
	184	+ */
	185	+ public DOMReference(Element refElem, XMLCryptoContext context,
	186	+ Provider provider) throws MarshalException {
	187	+ // unmarshal Transforms, if specified
	188	+ Element nextSibling = DOMUtils.getFirstChildElement(refElem);
	189	+ List transforms = new ArrayList(5);
	190	+ if (nextSibling.getLocalName().equals("Transforms")) {
	191	+ Element transformElem = DOMUtils.getFirstChildElement(nextSibling);
	192	+ while (transformElem != null) {
	193	+ transforms.add
	194	+ (new DOMTransform(transformElem, context, provider));
	195	+ transformElem = DOMUtils.getNextSiblingElement(transformElem);
	196	+ }
	197	+ nextSibling = DOMUtils.getNextSiblingElement(nextSibling);
	198	+ }
	199	+
	200	+ // unmarshal DigestMethod
	201	+ Element dmElem = nextSibling;
	202	+ this.digestMethod = DOMDigestMethod.unmarshal(dmElem);
	203	+
	204	+ // unmarshal DigestValue
	205	+ try {
	206	+ Element dvElem = DOMUtils.getNextSiblingElement(dmElem);
	207	+ this.digestValue = Base64.decode(dvElem);
	208	+ } catch (Base64DecodingException bde) {
	209	+ throw new MarshalException(bde);
	210	+ }
	211	+
	212	+ // unmarshal attributes
	213	+ this.uri = DOMUtils.getAttributeValue(refElem, "URI");
	214	+ this.id = DOMUtils.getAttributeValue(refElem, "Id");
	215	+
	216	+ this.type = DOMUtils.getAttributeValue(refElem, "Type");
	217	+ this.here = refElem.getAttributeNodeNS(null, "URI");
	218	+ this.refElem = refElem;
	219	+ this.transforms = transforms;
	220	+ this.allTransforms = transforms;
	221	+ this.appliedTransformData = null;
	222	+ this.provider = provider;
	223	+ }
	224	+
	225	+ public DigestMethod getDigestMethod() {
	226	+ return digestMethod;
	227	+ }
	228	+
	229	+ public String getId() {
	230	+ return id;
	231	+ }
	232	+
	233	+ public String getURI() {
	234	+ return uri;
	235	+ }
	236	+
	237	+ public String getType() {
	238	+ return type;
	239	+ }
	240	+
	241	+ public List getTransforms() {
	242	+ return Collections.unmodifiableList(allTransforms);
	243	+ }
	244	+
	245	+ public byte[] getDigestValue() {
	246	+ return (digestValue == null ? null : (byte[]) digestValue.clone());
	247	+ }
	248	+
	249	+ public byte[] getCalculatedDigestValue() {
	250	+ return (calcDigestValue == null ? null
	251	+ : (byte[]) calcDigestValue.clone());
	252	+ }
	253	+
	254	+ public void marshal(Node parent, String dsPrefix, DOMCryptoContext context)
	255	+ throws MarshalException {
	256	+ if (log.isLoggable(Level.FINE)) {
	257	+ log.log(Level.FINE, "Marshalling Reference");
	258	+ }
	259	+ Document ownerDoc = DOMUtils.getOwnerDocument(parent);
	260	+
	261	+ refElem = DOMUtils.createElement
	262	+ (ownerDoc, "Reference", XMLSignature.XMLNS, dsPrefix);
	263	+
	264	+ // set attributes
	265	+ DOMUtils.setAttributeID(refElem, "Id", id);
	266	+ DOMUtils.setAttribute(refElem, "URI", uri);
	267	+ DOMUtils.setAttribute(refElem, "Type", type);
	268	+
	269	+ // create and append Transforms element
	270	+ if (!allTransforms.isEmpty()) {
	271	+ Element transformsElem = DOMUtils.createElement
	272	+ (ownerDoc, "Transforms", XMLSignature.XMLNS, dsPrefix);
	273	+ refElem.appendChild(transformsElem);
	274	+ for (int i = 0, size = allTransforms.size(); i < size; i++) {
	275	+ DOMStructure transform =
	276	+ (DOMStructure) allTransforms.get(i);
	277	+ transform.marshal(transformsElem, dsPrefix, context);
	278	+ }
	279	+ }
	280	+
	281	+ // create and append DigestMethod element
	282	+ ((DOMDigestMethod) digestMethod).marshal(refElem, dsPrefix, context);
	283	+
	284	+ // create and append DigestValue element
	285	+ if (log.isLoggable(Level.FINE)) {
	286	+ log.log(Level.FINE, "Adding digestValueElem");
	287	+ }
	288	+ Element digestValueElem = DOMUtils.createElement
	289	+ (ownerDoc, "DigestValue", XMLSignature.XMLNS, dsPrefix);
	290	+ if (digestValue != null) {
	291	+ digestValueElem.appendChild
	292	+ (ownerDoc.createTextNode(Base64.encode(digestValue)));
	293	+ }
	294	+ refElem.appendChild(digestValueElem);
	295	+
	296	+ parent.appendChild(refElem);
	297	+ here = refElem.getAttributeNodeNS(null, "URI");
	298	+ }
	299	+
	300	+ public void digest(XMLSignContext signContext)
	301	+ throws XMLSignatureException {
	302	+ Data data = null;
	303	+ if (appliedTransformData == null) {
	304	+ data = dereference(signContext);
	305	+ } else {
	306	+ data = appliedTransformData;
	307	+ }
	308	+ digestValue = transform(data, signContext);
	309	+
	310	+ // insert digestValue into DigestValue element
	311	+ String encodedDV = Base64.encode(digestValue);
	312	+ if (log.isLoggable(Level.FINE)) {
	313	+ log.log(Level.FINE, "Reference object uri = " + uri);
	314	+ }
	315	+ Element digestElem = DOMUtils.getLastChildElement(refElem);
	316	+ if (digestElem == null) {
	317	+ throw new XMLSignatureException("DigestValue element expected");
	318	+ }
	319	+ DOMUtils.removeAllChildren(digestElem);
	320	+ digestElem.appendChild
	321	+ (refElem.getOwnerDocument().createTextNode(encodedDV));
	322	+
	323	+ digested = true;
	324	+ if (log.isLoggable(Level.FINE)) {
	325	+ log.log(Level.FINE, "Reference digesting completed");
	326	+ }
	327	+ }
	328	+
	329	+ public boolean validate(XMLValidateContext validateContext)
	330	+ throws XMLSignatureException {
	331	+ if (validateContext == null) {
	332	+ throw new NullPointerException("validateContext cannot be null");
	333	+ }
	334	+ if (validated) {
	335	+ return validationStatus;
	336	+ }
	337	+ Data data = dereference(validateContext);
	338	+ calcDigestValue = transform(data, validateContext);
	339	+
	340	+ if (log.isLoggable(Level.FINE)) {
	341	+ log.log(Level.FINE, "Expected digest: "
	342	+ + Base64.encode(digestValue));
	343	+ log.log(Level.FINE, "Actual digest: "
	344	+ + Base64.encode(calcDigestValue));
	345	+ }
	346	+
	347	+ validationStatus = Arrays.equals(digestValue, calcDigestValue);
	348	+ validated = true;
	349	+ return validationStatus;
	350	+ }
	351	+
	352	+ public Data getDereferencedData() {
	353	+ return derefData;
	354	+ }
	355	+
	356	+ public InputStream getDigestInputStream() {
	357	+ return dis;
	358	+ }
	359	+
	360	+ private Data dereference(XMLCryptoContext context)
	361	+ throws XMLSignatureException {
	362	+ Data data = null;
	363	+
	364	+ // use user-specified URIDereferencer if specified; otherwise use deflt
	365	+ URIDereferencer deref = context.getURIDereferencer();
	366	+ if (deref == null) {
	367	+ deref = DOMURIDereferencer.INSTANCE;
	368	+ }
	369	+ try {
	370	+ data = deref.dereference(this, context);
	371	+ if (log.isLoggable(Level.FINE)) {
	372	+ log.log(Level.FINE, "URIDereferencer class name: "
	373	+ + deref.getClass().getName());
	374	+ log.log(Level.FINE, "Data class name: "
	375	+ + data.getClass().getName());
	376	+ }
	377	+ } catch (URIReferenceException ure) {
	378	+ throw new XMLSignatureException(ure);
	379	+ }
	380	+
	381	+ return data;
	382	+ }
	383	+
	384	+ private byte[] transform(Data dereferencedData,
	385	+ XMLCryptoContext context) throws XMLSignatureException {
	386	+
	387	+ if (md == null) {
	388	+ try {
	389	+ md = MessageDigest.getInstance
	390	+ (((DOMDigestMethod) digestMethod).getMessageDigestAlgorithm());
	391	+ } catch (NoSuchAlgorithmException nsae) {
	392	+ throw new XMLSignatureException(nsae);
	393	+ }
	394	+ }
	395	+ md.reset();
	396	+ DigesterOutputStream dos;
	397	+ Boolean cache = (Boolean)
	398	+ context.getProperty("javax.xml.crypto.dsig.cacheReference");
	399	+ if (cache != null && cache.booleanValue() == true) {
	400	+ this.derefData = copyDerefData(dereferencedData);
	401	+ dos = new DigesterOutputStream(md, true);
	402	+ } else {
	403	+ dos = new DigesterOutputStream(md);
	404	+ }
	405	+ OutputStream os = new UnsyncBufferedOutputStream(dos);
	406	+ Data data = dereferencedData;
	407	+ for (int i = 0, size = transforms.size(); i < size; i++) {
	408	+ DOMTransform transform = (DOMTransform) transforms.get(i);
	409	+ try {
	410	+ if (i < size - 1) {
	411	+ data = transform.transform(data, context);
	412	+ } else {
	413	+ data = transform.transform(data, context, os);
	414	+ }
	415	+ } catch (TransformException te) {
	416	+ throw new XMLSignatureException(te);
	417	+ }
	418	+ }
	419	+
	420	+ try {
	421	+ if (data != null) {
	422	+ XMLSignatureInput xi;
	423	+ // explicitly use C14N 1.1 when generating signature
	424	+ // first check system property, then context property
	425	+ boolean c14n11 = useC14N11;
	426	+ String c14nalg = CanonicalizationMethod.INCLUSIVE;
	427	+ if (context instanceof XMLSignContext) {
	428	+ if (!c14n11) {
	429	+ Boolean prop = (Boolean) context.getProperty
	430	+ ("com.sun.org.apache.xml.internal.security.useC14N11");
	431	+ c14n11 = (prop != null && prop.booleanValue() == true);
	432	+ if (c14n11) {
	433	+ c14nalg = "http://www.w3.org/2006/12/xml-c14n11";
	434	+ }
	435	+ } else {
	436	+ c14nalg = "http://www.w3.org/2006/12/xml-c14n11";
	437	+ }
	438	+ }
	439	+ if (data instanceof ApacheData) {
	440	+ xi = ((ApacheData) data).getXMLSignatureInput();
	441	+ } else if (data instanceof OctetStreamData) {
	442	+ xi = new XMLSignatureInput
	443	+ (((OctetStreamData)data).getOctetStream());
	444	+ } else if (data instanceof NodeSetData) {
	445	+ TransformService spi = null;
	446	+ try {
	447	+ spi = TransformService.getInstance(c14nalg, "DOM");
	448	+ } catch (NoSuchAlgorithmException nsae) {
	449	+ spi = TransformService.getInstance
	450	+ (c14nalg, "DOM", provider);
	451	+ }
	452	+ data = spi.transform(data, context);
	453	+ xi = new XMLSignatureInput
	454	+ (((OctetStreamData)data).getOctetStream());
	455	+ } else {
	456	+ throw new XMLSignatureException("unrecognized Data type");
	457	+ }
	458	+ if (context instanceof XMLSignContext && c14n11
	459	+ && !xi.isOctetStream() && !xi.isOutputStreamSet()) {
	460	+ DOMTransform t = new DOMTransform
	461	+ (TransformService.getInstance(c14nalg, "DOM"));
	462	+ Element transformsElem = null;
	463	+ String dsPrefix = DOMUtils.getSignaturePrefix(context);
	464	+ if (allTransforms.isEmpty()) {
	465	+ transformsElem = DOMUtils.createElement(
	466	+ refElem.getOwnerDocument(),
	467	+ "Transforms", XMLSignature.XMLNS, dsPrefix);
	468	+ refElem.insertBefore(transformsElem,
	469	+ DOMUtils.getFirstChildElement(refElem));
	470	+ } else {
	471	+ transformsElem = DOMUtils.getFirstChildElement(refElem);
	472	+ }
	473	+ t.marshal(transformsElem, dsPrefix, (DOMCryptoContext) context);
	474	+ allTransforms.add(t);
	475	+ xi.updateOutputStream(os, true);
	476	+ } else {
	477	+ xi.updateOutputStream(os);
	478	+ }
	479	+ }
	480	+ os.flush();
	481	+ if (cache != null && cache.booleanValue() == true) {
	482	+ this.dis = dos.getInputStream();
	483	+ }
	484	+ return dos.getDigestValue();
	485	+ } catch (Exception e) {
	486	+ throw new XMLSignatureException(e);
	487	+ }
	488	+ }
	489	+
	490	+ public Node getHere() {
	491	+ return here;
	492	+ }
	493	+
	494	+ public boolean equals(Object o) {
	495	+ if (this == o) {
	496	+ return true;
	497	+ }
	498	+
	499	+ if (!(o instanceof Reference)) {
	500	+ return false;
	501	+ }
	502	+ Reference oref = (Reference) o;
	503	+
	504	+ boolean idsEqual = (id == null ? oref.getId() == null :
	505	+ id.equals(oref.getId()));
	506	+ boolean urisEqual = (uri == null ? oref.getURI() == null :
	507	+ uri.equals(oref.getURI()));
	508	+ boolean typesEqual = (type == null ? oref.getType() == null :
	509	+ type.equals(oref.getType()));
	510	+ boolean digestValuesEqual =
	511	+ Arrays.equals(digestValue, oref.getDigestValue());
	512	+
	513	+ return (digestMethod.equals(oref.getDigestMethod()) && idsEqual &&
	514	+ urisEqual && typesEqual && allTransforms.equals(oref.getTransforms()));
	515	+ }
	516	+
	517	+ boolean isDigested() {
	518	+ return digested;
	519	+ }
	520	+
	521	+ private static Data copyDerefData(Data dereferencedData) {
	522	+ if (dereferencedData instanceof ApacheData) {
	523	+ // need to make a copy of the Data
	524	+ ApacheData ad = (ApacheData) dereferencedData;
	525	+ XMLSignatureInput xsi = ad.getXMLSignatureInput();
	526	+ if (xsi.isNodeSet()) {
	527	+ try {
	528	+ final Set s = xsi.getNodeSet();
	529	+ return new NodeSetData() {
	530	+ public Iterator iterator() { return s.iterator(); }
	531	+ };
	532	+ } catch (Exception e) {
	533	+ // log a warning
	534	+ log.log(Level.WARNING,
	535	+ "cannot cache dereferenced data: " + e);
	536	+ return null;
	537	+ }
	538	+ } else if (xsi.isElement()) {
	539	+ return new DOMSubTreeData
	540	+ (xsi.getSubNode(), xsi.isExcludeComments());
	541	+ } else if (xsi.isOctetStream() \|\| xsi.isByteArray()) {
	542	+ try {
	543	+ return new OctetStreamData
	544	+ (xsi.getOctetStream(), xsi.getSourceURI(), xsi.getMIMEType());
	545	+ } catch (IOException ioe) {
	546	+ // log a warning
	547	+ log.log(Level.WARNING,
	548	+ "cannot cache dereferenced data: " + ioe);
	549	+ return null;
	550	+ }
	551	+ }
	552	+ }
	553	+ return dereferencedData;
	554	+ }
	555	+}

java/pkg/org/jcp/xml/dsig/internal/dom/DOMRetrievalMethod.class+0−0

Binary file not shown.

java/pkg/org/jcp/xml/dsig/internal/dom/DOMRetrievalMethod.java+256−0

@@ -0,0 +1,256 @@
	1	+/*
	2	+ * reserved comment block
	3	+ * DO NOT REMOVE OR ALTER!
	4	+ */
	5	+/*
	6	+ * Copyright 2005 The Apache Software Foundation.
	7	+ *
	8	+ * Licensed under the Apache License, Version 2.0 (the "License");
	9	+ * you may not use this file except in compliance with the License.
	10	+ * You may obtain a copy of the License at
	11	+ *
	12	+ * http://www.apache.org/licenses/LICENSE-2.0
	13	+ *
	14	+ * Unless required by applicable law or agreed to in writing, software
	15	+ * distributed under the License is distributed on an "AS IS" BASIS,
	16	+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
	17	+ * See the License for the specific language governing permissions and
	18	+ * limitations under the License.
	19	+ *
	20	+ */
	21	+/*
	22	+ * Copyright (c) 2005, Oracle and/or its affiliates. All rights reserved.
	23	+ */
	24	+/*
	25	+ * ===========================================================================
	26	+ *
	27	+ * (C) Copyright IBM Corp. 2003 All Rights Reserved.
	28	+ *
	29	+ * ===========================================================================
	30	+ */
	31	+/*
	32	+ * $Id: DOMRetrievalMethod.java,v 1.2 2008/07/24 15:20:32 mullan Exp $
	33	+ */
	34	+package org.jcp.xml.dsig.internal.dom;
	35	+
	36	+import java.io.ByteArrayInputStream;
	37	+import java.net.URI;
	38	+import java.net.URISyntaxException;
	39	+import java.security.Provider;
	40	+import java.util.*;
	41	+import javax.xml.crypto.*;
	42	+import javax.xml.crypto.dsig.*;
	43	+import javax.xml.crypto.dom.DOMCryptoContext;
	44	+import javax.xml.crypto.dom.DOMURIReference;
	45	+import javax.xml.crypto.dsig.keyinfo.RetrievalMethod;
	46	+import javax.xml.parsers.*;
	47	+import org.w3c.dom.Attr;
	48	+import org.w3c.dom.Document;
	49	+import org.w3c.dom.Element;
	50	+import org.w3c.dom.Node;
	51	+
	52	+import com.sun.org.apache.xml.internal.security.signature.XMLSignatureInput;
	53	+
	54	+/**
	55	+ * DOM-based implementation of RetrievalMethod.
	56	+ *
	57	+ * @author Sean Mullan
	58	+ * @author Joyce Leung
	59	+ */
	60	+public final class DOMRetrievalMethod extends DOMStructure
	61	+ implements RetrievalMethod, DOMURIReference {
	62	+
	63	+ private final List transforms;
	64	+ private String uri;
	65	+ private String type;
	66	+ private Attr here;
	67	+
	68	+ /**
	69	+ * Creates a <code>DOMRetrievalMethod</code> containing the specified
	70	+ * URIReference and List of Transforms.
	71	+ *
	72	+ * @param uri the URI
	73	+ * @param type the type
	74	+ * @param transforms a list of {@link Transform}s. The list is defensively
	75	+ * copied to prevent subsequent modification. May be <code>null</code>
	76	+ * or empty.
	77	+ * @throws IllegalArgumentException if the format of <code>uri</code> is
	78	+ * invalid, as specified by Reference's URI attribute in the W3C
	79	+ * specification for XML-Signature Syntax and Processing
	80	+ * @throws NullPointerException if <code>uriReference</code>
	81	+ * is <code>null</code>
	82	+ * @throws ClassCastException if <code>transforms</code> contains any
	83	+ * entries that are not of type {@link Transform}
	84	+ */
	85	+ public DOMRetrievalMethod(String uri, String type, List transforms) {
	86	+ if (uri == null) {
	87	+ throw new NullPointerException("uri cannot be null");
	88	+ }
	89	+ if (transforms == null \|\| transforms.isEmpty()) {
	90	+ this.transforms = Collections.EMPTY_LIST;
	91	+ } else {
	92	+ List transformsCopy = new ArrayList(transforms);
	93	+ for (int i = 0, size = transformsCopy.size(); i < size; i++) {
	94	+ if (!(transformsCopy.get(i) instanceof Transform)) {
	95	+ throw new ClassCastException
	96	+ ("transforms["+i+"] is not a valid type");
	97	+ }
	98	+ }
	99	+ this.transforms = Collections.unmodifiableList(transformsCopy);
	100	+ }
	101	+ this.uri = uri;
	102	+ if ((uri != null) && (!uri.equals(""))) {
	103	+ try {
	104	+ new URI(uri);
	105	+ } catch (URISyntaxException e) {
	106	+ throw new IllegalArgumentException(e.getMessage());
	107	+ }
	108	+ }
	109	+
	110	+ this.type = type;
	111	+ }
	112	+
	113	+ /**
	114	+ * Creates a <code>DOMRetrievalMethod</code> from an element.
	115	+ *
	116	+ * @param rmElem a RetrievalMethod element
	117	+ */
	118	+ public DOMRetrievalMethod(Element rmElem, XMLCryptoContext context,
	119	+ Provider provider) throws MarshalException {
	120	+ // get URI and Type attributes
	121	+ uri = DOMUtils.getAttributeValue(rmElem, "URI");
	122	+ type = DOMUtils.getAttributeValue(rmElem, "Type");
	123	+
	124	+ // get here node
	125	+ here = rmElem.getAttributeNodeNS(null, "URI");
	126	+
	127	+ // get Transforms, if specified
	128	+ List transforms = new ArrayList();
	129	+ Element transformsElem = DOMUtils.getFirstChildElement(rmElem);
	130	+ if (transformsElem != null) {
	131	+ Element transformElem =
	132	+ DOMUtils.getFirstChildElement(transformsElem);
	133	+ while (transformElem != null) {
	134	+ transforms.add
	135	+ (new DOMTransform(transformElem, context, provider));
	136	+ transformElem = DOMUtils.getNextSiblingElement(transformElem);
	137	+ }
	138	+ }
	139	+ if (transforms.isEmpty()) {
	140	+ this.transforms = Collections.EMPTY_LIST;
	141	+ } else {
	142	+ this.transforms = Collections.unmodifiableList(transforms);
	143	+ }
	144	+ }
	145	+
	146	+ public String getURI() {
	147	+ return uri;
	148	+ }
	149	+
	150	+ public String getType() {
	151	+ return type;
	152	+ }
	153	+
	154	+ public List getTransforms() {
	155	+ return transforms;
	156	+ }
	157	+
	158	+ public void marshal(Node parent, String dsPrefix, DOMCryptoContext context)
	159	+ throws MarshalException {
	160	+ Document ownerDoc = DOMUtils.getOwnerDocument(parent);
	161	+
	162	+ Element rmElem = DOMUtils.createElement
	163	+ (ownerDoc, "RetrievalMethod", XMLSignature.XMLNS, dsPrefix);
	164	+
	165	+ // add URI and Type attributes
	166	+ DOMUtils.setAttribute(rmElem, "URI", uri);
	167	+ DOMUtils.setAttribute(rmElem, "Type", type);
	168	+
	169	+ // add Transforms elements
	170	+ if (!transforms.isEmpty()) {
	171	+ Element transformsElem = DOMUtils.createElement
	172	+ (ownerDoc, "Transforms", XMLSignature.XMLNS, dsPrefix);
	173	+ rmElem.appendChild(transformsElem);
	174	+ for (int i = 0, size = transforms.size(); i < size; i++) {
	175	+ ((DOMTransform) transforms.get(i)).marshal
	176	+ (transformsElem, dsPrefix, context);
	177	+ }
	178	+ }
	179	+
	180	+ parent.appendChild(rmElem);
	181	+
	182	+ // save here node
	183	+ here = rmElem.getAttributeNodeNS(null, "URI");
	184	+ }
	185	+
	186	+ public Node getHere() {
	187	+ return here;
	188	+ }
	189	+
	190	+ public Data dereference(XMLCryptoContext context)
	191	+ throws URIReferenceException {
	192	+
	193	+ if (context == null) {
	194	+ throw new NullPointerException("context cannot be null");
	195	+ }
	196	+
	197	+ /*
	198	+ * If URIDereferencer is specified in context; use it, otherwise use
	199	+ * built-in.
	200	+ */
	201	+ URIDereferencer deref = context.getURIDereferencer();
	202	+ if (deref == null) {
	203	+ deref = DOMURIDereferencer.INSTANCE;
	204	+ }
	205	+
	206	+ Data data = deref.dereference(this, context);
	207	+
	208	+ // pass dereferenced data through Transforms
	209	+ try {
	210	+ for (int i = 0, size = transforms.size(); i < size; i++) {
	211	+ Transform transform = (Transform) transforms.get(i);
	212	+ data = ((DOMTransform) transform).transform(data, context);
	213	+ }
	214	+ } catch (Exception e) {
	215	+ throw new URIReferenceException(e);
	216	+ }
	217	+ return data;
	218	+ }
	219	+
	220	+ public XMLStructure dereferenceAsXMLStructure(XMLCryptoContext context)
	221	+ throws URIReferenceException {
	222	+
	223	+ try {
	224	+ ApacheData data = (ApacheData) dereference(context);
	225	+ DocumentBuilderFactory dbf = DocumentBuilderFactory.newInstance();
	226	+ dbf.setNamespaceAware(true);
	227	+ DocumentBuilder db = dbf.newDocumentBuilder();
	228	+ Document doc = db.parse(new ByteArrayInputStream
	229	+ (data.getXMLSignatureInput().getBytes()));
	230	+ Element kiElem = doc.getDocumentElement();
	231	+ if (kiElem.getLocalName().equals("X509Data")) {
	232	+ return new DOMX509Data(kiElem);
	233	+ } else {
	234	+ return null; // unsupported
	235	+ }
	236	+ } catch (Exception e) {
	237	+ throw new URIReferenceException(e);
	238	+ }
	239	+ }
	240	+
	241	+ public boolean equals(Object obj) {
	242	+ if (this == obj) {
	243	+ return true;
	244	+ }
	245	+ if (!(obj instanceof RetrievalMethod)) {
	246	+ return false;
	247	+ }
	248	+ RetrievalMethod orm = (RetrievalMethod) obj;
	249	+
	250	+ boolean typesEqual = (type == null ? orm.getType() == null :
	251	+ type.equals(orm.getType()));
	252	+
	253	+ return (uri.equals(orm.getURI()) &&
	254	+ transforms.equals(orm.getTransforms()) && typesEqual);
	255	+ }
	256	+}

java/pkg/org/jcp/xml/dsig/internal/dom/DOMSignatureMethod$SHA1withDSA.class+0−0

Binary file not shown.

java/pkg/org/jcp/xml/dsig/internal/dom/DOMSignatureMethod$SHA1withRSA.class+0−0

Binary file not shown.

java/pkg/org/jcp/xml/dsig/internal/dom/DOMSignatureMethod$SHA256withRSA.class+0−0

Binary file not shown.

java/pkg/org/jcp/xml/dsig/internal/dom/DOMSignatureMethod$SHA384withRSA.class+0−0

Binary file not shown.

java/pkg/org/jcp/xml/dsig/internal/dom/DOMSignatureMethod$SHA512withRSA.class+0−0

Binary file not shown.

java/pkg/org/jcp/xml/dsig/internal/dom/DOMSignatureMethod.class+0−0

Binary file not shown.

java/pkg/org/jcp/xml/dsig/internal/dom/DOMSignatureMethod.java+527−0

@@ -0,0 +1,527 @@
	1	+/*
	2	+ * reserved comment block
	3	+ * DO NOT REMOVE OR ALTER!
	4	+ */
	5	+/*
	6	+ * Copyright 2005 The Apache Software Foundation.
	7	+ *
	8	+ * Licensed under the Apache License, Version 2.0 (the "License");
	9	+ * you may not use this file except in compliance with the License.
	10	+ * You may obtain a copy of the License at
	11	+ *
	12	+ * http://www.apache.org/licenses/LICENSE-2.0
	13	+ *
	14	+ * Unless required by applicable law or agreed to in writing, software
	15	+ * distributed under the License is distributed on an "AS IS" BASIS,
	16	+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
	17	+ * See the License for the specific language governing permissions and
	18	+ * limitations under the License.
	19	+ *
	20	+ */
	21	+/*
	22	+ * Copyright (c) 2005, 2008, Oracle and/or its affiliates. All rights reserved.
	23	+ */
	24	+/*
	25	+ * $Id: DOMSignatureMethod.java,v 1.2 2008/07/24 15:20:32 mullan Exp $
	26	+ */
	27	+package org.jcp.xml.dsig.internal.dom;
	28	+
	29	+import javax.xml.crypto.*;
	30	+import javax.xml.crypto.dom.DOMCryptoContext;
	31	+import javax.xml.crypto.dsig.*;
	32	+import javax.xml.crypto.dsig.spec.SignatureMethodParameterSpec;
	33	+
	34	+import java.io.IOException;
	35	+import java.security.*;
	36	+import java.security.spec.AlgorithmParameterSpec;
	37	+import java.util.logging.Level;
	38	+import java.util.logging.Logger;
	39	+import org.w3c.dom.Document;
	40	+import org.w3c.dom.Element;
	41	+import org.w3c.dom.Node;
	42	+
	43	+import org.jcp.xml.dsig.internal.SignerOutputStream;
	44	+
	45	+/**
	46	+ * DOM-based abstract implementation of SignatureMethod.
	47	+ *
	48	+ * @author Sean Mullan
	49	+ */
	50	+public abstract class DOMSignatureMethod extends DOMStructure
	51	+ implements SignatureMethod {
	52	+
	53	+ private static Logger log =
	54	+ Logger.getLogger("org.jcp.xml.dsig.internal.dom");
	55	+
	56	+ // see RFC 4051 for these algorithm definitions
	57	+ final static String RSA_SHA256 =
	58	+ "http://www.w3.org/2001/04/xmldsig-more#rsa-sha256";
	59	+ final static String RSA_SHA384 =
	60	+ "http://www.w3.org/2001/04/xmldsig-more#rsa-sha384";
	61	+ final static String RSA_SHA512 =
	62	+ "http://www.w3.org/2001/04/xmldsig-more#rsa-sha512";
	63	+ final static String HMAC_SHA256 =
	64	+ "http://www.w3.org/2001/04/xmldsig-more#hmac-sha256";
	65	+ final static String HMAC_SHA384 =
	66	+ "http://www.w3.org/2001/04/xmldsig-more#hmac-sha384";
	67	+ final static String HMAC_SHA512 =
	68	+ "http://www.w3.org/2001/04/xmldsig-more#hmac-sha512";
	69	+
	70	+ private SignatureMethodParameterSpec params;
	71	+ private Signature signature;
	72	+
	73	+ /**
	74	+ * Creates a <code>DOMSignatureMethod</code>.
	75	+ *
	76	+ * @param params the algorithm-specific params (may be <code>null</code>)
	77	+ * @throws InvalidAlgorithmParameterException if the parameters are not
	78	+ * appropriate for this signature method
	79	+ */
	80	+ DOMSignatureMethod(AlgorithmParameterSpec params)
	81	+ throws InvalidAlgorithmParameterException {
	82	+ if (params != null &&
	83	+ !(params instanceof SignatureMethodParameterSpec)) {
	84	+ throw new InvalidAlgorithmParameterException
	85	+ ("params must be of type SignatureMethodParameterSpec");
	86	+ }
	87	+ checkParams((SignatureMethodParameterSpec) params);
	88	+ this.params = (SignatureMethodParameterSpec) params;
	89	+ }
	90	+
	91	+ /**
	92	+ * Creates a <code>DOMSignatureMethod</code> from an element. This ctor
	93	+ * invokes the abstract {@link #unmarshalParams unmarshalParams} method to
	94	+ * unmarshal any algorithm-specific input parameters.
	95	+ *
	96	+ * @param smElem a SignatureMethod element
	97	+ */
	98	+ DOMSignatureMethod(Element smElem) throws MarshalException {
	99	+ Element paramsElem = DOMUtils.getFirstChildElement(smElem);
	100	+ if (paramsElem != null) {
	101	+ params = unmarshalParams(paramsElem);
	102	+ }
	103	+ try {
	104	+ checkParams(params);
	105	+ } catch (InvalidAlgorithmParameterException iape) {
	106	+ throw new MarshalException(iape);
	107	+ }
	108	+ }
	109	+
	110	+ static SignatureMethod unmarshal(Element smElem) throws MarshalException {
	111	+ String alg = DOMUtils.getAttributeValue(smElem, "Algorithm");
	112	+ if (alg.equals(SignatureMethod.RSA_SHA1)) {
	113	+ return new SHA1withRSA(smElem);
	114	+ } else if (alg.equals(RSA_SHA256)) {
	115	+ return new SHA256withRSA(smElem);
	116	+ } else if (alg.equals(RSA_SHA384)) {
	117	+ return new SHA384withRSA(smElem);
	118	+ } else if (alg.equals(RSA_SHA512)) {
	119	+ return new SHA512withRSA(smElem);
	120	+ } else if (alg.equals(SignatureMethod.DSA_SHA1)) {
	121	+ return new SHA1withDSA(smElem);
	122	+ } else if (alg.equals(SignatureMethod.HMAC_SHA1)) {
	123	+ return new DOMHMACSignatureMethod.SHA1(smElem);
	124	+ } else if (alg.equals(HMAC_SHA256)) {
	125	+ return new DOMHMACSignatureMethod.SHA256(smElem);
	126	+ } else if (alg.equals(HMAC_SHA384)) {
	127	+ return new DOMHMACSignatureMethod.SHA384(smElem);
	128	+ } else if (alg.equals(HMAC_SHA512)) {
	129	+ return new DOMHMACSignatureMethod.SHA512(smElem);
	130	+ } else {
	131	+ throw new MarshalException
	132	+ ("unsupported SignatureMethod algorithm: " + alg);
	133	+ }
	134	+ }
	135	+
	136	+ /**
	137	+ * Checks if the specified parameters are valid for this algorithm. By
	138	+ * default, this method throws an exception if parameters are specified
	139	+ * since most SignatureMethod algorithms do not have parameters. Subclasses
	140	+ * should override it if they have parameters.
	141	+ *
	142	+ * @param params the algorithm-specific params (may be <code>null</code>)
	143	+ * @throws InvalidAlgorithmParameterException if the parameters are not
	144	+ * appropriate for this signature method
	145	+ */
	146	+ void checkParams(SignatureMethodParameterSpec params)
	147	+ throws InvalidAlgorithmParameterException {
	148	+ if (params != null) {
	149	+ throw new InvalidAlgorithmParameterException("no parameters " +
	150	+ "should be specified for the " + getSignatureAlgorithm()
	151	+ + " SignatureMethod algorithm");
	152	+ }
	153	+ }
	154	+
	155	+ public final AlgorithmParameterSpec getParameterSpec() {
	156	+ return params;
	157	+ }
	158	+
	159	+ /**
	160	+ * Unmarshals <code>SignatureMethodParameterSpec</code> from the specified
	161	+ * <code>Element</code>. By default, this method throws an exception since
	162	+ * most SignatureMethod algorithms do not have parameters. Subclasses should
	163	+ * override it if they have parameters.
	164	+ *
	165	+ * @param paramsElem the <code>Element</code> holding the input params
	166	+ * @return the algorithm-specific <code>SignatureMethodParameterSpec</code>
	167	+ * @throws MarshalException if the parameters cannot be unmarshalled
	168	+ */
	169	+ SignatureMethodParameterSpec
	170	+ unmarshalParams(Element paramsElem) throws MarshalException {
	171	+ throw new MarshalException("no parameters should " +
	172	+ "be specified for the " + getSignatureAlgorithm() +
	173	+ " SignatureMethod algorithm");
	174	+ }
	175	+
	176	+ /**
	177	+ * This method invokes the abstract {@link #marshalParams marshalParams}
	178	+ * method to marshal any algorithm-specific parameters.
	179	+ */
	180	+ public void marshal(Node parent, String dsPrefix, DOMCryptoContext context)
	181	+ throws MarshalException {
	182	+ Document ownerDoc = DOMUtils.getOwnerDocument(parent);
	183	+
	184	+ Element smElem = DOMUtils.createElement
	185	+ (ownerDoc, "SignatureMethod", XMLSignature.XMLNS, dsPrefix);
	186	+ DOMUtils.setAttribute(smElem, "Algorithm", getAlgorithm());
	187	+
	188	+ if (params != null) {
	189	+ marshalParams(smElem, dsPrefix);
	190	+ }
	191	+
	192	+ parent.appendChild(smElem);
	193	+ }
	194	+
	195	+ /**
	196	+ * Verifies the passed-in signature with the specified key, using the
	197	+ * underlying signature or MAC algorithm.
	198	+ *
	199	+ * @param key the verification key
	200	+ * @param si the DOMSignedInfo
	201	+ * @param signature the signature bytes to be verified
	202	+ * @param context the XMLValidateContext
	203	+ * @return <code>true</code> if the signature verified successfully,
	204	+ * <code>false</code> if not
	205	+ * @throws NullPointerException if <code>key</code>, <code>si</code> or
	206	+ * <code>signature</code> are <code>null</code>
	207	+ * @throws InvalidKeyException if the key is improperly encoded, of
	208	+ * the wrong type, or parameters are missing, etc
	209	+ * @throws SignatureException if an unexpected error occurs, such
	210	+ * as the passed in signature is improperly encoded
	211	+ * @throws XMLSignatureException if an unexpected error occurs
	212	+ */
	213	+ boolean verify(Key key, DOMSignedInfo si, byte[] sig,
	214	+ XMLValidateContext context) throws InvalidKeyException,
	215	+ SignatureException, XMLSignatureException {
	216	+ if (key == null \|\| si == null \|\| sig == null) {
	217	+ throw new NullPointerException();
	218	+ }
	219	+
	220	+ if (!(key instanceof PublicKey)) {
	221	+ throw new InvalidKeyException("key must be PublicKey");
	222	+ }
	223	+ if (signature == null) {
	224	+ try {
	225	+ Provider p = (Provider) context.getProperty
	226	+ ("org.jcp.xml.dsig.internal.dom.SignatureProvider");
	227	+ signature = (p == null)
	228	+ ? Signature.getInstance(getSignatureAlgorithm())
	229	+ : Signature.getInstance(getSignatureAlgorithm(), p);
	230	+ } catch (NoSuchAlgorithmException nsae) {
	231	+ throw new XMLSignatureException(nsae);
	232	+ }
	233	+ }
	234	+ signature.initVerify((PublicKey) key);
	235	+ if (log.isLoggable(Level.FINE)) {
	236	+ log.log(Level.FINE, "Signature provider:"+ signature.getProvider());
	237	+ log.log(Level.FINE, "verifying with key: " + key);
	238	+ }
	239	+ si.canonicalize(context, new SignerOutputStream(signature));
	240	+
	241	+ if (getAlgorithm().equals(SignatureMethod.DSA_SHA1)) {
	242	+ try {
	243	+ return signature.verify(convertXMLDSIGtoASN1(sig));
	244	+ } catch (IOException ioe) {
	245	+ throw new XMLSignatureException(ioe);
	246	+ }
	247	+ } else {
	248	+ return signature.verify(sig);
	249	+ }
	250	+ }
	251	+
	252	+ /**
	253	+ * Signs the bytes with the specified key, using the underlying
	254	+ * signature or MAC algorithm.
	255	+ *
	256	+ * @param key the signing key
	257	+ * @param si the DOMSignedInfo
	258	+ * @param context the XMLSignContext
	259	+ * @return the signature
	260	+ * @throws NullPointerException if <code>key</code> or
	261	+ * <code>si</code> are <code>null</code>
	262	+ * @throws InvalidKeyException if the key is improperly encoded, of
	263	+ * the wrong type, or parameters are missing, etc
	264	+ * @throws XMLSignatureException if an unexpected error occurs
	265	+ */
	266	+ byte[] sign(Key key, DOMSignedInfo si, XMLSignContext context)
	267	+ throws InvalidKeyException, XMLSignatureException {
	268	+ if (key == null \|\| si == null) {
	269	+ throw new NullPointerException();
	270	+ }
	271	+
	272	+ if (!(key instanceof PrivateKey)) {
	273	+ throw new InvalidKeyException("key must be PrivateKey");
	274	+ }
	275	+ if (signature == null) {
	276	+ try {
	277	+ Provider p = (Provider) context.getProperty
	278	+ ("org.jcp.xml.dsig.internal.dom.SignatureProvider");
	279	+ signature = (p == null)
	280	+ ? Signature.getInstance(getSignatureAlgorithm())
	281	+ : Signature.getInstance(getSignatureAlgorithm(), p);
	282	+ } catch (NoSuchAlgorithmException nsae) {
	283	+ throw new XMLSignatureException(nsae);
	284	+ }
	285	+ }
	286	+ signature.initSign((PrivateKey) key);
	287	+ if (log.isLoggable(Level.FINE)) {
	288	+ log.log(Level.FINE, "Signature provider:" +signature.getProvider());
	289	+ log.log(Level.FINE, "Signing with key: " + key);
	290	+ }
	291	+
	292	+ si.canonicalize(context, new SignerOutputStream(signature));
	293	+
	294	+ try {
	295	+ if (getAlgorithm().equals(SignatureMethod.DSA_SHA1)) {
	296	+ return convertASN1toXMLDSIG(signature.sign());
	297	+ } else {
	298	+ return signature.sign();
	299	+ }
	300	+ } catch (SignatureException se) {
	301	+ throw new XMLSignatureException(se);
	302	+ } catch (IOException ioe) {
	303	+ throw new XMLSignatureException(ioe);
	304	+ }
	305	+ }
	306	+
	307	+ /**
	308	+ * Marshals the algorithm-specific parameters to an Element and
	309	+ * appends it to the specified parent element. By default, this method
	310	+ * throws an exception since most SignatureMethod algorithms do not have
	311	+ * parameters. Subclasses should override it if they have parameters.
	312	+ *
	313	+ * @param parent the parent element to append the parameters to
	314	+ * @param paramsPrefix the algorithm parameters prefix to use
	315	+ * @throws MarshalException if the parameters cannot be marshalled
	316	+ */
	317	+ void marshalParams(Element parent, String paramsPrefix)
	318	+ throws MarshalException {
	319	+ throw new MarshalException("no parameters should " +
	320	+ "be specified for the " + getSignatureAlgorithm() +
	321	+ " SignatureMethod algorithm");
	322	+ }
	323	+
	324	+ /**
	325	+ * Returns the java.security.Signature standard algorithm name.
	326	+ */
	327	+ abstract String getSignatureAlgorithm();
	328	+
	329	+ /**
	330	+ * Returns true if parameters are equal; false otherwise.
	331	+ *
	332	+ * Subclasses should override this method to compare algorithm-specific
	333	+ * parameters.
	334	+ */
	335	+ boolean paramsEqual(AlgorithmParameterSpec spec) {
	336	+ return (getParameterSpec() == spec);
	337	+ }
	338	+
	339	+ public boolean equals(Object o) {
	340	+ if (this == o) {
	341	+ return true;
	342	+ }
	343	+
	344	+ if (!(o instanceof SignatureMethod)) {
	345	+ return false;
	346	+ }
	347	+ SignatureMethod osm = (SignatureMethod) o;
	348	+
	349	+ return (getAlgorithm().equals(osm.getAlgorithm()) &&
	350	+ paramsEqual(osm.getParameterSpec()));
	351	+ }
	352	+
	353	+ /**
	354	+ * Converts an ASN.1 DSA value to a XML Signature DSA Value.
	355	+ *
	356	+ * The JAVA JCE DSA Signature algorithm creates ASN.1 encoded (r,s) value
	357	+ * pairs; the XML Signature requires the core BigInteger values.
	358	+ *
	359	+ * @param asn1Bytes
	360	+ *
	361	+ * @throws IOException
	362	+ * @see <A HREF="http://www.w3.org/TR/xmldsig-core/#dsa-sha1">6.4.1 DSA</A>
	363	+ */
	364	+ private static byte[] convertASN1toXMLDSIG(byte asn1Bytes[])
	365	+ throws IOException {
	366	+
	367	+ byte rLength = asn1Bytes[3];
	368	+ int i;
	369	+
	370	+ for (i = rLength; (i > 0) && (asn1Bytes[(4 + rLength) - i] == 0); i--);
	371	+
	372	+ byte sLength = asn1Bytes[5 + rLength];
	373	+ int j;
	374	+
	375	+ for (j = sLength;
	376	+ (j > 0) && (asn1Bytes[(6 + rLength + sLength) - j] == 0); j--);
	377	+
	378	+ if ((asn1Bytes[0] != 48) \|\| (asn1Bytes[1] != asn1Bytes.length - 2)
	379	+ \|\| (asn1Bytes[2] != 2) \|\| (i > 20)
	380	+ \|\| (asn1Bytes[4 + rLength] != 2) \|\| (j > 20)) {
	381	+ throw new IOException("Invalid ASN.1 format of DSA signature");
	382	+ } else {
	383	+ byte xmldsigBytes[] = new byte[40];
	384	+
	385	+ System.arraycopy(asn1Bytes, (4+rLength)-i, xmldsigBytes, 20-i, i);
	386	+ System.arraycopy(asn1Bytes, (6+rLength+sLength)-j, xmldsigBytes,
	387	+ 40 - j, j);
	388	+
	389	+ return xmldsigBytes;
	390	+ }
	391	+ }
	392	+
	393	+ /**
	394	+ * Converts a XML Signature DSA Value to an ASN.1 DSA value.
	395	+ *
	396	+ * The JAVA JCE DSA Signature algorithm creates ASN.1 encoded (r,s) value
	397	+ * pairs; the XML Signature requires the core BigInteger values.
	398	+ *
	399	+ * @param xmldsigBytes
	400	+ *
	401	+ * @throws IOException
	402	+ * @see <A HREF="http://www.w3.org/TR/xmldsig-core/#dsa-sha1">6.4.1 DSA</A>
	403	+ */
	404	+ private static byte[] convertXMLDSIGtoASN1(byte xmldsigBytes[])
	405	+ throws IOException {
	406	+
	407	+ if (xmldsigBytes.length != 40) {
	408	+ throw new IOException("Invalid XMLDSIG format of DSA signature");
	409	+ }
	410	+
	411	+ int i;
	412	+
	413	+ for (i = 20; (i > 0) && (xmldsigBytes[20 - i] == 0); i--);
	414	+
	415	+ int j = i;
	416	+
	417	+ if (xmldsigBytes[20 - i] < 0) {
	418	+ j += 1;
	419	+ }
	420	+
	421	+ int k;
	422	+
	423	+ for (k = 20; (k > 0) && (xmldsigBytes[40 - k] == 0); k--);
	424	+
	425	+ int l = k;
	426	+
	427	+ if (xmldsigBytes[40 - k] < 0) {
	428	+ l += 1;
	429	+ }
	430	+
	431	+ byte asn1Bytes[] = new byte[6 + j + l];
	432	+
	433	+ asn1Bytes[0] = 48;
	434	+ asn1Bytes[1] = (byte) (4 + j + l);
	435	+ asn1Bytes[2] = 2;
	436	+ asn1Bytes[3] = (byte) j;
	437	+
	438	+ System.arraycopy(xmldsigBytes, 20 - i, asn1Bytes, (4 + j) - i, i);
	439	+
	440	+ asn1Bytes[4 + j] = 2;
	441	+ asn1Bytes[5 + j] = (byte) l;
	442	+
	443	+ System.arraycopy(xmldsigBytes, 40 - k, asn1Bytes, (6 + j + l) - k, k);
	444	+
	445	+ return asn1Bytes;
	446	+ }
	447	+
	448	+ static final class SHA1withRSA extends DOMSignatureMethod {
	449	+ SHA1withRSA(AlgorithmParameterSpec params)
	450	+ throws InvalidAlgorithmParameterException {
	451	+ super(params);
	452	+ }
	453	+ SHA1withRSA(Element dmElem) throws MarshalException {
	454	+ super(dmElem);
	455	+ }
	456	+ public String getAlgorithm() {
	457	+ return SignatureMethod.RSA_SHA1;
	458	+ }
	459	+ String getSignatureAlgorithm() {
	460	+ return "SHA1withRSA";
	461	+ }
	462	+ }
	463	+
	464	+ static final class SHA256withRSA extends DOMSignatureMethod {
	465	+ SHA256withRSA(AlgorithmParameterSpec params)
	466	+ throws InvalidAlgorithmParameterException {
	467	+ super(params);
	468	+ }
	469	+ SHA256withRSA(Element dmElem) throws MarshalException {
	470	+ super(dmElem);
	471	+ }
	472	+ public String getAlgorithm() {
	473	+ return RSA_SHA256;
	474	+ }
	475	+ String getSignatureAlgorithm() {
	476	+ return "SHA256withRSA";
	477	+ }
	478	+ }
	479	+
	480	+ static final class SHA384withRSA extends DOMSignatureMethod {
	481	+ SHA384withRSA(AlgorithmParameterSpec params)
	482	+ throws InvalidAlgorithmParameterException {
	483	+ super(params);
	484	+ }
	485	+ SHA384withRSA(Element dmElem) throws MarshalException {
	486	+ super(dmElem);
	487	+ }
	488	+ public String getAlgorithm() {
	489	+ return RSA_SHA384;
	490	+ }
	491	+ String getSignatureAlgorithm() {
	492	+ return "SHA384withRSA";
	493	+ }
	494	+ }
	495	+
	496	+ static final class SHA512withRSA extends DOMSignatureMethod {
	497	+ SHA512withRSA(AlgorithmParameterSpec params)
	498	+ throws InvalidAlgorithmParameterException {
	499	+ super(params);
	500	+ }
	501	+ SHA512withRSA(Element dmElem) throws MarshalException {
	502	+ super(dmElem);
	503	+ }
	504	+ public String getAlgorithm() {
	505	+ return RSA_SHA512;
	506	+ }
	507	+ String getSignatureAlgorithm() {
	508	+ return "SHA512withRSA";
	509	+ }
	510	+ }
	511	+
	512	+ static final class SHA1withDSA extends DOMSignatureMethod {
	513	+ SHA1withDSA(AlgorithmParameterSpec params)
	514	+ throws InvalidAlgorithmParameterException {
	515	+ super(params);
	516	+ }
	517	+ SHA1withDSA(Element dmElem) throws MarshalException {
	518	+ super(dmElem);
	519	+ }
	520	+ public String getAlgorithm() {
	521	+ return SignatureMethod.DSA_SHA1;
	522	+ }
	523	+ String getSignatureAlgorithm() {
	524	+ return "SHA1withDSA";
	525	+ }
	526	+ }
	527	+}

java/pkg/org/jcp/xml/dsig/internal/dom/DOMSignatureProperties.class+0−0

Binary file not shown.

java/pkg/org/jcp/xml/dsig/internal/dom/DOMSignatureProperties.java+150−0

@@ -0,0 +1,150 @@
	1	+/*
	2	+ * reserved comment block
	3	+ * DO NOT REMOVE OR ALTER!
	4	+ */
	5	+/*
	6	+ * Copyright 2005 The Apache Software Foundation.
	7	+ *
	8	+ * Licensed under the Apache License, Version 2.0 (the "License");
	9	+ * you may not use this file except in compliance with the License.
	10	+ * You may obtain a copy of the License at
	11	+ *
	12	+ * http://www.apache.org/licenses/LICENSE-2.0
	13	+ *
	14	+ * Unless required by applicable law or agreed to in writing, software
	15	+ * distributed under the License is distributed on an "AS IS" BASIS,
	16	+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
	17	+ * See the License for the specific language governing permissions and
	18	+ * limitations under the License.
	19	+ *
	20	+ */
	21	+/*
	22	+ * Copyright (c) 2005, 2008, Oracle and/or its affiliates. All rights reserved.
	23	+ */
	24	+/*
	25	+ * $Id: DOMSignatureProperties.java,v 1.2 2008/07/24 15:20:32 mullan Exp $
	26	+ */
	27	+package org.jcp.xml.dsig.internal.dom;
	28	+
	29	+import javax.xml.crypto.*;
	30	+import javax.xml.crypto.dom.DOMCryptoContext;
	31	+import javax.xml.crypto.dsig.*;
	32	+
	33	+import java.util.*;
	34	+import org.w3c.dom.Document;
	35	+import org.w3c.dom.Element;
	36	+import org.w3c.dom.Node;
	37	+import org.w3c.dom.NodeList;
	38	+
	39	+/**
	40	+ * DOM-based implementation of SignatureProperties.
	41	+ *
	42	+ * @author Sean Mullan
	43	+ */
	44	+public final class DOMSignatureProperties extends DOMStructure
	45	+ implements SignatureProperties {
	46	+
	47	+ private final String id;
	48	+ private final List properties;
	49	+
	50	+ /**
	51	+ * Creates a <code>DOMSignatureProperties</code> from the specified
	52	+ * parameters.
	53	+ *
	54	+ * @param properties a list of one or more {@link SignatureProperty}s. The
	55	+ * list is defensively copied to protect against subsequent modification.
	56	+ * @param id the Id (may be <code>null</code>)
	57	+ * @return a <code>DOMSignatureProperties</code>
	58	+ * @throws ClassCastException if <code>properties</code> contains any
	59	+ * entries that are not of type {@link SignatureProperty}
	60	+ * @throws IllegalArgumentException if <code>properties</code> is empty
	61	+ * @throws NullPointerException if <code>properties</code>
	62	+ */
	63	+ public DOMSignatureProperties(List properties, String id) {
	64	+ if (properties == null) {
	65	+ throw new NullPointerException("properties cannot be null");
	66	+ } else if (properties.isEmpty()) {
	67	+ throw new IllegalArgumentException("properties cannot be empty");
	68	+ } else {
	69	+ List propsCopy = new ArrayList(properties);
	70	+ for (int i = 0, size = propsCopy.size(); i < size; i++) {
	71	+ if (!(propsCopy.get(i) instanceof SignatureProperty)) {
	72	+ throw new ClassCastException
	73	+ ("properties["+i+"] is not a valid type");
	74	+ }
	75	+ }
	76	+ this.properties = Collections.unmodifiableList(propsCopy);
	77	+ }
	78	+ this.id = id;
	79	+ }
	80	+
	81	+ /**
	82	+ * Creates a <code>DOMSignatureProperties</code> from an element.
	83	+ *
	84	+ * @param propsElem a SignatureProperties element
	85	+ * @throws MarshalException if a marshalling error occurs
	86	+ */
	87	+ public DOMSignatureProperties(Element propsElem) throws MarshalException{
	88	+ // unmarshal attributes
	89	+ id = DOMUtils.getAttributeValue(propsElem, "Id");
	90	+
	91	+ NodeList nodes = propsElem.getChildNodes();
	92	+ int length = nodes.getLength();
	93	+ List properties = new ArrayList(length);
	94	+ for (int i = 0; i < length; i++) {
	95	+ Node child = nodes.item(i);
	96	+ if (child.getNodeType() == Node.ELEMENT_NODE) {
	97	+ properties.add(new DOMSignatureProperty((Element) child));
	98	+ }
	99	+ }
	100	+ if (properties.isEmpty()) {
	101	+ throw new MarshalException("properties cannot be empty");
	102	+ } else {
	103	+ this.properties = Collections.unmodifiableList(properties);
	104	+ }
	105	+ }
	106	+
	107	+ public List getProperties() {
	108	+ return properties;
	109	+ }
	110	+
	111	+ public String getId() {
	112	+ return id;
	113	+ }
	114	+
	115	+ public void marshal(Node parent, String dsPrefix, DOMCryptoContext context)
	116	+ throws MarshalException {
	117	+ Document ownerDoc = DOMUtils.getOwnerDocument(parent);
	118	+
	119	+ Element propsElem = DOMUtils.createElement
	120	+ (ownerDoc, "SignatureProperties", XMLSignature.XMLNS, dsPrefix);
	121	+
	122	+ // set attributes
	123	+ DOMUtils.setAttributeID(propsElem, "Id", id);
	124	+
	125	+ // create and append any properties
	126	+ for (int i = 0, size = properties.size(); i < size; i++) {
	127	+ DOMSignatureProperty property =
	128	+ (DOMSignatureProperty) properties.get(i);
	129	+ property.marshal(propsElem, dsPrefix, context);
	130	+ }
	131	+
	132	+ parent.appendChild(propsElem);
	133	+ }
	134	+
	135	+ public boolean equals(Object o) {
	136	+ if (this == o) {
	137	+ return true;
	138	+ }
	139	+
	140	+ if (!(o instanceof SignatureProperties)) {
	141	+ return false;
	142	+ }
	143	+ SignatureProperties osp = (SignatureProperties) o;
	144	+
	145	+ boolean idsEqual = (id == null ? osp.getId() == null :
	146	+ id.equals(osp.getId()));
	147	+
	148	+ return (properties.equals(osp.getProperties()) && idsEqual);
	149	+ }
	150	+}

java/pkg/org/jcp/xml/dsig/internal/dom/DOMSignatureProperty.class+0−0

Binary file not shown.

java/pkg/org/jcp/xml/dsig/internal/dom/DOMSignatureProperty.java+190−0

@@ -0,0 +1,190 @@
	1	+/*
	2	+ * reserved comment block
	3	+ * DO NOT REMOVE OR ALTER!
	4	+ */
	5	+/*
	6	+ * Copyright 2005 The Apache Software Foundation.
	7	+ *
	8	+ * Licensed under the Apache License, Version 2.0 (the "License");
	9	+ * you may not use this file except in compliance with the License.
	10	+ * You may obtain a copy of the License at
	11	+ *
	12	+ * http://www.apache.org/licenses/LICENSE-2.0
	13	+ *
	14	+ * Unless required by applicable law or agreed to in writing, software
	15	+ * distributed under the License is distributed on an "AS IS" BASIS,
	16	+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
	17	+ * See the License for the specific language governing permissions and
	18	+ * limitations under the License.
	19	+ *
	20	+ */
	21	+/*
	22	+ * Copyright (c) 2005, 2008, Oracle and/or its affiliates. All rights reserved.
	23	+ */
	24	+/*
	25	+ * $Id: DOMSignatureProperty.java,v 1.2 2008/07/24 15:20:32 mullan Exp $
	26	+ */
	27	+package org.jcp.xml.dsig.internal.dom;
	28	+
	29	+import javax.xml.crypto.*;
	30	+import javax.xml.crypto.dom.DOMCryptoContext;
	31	+import javax.xml.crypto.dsig.*;
	32	+
	33	+import java.util.*;
	34	+import org.w3c.dom.Document;
	35	+import org.w3c.dom.Element;
	36	+import org.w3c.dom.Node;
	37	+import org.w3c.dom.NodeList;
	38	+
	39	+/**
	40	+ * DOM-based implementation of SignatureProperty.
	41	+ *
	42	+ * @author Sean Mullan
	43	+ */
	44	+public final class DOMSignatureProperty extends DOMStructure
	45	+ implements SignatureProperty {
	46	+
	47	+ private final String id;
	48	+ private final String target;
	49	+ private final List content;
	50	+
	51	+ /**
	52	+ * Creates a <code>SignatureProperty</code> from the specified parameters.
	53	+ *
	54	+ * @param content a list of one or more {@link XMLStructure}s. The list
	55	+ * is defensively copied to protect against subsequent modification.
	56	+ * @param target the target URI
	57	+ * @param id the Id (may be <code>null</code>)
	58	+ * @return a <code>SignatureProperty</code>
	59	+ * @throws ClassCastException if <code>content</code> contains any
	60	+ * entries that are not of type {@link XMLStructure}
	61	+ * @throws IllegalArgumentException if <code>content</code> is empty
	62	+ * @throws NullPointerException if <code>content</code> or
	63	+ * <code>target</code> is <code>null</code>
	64	+ */
	65	+ public DOMSignatureProperty(List content, String target, String id) {
	66	+ if (target == null) {
	67	+ throw new NullPointerException("target cannot be null");
	68	+ } else if (content == null) {
	69	+ throw new NullPointerException("content cannot be null");
	70	+ } else if (content.isEmpty()) {
	71	+ throw new IllegalArgumentException("content cannot be empty");
	72	+ } else {
	73	+ List contentCopy = new ArrayList(content);
	74	+ for (int i = 0, size = contentCopy.size(); i < size; i++) {
	75	+ if (!(contentCopy.get(i) instanceof XMLStructure)) {
	76	+ throw new ClassCastException
	77	+ ("content["+i+"] is not a valid type");
	78	+ }
	79	+ }
	80	+ this.content = Collections.unmodifiableList(contentCopy);
	81	+ }
	82	+ this.target = target;
	83	+ this.id = id;
	84	+ }
	85	+
	86	+ /**
	87	+ * Creates a <code>DOMSignatureProperty</code> from an element.
	88	+ *
	89	+ * @param propElem a SignatureProperty element
	90	+ */
	91	+ public DOMSignatureProperty(Element propElem) throws MarshalException {
	92	+ // unmarshal attributes
	93	+ target = DOMUtils.getAttributeValue(propElem, "Target");
	94	+ if (target == null) {
	95	+ throw new MarshalException("target cannot be null");
	96	+ }
	97	+ id = DOMUtils.getAttributeValue(propElem, "Id");
	98	+
	99	+ NodeList nodes = propElem.getChildNodes();
	100	+ int length = nodes.getLength();
	101	+ List content = new ArrayList(length);
	102	+ for (int i = 0; i < length; i++) {
	103	+ content.add(new javax.xml.crypto.dom.DOMStructure(nodes.item(i)));
	104	+ }
	105	+ if (content.isEmpty()) {
	106	+ throw new MarshalException("content cannot be empty");
	107	+ } else {
	108	+ this.content = Collections.unmodifiableList(content);
	109	+ }
	110	+ }
	111	+
	112	+ public List getContent() {
	113	+ return content;
	114	+ }
	115	+
	116	+ public String getId() {
	117	+ return id;
	118	+ }
	119	+
	120	+ public String getTarget() {
	121	+ return target;
	122	+ }
	123	+
	124	+ public void marshal(Node parent, String dsPrefix, DOMCryptoContext context)
	125	+ throws MarshalException {
	126	+ Document ownerDoc = DOMUtils.getOwnerDocument(parent);
	127	+
	128	+ Element propElem = DOMUtils.createElement
	129	+ (ownerDoc, "SignatureProperty", XMLSignature.XMLNS, dsPrefix);
	130	+
	131	+ // set attributes
	132	+ DOMUtils.setAttributeID(propElem, "Id", id);
	133	+ DOMUtils.setAttribute(propElem, "Target", target);
	134	+
	135	+ // create and append any elements and mixed content
	136	+ for (int i = 0, size = content.size(); i < size; i++) {
	137	+ javax.xml.crypto.dom.DOMStructure property =
	138	+ (javax.xml.crypto.dom.DOMStructure) content.get(i);
	139	+ DOMUtils.appendChild(propElem, property.getNode());
	140	+ }
	141	+
	142	+ parent.appendChild(propElem);
	143	+ }
	144	+
	145	+ public boolean equals(Object o) {
	146	+ if (this == o) {
	147	+ return true;
	148	+ }
	149	+
	150	+ if (!(o instanceof SignatureProperty)) {
	151	+ return false;
	152	+ }
	153	+ SignatureProperty osp = (SignatureProperty) o;
	154	+
	155	+ boolean idsEqual = (id == null ? osp.getId() == null :
	156	+ id.equals(osp.getId()));
	157	+
	158	+ return (equalsContent(osp.getContent()) &&
	159	+ target.equals(osp.getTarget()) && idsEqual);
	160	+ }
	161	+
	162	+ private boolean equalsContent(List otherContent) {
	163	+ int osize = otherContent.size();
	164	+ if (content.size() != osize) {
	165	+ return false;
	166	+ }
	167	+ for (int i = 0; i < osize; i++) {
	168	+ XMLStructure oxs = (XMLStructure) otherContent.get(i);
	169	+ XMLStructure xs = (XMLStructure) content.get(i);
	170	+ if (oxs instanceof javax.xml.crypto.dom.DOMStructure) {
	171	+ if (!(xs instanceof javax.xml.crypto.dom.DOMStructure)) {
	172	+ return false;
	173	+ }
	174	+ Node onode =
	175	+ ((javax.xml.crypto.dom.DOMStructure) oxs).getNode();
	176	+ Node node =
	177	+ ((javax.xml.crypto.dom.DOMStructure) xs).getNode();
	178	+ if (!DOMUtils.nodesEqual(node, onode)) {
	179	+ return false;
	180	+ }
	181	+ } else {
	182	+ if (!(xs.equals(oxs))) {
	183	+ return false;
	184	+ }
	185	+ }
	186	+ }
	187	+
	188	+ return true;
	189	+ }
	190	+}

java/pkg/org/jcp/xml/dsig/internal/dom/DOMSignedInfo.class+0−0

Binary file not shown.

java/pkg/org/jcp/xml/dsig/internal/dom/DOMSignedInfo.java+266−0

@@ -0,0 +1,266 @@
	1	+/*
	2	+ * reserved comment block
	3	+ * DO NOT REMOVE OR ALTER!
	4	+ */
	5	+/*
	6	+ * Copyright 2005 The Apache Software Foundation.
	7	+ *
	8	+ * Licensed under the Apache License, Version 2.0 (the "License");
	9	+ * you may not use this file except in compliance with the License.
	10	+ * You may obtain a copy of the License at
	11	+ *
	12	+ * http://www.apache.org/licenses/LICENSE-2.0
	13	+ *
	14	+ * Unless required by applicable law or agreed to in writing, software
	15	+ * distributed under the License is distributed on an "AS IS" BASIS,
	16	+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
	17	+ * See the License for the specific language governing permissions and
	18	+ * limitations under the License.
	19	+ *
	20	+ */
	21	+/*
	22	+ * Copyright (c) 2005, 2008, Oracle and/or its affiliates. All rights reserved.
	23	+ */
	24	+/*
	25	+ * $Id: DOMSignedInfo.java,v 1.2 2008/07/24 15:20:32 mullan Exp $
	26	+ */
	27	+package org.jcp.xml.dsig.internal.dom;
	28	+
	29	+import javax.xml.crypto.*;
	30	+import javax.xml.crypto.dom.DOMCryptoContext;
	31	+import javax.xml.crypto.dsig.*;
	32	+
	33	+import java.io.ByteArrayInputStream;
	34	+import java.io.ByteArrayOutputStream;
	35	+import java.io.InputStream;
	36	+import java.io.IOException;
	37	+import java.io.InputStreamReader;
	38	+import java.io.OutputStream;
	39	+import java.security.Provider;
	40	+import java.util.*;
	41	+import java.util.logging.Level;
	42	+import java.util.logging.Logger;
	43	+import org.w3c.dom.Document;
	44	+import org.w3c.dom.Element;
	45	+import org.w3c.dom.Node;
	46	+
	47	+import com.sun.org.apache.xml.internal.security.utils.Base64;
	48	+import com.sun.org.apache.xml.internal.security.utils.UnsyncBufferedOutputStream;
	49	+import com.sun.org.apache.xml.internal.security.utils.XMLUtils;
	50	+
	51	+/**
	52	+ * DOM-based implementation of SignedInfo.
	53	+ *
	54	+ * @author Sean Mullan
	55	+ */
	56	+public final class DOMSignedInfo extends DOMStructure implements SignedInfo {
	57	+
	58	+ private static Logger log = Logger.getLogger("org.jcp.xml.dsig.internal.dom");
	59	+ private List references;
	60	+ private CanonicalizationMethod canonicalizationMethod;
	61	+ private SignatureMethod signatureMethod;
	62	+ private String id;
	63	+ private Document ownerDoc;
	64	+ private Element localSiElem;
	65	+ private InputStream canonData;
	66	+
	67	+ /**
	68	+ * Creates a <code>DOMSignedInfo</code> from the specified parameters. Use
	69	+ * this constructor when the <code>Id</code> is not specified.
	70	+ *
	71	+ * @param cm the canonicalization method
	72	+ * @param sm the signature method
	73	+ * @param references the list of references. The list is copied.
	74	+ * @throws NullPointerException if
	75	+ * <code>cm</code>, <code>sm</code>, or <code>references</code> is
	76	+ * <code>null</code>
	77	+ * @throws IllegalArgumentException if <code>references</code> is empty
	78	+ * @throws ClassCastException if any of the references are not of
	79	+ * type <code>Reference</code>
	80	+ */
	81	+ public DOMSignedInfo(CanonicalizationMethod cm, SignatureMethod sm,
	82	+ List references) {
	83	+ if (cm == null \|\| sm == null \|\| references == null) {
	84	+ throw new NullPointerException();
	85	+ }
	86	+ this.canonicalizationMethod = cm;
	87	+ this.signatureMethod = sm;
	88	+ this.references = Collections.unmodifiableList
	89	+ (new ArrayList(references));
	90	+ if (this.references.isEmpty()) {
	91	+ throw new IllegalArgumentException("list of references must " +
	92	+ "contain at least one entry");
	93	+ }
	94	+ for (int i = 0, size = this.references.size(); i < size; i++) {
	95	+ Object obj = this.references.get(i);
	96	+ if (!(obj instanceof Reference)) {
	97	+ throw new ClassCastException("list of references contains " +
	98	+ "an illegal type");
	99	+ }
	100	+ }
	101	+ }
	102	+
	103	+ /**
	104	+ * Creates a <code>DOMSignedInfo</code> from the specified parameters.
	105	+ *
	106	+ * @param cm the canonicalization method
	107	+ * @param sm the signature method
	108	+ * @param references the list of references. The list is copied.
	109	+ * @param id an optional identifer that will allow this
	110	+ * <code>SignedInfo</code> to be referenced by other signatures and
	111	+ * objects
	112	+ * @throws NullPointerException if <code>cm</code>, <code>sm</code>,
	113	+ * or <code>references</code> is <code>null</code>
	114	+ * @throws IllegalArgumentException if <code>references</code> is empty
	115	+ * @throws ClassCastException if any of the references are not of
	116	+ * type <code>Reference</code>
	117	+ */
	118	+ public DOMSignedInfo(CanonicalizationMethod cm, SignatureMethod sm,
	119	+ List references, String id) {
	120	+ this(cm, sm, references);
	121	+ this.id = id;
	122	+ }
	123	+
	124	+ /**
	125	+ * Creates a <code>DOMSignedInfo</code> from an element.
	126	+ *
	127	+ * @param siElem a SignedInfo element
	128	+ */
	129	+ public DOMSignedInfo(Element siElem, XMLCryptoContext context,
	130	+ Provider provider) throws MarshalException {
	131	+ localSiElem = siElem;
	132	+ ownerDoc = siElem.getOwnerDocument();
	133	+
	134	+ // get Id attribute, if specified
	135	+ id = DOMUtils.getAttributeValue(siElem, "Id");
	136	+
	137	+ // unmarshal CanonicalizationMethod
	138	+ Element cmElem = DOMUtils.getFirstChildElement(siElem);
	139	+ canonicalizationMethod = new DOMCanonicalizationMethod
	140	+ (cmElem, context, provider);
	141	+
	142	+ // unmarshal SignatureMethod
	143	+ Element smElem = DOMUtils.getNextSiblingElement(cmElem);
	144	+ signatureMethod = DOMSignatureMethod.unmarshal(smElem);
	145	+
	146	+ // unmarshal References
	147	+ ArrayList refList = new ArrayList(5);
	148	+ Element refElem = DOMUtils.getNextSiblingElement(smElem);
	149	+ while (refElem != null) {
	150	+ refList.add(new DOMReference(refElem, context, provider));
	151	+ refElem = DOMUtils.getNextSiblingElement(refElem);
	152	+ }
	153	+ references = Collections.unmodifiableList(refList);
	154	+ }
	155	+
	156	+ public CanonicalizationMethod getCanonicalizationMethod() {
	157	+ return canonicalizationMethod;
	158	+ }
	159	+
	160	+ public SignatureMethod getSignatureMethod() {
	161	+ return signatureMethod;
	162	+ }
	163	+
	164	+ public String getId() {
	165	+ return id;
	166	+ }
	167	+
	168	+ public List getReferences() {
	169	+ return references;
	170	+ }
	171	+
	172	+ public InputStream getCanonicalizedData() {
	173	+ return canonData;
	174	+ }
	175	+
	176	+ public void canonicalize(XMLCryptoContext context,ByteArrayOutputStream bos)
	177	+ throws XMLSignatureException {
	178	+
	179	+ if (context == null) {
	180	+ throw new NullPointerException("context cannot be null");
	181	+ }
	182	+
	183	+ OutputStream os = new UnsyncBufferedOutputStream(bos);
	184	+ try {
	185	+ os.close();
	186	+ } catch (IOException e) {
	187	+ // Impossible
	188	+ }
	189	+
	190	+ DOMSubTreeData subTree = new DOMSubTreeData(localSiElem, true);
	191	+
	192	+ try {
	193	+ Data data = ((DOMCanonicalizationMethod)
	194	+ canonicalizationMethod).canonicalize(subTree, context, os);
	195	+ } catch (TransformException te) {
	196	+ throw new XMLSignatureException(te);
	197	+ }
	198	+
	199	+ byte[] signedInfoBytes = bos.toByteArray();
	200	+
	201	+ // this whole block should only be done if logging is enabled
	202	+ if (log.isLoggable(Level.FINE)) {
	203	+ InputStreamReader isr = new InputStreamReader
	204	+ (new ByteArrayInputStream(signedInfoBytes));
	205	+ char[] siBytes = new char[signedInfoBytes.length];
	206	+ try {
	207	+ isr.read(siBytes);
	208	+ log.log(Level.FINE, "Canonicalized SignedInfo:\n"
	209	+ + new String(siBytes));
	210	+ } catch (IOException ioex) {
	211	+ log.log(Level.FINE, "IOException reading SignedInfo bytes");
	212	+ }
	213	+ log.log(Level.FINE, "Data to be signed/verified:"
	214	+ + Base64.encode(signedInfoBytes));
	215	+ }
	216	+
	217	+ this.canonData = new ByteArrayInputStream(signedInfoBytes);
	218	+ }
	219	+
	220	+ public void marshal(Node parent, String dsPrefix, DOMCryptoContext context)
	221	+ throws MarshalException {
	222	+ ownerDoc = DOMUtils.getOwnerDocument(parent);
	223	+
	224	+ Element siElem = DOMUtils.createElement
	225	+ (ownerDoc, "SignedInfo", XMLSignature.XMLNS, dsPrefix);
	226	+
	227	+ // create and append CanonicalizationMethod element
	228	+ DOMCanonicalizationMethod dcm =
	229	+ (DOMCanonicalizationMethod) canonicalizationMethod;
	230	+ dcm.marshal(siElem, dsPrefix, context);
	231	+
	232	+ // create and append SignatureMethod element
	233	+ ((DOMSignatureMethod) signatureMethod).marshal
	234	+ (siElem, dsPrefix, context);
	235	+
	236	+ // create and append Reference elements
	237	+ for (int i = 0, size = references.size(); i < size; i++) {
	238	+ DOMReference reference = (DOMReference) references.get(i);
	239	+ reference.marshal(siElem, dsPrefix, context);
	240	+ }
	241	+
	242	+ // append Id attribute
	243	+ DOMUtils.setAttributeID(siElem, "Id", id);
	244	+
	245	+ parent.appendChild(siElem);
	246	+ localSiElem = siElem;
	247	+ }
	248	+
	249	+ public boolean equals(Object o) {
	250	+ if (this == o) {
	251	+ return true;
	252	+ }
	253	+
	254	+ if (!(o instanceof SignedInfo)) {
	255	+ return false;
	256	+ }
	257	+ SignedInfo osi = (SignedInfo) o;
	258	+
	259	+ boolean idEqual = (id == null ? osi.getId() == null :
	260	+ id.equals(osi.getId()));
	261	+
	262	+ return (canonicalizationMethod.equals(osi.getCanonicalizationMethod())
	263	+ && signatureMethod.equals(osi.getSignatureMethod()) &&
	264	+ references.equals(osi.getReferences()) && idEqual);
	265	+ }
	266	+}

java/pkg/org/jcp/xml/dsig/internal/dom/DOMStructure.class+0−0

Binary file not shown.

java/pkg/org/jcp/xml/dsig/internal/dom/DOMStructure.java+51−0

@@ -0,0 +1,51 @@
	1	+/*
	2	+ * reserved comment block
	3	+ * DO NOT REMOVE OR ALTER!
	4	+ */
	5	+/*
	6	+ * Copyright 2005 The Apache Software Foundation.
	7	+ *
	8	+ * Licensed under the Apache License, Version 2.0 (the "License");
	9	+ * you may not use this file except in compliance with the License.
	10	+ * You may obtain a copy of the License at
	11	+ *
	12	+ * http://www.apache.org/licenses/LICENSE-2.0
	13	+ *
	14	+ * Unless required by applicable law or agreed to in writing, software
	15	+ * distributed under the License is distributed on an "AS IS" BASIS,
	16	+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
	17	+ * See the License for the specific language governing permissions and
	18	+ * limitations under the License.
	19	+ *
	20	+ */
	21	+/*
	22	+ * Copyright (c) 2005, 2008, Oracle and/or its affiliates. All rights reserved.
	23	+ */
	24	+/*
	25	+ * $Id: DOMStructure.java,v 1.2 2008/07/24 15:20:32 mullan Exp $
	26	+ */
	27	+package org.jcp.xml.dsig.internal.dom;
	28	+
	29	+import javax.xml.crypto.MarshalException;
	30	+import javax.xml.crypto.XMLStructure;
	31	+import javax.xml.crypto.dom.DOMCryptoContext;
	32	+import org.w3c.dom.Node;
	33	+
	34	+/**
	35	+ * DOM-based abstract implementation of XMLStructure.
	36	+ *
	37	+ * @author Sean Mullan
	38	+ */
	39	+public abstract class DOMStructure implements XMLStructure {
	40	+
	41	+ public final boolean isFeatureSupported(String feature) {
	42	+ if (feature == null) {
	43	+ throw new NullPointerException();
	44	+ } else {
	45	+ return false;
	46	+ }
	47	+ }
	48	+
	49	+ public abstract void marshal(Node parent, String dsPrefix,
	50	+ DOMCryptoContext context) throws MarshalException;
	51	+}

java/pkg/org/jcp/xml/dsig/internal/dom/DOMSubTreeData$DelayedNodeIterator.class+0−0

Binary file not shown.

java/pkg/org/jcp/xml/dsig/internal/dom/DOMSubTreeData.class+0−0

Binary file not shown.

java/pkg/org/jcp/xml/dsig/internal/dom/DOMSubTreeData.java+169−0

@@ -0,0 +1,169 @@
	1	+/*
	2	+ * reserved comment block
	3	+ * DO NOT REMOVE OR ALTER!
	4	+ */
	5	+/*
	6	+ * Copyright 2006 The Apache Software Foundation.
	7	+ *
	8	+ * Licensed under the Apache License, Version 2.0 (the "License");
	9	+ * you may not use this file except in compliance with the License.
	10	+ * You may obtain a copy of the License at
	11	+ *
	12	+ * http://www.apache.org/licenses/LICENSE-2.0
	13	+ *
	14	+ * Unless required by applicable law or agreed to in writing, software
	15	+ * distributed under the License is distributed on an "AS IS" BASIS,
	16	+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
	17	+ * See the License for the specific language governing permissions and
	18	+ * limitations under the License.
	19	+ *
	20	+ */
	21	+/*
	22	+ * Copyright (c) 2005, 2008, Oracle and/or its affiliates. All rights reserved.
	23	+ */
	24	+/*
	25	+ * $Id: DOMSubTreeData.java,v 1.2 2008/07/24 15:20:32 mullan Exp $
	26	+ */
	27	+package org.jcp.xml.dsig.internal.dom;
	28	+
	29	+import javax.xml.crypto.NodeSetData;
	30	+import java.util.ArrayList;
	31	+import java.util.Iterator;
	32	+import java.util.List;
	33	+import java.util.ListIterator;
	34	+import java.util.NoSuchElementException;
	35	+import org.w3c.dom.NamedNodeMap;
	36	+import org.w3c.dom.Node;
	37	+
	38	+/**
	39	+ * This is a subtype of NodeSetData that represents a dereferenced
	40	+ * same-document URI as the root of a subdocument. The main reason is
	41	+ * for efficiency and performance, as some transforms can operate
	42	+ * directly on the subdocument and there is no need to convert it
	43	+ * first to an XPath node-set.
	44	+ */
	45	+public class DOMSubTreeData implements NodeSetData {
	46	+
	47	+ private boolean excludeComments;
	48	+ private Iterator ni;
	49	+ private Node root;
	50	+
	51	+ public DOMSubTreeData(Node root, boolean excludeComments) {
	52	+ this.root = root;
	53	+ this.ni = new DelayedNodeIterator(root, excludeComments);
	54	+ this.excludeComments = excludeComments;
	55	+ }
	56	+
	57	+ public Iterator iterator() {
	58	+ return ni;
	59	+ }
	60	+
	61	+ public Node getRoot() {
	62	+ return root;
	63	+ }
	64	+
	65	+ public boolean excludeComments() {
	66	+ return excludeComments;
	67	+ }
	68	+
	69	+ /**
	70	+ * This is an Iterator that contains a backing node-set that is
	71	+ * not populated until the caller first attempts to advance the iterator.
	72	+ */
	73	+ static class DelayedNodeIterator implements Iterator {
	74	+ private Node root;
	75	+ private List nodeSet;
	76	+ private ListIterator li;
	77	+ private boolean withComments;
	78	+
	79	+ DelayedNodeIterator(Node root, boolean excludeComments) {
	80	+ this.root = root;
	81	+ this.withComments = !excludeComments;
	82	+ }
	83	+
	84	+ public boolean hasNext() {
	85	+ if (nodeSet == null) {
	86	+ nodeSet = dereferenceSameDocumentURI(root);
	87	+ li = nodeSet.listIterator();
	88	+ }
	89	+ return li.hasNext();
	90	+ }
	91	+
	92	+ public Object next() {
	93	+ if (nodeSet == null) {
	94	+ nodeSet = dereferenceSameDocumentURI(root);
	95	+ li = nodeSet.listIterator();
	96	+ }
	97	+ if (li.hasNext()) {
	98	+ return (Node) li.next();
	99	+ } else {
	100	+ throw new NoSuchElementException();
	101	+ }
	102	+ }
	103	+
	104	+ public void remove() {
	105	+ throw new UnsupportedOperationException();
	106	+ }
	107	+
	108	+ /**
	109	+ * Dereferences a same-document URI fragment.
	110	+ *
	111	+ * @param node the node (document or element) referenced by the
	112	+ * URI fragment. If null, returns an empty set.
	113	+ * @return a set of nodes (minus any comment nodes)
	114	+ */
	115	+ private List dereferenceSameDocumentURI(Node node) {
	116	+ List nodeSet = new ArrayList();
	117	+ if (node != null) {
	118	+ nodeSetMinusCommentNodes(node, nodeSet, null);
	119	+ }
	120	+ return nodeSet;
	121	+ }
	122	+
	123	+ /**
	124	+ * Recursively traverses the subtree, and returns an XPath-equivalent
	125	+ * node-set of all nodes traversed, excluding any comment nodes,
	126	+ * if specified.
	127	+ *
	128	+ * @param node the node to traverse
	129	+ * @param nodeSet the set of nodes traversed so far
	130	+ * @param the previous sibling node
	131	+ */
	132	+ private void nodeSetMinusCommentNodes(Node node, List nodeSet,
	133	+ Node prevSibling) {
	134	+ switch (node.getNodeType()) {
	135	+ case Node.ELEMENT_NODE :
	136	+ NamedNodeMap attrs = node.getAttributes();
	137	+ if (attrs != null) {
	138	+ for (int i = 0, len = attrs.getLength(); i < len; i++) {
	139	+ nodeSet.add(attrs.item(i));
	140	+ }
	141	+ }
	142	+ nodeSet.add(node);
	143	+ case Node.DOCUMENT_NODE :
	144	+ Node pSibling = null;
	145	+ for (Node child = node.getFirstChild(); child != null;
	146	+ child = child.getNextSibling()) {
	147	+ nodeSetMinusCommentNodes(child, nodeSet, pSibling);
	148	+ pSibling = child;
	149	+ }
	150	+ break;
	151	+ case Node.TEXT_NODE :
	152	+ case Node.CDATA_SECTION_NODE:
	153	+ // emulate XPath which only returns the first node in
	154	+ // contiguous text/cdata nodes
	155	+ if (prevSibling != null &&
	156	+ (prevSibling.getNodeType() == Node.TEXT_NODE \|\|
	157	+ prevSibling.getNodeType() == Node.CDATA_SECTION_NODE)){ return;
	158	+ }
	159	+ case Node.PROCESSING_INSTRUCTION_NODE :
	160	+ nodeSet.add(node);
	161	+ break;
	162	+ case Node.COMMENT_NODE:
	163	+ if (withComments) {
	164	+ nodeSet.add(node);
	165	+ }
	166	+ }
	167	+ }
	168	+ }
	169	+}

java/pkg/org/jcp/xml/dsig/internal/dom/DOMTransform.class+0−0

Binary file not shown.

java/pkg/org/jcp/xml/dsig/internal/dom/DOMTransform.java+193−0

@@ -0,0 +1,193 @@
	1	+/*
	2	+ * reserved comment block
	3	+ * DO NOT REMOVE OR ALTER!
	4	+ */
	5	+/*
	6	+ * Copyright 2005 The Apache Software Foundation.
	7	+ *
	8	+ * Licensed under the Apache License, Version 2.0 (the "License");
	9	+ * you may not use this file except in compliance with the License.
	10	+ * You may obtain a copy of the License at
	11	+ *
	12	+ * http://www.apache.org/licenses/LICENSE-2.0
	13	+ *
	14	+ * Unless required by applicable law or agreed to in writing, software
	15	+ * distributed under the License is distributed on an "AS IS" BASIS,
	16	+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
	17	+ * See the License for the specific language governing permissions and
	18	+ * limitations under the License.
	19	+ *
	20	+ */
	21	+/*
	22	+ * Copyright (c) 2005, 2008, Oracle and/or its affiliates. All rights reserved.
	23	+ */
	24	+/*
	25	+ * $Id: DOMTransform.java,v 1.2 2008/07/24 15:20:32 mullan Exp $
	26	+ */
	27	+package org.jcp.xml.dsig.internal.dom;
	28	+
	29	+import java.io.OutputStream;
	30	+import java.security.InvalidAlgorithmParameterException;
	31	+import java.security.NoSuchAlgorithmException;
	32	+import java.security.Provider;
	33	+import java.security.spec.AlgorithmParameterSpec;
	34	+
	35	+import org.w3c.dom.Document;
	36	+import org.w3c.dom.Element;
	37	+import org.w3c.dom.Node;
	38	+import org.w3c.dom.NodeList;
	39	+
	40	+import javax.xml.crypto.*;
	41	+import javax.xml.crypto.dsig.*;
	42	+import javax.xml.crypto.dom.DOMCryptoContext;
	43	+import javax.xml.crypto.dsig.dom.DOMSignContext;
	44	+import javax.xml.crypto.dsig.spec.TransformParameterSpec;
	45	+
	46	+/**
	47	+ * DOM-based abstract implementation of Transform.
	48	+ *
	49	+ * @author Sean Mullan
	50	+ */
	51	+public class DOMTransform extends DOMStructure implements Transform {
	52	+
	53	+ protected TransformService spi;
	54	+
	55	+ /**
	56	+ * Creates a <code>DOMTransform</code>.
	57	+ *
	58	+ * @param spi the TransformService
	59	+ */
	60	+ public DOMTransform(TransformService spi) {
	61	+ this.spi = spi;
	62	+ }
	63	+
	64	+ /**
	65	+ * Creates a <code>DOMTransform</code> from an element. This constructor
	66	+ * invokes the abstract {@link #unmarshalParams unmarshalParams} method to
	67	+ * unmarshal any algorithm-specific input parameters.
	68	+ *
	69	+ * @param transElem a Transform element
	70	+ */
	71	+ public DOMTransform(Element transElem, XMLCryptoContext context,
	72	+ Provider provider) throws MarshalException {
	73	+ String algorithm = DOMUtils.getAttributeValue(transElem, "Algorithm");
	74	+ try {
	75	+ spi = TransformService.getInstance(algorithm, "DOM");
	76	+ } catch (NoSuchAlgorithmException e1) {
	77	+ try {
	78	+ spi = TransformService.getInstance(algorithm, "DOM", provider);
	79	+ } catch (NoSuchAlgorithmException e2) {
	80	+ throw new MarshalException(e2);
	81	+ }
	82	+ }
	83	+ try {
	84	+ spi.init(new javax.xml.crypto.dom.DOMStructure(transElem), context);
	85	+ } catch (InvalidAlgorithmParameterException iape) {
	86	+ throw new MarshalException(iape);
	87	+ }
	88	+ }
	89	+
	90	+ public final AlgorithmParameterSpec getParameterSpec() {
	91	+ return spi.getParameterSpec();
	92	+ }
	93	+
	94	+ public final String getAlgorithm() {
	95	+ return spi.getAlgorithm();
	96	+ }
	97	+
	98	+ /**
	99	+ * This method invokes the abstract {@link #marshalParams marshalParams}
	100	+ * method to marshal any algorithm-specific parameters.
	101	+ */
	102	+ public void marshal(Node parent, String dsPrefix, DOMCryptoContext context)
	103	+ throws MarshalException {
	104	+ Document ownerDoc = DOMUtils.getOwnerDocument(parent);
	105	+
	106	+ Element transformElem = null;
	107	+ if (parent.getLocalName().equals("Transforms")) {
	108	+ transformElem = DOMUtils.createElement
	109	+ (ownerDoc, "Transform", XMLSignature.XMLNS, dsPrefix);
	110	+ } else {
	111	+ transformElem = DOMUtils.createElement
	112	+ (ownerDoc, "CanonicalizationMethod", XMLSignature.XMLNS, dsPrefix);
	113	+ }
	114	+ DOMUtils.setAttribute(transformElem, "Algorithm", getAlgorithm());
	115	+
	116	+ spi.marshalParams
	117	+ (new javax.xml.crypto.dom.DOMStructure(transformElem), context);
	118	+
	119	+ parent.appendChild(transformElem);
	120	+ }
	121	+
	122	+ /**
	123	+ * Transforms the specified data using the underlying transform algorithm.
	124	+ *
	125	+ * @param data the data to be transformed
	126	+ * @param sc the <code>XMLCryptoContext</code> containing
	127	+ * additional context (may be <code>null</code> if not applicable)
	128	+ * @return the transformed data
	129	+ * @throws NullPointerException if <code>data</code> is <code>null</code>
	130	+ * @throws XMLSignatureException if an unexpected error occurs while
	131	+ * executing the transform
	132	+ */
	133	+ public Data transform(Data data, XMLCryptoContext xc)
	134	+ throws TransformException {
	135	+ return spi.transform(data, xc);
	136	+ }
	137	+
	138	+ /**
	139	+ * Transforms the specified data using the underlying transform algorithm.
	140	+ *
	141	+ * @param data the data to be transformed
	142	+ * @param sc the <code>XMLCryptoContext</code> containing
	143	+ * additional context (may be <code>null</code> if not applicable)
	144	+ * @param os the <code>OutputStream</code> that should be used to write
	145	+ * the transformed data to
	146	+ * @return the transformed data
	147	+ * @throws NullPointerException if <code>data</code> is <code>null</code>
	148	+ * @throws XMLSignatureException if an unexpected error occurs while
	149	+ * executing the transform
	150	+ */
	151	+ public Data transform(Data data, XMLCryptoContext xc, OutputStream os)
	152	+ throws TransformException {
	153	+ return spi.transform(data, xc, os);
	154	+ }
	155	+
	156	+ public boolean equals(Object o) {
	157	+ if (this == o) {
	158	+ return true;
	159	+ }
	160	+
	161	+ if (!(o instanceof Transform)) {
	162	+ return false;
	163	+ }
	164	+ Transform otransform = (Transform) o;
	165	+
	166	+ return (getAlgorithm().equals(otransform.getAlgorithm()) &&
	167	+ DOMUtils.paramsEqual
	168	+ (getParameterSpec(), otransform.getParameterSpec()));
	169	+ }
	170	+
	171	+ /**
	172	+ * Transforms the specified data using the underlying transform algorithm.
	173	+ * This method invokes the {@link #marshal marshal} method and passes it
	174	+ * the specified <code>DOMSignContext</code> before transforming the data.
	175	+ *
	176	+ * @param data the data to be transformed
	177	+ * @param sc the <code>XMLCryptoContext</code> containing
	178	+ * additional context (may be <code>null</code> if not applicable)
	179	+ * @param context the marshalling context
	180	+ * @return the transformed data
	181	+ * @throws MarshalException if an exception occurs while marshalling
	182	+ * @throws NullPointerException if <code>data</code> or <code>context</code>
	183	+ * is <code>null</code>
	184	+ * @throws XMLSignatureException if an unexpected error occurs while
	185	+ * executing the transform
	186	+ */
	187	+ Data transform(Data data, XMLCryptoContext xc, DOMSignContext context)
	188	+ throws MarshalException, TransformException {
	189	+ marshal(context.getParent(),
	190	+ DOMUtils.getSignaturePrefix(context), context);
	191	+ return transform(data, xc);
	192	+ }
	193	+}

java/pkg/org/jcp/xml/dsig/internal/dom/DOMURIDereferencer.class+0−0

Binary file not shown.

java/pkg/org/jcp/xml/dsig/internal/dom/DOMURIDereferencer.java+105−0

@@ -0,0 +1,105 @@
	1	+/*
	2	+ * reserved comment block
	3	+ * DO NOT REMOVE OR ALTER!
	4	+ */
	5	+/*
	6	+ * Copyright 2005 The Apache Software Foundation.
	7	+ *
	8	+ * Licensed under the Apache License, Version 2.0 (the "License");
	9	+ * you may not use this file except in compliance with the License.
	10	+ * You may obtain a copy of the License at
	11	+ *
	12	+ * http://www.apache.org/licenses/LICENSE-2.0
	13	+ *
	14	+ * Unless required by applicable law or agreed to in writing, software
	15	+ * distributed under the License is distributed on an "AS IS" BASIS,
	16	+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
	17	+ * See the License for the specific language governing permissions and
	18	+ * limitations under the License.
	19	+ *
	20	+ */
	21	+/*
	22	+ * Copyright (c) 2005, 2008, Oracle and/or its affiliates. All rights reserved.
	23	+ */
	24	+/*
	25	+ * $Id: DOMURIDereferencer.java,v 1.2 2008/07/24 15:20:32 mullan Exp $
	26	+ */
	27	+package org.jcp.xml.dsig.internal.dom;
	28	+
	29	+import org.w3c.dom.Attr;
	30	+import org.w3c.dom.Element;
	31	+import org.w3c.dom.Node;
	32	+
	33	+import com.sun.org.apache.xml.internal.security.Init;
	34	+import com.sun.org.apache.xml.internal.security.utils.IdResolver;
	35	+import com.sun.org.apache.xml.internal.security.utils.resolver.ResourceResolver;
	36	+import com.sun.org.apache.xml.internal.security.signature.XMLSignatureInput;
	37	+
	38	+import javax.xml.crypto.*;
	39	+import javax.xml.crypto.dom.*;
	40	+import javax.xml.crypto.dsig.*;
	41	+
	42	+/**
	43	+ * DOM-based implementation of URIDereferencer.
	44	+ *
	45	+ * @author Sean Mullan
	46	+ */
	47	+public class DOMURIDereferencer implements URIDereferencer {
	48	+
	49	+ static final URIDereferencer INSTANCE = new DOMURIDereferencer();
	50	+
	51	+ private DOMURIDereferencer() {
	52	+ // need to call com.sun.org.apache.xml.internal.security.Init.init()
	53	+ // before calling any apache security code
	54	+ Init.init();
	55	+ }
	56	+
	57	+ public Data dereference(URIReference uriRef, XMLCryptoContext context)
	58	+ throws URIReferenceException {
	59	+
	60	+ if (uriRef == null) {
	61	+ throw new NullPointerException("uriRef cannot be null");
	62	+ }
	63	+ if (context == null) {
	64	+ throw new NullPointerException("context cannot be null");
	65	+ }
	66	+
	67	+ DOMURIReference domRef = (DOMURIReference) uriRef;
	68	+ Attr uriAttr = (Attr) domRef.getHere();
	69	+ String uri = uriRef.getURI();
	70	+ DOMCryptoContext dcc = (DOMCryptoContext) context;
	71	+
	72	+ // Check if same-document URI and register ID
	73	+ if (uri != null && uri.length() != 0 && uri.charAt(0) == '#') {
	74	+ String id = uri.substring(1);
	75	+
	76	+ if (id.startsWith("xpointer(id(")) {
	77	+ int i1 = id.indexOf('\'');
	78	+ int i2 = id.indexOf('\'', i1+1);
	79	+ id = id.substring(i1+1, i2);
	80	+ }
	81	+
	82	+ // this is a bit of a hack to check for registered
	83	+ // IDRefs and manually register them with Apache's IdResolver
	84	+ // map which includes builtin schema knowledge of DSig/Enc IDs
	85	+ Node referencedElem = dcc.getElementById(id);
	86	+ if (referencedElem != null) {
	87	+ IdResolver.registerElementById((Element) referencedElem, id);
	88	+ }
	89	+ }
	90	+
	91	+ try {
	92	+ String baseURI = context.getBaseURI();
	93	+ ResourceResolver apacheResolver =
	94	+ ResourceResolver.getInstance(uriAttr, baseURI);
	95	+ XMLSignatureInput in = apacheResolver.resolve(uriAttr, baseURI);
	96	+ if (in.isOctetStream()) {
	97	+ return new ApacheOctetStreamData(in);
	98	+ } else {
	99	+ return new ApacheNodeSetData(in);
	100	+ }
	101	+ } catch (Exception e) {
	102	+ throw new URIReferenceException(e);
	103	+ }
	104	+ }
	105	+}

java/pkg/org/jcp/xml/dsig/internal/dom/DOMUtils$NodeSet$1.class+0−0

Binary file not shown.

java/pkg/org/jcp/xml/dsig/internal/dom/DOMUtils$NodeSet.class+0−0

Binary file not shown.

java/pkg/org/jcp/xml/dsig/internal/dom/DOMUtils.class+0−0

Binary file not shown.

java/pkg/org/jcp/xml/dsig/internal/dom/DOMUtils.java+363−0

@@ -0,0 +1,363 @@
	1	+/*
	2	+ * reserved comment block
	3	+ * DO NOT REMOVE OR ALTER!
	4	+ */
	5	+/*
	6	+ * Copyright 2005 The Apache Software Foundation.
	7	+ *
	8	+ * Licensed under the Apache License, Version 2.0 (the "License");
	9	+ * you may not use this file except in compliance with the License.
	10	+ * You may obtain a copy of the License at
	11	+ *
	12	+ * http://www.apache.org/licenses/LICENSE-2.0
	13	+ *
	14	+ * Unless required by applicable law or agreed to in writing, software
	15	+ * distributed under the License is distributed on an "AS IS" BASIS,
	16	+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
	17	+ * See the License for the specific language governing permissions and
	18	+ * limitations under the License.
	19	+ *
	20	+ */
	21	+/*
	22	+ * Copyright (c) 2005, 2008, Oracle and/or its affiliates. All rights reserved.
	23	+ */
	24	+/*
	25	+ * $Id: DOMUtils.java,v 1.2 2008/07/24 15:20:32 mullan Exp $
	26	+ */
	27	+package org.jcp.xml.dsig.internal.dom;
	28	+
	29	+import java.util.*;
	30	+import java.security.spec.AlgorithmParameterSpec;
	31	+import org.w3c.dom.Attr;
	32	+import org.w3c.dom.Document;
	33	+import org.w3c.dom.Element;
	34	+import org.w3c.dom.Node;
	35	+import org.w3c.dom.NodeList;
	36	+import javax.xml.crypto.*;
	37	+import javax.xml.crypto.dsig.dom.DOMSignContext;
	38	+import javax.xml.crypto.dsig.*;
	39	+import javax.xml.crypto.dsig.spec.*;
	40	+
	41	+import com.sun.org.apache.xml.internal.security.utils.IdResolver;
	42	+
	43	+/**
	44	+ * Useful static DOM utility methods.
	45	+ *
	46	+ * @author Sean Mullan
	47	+ */
	48	+public class DOMUtils {
	49	+
	50	+ // class cannot be instantiated
	51	+ private DOMUtils() {}
	52	+
	53	+ /**
	54	+ * Returns the owner document of the specified node.
	55	+ *
	56	+ * @param node the node
	57	+ * @return the owner document
	58	+ */
	59	+ public static Document getOwnerDocument(Node node) {
	60	+ if (node.getNodeType() == Node.DOCUMENT_NODE) {
	61	+ return (Document) node;
	62	+ } else {
	63	+ return node.getOwnerDocument();
	64	+ }
	65	+ }
	66	+
	67	+ /**
	68	+ * Creates an element in the specified namespace, with the specified tag
	69	+ * and namespace prefix.
	70	+ *
	71	+ * @param doc the owner document
	72	+ * @param tag the tag
	73	+ * @param nsURI the namespace URI
	74	+ * @param prefix the namespace prefix
	75	+ * @return the newly created element
	76	+ */
	77	+ public static Element createElement(Document doc, String tag, String nsURI,
	78	+ String prefix) {
	79	+ String qName = (prefix == null \|\| prefix.length() == 0)
	80	+ ? tag : prefix + ":" + tag;
	81	+ return doc.createElementNS(nsURI, qName);
	82	+ }
	83	+
	84	+ /**
	85	+ * Sets an element's attribute (using DOM level 2) with the
	86	+ * specified value and namespace prefix.
	87	+ *
	88	+ * @param elem the element to set the attribute on
	89	+ * @param name the name of the attribute
	90	+ * @param value the attribute value. If null, no attribute is set.
	91	+ */
	92	+ public static void setAttribute(Element elem, String name, String value) {
	93	+ if (value == null) return;
	94	+ elem.setAttributeNS(null, name, value);
	95	+ }
	96	+
	97	+ /**
	98	+ * Sets an element's attribute (using DOM level 2) with the
	99	+ * specified value and namespace prefix AND registers the ID value with
	100	+ * the specified element. This is for resolving same-document
	101	+ * ID references.
	102	+ *
	103	+ * @param elem the element to set the attribute on
	104	+ * @param name the name of the attribute
	105	+ * @param value the attribute value. If null, no attribute is set.
	106	+ */
	107	+ public static void setAttributeID(Element elem, String name, String value) {
	108	+ if (value == null) return;
	109	+ elem.setAttributeNS(null, name, value);
	110	+ IdResolver.registerElementById(elem, value);
	111	+ }
	112	+
	113	+ /**
	114	+ * Returns the first child element of the specified node, or null if there
	115	+ * is no such element.
	116	+ *
	117	+ * @param node the node
	118	+ * @return the first child element of the specified node, or null if there
	119	+ * is no such element
	120	+ * @throws NullPointerException if <code>node == null</code>
	121	+ */
	122	+ public static Element getFirstChildElement(Node node) {
	123	+ Node child = node.getFirstChild();
	124	+ while (child != null && child.getNodeType() != Node.ELEMENT_NODE) {
	125	+ child = child.getNextSibling();
	126	+ }
	127	+ return (Element) child;
	128	+ }
	129	+
	130	+ /**
	131	+ * Returns the last child element of the specified node, or null if there
	132	+ * is no such element.
	133	+ *
	134	+ * @param node the node
	135	+ * @return the last child element of the specified node, or null if there
	136	+ * is no such element
	137	+ * @throws NullPointerException if <code>node == null</code>
	138	+ */
	139	+ public static Element getLastChildElement(Node node) {
	140	+ Node child = node.getLastChild();
	141	+ while (child != null && child.getNodeType() != Node.ELEMENT_NODE) {
	142	+ child = child.getPreviousSibling();
	143	+ }
	144	+ return (Element) child;
	145	+ }
	146	+
	147	+ /**
	148	+ * Returns the next sibling element of the specified node, or null if there
	149	+ * is no such element.
	150	+ *
	151	+ * @param node the node
	152	+ * @return the next sibling element of the specified node, or null if there
	153	+ * is no such element
	154	+ * @throws NullPointerException if <code>node == null</code>
	155	+ */
	156	+ public static Element getNextSiblingElement(Node node) {
	157	+ Node sibling = node.getNextSibling();
	158	+ while (sibling != null && sibling.getNodeType() != Node.ELEMENT_NODE) {
	159	+ sibling = sibling.getNextSibling();
	160	+ }
	161	+ return (Element) sibling;
	162	+ }
	163	+
	164	+ /**
	165	+ * Returns the attribute value for the attribute with the specified name.
	166	+ * Returns null if there is no such attribute, or
	167	+ * the empty string if the attribute value is empty.
	168	+ *
	169	+ * <p>This works around a limitation of the DOM
	170	+ * <code>Element.getAttributeNode</code> method, which does not distinguish
	171	+ * between an unspecified attribute and an attribute with a value of
	172	+ * "" (it returns "" for both cases).
	173	+ *
	174	+ * @param elem the element containing the attribute
	175	+ * @param name the name of the attribute
	176	+ * @return the attribute value (may be null if unspecified)
	177	+ */
	178	+ public static String getAttributeValue(Element elem, String name) {
	179	+ Attr attr = elem.getAttributeNodeNS(null, name);
	180	+ return (attr == null) ? null : attr.getValue();
	181	+ }
	182	+
	183	+ /**
	184	+ * Returns a Set of <code>Node</code>s, backed by the specified
	185	+ * <code>NodeList</code>.
	186	+ *
	187	+ * @param nl the NodeList
	188	+ * @return a Set of Nodes
	189	+ */
	190	+ public static Set nodeSet(NodeList nl) {
	191	+ return new NodeSet(nl);
	192	+ }
	193	+
	194	+ static class NodeSet extends AbstractSet {
	195	+ private NodeList nl;
	196	+ public NodeSet(NodeList nl) {
	197	+ this.nl = nl;
	198	+ }
	199	+
	200	+ public int size() { return nl.getLength(); }
	201	+ public Iterator iterator() {
	202	+ return new Iterator() {
	203	+ int index = 0;
	204	+
	205	+ public void remove() {
	206	+ throw new UnsupportedOperationException();
	207	+ }
	208	+ public Object next() {
	209	+ if (!hasNext()) {
	210	+ throw new NoSuchElementException();
	211	+ }
	212	+ return nl.item(index++);
	213	+ }
	214	+ public boolean hasNext() {
	215	+ return index < nl.getLength() ? true : false;
	216	+ }
	217	+ };
	218	+ }
	219	+ }
	220	+
	221	+ /**
	222	+ * Returns the prefix associated with the specified namespace URI
	223	+ *
	224	+ * @param context contains the namespace map
	225	+ * @param nsURI the namespace URI
	226	+ * @return the prefix associated with the specified namespace URI, or
	227	+ * null if not set
	228	+ */
	229	+ public static String getNSPrefix(XMLCryptoContext context, String nsURI) {
	230	+ if (context != null) {
	231	+ return context.getNamespacePrefix
	232	+ (nsURI, context.getDefaultNamespacePrefix());
	233	+ } else {
	234	+ return null;
	235	+ }
	236	+ }
	237	+
	238	+ /**
	239	+ * Returns the prefix associated with the XML Signature namespace URI
	240	+ *
	241	+ * @param context contains the namespace map
	242	+ * @return the prefix associated with the specified namespace URI, or
	243	+ * null if not set
	244	+ */
	245	+ public static String getSignaturePrefix(XMLCryptoContext context) {
	246	+ return getNSPrefix(context, XMLSignature.XMLNS);
	247	+ }
	248	+
	249	+ /**
	250	+ * Removes all children nodes from the specified node.
	251	+ *
	252	+ * @param node the parent node whose children are to be removed
	253	+ */
	254	+ public static void removeAllChildren(Node node) {
	255	+ NodeList children = node.getChildNodes();
	256	+ for (int i = 0, length = children.getLength(); i < length; i++) {
	257	+ node.removeChild(children.item(i));
	258	+ }
	259	+ }
	260	+
	261	+ /**
	262	+ * Compares 2 nodes for equality. Implementation is not complete.
	263	+ */
	264	+ public static boolean nodesEqual(Node thisNode, Node otherNode) {
	265	+ if (thisNode == otherNode) {
	266	+ return true;
	267	+ }
	268	+ if (thisNode.getNodeType() != otherNode.getNodeType()) {
	269	+ return false;
	270	+ }
	271	+ // FIXME - test content, etc
	272	+ return true;
	273	+ }
	274	+
	275	+ /**
	276	+ * Checks if child element has same owner document before
	277	+ * appending to the parent, and imports it to the parent's document
	278	+ * if necessary.
	279	+ */
	280	+ public static void appendChild(Node parent, Node child) {
	281	+ Document ownerDoc = getOwnerDocument(parent);
	282	+ if (child.getOwnerDocument() != ownerDoc) {
	283	+ parent.appendChild(ownerDoc.importNode(child, true));
	284	+ } else {
	285	+ parent.appendChild(child);
	286	+ }
	287	+ }
	288	+
	289	+ public static boolean paramsEqual(AlgorithmParameterSpec spec1,
	290	+ AlgorithmParameterSpec spec2) {
	291	+ if (spec1 == spec2) {
	292	+ return true;
	293	+ }
	294	+ if (spec1 instanceof XPathFilter2ParameterSpec &&
	295	+ spec2 instanceof XPathFilter2ParameterSpec) {
	296	+ return paramsEqual((XPathFilter2ParameterSpec) spec1,
	297	+ (XPathFilter2ParameterSpec) spec2);
	298	+ }
	299	+ if (spec1 instanceof ExcC14NParameterSpec &&
	300	+ spec2 instanceof ExcC14NParameterSpec) {
	301	+ return paramsEqual((ExcC14NParameterSpec) spec1,
	302	+ (ExcC14NParameterSpec) spec2);
	303	+ }
	304	+ if (spec1 instanceof XPathFilterParameterSpec &&
	305	+ spec2 instanceof XPathFilterParameterSpec) {
	306	+ return paramsEqual((XPathFilterParameterSpec) spec1,
	307	+ (XPathFilterParameterSpec) spec2);
	308	+ }
	309	+ if (spec1 instanceof XSLTTransformParameterSpec &&
	310	+ spec2 instanceof XSLTTransformParameterSpec) {
	311	+ return paramsEqual((XSLTTransformParameterSpec) spec1,
	312	+ (XSLTTransformParameterSpec) spec2);
	313	+ }
	314	+ return false;
	315	+ }
	316	+
	317	+ private static boolean paramsEqual(XPathFilter2ParameterSpec spec1,
	318	+ XPathFilter2ParameterSpec spec2) {
	319	+
	320	+ List types = spec1.getXPathList();
	321	+ List otypes = spec2.getXPathList();
	322	+ int size = types.size();
	323	+ if (size != otypes.size()) {
	324	+ return false;
	325	+ }
	326	+ for (int i = 0; i < size; i++) {
	327	+ XPathType type = (XPathType) types.get(i);
	328	+ XPathType otype = (XPathType) otypes.get(i);
	329	+ if (!type.getExpression().equals(otype.getExpression()) \|\|
	330	+ !type.getNamespaceMap().equals(otype.getNamespaceMap()) \|\|
	331	+ type.getFilter() != otype.getFilter()) {
	332	+ return false;
	333	+ }
	334	+ }
	335	+ return true;
	336	+ }
	337	+
	338	+ private static boolean paramsEqual(ExcC14NParameterSpec spec1,
	339	+ ExcC14NParameterSpec spec2) {
	340	+ return spec1.getPrefixList().equals(spec2.getPrefixList());
	341	+ }
	342	+
	343	+ private static boolean paramsEqual(XPathFilterParameterSpec spec1,
	344	+ XPathFilterParameterSpec spec2) {
	345	+ return (spec1.getXPath().equals(spec2.getXPath()) &&
	346	+ spec1.getNamespaceMap().equals(spec2.getNamespaceMap()));
	347	+ }
	348	+
	349	+ private static boolean paramsEqual(XSLTTransformParameterSpec spec1,
	350	+ XSLTTransformParameterSpec spec2) {
	351	+
	352	+ XMLStructure ostylesheet = spec2.getStylesheet();
	353	+ if (!(ostylesheet instanceof javax.xml.crypto.dom.DOMStructure)) {
	354	+ return false;
	355	+ }
	356	+ Node ostylesheetElem =
	357	+ ((javax.xml.crypto.dom.DOMStructure) ostylesheet).getNode();
	358	+ XMLStructure stylesheet = spec1.getStylesheet();
	359	+ Node stylesheetElem =
	360	+ ((javax.xml.crypto.dom.DOMStructure) stylesheet).getNode();
	361	+ return nodesEqual(stylesheetElem, ostylesheetElem);
	362	+ }
	363	+}

java/pkg/org/jcp/xml/dsig/internal/dom/DOMX509Data.class+0−0

Binary file not shown.

java/pkg/org/jcp/xml/dsig/internal/dom/DOMX509Data.java+285−0

@@ -0,0 +1,285 @@
	1	+/*
	2	+ * reserved comment block
	3	+ * DO NOT REMOVE OR ALTER!
	4	+ */
	5	+/*
	6	+ * Copyright 2005 The Apache Software Foundation.
	7	+ *
	8	+ * Licensed under the Apache License, Version 2.0 (the "License");
	9	+ * you may not use this file except in compliance with the License.
	10	+ * You may obtain a copy of the License at
	11	+ *
	12	+ * http://www.apache.org/licenses/LICENSE-2.0
	13	+ *
	14	+ * Unless required by applicable law or agreed to in writing, software
	15	+ * distributed under the License is distributed on an "AS IS" BASIS,
	16	+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
	17	+ * See the License for the specific language governing permissions and
	18	+ * limitations under the License.
	19	+ *
	20	+ */
	21	+/*
	22	+ * Copyright (c) 2005, 2008, Oracle and/or its affiliates. All rights reserved.
	23	+ */
	24	+/*
	25	+ * $Id: DOMX509Data.java,v 1.2 2008/07/24 15:20:32 mullan Exp $
	26	+ */
	27	+package org.jcp.xml.dsig.internal.dom;
	28	+
	29	+import java.io.ByteArrayInputStream;
	30	+import java.security.cert.*;
	31	+import java.util.*;
	32	+import javax.xml.crypto.*;
	33	+import javax.xml.crypto.dom.DOMCryptoContext;
	34	+import javax.xml.crypto.dsig.*;
	35	+import javax.xml.crypto.dsig.keyinfo.X509IssuerSerial;
	36	+import javax.xml.crypto.dsig.keyinfo.X509Data;
	37	+import javax.security.auth.x500.X500Principal;
	38	+import org.w3c.dom.Document;
	39	+import org.w3c.dom.Element;
	40	+import org.w3c.dom.Node;
	41	+import org.w3c.dom.NodeList;
	42	+
	43	+import com.sun.org.apache.xml.internal.security.exceptions.Base64DecodingException;
	44	+import com.sun.org.apache.xml.internal.security.utils.Base64;
	45	+
	46	+/**
	47	+ * DOM-based implementation of X509Data.
	48	+ *
	49	+ * @author Sean Mullan
	50	+ */
	51	+//@@@ check for illegal combinations of data violating MUSTs in W3c spec
	52	+public final class DOMX509Data extends DOMStructure implements X509Data {
	53	+
	54	+ private final List content;
	55	+ private CertificateFactory cf;
	56	+
	57	+ /**
	58	+ * Creates a DOMX509Data.
	59	+ *
	60	+ * @param content a list of one or more X.509 data types. Valid types are
	61	+ * {@link String} (subject names), <code>byte[]</code> (subject key ids),
	62	+ * {@link java.security.cert.X509Certificate}, {@link X509CRL},
	63	+ * or {@link javax.xml.dsig.XMLStructure} ({@link X509IssuerSerial}
	64	+ * objects or elements from an external namespace). The list is
	65	+ * defensively copied to protect against subsequent modification.
	66	+ * @return a <code>X509Data</code>
	67	+ * @throws NullPointerException if <code>content</code> is <code>null</code>
	68	+ * @throws IllegalArgumentException if <code>content</code> is empty
	69	+ * @throws ClassCastException if <code>content</code> contains any entries
	70	+ * that are not of one of the valid types mentioned above
	71	+ */
	72	+ public DOMX509Data(List content) {
	73	+ if (content == null) {
	74	+ throw new NullPointerException("content cannot be null");
	75	+ }
	76	+ List contentCopy = new ArrayList(content);
	77	+ if (contentCopy.isEmpty()) {
	78	+ throw new IllegalArgumentException("content cannot be empty");
	79	+ }
	80	+ for (int i = 0, size = contentCopy.size(); i < size; i++) {
	81	+ Object x509Type = contentCopy.get(i);
	82	+ if (x509Type instanceof String) {
	83	+ new X500Principal((String) x509Type);
	84	+ } else if (!(x509Type instanceof byte[]) &&
	85	+ !(x509Type instanceof X509Certificate) &&
	86	+ !(x509Type instanceof X509CRL) &&
	87	+ !(x509Type instanceof XMLStructure)) {
	88	+ throw new ClassCastException
	89	+ ("content["+i+"] is not a valid X509Data type");
	90	+ }
	91	+ }
	92	+ this.content = Collections.unmodifiableList(contentCopy);
	93	+ }
	94	+
	95	+ /**
	96	+ * Creates a <code>DOMX509Data</code> from an element.
	97	+ *
	98	+ * @param xdElem an X509Data element
	99	+ * @throws MarshalException if there is an error while unmarshalling
	100	+ */
	101	+ public DOMX509Data(Element xdElem) throws MarshalException {
	102	+ // get all children nodes
	103	+ NodeList nl = xdElem.getChildNodes();
	104	+ int length = nl.getLength();
	105	+ List content = new ArrayList(length);
	106	+ for (int i = 0; i < length; i++) {
	107	+ Node child = nl.item(i);
	108	+ // ignore all non-Element nodes
	109	+ if (child.getNodeType() != Node.ELEMENT_NODE) {
	110	+ continue;
	111	+ }
	112	+
	113	+ Element childElem = (Element) child;
	114	+ String localName = childElem.getLocalName();
	115	+ if (localName.equals("X509Certificate")) {
	116	+ content.add(unmarshalX509Certificate(childElem));
	117	+ } else if (localName.equals("X509IssuerSerial")) {
	118	+ content.add(new DOMX509IssuerSerial(childElem));
	119	+ } else if (localName.equals("X509SubjectName")) {
	120	+ content.add(childElem.getFirstChild().getNodeValue());
	121	+ } else if (localName.equals("X509SKI")) {
	122	+ try {
	123	+ content.add(Base64.decode(childElem));
	124	+ } catch (Base64DecodingException bde) {
	125	+ throw new MarshalException("cannot decode X509SKI", bde);
	126	+ }
	127	+ } else if (localName.equals("X509CRL")) {
	128	+ content.add(unmarshalX509CRL(childElem));
	129	+ } else {
	130	+ content.add(new javax.xml.crypto.dom.DOMStructure(childElem));
	131	+ }
	132	+ }
	133	+ this.content = Collections.unmodifiableList(content);
	134	+ }
	135	+
	136	+ public List getContent() {
	137	+ return content;
	138	+ }
	139	+
	140	+ public void marshal(Node parent, String dsPrefix, DOMCryptoContext context)
	141	+ throws MarshalException {
	142	+ Document ownerDoc = DOMUtils.getOwnerDocument(parent);
	143	+
	144	+ Element xdElem = DOMUtils.createElement
	145	+ (ownerDoc, "X509Data", XMLSignature.XMLNS, dsPrefix);
	146	+
	147	+ // append children and preserve order
	148	+ for (int i = 0, size = content.size(); i < size; i++) {
	149	+ Object object = content.get(i);
	150	+ if (object instanceof X509Certificate) {
	151	+ marshalCert((X509Certificate) object,xdElem,ownerDoc,dsPrefix);
	152	+ } else if (object instanceof XMLStructure) {
	153	+ if (object instanceof X509IssuerSerial) {
	154	+ ((DOMX509IssuerSerial) object).marshal
	155	+ (xdElem, dsPrefix, context);
	156	+ } else {
	157	+ javax.xml.crypto.dom.DOMStructure domContent =
	158	+ (javax.xml.crypto.dom.DOMStructure) object;
	159	+ DOMUtils.appendChild(xdElem, domContent.getNode());
	160	+ }
	161	+ } else if (object instanceof byte[]) {
	162	+ marshalSKI((byte[]) object, xdElem, ownerDoc, dsPrefix);
	163	+ } else if (object instanceof String) {
	164	+ marshalSubjectName((String) object, xdElem, ownerDoc,dsPrefix);
	165	+ } else if (object instanceof X509CRL) {
	166	+ marshalCRL((X509CRL) object, xdElem, ownerDoc, dsPrefix);
	167	+ }
	168	+ }
	169	+
	170	+ parent.appendChild(xdElem);
	171	+ }
	172	+
	173	+ private void marshalSKI(byte[] skid, Node parent, Document doc,
	174	+ String dsPrefix) {
	175	+
	176	+ Element skidElem = DOMUtils.createElement
	177	+ (doc, "X509SKI", XMLSignature.XMLNS, dsPrefix);
	178	+ skidElem.appendChild(doc.createTextNode(Base64.encode(skid)));
	179	+ parent.appendChild(skidElem);
	180	+ }
	181	+
	182	+ private void marshalSubjectName(String name, Node parent, Document doc,
	183	+ String dsPrefix) {
	184	+
	185	+ Element snElem = DOMUtils.createElement
	186	+ (doc, "X509SubjectName", XMLSignature.XMLNS, dsPrefix);
	187	+ snElem.appendChild(doc.createTextNode(name));
	188	+ parent.appendChild(snElem);
	189	+ }
	190	+
	191	+ private void marshalCert(X509Certificate cert, Node parent, Document doc,
	192	+ String dsPrefix) throws MarshalException {
	193	+
	194	+ Element certElem = DOMUtils.createElement
	195	+ (doc, "X509Certificate", XMLSignature.XMLNS, dsPrefix);
	196	+ try {
	197	+ certElem.appendChild(doc.createTextNode
	198	+ (Base64.encode(cert.getEncoded())));
	199	+ } catch (CertificateEncodingException e) {
	200	+ throw new MarshalException("Error encoding X509Certificate", e);
	201	+ }
	202	+ parent.appendChild(certElem);
	203	+ }
	204	+
	205	+ private void marshalCRL(X509CRL crl, Node parent, Document doc,
	206	+ String dsPrefix) throws MarshalException {
	207	+
	208	+ Element crlElem = DOMUtils.createElement
	209	+ (doc, "X509CRL", XMLSignature.XMLNS, dsPrefix);
	210	+ try {
	211	+ crlElem.appendChild(doc.createTextNode
	212	+ (Base64.encode(crl.getEncoded())));
	213	+ } catch (CRLException e) {
	214	+ throw new MarshalException("Error encoding X509CRL", e);
	215	+ }
	216	+ parent.appendChild(crlElem);
	217	+ }
	218	+
	219	+ private X509Certificate unmarshalX509Certificate(Element elem)
	220	+ throws MarshalException {
	221	+ try {
	222	+ ByteArrayInputStream bs = unmarshalBase64Binary(elem);
	223	+ return (X509Certificate) cf.generateCertificate(bs);
	224	+ } catch (CertificateException e) {
	225	+ throw new MarshalException("Cannot create X509Certificate", e);
	226	+ }
	227	+ }
	228	+
	229	+ private X509CRL unmarshalX509CRL(Element elem) throws MarshalException {
	230	+ try {
	231	+ ByteArrayInputStream bs = unmarshalBase64Binary(elem);
	232	+ return (X509CRL) cf.generateCRL(bs);
	233	+ } catch (CRLException e) {
	234	+ throw new MarshalException("Cannot create X509CRL", e);
	235	+ }
	236	+ }
	237	+
	238	+ private ByteArrayInputStream unmarshalBase64Binary(Element elem)
	239	+ throws MarshalException {
	240	+ try {
	241	+ if (cf == null) {
	242	+ cf = CertificateFactory.getInstance("X.509");
	243	+ }
	244	+ return new ByteArrayInputStream(Base64.decode(elem));
	245	+ } catch (CertificateException e) {
	246	+ throw new MarshalException("Cannot create CertificateFactory", e);
	247	+ } catch (Base64DecodingException bde) {
	248	+ throw new MarshalException("Cannot decode Base64-encoded val", bde);
	249	+ }
	250	+ }
	251	+
	252	+ public boolean equals(Object o) {
	253	+ if (this == o) {
	254	+ return true;
	255	+ }
	256	+
	257	+ if (!(o instanceof X509Data)) {
	258	+ return false;
	259	+ }
	260	+ X509Data oxd = (X509Data) o;
	261	+
	262	+ List ocontent = oxd.getContent();
	263	+ int size = content.size();
	264	+ if (size != ocontent.size()) {
	265	+ return false;
	266	+ }
	267	+
	268	+ for (int i = 0; i < size; i++) {
	269	+ Object x = content.get(i);
	270	+ Object ox = ocontent.get(i);
	271	+ if (x instanceof byte[]) {
	272	+ if (!(ox instanceof byte[]) \|\|
	273	+ !Arrays.equals((byte[]) x, (byte[]) ox)) {
	274	+ return false;
	275	+ }
	276	+ } else {
	277	+ if (!(x.equals(ox))) {
	278	+ return false;
	279	+ }
	280	+ }
	281	+ }
	282	+
	283	+ return true;
	284	+ }
	285	+}

java/pkg/org/jcp/xml/dsig/internal/dom/DOMX509IssuerSerial.class+0−0

Binary file not shown.

java/pkg/org/jcp/xml/dsig/internal/dom/DOMX509IssuerSerial.java+124−0

@@ -0,0 +1,124 @@
	1	+/*
	2	+ * reserved comment block
	3	+ * DO NOT REMOVE OR ALTER!
	4	+ */
	5	+/*
	6	+ * Copyright 2005 The Apache Software Foundation.
	7	+ *
	8	+ * Licensed under the Apache License, Version 2.0 (the "License");
	9	+ * you may not use this file except in compliance with the License.
	10	+ * You may obtain a copy of the License at
	11	+ *
	12	+ * http://www.apache.org/licenses/LICENSE-2.0
	13	+ *
	14	+ * Unless required by applicable law or agreed to in writing, software
	15	+ * distributed under the License is distributed on an "AS IS" BASIS,
	16	+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
	17	+ * See the License for the specific language governing permissions and
	18	+ * limitations under the License.
	19	+ *
	20	+ */
	21	+/*
	22	+ * Copyright (c) 2005, 2008, Oracle and/or its affiliates. All rights reserved.
	23	+ */
	24	+/*
	25	+ * $Id: DOMX509IssuerSerial.java,v 1.2 2008/07/24 15:20:32 mullan Exp $
	26	+ */
	27	+package org.jcp.xml.dsig.internal.dom;
	28	+
	29	+import javax.xml.crypto.*;
	30	+import javax.xml.crypto.dom.DOMCryptoContext;
	31	+import javax.xml.crypto.dsig.*;
	32	+import javax.xml.crypto.dsig.keyinfo.X509IssuerSerial;
	33	+
	34	+import java.math.BigInteger;
	35	+import javax.security.auth.x500.X500Principal;
	36	+import org.w3c.dom.Document;
	37	+import org.w3c.dom.Element;
	38	+import org.w3c.dom.Node;
	39	+
	40	+/**
	41	+ * DOM-based implementation of X509IssuerSerial.
	42	+ *
	43	+ * @author Sean Mullan
	44	+ */
	45	+public final class DOMX509IssuerSerial extends DOMStructure
	46	+ implements X509IssuerSerial {
	47	+
	48	+ private final String issuerName;
	49	+ private final BigInteger serialNumber;
	50	+
	51	+ /**
	52	+ * Creates a <code>DOMX509IssuerSerial</code> containing the specified
	53	+ * issuer distinguished name/serial number pair.
	54	+ *
	55	+ * @param issuerName the X.509 issuer distinguished name in RFC 2253
	56	+ * String format
	57	+ * @param serialNumber the serial number
	58	+ * @throws IllegalArgumentException if the format of <code>issuerName</code>
	59	+ * is not RFC 2253 compliant
	60	+ * @throws NullPointerException if <code>issuerName</code> or
	61	+ * <code>serialNumber</code> is <code>null</code>
	62	+ */
	63	+ public DOMX509IssuerSerial(String issuerName, BigInteger serialNumber) {
	64	+ if (issuerName == null) {
	65	+ throw new NullPointerException("issuerName cannot be null");
	66	+ }
	67	+ if (serialNumber == null) {
	68	+ throw new NullPointerException("serialNumber cannot be null");
	69	+ }
	70	+ // check that issuer distinguished name conforms to RFC 2253
	71	+ new X500Principal(issuerName);
	72	+ this.issuerName = issuerName;
	73	+ this.serialNumber = serialNumber;
	74	+ }
	75	+
	76	+ /**
	77	+ * Creates a <code>DOMX509IssuerSerial</code> from an element.
	78	+ *
	79	+ * @param isElem an X509IssuerSerial element
	80	+ */
	81	+ public DOMX509IssuerSerial(Element isElem) {
	82	+ Element iNElem = DOMUtils.getFirstChildElement(isElem);
	83	+ Element sNElem = DOMUtils.getNextSiblingElement(iNElem);
	84	+ issuerName = iNElem.getFirstChild().getNodeValue();
	85	+ serialNumber = new BigInteger(sNElem.getFirstChild().getNodeValue());
	86	+ }
	87	+
	88	+ public String getIssuerName() {
	89	+ return issuerName;
	90	+ }
	91	+
	92	+ public BigInteger getSerialNumber() {
	93	+ return serialNumber;
	94	+ }
	95	+
	96	+ public void marshal(Node parent, String dsPrefix, DOMCryptoContext context)
	97	+ throws MarshalException {
	98	+ Document ownerDoc = DOMUtils.getOwnerDocument(parent);
	99	+
	100	+ Element isElem = DOMUtils.createElement
	101	+ (ownerDoc, "X509IssuerSerial", XMLSignature.XMLNS, dsPrefix);
	102	+ Element inElem = DOMUtils.createElement
	103	+ (ownerDoc, "X509IssuerName", XMLSignature.XMLNS, dsPrefix);
	104	+ Element snElem = DOMUtils.createElement
	105	+ (ownerDoc, "X509SerialNumber", XMLSignature.XMLNS, dsPrefix);
	106	+ inElem.appendChild(ownerDoc.createTextNode(issuerName));
	107	+ snElem.appendChild(ownerDoc.createTextNode(serialNumber.toString()));
	108	+ isElem.appendChild(inElem);
	109	+ isElem.appendChild(snElem);
	110	+ parent.appendChild(isElem);
	111	+ }
	112	+
	113	+ public boolean equals(Object obj) {
	114	+ if (this == obj) {
	115	+ return true;
	116	+ }
	117	+ if (!(obj instanceof X509IssuerSerial)) {
	118	+ return false;
	119	+ }
	120	+ X509IssuerSerial ois = (X509IssuerSerial) obj;
	121	+ return (issuerName.equals(ois.getIssuerName()) &&
	122	+ serialNumber.equals(ois.getSerialNumber()));
	123	+ }
	124	+}

java/pkg/org/jcp/xml/dsig/internal/dom/DOMXMLObject.class+0−0

Binary file not shown.

java/pkg/org/jcp/xml/dsig/internal/dom/DOMXMLObject.java+217−0

@@ -0,0 +1,217 @@
	1	+/*
	2	+ * reserved comment block
	3	+ * DO NOT REMOVE OR ALTER!
	4	+ */
	5	+/*
	6	+ * Copyright 2005 The Apache Software Foundation.
	7	+ *
	8	+ * Licensed under the Apache License, Version 2.0 (the "License");
	9	+ * you may not use this file except in compliance with the License.
	10	+ * You may obtain a copy of the License at
	11	+ *
	12	+ * http://www.apache.org/licenses/LICENSE-2.0
	13	+ *
	14	+ * Unless required by applicable law or agreed to in writing, software
	15	+ * distributed under the License is distributed on an "AS IS" BASIS,
	16	+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
	17	+ * See the License for the specific language governing permissions and
	18	+ * limitations under the License.
	19	+ *
	20	+ */
	21	+/*
	22	+ * Copyright (c) 2005, 2008, Oracle and/or its affiliates. All rights reserved.
	23	+ */
	24	+/*
	25	+ * $Id: DOMXMLObject.java,v 1.2 2008/07/24 15:20:32 mullan Exp $
	26	+ */
	27	+package org.jcp.xml.dsig.internal.dom;
	28	+
	29	+import javax.xml.crypto.*;
	30	+import javax.xml.crypto.dom.DOMCryptoContext;
	31	+import javax.xml.crypto.dsig.*;
	32	+
	33	+import java.security.Provider;
	34	+import java.util.*;
	35	+import org.w3c.dom.Document;
	36	+import org.w3c.dom.Element;
	37	+import org.w3c.dom.Node;
	38	+import org.w3c.dom.NodeList;
	39	+
	40	+/**
	41	+ * DOM-based implementation of XMLObject.
	42	+ *
	43	+ * @author Sean Mullan
	44	+ */
	45	+public final class DOMXMLObject extends DOMStructure implements XMLObject {
	46	+
	47	+ private final String id;
	48	+ private final String mimeType;
	49	+ private final String encoding;
	50	+ private final List content;
	51	+
	52	+ /**
	53	+ * Creates an <code>XMLObject</code> from the specified parameters.
	54	+ *
	55	+ * @param content a list of {@link XMLStructure}s. The list
	56	+ * is defensively copied to protect against subsequent modification.
	57	+ * May be <code>null</code> or empty.
	58	+ * @param id the Id (may be <code>null</code>)
	59	+ * @param mimeType the mime type (may be <code>null</code>)
	60	+ * @param encoding the encoding (may be <code>null</code>)
	61	+ * @return an <code>XMLObject</code>
	62	+ * @throws ClassCastException if <code>content</code> contains any
	63	+ * entries that are not of type {@link XMLStructure}
	64	+ */
	65	+ public DOMXMLObject(List content, String id, String mimeType,
	66	+ String encoding) {
	67	+ if (content == null \|\| content.isEmpty()) {
	68	+ this.content = Collections.EMPTY_LIST;
	69	+ } else {
	70	+ List contentCopy = new ArrayList(content);
	71	+ for (int i = 0, size = contentCopy.size(); i < size; i++) {
	72	+ if (!(contentCopy.get(i) instanceof XMLStructure)) {
	73	+ throw new ClassCastException
	74	+ ("content["+i+"] is not a valid type");
	75	+ }
	76	+ }
	77	+ this.content = Collections.unmodifiableList(contentCopy);
	78	+ }
	79	+ this.id = id;
	80	+ this.mimeType = mimeType;
	81	+ this.encoding = encoding;
	82	+ }
	83	+
	84	+ /**
	85	+ * Creates an <code>XMLObject</code> from an element.
	86	+ *
	87	+ * @param objElem an Object element
	88	+ * @throws MarshalException if there is an error when unmarshalling
	89	+ */
	90	+ public DOMXMLObject(Element objElem, XMLCryptoContext context,
	91	+ Provider provider) throws MarshalException {
	92	+ // unmarshal attributes
	93	+ this.encoding = DOMUtils.getAttributeValue(objElem, "Encoding");
	94	+ this.id = DOMUtils.getAttributeValue(objElem, "Id");
	95	+ this.mimeType = DOMUtils.getAttributeValue(objElem, "MimeType");
	96	+
	97	+ NodeList nodes = objElem.getChildNodes();
	98	+ int length = nodes.getLength();
	99	+ List content = new ArrayList(length);
	100	+ for (int i = 0; i < length; i++) {
	101	+ Node child = nodes.item(i);
	102	+ if (child.getNodeType() == Node.ELEMENT_NODE) {
	103	+ Element childElem = (Element) child;
	104	+ String tag = childElem.getLocalName();
	105	+ if (tag.equals("Manifest")) {
	106	+ content.add(new DOMManifest(childElem, context, provider));
	107	+ continue;
	108	+ } else if (tag.equals("SignatureProperties")) {
	109	+ content.add(new DOMSignatureProperties(childElem));
	110	+ continue;
	111	+ } else if (tag.equals("X509Data")) {
	112	+ content.add(new DOMX509Data(childElem));
	113	+ continue;
	114	+ }
	115	+ //@@@FIXME: check for other dsig structures
	116	+ }
	117	+ content.add(new javax.xml.crypto.dom.DOMStructure(child));
	118	+ }
	119	+ if (content.isEmpty()) {
	120	+ this.content = Collections.EMPTY_LIST;
	121	+ } else {
	122	+ this.content = Collections.unmodifiableList(content);
	123	+ }
	124	+ }
	125	+
	126	+ public List getContent() {
	127	+ return content;
	128	+ }
	129	+
	130	+ public String getId() {
	131	+ return id;
	132	+ }
	133	+
	134	+ public String getMimeType() {
	135	+ return mimeType;
	136	+ }
	137	+
	138	+ public String getEncoding() {
	139	+ return encoding;
	140	+ }
	141	+
	142	+ public void marshal(Node parent, String dsPrefix, DOMCryptoContext context)
	143	+ throws MarshalException {
	144	+ Document ownerDoc = DOMUtils.getOwnerDocument(parent);
	145	+
	146	+ Element objElem = DOMUtils.createElement
	147	+ (ownerDoc, "Object", XMLSignature.XMLNS, dsPrefix);
	148	+
	149	+ // set attributes
	150	+ DOMUtils.setAttributeID(objElem, "Id", id);
	151	+ DOMUtils.setAttribute(objElem, "MimeType", mimeType);
	152	+ DOMUtils.setAttribute(objElem, "Encoding", encoding);
	153	+
	154	+ // create and append any elements and mixed content, if necessary
	155	+ for (int i = 0, size = content.size(); i < size; i++) {
	156	+ XMLStructure object = (XMLStructure) content.get(i);
	157	+ if (object instanceof DOMStructure) {
	158	+ ((DOMStructure) object).marshal(objElem, dsPrefix, context);
	159	+ } else {
	160	+ javax.xml.crypto.dom.DOMStructure domObject =
	161	+ (javax.xml.crypto.dom.DOMStructure) object;
	162	+ DOMUtils.appendChild(objElem, domObject.getNode());
	163	+ }
	164	+ }
	165	+
	166	+ parent.appendChild(objElem);
	167	+ }
	168	+
	169	+ public boolean equals(Object o) {
	170	+ if (this == o) {
	171	+ return true;
	172	+ }
	173	+
	174	+ if (!(o instanceof XMLObject)) {
	175	+ return false;
	176	+ }
	177	+ XMLObject oxo = (XMLObject) o;
	178	+
	179	+ boolean idsEqual = (id == null ? oxo.getId() == null :
	180	+ id.equals(oxo.getId()));
	181	+ boolean encodingsEqual = (encoding == null ? oxo.getEncoding() == null :
	182	+ encoding.equals(oxo.getEncoding()));
	183	+ boolean mimeTypesEqual = (mimeType == null ? oxo.getMimeType() == null :
	184	+ mimeType.equals(oxo.getMimeType()));
	185	+
	186	+ return (idsEqual && encodingsEqual && mimeTypesEqual &&
	187	+ equalsContent(oxo.getContent()));
	188	+ }
	189	+
	190	+ private boolean equalsContent(List otherContent) {
	191	+ if (content.size() != otherContent.size()) {
	192	+ return false;
	193	+ }
	194	+ for (int i = 0, osize = otherContent.size(); i < osize; i++) {
	195	+ XMLStructure oxs = (XMLStructure) otherContent.get(i);
	196	+ XMLStructure xs = (XMLStructure) content.get(i);
	197	+ if (oxs instanceof javax.xml.crypto.dom.DOMStructure) {
	198	+ if (!(xs instanceof javax.xml.crypto.dom.DOMStructure)) {
	199	+ return false;
	200	+ }
	201	+ Node onode =
	202	+ ((javax.xml.crypto.dom.DOMStructure) oxs).getNode();
	203	+ Node node =
	204	+ ((javax.xml.crypto.dom.DOMStructure) xs).getNode();
	205	+ if (!DOMUtils.nodesEqual(node, onode)) {
	206	+ return false;
	207	+ }
	208	+ } else {
	209	+ if (!(xs.equals(oxs))) {
	210	+ return false;
	211	+ }
	212	+ }
	213	+ }
	214	+
	215	+ return true;
	216	+ }
	217	+}

java/pkg/org/jcp/xml/dsig/internal/dom/DOMXMLSignature$DOMSignatureValue.class+0−0

Binary file not shown.

java/pkg/org/jcp/xml/dsig/internal/dom/DOMXMLSignature.class+0−0

Binary file not shown.

java/pkg/org/jcp/xml/dsig/internal/dom/DOMXMLSignature.java+586−0

@@ -0,0 +1,586 @@
	1	+/*
	2	+ * reserved comment block
	3	+ * DO NOT REMOVE OR ALTER!
	4	+ */
	5	+/*
	6	+ * Copyright 2005 The Apache Software Foundation.
	7	+ *
	8	+ * Licensed under the Apache License, Version 2.0 (the "License");
	9	+ * you may not use this file except in compliance with the License.
	10	+ * You may obtain a copy of the License at
	11	+ *
	12	+ * http://www.apache.org/licenses/LICENSE-2.0
	13	+ *
	14	+ * Unless required by applicable law or agreed to in writing, software
	15	+ * distributed under the License is distributed on an "AS IS" BASIS,
	16	+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
	17	+ * See the License for the specific language governing permissions and
	18	+ * limitations under the License.
	19	+ *
	20	+ */
	21	+/*
	22	+ * Copyright (c) 2005, Oracle and/or its affiliates. All rights reserved.
	23	+ */
	24	+/*
	25	+ * ===========================================================================
	26	+ *
	27	+ * (C) Copyright IBM Corp. 2003 All Rights Reserved.
	28	+ *
	29	+ * ===========================================================================
	30	+ */
	31	+/*
	32	+ * $Id: DOMXMLSignature.java,v 1.2 2008/07/24 15:20:32 mullan Exp $
	33	+ */
	34	+package org.jcp.xml.dsig.internal.dom;
	35	+
	36	+import javax.xml.crypto.*;
	37	+import javax.xml.crypto.dom.*;
	38	+import javax.xml.crypto.dsig.*;
	39	+import javax.xml.crypto.dsig.dom.DOMSignContext;
	40	+import javax.xml.crypto.dsig.dom.DOMValidateContext;
	41	+import javax.xml.crypto.dsig.keyinfo.KeyInfo;
	42	+
	43	+import java.io.*;
	44	+import java.security.InvalidKeyException;
	45	+import java.security.Key;
	46	+import java.security.Provider;
	47	+import java.util.Collections;
	48	+import java.util.ArrayList;
	49	+import java.util.HashMap;
	50	+import java.util.List;
	51	+import java.util.logging.Level;
	52	+import java.util.logging.Logger;
	53	+import org.w3c.dom.Document;
	54	+import org.w3c.dom.Element;
	55	+import org.w3c.dom.Node;
	56	+
	57	+import com.sun.org.apache.xml.internal.security.exceptions.Base64DecodingException;
	58	+import com.sun.org.apache.xml.internal.security.utils.Base64;
	59	+
	60	+/**
	61	+ * DOM-based implementation of XMLSignature.
	62	+ *
	63	+ * @author Sean Mullan
	64	+ * @author Joyce Leung
	65	+ */
	66	+public final class DOMXMLSignature extends DOMStructure
	67	+ implements XMLSignature {
	68	+
	69	+ private static Logger log = Logger.getLogger("org.jcp.xml.dsig.internal.dom");
	70	+ private String id;
	71	+ private SignatureValue sv;
	72	+ private KeyInfo ki;
	73	+ private List objects;
	74	+ private SignedInfo si;
	75	+ private Document ownerDoc = null;
	76	+ private Element localSigElem = null;
	77	+ private Element sigElem = null;
	78	+ private boolean validationStatus;
	79	+ private boolean validated = false;
	80	+ private KeySelectorResult ksr;
	81	+ private HashMap signatureIdMap;
	82	+
	83	+ static {
	84	+ com.sun.org.apache.xml.internal.security.Init.init();
	85	+ }
	86	+
	87	+ /**
	88	+ * Creates a <code>DOMXMLSignature</code> from the specified components.
	89	+ *
	90	+ * @param si the <code>SignedInfo</code>
	91	+ * @param ki the <code>KeyInfo</code>, or <code>null</code> if not specified
	92	+ * @param objs a list of <code>XMLObject</code>s or <code>null</code>
	93	+ * if not specified. The list is copied to protect against subsequent
	94	+ * modification.
	95	+ * @param id an optional id (specify <code>null</code> to omit)
	96	+ * @param signatureValueId an optional id (specify <code>null</code> to
	97	+ * omit)
	98	+ * @throws NullPointerException if <code>si</code> is <code>null</code>
	99	+ */
	100	+ public DOMXMLSignature(SignedInfo si, KeyInfo ki, List objs, String id,
	101	+ String signatureValueId)
	102	+ {
	103	+ if (si == null) {
	104	+ throw new NullPointerException("signedInfo cannot be null");
	105	+ }
	106	+ this.si = si;
	107	+ this.id = id;
	108	+ this.sv = new DOMSignatureValue(signatureValueId);
	109	+ if (objs == null) {
	110	+ this.objects = Collections.EMPTY_LIST;
	111	+ } else {
	112	+ List objsCopy = new ArrayList(objs);
	113	+ for (int i = 0, size = objsCopy.size(); i < size; i++) {
	114	+ if (!(objsCopy.get(i) instanceof XMLObject)) {
	115	+ throw new ClassCastException
	116	+ ("objs["+i+"] is not an XMLObject");
	117	+ }
	118	+ }
	119	+ this.objects = Collections.unmodifiableList(objsCopy);
	120	+ }
	121	+ this.ki = ki;
	122	+ }
	123	+
	124	+ /**
	125	+ * Creates a <code>DOMXMLSignature</code> from XML.
	126	+ *
	127	+ * @param sigElem Signature element
	128	+ * @throws MarshalException if XMLSignature cannot be unmarshalled
	129	+ */
	130	+ public DOMXMLSignature(Element sigElem, XMLCryptoContext context,
	131	+ Provider provider) throws MarshalException {
	132	+ localSigElem = sigElem;
	133	+ ownerDoc = localSigElem.getOwnerDocument();
	134	+
	135	+ // get Id attribute, if specified
	136	+ id = DOMUtils.getAttributeValue(localSigElem, "Id");
	137	+
	138	+ // unmarshal SignedInfo
	139	+ Element siElem = DOMUtils.getFirstChildElement(localSigElem);
	140	+ si = new DOMSignedInfo(siElem, context, provider);
	141	+
	142	+ // unmarshal SignatureValue
	143	+ Element sigValElem = DOMUtils.getNextSiblingElement(siElem);
	144	+ sv = new DOMSignatureValue(sigValElem);
	145	+
	146	+ // unmarshal KeyInfo, if specified
	147	+ Element nextSibling = DOMUtils.getNextSiblingElement(sigValElem);
	148	+ if (nextSibling != null && nextSibling.getLocalName().equals("KeyInfo")) {
	149	+ ki = new DOMKeyInfo(nextSibling, context, provider);
	150	+ nextSibling = DOMUtils.getNextSiblingElement(nextSibling);
	151	+ }
	152	+
	153	+ // unmarshal Objects, if specified
	154	+ if (nextSibling == null) {
	155	+ objects = Collections.EMPTY_LIST;
	156	+ } else {
	157	+ List tempObjects = new ArrayList();
	158	+ while (nextSibling != null) {
	159	+ tempObjects.add
	160	+ (new DOMXMLObject(nextSibling, context, provider));
	161	+ nextSibling = DOMUtils.getNextSiblingElement(nextSibling);
	162	+ }
	163	+ objects = Collections.unmodifiableList(tempObjects);
	164	+ }
	165	+ }
	166	+
	167	+ public String getId() {
	168	+ return id;
	169	+ }
	170	+
	171	+ public KeyInfo getKeyInfo() {
	172	+ return ki;
	173	+ }
	174	+
	175	+ public SignedInfo getSignedInfo() {
	176	+ return si;
	177	+ }
	178	+
	179	+ public List getObjects() {
	180	+ return objects;
	181	+ }
	182	+
	183	+ public SignatureValue getSignatureValue() {
	184	+ return sv;
	185	+ }
	186	+
	187	+ public KeySelectorResult getKeySelectorResult() {
	188	+ return ksr;
	189	+ }
	190	+
	191	+ public void marshal(Node parent, String dsPrefix, DOMCryptoContext context)
	192	+ throws MarshalException {
	193	+ marshal(parent, null, dsPrefix, context);
	194	+ }
	195	+
	196	+ public void marshal(Node parent, Node nextSibling, String dsPrefix,
	197	+ DOMCryptoContext context) throws MarshalException {
	198	+ ownerDoc = DOMUtils.getOwnerDocument(parent);
	199	+
	200	+ sigElem = DOMUtils.createElement
	201	+ (ownerDoc, "Signature", XMLSignature.XMLNS, dsPrefix);
	202	+
	203	+ // append xmlns attribute
	204	+ if (dsPrefix == null \|\| dsPrefix.length() == 0) {
	205	+ sigElem.setAttributeNS
	206	+ ("http://www.w3.org/2000/xmlns/", "xmlns", XMLSignature.XMLNS);
	207	+ } else {
	208	+ sigElem.setAttributeNS
	209	+ ("http://www.w3.org/2000/xmlns/", "xmlns:" + dsPrefix,
	210	+ XMLSignature.XMLNS);
	211	+ }
	212	+
	213	+ // create and append SignedInfo element
	214	+ ((DOMSignedInfo) si).marshal(sigElem, dsPrefix, context);
	215	+
	216	+ // create and append SignatureValue element
	217	+ ((DOMSignatureValue) sv).marshal(sigElem, dsPrefix, context);
	218	+
	219	+ // create and append KeyInfo element if necessary
	220	+ if (ki != null) {
	221	+ ((DOMKeyInfo) ki).marshal(sigElem, null, dsPrefix, context);
	222	+ }
	223	+
	224	+ // create and append Object elements if necessary
	225	+ for (int i = 0, size = objects.size(); i < size; i++) {
	226	+ ((DOMXMLObject) objects.get(i)).marshal(sigElem, dsPrefix, context);
	227	+ }
	228	+
	229	+ // append Id attribute
	230	+ DOMUtils.setAttributeID(sigElem, "Id", id);
	231	+
	232	+ parent.insertBefore(sigElem, nextSibling);
	233	+ }
	234	+
	235	+ public boolean validate(XMLValidateContext vc)
	236	+ throws XMLSignatureException {
	237	+
	238	+ if (vc == null) {
	239	+ throw new NullPointerException("validateContext is null");
	240	+ }
	241	+
	242	+ if (!(vc instanceof DOMValidateContext)) {
	243	+ throw new ClassCastException
	244	+ ("validateContext must be of type DOMValidateContext");
	245	+ }
	246	+
	247	+ if (validated) {
	248	+ return validationStatus;
	249	+ }
	250	+
	251	+ // validate the signature
	252	+ boolean sigValidity = sv.validate(vc);
	253	+ if (!sigValidity) {
	254	+ validationStatus = false;
	255	+ validated = true;
	256	+ return validationStatus;
	257	+ }
	258	+
	259	+ // validate all References
	260	+ List refs = this.si.getReferences();
	261	+ boolean validateRefs = true;
	262	+ for (int i = 0, size = refs.size(); validateRefs && i < size; i++) {
	263	+ Reference ref = (Reference) refs.get(i);
	264	+ boolean refValid = ref.validate(vc);
	265	+ if (log.isLoggable(Level.FINE)) {
	266	+ log.log(Level.FINE, "Reference[" + ref.getURI() + "] is valid: "
	267	+ + refValid);
	268	+ }
	269	+ validateRefs &= refValid;
	270	+ }
	271	+ if (!validateRefs) {
	272	+ if (log.isLoggable(Level.FINE)) {
	273	+ log.log(Level.FINE, "Couldn't validate the References");
	274	+ }
	275	+ validationStatus = false;
	276	+ validated = true;
	277	+ return validationStatus;
	278	+ }
	279	+
	280	+ // validate Manifests, if property set
	281	+ boolean validateMans = true;
	282	+ if (Boolean.TRUE.equals(vc.getProperty
	283	+ ("org.jcp.xml.dsig.validateManifests"))) {
	284	+
	285	+ for (int i=0, size=objects.size(); validateMans && i < size; i++) {
	286	+ XMLObject xo = (XMLObject) objects.get(i);
	287	+ List content = xo.getContent();
	288	+ int csize = content.size();
	289	+ for (int j = 0; validateMans && j < csize; j++) {
	290	+ XMLStructure xs = (XMLStructure) content.get(j);
	291	+ if (xs instanceof Manifest) {
	292	+ if (log.isLoggable(Level.FINE)) {
	293	+ log.log(Level.FINE, "validating manifest");
	294	+ }
	295	+ Manifest man = (Manifest) xs;
	296	+ List manRefs = man.getReferences();
	297	+ int rsize = manRefs.size();
	298	+ for (int k = 0; validateMans && k < rsize; k++) {
	299	+ Reference ref = (Reference) manRefs.get(k);
	300	+ boolean refValid = ref.validate(vc);
	301	+ if (log.isLoggable(Level.FINE)) {
	302	+ log.log(Level.FINE, "Manifest ref["
	303	+ + ref.getURI() + "] is valid: " + refValid);
	304	+ }
	305	+ validateMans &= refValid;
	306	+ }
	307	+ }
	308	+ }
	309	+ }
	310	+ }
	311	+
	312	+ validationStatus = validateMans;
	313	+ validated = true;
	314	+ return validationStatus;
	315	+ }
	316	+
	317	+ public void sign(XMLSignContext signContext)
	318	+ throws MarshalException, XMLSignatureException {
	319	+ if (signContext == null) {
	320	+ throw new NullPointerException("signContext cannot be null");
	321	+ }
	322	+ DOMSignContext context = (DOMSignContext) signContext;
	323	+ if (context != null) {
	324	+ marshal(context.getParent(), context.getNextSibling(),
	325	+ DOMUtils.getSignaturePrefix(context), context);
	326	+ }
	327	+
	328	+ // generate references and signature value
	329	+ List allReferences = new ArrayList();
	330	+
	331	+ // traverse the Signature and register all objects with IDs that
	332	+ // may contain References
	333	+ signatureIdMap = new HashMap();
	334	+ signatureIdMap.put(id, this);
	335	+ signatureIdMap.put(si.getId(), si);
	336	+ List refs = si.getReferences();
	337	+ for (int i = 0, size = refs.size(); i < size; i++) {
	338	+ Reference ref = (Reference) refs.get(i);
	339	+ signatureIdMap.put(ref.getId(), ref);
	340	+ }
	341	+ for (int i = 0, size = objects.size(); i < size; i++) {
	342	+ XMLObject obj = (XMLObject) objects.get(i);
	343	+ signatureIdMap.put(obj.getId(), obj);
	344	+ List content = obj.getContent();
	345	+ for (int j = 0, csize = content.size(); j < csize; j++) {
	346	+ XMLStructure xs = (XMLStructure) content.get(j);
	347	+ if (xs instanceof Manifest) {
	348	+ Manifest man = (Manifest) xs;
	349	+ signatureIdMap.put(man.getId(), man);
	350	+ List manRefs = man.getReferences();
	351	+ for (int k = 0, msize = manRefs.size(); k < msize; k++) {
	352	+ Reference ref = (Reference) manRefs.get(k);
	353	+ allReferences.add(ref);
	354	+ signatureIdMap.put(ref.getId(), ref);
	355	+ }
	356	+ }
	357	+ }
	358	+ }
	359	+ // always add SignedInfo references after Manifest references so
	360	+ // that Manifest reference are digested first
	361	+ allReferences.addAll(si.getReferences());
	362	+
	363	+ // generate/digest each reference
	364	+ for (int i = 0, size = allReferences.size(); i < size; i++) {
	365	+ DOMReference ref = (DOMReference) allReferences.get(i);
	366	+ digestReference(ref, signContext);
	367	+ }
	368	+
	369	+ // do final sweep to digest any references that were skipped or missed
	370	+ for (int i = 0, size = allReferences.size(); i < size; i++) {
	371	+ DOMReference ref = (DOMReference) allReferences.get(i);
	372	+ if (ref.isDigested()) {
	373	+ continue;
	374	+ }
	375	+ ref.digest(signContext);
	376	+ }
	377	+
	378	+ Key signingKey = null;
	379	+ KeySelectorResult ksr = null;
	380	+ try {
	381	+ ksr = signContext.getKeySelector().select
	382	+ (ki, KeySelector.Purpose.SIGN,
	383	+ si.getSignatureMethod(), signContext);
	384	+ signingKey = ksr.getKey();
	385	+ if (signingKey == null) {
	386	+ throw new XMLSignatureException("the keySelector did not " +
	387	+ "find a signing key");
	388	+ }
	389	+ } catch (KeySelectorException kse) {
	390	+ throw new XMLSignatureException("cannot find signing key", kse);
	391	+ }
	392	+
	393	+ // calculate signature value
	394	+ byte[] val = null;
	395	+ try {
	396	+ val = ((DOMSignatureMethod) si.getSignatureMethod()).sign
	397	+ (signingKey, (DOMSignedInfo) si, signContext);
	398	+ } catch (InvalidKeyException ike) {
	399	+ throw new XMLSignatureException(ike);
	400	+ }
	401	+
	402	+ if (log.isLoggable(Level.FINE)) {
	403	+ log.log(Level.FINE, "SignatureValue = " + val);
	404	+ }
	405	+ ((DOMSignatureValue) sv).setValue(val);
	406	+
	407	+ this.localSigElem = sigElem;
	408	+ this.ksr = ksr;
	409	+ }
	410	+
	411	+ public boolean equals(Object o) {
	412	+ if (this == o) {
	413	+ return true;
	414	+ }
	415	+
	416	+ if (!(o instanceof XMLSignature)) {
	417	+ return false;
	418	+ }
	419	+ XMLSignature osig = (XMLSignature) o;
	420	+
	421	+ boolean idEqual =
	422	+ (id == null ? osig.getId() == null : id.equals(osig.getId()));
	423	+ boolean keyInfoEqual =
	424	+ (ki == null ? osig.getKeyInfo() == null :
	425	+ ki.equals(osig.getKeyInfo()));
	426	+
	427	+ return (idEqual && keyInfoEqual &&
	428	+ sv.equals(osig.getSignatureValue()) &&
	429	+ si.equals(osig.getSignedInfo()) &&
	430	+ objects.equals(osig.getObjects()));
	431	+ }
	432	+
	433	+ private void digestReference(DOMReference ref, XMLSignContext signContext)
	434	+ throws XMLSignatureException {
	435	+ if (ref.isDigested()) {
	436	+ return;
	437	+ }
	438	+ // check dependencies
	439	+ String uri = ref.getURI();
	440	+ if (Utils.sameDocumentURI(uri)) {
	441	+ String id = Utils.parseIdFromSameDocumentURI(uri);
	442	+ if (id != null && signatureIdMap.containsKey(id)) {
	443	+ Object obj = signatureIdMap.get(id);
	444	+ if (obj instanceof DOMReference) {
	445	+ digestReference((DOMReference) obj, signContext);
	446	+ } else if (obj instanceof Manifest) {
	447	+ Manifest man = (Manifest) obj;
	448	+ List manRefs = man.getReferences();
	449	+ for (int i = 0, size = manRefs.size(); i < size; i++) {
	450	+ digestReference
	451	+ ((DOMReference) manRefs.get(i), signContext);
	452	+ }
	453	+ }
	454	+ }
	455	+ // if uri="" and there are XPath Transforms, there may be
	456	+ // reference dependencies in the XPath Transform - so be on
	457	+ // the safe side, and skip and do at end in the final sweep
	458	+ if (uri.length() == 0) {
	459	+ List transforms = ref.getTransforms();
	460	+ for (int i = 0, size = transforms.size(); i < size; i++) {
	461	+ Transform transform = (Transform) transforms.get(i);
	462	+ String transformAlg = transform.getAlgorithm();
	463	+ if (transformAlg.equals(Transform.XPATH) \|\|
	464	+ transformAlg.equals(Transform.XPATH2)) {
	465	+ return;
	466	+ }
	467	+ }
	468	+ }
	469	+ }
	470	+ ref.digest(signContext);
	471	+ }
	472	+
	473	+ public class DOMSignatureValue extends DOMStructure
	474	+ implements SignatureValue {
	475	+
	476	+ private String id;
	477	+ private byte[] value;
	478	+ private String valueBase64;
	479	+ private Element sigValueElem;
	480	+ private boolean validated = false;
	481	+ private boolean validationStatus;
	482	+
	483	+ DOMSignatureValue(String id) {
	484	+ this.id = id;
	485	+ }
	486	+
	487	+ DOMSignatureValue(Element sigValueElem) throws MarshalException {
	488	+ try {
	489	+ // base64 decode signatureValue
	490	+ value = Base64.decode(sigValueElem);
	491	+ } catch (Base64DecodingException bde) {
	492	+ throw new MarshalException(bde);
	493	+ }
	494	+
	495	+ id = DOMUtils.getAttributeValue(sigValueElem, "Id");
	496	+ this.sigValueElem = sigValueElem;
	497	+ }
	498	+
	499	+ public String getId() {
	500	+ return id;
	501	+ }
	502	+
	503	+ public byte[] getValue() {
	504	+ return (value == null) ? null : (byte[]) value.clone();
	505	+ }
	506	+
	507	+ public boolean validate(XMLValidateContext validateContext)
	508	+ throws XMLSignatureException {
	509	+
	510	+ if (validateContext == null) {
	511	+ throw new NullPointerException("context cannot be null");
	512	+ }
	513	+
	514	+ if (validated) {
	515	+ return validationStatus;
	516	+ }
	517	+
	518	+ // get validating key
	519	+ SignatureMethod sm = si.getSignatureMethod();
	520	+ Key validationKey = null;
	521	+ KeySelectorResult ksResult;
	522	+ try {
	523	+ ksResult = validateContext.getKeySelector().select
	524	+ (ki, KeySelector.Purpose.VERIFY, sm, validateContext);
	525	+ validationKey = ksResult.getKey();
	526	+ if (validationKey == null) {
	527	+ throw new XMLSignatureException("the keyselector did " +
	528	+ "not find a validation key");
	529	+ }
	530	+ } catch (KeySelectorException kse) {
	531	+ throw new XMLSignatureException("cannot find validation " +
	532	+ "key", kse);
	533	+ }
	534	+
	535	+ // canonicalize SignedInfo and verify signature
	536	+ try {
	537	+ validationStatus = ((DOMSignatureMethod) sm).verify
	538	+ (validationKey, (DOMSignedInfo) si, value, validateContext);
	539	+ } catch (Exception e) {
	540	+ throw new XMLSignatureException(e);
	541	+ }
	542	+
	543	+ validated = true;
	544	+ ksr = ksResult;
	545	+ return validationStatus;
	546	+ }
	547	+
	548	+ public boolean equals(Object o) {
	549	+ if (this == o) {
	550	+ return true;
	551	+ }
	552	+
	553	+ if (!(o instanceof SignatureValue)) {
	554	+ return false;
	555	+ }
	556	+ SignatureValue osv = (SignatureValue) o;
	557	+
	558	+ boolean idEqual =
	559	+ (id == null ? osv.getId() == null : id.equals(osv.getId()));
	560	+
	561	+ //XXX compare signature values?
	562	+ return idEqual;
	563	+ }
	564	+
	565	+ public void marshal(Node parent, String dsPrefix,
	566	+ DOMCryptoContext context) throws MarshalException {
	567	+
	568	+ // create SignatureValue element
	569	+ sigValueElem = DOMUtils.createElement
	570	+ (ownerDoc, "SignatureValue", XMLSignature.XMLNS, dsPrefix);
	571	+ if (valueBase64 != null) {
	572	+ sigValueElem.appendChild(ownerDoc.createTextNode(valueBase64));
	573	+ }
	574	+
	575	+ // append Id attribute, if specified
	576	+ DOMUtils.setAttributeID(sigValueElem, "Id", id);
	577	+ parent.appendChild(sigValueElem);
	578	+ }
	579	+
	580	+ void setValue(byte[] value) {
	581	+ this.value = value;
	582	+ valueBase64 = Base64.encode(value);
	583	+ sigValueElem.appendChild(ownerDoc.createTextNode(valueBase64));
	584	+ }
	585	+ }
	586	+}

java/pkg/org/jcp/xml/dsig/internal/dom/DOMXMLSignatureFactory.class+0−0

Binary file not shown.

java/pkg/org/jcp/xml/dsig/internal/dom/DOMXMLSignatureFactory.java+298−0

@@ -0,0 +1,298 @@
	1	+/*
	2	+ * reserved comment block
	3	+ * DO NOT REMOVE OR ALTER!
	4	+ */
	5	+/*
	6	+ * Copyright 2005 The Apache Software Foundation.
	7	+ *
	8	+ * Licensed under the Apache License, Version 2.0 (the "License");
	9	+ * you may not use this file except in compliance with the License.
	10	+ * You may obtain a copy of the License at
	11	+ *
	12	+ * http://www.apache.org/licenses/LICENSE-2.0
	13	+ *
	14	+ * Unless required by applicable law or agreed to in writing, software
	15	+ * distributed under the License is distributed on an "AS IS" BASIS,
	16	+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
	17	+ * See the License for the specific language governing permissions and
	18	+ * limitations under the License.
	19	+ *
	20	+ */
	21	+/*
	22	+ * Copyright (c) 2005, 2008, Oracle and/or its affiliates. All rights reserved.
	23	+ */
	24	+/*
	25	+ * $Id: DOMXMLSignatureFactory.java,v 1.2 2008/07/24 15:20:32 mullan Exp $
	26	+ */
	27	+package org.jcp.xml.dsig.internal.dom;
	28	+
	29	+import javax.xml.crypto.*;
	30	+import javax.xml.crypto.dsig.*;
	31	+import javax.xml.crypto.dsig.dom.DOMValidateContext;
	32	+import javax.xml.crypto.dsig.keyinfo.*;
	33	+import javax.xml.crypto.dsig.spec.*;
	34	+
	35	+import java.security.InvalidAlgorithmParameterException;
	36	+import java.security.NoSuchAlgorithmException;
	37	+import java.security.spec.AlgorithmParameterSpec;
	38	+import java.util.List;
	39	+import org.w3c.dom.Document;
	40	+import org.w3c.dom.Element;
	41	+import org.w3c.dom.Node;
	42	+
	43	+/**
	44	+ * DOM-based implementation of XMLSignatureFactory.
	45	+ *
	46	+ * @author Sean Mullan
	47	+ */
	48	+public final class DOMXMLSignatureFactory extends XMLSignatureFactory {
	49	+
	50	+ /**
	51	+ * Initializes a new instance of this class.
	52	+ */
	53	+ public DOMXMLSignatureFactory() {}
	54	+
	55	+ public XMLSignature newXMLSignature(SignedInfo si, KeyInfo ki) {
	56	+ return new DOMXMLSignature(si, ki, null, null, null);
	57	+ }
	58	+
	59	+ public XMLSignature newXMLSignature(SignedInfo si, KeyInfo ki,
	60	+ List objects, String id, String signatureValueId) {
	61	+ return new DOMXMLSignature(si, ki, objects, id, signatureValueId);
	62	+ }
	63	+
	64	+ public Reference newReference(String uri, DigestMethod dm) {
	65	+ return newReference(uri, dm, null, null, null);
	66	+ }
	67	+
	68	+ public Reference newReference(String uri, DigestMethod dm, List transforms,
	69	+ String type, String id) {
	70	+ return new DOMReference(uri, type, dm, transforms, id, getProvider());
	71	+ }
	72	+
	73	+ public Reference newReference(String uri, DigestMethod dm,
	74	+ List appliedTransforms, Data result, List transforms, String type,
	75	+ String id) {
	76	+ if (appliedTransforms == null) {
	77	+ throw new NullPointerException("appliedTransforms cannot be null");
	78	+ }
	79	+ if (appliedTransforms.isEmpty()) {
	80	+ throw new NullPointerException("appliedTransforms cannot be empty");
	81	+ }
	82	+ if (result == null) {
	83	+ throw new NullPointerException("result cannot be null");
	84	+ }
	85	+ return new DOMReference
	86	+ (uri, type, dm, appliedTransforms, result, transforms, id, getProvider());
	87	+ }
	88	+
	89	+ public Reference newReference(String uri, DigestMethod dm, List transforms,
	90	+ String type, String id, byte[] digestValue) {
	91	+ if (digestValue == null) {
	92	+ throw new NullPointerException("digestValue cannot be null");
	93	+ }
	94	+ return new DOMReference
	95	+ (uri, type, dm, null, null, transforms, id, digestValue, getProvider());
	96	+ }
	97	+
	98	+ public SignedInfo newSignedInfo(CanonicalizationMethod cm,
	99	+ SignatureMethod sm, List references) {
	100	+ return newSignedInfo(cm, sm, references, null);
	101	+ }
	102	+
	103	+ public SignedInfo newSignedInfo(CanonicalizationMethod cm,
	104	+ SignatureMethod sm, List references, String id) {
	105	+ return new DOMSignedInfo(cm, sm, references, id);
	106	+ }
	107	+
	108	+ // Object factory methods
	109	+ public XMLObject newXMLObject(List content, String id, String mimeType,
	110	+ String encoding) {
	111	+ return new DOMXMLObject(content, id, mimeType, encoding);
	112	+ }
	113	+
	114	+ public Manifest newManifest(List references) {
	115	+ return newManifest(references, null);
	116	+ }
	117	+
	118	+ public Manifest newManifest(List references, String id) {
	119	+ return new DOMManifest(references, id);
	120	+ }
	121	+
	122	+ public SignatureProperties newSignatureProperties(List props, String id) {
	123	+ return new DOMSignatureProperties(props, id);
	124	+ }
	125	+
	126	+ public SignatureProperty newSignatureProperty
	127	+ (List info, String target, String id) {
	128	+ return new DOMSignatureProperty(info, target, id);
	129	+ }
	130	+
	131	+ public XMLSignature unmarshalXMLSignature(XMLValidateContext context)
	132	+ throws MarshalException {
	133	+
	134	+ if (context == null) {
	135	+ throw new NullPointerException("context cannot be null");
	136	+ }
	137	+ return unmarshal(((DOMValidateContext) context).getNode(), context);
	138	+ }
	139	+
	140	+ public XMLSignature unmarshalXMLSignature(XMLStructure xmlStructure)
	141	+ throws MarshalException {
	142	+
	143	+ if (xmlStructure == null) {
	144	+ throw new NullPointerException("xmlStructure cannot be null");
	145	+ }
	146	+ return unmarshal
	147	+ (((javax.xml.crypto.dom.DOMStructure) xmlStructure).getNode(),
	148	+ null);
	149	+ }
	150	+
	151	+ private XMLSignature unmarshal(Node node, XMLValidateContext context)
	152	+ throws MarshalException {
	153	+
	154	+ node.normalize();
	155	+
	156	+ Element element = null;
	157	+ if (node.getNodeType() == Node.DOCUMENT_NODE) {
	158	+ element = ((Document) node).getDocumentElement();
	159	+ } else if (node.getNodeType() == Node.ELEMENT_NODE) {
	160	+ element = (Element) node;
	161	+ } else {
	162	+ throw new MarshalException
	163	+ ("Signature element is not a proper Node");
	164	+ }
	165	+
	166	+ // check tag
	167	+ String tag = element.getLocalName();
	168	+ if (tag == null) {
	169	+ throw new MarshalException("Document implementation must " +
	170	+ "support DOM Level 2 and be namespace aware");
	171	+ }
	172	+ if (tag.equals("Signature")) {
	173	+ return new DOMXMLSignature(element, context, getProvider());
	174	+ } else {
	175	+ throw new MarshalException("invalid Signature tag: " + tag);
	176	+ }
	177	+ }
	178	+
	179	+ public boolean isFeatureSupported(String feature) {
	180	+ if (feature == null) {
	181	+ throw new NullPointerException();
	182	+ } else {
	183	+ return false;
	184	+ }
	185	+ }
	186	+
	187	+ public DigestMethod newDigestMethod(String algorithm,
	188	+ DigestMethodParameterSpec params) throws NoSuchAlgorithmException,
	189	+ InvalidAlgorithmParameterException {
	190	+ if (algorithm == null) {
	191	+ throw new NullPointerException();
	192	+ }
	193	+ if (algorithm.equals(DigestMethod.SHA1)) {
	194	+ return new DOMDigestMethod.SHA1(params);
	195	+ } else if (algorithm.equals(DigestMethod.SHA256)) {
	196	+ return new DOMDigestMethod.SHA256(params);
	197	+ } else if (algorithm.equals(DOMDigestMethod.SHA384)) {
	198	+ return new DOMDigestMethod.SHA384(params);
	199	+ } else if (algorithm.equals(DigestMethod.SHA512)) {
	200	+ return new DOMDigestMethod.SHA512(params);
	201	+ } else {
	202	+ throw new NoSuchAlgorithmException("unsupported algorithm");
	203	+ }
	204	+ }
	205	+
	206	+ public SignatureMethod newSignatureMethod(String algorithm,
	207	+ SignatureMethodParameterSpec params) throws NoSuchAlgorithmException,
	208	+ InvalidAlgorithmParameterException {
	209	+ if (algorithm == null) {
	210	+ throw new NullPointerException();
	211	+ }
	212	+ if (algorithm.equals(SignatureMethod.RSA_SHA1)) {
	213	+ return new DOMSignatureMethod.SHA1withRSA(params);
	214	+ } else if (algorithm.equals(DOMSignatureMethod.RSA_SHA256)) {
	215	+ return new DOMSignatureMethod.SHA256withRSA(params);
	216	+ } else if (algorithm.equals(DOMSignatureMethod.RSA_SHA384)) {
	217	+ return new DOMSignatureMethod.SHA384withRSA(params);
	218	+ } else if (algorithm.equals(DOMSignatureMethod.RSA_SHA512)) {
	219	+ return new DOMSignatureMethod.SHA512withRSA(params);
	220	+ } else if (algorithm.equals(SignatureMethod.DSA_SHA1)) {
	221	+ return new DOMSignatureMethod.SHA1withDSA(params);
	222	+ } else if (algorithm.equals(SignatureMethod.HMAC_SHA1)) {
	223	+ return new DOMHMACSignatureMethod.SHA1(params);
	224	+ } else if (algorithm.equals(DOMSignatureMethod.HMAC_SHA256)) {
	225	+ return new DOMHMACSignatureMethod.SHA256(params);
	226	+ } else if (algorithm.equals(DOMSignatureMethod.HMAC_SHA384)) {
	227	+ return new DOMHMACSignatureMethod.SHA384(params);
	228	+ } else if (algorithm.equals(DOMSignatureMethod.HMAC_SHA512)) {
	229	+ return new DOMHMACSignatureMethod.SHA512(params);
	230	+ } else {
	231	+ throw new NoSuchAlgorithmException("unsupported algorithm");
	232	+ }
	233	+ }
	234	+
	235	+ public Transform newTransform(String algorithm,
	236	+ TransformParameterSpec params) throws NoSuchAlgorithmException,
	237	+ InvalidAlgorithmParameterException {
	238	+ TransformService spi;
	239	+ try {
	240	+ spi = TransformService.getInstance(algorithm, "DOM");
	241	+ } catch (NoSuchAlgorithmException nsae) {
	242	+ spi = TransformService.getInstance(algorithm, "DOM", getProvider());
	243	+ }
	244	+ spi.init(params);
	245	+ return new DOMTransform(spi);
	246	+ }
	247	+
	248	+ public Transform newTransform(String algorithm,
	249	+ XMLStructure params) throws NoSuchAlgorithmException,
	250	+ InvalidAlgorithmParameterException {
	251	+ TransformService spi;
	252	+ try {
	253	+ spi = TransformService.getInstance(algorithm, "DOM");
	254	+ } catch (NoSuchAlgorithmException nsae) {
	255	+ spi = TransformService.getInstance(algorithm, "DOM", getProvider());
	256	+ }
	257	+ if (params == null) {
	258	+ spi.init(null);
	259	+ } else {
	260	+ spi.init(params, null);
	261	+ }
	262	+ return new DOMTransform(spi);
	263	+ }
	264	+
	265	+ public CanonicalizationMethod newCanonicalizationMethod(String algorithm,
	266	+ C14NMethodParameterSpec params) throws NoSuchAlgorithmException,
	267	+ InvalidAlgorithmParameterException {
	268	+ TransformService spi;
	269	+ try {
	270	+ spi = TransformService.getInstance(algorithm, "DOM");
	271	+ } catch (NoSuchAlgorithmException nsae) {
	272	+ spi = TransformService.getInstance(algorithm, "DOM", getProvider());
	273	+ }
	274	+ spi.init(params);
	275	+ return new DOMCanonicalizationMethod(spi);
	276	+ }
	277	+
	278	+ public CanonicalizationMethod newCanonicalizationMethod(String algorithm,
	279	+ XMLStructure params) throws NoSuchAlgorithmException,
	280	+ InvalidAlgorithmParameterException {
	281	+ TransformService spi;
	282	+ try {
	283	+ spi = TransformService.getInstance(algorithm, "DOM");
	284	+ } catch (NoSuchAlgorithmException nsae) {
	285	+ spi = TransformService.getInstance(algorithm, "DOM", getProvider());
	286	+ }
	287	+ if (params == null) {
	288	+ spi.init(null);
	289	+ } else {
	290	+ spi.init(params, null);
	291	+ }
	292	+ return new DOMCanonicalizationMethod(spi);
	293	+ }
	294	+
	295	+ public URIDereferencer getURIDereferencer() {
	296	+ return DOMURIDereferencer.INSTANCE;
	297	+ }
	298	+}

java/pkg/org/jcp/xml/dsig/internal/dom/DOMXPathFilter2Transform.class+0−0

Binary file not shown.

java/pkg/org/jcp/xml/dsig/internal/dom/DOMXPathFilter2Transform.java+155−0

@@ -0,0 +1,155 @@
	1	+/*
	2	+ * reserved comment block
	3	+ * DO NOT REMOVE OR ALTER!
	4	+ */
	5	+/*
	6	+ * Copyright 2005 The Apache Software Foundation.
	7	+ *
	8	+ * Licensed under the Apache License, Version 2.0 (the "License");
	9	+ * you may not use this file except in compliance with the License.
	10	+ * You may obtain a copy of the License at
	11	+ *
	12	+ * http://www.apache.org/licenses/LICENSE-2.0
	13	+ *
	14	+ * Unless required by applicable law or agreed to in writing, software
	15	+ * distributed under the License is distributed on an "AS IS" BASIS,
	16	+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
	17	+ * See the License for the specific language governing permissions and
	18	+ * limitations under the License.
	19	+ *
	20	+ */
	21	+/*
	22	+ * ===========================================================================
	23	+ *
	24	+ * (C) Copyright IBM Corp. 2003 All Rights Reserved.
	25	+ *
	26	+ * ===========================================================================
	27	+ */
	28	+/*
	29	+ * Copyright (c) 2005, Oracle and/or its affiliates. All rights reserved.
	30	+ */
	31	+/*
	32	+ * $Id: DOMXPathFilter2Transform.java,v 1.2 2008/07/24 15:20:32 mullan Exp $
	33	+ */
	34	+package org.jcp.xml.dsig.internal.dom;
	35	+
	36	+import javax.xml.crypto.*;
	37	+import javax.xml.crypto.dsig.*;
	38	+import javax.xml.crypto.dsig.spec.TransformParameterSpec;
	39	+import javax.xml.crypto.dsig.spec.XPathType;
	40	+import javax.xml.crypto.dsig.spec.XPathFilter2ParameterSpec;
	41	+import java.security.InvalidAlgorithmParameterException;
	42	+import java.util.ArrayList;
	43	+import java.util.Iterator;
	44	+import java.util.List;
	45	+import java.util.Map;
	46	+import java.util.HashMap;
	47	+import org.w3c.dom.Attr;
	48	+import org.w3c.dom.Element;
	49	+import org.w3c.dom.NamedNodeMap;
	50	+
	51	+/**
	52	+ * DOM-based implementation of XPath Filter 2.0 Transform.
	53	+ * (Uses Apache XML-Sec Transform implementation)
	54	+ *
	55	+ * @author Joyce Leung
	56	+ */
	57	+public final class DOMXPathFilter2Transform extends ApacheTransform {
	58	+
	59	+ public void init(TransformParameterSpec params)
	60	+ throws InvalidAlgorithmParameterException {
	61	+ if (params == null) {
	62	+ throw new InvalidAlgorithmParameterException("params are required");
	63	+ } else if (!(params instanceof XPathFilter2ParameterSpec)) {
	64	+ throw new InvalidAlgorithmParameterException
	65	+ ("params must be of type XPathFilter2ParameterSpec");
	66	+ }
	67	+ this.params = params;
	68	+ }
	69	+
	70	+ public void init(XMLStructure parent, XMLCryptoContext context)
	71	+ throws InvalidAlgorithmParameterException {
	72	+
	73	+ super.init(parent, context);
	74	+ try {
	75	+ unmarshalParams(DOMUtils.getFirstChildElement(transformElem));
	76	+ } catch (MarshalException me) {
	77	+ throw (InvalidAlgorithmParameterException)
	78	+ new InvalidAlgorithmParameterException().initCause(me);
	79	+ }
	80	+ }
	81	+
	82	+ private void unmarshalParams(Element curXPathElem) throws MarshalException {
	83	+ List list = new ArrayList();
	84	+ while (curXPathElem != null) {
	85	+ String xPath = curXPathElem.getFirstChild().getNodeValue();
	86	+ String filterVal =
	87	+ DOMUtils.getAttributeValue(curXPathElem, "Filter");
	88	+ if (filterVal == null) {
	89	+ throw new MarshalException("filter cannot be null");
	90	+ }
	91	+ XPathType.Filter filter = null;
	92	+ if (filterVal.equals("intersect")) {
	93	+ filter = XPathType.Filter.INTERSECT;
	94	+ } else if (filterVal.equals("subtract")) {
	95	+ filter = XPathType.Filter.SUBTRACT;
	96	+ } else if (filterVal.equals("union")) {
	97	+ filter = XPathType.Filter.UNION;
	98	+ } else {
	99	+ throw new MarshalException("Unknown XPathType filter type"
	100	+ + filterVal);
	101	+ }
	102	+ NamedNodeMap attributes = curXPathElem.getAttributes();
	103	+ if (attributes != null) {
	104	+ int length = attributes.getLength();
	105	+ Map namespaceMap = new HashMap(length);
	106	+ for (int i = 0; i < length; i++) {
	107	+ Attr attr = (Attr) attributes.item(i);
	108	+ String prefix = attr.getPrefix();
	109	+ if (prefix != null && prefix.equals("xmlns")) {
	110	+ namespaceMap.put(attr.getLocalName(), attr.getValue());
	111	+ }
	112	+ }
	113	+ list.add(new XPathType(xPath, filter, namespaceMap));
	114	+ } else {
	115	+ list.add(new XPathType(xPath, filter));
	116	+ }
	117	+
	118	+ curXPathElem = DOMUtils.getNextSiblingElement(curXPathElem);
	119	+ }
	120	+ this.params = new XPathFilter2ParameterSpec(list);
	121	+ }
	122	+
	123	+ public void marshalParams(XMLStructure parent, XMLCryptoContext context)
	124	+ throws MarshalException {
	125	+
	126	+ super.marshalParams(parent, context);
	127	+ XPathFilter2ParameterSpec xp =
	128	+ (XPathFilter2ParameterSpec) getParameterSpec();
	129	+ String prefix = DOMUtils.getNSPrefix(context, Transform.XPATH2);
	130	+ String qname = (prefix == null \|\| prefix.length() == 0)
	131	+ ? "xmlns" : "xmlns:" + prefix;
	132	+ List list = xp.getXPathList();
	133	+ for (int i = 0, size = list.size(); i < size; i++) {
	134	+ XPathType xpathType = (XPathType) list.get(i);
	135	+ Element elem = DOMUtils.createElement
	136	+ (ownerDoc, "XPath", Transform.XPATH2, prefix);
	137	+ elem.appendChild
	138	+ (ownerDoc.createTextNode(xpathType.getExpression()));
	139	+ DOMUtils.setAttribute
	140	+ (elem, "Filter", xpathType.getFilter().toString());
	141	+ elem.setAttributeNS("http://www.w3.org/2000/xmlns/", qname,
	142	+ Transform.XPATH2);
	143	+
	144	+ // add namespace attributes, if necessary
	145	+ Iterator it = xpathType.getNamespaceMap().entrySet().iterator();
	146	+ while (it.hasNext()) {
	147	+ Map.Entry entry = (Map.Entry) it.next();
	148	+ elem.setAttributeNS("http://www.w3.org/2000/xmlns/", "xmlns:"
	149	+ + (String) entry.getKey(), (String) entry.getValue());
	150	+ }
	151	+
	152	+ transformElem.appendChild(elem);
	153	+ }
	154	+ }
	155	+}

java/pkg/org/jcp/xml/dsig/internal/dom/DOMXPathTransform.class+0−0

Binary file not shown.

java/pkg/org/jcp/xml/dsig/internal/dom/DOMXPathTransform.java+108−0

@@ -0,0 +1,108 @@
	1	+/*
	2	+ * reserved comment block
	3	+ * DO NOT REMOVE OR ALTER!
	4	+ */
	5	+/*
	6	+ * Copyright 2005 The Apache Software Foundation.
	7	+ *
	8	+ * Licensed under the Apache License, Version 2.0 (the "License");
	9	+ * you may not use this file except in compliance with the License.
	10	+ * You may obtain a copy of the License at
	11	+ *
	12	+ * http://www.apache.org/licenses/LICENSE-2.0
	13	+ *
	14	+ * Unless required by applicable law or agreed to in writing, software
	15	+ * distributed under the License is distributed on an "AS IS" BASIS,
	16	+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
	17	+ * See the License for the specific language governing permissions and
	18	+ * limitations under the License.
	19	+ *
	20	+ */
	21	+/*
	22	+ * Copyright (c) 2005, 2008, Oracle and/or its affiliates. All rights reserved.
	23	+ */
	24	+/*
	25	+ * $Id: DOMXPathTransform.java,v 1.2 2008/07/24 15:20:32 mullan Exp $
	26	+ */
	27	+package org.jcp.xml.dsig.internal.dom;
	28	+
	29	+import javax.xml.crypto.*;
	30	+import javax.xml.crypto.dsig.*;
	31	+import javax.xml.crypto.dsig.spec.TransformParameterSpec;
	32	+import javax.xml.crypto.dsig.spec.XPathFilterParameterSpec;
	33	+import java.security.InvalidAlgorithmParameterException;
	34	+import java.util.Iterator;
	35	+import java.util.Map;
	36	+import java.util.HashMap;
	37	+import org.w3c.dom.Attr;
	38	+import org.w3c.dom.Element;
	39	+import org.w3c.dom.NamedNodeMap;
	40	+
	41	+/**
	42	+ * DOM-based implementation of XPath Filtering Transform.
	43	+ * (Uses Apache XML-Sec Transform implementation)
	44	+ *
	45	+ * @author Sean Mullan
	46	+ */
	47	+public final class DOMXPathTransform extends ApacheTransform {
	48	+
	49	+ public void init(TransformParameterSpec params)
	50	+ throws InvalidAlgorithmParameterException {
	51	+ if (params == null) {
	52	+ throw new InvalidAlgorithmParameterException("params are required");
	53	+ } else if (!(params instanceof XPathFilterParameterSpec)) {
	54	+ throw new InvalidAlgorithmParameterException
	55	+ ("params must be of type XPathFilterParameterSpec");
	56	+ }
	57	+ this.params = params;
	58	+ }
	59	+
	60	+ public void init(XMLStructure parent, XMLCryptoContext context)
	61	+ throws InvalidAlgorithmParameterException {
	62	+
	63	+ super.init(parent, context);
	64	+ unmarshalParams(DOMUtils.getFirstChildElement(transformElem));
	65	+ }
	66	+
	67	+ private void unmarshalParams(Element paramsElem) {
	68	+ String xPath = paramsElem.getFirstChild().getNodeValue();
	69	+ // create a Map of namespace prefixes
	70	+ NamedNodeMap attributes = paramsElem.getAttributes();
	71	+ if (attributes != null) {
	72	+ int length = attributes.getLength();
	73	+ Map namespaceMap = new HashMap(length);
	74	+ for (int i = 0; i < length; i++) {
	75	+ Attr attr = (Attr) attributes.item(i);
	76	+ String prefix = attr.getPrefix();
	77	+ if (prefix != null && prefix.equals("xmlns")) {
	78	+ namespaceMap.put(attr.getLocalName(), attr.getValue());
	79	+ }
	80	+ }
	81	+ this.params = new XPathFilterParameterSpec(xPath, namespaceMap);
	82	+ } else {
	83	+ this.params = new XPathFilterParameterSpec(xPath);
	84	+ }
	85	+ }
	86	+
	87	+ public void marshalParams(XMLStructure parent, XMLCryptoContext context)
	88	+ throws MarshalException {
	89	+
	90	+ super.marshalParams(parent, context);
	91	+ XPathFilterParameterSpec xp =
	92	+ (XPathFilterParameterSpec) getParameterSpec();
	93	+ Element xpathElem = DOMUtils.createElement
	94	+ (ownerDoc, "XPath", XMLSignature.XMLNS,
	95	+ DOMUtils.getSignaturePrefix(context));
	96	+ xpathElem.appendChild(ownerDoc.createTextNode(xp.getXPath()));
	97	+
	98	+ // add namespace attributes, if necessary
	99	+ Iterator i = xp.getNamespaceMap().entrySet().iterator();
	100	+ while (i.hasNext()) {
	101	+ Map.Entry entry = (Map.Entry) i.next();
	102	+ xpathElem.setAttributeNS("http://www.w3.org/2000/xmlns/", "xmlns:"
	103	+ + (String) entry.getKey(), (String) entry.getValue());
	104	+ }
	105	+
	106	+ transformElem.appendChild(xpathElem);
	107	+ }
	108	+}

java/pkg/org/jcp/xml/dsig/internal/dom/DOMXSLTTransform.class+0−0

Binary file not shown.

java/pkg/org/jcp/xml/dsig/internal/dom/DOMXSLTTransform.java+78−0

@@ -0,0 +1,78 @@
	1	+/*
	2	+ * reserved comment block
	3	+ * DO NOT REMOVE OR ALTER!
	4	+ */
	5	+/*
	6	+ * Copyright 2005 The Apache Software Foundation.
	7	+ *
	8	+ * Licensed under the Apache License, Version 2.0 (the "License");
	9	+ * you may not use this file except in compliance with the License.
	10	+ * You may obtain a copy of the License at
	11	+ *
	12	+ * http://www.apache.org/licenses/LICENSE-2.0
	13	+ *
	14	+ * Unless required by applicable law or agreed to in writing, software
	15	+ * distributed under the License is distributed on an "AS IS" BASIS,
	16	+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
	17	+ * See the License for the specific language governing permissions and
	18	+ * limitations under the License.
	19	+ *
	20	+ */
	21	+/*
	22	+ * Copyright (c) 2005, 2008, Oracle and/or its affiliates. All rights reserved.
	23	+ */
	24	+/*
	25	+ * $Id: DOMXSLTTransform.java,v 1.2 2008/07/24 15:20:32 mullan Exp $
	26	+ */
	27	+package org.jcp.xml.dsig.internal.dom;
	28	+
	29	+import java.security.InvalidAlgorithmParameterException;
	30	+import org.w3c.dom.Element;
	31	+import org.w3c.dom.Node;
	32	+
	33	+import javax.xml.crypto.*;
	34	+import javax.xml.crypto.dsig.*;
	35	+import javax.xml.crypto.dsig.spec.TransformParameterSpec;
	36	+import javax.xml.crypto.dsig.spec.XSLTTransformParameterSpec;
	37	+
	38	+/**
	39	+ * DOM-based implementation of XSLT Transform.
	40	+ * (Uses Apache XML-Sec Transform implementation)
	41	+ *
	42	+ * @author Sean Mullan
	43	+ */
	44	+public final class DOMXSLTTransform extends ApacheTransform {
	45	+
	46	+ public void init(TransformParameterSpec params)
	47	+ throws InvalidAlgorithmParameterException {
	48	+ if (params == null) {
	49	+ throw new InvalidAlgorithmParameterException("params are required");
	50	+ }
	51	+ if (!(params instanceof XSLTTransformParameterSpec)) {
	52	+ throw new InvalidAlgorithmParameterException("unrecognized params");
	53	+ }
	54	+ this.params = params;
	55	+ }
	56	+
	57	+ public void init(XMLStructure parent, XMLCryptoContext context)
	58	+ throws InvalidAlgorithmParameterException {
	59	+
	60	+ super.init(parent, context);
	61	+ unmarshalParams(DOMUtils.getFirstChildElement(transformElem));
	62	+ }
	63	+
	64	+ private void unmarshalParams(Element sheet) {
	65	+ this.params = new XSLTTransformParameterSpec
	66	+ (new javax.xml.crypto.dom.DOMStructure(sheet));
	67	+ }
	68	+
	69	+ public void marshalParams(XMLStructure parent, XMLCryptoContext context)
	70	+ throws MarshalException {
	71	+ super.marshalParams(parent, context);
	72	+ XSLTTransformParameterSpec xp =
	73	+ (XSLTTransformParameterSpec) getParameterSpec();
	74	+ Node xsltElem =
	75	+ ((javax.xml.crypto.dom.DOMStructure) xp.getStylesheet()).getNode();
	76	+ DOMUtils.appendChild(transformElem, xsltElem);
	77	+ }
	78	+}

java/pkg/org/jcp/xml/dsig/internal/dom/Utils.class+0−0

Binary file not shown.

java/pkg/org/jcp/xml/dsig/internal/dom/Utils.java+107−0

@@ -0,0 +1,107 @@
	1	+/*
	2	+ * reserved comment block
	3	+ * DO NOT REMOVE OR ALTER!
	4	+ */
	5	+/*
	6	+ * Copyright 2005 The Apache Software Foundation.
	7	+ *
	8	+ * Licensed under the Apache License, Version 2.0 (the "License");
	9	+ * you may not use this file except in compliance with the License.
	10	+ * You may obtain a copy of the License at
	11	+ *
	12	+ * http://www.apache.org/licenses/LICENSE-2.0
	13	+ *
	14	+ * Unless required by applicable law or agreed to in writing, software
	15	+ * distributed under the License is distributed on an "AS IS" BASIS,
	16	+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
	17	+ * See the License for the specific language governing permissions and
	18	+ * limitations under the License.
	19	+ *
	20	+ */
	21	+/*
	22	+ * Copyright (c) 2005, 2008, Oracle and/or its affiliates. All rights reserved.
	23	+ */
	24	+/*
	25	+ * $Id: Utils.java,v 1.2 2008/07/24 15:20:32 mullan Exp $
	26	+ */
	27	+package org.jcp.xml.dsig.internal.dom;
	28	+
	29	+import java.io.ByteArrayOutputStream;
	30	+import java.io.InputStream;
	31	+import java.io.IOException;
	32	+import java.util.*;
	33	+import org.w3c.dom.NamedNodeMap;
	34	+import org.w3c.dom.Node;
	35	+
	36	+/**
	37	+ * Miscellaneous static utility methods for use in JSR 105 RI.
	38	+ *
	39	+ * @author Sean Mullan
	40	+ */
	41	+public final class Utils {
	42	+
	43	+ private Utils() {}
	44	+
	45	+ public static byte[] readBytesFromStream(InputStream is)
	46	+ throws IOException {
	47	+ ByteArrayOutputStream baos = new ByteArrayOutputStream();
	48	+ byte[] buf = new byte[1024];
	49	+ while (true) {
	50	+ int read = is.read(buf);
	51	+ if (read == -1) { // EOF
	52	+ break;
	53	+ }
	54	+ baos.write(buf, 0, read);
	55	+ if (read < 1024) {
	56	+ break;
	57	+ }
	58	+ }
	59	+ return baos.toByteArray();
	60	+ }
	61	+
	62	+ /**
	63	+ * Converts an Iterator to a Set of Nodes, according to the XPath
	64	+ * Data Model.
	65	+ *
	66	+ * @param i the Iterator
	67	+ * @return the Set of Nodes
	68	+ */
	69	+ static Set toNodeSet(Iterator i) {
	70	+ Set nodeSet = new HashSet();
	71	+ while (i.hasNext()) {
	72	+ Node n = (Node) i.next();
	73	+ nodeSet.add(n);
	74	+ // insert attributes nodes to comply with XPath
	75	+ if (n.getNodeType() == Node.ELEMENT_NODE) {
	76	+ NamedNodeMap nnm = n.getAttributes();
	77	+ for (int j = 0, length = nnm.getLength(); j < length; j++) {
	78	+ nodeSet.add(nnm.item(j));
	79	+ }
	80	+ }
	81	+ }
	82	+ return nodeSet;
	83	+ }
	84	+
	85	+ /**
	86	+ * Returns the ID from a same-document URI (ex: "#id")
	87	+ */
	88	+ public static String parseIdFromSameDocumentURI(String uri) {
	89	+ if (uri.length() == 0) {
	90	+ return null;
	91	+ }
	92	+ String id = uri.substring(1);
	93	+ if (id != null && id.startsWith("xpointer(id(")) {
	94	+ int i1 = id.indexOf('\'');
	95	+ int i2 = id.indexOf('\'', i1+1);
	96	+ id = id.substring(i1+1, i2);
	97	+ }
	98	+ return id;
	99	+ }
	100	+
	101	+ /**
	102	+ * Returns true if uri is a same-document URI, false otherwise.
	103	+ */
	104	+ public static boolean sameDocumentURI(String uri) {
	105	+ return (uri != null && (uri.length() == 0 \|\| uri.charAt(0) == '#'));
	106	+ }
	107	+}

java/pkg/org/jcp/xml/dsig/internal/dom/XMLDSigRI$1.class+0−0

Binary file not shown.

java/pkg/org/jcp/xml/dsig/internal/dom/XMLDSigRI.class+0−0

Binary file not shown.

java/pkg/org/jcp/xml/dsig/internal/dom/XMLDSigRI.java+163−0

@@ -0,0 +1,163 @@
	1	+/*
	2	+ * reserved comment block
	3	+ * DO NOT REMOVE OR ALTER!
	4	+ */
	5	+/*
	6	+ * Copyright 2005 The Apache Software Foundation.
	7	+ *
	8	+ * Licensed under the Apache License, Version 2.0 (the "License");
	9	+ * you may not use this file except in compliance with the License.
	10	+ * You may obtain a copy of the License at
	11	+ *
	12	+ * http://www.apache.org/licenses/LICENSE-2.0
	13	+ *
	14	+ * Unless required by applicable law or agreed to in writing, software
	15	+ * distributed under the License is distributed on an "AS IS" BASIS,
	16	+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
	17	+ * See the License for the specific language governing permissions and
	18	+ * limitations under the License.
	19	+ *
	20	+ */
	21	+/*
	22	+ * ===========================================================================
	23	+ *
	24	+ * (C) Copyright IBM Corp. 2003 All Rights Reserved.
	25	+ *
	26	+ * ===========================================================================
	27	+ */
	28	+/*
	29	+ * Copyright (c) 2005, Oracle and/or its affiliates. All rights reserved.
	30	+ */
	31	+/*
	32	+ * $Id: XMLDSigRI.java,v 1.2 2008/07/24 15:20:32 mullan Exp $
	33	+ */
	34	+package org.jcp.xml.dsig.internal.dom;
	35	+
	36	+import java.util.*;
	37	+import java.security.*;
	38	+
	39	+import javax.xml.crypto.dsig.*;
	40	+
	41	+/**
	42	+ * The XMLDSig RI Provider.
	43	+ *
	44	+ * @author Joyce Leung
	45	+ */
	46	+
	47	+/**
	48	+ * Defines the XMLDSigRI provider.
	49	+ */
	50	+
	51	+public final class XMLDSigRI extends Provider {
	52	+
	53	+ static final long serialVersionUID = -5049765099299494554L;
	54	+
	55	+ private static final String INFO = "XMLDSig " +
	56	+ "(DOM XMLSignatureFactory; DOM KeyInfoFactory)";
	57	+
	58	+ public XMLDSigRI() {
	59	+ /* We are the XMLDSig provider */
	60	+ super("XMLDSig", 1.0, INFO);
	61	+
	62	+ final Map map = new HashMap();
	63	+ map.put("XMLSignatureFactory.DOM",
	64	+ "org.jcp.xml.dsig.internal.dom.DOMXMLSignatureFactory");
	65	+ map.put("KeyInfoFactory.DOM",
	66	+ "org.jcp.xml.dsig.internal.dom.DOMKeyInfoFactory");
	67	+
	68	+
	69	+ // Inclusive C14N
	70	+ map.put((String)"TransformService." + CanonicalizationMethod.INCLUSIVE,
	71	+ "org.jcp.xml.dsig.internal.dom.DOMCanonicalXMLC14NMethod");
	72	+ map.put("Alg.Alias.TransformService.INCLUSIVE",
	73	+ CanonicalizationMethod.INCLUSIVE);
	74	+ map.put((String)"TransformService." + CanonicalizationMethod.INCLUSIVE +
	75	+ " MechanismType", "DOM");
	76	+
	77	+ // InclusiveWithComments C14N
	78	+ map.put((String) "TransformService." +
	79	+ CanonicalizationMethod.INCLUSIVE_WITH_COMMENTS,
	80	+ "org.jcp.xml.dsig.internal.dom.DOMCanonicalXMLC14NMethod");
	81	+ map.put("Alg.Alias.TransformService.INCLUSIVE_WITH_COMMENTS",
	82	+ CanonicalizationMethod.INCLUSIVE_WITH_COMMENTS);
	83	+ map.put((String) "TransformService." +
	84	+ CanonicalizationMethod.INCLUSIVE_WITH_COMMENTS +
	85	+ " MechanismType", "DOM");
	86	+
	87	+ // Inclusive C14N 1.1
	88	+ map.put((String)"TransformService." +
	89	+ "http://www.w3.org/2006/12/xml-c14n11",
	90	+ "org.jcp.xml.dsig.internal.dom.DOMCanonicalXMLC14N11Method");
	91	+ map.put((String)"TransformService." +
	92	+ "http://www.w3.org/2006/12/xml-c14n11" +
	93	+ " MechanismType", "DOM");
	94	+
	95	+ // InclusiveWithComments C14N 1.1
	96	+ map.put((String)"TransformService." +
	97	+ "http://www.w3.org/2006/12/xml-c14n11#WithComments",
	98	+ "org.jcp.xml.dsig.internal.dom.DOMCanonicalXMLC14N11Method");
	99	+ map.put((String)"TransformService." +
	100	+ "http://www.w3.org/2006/12/xml-c14n11#WithComments" +
	101	+ " MechanismType", "DOM");
	102	+
	103	+ // Exclusive C14N
	104	+ map.put((String) "TransformService." + CanonicalizationMethod.EXCLUSIVE,
	105	+ "org.jcp.xml.dsig.internal.dom.DOMExcC14NMethod");
	106	+ map.put("Alg.Alias.TransformService.EXCLUSIVE",
	107	+ CanonicalizationMethod.EXCLUSIVE);
	108	+ map.put((String)"TransformService." + CanonicalizationMethod.EXCLUSIVE +
	109	+ " MechanismType", "DOM");
	110	+
	111	+ // ExclusiveWithComments C14N
	112	+ map.put((String) "TransformService." +
	113	+ CanonicalizationMethod.EXCLUSIVE_WITH_COMMENTS,
	114	+ "org.jcp.xml.dsig.internal.dom.DOMExcC14NMethod");
	115	+ map.put("Alg.Alias.TransformService.EXCLUSIVE_WITH_COMMENTS",
	116	+ CanonicalizationMethod.EXCLUSIVE_WITH_COMMENTS);
	117	+ map.put((String) "TransformService." +
	118	+ CanonicalizationMethod.EXCLUSIVE_WITH_COMMENTS +
	119	+ " MechanismType", "DOM");
	120	+
	121	+ // Base64 Transform
	122	+ map.put((String) "TransformService." + Transform.BASE64,
	123	+ "org.jcp.xml.dsig.internal.dom.DOMBase64Transform");
	124	+ map.put("Alg.Alias.TransformService.BASE64", Transform.BASE64);
	125	+ map.put((String) "TransformService." + Transform.BASE64 +
	126	+ " MechanismType", "DOM");
	127	+
	128	+ // Enveloped Transform
	129	+ map.put((String) "TransformService." + Transform.ENVELOPED,
	130	+ "org.jcp.xml.dsig.internal.dom.DOMEnvelopedTransform");
	131	+ map.put("Alg.Alias.TransformService.ENVELOPED", Transform.ENVELOPED);
	132	+ map.put((String) "TransformService." + Transform.ENVELOPED +
	133	+ " MechanismType", "DOM");
	134	+
	135	+ // XPath2 Transform
	136	+ map.put((String) "TransformService." + Transform.XPATH2,
	137	+ "org.jcp.xml.dsig.internal.dom.DOMXPathFilter2Transform");
	138	+ map.put("Alg.Alias.TransformService.XPATH2", Transform.XPATH2);
	139	+ map.put((String) "TransformService." + Transform.XPATH2 +
	140	+ " MechanismType", "DOM");
	141	+
	142	+ // XPath Transform
	143	+ map.put((String) "TransformService." + Transform.XPATH,
	144	+ "org.jcp.xml.dsig.internal.dom.DOMXPathTransform");
	145	+ map.put("Alg.Alias.TransformService.XPATH", Transform.XPATH);
	146	+ map.put((String) "TransformService." + Transform.XPATH +
	147	+ " MechanismType", "DOM");
	148	+
	149	+ // XSLT Transform
	150	+ map.put((String) "TransformService." + Transform.XSLT,
	151	+ "org.jcp.xml.dsig.internal.dom.DOMXSLTTransform");
	152	+ map.put("Alg.Alias.TransformService.XSLT", Transform.XSLT);
	153	+ map.put((String) "TransformService." + Transform.XSLT +
	154	+ " MechanismType", "DOM");
	155	+
	156	+ AccessController.doPrivileged(new java.security.PrivilegedAction() {
	157	+ public Object run() {
	158	+ putAll(map);
	159	+ return null;
	160	+ }
	161	+ });
	162	+ }
	163	+}

java/pkg/org/jcp/xml/dsig/internal/dom/mkfile+48−0

@@ -0,0 +1,48 @@
	1	+<../../../../../../../../mkconfig
	2	+
	3	+TARG=\
	4	+ ApacheCanonicalizer.dis\
	5	+ ApacheData.dis\
	6	+ ApacheNodeSetData.dis\
	7	+ ApacheOctetStreamData.dis\
	8	+ ApacheTransform.dis\
	9	+ DOMBase64Transform.dis\
	10	+ DOMCanonicalizationMethod.dis\
	11	+ DOMCanonicalXMLC14N11Method.dis\
	12	+ DOMCanonicalXMLC14NMethod.dis\
	13	+ DOMCryptoBinary.dis\
	14	+ DOMDigestMethod.dis\
	15	+ DOMEnvelopedTransform.dis\
	16	+ DOMExcC14NMethod.dis\
	17	+ DOMHMACSignatureMethod.dis\
	18	+ DOMKeyInfo.dis\
	19	+ DOMKeyInfoFactory.dis\
	20	+ DOMKeyName.dis\
	21	+ DOMKeyValue.dis\
	22	+ DOMManifest.dis\
	23	+ DOMPGPData.dis\
	24	+ DOMReference.dis\
	25	+ DOMRetrievalMethod.dis\
	26	+ DOMSignatureMethod.dis\
	27	+ DOMSignatureProperties.dis\
	28	+ DOMSignatureProperty.dis\
	29	+ DOMSignedInfo.dis\
	30	+ DOMStructure.dis\
	31	+ DOMSubTreeData.dis\
	32	+ DOMTransform.dis\
	33	+ DOMURIDereferencer.dis\
	34	+ DOMUtils.dis\
	35	+ DOMX509Data.dis\
	36	+ DOMX509IssuerSerial.dis\
	37	+ DOMXMLObject.dis\
	38	+ DOMXMLSignature.dis\
	39	+ DOMXMLSignatureFactory.dis\
	40	+ DOMXPathFilter2Transform.dis\
	41	+ DOMXPathTransform.dis\
	42	+ DOMXSLTTransform.dis\
	43	+ Utils.dis\
	44	+ XMLDSigRI.dis\
	45	+
	46	+DISBIN=$ROOT/java/dis/java/java/org/jcp/xml/dsig/internal/dom
	47	+
	48	+<$ROOT/mkfiles/mkjava

java/pkg/org/jcp/xml/dsig/internal/mkfile+14−0

@@ -0,0 +1,14 @@
	1	+<../../../../../../../mkconfig
	2	+
	3	+DIRS=\
	4	+ dom\
	5	+
	6	+TARG=\
	7	+ DigesterOutputStream.dis\
	8	+ MacOutputStream.dis\
	9	+ SignerOutputStream.dis\
	10	+
	11	+DISBIN=$ROOT/java/dis/java/java/org/jcp/xml/dsig/internal
	12	+
	13	+<$ROOT/mkfiles/mkjava
	14	+<$ROOT/mkfiles/mksubdirs

java/pkg/org/jcp/xml/dsig/mkfile+6−0

@@ -0,0 +1,6 @@
	1	+<../../../../../../mkconfig
	2	+
	3	+DIRS=\
	4	+ internal\
	5	+
	6	+<$ROOT/mkfiles/mksubdirs

java/pkg/org/jcp/xml/mkfile+6−0

@@ -0,0 +1,6 @@
	1	+<../../../../../mkconfig
	2	+
	3	+DIRS=\
	4	+ dsig\
	5	+
	6	+<$ROOT/mkfiles/mksubdirs

java/pkg/org/mkfile+7−0

@@ -0,0 +1,7 @@
	1	+<../../../mkconfig
	2	+
	3	+DIRS=\
	4	+ ietf\
	5	+ jcp\
	6	+
	7	+<$ROOT/mkfiles/mksubdirs