0N/A/*
2362N/A * Copyright (c) 2002, 2006, Oracle and/or its affiliates. All rights reserved.
0N/A * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
0N/A *
0N/A * This code is free software; you can redistribute it and/or modify it
0N/A * under the terms of the GNU General Public License version 2 only, as
2362N/A * published by the Free Software Foundation. Oracle designates this
0N/A * particular file as subject to the "Classpath" exception as provided
2362N/A * by Oracle in the LICENSE file that accompanied this code.
0N/A *
0N/A * This code is distributed in the hope that it will be useful, but WITHOUT
0N/A * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
0N/A * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
0N/A * version 2 for more details (a copy is included in the LICENSE file that
0N/A * accompanied this code).
0N/A *
0N/A * You should have received a copy of the GNU General Public License version
0N/A * 2 along with this work; if not, write to the Free Software Foundation,
0N/A * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
0N/A *
2362N/A * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
2362N/A * or visit www.oracle.com if you need additional information or have any
2362N/A * questions.
0N/A */
0N/A
0N/Apackage sun.security.x509;
0N/A
0N/Aimport java.io.IOException;
0N/Aimport java.util.*;
0N/A
0N/Aimport sun.security.util.BitArray;
0N/Aimport sun.security.util.DerOutputStream;
0N/Aimport sun.security.util.DerValue;
0N/A
0N/A/**
0N/A * Represent the DistributionPoint sequence used in the CRL
0N/A * Distribution Points Extension (OID = 2.5.29.31).
0N/A * <p>
0N/A * The ASN.1 definition for this is:
0N/A * <pre>
0N/A * DistributionPoint ::= SEQUENCE {
0N/A * distributionPoint [0] DistributionPointName OPTIONAL,
0N/A * reasons [1] ReasonFlags OPTIONAL,
0N/A * cRLIssuer [2] GeneralNames OPTIONAL }
0N/A *
0N/A * DistributionPointName ::= CHOICE {
0N/A * fullName [0] GeneralNames,
0N/A * nameRelativeToCRLIssuer [1] RelativeDistinguishedName }
0N/A *
0N/A * ReasonFlags ::= BIT STRING {
0N/A * unused (0),
0N/A * keyCompromise (1),
0N/A * cACompromise (2),
0N/A * affiliationChanged (3),
0N/A * superseded (4),
0N/A * cessationOfOperation (5),
0N/A * certificateHold (6),
0N/A * privilegeWithdrawn (7),
0N/A * aACompromise (8) }
0N/A *
0N/A * GeneralNames ::= SEQUENCE SIZE (1..MAX) OF GeneralName
0N/A *
0N/A * GeneralName ::= CHOICE {
0N/A * otherName [0] INSTANCE OF OTHER-NAME,
0N/A * rfc822Name [1] IA5String,
0N/A * dNSName [2] IA5String,
0N/A * x400Address [3] ORAddress,
0N/A * directoryName [4] Name,
0N/A * ediPartyName [5] EDIPartyName,
0N/A * uniformResourceIdentifier [6] IA5String,
0N/A * iPAddress [7] OCTET STRING,
0N/A * registeredID [8] OBJECT IDENTIFIER }
0N/A *
0N/A * RelativeDistinguishedName ::=
0N/A * SET OF AttributeTypeAndValue
0N/A *
0N/A * AttributeTypeAndValue ::= SEQUENCE {
0N/A * type AttributeType,
0N/A * value AttributeValue }
0N/A *
0N/A * AttributeType ::= OBJECT IDENTIFIER
0N/A *
0N/A * AttributeValue ::= ANY DEFINED BY AttributeType
0N/A * </pre>
0N/A * <p>
0N/A * Instances of this class are designed to be immutable. However, since this
0N/A * is an internal API we do not use defensive cloning for values for
0N/A * performance reasons. It is the responsibility of the consumer to ensure
0N/A * that no mutable elements are modified.
0N/A *
0N/A * @author Anne Anderson
0N/A * @author Andreas Sterbenz
0N/A * @since 1.4.2
0N/A * @see CRLDistributionPointsExtension
0N/A */
0N/Apublic class DistributionPoint {
0N/A
0N/A // reason flag bits
0N/A // NOTE that these are NOT quite the same as the CRL reason code extension
0N/A public final static int KEY_COMPROMISE = 1;
0N/A public final static int CA_COMPROMISE = 2;
0N/A public final static int AFFILIATION_CHANGED = 3;
0N/A public final static int SUPERSEDED = 4;
0N/A public final static int CESSATION_OF_OPERATION = 5;
0N/A public final static int CERTIFICATE_HOLD = 6;
0N/A public final static int PRIVILEGE_WITHDRAWN = 7;
0N/A public final static int AA_COMPROMISE = 8;
0N/A
0N/A private static final String[] REASON_STRINGS = {
0N/A null,
0N/A "key compromise",
0N/A "CA compromise",
0N/A "affiliation changed",
0N/A "superseded",
0N/A "cessation of operation",
0N/A "certificate hold",
0N/A "privilege withdrawn",
0N/A "AA compromise",
0N/A };
0N/A
0N/A // context specific tag values
0N/A private static final byte TAG_DIST_PT = 0;
0N/A private static final byte TAG_REASONS = 1;
0N/A private static final byte TAG_ISSUER = 2;
0N/A
0N/A private static final byte TAG_FULL_NAME = 0;
0N/A private static final byte TAG_REL_NAME = 1;
0N/A
0N/A // only one of fullName and relativeName can be set
0N/A private GeneralNames fullName;
0N/A private RDN relativeName;
0N/A
0N/A // reasonFlags or null
0N/A private boolean[] reasonFlags;
0N/A
0N/A // crlIssuer or null
0N/A private GeneralNames crlIssuer;
0N/A
0N/A // cached hashCode value
0N/A private volatile int hashCode;
0N/A
0N/A /**
0N/A * Constructor for the class using GeneralNames for DistributionPointName
0N/A *
0N/A * @param fullName the GeneralNames of the distribution point; may be null
0N/A * @param reasons the CRL reasons included in the CRL at this distribution
0N/A * point; may be null
0N/A * @param issuer the name(s) of the CRL issuer for the CRL at this
0N/A * distribution point; may be null
0N/A */
0N/A public DistributionPoint(GeneralNames fullName, boolean[] reasonFlags,
0N/A GeneralNames crlIssuer) {
0N/A if ((fullName == null) && (crlIssuer == null)) {
0N/A throw new IllegalArgumentException
0N/A ("fullName and crlIssuer may not both be null");
0N/A }
0N/A this.fullName = fullName;
0N/A this.reasonFlags = reasonFlags;
0N/A this.crlIssuer = crlIssuer;
0N/A }
0N/A
0N/A /**
0N/A * Constructor for the class using RelativeDistinguishedName for
0N/A * DistributionPointName
0N/A *
0N/A * @param relativeName the RelativeDistinguishedName of the distribution
0N/A * point; may not be null
0N/A * @param reasons the CRL reasons included in the CRL at this distribution
0N/A * point; may be null
0N/A * @param issuer the name(s) of the CRL issuer for the CRL at this
0N/A * distribution point; may not be null or empty.
0N/A */
0N/A public DistributionPoint(RDN relativeName, boolean[] reasonFlags,
0N/A GeneralNames crlIssuer) {
0N/A if ((relativeName == null) && (crlIssuer == null)) {
0N/A throw new IllegalArgumentException
0N/A ("relativeName and crlIssuer may not both be null");
0N/A }
0N/A this.relativeName = relativeName;
0N/A this.reasonFlags = reasonFlags;
0N/A this.crlIssuer = crlIssuer;
0N/A }
0N/A
0N/A /**
0N/A * Create the object from the passed DER encoded form.
0N/A *
0N/A * @param val the DER encoded form of the DistributionPoint
0N/A * @throws IOException on error
0N/A */
0N/A public DistributionPoint(DerValue val) throws IOException {
0N/A if (val.tag != DerValue.tag_Sequence) {
0N/A throw new IOException("Invalid encoding of DistributionPoint.");
0N/A }
0N/A
0N/A // Note that all the fields in DistributionPoint are defined as
0N/A // being OPTIONAL, i.e., there could be an empty SEQUENCE, resulting
0N/A // in val.data being null.
0N/A while ((val.data != null) && (val.data.available() != 0)) {
0N/A DerValue opt = val.data.getDerValue();
0N/A
0N/A if (opt.isContextSpecific(TAG_DIST_PT) && opt.isConstructed()) {
0N/A if ((fullName != null) || (relativeName != null)) {
0N/A throw new IOException("Duplicate DistributionPointName in "
0N/A + "DistributionPoint.");
0N/A }
0N/A DerValue distPnt = opt.data.getDerValue();
0N/A if (distPnt.isContextSpecific(TAG_FULL_NAME)
0N/A && distPnt.isConstructed()) {
0N/A distPnt.resetTag(DerValue.tag_Sequence);
0N/A fullName = new GeneralNames(distPnt);
0N/A } else if (distPnt.isContextSpecific(TAG_REL_NAME)
0N/A && distPnt.isConstructed()) {
0N/A distPnt.resetTag(DerValue.tag_Set);
0N/A relativeName = new RDN(distPnt);
0N/A } else {
0N/A throw new IOException("Invalid DistributionPointName in "
0N/A + "DistributionPoint");
0N/A }
0N/A } else if (opt.isContextSpecific(TAG_REASONS)
0N/A && !opt.isConstructed()) {
0N/A if (reasonFlags != null) {
0N/A throw new IOException("Duplicate Reasons in " +
0N/A "DistributionPoint.");
0N/A }
0N/A opt.resetTag(DerValue.tag_BitString);
0N/A reasonFlags = (opt.getUnalignedBitString()).toBooleanArray();
0N/A } else if (opt.isContextSpecific(TAG_ISSUER)
0N/A && opt.isConstructed()) {
0N/A if (crlIssuer != null) {
0N/A throw new IOException("Duplicate CRLIssuer in " +
0N/A "DistributionPoint.");
0N/A }
0N/A opt.resetTag(DerValue.tag_Sequence);
0N/A crlIssuer = new GeneralNames(opt);
0N/A } else {
0N/A throw new IOException("Invalid encoding of " +
0N/A "DistributionPoint.");
0N/A }
0N/A }
0N/A if ((crlIssuer == null) && (fullName == null) && (relativeName == null)) {
0N/A throw new IOException("One of fullName, relativeName, "
0N/A + " and crlIssuer has to be set");
0N/A }
0N/A }
0N/A
0N/A /**
0N/A * Return the full distribution point name or null if not set.
0N/A */
0N/A public GeneralNames getFullName() {
0N/A return fullName;
0N/A }
0N/A
0N/A /**
0N/A * Return the relative distribution point name or null if not set.
0N/A */
0N/A public RDN getRelativeName() {
0N/A return relativeName;
0N/A }
0N/A
0N/A /**
0N/A * Return the reason flags or null if not set.
0N/A */
0N/A public boolean[] getReasonFlags() {
0N/A return reasonFlags;
0N/A }
0N/A
0N/A /**
0N/A * Return the CRL issuer name or null if not set.
0N/A */
0N/A public GeneralNames getCRLIssuer() {
0N/A return crlIssuer;
0N/A }
0N/A
0N/A /**
0N/A * Write the DistributionPoint value to the DerOutputStream.
0N/A *
0N/A * @param out the DerOutputStream to write the extension to.
0N/A * @exception IOException on error.
0N/A */
0N/A public void encode(DerOutputStream out) throws IOException {
0N/A DerOutputStream tagged = new DerOutputStream();
0N/A
0N/A // NOTE: only one of pointNames and pointRDN can be set
0N/A if ((fullName != null) || (relativeName != null)) {
0N/A DerOutputStream distributionPoint = new DerOutputStream();
0N/A if (fullName != null) {
0N/A DerOutputStream derOut = new DerOutputStream();
0N/A fullName.encode(derOut);
0N/A distributionPoint.writeImplicit(
0N/A DerValue.createTag(DerValue.TAG_CONTEXT, true, TAG_FULL_NAME),
0N/A derOut);
0N/A } else if (relativeName != null) {
0N/A DerOutputStream derOut = new DerOutputStream();
0N/A relativeName.encode(derOut);
0N/A distributionPoint.writeImplicit(
0N/A DerValue.createTag(DerValue.TAG_CONTEXT, true, TAG_REL_NAME),
0N/A derOut);
0N/A }
0N/A tagged.write(
0N/A DerValue.createTag(DerValue.TAG_CONTEXT, true, TAG_DIST_PT),
0N/A distributionPoint);
0N/A }
0N/A if (reasonFlags != null) {
0N/A DerOutputStream reasons = new DerOutputStream();
0N/A BitArray rf = new BitArray(reasonFlags);
0N/A reasons.putTruncatedUnalignedBitString(rf);
0N/A tagged.writeImplicit(
0N/A DerValue.createTag(DerValue.TAG_CONTEXT, false, TAG_REASONS),
0N/A reasons);
0N/A }
0N/A if (crlIssuer != null) {
0N/A DerOutputStream issuer = new DerOutputStream();
0N/A crlIssuer.encode(issuer);
0N/A tagged.writeImplicit(
0N/A DerValue.createTag(DerValue.TAG_CONTEXT, true, TAG_ISSUER),
0N/A issuer);
0N/A }
0N/A out.write(DerValue.tag_Sequence, tagged);
0N/A }
0N/A
0N/A /**
0N/A * Utility function for a.equals(b) where both a and b may be null.
0N/A */
0N/A private static boolean equals(Object a, Object b) {
0N/A return (a == null) ? (b == null) : a.equals(b);
0N/A }
0N/A
0N/A /**
0N/A * Compare an object to this DistributionPoint for equality.
0N/A *
0N/A * @param obj Object to be compared to this
0N/A * @return true if objects match; false otherwise
0N/A */
0N/A public boolean equals(Object obj) {
0N/A if (this == obj) {
0N/A return true;
0N/A }
0N/A if (obj instanceof DistributionPoint == false) {
0N/A return false;
0N/A }
0N/A DistributionPoint other = (DistributionPoint)obj;
0N/A
0N/A boolean equal = equals(this.fullName, other.fullName)
0N/A && equals(this.relativeName, other.relativeName)
0N/A && equals(this.crlIssuer, other.crlIssuer)
0N/A && Arrays.equals(this.reasonFlags, other.reasonFlags);
0N/A return equal;
0N/A }
0N/A
0N/A public int hashCode() {
0N/A int hash = hashCode;
0N/A if (hash == 0) {
0N/A hash = 1;
0N/A if (fullName != null) {
0N/A hash += fullName.hashCode();
0N/A }
0N/A if (relativeName != null) {
0N/A hash += relativeName.hashCode();
0N/A }
0N/A if (crlIssuer != null) {
0N/A hash += crlIssuer.hashCode();
0N/A }
0N/A if (reasonFlags != null) {
0N/A for (int i = 0; i < reasonFlags.length; i++) {
0N/A if (reasonFlags[i]) {
0N/A hash += i;
0N/A }
0N/A }
0N/A }
0N/A hashCode = hash;
0N/A }
0N/A return hash;
0N/A }
0N/A
0N/A /**
0N/A * Return a string representation for reasonFlag bit 'reason'.
0N/A */
0N/A private static String reasonToString(int reason) {
0N/A if ((reason > 0) && (reason < REASON_STRINGS.length)) {
0N/A return REASON_STRINGS[reason];
0N/A }
0N/A return "Unknown reason " + reason;
0N/A }
0N/A
0N/A /**
0N/A * Return a printable string of the Distribution Point.
0N/A */
0N/A public String toString() {
0N/A StringBuilder sb = new StringBuilder();
0N/A if (fullName != null) {
0N/A sb.append("DistributionPoint:\n " + fullName + "\n");
0N/A }
0N/A if (relativeName != null) {
0N/A sb.append("DistributionPoint:\n " + relativeName + "\n");
0N/A }
0N/A
0N/A if (reasonFlags != null) {
0N/A sb.append(" ReasonFlags:\n");
0N/A for (int i = 0; i < reasonFlags.length; i++) {
0N/A if (reasonFlags[i]) {
0N/A sb.append(" " + reasonToString(i) + "\n");
0N/A }
0N/A }
0N/A }
0N/A if (crlIssuer != null) {
0N/A sb.append(" CRLIssuer:" + crlIssuer + "\n");
0N/A }
0N/A return sb.toString();
0N/A }
0N/A
0N/A}