0N/A/*
2362N/A * Copyright (c) 2005, 2006, Oracle and/or its affiliates. All rights reserved.
0N/A * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
0N/A *
0N/A * This code is free software; you can redistribute it and/or modify it
0N/A * under the terms of the GNU General Public License version 2 only, as
2362N/A * published by the Free Software Foundation. Oracle designates this
0N/A * particular file as subject to the "Classpath" exception as provided
2362N/A * by Oracle in the LICENSE file that accompanied this code.
0N/A *
0N/A * This code is distributed in the hope that it will be useful, but WITHOUT
0N/A * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
0N/A * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
0N/A * version 2 for more details (a copy is included in the LICENSE file that
0N/A * accompanied this code).
0N/A *
0N/A * You should have received a copy of the GNU General Public License version
0N/A * 2 along with this work; if not, write to the Free Software Foundation,
0N/A * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
0N/A *
2362N/A * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
2362N/A * or visit www.oracle.com if you need additional information or have any
2362N/A * questions.
0N/A */
0N/A
0N/Apackage sun.security.x509;
0N/A
0N/Aimport java.io.IOException;
0N/Aimport java.io.OutputStream;
0N/A
0N/Aimport java.util.*;
0N/A
0N/Aimport sun.security.util.DerInputStream;
0N/Aimport sun.security.util.DerOutputStream;
0N/Aimport sun.security.util.DerValue;
0N/A
0N/A/**
0N/A * Represents the CRL Issuing Distribution Point Extension (OID = 2.5.29.28).
0N/A *
0N/A * <p>
0N/A * The issuing distribution point is a critical CRL extension that
0N/A * identifies the CRL distribution point and scope for a particular CRL,
0N/A * and it indicates whether the CRL covers revocation for end entity
0N/A * certificates only, CA certificates only, attribute certificates only,
0N/A * or a limited set of reason codes.
0N/A *
0N/A * <p>
0N/A * The extension is defined in Section 5.2.5 of
0N/A * <a href="http://www.ietf.org/rfc/rfc3280.txt">Internet X.509 PKI Certific
0N/Aate and Certificate Revocation List (CRL) Profile</a>.
0N/A *
0N/A * <p>
0N/A * Its ASN.1 definition is as follows:
0N/A * <pre>
0N/A * id-ce-issuingDistributionPoint OBJECT IDENTIFIER ::= { id-ce 28 }
0N/A *
0N/A * issuingDistributionPoint ::= SEQUENCE {
0N/A * distributionPoint [0] DistributionPointName OPTIONAL,
0N/A * onlyContainsUserCerts [1] BOOLEAN DEFAULT FALSE,
0N/A * onlyContainsCACerts [2] BOOLEAN DEFAULT FALSE,
0N/A * onlySomeReasons [3] ReasonFlags OPTIONAL,
0N/A * indirectCRL [4] BOOLEAN DEFAULT FALSE,
0N/A * onlyContainsAttributeCerts [5] BOOLEAN DEFAULT FALSE }
0N/A * </pre>
0N/A *
0N/A * @see DistributionPoint
0N/A * @since 1.6
0N/A */
0N/Apublic class IssuingDistributionPointExtension extends Extension
0N/A implements CertAttrSet<String> {
0N/A
0N/A /**
0N/A * Identifier for this attribute, to be used with the
0N/A * get, set, delete methods of Certificate, x509 type.
0N/A */
0N/A public static final String IDENT =
0N/A "x509.info.extensions.IssuingDistributionPoint";
0N/A
0N/A /**
0N/A * Attribute names.
0N/A */
0N/A public static final String NAME = "IssuingDistributionPoint";
0N/A public static final String POINT = "point";
0N/A public static final String REASONS = "reasons";
0N/A public static final String ONLY_USER_CERTS = "only_user_certs";
0N/A public static final String ONLY_CA_CERTS = "only_ca_certs";
0N/A public static final String ONLY_ATTRIBUTE_CERTS = "only_attribute_certs";
0N/A public static final String INDIRECT_CRL = "indirect_crl";
0N/A
0N/A /*
0N/A * The distribution point name for the CRL.
0N/A */
0N/A private DistributionPointName distributionPoint = null;
0N/A
0N/A /*
0N/A * The scope settings for the CRL.
0N/A */
0N/A private ReasonFlags revocationReasons = null;
0N/A private boolean hasOnlyUserCerts = false;
0N/A private boolean hasOnlyCACerts = false;
0N/A private boolean hasOnlyAttributeCerts = false;
0N/A private boolean isIndirectCRL = false;
0N/A
0N/A /*
0N/A * ASN.1 context specific tag values
0N/A */
0N/A private static final byte TAG_DISTRIBUTION_POINT = 0;
0N/A private static final byte TAG_ONLY_USER_CERTS = 1;
0N/A private static final byte TAG_ONLY_CA_CERTS = 2;
0N/A private static final byte TAG_ONLY_SOME_REASONS = 3;
0N/A private static final byte TAG_INDIRECT_CRL = 4;
0N/A private static final byte TAG_ONLY_ATTRIBUTE_CERTS = 5;
0N/A
0N/A /**
0N/A * Creates a critical IssuingDistributionPointExtension.
0N/A *
0N/A * @param distributionPoint the name of the distribution point, or null for
0N/A * none.
0N/A * @param revocationReasons the revocation reasons associated with the
0N/A * distribution point, or null for none.
0N/A * @param hasOnlyUserCerts if <code>true</code> then scope of the CRL
0N/A * includes only user certificates.
0N/A * @param hasOnlyCACerts if <code>true</code> then scope of the CRL
0N/A * includes only CA certificates.
0N/A * @param hasOnlyAttributeCerts if <code>true</code> then scope of the CRL
0N/A * includes only attribute certificates.
0N/A * @param isIndirectCRL if <code>true</code> then the scope of the CRL
0N/A * includes certificates issued by authorities other than the CRL
0N/A * issuer. The responsible authority is indicated by a certificate
0N/A * issuer CRL entry extension.
0N/A * @throws IllegalArgumentException if more than one of
0N/A * <code>hasOnlyUserCerts</code>, <code>hasOnlyCACerts</code>,
0N/A * <code>hasOnlyAttributeCerts</code> is set to <code>true</code>.
0N/A * @throws IOException on encoding error.
0N/A */
0N/A public IssuingDistributionPointExtension(
0N/A DistributionPointName distributionPoint, ReasonFlags revocationReasons,
0N/A boolean hasOnlyUserCerts, boolean hasOnlyCACerts,
0N/A boolean hasOnlyAttributeCerts, boolean isIndirectCRL)
0N/A throws IOException {
0N/A
0N/A if ((hasOnlyUserCerts && (hasOnlyCACerts || hasOnlyAttributeCerts)) ||
0N/A (hasOnlyCACerts && (hasOnlyUserCerts || hasOnlyAttributeCerts)) ||
0N/A (hasOnlyAttributeCerts && (hasOnlyUserCerts || hasOnlyCACerts))) {
0N/A throw new IllegalArgumentException(
0N/A "Only one of hasOnlyUserCerts, hasOnlyCACerts, " +
0N/A "hasOnlyAttributeCerts may be set to true");
0N/A }
0N/A this.extensionId = PKIXExtensions.IssuingDistributionPoint_Id;
0N/A this.critical = true;
0N/A this.distributionPoint = distributionPoint;
0N/A this.revocationReasons = revocationReasons;
0N/A this.hasOnlyUserCerts = hasOnlyUserCerts;
0N/A this.hasOnlyCACerts = hasOnlyCACerts;
0N/A this.hasOnlyAttributeCerts = hasOnlyAttributeCerts;
0N/A this.isIndirectCRL = isIndirectCRL;
0N/A encodeThis();
0N/A }
0N/A
0N/A /**
0N/A * Creates a critical IssuingDistributionPointExtension from its
0N/A * DER-encoding.
0N/A *
0N/A * @param critical true if the extension is to be treated as critical.
0N/A * @param value the DER-encoded value. It must be a <code>byte[]</code>.
0N/A * @exception IOException on decoding error.
0N/A */
0N/A public IssuingDistributionPointExtension(Boolean critical, Object value)
0N/A throws IOException {
0N/A this.extensionId = PKIXExtensions.IssuingDistributionPoint_Id;
0N/A this.critical = critical.booleanValue();
0N/A
0N/A if (!(value instanceof byte[])) {
0N/A throw new IOException("Illegal argument type");
0N/A }
0N/A
0N/A extensionValue = (byte[])value;
0N/A DerValue val = new DerValue(extensionValue);
0N/A if (val.tag != DerValue.tag_Sequence) {
0N/A throw new IOException("Invalid encoding for " +
0N/A "IssuingDistributionPointExtension.");
0N/A }
0N/A
0N/A // All the elements in issuingDistributionPoint are optional
0N/A if ((val.data == null) || (val.data.available() == 0)) {
0N/A return;
0N/A }
0N/A
0N/A DerInputStream in = val.data;
0N/A while (in != null && in.available() != 0) {
0N/A DerValue opt = in.getDerValue();
0N/A
0N/A if (opt.isContextSpecific(TAG_DISTRIBUTION_POINT) &&
0N/A opt.isConstructed()) {
0N/A distributionPoint =
0N/A new DistributionPointName(opt.data.getDerValue());
0N/A } else if (opt.isContextSpecific(TAG_ONLY_USER_CERTS) &&
0N/A !opt.isConstructed()) {
0N/A opt.resetTag(DerValue.tag_Boolean);
0N/A hasOnlyUserCerts = opt.getBoolean();
0N/A } else if (opt.isContextSpecific(TAG_ONLY_CA_CERTS) &&
0N/A !opt.isConstructed()) {
0N/A opt.resetTag(DerValue.tag_Boolean);
0N/A hasOnlyCACerts = opt.getBoolean();
0N/A } else if (opt.isContextSpecific(TAG_ONLY_SOME_REASONS) &&
0N/A !opt.isConstructed()) {
0N/A revocationReasons = new ReasonFlags(opt); // expects tag implicit
0N/A } else if (opt.isContextSpecific(TAG_INDIRECT_CRL) &&
0N/A !opt.isConstructed()) {
0N/A opt.resetTag(DerValue.tag_Boolean);
0N/A isIndirectCRL = opt.getBoolean();
0N/A } else if (opt.isContextSpecific(TAG_ONLY_ATTRIBUTE_CERTS) &&
0N/A !opt.isConstructed()) {
0N/A opt.resetTag(DerValue.tag_Boolean);
0N/A hasOnlyAttributeCerts = opt.getBoolean();
0N/A } else {
0N/A throw new IOException
0N/A ("Invalid encoding of IssuingDistributionPoint");
0N/A }
0N/A }
0N/A }
0N/A
0N/A /**
0N/A * Returns the name of this attribute.
0N/A */
0N/A public String getName() {
0N/A return NAME;
0N/A }
0N/A
0N/A /**
0N/A * Encodes the issuing distribution point extension and writes it to the
0N/A * DerOutputStream.
0N/A *
0N/A * @param out the output stream.
0N/A * @exception IOException on encoding error.
0N/A */
0N/A public void encode(OutputStream out) throws IOException {
0N/A DerOutputStream tmp = new DerOutputStream();
0N/A if (this.extensionValue == null) {
0N/A this.extensionId = PKIXExtensions.IssuingDistributionPoint_Id;
0N/A this.critical = false;
0N/A encodeThis();
0N/A }
0N/A super.encode(tmp);
0N/A out.write(tmp.toByteArray());
0N/A }
0N/A
0N/A /**
0N/A * Sets the attribute value.
0N/A */
0N/A public void set(String name, Object obj) throws IOException {
0N/A if (name.equalsIgnoreCase(POINT)) {
0N/A if (!(obj instanceof DistributionPointName)) {
0N/A throw new IOException(
0N/A "Attribute value should be of type DistributionPointName.");
0N/A }
0N/A distributionPoint = (DistributionPointName)obj;
0N/A
0N/A } else if (name.equalsIgnoreCase(REASONS)) {
0N/A if (!(obj instanceof ReasonFlags)) {
0N/A throw new IOException(
0N/A "Attribute value should be of type ReasonFlags.");
0N/A }
0N/A
0N/A } else if (name.equalsIgnoreCase(INDIRECT_CRL)) {
0N/A if (!(obj instanceof Boolean)) {
0N/A throw new IOException(
0N/A "Attribute value should be of type Boolean.");
0N/A }
0N/A isIndirectCRL = ((Boolean)obj).booleanValue();
0N/A
0N/A } else if (name.equalsIgnoreCase(ONLY_USER_CERTS)) {
0N/A if (!(obj instanceof Boolean)) {
0N/A throw new IOException(
0N/A "Attribute value should be of type Boolean.");
0N/A }
0N/A hasOnlyUserCerts = ((Boolean)obj).booleanValue();
0N/A
0N/A } else if (name.equalsIgnoreCase(ONLY_CA_CERTS)) {
0N/A if (!(obj instanceof Boolean)) {
0N/A throw new IOException(
0N/A "Attribute value should be of type Boolean.");
0N/A }
0N/A hasOnlyCACerts = ((Boolean)obj).booleanValue();
0N/A
0N/A } else if (name.equalsIgnoreCase(ONLY_ATTRIBUTE_CERTS)) {
0N/A if (!(obj instanceof Boolean)) {
0N/A throw new IOException(
0N/A "Attribute value should be of type Boolean.");
0N/A }
0N/A hasOnlyAttributeCerts = ((Boolean)obj).booleanValue();
0N/A
0N/A
0N/A } else {
0N/A throw new IOException("Attribute name [" + name +
0N/A "] not recognized by " +
0N/A "CertAttrSet:IssuingDistributionPointExtension.");
0N/A }
0N/A encodeThis();
0N/A }
0N/A
0N/A /**
0N/A * Gets the attribute value.
0N/A */
0N/A public Object get(String name) throws IOException {
0N/A if (name.equalsIgnoreCase(POINT)) {
0N/A return distributionPoint;
0N/A
0N/A } else if (name.equalsIgnoreCase(INDIRECT_CRL)) {
0N/A return Boolean.valueOf(isIndirectCRL);
0N/A
0N/A } else if (name.equalsIgnoreCase(REASONS)) {
0N/A return revocationReasons;
0N/A
0N/A } else if (name.equalsIgnoreCase(ONLY_USER_CERTS)) {
0N/A return Boolean.valueOf(hasOnlyUserCerts);
0N/A
0N/A } else if (name.equalsIgnoreCase(ONLY_CA_CERTS)) {
0N/A return Boolean.valueOf(hasOnlyCACerts);
0N/A
0N/A } else if (name.equalsIgnoreCase(ONLY_ATTRIBUTE_CERTS)) {
0N/A return Boolean.valueOf(hasOnlyAttributeCerts);
0N/A
0N/A } else {
0N/A throw new IOException("Attribute name [" + name +
0N/A "] not recognized by " +
0N/A "CertAttrSet:IssuingDistributionPointExtension.");
0N/A }
0N/A }
0N/A
0N/A /**
0N/A * Deletes the attribute value.
0N/A */
0N/A public void delete(String name) throws IOException {
0N/A if (name.equalsIgnoreCase(POINT)) {
0N/A distributionPoint = null;
0N/A
0N/A } else if (name.equalsIgnoreCase(INDIRECT_CRL)) {
0N/A isIndirectCRL = false;
0N/A
0N/A } else if (name.equalsIgnoreCase(REASONS)) {
0N/A revocationReasons = null;
0N/A
0N/A } else if (name.equalsIgnoreCase(ONLY_USER_CERTS)) {
0N/A hasOnlyUserCerts = false;
0N/A
0N/A } else if (name.equalsIgnoreCase(ONLY_CA_CERTS)) {
0N/A hasOnlyCACerts = false;
0N/A
0N/A } else if (name.equalsIgnoreCase(ONLY_ATTRIBUTE_CERTS)) {
0N/A hasOnlyAttributeCerts = false;
0N/A
0N/A } else {
0N/A throw new IOException("Attribute name [" + name +
0N/A "] not recognized by " +
0N/A "CertAttrSet:IssuingDistributionPointExtension.");
0N/A }
0N/A encodeThis();
0N/A }
0N/A
0N/A /**
0N/A * Returns an enumeration of names of attributes existing within this
0N/A * attribute.
0N/A */
0N/A public Enumeration<String> getElements() {
0N/A AttributeNameEnumeration elements = new AttributeNameEnumeration();
0N/A elements.addElement(POINT);
0N/A elements.addElement(REASONS);
0N/A elements.addElement(ONLY_USER_CERTS);
0N/A elements.addElement(ONLY_CA_CERTS);
0N/A elements.addElement(ONLY_ATTRIBUTE_CERTS);
0N/A elements.addElement(INDIRECT_CRL);
0N/A return elements.elements();
0N/A }
0N/A
0N/A // Encodes this extension value
0N/A private void encodeThis() throws IOException {
0N/A
0N/A if (distributionPoint == null &&
0N/A revocationReasons == null &&
0N/A !hasOnlyUserCerts &&
0N/A !hasOnlyCACerts &&
0N/A !hasOnlyAttributeCerts &&
0N/A !isIndirectCRL) {
0N/A
0N/A this.extensionValue = null;
0N/A return;
0N/A
0N/A }
0N/A
0N/A DerOutputStream tagged = new DerOutputStream();
0N/A
0N/A if (distributionPoint != null) {
0N/A DerOutputStream tmp = new DerOutputStream();
0N/A distributionPoint.encode(tmp);
0N/A tagged.writeImplicit(DerValue.createTag(DerValue.TAG_CONTEXT, true,
0N/A TAG_DISTRIBUTION_POINT), tmp);
0N/A }
0N/A
0N/A if (hasOnlyUserCerts) {
0N/A DerOutputStream tmp = new DerOutputStream();
0N/A tmp.putBoolean(hasOnlyUserCerts);
0N/A tagged.writeImplicit(DerValue.createTag(DerValue.TAG_CONTEXT, false,
0N/A TAG_ONLY_USER_CERTS), tmp);
0N/A }
0N/A
0N/A if (hasOnlyCACerts) {
0N/A DerOutputStream tmp = new DerOutputStream();
0N/A tmp.putBoolean(hasOnlyCACerts);
0N/A tagged.writeImplicit(DerValue.createTag(DerValue.TAG_CONTEXT, false,
0N/A TAG_ONLY_CA_CERTS), tmp);
0N/A }
0N/A
0N/A if (revocationReasons != null) {
0N/A DerOutputStream tmp = new DerOutputStream();
0N/A revocationReasons.encode(tmp);
0N/A tagged.writeImplicit(DerValue.createTag(DerValue.TAG_CONTEXT, false,
0N/A TAG_ONLY_SOME_REASONS), tmp);
0N/A }
0N/A
0N/A if (isIndirectCRL) {
0N/A DerOutputStream tmp = new DerOutputStream();
0N/A tmp.putBoolean(isIndirectCRL);
0N/A tagged.writeImplicit(DerValue.createTag(DerValue.TAG_CONTEXT, false,
0N/A TAG_INDIRECT_CRL), tmp);
0N/A }
0N/A
0N/A if (hasOnlyAttributeCerts) {
0N/A DerOutputStream tmp = new DerOutputStream();
0N/A tmp.putBoolean(hasOnlyAttributeCerts);
0N/A tagged.writeImplicit(DerValue.createTag(DerValue.TAG_CONTEXT, false,
0N/A TAG_ONLY_ATTRIBUTE_CERTS), tmp);
0N/A }
0N/A
0N/A DerOutputStream seq = new DerOutputStream();
0N/A seq.write(DerValue.tag_Sequence, tagged);
0N/A this.extensionValue = seq.toByteArray();
0N/A }
0N/A
0N/A /**
0N/A * Returns the extension as user readable string.
0N/A */
0N/A public String toString() {
0N/A
0N/A StringBuilder sb = new StringBuilder(super.toString());
0N/A sb.append("IssuingDistributionPoint [\n ");
0N/A
0N/A if (distributionPoint != null) {
0N/A sb.append(distributionPoint);
0N/A }
0N/A
0N/A if (revocationReasons != null) {
0N/A sb.append(revocationReasons);
0N/A }
0N/A
0N/A sb.append((hasOnlyUserCerts)
0N/A ? (" Only contains user certs: true")
0N/A : (" Only contains user certs: false")).append("\n");
0N/A
0N/A sb.append((hasOnlyCACerts)
0N/A ? (" Only contains CA certs: true")
0N/A : (" Only contains CA certs: false")).append("\n");
0N/A
0N/A sb.append((hasOnlyAttributeCerts)
0N/A ? (" Only contains attribute certs: true")
0N/A : (" Only contains attribute certs: false")).append("\n");
0N/A
0N/A sb.append((isIndirectCRL)
0N/A ? (" Indirect CRL: true")
0N/A : (" Indirect CRL: false")).append("\n");
0N/A
0N/A sb.append("]\n");
0N/A
0N/A return sb.toString();
0N/A }
0N/A
0N/A}