0N/A/*
2362N/A * Copyright (c) 1996, 2006, Oracle and/or its affiliates. All rights reserved.
0N/A * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
0N/A *
0N/A * This code is free software; you can redistribute it and/or modify it
0N/A * under the terms of the GNU General Public License version 2 only, as
2362N/A * published by the Free Software Foundation. Oracle designates this
0N/A * particular file as subject to the "Classpath" exception as provided
2362N/A * by Oracle in the LICENSE file that accompanied this code.
0N/A *
0N/A * This code is distributed in the hope that it will be useful, but WITHOUT
0N/A * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
0N/A * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
0N/A * version 2 for more details (a copy is included in the LICENSE file that
0N/A * accompanied this code).
0N/A *
0N/A * You should have received a copy of the GNU General Public License version
0N/A * 2 along with this work; if not, write to the Free Software Foundation,
0N/A * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
0N/A *
2362N/A * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
2362N/A * or visit www.oracle.com if you need additional information or have any
2362N/A * questions.
0N/A */
0N/A
0N/Apackage sun.security.x509;
0N/A
0N/Aimport java.lang.reflect.*;
0N/Aimport java.io.IOException;
0N/Aimport java.io.StringReader;
0N/Aimport java.security.PrivilegedExceptionAction;
0N/Aimport java.security.AccessController;
0N/Aimport java.security.Principal;
0N/Aimport java.util.*;
0N/A
0N/Aimport sun.security.util.*;
0N/Aimport sun.security.pkcs.PKCS9Attribute;
0N/Aimport javax.security.auth.x500.X500Principal;
0N/A
0N/A/**
0N/A * Note: As of 1.4, the public class,
0N/A * javax.security.auth.x500.X500Principal,
0N/A * should be used when parsing, generating, and comparing X.500 DNs.
0N/A * This class contains other useful methods for checking name constraints
0N/A * and retrieving DNs by keyword.
0N/A *
0N/A * <p> X.500 names are used to identify entities, such as those which are
0N/A * identified by X.509 certificates. They are world-wide, hierarchical,
0N/A * and descriptive. Entities can be identified by attributes, and in
0N/A * some systems can be searched for according to those attributes.
0N/A * <p>
0N/A * The ASN.1 for this is:
0N/A * <pre>
0N/A * GeneralName ::= CHOICE {
0N/A * ....
0N/A * directoryName [4] Name,
0N/A * ....
0N/A * Name ::= CHOICE {
0N/A * RDNSequence }
0N/A *
0N/A * RDNSequence ::= SEQUENCE OF RelativeDistinguishedName
0N/A *
0N/A * RelativeDistinguishedName ::=
0N/A * SET OF AttributeTypeAndValue
0N/A *
0N/A * AttributeTypeAndValue ::= SEQUENCE {
0N/A * type AttributeType,
0N/A * value AttributeValue }
0N/A *
0N/A * AttributeType ::= OBJECT IDENTIFIER
0N/A *
0N/A * AttributeValue ::= ANY DEFINED BY AttributeType
0N/A * ....
0N/A * DirectoryString ::= CHOICE {
0N/A * teletexString TeletexString (SIZE (1..MAX)),
0N/A * printableString PrintableString (SIZE (1..MAX)),
0N/A * universalString UniversalString (SIZE (1..MAX)),
0N/A * utf8String UTF8String (SIZE (1.. MAX)),
0N/A * bmpString BMPString (SIZE (1..MAX)) }
0N/A * </pre>
0N/A * <p>
0N/A * This specification requires only a subset of the name comparison
0N/A * functionality specified in the X.500 series of specifications. The
0N/A * requirements for conforming implementations are as follows:
0N/A * <ol TYPE=a>
0N/A * <li>attribute values encoded in different types (e.g.,
0N/A * PrintableString and BMPString) may be assumed to represent
0N/A * different strings;
0N/A * <p>
0N/A * <li>attribute values in types other than PrintableString are case
0N/A * sensitive (this permits matching of attribute values as binary
0N/A * objects);
0N/A * <p>
0N/A * <li>attribute values in PrintableString are not case sensitive
0N/A * (e.g., "Marianne Swanson" is the same as "MARIANNE SWANSON"); and
0N/A * <p>
0N/A * <li>attribute values in PrintableString are compared after
0N/A * removing leading and trailing white space and converting internal
0N/A * substrings of one or more consecutive white space characters to a
0N/A * single space.
0N/A * </ol>
0N/A * <p>
0N/A * These name comparison rules permit a certificate user to validate
0N/A * certificates issued using languages or encodings unfamiliar to the
0N/A * certificate user.
0N/A * <p>
0N/A * In addition, implementations of this specification MAY use these
0N/A * comparison rules to process unfamiliar attribute types for name
0N/A * chaining. This allows implementations to process certificates with
0N/A * unfamiliar attributes in the issuer name.
0N/A * <p>
0N/A * Note that the comparison rules defined in the X.500 series of
0N/A * specifications indicate that the character sets used to encode data
0N/A * in distinguished names are irrelevant. The characters themselves are
0N/A * compared without regard to encoding. Implementations of the profile
0N/A * are permitted to use the comparison algorithm defined in the X.500
0N/A * series. Such an implementation will recognize a superset of name
0N/A * matches recognized by the algorithm specified above.
0N/A * <p>
0N/A * Note that instances of this class are immutable.
0N/A *
0N/A * @author David Brownell
0N/A * @author Amit Kapoor
0N/A * @author Hemma Prafullchandra
0N/A * @see GeneralName
0N/A * @see GeneralNames
0N/A * @see GeneralNameInterface
0N/A */
0N/A
0N/Apublic class X500Name implements GeneralNameInterface, Principal {
0N/A
0N/A private String dn; // roughly RFC 1779 DN, or null
0N/A private String rfc1779Dn; // RFC 1779 compliant DN, or null
0N/A private String rfc2253Dn; // RFC 2253 DN, or null
0N/A private String canonicalDn; // canonical RFC 2253 DN or null
0N/A private RDN[] names; // RDNs (never null)
0N/A private X500Principal x500Principal;
0N/A private byte[] encoded;
0N/A
0N/A // cached immutable list of the RDNs and all the AVAs
0N/A private volatile List<RDN> rdnList;
0N/A private volatile List<AVA> allAvaList;
0N/A
0N/A /**
0N/A * Constructs a name from a conventionally formatted string, such
0N/A * as "CN=Dave, OU=JavaSoft, O=Sun Microsystems, C=US".
0N/A * (RFC 1779 or RFC 2253 style).
0N/A *
0N/A * @param DN X.500 Distinguished Name
0N/A */
0N/A public X500Name(String dname) throws IOException {
0N/A this(dname, Collections.<String, String>emptyMap());
0N/A }
0N/A
0N/A /**
0N/A * Constructs a name from a conventionally formatted string, such
0N/A * as "CN=Dave, OU=JavaSoft, O=Sun Microsystems, C=US".
0N/A * (RFC 1779 or RFC 2253 style).
0N/A *
0N/A * @param DN X.500 Distinguished Name
0N/A * @param keywordMap an additional keyword/OID map
0N/A */
0N/A public X500Name(String dname, Map<String, String> keywordMap)
0N/A throws IOException {
0N/A parseDN(dname, keywordMap);
0N/A }
0N/A
0N/A /**
0N/A * Constructs a name from a string formatted according to format.
0N/A * Currently, the formats DEFAULT and RFC2253 are supported.
0N/A * DEFAULT is the default format used by the X500Name(String)
0N/A * constructor. RFC2253 is format strictly according to RFC2253
0N/A * without extensions.
0N/A *
0N/A * @param DN X.500 Distinguished Name
0N/A */
0N/A public X500Name(String dname, String format) throws IOException {
0N/A if (dname == null) {
0N/A throw new NullPointerException("Name must not be null");
0N/A }
0N/A if (format.equalsIgnoreCase("RFC2253")) {
0N/A parseRFC2253DN(dname);
0N/A } else if (format.equalsIgnoreCase("DEFAULT")) {
0N/A parseDN(dname, Collections.<String, String>emptyMap());
0N/A } else {
0N/A throw new IOException("Unsupported format " + format);
0N/A }
0N/A }
0N/A
0N/A /**
0N/A * Constructs a name from fields common in enterprise application
0N/A * environments.
0N/A *
0N/A * <P><EM><STRONG>NOTE:</STRONG> The behaviour when any of
0N/A * these strings contain characters outside the ASCII range
0N/A * is unspecified in currently relevant standards.</EM>
0N/A *
0N/A * @param commonName common name of a person, e.g. "Vivette Davis"
0N/A * @param organizationUnit small organization name, e.g. "Purchasing"
0N/A * @param organizationName large organization name, e.g. "Onizuka, Inc."
0N/A * @param country two letter country code, e.g. "CH"
0N/A */
0N/A public X500Name(String commonName, String organizationUnit,
0N/A String organizationName, String country)
0N/A throws IOException {
0N/A names = new RDN[4];
0N/A /*
0N/A * NOTE: it's only on output that little-endian
0N/A * ordering is used.
0N/A */
0N/A names[3] = new RDN(1);
0N/A names[3].assertion[0] = new AVA(commonName_oid,
0N/A new DerValue(commonName));
0N/A names[2] = new RDN(1);
0N/A names[2].assertion[0] = new AVA(orgUnitName_oid,
0N/A new DerValue(organizationUnit));
0N/A names[1] = new RDN(1);
0N/A names[1].assertion[0] = new AVA(orgName_oid,
0N/A new DerValue(organizationName));
0N/A names[0] = new RDN(1);
0N/A names[0].assertion[0] = new AVA(countryName_oid,
0N/A new DerValue(country));
0N/A }
0N/A
0N/A /**
0N/A * Constructs a name from fields common in Internet application
0N/A * environments.
0N/A *
0N/A * <P><EM><STRONG>NOTE:</STRONG> The behaviour when any of
0N/A * these strings contain characters outside the ASCII range
0N/A * is unspecified in currently relevant standards.</EM>
0N/A *
0N/A * @param commonName common name of a person, e.g. "Vivette Davis"
0N/A * @param organizationUnit small organization name, e.g. "Purchasing"
0N/A * @param organizationName large organization name, e.g. "Onizuka, Inc."
0N/A * @param localityName locality (city) name, e.g. "Palo Alto"
0N/A * @param stateName state name, e.g. "California"
0N/A * @param country two letter country code, e.g. "CH"
0N/A */
0N/A public X500Name(String commonName, String organizationUnit,
0N/A String organizationName, String localityName,
0N/A String stateName, String country)
0N/A throws IOException {
0N/A names = new RDN[6];
0N/A /*
0N/A * NOTE: it's only on output that little-endian
0N/A * ordering is used.
0N/A */
0N/A names[5] = new RDN(1);
0N/A names[5].assertion[0] = new AVA(commonName_oid,
0N/A new DerValue(commonName));
0N/A names[4] = new RDN(1);
0N/A names[4].assertion[0] = new AVA(orgUnitName_oid,
0N/A new DerValue(organizationUnit));
0N/A names[3] = new RDN(1);
0N/A names[3].assertion[0] = new AVA(orgName_oid,
0N/A new DerValue(organizationName));
0N/A names[2] = new RDN(1);
0N/A names[2].assertion[0] = new AVA(localityName_oid,
0N/A new DerValue(localityName));
0N/A names[1] = new RDN(1);
0N/A names[1].assertion[0] = new AVA(stateName_oid,
0N/A new DerValue(stateName));
0N/A names[0] = new RDN(1);
0N/A names[0].assertion[0] = new AVA(countryName_oid,
0N/A new DerValue(country));
0N/A }
0N/A
0N/A /**
0N/A * Constructs a name from an array of relative distinguished names
0N/A *
0N/A * @param rdnArray array of relative distinguished names
0N/A * @throws IOException on error
0N/A */
0N/A public X500Name(RDN[] rdnArray) throws IOException {
0N/A if (rdnArray == null) {
0N/A names = new RDN[0];
0N/A } else {
0N/A names = rdnArray.clone();
0N/A for (int i = 0; i < names.length; i++) {
0N/A if (names[i] == null) {
0N/A throw new IOException("Cannot create an X500Name");
0N/A }
0N/A }
0N/A }
0N/A }
0N/A
0N/A /**
0N/A * Constructs a name from an ASN.1 encoded value. The encoding
0N/A * of the name in the stream uses DER (a BER/1 subset).
0N/A *
0N/A * @param value a DER-encoded value holding an X.500 name.
0N/A */
0N/A public X500Name(DerValue value) throws IOException {
0N/A //Note that toDerInputStream uses only the buffer (data) and not
0N/A //the tag, so an empty SEQUENCE (OF) will yield an empty DerInputStream
0N/A this(value.toDerInputStream());
0N/A }
0N/A
0N/A /**
0N/A * Constructs a name from an ASN.1 encoded input stream. The encoding
0N/A * of the name in the stream uses DER (a BER/1 subset).
0N/A *
0N/A * @param in DER-encoded data holding an X.500 name.
0N/A */
0N/A public X500Name(DerInputStream in) throws IOException {
0N/A parseDER(in);
0N/A }
0N/A
0N/A /**
0N/A * Constructs a name from an ASN.1 encoded byte array.
0N/A *
0N/A * @param name DER-encoded byte array holding an X.500 name.
0N/A */
0N/A public X500Name(byte[] name) throws IOException {
0N/A DerInputStream in = new DerInputStream(name);
0N/A parseDER(in);
0N/A }
0N/A
0N/A /**
0N/A * Return an immutable List of all RDNs in this X500Name.
0N/A */
0N/A public List<RDN> rdns() {
0N/A List<RDN> list = rdnList;
0N/A if (list == null) {
0N/A list = Collections.unmodifiableList(Arrays.asList(names));
0N/A rdnList = list;
0N/A }
0N/A return list;
0N/A }
0N/A
0N/A /**
0N/A * Return the number of RDNs in this X500Name.
0N/A */
0N/A public int size() {
0N/A return names.length;
0N/A }
0N/A
0N/A /**
0N/A * Return an immutable List of the the AVAs contained in all the
0N/A * RDNs of this X500Name.
0N/A */
0N/A public List<AVA> allAvas() {
0N/A List<AVA> list = allAvaList;
0N/A if (list == null) {
0N/A list = new ArrayList<AVA>();
0N/A for (int i = 0; i < names.length; i++) {
0N/A list.addAll(names[i].avas());
0N/A }
0N/A }
0N/A return list;
0N/A }
0N/A
0N/A /**
0N/A * Return the total number of AVAs contained in all the RDNs of
0N/A * this X500Name.
0N/A */
0N/A public int avaSize() {
0N/A return allAvas().size();
0N/A }
0N/A
0N/A /**
0N/A * Return whether this X500Name is empty. An X500Name is not empty
0N/A * if it has at least one RDN containing at least one AVA.
0N/A */
0N/A public boolean isEmpty() {
0N/A int n = names.length;
0N/A if (n == 0) {
0N/A return true;
0N/A }
0N/A for (int i = 0; i < n; i++) {
0N/A if (names[i].assertion.length != 0) {
0N/A return false;
0N/A }
0N/A }
0N/A return true;
0N/A }
0N/A
0N/A /**
0N/A * Calculates a hash code value for the object. Objects
0N/A * which are equal will also have the same hashcode.
0N/A */
0N/A public int hashCode() {
0N/A return getRFC2253CanonicalName().hashCode();
0N/A }
0N/A
0N/A /**
0N/A * Compares this name with another, for equality.
0N/A *
0N/A * @return true iff the names are identical.
0N/A */
0N/A public boolean equals(Object obj) {
0N/A if (this == obj) {
0N/A return true;
0N/A }
0N/A if (obj instanceof X500Name == false) {
0N/A return false;
0N/A }
0N/A X500Name other = (X500Name)obj;
0N/A // if we already have the canonical forms, compare now
0N/A if ((this.canonicalDn != null) && (other.canonicalDn != null)) {
0N/A return this.canonicalDn.equals(other.canonicalDn);
0N/A }
0N/A // quick check that number of RDNs and AVAs match before canonicalizing
0N/A int n = this.names.length;
0N/A if (n != other.names.length) {
0N/A return false;
0N/A }
0N/A for (int i = 0; i < n; i++) {
0N/A RDN r1 = this.names[i];
0N/A RDN r2 = other.names[i];
0N/A if (r1.assertion.length != r2.assertion.length) {
0N/A return false;
0N/A }
0N/A }
0N/A // definite check via canonical form
0N/A String thisCanonical = this.getRFC2253CanonicalName();
0N/A String otherCanonical = other.getRFC2253CanonicalName();
0N/A return thisCanonical.equals(otherCanonical);
0N/A }
0N/A
0N/A /*
0N/A * Returns the name component as a Java string, regardless of its
0N/A * encoding restrictions.
0N/A */
0N/A private String getString(DerValue attribute) throws IOException {
0N/A if (attribute == null)
0N/A return null;
0N/A String value = attribute.getAsString();
0N/A
0N/A if (value == null)
0N/A throw new IOException("not a DER string encoding, "
0N/A + attribute.tag);
0N/A else
0N/A return value;
0N/A }
0N/A
0N/A /**
0N/A * Return type of GeneralName.
0N/A */
0N/A public int getType() {
0N/A return (GeneralNameInterface.NAME_DIRECTORY);
0N/A }
0N/A
0N/A /**
0N/A * Returns a "Country" name component. If more than one
0N/A * such attribute exists, the topmost one is returned.
0N/A *
0N/A * @return "C=" component of the name, if any.
0N/A */
0N/A public String getCountry() throws IOException {
0N/A DerValue attr = findAttribute(countryName_oid);
0N/A
0N/A return getString(attr);
0N/A }
0N/A
0N/A
0N/A /**
0N/A * Returns an "Organization" name component. If more than
0N/A * one such attribute exists, the topmost one is returned.
0N/A *
0N/A * @return "O=" component of the name, if any.
0N/A */
0N/A public String getOrganization() throws IOException {
0N/A DerValue attr = findAttribute(orgName_oid);
0N/A
0N/A return getString(attr);
0N/A }
0N/A
0N/A
0N/A /**
0N/A * Returns an "Organizational Unit" name component. If more
0N/A * than one such attribute exists, the topmost one is returned.
0N/A *
0N/A * @return "OU=" component of the name, if any.
0N/A */
0N/A public String getOrganizationalUnit() throws IOException {
0N/A DerValue attr = findAttribute(orgUnitName_oid);
0N/A
0N/A return getString(attr);
0N/A }
0N/A
0N/A
0N/A /**
0N/A * Returns a "Common Name" component. If more than one such
0N/A * attribute exists, the topmost one is returned.
0N/A *
0N/A * @return "CN=" component of the name, if any.
0N/A */
0N/A public String getCommonName() throws IOException {
0N/A DerValue attr = findAttribute(commonName_oid);
0N/A
0N/A return getString(attr);
0N/A }
0N/A
0N/A
0N/A /**
0N/A * Returns a "Locality" name component. If more than one
0N/A * such component exists, the topmost one is returned.
0N/A *
0N/A * @return "L=" component of the name, if any.
0N/A */
0N/A public String getLocality() throws IOException {
0N/A DerValue attr = findAttribute(localityName_oid);
0N/A
0N/A return getString(attr);
0N/A }
0N/A
0N/A /**
0N/A * Returns a "State" name component. If more than one
0N/A * such component exists, the topmost one is returned.
0N/A *
0N/A * @return "S=" component of the name, if any.
0N/A */
0N/A public String getState() throws IOException {
0N/A DerValue attr = findAttribute(stateName_oid);
0N/A
0N/A return getString(attr);
0N/A }
0N/A
0N/A /**
0N/A * Returns a "Domain" name component. If more than one
0N/A * such component exists, the topmost one is returned.
0N/A *
0N/A * @return "DC=" component of the name, if any.
0N/A */
0N/A public String getDomain() throws IOException {
0N/A DerValue attr = findAttribute(DOMAIN_COMPONENT_OID);
0N/A
0N/A return getString(attr);
0N/A }
0N/A
0N/A /**
0N/A * Returns a "DN Qualifier" name component. If more than one
0N/A * such component exists, the topmost one is returned.
0N/A *
0N/A * @return "DNQ=" component of the name, if any.
0N/A */
0N/A public String getDNQualifier() throws IOException {
0N/A DerValue attr = findAttribute(DNQUALIFIER_OID);
0N/A
0N/A return getString(attr);
0N/A }
0N/A
0N/A /**
0N/A * Returns a "Surname" name component. If more than one
0N/A * such component exists, the topmost one is returned.
0N/A *
0N/A * @return "SURNAME=" component of the name, if any.
0N/A */
0N/A public String getSurname() throws IOException {
0N/A DerValue attr = findAttribute(SURNAME_OID);
0N/A
0N/A return getString(attr);
0N/A }
0N/A
0N/A /**
0N/A * Returns a "Given Name" name component. If more than one
0N/A * such component exists, the topmost one is returned.
0N/A *
0N/A * @return "GIVENNAME=" component of the name, if any.
0N/A */
0N/A public String getGivenName() throws IOException {
0N/A DerValue attr = findAttribute(GIVENNAME_OID);
0N/A
0N/A return getString(attr);
0N/A }
0N/A
0N/A /**
0N/A * Returns an "Initials" name component. If more than one
0N/A * such component exists, the topmost one is returned.
0N/A *
0N/A * @return "INITIALS=" component of the name, if any.
0N/A */
0N/A public String getInitials() throws IOException {
0N/A DerValue attr = findAttribute(INITIALS_OID);
0N/A
0N/A return getString(attr);
0N/A }
0N/A
0N/A /**
0N/A * Returns a "Generation Qualifier" name component. If more than one
0N/A * such component exists, the topmost one is returned.
0N/A *
0N/A * @return "GENERATION=" component of the name, if any.
0N/A */
0N/A public String getGeneration() throws IOException {
0N/A DerValue attr = findAttribute(GENERATIONQUALIFIER_OID);
0N/A
0N/A return getString(attr);
0N/A }
0N/A
0N/A /**
0N/A * Returns an "IP address" name component. If more than one
0N/A * such component exists, the topmost one is returned.
0N/A *
0N/A * @return "IP=" component of the name, if any.
0N/A */
0N/A public String getIP() throws IOException {
0N/A DerValue attr = findAttribute(ipAddress_oid);
0N/A
0N/A return getString(attr);
0N/A }
0N/A
0N/A /**
0N/A * Returns a string form of the X.500 distinguished name.
0N/A * The format of the string is from RFC 1779. The returned string
0N/A * may contain non-standardised keywords for more readability
0N/A * (keywords from RFCs 1779, 2253, and 3280).
0N/A */
0N/A public String toString() {
0N/A if (dn == null) {
0N/A generateDN();
0N/A }
0N/A return dn;
0N/A }
0N/A
0N/A /**
0N/A * Returns a string form of the X.500 distinguished name
0N/A * using the algorithm defined in RFC 1779. Only standard attribute type
0N/A * keywords defined in RFC 1779 are emitted.
0N/A */
0N/A public String getRFC1779Name() {
0N/A return getRFC1779Name(Collections.<String, String>emptyMap());
0N/A }
0N/A
0N/A /**
0N/A * Returns a string form of the X.500 distinguished name
0N/A * using the algorithm defined in RFC 1779. Attribute type
0N/A * keywords defined in RFC 1779 are emitted, as well as additional
0N/A * keywords contained in the OID/keyword map.
0N/A */
0N/A public String getRFC1779Name(Map<String, String> oidMap)
0N/A throws IllegalArgumentException {
0N/A if (oidMap.isEmpty()) {
0N/A // return cached result
0N/A if (rfc1779Dn != null) {
0N/A return rfc1779Dn;
0N/A } else {
0N/A rfc1779Dn = generateRFC1779DN(oidMap);
0N/A return rfc1779Dn;
0N/A }
0N/A }
0N/A return generateRFC1779DN(oidMap);
0N/A }
0N/A
0N/A /**
0N/A * Returns a string form of the X.500 distinguished name
0N/A * using the algorithm defined in RFC 2253. Only standard attribute type
0N/A * keywords defined in RFC 2253 are emitted.
0N/A */
0N/A public String getRFC2253Name() {
0N/A return getRFC2253Name(Collections.<String, String>emptyMap());
0N/A }
0N/A
0N/A /**
0N/A * Returns a string form of the X.500 distinguished name
0N/A * using the algorithm defined in RFC 2253. Attribute type
0N/A * keywords defined in RFC 2253 are emitted, as well as additional
0N/A * keywords contained in the OID/keyword map.
0N/A */
0N/A public String getRFC2253Name(Map<String, String> oidMap) {
0N/A /* check for and return cached name */
0N/A if (oidMap.isEmpty()) {
0N/A if (rfc2253Dn != null) {
0N/A return rfc2253Dn;
0N/A } else {
0N/A rfc2253Dn = generateRFC2253DN(oidMap);
0N/A return rfc2253Dn;
0N/A }
0N/A }
0N/A return generateRFC2253DN(oidMap);
0N/A }
0N/A
0N/A private String generateRFC2253DN(Map<String, String> oidMap) {
0N/A /*
0N/A * Section 2.1 : if the RDNSequence is an empty sequence
0N/A * the result is the empty or zero length string.
0N/A */
0N/A if (names.length == 0) {
0N/A return "";
0N/A }
0N/A
0N/A /*
0N/A * 2.1 (continued) : Otherwise, the output consists of the string
0N/A * encodings of each RelativeDistinguishedName in the RDNSequence
0N/A * (according to 2.2), starting with the last element of the sequence
0N/A * and moving backwards toward the first.
0N/A *
0N/A * The encodings of adjoining RelativeDistinguishedNames are separated
0N/A * by a comma character (',' ASCII 44).
0N/A */
0N/A StringBuilder fullname = new StringBuilder(48);
0N/A for (int i = names.length - 1; i >= 0; i--) {
0N/A if (i < names.length - 1) {
0N/A fullname.append(',');
0N/A }
0N/A fullname.append(names[i].toRFC2253String(oidMap));
0N/A }
0N/A return fullname.toString();
0N/A }
0N/A
0N/A public String getRFC2253CanonicalName() {
0N/A /* check for and return cached name */
0N/A if (canonicalDn != null) {
0N/A return canonicalDn;
0N/A }
0N/A /*
0N/A * Section 2.1 : if the RDNSequence is an empty sequence
0N/A * the result is the empty or zero length string.
0N/A */
0N/A if (names.length == 0) {
0N/A canonicalDn = "";
0N/A return canonicalDn;
0N/A }
0N/A
0N/A /*
0N/A * 2.1 (continued) : Otherwise, the output consists of the string
0N/A * encodings of each RelativeDistinguishedName in the RDNSequence
0N/A * (according to 2.2), starting with the last element of the sequence
0N/A * and moving backwards toward the first.
0N/A *
0N/A * The encodings of adjoining RelativeDistinguishedNames are separated
0N/A * by a comma character (',' ASCII 44).
0N/A */
0N/A StringBuilder fullname = new StringBuilder(48);
0N/A for (int i = names.length - 1; i >= 0; i--) {
0N/A if (i < names.length - 1) {
0N/A fullname.append(',');
0N/A }
0N/A fullname.append(names[i].toRFC2253String(true));
0N/A }
0N/A canonicalDn = fullname.toString();
0N/A return canonicalDn;
0N/A }
0N/A
0N/A /**
0N/A * Returns the value of toString(). This call is needed to
0N/A * implement the java.security.Principal interface.
0N/A */
0N/A public String getName() { return toString(); }
0N/A
0N/A /**
0N/A * Find the first instance of this attribute in a "top down"
0N/A * search of all the attributes in the name.
0N/A */
0N/A private DerValue findAttribute(ObjectIdentifier attribute) {
0N/A if (names != null) {
0N/A for (int i = 0; i < names.length; i++) {
0N/A DerValue value = names[i].findAttribute(attribute);
0N/A if (value != null) {
0N/A return value;
0N/A }
0N/A }
0N/A }
0N/A return null;
0N/A }
0N/A
0N/A /**
0N/A * Find the most specific ("last") attribute of the given
0N/A * type.
0N/A */
0N/A public DerValue findMostSpecificAttribute(ObjectIdentifier attribute) {
0N/A if (names != null) {
0N/A for (int i = names.length - 1; i >= 0; i--) {
0N/A DerValue value = names[i].findAttribute(attribute);
0N/A if (value != null) {
0N/A return value;
0N/A }
0N/A }
0N/A }
0N/A return null;
0N/A }
0N/A
0N/A /****************************************************************/
0N/A
0N/A private void parseDER(DerInputStream in) throws IOException {
0N/A //
0N/A // X.500 names are a "SEQUENCE OF" RDNs, which means zero or
0N/A // more and order matters. We scan them in order, which
0N/A // conventionally is big-endian.
0N/A //
0N/A DerValue[] nameseq = null;
0N/A byte[] derBytes = in.toByteArray();
0N/A
0N/A try {
0N/A nameseq = in.getSequence(5);
0N/A } catch (IOException ioe) {
0N/A if (derBytes == null) {
0N/A nameseq = null;
0N/A } else {
0N/A DerValue derVal = new DerValue(DerValue.tag_Sequence,
0N/A derBytes);
0N/A derBytes = derVal.toByteArray();
0N/A nameseq = new DerInputStream(derBytes).getSequence(5);
0N/A }
0N/A }
0N/A
0N/A if (nameseq == null) {
0N/A names = new RDN[0];
0N/A } else {
0N/A names = new RDN[nameseq.length];
0N/A for (int i = 0; i < nameseq.length; i++) {
0N/A names[i] = new RDN(nameseq[i]);
0N/A }
0N/A }
0N/A }
0N/A
0N/A /**
0N/A * Encodes the name in DER-encoded form.
0N/A *
0N/A * @deprecated Use encode() instead
0N/A * @param out where to put the DER-encoded X.500 name
0N/A */
0N/A @Deprecated
0N/A public void emit(DerOutputStream out) throws IOException {
0N/A encode(out);
0N/A }
0N/A
0N/A /**
0N/A * Encodes the name in DER-encoded form.
0N/A *
0N/A * @param out where to put the DER-encoded X.500 name
0N/A */
0N/A public void encode(DerOutputStream out) throws IOException {
0N/A DerOutputStream tmp = new DerOutputStream();
0N/A for (int i = 0; i < names.length; i++) {
0N/A names[i].encode(tmp);
0N/A }
0N/A out.write(DerValue.tag_Sequence, tmp);
0N/A }
0N/A
0N/A /**
0N/A * Returned the encoding as an uncloned byte array. Callers must
0N/A * guarantee that they neither modify it not expose it to untrusted
0N/A * code.
0N/A */
0N/A public byte[] getEncodedInternal() throws IOException {
0N/A if (encoded == null) {
0N/A DerOutputStream out = new DerOutputStream();
0N/A DerOutputStream tmp = new DerOutputStream();
0N/A for (int i = 0; i < names.length; i++) {
0N/A names[i].encode(tmp);
0N/A }
0N/A out.write(DerValue.tag_Sequence, tmp);
0N/A encoded = out.toByteArray();
0N/A }
0N/A return encoded;
0N/A }
0N/A
0N/A /**
0N/A * Gets the name in DER-encoded form.
0N/A *
0N/A * @return the DER encoded byte array of this name.
0N/A */
0N/A public byte[] getEncoded() throws IOException {
0N/A return getEncodedInternal().clone();
0N/A }
0N/A
0N/A /*
0N/A * Parses a Distinguished Name (DN) in printable representation.
0N/A *
0N/A * According to RFC 1779, RDNs in a DN are separated by comma.
0N/A * The following examples show both methods of quoting a comma, so that it
0N/A * is not considered a separator:
0N/A *
0N/A * O="Sue, Grabbit and Runn" or
0N/A * O=Sue\, Grabbit and Runn
0N/A *
0N/A * This method can parse 1779 or 2253 DNs and non-standard 3280 keywords.
0N/A * Additional keywords can be specified in the keyword/OID map.
0N/A */
0N/A private void parseDN(String input, Map<String, String> keywordMap)
0N/A throws IOException {
0N/A if (input == null || input.length() == 0) {
0N/A names = new RDN[0];
0N/A return;
0N/A }
0N/A
0N/A List<RDN> dnVector = new ArrayList<RDN>();
0N/A int dnOffset = 0;
0N/A int rdnEnd;
0N/A String rdnString;
0N/A int quoteCount = 0;
0N/A
0N/A String dnString = input;
0N/A
0N/A int searchOffset = 0;
0N/A int nextComma = dnString.indexOf(',');
0N/A int nextSemiColon = dnString.indexOf(';');
0N/A while (nextComma >=0 || nextSemiColon >=0) {
0N/A
0N/A if (nextSemiColon < 0) {
0N/A rdnEnd = nextComma;
0N/A } else if (nextComma < 0) {
0N/A rdnEnd = nextSemiColon;
0N/A } else {
0N/A rdnEnd = Math.min(nextComma, nextSemiColon);
0N/A }
0N/A quoteCount += countQuotes(dnString, searchOffset, rdnEnd);
0N/A
0N/A /*
0N/A * We have encountered an RDN delimiter (comma or a semicolon).
0N/A * If the comma or semicolon in the RDN under consideration is
0N/A * preceded by a backslash (escape), or by a double quote, it
0N/A * is part of the RDN. Otherwise, it is used as a separator, to
0N/A * delimit the RDN under consideration from any subsequent RDNs.
0N/A */
0N/A if (rdnEnd >= 0 && quoteCount != 1 &&
0N/A !escaped(rdnEnd, searchOffset, dnString)) {
0N/A
0N/A /*
0N/A * Comma/semicolon is a separator
0N/A */
0N/A rdnString = dnString.substring(dnOffset, rdnEnd);
0N/A
0N/A // Parse RDN, and store it in vector
0N/A RDN rdn = new RDN(rdnString, keywordMap);
0N/A dnVector.add(rdn);
0N/A
0N/A // Increase the offset
0N/A dnOffset = rdnEnd + 1;
0N/A
0N/A // Set quote counter back to zero
0N/A quoteCount = 0;
0N/A }
0N/A
0N/A searchOffset = rdnEnd + 1;
0N/A nextComma = dnString.indexOf(',', searchOffset);
0N/A nextSemiColon = dnString.indexOf(';', searchOffset);
0N/A }
0N/A
0N/A // Parse last or only RDN, and store it in vector
0N/A rdnString = dnString.substring(dnOffset);
0N/A RDN rdn = new RDN(rdnString, keywordMap);
0N/A dnVector.add(rdn);
0N/A
0N/A /*
0N/A * Store the vector elements as an array of RDNs
0N/A * NOTE: It's only on output that little-endian ordering is used.
0N/A */
0N/A Collections.reverse(dnVector);
0N/A names = dnVector.toArray(new RDN[dnVector.size()]);
0N/A }
0N/A
0N/A private void parseRFC2253DN(String dnString) throws IOException {
0N/A if (dnString.length() == 0) {
0N/A names = new RDN[0];
0N/A return;
0N/A }
0N/A
0N/A List<RDN> dnVector = new ArrayList<RDN>();
0N/A int dnOffset = 0;
0N/A String rdnString;
0N/A
0N/A int searchOffset = 0;
0N/A int rdnEnd = dnString.indexOf(',');
0N/A while (rdnEnd >=0) {
0N/A /*
0N/A * We have encountered an RDN delimiter (comma).
0N/A * If the comma in the RDN under consideration is
0N/A * preceded by a backslash (escape), it
0N/A * is part of the RDN. Otherwise, it is used as a separator, to
0N/A * delimit the RDN under consideration from any subsequent RDNs.
0N/A */
0N/A if (rdnEnd > 0 && !escaped(rdnEnd, searchOffset, dnString)) {
0N/A
0N/A /*
0N/A * Comma is a separator
0N/A */
0N/A rdnString = dnString.substring(dnOffset, rdnEnd);
0N/A
0N/A // Parse RDN, and store it in vector
0N/A RDN rdn = new RDN(rdnString, "RFC2253");
0N/A dnVector.add(rdn);
0N/A
0N/A // Increase the offset
0N/A dnOffset = rdnEnd + 1;
0N/A }
0N/A
0N/A searchOffset = rdnEnd + 1;
0N/A rdnEnd = dnString.indexOf(',', searchOffset);
0N/A }
0N/A
0N/A // Parse last or only RDN, and store it in vector
0N/A rdnString = dnString.substring(dnOffset);
0N/A RDN rdn = new RDN(rdnString, "RFC2253");
0N/A dnVector.add(rdn);
0N/A
0N/A /*
0N/A * Store the vector elements as an array of RDNs
0N/A * NOTE: It's only on output that little-endian ordering is used.
0N/A */
0N/A Collections.reverse(dnVector);
0N/A names = dnVector.toArray(new RDN[dnVector.size()]);
0N/A }
0N/A
0N/A /*
0N/A * Counts double quotes in string.
0N/A * Escaped quotes are ignored.
0N/A */
0N/A static int countQuotes(String string, int from, int to) {
0N/A int count = 0;
0N/A
0N/A for (int i = from; i < to; i++) {
0N/A if ((string.charAt(i) == '"' && i == from) ||
0N/A (string.charAt(i) == '"' && string.charAt(i-1) != '\\')) {
0N/A count++;
0N/A }
0N/A }
0N/A
0N/A return count;
0N/A }
0N/A
0N/A private static boolean escaped
0N/A (int rdnEnd, int searchOffset, String dnString) {
0N/A
0N/A if (rdnEnd == 1 && dnString.charAt(rdnEnd - 1) == '\\') {
0N/A
0N/A // case 1:
0N/A // \,
0N/A
0N/A return true;
0N/A
0N/A } else if (rdnEnd > 1 && dnString.charAt(rdnEnd - 1) == '\\' &&
0N/A dnString.charAt(rdnEnd - 2) != '\\') {
0N/A
0N/A // case 2:
0N/A // foo\,
0N/A
0N/A return true;
0N/A
0N/A } else if (rdnEnd > 1 && dnString.charAt(rdnEnd - 1) == '\\' &&
0N/A dnString.charAt(rdnEnd - 2) == '\\') {
0N/A
0N/A // case 3:
0N/A // foo\\\\\,
0N/A
0N/A int count = 0;
0N/A rdnEnd--; // back up to last backSlash
0N/A while (rdnEnd >= searchOffset) {
0N/A if (dnString.charAt(rdnEnd) == '\\') {
0N/A count++; // count consecutive backslashes
0N/A }
0N/A rdnEnd--;
0N/A }
0N/A
0N/A // if count is odd, then rdnEnd is escaped
0N/A return (count % 2) != 0 ? true : false;
0N/A
0N/A } else {
0N/A return false;
0N/A }
0N/A }
0N/A
0N/A /*
0N/A * Dump the printable form of a distinguished name. Each relative
0N/A * name is separated from the next by a ",", and assertions in the
0N/A * relative names have "label=value" syntax.
0N/A *
0N/A * Uses RFC 1779 syntax (i.e. little-endian, comma separators)
0N/A */
0N/A private void generateDN() {
0N/A if (names.length == 1) {
0N/A dn = names[0].toString();
0N/A return;
0N/A }
0N/A
0N/A StringBuilder sb = new StringBuilder(48);
0N/A if (names != null) {
0N/A for (int i = names.length - 1; i >= 0; i--) {
0N/A if (i != names.length - 1) {
0N/A sb.append(", ");
0N/A }
0N/A sb.append(names[i].toString());
0N/A }
0N/A }
0N/A dn = sb.toString();
0N/A }
0N/A
0N/A /*
0N/A * Dump the printable form of a distinguished name. Each relative
0N/A * name is separated from the next by a ",", and assertions in the
0N/A * relative names have "label=value" syntax.
0N/A *
0N/A * Uses RFC 1779 syntax (i.e. little-endian, comma separators)
0N/A * Valid keywords from RFC 1779 are used. Additional keywords can be
0N/A * specified in the OID/keyword map.
0N/A */
0N/A private String generateRFC1779DN(Map<String, String> oidMap) {
0N/A if (names.length == 1) {
0N/A return names[0].toRFC1779String(oidMap);
0N/A }
0N/A
0N/A StringBuilder sb = new StringBuilder(48);
0N/A if (names != null) {
0N/A for (int i = names.length - 1; i >= 0; i--) {
0N/A if (i != names.length - 1) {
0N/A sb.append(", ");
0N/A }
0N/A sb.append(names[i].toRFC1779String(oidMap));
0N/A }
0N/A }
0N/A return sb.toString();
0N/A }
0N/A
0N/A /****************************************************************/
0N/A
0N/A /*
0N/A * Maybe return a preallocated OID, to reduce storage costs
0N/A * and speed recognition of common X.500 attributes.
0N/A */
0N/A static ObjectIdentifier intern(ObjectIdentifier oid) {
0N/A ObjectIdentifier interned = internedOIDs.get(oid);
0N/A if (interned != null) {
0N/A return interned;
0N/A }
0N/A internedOIDs.put(oid, oid);
0N/A return oid;
0N/A }
0N/A
0N/A private static final Map<ObjectIdentifier,ObjectIdentifier> internedOIDs
0N/A = new HashMap<ObjectIdentifier,ObjectIdentifier>();
0N/A
0N/A /*
0N/A * Selected OIDs from X.520
0N/A * Includes all those specified in RFC 3280 as MUST or SHOULD
0N/A * be recognized
0N/A */
0N/A private static final int commonName_data[] = { 2, 5, 4, 3 };
0N/A private static final int SURNAME_DATA[] = { 2, 5, 4, 4 };
0N/A private static final int SERIALNUMBER_DATA[] = { 2, 5, 4, 5 };
0N/A private static final int countryName_data[] = { 2, 5, 4, 6 };
0N/A private static final int localityName_data[] = { 2, 5, 4, 7 };
0N/A private static final int stateName_data[] = { 2, 5, 4, 8 };
0N/A private static final int streetAddress_data[] = { 2, 5, 4, 9 };
0N/A private static final int orgName_data[] = { 2, 5, 4, 10 };
0N/A private static final int orgUnitName_data[] = { 2, 5, 4, 11 };
0N/A private static final int title_data[] = { 2, 5, 4, 12 };
0N/A private static final int GIVENNAME_DATA[] = { 2, 5, 4, 42 };
0N/A private static final int INITIALS_DATA[] = { 2, 5, 4, 43 };
0N/A private static final int GENERATIONQUALIFIER_DATA[] = { 2, 5, 4, 44 };
0N/A private static final int DNQUALIFIER_DATA[] = { 2, 5, 4, 46 };
0N/A
0N/A private static final int ipAddress_data[] = { 1, 3, 6, 1, 4, 1, 42, 2, 11, 2, 1 };
0N/A private static final int DOMAIN_COMPONENT_DATA[] =
0N/A { 0, 9, 2342, 19200300, 100, 1, 25 };
0N/A private static final int userid_data[] =
0N/A { 0, 9, 2342, 19200300, 100, 1, 1 };
0N/A
0N/A
0N/A public static final ObjectIdentifier commonName_oid;
0N/A public static final ObjectIdentifier countryName_oid;
0N/A public static final ObjectIdentifier localityName_oid;
0N/A public static final ObjectIdentifier orgName_oid;
0N/A public static final ObjectIdentifier orgUnitName_oid;
0N/A public static final ObjectIdentifier stateName_oid;
0N/A public static final ObjectIdentifier streetAddress_oid;
0N/A public static final ObjectIdentifier title_oid;
0N/A public static final ObjectIdentifier DNQUALIFIER_OID;
0N/A public static final ObjectIdentifier SURNAME_OID;
0N/A public static final ObjectIdentifier GIVENNAME_OID;
0N/A public static final ObjectIdentifier INITIALS_OID;
0N/A public static final ObjectIdentifier GENERATIONQUALIFIER_OID;
0N/A public static final ObjectIdentifier ipAddress_oid;
0N/A public static final ObjectIdentifier DOMAIN_COMPONENT_OID;
0N/A public static final ObjectIdentifier userid_oid;
0N/A public static final ObjectIdentifier SERIALNUMBER_OID;
0N/A
0N/A static {
0N/A /** OID for the "CN=" attribute, denoting a person's common name. */
0N/A commonName_oid = intern(ObjectIdentifier.newInternal(commonName_data));
0N/A
0N/A /** OID for the "SERIALNUMBER=" attribute, denoting a serial number for.
0N/A a name. Do not confuse with PKCS#9 issuerAndSerialNumber or the
0N/A certificate serial number. */
0N/A SERIALNUMBER_OID = intern(ObjectIdentifier.newInternal(SERIALNUMBER_DATA));
0N/A
0N/A /** OID for the "C=" attribute, denoting a country. */
0N/A countryName_oid = intern(ObjectIdentifier.newInternal(countryName_data));
0N/A
0N/A /** OID for the "L=" attribute, denoting a locality (such as a city) */
0N/A localityName_oid = intern(ObjectIdentifier.newInternal(localityName_data));
0N/A
0N/A /** OID for the "O=" attribute, denoting an organization name */
0N/A orgName_oid = intern(ObjectIdentifier.newInternal(orgName_data));
0N/A
0N/A /** OID for the "OU=" attribute, denoting an organizational unit name */
0N/A orgUnitName_oid = intern(ObjectIdentifier.newInternal(orgUnitName_data));
0N/A
0N/A /** OID for the "S=" attribute, denoting a state (such as Delaware) */
0N/A stateName_oid = intern(ObjectIdentifier.newInternal(stateName_data));
0N/A
0N/A /** OID for the "STREET=" attribute, denoting a street address. */
0N/A streetAddress_oid = intern(ObjectIdentifier.newInternal(streetAddress_data));
0N/A
0N/A /** OID for the "T=" attribute, denoting a person's title. */
0N/A title_oid = intern(ObjectIdentifier.newInternal(title_data));
0N/A
0N/A /** OID for the "DNQUALIFIER=" or "DNQ=" attribute, denoting DN
0N/A disambiguating information.*/
0N/A DNQUALIFIER_OID = intern(ObjectIdentifier.newInternal(DNQUALIFIER_DATA));
0N/A
0N/A /** OID for the "SURNAME=" attribute, denoting a person's surname.*/
0N/A SURNAME_OID = intern(ObjectIdentifier.newInternal(SURNAME_DATA));
0N/A
0N/A /** OID for the "GIVENNAME=" attribute, denoting a person's given name.*/
0N/A GIVENNAME_OID = intern(ObjectIdentifier.newInternal(GIVENNAME_DATA));
0N/A
0N/A /** OID for the "INITIALS=" attribute, denoting a person's initials.*/
0N/A INITIALS_OID = intern(ObjectIdentifier.newInternal(INITIALS_DATA));
0N/A
0N/A /** OID for the "GENERATION=" attribute, denoting Jr., II, etc.*/
0N/A GENERATIONQUALIFIER_OID =
0N/A intern(ObjectIdentifier.newInternal(GENERATIONQUALIFIER_DATA));
0N/A
0N/A /*
0N/A * OIDs from other sources which show up in X.500 names we
0N/A * expect to deal with often
0N/A */
0N/A /** OID for "IP=" IP address attributes, used with SKIP. */
0N/A ipAddress_oid = intern(ObjectIdentifier.newInternal(ipAddress_data));
0N/A
0N/A /*
0N/A * Domain component OID from RFC 1274, RFC 2247, RFC 3280
0N/A */
0N/A
0N/A /*
0N/A * OID for "DC=" domain component attributes, used with DNS names in DN
0N/A * format
0N/A */
0N/A DOMAIN_COMPONENT_OID =
0N/A intern(ObjectIdentifier.newInternal(DOMAIN_COMPONENT_DATA));
0N/A
0N/A /** OID for "UID=" denoting a user id, defined in RFCs 1274 & 2798. */
0N/A userid_oid = intern(ObjectIdentifier.newInternal(userid_data));
0N/A }
0N/A
0N/A /**
0N/A * Return constraint type:<ul>
0N/A * <li>NAME_DIFF_TYPE = -1: input name is different type from this name
0N/A * (i.e. does not constrain)
0N/A * <li>NAME_MATCH = 0: input name matches this name
0N/A * <li>NAME_NARROWS = 1: input name narrows this name
0N/A * <li>NAME_WIDENS = 2: input name widens this name
0N/A * <li>NAME_SAME_TYPE = 3: input name does not match or narrow this name,
0N/A & but is same type
0N/A * </ul>. These results are used in checking NameConstraints during
0N/A * certification path verification.
0N/A *
0N/A * @param inputName to be checked for being constrained
0N/A * @returns constraint type above
0N/A * @throws UnsupportedOperationException if name is not exact match, but
0N/A * narrowing and widening are not supported for this name type.
0N/A */
0N/A public int constrains(GeneralNameInterface inputName)
0N/A throws UnsupportedOperationException {
0N/A int constraintType;
0N/A if (inputName == null) {
0N/A constraintType = NAME_DIFF_TYPE;
0N/A } else if (inputName.getType() != NAME_DIRECTORY) {
0N/A constraintType = NAME_DIFF_TYPE;
0N/A } else { // type == NAME_DIRECTORY
0N/A X500Name inputX500 = (X500Name)inputName;
0N/A if (inputX500.equals(this)) {
0N/A constraintType = NAME_MATCH;
0N/A } else if (inputX500.names.length == 0) {
0N/A constraintType = NAME_WIDENS;
0N/A } else if (this.names.length == 0) {
0N/A constraintType = NAME_NARROWS;
0N/A } else if (inputX500.isWithinSubtree(this)) {
0N/A constraintType = NAME_NARROWS;
0N/A } else if (isWithinSubtree(inputX500)) {
0N/A constraintType = NAME_WIDENS;
0N/A } else {
0N/A constraintType = NAME_SAME_TYPE;
0N/A }
0N/A }
0N/A return constraintType;
0N/A }
0N/A
0N/A /**
0N/A * Compares this name with another and determines if
0N/A * it is within the subtree of the other. Useful for
0N/A * checking against the name constraints extension.
0N/A *
0N/A * @return true iff this name is within the subtree of other.
0N/A */
0N/A private boolean isWithinSubtree(X500Name other) {
0N/A if (this == other) {
0N/A return true;
0N/A }
0N/A if (other == null) {
0N/A return false;
0N/A }
0N/A if (other.names.length == 0) {
0N/A return true;
0N/A }
0N/A if (this.names.length == 0) {
0N/A return false;
0N/A }
0N/A if (names.length < other.names.length) {
0N/A return false;
0N/A }
0N/A for (int i = 0; i < other.names.length; i++) {
0N/A if (!names[i].equals(other.names[i])) {
0N/A return false;
0N/A }
0N/A }
0N/A return true;
0N/A }
0N/A
0N/A /**
0N/A * Return subtree depth of this name for purposes of determining
0N/A * NameConstraints minimum and maximum bounds and for calculating
0N/A * path lengths in name subtrees.
0N/A *
0N/A * @returns distance of name from root
0N/A * @throws UnsupportedOperationException if not supported for this name type
0N/A */
0N/A public int subtreeDepth() throws UnsupportedOperationException {
0N/A return names.length;
0N/A }
0N/A
0N/A /**
0N/A * Return lowest common ancestor of this name and other name
0N/A *
0N/A * @param other another X500Name
0N/A * @return X500Name of lowest common ancestor; null if none
0N/A */
0N/A public X500Name commonAncestor(X500Name other) {
0N/A
0N/A if (other == null) {
0N/A return null;
0N/A }
0N/A int otherLen = other.names.length;
0N/A int thisLen = this.names.length;
0N/A if (thisLen == 0 || otherLen == 0) {
0N/A return null;
0N/A }
0N/A int minLen = (thisLen < otherLen) ? thisLen: otherLen;
0N/A
0N/A //Compare names from highest RDN down the naming tree
0N/A //Note that these are stored in RDN[0]...
0N/A int i=0;
0N/A for (; i < minLen; i++) {
0N/A if (!names[i].equals(other.names[i])) {
0N/A if (i == 0) {
0N/A return null;
0N/A } else {
0N/A break;
0N/A }
0N/A }
0N/A }
0N/A
0N/A //Copy matching RDNs into new RDN array
0N/A RDN[] ancestor = new RDN[i];
0N/A for (int j=0; j < i; j++) {
0N/A ancestor[j] = names[j];
0N/A }
0N/A
0N/A X500Name commonAncestor = null;
0N/A try {
0N/A commonAncestor = new X500Name(ancestor);
0N/A } catch (IOException ioe) {
0N/A return null;
0N/A }
0N/A return commonAncestor;
0N/A }
0N/A
0N/A /**
0N/A * Constructor object for use by asX500Principal().
0N/A */
0N/A private static final Constructor principalConstructor;
0N/A
0N/A /**
0N/A * Field object for use by asX500Name().
0N/A */
0N/A private static final Field principalField;
0N/A
0N/A /**
0N/A * Retrieve the Constructor and Field we need for reflective access
0N/A * and make them accessible.
0N/A */
0N/A static {
0N/A PrivilegedExceptionAction<Object[]> pa =
0N/A new PrivilegedExceptionAction<Object[]>() {
0N/A public Object[] run() throws Exception {
0N/A Class pClass = X500Principal.class;
0N/A Class[] args = new Class[] {X500Name.class};
0N/A Constructor cons = ((Class<?>)pClass).getDeclaredConstructor(args);
0N/A cons.setAccessible(true);
0N/A Field field = pClass.getDeclaredField("thisX500Name");
0N/A field.setAccessible(true);
0N/A return new Object[] {cons, field};
0N/A }
0N/A };
0N/A try {
0N/A Object[] result = AccessController.doPrivileged(pa);
0N/A principalConstructor = (Constructor)result[0];
0N/A principalField = (Field)result[1];
0N/A } catch (Exception e) {
0N/A throw (InternalError)new InternalError("Could not obtain "
0N/A + "X500Principal access").initCause(e);
0N/A }
0N/A }
0N/A
0N/A /**
0N/A * Get an X500Principal backed by this X500Name.
0N/A *
0N/A * Note that we are using privileged reflection to access the hidden
0N/A * package private constructor in X500Principal.
0N/A */
0N/A public X500Principal asX500Principal() {
0N/A if (x500Principal == null) {
0N/A try {
0N/A Object[] args = new Object[] {this};
0N/A x500Principal =
0N/A (X500Principal)principalConstructor.newInstance(args);
0N/A } catch (Exception e) {
0N/A throw new RuntimeException("Unexpected exception", e);
0N/A }
0N/A }
0N/A return x500Principal;
0N/A }
0N/A
0N/A /**
0N/A * Get the X500Name contained in the given X500Principal.
0N/A *
0N/A * Note that the X500Name is retrieved using reflection.
0N/A */
0N/A public static X500Name asX500Name(X500Principal p) {
0N/A try {
0N/A X500Name name = (X500Name)principalField.get(p);
0N/A name.x500Principal = p;
0N/A return name;
0N/A } catch (Exception e) {
0N/A throw new RuntimeException("Unexpected exception", e);
0N/A }
0N/A }
0N/A
0N/A}