archive/jdk
1
0
Fork 0
mirror of https://github.com/openjdk/jdk.git synced 2025-08-28 07:14:30 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions

8214532: Update RFC 2459 references in javadoc to RFC 5280

Browse source 
Reviewed-by: mullan
This commit is contained in:
Sean Coffey 2018-12-19 18:21:38 +00:00
parent c9d7dd0827
commit 36d0987f4d
14 changed files with 66 additions and 70 deletions
Download patch file Download diff file Expand all files Collapse all files

4
src/java.base/share/classes/sun/security/provider/certpath/DistributionPointFetcher.java
View file

@ -1,5 +1,5 @@
/* /*
* Copyright (c) 2002, 2017, Oracle and/or its affiliates. All rights reserved. * Copyright (c) 2002, 2018, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
* *
* This code is free software; you can redistribute it and/or modify it * This code is free software; you can redistribute it and/or modify it
@ -770,7 +770,7 @@ public class DistributionPointFetcher {
* *
* In practice, conforming CAs MUST use the key identifier method, * In practice, conforming CAs MUST use the key identifier method,
* and MUST include authority key identifier extension in all CRLs * and MUST include authority key identifier extension in all CRLs
* issued. [section 5.2.1, RFC 2459] * issued. [section 5.2.1, RFC 5280]
*/ */
AuthorityKeyIdentifierExtension crlAKID = crl.getAuthKeyIdExtension(); AuthorityKeyIdentifierExtension crlAKID = crl.getAuthKeyIdExtension();
issuerSelector.setSkiAndSerialNumber(crlAKID); issuerSelector.setSkiAndSerialNumber(crlAKID);

4
src/java.base/share/classes/sun/security/provider/certpath/ForwardBuilder.java
View file

@ -1,5 +1,5 @@
/* /*
* Copyright (c) 2000, 2016, Oracle and/or its affiliates. All rights reserved. * Copyright (c) 2000, 2018, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
* *
* This code is free software; you can redistribute it and/or modify it * This code is free software; you can redistribute it and/or modify it
@ -668,7 +668,7 @@ class ForwardBuilder extends Builder {
* Verifies a matching certificate. * Verifies a matching certificate.
* *
* This method executes the validation steps in the PKIX path * This method executes the validation steps in the PKIX path
* validation algorithm <draft-ietf-pkix-new-part1-08.txt> which were * validation algorithm, RFC 5280, which were
* not satisfied by the selection criteria used by getCertificates() * not satisfied by the selection criteria used by getCertificates()
* to find the certs and only the steps that can be executed in a * to find the certs and only the steps that can be executed in a
* forward direction (target to trust anchor). Those steps that can * forward direction (target to trust anchor). Those steps that can

2
src/java.base/share/classes/sun/security/x509/AVA.java
View file

@ -1045,7 +1045,7 @@ public class AVA implements DerEncoder {
if (valStr == null) { if (valStr == null) {
// rfc1779 specifies that attribute values associated // RFC 1779 specifies that attribute values associated
// with non-standard keyword attributes may be represented // with non-standard keyword attributes may be represented
// using the hex format below. This will be used only // using the hex format below. This will be used only
// when the value is not a string type // when the value is not a string type

8
src/java.base/share/classes/sun/security/x509/AlgorithmId.java
View file

@ -166,15 +166,15 @@ public class AlgorithmId implements Serializable, DerEncoder {
// Several AlgorithmId should omit the whole parameter part when // Several AlgorithmId should omit the whole parameter part when
// it's NULL. They are --- // it's NULL. They are ---
// rfc3370 2.1: Implementations SHOULD generate SHA-1 // RFC 3370 2.1: Implementations SHOULD generate SHA-1
// AlgorithmIdentifiers with absent parameters. // AlgorithmIdentifiers with absent parameters.
// rfc3447 C1: When id-sha1, id-sha224, id-sha256, id-sha384 and // RFC 3447 C1: When id-sha1, id-sha224, id-sha256, id-sha384 and
// id-sha512 are used in an AlgorithmIdentifier the parameters // id-sha512 are used in an AlgorithmIdentifier the parameters
// (which are optional) SHOULD be omitted. // (which are optional) SHOULD be omitted.
// rfc3279 2.3.2: The id-dsa algorithm syntax includes optional // RFC 3279 2.3.2: The id-dsa algorithm syntax includes optional
// domain parameters... When omitted, the parameters component // domain parameters... When omitted, the parameters component
// MUST be omitted entirely // MUST be omitted entirely
// rfc3370 3.1: When the id-dsa-with-sha1 algorithm identifier // RFC 3370 3.1: When the id-dsa-with-sha1 algorithm identifier
// is used, the AlgorithmIdentifier parameters field MUST be absent. // is used, the AlgorithmIdentifier parameters field MUST be absent.
/*if ( /*if (
algid.equals((Object)SHA_oid) || algid.equals((Object)SHA_oid) ||

4
src/java.base/share/classes/sun/security/x509/CertificatePoliciesExtension.java
View file

@ -1,5 +1,5 @@
/* /*
* Copyright (c) 2000, 2011, Oracle and/or its affiliates. All rights reserved. * Copyright (c) 2000, 2018, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
* *
* This code is free software; you can redistribute it and/or modify it * This code is free software; you can redistribute it and/or modify it
@ -45,7 +45,7 @@ import sun.security.util.DerOutputStream;
* certificate. * certificate.
* <p> * <p>
* Optional qualifiers are not supported in this implementation, as they are * Optional qualifiers are not supported in this implementation, as they are
* not recommended by RFC2459. * not recommended by RFC 5280.
* *
* The ASN.1 syntax for this is (IMPLICIT tagging is defined in the * The ASN.1 syntax for this is (IMPLICIT tagging is defined in the
* module definition): * module definition):

2
src/java.base/share/classes/sun/security/x509/DNSName.java
View file

@ -181,7 +181,7 @@ public class DNSName implements GeneralNameInterface {
* For example, www.host.example.com would satisfy the constraint but * For example, www.host.example.com would satisfy the constraint but
* host1.example.com would not. * host1.example.com would not.
* <p> * <p>
* draft-ietf-pkix-new-part1-00.txt: DNSName restrictions are expressed as foo.bar.com. * RFC 5280: DNSName restrictions are expressed as foo.bar.com.
* Any DNSName that * Any DNSName that
* can be constructed by simply adding to the left hand side of the name * can be constructed by simply adding to the left hand side of the name
* satisfies the name constraint. For example, www.foo.bar.com would * satisfies the name constraint. For example, www.foo.bar.com would

55
src/java.base/share/classes/sun/security/x509/IPAddressName.java
View file

@ -1,5 +1,5 @@
/* /*
* Copyright (c) 1997, 2002, Oracle and/or its affiliates. All rights reserved. * Copyright (c) 1997, 2018, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
* *
* This code is free software; you can redistribute it and/or modify it * This code is free software; you can redistribute it and/or modify it
@ -37,27 +37,27 @@ import sun.security.util.DerValue;
/** /**
* This class implements the IPAddressName as required by the GeneralNames * This class implements the IPAddressName as required by the GeneralNames
* ASN.1 object. Both IPv4 and IPv6 addresses are supported using the * ASN.1 object. Both IPv4 and IPv6 addresses are supported using the
* formats specified in IETF PKIX RFC2459. * formats specified in IETF PKIX RFC 5280.
* <p> * <p>
* [RFC2459 4.2.1.7 Subject Alternative Name] * [RFC 5280 4.2.1.6 Subject Alternative Name]
* When the subjectAltName extension contains a iPAddress, the address * When the subjectAltName extension contains an iPAddress, the address
* MUST be stored in the octet string in "network byte order," as * MUST be stored in the octet string in "network byte order", as
* specified in RFC 791. The least significant bit (LSB) of * specified in [RFC791]. The least significant bit (LSB) of each octet
* each octet is the LSB of the corresponding byte in the network * is the LSB of the corresponding byte in the network address. For IP
* address. For IP Version 4, as specified in RFC 791, the octet string * version 4, as specified in [RFC791], the octet string MUST contain
* MUST contain exactly four octets. For IP Version 6, as specified in * exactly four octets. For IP version 6, as specified in
* RFC 1883, the octet string MUST contain exactly sixteen octets. * [RFC 2460], the octet string MUST contain exactly sixteen octets.
* <p> * <p>
* [RFC2459 4.2.1.11 Name Constraints] * [RFC 5280 4.2.1.10 Name Constraints]
* The syntax of iPAddress MUST be as described in section 4.2.1.7 with * The syntax of iPAddress MUST be as described in Section 4.2.1.6 with
* the following additions specifically for Name Constraints. For IPv4 * the following additions specifically for name constraints. For IPv4
* addresses, the ipAddress field of generalName MUST contain eight (8) * addresses, the iPAddress field of GeneralName MUST contain eight (8)
* octets, encoded in the style of RFC 1519 (CIDR) to represent an * octets, encoded in the style of RFC 4632 (CIDR) to represent an
* address range.[RFC 1519] For IPv6 addresses, the ipAddress field * address range [RFC 4632]. For IPv6 addresses, the iPAddress field
* MUST contain 32 octets similarly encoded. For example, a name * MUST contain 32 octets similarly encoded. For example, a name
* constraint for "class C" subnet 10.9.8.0 shall be represented as the * constraint for "class C" subnet 192.0.2.0 is represented as the
* octets 0A 09 08 00 FF FF FF 00, representing the CIDR notation * octets C0 00 02 00 FF FF FF 00, representing the CIDR notation
* 10.9.8.0/255.255.255.0. * 192.0.2.0/24 (mask 255.255.255.0).
* <p> * <p>
* @see GeneralName * @see GeneralName
* @see GeneralNameInterface * @see GeneralNameInterface
@ -376,15 +376,16 @@ public class IPAddressName implements GeneralNameInterface {
* </ul>. These results are used in checking NameConstraints during * </ul>. These results are used in checking NameConstraints during
* certification path verification. * certification path verification.
* <p> * <p>
* [RFC2459] The syntax of iPAddress MUST be as described in section * [RFC 5280 4.2.1.10 Name Constraints]
* 4.2.1.7 with the following additions specifically for Name Constraints. * The syntax of iPAddress MUST be as described in Section 4.2.1.6 with
* For IPv4 addresses, the ipAddress field of generalName MUST contain * the following additions specifically for name constraints. For IPv4
* eight (8) octets, encoded in the style of RFC 1519 (CIDR) to represent an * addresses, the iPAddress field of GeneralName MUST contain eight (8)
* address range.[RFC 1519] For IPv6 addresses, the ipAddress field * octets, encoded in the style of RFC 4632 (CIDR) to represent an
* address range [RFC 4632]. For IPv6 addresses, the iPAddress field
* MUST contain 32 octets similarly encoded. For example, a name * MUST contain 32 octets similarly encoded. For example, a name
* constraint for "class C" subnet 10.9.8.0 shall be represented as the * constraint for "class C" subnet 192.0.2.0 is represented as the
* octets 0A 09 08 00 FF FF FF 00, representing the CIDR notation * octets C0 00 02 00 FF FF FF 00, representing the CIDR notation
* 10.9.8.0/255.255.255.0. * 192.0.2.0/24 (mask 255.255.255.0).
* *
* @param inputName to be checked for being constrained * @param inputName to be checked for being constrained
* @return constraint type above * @return constraint type above

4
src/java.base/share/classes/sun/security/x509/KeyIdentifier.java
View file

@ -1,5 +1,5 @@
/* /*
* Copyright (c) 1997, 1999, Oracle and/or its affiliates. All rights reserved. * Copyright (c) 1997, 2018, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
* *
* This code is free software; you can redistribute it and/or modify it * This code is free software; you can redistribute it and/or modify it
@ -63,7 +63,7 @@ public class KeyIdentifier {
/** /**
* Creates a KeyIdentifier from a public-key value. * Creates a KeyIdentifier from a public-key value.
* *
* <p>From RFC2459: Two common methods for generating key identifiers from * <p>From RFC 5280: Two common methods for generating key identifiers from
* the public key are: * the public key are:
* <ol> * <ol>
* <li>The keyIdentifier is composed of the 160-bit SHA-1 hash of the * <li>The keyIdentifier is composed of the 160-bit SHA-1 hash of the

4
src/java.base/share/classes/sun/security/x509/NameConstraintsExtension.java
View file

@ -1,5 +1,5 @@
/* /*
* Copyright (c) 1997, 2017, Oracle and/or its affiliates. All rights reserved. * Copyright (c) 1997, 2018, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
* *
* This code is free software; you can redistribute it and/or modify it * This code is free software; you can redistribute it and/or modify it
@ -326,7 +326,7 @@ implements CertAttrSet<String>, Cloneable {
* expanded by a merge, just remain constant or become more * expanded by a merge, just remain constant or become more
* limiting. * limiting.
* <p> * <p>
* IETF RFC2459 specifies the processing of Name Constraints as * IETF RFC 5280 specifies the processing of Name Constraints as
* follows: * follows:
* <p> * <p>
* (j) If permittedSubtrees is present in the certificate, set the * (j) If permittedSubtrees is present in the certificate, set the

4
src/java.base/share/classes/sun/security/x509/OIDName.java
View file

@ -1,5 +1,5 @@
/* /*
* Copyright (c) 1997, 2015, Oracle and/or its affiliates. All rights reserved. * Copyright (c) 1997, 2018, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
* *
* This code is free software; you can redistribute it and/or modify it * This code is free software; you can redistribute it and/or modify it
@ -156,7 +156,7 @@ public class OIDName implements GeneralNameInterface {
else if (this.equals((OIDName)inputName)) else if (this.equals((OIDName)inputName))
constraintType = NAME_MATCH; constraintType = NAME_MATCH;
else else
//widens and narrows not defined in RFC2459 for OIDName (aka registeredID) //widens and narrows not defined in RFC 5280 for OIDName (aka registeredID)
throw new UnsupportedOperationException("Narrowing and widening are not supported for OIDNames"); throw new UnsupportedOperationException("Narrowing and widening are not supported for OIDNames");
return constraintType; return constraintType;
} }

25
src/java.base/share/classes/sun/security/x509/RFC822Name.java
View file

@ -1,5 +1,5 @@
/* /*
* Copyright (c) 1997, 2011, Oracle and/or its affiliates. All rights reserved. * Copyright (c) 1997, 2018, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
* *
* This code is free software; you can redistribute it and/or modify it * This code is free software; you can redistribute it and/or modify it
@ -68,7 +68,7 @@ public class RFC822Name implements GeneralNameInterface
/** /**
* Parse an RFC822Name string to see if it is a valid * Parse an RFC822Name string to see if it is a valid
* addr-spec according to IETF RFC822 and RFC2459: * addr-spec according to IETF RFC 822 and RFC 5280:
* [local-part@]domain * [local-part@]domain
* <p> * <p>
* local-part@ could be empty for an RFC822Name NameConstraint, * local-part@ could be empty for an RFC822Name NameConstraint,
@ -131,7 +131,7 @@ public class RFC822Name implements GeneralNameInterface
* Compares this name with another, for equality. * Compares this name with another, for equality.
* *
* @return true iff the names are equivalent * @return true iff the names are equivalent
* according to RFC2459. * according to RFC 5280.
*/ */
public boolean equals(Object obj) { public boolean equals(Object obj) {
if (this == obj) if (this == obj)
@ -142,7 +142,7 @@ public class RFC822Name implements GeneralNameInterface
RFC822Name other = (RFC822Name)obj; RFC822Name other = (RFC822Name)obj;
// RFC2459 mandates that these names are // RFC 5280 mandates that these names are
// not case-sensitive // not case-sensitive
return name.equalsIgnoreCase(other.name); return name.equalsIgnoreCase(other.name);
} }
@ -166,14 +166,15 @@ public class RFC822Name implements GeneralNameInterface
* </ul>. These results are used in checking NameConstraints during * </ul>. These results are used in checking NameConstraints during
* certification path verification. * certification path verification.
* <p> * <p>
* [RFC2459] When the subjectAltName extension contains an Internet mail address, *
* the address MUST be included as an rfc822Name. The format of an * [RFC 5280]:
* rfc822Name is an "addr-spec" as defined in RFC 822 [RFC 822]. An * When the subjectAltName extension contains an Internet mail address,
* addr-spec has the form "local-part@domain". Note that an addr-spec * the address MUST be stored in the rfc822Name. The format of an
* has no phrase (such as a common name) before it, has no comment (text * rfc822Name is a "Mailbox" as defined in Section 4.1.2 of [RFC2821].
* A Mailbox has the form "Local-part@Domain". Note that a Mailbox has
* no phrase (such as a common name) before it, has no comment (text
* surrounded in parentheses) after it, and is not surrounded by "&lt;" and * surrounded in parentheses) after it, and is not surrounded by "&lt;" and
* "&gt;". Note that while upper and lower case letters are allowed in an * "&gt;".
* RFC 822 addr-spec, no significance is attached to the case.
* *
* @param inputName to be checked for being constrained * @param inputName to be checked for being constrained
* @return constraint type above * @return constraint type above
@ -187,7 +188,7 @@ public class RFC822Name implements GeneralNameInterface
else if (inputName.getType() != (GeneralNameInterface.NAME_RFC822)) { else if (inputName.getType() != (GeneralNameInterface.NAME_RFC822)) {
constraintType = NAME_DIFF_TYPE; constraintType = NAME_DIFF_TYPE;
} else { } else {
//RFC2459 specifies that case is not significant in RFC822Names //RFC 5280 specifies that case is not significant in RFC822Names
String inName = String inName =
(((RFC822Name)inputName).getName()).toLowerCase(Locale.ENGLISH); (((RFC822Name)inputName).getName()).toLowerCase(Locale.ENGLISH);
String thisName = name.toLowerCase(Locale.ENGLISH); String thisName = name.toLowerCase(Locale.ENGLISH);

4
src/java.base/share/classes/sun/security/x509/URIName.java
View file

@ -1,5 +1,5 @@
/* /*
* Copyright (c) 1997, 2014, Oracle and/or its affiliates. All rights reserved. * Copyright (c) 1997, 2018, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
* *
* This code is free software; you can redistribute it and/or modify it * This code is free software; you can redistribute it and/or modify it
@ -213,7 +213,7 @@ public class URIName implements GeneralNameInterface {
/** /**
* Compares this name with another, for equality. * Compares this name with another, for equality.
* *
* @return true iff the names are equivalent according to RFC2459. * @return true iff the names are equivalent according to RFC 5280.
*/ */
public boolean equals(Object obj) { public boolean equals(Object obj) {
if (this == obj) { if (this == obj) {

4
src/java.base/share/classes/sun/security/x509/X400Address.java
View file

@ -1,5 +1,5 @@
/* /*
* Copyright (c) 2000, Oracle and/or its affiliates. All rights reserved. * Copyright (c) 2000, 2018, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
* *
* This code is free software; you can redistribute it and/or modify it * This code is free software; you can redistribute it and/or modify it
@ -403,7 +403,7 @@ public class X400Address implements GeneralNameInterface {
else if (inputName.getType() != NAME_X400) else if (inputName.getType() != NAME_X400)
constraintType = NAME_DIFF_TYPE; constraintType = NAME_DIFF_TYPE;
else else
//Narrowing, widening, and match constraints not defined in rfc2459 for X400Address //Narrowing, widening, and match constraints not defined in RFC 5280 for X400Address
throw new UnsupportedOperationException("Narrowing, widening, and match are not supported for X400Address."); throw new UnsupportedOperationException("Narrowing, widening, and match are not supported for X400Address.");
return constraintType; return constraintType;
} }

12
src/java.base/share/classes/sun/security/x509/X509CertImpl.java
View file

@ -1,5 +1,5 @@
/* /*
* Copyright (c) 1996, 2017, Oracle and/or its affiliates. All rights reserved. * Copyright (c) 1996, 2018, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
* *
* This code is free software; you can redistribute it and/or modify it * This code is free software; you can redistribute it and/or modify it
@ -63,14 +63,8 @@ import sun.security.provider.X509Factory;
* direct knowledge of each other. CA certificates are either signed by * direct knowledge of each other. CA certificates are either signed by
* themselves, or by some other CA such as a "root" CA. * themselves, or by some other CA such as a "root" CA.
* *
* <P>RFC 1422 is very informative, though it does not describe much * <P> Standards relating to X.509 Public Key Infrastructure for the Internet
* of the recent work being done with X.509 certificates. That includes * can be referenced in RFC 5280.
* a 1996 version (X.509v3) and a variety of enhancements being made to
* facilitate an explosion of personal certificates used as "Internet
* Drivers' Licences", or with SET for credit card transactions.
*
* <P>More recent work includes the IETF PKIX Working Group efforts,
* especially RFC2459.
* *
* @author Dave Brownell * @author Dave Brownell
* @author Amit Kapoor * @author Amit Kapoor