mirror of
https://github.com/openjdk/jdk.git
synced 2025-08-27 14:54:52 +02:00
8187443: Forest Consolidation: Move files to unified layout
Reviewed-by: darcy, ihse
This commit is contained in:
Erik Joelsson
parent
270fe13182
commit
3789983e89
56923 changed files with 3 additions and 15727 deletions
|
|
@ -0,0 +1,718 @@
|
|||
/*
|
||||
* Copyright (c) 2000, 2015, Oracle and/or its affiliates. All rights reserved.
|
||||
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
|
||||
*
|
||||
* This code is free software; you can redistribute it and/or modify it
|
||||
* under the terms of the GNU General Public License version 2 only, as
|
||||
* published by the Free Software Foundation. Oracle designates this
|
||||
* particular file as subject to the "Classpath" exception as provided
|
||||
* by Oracle in the LICENSE file that accompanied this code.
|
||||
*
|
||||
* This code is distributed in the hope that it will be useful, but WITHOUT
|
||||
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
|
||||
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
|
||||
* version 2 for more details (a copy is included in the LICENSE file that
|
||||
* accompanied this code).
|
||||
*
|
||||
* You should have received a copy of the GNU General Public License version
|
||||
* 2 along with this work; if not, write to the Free Software Foundation,
|
||||
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
|
||||
*
|
||||
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
|
||||
* or visit www.oracle.com if you need additional information or have any
|
||||
* questions.
|
||||
*/
|
||||
|
||||
package java.security.cert;
|
||||
|
||||
import java.io.IOException;
|
||||
import java.math.BigInteger;
|
||||
import java.util.*;
|
||||
|
||||
import javax.security.auth.x500.X500Principal;
|
||||
|
||||
import sun.security.util.Debug;
|
||||
import sun.security.util.DerInputStream;
|
||||
import sun.security.x509.CRLNumberExtension;
|
||||
import sun.security.x509.X500Name;
|
||||
|
||||
/**
|
||||
* A {@code CRLSelector} that selects {@code X509CRLs} that
|
||||
* match all specified criteria. This class is particularly useful when
|
||||
* selecting CRLs from a {@code CertStore} to check revocation status
|
||||
* of a particular certificate.
|
||||
* <p>
|
||||
* When first constructed, an {@code X509CRLSelector} has no criteria
|
||||
* enabled and each of the {@code get} methods return a default
|
||||
* value ({@code null}). Therefore, the {@link #match match} method
|
||||
* would return {@code true} for any {@code X509CRL}. Typically,
|
||||
* several criteria are enabled (by calling {@link #setIssuers setIssuers}
|
||||
* or {@link #setDateAndTime setDateAndTime}, for instance) and then the
|
||||
* {@code X509CRLSelector} is passed to
|
||||
* {@link CertStore#getCRLs CertStore.getCRLs} or some similar
|
||||
* method.
|
||||
* <p>
|
||||
* Please refer to <a href="http://tools.ietf.org/html/rfc5280">RFC 5280:
|
||||
* Internet X.509 Public Key Infrastructure Certificate and CRL Profile</a>
|
||||
* for definitions of the X.509 CRL fields and extensions mentioned below.
|
||||
* <p>
|
||||
* <b>Concurrent Access</b>
|
||||
* <p>
|
||||
* Unless otherwise specified, the methods defined in this class are not
|
||||
* thread-safe. Multiple threads that need to access a single
|
||||
* object concurrently should synchronize amongst themselves and
|
||||
* provide the necessary locking. Multiple threads each manipulating
|
||||
* separate objects need not synchronize.
|
||||
*
|
||||
* @see CRLSelector
|
||||
* @see X509CRL
|
||||
*
|
||||
* @since 1.4
|
||||
* @author Steve Hanna
|
||||
*/
|
||||
public class X509CRLSelector implements CRLSelector {
|
||||
|
||||
static {
|
||||
CertPathHelperImpl.initialize();
|
||||
}
|
||||
|
||||
private static final Debug debug = Debug.getInstance("certpath");
|
||||
private HashSet<Object> issuerNames;
|
||||
private HashSet<X500Principal> issuerX500Principals;
|
||||
private BigInteger minCRL;
|
||||
private BigInteger maxCRL;
|
||||
private Date dateAndTime;
|
||||
private X509Certificate certChecking;
|
||||
private long skew = 0;
|
||||
|
||||
/**
|
||||
* Creates an {@code X509CRLSelector}. Initially, no criteria are set
|
||||
* so any {@code X509CRL} will match.
|
||||
*/
|
||||
public X509CRLSelector() {}
|
||||
|
||||
/**
|
||||
* Sets the issuerNames criterion. The issuer distinguished name in the
|
||||
* {@code X509CRL} must match at least one of the specified
|
||||
* distinguished names. If {@code null}, any issuer distinguished name
|
||||
* will do.
|
||||
* <p>
|
||||
* This method allows the caller to specify, with a single method call,
|
||||
* the complete set of issuer names which {@code X509CRLs} may contain.
|
||||
* The specified value replaces the previous value for the issuerNames
|
||||
* criterion.
|
||||
* <p>
|
||||
* The {@code names} parameter (if not {@code null}) is a
|
||||
* {@code Collection} of {@code X500Principal}s.
|
||||
* <p>
|
||||
* Note that the {@code names} parameter can contain duplicate
|
||||
* distinguished names, but they may be removed from the
|
||||
* {@code Collection} of names returned by the
|
||||
* {@link #getIssuers getIssuers} method.
|
||||
* <p>
|
||||
* Note that a copy is performed on the {@code Collection} to
|
||||
* protect against subsequent modifications.
|
||||
*
|
||||
* @param issuers a {@code Collection} of X500Principals
|
||||
* (or {@code null})
|
||||
* @see #getIssuers
|
||||
* @since 1.5
|
||||
*/
|
||||
public void setIssuers(Collection<X500Principal> issuers) {
|
||||
if ((issuers == null) || issuers.isEmpty()) {
|
||||
issuerNames = null;
|
||||
issuerX500Principals = null;
|
||||
} else {
|
||||
// clone
|
||||
issuerX500Principals = new HashSet<>(issuers);
|
||||
issuerNames = new HashSet<>();
|
||||
for (X500Principal p : issuerX500Principals) {
|
||||
issuerNames.add(p.getEncoded());
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* <strong>Note:</strong> use {@linkplain #setIssuers(Collection)} instead
|
||||
* or only specify the byte array form of distinguished names when using
|
||||
* this method. See {@link #addIssuerName(String)} for more information.
|
||||
* <p>
|
||||
* Sets the issuerNames criterion. The issuer distinguished name in the
|
||||
* {@code X509CRL} must match at least one of the specified
|
||||
* distinguished names. If {@code null}, any issuer distinguished name
|
||||
* will do.
|
||||
* <p>
|
||||
* This method allows the caller to specify, with a single method call,
|
||||
* the complete set of issuer names which {@code X509CRLs} may contain.
|
||||
* The specified value replaces the previous value for the issuerNames
|
||||
* criterion.
|
||||
* <p>
|
||||
* The {@code names} parameter (if not {@code null}) is a
|
||||
* {@code Collection} of names. Each name is a {@code String}
|
||||
* or a byte array representing a distinguished name (in
|
||||
* <a href="http://www.ietf.org/rfc/rfc2253.txt">RFC 2253</a> or
|
||||
* ASN.1 DER encoded form, respectively). If {@code null} is supplied
|
||||
* as the value for this argument, no issuerNames check will be performed.
|
||||
* <p>
|
||||
* Note that the {@code names} parameter can contain duplicate
|
||||
* distinguished names, but they may be removed from the
|
||||
* {@code Collection} of names returned by the
|
||||
* {@link #getIssuerNames getIssuerNames} method.
|
||||
* <p>
|
||||
* If a name is specified as a byte array, it should contain a single DER
|
||||
* encoded distinguished name, as defined in X.501. The ASN.1 notation for
|
||||
* this structure is as follows.
|
||||
* <pre>{@code
|
||||
* Name ::= CHOICE {
|
||||
* RDNSequence }
|
||||
*
|
||||
* RDNSequence ::= SEQUENCE OF RelativeDistinguishedName
|
||||
*
|
||||
* RelativeDistinguishedName ::=
|
||||
* SET SIZE (1 .. MAX) OF AttributeTypeAndValue
|
||||
*
|
||||
* AttributeTypeAndValue ::= SEQUENCE {
|
||||
* type AttributeType,
|
||||
* value AttributeValue }
|
||||
*
|
||||
* AttributeType ::= OBJECT IDENTIFIER
|
||||
*
|
||||
* AttributeValue ::= ANY DEFINED BY AttributeType
|
||||
* ....
|
||||
* DirectoryString ::= CHOICE {
|
||||
* teletexString TeletexString (SIZE (1..MAX)),
|
||||
* printableString PrintableString (SIZE (1..MAX)),
|
||||
* universalString UniversalString (SIZE (1..MAX)),
|
||||
* utf8String UTF8String (SIZE (1.. MAX)),
|
||||
* bmpString BMPString (SIZE (1..MAX)) }
|
||||
* }</pre>
|
||||
* <p>
|
||||
* Note that a deep copy is performed on the {@code Collection} to
|
||||
* protect against subsequent modifications.
|
||||
*
|
||||
* @param names a {@code Collection} of names (or {@code null})
|
||||
* @throws IOException if a parsing error occurs
|
||||
* @see #getIssuerNames
|
||||
*/
|
||||
public void setIssuerNames(Collection<?> names) throws IOException {
|
||||
if (names == null || names.size() == 0) {
|
||||
issuerNames = null;
|
||||
issuerX500Principals = null;
|
||||
} else {
|
||||
HashSet<Object> tempNames = cloneAndCheckIssuerNames(names);
|
||||
// Ensure that we either set both of these or neither
|
||||
issuerX500Principals = parseIssuerNames(tempNames);
|
||||
issuerNames = tempNames;
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Adds a name to the issuerNames criterion. The issuer distinguished
|
||||
* name in the {@code X509CRL} must match at least one of the specified
|
||||
* distinguished names.
|
||||
* <p>
|
||||
* This method allows the caller to add a name to the set of issuer names
|
||||
* which {@code X509CRLs} may contain. The specified name is added to
|
||||
* any previous value for the issuerNames criterion.
|
||||
* If the specified name is a duplicate, it may be ignored.
|
||||
*
|
||||
* @param issuer the issuer as X500Principal
|
||||
* @since 1.5
|
||||
*/
|
||||
public void addIssuer(X500Principal issuer) {
|
||||
addIssuerNameInternal(issuer.getEncoded(), issuer);
|
||||
}
|
||||
|
||||
/**
|
||||
* <strong>Denigrated</strong>, use
|
||||
* {@linkplain #addIssuer(X500Principal)} or
|
||||
* {@linkplain #addIssuerName(byte[])} instead. This method should not be
|
||||
* relied on as it can fail to match some CRLs because of a loss of
|
||||
* encoding information in the RFC 2253 String form of some distinguished
|
||||
* names.
|
||||
* <p>
|
||||
* Adds a name to the issuerNames criterion. The issuer distinguished
|
||||
* name in the {@code X509CRL} must match at least one of the specified
|
||||
* distinguished names.
|
||||
* <p>
|
||||
* This method allows the caller to add a name to the set of issuer names
|
||||
* which {@code X509CRLs} may contain. The specified name is added to
|
||||
* any previous value for the issuerNames criterion.
|
||||
* If the specified name is a duplicate, it may be ignored.
|
||||
*
|
||||
* @param name the name in RFC 2253 form
|
||||
* @throws IOException if a parsing error occurs
|
||||
*/
|
||||
public void addIssuerName(String name) throws IOException {
|
||||
addIssuerNameInternal(name, new X500Name(name).asX500Principal());
|
||||
}
|
||||
|
||||
/**
|
||||
* Adds a name to the issuerNames criterion. The issuer distinguished
|
||||
* name in the {@code X509CRL} must match at least one of the specified
|
||||
* distinguished names.
|
||||
* <p>
|
||||
* This method allows the caller to add a name to the set of issuer names
|
||||
* which {@code X509CRLs} may contain. The specified name is added to
|
||||
* any previous value for the issuerNames criterion. If the specified name
|
||||
* is a duplicate, it may be ignored.
|
||||
* If a name is specified as a byte array, it should contain a single DER
|
||||
* encoded distinguished name, as defined in X.501. The ASN.1 notation for
|
||||
* this structure is as follows.
|
||||
* <p>
|
||||
* The name is provided as a byte array. This byte array should contain
|
||||
* a single DER encoded distinguished name, as defined in X.501. The ASN.1
|
||||
* notation for this structure appears in the documentation for
|
||||
* {@link #setIssuerNames setIssuerNames(Collection names)}.
|
||||
* <p>
|
||||
* Note that the byte array supplied here is cloned to protect against
|
||||
* subsequent modifications.
|
||||
*
|
||||
* @param name a byte array containing the name in ASN.1 DER encoded form
|
||||
* @throws IOException if a parsing error occurs
|
||||
*/
|
||||
public void addIssuerName(byte[] name) throws IOException {
|
||||
// clone because byte arrays are modifiable
|
||||
addIssuerNameInternal(name.clone(), new X500Name(name).asX500Principal());
|
||||
}
|
||||
|
||||
/**
|
||||
* A private method that adds a name (String or byte array) to the
|
||||
* issuerNames criterion. The issuer distinguished
|
||||
* name in the {@code X509CRL} must match at least one of the specified
|
||||
* distinguished names.
|
||||
*
|
||||
* @param name the name in string or byte array form
|
||||
* @param principal the name in X500Principal form
|
||||
* @throws IOException if a parsing error occurs
|
||||
*/
|
||||
private void addIssuerNameInternal(Object name, X500Principal principal) {
|
||||
if (issuerNames == null) {
|
||||
issuerNames = new HashSet<>();
|
||||
}
|
||||
if (issuerX500Principals == null) {
|
||||
issuerX500Principals = new HashSet<>();
|
||||
}
|
||||
issuerNames.add(name);
|
||||
issuerX500Principals.add(principal);
|
||||
}
|
||||
|
||||
/**
|
||||
* Clone and check an argument of the form passed to
|
||||
* setIssuerNames. Throw an IOException if the argument is malformed.
|
||||
*
|
||||
* @param names a {@code Collection} of names. Each entry is a
|
||||
* String or a byte array (the name, in string or ASN.1
|
||||
* DER encoded form, respectively). {@code null} is
|
||||
* not an acceptable value.
|
||||
* @return a deep copy of the specified {@code Collection}
|
||||
* @throws IOException if a parsing error occurs
|
||||
*/
|
||||
private static HashSet<Object> cloneAndCheckIssuerNames(Collection<?> names)
|
||||
throws IOException
|
||||
{
|
||||
HashSet<Object> namesCopy = new HashSet<>();
|
||||
Iterator<?> i = names.iterator();
|
||||
while (i.hasNext()) {
|
||||
Object nameObject = i.next();
|
||||
if (!(nameObject instanceof byte []) &&
|
||||
!(nameObject instanceof String))
|
||||
throw new IOException("name not byte array or String");
|
||||
if (nameObject instanceof byte [])
|
||||
namesCopy.add(((byte []) nameObject).clone());
|
||||
else
|
||||
namesCopy.add(nameObject);
|
||||
}
|
||||
return(namesCopy);
|
||||
}
|
||||
|
||||
/**
|
||||
* Clone an argument of the form passed to setIssuerNames.
|
||||
* Throw a RuntimeException if the argument is malformed.
|
||||
* <p>
|
||||
* This method wraps cloneAndCheckIssuerNames, changing any IOException
|
||||
* into a RuntimeException. This method should be used when the object being
|
||||
* cloned has already been checked, so there should never be any exceptions.
|
||||
*
|
||||
* @param names a {@code Collection} of names. Each entry is a
|
||||
* String or a byte array (the name, in string or ASN.1
|
||||
* DER encoded form, respectively). {@code null} is
|
||||
* not an acceptable value.
|
||||
* @return a deep copy of the specified {@code Collection}
|
||||
* @throws RuntimeException if a parsing error occurs
|
||||
*/
|
||||
private static HashSet<Object> cloneIssuerNames(Collection<Object> names) {
|
||||
try {
|
||||
return cloneAndCheckIssuerNames(names);
|
||||
} catch (IOException ioe) {
|
||||
throw new RuntimeException(ioe);
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Parse an argument of the form passed to setIssuerNames,
|
||||
* returning a Collection of issuerX500Principals.
|
||||
* Throw an IOException if the argument is malformed.
|
||||
*
|
||||
* @param names a {@code Collection} of names. Each entry is a
|
||||
* String or a byte array (the name, in string or ASN.1
|
||||
* DER encoded form, respectively). <Code>Null</Code> is
|
||||
* not an acceptable value.
|
||||
* @return a HashSet of issuerX500Principals
|
||||
* @throws IOException if a parsing error occurs
|
||||
*/
|
||||
private static HashSet<X500Principal> parseIssuerNames(Collection<Object> names)
|
||||
throws IOException {
|
||||
HashSet<X500Principal> x500Principals = new HashSet<>();
|
||||
for (Iterator<Object> t = names.iterator(); t.hasNext(); ) {
|
||||
Object nameObject = t.next();
|
||||
if (nameObject instanceof String) {
|
||||
x500Principals.add(new X500Name((String)nameObject).asX500Principal());
|
||||
} else {
|
||||
try {
|
||||
x500Principals.add(new X500Principal((byte[])nameObject));
|
||||
} catch (IllegalArgumentException e) {
|
||||
throw (IOException)new IOException("Invalid name").initCause(e);
|
||||
}
|
||||
}
|
||||
}
|
||||
return x500Principals;
|
||||
}
|
||||
|
||||
/**
|
||||
* Sets the minCRLNumber criterion. The {@code X509CRL} must have a
|
||||
* CRL number extension whose value is greater than or equal to the
|
||||
* specified value. If {@code null}, no minCRLNumber check will be
|
||||
* done.
|
||||
*
|
||||
* @param minCRL the minimum CRL number accepted (or {@code null})
|
||||
*/
|
||||
public void setMinCRLNumber(BigInteger minCRL) {
|
||||
this.minCRL = minCRL;
|
||||
}
|
||||
|
||||
/**
|
||||
* Sets the maxCRLNumber criterion. The {@code X509CRL} must have a
|
||||
* CRL number extension whose value is less than or equal to the
|
||||
* specified value. If {@code null}, no maxCRLNumber check will be
|
||||
* done.
|
||||
*
|
||||
* @param maxCRL the maximum CRL number accepted (or {@code null})
|
||||
*/
|
||||
public void setMaxCRLNumber(BigInteger maxCRL) {
|
||||
this.maxCRL = maxCRL;
|
||||
}
|
||||
|
||||
/**
|
||||
* Sets the dateAndTime criterion. The specified date must be
|
||||
* equal to or later than the value of the thisUpdate component
|
||||
* of the {@code X509CRL} and earlier than the value of the
|
||||
* nextUpdate component. There is no match if the {@code X509CRL}
|
||||
* does not contain a nextUpdate component.
|
||||
* If {@code null}, no dateAndTime check will be done.
|
||||
* <p>
|
||||
* Note that the {@code Date} supplied here is cloned to protect
|
||||
* against subsequent modifications.
|
||||
*
|
||||
* @param dateAndTime the {@code Date} to match against
|
||||
* (or {@code null})
|
||||
* @see #getDateAndTime
|
||||
*/
|
||||
public void setDateAndTime(Date dateAndTime) {
|
||||
if (dateAndTime == null)
|
||||
this.dateAndTime = null;
|
||||
else
|
||||
this.dateAndTime = new Date(dateAndTime.getTime());
|
||||
this.skew = 0;
|
||||
}
|
||||
|
||||
/**
|
||||
* Sets the dateAndTime criterion and allows for the specified clock skew
|
||||
* (in milliseconds) when checking against the validity period of the CRL.
|
||||
*/
|
||||
void setDateAndTime(Date dateAndTime, long skew) {
|
||||
this.dateAndTime =
|
||||
(dateAndTime == null ? null : new Date(dateAndTime.getTime()));
|
||||
this.skew = skew;
|
||||
}
|
||||
|
||||
/**
|
||||
* Sets the certificate being checked. This is not a criterion. Rather,
|
||||
* it is optional information that may help a {@code CertStore}
|
||||
* find CRLs that would be relevant when checking revocation for the
|
||||
* specified certificate. If {@code null} is specified, then no
|
||||
* such optional information is provided.
|
||||
*
|
||||
* @param cert the {@code X509Certificate} being checked
|
||||
* (or {@code null})
|
||||
* @see #getCertificateChecking
|
||||
*/
|
||||
public void setCertificateChecking(X509Certificate cert) {
|
||||
certChecking = cert;
|
||||
}
|
||||
|
||||
/**
|
||||
* Returns the issuerNames criterion. The issuer distinguished
|
||||
* name in the {@code X509CRL} must match at least one of the specified
|
||||
* distinguished names. If the value returned is {@code null}, any
|
||||
* issuer distinguished name will do.
|
||||
* <p>
|
||||
* If the value returned is not {@code null}, it is a
|
||||
* unmodifiable {@code Collection} of {@code X500Principal}s.
|
||||
*
|
||||
* @return an unmodifiable {@code Collection} of names
|
||||
* (or {@code null})
|
||||
* @see #setIssuers
|
||||
* @since 1.5
|
||||
*/
|
||||
public Collection<X500Principal> getIssuers() {
|
||||
if (issuerX500Principals == null) {
|
||||
return null;
|
||||
}
|
||||
return Collections.unmodifiableCollection(issuerX500Principals);
|
||||
}
|
||||
|
||||
/**
|
||||
* Returns a copy of the issuerNames criterion. The issuer distinguished
|
||||
* name in the {@code X509CRL} must match at least one of the specified
|
||||
* distinguished names. If the value returned is {@code null}, any
|
||||
* issuer distinguished name will do.
|
||||
* <p>
|
||||
* If the value returned is not {@code null}, it is a
|
||||
* {@code Collection} of names. Each name is a {@code String}
|
||||
* or a byte array representing a distinguished name (in RFC 2253 or
|
||||
* ASN.1 DER encoded form, respectively). Note that the
|
||||
* {@code Collection} returned may contain duplicate names.
|
||||
* <p>
|
||||
* If a name is specified as a byte array, it should contain a single DER
|
||||
* encoded distinguished name, as defined in X.501. The ASN.1 notation for
|
||||
* this structure is given in the documentation for
|
||||
* {@link #setIssuerNames setIssuerNames(Collection names)}.
|
||||
* <p>
|
||||
* Note that a deep copy is performed on the {@code Collection} to
|
||||
* protect against subsequent modifications.
|
||||
*
|
||||
* @return a {@code Collection} of names (or {@code null})
|
||||
* @see #setIssuerNames
|
||||
*/
|
||||
public Collection<Object> getIssuerNames() {
|
||||
if (issuerNames == null) {
|
||||
return null;
|
||||
}
|
||||
return cloneIssuerNames(issuerNames);
|
||||
}
|
||||
|
||||
/**
|
||||
* Returns the minCRLNumber criterion. The {@code X509CRL} must have a
|
||||
* CRL number extension whose value is greater than or equal to the
|
||||
* specified value. If {@code null}, no minCRLNumber check will be done.
|
||||
*
|
||||
* @return the minimum CRL number accepted (or {@code null})
|
||||
*/
|
||||
public BigInteger getMinCRL() {
|
||||
return minCRL;
|
||||
}
|
||||
|
||||
/**
|
||||
* Returns the maxCRLNumber criterion. The {@code X509CRL} must have a
|
||||
* CRL number extension whose value is less than or equal to the
|
||||
* specified value. If {@code null}, no maxCRLNumber check will be
|
||||
* done.
|
||||
*
|
||||
* @return the maximum CRL number accepted (or {@code null})
|
||||
*/
|
||||
public BigInteger getMaxCRL() {
|
||||
return maxCRL;
|
||||
}
|
||||
|
||||
/**
|
||||
* Returns the dateAndTime criterion. The specified date must be
|
||||
* equal to or later than the value of the thisUpdate component
|
||||
* of the {@code X509CRL} and earlier than the value of the
|
||||
* nextUpdate component. There is no match if the
|
||||
* {@code X509CRL} does not contain a nextUpdate component.
|
||||
* If {@code null}, no dateAndTime check will be done.
|
||||
* <p>
|
||||
* Note that the {@code Date} returned is cloned to protect against
|
||||
* subsequent modifications.
|
||||
*
|
||||
* @return the {@code Date} to match against (or {@code null})
|
||||
* @see #setDateAndTime
|
||||
*/
|
||||
public Date getDateAndTime() {
|
||||
if (dateAndTime == null)
|
||||
return null;
|
||||
return (Date) dateAndTime.clone();
|
||||
}
|
||||
|
||||
/**
|
||||
* Returns the certificate being checked. This is not a criterion. Rather,
|
||||
* it is optional information that may help a {@code CertStore}
|
||||
* find CRLs that would be relevant when checking revocation for the
|
||||
* specified certificate. If the value returned is {@code null}, then
|
||||
* no such optional information is provided.
|
||||
*
|
||||
* @return the certificate being checked (or {@code null})
|
||||
* @see #setCertificateChecking
|
||||
*/
|
||||
public X509Certificate getCertificateChecking() {
|
||||
return certChecking;
|
||||
}
|
||||
|
||||
/**
|
||||
* Returns a printable representation of the {@code X509CRLSelector}.
|
||||
*
|
||||
* @return a {@code String} describing the contents of the
|
||||
* {@code X509CRLSelector}.
|
||||
*/
|
||||
public String toString() {
|
||||
StringBuilder sb = new StringBuilder();
|
||||
sb.append("X509CRLSelector: [\n");
|
||||
if (issuerNames != null) {
|
||||
sb.append(" IssuerNames:\n");
|
||||
Iterator<Object> i = issuerNames.iterator();
|
||||
while (i.hasNext())
|
||||
sb.append(" " + i.next() + "\n");
|
||||
}
|
||||
if (minCRL != null)
|
||||
sb.append(" minCRLNumber: " + minCRL + "\n");
|
||||
if (maxCRL != null)
|
||||
sb.append(" maxCRLNumber: " + maxCRL + "\n");
|
||||
if (dateAndTime != null)
|
||||
sb.append(" dateAndTime: " + dateAndTime + "\n");
|
||||
if (certChecking != null)
|
||||
sb.append(" Certificate being checked: " + certChecking + "\n");
|
||||
sb.append("]");
|
||||
return sb.toString();
|
||||
}
|
||||
|
||||
/**
|
||||
* Decides whether a {@code CRL} should be selected.
|
||||
*
|
||||
* @param crl the {@code CRL} to be checked
|
||||
* @return {@code true} if the {@code CRL} should be selected,
|
||||
* {@code false} otherwise
|
||||
*/
|
||||
public boolean match(CRL crl) {
|
||||
if (!(crl instanceof X509CRL)) {
|
||||
return false;
|
||||
}
|
||||
X509CRL xcrl = (X509CRL)crl;
|
||||
|
||||
/* match on issuer name */
|
||||
if (issuerNames != null) {
|
||||
X500Principal issuer = xcrl.getIssuerX500Principal();
|
||||
Iterator<X500Principal> i = issuerX500Principals.iterator();
|
||||
boolean found = false;
|
||||
while (!found && i.hasNext()) {
|
||||
if (i.next().equals(issuer)) {
|
||||
found = true;
|
||||
}
|
||||
}
|
||||
if (!found) {
|
||||
if (debug != null) {
|
||||
debug.println("X509CRLSelector.match: issuer DNs "
|
||||
+ "don't match");
|
||||
}
|
||||
return false;
|
||||
}
|
||||
}
|
||||
|
||||
if ((minCRL != null) || (maxCRL != null)) {
|
||||
/* Get CRL number extension from CRL */
|
||||
byte[] crlNumExtVal = xcrl.getExtensionValue("2.5.29.20");
|
||||
if (crlNumExtVal == null) {
|
||||
if (debug != null) {
|
||||
debug.println("X509CRLSelector.match: no CRLNumber");
|
||||
}
|
||||
}
|
||||
BigInteger crlNum;
|
||||
try {
|
||||
DerInputStream in = new DerInputStream(crlNumExtVal);
|
||||
byte[] encoded = in.getOctetString();
|
||||
CRLNumberExtension crlNumExt =
|
||||
new CRLNumberExtension(Boolean.FALSE, encoded);
|
||||
crlNum = crlNumExt.get(CRLNumberExtension.NUMBER);
|
||||
} catch (IOException ex) {
|
||||
if (debug != null) {
|
||||
debug.println("X509CRLSelector.match: exception in "
|
||||
+ "decoding CRL number");
|
||||
}
|
||||
return false;
|
||||
}
|
||||
|
||||
/* match on minCRLNumber */
|
||||
if (minCRL != null) {
|
||||
if (crlNum.compareTo(minCRL) < 0) {
|
||||
if (debug != null) {
|
||||
debug.println("X509CRLSelector.match: CRLNumber too small");
|
||||
}
|
||||
return false;
|
||||
}
|
||||
}
|
||||
|
||||
/* match on maxCRLNumber */
|
||||
if (maxCRL != null) {
|
||||
if (crlNum.compareTo(maxCRL) > 0) {
|
||||
if (debug != null) {
|
||||
debug.println("X509CRLSelector.match: CRLNumber too large");
|
||||
}
|
||||
return false;
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
/* match on dateAndTime */
|
||||
if (dateAndTime != null) {
|
||||
Date crlThisUpdate = xcrl.getThisUpdate();
|
||||
Date nextUpdate = xcrl.getNextUpdate();
|
||||
if (nextUpdate == null) {
|
||||
if (debug != null) {
|
||||
debug.println("X509CRLSelector.match: nextUpdate null");
|
||||
}
|
||||
return false;
|
||||
}
|
||||
Date nowPlusSkew = dateAndTime;
|
||||
Date nowMinusSkew = dateAndTime;
|
||||
if (skew > 0) {
|
||||
nowPlusSkew = new Date(dateAndTime.getTime() + skew);
|
||||
nowMinusSkew = new Date(dateAndTime.getTime() - skew);
|
||||
}
|
||||
|
||||
// Check that the test date is within the validity interval:
|
||||
// [ thisUpdate - MAX_CLOCK_SKEW,
|
||||
// nextUpdate + MAX_CLOCK_SKEW ]
|
||||
if (nowMinusSkew.after(nextUpdate)
|
||||
|| nowPlusSkew.before(crlThisUpdate)) {
|
||||
if (debug != null) {
|
||||
debug.println("X509CRLSelector.match: update out-of-range");
|
||||
}
|
||||
return false;
|
||||
}
|
||||
}
|
||||
|
||||
return true;
|
||||
}
|
||||
|
||||
/**
|
||||
* Returns a copy of this object.
|
||||
*
|
||||
* @return the copy
|
||||
*/
|
||||
public Object clone() {
|
||||
try {
|
||||
X509CRLSelector copy = (X509CRLSelector)super.clone();
|
||||
if (issuerNames != null) {
|
||||
copy.issuerNames =
|
||||
new HashSet<>(issuerNames);
|
||||
copy.issuerX500Principals =
|
||||
new HashSet<>(issuerX500Principals);
|
||||
}
|
||||
return copy;
|
||||
} catch (CloneNotSupportedException e) {
|
||||
/* Cannot happen */
|
||||
throw new InternalError(e.toString(), e);
|
||||
}
|
||||
}
|
||||
}
|
||||
Loading…
Add table
Add a link
Reference in a new issue