1adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project/* 2adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * Licensed to the Apache Software Foundation (ASF) under one or more 3adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * contributor license agreements. See the NOTICE file distributed with 4adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * this work for additional information regarding copyright ownership. 5adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * The ASF licenses this file to You under the Apache License, Version 2.0 6adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * (the "License"); you may not use this file except in compliance with 7adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * the License. You may obtain a copy of the License at 8adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * 9adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * http://www.apache.org/licenses/LICENSE-2.0 10adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * 11adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * Unless required by applicable law or agreed to in writing, software 12adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * distributed under the License is distributed on an "AS IS" BASIS, 13adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 14adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * See the License for the specific language governing permissions and 15adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * limitations under the License. 16adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project */ 17adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project 18adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Projectpackage java.security.cert; 19adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project 20adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Projectimport java.io.IOException; 21adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Projectimport java.math.BigInteger; 22adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Projectimport java.security.PublicKey; 23adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Projectimport java.util.ArrayList; 24adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Projectimport java.util.Arrays; 25adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Projectimport java.util.Collection; 26adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Projectimport java.util.Collections; 27adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Projectimport java.util.Date; 28adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Projectimport java.util.HashSet; 29adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Projectimport java.util.List; 30adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Projectimport java.util.Set; 31adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Projectimport javax.security.auth.x500.X500Principal; 326186821cb13f4ac7ff50950c813394367e021eaeJesse Wilsonimport libcore.util.EmptyArray; 33adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Projectimport org.apache.harmony.security.asn1.ASN1OctetString; 344b25199bc0b7a64a6feaa60e7d5d6b0474341234Elliott Hughesimport org.apache.harmony.security.utils.Array; 35adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Projectimport org.apache.harmony.security.x509.AlgorithmIdentifier; 36adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Projectimport org.apache.harmony.security.x509.CertificatePolicies; 37adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Projectimport org.apache.harmony.security.x509.GeneralName; 38adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Projectimport org.apache.harmony.security.x509.GeneralNames; 39adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Projectimport org.apache.harmony.security.x509.NameConstraints; 40adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Projectimport org.apache.harmony.security.x509.PolicyInformation; 41adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Projectimport org.apache.harmony.security.x509.PrivateKeyUsagePeriod; 42adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Projectimport org.apache.harmony.security.x509.SubjectPublicKeyInfo; 43adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project 44adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project 45adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project 46adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project/** 47adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * A certificate selector ({@code CertSelector} for selecting {@code 48adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * X509Certificate}s that match the specified criteria. 49adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project */ 50adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Projectpublic class X509CertSelector implements CertSelector { 51adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project 52adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project // match criteria 53adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project private X509Certificate certificateEquals; 54adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project private BigInteger serialNumber; 55adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project private X500Principal issuer; 56adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project private X500Principal subject; 57adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project private byte[] subjectKeyIdentifier; 58adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project private byte[] authorityKeyIdentifier; 59adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project private Date certificateValid; 60adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project private String subjectPublicKeyAlgID; 61adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project private Date privateKeyValid; 62adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project private byte[] subjectPublicKey; 63adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project private boolean[] keyUsage; 645c27fb80ffd335aa45dc8829ba3ecbc18c01e4e8Jesse Wilson private Set<String> extendedKeyUsage; 65adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project private boolean matchAllNames = true; 66adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project private int pathLen = -1; 675c27fb80ffd335aa45dc8829ba3ecbc18c01e4e8Jesse Wilson private List<GeneralName>[] subjectAltNames; 68adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project private NameConstraints nameConstraints; 69866e7ae17a3da81a02b0b144e0c9c2b3196d293aElliott Hughes private Set<String> policies; 705c27fb80ffd335aa45dc8829ba3ecbc18c01e4e8Jesse Wilson private ArrayList<GeneralName> pathToNames; 71adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project 72adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project // needed to avoid needless encoding/decoding work 73adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project private PublicKey subjectPublicKeyImpl; 74adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project private String issuerName; 75adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project private byte[] issuerBytes; 76adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project 77adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project /** 78adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * Creates a new {@code X509CertSelector}. 79adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project */ 80adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project public X509CertSelector() {} 81adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project 82adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project /** 83adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * Sets the certificate that a matching certificate must be equal to. 842f9e468ed4985edfd5e351faf2089d91e561e41dElliott Hughes * 85adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * @param certificate 86adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * the certificate to match, or null to not check this criteria. 87adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project */ 88adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project public void setCertificate(X509Certificate certificate) { 89adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project certificateEquals = certificate; 90adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 91adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project 92adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project /** 93adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * Returns the certificate that a matching certificate must be equal to. 942f9e468ed4985edfd5e351faf2089d91e561e41dElliott Hughes * 95adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * @return the certificate to match, or null if this criteria is not 96adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * checked. 97adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project */ 98adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project public X509Certificate getCertificate() { 99adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project return certificateEquals; 100adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 101adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project 102adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project /** 103adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * Sets the serial number that a certificate must match. 1042f9e468ed4985edfd5e351faf2089d91e561e41dElliott Hughes * 105adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * @param serialNumber 106adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * the serial number to match, or {@code null} to not check the 107adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * serial number. 108adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project */ 109adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project public void setSerialNumber(BigInteger serialNumber) { 110adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project this.serialNumber = serialNumber; 111adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 112adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project 113adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project /** 114adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * Returns the serial number that a certificate must match. 1152f9e468ed4985edfd5e351faf2089d91e561e41dElliott Hughes * 116adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * @return the serial number to match, or {@code null} if the serial number 117adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * is not to be checked. 118adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project */ 119adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project public BigInteger getSerialNumber() { 120adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project return serialNumber; 121adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 122adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project 123adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project /** 124adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * Sets the issuer that a certificate must match. 1252f9e468ed4985edfd5e351faf2089d91e561e41dElliott Hughes * 126adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * @param issuer 127adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * the issuer to match, or {@code null} if the issuer is not to 128adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * be checked. 129adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project */ 130adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project public void setIssuer(X500Principal issuer) { 131adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project this.issuer = issuer; 132adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project this.issuerName = null; 133adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project this.issuerBytes = null; 134adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 135adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project 136adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project /** 137adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * Returns the issuer that a certificate must match. 1382f9e468ed4985edfd5e351faf2089d91e561e41dElliott Hughes * 139adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * @return the issuer that a certificate must match, or {@code null} if the 140adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * issuer is not to be checked. 141adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project */ 142adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project public X500Principal getIssuer() { 143adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project return issuer; 144adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 145adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project 146adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project /** 147adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * <b>Do not use</b>, use {@link #getIssuer()} or 148adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * {@link #getIssuerAsBytes()} instead. Sets the issuer that a certificate 149adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * must match. 1502f9e468ed4985edfd5e351faf2089d91e561e41dElliott Hughes * 151adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * @param issuerName 152adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * the issuer in a RFC 2253 format string, or {@code null} to not 153adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * check the issuer. 154adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * @throws IOException 155adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * if parsing the issuer fails. 156adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project */ 157adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project public void setIssuer(String issuerName) throws IOException { 158adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project if (issuerName == null) { 159adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project this.issuer = null; 160adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project this.issuerName = null; 161adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project this.issuerBytes = null; 162adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project return; 163adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 164adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project try { 165adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project this.issuer = new X500Principal(issuerName); 166adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project this.issuerName = issuerName; 167adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project this.issuerBytes = null; 168adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } catch (IllegalArgumentException e) { 169adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project throw new IOException(e.getMessage()); 170adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 171adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 172adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project 173adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project /** 174adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * <b>Do not use</b>, use {@link #getIssuer()} or 175adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * {@link #getIssuerAsBytes()} instead. Returns the issuer that a 176adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * certificate must match in a RFC 2253 format string. 1772f9e468ed4985edfd5e351faf2089d91e561e41dElliott Hughes * 178adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * @return the issuer in a RFC 2253 format string, or {@code null} if the 179adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * issuer is not to be checked. 180adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project */ 181adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project public String getIssuerAsString() { 182adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project if (issuer == null) { 183adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project return null; 184adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 185adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project if (issuerName == null) { 186adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project issuerName = issuer.getName(); 187adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 188adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project return issuerName; 189adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 190adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project 191adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project /** 192adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * Sets the issuer that a certificate must match. 1932f9e468ed4985edfd5e351faf2089d91e561e41dElliott Hughes * 194adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * @param issuerDN 195adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * the distinguished issuer name in ASN.1 DER encoded format, or 196adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * {@code null} to not check the issuer. 197adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * @throws IOException 198adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * if decoding the issuer fail. 199adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project */ 200adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project public void setIssuer(byte[] issuerDN) throws IOException { 201adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project if (issuerDN == null) { 202adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project issuer = null; 203adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project return; 204adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 205adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project try { 206adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project issuer = new X500Principal(issuerDN); 207adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project this.issuerName = null; 208adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project this.issuerBytes = new byte[issuerDN.length]; 209adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project System.arraycopy(issuerDN, 0, this.issuerBytes, 0, issuerDN.length); 210adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } catch (IllegalArgumentException e) { 211adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project throw new IOException(e.getMessage()); 212adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 213adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 214adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project 215adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project /** 216adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * Returns the issuer that a certificate must match. 2172f9e468ed4985edfd5e351faf2089d91e561e41dElliott Hughes * 218adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * @return the distinguished issuer name in ASN.1 DER encoded format, or 219adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * {@code null} if the issuer is not to be checked. 220adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * @throws IOException 221adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * if encoding the issuer fails. 222adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project */ 223adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project public byte[] getIssuerAsBytes() throws IOException { 224adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project if (issuer == null) { 225adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project return null; 226adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 227adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project if (issuerBytes == null) { 228adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project issuerBytes = issuer.getEncoded(); 229adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 230adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project byte[] result = new byte[issuerBytes.length]; 231adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project System.arraycopy(issuerBytes, 0, result, 0, issuerBytes.length); 232adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project return result; 233adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 234adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project 235adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project /** 236adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * Set the subject that a certificate must match. 2372f9e468ed4985edfd5e351faf2089d91e561e41dElliott Hughes * 238adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * @param subject 239adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * the subject distinguished name or {@code null} to not check 240adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * the subject. 241adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project */ 242adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project public void setSubject(X500Principal subject) { 243adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project this.subject = subject; 244adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 245adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project 246adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project /** 247adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * Returns the subject that a certificate must match. 2482f9e468ed4985edfd5e351faf2089d91e561e41dElliott Hughes * 249adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * @return the subject distinguished name, or null if the subject is not to 250adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * be checked. 251adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project */ 252adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project public X500Principal getSubject() { 253adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project return subject; 254adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 255adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project 256adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project /** 257adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * <b>Do not use</b>, use {@link #setSubject(byte[])} or 258adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * {@link #setSubject(X500Principal)} instead. Returns the subject that a 259adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * certificate must match. 2602f9e468ed4985edfd5e351faf2089d91e561e41dElliott Hughes * 261adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * @param subjectDN 262adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * the subject distinguished name in RFC 2253 format or {@code 263adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * null} to not check the subject. 264adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * @throws IOException 265adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * if decoding the subject fails. 266adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project */ 267adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project public void setSubject(String subjectDN) throws IOException { 268adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project if (subjectDN == null) { 269adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project subject = null; 270adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project return; 271adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 272adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project try { 273adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project subject = new X500Principal(subjectDN); 274adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } catch (IllegalArgumentException e) { 275adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project throw new IOException(e.getMessage()); 276adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 277adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 278adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project 279adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project /** 280adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * <b>Do not use</b>, use {@link #getSubject()} or 281adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * {@link #getSubjectAsBytes()} instead. Returns the subject that a 282adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * certificate must match. 2832f9e468ed4985edfd5e351faf2089d91e561e41dElliott Hughes * 284adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * @return the subject distinguished name in RFC 2253 format, or {@code 285adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * null} if the subject is not to be checked. 286adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project */ 287adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project public String getSubjectAsString() { 288adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project if (subject == null) { 289adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project return null; 290adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 291adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project return subject.getName(); 292adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 293adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project 294adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project /** 295adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * Sets the subject that a certificate must match. 2962f9e468ed4985edfd5e351faf2089d91e561e41dElliott Hughes * 297adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * @param subjectDN 298adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * the subject distinguished name in ASN.1 DER format, or {@code 299adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * null} to not check the subject. 300adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * @throws IOException 301adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * if decoding the subject fails. 302adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project */ 303adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project public void setSubject(byte[] subjectDN) throws IOException { 304adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project if (subjectDN == null) { 305adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project subject = null; 306adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project return; 307adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 308adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project try { 309adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project subject = new X500Principal(subjectDN); 310adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } catch (IllegalArgumentException e) { 311adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project throw new IOException(e.getMessage()); 312adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 313adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 314adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project 315adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project /** 316adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * Returns the subject that a certificate must match. 3172f9e468ed4985edfd5e351faf2089d91e561e41dElliott Hughes * 318adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * @return the subject distinguished name in ASN.1 DER format, or {@code 319adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * null} if the subject is not to be checked. 320adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * @throws IOException 321adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * if encoding the subject fails. 322adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project */ 323adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project public byte[] getSubjectAsBytes() throws IOException { 324adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project if (subject == null) { 325adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project return null; 326adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 327adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project return subject.getEncoded(); 328adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 329adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project 330adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project /** 331adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * Sets the criterion for the {@literal SubjectKeyIdentifier} extension. 332adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * <p> 333adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * The {@code subjectKeyIdentifier} should be a single DER encoded value. 3342f9e468ed4985edfd5e351faf2089d91e561e41dElliott Hughes * 335adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * @param subjectKeyIdentifier 336adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * the subject key identifier or {@code null} to disable this 337adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * check. 338adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project */ 339adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project public void setSubjectKeyIdentifier(byte[] subjectKeyIdentifier) { 340adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project if (subjectKeyIdentifier == null) { 341adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project this.subjectKeyIdentifier = null; 342adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project return; 343adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 344adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project this.subjectKeyIdentifier = new byte[subjectKeyIdentifier.length]; 345adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project System.arraycopy(subjectKeyIdentifier, 0, this.subjectKeyIdentifier, 0, 346adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project subjectKeyIdentifier.length); 347adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 348adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project 349adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project /** 350adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * Returns the criterion for the {@literal SubjectKeyIdentifier} extension. 3512f9e468ed4985edfd5e351faf2089d91e561e41dElliott Hughes * 352adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * @return the subject key identifier or {@code null} if it is not to be 353adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * checked. 354adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project */ 355adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project public byte[] getSubjectKeyIdentifier() { 356adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project if (subjectKeyIdentifier == null) { 357adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project return null; 358adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 359adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project byte[] res = new byte[subjectKeyIdentifier.length]; 360adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project System.arraycopy(subjectKeyIdentifier, 0, res, 0, res.length); 361adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project return res; 362adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 363adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project 364adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project /** 365adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * Sets the criterion for the {@literal AuthorityKeyIdentifier} extension. 3662f9e468ed4985edfd5e351faf2089d91e561e41dElliott Hughes * 367adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * @param authorityKeyIdentifier 368adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * the authority key identifier, or {@code null} to disable this 369adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * check. 370adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project */ 371adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project public void setAuthorityKeyIdentifier(byte[] authorityKeyIdentifier) { 372adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project if (authorityKeyIdentifier == null) { 373adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project this.authorityKeyIdentifier = null; 374adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project return; 375adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 376adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project this.authorityKeyIdentifier = new byte[authorityKeyIdentifier.length]; 377adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project System.arraycopy(authorityKeyIdentifier, 0, 378adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project this.authorityKeyIdentifier, 0, 379adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project authorityKeyIdentifier.length); 380adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 381adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project 382adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project /** 383adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * Returns the criterion for the {@literal AuthorityKeyIdentifier} 384adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * extension. 3852f9e468ed4985edfd5e351faf2089d91e561e41dElliott Hughes * 386adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * @return the authority key identifier, or {@code null} if it is not to be 387adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * checked. 388adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project */ 389adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project public byte[] getAuthorityKeyIdentifier() { 390adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project if (authorityKeyIdentifier == null) { 391adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project return null; 392adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 393adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project byte[] res = new byte[authorityKeyIdentifier.length]; 394adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project System.arraycopy(authorityKeyIdentifier, 0, res, 0, res.length); 395adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project return res; 396adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 397adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project 398adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project /** 399adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * Sets the criterion for the validity date of the certificate. 400adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * <p> 401adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * The certificate must be valid at the specified date. 402adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * @param certificateValid 403adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * the validity date or {@code null} to not check the date. 404adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project */ 405adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project public void setCertificateValid(Date certificateValid) { 406adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project this.certificateValid = (certificateValid == null) 407adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project ? null 408adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project : (Date) certificateValid.clone(); 409adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 410adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project 411adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project /** 412adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * Returns the criterion for the validity date of the certificate. 4132f9e468ed4985edfd5e351faf2089d91e561e41dElliott Hughes * 414adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * @return the validity date or {@code null} if the date is not to be 415adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * checked. 416adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project */ 417adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project public Date getCertificateValid() { 418adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project return (certificateValid == null) 419adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project ? null 420adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project : (Date) certificateValid.clone(); 421adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 422adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project 423adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project /** 424adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * Sets the criterion for the validity date of the private key. 425adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * <p> 426adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * The private key must be valid at the specified date. 4272f9e468ed4985edfd5e351faf2089d91e561e41dElliott Hughes * 428adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * @param privateKeyValid 429adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * the validity date or {@code null} to not check the date. 430adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project */ 431adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project public void setPrivateKeyValid(Date privateKeyValid) { 432adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project if (privateKeyValid == null) { 433adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project this.privateKeyValid = null; 434adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project return; 435adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 436adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project this.privateKeyValid = (Date) privateKeyValid.clone(); 437adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 438adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project 439adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project /** 440adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * Returns the criterion for the validity date of the private key. 441adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * <p> 442adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * The private key must be valid at the specified date. 4432f9e468ed4985edfd5e351faf2089d91e561e41dElliott Hughes * 444adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * @return the validity date or {@code null} if the date is not to be 445adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * checked. 446adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project */ 447adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project public Date getPrivateKeyValid() { 448adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project if (privateKeyValid != null) { 449adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project return (Date) privateKeyValid.clone(); 450adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 451adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project return null; 452adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 453adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project 454adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project private void checkOID(String oid) throws IOException { 455adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project int beg = 0; 456adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project int end = oid.indexOf('.', beg); 457adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project try { 458adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project int comp = Integer.parseInt(oid.substring(beg, end)); 459adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project beg = end + 1; 460adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project if ((comp < 0) || (comp > 2)) { 461897538a36c18f4db8f9f68ee566aec0bda842e9fElliott Hughes throw new IOException("Bad OID: " + oid); 462adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 463adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project end = oid.indexOf('.', beg); 464adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project comp = Integer.parseInt(oid.substring(beg, end)); 465adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project if ((comp < 0) || (comp > 39)) { 466897538a36c18f4db8f9f68ee566aec0bda842e9fElliott Hughes throw new IOException("Bad OID: " + oid); 467adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 468adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } catch (IndexOutOfBoundsException e) { 469897538a36c18f4db8f9f68ee566aec0bda842e9fElliott Hughes throw new IOException("Bad OID: " + oid); 470adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } catch (NumberFormatException e) { 471897538a36c18f4db8f9f68ee566aec0bda842e9fElliott Hughes throw new IOException("Bad OID: " + oid); 472adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 473adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 474adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project 475adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project /** 476adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * Sets the criterion for the subject public key signature algorithm. 477adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * <p> 478adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * The certificate must contain a subject public key with the algorithm 479adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * specified. 4802f9e468ed4985edfd5e351faf2089d91e561e41dElliott Hughes * 481adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * @param oid 482adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * the OID (object identifier) of the signature algorithm or 483adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * {@code null} to not check the OID. 484adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * @throws IOException 485adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * if the specified object identifier is invalid. 486adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project */ 487adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project public void setSubjectPublicKeyAlgID(String oid) throws IOException { 488adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project if (oid == null) { 489adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project subjectPublicKeyAlgID = null; 490adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project return; 491adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 492adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project checkOID(oid); 493adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project subjectPublicKeyAlgID = oid; 494adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 495adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project 496adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project /** 497adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * Returns the criterion for the subject public key signature algorithm. 4982f9e468ed4985edfd5e351faf2089d91e561e41dElliott Hughes * 499adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * @return the OID (object identifier) or the signature algorithm or {@code 500adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * null} if it's not to be checked. 501adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project */ 502adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project public String getSubjectPublicKeyAlgID() { 503adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project return subjectPublicKeyAlgID; 504adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 505adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project 506adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project /** 507adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * Sets the criterion for the subject public key. 5082f9e468ed4985edfd5e351faf2089d91e561e41dElliott Hughes * 509adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * @param key 510adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * the subject public key or {@code null} to not check the key. 511adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project */ 512adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project public void setSubjectPublicKey(PublicKey key) { 513adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project subjectPublicKey = (key == null) ? null : key.getEncoded(); 514adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project subjectPublicKeyImpl = key; 515adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 516adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project 517adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project /** 518adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * Sets the criterion for the subject public key. 5192f9e468ed4985edfd5e351faf2089d91e561e41dElliott Hughes * 520adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * @param key 521adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * the subject public key in ASN.1 DER encoded format or {@code null} to 522adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * not check the key. 523adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * @throws IOException 524adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * if decoding the the public key fails. 525adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project */ 526adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project public void setSubjectPublicKey(byte[] key) throws IOException { 527adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project if (key == null) { 528adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project subjectPublicKey = null; 529adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project subjectPublicKeyImpl = null; 530adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project return; 531adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 532adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project subjectPublicKey = new byte[key.length]; 533adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project System.arraycopy(key, 0, subjectPublicKey, 0, key.length); 534f33eae7e84eb6d3b0f4e86b59605bb3de73009f3Elliott Hughes subjectPublicKeyImpl = 535adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project ((SubjectPublicKeyInfo) SubjectPublicKeyInfo.ASN1.decode(key)) 536adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project .getPublicKey(); 537adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 538adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project 539adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project /** 540adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * Returns the criterion for the subject public key. 5412f9e468ed4985edfd5e351faf2089d91e561e41dElliott Hughes * 542adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * @return the subject public key or {@code null} if the key is not to be 543adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * checked. 544adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project */ 545adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project public PublicKey getSubjectPublicKey() { 546adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project return subjectPublicKeyImpl; 547adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 548adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project 549adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project /** 550adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * Sets the criterion for the {@literal KeyUsage} extension. 5512f9e468ed4985edfd5e351faf2089d91e561e41dElliott Hughes * 552adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * @param keyUsage 553adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * the boolean array in the format as returned by 554adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * {@link X509Certificate#getKeyUsage()}, or {@code null} to not 555adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * check the key usage. 556adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project */ 557adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project public void setKeyUsage(boolean[] keyUsage) { 558adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project if (keyUsage == null) { 559adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project this.keyUsage = null; 560adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project return; 561adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 562adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project this.keyUsage = new boolean[keyUsage.length]; 563adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project System.arraycopy(keyUsage, 0, this.keyUsage, 0, keyUsage.length); 564adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 565adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project 566adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project /** 567adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * Returns the criterion for the {@literal KeyUsage} extension. 5682f9e468ed4985edfd5e351faf2089d91e561e41dElliott Hughes * 569adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * @return the boolean array in the format as returned by 570adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * {@link X509Certificate#getKeyUsage()}, or {@code null} if the key 571adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * usage is not to be checked. 572adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project */ 573adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project public boolean[] getKeyUsage() { 574adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project if (keyUsage == null) { 575adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project return null; 576adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 577adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project boolean[] result = new boolean[keyUsage.length]; 578adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project System.arraycopy(keyUsage, 0, result, 0, keyUsage.length); 579adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project return result; 580adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 581adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project 582adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project /** 583adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * Sets the criterion for the {@literal ExtendedKeyUsage} extension. 5842f9e468ed4985edfd5e351faf2089d91e561e41dElliott Hughes * 585adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * @param keyUsage 586adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * the set of key usage OIDs, or {@code null} to not check it. 587adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * @throws IOException 588adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * if one of the OIDs is invalid. 589adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project */ 590adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project public void setExtendedKeyUsage(Set<String> keyUsage) 591adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project throws IOException { 592adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project extendedKeyUsage = null; 593adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project if ((keyUsage == null) || (keyUsage.size() == 0)) { 594adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project return; 595adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 5965c27fb80ffd335aa45dc8829ba3ecbc18c01e4e8Jesse Wilson HashSet<String> key_u = new HashSet<String>(); 5975c27fb80ffd335aa45dc8829ba3ecbc18c01e4e8Jesse Wilson for (String usage : keyUsage) { 598adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project checkOID(usage); 599adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project key_u.add(usage); 600adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 601adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project extendedKeyUsage = Collections.unmodifiableSet(key_u); 602adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 603adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project 604adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project /** 605adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * Returns the criterion for the {@literal ExtendedKeyUsage} extension. 6062f9e468ed4985edfd5e351faf2089d91e561e41dElliott Hughes * 607adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * @return the set of key usage OIDs, or {@code null} if it's not to be 608adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * checked. 609adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project */ 610adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project public Set<String> getExtendedKeyUsage() { 611adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project return extendedKeyUsage; 612adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 613adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project 614adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project /** 615adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * Sets the flag for the matching behavior for subject alternative names. 616adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * <p> 617adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * The flag indicates whether a certificate must contain all or at least one 6182f9e468ed4985edfd5e351faf2089d91e561e41dElliott Hughes * of the subject alternative names specified by {@link 6192f9e468ed4985edfd5e351faf2089d91e561e41dElliott Hughes * #setSubjectAlternativeNames} or {@link #addSubjectAlternativeName}. 6202f9e468ed4985edfd5e351faf2089d91e561e41dElliott Hughes * 621adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * @param matchAllNames 622adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * {@code true} if a certificate must contain all of the 623adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * specified subject alternative names, otherwise {@code false}. 624adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project */ 625adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project public void setMatchAllSubjectAltNames(boolean matchAllNames) { 626adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project this.matchAllNames = matchAllNames; 627adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 628adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project 629adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project /** 630adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * Returns the flag for the matching behavior for subject alternative names. 631adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * <p> 632adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * The flag indicates whether a certificate must contain all or at least one 6332f9e468ed4985edfd5e351faf2089d91e561e41dElliott Hughes * of the subject alternative names specified by {@link 6342f9e468ed4985edfd5e351faf2089d91e561e41dElliott Hughes * #setSubjectAlternativeNames} or {@link #addSubjectAlternativeName}. 6352f9e468ed4985edfd5e351faf2089d91e561e41dElliott Hughes * 636adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * @return {@code true} if a certificate must contain all of the specified 637adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * subject alternative names, otherwise {@code false}. 638adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project */ 639adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project public boolean getMatchAllSubjectAltNames() { 640adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project return matchAllNames; 641adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 642adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project 643adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project /** 644adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * Sets the criterion for subject alternative names. 645adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * <p> 646adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * the certificate must contain all or at least one of the specified subject 647adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * alternative names. The behavior is specified by 648adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * {@link #getMatchAllSubjectAltNames}. 649adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * <p> 650adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * The specified parameter {@code names} is a collection with an entry for 651adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * each name to be included in the criterion. The name is specified as a 652adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * {@code List}, the first entry must be an {@code Integer} specifying the 653adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * name type (0-8), the second entry must be a {@code String} or a byte 654adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * array specifying the name (in string or ASN.1 DER encoded form) 6552f9e468ed4985edfd5e351faf2089d91e561e41dElliott Hughes * 656adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * @param names 657adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * the names collection or {@code null} to not perform this check. 658adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * @throws IOException 659adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * if the decoding of a name fails. 660adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project */ 661595db69d9b219f3d2d4598b5cb57c116cd157918Jesse Wilson public void setSubjectAlternativeNames(Collection<List<?>> names) throws IOException { 662adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project subjectAltNames = null; 663adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project if ((names == null) || (names.size() == 0)) { 664adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project return; 665adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 666595db69d9b219f3d2d4598b5cb57c116cd157918Jesse Wilson for (List<?> name : names) { 6675c27fb80ffd335aa45dc8829ba3ecbc18c01e4e8Jesse Wilson int tag = (Integer) name.get(0); 668adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project Object value = name.get(1); 669adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project if (value instanceof String) { 670adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project addSubjectAlternativeName(tag, (String) value); 671adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } else if (value instanceof byte[]) { 672adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project addSubjectAlternativeName(tag, (byte[]) value); 673adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } else { 674897538a36c18f4db8f9f68ee566aec0bda842e9fElliott Hughes throw new IOException("name neither a String nor a byte[]"); 675adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 676adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 677adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 678adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project 679adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project /** 680adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * Adds a subject alternative name to the respective criterion. 6812f9e468ed4985edfd5e351faf2089d91e561e41dElliott Hughes * 682adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * @param tag 683adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * the type of the name 684adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * @param name 685adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * the name in string format. 686adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * @throws IOException 687adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * if parsing the name fails. 688adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project */ 689adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project public void addSubjectAlternativeName(int tag, String name) 690adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project throws IOException { 691adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project GeneralName alt_name = new GeneralName(tag, name); 692adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project // create only if there was not any errors 693adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project if (subjectAltNames == null) { 694adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project subjectAltNames = new ArrayList[9]; 695adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 696adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project if (subjectAltNames[tag] == null) { 6975c27fb80ffd335aa45dc8829ba3ecbc18c01e4e8Jesse Wilson subjectAltNames[tag] = new ArrayList<GeneralName>(); 698adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 699adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project subjectAltNames[tag].add(alt_name); 700adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 701adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project 702adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project /** 703adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * Adds a subject alternative name to the respective criterion. 7042f9e468ed4985edfd5e351faf2089d91e561e41dElliott Hughes * 705adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * @param tag 706adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * the type of the name. 707adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * @param name 708adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * the name in ASN.1 DER encoded form. 709adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * @throws IOException 710adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * if the decoding of the name fails. 711adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project */ 712adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project public void addSubjectAlternativeName(int tag, byte[] name) 713adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project throws IOException { 714adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project GeneralName alt_name = new GeneralName(tag, name); 715adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project // create only if there was not any errors 716adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project if (subjectAltNames == null) { 717adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project subjectAltNames = new ArrayList[9]; 718adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 719adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project if (subjectAltNames[tag] == null) { 7205c27fb80ffd335aa45dc8829ba3ecbc18c01e4e8Jesse Wilson subjectAltNames[tag] = new ArrayList<GeneralName>(); 721adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 722adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project subjectAltNames[tag].add(alt_name); 723adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 724adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project 725adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project /** 726adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * Returns the criterion for subject alternative names. 727adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * <p> 728adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * the certificate must contain all or at least one of the specified subject 729adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * alternative names. The behavior is specified by 730adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * {@link #getMatchAllSubjectAltNames}. 731adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * <p> 732adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * The subject alternative names is a collection with an entry for each name 733adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * included in the criterion. The name is specified as a {@code List}, the 734adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * first entry is an {@code Integer} specifying the name type (0-8), the 735adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * second entry is byte array specifying the name in ASN.1 DER encoded form) 7362f9e468ed4985edfd5e351faf2089d91e561e41dElliott Hughes * 737adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * @return the names collection or {@code null} if none specified. 738adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project */ 739adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project public Collection<List<?>> getSubjectAlternativeNames() { 740adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project if (subjectAltNames == null) { 741adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project return null; 742adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 7435c27fb80ffd335aa45dc8829ba3ecbc18c01e4e8Jesse Wilson ArrayList<List<?>> result = new ArrayList<List<?>>(); 744adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project for (int tag=0; tag<9; tag++) { 745adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project if (subjectAltNames[tag] != null) { 746adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project for (int name=0; name<subjectAltNames[tag].size(); name++) { 7475c27fb80ffd335aa45dc8829ba3ecbc18c01e4e8Jesse Wilson List<Object> list = new ArrayList<Object>(2); 748fb0ec0e650bf8be35acb0d47da0311a7c446aa33Elliott Hughes list.add(tag); 7495c27fb80ffd335aa45dc8829ba3ecbc18c01e4e8Jesse Wilson list.add(subjectAltNames[tag].get(name)); 750adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project result.add(list); 751adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 752adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 753adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 754adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project return result; 755adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 756adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project 757adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project /** 758adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * Sets the criterion for the name constraints. 759adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * <p> 760adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * The certificate must constraint subject and subject alternative names 761adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * that match the specified name constraints. 762adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * <p> 763adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * The name constraints in ASN.1: 7642f9e468ed4985edfd5e351faf2089d91e561e41dElliott Hughes * 765adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * <pre> 766adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * NameConstraints ::= SEQUENCE { 767adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * permittedSubtrees [0] GeneralSubtrees OPTIONAL, 768adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * excludedSubtrees [1] GeneralSubtrees OPTIONAL } 7692f9e468ed4985edfd5e351faf2089d91e561e41dElliott Hughes * 770adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * GeneralSubtrees ::= SEQUENCE SIZE (1..MAX) OF GeneralSubtree 7712f9e468ed4985edfd5e351faf2089d91e561e41dElliott Hughes * 772adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * GeneralSubtree ::= SEQUENCE { 773adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * base GeneralName, 774adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * minimum [0] BaseDistance DEFAULT 0, 775adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * maximum [1] BaseDistance OPTIONAL } 7762f9e468ed4985edfd5e351faf2089d91e561e41dElliott Hughes * 777adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * BaseDistance ::= INTEGER (0..MAX) 7782f9e468ed4985edfd5e351faf2089d91e561e41dElliott Hughes * 779adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * GeneralName ::= CHOICE { 780adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * otherName [0] OtherName, 781adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * rfc822Name [1] IA5String, 782adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * dNSName [2] IA5String, 783adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * x400Address [3] ORAddress, 784adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * directoryName [4] Name, 785adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * ediPartyName [5] EDIPartyName, 786adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * uniformResourceIdentifier [6] IA5String, 787adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * iPAddress [7] OCTET STRING, 788adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * registeredID [8] OBJECT IDENTIFIER} 7892f9e468ed4985edfd5e351faf2089d91e561e41dElliott Hughes * 790adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * </pre> 7912f9e468ed4985edfd5e351faf2089d91e561e41dElliott Hughes * 792adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * @param bytes 793adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * the name constraints in ASN.1 DER encoded format, or null to 794adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * not check any constraints. 795adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * @throws IOException 796adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * if decoding the name constraints fail. 797adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project */ 798adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project public void setNameConstraints(byte[] bytes) throws IOException { 799adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project this.nameConstraints = (bytes == null) 800adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project ? null 801adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project : (NameConstraints) NameConstraints.ASN1.decode(bytes); 802adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 803adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project 804adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project /** 805adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * Returns the criterion for the name constraints. 8062f9e468ed4985edfd5e351faf2089d91e561e41dElliott Hughes * 807adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * @return the name constraints or {@code null} if none specified. 808adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * @see #setNameConstraints 809adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project */ 810adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project public byte[] getNameConstraints() { 811adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project return (nameConstraints == null) 812adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project ? null 813adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project : nameConstraints.getEncoded(); 814adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 815adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project 816adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project /** 817adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * Sets the criterion for the basic constraints extension. 818adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * <p> 819adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * A value greater than or equal to zero indicates that a certificate must 820adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * include a basic constraints extension with a path length of a least that 821adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * value. A value of {@code -2} indicates that only end-entity certificates 822adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * are accepted. A value of {@code -1} indicates that no check is done. 8232f9e468ed4985edfd5e351faf2089d91e561e41dElliott Hughes * 824adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * @param pathLen 825adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * the value specifying the criterion. 826adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * @throws IllegalArgumentException 827adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * if {@code pathLen} is less than {@code -2}. 828adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project */ 829adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project public void setBasicConstraints(int pathLen) { 830adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project if (pathLen < -2) { 831897538a36c18f4db8f9f68ee566aec0bda842e9fElliott Hughes throw new IllegalArgumentException("pathLen < -2"); 832adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 833adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project this.pathLen = pathLen; 834adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 835adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project 836adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project /** 837adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * Returns the criterion for the basic constraints extension. 838adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * <p> 839adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * A value greater than or equal to zero indicates that a certificate must 840adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * include a basic constraints extension with a path length of a least that 841adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * value. A value of {@code -2} indicates that only end-entity certificates 842adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * are accepted. A value of {@code -1} indicates that no check is done. 8432f9e468ed4985edfd5e351faf2089d91e561e41dElliott Hughes * 844adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * @return the value of the criterion. 845adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project */ 846adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project public int getBasicConstraints() { 847adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project return pathLen; 848adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 849adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project 850adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project /** 851adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * Sets the criterion for the policy constraint. 852adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * <p> 853adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * The certificate must have at least one of the specified certificate 854adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * policy extensions. For an empty set the certificate must have at least 855adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * some policies in its policy extension. 8562f9e468ed4985edfd5e351faf2089d91e561e41dElliott Hughes * 857adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * @param policies 858adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * the certificate policy OIDs, an empty set, or {@code null} to 859adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * not perform this check. 860adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * @throws IOException 861adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * if parsing the specified OIDs fails. 862adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project */ 863adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project public void setPolicy(Set<String> policies) throws IOException { 864adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project if (policies == null) { 865adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project this.policies = null; 866adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project return; 867adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 868866e7ae17a3da81a02b0b144e0c9c2b3196d293aElliott Hughes HashSet<String> pols = new HashSet<String>(policies.size()); 8695c27fb80ffd335aa45dc8829ba3ecbc18c01e4e8Jesse Wilson for (String certPolicyId : policies) { 870adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project checkOID(certPolicyId); 871adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project pols.add(certPolicyId); 872adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 873adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project this.policies = Collections.unmodifiableSet(pols); 874adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 875adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project 876adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project /** 877adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * Returns the criterion for the policy constraint. 878adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * <p> 879adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * The certificate must have at least one of the certificate policy 880adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * extensions. For an empty set the certificate must have at least some 881adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * policies in its policy extension. 8822f9e468ed4985edfd5e351faf2089d91e561e41dElliott Hughes * 883adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * @return the certificate policy OIDs, an empty set, or {@code null} if not 884adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * to be checked. 885adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project */ 886adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project public Set<String> getPolicy() { 887adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project return policies; 888adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 889adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project 890adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project /** 8915c27fb80ffd335aa45dc8829ba3ecbc18c01e4e8Jesse Wilson * Adds a {@literal "pathToName"} to the respective criterion. 8925c27fb80ffd335aa45dc8829ba3ecbc18c01e4e8Jesse Wilson * 8935c27fb80ffd335aa45dc8829ba3ecbc18c01e4e8Jesse Wilson * @param type 8945c27fb80ffd335aa45dc8829ba3ecbc18c01e4e8Jesse Wilson * the type of the name. 8955c27fb80ffd335aa45dc8829ba3ecbc18c01e4e8Jesse Wilson * @param name 8965c27fb80ffd335aa45dc8829ba3ecbc18c01e4e8Jesse Wilson * the name in string format. 8975c27fb80ffd335aa45dc8829ba3ecbc18c01e4e8Jesse Wilson * @throws IOException 8985c27fb80ffd335aa45dc8829ba3ecbc18c01e4e8Jesse Wilson * if parsing fails. 8995c27fb80ffd335aa45dc8829ba3ecbc18c01e4e8Jesse Wilson * @see #setPathToNames 9005c27fb80ffd335aa45dc8829ba3ecbc18c01e4e8Jesse Wilson */ 9015c27fb80ffd335aa45dc8829ba3ecbc18c01e4e8Jesse Wilson public void addPathToName(int type, String name) throws IOException { 9025c27fb80ffd335aa45dc8829ba3ecbc18c01e4e8Jesse Wilson GeneralName path_name = new GeneralName(type, name); 9035c27fb80ffd335aa45dc8829ba3ecbc18c01e4e8Jesse Wilson // create only if there was not any errors 9045c27fb80ffd335aa45dc8829ba3ecbc18c01e4e8Jesse Wilson if (pathToNames == null) { 9055c27fb80ffd335aa45dc8829ba3ecbc18c01e4e8Jesse Wilson pathToNames = new ArrayList<GeneralName>(); 9065c27fb80ffd335aa45dc8829ba3ecbc18c01e4e8Jesse Wilson } 9075c27fb80ffd335aa45dc8829ba3ecbc18c01e4e8Jesse Wilson pathToNames.add(path_name); 9085c27fb80ffd335aa45dc8829ba3ecbc18c01e4e8Jesse Wilson } 9095c27fb80ffd335aa45dc8829ba3ecbc18c01e4e8Jesse Wilson 9105c27fb80ffd335aa45dc8829ba3ecbc18c01e4e8Jesse Wilson /** 911adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * Sets the criterion for the pathToNames constraint. 912adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * <p> 913adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * This allows to specify the complete set of names, a certificate's name 914adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * constraints must permit. 915adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * <p> 916adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * The specified parameter {@code names} is a collection with an entry for 917adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * each name to be included in the criterion. The name is specified as a 918adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * {@code List}, the first entry must be an {@code Integer} specifying the 919adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * name type (0-8), the second entry must be a {@code String} or a byte 920adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * array specifying the name (in string or ASN.1 DER encoded form) 9212f9e468ed4985edfd5e351faf2089d91e561e41dElliott Hughes * 922adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * @param names 923adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * the names collection or {@code null} to not perform this 924adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * check. 925adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * @throws IOException 926adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * if decoding fails. 927adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project */ 928595db69d9b219f3d2d4598b5cb57c116cd157918Jesse Wilson public void setPathToNames(Collection<List<?>> names) throws IOException { 929adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project pathToNames = null; 930adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project if ((names == null) || (names.size() == 0)) { 931adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project return; 932adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 9335c27fb80ffd335aa45dc8829ba3ecbc18c01e4e8Jesse Wilson for (List<?> name : names) { 9345c27fb80ffd335aa45dc8829ba3ecbc18c01e4e8Jesse Wilson int tag = (Integer) name.get(0); 935adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project Object value = name.get(1); 936adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project if (value instanceof String) { 937adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project addPathToName(tag, (String) value); 938adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } else if (value instanceof byte[]) { 939adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project addPathToName(tag, (byte[]) value); 940adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } else { 941897538a36c18f4db8f9f68ee566aec0bda842e9fElliott Hughes throw new IOException("name neither a String nor a byte[]"); 942adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 943adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 944adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 945adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project 946adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project /** 947adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * Adds a {@literal "pathToName"} to the respective criterion. 9482f9e468ed4985edfd5e351faf2089d91e561e41dElliott Hughes * 949adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * @param type 950adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * the type of the name 951adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * @param name 952adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * the name in ASN.1 DER encoded form. 953adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * @throws IOException 954adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * if decoding fails. 955adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * @see #setPathToNames 956adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project */ 957adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project public void addPathToName(int type, byte[] name) throws IOException { 958adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project GeneralName path_name= new GeneralName(type, name); 959adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project // create only if there was not any errors 960adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project if (pathToNames == null) { 9615c27fb80ffd335aa45dc8829ba3ecbc18c01e4e8Jesse Wilson pathToNames = new ArrayList<GeneralName>(); 962adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 963adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project pathToNames.add(path_name); 964adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 965adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project 966adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project /** 967adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * Returns the criterion for the pathToNames constraint. 968adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * <p> 969adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * The constraint is a collection with an entry for each name to be included 970adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * in the criterion. The name is specified as a {@code List}, the first 971adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * entry is an {@code Integer} specifying the name type (0-8), the second 972adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * entry is a byte array specifying the name in ASN.1 DER encoded form. 9732f9e468ed4985edfd5e351faf2089d91e561e41dElliott Hughes * 974adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * @return the pathToNames constraint or {@code null} if none specified. 975adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project */ 976adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project public Collection<List<?>> getPathToNames() { 977adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project if (pathToNames == null) { 978adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project return null; 979adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 9805c27fb80ffd335aa45dc8829ba3ecbc18c01e4e8Jesse Wilson Collection<List<?>> result = new ArrayList<List<?>>(); 9815c27fb80ffd335aa45dc8829ba3ecbc18c01e4e8Jesse Wilson for (GeneralName name : pathToNames) { 982adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project result.add(name.getAsList()); 983adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 984adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project return result; 985adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 986adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project 987adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project /** 988adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * Returns a string representation of this {@code X509CertSelector} 989adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * instance. 9902f9e468ed4985edfd5e351faf2089d91e561e41dElliott Hughes * 991adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * @return a string representation of this {@code X509CertSelector} 992adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * instance. 993adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project */ 994adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project public String toString() { 995adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project // For convenient reading of the string representation 996adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project // all of the fields named according to the rfc 3280 997adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project // (http://www.ietf.org/rfc/rfc3280.txt). 998adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project 9992f9e468ed4985edfd5e351faf2089d91e561e41dElliott Hughes StringBuilder result = new StringBuilder(); 1000f33eae7e84eb6d3b0f4e86b59605bb3de73009f3Elliott Hughes result.append("X509CertSelector: \n["); 1001adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project if (this.certificateEquals != null) { 10025c27fb80ffd335aa45dc8829ba3ecbc18c01e4e8Jesse Wilson result.append("\n certificateEquals: ").append(certificateEquals); 1003adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 1004adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project if (this.serialNumber != null) { 10055c27fb80ffd335aa45dc8829ba3ecbc18c01e4e8Jesse Wilson result.append("\n serialNumber: ").append(serialNumber); 1006adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 1007adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project if (this.issuer != null) { 10085c27fb80ffd335aa45dc8829ba3ecbc18c01e4e8Jesse Wilson result.append("\n issuer: ").append(issuer); 1009adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 1010adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project if (this.subject != null) { 10115c27fb80ffd335aa45dc8829ba3ecbc18c01e4e8Jesse Wilson result.append("\n subject: ").append(subject); 1012adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 1013adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project if (this.subjectKeyIdentifier != null) { 10145c27fb80ffd335aa45dc8829ba3ecbc18c01e4e8Jesse Wilson result.append("\n subjectKeyIdentifier: ") 10155c27fb80ffd335aa45dc8829ba3ecbc18c01e4e8Jesse Wilson .append(Array.getBytesAsString(subjectKeyIdentifier)); 1016adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 1017adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project if (this.authorityKeyIdentifier != null) { 10185c27fb80ffd335aa45dc8829ba3ecbc18c01e4e8Jesse Wilson result.append("\n authorityKeyIdentifier: ") 10195c27fb80ffd335aa45dc8829ba3ecbc18c01e4e8Jesse Wilson .append(Array.getBytesAsString(authorityKeyIdentifier)); 1020adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 1021adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project if (this.certificateValid != null) { 10225c27fb80ffd335aa45dc8829ba3ecbc18c01e4e8Jesse Wilson result.append("\n certificateValid: ").append(certificateValid); 1023adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 1024adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project if (this.subjectPublicKeyAlgID != null) { 10255c27fb80ffd335aa45dc8829ba3ecbc18c01e4e8Jesse Wilson result.append("\n subjectPublicKeyAlgID: ").append(subjectPublicKeyAlgID); 1026adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 1027adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project if (this.privateKeyValid != null) { 10285c27fb80ffd335aa45dc8829ba3ecbc18c01e4e8Jesse Wilson result.append("\n privateKeyValid: ").append(privateKeyValid); 1029adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 1030adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project if (this.subjectPublicKey != null) { 10315c27fb80ffd335aa45dc8829ba3ecbc18c01e4e8Jesse Wilson result.append("\n subjectPublicKey: ") 10325c27fb80ffd335aa45dc8829ba3ecbc18c01e4e8Jesse Wilson .append(Array.getBytesAsString(subjectPublicKey)); 1033adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 1034adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project if (this.keyUsage != null) { 1035f33eae7e84eb6d3b0f4e86b59605bb3de73009f3Elliott Hughes result.append("\n keyUsage: \n ["); 1036adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project String[] kuNames = new String[] { 1037f33eae7e84eb6d3b0f4e86b59605bb3de73009f3Elliott Hughes "digitalSignature", "nonRepudiation", "keyEncipherment", 1038f33eae7e84eb6d3b0f4e86b59605bb3de73009f3Elliott Hughes "dataEncipherment", "keyAgreement", "keyCertSign", "cRLSign", 1039f33eae7e84eb6d3b0f4e86b59605bb3de73009f3Elliott Hughes "encipherOnly", "decipherOnly" 1040adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project }; 1041adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project for (int i=0; i<9; i++) { 1042adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project if (keyUsage[i]) { 10435c27fb80ffd335aa45dc8829ba3ecbc18c01e4e8Jesse Wilson result.append("\n ").append(kuNames[i]); 1044adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 1045adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 1046f33eae7e84eb6d3b0f4e86b59605bb3de73009f3Elliott Hughes result.append("\n ]"); 1047adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 1048adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project if (this.extendedKeyUsage != null) { 10495c27fb80ffd335aa45dc8829ba3ecbc18c01e4e8Jesse Wilson result.append("\n extendedKeyUsage: ").append(extendedKeyUsage.toString()); 1050adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 10515c27fb80ffd335aa45dc8829ba3ecbc18c01e4e8Jesse Wilson result.append("\n matchAllNames: ").append(matchAllNames); 10525c27fb80ffd335aa45dc8829ba3ecbc18c01e4e8Jesse Wilson result.append("\n pathLen: ").append(pathLen); 1053adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project if (this.subjectAltNames != null) { 1054f33eae7e84eb6d3b0f4e86b59605bb3de73009f3Elliott Hughes result.append("\n subjectAltNames: \n ["); 1055adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project for (int i=0; i<9; i++) { 10565c27fb80ffd335aa45dc8829ba3ecbc18c01e4e8Jesse Wilson List<GeneralName> names = subjectAltNames[i]; 1057adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project if (names != null) { 1058adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project int size = names.size(); 10595c27fb80ffd335aa45dc8829ba3ecbc18c01e4e8Jesse Wilson for (GeneralName generalName : names) { 10605c27fb80ffd335aa45dc8829ba3ecbc18c01e4e8Jesse Wilson result.append("\n ").append(generalName.toString()); 1061adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 1062adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 1063adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 1064f33eae7e84eb6d3b0f4e86b59605bb3de73009f3Elliott Hughes result.append("\n ]"); 1065adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 1066adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project if (this.nameConstraints != null) { 1067adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 1068adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project if (this.policies != null) { 10695c27fb80ffd335aa45dc8829ba3ecbc18c01e4e8Jesse Wilson result.append("\n policies: ").append(policies.toString()); 1070adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 1071adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project if (this.pathToNames != null) { 1072f33eae7e84eb6d3b0f4e86b59605bb3de73009f3Elliott Hughes result.append("\n pathToNames: \n ["); 10735c27fb80ffd335aa45dc8829ba3ecbc18c01e4e8Jesse Wilson for (GeneralName generalName : pathToNames) { 10745c27fb80ffd335aa45dc8829ba3ecbc18c01e4e8Jesse Wilson result.append("\n ").append(generalName.toString()); 1075adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 1076adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 1077f33eae7e84eb6d3b0f4e86b59605bb3de73009f3Elliott Hughes result.append("\n]"); 1078adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project return result.toString(); 1079adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 1080adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project 1081adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project private byte[] getExtensionValue(X509Certificate cert, String oid) { 1082adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project try { 1083adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project byte[] bytes = cert.getExtensionValue(oid); 1084adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project if (bytes == null) { 1085adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project return null; 1086adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 1087adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project return (byte[]) ASN1OctetString.getInstance().decode(bytes); 1088adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } catch (IOException e) { 1089adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project return null; 1090adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 1091adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 1092adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project 1093adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project /** 1094adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * Returns whether the specified certificate matches all the criteria 1095adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * collected in this instance. 10962f9e468ed4985edfd5e351faf2089d91e561e41dElliott Hughes * 1097adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * @param certificate 1098adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * the certificate to check. 1099adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * @return {@code true} if the certificate matches all the criteria, 1100adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * otherwise {@code false}. 1101adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project */ 1102adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project public boolean match(Certificate certificate) { 1103adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project if (! (certificate instanceof X509Certificate)) { 1104adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project return false; 1105adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 1106adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project 1107adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project X509Certificate cert = (X509Certificate) certificate; 1108adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project if ((certificateEquals != null) && 1109adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project !certificateEquals.equals(cert)) { 1110adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project return false; 1111adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 1112adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project if ((serialNumber != null) && 1113adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project !serialNumber.equals(cert.getSerialNumber())) { 1114adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project return false; 1115adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 1116adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project if ((issuer != null) && 1117adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project !issuer.equals(cert.getIssuerX500Principal())) { 1118adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project return false; 1119adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 1120adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project if ((subject != null) && 1121adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project !subject.equals(cert.getSubjectX500Principal())) { 1122adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project return false; 1123adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 1124adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project if ((subjectKeyIdentifier != null) && 1125adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project !Arrays.equals(subjectKeyIdentifier, 1126f33eae7e84eb6d3b0f4e86b59605bb3de73009f3Elliott Hughes // Here and later all of the extension OIDs 1127adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project // are taken from rfc 3280 (http://www.ietf.org/rfc/rfc3280.txt) 1128f33eae7e84eb6d3b0f4e86b59605bb3de73009f3Elliott Hughes getExtensionValue(cert, "2.5.29.14"))) { 1129adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project return false; 1130adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 1131adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project if ((authorityKeyIdentifier != null) && 1132adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project !Arrays.equals(authorityKeyIdentifier, 1133f33eae7e84eb6d3b0f4e86b59605bb3de73009f3Elliott Hughes getExtensionValue(cert, "2.5.29.35"))) { 1134adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project return false; 1135adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 1136adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project if (certificateValid != null) { 1137adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project try { 1138adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project cert.checkValidity(certificateValid); 1139adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } catch(CertificateExpiredException e) { 1140adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project return false; 1141adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } catch(CertificateNotYetValidException e) { 1142adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project return false; 1143adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 1144adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 1145adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project if (privateKeyValid != null) { 1146adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project try { 1147f33eae7e84eb6d3b0f4e86b59605bb3de73009f3Elliott Hughes byte[] bytes = getExtensionValue(cert, "2.5.29.16"); 1148adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project if (bytes == null) { 1149adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project return false; 1150adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 1151f33eae7e84eb6d3b0f4e86b59605bb3de73009f3Elliott Hughes PrivateKeyUsagePeriod pkup = (PrivateKeyUsagePeriod) 1152adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project PrivateKeyUsagePeriod.ASN1.decode(bytes); 1153adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project Date notBefore = pkup.getNotBefore(); 1154adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project Date notAfter = pkup.getNotAfter(); 1155adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project if ((notBefore == null) && (notAfter == null)) { 1156adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project return false; 1157adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 1158adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project if ((notBefore != null) 1159adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project && notBefore.compareTo(privateKeyValid) > 0) { 1160adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project return false; 1161adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 1162adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project if ((notAfter != null) 1163adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project && notAfter.compareTo(privateKeyValid) < 0) { 1164adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project return false; 1165adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 1166adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } catch (IOException e) { 1167adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project return false; 1168adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 1169adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 1170adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project if (subjectPublicKeyAlgID != null) { 1171adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project try { 1172adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project byte[] encoding = cert.getPublicKey().getEncoded(); 1173f33eae7e84eb6d3b0f4e86b59605bb3de73009f3Elliott Hughes AlgorithmIdentifier ai = ((SubjectPublicKeyInfo) 1174adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project SubjectPublicKeyInfo.ASN1.decode(encoding)) 1175adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project .getAlgorithmIdentifier(); 1176adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project if (!subjectPublicKeyAlgID.equals(ai.getAlgorithm())) { 1177adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project return false; 1178adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 1179adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } catch (IOException e) { 1180adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project e.printStackTrace(); 1181adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project return false; 1182adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 1183adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 1184adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project if (subjectPublicKey != null) { 1185adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project if (!Arrays.equals(subjectPublicKey, 1186adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project cert.getPublicKey().getEncoded())) { 1187adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project return false; 1188adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 1189adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 1190adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project if (keyUsage != null) { 1191adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project boolean[] ku = cert.getKeyUsage(); 1192adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project if (ku != null) { 1193adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project int i = 0; 1194adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project int min_length = (ku.length < keyUsage.length) ? ku.length 1195adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project : keyUsage.length; 1196adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project for (; i < min_length; i++) { 1197adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project if (keyUsage[i] && !ku[i]) { 1198adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project // the specified keyUsage allows, 1199adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project // but certificate does not. 1200adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project return false; 1201adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 1202adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 1203adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project for (; i<keyUsage.length; i++) { 1204adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project if (keyUsage[i]) { 1205adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project return false; 1206adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 1207adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 1208adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 1209adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 1210adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project if (extendedKeyUsage != null) { 1211adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project try { 1212adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project List keyUsage = cert.getExtendedKeyUsage(); 1213adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project if (keyUsage != null) { 1214adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project if (!keyUsage.containsAll(extendedKeyUsage)) { 1215adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project return false; 1216adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 1217adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 1218adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } catch (CertificateParsingException e) { 1219adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project return false; 1220adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 1221adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 1222adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project if (pathLen != -1) { 1223adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project int p_len = cert.getBasicConstraints(); 1224adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project if ((pathLen < 0) && (p_len >= 0)) { 1225adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project // need end-entity but got CA 1226adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project return false; 1227adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 1228adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project if ((pathLen > 0) && (pathLen > p_len)) { 1229adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project // allowed _pathLen is small 1230adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project return false; 1231adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 1232adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 1233adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project if (subjectAltNames != null) { 1234adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project PASSED: 1235adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project try { 1236f33eae7e84eb6d3b0f4e86b59605bb3de73009f3Elliott Hughes byte[] bytes = getExtensionValue(cert, "2.5.29.17"); 1237adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project if (bytes == null) { 1238adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project return false; 1239adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 12405c27fb80ffd335aa45dc8829ba3ecbc18c01e4e8Jesse Wilson List<GeneralName> sans = ((GeneralNames) GeneralNames.ASN1.decode(bytes)) 1241adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project .getNames(); 1242adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project if ((sans == null) || (sans.size() == 0)) { 1243adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project return false; 1244adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 1245adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project boolean[][] map = new boolean[9][]; 1246adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project // initialize the check map 1247adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project for (int i=0; i<9; i++) { 1248adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project map[i] = (subjectAltNames[i] == null) 1249693eacca9fa67ad79d1b35dbaad61c5ac1ac457cElliott Hughes ? EmptyArray.BOOLEAN : new boolean[subjectAltNames[i].size()]; 1250adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 12515c27fb80ffd335aa45dc8829ba3ecbc18c01e4e8Jesse Wilson for (GeneralName name : sans) { 1252adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project int tag = name.getTag(); 12535c27fb80ffd335aa45dc8829ba3ecbc18c01e4e8Jesse Wilson for (int i = 0; i < map[tag].length; i++) { 12545c27fb80ffd335aa45dc8829ba3ecbc18c01e4e8Jesse Wilson if (subjectAltNames[tag].get(i).equals(name)) { 1255adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project if (!matchAllNames) { 1256adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project break PASSED; 1257adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 1258adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project map[tag][i] = true; 1259adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 1260adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 1261adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 1262adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project if (!matchAllNames) { 1263adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project // there was not any match 1264adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project return false; 1265adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 1266adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project // else check the map 1267adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project for (int tag=0; tag<9; tag++) { 1268adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project for (int name=0; name<map[tag].length; name++) { 1269adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project if (!map[tag][name]) { 1270adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project return false; 1271adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 1272adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 1273adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 1274adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } catch (IOException e) { 1275adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project e.printStackTrace(); 1276adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project return false; 1277adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 1278adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 1279adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project if (nameConstraints != null) { 1280adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project if (!nameConstraints.isAcceptable(cert)) { 1281adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project return false; 1282adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 1283adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 1284adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project if (policies != null) { 1285f33eae7e84eb6d3b0f4e86b59605bb3de73009f3Elliott Hughes byte[] bytes = getExtensionValue(cert, "2.5.29.32"); 1286adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project if (bytes == null) { 1287adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project return false; 1288adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 1289adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project if (policies.size() == 0) { 1290adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project // if certificate has such extension than it has at least 1291adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project // one policy in it. 1292adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project return true; 1293adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 1294adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project PASSED: 1295adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project try { 12965c27fb80ffd335aa45dc8829ba3ecbc18c01e4e8Jesse Wilson List<PolicyInformation> policyInformations 12975c27fb80ffd335aa45dc8829ba3ecbc18c01e4e8Jesse Wilson = ((CertificatePolicies) CertificatePolicies.ASN1.decode(bytes)) 1298adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project .getPolicyInformations(); 12995c27fb80ffd335aa45dc8829ba3ecbc18c01e4e8Jesse Wilson for (PolicyInformation policyInformation : policyInformations) { 13005c27fb80ffd335aa45dc8829ba3ecbc18c01e4e8Jesse Wilson if (policies.contains(policyInformation.getPolicyIdentifier())) { 1301adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project break PASSED; 1302adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 1303adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 1304adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project return false; 1305adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } catch (IOException e) { 1306adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project // the extension is invalid 1307adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project return false; 1308adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 1309adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 1310adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project if (pathToNames != null) { 1311f33eae7e84eb6d3b0f4e86b59605bb3de73009f3Elliott Hughes byte[] bytes = getExtensionValue(cert, "2.5.29.30"); 1312adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project if (bytes != null) { 1313adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project NameConstraints nameConstraints; 1314adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project try { 1315adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project nameConstraints = 1316adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project (NameConstraints) NameConstraints.ASN1.decode(bytes); 1317adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } catch (IOException e) { 1318adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project // the extension is invalid; 1319adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project return false; 1320adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 1321adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project if (!nameConstraints.isAcceptable(pathToNames)) { 1322adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project return false; 1323adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 1324adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 1325adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 1326adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project return true; 1327adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 1328adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project 1329adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project /** 1330adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * Clones this {@code X509CertSelector} instance. 13312f9e468ed4985edfd5e351faf2089d91e561e41dElliott Hughes * 1332adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * @return the cloned instance. 1333adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project */ 1334adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project public Object clone() { 13352f9e468ed4985edfd5e351faf2089d91e561e41dElliott Hughes X509CertSelector result; 13362f9e468ed4985edfd5e351faf2089d91e561e41dElliott Hughes 1337d21d78fd49a2d798218e8c8aefbddb26a0e71bbbElliott Hughes try { 1338d21d78fd49a2d798218e8c8aefbddb26a0e71bbbElliott Hughes result = (X509CertSelector) super.clone(); 1339d21d78fd49a2d798218e8c8aefbddb26a0e71bbbElliott Hughes } catch (CloneNotSupportedException e) { 1340d21d78fd49a2d798218e8c8aefbddb26a0e71bbbElliott Hughes return null; 1341d21d78fd49a2d798218e8c8aefbddb26a0e71bbbElliott Hughes } 13422f9e468ed4985edfd5e351faf2089d91e561e41dElliott Hughes 1343adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project if (this.subjectKeyIdentifier != null) { 1344adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project result.subjectKeyIdentifier = 1345adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project new byte[this.subjectKeyIdentifier.length]; 1346adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project System.arraycopy(this.subjectKeyIdentifier, 0, 1347adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project result.subjectKeyIdentifier, 0, 1348adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project this.subjectKeyIdentifier.length); 1349adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 1350adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project if (this.authorityKeyIdentifier != null) { 1351adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project result.authorityKeyIdentifier = 1352adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project new byte[this.authorityKeyIdentifier.length]; 1353adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project System.arraycopy(this.authorityKeyIdentifier, 0, 1354adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project result.authorityKeyIdentifier, 0, 1355adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project this.authorityKeyIdentifier.length); 1356adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 1357adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project if (this.subjectPublicKey != null) { 1358adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project result.subjectPublicKey = new byte[this.subjectPublicKey.length]; 1359adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project System.arraycopy(this.subjectPublicKey, 0, result.subjectPublicKey, 1360adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project 0, this.subjectPublicKey.length); 1361adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 1362adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project if (this.keyUsage != null) { 1363adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project result.keyUsage = new boolean[this.keyUsage.length]; 1364adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project System.arraycopy(this.keyUsage, 0, result.keyUsage, 0, 1365adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project this.keyUsage.length); 1366adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 1367adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project result.extendedKeyUsage = (this.extendedKeyUsage == null) 1368adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project ? null 13695c27fb80ffd335aa45dc8829ba3ecbc18c01e4e8Jesse Wilson : new HashSet<String>(this.extendedKeyUsage); 1370adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project if (this.subjectAltNames != null) { 1371adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project result.subjectAltNames = new ArrayList[9]; 1372adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project for (int i=0; i<9; i++) { 1373adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project if (this.subjectAltNames[i] != null) { 1374adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project result.subjectAltNames[i] = 13755c27fb80ffd335aa45dc8829ba3ecbc18c01e4e8Jesse Wilson new ArrayList<GeneralName>(this.subjectAltNames[i]); 1376adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 1377adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 1378adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 1379866e7ae17a3da81a02b0b144e0c9c2b3196d293aElliott Hughes result.policies = (this.policies == null) ? null : new HashSet<String>(this.policies); 1380adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project result.pathToNames = (this.pathToNames == null) 1381adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project ? null 13825c27fb80ffd335aa45dc8829ba3ecbc18c01e4e8Jesse Wilson : new ArrayList<GeneralName>(this.pathToNames); 1383adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project return result; 1384adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 1385adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project} 1386