X509CertSelector.java revision 897538a36c18f4db8f9f68ee566aec0bda842e9f
1adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project/* 2adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * Licensed to the Apache Software Foundation (ASF) under one or more 3adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * contributor license agreements. See the NOTICE file distributed with 4adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * this work for additional information regarding copyright ownership. 5adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * The ASF licenses this file to You under the Apache License, Version 2.0 6adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * (the "License"); you may not use this file except in compliance with 7adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * the License. You may obtain a copy of the License at 8adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * 9adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * http://www.apache.org/licenses/LICENSE-2.0 10adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * 11adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * Unless required by applicable law or agreed to in writing, software 12adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * distributed under the License is distributed on an "AS IS" BASIS, 13adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 14adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * See the License for the specific language governing permissions and 15adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * limitations under the License. 16adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project */ 17adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project 18adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Projectpackage java.security.cert; 19adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project 20adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Projectimport java.io.IOException; 21adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Projectimport java.math.BigInteger; 22adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Projectimport java.security.PublicKey; 23adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Projectimport java.security.cert.CertSelector; 24adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Projectimport java.security.cert.X509Certificate; 25adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Projectimport java.util.ArrayList; 26adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Projectimport java.util.Arrays; 27adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Projectimport java.util.Collection; 28adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Projectimport java.util.Collections; 29adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Projectimport java.util.Date; 30adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Projectimport java.util.HashSet; 31adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Projectimport java.util.Iterator; 32adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Projectimport java.util.List; 33adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Projectimport java.util.Set; 34adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Projectimport javax.security.auth.x500.X500Principal; 35adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project 36adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Projectimport org.apache.harmony.security.asn1.ASN1OctetString; 37adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Projectimport org.apache.harmony.security.x509.AlgorithmIdentifier; 38adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Projectimport org.apache.harmony.security.x509.CertificatePolicies; 39adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Projectimport org.apache.harmony.security.x509.GeneralName; 40adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Projectimport org.apache.harmony.security.x509.GeneralNames; 41adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Projectimport org.apache.harmony.security.x509.NameConstraints; 42adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Projectimport org.apache.harmony.security.x509.PolicyInformation; 43adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Projectimport org.apache.harmony.security.x509.PrivateKeyUsagePeriod; 44adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Projectimport org.apache.harmony.security.x509.SubjectPublicKeyInfo; 45adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project 46adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project 47adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project 48adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project/** 49adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * A certificate selector ({@code CertSelector} for selecting {@code 50adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * X509Certificate}s that match the specified criteria. 51adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project */ 52adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Projectpublic class X509CertSelector implements CertSelector { 53adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project 54adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project // match criteria 55adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project private X509Certificate certificateEquals; 56adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project private BigInteger serialNumber; 57adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project private X500Principal issuer; 58adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project private X500Principal subject; 59adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project private byte[] subjectKeyIdentifier; 60adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project private byte[] authorityKeyIdentifier; 61adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project private Date certificateValid; 62adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project private String subjectPublicKeyAlgID; 63adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project private Date privateKeyValid; 64adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project private byte[] subjectPublicKey; 65adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project private boolean[] keyUsage; 66adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project private Set extendedKeyUsage; 67adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project private boolean matchAllNames = true; 68adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project private int pathLen = -1; 69adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project private List[] subjectAltNames; 70adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project private NameConstraints nameConstraints; 71adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project private Set policies; 72adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project private ArrayList pathToNames; 73adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project 74adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project // needed to avoid needless encoding/decoding work 75adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project private PublicKey subjectPublicKeyImpl; 76adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project private String issuerName; 77adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project private byte[] issuerBytes; 78adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project 79adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project /** 80adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * Creates a new {@code X509CertSelector}. 81adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project */ 82adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project public X509CertSelector() {} 83adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project 84adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project /** 85adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * Sets the certificate that a matching certificate must be equal to. 862f9e468ed4985edfd5e351faf2089d91e561e41dElliott Hughes * 87adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * @param certificate 88adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * the certificate to match, or null to not check this criteria. 89adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project */ 90adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project public void setCertificate(X509Certificate certificate) { 91adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project certificateEquals = certificate; 92adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 93adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project 94adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project /** 95adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * Returns the certificate that a matching certificate must be equal to. 962f9e468ed4985edfd5e351faf2089d91e561e41dElliott Hughes * 97adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * @return the certificate to match, or null if this criteria is not 98adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * checked. 99adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project */ 100adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project public X509Certificate getCertificate() { 101adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project return certificateEquals; 102adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 103adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project 104adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project /** 105adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * Sets the serial number that a certificate must match. 1062f9e468ed4985edfd5e351faf2089d91e561e41dElliott Hughes * 107adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * @param serialNumber 108adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * the serial number to match, or {@code null} to not check the 109adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * serial number. 110adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project */ 111adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project public void setSerialNumber(BigInteger serialNumber) { 112adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project this.serialNumber = serialNumber; 113adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 114adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project 115adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project /** 116adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * Returns the serial number that a certificate must match. 1172f9e468ed4985edfd5e351faf2089d91e561e41dElliott Hughes * 118adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * @return the serial number to match, or {@code null} if the serial number 119adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * is not to be checked. 120adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project */ 121adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project public BigInteger getSerialNumber() { 122adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project return serialNumber; 123adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 124adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project 125adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project /** 126adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * Sets the issuer that a certificate must match. 1272f9e468ed4985edfd5e351faf2089d91e561e41dElliott Hughes * 128adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * @param issuer 129adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * the issuer to match, or {@code null} if the issuer is not to 130adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * be checked. 131adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project */ 132adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project public void setIssuer(X500Principal issuer) { 133adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project this.issuer = issuer; 134adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project this.issuerName = null; 135adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project this.issuerBytes = null; 136adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 137adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project 138adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project /** 139adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * Returns the issuer that a certificate must match. 1402f9e468ed4985edfd5e351faf2089d91e561e41dElliott Hughes * 141adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * @return the issuer that a certificate must match, or {@code null} if the 142adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * issuer is not to be checked. 143adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project */ 144adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project public X500Principal getIssuer() { 145adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project return issuer; 146adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 147adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project 148adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project /** 149adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * <b>Do not use</b>, use {@link #getIssuer()} or 150adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * {@link #getIssuerAsBytes()} instead. Sets the issuer that a certificate 151adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * must match. 1522f9e468ed4985edfd5e351faf2089d91e561e41dElliott Hughes * 153adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * @param issuerName 154adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * the issuer in a RFC 2253 format string, or {@code null} to not 155adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * check the issuer. 156adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * @throws IOException 157adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * if parsing the issuer fails. 158adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project */ 159adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project public void setIssuer(String issuerName) throws IOException { 160adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project if (issuerName == null) { 161adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project this.issuer = null; 162adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project this.issuerName = null; 163adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project this.issuerBytes = null; 164adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project return; 165adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 166adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project try { 167adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project this.issuer = new X500Principal(issuerName); 168adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project this.issuerName = issuerName; 169adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project this.issuerBytes = null; 170adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } catch (IllegalArgumentException e) { 171adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project throw new IOException(e.getMessage()); 172adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 173adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 174adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project 175adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project /** 176adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * <b>Do not use</b>, use {@link #getIssuer()} or 177adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * {@link #getIssuerAsBytes()} instead. Returns the issuer that a 178adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * certificate must match in a RFC 2253 format string. 1792f9e468ed4985edfd5e351faf2089d91e561e41dElliott Hughes * 180adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * @return the issuer in a RFC 2253 format string, or {@code null} if the 181adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * issuer is not to be checked. 182adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project */ 183adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project public String getIssuerAsString() { 184adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project if (issuer == null) { 185adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project return null; 186adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 187adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project if (issuerName == null) { 188adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project issuerName = issuer.getName(); 189adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 190adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project return issuerName; 191adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 192adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project 193adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project /** 194adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * Sets the issuer that a certificate must match. 1952f9e468ed4985edfd5e351faf2089d91e561e41dElliott Hughes * 196adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * @param issuerDN 197adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * the distinguished issuer name in ASN.1 DER encoded format, or 198adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * {@code null} to not check the issuer. 199adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * @throws IOException 200adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * if decoding the issuer fail. 201adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project */ 202adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project public void setIssuer(byte[] issuerDN) throws IOException { 203adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project if (issuerDN == null) { 204adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project issuer = null; 205adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project return; 206adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 207adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project try { 208adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project issuer = new X500Principal(issuerDN); 209adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project this.issuerName = null; 210adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project this.issuerBytes = new byte[issuerDN.length]; 211adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project System.arraycopy(issuerDN, 0, this.issuerBytes, 0, issuerDN.length); 212adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } catch (IllegalArgumentException e) { 213adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project throw new IOException(e.getMessage()); 214adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 215adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 216adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project 217adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project /** 218adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * Returns the issuer that a certificate must match. 2192f9e468ed4985edfd5e351faf2089d91e561e41dElliott Hughes * 220adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * @return the distinguished issuer name in ASN.1 DER encoded format, or 221adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * {@code null} if the issuer is not to be checked. 222adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * @throws IOException 223adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * if encoding the issuer fails. 224adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project */ 225adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project public byte[] getIssuerAsBytes() throws IOException { 226adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project if (issuer == null) { 227adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project return null; 228adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 229adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project if (issuerBytes == null) { 230adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project issuerBytes = issuer.getEncoded(); 231adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 232adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project byte[] result = new byte[issuerBytes.length]; 233adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project System.arraycopy(issuerBytes, 0, result, 0, issuerBytes.length); 234adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project return result; 235adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 236adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project 237adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project /** 238adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * Set the subject that a certificate must match. 2392f9e468ed4985edfd5e351faf2089d91e561e41dElliott Hughes * 240adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * @param subject 241adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * the subject distinguished name or {@code null} to not check 242adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * the subject. 243adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project */ 244adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project public void setSubject(X500Principal subject) { 245adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project this.subject = subject; 246adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 247adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project 248adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project /** 249adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * Returns the subject that a certificate must match. 2502f9e468ed4985edfd5e351faf2089d91e561e41dElliott Hughes * 251adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * @return the subject distinguished name, or null if the subject is not to 252adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * be checked. 253adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project */ 254adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project public X500Principal getSubject() { 255adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project return subject; 256adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 257adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project 258adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project /** 259adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * <b>Do not use</b>, use {@link #setSubject(byte[])} or 260adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * {@link #setSubject(X500Principal)} instead. Returns the subject that a 261adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * certificate must match. 2622f9e468ed4985edfd5e351faf2089d91e561e41dElliott Hughes * 263adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * @param subjectDN 264adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * the subject distinguished name in RFC 2253 format or {@code 265adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * null} to not check the subject. 266adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * @throws IOException 267adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * if decoding the subject fails. 268adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project */ 269adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project public void setSubject(String subjectDN) throws IOException { 270adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project if (subjectDN == null) { 271adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project subject = null; 272adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project return; 273adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 274adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project try { 275adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project subject = new X500Principal(subjectDN); 276adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } catch (IllegalArgumentException e) { 277adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project throw new IOException(e.getMessage()); 278adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 279adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 280adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project 281adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project /** 282adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * <b>Do not use</b>, use {@link #getSubject()} or 283adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * {@link #getSubjectAsBytes()} instead. Returns the subject that a 284adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * certificate must match. 2852f9e468ed4985edfd5e351faf2089d91e561e41dElliott Hughes * 286adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * @return the subject distinguished name in RFC 2253 format, or {@code 287adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * null} if the subject is not to be checked. 288adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project */ 289adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project public String getSubjectAsString() { 290adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project if (subject == null) { 291adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project return null; 292adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 293adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project return subject.getName(); 294adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 295adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project 296adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project /** 297adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * Sets the subject that a certificate must match. 2982f9e468ed4985edfd5e351faf2089d91e561e41dElliott Hughes * 299adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * @param subjectDN 300adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * the subject distinguished name in ASN.1 DER format, or {@code 301adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * null} to not check the subject. 302adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * @throws IOException 303adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * if decoding the subject fails. 304adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project */ 305adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project public void setSubject(byte[] subjectDN) throws IOException { 306adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project if (subjectDN == null) { 307adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project subject = null; 308adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project return; 309adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 310adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project try { 311adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project subject = new X500Principal(subjectDN); 312adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } catch (IllegalArgumentException e) { 313adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project throw new IOException(e.getMessage()); 314adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 315adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 316adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project 317adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project /** 318adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * Returns the subject that a certificate must match. 3192f9e468ed4985edfd5e351faf2089d91e561e41dElliott Hughes * 320adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * @return the subject distinguished name in ASN.1 DER format, or {@code 321adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * null} if the subject is not to be checked. 322adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * @throws IOException 323adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * if encoding the subject fails. 324adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project */ 325adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project public byte[] getSubjectAsBytes() throws IOException { 326adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project if (subject == null) { 327adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project return null; 328adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 329adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project return subject.getEncoded(); 330adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 331adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project 332adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project /** 333adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * Sets the criterion for the {@literal SubjectKeyIdentifier} extension. 334adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * <p> 335adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * The {@code subjectKeyIdentifier} should be a single DER encoded value. 3362f9e468ed4985edfd5e351faf2089d91e561e41dElliott Hughes * 337adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * @param subjectKeyIdentifier 338adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * the subject key identifier or {@code null} to disable this 339adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * check. 340adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project */ 341adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project public void setSubjectKeyIdentifier(byte[] subjectKeyIdentifier) { 342adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project if (subjectKeyIdentifier == null) { 343adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project this.subjectKeyIdentifier = null; 344adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project return; 345adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 346adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project this.subjectKeyIdentifier = new byte[subjectKeyIdentifier.length]; 347adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project System.arraycopy(subjectKeyIdentifier, 0, this.subjectKeyIdentifier, 0, 348adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project subjectKeyIdentifier.length); 349adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 350adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project 351adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project /** 352adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * Returns the criterion for the {@literal SubjectKeyIdentifier} extension. 3532f9e468ed4985edfd5e351faf2089d91e561e41dElliott Hughes * 354adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * @return the subject key identifier or {@code null} if it is not to be 355adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * checked. 356adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project */ 357adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project public byte[] getSubjectKeyIdentifier() { 358adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project if (subjectKeyIdentifier == null) { 359adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project return null; 360adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 361adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project byte[] res = new byte[subjectKeyIdentifier.length]; 362adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project System.arraycopy(subjectKeyIdentifier, 0, res, 0, res.length); 363adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project return res; 364adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 365adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project 366adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project /** 367adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * Sets the criterion for the {@literal AuthorityKeyIdentifier} extension. 3682f9e468ed4985edfd5e351faf2089d91e561e41dElliott Hughes * 369adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * @param authorityKeyIdentifier 370adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * the authority key identifier, or {@code null} to disable this 371adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * check. 372adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project */ 373adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project public void setAuthorityKeyIdentifier(byte[] authorityKeyIdentifier) { 374adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project if (authorityKeyIdentifier == null) { 375adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project this.authorityKeyIdentifier = null; 376adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project return; 377adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 378adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project this.authorityKeyIdentifier = new byte[authorityKeyIdentifier.length]; 379adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project System.arraycopy(authorityKeyIdentifier, 0, 380adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project this.authorityKeyIdentifier, 0, 381adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project authorityKeyIdentifier.length); 382adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 383adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project 384adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project /** 385adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * Returns the criterion for the {@literal AuthorityKeyIdentifier} 386adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * extension. 3872f9e468ed4985edfd5e351faf2089d91e561e41dElliott Hughes * 388adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * @return the authority key identifier, or {@code null} if it is not to be 389adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * checked. 390adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project */ 391adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project public byte[] getAuthorityKeyIdentifier() { 392adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project if (authorityKeyIdentifier == null) { 393adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project return null; 394adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 395adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project byte[] res = new byte[authorityKeyIdentifier.length]; 396adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project System.arraycopy(authorityKeyIdentifier, 0, res, 0, res.length); 397adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project return res; 398adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 399adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project 400adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project /** 401adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * Sets the criterion for the validity date of the certificate. 402adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * <p> 403adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * The certificate must be valid at the specified date. 404adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * @param certificateValid 405adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * the validity date or {@code null} to not check the date. 406adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project */ 407adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project public void setCertificateValid(Date certificateValid) { 408adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project this.certificateValid = (certificateValid == null) 409adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project ? null 410adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project : (Date) certificateValid.clone(); 411adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 412adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project 413adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project /** 414adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * Returns the criterion for the validity date of the certificate. 4152f9e468ed4985edfd5e351faf2089d91e561e41dElliott Hughes * 416adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * @return the validity date or {@code null} if the date is not to be 417adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * checked. 418adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project */ 419adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project public Date getCertificateValid() { 420adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project return (certificateValid == null) 421adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project ? null 422adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project : (Date) certificateValid.clone(); 423adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 424adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project 425adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project /** 426adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * Sets the criterion for the validity date of the private key. 427adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * <p> 428adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * The private key must be valid at the specified date. 4292f9e468ed4985edfd5e351faf2089d91e561e41dElliott Hughes * 430adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * @param privateKeyValid 431adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * the validity date or {@code null} to not check the date. 432adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project */ 433adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project public void setPrivateKeyValid(Date privateKeyValid) { 434adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project if (privateKeyValid == null) { 435adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project this.privateKeyValid = null; 436adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project return; 437adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 438adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project this.privateKeyValid = (Date) privateKeyValid.clone(); 439adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 440adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project 441adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project /** 442adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * Returns the criterion for the validity date of the private key. 443adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * <p> 444adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * The private key must be valid at the specified date. 4452f9e468ed4985edfd5e351faf2089d91e561e41dElliott Hughes * 446adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * @return the validity date or {@code null} if the date is not to be 447adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * checked. 448adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project */ 449adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project public Date getPrivateKeyValid() { 450adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project if (privateKeyValid != null) { 451adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project return (Date) privateKeyValid.clone(); 452adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 453adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project return null; 454adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 455adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project 456adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project private void checkOID(String oid) throws IOException { 457adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project int beg = 0; 458adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project int end = oid.indexOf('.', beg); 459adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project try { 460adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project int comp = Integer.parseInt(oid.substring(beg, end)); 461adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project beg = end + 1; 462adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project if ((comp < 0) || (comp > 2)) { 463897538a36c18f4db8f9f68ee566aec0bda842e9fElliott Hughes throw new IOException("Bad OID: " + oid); 464adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 465adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project end = oid.indexOf('.', beg); 466adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project comp = Integer.parseInt(oid.substring(beg, end)); 467adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project if ((comp < 0) || (comp > 39)) { 468897538a36c18f4db8f9f68ee566aec0bda842e9fElliott Hughes throw new IOException("Bad OID: " + oid); 469adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 470adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } catch (IndexOutOfBoundsException e) { 471897538a36c18f4db8f9f68ee566aec0bda842e9fElliott Hughes throw new IOException("Bad OID: " + oid); 472adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } catch (NumberFormatException e) { 473897538a36c18f4db8f9f68ee566aec0bda842e9fElliott Hughes throw new IOException("Bad OID: " + oid); 474adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 475adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 476adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project 477adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project /** 478adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * Sets the criterion for the subject public key signature algorithm. 479adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * <p> 480adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * The certificate must contain a subject public key with the algorithm 481adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * specified. 4822f9e468ed4985edfd5e351faf2089d91e561e41dElliott Hughes * 483adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * @param oid 484adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * the OID (object identifier) of the signature algorithm or 485adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * {@code null} to not check the OID. 486adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * @throws IOException 487adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * if the specified object identifier is invalid. 488adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project */ 489adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project public void setSubjectPublicKeyAlgID(String oid) throws IOException { 490adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project if (oid == null) { 491adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project subjectPublicKeyAlgID = null; 492adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project return; 493adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 494adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project checkOID(oid); 495adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project subjectPublicKeyAlgID = oid; 496adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 497adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project 498adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project /** 499adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * Returns the criterion for the subject public key signature algorithm. 5002f9e468ed4985edfd5e351faf2089d91e561e41dElliott Hughes * 501adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * @return the OID (object identifier) or the signature algorithm or {@code 502adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * null} if it's not to be checked. 503adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project */ 504adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project public String getSubjectPublicKeyAlgID() { 505adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project return subjectPublicKeyAlgID; 506adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 507adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project 508adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project /** 509adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * Sets the criterion for the subject public key. 5102f9e468ed4985edfd5e351faf2089d91e561e41dElliott Hughes * 511adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * @param key 512adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * the subject public key or {@code null} to not check the key. 513adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project */ 514adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project public void setSubjectPublicKey(PublicKey key) { 515adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project subjectPublicKey = (key == null) ? null : key.getEncoded(); 516adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project subjectPublicKeyImpl = key; 517adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 518adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project 519adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project /** 520adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * Sets the criterion for the subject public key. 5212f9e468ed4985edfd5e351faf2089d91e561e41dElliott Hughes * 522adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * @param key 523adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * the subject public key in ASN.1 DER encoded format or {@code null} to 524adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * not check the key. 525adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * @throws IOException 526adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * if decoding the the public key fails. 527adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project */ 528adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project public void setSubjectPublicKey(byte[] key) throws IOException { 529adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project if (key == null) { 530adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project subjectPublicKey = null; 531adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project subjectPublicKeyImpl = null; 532adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project return; 533adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 534adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project subjectPublicKey = new byte[key.length]; 535adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project System.arraycopy(key, 0, subjectPublicKey, 0, key.length); 536f33eae7e84eb6d3b0f4e86b59605bb3de73009f3Elliott Hughes subjectPublicKeyImpl = 537adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project ((SubjectPublicKeyInfo) SubjectPublicKeyInfo.ASN1.decode(key)) 538adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project .getPublicKey(); 539adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 540adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project 541adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project /** 542adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * Returns the criterion for the subject public key. 5432f9e468ed4985edfd5e351faf2089d91e561e41dElliott Hughes * 544adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * @return the subject public key or {@code null} if the key is not to be 545adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * checked. 546adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project */ 547adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project public PublicKey getSubjectPublicKey() { 548adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project return subjectPublicKeyImpl; 549adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 550adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project 551adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project /** 552adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * Sets the criterion for the {@literal KeyUsage} extension. 5532f9e468ed4985edfd5e351faf2089d91e561e41dElliott Hughes * 554adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * @param keyUsage 555adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * the boolean array in the format as returned by 556adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * {@link X509Certificate#getKeyUsage()}, or {@code null} to not 557adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * check the key usage. 558adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project */ 559adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project public void setKeyUsage(boolean[] keyUsage) { 560adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project if (keyUsage == null) { 561adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project this.keyUsage = null; 562adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project return; 563adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 564adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project this.keyUsage = new boolean[keyUsage.length]; 565adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project System.arraycopy(keyUsage, 0, this.keyUsage, 0, keyUsage.length); 566adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 567adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project 568adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project /** 569adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * Returns the criterion for the {@literal KeyUsage} extension. 5702f9e468ed4985edfd5e351faf2089d91e561e41dElliott Hughes * 571adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * @return the boolean array in the format as returned by 572adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * {@link X509Certificate#getKeyUsage()}, or {@code null} if the key 573adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * usage is not to be checked. 574adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project */ 575adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project public boolean[] getKeyUsage() { 576adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project if (keyUsage == null) { 577adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project return null; 578adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 579adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project boolean[] result = new boolean[keyUsage.length]; 580adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project System.arraycopy(keyUsage, 0, result, 0, keyUsage.length); 581adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project return result; 582adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 583adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project 584adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project /** 585adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * Sets the criterion for the {@literal ExtendedKeyUsage} extension. 5862f9e468ed4985edfd5e351faf2089d91e561e41dElliott Hughes * 587adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * @param keyUsage 588adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * the set of key usage OIDs, or {@code null} to not check it. 589adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * @throws IOException 590adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * if one of the OIDs is invalid. 591adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project */ 592adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project public void setExtendedKeyUsage(Set<String> keyUsage) 593adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project throws IOException { 594adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project extendedKeyUsage = null; 595adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project if ((keyUsage == null) || (keyUsage.size() == 0)) { 596adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project return; 597adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 598adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project HashSet key_u = new HashSet(); 599adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project Iterator it = keyUsage.iterator(); 600adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project while (it.hasNext()) { 601adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project String usage = (String) it.next(); 602adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project checkOID(usage); 603adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project key_u.add(usage); 604adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 605adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project extendedKeyUsage = Collections.unmodifiableSet(key_u); 606adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 607adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project 608adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project /** 609adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * Returns the criterion for the {@literal ExtendedKeyUsage} extension. 6102f9e468ed4985edfd5e351faf2089d91e561e41dElliott Hughes * 611adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * @return the set of key usage OIDs, or {@code null} if it's not to be 612adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * checked. 613adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project */ 614adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project public Set<String> getExtendedKeyUsage() { 615adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project return extendedKeyUsage; 616adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 617adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project 618adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project /** 619adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * Sets the flag for the matching behavior for subject alternative names. 620adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * <p> 621adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * The flag indicates whether a certificate must contain all or at least one 6222f9e468ed4985edfd5e351faf2089d91e561e41dElliott Hughes * of the subject alternative names specified by {@link 6232f9e468ed4985edfd5e351faf2089d91e561e41dElliott Hughes * #setSubjectAlternativeNames} or {@link #addSubjectAlternativeName}. 6242f9e468ed4985edfd5e351faf2089d91e561e41dElliott Hughes * 625adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * @param matchAllNames 626adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * {@code true} if a certificate must contain all of the 627adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * specified subject alternative names, otherwise {@code false}. 628adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project */ 629adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project public void setMatchAllSubjectAltNames(boolean matchAllNames) { 630adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project this.matchAllNames = matchAllNames; 631adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 632adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project 633adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project /** 634adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * Returns the flag for the matching behavior for subject alternative names. 635adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * <p> 636adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * The flag indicates whether a certificate must contain all or at least one 6372f9e468ed4985edfd5e351faf2089d91e561e41dElliott Hughes * of the subject alternative names specified by {@link 6382f9e468ed4985edfd5e351faf2089d91e561e41dElliott Hughes * #setSubjectAlternativeNames} or {@link #addSubjectAlternativeName}. 6392f9e468ed4985edfd5e351faf2089d91e561e41dElliott Hughes * 640adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * @return {@code true} if a certificate must contain all of the specified 641adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * subject alternative names, otherwise {@code false}. 642adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project */ 643adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project public boolean getMatchAllSubjectAltNames() { 644adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project return matchAllNames; 645adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 646adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project 647adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project /** 648adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * Sets the criterion for subject alternative names. 649adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * <p> 650adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * the certificate must contain all or at least one of the specified subject 651adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * alternative names. The behavior is specified by 652adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * {@link #getMatchAllSubjectAltNames}. 653adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * <p> 654adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * The specified parameter {@code names} is a collection with an entry for 655adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * each name to be included in the criterion. The name is specified as a 656adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * {@code List}, the first entry must be an {@code Integer} specifying the 657adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * name type (0-8), the second entry must be a {@code String} or a byte 658adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * array specifying the name (in string or ASN.1 DER encoded form) 6592f9e468ed4985edfd5e351faf2089d91e561e41dElliott Hughes * 660adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * @param names 661adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * the names collection or {@code null} to not perform this check. 662adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * @throws IOException 663adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * if the decoding of a name fails. 664adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project */ 665adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project public void setSubjectAlternativeNames(Collection<List<?>> names) 666adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project throws IOException { 667adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project subjectAltNames = null; 668adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project if ((names == null) || (names.size() == 0)) { 669adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project return; 670adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 671adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project Iterator it = names.iterator(); 672adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project while (it.hasNext()) { 673adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project List name = (List) it.next(); 674adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project int tag = ((Integer) name.get(0)).intValue(); 675adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project Object value = name.get(1); 676adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project if (value instanceof String) { 677adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project addSubjectAlternativeName(tag, (String) value); 678adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } else if (value instanceof byte[]) { 679adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project addSubjectAlternativeName(tag, (byte[]) value); 680adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } else { 681897538a36c18f4db8f9f68ee566aec0bda842e9fElliott Hughes throw new IOException("name neither a String nor a byte[]"); 682adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 683adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 684adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 685adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project 686adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project /** 687adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * Adds a subject alternative name to the respective criterion. 6882f9e468ed4985edfd5e351faf2089d91e561e41dElliott Hughes * 689adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * @param tag 690adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * the type of the name 691adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * @param name 692adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * the name in string format. 693adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * @throws IOException 694adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * if parsing the name fails. 695adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project */ 696adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project public void addSubjectAlternativeName(int tag, String name) 697adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project throws IOException { 698adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project GeneralName alt_name = new GeneralName(tag, name); 699adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project // create only if there was not any errors 700adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project if (subjectAltNames == null) { 701adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project subjectAltNames = new ArrayList[9]; 702adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 703adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project if (subjectAltNames[tag] == null) { 704adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project subjectAltNames[tag] = new ArrayList(); 705adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 706adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project subjectAltNames[tag].add(alt_name); 707adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 708adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project 709adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project /** 710adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * Adds a subject alternative name to the respective criterion. 7112f9e468ed4985edfd5e351faf2089d91e561e41dElliott Hughes * 712adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * @param tag 713adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * the type of the name. 714adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * @param name 715adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * the name in ASN.1 DER encoded form. 716adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * @throws IOException 717adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * if the decoding of the name fails. 718adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project */ 719adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project public void addSubjectAlternativeName(int tag, byte[] name) 720adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project throws IOException { 721adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project GeneralName alt_name = new GeneralName(tag, name); 722adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project // create only if there was not any errors 723adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project if (subjectAltNames == null) { 724adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project subjectAltNames = new ArrayList[9]; 725adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 726adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project if (subjectAltNames[tag] == null) { 727adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project subjectAltNames[tag] = new ArrayList(); 728adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 729adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project subjectAltNames[tag].add(alt_name); 730adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 731adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project 732adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project /** 733adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * Returns the criterion for subject alternative names. 734adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * <p> 735adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * the certificate must contain all or at least one of the specified subject 736adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * alternative names. The behavior is specified by 737adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * {@link #getMatchAllSubjectAltNames}. 738adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * <p> 739adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * The subject alternative names is a collection with an entry for each name 740adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * included in the criterion. The name is specified as a {@code List}, the 741adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * first entry is an {@code Integer} specifying the name type (0-8), the 742adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * second entry is byte array specifying the name in ASN.1 DER encoded form) 7432f9e468ed4985edfd5e351faf2089d91e561e41dElliott Hughes * 744adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * @return the names collection or {@code null} if none specified. 745adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project */ 746adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project public Collection<List<?>> getSubjectAlternativeNames() { 747adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project if (subjectAltNames == null) { 748adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project return null; 749adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 750adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project ArrayList result = new ArrayList(); 751adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project for (int tag=0; tag<9; tag++) { 752adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project if (subjectAltNames[tag] != null) { 753adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project for (int name=0; name<subjectAltNames[tag].size(); name++) { 754adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project Object neim = subjectAltNames[tag].get(name); 755adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project if (neim instanceof byte[]) { 756adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project byte[] arr_neim = (byte[]) neim; 757adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project neim = new byte[arr_neim.length]; 758adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project System.arraycopy(arr_neim, 0, neim, 0, arr_neim.length); 759adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 760adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project List list = new ArrayList(2); 761a0a4196cb15480959f053d0ebe6b412bd23c8170Elliott Hughes list.add(Integer.valueOf(tag)); // android-changed 762adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project list.add(neim); 763adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project result.add(list); 764adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 765adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 766adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 767adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project return result; 768adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 769adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project 770adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project /** 771adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * Sets the criterion for the name constraints. 772adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * <p> 773adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * The certificate must constraint subject and subject alternative names 774adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * that match the specified name constraints. 775adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * <p> 776adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * The name constraints in ASN.1: 7772f9e468ed4985edfd5e351faf2089d91e561e41dElliott Hughes * 778adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * <pre> 779adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * NameConstraints ::= SEQUENCE { 780adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * permittedSubtrees [0] GeneralSubtrees OPTIONAL, 781adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * excludedSubtrees [1] GeneralSubtrees OPTIONAL } 7822f9e468ed4985edfd5e351faf2089d91e561e41dElliott Hughes * 783adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * GeneralSubtrees ::= SEQUENCE SIZE (1..MAX) OF GeneralSubtree 7842f9e468ed4985edfd5e351faf2089d91e561e41dElliott Hughes * 785adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * GeneralSubtree ::= SEQUENCE { 786adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * base GeneralName, 787adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * minimum [0] BaseDistance DEFAULT 0, 788adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * maximum [1] BaseDistance OPTIONAL } 7892f9e468ed4985edfd5e351faf2089d91e561e41dElliott Hughes * 790adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * BaseDistance ::= INTEGER (0..MAX) 7912f9e468ed4985edfd5e351faf2089d91e561e41dElliott Hughes * 792adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * GeneralName ::= CHOICE { 793adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * otherName [0] OtherName, 794adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * rfc822Name [1] IA5String, 795adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * dNSName [2] IA5String, 796adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * x400Address [3] ORAddress, 797adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * directoryName [4] Name, 798adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * ediPartyName [5] EDIPartyName, 799adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * uniformResourceIdentifier [6] IA5String, 800adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * iPAddress [7] OCTET STRING, 801adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * registeredID [8] OBJECT IDENTIFIER} 8022f9e468ed4985edfd5e351faf2089d91e561e41dElliott Hughes * 803adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * </pre> 8042f9e468ed4985edfd5e351faf2089d91e561e41dElliott Hughes * 805adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * @param bytes 806adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * the name constraints in ASN.1 DER encoded format, or null to 807adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * not check any constraints. 808adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * @throws IOException 809adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * if decoding the name constraints fail. 810adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project */ 811adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project public void setNameConstraints(byte[] bytes) throws IOException { 812adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project this.nameConstraints = (bytes == null) 813adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project ? null 814adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project : (NameConstraints) NameConstraints.ASN1.decode(bytes); 815adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 816adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project 817adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project /** 818adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * Returns the criterion for the name constraints. 8192f9e468ed4985edfd5e351faf2089d91e561e41dElliott Hughes * 820adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * @return the name constraints or {@code null} if none specified. 821adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * @see #setNameConstraints 822adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project */ 823adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project public byte[] getNameConstraints() { 824adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project return (nameConstraints == null) 825adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project ? null 826adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project : nameConstraints.getEncoded(); 827adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 828adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project 829adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project /** 830adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * Sets the criterion for the basic constraints extension. 831adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * <p> 832adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * A value greater than or equal to zero indicates that a certificate must 833adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * include a basic constraints extension with a path length of a least that 834adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * value. A value of {@code -2} indicates that only end-entity certificates 835adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * are accepted. A value of {@code -1} indicates that no check is done. 8362f9e468ed4985edfd5e351faf2089d91e561e41dElliott Hughes * 837adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * @param pathLen 838adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * the value specifying the criterion. 839adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * @throws IllegalArgumentException 840adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * if {@code pathLen} is less than {@code -2}. 841adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project */ 842adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project public void setBasicConstraints(int pathLen) { 843adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project if (pathLen < -2) { 844897538a36c18f4db8f9f68ee566aec0bda842e9fElliott Hughes throw new IllegalArgumentException("pathLen < -2"); 845adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 846adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project this.pathLen = pathLen; 847adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 848adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project 849adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project /** 850adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * Returns the criterion for the basic constraints extension. 851adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * <p> 852adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * A value greater than or equal to zero indicates that a certificate must 853adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * include a basic constraints extension with a path length of a least that 854adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * value. A value of {@code -2} indicates that only end-entity certificates 855adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * are accepted. A value of {@code -1} indicates that no check is done. 8562f9e468ed4985edfd5e351faf2089d91e561e41dElliott Hughes * 857adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * @return the value of the criterion. 858adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project */ 859adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project public int getBasicConstraints() { 860adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project return pathLen; 861adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 862adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project 863adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project /** 864adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * Sets the criterion for the policy constraint. 865adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * <p> 866adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * The certificate must have at least one of the specified certificate 867adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * policy extensions. For an empty set the certificate must have at least 868adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * some policies in its policy extension. 8692f9e468ed4985edfd5e351faf2089d91e561e41dElliott Hughes * 870adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * @param policies 871adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * the certificate policy OIDs, an empty set, or {@code null} to 872adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * not perform this check. 873adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * @throws IOException 874adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * if parsing the specified OIDs fails. 875adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project */ 876adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project public void setPolicy(Set<String> policies) throws IOException { 877adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project if (policies == null) { 878adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project this.policies = null; 879adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project return; 880adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 881adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project HashSet pols = new HashSet(policies.size()); 882adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project Iterator it = policies.iterator(); 883adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project while (it.hasNext()) { 884adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project String certPolicyId = (String) it.next(); 885adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project checkOID(certPolicyId); 886adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project pols.add(certPolicyId); 887adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 888adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project this.policies = Collections.unmodifiableSet(pols); 889adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 890adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project 891adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project /** 892adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * Returns the criterion for the policy constraint. 893adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * <p> 894adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * The certificate must have at least one of the certificate policy 895adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * extensions. For an empty set the certificate must have at least some 896adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * policies in its policy extension. 8972f9e468ed4985edfd5e351faf2089d91e561e41dElliott Hughes * 898adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * @return the certificate policy OIDs, an empty set, or {@code null} if not 899adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * to be checked. 900adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project */ 901adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project public Set<String> getPolicy() { 902adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project return policies; 903adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 904adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project 905adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project /** 906adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * Sets the criterion for the pathToNames constraint. 907adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * <p> 908adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * This allows to specify the complete set of names, a certificate's name 909adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * constraints must permit. 910adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * <p> 911adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * The specified parameter {@code names} is a collection with an entry for 912adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * each name to be included in the criterion. The name is specified as a 913adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * {@code List}, the first entry must be an {@code Integer} specifying the 914adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * name type (0-8), the second entry must be a {@code String} or a byte 915adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * array specifying the name (in string or ASN.1 DER encoded form) 9162f9e468ed4985edfd5e351faf2089d91e561e41dElliott Hughes * 917adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * @param names 918adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * the names collection or {@code null} to not perform this 919adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * check. 920adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * @throws IOException 921adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * if decoding fails. 922adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project */ 923adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project public void setPathToNames(Collection<List<?>> names) 924adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project throws IOException { 925adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project pathToNames = null; 926adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project if ((names == null) || (names.size() == 0)) { 927adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project return; 928adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 929adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project Iterator it = names.iterator(); 930adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project while (it.hasNext()) { 931adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project List name = (List) it.next(); 932adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project int tag = ((Integer) name.get(0)).intValue(); 933adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project Object value = name.get(1); 934adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project if (value instanceof String) { 935adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project addPathToName(tag, (String) value); 936adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } else if (value instanceof byte[]) { 937adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project addPathToName(tag, (byte[]) value); 938adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } else { 939897538a36c18f4db8f9f68ee566aec0bda842e9fElliott Hughes throw new IOException("name neither a String nor a byte[]"); 940adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 941adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 942adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 943adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project 944adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project /** 945adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * Adds a {@literal "pathToName"} to the respective criterion. 9462f9e468ed4985edfd5e351faf2089d91e561e41dElliott Hughes * 947adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * @param type 948adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * the type of the name. 949adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * @param name 950adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * the name in string format. 951adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * @throws IOException 952adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * if parsing fails. 953adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * @see #setPathToNames 954adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project */ 955adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project public void addPathToName(int type, String name) throws IOException { 956adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project GeneralName path_name = new GeneralName(type, name); 957adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project // create only if there was not any errors 958adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project if (pathToNames == null) { 959adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project pathToNames = new ArrayList(); 960adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 961adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project pathToNames.add(path_name); 962adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 963adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project 964adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project /** 965adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * Adds a {@literal "pathToName"} to the respective criterion. 9662f9e468ed4985edfd5e351faf2089d91e561e41dElliott Hughes * 967adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * @param type 968adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * the type of the name 969adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * @param name 970adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * the name in ASN.1 DER encoded form. 971adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * @throws IOException 972adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * if decoding fails. 973adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * @see #setPathToNames 974adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project */ 975adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project public void addPathToName(int type, byte[] name) throws IOException { 976adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project GeneralName path_name= new GeneralName(type, name); 977adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project // create only if there was not any errors 978adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project if (pathToNames == null) { 979adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project pathToNames = new ArrayList(); 980adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 981adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project pathToNames.add(path_name); 982adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 983adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project 984adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project /** 985adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * Returns the criterion for the pathToNames constraint. 986adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * <p> 987adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * The constraint is a collection with an entry for each name to be included 988adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * in the criterion. The name is specified as a {@code List}, the first 989adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * entry is an {@code Integer} specifying the name type (0-8), the second 990adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * entry is a byte array specifying the name in ASN.1 DER encoded form. 9912f9e468ed4985edfd5e351faf2089d91e561e41dElliott Hughes * 992adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * @return the pathToNames constraint or {@code null} if none specified. 993adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project */ 994adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project public Collection<List<?>> getPathToNames() { 995adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project if (pathToNames == null) { 996adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project return null; 997adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 998adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project ArrayList result = new ArrayList(); 999adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project Iterator it = pathToNames.iterator(); 1000adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project while (it.hasNext()) { 1001adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project GeneralName name = (GeneralName) it.next(); 1002adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project result.add(name.getAsList()); 1003adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 1004adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project return result; 1005adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 1006adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project 1007adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project /** 1008adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * Returns a string representation of this {@code X509CertSelector} 1009adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * instance. 10102f9e468ed4985edfd5e351faf2089d91e561e41dElliott Hughes * 1011adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * @return a string representation of this {@code X509CertSelector} 1012adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * instance. 1013adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project */ 1014adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project public String toString() { 1015adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project // For convenient reading of the string representation 1016adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project // all of the fields named according to the rfc 3280 1017adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project // (http://www.ietf.org/rfc/rfc3280.txt). 1018adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project 10192f9e468ed4985edfd5e351faf2089d91e561e41dElliott Hughes StringBuilder result = new StringBuilder(); 1020f33eae7e84eb6d3b0f4e86b59605bb3de73009f3Elliott Hughes result.append("X509CertSelector: \n["); 1021adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project if (this.certificateEquals != null) { 1022f33eae7e84eb6d3b0f4e86b59605bb3de73009f3Elliott Hughes result.append("\n certificateEquals: " + certificateEquals); 1023adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 1024adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project if (this.serialNumber != null) { 1025adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project //FIXME: needs DRL's BigInteger.toString implementation 1026adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project //result.append("\n serialNumber: " + serialNumber); 1027adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 1028adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project if (this.issuer != null) { 1029f33eae7e84eb6d3b0f4e86b59605bb3de73009f3Elliott Hughes result.append("\n issuer: " + issuer); 1030adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 1031adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project if (this.subject != null) { 1032f33eae7e84eb6d3b0f4e86b59605bb3de73009f3Elliott Hughes result.append("\n subject: " + subject); 1033adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 1034adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project if (this.subjectKeyIdentifier != null) { 1035f33eae7e84eb6d3b0f4e86b59605bb3de73009f3Elliott Hughes result.append("\n subjectKeyIdentifier: " 1036adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project + getBytesAsString(subjectKeyIdentifier)); 1037adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 1038adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project if (this.authorityKeyIdentifier != null) { 1039f33eae7e84eb6d3b0f4e86b59605bb3de73009f3Elliott Hughes result.append("\n authorityKeyIdentifier: " 1040adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project + getBytesAsString(authorityKeyIdentifier)); 1041adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 1042adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project if (this.certificateValid != null) { 1043f33eae7e84eb6d3b0f4e86b59605bb3de73009f3Elliott Hughes result.append("\n certificateValid: " + certificateValid); 1044adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 1045adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project if (this.subjectPublicKeyAlgID != null) { 1046f33eae7e84eb6d3b0f4e86b59605bb3de73009f3Elliott Hughes result.append("\n subjectPublicKeyAlgID: " 1047adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project + subjectPublicKeyAlgID); 1048adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 1049adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project if (this.privateKeyValid != null) { 1050f33eae7e84eb6d3b0f4e86b59605bb3de73009f3Elliott Hughes result.append("\n privateKeyValid: " + privateKeyValid); 1051adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 1052adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project if (this.subjectPublicKey != null) { 1053f33eae7e84eb6d3b0f4e86b59605bb3de73009f3Elliott Hughes result.append("\n subjectPublicKey: " 1054adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project + getBytesAsString(subjectPublicKey)); 1055adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 1056adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project if (this.keyUsage != null) { 1057f33eae7e84eb6d3b0f4e86b59605bb3de73009f3Elliott Hughes result.append("\n keyUsage: \n ["); 1058adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project String[] kuNames = new String[] { 1059f33eae7e84eb6d3b0f4e86b59605bb3de73009f3Elliott Hughes "digitalSignature", "nonRepudiation", "keyEncipherment", 1060f33eae7e84eb6d3b0f4e86b59605bb3de73009f3Elliott Hughes "dataEncipherment", "keyAgreement", "keyCertSign", "cRLSign", 1061f33eae7e84eb6d3b0f4e86b59605bb3de73009f3Elliott Hughes "encipherOnly", "decipherOnly" 1062adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project }; 1063adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project for (int i=0; i<9; i++) { 1064adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project if (keyUsage[i]) { 1065f33eae7e84eb6d3b0f4e86b59605bb3de73009f3Elliott Hughes result.append("\n " + kuNames[i]); 1066adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 1067adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 1068f33eae7e84eb6d3b0f4e86b59605bb3de73009f3Elliott Hughes result.append("\n ]"); 1069adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 1070adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project if (this.extendedKeyUsage != null) { 1071f33eae7e84eb6d3b0f4e86b59605bb3de73009f3Elliott Hughes result.append("\n extendedKeyUsage: " 1072adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project + extendedKeyUsage.toString()); 1073adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 1074f33eae7e84eb6d3b0f4e86b59605bb3de73009f3Elliott Hughes result.append("\n matchAllNames: " + matchAllNames); 1075f33eae7e84eb6d3b0f4e86b59605bb3de73009f3Elliott Hughes result.append("\n pathLen: " + pathLen); 1076adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project if (this.subjectAltNames != null) { 1077f33eae7e84eb6d3b0f4e86b59605bb3de73009f3Elliott Hughes result.append("\n subjectAltNames: \n ["); 1078adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project for (int i=0; i<9; i++) { 1079adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project List names = this.subjectAltNames[i]; 1080adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project if (names != null) { 1081adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project int size = names.size(); 1082adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project for (int j=0; j<size; j++) { 1083f33eae7e84eb6d3b0f4e86b59605bb3de73009f3Elliott Hughes result.append("\n " 1084adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project + ((GeneralName)names.get(j)).toString()); 1085adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 1086adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 1087adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 1088f33eae7e84eb6d3b0f4e86b59605bb3de73009f3Elliott Hughes result.append("\n ]"); 1089adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 1090adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project if (this.nameConstraints != null) { 1091adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 1092adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project if (this.policies != null) { 1093f33eae7e84eb6d3b0f4e86b59605bb3de73009f3Elliott Hughes result.append("\n policies: " + policies.toString()); 1094adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 1095adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project if (this.pathToNames != null) { 1096f33eae7e84eb6d3b0f4e86b59605bb3de73009f3Elliott Hughes result.append("\n pathToNames: \n ["); 1097adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project int size = pathToNames.size(); 1098adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project for (int i = 0; i < size; i++) { 1099f33eae7e84eb6d3b0f4e86b59605bb3de73009f3Elliott Hughes result.append("\n " 1100adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project + ((GeneralName)pathToNames.get(i)).toString()); 1101adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 1102adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 1103f33eae7e84eb6d3b0f4e86b59605bb3de73009f3Elliott Hughes result.append("\n]"); 1104adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project return result.toString(); 1105adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 1106adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project 1107adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project private String getBytesAsString(byte[] data) { 1108f33eae7e84eb6d3b0f4e86b59605bb3de73009f3Elliott Hughes String result = ""; 1109adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project for (int i=0; i<data.length; i++) { 1110adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project String tail = Integer.toHexString(0x00ff & data[i]); 1111adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project if (tail.length() == 1) { 1112f33eae7e84eb6d3b0f4e86b59605bb3de73009f3Elliott Hughes tail = "0" + tail; 1113adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 1114f33eae7e84eb6d3b0f4e86b59605bb3de73009f3Elliott Hughes result += tail + " "; 1115adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 1116adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project return result; 1117adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 1118adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project 1119adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project private byte[] getExtensionValue(X509Certificate cert, String oid) { 1120adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project try { 1121adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project byte[] bytes = cert.getExtensionValue(oid); 1122adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project if (bytes == null) { 1123adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project return null; 1124adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 1125adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project return (byte[]) ASN1OctetString.getInstance().decode(bytes); 1126adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } catch (IOException e) { 1127adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project return null; 1128adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 1129adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 1130adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project 1131adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project /** 1132adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * Returns whether the specified certificate matches all the criteria 1133adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * collected in this instance. 11342f9e468ed4985edfd5e351faf2089d91e561e41dElliott Hughes * 1135adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * @param certificate 1136adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * the certificate to check. 1137adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * @return {@code true} if the certificate matches all the criteria, 1138adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * otherwise {@code false}. 1139adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project */ 1140adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project public boolean match(Certificate certificate) { 1141adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project if (! (certificate instanceof X509Certificate)) { 1142adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project return false; 1143adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 1144adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project 1145adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project X509Certificate cert = (X509Certificate) certificate; 1146adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project if ((certificateEquals != null) && 1147adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project !certificateEquals.equals(cert)) { 1148adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project return false; 1149adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 1150adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project if ((serialNumber != null) && 1151adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project !serialNumber.equals(cert.getSerialNumber())) { 1152adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project return false; 1153adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 1154adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project if ((issuer != null) && 1155adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project !issuer.equals(cert.getIssuerX500Principal())) { 1156adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project return false; 1157adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 1158adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project if ((subject != null) && 1159adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project !subject.equals(cert.getSubjectX500Principal())) { 1160adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project return false; 1161adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 1162adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project if ((subjectKeyIdentifier != null) && 1163adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project !Arrays.equals(subjectKeyIdentifier, 1164f33eae7e84eb6d3b0f4e86b59605bb3de73009f3Elliott Hughes // Here and later all of the extension OIDs 1165adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project // are taken from rfc 3280 (http://www.ietf.org/rfc/rfc3280.txt) 1166f33eae7e84eb6d3b0f4e86b59605bb3de73009f3Elliott Hughes getExtensionValue(cert, "2.5.29.14"))) { 1167adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project return false; 1168adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 1169adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project if ((authorityKeyIdentifier != null) && 1170adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project !Arrays.equals(authorityKeyIdentifier, 1171f33eae7e84eb6d3b0f4e86b59605bb3de73009f3Elliott Hughes getExtensionValue(cert, "2.5.29.35"))) { 1172adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project return false; 1173adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 1174adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project if (certificateValid != null) { 1175adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project try { 1176adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project cert.checkValidity(certificateValid); 1177adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } catch(CertificateExpiredException e) { 1178adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project return false; 1179adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } catch(CertificateNotYetValidException e) { 1180adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project return false; 1181adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 1182adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 1183adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project if (privateKeyValid != null) { 1184adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project try { 1185f33eae7e84eb6d3b0f4e86b59605bb3de73009f3Elliott Hughes byte[] bytes = getExtensionValue(cert, "2.5.29.16"); 1186adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project if (bytes == null) { 1187adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project return false; 1188adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 1189f33eae7e84eb6d3b0f4e86b59605bb3de73009f3Elliott Hughes PrivateKeyUsagePeriod pkup = (PrivateKeyUsagePeriod) 1190adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project PrivateKeyUsagePeriod.ASN1.decode(bytes); 1191adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project Date notBefore = pkup.getNotBefore(); 1192adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project Date notAfter = pkup.getNotAfter(); 1193adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project if ((notBefore == null) && (notAfter == null)) { 1194adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project return false; 1195adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 1196adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project if ((notBefore != null) 1197adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project && notBefore.compareTo(privateKeyValid) > 0) { 1198adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project return false; 1199adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 1200adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project if ((notAfter != null) 1201adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project && notAfter.compareTo(privateKeyValid) < 0) { 1202adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project return false; 1203adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 1204adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } catch (IOException e) { 1205adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project return false; 1206adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 1207adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 1208adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project if (subjectPublicKeyAlgID != null) { 1209adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project try { 1210adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project byte[] encoding = cert.getPublicKey().getEncoded(); 1211f33eae7e84eb6d3b0f4e86b59605bb3de73009f3Elliott Hughes AlgorithmIdentifier ai = ((SubjectPublicKeyInfo) 1212adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project SubjectPublicKeyInfo.ASN1.decode(encoding)) 1213adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project .getAlgorithmIdentifier(); 1214adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project if (!subjectPublicKeyAlgID.equals(ai.getAlgorithm())) { 1215adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project return false; 1216adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 1217adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } catch (IOException e) { 1218adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project e.printStackTrace(); 1219adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project return false; 1220adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 1221adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 1222adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project if (subjectPublicKey != null) { 1223adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project if (!Arrays.equals(subjectPublicKey, 1224adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project cert.getPublicKey().getEncoded())) { 1225adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project return false; 1226adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 1227adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 1228adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project if (keyUsage != null) { 1229adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project boolean[] ku = cert.getKeyUsage(); 1230adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project if (ku != null) { 1231adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project int i = 0; 1232adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project int min_length = (ku.length < keyUsage.length) ? ku.length 1233adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project : keyUsage.length; 1234adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project for (; i < min_length; i++) { 1235adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project if (keyUsage[i] && !ku[i]) { 1236adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project // the specified keyUsage allows, 1237adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project // but certificate does not. 1238adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project return false; 1239adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 1240adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 1241adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project for (; i<keyUsage.length; i++) { 1242adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project if (keyUsage[i]) { 1243adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project return false; 1244adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 1245adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 1246adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 1247adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 1248adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project if (extendedKeyUsage != null) { 1249adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project try { 1250adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project List keyUsage = cert.getExtendedKeyUsage(); 1251adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project if (keyUsage != null) { 1252adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project if (!keyUsage.containsAll(extendedKeyUsage)) { 1253adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project return false; 1254adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 1255adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 1256adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } catch (CertificateParsingException e) { 1257adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project return false; 1258adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 1259adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 1260adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project if (pathLen != -1) { 1261adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project int p_len = cert.getBasicConstraints(); 1262adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project if ((pathLen < 0) && (p_len >= 0)) { 1263adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project // need end-entity but got CA 1264adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project return false; 1265adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 1266adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project if ((pathLen > 0) && (pathLen > p_len)) { 1267adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project // allowed _pathLen is small 1268adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project return false; 1269adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 1270adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 1271adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project if (subjectAltNames != null) { 1272adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project PASSED: 1273adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project try { 1274f33eae7e84eb6d3b0f4e86b59605bb3de73009f3Elliott Hughes byte[] bytes = getExtensionValue(cert, "2.5.29.17"); 1275adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project if (bytes == null) { 1276adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project return false; 1277adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 1278adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project List sans = ((GeneralNames) GeneralNames.ASN1.decode(bytes)) 1279adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project .getNames(); 1280adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project if ((sans == null) || (sans.size() == 0)) { 1281adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project return false; 1282adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 1283adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project boolean[][] map = new boolean[9][]; 1284adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project // initialize the check map 1285adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project for (int i=0; i<9; i++) { 1286adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project map[i] = (subjectAltNames[i] == null) 1287adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project ? new boolean[0] 1288adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project : new boolean[subjectAltNames[i].size()]; 1289adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 1290adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project Iterator it = sans.iterator(); 1291adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project while (it.hasNext()) { 1292adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project GeneralName name = (GeneralName) it.next(); 1293adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project int tag = name.getTag(); 1294adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project for (int i=0; i<map[tag].length; i++) { 1295adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project if (((GeneralName) subjectAltNames[tag].get(i)) 1296adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project .equals(name)) { 1297adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project if (!matchAllNames) { 1298adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project break PASSED; 1299adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 1300adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project map[tag][i] = true; 1301adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 1302adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 1303adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 1304adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project if (!matchAllNames) { 1305adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project // there was not any match 1306adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project return false; 1307adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 1308adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project // else check the map 1309adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project for (int tag=0; tag<9; tag++) { 1310adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project for (int name=0; name<map[tag].length; name++) { 1311adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project if (!map[tag][name]) { 1312adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project return false; 1313adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 1314adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 1315adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 1316adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } catch (IOException e) { 1317adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project e.printStackTrace(); 1318adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project return false; 1319adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 1320adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 1321adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project if (nameConstraints != null) { 1322adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project if (!nameConstraints.isAcceptable(cert)) { 1323adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project return false; 1324adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 1325adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 1326adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project if (policies != null) { 1327f33eae7e84eb6d3b0f4e86b59605bb3de73009f3Elliott Hughes byte[] bytes = getExtensionValue(cert, "2.5.29.32"); 1328adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project if (bytes == null) { 1329adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project return false; 1330adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 1331adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project if (policies.size() == 0) { 1332adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project // if certificate has such extension than it has at least 1333adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project // one policy in it. 1334adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project return true; 1335adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 1336adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project PASSED: 1337adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project try { 1338f33eae7e84eb6d3b0f4e86b59605bb3de73009f3Elliott Hughes List policyInformations = ((CertificatePolicies) 1339adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project CertificatePolicies.ASN1.decode(bytes)) 1340adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project .getPolicyInformations(); 1341adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project Iterator it = policyInformations.iterator(); 1342adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project while (it.hasNext()) { 1343adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project if (policies.contains(((PolicyInformation) it.next()) 1344adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project .getPolicyIdentifier())) { 1345adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project break PASSED; 1346adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 1347adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 1348adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project return false; 1349adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } catch (IOException e) { 1350adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project // the extension is invalid 1351adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project return false; 1352adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 1353adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 1354adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project if (pathToNames != null) { 1355f33eae7e84eb6d3b0f4e86b59605bb3de73009f3Elliott Hughes byte[] bytes = getExtensionValue(cert, "2.5.29.30"); 1356adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project if (bytes != null) { 1357adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project NameConstraints nameConstraints; 1358adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project try { 1359adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project nameConstraints = 1360adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project (NameConstraints) NameConstraints.ASN1.decode(bytes); 1361adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } catch (IOException e) { 1362adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project // the extension is invalid; 1363adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project return false; 1364adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 1365adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project if (!nameConstraints.isAcceptable(pathToNames)) { 1366adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project return false; 1367adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 1368adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 1369adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 1370adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project return true; 1371adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 1372adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project 1373adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project /** 1374adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * Clones this {@code X509CertSelector} instance. 13752f9e468ed4985edfd5e351faf2089d91e561e41dElliott Hughes * 1376adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project * @return the cloned instance. 1377adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project */ 1378adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project public Object clone() { 13792f9e468ed4985edfd5e351faf2089d91e561e41dElliott Hughes X509CertSelector result; 13802f9e468ed4985edfd5e351faf2089d91e561e41dElliott Hughes 1381d21d78fd49a2d798218e8c8aefbddb26a0e71bbbElliott Hughes try { 1382d21d78fd49a2d798218e8c8aefbddb26a0e71bbbElliott Hughes result = (X509CertSelector) super.clone(); 1383d21d78fd49a2d798218e8c8aefbddb26a0e71bbbElliott Hughes } catch (CloneNotSupportedException e) { 1384d21d78fd49a2d798218e8c8aefbddb26a0e71bbbElliott Hughes return null; 1385d21d78fd49a2d798218e8c8aefbddb26a0e71bbbElliott Hughes } 13862f9e468ed4985edfd5e351faf2089d91e561e41dElliott Hughes 1387adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project if (this.subjectKeyIdentifier != null) { 1388adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project result.subjectKeyIdentifier = 1389adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project new byte[this.subjectKeyIdentifier.length]; 1390adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project System.arraycopy(this.subjectKeyIdentifier, 0, 1391adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project result.subjectKeyIdentifier, 0, 1392adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project this.subjectKeyIdentifier.length); 1393adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 1394adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project if (this.authorityKeyIdentifier != null) { 1395adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project result.authorityKeyIdentifier = 1396adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project new byte[this.authorityKeyIdentifier.length]; 1397adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project System.arraycopy(this.authorityKeyIdentifier, 0, 1398adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project result.authorityKeyIdentifier, 0, 1399adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project this.authorityKeyIdentifier.length); 1400adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 1401adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project if (this.subjectPublicKey != null) { 1402adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project result.subjectPublicKey = new byte[this.subjectPublicKey.length]; 1403adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project System.arraycopy(this.subjectPublicKey, 0, result.subjectPublicKey, 1404adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project 0, this.subjectPublicKey.length); 1405adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 1406adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project if (this.keyUsage != null) { 1407adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project result.keyUsage = new boolean[this.keyUsage.length]; 1408adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project System.arraycopy(this.keyUsage, 0, result.keyUsage, 0, 1409adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project this.keyUsage.length); 1410adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 1411adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project result.extendedKeyUsage = (this.extendedKeyUsage == null) 1412adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project ? null 1413adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project : new HashSet(this.extendedKeyUsage); 1414adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project if (this.subjectAltNames != null) { 1415adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project result.subjectAltNames = new ArrayList[9]; 1416adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project for (int i=0; i<9; i++) { 1417adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project if (this.subjectAltNames[i] != null) { 1418adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project result.subjectAltNames[i] = 1419adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project new ArrayList(this.subjectAltNames[i]); 1420adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 1421adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 1422adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 1423adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project result.policies = (this.policies == null) 1424adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project ? null 1425adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project : new HashSet(this.policies); 1426adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project result.pathToNames = (this.pathToNames == null) 1427adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project ? null 1428adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project : new ArrayList(this.pathToNames); 1429adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project return result; 1430adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project } 1431adc854b798c1cfe3bfd4c27d68d5cee38ca617daThe Android Open Source Project} 1432