1package org.bouncycastle.jce.provider; 2 3import java.io.IOException; 4import java.math.BigInteger; 5import java.security.GeneralSecurityException; 6import java.security.PublicKey; 7import java.security.cert.CertPath; 8import java.security.cert.CertPathBuilder; 9import java.security.cert.CertPathBuilderException; 10import java.security.cert.CertPathValidatorException; 11import java.security.cert.CertificateExpiredException; 12import java.security.cert.CertificateNotYetValidException; 13import java.security.cert.PKIXCertPathChecker; 14import java.security.cert.X509CRL; 15import java.security.cert.X509Certificate; 16import java.security.cert.X509Extension; 17import java.util.ArrayList; 18import java.util.Collection; 19import java.util.Date; 20import java.util.Enumeration; 21import java.util.HashMap; 22import java.util.HashSet; 23import java.util.Iterator; 24import java.util.List; 25import java.util.Map; 26import java.util.Set; 27import java.util.Vector; 28 29import javax.security.auth.x500.X500Principal; 30 31import org.bouncycastle.asn1.ASN1Encodable; 32import org.bouncycastle.asn1.ASN1EncodableVector; 33import org.bouncycastle.asn1.ASN1InputStream; 34import org.bouncycastle.asn1.ASN1Primitive; 35import org.bouncycastle.asn1.ASN1Sequence; 36import org.bouncycastle.asn1.ASN1TaggedObject; 37import org.bouncycastle.asn1.DERInteger; 38import org.bouncycastle.asn1.DERObjectIdentifier; 39import org.bouncycastle.asn1.DERSequence; 40import org.bouncycastle.asn1.x509.BasicConstraints; 41import org.bouncycastle.asn1.x509.CRLDistPoint; 42import org.bouncycastle.asn1.x509.CRLReason; 43import org.bouncycastle.asn1.x509.DistributionPoint; 44import org.bouncycastle.asn1.x509.DistributionPointName; 45import org.bouncycastle.asn1.x509.GeneralName; 46import org.bouncycastle.asn1.x509.GeneralNames; 47import org.bouncycastle.asn1.x509.GeneralSubtree; 48import org.bouncycastle.asn1.x509.IssuingDistributionPoint; 49import org.bouncycastle.asn1.x509.NameConstraints; 50import org.bouncycastle.asn1.x509.PolicyInformation; 51import org.bouncycastle.asn1.x509.X509Extensions; 52import org.bouncycastle.asn1.x509.X509Name; 53import org.bouncycastle.jce.exception.ExtCertPathValidatorException; 54import org.bouncycastle.util.Arrays; 55import org.bouncycastle.x509.ExtendedPKIXBuilderParameters; 56import org.bouncycastle.x509.ExtendedPKIXParameters; 57import org.bouncycastle.x509.X509CRLStoreSelector; 58import org.bouncycastle.x509.X509CertStoreSelector; 59 60public class RFC3280CertPathUtilities 61{ 62 private static final PKIXCRLUtil CRL_UTIL = new PKIXCRLUtil(); 63 64 /** 65 * If the complete CRL includes an issuing distribution point (IDP) CRL 66 * extension check the following: 67 * <p/> 68 * (i) If the distribution point name is present in the IDP CRL extension 69 * and the distribution field is present in the DP, then verify that one of 70 * the names in the IDP matches one of the names in the DP. If the 71 * distribution point name is present in the IDP CRL extension and the 72 * distribution field is omitted from the DP, then verify that one of the 73 * names in the IDP matches one of the names in the cRLIssuer field of the 74 * DP. 75 * </p> 76 * <p/> 77 * (ii) If the onlyContainsUserCerts boolean is asserted in the IDP CRL 78 * extension, verify that the certificate does not include the basic 79 * constraints extension with the cA boolean asserted. 80 * </p> 81 * <p/> 82 * (iii) If the onlyContainsCACerts boolean is asserted in the IDP CRL 83 * extension, verify that the certificate includes the basic constraints 84 * extension with the cA boolean asserted. 85 * </p> 86 * <p/> 87 * (iv) Verify that the onlyContainsAttributeCerts boolean is not asserted. 88 * </p> 89 * 90 * @param dp The distribution point. 91 * @param cert The certificate. 92 * @param crl The CRL. 93 * @throws AnnotatedException if one of the conditions is not met or an error occurs. 94 */ 95 protected static void processCRLB2( 96 DistributionPoint dp, 97 Object cert, 98 X509CRL crl) 99 throws AnnotatedException 100 { 101 IssuingDistributionPoint idp = null; 102 try 103 { 104 idp = IssuingDistributionPoint.getInstance(CertPathValidatorUtilities.getExtensionValue(crl, 105 RFC3280CertPathUtilities.ISSUING_DISTRIBUTION_POINT)); 106 } 107 catch (Exception e) 108 { 109 throw new AnnotatedException("Issuing distribution point extension could not be decoded.", e); 110 } 111 // (b) (2) (i) 112 // distribution point name is present 113 if (idp != null) 114 { 115 if (idp.getDistributionPoint() != null) 116 { 117 // make list of names 118 DistributionPointName dpName = IssuingDistributionPoint.getInstance(idp).getDistributionPoint(); 119 List names = new ArrayList(); 120 121 if (dpName.getType() == DistributionPointName.FULL_NAME) 122 { 123 GeneralName[] genNames = GeneralNames.getInstance(dpName.getName()).getNames(); 124 for (int j = 0; j < genNames.length; j++) 125 { 126 names.add(genNames[j]); 127 } 128 } 129 if (dpName.getType() == DistributionPointName.NAME_RELATIVE_TO_CRL_ISSUER) 130 { 131 ASN1EncodableVector vec = new ASN1EncodableVector(); 132 try 133 { 134 Enumeration e = ASN1Sequence.getInstance( 135 ASN1Sequence.fromByteArray(CertPathValidatorUtilities.getIssuerPrincipal(crl) 136 .getEncoded())).getObjects(); 137 while (e.hasMoreElements()) 138 { 139 vec.add((ASN1Encodable)e.nextElement()); 140 } 141 } 142 catch (IOException e) 143 { 144 throw new AnnotatedException("Could not read CRL issuer.", e); 145 } 146 vec.add(dpName.getName()); 147 names.add(new GeneralName(X509Name.getInstance(new DERSequence(vec)))); 148 } 149 boolean matches = false; 150 // verify that one of the names in the IDP matches one 151 // of the names in the DP. 152 if (dp.getDistributionPoint() != null) 153 { 154 dpName = dp.getDistributionPoint(); 155 GeneralName[] genNames = null; 156 if (dpName.getType() == DistributionPointName.FULL_NAME) 157 { 158 genNames = GeneralNames.getInstance(dpName.getName()).getNames(); 159 } 160 if (dpName.getType() == DistributionPointName.NAME_RELATIVE_TO_CRL_ISSUER) 161 { 162 if (dp.getCRLIssuer() != null) 163 { 164 genNames = dp.getCRLIssuer().getNames(); 165 } 166 else 167 { 168 genNames = new GeneralName[1]; 169 try 170 { 171 genNames[0] = new GeneralName(new X509Name( 172 (ASN1Sequence)ASN1Sequence.fromByteArray(CertPathValidatorUtilities 173 .getEncodedIssuerPrincipal(cert).getEncoded()))); 174 } 175 catch (IOException e) 176 { 177 throw new AnnotatedException("Could not read certificate issuer.", e); 178 } 179 } 180 for (int j = 0; j < genNames.length; j++) 181 { 182 Enumeration e = ASN1Sequence.getInstance(genNames[j].getName().toASN1Primitive()).getObjects(); 183 ASN1EncodableVector vec = new ASN1EncodableVector(); 184 while (e.hasMoreElements()) 185 { 186 vec.add((ASN1Encodable)e.nextElement()); 187 } 188 vec.add(dpName.getName()); 189 genNames[j] = new GeneralName(new X509Name(new DERSequence(vec))); 190 } 191 } 192 if (genNames != null) 193 { 194 for (int j = 0; j < genNames.length; j++) 195 { 196 if (names.contains(genNames[j])) 197 { 198 matches = true; 199 break; 200 } 201 } 202 } 203 if (!matches) 204 { 205 throw new AnnotatedException( 206 "No match for certificate CRL issuing distribution point name to cRLIssuer CRL distribution point."); 207 } 208 } 209 // verify that one of the names in 210 // the IDP matches one of the names in the cRLIssuer field of 211 // the DP 212 else 213 { 214 if (dp.getCRLIssuer() == null) 215 { 216 throw new AnnotatedException("Either the cRLIssuer or the distributionPoint field must " 217 + "be contained in DistributionPoint."); 218 } 219 GeneralName[] genNames = dp.getCRLIssuer().getNames(); 220 for (int j = 0; j < genNames.length; j++) 221 { 222 if (names.contains(genNames[j])) 223 { 224 matches = true; 225 break; 226 } 227 } 228 if (!matches) 229 { 230 throw new AnnotatedException( 231 "No match for certificate CRL issuing distribution point name to cRLIssuer CRL distribution point."); 232 } 233 } 234 } 235 BasicConstraints bc = null; 236 try 237 { 238 bc = BasicConstraints.getInstance(CertPathValidatorUtilities.getExtensionValue((X509Extension)cert, 239 BASIC_CONSTRAINTS)); 240 } 241 catch (Exception e) 242 { 243 throw new AnnotatedException("Basic constraints extension could not be decoded.", e); 244 } 245 246 if (cert instanceof X509Certificate) 247 { 248 // (b) (2) (ii) 249 if (idp.onlyContainsUserCerts() && (bc != null && bc.isCA())) 250 { 251 throw new AnnotatedException("CA Cert CRL only contains user certificates."); 252 } 253 254 // (b) (2) (iii) 255 if (idp.onlyContainsCACerts() && (bc == null || !bc.isCA())) 256 { 257 throw new AnnotatedException("End CRL only contains CA certificates."); 258 } 259 } 260 261 // (b) (2) (iv) 262 if (idp.onlyContainsAttributeCerts()) 263 { 264 throw new AnnotatedException("onlyContainsAttributeCerts boolean is asserted."); 265 } 266 } 267 } 268 269 /** 270 * If the DP includes cRLIssuer, then verify that the issuer field in the 271 * complete CRL matches cRLIssuer in the DP and that the complete CRL 272 * contains an issuing distribution point extension with the indirectCRL 273 * boolean asserted. Otherwise, verify that the CRL issuer matches the 274 * certificate issuer. 275 * 276 * @param dp The distribution point. 277 * @param cert The certificate ot attribute certificate. 278 * @param crl The CRL for <code>cert</code>. 279 * @throws AnnotatedException if one of the above conditions does not apply or an error 280 * occurs. 281 */ 282 protected static void processCRLB1( 283 DistributionPoint dp, 284 Object cert, 285 X509CRL crl) 286 throws AnnotatedException 287 { 288 ASN1Primitive idp = CertPathValidatorUtilities.getExtensionValue(crl, ISSUING_DISTRIBUTION_POINT); 289 boolean isIndirect = false; 290 if (idp != null) 291 { 292 if (IssuingDistributionPoint.getInstance(idp).isIndirectCRL()) 293 { 294 isIndirect = true; 295 } 296 } 297 byte[] issuerBytes = CertPathValidatorUtilities.getIssuerPrincipal(crl).getEncoded(); 298 299 boolean matchIssuer = false; 300 if (dp.getCRLIssuer() != null) 301 { 302 GeneralName genNames[] = dp.getCRLIssuer().getNames(); 303 for (int j = 0; j < genNames.length; j++) 304 { 305 if (genNames[j].getTagNo() == GeneralName.directoryName) 306 { 307 try 308 { 309 if (Arrays.areEqual(genNames[j].getName().toASN1Primitive().getEncoded(), issuerBytes)) 310 { 311 matchIssuer = true; 312 } 313 } 314 catch (IOException e) 315 { 316 throw new AnnotatedException( 317 "CRL issuer information from distribution point cannot be decoded.", e); 318 } 319 } 320 } 321 if (matchIssuer && !isIndirect) 322 { 323 throw new AnnotatedException("Distribution point contains cRLIssuer field but CRL is not indirect."); 324 } 325 if (!matchIssuer) 326 { 327 throw new AnnotatedException("CRL issuer of CRL does not match CRL issuer of distribution point."); 328 } 329 } 330 else 331 { 332 if (CertPathValidatorUtilities.getIssuerPrincipal(crl).equals( 333 CertPathValidatorUtilities.getEncodedIssuerPrincipal(cert))) 334 { 335 matchIssuer = true; 336 } 337 } 338 if (!matchIssuer) 339 { 340 throw new AnnotatedException("Cannot find matching CRL issuer for certificate."); 341 } 342 } 343 344 protected static ReasonsMask processCRLD( 345 X509CRL crl, 346 DistributionPoint dp) 347 throws AnnotatedException 348 { 349 IssuingDistributionPoint idp = null; 350 try 351 { 352 idp = IssuingDistributionPoint.getInstance(CertPathValidatorUtilities.getExtensionValue(crl, 353 RFC3280CertPathUtilities.ISSUING_DISTRIBUTION_POINT)); 354 } 355 catch (Exception e) 356 { 357 throw new AnnotatedException("Issuing distribution point extension could not be decoded.", e); 358 } 359 // (d) (1) 360 if (idp != null && idp.getOnlySomeReasons() != null && dp.getReasons() != null) 361 { 362 return new ReasonsMask(dp.getReasons()).intersect(new ReasonsMask(idp.getOnlySomeReasons())); 363 } 364 // (d) (4) 365 if ((idp == null || idp.getOnlySomeReasons() == null) && dp.getReasons() == null) 366 { 367 return ReasonsMask.allReasons; 368 } 369 // (d) (2) and (d)(3) 370 return (dp.getReasons() == null 371 ? ReasonsMask.allReasons 372 : new ReasonsMask(dp.getReasons())).intersect(idp == null 373 ? ReasonsMask.allReasons 374 : new ReasonsMask(idp.getOnlySomeReasons())); 375 376 } 377 378 protected static final String CERTIFICATE_POLICIES = X509Extensions.CertificatePolicies.getId(); 379 380 protected static final String POLICY_MAPPINGS = X509Extensions.PolicyMappings.getId(); 381 382 protected static final String INHIBIT_ANY_POLICY = X509Extensions.InhibitAnyPolicy.getId(); 383 384 protected static final String ISSUING_DISTRIBUTION_POINT = X509Extensions.IssuingDistributionPoint.getId(); 385 386 protected static final String FRESHEST_CRL = X509Extensions.FreshestCRL.getId(); 387 388 protected static final String DELTA_CRL_INDICATOR = X509Extensions.DeltaCRLIndicator.getId(); 389 390 protected static final String POLICY_CONSTRAINTS = X509Extensions.PolicyConstraints.getId(); 391 392 protected static final String BASIC_CONSTRAINTS = X509Extensions.BasicConstraints.getId(); 393 394 protected static final String CRL_DISTRIBUTION_POINTS = X509Extensions.CRLDistributionPoints.getId(); 395 396 protected static final String SUBJECT_ALTERNATIVE_NAME = X509Extensions.SubjectAlternativeName.getId(); 397 398 protected static final String NAME_CONSTRAINTS = X509Extensions.NameConstraints.getId(); 399 400 protected static final String AUTHORITY_KEY_IDENTIFIER = X509Extensions.AuthorityKeyIdentifier.getId(); 401 402 protected static final String KEY_USAGE = X509Extensions.KeyUsage.getId(); 403 404 protected static final String CRL_NUMBER = X509Extensions.CRLNumber.getId(); 405 406 protected static final String ANY_POLICY = "2.5.29.32.0"; 407 408 /* 409 * key usage bits 410 */ 411 protected static final int KEY_CERT_SIGN = 5; 412 413 protected static final int CRL_SIGN = 6; 414 415 /** 416 * Obtain and validate the certification path for the complete CRL issuer. 417 * If a key usage extension is present in the CRL issuer's certificate, 418 * verify that the cRLSign bit is set. 419 * 420 * @param crl CRL which contains revocation information for the certificate 421 * <code>cert</code>. 422 * @param cert The attribute certificate or certificate to check if it is 423 * revoked. 424 * @param defaultCRLSignCert The issuer certificate of the certificate <code>cert</code>. 425 * @param defaultCRLSignKey The public key of the issuer certificate 426 * <code>defaultCRLSignCert</code>. 427 * @param paramsPKIX paramsPKIX PKIX parameters. 428 * @param certPathCerts The certificates on the certification path. 429 * @return A <code>Set</code> with all keys of possible CRL issuer 430 * certificates. 431 * @throws AnnotatedException if the CRL is not valid or the status cannot be checked or 432 * some error occurs. 433 */ 434 protected static Set processCRLF( 435 X509CRL crl, 436 Object cert, 437 X509Certificate defaultCRLSignCert, 438 PublicKey defaultCRLSignKey, 439 ExtendedPKIXParameters paramsPKIX, 440 List certPathCerts) 441 throws AnnotatedException 442 { 443 // (f) 444 445 // get issuer from CRL 446 X509CertStoreSelector selector = new X509CertStoreSelector(); 447 try 448 { 449 byte[] issuerPrincipal = CertPathValidatorUtilities.getIssuerPrincipal(crl).getEncoded(); 450 selector.setSubject(issuerPrincipal); 451 } 452 catch (IOException e) 453 { 454 throw new AnnotatedException( 455 "Subject criteria for certificate selector to find issuer certificate for CRL could not be set.", e); 456 } 457 458 // get CRL signing certs 459 Collection coll; 460 try 461 { 462 coll = CertPathValidatorUtilities.findCertificates(selector, paramsPKIX.getStores()); 463 coll.addAll(CertPathValidatorUtilities.findCertificates(selector, paramsPKIX.getAdditionalStores())); 464 coll.addAll(CertPathValidatorUtilities.findCertificates(selector, paramsPKIX.getCertStores())); 465 } 466 catch (AnnotatedException e) 467 { 468 throw new AnnotatedException("Issuer certificate for CRL cannot be searched.", e); 469 } 470 471 coll.add(defaultCRLSignCert); 472 473 Iterator cert_it = coll.iterator(); 474 475 List validCerts = new ArrayList(); 476 List validKeys = new ArrayList(); 477 478 while (cert_it.hasNext()) 479 { 480 X509Certificate signingCert = (X509Certificate)cert_it.next(); 481 482 /* 483 * CA of the certificate, for which this CRL is checked, has also 484 * signed CRL, so skip the path validation, because is already done 485 */ 486 if (signingCert.equals(defaultCRLSignCert)) 487 { 488 validCerts.add(signingCert); 489 validKeys.add(defaultCRLSignKey); 490 continue; 491 } 492 try 493 { 494 CertPathBuilder builder = CertPathBuilder.getInstance("PKIX", BouncyCastleProvider.PROVIDER_NAME); 495 selector = new X509CertStoreSelector(); 496 selector.setCertificate(signingCert); 497 ExtendedPKIXParameters temp = (ExtendedPKIXParameters)paramsPKIX.clone(); 498 temp.setTargetCertConstraints(selector); 499 ExtendedPKIXBuilderParameters params = (ExtendedPKIXBuilderParameters)ExtendedPKIXBuilderParameters 500 .getInstance(temp); 501 /* 502 * if signingCert is placed not higher on the cert path a 503 * dependency loop results. CRL for cert is checked, but 504 * signingCert is needed for checking the CRL which is dependent 505 * on checking cert because it is higher in the cert path and so 506 * signing signingCert transitively. so, revocation is disabled, 507 * forgery attacks of the CRL are detected in this outer loop 508 * for all other it must be enabled to prevent forgery attacks 509 */ 510 if (certPathCerts.contains(signingCert)) 511 { 512 params.setRevocationEnabled(false); 513 } 514 else 515 { 516 params.setRevocationEnabled(true); 517 } 518 List certs = builder.build(params).getCertPath().getCertificates(); 519 validCerts.add(signingCert); 520 validKeys.add(CertPathValidatorUtilities.getNextWorkingKey(certs, 0)); 521 } 522 catch (CertPathBuilderException e) 523 { 524 throw new AnnotatedException("Internal error.", e); 525 } 526 catch (CertPathValidatorException e) 527 { 528 throw new AnnotatedException("Public key of issuer certificate of CRL could not be retrieved.", e); 529 } 530 catch (Exception e) 531 { 532 throw new RuntimeException(e.getMessage()); 533 } 534 } 535 536 Set checkKeys = new HashSet(); 537 538 AnnotatedException lastException = null; 539 for (int i = 0; i < validCerts.size(); i++) 540 { 541 X509Certificate signCert = (X509Certificate)validCerts.get(i); 542 boolean[] keyusage = signCert.getKeyUsage(); 543 544 if (keyusage != null && (keyusage.length < 7 || !keyusage[CRL_SIGN])) 545 { 546 lastException = new AnnotatedException( 547 "Issuer certificate key usage extension does not permit CRL signing."); 548 } 549 else 550 { 551 checkKeys.add(validKeys.get(i)); 552 } 553 } 554 555 if (checkKeys.isEmpty() && lastException == null) 556 { 557 throw new AnnotatedException("Cannot find a valid issuer certificate."); 558 } 559 if (checkKeys.isEmpty() && lastException != null) 560 { 561 throw lastException; 562 } 563 564 return checkKeys; 565 } 566 567 protected static PublicKey processCRLG( 568 X509CRL crl, 569 Set keys) 570 throws AnnotatedException 571 { 572 Exception lastException = null; 573 for (Iterator it = keys.iterator(); it.hasNext();) 574 { 575 PublicKey key = (PublicKey)it.next(); 576 try 577 { 578 crl.verify(key); 579 return key; 580 } 581 catch (Exception e) 582 { 583 lastException = e; 584 } 585 } 586 throw new AnnotatedException("Cannot verify CRL.", lastException); 587 } 588 589 protected static X509CRL processCRLH( 590 Set deltacrls, 591 PublicKey key) 592 throws AnnotatedException 593 { 594 Exception lastException = null; 595 596 for (Iterator it = deltacrls.iterator(); it.hasNext();) 597 { 598 X509CRL crl = (X509CRL)it.next(); 599 try 600 { 601 crl.verify(key); 602 return crl; 603 } 604 catch (Exception e) 605 { 606 lastException = e; 607 } 608 } 609 610 if (lastException != null) 611 { 612 throw new AnnotatedException("Cannot verify delta CRL.", lastException); 613 } 614 return null; 615 } 616 617 protected static Set processCRLA1i( 618 Date currentDate, 619 ExtendedPKIXParameters paramsPKIX, 620 X509Certificate cert, 621 X509CRL crl) 622 throws AnnotatedException 623 { 624 Set set = new HashSet(); 625 if (paramsPKIX.isUseDeltasEnabled()) 626 { 627 CRLDistPoint freshestCRL = null; 628 try 629 { 630 freshestCRL = CRLDistPoint 631 .getInstance(CertPathValidatorUtilities.getExtensionValue(cert, FRESHEST_CRL)); 632 } 633 catch (AnnotatedException e) 634 { 635 throw new AnnotatedException("Freshest CRL extension could not be decoded from certificate.", e); 636 } 637 if (freshestCRL == null) 638 { 639 try 640 { 641 freshestCRL = CRLDistPoint.getInstance(CertPathValidatorUtilities.getExtensionValue(crl, 642 FRESHEST_CRL)); 643 } 644 catch (AnnotatedException e) 645 { 646 throw new AnnotatedException("Freshest CRL extension could not be decoded from CRL.", e); 647 } 648 } 649 if (freshestCRL != null) 650 { 651 try 652 { 653 CertPathValidatorUtilities.addAdditionalStoresFromCRLDistributionPoint(freshestCRL, paramsPKIX); 654 } 655 catch (AnnotatedException e) 656 { 657 throw new AnnotatedException( 658 "No new delta CRL locations could be added from Freshest CRL extension.", e); 659 } 660 // get delta CRL(s) 661 try 662 { 663 set.addAll(CertPathValidatorUtilities.getDeltaCRLs(currentDate, paramsPKIX, crl)); 664 } 665 catch (AnnotatedException e) 666 { 667 throw new AnnotatedException("Exception obtaining delta CRLs.", e); 668 } 669 } 670 } 671 return set; 672 } 673 674 protected static Set[] processCRLA1ii( 675 Date currentDate, 676 ExtendedPKIXParameters paramsPKIX, 677 X509Certificate cert, 678 X509CRL crl) 679 throws AnnotatedException 680 { 681 Set deltaSet = new HashSet(); 682 X509CRLStoreSelector crlselect = new X509CRLStoreSelector(); 683 crlselect.setCertificateChecking(cert); 684 685 try 686 { 687 crlselect.addIssuerName(crl.getIssuerX500Principal().getEncoded()); 688 } 689 catch (IOException e) 690 { 691 throw new AnnotatedException("Cannot extract issuer from CRL." + e, e); 692 } 693 694 crlselect.setCompleteCRLEnabled(true); 695 Set completeSet = CRL_UTIL.findCRLs(crlselect, paramsPKIX, currentDate); 696 697 if (paramsPKIX.isUseDeltasEnabled()) 698 { 699 // get delta CRL(s) 700 try 701 { 702 deltaSet.addAll(CertPathValidatorUtilities.getDeltaCRLs(currentDate, paramsPKIX, crl)); 703 } 704 catch (AnnotatedException e) 705 { 706 throw new AnnotatedException("Exception obtaining delta CRLs.", e); 707 } 708 } 709 return new Set[] 710 { 711 completeSet, 712 deltaSet}; 713 } 714 715 716 717 /** 718 * If use-deltas is set, verify the issuer and scope of the delta CRL. 719 * 720 * @param deltaCRL The delta CRL. 721 * @param completeCRL The complete CRL. 722 * @param pkixParams The PKIX paramaters. 723 * @throws AnnotatedException if an exception occurs. 724 */ 725 protected static void processCRLC( 726 X509CRL deltaCRL, 727 X509CRL completeCRL, 728 ExtendedPKIXParameters pkixParams) 729 throws AnnotatedException 730 { 731 if (deltaCRL == null) 732 { 733 return; 734 } 735 IssuingDistributionPoint completeidp = null; 736 try 737 { 738 completeidp = IssuingDistributionPoint.getInstance(CertPathValidatorUtilities.getExtensionValue( 739 completeCRL, RFC3280CertPathUtilities.ISSUING_DISTRIBUTION_POINT)); 740 } 741 catch (Exception e) 742 { 743 throw new AnnotatedException("Issuing distribution point extension could not be decoded.", e); 744 } 745 746 if (pkixParams.isUseDeltasEnabled()) 747 { 748 // (c) (1) 749 if (!deltaCRL.getIssuerX500Principal().equals(completeCRL.getIssuerX500Principal())) 750 { 751 throw new AnnotatedException("Complete CRL issuer does not match delta CRL issuer."); 752 } 753 754 // (c) (2) 755 IssuingDistributionPoint deltaidp = null; 756 try 757 { 758 deltaidp = IssuingDistributionPoint.getInstance(CertPathValidatorUtilities.getExtensionValue( 759 deltaCRL, ISSUING_DISTRIBUTION_POINT)); 760 } 761 catch (Exception e) 762 { 763 throw new AnnotatedException( 764 "Issuing distribution point extension from delta CRL could not be decoded.", e); 765 } 766 767 boolean match = false; 768 if (completeidp == null) 769 { 770 if (deltaidp == null) 771 { 772 match = true; 773 } 774 } 775 else 776 { 777 if (completeidp.equals(deltaidp)) 778 { 779 match = true; 780 } 781 } 782 if (!match) 783 { 784 throw new AnnotatedException( 785 "Issuing distribution point extension from delta CRL and complete CRL does not match."); 786 } 787 788 // (c) (3) 789 ASN1Primitive completeKeyIdentifier = null; 790 try 791 { 792 completeKeyIdentifier = CertPathValidatorUtilities.getExtensionValue( 793 completeCRL, AUTHORITY_KEY_IDENTIFIER); 794 } 795 catch (AnnotatedException e) 796 { 797 throw new AnnotatedException( 798 "Authority key identifier extension could not be extracted from complete CRL.", e); 799 } 800 801 ASN1Primitive deltaKeyIdentifier = null; 802 try 803 { 804 deltaKeyIdentifier = CertPathValidatorUtilities.getExtensionValue( 805 deltaCRL, AUTHORITY_KEY_IDENTIFIER); 806 } 807 catch (AnnotatedException e) 808 { 809 throw new AnnotatedException( 810 "Authority key identifier extension could not be extracted from delta CRL.", e); 811 } 812 813 if (completeKeyIdentifier == null) 814 { 815 throw new AnnotatedException("CRL authority key identifier is null."); 816 } 817 818 if (deltaKeyIdentifier == null) 819 { 820 throw new AnnotatedException("Delta CRL authority key identifier is null."); 821 } 822 823 if (!completeKeyIdentifier.equals(deltaKeyIdentifier)) 824 { 825 throw new AnnotatedException( 826 "Delta CRL authority key identifier does not match complete CRL authority key identifier."); 827 } 828 } 829 } 830 831 protected static void processCRLI( 832 Date validDate, 833 X509CRL deltacrl, 834 Object cert, 835 CertStatus certStatus, 836 ExtendedPKIXParameters pkixParams) 837 throws AnnotatedException 838 { 839 if (pkixParams.isUseDeltasEnabled() && deltacrl != null) 840 { 841 CertPathValidatorUtilities.getCertStatus(validDate, deltacrl, cert, certStatus); 842 } 843 } 844 845 protected static void processCRLJ( 846 Date validDate, 847 X509CRL completecrl, 848 Object cert, 849 CertStatus certStatus) 850 throws AnnotatedException 851 { 852 if (certStatus.getCertStatus() == CertStatus.UNREVOKED) 853 { 854 CertPathValidatorUtilities.getCertStatus(validDate, completecrl, cert, certStatus); 855 } 856 } 857 858 protected static PKIXPolicyNode prepareCertB( 859 CertPath certPath, 860 int index, 861 List[] policyNodes, 862 PKIXPolicyNode validPolicyTree, 863 int policyMapping) 864 throws CertPathValidatorException 865 { 866 List certs = certPath.getCertificates(); 867 X509Certificate cert = (X509Certificate)certs.get(index); 868 int n = certs.size(); 869 // i as defined in the algorithm description 870 int i = n - index; 871 // (b) 872 // 873 ASN1Sequence pm = null; 874 try 875 { 876 pm = DERSequence.getInstance(CertPathValidatorUtilities.getExtensionValue(cert, 877 RFC3280CertPathUtilities.POLICY_MAPPINGS)); 878 } 879 catch (AnnotatedException ex) 880 { 881 throw new ExtCertPathValidatorException("Policy mappings extension could not be decoded.", ex, certPath, 882 index); 883 } 884 PKIXPolicyNode _validPolicyTree = validPolicyTree; 885 if (pm != null) 886 { 887 ASN1Sequence mappings = (ASN1Sequence)pm; 888 Map m_idp = new HashMap(); 889 Set s_idp = new HashSet(); 890 891 for (int j = 0; j < mappings.size(); j++) 892 { 893 ASN1Sequence mapping = (ASN1Sequence)mappings.getObjectAt(j); 894 String id_p = ((DERObjectIdentifier)mapping.getObjectAt(0)).getId(); 895 String sd_p = ((DERObjectIdentifier)mapping.getObjectAt(1)).getId(); 896 Set tmp; 897 898 if (!m_idp.containsKey(id_p)) 899 { 900 tmp = new HashSet(); 901 tmp.add(sd_p); 902 m_idp.put(id_p, tmp); 903 s_idp.add(id_p); 904 } 905 else 906 { 907 tmp = (Set)m_idp.get(id_p); 908 tmp.add(sd_p); 909 } 910 } 911 912 Iterator it_idp = s_idp.iterator(); 913 while (it_idp.hasNext()) 914 { 915 String id_p = (String)it_idp.next(); 916 917 // 918 // (1) 919 // 920 if (policyMapping > 0) 921 { 922 boolean idp_found = false; 923 Iterator nodes_i = policyNodes[i].iterator(); 924 while (nodes_i.hasNext()) 925 { 926 PKIXPolicyNode node = (PKIXPolicyNode)nodes_i.next(); 927 if (node.getValidPolicy().equals(id_p)) 928 { 929 idp_found = true; 930 node.expectedPolicies = (Set)m_idp.get(id_p); 931 break; 932 } 933 } 934 935 if (!idp_found) 936 { 937 nodes_i = policyNodes[i].iterator(); 938 while (nodes_i.hasNext()) 939 { 940 PKIXPolicyNode node = (PKIXPolicyNode)nodes_i.next(); 941 if (RFC3280CertPathUtilities.ANY_POLICY.equals(node.getValidPolicy())) 942 { 943 Set pq = null; 944 ASN1Sequence policies = null; 945 try 946 { 947 policies = (ASN1Sequence)CertPathValidatorUtilities.getExtensionValue(cert, 948 RFC3280CertPathUtilities.CERTIFICATE_POLICIES); 949 } 950 catch (AnnotatedException e) 951 { 952 throw new ExtCertPathValidatorException( 953 "Certificate policies extension could not be decoded.", e, certPath, index); 954 } 955 Enumeration e = policies.getObjects(); 956 while (e.hasMoreElements()) 957 { 958 PolicyInformation pinfo = null; 959 try 960 { 961 pinfo = PolicyInformation.getInstance(e.nextElement()); 962 } 963 catch (Exception ex) 964 { 965 throw new CertPathValidatorException( 966 "Policy information could not be decoded.", ex, certPath, index); 967 } 968 if (RFC3280CertPathUtilities.ANY_POLICY.equals(pinfo.getPolicyIdentifier().getId())) 969 { 970 try 971 { 972 pq = CertPathValidatorUtilities 973 .getQualifierSet(pinfo.getPolicyQualifiers()); 974 } 975 catch (CertPathValidatorException ex) 976 { 977 978 throw new ExtCertPathValidatorException( 979 "Policy qualifier info set could not be decoded.", ex, certPath, 980 index); 981 } 982 break; 983 } 984 } 985 boolean ci = false; 986 if (cert.getCriticalExtensionOIDs() != null) 987 { 988 ci = cert.getCriticalExtensionOIDs().contains( 989 RFC3280CertPathUtilities.CERTIFICATE_POLICIES); 990 } 991 992 PKIXPolicyNode p_node = (PKIXPolicyNode)node.getParent(); 993 if (RFC3280CertPathUtilities.ANY_POLICY.equals(p_node.getValidPolicy())) 994 { 995 PKIXPolicyNode c_node = new PKIXPolicyNode(new ArrayList(), i, (Set)m_idp 996 .get(id_p), p_node, pq, id_p, ci); 997 p_node.addChild(c_node); 998 policyNodes[i].add(c_node); 999 } 1000 break; 1001 } 1002 } 1003 } 1004 1005 // 1006 // (2) 1007 // 1008 } 1009 else if (policyMapping <= 0) 1010 { 1011 Iterator nodes_i = policyNodes[i].iterator(); 1012 while (nodes_i.hasNext()) 1013 { 1014 PKIXPolicyNode node = (PKIXPolicyNode)nodes_i.next(); 1015 if (node.getValidPolicy().equals(id_p)) 1016 { 1017 PKIXPolicyNode p_node = (PKIXPolicyNode)node.getParent(); 1018 p_node.removeChild(node); 1019 nodes_i.remove(); 1020 for (int k = (i - 1); k >= 0; k--) 1021 { 1022 List nodes = policyNodes[k]; 1023 for (int l = 0; l < nodes.size(); l++) 1024 { 1025 PKIXPolicyNode node2 = (PKIXPolicyNode)nodes.get(l); 1026 if (!node2.hasChildren()) 1027 { 1028 _validPolicyTree = CertPathValidatorUtilities.removePolicyNode( 1029 _validPolicyTree, policyNodes, node2); 1030 if (_validPolicyTree == null) 1031 { 1032 break; 1033 } 1034 } 1035 } 1036 } 1037 } 1038 } 1039 } 1040 } 1041 } 1042 return _validPolicyTree; 1043 } 1044 1045 protected static void prepareNextCertA( 1046 CertPath certPath, 1047 int index) 1048 throws CertPathValidatorException 1049 { 1050 List certs = certPath.getCertificates(); 1051 X509Certificate cert = (X509Certificate)certs.get(index); 1052 // 1053 // 1054 // (a) check the policy mappings 1055 // 1056 ASN1Sequence pm = null; 1057 try 1058 { 1059 pm = DERSequence.getInstance(CertPathValidatorUtilities.getExtensionValue(cert, 1060 RFC3280CertPathUtilities.POLICY_MAPPINGS)); 1061 } 1062 catch (AnnotatedException ex) 1063 { 1064 throw new ExtCertPathValidatorException("Policy mappings extension could not be decoded.", ex, certPath, 1065 index); 1066 } 1067 if (pm != null) 1068 { 1069 ASN1Sequence mappings = pm; 1070 1071 for (int j = 0; j < mappings.size(); j++) 1072 { 1073 DERObjectIdentifier issuerDomainPolicy = null; 1074 DERObjectIdentifier subjectDomainPolicy = null; 1075 try 1076 { 1077 ASN1Sequence mapping = DERSequence.getInstance(mappings.getObjectAt(j)); 1078 1079 issuerDomainPolicy = DERObjectIdentifier.getInstance(mapping.getObjectAt(0)); 1080 subjectDomainPolicy = DERObjectIdentifier.getInstance(mapping.getObjectAt(1)); 1081 } 1082 catch (Exception e) 1083 { 1084 throw new ExtCertPathValidatorException("Policy mappings extension contents could not be decoded.", 1085 e, certPath, index); 1086 } 1087 1088 if (RFC3280CertPathUtilities.ANY_POLICY.equals(issuerDomainPolicy.getId())) 1089 { 1090 1091 throw new CertPathValidatorException("IssuerDomainPolicy is anyPolicy", null, certPath, index); 1092 } 1093 1094 if (RFC3280CertPathUtilities.ANY_POLICY.equals(subjectDomainPolicy.getId())) 1095 { 1096 1097 throw new CertPathValidatorException("SubjectDomainPolicy is anyPolicy,", null, certPath, index); 1098 } 1099 } 1100 } 1101 } 1102 1103 protected static void processCertF( 1104 CertPath certPath, 1105 int index, 1106 PKIXPolicyNode validPolicyTree, 1107 int explicitPolicy) 1108 throws CertPathValidatorException 1109 { 1110 // 1111 // (f) 1112 // 1113 if (explicitPolicy <= 0 && validPolicyTree == null) 1114 { 1115 throw new ExtCertPathValidatorException("No valid policy tree found when one expected.", null, certPath, 1116 index); 1117 } 1118 } 1119 1120 protected static PKIXPolicyNode processCertE( 1121 CertPath certPath, 1122 int index, 1123 PKIXPolicyNode validPolicyTree) 1124 throws CertPathValidatorException 1125 { 1126 List certs = certPath.getCertificates(); 1127 X509Certificate cert = (X509Certificate)certs.get(index); 1128 // 1129 // (e) 1130 // 1131 ASN1Sequence certPolicies = null; 1132 try 1133 { 1134 certPolicies = DERSequence.getInstance(CertPathValidatorUtilities.getExtensionValue(cert, 1135 RFC3280CertPathUtilities.CERTIFICATE_POLICIES)); 1136 } 1137 catch (AnnotatedException e) 1138 { 1139 throw new ExtCertPathValidatorException("Could not read certificate policies extension from certificate.", 1140 e, certPath, index); 1141 } 1142 if (certPolicies == null) 1143 { 1144 validPolicyTree = null; 1145 } 1146 return validPolicyTree; 1147 } 1148 1149 protected static void processCertBC( 1150 CertPath certPath, 1151 int index, 1152 PKIXNameConstraintValidator nameConstraintValidator) 1153 throws CertPathValidatorException 1154 { 1155 List certs = certPath.getCertificates(); 1156 X509Certificate cert = (X509Certificate)certs.get(index); 1157 int n = certs.size(); 1158 // i as defined in the algorithm description 1159 int i = n - index; 1160 // 1161 // (b), (c) permitted and excluded subtree checking. 1162 // 1163 if (!(CertPathValidatorUtilities.isSelfIssued(cert) && (i < n))) 1164 { 1165 X500Principal principal = CertPathValidatorUtilities.getSubjectPrincipal(cert); 1166 ASN1InputStream aIn = new ASN1InputStream(principal.getEncoded()); 1167 ASN1Sequence dns; 1168 1169 try 1170 { 1171 dns = DERSequence.getInstance(aIn.readObject()); 1172 } 1173 catch (Exception e) 1174 { 1175 throw new CertPathValidatorException("Exception extracting subject name when checking subtrees.", e, 1176 certPath, index); 1177 } 1178 1179 try 1180 { 1181 nameConstraintValidator.checkPermittedDN(dns); 1182 nameConstraintValidator.checkExcludedDN(dns); 1183 } 1184 catch (PKIXNameConstraintValidatorException e) 1185 { 1186 throw new CertPathValidatorException("Subtree check for certificate subject failed.", e, certPath, 1187 index); 1188 } 1189 1190 GeneralNames altName = null; 1191 try 1192 { 1193 altName = GeneralNames.getInstance(CertPathValidatorUtilities.getExtensionValue(cert, 1194 RFC3280CertPathUtilities.SUBJECT_ALTERNATIVE_NAME)); 1195 } 1196 catch (Exception e) 1197 { 1198 throw new CertPathValidatorException("Subject alternative name extension could not be decoded.", e, 1199 certPath, index); 1200 } 1201 Vector emails = new X509Name(dns).getValues(X509Name.EmailAddress); 1202 for (Enumeration e = emails.elements(); e.hasMoreElements();) 1203 { 1204 String email = (String)e.nextElement(); 1205 GeneralName emailAsGeneralName = new GeneralName(GeneralName.rfc822Name, email); 1206 try 1207 { 1208 nameConstraintValidator.checkPermitted(emailAsGeneralName); 1209 nameConstraintValidator.checkExcluded(emailAsGeneralName); 1210 } 1211 catch (PKIXNameConstraintValidatorException ex) 1212 { 1213 throw new CertPathValidatorException( 1214 "Subtree check for certificate subject alternative email failed.", ex, certPath, index); 1215 } 1216 } 1217 if (altName != null) 1218 { 1219 GeneralName[] genNames = null; 1220 try 1221 { 1222 genNames = altName.getNames(); 1223 } 1224 catch (Exception e) 1225 { 1226 throw new CertPathValidatorException("Subject alternative name contents could not be decoded.", e, 1227 certPath, index); 1228 } 1229 for (int j = 0; j < genNames.length; j++) 1230 { 1231 1232 try 1233 { 1234 nameConstraintValidator.checkPermitted(genNames[j]); 1235 nameConstraintValidator.checkExcluded(genNames[j]); 1236 } 1237 catch (PKIXNameConstraintValidatorException e) 1238 { 1239 throw new CertPathValidatorException( 1240 "Subtree check for certificate subject alternative name failed.", e, certPath, index); 1241 } 1242 } 1243 } 1244 } 1245 } 1246 1247 protected static PKIXPolicyNode processCertD( 1248 CertPath certPath, 1249 int index, 1250 Set acceptablePolicies, 1251 PKIXPolicyNode validPolicyTree, 1252 List[] policyNodes, 1253 int inhibitAnyPolicy) 1254 throws CertPathValidatorException 1255 { 1256 List certs = certPath.getCertificates(); 1257 X509Certificate cert = (X509Certificate)certs.get(index); 1258 int n = certs.size(); 1259 // i as defined in the algorithm description 1260 int i = n - index; 1261 // 1262 // (d) policy Information checking against initial policy and 1263 // policy mapping 1264 // 1265 ASN1Sequence certPolicies = null; 1266 try 1267 { 1268 certPolicies = DERSequence.getInstance(CertPathValidatorUtilities.getExtensionValue(cert, 1269 RFC3280CertPathUtilities.CERTIFICATE_POLICIES)); 1270 } 1271 catch (AnnotatedException e) 1272 { 1273 throw new ExtCertPathValidatorException("Could not read certificate policies extension from certificate.", 1274 e, certPath, index); 1275 } 1276 if (certPolicies != null && validPolicyTree != null) 1277 { 1278 // 1279 // (d) (1) 1280 // 1281 Enumeration e = certPolicies.getObjects(); 1282 Set pols = new HashSet(); 1283 1284 while (e.hasMoreElements()) 1285 { 1286 PolicyInformation pInfo = PolicyInformation.getInstance(e.nextElement()); 1287 DERObjectIdentifier pOid = pInfo.getPolicyIdentifier(); 1288 1289 pols.add(pOid.getId()); 1290 1291 if (!RFC3280CertPathUtilities.ANY_POLICY.equals(pOid.getId())) 1292 { 1293 Set pq = null; 1294 try 1295 { 1296 pq = CertPathValidatorUtilities.getQualifierSet(pInfo.getPolicyQualifiers()); 1297 } 1298 catch (CertPathValidatorException ex) 1299 { 1300 throw new ExtCertPathValidatorException("Policy qualifier info set could not be build.", ex, 1301 certPath, index); 1302 } 1303 1304 boolean match = CertPathValidatorUtilities.processCertD1i(i, policyNodes, pOid, pq); 1305 1306 if (!match) 1307 { 1308 CertPathValidatorUtilities.processCertD1ii(i, policyNodes, pOid, pq); 1309 } 1310 } 1311 } 1312 1313 if (acceptablePolicies.isEmpty() || acceptablePolicies.contains(RFC3280CertPathUtilities.ANY_POLICY)) 1314 { 1315 acceptablePolicies.clear(); 1316 acceptablePolicies.addAll(pols); 1317 } 1318 else 1319 { 1320 Iterator it = acceptablePolicies.iterator(); 1321 Set t1 = new HashSet(); 1322 1323 while (it.hasNext()) 1324 { 1325 Object o = it.next(); 1326 1327 if (pols.contains(o)) 1328 { 1329 t1.add(o); 1330 } 1331 } 1332 acceptablePolicies.clear(); 1333 acceptablePolicies.addAll(t1); 1334 } 1335 1336 // 1337 // (d) (2) 1338 // 1339 if ((inhibitAnyPolicy > 0) || ((i < n) && CertPathValidatorUtilities.isSelfIssued(cert))) 1340 { 1341 e = certPolicies.getObjects(); 1342 1343 while (e.hasMoreElements()) 1344 { 1345 PolicyInformation pInfo = PolicyInformation.getInstance(e.nextElement()); 1346 1347 if (RFC3280CertPathUtilities.ANY_POLICY.equals(pInfo.getPolicyIdentifier().getId())) 1348 { 1349 Set _apq = CertPathValidatorUtilities.getQualifierSet(pInfo.getPolicyQualifiers()); 1350 List _nodes = policyNodes[i - 1]; 1351 1352 for (int k = 0; k < _nodes.size(); k++) 1353 { 1354 PKIXPolicyNode _node = (PKIXPolicyNode)_nodes.get(k); 1355 1356 Iterator _policySetIter = _node.getExpectedPolicies().iterator(); 1357 while (_policySetIter.hasNext()) 1358 { 1359 Object _tmp = _policySetIter.next(); 1360 1361 String _policy; 1362 if (_tmp instanceof String) 1363 { 1364 _policy = (String)_tmp; 1365 } 1366 else if (_tmp instanceof DERObjectIdentifier) 1367 { 1368 _policy = ((DERObjectIdentifier)_tmp).getId(); 1369 } 1370 else 1371 { 1372 continue; 1373 } 1374 1375 boolean _found = false; 1376 Iterator _childrenIter = _node.getChildren(); 1377 1378 while (_childrenIter.hasNext()) 1379 { 1380 PKIXPolicyNode _child = (PKIXPolicyNode)_childrenIter.next(); 1381 1382 if (_policy.equals(_child.getValidPolicy())) 1383 { 1384 _found = true; 1385 } 1386 } 1387 1388 if (!_found) 1389 { 1390 Set _newChildExpectedPolicies = new HashSet(); 1391 _newChildExpectedPolicies.add(_policy); 1392 1393 PKIXPolicyNode _newChild = new PKIXPolicyNode(new ArrayList(), i, 1394 _newChildExpectedPolicies, _node, _apq, _policy, false); 1395 _node.addChild(_newChild); 1396 policyNodes[i].add(_newChild); 1397 } 1398 } 1399 } 1400 break; 1401 } 1402 } 1403 } 1404 1405 PKIXPolicyNode _validPolicyTree = validPolicyTree; 1406 // 1407 // (d) (3) 1408 // 1409 for (int j = (i - 1); j >= 0; j--) 1410 { 1411 List nodes = policyNodes[j]; 1412 1413 for (int k = 0; k < nodes.size(); k++) 1414 { 1415 PKIXPolicyNode node = (PKIXPolicyNode)nodes.get(k); 1416 if (!node.hasChildren()) 1417 { 1418 _validPolicyTree = CertPathValidatorUtilities.removePolicyNode(_validPolicyTree, policyNodes, 1419 node); 1420 if (_validPolicyTree == null) 1421 { 1422 break; 1423 } 1424 } 1425 } 1426 } 1427 1428 // 1429 // d (4) 1430 // 1431 Set criticalExtensionOids = cert.getCriticalExtensionOIDs(); 1432 1433 if (criticalExtensionOids != null) 1434 { 1435 boolean critical = criticalExtensionOids.contains(RFC3280CertPathUtilities.CERTIFICATE_POLICIES); 1436 1437 List nodes = policyNodes[i]; 1438 for (int j = 0; j < nodes.size(); j++) 1439 { 1440 PKIXPolicyNode node = (PKIXPolicyNode)nodes.get(j); 1441 node.setCritical(critical); 1442 } 1443 } 1444 return _validPolicyTree; 1445 } 1446 return null; 1447 } 1448 1449 protected static void processCertA( 1450 CertPath certPath, 1451 ExtendedPKIXParameters paramsPKIX, 1452 int index, 1453 PublicKey workingPublicKey, 1454 boolean verificationAlreadyPerformed, 1455 X500Principal workingIssuerName, 1456 X509Certificate sign) 1457 throws ExtCertPathValidatorException 1458 { 1459 List certs = certPath.getCertificates(); 1460 X509Certificate cert = (X509Certificate)certs.get(index); 1461 // 1462 // (a) verify 1463 // 1464 if (!verificationAlreadyPerformed) 1465 { 1466 try 1467 { 1468 // (a) (1) 1469 // 1470 CertPathValidatorUtilities.verifyX509Certificate(cert, workingPublicKey, 1471 paramsPKIX.getSigProvider()); 1472 } 1473 catch (GeneralSecurityException e) 1474 { 1475 throw new ExtCertPathValidatorException("Could not validate certificate signature.", e, certPath, index); 1476 } 1477 } 1478 1479 try 1480 { 1481 // (a) (2) 1482 // 1483 cert.checkValidity(CertPathValidatorUtilities 1484 .getValidCertDateFromValidityModel(paramsPKIX, certPath, index)); 1485 } 1486 catch (CertificateExpiredException e) 1487 { 1488 throw new ExtCertPathValidatorException("Could not validate certificate: " + e.getMessage(), e, certPath, index); 1489 } 1490 catch (CertificateNotYetValidException e) 1491 { 1492 throw new ExtCertPathValidatorException("Could not validate certificate: " + e.getMessage(), e, certPath, index); 1493 } 1494 catch (AnnotatedException e) 1495 { 1496 throw new ExtCertPathValidatorException("Could not validate time of certificate.", e, certPath, index); 1497 } 1498 1499 // 1500 // (a) (3) 1501 // 1502 if (paramsPKIX.isRevocationEnabled()) 1503 { 1504 try 1505 { 1506 checkCRLs(paramsPKIX, cert, CertPathValidatorUtilities.getValidCertDateFromValidityModel(paramsPKIX, 1507 certPath, index), sign, workingPublicKey, certs); 1508 } 1509 catch (AnnotatedException e) 1510 { 1511 Throwable cause = e; 1512 if (null != e.getCause()) 1513 { 1514 cause = e.getCause(); 1515 } 1516 throw new ExtCertPathValidatorException(e.getMessage(), cause, certPath, index); 1517 } 1518 } 1519 1520 // 1521 // (a) (4) name chaining 1522 // 1523 if (!CertPathValidatorUtilities.getEncodedIssuerPrincipal(cert).equals(workingIssuerName)) 1524 { 1525 throw new ExtCertPathValidatorException("IssuerName(" + CertPathValidatorUtilities.getEncodedIssuerPrincipal(cert) 1526 + ") does not match SubjectName(" + workingIssuerName + ") of signing certificate.", null, 1527 certPath, index); 1528 } 1529 } 1530 1531 protected static int prepareNextCertI1( 1532 CertPath certPath, 1533 int index, 1534 int explicitPolicy) 1535 throws CertPathValidatorException 1536 { 1537 List certs = certPath.getCertificates(); 1538 X509Certificate cert = (X509Certificate)certs.get(index); 1539 // 1540 // (i) 1541 // 1542 ASN1Sequence pc = null; 1543 try 1544 { 1545 pc = DERSequence.getInstance(CertPathValidatorUtilities.getExtensionValue(cert, 1546 RFC3280CertPathUtilities.POLICY_CONSTRAINTS)); 1547 } 1548 catch (Exception e) 1549 { 1550 throw new ExtCertPathValidatorException("Policy constraints extension cannot be decoded.", e, certPath, 1551 index); 1552 } 1553 1554 int tmpInt; 1555 1556 if (pc != null) 1557 { 1558 Enumeration policyConstraints = pc.getObjects(); 1559 1560 while (policyConstraints.hasMoreElements()) 1561 { 1562 try 1563 { 1564 1565 ASN1TaggedObject constraint = ASN1TaggedObject.getInstance(policyConstraints.nextElement()); 1566 if (constraint.getTagNo() == 0) 1567 { 1568 tmpInt = DERInteger.getInstance(constraint, false).getValue().intValue(); 1569 if (tmpInt < explicitPolicy) 1570 { 1571 return tmpInt; 1572 } 1573 break; 1574 } 1575 } 1576 catch (IllegalArgumentException e) 1577 { 1578 throw new ExtCertPathValidatorException("Policy constraints extension contents cannot be decoded.", 1579 e, certPath, index); 1580 } 1581 } 1582 } 1583 return explicitPolicy; 1584 } 1585 1586 protected static int prepareNextCertI2( 1587 CertPath certPath, 1588 int index, 1589 int policyMapping) 1590 throws CertPathValidatorException 1591 { 1592 List certs = certPath.getCertificates(); 1593 X509Certificate cert = (X509Certificate)certs.get(index); 1594 // 1595 // (i) 1596 // 1597 ASN1Sequence pc = null; 1598 try 1599 { 1600 pc = DERSequence.getInstance(CertPathValidatorUtilities.getExtensionValue(cert, 1601 RFC3280CertPathUtilities.POLICY_CONSTRAINTS)); 1602 } 1603 catch (Exception e) 1604 { 1605 throw new ExtCertPathValidatorException("Policy constraints extension cannot be decoded.", e, certPath, 1606 index); 1607 } 1608 1609 int tmpInt; 1610 1611 if (pc != null) 1612 { 1613 Enumeration policyConstraints = pc.getObjects(); 1614 1615 while (policyConstraints.hasMoreElements()) 1616 { 1617 try 1618 { 1619 ASN1TaggedObject constraint = ASN1TaggedObject.getInstance(policyConstraints.nextElement()); 1620 if (constraint.getTagNo() == 1) 1621 { 1622 tmpInt = DERInteger.getInstance(constraint, false).getValue().intValue(); 1623 if (tmpInt < policyMapping) 1624 { 1625 return tmpInt; 1626 } 1627 break; 1628 } 1629 } 1630 catch (IllegalArgumentException e) 1631 { 1632 throw new ExtCertPathValidatorException("Policy constraints extension contents cannot be decoded.", 1633 e, certPath, index); 1634 } 1635 } 1636 } 1637 return policyMapping; 1638 } 1639 1640 protected static void prepareNextCertG( 1641 CertPath certPath, 1642 int index, 1643 PKIXNameConstraintValidator nameConstraintValidator) 1644 throws CertPathValidatorException 1645 { 1646 List certs = certPath.getCertificates(); 1647 X509Certificate cert = (X509Certificate)certs.get(index); 1648 // 1649 // (g) handle the name constraints extension 1650 // 1651 NameConstraints nc = null; 1652 try 1653 { 1654 ASN1Sequence ncSeq = DERSequence.getInstance(CertPathValidatorUtilities.getExtensionValue(cert, 1655 RFC3280CertPathUtilities.NAME_CONSTRAINTS)); 1656 if (ncSeq != null) 1657 { 1658 nc = NameConstraints.getInstance(ncSeq); 1659 } 1660 } 1661 catch (Exception e) 1662 { 1663 throw new ExtCertPathValidatorException("Name constraints extension could not be decoded.", e, certPath, 1664 index); 1665 } 1666 if (nc != null) 1667 { 1668 1669 // 1670 // (g) (1) permitted subtrees 1671 // 1672 ASN1Sequence permitted = nc.getPermittedSubtrees(); 1673 if (permitted != null) 1674 { 1675 try 1676 { 1677 nameConstraintValidator.intersectPermittedSubtree(permitted); 1678 } 1679 catch (Exception ex) 1680 { 1681 throw new ExtCertPathValidatorException( 1682 "Permitted subtrees cannot be build from name constraints extension.", ex, certPath, index); 1683 } 1684 } 1685 1686 // 1687 // (g) (2) excluded subtrees 1688 // 1689 ASN1Sequence excluded = nc.getExcludedSubtrees(); 1690 if (excluded != null) 1691 { 1692 Enumeration e = excluded.getObjects(); 1693 try 1694 { 1695 while (e.hasMoreElements()) 1696 { 1697 GeneralSubtree subtree = GeneralSubtree.getInstance(e.nextElement()); 1698 nameConstraintValidator.addExcludedSubtree(subtree); 1699 } 1700 } 1701 catch (Exception ex) 1702 { 1703 throw new ExtCertPathValidatorException( 1704 "Excluded subtrees cannot be build from name constraints extension.", ex, certPath, index); 1705 } 1706 } 1707 } 1708 } 1709 1710 /** 1711 * Checks a distribution point for revocation information for the 1712 * certificate <code>cert</code>. 1713 * 1714 * @param dp The distribution point to consider. 1715 * @param paramsPKIX PKIX parameters. 1716 * @param cert Certificate to check if it is revoked. 1717 * @param validDate The date when the certificate revocation status should be 1718 * checked. 1719 * @param defaultCRLSignCert The issuer certificate of the certificate <code>cert</code>. 1720 * @param defaultCRLSignKey The public key of the issuer certificate 1721 * <code>defaultCRLSignCert</code>. 1722 * @param certStatus The current certificate revocation status. 1723 * @param reasonMask The reasons mask which is already checked. 1724 * @param certPathCerts The certificates of the certification path. 1725 * @throws AnnotatedException if the certificate is revoked or the status cannot be checked 1726 * or some error occurs. 1727 */ 1728 private static void checkCRL( 1729 DistributionPoint dp, 1730 ExtendedPKIXParameters paramsPKIX, 1731 X509Certificate cert, 1732 Date validDate, 1733 X509Certificate defaultCRLSignCert, 1734 PublicKey defaultCRLSignKey, 1735 CertStatus certStatus, 1736 ReasonsMask reasonMask, 1737 List certPathCerts) 1738 throws AnnotatedException 1739 { 1740 Date currentDate = new Date(System.currentTimeMillis()); 1741 if (validDate.getTime() > currentDate.getTime()) 1742 { 1743 throw new AnnotatedException("Validation time is in future."); 1744 } 1745 1746 // (a) 1747 /* 1748 * We always get timely valid CRLs, so there is no step (a) (1). 1749 * "locally cached" CRLs are assumed to be in getStore(), additional 1750 * CRLs must be enabled in the ExtendedPKIXParameters and are in 1751 * getAdditionalStore() 1752 */ 1753 1754 Set crls = CertPathValidatorUtilities.getCompleteCRLs(dp, cert, currentDate, paramsPKIX); 1755 boolean validCrlFound = false; 1756 AnnotatedException lastException = null; 1757 Iterator crl_iter = crls.iterator(); 1758 1759 while (crl_iter.hasNext() && certStatus.getCertStatus() == CertStatus.UNREVOKED && !reasonMask.isAllReasons()) 1760 { 1761 try 1762 { 1763 X509CRL crl = (X509CRL)crl_iter.next(); 1764 1765 // (d) 1766 ReasonsMask interimReasonsMask = RFC3280CertPathUtilities.processCRLD(crl, dp); 1767 1768 // (e) 1769 /* 1770 * The reasons mask is updated at the end, so only valid CRLs 1771 * can update it. If this CRL does not contain new reasons it 1772 * must be ignored. 1773 */ 1774 if (!interimReasonsMask.hasNewReasons(reasonMask)) 1775 { 1776 continue; 1777 } 1778 1779 // (f) 1780 Set keys = RFC3280CertPathUtilities.processCRLF(crl, cert, defaultCRLSignCert, defaultCRLSignKey, 1781 paramsPKIX, certPathCerts); 1782 // (g) 1783 PublicKey key = RFC3280CertPathUtilities.processCRLG(crl, keys); 1784 1785 X509CRL deltaCRL = null; 1786 1787 if (paramsPKIX.isUseDeltasEnabled()) 1788 { 1789 // get delta CRLs 1790 Set deltaCRLs = CertPathValidatorUtilities.getDeltaCRLs(currentDate, paramsPKIX, crl); 1791 // we only want one valid delta CRL 1792 // (h) 1793 deltaCRL = RFC3280CertPathUtilities.processCRLH(deltaCRLs, key); 1794 } 1795 1796 /* 1797 * CRL must be be valid at the current time, not the validation 1798 * time. If a certificate is revoked with reason keyCompromise, 1799 * cACompromise, it can be used for forgery, also for the past. 1800 * This reason may not be contained in older CRLs. 1801 */ 1802 1803 /* 1804 * in the chain model signatures stay valid also after the 1805 * certificate has been expired, so they do not have to be in 1806 * the CRL validity time 1807 */ 1808 1809 if (paramsPKIX.getValidityModel() != ExtendedPKIXParameters.CHAIN_VALIDITY_MODEL) 1810 { 1811 /* 1812 * if a certificate has expired, but was revoked, it is not 1813 * more in the CRL, so it would be regarded as valid if the 1814 * first check is not done 1815 */ 1816 if (cert.getNotAfter().getTime() < crl.getThisUpdate().getTime()) 1817 { 1818 throw new AnnotatedException("No valid CRL for current time found."); 1819 } 1820 } 1821 1822 RFC3280CertPathUtilities.processCRLB1(dp, cert, crl); 1823 1824 // (b) (2) 1825 RFC3280CertPathUtilities.processCRLB2(dp, cert, crl); 1826 1827 // (c) 1828 RFC3280CertPathUtilities.processCRLC(deltaCRL, crl, paramsPKIX); 1829 1830 // (i) 1831 RFC3280CertPathUtilities.processCRLI(validDate, deltaCRL, cert, certStatus, paramsPKIX); 1832 1833 // (j) 1834 RFC3280CertPathUtilities.processCRLJ(validDate, crl, cert, certStatus); 1835 1836 // (k) 1837 if (certStatus.getCertStatus() == CRLReason.removeFromCRL) 1838 { 1839 certStatus.setCertStatus(CertStatus.UNREVOKED); 1840 } 1841 1842 // update reasons mask 1843 reasonMask.addReasons(interimReasonsMask); 1844 1845 Set criticalExtensions = crl.getCriticalExtensionOIDs(); 1846 if (criticalExtensions != null) 1847 { 1848 criticalExtensions = new HashSet(criticalExtensions); 1849 criticalExtensions.remove(X509Extensions.IssuingDistributionPoint.getId()); 1850 criticalExtensions.remove(X509Extensions.DeltaCRLIndicator.getId()); 1851 1852 if (!criticalExtensions.isEmpty()) 1853 { 1854 throw new AnnotatedException("CRL contains unsupported critical extensions."); 1855 } 1856 } 1857 1858 if (deltaCRL != null) 1859 { 1860 criticalExtensions = deltaCRL.getCriticalExtensionOIDs(); 1861 if (criticalExtensions != null) 1862 { 1863 criticalExtensions = new HashSet(criticalExtensions); 1864 criticalExtensions.remove(X509Extensions.IssuingDistributionPoint.getId()); 1865 criticalExtensions.remove(X509Extensions.DeltaCRLIndicator.getId()); 1866 if (!criticalExtensions.isEmpty()) 1867 { 1868 throw new AnnotatedException("Delta CRL contains unsupported critical extension."); 1869 } 1870 } 1871 } 1872 1873 validCrlFound = true; 1874 } 1875 catch (AnnotatedException e) 1876 { 1877 lastException = e; 1878 } 1879 } 1880 if (!validCrlFound) 1881 { 1882 throw lastException; 1883 } 1884 } 1885 1886 /** 1887 * Checks a certificate if it is revoked. 1888 * 1889 * @param paramsPKIX PKIX parameters. 1890 * @param cert Certificate to check if it is revoked. 1891 * @param validDate The date when the certificate revocation status should be 1892 * checked. 1893 * @param sign The issuer certificate of the certificate <code>cert</code>. 1894 * @param workingPublicKey The public key of the issuer certificate <code>sign</code>. 1895 * @param certPathCerts The certificates of the certification path. 1896 * @throws AnnotatedException if the certificate is revoked or the status cannot be checked 1897 * or some error occurs. 1898 */ 1899 protected static void checkCRLs( 1900 ExtendedPKIXParameters paramsPKIX, 1901 X509Certificate cert, 1902 Date validDate, 1903 X509Certificate sign, 1904 PublicKey workingPublicKey, 1905 List certPathCerts) 1906 throws AnnotatedException 1907 { 1908 AnnotatedException lastException = null; 1909 CRLDistPoint crldp = null; 1910 try 1911 { 1912 crldp = CRLDistPoint.getInstance(CertPathValidatorUtilities.getExtensionValue(cert, 1913 RFC3280CertPathUtilities.CRL_DISTRIBUTION_POINTS)); 1914 } 1915 catch (Exception e) 1916 { 1917 throw new AnnotatedException("CRL distribution point extension could not be read.", e); 1918 } 1919 try 1920 { 1921 CertPathValidatorUtilities.addAdditionalStoresFromCRLDistributionPoint(crldp, paramsPKIX); 1922 } 1923 catch (AnnotatedException e) 1924 { 1925 throw new AnnotatedException( 1926 "No additional CRL locations could be decoded from CRL distribution point extension.", e); 1927 } 1928 CertStatus certStatus = new CertStatus(); 1929 ReasonsMask reasonsMask = new ReasonsMask(); 1930 1931 boolean validCrlFound = false; 1932 // for each distribution point 1933 if (crldp != null) 1934 { 1935 DistributionPoint dps[] = null; 1936 try 1937 { 1938 dps = crldp.getDistributionPoints(); 1939 } 1940 catch (Exception e) 1941 { 1942 throw new AnnotatedException("Distribution points could not be read.", e); 1943 } 1944 if (dps != null) 1945 { 1946 for (int i = 0; i < dps.length && certStatus.getCertStatus() == CertStatus.UNREVOKED && !reasonsMask.isAllReasons(); i++) 1947 { 1948 ExtendedPKIXParameters paramsPKIXClone = (ExtendedPKIXParameters)paramsPKIX.clone(); 1949 try 1950 { 1951 checkCRL(dps[i], paramsPKIXClone, cert, validDate, sign, workingPublicKey, certStatus, reasonsMask, certPathCerts); 1952 validCrlFound = true; 1953 } 1954 catch (AnnotatedException e) 1955 { 1956 lastException = e; 1957 } 1958 } 1959 } 1960 } 1961 1962 /* 1963 * If the revocation status has not been determined, repeat the process 1964 * above with any available CRLs not specified in a distribution point 1965 * but issued by the certificate issuer. 1966 */ 1967 1968 if (certStatus.getCertStatus() == CertStatus.UNREVOKED && !reasonsMask.isAllReasons()) 1969 { 1970 try 1971 { 1972 /* 1973 * assume a DP with both the reasons and the cRLIssuer fields 1974 * omitted and a distribution point name of the certificate 1975 * issuer. 1976 */ 1977 ASN1Primitive issuer = null; 1978 try 1979 { 1980 issuer = new ASN1InputStream(CertPathValidatorUtilities.getEncodedIssuerPrincipal(cert).getEncoded()) 1981 .readObject(); 1982 } 1983 catch (Exception e) 1984 { 1985 throw new AnnotatedException("Issuer from certificate for CRL could not be reencoded.", e); 1986 } 1987 DistributionPoint dp = new DistributionPoint(new DistributionPointName(0, new GeneralNames( 1988 new GeneralName(GeneralName.directoryName, issuer))), null, null); 1989 ExtendedPKIXParameters paramsPKIXClone = (ExtendedPKIXParameters)paramsPKIX.clone(); 1990 checkCRL(dp, paramsPKIXClone, cert, validDate, sign, workingPublicKey, certStatus, reasonsMask, 1991 certPathCerts); 1992 validCrlFound = true; 1993 } 1994 catch (AnnotatedException e) 1995 { 1996 lastException = e; 1997 } 1998 } 1999 2000 if (!validCrlFound) 2001 { 2002 if (lastException instanceof AnnotatedException) 2003 { 2004 throw lastException; 2005 } 2006 2007 throw new AnnotatedException("No valid CRL found.", lastException); 2008 } 2009 if (certStatus.getCertStatus() != CertStatus.UNREVOKED) 2010 { 2011 String message = "Certificate revocation after " + certStatus.getRevocationDate(); 2012 message += ", reason: " + crlReasons[certStatus.getCertStatus()]; 2013 throw new AnnotatedException(message); 2014 } 2015 if (!reasonsMask.isAllReasons() && certStatus.getCertStatus() == CertStatus.UNREVOKED) 2016 { 2017 certStatus.setCertStatus(CertStatus.UNDETERMINED); 2018 } 2019 if (certStatus.getCertStatus() == CertStatus.UNDETERMINED) 2020 { 2021 throw new AnnotatedException("Certificate status could not be determined."); 2022 } 2023 } 2024 2025 protected static int prepareNextCertJ( 2026 CertPath certPath, 2027 int index, 2028 int inhibitAnyPolicy) 2029 throws CertPathValidatorException 2030 { 2031 List certs = certPath.getCertificates(); 2032 X509Certificate cert = (X509Certificate)certs.get(index); 2033 // 2034 // (j) 2035 // 2036 DERInteger iap = null; 2037 try 2038 { 2039 iap = DERInteger.getInstance(CertPathValidatorUtilities.getExtensionValue(cert, 2040 RFC3280CertPathUtilities.INHIBIT_ANY_POLICY)); 2041 } 2042 catch (Exception e) 2043 { 2044 throw new ExtCertPathValidatorException("Inhibit any-policy extension cannot be decoded.", e, certPath, 2045 index); 2046 } 2047 2048 if (iap != null) 2049 { 2050 int _inhibitAnyPolicy = iap.getValue().intValue(); 2051 2052 if (_inhibitAnyPolicy < inhibitAnyPolicy) 2053 { 2054 return _inhibitAnyPolicy; 2055 } 2056 } 2057 return inhibitAnyPolicy; 2058 } 2059 2060 protected static void prepareNextCertK( 2061 CertPath certPath, 2062 int index) 2063 throws CertPathValidatorException 2064 { 2065 List certs = certPath.getCertificates(); 2066 X509Certificate cert = (X509Certificate)certs.get(index); 2067 // 2068 // (k) 2069 // 2070 BasicConstraints bc = null; 2071 try 2072 { 2073 bc = BasicConstraints.getInstance(CertPathValidatorUtilities.getExtensionValue(cert, 2074 RFC3280CertPathUtilities.BASIC_CONSTRAINTS)); 2075 } 2076 catch (Exception e) 2077 { 2078 throw new ExtCertPathValidatorException("Basic constraints extension cannot be decoded.", e, certPath, 2079 index); 2080 } 2081 if (bc != null) 2082 { 2083 if (!(bc.isCA())) 2084 { 2085 throw new CertPathValidatorException("Not a CA certificate"); 2086 } 2087 } 2088 else 2089 { 2090 throw new CertPathValidatorException("Intermediate certificate lacks BasicConstraints"); 2091 } 2092 } 2093 2094 protected static int prepareNextCertL( 2095 CertPath certPath, 2096 int index, 2097 int maxPathLength) 2098 throws CertPathValidatorException 2099 { 2100 List certs = certPath.getCertificates(); 2101 X509Certificate cert = (X509Certificate)certs.get(index); 2102 // 2103 // (l) 2104 // 2105 if (!CertPathValidatorUtilities.isSelfIssued(cert)) 2106 { 2107 if (maxPathLength <= 0) 2108 { 2109 throw new ExtCertPathValidatorException("Max path length not greater than zero", null, certPath, index); 2110 } 2111 2112 return maxPathLength - 1; 2113 } 2114 return maxPathLength; 2115 } 2116 2117 protected static int prepareNextCertM( 2118 CertPath certPath, 2119 int index, 2120 int maxPathLength) 2121 throws CertPathValidatorException 2122 { 2123 List certs = certPath.getCertificates(); 2124 X509Certificate cert = (X509Certificate)certs.get(index); 2125 2126 // 2127 // (m) 2128 // 2129 BasicConstraints bc = null; 2130 try 2131 { 2132 bc = BasicConstraints.getInstance(CertPathValidatorUtilities.getExtensionValue(cert, 2133 RFC3280CertPathUtilities.BASIC_CONSTRAINTS)); 2134 } 2135 catch (Exception e) 2136 { 2137 throw new ExtCertPathValidatorException("Basic constraints extension cannot be decoded.", e, certPath, 2138 index); 2139 } 2140 if (bc != null) 2141 { 2142 BigInteger _pathLengthConstraint = bc.getPathLenConstraint(); 2143 2144 if (_pathLengthConstraint != null) 2145 { 2146 int _plc = _pathLengthConstraint.intValue(); 2147 2148 if (_plc < maxPathLength) 2149 { 2150 return _plc; 2151 } 2152 } 2153 } 2154 return maxPathLength; 2155 } 2156 2157 protected static void prepareNextCertN( 2158 CertPath certPath, 2159 int index) 2160 throws CertPathValidatorException 2161 { 2162 List certs = certPath.getCertificates(); 2163 X509Certificate cert = (X509Certificate)certs.get(index); 2164 2165 // 2166 // (n) 2167 // 2168 boolean[] _usage = cert.getKeyUsage(); 2169 2170 if ((_usage != null) && !_usage[RFC3280CertPathUtilities.KEY_CERT_SIGN]) 2171 { 2172 throw new ExtCertPathValidatorException( 2173 "Issuer certificate keyusage extension is critical and does not permit key signing.", null, 2174 certPath, index); 2175 } 2176 } 2177 2178 protected static void prepareNextCertO( 2179 CertPath certPath, 2180 int index, 2181 Set criticalExtensions, 2182 List pathCheckers) 2183 throws CertPathValidatorException 2184 { 2185 List certs = certPath.getCertificates(); 2186 X509Certificate cert = (X509Certificate)certs.get(index); 2187 // 2188 // (o) 2189 // 2190 2191 Iterator tmpIter; 2192 tmpIter = pathCheckers.iterator(); 2193 while (tmpIter.hasNext()) 2194 { 2195 try 2196 { 2197 ((PKIXCertPathChecker)tmpIter.next()).check(cert, criticalExtensions); 2198 } 2199 catch (CertPathValidatorException e) 2200 { 2201 throw new CertPathValidatorException(e.getMessage(), e.getCause(), certPath, index); 2202 } 2203 } 2204 if (!criticalExtensions.isEmpty()) 2205 { 2206 throw new ExtCertPathValidatorException("Certificate has unsupported critical extension.", null, certPath, 2207 index); 2208 } 2209 } 2210 2211 protected static int prepareNextCertH1( 2212 CertPath certPath, 2213 int index, 2214 int explicitPolicy) 2215 { 2216 List certs = certPath.getCertificates(); 2217 X509Certificate cert = (X509Certificate)certs.get(index); 2218 // 2219 // (h) 2220 // 2221 if (!CertPathValidatorUtilities.isSelfIssued(cert)) 2222 { 2223 // 2224 // (1) 2225 // 2226 if (explicitPolicy != 0) 2227 { 2228 return explicitPolicy - 1; 2229 } 2230 } 2231 return explicitPolicy; 2232 } 2233 2234 protected static int prepareNextCertH2( 2235 CertPath certPath, 2236 int index, 2237 int policyMapping) 2238 { 2239 List certs = certPath.getCertificates(); 2240 X509Certificate cert = (X509Certificate)certs.get(index); 2241 // 2242 // (h) 2243 // 2244 if (!CertPathValidatorUtilities.isSelfIssued(cert)) 2245 { 2246 // 2247 // (2) 2248 // 2249 if (policyMapping != 0) 2250 { 2251 return policyMapping - 1; 2252 } 2253 } 2254 return policyMapping; 2255 } 2256 2257 protected static int prepareNextCertH3( 2258 CertPath certPath, 2259 int index, 2260 int inhibitAnyPolicy) 2261 { 2262 List certs = certPath.getCertificates(); 2263 X509Certificate cert = (X509Certificate)certs.get(index); 2264 // 2265 // (h) 2266 // 2267 if (!CertPathValidatorUtilities.isSelfIssued(cert)) 2268 { 2269 // 2270 // (3) 2271 // 2272 if (inhibitAnyPolicy != 0) 2273 { 2274 return inhibitAnyPolicy - 1; 2275 } 2276 } 2277 return inhibitAnyPolicy; 2278 } 2279 2280 protected static final String[] crlReasons = new String[] 2281 { 2282 "unspecified", 2283 "keyCompromise", 2284 "cACompromise", 2285 "affiliationChanged", 2286 "superseded", 2287 "cessationOfOperation", 2288 "certificateHold", 2289 "unknown", 2290 "removeFromCRL", 2291 "privilegeWithdrawn", 2292 "aACompromise"}; 2293 2294 protected static int wrapupCertA( 2295 int explicitPolicy, 2296 X509Certificate cert) 2297 { 2298 // 2299 // (a) 2300 // 2301 if (!CertPathValidatorUtilities.isSelfIssued(cert) && (explicitPolicy != 0)) 2302 { 2303 explicitPolicy--; 2304 } 2305 return explicitPolicy; 2306 } 2307 2308 protected static int wrapupCertB( 2309 CertPath certPath, 2310 int index, 2311 int explicitPolicy) 2312 throws CertPathValidatorException 2313 { 2314 List certs = certPath.getCertificates(); 2315 X509Certificate cert = (X509Certificate)certs.get(index); 2316 // 2317 // (b) 2318 // 2319 int tmpInt; 2320 ASN1Sequence pc = null; 2321 try 2322 { 2323 pc = DERSequence.getInstance(CertPathValidatorUtilities.getExtensionValue(cert, 2324 RFC3280CertPathUtilities.POLICY_CONSTRAINTS)); 2325 } 2326 catch (AnnotatedException e) 2327 { 2328 throw new ExtCertPathValidatorException("Policy constraints could not be decoded.", e, certPath, index); 2329 } 2330 if (pc != null) 2331 { 2332 Enumeration policyConstraints = pc.getObjects(); 2333 2334 while (policyConstraints.hasMoreElements()) 2335 { 2336 ASN1TaggedObject constraint = (ASN1TaggedObject)policyConstraints.nextElement(); 2337 switch (constraint.getTagNo()) 2338 { 2339 case 0: 2340 try 2341 { 2342 tmpInt = DERInteger.getInstance(constraint, false).getValue().intValue(); 2343 } 2344 catch (Exception e) 2345 { 2346 throw new ExtCertPathValidatorException( 2347 "Policy constraints requireExplicitPolicy field could not be decoded.", e, certPath, 2348 index); 2349 } 2350 if (tmpInt == 0) 2351 { 2352 return 0; 2353 } 2354 break; 2355 } 2356 } 2357 } 2358 return explicitPolicy; 2359 } 2360 2361 protected static void wrapupCertF( 2362 CertPath certPath, 2363 int index, 2364 List pathCheckers, 2365 Set criticalExtensions) 2366 throws CertPathValidatorException 2367 { 2368 List certs = certPath.getCertificates(); 2369 X509Certificate cert = (X509Certificate)certs.get(index); 2370 Iterator tmpIter; 2371 tmpIter = pathCheckers.iterator(); 2372 while (tmpIter.hasNext()) 2373 { 2374 try 2375 { 2376 ((PKIXCertPathChecker)tmpIter.next()).check(cert, criticalExtensions); 2377 } 2378 catch (CertPathValidatorException e) 2379 { 2380 throw new ExtCertPathValidatorException("Additional certificate path checker failed.", e, certPath, 2381 index); 2382 } 2383 } 2384 2385 if (!criticalExtensions.isEmpty()) 2386 { 2387 throw new ExtCertPathValidatorException("Certificate has unsupported critical extension", null, certPath, 2388 index); 2389 } 2390 } 2391 2392 protected static PKIXPolicyNode wrapupCertG( 2393 CertPath certPath, 2394 ExtendedPKIXParameters paramsPKIX, 2395 Set userInitialPolicySet, 2396 int index, 2397 List[] policyNodes, 2398 PKIXPolicyNode validPolicyTree, 2399 Set acceptablePolicies) 2400 throws CertPathValidatorException 2401 { 2402 int n = certPath.getCertificates().size(); 2403 // 2404 // (g) 2405 // 2406 PKIXPolicyNode intersection; 2407 2408 // 2409 // (g) (i) 2410 // 2411 if (validPolicyTree == null) 2412 { 2413 if (paramsPKIX.isExplicitPolicyRequired()) 2414 { 2415 throw new ExtCertPathValidatorException("Explicit policy requested but none available.", null, 2416 certPath, index); 2417 } 2418 intersection = null; 2419 } 2420 else if (CertPathValidatorUtilities.isAnyPolicy(userInitialPolicySet)) // (g) 2421 // (ii) 2422 { 2423 if (paramsPKIX.isExplicitPolicyRequired()) 2424 { 2425 if (acceptablePolicies.isEmpty()) 2426 { 2427 throw new ExtCertPathValidatorException("Explicit policy requested but none available.", null, 2428 certPath, index); 2429 } 2430 else 2431 { 2432 Set _validPolicyNodeSet = new HashSet(); 2433 2434 for (int j = 0; j < policyNodes.length; j++) 2435 { 2436 List _nodeDepth = policyNodes[j]; 2437 2438 for (int k = 0; k < _nodeDepth.size(); k++) 2439 { 2440 PKIXPolicyNode _node = (PKIXPolicyNode)_nodeDepth.get(k); 2441 2442 if (RFC3280CertPathUtilities.ANY_POLICY.equals(_node.getValidPolicy())) 2443 { 2444 Iterator _iter = _node.getChildren(); 2445 while (_iter.hasNext()) 2446 { 2447 _validPolicyNodeSet.add(_iter.next()); 2448 } 2449 } 2450 } 2451 } 2452 2453 Iterator _vpnsIter = _validPolicyNodeSet.iterator(); 2454 while (_vpnsIter.hasNext()) 2455 { 2456 PKIXPolicyNode _node = (PKIXPolicyNode)_vpnsIter.next(); 2457 String _validPolicy = _node.getValidPolicy(); 2458 2459 if (!acceptablePolicies.contains(_validPolicy)) 2460 { 2461 // validPolicyTree = 2462 // removePolicyNode(validPolicyTree, policyNodes, 2463 // _node); 2464 } 2465 } 2466 if (validPolicyTree != null) 2467 { 2468 for (int j = (n - 1); j >= 0; j--) 2469 { 2470 List nodes = policyNodes[j]; 2471 2472 for (int k = 0; k < nodes.size(); k++) 2473 { 2474 PKIXPolicyNode node = (PKIXPolicyNode)nodes.get(k); 2475 if (!node.hasChildren()) 2476 { 2477 validPolicyTree = CertPathValidatorUtilities.removePolicyNode(validPolicyTree, 2478 policyNodes, node); 2479 } 2480 } 2481 } 2482 } 2483 } 2484 } 2485 2486 intersection = validPolicyTree; 2487 } 2488 else 2489 { 2490 // 2491 // (g) (iii) 2492 // 2493 // This implementation is not exactly same as the one described in 2494 // RFC3280. 2495 // However, as far as the validation result is concerned, both 2496 // produce 2497 // adequate result. The only difference is whether AnyPolicy is 2498 // remain 2499 // in the policy tree or not. 2500 // 2501 // (g) (iii) 1 2502 // 2503 Set _validPolicyNodeSet = new HashSet(); 2504 2505 for (int j = 0; j < policyNodes.length; j++) 2506 { 2507 List _nodeDepth = policyNodes[j]; 2508 2509 for (int k = 0; k < _nodeDepth.size(); k++) 2510 { 2511 PKIXPolicyNode _node = (PKIXPolicyNode)_nodeDepth.get(k); 2512 2513 if (RFC3280CertPathUtilities.ANY_POLICY.equals(_node.getValidPolicy())) 2514 { 2515 Iterator _iter = _node.getChildren(); 2516 while (_iter.hasNext()) 2517 { 2518 PKIXPolicyNode _c_node = (PKIXPolicyNode)_iter.next(); 2519 if (!RFC3280CertPathUtilities.ANY_POLICY.equals(_c_node.getValidPolicy())) 2520 { 2521 _validPolicyNodeSet.add(_c_node); 2522 } 2523 } 2524 } 2525 } 2526 } 2527 2528 // 2529 // (g) (iii) 2 2530 // 2531 Iterator _vpnsIter = _validPolicyNodeSet.iterator(); 2532 while (_vpnsIter.hasNext()) 2533 { 2534 PKIXPolicyNode _node = (PKIXPolicyNode)_vpnsIter.next(); 2535 String _validPolicy = _node.getValidPolicy(); 2536 2537 if (!userInitialPolicySet.contains(_validPolicy)) 2538 { 2539 validPolicyTree = CertPathValidatorUtilities.removePolicyNode(validPolicyTree, policyNodes, _node); 2540 } 2541 } 2542 2543 // 2544 // (g) (iii) 4 2545 // 2546 if (validPolicyTree != null) 2547 { 2548 for (int j = (n - 1); j >= 0; j--) 2549 { 2550 List nodes = policyNodes[j]; 2551 2552 for (int k = 0; k < nodes.size(); k++) 2553 { 2554 PKIXPolicyNode node = (PKIXPolicyNode)nodes.get(k); 2555 if (!node.hasChildren()) 2556 { 2557 validPolicyTree = CertPathValidatorUtilities.removePolicyNode(validPolicyTree, policyNodes, 2558 node); 2559 } 2560 } 2561 } 2562 } 2563 2564 intersection = validPolicyTree; 2565 } 2566 return intersection; 2567 } 2568 2569} 2570