Skip to content

Commit f9ed7eb

Browse files
dghgitdghgit
committed
update
1 parent 9417408 commit f9ed7eb

7 files changed

Lines changed: 1222 additions & 0 deletions

File tree

‎prov/src/main/jdk1.2/org/bouncycastle/jcajce/PKIXCRLStoreSelector.java‎

Lines changed: 313 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,313 @@
1+
package org.bouncycastle.jcajce;
2+
3+
import java.math.BigInteger;
4+
import java.security.cert.CRL;
5+
import java.security.cert.CRLSelector;
6+
import java.security.cert.CertStore;
7+
import java.security.cert.CertStoreException;
8+
import java.security.cert.X509CRL;
9+
import java.security.cert.X509CRLSelector;
10+
import java.security.cert.X509Certificate;
11+
import java.util.Collection;
12+
13+
import org.bouncycastle.asn1.ASN1Integer;
14+
import org.bouncycastle.asn1.ASN1OctetString;
15+
import org.bouncycastle.asn1.x509.Extension;
16+
import org.bouncycastle.util.Arrays;
17+
import org.bouncycastle.util.Selector;
18+
19+
/**
20+
* This class is a Selector implementation for X.509 certificate revocation
21+
* lists.
22+
*
23+
* @see org.bouncycastle.util.Selector
24+
*/
25+
public class PKIXCRLStoreSelector
26+
implements Selector
27+
{
28+
public static class Builder
29+
{
30+
private CRLSelector baseSelector;
31+
32+
private boolean deltaCRLIndicator = false;
33+
private boolean completeCRLEnabled = false;
34+
private BigInteger maxBaseCRLNumber = null;
35+
private byte[] issuingDistributionPoint = null;
36+
private boolean issuingDistributionPointEnabled = false;
37+
38+
public Builder(CRLSelector certSelector)
39+
{
40+
this.baseSelector = (CRLSelector)certSelector.clone();
41+
}
42+
43+
44+
/**
45+
* If set to <code>true</code> only complete CRLs are returned.
46+
* <p>
47+
* {@link #setCompleteCRLEnabled(boolean)} and
48+
* {@link #setDeltaCRLIndicatorEnabled(boolean)} excluded each other.
49+
*
50+
* @param completeCRLEnabled <code>true</code> if only complete CRLs
51+
* should be returned.
52+
*/
53+
public Builder setCompleteCRLEnabled(boolean completeCRLEnabled)
54+
{
55+
this.completeCRLEnabled = completeCRLEnabled;
56+
57+
return this;
58+
}
59+
60+
/**
61+
* If this is set to <code>true</code> the CRL reported contains the delta
62+
* CRL indicator CRL extension.
63+
* <p>
64+
* {@link #setCompleteCRLEnabled(boolean)} and
65+
* {@link #setDeltaCRLIndicatorEnabled(boolean)} excluded each other.
66+
*
67+
* @param deltaCRLIndicator <code>true</code> if the delta CRL indicator
68+
* extension must be in the CRL.
69+
*/
70+
public Builder setDeltaCRLIndicatorEnabled(boolean deltaCRLIndicator)
71+
{
72+
this.deltaCRLIndicator = deltaCRLIndicator;
73+
74+
return this;
75+
}
76+
77+
/**
78+
* Sets the maximum base CRL number. Setting to <code>null</code> disables
79+
* this cheack.
80+
* <p>
81+
* This is only meaningful for delta CRLs. Complete CRLs must have a CRL
82+
* number which is greater or equal than the base number of the
83+
* corresponding CRL.
84+
*
85+
* @param maxBaseCRLNumber The maximum base CRL number to set.
86+
*/
87+
public void setMaxBaseCRLNumber(BigInteger maxBaseCRLNumber)
88+
{
89+
this.maxBaseCRLNumber = maxBaseCRLNumber;
90+
}
91+
92+
/**
93+
* Enables or disables the issuing distribution point check.
94+
*
95+
* @param issuingDistributionPointEnabled <code>true</code> to enable the
96+
* issuing distribution point check.
97+
*/
98+
public void setIssuingDistributionPointEnabled(
99+
boolean issuingDistributionPointEnabled)
100+
{
101+
this.issuingDistributionPointEnabled = issuingDistributionPointEnabled;
102+
}
103+
104+
/**
105+
* Sets the issuing distribution point.
106+
* <p>
107+
* The issuing distribution point extension is a CRL extension which
108+
* identifies the scope and the distribution point of a CRL. The scope
109+
* contains among others information about revocation reasons contained in
110+
* the CRL. Delta CRLs and complete CRLs must have matching issuing
111+
* distribution points.
112+
* <p>
113+
* The byte array is cloned to protect against subsequent modifications.
114+
* <p>
115+
* You must also enable or disable this criteria with
116+
* {@link #setIssuingDistributionPointEnabled(boolean)}.
117+
*
118+
* @param issuingDistributionPoint The issuing distribution point to set.
119+
* This is the DER encoded OCTET STRING extension value.
120+
* @see #getIssuingDistributionPoint()
121+
*/
122+
public void setIssuingDistributionPoint(byte[] issuingDistributionPoint)
123+
{
124+
this.issuingDistributionPoint = Arrays.clone(issuingDistributionPoint);
125+
}
126+
127+
public PKIXCRLStoreSelector build()
128+
{
129+
return new PKIXCRLStoreSelector(this);
130+
}
131+
}
132+
133+
private CRLSelector baseSelector;
134+
private boolean deltaCRLIndicator;
135+
private boolean completeCRLEnabled;
136+
private BigInteger maxBaseCRLNumber;
137+
private byte[] issuingDistributionPoint;
138+
private boolean issuingDistributionPointEnabled;
139+
140+
private PKIXCRLStoreSelector(Builder baseBuilder)
141+
{
142+
this.baseSelector = baseBuilder.baseSelector;
143+
this.deltaCRLIndicator = baseBuilder.deltaCRLIndicator;
144+
this.completeCRLEnabled = baseBuilder.completeCRLEnabled;
145+
this.maxBaseCRLNumber = baseBuilder.maxBaseCRLNumber;
146+
this.issuingDistributionPoint = baseBuilder.issuingDistributionPoint;
147+
this.issuingDistributionPointEnabled = baseBuilder.issuingDistributionPointEnabled;
148+
}
149+
150+
151+
/**
152+
* Returns if the issuing distribution point criteria should be applied.
153+
* Defaults to <code>false</code>.
154+
* <p>
155+
* You may also set the issuing distribution point criteria if not a missing
156+
* issuing distribution point should be assumed.
157+
*
158+
* @return Returns if the issuing distribution point check is enabled.
159+
*/
160+
public boolean isIssuingDistributionPointEnabled()
161+
{
162+
return issuingDistributionPointEnabled;
163+
}
164+
165+
166+
167+
public boolean match(Object obj)
168+
{
169+
if (!(obj instanceof X509CRL))
170+
{
171+
return baseSelector.match((X509CRL)obj);
172+
}
173+
174+
X509CRL crl = (X509CRL)obj;
175+
ASN1Integer dci = null;
176+
try
177+
{
178+
byte[] bytes = crl
179+
.getExtensionValue(Extension.deltaCRLIndicator.getId());
180+
if (bytes != null)
181+
{
182+
dci = ASN1Integer.getInstance(ASN1OctetString.getInstance(bytes).getOctets());
183+
}
184+
}
185+
catch (Exception e)
186+
{
187+
return false;
188+
}
189+
if (isDeltaCRLIndicatorEnabled())
190+
{
191+
if (dci == null)
192+
{
193+
return false;
194+
}
195+
}
196+
if (isCompleteCRLEnabled())
197+
{
198+
if (dci != null)
199+
{
200+
return false;
201+
}
202+
}
203+
if (dci != null)
204+
{
205+
206+
if (maxBaseCRLNumber != null)
207+
{
208+
if (dci.getPositiveValue().compareTo(maxBaseCRLNumber) == 1)
209+
{
210+
return false;
211+
}
212+
}
213+
}
214+
if (issuingDistributionPointEnabled)
215+
{
216+
byte[] idp = crl
217+
.getExtensionValue(Extension.issuingDistributionPoint
218+
.getId());
219+
if (issuingDistributionPoint == null)
220+
{
221+
if (idp != null)
222+
{
223+
return false;
224+
}
225+
}
226+
else
227+
{
228+
if (!Arrays.areEqual(idp, issuingDistributionPoint))
229+
{
230+
return false;
231+
}
232+
}
233+
234+
}
235+
return baseSelector.match((CRL)obj);
236+
}
237+
238+
/**
239+
* Returns if this selector must match CRLs with the delta CRL indicator
240+
* extension set. Defaults to <code>false</code>.
241+
*
242+
* @return Returns <code>true</code> if only CRLs with the delta CRL
243+
* indicator extension are selected.
244+
*/
245+
public boolean isDeltaCRLIndicatorEnabled()
246+
{
247+
return deltaCRLIndicator;
248+
}
249+
250+
public Object clone()
251+
{
252+
return this;
253+
}
254+
255+
/**
256+
* If <code>true</code> only complete CRLs are returned. Defaults to
257+
* <code>false</code>.
258+
*
259+
* @return <code>true</code> if only complete CRLs are returned.
260+
*/
261+
public boolean isCompleteCRLEnabled()
262+
{
263+
return completeCRLEnabled;
264+
}
265+
266+
/**
267+
* Get the maximum base CRL number. Defaults to <code>null</code>.
268+
*
269+
* @return Returns the maximum base CRL number.
270+
*/
271+
public BigInteger getMaxBaseCRLNumber()
272+
{
273+
return maxBaseCRLNumber;
274+
}
275+
276+
277+
/**
278+
* Returns the issuing distribution point. Defaults to <code>null</code>,
279+
* which is a missing issuing distribution point extension.
280+
* <p>
281+
* The internal byte array is cloned before it is returned.
282+
* <p>
283+
* The criteria must be enable with Builder.setIssuingDistributionPointEnabled(boolean)}.
284+
*
285+
* @return Returns the issuing distribution point.
286+
*/
287+
public byte[] getIssuingDistributionPoint()
288+
{
289+
return Arrays.clone(issuingDistributionPoint);
290+
}
291+
292+
public X509Certificate getCertificateChecking()
293+
{
294+
return ((X509CRLSelector)baseSelector).getCertificateChecking();
295+
}
296+
297+
public static Collection getCRLs(final PKIXCRLStoreSelector selector, CertStore certStore)
298+
throws CertStoreException
299+
{
300+
return certStore.getCRLs(new CRLSelector()
301+
{
302+
public boolean match(CRL crl)
303+
{
304+
return selector.match(crl);
305+
}
306+
307+
public Object clone()
308+
{
309+
return this;
310+
}
311+
});
312+
}
313+
}

‎prov/src/main/jdk1.2/org/bouncycastle/jcajce/PKIXCertStoreSelector.java‎

Lines changed: 67 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,67 @@
1+
package org.bouncycastle.jcajce;
2+
3+
import java.security.cert.CertSelector;
4+
import java.security.cert.CertStore;
5+
import java.security.cert.CertStoreException;
6+
import java.security.cert.Certificate;
7+
import java.util.Collection;
8+
9+
import org.bouncycastle.util.Selector;
10+
11+
/**
12+
* This class is a Selector implementation for certificates.
13+
*
14+
* @see org.bouncycastle.util.Selector
15+
*/
16+
public class PKIXCertStoreSelector
17+
implements Selector
18+
{
19+
public static class Builder
20+
{
21+
private CertSelector baseSelector;
22+
23+
public Builder(CertSelector certSelector)
24+
{
25+
this.baseSelector = (CertSelector)certSelector.clone();
26+
}
27+
28+
public PKIXCertStoreSelector build()
29+
{
30+
return new PKIXCertStoreSelector(baseSelector);
31+
}
32+
}
33+
34+
private CertSelector baseSelector;
35+
36+
private PKIXCertStoreSelector(CertSelector baseSelector)
37+
{
38+
this.baseSelector = baseSelector;
39+
}
40+
41+
public boolean match(Object cert)
42+
{
43+
return baseSelector.match((Certificate)cert);
44+
}
45+
46+
public Object clone()
47+
{
48+
return new PKIXCertStoreSelector(baseSelector);
49+
}
50+
51+
public static Collection getCertificates(final PKIXCertStoreSelector selector, CertStore certStore)
52+
throws CertStoreException
53+
{
54+
return certStore.getCertificates(new CertSelector()
55+
{
56+
public boolean match(Certificate certificate)
57+
{
58+
return (selector == null) ? true : selector.match(certificate);
59+
}
60+
61+
public Object clone()
62+
{
63+
return this;
64+
}
65+
});
66+
}
67+
}

0 commit comments

Comments
 (0)