/* X509CRLSelector.java -- selects X.509 CRLs by criteria. Copyright (C) 2004 Free Software Foundation, Inc. This file is part of GNU Classpath. GNU Classpath is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 2, or (at your option) any later version. GNU Classpath is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details. You should have received a copy of the GNU General Public License along with GNU Classpath; see the file COPYING. If not, write to the Free Software Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA. Linking this library statically or dynamically with other modules is making a combined work based on this library. Thus, the terms and conditions of the GNU General Public License cover the whole combination. As a special exception, the copyright holders of this library give you permission to link this library with independent modules to produce an executable, regardless of the license terms of these independent modules, and to copy and distribute the resulting executable under terms of your choice, provided that you also meet, for each linked independent module, the terms and conditions of the license of that module. An independent module is a module which is not derived from or based on this library. If you modify this library, you may extend this exception to your version of the library, but you are not obligated to do so. If you do not wish to do so, delete this exception statement from your version. */ package java.security.cert; import java.io.IOException; import java.io.InputStream; import java.math.BigInteger; import java.security.AccessController; import java.util.ArrayList; import java.util.Collection; import java.util.Collections; import java.util.Date; import java.util.Iterator; import java.util.LinkedList; import java.util.List; import javax.security.auth.x500.X500Principal; import gnu.java.security.action.GetPropertyAction; import gnu.java.security.der.DERReader; import gnu.java.security.der.DERValue; /** * A class for matching X.509 certificate revocation lists by criteria. * *

Use of this class requires extensive knowledge of the Internet * Engineering Task Force's Public Key Infrastructure (X.509). The primary * document describing this standard is RFC 3280: Internet X.509 * Public Key Infrastructure Certificate and Certificate Revocation List * (CRL) Profile. * *

Note that this class is not thread-safe. If multiple threads will * use or modify this class then they need to synchronize on the object. * * @author Casey Marshall (csm@gnu.org) */ public class X509CRLSelector implements CRLSelector, Cloneable { // Fields. // ------------------------------------------------------------------------- private static final String CRL_NUMBER_ID = "2.5.29.20"; private List issuerNames; private BigInteger maxCrlNumber; private BigInteger minCrlNumber; private Date date; private X509Certificate cert; // Constructor. // ------------------------------------------------------------------------- /** * Creates a new CRL selector with no criteria enabled; i.e., every CRL * will be matched. */ public X509CRLSelector() { } // Instance methods. // ------------------------------------------------------------------------- /** * Add an issuer name to the set of issuer names criteria, as the DER * encoded form. * * @param name The name to add, as DER bytes. * @throws IOException If the argument is not a valid DER-encoding. */ public void addIssuerName(byte[] name) throws IOException { X500Principal p = null; try { p = new X500Principal(name); } catch (IllegalArgumentException iae) { IOException ioe = new IOException("malformed name"); ioe.initCause(iae); throw ioe; } if (issuerNames == null) issuerNames = new LinkedList(); issuerNames.add(p); } /** * Add an issuer name to the set of issuer names criteria, as a * String representation. * * @param name The name to add. * @throws IOException If the argument is not a valid name. */ public void addIssuerName(String name) throws IOException { X500Principal p = null; try { p = new X500Principal(name); } catch (IllegalArgumentException iae) { IOException ioe = new IOException("malformed name: " + name); ioe.initCause(iae); throw ioe; } if (issuerNames == null) issuerNames = new LinkedList(); issuerNames.add(p); } /** * Sets the issuer names criterion. Pass null to clear this * value. CRLs matched by this selector must have an issuer name in this * set. * * @param names The issuer names. * @throws IOException If any of the elements in the collection is not * a valid name. */ public void setIssuerNames(Collection names) throws IOException { if (names == null) { issuerNames = null; return; } List l = new ArrayList(names.size()); for (Iterator it = names.iterator(); it.hasNext(); ) { Object o = it.next(); if (o instanceof X500Principal) l.add(o); else if (o instanceof String) { try { l.add(new X500Principal((String) o)); } catch (IllegalArgumentException iae) { IOException ioe = new IOException("malformed name: " + o); ioe.initCause(iae); throw ioe; } } else if (o instanceof byte[]) { try { l.add(new X500Principal((byte[]) o)); } catch (IllegalArgumentException iae) { IOException ioe = new IOException("malformed name"); ioe.initCause(iae); throw ioe; } } else if (o instanceof InputStream) { try { l.add(new X500Principal((InputStream) o)); } catch (IllegalArgumentException iae) { IOException ioe = new IOException("malformed name"); ioe.initCause(iae); throw ioe; } } else throw new IOException("not a valid name: " + (o != null ? o.getClass().getName() : "null")); } issuerNames = l; } /** * Returns the set of issuer names that are matched by this selector, * or null if this criteria is not set. The returned * collection is not modifiable. * * @return The set of issuer names. */ public Collection getIssuerNames() { if (issuerNames != null) return Collections.unmodifiableList(issuerNames); else return null; } /** * Returns the maximum value of the CRLNumber extension present in * CRLs matched by this selector, or null if this * criteria is not set. * * @return The maximum CRL number. */ public BigInteger getMaxCRL() { return maxCrlNumber; } /** * Returns the minimum value of the CRLNumber extension present in * CRLs matched by this selector, or null if this * criteria is not set. * * @return The minimum CRL number. */ public BigInteger getMinCRL() { return minCrlNumber; } /** * Sets the maximum value of the CRLNumber extension present in CRLs * matched by this selector. Specify null to clear this * criterion. * * @param maxCrlNumber The maximum CRL number. */ public void setMaxCRLNumber(BigInteger maxCrlNumber) { this.maxCrlNumber = maxCrlNumber; } /** * Sets the minimum value of the CRLNumber extension present in CRLs * matched by this selector. Specify null to clear this * criterion. * * @param minCrlNumber The minimum CRL number. */ public void setMinCRLNumber(BigInteger minCrlNumber) { this.minCrlNumber = minCrlNumber; } /** * Returns the date when this CRL must be valid; that is, the date * must be after the thisUpdate date, but before the nextUpdate date. * Returns null if this criterion is not set. * * @return The date. */ public Date getDateAndTime() { return date != null ? (Date) date.clone() : null; } /** * Sets the date at which this CRL must be valid. Specify * null to clear this criterion. * * @param date The date. */ public void setDateAndTime(Date date) { this.date = date != null ? (Date) date.clone() : null; } /** * Returns the certificate being checked, or null if this * value is not set. * * @return The certificate. */ public X509Certificate getCertificateChecking() { return cert; } /** * Sets the certificate being checked. This is not a criterion, but * info used by certificate store implementations to aid in searching. * * @param cert The certificate. */ public void setCertificateChecking(X509Certificate cert) { this.cert = cert; } /** * Returns a string representation of this selector. The string will * only describe the enabled criteria, so if none are enabled this will * return a string that contains little else besides the class name. * * @return The string. */ public String toString() { StringBuffer str = new StringBuffer(X509CRLSelector.class.getName()); GetPropertyAction getProp = new GetPropertyAction("line.separator"); String nl = (String) AccessController.doPrivileged(getProp); String eol = ";" + nl; str.append(" {").append(nl); if (issuerNames != null) str.append(" issuer names = ").append(issuerNames).append(eol); if (maxCrlNumber != null) str.append(" max CRL = ").append(maxCrlNumber).append(eol); if (minCrlNumber != null) str.append(" min CRL = ").append(minCrlNumber).append(eol); if (date != null) str.append(" date = ").append(date).append(eol); if (cert != null) str.append(" certificate = ").append(cert).append(eol); str.append("}").append(nl); return str.toString(); } /** * Checks a CRL against the criteria of this selector, returning * true if the given CRL matches all the criteria. * * @param _crl The CRL being checked. * @return True if the CRL matches, false otherwise. */ public boolean match(CRL _crl) { if (!(_crl instanceof X509CRL)) return false; X509CRL crl = (X509CRL) _crl; if (issuerNames != null) { if (!issuerNames.contains(crl.getIssuerX500Principal())) return false; } BigInteger crlNumber = null; if (maxCrlNumber != null) { try { byte[] b = crl.getExtensionValue(CRL_NUMBER_ID); if (b == null) return false; try { DERValue val = DERReader.read(b); if (!(val.getValue() instanceof BigInteger)) return false; crlNumber = (BigInteger) val.getValue(); } catch (IOException ioe) { return false; } if (maxCrlNumber.compareTo(crlNumber) < 0) return false; } catch (CertificateParsingException cpe) { return false; } } if (minCrlNumber != null) { try { if (crlNumber == null) { byte[] b = crl.getExtensionValue(CRL_NUMBER_ID); if (b == null) return false; try { DERValue val = DERReader.read(b); if (!(val.getValue() instanceof BigInteger)) return false; crlNumber = (BigInteger) val.getValue(); } catch (IOException ioe) { return false; } } if (minCrlNumber.compareTo(crlNumber) > 0) return false; } catch (CertificateParsingException cpe) { return false; } } if (date != null) { if (date.compareTo(crl.getThisUpdate()) < 0 || date.compareTo(crl.getNextUpdate()) > 0) return false; } return true; } /** * Returns a copy of this object. * * @return The copy. */ public Object clone() { try { return super.clone(); } catch (CloneNotSupportedException shouldNotHappen) { throw new Error(shouldNotHappen); } } }