Example usage for org.bouncycastle.asn1.x500 DirectoryString getInstance

List of usage examples for org.bouncycastle.asn1.x500 DirectoryString getInstance

  1. HOME
  2. Java
  3. org.bouncycastle
  4. org.bouncycastle.asn1.x500.*
  5. DirectoryString
  6. getInstance

Introduction

In this page you can find the example usage for org.bouncycastle.asn1.x500 DirectoryString getInstance.

Prototype

public static DirectoryString getInstance(Object o)

Source Link

Usage

From source file:net.sf.keystore_explorer.crypto.x509.GeneralNameUtil.java

License:Open Source License

/**
 * Get string representation for all General Names.
 *
 * @param generalName//from   www . ja  v  a2s  . c  o  m
 *            General name
 * @return String representation of general name
 * @throws IOException
 *             If general name is invalid
 */
public static String toString(GeneralName generalName) throws IOException {

    if (generalName == null) {
        return "";
    }

    switch (generalName.getTagNo()) {
    case GeneralName.ediPartyName: {

        /* EDIPartyName ::= SEQUENCE {
         *      nameAssigner            [0]     DirectoryString OPTIONAL,
         *      partyName               [1]     DirectoryString }
         */
        ASN1Sequence ediPartyName = (ASN1Sequence) generalName.getName();

        DirectoryString nameAssigner = DirectoryString.getInstance(ediPartyName.getObjectAt(0));
        DirectoryString partyName = DirectoryString.getInstance(ediPartyName.getObjectAt(1));

        String nameAssignerStr = null;
        if (nameAssigner != null) { // Optional
            nameAssignerStr = nameAssigner.getString();
        }

        String partyNameStr = partyName.getString();
        if (nameAssignerStr != null) {
            return MessageFormat.format(res.getString("GeneralNameUtil.EdiPartyGeneralName"), nameAssignerStr,
                    partyNameStr);
        } else {
            return MessageFormat.format(res.getString("GeneralNameUtil.EdiPartyGeneralNameNoAssigner"),
                    partyNameStr);
        }
    }
    case GeneralName.otherName: {

        return parseUPN(generalName);
    }
    case GeneralName.x400Address: {
        /*
         * No support for this at the moment - just get a hex dump
         * The Oracle CertificateFactory blows up if a certificate extension contains this anyway
         */
        ASN1Encodable x400Address = generalName.getName();

        return MessageFormat.format(res.getString("GeneralNameUtil.X400AddressGeneralName"),
                HexUtil.getHexString(x400Address.toASN1Primitive().getEncoded(ASN1Encoding.DER)));
    }
    default: {
        return safeToString(generalName, true);
    }
    }
}

From source file:net.sf.keystore_explorer.crypto.x509.X509Ext.java

License:Open Source License

private String getAttributeValueString(ASN1ObjectIdentifier attributeType, ASN1Encodable attributeValue)
        throws IOException {
    // @formatter:off

    /* AttributeValue ::= ANY */

    // @formatter:on

    // Get value string for recognized attribute types
    AttributeTypeType attributeTypeType = AttributeTypeType.resolveOid(attributeType.getId());

    if (attributeTypeType == COMMON_NAME) {
        DirectoryString commonName = DirectoryString.getInstance(ASN1Primitive.fromByteArray(value));
        return commonName.getString();
    } else if (attributeTypeType == SERIAL_NUMBER) {
        DERPrintableString serialNumber = DERPrintableString.getInstance(value);
        return serialNumber.getString();
    } else if (attributeTypeType == COUNTRY_NAME) {
        DERPrintableString countryName = DERPrintableString.getInstance(value);
        return countryName.getString();
    } else if (attributeTypeType == LOCALITY_NAME) {
        DirectoryString localityName = DirectoryString.getInstance(ASN1Primitive.fromByteArray(value));
        return localityName.getString();
    } else if (attributeTypeType == STATE_NAME) {
        DirectoryString stateName = DirectoryString.getInstance(ASN1Primitive.fromByteArray(value));
        return stateName.getString();
    } else if (attributeTypeType == STREET_ADDRESS) {
        DirectoryString street = DirectoryString.getInstance(ASN1Primitive.fromByteArray(value));
        return street.getString();
    } else if (attributeTypeType == ORGANIZATION_NAME) {
        DirectoryString organizationName = DirectoryString.getInstance(ASN1Primitive.fromByteArray(value));
        return organizationName.getString();
    } else if (attributeTypeType == ORGANIZATIONAL_UNIT) {
        DirectoryString organizationalUnitName = DirectoryString
                .getInstance(ASN1Primitive.fromByteArray(value));
        return organizationalUnitName.getString();
    } else if (attributeTypeType == TITLE) {
        DirectoryString title = DirectoryString.getInstance(ASN1Primitive.fromByteArray(value));
        return title.getString();
    } else if (attributeTypeType == EMAIL_ADDRESS) {
        DERIA5String emailAddress = DERIA5String.getInstance(value);
        return emailAddress.getString();
    } else if (attributeTypeType == UNSTRUCTURED_NAME) {
        DERIA5String emailAddress = DERIA5String.getInstance(value);
        return emailAddress.getString();
    } else if (attributeTypeType == UNSTRUCTURED_ADDRESS) {
        DERPrintableString serialNumber = DERPrintableString.getInstance(value);
        return serialNumber.getString();
    } else if (attributeTypeType == USER_ID) {
        DirectoryString title = DirectoryString.getInstance(ASN1Primitive.fromByteArray(value));
        return title.getString();
    } else if (attributeTypeType == MAIL) {
        DERIA5String emailAddress = DERIA5String.getInstance(value);
        return emailAddress.getString();
    } else if (attributeTypeType == DOMAIN_COMPONENT) {
        DERIA5String domainComponent = DERIA5String.getInstance(value);
        return domainComponent.getString();
    }//from  www .  ja v  a2  s  .  com
    // Attribute type not recognized - return hex string for value
    else {
        return HexUtil.getHexString(value);
    }
}

From source file:net.sf.keystore_explorer.crypto.x509.X509Ext.java

License:Open Source License

private String getRestrictionStringValue(byte[] octets) throws IOException {

    /*   RestrictionSyntax ::= DirectoryString (SIZE(1..1024)) */

    return DirectoryString.getInstance(ASN1Primitive.fromByteArray(octets)).toString();
}

From source file:net.sf.keystore_explorer.crypto.x509.X509Ext.java

License:Open Source License

private String getAdditionalInformationStringValue(byte[] octets) throws IOException {

    /*   AdditionalInformationSyntax ::= DirectoryString (SIZE(1..2048)) */

    return DirectoryString.getInstance(ASN1Primitive.fromByteArray(octets)).toString();
}

From source file:org.xipki.ca.qa.impl.X509CertprofileQAImpl.java

License:Open Source License

private static GeneralName createGeneralName(final GeneralName reqName, final Set<GeneralNameMode> modes)
        throws BadCertTemplateException {
    int tag = reqName.getTagNo();
    GeneralNameMode mode = null;//from   w  w  w.  j a  v  a 2s  .c o m
    for (GeneralNameMode m : modes) {
        if (m.getTag().getTag() == tag) {
            mode = m;
            break;
        }
    }

    if (mode == null) {
        throw new BadCertTemplateException("generalName tag " + tag + " is not allowed");
    }

    switch (tag) {
    case GeneralName.rfc822Name:
    case GeneralName.dNSName:
    case GeneralName.uniformResourceIdentifier:
    case GeneralName.iPAddress:
    case GeneralName.registeredID:
    case GeneralName.directoryName: {
        return new GeneralName(tag, reqName.getName());
    }
    case GeneralName.otherName: {
        ASN1Sequence reqSeq = ASN1Sequence.getInstance(reqName.getName());
        ASN1ObjectIdentifier type = ASN1ObjectIdentifier.getInstance(reqSeq.getObjectAt(0));
        if (mode.getAllowedTypes().contains(type) == false) {
            throw new BadCertTemplateException("otherName.type " + type.getId() + " is not allowed");
        }

        ASN1Encodable value = ((ASN1TaggedObject) reqSeq.getObjectAt(1)).getObject();
        String text;
        if (value instanceof ASN1String == false) {
            throw new BadCertTemplateException("otherName.value is not a String");
        } else {
            text = ((ASN1String) value).getString();
        }

        ASN1EncodableVector vector = new ASN1EncodableVector();
        vector.add(type);
        vector.add(new DERTaggedObject(true, 0, new DERUTF8String(text)));
        DERSequence seq = new DERSequence(vector);

        return new GeneralName(GeneralName.otherName, seq);
    }
    case GeneralName.ediPartyName: {
        ASN1Sequence reqSeq = ASN1Sequence.getInstance(reqName.getName());

        int n = reqSeq.size();
        String nameAssigner = null;
        int idx = 0;
        if (n > 1) {
            DirectoryString ds = DirectoryString
                    .getInstance(((ASN1TaggedObject) reqSeq.getObjectAt(idx++)).getObject());
            nameAssigner = ds.getString();
        }

        DirectoryString ds = DirectoryString
                .getInstance(((ASN1TaggedObject) reqSeq.getObjectAt(idx++)).getObject());
        String partyName = ds.getString();

        ASN1EncodableVector vector = new ASN1EncodableVector();
        if (nameAssigner != null) {
            vector.add(new DERTaggedObject(false, 0, new DirectoryString(nameAssigner)));
        }
        vector.add(new DERTaggedObject(false, 1, new DirectoryString(partyName)));
        ASN1Sequence seq = new DERSequence(vector);
        return new GeneralName(GeneralName.ediPartyName, seq);
    }
    default: {
        throw new RuntimeException("should not reach here, unknwon GeneralName tag " + tag);
    }
    } // end switch
}

From source file:org.xipki.ca.server.impl.IdentifiedX509Certprofile.java

License:Open Source License

private static GeneralName createGeneralName(final GeneralName reqName, final Set<GeneralNameMode> modes)
        throws BadCertTemplateException {
    int tag = reqName.getTagNo();
    GeneralNameMode mode = null;//from w w  w .j  ava 2  s.c o m
    for (GeneralNameMode m : modes) {
        if (m.getTag().getTag() == tag) {
            mode = m;
            break;
        }
    }

    if (mode == null) {
        throw new BadCertTemplateException("generalName tag " + tag + " is not allowed");
    }

    switch (tag) {
    case GeneralName.rfc822Name:
    case GeneralName.dNSName:
    case GeneralName.uniformResourceIdentifier:
    case GeneralName.iPAddress:
    case GeneralName.registeredID:
    case GeneralName.directoryName: {
        return new GeneralName(tag, reqName.getName());
    }
    case GeneralName.otherName: {
        ASN1Sequence reqSeq = ASN1Sequence.getInstance(reqName.getName());
        ASN1ObjectIdentifier type = ASN1ObjectIdentifier.getInstance(reqSeq.getObjectAt(0));
        if (mode.getAllowedTypes().contains(type) == false) {
            throw new BadCertTemplateException("otherName.type " + type.getId() + " is not allowed");
        }

        ASN1Encodable value = ((ASN1TaggedObject) reqSeq.getObjectAt(1)).getObject();
        String text;
        if (value instanceof ASN1String == false) {
            throw new BadCertTemplateException("otherName.value is not a String");
        } else {
            text = ((ASN1String) value).getString();
        }

        ASN1EncodableVector vector = new ASN1EncodableVector();
        vector.add(type);
        vector.add(new DERTaggedObject(true, 0, new DERUTF8String(text)));
        DERSequence seq = new DERSequence(vector);

        return new GeneralName(GeneralName.otherName, seq);
    }
    case GeneralName.ediPartyName: {
        ASN1Sequence reqSeq = ASN1Sequence.getInstance(reqName.getName());

        int n = reqSeq.size();
        String nameAssigner = null;
        int idx = 0;
        if (n > 1) {
            DirectoryString ds = DirectoryString
                    .getInstance(((ASN1TaggedObject) reqSeq.getObjectAt(idx++)).getObject());
            nameAssigner = ds.getString();
        }

        DirectoryString ds = DirectoryString
                .getInstance(((ASN1TaggedObject) reqSeq.getObjectAt(idx++)).getObject());
        String partyName = ds.getString();

        ASN1EncodableVector vector = new ASN1EncodableVector();
        if (nameAssigner != null) {
            vector.add(new DERTaggedObject(false, 0, new DirectoryString(nameAssigner)));
        }
        vector.add(new DERTaggedObject(false, 1, new DirectoryString(partyName)));
        ASN1Sequence seq = new DERSequence(vector);
        return new GeneralName(GeneralName.ediPartyName, seq);
    }
    default: {
        throw new RuntimeException("should not reach here, unknown GeneralName tag " + tag);
    }
    }// end switch(tag)
}

From source file:org.xipki.pki.ca.api.profile.x509.X509CertprofileUtil.java

License:Open Source License

public static GeneralName createGeneralName(@NonNull final GeneralName requestedName,
        @NonNull final Set<GeneralNameMode> modes) throws BadCertTemplateException {
    ParamUtil.requireNonNull("requestedName", requestedName);

    int tag = requestedName.getTagNo();
    GeneralNameMode mode = null;/*from w w w . ja v  a 2s.com*/
    if (modes != null) {
        for (GeneralNameMode m : modes) {
            if (m.getTag().getTag() == tag) {
                mode = m;
                break;
            }
        }

        if (mode == null) {
            throw new BadCertTemplateException("generalName tag " + tag + " is not allowed");
        }
    }

    switch (tag) {
    case GeneralName.rfc822Name:
    case GeneralName.dNSName:
    case GeneralName.uniformResourceIdentifier:
    case GeneralName.iPAddress:
    case GeneralName.registeredID:
    case GeneralName.directoryName:
        return new GeneralName(tag, requestedName.getName());
    case GeneralName.otherName:
        ASN1Sequence reqSeq = ASN1Sequence.getInstance(requestedName.getName());
        int size = reqSeq.size();
        if (size != 2) {
            throw new BadCertTemplateException("invalid otherName sequence: size is not 2: " + size);
        }

        ASN1ObjectIdentifier type = ASN1ObjectIdentifier.getInstance(reqSeq.getObjectAt(0));
        if (mode != null && !mode.getAllowedTypes().contains(type)) {
            throw new BadCertTemplateException("otherName.type " + type.getId() + " is not allowed");
        }

        ASN1Encodable asn1 = reqSeq.getObjectAt(1);
        if (!(asn1 instanceof ASN1TaggedObject)) {
            throw new BadCertTemplateException("otherName.value is not tagged Object");
        }

        int tagNo = ASN1TaggedObject.getInstance(asn1).getTagNo();
        if (tagNo != 0) {
            throw new BadCertTemplateException("otherName.value does not have tag 0: " + tagNo);
        }

        ASN1EncodableVector vector = new ASN1EncodableVector();
        vector.add(type);
        vector.add(new DERTaggedObject(true, 0, ASN1TaggedObject.getInstance(asn1).getObject()));
        DERSequence seq = new DERSequence(vector);

        return new GeneralName(GeneralName.otherName, seq);
    case GeneralName.ediPartyName:
        reqSeq = ASN1Sequence.getInstance(requestedName.getName());

        size = reqSeq.size();
        String nameAssigner = null;
        int idx = 0;
        if (size > 1) {
            DirectoryString ds = DirectoryString
                    .getInstance(ASN1TaggedObject.getInstance(reqSeq.getObjectAt(idx++)).getObject());
            nameAssigner = ds.getString();
        }

        DirectoryString ds = DirectoryString
                .getInstance(ASN1TaggedObject.getInstance(reqSeq.getObjectAt(idx++)).getObject());
        String partyName = ds.getString();

        vector = new ASN1EncodableVector();
        if (nameAssigner != null) {
            vector.add(new DERTaggedObject(false, 0, new DirectoryString(nameAssigner)));
        }
        vector.add(new DERTaggedObject(false, 1, new DirectoryString(partyName)));
        seq = new DERSequence(vector);
        return new GeneralName(GeneralName.ediPartyName, seq);
    default:
        throw new RuntimeException("should not reach here, unknown GeneralName tag " + tag);
    } // end switch (tag)
}

From source file:org.xipki.pki.ca.certprofile.XmlX509Certprofile.java

License:Open Source License

@Override
public ExtensionValues getExtensions(final Map<ASN1ObjectIdentifier, ExtensionControl> extensionOccurences,
        final X500Name requestedSubject, final X500Name grantedSubject, final Extensions requestedExtensions,
        final Date notBefore, final Date notAfter) throws CertprofileException, BadCertTemplateException {
    ExtensionValues values = new ExtensionValues();
    if (CollectionUtil.isEmpty(extensionOccurences)) {
        return values;
    }//from   w  w  w.  j a v  a2  s. c om

    ParamUtil.requireNonNull("requestedSubject", requestedSubject);
    ParamUtil.requireNonNull("notBefore", notBefore);
    ParamUtil.requireNonNull("notAfter", notAfter);

    Set<ASN1ObjectIdentifier> occurences = new HashSet<>(extensionOccurences.keySet());

    // AuthorityKeyIdentifier
    // processed by the CA

    // SubjectKeyIdentifier
    // processed by the CA

    // KeyUsage
    // processed by the CA

    // CertificatePolicies
    ASN1ObjectIdentifier type = Extension.certificatePolicies;
    if (certificatePolicies != null) {
        if (occurences.remove(type)) {
            values.addExtension(type, certificatePolicies);
        }
    }

    // Policy Mappings
    type = Extension.policyMappings;
    if (policyMappings != null) {
        if (occurences.remove(type)) {
            values.addExtension(type, policyMappings);
        }
    }

    // SubjectAltName
    type = Extension.subjectAlternativeName;
    if (occurences.contains(type)) {
        GeneralNames genNames = createRequestedSubjectAltNames(requestedSubject, grantedSubject,
                requestedExtensions);
        if (genNames != null) {
            ExtensionValue value = new ExtensionValue(extensionControls.get(type).isCritical(), genNames);
            values.addExtension(type, value);
            occurences.remove(type);
        }
    }

    // IssuerAltName
    // processed by the CA

    // Subject Directory Attributes
    type = Extension.subjectDirectoryAttributes;
    if (occurences.contains(type) && subjectDirAttrsControl != null) {
        Extension extension = (requestedExtensions == null) ? null : requestedExtensions.getExtension(type);
        if (extension == null) {
            throw new BadCertTemplateException(
                    "no SubjectDirecotryAttributes extension is contained in the request");
        }

        ASN1GeneralizedTime dateOfBirth = null;
        String placeOfBirth = null;
        String gender = null;
        List<String> countryOfCitizenshipList = new LinkedList<>();
        List<String> countryOfResidenceList = new LinkedList<>();
        Map<ASN1ObjectIdentifier, List<ASN1Encodable>> otherAttrs = new HashMap<>();

        Vector<?> reqSubDirAttrs = SubjectDirectoryAttributes.getInstance(extension.getParsedValue())
                .getAttributes();
        final int n = reqSubDirAttrs.size();
        for (int i = 0; i < n; i++) {
            Attribute attr = (Attribute) reqSubDirAttrs.get(i);
            ASN1ObjectIdentifier attrType = attr.getAttrType();
            ASN1Encodable attrVal = attr.getAttributeValues()[0];

            if (ObjectIdentifiers.DN_DATE_OF_BIRTH.equals(attrType)) {
                dateOfBirth = ASN1GeneralizedTime.getInstance(attrVal);
            } else if (ObjectIdentifiers.DN_PLACE_OF_BIRTH.equals(attrType)) {
                placeOfBirth = DirectoryString.getInstance(attrVal).getString();
            } else if (ObjectIdentifiers.DN_GENDER.equals(attrType)) {
                gender = DERPrintableString.getInstance(attrVal).getString();
            } else if (ObjectIdentifiers.DN_COUNTRY_OF_CITIZENSHIP.equals(attrType)) {
                String country = DERPrintableString.getInstance(attrVal).getString();
                countryOfCitizenshipList.add(country);
            } else if (ObjectIdentifiers.DN_COUNTRY_OF_RESIDENCE.equals(attrType)) {
                String country = DERPrintableString.getInstance(attrVal).getString();
                countryOfResidenceList.add(country);
            } else {
                List<ASN1Encodable> otherAttrVals = otherAttrs.get(attrType);
                if (otherAttrVals == null) {
                    otherAttrVals = new LinkedList<>();
                    otherAttrs.put(attrType, otherAttrVals);
                }
                otherAttrVals.add(attrVal);
            }
        }

        Vector<Attribute> attrs = new Vector<>();
        for (ASN1ObjectIdentifier attrType : subjectDirAttrsControl.getTypes()) {
            if (ObjectIdentifiers.DN_DATE_OF_BIRTH.equals(attrType)) {
                if (dateOfBirth != null) {
                    String timeStirng = dateOfBirth.getTimeString();
                    if (!SubjectDnSpec.PATTERN_DATE_OF_BIRTH.matcher(timeStirng).matches()) {
                        throw new BadCertTemplateException("invalid dateOfBirth " + timeStirng);
                    }
                    attrs.add(new Attribute(attrType, new DERSet(dateOfBirth)));
                    continue;
                }
            } else if (ObjectIdentifiers.DN_PLACE_OF_BIRTH.equals(attrType)) {
                if (placeOfBirth != null) {
                    ASN1Encodable attrVal = new DERUTF8String(placeOfBirth);
                    attrs.add(new Attribute(attrType, new DERSet(attrVal)));
                    continue;
                }
            } else if (ObjectIdentifiers.DN_GENDER.equals(attrType)) {
                if (gender != null && !gender.isEmpty()) {
                    char ch = gender.charAt(0);
                    if (!(gender.length() == 1 && (ch == 'f' || ch == 'F' || ch == 'm' || ch == 'M'))) {
                        throw new BadCertTemplateException("invalid gender " + gender);
                    }
                    ASN1Encodable attrVal = new DERPrintableString(gender);
                    attrs.add(new Attribute(attrType, new DERSet(attrVal)));
                    continue;
                }
            } else if (ObjectIdentifiers.DN_COUNTRY_OF_CITIZENSHIP.equals(attrType)) {
                if (!countryOfCitizenshipList.isEmpty()) {
                    for (String country : countryOfCitizenshipList) {
                        if (!SubjectDnSpec.isValidCountryAreaCode(country)) {
                            throw new BadCertTemplateException("invalid countryOfCitizenship code " + country);
                        }
                        ASN1Encodable attrVal = new DERPrintableString(country);
                        attrs.add(new Attribute(attrType, new DERSet(attrVal)));
                    }
                    continue;
                }
            } else if (ObjectIdentifiers.DN_COUNTRY_OF_RESIDENCE.equals(attrType)) {
                if (!countryOfResidenceList.isEmpty()) {
                    for (String country : countryOfResidenceList) {
                        if (!SubjectDnSpec.isValidCountryAreaCode(country)) {
                            throw new BadCertTemplateException("invalid countryOfResidence code " + country);
                        }
                        ASN1Encodable attrVal = new DERPrintableString(country);
                        attrs.add(new Attribute(attrType, new DERSet(attrVal)));
                    }
                    continue;
                }
            } else if (otherAttrs.containsKey(attrType)) {
                for (ASN1Encodable attrVal : otherAttrs.get(attrType)) {
                    attrs.add(new Attribute(attrType, new DERSet(attrVal)));
                }

                continue;
            }

            throw new BadCertTemplateException(
                    "could not process type " + attrType.getId() + " in extension SubjectDirectoryAttributes");
        }

        SubjectDirectoryAttributes subjDirAttrs = new SubjectDirectoryAttributes(attrs);
        ExtensionValue extValue = new ExtensionValue(extensionControls.get(type).isCritical(), subjDirAttrs);
        values.addExtension(type, extValue);
        occurences.remove(type);
    }

    // Basic Constraints
    // processed by the CA

    // Name Constraints
    type = Extension.nameConstraints;
    if (nameConstraints != null) {
        if (occurences.remove(type)) {
            values.addExtension(type, nameConstraints);
        }
    }

    // PolicyConstrains
    type = Extension.policyConstraints;
    if (policyConstraints != null) {
        if (occurences.remove(type)) {
            values.addExtension(type, policyConstraints);
        }
    }

    // ExtendedKeyUsage
    // processed by CA

    // CRL Distribution Points
    // processed by the CA

    // Inhibit anyPolicy
    type = Extension.inhibitAnyPolicy;
    if (inhibitAnyPolicy != null) {
        if (occurences.remove(type)) {
            values.addExtension(type, inhibitAnyPolicy);
        }
    }

    // Freshest CRL
    // processed by the CA

    // Authority Information Access
    // processed by the CA

    // Subject Information Access
    // processed by the CA

    // Admission
    type = ObjectIdentifiers.id_extension_admission;
    if (occurences.contains(type) && admission != null) {
        if (admission.isInputFromRequestRequired()) {
            Extension extension = (requestedExtensions == null) ? null : requestedExtensions.getExtension(type);
            if (extension == null) {
                throw new BadCertTemplateException("No Admission extension is contained in the request");
            }

            Admissions[] reqAdmissions = org.bouncycastle.asn1.isismtt.x509.AdmissionSyntax
                    .getInstance(extension.getParsedValue()).getContentsOfAdmissions();

            final int n = reqAdmissions.length;
            List<List<String>> reqRegNumsList = new ArrayList<>(n);
            for (int i = 0; i < n; i++) {
                Admissions reqAdmission = reqAdmissions[i];
                ProfessionInfo[] reqPis = reqAdmission.getProfessionInfos();
                List<String> reqNums = new ArrayList<>(reqPis.length);
                reqRegNumsList.add(reqNums);
                for (ProfessionInfo reqPi : reqPis) {
                    String reqNum = reqPi.getRegistrationNumber();
                    reqNums.add(reqNum);
                }
            }
            values.addExtension(type, admission.getExtensionValue(reqRegNumsList));
            occurences.remove(type);
        } else {
            values.addExtension(type, admission.getExtensionValue(null));
            occurences.remove(type);
        }
    }

    // OCSP Nocheck
    // processed by the CA

    // restriction
    type = ObjectIdentifiers.id_extension_restriction;
    if (restriction != null) {
        if (occurences.remove(type)) {
            values.addExtension(type, restriction);
        }
    }

    // AdditionalInformation
    type = ObjectIdentifiers.id_extension_additionalInformation;
    if (additionalInformation != null) {
        if (occurences.remove(type)) {
            values.addExtension(type, additionalInformation);
        }
    }

    // ValidityModel
    type = ObjectIdentifiers.id_extension_validityModel;
    if (validityModel != null) {
        if (occurences.remove(type)) {
            values.addExtension(type, validityModel);
        }
    }

    // PrivateKeyUsagePeriod
    type = Extension.privateKeyUsagePeriod;
    if (occurences.contains(type)) {
        Date tmpNotAfter;
        if (privateKeyUsagePeriod == null) {
            tmpNotAfter = notAfter;
        } else {
            tmpNotAfter = privateKeyUsagePeriod.add(notBefore);
            if (tmpNotAfter.after(notAfter)) {
                tmpNotAfter = notAfter;
            }
        }

        ASN1EncodableVector vec = new ASN1EncodableVector();
        vec.add(new DERTaggedObject(false, 0, new DERGeneralizedTime(notBefore)));
        vec.add(new DERTaggedObject(false, 1, new DERGeneralizedTime(tmpNotAfter)));
        ExtensionValue extValue = new ExtensionValue(extensionControls.get(type).isCritical(),
                new DERSequence(vec));
        values.addExtension(type, extValue);
        occurences.remove(type);
    }

    // QCStatements
    type = Extension.qCStatements;
    if (occurences.contains(type) && (qcStatments != null || qcStatementsOption != null)) {
        if (qcStatments != null) {
            values.addExtension(type, qcStatments);
            occurences.remove(type);
        } else if (requestedExtensions != null && qcStatementsOption != null) {
            // extract the euLimit data from request
            Extension extension = requestedExtensions.getExtension(type);
            if (extension == null) {
                throw new BadCertTemplateException("No QCStatement extension is contained in the request");
            }
            ASN1Sequence seq = ASN1Sequence.getInstance(extension.getParsedValue());

            Map<String, int[]> qcEuLimits = new HashMap<>();
            final int n = seq.size();
            for (int i = 0; i < n; i++) {
                QCStatement stmt = QCStatement.getInstance(seq.getObjectAt(i));
                if (!ObjectIdentifiers.id_etsi_qcs_QcLimitValue.equals(stmt.getStatementId())) {
                    continue;
                }

                MonetaryValue monetaryValue = MonetaryValue.getInstance(stmt.getStatementInfo());
                int amount = monetaryValue.getAmount().intValue();
                int exponent = monetaryValue.getExponent().intValue();
                Iso4217CurrencyCode currency = monetaryValue.getCurrency();
                String currencyS = currency.isAlphabetic() ? currency.getAlphabetic().toUpperCase()
                        : Integer.toString(currency.getNumeric());
                qcEuLimits.put(currencyS, new int[] { amount, exponent });
            }

            ASN1EncodableVector vec = new ASN1EncodableVector();
            for (QcStatementOption m : qcStatementsOption) {
                if (m.getStatement() != null) {
                    vec.add(m.getStatement());
                    continue;
                }

                MonetaryValueOption monetaryOption = m.getMonetaryValueOption();
                String currencyS = monetaryOption.getCurrencyString();
                int[] limit = qcEuLimits.get(currencyS);
                if (limit == null) {
                    throw new BadCertTemplateException(
                            "no EuLimitValue is specified for currency '" + currencyS + "'");
                }

                int amount = limit[0];
                Range2Type range = monetaryOption.getAmountRange();
                if (amount < range.getMin() || amount > range.getMax()) {
                    throw new BadCertTemplateException("amount for currency '" + currencyS + "' is not within ["
                            + range.getMin() + ", " + range.getMax() + "]");
                }

                int exponent = limit[1];
                range = monetaryOption.getExponentRange();
                if (exponent < range.getMin() || exponent > range.getMax()) {
                    throw new BadCertTemplateException("exponent for currency '" + currencyS
                            + "' is not within [" + range.getMin() + ", " + range.getMax() + "]");
                }

                MonetaryValue monetaryVale = new MonetaryValue(monetaryOption.getCurrency(), amount, exponent);
                QCStatement qcStatment = new QCStatement(m.getStatementId(), monetaryVale);
                vec.add(qcStatment);
            }

            ExtensionValue extValue = new ExtensionValue(extensionControls.get(type).isCritical(),
                    new DERSequence(vec));
            values.addExtension(type, extValue);
            occurences.remove(type);
        } else {
            throw new RuntimeException("should not reach here");
        }
    }

    // BiometricData
    type = Extension.biometricInfo;
    if (occurences.contains(type) && biometricInfo != null) {
        Extension extension = (requestedExtensions == null) ? null : requestedExtensions.getExtension(type);
        if (extension == null) {
            throw new BadCertTemplateException("no biometricInfo extension is contained in the request");
        }
        ASN1Sequence seq = ASN1Sequence.getInstance(extension.getParsedValue());
        final int n = seq.size();
        if (n < 1) {
            throw new BadCertTemplateException("biometricInfo extension in request contains empty sequence");
        }

        ASN1EncodableVector vec = new ASN1EncodableVector();

        for (int i = 0; i < n; i++) {
            BiometricData bd = BiometricData.getInstance(seq.getObjectAt(i));
            TypeOfBiometricData bdType = bd.getTypeOfBiometricData();
            if (!biometricInfo.isTypePermitted(bdType)) {
                throw new BadCertTemplateException(
                        "biometricInfo[" + i + "].typeOfBiometricData is not permitted");
            }

            ASN1ObjectIdentifier hashAlgo = bd.getHashAlgorithm().getAlgorithm();
            if (!biometricInfo.isHashAlgorithmPermitted(hashAlgo)) {
                throw new BadCertTemplateException("biometricInfo[" + i + "].hashAlgorithm is not permitted");
            }

            int expHashValueSize;
            try {
                expHashValueSize = AlgorithmUtil.getHashOutputSizeInOctets(hashAlgo);
            } catch (NoSuchAlgorithmException ex) {
                throw new CertprofileException("should not happen, unknown hash algorithm " + hashAlgo);
            }

            byte[] hashValue = bd.getBiometricDataHash().getOctets();
            if (hashValue.length != expHashValueSize) {
                throw new BadCertTemplateException(
                        "biometricInfo[" + i + "].biometricDataHash has incorrect length");
            }

            DERIA5String sourceDataUri = bd.getSourceDataUri();
            switch (biometricInfo.getSourceDataUriOccurrence()) {
            case FORBIDDEN:
                sourceDataUri = null;
                break;
            case REQUIRED:
                if (sourceDataUri == null) {
                    throw new BadCertTemplateException("biometricInfo[" + i
                            + "].sourceDataUri is not specified in request but is required");
                }
                break;
            case OPTIONAL:
                break;
            default:
                throw new BadCertTemplateException("could not reach here, unknown tripleState");
            }

            AlgorithmIdentifier newHashAlg = new AlgorithmIdentifier(hashAlgo, DERNull.INSTANCE);
            BiometricData newBiometricData = new BiometricData(bdType, newHashAlg,
                    new DEROctetString(hashValue), sourceDataUri);
            vec.add(newBiometricData);
        }

        ExtensionValue extValue = new ExtensionValue(extensionControls.get(type).isCritical(),
                new DERSequence(vec));
        values.addExtension(type, extValue);
        occurences.remove(type);
    }

    // TlsFeature
    type = ObjectIdentifiers.id_pe_tlsfeature;
    if (tlsFeature != null) {
        if (occurences.remove(type)) {
            values.addExtension(type, tlsFeature);
        }
    }

    // AuthorizationTemplate
    type = ObjectIdentifiers.id_xipki_ext_authorizationTemplate;
    if (authorizationTemplate != null) {
        if (occurences.remove(type)) {
            values.addExtension(type, authorizationTemplate);
        }
    }

    // SMIME
    type = ObjectIdentifiers.id_smimeCapabilities;
    if (smimeCapabilities != null) {
        if (occurences.remove(type)) {
            values.addExtension(type, smimeCapabilities);
        }
    }

    // constant extensions
    if (constantExtensions != null) {
        for (ASN1ObjectIdentifier m : constantExtensions.keySet()) {
            if (!occurences.remove(m)) {
                continue;
            }

            ExtensionValue extensionValue = constantExtensions.get(m);
            if (extensionValue != null) {
                values.addExtension(m, extensionValue);
            }
        }
    }

    return values;
}

From source file:org.xipki.pki.ca.qa.ExtensionsChecker.java

License:Open Source License

private void checkExtensionSubjectDirAttrs(final StringBuilder failureMsg, final byte[] extensionValue,
        final Extensions requestedExtensions, final ExtensionControl extControl) {
    SubjectDirectoryAttributesControl conf = certProfile.getSubjectDirAttrsControl();
    if (conf == null) {
        failureMsg.append("extension is present but not expected; ");
        return;/* w w  w . j  av  a  2  s.c  o m*/
    }

    ASN1Encodable extInRequest = null;
    if (requestedExtensions != null) {
        extInRequest = requestedExtensions.getExtensionParsedValue(Extension.subjectDirectoryAttributes);
    }

    if (extInRequest == null) {
        failureMsg.append("extension is present but not expected; ");
        return;
    }

    SubjectDirectoryAttributes requested = SubjectDirectoryAttributes.getInstance(extInRequest);
    Vector<?> reqSubDirAttrs = requested.getAttributes();
    ASN1GeneralizedTime expDateOfBirth = null;
    String expPlaceOfBirth = null;
    String expGender = null;
    Set<String> expCountryOfCitizenshipList = new HashSet<>();
    Set<String> expCountryOfResidenceList = new HashSet<>();
    Map<ASN1ObjectIdentifier, Set<ASN1Encodable>> expOtherAttrs = new HashMap<>();

    final int expN = reqSubDirAttrs.size();
    for (int i = 0; i < expN; i++) {
        Attribute attr = Attribute.getInstance(reqSubDirAttrs.get(i));
        ASN1ObjectIdentifier attrType = attr.getAttrType();
        ASN1Encodable attrVal = attr.getAttributeValues()[0];

        if (ObjectIdentifiers.DN_DATE_OF_BIRTH.equals(attrType)) {
            expDateOfBirth = ASN1GeneralizedTime.getInstance(attrVal);
        } else if (ObjectIdentifiers.DN_PLACE_OF_BIRTH.equals(attrType)) {
            expPlaceOfBirth = DirectoryString.getInstance(attrVal).getString();
        } else if (ObjectIdentifiers.DN_GENDER.equals(attrType)) {
            expGender = DERPrintableString.getInstance(attrVal).getString();
        } else if (ObjectIdentifiers.DN_COUNTRY_OF_CITIZENSHIP.equals(attrType)) {
            String country = DERPrintableString.getInstance(attrVal).getString();
            expCountryOfCitizenshipList.add(country);
        } else if (ObjectIdentifiers.DN_COUNTRY_OF_RESIDENCE.equals(attrType)) {
            String country = DERPrintableString.getInstance(attrVal).getString();
            expCountryOfResidenceList.add(country);
        } else {
            Set<ASN1Encodable> otherAttrVals = expOtherAttrs.get(attrType);
            if (otherAttrVals == null) {
                otherAttrVals = new HashSet<>();
                expOtherAttrs.put(attrType, otherAttrVals);
            }
            otherAttrVals.add(attrVal);
        }
    }

    SubjectDirectoryAttributes ext = SubjectDirectoryAttributes.getInstance(extensionValue);
    Vector<?> subDirAttrs = ext.getAttributes();
    ASN1GeneralizedTime dateOfBirth = null;
    String placeOfBirth = null;
    String gender = null;
    Set<String> countryOfCitizenshipList = new HashSet<>();
    Set<String> countryOfResidenceList = new HashSet<>();
    Map<ASN1ObjectIdentifier, Set<ASN1Encodable>> otherAttrs = new HashMap<>();

    List<ASN1ObjectIdentifier> attrTypes = new LinkedList<>(conf.getTypes());
    final int n = subDirAttrs.size();
    for (int i = 0; i < n; i++) {
        Attribute attr = Attribute.getInstance(subDirAttrs.get(i));
        ASN1ObjectIdentifier attrType = attr.getAttrType();
        if (!attrTypes.contains(attrType)) {
            failureMsg.append("attribute of type " + attrType.getId() + " is present but not expected; ");
            continue;
        }

        ASN1Encodable[] attrs = attr.getAttributeValues();
        if (attrs.length != 1) {
            failureMsg.append("attribute of type " + attrType.getId() + " does not single-value value: "
                    + attrs.length + "; ");
            continue;
        }

        ASN1Encodable attrVal = attrs[0];

        if (ObjectIdentifiers.DN_DATE_OF_BIRTH.equals(attrType)) {
            dateOfBirth = ASN1GeneralizedTime.getInstance(attrVal);
        } else if (ObjectIdentifiers.DN_PLACE_OF_BIRTH.equals(attrType)) {
            placeOfBirth = DirectoryString.getInstance(attrVal).getString();
        } else if (ObjectIdentifiers.DN_GENDER.equals(attrType)) {
            gender = DERPrintableString.getInstance(attrVal).getString();
        } else if (ObjectIdentifiers.DN_COUNTRY_OF_CITIZENSHIP.equals(attrType)) {
            String country = DERPrintableString.getInstance(attrVal).getString();
            countryOfCitizenshipList.add(country);
        } else if (ObjectIdentifiers.DN_COUNTRY_OF_RESIDENCE.equals(attrType)) {
            String country = DERPrintableString.getInstance(attrVal).getString();
            countryOfResidenceList.add(country);
        } else {
            Set<ASN1Encodable> otherAttrVals = otherAttrs.get(attrType);
            if (otherAttrVals == null) {
                otherAttrVals = new HashSet<>();
                otherAttrs.put(attrType, otherAttrVals);
            }
            otherAttrVals.add(attrVal);
        }
    }

    if (dateOfBirth != null) {
        attrTypes.remove(ObjectIdentifiers.DN_DATE_OF_BIRTH);
    }

    if (placeOfBirth != null) {
        attrTypes.remove(ObjectIdentifiers.DN_PLACE_OF_BIRTH);
    }

    if (gender != null) {
        attrTypes.remove(ObjectIdentifiers.DN_GENDER);
    }

    if (!countryOfCitizenshipList.isEmpty()) {
        attrTypes.remove(ObjectIdentifiers.DN_COUNTRY_OF_CITIZENSHIP);
    }

    if (!countryOfResidenceList.isEmpty()) {
        attrTypes.remove(ObjectIdentifiers.DN_COUNTRY_OF_RESIDENCE);
    }

    attrTypes.removeAll(otherAttrs.keySet());

    if (!attrTypes.isEmpty()) {
        List<String> attrTypeTexts = new LinkedList<>();
        for (ASN1ObjectIdentifier oid : attrTypes) {
            attrTypeTexts.add(oid.getId());
        }
        failureMsg.append("required attributes of types " + attrTypeTexts + " are not present; ");
    }

    if (dateOfBirth != null) {
        String timeStirng = dateOfBirth.getTimeString();
        if (!SubjectDnSpec.PATTERN_DATE_OF_BIRTH.matcher(timeStirng).matches()) {
            failureMsg.append("invalid dateOfBirth: " + timeStirng + "; ");
        }

        String exp = (expDateOfBirth == null) ? null : expDateOfBirth.getTimeString();
        if (!timeStirng.equalsIgnoreCase(exp)) {
            addViolation(failureMsg, "dateOfBirth", timeStirng, exp);
        }
    }

    if (gender != null) {
        if (!(gender.equalsIgnoreCase("F") || gender.equalsIgnoreCase("M"))) {
            failureMsg.append("invalid gender: " + gender + "; ");
        }
        if (!gender.equalsIgnoreCase(expGender)) {
            addViolation(failureMsg, "gender", gender, expGender);
        }
    }

    if (placeOfBirth != null) {
        if (!placeOfBirth.equals(expPlaceOfBirth)) {
            addViolation(failureMsg, "placeOfBirth", placeOfBirth, expPlaceOfBirth);
        }
    }

    if (!countryOfCitizenshipList.isEmpty()) {
        Set<String> diffs = strInBnotInA(expCountryOfCitizenshipList, countryOfCitizenshipList);
        if (CollectionUtil.isNonEmpty(diffs)) {
            failureMsg.append("countryOfCitizenship ").append(diffs.toString());
            failureMsg.append(" are present but not expected; ");
        }

        diffs = strInBnotInA(countryOfCitizenshipList, expCountryOfCitizenshipList);
        if (CollectionUtil.isNonEmpty(diffs)) {
            failureMsg.append("countryOfCitizenship ").append(diffs.toString());
            failureMsg.append(" are absent but are required; ");
        }
    }

    if (!countryOfResidenceList.isEmpty()) {
        Set<String> diffs = strInBnotInA(expCountryOfResidenceList, countryOfResidenceList);
        if (CollectionUtil.isNonEmpty(diffs)) {
            failureMsg.append("countryOfResidence ").append(diffs.toString());
            failureMsg.append(" are present but not expected; ");
        }

        diffs = strInBnotInA(countryOfResidenceList, expCountryOfResidenceList);
        if (CollectionUtil.isNonEmpty(diffs)) {
            failureMsg.append("countryOfResidence ").append(diffs.toString());
            failureMsg.append(" are absent but are required; ");
        }
    }

    if (!otherAttrs.isEmpty()) {
        for (ASN1ObjectIdentifier attrType : otherAttrs.keySet()) {
            Set<ASN1Encodable> expAttrValues = expOtherAttrs.get(attrType);
            if (expAttrValues == null) {
                failureMsg.append("attribute of type " + attrType.getId() + " is present but not requested; ");
                continue;
            }
            Set<ASN1Encodable> attrValues = otherAttrs.get(attrType);
            if (!attrValues.equals(expAttrValues)) {
                failureMsg
                        .append("attribute of type " + attrType.getId() + " differs from the requested one; ");
                continue;
            }
        }
    }
}

From source file:org.xipki.pki.ca.qa.ExtensionsChecker.java

License:Open Source License

private static GeneralName createGeneralName(final GeneralName reqName, final Set<GeneralNameMode> modes)
        throws BadCertTemplateException {
    int tag = reqName.getTagNo();
    GeneralNameMode mode = null;/*from  w ww . java2s . co  m*/
    if (modes != null) {
        for (GeneralNameMode m : modes) {
            if (m.getTag().getTag() == tag) {
                mode = m;
                break;
            }
        }

        if (mode == null) {
            throw new BadCertTemplateException("generalName tag " + tag + " is not allowed");
        }
    }

    switch (tag) {
    case GeneralName.rfc822Name:
    case GeneralName.dNSName:
    case GeneralName.uniformResourceIdentifier:
    case GeneralName.iPAddress:
    case GeneralName.registeredID:
    case GeneralName.directoryName:
        return new GeneralName(tag, reqName.getName());
    case GeneralName.otherName:
        ASN1Sequence reqSeq = ASN1Sequence.getInstance(reqName.getName());
        ASN1ObjectIdentifier type = ASN1ObjectIdentifier.getInstance(reqSeq.getObjectAt(0));
        if (mode != null && !mode.getAllowedTypes().contains(type)) {
            throw new BadCertTemplateException("otherName.type " + type.getId() + " is not allowed");
        }

        ASN1Encodable value = ASN1TaggedObject.getInstance(reqSeq.getObjectAt(1)).getObject();
        String text;
        if (!(value instanceof ASN1String)) {
            throw new BadCertTemplateException("otherName.value is not a String");
        } else {
            text = ((ASN1String) value).getString();
        }

        ASN1EncodableVector vector = new ASN1EncodableVector();
        vector.add(type);
        vector.add(new DERTaggedObject(true, 0, new DERUTF8String(text)));
        DERSequence seq = new DERSequence(vector);

        return new GeneralName(GeneralName.otherName, seq);
    case GeneralName.ediPartyName:
        reqSeq = ASN1Sequence.getInstance(reqName.getName());

        int size = reqSeq.size();
        String nameAssigner = null;
        int idx = 0;
        if (size > 1) {
            DirectoryString ds = DirectoryString
                    .getInstance(ASN1TaggedObject.getInstance(reqSeq.getObjectAt(idx++)).getObject());
            nameAssigner = ds.getString();
        }

        DirectoryString ds = DirectoryString
                .getInstance(ASN1TaggedObject.getInstance(reqSeq.getObjectAt(idx++)).getObject());
        String partyName = ds.getString();

        vector = new ASN1EncodableVector();
        if (nameAssigner != null) {
            vector.add(new DERTaggedObject(false, 0, new DirectoryString(nameAssigner)));
        }
        vector.add(new DERTaggedObject(false, 1, new DirectoryString(partyName)));
        seq = new DERSequence(vector);
        return new GeneralName(GeneralName.ediPartyName, seq);
    default:
        throw new RuntimeException("should not reach here, unknown GeneralName tag " + tag);
    } // end switch
}