Example usage for org.bouncycastle.jce.provider PKIXNameConstraintValidator checkPermitted

Introduction

In this page you can find the example usage for org.bouncycastle.jce.provider PKIXNameConstraintValidator checkPermitted.

Prototype

public void checkPermitted(GeneralName name) throws PKIXNameConstraintValidatorException 

Source Link

Document

Checks if the given GeneralName is in the permitted set.

Usage

From source file:eu.emi.security.authn.x509.helpers.pkipath.bc.FixedBCPKIXCertPathReviewer.java

License:Open Source License

private void checkNameConstraints() {
    X509Certificate cert = null;/*from w  w  w .j  a v a 2 s. co m*/

    //
    // Setup
    //

    // (b)  and (c)
    PKIXNameConstraintValidator nameConstraintValidator = new PKIXNameConstraintValidator();

    //
    // process each certificate except the self issued which are not last in the path
    //
    int index;

    try {
        for (index = certs.size() - 1; index >= 0; index--) {
            //
            // certificate processing
            //    

            cert = (X509Certificate) certs.get(index);

            // b),c)

            if (!(isSelfIssued(cert) && index != 0)) {
                X500Principal principal = getSubjectPrincipal(cert);
                ASN1InputStream aIn = new ASN1InputStream(new ByteArrayInputStream(principal.getEncoded()));
                ASN1Sequence dns;

                try {
                    dns = (ASN1Sequence) aIn.readObject();
                } catch (IOException e) {
                    ErrorBundle msg = new ErrorBundle(RESOURCE_NAME, "CertPathReviewer.ncSubjectNameError",
                            new Object[] { new UntrustedInput(principal) });
                    throw new CertPathReviewerException(msg, e, certPath, index);
                }

                try {
                    nameConstraintValidator.checkPermittedDN(dns);
                } catch (PKIXNameConstraintValidatorException cpve) {
                    ErrorBundle msg = new ErrorBundle(RESOURCE_NAME, "CertPathReviewer.notPermittedDN",
                            new Object[] { new UntrustedInput(principal.getName()) });
                    throw new CertPathReviewerException(msg, cpve, certPath, index);
                }

                try {
                    nameConstraintValidator.checkExcludedDN(dns);
                } catch (PKIXNameConstraintValidatorException cpve) {
                    ErrorBundle msg = new ErrorBundle(RESOURCE_NAME, "CertPathReviewer.excludedDN",
                            new Object[] { new UntrustedInput(principal.getName()) });
                    throw new CertPathReviewerException(msg, cpve, certPath, index);
                }

                //FIX (missing in orig cert path reviewer)
                Vector emails = new X509Name(dns).getValues(X509Name.EmailAddress);
                for (Enumeration e = emails.elements(); e.hasMoreElements();) {
                    String email = (String) e.nextElement();
                    GeneralName emailAsGeneralName = new GeneralName(GeneralName.rfc822Name, email);
                    try {
                        nameConstraintValidator.checkPermitted(emailAsGeneralName);
                    } catch (PKIXNameConstraintValidatorException cpve) {
                        ErrorBundle msg = new ErrorBundle(RESOURCE_NAME, "CertPathReviewer.notPermittedDN",
                                new Object[] { new UntrustedInput(principal.getName()) });
                        throw new CertPathReviewerException(msg, cpve, certPath, index);
                    }

                    try {
                        nameConstraintValidator.checkExcluded(emailAsGeneralName);
                    } catch (PKIXNameConstraintValidatorException cpve) {
                        ErrorBundle msg = new ErrorBundle(RESOURCE_NAME, "CertPathReviewer.excludedDN",
                                new Object[] { new UntrustedInput(principal.getName()) });
                        throw new CertPathReviewerException(msg, cpve, certPath, index);
                    }
                }

                ASN1Sequence altName;
                try {
                    altName = (ASN1Sequence) getExtensionValue(cert, SUBJECT_ALTERNATIVE_NAME);
                } catch (AnnotatedException ae) {
                    ErrorBundle msg = new ErrorBundle(RESOURCE_NAME, "CertPathReviewer.subjAltNameExtError");
                    throw new CertPathReviewerException(msg, ae, certPath, index);
                }

                if (altName != null) {
                    for (int j = 0; j < altName.size(); j++) {
                        GeneralName name = GeneralName.getInstance(altName.getObjectAt(j));

                        try {
                            nameConstraintValidator.checkPermitted(name);
                            nameConstraintValidator.checkExcluded(name);
                        } catch (PKIXNameConstraintValidatorException cpve) {
                            ErrorBundle msg = new ErrorBundle(RESOURCE_NAME,
                                    "CertPathReviewer.notPermittedEmail",
                                    new Object[] { new UntrustedInput(name) });
                            throw new CertPathReviewerException(msg, cpve, certPath, index);
                        }
                    }
                }

            }

            //
            // prepare for next certificate
            //

            //
            // (g) handle the name constraints extension
            //
            ASN1Sequence ncSeq;
            try {
                ncSeq = (ASN1Sequence) getExtensionValue(cert, NAME_CONSTRAINTS);
            } catch (AnnotatedException ae) {
                ErrorBundle msg = new ErrorBundle(RESOURCE_NAME, "CertPathReviewer.ncExtError");
                throw new CertPathReviewerException(msg, ae, certPath, index);
            }

            if (ncSeq != null) {
                NameConstraints nc = NameConstraints.getInstance(ncSeq);

                //
                // (g) (1) permitted subtrees
                //
                GeneralSubtree[] permitted = nc.getPermittedSubtrees();
                if (permitted != null) {
                    nameConstraintValidator.intersectPermittedSubtree(permitted);
                }

                //
                // (g) (2) excluded subtrees
                //
                GeneralSubtree[] excluded = nc.getExcludedSubtrees();
                if (excluded != null) {
                    for (int c = 0; c != excluded.length; c++) {
                        nameConstraintValidator.addExcludedSubtree(excluded[c]);
                    }
                }
            }

        } // for
    } catch (CertPathReviewerException cpre) {
        addError(cpre.getErrorMessage(), cpre.getIndex());
    }
}

---

From source file:org.cesecore.util.CertTools.java

License:Open Source License

/**
 * Checks that the given SubjectDN / SAN satisfies the Name Constraints of the given issuer (if there are any).
 * This method checks the Name Constraints in the given issuer only. A complete implementation of
 * name constraints should check the whole certificate chain.
 * /*  w  w  w .  jav  a2s.com*/
 * @param issuer Issuing CA.
 * @param subjectDNName Subject DN to check. Optional.
 * @param subjectAltName Subject Alternative Name to check. Optional.
 * @throws CertificateExtensionException
 */
public static void checkNameConstraints(X509Certificate issuer, X500Name subjectDNName,
        GeneralNames subjectAltName) throws IllegalNameException {
    final byte[] ncbytes = issuer.getExtensionValue(Extension.nameConstraints.getId());
    final ASN1OctetString ncstr = (ncbytes != null ? DEROctetString.getInstance(ncbytes) : null);
    final ASN1Sequence ncseq = (ncbytes != null ? DERSequence.getInstance(ncstr.getOctets()) : null);
    final NameConstraints nc = (ncseq != null ? NameConstraints.getInstance(ncseq) : null);

    if (nc != null) {
        if (subjectDNName != null) {
            // Skip check for root CAs
            final X500Name issuerDNName = X500Name.getInstance(issuer.getSubjectX500Principal().getEncoded());
            if (issuerDNName.equals(subjectDNName)) {
                return;
            }
        }

        final PKIXNameConstraintValidator validator = new PKIXNameConstraintValidator();

        GeneralSubtree[] permitted = nc.getPermittedSubtrees();
        GeneralSubtree[] excluded = nc.getExcludedSubtrees();

        if (permitted != null) {
            validator.intersectPermittedSubtree(permitted);
        }
        if (excluded != null) {
            for (GeneralSubtree subtree : excluded) {
                validator.addExcludedSubtree(subtree);
            }
        }

        if (subjectDNName != null) {
            GeneralName dngn = new GeneralName(subjectDNName);
            try {
                validator.checkPermitted(dngn);
                validator.checkExcluded(dngn);
            } catch (PKIXNameConstraintValidatorException e) {
                final String dnStr = subjectDNName.toString();
                final boolean isLdapOrder = dnHasMultipleComponents(dnStr) && !isDNReversed(dnStr);
                if (isLdapOrder) {
                    final String msg = intres.getLocalizedMessage("nameconstraints.x500dnorderrequired");
                    throw new IllegalNameException(msg);
                } else {
                    final String msg = intres.getLocalizedMessage("nameconstraints.forbiddensubjectdn",
                            subjectDNName);
                    throw new IllegalNameException(msg, e);
                }
            }
        }

        if (subjectAltName != null) {
            for (GeneralName sangn : subjectAltName.getNames()) {
                try {
                    validator.checkPermitted(sangn);
                    validator.checkExcluded(sangn);
                } catch (PKIXNameConstraintValidatorException e) {
                    final String msg = intres.getLocalizedMessage("nameconstraints.forbiddensubjectaltname",
                            sangn);
                    throw new IllegalNameException(msg, e);
                }
            }
        }
    }
}

---