Example usage for org.bouncycastle.jce.provider X509CRLEntryObject getEncoded

Introduction

In this page you can find the example usage for org.bouncycastle.jce.provider X509CRLEntryObject getEncoded.

Prototype

public byte[] getEncoded() throws CRLException 

Source Link

Usage

From source file:org.candlepin.util.X509CRLStreamWriter.java

License:Open Source License

public synchronized X509CRLStreamWriter preScan(InputStream crlToChange, CRLEntryValidator validator)
        throws IOException {
    if (locked) {
        throw new IllegalStateException("Cannot modify a locked stream.");
    }/*ww  w.  j  a  v a 2  s.  c o  m*/

    if (preScanned) {
        throw new IllegalStateException("preScan has already been run.");
    }

    X509CRLEntryStream reaperStream = null;
    ASN1InputStream asn1In = null;

    try {
        reaperStream = new X509CRLEntryStream(crlToChange);
        try {
            if (!reaperStream.hasNext()) {
                emptyCrl = true;
                preScanned = true;
                return this;
            }

            while (reaperStream.hasNext()) {
                X509CRLEntryObject entry = reaperStream.next();
                if (validator != null && validator.shouldDelete(entry)) {
                    deletedEntries.add(entry.getSerialNumber());
                    deletedEntriesLength += entry.getEncoded().length;
                }
            }
        } catch (CRLException e) {
            throw new IOException("Could not read CRL entry", e);
        }

        /* At this point, crlToChange is at the point where the crlExtensions would
         * be.  RFC 5280 says that "Conforming CRL issuers are REQUIRED to include
         * the authority key identifier (Section 5.2.1) and the CRL number (Section 5.2.3)
         * extensions in all CRLs issued.
         */
        byte[] oldExtensions = null;
        DERObject o;
        asn1In = new ASN1InputStream(crlToChange);
        while ((o = asn1In.readObject()) != null) {
            if (o instanceof DERSequence) {
                // Now we are at the signatureAlgorithm
                DERSequence seq = (DERSequence) o;
                if (seq.getObjectAt(0) instanceof DERObjectIdentifier) {
                    signingAlg = new AlgorithmIdentifier(seq);
                    digestAlg = new DefaultDigestAlgorithmIdentifierFinder().find(signingAlg);

                    try {
                        // Build the signer
                        this.signer = new RSADigestSigner(createDigest(digestAlg));
                        signer.init(true,
                                new RSAKeyParameters(true, key.getModulus(), key.getPrivateExponent()));
                    } catch (CryptoException e) {
                        throw new IOException(
                                "Could not create RSADigest signer for " + digestAlg.getAlgorithm());
                    }
                }
            } else if (o instanceof DERBitString) {
                oldSigLength = o.getDEREncoded().length;
            } else {
                if (oldExtensions != null) {
                    throw new IllegalStateException("Already read in CRL extensions.");
                }
                oldExtensions = ((DERTaggedObject) o).getDEREncoded();
            }
        }

        if (oldExtensions == null) {
            /* v1 CRLs (defined in RFC 1422) don't require extensions but all new
             * CRLs should be v2 (defined in RFC 5280).  In the extremely unlikely
             * event that someone is working with a v1 CRL, we handle it here although
             * we print a warning.
             */
            preScanned = true;
            newExtensions = null;
            extensionsDelta = 0;
            log.warn("The CRL you are modifying is a version 1 CRL."
                    + " Please investigate moving to a version 2 CRL by adding the CRL Number"
                    + " and Authority Key Identifier extensions.");
            return this;
        }
        newExtensions = updateExtensions(oldExtensions);
        extensionsDelta = (newExtensions.length - oldExtensions.length)
                + findHeaderBytesDelta(oldExtensions.length, newExtensions.length);
    } finally {
        if (reaperStream != null) {
            reaperStream.close();
        }
        IOUtils.closeQuietly(asn1In);
    }
    preScanned = true;
    return this;
}

---