use of com.github.zhenwei.core.asn1.x509.qualified.QCStatement in project xipki by xipki.
the class ExtensionsChecker method checkExtensionQcStatements.
// method checkExtensionPrivateKeyUsagePeriod
private void checkExtensionQcStatements(StringBuilder failureMsg, byte[] extensionValue, Extensions requestedExtensions, ExtensionControl extControl) {
QcStatements conf = qcStatements;
if (conf == null) {
byte[] expected = getExpectedExtValue(Extension.qCStatements, requestedExtensions, extControl);
if (!Arrays.equals(expected, extensionValue)) {
addViolation(failureMsg, "extension values", extensionValue, (expected == null) ? "not present" : hex(expected));
}
return;
}
final int expSize = conf.getQcStatement().size();
ASN1Sequence extValue = ASN1Sequence.getInstance(extensionValue);
final int isSize = extValue.size();
if (isSize != expSize) {
addViolation(failureMsg, "number of statements", isSize, expSize);
return;
}
// extract the euLimit and pdsLocations data from request
Map<String, int[]> reqQcEuLimits = new HashMap<>();
Extension reqExtension = (requestedExtensions == null) ? null : requestedExtensions.getExtension(Extension.qCStatements);
if (reqExtension != null) {
ASN1Sequence seq = ASN1Sequence.getInstance(reqExtension.getParsedValue());
final int n = seq.size();
for (int j = 0; j < n; j++) {
QCStatement stmt = QCStatement.getInstance(seq.getObjectAt(j));
if (ObjectIdentifiers.id_etsi_qcs_QcLimitValue.equals(stmt.getStatementId())) {
MonetaryValue monetaryValue = MonetaryValue.getInstance(stmt.getStatementInfo());
int amount = monetaryValue.getAmount().intValue();
int exponent = monetaryValue.getExponent().intValue();
Iso4217CurrencyCode currency = monetaryValue.getCurrency();
String currencyS = currency.isAlphabetic() ? currency.getAlphabetic().toUpperCase() : Integer.toString(currency.getNumeric());
reqQcEuLimits.put(currencyS, new int[] { amount, exponent });
}
}
}
for (int i = 0; i < expSize; i++) {
QCStatement is = QCStatement.getInstance(extValue.getObjectAt(i));
QcStatementType exp = conf.getQcStatement().get(i);
if (!is.getStatementId().getId().equals(exp.getStatementId().getValue())) {
addViolation(failureMsg, "statmentId[" + i + "]", is.getStatementId().getId(), exp.getStatementId().getValue());
continue;
}
if (exp.getStatementValue() == null) {
if (is.getStatementInfo() != null) {
addViolation(failureMsg, "statmentInfo[" + i + "]", "present", "absent");
}
continue;
}
if (is.getStatementInfo() == null) {
addViolation(failureMsg, "statmentInfo[" + i + "]", "absent", "present");
continue;
}
QcStatementValueType expStatementValue = exp.getStatementValue();
try {
if (expStatementValue.getConstant() != null) {
byte[] expValue = expStatementValue.getConstant().getValue();
byte[] isValue = is.getStatementInfo().toASN1Primitive().getEncoded();
if (!Arrays.equals(isValue, expValue)) {
addViolation(failureMsg, "statementInfo[" + i + "]", hex(isValue), hex(expValue));
}
} else if (expStatementValue.getQcRetentionPeriod() != null) {
String isValue = ASN1Integer.getInstance(is.getStatementInfo()).toString();
String expValue = expStatementValue.getQcRetentionPeriod().toString();
if (!isValue.equals(expValue)) {
addViolation(failureMsg, "statementInfo[" + i + "]", isValue, expValue);
}
} else if (expStatementValue.getPdsLocations() != null) {
Set<String> pdsLocations = new HashSet<>();
ASN1Sequence pdsLocsSeq = ASN1Sequence.getInstance(is.getStatementInfo());
int size = pdsLocsSeq.size();
for (int k = 0; k < size; k++) {
ASN1Sequence pdsLocSeq = ASN1Sequence.getInstance(pdsLocsSeq.getObjectAt(k));
int size2 = pdsLocSeq.size();
if (size2 != 2) {
throw new IllegalArgumentException("sequence size is " + size2 + " but expected 2");
}
String url = DERIA5String.getInstance(pdsLocSeq.getObjectAt(0)).getString();
String lang = DERPrintableString.getInstance(pdsLocSeq.getObjectAt(1)).getString();
pdsLocations.add("url=" + url + ",lang=" + lang);
}
PdsLocationsType pdsLocationsConf = expStatementValue.getPdsLocations();
Set<String> expectedPdsLocations = new HashSet<>();
for (PdsLocationType m : pdsLocationsConf.getPdsLocation()) {
expectedPdsLocations.add("url=" + m.getUrl() + ",lang=" + m.getLanguage());
}
Set<String> diffs = strInBnotInA(expectedPdsLocations, pdsLocations);
if (CollectionUtil.isNonEmpty(diffs)) {
failureMsg.append("statementInfo[").append(i).append("]: ").append(diffs).append(" are present but not expected; ");
}
diffs = strInBnotInA(pdsLocations, expectedPdsLocations);
if (CollectionUtil.isNonEmpty(diffs)) {
failureMsg.append("statementInfo[").append(i).append("]: ").append(diffs).append(" are absent but are required; ");
}
} else if (expStatementValue.getQcEuLimitValue() != null) {
QcEuLimitValueType euLimitConf = expStatementValue.getQcEuLimitValue();
String expCurrency = euLimitConf.getCurrency().toUpperCase();
int[] expAmountExp = reqQcEuLimits.get(expCurrency);
Range2Type range = euLimitConf.getAmount();
int value;
if (range.getMin() == range.getMax()) {
value = range.getMin();
} else if (expAmountExp != null) {
value = expAmountExp[0];
} else {
failureMsg.append("found no QcEuLimit for currency '").append(expCurrency).append("'; ");
return;
}
// CHECKSTYLE:SKIP
String expAmount = Integer.toString(value);
range = euLimitConf.getExponent();
if (range.getMin() == range.getMax()) {
value = range.getMin();
} else if (expAmountExp != null) {
value = expAmountExp[1];
} else {
failureMsg.append("found no QcEuLimit for currency '").append(expCurrency).append("'; ");
return;
}
String expExponent = Integer.toString(value);
MonetaryValue monterayValue = MonetaryValue.getInstance(is.getStatementInfo());
Iso4217CurrencyCode currency = monterayValue.getCurrency();
String isCurrency = currency.isAlphabetic() ? currency.getAlphabetic() : Integer.toString(currency.getNumeric());
String isAmount = monterayValue.getAmount().toString();
String isExponent = monterayValue.getExponent().toString();
if (!isCurrency.equals(expCurrency)) {
addViolation(failureMsg, "statementInfo[" + i + "].qcEuLimit.currency", isCurrency, expCurrency);
}
if (!isAmount.equals(expAmount)) {
addViolation(failureMsg, "statementInfo[" + i + "].qcEuLimit.amount", isAmount, expAmount);
}
if (!isExponent.equals(expExponent)) {
addViolation(failureMsg, "statementInfo[" + i + "].qcEuLimit.exponent", isExponent, expExponent);
}
} else {
throw new RuntimeException("statementInfo[" + i + "]should not reach here");
}
} catch (IOException ex) {
failureMsg.append("statementInfo[").append(i).append("] has incorrect syntax; ");
}
}
}
use of com.github.zhenwei.core.asn1.x509.qualified.QCStatement in project xipki by xipki.
the class O2tChecker method checkExtnQcStatements.
// method checkExtnPrivateKeyUsagePeriod
void checkExtnQcStatements(StringBuilder failureMsg, byte[] extnValue, Extensions requestedExtns, ExtensionControl extnControl) {
QcStatements qcStatements = caller.getQcStatements();
if (qcStatements == null) {
caller.checkConstantExtnValue(Extension.qCStatements, failureMsg, extnValue, requestedExtns, extnControl);
return;
}
final int expSize = qcStatements.getQcStatements().size();
ASN1Sequence extValue = ASN1Sequence.getInstance(extnValue);
final int isSize = extValue.size();
if (isSize != expSize) {
addViolation(failureMsg, "number of statements", isSize, expSize);
return;
}
// extract the euLimit and pdsLocations data from request
Map<String, int[]> reqQcEuLimits = new HashMap<>();
Extension reqExtension = (requestedExtns == null) ? null : requestedExtns.getExtension(Extension.qCStatements);
if (reqExtension != null) {
ASN1Sequence seq = ASN1Sequence.getInstance(reqExtension.getParsedValue());
final int n = seq.size();
for (int j = 0; j < n; j++) {
QCStatement stmt = QCStatement.getInstance(seq.getObjectAt(j));
if (Extn.id_etsi_qcs_QcLimitValue.equals(stmt.getStatementId())) {
MonetaryValue monetaryValue = MonetaryValue.getInstance(stmt.getStatementInfo());
int amount = monetaryValue.getAmount().intValue();
int exponent = monetaryValue.getExponent().intValue();
Iso4217CurrencyCode currency = monetaryValue.getCurrency();
String currencyS = currency.isAlphabetic() ? currency.getAlphabetic().toUpperCase() : Integer.toString(currency.getNumeric());
reqQcEuLimits.put(currencyS, new int[] { amount, exponent });
}
}
}
for (int i = 0; i < expSize; i++) {
QCStatement is = QCStatement.getInstance(extValue.getObjectAt(i));
QcStatementType exp = qcStatements.getQcStatements().get(i);
if (!is.getStatementId().getId().equals(exp.getStatementId().getOid())) {
addViolation(failureMsg, "statmentId[" + i + "]", is.getStatementId().getId(), exp.getStatementId().getOid());
continue;
}
if (exp.getStatementValue() == null) {
if (is.getStatementInfo() != null) {
addViolation(failureMsg, "statmentInfo[" + i + "]", "present", "absent");
}
continue;
}
if (is.getStatementInfo() == null) {
addViolation(failureMsg, "statmentInfo[" + i + "]", "absent", "present");
continue;
}
QcStatementValueType expStatementValue = exp.getStatementValue();
try {
if (expStatementValue.getConstant() != null) {
byte[] expValue = expStatementValue.getConstant().getValue();
byte[] isValue = is.getStatementInfo().toASN1Primitive().getEncoded();
if (!Arrays.equals(isValue, expValue)) {
addViolation(failureMsg, "statementInfo[" + i + "]", hex(isValue), hex(expValue));
}
} else if (expStatementValue.getQcRetentionPeriod() != null) {
String isValue = ASN1Integer.getInstance(is.getStatementInfo()).toString();
String expValue = expStatementValue.getQcRetentionPeriod().toString();
if (!isValue.equals(expValue)) {
addViolation(failureMsg, "statementInfo[" + i + "]", isValue, expValue);
}
} else if (expStatementValue.getPdsLocations() != null) {
Set<String> pdsLocations = new HashSet<>();
ASN1Sequence pdsLocsSeq = ASN1Sequence.getInstance(is.getStatementInfo());
int size = pdsLocsSeq.size();
for (int k = 0; k < size; k++) {
ASN1Sequence pdsLocSeq = ASN1Sequence.getInstance(pdsLocsSeq.getObjectAt(k));
int size2 = pdsLocSeq.size();
if (size2 != 2) {
throw new IllegalArgumentException("sequence size is " + size2 + " but expected 2");
}
String url = DERIA5String.getInstance(pdsLocSeq.getObjectAt(0)).getString();
String lang = DERPrintableString.getInstance(pdsLocSeq.getObjectAt(1)).getString();
pdsLocations.add("url=" + url + ",lang=" + lang);
}
Set<String> expectedPdsLocations = new HashSet<>();
for (PdsLocationType m : expStatementValue.getPdsLocations()) {
expectedPdsLocations.add("url=" + m.getUrl() + ",lang=" + m.getLanguage());
}
Set<String> diffs = CheckerUtil.strInBnotInA(expectedPdsLocations, pdsLocations);
if (isNotEmpty(diffs)) {
failureMsg.append("statementInfo[").append(i).append("]: ").append(diffs).append(" are present but not expected; ");
}
diffs = CheckerUtil.strInBnotInA(pdsLocations, expectedPdsLocations);
if (isNotEmpty(diffs)) {
failureMsg.append("statementInfo[").append(i).append("]: ").append(diffs).append(" are absent but are required; ");
}
} else if (expStatementValue.getQcEuLimitValue() != null) {
QcEuLimitValueType euLimitConf = expStatementValue.getQcEuLimitValue();
String expCurrency = euLimitConf.getCurrency().toUpperCase();
int[] expAmountExp = reqQcEuLimits.get(expCurrency);
Range2Type range = euLimitConf.getAmount();
int value;
if (range.getMin() == range.getMax()) {
value = range.getMin();
} else if (expAmountExp != null) {
value = expAmountExp[0];
} else {
failureMsg.append("found no QcEuLimit for currency '").append(expCurrency).append("'; ");
return;
}
String expAmount = Integer.toString(value);
range = euLimitConf.getExponent();
if (range.getMin() == range.getMax()) {
value = range.getMin();
} else if (expAmountExp != null) {
value = expAmountExp[1];
} else {
failureMsg.append("found no QcEuLimit for currency '").append(expCurrency).append("'; ");
return;
}
String expExponent = Integer.toString(value);
MonetaryValue monterayValue = MonetaryValue.getInstance(is.getStatementInfo());
Iso4217CurrencyCode currency = monterayValue.getCurrency();
String isCurrency = currency.isAlphabetic() ? currency.getAlphabetic() : Integer.toString(currency.getNumeric());
String isAmount = monterayValue.getAmount().toString();
String isExponent = monterayValue.getExponent().toString();
if (!isCurrency.equals(expCurrency)) {
addViolation(failureMsg, "statementInfo[" + i + "].qcEuLimit.currency", isCurrency, expCurrency);
}
if (!isAmount.equals(expAmount)) {
addViolation(failureMsg, "statementInfo[" + i + "].qcEuLimit.amount", isAmount, expAmount);
}
if (!isExponent.equals(expExponent)) {
addViolation(failureMsg, "statementInfo[" + i + "].qcEuLimit.exponent", isExponent, expExponent);
}
} else {
throw new IllegalStateException("statementInfo[" + i + "]should not reach here");
}
} catch (IOException ex) {
failureMsg.append("statementInfo[").append(i).append("] has incorrect syntax; ");
}
}
}
use of com.github.zhenwei.core.asn1.x509.qualified.QCStatement in project xipki by xipki.
the class XijsonExtensions method initQcStatements.
// method initPolicyMappings
private void initQcStatements(Set<ASN1ObjectIdentifier> extnIds, Map<String, ExtensionType> extensions) throws CertprofileException {
ASN1ObjectIdentifier type = Extension.qCStatements;
if (!extensionControls.containsKey(type)) {
return;
}
extnIds.remove(type);
QcStatements extConf = getExtension(type, extensions).getQcStatements();
if (extConf == null) {
return;
}
List<QcStatementType> qcStatementTypes = extConf.getQcStatements();
this.qcStatementsOption = new ArrayList<>(qcStatementTypes.size());
Set<String> currencyCodes = new HashSet<>();
boolean requireInfoFromReq = false;
for (QcStatementType m : qcStatementTypes) {
ASN1ObjectIdentifier qcStatementId = new ASN1ObjectIdentifier(m.getStatementId().getOid());
QcStatementOption qcStatementOption;
QcStatementValueType statementValue = m.getStatementValue();
if (statementValue == null) {
QCStatement qcStatment = new QCStatement(qcStatementId);
qcStatementOption = new QcStatementOption(qcStatment);
} else if (statementValue.getQcRetentionPeriod() != null) {
QCStatement qcStatment = new QCStatement(qcStatementId, new ASN1Integer(statementValue.getQcRetentionPeriod()));
qcStatementOption = new QcStatementOption(qcStatment);
} else if (statementValue.getConstant() != null) {
ASN1Encodable constantStatementValue;
try {
constantStatementValue = new ASN1StreamParser(statementValue.getConstant().getValue()).readObject();
} catch (IOException ex) {
throw new CertprofileException("can not parse the constant value of QcStatement");
}
QCStatement qcStatment = new QCStatement(qcStatementId, constantStatementValue);
qcStatementOption = new QcStatementOption(qcStatment);
} else if (statementValue.getQcEuLimitValue() != null) {
QcEuLimitValueType euLimitType = statementValue.getQcEuLimitValue();
String tmpCurrency = euLimitType.getCurrency().toUpperCase();
if (currencyCodes.contains(tmpCurrency)) {
throw new CertprofileException("Duplicated definition of qcStatments with QCEuLimitValue" + " for the currency " + tmpCurrency);
}
Iso4217CurrencyCode currency = StringUtil.isNumber(tmpCurrency) ? new Iso4217CurrencyCode(Integer.parseInt(tmpCurrency)) : new Iso4217CurrencyCode(tmpCurrency);
Range2Type r1 = euLimitType.getAmount();
Range2Type r2 = euLimitType.getExponent();
if (r1.getMin() == r1.getMax() && r2.getMin() == r2.getMax()) {
MonetaryValue monetaryValue = new MonetaryValue(currency, r1.getMin(), r2.getMin());
QCStatement qcStatement = new QCStatement(qcStatementId, monetaryValue);
qcStatementOption = new QcStatementOption(qcStatement);
} else {
MonetaryValueOption monetaryValueOption = new MonetaryValueOption(currency, r1, r2);
qcStatementOption = new QcStatementOption(qcStatementId, monetaryValueOption);
requireInfoFromReq = true;
}
currencyCodes.add(tmpCurrency);
} else if (statementValue.getPdsLocations() != null) {
ASN1EncodableVector vec = new ASN1EncodableVector();
for (PdsLocationType pl : statementValue.getPdsLocations()) {
ASN1EncodableVector vec2 = new ASN1EncodableVector();
vec2.add(new DERIA5String(pl.getUrl()));
String lang = pl.getLanguage();
if (lang.length() != 2) {
throw new CertprofileException("invalid language '" + lang + "'");
}
vec2.add(new DERPrintableString(lang));
DERSequence seq = new DERSequence(vec2);
vec.add(seq);
}
QCStatement qcStatement = new QCStatement(qcStatementId, new DERSequence(vec));
qcStatementOption = new QcStatementOption(qcStatement);
} else {
throw new CertprofileException("unknown value of qcStatment");
}
this.qcStatementsOption.add(qcStatementOption);
}
if (requireInfoFromReq) {
return;
}
ASN1EncodableVector vec = new ASN1EncodableVector();
for (QcStatementOption m : qcStatementsOption) {
if (m.getStatement() == null) {
throw new IllegalStateException("should not reach here");
}
vec.add(m.getStatement());
}
ASN1Sequence seq = new DERSequence(vec);
qcStatments = new ExtensionValue(extensionControls.get(type).isCritical(), seq);
qcStatementsOption = null;
}
use of com.github.zhenwei.core.asn1.x509.qualified.QCStatement in project LinLong-Java by zhenwei1108.
the class PKIXCertPathReviewer method processQcStatements.
private boolean processQcStatements(X509Certificate cert, int index) {
try {
boolean unknownStatement = false;
ASN1Sequence qcSt = (ASN1Sequence) getExtensionValue(cert, QC_STATEMENT);
for (int j = 0; j < qcSt.size(); j++) {
QCStatement stmt = QCStatement.getInstance(qcSt.getObjectAt(j));
if (QCStatement.id_etsi_qcs_QcCompliance.equals(stmt.getStatementId())) {
// process statement - just write a notification that the certificate contains this statement
ErrorBundle msg = new ErrorBundle(RESOURCE_NAME, "CertPathReviewer.QcEuCompliance");
addNotification(msg, index);
} else if (QCStatement.id_qcs_pkixQCSyntax_v1.equals(stmt.getStatementId())) {
// process statement - just recognize the statement
} else if (QCStatement.id_etsi_qcs_QcSSCD.equals(stmt.getStatementId())) {
// process statement - just write a notification that the certificate contains this statement
ErrorBundle msg = new ErrorBundle(RESOURCE_NAME, "CertPathReviewer.QcSSCD");
addNotification(msg, index);
} else if (QCStatement.id_etsi_qcs_LimiteValue.equals(stmt.getStatementId())) {
// process statement - write a notification containing the limit value
MonetaryValue limit = MonetaryValue.getInstance(stmt.getStatementInfo());
Iso4217CurrencyCode currency = limit.getCurrency();
double value = limit.getAmount().doubleValue() * Math.pow(10, limit.getExponent().doubleValue());
ErrorBundle msg;
if (limit.getCurrency().isAlphabetic()) {
msg = new ErrorBundle(RESOURCE_NAME, "CertPathReviewer.QcLimitValueAlpha", new Object[] { limit.getCurrency().getAlphabetic(), new TrustedInput(new Double(value)), limit });
} else {
msg = new ErrorBundle(RESOURCE_NAME, "CertPathReviewer.QcLimitValueNum", new Object[] { Integers.valueOf(limit.getCurrency().getNumeric()), new TrustedInput(new Double(value)), limit });
}
addNotification(msg, index);
} else {
ErrorBundle msg = new ErrorBundle(RESOURCE_NAME, "CertPathReviewer.QcUnknownStatement", new Object[] { stmt.getStatementId(), new UntrustedInput(stmt) });
addNotification(msg, index);
unknownStatement = true;
}
}
return !unknownStatement;
} catch (AnnotatedException ae) {
ErrorBundle msg = new ErrorBundle(RESOURCE_NAME, "CertPathReviewer.QcStatementExtError");
addError(msg, index);
}
return false;
}
Aggregations