Examples with PKIXCRLStore com.github.zhenwei.provider.jcajce.PKIXCRLStore used on opensource projects

Example 1 with PKIXCRLStore

use of com.github.zhenwei.provider.jcajce.PKIXCRLStore in project LinLong-Java by zhenwei1108.

the class X509RevocationChecker method getAdditionalStoresFromCRLDistributionPoint.

static List<PKIXCRLStore> getAdditionalStoresFromCRLDistributionPoint(CRLDistPoint crldp, Map<GeneralName, PKIXCRLStore> namedCRLStoreMap) throws AnnotatedException {
    if (crldp == null) {
        return Collections.emptyList();
    }
    DistributionPoint[] dps;
    try {
        dps = crldp.getDistributionPoints();
    } catch (Exception e) {
        throw new AnnotatedException("could not read distribution points could not be read", e);
    }
    List<PKIXCRLStore> stores = new ArrayList<PKIXCRLStore>();
    for (int i = 0; i < dps.length; i++) {
        DistributionPointName dpn = dps[i].getDistributionPoint();
        // look for URIs in fullName
        if (dpn != null && dpn.getType() == DistributionPointName.FULL_NAME) {
            GeneralName[] genNames = GeneralNames.getInstance(dpn.getName()).getNames();
            for (int j = 0; j < genNames.length; j++) {
                PKIXCRLStore store = namedCRLStoreMap.get(genNames[j]);
                if (store != null) {
                    stores.add(store);
                }
            }
        }
    }
    return stores;
}

Example 2 with PKIXCRLStore

use of com.github.zhenwei.provider.jcajce.PKIXCRLStore in project LinLong-Java by zhenwei1108.

the class CertPathValidatorUtilities method getDeltaCRLs.

/**
 * Fetches delta CRLs according to RFC 3280 section 5.2.4.
 *
 * @param validityDate The date for which the delta CRLs must be valid.
 * @param completeCRL  The complete CRL the delta CRL is for.
 * @return A <code>Set</code> of <code>X509CRL</code>s with delta CRLs.
 * @throws AnnotatedException if an exception occurs while picking the delta CRLs.
 */
protected static Set getDeltaCRLs(Date validityDate, X509CRL completeCRL, List<CertStore> certStores, List<PKIXCRLStore> pkixCrlStores, JcaJceHelper helper) throws AnnotatedException {
    X509CRLSelector baseDeltaSelect = new X509CRLSelector();
    // 5.2.4 (a)
    try {
        baseDeltaSelect.addIssuerName(PrincipalUtils.getIssuerPrincipal(completeCRL).getEncoded());
    } catch (IOException e) {
        throw new AnnotatedException("Cannot extract issuer from CRL.", e);
    }
    BigInteger completeCRLNumber = null;
    try {
        ASN1Primitive derObject = CertPathValidatorUtilities.getExtensionValue(completeCRL, CRL_NUMBER);
        if (derObject != null) {
            completeCRLNumber = ASN1Integer.getInstance(derObject).getPositiveValue();
        }
    } catch (Exception e) {
        throw new AnnotatedException("CRL number extension could not be extracted from CRL.", e);
    }
    // 5.2.4 (b)
    byte[] idp;
    try {
        idp = completeCRL.getExtensionValue(ISSUING_DISTRIBUTION_POINT);
    } catch (Exception e) {
        throw new AnnotatedException("Issuing distribution point extension value could not be read.", e);
    }
    // 5.2.4 (d)
    baseDeltaSelect.setMinCRLNumber(completeCRLNumber == null ? null : completeCRLNumber.add(BigInteger.valueOf(1)));
    PKIXCRLStoreSelector.Builder selBuilder = new PKIXCRLStoreSelector.Builder(baseDeltaSelect);
    selBuilder.setIssuingDistributionPoint(idp);
    selBuilder.setIssuingDistributionPointEnabled(true);
    // 5.2.4 (c)
    selBuilder.setMaxBaseCRLNumber(completeCRLNumber);
    PKIXCRLStoreSelector deltaSelect = selBuilder.build();
    // find delta CRLs
    Set temp = PKIXCRLUtil.findCRLs(deltaSelect, validityDate, certStores, pkixCrlStores);
    // if the named CRL store is empty, and we're told to check with CRLDP
    if (temp.isEmpty() && Properties.isOverrideSet("com.github.zhenwei.provider.x509.enableCRLDP")) {
        CertificateFactory certFact;
        try {
            certFact = helper.createCertificateFactory("X.509");
        } catch (Exception e) {
            throw new AnnotatedException("cannot create certificate factory: " + e.getMessage(), e);
        }
        CRLDistPoint id = CRLDistPoint.getInstance(idp);
        DistributionPoint[] dps = id.getDistributionPoints();
        for (int i = 0; i < dps.length; i++) {
            DistributionPointName dpn = dps[i].getDistributionPoint();
            // look for URIs in fullName
            if (dpn != null && dpn.getType() == DistributionPointName.FULL_NAME) {
                GeneralName[] genNames = GeneralNames.getInstance(dpn.getName()).getNames();
                for (int j = 0; j < genNames.length; j++) {
                    GeneralName name = genNames[i];
                    if (name.getTagNo() == GeneralName.uniformResourceIdentifier) {
                        try {
                            PKIXCRLStore store = CrlCache.getCrl(certFact, validityDate, new URI(((ASN1String) name.getName()).getString()));
                            if (store != null) {
                                temp = PKIXCRLUtil.findCRLs(deltaSelect, validityDate, Collections.EMPTY_LIST, Collections.singletonList(store));
                            }
                            break;
                        } catch (Exception e) {
                        // ignore...  TODO: maybe log
                        }
                    }
                }
            }
        }
    }
    Set result = new HashSet();
    for (Iterator it = temp.iterator(); it.hasNext(); ) {
        X509CRL crl = (X509CRL) it.next();
        if (isDeltaCRL(crl)) {
            result.add(crl);
        }
    }
    return result;
}

Example 3 with PKIXCRLStore

use of com.github.zhenwei.provider.jcajce.PKIXCRLStore in project LinLong-Java by zhenwei1108.

the class CrlCache method getCrl.

static synchronized PKIXCRLStore getCrl(CertificateFactory certFact, Date validDate, URI distributionPoint) throws IOException, CRLException {
    PKIXCRLStore crlStore = null;
    WeakReference<PKIXCRLStore> markerRef = (WeakReference) cache.get(distributionPoint);
    if (markerRef != null) {
        crlStore = (PKIXCRLStore) markerRef.get();
    }
    if (crlStore != null) {
        boolean isExpired = false;
        for (Iterator it = crlStore.getMatches(null).iterator(); it.hasNext(); ) {
            X509CRL crl = (X509CRL) it.next();
            Date nextUpdate = crl.getNextUpdate();
            if (nextUpdate != null && nextUpdate.before(validDate)) {
                isExpired = true;
                break;
            }
        }
        if (!isExpired) {
            return crlStore;
        }
    }
    Collection crls;
    if (distributionPoint.getScheme().equals("ldap")) {
        crls = getCrlsFromLDAP(certFact, distributionPoint);
    } else {
        // http, https, ftp
        crls = getCrls(certFact, distributionPoint);
    }
    LocalCRLStore localCRLStore = new LocalCRLStore(new CollectionStore<CRL>(crls));
    cache.put(distributionPoint, new WeakReference<PKIXCRLStore>(localCRLStore));
    return localCRLStore;
}

Example 4 with PKIXCRLStore

use of com.github.zhenwei.provider.jcajce.PKIXCRLStore in project LinLong-Java by zhenwei1108.

the class RevocationUtilities method getAdditionalStoresFromCRLDistributionPoint.

static List<PKIXCRLStore> getAdditionalStoresFromCRLDistributionPoint(CRLDistPoint crldp, Map<GeneralName, PKIXCRLStore> namedCRLStoreMap) throws AnnotatedException {
    if (crldp == null) {
        return Collections.emptyList();
    }
    DistributionPoint[] dps;
    try {
        dps = crldp.getDistributionPoints();
    } catch (Exception e) {
        throw new AnnotatedException("Distribution points could not be read.", e);
    }
    List<PKIXCRLStore> stores = new ArrayList<PKIXCRLStore>();
    for (int i = 0; i < dps.length; i++) {
        DistributionPointName dpn = dps[i].getDistributionPoint();
        // look for URIs in fullName
        if (dpn != null && dpn.getType() == DistributionPointName.FULL_NAME) {
            GeneralName[] genNames = GeneralNames.getInstance(dpn.getName()).getNames();
            for (int j = 0; j < genNames.length; j++) {
                PKIXCRLStore store = namedCRLStoreMap.get(genNames[j]);
                if (store != null) {
                    stores.add(store);
                }
            }
        }
    }
    return stores;
}

Example 5 with PKIXCRLStore

use of com.github.zhenwei.provider.jcajce.PKIXCRLStore in project LinLong-Java by zhenwei1108.

the class CertPathValidatorUtilities method getAdditionalStoresFromCRLDistributionPoint.

static List<PKIXCRLStore> getAdditionalStoresFromCRLDistributionPoint(CRLDistPoint crldp, Map<GeneralName, PKIXCRLStore> namedCRLStoreMap, Date validDate, JcaJceHelper helper) throws AnnotatedException {
    if (null == crldp) {
        return Collections.EMPTY_LIST;
    }
    DistributionPoint[] dps;
    try {
        dps = crldp.getDistributionPoints();
    } catch (Exception e) {
        throw new AnnotatedException("Distribution points could not be read.", e);
    }
    List<PKIXCRLStore> stores = new ArrayList<PKIXCRLStore>();
    for (int i = 0; i < dps.length; i++) {
        DistributionPointName dpn = dps[i].getDistributionPoint();
        // look for URIs in fullName
        if (dpn != null && dpn.getType() == DistributionPointName.FULL_NAME) {
            GeneralName[] genNames = GeneralNames.getInstance(dpn.getName()).getNames();
            for (int j = 0; j < genNames.length; j++) {
                PKIXCRLStore store = namedCRLStoreMap.get(genNames[j]);
                if (store != null) {
                    stores.add(store);
                }
            }
        }
    }
    // if the named CRL store is empty, and we're told to check with CRLDP
    if (stores.isEmpty() && Properties.isOverrideSet("com.github.zhenwei.provider.x509.enableCRLDP")) {
        CertificateFactory certFact;
        try {
            certFact = helper.createCertificateFactory("X.509");
        } catch (Exception e) {
            throw new AnnotatedException("cannot create certificate factory: " + e.getMessage(), e);
        }
        for (int i = 0; i < dps.length; i++) {
            DistributionPointName dpn = dps[i].getDistributionPoint();
            // look for URIs in fullName
            if (dpn != null && dpn.getType() == DistributionPointName.FULL_NAME) {
                GeneralName[] genNames = GeneralNames.getInstance(dpn.getName()).getNames();
                for (int j = 0; j < genNames.length; j++) {
                    GeneralName name = genNames[i];
                    if (name.getTagNo() == GeneralName.uniformResourceIdentifier) {
                        try {
                            URI distributionPoint = new URI(((ASN1String) name.getName()).getString());
                            PKIXCRLStore store = CrlCache.getCrl(certFact, validDate, distributionPoint);
                            if (store != null) {
                                stores.add(store);
                            }
                            break;
                        } catch (Exception e) {
                        // ignore...  TODO: maybe log
                        }
                    }
                }
            }
        }
    }
    return stores;
}