Examples with CRLException java.security.cert.CRLException used on opensource projects

Example 16 with CRLException

use of java.security.cert.CRLException in project j2objc by google.

the class X509CRLImpl method encodeInfo.

/**
     * Encodes the "to-be-signed" CRL to the OutputStream.
     *
     * @param out the OutputStream to write to.
     * @exception CRLException on encoding errors.
     */
public void encodeInfo(OutputStream out) throws CRLException {
    try {
        DerOutputStream tmp = new DerOutputStream();
        DerOutputStream rCerts = new DerOutputStream();
        DerOutputStream seq = new DerOutputStream();
        if (// v2 crl encode version
        version != 0)
            tmp.putInteger(version);
        infoSigAlgId.encode(tmp);
        if ((version == 0) && (issuer.toString() == null))
            throw new CRLException("Null Issuer DN not allowed in v1 CRL");
        issuer.encode(tmp);
        if (thisUpdate.getTime() < YR_2050)
            tmp.putUTCTime(thisUpdate);
        else
            tmp.putGeneralizedTime(thisUpdate);
        if (nextUpdate != null) {
            if (nextUpdate.getTime() < YR_2050)
                tmp.putUTCTime(nextUpdate);
            else
                tmp.putGeneralizedTime(nextUpdate);
        }
        if (!revokedList.isEmpty()) {
            for (X509CRLEntry entry : revokedList) {
                ((X509CRLEntryImpl) entry).encode(rCerts);
            }
            tmp.write(DerValue.tag_Sequence, rCerts);
        }
        if (extensions != null)
            extensions.encode(tmp, isExplicit);
        seq.write(DerValue.tag_Sequence, tmp);
        tbsCertList = seq.toByteArray();
        out.write(tbsCertList);
    } catch (IOException e) {
        throw new CRLException("Encoding error: " + e.getMessage());
    }
}

Example 17 with CRLException

use of java.security.cert.CRLException in project j2objc by google.

the class X509CRLImpl method verify.

/**
     * Verifies that this CRL was signed using the
     * private key that corresponds to the given public key,
     * and that the signature verification was computed by
     * the given provider.
     *
     * @param key the PublicKey used to carry out the verification.
     * @param sigProvider the name of the signature provider.
     *
     * @exception NoSuchAlgorithmException on unsupported signature
     * algorithms.
     * @exception InvalidKeyException on incorrect key.
     * @exception NoSuchProviderException on incorrect provider.
     * @exception SignatureException on signature errors.
     * @exception CRLException on encoding errors.
     */
public synchronized void verify(PublicKey key, String sigProvider) throws CRLException, NoSuchAlgorithmException, InvalidKeyException, NoSuchProviderException, SignatureException {
    if (sigProvider == null) {
        sigProvider = "";
    }
    if ((verifiedPublicKey != null) && verifiedPublicKey.equals(key)) {
        // this public key. Make sure providers match, too.
        if (sigProvider.equals(verifiedProvider)) {
            return;
        }
    }
    if (signedCRL == null) {
        throw new CRLException("Uninitialized CRL");
    }
    Signature sigVerf = null;
    if (sigProvider.length() == 0) {
        sigVerf = Signature.getInstance(sigAlgId.getName());
    } else {
        sigVerf = Signature.getInstance(sigAlgId.getName(), sigProvider);
    }
    sigVerf.initVerify(key);
    if (tbsCertList == null) {
        throw new CRLException("Uninitialized CRL");
    }
    sigVerf.update(tbsCertList, 0, tbsCertList.length);
    if (!sigVerf.verify(signature)) {
        throw new SignatureException("Signature does not match.");
    }
    verifiedPublicKey = key;
    verifiedProvider = sigProvider;
}

Example 18 with CRLException

use of java.security.cert.CRLException in project j2objc by google.

the class X509CRLImpl method parse.

/*
     * Parses an X.509 CRL, should be used only by constructors.
     */
private void parse(DerValue val) throws CRLException, IOException {
    // check if can over write the certificate
    if (readOnly)
        throw new CRLException("cannot over-write existing CRL");
    if (val.getData() == null || val.tag != DerValue.tag_Sequence)
        throw new CRLException("Invalid DER-encoded CRL data");
    signedCRL = val.toByteArray();
    DerValue[] seq = new DerValue[3];
    seq[0] = val.data.getDerValue();
    seq[1] = val.data.getDerValue();
    seq[2] = val.data.getDerValue();
    if (val.data.available() != 0)
        throw new CRLException("signed overrun, bytes = " + val.data.available());
    if (seq[0].tag != DerValue.tag_Sequence)
        throw new CRLException("signed CRL fields invalid");
    sigAlgId = AlgorithmId.parse(seq[1]);
    signature = seq[2].getBitString();
    if (seq[1].data.available() != 0)
        throw new CRLException("AlgorithmId field overrun");
    if (seq[2].data.available() != 0)
        throw new CRLException("Signature field overrun");
    // the tbsCertsList
    tbsCertList = seq[0].toByteArray();
    // parse the information
    DerInputStream derStrm = seq[0].data;
    DerValue tmp;
    byte nextByte;
    // version (optional if v1)
    // by default, version = v1 == 0
    version = 0;
    nextByte = (byte) derStrm.peekByte();
    if (nextByte == DerValue.tag_Integer) {
        version = derStrm.getInteger();
        if (// i.e. v2
        version != 1)
            throw new CRLException("Invalid version");
    }
    tmp = derStrm.getDerValue();
    // signature
    AlgorithmId tmpId = AlgorithmId.parse(tmp);
    // the "inner" and "outer" signature algorithms must match
    if (!tmpId.equals(sigAlgId))
        throw new CRLException("Signature algorithm mismatch");
    infoSigAlgId = tmpId;
    // issuer
    issuer = new X500Name(derStrm);
    if (issuer.isEmpty()) {
        throw new CRLException("Empty issuer DN not allowed in X509CRLs");
    }
    // thisUpdate
    // check if UTCTime encoded or GeneralizedTime
    nextByte = (byte) derStrm.peekByte();
    if (nextByte == DerValue.tag_UtcTime) {
        thisUpdate = derStrm.getUTCTime();
    } else if (nextByte == DerValue.tag_GeneralizedTime) {
        thisUpdate = derStrm.getGeneralizedTime();
    } else {
        throw new CRLException("Invalid encoding for thisUpdate" + " (tag=" + nextByte + ")");
    }
    if (derStrm.available() == 0)
        // done parsing no more optional fields present
        return;
    // nextUpdate (optional)
    nextByte = (byte) derStrm.peekByte();
    if (nextByte == DerValue.tag_UtcTime) {
        nextUpdate = derStrm.getUTCTime();
    } else if (nextByte == DerValue.tag_GeneralizedTime) {
        nextUpdate = derStrm.getGeneralizedTime();
    }
    if (derStrm.available() == 0)
        // done parsing no more optional fields present
        return;
    // revokedCertificates (optional)
    nextByte = (byte) derStrm.peekByte();
    if ((nextByte == DerValue.tag_SequenceOf) && (!((nextByte & 0x0c0) == 0x080))) {
        DerValue[] badCerts = derStrm.getSequence(4);
        X500Principal crlIssuer = getIssuerX500Principal();
        X500Principal badCertIssuer = crlIssuer;
        for (int i = 0; i < badCerts.length; i++) {
            X509CRLEntryImpl entry = new X509CRLEntryImpl(badCerts[i]);
            badCertIssuer = getCertIssuer(entry, badCertIssuer);
            entry.setCertificateIssuer(crlIssuer, badCertIssuer);
            X509IssuerSerial issuerSerial = new X509IssuerSerial(badCertIssuer, entry.getSerialNumber());
            revokedMap.put(issuerSerial, entry);
            revokedList.add(entry);
        }
    }
    if (derStrm.available() == 0)
        // done parsing no extensions
        return;
    // crlExtensions (optional)
    tmp = derStrm.getDerValue();
    if (tmp.isConstructed() && tmp.isContextSpecific((byte) 0)) {
        extensions = new CRLExtensions(tmp.data);
    }
    readOnly = true;
}

Example 19 with CRLException

use of java.security.cert.CRLException in project j2objc by google.

the class PKCS7 method encodeSignedData.

/**
     * Encodes the signed data to a DerOutputStream.
     *
     * @param out the DerOutputStream to write the encoded data to.
     * @exception IOException on encoding errors.
     */
public void encodeSignedData(DerOutputStream out) throws IOException {
    DerOutputStream signedData = new DerOutputStream();
    // version
    signedData.putInteger(version);
    // digestAlgorithmIds
    signedData.putOrderedSetOf(DerValue.tag_Set, digestAlgorithmIds);
    // contentInfo
    contentInfo.encode(signedData);
    // certificates (optional)
    if (certificates != null && certificates.length != 0) {
        // cast to X509CertImpl[] since X509CertImpl implements DerEncoder
        X509CertImpl[] implCerts = new X509CertImpl[certificates.length];
        for (int i = 0; i < certificates.length; i++) {
            if (certificates[i] instanceof X509CertImpl)
                implCerts[i] = (X509CertImpl) certificates[i];
            else {
                try {
                    byte[] encoded = certificates[i].getEncoded();
                    implCerts[i] = new X509CertImpl(encoded);
                } catch (CertificateException ce) {
                    IOException ie = new IOException(ce.getMessage());
                    ie.initCause(ce);
                    throw ie;
                }
            }
        }
        // Add the certificate set (tagged with [0] IMPLICIT)
        // to the signed data
        signedData.putOrderedSetOf((byte) 0xA0, implCerts);
    }
    // CRLs (optional)
    if (crls != null && crls.length != 0) {
        // cast to X509CRLImpl[] since X509CRLImpl implements DerEncoder
        Set<X509CRLImpl> implCRLs = new HashSet<X509CRLImpl>(crls.length);
        for (X509CRL crl : crls) {
            if (crl instanceof X509CRLImpl)
                implCRLs.add((X509CRLImpl) crl);
            else {
                try {
                    byte[] encoded = crl.getEncoded();
                    implCRLs.add(new X509CRLImpl(encoded));
                } catch (CRLException ce) {
                    IOException ie = new IOException(ce.getMessage());
                    ie.initCause(ce);
                    throw ie;
                }
            }
        }
        // Add the CRL set (tagged with [1] IMPLICIT)
        // to the signed data
        signedData.putOrderedSetOf((byte) 0xA1, implCRLs.toArray(new X509CRLImpl[implCRLs.size()]));
    }
    // signerInfos
    signedData.putOrderedSetOf(DerValue.tag_Set, signerInfos);
    // making it a signed data block
    DerValue signedDataSeq = new DerValue(DerValue.tag_Sequence, signedData.toByteArray());
    // making it a content info sequence
    ContentInfo block = new ContentInfo(ContentInfo.SIGNED_DATA_OID, signedDataSeq);
    // writing out the contentInfo sequence
    block.encode(out);
}

Example 20 with CRLException

use of java.security.cert.CRLException in project j2objc by google.

the class PKCS7 method parseSignedData.

private void parseSignedData(DerValue val) throws ParsingException, IOException {
    DerInputStream dis = val.toDerInputStream();
    // Version
    version = dis.getBigInteger();
    // digestAlgorithmIds
    DerValue[] digestAlgorithmIdVals = dis.getSet(1);
    int len = digestAlgorithmIdVals.length;
    digestAlgorithmIds = new AlgorithmId[len];
    try {
        for (int i = 0; i < len; i++) {
            DerValue oid = digestAlgorithmIdVals[i];
            digestAlgorithmIds[i] = AlgorithmId.parse(oid);
        }
    } catch (IOException e) {
        ParsingException pe = new ParsingException("Error parsing digest AlgorithmId IDs: " + e.getMessage());
        pe.initCause(e);
        throw pe;
    }
    // contentInfo
    contentInfo = new ContentInfo(dis);
    CertificateFactory certfac = null;
    try {
        certfac = CertificateFactory.getInstance("X.509");
    } catch (CertificateException ce) {
    // do nothing
    }
    /*
         * check if certificates (implicit tag) are provided
         * (certificates are OPTIONAL)
         */
    if ((byte) (dis.peekByte()) == (byte) 0xA0) {
        DerValue[] certVals = dis.getSet(2, true, true);
        len = certVals.length;
        certificates = new X509Certificate[len];
        int count = 0;
        for (int i = 0; i < len; i++) {
            ByteArrayInputStream bais = null;
            try {
                byte tag = certVals[i].getTag();
                // CertificateChoices ignored.
                if (tag == DerValue.tag_Sequence) {
                    byte[] original = certVals[i].getOriginalEncodedForm();
                    if (certfac == null) {
                        certificates[count] = new X509CertImpl(certVals[i], original);
                    } else {
                        bais = new ByteArrayInputStream(original);
                        certificates[count] = new VerbatimX509Certificate((X509Certificate) certfac.generateCertificate(bais), original);
                        bais.close();
                        bais = null;
                    }
                    count++;
                }
            } catch (CertificateException ce) {
                ParsingException pe = new ParsingException(ce.getMessage());
                pe.initCause(ce);
                throw pe;
            } catch (IOException ioe) {
                ParsingException pe = new ParsingException(ioe.getMessage());
                pe.initCause(ioe);
                throw pe;
            } finally {
                if (bais != null)
                    bais.close();
            }
        }
        if (count != len) {
            certificates = Arrays.copyOf(certificates, count);
        }
    }
    // check if crls (implicit tag) are provided (crls are OPTIONAL)
    if ((byte) (dis.peekByte()) == (byte) 0xA1) {
        DerValue[] crlVals = dis.getSet(1, true);
        len = crlVals.length;
        crls = new X509CRL[len];
        for (int i = 0; i < len; i++) {
            ByteArrayInputStream bais = null;
            try {
                if (certfac == null)
                    crls[i] = new X509CRLImpl(crlVals[i]);
                else {
                    byte[] encoded = crlVals[i].toByteArray();
                    bais = new ByteArrayInputStream(encoded);
                    crls[i] = (X509CRL) certfac.generateCRL(bais);
                    bais.close();
                    bais = null;
                }
            } catch (CRLException e) {
                ParsingException pe = new ParsingException(e.getMessage());
                pe.initCause(e);
                throw pe;
            } finally {
                if (bais != null)
                    bais.close();
            }
        }
    }
    // signerInfos
    DerValue[] signerInfoVals = dis.getSet(1);
    len = signerInfoVals.length;
    signerInfos = new SignerInfo[len];
    for (int i = 0; i < len; i++) {
        DerInputStream in = signerInfoVals[i].toDerInputStream();
        signerInfos[i] = new SignerInfo(in);
    }
}