Examples with ASN1TaggedObject org.bouncycastle.asn1.ASN1TaggedObject used on opensource projects

Example 36 with ASN1TaggedObject

use of org.bouncycastle.asn1.ASN1TaggedObject in project zm-mailbox by Zimbra.

the class CertUtil method printSubjectAlternativeNames.

private void printSubjectAlternativeNames(PrintStream outStream) throws Exception {
    final String UPN_DISPLAY = "Principal Name";
    final String RFC822NAME_DISPLAY = "RFC822 Name";
    final String DNSNAME_DISPLAY = "DNS Name";
    outStream.format("X509v3 Subject Alternative Name: \n");
    ASN1InputStream decoder = null;
    try {
        Collection<List<?>> generalNames = cert.getSubjectAlternativeNames();
        // Check that the certificate includes the SubjectAltName extension
        if (generalNames == null) {
            return;
        }
        for (List<?> generalName : generalNames) {
            Integer tag = (Integer) generalName.get(0);
            if (GeneralName.otherName == tag.intValue()) {
                // Value is encoded using ASN.1
                decoder = new ASN1InputStream((byte[]) generalName.toArray()[1]);
                ASN1Encodable encoded = decoder.readObject();
                DERSequence derSeq = (DERSequence) encoded;
                ASN1ObjectIdentifier typeId = ASN1ObjectIdentifier.getInstance(derSeq.getObjectAt(0));
                String oid = typeId.getId();
                String value = null;
                ASN1TaggedObject otherNameValue = ASN1TaggedObject.getInstance(derSeq.getObjectAt(1));
                if (OID_UPN.equals(oid)) {
                    ASN1TaggedObject upnValue = ASN1TaggedObject.getInstance(otherNameValue.getObject());
                    DERUTF8String str = DERUTF8String.getInstance(upnValue.getObject());
                    value = str.getString();
                }
                outStream.format("    [%d] %s(%s) = %s\n", tag, oid, UPN_DISPLAY, value);
            } else if (GeneralName.rfc822Name == tag.intValue()) {
                String value = (String) generalName.get(1);
                outStream.format("    [%d] %s = %s\n", tag, RFC822NAME_DISPLAY, value);
            } else if (GeneralName.dNSName == tag.intValue()) {
                String value = (String) generalName.get(1);
                outStream.format("    [%d] %s = %s\n", tag, DNSNAME_DISPLAY, value);
            } else {
                outStream.format("    [%d] - not yet supported\n", tag);
            }
        }
    } catch (CertificateParsingException e) {
        e.printStackTrace();
    } finally {
        ByteUtil.closeStream(decoder);
    }
}

Example 37 with ASN1TaggedObject

use of org.bouncycastle.asn1.ASN1TaggedObject in project zm-mailbox by Zimbra.

the class CertUtil method getSubjectAltNameOtherNameUPN.

String getSubjectAltNameOtherNameUPN() {
    Collection<List<?>> generalNames = null;
    try {
        generalNames = cert.getSubjectAlternativeNames();
    } catch (CertificateParsingException e) {
        ZimbraLog.account.warn(LOG_PREFIX + "unable to get subject alternative names", e);
    }
    if (generalNames == null) {
        return null;
    }
    ASN1InputStream decoder = null;
    try {
        // Check that the certificate includes the SubjectAltName extension
        for (List<?> generalName : generalNames) {
            Integer tag = (Integer) generalName.get(0);
            if (GeneralName.otherName == tag.intValue()) {
                // Value is encoded using ASN.1
                decoder = new ASN1InputStream((byte[]) generalName.toArray()[1]);
                ASN1Encodable encoded = decoder.readObject();
                DERSequence derSeq = (DERSequence) encoded;
                ASN1ObjectIdentifier typeId = ASN1ObjectIdentifier.getInstance(derSeq.getObjectAt(0));
                String oid = typeId.getId();
                String value = null;
                ASN1TaggedObject otherNameValue = ASN1TaggedObject.getInstance(derSeq.getObjectAt(1));
                if (OID_UPN.equals(oid)) {
                    ASN1TaggedObject upnValue = ASN1TaggedObject.getInstance(otherNameValue.getObject());
                    DERUTF8String str = DERUTF8String.getInstance(upnValue.getObject());
                    value = str.getString();
                    return value;
                }
            }
        }
    } catch (IOException e) {
        ZimbraLog.account.warn(LOG_PREFIX + "unable to process ASN.1 data", e);
    } finally {
        ByteUtil.closeStream(decoder);
    }
    return null;
}

Example 38 with ASN1TaggedObject

use of org.bouncycastle.asn1.ASN1TaggedObject in project jruby-openssl by jruby.

the class PEMInputOutput method readAuxCertificate.

private static X509AuxCertificate readAuxCertificate(final BufferedReader in, final String endMarker) throws IOException {
    final byte[] bytes = readBase64Bytes(in, endMarker);
    final ASN1InputStream asn1 = new ASN1InputStream(bytes);
    ByteArrayInputStream certBytes = new ByteArrayInputStream((asn1.readObject()).getEncoded());
    try {
        final X509Certificate cert = (X509Certificate) getX509CertificateFactory().generateCertificate(certBytes);
        final ASN1Sequence auxSeq = (ASN1Sequence) asn1.readObject();
        final X509Aux aux;
        if (auxSeq != null) {
            // X509Aux fields :
            final List<String> trust;
            final List<String> reject;
            final String alias;
            final byte[] keyid;
            final List<ASN1Primitive> other;
            int ix = 0;
            ASN1Encodable obj = null;
            if (auxSeq.size() > ix)
                obj = auxSeq.getObjectAt(ix);
            if (obj instanceof ASN1Sequence) {
                trust = new ArrayList<String>();
                final ASN1Sequence trustSeq = (ASN1Sequence) obj;
                for (int i = 0; i < trustSeq.size(); i++) {
                    trust.add(((ASN1ObjectIdentifier) trustSeq.getObjectAt(i)).getId());
                }
                // next obj
                obj = (auxSeq.size() > ++ix) ? auxSeq.getObjectAt(ix) : null;
            } else
                trust = Collections.emptyList();
            if (obj instanceof ASN1TaggedObject && ((ASN1TaggedObject) obj).getTagNo() == 0) {
                reject = new ArrayList<String>();
                final ASN1Sequence rejectSeq = (ASN1Sequence) ((ASN1TaggedObject) obj).getObject();
                for (int i = 0; i < rejectSeq.size(); i++) {
                    reject.add(((ASN1ObjectIdentifier) rejectSeq.getObjectAt(i)).getId());
                }
                // next obj
                obj = (auxSeq.size() > ++ix) ? auxSeq.getObjectAt(ix) : null;
            } else
                reject = Collections.emptyList();
            if (obj instanceof DERUTF8String) {
                alias = ((DERUTF8String) obj).getString();
                // next obj
                obj = (auxSeq.size() > ++ix) ? auxSeq.getObjectAt(ix) : null;
            } else
                alias = null;
            if (obj instanceof DEROctetString) {
                keyid = ((DEROctetString) obj).getOctets();
                // next obj
                obj = (auxSeq.size() > ++ix) ? auxSeq.getObjectAt(ix) : null;
            } else
                keyid = null;
            if (obj instanceof ASN1TaggedObject && ((ASN1TaggedObject) obj).getTagNo() == 1) {
                other = new ArrayList<ASN1Primitive>();
                final ASN1Sequence otherSeq = (ASN1Sequence) ((ASN1TaggedObject) obj).getObject();
                for (int i = 0; i < otherSeq.size(); i++) {
                    other.add((ASN1Primitive) otherSeq.getObjectAt(i));
                }
            // obj = ( auxSeq.size() > ++ix ) ? auxSeq.getObjectAt(ix) : null; // next obj
            } else
                other = Collections.emptyList();
            aux = new X509Aux(alias, keyid, Collections.unmodifiableList(trust), Collections.unmodifiableList(reject), Collections.unmodifiableList(other));
        } else {
            aux = null;
        }
        return new X509AuxCertificate(cert, aux);
    } catch (CertificateException e) {
        throw new IOException("failed to read aux cert: " + e, e);
    }
}

Example 39 with ASN1TaggedObject

use of org.bouncycastle.asn1.ASN1TaggedObject in project jruby-openssl by jruby.

the class ASN1 method decodeObject.

// ObjectId
static IRubyObject decodeObject(final ThreadContext context, final RubyModule ASN1, final org.bouncycastle.asn1.ASN1Encodable obj) throws IOException, IllegalArgumentException {
    final Ruby runtime = context.runtime;
    if (obj instanceof ASN1Integer) {
        final BN val = BN.newBN(runtime, ((ASN1Integer) obj).getValue());
        return ASN1.getClass("Integer").callMethod(context, "new", val);
    }
    if (obj instanceof DERInteger) {
        final BN val = BN.newBN(runtime, ((DERInteger) obj).getValue());
        return ASN1.getClass("Integer").callMethod(context, "new", val);
    }
    if (obj instanceof DERBitString) {
        final DERBitString derObj = (DERBitString) obj;
        RubyString str = runtime.newString(new ByteList(derObj.getBytes(), false));
        IRubyObject bitString = ASN1.getClass("BitString").callMethod(context, "new", str);
        bitString.callMethod(context, "unused_bits=", runtime.newFixnum(derObj.getPadBits()));
        return bitString;
    }
    if (obj instanceof ASN1String) {
        final Integer typeId = typeId(obj.getClass());
        String type = typeId == null ? null : (String) (ASN1_INFO[typeId][2]);
        final ByteList bytes;
        if (obj instanceof DERUTF8String) {
            if (type == null)
                type = "UTF8String";
            bytes = new ByteList(((DERUTF8String) obj).getString().getBytes("UTF-8"), false);
        } else {
            if (type == null) {
                if (obj instanceof DERNumericString) {
                    type = "NumericString";
                } else if (obj instanceof DERPrintableString) {
                    type = "PrintableString";
                } else if (obj instanceof DERIA5String) {
                    type = "IA5String";
                } else if (obj instanceof DERT61String) {
                    type = "T61String";
                } else if (obj instanceof DERGeneralString) {
                    type = "GeneralString";
                } else if (obj instanceof DERUniversalString) {
                    type = "UniversalString";
                } else if (obj instanceof DERBMPString) {
                    type = "BMPString";
                } else {
                    // NOTE "VideotexString", "GraphicString", "ISO64String" not-handled in BC !
                    throw new IllegalArgumentException("could not handle ASN1 string type: " + obj + " (" + obj.getClass().getName() + ")");
                }
            }
            bytes = ByteList.create(((ASN1String) obj).getString());
        }
        return ASN1.getClass(type).callMethod(context, "new", runtime.newString(bytes));
    }
    if (obj instanceof ASN1OctetString) {
        final ByteList octets = new ByteList(((ASN1OctetString) obj).getOctets(), false);
        // final ByteList octets = new ByteList(((ASN1OctetString) obj).getEncoded(ASN1Encoding.DER), false);
        return ASN1.getClass("OctetString").callMethod(context, "new", runtime.newString(octets));
    }
    if (obj instanceof ASN1Null) {
        return ASN1.getClass("Null").callMethod(context, "new", runtime.getNil());
    }
    if (obj instanceof ASN1Boolean) {
        final boolean val = ((ASN1Boolean) obj).isTrue();
        return ASN1.getClass("Boolean").callMethod(context, "new", runtime.newBoolean(val));
    }
    // DERBoolean extends ASN1Boolean only since 1.51 (<= 1.50 the other way around)
    if (obj instanceof DERBoolean) {
        final boolean val = ((DERBoolean) obj).isTrue();
        return ASN1.getClass("Boolean").callMethod(context, "new", runtime.newBoolean(val));
    }
    if (obj instanceof ASN1UTCTime) {
        final Date adjustedTime;
        try {
            adjustedTime = ((ASN1UTCTime) obj).getAdjustedDate();
        } catch (ParseException e) {
            throw new IOException(e);
        }
        final RubyTime time = RubyTime.newTime(runtime, adjustedTime.getTime());
        return ASN1.getClass("UTCTime").callMethod(context, "new", time);
    }
    // NOTE: keep for BC versions compatibility ... extends ASN1UTCTime (since BC 1.51)
    if (obj instanceof DERUTCTime) {
        final Date adjustedTime;
        try {
            adjustedTime = ((DERUTCTime) obj).getAdjustedDate();
        } catch (ParseException e) {
            throw new IOException(e);
        }
        final RubyTime time = RubyTime.newTime(runtime, adjustedTime.getTime());
        return ASN1.getClass("UTCTime").callMethod(context, "new", time);
    }
    if (obj instanceof ASN1GeneralizedTime) {
        final Date generalTime;
        try {
            generalTime = ((ASN1GeneralizedTime) obj).getDate();
        } catch (ParseException e) {
            throw new IOException(e);
        }
        final RubyTime time = RubyTime.newTime(runtime, generalTime.getTime());
        return ASN1.getClass("GeneralizedTime").callMethod(context, "new", time);
    }
    // NOTE: keep for BC versions compatibility ... extends ASN1GeneralizedTime (since BC 1.51)
    if (obj instanceof DERGeneralizedTime) {
        final Date generalTime;
        try {
            generalTime = ((DERGeneralizedTime) obj).getDate();
        } catch (ParseException e) {
            throw new IOException(e);
        }
        final RubyTime time = RubyTime.newTime(runtime, generalTime.getTime());
        return ASN1.getClass("GeneralizedTime").callMethod(context, "new", time);
    }
    if (obj instanceof ASN1ObjectIdentifier) {
        final String objId = ((ASN1ObjectIdentifier) obj).getId();
        return ASN1.getClass("ObjectId").callMethod(context, "new", runtime.newString(objId));
    }
    // DERObjectIdentifier extends ASN1ObjectIdentifier = 1.51
    if (obj instanceof DERObjectIdentifier) {
        final String objId = ((DERObjectIdentifier) obj).getId();
        return ASN1.getClass("ObjectId").callMethod(context, "new", runtime.newString(objId));
    }
    if (obj instanceof ASN1TaggedObject) {
        final ASN1TaggedObject taggedObj = (ASN1TaggedObject) obj;
        IRubyObject val = decodeObject(context, ASN1, taggedObj.getObject());
        IRubyObject tag = runtime.newFixnum(taggedObj.getTagNo());
        IRubyObject tag_class = runtime.newSymbol("CONTEXT_SPECIFIC");
        final RubyArray valArr = runtime.newArray(val);
        return ASN1.getClass("ASN1Data").callMethod(context, "new", new IRubyObject[] { valArr, tag, tag_class });
    }
    if (obj instanceof DERApplicationSpecific) {
        final DERApplicationSpecific appSpecific = (DERApplicationSpecific) obj;
        IRubyObject tag = runtime.newFixnum(appSpecific.getApplicationTag());
        IRubyObject tag_class = runtime.newSymbol("APPLICATION");
        final ASN1Sequence sequence = (ASN1Sequence) appSpecific.getObject(SEQUENCE);
        @SuppressWarnings("unchecked") final RubyArray valArr = decodeObjects(context, ASN1, sequence.getObjects());
        return ASN1.getClass("ASN1Data").callMethod(context, "new", new IRubyObject[] { valArr, tag, tag_class });
    }
    if (obj instanceof ASN1Sequence) {
        @SuppressWarnings("unchecked") RubyArray arr = decodeObjects(context, ASN1, ((ASN1Sequence) obj).getObjects());
        return ASN1.getClass("Sequence").callMethod(context, "new", arr);
    }
    if (obj instanceof ASN1Set) {
        @SuppressWarnings("unchecked") RubyArray arr = decodeObjects(context, ASN1, ((ASN1Set) obj).getObjects());
        return ASN1.getClass("Set").callMethod(context, "new", arr);
    }
    if (obj instanceof ASN1Enumerated) {
        final RubyInteger value = RubyBignum.bignorm(runtime, ((ASN1Enumerated) obj).getValue());
        return ASN1.getClass("Enumerated").callMethod(context, "new", value);
    }
    throw new IllegalArgumentException("unable to decode object: " + obj + " (" + (obj == null ? "" : obj.getClass().getName()) + ")");
}

Example 40 with ASN1TaggedObject

use of org.bouncycastle.asn1.ASN1TaggedObject in project pdfbox by apache.

the class CertificateVerifier method downloadExtraCertificates.

/**
 * Download extra certificates from the URI mentioned in id-ad-caIssuers in the "authority
 * information access" extension. The method is lenient, i.e. catches all exceptions.
 *
 * @param ext an X509 object that can have extensions.
 *
 * @return a certificate set, never null.
 */
public static Set<X509Certificate> downloadExtraCertificates(X509Extension ext) {
    // https://tools.ietf.org/html/rfc2459#section-4.2.2.1
    // https://tools.ietf.org/html/rfc3280#section-4.2.2.1
    // https://tools.ietf.org/html/rfc4325
    Set<X509Certificate> resultSet = new HashSet<>();
    byte[] authorityExtensionValue = ext.getExtensionValue(Extension.authorityInfoAccess.getId());
    if (authorityExtensionValue == null) {
        return resultSet;
    }
    ASN1Primitive asn1Prim;
    try {
        asn1Prim = JcaX509ExtensionUtils.parseExtensionValue(authorityExtensionValue);
    } catch (IOException ex) {
        LOG.warn(ex.getMessage(), ex);
        return resultSet;
    }
    if (!(asn1Prim instanceof ASN1Sequence)) {
        LOG.warn("ASN1Sequence expected, got " + asn1Prim.getClass().getSimpleName());
        return resultSet;
    }
    ASN1Sequence asn1Seq = (ASN1Sequence) asn1Prim;
    Enumeration<?> objects = asn1Seq.getObjects();
    while (objects.hasMoreElements()) {
        // AccessDescription
        ASN1Sequence obj = (ASN1Sequence) objects.nextElement();
        ASN1Encodable oid = obj.getObjectAt(0);
        if (!X509ObjectIdentifiers.id_ad_caIssuers.equals(oid)) {
            continue;
        }
        ASN1TaggedObject location = (ASN1TaggedObject) obj.getObjectAt(1);
        ASN1OctetString uri = (ASN1OctetString) location.getBaseObject();
        String urlString = new String(uri.getOctets());
        LOG.info("CA issuers URL: " + urlString);
        try (InputStream in = new URL(urlString).openStream()) {
            CertificateFactory certFactory = CertificateFactory.getInstance("X.509");
            Collection<? extends Certificate> altCerts = certFactory.generateCertificates(in);
            altCerts.forEach(altCert -> resultSet.add((X509Certificate) altCert));
            LOG.info("CA issuers URL: " + altCerts.size() + " certificate(s) downloaded");
        } catch (IOException ex) {
            LOG.warn(urlString + " failure: " + ex.getMessage(), ex);
        } catch (CertificateException ex) {
            LOG.warn(ex.getMessage(), ex);
        }
    }
    LOG.info("CA issuers: Downloaded " + resultSet.size() + " certificate(s) total");
    return resultSet;
}