Examples with DERUTF8String org.bouncycastle.asn1.DERUTF8String used on opensource projects

Example 41 with DERUTF8String

use of org.bouncycastle.asn1.DERUTF8String in project zm-mailbox by Zimbra.

the class CertUtil method getSubjectAltNameOtherNameUPN.

String getSubjectAltNameOtherNameUPN() {
    Collection<List<?>> generalNames = null;
    try {
        generalNames = cert.getSubjectAlternativeNames();
    } catch (CertificateParsingException e) {
        ZimbraLog.account.warn(LOG_PREFIX + "unable to get subject alternative names", e);
    }
    if (generalNames == null) {
        return null;
    }
    ASN1InputStream decoder = null;
    try {
        // Check that the certificate includes the SubjectAltName extension
        for (List<?> generalName : generalNames) {
            Integer tag = (Integer) generalName.get(0);
            if (GeneralName.otherName == tag.intValue()) {
                // Value is encoded using ASN.1
                decoder = new ASN1InputStream((byte[]) generalName.toArray()[1]);
                ASN1Encodable encoded = decoder.readObject();
                DERSequence derSeq = (DERSequence) encoded;
                ASN1ObjectIdentifier typeId = ASN1ObjectIdentifier.getInstance(derSeq.getObjectAt(0));
                String oid = typeId.getId();
                String value = null;
                ASN1TaggedObject otherNameValue = ASN1TaggedObject.getInstance(derSeq.getObjectAt(1));
                if (OID_UPN.equals(oid)) {
                    ASN1TaggedObject upnValue = ASN1TaggedObject.getInstance(otherNameValue.getObject());
                    DERUTF8String str = DERUTF8String.getInstance(upnValue.getObject());
                    value = str.getString();
                    return value;
                }
            }
        }
    } catch (IOException e) {
        ZimbraLog.account.warn(LOG_PREFIX + "unable to process ASN.1 data", e);
    } finally {
        ByteUtil.closeStream(decoder);
    }
    return null;
}

Example 42 with DERUTF8String

use of org.bouncycastle.asn1.DERUTF8String in project jruby-openssl by jruby.

the class PEMInputOutput method readAuxCertificate.

private static X509AuxCertificate readAuxCertificate(final BufferedReader in, final String endMarker) throws IOException {
    final byte[] bytes = readBase64Bytes(in, endMarker);
    final ASN1InputStream asn1 = new ASN1InputStream(bytes);
    ByteArrayInputStream certBytes = new ByteArrayInputStream((asn1.readObject()).getEncoded());
    try {
        final X509Certificate cert = (X509Certificate) getX509CertificateFactory().generateCertificate(certBytes);
        final ASN1Sequence auxSeq = (ASN1Sequence) asn1.readObject();
        final X509Aux aux;
        if (auxSeq != null) {
            // X509Aux fields :
            final List<String> trust;
            final List<String> reject;
            final String alias;
            final byte[] keyid;
            final List<ASN1Primitive> other;
            int ix = 0;
            ASN1Encodable obj = null;
            if (auxSeq.size() > ix)
                obj = auxSeq.getObjectAt(ix);
            if (obj instanceof ASN1Sequence) {
                trust = new ArrayList<String>();
                final ASN1Sequence trustSeq = (ASN1Sequence) obj;
                for (int i = 0; i < trustSeq.size(); i++) {
                    trust.add(((ASN1ObjectIdentifier) trustSeq.getObjectAt(i)).getId());
                }
                // next obj
                obj = (auxSeq.size() > ++ix) ? auxSeq.getObjectAt(ix) : null;
            } else
                trust = Collections.emptyList();
            if (obj instanceof ASN1TaggedObject && ((ASN1TaggedObject) obj).getTagNo() == 0) {
                reject = new ArrayList<String>();
                final ASN1Sequence rejectSeq = (ASN1Sequence) ((ASN1TaggedObject) obj).getObject();
                for (int i = 0; i < rejectSeq.size(); i++) {
                    reject.add(((ASN1ObjectIdentifier) rejectSeq.getObjectAt(i)).getId());
                }
                // next obj
                obj = (auxSeq.size() > ++ix) ? auxSeq.getObjectAt(ix) : null;
            } else
                reject = Collections.emptyList();
            if (obj instanceof DERUTF8String) {
                alias = ((DERUTF8String) obj).getString();
                // next obj
                obj = (auxSeq.size() > ++ix) ? auxSeq.getObjectAt(ix) : null;
            } else
                alias = null;
            if (obj instanceof DEROctetString) {
                keyid = ((DEROctetString) obj).getOctets();
                // next obj
                obj = (auxSeq.size() > ++ix) ? auxSeq.getObjectAt(ix) : null;
            } else
                keyid = null;
            if (obj instanceof ASN1TaggedObject && ((ASN1TaggedObject) obj).getTagNo() == 1) {
                other = new ArrayList<ASN1Primitive>();
                final ASN1Sequence otherSeq = (ASN1Sequence) ((ASN1TaggedObject) obj).getObject();
                for (int i = 0; i < otherSeq.size(); i++) {
                    other.add((ASN1Primitive) otherSeq.getObjectAt(i));
                }
            // obj = ( auxSeq.size() > ++ix ) ? auxSeq.getObjectAt(ix) : null; // next obj
            } else
                other = Collections.emptyList();
            aux = new X509Aux(alias, keyid, Collections.unmodifiableList(trust), Collections.unmodifiableList(reject), Collections.unmodifiableList(other));
        } else {
            aux = null;
        }
        return new X509AuxCertificate(cert, aux);
    } catch (CertificateException e) {
        throw new IOException("failed to read aux cert: " + e, e);
    }
}

Example 43 with DERUTF8String

use of org.bouncycastle.asn1.DERUTF8String in project jruby-openssl by jruby.

the class PEMInputOutput method writeX509Aux.

public static void writeX509Aux(final Writer _out, final X509AuxCertificate cert) throws IOException {
    BufferedWriter out = makeBuffered(_out);
    final byte[] encoding;
    final int encLen;
    try {
        if (cert.aux == null) {
            encoding = cert.getEncoded();
            encLen = encoding.length;
        } else {
            ByteArrayOutputStream baos = new ByteArrayOutputStream();
            byte[] enc = cert.getEncoded();
            baos.write(enc, 0, enc.length);
            final X509Aux aux = cert.aux;
            ASN1EncodableVector a1 = new ASN1EncodableVector();
            if (aux.trust.size() > 0) {
                ASN1EncodableVector a2 = new ASN1EncodableVector();
                for (String trust : aux.trust) {
                    a2.add(new ASN1ObjectIdentifier(trust));
                }
                a1.add(new DLSequence(a2));
            }
            if (aux.reject.size() > 0) {
                ASN1EncodableVector a2 = new ASN1EncodableVector();
                for (String reject : aux.reject) {
                    a2.add(new ASN1ObjectIdentifier(reject));
                }
                a1.add(new DERTaggedObject(0, new DLSequence(a2)));
            }
            if (aux.alias != null) {
                a1.add(new DERUTF8String(aux.alias));
            }
            if (aux.keyid != null) {
                a1.add(new DEROctetString(aux.keyid));
            }
            if (aux.other.size() > 0) {
                ASN1EncodableVector a2 = new ASN1EncodableVector();
                for (ASN1Primitive other : aux.other) a2.add(other);
                a1.add(new DERTaggedObject(1, new DLSequence(a2)));
            }
            enc = new DLSequence(a1).getEncoded();
            baos.write(enc, 0, enc.length);
            encoding = baos.buffer();
            encLen = baos.size();
        }
    } catch (CertificateEncodingException e) {
        throw new IOException("problem with encoding object in write_X509_AUX", e);
    }
    out.write(BEF_G + PEM_STRING_X509_TRUSTED + AFT);
    out.newLine();
    writeEncoded(out, encoding, encLen);
    out.write(BEF_E + PEM_STRING_X509_TRUSTED + AFT);
    out.newLine();
    out.flush();
}

Example 44 with DERUTF8String

use of org.bouncycastle.asn1.DERUTF8String in project jruby-openssl by jruby.

the class ASN1 method decodeObject.

// ObjectId
static IRubyObject decodeObject(final ThreadContext context, final RubyModule ASN1, final org.bouncycastle.asn1.ASN1Encodable obj) throws IOException, IllegalArgumentException {
    final Ruby runtime = context.runtime;
    if (obj instanceof ASN1Integer) {
        final BN val = BN.newBN(runtime, ((ASN1Integer) obj).getValue());
        return ASN1.getClass("Integer").callMethod(context, "new", val);
    }
    if (obj instanceof DERInteger) {
        final BN val = BN.newBN(runtime, ((DERInteger) obj).getValue());
        return ASN1.getClass("Integer").callMethod(context, "new", val);
    }
    if (obj instanceof DERBitString) {
        final DERBitString derObj = (DERBitString) obj;
        RubyString str = runtime.newString(new ByteList(derObj.getBytes(), false));
        IRubyObject bitString = ASN1.getClass("BitString").callMethod(context, "new", str);
        bitString.callMethod(context, "unused_bits=", runtime.newFixnum(derObj.getPadBits()));
        return bitString;
    }
    if (obj instanceof ASN1String) {
        final Integer typeId = typeId(obj.getClass());
        String type = typeId == null ? null : (String) (ASN1_INFO[typeId][2]);
        final ByteList bytes;
        if (obj instanceof DERUTF8String) {
            if (type == null)
                type = "UTF8String";
            bytes = new ByteList(((DERUTF8String) obj).getString().getBytes("UTF-8"), false);
        } else {
            if (type == null) {
                if (obj instanceof DERNumericString) {
                    type = "NumericString";
                } else if (obj instanceof DERPrintableString) {
                    type = "PrintableString";
                } else if (obj instanceof DERIA5String) {
                    type = "IA5String";
                } else if (obj instanceof DERT61String) {
                    type = "T61String";
                } else if (obj instanceof DERGeneralString) {
                    type = "GeneralString";
                } else if (obj instanceof DERUniversalString) {
                    type = "UniversalString";
                } else if (obj instanceof DERBMPString) {
                    type = "BMPString";
                } else {
                    // NOTE "VideotexString", "GraphicString", "ISO64String" not-handled in BC !
                    throw new IllegalArgumentException("could not handle ASN1 string type: " + obj + " (" + obj.getClass().getName() + ")");
                }
            }
            bytes = ByteList.create(((ASN1String) obj).getString());
        }
        return ASN1.getClass(type).callMethod(context, "new", runtime.newString(bytes));
    }
    if (obj instanceof ASN1OctetString) {
        final ByteList octets = new ByteList(((ASN1OctetString) obj).getOctets(), false);
        // final ByteList octets = new ByteList(((ASN1OctetString) obj).getEncoded(ASN1Encoding.DER), false);
        return ASN1.getClass("OctetString").callMethod(context, "new", runtime.newString(octets));
    }
    if (obj instanceof ASN1Null) {
        return ASN1.getClass("Null").callMethod(context, "new", runtime.getNil());
    }
    if (obj instanceof ASN1Boolean) {
        final boolean val = ((ASN1Boolean) obj).isTrue();
        return ASN1.getClass("Boolean").callMethod(context, "new", runtime.newBoolean(val));
    }
    // DERBoolean extends ASN1Boolean only since 1.51 (<= 1.50 the other way around)
    if (obj instanceof DERBoolean) {
        final boolean val = ((DERBoolean) obj).isTrue();
        return ASN1.getClass("Boolean").callMethod(context, "new", runtime.newBoolean(val));
    }
    if (obj instanceof ASN1UTCTime) {
        final Date adjustedTime;
        try {
            adjustedTime = ((ASN1UTCTime) obj).getAdjustedDate();
        } catch (ParseException e) {
            throw new IOException(e);
        }
        final RubyTime time = RubyTime.newTime(runtime, adjustedTime.getTime());
        return ASN1.getClass("UTCTime").callMethod(context, "new", time);
    }
    // NOTE: keep for BC versions compatibility ... extends ASN1UTCTime (since BC 1.51)
    if (obj instanceof DERUTCTime) {
        final Date adjustedTime;
        try {
            adjustedTime = ((DERUTCTime) obj).getAdjustedDate();
        } catch (ParseException e) {
            throw new IOException(e);
        }
        final RubyTime time = RubyTime.newTime(runtime, adjustedTime.getTime());
        return ASN1.getClass("UTCTime").callMethod(context, "new", time);
    }
    if (obj instanceof ASN1GeneralizedTime) {
        final Date generalTime;
        try {
            generalTime = ((ASN1GeneralizedTime) obj).getDate();
        } catch (ParseException e) {
            throw new IOException(e);
        }
        final RubyTime time = RubyTime.newTime(runtime, generalTime.getTime());
        return ASN1.getClass("GeneralizedTime").callMethod(context, "new", time);
    }
    // NOTE: keep for BC versions compatibility ... extends ASN1GeneralizedTime (since BC 1.51)
    if (obj instanceof DERGeneralizedTime) {
        final Date generalTime;
        try {
            generalTime = ((DERGeneralizedTime) obj).getDate();
        } catch (ParseException e) {
            throw new IOException(e);
        }
        final RubyTime time = RubyTime.newTime(runtime, generalTime.getTime());
        return ASN1.getClass("GeneralizedTime").callMethod(context, "new", time);
    }
    if (obj instanceof ASN1ObjectIdentifier) {
        final String objId = ((ASN1ObjectIdentifier) obj).getId();
        return ASN1.getClass("ObjectId").callMethod(context, "new", runtime.newString(objId));
    }
    // DERObjectIdentifier extends ASN1ObjectIdentifier = 1.51
    if (obj instanceof DERObjectIdentifier) {
        final String objId = ((DERObjectIdentifier) obj).getId();
        return ASN1.getClass("ObjectId").callMethod(context, "new", runtime.newString(objId));
    }
    if (obj instanceof ASN1TaggedObject) {
        final ASN1TaggedObject taggedObj = (ASN1TaggedObject) obj;
        IRubyObject val = decodeObject(context, ASN1, taggedObj.getObject());
        IRubyObject tag = runtime.newFixnum(taggedObj.getTagNo());
        IRubyObject tag_class = runtime.newSymbol("CONTEXT_SPECIFIC");
        final RubyArray valArr = runtime.newArray(val);
        return ASN1.getClass("ASN1Data").callMethod(context, "new", new IRubyObject[] { valArr, tag, tag_class });
    }
    if (obj instanceof DERApplicationSpecific) {
        final DERApplicationSpecific appSpecific = (DERApplicationSpecific) obj;
        IRubyObject tag = runtime.newFixnum(appSpecific.getApplicationTag());
        IRubyObject tag_class = runtime.newSymbol("APPLICATION");
        final ASN1Sequence sequence = (ASN1Sequence) appSpecific.getObject(SEQUENCE);
        @SuppressWarnings("unchecked") final RubyArray valArr = decodeObjects(context, ASN1, sequence.getObjects());
        return ASN1.getClass("ASN1Data").callMethod(context, "new", new IRubyObject[] { valArr, tag, tag_class });
    }
    if (obj instanceof ASN1Sequence) {
        @SuppressWarnings("unchecked") RubyArray arr = decodeObjects(context, ASN1, ((ASN1Sequence) obj).getObjects());
        return ASN1.getClass("Sequence").callMethod(context, "new", arr);
    }
    if (obj instanceof ASN1Set) {
        @SuppressWarnings("unchecked") RubyArray arr = decodeObjects(context, ASN1, ((ASN1Set) obj).getObjects());
        return ASN1.getClass("Set").callMethod(context, "new", arr);
    }
    if (obj instanceof ASN1Enumerated) {
        final RubyInteger value = RubyBignum.bignorm(runtime, ((ASN1Enumerated) obj).getValue());
        return ASN1.getClass("Enumerated").callMethod(context, "new", value);
    }
    throw new IllegalArgumentException("unable to decode object: " + obj + " (" + (obj == null ? "" : obj.getClass().getName()) + ")");
}

Example 45 with DERUTF8String

use of org.bouncycastle.asn1.DERUTF8String in project Openfire by igniterealtime.

the class CertificateManagerTest method testServerIdentitiesDnsSrv.

/**
 * {@link CertificateManager#getServerIdentities(X509Certificate)} should return:
 * <ul>
 *     <li>the 'DNS SRV' subjectAltName value</li>
 *     <li>explicitly not the Common Name</li>
 * </ul>
 *
 * when a certificate contains:
 * <ul>
 *     <li>a subjectAltName entry of type otherName with an ASN.1 Object Identifier of "id-on-dnsSRV"</li>
 * </ul>
 */
@Test
public void testServerIdentitiesDnsSrv() throws Exception {
    // Setup fixture.
    final String subjectCommonName = "MySubjectCommonName";
    final String subjectAltNameDnsSrv = "MySubjectAltNameXmppAddr";
    final X509v3CertificateBuilder builder = new JcaX509v3CertificateBuilder(// Issuer
    new X500Name("CN=MyIssuer"), // Random serial number
    BigInteger.valueOf(Math.abs(new SecureRandom().nextInt())), // Not before 30 days ago
    new Date(System.currentTimeMillis() - (1000L * 60 * 60 * 24 * 30)), // Not after 99 days from now
    new Date(System.currentTimeMillis() + (1000L * 60 * 60 * 24 * 99)), // Subject
    new X500Name("CN=" + subjectCommonName), subjectKeyPair.getPublic());
    final DERSequence otherName = new DERSequence(new ASN1Encodable[] { DNS_SRV_OID, new DERUTF8String("_xmpp-server." + subjectAltNameDnsSrv) });
    final GeneralNames subjectAltNames = new GeneralNames(new GeneralName(GeneralName.otherName, otherName));
    builder.addExtension(Extension.subjectAlternativeName, true, subjectAltNames);
    final X509CertificateHolder certificateHolder = builder.build(contentSigner);
    final X509Certificate cert = new JcaX509CertificateConverter().getCertificate(certificateHolder);
    // Execute system under test
    final List<String> serverIdentities = CertificateManager.getServerIdentities(cert);
    // Verify result
    assertEquals(1, serverIdentities.size());
    assertTrue(serverIdentities.contains(subjectAltNameDnsSrv));
    assertFalse(serverIdentities.contains(subjectCommonName));
}