Java Code Examples for org.bouncycastle.asn1.x509.Extensions#getExtensionParsedValue()

private GeneralName[] getRequestedSubjectAltNames(X500Name requestedSubject,
    Extensions requestedExtns) throws CertprofileException, BadCertTemplateException {
  ASN1Encodable extValue = (requestedExtns == null) ? null
      : requestedExtns.getExtensionParsedValue(Extension.subjectAlternativeName);

  Map<ASN1ObjectIdentifier, GeneralNameTag> subjectToSubjectAltNameModes =
      certprofile.getSubjectToSubjectAltNameModes();
  if (extValue == null && subjectToSubjectAltNameModes == null) {
    return null;
  }

  GeneralNames reqNames = (extValue == null) ? null : GeneralNames.getInstance(extValue);

  Set<GeneralNameMode> subjectAltNameModes = certprofile.getSubjectAltNameModes();
  if (subjectAltNameModes == null && subjectToSubjectAltNameModes == null) {
    return (reqNames == null) ? null : reqNames.getNames();
  }

  List<GeneralName> grantedNames = new LinkedList<>();
  // copy the required attributes of Subject
  if (subjectToSubjectAltNameModes != null) {
    X500Name grantedSubject = certprofile.getSubject(requestedSubject).getGrantedSubject();

    for (ASN1ObjectIdentifier attrType : subjectToSubjectAltNameModes.keySet()) {
      GeneralNameTag tag = subjectToSubjectAltNameModes.get(attrType);

      RDN[] rdns = grantedSubject.getRDNs(attrType);
      if (rdns == null || rdns.length == 0) {
        rdns = requestedSubject.getRDNs(attrType);
      }

      if (rdns == null || rdns.length == 0) {
        continue;
      }

      for (RDN rdn : rdns) {
        String rdnValue = X509Util.rdnValueToString(rdn.getFirst().getValue());
        switch (tag) {
          case rfc822Name:
            grantedNames.add(new GeneralName(tag.getTag(), rdnValue.toLowerCase()));
            break;
          case DNSName:
          case uniformResourceIdentifier:
          case IPAddress:
          case directoryName:
          case registeredID:
            grantedNames.add(new GeneralName(tag.getTag(), rdnValue));
            break;
          default:
            throw new IllegalStateException(
                "should not reach here, unknown GeneralName tag " + tag);
        } // end switch (tag)
      }
    }
  }

  // copy the requested SubjectAltName entries
  if (reqNames != null) {
    GeneralName[] reqL = reqNames.getNames();
    for (int i = 0; i < reqL.length; i++) {
      grantedNames.add(reqL[i]);
    }
  }

  return grantedNames.isEmpty() ? null : grantedNames.toArray(new GeneralName[0]);
}
 

private void checkExtnSubjectInfoAccess(StringBuilder failureMsg, byte[] extensionValue,
    Extensions requestedExtns, ExtensionControl extControl) {
  Map<ASN1ObjectIdentifier, Set<GeneralNameMode>> conf =
      certprofile.getSubjectInfoAccessModes();
  if (conf == null) {
    failureMsg.append("extension is present but not expected; ");
    return;
  }

  ASN1Encodable requestExtValue = null;
  if (requestedExtns != null) {
    requestExtValue = requestedExtns.getExtensionParsedValue(Extension.subjectInfoAccess);
  }
  if (requestExtValue == null) {
    failureMsg.append("extension is present but not expected; ");
    return;
  }

  ASN1Sequence requestSeq = ASN1Sequence.getInstance(requestExtValue);
  ASN1Sequence certSeq = ASN1Sequence.getInstance(extensionValue);

  int size = requestSeq.size();

  if (certSeq.size() != size) {
    addViolation(failureMsg, "size of GeneralNames", certSeq.size(), size);
    return;
  }

  for (int i = 0; i < size; i++) {
    AccessDescription ad = AccessDescription.getInstance(requestSeq.getObjectAt(i));
    ASN1ObjectIdentifier accessMethod = ad.getAccessMethod();
    Set<GeneralNameMode> generalNameModes = conf.get(accessMethod);

    if (generalNameModes == null) {
      failureMsg.append("accessMethod in requestedExtension ")
        .append(accessMethod.getId()).append(" is not allowed; ");
      continue;
    }

    AccessDescription certAccessDesc = AccessDescription.getInstance(
        certSeq.getObjectAt(i));
    ASN1ObjectIdentifier certAccessMethod = certAccessDesc.getAccessMethod();

    boolean bo = (accessMethod == null) ? (certAccessMethod == null)
        : accessMethod.equals(certAccessMethod);

    if (!bo) {
      addViolation(failureMsg, "accessMethod",
          (certAccessMethod == null) ? "null" : certAccessMethod.getId(),
          (accessMethod == null) ? "null" : accessMethod.getId());
      continue;
    }

    GeneralName accessLocation;
    try {
      accessLocation = createGeneralName(ad.getAccessLocation(), generalNameModes);
    } catch (BadCertTemplateException ex) {
      failureMsg.append("invalid requestedExtension: ").append(ex.getMessage()).append("; ");
      continue;
    }

    GeneralName certAccessLocation = certAccessDesc.getAccessLocation();
    if (!certAccessLocation.equals(accessLocation)) {
      failureMsg.append("accessLocation does not match the requested one; ");
    }
  }
}
 

private PKIBody cmpUnRevokeRemoveCertificates(PKIMessage request, PKIHeaderBuilder respHeader,
    CmpControl cmpControl, PKIHeader reqHeader, PKIBody reqBody, CmpRequestorInfo requestor,
    String msgId, AuditEvent event) {
  Integer requiredPermission = null;
  boolean allRevdetailsOfSameType = true;

  RevReqContent rr = RevReqContent.getInstance(reqBody.getContent());
  RevDetails[] revContent = rr.toRevDetailsArray();

  int len = revContent.length;
  for (int i = 0; i < len; i++) {
    RevDetails revDetails = revContent[i];
    Extensions crlDetails = revDetails.getCrlEntryDetails();
    int reasonCode = CrlReason.UNSPECIFIED.getCode();
    if (crlDetails != null) {
      ASN1ObjectIdentifier extId = Extension.reasonCode;
      ASN1Encodable extValue = crlDetails.getExtensionParsedValue(extId);
      if (extValue != null) {
        reasonCode = ASN1Enumerated.getInstance(extValue).getValue().intValue();
      }
    }

    if (reasonCode == XiSecurityConstants.CMP_CRL_REASON_REMOVE) {
      if (requiredPermission == null) {
        event.addEventType(CaAuditConstants.Cmp.TYPE_rr_remove);
        requiredPermission = PermissionConstants.REMOVE_CERT;
      } else if (requiredPermission != PermissionConstants.REMOVE_CERT) {
        allRevdetailsOfSameType = false;
        break;
      }
    } else if (reasonCode == CrlReason.REMOVE_FROM_CRL.getCode()) {
      if (requiredPermission == null) {
        event.addEventType(CaAuditConstants.Cmp.TYPE_rr_unrevoke);
        requiredPermission = PermissionConstants.UNREVOKE_CERT;
      } else if (requiredPermission != PermissionConstants.UNREVOKE_CERT) {
        allRevdetailsOfSameType = false;
        break;
      }
    } else {
      if (requiredPermission == null) {
        event.addEventType(CaAuditConstants.Cmp.TYPE_rr_revoke);
        requiredPermission = PermissionConstants.REVOKE_CERT;
      } else if (requiredPermission != PermissionConstants.REVOKE_CERT) {
        allRevdetailsOfSameType = false;
        break;
      }
    }
  } // end for

  if (!allRevdetailsOfSameType) {
    ErrorMsgContent emc = new ErrorMsgContent(
        new PKIStatusInfo(PKIStatus.rejection,
        new PKIFreeText("not all revDetails are of the same type"),
        new PKIFailureInfo(PKIFailureInfo.badRequest)));

    return new PKIBody(PKIBody.TYPE_ERROR, emc);
  }

  try {
    checkPermission(requestor, requiredPermission);
  } catch (InsuffientPermissionException ex) {
    event.setStatus(AuditStatus.FAILED);
    event.addEventData(CaAuditConstants.NAME_message, "NOT_PERMITTED");
    return buildErrorMsgPkiBody(PKIStatus.rejection, PKIFailureInfo.notAuthorized, null);
  }

  return unRevokeRemoveCertificates(request, rr, requiredPermission, cmpControl, msgId, event);
}