| /* |
| * Copyright (c) 1997, 2010, Oracle and/or its affiliates. All rights reserved. |
| * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. |
| * |
| * This code is free software; you can redistribute it and/or modify it |
| * under the terms of the GNU General Public License version 2 only, as |
| * published by the Free Software Foundation. Oracle designates this |
| * particular file as subject to the "Classpath" exception as provided |
| * by Oracle in the LICENSE file that accompanied this code. |
| * |
| * This code is distributed in the hope that it will be useful, but WITHOUT |
| * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or |
| * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License |
| * version 2 for more details (a copy is included in the LICENSE file that |
| * accompanied this code). |
| * |
| * You should have received a copy of the GNU General Public License version |
| * 2 along with this work; if not, write to the Free Software Foundation, |
| * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA. |
| * |
| * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA |
| * or visit www.oracle.com if you need additional information or have any |
| * questions. |
| */ |
| |
| package sun.security.pkcs; |
| |
| import java.io.IOException; |
| import java.io.OutputStream; |
| import java.security.cert.CertificateException; |
| import java.util.Locale; |
| import java.util.Date; |
| import java.util.Hashtable; |
| import sun.security.x509.CertificateExtensions; |
| import sun.security.util.Debug; |
| import sun.security.util.DerEncoder; |
| import sun.security.util.DerValue; |
| import sun.security.util.DerInputStream; |
| import sun.security.util.DerOutputStream; |
| import sun.security.util.ObjectIdentifier; |
| import sun.misc.HexDumpEncoder; |
| |
| /** |
| * Class supporting any PKCS9 attributes. |
| * Supports DER decoding/encoding and access to attribute values. |
| * |
| * <a name="classTable"><h3>Type/Class Table</h3></a> |
| * The following table shows the correspondence between |
| * PKCS9 attribute types and value component classes. |
| * For types not listed here, its name is the OID |
| * in string form, its value is a (single-valued) |
| * byte array that is the SET's encoding. |
| * |
| * <P> |
| * <TABLE BORDER CELLPADDING=8 ALIGN=CENTER> |
| * |
| * <TR> |
| * <TH>Object Identifier</TH> |
| * <TH>Attribute Name</TH> |
| * <TH>Type</TH> |
| * <TH>Value Class</TH> |
| * </TR> |
| * |
| * <TR> |
| * <TD>1.2.840.113549.1.9.1</TD> |
| * <TD>EmailAddress</TD> |
| * <TD>Multi-valued</TD> |
| * <TD><code>String[]</code></TD> |
| * </TR> |
| * |
| * <TR> |
| * <TD>1.2.840.113549.1.9.2</TD> |
| * <TD>UnstructuredName</TD> |
| * <TD>Multi-valued</TD> |
| * <TD><code>String[]</code></TD> |
| * </TR> |
| * |
| * <TR> |
| * <TD>1.2.840.113549.1.9.3</TD> |
| * <TD>ContentType</TD> |
| * <TD>Single-valued</TD> |
| * <TD><code>ObjectIdentifier</code></TD> |
| * </TR> |
| * |
| * <TR> |
| * <TD>1.2.840.113549.1.9.4</TD> |
| * <TD>MessageDigest</TD> |
| * <TD>Single-valued</TD> |
| * <TD><code>byte[]</code></TD> |
| * </TR> |
| * |
| * <TR> |
| * <TD>1.2.840.113549.1.9.5</TD> |
| * <TD>SigningTime</TD> |
| * <TD>Single-valued</TD> |
| * <TD><code>Date</code></TD> |
| * </TR> |
| * |
| * <TR> |
| * <TD>1.2.840.113549.1.9.6</TD> |
| * <TD>Countersignature</TD> |
| * <TD>Multi-valued</TD> |
| * <TD><code>SignerInfo[]</code></TD> |
| * </TR> |
| * |
| * <TR> |
| * <TD>1.2.840.113549.1.9.7</TD> |
| * <TD>ChallengePassword</TD> |
| * <TD>Single-valued</TD> |
| * <TD><code>String</code></TD> |
| * </TR> |
| * |
| * <TR> |
| * <TD>1.2.840.113549.1.9.8</TD> |
| * <TD>UnstructuredAddress</TD> |
| * <TD>Single-valued</TD> |
| * <TD><code>String</code></TD> |
| * </TR> |
| * |
| * <TR> |
| * <TD>1.2.840.113549.1.9.9</TD> |
| * <TD>ExtendedCertificateAttributes</TD> |
| * <TD>Multi-valued</TD> |
| * <TD>(not supported)</TD> |
| * </TR> |
| * |
| * <TR> |
| * <TD>1.2.840.113549.1.9.10</TD> |
| * <TD>IssuerAndSerialNumber</TD> |
| * <TD>Single-valued</TD> |
| * <TD>(not supported)</TD> |
| * </TR> |
| * |
| * <TR> |
| * <TD>1.2.840.113549.1.9.{11,12}</TD> |
| * <TD>RSA DSI proprietary</TD> |
| * <TD>Single-valued</TD> |
| * <TD>(not supported)</TD> |
| * </TR> |
| * |
| * <TR> |
| * <TD>1.2.840.113549.1.9.13</TD> |
| * <TD>S/MIME unused assignment</TD> |
| * <TD>Single-valued</TD> |
| * <TD>(not supported)</TD> |
| * </TR> |
| * |
| * <TR> |
| * <TD>1.2.840.113549.1.9.14</TD> |
| * <TD>ExtensionRequest</TD> |
| * <TD>Single-valued</TD> |
| * <TD>CertificateExtensions</TD> |
| * </TR> |
| * |
| * <TR> |
| * <TD>1.2.840.113549.1.9.15</TD> |
| * <TD>SMIMECapability</TD> |
| * <TD>Single-valued</TD> |
| * <TD>(not supported)</TD> |
| * </TR> |
| * |
| * <TR> |
| * <TD>1.2.840.113549.1.9.16.2.12</TD> |
| * <TD>SigningCertificate</TD> |
| * <TD>Single-valued</TD> |
| * <TD>SigningCertificateInfo</TD> |
| * </TR> |
| * |
| * <TR> |
| * <TD>1.2.840.113549.1.9.16.2.14</TD> |
| * <TD>SignatureTimestampToken</TD> |
| * <TD>Single-valued</TD> |
| * <TD>byte[]</TD> |
| * </TR> |
| * |
| * </TABLE> |
| * |
| * @author Douglas Hoover |
| */ |
| public class PKCS9Attribute implements DerEncoder { |
| |
| /* Are we debugging ? */ |
| private static final Debug debug = Debug.getInstance("jar"); |
| |
| /** |
| * Array of attribute OIDs defined in PKCS9, by number. |
| */ |
| static final ObjectIdentifier[] PKCS9_OIDS = new ObjectIdentifier[18]; |
| |
| private final static Class<?> BYTE_ARRAY_CLASS; |
| |
| static { // static initializer for PKCS9_OIDS |
| for (int i = 1; i < PKCS9_OIDS.length - 2; i++) { |
| PKCS9_OIDS[i] = |
| ObjectIdentifier.newInternal(new int[]{1,2,840,113549,1,9,i}); |
| } |
| // Initialize SigningCertificate and SignatureTimestampToken |
| // separately (because their values are out of sequence) |
| PKCS9_OIDS[PKCS9_OIDS.length - 2] = |
| ObjectIdentifier.newInternal(new int[]{1,2,840,113549,1,9,16,2,12}); |
| PKCS9_OIDS[PKCS9_OIDS.length - 1] = |
| ObjectIdentifier.newInternal(new int[]{1,2,840,113549,1,9,16,2,14}); |
| |
| try { |
| BYTE_ARRAY_CLASS = Class.forName("[B"); |
| } catch (ClassNotFoundException e) { |
| throw new ExceptionInInitializerError(e.toString()); |
| } |
| } |
| |
| // first element [0] not used |
| public static final ObjectIdentifier EMAIL_ADDRESS_OID = PKCS9_OIDS[1]; |
| public static final ObjectIdentifier UNSTRUCTURED_NAME_OID = PKCS9_OIDS[2]; |
| public static final ObjectIdentifier CONTENT_TYPE_OID = PKCS9_OIDS[3]; |
| public static final ObjectIdentifier MESSAGE_DIGEST_OID = PKCS9_OIDS[4]; |
| public static final ObjectIdentifier SIGNING_TIME_OID = PKCS9_OIDS[5]; |
| public static final ObjectIdentifier COUNTERSIGNATURE_OID = PKCS9_OIDS[6]; |
| public static final ObjectIdentifier CHALLENGE_PASSWORD_OID = PKCS9_OIDS[7]; |
| public static final ObjectIdentifier UNSTRUCTURED_ADDRESS_OID = PKCS9_OIDS[8]; |
| public static final ObjectIdentifier EXTENDED_CERTIFICATE_ATTRIBUTES_OID |
| = PKCS9_OIDS[9]; |
| public static final ObjectIdentifier ISSUER_SERIALNUMBER_OID = PKCS9_OIDS[10]; |
| // [11], [12] are RSA DSI proprietary |
| // [13] ==> signingDescription, S/MIME, not used anymore |
| public static final ObjectIdentifier EXTENSION_REQUEST_OID = PKCS9_OIDS[14]; |
| public static final ObjectIdentifier SMIME_CAPABILITY_OID = PKCS9_OIDS[15]; |
| public static final ObjectIdentifier SIGNING_CERTIFICATE_OID = PKCS9_OIDS[16]; |
| public static final ObjectIdentifier SIGNATURE_TIMESTAMP_TOKEN_OID = |
| PKCS9_OIDS[17]; |
| public static final String EMAIL_ADDRESS_STR = "EmailAddress"; |
| public static final String UNSTRUCTURED_NAME_STR = "UnstructuredName"; |
| public static final String CONTENT_TYPE_STR = "ContentType"; |
| public static final String MESSAGE_DIGEST_STR = "MessageDigest"; |
| public static final String SIGNING_TIME_STR = "SigningTime"; |
| public static final String COUNTERSIGNATURE_STR = "Countersignature"; |
| public static final String CHALLENGE_PASSWORD_STR = "ChallengePassword"; |
| public static final String UNSTRUCTURED_ADDRESS_STR = "UnstructuredAddress"; |
| public static final String EXTENDED_CERTIFICATE_ATTRIBUTES_STR = |
| "ExtendedCertificateAttributes"; |
| public static final String ISSUER_SERIALNUMBER_STR = "IssuerAndSerialNumber"; |
| // [11], [12] are RSA DSI proprietary |
| private static final String RSA_PROPRIETARY_STR = "RSAProprietary"; |
| // [13] ==> signingDescription, S/MIME, not used anymore |
| private static final String SMIME_SIGNING_DESC_STR = "SMIMESigningDesc"; |
| public static final String EXTENSION_REQUEST_STR = "ExtensionRequest"; |
| public static final String SMIME_CAPABILITY_STR = "SMIMECapability"; |
| public static final String SIGNING_CERTIFICATE_STR = "SigningCertificate"; |
| public static final String SIGNATURE_TIMESTAMP_TOKEN_STR = |
| "SignatureTimestampToken"; |
| |
| /** |
| * Hashtable mapping names and variant names of supported |
| * attributes to their OIDs. This table contains all name forms |
| * that occur in PKCS9, in lower case. |
| */ |
| private static final Hashtable<String, ObjectIdentifier> NAME_OID_TABLE = |
| new Hashtable<String, ObjectIdentifier>(18); |
| |
| static { // static initializer for PCKS9_NAMES |
| NAME_OID_TABLE.put("emailaddress", PKCS9_OIDS[1]); |
| NAME_OID_TABLE.put("unstructuredname", PKCS9_OIDS[2]); |
| NAME_OID_TABLE.put("contenttype", PKCS9_OIDS[3]); |
| NAME_OID_TABLE.put("messagedigest", PKCS9_OIDS[4]); |
| NAME_OID_TABLE.put("signingtime", PKCS9_OIDS[5]); |
| NAME_OID_TABLE.put("countersignature", PKCS9_OIDS[6]); |
| NAME_OID_TABLE.put("challengepassword", PKCS9_OIDS[7]); |
| NAME_OID_TABLE.put("unstructuredaddress", PKCS9_OIDS[8]); |
| NAME_OID_TABLE.put("extendedcertificateattributes", PKCS9_OIDS[9]); |
| NAME_OID_TABLE.put("issuerandserialnumber", PKCS9_OIDS[10]); |
| NAME_OID_TABLE.put("rsaproprietary", PKCS9_OIDS[11]); |
| NAME_OID_TABLE.put("rsaproprietary", PKCS9_OIDS[12]); |
| NAME_OID_TABLE.put("signingdescription", PKCS9_OIDS[13]); |
| NAME_OID_TABLE.put("extensionrequest", PKCS9_OIDS[14]); |
| NAME_OID_TABLE.put("smimecapability", PKCS9_OIDS[15]); |
| NAME_OID_TABLE.put("signingcertificate", PKCS9_OIDS[16]); |
| NAME_OID_TABLE.put("signaturetimestamptoken", PKCS9_OIDS[17]); |
| }; |
| |
| /** |
| * Hashtable mapping attribute OIDs defined in PKCS9 to the |
| * corresponding attribute value type. |
| */ |
| private static final Hashtable<ObjectIdentifier, String> OID_NAME_TABLE = |
| new Hashtable<ObjectIdentifier, String>(16); |
| static { |
| OID_NAME_TABLE.put(PKCS9_OIDS[1], EMAIL_ADDRESS_STR); |
| OID_NAME_TABLE.put(PKCS9_OIDS[2], UNSTRUCTURED_NAME_STR); |
| OID_NAME_TABLE.put(PKCS9_OIDS[3], CONTENT_TYPE_STR); |
| OID_NAME_TABLE.put(PKCS9_OIDS[4], MESSAGE_DIGEST_STR); |
| OID_NAME_TABLE.put(PKCS9_OIDS[5], SIGNING_TIME_STR); |
| OID_NAME_TABLE.put(PKCS9_OIDS[6], COUNTERSIGNATURE_STR); |
| OID_NAME_TABLE.put(PKCS9_OIDS[7], CHALLENGE_PASSWORD_STR); |
| OID_NAME_TABLE.put(PKCS9_OIDS[8], UNSTRUCTURED_ADDRESS_STR); |
| OID_NAME_TABLE.put(PKCS9_OIDS[9], EXTENDED_CERTIFICATE_ATTRIBUTES_STR); |
| OID_NAME_TABLE.put(PKCS9_OIDS[10], ISSUER_SERIALNUMBER_STR); |
| OID_NAME_TABLE.put(PKCS9_OIDS[11], RSA_PROPRIETARY_STR); |
| OID_NAME_TABLE.put(PKCS9_OIDS[12], RSA_PROPRIETARY_STR); |
| OID_NAME_TABLE.put(PKCS9_OIDS[13], SMIME_SIGNING_DESC_STR); |
| OID_NAME_TABLE.put(PKCS9_OIDS[14], EXTENSION_REQUEST_STR); |
| OID_NAME_TABLE.put(PKCS9_OIDS[15], SMIME_CAPABILITY_STR); |
| OID_NAME_TABLE.put(PKCS9_OIDS[16], SIGNING_CERTIFICATE_STR); |
| OID_NAME_TABLE.put(PKCS9_OIDS[17], SIGNATURE_TIMESTAMP_TOKEN_STR); |
| } |
| |
| /** |
| * Acceptable ASN.1 tags for DER encodings of values of PKCS9 |
| * attributes, by index in <code>PKCS9_OIDS</code>. |
| * Sets of acceptable tags are represented as arrays. |
| */ |
| private static final Byte[][] PKCS9_VALUE_TAGS = { |
| null, |
| {new Byte(DerValue.tag_IA5String)}, // EMailAddress |
| {new Byte(DerValue.tag_IA5String)}, // UnstructuredName |
| {new Byte(DerValue.tag_ObjectId)}, // ContentType |
| {new Byte(DerValue.tag_OctetString)}, // MessageDigest |
| {new Byte(DerValue.tag_UtcTime)}, // SigningTime |
| {new Byte(DerValue.tag_Sequence)}, // Countersignature |
| {new Byte(DerValue.tag_PrintableString), |
| new Byte(DerValue.tag_T61String)}, // ChallengePassword |
| {new Byte(DerValue.tag_PrintableString), |
| new Byte(DerValue.tag_T61String)}, // UnstructuredAddress |
| {new Byte(DerValue.tag_SetOf)}, // ExtendedCertificateAttributes |
| {new Byte(DerValue.tag_Sequence)}, // issuerAndSerialNumber |
| null, |
| null, |
| null, |
| {new Byte(DerValue.tag_Sequence)}, // extensionRequest |
| {new Byte(DerValue.tag_Sequence)}, // SMIMECapability |
| {new Byte(DerValue.tag_Sequence)}, // SigningCertificate |
| {new Byte(DerValue.tag_Sequence)} // SignatureTimestampToken |
| }; |
| |
| private static final Class[] VALUE_CLASSES = new Class[18]; |
| |
| static { |
| try { |
| Class str = Class.forName("[Ljava.lang.String;"); |
| |
| VALUE_CLASSES[0] = null; // not used |
| VALUE_CLASSES[1] = str; // EMailAddress |
| VALUE_CLASSES[2] = str; // UnstructuredName |
| VALUE_CLASSES[3] = // ContentType |
| Class.forName("sun.security.util.ObjectIdentifier"); |
| VALUE_CLASSES[4] = BYTE_ARRAY_CLASS; // MessageDigest (byte[]) |
| VALUE_CLASSES[5] = Class.forName("java.util.Date"); // SigningTime |
| VALUE_CLASSES[6] = // Countersignature |
| Class.forName("[Lsun.security.pkcs.SignerInfo;"); |
| VALUE_CLASSES[7] = // ChallengePassword |
| Class.forName("java.lang.String"); |
| VALUE_CLASSES[8] = str; // UnstructuredAddress |
| VALUE_CLASSES[9] = null; // ExtendedCertificateAttributes |
| VALUE_CLASSES[10] = null; // IssuerAndSerialNumber |
| VALUE_CLASSES[11] = null; // not used |
| VALUE_CLASSES[12] = null; // not used |
| VALUE_CLASSES[13] = null; // not used |
| VALUE_CLASSES[14] = // ExtensionRequest |
| Class.forName("sun.security.x509.CertificateExtensions"); |
| VALUE_CLASSES[15] = null; // not supported yet |
| VALUE_CLASSES[16] = null; // not supported yet |
| VALUE_CLASSES[17] = BYTE_ARRAY_CLASS; // SignatureTimestampToken |
| } catch (ClassNotFoundException e) { |
| throw new ExceptionInInitializerError(e.toString()); |
| } |
| } |
| |
| /** |
| * Array indicating which PKCS9 attributes are single-valued, |
| * by index in <code>PKCS9_OIDS</code>. |
| */ |
| private static final boolean[] SINGLE_VALUED = { |
| false, |
| false, // EMailAddress |
| false, // UnstructuredName |
| true, // ContentType |
| true, // MessageDigest |
| true, // SigningTime |
| false, // Countersignature |
| true, // ChallengePassword |
| false, // UnstructuredAddress |
| false, // ExtendedCertificateAttributes |
| true, // IssuerAndSerialNumber - not supported yet |
| false, // not used |
| false, // not used |
| false, // not used |
| true, // ExtensionRequest |
| true, // SMIMECapability - not supported yet |
| true, // SigningCertificate |
| true // SignatureTimestampToken |
| }; |
| |
| /** |
| * The OID of this attribute. |
| */ |
| private ObjectIdentifier oid; |
| |
| /** |
| * The index of the OID of this attribute in <code>PKCS9_OIDS</code>, |
| * or -1 if it's unknown. |
| */ |
| private int index; |
| |
| /** |
| * Value set of this attribute. Its class is given by |
| * <code>VALUE_CLASSES[index]</code>. The SET itself |
| * as byte[] if unknown. |
| */ |
| private Object value; |
| |
| /** |
| * Construct an attribute object from the attribute's OID and |
| * value. If the attribute is single-valued, provide only one |
| * value. If the attribute is multi-valued, provide an array |
| * containing all the values. |
| * Arrays of length zero are accepted, though probably useless. |
| * |
| * <P> The |
| * <a href=#classTable>table</a> gives the class that <code>value</code> |
| * must have for a given attribute. |
| * |
| * @exception IllegalArgumentException |
| * if the <code>value</code> has the wrong type. |
| */ |
| public PKCS9Attribute(ObjectIdentifier oid, Object value) |
| throws IllegalArgumentException { |
| init(oid, value); |
| } |
| |
| /** |
| * Construct an attribute object from the attribute's name and |
| * value. If the attribute is single-valued, provide only one |
| * value. If the attribute is multi-valued, provide an array |
| * containing all the values. |
| * Arrays of length zero are accepted, though probably useless. |
| * |
| * <P> The |
| * <a href=#classTable>table</a> gives the class that <code>value</code> |
| * must have for a given attribute. Reasonable variants of these |
| * attributes are accepted; in particular, case does not matter. |
| * |
| * @exception IllegalArgumentException |
| * if the <code>name</code> is not recognized or the |
| * <code>value</code> has the wrong type. |
| */ |
| public PKCS9Attribute(String name, Object value) |
| throws IllegalArgumentException { |
| ObjectIdentifier oid = getOID(name); |
| |
| if (oid == null) |
| throw new IllegalArgumentException( |
| "Unrecognized attribute name " + name + |
| " constructing PKCS9Attribute."); |
| |
| init(oid, value); |
| } |
| |
| private void init(ObjectIdentifier oid, Object value) |
| throws IllegalArgumentException { |
| |
| this.oid = oid; |
| index = indexOf(oid, PKCS9_OIDS, 1); |
| Class<?> clazz = index == -1 ? BYTE_ARRAY_CLASS: VALUE_CLASSES[index]; |
| if (!clazz.isInstance(value)) { |
| throw new IllegalArgumentException( |
| "Wrong value class " + |
| " for attribute " + oid + |
| " constructing PKCS9Attribute; was " + |
| value.getClass().toString() + ", should be " + |
| clazz.toString()); |
| } |
| this.value = value; |
| } |
| |
| |
| /** |
| * Construct a PKCS9Attribute from its encoding on an input |
| * stream. |
| * |
| * @param val the DerValue representing the DER encoding of the attribute. |
| * @exception IOException on parsing error. |
| */ |
| public PKCS9Attribute(DerValue derVal) throws IOException { |
| |
| DerInputStream derIn = new DerInputStream(derVal.toByteArray()); |
| DerValue[] val = derIn.getSequence(2); |
| |
| if (derIn.available() != 0) |
| throw new IOException("Excess data parsing PKCS9Attribute"); |
| |
| if (val.length != 2) |
| throw new IOException("PKCS9Attribute doesn't have two components"); |
| |
| // get the oid |
| oid = val[0].getOID(); |
| byte[] content = val[1].toByteArray(); |
| DerValue[] elems = new DerInputStream(content).getSet(1); |
| |
| index = indexOf(oid, PKCS9_OIDS, 1); |
| if (index == -1) { |
| if (debug != null) { |
| debug.println("Unsupported signer attribute: " + oid); |
| } |
| value = content; |
| return; |
| } |
| |
| // check single valued have only one value |
| if (SINGLE_VALUED[index] && elems.length > 1) |
| throwSingleValuedException(); |
| |
| // check for illegal element tags |
| Byte tag; |
| for (int i=0; i < elems.length; i++) { |
| tag = new Byte(elems[i].tag); |
| |
| if (indexOf(tag, PKCS9_VALUE_TAGS[index], 0) == -1) |
| throwTagException(tag); |
| } |
| |
| switch (index) { |
| case 1: // email address |
| case 2: // unstructured name |
| case 8: // unstructured address |
| { // open scope |
| String[] values = new String[elems.length]; |
| |
| for (int i=0; i < elems.length; i++) |
| values[i] = elems[i].getAsString(); |
| value = values; |
| } // close scope |
| break; |
| |
| case 3: // content type |
| value = elems[0].getOID(); |
| break; |
| |
| case 4: // message digest |
| value = elems[0].getOctetString(); |
| break; |
| |
| case 5: // signing time |
| value = (new DerInputStream(elems[0].toByteArray())).getUTCTime(); |
| break; |
| |
| case 6: // countersignature |
| { // open scope |
| SignerInfo[] values = new SignerInfo[elems.length]; |
| for (int i=0; i < elems.length; i++) |
| values[i] = |
| new SignerInfo(elems[i].toDerInputStream()); |
| value = values; |
| } // close scope |
| break; |
| |
| case 7: // challenge password |
| value = elems[0].getAsString(); |
| break; |
| |
| case 9: // extended-certificate attribute -- not supported |
| throw new IOException("PKCS9 extended-certificate " + |
| "attribute not supported."); |
| // break unnecessary |
| case 10: // issuerAndserialNumber attribute -- not supported |
| throw new IOException("PKCS9 IssuerAndSerialNumber" + |
| "attribute not supported."); |
| // break unnecessary |
| case 11: // RSA DSI proprietary |
| case 12: // RSA DSI proprietary |
| throw new IOException("PKCS9 RSA DSI attributes" + |
| "11 and 12, not supported."); |
| // break unnecessary |
| case 13: // S/MIME unused attribute |
| throw new IOException("PKCS9 attribute #13 not supported."); |
| // break unnecessary |
| |
| case 14: // ExtensionRequest |
| value = new CertificateExtensions( |
| new DerInputStream(elems[0].toByteArray())); |
| break; |
| |
| case 15: // SMIME-capability attribute -- not supported |
| throw new IOException("PKCS9 SMIMECapability " + |
| "attribute not supported."); |
| // break unnecessary |
| case 16: // SigningCertificate attribute |
| value = new SigningCertificateInfo(elems[0].toByteArray()); |
| break; |
| |
| case 17: // SignatureTimestampToken attribute |
| value = elems[0].toByteArray(); |
| break; |
| default: // can't happen |
| } |
| } |
| |
| /** |
| * Write the DER encoding of this attribute to an output stream. |
| * |
| * <P> N.B.: This method always encodes values of |
| * ChallengePassword and UnstructuredAddress attributes as ASN.1 |
| * <code>PrintableString</code>s, without checking whether they |
| * should be encoded as <code>T61String</code>s. |
| */ |
| public void derEncode(OutputStream out) throws IOException { |
| DerOutputStream temp = new DerOutputStream(); |
| temp.putOID(oid); |
| switch (index) { |
| case -1: // Unknown |
| temp.write((byte[])value); |
| break; |
| case 1: // email address |
| case 2: // unstructured name |
| { // open scope |
| String[] values = (String[]) value; |
| DerOutputStream[] temps = new |
| DerOutputStream[values.length]; |
| |
| for (int i=0; i < values.length; i++) { |
| temps[i] = new DerOutputStream(); |
| temps[i].putIA5String( values[i]); |
| } |
| temp.putOrderedSetOf(DerValue.tag_Set, temps); |
| } // close scope |
| break; |
| |
| case 3: // content type |
| { |
| DerOutputStream temp2 = new DerOutputStream(); |
| temp2.putOID((ObjectIdentifier) value); |
| temp.write(DerValue.tag_Set, temp2.toByteArray()); |
| } |
| break; |
| |
| case 4: // message digest |
| { |
| DerOutputStream temp2 = new DerOutputStream(); |
| temp2.putOctetString((byte[]) value); |
| temp.write(DerValue.tag_Set, temp2.toByteArray()); |
| } |
| break; |
| |
| case 5: // signing time |
| { |
| DerOutputStream temp2 = new DerOutputStream(); |
| temp2.putUTCTime((Date) value); |
| temp.write(DerValue.tag_Set, temp2.toByteArray()); |
| } |
| break; |
| |
| case 6: // countersignature |
| temp.putOrderedSetOf(DerValue.tag_Set, (DerEncoder[]) value); |
| break; |
| |
| case 7: // challenge password |
| { |
| DerOutputStream temp2 = new DerOutputStream(); |
| temp2.putPrintableString((String) value); |
| temp.write(DerValue.tag_Set, temp2.toByteArray()); |
| } |
| break; |
| |
| case 8: // unstructured address |
| { // open scope |
| String[] values = (String[]) value; |
| DerOutputStream[] temps = new |
| DerOutputStream[values.length]; |
| |
| for (int i=0; i < values.length; i++) { |
| temps[i] = new DerOutputStream(); |
| temps[i].putPrintableString(values[i]); |
| } |
| temp.putOrderedSetOf(DerValue.tag_Set, temps); |
| } // close scope |
| break; |
| |
| case 9: // extended-certificate attribute -- not supported |
| throw new IOException("PKCS9 extended-certificate " + |
| "attribute not supported."); |
| // break unnecessary |
| case 10: // issuerAndserialNumber attribute -- not supported |
| throw new IOException("PKCS9 IssuerAndSerialNumber" + |
| "attribute not supported."); |
| // break unnecessary |
| case 11: // RSA DSI proprietary |
| case 12: // RSA DSI proprietary |
| throw new IOException("PKCS9 RSA DSI attributes" + |
| "11 and 12, not supported."); |
| // break unnecessary |
| case 13: // S/MIME unused attribute |
| throw new IOException("PKCS9 attribute #13 not supported."); |
| // break unnecessary |
| |
| case 14: // ExtensionRequest |
| { |
| DerOutputStream temp2 = new DerOutputStream(); |
| CertificateExtensions exts = (CertificateExtensions)value; |
| try { |
| exts.encode(temp2, true); |
| } catch (CertificateException ex) { |
| throw new IOException(ex.toString()); |
| } |
| temp.write(DerValue.tag_Set, temp2.toByteArray()); |
| } |
| break; |
| case 15: // SMIMECapability |
| throw new IOException("PKCS9 attribute #15 not supported."); |
| // break unnecessary |
| |
| case 16: // SigningCertificate |
| throw new IOException( |
| "PKCS9 SigningCertificate attribute not supported."); |
| // break unnecessary |
| |
| case 17: // SignatureTimestampToken |
| temp.write(DerValue.tag_Set, (byte[])value); |
| break; |
| |
| default: // can't happen |
| } |
| |
| DerOutputStream derOut = new DerOutputStream(); |
| derOut.write(DerValue.tag_Sequence, temp.toByteArray()); |
| |
| out.write(derOut.toByteArray()); |
| |
| } |
| |
| /** |
| * Returns if the attribute is known. Unknown attributes can be created |
| * from DER encoding with unknown OIDs. |
| */ |
| public boolean isKnown() { |
| return index != -1; |
| } |
| |
| /** |
| * Get the value of this attribute. If the attribute is |
| * single-valued, return just the one value. If the attribute is |
| * multi-valued, return an array containing all the values. |
| * It is possible for this array to be of length 0. |
| * |
| * <P> The |
| * <a href=#classTable>table</a> gives the class of the value returned, |
| * depending on the type of this attribute. |
| */ |
| public Object getValue() { |
| return value; |
| } |
| |
| /** |
| * Show whether this attribute is single-valued. |
| */ |
| public boolean isSingleValued() { |
| return index == -1 || SINGLE_VALUED[index]; |
| } |
| |
| /** |
| * Return the OID of this attribute. |
| */ |
| public ObjectIdentifier getOID() { |
| return oid; |
| } |
| |
| /** |
| * Return the name of this attribute. |
| */ |
| public String getName() { |
| return index == -1 ? |
| oid.toString() : |
| OID_NAME_TABLE.get(PKCS9_OIDS[index]); |
| } |
| |
| /** |
| * Return the OID for a given attribute name or null if we don't recognize |
| * the name. |
| */ |
| public static ObjectIdentifier getOID(String name) { |
| return NAME_OID_TABLE.get(name.toLowerCase(Locale.ENGLISH)); |
| } |
| |
| /** |
| * Return the attribute name for a given OID or null if we don't recognize |
| * the oid. |
| */ |
| public static String getName(ObjectIdentifier oid) { |
| return OID_NAME_TABLE.get(oid); |
| } |
| |
| /** |
| * Returns a string representation of this attribute. |
| */ |
| public String toString() { |
| StringBuffer buf = new StringBuffer(100); |
| |
| buf.append("["); |
| |
| if (index == -1) { |
| buf.append(oid.toString()); |
| } else { |
| buf.append(OID_NAME_TABLE.get(PKCS9_OIDS[index])); |
| } |
| buf.append(": "); |
| |
| if (index == -1 || SINGLE_VALUED[index]) { |
| if (value instanceof byte[]) { // special case for octet string |
| HexDumpEncoder hexDump = new HexDumpEncoder(); |
| buf.append(hexDump.encodeBuffer((byte[]) value)); |
| } else { |
| buf.append(value.toString()); |
| } |
| buf.append("]"); |
| return buf.toString(); |
| } else { // multi-valued |
| boolean first = true; |
| Object[] values = (Object[]) value; |
| |
| for (int j=0; j < values.length; j++) { |
| if (first) |
| first = false; |
| else |
| buf.append(", "); |
| |
| buf.append(values[j].toString()); |
| } |
| return buf.toString(); |
| } |
| } |
| |
| /** |
| * Beginning the search at <code>start</code>, find the first |
| * index <code>i</code> such that <code>a[i] = obj</code>. |
| * |
| * @return the index, if found, and -1 otherwise. |
| */ |
| static int indexOf(Object obj, Object[] a, int start) { |
| for (int i=start; i < a.length; i++) { |
| if (obj.equals(a[i])) return i; |
| } |
| return -1; |
| } |
| |
| /** |
| * Throw an exception when there are multiple values for |
| * a single-valued attribute. |
| */ |
| private void throwSingleValuedException() throws IOException { |
| throw new IOException("Single-value attribute " + |
| oid + " (" + getName() + ")" + |
| " has multiple values."); |
| } |
| |
| /** |
| * Throw an exception when the tag on a value encoding is |
| * wrong for the attribute whose value it is. This method |
| * will only be called for known tags. |
| */ |
| private void throwTagException(Byte tag) |
| throws IOException { |
| Byte[] expectedTags = PKCS9_VALUE_TAGS[index]; |
| StringBuffer msg = new StringBuffer(100); |
| msg.append("Value of attribute "); |
| msg.append(oid.toString()); |
| msg.append(" ("); |
| msg.append(getName()); |
| msg.append(") has wrong tag: "); |
| msg.append(tag.toString()); |
| msg.append(". Expected tags: "); |
| |
| msg.append(expectedTags[0].toString()); |
| |
| for (int i = 1; i < expectedTags.length; i++) { |
| msg.append(", "); |
| msg.append(expectedTags[i].toString()); |
| } |
| msg.append("."); |
| throw new IOException(msg.toString()); |
| } |
| } |
