diff options
| -rw-r--r-- | java/security/AlgorithmParameterGenerator.java | 8 | ||||
| -rw-r--r-- | java/security/AlgorithmParameters.java | 6 | ||||
| -rw-r--r-- | java/security/KeyFactory.java | 6 | ||||
| -rw-r--r-- | java/security/KeyPairGenerator.java | 13 | ||||
| -rw-r--r-- | java/security/KeyStore.java | 6 | ||||
| -rw-r--r-- | java/security/MessageDigest.java | 12 | ||||
| -rw-r--r-- | java/security/SecureRandom.java | 6 | ||||
| -rw-r--r-- | java/security/Signature.java | 34 | ||||
| -rw-r--r-- | java/security/cert/Certificate.java | 153 | ||||
| -rw-r--r-- | java/security/cert/CertificateFactory.java | 382 | ||||
| -rw-r--r-- | java/security/cert/CertificateFactorySpi.java | 82 | ||||
| -rw-r--r-- | java/security/cert/X509Certificate.java | 297 |
12 files changed, 720 insertions, 285 deletions
diff --git a/java/security/AlgorithmParameterGenerator.java b/java/security/AlgorithmParameterGenerator.java index b8ad8e27d..26a7790d3 100644 --- a/java/security/AlgorithmParameterGenerator.java +++ b/java/security/AlgorithmParameterGenerator.java @@ -39,6 +39,8 @@ package java.security; import java.security.spec.AlgorithmParameterSpec; +import gnu.java.security.Engine; + /** * <p>The <code>AlgorithmParameterGenerator</code> class is used to generate a * set of parameters to be used with a certain algorithm. Parameter generators @@ -201,7 +203,11 @@ public class AlgorithmParameterGenerator (AlgorithmParameterGeneratorSpi) Engine.getInstance( ALGORITHM_PARAMETER_GENERATOR, algorithm, provider), provider, algorithm); - } + } + catch (java.lang.reflect.InvocationTargetException ite) + { + throw new NoSuchAlgorithmException(algorithm); + } catch (ClassCastException cce) { throw new NoSuchAlgorithmException(algorithm); diff --git a/java/security/AlgorithmParameters.java b/java/security/AlgorithmParameters.java index a7212772b..07d76bb7b 100644 --- a/java/security/AlgorithmParameters.java +++ b/java/security/AlgorithmParameters.java @@ -41,6 +41,8 @@ import java.security.spec.InvalidParameterSpecException; import java.security.spec.AlgorithmParameterSpec; import java.io.IOException; +import gnu.java.security.Engine; + /** * <p>This class is used as an opaque representation of cryptographic * parameters.</p> @@ -204,6 +206,10 @@ public class AlgorithmParameters Engine.getInstance(ALGORITHM_PARAMETERS, algorithm, provider), provider, algorithm); } + catch (java.lang.reflect.InvocationTargetException ite) + { + throw new NoSuchAlgorithmException(algorithm); + } catch (ClassCastException cce) { throw new NoSuchAlgorithmException(algorithm); diff --git a/java/security/KeyFactory.java b/java/security/KeyFactory.java index 918bf3d6d..223d0d84a 100644 --- a/java/security/KeyFactory.java +++ b/java/security/KeyFactory.java @@ -41,6 +41,8 @@ import java.security.spec.KeySpec; import java.security.spec.InvalidKeySpecException; import java.security.NoSuchAlgorithmException; +import gnu.java.security.Engine; + /** * <p>Key factories are used to convert keys (opaque cryptographic keys of type * {@link Key}) into key specifications (transparent representations of the @@ -192,6 +194,10 @@ public class KeyFactory Engine.getInstance(KEY_FACTORY, algorithm, provider), provider, algorithm); } + catch (java.lang.reflect.InvocationTargetException ite) + { + throw new NoSuchAlgorithmException(algorithm); + } catch (ClassCastException cce) { throw new NoSuchAlgorithmException(algorithm); diff --git a/java/security/KeyPairGenerator.java b/java/security/KeyPairGenerator.java index 8bc829608..b9b07852a 100644 --- a/java/security/KeyPairGenerator.java +++ b/java/security/KeyPairGenerator.java @@ -39,6 +39,8 @@ package java.security; import java.security.spec.AlgorithmParameterSpec; +import gnu.java.security.Engine; + /** * <p>The <code>KeyPairGenerator</code> class is used to generate pairs of * public and private keys. Key pair generators are constructed using the @@ -231,7 +233,16 @@ public abstract class KeyPairGenerator extends KeyPairGeneratorSpi if (provider == null) throw new IllegalArgumentException("Illegal provider"); - Object o = Engine.getInstance(KEY_PAIR_GENERATOR, algorithm, provider); + Object o = null; + try + { + o = Engine.getInstance(KEY_PAIR_GENERATOR, algorithm, provider); + } + catch (java.lang.reflect.InvocationTargetException ite) + { + throw new NoSuchAlgorithmException(algorithm); + } + KeyPairGenerator result = null; if (o instanceof KeyPairGeneratorSpi) { diff --git a/java/security/KeyStore.java b/java/security/KeyStore.java index cd3c2687c..5f0c159d7 100644 --- a/java/security/KeyStore.java +++ b/java/security/KeyStore.java @@ -43,6 +43,8 @@ import java.security.cert.CertificateException; import java.util.Date; import java.util.Enumeration; +import gnu.java.security.Engine; + /** * Keystore represents an in-memory collection of keys and * certificates. There are two types of entries: @@ -194,6 +196,10 @@ public class KeyStore { throw new KeyStoreException(type); } + catch (java.lang.reflect.InvocationTargetException ite) + { + throw new KeyStoreException(type); + } catch (ClassCastException cce) { throw new KeyStoreException(type); diff --git a/java/security/MessageDigest.java b/java/security/MessageDigest.java index cbf0e0753..47b082a19 100644 --- a/java/security/MessageDigest.java +++ b/java/security/MessageDigest.java @@ -37,6 +37,8 @@ exception statement from your version. */ package java.security; +import gnu.java.security.Engine; + /** * <p>This <code>MessageDigest</code> class provides applications the * functionality of a message digest algorithm, such as <i>MD5</i> or <i>SHA</i>. @@ -197,7 +199,15 @@ public abstract class MessageDigest extends MessageDigestSpi throw new IllegalArgumentException("Illegal provider"); MessageDigest result = null; - Object o = Engine.getInstance(MESSAGE_DIGEST, algorithm, provider); + Object o = null; + try + { + o = Engine.getInstance(MESSAGE_DIGEST, algorithm, provider); + } + catch (java.lang.reflect.InvocationTargetException ite) + { + throw new NoSuchAlgorithmException(algorithm); + } if (o instanceof MessageDigestSpi) { diff --git a/java/security/SecureRandom.java b/java/security/SecureRandom.java index 5cd3cae67..b42f2e7ed 100644 --- a/java/security/SecureRandom.java +++ b/java/security/SecureRandom.java @@ -41,6 +41,8 @@ import java.io.Serializable; import java.util.Random; import java.util.Enumeration; +import gnu.java.security.Engine; + /** * An interface to a cryptographically secure pseudo-random number * generator (PRNG). Random (or at least unguessable) numbers are used @@ -234,6 +236,10 @@ public class SecureRandom extends Random Engine.getInstance(SECURE_RANDOM, algorithm, provider), provider); } + catch (java.lang.reflect.InvocationTargetException ite) + { + throw new NoSuchAlgorithmException(algorithm); + } catch (ClassCastException cce) { throw new NoSuchAlgorithmException(algorithm); diff --git a/java/security/Signature.java b/java/security/Signature.java index dff2e2d87..3c4c46a6e 100644 --- a/java/security/Signature.java +++ b/java/security/Signature.java @@ -38,9 +38,12 @@ exception statement from your version. */ package java.security; import java.security.cert.Certificate; +import java.security.cert.CertificateException; import java.security.cert.X509Certificate; import java.security.spec.AlgorithmParameterSpec; +import gnu.java.security.Engine; + /** * <p>This <code>Signature</code> class is used to provide applications the * functionality of a digital signature algorithm. Digital signatures are used @@ -237,7 +240,15 @@ public abstract class Signature extends SignatureSpi throw new IllegalArgumentException("Illegal provider"); Signature result = null; - Object o = Engine.getInstance(SIGNATURE, algorithm, provider); + Object o = null; + try + { + o = Engine.getInstance(SIGNATURE, algorithm, provider); + } + catch (java.lang.reflect.InvocationTargetException ite) + { + throw new NoSuchAlgorithmException(algorithm); + } if (o instanceof SignatureSpi) { @@ -308,7 +319,26 @@ public abstract class Signature extends SignatureSpi throw new InvalidKeyException( "KeyUsage of this Certificate indicates it cannot be used for digital signing"); } - this.initVerify(certificate.getPublicKey()); + try + { + this.initVerify(certificate.getPublicKey()); + } + catch (SignatureException se) + { + throw new InvalidKeyException(se.getMessage()); + } + catch (NoSuchAlgorithmException nsae) + { + throw new InvalidKeyException(nsae.getMessage()); + } + catch (NoSuchProviderException nspe) + { + throw new InvalidKeyException(nspe.getMessage()); + } + catch (CertificateException ce) + { + throw new InvalidKeyException(ce.getMessage()); + } } /** diff --git a/java/security/cert/Certificate.java b/java/security/cert/Certificate.java index 25e8aadf1..4f5e3c92c 100644 --- a/java/security/cert/Certificate.java +++ b/java/security/cert/Certificate.java @@ -1,5 +1,5 @@ /* Certificate.java --- Certificate class - Copyright (C) 1999 Free Software Foundation, Inc. + Copyright (C) 1999,2003 Free Software Foundation, Inc. This file is part of GNU Classpath. @@ -37,6 +37,7 @@ exception statement from your version. */ package java.security.cert; + import java.security.PublicKey; import java.security.NoSuchAlgorithmException; import java.security.InvalidKeyException; @@ -44,34 +45,38 @@ import java.security.NoSuchProviderException; import java.security.SignatureException; import java.io.ObjectInputStream; import java.io.ByteArrayInputStream; +import java.io.InvalidObjectException; import java.io.ObjectStreamException; /** - The Certificate class is an abstract class used to manage - identity certificates. An identity certificate is a - combination of a principal and a public key which is - certified by another principal. This is the puprose of - Certificate Authorities (CA). - - This class is used to manage different types of certificates - but have important common puposes. Different types of - certificates like X.509 and OpenPGP share general certificate - functions (like encoding and verifying) and information like - public keys. - - X.509, OpenPGP, and SDSI can be implemented by subclassing this - class even though they differ in storage methods and information - stored. - - @since JDK 1.2 - - @author Mark Benvenuto -*/ + * The Certificate class is an abstract class used to manage + * identity certificates. An identity certificate is a + * combination of a principal and a public key which is + * certified by another principal. This is the puprose of + * Certificate Authorities (CA). + * + * <p>This class is used to manage different types of certificates + * but have important common puposes. Different types of + * certificates like X.509 and OpenPGP share general certificate + * functions (like encoding and verifying) and information like + * public keys. + * + * <p>X.509, OpenPGP, and SDSI can be implemented by subclassing this + * class even though they differ in storage methods and information + * stored. + * + * @see CertificateFactory + * @see X509Certificate + * @since JDK 1.2 + * @author Mark Benvenuto + * @author Casey Marshall + */ public abstract class Certificate { static final long serialVersionUID = -6751606818319535583L; private String type; + /** Constructs a new certificate of the specified type. An example is "X.509". @@ -201,49 +206,107 @@ public abstract class Certificate @return The public key */ - public abstract PublicKey getPublicKey(); + public abstract PublicKey getPublicKey() + throws SignatureException, + InvalidKeyException, + NoSuchAlgorithmException, + CertificateException, + NoSuchProviderException; + + + // Protected methods. + // ------------------------------------------------------------------------ + + /** + * Returns a replacement for this certificate to be serialized. This + * method returns the equivalent to the following for this class: + * + * <blockquote> + * <pre>new CertificateRep(getType(), getEncoded());</pre> + * </blockquote> + * + * <p>This thusly replaces the certificate with its name and its + * encoded form, which can be deserialized later with the {@link + * CertificateFactory} implementation for this certificate's type. + * + * @return The replacement object to be serialized. + * @throws ObjectStreamException If the replacement could not be + * created. + */ + protected Object writeReplace() throws ObjectStreamException + { + try + { + return new CertificateRep(getType(), getEncoded()); + } + catch (CertificateEncodingException cee) + { + throw new InvalidObjectException(cee.toString()); + } + } + // Inner class. + // ------------------------------------------------------------------------ - /* INNER CLASS */ /** Certificate.CertificateRep is an inner class used to provide an alternate storage mechanism for serialized Certificates. */ protected static class CertificateRep implements java.io.Serializable { + + /** From JDK1.4. */ + private static final long serialVersionUID = -8563758940495660020L; + + /** The certificate type, e.g. "X.509". */ private String type; + + /** The encoded certificate data. */ private byte[] data; /** - Create an alternate Certificate class to store a serialized Certificate - - @param type the name of certificate type - @param data the certificate data - */ - protected CertificateRep(String type, - byte[] data) + * Create an alternative representation of this certificate. The + * <code>(type, data)</code> pair is typically the certificate's + * type as returned by {@link Certificate#getType()} (i.e. the + * canonical name of the certificate type) and the encoded form as + * returned by {@link Certificate#getEncoded()}. + * + * <p>For example, X.509 certificates would create an instance of + * this class with the parameters "X.509" and the ASN.1 + * representation of the certificate, encoded as DER bytes. + * + * @param type The certificate type. + * @param data The encoded certificate data. + */ + protected CertificateRep(String type, byte[] data) { this.type = type; this.data = data; } /** - Return the stored Certificate - - @return the stored certificate - - @throws ObjectStreamException if certificate cannot be resolved - */ - protected Object readResolve() - throws ObjectStreamException + * Deserialize this certificate replacement into the appropriate + * certificate object. That is, this method attempts to create a + * {@link CertificateFactory} for this certificate's type, then + * attempts to parse the encoded data with that factory, returning + * the resulting certificate. + * + * @return The deserialized certificate. + * @throws ObjectStreamException If there is no appropriate + * certificate factory for the given type, or if the encoded form + * cannot be parsed. + */ + protected Object readResolve() throws ObjectStreamException { - try { - return new ObjectInputStream( new ByteArrayInputStream( data ) ).readObject(); - } catch ( Exception e ) { - e.printStackTrace(); - throw new RuntimeException ( e.toString() ); - } + try + { + CertificateFactory fact = CertificateFactory.getInstance(type); + return fact.generateCertificate(new ByteArrayInputStream(data)); + } + catch (Exception e) + { + throw new InvalidObjectException(e.toString()); + } } } - } diff --git a/java/security/cert/CertificateFactory.java b/java/security/cert/CertificateFactory.java index 4318862ec..20ade70b3 100644 --- a/java/security/cert/CertificateFactory.java +++ b/java/security/cert/CertificateFactory.java @@ -1,5 +1,5 @@ /* CertificateFactory.java -- Certificate Factory Class - Copyright (C) 1999, 2002 Free Software Foundation, Inc. + Copyright (C) 1999, 2002, 2003 Free Software Foundation, Inc. This file is part of GNU Classpath. @@ -37,239 +37,323 @@ exception statement from your version. */ package java.security.cert; + +import java.security.NoSuchAlgorithmException; import java.security.NoSuchProviderException; import java.security.Provider; import java.security.Security; + import java.io.InputStream; + import java.util.Collection; +import java.util.Iterator; +import java.util.List; + +import gnu.java.security.Engine; /** - This class implments the CertificateFactory class interface - used to generate certificates and certificate revocation - list (CRL) objects from their encodings. - - A certifcate factory for X.509 returns certificates of the - java.security.cert.X509Certificate class, and CRLs of the - java.security.cert.X509CRL class. - - @author Mark Benvenuto - @since JDK 1.2 - @status still missing full 1.4 support -*/ + * This class implments the CertificateFactory class interface used to + * generate certificates, certificate revocation lists (CRLs), and certificate + * paths objects from their encoded forms. + * + * @author Mark Benvenuto + * @author Casey Marshall + * @since JDK 1.2 + * @status Fully compatible with JDK 1.4. + */ public class CertificateFactory { + /** The service name for certificate factories. */ + private static final String CERTIFICATE_FACTORY = "CertificateFactory"; + private CertificateFactorySpi certFacSpi; private Provider provider; private String type; /** - Creates an instance of CertificateFactory - - @param certFacSpi A CertificateFactory engine to use - @param provider A provider to use - @param type The type of Certificate - */ - protected CertificateFactory(CertificateFactorySpi certFacSpi, Provider provider, String type) + * Creates an instance of CertificateFactory. + * + * @param certFacSpi The underlying CertificateFactory engine. + * @param provider The provider of this implementation. + * @param type The type of Certificate this factory creates. + */ + protected CertificateFactory(CertificateFactorySpi certFacSpi, + Provider provider, String type) { this.certFacSpi = certFacSpi; this.provider = provider; this.type = type; } + // Class methods. + // ------------------------------------------------------------------------ /** - Gets an instance of the CertificateFactory class representing - the specified certificate factory. If the type is not - found then, it throws CertificateException. - - @param type the type of certificate to choose - - @return a CertificateFactory repesenting the desired type - - @throws CertificateException if the type of certificate is not implemented by providers - */ - public static final CertificateFactory getInstance(String type) throws CertificateException + * Gets an instance of the CertificateFactory class representing + * the specified certificate factory. If the type is not + * found then, it throws CertificateException. + * + * @param type The type of certificate factory to create. + * @return a CertificateFactory repesenting the desired type + * @throws CertificateException If the type of certificate is not + * implemented by any installed provider. + */ + public static final CertificateFactory getInstance(String type) + throws CertificateException { - Provider[] p = Security.getProviders (); + Provider[] p = Security.getProviders(); for (int i = 0; i < p.length; i++) { - String classname = p[i].getProperty ("CertificateFactory." + type); - if (classname != null) - return getInstance (classname, type, p[i]); + try + { + return getInstance(type, p[i]); + } + catch (CertificateException ignored) + { + } } throw new CertificateException(type); } - - /** - Gets an instance of the CertificateFactory class representing - the specified certificate factory from the specified provider. - If the type is not found then, it throws CertificateException. - If the provider is not found, then it throws - NoSuchProviderException. - - @param type the type of certificate to choose - - @return a CertificateFactory repesenting the desired type - - @throws CertificateException if the type of certificate is not implemented by providers - @throws NoSuchProviderException if the provider is not found - */ - public static final CertificateFactory getInstance(String type, String provider) + * Gets an instance of the CertificateFactory class representing + * the specified certificate factory from the specified provider. + * If the type is not found then, it throws {@link CertificateException}. + * If the provider is not found, then it throws + * {@link java.security.NoSuchProviderException}. + * + * @param type The type of certificate factory to create. + * @param provider The name of the provider from which to get the + * implementation. + * @return A CertificateFactory for the desired type. + * @throws CertificateException If the type of certificate is not + * implemented by the named provider. + * @throws NoSuchProviderException If the named provider is not installed. + */ + public static final CertificateFactory getInstance(String type, + String provider) throws CertificateException, NoSuchProviderException { Provider p = Security.getProvider(provider); if( p == null) throw new NoSuchProviderException(); - return getInstance (p.getProperty ("CertificateFactory." + type), - type, p); + return getInstance(type, p); } - private static CertificateFactory getInstance (String classname, - String type, - Provider provider) + /** + * Get a certificate factory for the given certificate type from the + * given provider. + * + * @param type The type of certificate factory to create. + * @param provider The provider from which to get the implementation. + * @return A CertificateFactory for the desired type. + * @throws CertificateException If the type of certificate is not + * implemented by the provider. + * @throws IllegalArgumentException If the provider is null. + */ + public static final CertificateFactory getInstance(String type, + Provider provider) throws CertificateException { - try { - return new CertificateFactory( (CertificateFactorySpi)Class.forName( classname ).newInstance(), provider, type ); - } catch( ClassNotFoundException cnfe) { - throw new CertificateException("Class not found"); - } catch( InstantiationException ie) { - throw new CertificateException("Class instantiation failed"); - } catch( IllegalAccessException iae) { - throw new CertificateException("Illegal Access"); - } + if (provider == null) + throw new IllegalArgumentException("null provider"); + + try + { + return new CertificateFactory((CertificateFactorySpi) + Engine.getInstance(CERTIFICATE_FACTORY, type, provider), + provider, type); + } + catch (ClassCastException cce) + { + throw new CertificateException(type); + } + catch (java.lang.reflect.InvocationTargetException ite) + { + throw new CertificateException(type); + } + catch (NoSuchAlgorithmException nsae) + { + throw new CertificateException(nsae.getMessage()); + } } + // Instance methods. + // ------------------------------------------------------------------------ /** - Gets the provider that the class is from. - - @return the provider of this class - */ + * Gets the provider of this implementation. + * + * @return The provider of this implementation. + */ public final Provider getProvider() { return provider; } /** - Returns the type of the certificate supported - - @return A string with the type of certificate - */ + * Returns the type of the certificate this factory creates. + * + * @return A string with the type of certificate + */ public final String getType() { return type; } /** - Generates a Certificate based on the encoded data read - from the InputStream. - - The input stream must contain only one certificate. - - If there exists a specialized certificate class for the - certificate format handled by the certificate factory - then the return Ceritificate should be a typecast of it. - Ex: A X.509 CertificateFactory should return X509Certificate. - - For X.509 certificates, the certificate in inStream must be - DER encoded and supplied in binary or printable (Base64) - encoding. If the certificate is in Base64 encoding, it must be - bounded by -----BEGINCERTIFICATE-----, and - -----END CERTIFICATE-----. - - @param inStream an input stream containing the certificate data - - @return a certificate initialized with InputStream data. - - @throws CertificateException Certificate parsing error - */ + * Generates a Certificate from the encoded data read + * from an InputStream. + * + * <p>The input stream must contain only one certificate. + * + * <p>If there exists a specialized certificate class for the + * certificate format handled by the certificate factory + * then the return Ceritificate should be a typecast of it. + * Ex: A X.509 CertificateFactory should return X509Certificate. + * + * <p>For X.509 certificates, the certificate in inStream must be + * DER encoded and supplied in binary or printable (Base64) + * encoding. If the certificate is in Base64 encoding, it must be + * bounded by -----BEGINCERTIFICATE-----, and + * -----END CERTIFICATE-----. + * + * @param inStream An input stream containing the certificate data. + * @return A certificate initialized from the decoded InputStream data. + * @throws CertificateException If an error occurs decoding the + * certificate. + */ public final Certificate generateCertificate(InputStream inStream) throws CertificateException { - return certFacSpi.engineGenerateCertificate( inStream ); + return certFacSpi.engineGenerateCertificate(inStream); } /** - Returns a collection of certificates that were read from the - input stream. It may be empty, have only one, or have - multiple certificates. - - For a X.509 certificate factory, the stream may contain a - single DER encoded certificate or a PKCS#7 certificate - chain. This is a PKCS#7 <I>SignedData</I> object with the - most significant field being <I>certificates</I>. If no - CRLs are present, then an empty collection is returned. - - @param inStream an input stream containing the certificates - - @return a collection of certificates initialized with - the InputStream data. - - @throws CertificateException Certificate parsing error - */ + * Returns a collection of certificates that were read from the + * input stream. It may be empty, have only one, or have + * multiple certificates. + * + * For a X.509 certificate factory, the stream may contain a + * single DER encoded certificate or a PKCS#7 certificate + * chain. This is a PKCS#7 <I>SignedData</I> object with the + * most significant field being <I>certificates</I>. If no + * CRLs are present, then an empty collection is returned. + * + * @param inStream An input stream containing the certificate data. + * @return A collection of certificates initialized from the decoded + * InputStream data. + * @throws CertificateException If an error occurs decoding the + * certificates. + */ public final Collection generateCertificates(InputStream inStream) throws CertificateException { - return certFacSpi.engineGenerateCertificates( inStream ); + return certFacSpi.engineGenerateCertificates(inStream); } /** - Generates a CRL based on the encoded data read - from the InputStream. - - The input stream must contain only one CRL. - - If there exists a specialized CRL class for the - CRL format handled by the certificate factory - then the return CRL should be a typecast of it. - Ex: A X.509 CertificateFactory should return X509CRL. - - @param inStream an input stream containing the CRL data - - @return a CRL initialized with InputStream data. - - @throws CRLException CRL parsing error - */ + * Generates a CRL based on the encoded data read + * from the InputStream. + * + * <p>The input stream must contain only one CRL. + * + * <p>If there exists a specialized CRL class for the + * CRL format handled by the certificate factory + * then the return CRL should be a typecast of it. + * Ex: A X.509 CertificateFactory should return X509CRL. + * + * @param inStream An input stream containing the CRL data. + * @return A CRL initialized from the decoded InputStream data. + * @throws CRLException If an error occurs decoding the CRL. + */ public final CRL generateCRL(InputStream inStream) throws CRLException { - return certFacSpi.engineGenerateCRL( inStream ); + return certFacSpi.engineGenerateCRL(inStream); } - /** - Generates CRLs based on the encoded data read - from the InputStream. - - For a X.509 certificate factory, the stream may contain a - single DER encoded CRL or a PKCS#7 CRL set. This is a - PKCS#7 <I>SignedData</I> object with the most significant - field being <I>crls</I>. If no CRLs are present, then an - empty collection is returned. - - @param inStream an input stream containing the CRLs - - @return a collection of CRLs initialized with - the InputStream data. - - @throws CRLException CRL parsing error - */ + * <p>Generates CRLs based on the encoded data read + * from the InputStream. + * + * <p>For a X.509 certificate factory, the stream may contain a + * single DER encoded CRL or a PKCS#7 CRL set. This is a + * PKCS#7 <I>SignedData</I> object with the most significant + * field being <I>crls</I>. If no CRLs are present, then an + * empty collection is returned. + * + * @param inStream an input stream containing the CRLs. + * @return a collection of CRLs initialized from the decoded + * InputStream data. + * @throws CRLException If an error occurs decoding the CRLs. + */ public final Collection generateCRLs(InputStream inStream) throws CRLException { return certFacSpi.engineGenerateCRLs( inStream ); } + /** + * Generate a {@link CertPath} and initialize it with data parsed from + * the input stream. The default encoding of this factory is used. + * + * @param inStream The InputStream containing the CertPath data. + * @return A CertPath initialized from the input stream data. + * @throws CertificateException If an error occurs decoding the + * CertPath. + */ public final CertPath generateCertPath(InputStream inStream) throws CertificateException { - throw new CertificateException("not implemented"); + return certFacSpi.engineGenerateCertPath(inStream); + } + + /** + * Generate a {@link CertPath} and initialize it with data parsed from + * the input stream, using the specified encoding. + * + * @param inStream The InputStream containing the CertPath data. + * @param encoding The encoding of the InputStream data. + * @return A CertPath initialized from the input stream data. + * @throws CertificateException If an error occurs decoding the + * CertPath. + */ + public final CertPath generateCertPath(InputStream inStream, String encoding) + throws CertificateException + { + return certFacSpi.engineGenerateCertPath(inStream, encoding); + } + + /** + * Generate a {@link CertPath} and initialize it with the certificates + * in the {@link java.util.List} argument. + * + * @param certificates The list of certificates with which to create + * the CertPath. + * @return A CertPath initialized from the certificates. + * @throws CertificateException If an error occurs generating the + * CertPath. + */ + public final CertPath generateCertPath(List certificates) + throws CertificateException + { + return certFacSpi.engineGenerateCertPath(certificates); + } + + /** + * Returns an Iterator of CertPath encodings supported by this + * factory, with the default encoding first. The returned Iterator + * cannot be modified. + * + * @return The Iterator of supported encodings. + */ + public final Iterator getCertPathEncodings() + { + return certFacSpi.engineGetCertPathEncodings(); } } // class CertificateFactory diff --git a/java/security/cert/CertificateFactorySpi.java b/java/security/cert/CertificateFactorySpi.java index 81293909e..2bf8155e3 100644 --- a/java/security/cert/CertificateFactorySpi.java +++ b/java/security/cert/CertificateFactorySpi.java @@ -1,5 +1,5 @@ /* CertificateFactorySpi.java --- Certificate Factory Class - Copyright (C) 1999 Free Software Foundation, Inc. + Copyright (C) 1999,2003 Free Software Foundation, Inc. This file is part of GNU Classpath. @@ -37,8 +37,12 @@ exception statement from your version. */ package java.security.cert; + import java.io.InputStream; + import java.util.Collection; +import java.util.Iterator; +import java.util.List; /** CertificateFactorySpi is the abstract class Service Provider @@ -53,16 +57,22 @@ import java.util.Collection; @since JDK 1.2 @author Mark Benvenuto -*/ + */ public abstract class CertificateFactorySpi { + // Constructor. + // ------------------------------------------------------------------------ + /** - Constructs a new CertificateFactorySpi - */ + * Constructs a new CertificateFactorySpi + */ public CertificateFactorySpi() {} + // Abstract methods. + // ------------------------------------------------------------------------ + /** Generates a Certificate based on the encoded data read from the InputStream. @@ -77,7 +87,7 @@ public abstract class CertificateFactorySpi For X.509 certificates, the certificate in inStream must be DER encoded and supplied in binary or printable (Base64) encoding. If the certificate is in Base64 encoding, it must be - bounded by -----BEGINCERTIFICATE-----, and + bounded by -----BEGIN CERTIFICATE-----, and -----END CERTIFICATE-----. @param inStream an input stream containing the certificate data @@ -149,5 +159,67 @@ public abstract class CertificateFactorySpi */ public abstract Collection engineGenerateCRLs(InputStream inStream) throws CRLException; + + // 1.4 instance methods. + // ------------------------------------------------------------------------ + + /** + * Generate a {@link CertPath} and initialize it with data parsed from + * the input stream. The default encoding of this factory is used. + * + * @param inStream The InputStream containing the CertPath data. + * @return A CertPath initialized from the input stream data. + * @throws CertificateException If an error occurs decoding the + * CertPath. + */ + public CertPath engineGenerateCertPath(InputStream inStream) + throws CertificateException + { + throw new UnsupportedOperationException("not implemented"); + } + + /** + * Generate a {@link CertPath} and initialize it with data parsed from + * the input stream, using the specified encoding. + * + * @param inStream The InputStream containing the CertPath data. + * @param encoding The encoding of the InputStream data. + * @return A CertPath initialized from the input stream data. + * @throws CertificateException If an error occurs decoding the + * CertPath. + */ + public CertPath engineGenerateCertPath(InputStream inStream, String encoding) + throws CertificateException + { + throw new UnsupportedOperationException("not implemented"); + } + + /** + * Generate a {@link CertPath} and initialize it with the certificates + * in the {@link java.util.List} argument. + * + * @param certificates The list of certificates with which to create + * the CertPath. + * @return A CertPath initialized from the certificates. + * @throws CertificateException If an error occurs generating the + * CertPath. + */ + public CertPath engineGenerateCertPath(List certificates) + throws CertificateException + { + throw new UnsupportedOperationException("not implemented"); + } + + /** + * Returns an Iterator of CertPath encodings supported by this + * factory, with the default encoding first. The returned Iterator + * cannot be modified. + * + * @return The Iterator of supported encodings. + */ + public Iterator engineGetCertPathEncodings() + { + throw new UnsupportedOperationException("not implemented"); + } } diff --git a/java/security/cert/X509Certificate.java b/java/security/cert/X509Certificate.java index b245dcdfe..cce1e535c 100644 --- a/java/security/cert/X509Certificate.java +++ b/java/security/cert/X509Certificate.java @@ -1,5 +1,5 @@ /* X509Certificate.java --- X.509 Certificate class - Copyright (C) 1999 Free Software Foundation, Inc. + Copyright (C) 1999,2003 Free Software Foundation, Inc. This file is part of GNU Classpath. @@ -37,6 +37,7 @@ exception statement from your version. */ package java.security.cert; + import java.math.BigInteger; import java.security.Principal; import java.security.PublicKey; @@ -47,90 +48,104 @@ import java.security.SignatureException; import java.util.Date; /** - X509Certificate is the abstract class for X.509 certificates. - This provides a stanard class interface for accessing all - the attributes of X.509 certificates. - - In June 1996, the basic X.509 v3 format was finished by - ISO/IEC and ANSI X.9. The ASN.1 DER format is below: - - Certificate ::= SEQUENCE { - tbsCertificate TBSCertificate, - signatureAlgorithm AlgorithmIdentifier, - signatureValue BIT STRING } - - These certificates are widely used in various Internet - protocols to support authentication. It is used in - Privacy Enhanced Mail (PEM), Transport Layer Security (TLS), - Secure Sockets Layer (SSL), code signing for trusted software - distribution, and Secure Electronic Transactions (SET). - - The certificates are managed and vouched for by - <I>Certificate Authorities</I> (CAs). CAs are companies or - groups that create certificates by placing the data in the - X.509 certificate format and signing it with their private - key. CAs serve as trusted third parties by certifying that - the person or group specified in the certificate is who - they say they are. - - The ASN.1 defintion for <I>tbsCertificate</I> is - - TBSCertificate ::= SEQUENCE { - version [0] EXPLICIT Version DEFAULT v1, - serialNumber CertificateSerialNumber, - signature AlgorithmIdentifier, - issuer Name, - validity Validity, - subject Name, - subjectPublicKeyInfo SubjectPublicKeyInfo, - issuerUniqueID [1] IMPLICIT UniqueIdentifier OPTIONAL, - -- If present, version shall be v2 or v3 - subjectUniqueID [2] IMPLICIT UniqueIdentifier OPTIONAL, - -- If present, version shall be v2 or v3 - extensions [3] EXPLICIT Extensions OPTIONAL - -- If present, version shall be v3 - } - - Version ::= INTEGER { v1(0), v2(1), v3(2) } - - CertificateSerialNumber ::= INTEGER - - Validity ::= SEQUENCE { - notBefore Time, - notAfter Time } - - Time ::= CHOICE { - utcTime UTCTime, - generalTime GeneralizedTime } - - UniqueIdentifier ::= BIT STRING - - SubjectPublicKeyInfo ::= SEQUENCE { - algorithm AlgorithmIdentifier, - subjectPublicKey BIT STRING } - - Extensions ::= SEQUENCE SIZE (1..MAX) OF Extension - - Extension ::= SEQUENCE { - extnID OBJECT IDENTIFIER, - critical BOOLEAN DEFAULT FALSE, - extnValue OCTET STRING } - - - Certificates are created with the CertificateFactory. - For more information about X.509 certificates, consult - rfc2459. - - @since JDK 1.2 - - @author Mark Benvenuto -*/ + * X509Certificate is the abstract class for X.509 certificates. + * This provides a stanard class interface for accessing all + * the attributes of X.509 certificates. + * + * <p>In June 1996, the basic X.509 v3 format was finished by + * ISO/IEC and ANSI X.9. The ASN.1 DER format is below: + * + * <blockquote><pre> + * Certificate ::= SEQUENCE { + * tbsCertificate TBSCertificate, + * signatureAlgorithm AlgorithmIdentifier, + * signatureValue BIT STRING } + * </pre></blockquote> + * + * <p>These certificates are widely used in various Internet + * protocols to support authentication. It is used in + * Privacy Enhanced Mail (PEM), Transport Layer Security (TLS), + * Secure Sockets Layer (SSL), code signing for trusted software + * distribution, and Secure Electronic Transactions (SET). + * + * <p>The certificates are managed and vouched for by + * <I>Certificate Authorities</I> (CAs). CAs are companies or + * groups that create certificates by placing the data in the + * X.509 certificate format and signing it with their private + * key. CAs serve as trusted third parties by certifying that + * the person or group specified in the certificate is who + * they say they are. + * + * <p>The ASN.1 defintion for <I>tbsCertificate</I> is + * + * <blockquote><pre> + * TBSCertificate ::= SEQUENCE { + * version [0] EXPLICIT Version DEFAULT v1, + * serialNumber CertificateSerialNumber, + * signature AlgorithmIdentifier, + * issuer Name, + * validity Validity, + * subject Name, + * subjectPublicKeyInfo SubjectPublicKeyInfo, + * issuerUniqueID [1] IMPLICIT UniqueIdentifier OPTIONAL, + * -- If present, version shall be v2 or v3 + * subjectUniqueID [2] IMPLICIT UniqueIdentifier OPTIONAL, + * -- If present, version shall be v2 or v3 + * extensions [3] EXPLICIT Extensions OPTIONAL + * -- If present, version shall be v3 + * } + * + * Version ::= INTEGER { v1(0), v2(1), v3(2) } + * + * CertificateSerialNumber ::= INTEGER + * + * Validity ::= SEQUENCE { + * notBefore Time, + * notAfter Time } + * + * Time ::= CHOICE { + * utcTime UTCTime, + * generalTime GeneralizedTime } + * + * UniqueIdentifier ::= BIT STRING + * + * SubjectPublicKeyInfo ::= SEQUENCE { + * algorithm AlgorithmIdentifier, + * subjectPublicKey BIT STRING } + * + * Extensions ::= SEQUENCE SIZE (1..MAX) OF Extension + * + * Extension ::= SEQUENCE { + * extnID OBJECT IDENTIFIER, + * critical BOOLEAN DEFAULT FALSE, + * extnValue OCTET STRING } + * </pre></blockquote> + * + * Certificates are created with the CertificateFactory. + * + * <p>References: + * + * <ol> + * <li>Olivier Dubuisson, Philippe Fouquart (Translator) <i>ASN.1 - + * Communication between heterogeneous systems</i>, (C) September 2000, + * Morgan Kaufmann Publishers, ISBN 0-12-6333361-0. Available on-line at + * <a + * href="http://www.oss.com/asn1/dubuisson.html">http://www.oss.com/asn1/dubuisson.html</a></li> + * <li>R. Housley et al, <i><a href="http://www.ietf.org/rfc/rfc3280.txt">RFC + * 3280: Internet X.509 Public Key Infrastructure Certificate and CRL + * Profile</a></i>.</li> + * </ol> + * + * @since JDK 1.2 + * @author Mark Benvenuto + * @author Casey Marshall (rsdio@metastatic.org) + */ public abstract class X509Certificate extends Certificate implements X509Extension { /** - Constructs a new certificate of the specified type. - */ + * Constructs a new certificate of the specified type. + */ protected X509Certificate() { super( "X.509" ); @@ -451,5 +466,125 @@ public abstract class X509Certificate extends Certificate implements X509Extensi */ public abstract int getBasicConstraints(); + // 1.4 instance methods. + // ------------------------------------------------------------------------ + + /** + * Returns the <code>ExtendedKeyUsage</code> extension of this + * certificate, or null if there is no extension present. The returned + * value is a {@link java.util.List} strings representing the object + * identifiers of the extended key usages. This extension has the OID + * 2.5.29.37. + * + * <p>The ASN.1 definition for this extension is: + * + * <blockquote><pre> + * ExtendedKeyUsage ::= SEQUENCE SIZE (1..MAX) OF KeyPurposeId + * + * KeyPurposeId ::= OBJECT IDENTIFIER + * </pre></blockquote> + * + * @return The list of extension OIDs, or null if there are none + * present in this certificate. + * @throws CertificateParsingException If this extension cannot be + * parsed from its encoded form. + */ + public java.util.List getExtendedKeyUsage() + throws CertificateParsingException + { + throw new UnsupportedOperationException(); + } + + /** + * Returns the alternative names for this certificate's subject (the + * owner), or null if there are none. + * + * <p>This is an X.509 extension with OID 2.5.29.17 and is defined by + * the ASN.1 construction: + * + * <blockquote><pre> + * SubjectAltNames ::= GeneralNames + * + * GeneralNames ::= SEQUENCE SIZE (1..MAX) OF GeneralName + * + * GeneralName ::= CHOICE { + * otherName [0] OtherName, + * rfc822Name [1] IA5String, + * dNSName [2] IA5String, + * x400Address [3] ORAddress, + * directoryName [4] Name, + * ediPartyName [5] EDIPartyName, + * uniformResourceIdentifier [6] IA5String, + * iPAddress [7] OCTET STRING, + * registeredID [8] OBJECT IDENTIFIER + * } + * </pre></blockquote> + * + * <p>The returned collection contains one or more two-element Lists, + * with the first object being an Integer representing the choice + * above (with value 0 through 8) and the second being an (a) String + * if the <code>GeneralName</code> is a rfc822Name, dNSName, + * uniformResourceIdentifier, iPAddress, or registeredID, or (b) a + * byte array of the DER encoded form for any others. + * + * @return The collection of alternative names, or null if there are + * none. + * @throws CertificateParsingException If the encoded extension cannot + * be parsed. + * @since JDK 1.4 + */ + public java.util.Collection getSubjectAlternativeNames() + throws CertificateParsingException + { + throw new UnsupportedOperationException(); + } + /** + * Returns the alternative names for this certificate's issuer, or + * null if there are none. + * + * <p>This is an X.509 extension with OID 2.5.29.18, and is defined by + * the ASN.1 construction: + * + * <blockquote><pre> + * IssuerAltNames ::= GeneralNames + * </pre></blockquote> + * + * <p>The <code>GeneralNames</code> construct and the form of the + * returned collection are the same as with {@link + * #getSubjectAlternativeNames()}. + * + * @return The collection of alternative names, or null if there are + * none. + * @throws CertificateParsingException If the encoded extension cannot + * be parsed. + * @since JDK 1.4 + */ + public java.util.Collection getIssuerAlternativeNames() + throws CertificateParsingException + { + throw new UnsupportedOperationException(); + } + + /** + * Returns the X.500 distinguished name of this certificate's subject. + * + * @return The subject's X.500 distinguished name. + * @since JDK 1.4 + */ + public javax.security.auth.x500.X500Principal getSubjectX500Principal() + { + throw new UnsupportedOperationException(); + } + + /** + * Returns the X.500 distinguished name of this certificate's issuer. + * + * @return The issuer's X.500 distinguished name. + * @since JDK 1.4 + */ + public javax.security.auth.x500.X500Principal getIssuerX500Principal() + { + throw new UnsupportedOperationException(); + } } |