2
|
1 |
/*
|
|
2 |
* Copyright 2003-2004 Sun Microsystems, Inc. All Rights Reserved.
|
|
3 |
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
|
|
4 |
*
|
|
5 |
* This code is free software; you can redistribute it and/or modify it
|
|
6 |
* under the terms of the GNU General Public License version 2 only, as
|
|
7 |
* published by the Free Software Foundation. Sun designates this
|
|
8 |
* particular file as subject to the "Classpath" exception as provided
|
|
9 |
* by Sun in the LICENSE file that accompanied this code.
|
|
10 |
*
|
|
11 |
* This code is distributed in the hope that it will be useful, but WITHOUT
|
|
12 |
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
|
|
13 |
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
|
|
14 |
* version 2 for more details (a copy is included in the LICENSE file that
|
|
15 |
* accompanied this code).
|
|
16 |
*
|
|
17 |
* You should have received a copy of the GNU General Public License version
|
|
18 |
* 2 along with this work; if not, write to the Free Software Foundation,
|
|
19 |
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
|
|
20 |
*
|
|
21 |
* Please contact Sun Microsystems, Inc., 4150 Network Circle, Santa Clara,
|
|
22 |
* CA 95054 USA or visit www.sun.com if you need additional information or
|
|
23 |
* have any questions.
|
|
24 |
*/
|
|
25 |
|
|
26 |
package sun.security.provider.certpath;
|
|
27 |
|
|
28 |
import java.io.IOException;
|
|
29 |
import java.security.cert.CertPathValidatorException;
|
|
30 |
import sun.misc.HexDumpEncoder;
|
|
31 |
import sun.security.x509.*;
|
|
32 |
import sun.security.util.*;
|
|
33 |
|
|
34 |
/**
|
|
35 |
* This class can be used to generate an OCSP request and send it over
|
|
36 |
* an outputstream. Currently we do not support signing requests
|
|
37 |
* The OCSP Request is specified in RFC 2560 and
|
|
38 |
* the ASN.1 definition is as follows:
|
|
39 |
* <pre>
|
|
40 |
*
|
|
41 |
* OCSPRequest ::= SEQUENCE {
|
|
42 |
* tbsRequest TBSRequest,
|
|
43 |
* optionalSignature [0] EXPLICIT Signature OPTIONAL }
|
|
44 |
*
|
|
45 |
* TBSRequest ::= SEQUENCE {
|
|
46 |
* version [0] EXPLICIT Version DEFAULT v1,
|
|
47 |
* requestorName [1] EXPLICIT GeneralName OPTIONAL,
|
|
48 |
* requestList SEQUENCE OF Request,
|
|
49 |
* requestExtensions [2] EXPLICIT Extensions OPTIONAL }
|
|
50 |
*
|
|
51 |
* Signature ::= SEQUENCE {
|
|
52 |
* signatureAlgorithm AlgorithmIdentifier,
|
|
53 |
* signature BIT STRING,
|
|
54 |
* certs [0] EXPLICIT SEQUENCE OF Certificate OPTIONAL
|
|
55 |
* }
|
|
56 |
*
|
|
57 |
* Version ::= INTEGER { v1(0) }
|
|
58 |
*
|
|
59 |
* Request ::= SEQUENCE {
|
|
60 |
* reqCert CertID,
|
|
61 |
* singleRequestExtensions [0] EXPLICIT Extensions OPTIONAL }
|
|
62 |
*
|
|
63 |
* CertID ::= SEQUENCE {
|
|
64 |
* hashAlgorithm AlgorithmIdentifier,
|
|
65 |
* issuerNameHash OCTET STRING, -- Hash of Issuer's DN
|
|
66 |
* issuerKeyHash OCTET STRING, -- Hash of Issuers public key
|
|
67 |
* serialNumber CertificateSerialNumber
|
|
68 |
* }
|
|
69 |
*
|
|
70 |
* </pre>
|
|
71 |
*
|
|
72 |
* @author Ram Marti
|
|
73 |
*/
|
|
74 |
|
|
75 |
class OCSPRequest {
|
|
76 |
|
|
77 |
private static final Debug debug = Debug.getInstance("certpath");
|
|
78 |
private static final boolean dump = false;
|
|
79 |
|
|
80 |
// Serial number of the certificates to be checked for revocation
|
|
81 |
private SerialNumber serialNumber;
|
|
82 |
|
|
83 |
// Issuer's certificate (for computing certId hash values)
|
|
84 |
private X509CertImpl issuerCert;
|
|
85 |
|
|
86 |
// CertId of the certificate to be checked
|
|
87 |
private CertId certId = null;
|
|
88 |
|
|
89 |
/*
|
|
90 |
* Constructs an OCSPRequest. This constructor is used
|
|
91 |
* to construct an unsigned OCSP Request for a single user cert.
|
|
92 |
*/
|
|
93 |
// used by OCSPChecker
|
|
94 |
OCSPRequest(X509CertImpl userCert, X509CertImpl issuerCert)
|
|
95 |
throws CertPathValidatorException {
|
|
96 |
|
|
97 |
if (issuerCert == null) {
|
|
98 |
throw new CertPathValidatorException("Null IssuerCertificate");
|
|
99 |
}
|
|
100 |
this.issuerCert = issuerCert;
|
|
101 |
serialNumber = userCert.getSerialNumberObject();
|
|
102 |
}
|
|
103 |
|
|
104 |
// used by OCSPChecker
|
|
105 |
byte[] encodeBytes() throws IOException {
|
|
106 |
|
|
107 |
// encode tbsRequest
|
|
108 |
DerOutputStream tmp = new DerOutputStream();
|
|
109 |
DerOutputStream derSingleReqList = new DerOutputStream();
|
|
110 |
SingleRequest singleRequest = null;
|
|
111 |
|
|
112 |
try {
|
|
113 |
singleRequest = new SingleRequest(issuerCert, serialNumber);
|
|
114 |
} catch (Exception e) {
|
|
115 |
throw new IOException("Error encoding OCSP request");
|
|
116 |
}
|
|
117 |
|
|
118 |
certId = singleRequest.getCertId();
|
|
119 |
singleRequest.encode(derSingleReqList);
|
|
120 |
tmp.write(DerValue.tag_Sequence, derSingleReqList);
|
|
121 |
// No extensions supported
|
|
122 |
DerOutputStream tbsRequest = new DerOutputStream();
|
|
123 |
tbsRequest.write(DerValue.tag_Sequence, tmp);
|
|
124 |
|
|
125 |
// OCSPRequest without the signature
|
|
126 |
DerOutputStream ocspRequest = new DerOutputStream();
|
|
127 |
ocspRequest.write(DerValue.tag_Sequence, tbsRequest);
|
|
128 |
|
|
129 |
byte[] bytes = ocspRequest.toByteArray();
|
|
130 |
|
|
131 |
if (dump) {
|
|
132 |
HexDumpEncoder hexEnc = new HexDumpEncoder();
|
|
133 |
System.out.println ("OCSPRequest bytes are... ");
|
|
134 |
System.out.println(hexEnc.encode(bytes));
|
|
135 |
}
|
|
136 |
|
|
137 |
return(bytes);
|
|
138 |
}
|
|
139 |
|
|
140 |
// used by OCSPChecker
|
|
141 |
CertId getCertId() {
|
|
142 |
return certId;
|
|
143 |
}
|
|
144 |
|
|
145 |
private static class SingleRequest {
|
|
146 |
private CertId certId;
|
|
147 |
|
|
148 |
// No extensions are set
|
|
149 |
|
|
150 |
private SingleRequest(X509CertImpl cert, SerialNumber serialNo) throws Exception {
|
|
151 |
certId = new CertId(cert, serialNo);
|
|
152 |
}
|
|
153 |
|
|
154 |
private void encode(DerOutputStream out) throws IOException {
|
|
155 |
DerOutputStream tmp = new DerOutputStream();
|
|
156 |
certId.encode(tmp);
|
|
157 |
out.write(DerValue.tag_Sequence, tmp);
|
|
158 |
}
|
|
159 |
|
|
160 |
private CertId getCertId() {
|
|
161 |
return certId;
|
|
162 |
}
|
|
163 |
}
|
|
164 |
}
|