2
|
1 |
/*
|
|
2 |
* Copyright 2007 Sun Microsystems, Inc. All Rights Reserved.
|
|
3 |
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
|
|
4 |
*
|
|
5 |
* This code is free software; you can redistribute it and/or modify it
|
|
6 |
* under the terms of the GNU General Public License version 2 only, as
|
|
7 |
* published by the Free Software Foundation. Sun designates this
|
|
8 |
* particular file as subject to the "Classpath" exception as provided
|
|
9 |
* by Sun in the LICENSE file that accompanied this code.
|
|
10 |
*
|
|
11 |
* This code is distributed in the hope that it will be useful, but WITHOUT
|
|
12 |
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
|
|
13 |
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
|
|
14 |
* version 2 for more details (a copy is included in the LICENSE file that
|
|
15 |
* accompanied this code).
|
|
16 |
*
|
|
17 |
* You should have received a copy of the GNU General Public License version
|
|
18 |
* 2 along with this work; if not, write to the Free Software Foundation,
|
|
19 |
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
|
|
20 |
*
|
|
21 |
* Please contact Sun Microsystems, Inc., 4150 Network Circle, Santa Clara,
|
|
22 |
* CA 95054 USA or visit www.sun.com if you need additional information or
|
|
23 |
* have any questions.
|
|
24 |
*/
|
|
25 |
|
|
26 |
package java.security.cert;
|
|
27 |
|
|
28 |
import java.io.ObjectInputStream;
|
|
29 |
import java.io.ObjectOutputStream;
|
|
30 |
import java.io.IOException;
|
|
31 |
import java.util.Collections;
|
|
32 |
import java.util.Date;
|
|
33 |
import java.util.HashMap;
|
|
34 |
import java.util.Map;
|
|
35 |
import java.util.Map.Entry;
|
|
36 |
import javax.security.auth.x500.X500Principal;
|
|
37 |
|
|
38 |
import sun.security.util.ObjectIdentifier;
|
|
39 |
import sun.security.x509.InvalidityDateExtension;
|
|
40 |
|
|
41 |
/**
|
|
42 |
* An exception that indicates an X.509 certificate is revoked. A
|
|
43 |
* <code>CertificateRevokedException</code> contains additional information
|
|
44 |
* about the revoked certificate, such as the date on which the
|
|
45 |
* certificate was revoked and the reason it was revoked.
|
|
46 |
*
|
|
47 |
* @author Sean Mullan
|
|
48 |
* @since 1.7
|
|
49 |
* @see CertPathValidatorException
|
|
50 |
*/
|
|
51 |
public class CertificateRevokedException extends CertificateException {
|
|
52 |
|
|
53 |
private static final long serialVersionUID = 7839996631571608627L;
|
|
54 |
|
|
55 |
/**
|
|
56 |
* @serial the date on which the certificate was revoked
|
|
57 |
*/
|
|
58 |
private Date revocationDate;
|
|
59 |
/**
|
|
60 |
* @serial the revocation reason
|
|
61 |
*/
|
|
62 |
private final CRLReason reason;
|
|
63 |
/**
|
|
64 |
* @serial the name of the authority that signed the certificate's
|
|
65 |
* revocation status information
|
|
66 |
*/
|
|
67 |
private final X500Principal authority;
|
|
68 |
|
|
69 |
private transient Map<String, Extension> extensions;
|
|
70 |
|
|
71 |
/**
|
|
72 |
* Constructs a <code>CertificateRevokedException</code> with
|
|
73 |
* the specified revocation date, reason code, authority name, and map
|
|
74 |
* of extensions.
|
|
75 |
*
|
|
76 |
* @param revocationDate the date on which the certificate was revoked. The
|
|
77 |
* date is copied to protect against subsequent modification.
|
|
78 |
* @param reason the revocation reason
|
|
79 |
* @param extensions a map of X.509 Extensions. Each key is an OID String
|
|
80 |
* that maps to the corresponding Extension. The map is copied to
|
|
81 |
* prevent subsequent modification.
|
|
82 |
* @param authority the name of the authority that signed the certificate's
|
|
83 |
* revocation status information
|
|
84 |
* @throws NullPointerException if <code>revocationDate</code>,
|
|
85 |
* <code>reason</code>, <code>authority</code>, or
|
|
86 |
* <code>extensions</code> is <code>null</code>
|
|
87 |
*/
|
|
88 |
public CertificateRevokedException(Date revocationDate, CRLReason reason,
|
|
89 |
X500Principal authority, Map<String, Extension> extensions) {
|
|
90 |
if (revocationDate == null || reason == null || authority == null ||
|
|
91 |
extensions == null) {
|
|
92 |
throw new NullPointerException();
|
|
93 |
}
|
|
94 |
this.revocationDate = new Date(revocationDate.getTime());
|
|
95 |
this.reason = reason;
|
|
96 |
this.authority = authority;
|
|
97 |
this.extensions = new HashMap(extensions);
|
|
98 |
}
|
|
99 |
|
|
100 |
/**
|
|
101 |
* Returns the date on which the certificate was revoked. A new copy is
|
|
102 |
* returned each time the method is invoked to protect against subsequent
|
|
103 |
* modification.
|
|
104 |
*
|
|
105 |
* @return the revocation date
|
|
106 |
*/
|
|
107 |
public Date getRevocationDate() {
|
|
108 |
return (Date) revocationDate.clone();
|
|
109 |
}
|
|
110 |
|
|
111 |
/**
|
|
112 |
* Returns the reason the certificate was revoked.
|
|
113 |
*
|
|
114 |
* @return the revocation reason
|
|
115 |
*/
|
|
116 |
public CRLReason getRevocationReason() {
|
|
117 |
return reason;
|
|
118 |
}
|
|
119 |
|
|
120 |
/**
|
|
121 |
* Returns the name of the authority that signed the certificate's
|
|
122 |
* revocation status information.
|
|
123 |
*
|
|
124 |
* @return the name of the authority that signed the certificate's
|
|
125 |
* revocation status information
|
|
126 |
*/
|
|
127 |
public X500Principal getAuthorityName() {
|
|
128 |
return authority;
|
|
129 |
}
|
|
130 |
|
|
131 |
/**
|
|
132 |
* Returns the invalidity date, as specifed in the Invalidity Date
|
|
133 |
* extension of this <code>CertificateRevokedException</code>. The
|
|
134 |
* invalidity date is the date on which it is known or suspected that the
|
|
135 |
* private key was compromised or that the certificate otherwise became
|
|
136 |
* invalid. This implementation calls <code>getExtensions()</code> and
|
|
137 |
* checks the returned map for an entry for the Invalidity Date extension
|
|
138 |
* OID ("2.5.29.24"). If found, it returns the invalidity date in the
|
|
139 |
* extension; otherwise null. A new Date object is returned each time the
|
|
140 |
* method is invoked to protect against subsequent modification.
|
|
141 |
*
|
|
142 |
* @return the invalidity date, or <code>null</code> if not specified
|
|
143 |
*/
|
|
144 |
public Date getInvalidityDate() {
|
|
145 |
Extension ext = getExtensions().get("2.5.29.24");
|
|
146 |
if (ext == null) {
|
|
147 |
return null;
|
|
148 |
} else {
|
|
149 |
try {
|
|
150 |
Date invalidity =
|
|
151 |
(Date) InvalidityDateExtension.toImpl(ext).get("DATE");
|
|
152 |
return new Date(invalidity.getTime());
|
|
153 |
} catch (IOException ioe) {
|
|
154 |
return null;
|
|
155 |
}
|
|
156 |
}
|
|
157 |
}
|
|
158 |
|
|
159 |
/**
|
|
160 |
* Returns a map of X.509 extensions containing additional information
|
|
161 |
* about the revoked certificate, such as the Invalidity Date
|
|
162 |
* Extension. Each key is an OID String that maps to the corresponding
|
|
163 |
* Extension.
|
|
164 |
*
|
|
165 |
* @return an unmodifiable map of X.509 extensions, or an empty map
|
|
166 |
* if there are no extensions
|
|
167 |
*/
|
|
168 |
public Map<String, Extension> getExtensions() {
|
|
169 |
return Collections.unmodifiableMap(extensions);
|
|
170 |
}
|
|
171 |
|
|
172 |
@Override
|
|
173 |
public String getMessage() {
|
|
174 |
return "Certificate has been revoked, reason: "
|
|
175 |
+ reason + ", revocation date: " + revocationDate
|
|
176 |
+ ", authority: " + authority + ", extensions: " + extensions;
|
|
177 |
}
|
|
178 |
|
|
179 |
/**
|
|
180 |
* Serialize this <code>CertificateRevokedException</code> instance.
|
|
181 |
*
|
|
182 |
* @serialData the size of the extensions map (int), followed by all of
|
|
183 |
* the extensions in the map, in no particular order. For each extension,
|
|
184 |
* the following data is emitted: the OID String (Object), the criticality
|
|
185 |
* flag (boolean), the length of the encoded extension value byte array
|
|
186 |
* (int), and the encoded extension value bytes.
|
|
187 |
*/
|
|
188 |
private void writeObject(ObjectOutputStream oos) throws IOException {
|
|
189 |
// Write out the non-transient fields
|
|
190 |
// (revocationDate, reason, authority)
|
|
191 |
oos.defaultWriteObject();
|
|
192 |
|
|
193 |
// Write out the size (number of mappings) of the extensions map
|
|
194 |
oos.writeInt(extensions.size());
|
|
195 |
|
|
196 |
// For each extension in the map, the following are emitted (in order):
|
|
197 |
// the OID String (Object), the criticality flag (boolean), the length
|
|
198 |
// of the encoded extension value byte array (int), and the encoded
|
|
199 |
// extension value byte array. The extensions themselves are emitted
|
|
200 |
// in no particular order.
|
|
201 |
for (Map.Entry<String, Extension> entry : extensions.entrySet()) {
|
|
202 |
Extension ext = entry.getValue();
|
|
203 |
oos.writeObject(ext.getId());
|
|
204 |
oos.writeBoolean(ext.isCritical());
|
|
205 |
byte[] extVal = ext.getValue();
|
|
206 |
oos.writeInt(extVal.length);
|
|
207 |
oos.write(extVal);
|
|
208 |
}
|
|
209 |
}
|
|
210 |
|
|
211 |
/**
|
|
212 |
* Deserialize the <code>CertificateRevokedException</code> instance.
|
|
213 |
*/
|
|
214 |
private void readObject(ObjectInputStream ois)
|
|
215 |
throws IOException, ClassNotFoundException {
|
|
216 |
// Read in the non-transient fields
|
|
217 |
// (revocationDate, reason, authority)
|
|
218 |
ois.defaultReadObject();
|
|
219 |
|
|
220 |
// Defensively copy the revocation date
|
|
221 |
revocationDate = new Date(revocationDate.getTime());
|
|
222 |
|
|
223 |
// Read in the size (number of mappings) of the extensions map
|
|
224 |
// and create the extensions map
|
|
225 |
int size = ois.readInt();
|
|
226 |
if (size == 0) {
|
|
227 |
extensions = Collections.emptyMap();
|
|
228 |
} else {
|
|
229 |
extensions = new HashMap<String, Extension>(size);
|
|
230 |
}
|
|
231 |
|
|
232 |
// Read in the extensions and put the mappings in the extensions map
|
|
233 |
for (int i = 0; i < size; i++) {
|
|
234 |
String oid = (String) ois.readObject();
|
|
235 |
boolean critical = ois.readBoolean();
|
|
236 |
int length = ois.readInt();
|
|
237 |
byte[] extVal = new byte[length];
|
|
238 |
ois.readFully(extVal);
|
|
239 |
Extension ext = sun.security.x509.Extension.newExtension
|
|
240 |
(new ObjectIdentifier(oid), critical, extVal);
|
|
241 |
extensions.put(oid, ext);
|
|
242 |
}
|
|
243 |
}
|
|
244 |
}
|