* The issuing distribution point is a critical CRL extension that * identifies the CRL distribution point and scope for a particular CRL, * and it indicates whether the CRL covers revocation for end entity * certificates only, CA certificates only, attribute certificates only, * or a limited set of reason codes. * *
* The extension is defined in Section 5.2.5 of * Internet X.509 PKI Certific ate and Certificate Revocation List (CRL) Profile. * *
* Its ASN.1 definition is as follows: *
* id-ce-issuingDistributionPoint OBJECT IDENTIFIER ::= { id-ce 28 }
*
* issuingDistributionPoint ::= SEQUENCE {
* distributionPoint [0] DistributionPointName OPTIONAL,
* onlyContainsUserCerts [1] BOOLEAN DEFAULT FALSE,
* onlyContainsCACerts [2] BOOLEAN DEFAULT FALSE,
* onlySomeReasons [3] ReasonFlags OPTIONAL,
* indirectCRL [4] BOOLEAN DEFAULT FALSE,
* onlyContainsAttributeCerts [5] BOOLEAN DEFAULT FALSE }
*
*
* @see DistributionPoint
* @since 1.6
*/
public class IssuingDistributionPointExtension extends Extension
implements CertAttrSettrue then scope of the CRL
* includes only user certificates.
* @param hasOnlyCACerts if true then scope of the CRL
* includes only CA certificates.
* @param hasOnlyAttributeCerts if true then scope of the CRL
* includes only attribute certificates.
* @param isIndirectCRL if true then the scope of the CRL
* includes certificates issued by authorities other than the CRL
* issuer. The responsible authority is indicated by a certificate
* issuer CRL entry extension.
* @throws IllegalArgumentException if more than one of
* hasOnlyUserCerts, hasOnlyCACerts,
* hasOnlyAttributeCerts is set to true.
* @throws IOException on encoding error.
*/
public IssuingDistributionPointExtension(
DistributionPointName distributionPoint, ReasonFlags revocationReasons,
boolean hasOnlyUserCerts, boolean hasOnlyCACerts,
boolean hasOnlyAttributeCerts, boolean isIndirectCRL)
throws IOException {
if ((hasOnlyUserCerts && (hasOnlyCACerts || hasOnlyAttributeCerts)) ||
(hasOnlyCACerts && (hasOnlyUserCerts || hasOnlyAttributeCerts)) ||
(hasOnlyAttributeCerts && (hasOnlyUserCerts || hasOnlyCACerts))) {
throw new IllegalArgumentException(
"Only one of hasOnlyUserCerts, hasOnlyCACerts, " +
"hasOnlyAttributeCerts may be set to true");
}
this.extensionId = PKIXExtensions.IssuingDistributionPoint_Id;
this.critical = true;
this.distributionPoint = distributionPoint;
this.revocationReasons = revocationReasons;
this.hasOnlyUserCerts = hasOnlyUserCerts;
this.hasOnlyCACerts = hasOnlyCACerts;
this.hasOnlyAttributeCerts = hasOnlyAttributeCerts;
this.isIndirectCRL = isIndirectCRL;
encodeThis();
}
/**
* Creates a critical IssuingDistributionPointExtension from its
* DER-encoding.
*
* @param critical true if the extension is to be treated as critical.
* @param value the DER-encoded value. It must be a byte[].
* @exception IOException on decoding error.
*/
public IssuingDistributionPointExtension(Boolean critical, Object value)
throws IOException {
this.extensionId = PKIXExtensions.IssuingDistributionPoint_Id;
this.critical = critical.booleanValue();
if (!(value instanceof byte[])) {
throw new IOException("Illegal argument type");
}
extensionValue = (byte[])value;
DerValue val = new DerValue(extensionValue);
if (val.tag != DerValue.tag_Sequence) {
throw new IOException("Invalid encoding for " +
"IssuingDistributionPointExtension.");
}
// All the elements in issuingDistributionPoint are optional
if ((val.data == null) || (val.data.available() == 0)) {
return;
}
DerInputStream in = val.data;
while (in != null && in.available() != 0) {
DerValue opt = in.getDerValue();
if (opt.isContextSpecific(TAG_DISTRIBUTION_POINT) &&
opt.isConstructed()) {
distributionPoint =
new DistributionPointName(opt.data.getDerValue());
} else if (opt.isContextSpecific(TAG_ONLY_USER_CERTS) &&
!opt.isConstructed()) {
opt.resetTag(DerValue.tag_Boolean);
hasOnlyUserCerts = opt.getBoolean();
} else if (opt.isContextSpecific(TAG_ONLY_CA_CERTS) &&
!opt.isConstructed()) {
opt.resetTag(DerValue.tag_Boolean);
hasOnlyCACerts = opt.getBoolean();
} else if (opt.isContextSpecific(TAG_ONLY_SOME_REASONS) &&
!opt.isConstructed()) {
revocationReasons = new ReasonFlags(opt); // expects tag implicit
} else if (opt.isContextSpecific(TAG_INDIRECT_CRL) &&
!opt.isConstructed()) {
opt.resetTag(DerValue.tag_Boolean);
isIndirectCRL = opt.getBoolean();
} else if (opt.isContextSpecific(TAG_ONLY_ATTRIBUTE_CERTS) &&
!opt.isConstructed()) {
opt.resetTag(DerValue.tag_Boolean);
hasOnlyAttributeCerts = opt.getBoolean();
} else {
throw new IOException
("Invalid encoding of IssuingDistributionPoint");
}
}
}
/**
* Returns the name of this attribute.
*/
public String getName() {
return NAME;
}
/**
* Encodes the issuing distribution point extension and writes it to the
* DerOutputStream.
*
* @param out the output stream.
* @exception IOException on encoding error.
*/
public void encode(OutputStream out) throws IOException {
DerOutputStream tmp = new DerOutputStream();
if (this.extensionValue == null) {
this.extensionId = PKIXExtensions.IssuingDistributionPoint_Id;
this.critical = false;
encodeThis();
}
super.encode(tmp);
out.write(tmp.toByteArray());
}
/**
* Sets the attribute value.
*/
public void set(String name, Object obj) throws IOException {
if (name.equalsIgnoreCase(POINT)) {
if (!(obj instanceof DistributionPointName)) {
throw new IOException(
"Attribute value should be of type DistributionPointName.");
}
distributionPoint = (DistributionPointName)obj;
} else if (name.equalsIgnoreCase(REASONS)) {
if (!(obj instanceof ReasonFlags)) {
throw new IOException(
"Attribute value should be of type ReasonFlags.");
}
revocationReasons = (ReasonFlags)obj;
} else if (name.equalsIgnoreCase(INDIRECT_CRL)) {
if (!(obj instanceof Boolean)) {
throw new IOException(
"Attribute value should be of type Boolean.");
}
isIndirectCRL = ((Boolean)obj).booleanValue();
} else if (name.equalsIgnoreCase(ONLY_USER_CERTS)) {
if (!(obj instanceof Boolean)) {
throw new IOException(
"Attribute value should be of type Boolean.");
}
hasOnlyUserCerts = ((Boolean)obj).booleanValue();
} else if (name.equalsIgnoreCase(ONLY_CA_CERTS)) {
if (!(obj instanceof Boolean)) {
throw new IOException(
"Attribute value should be of type Boolean.");
}
hasOnlyCACerts = ((Boolean)obj).booleanValue();
} else if (name.equalsIgnoreCase(ONLY_ATTRIBUTE_CERTS)) {
if (!(obj instanceof Boolean)) {
throw new IOException(
"Attribute value should be of type Boolean.");
}
hasOnlyAttributeCerts = ((Boolean)obj).booleanValue();
} else {
throw new IOException("Attribute name [" + name +
"] not recognized by " +
"CertAttrSet:IssuingDistributionPointExtension.");
}
encodeThis();
}
/**
* Gets the attribute value.
*/
public Object get(String name) throws IOException {
if (name.equalsIgnoreCase(POINT)) {
return distributionPoint;
} else if (name.equalsIgnoreCase(INDIRECT_CRL)) {
return Boolean.valueOf(isIndirectCRL);
} else if (name.equalsIgnoreCase(REASONS)) {
return revocationReasons;
} else if (name.equalsIgnoreCase(ONLY_USER_CERTS)) {
return Boolean.valueOf(hasOnlyUserCerts);
} else if (name.equalsIgnoreCase(ONLY_CA_CERTS)) {
return Boolean.valueOf(hasOnlyCACerts);
} else if (name.equalsIgnoreCase(ONLY_ATTRIBUTE_CERTS)) {
return Boolean.valueOf(hasOnlyAttributeCerts);
} else {
throw new IOException("Attribute name [" + name +
"] not recognized by " +
"CertAttrSet:IssuingDistributionPointExtension.");
}
}
/**
* Deletes the attribute value.
*/
public void delete(String name) throws IOException {
if (name.equalsIgnoreCase(POINT)) {
distributionPoint = null;
} else if (name.equalsIgnoreCase(INDIRECT_CRL)) {
isIndirectCRL = false;
} else if (name.equalsIgnoreCase(REASONS)) {
revocationReasons = null;
} else if (name.equalsIgnoreCase(ONLY_USER_CERTS)) {
hasOnlyUserCerts = false;
} else if (name.equalsIgnoreCase(ONLY_CA_CERTS)) {
hasOnlyCACerts = false;
} else if (name.equalsIgnoreCase(ONLY_ATTRIBUTE_CERTS)) {
hasOnlyAttributeCerts = false;
} else {
throw new IOException("Attribute name [" + name +
"] not recognized by " +
"CertAttrSet:IssuingDistributionPointExtension.");
}
encodeThis();
}
/**
* Returns an enumeration of names of attributes existing within this
* attribute.
*/
public Enumeration