blob: 5299d5cfa33cffa3cc4eb9ce4afd361528cf37e6 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
|
package org.spongycastle.x509;
import org.spongycastle.util.Selector;
import java.security.InvalidAlgorithmParameterException;
import java.security.InvalidParameterException;
import java.security.cert.PKIXBuilderParameters;
import java.security.cert.PKIXParameters;
import java.security.cert.TrustAnchor;
import java.security.cert.X509CertSelector;
import java.util.Collections;
import java.util.HashSet;
import java.util.Set;
/**
* This class contains extended parameters for PKIX certification path builders.
*
* @see java.security.cert.PKIXBuilderParameters
* @see org.spongycastle.jce.provider.PKIXCertPathBuilderSpi
*/
public class ExtendedPKIXBuilderParameters extends ExtendedPKIXParameters
{
private int maxPathLength = 5;
private Set excludedCerts = Collections.EMPTY_SET;
/**
* Excluded certificates are not used for building a certification path.
* <p>
* The returned set is immutable.
*
* @return Returns the excluded certificates.
*/
public Set getExcludedCerts()
{
return Collections.unmodifiableSet(excludedCerts);
}
/**
* Sets the excluded certificates which are not used for building a
* certification path. If the <code>Set</code> is <code>null</code> an
* empty set is assumed.
* <p>
* The given set is cloned to protect it against subsequent modifications.
*
* @param excludedCerts The excluded certificates to set.
*/
public void setExcludedCerts(Set excludedCerts)
{
if (excludedCerts == null)
{
excludedCerts = Collections.EMPTY_SET;
}
else
{
this.excludedCerts = new HashSet(excludedCerts);
}
}
/**
* Creates an instance of <code>PKIXBuilderParameters</code> with the
* specified <code>Set</code> of most-trusted CAs. Each element of the set
* is a {@link TrustAnchor TrustAnchor}.
*
* <p>
* Note that the <code>Set</code> is copied to protect against subsequent
* modifications.
*
* @param trustAnchors a <code>Set</code> of <code>TrustAnchor</code>s
* @param targetConstraints a <code>Selector</code> specifying the
* constraints on the target certificate or attribute
* certificate.
* @throws InvalidAlgorithmParameterException if <code>trustAnchors</code>
* is empty.
* @throws NullPointerException if <code>trustAnchors</code> is
* <code>null</code>
* @throws ClassCastException if any of the elements of
* <code>trustAnchors</code> is not of type
* <code>java.security.cert.TrustAnchor</code>
*/
public ExtendedPKIXBuilderParameters(Set trustAnchors,
Selector targetConstraints)
throws InvalidAlgorithmParameterException
{
super(trustAnchors);
setTargetConstraints(targetConstraints);
}
/**
* Sets the maximum number of intermediate non-self-issued certificates in a
* certification path. The PKIX <code>CertPathBuilder</code> must not
* build paths longer then this length.
* <p>
* A value of 0 implies that the path can only contain a single certificate.
* A value of -1 does not limit the length. The default length is 5.
*
* <p>
*
* The basic constraints extension of a CA certificate overrides this value
* if smaller.
*
* @param maxPathLength the maximum number of non-self-issued intermediate
* certificates in the certification path
* @throws InvalidParameterException if <code>maxPathLength</code> is set
* to a value less than -1
*
* @see org.spongycastle.jce.provider.PKIXCertPathBuilderSpi
* @see #getMaxPathLength
*/
public void setMaxPathLength(int maxPathLength)
{
if (maxPathLength < -1)
{
throw new InvalidParameterException("The maximum path "
+ "length parameter can not be less than -1.");
}
this.maxPathLength = maxPathLength;
}
/**
* Returns the value of the maximum number of intermediate non-self-issued
* certificates in the certification path.
*
* @return the maximum number of non-self-issued intermediate certificates
* in the certification path, or -1 if no limit exists.
*
* @see #setMaxPathLength(int)
*/
public int getMaxPathLength()
{
return maxPathLength;
}
/**
* Can alse handle <code>ExtendedPKIXBuilderParameters</code> and
* <code>PKIXBuilderParameters</code>.
*
* @param params Parameters to set.
* @see org.spongycastle.x509.ExtendedPKIXParameters#setParams(java.security.cert.PKIXParameters)
*/
protected void setParams(PKIXParameters params)
{
super.setParams(params);
if (params instanceof ExtendedPKIXBuilderParameters)
{
ExtendedPKIXBuilderParameters _params = (ExtendedPKIXBuilderParameters) params;
maxPathLength = _params.maxPathLength;
excludedCerts = new HashSet(_params.excludedCerts);
}
if (params instanceof PKIXBuilderParameters)
{
PKIXBuilderParameters _params = (PKIXBuilderParameters) params;
maxPathLength = _params.getMaxPathLength();
}
}
/**
* Makes a copy of this <code>PKIXParameters</code> object. Changes to the
* copy will not affect the original and vice versa.
*
* @return a copy of this <code>PKIXParameters</code> object
*/
public Object clone()
{
ExtendedPKIXBuilderParameters params = null;
try
{
params = new ExtendedPKIXBuilderParameters(getTrustAnchors(),
getTargetConstraints());
}
catch (Exception e)
{
// cannot happen
throw new RuntimeException(e.getMessage());
}
params.setParams(this);
return params;
}
/**
* Returns an instance of <code>ExtendedPKIXParameters</code> which can be
* safely casted to <code>ExtendedPKIXBuilderParameters</code>.
* <p>
* This method can be used to get a copy from other
* <code>PKIXBuilderParameters</code>, <code>PKIXParameters</code>,
* and <code>ExtendedPKIXParameters</code> instances.
*
* @param pkixParams The PKIX parameters to create a copy of.
* @return An <code>ExtendedPKIXBuilderParameters</code> instance.
*/
public static ExtendedPKIXParameters getInstance(PKIXParameters pkixParams)
{
ExtendedPKIXBuilderParameters params;
try
{
params = new ExtendedPKIXBuilderParameters(pkixParams
.getTrustAnchors(), X509CertStoreSelector
.getInstance((X509CertSelector) pkixParams
.getTargetCertConstraints()));
}
catch (Exception e)
{
// cannot happen
throw new RuntimeException(e.getMessage());
}
params.setParams(pkixParams);
return params;
}
}
|
