diff options
Diffstat (limited to 'pki/base/ca/src/com/netscape')
| -rw-r--r-- | pki/base/ca/src/com/netscape/ca/CAPolicy.java | 51 | ||||
| -rw-r--r-- | pki/base/ca/src/com/netscape/ca/CAService.java | 636 | ||||
| -rw-r--r-- | pki/base/ca/src/com/netscape/ca/CMSCRLExtensions.java | 191 | ||||
| -rw-r--r-- | pki/base/ca/src/com/netscape/ca/CRLIssuingPoint.java | 973 | ||||
| -rw-r--r-- | pki/base/ca/src/com/netscape/ca/CRLWithExpiredCerts.java | 28 | ||||
| -rw-r--r-- | pki/base/ca/src/com/netscape/ca/CertificateAuthority.java | 593 | ||||
| -rw-r--r-- | pki/base/ca/src/com/netscape/ca/SigningUnit.java | 77 |
7 files changed, 1260 insertions, 1289 deletions
diff --git a/pki/base/ca/src/com/netscape/ca/CAPolicy.java b/pki/base/ca/src/com/netscape/ca/CAPolicy.java index 80c801a4..ae6d15b3 100644 --- a/pki/base/ca/src/com/netscape/ca/CAPolicy.java +++ b/pki/base/ca/src/com/netscape/ca/CAPolicy.java @@ -17,7 +17,6 @@ // --- END COPYRIGHT BLOCK --- package com.netscape.ca; - import com.netscape.certsrv.apps.CMS; import com.netscape.certsrv.base.EBaseException; import com.netscape.certsrv.base.IConfigStore; @@ -32,14 +31,11 @@ import com.netscape.certsrv.request.PolicyResult; import com.netscape.cmscore.policy.GenericPolicyProcessor; import com.netscape.cmscore.util.Debug; - /** - * XXX Just inherit 'GenericPolicyProcessor' (from RA) for now. - * This really bad. need to make a special case just for connector. - * would like a much better way of doing this to handle both EE and - * connectors. - * XXX2 moved to just implement IPolicy since GenericPolicyProcessor is - * unuseable for CA. + * XXX Just inherit 'GenericPolicyProcessor' (from RA) for now. This really bad. + * need to make a special case just for connector. would like a much better way + * of doing this to handle both EE and connectors. XXX2 moved to just implement + * IPolicy since GenericPolicyProcessor is unuseable for CA. * * @version $Revision$, $Date$ */ @@ -47,8 +43,8 @@ public class CAPolicy implements IPolicy { IConfigStore mConfig = null; ICertificateAuthority mCA = null; - public static String PROP_PROCESSOR = - "processor"; + public static String PROP_PROCESSOR = + "processor"; // These are the different types of policy that are // allowed for the "processor" property public static String PR_TYPE_CLASSIC = "classic"; @@ -64,12 +60,12 @@ public class CAPolicy implements IPolicy { } public void init(ISubsystem owner, IConfigStore config) - throws EBaseException { + throws EBaseException { mCA = (ICertificateAuthority) owner; mConfig = config; - String processorType = // XXX - need to upgrade 4.2 - config.getString(PROP_PROCESSOR, PR_TYPE_CLASSIC); + String processorType = // XXX - need to upgrade 4.2 + config.getString(PROP_PROCESSOR, PR_TYPE_CLASSIC); Debug.trace("selected policy processor = " + processorType); if (processorType.equals(PR_TYPE_CLASSIC)) { @@ -100,32 +96,32 @@ public class CAPolicy implements IPolicy { } Debug.trace("in CAPolicy.apply(requestType=" + - r.getRequestType() + ",requestId=" + - r.getRequestId().toString() + ",requestStatus=" + - r.getRequestStatus().toString() + ")"); + r.getRequestType() + ",requestId=" + + r.getRequestId().toString() + ",requestStatus=" + + r.getRequestStatus().toString() + ")"); - if (isProfileRequest(r)) { - Debug.trace("CAPolicy: Profile-base Request " + - r.getRequestId().toString()); + if (isProfileRequest(r)) { + Debug.trace("CAPolicy: Profile-base Request " + + r.getRequestId().toString()); - CMS.debug("CAPolicy: requestId=" + - r.getRequestId().toString()); + CMS.debug("CAPolicy: requestId=" + + r.getRequestId().toString()); String profileId = r.getExtDataInString("profileId"); - if (profileId == null || profileId.equals("")) { + if (profileId == null || profileId.equals("")) { return PolicyResult.REJECTED; } - IProfileSubsystem ps = (IProfileSubsystem) - CMS.getSubsystem("profile"); + IProfileSubsystem ps = (IProfileSubsystem) + CMS.getSubsystem("profile"); try { - IProfile profile = ps.getProfile(profileId); + IProfile profile = ps.getProfile(profileId); r.setExtData("dbStatus", "NOT_UPDATED"); - profile.populate(r); - profile.validate(r); + profile.populate(r); + profile.validate(r); return PolicyResult.ACCEPTED; } catch (EBaseException e) { CMS.debug("CAPolicy: " + e.toString()); @@ -137,4 +133,3 @@ public class CAPolicy implements IPolicy { } } - diff --git a/pki/base/ca/src/com/netscape/ca/CAService.java b/pki/base/ca/src/com/netscape/ca/CAService.java index 64fd73e4..47e9c114 100644 --- a/pki/base/ca/src/com/netscape/ca/CAService.java +++ b/pki/base/ca/src/com/netscape/ca/CAService.java @@ -17,7 +17,6 @@ // --- END COPYRIGHT BLOCK --- package com.netscape.ca; - import java.io.ByteArrayOutputStream; import java.io.IOException; import java.math.BigInteger; @@ -93,7 +92,6 @@ import com.netscape.cmscore.dbs.CertificateRepository; import com.netscape.cmscore.dbs.RevocationInfo; import com.netscape.cmscore.util.Debug; - /** * Request Service for CertificateAuthority. */ @@ -114,56 +112,55 @@ public class CAService implements ICAService, IService { private Hashtable<String, ICRLIssuingPoint> mCRLIssuingPoints = new Hashtable<String, ICRLIssuingPoint>(); private ILogger mSignedAuditLogger = CMS.getSignedAuditLogger(); - private final static String - LOGGING_SIGNED_AUDIT_PRIVATE_KEY_ARCHIVE_REQUEST = - "LOGGING_SIGNED_AUDIT_PRIVATE_KEY_ARCHIVE_REQUEST_4"; + private final static String LOGGING_SIGNED_AUDIT_PRIVATE_KEY_ARCHIVE_REQUEST = + "LOGGING_SIGNED_AUDIT_PRIVATE_KEY_ARCHIVE_REQUEST_4"; public CAService(ICertificateAuthority ca) { mCA = ca; - // init services. + // init services. mServants.put( - IRequest.ENROLLMENT_REQUEST, - new serviceIssue(this)); + IRequest.ENROLLMENT_REQUEST, + new serviceIssue(this)); mServants.put( - IRequest.RENEWAL_REQUEST, - new serviceRenewal(this)); + IRequest.RENEWAL_REQUEST, + new serviceRenewal(this)); mServants.put( - IRequest.REVOCATION_REQUEST, - new serviceRevoke(this)); + IRequest.REVOCATION_REQUEST, + new serviceRevoke(this)); mServants.put( - IRequest.CMCREVOKE_REQUEST, - new serviceRevoke(this)); + IRequest.CMCREVOKE_REQUEST, + new serviceRevoke(this)); mServants.put( - IRequest.REVOCATION_CHECK_CHALLENGE_REQUEST, - new serviceCheckChallenge(this)); + IRequest.REVOCATION_CHECK_CHALLENGE_REQUEST, + new serviceCheckChallenge(this)); mServants.put( - IRequest.GETCERTS_FOR_CHALLENGE_REQUEST, - new getCertsForChallenge(this)); + IRequest.GETCERTS_FOR_CHALLENGE_REQUEST, + new getCertsForChallenge(this)); mServants.put( - IRequest.UNREVOCATION_REQUEST, - new serviceUnrevoke(this)); + IRequest.UNREVOCATION_REQUEST, + new serviceUnrevoke(this)); mServants.put( - IRequest.GETCACHAIN_REQUEST, - new serviceGetCAChain(this)); + IRequest.GETCACHAIN_REQUEST, + new serviceGetCAChain(this)); mServants.put( - IRequest.GETCRL_REQUEST, - new serviceGetCRL(this)); + IRequest.GETCRL_REQUEST, + new serviceGetCRL(this)); mServants.put( - IRequest.GETREVOCATIONINFO_REQUEST, - new serviceGetRevocationInfo(this)); + IRequest.GETREVOCATIONINFO_REQUEST, + new serviceGetRevocationInfo(this)); mServants.put( - IRequest.GETCERTS_REQUEST, - new serviceGetCertificates(this)); + IRequest.GETCERTS_REQUEST, + new serviceGetCertificates(this)); mServants.put( - IRequest.CLA_CERT4CRL_REQUEST, - new serviceCert4Crl(this)); + IRequest.CLA_CERT4CRL_REQUEST, + new serviceCert4Crl(this)); mServants.put( - IRequest.CLA_UNCERT4CRL_REQUEST, - new serviceUnCert4Crl(this)); + IRequest.CLA_UNCERT4CRL_REQUEST, + new serviceUnCert4Crl(this)); mServants.put( - IRequest.GETCERT_STATUS_REQUEST, - new getCertStatus(this)); + IRequest.GETCERT_STATUS_REQUEST, + new getCertStatus(this)); } public void init(IConfigStore config) throws EBaseException { @@ -171,20 +168,22 @@ public class CAService implements ICAService, IService { try { // MOVED TO com.netscape.certsrv.apps.CMS - // java.security.Security.addProvider(new netscape.security.provider.CMS()); - // java.security.Provider pr = java.security.Security.getProvider("CMS"); - // if (pr != null) { - // ; - // } - // else - // Debug.trace("Something is wrong in CMS install !"); + // java.security.Security.addProvider(new + // netscape.security.provider.CMS()); + // java.security.Provider pr = + // java.security.Security.getProvider("CMS"); + // if (pr != null) { + // ; + // } + // else + // Debug.trace("Something is wrong in CMS install !"); java.security.cert.CertificateFactory cf = java.security.cert.CertificateFactory.getInstance("X.509"); Debug.trace("CertificateFactory Type : " + cf.getType()); Debug.trace("CertificateFactory Provider : " + cf.getProvider().getInfo()); } catch (java.security.cert.CertificateException e) { Debug.trace("Something is happen in install CMS provider !" + e.toString()); - } + } } public void startup() throws EBaseException { @@ -229,8 +228,8 @@ public class CAService implements ICAService, IService { mKRAConnector = c; } - public IConnector getConnector(IConfigStore config) - throws EBaseException { + public IConnector getConnector(IConfigStore config) + throws EBaseException { IConnector connector = null; if (config == null || config.size() <= 0) { @@ -279,25 +278,25 @@ public class CAService implements ICAService, IService { int timeout = config.getInteger("timeout", 0); // Insert end // Changed by beomsuk - //RemoteAuthority remauthority = - // new RemoteAuthority(host, port, uri); + // RemoteAuthority remauthority = + // new RemoteAuthority(host, port, uri); RemoteAuthority remauthority = - new RemoteAuthority(host, port, uri, timeout); + new RemoteAuthority(host, port, uri, timeout); - // Change end - if (nickname == null) + // Change end + if (nickname == null) nickname = mCA.getNickname(); - // Changed by beomsuk - //connector = - // new HttpConnector(mCA, nickname, remauthority, resendInterval); + // Changed by beomsuk + // connector = + // new HttpConnector(mCA, nickname, remauthority, resendInterval); if (timeout == 0) connector = new HttpConnector((IAuthority) mCA, nickname, remauthority, resendInterval, config); else connector = new HttpConnector((IAuthority) mCA, nickname, remauthority, resendInterval, config, timeout); - // Change end + // Change end - // log(ILogger.LL_INFO, "remote authority "+ - // host+":"+port+" "+uri+" inited"); + // log(ILogger.LL_INFO, "remote authority "+ + // host+":"+port+" "+uri+" inited"); } return connector; } @@ -312,13 +311,13 @@ public class CAService implements ICAService, IService { } /** - * After population of defaults, and constraint validation, - * the profile request is processed here. + * After population of defaults, and constraint validation, the profile + * request is processed here. */ - public void serviceProfileRequest(IRequest request) - throws EBaseException { - CMS.debug("CAService: serviceProfileRequest requestId=" + - request.getRequestId().toString()); + public void serviceProfileRequest(IRequest request) + throws EBaseException { + CMS.debug("CAService: serviceProfileRequest requestId=" + + request.getRequestId().toString()); String profileId = request.getExtDataInString("profileId"); @@ -327,7 +326,7 @@ public class CAService implements ICAService, IService { } IProfileSubsystem ps = (IProfileSubsystem) - CMS.getSubsystem("profile"); + CMS.getSubsystem("profile"); IProfile profile = null; try { @@ -341,25 +340,26 @@ public class CAService implements ICAService, IService { // assumed rejected request.setExtData("dbStatus", "NOT_UPDATED"); - // profile.populate(request); + // profile.populate(request); profile.validate(request); profile.execute(request); // This function is called only from ConnectorServlet - // serialize to request queue + // serialize to request queue } /** - * method interface for IService + * method interface for IService * <P> - * + * * <ul> * <li>signed.audit LOGGING_SIGNED_AUDIT_PRIVATE_KEY_ARCHIVE_REQUEST used - * whenever a user private key archive request is made. This is an option - * in a cert enrollment request detected by an RA or a CA, so, if selected, - * it should be logged immediately following the certificate request. + * whenever a user private key archive request is made. This is an option in + * a cert enrollment request detected by an RA or a CA, so, if selected, it + * should be logged immediately following the certificate request. * </ul> + * * @param request a certificate enrollment request from an RA or CA * @return true or false */ @@ -417,7 +417,7 @@ public class CAService implements ICAService, IService { mCA.log(ILogger.LL_FAILURE, CMS.getLogMessage("CMSCORE_CA_INVALID_REQUEST_TYPE", type)); request.setExtData(IRequest.RESULT, IRequest.RES_ERROR); request.setExtData(IRequest.ERROR, - new ECAException(CMS.getUserMessage("CMS_CA_UNRECOGNIZED_REQUEST_TYPE", type))); + new ECAException(CMS.getUserMessage("CMS_CA_UNRECOGNIZED_REQUEST_TYPE", type))); // store a message in the signed audit log file auditMessage = CMS.getLogMessage( LOGGING_SIGNED_AUDIT_PRIVATE_KEY_ARCHIVE_REQUEST, @@ -433,8 +433,8 @@ public class CAService implements ICAService, IService { try { // send request to KRA first - if (type.equals(IRequest.ENROLLMENT_REQUEST) && - isPKIArchiveOptionPresent(request) && mKRAConnector != null) { + if (type.equals(IRequest.ENROLLMENT_REQUEST) && + isPKIArchiveOptionPresent(request) && mKRAConnector != null) { if (Debug.ON) { Debug.trace("*** Sending enrollment request to KRA"); } @@ -443,9 +443,9 @@ public class CAService implements ICAService, IService { if (mArchivalRequired == true) { if (sendStatus == false) { request.setExtData(IRequest.RESULT, - IRequest.RES_ERROR); + IRequest.RES_ERROR); request.setExtData(IRequest.ERROR, - new ECAException(CMS.getUserMessage("CMS_CA_SEND_KRA_REQUEST"))); + new ECAException(CMS.getUserMessage("CMS_CA_SEND_KRA_REQUEST"))); // store a message in the signed audit log file auditMessage = CMS.getLogMessage( @@ -508,8 +508,7 @@ public class CAService implements ICAService, IService { Debug.trace("serviceRequest completed = " + completed); if (!(type.equals(IRequest.REVOCATION_REQUEST) || - type.equals(IRequest.UNREVOCATION_REQUEST) || - type.equals(IRequest.CMCREVOKE_REQUEST))) { + type.equals(IRequest.UNREVOCATION_REQUEST) || type.equals(IRequest.CMCREVOKE_REQUEST))) { // store a message in the signed audit log file auditMessage = CMS.getLogMessage( LOGGING_SIGNED_AUDIT_PRIVATE_KEY_ARCHIVE_REQUEST, @@ -525,7 +524,7 @@ public class CAService implements ICAService, IService { } /** - * register CRL Issuing Point + * register CRL Issuing Point */ public void addCRLIssuingPoint(String id, ICRLIssuingPoint crlIssuingPoint) { mCRLIssuingPoints.put(id, crlIssuingPoint); @@ -563,12 +562,12 @@ public class CAService implements ICAService, IService { return false; } - /// - /// CA related routines. - /// + // / + // / CA related routines. + // / public X509CertImpl issueX509Cert(X509CertInfo certi) - throws EBaseException { + throws EBaseException { return issueX509Cert(certi, null, null); } @@ -576,7 +575,7 @@ public class CAService implements ICAService, IService { * issue cert for enrollment. */ public X509CertImpl issueX509Cert(X509CertInfo certi, String profileId, String rid) - throws EBaseException { + throws EBaseException { CMS.debug("issueX509Cert"); X509CertImpl certImpl = issueX509Cert("", certi, false, null); @@ -587,7 +586,7 @@ public class CAService implements ICAService, IService { } X509CertImpl issueX509Cert(String rid, X509CertInfo certi) - throws EBaseException { + throws EBaseException { return issueX509Cert(rid, certi, false, null); } @@ -595,7 +594,7 @@ public class CAService implements ICAService, IService { * issue cert for enrollment. */ void storeX509Cert(String profileId, String rid, X509CertImpl cert) - throws EBaseException { + throws EBaseException { storeX509Cert(rid, cert, false, null, null, null, profileId); } @@ -603,28 +602,27 @@ public class CAService implements ICAService, IService { * issue cert for enrollment. */ void storeX509Cert(String rid, X509CertImpl cert, String crmfReqId) - throws EBaseException { + throws EBaseException { storeX509Cert(rid, cert, false, null, crmfReqId, null, null); } - void storeX509Cert(String rid, X509CertImpl cert, String crmfReqId, - String challengePassword) throws EBaseException { + void storeX509Cert(String rid, X509CertImpl cert, String crmfReqId, + String challengePassword) throws EBaseException { storeX509Cert(rid, cert, false, null, crmfReqId, challengePassword, null); } /** - * issue cert for enrollment and renewal. - * renewal is expected to have original cert serial no. in cert info - * field. + * issue cert for enrollment and renewal. renewal is expected to have + * original cert serial no. in cert info field. */ - X509CertImpl issueX509Cert(String rid, X509CertInfo certi, - boolean renewal, BigInteger oldSerialNo) - throws EBaseException { + X509CertImpl issueX509Cert(String rid, X509CertInfo certi, + boolean renewal, BigInteger oldSerialNo) + throws EBaseException { String algname = null; X509CertImpl cert = null; - // NOTE: In this implementation, the "oldSerialNo" - // parameter is NOT used! + // NOTE: In this implementation, the "oldSerialNo" + // parameter is NOT used! boolean doUTF8 = mConfig.getBoolean("dnUTF8Encoding", false); @@ -633,10 +631,10 @@ public class CAService implements ICAService, IService { try { // check required fields in certinfo. if (certi.get(X509CertInfo.SUBJECT) == null || - certi.get(X509CertInfo.KEY) == null) { + certi.get(X509CertInfo.KEY) == null) { mCA.log(ILogger.LL_FAILURE, CMS.getLogMessage("CMSCORE_CA_MISSING_ATTR")); - // XXX how do you reject a request in the service object ? + // XXX how do you reject a request in the service object ? throw new ECAException( CMS.getUserMessage("CMS_CA_MISSING_REQD_FIELDS_IN_CERTISSUE")); } @@ -648,10 +646,10 @@ public class CAService implements ICAService, IService { } // set default validity if not set. - // validity would normally be set by policies or by - // agent or by authentication module. + // validity would normally be set by policies or by + // agent or by authentication module. CertificateValidity validity = (CertificateValidity) - certi.get(X509CertInfo.VALIDITY); + certi.get(X509CertInfo.VALIDITY); Date begin = null, end = null; if (validity != null) { @@ -660,22 +658,21 @@ public class CAService implements ICAService, IService { end = (Date) validity.get(CertificateValidity.NOT_AFTER); } - if (validity == null || - (begin.getTime() == 0 && end.getTime() == 0)) { + if (validity == null || + (begin.getTime() == 0 && end.getTime() == 0)) { if (Debug.ON) { Debug.trace("setting default validity"); } - + begin = CMS.getCurrentDate(); end = new Date(begin.getTime() + mCA.getDefaultValidity()); - certi.set(CertificateValidity.NAME, - new CertificateValidity(begin, end)); + certi.set(CertificateValidity.NAME, + new CertificateValidity(begin, end)); } /* - * For non-CA certs, check if validity exceeds CA time. - * If so, set to CA's not after if default validity - * exceeds ca's not after. + * For non-CA certs, check if validity exceeds CA time. If so, set + * to CA's not after if default validity exceeds ca's not after. */ // First find out if it is a CA cert @@ -685,7 +682,7 @@ public class CAService implements ICAService, IService { try { exts = (CertificateExtensions) - certi.get(X509CertInfo.EXTENSIONS); + certi.get(X509CertInfo.EXTENSIONS); if (exts != null) { Enumeration<Extension> e = exts.getAttributes(); @@ -697,7 +694,7 @@ public class CAService implements ICAService, IService { } } - if(bc_ext != null) { + if (bc_ext != null) { Boolean isCA = (Boolean) bc_ext.get(BasicConstraintsExtension.IS_CA); is_ca = isCA.booleanValue(); } @@ -706,8 +703,8 @@ public class CAService implements ICAService, IService { CMS.debug("EnrollDefault: getExtension " + e.toString()); } - Date caNotAfter = - mCA.getSigningUnit().getCertImpl().getNotAfter(); + Date caNotAfter = + mCA.getSigningUnit().getCertImpl().getNotAfter(); if (begin.after(caNotAfter)) { mCA.log(ILogger.LL_FAILURE, CMS.getLogMessage("CMSCORE_CA_PAST_VALIDITY")); @@ -715,31 +712,31 @@ public class CAService implements ICAService, IService { } if (end.after(caNotAfter)) { - if(!is_ca) { + if (!is_ca) { if (!mCA.isEnablePastCATime()) { end = caNotAfter; - certi.set(CertificateValidity.NAME, - new CertificateValidity(begin, caNotAfter)); + certi.set(CertificateValidity.NAME, + new CertificateValidity(begin, caNotAfter)); CMS.debug("CAService: issueX509Cert: cert past CA's NOT_AFTER...ca.enablePastCATime != true...resetting"); } else { CMS.debug("CAService: issueX509Cert: cert past CA's NOT_AFTER...ca.enablePastCATime = true...not resetting"); } } else { CMS.debug("CAService: issueX509Cert: CA cert issuance past CA's NOT_AFTER."); - } //!is_ca + } // !is_ca mCA.log(ILogger.LL_INFO, CMS.getLogMessage("CMSCORE_CA_PAST_NOT_AFTER")); } // check algorithm in certinfo. AlgorithmId algid = null; CertificateAlgorithmId algor = (CertificateAlgorithmId) - certi.get(X509CertInfo.ALGORITHM_ID); + certi.get(X509CertInfo.ALGORITHM_ID); if (algor == null || algor.toString().equals(CertInfo.SERIALIZE_ALGOR.toString())) { algname = mCA.getSigningUnit().getDefaultAlgorithm(); algid = AlgorithmId.get(algname); - certi.set(X509CertInfo.ALGORITHM_ID, - new CertificateAlgorithmId(algid)); + certi.set(X509CertInfo.ALGORITHM_ID, + new CertificateAlgorithmId(algid)); } else { algid = (AlgorithmId) algor.get(CertificateAlgorithmId.ALGORITHM); @@ -772,7 +769,7 @@ public class CAService implements ICAService, IService { if (renewal) { try { CertificateSerialNumber serialno = (CertificateSerialNumber) - certi.get(X509CertInfo.SERIAL_NUMBER); + certi.get(X509CertInfo.SERIAL_NUMBER); if (serialno == null) { mCA.log(ILogger.LL_FAILURE, CMS.getLogMessage("CMSCORE_CA_NULL_SERIAL_NUMBER")); @@ -780,7 +777,7 @@ public class CAService implements ICAService, IService { CMS.getUserMessage("CMS_CA_MISSING_INFO_IN_RENEWREQ")); } SerialNumber serialnum = (SerialNumber) - serialno.get(CertificateSerialNumber.NUMBER); + serialno.get(CertificateSerialNumber.NUMBER); if (serialnum == null) { mCA.log(ILogger.LL_FAILURE, CMS.getLogMessage("CMSCORE_CA_NULL_SERIAL_NUMBER")); @@ -788,12 +785,12 @@ public class CAService implements ICAService, IService { CMS.getUserMessage("CMS_CA_MISSING_INFO_IN_RENEWREQ")); } } catch (CertificateException e) { - // not possible + // not possible mCA.log(ILogger.LL_FAILURE, CMS.getLogMessage("CMSCORE_CA_NO_ORG_SERIAL", e.getMessage())); throw new ECAException( CMS.getUserMessage("CMS_CA_MISSING_INFO_IN_RENEWREQ")); } catch (IOException e) { - // not possible. + // not possible. mCA.log(ILogger.LL_FAILURE, CMS.getLogMessage("CMSCORE_CA_NO_ORG_SERIAL", e.getMessage())); throw new ECAException( CMS.getUserMessage("CMS_CA_MISSING_INFO_IN_RENEWREQ")); @@ -802,11 +799,11 @@ public class CAService implements ICAService, IService { // set issuer, serial number try { - BigInteger serialNo = - mCA.getCertificateRepository().getNextSerialNumber(); + BigInteger serialNo = + mCA.getCertificateRepository().getNextSerialNumber(); certi.set(X509CertInfo.SERIAL_NUMBER, - new CertificateSerialNumber(serialNo)); + new CertificateSerialNumber(serialNo)); mCA.log(ILogger.LL_INFO, CMS.getLogMessage("CMSCORE_CA_SIGN_SERIAL", serialNo.toString(16))); } catch (EBaseException e) { mCA.log(ILogger.LL_FAILURE, CMS.getLogMessage("CMSCORE_CA_NO_NEXT_SERIAL", e.toString())); @@ -822,8 +819,8 @@ public class CAService implements ICAService, IService { } try { - certi.set(X509CertInfo.ISSUER, - new CertificateIssuerName(mCA.getX500Name())); + certi.set(X509CertInfo.ISSUER, + new CertificateIssuerName(mCA.getX500Name())); } catch (CertificateException e) { mCA.log(ILogger.LL_FAILURE, CMS.getLogMessage("CMSCORE_CA_SET_ISSUER", e.toString())); throw new ECAException(CMS.getUserMessage("CMS_CA_SET_ISSUER_FAILED", rid)); @@ -844,7 +841,7 @@ public class CAService implements ICAService, IService { certi.set(X509CertInfo.SUBJECT, new CertificateSubjectName( new X500Name(subject, - new LdapV3DNStrConverter(X500NameAttrMap.getDirDefault(), true), utf8_encodingOrder))); + new LdapV3DNStrConverter(X500NameAttrMap.getDirDefault(), true), utf8_encodingOrder))); } catch (CertificateException e) { mCA.log(ILogger.LL_FAILURE, CMS.getLogMessage("CMSCORE_CA_SET_SUBJECT", e.toString())); @@ -860,22 +857,22 @@ public class CAService implements ICAService, IService { return cert; } - void storeX509Cert(String rid, X509CertImpl cert, - boolean renewal, BigInteger oldSerialNo) - throws EBaseException { + void storeX509Cert(String rid, X509CertImpl cert, + boolean renewal, BigInteger oldSerialNo) + throws EBaseException { storeX509Cert(rid, cert, renewal, oldSerialNo, null, null, null); } - void storeX509Cert(String rid, X509CertImpl cert, - boolean renewal, BigInteger oldSerialNo, String crmfReqId, - String challengePassword, String profileId) throws EBaseException { + void storeX509Cert(String rid, X509CertImpl cert, + boolean renewal, BigInteger oldSerialNo, String crmfReqId, + String challengePassword, String profileId) throws EBaseException { // now store in repository. - // if renewal, set the old serial number in the new cert, - // set the new serial number in the old cert. + // if renewal, set the old serial number in the new cert, + // set the new serial number in the old cert. CMS.debug("In storeX509Cert"); try { - BigInteger newSerialNo = cert.getSerialNumber(); + BigInteger newSerialNo = cert.getSerialNumber(); MetaInfo metaInfo = new MetaInfo(); if (profileId != null) @@ -885,34 +882,34 @@ public class CAService implements ICAService, IService { if (challengePassword != null && !challengePassword.equals("")) metaInfo.set("challengePhrase", challengePassword); if (crmfReqId != null) { - //System.out.println("Adding crmf reqid "+crmfReqId); + // System.out.println("Adding crmf reqid "+crmfReqId); metaInfo.set(CertRecord.META_CRMF_REQID, crmfReqId); } if (renewal) metaInfo.set(CertRecord.META_OLD_CERT, oldSerialNo.toString()); mCA.getCertificateRepository().addCertificateRecord( - new CertRecord(newSerialNo, cert, metaInfo)); + new CertRecord(newSerialNo, cert, metaInfo)); mCA.log(ILogger.LL_INFO, CMS.getLogMessage("CMSCORE_CA_STORE_SERIAL", cert.getSerialNumber().toString(16))); if (renewal) { /* - mCA.getCertificateRepository().markCertificateAsRenewed( - BigIntegerMapper.BigIntegerToDB(oldSerialNo)); - mCA.mCertRepot.markCertificateAsRenewed(oldSerialNo); + * mCA.getCertificateRepository().markCertificateAsRenewed( + * BigIntegerMapper.BigIntegerToDB(oldSerialNo)); + * mCA.mCertRepot.markCertificateAsRenewed(oldSerialNo); */ MetaInfo oldMeta = null; CertRecord oldCertRec = (CertRecord) - mCA.getCertificateRepository().readCertificateRecord(oldSerialNo); + mCA.getCertificateRepository().readCertificateRecord(oldSerialNo); if (oldCertRec == null) { - Exception e = - new EBaseException(CMS.getUserMessage("CMS_BASE_INTERNAL_ERROR", - "Cannot read cert record for " + oldSerialNo)); + Exception e = + new EBaseException(CMS.getUserMessage("CMS_BASE_INTERNAL_ERROR", + "Cannot read cert record for " + oldSerialNo)); e.printStackTrace(); } - if (oldCertRec != null) + if (oldCertRec != null) oldMeta = oldCertRec.getMetaInfo(); if (oldMeta == null) { if (Debug.ON) { @@ -928,24 +925,24 @@ public class CAService implements ICAService, IService { String name = (String) n.nextElement(); System.out.println("name " + name + " value " + - oldMeta.get(name)); + oldMeta.get(name)); } } } - oldMeta.set(CertRecord.META_RENEWED_CERT, - newSerialNo.toString()); + oldMeta.set(CertRecord.META_RENEWED_CERT, + newSerialNo.toString()); ModificationSet modSet = new ModificationSet(); - modSet.add(CertRecord.ATTR_AUTO_RENEW, - Modification.MOD_REPLACE, - CertRecord.AUTO_RENEWAL_DONE); - modSet.add(ICertRecord.ATTR_META_INFO, - Modification.MOD_REPLACE, oldMeta); + modSet.add(CertRecord.ATTR_AUTO_RENEW, + Modification.MOD_REPLACE, + CertRecord.AUTO_RENEWAL_DONE); + modSet.add(ICertRecord.ATTR_META_INFO, + Modification.MOD_REPLACE, oldMeta); mCA.getCertificateRepository().modifyCertificateRecord(oldSerialNo, modSet); mCA.log(ILogger.LL_INFO, CMS.getLogMessage("CMSCORE_CA_MARK_SERIAL", oldSerialNo.toString(16), newSerialNo.toString(16))); if (Debug.ON) { CertRecord check = (CertRecord) - mCA.getCertificateRepository().readCertificateRecord(oldSerialNo); + mCA.getCertificateRepository().readCertificateRecord(oldSerialNo); MetaInfo meta = check.getMetaInfo(); Enumeration<String> n = oldMeta.getElements(); @@ -968,12 +965,12 @@ public class CAService implements ICAService, IService { * revoke cert, check fields in crlentry, etc. */ public void revokeCert(RevokedCertImpl crlentry) - throws EBaseException { + throws EBaseException { revokeCert(crlentry, null); } public void revokeCert(RevokedCertImpl crlentry, String requestId) - throws EBaseException { + throws EBaseException { BigInteger serialno = crlentry.getSerialNumber(); Date revdate = crlentry.getRevocationDate(); CRLExtensions crlentryexts = crlentry.getExtensions(); @@ -983,8 +980,8 @@ public class CAService implements ICAService, IService { if (certRec == null) { mCA.log(ILogger.LL_FAILURE, CMS.getLogMessage("CMSCORE_CA_CERT_NOT_FOUND", serialno.toString(16))); throw new ECAException( - CMS.getUserMessage("CMS_CA_CANT_FIND_CERT_SERIAL", - "0x" + serialno.toString(16))); + CMS.getUserMessage("CMS_CA_CANT_FIND_CERT_SERIAL", + "0x" + serialno.toString(16))); } RevocationInfo revInfo = (RevocationInfo) certRec.getRevocationInfo(); CRLExtensions exts = null; @@ -1004,13 +1001,13 @@ public class CAService implements ICAService, IService { String certStatus = certRec.getStatus(); if (certStatus.equals(ICertRecord.STATUS_REVOKED) || - certStatus.equals(ICertRecord.STATUS_REVOKED_EXPIRED)) { - throw new ECAException(CMS.getUserMessage("CMS_CA_CERT_ALREADY_REVOKED", + certStatus.equals(ICertRecord.STATUS_REVOKED_EXPIRED)) { + throw new ECAException(CMS.getUserMessage("CMS_CA_CERT_ALREADY_REVOKED", "0x" + Long.toHexString(serialno.longValue()))); } try { - mCA.getCertificateRepository().markAsRevoked(serialno, - new RevocationInfo(revdate, crlentryexts)); + mCA.getCertificateRepository().markAsRevoked(serialno, + new RevocationInfo(revdate, crlentryexts)); mCA.log(ILogger.LL_INFO, CMS.getLogMessage("CMSCORE_CA_CERT_REVOKED", serialno.toString(16))); // inform all CRLIssuingPoints about revoked certificate @@ -1025,23 +1022,25 @@ public class CAService implements ICAService, IService { if (ip.isCACertsOnly()) { X509CertImpl cert = certRec.getCertificate(); - if (cert != null) b = cert.getBasicConstraintsIsCA(); + if (cert != null) + b = cert.getBasicConstraintsIsCA(); } if (ip.isProfileCertsOnly()) { MetaInfo metaInfo = certRec.getMetaInfo(); if (metaInfo != null) { - String profileId = (String)metaInfo.get("profileId"); + String profileId = (String) metaInfo.get("profileId"); if (profileId != null) { b = ip.checkCurrentProfile(profileId); } } } - if (b) ip.addRevokedCert(serialno, crlentry, requestId); + if (b) + ip.addRevokedCert(serialno, crlentry, requestId); } } } catch (EBaseException e) { mCA.log(ILogger.LL_FAILURE, CMS.getLogMessage("CMSCORE_CA_ERROR_REVOCATION", serialno.toString(), e.toString())); - //e.printStackTrace(); + // e.printStackTrace(); throw e; } return; @@ -1051,19 +1050,19 @@ public class CAService implements ICAService, IService { * unrevoke cert, check serial number, etc. */ void unrevokeCert(BigInteger serialNo) - throws EBaseException { + throws EBaseException { unrevokeCert(serialNo, null); } void unrevokeCert(BigInteger serialNo, String requestId) - throws EBaseException { + throws EBaseException { CertRecord certRec = (CertRecord) mCA.getCertificateRepository().readCertificateRecord(serialNo); if (certRec == null) { mCA.log(ILogger.LL_FAILURE, CMS.getLogMessage("CMSCORE_CA_CERT_NOT_FOUND", serialNo.toString(16))); throw new ECAException( - CMS.getUserMessage("CMS_CA_CANT_FIND_CERT_SERIAL", - "0x" + serialNo.toString(16))); + CMS.getUserMessage("CMS_CA_CANT_FIND_CERT_SERIAL", + "0x" + serialNo.toString(16))); } RevocationInfo revInfo = (RevocationInfo) certRec.getRevocationInfo(); CRLExtensions exts = null; @@ -1071,7 +1070,7 @@ public class CAService implements ICAService, IService { if (revInfo == null) { mCA.log(ILogger.LL_FAILURE, CMS.getLogMessage("CMSCORE_CA_CERT_ON_HOLD", serialNo.toString())); - throw new ECAException(CMS.getUserMessage("CMS_CA_IS_NOT_ON_HOLD", + throw new ECAException(CMS.getUserMessage("CMS_CA_IS_NOT_ON_HOLD", serialNo.toString())); } exts = revInfo.getCRLEntryExtensions(); @@ -1080,23 +1079,23 @@ public class CAService implements ICAService, IService { reasonext = (CRLReasonExtension) exts.get(CRLReasonExtension.class.getSimpleName()); } catch (X509ExtensionException e) { - mCA.log(ILogger.LL_FAILURE, CMS.getLogMessage("CMSCORE_CA_CERT_ON_HOLD", serialNo.toString())); - throw new ECAException(CMS.getUserMessage("CMS_CA_IS_NOT_ON_HOLD", + mCA.log(ILogger.LL_FAILURE, CMS.getLogMessage("CMSCORE_CA_CERT_ON_HOLD", serialNo.toString())); + throw new ECAException(CMS.getUserMessage("CMS_CA_IS_NOT_ON_HOLD", serialNo.toString())); } } else { - mCA.log(ILogger.LL_FAILURE, CMS.getLogMessage("CMSCORE_CA_CERT_ON_HOLD", serialNo.toString())); - throw new ECAException(CMS.getUserMessage("CMS_CA_IS_NOT_ON_HOLD", + mCA.log(ILogger.LL_FAILURE, CMS.getLogMessage("CMSCORE_CA_CERT_ON_HOLD", serialNo.toString())); + throw new ECAException(CMS.getUserMessage("CMS_CA_IS_NOT_ON_HOLD", serialNo.toString())); } // allow unrevoking certs that are on hold. if ((certRec.getStatus().equals(ICertRecord.STATUS_REVOKED) || certRec.getStatus().equals(ICertRecord.STATUS_REVOKED_EXPIRED)) && - reasonext != null && - reasonext.getReason() == RevocationReason.CERTIFICATE_HOLD) { + reasonext != null && + reasonext.getReason() == RevocationReason.CERTIFICATE_HOLD) { try { mCA.getCertificateRepository().unmarkRevoked(serialNo, revInfo, - certRec.getRevokedOn(), certRec.getRevokedBy()); + certRec.getRevokedOn(), certRec.getRevokedBy()); mCA.log(ILogger.LL_INFO, CMS.getLogMessage("CMSCORE_CA_CERT_UNREVOKED", serialNo.toString(16))); // inform all CRLIssuingPoints about unrevoked certificate Enumeration<ICRLIssuingPoint> eIPs = mCRLIssuingPoints.elements(); @@ -1110,18 +1109,20 @@ public class CAService implements ICAService, IService { if (ip.isCACertsOnly()) { X509CertImpl cert = certRec.getCertificate(); - if (cert != null) b = cert.getBasicConstraintsIsCA(); + if (cert != null) + b = cert.getBasicConstraintsIsCA(); } if (ip.isProfileCertsOnly()) { MetaInfo metaInfo = certRec.getMetaInfo(); if (metaInfo != null) { - String profileId = (String)metaInfo.get("profileId"); + String profileId = (String) metaInfo.get("profileId"); if (profileId != null) { b = ip.checkCurrentProfile(profileId); } } } - if (b) ip.addUnrevokedCert(serialNo, requestId); + if (b) + ip.addUnrevokedCert(serialNo, requestId); } } } catch (EBaseException e) { @@ -1129,8 +1130,8 @@ public class CAService implements ICAService, IService { throw e; } } else { - mCA.log(ILogger.LL_FAILURE, CMS.getLogMessage("CMSCORE_CA_CERT_ON_HOLD", serialNo.toString())); - throw new ECAException(CMS.getUserMessage("CMS_CA_IS_NOT_ON_HOLD", + mCA.log(ILogger.LL_FAILURE, CMS.getLogMessage("CMSCORE_CA_CERT_ON_HOLD", serialNo.toString())); + throw new ECAException(CMS.getUserMessage("CMS_CA_IS_NOT_ON_HOLD", "0x" + serialNo.toString(16))); } @@ -1139,10 +1140,10 @@ public class CAService implements ICAService, IService { /** * Signed Audit Log - * + * * This method is called to store messages to the signed audit log. * <P> - * + * * @param msg signed audit log message */ private void audit(String msg) { @@ -1154,19 +1155,19 @@ public class CAService implements ICAService, IService { } mSignedAuditLogger.log(ILogger.EV_SIGNED_AUDIT, - null, - ILogger.S_SIGNED_AUDIT, - ILogger.LL_SECURITY, - msg); + null, + ILogger.S_SIGNED_AUDIT, + ILogger.LL_SECURITY, + msg); } /** * Signed Audit Log Subject ID - * - * This method is called to obtain the "SubjectID" for - * a signed audit log message. + * + * This method is called to obtain the "SubjectID" for a signed audit log + * message. * <P> - * + * * @return id string containing the signed audit log message SubjectID */ private String auditSubjectID() { @@ -1198,11 +1199,11 @@ public class CAService implements ICAService, IService { /** * Signed Audit Log Requester ID - * - * This method is called to obtain the "RequesterID" for - * a signed audit log message. + * + * This method is called to obtain the "RequesterID" for a signed audit log + * message. * <P> - * + * * @return id string containing the signed audit log message RequesterID */ private String auditRequesterID() { @@ -1233,16 +1234,14 @@ public class CAService implements ICAService, IService { } } - -/// -/// servant classes -/// +// / +// / servant classes +// / interface IServant { public boolean service(IRequest request) throws EBaseException; } - class serviceIssue implements IServant { private ICertificateAuthority mCA; private CAService mService; @@ -1253,8 +1252,8 @@ class serviceIssue implements IServant { } public boolean service(IRequest request) - throws EBaseException { - // XXX This is ugly. should associate attributes with + throws EBaseException { + // XXX This is ugly. should associate attributes with // request types, not policy. // XXX how do we know what to look for in request ? @@ -1263,21 +1262,21 @@ class serviceIssue implements IServant { else return false; // Don't know what it is ????? } - + public boolean serviceX509(IRequest request) - throws EBaseException { - // XXX This is ugly. should associate attributes with + throws EBaseException { + // XXX This is ugly. should associate attributes with // request types, not policy. // XXX how do we know what to look for in request ? - X509CertInfo certinfos[] = - request.getExtDataInCertInfoArray(IRequest.CERT_INFO); + X509CertInfo certinfos[] = + request.getExtDataInCertInfoArray(IRequest.CERT_INFO); if (certinfos == null || certinfos[0] == null) { mCA.log(ILogger.LL_FAILURE, CMS.getLogMessage("CMSCORE_CA_CERT_REQUEST_NOT_FOUND", request.getRequestId().toString())); throw new ECAException(CMS.getUserMessage("CMS_CA_MISSING_INFO_IN_ISSUEREQ")); } - String challengePassword = - request.getExtDataInString(CAService.CHALLENGE_PHRASE); + String challengePassword = + request.getExtDataInString(CAService.CHALLENGE_PHRASE); X509CertImpl[] certs = new X509CertImpl[certinfos.length]; String rid = request.getRequestId().toString(); @@ -1300,16 +1299,16 @@ class serviceIssue implements IServant { } catch (EBaseException e) { e.printStackTrace(); mCA.log(ILogger.LL_FAILURE, CMS.getLogMessage("CMSCORE_CA_STORE_ERROR", Integer.toString(i), rid, e.toString())); - ex = e; // save to throw later. + ex = e; // save to throw later. break; } } if (ex != null) { for (int j = 0; j < i; j++) { - // delete the stored cert records from the database. - // we issue all or nothing. - BigInteger serialNo = - ((X509Certificate) certs[i]).getSerialNumber(); + // delete the stored cert records from the database. + // we issue all or nothing. + BigInteger serialNo = + ((X509Certificate) certs[i]).getSerialNumber(); try { mCA.getCertificateRepository().deleteCertificateRecord(serialNo); @@ -1326,7 +1325,6 @@ class serviceIssue implements IServant { } } - class serviceRenewal implements IServant { private ICertificateAuthority mCA; private CAService mService; @@ -1337,10 +1335,10 @@ class serviceRenewal implements IServant { } public boolean service(IRequest request) - throws EBaseException { + throws EBaseException { // XXX if one fails should all fail ? - can't backtrack. - X509CertInfo certinfos[] = - request.getExtDataInCertInfoArray(IRequest.CERT_INFO); + X509CertInfo certinfos[] = + request.getExtDataInCertInfoArray(IRequest.CERT_INFO); if (certinfos == null || certinfos[0] == null) { mCA.log(ILogger.LL_FAILURE, CMS.getLogMessage("CMSCORE_CA_CERT_REQUEST_NOT_FOUND", request.getRequestId().toString())); @@ -1364,7 +1362,7 @@ class serviceRenewal implements IServant { try { CertificateSerialNumber serialno = (CertificateSerialNumber) - certinfos[i].get(X509CertInfo.SERIAL_NUMBER); + certinfos[i].get(X509CertInfo.SERIAL_NUMBER); if (serialno == null) { mCA.log(ILogger.LL_FAILURE, CMS.getLogMessage("CMSCORE_CA_NULL_SERIAL_NUMBER")); @@ -1396,25 +1394,25 @@ class serviceRenewal implements IServant { // get cert record CertRecord certRecord = (CertRecord) - mCA.getCertificateRepository().readCertificateRecord(oldSerialNo); + mCA.getCertificateRepository().readCertificateRecord(oldSerialNo); if (certRecord == null) { mCA.log(ILogger.LL_FAILURE, CMS.getLogMessage("CMSCORE_CA_NOT_FROM_CA", oldSerialNo.toString())); svcerrors[i] = new ECAException( - CMS.getUserMessage("CMS_CA_CANT_FIND_CERT_SERIAL", - oldSerialNo.toString())).toString(); + CMS.getUserMessage("CMS_CA_CANT_FIND_CERT_SERIAL", + oldSerialNo.toString())).toString(); continue; } - // check if cert has been revoked. + // check if cert has been revoked. String certStatus = certRecord.getStatus(); - if (certStatus.equals(ICertRecord.STATUS_REVOKED) || - certStatus.equals(ICertRecord.STATUS_REVOKED_EXPIRED)) { + if (certStatus.equals(ICertRecord.STATUS_REVOKED) || + certStatus.equals(ICertRecord.STATUS_REVOKED_EXPIRED)) { mCA.log(ILogger.LL_FAILURE, CMS.getLogMessage("CMSCORE_CA_RENEW_REVOKED", oldSerialNo.toString())); svcerrors[i] = new ECAException( CMS.getUserMessage("CMS_CA_CANNOT_RENEW_REVOKED_CERT", - "0x" + oldSerialNo.toString(16))).toString(); + "0x" + oldSerialNo.toString(16))).toString(); continue; } @@ -1423,49 +1421,50 @@ class serviceRenewal implements IServant { if (metaInfo != null) { String renewed = (String) - metaInfo.get(ICertRecord.META_RENEWED_CERT); + metaInfo.get(ICertRecord.META_RENEWED_CERT); if (renewed != null) { BigInteger serial = new BigInteger(renewed); X509CertImpl cert = (X509CertImpl) - mCA.getCertificateRepository().getX509Certificate(serial); + mCA.getCertificateRepository().getX509Certificate(serial); if (cert == null) { - // something wrong + // something wrong mCA.log(ILogger.LL_FAILURE, CMS.getLogMessage("CMSCORE_CA_MISSING_RENEWED", serial.toString())); svcerrors[i] = new ECAException( CMS.getUserMessage("CMS_CA_ERROR_GETTING_RENEWED_CERT", - oldSerialNo.toString(), serial.toString())).toString(); + oldSerialNo.toString(), serial.toString())).toString(); continue; } // get cert record CertRecord cRecord = (CertRecord) - mCA.getCertificateRepository().readCertificateRecord(serial); + mCA.getCertificateRepository().readCertificateRecord(serial); if (cRecord == null) { mCA.log(ILogger.LL_FAILURE, CMS.getLogMessage("CMSCORE_CA_NOT_FROM_CA", serial.toString())); svcerrors[i] = new ECAException( - CMS.getUserMessage("CMS_CA_CANT_FIND_CERT_SERIAL", - serial.toString())).toString(); + CMS.getUserMessage("CMS_CA_CANT_FIND_CERT_SERIAL", + serial.toString())).toString(); continue; } // Check renewed certificate already REVOKED or EXPIRED String status = cRecord.getStatus(); - if (status.equals(ICertRecord.STATUS_REVOKED) || - status.equals(ICertRecord.STATUS_REVOKED_EXPIRED)) { + if (status.equals(ICertRecord.STATUS_REVOKED) || + status.equals(ICertRecord.STATUS_REVOKED_EXPIRED)) { Debug.trace("It is already revoked or Expired !!!"); - } // it is still new ... So just return this certificate to user - else { + } // it is still new ... So just return this certificate + // to user + else { Debug.trace("It is still new !!!"); issuedCerts[i] = cert; continue; - } + } } } // issue the cert. - issuedCerts[i] = + issuedCerts[i] = mService.issueX509Cert(rid, certinfos[i], true, oldSerialNo); mService.storeX509Cert(rid, issuedCerts[i], true, oldSerialNo); } catch (ECAException e) { @@ -1473,14 +1472,15 @@ class serviceRenewal implements IServant { mCA.log(ILogger.LL_FAILURE, CMS.getLogMessage("CMSCORE_CA_CANNOT_RENEW", Integer.toString(i), request.getRequestId().toString())); } } - + // always set issued certs regardless of error. request.setExtData(IRequest.ISSUED_CERTS, issuedCerts); // set and throw error if any. int l; - for (l = svcerrors.length - 1; l >= 0 && svcerrors[l] == null; l--); + for (l = svcerrors.length - 1; l >= 0 && svcerrors[l] == null; l--) + ; if (l >= 0) { request.setExtData(IRequest.SVCERRORS, svcerrors); mCA.log(ILogger.LL_FAILURE, CMS.getLogMessage("CMSCORE_CA_NO_RENEW", request.getRequestId().toString())); @@ -1490,7 +1490,6 @@ class serviceRenewal implements IServant { } } - class getCertsForChallenge implements IServant { private ICertificateAuthority mCA; private CAService mService; @@ -1501,10 +1500,10 @@ class getCertsForChallenge implements IServant { } public boolean service(IRequest request) - throws EBaseException { + throws EBaseException { BigInteger[] serialNoArray = - request.getExtDataInBigIntegerArray(CAService.SERIALNO_ARRAY); - X509CertImpl[] certs = new X509CertImpl[serialNoArray.length]; + request.getExtDataInBigIntegerArray(CAService.SERIALNO_ARRAY); + X509CertImpl[] certs = new X509CertImpl[serialNoArray.length]; for (int i = 0; i < serialNoArray.length; i++) { certs[i] = mCA.getCertificateRepository().getX509Certificate(serialNoArray[i]); @@ -1514,7 +1513,6 @@ class getCertsForChallenge implements IServant { } } - class getCertStatus implements IServant { private ICertificateAuthority mCA; private CAService mService; @@ -1528,7 +1526,7 @@ class getCertStatus implements IServant { BigInteger serialno = request.getExtDataInBigInteger("serialNumber"); String issuerDN = request.getExtDataInString("issuerDN"); CertificateRepository certDB = (CertificateRepository) - mCA.getCertificateRepository(); + mCA.getCertificateRepository(); String status = null; @@ -1553,13 +1551,12 @@ class getCertStatus implements IServant { } } } - + request.setExtData(IRequest.CERT_STATUS, status); return true; } } - class serviceCheckChallenge implements IServant { private ICertificateAuthority mCA; private CAService mService; @@ -1576,9 +1573,9 @@ class serviceCheckChallenge implements IServant { } public boolean service(IRequest request) - throws EBaseException { - // note: some request attributes used below are set in - // authentication/ChallengePhraseAuthentication.java :( + throws EBaseException { + // note: some request attributes used below are set in + // authentication/ChallengePhraseAuthentication.java :( BigInteger serialno = request.getExtDataInBigInteger("serialNumber"); String pwd = request.getExtDataInString( CAService.CHALLENGE_PHRASE); @@ -1606,7 +1603,7 @@ class serviceCheckChallenge implements IServant { } else { bigIntArray = new BigInteger[0]; } - } else + } else bigIntArray = new BigInteger[0]; } else { String subjectName = request.getExtDataInString("subjectName"); @@ -1623,7 +1620,7 @@ class serviceCheckChallenge implements IServant { Vector<BigInteger> idv = new Vector<BigInteger>(); while (en.hasMoreElements()) { - ICertRecord record = en.nextElement(); + ICertRecord record = en.nextElement(); boolean samepwd = compareChallengePassword(record, pwd); if (samepwd) { @@ -1638,7 +1635,7 @@ class serviceCheckChallenge implements IServant { } } - if (bigIntArray == null) + if (bigIntArray == null) bigIntArray = new BigInteger[0]; request.setExtData(CAService.SERIALNO_ARRAY, bigIntArray); @@ -1646,7 +1643,7 @@ class serviceCheckChallenge implements IServant { } private boolean compareChallengePassword(ICertRecord record, String pwd) - throws EBaseException { + throws EBaseException { MetaInfo metaInfo = (MetaInfo) record.get(CertRecord.ATTR_META_INFO); if (metaInfo == null) { @@ -1657,7 +1654,7 @@ class serviceCheckChallenge implements IServant { // got metaInfo String challengeString = - (String) metaInfo.get(CertRecord.META_CHALLENGE_PHRASE); + (String) metaInfo.get(CertRecord.META_CHALLENGE_PHRASE); if (!challengeString.equals(hashpwd)) { return false; @@ -1674,7 +1671,6 @@ class serviceCheckChallenge implements IServant { } } - class serviceRevoke implements IServant { private ICertificateAuthority mCA; private CAService mService; @@ -1684,24 +1680,24 @@ class serviceRevoke implements IServant { mCA = mService.getCA(); } - public boolean service(IRequest request) - throws EBaseException { + public boolean service(IRequest request) + throws EBaseException { boolean sendStatus = true; // XXX Need to think passing as array. - // XXX every implemented according to servlet. - RevokedCertImpl crlentries[] = - request.getExtDataInRevokedCertArray(IRequest.CERT_INFO); - - if (crlentries == null || - crlentries.length == 0 || - crlentries[0] == null) { - // XXX should this be an error ? + // XXX every implemented according to servlet. + RevokedCertImpl crlentries[] = + request.getExtDataInRevokedCertArray(IRequest.CERT_INFO); + + if (crlentries == null || + crlentries.length == 0 || + crlentries[0] == null) { + // XXX should this be an error ? mCA.log(ILogger.LL_FAILURE, CMS.getLogMessage("CMSCORE_CA_CRL_NOT_FOUND", request.getRequestId().toString())); throw new ECAException(CMS.getUserMessage("CMS_CA_MISSING_INFO_IN_REVREQ")); } - RevokedCertImpl revokedCerts[] = - new RevokedCertImpl[crlentries.length]; + RevokedCertImpl revokedCerts[] = + new RevokedCertImpl[crlentries.length]; String svcerrors[] = null; for (int i = 0; i < crlentries.length; i++) { @@ -1725,7 +1721,7 @@ class serviceRevoke implements IServant { if (CAService.mCLAConnector != null) { CMS.debug(CMS.getLogMessage("CMSCORE_CA_CLONE_READ_REVOKED")); BigInteger revokedCertIds[] = - new BigInteger[revokedCerts.length]; + new BigInteger[revokedCerts.length]; for (int i = 0; i < revokedCerts.length; i++) { revokedCertIds[i] = revokedCerts[i].getSerialNumber(); @@ -1733,16 +1729,16 @@ class serviceRevoke implements IServant { request.deleteExtData(IRequest.CERT_INFO); request.deleteExtData(IRequest.OLD_CERTS); request.setExtData(IRequest.REVOKED_CERT_RECORDS, revokedCertIds); - + CMS.debug(CMS.getLogMessage("CMSCORE_CA_CLONE_READ_REVOKED_CONNECTOR")); request.setRequestType(IRequest.CLA_CERT4CRL_REQUEST); sendStatus = CAService.mCLAConnector.send(request); if (sendStatus == false) { request.setExtData(IRequest.RESULT, - IRequest.RES_ERROR); + IRequest.RES_ERROR); request.setExtData(IRequest.ERROR, - new ECAException(CMS.getUserMessage("CMS_CA_SEND_CLA_REQUEST"))); + new ECAException(CMS.getUserMessage("CMS_CA_SEND_CLA_REQUEST"))); return sendStatus; } else { if (request.getExtDataInString(IRequest.ERROR) != null) { @@ -1768,7 +1764,6 @@ class serviceRevoke implements IServant { } } - class serviceUnrevoke implements IServant { private ICertificateAuthority mCA; private CAService mService; @@ -1778,11 +1773,11 @@ class serviceUnrevoke implements IServant { mCA = mService.getCA(); } - public boolean service(IRequest request) - throws EBaseException { + public boolean service(IRequest request) + throws EBaseException { boolean sendStatus = true; - BigInteger oldSerialNo[] = - request.getExtDataInBigIntegerArray(IRequest.OLD_SERIALS); + BigInteger oldSerialNo[] = + request.getExtDataInBigIntegerArray(IRequest.OLD_SERIALS); if (oldSerialNo == null || oldSerialNo.length < 1) { mCA.log(ILogger.LL_FAILURE, CMS.getLogMessage("CMSCORE_CA_UNREVOKE_MISSING_SERIAL")); @@ -1808,7 +1803,7 @@ class serviceUnrevoke implements IServant { } if (needOldCerts) { CertRecord certRec = (CertRecord) - mCA.getCertificateRepository().readCertificateRecord(oldSerialNo[i]); + mCA.getCertificateRepository().readCertificateRecord(oldSerialNo[i]); oldCerts[i] = certRec.getCertificate(); } @@ -1828,9 +1823,9 @@ class serviceUnrevoke implements IServant { sendStatus = CAService.mCLAConnector.send(request); if (sendStatus == false) { request.setExtData(IRequest.RESULT, - IRequest.RES_ERROR); + IRequest.RES_ERROR); request.setExtData(IRequest.ERROR, - new ECAException(CMS.getUserMessage("CMS_CA_SEND_CLA_REQUEST"))); + new ECAException(CMS.getUserMessage("CMS_CA_SEND_CLA_REQUEST"))); return sendStatus; } else { if (request.getExtDataInString(IRequest.ERROR) != null) { @@ -1854,7 +1849,6 @@ class serviceUnrevoke implements IServant { } } - class serviceGetCAChain implements IServant { private ICertificateAuthority mCA; private CAService mService; @@ -1878,7 +1872,6 @@ class serviceGetCAChain implements IServant { } } - class serviceGetCRL implements IServant { private ICertificateAuthority mCA; private CAService mService; @@ -1889,10 +1882,10 @@ class serviceGetCRL implements IServant { } public boolean service(IRequest request) - throws EBaseException { + throws EBaseException { try { - ICRLIssuingPointRecord crlRec = - (ICRLIssuingPointRecord) mCA.getCRLRepository().readCRLIssuingPointRecord(ICertificateAuthority.PROP_MASTER_CRL); + ICRLIssuingPointRecord crlRec = + (ICRLIssuingPointRecord) mCA.getCRLRepository().readCRLIssuingPointRecord(ICertificateAuthority.PROP_MASTER_CRL); X509CRLImpl crl = new X509CRLImpl(crlRec.getCRL()); request.setExtData(IRequest.CRL, crl.getEncoded()); @@ -1908,13 +1901,12 @@ class serviceGetCRL implements IServant { mCA.log(ILogger.LL_FAILURE, CMS.getLogMessage("CMSCORE_CA_GETCRL_NO_ISSUING_REC")); throw new ECAException( CMS.getUserMessage("CMS_CA_CRL_ISSUEPT_EXT_NOGOOD", - ICertificateAuthority.PROP_MASTER_CRL)); + ICertificateAuthority.PROP_MASTER_CRL)); } return true; } } - class serviceGetRevocationInfo implements IServant { private ICertificateAuthority mCA; private CAService mService; @@ -1925,7 +1917,7 @@ class serviceGetRevocationInfo implements IServant { } public boolean service(IRequest request) - throws EBaseException { + throws EBaseException { Enumeration<String> enum1 = request.getExtDataKeys(); while (enum1.hasMoreElements()) { @@ -1933,11 +1925,11 @@ class serviceGetRevocationInfo implements IServant { if (name.equals(IRequest.ISSUED_CERTS)) { X509CertImpl certsToCheck[] = - request.getExtDataInCertArray(IRequest.ISSUED_CERTS); + request.getExtDataInCertArray(IRequest.ISSUED_CERTS); CertificateRepository certDB = (CertificateRepository) mCA.getCertificateRepository(); - RevocationInfo info = - certDB.isCertificateRevoked(certsToCheck[0]); + RevocationInfo info = + certDB.isCertificateRevoked(certsToCheck[0]); if (info != null) { RevokedCertImpl revokedCerts[] = new RevokedCertImpl[1]; @@ -1955,7 +1947,6 @@ class serviceGetRevocationInfo implements IServant { } } - class serviceGetCertificates implements IServant { private ICertificateAuthority mCA; private CAService mService; @@ -1966,7 +1957,7 @@ class serviceGetCertificates implements IServant { } public boolean service(IRequest request) - throws EBaseException { + throws EBaseException { Enumeration<String> enum1 = request.getExtDataKeys(); while (enum1.hasMoreElements()) { @@ -1987,7 +1978,6 @@ class serviceGetCertificates implements IServant { } } - class serviceCert4Crl implements IServant { private ICertificateAuthority mCA; private CAService mService; @@ -1997,14 +1987,14 @@ class serviceCert4Crl implements IServant { mCA = mService.getCA(); } - public boolean service(IRequest request) - throws EBaseException { + public boolean service(IRequest request) + throws EBaseException { // XXX Need to think passing as array. - // XXX every implemented according to servlet. + // XXX every implemented according to servlet. BigInteger revokedCertIds[] = request.getExtDataInBigIntegerArray( IRequest.REVOKED_CERT_RECORDS); if (revokedCertIds == null || - revokedCertIds.length == 0) { + revokedCertIds.length == 0) { mCA.log(ILogger.LL_FAILURE, CMS.getLogMessage("CMSCORE_CA_CERT4CRL_NO_ENTRY", request.getRequestId().toString())); throw new ECAException(CMS.getUserMessage("CMS_CA_MISSING_INFO_IN_CLAREQ")); } @@ -2013,26 +2003,26 @@ class serviceCert4Crl implements IServant { for (int i = 0; i < revokedCertIds.length; i++) { revokedCertRecs[i] = (CertRecord) mCA.getCertificateRepository().readCertificateRecord( - revokedCertIds[i]); + revokedCertIds[i]); } - if (revokedCertRecs == null || - revokedCertRecs.length == 0 || - revokedCertRecs[0] == null) { - // XXX should this be an error ? + if (revokedCertRecs == null || + revokedCertRecs.length == 0 || + revokedCertRecs[0] == null) { + // XXX should this be an error ? mCA.log(ILogger.LL_FAILURE, CMS.getLogMessage("CMSCORE_CA_CERT4CRL_NO_ENTRY", request.getRequestId().toString())); throw new ECAException(CMS.getUserMessage("CMS_CA_MISSING_INFO_IN_CLAREQ")); } - CertRecord recordedCerts[] = - new CertRecord[revokedCertRecs.length]; + CertRecord recordedCerts[] = + new CertRecord[revokedCertRecs.length]; String svcerrors[] = null; for (int i = 0; i < revokedCertRecs.length; i++) { try { // for CLA, record it into cert repost ((CertificateRepository) mCA.getCertificateRepository()).addRevokedCertRecord(revokedCertRecs[i]); - // mService.revokeCert(crlentries[i]); + // mService.revokeCert(crlentries[i]); recordedCerts[i] = revokedCertRecs[i]; // inform all CRLIssuingPoints about revoked certificate Hashtable<String, ICRLIssuingPoint> hips = mService.getCRLIssuingPoints(); @@ -2041,9 +2031,9 @@ class serviceCert4Crl implements IServant { while (eIPs.hasMoreElements()) { ICRLIssuingPoint ip = (ICRLIssuingPoint) eIPs.nextElement(); // form RevokedCertImpl - RevokedCertImpl rci = - new RevokedCertImpl(revokedCertRecs[i].getSerialNumber(), - revokedCertRecs[i].getRevokedOn()); + RevokedCertImpl rci = + new RevokedCertImpl(revokedCertRecs[i].getSerialNumber(), + revokedCertRecs[i].getRevokedOn()); if (ip != null) { ip.addRevokedCert(revokedCertRecs[i].getSerialNumber(), rci); @@ -2059,8 +2049,8 @@ class serviceCert4Crl implements IServant { svcerrors[i] = e.toString(); } } - //need to record which gets recorded and which failed...cfu - // request.set(IRequest.REVOKED_CERTS, revokedCerts); + // need to record which gets recorded and which failed...cfu + // request.set(IRequest.REVOKED_CERTS, revokedCerts); if (svcerrors != null) { request.setExtData(IRequest.SVCERRORS, svcerrors); throw new ECAException(CMS.getUserMessage("CMS_CA_CERT4CRL_FAILED")); @@ -2070,7 +2060,6 @@ class serviceCert4Crl implements IServant { } } - class serviceUnCert4Crl implements IServant { private ICertificateAuthority mCA; private CAService mService; @@ -2080,10 +2069,10 @@ class serviceUnCert4Crl implements IServant { mCA = mService.getCA(); } - public boolean service(IRequest request) - throws EBaseException { - BigInteger oldSerialNo[] = - request.getExtDataInBigIntegerArray(IRequest.OLD_SERIALS); + public boolean service(IRequest request) + throws EBaseException { + BigInteger oldSerialNo[] = + request.getExtDataInBigIntegerArray(IRequest.OLD_SERIALS); if (oldSerialNo == null || oldSerialNo.length < 1) { mCA.log(ILogger.LL_FAILURE, CMS.getLogMessage("CMSCORE_CA_UNREVOKE_MISSING_SERIAL")); @@ -2125,4 +2114,3 @@ class serviceUnCert4Crl implements IServant { return true; } } - diff --git a/pki/base/ca/src/com/netscape/ca/CMSCRLExtensions.java b/pki/base/ca/src/com/netscape/ca/CMSCRLExtensions.java index 55449dff..e0064ddf 100644 --- a/pki/base/ca/src/com/netscape/ca/CMSCRLExtensions.java +++ b/pki/base/ca/src/com/netscape/ca/CMSCRLExtensions.java @@ -17,7 +17,6 @@ // --- END COPYRIGHT BLOCK --- package com.netscape.ca; - import java.io.IOException; import java.security.cert.CertificateException; import java.util.Enumeration; @@ -56,7 +55,6 @@ import com.netscape.certsrv.logging.ILogger; import com.netscape.cms.crl.CMSIssuingDistributionPointExtension; import com.netscape.cmscore.base.SubsystemRegistry; - public class CMSCRLExtensions implements ICMSCRLExtensions { public static final String PROP_ENABLE = "enable"; public static final String PROP_EXTENSION = "extension"; @@ -65,7 +63,7 @@ public class CMSCRLExtensions implements ICMSCRLExtensions { public static final String PROP_CRITICAL = "critical"; public static final String PROP_CRL_EXT = "CRLExtension"; public static final String PROP_CRL_ENTRY_EXT = "CRLEntryExtension"; - + private ICRLIssuingPoint mCRLIssuingPoint = null; private IConfigStore mConfig = null; @@ -100,91 +98,91 @@ public class CMSCRLExtensions implements ICMSCRLExtensions { /* Default CRL Entry Extensions */ mDefaultCRLEntryExtensionNames.addElement(CRLReasonExtension.class.getSimpleName()); - //mDefaultCRLEntryExtensionNames.addElement(HoldInstructionExtension.NAME); + // mDefaultCRLEntryExtensionNames.addElement(HoldInstructionExtension.NAME); mDefaultCRLEntryExtensionNames.addElement(InvalidityDateExtension.class.getSimpleName()); - //mDefaultCRLEntryExtensionNames.addElement(CertificateIssuerExtension.NAME); + // mDefaultCRLEntryExtensionNames.addElement(CertificateIssuerExtension.NAME); /* Default Enabled CRL Extensions */ mDefaultEnabledCRLExtensions.addElement(CRLNumberExtension.class.getSimpleName()); - //mDefaultEnabledCRLExtensions.addElement(DeltaCRLIndicatorExtension.NAME); + // mDefaultEnabledCRLExtensions.addElement(DeltaCRLIndicatorExtension.NAME); mDefaultEnabledCRLExtensions.addElement(CRLReasonExtension.class.getSimpleName()); mDefaultEnabledCRLExtensions.addElement(InvalidityDateExtension.class.getSimpleName()); /* Default Critical CRL Extensions */ mDefaultCriticalCRLExtensions.addElement(DeltaCRLIndicatorExtension.class.getSimpleName()); mDefaultCriticalCRLExtensions.addElement(IssuingDistributionPointExtension.class.getSimpleName()); - //mDefaultCriticalCRLExtensions.addElement(CertificateIssuerExtension.NAME); + // mDefaultCriticalCRLExtensions.addElement(CertificateIssuerExtension.NAME); /* CRL extension IDs */ mDefaultCRLExtensionIDs.put(PKIXExtensions.AuthorityKey_Id.toString(), - AuthorityKeyIdentifierExtension.class.getSimpleName()); + AuthorityKeyIdentifierExtension.class.getSimpleName()); mDefaultCRLExtensionIDs.put(PKIXExtensions.IssuerAlternativeName_Id.toString(), - IssuerAlternativeNameExtension.class.getSimpleName()); + IssuerAlternativeNameExtension.class.getSimpleName()); mDefaultCRLExtensionIDs.put(PKIXExtensions.CRLNumber_Id.toString(), - CRLNumberExtension.class.getSimpleName()); + CRLNumberExtension.class.getSimpleName()); mDefaultCRLExtensionIDs.put(PKIXExtensions.DeltaCRLIndicator_Id.toString(), - DeltaCRLIndicatorExtension.class.getSimpleName()); + DeltaCRLIndicatorExtension.class.getSimpleName()); mDefaultCRLExtensionIDs.put(PKIXExtensions.IssuingDistributionPoint_Id.toString(), - IssuingDistributionPointExtension.class.getSimpleName()); + IssuingDistributionPointExtension.class.getSimpleName()); mDefaultCRLExtensionIDs.put(PKIXExtensions.ReasonCode_Id.toString(), - CRLReasonExtension.class.getSimpleName()); + CRLReasonExtension.class.getSimpleName()); mDefaultCRLExtensionIDs.put(PKIXExtensions.HoldInstructionCode_Id.toString(), - HoldInstructionExtension.class.getSimpleName()); + HoldInstructionExtension.class.getSimpleName()); mDefaultCRLExtensionIDs.put(PKIXExtensions.InvalidityDate_Id.toString(), - InvalidityDateExtension.class.getSimpleName()); - //mDefaultCRLExtensionIDs.put(PKIXExtensions.CertificateIssuer_Id.toString(), - // CertificateIssuerExtension.NAME); + InvalidityDateExtension.class.getSimpleName()); + // mDefaultCRLExtensionIDs.put(PKIXExtensions.CertificateIssuer_Id.toString(), + // CertificateIssuerExtension.NAME); mDefaultCRLExtensionIDs.put(PKIXExtensions.FreshestCRL_Id.toString(), - FreshestCRLExtension.class.getSimpleName()); + FreshestCRLExtension.class.getSimpleName()); mDefaultCRLExtensionIDs.put(AuthInfoAccessExtension.ID.toString(), - AuthInfoAccessExtension.NAME2); + AuthInfoAccessExtension.NAME2); /* Class names */ mDefaultCRLExtensionClassNames.put(AuthorityKeyIdentifierExtension.class.getSimpleName(), - "com.netscape.cms.crl.CMSAuthorityKeyIdentifierExtension"); + "com.netscape.cms.crl.CMSAuthorityKeyIdentifierExtension"); mDefaultCRLExtensionClassNames.put(IssuerAlternativeNameExtension.class.getSimpleName(), - "com.netscape.cms.crl.CMSIssuerAlternativeNameExtension"); + "com.netscape.cms.crl.CMSIssuerAlternativeNameExtension"); mDefaultCRLExtensionClassNames.put(CRLNumberExtension.class.getSimpleName(), - "com.netscape.cms.crl.CMSCRLNumberExtension"); + "com.netscape.cms.crl.CMSCRLNumberExtension"); mDefaultCRLExtensionClassNames.put(DeltaCRLIndicatorExtension.class.getSimpleName(), - "com.netscape.cms.crl.CMSDeltaCRLIndicatorExtension"); + "com.netscape.cms.crl.CMSDeltaCRLIndicatorExtension"); mDefaultCRLExtensionClassNames.put(IssuingDistributionPointExtension.class.getSimpleName(), - "com.netscape.cms.crl.CMSIssuingDistributionPointExtension"); + "com.netscape.cms.crl.CMSIssuingDistributionPointExtension"); mDefaultCRLExtensionClassNames.put(CRLReasonExtension.class.getSimpleName(), - "com.netscape.cms.crl.CMSCRLReasonExtension"); + "com.netscape.cms.crl.CMSCRLReasonExtension"); mDefaultCRLExtensionClassNames.put(HoldInstructionExtension.class.getSimpleName(), - "com.netscape.cms.crl.CMSHoldInstructionExtension"); + "com.netscape.cms.crl.CMSHoldInstructionExtension"); mDefaultCRLExtensionClassNames.put(InvalidityDateExtension.class.getSimpleName(), - "com.netscape.cms.crl.CMSInvalidityDateExtension"); - //mDefaultCRLExtensionClassNames.put(CertificateIssuerExtension.NAME, - // "com.netscape.cms.crl.CMSCertificateIssuerExtension"); + "com.netscape.cms.crl.CMSInvalidityDateExtension"); + // mDefaultCRLExtensionClassNames.put(CertificateIssuerExtension.NAME, + // "com.netscape.cms.crl.CMSCertificateIssuerExtension"); mDefaultCRLExtensionClassNames.put(FreshestCRLExtension.class.getSimpleName(), - "com.netscape.cms.crl.CMSFreshestCRLExtension"); + "com.netscape.cms.crl.CMSFreshestCRLExtension"); mDefaultCRLExtensionClassNames.put(AuthInfoAccessExtension.NAME2, - "com.netscape.cms.crl.CMSAuthInfoAccessExtension"); + "com.netscape.cms.crl.CMSAuthInfoAccessExtension"); try { OIDMap.addAttribute(DeltaCRLIndicatorExtension.class.getName(), - DeltaCRLIndicatorExtension.OID, - DeltaCRLIndicatorExtension.class.getSimpleName()); + DeltaCRLIndicatorExtension.OID, + DeltaCRLIndicatorExtension.class.getSimpleName()); } catch (CertificateException e) { } try { OIDMap.addAttribute(HoldInstructionExtension.class.getName(), - HoldInstructionExtension.OID, - HoldInstructionExtension.class.getSimpleName()); + HoldInstructionExtension.OID, + HoldInstructionExtension.class.getSimpleName()); } catch (CertificateException e) { } try { OIDMap.addAttribute(InvalidityDateExtension.class.getName(), - InvalidityDateExtension.OID, - InvalidityDateExtension.class.getSimpleName()); + InvalidityDateExtension.OID, + InvalidityDateExtension.class.getSimpleName()); } catch (CertificateException e) { } try { OIDMap.addAttribute(FreshestCRLExtension.class.getName(), - FreshestCRLExtension.OID, - FreshestCRLExtension.class.getSimpleName()); + FreshestCRLExtension.OID, + FreshestCRLExtension.class.getSimpleName()); } catch (CertificateException e) { } } @@ -195,12 +193,12 @@ public class CMSCRLExtensions implements ICMSCRLExtensions { public CMSCRLExtensions(ICRLIssuingPoint crlIssuingPoint, IConfigStore config) { boolean modifiedConfig = false; - mConfig = config; + mConfig = config; mCRLExtConfig = config.getSubStore(PROP_EXTENSION); mCRLIssuingPoint = crlIssuingPoint; - IConfigStore mFileConfig = - SubsystemRegistry.getInstance().get("MAIN").getConfigStore(); + IConfigStore mFileConfig = + SubsystemRegistry.getInstance().get("MAIN").getConfigStore(); IConfigStore crlExtConfig = (IConfigStore) mFileConfig; StringTokenizer st = new StringTokenizer(mCRLExtConfig.getName(), "."); @@ -212,13 +210,13 @@ public class CMSCRLExtensions implements ICMSCRLExtensions { if (newConfig != null) { crlExtConfig = newConfig; } - } + } if (crlExtConfig != null) { Enumeration<String> enumExts = crlExtConfig.getSubStoreNames(); while (enumExts.hasMoreElements()) { - String extName = enumExts.nextElement(); + String extName = enumExts.nextElement(); IConfigStore extConfig = crlExtConfig.getSubStore(extName); if (extConfig != null) { @@ -361,10 +359,10 @@ public class CMSCRLExtensions implements ICMSCRLExtensions { Class<ICMSCRLExtension> crlExtClass = (Class<ICMSCRLExtension>) Class.forName(extClass); if (crlExtClass != null) { - ICMSCRLExtension cmsCRLExt = crlExtClass.newInstance(); + ICMSCRLExtension cmsCRLExt = crlExtClass.newInstance(); if (cmsCRLExt != null) { - String id = cmsCRLExt.getCRLExtOID(); + String id = cmsCRLExt.getCRLExtOID(); if (id != null) { mCRLExtensionIDs.put(id, extName); @@ -383,7 +381,7 @@ public class CMSCRLExtensions implements ICMSCRLExtensions { } else { if (mDefaultCRLExtensionClassNames.containsKey(extName)) { - extClass = mCRLExtensionClassNames.get(extName); + extClass = mCRLExtensionClassNames.get(extName); extConfig.putString(PROP_CLASS, extClass); modifiedConfig = true; } @@ -391,14 +389,14 @@ public class CMSCRLExtensions implements ICMSCRLExtensions { } } catch (EPropertyNotFound e) { if (mDefaultCRLExtensionClassNames.containsKey(extName)) { - extClass = mDefaultCRLExtensionClassNames.get(extName); + extClass = mDefaultCRLExtensionClassNames.get(extName); extConfig.putString(PROP_CLASS, extClass); modifiedConfig = true; } log(ILogger.LL_FAILURE, CMS.getLogMessage("CMSCORE_CA_CRLEXTS_CLASS_MISSING", extName)); } catch (EBaseException e) { if (mDefaultCRLExtensionClassNames.containsKey(extName)) { - extClass = mDefaultCRLExtensionClassNames.get(extName); + extClass = mDefaultCRLExtensionClassNames.get(extName); extConfig.putString(PROP_CLASS, extClass); modifiedConfig = true; } @@ -416,9 +414,7 @@ public class CMSCRLExtensions implements ICMSCRLExtensions { } public boolean isCRLExtensionEnabled(String extName) { - return ((mCRLExtensionNames.contains(extName) || - mCRLEntryExtensionNames.contains(extName)) && - mEnabledCRLExtensions.contains(extName)); + return ((mCRLExtensionNames.contains(extName) || mCRLEntryExtensionNames.contains(extName)) && mEnabledCRLExtensions.contains(extName)); } public boolean isCRLExtensionCritical(String extName) { @@ -429,7 +425,7 @@ public class CMSCRLExtensions implements ICMSCRLExtensions { String name = null; if (mCRLExtensionIDs.containsKey(id)) { - name = mCRLExtensionIDs.get(id); + name = mCRLExtensionIDs.get(id); } return name; } @@ -439,16 +435,16 @@ public class CMSCRLExtensions implements ICMSCRLExtensions { } public Vector<String> getCRLEntryExtensionNames() { - return new Vector<String>( mCRLEntryExtensionNames); + return new Vector<String>(mCRLEntryExtensionNames); } public void addToCRLExtensions(CRLExtensions crlExts, String extName, Extension ext) { if (mCRLExtensionClassNames.containsKey(extName)) { - String name = mCRLExtensionClassNames.get(extName); + String name = mCRLExtensionClassNames.get(extName); try { @SuppressWarnings("unchecked") - Class<ICMSCRLExtension > extClass = (Class<ICMSCRLExtension>) Class.forName(name); + Class<ICMSCRLExtension> extClass = (Class<ICMSCRLExtension>) Class.forName(name); if (extClass != null) { ICMSCRLExtension cmsCRLExt = extClass.newInstance(); @@ -488,21 +484,17 @@ public class CMSCRLExtensions implements ICMSCRLExtensions { NameValuePairs nvp = null; if (mCRLEntryExtensionNames.contains(id) || - mCRLExtensionNames.contains(id)) { + mCRLExtensionNames.contains(id)) { nvp = new NameValuePairs(); /* - if (mCRLEntryExtensionNames.contains(id)) { - nvp.add(Constants.PR_CRLEXT_IMPL_NAME, "CRLEntryExtension"); - } else { - nvp.add(Constants.PR_CRLEXT_IMPL_NAME, "CRLExtension"); - } - - if (mCRLEntryExtensionNames.contains(id)) { - nvp.add(PROP_TYPE, "CRLEntryExtension"); - } else { - nvp.add(PROP_TYPE, "CRLExtension"); - } + * if (mCRLEntryExtensionNames.contains(id)) { + * nvp.add(Constants.PR_CRLEXT_IMPL_NAME, "CRLEntryExtension"); } + * else { nvp.add(Constants.PR_CRLEXT_IMPL_NAME, "CRLExtension"); } + * + * if (mCRLEntryExtensionNames.contains(id)) { nvp.add(PROP_TYPE, + * "CRLEntryExtension"); } else { nvp.add(PROP_TYPE, + * "CRLExtension"); } */ if (mEnabledCRLExtensions.contains(id)) { @@ -517,7 +509,7 @@ public class CMSCRLExtensions implements ICMSCRLExtensions { } if (mCRLExtensionClassNames.containsKey(id)) { - String name = mCRLExtensionClassNames.get(id); + String name = mCRLExtensionClassNames.get(id); if (name != null) { @@ -555,12 +547,12 @@ public class CMSCRLExtensions implements ICMSCRLExtensions { } public void setConfigParams(String id, NameValuePairs nvp, IConfigStore config) { - ICertificateAuthority ca = (ICertificateAuthority) CMS.getSubsystem(CMS.SUBSYSTEM_CA); + ICertificateAuthority ca = (ICertificateAuthority) CMS.getSubsystem(CMS.SUBSYSTEM_CA); String ipId = nvp.getValue("id"); - ICRLIssuingPoint ip = null; - if(ipId != null && ca != null) { - ip = ca.getCRLIssuingPoint(ipId); + ICRLIssuingPoint ip = null; + if (ipId != null && ca != null) { + ip = ca.getCRLIssuingPoint(ipId); } for (int i = 0; i < nvp.size(); i++) { @@ -569,8 +561,7 @@ public class CMSCRLExtensions implements ICMSCRLExtensions { String value = p.getValue(); if (name.equals(PROP_ENABLE)) { - if (!(value.equals(Constants.TRUE) || - value.equals(Constants.FALSE))) { + if (!(value.equals(Constants.TRUE) || value.equals(Constants.FALSE))) { continue; } if (value.equals(Constants.TRUE)) { @@ -584,8 +575,7 @@ public class CMSCRLExtensions implements ICMSCRLExtensions { } if (name.equals(PROP_CRITICAL)) { - if (!(value.equals(Constants.TRUE) || - value.equals(Constants.FALSE))) { + if (!(value.equals(Constants.TRUE) || value.equals(Constants.FALSE))) { continue; } if (value.equals(Constants.TRUE)) { @@ -597,39 +587,40 @@ public class CMSCRLExtensions implements ICMSCRLExtensions { mCriticalCRLExtensions.remove(id); } } - //Sync the onlyContainsCACerts with similar property in CRLIssuingPoint - //called caCertsOnly. - if(name.equals(CMSIssuingDistributionPointExtension.PROP_CACERTS)) { + // Sync the onlyContainsCACerts with similar property in + // CRLIssuingPoint + // called caCertsOnly. + if (name.equals(CMSIssuingDistributionPointExtension.PROP_CACERTS)) { NameValuePairs crlIssuingPointPairs = null; boolean crlCACertsOnly = false; boolean issuingDistPointExtEnabled = false; CMSCRLExtensions cmsCRLExtensions = (CMSCRLExtensions) ip.getCRLExtensions(); - if(cmsCRLExtensions != null) { - issuingDistPointExtEnabled = cmsCRLExtensions.isCRLExtensionEnabled(IssuingDistributionPointExtension.class.getSimpleName()); + if (cmsCRLExtensions != null) { + issuingDistPointExtEnabled = cmsCRLExtensions.isCRLExtensionEnabled(IssuingDistributionPointExtension.class.getSimpleName()); } CMS.debug("issuingDistPointExtEnabled = " + issuingDistPointExtEnabled); - if (!(value.equals(Constants.TRUE) || - value.equals(Constants.FALSE))) { + if (!(value.equals(Constants.TRUE) || value.equals(Constants.FALSE))) { continue; } - //Get value of caCertsOnly from CRLIssuingPoint - if((ip != null) && (issuingDistPointExtEnabled == true)) { + // Get value of caCertsOnly from CRLIssuingPoint + if ((ip != null) && (issuingDistPointExtEnabled == true)) { crlCACertsOnly = ip.isCACertsOnly(); CMS.debug("CRLCACertsOnly is: " + crlCACertsOnly); crlIssuingPointPairs = new NameValuePairs(); - + } String newValue = ""; boolean modifiedCRLConfig = false; - //If the CRLCACertsOnly prop is false change it to true to sync. - if(value.equals(Constants.TRUE) && (issuingDistPointExtEnabled == true)) { - if(crlCACertsOnly == false) { + // If the CRLCACertsOnly prop is false change it to true to + // sync. + if (value.equals(Constants.TRUE) && (issuingDistPointExtEnabled == true)) { + if (crlCACertsOnly == false) { CMS.debug(" value = true and CRLCACertsOnly is already false."); crlIssuingPointPairs.add(Constants.PR_CA_CERTS_ONLY, Constants.TRUE); newValue = Constants.TRUE; @@ -638,24 +629,25 @@ public class CMSCRLExtensions implements ICMSCRLExtensions { } } - //If the CRLCACertsOnly prop is true change it to false to sync. - if(value.equals(Constants.FALSE) && (issuingDistPointExtEnabled == true)) { + // If the CRLCACertsOnly prop is true change it to false to + // sync. + if (value.equals(Constants.FALSE) && (issuingDistPointExtEnabled == true)) { crlIssuingPointPairs.add(Constants.PR_CA_CERTS_ONLY, Constants.FALSE); - if(ip != null) { + if (ip != null) { ip.updateConfig(crlIssuingPointPairs); newValue = Constants.FALSE; modifiedCRLConfig = true; } } - - if(modifiedCRLConfig == true) { - //Commit to this CRL IssuingPoint's config store + + if (modifiedCRLConfig == true) { + // Commit to this CRL IssuingPoint's config store ICertificateAuthority CA = (ICertificateAuthority) CMS.getSubsystem(CMS.SUBSYSTEM_CA); IConfigStore crlsSubStore = CA.getConfigStore(); - crlsSubStore = crlsSubStore.getSubStore(ICertificateAuthority.PROP_CRL_SUBSTORE); + crlsSubStore = crlsSubStore.getSubStore(ICertificateAuthority.PROP_CRL_SUBSTORE); crlsSubStore = crlsSubStore.getSubStore(ipId); try { - crlsSubStore.putString(Constants.PR_CA_CERTS_ONLY,newValue); + crlsSubStore.putString(Constants.PR_CA_CERTS_ONLY, newValue); crlsSubStore.commit(true); } catch (EBaseException e) { log(ILogger.LL_FAILURE, CMS.getLogMessage("CMSCORE_CA_CRLEXTS_SAVE_CONF", e.toString())); @@ -693,7 +685,6 @@ public class CMSCRLExtensions implements ICMSCRLExtensions { private void log(int level, String msg) { mLogger.log(ILogger.EV_SYSTEM, null, ILogger.S_CA, level, - "CMSCRLExtension - " + msg); + "CMSCRLExtension - " + msg); } } - diff --git a/pki/base/ca/src/com/netscape/ca/CRLIssuingPoint.java b/pki/base/ca/src/com/netscape/ca/CRLIssuingPoint.java index 5b98c62e..7a5a109b 100644 --- a/pki/base/ca/src/com/netscape/ca/CRLIssuingPoint.java +++ b/pki/base/ca/src/com/netscape/ca/CRLIssuingPoint.java @@ -17,7 +17,6 @@ // --- END COPYRIGHT BLOCK --- package com.netscape.ca; - import java.io.IOException; import java.math.BigInteger; import java.security.NoSuchAlgorithmException; @@ -85,18 +84,17 @@ import com.netscape.cmscore.dbs.CertificateRepository; import com.netscape.cmscore.util.Debug; /** - * This class encapsulates CRL issuing mechanism. CertificateAuthority - * contains a map of CRLIssuingPoint indexed by string ids. Each issuing - * point contains information about CRL issuing and publishing parameters - * as well as state information which includes last issued CRL, next CRL - * serial number, time of the next update etc. - * If autoUpdateInterval is set to non-zero value then worker thread - * is created that will perform CRL update at scheduled intervals. Update - * can also be triggered by invoking updateCRL method directly. Another - * parameter minUpdateInterval can be used to prevent CRL - * from being updated too often + * This class encapsulates CRL issuing mechanism. CertificateAuthority contains + * a map of CRLIssuingPoint indexed by string ids. Each issuing point contains + * information about CRL issuing and publishing parameters as well as state + * information which includes last issued CRL, next CRL serial number, time of + * the next update etc. If autoUpdateInterval is set to non-zero value then + * worker thread is created that will perform CRL update at scheduled intervals. + * Update can also be triggered by invoking updateCRL method directly. Another + * parameter minUpdateInterval can be used to prevent CRL from being updated too + * often * <P> - * + * * @author awnuk * @author lhsiao * @author galperin @@ -133,8 +131,8 @@ public class CRLIssuingPoint implements ICRLIssuingPoint, Runnable { protected String mId = null; /** - * Reference to the CertificateAuthority instance which owns this - * issuing point. + * Reference to the CertificateAuthority instance which owns this issuing + * point. */ protected ICertificateAuthority mCA = null; @@ -161,16 +159,16 @@ public class CRLIssuingPoint implements ICRLIssuingPoint, Runnable { /** * CRL cache */ - private Hashtable<BigInteger,RevokedCertificate> mCRLCerts = new Hashtable<BigInteger, RevokedCertificate>(); - private Hashtable<BigInteger,RevokedCertificate> mRevokedCerts = new Hashtable<BigInteger, RevokedCertificate>(); - private Hashtable<BigInteger,RevokedCertificate> mUnrevokedCerts = new Hashtable<BigInteger, RevokedCertificate>(); - private Hashtable<BigInteger,RevokedCertificate> mExpiredCerts = new Hashtable<BigInteger, RevokedCertificate>(); + private Hashtable<BigInteger, RevokedCertificate> mCRLCerts = new Hashtable<BigInteger, RevokedCertificate>(); + private Hashtable<BigInteger, RevokedCertificate> mRevokedCerts = new Hashtable<BigInteger, RevokedCertificate>(); + private Hashtable<BigInteger, RevokedCertificate> mUnrevokedCerts = new Hashtable<BigInteger, RevokedCertificate>(); + private Hashtable<BigInteger, RevokedCertificate> mExpiredCerts = new Hashtable<BigInteger, RevokedCertificate>(); private boolean mIncludeExpiredCerts = false; private boolean mIncludeExpiredCertsOneExtraTime = false; private boolean mCACertsOnly = false; private boolean mProfileCertsOnly = false; - private Vector<String> mProfileList = null; + private Vector<String> mProfileList = null; /** * Enable CRL cache. @@ -178,7 +176,7 @@ public class CRLIssuingPoint implements ICRLIssuingPoint, Runnable { private boolean mEnableCRLCache = true; private boolean mCRLCacheIsCleared = true; private boolean mEnableCacheRecovery = false; - private String mFirstUnsaved = null; + private String mFirstUnsaved = null; private boolean mEnableCacheTesting = false; /** @@ -187,8 +185,8 @@ public class CRLIssuingPoint implements ICRLIssuingPoint, Runnable { private long mLastCacheUpdate = 0; /** - * Time interval in milliseconds between consequential CRL cache - * updates performed automatically. + * Time interval in milliseconds between consequential CRL cache updates + * performed automatically. */ private long mCacheUpdateInterval; @@ -207,7 +205,7 @@ public class CRLIssuingPoint implements ICRLIssuingPoint, Runnable { * Enable CRL daily updates at listed times. */ private boolean mEnableDailyUpdates = false; - private Vector<Vector<Integer>> mDailyUpdates = null; + private Vector<Vector<Integer>> mDailyUpdates = null; private int mCurrentDay = 0; private int mLastDay = 0; private int mTimeListSize = 0; @@ -219,14 +217,14 @@ public class CRLIssuingPoint implements ICRLIssuingPoint, Runnable { private boolean mEnableUpdateFreq = false; /** - * Time interval in milliseconds between consequential CRL Enable CRL daily update at updates - * performed automatically. + * Time interval in milliseconds between consequential CRL Enable CRL daily + * update at updates performed automatically. */ private long mAutoUpdateInterval; /** - * Minimum time interval in milliseconds between consequential - * CRL updates (manual or automatic). + * Minimum time interval in milliseconds between consequential CRL updates + * (manual or automatic). */ private long mMinUpdateInterval; @@ -238,17 +236,16 @@ public class CRLIssuingPoint implements ICRLIssuingPoint, Runnable { /** * next update grace period */ - private long mNextUpdateGracePeriod; + private long mNextUpdateGracePeriod; /** - * Boolean flag controlling whether CRLv2 extensions are to be - * used in CRL. + * Boolean flag controlling whether CRLv2 extensions are to be used in CRL. */ private boolean mAllowExtensions = false; /** - * DN of the directory entry where CRLs from this issuing point - * are published. + * DN of the directory entry where CRLs from this issuing point are + * published. */ private String mPublishDN = null; @@ -261,7 +258,7 @@ public class CRLIssuingPoint implements ICRLIssuingPoint, Runnable { /** * Cached value of the CRL extensions to be placed in CRL */ - //protected CRLExtensions mCrlExtensions; + // protected CRLExtensions mCrlExtensions; /** * CRL number @@ -296,7 +293,7 @@ public class CRLIssuingPoint implements ICRLIssuingPoint, Runnable { private Thread mUpdateThread = null; /** - * for going one more round when auto-interval is set to 0 (turned off) + * for going one more round when auto-interval is set to 0 (turned off) */ private boolean mDoLastAutoUpdate = false; @@ -312,15 +309,15 @@ public class CRLIssuingPoint implements ICRLIssuingPoint, Runnable { private long mDeltaCRLSize = -1; /** - * update status, publishing status Strings to store in requests to - * display result. + * update status, publishing status Strings to store in requests to display + * result. */ private String mCrlUpdateStatus; private String mCrlUpdateError; private String mCrlPublishStatus; private String mCrlPublishError; - /** + /** * begin, end serial number range of revoked certs if any. */ protected BigInteger mBeginSerial = null; @@ -329,7 +326,7 @@ public class CRLIssuingPoint implements ICRLIssuingPoint, Runnable { private int mUpdatingCRL = CRL_UPDATE_DONE; private boolean mDoManualUpdate = false; - private String mSignatureAlgorithmForManualUpdate = null; + private String mSignatureAlgorithmForManualUpdate = null; private boolean mPublishOnStart = false; private long[] mSplits = new long[10]; @@ -337,8 +334,8 @@ public class CRLIssuingPoint implements ICRLIssuingPoint, Runnable { private boolean mSaveMemory = false; /** - * Constructs a CRL issuing point from instantiating from class name. - * CRL Issuing point must be followed by method call init(CA, id, config); + * Constructs a CRL issuing point from instantiating from class name. CRL + * Issuing point must be followed by method call init(CA, id, config); */ public CRLIssuingPoint() { } @@ -412,24 +409,23 @@ public class CRLIssuingPoint implements ICRLIssuingPoint, Runnable { } } } - + return b; } - /** * Initializes a CRL issuing point config. * <P> - * - * @param ca reference to CertificateAuthority instance which - * owns this issuing point. + * + * @param ca reference to CertificateAuthority instance which owns this + * issuing point. * @param id string id of this CRL issuing point. * @param config configuration of this CRL issuing point. * @exception EBaseException if initialization failed * @exception IOException */ - public void init(ISubsystem ca, String id, IConfigStore config) - throws EBaseException { + public void init(ISubsystem ca, String id, IConfigStore config) + throws EBaseException { mCA = (ICertificateAuthority) ca; mId = id; @@ -449,15 +445,15 @@ public class CRLIssuingPoint implements ICRLIssuingPoint, Runnable { IConfigStore crlSubStore = mCA.getConfigStore().getSubStore(ICertificateAuthority.PROP_CRL_SUBSTORE); mPageSize = crlSubStore.getInteger(ICertificateAuthority.PROP_CRL_PAGE_SIZE, CRL_PAGE_SIZE); - CMS.debug("CRL Page Size: "+ mPageSize); + CMS.debug("CRL Page Size: " + mPageSize); - mCountMod = config.getInteger("countMod",0); + mCountMod = config.getInteger("countMod", 0); mCRLRepository = mCA.getCRLRepository(); mCertRepository = mCA.getCertificateRepository(); ((CertificateRepository) mCertRepository).addCRLIssuingPoint(mId, this); mPublisherProcessor = mCA.getPublisherProcessor(); - //mCRLPublisher = mCA.getCRLPublisher(); + // mCRLPublisher = mCA.getCRLPublisher(); ((CAService) mCA.getCAService()).addCRLIssuingPoint(mId, this); // read in config parameters. @@ -469,7 +465,7 @@ public class CRLIssuingPoint implements ICRLIssuingPoint, Runnable { if (mCA.getRequestListener(crlListName) == null) { mCA.registerRequestListener( - crlListName, new RevocationRequestListener()); + crlListName, new RevocationRequestListener()); } for (int i = 0; i < mSplits.length; i++) { @@ -480,52 +476,60 @@ public class CRLIssuingPoint implements ICRLIssuingPoint, Runnable { setAutoUpdates(); } - private int checkTime(String time) { String digits = "0123456789"; int len = time.length(); - if (len < 3 || len > 5) return -1; + if (len < 3 || len > 5) + return -1; int s = time.indexOf(':'); - if (s < 0 || s > 2 || (len - s) != 3) return -1; + if (s < 0 || s > 2 || (len - s) != 3) + return -1; int h = 0; for (int i = 0; i < s; i++) { h *= 10; int k = digits.indexOf(time.charAt(i)); - if (k < 0) return -1; + if (k < 0) + return -1; h += k; } - if (h > 23) return -1; + if (h > 23) + return -1; int m = 0; - for (int i = s+1; i < len; i++) { + for (int i = s + 1; i < len; i++) { m *= 10; int k = digits.indexOf(time.charAt(i)); - if (k < 0) return -1; + if (k < 0) + return -1; m += k; } - if (m > 59) return -1; + if (m > 59) + return -1; return ((h * 60) + m); } private boolean areTimeListsIdentical(Vector<Vector<Integer>> list1, Vector<Vector<Integer>> list2) { boolean identical = true; - if (list1 == null || list2 == null) identical = false; - if (identical && list1.size() != list2.size()) identical = false; + if (list1 == null || list2 == null) + identical = false; + if (identical && list1.size() != list2.size()) + identical = false; for (int i = 0; identical && i < list1.size(); i++) { Vector<Integer> times1 = list1.elementAt(i); Vector<Integer> times2 = list2.elementAt(i); - if (times1.size() != times2.size()) identical = false; + if (times1.size() != times2.size()) + identical = false; for (int j = 0; identical && j < times1.size(); j++) { if ((((times1.elementAt(j))).intValue()) != (((times2.elementAt(j))).intValue())) { identical = false; } } } - CMS.debug("areTimeListsIdentical: identical: "+identical); + CMS.debug("areTimeListsIdentical: identical: " + identical); return identical; } @@ -533,23 +537,25 @@ public class CRLIssuingPoint implements ICRLIssuingPoint, Runnable { int listSize = 0; for (int i = 0; listedDays != null && i < listedDays.size(); i++) { Vector<Integer> listedTimes = listedDays.elementAt(i); - listSize += ((listedTimes != null)? listedTimes.size(): 0); + listSize += ((listedTimes != null) ? listedTimes.size() : 0); } - CMS.debug("getTimeListSize: ListSize="+listSize); + CMS.debug("getTimeListSize: ListSize=" + listSize); return listSize; } private boolean isTimeListExtended(String list) { - boolean extendedTimeList = true; - if (list == null || list.indexOf('*') == -1) - extendedTimeList = false; - return extendedTimeList; + boolean extendedTimeList = true; + if (list == null || list.indexOf('*') == -1) + extendedTimeList = false; + return extendedTimeList; } private Vector<Vector<Integer>> getTimeList(String list) { boolean timeListPresent = false; - if (list == null || list.length() == 0) return null; - if (list.charAt(0) == ',' || list.charAt(list.length()-1) == ',') return null; + if (list == null || list.length() == 0) + return null; + if (list.charAt(0) == ',' || list.charAt(list.length() - 1) == ',') + return null; Vector<Vector<Integer>> listedDays = new Vector<Vector<Integer>>(); @@ -557,7 +563,8 @@ public class CRLIssuingPoint implements ICRLIssuingPoint, Runnable { Vector<Integer> listedTimes = null; while (days.hasMoreTokens()) { String dayList = days.nextToken().trim(); - if (dayList == null) continue; + if (dayList == null) + continue; if (dayList.equals(";")) { if (timeListPresent) { @@ -586,7 +593,7 @@ public class CRLIssuingPoint implements ICRLIssuingPoint, Runnable { return null; } else { if (t > t0) { - listedTimes.addElement(new Integer(k*t)); + listedTimes.addElement(new Integer(k * t)); t0 = t; } else { return null; @@ -596,7 +603,7 @@ public class CRLIssuingPoint implements ICRLIssuingPoint, Runnable { } if (!timeListPresent) { listedTimes = new Vector<Integer>(); - listedDays.addElement(listedTimes); + listedDays.addElement(listedTimes); } return listedDays; @@ -605,7 +612,7 @@ public class CRLIssuingPoint implements ICRLIssuingPoint, Runnable { private String checkProfile(String id, Enumeration<String> e) { if (e != null) { while (e.hasMoreElements()) { - String profileId = e.nextElement(); + String profileId = e.nextElement(); if (profileId != null && profileId.equalsIgnoreCase(id)) return id; } @@ -616,9 +623,12 @@ public class CRLIssuingPoint implements ICRLIssuingPoint, Runnable { private Vector<String> getProfileList(String list) { Enumeration<String> e = null; IConfigStore pc = CMS.getConfigStore().getSubStore("profile"); - if (pc != null) e = pc.getSubStoreNames(); - if (list == null) return null; - if (list.length() > 0 && list.charAt(list.length()-1) == ',') return null; + if (pc != null) + e = pc.getSubStoreNames(); + if (list == null) + return null; + if (list.length() > 0 && list.charAt(list.length() - 1) == ',') + return null; Vector<String> listedProfiles = new Vector<String>(); @@ -627,8 +637,10 @@ public class CRLIssuingPoint implements ICRLIssuingPoint, Runnable { int n = 0; while (elements.hasMoreTokens()) { String element = elements.nextToken().trim(); - if (element == null || element.length() == 0) return null; - if (element.equals(",") && n % 2 == 0) return null; + if (element == null || element.length() == 0) + return null; + if (element.equals(",") && n % 2 == 0) + return null; if (n % 2 == 0) { String id = checkProfile(element, e); if (id != null) { @@ -637,17 +649,17 @@ public class CRLIssuingPoint implements ICRLIssuingPoint, Runnable { } n++; } - if (n % 2 == 0) return null; + if (n % 2 == 0) + return null; return listedProfiles; } - /** * get CRL config store info */ protected void initConfig(IConfigStore config) - throws EBaseException { + throws EBaseException { mEnable = config.getBoolean(Constants.PR_ENABLE, true); mDescription = config.getString(Constants.PR_DESCRIPTION); @@ -684,13 +696,13 @@ public class CRLIssuingPoint implements ICRLIssuingPoint, Runnable { mAutoUpdateInterval = MINUTE * config.getInteger(Constants.PR_UPDATE_FREQ, 0); mMinUpdateInterval = MINUTE * config.getInteger(PROP_MIN_UPDATE_INTERVAL, 0); if (mEnableUpdateFreq && mAutoUpdateInterval > 0 && - mAutoUpdateInterval < mMinUpdateInterval) + mAutoUpdateInterval < mMinUpdateInterval) mAutoUpdateInterval = mMinUpdateInterval; - // get next update grace period + // get next update grace period mNextUpdateGracePeriod = MINUTE * config.getInteger(Constants.PR_GRACE_PERIOD, 0); - // Get V2 or V1 CRL + // Get V2 or V1 CRL mAllowExtensions = config.getBoolean(Constants.PR_EXTENSIONS, false); mIncludeExpiredCerts = config.getBoolean(Constants.PR_INCLUDE_EXPIREDCERTS, false); @@ -708,13 +720,13 @@ public class CRLIssuingPoint implements ICRLIssuingPoint, Runnable { String algorithm = config.getString(Constants.PR_SIGNING_ALGORITHM, null); if (algorithm != null) { - // make sure this algorithm is acceptable to CA. + // make sure this algorithm is acceptable to CA. mCA.getCRLSigningUnit().checkSigningAlgorithmFromName(algorithm); mSigningAlgorithm = algorithm; } mPublishOnStart = config.getBoolean(PROP_PUBLISH_ON_START, false); - // if publish dn is null then certificate will be published to + // if publish dn is null then certificate will be published to // CA's entry in the directory. mPublishDN = config.getString(PROP_PUBLISH_DN, null); @@ -722,30 +734,29 @@ public class CRLIssuingPoint implements ICRLIssuingPoint, Runnable { mCMSCRLExtensions = new CMSCRLExtensions(this, config); - mExtendedNextUpdate = ((mUpdateSchema > 1 || (mEnableDailyUpdates && mExtendedTimeList)) && isDeltaCRLEnabled())? - config.getBoolean(Constants.PR_EXTENDED_NEXT_UPDATE, true): + mExtendedNextUpdate = ((mUpdateSchema > 1 || (mEnableDailyUpdates && mExtendedTimeList)) && isDeltaCRLEnabled()) ? + config.getBoolean(Constants.PR_EXTENDED_NEXT_UPDATE, true) : false; // Get serial number ranges if any. mBeginSerial = config.getBigInteger(PROP_BEGIN_SERIAL, null); if (mBeginSerial != null && mBeginSerial.compareTo(BigInteger.ZERO) < 0) { throw new EBaseException( - CMS.getUserMessage("CMS_BASE_INVALID_PROPERTY_1", - PROP_BEGIN_SERIAL, "BigInteger", "positive number")); + CMS.getUserMessage("CMS_BASE_INVALID_PROPERTY_1", + PROP_BEGIN_SERIAL, "BigInteger", "positive number")); } mEndSerial = config.getBigInteger(PROP_END_SERIAL, null); if (mEndSerial != null && mEndSerial.compareTo(BigInteger.ZERO) < 0) { throw new EBaseException( - CMS.getUserMessage("CMS_BASE_INVALID_PROPERTY_1", - PROP_END_SERIAL, "BigInteger", "positive number")); + CMS.getUserMessage("CMS_BASE_INVALID_PROPERTY_1", + PROP_END_SERIAL, "BigInteger", "positive number")); } } /** - * Reads CRL issuing point, if missing, it creates one. - * Initializes CRL cache and republishes CRL if requested - * Called from auto update thread (run()). - * Do not call it from init(), because it will block CMS on start. + * Reads CRL issuing point, if missing, it creates one. Initializes CRL + * cache and republishes CRL if requested Called from auto update thread + * (run()). Do not call it from init(), because it will block CMS on start. */ private void initCRL() { ICRLIssuingPointRecord crlRecord = null; @@ -760,7 +771,7 @@ public class CRLIssuingPoint implements ICRLIssuingPoint, Runnable { return; } catch (EBaseException e) { // CRL was never set. - // fall to the following.. + // fall to the following.. } if (crlRecord != null) { @@ -800,16 +811,16 @@ public class CRLIssuingPoint implements ICRLIssuingPoint, Runnable { mNextUpdate = crlRecord.getNextUpdate(); if (isDeltaCRLEnabled()) { - mNextDeltaUpdate = (mNextUpdate != null)? new Date(mNextUpdate.getTime()): null; + mNextDeltaUpdate = (mNextUpdate != null) ? new Date(mNextUpdate.getTime()) : null; } mFirstUnsaved = crlRecord.getFirstUnsaved(); if (Debug.on()) { - Debug.trace("initCRL CRLNumber="+mCRLNumber.toString()+" CRLSize="+mCRLSize+ - " FirstUnsaved="+mFirstUnsaved); + Debug.trace("initCRL CRLNumber=" + mCRLNumber.toString() + " CRLSize=" + mCRLSize + + " FirstUnsaved=" + mFirstUnsaved); } if (mFirstUnsaved == null || - (mFirstUnsaved != null && mFirstUnsaved.equals(ICRLIssuingPointRecord.NEW_CACHE))) { + (mFirstUnsaved != null && mFirstUnsaved.equals(ICRLIssuingPointRecord.NEW_CACHE))) { clearCRLCache(); updateCRLCacheRepository(); } else { @@ -877,24 +888,25 @@ public class CRLIssuingPoint implements ICRLIssuingPoint, Runnable { } if (crlRecord == null) { - // no crl was ever created, or crl in db is corrupted. + // no crl was ever created, or crl in db is corrupted. // create new one. try { crlRecord = new CRLIssuingPointRecord(mId, BigInteger.ZERO, Long.valueOf(-1), null, null, BigInteger.ZERO, Long.valueOf(-1), mRevokedCerts, mUnrevokedCerts, mExpiredCerts); mCRLRepository.addCRLIssuingPointRecord(crlRecord); - mCRLNumber = BigInteger.ZERO; //BIG_ZERO; - mNextCRLNumber = BigInteger.ONE; //BIG_ONE; + mCRLNumber = BigInteger.ZERO; // BIG_ZERO; + mNextCRLNumber = BigInteger.ONE; // BIG_ONE; mLastCRLNumber = mCRLNumber; mDeltaCRLNumber = mCRLNumber; mNextDeltaCRLNumber = mNextCRLNumber; mLastUpdate = new Date(0L); if (crlRecord != null) { - // This will trigger updateCRLNow, which will also publish CRL. + // This will trigger updateCRLNow, which will also publish + // CRL. if ((mDoManualUpdate == false) && - (mEnableCRLCache || mAlwaysUpdate || - (mEnableUpdateFreq && mAutoUpdateInterval > 0))) { + (mEnableCRLCache || mAlwaysUpdate || + (mEnableUpdateFreq && mAutoUpdateInterval > 0))) { mInitialized = CRL_IP_INITIALIZED; setManualUpdate(null); } @@ -919,7 +931,7 @@ public class CRLIssuingPoint implements ICRLIssuingPoint, Runnable { NameValuePair p = params.elementAt(i); String name = p.getName(); String value = p.getValue(); - + // -- Update Schema -- if (name.equals(Constants.PR_ENABLE_CRL)) { if (value.equals(Constants.FALSE) && mEnableCRLUpdates) { @@ -1082,7 +1094,8 @@ public class CRLIssuingPoint implements ICRLIssuingPoint, Runnable { // -- CRL Format -- if (name.equals(Constants.PR_SIGNING_ALGORITHM)) { - if (value != null) value = value.trim(); + if (value != null) + value = value.trim(); if (!mSigningAlgorithm.equals(value)) { mSigningAlgorithm = value; } @@ -1123,9 +1136,9 @@ public class CRLIssuingPoint implements ICRLIssuingPoint, Runnable { if (name.equals(Constants.PR_CA_CERTS_ONLY)) { Extension distExt = getCRLExtension(IssuingDistributionPointExtension.class.getSimpleName()); IssuingDistributionPointExtension iExt = (IssuingDistributionPointExtension) distExt; - IssuingDistributionPoint issuingDistributionPoint = null; - if(iExt != null) - issuingDistributionPoint = iExt.getIssuingDistributionPoint(); + IssuingDistributionPoint issuingDistributionPoint = null; + if (iExt != null) + issuingDistributionPoint = iExt.getIssuingDistributionPoint(); if (value.equals(Constants.FALSE) && mCACertsOnly) { clearCRLCache(); updateCRLCacheRepository(); @@ -1135,27 +1148,28 @@ public class CRLIssuingPoint implements ICRLIssuingPoint, Runnable { updateCRLCacheRepository(); mCACertsOnly = true; } - //attempt to sync the IssuingDistributionPoint Extension value of - //onlyContainsCACerts - if(issuingDistributionPoint != null && params.size() > 1) { + // attempt to sync the IssuingDistributionPoint Extension + // value of + // onlyContainsCACerts + if (issuingDistributionPoint != null && params.size() > 1) { boolean onlyContainsCACerts = issuingDistributionPoint.getOnlyContainsCACerts(); - if(onlyContainsCACerts != mCACertsOnly) { + if (onlyContainsCACerts != mCACertsOnly) { IConfigStore config = mCA.getConfigStore(); IConfigStore crlsSubStore = - config.getSubStore(ICertificateAuthority.PROP_CRL_SUBSTORE); + config.getSubStore(ICertificateAuthority.PROP_CRL_SUBSTORE); IConfigStore crlSubStore = crlsSubStore.getSubStore(mId); IConfigStore crlExtsSubStore = - crlSubStore.getSubStore(ICertificateAuthority.PROP_CRLEXT_SUBSTORE); + crlSubStore.getSubStore(ICertificateAuthority.PROP_CRLEXT_SUBSTORE); crlExtsSubStore = crlExtsSubStore.getSubStore(IssuingDistributionPointExtension.class.getSimpleName()); - if(crlExtsSubStore != null) { + if (crlExtsSubStore != null) { String val = ""; - if(mCACertsOnly == true) { + if (mCACertsOnly == true) { val = Constants.TRUE; } else { val = Constants.FALSE; } - crlExtsSubStore.putString(PROP_CACERTS,val); + crlExtsSubStore.putString(PROP_CACERTS, val); try { crlExtsSubStore.commit(true); } catch (Exception e) { @@ -1180,11 +1194,11 @@ public class CRLIssuingPoint implements ICRLIssuingPoint, Runnable { if (name.equals(Constants.PR_PROFILE_LIST)) { Vector<String> profileList = getProfileList(value); if (((profileList != null) ^ (mProfileList != null)) || - (profileList != null && mProfileList != null && - (!mProfileList.equals(profileList)))) { + (profileList != null && mProfileList != null && + (!mProfileList.equals(profileList)))) { if (profileList != null) { @SuppressWarnings("unchecked") - Vector<String> newProfileList = (Vector<String>) profileList.clone(); + Vector<String> newProfileList = (Vector<String>) profileList.clone(); mProfileList = newProfileList; } else { mProfileList = null; @@ -1199,7 +1213,8 @@ public class CRLIssuingPoint implements ICRLIssuingPoint, Runnable { } } - if (modifiedSchedule) setAutoUpdates(); + if (modifiedSchedule) + setAutoUpdates(); return noRestart; } @@ -1218,20 +1233,15 @@ public class CRLIssuingPoint implements ICRLIssuingPoint, Runnable { setAutoUpdates(); /* - if (mUpdateThread != null) { - try { - mUpdateThread.interrupt(); - } - catch (Exception e) { - } - } - */ + * if (mUpdateThread != null) { try { mUpdateThread.interrupt(); } catch + * (Exception e) { } } + */ } /** * Returns internal id of this CRL issuing point. * <P> - * + * * @return internal id of this CRL issuing point */ public String getId() { @@ -1241,7 +1251,7 @@ public class CRLIssuingPoint implements ICRLIssuingPoint, Runnable { /** * Returns internal description of this CRL issuing point. * <P> - * + * * @return internal description of this CRL issuing point */ public String getDescription() { @@ -1250,7 +1260,7 @@ public class CRLIssuingPoint implements ICRLIssuingPoint, Runnable { /** * Sets internal description of this CRL issuing point. - * + * * @param description description for this CRL issuing point. */ public void setDescription(String description) { @@ -1258,10 +1268,10 @@ public class CRLIssuingPoint implements ICRLIssuingPoint, Runnable { } /** - * Returns DN of the directory entry where CRLs.from this issuing point - * are published. + * Returns DN of the directory entry where CRLs.from this issuing point are + * published. * <P> - * + * * @return DN of the directory entry where CRLs are published. */ public String getPublishDN() { @@ -1271,7 +1281,7 @@ public class CRLIssuingPoint implements ICRLIssuingPoint, Runnable { /** * Returns signing algorithm. * <P> - * + * * @return SigningAlgorithm. */ public String getSigningAlgorithm() { @@ -1285,7 +1295,7 @@ public class CRLIssuingPoint implements ICRLIssuingPoint, Runnable { /** * Returns current CRL generation schema for this CRL issuing point. * <P> - * + * * @return current CRL generation schema for this CRL issuing point */ public int getCRLSchema() { @@ -1295,7 +1305,7 @@ public class CRLIssuingPoint implements ICRLIssuingPoint, Runnable { /** * Returns current CRL number of this CRL issuing point. * <P> - * + * * @return current CRL number of this CRL issuing point */ public BigInteger getCRLNumber() { @@ -1305,17 +1315,17 @@ public class CRLIssuingPoint implements ICRLIssuingPoint, Runnable { /** * Returns current delta CRL number of this CRL issuing point. * <P> - * + * * @return current delta CRL number of this CRL issuing point */ public BigInteger getDeltaCRLNumber() { - return (isDeltaCRLEnabled() && mDeltaCRLSize > -1)? mDeltaCRLNumber: BigInteger.ZERO; + return (isDeltaCRLEnabled() && mDeltaCRLSize > -1) ? mDeltaCRLNumber : BigInteger.ZERO; } /** * Returns next CRL number of this CRL issuing point. * <P> - * + * * @return next CRL number of this CRL issuing point */ public BigInteger getNextCRLNumber() { @@ -1325,17 +1335,17 @@ public class CRLIssuingPoint implements ICRLIssuingPoint, Runnable { /** * Returns number of entries in the CRL * <P> - * + * * @return number of entries in the CRL */ public long getCRLSize() { - return (mCRLCerts.size() > 0 && mCRLSize == 0)? mCRLCerts.size(): mCRLSize; + return (mCRLCerts.size() > 0 && mCRLSize == 0) ? mCRLCerts.size() : mCRLSize; } /** * Returns number of entries in delta CRL * <P> - * + * * @return number of entries in delta CRL */ public long getDeltaCRLSize() { @@ -1345,7 +1355,7 @@ public class CRLIssuingPoint implements ICRLIssuingPoint, Runnable { /** * Returns last update time * <P> - * + * * @return last CRL update time */ public Date getLastUpdate() { @@ -1355,7 +1365,7 @@ public class CRLIssuingPoint implements ICRLIssuingPoint, Runnable { /** * Returns next update time * <P> - * + * * @return next CRL update time */ public Date getNextUpdate() { @@ -1365,7 +1375,7 @@ public class CRLIssuingPoint implements ICRLIssuingPoint, Runnable { /** * Returns next update time * <P> - * + * * @return next CRL update time */ public Date getNextDeltaUpdate() { @@ -1375,7 +1385,7 @@ public class CRLIssuingPoint implements ICRLIssuingPoint, Runnable { /** * Returns all the revoked certificates from the CRL cache. * <P> - * + * * @return set of all the revoked certificates or null if there are none. */ public Set<RevokedCertificate> getRevokedCertificates(int start, int end) { @@ -1390,7 +1400,7 @@ public class CRLIssuingPoint implements ICRLIssuingPoint, Runnable { /** * Returns certificate authority. * <P> - * + * * @return certificate authority */ public ISubsystem getCertificateAuthority() { @@ -1403,13 +1413,13 @@ public class CRLIssuingPoint implements ICRLIssuingPoint, Runnable { private synchronized void setAutoUpdates() { if ((mEnable && mUpdateThread == null) && - ((mEnableCRLCache && mCacheUpdateInterval > 0) || - (mEnableCRLUpdates && - ((mEnableDailyUpdates && mDailyUpdates != null && - mTimeListSize > 0) || - (mEnableUpdateFreq && mAutoUpdateInterval > 0) || - (mInitialized == CRL_IP_NOT_INITIALIZED) || - mDoLastAutoUpdate || mDoManualUpdate)))) { + ((mEnableCRLCache && mCacheUpdateInterval > 0) || + (mEnableCRLUpdates && + ((mEnableDailyUpdates && mDailyUpdates != null && + mTimeListSize > 0) || + (mEnableUpdateFreq && mAutoUpdateInterval > 0) || + (mInitialized == CRL_IP_NOT_INITIALIZED) || + mDoLastAutoUpdate || mDoManualUpdate)))) { mUpdateThread = new Thread(this, "CRLIssuingPoint-" + mId); log(ILogger.LL_INFO, CMS.getLogMessage("CMSCORE_CA_ISSUING_START_CRL", mId)); mUpdateThread.setDaemon(true); @@ -1417,14 +1427,14 @@ public class CRLIssuingPoint implements ICRLIssuingPoint, Runnable { } if ((mInitialized == CRL_IP_INITIALIZED) && (((mNextUpdate != null) ^ - ((mEnableDailyUpdates && mDailyUpdates != null && mTimeListSize > 0) || - (mEnableUpdateFreq && mAutoUpdateInterval > 0))) || - (!mEnableCRLUpdates && mNextUpdate != null))) { - mDoLastAutoUpdate = true; + ((mEnableDailyUpdates && mDailyUpdates != null && mTimeListSize > 0) || + (mEnableUpdateFreq && mAutoUpdateInterval > 0))) || + (!mEnableCRLUpdates && mNextUpdate != null))) { + mDoLastAutoUpdate = true; } if (mEnableUpdateFreq && mAutoUpdateInterval > 0 && - mAutoUpdateInterval < mMinUpdateInterval) { + mAutoUpdateInterval < mMinUpdateInterval) { mAutoUpdateInterval = mMinUpdateInterval; } @@ -1432,8 +1442,7 @@ public class CRLIssuingPoint implements ICRLIssuingPoint, Runnable { } /** - * Sets CRL manual-update - * Starts or stops worker thread as necessary. + * Sets CRL manual-update Starts or stops worker thread as necessary. */ public synchronized void setManualUpdate(String signatureAlgorithm) { if (!mDoManualUpdate) { @@ -1451,13 +1460,13 @@ public class CRLIssuingPoint implements ICRLIssuingPoint, Runnable { * @return auto update interval in milliseconds. */ public long getAutoUpdateInterval() { - return (mEnableUpdateFreq)? mAutoUpdateInterval: 0; + return (mEnableUpdateFreq) ? mAutoUpdateInterval : 0; } /** - * @return always update the CRL + * @return always update the CRL */ - public boolean getAlwaysUpdate() { + public boolean getAlwaysUpdate() { return mAlwaysUpdate; } @@ -1471,11 +1480,11 @@ public class CRLIssuingPoint implements ICRLIssuingPoint, Runnable { /** * Finds next update time expressed as delay or time of the next update. - * - * @param fromLastUpdate if true, function returns delay to the next update time - * otherwise returns the next update time. - * @param delta if true, function returns the next update time for delta CRL, - * otherwise returns the next update time for CRL. + * + * @param fromLastUpdate if true, function returns delay to the next update + * time otherwise returns the next update time. + * @param delta if true, function returns the next update time for delta + * CRL, otherwise returns the next update time for CRL. * @return delay to the next update time or the next update time itself */ private long findNextUpdate(boolean fromLastUpdate, boolean delta) { @@ -1483,52 +1492,53 @@ public class CRLIssuingPoint implements ICRLIssuingPoint, Runnable { TimeZone tz = TimeZone.getDefault(); int offset = tz.getOffset(now); long oneDay = 1440L * MINUTE; - long nowToday = (now + (long)offset) % oneDay; + long nowToday = (now + (long) offset) % oneDay; long startOfToday = now - nowToday; - long lastUpdated = (mLastUpdate != null)? mLastUpdate.getTime(): now; - long lastUpdateDay = lastUpdated - ((lastUpdated + (long)offset) % oneDay); + long lastUpdated = (mLastUpdate != null) ? mLastUpdate.getTime() : now; + long lastUpdateDay = lastUpdated - ((lastUpdated + (long) offset) % oneDay); - long lastUpdate = (mLastUpdate != null && fromLastUpdate)? mLastUpdate.getTime(): now; - long last = (lastUpdate + (long)offset) % oneDay; + long lastUpdate = (mLastUpdate != null && fromLastUpdate) ? mLastUpdate.getTime() : now; + long last = (lastUpdate + (long) offset) % oneDay; long lastDay = lastUpdate - last; boolean isDeltaEnabled = isDeltaCRLEnabled(); long next = 0L; long nextUpdate = 0L; - CMS.debug("findNextUpdate: fromLastUpdate: "+fromLastUpdate+" delta: "+delta); + CMS.debug("findNextUpdate: fromLastUpdate: " + fromLastUpdate + " delta: " + delta); - int numberOfDays = (int)((startOfToday - lastUpdateDay) / oneDay); + int numberOfDays = (int) ((startOfToday - lastUpdateDay) / oneDay); if (numberOfDays > 0 && mDailyUpdates.size() > 1 && - ((mCurrentDay == mLastDay) || - (mCurrentDay != ((mLastDay + numberOfDays) % mDailyUpdates.size())))) { + ((mCurrentDay == mLastDay) || + (mCurrentDay != ((mLastDay + numberOfDays) % mDailyUpdates.size())))) { mCurrentDay = (mLastDay + numberOfDays) % mDailyUpdates.size(); } if ((delta || fromLastUpdate) && isDeltaEnabled && - (mUpdateSchema > 1 || (mEnableDailyUpdates && mExtendedTimeList)) && - mNextDeltaUpdate != null) { + (mUpdateSchema > 1 || (mEnableDailyUpdates && mExtendedTimeList)) && + mNextDeltaUpdate != null) { nextUpdate = mNextDeltaUpdate.getTime(); } else if (mNextUpdate != null) { nextUpdate = mNextUpdate.getTime(); } if (mEnableDailyUpdates && - mDailyUpdates != null && mDailyUpdates.size() > 0) { + mDailyUpdates != null && mDailyUpdates.size() > 0) { int n = 0; if (mDailyUpdates.size() == 1 && mDailyUpdates.elementAt(0).size() == 1 && - mEnableUpdateFreq && mAutoUpdateInterval > 0) { + mEnableUpdateFreq && mAutoUpdateInterval > 0) { // Interval updates with starting time - long firstTime = MINUTE * ((Integer)mDailyUpdates.elementAt(0).elementAt(0)).longValue(); + long firstTime = MINUTE * ((Integer) mDailyUpdates.elementAt(0).elementAt(0)).longValue(); long t = firstTime; long interval = mAutoUpdateInterval; if (mExtendedNextUpdate && (!fromLastUpdate) && (!delta) && - isDeltaEnabled && mUpdateSchema > 1) { + isDeltaEnabled && mUpdateSchema > 1) { interval *= mUpdateSchema; } - while (t < oneDay) { - if (t - mMinUpdateInterval > last) break; + while (t < oneDay) { + if (t - mMinUpdateInterval > last) + break; t += interval; n++; } @@ -1562,7 +1572,7 @@ public class CRLIssuingPoint implements ICRLIssuingPoint, Runnable { } // search the current day for (i = 0; i < mDailyUpdates.elementAt(mCurrentDay).size(); i++) { - long t = MINUTE * ((Integer)mDailyUpdates.elementAt(mCurrentDay).elementAt(i)).longValue(); + long t = MINUTE * ((Integer) mDailyUpdates.elementAt(mCurrentDay).elementAt(i)).longValue(); if (mEnableDailyUpdates && mExtendedTimeList) { if (mExtendedNextUpdate && (!fromLastUpdate) && (!delta) && isDeltaEnabled) { if (t < 0) { @@ -1578,7 +1588,7 @@ public class CRLIssuingPoint implements ICRLIssuingPoint, Runnable { } if (t - mMinUpdateInterval > last) { if (mExtendedNextUpdate && (!fromLastUpdate) && (!(mEnableDailyUpdates && mExtendedTimeList)) && (!delta) && - isDeltaEnabled && mUpdateSchema > 1) { + isDeltaEnabled && mUpdateSchema > 1) { i += mUpdateSchema - ((i + m) % mUpdateSchema); } break; @@ -1588,14 +1598,14 @@ public class CRLIssuingPoint implements ICRLIssuingPoint, Runnable { if (i < mDailyUpdates.elementAt(mCurrentDay).size()) { // found inside the current day - next = (MINUTE * ((Integer)mDailyUpdates.elementAt(mCurrentDay).elementAt(i)).longValue()); + next = (MINUTE * ((Integer) mDailyUpdates.elementAt(mCurrentDay).elementAt(i)).longValue()); if (mEnableDailyUpdates && mExtendedTimeList && next < 0) { next *= -1; if (fromLastUpdate) { mSchemaCounter = 0; } } - next += ((lastDay < lastUpdateDay)? lastDay: lastUpdateDay) + (oneDay * (mCurrentDay - mLastDay)); + next += ((lastDay < lastUpdateDay) ? lastDay : lastUpdateDay) + (oneDay * (mCurrentDay - mLastDay)); if (fromLastUpdate && (!(mEnableDailyUpdates && mExtendedTimeList))) { n = n % mUpdateSchema; @@ -1616,8 +1626,9 @@ public class CRLIssuingPoint implements ICRLIssuingPoint, Runnable { while (nDays <= mDailyUpdates.size()) { int nextDay = (mCurrentDay + nDays) % mDailyUpdates.size(); if (j < mDailyUpdates.elementAt(nextDay).size()) { - if (nextDay == 0 && (!(mEnableDailyUpdates && mExtendedTimeList))) j = 0; - t = MINUTE * ((Integer)mDailyUpdates.elementAt(nextDay).elementAt(j)).longValue(); + if (nextDay == 0 && (!(mEnableDailyUpdates && mExtendedTimeList))) + j = 0; + t = MINUTE * ((Integer) mDailyUpdates.elementAt(nextDay).elementAt(j)).longValue(); if (mEnableDailyUpdates && mExtendedTimeList) { if (mExtendedNextUpdate && (!fromLastUpdate) && (!delta) && isDeltaEnabled) { if (t < 0) { @@ -1642,7 +1653,7 @@ public class CRLIssuingPoint implements ICRLIssuingPoint, Runnable { nDays++; } } - next = ((lastDay < lastUpdateDay)? lastDay: lastUpdateDay) + (oneDay * nDays) + t; + next = ((lastDay < lastUpdateDay) ? lastDay : lastUpdateDay) + (oneDay * nDays) + t; if (fromLastUpdate && mDailyUpdates.size() < 2) { mSchemaCounter = 0; @@ -1651,7 +1662,7 @@ public class CRLIssuingPoint implements ICRLIssuingPoint, Runnable { } } else if (mEnableUpdateFreq && mAutoUpdateInterval > 0) { // Interval updates without starting time - if (mExtendedNextUpdate && (!fromLastUpdate) && (!delta) && isDeltaEnabled && mUpdateSchema > 1) { + if (mExtendedNextUpdate && (!fromLastUpdate) && (!delta) && isDeltaEnabled && mUpdateSchema > 1) { next = lastUpdate + (mUpdateSchema * mAutoUpdateInterval); } else { next = lastUpdate + mAutoUpdateInterval; @@ -1662,15 +1673,14 @@ public class CRLIssuingPoint implements ICRLIssuingPoint, Runnable { next = nextUpdate; } - CMS.debug("findNextUpdate: "+((new Date(next)).toString())+((fromLastUpdate)? " delay: "+(next-now): "")); + CMS.debug("findNextUpdate: " + ((new Date(next)).toString()) + ((fromLastUpdate) ? " delay: " + (next - now) : "")); - return (fromLastUpdate)? next-now: next; + return (fromLastUpdate) ? next - now : next; } - /** - * Implements Runnable interface. Defines auto-update - * logic used by worker thread. + * Implements Runnable interface. Defines auto-update logic used by worker + * thread. * <P> */ public void run() { @@ -1678,8 +1688,8 @@ public class CRLIssuingPoint implements ICRLIssuingPoint, Runnable { (mInitialized == CRL_IP_NOT_INITIALIZED) || mDoLastAutoUpdate || (mEnableCRLUpdates && ((mEnableDailyUpdates && mDailyUpdates != null && - mTimeListSize > 0) || - (mEnableUpdateFreq && mAutoUpdateInterval > 0) || + mTimeListSize > 0) || + (mEnableUpdateFreq && mAutoUpdateInterval > 0) || mDoManualUpdate)))) { synchronized (this) { @@ -1687,13 +1697,14 @@ public class CRLIssuingPoint implements ICRLIssuingPoint, Runnable { long delay2 = 0; boolean doCacheUpdate = false; boolean scheduledUpdates = mEnableCRLUpdates && - ((mEnableDailyUpdates && mDailyUpdates != null && - mTimeListSize > 0) || - (mEnableUpdateFreq && mAutoUpdateInterval > 0)); + ((mEnableDailyUpdates && mDailyUpdates != null && + mTimeListSize > 0) || + (mEnableUpdateFreq && mAutoUpdateInterval > 0)); if (mInitialized == CRL_IP_NOT_INITIALIZED) initCRL(); - if (mInitialized == CRL_IP_INITIALIZED && (!mEnable)) break; + if (mInitialized == CRL_IP_INITIALIZED && (!mEnable)) + break; if ((mEnableCRLUpdates && mDoManualUpdate) || mDoLastAutoUpdate) { delay = 0; @@ -1705,8 +1716,8 @@ public class CRLIssuingPoint implements ICRLIssuingPoint, Runnable { delay2 = mLastCacheUpdate + mCacheUpdateInterval - System.currentTimeMillis(); if (delay2 < delay || - (!(scheduledUpdates || mDoLastAutoUpdate || - (mEnableCRLUpdates && mDoManualUpdate)))) { + (!(scheduledUpdates || mDoLastAutoUpdate || + (mEnableCRLUpdates && mDoManualUpdate)))) { delay = delay2; if (delay <= 0) { doCacheUpdate = true; @@ -1716,7 +1727,7 @@ public class CRLIssuingPoint implements ICRLIssuingPoint, Runnable { } if (delay > 0) { - try { + try { wait(delay); } catch (InterruptedException e) { } @@ -1729,13 +1740,13 @@ public class CRLIssuingPoint implements ICRLIssuingPoint, Runnable { } } catch (Exception e) { log(ILogger.LL_FAILURE, CMS.getLogMessage("CMSCORE_CA_ISSUING_CRL", - (doCacheUpdate)?"update CRL cache":"update CRL", e.toString())); + (doCacheUpdate) ? "update CRL cache" : "update CRL", e.toString())); if (Debug.on()) { - Debug.trace((doCacheUpdate)?"update CRL cache":"update CRL" + " error " + e); + Debug.trace((doCacheUpdate) ? "update CRL cache" : "update CRL" + " error " + e); Debug.printStackTrace(e); } } - // put this here to prevent continuous loop if internal + // put this here to prevent continuous loop if internal // db is down. if (mDoLastAutoUpdate) mDoLastAutoUpdate = false; @@ -1749,28 +1760,23 @@ public class CRLIssuingPoint implements ICRLIssuingPoint, Runnable { mUpdateThread = null; } - /** - * Updates CRL and publishes it. - * If time elapsed since last CRL update is less than - * minUpdateInterval silently returns. - * Otherwise determines nextUpdate by adding autoUpdateInterval or - * minUpdateInterval to the current time. If neither of the - * intervals are defined nextUpdate will be null. - * Then using specified configuration parameters it formulates new - * CRL, signs it, updates CRLIssuingPointRecord in the database - * and publishes CRL in the directory. + * Updates CRL and publishes it. If time elapsed since last CRL update is + * less than minUpdateInterval silently returns. Otherwise determines + * nextUpdate by adding autoUpdateInterval or minUpdateInterval to the + * current time. If neither of the intervals are defined nextUpdate will be + * null. Then using specified configuration parameters it formulates new + * CRL, signs it, updates CRLIssuingPointRecord in the database and + * publishes CRL in the directory. * <P> */ private void updateCRL() throws EBaseException { /* - if (mEnableUpdateFreq && mAutoUpdateInterval > 0 && - (System.currentTimeMillis() - mLastUpdate.getTime() < - mMinUpdateInterval)) { - // log or alternatively throw an Exception - return; - } - */ + * if (mEnableUpdateFreq && mAutoUpdateInterval > 0 && + * (System.currentTimeMillis() - mLastUpdate.getTime() < + * mMinUpdateInterval)) { // log or alternatively throw an Exception + * return; } + */ if (mDoManualUpdate && mSignatureAlgorithmForManualUpdate != null) { updateCRLNow(mSignatureAlgorithmForManualUpdate); } else { @@ -1820,7 +1826,7 @@ public class CRLIssuingPoint implements ICRLIssuingPoint, Runnable { // get all revoked non-expired certs. if (mEndSerial != null || mBeginSerial != null || mCACertsOnly || - (mProfileCertsOnly && mProfileList != null && mProfileList.size() > 0)) { + (mProfileCertsOnly && mProfileList != null && mProfileList.size() > 0)) { filter = "(&" + filter + ")"; } @@ -1828,27 +1834,27 @@ public class CRLIssuingPoint implements ICRLIssuingPoint, Runnable { } /** - * Gets a enumeration of revoked certs to put into CRL. - * This does not include expired certs. - * <i>Override this method to make a CRL other than the - * full/complete CRL.</i> - * @return Enumeration of CertRecords to put into CRL. + * Gets a enumeration of revoked certs to put into CRL. This does not + * include expired certs. <i>Override this method to make a CRL other than + * the full/complete CRL.</i> + * + * @return Enumeration of CertRecords to put into CRL. * @exception EBaseException if an error occured in the database. */ public void processRevokedCerts(IElementProcessor p) - throws EBaseException { + throws EBaseException { CertRecProcessor cp = (CertRecProcessor) p; String filter = getFilter(); - // NOTE: dangerous cast. + // NOTE: dangerous cast. // correct way would be to modify interface and add // accessor but we don't want to touch the interface - CertificateRepository cr = (CertificateRepository)mCertRepository; + CertificateRepository cr = (CertificateRepository) mCertRepository; synchronized (cr.mCertStatusUpdateThread) { CMS.debug("Starting processRevokedCerts (entered lock)"); ICertRecordList list = mCertRepository.findCertRecordsInList(filter, - new String[] {ICertRecord.ATTR_ID, ICertRecord.ATTR_REVO_INFO, "objectclass" }, + new String[] { ICertRecord.ATTR_ID, ICertRecord.ATTR_REVO_INFO, "objectclass" }, "serialno", mPageSize); @@ -1888,18 +1894,18 @@ public class CRLIssuingPoint implements ICRLIssuingPoint, Runnable { if (mEnableCacheRecovery) { // 553815 - original filter was not aligned with any VLV index // String filter = "(&(requeststate=complete)"+ - // "(|(requestType=" + IRequest.REVOCATION_REQUEST + ")"+ - // "(requestType=" + IRequest.UNREVOCATION_REQUEST + ")))"; + // "(|(requestType=" + IRequest.REVOCATION_REQUEST + ")"+ + // "(requestType=" + IRequest.UNREVOCATION_REQUEST + ")))"; String filter = "(requeststate=complete)"; if (Debug.on()) { - Debug.trace("recoverCRLCache mFirstUnsaved="+mFirstUnsaved+" filter="+filter); + Debug.trace("recoverCRLCache mFirstUnsaved=" + mFirstUnsaved + " filter=" + filter); } IRequestQueue mQueue = mCA.getRequestQueue(); IRequestVirtualList list = mQueue.getPagedRequestsByFilter( new RequestId(mFirstUnsaved), filter, 500, "requestId"); if (Debug.on()) { - Debug.trace("recoverCRLCache size="+list.getSize()+" index="+list.getCurrentIndex()); + Debug.trace("recoverCRLCache size=" + list.getSize() + " index=" + list.getCurrentIndex()); } CertRecProcessor cp = new CertRecProcessor(mCRLCerts, this, mLogger, mAllowExtensions); @@ -1917,20 +1923,20 @@ public class CRLIssuingPoint implements ICRLIssuingPoint, Runnable { continue; } if (Debug.on()) { - Debug.trace("recoverCRLCache request="+request.getRequestId().toString()+ - " type="+request.getRequestType()); + Debug.trace("recoverCRLCache request=" + request.getRequestId().toString() + + " type=" + request.getRequestType()); } if (IRequest.REVOCATION_REQUEST.equals(request.getRequestType())) { RevokedCertImpl revokedCert[] = - request.getExtDataInRevokedCertArray(IRequest.CERT_INFO); + request.getExtDataInRevokedCertArray(IRequest.CERT_INFO); for (int j = 0; j < revokedCert.length; j++) { if (Debug.on()) { - Debug.trace("recoverCRLCache R j="+j+" length="+revokedCert.length+ - " SerialNumber=0x"+revokedCert[j].getSerialNumber().toString(16)); + Debug.trace("recoverCRLCache R j=" + j + " length=" + revokedCert.length + + " SerialNumber=0x" + revokedCert[j].getSerialNumber().toString(16)); } - if(cp != null) - includeCert = cp.checkRevokedCertExtensions(revokedCert[j].getExtensions()); - if(includeCert) { + if (cp != null) + includeCert = cp.checkRevokedCertExtensions(revokedCert[j].getExtensions()); + if (includeCert) { updateRevokedCert(REVOKED_CERT, revokedCert[j].getSerialNumber(), revokedCert[j]); } } @@ -1938,8 +1944,8 @@ public class CRLIssuingPoint implements ICRLIssuingPoint, Runnable { BigInteger serialNo[] = request.getExtDataInBigIntegerArray(IRequest.OLD_SERIALS); for (int j = 0; j < serialNo.length; j++) { if (Debug.on()) { - Debug.trace("recoverCRLCache U j="+j+" length="+serialNo.length+ - " SerialNumber=0x"+serialNo[j].toString(16)); + Debug.trace("recoverCRLCache U j=" + j + " length=" + serialNo.length + + " SerialNumber=0x" + serialNo[j].toString(16)); } updateRevokedCert(UNREVOKED_CERT, serialNo[j], null); } @@ -1972,32 +1978,33 @@ public class CRLIssuingPoint implements ICRLIssuingPoint, Runnable { } private Extension getCRLExtension(String extName) { - if(mAllowExtensions == false) { + if (mAllowExtensions == false) { return null; } - if(mCMSCRLExtensions.isCRLExtensionEnabled(extName) == false) { + if (mCMSCRLExtensions.isCRLExtensionEnabled(extName) == false) { return null; } CMSCRLExtensions exts = (CMSCRLExtensions) this.getCRLExtensions(); CRLExtensions ext = new CRLExtensions(); - + Vector<String> extNames = exts.getCRLExtensionNames(); - for (int i = 0; i < extNames.size(); i++) { - String curName = extNames.elementAt(i); - if (curName.equals(extName)) { - exts.addToCRLExtensions(ext, extName, null); - } - } - Extension theExt = null; - try { - theExt = ext.get(extName); - } catch (Exception e) { + for (int i = 0; i < extNames.size(); i++) { + String curName = extNames.elementAt(i); + if (curName.equals(extName)) { + exts.addToCRLExtensions(ext, extName, null); } + } + Extension theExt = null; + try { + theExt = ext.get(extName); + } catch (Exception e) { + } - CMS.debug("CRLIssuingPoint.getCRLExtension extension: " + theExt); - return theExt; + CMS.debug("CRLIssuingPoint.getCRLExtension extension: " + theExt); + return theExt; } + /** * get required crl entry extensions */ @@ -2021,7 +2028,7 @@ public class CRLIssuingPoint implements ICRLIssuingPoint, Runnable { if (extName.equals(name)) { if (!(ext instanceof CRLReasonExtension) || - (((CRLReasonExtension) ext).getReason().toInt() > + (((CRLReasonExtension) ext).getReason().toInt() > RevocationReason.UNSPECIFIED.toInt())) { mCMSCRLExtensions.addToCRLExtensions(entryExt, extName, ext); } @@ -2057,7 +2064,7 @@ public class CRLIssuingPoint implements ICRLIssuingPoint, Runnable { String requestId) { synchronized (cacheMonitor) { if (requestId != null && mFirstUnsaved != null && - mFirstUnsaved.equals(ICRLIssuingPointRecord.CLEAN_CACHE)) { + mFirstUnsaved.equals(ICRLIssuingPointRecord.CLEAN_CACHE)) { mFirstUnsaved = requestId; try { mCRLRepository.updateFirstUnsaved(mId, mFirstUnsaved); @@ -2072,7 +2079,7 @@ public class CRLIssuingPoint implements ICRLIssuingPoint, Runnable { Date revocationDate = revokedCert.getRevocationDate(); CRLExtensions entryExt = getRequiredEntryExtensions(revokedCert.getExtensions()); RevokedCertImpl newRevokedCert = - new RevokedCertImpl(serialNumber, revocationDate, entryExt); + new RevokedCertImpl(serialNumber, revocationDate, entryExt); mCRLCerts.put(serialNumber, newRevokedCert); } @@ -2080,7 +2087,7 @@ public class CRLIssuingPoint implements ICRLIssuingPoint, Runnable { Date revocationDate = revokedCert.getRevocationDate(); CRLExtensions entryExt = getRequiredEntryExtensions(revokedCert.getExtensions()); RevokedCertImpl newRevokedCert = - new RevokedCertImpl(serialNumber, revocationDate, entryExt); + new RevokedCertImpl(serialNumber, revocationDate, entryExt); mRevokedCerts.put(serialNumber, (RevokedCertificate) newRevokedCert); } @@ -2092,7 +2099,7 @@ public class CRLIssuingPoint implements ICRLIssuingPoint, Runnable { try { entryExt.set(CRLReasonExtension.REMOVE_FROM_CRL.getName(), - CRLReasonExtension.REMOVE_FROM_CRL); + CRLReasonExtension.REMOVE_FROM_CRL); } catch (IOException e) { } RevokedCertImpl newRevokedCert = new RevokedCertImpl(serialNumber, @@ -2116,8 +2123,8 @@ public class CRLIssuingPoint implements ICRLIssuingPoint, Runnable { CertRecProcessor cp = new CertRecProcessor(mCRLCerts, this, mLogger, mAllowExtensions); boolean includeCert = true; - if(cp != null) - includeCert = cp.checkRevokedCertExtensions(revokedCert.getExtensions()); + if (cp != null) + includeCert = cp.checkRevokedCertExtensions(revokedCert.getExtensions()); if (mEnable && mEnableCRLCache && includeCert == true) { updateRevokedCert(REVOKED_CERT, serialNumber, revokedCert, requestId); @@ -2166,7 +2173,7 @@ public class CRLIssuingPoint implements ICRLIssuingPoint, Runnable { try { entryExt.set(CRLReasonExtension.REMOVE_FROM_CRL.getName(), - CRLReasonExtension.REMOVE_FROM_CRL); + CRLReasonExtension.REMOVE_FROM_CRL); } catch (IOException e) { } RevokedCertImpl newRevokedCert = new RevokedCertImpl(serialNumber, @@ -2191,7 +2198,7 @@ public class CRLIssuingPoint implements ICRLIssuingPoint, Runnable { synchronized (repositoryMonitor) { try { mCRLRepository.updateCRLCache(mId, Long.valueOf(mCRLSize), - mRevokedCerts, mUnrevokedCerts, mExpiredCerts); + mRevokedCerts, mUnrevokedCerts, mExpiredCerts); mFirstUnsaved = ICRLIssuingPointRecord.CLEAN_CACHE; } catch (EBaseException e) { log(ILogger.LL_FAILURE, CMS.getLogMessage("CMSCORE_CA_ISSUING_STORE_CRL_CACHE", e.toString())); @@ -2202,8 +2209,7 @@ public class CRLIssuingPoint implements ICRLIssuingPoint, Runnable { public boolean isDeltaCRLEnabled() { return (mAllowExtensions && mEnableCRLCache && mCMSCRLExtensions.isCRLExtensionEnabled(DeltaCRLIndicatorExtension.class.getSimpleName()) && - mCMSCRLExtensions.isCRLExtensionEnabled(CRLNumberExtension.class.getSimpleName()) && - mCMSCRLExtensions.isCRLExtensionEnabled(CRLReasonExtension.class.getSimpleName())); + mCMSCRLExtensions.isCRLExtensionEnabled(CRLNumberExtension.class.getSimpleName()) && mCMSCRLExtensions.isCRLExtensionEnabled(CRLReasonExtension.class.getSimpleName())); } public boolean isThisCurrentDeltaCRL(X509CRLImpl deltaCRL) { @@ -2242,7 +2248,7 @@ public class CRLIssuingPoint implements ICRLIssuingPoint, Runnable { } public boolean isCRLCacheEmpty() { - return ((mCRLCerts != null)? mCRLCerts.isEmpty(): true); + return ((mCRLCerts != null) ? mCRLCerts.isEmpty() : true); } public boolean isCRLCacheTestingEnabled() { @@ -2250,8 +2256,8 @@ public class CRLIssuingPoint implements ICRLIssuingPoint, Runnable { } public Date getRevocationDateFromCache(BigInteger serialNumber, - boolean checkDeltaCache, - boolean includeExpiredCerts) { + boolean checkDeltaCache, + boolean includeExpiredCerts) { Date revocationDate = null; if (mCRLCerts.containsKey(serialNumber)) { @@ -2290,26 +2296,27 @@ public class CRLIssuingPoint implements ICRLIssuingPoint, Runnable { * updates CRL and publishes it now */ public void updateCRLNow() - throws EBaseException { + throws EBaseException { updateCRLNow(null); } public synchronized void updateCRLNow(String signingAlgorithm) - throws EBaseException { + throws EBaseException { - if ((!mEnable) || (!mEnableCRLUpdates && !mDoLastAutoUpdate)) return; + if ((!mEnable) || (!mEnableCRLUpdates && !mDoLastAutoUpdate)) + return; CMS.debug("Updating CRL"); mLogger.log(ILogger.EV_AUDIT, ILogger.S_OTHER, AuditFormat.LEVEL, CMS.getLogMessage("CMSCORE_CA_CA_CRL_UPDATE_STARTED"), new Object[] { - getId(), - getNextCRLNumber(), - Boolean.toString(isDeltaCRLEnabled()), - Boolean.toString(isCRLCacheEnabled()), - Boolean.toString(mEnableCacheRecovery), - Boolean.toString(mCRLCacheIsCleared), - ""+mCRLCerts.size()+","+mRevokedCerts.size()+","+mUnrevokedCerts.size()+","+mExpiredCerts.size()+"" + getId(), + getNextCRLNumber(), + Boolean.toString(isDeltaCRLEnabled()), + Boolean.toString(isCRLCacheEnabled()), + Boolean.toString(mEnableCacheRecovery), + Boolean.toString(mCRLCacheIsCleared), + "" + mCRLCerts.size() + "," + mRevokedCerts.size() + "," + mUnrevokedCerts.size() + "," + mExpiredCerts.size() + "" } ); mUpdatingCRL = CRL_UPDATE_STARTED; @@ -2321,8 +2328,8 @@ public class CRLIssuingPoint implements ICRLIssuingPoint, Runnable { Date nextDeltaUpdate = null; if (mEnableCRLUpdates && ((mEnableDailyUpdates && - mDailyUpdates != null && mTimeListSize > 0) || - (mEnableUpdateFreq && mAutoUpdateInterval > 0))) { + mDailyUpdates != null && mTimeListSize > 0) || + (mEnableUpdateFreq && mAutoUpdateInterval > 0))) { if ((!isDeltaCRLEnabled()) || mSchemaCounter == 0 || mUpdateSchema == 1) { nextUpdate = new Date(findNextUpdate(false, false)); @@ -2332,7 +2339,7 @@ public class CRLIssuingPoint implements ICRLIssuingPoint, Runnable { if (mUpdateSchema > 1 || (mEnableDailyUpdates && mExtendedTimeList && mTimeListSize > 1)) { nextDeltaUpdate = new Date(findNextUpdate(false, true)); if (mExtendedNextUpdate && mSchemaCounter > 0 && - mNextUpdate != null && mNextUpdate.equals(nextDeltaUpdate)) { + mNextUpdate != null && mNextUpdate.equals(nextDeltaUpdate)) { if (mEnableDailyUpdates && mExtendedTimeList && mTimeListSize > 1) { mSchemaCounter = mTimeListSize - 1; } else { @@ -2354,32 +2361,32 @@ public class CRLIssuingPoint implements ICRLIssuingPoint, Runnable { mLastUpdate = thisUpdate; // mNextUpdate = nextUpdate; - mNextDeltaUpdate = (nextDeltaUpdate != null)? new Date(nextDeltaUpdate.getTime()): null; + mNextDeltaUpdate = (nextDeltaUpdate != null) ? new Date(nextDeltaUpdate.getTime()) : null; if (nextUpdate != null) { - nextUpdate.setTime((nextUpdate.getTime())+mNextUpdateGracePeriod); + nextUpdate.setTime((nextUpdate.getTime()) + mNextUpdateGracePeriod); } if (nextDeltaUpdate != null) { - nextDeltaUpdate.setTime((nextDeltaUpdate.getTime())+mNextUpdateGracePeriod); + nextDeltaUpdate.setTime((nextDeltaUpdate.getTime()) + mNextUpdateGracePeriod); } mSplits[0] -= System.currentTimeMillis(); @SuppressWarnings("unchecked") - Hashtable<BigInteger, RevokedCertificate> clonedRevokedCerts = (Hashtable<BigInteger, RevokedCertificate>)mRevokedCerts.clone(); + Hashtable<BigInteger, RevokedCertificate> clonedRevokedCerts = (Hashtable<BigInteger, RevokedCertificate>) mRevokedCerts.clone(); @SuppressWarnings("unchecked") - Hashtable<BigInteger, RevokedCertificate> clonedUnrevokedCerts = (Hashtable<BigInteger, RevokedCertificate>)mUnrevokedCerts.clone(); + Hashtable<BigInteger, RevokedCertificate> clonedUnrevokedCerts = (Hashtable<BigInteger, RevokedCertificate>) mUnrevokedCerts.clone(); @SuppressWarnings("unchecked") - Hashtable<BigInteger, RevokedCertificate> clonedExpiredCerts = (Hashtable<BigInteger, RevokedCertificate> )mExpiredCerts.clone(); + Hashtable<BigInteger, RevokedCertificate> clonedExpiredCerts = (Hashtable<BigInteger, RevokedCertificate>) mExpiredCerts.clone(); mSplits[0] += System.currentTimeMillis(); // starting from the beginning if ((!mEnableCRLCache) || - ((mCRLCacheIsCleared && mCRLCerts.isEmpty() && clonedRevokedCerts.isEmpty() && - clonedUnrevokedCerts.isEmpty() && clonedExpiredCerts.isEmpty()) || - (mCRLCerts.isEmpty() && (!clonedUnrevokedCerts.isEmpty())) || - (mCRLCerts.size() < clonedUnrevokedCerts.size()) || - (mCRLCerts.isEmpty() && (mCRLSize > 0)) || + ((mCRLCacheIsCleared && mCRLCerts.isEmpty() && clonedRevokedCerts.isEmpty() && + clonedUnrevokedCerts.isEmpty() && clonedExpiredCerts.isEmpty()) || + (mCRLCerts.isEmpty() && (!clonedUnrevokedCerts.isEmpty())) || + (mCRLCerts.size() < clonedUnrevokedCerts.size()) || + (mCRLCerts.isEmpty() && (mCRLSize > 0)) || (mCRLCerts.size() > 0 && mCRLSize == 0))) { mSplits[5] -= System.currentTimeMillis(); @@ -2390,15 +2397,15 @@ public class CRLIssuingPoint implements ICRLIssuingPoint, Runnable { clonedExpiredCerts.clear(); mSchemaCounter = 0; - IStatsSubsystem statsSub = (IStatsSubsystem)CMS.getSubsystem("stats"); + IStatsSubsystem statsSub = (IStatsSubsystem) CMS.getSubsystem("stats"); if (statsSub != null) { - statsSub.startTiming("generation"); + statsSub.startTiming("generation"); } CertRecProcessor cp = new CertRecProcessor(mCRLCerts, this, mLogger, mAllowExtensions); processRevokedCerts(cp); if (statsSub != null) { - statsSub.endTiming("generation"); + statsSub.endTiming("generation"); } mCRLCacheIsCleared = false; @@ -2407,7 +2414,7 @@ public class CRLIssuingPoint implements ICRLIssuingPoint, Runnable { if (isDeltaCRLEnabled()) { mSplits[1] -= System.currentTimeMillis(); @SuppressWarnings("unchecked") - Hashtable<BigInteger, RevokedCertificate> deltaCRLCerts = (Hashtable<BigInteger, RevokedCertificate> )clonedRevokedCerts.clone(); + Hashtable<BigInteger, RevokedCertificate> deltaCRLCerts = (Hashtable<BigInteger, RevokedCertificate>) clonedRevokedCerts.clone(); deltaCRLCerts.putAll(clonedUnrevokedCerts); if (mIncludeExpiredCertsOneExtraTime) { @@ -2415,8 +2422,8 @@ public class CRLIssuingPoint implements ICRLIssuingPoint, Runnable { for (Enumeration<BigInteger> e = clonedExpiredCerts.keys(); e.hasMoreElements();) { BigInteger serialNumber = e.nextElement(); if ((mLastFullUpdate != null && - mLastFullUpdate.after((mExpiredCerts.get(serialNumber)).getRevocationDate())) || - mLastFullUpdate == null) { + mLastFullUpdate.after((mExpiredCerts.get(serialNumber)).getRevocationDate())) || + mLastFullUpdate == null) { deltaCRLCerts.put(serialNumber, clonedExpiredCerts.get(serialNumber)); } } @@ -2434,7 +2441,7 @@ public class CRLIssuingPoint implements ICRLIssuingPoint, Runnable { String extName = extNames.elementAt(i); if (mCMSCRLExtensions.isCRLExtensionEnabled(extName) && - (!extName.equals(FreshestCRLExtension.class.getSimpleName()))) { + (!extName.equals(FreshestCRLExtension.class.getSimpleName()))) { mCMSCRLExtensions.addToCRLExtensions(ext, extName, null); } } @@ -2447,7 +2454,7 @@ public class CRLIssuingPoint implements ICRLIssuingPoint, Runnable { byte[] newDeltaCRL; // #56123 - dont generate CRL if no revoked certificates - if (mConfigStore.getBoolean("noCRLIfNoRevokedCert", false)) { + if (mConfigStore.getBoolean("noCRLIfNoRevokedCert", false)) { if (deltaCRLCerts.size() == 0) { CMS.debug("CRLIssuingPoint: No Revoked Certificates Found And noCRLIfNoRevokedCert is set to true - No Delta CRL Generated"); throw new EBaseException(CMS.getUserMessage("CMS_BASE_INTERNAL_ERROR", "No Revoked Certificates")); @@ -2468,12 +2475,12 @@ public class CRLIssuingPoint implements ICRLIssuingPoint, Runnable { mDeltaCRLSize = deltaCRLCerts.size(); - long totalTime = 0; String splitTimes = " ("; for (int i = 1; i < mSplits.length && i < 5; i++) { totalTime += mSplits[i]; - if (i > 1) splitTimes += ","; + if (i > 1) + splitTimes += ","; splitTimes += Long.toString(mSplits[i]); } splitTimes += ")"; @@ -2481,13 +2488,13 @@ public class CRLIssuingPoint implements ICRLIssuingPoint, Runnable { AuditFormat.LEVEL, CMS.getLogMessage("CMSCORE_CA_CA_DELTA_CRL_UPDATED"), new Object[] { - getId(), - getNextCRLNumber(), - getCRLNumber(), - getLastUpdate(), - getNextDeltaUpdate(), - Long.toString(mDeltaCRLSize), - Long.toString(totalTime)+splitTimes + getId(), + getNextCRLNumber(), + getCRLNumber(), + getLastUpdate(), + getNextDeltaUpdate(), + Long.toString(mDeltaCRLSize), + Long.toString(totalTime) + splitTimes } ); } catch (EBaseException e) { @@ -2513,7 +2520,7 @@ public class CRLIssuingPoint implements ICRLIssuingPoint, Runnable { mSplits[4] += System.currentTimeMillis(); } catch (EBaseException e) { newX509DeltaCRL = null; - if (Debug.on()) + if (Debug.on()) Debug.printStackTrace(e); log(ILogger.LL_FAILURE, CMS.getLogMessage("CMSCORE_CA_ISSUING_PUBLISH_DELTA", mCRLNumber.toString(), e.toString())); } catch (OutOfMemoryError e) { @@ -2528,8 +2535,8 @@ public class CRLIssuingPoint implements ICRLIssuingPoint, Runnable { if (mSchemaCounter == 0) { if (((!mCRLCerts.isEmpty()) && ((!clonedRevokedCerts.isEmpty()) || - (!clonedUnrevokedCerts.isEmpty()) || (!clonedExpiredCerts.isEmpty()))) || - (mCRLCerts.isEmpty() && (mCRLSize == 0) && (!clonedRevokedCerts.isEmpty()))) { + (!clonedUnrevokedCerts.isEmpty()) || (!clonedExpiredCerts.isEmpty()))) || + (mCRLCerts.isEmpty() && (mCRLSize == 0) && (!clonedRevokedCerts.isEmpty()))) { if (!clonedUnrevokedCerts.isEmpty()) { for (Enumeration<BigInteger> e = clonedUnrevokedCerts.keys(); e.hasMoreElements();) { @@ -2556,9 +2563,9 @@ public class CRLIssuingPoint implements ICRLIssuingPoint, Runnable { BigInteger serialNumber = e.nextElement(); if ((!mIncludeExpiredCertsOneExtraTime) || - (mLastFullUpdate != null && - mLastFullUpdate.after((mExpiredCerts.get(serialNumber)).getRevocationDate())) || - mLastFullUpdate == null) { + (mLastFullUpdate != null && + mLastFullUpdate.after((mExpiredCerts.get(serialNumber)).getRevocationDate())) || + mLastFullUpdate == null) { if (mCRLCerts.containsKey(serialNumber)) { mCRLCerts.remove(serialNumber); } @@ -2595,7 +2602,7 @@ public class CRLIssuingPoint implements ICRLIssuingPoint, Runnable { String extName = extNames.elementAt(i); if (mCMSCRLExtensions.isCRLExtensionEnabled(extName) && - (!extName.equals(DeltaCRLIndicatorExtension.class.getSimpleName()))) { + (!extName.equals(DeltaCRLIndicatorExtension.class.getSimpleName()))) { mCMSCRLExtensions.addToCRLExtensions(ext, extName, null); } } @@ -2609,16 +2616,16 @@ public class CRLIssuingPoint implements ICRLIssuingPoint, Runnable { byte[] newCRL; CMS.debug("Making CRL with algorithm " + - signingAlgorithm + " " + AlgorithmId.get(signingAlgorithm)); + signingAlgorithm + " " + AlgorithmId.get(signingAlgorithm)); mSplits[7] -= System.currentTimeMillis(); // #56123 - dont generate CRL if no revoked certificates - if (mConfigStore.getBoolean("noCRLIfNoRevokedCert", false)) { - if (mCRLCerts.size() == 0) { - CMS.debug("CRLIssuingPoint: No Revoked Certificates Found And noCRLIfNoRevokedCert is set to true - No CRL Generated"); - throw new EBaseException(CMS.getUserMessage("CMS_BASE_INTERNAL_ERROR", "No Revoked Certificates")); - } + if (mConfigStore.getBoolean("noCRLIfNoRevokedCert", false)) { + if (mCRLCerts.size() == 0) { + CMS.debug("CRLIssuingPoint: No Revoked Certificates Found And noCRLIfNoRevokedCert is set to true - No CRL Generated"); + throw new EBaseException(CMS.getUserMessage("CMS_BASE_INTERNAL_ERROR", "No Revoked Certificates")); + } } CMS.debug("before new X509CRLImpl"); X509CRLImpl crl = new X509CRLImpl(mCA.getCRLX500Name(), @@ -2637,19 +2644,19 @@ public class CRLIssuingPoint implements ICRLIssuingPoint, Runnable { Date nextUpdateDate = mNextUpdate; if (isDeltaCRLEnabled() && (mUpdateSchema > 1 || - (mEnableDailyUpdates && mExtendedTimeList)) && mNextDeltaUpdate != null) { + (mEnableDailyUpdates && mExtendedTimeList)) && mNextDeltaUpdate != null) { nextUpdateDate = mNextDeltaUpdate; } if (mSaveMemory) { mCRLRepository.updateCRLIssuingPointRecord( - mId, newCRL, thisUpdate, nextUpdateDate, - mNextCRLNumber, Long.valueOf(mCRLCerts.size())); + mId, newCRL, thisUpdate, nextUpdateDate, + mNextCRLNumber, Long.valueOf(mCRLCerts.size())); updateCRLCacheRepository(); } else { mCRLRepository.updateCRLIssuingPointRecord( - mId, newCRL, thisUpdate, nextUpdateDate, - mNextCRLNumber, Long.valueOf(mCRLCerts.size()), - mRevokedCerts, mUnrevokedCerts, mExpiredCerts); + mId, newCRL, thisUpdate, nextUpdateDate, + mNextCRLNumber, Long.valueOf(mCRLCerts.size()), + mRevokedCerts, mUnrevokedCerts, mExpiredCerts); mFirstUnsaved = ICRLIssuingPointRecord.CLEAN_CACHE; } @@ -2661,11 +2668,10 @@ public class CRLIssuingPoint implements ICRLIssuingPoint, Runnable { mNextCRLNumber = mCRLNumber.add(BigInteger.ONE); mNextDeltaCRLNumber = mNextCRLNumber; - CMS.debug("Logging CRL Update to transaction log"); - long totalTime = 0; - long crlTime = 0; - long deltaTime = 0; + long totalTime = 0; + long crlTime = 0; + long deltaTime = 0; String splitTimes = " ("; for (int i = 0; i < mSplits.length; i++) { totalTime += mSplits[i]; @@ -2674,22 +2680,23 @@ public class CRLIssuingPoint implements ICRLIssuingPoint, Runnable { } else { crlTime += mSplits[i]; } - if (i > 0) splitTimes += ","; + if (i > 0) + splitTimes += ","; splitTimes += Long.toString(mSplits[i]); } splitTimes += "," + Long.toString(deltaTime) + "," + Long.toString(crlTime) + "," + Long.toString(totalTime) + ")"; mLogger.log(ILogger.EV_AUDIT, ILogger.S_OTHER, AuditFormat.LEVEL, CMS.getLogMessage("CMSCORE_CA_CA_CRL_UPDATED"), - new Object[] { - getId(), - getCRLNumber(), - getLastUpdate(), - getNextUpdate(), - Long.toString(mCRLSize), - Long.toString(totalTime), - Long.toString(crlTime), - Long.toString(deltaTime)+splitTimes + new Object[] { + getId(), + getCRLNumber(), + getLastUpdate(), + getNextUpdate(), + Long.toString(mCRLSize), + Long.toString(totalTime), + Long.toString(crlTime), + Long.toString(deltaTime) + splitTimes } ); CMS.debug("Finished Logging CRL Update to transaction log"); @@ -2697,7 +2704,7 @@ public class CRLIssuingPoint implements ICRLIssuingPoint, Runnable { } catch (EBaseException e) { newX509CRL = null; mUpdatingCRL = CRL_UPDATE_DONE; - if (Debug.on()) + if (Debug.on()) Debug.printStackTrace(e); log(ILogger.LL_FAILURE, CMS.getLogMessage("CMSCORE_CA_ISSUING_SIGN_OR_STORE_CRL", e.toString())); throw new ECAException(CMS.getUserMessage("CMS_CA_FAILED_CONSTRUCTING_CRL", e.toString())); @@ -2744,10 +2751,12 @@ public class CRLIssuingPoint implements ICRLIssuingPoint, Runnable { mDeltaCRLNumber = mNextDeltaCRLNumber; mNextDeltaCRLNumber = mDeltaCRLNumber.add(BigInteger.ONE); } - - if ((!(mEnableDailyUpdates && mExtendedTimeList)) || mSchemaCounter == 0) mSchemaCounter++; + + if ((!(mEnableDailyUpdates && mExtendedTimeList)) || mSchemaCounter == 0) + mSchemaCounter++; if ((mEnableDailyUpdates && mExtendedTimeList && mSchemaCounter >= mTimeListSize) || - (mUpdateSchema > 1 && mSchemaCounter >= mUpdateSchema)) mSchemaCounter = 0; + (mUpdateSchema > 1 && mSchemaCounter >= mUpdateSchema)) + mSchemaCounter = 0; mLastDay = mCurrentDay; mUpdatingCRL = CRL_UPDATE_DONE; @@ -2758,34 +2767,33 @@ public class CRLIssuingPoint implements ICRLIssuingPoint, Runnable { * publish CRL. called from updateCRLNow() and init(). */ - public void publishCRL() - throws EBaseException { + public void publishCRL() + throws EBaseException { publishCRL(null); } - protected void publishCRL(X509CRLImpl x509crl) - throws EBaseException { + protected void publishCRL(X509CRLImpl x509crl) + throws EBaseException { publishCRL(x509crl, false); } - + /* - * The Session Context is a Hashtable, but without type information. - * Suppress the warnings generated by adding to the session context - * + * The Session Context is a Hashtable, but without type information. + * Suppress the warnings generated by adding to the session context */ - protected void publishCRL(X509CRLImpl x509crl, boolean isDeltaCRL) - throws EBaseException { + protected void publishCRL(X509CRLImpl x509crl, boolean isDeltaCRL) + throws EBaseException { SessionContext sc = SessionContext.getContext(); - IStatsSubsystem statsSub = (IStatsSubsystem)CMS.getSubsystem("stats"); + IStatsSubsystem statsSub = (IStatsSubsystem) CMS.getSubsystem("stats"); if (statsSub != null) { - statsSub.startTiming("crl_publishing"); + statsSub.startTiming("crl_publishing"); } if (mCountMod == 0) { - sc.put(SC_CRL_COUNT, Integer.toString(mCount)); + sc.put(SC_CRL_COUNT, Integer.toString(mCount)); } else { - sc.put(SC_CRL_COUNT, Integer.toString(mCount%mCountMod)); + sc.put(SC_CRL_COUNT, Integer.toString(mCount % mCountMod)); } mCount++; sc.put(SC_ISSUING_POINT_ID, mId); @@ -2810,7 +2818,7 @@ public class CRLIssuingPoint implements ICRLIssuingPoint, Runnable { } } if (x509crl != null && - mPublisherProcessor != null && mPublisherProcessor.enabled()) { + mPublisherProcessor != null && mPublisherProcessor.enabled()) { Enumeration<ILdapRule> rules = mPublisherProcessor.getRules(IPublisherProcessor.PROP_LOCAL_CRL); if (rules == null || !rules.hasMoreElements()) { CMS.debug("CRL publishing is not enabled."); @@ -2819,7 +2827,7 @@ public class CRLIssuingPoint implements ICRLIssuingPoint, Runnable { mPublisherProcessor.publishCRL(mPublishDN, x509crl); CMS.debug("CRL published to " + mPublishDN); } else { - mPublisherProcessor.publishCRL(x509crl,getId()); + mPublisherProcessor.publishCRL(x509crl, getId()); CMS.debug("CRL published."); } } @@ -2830,15 +2838,15 @@ public class CRLIssuingPoint implements ICRLIssuingPoint, Runnable { throw new EErrorPublishCRL( CMS.getUserMessage("CMS_CA_ERROR_PUBLISH_CRL", mId, e.toString())); } finally { - if (statsSub != null) { - statsSub.endTiming("crl_publishing"); - } + if (statsSub != null) { + statsSub.endTiming("crl_publishing"); + } } } protected void log(int level, String msg) { - mLogger.log(ILogger.EV_SYSTEM, null, ILogger.S_CA, level, - "CRLIssuingPoint " + mId + " - " + msg); + mLogger.log(ILogger.EV_SYSTEM, null, ILogger.S_CA, level, + "CRLIssuingPoint " + mId + " - " + msg); } void setConfigParam(String name, String value) { @@ -2848,7 +2856,7 @@ public class CRLIssuingPoint implements ICRLIssuingPoint, Runnable { class RevocationRequestListener implements IRequestListener { public void init(ISubsystem sys, IConfigStore config) - throws EBaseException { + throws EBaseException { } public void set(String name, String val) { @@ -2858,36 +2866,36 @@ public class CRLIssuingPoint implements ICRLIssuingPoint, Runnable { String requestType = r.getRequestType(); if (requestType.equals(IRequest.REVOCATION_REQUEST) || - requestType.equals(IRequest.UNREVOCATION_REQUEST) || - requestType.equals(IRequest.CLA_CERT4CRL_REQUEST) || - requestType.equals(IRequest.CLA_UNCERT4CRL_REQUEST)) { + requestType.equals(IRequest.UNREVOCATION_REQUEST) || + requestType.equals(IRequest.CLA_CERT4CRL_REQUEST) || + requestType.equals(IRequest.CLA_UNCERT4CRL_REQUEST)) { CMS.debug("Revocation listener called."); // check if serial number is in begin/end range if set. if (mBeginSerial != null || mEndSerial != null) { CMS.debug( - "Checking if serial number is between " + - mBeginSerial + " and " + mEndSerial); - BigInteger[] serialNos = - r.getExtDataInBigIntegerArray(IRequest.OLD_SERIALS); + "Checking if serial number is between " + + mBeginSerial + " and " + mEndSerial); + BigInteger[] serialNos = + r.getExtDataInBigIntegerArray(IRequest.OLD_SERIALS); if (serialNos == null || serialNos.length == 0) { - X509CertImpl oldCerts[] = - r.getExtDataInCertArray(IRequest.OLD_CERTS); + X509CertImpl oldCerts[] = + r.getExtDataInCertArray(IRequest.OLD_CERTS); - if (oldCerts == null || oldCerts.length == 0) + if (oldCerts == null || oldCerts.length == 0) return; serialNos = new BigInteger[oldCerts.length]; for (int i = 0; i < oldCerts.length; i++) { serialNos[i] = oldCerts[i].getSerialNumber(); } } - + boolean inRange = false; for (int i = 0; i < serialNos.length; i++) { - if ((mBeginSerial == null || + if ((mBeginSerial == null || serialNos[i].compareTo(mBeginSerial) >= 0) && - (mEndSerial == null || + (mEndSerial == null || serialNos[i].compareTo(mEndSerial) <= 0)) { inRange = true; } @@ -2921,8 +2929,8 @@ public class CRLIssuingPoint implements ICRLIssuingPoint, Runnable { Debug.printStackTrace(e); r.setExtData(mCrlUpdateStatus, IRequest.RES_ERROR); r.setExtData(mCrlUpdateError, - new EBaseException( - CMS.getUserMessage("CMS_BASE_INTERNAL_ERROR", e.toString()))); + new EBaseException( + CMS.getUserMessage("CMS_BASE_INTERNAL_ERROR", e.toString()))); } } } @@ -2930,7 +2938,6 @@ public class CRLIssuingPoint implements ICRLIssuingPoint, Runnable { } } - class CertRecProcessor implements IElementProcessor { private Hashtable<BigInteger, RevokedCertificate> mCRLCerts = null; private boolean mAllowExtensions = false; @@ -2947,101 +2954,100 @@ class CertRecProcessor implements IElementProcessor { mIP = ip; mAllowExtensions = allowExtensions; mIssuingDistPointAttempted = false; - mIssuingDistPointEnabled = false; + mIssuingDistPointEnabled = false; mOnlySomeReasons = null; } private boolean initCRLIssuingDistPointExtension() { - boolean result = false; - CMSCRLExtensions exts = null; - - if(mIssuingDistPointAttempted == true) { - if((mIssuingDistPointEnabled == true) && (mOnlySomeReasons != null )) { - return true; - } else { - return false; - } - } - - mIssuingDistPointAttempted = true; - exts = (CMSCRLExtensions) mIP.getCRLExtensions(); - if(exts == null) { - return result; - } - boolean isIssuingDistPointExtEnabled = false; - isIssuingDistPointExtEnabled = exts.isCRLExtensionEnabled(IssuingDistributionPointExtension.class.getSimpleName()); - if(isIssuingDistPointExtEnabled == false) { + boolean result = false; + CMSCRLExtensions exts = null; + + if (mIssuingDistPointAttempted == true) { + if ((mIssuingDistPointEnabled == true) && (mOnlySomeReasons != null)) { + return true; + } else { + return false; + } + } + + mIssuingDistPointAttempted = true; + exts = (CMSCRLExtensions) mIP.getCRLExtensions(); + if (exts == null) { + return result; + } + boolean isIssuingDistPointExtEnabled = false; + isIssuingDistPointExtEnabled = exts.isCRLExtensionEnabled(IssuingDistributionPointExtension.class.getSimpleName()); + if (isIssuingDistPointExtEnabled == false) { mIssuingDistPointEnabled = false; return false; } mIssuingDistPointEnabled = true; - //Get info out of the IssuingDistPointExtension + // Get info out of the IssuingDistPointExtension CRLExtensions ext = new CRLExtensions(); Vector<String> extNames = exts.getCRLExtensionNames(); - for (int i = 0; i < extNames.size(); i++) { - String extName = extNames.elementAt(i); - if (extName.equals(IssuingDistributionPointExtension.class.getSimpleName())) { - exts.addToCRLExtensions(ext, extName, null); - } - } - Extension issuingDistExt = null; - try { - issuingDistExt = ext.get(IssuingDistributionPointExtension.class.getSimpleName()); - } catch (Exception e) { + for (int i = 0; i < extNames.size(); i++) { + String extName = extNames.elementAt(i); + if (extName.equals(IssuingDistributionPointExtension.class.getSimpleName())) { + exts.addToCRLExtensions(ext, extName, null); } + } + Extension issuingDistExt = null; + try { + issuingDistExt = ext.get(IssuingDistributionPointExtension.class.getSimpleName()); + } catch (Exception e) { + } - IssuingDistributionPointExtension iExt = null; - if(issuingDistExt != null) - iExt = (IssuingDistributionPointExtension) issuingDistExt; - IssuingDistributionPoint issuingDistributionPoint = null; - if(iExt != null) - issuingDistributionPoint = iExt.getIssuingDistributionPoint(); + IssuingDistributionPointExtension iExt = null; + if (issuingDistExt != null) + iExt = (IssuingDistributionPointExtension) issuingDistExt; + IssuingDistributionPoint issuingDistributionPoint = null; + if (iExt != null) + issuingDistributionPoint = iExt.getIssuingDistributionPoint(); - BitArray onlySomeReasons = null; + BitArray onlySomeReasons = null; - if(issuingDistributionPoint != null) - onlySomeReasons = issuingDistributionPoint.getOnlySomeReasons(); + if (issuingDistributionPoint != null) + onlySomeReasons = issuingDistributionPoint.getOnlySomeReasons(); - boolean applyReasonMatch = false; - boolean reasonMatch = true; + boolean applyReasonMatch = false; + boolean reasonMatch = true; - if(onlySomeReasons != null) { - applyReasonMatch = !onlySomeReasons.toString().equals("0000000"); - CMS.debug("applyReasonMatch " + applyReasonMatch); - if(applyReasonMatch == true) { - mOnlySomeReasons = onlySomeReasons; - result = true; - } + if (onlySomeReasons != null) { + applyReasonMatch = !onlySomeReasons.toString().equals("0000000"); + CMS.debug("applyReasonMatch " + applyReasonMatch); + if (applyReasonMatch == true) { + mOnlySomeReasons = onlySomeReasons; + result = true; } - return result; + } + return result; } - private boolean checkOnlySomeReasonsExtension(CRLExtensions entryExts) - { + private boolean checkOnlySomeReasonsExtension(CRLExtensions entryExts) { boolean includeCert = true; - //This is exactly how the Pretty Print code obtains the reason code - //through the extensions - if(entryExts == null) { + // This is exactly how the Pretty Print code obtains the reason code + // through the extensions + if (entryExts == null) { return includeCert; } Extension crlReasonExt = null; try { - crlReasonExt = entryExts.get(CRLReasonExtension.class.getSimpleName()); + crlReasonExt = entryExts.get(CRLReasonExtension.class.getSimpleName()); } catch (Exception e) { return includeCert; } RevocationReason reason = null; int reasonIndex = 0; - if(crlReasonExt != null) { + if (crlReasonExt != null) { try { - CRLReasonExtension theReason = (CRLReasonExtension) crlReasonExt; - reason = (RevocationReason) theReason.get("value"); - reasonIndex = reason.toInt(); - CMS.debug("revoked reason " + reason); + CRLReasonExtension theReason = (CRLReasonExtension) crlReasonExt; + reason = (RevocationReason) theReason.get("value"); + reasonIndex = reason.toInt(); + CMS.debug("revoked reason " + reason); } catch (Exception e) { return includeCert; } @@ -3049,37 +3055,37 @@ class CertRecProcessor implements IElementProcessor { return includeCert; } boolean reasonMatch = false; - if(reason != null) { - if(mOnlySomeReasons != null) { + if (reason != null) { + if (mOnlySomeReasons != null) { reasonMatch = mOnlySomeReasons.get(reasonIndex); - if(reasonMatch != true) { + if (reasonMatch != true) { includeCert = false; } else { CMS.debug("onlySomeReasons match! reason: " + reason); } } } - + return includeCert; } - public boolean checkRevokedCertExtensions(CRLExtensions crlExtensions) - { - //For now just check the onlySomeReason CRL IssuingDistributionPoint extension + public boolean checkRevokedCertExtensions(CRLExtensions crlExtensions) { + // For now just check the onlySomeReason CRL IssuingDistributionPoint + // extension - boolean includeCert = true; - if((crlExtensions == null) || (mAllowExtensions == false)) { + boolean includeCert = true; + if ((crlExtensions == null) || (mAllowExtensions == false)) { return includeCert; } boolean inited = initCRLIssuingDistPointExtension(); - //If the CRLIssuingDistPointExtension is not available or + // If the CRLIssuingDistPointExtension is not available or // if onlySomeReasons does not apply, bail. - if(inited == false) { + if (inited == false) { return includeCert; - } + } - //Check the onlySomeReasonsExtension + // Check the onlySomeReasonsExtension includeCert = checkOnlySomeReasonsExtension(crlExtensions); return includeCert; @@ -3099,22 +3105,21 @@ class CertRecProcessor implements IElementProcessor { entryExt = mIP.getRequiredEntryExtensions(crlExts); } RevokedCertificate newRevokedCert = - new RevokedCertImpl(serialNumber, revocationDate, entryExt); + new RevokedCertImpl(serialNumber, revocationDate, entryExt); boolean includeCert = checkRevokedCertExtensions(crlExts); if (includeCert == true) { mCRLCerts.put(serialNumber, (RevokedCertificate) newRevokedCert); if (serialNumber != null) { - CMS.debug("Putting certificate serial: 0x"+serialNumber.toString(16)+" into CRL hashtable"); + CMS.debug("Putting certificate serial: 0x" + serialNumber.toString(16) + " into CRL hashtable"); } } } catch (EBaseException e) { CMS.debug( - "CA failed constructing CRL entry: " + - (mCRLCerts.size() + 1) + " " + e); + "CA failed constructing CRL entry: " + + (mCRLCerts.size() + 1) + " " + e); throw new ECAException(CMS.getUserMessage("CMS_CA_FAILED_CONSTRUCTING_CRL", e.toString())); } } } - diff --git a/pki/base/ca/src/com/netscape/ca/CRLWithExpiredCerts.java b/pki/base/ca/src/com/netscape/ca/CRLWithExpiredCerts.java index bb204386..8b756a4a 100644 --- a/pki/base/ca/src/com/netscape/ca/CRLWithExpiredCerts.java +++ b/pki/base/ca/src/com/netscape/ca/CRLWithExpiredCerts.java @@ -17,44 +17,42 @@ // --- END COPYRIGHT BLOCK --- package com.netscape.ca; - import java.math.BigInteger; import com.netscape.certsrv.base.EBaseException; import com.netscape.cmscore.dbs.CertRecord; - /** - * A CRL Issuing point that contains revoked certs, include onces that - * have expired. + * A CRL Issuing point that contains revoked certs, include onces that have + * expired. */ public class CRLWithExpiredCerts extends CRLIssuingPoint { /** - * overrides getRevokedCerts in CRLIssuingPoint to include - * all revoked certs, including once that have expired. - * + * overrides getRevokedCerts in CRLIssuingPoint to include all revoked + * certs, including once that have expired. + * * @param thisUpdate parameter is ignored. - * + * * @exception EBaseException if an exception occured getting revoked - * certificates from the database. + * certificates from the database. */ public String getFilter() { // PLEASE DONT CHANGE THE FILTER. It is indexed. // Changing it will degrade performance. See // also com.netscape.certsetup.LDAPUtil.java String filter = - "(|(" + CertRecord.ATTR_CERT_STATUS + "=" + - CertRecord.STATUS_REVOKED + ")" + - "(" + CertRecord.ATTR_CERT_STATUS + "=" + - CertRecord.STATUS_REVOKED_EXPIRED + "))"; + "(|(" + CertRecord.ATTR_CERT_STATUS + "=" + + CertRecord.STATUS_REVOKED + ")" + + "(" + CertRecord.ATTR_CERT_STATUS + "=" + + CertRecord.STATUS_REVOKED_EXPIRED + "))"; // check if any ranges specified. - if (mBeginSerial != null) + if (mBeginSerial != null) filter += "(" + CertRecord.ATTR_ID + ">=" + mBeginSerial.toString() + ")"; if (mEndSerial != null) filter += "(" + CertRecord.ATTR_ID + "<=" + mEndSerial.toString() + ")"; - // get all revoked non-expired certs. + // get all revoked non-expired certs. if (mEndSerial != null || mBeginSerial != null) { filter = "(&" + filter + ")"; } diff --git a/pki/base/ca/src/com/netscape/ca/CertificateAuthority.java b/pki/base/ca/src/com/netscape/ca/CertificateAuthority.java index 657ed72c..ccd0af39 100644 --- a/pki/base/ca/src/com/netscape/ca/CertificateAuthority.java +++ b/pki/base/ca/src/com/netscape/ca/CertificateAuthority.java @@ -17,7 +17,6 @@ // --- END COPYRIGHT BLOCK --- package com.netscape.ca; - import java.io.ByteArrayInputStream; import java.io.File; import java.io.FileInputStream; @@ -117,12 +116,11 @@ import com.netscape.cmsutil.ocsp.SingleResponse; import com.netscape.cmsutil.ocsp.TBSRequest; import com.netscape.cmsutil.ocsp.UnknownInfo; - /** - * A class represents a Certificate Authority that is - * responsible for certificate specific operations. + * A class represents a Certificate Authority that is responsible for + * certificate specific operations. * <P> - * + * * @author lhsiao * @version $Revision$, $Date$ */ @@ -134,8 +132,8 @@ public class CertificateAuthority implements ICertificateAuthority, ICertAuthori protected ISubsystem mOwner = null; protected IConfigStore mConfig = null; protected ILogger mLogger = CMS.getLogger(); - protected Hashtable<String, ICRLIssuingPoint> mCRLIssuePoints = new Hashtable<String, ICRLIssuingPoint>(); - protected CRLIssuingPoint mMasterCRLIssuePoint = null; // the complete crl. + protected Hashtable<String, ICRLIssuingPoint> mCRLIssuePoints = new Hashtable<String, ICRLIssuingPoint>(); + protected CRLIssuingPoint mMasterCRLIssuePoint = null; // the complete crl. protected SigningUnit mSigningUnit; protected SigningUnit mOCSPSigningUnit; protected SigningUnit mCRLSigningUnit; @@ -143,8 +141,8 @@ public class CertificateAuthority implements ICertificateAuthority, ICertAuthori protected X500Name mName = null; protected X500Name mCRLName = null; protected X500Name mOCSPName = null; - protected String mNickname = null; // nickname of CA signing cert. - protected String mOCSPNickname = null; // nickname of OCSP signing cert. + protected String mNickname = null; // nickname of CA signing cert. + protected String mOCSPNickname = null; // nickname of OCSP signing cert. protected long mCertSerialNumberCounter = System.currentTimeMillis(); protected long mRequestID = System.currentTimeMillis(); @@ -185,7 +183,7 @@ public class CertificateAuthority implements ICertificateAuthority, ICertAuthori protected boolean mEnableOCSP; protected int mFastSigning = FASTSIGNING_DISABLED; - protected static final long SECOND = 1000; // 1000 milliseconds + protected static final long SECOND = 1000; // 1000 milliseconds protected static final long MINUTE = 60 * SECOND; protected static final long HOUR = 60 * MINUTE; protected static final long DAY = 24 * HOUR; @@ -197,7 +195,7 @@ public class CertificateAuthority implements ICertificateAuthority, ICertAuthori // for the notification listeners - /** + /** * Package constants */ @@ -261,12 +259,12 @@ public class CertificateAuthority implements ICertificateAuthority, ICertAuthori } } - public void publishCRLNow() throws EBaseException { if (mMasterCRLIssuePoint != null) { mMasterCRLIssuePoint.publishCRL(); } } + public ICRLPublisher getCRLPublisher() { return mCRLPublisher; } @@ -286,7 +284,7 @@ public class CertificateAuthority implements ICertificateAuthority, ICertAuthori /** * Initializes this CA subsystem. * <P> - * + * * @param owner owner of this subsystem * @param config configuration of this subsystem * @exception EBaseException failed to initialize this CA @@ -294,97 +292,97 @@ public class CertificateAuthority implements ICertificateAuthority, ICertAuthori public void init(ISubsystem owner, IConfigStore config) throws EBaseException { - try { - CMS.debug("CertificateAuthority init "); - mOwner = owner; - mConfig = config; + try { + CMS.debug("CertificateAuthority init "); + mOwner = owner; + mConfig = config; - // init cert & crl database. - initCaDatabases(); + // init cert & crl database. + initCaDatabases(); - // init signing unit & CA cert. - try { - initSigUnit(); - // init default CA attributes like cert version, validity. - initDefCaAttrs(); - } catch (EBaseException e) { - if (CMS.isPreOpMode()) - ; - else - throw e; - } + // init signing unit & CA cert. + try { + initSigUnit(); + // init default CA attributes like cert version, validity. + initDefCaAttrs(); + } catch (EBaseException e) { + if (CMS.isPreOpMode()) + ; + else + throw e; + } - // init web gateway. - initWebGateway(); + // init web gateway. + initWebGateway(); - mUseNonces = mConfig.getBoolean("enableNonces", true); - mMaxNonces = mConfig.getInteger("maxNumberOfNonces", 100); - if (mUseNonces) { - mNonces = new Nonces(mMaxNonces); - CMS.debug("CertificateAuthority init: Nonces enabled. ("+mNonces.size()+")"); - } + mUseNonces = mConfig.getBoolean("enableNonces", true); + mMaxNonces = mConfig.getInteger("maxNumberOfNonces", 100); + if (mUseNonces) { + mNonces = new Nonces(mMaxNonces); + CMS.debug("CertificateAuthority init: Nonces enabled. (" + mNonces.size() + ")"); + } - // init request queue and related modules. - CMS.debug("CertificateAuthority init: initRequestQueue"); - initRequestQueue(); - if (CMS.isPreOpMode()) - return; + // init request queue and related modules. + CMS.debug("CertificateAuthority init: initRequestQueue"); + initRequestQueue(); + if (CMS.isPreOpMode()) + return; - // set certificate status to 10 minutes - mCertRepot.setCertStatusUpdateInterval( - mRequestQueue.getRequestRepository(), - mConfig.getInteger("certStatusUpdateInterval", 10 * 60), - mConfig.getBoolean("listenToCloneModifications", false)); - mCertRepot.setConsistencyCheck( - mConfig.getBoolean("ConsistencyCheck", false)); - mCertRepot.setSkipIfInConsistent( - mConfig.getBoolean("SkipIfInConsistent", false)); - - mService.init(config.getSubStore("connector")); + // set certificate status to 10 minutes + mCertRepot.setCertStatusUpdateInterval( + mRequestQueue.getRequestRepository(), + mConfig.getInteger("certStatusUpdateInterval", 10 * 60), + mConfig.getBoolean("listenToCloneModifications", false)); + mCertRepot.setConsistencyCheck( + mConfig.getBoolean("ConsistencyCheck", false)); + mCertRepot.setSkipIfInConsistent( + mConfig.getBoolean("SkipIfInConsistent", false)); - initMiscellaneousListeners(); + mService.init(config.getSubStore("connector")); - // instantiate CRL publisher - IConfigStore cpStore = null; + initMiscellaneousListeners(); - mByName = config.getBoolean("byName", true); + // instantiate CRL publisher + IConfigStore cpStore = null; - cpStore = config.getSubStore("crlPublisher"); - if (cpStore != null && cpStore.size() > 0) { - String publisherClass = cpStore.getString("class"); + mByName = config.getBoolean("byName", true); - if (publisherClass != null) { - try { - @SuppressWarnings("unchecked") - Class<ICRLPublisher> pc = (Class<ICRLPublisher>) Class.forName(publisherClass); - - mCRLPublisher = pc.newInstance(); - mCRLPublisher.init(this, cpStore); - } catch (ClassNotFoundException ee) { - log(ILogger.LL_FAILURE, CMS.getLogMessage("CMSCORE_CA_CA_NO_PUBLISHER", ee.toString())); - } catch (IllegalAccessException ee) { - log(ILogger.LL_FAILURE, CMS.getLogMessage("CMSCORE_CA_CA_NO_PUBLISHER", ee.toString())); - } catch (InstantiationException ee) { - log(ILogger.LL_FAILURE, CMS.getLogMessage("CMSCORE_CA_CA_NO_PUBLISHER", ee.toString())); + cpStore = config.getSubStore("crlPublisher"); + if (cpStore != null && cpStore.size() > 0) { + String publisherClass = cpStore.getString("class"); + + if (publisherClass != null) { + try { + @SuppressWarnings("unchecked") + Class<ICRLPublisher> pc = (Class<ICRLPublisher>) Class.forName(publisherClass); + + mCRLPublisher = pc.newInstance(); + mCRLPublisher.init(this, cpStore); + } catch (ClassNotFoundException ee) { + log(ILogger.LL_FAILURE, CMS.getLogMessage("CMSCORE_CA_CA_NO_PUBLISHER", ee.toString())); + } catch (IllegalAccessException ee) { + log(ILogger.LL_FAILURE, CMS.getLogMessage("CMSCORE_CA_CA_NO_PUBLISHER", ee.toString())); + } catch (InstantiationException ee) { + log(ILogger.LL_FAILURE, CMS.getLogMessage("CMSCORE_CA_CA_NO_PUBLISHER", ee.toString())); + } } } - } - // initialize publisher processor (publish remote admin - // rely on this subsystem, so it has to be initialized) - initPublish(); + // initialize publisher processor (publish remote admin + // rely on this subsystem, so it has to be initialized) + initPublish(); - // Initialize CRL issuing points. - // note CRL framework depends on DBS, CRYPTO and PUBLISHING - // being functional. - initCRL(); + // Initialize CRL issuing points. + // note CRL framework depends on DBS, CRYPTO and PUBLISHING + // being functional. + initCRL(); - } catch (EBaseException e) { - if (CMS.isPreOpMode()) - return; - else - throw e; - } + } catch (EBaseException e) { + if (CMS.isPreOpMode()) + return; + else + throw e; + } } /** @@ -393,7 +391,7 @@ public class CertificateAuthority implements ICertificateAuthority, ICertAuthori public IRequestQueue getRequestQueue() { return mRequestQueue; } - + /** * registers listener */ @@ -506,7 +504,7 @@ public class CertificateAuthority implements ICertificateAuthority, ICertAuthori } mService.startup(); mRequestQueue.recover(); - + // Note that this could be null. // setup Admin operations @@ -514,7 +512,7 @@ public class CertificateAuthority implements ICertificateAuthority, ICertAuthori initNotificationListeners(); startPublish(); - // startCRL(); + // startCRL(); } /** @@ -524,7 +522,7 @@ public class CertificateAuthority implements ICertificateAuthority, ICertAuthori public void shutdown() { Enumeration<ICRLIssuingPoint> enums = mCRLIssuePoints.elements(); while (enums.hasMoreElements()) { - CRLIssuingPoint point = (CRLIssuingPoint)enums.nextElement(); + CRLIssuingPoint point = (CRLIssuingPoint) enums.nextElement(); point.shutdown(); } @@ -577,7 +575,7 @@ public class CertificateAuthority implements ICertificateAuthority, ICertAuthori return mDefaultValidity; } - public SignatureAlgorithm getDefaultSignatureAlgorithm() { + public SignatureAlgorithm getDefaultSignatureAlgorithm() { return mSigningUnit.getDefaultSignatureAlgorithm(); } @@ -592,7 +590,7 @@ public class CertificateAuthority implements ICertificateAuthority, ICertAuthori public String getStartSerial() { try { BigInteger serial = - ((Repository) mCertRepot).getTheSerialNumber(); + ((Repository) mCertRepot).getTheSerialNumber(); if (serial == null) return ""; @@ -600,7 +598,7 @@ public class CertificateAuthority implements ICertificateAuthority, ICertAuthori return serial.toString(16); } catch (EBaseException e) { // shouldn't get here. - return ""; + return ""; } } @@ -624,24 +622,23 @@ public class CertificateAuthority implements ICertificateAuthority, ICertAuthori /** * Retrieves certificate repository. * <P> - * + * * @return certificate repository */ public ICertificateRepository getCertificateRepository() { return mCertRepot; } - + /** * Retrieves replica repository. * <P> - * + * * @return replica repository */ public IReplicaIDRepository getReplicaRepository() { return mReplicaRepot; } - /** * Retrieves CRL repository. */ @@ -656,6 +653,7 @@ public class CertificateAuthority implements ICertificateAuthority, ICertAuthori /** * Retrieves the CRL issuing point by id. * <P> + * * @param id string id of the CRL issuing point * @return CRL issuing point */ @@ -666,6 +664,7 @@ public class CertificateAuthority implements ICertificateAuthority, ICertAuthori /** * Enumerates CRL issuing points * <P> + * * @return security service */ public Enumeration<ICRLIssuingPoint> getCRLIssuingPoints() { @@ -680,7 +679,7 @@ public class CertificateAuthority implements ICertificateAuthority, ICertAuthori * Adds CRL issuing point with the given identifier and description. */ @SuppressWarnings("unchecked") - public boolean addCRLIssuingPoint(IConfigStore crlSubStore, String id, + public boolean addCRLIssuingPoint(IConfigStore crlSubStore, String id, boolean enable, String description) { crlSubStore.makeSubStore(id); IConfigStore c = crlSubStore.getSubStore(id); @@ -716,7 +715,7 @@ public class CertificateAuthority implements ICertificateAuthority, ICertAuthori c.putString("extension.AuthorityInformationAccess.critical", "false"); c.putString("extension.AuthorityInformationAccess.type", "CRLExtension"); c.putString("extension.AuthorityInformationAccess.class", - "com.netscape.cms.crl.CMSAuthInfoAccessExtension"); + "com.netscape.cms.crl.CMSAuthInfoAccessExtension"); c.putString("extension.AuthorityInformationAccess.numberOfAccessDescriptions", "1"); c.putString("extension.AuthorityInformationAccess.accessMethod0", "caIssuers"); c.putString("extension.AuthorityInformationAccess.accessLocationType0", "URI"); @@ -726,13 +725,13 @@ public class CertificateAuthority implements ICertificateAuthority, ICertAuthori c.putString("extension.AuthorityKeyIdentifier.critical", "false"); c.putString("extension.AuthorityKeyIdentifier.type", "CRLExtension"); c.putString("extension.AuthorityKeyIdentifier.class", - "com.netscape.cms.crl.CMSAuthorityKeyIdentifierExtension"); + "com.netscape.cms.crl.CMSAuthorityKeyIdentifierExtension"); // IssuerAlternativeName c.putString("extension.IssuerAlternativeName.enable", "false"); c.putString("extension.IssuerAlternativeName.critical", "false"); c.putString("extension.IssuerAlternativeName.type", "CRLExtension"); c.putString("extension.IssuerAlternativeName.class", - "com.netscape.cms.crl.CMSIssuerAlternativeNameExtension"); + "com.netscape.cms.crl.CMSIssuerAlternativeNameExtension"); c.putString("extension.IssuerAlternativeName.numNames", "0"); c.putString("extension.IssuerAlternativeName.nameType0", ""); c.putString("extension.IssuerAlternativeName.name0", ""); @@ -741,62 +740,64 @@ public class CertificateAuthority implements ICertificateAuthority, ICertAuthori c.putString("extension.CRLNumber.critical", "false"); c.putString("extension.CRLNumber.type", "CRLExtension"); c.putString("extension.CRLNumber.class", - "com.netscape.cms.crl.CMSCRLNumberExtension"); + "com.netscape.cms.crl.CMSCRLNumberExtension"); // DeltaCRLIndicator c.putString("extension.DeltaCRLIndicator.enable", "false"); c.putString("extension.DeltaCRLIndicator.critical", "true"); c.putString("extension.DeltaCRLIndicator.type", "CRLExtension"); c.putString("extension.DeltaCRLIndicator.class", - "com.netscape.cms.crl.CMSDeltaCRLIndicatorExtension"); + "com.netscape.cms.crl.CMSDeltaCRLIndicatorExtension"); // IssuingDistributionPoint c.putString("extension.IssuingDistributionPoint.enable", "false"); c.putString("extension.IssuingDistributionPoint.critical", "true"); c.putString("extension.IssuingDistributionPoint.type", "CRLExtension"); c.putString("extension.IssuingDistributionPoint.class", - "com.netscape.cms.crl.CMSIssuingDistributionPointExtension"); + "com.netscape.cms.crl.CMSIssuingDistributionPointExtension"); c.putString("extension.IssuingDistributionPoint.pointType", ""); c.putString("extension.IssuingDistributionPoint.pointName", ""); c.putString("extension.IssuingDistributionPoint.onlyContainsUserCerts", "false"); c.putString("extension.IssuingDistributionPoint.onlyContainsCACerts", "false"); c.putString("extension.IssuingDistributionPoint.onlySomeReasons", ""); - //"keyCompromise,cACompromise,affiliationChanged,superseded,cessationOfOperation,certificateHold"); + // "keyCompromise,cACompromise,affiliationChanged,superseded,cessationOfOperation,certificateHold"); c.putString("extension.IssuingDistributionPoint.indirectCRL", "false"); // CRLReason c.putString("extension.CRLReason.enable", "true"); c.putString("extension.CRLReason.critical", "false"); c.putString("extension.CRLReason.type", "CRLEntryExtension"); c.putString("extension.CRLReason.class", - "com.netscape.cms.crl.CMSCRLReasonExtension"); + "com.netscape.cms.crl.CMSCRLReasonExtension"); // HoldInstruction - removed by RFC 5280 // c.putString("extension.HoldInstruction.enable", "false"); // c.putString("extension.HoldInstruction.critical", "false"); - // c.putString("extension.HoldInstruction.type", "CRLEntryExtension"); + // c.putString("extension.HoldInstruction.type", + // "CRLEntryExtension"); // c.putString("extension.HoldInstruction.class", - // "com.netscape.cms.crl.CMSHoldInstructionExtension"); + // "com.netscape.cms.crl.CMSHoldInstructionExtension"); // c.putString("extension.HoldInstruction.instruction", "none"); // InvalidityDate c.putString("extension.InvalidityDate.enable", "true"); c.putString("extension.InvalidityDate.critical", "false"); c.putString("extension.InvalidityDate.type", "CRLEntryExtension"); c.putString("extension.InvalidityDate.class", - "com.netscape.cms.crl.CMSInvalidityDateExtension"); + "com.netscape.cms.crl.CMSInvalidityDateExtension"); // CertificateIssuer /* - c.putString("extension.CertificateIssuer.enable", "false"); - c.putString("extension.CertificateIssuer.critical", "true"); - c.putString("extension.CertificateIssuer.type", "CRLEntryExtension"); - c.putString("extension.CertificateIssuer.class", - "com.netscape.cms.crl.CMSCertificateIssuerExtension"); - c.putString("extension.CertificateIssuer.numNames", "0"); - c.putString("extension.CertificateIssuer.nameType0", ""); - c.putString("extension.CertificateIssuer.name0", ""); + * c.putString("extension.CertificateIssuer.enable", "false"); + * c.putString("extension.CertificateIssuer.critical", "true"); + * c.putString("extension.CertificateIssuer.type", + * "CRLEntryExtension"); + * c.putString("extension.CertificateIssuer.class", + * "com.netscape.cms.crl.CMSCertificateIssuerExtension"); + * c.putString("extension.CertificateIssuer.numNames", "0"); + * c.putString("extension.CertificateIssuer.nameType0", ""); + * c.putString("extension.CertificateIssuer.name0", ""); */ // FreshestCRL c.putString("extension.FreshestCRL.enable", "false"); c.putString("extension.FreshestCRL.critical", "false"); c.putString("extension.FreshestCRL.type", "CRLExtension"); c.putString("extension.FreshestCRL.class", - "com.netscape.cms.crl.CMSFreshestCRLExtension"); + "com.netscape.cms.crl.CMSFreshestCRLExtension"); c.putString("extension.FreshestCRL.numPoints", "0"); c.putString("extension.FreshestCRL.pointType0", ""); c.putString("extension.FreshestCRL.pointName0", ""); @@ -807,7 +808,7 @@ public class CertificateAuthority implements ICertificateAuthority, ICertAuthori try { issuingPointClassName = c.getString(PROP_CLASS); - issuingPointClass = (Class<CRLIssuingPoint>)Class.forName(issuingPointClassName); + issuingPointClass = (Class<CRLIssuingPoint>) Class.forName(issuingPointClassName); issuingPoint = (CRLIssuingPoint) issuingPointClass.newInstance(); issuingPoint.init(this, id, c); mCRLIssuePoints.put(id, issuingPoint); @@ -846,7 +847,7 @@ public class CertificateAuthority implements ICertificateAuthority, ICertAuthori mCRLRepot.deleteCRLIssuingPointRecord(id); } catch (EBaseException e) { log(ILogger.LL_FAILURE, - CMS.getLogMessage("FAILED_REMOVING_CRL_IP_2", id, e.toString())); + CMS.getLogMessage("FAILED_REMOVING_CRL_IP_2", id, e.toString())); } } } @@ -854,7 +855,7 @@ public class CertificateAuthority implements ICertificateAuthority, ICertAuthori /** * Returns X500 name of the Certificate Authority * <P> - * + * * @return CA name */ public X500Name getX500Name() { @@ -872,6 +873,7 @@ public class CertificateAuthority implements ICertificateAuthority, ICertAuthori /** * Returns nickname of CA's signing cert. * <p> + * * @return CA signing cert nickname. */ public String getNickname() { @@ -881,6 +883,7 @@ public class CertificateAuthority implements ICertificateAuthority, ICertAuthori /** * Returns nickname of OCSP's signing cert. * <p> + * * @return OCSP signing cert nickname. */ public String getOCSPNickname() { @@ -890,7 +893,7 @@ public class CertificateAuthority implements ICertificateAuthority, ICertAuthori /** * Returns default signing unit used by this CA * <P> - * + * * @return request identifier */ public ISigningUnit getSigningUnit() { @@ -910,24 +913,24 @@ public class CertificateAuthority implements ICertificateAuthority, ICertAuthori } /** - * Signs CRL using the specified signature algorithm. - * If no algorithm is specified the CA's default signing algorithm - * is used. + * Signs CRL using the specified signature algorithm. If no algorithm is + * specified the CA's default signing algorithm is used. * <P> + * * @param crl the CRL to be signed. - * @param algname the algorithm name to use. This is a JCA name such - * as MD5withRSA, etc. If set to null the default signing algorithm - * is used. - * + * @param algname the algorithm name to use. This is a JCA name such as + * MD5withRSA, etc. If set to null the default signing algorithm + * is used. + * * @return the signed CRL */ public X509CRLImpl sign(X509CRLImpl crl, String algname) - throws EBaseException { + throws EBaseException { X509CRLImpl signedcrl = null; - IStatsSubsystem statsSub = (IStatsSubsystem)CMS.getSubsystem("stats"); + IStatsSubsystem statsSub = (IStatsSubsystem) CMS.getSubsystem("stats"); if (statsSub != null) { - statsSub.startTiming("signing"); + statsSub.startTiming("signing"); } long startTime = CMS.getCurrentDate().getTime(); @@ -976,32 +979,33 @@ public class CertificateAuthority implements ICertificateAuthority, ICertAuthori throw new ECAException( CMS.getUserMessage("CMS_CA_SIGNING_CRL_FAILED", e.getMessage())); } finally { - if (statsSub != null) { - statsSub.endTiming("signing"); - } + if (statsSub != null) { + statsSub.endTiming("signing"); + } } return signedcrl; } /** - * Signs the given certificate info using specified signing algorithm - * If no algorithm is specified the CA's default algorithm is used. + * Signs the given certificate info using specified signing algorithm If no + * algorithm is specified the CA's default algorithm is used. * <P> + * * @param certInfo the certificate info to be signed. - * @param algname the signing algorithm to use. These are names defined - * in JCA, such as MD5withRSA, etc. If null the CA's default - * signing algorithm will be used. + * @param algname the signing algorithm to use. These are names defined in + * JCA, such as MD5withRSA, etc. If null the CA's default signing + * algorithm will be used. * @return signed certificate */ - public X509CertImpl sign(X509CertInfo certInfo, String algname) - throws EBaseException { + public X509CertImpl sign(X509CertInfo certInfo, String algname) + throws EBaseException { X509CertImpl signedcert = null; - IStatsSubsystem statsSub = (IStatsSubsystem)CMS.getSubsystem("stats"); + IStatsSubsystem statsSub = (IStatsSubsystem) CMS.getSubsystem("stats"); if (statsSub != null) { - statsSub.startTiming("signing"); + statsSub.startTiming("signing"); } long startTime = CMS.getCurrentDate().getTime(); @@ -1025,20 +1029,20 @@ public class CertificateAuthority implements ICertificateAuthority, ICertAuthori CMS.debug("sign cert encoding cert"); certInfo.encode(tmp); byte[] rawCert = tmp.toByteArray(); - + // encode algorithm identifier CMS.debug("sign cert encoding algorithm"); alg.encode(tmp); - + CMS.debug("CA cert signing: signing cert"); byte[] signature = mSigningUnit.sign(rawCert, algname); - + tmp.putBitString(signature); - + // Wrap the signed data in a SEQUENCE { data, algorithm, sig } out.write(DerValue.tag_Sequence, tmp); - //log(ILogger.LL_INFO, "CertificateAuthority: done signing"); - + // log(ILogger.LL_INFO, "CertificateAuthority: done signing"); + switch (mFastSigning) { case FASTSIGNING_DISABLED: signedcert = new X509CertImpl(out.toByteArray()); @@ -1051,8 +1055,7 @@ public class CertificateAuthority implements ICertificateAuthority, ICertAuthori default: break; } - } - catch (NoSuchAlgorithmException e) { + } catch (NoSuchAlgorithmException e) { log(ILogger.LL_FAILURE, CMS.getLogMessage("CMSCORE_CA_CA_SIGN_CERT", e.toString(), e.getMessage())); throw new ECAException( CMS.getUserMessage("CMS_CA_SIGNING_CERT_FAILED", e.getMessage())); @@ -1065,38 +1068,41 @@ public class CertificateAuthority implements ICertificateAuthority, ICertAuthori throw new ECAException( CMS.getUserMessage("CMS_CA_SIGNING_CERT_FAILED", e.getMessage())); } finally { - if (statsSub != null) { - statsSub.endTiming("signing"); - } + if (statsSub != null) { + statsSub.endTiming("signing"); + } } return signedcert; } /** - * Sign a byte array using the specified algorithm. - * If algorithm is null the CA's default algorithm is used. + * Sign a byte array using the specified algorithm. If algorithm is null the + * CA's default algorithm is used. * <p> - * @param data the data to be signed in a byte array. + * + * @param data the data to be signed in a byte array. * @param algname the algorithm to use. * @return the signature in a byte array. - */ - public byte[] sign(byte[] data, String algname) - throws EBaseException { + */ + public byte[] sign(byte[] data, String algname) + throws EBaseException { return mSigningUnit.sign(data, algname); } /** * logs a message in the CA area. + * * @param level the debug level. * @param msg the message to debug. */ public void log(int level, String msg) { - mLogger.log(ILogger.EV_SYSTEM, ILogger.S_CA, - level, msg); + mLogger.log(ILogger.EV_SYSTEM, ILogger.S_CA, + level, msg); } /** * Retrieves certificate chains of this CA. + * * @return this CA's cert chain. */ public CertificateChain getCACertChain() { @@ -1105,18 +1111,18 @@ public class CertificateAuthority implements ICertificateAuthority, ICertAuthori public X509CertImpl getCACert() { if (mCaCert != null) { - return mCaCert; + return mCaCert; } // during configuration try { - String cert = mConfig.getString("signing.cert", null); - if (cert != null) { - return new X509CertImpl(CMS.AtoB(cert)); - } + String cert = mConfig.getString("signing.cert", null); + if (cert != null) { + return new X509CertImpl(CMS.AtoB(cert)); + } } catch (EBaseException e) { - CMS.debug(e); + CMS.debug(e); } catch (CertificateException e) { - CMS.debug(e); + CMS.debug(e); } return null; } @@ -1126,10 +1132,10 @@ public class CertificateAuthority implements ICertificateAuthority, ICertAuthori } public String[] getCASigningAlgorithms() { - if (mCASigningAlgorithms != null) + if (mCASigningAlgorithms != null) return mCASigningAlgorithms; - if (mCaCert == null) + if (mCaCert == null) return null; // CA not inited yet. X509Key caPubKey = null; @@ -1137,39 +1143,38 @@ public class CertificateAuthority implements ICertificateAuthority, ICertAuthori caPubKey = (X509Key) mCaCert.get(X509CertImpl.PUBLIC_KEY); } catch (CertificateParsingException e) { } - if (caPubKey == null) - return null; // something seriously wrong. + if (caPubKey == null) + return null; // something seriously wrong. AlgorithmId alg = caPubKey.getAlgorithmId(); - if (alg == null) - return null; // something seriously wrong. + if (alg == null) + return null; // something seriously wrong. mCASigningAlgorithms = AlgorithmId.getSigningAlgorithms(alg); if (mCASigningAlgorithms == null) { CMS.debug( - "CA - no signing algorithms for " + alg.getName()); + "CA - no signing algorithms for " + alg.getName()); } else { - CMS.debug( - "CA First signing algorithm is " + mCASigningAlgorithms[0]); + CMS.debug( + "CA First signing algorithm is " + mCASigningAlgorithms[0]); } return mCASigningAlgorithms; } - ////////// - // Initialization routines. + // //////// + // Initialization routines. // - /** * init CA signing unit & cert chain. */ private void initSigUnit() - throws EBaseException { + throws EBaseException { try { // init signing unit mSigningUnit = new SigningUnit(); IConfigStore caSigningCfg = - mConfig.getSubStore(PROP_SIGNING_SUBSTORE); + mConfig.getSubStore(PROP_SIGNING_SUBSTORE); mSigningUnit.init(this, caSigningCfg); CMS.debug("CA signing unit inited"); @@ -1188,38 +1193,38 @@ public class CertificateAuthority implements ICertificateAuthority, ICertAuthori CryptoManager manager = CryptoManager.getInstance(); int caChainNum = - caSigningCfg.getInteger(PROP_CA_CHAIN_NUM, 0); + caSigningCfg.getInteger(PROP_CA_CHAIN_NUM, 0); CMS.debug("cachainNum= " + caChainNum); if (caChainNum > 0) { // custom build chain (for cross cert chain) // audit here *** IConfigStore chainStore = - caSigningCfg.getSubStore(PROP_CA_CHAIN); + caSigningCfg.getSubStore(PROP_CA_CHAIN); if (chainStore == null) { log(ILogger.LL_FAILURE, - CMS.getLogMessage("CMSCORE_CA_CA_OCSP_CHAIN", - "ca cert chain config error")); + CMS.getLogMessage("CMSCORE_CA_CA_OCSP_CHAIN", + "ca cert chain config error")); throw new ECAException( CMS.getUserMessage("CMS_CA_BUILD_CA_CHAIN_FAILED", - "ca cert chain config error")); + "ca cert chain config error")); } java.security.cert.X509Certificate[] implchain = - new java.security.cert.X509Certificate[caChainNum]; + new java.security.cert.X509Certificate[caChainNum]; for (int i = 0; i < caChainNum; i++) { String subtreeName = PROP_CA_CERT + i; // cert file name must be full path String certFileName = - chainStore.getString(subtreeName, null); + chainStore.getString(subtreeName, null); if ((certFileName == null) || certFileName.equals("")) { log(ILogger.LL_FAILURE, CMS.getLogMessage("CMSCORE_CA_CA_OCSP_CHAIN", "cert file config error")); throw new ECAException( CMS.getUserMessage("CMS_CA_BUILD_CA_CHAIN_FAILED", - "cert file config error")); + "cert file config error")); } byte[] b64Bytes = getCertFromFile(certFileName); String b64String = new String(b64Bytes); @@ -1232,11 +1237,11 @@ public class CertificateAuthority implements ICertificateAuthority, ICertAuthori CMS.debug("in init - custom built CA cert chain."); } else { // build ca chain the traditional way - org.mozilla.jss.crypto.X509Certificate[] chain = - manager.buildCertificateChain(mSigningUnit.getCert()); + org.mozilla.jss.crypto.X509Certificate[] chain = + manager.buildCertificateChain(mSigningUnit.getCert()); // do this in case other subsyss expect a X509CertImpl java.security.cert.X509Certificate[] implchain = - new java.security.cert.X509Certificate[chain.length]; + new java.security.cert.X509Certificate[chain.length]; for (int i = 0; i < chain.length; i++) { implchain[i] = new X509CertImpl(chain[i].getEncoded()); @@ -1256,11 +1261,11 @@ public class CertificateAuthority implements ICertificateAuthority, ICertAuthori CMS.debug("Shared OCSP signing unit inited"); } - org.mozilla.jss.crypto.X509Certificate[] ocspChain = - manager.buildCertificateChain(mOCSPSigningUnit.getCert()); + org.mozilla.jss.crypto.X509Certificate[] ocspChain = + manager.buildCertificateChain(mOCSPSigningUnit.getCert()); // do this in case other subsyss expect a X509CertImpl java.security.cert.X509Certificate[] ocspImplchain = - new java.security.cert.X509Certificate[ocspChain.length]; + new java.security.cert.X509Certificate[ocspChain.length]; for (int i = 0; i < ocspChain.length; i++) { ocspImplchain[i] = new X509CertImpl(ocspChain[i].getEncoded()); @@ -1319,7 +1324,7 @@ public class CertificateAuthority implements ICertificateAuthority, ICertAuthori * read ca cert from path, converts and bytes */ byte[] getCertFromFile(String path) - throws FileNotFoundException, IOException { + throws FileNotFoundException, IOException { File file = new File(path); Long l = Long.valueOf(file.length()); @@ -1331,32 +1336,32 @@ public class CertificateAuthority implements ICertificateAuthority, ICertAuthori return b; } - /** + /** * init default cert attributes. */ private void initDefCaAttrs() - throws EBaseException { - int version = mConfig.getInteger(PROP_X509CERT_VERSION, + throws EBaseException { + int version = mConfig.getInteger(PROP_X509CERT_VERSION, CertificateVersion.V3); - if (version != CertificateVersion.V1 && - version != CertificateVersion.V3) { + if (version != CertificateVersion.V1 && + version != CertificateVersion.V3) { throw new ECAException( CMS.getUserMessage("CMS_CA_X509CERT_VERSION_NOT_SUPPORTED")); } try { mDefaultCertVersion = new CertificateVersion(version - 1); } catch (IOException e) { - // should never occur. + // should never occur. } int validity_in_days = mConfig.getInteger(PROP_DEF_VALIDITY, 2 * 365); mDefaultValidity = validity_in_days * DAY; // days in config file. - mEnablePastCATime = + mEnablePastCATime = mConfig.getBoolean(PROP_ENABLE_PAST_CATIME, false); - mEnableOCSP = + mEnableOCSP = mConfig.getBoolean(PROP_ENABLE_OCSP, true); String fs = mConfig.getString(PROP_FAST_SIGNING, ""); @@ -1373,19 +1378,19 @@ public class CertificateAuthority implements ICertificateAuthority, ICertAuthori * init cert & crl database */ private void initCaDatabases() - throws EBaseException { + throws EBaseException { int certdb_inc = mConfig.getInteger(PROP_CERTDB_INC, 5); String certReposDN = mConfig.getString(PROP_CERT_REPOS_DN, null); - if (certReposDN == null) { - certReposDN = "ou=certificateRepository, ou=" + getId() + + if (certReposDN == null) { + certReposDN = "ou=certificateRepository, ou=" + getId() + ", " + getDBSubsystem().getBaseDN(); } String reposDN = mConfig.getString(PROP_REPOS_DN, null); - if (reposDN == null) { - reposDN = "ou=certificateRepository, ou=" + getId() + + if (reposDN == null) { + reposDN = "ou=certificateRepository, ou=" + getId() + ", " + getDBSubsystem().getBaseDN(); } @@ -1409,15 +1414,15 @@ public class CertificateAuthority implements ICertificateAuthority, ICertAuthori DBSubsystem.getInstance(), crldb_inc, "ou=crlIssuingPoints, ou=" + getId() + ", " + - getDBSubsystem().getBaseDN()); + getDBSubsystem().getBaseDN()); CMS.debug("CRL Repot inited"); String replicaReposDN = mConfig.getString(PROP_REPLICAID_DN, null); if (replicaReposDN == null) { - replicaReposDN = "ou=Replica," + getDBSubsystem().getBaseDN(); + replicaReposDN = "ou=Replica," + getDBSubsystem().getBaseDN(); } mReplicaRepot = new ReplicaIDRepository( - DBSubsystem.getInstance(), 1, replicaReposDN); + DBSubsystem.getInstance(), 1, replicaReposDN); CMS.debug("Replica Repot inited"); } @@ -1426,12 +1431,12 @@ public class CertificateAuthority implements ICertificateAuthority, ICertAuthori * init web gateway - just gets the ee gateway for this CA. */ private void initWebGateway() - throws EBaseException { + throws EBaseException { } private void startPublish() - throws EBaseException { - //xxx Note that CMS411 only support ca cert publishing to ldap + throws EBaseException { + // xxx Note that CMS411 only support ca cert publishing to ldap // if ldap publishing is not enabled while publishing isenabled // there will be a lot of problem. try { @@ -1449,7 +1454,7 @@ public class CertificateAuthority implements ICertificateAuthority, ICertAuthori * init publishing */ private void initPublish() - throws EBaseException { + throws EBaseException { IConfigStore c = null; try { @@ -1467,8 +1472,8 @@ public class CertificateAuthority implements ICertificateAuthority, ICertAuthori } catch (ELdapException e) { log(ILogger.LL_FAILURE, CMS.getLogMessage("CMSCORE_CA_CA_ERROR_PUBLISH_MODULE", e.toString())); - //throw new ECAException( - // CAResources.INIT_PUBLISH_MODULE_FAILED, e); + // throw new ECAException( + // CAResources.INIT_PUBLISH_MODULE_FAILED, e); } } @@ -1489,7 +1494,7 @@ public class CertificateAuthority implements ICertificateAuthority, ICertAuthori while (names.hasMoreElements()) { String id = (String) names.nextElement(); - if (Debug.ON) + if (Debug.ON) Debug.trace("registering listener impl: " + id); String cl = implc.getString(id + "." + PROP_CLASS); @@ -1515,18 +1520,19 @@ public class CertificateAuthority implements ICertificateAuthority, ICertAuthori throw new Exception("Cannot initialize"); } String className = plugin.getClassPath(); - + try { IRequestListener listener = null; - listener = (IRequestListener) + listener = (IRequestListener) Class.forName(className).newInstance(); - //listener.init(id, implName, iConfig); + // listener.init(id, implName, iConfig); listener.init(this, iConfig); - // registerRequestListener(id, (IRequestListener) listener); - //log(ILogger.LL_INFO, - // "Listener instance " + id + " added"); + // registerRequestListener(id, (IRequestListener) + // listener); + // log(ILogger.LL_INFO, + // "Listener instance " + id + " added"); } catch (Exception e) { if (Debug.ON) { @@ -1537,13 +1543,13 @@ public class CertificateAuthority implements ICertificateAuthority, ICertAuthori throw e; } } - + } - + } catch (Exception e) { log(ILogger.LL_INFO, CMS.getLogMessage("CMSCORE_CA_CA_FAILED_LISTENER", e.toString())); } - + } /** @@ -1567,7 +1573,7 @@ public class CertificateAuthority implements ICertificateAuthority, ICertAuthori } // Initialize Revoke Request notification listener - + String certificateRevokedListenerClassName = nc.getString("certificateIssuedListenerClassName", "com.netscape.cms.listeners.CertificateRevokedListener"); try { @@ -1579,7 +1585,7 @@ public class CertificateAuthority implements ICertificateAuthority, ICertAuthori // Initialize Request In Queue notification listener IConfigStore rq = nc.getSubStore(PROP_REQ_IN_Q_SUBSTORE); - + String requestInQListenerClassName = nc.getString("certificateIssuedListenerClassName", "com.netscape.cms.listeners.RequestInQListener"); try { @@ -1598,7 +1604,7 @@ public class CertificateAuthority implements ICertificateAuthority, ICertAuthori } catch (Exception e) { e.printStackTrace(); log(ILogger.LL_FAILURE, CMS.getLogMessage("CMSCORE_CA_CA_NOTIFY_FAILED")); - // throw e; + // throw e; } } @@ -1606,14 +1612,14 @@ public class CertificateAuthority implements ICertificateAuthority, ICertAuthori * initialize request queue components */ private void initRequestQueue() - throws EBaseException { + throws EBaseException { mPolicy = new CAPolicy(); ((CAPolicy) mPolicy).init(this, mConfig.getSubStore(PROP_POLICY)); CMS.debug("CA policy inited"); mService = new CAService(this); CMS.debug("CA service inited"); - mNotify = new ARequestNotifier (this); + mNotify = new ARequestNotifier(this); CMS.debug("CA notifier inited"); mPNotify = new ARequestNotifier(); CMS.debug("CA pending notifier inited"); @@ -1622,22 +1628,22 @@ public class CertificateAuthority implements ICertificateAuthority, ICertAuthori try { int reqdb_inc = mConfig.getInteger("reqdbInc", 5); - mRequestQueue = + mRequestQueue = RequestSubsystem.getInstance().getRequestQueue( - getId(), reqdb_inc, mPolicy, mService, mNotify, mPNotify); + getId(), reqdb_inc, mPolicy, mService, mNotify, mPNotify); } catch (EBaseException e) { log(ILogger.LL_FAILURE, CMS.getLogMessage("CMSCORE_CA_CA_QUEUE_FAILED", e.toString())); throw e; } // init request scheduler if configured - String schedulerClass = - mConfig.getString("requestSchedulerClass", null); + String schedulerClass = + mConfig.getString("requestSchedulerClass", null); if (schedulerClass != null) { - try { + try { IRequestScheduler scheduler = (IRequestScheduler) - Class.forName(schedulerClass).newInstance(); + Class.forName(schedulerClass).newInstance(); mRequestQueue.setRequestScheduler(scheduler); } catch (Exception e) { @@ -1647,36 +1653,30 @@ public class CertificateAuthority implements ICertificateAuthority, ICertAuthori } /* - private void startCRL() - throws EBaseException - { - Enumeration e = mCRLIssuePoints.keys(); - while (e.hasMoreElements()) { - CRLIssuingPoint cp = (CRLIssuingPoint) - mCRLIssuePoints.get(e.nextElement()); - cp.startup(); - } - } + * private void startCRL() throws EBaseException { Enumeration e = + * mCRLIssuePoints.keys(); while (e.hasMoreElements()) { CRLIssuingPoint cp + * = (CRLIssuingPoint) mCRLIssuePoints.get(e.nextElement()); cp.startup(); } + * } */ - + /** - * initialize CRL + * initialize CRL */ @SuppressWarnings("unchecked") - private void initCRL() - throws EBaseException { + private void initCRL() + throws EBaseException { IConfigStore crlConfig = mConfig.getSubStore(PROP_CRL_SUBSTORE); if ((crlConfig == null) || (crlConfig.size() <= 0)) { log(ILogger.LL_FAILURE, CMS.getLogMessage("CMSCORE_CA_CA_NO_MASTER_CRL")); - //throw new ECAException(CAResources.NO_CONFIG_FOR_MASTER_CRL); + // throw new ECAException(CAResources.NO_CONFIG_FOR_MASTER_CRL); return; } Enumeration<String> issuePointIdEnum = crlConfig.getSubStoreNames(); if (issuePointIdEnum == null || !issuePointIdEnum.hasMoreElements()) { log(ILogger.LL_FAILURE, CMS.getLogMessage("CMSCORE_CA_CA_NO_MASTER_CRL_SUBSTORE")); - //throw new ECAException(CAResources.NO_CONFIG_FOR_MASTER_CRL); + // throw new ECAException(CAResources.NO_CONFIG_FOR_MASTER_CRL); return; } @@ -1686,7 +1686,7 @@ public class CertificateAuthority implements ICertificateAuthority, ICertAuthori String issuePointId = (String) issuePointIdEnum.nextElement(); CMS.debug( - "initializing crl issue point " + issuePointId); + "initializing crl issue point " + issuePointId); IConfigStore issuePointConfig = null; String issuePointClassName = null; @SuppressWarnings("unchecked") @@ -1700,29 +1700,28 @@ public class CertificateAuthority implements ICertificateAuthority, ICertAuthori issuePoint = issuePointClass.newInstance(); issuePoint.init(this, issuePointId, issuePointConfig); mCRLIssuePoints.put(issuePointId, issuePoint); - if (mMasterCRLIssuePoint == null && - issuePointId.equals(PROP_MASTER_CRL)) + if (mMasterCRLIssuePoint == null && + issuePointId.equals(PROP_MASTER_CRL)) mMasterCRLIssuePoint = issuePoint; } catch (ClassNotFoundException e) { throw new ECAException( CMS.getUserMessage("CMS_CA_CRL_ISSUING_POINT_INIT_FAILED", - issuePointId, e.toString())); + issuePointId, e.toString())); } catch (InstantiationException e) { throw new ECAException( CMS.getUserMessage("CMS_CA_CRL_ISSUING_POINT_INIT_FAILED", - issuePointId, e.toString())); + issuePointId, e.toString())); } catch (IllegalAccessException e) { throw new ECAException( CMS.getUserMessage("CMS_CA_CRL_ISSUING_POINT_INIT_FAILED", - issuePointId, e.toString())); + issuePointId, e.toString())); } } /* - if (mMasterCRLIssuePoint == null) { - log(ILogger.LL_FAILURE, CMS.getLogMessage("CMSCORE_CA_CA_NO_FULL_CRL", PROP_MASTER_CRL)); - throw new ECAException(CAResources.NO_CONFIG_FOR_MASTER_CRL); - } + * if (mMasterCRLIssuePoint == null) { log(ILogger.LL_FAILURE, + * CMS.getLogMessage("CMSCORE_CA_CA_NO_FULL_CRL", PROP_MASTER_CRL)); + * throw new ECAException(CAResources.NO_CONFIG_FOR_MASTER_CRL); } */ log(ILogger.LL_INFO, "CRL Issuing Points inited"); } @@ -1747,9 +1746,8 @@ public class CertificateAuthority implements ICertificateAuthority, ICertAuthori return mSignTime; } - public long getOCSPTotalLookupTime() - { - return mLookupTime; + public long getOCSPTotalLookupTime() { + return mLookupTime; } public ResponderID getResponderIDByName() { @@ -1769,8 +1767,8 @@ public class CertificateAuthority implements ICertificateAuthority, ICertAuthori public ResponderID getResponderIDByHash() { /* - KeyHash ::= OCTET STRING --SHA-1 hash of responder's public key - --(excluding the tag and length fields) + * KeyHash ::= OCTET STRING --SHA-1 hash of responder's public key + * --(excluding the tag and length fields) */ PublicKey publicKey = getOCSPSigningUnit().getPublicKey(); MessageDigest md = null; @@ -1790,7 +1788,7 @@ public class CertificateAuthority implements ICertificateAuthority, ICertAuthori * Process OCSPRequest. */ public OCSPResponse validate(OCSPRequest request) - throws EBaseException { + throws EBaseException { if (!mEnableOCSP) { CMS.debug("Local ocsp service is disable."); @@ -1798,23 +1796,23 @@ public class CertificateAuthority implements ICertificateAuthority, ICertAuthori } mNumOCSPRequest++; - IStatsSubsystem statsSub = (IStatsSubsystem)CMS.getSubsystem("stats"); + IStatsSubsystem statsSub = (IStatsSubsystem) CMS.getSubsystem("stats"); long startTime = CMS.getCurrentDate().getTime(); try { - //log(ILogger.LL_INFO, "start OCSP request"); + // log(ILogger.LL_INFO, "start OCSP request"); TBSRequest tbsReq = request.getTBSRequest(); // (3) look into database to check the - // certificate's status + // certificate's status Vector<SingleResponse> singleResponses = new Vector<SingleResponse>(); if (statsSub != null) { - statsSub.startTiming("lookup"); + statsSub.startTiming("lookup"); } long lookupStartTime = CMS.getCurrentDate().getTime(); for (int i = 0; i < tbsReq.getRequestCount(); i++) { com.netscape.cmsutil.ocsp.Request req = - tbsReq.getRequestAt(i); + tbsReq.getRequestAt(i); CertID cid = req.getCertID(); SingleResponse sr = processRequest(cid); @@ -1822,12 +1820,12 @@ public class CertificateAuthority implements ICertificateAuthority, ICertAuthori } long lookupEndTime = CMS.getCurrentDate().getTime(); if (statsSub != null) { - statsSub.endTiming("lookup"); + statsSub.endTiming("lookup"); } mLookupTime += lookupEndTime - lookupStartTime; if (statsSub != null) { - statsSub.startTiming("build_response"); + statsSub.startTiming("build_response"); } SingleResponse res[] = new SingleResponse[singleResponses.size()]; @@ -1836,16 +1834,16 @@ public class CertificateAuthority implements ICertificateAuthority, ICertAuthori ResponderID rid = null; if (mByName) { if (mResponderIDByName == null) { - mResponderIDByName = getResponderIDByName(); + mResponderIDByName = getResponderIDByName(); } rid = mResponderIDByName; } else { if (mResponderIDByHash == null) { - mResponderIDByHash = getResponderIDByHash(); + mResponderIDByHash = getResponderIDByHash(); } rid = mResponderIDByHash; } - + Extension nonce[] = null; for (int j = 0; j < tbsReq.getExtensionsCount(); j++) { @@ -1859,26 +1857,26 @@ public class CertificateAuthority implements ICertificateAuthority, ICertAuthori ResponseData rd = new ResponseData(rid, new GeneralizedTime(CMS.getCurrentDate()), res, nonce); if (statsSub != null) { - statsSub.endTiming("build_response"); + statsSub.endTiming("build_response"); } if (statsSub != null) { - statsSub.startTiming("signing"); + statsSub.startTiming("signing"); } long signStartTime = CMS.getCurrentDate().getTime(); BasicOCSPResponse basicRes = sign(rd); long signEndTime = CMS.getCurrentDate().getTime(); mSignTime += signEndTime - signStartTime; if (statsSub != null) { - statsSub.endTiming("signing"); + statsSub.endTiming("signing"); } OCSPResponse response = new OCSPResponse( OCSPResponseStatus.SUCCESSFUL, new ResponseBytes(ResponseBytes.OCSP_BASIC, - new OCTET_STRING(ASN1Util.encode(basicRes)))); + new OCTET_STRING(ASN1Util.encode(basicRes)))); - //log(ILogger.LL_INFO, "done OCSP request"); + // log(ILogger.LL_INFO, "done OCSP request"); long endTime = CMS.getCurrentDate().getTime(); mTotalTime += endTime - startTime; return response; @@ -1893,11 +1891,11 @@ public class CertificateAuthority implements ICertificateAuthority, ICertAuthori DerOutputStream out = new DerOutputStream(); DerOutputStream tmp = new DerOutputStream(); - String algname = mOCSPSigningUnit.getDefaultAlgorithm(); + String algname = mOCSPSigningUnit.getDefaultAlgorithm(); byte rd_data[] = ASN1Util.encode(rd); if (rd_data != null) { - mTotalData += rd_data.length; + mTotalData += rd_data.length; } rd.encode(tmp); AlgorithmId.get(algname).encode(tmp); @@ -1911,14 +1909,14 @@ public class CertificateAuthority implements ICertificateAuthority, ICertAuthori DerOutputStream tmp1 = new DerOutputStream(); DerOutputStream outChain = new DerOutputStream(); java.security.cert.X509Certificate chains[] = - mOCSPCertChain.getChain(); + mOCSPCertChain.getChain(); for (int i = 0; i < chains.length; i++) { tmpChain.putDerValue(new DerValue(chains[i].getEncoded())); } tmp1.write(DerValue.tag_Sequence, tmpChain); tmp.write(DerValue.createTag(DerValue.TAG_CONTEXT, true, (byte) 0), - tmp1); + tmp1); out.write(DerValue.tag_Sequence, tmp); @@ -1959,7 +1957,7 @@ public class CertificateAuthority implements ICertificateAuthority, ICertAuthori } catch (EBaseException e) { } CRLIssuingPoint point = (CRLIssuingPoint) - getCRLIssuingPoint(issuingPointId); + getCRLIssuingPoint(issuingPointId); if (point.isCRLCacheEnabled()) { // only do this if cache is enabled @@ -1987,7 +1985,7 @@ public class CertificateAuthority implements ICertificateAuthority, ICertAuthori } } - try { + try { ICertRecord rec = mCertRepot.readCertificateRecord(serialNo); String status = rec.getStatus(); @@ -2015,4 +2013,3 @@ public class CertificateAuthority implements ICertificateAuthority, ICertAuthori return new SingleResponse(cid, certStatus, thisUpdate, nextUpdate); } } - diff --git a/pki/base/ca/src/com/netscape/ca/SigningUnit.java b/pki/base/ca/src/com/netscape/ca/SigningUnit.java index 6b0dfc64..db756526 100644 --- a/pki/base/ca/src/com/netscape/ca/SigningUnit.java +++ b/pki/base/ca/src/com/netscape/ca/SigningUnit.java @@ -17,7 +17,6 @@ // --- END COPYRIGHT BLOCK --- package com.netscape.ca; - import java.security.InvalidKeyException; import java.security.NoSuchAlgorithmException; import java.security.PublicKey; @@ -50,10 +49,9 @@ import com.netscape.certsrv.security.ISigningUnit; import com.netscape.cmscore.security.JssSubsystem; import com.netscape.cmsutil.util.Cert; - /** * CA signing unit based on JSS. - * + * * $Revision$ $Date$ */ @@ -81,8 +79,8 @@ public final class SigningUnit implements ISigningUnit { private ISubsystem mOwner = null; - private String mDefSigningAlgname = null; - private SignatureAlgorithm mDefSigningAlgorithm = null; + private String mDefSigningAlgname = null; + private SignatureAlgorithm mDefSigningAlgorithm = null; public SigningUnit() { } @@ -114,7 +112,7 @@ public final class SigningUnit implements ISigningUnit { public PrivateKey getPrivateKey() { return mPrivk; } - + public void updateConfig(String nickname, String tokenname) { mConfig.putString(PROP_CERT_NICKNAME, nickname); mConfig.putString(PROP_TOKEN_NAME, tokenname); @@ -133,8 +131,8 @@ public final class SigningUnit implements ISigningUnit { } public void init(ISubsystem owner, IConfigStore config) - throws EBaseException { - mOwner = owner; + throws EBaseException { + mOwner = owner; mConfig = config; String tokenname = null; @@ -145,23 +143,23 @@ public final class SigningUnit implements ISigningUnit { tokenname = config.getString(PROP_TOKEN_NAME); if (tokenname.equalsIgnoreCase(Constants.PR_INTERNAL_TOKEN) || - tokenname.equalsIgnoreCase("Internal Key Storage Token")) { + tokenname.equalsIgnoreCase("Internal Key Storage Token")) { mToken = mManager.getInternalKeyStorageToken(); - setNewNickName(mNickname); + setNewNickName(mNickname); } else { mToken = mManager.getTokenByName(tokenname); - mNickname = tokenname + ":" + mNickname; - setNewNickName(mNickname); - } + mNickname = tokenname + ":" + mNickname; + setNewNickName(mNickname); + } CMS.debug(config.getName() + " Signing Unit nickname " + mNickname); CMS.debug("Got token " + tokenname + " by name"); - PasswordCallback cb = JssSubsystem.getInstance().getPWCB(); + PasswordCallback cb = JssSubsystem.getInstance().getPWCB(); mToken.login(cb); // ONE_TIME by default. mCert = mManager.findCertByNickname(mNickname); - CMS.debug("Found cert by nickname: '"+mNickname+"' with serial number: "+mCert.getSerialNumber()); + CMS.debug("Found cert by nickname: '" + mNickname + "' with serial number: " + mCert.getSerialNumber()); mCertImpl = new X509CertImpl(mCert.getEncoded()); CMS.debug("converted to x509CertImpl"); @@ -174,38 +172,38 @@ public final class SigningUnit implements ISigningUnit { // get def alg and check if def sign alg is valid for token. mDefSigningAlgname = config.getString(PROP_DEFAULT_SIGNALG); - mDefSigningAlgorithm = + mDefSigningAlgorithm = checkSigningAlgorithmFromName(mDefSigningAlgname); CMS.debug( - "got signing algorithm " + mDefSigningAlgorithm); + "got signing algorithm " + mDefSigningAlgorithm); mInited = true; } catch (java.security.cert.CertificateException e) { - CMS.debug("SigningUnit init: debug "+ e.toString()); + CMS.debug("SigningUnit init: debug " + e.toString()); log(ILogger.LL_FAILURE, CMS.getLogMessage("CMSCORE_CA_SIGNING_CA_CERT", e.getMessage())); throw new ECAException(CMS.getUserMessage("CMS_BASE_INTERNAL_ERROR", e.toString())); } catch (CryptoManager.NotInitializedException e) { - CMS.debug("SigningUnit init: debug "+ e.toString()); + CMS.debug("SigningUnit init: debug " + e.toString()); log(ILogger.LL_FAILURE, CMS.getLogMessage("CMSCORE_CA_SIGNING_TOKEN_INIT", e.toString())); throw new ECAException(CMS.getUserMessage("CMS_CA_CRYPTO_NOT_INITIALIZED")); } catch (IncorrectPasswordException e) { - CMS.debug("SigningUnit init: debug "+ e.toString()); + CMS.debug("SigningUnit init: debug " + e.toString()); log(ILogger.LL_FAILURE, CMS.getLogMessage("CMSCORE_CA_SIGNING_WRONG_PWD", e.toString())); throw new ECAException(CMS.getUserMessage("CMS_CA_INVALID_PASSWORD")); } catch (NoSuchTokenException e) { - CMS.debug("SigningUnit init: debug "+ e.toString()); + CMS.debug("SigningUnit init: debug " + e.toString()); log(ILogger.LL_FAILURE, CMS.getLogMessage("CMSCORE_CA_SIGNING_TOKEN_NOT_FOUND", tokenname, e.toString())); throw new ECAException(CMS.getUserMessage("CMS_CA_TOKEN_NOT_FOUND", tokenname)); } catch (ObjectNotFoundException e) { - CMS.debug("SigningUnit init: debug "+ e.toString()); + CMS.debug("SigningUnit init: debug " + e.toString()); log(ILogger.LL_FAILURE, CMS.getLogMessage("CMSCORE_CA_SIGNING_CERT_NOT_FOUND", e.toString())); throw new ECAException(CMS.getUserMessage("CMS_CA_CERT_OBJECT_NOT_FOUND")); } catch (TokenException e) { - CMS.debug("SigningUnit init: debug "+ e.toString()); + CMS.debug("SigningUnit init: debug " + e.toString()); log(ILogger.LL_FAILURE, CMS.getLogMessage("OPERATION_ERROR", e.toString())); throw new ECAException(CMS.getUserMessage("CMS_CA_TOKEN_ERROR")); - } catch (Exception e){ - CMS.debug("SigningUnit init: debug "+ e.toString()); - } + } catch (Exception e) { + CMS.debug("SigningUnit init: debug " + e.toString()); + } } /** @@ -218,7 +216,7 @@ public final class SigningUnit implements ISigningUnit { * @exception EBaseException if signing algorithm is not supported. */ public SignatureAlgorithm checkSigningAlgorithmFromName(String algname) - throws EBaseException { + throws EBaseException { try { SignatureAlgorithm sigalg = null; @@ -252,7 +250,7 @@ public final class SigningUnit implements ISigningUnit { * @param algname is expected to be one of JCA's algorithm names. */ public byte[] sign(byte[] data, String algname) - throws EBaseException { + throws EBaseException { if (!mInited) { throw new EBaseException("CASigningUnit not initialized!"); } @@ -264,11 +262,11 @@ public final class SigningUnit implements ISigningUnit { if (algname != null) { signAlg = checkSigningAlgorithmFromName(algname); } - - // XXX use a pool of signers based on alg ? + + // XXX use a pool of signers based on alg ? // XXX Map algor. name to id. hack: use hardcoded define for now. CMS.debug( - "Getting algorithm context for " + algname + " " + signAlg); + "Getting algorithm context for " + algname + " " + signAlg); Signature signer = mToken.getSignatureContext(signAlg); signer.initSign(mPrivk); @@ -294,9 +292,9 @@ public final class SigningUnit implements ISigningUnit { throw new EBaseException(e.toString()); } } - + public boolean verify(byte[] data, byte[] signature, String algname) - throws EBaseException { + throws EBaseException { if (!mInited) { throw new EBaseException("CASigningUnit not initialized!"); } @@ -337,8 +335,8 @@ public final class SigningUnit implements ISigningUnit { private void log(int level, String msg) { if (mLogger == null) return; - mLogger.log(ILogger.EV_SYSTEM, null, ILogger.S_CA, - level, "CASigningUnit: " + msg); + mLogger.log(ILogger.EV_SYSTEM, null, ILogger.S_CA, + level, "CASigningUnit: " + msg); } /** @@ -356,15 +354,15 @@ public final class SigningUnit implements ISigningUnit { } public void setDefaultAlgorithm(String algorithm) throws EBaseException { - mConfig.putString(PROP_DEFAULT_SIGNALG, algorithm); + mConfig.putString(PROP_DEFAULT_SIGNALG, algorithm); mDefSigningAlgname = algorithm; - log(ILogger.LL_INFO, - "Default signing algorithm is set to " + algorithm); + log(ILogger.LL_INFO, + "Default signing algorithm is set to " + algorithm); } /** * get all possible algorithms for the CA signing key type. - */ + */ public String[] getAllAlgorithms() throws EBaseException { byte[] keybytes = mPubk.getEncoded(); X509Key key = new X509Key(); @@ -389,4 +387,3 @@ public final class SigningUnit implements ISigningUnit { return Cert.mapAlgorithmToJss(algname); } } - |