// --- BEGIN COPYRIGHT BLOCK --- // This program is free software; you can redistribute it and/or modify // it under the terms of the GNU General Public License as published by // the Free Software Foundation; version 2 of the License. // // This program is distributed in the hope that it will be useful, // but WITHOUT ANY WARRANTY; without even the implied warranty of // MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the // GNU General Public License for more details. // // You should have received a copy of the GNU General Public License along // with this program; if not, write to the Free Software Foundation, Inc., // 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. // // (C) 2007 Red Hat, Inc. // All rights reserved. // --- END COPYRIGHT BLOCK --- package com.netscape.cms.policy.extensions; import java.io.IOException; import java.security.cert.CertificateException; import java.util.Enumeration; import java.util.Locale; import java.util.Vector; import netscape.security.x509.CertificateExtensions; import netscape.security.x509.CertificateVersion; import netscape.security.x509.GeneralName; import netscape.security.x509.GeneralNames; import netscape.security.x509.SubjectAlternativeNameExtension; import netscape.security.x509.X509CertInfo; import com.netscape.certsrv.apps.CMS; import com.netscape.certsrv.base.EBaseException; import com.netscape.certsrv.base.IConfigStore; import com.netscape.certsrv.base.IExtendedPluginInfo; import com.netscape.certsrv.base.ISubsystem; import com.netscape.certsrv.logging.ILogger; import com.netscape.certsrv.policy.IEnrollmentPolicy; import com.netscape.certsrv.policy.IGeneralNameUtil; import com.netscape.certsrv.policy.IPolicyProcessor; import com.netscape.certsrv.policy.ISubjAltNameConfig; import com.netscape.certsrv.request.IRequest; import com.netscape.certsrv.request.PolicyResult; import com.netscape.cms.policy.APolicyRule; /** * Subject Alternative Name extension policy. * * Adds the subject alternative name extension as configured. * * Two forms are supported. 1) For S/MIME certificates, email * addresses are copied from data stored in the request by the * authentication component. Both 'e' and 'altEmail' are supported * so that both the primary address and alternative forms may be * certified. Only the primary goes in the subjectName position (which * should be phased out). * * e * mailAlternateAddress *
* *
* NOTE: The Policy Framework has been replaced by the Profile Framework. **
*
* @deprecated
* @version $Revision$, $Date$
*/
public class SubjectAltNameExt extends APolicyRule
implements IEnrollmentPolicy, IExtendedPluginInfo {
// (standard says SHOULD be marked critical if included.)
protected static final String PROP_CRITICAL = "critical";
protected static final boolean DEF_CRITICAL = false;
protected IConfigStore mConfig = null;
protected boolean mEnabled = false;
protected boolean mCritical = DEF_CRITICAL;
protected int mNumGNs = 0;
protected ISubjAltNameConfig[] mGNs = null;
Vector
*
* The entries may be of the form:
*
* ra.Policy.rule.
*
* @param req The request on which to apply policy.
* @return The policy result object.
*/
public PolicyResult apply(IRequest req) {
PolicyResult res = PolicyResult.ACCEPTED;
// Find the X509CertInfo object in the request
X509CertInfo[] ci =
req.getExtDataInCertInfoArray(IRequest.CERT_INFO);
if (ci == null || ci[0] == null) {
setError(req, CMS.getUserMessage("CMS_POLICY_NO_CERT_INFO"), NAME);
return PolicyResult.REJECTED; // unrecoverable error.
}
for (int i = 0; i < ci.length; i++) {
PolicyResult certRes = applyCert(req, ci[i]);
if (certRes == PolicyResult.REJECTED)
return certRes;
}
return res;
}
public PolicyResult applyCert(IRequest req, X509CertInfo certInfo) {
PolicyResult res = PolicyResult.ACCEPTED;
try {
// Find the extensions in the certInfo
CertificateExtensions extensions = (CertificateExtensions)
certInfo.get(X509CertInfo.EXTENSIONS);
// Remove any previously computed version of the extension
// unless it is from RA. If from RA, accept what RA put in
// request and don't add our own.
if (extensions != null) {
String sourceId = req.getSourceId();
if (sourceId != null && sourceId.length() > 0)
return res; // accepted
try {
extensions.delete(SubjectAlternativeNameExtension.class.getSimpleName());
} catch (IOException e) {
// extension isn't there
}
}
// form list of general names for the extension.
GeneralNames gns = new GeneralNames();
for (int i = 0; i < mNumGNs; i++) {
Object value = null;
value = req.getExtDataInString(mGNs[i].getPfx(), mGNs[i].getAttr());
if (value == null) {
continue;
}
Vector