diff -ur voms-api-java-3.0.5.orig/src/main/java/org/italiangrid/voms/ac/impl/DefaultVOMSValidationStrategy.java voms-api-java-3.0.5/src/main/java/org/italiangrid/voms/ac/impl/DefaultVOMSValidationStrategy.java --- voms-api-java-3.0.5.orig/src/main/java/org/italiangrid/voms/ac/impl/DefaultVOMSValidationStrategy.java 2014-12-09 10:55:31.000000000 +0100 +++ voms-api-java-3.0.5/src/main/java/org/italiangrid/voms/ac/impl/DefaultVOMSValidationStrategy.java 2014-12-17 09:19:10.674934059 +0100 @@ -39,7 +39,7 @@ import javax.security.auth.x500.X500Principal; import org.bouncycastle.asn1.ASN1ObjectIdentifier; -import org.bouncycastle.asn1.x509.X509Extension; +import org.bouncycastle.asn1.x509.Extension; import org.bouncycastle.cert.X509CertificateHolder; import org.bouncycastle.cert.jcajce.JcaX509CertificateHolder; import org.bouncycastle.operator.ContentVerifierProvider; @@ -239,8 +239,8 @@ private boolean checkNoRevAvailExtension(VOMSAttribute attributes, List validationErrors) { - X509Extension noRevAvail = attributes.getVOMSAC().getExtension( - X509Extension.noRevAvail); + Extension noRevAvail = attributes.getVOMSAC().getExtension( + Extension.noRevAvail); if (noRevAvail != null && noRevAvail.isCritical()) { validationErrors.add(newErrorMessage(other, "NoRevAvail AC extension cannot be critical!")); @@ -252,8 +252,8 @@ private boolean checkAuthorityKeyIdentifierExtension( VOMSAttribute attributes, List validationErrors) { - X509Extension authKeyId = attributes.getVOMSAC().getExtension( - X509Extension.authorityKeyIdentifier); + Extension authKeyId = attributes.getVOMSAC().getExtension( + Extension.authorityKeyIdentifier); if (authKeyId != null && authKeyId.isCritical()) { validationErrors.add(newErrorMessage(other, "AuthorityKeyIdentifier AC extension cannot be critical!")); diff -ur voms-api-java-3.0.5.orig/src/main/java/org/italiangrid/voms/asn1/VOMSACGenerator.java voms-api-java-3.0.5/src/main/java/org/italiangrid/voms/asn1/VOMSACGenerator.java --- voms-api-java-3.0.5.orig/src/main/java/org/italiangrid/voms/asn1/VOMSACGenerator.java 2014-12-09 10:55:31.000000000 +0100 +++ voms-api-java-3.0.5/src/main/java/org/italiangrid/voms/asn1/VOMSACGenerator.java 2014-12-17 09:45:43.404176616 +0100 @@ -30,20 +30,21 @@ import org.bouncycastle.asn1.ASN1Encodable; import org.bouncycastle.asn1.ASN1EncodableVector; import org.bouncycastle.asn1.ASN1InputStream; +import org.bouncycastle.asn1.ASN1Object; import org.bouncycastle.asn1.ASN1ObjectIdentifier; -import org.bouncycastle.asn1.DEREncodable; +import org.bouncycastle.asn1.ASN1Primitive; import org.bouncycastle.asn1.DERNull; -import org.bouncycastle.asn1.DERObject; import org.bouncycastle.asn1.DEROctetString; import org.bouncycastle.asn1.DERSequence; import org.bouncycastle.asn1.DERTaggedObject; import org.bouncycastle.asn1.x509.AlgorithmIdentifier; import org.bouncycastle.asn1.x509.AuthorityKeyIdentifier; +import org.bouncycastle.asn1.x509.Extension; import org.bouncycastle.asn1.x509.GeneralName; import org.bouncycastle.asn1.x509.GeneralNames; -import org.bouncycastle.asn1.x509.X509Extension; import org.bouncycastle.cert.AttributeCertificateHolder; import org.bouncycastle.cert.AttributeCertificateIssuer; +import org.bouncycastle.cert.CertIOException; import org.bouncycastle.cert.X509AttributeCertificateHolder; import org.bouncycastle.cert.X509v2AttributeCertificateBuilder; import org.bouncycastle.cert.jcajce.JcaX509CertificateHolder; @@ -156,7 +157,7 @@ return String.format("%s://%s:%d", voName, host, port); } - private ASN1Encodable buildACCertsExtensionContent( + private ASN1Object buildACCertsExtensionContent( EnumSet properties) { ASN1EncodableVector issuerCertsContainer = new ASN1EncodableVector(); @@ -166,7 +167,7 @@ issuerCertsContainer.add(new DERSequence()); else issuerCertsContainer.add(new DERSequence( - getCertAsDEREncodable(aaCredential.getCertificate()))); + getCertAsASN1Encodable(aaCredential.getCertificate()))); return new DERSequence(issuerCertsContainer); } @@ -174,7 +175,7 @@ private AuthorityKeyIdentifier buildAuthorityKeyIdentifier() { byte[] authKeyId = aaCredential.getCertificate().getExtensionValue( - X509Extension.authorityKeyIdentifier.toString()); + Extension.authorityKeyIdentifier.toString()); if (authKeyId != null) { return new AuthorityKeyIdentifier(authKeyId); @@ -183,7 +184,7 @@ return null; } - private ASN1Encodable buildFQANsAttributeContent(List fqans, + private ASN1Object buildFQANsAttributeContent(List fqans, GeneralName policyAuthorityInfo) { ASN1EncodableVector container = new ASN1EncodableVector(); @@ -201,7 +202,7 @@ return new DERSequence(container); } - private ASN1Encodable buildGAExtensionContent( + private ASN1Object buildGAExtensionContent( EnumSet properties, List gas, GeneralName policyAuthorityInfo) { @@ -262,7 +263,7 @@ } - private ASN1Encodable buildTargetsExtensionContent( + private ASN1Object buildTargetsExtensionContent( EnumSet properties, List targets) { ASN1EncodableVector targetSeq = new ASN1EncodableVector(); @@ -315,6 +316,8 @@ GeneralName policyAuthorityInfo = buildPolicyAuthorityInfo(voName, host, port); + try { + builder.addAttribute(VOMS_FQANS_OID, buildFQANsAttributeContent(fqans, policyAuthorityInfo)); @@ -327,7 +330,7 @@ policyAuthorityInfo)); if (targets != null && !targets.isEmpty()) - builder.addExtension(X509Extension.targetInformation, true, + builder.addExtension(Extension.targetInformation, true, buildTargetsExtensionContent(generationProperties, targets)); if (!generationProperties @@ -350,13 +353,17 @@ .contains(ACGenerationProperties.INCLUDE_CRITICAL_AKID_EXTENSION)) akidIsCritical = true; - builder.addExtension(X509Extension.noRevAvail, noRevAvailIsCritical, - new DERNull()); + builder.addExtension(Extension.noRevAvail, noRevAvailIsCritical, + DERNull.INSTANCE); AuthorityKeyIdentifier akid = buildAuthorityKeyIdentifier(); - builder.addExtension(X509Extension.authorityKeyIdentifier, akidIsCritical, - akid != null ? akid : new DERNull()); + builder.addExtension(Extension.authorityKeyIdentifier, akidIsCritical, + akid != null ? akid : DERNull.INSTANCE); + + } catch (CertIOException e) { + throw new VOMSError(e.getMessage(), e); + } return builder.build(getSigner(generationProperties)); @@ -373,19 +380,19 @@ DERSequence acSeq = new DERSequence(vomsACs); CertificateExtension ext = new CertificateExtension( - VOMS_EXTENSION_OID.getId(), acSeq.toASN1Object(), false); + VOMS_EXTENSION_OID.getId(), acSeq.toASN1Primitive(), false); return ext; } - private DEREncodable getCertAsDEREncodable(X509Certificate cert) { + private ASN1Encodable getCertAsASN1Encodable(X509Certificate cert) { try { byte[] certBytes = cert.getEncoded(); ByteArrayInputStream bais = new ByteArrayInputStream(certBytes); ASN1InputStream is = new ASN1InputStream(bais); - DERObject derCert = is.readObject(); + ASN1Primitive derCert = is.readObject(); is.close(); return derCert; diff -ur voms-api-java-3.0.5.orig/src/main/java/org/italiangrid/voms/asn1/VOMSACUtils.java voms-api-java-3.0.5/src/main/java/org/italiangrid/voms/asn1/VOMSACUtils.java --- voms-api-java-3.0.5.orig/src/main/java/org/italiangrid/voms/asn1/VOMSACUtils.java 2014-12-09 10:55:31.000000000 +0100 +++ voms-api-java-3.0.5/src/main/java/org/italiangrid/voms/asn1/VOMSACUtils.java 2014-12-17 09:51:02.983413156 +0100 @@ -31,21 +31,21 @@ import org.bouncycastle.asn1.ASN1InputStream; import org.bouncycastle.asn1.ASN1OctetString; +import org.bouncycastle.asn1.ASN1Primitive; import org.bouncycastle.asn1.ASN1Sequence; import org.bouncycastle.asn1.ASN1TaggedObject; import org.bouncycastle.asn1.DERIA5String; -import org.bouncycastle.asn1.DERObject; import org.bouncycastle.asn1.DEROctetString; -import org.bouncycastle.asn1.DERSequence; +import org.bouncycastle.asn1.DLSequence; import org.bouncycastle.asn1.x509.Attribute; import org.bouncycastle.asn1.x509.AttributeCertificate; +import org.bouncycastle.asn1.x509.Certificate; +import org.bouncycastle.asn1.x509.Extension; import org.bouncycastle.asn1.x509.GeneralName; import org.bouncycastle.asn1.x509.IetfAttrSyntax; import org.bouncycastle.asn1.x509.Target; import org.bouncycastle.asn1.x509.TargetInformation; import org.bouncycastle.asn1.x509.Targets; -import org.bouncycastle.asn1.x509.X509CertificateStructure; -import org.bouncycastle.asn1.x509.X509Extension; import org.bouncycastle.cert.X509AttributeCertificateHolder; import org.bouncycastle.jce.provider.BouncyCastleProvider; import org.bouncycastle.jce.provider.X509CertificateObject; @@ -124,7 +124,7 @@ while (theACs.hasMoreElements()) { - AttributeCertificate parsedAC = new AttributeCertificate( + AttributeCertificate parsedAC = AttributeCertificate.getInstance( theACs.nextElement()); acs.add(parsedAC); } @@ -178,8 +178,8 @@ List targets = new ArrayList(); - X509Extension targetExtension = ac - .getExtension(X509Extension.targetInformation); + Extension targetExtension = ac + .getExtension(Extension.targetInformation); if (targetExtension == null) return targets; @@ -193,7 +193,7 @@ // The deserialization has to be done by hand since it seems VOMS // does not correctly encode the ACTargets extension... ASN1Sequence targetSequence = (ASN1Sequence) asn1TargetContainer - .getDERObject(); + .toASN1Primitive(); Target[] asn1Targets = new Target[targetSequence.size()]; int count = 0; @@ -291,8 +291,8 @@ Attribute[] asn1Attrs = acHolder.getAttributes(VOMS_FQANS_OID); for (Attribute a : asn1Attrs) { - DERObject theVOMSDerObject = a.getAttributeValues()[0].getDERObject(); - IetfAttrSyntax attrSyntax = new IetfAttrSyntax( + ASN1Primitive theVOMSDerObject = a.getAttributeValues()[0].toASN1Primitive(); + IetfAttrSyntax attrSyntax = IetfAttrSyntax.getInstance( ASN1Sequence.getInstance(theVOMSDerObject)); String policyAuthority = policyAuthoritySanityChecks(attrSyntax); @@ -350,7 +350,7 @@ List gas = new ArrayList(); - X509Extension gasExtension = ac.getExtension(VOMS_GENERIC_ATTRS_OID); + Extension gasExtension = ac.getExtension(VOMS_GENERIC_ATTRS_OID); if (gasExtension == null) return gas; @@ -416,7 +416,7 @@ List certs = new ArrayList(); - X509Extension e = ac.getExtension(VOMS_CERTS_OID); + Extension e = ac.getExtension(VOMS_CERTS_OID); if (e == null) return null; @@ -429,7 +429,7 @@ certSeq = (ASN1Sequence) certSeq.getObjectAt(0); @SuppressWarnings("unchecked") - Enumeration encodedCerts = certSeq.getObjects(); + Enumeration encodedCerts = certSeq.getObjects(); CertificateFactory cf = null; @@ -443,7 +443,7 @@ while (encodedCerts.hasMoreElements()) { - DERSequence s = encodedCerts.nextElement(); + DLSequence s = encodedCerts.nextElement(); X509CertificateObject certObj = null; byte[] certData = null; X509Certificate theCert = null; @@ -451,7 +451,7 @@ try { certObj = new X509CertificateObject( - X509CertificateStructure.getInstance(ASN1Sequence.getInstance(s))); + Certificate.getInstance(ASN1Sequence.getInstance(s))); certData = certObj.getEncoded(); theCert = (X509Certificate) cf .generateCertificate(new ByteArrayInputStream(certData)); diff -ur voms-api-java-3.0.5.orig/src/main/java/org/italiangrid/voms/asn1/VOMSConstants.java voms-api-java-3.0.5/src/main/java/org/italiangrid/voms/asn1/VOMSConstants.java --- voms-api-java-3.0.5.orig/src/main/java/org/italiangrid/voms/asn1/VOMSConstants.java 2014-12-09 10:55:31.000000000 +0100 +++ voms-api-java-3.0.5/src/main/java/org/italiangrid/voms/asn1/VOMSConstants.java 2014-12-17 09:19:10.761933034 +0100 @@ -20,7 +20,7 @@ import java.util.Set; import org.bouncycastle.asn1.ASN1ObjectIdentifier; -import org.bouncycastle.asn1.x509.X509Extension; +import org.bouncycastle.asn1.x509.Extension; /** * A set of useful constants for ASN.1 parsing of VOMS attributes. @@ -56,7 +56,7 @@ public final Set VOMS_HANDLED_EXTENSIONS = new HashSet( Arrays.asList(VOMS_FQANS_OID, VOMS_CERTS_OID, VOMS_GENERIC_ATTRS_OID, - X509Extension.targetInformation, X509Extension.noRevAvail, - X509Extension.authorityKeyIdentifier)); + Extension.targetInformation, Extension.noRevAvail, + Extension.authorityKeyIdentifier)); } diff -ur voms-api-java-3.0.5.orig/src/test/java/org/italiangrid/voms/test/ac/TestNoExtensionValidation.java voms-api-java-3.0.5/src/test/java/org/italiangrid/voms/test/ac/TestNoExtensionValidation.java --- voms-api-java-3.0.5.orig/src/test/java/org/italiangrid/voms/test/ac/TestNoExtensionValidation.java 2014-12-09 10:55:31.000000000 +0100 +++ voms-api-java-3.0.5/src/test/java/org/italiangrid/voms/test/ac/TestNoExtensionValidation.java 2014-12-17 09:19:10.761933034 +0100 @@ -15,6 +15,7 @@ */ package org.italiangrid.voms.test.ac; +import java.io.IOException; import java.security.InvalidKeyException; import java.security.NoSuchAlgorithmException; import java.security.SignatureException; @@ -55,7 +56,8 @@ @Test public void testNoExtensionValidation() throws InvalidKeyException, - CertificateParsingException, SignatureException, NoSuchAlgorithmException { + CertificateParsingException, SignatureException, NoSuchAlgorithmException, + IOException { ProxyCertificateOptions options = new ProxyCertificateOptions( cred.getCertificateChain());