diff -ur voms-api-java-3_0_2.orig/pom.xml voms-api-java-3_0_2/pom.xml --- voms-api-java-3_0_2.orig/pom.xml 2013-10-17 16:29:07.000000000 +0200 +++ voms-api-java-3_0_2/pom.xml 2014-03-08 09:57:54.689276148 +0100 @@ -37,7 +37,7 @@ /usr/share/javadoc/${project.name} 4.10 1.3.0 - 1.46 + 1.47 1.9.0 2.2.2 2.5.2 @@ -189,7 +189,7 @@ org.bouncycastle - bcmail-jdk16 + bcpkix-jdk15on ${bcVersion} diff -ur voms-api-java-3_0_2.orig/src/main/java/org/italiangrid/voms/ac/impl/DefaultVOMSValidationStrategy.java voms-api-java-3_0_2/src/main/java/org/italiangrid/voms/ac/impl/DefaultVOMSValidationStrategy.java --- voms-api-java-3_0_2.orig/src/main/java/org/italiangrid/voms/ac/impl/DefaultVOMSValidationStrategy.java 2013-10-17 16:29:07.000000000 +0200 +++ voms-api-java-3_0_2/src/main/java/org/italiangrid/voms/ac/impl/DefaultVOMSValidationStrategy.java 2014-03-08 09:57:16.678003546 +0100 @@ -39,7 +39,7 @@ import javax.security.auth.x500.X500Principal; import org.bouncycastle.asn1.ASN1ObjectIdentifier; -import org.bouncycastle.asn1.x509.X509Extension; +import org.bouncycastle.asn1.x509.Extension; import org.bouncycastle.cert.X509CertificateHolder; import org.bouncycastle.cert.jcajce.JcaX509CertificateHolder; import org.bouncycastle.operator.ContentVerifierProvider; @@ -215,7 +215,7 @@ private boolean checkNoRevAvailExtension(VOMSAttribute attributes, List validationErrors){ - X509Extension noRevAvail = attributes.getVOMSAC().getExtension(X509Extension.noRevAvail); + Extension noRevAvail = attributes.getVOMSAC().getExtension(Extension.noRevAvail); if (noRevAvail != null && noRevAvail.isCritical()){ validationErrors.add(newErrorMessage(other, "NoRevAvail AC extension cannot be critical!")); return false; @@ -225,7 +225,7 @@ private boolean checkAuthorityKeyIdentifierExtension(VOMSAttribute attributes, List validationErrors){ - X509Extension authKeyId = attributes.getVOMSAC().getExtension(X509Extension.authorityKeyIdentifier); + Extension authKeyId = attributes.getVOMSAC().getExtension(Extension.authorityKeyIdentifier); if (authKeyId != null && authKeyId.isCritical()){ validationErrors.add(newErrorMessage(other, "AuthorityKeyIdentifier AC extension cannot be critical!")); return false; diff -ur voms-api-java-3_0_2.orig/src/main/java/org/italiangrid/voms/asn1/VOMSACGenerator.java voms-api-java-3_0_2/src/main/java/org/italiangrid/voms/asn1/VOMSACGenerator.java --- voms-api-java-3_0_2.orig/src/main/java/org/italiangrid/voms/asn1/VOMSACGenerator.java 2013-10-17 16:29:07.000000000 +0200 +++ voms-api-java-3_0_2/src/main/java/org/italiangrid/voms/asn1/VOMSACGenerator.java 2014-03-08 09:57:16.678003546 +0100 @@ -30,20 +30,21 @@ import org.bouncycastle.asn1.ASN1Encodable; import org.bouncycastle.asn1.ASN1EncodableVector; import org.bouncycastle.asn1.ASN1InputStream; +import org.bouncycastle.asn1.ASN1Object; import org.bouncycastle.asn1.ASN1ObjectIdentifier; -import org.bouncycastle.asn1.DEREncodable; +import org.bouncycastle.asn1.ASN1Primitive; import org.bouncycastle.asn1.DERNull; -import org.bouncycastle.asn1.DERObject; import org.bouncycastle.asn1.DEROctetString; import org.bouncycastle.asn1.DERSequence; import org.bouncycastle.asn1.DERTaggedObject; import org.bouncycastle.asn1.x509.AlgorithmIdentifier; import org.bouncycastle.asn1.x509.AuthorityKeyIdentifier; +import org.bouncycastle.asn1.x509.Extension; import org.bouncycastle.asn1.x509.GeneralName; import org.bouncycastle.asn1.x509.GeneralNames; -import org.bouncycastle.asn1.x509.X509Extension; import org.bouncycastle.cert.AttributeCertificateHolder; import org.bouncycastle.cert.AttributeCertificateIssuer; +import org.bouncycastle.cert.CertIOException; import org.bouncycastle.cert.X509AttributeCertificateHolder; import org.bouncycastle.cert.X509v2AttributeCertificateBuilder; import org.bouncycastle.cert.jcajce.JcaX509CertificateHolder; @@ -160,7 +161,7 @@ return String.format("%s://%s:%d", voName, host, port); } - private ASN1Encodable buildACCertsExtensionContent( + private ASN1Object buildACCertsExtensionContent( EnumSet properties) { ASN1EncodableVector issuerCertsContainer = new ASN1EncodableVector(); @@ -169,7 +170,7 @@ issuerCertsContainer.add(new DERSequence()); else issuerCertsContainer.add(new DERSequence( - getCertAsDEREncodable(aaCredential.getCertificate()))); + getCertAsASN1Encodable(aaCredential.getCertificate()))); return new DERSequence(issuerCertsContainer); } @@ -177,7 +178,7 @@ private AuthorityKeyIdentifier buildAuthorityKeyIdentifier() { byte[] authKeyId = aaCredential.getCertificate().getExtensionValue( - X509Extension.authorityKeyIdentifier.toString()); + Extension.authorityKeyIdentifier.toString()); if (authKeyId != null) { return new AuthorityKeyIdentifier(authKeyId); @@ -186,7 +187,7 @@ return null; } - private ASN1Encodable buildFQANsAttributeContent(List fqans, + private ASN1Object buildFQANsAttributeContent(List fqans, GeneralName policyAuthorityInfo) { ASN1EncodableVector container = new ASN1EncodableVector(); @@ -204,7 +205,7 @@ return new DERSequence(container); } - private ASN1Encodable buildGAExtensionContent( + private ASN1Object buildGAExtensionContent( EnumSet properties, List gas, GeneralName policyAuthorityInfo) { @@ -265,7 +266,7 @@ } - private ASN1Encodable buildTargetsExtensionContent( + private ASN1Object buildTargetsExtensionContent( EnumSet properties, List targets) { ASN1EncodableVector targetSeq = new ASN1EncodableVector(); @@ -329,6 +330,8 @@ GeneralName policyAuthorityInfo = buildPolicyAuthorityInfo(voName, host, port); + try { + builder.addAttribute(VOMS_FQANS_OID, buildFQANsAttributeContent(fqans, policyAuthorityInfo)); @@ -341,7 +344,7 @@ policyAuthorityInfo)); if (targets != null && !targets.isEmpty()) - builder.addExtension(X509Extension.targetInformation, true, + builder.addExtension(Extension.targetInformation, true, buildTargetsExtensionContent(generationProperties, targets)); if (!generationProperties @@ -365,16 +368,20 @@ .contains(ACGenerationProperties.INCLUDE_CRITICAL_AKID_EXTENSION)) akidIsCritical = true; - builder.addExtension(X509Extension.noRevAvail, + builder.addExtension(Extension.noRevAvail, noRevAvailIsCritical, new DERNull()); AuthorityKeyIdentifier akid = buildAuthorityKeyIdentifier(); - builder.addExtension(X509Extension.authorityKeyIdentifier, + builder.addExtension(Extension.authorityKeyIdentifier, akidIsCritical, akid != null ? akid : new DERNull()); + } catch (CertIOException e) { + throw new VOMSError(e.getMessage(), e); + } + return builder.build(getSigner(generationProperties)); } @@ -395,14 +402,14 @@ return ext; } - private DEREncodable getCertAsDEREncodable(X509Certificate cert) { + private ASN1Encodable getCertAsASN1Encodable(X509Certificate cert) { try { byte[] certBytes = cert.getEncoded(); ByteArrayInputStream bais = new ByteArrayInputStream(certBytes); ASN1InputStream is = new ASN1InputStream(bais); - DERObject derCert = is.readObject(); + ASN1Primitive derCert = is.readObject(); is.close(); return derCert; diff -ur voms-api-java-3_0_2.orig/src/main/java/org/italiangrid/voms/asn1/VOMSACUtils.java voms-api-java-3_0_2/src/main/java/org/italiangrid/voms/asn1/VOMSACUtils.java --- voms-api-java-3_0_2.orig/src/main/java/org/italiangrid/voms/asn1/VOMSACUtils.java 2013-10-17 16:29:07.000000000 +0200 +++ voms-api-java-3_0_2/src/main/java/org/italiangrid/voms/asn1/VOMSACUtils.java 2014-03-08 11:07:33.203630648 +0100 @@ -31,21 +31,21 @@ import org.bouncycastle.asn1.ASN1InputStream; import org.bouncycastle.asn1.ASN1OctetString; +import org.bouncycastle.asn1.ASN1Primitive; import org.bouncycastle.asn1.ASN1Sequence; import org.bouncycastle.asn1.ASN1TaggedObject; import org.bouncycastle.asn1.DERIA5String; -import org.bouncycastle.asn1.DERObject; import org.bouncycastle.asn1.DEROctetString; -import org.bouncycastle.asn1.DERSequence; +import org.bouncycastle.asn1.DLSequence; import org.bouncycastle.asn1.x509.Attribute; import org.bouncycastle.asn1.x509.AttributeCertificate; +import org.bouncycastle.asn1.x509.Certificate; +import org.bouncycastle.asn1.x509.Extension; import org.bouncycastle.asn1.x509.GeneralName; import org.bouncycastle.asn1.x509.IetfAttrSyntax; import org.bouncycastle.asn1.x509.Target; import org.bouncycastle.asn1.x509.TargetInformation; import org.bouncycastle.asn1.x509.Targets; -import org.bouncycastle.asn1.x509.X509CertificateStructure; -import org.bouncycastle.asn1.x509.X509Extension; import org.bouncycastle.cert.X509AttributeCertificateHolder; import org.bouncycastle.jce.provider.BouncyCastleProvider; import org.bouncycastle.jce.provider.X509CertificateObject; @@ -159,7 +159,7 @@ private static List deserializeACTargets(X509AttributeCertificateHolder ac){ List targets = new ArrayList(); - X509Extension targetExtension = ac.getExtension(X509Extension.targetInformation); + Extension targetExtension = ac.getExtension(Extension.targetInformation); if (targetExtension == null) return targets; @@ -171,7 +171,7 @@ // The deserialization has to be done by hand since it seems VOMS // does not correctly encode the ACTargets extension... - ASN1Sequence targetSequence = (ASN1Sequence) asn1TargetContainer.getDERObject(); + ASN1Sequence targetSequence = (ASN1Sequence) asn1TargetContainer.toASN1Primitive(); Target[] asn1Targets = new Target[targetSequence.size()]; int count = 0; @@ -256,8 +256,8 @@ Attribute[] asn1Attrs = acHolder.getAttributes(VOMS_FQANS_OID); for (Attribute a: asn1Attrs){ - DERObject theVOMSDerObject = a.getAttributeValues()[0].getDERObject(); - IetfAttrSyntax attrSyntax = new IetfAttrSyntax(ASN1Sequence.getInstance(theVOMSDerObject)); + ASN1Primitive theVOMSDerObject = a.getAttributeValues()[0].toASN1Primitive(); + IetfAttrSyntax attrSyntax = IetfAttrSyntax.getInstance(ASN1Sequence.getInstance(theVOMSDerObject)); String policyAuthority = policyAuthoritySanityChecks(attrSyntax); @@ -306,7 +306,7 @@ List gas = new ArrayList(); - X509Extension gasExtension = ac.getExtension(VOMS_GENERIC_ATTRS_OID); + Extension gasExtension = ac.getExtension(VOMS_GENERIC_ATTRS_OID); if (gasExtension == null) return gas; @@ -364,7 +364,7 @@ private static X509Certificate[] deserializeACCerts(X509AttributeCertificateHolder ac){ List certs = new ArrayList(); - X509Extension e = ac.getExtension(VOMS_CERTS_OID); + Extension e = ac.getExtension(VOMS_CERTS_OID); if (e == null) return null; @@ -377,7 +377,7 @@ certSeq = (ASN1Sequence)certSeq.getObjectAt(0); @SuppressWarnings("unchecked") - Enumeration encodedCerts = certSeq.getObjects(); + Enumeration encodedCerts = certSeq.getObjects(); CertificateFactory cf = null; @@ -389,14 +389,14 @@ while (encodedCerts.hasMoreElements()){ - DERSequence s = encodedCerts.nextElement(); + DLSequence s = encodedCerts.nextElement(); X509CertificateObject certObj = null; byte[] certData = null; X509Certificate theCert = null; try { - certObj = new X509CertificateObject(X509CertificateStructure.getInstance(ASN1Sequence.getInstance(s))); + certObj = new X509CertificateObject(Certificate.getInstance(ASN1Sequence.getInstance(s))); certData = certObj.getEncoded(); theCert = (X509Certificate)cf.generateCertificate(new ByteArrayInputStream(certData)); diff -ur voms-api-java-3_0_2.orig/src/main/java/org/italiangrid/voms/asn1/VOMSConstants.java voms-api-java-3_0_2/src/main/java/org/italiangrid/voms/asn1/VOMSConstants.java --- voms-api-java-3_0_2.orig/src/main/java/org/italiangrid/voms/asn1/VOMSConstants.java 2013-10-17 16:29:07.000000000 +0200 +++ voms-api-java-3_0_2/src/main/java/org/italiangrid/voms/asn1/VOMSConstants.java 2014-03-08 09:57:16.678003546 +0100 @@ -20,7 +20,7 @@ import java.util.Set; import org.bouncycastle.asn1.ASN1ObjectIdentifier; -import org.bouncycastle.asn1.x509.X509Extension; +import org.bouncycastle.asn1.x509.Extension; /** * A set of useful constants for ASN.1 parsing of VOMS attributes. @@ -54,8 +54,8 @@ VOMS_FQANS_OID, VOMS_CERTS_OID, VOMS_GENERIC_ATTRS_OID, - X509Extension.targetInformation, - X509Extension.noRevAvail, - X509Extension.authorityKeyIdentifier)); + Extension.targetInformation, + Extension.noRevAvail, + Extension.authorityKeyIdentifier)); } diff -ur voms-api-java-3_0_2.orig/src/test/java/org/italiangrid/voms/test/ac/TestNoExtensionValidation.java voms-api-java-3_0_2/src/test/java/org/italiangrid/voms/test/ac/TestNoExtensionValidation.java --- voms-api-java-3_0_2.orig/src/test/java/org/italiangrid/voms/test/ac/TestNoExtensionValidation.java 2013-10-17 16:29:07.000000000 +0200 +++ voms-api-java-3_0_2/src/test/java/org/italiangrid/voms/test/ac/TestNoExtensionValidation.java 2014-03-08 09:57:16.679003553 +0100 @@ -15,6 +15,7 @@ */ package org.italiangrid.voms.test.ac; +import java.io.IOException; import java.security.InvalidKeyException; import java.security.NoSuchAlgorithmException; import java.security.SignatureException; @@ -52,7 +53,7 @@ } @Test - public void testNoExtensionValidation() throws InvalidKeyException, CertificateParsingException, SignatureException, NoSuchAlgorithmException { + public void testNoExtensionValidation() throws InvalidKeyException, CertificateParsingException, SignatureException, NoSuchAlgorithmException, IOException { ProxyCertificateOptions options = new ProxyCertificateOptions(cred.getCertificateChain()); options.setType(ProxyType.LEGACY);