1 module hunt.security.cert.X509CRL; 2 3 import hunt.security.cert.CRL; 4 import hunt.security.cert.X509Certificate; 5 import hunt.security.cert.X509CRLEntry; 6 7 import hunt.security.Key; 8 // import hunt.security.x509.X509CRLImpl; 9 import hunt.security.x500.X500Principal; 10 import hunt.security.Principal; 11 import hunt.security.Provider; 12 13 import hunt.collection; 14 15 import hunt.Exceptions; 16 17 import std.datetime; 18 import std.bigint; 19 20 alias BigInteger = BigInt; 21 22 /** 23 * <p> 24 * Abstract class for an X.509 Certificate Revocation List (CRL). 25 * A CRL is a time-stamped list identifying revoked certificates. 26 * It is signed by a Certificate Authority (CA) and made freely 27 * available in a public repository. 28 * 29 * <p>Each revoked certificate is 30 * identified in a CRL by its certificate serial number. When a 31 * certificate-using system uses a certificate (e.g., for verifying a 32 * remote user's digital signature), that system not only checks the 33 * certificate signature and validity but also acquires a suitably- 34 * recent CRL and checks that the certificate serial number is not on 35 * that CRL. The meaning of "suitably-recent" may vary with local 36 * policy, but it usually means the most recently-issued CRL. A CA 37 * issues a new CRL on a regular periodic basis (e.g., hourly, daily, or 38 * weekly). Entries are added to CRLs as revocations occur, and an 39 * entry may be removed when the certificate expiration date is reached. 40 * <p> 41 * The X.509 v2 CRL format is described below in ASN.1: 42 * <pre> 43 * CertificateList ::= SEQUENCE { 44 * tbsCertList TBSCertList, 45 * signatureAlgorithm AlgorithmIdentifier, 46 * signature BIT STRING } 47 * </pre> 48 * <p> 49 * More information can be found in 50 * <a href="http://www.ietf.org/rfc/rfc3280.txt">RFC 3280: Internet X.509 51 * Public Key Infrastructure Certificate and CRL Profile</a>. 52 * <p> 53 * The ASN.1 definition of {@code tbsCertList} is: 54 * <pre> 55 * TBSCertList ::= SEQUENCE { 56 * version Version OPTIONAL, 57 * -- if present, must be v2 58 * signature AlgorithmIdentifier, 59 * issuer Name, 60 * thisUpdate ChoiceOfTime, 61 * nextUpdate ChoiceOfTime OPTIONAL, 62 * revokedCertificates SEQUENCE OF SEQUENCE { 63 * userCertificate CertificateSerialNumber, 64 * revocationDate ChoiceOfTime, 65 * crlEntryExtensions Extensions OPTIONAL 66 * -- if present, must be v2 67 * } OPTIONAL, 68 * crlExtensions [0] EXPLICIT Extensions OPTIONAL 69 * -- if present, must be v2 70 * } 71 * </pre> 72 * <p> 73 * CRLs are instantiated using a certificate factory. The following is an 74 * example of how to instantiate an X.509 CRL: 75 * <pre>{@code 76 * try (InputStream inStream = new FileInputStream("fileName-of-crl")) { 77 * CertificateFactory cf = CertificateFactory.getInstance("X.509"); 78 * X509CRL crl = (X509CRL)cf.generateCRL(inStream); 79 * } 80 * }</pre> 81 * 82 * @author Hemma Prafullchandra 83 * 84 * 85 * @see CRL 86 * @see CertificateFactory 87 * @see X509Extension 88 */ 89 90 abstract class X509CRL : CRL , X509Extension { 91 92 private X500Principal issuerPrincipal; 93 94 /** 95 * Constructor for X.509 CRLs. 96 */ 97 protected this() { 98 super("X.509"); 99 } 100 101 102 /** 103 * Returns the ASN.1 DER-encoded form of this CRL. 104 * 105 * @return the encoded form of this certificate 106 * @exception CRLException if an encoding error occurs. 107 */ 108 abstract byte[] getEncoded(); 109 110 /** 111 * Verifies that this CRL was signed using the 112 * private key that corresponds to the given public key. 113 * 114 * @param key the PublicKey used to carry out the verification. 115 * 116 * @exception NoSuchAlgorithmException on unsupported signature 117 * algorithms. 118 * @exception InvalidKeyException on incorrect key. 119 * @exception NoSuchProviderException if there's no default provider. 120 * @exception SignatureException on signature errors. 121 * @exception CRLException on encoding errors. 122 */ 123 abstract void verify(PublicKey key); 124 125 /** 126 * Verifies that this CRL was signed using the 127 * private key that corresponds to the given public key. 128 * This method uses the signature verification engine 129 * supplied by the given provider. 130 * 131 * @param key the PublicKey used to carry out the verification. 132 * @param sigProvider the name of the signature provider. 133 * 134 * @exception NoSuchAlgorithmException on unsupported signature 135 * algorithms. 136 * @exception InvalidKeyException on incorrect key. 137 * @exception NoSuchProviderException on incorrect provider. 138 * @exception SignatureException on signature errors. 139 * @exception CRLException on encoding errors. 140 */ 141 abstract void verify(PublicKey key, string sigProvider); 142 143 /** 144 * Verifies that this CRL was signed using the 145 * private key that corresponds to the given public key. 146 * This method uses the signature verification engine 147 * supplied by the given provider. Note that the specified Provider object 148 * does not have to be registered in the provider list. 149 * 150 * This method was added to version 1.8 of the Java Platform Standard 151 * Edition. In order to maintain backwards compatibility with existing 152 * service providers, this method is not {@code abstract} 153 * and it provides a default implementation. 154 * 155 * @param key the PublicKey used to carry out the verification. 156 * @param sigProvider the signature provider. 157 * 158 * @exception NoSuchAlgorithmException on unsupported signature 159 * algorithms. 160 * @exception InvalidKeyException on incorrect key. 161 * @exception SignatureException on signature errors. 162 * @exception CRLException on encoding errors. 163 * @since 1.8 164 */ 165 abstract void verify(PublicKey key, Provider sigProvider); 166 // void verify(PublicKey key, Provider sigProvider) { 167 // X509CRLImpl.verify(this, key, sigProvider); 168 // } 169 170 /** 171 * Gets the {@code version} (version number) value from the CRL. 172 * The ASN.1 definition for this is: 173 * <pre> 174 * version Version OPTIONAL, 175 * -- if present, must be v2 176 * 177 * Version ::= INTEGER { v1(0), v2(1), v3(2) } 178 * -- v3 does not apply to CRLs but appears for consistency 179 * -- with definition of Version for certs 180 * </pre> 181 * 182 * @return the version number, i.e. 1 or 2. 183 */ 184 abstract int getVersion(); 185 186 /** 187 * <strong>Denigrated</strong>, replaced by {@linkplain 188 * #getIssuerX500Principal()}. This method returns the {@code issuer} 189 * as an implementation specific Principal object, which should not be 190 * relied upon by portable code. 191 * 192 * <p> 193 * Gets the {@code issuer} (issuer distinguished name) value from 194 * the CRL. The issuer name identifies the entity that signed (and 195 * issued) the CRL. 196 * 197 * <p>The issuer name field contains an 198 * X.500 distinguished name (DN). 199 * The ASN.1 definition for this is: 200 * <pre> 201 * issuer Name 202 * 203 * Name ::= CHOICE { RDNSequence } 204 * RDNSequence ::= SEQUENCE OF RelativeDistinguishedName 205 * RelativeDistinguishedName ::= 206 * SET OF AttributeValueAssertion 207 * 208 * AttributeValueAssertion ::= SEQUENCE { 209 * AttributeType, 210 * AttributeValue } 211 * AttributeType ::= OBJECT IDENTIFIER 212 * AttributeValue ::= ANY 213 * </pre> 214 * The {@code Name} describes a hierarchical name composed of 215 * attributes, 216 * such as country name, and corresponding values, such as US. 217 * The type of the {@code AttributeValue} component is determined by 218 * the {@code AttributeType}; in general it will be a 219 * {@code directoryString}. A {@code directoryString} is usually 220 * one of {@code PrintableString}, 221 * {@code TeletexString} or {@code UniversalString}. 222 * 223 * @return a Principal whose name is the issuer distinguished name. 224 */ 225 abstract Principal getIssuerDN(); 226 227 /** 228 * Returns the issuer (issuer distinguished name) value from the 229 * CRL as an {@code X500Principal}. 230 * <p> 231 * It is recommended that subclasses override this method. 232 * 233 * @return an {@code X500Principal} representing the issuer 234 * distinguished name 235 * @since 1.4 236 */ 237 abstract X500Principal getIssuerX500Principal(); 238 239 /** 240 * Gets the {@code thisUpdate} date from the CRL. 241 * The ASN.1 definition for this is: 242 * <pre> 243 * thisUpdate ChoiceOfTime 244 * ChoiceOfTime ::= CHOICE { 245 * utcTime UTCTime, 246 * generalTime GeneralizedTime } 247 * </pre> 248 * 249 * @return the {@code thisUpdate} date from the CRL. 250 */ 251 abstract Date getThisUpdate(); 252 253 /** 254 * Gets the {@code nextUpdate} date from the CRL. 255 * 256 * @return the {@code nextUpdate} date from the CRL, or null if 257 * not present. 258 */ 259 abstract Date getNextUpdate(); 260 261 /** 262 * Gets the CRL entry, if any, with the given certificate serialNumber. 263 * 264 * @param serialNumber the serial number of the certificate for which a CRL entry 265 * is to be looked up 266 * @return the entry with the given serial number, or null if no such entry 267 * exists in this CRL. 268 * @see X509CRLEntry 269 */ 270 abstract X509CRLEntry getRevokedCertificate(BigInteger serialNumber); 271 272 /** 273 * Get the CRL entry, if any, for the given certificate. 274 * 275 * <p>This method can be used to lookup CRL entries in indirect CRLs, 276 * that means CRLs that contain entries from issuers other than the CRL 277 * issuer. The default implementation will only return entries for 278 * certificates issued by the CRL issuer. Subclasses that wish to 279 * support indirect CRLs should override this method. 280 * 281 * @param certificate the certificate for which a CRL entry is to be looked 282 * up 283 * @return the entry for the given certificate, or null if no such entry 284 * exists in this CRL. 285 * @exception NullPointerException if certificate is null 286 * 287 * @since 1.5 288 */ 289 X509CRLEntry getRevokedCertificate(X509Certificate certificate) { 290 X500Principal certIssuer = certificate.getIssuerX500Principal(); 291 X500Principal crlIssuer = getIssuerX500Principal(); 292 if (!certIssuer.opEquals(crlIssuer)) { 293 return null; 294 } 295 return getRevokedCertificate(certificate.getSerialNumber()); 296 } 297 298 /** 299 * Gets all the entries from this CRL. 300 * This returns a Set of X509CRLEntry objects. 301 * 302 * @return all the entries or null if there are none present. 303 * @see X509CRLEntry 304 */ 305 abstract Set!X509CRLEntry getRevokedCertificates(); 306 307 /** 308 * Gets the DER-encoded CRL information, the 309 * {@code tbsCertList} from this CRL. 310 * This can be used to verify the signature independently. 311 * 312 * @return the DER-encoded CRL information. 313 * @exception CRLException if an encoding error occurs. 314 */ 315 abstract byte[] getTBSCertList(); 316 317 /** 318 * Gets the {@code signature} value (the raw signature bits) from 319 * the CRL. 320 * The ASN.1 definition for this is: 321 * <pre> 322 * signature BIT STRING 323 * </pre> 324 * 325 * @return the signature. 326 */ 327 abstract byte[] getSignature(); 328 329 /** 330 * Gets the signature algorithm name for the CRL 331 * signature algorithm. An example is the string "SHA256withRSA". 332 * The ASN.1 definition for this is: 333 * <pre> 334 * signatureAlgorithm AlgorithmIdentifier 335 * 336 * AlgorithmIdentifier ::= SEQUENCE { 337 * algorithm OBJECT IDENTIFIER, 338 * parameters ANY DEFINED BY algorithm OPTIONAL } 339 * -- contains a value of the type 340 * -- registered for use with the 341 * -- algorithm object identifier value 342 * </pre> 343 * 344 * <p>The algorithm name is determined from the {@code algorithm} 345 * OID string. 346 * 347 * @return the signature algorithm name. 348 */ 349 abstract string getSigAlgName(); 350 351 /** 352 * Gets the signature algorithm OID string from the CRL. 353 * An OID is represented by a set of nonnegative whole numbers separated 354 * by periods. 355 * For example, the string "1.2.840.10040.4.3" identifies the SHA-1 356 * with DSA signature algorithm defined in 357 * <a href="http://www.ietf.org/rfc/rfc3279.txt">RFC 3279: Algorithms and 358 * Identifiers for the Internet X.509 Public Key Infrastructure Certificate 359 * and CRL Profile</a>. 360 * 361 * <p>See {@link #getSigAlgName() getSigAlgName} for 362 * relevant ASN.1 definitions. 363 * 364 * @return the signature algorithm OID string. 365 */ 366 abstract string getSigAlgOID(); 367 368 /** 369 * Gets the DER-encoded signature algorithm parameters from this 370 * CRL's signature algorithm. In most cases, the signature 371 * algorithm parameters are null; the parameters are usually 372 * supplied with the public key. 373 * If access to individual parameter values is needed then use 374 * {@link java.security.AlgorithmParameters AlgorithmParameters} 375 * and instantiate with the name returned by 376 * {@link #getSigAlgName() getSigAlgName}. 377 * 378 * <p>See {@link #getSigAlgName() getSigAlgName} for 379 * relevant ASN.1 definitions. 380 * 381 * @return the DER-encoded signature algorithm parameters, or 382 * null if no parameters are present. 383 */ 384 abstract byte[] getSigAlgParams(); 385 }