/************************************************************************* *                                                                       * *  EJBCA: The OpenSource Certificate Authority                          * *                                                                       * *  This software is free software; you can redistribute it and/or       * *  modify it under the terms of the GNU Lesser General Public           * *  License as published by the Free Software Foundation; either         * *  version 2.1 of the License, or any later version.                    * *                                                                       * *  See terms of license at gnu.org.                                     * *                                                                       * *************************************************************************/ package se.anatom.ejbca.util;import java.io.*;import java.security.*;import java.security.cert.*;import java.util.*;import java.net.URL;import org.apache.log4j.Logger;import org.bouncycastle.asn1.*;import org.bouncycastle.asn1.x509.*;import org.bouncycastle.jce.*;import org.bouncycastle.jce.provider.BouncyCastleProvider;/** * Tools to handle common certificate operations. * * @version $Id: CertTools.java,v 1.64 2004/06/01 19:38:26 anatom Exp $ */public class CertTools {    private static Logger log = Logger.getLogger(CertTools.class);    public static final String EMAIL = "rfc822name";    public static final String EMAIL1 = "email";    public static final String EMAIL2 = "EmailAddress";    public static final String EMAIL3 = "E";    public static final String DNS = "dNSName";    public static final String URI = "uniformResourceIdentifier";    public static final String URI1 = "uri";    public static final String IPADDR = "iPAddress";    /** Microsoft altName for windows smart card logon */    public static final String UPN = "upn";    /** ObjectID for upn altName for windows smart card logon */    public static final String UPN_OBJECTID = "1.3.6.1.4.1.311.20.2.3";    /** Microsoft altName for windows domain controller guid */    public static final String GUID = "guid";    /** ObjectID for upn altName for windows domain controller guid */    public static final String GUID_OBJECTID = "1.3.6.1.4.1.311.25.1";        private static final String[] EMAILIDS = { EMAIL, EMAIL1, EMAIL2, EMAIL3 };    /** ObjectID for unstructuredName DN attribute */    public static final DERObjectIdentifier unstructuredName = new DERObjectIdentifier("1.2.840.113549.1.9.2");    /** ObjectID for unstructuredAddress DN attribute */    public static final DERObjectIdentifier unstructuredAddress = new DERObjectIdentifier("1.2.840.113549.1.9.8");    /**     * inhibits creation of new CertTools     */    private CertTools() {    }    /** BC X509Name contains some lookup tables that could maybe be used here. */    private static final HashMap oids = new HashMap();    static {        oids.put("c", X509Name.C);        oids.put("dc", X509Name.DC);        oids.put("st", X509Name.ST);        oids.put("l", X509Name.L);        oids.put("o", X509Name.O);        oids.put("ou", X509Name.OU);        oids.put("t", X509Name.T);        oids.put("surname", X509Name.SURNAME);        oids.put("initials", X509Name.INITIALS);        oids.put("givenname", X509Name.GIVENNAME);        oids.put("gn", X509Name.GIVENNAME);        oids.put("sn", X509Name.SN);        oids.put("serialnumber", X509Name.SN);        oids.put("cn", X509Name.CN);        oids.put("uid", X509Name.UID);        oids.put("emailaddress", X509Name.EmailAddress);        oids.put("e", X509Name.EmailAddress);        oids.put("email", X509Name.EmailAddress);        oids.put("1.2.840.113549.1.9.2", unstructuredName); //unstructuredName         oids.put("1.2.840.113549.1.9.8", unstructuredAddress); //unstructuredAddress    }    private static final String[] dNObjectsForward = {        "1.2.840.113549.1.9.8", "1.2.840.113549.1.9.2", "emailaddress", "e", "email", "uid", "cn", "sn", "serialnumber", "gn", "givenname",        "initials", "surname", "t", "ou", "o", "l", "st", "dc", "c"    };    private static final String[] dNObjectsReverse = {        "c", "dc", "st", "l", "o", "ou", "t", "surname", "initials",        "givenname", "gn", "serialnumber", "sn", "cn", "uid", "email", "e", "emailaddress", "1.2.840.113549.1.9.2", "1.2.840.113549.1.9.8"    };    /** Change this if you want reverse order */    private static final String[] dNObjects = dNObjectsForward;                private static DERObjectIdentifier getOid(String o) {        return (DERObjectIdentifier) oids.get(o.toLowerCase());    } // getOid    /**     * Creates a (Bouncycastle) X509Name object from a string with a DN. Known OID (with order)     * are: <code> EmailAddress, UID, CN, SN (SerialNumber), GivenName, Initials, SurName, T, OU,     * O, L, ST, DC, C </code>     * To change order edit 'dnObjects' in this source file.     *     * @param dn String containing DN that will be transformed into X509Name, The DN string has the     *        format "CN=zz,OU=yy,O=foo,C=SE". Unknown OIDs in the string will be silently     *        dropped.     *     * @return X509Name     */    public static X509Name stringToBcX509Name(String dn) {        //log.debug(">stringToBcX509Name: " + dn);        // first make two vectors, one with all the C, O, OU etc specifying        // the order and one holding the actual values        ArrayList oldordering = new ArrayList();        ArrayList oldvalues = new ArrayList();        X509NameTokenizer xt = new X509NameTokenizer(dn);        while (xt.hasMoreTokens()) {            // This is a pair (CN=xx)            String pair = xt.nextToken();            int ix = pair.indexOf("=");            if (ix != -1) {                // make lower case so we can easily compare later                oldordering.add(pair.substring(0, ix).toLowerCase());                oldvalues.add(pair.substring(ix + 1));            } else {                // Huh, what's this?            }        }        // Now in the specified order, move from oldordering to newordering,        // reshuffling as we go along        Vector ordering = new Vector();        Vector values = new Vector();        int index = -1;        for (int i = 0; i < dNObjects.length; i++) {            //log.debug("Looking for "+dNObjects[i]);            String object = dNObjects[i];            while ((index = oldordering.indexOf(object)) != -1) {                //log.debug("Found 1 "+object+" at index " + index);                DERObjectIdentifier oid = getOid(object);                if (oid != null) {                    //log.debug("Added "+object+", "+oldvalues.elementAt(index));                    ordering.add(oid);                    // remove from the old vectors, so we start clean the next round                    values.add(oldvalues.remove(index));                    oldordering.remove(index);                    index = -1;                }            }        }        /*        if (log.isDebugEnabled()) {            Iterator i1 = ordering.iterator();            Iterator i2 = values.iterator();            log.debug("Order: ");            while (i1.hasNext()) {                log.debug(((DERObjectIdentifier)i1.next()).getId());            }            log.debug("Values: ");            while (i2.hasNext()) {                log.debug((String)i2.next());            }        } */        //log.debug("<stringToBcX509Name");        return new X509Name(ordering, values);    } // stringToBcX509Name    /**     * Every DN-string should look the same. Creates a name string ordered and looking like we want     * it...     *     * @param dn String containing DN     *     * @return String containing DN     */    public static String stringToBCDNString(String dn) {        //log.debug(">stringToBcDNString: "+dn);        String ret = stringToBcX509Name(dn).toString();        //log.debug("<stringToBcDNString: "+ret);        return ret;    }    /**     * Convenience method for getting an email address from a DN. Uses {@link     * getPartFromDN(String,String)} internally, and searches for {@link EMAIL}, {@link EMAIL1},     * {@link EMAIL2}, {@link EMAIL3} and returns the first one found.     *     * @param dn the DN     *     * @return the found email address, or <code>null</code> if none is found     */    public static String getEmailFromDN(String dn) {        log.debug(">getEmailFromDN(" + dn + ")");        String email = null;        for (int i = 0; (i < EMAILIDS.length) && (email == null); i++) {            email = getPartFromDN(dn, EMAILIDS[i]);        }        log.debug("<getEmailFromDN(" + dn + "): " + email);        return email;    }    /**     * Gets a specified part of a DN. Specifically the first occurrence it the DN contains several     * instances of a part (i.e. cn=x, cn=y returns x).     *     * @param dn String containing DN, The DN string has the format "C=SE, O=xx, OU=yy, CN=zz".     * @param dnpart String specifying which part of the DN to get, should be "CN" or "OU" etc.     *     * @return String containing dnpart or null if dnpart is not present     */    public static String getPartFromDN(String dn, String dnpart) {        log.debug(">getPartFromDN: dn:'" + dn + "', dnpart=" + dnpart);        String part = null;        if ((dn != null) && (dnpart != null)) {            String o;            dnpart += "="; // we search for 'CN=' etc.            X509NameTokenizer xt = new X509NameTokenizer(dn);            while (xt.hasMoreTokens()) {                o = xt.nextToken();                //log.debug("checking: "+o.substring(0,dnpart.length()));                if ((o.length() > dnpart.length()) &&                        o.substring(0, dnpart.length()).equalsIgnoreCase(dnpart)) {                    part = o.substring(dnpart.length());                    break;                }            }        }        log.debug("<getpartFromDN: resulting DN part=" + part);        return part;    } //getPartFromDN    /**     * Gets subject DN in the format we are sure about (BouncyCastle),supporting UTF8.     *     * @param cert X509Certificate     *     * @return String containing the subjects DN.     */    public static String getSubjectDN(X509Certificate cert) {        return getDN(cert, 1);    }    /**     * Gets issuer DN in the format we are sure about (BouncyCastle),supporting UTF8.     *     * @param cert X509Certificate     *     * @return String containing the issuers DN.     */    public static String getIssuerDN(X509Certificate cert) {        return getDN(cert, 2);    }    /**