}
protected static void processCRLB2(DistributionPoint dp,
Object cert, X509CRL crl) throws AnnotatedException
{
IssuingDistributionPoint idp = null;
try
{
idp = IssuingDistributionPoint
.getInstance(CertPathValidatorUtilities.getExtensionValue(crl,
ISSUING_DISTRIBUTION_POINT));
}
catch (Exception e)
{
throw new AnnotatedException(
"Issuing distribution point extension could not be decoded.", e);
}
// distribution point name is present
if (idp != null && idp.getDistributionPoint() != null)
{
// make list of names
DistributionPointName dpName = IssuingDistributionPoint
.getInstance(idp).getDistributionPoint();
List names = new ArrayList();
if (dpName.getType() == DistributionPointName.FULL_NAME)
{
GeneralName[] genNames = GeneralNames.getInstance(
dpName.getName()).getNames();
for (int j = 0; j < genNames.length; j++)
{
names.add(genNames[j].getDEREncoded());
}
}
boolean matches = false;
// verify that one of the names in the IDP matches one
// of the names in the DP.
if (dp.getDistributionPoint() != null)
{
dpName = dp.getDistributionPoint();
if (dpName.getType() == DistributionPointName.FULL_NAME)
{
GeneralName[] genNames = GeneralNames.getInstance(
dpName.getName()).getNames();
for (int j = 0; j < genNames.length; j++)
{
if (names.contains(genNames[j]))
{
matches = true;
break;
}
}
}
if (!matches)
{
throw new AnnotatedException(
"None of the names in the CRL issuing distribution point matches one "
+ "of the names in a distributionPoint field of the certificate CRL distribution point.");
}
}
// verify that one of the names in
// the IDP matches one of the names in the cRLIssuer field of
// the DP
else
{
if (dp.getCRLIssuer() == null)
{
throw new AnnotatedException(
"Either the cRLIssuer or the distributionPoint field must "
+ "be contained in DistributionPoint.");
}
GeneralName[] genNames = dp.getCRLIssuer().getNames();
for (int j = 0; j < genNames.length; j++)
{
if (names.contains(genNames[j]))
{
matches = true;
break;
}
}
if (!matches)
{
throw new AnnotatedException(
"None of the names in the CRL issuing distribution point matches one "
+ "of the names in a cRLIssuer field of the certificate CRL distribution point.");
}
}
BasicConstraints bc = null;
try
{
bc = BasicConstraints.getInstance(CertPathValidatorUtilities
.getExtensionValue((java.security.cert.X509Extension)cert, BASIC_CONSTRAINTS));
}
catch (Exception e)
{
throw new AnnotatedException(
"Basic constraints extension could not be decoded.",
e);
}
if (cert instanceof X509Certificate)
{
// (b) (ii)
if (idp.onlyContainsUserCerts() && (bc != null && bc.isCA()))
{
throw new AnnotatedException(
"CA Cert CRL only contains user certificates.");
}
// (b) (iii)
if (idp.onlyContainsCACerts() && (bc == null || !bc.isCA()))
{
throw new AnnotatedException(
"End CRL only contains CA certificates.");
}
}
// (b) (iv)
if (idp.onlyContainsAttributeCerts())
{
throw new AnnotatedException(
"onlyContainsAttributeCerts boolean is asserted.");
}
}