Refactor delta cert code

Author: peterdettman

core/src/main/java/org/bouncycastle/asn1/x509/Certificate.java

@@ -1,11 +1,13 @@
 package org.bouncycastle.asn1.x509;
 
 import org.bouncycastle.asn1.ASN1BitString;
+import org.bouncycastle.asn1.ASN1EncodableVector;
 import org.bouncycastle.asn1.ASN1Integer;
 import org.bouncycastle.asn1.ASN1Object;
 import org.bouncycastle.asn1.ASN1Primitive;
 import org.bouncycastle.asn1.ASN1Sequence;
 import org.bouncycastle.asn1.ASN1TaggedObject;
+import org.bouncycastle.asn1.DERSequence;
 import org.bouncycastle.asn1.x500.X500Name;
 
 /**
@@ -69,6 +71,32 @@ private Certificate(
         }
     }
 
+    public Certificate(TBSCertificate tbsCertificate, AlgorithmIdentifier signatureAlgorithm, ASN1BitString signature)
+    {
+        if (tbsCertificate == null)
+        {
+            throw new NullPointerException("'tbsCertificate' cannot be null");
+        }
+        if (signatureAlgorithm == null)
+        {
+            throw new NullPointerException("'signatureAlgorithm' cannot be null");
+        }
+        if (signature == null)
+        {
+            throw new NullPointerException("'signature' cannot be null");
+        }
+
+        this.tbsCert = tbsCertificate;
+        this.sigAlgId = signatureAlgorithm;
+        this.sig = signature;
+
+        ASN1EncodableVector v = new ASN1EncodableVector(3);
+        v.add(tbsCertificate);
+        v.add(signatureAlgorithm);
+        v.add(signature);
+        this.seq = new DERSequence(v);
+    }
+
     public TBSCertificate getTBSCertificate()
     {
         return tbsCert;
@@ -119,6 +147,21 @@ public SubjectPublicKeyInfo getSubjectPublicKeyInfo()
         return tbsCert.getSubjectPublicKeyInfo();
     }
 
+    public ASN1BitString getIssuerUniqueID()
+    {
+        return tbsCert.getIssuerUniqueId();
+    }
+
+    public ASN1BitString getSubjectUniqueID()
+    {
+        return tbsCert.getSubjectUniqueId();
+    }
+
+    public Extensions getExtensions()
+    {
+        return tbsCert.getExtensions();
+    }
+
     public AlgorithmIdentifier getSignatureAlgorithm()
     {
         return sigAlgId;

core/src/main/java/org/bouncycastle/asn1/x509/DeltaCertificateDescriptor.java

@@ -17,32 +17,28 @@
 
 /**
  * <pre>
- *     DeltaCertificateDescriptor ::= SEQUENCE {
- *      serialNumber          CertificateSerialNumber,
- *      signature             [0] IMPLICIT AlgorithmIdentifier
- *           {SIGNATURE_ALGORITHM, {...}} OPTIONAL,
- *      issuer                [1] IMPLICIT Name OPTIONAL,
- *      validity              [2] IMPLICIT Validity OPTIONAL,
- *      subject               [3] IMPLICIT Name OPTIONAL,
- *      subjectPublicKeyInfo  SubjectPublicKeyInfo,
- *      extensions            [4] IMPLICIT Extensions{CertExtensions}
- *           OPTIONAL,
- *      signatureValue        BIT STRING
- *    }
- *    </pre>
+ * DeltaCertificateDescriptor ::= SEQUENCE {
+ *   serialNumber          CertificateSerialNumber,
+ *   signature             [0] EXPLICIT AlgorithmIdentifier {SIGNATURE_ALGORITHM, {...}} OPTIONAL,
+ *   issuer                [1] EXPLICIT Name OPTIONAL,
+ *   validity              [2] EXPLICIT Validity OPTIONAL,
+ *   subject               [3] EXPLICIT Name OPTIONAL,
+ *   subjectPublicKeyInfo  SubjectPublicKeyInfo,
+ *   extensions            [4] EXPLICIT Extensions{CertExtensions} OPTIONAL,
+ *   signatureValue        BIT STRING
+ * }
+ * </pre>
  */
 public class DeltaCertificateDescriptor
     extends ASN1Object
 {
     private final ASN1Integer serialNumber;
-
-    private AlgorithmIdentifier signature;
-    private X500Name issuer;
-    private ASN1Sequence validity;
-    private X500Name subject;
-    private SubjectPublicKeyInfo subjectPublicKeyInfo;
-    private Extensions extensions;
-
+    private final AlgorithmIdentifier signature;
+    private final X500Name issuer;
+    private final Validity validity;
+    private final X500Name subject;
+    private final SubjectPublicKeyInfo subjectPublicKeyInfo;
+    private final Extensions extensions;
     private final ASN1BitString signatureValue;
 
     public static DeltaCertificateDescriptor getInstance(
@@ -73,10 +69,15 @@ public static DeltaCertificateDescriptor fromExtensions(Extensions extensions)
 
     private DeltaCertificateDescriptor(ASN1Sequence seq)
     {
-        this.serialNumber = ASN1Integer.getInstance(seq.getObjectAt(0));
+        ASN1Integer serialNumber = ASN1Integer.getInstance(seq.getObjectAt(0));
 
         int idx = 1;
         ASN1Encodable next = seq.getObjectAt(idx++);
+
+        AlgorithmIdentifier signature = null;
+        X500Name issuer = null;
+        Validity validity = null;
+        X500Name subject = null;
         while (next instanceof ASN1TaggedObject)
         {
             ASN1TaggedObject tagged = ASN1TaggedObject.getInstance(next);
@@ -89,7 +90,7 @@ private DeltaCertificateDescriptor(ASN1Sequence seq)
                 issuer = X500Name.getInstance(tagged, true);   // issuer
                 break;
             case 2:
-                validity = ASN1Sequence.getInstance(tagged, true);
+                validity = Validity.getInstance(tagged, true);
                 break;
             case 3:
                 subject = X500Name.getInstance(tagged, true);   // subject
@@ -98,9 +99,11 @@ private DeltaCertificateDescriptor(ASN1Sequence seq)
             next = seq.getObjectAt(idx++);
         }
 
-        subjectPublicKeyInfo = subjectPublicKeyInfo.getInstance(next);
+        SubjectPublicKeyInfo subjectPublicKeyInfo = SubjectPublicKeyInfo.getInstance(next);
 
         next = seq.getObjectAt(idx);
+
+        Extensions extensions = null;
         while (next instanceof ASN1TaggedObject)
         {
             ASN1TaggedObject tagged = ASN1TaggedObject.getInstance(next);
@@ -113,7 +116,43 @@ private DeltaCertificateDescriptor(ASN1Sequence seq)
             next = seq.getObjectAt(idx++);
         }
 
-        signatureValue = ASN1BitString.getInstance(next);
+        ASN1BitString signatureValue = ASN1BitString.getInstance(next);
+
+        this.serialNumber = serialNumber;
+        this.signature = signature;
+        this.issuer = issuer;
+        this.validity = validity;
+        this.subject = subject;
+        this.subjectPublicKeyInfo = subjectPublicKeyInfo;
+        this.extensions = extensions;
+        this.signatureValue = signatureValue;
+    }
+
+    public DeltaCertificateDescriptor(ASN1Integer serialNumber, AlgorithmIdentifier signature, X500Name issuer,
+        Validity validity, X500Name subject, SubjectPublicKeyInfo subjectPublicKeyInfo, Extensions extensions,
+        ASN1BitString signatureValue)
+    {
+        if (serialNumber == null)
+        {
+            throw new NullPointerException("'serialNumber' cannot be null");
+        }
+        if (subjectPublicKeyInfo == null)
+        {
+            throw new NullPointerException("'subjectPublicKeyInfo' cannot be null");
+        }
+        if (signatureValue == null)
+        {
+            throw new NullPointerException("'signatureValue' cannot be null");
+        }
+
+        this.serialNumber = serialNumber;
+        this.signature = signature;
+        this.issuer = issuer;
+        this.validity = validity;
+        this.subject = subject;
+        this.subjectPublicKeyInfo = subjectPublicKeyInfo;
+        this.extensions = extensions;
+        this.signatureValue = signatureValue;
     }
 
     public ASN1Integer getSerialNumber()
@@ -131,7 +170,13 @@ public X500Name getIssuer()
         return issuer;
     }
 
+    /** @deprecated Use getValidityObject instead. */
     public ASN1Sequence getValidity()
+    {
+        return (ASN1Sequence)validity.toASN1Primitive();
+    }
+
+    public Validity getValidityObject()
     {
         return validity;
     }
@@ -156,96 +201,83 @@ public ASN1BitString getSignatureValue()
         return signatureValue;
     }
 
+    /** @deprecated Use DeltaCertificateTool#trimDeltaCertificateDescriptor instead. */
     public DeltaCertificateDescriptor trimTo(TBSCertificate baseTbsCertificate, Extensions tbsExtensions)
     {
-        AlgorithmIdentifier signature = baseTbsCertificate.signature;
-        X500Name issuer = baseTbsCertificate.issuer;
-        ASN1Sequence validity = new DERSequence(new ASN1Encodable[]
+        return trimDeltaCertificateDescriptor(this, baseTbsCertificate, tbsExtensions);
+    }
+
+    // NB: This can replace DeltaCertificateTool#trimDeltaCertificateDescriptor once 'trimTo' is removed
+    private static DeltaCertificateDescriptor trimDeltaCertificateDescriptor(DeltaCertificateDescriptor descriptor,
+        TBSCertificate tbsCertificate, Extensions tbsExtensions)
+    {
+        ASN1Integer serialNumber = descriptor.getSerialNumber();
+
+        AlgorithmIdentifier signature = descriptor.getSignature();
+        if (signature != null && signature.equals(tbsCertificate.getSignature()))
         {
-            baseTbsCertificate.startDate, baseTbsCertificate.endDate
-        });
-        X500Name subject = baseTbsCertificate.subject;
-        ASN1Sequence s = ASN1Sequence.getInstance(toASN1Primitive());
-        ASN1EncodableVector v = new ASN1EncodableVector();
+            signature = null;
+        }
 
-        Enumeration en = s.getObjects();
-        v.add((ASN1Encodable)en.nextElement());
+        X500Name issuer = descriptor.getIssuer();
+        if (issuer != null && issuer.equals(tbsCertificate.getIssuer()))
+        {
+            issuer = null;
+        }
 
-        ASN1Encodable next = (ASN1Encodable)en.nextElement();
-        while (next instanceof ASN1TaggedObject)
+        Validity validity = descriptor.getValidityObject();
+        if (validity != null && validity.equals(tbsCertificate.getValidity()))
         {
-            ASN1TaggedObject tagged = ASN1TaggedObject.getInstance(next);
-            switch (tagged.getTagNo())
-            {
-            case 0:
-                AlgorithmIdentifier sig = AlgorithmIdentifier.getInstance(tagged, true);
-                if (!sig.equals(signature))
-                {
-                    v.add(next);
-                }
-                break;
-            case 1:
-                X500Name iss = X500Name.getInstance(tagged, true);   // issuer
-                if (!iss.equals(issuer))
-                {
-                    v.add(next);
-                }
-                break;
-            case 2:
-                ASN1Sequence val = ASN1Sequence.getInstance(tagged, true);
-                if (!val.equals(validity))
-                {
-                    v.add(next);
-                }
-                break;
-            case 3:
-                X500Name sub = X500Name.getInstance(tagged, true);   // subject
-                if (!sub.equals(subject))
-                {
-                    v.add(next);
-                }
-                break;
-            }
-            next = (ASN1Encodable)en.nextElement();
+            validity = null;
         }
 
-        v.add(next);
+        X500Name subject = descriptor.getSubject();
+        if (subject != null && subject.equals(tbsCertificate.getSubject()))
+        {
+            subject = null;
+        }
 
-        next = (ASN1Encodable)en.nextElement();
-        while (next instanceof ASN1TaggedObject)
+        SubjectPublicKeyInfo subjectPublicKeyInfo = descriptor.getSubjectPublicKeyInfo();
+
+        Extensions extensions = descriptor.getExtensions();
+        if (extensions != null)
         {
-            ASN1TaggedObject tagged = ASN1TaggedObject.getInstance(next);
-            switch (tagged.getTagNo())
+            /*
+             * draft-bonnell-lamps-chameleon-certs-05 4.1:
+             *
+             * [The extensions] field MUST NOT contain any extension:
+             * - which has the same criticality and DER-encoded value as encoded in the Base Certificate,
+             * - whose type does not appear in the Base Certificate, or
+             * - which is of the DCD extension type (recursive Delta Certificates are not permitted).
+             * 
+             * [...] The ordering of extensions in [the extensions] field MUST be relative to the ordering of the
+             * extensions as they are encoded in the Delta [recte Base] Certificate.
+             */
+
+            ExtensionsGenerator generator = new ExtensionsGenerator();
+
+            for (Enumeration extEn = tbsExtensions.oids(); extEn.hasMoreElements();)
             {
-            case 4:
-                Extensions deltaExts = Extensions.getInstance(tagged, true);
-                ExtensionsGenerator deltaExtGen = new ExtensionsGenerator();
-                for (Enumeration extEn = deltaExts.oids(); extEn.hasMoreElements(); )
+                ASN1ObjectIdentifier oid = (ASN1ObjectIdentifier)extEn.nextElement();
+                if (Extension.deltaCertificateDescriptor.equals(oid))
                 {
-                    Extension deltaExt = deltaExts.getExtension((ASN1ObjectIdentifier)extEn.nextElement());
-                    Extension primaryExt = tbsExtensions.getExtension(deltaExt.getExtnId());
-
-                    if (primaryExt != null)
-                    {
-                        if (!deltaExt.equals(primaryExt))
-                        {
-                            deltaExtGen.addExtension(deltaExt);
-                        }
-                    }
+                    continue;
                 }
 
-                DeltaCertificateDescriptor trimmedDeltaCertDesc;
-                if (!deltaExtGen.isEmpty())
+                Extension deltaExtension = extensions.getExtension(oid);
+                if (deltaExtension != null && !deltaExtension.equals(tbsExtensions.getExtension(oid)))
                 {
-                    v.add(new DERTaggedObject(true, 4, deltaExtGen.generate()));
+                    generator.addExtension(deltaExtension);
                 }
             }
-            next = (ASN1Encodable)en.nextElement();
+
+            extensions = generator.isEmpty() ? null : generator.generate();
         }
 
-        v.add(next);
+        ASN1BitString signatureValue = descriptor.getSignatureValue();
 
-        return new DeltaCertificateDescriptor(new DERSequence(v));
+        return new DeltaCertificateDescriptor(serialNumber, signature, issuer, validity, subject,
+            subjectPublicKeyInfo, extensions, signatureValue);
     }
 
     private void addOptional(ASN1EncodableVector v, int tag, boolean explicit, ASN1Object obj)
@@ -258,7 +290,7 @@ private void addOptional(ASN1EncodableVector v, int tag, boolean explicit, ASN1O
 
     public ASN1Primitive toASN1Primitive()
     {
-        ASN1EncodableVector v = new ASN1EncodableVector(7);
+        ASN1EncodableVector v = new ASN1EncodableVector(8);
 
         v.add(serialNumber);
         addOptional(v, 0, true, signature);