Skip to content

Commit 580739d

Browse files
pavel-morozov-duallabpavel-morozov-duallab
committed
sign module preparations for itextsharp
1 parent afba3ca commit 580739d

11 files changed

+95
-210
lines changed

‎sign/src/main/java/com/itextpdf/signatures/CertificateUtil.java

Lines changed: 6 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -44,31 +44,15 @@ This file is part of the iText (R) project.
4444
*/
4545
package com.itextpdf.signatures;
4646

47+
import org.bouncycastle.asn1.*;
48+
import org.bouncycastle.asn1.x509.*;
49+
import org.bouncycastle.asn1.x509.Extension;
50+
4751
import java.io.ByteArrayInputStream;
4852
import java.io.IOException;
4953
import java.io.InputStream;
5054
import java.net.URL;
51-
import java.security.cert.CRL;
52-
import java.security.cert.CRLException;
53-
import java.security.cert.CertificateException;
54-
import java.security.cert.CertificateFactory;
55-
import java.security.cert.CertificateParsingException;
56-
import java.security.cert.X509Certificate;
57-
58-
import org.bouncycastle.asn1.ASN1InputStream;
59-
import org.bouncycastle.asn1.ASN1ObjectIdentifier;
60-
import org.bouncycastle.asn1.ASN1OctetString;
61-
import org.bouncycastle.asn1.ASN1Primitive;
62-
import org.bouncycastle.asn1.ASN1Sequence;
63-
import org.bouncycastle.asn1.ASN1TaggedObject;
64-
import org.bouncycastle.asn1.DERIA5String;
65-
import org.bouncycastle.asn1.DEROctetString;
66-
import org.bouncycastle.asn1.x509.CRLDistPoint;
67-
import org.bouncycastle.asn1.x509.DistributionPoint;
68-
import org.bouncycastle.asn1.x509.DistributionPointName;
69-
import org.bouncycastle.asn1.x509.Extension;
70-
import org.bouncycastle.asn1.x509.GeneralName;
71-
import org.bouncycastle.asn1.x509.GeneralNames;
55+
import java.security.cert.*;
7256

7357

7458
/**
@@ -103,7 +87,7 @@ public static String getCRLURL(X509Certificate certificate) throws CertificatePa
10387
try {
10488
obj = getExtensionValue(certificate, Extension.cRLDistributionPoints.getId());
10589
} catch (IOException e) {
106-
obj = null;
90+
obj = (ASN1Primitive) null;
10791
}
10892
if (obj == null) {
10993
return null;

‎sign/src/main/java/com/itextpdf/signatures/CertificateVerification.java

Lines changed: 7 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -44,22 +44,17 @@ This file is part of the iText (R) project.
4444
*/
4545
package com.itextpdf.signatures;
4646

47+
import org.bouncycastle.cert.ocsp.BasicOCSPResp;
48+
import org.bouncycastle.cms.jcajce.JcaSimpleSignerInfoVerifierBuilder;
49+
import org.bouncycastle.operator.jcajce.JcaContentVerifierProviderBuilder;
50+
import org.bouncycastle.tsp.TimeStampToken;
51+
4752
import java.security.KeyStore;
4853
import java.security.cert.CRL;
4954
import java.security.cert.Certificate;
5055
import java.security.cert.CertificateParsingException;
5156
import java.security.cert.X509Certificate;
52-
import java.util.ArrayList;
53-
import java.util.Calendar;
54-
import java.util.Collection;
55-
import java.util.Enumeration;
56-
import java.util.GregorianCalendar;
57-
import java.util.List;
58-
59-
import org.bouncycastle.cert.ocsp.BasicOCSPResp;
60-
import org.bouncycastle.cms.jcajce.JcaSimpleSignerInfoVerifierBuilder;
61-
import org.bouncycastle.operator.jcajce.JcaContentVerifierProviderBuilder;
62-
import org.bouncycastle.tsp.TimeStampToken;
57+
import java.util.*;
6358

6459
/**
6560
* This class consists of some methods that allow you to verify certificates.
@@ -168,7 +163,7 @@ public static List<VerificationException> verifyCertificates(Certificate[] certs
168163
}
169164
}
170165
if (result.size() == 0)
171-
result.add(new VerificationException(null, "Invalid state. Possible circular certificate chain"));
166+
result.add(new VerificationException((Certificate) null, "Invalid state. Possible circular certificate chain"));
172167
return result;
173168
}
174169

‎sign/src/main/java/com/itextpdf/signatures/CrlClientOnline.java

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -49,9 +49,9 @@ This file is part of the iText (R) project.
4949
import org.slf4j.LoggerFactory;
5050

5151
import java.io.ByteArrayOutputStream;
52+
import java.io.IOException;
5253
import java.io.InputStream;
5354
import java.net.HttpURLConnection;
54-
import java.net.MalformedURLException;
5555
import java.net.URL;
5656
import java.security.cert.Certificate;
5757
import java.security.cert.CertificateParsingException;
@@ -120,7 +120,7 @@ public CrlClientOnline(Certificate[] chain) {
120120
protected void addUrl(String url) {
121121
try {
122122
addUrl(new URL(url));
123-
} catch (MalformedURLException e) {
123+
} catch (IOException e) {
124124
LOGGER.info("Skipped CRL url (malformed): " + url);
125125
}
126126
}

‎sign/src/main/java/com/itextpdf/signatures/LtvVerification.java

Lines changed: 13 additions & 35 deletions
Original file line numberDiff line numberDiff line change
@@ -44,21 +44,15 @@ This file is part of the iText (R) project.
4444
*/
4545
package com.itextpdf.signatures;
4646

47-
import com.itextpdf.kernel.PdfException;
47+
import com.itextpdf.forms.PdfAcroForm;
4848
import com.itextpdf.io.font.PdfEncodings;
4949
import com.itextpdf.io.source.ByteBuffer;
50-
import com.itextpdf.kernel.pdf.CompressionConstants;
51-
import com.itextpdf.kernel.pdf.PdfArray;
52-
import com.itextpdf.kernel.pdf.PdfCatalog;
53-
import com.itextpdf.kernel.pdf.PdfDeveloperExtension;
54-
import com.itextpdf.kernel.pdf.PdfDictionary;
55-
import com.itextpdf.kernel.pdf.PdfDocument;
56-
import com.itextpdf.kernel.pdf.PdfIndirectReference;
57-
import com.itextpdf.kernel.pdf.PdfName;
58-
import com.itextpdf.kernel.pdf.PdfObject;
59-
import com.itextpdf.kernel.pdf.PdfStream;
60-
import com.itextpdf.kernel.pdf.PdfString;
61-
import com.itextpdf.forms.PdfAcroForm;
50+
import com.itextpdf.kernel.PdfException;
51+
import com.itextpdf.kernel.pdf.*;
52+
import org.bouncycastle.asn1.*;
53+
import org.bouncycastle.asn1.ocsp.OCSPObjectIdentifiers;
54+
import org.slf4j.Logger;
55+
import org.slf4j.LoggerFactory;
6256

6357
import java.io.ByteArrayInputStream;
6458
import java.io.IOException;
@@ -67,23 +61,7 @@ This file is part of the iText (R) project.
6761
import java.security.NoSuchAlgorithmException;
6862
import java.security.cert.Certificate;
6963
import java.security.cert.X509Certificate;
70-
import java.util.ArrayList;
71-
import java.util.Arrays;
72-
import java.util.Collection;
73-
import java.util.HashMap;
74-
import java.util.List;
75-
import java.util.Map;
76-
77-
import org.bouncycastle.asn1.ASN1EncodableVector;
78-
import org.bouncycastle.asn1.ASN1Enumerated;
79-
import org.bouncycastle.asn1.ASN1InputStream;
80-
import org.bouncycastle.asn1.ASN1Primitive;
81-
import org.bouncycastle.asn1.DEROctetString;
82-
import org.bouncycastle.asn1.DERSequence;
83-
import org.bouncycastle.asn1.DERTaggedObject;
84-
import org.bouncycastle.asn1.ocsp.OCSPObjectIdentifiers;
85-
import org.slf4j.Logger;
86-
import org.slf4j.LoggerFactory;
64+
import java.util.*;
8765

8866
/**
8967
* Add verification according to PAdES-LTV (part 4).
@@ -221,7 +199,7 @@ public boolean addVerification(String signatureName, IOcspClient ocsp, ICrlClien
221199
vd.certs.add(cert.getEncoded());
222200
}
223201
}
224-
if (vd.crls.isEmpty() && vd.ocsps.isEmpty())
202+
if (vd.crls.size() == 0 && vd.ocsps.size() == 0)
225203
return false;
226204
validated.put(getSignatureHashKey(signatureName), vd);
227205
return true;
@@ -321,7 +299,7 @@ private static byte[] hashBytesSha1(byte[] b) throws NoSuchAlgorithmException {
321299
* @throws IOException
322300
*/
323301
public void merge() throws IOException {
324-
if (used || validated.isEmpty())
302+
if (used || validated.size() == 0)
325303
return;
326304
used = true;
327305
PdfDictionary catalog = document.getCatalog().getPdfObject();
@@ -458,9 +436,9 @@ private void outputDss(PdfDictionary dss, PdfDictionary vrim, PdfArray ocsps, Pd
458436
}
459437

460438
private static class ValidationData {
461-
private List<byte[]> crls = new ArrayList<>();
462-
private List<byte[]> ocsps = new ArrayList<>();
463-
private List<byte[]> certs = new ArrayList<>();
439+
public List<byte[]> crls = new ArrayList<>();
440+
public List<byte[]> ocsps = new ArrayList<>();
441+
public List<byte[]> certs = new ArrayList<>();
464442
}
465443

466444
// TODO: Refactor. Copied from itext5 Utilities

‎sign/src/main/java/com/itextpdf/signatures/LtvVerifier.java

Lines changed: 5 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -44,9 +44,8 @@ This file is part of the iText (R) project.
4444
*/
4545
package com.itextpdf.signatures;
4646

47-
import com.itextpdf.kernel.pdf.*;
4847
import com.itextpdf.forms.PdfAcroForm;
49-
48+
import com.itextpdf.kernel.pdf.*;
5049
import org.bouncycastle.cert.ocsp.BasicOCSPResp;
5150
import org.bouncycastle.cert.ocsp.OCSPException;
5251
import org.bouncycastle.cert.ocsp.OCSPResp;
@@ -61,14 +60,13 @@ This file is part of the iText (R) project.
6160
import java.security.cert.X509CRL;
6261
import java.security.cert.X509Certificate;
6362
import java.text.MessageFormat;
63+
import java.util.ArrayList;
6464
import java.util.Calendar;
6565
import java.util.Date;
6666
import java.util.List;
6767

6868
import static com.itextpdf.signatures.LtvVerification.CertificateOption;
6969

70-
import java.util.ArrayList;
71-
7270
/**
7371
* Verifies the signatures in an LTV document.
7472
*/
@@ -150,14 +148,14 @@ protected PdfPKCS7 coversWholeDocument() throws GeneralSecurityException {
150148
LOGGER.info("The timestamp covers whole document.");
151149
}
152150
else {
153-
throw new VerificationException(null, "Signature doesn't cover whole document.");
151+
throw new VerificationException((Certificate) null, "Signature doesn't cover whole document.");
154152
}
155153
if (pkcs7.verify()) {
156154
LOGGER.info("The signed document has not been modified.");
157155
return pkcs7;
158156
}
159157
else {
160-
throw new VerificationException(null, "The document was altered after the final signature was applied.");
158+
throw new VerificationException((Certificate) null, "The document was altered after the final signature was applied.");
161159
}
162160
}
163161

@@ -198,7 +196,7 @@ public List<VerificationOK> verifySignature() throws GeneralSecurityException, I
198196
// the certificate to check
199197
signCert = (X509Certificate) chain[i++];
200198
// its issuer
201-
issuerCert = null;
199+
issuerCert = (X509Certificate) null;
202200
if (i < chain.length)
203201
issuerCert = (X509Certificate) chain[i];
204202
// now lets verify the certificate

‎sign/src/main/java/com/itextpdf/signatures/OCSPVerifier.java

Lines changed: 12 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -44,20 +44,6 @@ This file is part of the iText (R) project.
4444
*/
4545
package com.itextpdf.signatures;
4646

47-
import java.io.IOException;
48-
import java.security.GeneralSecurityException;
49-
import java.security.KeyStoreException;
50-
import java.security.cert.CRL;
51-
import java.security.cert.Certificate;
52-
import java.security.cert.CertificateParsingException;
53-
import java.security.cert.X509CRL;
54-
import java.security.cert.X509Certificate;
55-
import java.text.MessageFormat;
56-
import java.util.ArrayList;
57-
import java.util.Date;
58-
import java.util.Enumeration;
59-
import java.util.List;
60-
6147
import org.bouncycastle.asn1.ocsp.OCSPObjectIdentifiers;
6248
import org.bouncycastle.cert.X509CertificateHolder;
6349
import org.bouncycastle.cert.jcajce.JcaX509CertificateConverter;
@@ -72,6 +58,16 @@ This file is part of the iText (R) project.
7258
import org.slf4j.Logger;
7359
import org.slf4j.LoggerFactory;
7460

61+
import java.io.IOException;
62+
import java.security.GeneralSecurityException;
63+
import java.security.KeyStoreException;
64+
import java.security.cert.*;
65+
import java.text.MessageFormat;
66+
import java.util.ArrayList;
67+
import java.util.Date;
68+
import java.util.Enumeration;
69+
import java.util.List;
70+
7571
/**
7672
* Class that allows you to verify a certificate against
7773
* one or more OCSP responses.
@@ -255,7 +251,7 @@ public void isValidResponse(BasicOCSPResp ocspResp, X509Certificate issuerCert)
255251
}
256252
}
257253
} catch (KeyStoreException e) {
258-
responderCert = null;
254+
responderCert = (X509Certificate) null;
259255
}
260256
}
261257

@@ -278,7 +274,7 @@ public void isValidResponse(BasicOCSPResp ocspResp, X509Certificate issuerCert)
278274
try {
279275
crl = CertificateUtil.getCRL(responderCert);
280276
} catch (Exception ignored) {
281-
crl = null;
277+
crl = (CRL) null;
282278
}
283279
if (crl != null && crl instanceof X509CRL) {
284280
CRLVerifier crlVerifier = new CRLVerifier(null, null);

‎sign/src/main/java/com/itextpdf/signatures/PdfPKCS7.java

Lines changed: 11 additions & 48 deletions
Original file line numberDiff line numberDiff line change
@@ -46,53 +46,7 @@ This file is part of the iText (R) project.
4646

4747
import com.itextpdf.kernel.PdfException;
4848
import com.itextpdf.kernel.pdf.PdfName;
49-
50-
import java.io.ByteArrayInputStream;
51-
import java.io.ByteArrayOutputStream;
52-
import java.io.IOException;
53-
import java.math.BigInteger;
54-
import java.security.GeneralSecurityException;
55-
import java.security.InvalidKeyException;
56-
import java.security.MessageDigest;
57-
import java.security.NoSuchAlgorithmException;
58-
import java.security.NoSuchProviderException;
59-
import java.security.PrivateKey;
60-
import java.security.PublicKey;
61-
import java.security.Signature;
62-
import java.security.SignatureException;
63-
import java.security.cert.CRL;
64-
import java.security.cert.Certificate;
65-
import java.security.cert.CertificateFactory;
66-
import java.security.cert.X509CRL;
67-
import java.security.cert.X509Certificate;
68-
import java.util.ArrayList;
69-
import java.util.Arrays;
70-
import java.util.Calendar;
71-
import java.util.Collection;
72-
import java.util.Date;
73-
import java.util.Enumeration;
74-
import java.util.GregorianCalendar;
75-
import java.util.HashSet;
76-
import java.util.List;
77-
import java.util.Set;
78-
79-
import org.bouncycastle.asn1.ASN1EncodableVector;
80-
import org.bouncycastle.asn1.ASN1Encoding;
81-
import org.bouncycastle.asn1.ASN1Enumerated;
82-
import org.bouncycastle.asn1.ASN1InputStream;
83-
import org.bouncycastle.asn1.ASN1Integer;
84-
import org.bouncycastle.asn1.ASN1ObjectIdentifier;
85-
import org.bouncycastle.asn1.ASN1OctetString;
86-
import org.bouncycastle.asn1.ASN1OutputStream;
87-
import org.bouncycastle.asn1.ASN1Primitive;
88-
import org.bouncycastle.asn1.ASN1Sequence;
89-
import org.bouncycastle.asn1.ASN1Set;
90-
import org.bouncycastle.asn1.ASN1TaggedObject;
91-
import org.bouncycastle.asn1.DERNull;
92-
import org.bouncycastle.asn1.DEROctetString;
93-
import org.bouncycastle.asn1.DERSequence;
94-
import org.bouncycastle.asn1.DERSet;
95-
import org.bouncycastle.asn1.DERTaggedObject;
49+
import org.bouncycastle.asn1.*;
9650
import org.bouncycastle.asn1.cms.Attribute;
9751
import org.bouncycastle.asn1.cms.AttributeTable;
9852
import org.bouncycastle.asn1.cms.ContentInfo;
@@ -116,6 +70,15 @@ This file is part of the iText (R) project.
11670
import org.bouncycastle.tsp.TimeStampToken;
11771
import org.bouncycastle.tsp.TimeStampTokenInfo;
11872

73+
import java.io.ByteArrayInputStream;
74+
import java.io.ByteArrayOutputStream;
75+
import java.io.IOException;
76+
import java.math.BigInteger;
77+
import java.security.*;
78+
import java.security.cert.*;
79+
import java.security.cert.Certificate;
80+
import java.util.*;
81+
11982
/**
12083
* This class does all the processing related to signing
12184
* and verifying a PKCS#7 signature.
@@ -1276,7 +1239,7 @@ public boolean isRevocationValid() {
12761239
* @throws IOException
12771240
*/
12781241
private void findOcsp(ASN1Sequence seq) throws IOException {
1279-
basicResp = null;
1242+
basicResp = (BasicOCSPResp) null;
12801243
boolean ret = false;
12811244
while (true) {
12821245
if (seq.getObjectAt(0) instanceof ASN1ObjectIdentifier

0 commit comments

Comments
 (0)