1 /*
2 * Copyright (c) 1996, 2016, Oracle and/or its affiliates. All rights reserved.
3 * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
4 *
5 * This code is free software; you can redistribute it and/or modify it
6 * under the terms of the GNU General Public License version 2 only, as
7 * published by the Free Software Foundation. Oracle designates this
8 * particular file as subject to the "Classpath" exception as provided
9 * by Oracle in the LICENSE file that accompanied this code.
10 *
11 * This code is distributed in the hope that it will be useful, but WITHOUT
12 * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
13 * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
14 * version 2 for more details (a copy is included in the LICENSE file that
15 * accompanied this code).
16 *
17 * You should have received a copy of the GNU General Public License version
18 * 2 along with this work; if not, write to the Free Software Foundation,
19 * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
20 *
21 * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
22 * or visit www.oracle.com if you need additional information or have any
23 * questions.
24 */
25
26 package sun.security.util;
27
28 import java.io.*;
29 import java.math.BigInteger;
30 import java.util.Arrays;
31
32 /**
33 * Represent an ISO Object Identifier.
34 *
35 * <P>Object Identifiers are arbitrary length hierarchical identifiers.
36 * The individual components are numbers, and they define paths from the
37 * root of an ISO-managed identifier space. You will sometimes see a
38 * string name used instead of (or in addition to) the numerical id.
39 * These are synonyms for the numerical IDs, but are not widely used
40 * since most sites do not know all the requisite strings, while all
41 * sites can parse the numeric forms.
42 *
43 * <P>So for example, JavaSoft has the sole authority to assign the
44 * meaning to identifiers below the 1.3.6.1.4.1.42.2.17 node in the
45 * hierarchy, and other organizations can easily acquire the ability
46 * to assign such unique identifiers.
47 *
48 * @author David Brownell
49 * @author Amit Kapoor
50 * @author Hemma Prafullchandra
51 */
52
53 public final
54 class ObjectIdentifier implements Serializable
55 {
56 /**
57 * We use the DER value (no tag, no length) as the internal format
58 * @serial
59 */
60 private byte[] encoding = null;
61
62 private transient volatile String stringForm;
63
64 /*
65 * IMPORTANT NOTES FOR CODE CHANGES (bug 4811968) IN JDK 1.7.0
66 * ===========================================================
67 *
68 * (Almost) serialization compatibility with old versions:
69 *
70 * serialVersionUID is unchanged. Old field "component" is changed to
71 * type Object so that "poison" (unknown object type for old versions)
72 * can be put inside if there are huge components that cannot be saved
73 * as integers.
74 *
75 * New version use the new filed "encoding" only.
76 *
77 * Below are all 4 cases in a serialization/deserialization process:
78 *
79 * 1. old -> old: Not covered here
80 * 2. old -> new: There's no "encoding" field, new readObject() reads
81 * "components" and "componentLen" instead and inits correctly.
82 * 3. new -> new: "encoding" field exists, new readObject() uses it
83 * (ignoring the other 2 fields) and inits correctly.
84 * 4. new -> old: old readObject() only recognizes "components" and
85 * "componentLen" fields. If no huge components are involved, they
86 * are serialized as legal values and old object can init correctly.
87 * Otherwise, old object cannot recognize the form (component not int[])
88 * and throw a ClassNotFoundException at deserialization time.
89 *
90 * Therfore, for the first 3 cases, exact compatibility is preserved. In
91 * the 4th case, non-huge OID is still supportable in old versions, while
92 * huge OID is not.
93 */
94 private static final long serialVersionUID = 8697030238860181294L;
95
96 /**
97 * Changed to Object
98 * @serial
99 */
100 private Object components = null; // path from root
101 /**
102 * @serial
103 */
104 private int componentLen = -1; // how much is used.
105
106 // Is the components field calculated?
107 private transient boolean componentsCalculated = false;
108
109 private void readObject(ObjectInputStream is)
110 throws IOException, ClassNotFoundException {
111 is.defaultReadObject();
112
113 if (encoding == null) { // from an old version
114 init((int[])components, componentLen);
115 }
116 }
117
118 private void writeObject(ObjectOutputStream os)
119 throws IOException {
120 if (!componentsCalculated) {
121 int[] comps = toIntArray();
122 if (comps != null) { // every one understands this
123 components = comps;
124 componentLen = comps.length;
125 } else {
126 components = HugeOidNotSupportedByOldJDK.theOne;
127 }
128 componentsCalculated = true;
129 }
130 os.defaultWriteObject();
131 }
132
133 static class HugeOidNotSupportedByOldJDK implements Serializable {
134 private static final long serialVersionUID = 1L;
135 static HugeOidNotSupportedByOldJDK theOne = new HugeOidNotSupportedByOldJDK();
136 }
137
138 /**
139 * Constructs, from a string. This string should be of the form 1.23.56.
140 * Validity check included.
141 */
142 public ObjectIdentifier (String oid) throws IOException
143 {
144 int ch = '.';
145 int start = 0;
146 int end = 0;
147
148 int pos = 0;
149 byte[] tmp = new byte[oid.length()];
150 int first = 0, second;
151 int count = 0;
152
153 try {
154 String comp = null;
155 do {
156 int length = 0; // length of one section
157 end = oid.indexOf(ch,start);
158 if (end == -1) {
159 comp = oid.substring(start);
160 length = oid.length() - start;
161 } else {
162 comp = oid.substring(start,end);
163 length = end - start;
164 }
165
166 if (length > 9) {
167 BigInteger bignum = new BigInteger(comp);
168 if (count == 0) {
169 checkFirstComponent(bignum);
170 first = bignum.intValue();
171 } else {
172 if (count == 1) {
173 checkSecondComponent(first, bignum);
174 bignum = bignum.add(BigInteger.valueOf(40*first));
175 } else {
176 checkOtherComponent(count, bignum);
177 }
178 pos += pack7Oid(bignum, tmp, pos);
179 }
180 } else {
181 int num = Integer.parseInt(comp);
182 if (count == 0) {
183 checkFirstComponent(num);
184 first = num;
185 } else {
186 if (count == 1) {
187 checkSecondComponent(first, num);
188 num += 40 * first;
189 } else {
190 checkOtherComponent(count, num);
191 }
192 pos += pack7Oid(num, tmp, pos);
193 }
194 }
195 start = end + 1;
196 count++;
197 } while (end != -1);
198
199 checkCount(count);
200 encoding = new byte[pos];
201 System.arraycopy(tmp, 0, encoding, 0, pos);
202 this.stringForm = oid;
203 } catch (IOException ioe) { // already detected by checkXXX
204 throw ioe;
205 } catch (Exception e) {
206 throw new IOException("ObjectIdentifier() -- Invalid format: "
207 + e.toString(), e);
208 }
209 }
210
211 /**
212 * Constructor, from an array of integers.
213 * Validity check included.
214 */
215 public ObjectIdentifier(int[] values) throws IOException
216 {
217 checkCount(values.length);
218 checkFirstComponent(values[0]);
219 checkSecondComponent(values[0], values[1]);
220 for (int i=2; i<values.length; i++)
221 checkOtherComponent(i, values[i]);
222 init(values, values.length);
223 }
224
225 /**
226 * Constructor, from an ASN.1 encoded input stream.
227 * Validity check NOT included.
228 * The encoding of the ID in the stream uses "DER", a BER/1 subset.
229 * In this case, that means a triple { typeId, length, data }.
230 *
231 * <P><STRONG>NOTE:</STRONG> When an exception is thrown, the
232 * input stream has not been returned to its "initial" state.
233 *
234 * @param in DER-encoded data holding an object ID
235 * @exception IOException indicates a decoding error
236 */
237 public ObjectIdentifier (DerInputStream in) throws IOException
238 {
239 byte type_id;
240 int bufferEnd;
241
242 /*
243 * Object IDs are a "universal" type, and their tag needs only
244 * one byte of encoding. Verify that the tag of this datum
245 * is that of an object ID.
246 *
247 * Then get and check the length of the ID's encoding. We set
248 * up so that we can use in.available() to check for the end of
249 * this value in the data stream.
250 */
251 type_id = (byte) in.getByte ();
252 if (type_id != DerValue.tag_ObjectId)
253 throw new IOException (
254 "ObjectIdentifier() -- data isn't an object ID"
255 + " (tag = " + type_id + ")"
256 );
257
258 encoding = new byte[in.getDefiniteLength()];
259 in.getBytes(encoding);
260 check(encoding);
261 }
262
263 /*
264 * Constructor, from the rest of a DER input buffer;
265 * the tag and length have been removed/verified
266 * Validity check NOT included.
267 */
268 ObjectIdentifier (DerInputBuffer buf) throws IOException
269 {
270 DerInputStream in = new DerInputStream(buf);
271 encoding = new byte[in.available()];
272 in.getBytes(encoding);
273 check(encoding);
274 }
275
276 private void init(int[] components, int length) {
277 int pos = 0;
278 byte[] tmp = new byte[length*5+1]; // +1 for empty input
279
280 if (components[1] < Integer.MAX_VALUE - components[0]*40)
281 pos += pack7Oid(components[0]*40+components[1], tmp, pos);
282 else {
283 BigInteger big = BigInteger.valueOf(components[1]);
284 big = big.add(BigInteger.valueOf(components[0]*40));
285 pos += pack7Oid(big, tmp, pos);
286 }
287
288 for (int i=2; i<length; i++) {
289 pos += pack7Oid(components[i], tmp, pos);
290 }
291 encoding = new byte[pos];
292 System.arraycopy(tmp, 0, encoding, 0, pos);
293 }
294
295 /**
296 * This method is kept for compatibility reasons. The new implementation
297 * does the check and conversion. All around the JDK, the method is called
298 * in static blocks to initialize pre-defined ObjectIdentifieies. No
299 * obvious performance hurt will be made after this change.
300 *
301 * Old doc: Create a new ObjectIdentifier for internal use. The values are
302 * neither checked nor cloned.
303 */
304 public static ObjectIdentifier newInternal(int[] values) {
305 try {
306 return new ObjectIdentifier(values);
307 } catch (IOException ex) {
308 throw new RuntimeException(ex);
309 // Should not happen, internal calls always uses legal values.
310 }
311 }
312
313 /*
314 * n.b. the only public interface is DerOutputStream.putOID()
315 */
316 void encode (DerOutputStream out) throws IOException
317 {
318 out.write (DerValue.tag_ObjectId, encoding);
319 }
320
321 /**
322 * Compares this identifier with another, for equality.
323 *
324 * @return true iff the names are identical.
325 */
326 @Override
327 public boolean equals(Object obj) {
328 if (this == obj) {
329 return true;
330 }
331 if (obj instanceof ObjectIdentifier == false) {
332 return false;
333 }
334 ObjectIdentifier other = (ObjectIdentifier)obj;
335 return Arrays.equals(encoding, other.encoding);
336 }
337
338 @Override
339 public int hashCode() {
340 return Arrays.hashCode(encoding);
341 }
342
343 /**
344 * Private helper method for serialization. To be compatible with old
345 * versions of JDK.
346 * @return components in an int array, if all the components are less than
347 * Integer.MAX_VALUE. Otherwise, null.
348 */
349 private int[] toIntArray() {
350 int length = encoding.length;
351 int[] result = new int[20];
352 int which = 0;
353 int fromPos = 0;
354 for (int i = 0; i < length; i++) {
355 if ((encoding[i] & 0x80) == 0) {
356 // one section [fromPos..i]
357 if (i - fromPos + 1 > 4) {
358 BigInteger big = new BigInteger(pack(encoding, fromPos, i-fromPos+1, 7, 8));
359 if (fromPos == 0) {
360 result[which++] = 2;
361 BigInteger second = big.subtract(BigInteger.valueOf(80));
362 if (second.compareTo(BigInteger.valueOf(Integer.MAX_VALUE)) == 1) {
363 return null;
364 } else {
365 result[which++] = second.intValue();
366 }
367 } else {
368 if (big.compareTo(BigInteger.valueOf(Integer.MAX_VALUE)) == 1) {
369 return null;
370 } else {
371 result[which++] = big.intValue();
372 }
373 }
374 } else {
375 int retval = 0;
376 for (int j = fromPos; j <= i; j++) {
377 retval <<= 7;
378 byte tmp = encoding[j];
379 retval |= (tmp & 0x07f);
380 }
381 if (fromPos == 0) {
382 if (retval < 80) {
383 result[which++] = retval / 40;
384 result[which++] = retval % 40;
385 } else {
386 result[which++] = 2;
387 result[which++] = retval - 80;
388 }
389 } else {
390 result[which++] = retval;
391 }
392 }
393 fromPos = i+1;
394 }
395 if (which >= result.length) {
396 result = Arrays.copyOf(result, which + 10);
397 }
398 }
399 return Arrays.copyOf(result, which);
400 }
401
402 /**
403 * Returns a string form of the object ID. The format is the
404 * conventional "dot" notation for such IDs, without any
405 * user-friendly descriptive strings, since those strings
406 * will not be understood everywhere.
407 */
408 @Override
409 public String toString() {
410 String s = stringForm;
411 if (s == null) {
412 int length = encoding.length;
413 StringBuilder sb = new StringBuilder(length * 4);
414
415 int fromPos = 0;
416 for (int i = 0; i < length; i++) {
417 if ((encoding[i] & 0x80) == 0) {
418 // one section [fromPos..i]
419 if (fromPos != 0) { // not the first segment
420 sb.append('.');
421 }
422 if (i - fromPos + 1 > 4) { // maybe big integer
423 BigInteger big = new BigInteger(pack(encoding, fromPos, i-fromPos+1, 7, 8));
424 if (fromPos == 0) {
425 // first section encoded with more than 4 bytes,
426 // must be 2.something
427 sb.append("2.");
428 sb.append(big.subtract(BigInteger.valueOf(80)));
429 } else {
430 sb.append(big);
431 }
432 } else { // small integer
433 int retval = 0;
434 for (int j = fromPos; j <= i; j++) {
435 retval <<= 7;
436 byte tmp = encoding[j];
437 retval |= (tmp & 0x07f);
438 }
439 if (fromPos == 0) {
440 if (retval < 80) {
441 sb.append(retval/40);
442 sb.append('.');
443 sb.append(retval%40);
444 } else {
445 sb.append("2.");
446 sb.append(retval - 80);
447 }
448 } else {
449 sb.append(retval);
450 }
451 }
452 fromPos = i+1;
453 }
454 }
455 s = sb.toString();
456 stringForm = s;
457 }
458 return s;
459 }
460
461 /**
462 * Repack all bits from input to output. On the both sides, only a portion
463 * (from the least significant bit) of the 8 bits in a byte is used. This
464 * number is defined as the number of useful bits (NUB) for the array. All the
465 * used bits from the input byte array and repacked into the output in the
466 * exactly same order. The output bits are aligned so that the final bit of
467 * the input (the least significant bit in the last byte), when repacked as
468 * the final bit of the output, is still at the least significant position.
469 * Zeroes will be padded on the left side of the first output byte if
470 * necessary. All unused bits in the output are also zeroed.
471 *
472 * For example: if the input is 01001100 with NUB 8, the output which
473 * has a NUB 6 will look like:
474 * 00000001 00001100
475 * The first 2 bits of the output bytes are unused bits. The other bits
476 * turn out to be 000001 001100. While the 8 bits on the right are from
477 * the input, the left 4 zeroes are padded to fill the 6 bits space.
478 *
479 * @param in the input byte array
480 * @param ioffset start point inside <code>in</code>
481 * @param ilength number of bytes to repack
482 * @param iw NUB for input
483 * @param ow NUB for output
484 * @return the repacked bytes
485 */
486 private static byte[] pack(byte[] in, int ioffset, int ilength, int iw, int ow) {
487 assert (iw > 0 && iw <= 8): "input NUB must be between 1 and 8";
488 assert (ow > 0 && ow <= 8): "output NUB must be between 1 and 8";
489
490 if (iw == ow) {
491 return in.clone();
492 }
493
494 int bits = ilength * iw; // number of all used bits
495 byte[] out = new byte[(bits+ow-1)/ow];
496
497 // starting from the 0th bit in the input
498 int ipos = 0;
499
500 // the number of padding 0's needed in the output, skip them
501 int opos = (bits+ow-1)/ow*ow-bits;
502
503 while(ipos < bits) {
504 int count = iw - ipos%iw; // unpacked bits in current input byte
505 if (count > ow - opos%ow) { // free space available in output byte
506 count = ow - opos%ow; // choose the smaller number
507 }
508 // and move them!
509 out[opos/ow] |= // paste!
510 (((in[ioffset+ipos/iw]+256) // locate the byte (+256 so that it's never negative)
511 >> (iw-ipos%iw-count)) // move to the end of a byte
512 & ((1 << (count))-1)) // zero out all other bits
513 << (ow-opos%ow-count); // move to the output position
514 ipos += count; // advance
515 opos += count; // advance
516 }
517 return out;
518 }
519
520 /**
521 * Repack from NUB 8 to a NUB 7 OID sub-identifier, remove all
522 * unnecessary 0 headings, set the first bit of all non-tail
523 * output bytes to 1 (as ITU-T Rec. X.690 8.19.2 says), and
524 * paste it into an existing byte array.
525 * @param out the existing array to be pasted into
526 * @param ooffset the starting position to paste
527 * @return the number of bytes pasted
528 */
529 private static int pack7Oid(byte[] in, int ioffset, int ilength, byte[] out, int ooffset) {
530 byte[] pack = pack(in, ioffset, ilength, 8, 7);
531 int firstNonZero = pack.length-1; // paste at least one byte
532 for (int i=pack.length-2; i>=0; i--) {
533 if (pack[i] != 0) {
534 firstNonZero = i;
535 }
536 pack[i] |= 0x80;
537 }
538 System.arraycopy(pack, firstNonZero, out, ooffset, pack.length-firstNonZero);
539 return pack.length-firstNonZero;
540 }
541
542 /**
543 * Repack from NUB 7 to NUB 8, remove all unnecessary 0
544 * headings, and paste it into an existing byte array.
545 * @param out the existing array to be pasted into
546 * @param ooffset the starting position to paste
547 * @return the number of bytes pasted
548 */
549 private static int pack8(byte[] in, int ioffset, int ilength, byte[] out, int ooffset) {
550 byte[] pack = pack(in, ioffset, ilength, 7, 8);
551 int firstNonZero = pack.length-1; // paste at least one byte
552 for (int i=pack.length-2; i>=0; i--) {
553 if (pack[i] != 0) {
554 firstNonZero = i;
555 }
556 }
557 System.arraycopy(pack, firstNonZero, out, ooffset, pack.length-firstNonZero);
558 return pack.length-firstNonZero;
559 }
560
561 /**
562 * Pack the int into a OID sub-identifier DER encoding
563 */
564 private static int pack7Oid(int input, byte[] out, int ooffset) {
565 byte[] b = new byte[4];
566 b[0] = (byte)(input >> 24);
567 b[1] = (byte)(input >> 16);
568 b[2] = (byte)(input >> 8);
569 b[3] = (byte)(input);
570 return pack7Oid(b, 0, 4, out, ooffset);
571 }
572
573 /**
574 * Pack the BigInteger into a OID subidentifier DER encoding
575 */
576 private static int pack7Oid(BigInteger input, byte[] out, int ooffset) {
577 byte[] b = input.toByteArray();
578 return pack7Oid(b, 0, b.length, out, ooffset);
579 }
580
581 /**
582 * Private methods to check validity of OID. They must be --
583 * 1. at least 2 components
584 * 2. all components must be non-negative
585 * 3. the first must be 0, 1 or 2
586 * 4. if the first is 0 or 1, the second must be <40
587 */
588
589 /**
590 * Check the DER encoding. Since DER encoding defines that the integer bits
591 * are unsigned, so there's no need to check the MSB.
592 */
593 private static void check(byte[] encoding) throws IOException {
594 int length = encoding.length;
595 if (length < 1 || // too short
596 (encoding[length - 1] & 0x80) != 0) { // not ended
597 throw new IOException("ObjectIdentifier() -- " +
598 "Invalid DER encoding, not ended");
599 }
600 for (int i=0; i<length; i++) {
601 // 0x80 at the beginning of a subidentifier
602 if (encoding[i] == (byte)0x80 &&
603 (i==0 || (encoding[i-1] & 0x80) == 0)) {
604 throw new IOException("ObjectIdentifier() -- " +
605 "Invalid DER encoding, useless extra octet detected");
606 }
607 }
608 }
609 private static void checkCount(int count) throws IOException {
610 if (count < 2) {
611 throw new IOException("ObjectIdentifier() -- " +
612 "Must be at least two oid components ");
613 }
614 }
615 private static void checkFirstComponent(int first) throws IOException {
616 if (first < 0 || first > 2) {
617 throw new IOException("ObjectIdentifier() -- " +
618 "First oid component is invalid ");
619 }
620 }
621 private static void checkFirstComponent(BigInteger first) throws IOException {
622 if (first.signum() == -1 ||
623 first.compareTo(BigInteger.TWO) == 1) {
624 throw new IOException("ObjectIdentifier() -- " +
625 "First oid component is invalid ");
626 }
627 }
628 private static void checkSecondComponent(int first, int second) throws IOException {
629 if (second < 0 || first != 2 && second > 39) {
630 throw new IOException("ObjectIdentifier() -- " +
631 "Second oid component is invalid ");
632 }
633 }
634 private static void checkSecondComponent(int first, BigInteger second) throws IOException {
635 if (second.signum() == -1 ||
636 first != 2 &&
637 second.compareTo(BigInteger.valueOf(39)) == 1) {
638 throw new IOException("ObjectIdentifier() -- " +
639 "Second oid component is invalid ");
640 }
641 }
642 private static void checkOtherComponent(int i, int num) throws IOException {
643 if (num < 0) {
644 throw new IOException("ObjectIdentifier() -- " +
645 "oid component #" + (i+1) + " must be non-negative ");
646 }
647 }
648 private static void checkOtherComponent(int i, BigInteger num) throws IOException {
649 if (num.signum() == -1) {
650 throw new IOException("ObjectIdentifier() -- " +
651 "oid component #" + (i+1) + " must be non-negative ");
652 }
653 }
654 }