Initial revision

git-svn-id: svn+ssh://gcc.gnu.org/svn/gcc/trunk@102074 138bc75d-0d04-0410-961f-82ee72b054a4

16 files changed, 1864 insertions, 0 deletions

diff --git a/libjava/classpath/gnu/java/security/x509/ext/AuthorityKeyIdentifier.java b/libjava/classpath/gnu/java/security/x509/ext/AuthorityKeyIdentifier.java
new file mode 100644
index 00000000000..a94b76f093e
--- /dev/null
+++ b/libjava/classpath/gnu/java/security/x509/ext/AuthorityKeyIdentifier.java
@@ -0,0 +1,133 @@
+/* AuthorityKeyIdentifier.java -- Authority key identifier extension.
+   Copyright (C) 2004  Free Software Foundation, Inc.
+
+This file is part of GNU Classpath.
+
+GNU Classpath is free software; you can redistribute it and/or modify
+it under the terms of the GNU General Public License as published by
+the Free Software Foundation; either version 2, or (at your option)
+any later version.
+
+GNU Classpath is distributed in the hope that it will be useful, but
+WITHOUT ANY WARRANTY; without even the implied warranty of
+MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+General Public License for more details.
+
+You should have received a copy of the GNU General Public License
+along with GNU Classpath; see the file COPYING.  If not, write to the
+Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
+02110-1301 USA.
+
+Linking this library statically or dynamically with other modules is
+making a combined work based on this library.  Thus, the terms and
+conditions of the GNU General Public License cover the whole
+combination.
+
+As a special exception, the copyright holders of this library give you
+permission to link this library with independent modules to produce an
+executable, regardless of the license terms of these independent
+modules, and to copy and distribute the resulting executable under
+terms of your choice, provided that you also meet, for each linked
+independent module, the terms and conditions of the license of that
+module.  An independent module is a module which is not derived from
+or based on this library.  If you modify this library, you may extend
+this exception to your version of the library, but you are not
+obligated to do so.  If you do not wish to do so, delete this
+exception statement from your version. */
+
+
+package gnu.java.security.x509.ext;
+
+import gnu.java.security.OID;
+import gnu.java.security.der.DER;
+import gnu.java.security.der.DERReader;
+import gnu.java.security.der.DERValue;
+import gnu.java.security.x509.Util;
+
+import java.io.IOException;
+import java.math.BigInteger;
+
+public class AuthorityKeyIdentifier extends Extension.Value
+{
+
+  // Constants and fields.
+  // -------------------------------------------------------------------------
+
+  public static final OID ID = new OID("2.5.29.35");
+
+  private final byte[] keyIdentifier;
+  private final GeneralNames authorityCertIssuer;
+  private final BigInteger authorityCertSerialNumber;
+
+  // Contstructor.
+  // -------------------------------------------------------------------------
+
+  public AuthorityKeyIdentifier(final byte[] encoded) throws IOException
+  {
+    super(encoded);
+    DERReader der = new DERReader(encoded);
+
+    // AuthorityKeyIdentifier ::= SEQUENCE {
+    DERValue val = der.read();
+    if (!val.isConstructed())
+      throw new IOException("malformed AuthorityKeyIdentifier");
+    if (val.getLength() > 0)
+      val = der.read();
+
+    //   keyIdentifier  [0] KeyIdentifier OPTIONAL,
+    //   KeyIdentifier ::= OCTET STRING
+    if (val.getTagClass() == DER.APPLICATION && val.getTag() == 0)
+      {
+        keyIdentifier = (byte[]) val.getValue();
+        val = der.read();
+      }
+    else
+      keyIdentifier = null;
+
+    //   authorityCertIssuer  [1] GeneralNames OPTIONAL,
+    if (val.getTagClass() == DER.APPLICATION && val.getTag() == 1)
+      {
+        byte[] b = val.getEncoded();
+        b[0] = (byte) (DER.CONSTRUCTED|DER.SEQUENCE);
+        authorityCertIssuer = new GeneralNames(b);
+        der.skip(val.getLength());
+        val = der.read();
+      }
+    else
+      authorityCertIssuer = null;
+
+    //   authorityCertSerialNumber  [2] CertificateSerialNumber OPTIONAL }
+    if (val.getTagClass() == DER.APPLICATION && val.getTag() == 2)
+      {
+        authorityCertSerialNumber = new BigInteger((byte[]) val.getValue());
+      }
+    else
+      authorityCertSerialNumber = null;
+  }
+
+  // Instance methods.
+  // -------------------------------------------------------------------------
+
+  public byte[] getKeyIdentifier()
+  {
+    return keyIdentifier != null ? (byte[]) keyIdentifier.clone() : null;
+  }
+
+  public GeneralNames getAuthorityCertIssuer()
+  {
+    return authorityCertIssuer;
+  }
+
+  public BigInteger getAuthorityCertSerialNumber()
+  {
+    return authorityCertSerialNumber;
+  }
+
+  public String toString()
+  {
+    return AuthorityKeyIdentifier.class.getName() + " [ keyId=" +
+      (keyIdentifier != null ? Util.toHexString (keyIdentifier, ':') : "nil") +
+      " authorityCertIssuer=" + authorityCertIssuer +
+      " authorityCertSerialNumbe=" + authorityCertSerialNumber + " ]";
+  }
+}
diff --git a/libjava/classpath/gnu/java/security/x509/ext/BasicConstraints.java b/libjava/classpath/gnu/java/security/x509/ext/BasicConstraints.java
new file mode 100644
index 00000000000..00f7a6ed220
--- /dev/null
+++ b/libjava/classpath/gnu/java/security/x509/ext/BasicConstraints.java
@@ -0,0 +1,129 @@
+/* BasicConstraints.java -- the basic constraints extension.
+   Copyright (C) 2004  Free Software Foundation, Inc.
+
+This file is part of GNU Classpath.
+
+GNU Classpath is free software; you can redistribute it and/or modify
+it under the terms of the GNU General Public License as published by
+the Free Software Foundation; either version 2, or (at your option)
+any later version.
+
+GNU Classpath is distributed in the hope that it will be useful, but
+WITHOUT ANY WARRANTY; without even the implied warranty of
+MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+General Public License for more details.
+
+You should have received a copy of the GNU General Public License
+along with GNU Classpath; see the file COPYING.  If not, write to the
+Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
+02110-1301 USA.
+
+Linking this library statically or dynamically with other modules is
+making a combined work based on this library.  Thus, the terms and
+conditions of the GNU General Public License cover the whole
+combination.
+
+As a special exception, the copyright holders of this library give you
+permission to link this library with independent modules to produce an
+executable, regardless of the license terms of these independent
+modules, and to copy and distribute the resulting executable under
+terms of your choice, provided that you also meet, for each linked
+independent module, the terms and conditions of the license of that
+module.  An independent module is a module which is not derived from
+or based on this library.  If you modify this library, you may extend
+this exception to your version of the library, but you are not
+obligated to do so.  If you do not wish to do so, delete this
+exception statement from your version. */
+
+
+package gnu.java.security.x509.ext;
+
+import gnu.java.security.OID;
+import gnu.java.security.der.DER;
+import gnu.java.security.der.DERReader;
+import gnu.java.security.der.DERValue;
+
+import java.io.IOException;
+import java.math.BigInteger;
+import java.util.ArrayList;
+import java.util.List;
+
+public class BasicConstraints extends Extension.Value
+{
+
+  // Constants and fields.
+  // -------------------------------------------------------------------------
+
+  public static final OID ID = new OID("2.5.29.19");
+
+  private final boolean ca;
+  private final int pathLenConstraint;
+
+  // Constructor.
+  // -------------------------------------------------------------------------
+
+  public BasicConstraints(final byte[] encoded) throws IOException
+  {
+    super(encoded);
+    DERReader der = new DERReader(encoded);
+    DERValue bc = der.read();
+    if (!bc.isConstructed())
+      throw new IOException("malformed BasicConstraints");
+    DERValue val = bc;
+    if (bc.getLength() > 0)
+      val = der.read();
+    if (val.getTag() == DER.BOOLEAN)
+      {
+        ca = ((Boolean) val.getValue()).booleanValue();
+        if (val.getEncodedLength() < bc.getLength())
+          val = der.read();
+      }
+    else
+      ca = false;
+    if (val.getTag() == DER.INTEGER)
+      {
+        pathLenConstraint = ((BigInteger) val.getValue()).intValue();
+      }
+    else
+      pathLenConstraint = -1;
+  }
+
+  public BasicConstraints (final boolean ca, final int pathLenConstraint)
+  {
+    this.ca = ca;
+    this.pathLenConstraint = pathLenConstraint;
+  }
+
+  // Instance methods.
+  // -------------------------------------------------------------------------
+
+  public boolean isCA()
+  {
+    return ca;
+  }
+
+  public int getPathLengthConstraint()
+  {
+    return pathLenConstraint;
+  }
+
+  public byte[] getEncoded()
+  {
+    if (encoded == null)
+      {
+        List bc = new ArrayList (2);
+        bc.add (new DERValue (DER.BOOLEAN, new Boolean (ca)));
+        if (pathLenConstraint >= 0)
+          bc.add (new DERValue (DER.INTEGER,
+                                BigInteger.valueOf ((long) pathLenConstraint)));
+        encoded = new DERValue (DER.CONSTRUCTED|DER.SEQUENCE, bc).getEncoded();
+      }
+    return (byte[]) encoded.clone();
+  }
+
+  public String toString()
+  {
+    return BasicConstraints.class.getName() + " [ isCA=" + ca +
+      " pathLen=" + pathLenConstraint + " ]";
+  }
+}
diff --git a/libjava/classpath/gnu/java/security/x509/ext/CRLNumber.java b/libjava/classpath/gnu/java/security/x509/ext/CRLNumber.java
new file mode 100644
index 00000000000..36b1c7b5f1d
--- /dev/null
+++ b/libjava/classpath/gnu/java/security/x509/ext/CRLNumber.java
@@ -0,0 +1,97 @@
+/* CRLNumber.java -- CRL number extension.
+   Copyright (C) 2004  Free Software Foundation, Inc.
+
+This file is part of GNU Classpath.
+
+GNU Classpath is free software; you can redistribute it and/or modify
+it under the terms of the GNU General Public License as published by
+the Free Software Foundation; either version 2, or (at your option)
+any later version.
+
+GNU Classpath is distributed in the hope that it will be useful, but
+WITHOUT ANY WARRANTY; without even the implied warranty of
+MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+General Public License for more details.
+
+You should have received a copy of the GNU General Public License
+along with GNU Classpath; see the file COPYING.  If not, write to the
+Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
+02110-1301 USA.
+
+Linking this library statically or dynamically with other modules is
+making a combined work based on this library.  Thus, the terms and
+conditions of the GNU General Public License cover the whole
+combination.
+
+As a special exception, the copyright holders of this library give you
+permission to link this library with independent modules to produce an
+executable, regardless of the license terms of these independent
+modules, and to copy and distribute the resulting executable under
+terms of your choice, provided that you also meet, for each linked
+independent module, the terms and conditions of the license of that
+module.  An independent module is a module which is not derived from
+or based on this library.  If you modify this library, you may extend
+this exception to your version of the library, but you are not
+obligated to do so.  If you do not wish to do so, delete this
+exception statement from your version. */
+
+
+package gnu.java.security.x509.ext;
+
+import gnu.java.security.OID;
+import gnu.java.security.der.DER;
+import gnu.java.security.der.DERReader;
+import gnu.java.security.der.DERValue;
+
+import java.io.IOException;
+import java.math.BigInteger;
+
+public class CRLNumber extends Extension.Value
+{
+
+  // Constants and fields.
+  // -------------------------------------------------------------------------
+
+  public static final OID ID = new OID("2.5.29.20");
+
+  private final BigInteger number;
+
+  // Constructor.
+  // -------------------------------------------------------------------------
+
+  public CRLNumber(final byte[] encoded) throws IOException
+  {
+    super(encoded);
+    DERValue val = DERReader.read(encoded);
+    if (val.getTag() != DER.INTEGER)
+      throw new IOException("malformed CRLNumber");
+    number = (BigInteger) val.getValue();
+  }
+
+  public CRLNumber (final BigInteger number)
+  {
+    this.number = number;
+  }
+
+  // Instance method.
+  // -------------------------------------------------------------------------
+
+  public BigInteger getNumber()
+  {
+    return number;
+  }
+
+  public byte[] getEncoded()
+  {
+    if (encoded == null)
+      {
+        encoded = new DERValue (DER.INTEGER, number).getEncoded();
+      }
+    return (byte[]) encoded.clone();
+  }
+
+  public String toString()
+  {
+    return CRLNumber.class.getName() + " [ " + number + " ]";
+  }
+}
diff --git a/libjava/classpath/gnu/java/security/x509/ext/CertificatePolicies.java b/libjava/classpath/gnu/java/security/x509/ext/CertificatePolicies.java
new file mode 100644
index 00000000000..50bc6d367d7
--- /dev/null
+++ b/libjava/classpath/gnu/java/security/x509/ext/CertificatePolicies.java
@@ -0,0 +1,189 @@
+/* CertificatePolicies.java -- certificate policy extension.
+   Copyright (C) 2004  Free Software Foundation, Inc.
+
+This file is part of GNU Classpath.
+
+GNU Classpath is free software; you can redistribute it and/or modify
+it under the terms of the GNU General Public License as published by
+the Free Software Foundation; either version 2, or (at your option)
+any later version.
+
+GNU Classpath is distributed in the hope that it will be useful, but
+WITHOUT ANY WARRANTY; without even the implied warranty of
+MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+General Public License for more details.
+
+You should have received a copy of the GNU General Public License
+along with GNU Classpath; see the file COPYING.  If not, write to the
+Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
+02110-1301 USA.
+
+Linking this library statically or dynamically with other modules is
+making a combined work based on this library.  Thus, the terms and
+conditions of the GNU General Public License cover the whole
+combination.
+
+As a special exception, the copyright holders of this library give you
+permission to link this library with independent modules to produce an
+executable, regardless of the license terms of these independent
+modules, and to copy and distribute the resulting executable under
+terms of your choice, provided that you also meet, for each linked
+independent module, the terms and conditions of the license of that
+module.  An independent module is a module which is not derived from
+or based on this library.  If you modify this library, you may extend
+this exception to your version of the library, but you are not
+obligated to do so.  If you do not wish to do so, delete this
+exception statement from your version. */
+
+
+package gnu.java.security.x509.ext;
+
+import gnu.java.security.OID;
+import gnu.java.security.der.DER;
+import gnu.java.security.der.DERReader;
+import gnu.java.security.der.DERValue;
+
+import java.io.IOException;
+import java.security.cert.PolicyQualifierInfo;
+import java.util.ArrayList;
+import java.util.Collections;
+import java.util.HashMap;
+import java.util.Iterator;
+import java.util.LinkedList;
+import java.util.List;
+import java.util.Map;
+
+public class CertificatePolicies extends Extension.Value
+{
+
+  // Constants and fields.
+  // -------------------------------------------------------------------------
+
+  public static final OID ID = new OID("2.5.29.32");
+
+  private final List policies;
+  private final Map policyQualifierInfos;
+
+  // Constructor.
+  // -------------------------------------------------------------------------
+
+  public CertificatePolicies(final byte[] encoded) throws IOException
+  {
+    super(encoded);
+    DERReader der = new DERReader(encoded);
+    DERValue pol = der.read();
+    if (!pol.isConstructed())
+      throw new IOException("malformed CertificatePolicies");
+
+    int len = 0;
+    LinkedList policyList = new LinkedList();
+    HashMap qualifierMap = new HashMap();
+    while (len < pol.getLength())
+      {
+        DERValue policyInfo = der.read();
+        if (!policyInfo.isConstructed())
+          throw new IOException("malformed PolicyInformation");
+        DERValue val = der.read();
+        if (val.getTag() != DER.OBJECT_IDENTIFIER)
+          throw new IOException("malformed CertPolicyId");
+        OID policyId = (OID) val.getValue();
+        policyList.add(policyId);
+        if (val.getEncodedLength() < policyInfo.getLength())
+          {
+            DERValue qual = der.read();
+            int len2 = 0;
+            LinkedList quals = new LinkedList();
+            while (len2 < qual.getLength())
+              {
+                val = der.read();
+                quals.add(new PolicyQualifierInfo(val.getEncoded()));
+                der.skip(val.getLength());
+                len2 += val.getEncodedLength();
+              }
+            qualifierMap.put(policyId, quals);
+          }
+        len += policyInfo.getEncodedLength();
+      }
+
+    policies = Collections.unmodifiableList(policyList);
+    policyQualifierInfos = Collections.unmodifiableMap(qualifierMap);
+  }
+
+  public CertificatePolicies (final List policies,
+                              final Map policyQualifierInfos)
+  {
+    for (Iterator it = policies.iterator(); it.hasNext(); )
+      if (!(it.next() instanceof OID))
+        throw new IllegalArgumentException ("policies must be OIDs");
+    for (Iterator it = policyQualifierInfos.entrySet().iterator(); it.hasNext();)
+      {
+        Map.Entry e = (Map.Entry) it.next();
+        if (!(e.getKey() instanceof OID) || !policies.contains (e.getKey()))
+          throw new IllegalArgumentException
+            ("policyQualifierInfos keys must be OIDs");
+        if (!(e.getValue() instanceof List))
+          throw new IllegalArgumentException
+            ("policyQualifierInfos values must be Lists of PolicyQualifierInfos");
+        for (Iterator it2 = ((List) e.getValue()).iterator(); it.hasNext(); )
+          if (!(it2.next() instanceof PolicyQualifierInfo))
+            throw new IllegalArgumentException
+              ("policyQualifierInfos values must be Lists of PolicyQualifierInfos");
+      }
+    this.policies = Collections.unmodifiableList (new ArrayList (policies));
+    this.policyQualifierInfos = Collections.unmodifiableMap
+      (new HashMap (policyQualifierInfos));
+  }
+
+  // Instance methods.
+  // -------------------------------------------------------------------------
+
+  public List getPolicies()
+  {
+    return policies;
+  }
+
+  public List getPolicyQualifierInfos(OID oid)
+  {
+    return (List) policyQualifierInfos.get(oid);
+  }
+
+  public byte[] getEncoded()
+  {
+    if (encoded == null)
+      {
+        List pol = new ArrayList (policies.size());
+        for (Iterator it = policies.iterator(); it.hasNext(); )
+          {
+            OID policy = (OID) it.next();
+            List qualifiers = getPolicyQualifierInfos (policy);
+            List l = new ArrayList (qualifiers == null ? 1 : 2);
+            l.add (new DERValue (DER.OBJECT_IDENTIFIER, policy));
+            if (qualifiers != null)
+              {
+                List ll = new ArrayList (qualifiers.size());
+                for (Iterator it2 = qualifiers.iterator(); it.hasNext(); )
+                  {
+                    PolicyQualifierInfo info = (PolicyQualifierInfo) it2.next();
+                    try
+                      {
+                        ll.add (DERReader.read (info.getEncoded()));
+                      }
+                    catch (IOException ioe)
+                      {
+                      }
+                  }
+                l.add (new DERValue (DER.CONSTRUCTED|DER.SEQUENCE, ll));
+              }
+            pol.add (new DERValue (DER.CONSTRUCTED|DER.SEQUENCE, l));
+          }
+        encoded = new DERValue (DER.CONSTRUCTED|DER.SEQUENCE, pol).getEncoded();
+      }
+    return (byte[]) encoded.clone();
+  }
+
+  public String toString()
+  {
+    return CertificatePolicies.class.getName() + " [ policies=" + policies +
+      " policyQualifierInfos=" + policyQualifierInfos + " ]";
+  }
+}
diff --git a/libjava/classpath/gnu/java/security/x509/ext/ExtendedKeyUsage.java b/libjava/classpath/gnu/java/security/x509/ext/ExtendedKeyUsage.java
new file mode 100644
index 00000000000..37b08acf43e
--- /dev/null
+++ b/libjava/classpath/gnu/java/security/x509/ext/ExtendedKeyUsage.java
@@ -0,0 +1,95 @@
+/* ExtendedKeyUsage.java -- the extended key usage extension.
+   Copyright (C) 2004  Free Software Foundation, Inc.
+
+This file is part of GNU Classpath.
+
+GNU Classpath is free software; you can redistribute it and/or modify
+it under the terms of the GNU General Public License as published by
+the Free Software Foundation; either version 2, or (at your option)
+any later version.
+
+GNU Classpath is distributed in the hope that it will be useful, but
+WITHOUT ANY WARRANTY; without even the implied warranty of
+MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+General Public License for more details.
+
+You should have received a copy of the GNU General Public License
+along with GNU Classpath; see the file COPYING.  If not, write to the
+Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
+02110-1301 USA.
+
+Linking this library statically or dynamically with other modules is
+making a combined work based on this library.  Thus, the terms and
+conditions of the GNU General Public License cover the whole
+combination.
+
+As a special exception, the copyright holders of this library give you
+permission to link this library with independent modules to produce an
+executable, regardless of the license terms of these independent
+modules, and to copy and distribute the resulting executable under
+terms of your choice, provided that you also meet, for each linked
+independent module, the terms and conditions of the license of that
+module.  An independent module is a module which is not derived from
+or based on this library.  If you modify this library, you may extend
+this exception to your version of the library, but you are not
+obligated to do so.  If you do not wish to do so, delete this
+exception statement from your version. */
+
+
+package gnu.java.security.x509.ext;
+
+import gnu.java.security.OID;
+import gnu.java.security.der.DER;
+import gnu.java.security.der.DERReader;
+import gnu.java.security.der.DERValue;
+
+import java.io.IOException;
+import java.util.Collections;
+import java.util.LinkedList;
+import java.util.List;
+
+public class ExtendedKeyUsage extends Extension.Value
+{
+
+  // Constants and fields.
+  // -------------------------------------------------------------------------
+
+  public static final OID ID = new OID("2.5.29.37");
+
+  private final List purposeIds;
+
+  // Constructor.
+  // -------------------------------------------------------------------------
+
+  public ExtendedKeyUsage(final byte[] encoded) throws IOException
+  {
+    super(encoded);
+    DERReader der = new DERReader(encoded);
+    DERValue usageList = der.read();
+    if (!usageList.isConstructed())
+      throw new IOException("malformed ExtKeyUsageSyntax");
+    int len = 0;
+    purposeIds = new LinkedList();
+    while (len < usageList.getLength())
+      {
+        DERValue val = der.read();
+        if (val.getTag() != DER.OBJECT_IDENTIFIER)
+          throw new IOException("malformed KeyPurposeId");
+        purposeIds.add(val.getValue());
+        len += val.getEncodedLength();
+      }
+  }
+
+  // Instance method.
+  // -------------------------------------------------------------------------
+
+  public List getPurposeIds()
+  {
+    return Collections.unmodifiableList(purposeIds);
+  }
+
+  public String toString()
+  {
+    return ExtendedKeyUsage.class.getName() + " [ " + purposeIds + " ]";
+  }
+}
diff --git a/libjava/classpath/gnu/java/security/x509/ext/Extension.java b/libjava/classpath/gnu/java/security/x509/ext/Extension.java
new file mode 100644
index 00000000000..5ca9ac3a91d
--- /dev/null
+++ b/libjava/classpath/gnu/java/security/x509/ext/Extension.java
@@ -0,0 +1,289 @@
+/* Extension.java -- an X.509 certificate or CRL extension.
+   Copyright (C) 2004  Free Software Foundation, Inc.
+
+This file is part of GNU Classpath.
+
+GNU Classpath is free software; you can redistribute it and/or modify
+it under the terms of the GNU General Public License as published by
+the Free Software Foundation; either version 2, or (at your option)
+any later version.
+
+GNU Classpath is distributed in the hope that it will be useful, but
+WITHOUT ANY WARRANTY; without even the implied warranty of
+MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+General Public License for more details.
+
+You should have received a copy of the GNU General Public License
+along with GNU Classpath; see the file COPYING.  If not, write to the
+Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
+02110-1301 USA.
+
+Linking this library statically or dynamically with other modules is
+making a combined work based on this library.  Thus, the terms and
+conditions of the GNU General Public License cover the whole
+combination.
+
+As a special exception, the copyright holders of this library give you
+permission to link this library with independent modules to produce an
+executable, regardless of the license terms of these independent
+modules, and to copy and distribute the resulting executable under
+terms of your choice, provided that you also meet, for each linked
+independent module, the terms and conditions of the license of that
+module.  An independent module is a module which is not derived from
+or based on this library.  If you modify this library, you may extend
+this exception to your version of the library, but you are not
+obligated to do so.  If you do not wish to do so, delete this
+exception statement from your version. */
+
+
+package gnu.java.security.x509.ext;
+
+import gnu.java.security.OID;
+import gnu.java.security.der.DER;
+import gnu.java.security.der.DERReader;
+import gnu.java.security.der.DERValue;
+import gnu.java.security.x509.Util;
+
+import java.io.IOException;
+import java.util.ArrayList;
+import java.util.Arrays;
+import java.util.List;
+
+public class Extension
+{
+
+  // Fields.
+  // -------------------------------------------------------------------------
+
+  private static final boolean DEBUG = false;
+  private static void debug(String msg)
+  {
+    System.err.print(">> Extension: ");
+    System.err.println(msg);
+  }
+
+  /**
+   * This extension's object identifier.
+   */
+  protected final OID oid;
+
+  /**
+   * The criticality flag.
+   */
+  protected final boolean critical;
+
+  /**
+   * Whether or not this extension is locally supported.
+   */
+  protected boolean isSupported;
+
+  /**
+   * The extension value.
+   */
+  protected final Value value;
+
+  /**
+   * The DER encoded form.
+   */
+  protected byte[] encoded;
+
+  // Constructors.
+  // -------------------------------------------------------------------------
+
+  public Extension(byte[] encoded) throws IOException
+  {
+    this.encoded = (byte[]) encoded.clone();
+    DERReader der = new DERReader(encoded);
+
+    // Extension ::= SEQUENCE {
+    DERValue val = der.read();
+    if (DEBUG) debug("read val  tag == " + val.getTag() + " len == " + val.getLength());
+    if (!val.isConstructed())
+      throw new IOException("malformed Extension");
+
+    //   extnID    OBJECT IDENTIFIER,
+    val = der.read();
+    if (val.getTag() != DER.OBJECT_IDENTIFIER)
+      throw new IOException("expecting OBJECT IDENTIFIER");
+    oid = (OID) val.getValue();
+    if (DEBUG) debug("read oid == " + oid);
+
+    //   critical  BOOLEAN DEFAULT FALSE,
+    val = der.read();
+    if (val.getTag() == DER.BOOLEAN)
+      {
+        critical = ((Boolean) val.getValue()).booleanValue();
+        val = der.read();
+      }
+    else
+      critical = false;
+    if (DEBUG) debug("is critical == " + critical);
+
+    //   extnValue OCTET STRING }
+    if (val.getTag() != DER.OCTET_STRING)
+      throw new IOException("expecting OCTET STRING");
+    byte[] encval = (byte[]) val.getValue();
+    isSupported = true;
+    if (oid.equals(AuthorityKeyIdentifier.ID))
+      {
+        value = new AuthorityKeyIdentifier(encval);
+      }
+    else if (oid.equals(SubjectKeyIdentifier.ID))
+      {
+        value = new SubjectKeyIdentifier(encval);
+      }
+    else if (oid.equals(KeyUsage.ID))
+      {
+        value = new KeyUsage(encval);
+      }
+    else if (oid.equals(PrivateKeyUsagePeriod.ID))
+      {
+        value = new PrivateKeyUsagePeriod(encval);
+      }
+    else if (oid.equals(CertificatePolicies.ID))
+      {
+        value = new CertificatePolicies(encval);
+      }
+    else if (oid.equals (PolicyConstraint.ID))
+      {
+        value = new PolicyConstraint (encval);
+      }
+    else if (oid.equals(PolicyMappings.ID))
+      {
+        value = new PolicyMappings(encval);
+      }
+    else if (oid.equals(SubjectAlternativeNames.ID))
+      {
+        value = new SubjectAlternativeNames(encval);
+      }
+    else if (oid.equals(IssuerAlternativeNames.ID))
+      {
+        value = new IssuerAlternativeNames(encval);
+      }
+    else if (oid.equals(BasicConstraints.ID))
+      {
+        value = new BasicConstraints(encval);
+      }
+    else if (oid.equals(ExtendedKeyUsage.ID))
+      {
+        value = new ExtendedKeyUsage(encval);
+      }
+    else if (oid.equals(CRLNumber.ID))
+      {
+        value = new CRLNumber(encval);
+      }
+    else if (oid.equals(ReasonCode.ID))
+      {
+        value = new ReasonCode(encval);
+      }
+    else
+      {
+        value = new Value(encval);
+        isSupported = false;
+      }
+    if (DEBUG) debug("read value == " + value);
+  }
+
+  public Extension (final OID oid, final Value value, final boolean critical)
+  {
+    this.oid = oid;
+    this.value = value;
+    this.critical = critical;
+    isSupported = true;
+  }
+
+  // Instance methods.
+  // -------------------------------------------------------------------------
+
+  public OID getOid()
+  {
+    return oid;
+  }
+
+  public boolean isCritical()
+  {
+    return critical;
+  }
+
+  public boolean isSupported()
+  {
+    return isSupported;
+  }
+
+  public Value getValue()
+  {
+    return value;
+  }
+
+  public byte[] getEncoded()
+  {
+    if (encoded == null)
+      encode();
+    return (byte[]) encoded.clone();
+  }
+
+  public String toString()
+  {
+    return Extension.class.getName() + " [ id=" + oid + " critical=" +
+      critical + " value=" + value + " ]";
+  }
+
+  public DERValue getDerValue()
+  {
+    List ext = new ArrayList (3);
+    ext.add (new DERValue (DER.OBJECT_IDENTIFIER, oid));
+    ext.add (new DERValue (DER.BOOLEAN, new Boolean (critical)));
+    ext.add (new DERValue (DER.OCTET_STRING, value.getEncoded()));
+    return new DERValue (DER.CONSTRUCTED|DER.SEQUENCE, ext);
+  }
+
+  // Own methods.
+  // -------------------------------------------------------------------------
+
+  private void encode()
+  {
+    encoded = getDerValue().getEncoded();
+  }
+
+  // Inner class.
+  // -------------------------------------------------------------------------
+
+  public static class Value
+  {
+
+    // Fields.
+    // -----------------------------------------------------------------------
+
+    protected byte[] encoded;
+
+    // Constructor.
+    // -----------------------------------------------------------------------
+
+    public Value(byte[] encoded)
+    {
+      this.encoded = (byte[]) encoded.clone();
+    }
+
+    protected Value() { }
+
+    // Instance methods.
+    // -----------------------------------------------------------------------
+
+    public byte[] getEncoded()
+    {
+      return (byte[]) encoded;
+    }
+
+    public boolean equals(Object o)
+    {
+      if (!(o instanceof Value))
+        return false;
+      return Arrays.equals(encoded, ((Value) o).encoded);
+    }
+
+    public String toString()
+    {
+      return Util.toHexString(encoded, ':');
+    }
+  }
+}
diff --git a/libjava/classpath/gnu/java/security/x509/ext/GeneralNames.java b/libjava/classpath/gnu/java/security/x509/ext/GeneralNames.java
new file mode 100644
index 00000000000..e92aedaefd0
--- /dev/null
+++ b/libjava/classpath/gnu/java/security/x509/ext/GeneralNames.java
@@ -0,0 +1,155 @@
+/* GeneralNames.java -- the GeneralNames object
+   Copyright (C) 2004  Free Software Foundation, Inc.
+
+This file is part of GNU Classpath.
+
+GNU Classpath is free software; you can redistribute it and/or modify
+it under the terms of the GNU General Public License as published by
+the Free Software Foundation; either version 2, or (at your option)
+any later version.
+
+GNU Classpath is distributed in the hope that it will be useful, but
+WITHOUT ANY WARRANTY; without even the implied warranty of
+MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+General Public License for more details.
+
+You should have received a copy of the GNU General Public License
+along with GNU Classpath; see the file COPYING.  If not, write to the
+Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
+02110-1301 USA.
+
+Linking this library statically or dynamically with other modules is
+making a combined work based on this library.  Thus, the terms and
+conditions of the GNU General Public License cover the whole
+combination.
+
+As a special exception, the copyright holders of this library give you
+permission to link this library with independent modules to produce an
+executable, regardless of the license terms of these independent
+modules, and to copy and distribute the resulting executable under
+terms of your choice, provided that you also meet, for each linked
+independent module, the terms and conditions of the license of that
+module.  An independent module is a module which is not derived from
+or based on this library.  If you modify this library, you may extend
+this exception to your version of the library, but you are not
+obligated to do so.  If you do not wish to do so, delete this
+exception statement from your version. */
+
+
+package gnu.java.security.x509.ext;
+
+import gnu.java.security.OID;
+import gnu.java.security.der.DER;
+import gnu.java.security.der.DERReader;
+import gnu.java.security.der.DERValue;
+import gnu.java.security.x509.X500DistinguishedName;
+
+import java.io.IOException;
+import java.net.InetAddress;
+import java.util.ArrayList;
+import java.util.Collections;
+import java.util.Iterator;
+import java.util.LinkedList;
+import java.util.List;
+
+public class GeneralNames
+{
+
+  // Instance methods.
+  // -------------------------------------------------------------------------
+
+  public static final int OTHER_NAME     = 0;
+  public static final int RFC822_NAME    = 1;
+  public static final int DNS_NAME       = 2;
+  public static final int X400_ADDRESS   = 3;
+  public static final int DIRECTORY_NAME = 4;
+  public static final int EDI_PARTY_NAME = 5;
+  public static final int URI            = 6;
+  public static final int IP_ADDRESS     = 7;
+  public static final int REGISTERED_ID  = 8;
+
+  private List names;
+
+  // Constructor.
+  // -------------------------------------------------------------------------
+
+  public GeneralNames(final byte[] encoded) throws IOException
+  {
+    names = new LinkedList();
+    DERReader der = new DERReader(encoded);
+    DERValue nameList = der.read();
+    if (!nameList.isConstructed())
+      throw new IOException("malformed GeneralNames");
+    int len = 0;
+    while (len < nameList.getLength())
+      {
+        DERValue name = der.read();
+        List namePair = new ArrayList(2);
+        if (name.getTagClass() != DER.APPLICATION)
+          throw new IOException("malformed GeneralName");
+        namePair.add(new Integer(name.getTag()));
+        DERValue val = null;
+        switch (name.getTag())
+          {
+          case RFC822_NAME:
+          case DNS_NAME:
+          case X400_ADDRESS:
+          case URI:
+            namePair.add(new String((byte[]) name.getValue()));
+            break;
+
+          case OTHER_NAME:
+          case EDI_PARTY_NAME:
+            namePair.add(name.getValue());
+            break;
+
+          case DIRECTORY_NAME:
+            byte[] b = name.getEncoded();
+            b[0] = (byte) (DER.CONSTRUCTED|DER.SEQUENCE);
+            namePair.add(new X500DistinguishedName(b).toString());
+            break;
+
+          case IP_ADDRESS:
+            namePair.add(InetAddress.getByAddress((byte[]) name.getValue())
+                         .getHostAddress());
+            break;
+
+          case REGISTERED_ID:
+            byte[] bb = name.getEncoded();
+            bb[0] = (byte) DER.OBJECT_IDENTIFIER;
+            namePair.add(new OID(bb).toString());
+            break;
+
+          default:
+            throw new IOException("unknown tag " + name.getTag());
+          }
+        names.add(namePair);
+        len += name.getEncodedLength();
+      }
+  }
+
+  // Instance methods.
+  // -------------------------------------------------------------------------
+
+  public List getNames()
+  {
+    List l = new ArrayList(names.size());
+    for (Iterator it = names.iterator(); it.hasNext(); )
+      {
+        List ll = (List) it.next();
+        List pair = new ArrayList(2);
+        pair.add(ll.get(0));
+        if (ll.get(1) instanceof byte[])
+          pair.add(((byte[]) ll.get(1)).clone());
+        else
+          pair.add(ll.get(1));
+        l.add(Collections.unmodifiableList(pair));
+      }
+    return Collections.unmodifiableList(l);
+  }
+
+  public String toString()
+  {
+    return GeneralNames.class.getName() + " [ " + names + " ]";
+  }
+}
diff --git a/libjava/classpath/gnu/java/security/x509/ext/IssuerAlternativeNames.java b/libjava/classpath/gnu/java/security/x509/ext/IssuerAlternativeNames.java
new file mode 100644
index 00000000000..8b017dc62d8
--- /dev/null
+++ b/libjava/classpath/gnu/java/security/x509/ext/IssuerAlternativeNames.java
@@ -0,0 +1,77 @@
+/* IssuerAlternatuveNames.java -- issuer alternative names extension.
+   Copyright (C) 2004  Free Software Foundation, Inc.
+
+This file is part of GNU Classpath.
+
+GNU Classpath is free software; you can redistribute it and/or modify
+it under the terms of the GNU General Public License as published by
+the Free Software Foundation; either version 2, or (at your option)
+any later version.
+
+GNU Classpath is distributed in the hope that it will be useful, but
+WITHOUT ANY WARRANTY; without even the implied warranty of
+MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+General Public License for more details.
+
+You should have received a copy of the GNU General Public License
+along with GNU Classpath; see the file COPYING.  If not, write to the
+Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
+02110-1301 USA.
+
+Linking this library statically or dynamically with other modules is
+making a combined work based on this library.  Thus, the terms and
+conditions of the GNU General Public License cover the whole
+combination.
+
+As a special exception, the copyright holders of this library give you
+permission to link this library with independent modules to produce an
+executable, regardless of the license terms of these independent
+modules, and to copy and distribute the resulting executable under
+terms of your choice, provided that you also meet, for each linked
+independent module, the terms and conditions of the license of that
+module.  An independent module is a module which is not derived from
+or based on this library.  If you modify this library, you may extend
+this exception to your version of the library, but you are not
+obligated to do so.  If you do not wish to do so, delete this
+exception statement from your version. */
+
+
+package gnu.java.security.x509.ext;
+
+import gnu.java.security.OID;
+
+import java.io.IOException;
+import java.util.List;
+
+public class IssuerAlternativeNames extends Extension.Value
+{
+
+  // Constants and fields.
+  // -------------------------------------------------------------------------
+
+  public static final OID ID = new OID("2.5.29.18");
+
+  private final GeneralNames names;
+
+  // Constructor.
+  // -------------------------------------------------------------------------
+
+  public IssuerAlternativeNames(final byte[] encoded) throws IOException
+  {
+    super(encoded);
+    names = new GeneralNames(encoded);
+  }
+
+  // Instance method.
+  // -------------------------------------------------------------------------
+
+  public List getNames()
+  {
+    return names.getNames();
+  }
+
+  public String toString()
+  {
+    return IssuerAlternativeNames.class.getName() + " [ " + names + " ]";
+  }
+}
diff --git a/libjava/classpath/gnu/java/security/x509/ext/KeyUsage.java b/libjava/classpath/gnu/java/security/x509/ext/KeyUsage.java
new file mode 100644
index 00000000000..dcd98181e12
--- /dev/null
+++ b/libjava/classpath/gnu/java/security/x509/ext/KeyUsage.java
@@ -0,0 +1,92 @@
+/* KeyUsage.java -- the key usage extension.
+   Copyright (C) 2004  Free Software Foundation, Inc.
+
+This file is part of GNU Classpath.
+
+GNU Classpath is free software; you can redistribute it and/or modify
+it under the terms of the GNU General Public License as published by
+the Free Software Foundation; either version 2, or (at your option)
+any later version.
+
+GNU Classpath is distributed in the hope that it will be useful, but
+WITHOUT ANY WARRANTY; without even the implied warranty of
+MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+General Public License for more details.
+
+You should have received a copy of the GNU General Public License
+along with GNU Classpath; see the file COPYING.  If not, write to the
+Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
+02110-1301 USA.
+
+Linking this library statically or dynamically with other modules is
+making a combined work based on this library.  Thus, the terms and
+conditions of the GNU General Public License cover the whole
+combination.
+
+As a special exception, the copyright holders of this library give you
+permission to link this library with independent modules to produce an
+executable, regardless of the license terms of these independent
+modules, and to copy and distribute the resulting executable under
+terms of your choice, provided that you also meet, for each linked
+independent module, the terms and conditions of the license of that
+module.  An independent module is a module which is not derived from
+or based on this library.  If you modify this library, you may extend
+this exception to your version of the library, but you are not
+obligated to do so.  If you do not wish to do so, delete this
+exception statement from your version. */
+
+
+package gnu.java.security.x509.ext;
+
+import gnu.java.security.OID;
+import gnu.java.security.der.BitString;
+import gnu.java.security.der.DER;
+import gnu.java.security.der.DERReader;
+import gnu.java.security.der.DERValue;
+
+import java.io.IOException;
+
+public class KeyUsage extends Extension.Value
+{
+
+  // Constants and fields.
+  // -------------------------------------------------------------------------
+
+  public static final OID ID = new OID("2.5.29.15");
+  public static final int DIGITAL_SIGNATURE = 0;
+  public static final int NON_REPUDIATION   = 1;
+  public static final int KEY_ENCIPHERMENT  = 2;
+  public static final int DATA_ENCIPHERMENT = 3;
+  public static final int KEY_AGREEMENT     = 4;
+  public static final int KEY_CERT_SIGN     = 5;
+  public static final int CRL_SIGN          = 6;
+  public static final int ENCIPHER_ONLY     = 7;
+  public static final int DECIPHER_ONLY     = 8;
+
+  private final BitString keyUsage;
+
+  // Constructor.
+  // -------------------------------------------------------------------------
+
+  public KeyUsage(final byte[] encoded) throws IOException
+  {
+    super(encoded);
+    DERValue val = DERReader.read(encoded);
+    if (val.getTag() != DER.BIT_STRING)
+      throw new IOException("malformed KeyUsage");
+    keyUsage = (BitString) val.getValue();
+  }
+
+  // Instance methods.
+  // -------------------------------------------------------------------------
+
+  public BitString getKeyUsage()
+  {
+    return keyUsage;
+  }
+
+  public String toString()
+  {
+    return KeyUsage.class.getName() + " [ " + keyUsage + " ]";
+  }
+}
diff --git a/libjava/classpath/gnu/java/security/x509/ext/PolicyConstraint.java b/libjava/classpath/gnu/java/security/x509/ext/PolicyConstraint.java
new file mode 100644
index 00000000000..20cf552a0fe
--- /dev/null
+++ b/libjava/classpath/gnu/java/security/x509/ext/PolicyConstraint.java
@@ -0,0 +1,107 @@
+/* PolicyConstraint.java -- policyConstraint extension
+   Copyright (C) 2004  Free Software Foundation, Inc.
+
+This file is part of GNU Classpath.
+
+GNU Classpath is free software; you can redistribute it and/or modify
+it under the terms of the GNU General Public License as published by
+the Free Software Foundation; either version 2, or (at your option)
+any later version.
+
+GNU Classpath is distributed in the hope that it will be useful, but
+WITHOUT ANY WARRANTY; without even the implied warranty of
+MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+General Public License for more details.
+
+You should have received a copy of the GNU General Public License
+along with GNU Classpath; see the file COPYING.  If not, write to the
+Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
+02110-1301 USA.
+
+Linking this library statically or dynamically with other modules is
+making a combined work based on this library.  Thus, the terms and
+conditions of the GNU General Public License cover the whole
+combination.
+
+As a special exception, the copyright holders of this library give you
+permission to link this library with independent modules to produce an
+executable, regardless of the license terms of these independent
+modules, and to copy and distribute the resulting executable under
+terms of your choice, provided that you also meet, for each linked
+independent module, the terms and conditions of the license of that
+module.  An independent module is a module which is not derived from
+or based on this library.  If you modify this library, you may extend
+this exception to your version of the library, but you are not
+obligated to do so.  If you do not wish to do so, delete this
+exception statement from your version. */
+
+
+package gnu.java.security.x509.ext;
+
+import gnu.java.security.OID;
+import gnu.java.security.der.DERReader;
+import gnu.java.security.der.DERValue;
+
+import java.io.IOException;
+import java.math.BigInteger;
+
+public class PolicyConstraint extends Extension.Value
+{
+
+  // Constants and fields.
+  // -------------------------------------------------------------------------
+
+  public static final OID ID = new OID ("2.5.29.36");
+
+  private final int requireExplicitPolicy;
+  private final int inhibitPolicyMapping;
+
+  // Constructors.
+  // -------------------------------------------------------------------------
+
+  public PolicyConstraint (final byte[] encoded) throws IOException
+  {
+    super (encoded);
+    int rpc = -1, ipm = -1;
+    DERReader der = new DERReader(encoded);
+    DERValue pc = der.read();
+    if (!pc.isConstructed())
+      throw new IOException("malformed PolicyConstraints");
+    DERValue val;
+    int len = pc.getLength();
+    while (len > 0)
+      {
+        val = der.read();
+        if (val.getTag() == 0)
+          rpc = new BigInteger ((byte[]) val.getValue()).intValue();
+        else if (val.getTag() == 1)
+          ipm = new BigInteger ((byte[]) val.getValue()).intValue();
+        else
+          throw new IOException ("invalid policy constraint");
+        len -= val.getEncodedLength();
+      }
+
+    requireExplicitPolicy = rpc;
+    inhibitPolicyMapping = ipm;
+  }
+
+  // Instance methods.
+  // -------------------------------------------------------------------------
+
+  public int getRequireExplicitPolicy()
+  {
+    return requireExplicitPolicy;
+  }
+
+  public int getInhibitPolicyMapping()
+  {
+    return inhibitPolicyMapping;
+  }
+
+  public String toString()
+  {
+    return PolicyConstraint.class.getName() + " [ requireExplicitPolicy=" +
+      requireExplicitPolicy + " inhibitPolicyMapping=" + inhibitPolicyMapping
+      + " ]";
+  }
+}
diff --git a/libjava/classpath/gnu/java/security/x509/ext/PolicyMappings.java b/libjava/classpath/gnu/java/security/x509/ext/PolicyMappings.java
new file mode 100644
index 00000000000..0493ed89dd4
--- /dev/null
+++ b/libjava/classpath/gnu/java/security/x509/ext/PolicyMappings.java
@@ -0,0 +1,104 @@
+/* PolicyMappings.java -- policy mappings extension.
+   Copyright (C) 2004  Free Software Foundation, Inc.
+
+This file is part of GNU Classpath.
+
+GNU Classpath is free software; you can redistribute it and/or modify
+it under the terms of the GNU General Public License as published by
+the Free Software Foundation; either version 2, or (at your option)
+any later version.
+
+GNU Classpath is distributed in the hope that it will be useful, but
+WITHOUT ANY WARRANTY; without even the implied warranty of
+MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+General Public License for more details.
+
+You should have received a copy of the GNU General Public License
+along with GNU Classpath; see the file COPYING.  If not, write to the
+Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
+02110-1301 USA.
+
+Linking this library statically or dynamically with other modules is
+making a combined work based on this library.  Thus, the terms and
+conditions of the GNU General Public License cover the whole
+combination.
+
+As a special exception, the copyright holders of this library give you
+permission to link this library with independent modules to produce an
+executable, regardless of the license terms of these independent
+modules, and to copy and distribute the resulting executable under
+terms of your choice, provided that you also meet, for each linked
+independent module, the terms and conditions of the license of that
+module.  An independent module is a module which is not derived from
+or based on this library.  If you modify this library, you may extend
+this exception to your version of the library, but you are not
+obligated to do so.  If you do not wish to do so, delete this
+exception statement from your version. */
+
+
+package gnu.java.security.x509.ext;
+
+import gnu.java.security.OID;
+import gnu.java.security.der.DER;
+import gnu.java.security.der.DERReader;
+import gnu.java.security.der.DERValue;
+
+import java.io.IOException;
+import java.util.Collections;
+import java.util.HashMap;
+import java.util.Map;
+
+public class PolicyMappings extends Extension.Value
+{
+
+  // Constants and fields.
+  // -------------------------------------------------------------------------
+
+  public static final OID ID = new OID("2.5.29.33");
+
+  private final Map mappings;
+
+  // Constructor.
+  // -------------------------------------------------------------------------
+
+  public PolicyMappings(final byte[] encoded) throws IOException
+  {
+    super(encoded);
+    DERReader der = new DERReader(encoded);
+    DERValue maps = der.read();
+    if (!maps.isConstructed())
+      throw new IOException("malformed PolicyMappings");
+    int len = 0;
+    HashMap _mappings = new HashMap();
+    while (len < maps.getLength())
+      {
+        DERValue map = der.read();
+        if (!map.isConstructed())
+          throw new IOException("malformed PolicyMapping");
+        DERValue val = der.read();
+        if (val.getTag() != DER.OBJECT_IDENTIFIER)
+          throw new IOException("malformed PolicyMapping");
+        OID issuerPolicy = (OID) val.getValue();
+        val = der.read();
+        if (val.getTag() != DER.OBJECT_IDENTIFIER)
+          throw new IOException("malformed PolicyMapping");
+        OID subjectPolicy = (OID) val.getValue();
+        _mappings.put(issuerPolicy, subjectPolicy);
+        len += map.getEncodedLength();
+      }
+    mappings = Collections.unmodifiableMap(_mappings);
+  }
+
+  // Instance methods.
+  // -------------------------------------------------------------------------
+
+  public OID getSubjectDomainPolicy(OID issuerDomainPolicy)
+  {
+    return (OID) mappings.get(issuerDomainPolicy);
+  }
+
+  public String toString()
+  {
+    return PolicyMappings.class.getName() + " [ " + mappings + " ]";
+  }
+}
diff --git a/libjava/classpath/gnu/java/security/x509/ext/PrivateKeyUsagePeriod.java b/libjava/classpath/gnu/java/security/x509/ext/PrivateKeyUsagePeriod.java
new file mode 100644
index 00000000000..3b531c05517
--- /dev/null
+++ b/libjava/classpath/gnu/java/security/x509/ext/PrivateKeyUsagePeriod.java
@@ -0,0 +1,105 @@
+/* PrivateKeyUsagePeriod.java -- private key usage period extension.
+   Copyright (C) 2004  Free Software Foundation, Inc.
+
+This file is part of GNU Classpath.
+
+GNU Classpath is free software; you can redistribute it and/or modify
+it under the terms of the GNU General Public License as published by
+the Free Software Foundation; either version 2, or (at your option)
+any later version.
+
+GNU Classpath is distributed in the hope that it will be useful, but
+WITHOUT ANY WARRANTY; without even the implied warranty of
+MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+General Public License for more details.
+
+You should have received a copy of the GNU General Public License
+along with GNU Classpath; see the file COPYING.  If not, write to the
+Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
+02110-1301 USA.
+
+Linking this library statically or dynamically with other modules is
+making a combined work based on this library.  Thus, the terms and
+conditions of the GNU General Public License cover the whole
+combination.
+
+As a special exception, the copyright holders of this library give you
+permission to link this library with independent modules to produce an
+executable, regardless of the license terms of these independent
+modules, and to copy and distribute the resulting executable under
+terms of your choice, provided that you also meet, for each linked
+independent module, the terms and conditions of the license of that
+module.  An independent module is a module which is not derived from
+or based on this library.  If you modify this library, you may extend
+this exception to your version of the library, but you are not
+obligated to do so.  If you do not wish to do so, delete this
+exception statement from your version. */
+
+
+package gnu.java.security.x509.ext;
+
+import gnu.java.security.OID;
+import gnu.java.security.der.DER;
+import gnu.java.security.der.DERReader;
+import gnu.java.security.der.DERValue;
+
+import java.io.IOException;
+import java.util.Date;
+
+public class PrivateKeyUsagePeriod extends Extension.Value
+{
+
+  // Constants and fields.
+  // -------------------------------------------------------------------------
+
+  public static final OID ID = new OID("2.5.29.16");
+
+  private final Date notBefore;
+  private final Date notAfter;
+
+  // Constructor.
+  // -------------------------------------------------------------------------
+
+  public PrivateKeyUsagePeriod(final byte[] encoded) throws IOException
+  {
+    super(encoded);
+    DERReader der = new DERReader(encoded);
+    DERValue val = der.read();
+    if (!val.isConstructed())
+      throw new IOException("malformed PrivateKeyUsagePeriod");
+    if (val.getLength() > 0)
+      val = der.read();
+    if (val.getTagClass() == DER.APPLICATION || val.getTag() == 0)
+      {
+        notBefore = (Date) val.getValueAs (DER.GENERALIZED_TIME);
+        val = der.read();
+      }
+    else
+      notBefore = null;
+    if (val.getTagClass() == DER.APPLICATION || val.getTag() == 1)
+      {
+        notAfter = (Date) val.getValueAs (DER.GENERALIZED_TIME);
+      }
+    else
+      notAfter = null;
+  }
+
+  // Instance methods.
+  // -------------------------------------------------------------------------
+
+  public Date getNotBefore()
+  {
+    return notBefore != null ? (Date) notBefore.clone() : null;
+  }
+
+  public Date getNotAfter()
+  {
+    return notAfter != null ? (Date) notAfter.clone() : null;
+  }
+
+  public String toString()
+  {
+    return PrivateKeyUsagePeriod.class.getName() + " [ notBefore=" + notBefore
+      + " notAfter=" + notAfter + " ]";
+  }
+}
diff --git a/libjava/classpath/gnu/java/security/x509/ext/ReasonCode.java b/libjava/classpath/gnu/java/security/x509/ext/ReasonCode.java
new file mode 100644
index 00000000000..a6d59e43ae8
--- /dev/null
+++ b/libjava/classpath/gnu/java/security/x509/ext/ReasonCode.java
@@ -0,0 +1,85 @@
+/* ReasonCode.java -- a reason code for a certificate revocation.
+   Copyright (C) 2004  Free Software Foundation, Inc.
+
+This file is part of GNU Classpath.
+
+GNU Classpath is free software; you can redistribute it and/or modify
+it under the terms of the GNU General Public License as published by
+the Free Software Foundation; either version 2, or (at your option)
+any later version.
+
+GNU Classpath is distributed in the hope that it will be useful, but
+WITHOUT ANY WARRANTY; without even the implied warranty of
+MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+General Public License for more details.
+
+You should have received a copy of the GNU General Public License
+along with GNU Classpath; see the file COPYING.  If not, write to the
+Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
+02110-1301 USA.
+
+Linking this library statically or dynamically with other modules is
+making a combined work based on this library.  Thus, the terms and
+conditions of the GNU General Public License cover the whole
+combination.
+
+As a special exception, the copyright holders of this library give you
+permission to link this library with independent modules to produce an
+executable, regardless of the license terms of these independent
+modules, and to copy and distribute the resulting executable under
+terms of your choice, provided that you also meet, for each linked
+independent module, the terms and conditions of the license of that
+module.  An independent module is a module which is not derived from
+or based on this library.  If you modify this library, you may extend
+this exception to your version of the library, but you are not
+obligated to do so.  If you do not wish to do so, delete this
+exception statement from your version. */
+
+
+package gnu.java.security.x509.ext;
+
+import gnu.java.security.OID;
+import gnu.java.security.der.DER;
+import gnu.java.security.der.DERReader;
+import gnu.java.security.der.DERValue;
+
+import java.io.IOException;
+import java.math.BigInteger;
+
+public class ReasonCode extends Extension.Value
+{
+
+  // Constants and fields.
+  // -------------------------------------------------------------------------
+
+  public static final OID ID = new OID("2.5.29.21");
+
+  public final int reason;
+
+  // Constructor.
+  // -------------------------------------------------------------------------
+
+  public ReasonCode(final byte[] encoded) throws IOException
+  {
+    super(encoded);
+    DERValue val = DERReader.read(encoded);
+    if (val.getTag() != DER.ENUMERATED)
+      throw new IOException("malformed CRLReason");
+    reason = ((BigInteger) val.getValue()).intValue();
+    if (reason < 0 || reason == 7 || reason > 10)
+      throw new IOException("illegal reason: " + reason);
+  }
+
+  // Instance method.
+  // -------------------------------------------------------------------------
+
+  public int getReasonCode()
+  {
+    return reason;
+  }
+
+  public String toString()
+  {
+    return ReasonCode.class.getName() + " [ " + reason + " ]";
+  }
+}
diff --git a/libjava/classpath/gnu/java/security/x509/ext/SubjectAlternativeNames.java b/libjava/classpath/gnu/java/security/x509/ext/SubjectAlternativeNames.java
new file mode 100644
index 00000000000..f88e854965f
--- /dev/null
+++ b/libjava/classpath/gnu/java/security/x509/ext/SubjectAlternativeNames.java
@@ -0,0 +1,77 @@
+/* SubjectAlternatuveNames.java -- subject alternative names extension.
+   Copyright (C) 2004  Free Software Foundation, Inc.
+
+This file is part of GNU Classpath.
+
+GNU Classpath is free software; you can redistribute it and/or modify
+it under the terms of the GNU General Public License as published by
+the Free Software Foundation; either version 2, or (at your option)
+any later version.
+
+GNU Classpath is distributed in the hope that it will be useful, but
+WITHOUT ANY WARRANTY; without even the implied warranty of
+MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+General Public License for more details.
+
+You should have received a copy of the GNU General Public License
+along with GNU Classpath; see the file COPYING.  If not, write to the
+Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
+02110-1301 USA.
+
+Linking this library statically or dynamically with other modules is
+making a combined work based on this library.  Thus, the terms and
+conditions of the GNU General Public License cover the whole
+combination.
+
+As a special exception, the copyright holders of this library give you
+permission to link this library with independent modules to produce an
+executable, regardless of the license terms of these independent
+modules, and to copy and distribute the resulting executable under
+terms of your choice, provided that you also meet, for each linked
+independent module, the terms and conditions of the license of that
+module.  An independent module is a module which is not derived from
+or based on this library.  If you modify this library, you may extend
+this exception to your version of the library, but you are not
+obligated to do so.  If you do not wish to do so, delete this
+exception statement from your version. */
+
+
+package gnu.java.security.x509.ext;
+
+import gnu.java.security.OID;
+
+import java.io.IOException;
+import java.util.List;
+
+public class SubjectAlternativeNames extends Extension.Value
+{
+
+  // Constants and fields.
+  // -------------------------------------------------------------------------
+
+  public static final OID ID = new OID("2.5.29.17");
+
+  private final GeneralNames names;
+
+  // Constructor.
+  // -------------------------------------------------------------------------
+
+  public SubjectAlternativeNames(final byte[] encoded) throws IOException
+  {
+    super(encoded);
+    names = new GeneralNames(encoded);
+  }
+
+  // Instance method.
+  // -------------------------------------------------------------------------
+
+  public List getNames()
+  {
+    return names.getNames();
+  }
+
+  public String toString()
+  {
+    return SubjectAlternativeNames.class.getName() + " [ " + names + " ]";
+  }
+}
diff --git a/libjava/classpath/gnu/java/security/x509/ext/SubjectKeyIdentifier.java b/libjava/classpath/gnu/java/security/x509/ext/SubjectKeyIdentifier.java
new file mode 100644
index 00000000000..fc65abe211c
--- /dev/null
+++ b/libjava/classpath/gnu/java/security/x509/ext/SubjectKeyIdentifier.java
@@ -0,0 +1,84 @@
+/* SubjectKeyIdentifier.java -- subject key identifier extension.
+   Copyright (C) 2004  Free Software Foundation, Inc.
+
+This file is part of GNU Classpath.
+
+GNU Classpath is free software; you can redistribute it and/or modify
+it under the terms of the GNU General Public License as published by
+the Free Software Foundation; either version 2, or (at your option)
+any later version.
+
+GNU Classpath is distributed in the hope that it will be useful, but
+WITHOUT ANY WARRANTY; without even the implied warranty of
+MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+General Public License for more details.
+
+You should have received a copy of the GNU General Public License
+along with GNU Classpath; see the file COPYING.  If not, write to the
+Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
+02110-1301 USA.
+
+Linking this library statically or dynamically with other modules is
+making a combined work based on this library.  Thus, the terms and
+conditions of the GNU General Public License cover the whole
+combination.
+
+As a special exception, the copyright holders of this library give you
+permission to link this library with independent modules to produce an
+executable, regardless of the license terms of these independent
+modules, and to copy and distribute the resulting executable under
+terms of your choice, provided that you also meet, for each linked
+independent module, the terms and conditions of the license of that
+module.  An independent module is a module which is not derived from
+or based on this library.  If you modify this library, you may extend
+this exception to your version of the library, but you are not
+obligated to do so.  If you do not wish to do so, delete this
+exception statement from your version. */
+
+
+package gnu.java.security.x509.ext;
+
+import gnu.java.security.OID;
+import gnu.java.security.der.DER;
+import gnu.java.security.der.DERReader;
+import gnu.java.security.der.DERValue;
+import gnu.java.security.x509.Util;
+
+import java.io.IOException;
+
+public class SubjectKeyIdentifier extends Extension.Value
+{
+
+  // Constant.
+  // -------------------------------------------------------------------------
+
+  public static final OID ID = new OID("2.5.29.14");
+
+  private final byte[] keyIdentifier;
+
+  // Constructor.
+  // -------------------------------------------------------------------------
+
+  public SubjectKeyIdentifier(final byte[] encoded) throws IOException
+  {
+    super(encoded);
+    DERValue val = DERReader.read(encoded);
+    if (val.getTag() != DER.OCTET_STRING)
+      throw new IOException("malformed SubjectKeyIdentifier");
+    keyIdentifier = (byte[]) val.getValue();
+  }
+
+  // Instance methods.
+  // -------------------------------------------------------------------------
+
+  public byte[] getKeyIdentifier()
+  {
+    return (byte[]) keyIdentifier.clone();
+  }
+
+  public String toString()
+  {
+    return SubjectKeyIdentifier.class.getName() + " [ " +
+      Util.toHexString (keyIdentifier, ':') + " ]";
+  }
+}
diff --git a/libjava/classpath/gnu/java/security/x509/ext/package.html b/libjava/classpath/gnu/java/security/x509/ext/package.html
new file mode 100644
index 00000000000..cc44e55c97e
--- /dev/null
+++ b/libjava/classpath/gnu/java/security/x509/ext/package.html
@@ -0,0 +1,46 @@
+<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2 Final//EN">
+<!-- package.html - describes classes in gnu.java.security.x509.ext package.
+   Copyright (C) 2005 Free Software Foundation, Inc.
+
+This file is part of GNU Classpath.
+
+GNU Classpath is free software; you can redistribute it and/or modify
+it under the terms of the GNU General Public License as published by
+the Free Software Foundation; either version 2, or (at your option)
+any later version.
+
+GNU Classpath is distributed in the hope that it will be useful, but
+WITHOUT ANY WARRANTY; without even the implied warranty of
+MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+General Public License for more details.
+
+You should have received a copy of the GNU General Public License
+along with GNU Classpath; see the file COPYING.  If not, write to the
+Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
+02110-1301 USA.
+
+Linking this library statically or dynamically with other modules is
+making a combined work based on this library.  Thus, the terms and
+conditions of the GNU General Public License cover the whole
+combination.
+
+As a special exception, the copyright holders of this library give you
+permission to link this library with independent modules to produce an
+executable, regardless of the license terms of these independent
+modules, and to copy and distribute the resulting executable under
+terms of your choice, provided that you also meet, for each linked
+independent module, the terms and conditions of the license of that
+module.  An independent module is a module which is not derived from
+or based on this library.  If you modify this library, you may extend
+this exception to your version of the library, but you are not
+obligated to do so.  If you do not wish to do so, delete this
+exception statement from your version. -->
+
+<html>
+<head><title>GNU Classpath - gnu.java.security.x509.ext</title></head>
+
+<body>
+<p></p>
+
+</body>
+</html>