升级BouncyCastle至1.71后，ASN1TaggedObject.getObject()弃用替换方案咨询

问题背景 #

升级BouncyCastle到1.71版本后，编译出现如下警告：

warning: [deprecation] getObject() in ASN1TaggedObject has been deprecated  ASN1OctetString url = (ASN1OctetString) location.getObject();

官方说明：

getObject() Deprecated. Tagged objects now include the tag class. This method will raise an exception if it is not BERTags.CONTEXT_SPECIFIC. Use getBaseUniversal(boolean, int) only after confirming the expected tag class.

以下是两段代码的修改方案：

第一段代码修改 #

原代码中location属于CONTEXT_SPECIFIC类型标签对象，对应值为ASN.1通用类型OCTET_STRING（标签编号4），直接用getBaseUniversal(false, BERTags.OCTET_STRING)替代getObject()即可。

修改后的代码：

protected static void getAuthorityInfoExtensionValue(byte[] extensionValue,
    CertSignatureInformation certInfo) throws IOException
{
    ASN1Sequence asn1Seq = (ASN1Sequence) JcaX509ExtensionUtils.parseExtensionValue(extensionValue);
    Enumeration<?> objects = asn1Seq.getObjects();
    while (objects.hasMoreElements())
    {
        // AccessDescription
        ASN1Sequence obj = (ASN1Sequence) objects.nextElement();
        ASN1Encodable oid = obj.getObjectAt(0);
        // accessLocation
        ASN1TaggedObject location = (ASN1TaggedObject) obj.getObjectAt(1);

        if (X509ObjectIdentifiers.id_ad_ocsp.equals(oid)
                && location.getTagNo() == GeneralName.uniformResourceIdentifier)
        {
            ASN1OctetString url = (ASN1OctetString) location.getBaseUniversal(false, BERTags.OCTET_STRING);
            certInfo.setOcspUrl(new String(url.getOctets()));  
        }
        else if (X509ObjectIdentifiers.id_ad_caIssuers.equals(oid))
        {
            ASN1OctetString uri = (ASN1OctetString) location.getBaseUniversal(false, BERTags.OCTET_STRING);
            certInfo.setIssuerUrl(new String(uri.getOctets()));
        }
    }
}

第二段代码修改 #

这段代码中多次调用getObject()，需根据每个标签对象对应的ASN.1通用类型，替换为getBaseUniversal()：

• 嵌套的序列类型用BERTags.SEQUENCE（标签编号16）
• 最终的URL字符串对应BERTags.OCTET_STRING

修改后的代码：

/**
 * Gets the first CRL URL from given extension value. Structure has to be
 * built as in 4.2.1.14 CRL Distribution Points of RFC 2459.
 *
 * @param extensionValue to get the extension value from
 * @return first CRL- URL or null
 * @throws IOException when there is a problem with the extensionValue
 */
protected static String getCrlUrlFromExtensionValue(byte[] extensionValue) throws IOException
{
    ASN1Sequence asn1Seq = (ASN1Sequence) JcaX509ExtensionUtils.parseExtensionValue(extensionValue);
    Enumeration<?> objects = asn1Seq.getObjects();

    while (objects.hasMoreElements())
    {
        Object obj = objects.nextElement();
        if (obj instanceof ASN1Sequence)
        {
            String url = extractCrlUrlFromSequence((ASN1Sequence) obj);
            if (url != null)
            {
                return url;
            }
        }
    }
    return null;
}

private static String extractCrlUrlFromSequence(ASN1Sequence sequence)
{
    ASN1TaggedObject taggedObject = (ASN1TaggedObject) sequence.getObjectAt(0);
    taggedObject = (ASN1TaggedObject) taggedObject.getBaseUniversal(false, BERTags.SEQUENCE);
    if (taggedObject.getObject() instanceof ASN1TaggedObject)
    {
        taggedObject = (ASN1TaggedObject) taggedObject.getBaseUniversal(false, BERTags.TAGGED);
    }
    else if (taggedObject.getObject() instanceof ASN1Sequence)
    {
        // multiple URLs (we take the first)
        ASN1Sequence seq = (ASN1Sequence) taggedObject.getBaseUniversal(false, BERTags.SEQUENCE);
        if (seq.getObjectAt(0) instanceof ASN1TaggedObject)
        {
            taggedObject = (ASN1TaggedObject) seq.getObjectAt(0);
        }
        else
        {
            return null;
        }
    }
    else
    {
        return null;
    }
    if (taggedObject.getObject() instanceof ASN1OctetString)
    {
        ASN1OctetString uri = (ASN1OctetString) taggedObject.getBaseUniversal(false, BERTags.OCTET_STRING);
        String url = new String(uri.getOctets());

        // return first http(s)-Url for crl
        if (url.startsWith("http"))
        {
            return url;
        }
    }
    // else happens with http://blogs.adobe.com/security/SampleSignedPDFDocument.pdf
    return null;
}

修改说明 #

• getBaseUniversal(boolean declaredExplicit, int tagNo)参数说明：
  • 第一个参数declaredExplicit：X.509扩展中标签多为隐式编码，传false；若为显式编码则传true
  • 第二个参数tagNo：对应ASN.1通用标签编号，可通过BERTags常量直接引用
• 可提前通过location.getTagClass() == BERTags.CONTEXT_SPECIFIC验证标签类，确保符合X.509规范后再调用getBaseUniversal()

内容的提问来源于stack exchange，提问作者user1391606