redcar 0.3.2dev → 0.3.3

data/lib/openssl/src/java/org/jruby/ext/openssl/X509Extensions.java

@@ -0,0 +1,751 @@
+/***** BEGIN LICENSE BLOCK *****
+ * Version: CPL 1.0/GPL 2.0/LGPL 2.1
+ *
+ * The contents of this file are subject to the Common Public
+ * License Version 1.0 (the "License"); you may not use this file
+ * except in compliance with the License. You may obtain a copy of
+ * the License at http://www.eclipse.org/legal/cpl-v10.html
+ *
+ * Software distributed under the License is distributed on an "AS
+ * IS" basis, WITHOUT WARRANTY OF ANY KIND, either express or
+ * implied. See the License for the specific language governing
+ * rights and limitations under the License.
+ *
+ * Copyright (C) 2006, 2007 Ola Bini <ola@ologix.com>
+ * 
+ * Alternatively, the contents of this file may be used under the terms of
+ * either of the GNU General Public License Version 2 or later (the "GPL"),
+ * or the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
+ * in which case the provisions of the GPL or the LGPL are applicable instead
+ * of those above. If you wish to allow use of your version of this file only
+ * under the terms of either the GPL or the LGPL, and not to allow others to
+ * use your version of this file under the terms of the CPL, indicate your
+ * decision by deleting the provisions above and replace them with the notice
+ * and other provisions required by the GPL or the LGPL. If you do not delete
+ * the provisions above, a recipient may use your version of this file under
+ * the terms of any one of the CPL, the GPL or the LGPL.
+ ***** END LICENSE BLOCK *****/
+package org.jruby.ext.openssl;
+
+
+import java.io.IOException;
+import java.security.MessageDigest;
+import java.util.Iterator;
+import java.util.List;
+import org.bouncycastle.asn1.ASN1Encodable;
+import org.bouncycastle.asn1.ASN1EncodableVector;
+import org.bouncycastle.asn1.ASN1InputStream;
+import org.bouncycastle.asn1.ASN1Sequence;
+import org.bouncycastle.asn1.DERBitString;
+import org.bouncycastle.asn1.DERBoolean;
+import org.bouncycastle.asn1.DEREncodable;
+import org.bouncycastle.asn1.DERIA5String;
+import org.bouncycastle.asn1.DERInteger;
+import org.bouncycastle.asn1.DERObject;
+import org.bouncycastle.asn1.DERObjectIdentifier;
+import org.bouncycastle.asn1.DEROctetString;
+import org.bouncycastle.asn1.DERSequence;
+import org.bouncycastle.asn1.DERString;
+import org.bouncycastle.asn1.DERUnknownTag;
+import org.bouncycastle.asn1.x509.GeneralName;
+import org.bouncycastle.asn1.x509.GeneralNames;
+import org.jruby.Ruby;
+import org.jruby.RubyArray;
+import org.jruby.RubyClass;
+import org.jruby.RubyModule;
+import org.jruby.RubyNumeric;
+import org.jruby.RubyObject;
+import org.jruby.RubyString;
+import org.jruby.anno.JRubyMethod;
+import org.jruby.exceptions.RaiseException;
+import org.jruby.ext.openssl.impl.ASN1Registry;
+import org.jruby.runtime.Block;
+import org.jruby.runtime.ObjectAllocator;
+import org.jruby.runtime.ThreadContext;
+import org.jruby.runtime.builtin.IRubyObject;
+import org.jruby.util.ByteList;
+
+/**
+ * @author <a href="mailto:ola.bini@ki.se">Ola Bini</a>
+ */
+public class X509Extensions {
+    public static void createX509Ext(Ruby runtime, RubyModule mX509) {
+        RubyClass cX509ExtFactory = mX509.defineClassUnder("ExtensionFactory",runtime.getObject(),ExtensionFactory.ALLOCATOR);
+        RubyClass openSSLError = runtime.getModule("OpenSSL").getClass("OpenSSLError");
+        mX509.defineClassUnder("ExtensionError",openSSLError,openSSLError.getAllocator());
+        
+        cX509ExtFactory.attr_reader(runtime.getCurrentContext(), new IRubyObject[]{runtime.newString("issuer_certificate"),runtime.newString("subject_certificate"),
+                                                                                   runtime.newString("subject_request"),runtime.newString("crl"),
+                                                                                   runtime.newString("config")});
+
+        cX509ExtFactory.defineAnnotatedMethods(ExtensionFactory.class);
+
+        RubyClass cX509Ext = mX509.defineClassUnder("Extension",runtime.getObject(),Extension.ALLOCATOR);
+        cX509Ext.defineAnnotatedMethods(Extension.class);
+    }
+
+    public static class ExtensionFactory extends RubyObject {
+        public static ObjectAllocator ALLOCATOR = new ObjectAllocator() {
+                public IRubyObject allocate(Ruby runtime, RubyClass klass) {
+                    return new ExtensionFactory(runtime, klass);
+                }
+            };
+
+        public ExtensionFactory(Ruby runtime, RubyClass type) {
+            super(runtime,type);
+        }
+
+        @JRubyMethod(rest=true,frame=true)
+        public IRubyObject initialize(IRubyObject[] args, Block unusedBlock) {
+            org.jruby.runtime.Arity.checkArgumentCount(getRuntime(),args,0,4);
+            if(args.length > 0 && !args[0].isNil()) {
+                set_issuer_cert(args[0]);
+            }
+            if(args.length > 1 && !args[1].isNil()) {
+                set_subject_cert(args[1]);
+            }
+            if(args.length > 2 && !args[2].isNil()) {
+                set_subject_req(args[2]);
+            }
+            if(args.length > 3 && !args[3].isNil()) {
+                set_crl(args[3]);
+            }
+            return this;
+        }
+
+        @JRubyMethod(name="issuer_certificate=")
+        public IRubyObject set_issuer_cert(IRubyObject arg) {
+            setInstanceVariable("@issuer_certificate",arg);
+            return arg;
+        }
+
+        @JRubyMethod(name="subject_certificate=")
+        public IRubyObject set_subject_cert(IRubyObject arg) {
+            setInstanceVariable("@subject_certificate",arg);
+            return arg;
+        }
+
+        @JRubyMethod(name="subject_request=")
+        public IRubyObject set_subject_req(IRubyObject arg) {
+            setInstanceVariable("@subject_request",arg);
+            return arg;
+        }
+
+        @JRubyMethod(name="crl=")
+        public IRubyObject set_crl(IRubyObject arg) {
+            setInstanceVariable("@crl",arg);
+            return arg;
+        }
+
+        @JRubyMethod(name="config=")
+        public IRubyObject set_config(IRubyObject arg) {
+            setInstanceVariable("@config",arg);
+            return arg;
+        }
+
+        private DERObjectIdentifier getObjectIdentifier(String nameOrOid) {
+            Object val1 = ASN1.getOIDLookup(getRuntime()).get(nameOrOid.toLowerCase());
+            if(null != val1) {
+                return (DERObjectIdentifier)val1;
+            }
+            DERObjectIdentifier val2 = new DERObjectIdentifier(nameOrOid);
+            return val2;
+        }
+
+        private static boolean isHexDigit(char c) {
+            return ('0'<=c && c<='9') || ('A'<= c && c <= 'F') || ('a'<= c && c <= 'f');
+        }
+        
+        private boolean isHexString(String str ){
+        	for(int i = 0; i< str.length(); i++) {
+        		if (!isHexDigit(str.charAt(i))) return false;
+        	}
+        	return true;
+        }
+
+        @JRubyMethod(rest=true)
+        public IRubyObject create_ext(IRubyObject[] args) throws Exception {
+            IRubyObject critical = getRuntime().getFalse();
+            if(org.jruby.runtime.Arity.checkArgumentCount(getRuntime(),args,2,3) == 3 && !args[2].isNil()) {
+                critical = args[2];
+            }
+            String oid = args[0].toString();
+            String valuex = args[1].toString();
+            Object value = valuex;
+
+            DERObjectIdentifier r_oid = null;
+
+            try {
+                r_oid = getObjectIdentifier(oid);
+            } catch(IllegalArgumentException e) {
+                r_oid = null;
+            }
+            if(null == r_oid) {
+                throw new RaiseException(getRuntime(), (RubyClass)(((RubyModule)(getRuntime().getModule("OpenSSL").getConstant("X509"))).getConstant("ExtensionError")), "unknown OID `" + oid + "'", true);
+            }
+
+            ThreadContext tc = getRuntime().getCurrentContext();
+            Extension ext = (Extension)(((RubyClass)(((RubyModule)(getRuntime().getModule("OpenSSL").getConstant("X509"))).getConstant("Extension"))).callMethod(tc,"new"));
+
+            if(valuex.startsWith("critical,")) {
+                critical = getRuntime().getTrue();
+                value = valuex.substring(9).trim();
+            }
+
+            if(r_oid.equals(new DERObjectIdentifier("2.5.29.14"))) { //subjectKeyIdentifier
+                if("hash".equalsIgnoreCase(valuex)) {
+                    IRubyObject pkey = getInstanceVariable("@subject_certificate").callMethod(tc,"public_key");
+                    IRubyObject val = null;
+                    if(pkey instanceof PKeyRSA) {
+                        val = pkey.callMethod(tc,"to_der");
+                    } else {
+                        val = ASN1.decode(getRuntime().getModule("OpenSSL").getConstant("ASN1"),pkey.callMethod(tc,"to_der")).callMethod(tc,"value").callMethod(tc,"[]",getRuntime().newFixnum(1)).callMethod(tc,"value");
+                    }
+                    byte[] b = MessageDigest.getInstance("SHA-1",OpenSSLReal.PROVIDER).digest(val.convertToString().getBytes());
+                    value = new String(ByteList.plain(new DEROctetString(b).getDEREncoded()));
+                } else if(valuex.length() == 20 || !isHexString(valuex)) {
+                    value = new String(ByteList.plain(new DEROctetString(ByteList.plain(valuex)).getDEREncoded()));
+                } else {
+                    StringBuffer nstr = new StringBuffer();
+                    for(int i = 0; i < valuex.length(); i+=2) {
+                        if(i+1 >= valuex.length()) {
+                            throw new RaiseException(getRuntime(), (RubyClass)(((RubyModule)(getRuntime().getModule("OpenSSL").getConstant("X509"))).getConstant("ExtensionError")), oid + " = " + value + ": odd number of digits", true);
+                        }
+
+                        char c1 = valuex.charAt(i);
+                        char c2 = valuex.charAt(i+1);
+                        if(isHexDigit(c1) && isHexDigit(c2)) {
+                            nstr.append(Character.toUpperCase(c1)).append(Character.toUpperCase(c2));
+                        } else {
+                            throw new RaiseException(getRuntime(), (RubyClass)(((RubyModule)(getRuntime().getModule("OpenSSL").getConstant("X509"))).getConstant("ExtensionError")), oid + " = " + value + ": illegal hex digit", true);
+                        }
+                        while((i+2) < valuex.length() && valuex.charAt(i+2) == ':') {
+                            i++;
+                        }
+                    }
+                    String v = nstr.toString();
+                    byte[] arr = new byte[v.length()/2];
+                    for(int i=0;i<v.length();i+=2) {
+                        arr[i/2] = (byte)Integer.parseInt(v.substring(i,i+2),16);
+                    }
+                    value = new String(ByteList.plain(new DEROctetString(arr).getDEREncoded()));
+                }
+            } else if(r_oid.equals(new DERObjectIdentifier("2.5.29.35"))) { //authorityKeyIdentifier
+                String ourV = valuex;
+                ASN1EncodableVector asnv = new ASN1EncodableVector();
+               
+                if(ourV.startsWith("keyid:always")) {
+                    ourV = ourV.substring("keyid:always".length());
+                    IRubyObject pkey = getInstanceVariable("@issuer_certificate").callMethod(tc,"public_key");
+                    IRubyObject val = null;
+                    if(pkey instanceof PKeyRSA) {
+                        val = pkey.callMethod(tc,"to_der");
+                    } else {
+                        val = ASN1.decode(getRuntime().getModule("OpenSSL").getConstant("ASN1"),pkey.callMethod(tc,"to_der")).callMethod(tc,"value").callMethod(tc,"[]",getRuntime().newFixnum(1)).callMethod(tc,"value");
+                    }
+                    byte[] b = MessageDigest.getInstance("SHA-1",OpenSSLReal.PROVIDER).digest(val.convertToString().getBytes());
+                    asnv.add(new DEROctetString(b));
+                } else if(ourV.startsWith("keyid")) {
+                    ourV = ourV.substring("keyid".length());
+                    IRubyObject pkey = getInstanceVariable("@issuer_certificate").callMethod(tc,"public_key");
+                    IRubyObject val = null;
+                    if(pkey instanceof PKeyRSA) {
+                        val = pkey.callMethod(tc,"to_der");
+                    } else {
+                        val = ASN1.decode(getRuntime().getModule("OpenSSL").getConstant("ASN1"),pkey.callMethod(tc,"to_der")).callMethod(tc,"value").callMethod(tc,"[]",getRuntime().newFixnum(1)).callMethod(tc,"value");
+                    }
+                    byte[] b = MessageDigest.getInstance("SHA-1",OpenSSLReal.PROVIDER).digest(val.convertToString().getBytes());
+                    asnv.add(new DEROctetString(b));
+                }
+                value = new String(ByteList.plain(new DERSequence(asnv).getDEREncoded()));
+            } else if(r_oid.equals(new DERObjectIdentifier("2.5.29.18"))) { //issuerAltName
+                if(valuex.startsWith("issuer:copy")) {
+                    List exts = ((RubyArray)getInstanceVariable("@issuer_certificate").callMethod(tc,"extensions")).getList();
+                    for(Iterator iter = exts.iterator();iter.hasNext();) {
+                        Extension exta = (Extension)iter.next();
+                        if(exta.getRealOid().equals(new DERObjectIdentifier("2.5.29.17"))) {
+                            value = exta.getRealValue();
+                            break;
+                        }
+                    }
+                }
+            } else if(r_oid.equals(new DERObjectIdentifier("2.5.29.19"))) { //basicConstraints
+                String[] spl = valuex.split(",");
+                for(int i=0;i<spl.length;i++) {
+                    spl[i] = spl[i].trim();
+                }
+                ASN1EncodableVector asnv = new ASN1EncodableVector();
+                for(int i=0;i<spl.length;i++) {
+                    if(spl[i].length() > 3 && spl[i].substring(0,3).equalsIgnoreCase("CA:")) {
+                        asnv.add(new DERBoolean("TRUE".equalsIgnoreCase(spl[i].substring(3).trim())));
+                    }
+                }
+                for(int i=0;i<spl.length;i++) {
+                    if(spl[i].length() > 8 && spl[i].substring(0,8).equalsIgnoreCase("pathlen:")) {
+                        asnv.add(new DERInteger(Integer.parseInt(spl[i].substring(8).trim())));
+                    }
+                }
+                value = new String(ByteList.plain(new DERSequence(asnv).getDEREncoded()));
+            } else if(r_oid.equals(new DERObjectIdentifier("2.5.29.15"))) { //keyUsage
+                byte[] inp = null;
+                inp = null;
+                try {
+                    String[] exx = valuex.split(":");
+                    if(exx != null) {
+                        inp = new byte[exx.length];
+                        for(int i=0;i<exx.length;i++) {
+                            inp[i] = (byte)Integer.parseInt(exx[i],16);
+                        }
+                    }
+                } catch(Exception e) {
+                    inp = null;
+                }
+
+                if(null == inp && valuex.length()<3) {
+                    inp = ByteList.plain(valuex);
+                }
+
+                if(inp == null) {
+                    byte v1 = 0;
+                    byte v2 = 0;
+                    String[] spl = valuex.split(",");
+                    for(int i=0;i<spl.length;i++) {
+                        spl[i] = spl[i].trim();
+                    }
+                    for(int i=0;i<spl.length;i++) {
+                        if("decipherOnly".equals(spl[i].trim()) || "Decipher Only".equals(spl[i].trim())) {
+                            v2 |= (byte)128;
+                        } else if("digitalSignature".equals(spl[i].trim()) || "Digital Signature".equals(spl[i].trim())) {
+                            v1 |= (byte)128;
+                        } else if("nonRepudiation".equals(spl[i].trim()) || "Non Repudiation".equals(spl[i].trim())) {
+                            v1 |= (byte)64;
+                        } else if("keyEncipherment".equals(spl[i].trim()) || "Key Encipherment".equals(spl[i].trim())) {
+                            v1 |= (byte)32;
+                        } else if("dataEncipherment".equals(spl[i].trim()) || "Data Encipherment".equals(spl[i].trim())) {
+                            v1 |= (byte)16;
+                        } else if("keyAgreement".equals(spl[i].trim()) || "Key Agreement".equals(spl[i].trim())) {
+                            v1 |= (byte)8;
+                        } else if("keyCertSign".equals(spl[i].trim()) || "Key Cert Sign".equals(spl[i].trim())) {
+                            v1 |= (byte)4;
+                        } else if("cRLSign".equals(spl[i].trim())) {
+                            v1 |= (byte)2;
+                        } else if("encipherOnly".equals(spl[i].trim()) || "Encipher Only".equals(spl[i].trim())) {
+                            v1 |= (byte)1;
+                        } else {
+                            throw new RaiseException(getRuntime(), (RubyClass)(((RubyModule)(getRuntime().getModule("OpenSSL").getConstant("X509"))).getConstant("ExtensionError")), oid + " = " + valuex + ": unknown bit string argument", true);
+                        }
+                    }
+                    if(v2 != 0) {
+                        inp = new byte[]{v1,v2};
+                    } else {
+                        inp = new byte[]{v1};
+                    }
+                }
+
+                int unused = 0;
+                for(int i = (inp.length-1); i>-1; i--) {
+                    if(inp[i] == 0) {
+                        unused += 8;
+                    } else {
+                        byte a2 = inp[i];
+                        int x = 8;
+                        while(a2 != 0) {
+                            a2 <<= 1;
+                            x--;
+                        }
+                        unused += x;
+                        break;
+                    }
+                }
+                
+                value = new String(ByteList.plain(new DERBitString(inp,unused).getDEREncoded()));
+            } else if(r_oid.equals(new DERObjectIdentifier("2.16.840.1.113730.1.1"))) { //nsCertType
+                byte v = 0;
+                if (valuex.length() < 3) {
+                    byte[] inp = ByteList.plain(valuex);
+                    v = inp[0];
+                } else {
+                    String[] spl = valuex.split(",");
+                    for (int i = 0; i < spl.length; i++) {
+                        spl[i] = spl[i].trim();
+                    }
+                    for (int i = 0; i < spl.length; i++) {
+                        if ("SSL Client".equals(spl[i]) || "client".equals(spl[i])) {
+                            v |= (byte) 128;
+                        } else if ("SSL Server".equals(spl[i]) || "server".equals(spl[i])) {
+                            v |= (byte) 64;
+                        } else if ("S/MIME".equals(spl[i]) || "email".equals(spl[i])) {
+                            v |= (byte) 32;
+                        } else if ("Object Signing".equals(spl[i]) || "objsign".equals(spl[i])) {
+                            v |= (byte) 16;
+                        } else if ("Unused".equals(spl[i]) || "reserved".equals(spl[i])) {
+                            v |= (byte) 8;
+                        } else if ("SSL CA".equals(spl[i]) || "sslCA".equals(spl[i])) {
+                            v |= (byte) 4;
+                        } else if ("S/MIME CA".equals(spl[i]) || "emailCA".equals(spl[i])) {
+                            v |= (byte) 2;
+                        } else if ("Object Signing CA".equals(spl[i]) || "objCA".equals(spl[i])) {
+                            v |= (byte) 1;
+                        } else {
+                            throw new RaiseException(getRuntime(), (RubyClass) (((RubyModule) (getRuntime().getModule("OpenSSL").getConstant("X509"))).getConstant("ExtensionError")), oid + " = " + valuex + ": unknown bit string argument", true);
+                        }
+                    }
+                }
+                int unused = 0;
+                if (v == 0) {
+                    unused += 8;
+                } else {
+                    byte a2 = v;
+                    int x = 8;
+                    while (a2 != 0) {
+                        a2 <<= 1;
+                        x--;
+                    }
+                    unused += x;
+                }
+                value = new DERBitString(new byte[] { v }, unused);
+            } else if(r_oid.equals(new DERObjectIdentifier("2.5.29.17"))) { //subjectAltName
+                if(valuex.startsWith("DNS:")) {
+                    value = new String(ByteList.plain(new GeneralNames(new GeneralName(GeneralName.dNSName,new DERIA5String(valuex.substring(4)))).getDEREncoded()));
+                } else if(valuex.startsWith("IP:")) {
+                    String[] numbers = valuex.substring(3).split("\\.");
+                    byte[] bs = new byte[4];
+                    bs[0] = (byte) (Integer.parseInt(numbers[0]) & 0xff);
+                    bs[1] = (byte) (Integer.parseInt(numbers[1]) & 0xff);
+                    bs[2] = (byte) (Integer.parseInt(numbers[2]) & 0xff);
+                    bs[3] = (byte) (Integer.parseInt(numbers[3]) & 0xff);
+                    value = new String(ByteList.plain(new GeneralNames(new GeneralName(GeneralName.iPAddress,new DEROctetString(bs))).getDEREncoded()));
+                } else if(valuex.startsWith("IP Address:")) {
+                    String[] numbers = valuex.substring(11).split("\\.");
+                    byte[] bs = new byte[4];
+                    bs[0] = (byte) (Integer.parseInt(numbers[0]) & 0xff);
+                    bs[1] = (byte) (Integer.parseInt(numbers[1]) & 0xff);
+                    bs[2] = (byte) (Integer.parseInt(numbers[2]) & 0xff);
+                    bs[3] = (byte) (Integer.parseInt(numbers[3]) & 0xff);
+                    value = new String(ByteList.plain(new GeneralNames(new GeneralName(GeneralName.iPAddress,new DEROctetString(bs))).getDEREncoded()));
+                }
+            } else if(r_oid.equals(new DERObjectIdentifier("2.5.29.37"))) { //extendedKeyUsage
+                String[] spl = valuex.split(", ?");
+                ASN1EncodableVector vector = new ASN1EncodableVector();
+                for(String name : spl) {
+                    vector.add(ASN1Registry.sym2oid(name));
+                }
+                value = new DERSequence(vector);
+            } else {
+                value = new DEROctetString(new DEROctetString(ByteList.plain(valuex)).getDEREncoded());
+            }
+
+            ext.setRealOid(r_oid);
+            ext.setRealValue(value);
+            ext.setRealCritical(critical.isTrue());
+
+            return ext;
+        }
+    }
+
+    public static class Extension extends RubyObject {
+        public static ObjectAllocator ALLOCATOR = new ObjectAllocator() {
+                public IRubyObject allocate(Ruby runtime, RubyClass klass) {
+                    return new Extension(runtime, klass);
+                }
+            };
+
+        public Extension(Ruby runtime, RubyClass type) {
+            super(runtime,type);
+        }
+
+        private DERObjectIdentifier oid;
+        private Object value;
+        private boolean critical;
+
+        void setRealOid(DERObjectIdentifier oid) {
+            this.oid = oid;
+        }
+
+        void setRealValue(Object value) {
+            this.value = value;
+        }
+
+        void setRealCritical(boolean critical) {
+            this.critical = critical;
+        }
+        
+        DERObjectIdentifier getRealOid() {
+            return oid;
+        }
+
+        Object getRealValue() {
+            return value;
+        }
+
+        byte[] getRealValueBytes() throws IOException {
+            if((value instanceof RubyString)) {
+                return ((RubyString) value).convertToString().getBytes();
+            } else if(value instanceof String) {
+                return ByteList.plain((String) value);
+            } else if(value instanceof DEROctetString) {
+                return ((DEROctetString)value).getOctets();
+            } else if(value instanceof DEREncodable) {
+                return ((ASN1Encodable)value).getEncoded();
+            } else {
+                return ((ASN1.ASN1Data)value).toASN1().getDEREncoded();
+            }
+        }
+
+        boolean getRealCritical() {
+            return critical;
+        }
+
+        DERObjectIdentifier getObjectIdentifier(String nameOrOid) {
+            Object val1 = ASN1.getOIDLookup(getRuntime()).get(nameOrOid.toLowerCase());
+            if(null != val1) {
+                return (DERObjectIdentifier)val1;
+            }
+            DERObjectIdentifier val2 = new DERObjectIdentifier(nameOrOid);
+            return val2;
+        }
+
+        @JRubyMethod(name="initialize", rest=true)
+        public IRubyObject _initialize(IRubyObject[] args) throws Exception {
+            byte[] octets = null;
+            if(args.length == 1) {
+                ASN1InputStream is = new ASN1InputStream(OpenSSLImpl.to_der_if_possible(args[0]).convertToString().getBytes());
+                Object obj = is.readObject();
+                ASN1Sequence seq = (ASN1Sequence)obj;
+                setRealOid((DERObjectIdentifier)(seq.getObjectAt(0)));
+                setRealCritical(((DERBoolean)(seq.getObjectAt(1))).isTrue());
+                octets = ((DEROctetString)(seq.getObjectAt(2))).getOctets();
+            } else if(args.length > 1) {
+                setRealOid(getObjectIdentifier(args[0].toString()));
+                setRealValue(args[1]);
+            }
+            if(args.length > 2) {
+                setRealCritical(args[2].isTrue());
+            }
+            if(args.length > 0 && octets != null) {
+                setRealValue(new String(ByteList.plain(octets)));
+            }
+
+            return this;
+        }
+
+        @JRubyMethod(name="oid=")
+        public IRubyObject set_oid(IRubyObject arg) {
+            System.err.println("WARNING: calling ext#oid=");
+            return getRuntime().getNil();
+        }
+
+        @JRubyMethod(name="value=")
+        public IRubyObject set_value(IRubyObject arg) {
+            System.err.println("WARNING: calling ext#value=");
+            return getRuntime().getNil();
+        }
+
+        @JRubyMethod(name="critical=")
+        public IRubyObject set_critical(IRubyObject arg) {
+            System.err.println("WARNING: calling ext#critical=");
+            return getRuntime().getNil();
+        }
+
+        @JRubyMethod
+        public IRubyObject oid() {
+            Object val = ASN1.getSymLookup(getRuntime()).get(oid);
+            if(null == val) {
+                val = oid.toString();
+            }
+            return getRuntime().newString((String)(val));
+        }
+
+        @JRubyMethod
+        public IRubyObject value() throws Exception {
+            if(getRealOid().equals(new DERObjectIdentifier("2.5.29.19"))) { //basicConstraints
+                ASN1Sequence seq2 = (ASN1Sequence)(new ASN1InputStream(getRealValueBytes()).readObject());
+                String c = "";
+                String path = "";
+                if(seq2.size()>0) {
+                    c = "CA:" + (((DERBoolean)(seq2.getObjectAt(0))).isTrue() ? "TRUE" : "FALSE");
+                }
+                if(seq2.size()>1) {
+                    path = ", pathlen:" + seq2.getObjectAt(1).toString();
+                }
+                return getRuntime().newString(c+path);
+            } else if(getRealOid().equals(new DERObjectIdentifier("2.5.29.15"))) { //keyUsage
+                byte[] bx = getRealValueBytes();
+                byte[] bs = new byte[bx.length-2];
+                System.arraycopy(bx,2,bs,0,bs.length);
+                byte b1 = 0;
+                byte b2 = bs[0];
+                if(bs.length>1) {
+                    b1 = bs[1];
+                }
+                StringBuffer sbe = new StringBuffer();
+                String sep = "";
+                if((b2 & (byte)128) != 0) {
+                    sbe.append(sep).append("Decipher Only");
+                    sep = ", ";
+                }
+                if((b1 & (byte)128) != 0) {
+                    sbe.append(sep).append("Digital Signature");
+                    sep = ", ";
+                }
+                if((b1 & (byte)64) != 0) {
+                    sbe.append(sep).append("Non Repudiation");
+                    sep = ", ";
+                }
+                if((b1 & (byte)32) != 0) {
+                    sbe.append(sep).append("Key Encipherment");
+                    sep = ", ";
+                }
+                if((b1 & (byte)16) != 0) {
+                    sbe.append(sep).append("Data Encipherment");
+                    sep = ", ";
+                }
+                if((b1 & (byte)8) != 0) {
+                    sbe.append(sep).append("Key Agreement");
+                    sep = ", ";
+                }
+                if((b1 & (byte)4) != 0) {
+                    sbe.append(sep).append("Key Cert Sign");
+                    sep = ", ";
+                }
+                if((b1 & (byte)2) != 0) {
+                    sbe.append(sep).append("cRLSign");
+                    sep = ", ";
+                }
+                if((b1 & (byte)1) != 0) {
+                    sbe.append(sep).append("Encipher Only");
+                }
+                return getRuntime().newString(sbe.toString());
+            } else if(getRealOid().equals(new DERObjectIdentifier("2.16.840.1.113730.1.1"))) { //nsCertType
+                byte[] bx = getRealValueBytes();
+                byte b = bx[0];
+                StringBuffer sbe = new StringBuffer();
+                String sep = "";
+                if((b & (byte)128) != 0) {
+                    sbe.append(sep).append("SSL Client");
+                    sep = ", ";
+                }
+                if((b & (byte)64) != 0) {
+                    sbe.append(sep).append("SSL Servern");
+                    sep = ", ";
+                }
+                if((b & (byte)32) != 0) {
+                    sbe.append(sep).append("S/MIME");
+                    sep = ", ";
+                }
+                if((b & (byte)16) != 0) {
+                    sbe.append(sep).append("Object Signing");
+                    sep = ", ";
+                }
+                if((b & (byte)8) != 0) {
+                    sbe.append(sep).append("Unused");
+                    sep = ", ";
+                }
+                if((b & (byte)4) != 0) {
+                    sbe.append(sep).append("SSL CA");
+                    sep = ", ";
+                }
+                if((b & (byte)2) != 0) {
+                    sbe.append(sep).append("S/MIME CA");
+                    sep = ", ";
+                }
+                if((b & (byte)1) != 0) {
+                    sbe.append(sep).append("Object Signing CA");
+                }
+                return getRuntime().newString(sbe.toString());
+            } else if(getRealOid().equals(new DERObjectIdentifier("2.5.29.14"))) { //subjectKeyIdentifier
+                byte[] b1 = getRealValueBytes();
+                byte[] b2 = new byte[b1.length-2];
+                System.arraycopy(b1,2,b2,0,b2.length);
+                return getRuntime().newString(Utils.toHex(b2,':'));
+            } else if(getRealOid().equals(new DERObjectIdentifier("2.5.29.35"))) { // authorityKeyIdentifier
+                DERSequence seq = (DERSequence)(new ASN1InputStream(getRealValueBytes()).readObject());
+                StringBuffer out1 = new StringBuffer();
+                if(seq.size() > 0) {
+                    out1.append("keyid:");
+                    out1.append(Utils.toHex(((DEROctetString)seq.getObjectAt(0)).getOctets(),':'));
+                }
+                return getRuntime().newString(out1.toString());
+            } else if(getRealOid().equals(new DERObjectIdentifier("2.5.29.21"))) { // CRLReason
+                switch(RubyNumeric.fix2int(((IRubyObject)value).callMethod(getRuntime().getCurrentContext(),"value"))) {
+                case 0:
+                    return getRuntime().newString("Unspecified");
+                case 1:
+                    return getRuntime().newString("Key Compromise");
+                case 2:
+                    return getRuntime().newString("CA Compromise");
+                case 3:
+                    return getRuntime().newString("Affiliation Changed");
+                case 4:
+                    return getRuntime().newString("Superseded");
+                case 5:
+                    return getRuntime().newString("Cessation Of Operation");
+                case 6:
+                    return getRuntime().newString("Certificate Hold");
+                case 8:
+                    return getRuntime().newString("Remove From CRL");
+                case 9:
+                    return getRuntime().newString("Privilege Withdrawn");
+                default:
+                    return getRuntime().newString("Unspecified");
+                }
+            } else if(getRealOid().equals(new DERObjectIdentifier("2.5.29.17"))) { //subjectAltName
+                try {
+                    DERObject seq = new ASN1InputStream(getRealValueBytes()).readObject();
+                    GeneralName[] n1 = null;
+                    if(seq instanceof DERUnknownTag) {
+                        n1 = new GeneralName[]{GeneralName.getInstance(seq)};
+                    } else if(seq instanceof org.bouncycastle.asn1.DERTaggedObject) {
+                        n1 = new GeneralName[]{GeneralName.getInstance(seq)};
+                    } else {
+                        n1 = GeneralNames.getInstance(seq).getNames();
+                    }
+                    StringBuffer sbe = new StringBuffer();
+                    String sep = "";
+                    for(int i=0;i<n1.length;i++) {
+                        sbe.append(sep);
+                        if(n1[i].getTagNo() == GeneralName.dNSName) {
+                            sbe.append("DNS:");
+                            sbe.append(((DERString)n1[i].getName()).getString());
+                        } else if(n1[i].getTagNo() == GeneralName.iPAddress) {
+                            sbe.append("IP Address:");
+                            byte[] bs = ((DEROctetString)n1[i].getName()).getOctets();
+                            String sep2 = "";
+                            for(int j=0;j<bs.length;j++) {
+                                sbe.append(sep2);
+                                sbe.append(((int)bs[j]) & 0xff);
+                                sep2 = ".";
+                            }
+                        } else {
+                            sbe.append(n1[i].toString());
+                        }
+                        sep = ", ";
+                    }
+                    return getRuntime().newString(sbe.toString());
+                } catch(Exception e) {
+                    return getRuntime().newString(getRealValue().toString());
+                }
+            } else {
+                try {
+                    return ASN1.decode(getRuntime().getModule("OpenSSL").getConstant("ASN1"),RubyString.newString(getRuntime(), getRealValueBytes())).callMethod(getRuntime().getCurrentContext(),"value").callMethod(getRuntime().getCurrentContext(),"to_s");
+                } catch(Exception e) {
+                    return getRuntime().newString(getRealValue().toString());
+                }
+            }
+        }
+
+        @JRubyMethod(name="critical?")
+        public IRubyObject critical_p() {
+            return critical ? getRuntime().getTrue() : getRuntime().getFalse();
+        }
+
+        @JRubyMethod
+        public IRubyObject to_der() throws Exception {
+            ASN1EncodableVector all = new ASN1EncodableVector();
+            all.add(getRealOid());
+            all.add(getRealCritical() ? DERBoolean.TRUE : DERBoolean.FALSE);
+            all.add(new DEROctetString(getRealValueBytes()));
+            return RubyString.newString(getRuntime(), new DERSequence(all).getDEREncoded());
+        }
+    }
+}// X509Extensions