>From f3d703415909bc7f7e367ebfe44b4adcf4340196 Mon Sep 17 00:00:00 2001
From: Abhishek Koneru <akoneru@redhat.com>
Date: Tue, 12 Jun 2012 14:04:10 -0400
Subject: [PATCH] Fixes For Review Comments For NR2

---
 .../netscape/certsrv/authentication/AuthToken.java |   42 +++++++-------------
 .../src/com/netscape/certsrv/request/IService.java |    2 +-
 .../com/netscape/cms/authentication/CMCAuth.java   |    6 +--
 .../cms/policy/extensions/SubjAltNameExt.java      |    3 +-
 .../cms/servlet/base/DisplayHtmlServlet.java       |    3 +-
 .../servlet/cert/ChallengeRevocationServlet1.java  |    3 +-
 .../com/netscape/cms/servlet/cert/UpdateCRL.java   |    4 +-
 .../csadmin/LDAPSecurityDomainSessionTable.java    |    6 +--
 .../cmscore/authentication/AuthSubsystem.java      |    7 +---
 .../authentication/PasswdUserDBAuthentication.java |    7 ++--
 .../src/com/netscape/cmscore/dbs/DBSubsystem.java  |    4 +-
 .../com/netscape/cmscore/dbs/KeyRepository.java    |    4 +-
 .../netscape/cmscore/request/ARequestQueue.java    |   10 +----
 .../certsrv/authentication/AuthTokenTest.java      |    4 +-
 base/kra/src/com/netscape/kra/KRAService.java      |    9 -----
 base/kra/src/com/netscape/kra/RecoveryService.java |    4 +-
 .../com/netscape/pkisilent/http/HTTPClient.java    |   33 ++++++---------
 .../cmsutil/radius/ChallengeException.java         |   18 ++-------
 .../netscape/cmsutil/radius/RejectException.java   |    8 +---
 .../src/netscape/security/util/DerInputBuffer.java |    4 +-
 .../src/netscape/security/util/DerInputStream.java |    2 +-
 .../x509/IssuingDistributionPointExtension.java    |    2 +-
 .../test/com/netscape/security/util/JSSUtil.java   |    6 +--
 23 files changed, 66 insertions(+), 125 deletions(-)

diff --git a/base/common/src/com/netscape/certsrv/authentication/AuthToken.java b/base/common/src/com/netscape/certsrv/authentication/AuthToken.java
index 110b30485aa195caea2eb4e40fddd111d0f68848..1b5bf2350fdd3a8ff368758e9076cddd9d53c8bf 100644
--- a/base/common/src/com/netscape/certsrv/authentication/AuthToken.java
+++ b/base/common/src/com/netscape/certsrv/authentication/AuthToken.java
@@ -295,13 +295,9 @@ public class AuthToken implements IAuthToken {
         CertificateExtensions exts = null;
         byte[] data = getInByteArray(name);
         if (data != null) {
-            try {
-                exts = new CertificateExtensions();
-                // exts.decode() doesn't work for empty CertExts
-                exts.decodeEx(new ByteArrayInputStream(data));
-            } catch (IOException e) {
-                throw new IOException(e.toString());
-            }
+            exts = new CertificateExtensions();
+            // exts.decode() doesn't work for empty CertExts
+            exts.decodeEx(new ByteArrayInputStream(data));
         }
         return exts;
     }
@@ -329,18 +325,12 @@ public class AuthToken implements IAuthToken {
             return null;
         }
 
-        try {
-            DerInputStream in = new DerInputStream(byteValue);
-            DerValue[] derValues = in.getSequence(5);
-            certArray = new X509CertImpl[derValues.length];
-            for (int i = 0; i < derValues.length; i++) {
-                byte[] certData = derValues[i].toByteArray();
-                certArray[i] = new X509CertImpl(certData);
-            }
-        } catch (IOException e) {
-            throw new IOException(e.toString());
-        } catch (CertificateException e) {
-            throw new CertificateException(e.toString());
+        DerInputStream in = new DerInputStream(byteValue);
+        DerValue[] derValues = in.getSequence(5);
+        certArray = new X509CertImpl[derValues.length];
+        for (int i = 0; i < derValues.length; i++) {
+            byte[] certData = derValues[i].toByteArray();
+            certArray[i] = new X509CertImpl(certData);
         }
         return new Certificates(certArray);
     }
@@ -379,15 +369,11 @@ public class AuthToken implements IAuthToken {
         if (byteValue == null) {
             return null;
         }
-        try {
-            DerInputStream in = new DerInputStream(byteValue);
-            DerValue[] derValues = in.getSequence(5);
-            retval = new byte[derValues.length][];
-            for (int i = 0; i < derValues.length; i++) {
-                retval[i] = derValues[i].getOctetString();
-            }
-        } catch (IOException e) {
-            throw new IOException(e.toString());
+        DerInputStream in = new DerInputStream(byteValue);
+        DerValue[] derValues = in.getSequence(5);
+        retval = new byte[derValues.length][];
+        for (int i = 0; i < derValues.length; i++) {
+            retval[i] = derValues[i].getOctetString();
         }
         return retval;
     }
diff --git a/base/common/src/com/netscape/certsrv/request/IService.java b/base/common/src/com/netscape/certsrv/request/IService.java
index 0dd7ab52cf0a4419a864f7b70b0076059c261545..af77210b2b1cdb40d8627df481696c2f1f4270cc 100644
--- a/base/common/src/com/netscape/certsrv/request/IService.java
+++ b/base/common/src/com/netscape/certsrv/request/IService.java
@@ -47,5 +47,5 @@ public interface IService {
      * @throws CertificateException
      */
     boolean serviceRequest(IRequest request)
-            throws EBaseException, CertificateException;
+            throws EBaseException;
 }
diff --git a/base/common/src/com/netscape/cms/authentication/CMCAuth.java b/base/common/src/com/netscape/cms/authentication/CMCAuth.java
index 1b8857ba85bafbb663b455faaaa3b370cbca8ac2..865b8e24bea76f0a0323d0a5125102f68aeeda58 100644
--- a/base/common/src/com/netscape/cms/authentication/CMCAuth.java
+++ b/base/common/src/com/netscape/cms/authentication/CMCAuth.java
@@ -876,7 +876,7 @@ public class CMCAuth implements IAuthManager, IExtendedPluginInfo,
 
                         IAuthManager agentAuth = authSS.getAuthManager(IAuthSubsystem.CERTUSERDB_AUTHMGR_ID);//AGENT_AUTHMGR_ID);
                         if (agentAuth == null) {
-                            throw new EBaseException("No Authentication Manager with name "+IAuthSubsystem.CERTUSERDB_AUTHMGR_ID);
+                            throw new EBaseException(CMS.getUserMessage("CMS_AUTHENTICATION_MANAGER_NOT_FOUND", IAuthSubsystem.CERTUSERDB_AUTHMGR_ID));
                         }
                         IAuthCredentials agentCred = new com.netscape.certsrv.authentication.AuthCredentials();
 
@@ -904,9 +904,7 @@ public class CMCAuth implements IAuthManager, IExtendedPluginInfo,
             CMS.debug("CMCAuth: " + e.toString());
         } catch (IOException e) {
             CMS.debug("CMCAuth: " + e.toString());
-        } catch (EBaseException e) {
-            throw new EBaseException(e.getMessage());
-        } catch (Exception e) {
+        }catch (Exception e) {
             throw new EInvalidCredentials(CMS.getUserMessage("CMS_AUTHENTICATION_INVALID_CREDENTIAL"));
         }
         return null;
diff --git a/base/common/src/com/netscape/cms/policy/extensions/SubjAltNameExt.java b/base/common/src/com/netscape/cms/policy/extensions/SubjAltNameExt.java
index 944846273373d0a789285f5804191a79d815aef0..d6e626aa95b6b06f16737688d12648ba482d25c2 100644
--- a/base/common/src/com/netscape/cms/policy/extensions/SubjAltNameExt.java
+++ b/base/common/src/com/netscape/cms/policy/extensions/SubjAltNameExt.java
@@ -252,8 +252,7 @@ public class SubjAltNameExt extends APolicyRule
      * found in this Authentication token
      * @throws IOException
      */
-    protected Vector /* of String */<String>
-            getEmailList(IAuthToken tok) throws IOException {
+    protected Vector<String> getEmailList(IAuthToken tok) throws IOException {
 
         Vector<String> v = new Vector<String>();
 
diff --git a/base/common/src/com/netscape/cms/servlet/base/DisplayHtmlServlet.java b/base/common/src/com/netscape/cms/servlet/base/DisplayHtmlServlet.java
index 05f0a8b59c697227fdc5fc6c299c8a89810476df..895e099fb75b685838b81c35cb374ed1547f612f 100644
--- a/base/common/src/com/netscape/cms/servlet/base/DisplayHtmlServlet.java
+++ b/base/common/src/com/netscape/cms/servlet/base/DisplayHtmlServlet.java
@@ -61,9 +61,8 @@ public class DisplayHtmlServlet extends CMSServlet {
      */
     public void process(CMSRequest cmsReq) throws EBaseException {
         CMS.debug("DisplayHtmlServlet about to service ");
-
+        authenticate(cmsReq);
         try {
-            authenticate(cmsReq);
             String realpath =
                     mServletConfig.getServletContext().getRealPath("/" + mHTMLPath);
 
diff --git a/base/common/src/com/netscape/cms/servlet/cert/ChallengeRevocationServlet1.java b/base/common/src/com/netscape/cms/servlet/cert/ChallengeRevocationServlet1.java
index 9615320776f25e83d307d7621935121e9b91fb92..e3680fd6b8991321f61a6085cb36e389bc666d82 100644
--- a/base/common/src/com/netscape/cms/servlet/cert/ChallengeRevocationServlet1.java
+++ b/base/common/src/com/netscape/cms/servlet/cert/ChallengeRevocationServlet1.java
@@ -134,8 +134,7 @@ public class ChallengeRevocationServlet1 extends CMSServlet {
      * @param cmsReq the object holding the request and response information
      * @throws IOException
      */
-    protected void process(CMSRequest cmsReq)
-            throws EBaseException{
+    protected void process(CMSRequest cmsReq) throws EBaseException {
         IArgBlock httpParams = cmsReq.getHttpParams();
         HttpServletRequest req = cmsReq.getHttpReq();
         HttpServletResponse resp = cmsReq.getHttpResp();
diff --git a/base/common/src/com/netscape/cms/servlet/cert/UpdateCRL.java b/base/common/src/com/netscape/cms/servlet/cert/UpdateCRL.java
index 433e97f895a0af2eb2ba4cc842df5aef60867af1..a3cec570a20253cd74e754c63606e1be3b057521 100644
--- a/base/common/src/com/netscape/cms/servlet/cert/UpdateCRL.java
+++ b/base/common/src/com/netscape/cms/servlet/cert/UpdateCRL.java
@@ -120,11 +120,9 @@ public class UpdateCRL extends CMSServlet {
             statsSub.startTiming("crl", true /* main action */);
         }
 
-        IAuthToken authToken = null;
+        IAuthToken authToken = authenticate(cmsReq);
         AuthzToken authzToken = null;
-
         try {
-            authToken = authenticate(cmsReq);
             authzToken = authorize(mAclMethod, authToken,
                         mAuthzResourceName, "update");
         } catch (EAuthzAccessDenied e) {
diff --git a/base/common/src/com/netscape/cms/servlet/csadmin/LDAPSecurityDomainSessionTable.java b/base/common/src/com/netscape/cms/servlet/csadmin/LDAPSecurityDomainSessionTable.java
index 1933383f8e4e60ee2e8c65e3a68726504217d719..ff9ab5eba1e683a6bb0594fc27da83e0b9aca04c 100644
--- a/base/common/src/com/netscape/cms/servlet/csadmin/LDAPSecurityDomainSessionTable.java
+++ b/base/common/src/com/netscape/cms/servlet/csadmin/LDAPSecurityDomainSessionTable.java
@@ -194,9 +194,9 @@ public class LDAPSecurityDomainSessionTable
                 LDAPEntry entry = res.next();
                 LDAPAttribute sid = entry.getAttribute("cn");
                 if (sid == null) {
-                    throw new Exception("Invalid LDAP Entry. No session id.");
+                    throw new Exception("Invalid LDAP Entry." + entry.getDN() + " No session id(cn).");
                 }
-                ret.add(entry.getAttribute("cn").getStringValueArray()[0]);
+                ret.add(sid.getStringValueArray()[0]);
             }
         } catch (LDAPException e) {
             switch (e.getLDAPResultCode()) {
@@ -234,7 +234,7 @@ public class LDAPSecurityDomainSessionTable
                 LDAPEntry entry = res.next();
                 LDAPAttribute searchAttribute = entry.getAttribute(attr);
                 if (searchAttribute == null) {
-                    throw new Exception("No Attribute " + attr + " for this session");
+                    throw new Exception("No Attribute " + attr + " for this session in LDAPEntry "+entry.getDN());
                 }
                 ret = searchAttribute.getStringValueArray()[0];
             }
diff --git a/base/common/src/com/netscape/cmscore/authentication/AuthSubsystem.java b/base/common/src/com/netscape/cmscore/authentication/AuthSubsystem.java
index 43de01ada9f3c4c4916e8d46be235b17708f5dfe..c5b09a7d7e956deb56f58e3713ba502dc6656544 100644
--- a/base/common/src/com/netscape/cmscore/authentication/AuthSubsystem.java
+++ b/base/common/src/com/netscape/cmscore/authentication/AuthSubsystem.java
@@ -458,12 +458,9 @@ public class AuthSubsystem implements IAuthSubsystem {
      * <P>
      */
     public void shutdown() {
-        for (Enumeration<String> e = mAuthMgrInsts.keys(); e.hasMoreElements();) {
+        for (AuthManagerProxy proxy : mAuthMgrInsts.values()) {
 
-            IAuthManager mgr = get(e.nextElement());
-            if (mgr == null) {
-                continue;
-            }
+            IAuthManager mgr = proxy.getAuthManager();
 
             log(ILogger.LL_INFO, CMS.getLogMessage("CMSCORE_AUTH_INSTANCE_SHUTDOWN", mgr.getName()));
 
diff --git a/base/common/src/com/netscape/cmscore/authentication/PasswdUserDBAuthentication.java b/base/common/src/com/netscape/cmscore/authentication/PasswdUserDBAuthentication.java
index eddebd88198b7d9d8b8f24e6d83a5ade1e4fcfa3..fa8696c1d6a25b1ea86a65d229d1f99efab713e8 100644
--- a/base/common/src/com/netscape/cmscore/authentication/PasswdUserDBAuthentication.java
+++ b/base/common/src/com/netscape/cmscore/authentication/PasswdUserDBAuthentication.java
@@ -186,9 +186,6 @@ public class PasswdUserDBAuthentication implements IAuthManager {
 
         try {
             user = ug.getUser(uid);
-            if (user == null) {
-                throw new EInvalidCredentials(uid);
-            }
         } catch (EBaseException e) {
             if (Debug.ON)
                 e.printStackTrace();
@@ -196,6 +193,10 @@ public class PasswdUserDBAuthentication implements IAuthManager {
             log(ILogger.LL_SECURITY, CMS.getLogMessage("CMSCORE_AUTH_UID_NOT_FOUND", uid, e.toString()));
             throw new EInvalidCredentials(CMS.getUserMessage("CMS_AUTHENTICATION_INVALID_CREDENTIAL") + " " + e.getMessage());
         }
+        if (user == null) {
+            throw new EInvalidCredentials(CMS.getUserMessage("CMS_AUTHENTICATION_INTERNAL_ERROR",
+                    "Failure in User Group subsystem."));
+        }
         authToken.set(TOKEN_USERDN, user.getUserDN());
         authToken.set(TOKEN_USERID, user.getUserID());
         log(ILogger.LL_INFO, CMS.getLogMessage("CMS_AUTH_AUTHENTICATED", uid));
diff --git a/base/common/src/com/netscape/cmscore/dbs/DBSubsystem.java b/base/common/src/com/netscape/cmscore/dbs/DBSubsystem.java
index e36f5d9bc22ce55208641bde61a8e403f7258a01..ecab3c9bc570f1b7ac7c503ed542e3b28c9e6414 100644
--- a/base/common/src/com/netscape/cmscore/dbs/DBSubsystem.java
+++ b/base/common/src/com/netscape/cmscore/dbs/DBSubsystem.java
@@ -408,8 +408,8 @@ public class DBSubsystem implements IDBSubsystem {
 
             LDAPEntry entry = conn.read(dn);
             LDAPAttribute attr = entry.getAttribute(PROP_NEXT_RANGE);
-            if(attr==null){
-                throw new Exception("No next range LDAPEntry available");
+            if (attr == null) {
+                throw new Exception("Missing Attribute PROP_NEXT_RANGE in Entry " + dn);
             }
             nextRange = (String) attr.getStringValues().nextElement();
 
diff --git a/base/common/src/com/netscape/cmscore/dbs/KeyRepository.java b/base/common/src/com/netscape/cmscore/dbs/KeyRepository.java
index 178b639ff94877b7d476b3910b6a49eaf6855088..0fbff688a7608daa16d6c373047f1460bdafc537 100644
--- a/base/common/src/com/netscape/cmscore/dbs/KeyRepository.java
+++ b/base/common/src/com/netscape/cmscore/dbs/KeyRepository.java
@@ -251,7 +251,7 @@ public class KeyRepository extends Repository implements IKeyRepository {
      */
     public IKeyRecord readKeyRecord(BigInteger serialNo)
             throws EBaseException {
-        if(serialNo==null){
+        if (serialNo == null) {
             throw new EBaseException("Invalid Serial Number.");
         }
         IDBSSession s = mDBService.createSession();
@@ -268,7 +268,7 @@ public class KeyRepository extends Repository implements IKeyRepository {
                 s.close();
         }
         if (rec == null) {
-            throw new EBaseException("Failed to recover Key");
+            throw new EBaseException("Failed to recover Key for Serial Number " + serialNo);
         }
         return rec;
     }
diff --git a/base/common/src/com/netscape/cmscore/request/ARequestQueue.java b/base/common/src/com/netscape/cmscore/request/ARequestQueue.java
index df68abfef9a9a6242a3601aee06b5a07b48bb647..0a156b003eac2c1b30cf7a634ffb6fe7a080dd3c 100644
--- a/base/common/src/com/netscape/cmscore/request/ARequestQueue.java
+++ b/base/common/src/com/netscape/cmscore/request/ARequestQueue.java
@@ -588,15 +588,9 @@ public abstract class ARequestQueue
 
                 complete = true;
             } else if (rs == RequestStatus.APPROVED) {
-                boolean svcComplete=false;
+                boolean svcComplete;
 
-                try {
-                    svcComplete = mService.serviceRequest(r);
-                } catch (CertificateException e) {
-                    // TODO Auto-generated catch block
-                    e.printStackTrace();
-                    throw new EBaseException("Cannot service the Request.");
-                }
+                svcComplete = mService.serviceRequest(r);
 
                 // Completed requests call the notifier and are done. Others
                 // wait for the serviceComplete call.
diff --git a/base/common/test/com/netscape/certsrv/authentication/AuthTokenTest.java b/base/common/test/com/netscape/certsrv/authentication/AuthTokenTest.java
index f81f790fc492f5040166226a8e028ebf10b7308f..a5b5c4737f30d0f98603a166378163baeb99bf1b 100644
--- a/base/common/test/com/netscape/certsrv/authentication/AuthTokenTest.java
+++ b/base/common/test/com/netscape/certsrv/authentication/AuthTokenTest.java
@@ -119,7 +119,7 @@ public class AuthTokenTest extends CMSBaseTestCase {
         authToken.set("key2", "234567");
         Date retval = authToken.getInDate("key2");
         if (retval == null) {
-            throw new Exception("Null InDate for AuthToken key2");
+            throw new Exception("Unable to get key2 as Date");
         }
         assertEquals(234567L, retval.getTime());
 
@@ -140,7 +140,7 @@ public class AuthTokenTest extends CMSBaseTestCase {
 
         assertFalse(cmsStub.aToBCalled);
         String[] retval = authToken.getInStringArray("key");
-        if(retval==null){
+        if (retval == null) {
             throw new IOException();
         }
         assertTrue(cmsStub.aToBCalled);
diff --git a/base/kra/src/com/netscape/kra/KRAService.java b/base/kra/src/com/netscape/kra/KRAService.java
index f5d709c93796a0c67477d98c566722585024442e..987d17b6b7f48b258806f03ddaee53aca35a23aa 100644
--- a/base/kra/src/com/netscape/kra/KRAService.java
+++ b/base/kra/src/com/netscape/kra/KRAService.java
@@ -17,7 +17,6 @@
 // --- END COPYRIGHT BLOCK ---
 package com.netscape.kra;
 
-import java.security.cert.CertificateException;
 import java.util.Hashtable;
 
 import com.netscape.certsrv.apps.CMS;
@@ -97,14 +96,6 @@ public class KRAService implements IService {
             //	return true;
             // #546508
             return false;
-        } catch (CertificateException e) {
-            // TODO Auto-generated catch block
-            e.printStackTrace();
-            r.setExtData(IRequest.RESULT, IRequest.RES_ERROR);
-            r.setExtData(IRequest.ERROR, e);
-            //  return true;
-            // #546508
-            return false;
         }
     }
 }
diff --git a/base/kra/src/com/netscape/kra/RecoveryService.java b/base/kra/src/com/netscape/kra/RecoveryService.java
index e00ff374df8cf351638776861541310e0b8ef5c9..4664f17b2d0a60f8cf518ac49a0c7256b257f0bb 100644
--- a/base/kra/src/com/netscape/kra/RecoveryService.java
+++ b/base/kra/src/com/netscape/kra/RecoveryService.java
@@ -131,7 +131,7 @@ public class RecoveryService implements IService {
      * @exception EBaseException failed to serve
      * @throws CertificateException
      */
-    public boolean serviceRequest(IRequest request) throws EBaseException, CertificateException {
+    public boolean serviceRequest(IRequest request) throws EBaseException {
 
         CryptoManager cm = null;
         IConfigStore config = null;
@@ -197,7 +197,7 @@ public class RecoveryService implements IService {
         X509Certificate x509cert =
                 request.getExtDataInCert(ATTR_USER_CERT);
         if (x509cert == null) {
-            throw new CertificateException("Key is Null or Could not create a certificate.");
+            throw new EKRAException(CMS.getLogMessage("CMS_KRA_INVALID_KEYRECORD"));
         }
         byte inputPubData[] = x509cert.getPublicKey().getEncoded();
 
diff --git a/base/silent/src/com/netscape/pkisilent/http/HTTPClient.java b/base/silent/src/com/netscape/pkisilent/http/HTTPClient.java
index 7738e7d7e4b56cbf4febc5a8ddc98a815c340e77..6398fdcddbe0fd529f2044aeab12bd812b1f003c 100644
--- a/base/silent/src/com/netscape/pkisilent/http/HTTPClient.java
+++ b/base/silent/src/com/netscape/pkisilent/http/HTTPClient.java
@@ -428,24 +428,22 @@ public class HTTPClient implements SSLCertificateApprovalCallback {
             } catch (Exception e) {
                 System.out.println("Exception");
                 e.printStackTrace();
-                throw new Exception(e.toString());
+                throw e;
+            } finally {
+                socket.close();
+                os.close();
+                rawos.close();
+                ps.close();
+
+                os = null;
+                rawos = null;
+                ps = null;
             }
 
-            socket.close();
-            os.close();
-            rawos.close();
-            ps.close();
-
-            os = null;
-            rawos = null;
-            ps = null;
-
-        }
-
-        catch (Exception e) {
+        } catch (Exception e) {
             System.err.println("Exception: Unable to Send Request:" + e);
             e.printStackTrace();
-            throw new Exception("Exception: Unable to Send Request:" + e.toString());
+            throw e;
         }
 
         return hr;
@@ -1195,13 +1193,8 @@ public class HTTPClient implements SSLCertificateApprovalCallback {
             }
         } else if (ssl != null && ssl.equalsIgnoreCase("false")) {
             // non ssl connect
-            try {
                 hr = hc.nonsslConnect(cs_hostname, cs_port, uri, query);
-            } catch (Exception e) {
-                // TODO Auto-generated catch block
-                e.printStackTrace();
-                throw new Exception("Non SSL Connect Failed due to :" + e.toString());
-            }
+
         } else {
             System.out.println("ERROR: ssl parameter is null");
             System.exit(-1);
diff --git a/base/util/src/com/netscape/cmsutil/radius/ChallengeException.java b/base/util/src/com/netscape/cmsutil/radius/ChallengeException.java
index 7ee265523472323e1c77608f4b8f6d04472ee9fa..2c13a6b115f7a9f178815465e37b9e6f9a0a865a 100644
--- a/base/util/src/com/netscape/cmsutil/radius/ChallengeException.java
+++ b/base/util/src/com/netscape/cmsutil/radius/ChallengeException.java
@@ -32,21 +32,11 @@ public class ChallengeException extends Exception {
         return _res.getAttributeSet();
     }
 
-    public String getState() {
-        StateAttribute state = (StateAttribute) _res.getAttributeSet().getAttributeByType(
-                Attribute.STATE);
-        if (state != null) {
-            return state.getString();
-        }
-        return "";
+    public StateAttribute getState() {
+        return (StateAttribute) _res.getAttributeSet().getAttributeByType(Attribute.STATE);
     }
 
-    public String getReplyMessage() {
-        ReplyMessageAttribute replyMsg = (ReplyMessageAttribute) _res.getAttributeSet().getAttributeByType(
-                Attribute.REPLY_MESSAGE);
-        if (replyMsg != null) {
-            return replyMsg.getString();
-        }
-        return "";
+    public ReplyMessageAttribute getReplyMessage() {
+        return (ReplyMessageAttribute) _res.getAttributeSet().getAttributeByType(Attribute.REPLY_MESSAGE);
     }
 }
diff --git a/base/util/src/com/netscape/cmsutil/radius/RejectException.java b/base/util/src/com/netscape/cmsutil/radius/RejectException.java
index 77fe3920f22444f3f98b7bb9923b42ec25e086fa..79678fb324bc18a8801dca5ff7a3ab2b7f3c19f3 100644
--- a/base/util/src/com/netscape/cmsutil/radius/RejectException.java
+++ b/base/util/src/com/netscape/cmsutil/radius/RejectException.java
@@ -32,12 +32,8 @@ public class RejectException extends Exception {
         return _res.getAttributeSet();
     }
 
-    public String getReplyMessage() {
-        ReplyMessageAttribute replyMsg = (ReplyMessageAttribute) _res.getAttributeSet().getAttributeByType(
+    public ReplyMessageAttribute getReplyMessage() {
+        return (ReplyMessageAttribute) _res.getAttributeSet().getAttributeByType(
                 Attribute.REPLY_MESSAGE);
-        if (replyMsg != null) {
-            return replyMsg.getString();
-        }
-        return "";
     }
 }
diff --git a/base/util/src/netscape/security/util/DerInputBuffer.java b/base/util/src/netscape/security/util/DerInputBuffer.java
index 466e64906c0dc9676b014d39f6e929cf7045d1ef..e1cdcf6fbedf8dec7704e6b1186aa6085ad53b7c 100644
--- a/base/util/src/netscape/security/util/DerInputBuffer.java
+++ b/base/util/src/netscape/security/util/DerInputBuffer.java
@@ -52,10 +52,10 @@ class DerInputBuffer extends ByteArrayInputStream implements Cloneable {
         }
     }
 
-    byte[] toByteArray() throws Exception {
+    byte[] toByteArray() throws IOException {
         int len = available();
         if (len <= 0)
-            throw new Exception("No Buffer Space Available.");
+            throw new IOException("No Buffer Space Available.");
         byte[] retval = new byte[len];
 
         System.arraycopy(buf, pos, retval, 0, len);
diff --git a/base/util/src/netscape/security/util/DerInputStream.java b/base/util/src/netscape/security/util/DerInputStream.java
index 1d33149957fd9202af0cf300edb7ce098f0da1d0..95bd73364768242af6410969df519ed03868669d 100644
--- a/base/util/src/netscape/security/util/DerInputStream.java
+++ b/base/util/src/netscape/security/util/DerInputStream.java
@@ -114,7 +114,7 @@ public class DerInputStream {
      * as a byte array. Useful for debugging.
      * @throws Exception
      */
-    public byte[] toByteArray() throws Exception {
+    public byte[] toByteArray() throws IOException {
         return buffer.toByteArray();
     }
 
diff --git a/base/util/src/netscape/security/x509/IssuingDistributionPointExtension.java b/base/util/src/netscape/security/x509/IssuingDistributionPointExtension.java
index 4af8d19626c3599d7680e33ebe9dc4bacb039362..0f8c8835c487739ba03a0f96831f642da329990a 100644
--- a/base/util/src/netscape/security/x509/IssuingDistributionPointExtension.java
+++ b/base/util/src/netscape/security/x509/IssuingDistributionPointExtension.java
@@ -196,7 +196,7 @@ public class IssuingDistributionPointExtension extends Extension
                                 try {
                                     BitArray reasons = opt.getUnalignedBitString();
                                     if (reasons == null) {
-                                        throw new IOException();
+                                        throw new IOException("Unable to get the unaligned bit string.");
                                     }
                                     issuingDistributionPoint.setOnlySomeReasons(reasons);
 
diff --git a/base/util/test/com/netscape/security/util/JSSUtil.java b/base/util/test/com/netscape/security/util/JSSUtil.java
index 7e5624e1ee715fb6715d2ff8f8cf060e37d8b37b..5c7ddcddbdef13e5a1ba8b325764179df87d72c5 100644
--- a/base/util/test/com/netscape/security/util/JSSUtil.java
+++ b/base/util/test/com/netscape/security/util/JSSUtil.java
@@ -68,9 +68,9 @@ public class JSSUtil {
         default:
             throw new Exception("Unsupported tag: " + tag);
         }
-        ASN1Value asnValue=ASN1Util.decode(new Tag(Tag.UNIVERSAL, tag), template, bytes);
-        if(asnValue==null){
-            throw new Exception("Cannot decode the given template.");
+        ASN1Value asnValue = ASN1Util.decode(new Tag(Tag.UNIVERSAL, tag), template, bytes);
+        if (asnValue == null) {
+            throw new Exception("Cannot decode the given bytes.");
         }
         return asnValue.toString();
     }
-- 
1.7.10.2

