diff options
Diffstat (limited to 'bkucommon/src/main/java/at/gv/egiz/bku/spring/PKITrustManager.java')
-rw-r--r-- | bkucommon/src/main/java/at/gv/egiz/bku/spring/PKITrustManager.java | 369 |
1 files changed, 184 insertions, 185 deletions
diff --git a/bkucommon/src/main/java/at/gv/egiz/bku/spring/PKITrustManager.java b/bkucommon/src/main/java/at/gv/egiz/bku/spring/PKITrustManager.java index 076fdf11..7b82f2f8 100644 --- a/bkucommon/src/main/java/at/gv/egiz/bku/spring/PKITrustManager.java +++ b/bkucommon/src/main/java/at/gv/egiz/bku/spring/PKITrustManager.java @@ -1,185 +1,184 @@ -/* - * Copyright 2011 by Graz University of Technology, Austria - * MOCCA has been developed by the E-Government Innovation Center EGIZ, a joint - * initiative of the Federal Chancellery Austria and Graz University of Technology. - * - * Licensed under the EUPL, Version 1.1 or - as soon they will be approved by - * the European Commission - subsequent versions of the EUPL (the "Licence"); - * You may not use this work except in compliance with the Licence. - * You may obtain a copy of the Licence at: - * http://www.osor.eu/eupl/ - * - * Unless required by applicable law or agreed to in writing, software - * distributed under the Licence is distributed on an "AS IS" basis, - * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. - * See the Licence for the specific language governing permissions and - * limitations under the Licence. - * - * This product combines work with different licenses. See the "NOTICE" text - * file for details on the various modules and licenses. - * The "NOTICE" text file is part of the distribution. Any derivative works - * that you distribute must include a readable copy of the "NOTICE" text file. - */ - - - -package at.gv.egiz.bku.spring; - -import iaik.logging.TransactionId; -import iaik.pki.PKIException; -import iaik.pki.PKIFactory; -import iaik.pki.PKIModule; -import iaik.pki.PKIProfile; -import iaik.pki.store.truststore.TrustStore; -import iaik.pki.store.truststore.TrustStoreException; -import iaik.pki.store.truststore.TrustStoreFactory; - -import java.security.cert.CertificateException; -import java.security.cert.X509Certificate; -import java.util.Date; -import java.util.Set; - -import javax.net.ssl.X509TrustManager; - -import org.apache.commons.configuration.Configuration; -import org.slf4j.Logger; -import org.slf4j.LoggerFactory; -import org.slf4j.MDC; - -import at.gv.egiz.bku.conf.MoccaConfigurationFacade; - -public class PKITrustManager implements X509TrustManager { - - Logger log = LoggerFactory.getLogger(PKITrustManager.class); - - protected PKIProfile pkiProfile; - - /** - * The configuration facade. - */ - protected final ConfigurationFacade configurationFacade = new ConfigurationFacade(); - - public class ConfigurationFacade implements MoccaConfigurationFacade { - - private Configuration configuration; - - public static final String SSL_DISSABLE_ALL_CHECKS = "SSL.disableAllChecks"; - - public boolean disableAllSslChecks() { - return configuration.getBoolean(SSL_DISSABLE_ALL_CHECKS, false); - } - - } - - /** - * @return the configuration - */ - public Configuration getConfiguration() { - return configurationFacade.configuration; - } - - /** - * @param configuration the configuration to set - */ - public void setConfiguration(Configuration configuration) { - configurationFacade.configuration = configuration; - } - - /** - * @return the pkiProfile - */ - public PKIProfile getPkiProfile() { - return pkiProfile; - } - - /** - * @param pkiProfile the pkiProfile to set - */ - public void setPkiProfile(PKIProfile pkiProfile) { - this.pkiProfile = pkiProfile; - } - - @Override - public void checkClientTrusted(X509Certificate[] chain, String authType) - throws CertificateException { - checkServerTrusted(chain, authType); - } - - @Override - public void checkServerTrusted(X509Certificate[] chain, String authType) - throws CertificateException { - - if (pkiProfile == null) { - throw new CertificateException("No PKI profile set. Configuration error."); - } - - if (configurationFacade.disableAllSslChecks()) { - log.warn("SSL certificate validation disabled. " + - "Accepted certificate {}.", chain[0].getSubjectDN()); - } else { - - iaik.x509.X509Certificate[] certs = convertCerts(chain); - - TransactionId tid = new MDCTransactionId(); - try { - PKIModule pkiModule = PKIFactory.getInstance().getPKIModule(pkiProfile); - if (!pkiModule.validateCertificate(new Date(), certs[0], certs, null, - tid).isCertificateValid()) { - throw new CertificateException("Certificate not valid."); - } - } catch (PKIException e) { - log.warn("Failed to validate certificate.", e); - throw new CertificateException("Failed to validate certificate. " + e.getMessage()); - } - - } - - } - - @Override - public X509Certificate[] getAcceptedIssuers() { - - if (pkiProfile == null) { - log.warn("No PKI profile set. Configuration error."); - return new X509Certificate[] {}; - } - - TransactionId tid = new MDCTransactionId(); - - try { - - TrustStore trustStore = TrustStoreFactory.getInstance(pkiProfile.getTrustStoreProfile(), tid); - @SuppressWarnings("unchecked") - Set<X509Certificate> certs = trustStore.getTrustedCertificates(tid); - return certs.toArray(new X509Certificate[certs.size()]); - } catch (TrustStoreException e) { - log.warn("Failed to get list of accepted issuers.", e); - return new X509Certificate[] {}; - } catch (ClassCastException e) { - log.error("Failed to cast list of accepted issuers.", e); - return new X509Certificate[] {}; - } - } - - private static iaik.x509.X509Certificate[] convertCerts( - X509Certificate[] certs) throws CertificateException { - iaik.x509.X509Certificate[] retVal = new iaik.x509.X509Certificate[certs.length]; - int i = 0; - for (X509Certificate cert : certs) { - if (cert instanceof iaik.x509.X509Certificate) { - retVal[i++] = (iaik.x509.X509Certificate) cert; - } else { - retVal[i++] = new iaik.x509.X509Certificate(cert.getEncoded()); - } - } - return retVal; - } - - private static class MDCTransactionId implements TransactionId { - @Override - public String getLogID() { - String sessionId = MDC.get("SessionId"); - return (sessionId != null) ? sessionId : "PKITrustManager"; - } - } -} +/*
+ * Copyright 2011 by Graz University of Technology, Austria
+ * MOCCA has been developed by the E-Government Innovation Center EGIZ, a joint
+ * initiative of the Federal Chancellery Austria and Graz University of Technology.
+ *
+ * Licensed under the EUPL, Version 1.1 or - as soon they will be approved by
+ * the European Commission - subsequent versions of the EUPL (the "Licence");
+ * You may not use this work except in compliance with the Licence.
+ * You may obtain a copy of the Licence at:
+ * http://www.osor.eu/eupl/
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the Licence is distributed on an "AS IS" basis,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the Licence for the specific language governing permissions and
+ * limitations under the Licence.
+ *
+ * This product combines work with different licenses. See the "NOTICE" text
+ * file for details on the various modules and licenses.
+ * The "NOTICE" text file is part of the distribution. Any derivative works
+ * that you distribute must include a readable copy of the "NOTICE" text file.
+ */
+
+
+
+package at.gv.egiz.bku.spring;
+
+import iaik.logging.TransactionId;
+import iaik.pki.PKIException;
+import iaik.pki.PKIFactory;
+import iaik.pki.PKIModule;
+import iaik.pki.PKIProfile;
+import iaik.pki.store.truststore.TrustStore;
+import iaik.pki.store.truststore.TrustStoreException;
+import iaik.pki.store.truststore.TrustStoreFactory;
+
+import java.security.cert.CertificateException;
+import java.security.cert.X509Certificate;
+import java.util.Date;
+import java.util.Set;
+
+import javax.net.ssl.X509TrustManager;
+
+import org.apache.commons.configuration.Configuration;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+import org.slf4j.MDC;
+
+import at.gv.egiz.bku.conf.MoccaConfigurationFacade;
+
+public class PKITrustManager implements X509TrustManager {
+
+ Logger log = LoggerFactory.getLogger(PKITrustManager.class);
+
+ protected PKIProfile pkiProfile;
+
+ /**
+ * The configuration facade.
+ */
+ protected final ConfigurationFacade configurationFacade = new ConfigurationFacade();
+
+ public class ConfigurationFacade implements MoccaConfigurationFacade {
+
+ private Configuration configuration;
+
+ public static final String SSL_DISSABLE_ALL_CHECKS = "SSL.disableAllChecks";
+
+ public boolean disableAllSslChecks() {
+ return configuration.getBoolean(SSL_DISSABLE_ALL_CHECKS, false);
+ }
+
+ }
+
+ /**
+ * @return the configuration
+ */
+ public Configuration getConfiguration() {
+ return configurationFacade.configuration;
+ }
+
+ /**
+ * @param configuration the configuration to set
+ */
+ public void setConfiguration(Configuration configuration) {
+ configurationFacade.configuration = configuration;
+ }
+
+ /**
+ * @return the pkiProfile
+ */
+ public PKIProfile getPkiProfile() {
+ return pkiProfile;
+ }
+
+ /**
+ * @param pkiProfile the pkiProfile to set
+ */
+ public void setPkiProfile(PKIProfile pkiProfile) {
+ this.pkiProfile = pkiProfile;
+ }
+
+ @Override
+ public void checkClientTrusted(X509Certificate[] chain, String authType)
+ throws CertificateException {
+ checkServerTrusted(chain, authType);
+ }
+
+ @Override
+ public void checkServerTrusted(X509Certificate[] chain, String authType)
+ throws CertificateException {
+
+ if (pkiProfile == null) {
+ throw new CertificateException("No PKI profile set. Configuration error.");
+ }
+
+ if (configurationFacade.disableAllSslChecks()) {
+ log.warn("SSL certificate validation disabled. " +
+ "Accepted certificate {}.", chain[0].getSubjectDN());
+ } else {
+
+ iaik.x509.X509Certificate[] certs = convertCerts(chain);
+
+ TransactionId tid = new MDCTransactionId();
+ try {
+ PKIModule pkiModule = PKIFactory.getInstance().getPKIModule(pkiProfile);
+ if (!pkiModule.validateCertificate(new Date(), certs[0], certs, null,
+ tid).isCertificateValid()) {
+ throw new CertificateException("Certificate not valid.");
+ }
+ } catch (PKIException e) {
+ log.warn("Failed to validate certificate.", e);
+ throw new CertificateException("Failed to validate certificate. " + e.getMessage());
+ }
+
+ }
+
+ }
+
+ @Override
+ public X509Certificate[] getAcceptedIssuers() {
+
+ if (pkiProfile == null) {
+ log.warn("No PKI profile set. Configuration error.");
+ return new X509Certificate[] {};
+ }
+
+ TransactionId tid = new MDCTransactionId();
+
+ try {
+
+ TrustStore trustStore = TrustStoreFactory.getInstance(pkiProfile.getTrustStoreProfile(), tid);
+ Set<iaik.x509.X509Certificate> certs = trustStore.getTrustedCertificates(tid);
+ return certs.toArray(new X509Certificate[certs.size()]);
+ } catch (TrustStoreException e) {
+ log.warn("Failed to get list of accepted issuers.", e);
+ return new X509Certificate[] {};
+ } catch (ClassCastException e) {
+ log.error("Failed to cast list of accepted issuers.", e);
+ return new X509Certificate[] {};
+ }
+ }
+
+ private static iaik.x509.X509Certificate[] convertCerts(
+ X509Certificate[] certs) throws CertificateException {
+ iaik.x509.X509Certificate[] retVal = new iaik.x509.X509Certificate[certs.length];
+ int i = 0;
+ for (X509Certificate cert : certs) {
+ if (cert instanceof iaik.x509.X509Certificate) {
+ retVal[i++] = (iaik.x509.X509Certificate) cert;
+ } else {
+ retVal[i++] = new iaik.x509.X509Certificate(cert.getEncoded());
+ }
+ }
+ return retVal;
+ }
+
+ private static class MDCTransactionId implements TransactionId {
+ @Override
+ public String getLogID() {
+ String sessionId = MDC.get("SessionId");
+ return (sessionId != null) ? sessionId : "PKITrustManager";
+ }
+ }
+}
|