aboutsummaryrefslogtreecommitdiff
path: root/spss.server/src/at
diff options
context:
space:
mode:
authorgregor <gregor@d688527b-c9ab-4aba-bd8d-4036d912da1d>2005-07-15 13:22:13 +0000
committergregor <gregor@d688527b-c9ab-4aba-bd8d-4036d912da1d>2005-07-15 13:22:13 +0000
commitc09f1913c1ac92c76b1baaba705d09c52eeec7db (patch)
treee19214ee5704ce37131e5890657ef34b2f74a557 /spss.server/src/at
parent01f3255645de31b4250c375f299bf8231efa2fa2 (diff)
downloadmoa-id-spss-c09f1913c1ac92c76b1baaba705d09c52eeec7db.tar.gz
moa-id-spss-c09f1913c1ac92c76b1baaba705d09c52eeec7db.tar.bz2
moa-id-spss-c09f1913c1ac92c76b1baaba705d09c52eeec7db.zip
Fix für Bug 267 erstellt. Noch absolut ungetestet.tags/Build-ID-1.2.0.D10-svn
git-svn-id: https://joinup.ec.europa.eu/svn/moa-idspss/trunk@381 d688527b-c9ab-4aba-bd8d-4036d912da1d
Diffstat (limited to 'spss.server/src/at')
-rw-r--r--spss.server/src/at/gv/egovernment/moa/spss/server/config/ConfigurationPartsBuilder.java74
-rw-r--r--spss.server/src/at/gv/egovernment/moa/spss/server/config/TrustProfile.java17
-rw-r--r--spss.server/src/at/gv/egovernment/moa/spss/server/invoke/VerifyXMLSignatureResponseBuilder.java13
-rw-r--r--spss.server/src/at/gv/egovernment/moa/spss/server/invoke/XMLSignatureVerificationInvoker.java116
4 files changed, 176 insertions, 44 deletions
diff --git a/spss.server/src/at/gv/egovernment/moa/spss/server/config/ConfigurationPartsBuilder.java b/spss.server/src/at/gv/egovernment/moa/spss/server/config/ConfigurationPartsBuilder.java
index 1e966911b..33e9daca1 100644
--- a/spss.server/src/at/gv/egovernment/moa/spss/server/config/ConfigurationPartsBuilder.java
+++ b/spss.server/src/at/gv/egovernment/moa/spss/server/config/ConfigurationPartsBuilder.java
@@ -827,32 +827,66 @@ public class ConfigurationPartsBuilder {
while ((profileElem = (Element) profileIter.nextNode()) != null) {
String id = profileElem.getAttribute("id");
String uriStr = profileElem.getAttribute("uri");
-
- try {
- URI uri = new URI(uriStr);
- TrustProfile profile;
- File profileDir;
-
+ String signerCertsUriStr = profileElem.getAttribute("signerCertsUri");
+
+ boolean createTrustProfile = true;
+
+ URI uri = null;
+ try
+ {
+ uri = new URI(uriStr);
if (!uri.isAbsolute()) { // make it absolute to the config file
uri = new URI(configRoot.toURL() + uriStr);
}
+ }
+ catch (URIException e) {
+ warn("config.14", new Object[] { "uri", id, uriStr }, e);
+ createTrustProfile = false;
+ }
+ catch (MalformedURLException e)
+ {
+ warn("config.15", new Object[] {id}, e);
+ createTrustProfile = false;
+ }
- profileDir = new File(uri.getPath());
- if (!profileDir.exists() || !profileDir.isDirectory()) {
- warn("config.27", new Object[] { id });
- }
+ File profileDir = new File(uri.getPath());
+ if (!profileDir.exists() || !profileDir.isDirectory()) {
+ warn("config.27", new Object[] { "uri", id });
+ createTrustProfile = false;
+ }
- if (trustProfiles.containsKey(id)) {
- warn("config.04", new Object[] { "TrustProfile", id });
- } else {
- profile = new TrustProfile(id, uri.toString());
- trustProfiles.put(id, profile);
+ if (trustProfiles.containsKey(id)) {
+ warn("config.04", new Object[] { "TrustProfile", id });
+ createTrustProfile = false;
+ }
+
+ URI signerCertsUri = null;
+ if (signerCertsUriStr != null && !"".equals(signerCertsUriStr))
+ {
+ try
+ {
+ signerCertsUri = new URI(signerCertsUriStr);
+ if (!signerCertsUri.isAbsolute()) uri = new URI(configRoot.toURL() + signerCertsUriStr);
+
+ File signerCertsDir = new File(signerCertsUri.getPath());
+ if (!signerCertsDir.exists() || !signerCertsDir.isDirectory()) {
+ warn("config.27", new Object[] { "signerCertsUri", id });
+ createTrustProfile = false;
+ }
}
-
- } catch (URIException e) {
- warn("config.14", new Object[] { id, uriStr }, e);
- } catch (MalformedURLException e) {
- warn("config.15", null, e);
+ catch (URIException e) {
+ warn("config.14", new Object[] { "signerCertsUri", id, uriStr }, e);
+ createTrustProfile = false;
+ }
+ catch (MalformedURLException e) {
+ warn("config.15", new Object[] {id}, e);
+ createTrustProfile = false;
+ }
+ }
+
+ if (createTrustProfile) {
+ TrustProfile profile = new TrustProfile(id, uri.toString(), signerCertsUri.toString());
+ trustProfiles.put(id, profile);
}
}
diff --git a/spss.server/src/at/gv/egovernment/moa/spss/server/config/TrustProfile.java b/spss.server/src/at/gv/egovernment/moa/spss/server/config/TrustProfile.java
index 6ba33be63..929d5ce2b 100644
--- a/spss.server/src/at/gv/egovernment/moa/spss/server/config/TrustProfile.java
+++ b/spss.server/src/at/gv/egovernment/moa/spss/server/config/TrustProfile.java
@@ -11,16 +11,21 @@ public class TrustProfile {
private String id;
/** The URI giving the location of the trust profile. */
private String uri;
+ /** The URI giving the location of the allowed signer certificates. */
+ private String signerCertsUri;
/**
* Create a <code>TrustProfile</code>.
*
* @param id The ID of the <code>TrustProfile</code> to create.
* @param uri The URI of the <code>TrustProfile</code> to create.
+ * @param signerCertsUri The URI of the location of the allowed signer
+ * certificates of the <code>TrustProfile</code> to create.
*/
- public TrustProfile(String id, String uri) {
+ public TrustProfile(String id, String uri, String signerCertsUri) {
this.id = id;
this.uri = uri;
+ this.signerCertsUri = signerCertsUri;
}
/**
@@ -40,4 +45,14 @@ public class TrustProfile {
public String getUri() {
return uri;
}
+
+ /**
+ * Return the URI giving the location of the allowed signer certificates
+ * of this <code>TrustProfile</code>.
+ *
+ * @return The URI of <code>TrustProfile</code>.
+ */
+ public String getSignerCertsUri() {
+ return signerCertsUri;
+ }
}
diff --git a/spss.server/src/at/gv/egovernment/moa/spss/server/invoke/VerifyXMLSignatureResponseBuilder.java b/spss.server/src/at/gv/egovernment/moa/spss/server/invoke/VerifyXMLSignatureResponseBuilder.java
index 543fa3b01..af5787795 100644
--- a/spss.server/src/at/gv/egovernment/moa/spss/server/invoke/VerifyXMLSignatureResponseBuilder.java
+++ b/spss.server/src/at/gv/egovernment/moa/spss/server/invoke/VerifyXMLSignatureResponseBuilder.java
@@ -94,12 +94,16 @@ public class VerifyXMLSignatureResponseBuilder {
*
* @param result The result to set for the response.
* @param profile The profile used for verifying the signature.
+ * @param transformsSignatureManifestCheck The overall result for the signature
+ * manifest check.
+ * @param certificateCheck The overall result for the certificate check.
* @throws MOAApplicationException An error occurred adding the result.
*/
public void setResult(
XMLSignatureVerificationResult result,
XMLSignatureVerificationProfile profile,
- ReferencesCheckResult transformsSignatureManifestCheck)
+ ReferencesCheckResult transformsSignatureManifestCheck,
+ CheckResult certificateCheck)
throws MOAApplicationException {
CertificateValidationResult certResult =
@@ -230,11 +234,8 @@ public class VerifyXMLSignatureResponseBuilder {
}
}
- // create the certificate check
- certificateCheck =
- factory.createCheckResult(
- certResult.getValidationResultCode().intValue(),
- null);
+ // create the certificate check
+ this.certificateCheck = certificateCheck;
}
/**
diff --git a/spss.server/src/at/gv/egovernment/moa/spss/server/invoke/XMLSignatureVerificationInvoker.java b/spss.server/src/at/gv/egovernment/moa/spss/server/invoke/XMLSignatureVerificationInvoker.java
index e192b66a2..e8b2a5e10 100644
--- a/spss.server/src/at/gv/egovernment/moa/spss/server/invoke/XMLSignatureVerificationInvoker.java
+++ b/spss.server/src/at/gv/egovernment/moa/spss/server/invoke/XMLSignatureVerificationInvoker.java
@@ -1,20 +1,9 @@
package at.gv.egovernment.moa.spss.server.invoke;
-import java.util.ArrayList;
-import java.util.Arrays;
-import java.util.Date;
-import java.util.HashMap;
-import java.util.HashSet;
-import java.util.Iterator;
-import java.util.List;
-import java.util.Map;
-import java.util.Set;
-
-import org.w3c.dom.Element;
-import org.w3c.dom.Node;
-
import iaik.IAIKException;
import iaik.IAIKRuntimeException;
+import iaik.ixsil.exceptions.URIException;
+import iaik.ixsil.util.URI;
import iaik.server.modules.xml.DataObject;
import iaik.server.modules.xml.XMLDataObject;
import iaik.server.modules.xml.XMLSignature;
@@ -26,18 +15,33 @@ import iaik.server.modules.xmlverify.XMLSignatureVerificationModule;
import iaik.server.modules.xmlverify.XMLSignatureVerificationModuleFactory;
import iaik.server.modules.xmlverify.XMLSignatureVerificationProfile;
import iaik.server.modules.xmlverify.XMLSignatureVerificationResult;
+import iaik.x509.X509Certificate;
+
+import java.io.File;
+import java.io.FileInputStream;
+import java.io.FileNotFoundException;
+import java.util.ArrayList;
+import java.util.Arrays;
+import java.util.Date;
+import java.util.HashMap;
+import java.util.HashSet;
+import java.util.Iterator;
+import java.util.List;
+import java.util.Map;
+import java.util.Set;
+
+import org.w3c.dom.Element;
+import org.w3c.dom.Node;
import at.gv.egovernment.moa.logging.LogMsg;
import at.gv.egovernment.moa.logging.Logger;
import at.gv.egovernment.moa.logging.LoggingContext;
import at.gv.egovernment.moa.logging.LoggingContextManager;
-import at.gv.egovernment.moa.util.CollectionUtils;
-import at.gv.egovernment.moa.util.Constants;
-
import at.gv.egovernment.moa.spss.MOAApplicationException;
import at.gv.egovernment.moa.spss.MOAException;
import at.gv.egovernment.moa.spss.MOASystemException;
import at.gv.egovernment.moa.spss.api.SPSSFactory;
+import at.gv.egovernment.moa.spss.api.common.CheckResult;
import at.gv.egovernment.moa.spss.api.common.XMLDataObjectAssociation;
import at.gv.egovernment.moa.spss.api.xmlverify.ReferenceInfo;
import at.gv.egovernment.moa.spss.api.xmlverify.ReferencesCheckResult;
@@ -50,12 +54,15 @@ import at.gv.egovernment.moa.spss.api.xmlverify.VerifyTransformsInfoProfileExpli
import at.gv.egovernment.moa.spss.api.xmlverify.VerifyXMLSignatureRequest;
import at.gv.egovernment.moa.spss.api.xmlverify.VerifyXMLSignatureResponse;
import at.gv.egovernment.moa.spss.server.config.ConfigurationProvider;
+import at.gv.egovernment.moa.spss.server.config.TrustProfile;
import at.gv.egovernment.moa.spss.server.iaik.xml.XMLSignatureImpl;
import at.gv.egovernment.moa.spss.server.logging.IaikLog;
import at.gv.egovernment.moa.spss.server.logging.TransactionId;
import at.gv.egovernment.moa.spss.server.transaction.TransactionContext;
import at.gv.egovernment.moa.spss.server.transaction.TransactionContextManager;
import at.gv.egovernment.moa.spss.util.MessageProvider;
+import at.gv.egovernment.moa.util.CollectionUtils;
+import at.gv.egovernment.moa.util.Constants;
/**
* A class providing a DOM based interface to the
@@ -208,13 +215,88 @@ public class XMLSignatureVerificationInvoker {
signatureManifestCheck =
validateSignatureManifest(request, result, profile);
+ // Check if signer certificate is in trust profile's allowed signer certificates pool
+ TrustProfile trustProfile = context.getConfiguration().getTrustProfile(request.getTrustProfileId());
+ CheckResult certificateCheck = validateSignerCertificate(result, trustProfile);
+
// build the response
- responseBuilder.setResult(result, profile, signatureManifestCheck);
+ responseBuilder.setResult(result, profile, signatureManifestCheck, certificateCheck);
return responseBuilder.getResponse();
}
/**
+ * Checks if the signer certificate matches one of the allowed signer certificates specified
+ * in the provided <code>trustProfile</code>.
+ *
+ * @param result The result produced by the <code>XMLSignatureVerificationModule</code>.
+ *
+ * @param trustProfile The trust profile the signer certificate is validated against.
+ *
+ * @return The overal result of the certificate validation for the signer certificate.
+ *
+ * @throws MOAException if one of the signer certificates specified in the <code>trustProfile</code>
+ * cannot be read from the file system.
+ */
+ private CheckResult validateSignerCertificate(XMLSignatureVerificationResult result, TrustProfile trustProfile)
+ throws MOAException
+ {
+ int resultCode = result.getCertificateValidationResult().getValidationResultCode().intValue();
+ if (resultCode == 0 && trustProfile.getSignerCertsUri() != null)
+ {
+ X509Certificate signerCertificate = (X509Certificate) result.getCertificateValidationResult().getCertificateChain().get(0);
+
+ File signerCertsDir = null;
+ try
+ {
+ signerCertsDir = new File(new URI(trustProfile.getSignerCertsUri()).getPath());
+ }
+ catch (URIException e)
+ {
+ throw new MOASystemException("2900", null, e); // Should not happen, already checked at loading the MOA configuration
+ }
+
+ File[] files = signerCertsDir.listFiles();
+ if (files == null) resultCode = 1;
+ int i;
+ for (i = 0; i < files.length; i++)
+ {
+ if (!files[i].isDirectory())
+ {
+ FileInputStream currentFIS = null;
+ try
+ {
+ currentFIS = new FileInputStream(files[i]);
+ }
+ catch (FileNotFoundException e) {
+ throw new MOASystemException("2900", null, e);
+ }
+
+ try
+ {
+ X509Certificate currentCert = new X509Certificate(currentFIS);
+ if (currentCert.equals(signerCertificate)) break;
+ }
+ catch (Exception e)
+ {
+ // Simply ignore file if it cannot be interpreted as certificate
+ Logger.warn("Signatorzertifiat aus Trustprofile mit id=" +
+ trustProfile.getId() + " kann nicht geparst werden: " +
+ e.getMessage());
+ }
+ }
+ }
+ if (i >= files.length)
+ {
+ resultCode = 1; // No signer certificate from the trustprofile pool matches the actual signer certificate
+ }
+ }
+
+ SPSSFactory factory = SPSSFactory.getInstance();
+ return factory.createCheckResult(resultCode, null);
+ }
+
+ /**
* Select the <code>dsig:Signature</code> DOM element within the signature
* environment.
*