1 files changed, 121 insertions, 3 deletions

diff --git a/id/ConfigWebTool/src/main/java/at/gv/egovernment/moa/id/configuration/validation/ValidationHelper.java b/id/ConfigWebTool/src/main/java/at/gv/egovernment/moa/id/configuration/validation/ValidationHelper.java
index aeac75e44..eadf15f84 100644
--- a/id/ConfigWebTool/src/main/java/at/gv/egovernment/moa/id/configuration/validation/ValidationHelper.java
+++ b/id/ConfigWebTool/src/main/java/at/gv/egovernment/moa/id/configuration/validation/ValidationHelper.java
@@ -1,18 +1,122 @@
 package at.gv.egovernment.moa.id.configuration.validation;
 
+import iaik.asn1.ObjectID;
+import iaik.utils.Util;
+import iaik.x509.X509Certificate;
+import iaik.x509.X509ExtensionInitException;
+
+import java.io.IOException;
 import java.net.MalformedURLException;
+import java.net.Socket;
 import java.net.URL;
+import java.net.UnknownHostException;
+import java.security.cert.Certificate;
+import java.security.cert.CertificateEncodingException;
+import java.security.cert.CertificateException;
 import java.text.ParseException;
 import java.text.SimpleDateFormat;
+import java.util.ArrayList;
+import java.util.List;
 import java.util.regex.Matcher;
 import java.util.regex.Pattern;
 
+import javax.net.ssl.HttpsURLConnection;
+import javax.net.ssl.SSLContext;
+import javax.net.ssl.SSLSession;
+import javax.net.ssl.SSLSocket;
+import javax.net.ssl.SSLSocketFactory;
+
 import org.apache.log4j.Logger;
 
+import at.gv.egovernment.moa.id.util.SSLUtils;
+import at.gv.egovernment.moa.util.Constants;
+
 public class ValidationHelper {
 
 	private static final Logger log = Logger.getLogger(ValidationHelper.class);
 	
+	public static boolean isPublicServiceAllowed(String identifier) {
+		
+		SSLSocket socket = null;
+		
+		try {
+			URL url = new URL(identifier);
+			String host = url.getHost();
+			
+			if (host.endsWith("/"))
+				host = host.substring(0, host.length()-1);
+			
+			if (url.getHost().endsWith(at.gv.egovernment.moa.id.configuration.Constants.PUBLICSERVICE_URL_POSTFIX)) {
+				log.debug("PublicURLPrefix with .gv.at Domain found.");
+				return true;
+				
+			} else {
+				SSLSocketFactory factory = HttpsURLConnection.getDefaultSSLSocketFactory();			
+				socket = (SSLSocket) factory.createSocket(url.getHost(), url.getPort());
+				socket.startHandshake();
+				
+				SSLSession session = socket.getSession();
+				Certificate[] servercerts = session.getPeerCertificates();
+				X509Certificate[] iaikChain = new X509Certificate[servercerts.length];
+				for (int i=0; i<servercerts.length; i++) {
+					iaikChain[i] = new X509Certificate(servercerts[i].getEncoded());
+				}
+				
+				
+				X509Certificate cert = Util.arrangeCertificateChain(iaikChain, false)[0];
+				
+				if (cert != null) {
+					ObjectID vwOID = new ObjectID("1.2.40.0.10.1.1.1"); // Verwaltungseigenschaft
+					ObjectID dOID = new ObjectID("1.2.40.0.10.1.1.2"); // Dienstleistereigenschaft
+					
+					
+					if ((cert.getExtension(vwOID) == null) && (cert.getExtension(dOID) == null)) {
+						return false;
+						
+					} else {
+						log.info("Found correct X509 Extension in server certificate. PublicService is allowed");
+						return true;
+					}		
+				}
+				
+				return false;
+			}
+				
+		} catch (MalformedURLException e) {
+			log.warn("PublicURLPrefix can not parsed to URL", e);
+			return false;
+			
+		} catch (UnknownHostException e) {
+			log.warn("Can not connect to PublicURLPrefix Server", e);
+			return false;
+			
+		} catch (IOException e) {
+			log.warn("Can not connect to PublicURLPrefix Server", e);
+			return false;
+			
+		} catch (CertificateEncodingException e) {
+			log.warn("Can not parse X509 server certificate", e);
+			return false;
+			
+		} catch (CertificateException e) {
+			log.warn("Can not read X509 server certificate", e);
+			return false;
+			
+		} catch (X509ExtensionInitException e) {
+			log.warn("Can not read X509 server certificate extension", e);
+			return false;
+		}
+		
+		finally {
+			if (socket != null)
+				try {
+					socket.close();
+				} catch (IOException e) {
+					log.warn("SSL Socket can not be closed.", e);
+				}
+		}
+	}
+	
 	public static boolean validateOAID(String oaIDObj) {
 		if (oaIDObj != null) {
 			try {
@@ -62,7 +166,7 @@ public class ValidationHelper {
 		return false;
 	}
 	
-	public static boolean isValidTarget(String target) {
+	public static boolean isValidAdminTarget(String target) {
 		   
 	   log.debug("Ueberpruefe Parameter Target");
 	            
@@ -76,10 +180,24 @@ public class ValidationHelper {
        else {
     	   log.error("Fehler Ueberpruefung Parameter Target. Target entspricht nicht den Kriterien (nur Zeichen a-z, A-Z und -, sowie 1-5 Zeichen lang)");
     	  return false;  
-       }
-	            
+       }           
 	}
 	
+	public static boolean isValidTarget(String target) {
+		   
+		   log.debug("Ueberpruefe Parameter Target");
+		            
+	       if (TargetValidator.isValidTarget(target)) {
+	    	   log.debug("Parameter Target erfolgreich ueberprueft");
+	    	  return true;
+	       }
+	       else {
+	    	   log.error("Fehler Ueberpruefung Parameter Target. Target entspricht nicht den Kriterien (nur Zeichen a-z, A-Z und -, sowie 1-5 Zeichen lang)");
+	    	  return false;  
+	       }
+		            
+		}
+	
 	public static boolean isValidSourceID(String sourceID) {
 		   
 	   log.debug("Ueberpruefe Parameter sourceID");