1 files changed, 236 insertions, 0 deletions
diff --git a/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/util/AxisSecureSocketFactory.java b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/util/AxisSecureSocketFactory.java
new file mode 100644
index 000000000..70c397c42
--- /dev/null
+++ b/id/server/idserverlib/src/main/java/at/gv/egovernment/moa/id/util/AxisSecureSocketFactory.java
@@ -0,0 +1,236 @@
+/*
+ * Copyright 2003 Federal Chancellery Austria
+ * MOA-ID has been developed in a cooperation between BRZ, the Federal
+ * Chancellery Austria - ICT staff unit, and Graz University of Technology.
+ *
+ * Licensed under the EUPL, Version 1.1 or - as soon they will be approved by
+ * the European Commission - subsequent versions of the EUPL (the "Licence");
+ * You may not use this work except in compliance with the Licence.
+ * You may obtain a copy of the Licence at:
+ * http://www.osor.eu/eupl/
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the Licence is distributed on an "AS IS" basis,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the Licence for the specific language governing permissions and
+ * limitations under the Licence.
+ *
+ * This product combines work with different licenses. See the "NOTICE" text
+ * file for details on the various modules and licenses.
+ * The "NOTICE" text file is part of the distribution. Any derivative works
+ * that you distribute must include a readable copy of the "NOTICE" text file.
+ */
+
+
+package at.gv.egovernment.moa.id.util;
+
+import java.io.BufferedWriter;
+import java.io.IOException;
+import java.io.InputStream;
+import java.io.OutputStream;
+import java.io.OutputStreamWriter;
+import java.io.PrintWriter;
+import java.net.Socket;
+import java.security.GeneralSecurityException;
+import java.util.Hashtable;
+
+import javax.net.ssl.SSLSocket;
+import javax.net.ssl.SSLSocketFactory;
+
+import org.apache.axis.components.net.BooleanHolder;
+import org.apache.axis.components.net.DefaultSocketFactory;
+import org.apache.axis.components.net.SecureSocketFactory;
+import org.apache.axis.components.net.TransportClientProperties;
+import org.apache.axis.components.net.TransportClientPropertiesFactory;
+import org.apache.axis.utils.Messages;
+import org.apache.axis.utils.XMLUtils;
+
+import at.gv.egovernment.moa.logging.Logger;
+
+/**
+ * Secure socket factory for Axis webs service clients of the MOA-ID component,
+ * which are the MOA-SP calls from MOA-ID Auth, 
+ * and the MOA-ID Auth calls from MOA-ID Proxy.
+ * <br/>Use this initialization code:<br/>
+ * <code>	// ConnectionParameter connParam = ... get from ConfigurationProvider
+ * 	AxisSecureSocketFactory.initialize(connParam);</code>
+ * <br/>See the Apache Axis documentation on how to configure this class
+ * as the default secure socket factory to be used by Axis.
+ * <br/>
+ * This code has been copied from <code>JSSESocketFactory</code>, the
+ * method <code>initialize()</code> has been added.
+ * 
+ * 
+ * @author Paul Ivancsics
+ * @version $Id$
+ */
+public class AxisSecureSocketFactory
+  extends DefaultSocketFactory implements SecureSocketFactory {
+
+  /** Field sslFactory           */
+  private static SSLSocketFactory sslFactory;
+
+  /**
+   * Constructor for AxisSecureSocketFactory.
+   * @param attributes ???
+   */
+  public AxisSecureSocketFactory(Hashtable attributes) {
+    super(attributes);
+  }
+  /**
+   * Initializes the factory by setting the connection parameters to be used for
+   * setting the secure socket factory, and by setting the system property 
+   * <code>axis.socketSecureFactory</code>.
+   * @param ssf <code>SSLSocketFactory</code> to initialize with
+   */
+  public static void initialize(SSLSocketFactory ssf)
+    throws IOException, GeneralSecurityException {
+
+    Logger.debug("Initialize AxisSecureSocketFactory");
+    sslFactory = ssf;
+  }
+
+  /**
+   * creates a secure socket
+   *
+   * @param host
+   * @param port
+   * @param otherHeaders
+   * @param useFullURL
+   *
+   * @return Socket
+   * @throws Exception
+   */
+  public Socket create(
+    String host,
+    int port,
+    StringBuffer otherHeaders,
+    BooleanHolder useFullURL)
+    throws Exception {
+    if (port == -1) {
+      port = 443;
+    }
+
+    TransportClientProperties tcp =
+      TransportClientPropertiesFactory.create("https");
+
+    boolean hostInNonProxyList =
+      isHostInNonProxyList(host, tcp.getNonProxyHosts());
+
+    Socket sslSocket = null;
+    if (tcp.getProxyHost().length() == 0 || hostInNonProxyList) {
+      // direct SSL connection
+      sslSocket = sslFactory.createSocket(host, port);
+    }
+    else {
+
+      // Default proxy port is 80, even for https
+      int tunnelPort =
+        (tcp.getProxyPort().length() != 0)
+          ? Integer.parseInt(tcp.getProxyPort())
+          : 80;
+      if (tunnelPort < 0)
+        tunnelPort = 80;
+
+      // Create the regular socket connection to the proxy
+      Socket tunnel = new Socket(tcp.getProxyHost(), tunnelPort);
+
+      // The tunnel handshake method (condensed and made reflexive)
+      OutputStream tunnelOutputStream = tunnel.getOutputStream();
+      PrintWriter out =
+        new PrintWriter(
+          new BufferedWriter(new OutputStreamWriter(tunnelOutputStream)));
+
+      // More secure version... engage later?
+      // PasswordAuthentication pa =
+      // Authenticator.requestPasswordAuthentication(
+      // InetAddress.getByName(tunnelHost),
+      // tunnelPort, "SOCK", "Proxy","HTTP");
+      // if(pa == null){
+      // printDebug("No Authenticator set.");
+      // }else{
+      // printDebug("Using Authenticator.");
+      // tunnelUser = pa.getUserName();
+      // tunnelPassword = new String(pa.getPassword());
+      // }
+      out.print(
+        "CONNECT "
+          + host
+          + ":"
+          + port
+          + " HTTP/1.0\r\n"
+          + "User-Agent: AxisClient");
+      if (tcp.getProxyUser().length() != 0
+        && tcp.getProxyPassword().length() != 0) {
+
+        // add basic authentication header for the proxy
+        String encodedPassword =
+          XMLUtils.base64encode(
+            (tcp.getProxyUser() + ":" + tcp.getProxyPassword()).getBytes());
+
+        out.print("\nProxy-Authorization: Basic " + encodedPassword);
+      }
+      out.print("\nContent-Length: 0");
+      out.print("\nPragma: no-cache");
+      out.print("\r\n\r\n");
+      out.flush();
+      InputStream tunnelInputStream = tunnel.getInputStream();
+
+      if (log.isDebugEnabled()) {
+        log.debug(
+          Messages.getMessage(
+            "isNull00",
+            "tunnelInputStream",
+            "" + (tunnelInputStream == null)));
+      }
+      String replyStr = "";
+
+      // Make sure to read all the response from the proxy to prevent SSL negotiation failure
+      // Response message terminated by two sequential newlines
+      int newlinesSeen = 0;
+      boolean headerDone = false; /* Done on first newline */
+
+      while (newlinesSeen < 2) {
+        int i = tunnelInputStream.read();
+
+        if (i < 0) {
+          throw new IOException("Unexpected EOF from proxy");
+        }
+        if (i == '\n') {
+          headerDone = true;
+          ++newlinesSeen;
+        }
+        else if (i != '\r') {
+          newlinesSeen = 0;
+          if (!headerDone) {
+            replyStr += String.valueOf((char) i);
+          }
+        }
+      }
+      if (!replyStr.startsWith("HTTP/1.0 200")
+        && !replyStr.startsWith("HTTP/1.1 200")) {
+        throw new IOException(
+          Messages.getMessage(
+            "cantTunnel00",
+            new String[] { tcp.getProxyHost(), "" + tunnelPort, replyStr }));
+      }
+
+      // End of condensed reflective tunnel handshake method
+      sslSocket = sslFactory.createSocket(tunnel, host, port, true);
+      if (log.isDebugEnabled()) {
+        log.debug(
+          Messages.getMessage(
+            "setupTunnel00",
+            tcp.getProxyHost(),
+            "" + tunnelPort));
+      }
+    }
+
+    ((SSLSocket) sslSocket).startHandshake();
+    if (log.isDebugEnabled()) {
+      log.debug(Messages.getMessage("createdSSL00"));
+    }
+    return sslSocket;
+  }
+
+}