[31b67d5] | 1 | package net.deterlab.abac; |
---|
| 2 | |
---|
[7ef13e3] | 3 | import java.io.*; |
---|
[281158a] | 4 | import java.math.*; |
---|
[7ef13e3] | 5 | |
---|
| 6 | import java.util.*; |
---|
| 7 | import java.security.*; |
---|
| 8 | import java.security.cert.*; |
---|
| 9 | |
---|
[e36ea1d] | 10 | import javax.security.auth.x500.*; |
---|
[90f939f] | 11 | |
---|
| 12 | import org.bouncycastle.asn1.*; |
---|
[e9360e2] | 13 | import org.bouncycastle.asn1.x509.*; |
---|
[90f939f] | 14 | import org.bouncycastle.x509.*; |
---|
[e36ea1d] | 15 | import org.bouncycastle.x509.util.*; |
---|
| 16 | import org.bouncycastle.openssl.*; |
---|
| 17 | |
---|
| 18 | /** |
---|
| 19 | * An ABAC credential, with or without an underlying certificate that |
---|
[3797bbe] | 20 | * represents it. These are edges in proof graphs and can be constructed from |
---|
[e36ea1d] | 21 | * their constituent Roles. |
---|
| 22 | * @author <a href="http://abac.deterlab.net">ISI ABAC team</a> |
---|
[4560b65] | 23 | * @version 1.4 |
---|
[e36ea1d] | 24 | */ |
---|
[7b33c9b] | 25 | public abstract class Credential implements Comparable { |
---|
[e36ea1d] | 26 | /** The role at the head */ |
---|
| 27 | protected Role m_head |
---|
| 28 | /** The role at the tail */; |
---|
[d69593c] | 29 | protected Role m_tail; |
---|
[e36ea1d] | 30 | /** The identity that issued the certificate */ |
---|
[d69593c] | 31 | protected Identity id; |
---|
[7f614c1] | 32 | /** The expiration time of the credential */ |
---|
| 33 | protected Date m_expiration; |
---|
[0595372] | 34 | |
---|
[9394f1f] | 35 | /** |
---|
[e36ea1d] | 36 | * Create an empty Credential. |
---|
[9394f1f] | 37 | */ |
---|
[a7f73b5] | 38 | Credential() { |
---|
[9394f1f] | 39 | m_head = m_tail = null; |
---|
[0595372] | 40 | id = null; |
---|
[7f614c1] | 41 | m_expiration = null; |
---|
[9394f1f] | 42 | } |
---|
[31b67d5] | 43 | /** |
---|
[e36ea1d] | 44 | * Create a credential from a head and tail role. This credential has no |
---|
| 45 | * underlying certificate, and cannot be exported or used in real proofs. |
---|
| 46 | * make_cert can create a certificate for a credential initialized this |
---|
| 47 | * way. |
---|
| 48 | * @param head the Role at the head of the credential |
---|
| 49 | * @param tail the Role at the tail of the credential |
---|
[31b67d5] | 50 | */ |
---|
[a7f73b5] | 51 | Credential(Role head, Role tail) { |
---|
[31b67d5] | 52 | m_head = head; |
---|
| 53 | m_tail = tail; |
---|
[0595372] | 54 | id = null; |
---|
[7f614c1] | 55 | m_expiration = null; |
---|
[31b67d5] | 56 | } |
---|
| 57 | |
---|
[7ef13e3] | 58 | /** |
---|
[e36ea1d] | 59 | * Create a credential from an attribute cert in a file. Throws an |
---|
| 60 | * exception if the cert file can't be opened or if there's a format |
---|
| 61 | * problem with the cert. Note that catching |
---|
| 62 | * java.security.GeneralSecurityException catches most of the exceptions |
---|
| 63 | * this throws. |
---|
| 64 | * @param filename a String containing the filename to read |
---|
| 65 | * @param ids a Collection of Identities to use in validating the cert |
---|
[44896b5] | 66 | * @throws CertInvalidException if the stream is unparsable |
---|
| 67 | * @throws MissingIssuerException if none of the Identities can validate the |
---|
[e36ea1d] | 68 | * certificate |
---|
[44896b5] | 69 | * @throws BadSignatureException if the signature check fails |
---|
[7ef13e3] | 70 | */ |
---|
[4d5f56d] | 71 | Credential(String filename, Collection<Identity> ids) |
---|
[44896b5] | 72 | throws ABACException { this(); } |
---|
[7ef13e3] | 73 | |
---|
| 74 | /** |
---|
[e36ea1d] | 75 | * Create a credential from an attribute cert in a file. Throws an |
---|
| 76 | * exception if the cert file can't be opened or if there's a format |
---|
| 77 | * problem with the cert. Note that catching |
---|
| 78 | * java.security.GeneralSecurityException catches most of the exceptions |
---|
| 79 | * this throws. |
---|
| 80 | * @param file the File to read |
---|
| 81 | * @param ids a Collection of Identities to use in validating the cert |
---|
[44896b5] | 82 | * @throws CertInvalidException if the stream is unparsable |
---|
| 83 | * @throws MissingIssuerException if none of the Identities can validate the |
---|
[e36ea1d] | 84 | * certificate |
---|
[44896b5] | 85 | * @throws BadSignatureException if the signature check fails |
---|
[7ef13e3] | 86 | */ |
---|
[4d5f56d] | 87 | Credential(File file, Collection<Identity> ids) |
---|
[44896b5] | 88 | throws ABACException { |
---|
[7b33c9b] | 89 | this(); |
---|
[e36ea1d] | 90 | } |
---|
[1a7e6d3] | 91 | |
---|
| 92 | /** |
---|
[e36ea1d] | 93 | * Create a credential from an InputStream. Throws an exception if the |
---|
| 94 | * stream can't be parsed or if there's a format problem with the cert. |
---|
| 95 | * Note that catching java.security.GeneralSecurityException catches most |
---|
| 96 | * of the exceptions this throws. |
---|
| 97 | * @param s the InputStream to read |
---|
| 98 | * @param ids a Collection of Identities to use in validating the cert |
---|
[44896b5] | 99 | * @throws CertInvalidException if the stream is unparsable |
---|
| 100 | * @throws MissingIssuerException if none of the Identities can validate the |
---|
[e36ea1d] | 101 | * certificate |
---|
[44896b5] | 102 | * @throws BadSignatureException if the signature check fails |
---|
[1a7e6d3] | 103 | */ |
---|
[4d5f56d] | 104 | Credential(InputStream s, Collection<Identity> ids) |
---|
[44896b5] | 105 | throws ABACException { |
---|
[7b33c9b] | 106 | this(); |
---|
[7ef13e3] | 107 | } |
---|
| 108 | |
---|
[84f0e7a] | 109 | |
---|
[e9360e2] | 110 | /** |
---|
| 111 | * Create a certificate from this credential issued by the given identity. |
---|
[e36ea1d] | 112 | * Note that catching java.security.GeneralSecurityException catches most |
---|
| 113 | * of the exceptions this throws. |
---|
| 114 | * @param i the Identity that will issue the certificate |
---|
[44896b5] | 115 | * @throws ABACException for Credential-specific errors |
---|
| 116 | * @throws MissingIssuerException the identity is invalid |
---|
| 117 | * @throws BadSignatureException if the signature creation fails |
---|
[e9360e2] | 118 | */ |
---|
[7b33c9b] | 119 | public abstract void make_cert(Identity i) |
---|
[44896b5] | 120 | throws ABACException; |
---|
[90f939f] | 121 | |
---|
[cfcdcb4b] | 122 | /** |
---|
[a7f73b5] | 123 | * Return true if 2 credentials represent the same ABAC. Two credentials |
---|
| 124 | * are the same if their roles are the same. |
---|
[e36ea1d] | 125 | * @param o an Object to compare |
---|
| 126 | * @return true if the Credentials have the Roles |
---|
[cfcdcb4b] | 127 | */ |
---|
| 128 | public boolean equals(Object o) { |
---|
| 129 | if ( o instanceof Credential ) { |
---|
| 130 | Credential c = (Credential) o; |
---|
| 131 | |
---|
| 132 | if (m_head == null || m_tail == null ) return false; |
---|
| 133 | else return (m_head.equals(c.head()) && m_tail.equals(c.tail())); |
---|
| 134 | } |
---|
| 135 | else return false; |
---|
| 136 | } |
---|
| 137 | |
---|
[e36ea1d] | 138 | /** |
---|
[a7f73b5] | 139 | * Compare 2 credentials for sorting. They are ordered by their Roles, |
---|
| 140 | * head then tail. |
---|
[e36ea1d] | 141 | * @param o an Object to compare |
---|
| 142 | * @return -1 if this Credential is before, 0 if they are the same, and 1 |
---|
| 143 | * if this Credential is after the given object. |
---|
| 144 | */ |
---|
[88e139a] | 145 | public int compareTo(Object o) { |
---|
| 146 | if (o instanceof Credential) { |
---|
| 147 | Credential c = (Credential) o; |
---|
| 148 | |
---|
| 149 | if (head().equals(c.head())) return tail().compareTo(c.tail()); |
---|
| 150 | else return head().compareTo(c.head()); |
---|
| 151 | } |
---|
| 152 | else return 1; |
---|
| 153 | } |
---|
| 154 | |
---|
| 155 | |
---|
[31b67d5] | 156 | /** |
---|
| 157 | * Get the head role from the credential. |
---|
[e36ea1d] | 158 | * @return the Role in the head |
---|
[31b67d5] | 159 | */ |
---|
[0595372] | 160 | public Role head() { return m_head; } |
---|
[31b67d5] | 161 | |
---|
| 162 | /** |
---|
| 163 | * Get the tail role from the credential |
---|
[e36ea1d] | 164 | * @return the Role in the tail |
---|
[31b67d5] | 165 | */ |
---|
[0595372] | 166 | public Role tail() { return m_tail; } |
---|
[31b67d5] | 167 | |
---|
[7f614c1] | 168 | /** |
---|
| 169 | * Get the expiration Date of the credential. |
---|
| 170 | */ |
---|
| 171 | public Date expiration() { return m_expiration; } |
---|
| 172 | |
---|
[31b67d5] | 173 | /** |
---|
[a7f73b5] | 174 | * Return an untranslated string form of the credential. The format is head |
---|
| 175 | * <- tail. For example: A.r1 <- B.r2.r3. Principal names are key |
---|
| 176 | * identifiers. |
---|
[e36ea1d] | 177 | * @return the string form |
---|
[31b67d5] | 178 | */ |
---|
| 179 | public String toString() { |
---|
| 180 | return m_head + " <- " + m_tail; |
---|
| 181 | } |
---|
| 182 | |
---|
[e36ea1d] | 183 | /** |
---|
[a7f73b5] | 184 | * Return a translated string form of the credential. The format is head |
---|
| 185 | * <- tail. For example: A.r1 <- B.r2.r3. Principal names are |
---|
| 186 | * shortened to menmonics if the Context knows the identity. |
---|
[e36ea1d] | 187 | * @param c the Context to translate names in |
---|
| 188 | * @return the string form |
---|
| 189 | */ |
---|
[84f0e7a] | 190 | public String simpleString(Context c) { |
---|
| 191 | return m_head.simpleString(c) + " <- " + m_tail.simpleString(c); |
---|
[de63a31] | 192 | } |
---|
| 193 | |
---|
[e36ea1d] | 194 | /** |
---|
[a7f73b5] | 195 | * Output the external representation of the Credential to the OutputStream |
---|
| 196 | * given. Subclasses will overload this for their output format. |
---|
[e36ea1d] | 197 | * @param s the OutputStream on which to write |
---|
| 198 | * @throws IOException if there is an error writing. |
---|
| 199 | */ |
---|
[7b33c9b] | 200 | public abstract void write(OutputStream s) throws IOException; |
---|
[1a7e6d3] | 201 | |
---|
[e36ea1d] | 202 | /** |
---|
[a7f73b5] | 203 | * Output the external representation of the Credential to the filename |
---|
| 204 | * given. Subclasses will overload this for their output format. |
---|
[e36ea1d] | 205 | * @param fn a String containing the output filename |
---|
| 206 | * @throws IOException if there is an error writing. |
---|
| 207 | */ |
---|
[7b33c9b] | 208 | public abstract void write(String fn) |
---|
| 209 | throws IOException, FileNotFoundException; |
---|
[1a7e6d3] | 210 | |
---|
[e36ea1d] | 211 | /** |
---|
| 212 | * Return true if this Credential has a certificate associated. A jabac |
---|
| 213 | * extension. |
---|
| 214 | * @return true if this Credential has a certificate associated. |
---|
| 215 | */ |
---|
[7b33c9b] | 216 | public abstract boolean hasCertificate(); |
---|
[5cf72cc] | 217 | |
---|
[e36ea1d] | 218 | /** |
---|
[a7f73b5] | 219 | * Return the Identity that issued the underlying certificate (if any). A |
---|
| 220 | * jabac extension. |
---|
| 221 | * @return the Identity that issued the underlying certificate. |
---|
[e36ea1d] | 222 | */ |
---|
[d69593c] | 223 | public Identity issuer() { return id; } |
---|
[f84d71e] | 224 | |
---|
[31b67d5] | 225 | } |
---|