[3797bbe] | 1 | package net.deterlab.abac; |
---|
| 2 | |
---|
| 3 | import java.io.*; |
---|
| 4 | import java.math.*; |
---|
| 5 | import java.text.*; |
---|
| 6 | |
---|
| 7 | import java.util.*; |
---|
| 8 | import java.security.*; |
---|
| 9 | import java.security.cert.*; |
---|
| 10 | |
---|
| 11 | import javax.security.auth.x500.*; |
---|
| 12 | |
---|
| 13 | import javax.xml.parsers.*; |
---|
| 14 | import javax.xml.transform.*; |
---|
| 15 | import javax.xml.transform.dom.*; |
---|
| 16 | import javax.xml.transform.stream.*; |
---|
| 17 | |
---|
| 18 | import javax.xml.crypto.*; |
---|
| 19 | import javax.xml.crypto.dsig.*; |
---|
| 20 | import javax.xml.crypto.dsig.dom.*; |
---|
| 21 | import javax.xml.crypto.dsig.keyinfo.*; |
---|
| 22 | import javax.xml.crypto.dsig.spec.*; |
---|
| 23 | |
---|
| 24 | import org.xml.sax.*; |
---|
| 25 | import org.w3c.dom.*; |
---|
| 26 | |
---|
| 27 | import org.bouncycastle.asn1.*; |
---|
| 28 | import org.bouncycastle.asn1.x509.*; |
---|
| 29 | import org.bouncycastle.x509.*; |
---|
| 30 | import org.bouncycastle.x509.util.*; |
---|
| 31 | import org.bouncycastle.openssl.*; |
---|
| 32 | |
---|
| 33 | /** |
---|
| 34 | * An ABAC credential, with or without an underlying certificate that |
---|
| 35 | * represents it. These are edges in proof garphs and can be constructed from |
---|
| 36 | * their constituent Roles. |
---|
| 37 | * @author <a href="http://abac.deterlab.net">ISI ABAC team</a> |
---|
| 38 | * @version 1.3 |
---|
| 39 | */ |
---|
| 40 | public class GENICredential extends Credential implements Comparable { |
---|
| 41 | /** The signed XML representing this credential */ |
---|
| 42 | protected Document doc; |
---|
[797bebe] | 43 | |
---|
| 44 | /** |
---|
[61f21c5] | 45 | * X509KeySelector implementation from |
---|
| 46 | * http://www.outsourcingi.com/art-271-Programming-With-the-Java-XML-Digital-Signature-API.html |
---|
| 47 | * . |
---|
| 48 | * |
---|
| 49 | * Straight ahead extraction of a key from an X509 cert, but it is their |
---|
| 50 | * code and hard to improve on. |
---|
[797bebe] | 51 | */ |
---|
| 52 | protected class X509KeySelector extends KeySelector { |
---|
| 53 | public KeySelectorResult select(KeyInfo keyInfo, |
---|
| 54 | KeySelector.Purpose purpose, |
---|
| 55 | AlgorithmMethod method, |
---|
| 56 | XMLCryptoContext context) |
---|
| 57 | throws KeySelectorException { |
---|
| 58 | Iterator ki = keyInfo.getContent().iterator(); |
---|
| 59 | while (ki.hasNext()) { |
---|
| 60 | XMLStructure info = (XMLStructure) ki.next(); |
---|
| 61 | if (!(info instanceof X509Data)) |
---|
| 62 | continue; |
---|
| 63 | X509Data x509Data = (X509Data) info; |
---|
| 64 | Iterator xi = x509Data.getContent().iterator(); |
---|
| 65 | while (xi.hasNext()) { |
---|
| 66 | Object o = xi.next(); |
---|
| 67 | if (!(o instanceof X509Certificate)) |
---|
| 68 | continue; |
---|
| 69 | final PublicKey key = ((X509Certificate)o).getPublicKey(); |
---|
| 70 | // Make sure the algorithm is compatible |
---|
| 71 | // with the method. |
---|
| 72 | if (algEquals(method.getAlgorithm(), key.getAlgorithm())) { |
---|
| 73 | return new KeySelectorResult() { |
---|
| 74 | public Key getKey() { return key; } |
---|
| 75 | }; |
---|
| 76 | } |
---|
| 77 | } |
---|
| 78 | } |
---|
| 79 | throw new KeySelectorException("No key found!"); |
---|
| 80 | } |
---|
| 81 | |
---|
| 82 | boolean algEquals(String algURI, String algName) { |
---|
| 83 | if ((algName.equalsIgnoreCase("DSA") && |
---|
| 84 | algURI.equalsIgnoreCase(SignatureMethod.DSA_SHA1)) || |
---|
| 85 | (algName.equalsIgnoreCase("RSA") && |
---|
| 86 | |
---|
| 87 | algURI.equalsIgnoreCase(SignatureMethod.RSA_SHA1))) { |
---|
| 88 | return true; |
---|
| 89 | } else { |
---|
| 90 | return false; |
---|
| 91 | } |
---|
| 92 | } |
---|
| 93 | } |
---|
| 94 | |
---|
[3797bbe] | 95 | /** |
---|
| 96 | * Create an empty Credential. |
---|
| 97 | */ |
---|
| 98 | public GENICredential() { |
---|
| 99 | m_head = m_tail = null; |
---|
| 100 | doc = null; |
---|
| 101 | id = null; |
---|
| 102 | } |
---|
| 103 | /** |
---|
| 104 | * Create a credential from a head and tail role. This credential has no |
---|
| 105 | * underlying certificate, and cannot be exported or used in real proofs. |
---|
| 106 | * make_cert can create a certificate for a credential initialized this |
---|
| 107 | * way. |
---|
| 108 | * @param head the Role at the head of the credential |
---|
| 109 | * @param tail the Role at the tail of the credential |
---|
| 110 | */ |
---|
| 111 | public GENICredential(Role head, Role tail) { |
---|
| 112 | m_head = head; |
---|
| 113 | m_tail = tail; |
---|
| 114 | doc = null; |
---|
| 115 | id = null; |
---|
| 116 | } |
---|
| 117 | |
---|
| 118 | /** |
---|
| 119 | * Do the credential extraction from an input stream. This parses the |
---|
| 120 | * certificate from the input stream and saves it. The contents must be |
---|
| 121 | * validated and parsed later. |
---|
| 122 | * @param stream the InputStream to read the certificate from. |
---|
| 123 | * @throws IOException if the stream is unparsable |
---|
| 124 | */ |
---|
| 125 | protected void read_certificate(InputStream stream) |
---|
| 126 | throws IOException { |
---|
| 127 | DocumentBuilderFactory dbf = DocumentBuilderFactory.newInstance(); |
---|
| 128 | DocumentBuilder db = null; |
---|
| 129 | |
---|
| 130 | if ( dbf == null ) |
---|
| 131 | throw new IOException("Cannot get DocumentBuilderFactory!?"); |
---|
| 132 | try { |
---|
[61f21c5] | 133 | /* Note this setting is required to find the properly |
---|
| 134 | * namespace-scoped signature block in the credential. |
---|
| 135 | */ |
---|
[797bebe] | 136 | dbf.setNamespaceAware(true); |
---|
[3797bbe] | 137 | if ( (db = dbf.newDocumentBuilder()) == null ) |
---|
| 138 | throw new IOException("Cannot get DocumentBuilder!?"); |
---|
| 139 | doc = db.parse(stream); |
---|
[797bebe] | 140 | doc.normalizeDocument(); |
---|
[3797bbe] | 141 | } |
---|
| 142 | catch (IllegalArgumentException ie) { |
---|
[3612811] | 143 | ie.printStackTrace(); |
---|
[44896b5] | 144 | throw new IOException("null stream", ie); |
---|
[3797bbe] | 145 | } |
---|
| 146 | catch (SAXException se) { |
---|
[3612811] | 147 | se.printStackTrace(); |
---|
[44896b5] | 148 | throw new IOException(se.getMessage(), se); |
---|
[3797bbe] | 149 | } |
---|
| 150 | catch (Exception e) { |
---|
[3612811] | 151 | e.printStackTrace(); |
---|
[44896b5] | 152 | throw new IOException(e.getMessage(), e); |
---|
[3797bbe] | 153 | } |
---|
| 154 | |
---|
| 155 | } |
---|
| 156 | |
---|
[797bebe] | 157 | /** |
---|
| 158 | * Walk the document and set all instances of an xml:id attribute to be ID |
---|
| 159 | * attributes in terms of the java libraries. This is needed for the |
---|
| 160 | * signature code to find signed subsections. The "xml:id" is treated as |
---|
| 161 | * both a namespace free ID with a colon and as an "id" identifier in the |
---|
| 162 | * "xml" namespace so we don't miss it. |
---|
| 163 | * @param n the root of the document to mark |
---|
| 164 | */ |
---|
| 165 | static protected void setIDAttrs(Node n) { |
---|
| 166 | if ( n.getNodeType() == Node.ELEMENT_NODE) { |
---|
| 167 | Element e = (Element) n; |
---|
| 168 | String id = e.getAttribute("xml:id"); |
---|
| 169 | |
---|
| 170 | if ( id != null && id.length() > 0 ) |
---|
| 171 | e.setIdAttribute("xml:id", true); |
---|
| 172 | |
---|
| 173 | id = e.getAttributeNS("xml", "id"); |
---|
| 174 | if ( id != null && id.length() > 0 ) |
---|
| 175 | e.setIdAttributeNS("xml", "id", true); |
---|
| 176 | } |
---|
| 177 | |
---|
| 178 | for (Node nn = n.getFirstChild(); nn != null; nn = nn.getNextSibling()) |
---|
| 179 | setIDAttrs(nn); |
---|
| 180 | } |
---|
| 181 | |
---|
| 182 | /** |
---|
| 183 | * Return the child of Node n that has the given name, if there is one. |
---|
| 184 | * @param n a Node to search |
---|
| 185 | * @param name the name to search for |
---|
| 186 | * @return a Node with the name, may be null |
---|
| 187 | */ |
---|
| 188 | static protected Node getChildByName(Node n, String name) { |
---|
| 189 | if (name == null ) return null; |
---|
| 190 | |
---|
| 191 | for (Node nn = n.getFirstChild(); nn != null; nn = nn.getNextSibling()) |
---|
| 192 | if ( nn.getNodeType() == Node.ELEMENT_NODE && |
---|
| 193 | name.equals(nn.getNodeName())) return nn; |
---|
| 194 | return null; |
---|
| 195 | } |
---|
| 196 | |
---|
| 197 | /** |
---|
| 198 | * Find the X509Certificate in the Signature element and convert it to an |
---|
| 199 | * ABAC identity. This assumes a KeyInfo in that section holding an |
---|
| 200 | * X509Data section containing the certificate in an X509Certificate |
---|
| 201 | * section. Any of that not being found will cause a failure. If the |
---|
| 202 | * Identity cannot be created a Gignature exception is thrown. |
---|
| 203 | * @param n a Node pointing to a Signature section |
---|
| 204 | * @return an Identity constructed frm the X509 Certificate |
---|
[44896b5] | 205 | * @throws MissingIssuerException if the Identity cannot be created from the |
---|
[797bebe] | 206 | * certificate. |
---|
| 207 | */ |
---|
[44896b5] | 208 | static protected Identity getIdentity(Node n) |
---|
| 209 | throws MissingIssuerException { |
---|
[797bebe] | 210 | Identity rv = null; |
---|
| 211 | Node nn = getChildByName(n, "KeyInfo"); |
---|
| 212 | String certStr = null; |
---|
| 213 | |
---|
| 214 | if ( nn == null ) return null; |
---|
| 215 | if ( ( nn = getChildByName(nn, "X509Data")) == null ) return null; |
---|
| 216 | if ( ( nn = getChildByName(nn, "X509Certificate")) == null ) return null; |
---|
| 217 | if ( ( certStr = nn.getTextContent()) == null ) return null; |
---|
| 218 | try { |
---|
| 219 | certStr = "-----BEGIN CERTIFICATE-----\n" + |
---|
| 220 | certStr + |
---|
| 221 | "\n-----END CERTIFICATE-----"; |
---|
| 222 | return new Identity(new StringReader(certStr)); |
---|
| 223 | } |
---|
| 224 | catch (Exception e) { |
---|
[44896b5] | 225 | throw new MissingIssuerException(e.getMessage(), e); |
---|
[797bebe] | 226 | } |
---|
| 227 | } |
---|
| 228 | |
---|
[3797bbe] | 229 | /** |
---|
| 230 | * Initialize a credential from parsed certificate. Validiate it against |
---|
| 231 | * the given identities and parse out the roles. Note that catching |
---|
| 232 | * java.security.GeneralSecurityException catches most of the exceptions |
---|
| 233 | * this throws. |
---|
| 234 | * @param ids a Collection of Identities to use in validating the cert |
---|
[44896b5] | 235 | * @throws CertInvalidException if the stream is unparsable |
---|
| 236 | * @throws MissingIssuerException if none of the Identities can validate the |
---|
[3797bbe] | 237 | * certificate |
---|
[44896b5] | 238 | * @throws BadSignatureException if the signature check fails |
---|
[3797bbe] | 239 | */ |
---|
| 240 | protected void init(Collection<Identity> ids) |
---|
[44896b5] | 241 | throws ABACException { |
---|
[3797bbe] | 242 | |
---|
| 243 | XMLSignatureFactory fac = XMLSignatureFactory.getInstance("DOM"); |
---|
| 244 | NodeList nl = doc.getElementsByTagNameNS(XMLSignature.XMLNS, |
---|
[797bebe] | 245 | "Signature"); |
---|
[3797bbe] | 246 | DOMValidateContext valContext = null; |
---|
| 247 | XMLSignature signature = null; |
---|
| 248 | |
---|
| 249 | try { |
---|
| 250 | |
---|
| 251 | if (nl.getLength() == 0) |
---|
[44896b5] | 252 | throw new CertInvalidException("Cannot find Signature element"); |
---|
[3797bbe] | 253 | |
---|
[797bebe] | 254 | setIDAttrs(doc); |
---|
| 255 | valContext = new DOMValidateContext(new X509KeySelector(), |
---|
| 256 | nl.item(0)); |
---|
[3797bbe] | 257 | if ( valContext == null ) |
---|
[44896b5] | 258 | throw new ABACException("No validation context!?"); |
---|
[3797bbe] | 259 | |
---|
| 260 | signature = fac.unmarshalXMLSignature(valContext); |
---|
| 261 | if (signature == null) |
---|
[44896b5] | 262 | throw new BadSignatureException("Cannot unmarshal signature"); |
---|
[3797bbe] | 263 | |
---|
| 264 | if (!signature.validate(valContext)) |
---|
[44896b5] | 265 | throw new BadSignatureException("bad signature"); |
---|
[3797bbe] | 266 | |
---|
| 267 | load_roles(); |
---|
| 268 | |
---|
[797bebe] | 269 | id = getIdentity(nl.item(0)); |
---|
| 270 | |
---|
| 271 | if ( !ids.contains(id) ) ids.add(id); |
---|
| 272 | |
---|
[3797bbe] | 273 | if (!id.getKeyID().equals(m_head.principal())) |
---|
[44896b5] | 274 | throw new MissingIssuerException("Issuer ID and left hand " + |
---|
| 275 | "side principal disagree"); |
---|
| 276 | } |
---|
| 277 | catch (ABACException ae) { |
---|
| 278 | throw ae; |
---|
[3797bbe] | 279 | } |
---|
| 280 | catch (Exception e) { |
---|
[44896b5] | 281 | throw new BadSignatureException(e.getMessage(), e); |
---|
[3797bbe] | 282 | } |
---|
| 283 | } |
---|
| 284 | |
---|
| 285 | /** |
---|
| 286 | * Parse a credential from an InputStream and initialize the role from it. |
---|
| 287 | * Combine read_credential(stream) and init(ids). Note that catching |
---|
| 288 | * java.security.GeneralSecurityException catches most of the exceptions |
---|
| 289 | * this throws. |
---|
| 290 | * @param stream the InputStream to read the certificate from. |
---|
| 291 | * @param ids a Collection of Identities to use in validating the cert |
---|
[44896b5] | 292 | * @throws CertInvalidException if the stream is unparsable |
---|
| 293 | * @throws MissingIssuerException if none of the Identities can validate the |
---|
[3797bbe] | 294 | * certificate |
---|
[44896b5] | 295 | * @throws BadSignatureException if the signature check fails |
---|
[3797bbe] | 296 | */ |
---|
| 297 | protected void init(InputStream stream, Collection<Identity> ids) |
---|
[44896b5] | 298 | throws ABACException { |
---|
| 299 | try { |
---|
| 300 | read_certificate(stream); |
---|
| 301 | } |
---|
| 302 | catch (IOException e) { |
---|
| 303 | throw new CertInvalidException("Cannot parse cert", e); |
---|
| 304 | } |
---|
| 305 | if (doc == null) throw new CertInvalidException("Unknown Format"); |
---|
[3797bbe] | 306 | init(ids); |
---|
| 307 | } |
---|
| 308 | |
---|
| 309 | /** |
---|
| 310 | * Create a credential from an attribute cert in a file. Throws an |
---|
| 311 | * exception if the cert file can't be opened or if there's a format |
---|
| 312 | * problem with the cert. Note that catching |
---|
| 313 | * java.security.GeneralSecurityException catches most of the exceptions |
---|
| 314 | * this throws. |
---|
| 315 | * @param filename a String containing the filename to read |
---|
| 316 | * @param ids a Collection of Identities to use in validating the cert |
---|
[44896b5] | 317 | * @throws CertInvalidException if the stream is unparsable |
---|
| 318 | * @throws MissingIssuerException if none of the Identities can validate the |
---|
[3797bbe] | 319 | * certificate |
---|
[44896b5] | 320 | * @throws BadSignatureException if the signature check fails |
---|
[3797bbe] | 321 | */ |
---|
| 322 | public GENICredential(String filename, Collection<Identity> ids) |
---|
[44896b5] | 323 | throws ABACException { |
---|
| 324 | try { |
---|
| 325 | init(new FileInputStream(filename), ids); |
---|
| 326 | } |
---|
| 327 | catch (FileNotFoundException e) { |
---|
| 328 | throw new CertInvalidException("Bad filename", e); |
---|
| 329 | } |
---|
| 330 | } |
---|
[3797bbe] | 331 | |
---|
| 332 | /** |
---|
| 333 | * Create a credential from an attribute cert in a file. Throws an |
---|
| 334 | * exception if the cert file can't be opened or if there's a format |
---|
| 335 | * problem with the cert. Note that catching |
---|
| 336 | * java.security.GeneralSecurityException catches most of the exceptions |
---|
| 337 | * this throws. |
---|
| 338 | * @param file the File to read |
---|
| 339 | * @param ids a Collection of Identities to use in validating the cert |
---|
[44896b5] | 340 | * @throws CertInvalidException if the stream is unparsable |
---|
| 341 | * @throws MissingIssuerException if none of the Identities can validate the |
---|
[3797bbe] | 342 | * certificate |
---|
[44896b5] | 343 | * @throws BadSignatureException if the signature check fails |
---|
[3797bbe] | 344 | */ |
---|
| 345 | public GENICredential(File file, Collection<Identity> ids) |
---|
[44896b5] | 346 | throws ABACException { |
---|
| 347 | try { |
---|
| 348 | init(new FileInputStream(file), ids); |
---|
| 349 | } |
---|
| 350 | catch (FileNotFoundException e) { |
---|
| 351 | throw new CertInvalidException("Bad filename", e); |
---|
| 352 | } |
---|
[3797bbe] | 353 | } |
---|
| 354 | |
---|
| 355 | /** |
---|
| 356 | * Create a credential from an InputStream. Throws an exception if the |
---|
| 357 | * stream can't be parsed or if there's a format problem with the cert. |
---|
| 358 | * Note that catching java.security.GeneralSecurityException catches most |
---|
| 359 | * of the exceptions this throws. |
---|
| 360 | * @param s the InputStream to read |
---|
| 361 | * @param ids a Collection of Identities to use in validating the cert |
---|
[44896b5] | 362 | * @throws CertInvalidException if the stream is unparsable |
---|
| 363 | * @throws MissingIssuerException if none of the Identities can validate the |
---|
[3797bbe] | 364 | * certificate |
---|
[44896b5] | 365 | * @throws BadSignatureException if the signature check fails |
---|
[3797bbe] | 366 | */ |
---|
| 367 | public GENICredential(InputStream s, Collection<Identity> ids) |
---|
[44896b5] | 368 | throws ABACException { init(s, ids); } |
---|
[3797bbe] | 369 | |
---|
[61f21c5] | 370 | /** |
---|
| 371 | * Encode the abac credential's XML. This is straight line code that |
---|
| 372 | * directly builds the credential. |
---|
| 373 | * @return a Node, the place to attach signatures |
---|
[44896b5] | 374 | * @throws ABACException if any of the XML construction fails |
---|
[61f21c5] | 375 | */ |
---|
[44896b5] | 376 | protected Node make_rt0_content() throws ABACException { |
---|
[61f21c5] | 377 | DocumentBuilderFactory dbf = DocumentBuilderFactory.newInstance(); |
---|
| 378 | DocumentBuilder db = null; |
---|
| 379 | SimpleDateFormat df = new SimpleDateFormat("yyy-MM-dd'T'HH:mm:ss'Z'"); |
---|
| 380 | StringBuffer expBuf = new StringBuffer(); |
---|
| 381 | |
---|
| 382 | /* This is a weirdness to cope with the GENI format. They have a naked |
---|
| 383 | * xml:id specifier without any namespace declarations in the |
---|
| 384 | * credential. Notice that this is the opposite of the setting used in |
---|
| 385 | * init to read a credential. */ |
---|
| 386 | dbf.setNamespaceAware(false); |
---|
| 387 | |
---|
| 388 | if ( dbf == null ) |
---|
[44896b5] | 389 | throw new ABACException("Cannot get DocumentBuilderFactory!?"); |
---|
[61f21c5] | 390 | |
---|
| 391 | try { |
---|
| 392 | db = dbf.newDocumentBuilder(); |
---|
| 393 | } |
---|
| 394 | catch (ParserConfigurationException pe) { |
---|
[44896b5] | 395 | throw new ABACException("Cannot get DocumentBuilder!?" + |
---|
| 396 | pe.getMessage(), pe); |
---|
[61f21c5] | 397 | } |
---|
| 398 | |
---|
| 399 | doc = db.newDocument(); |
---|
| 400 | if ( doc == null ) |
---|
[44896b5] | 401 | throw new ABACException("No Document"); |
---|
[61f21c5] | 402 | |
---|
| 403 | Element root = doc.createElement("signed-credential"); |
---|
| 404 | Element cred = doc.createElement("credential"); |
---|
| 405 | Element sig = doc.createElement("signatures"); |
---|
| 406 | Element e = doc.createElement("type"); |
---|
| 407 | Node text = doc.createTextNode("abac"); |
---|
| 408 | |
---|
| 409 | doc.appendChild(root); |
---|
| 410 | |
---|
| 411 | cred.setAttribute("xml:id", "ref0"); |
---|
| 412 | /* So that the signing code can find the section to sign */ |
---|
| 413 | cred.setIdAttribute("xml:id", true); |
---|
| 414 | |
---|
| 415 | root.appendChild(cred); |
---|
| 416 | e.appendChild(text); |
---|
| 417 | cred.appendChild(e); |
---|
| 418 | |
---|
| 419 | /* XXX: pass in valid time */ |
---|
| 420 | df.format(new Date(System.currentTimeMillis() |
---|
| 421 | + (3600L * 1000L * 24L * 365L)), expBuf, |
---|
| 422 | new FieldPosition(0)); |
---|
| 423 | e = doc.createElement("expires"); |
---|
| 424 | text = doc.createTextNode(expBuf.toString()); |
---|
| 425 | e.appendChild(text); |
---|
| 426 | cred.appendChild(e); |
---|
| 427 | |
---|
| 428 | e = doc.createElement("version"); |
---|
| 429 | text = doc.createTextNode("1.0"); |
---|
| 430 | e.appendChild(text); |
---|
| 431 | cred.appendChild(e); |
---|
| 432 | |
---|
| 433 | e = doc.createElement("rt0"); |
---|
| 434 | text = doc.createTextNode(m_head + "<-" + m_tail); |
---|
| 435 | e.appendChild(text); |
---|
| 436 | cred.appendChild(e); |
---|
| 437 | |
---|
| 438 | root.appendChild(sig); |
---|
| 439 | return sig; |
---|
| 440 | } |
---|
| 441 | |
---|
[3797bbe] | 442 | /** |
---|
| 443 | * Create a certificate from this credential issued by the given identity. |
---|
[44896b5] | 444 | * This is the signed XML ABAC credential. |
---|
[3797bbe] | 445 | * @param i the Identity that will issue the certificate |
---|
[44896b5] | 446 | * @throws ABACException if xml creation fails |
---|
| 447 | * @throws MissingIssuerException if the issuer is bad |
---|
| 448 | * @throws BadSignatureException if the signature creation fails |
---|
[3797bbe] | 449 | */ |
---|
| 450 | public void make_cert(Identity i) |
---|
[44896b5] | 451 | throws ABACException { |
---|
[61f21c5] | 452 | X509Certificate cert = i.getCertificate(); |
---|
| 453 | KeyPair kp = i.getKeyPair(); |
---|
| 454 | PublicKey pubKey = null; |
---|
| 455 | PrivateKey privKey = null; |
---|
| 456 | if ( cert == null ) |
---|
[44896b5] | 457 | throw new MissingIssuerException("No credential in identity?"); |
---|
[61f21c5] | 458 | if ( kp == null ) |
---|
[44896b5] | 459 | throw new MissingIssuerException("No keypair in identity?"); |
---|
[61f21c5] | 460 | |
---|
| 461 | pubKey = kp.getPublic(); |
---|
| 462 | if ((privKey = kp.getPrivate()) == null ) |
---|
[44896b5] | 463 | throw new MissingIssuerException("No private ket in identity"); |
---|
[61f21c5] | 464 | |
---|
| 465 | XMLSignatureFactory fac = XMLSignatureFactory.getInstance("DOM"); |
---|
| 466 | Reference ref = null; |
---|
| 467 | SignedInfo si = null; |
---|
| 468 | KeyInfoFactory kif = fac.getKeyInfoFactory(); |
---|
| 469 | List x509Content = new ArrayList(); |
---|
| 470 | List keyInfo = new ArrayList(); |
---|
| 471 | x509Content.add(cert.getSubjectX500Principal().getName()); |
---|
| 472 | x509Content.add(cert); |
---|
| 473 | X509Data xd = kif.newX509Data(x509Content); |
---|
| 474 | KeyValue kv = null; |
---|
| 475 | |
---|
[3797bbe] | 476 | try { |
---|
[61f21c5] | 477 | kv = kif.newKeyValue(pubKey); |
---|
| 478 | } |
---|
| 479 | catch (KeyException ke) { |
---|
[44896b5] | 480 | throw new ABACException("Unsupported key format " + |
---|
| 481 | ke.getMessage(), ke); |
---|
[61f21c5] | 482 | } |
---|
| 483 | |
---|
| 484 | Collections.addAll(keyInfo, kv, xd); |
---|
| 485 | |
---|
| 486 | KeyInfo ki = kif.newKeyInfo(keyInfo); |
---|
| 487 | Node sig = make_rt0_content(); |
---|
| 488 | |
---|
| 489 | try { |
---|
| 490 | ref = fac.newReference("#ref0", |
---|
[3797bbe] | 491 | fac.newDigestMethod(DigestMethod.SHA1, null), |
---|
| 492 | Collections.singletonList( |
---|
| 493 | fac.newTransform(Transform.ENVELOPED, |
---|
| 494 | (TransformParameterSpec) null)), |
---|
| 495 | null, null); |
---|
| 496 | |
---|
[61f21c5] | 497 | si = fac.newSignedInfo( |
---|
[797bebe] | 498 | fac.newCanonicalizationMethod( |
---|
| 499 | CanonicalizationMethod.INCLUSIVE, |
---|
[3797bbe] | 500 | (C14NMethodParameterSpec) null), |
---|
| 501 | fac.newSignatureMethod(SignatureMethod.RSA_SHA1, null), |
---|
| 502 | Collections.singletonList(ref)); |
---|
| 503 | |
---|
[61f21c5] | 504 | DOMSignContext dsc = new DOMSignContext(privKey, sig); |
---|
[3797bbe] | 505 | XMLSignature signature = fac.newXMLSignature(si, ki); |
---|
| 506 | signature.sign(dsc); |
---|
| 507 | } |
---|
[61f21c5] | 508 | catch (Exception me) { |
---|
[44896b5] | 509 | throw new BadSignatureException(me.getMessage(), me); |
---|
[3797bbe] | 510 | } |
---|
| 511 | |
---|
| 512 | } |
---|
| 513 | |
---|
| 514 | /** |
---|
[44896b5] | 515 | * Load the roles off the attribute cert. |
---|
| 516 | * @throws CertInvalidException if the certificate is badly formatted |
---|
[3797bbe] | 517 | */ |
---|
[44896b5] | 518 | private void load_roles() throws CertInvalidException { |
---|
[3797bbe] | 519 | if ( doc == null ) |
---|
[44896b5] | 520 | throw new CertInvalidException("No credential"); |
---|
[3797bbe] | 521 | |
---|
| 522 | String roles = null; |
---|
| 523 | NodeList nodes = doc.getElementsByTagName("rt0"); |
---|
| 524 | |
---|
| 525 | if (nodes == null || nodes.getLength() != 1) |
---|
[44896b5] | 526 | throw new CertInvalidException("More than one rt0 element?"); |
---|
[3797bbe] | 527 | |
---|
| 528 | Node node = nodes.item(0); |
---|
| 529 | |
---|
| 530 | if ( node == null ) |
---|
[44896b5] | 531 | throw new CertInvalidException("bad rt0 element?"); |
---|
[3797bbe] | 532 | |
---|
| 533 | if ( (roles = node.getTextContent()) == null ) |
---|
[44896b5] | 534 | throw new CertInvalidException("bad rt0 element (no text)?"); |
---|
[3797bbe] | 535 | |
---|
| 536 | String[] parts = roles.split("\\s*<--?\\s*"); |
---|
| 537 | if (parts.length != 2) |
---|
[44896b5] | 538 | throw new CertInvalidException("Invalid attribute: " + roles); |
---|
[3797bbe] | 539 | |
---|
| 540 | m_head = new Role(parts[0]); |
---|
| 541 | m_tail = new Role(parts[1]); |
---|
| 542 | } |
---|
| 543 | |
---|
| 544 | /** |
---|
| 545 | * Gets the cert associated with this credential (if any). |
---|
| 546 | * @return the attribute cert associated with this credential (if any). |
---|
| 547 | */ |
---|
| 548 | public Document GENIcert() { return doc; } |
---|
| 549 | |
---|
| 550 | /** |
---|
| 551 | * Output the signed GENI ABAC certificate associated with this |
---|
| 552 | * Credential to the OutputStream. |
---|
| 553 | * @param s the OutputStream on which to write |
---|
| 554 | * @throws IOException if there is an error writing. |
---|
| 555 | */ |
---|
| 556 | public void write(OutputStream s) throws IOException { |
---|
| 557 | if ( doc == null ) |
---|
| 558 | return; |
---|
| 559 | try { |
---|
| 560 | TransformerFactory tf = TransformerFactory.newInstance(); |
---|
| 561 | Transformer t = tf.newTransformer(); |
---|
| 562 | DOMSource source = new DOMSource(doc); |
---|
| 563 | StreamResult result = new StreamResult(s); |
---|
| 564 | |
---|
| 565 | t.transform(source, result); |
---|
| 566 | s.flush(); |
---|
| 567 | } |
---|
| 568 | catch (Exception e) { |
---|
[44896b5] | 569 | throw new IOException(e.getMessage(), e); |
---|
[3797bbe] | 570 | } |
---|
| 571 | } |
---|
| 572 | /** |
---|
| 573 | * Output the signed GENI ABAC certificate associated with this |
---|
[7b33c9b] | 574 | * Credential to the OutputStream. |
---|
| 575 | * @param fn a String, the file name on which to write |
---|
[3797bbe] | 576 | * @throws IOException if there is an error writing. |
---|
[44896b5] | 577 | * @throws FileNotFoundExeption if the file path is bogus |
---|
[3797bbe] | 578 | */ |
---|
| 579 | public void write(String fn) throws IOException, FileNotFoundException { |
---|
| 580 | write(new FileOutputStream(fn)); |
---|
| 581 | } |
---|
| 582 | |
---|
| 583 | /** |
---|
| 584 | * Return true if this Credential has a certificate associated. A jabac |
---|
| 585 | * extension. |
---|
| 586 | * @return true if this Credential has a certificate associated. |
---|
| 587 | */ |
---|
| 588 | public boolean hasCertificate() { return doc != null; } |
---|
| 589 | |
---|
| 590 | } |
---|