SoapBoxSecurityConfig.java

  1. /*
  2.  * AdroitLogic UltraESB Enterprise Service Bus
  3.  *
  4.  * Copyright (c) 2010-2012 AdroitLogic Private Ltd. (http://adroitlogic.org). All Rights Reserved.
  5.  *
  6.  * GNU Affero General Public License Usage
  7.  *
  8.  * This program is free software: you can redistribute it and/or modify it under the terms of the GNU Affero General
  9.  * Public License as published by the Free Software Foundation, either version 3 of the License, or (at your option)
  10.  * any later version.
  11.  *
  12.  * This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied
  13.  * warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU Affero General Public License for
  14.  * more details.
  15.  *
  16.  * You should have received a copy of the GNU Affero General Public License along with this program (See LICENSE-AGPL.TXT).
  17.  * If not, see http://www.gnu.org/licenses/agpl-3.0.html
  18.  *
  19.  * Commercial Usage
  20.  *
  21.  * Licensees holding valid UltraESB Commercial licenses may use this file in accordance with the UltraESB Commercial
  22.  * License Agreement provided with the Software or, alternatively, in accordance with the terms contained in a written
  23.  * agreement between you and AdroitLogic.
  24.  *
  25.  * If you are unsure which license is appropriate for your use, or have questions regarding the use of this file,
  26.  * please contact AdroitLogic at info@adroitlogic.com
  27.  */
  28. /*
  29.  * Modificato da Link.it (https://link.it) per supportare le seguenti funzionalità:
  30.  * - firma e cifratura degli attachments
  31.  * - cifratura con chiave simmetrica
  32.  * - supporto CRL 
  33.  * 
  34.  * Copyright (c) 2011-2025 Link.it srl (https://link.it). 
  35.  * 
  36.  */

  38. package org.openspcoop2.security.message.soapbox;

  40. import java.security.InvalidAlgorithmParameterException;
  41. import java.security.Key;
  42. import java.security.KeyStore;
  43. import java.security.KeyStoreException;
  44. import java.security.NoSuchAlgorithmException;
  45. import java.security.UnrecoverableKeyException;
  46. import java.security.cert.CertPath;
  47. import java.security.cert.CertPathValidator;
  48. import java.security.cert.CertificateException;
  49. import java.security.cert.CertificateExpiredException;
  50. import java.security.cert.CertificateFactory;
  51. import java.security.cert.CertificateNotYetValidException;
  52. import java.security.cert.PKIXParameters;
  53. import java.security.cert.X509Certificate;
  54. import java.util.Arrays;
  55. import java.util.Map;
  56. import java.util.WeakHashMap;

  58. import org.openspcoop2.core.constants.Costanti;
  59. import org.openspcoop2.protocol.sdk.state.RequestInfo;
  60. import org.openspcoop2.security.SecurityException;
  61. import org.openspcoop2.security.keystore.CRLCertstore;
  62. import org.openspcoop2.security.keystore.cache.GestoreKeystoreCache;
  63. import org.openspcoop2.utils.date.DateManager;

  65. /**
  66.  * SecurityConfig
  67.  *
  68.  * Author of the original AdroitLogic code:
  69.  * @author asankha
  70.  *
  71.  * Authors of the Link.it modification to the code:
  72.  * @author Andrea Poli (apoli@link.it)
  73.  * @author Giovanni Bussu (bussu@link.it)
  74.  * @author $Author$
  75.  * @version $Rev$, $Date$
  76.  */
  77. public class SoapBoxSecurityConfig extends org.adroitlogic.soapbox.SecurityConfig {

  79.     
  80.     private boolean symmetricSharedKey = false;
  81.     public boolean isSymmetricSharedKey() {
  82.         return this.symmetricSharedKey;
  83.     }
  84.     public void setSymmetricSharedKey(boolean symmetricSharedKey) {
  85.         this.symmetricSharedKey = symmetricSharedKey;
  86.     }
  87.     
  88.     
  89.     private KeyStore identityStore = null;
  90.     
  91.     public SoapBoxSecurityConfig(org.openspcoop2.utils.certificate.KeyStore identityStore, org.openspcoop2.utils.certificate.KeyStore trustStore, Map<String, String> keyPasswords,
  92.             org.openspcoop2.utils.Map<Object> ctx)
  93.             throws KeyStoreException, InvalidAlgorithmParameterException, NoSuchAlgorithmException, CertificateException {
  94.         this(identityStore, trustStore, keyPasswords, null,
  95.                 ctx);
  96.     }
  97.     public SoapBoxSecurityConfig(org.openspcoop2.utils.certificate.KeyStore identityStore, org.openspcoop2.utils.certificate.KeyStore trustStore, Map<String, String> keyPasswords,String crlPath,
  98.             org.openspcoop2.utils.Map<Object> ctx)
  99.         throws KeyStoreException, InvalidAlgorithmParameterException, NoSuchAlgorithmException, CertificateException {
  100.         this(identityStore!=null? identityStore.getKeystore() : null, 
  101.                 trustStore!=null ? trustStore.getKeystore() : null, 
  102.                         keyPasswords, crlPath,
  103.                         ctx);
  104.     }
  105.     public SoapBoxSecurityConfig(KeyStore identityStore, KeyStore trustStore, Map<String, String> keyPasswords,
  106.             org.openspcoop2.utils.Map<Object> ctx)
  107.             throws KeyStoreException, InvalidAlgorithmParameterException, NoSuchAlgorithmException, CertificateException {
  108.         this(identityStore, trustStore, keyPasswords, null,
  109.                 ctx);
  110.     }
  111.     public SoapBoxSecurityConfig(KeyStore identityStore, KeyStore trustStore, Map<String, String> keyPasswords,String crlPath,
  112.             org.openspcoop2.utils.Map<Object> ctx)
  113.         throws KeyStoreException, InvalidAlgorithmParameterException, NoSuchAlgorithmException, CertificateException {

  115.         super(identityStore, trustStore, keyPasswords);

  117.         if(trustStore==null) {
  118.             throw new KeyStoreException("TrustStore param is null");
  119.         }
  120.         
  121.         this.identityStore = identityStore;
  122.         
  123.         // create the parameters for the validator
  124.         this.validatorParams = new PKIXParameters(trustStore);
  125.         // disable CRL checking since we are not supplying any CRLs
  126.         this.validatorParams.setRevocationEnabled(false);
  127.         // create the validator and validate the path
  128.         this.certPathValidator = org.openspcoop2.utils.certificate.CertificateFactory.getCertPathValidator();
  129.         // create a X509 certificate factory for later use
  130.         this.certFactory = org.openspcoop2.utils.certificate.CertificateFactory.getCertificateFactory();

  132.         if(crlPath!=null){
  133.             try{
  134.                 RequestInfo requestInfo = null;
  135.                 if(ctx!=null && ctx.containsKey(Costanti.REQUEST_INFO)) {
  136.                     requestInfo = (RequestInfo) ctx.get(Costanti.REQUEST_INFO);
  137.                 }
  138.                 
  139.                 CRLCertstore crlCertstore = GestoreKeystoreCache.getCRLCertstore(requestInfo, crlPath);
  140.                 this.validatorParams.addCertStore(crlCertstore.getCertStore());
  141.                 this.validatorParams.setRevocationEnabled(true);
  142.                 this.validatorParams.setDate(DateManager.getDate());
  143.                 //System.out.println("INIT ["+crlPath+"]");
  144.             }catch(Exception e){
  145.                 throw new CertificateException(e.getMessage(),e);
  146.             }
  147.         }
  148.         
  149.         /*try{
  150.             this.validatorParams.setRevocationEnabled(true);
  151.             Security.setProperty("ocsp.enable", "true");
  152.             Security.setProperty("ocsp.responderURL","http://siipki.acquirenteunico.it/ocsp");
  153.             //System.out.println("SETTING [http://siipki.acquirenteunico.it/ocsp]");
  154.          }catch(Exception e){
  155.             System.out.println(e.getMessage());
  156.             e.printStackTrace(System.out);
  157.         }*/
  158.         
  159.     }


  162.     public Key getSymmetricKey(String alias) throws KeyStoreException, NoSuchAlgorithmException, UnrecoverableKeyException{  
  163.         String password = this.getKeyPassword(alias);
  164.         Key key = this.identityStore.getKey(alias, password.toCharArray());
  165.         return key;
  166.     }


  169.     private final WeakHashMap<X509Certificate[], Boolean> validCerts = new WeakHashMap<X509Certificate[], Boolean>();
  170.     private final CertPathValidator certPathValidator;
  171.     private final CertificateFactory certFactory;
  172.     private final PKIXParameters validatorParams;
  173.     
  174.    public void validateX509Certificate(X509Certificate[] certs) throws SecurityException {

  176.         if(certs==null || certs.length==0) {
  177.             throw new SecurityException("Certificates undefined");
  178.         }
  179.        
  180.         Boolean validity = this.validCerts.get(certs);
  181.         if (validity == null) {
  182.             synchronized (this) {
  183.                 
  184.                 StringBuilder bf = new StringBuilder();
  185.                 if(certs!=null){
  186.                     for (int i = 0; i < certs.length; i++) {
  187.                         if(i>0){
  188.                             bf.append(" ");
  189.                         }
  190.                         bf.append("(Certificate["+i+"]: DN="+certs[i].getSubjectDN().toString()+")");
  191.                     }
  192.                 }
  193.                 bf.append(" Does not validate against the trusted CA certificates ");
  194.                 
  195.                 try {
  196.                     //System.out.println("Validate...");
  197.                     CertPath certPath = this.certFactory.generateCertPath(Arrays.asList(certs));
  198.                     if(certPath==null) {
  199.                         throw new Exception("CertPath unavailable");
  200.                     }
  201.                     this.certPathValidator.validate(certPath, this.validatorParams);
  202.                     this.validCerts.put(certs, Boolean.TRUE);
  203.                     //System.out.println("Validate OK");
  204.                 } catch (CertificateNotYetValidException e) {
  205.                     this.validCerts.put(certs, Boolean.FALSE);
  206.                     throw new SecurityException(bf.toString()+"[Certificate is not yet valid] - " + e.getMessage());
  207.                 } catch (CertificateExpiredException e) {
  208.                     this.validCerts.put(certs, Boolean.FALSE);
  209.                     throw new SecurityException(bf.toString()+"[Certificate has expired] - " + e.getMessage());
  210.                 } catch (Exception e) {
  211.                       this.validCerts.put(certs, Boolean.FALSE);
  212.                       throw new SecurityException(bf.toString()+"[Errore generico] - " + e.getMessage());
  213.                     //return false;
  214.                 }
  215.             }
  216.         } else {
  217.              throw new SecurityException("Certificate not found in validCerts");
  218.         }
  219.     }

  221. }
Created with JaCoCo 0.8.8.202204050719