001: /*
002: * Licensed to the Apache Software Foundation (ASF) under one or more
003: * contributor license agreements. See the NOTICE file distributed with
004: * this work for additional information regarding copyright ownership.
005: * The ASF licenses this file to You under the Apache License, Version 2.0
006: * (the "License"); you may not use this file except in compliance with
007: * the License. You may obtain a copy of the License at
008: *
009: * http://www.apache.org/licenses/LICENSE-2.0
010: *
011: * Unless required by applicable law or agreed to in writing, software
012: * distributed under the License is distributed on an "AS IS" BASIS,
013: * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
014: * See the License for the specific language governing permissions and
015: * limitations under the License.
016: */
017:
018: package org.apache.tomcat.util.net.puretls;
019:
020: import java.io.ByteArrayInputStream;
021: import java.io.IOException;
022: import java.security.cert.CertificateFactory;
023: import java.security.cert.X509Certificate;
024: import java.util.Vector;
025:
026: import org.apache.tomcat.util.buf.HexUtils;
027: import org.apache.tomcat.util.net.SSLSupport;
028:
029: import COM.claymoresystems.cert.X509Cert;
030: import COM.claymoresystems.ptls.SSLSocket;
031: import COM.claymoresystems.sslg.SSLPolicyInt;
032:
033: /* PureTLSSupport
034:
035: Concrete implementation class for PureTLS
036: Support classes.
037:
038: This will only work with JDK 1.2 and up since it
039: depends on JDK 1.2's certificate support
040:
041: @author EKR
042: */
043:
044: class PureTLSSupport implements SSLSupport {
045: static org.apache.commons.logging.Log logger = org.apache.commons.logging.LogFactory
046: .getLog(PureTLSSupport.class);
047:
048: private COM.claymoresystems.ptls.SSLSocket ssl;
049:
050: PureTLSSupport(SSLSocket sock) {
051: ssl = sock;
052: }
053:
054: public String getCipherSuite() throws IOException {
055: int cs = ssl.getCipherSuite();
056: return SSLPolicyInt.getCipherSuiteName(cs);
057: }
058:
059: public Object[] getPeerCertificateChain() throws IOException {
060: return getPeerCertificateChain(false);
061: }
062:
063: public Object[] getPeerCertificateChain(boolean force)
064: throws IOException {
065: Vector v = ssl.getCertificateChain();
066:
067: if (v == null && force) {
068: SSLPolicyInt policy = new SSLPolicyInt();
069: policy.requireClientAuth(true);
070: policy.handshakeOnConnect(false);
071: policy.waitOnClose(false);
072: ssl.renegotiate(policy);
073: v = ssl.getCertificateChain();
074: }
075:
076: if (v == null)
077: return null;
078:
079: java.security.cert.X509Certificate[] chain = new java.security.cert.X509Certificate[v
080: .size()];
081:
082: try {
083: for (int i = 1; i <= v.size(); i++) {
084: // PureTLS provides cert chains with the peer
085: // cert last but the Servlet 2.3 spec (S 4.7) requires
086: // the opposite order so we reverse the chain as we go
087: byte buffer[] = ((X509Cert) v.elementAt(v.size() - i))
088: .getDER();
089:
090: CertificateFactory cf = CertificateFactory
091: .getInstance("X.509");
092: ByteArrayInputStream stream = new ByteArrayInputStream(
093: buffer);
094:
095: X509Certificate xCert = (X509Certificate) cf
096: .generateCertificate(stream);
097: chain[i - 1] = xCert;
098: if (logger.isTraceEnabled()) {
099: logger.trace("Cert # " + i + " = " + xCert);
100: }
101: }
102: } catch (java.security.cert.CertificateException e) {
103: logger
104: .info(
105: "JDK's broken cert handling can't parse this certificate (which PureTLS likes)",
106: e);
107: throw new IOException(
108: "JDK's broken cert handling can't parse this certificate (which PureTLS likes)");
109: }
110: return chain;
111: }
112:
113: /**
114: * Lookup the symmetric key size.
115: */
116: public Integer getKeySize() throws IOException {
117:
118: int cs = ssl.getCipherSuite();
119: String cipherSuite = SSLPolicyInt.getCipherSuiteName(cs);
120: int size = 0;
121: for (int i = 0; i < ciphers.length; i++) {
122: if (cipherSuite.indexOf(ciphers[i].phrase) >= 0) {
123: size = ciphers[i].keySize;
124: break;
125: }
126: }
127: Integer keySize = new Integer(size);
128: return keySize;
129: }
130:
131: public String getSessionId() throws IOException {
132: byte[] ssl_session = ssl.getSessionID();
133: if (ssl_session == null)
134: return null;
135: return HexUtils.convert(ssl_session);
136: }
137:
138: }
|