001: /*
002: * Copyright 1999-2004 The Apache Software Foundation
003: *
004: * Licensed under the Apache License, Version 2.0 (the "License");
005: * you may not use this file except in compliance with the License.
006: * You may obtain a copy of the License at
007: *
008: * http://www.apache.org/licenses/LICENSE-2.0
009: *
010: * Unless required by applicable law or agreed to in writing, software
011: * distributed under the License is distributed on an "AS IS" BASIS,
012: * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
013: * See the License for the specific language governing permissions and
014: * limitations under the License.
015: */
016:
017: package org.apache.tomcat.util.net.puretls;
018:
019: import java.io.ByteArrayInputStream;
020: import java.io.IOException;
021: import java.security.cert.CertificateFactory;
022: import java.security.cert.X509Certificate;
023: import java.util.Vector;
024:
025: import org.apache.tomcat.util.buf.HexUtils;
026: import org.apache.tomcat.util.net.SSLSupport;
027:
028: import COM.claymoresystems.cert.X509Cert;
029: import COM.claymoresystems.ptls.SSLSocket;
030: import COM.claymoresystems.sslg.SSLPolicyInt;
031:
032: /* PureTLSSupport
033:
034: Concrete implementation class for PureTLS
035: Support classes.
036:
037: This will only work with JDK 1.2 and up since it
038: depends on JDK 1.2's certificate support
039:
040: @author EKR
041: */
042:
043: class PureTLSSupport implements SSLSupport {
044: static org.apache.commons.logging.Log logger = org.apache.commons.logging.LogFactory
045: .getLog(PureTLSSupport.class);
046:
047: private COM.claymoresystems.ptls.SSLSocket ssl;
048:
049: PureTLSSupport(SSLSocket sock) {
050: ssl = sock;
051: }
052:
053: public String getCipherSuite() throws IOException {
054: int cs = ssl.getCipherSuite();
055: return SSLPolicyInt.getCipherSuiteName(cs);
056: }
057:
058: public Object[] getPeerCertificateChain() throws IOException {
059: return getPeerCertificateChain(false);
060: }
061:
062: public Object[] getPeerCertificateChain(boolean force)
063: throws IOException {
064: Vector v = ssl.getCertificateChain();
065:
066: if (v == null && force) {
067: SSLPolicyInt policy = new SSLPolicyInt();
068: policy.requireClientAuth(true);
069: policy.handshakeOnConnect(false);
070: policy.waitOnClose(false);
071: ssl.renegotiate(policy);
072: v = ssl.getCertificateChain();
073: }
074:
075: if (v == null)
076: return null;
077:
078: java.security.cert.X509Certificate[] chain = new java.security.cert.X509Certificate[v
079: .size()];
080:
081: try {
082: for (int i = 1; i <= v.size(); i++) {
083: // PureTLS provides cert chains with the peer
084: // cert last but the Servlet 2.3 spec (S 4.7) requires
085: // the opposite order so we reverse the chain as we go
086: byte buffer[] = ((X509Cert) v.elementAt(v.size() - i))
087: .getDER();
088:
089: CertificateFactory cf = CertificateFactory
090: .getInstance("X.509");
091: ByteArrayInputStream stream = new ByteArrayInputStream(
092: buffer);
093:
094: X509Certificate xCert = (X509Certificate) cf
095: .generateCertificate(stream);
096: chain[i - 1] = xCert;
097: if (logger.isTraceEnabled()) {
098: logger.trace("Cert # " + i + " = " + xCert);
099: }
100: }
101: } catch (java.security.cert.CertificateException e) {
102: logger
103: .info(
104: "JDK's broken cert handling can't parse this certificate (which PureTLS likes)",
105: e);
106: throw new IOException(
107: "JDK's broken cert handling can't parse this certificate (which PureTLS likes)");
108: }
109: return chain;
110: }
111:
112: /**
113: * Lookup the symmetric key size.
114: */
115: public Integer getKeySize() throws IOException {
116:
117: int cs = ssl.getCipherSuite();
118: String cipherSuite = SSLPolicyInt.getCipherSuiteName(cs);
119: int size = 0;
120: for (int i = 0; i < ciphers.length; i++) {
121: if (cipherSuite.indexOf(ciphers[i].phrase) >= 0) {
122: size = ciphers[i].keySize;
123: break;
124: }
125: }
126: Integer keySize = new Integer(size);
127: return keySize;
128: }
129:
130: public String getSessionId() throws IOException {
131: byte[] ssl_session = ssl.getSessionID();
132: if (ssl_session == null)
133: return null;
134: return HexUtils.convert(ssl_session);
135: }
136:
137: }
|