-
Notifications
You must be signed in to change notification settings - Fork 48
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
- Loading branch information
Showing
7 changed files
with
215 additions
and
12 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
71 changes: 71 additions & 0 deletions
71
.../roda-core/src/main/java/org/roda/core/plugins/certificate/CompositeX509TrustManager.java
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,71 @@ | ||
| package org.roda.core.plugins.certificate; | ||
|
|
||
| import java.security.cert.Certificate; | ||
| import java.security.cert.CertificateException; | ||
| import java.security.cert.X509Certificate; | ||
| import java.util.ArrayList; | ||
| import java.util.Arrays; | ||
| import java.util.List; | ||
| import java.util.stream.Collectors; | ||
|
|
||
| import javax.net.ssl.X509TrustManager; | ||
|
|
||
| import org.slf4j.Logger; | ||
| import org.slf4j.LoggerFactory; | ||
|
|
||
| /** | ||
| * @author Gabriel Barros <[email protected]> | ||
| */ | ||
| public class CompositeX509TrustManager implements X509TrustManager { | ||
| private static final Logger LOGGER = LoggerFactory.getLogger(CompositeX509TrustManager.class); | ||
| private final List<X509TrustManager> trustManagers; | ||
|
|
||
| public CompositeX509TrustManager(List<X509TrustManager> trustManagers) { | ||
| this.trustManagers = trustManagers; | ||
| } | ||
|
|
||
| @Override | ||
| public void checkClientTrusted(X509Certificate[] x509Certificates, String authType) throws CertificateException { | ||
| boolean isTrusted = trustManagers.stream().anyMatch(trustManager -> { | ||
| try { | ||
| trustManager.checkClientTrusted(x509Certificates, authType); | ||
| return true; | ||
| } catch (CertificateException e) { | ||
| LOGGER.debug("Unable to trust the client certificates " | ||
| + Arrays.stream(x509Certificates).map(Certificate::toString).collect(Collectors.toSet())); | ||
| return false; | ||
| } | ||
| }); | ||
|
|
||
| if (!isTrusted) { | ||
| throw new CertificateException("None of the TrustManagers can trust this client certificate chain"); | ||
| } | ||
| } | ||
|
|
||
| @Override | ||
| public void checkServerTrusted(X509Certificate[] x509Certificates, String authType) throws CertificateException { | ||
| boolean isTrusted = trustManagers.stream().anyMatch(trustManager -> { | ||
| try { | ||
| trustManager.checkServerTrusted(x509Certificates, authType); | ||
| return true; | ||
| } catch (CertificateException e) { | ||
| LOGGER.debug("Unable to trust the server certificates " | ||
| + Arrays.stream(x509Certificates).map(Certificate::toString).collect(Collectors.toSet())); | ||
| return false; | ||
| } | ||
| }); | ||
|
|
||
| if (!isTrusted) { | ||
| throw new CertificateException("None of the TrustManagers can trust this client certificate chain"); | ||
| } | ||
| } | ||
|
|
||
| @Override | ||
| public X509Certificate[] getAcceptedIssuers() { | ||
| ArrayList<X509Certificate> x509Certificates = new ArrayList<>(trustManagers.size()); | ||
| for (X509TrustManager trustManager : trustManagers) { | ||
| x509Certificates.addAll(Arrays.asList(trustManager.getAcceptedIssuers())); | ||
| } | ||
| return x509Certificates.toArray(X509Certificate[]::new); | ||
| } | ||
| } |
25 changes: 25 additions & 0 deletions
25
...roda-core/src/main/java/org/roda/core/plugins/certificate/PluginCertificateException.java
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,25 @@ | ||
| package org.roda.core.plugins.certificate; | ||
|
|
||
| import org.roda.core.data.exceptions.RODAException; | ||
|
|
||
| /** | ||
| * @author Gabriel Barros <[email protected]> | ||
| */ | ||
| public class PluginCertificateException extends RODAException { | ||
|
|
||
| public PluginCertificateException() { | ||
| super(); | ||
| } | ||
|
|
||
| public PluginCertificateException(String message) { | ||
| super(message); | ||
| } | ||
|
|
||
| public PluginCertificateException(String message, Throwable cause) { | ||
| super(message, cause); | ||
| } | ||
|
|
||
| public PluginCertificateException(Throwable cause) { | ||
| super(cause); | ||
| } | ||
| } |
74 changes: 74 additions & 0 deletions
74
...ore/roda-core/src/main/java/org/roda/core/plugins/certificate/PluginCertificateUtils.java
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,74 @@ | ||
| package org.roda.core.plugins.certificate; | ||
|
|
||
| import java.io.IOException; | ||
| import java.security.KeyStore; | ||
| import java.security.KeyStoreException; | ||
| import java.security.NoSuchAlgorithmException; | ||
| import java.security.cert.CertificateException; | ||
| import java.security.cert.X509Certificate; | ||
| import java.util.ArrayList; | ||
| import java.util.Arrays; | ||
| import java.util.List; | ||
| import java.util.stream.Collectors; | ||
|
|
||
| import javax.net.ssl.TrustManagerFactory; | ||
| import javax.net.ssl.X509TrustManager; | ||
|
|
||
| import org.roda.core.RodaCoreFactory; | ||
| import org.roda.core.data.common.RodaConstants; | ||
|
|
||
| /** | ||
| * @author Gabriel Barros <[email protected]> | ||
| */ | ||
| public class PluginCertificateUtils { | ||
| public static void validate(X509Certificate[] certificates) | ||
| throws KeyStoreException, CertificateException, IOException, NoSuchAlgorithmException, PluginCertificateException { | ||
|
|
||
| // RODA truststore | ||
| KeyStore rodaTrustStore = KeyStore.getInstance(RodaConstants.PLUGINS_CERTIFICATE_RODA_TRUSTSTORE_TYPE); | ||
| String rodaTrustStorePath = RodaConstants.PLUGINS_CERTIFICATE_DEFAULT_TRUSTSTORE_PATH | ||
| + RodaConstants.PLUGINS_CERTIFICATE_RODA_TRUSTSTORE_NAME; | ||
| rodaTrustStore.load(PluginCertificateUtils.class.getResourceAsStream(rodaTrustStorePath), | ||
| RodaConstants.PLUGINS_CERTIFICATE_RODA_TRUSTSTORE_PASS.toCharArray()); | ||
|
|
||
| List<X509TrustManager> allTrustManagers = new ArrayList<>( | ||
| getTrustManager(rodaTrustStore, TrustManagerFactory.getDefaultAlgorithm())); | ||
|
|
||
| // Custom truststore | ||
| if (RodaCoreFactory.getProperty(RodaConstants.PLUGINS_CERTIFICATE_CUSTOM_TRUSTSTORE_TYPE_PROPERTY, false)) { | ||
| String customTrustStoreType = getMandatoryCertificateProperty( | ||
| RodaConstants.PLUGINS_CERTIFICATE_CUSTOM_TRUSTSTORE_TYPE_PROPERTY); | ||
| String customName = getMandatoryCertificateProperty( | ||
| RodaConstants.PLUGINS_CERTIFICATE_CUSTOM_TRUSTSTORE_NAME_PROPERTY); | ||
| String customPass = getMandatoryCertificateProperty( | ||
| RodaConstants.PLUGINS_CERTIFICATE_CUSTOM_TRUSTSTORE_PASS_PROPERTY); | ||
|
|
||
| String customTrustStorePath = RodaConstants.PLUGINS_CERTIFICATE_DEFAULT_TRUSTSTORE_PATH + customName; | ||
| KeyStore customTrustStore = KeyStore.getInstance(customTrustStoreType); | ||
| customTrustStore.load(RodaCoreFactory.getConfigurationFileAsStream(customTrustStorePath), | ||
| customPass.toCharArray()); | ||
| allTrustManagers.addAll(getTrustManager(customTrustStore, TrustManagerFactory.getDefaultAlgorithm())); | ||
| } | ||
|
|
||
| CompositeX509TrustManager compositeX509TrustManager = new CompositeX509TrustManager(allTrustManagers); | ||
| compositeX509TrustManager.checkServerTrusted(certificates, | ||
| RodaConstants.PLUGINS_CERTIFICATE_DEFAULT_TRUSTSTORE_AUTH_TYPE); | ||
| } | ||
|
|
||
| private static String getMandatoryCertificateProperty(String propertyKey) throws PluginCertificateException { | ||
| String property = RodaCoreFactory.getProperty(propertyKey, ""); | ||
| if (property.isEmpty()) { | ||
| throw new PluginCertificateException("Mandatory property not defined: " + propertyKey); | ||
| } | ||
| return property; | ||
| } | ||
|
|
||
| private static List<X509TrustManager> getTrustManager(final KeyStore keyStore, final String algorithm) | ||
| throws NoSuchAlgorithmException, KeyStoreException { | ||
| TrustManagerFactory trustManagerFactory = TrustManagerFactory.getInstance(algorithm); | ||
| trustManagerFactory.init(keyStore); | ||
|
|
||
| return Arrays.stream(trustManagerFactory.getTrustManagers()).filter(X509TrustManager.class::isInstance) | ||
| .map(X509TrustManager.class::cast).collect(Collectors.toList()); | ||
| } | ||
| } |
File renamed without changes.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters