getTags();
public Object putPassword(String tag, String password);
public void commit() throws IOException, ClassCastException,
NullPointerException;
}
tomcatjss-7.4.1/src/org/apache/tomcat/util/net/jss/PlainPasswordFile.java 0000664 0000000 0000000 00000012614 13500240455 0026415 0 ustar 00root root 0000000 0000000 /* BEGIN COPYRIGHT BLOCK
* This library is free software; you can redistribute it and/or
* modify it under the terms of the GNU Lesser General Public
* License as published by the Free Software Foundation; either
* version 2.1 of the License, or (at your option) any later version.
*
* This library is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
* Lesser General Public License for more details.
*
* You should have received a copy of the GNU Lesser General Public
* License along with this library; if not, write to the Free Software
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
*
* Copyright (C) 2007 Red Hat, Inc.
* All rights reserved.
* END COPYRIGHT BLOCK */
package org.apache.tomcat.util.net.jss;
import java.io.BufferedReader;
import java.io.BufferedWriter;
import java.io.FileInputStream;
import java.io.FileOutputStream;
import java.io.IOException;
import java.io.InputStreamReader;
import java.io.OutputStreamWriter;
import java.util.Enumeration;
import java.util.Properties;
public class PlainPasswordFile implements IPasswordStore {
private String mPwdPath = "";
private Properties mPwdStore;
private static org.slf4j.Logger logger = org.slf4j.LoggerFactory.getLogger(PlainPasswordFile.class);
public PlainPasswordFile() {
mPwdStore = new Properties();
}
/**
* Initialization method to read passwords(key and element pairs) from a file.
*
* Every property occupies one line of the input stream. Each line is terminated by a line terminator (
* \n or \r or \r\n). Lines are processed until end of
* file is reached.
*
* A line that contains only whitespace or whose first non-whitespace character is an ASCII #
* is ignored (thus, # indicates comment line).
*
* Every line other than a blank line or a comment line describes one property to be added to the table.
* The characters before the delimiter = forms the key and the characters after
* the = is assigned as value to the key.
*
* As an example, each of the following lines specify the key "Truth" and the associated element
* value "Beauty":
*
*
*
* Truth = Beauty
* Truth= Beauty
* Truth =Beauty
*
*
*
* Note that the space appearing before/after = is ignored. However, the space appearing in between are
* stored.
*
* Example:
*
*
* Welcome Message = Hello World
*
*
* assigns value Hello World to key Welcome Message
*
*
* If the line doesn't have the delimiter =, the method throws an IOException
*
* @param pwdPath the input file path.
* @exception IOException if an error occurred when reading from the
* input stream.
*/
public void init(String pwdPath) throws IOException {
logger.debug("PlainPasswordFile: Initializing PlainPasswordFile");
// initialize mPwdStore
mPwdPath = pwdPath;
try (FileInputStream file = new FileInputStream(mPwdPath);
InputStreamReader isr = new InputStreamReader(file);
BufferedReader br = new BufferedReader(isr)) {
String line;
int index = 1;
while ((line = br.readLine()) != null) {
// Remove any leading or trailing spaces
line = line.trim();
if (line.startsWith("#") || line.isEmpty())
continue;
String[] parts = line.split("=", 2);
if (parts.length < 2) {
throw new IOException("Missing delimiter '=' in file " + mPwdPath + " in line " + index);
}
// Load key value into the password store
mPwdStore.put(parts[0].trim(), parts[1].trim());
index++;
}
}
}
public String getPassword(String tag) {
return getPassword(tag, 0);
}
public String getPassword(String tag, int iteration) {
return mPwdStore.getProperty(tag);
}
// return an array of String-based tag
@SuppressWarnings("unchecked")
public Enumeration getTags() {
return (Enumeration) mPwdStore.propertyNames();
}
public Object putPassword(String tag, String password) {
return mPwdStore.setProperty(tag, password);
}
public synchronized void commit()
throws IOException, ClassCastException, NullPointerException {
try (FileOutputStream file = new FileOutputStream(mPwdPath);
OutputStreamWriter osw = new OutputStreamWriter(file);
BufferedWriter bw = new BufferedWriter(osw)) {
for (Enumeration e = mPwdStore.keys(); e.hasMoreElements();) {
String key = ((String) e.nextElement()).trim();
String val = ((String) mPwdStore.get(key)).trim();
bw.write(key + "=" + val);
bw.newLine();
}
}
}
public int getSize() {
return mPwdStore.size();
}
}
tomcatjss-7.4.1/src/org/apache/tomcat/util/net/jss/TomcatJSS.java 0000664 0000000 0000000 00000075473 13500240455 0024652 0 ustar 00root root 0000000 0000000 /* BEGIN COPYRIGHT BLOCK
* This library is free software; you can redistribute it and/or
* modify it under the terms of the GNU Lesser General Public
* License as published by the Free Software Foundation; either
* version 2.1 of the License, or (at your option) any later version.
*
* This library is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
* Lesser General Public License for more details.
*
* You should have received a copy of the GNU Lesser General Public
* License along with this library; if not, write to the Free Software
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
*
* Copyright (C) 2017 Red Hat, Inc.
* All rights reserved.
* END COPYRIGHT BLOCK */
package org.apache.tomcat.util.net.jss;
import java.io.File;
import java.io.FileReader;
import java.io.IOException;
import java.net.SocketException;
import java.nio.file.Files;
import java.nio.file.Paths;
import java.util.ArrayList;
import java.util.Collection;
import java.util.Enumeration;
import java.util.Properties;
import java.util.StringTokenizer;
import javax.xml.parsers.DocumentBuilder;
import javax.xml.parsers.DocumentBuilderFactory;
import javax.xml.xpath.XPath;
import javax.xml.xpath.XPathConstants;
import javax.xml.xpath.XPathFactory;
import org.apache.commons.lang.StringUtils;
import org.mozilla.jss.CryptoManager;
import org.mozilla.jss.InitializationValues;
import org.mozilla.jss.NoSuchTokenException;
import org.mozilla.jss.crypto.AlreadyInitializedException;
import org.mozilla.jss.crypto.CryptoToken;
import org.mozilla.jss.ssl.SSLAlertEvent;
import org.mozilla.jss.ssl.SSLCipher;
import org.mozilla.jss.ssl.SSLHandshakeCompletedEvent;
import org.mozilla.jss.ssl.SSLProtocolVariant;
import org.mozilla.jss.ssl.SSLServerSocket;
import org.mozilla.jss.ssl.SSLSocket;
import org.mozilla.jss.ssl.SSLSocketListener;
import org.mozilla.jss.ssl.SSLVersion;
import org.mozilla.jss.ssl.SSLVersionRange;
import org.mozilla.jss.util.IncorrectPasswordException;
import org.mozilla.jss.util.Password;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import org.w3c.dom.Document;
import org.w3c.dom.Element;
public class TomcatJSS implements SSLSocketListener {
public static Logger logger = LoggerFactory.getLogger(TomcatJSS.class);
public final static TomcatJSS INSTANCE = new TomcatJSS();
public static final int MAX_LOGIN_ATTEMPTS = 3;
public static TomcatJSS getInstance() { return INSTANCE; }
Collection socketListeners = new ArrayList();
String certdbDir;
CryptoManager manager;
String passwordClass;
String passwordFile;
IPasswordStore passwordStore;
String serverCertNickFile;
String serverCertNick;
String clientAuth = "want";
boolean requireClientAuth;
boolean wantClientAuth;
boolean enableOCSP;
String ocspResponderURL;
String ocspResponderCertNickname;
int ocspCacheSize = 1000; // entries
int ocspMinCacheEntryDuration = 3600; // seconds (default: 1 hour)
int ocspMaxCacheEntryDuration = 86400; // seconds (default: 24 hours)
int ocspTimeout = 60; // seconds (default: 1 minute)
String strictCiphers;
boolean boolStrictCiphers;
String sslVersionRangeStream;
String sslVersionRangeDatagram;
String sslRangeCiphers;
String sslOptions;
String ssl2Ciphers;
String ssl3Ciphers;
String tlsCiphers;
boolean initialized;
public void addSocketListener(SSLSocketListener listener) {
socketListeners.add(listener);
}
public void removeSocketListener(SSLSocketListener listener) {
socketListeners.remove(listener);
}
public Collection getSocketListeners() {
return socketListeners;
}
public String getCertdbDir() {
return certdbDir;
}
public void setCertdbDir(String certdbDir) {
this.certdbDir = certdbDir;
}
public String getPasswordClass() {
return passwordClass;
}
public void setPasswordClass(String passwordClass) {
this.passwordClass = passwordClass;
}
public String getPasswordFile() {
return passwordFile;
}
public void setPasswordFile(String passwordFile) {
this.passwordFile = passwordFile;
}
public String getServerCertNickFile() {
return serverCertNickFile;
}
public IPasswordStore getPasswordStore() {
return passwordStore;
}
public void setPasswordStore(IPasswordStore passwordStore) {
this.passwordStore = passwordStore;
}
public void setServerCertNickFile(String serverCertNickFile) {
this.serverCertNickFile = serverCertNickFile;
}
public String getServerCertNick() {
return serverCertNick;
}
public void setServerCertNick(String serverCertNick) {
this.serverCertNick = serverCertNick;
}
public String getClientAuth() {
return clientAuth;
}
public void setClientAuth(String clientAuth) {
this.clientAuth = clientAuth;
}
public boolean getRequireClientAuth() {
return requireClientAuth;
}
public boolean getWantClientAuth() {
return wantClientAuth;
}
public boolean getEnableOCSP() {
return enableOCSP;
}
public void setEnableOCSP(boolean enableOCSP) {
this.enableOCSP = enableOCSP;
}
public String getOcspResponderURL() {
return ocspResponderURL;
}
public void setOcspResponderURL(String ocspResponderURL) {
this.ocspResponderURL = ocspResponderURL;
}
public String getOcspResponderCertNickname() {
return ocspResponderCertNickname;
}
public void setOcspResponderCertNickname(String ocspResponderCertNickname) {
this.ocspResponderCertNickname = ocspResponderCertNickname;
}
public int getOcspCacheSize() {
return ocspCacheSize;
}
public void setOcspCacheSize(int ocspCacheSize) {
this.ocspCacheSize = ocspCacheSize;
}
public int getOcspMinCacheEntryDuration() {
return ocspMinCacheEntryDuration;
}
public void setOcspMinCacheEntryDuration(int ocspMinCacheEntryDuration) {
this.ocspMinCacheEntryDuration = ocspMinCacheEntryDuration;
}
public int getOcspMaxCacheEntryDuration() {
return ocspMaxCacheEntryDuration;
}
public void setOcspMaxCacheEntryDuration(int ocspMaxCacheEntryDuration) {
this.ocspMaxCacheEntryDuration = ocspMaxCacheEntryDuration;
}
public int getOcspTimeout() {
return ocspTimeout;
}
public void setOcspTimeout(int ocspTimeout) {
this.ocspTimeout = ocspTimeout;
}
public String getStrictCiphers() {
return strictCiphers;
}
public void setStrictCiphers(String strictCiphers) {
this.strictCiphers = strictCiphers;
}
public String getSslVersionRangeStream() {
return sslVersionRangeStream;
}
public void setSslVersionRangeStream(String sslVersionRangeStream) {
this.sslVersionRangeStream = sslVersionRangeStream;
}
public String getSslVersionRangeDatagram() {
return sslVersionRangeDatagram;
}
public void setSslVersionRangeDatagram(String sslVersionRangeDatagram) {
this.sslVersionRangeDatagram = sslVersionRangeDatagram;
}
public String getSslRangeCiphers() {
return sslRangeCiphers;
}
public void setSslRangeCiphers(String sslRangeCiphers) {
this.sslRangeCiphers = sslRangeCiphers;
}
public String getSslOptions() {
return sslOptions;
}
public void setSslOptions(String sslOptions) {
this.sslOptions = sslOptions;
}
public String getSsl2Ciphers() {
return ssl2Ciphers;
}
public void setSsl2Ciphers(String ssl2Ciphers) {
this.ssl2Ciphers = ssl2Ciphers;
}
public String getSsl3Ciphers() {
return ssl3Ciphers;
}
public void setSsl3Ciphers(String ssl3Ciphers) {
this.ssl3Ciphers = ssl3Ciphers;
}
public String getTlsCiphers() {
return tlsCiphers;
}
public void setTlsCiphers(String tlsCiphers) {
this.tlsCiphers = tlsCiphers;
}
public void loadJSSConfig(String jssConf) throws Exception {
File configFile = new File(jssConf);
loadJSSConfig(configFile);
}
public void loadJSSConfig(File configFile) throws Exception {
Properties config = new Properties();
config.load(new FileReader(configFile));
loadJSSConfig(config);
}
public void loadJSSConfig(Properties config) throws Exception {
String certDb = config.getProperty("certdbDir");
if (certDb != null)
setCertdbDir(certDb);
String passwordClass = config.getProperty("passwordClass");
if (passwordClass != null)
setPasswordClass(passwordClass);
String passwordFile = config.getProperty("passwordFile");
if (passwordFile != null)
setPasswordFile(passwordFile);
String enableOCSP = config.getProperty("enableOCSP");
if (enableOCSP != null)
setEnableOCSP(Boolean.parseBoolean(enableOCSP));
String ocspResponderURL = config.getProperty("ocspResponderURL");
if (ocspResponderURL != null)
setOcspResponderURL(ocspResponderURL);
String ocspResponderCertNickname = config.getProperty("ocspResponderCertNickname");
if (ocspResponderCertNickname != null)
setOcspResponderCertNickname(ocspResponderCertNickname);
String ocspCacheSize = config.getProperty("ocspCacheSize");
if (StringUtils.isNotEmpty(ocspCacheSize))
setOcspCacheSize(Integer.parseInt(ocspCacheSize));
String ocspMinCacheEntryDuration = config.getProperty("ocspMinCacheEntryDuration");
if (StringUtils.isNotEmpty(ocspMinCacheEntryDuration))
setOcspMinCacheEntryDuration(Integer.parseInt(ocspMinCacheEntryDuration));
String ocspMaxCacheEntryDuration = config.getProperty("ocspMaxCacheEntryDuration");
if (StringUtils.isNotEmpty(ocspMaxCacheEntryDuration))
setOcspMaxCacheEntryDuration(Integer.parseInt(ocspMaxCacheEntryDuration));
String ocspTimeout = config.getProperty("ocspTimeout");
if (StringUtils.isNotEmpty(ocspTimeout))
setOcspTimeout(Integer.parseInt(ocspTimeout));
String strictCiphers = config.getProperty("strictCiphers");
if (strictCiphers != null)
setStrictCiphers(strictCiphers);
String sslVersionRangeStream = config.getProperty("sslVersionRangeStream");
if (sslVersionRangeStream != null)
setSslVersionRangeStream(sslVersionRangeStream);
String sslVersionRangeDatagram = config.getProperty("sslVersionRangeDatagram");
if (sslVersionRangeDatagram != null)
setSslVersionRangeDatagram(sslVersionRangeDatagram);
String sslRangeCiphers = config.getProperty("sslRangeCiphers");
if (sslRangeCiphers != null)
setSslRangeCiphers(sslRangeCiphers);
String sslOptions = config.getProperty("sslOptions");
if (sslOptions != null)
setSslOptions(sslOptions);
String ssl2Ciphers = config.getProperty("ssl2Ciphers");
if (ssl2Ciphers != null)
setSsl2Ciphers(ssl2Ciphers);
String ssl3Ciphers = config.getProperty("ssl3Ciphers");
if (ssl3Ciphers != null)
setSsl3Ciphers(ssl3Ciphers);
String tlsCiphers = config.getProperty("tlsCiphers");
if (tlsCiphers != null)
setTlsCiphers(tlsCiphers);
}
public void loadTomcatConfig(String serverXml) throws Exception {
File configFile = new File(serverXml);
loadTomcatConfig(configFile);
}
public void loadTomcatConfig(File configFile) throws Exception {
DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
DocumentBuilder builder = factory.newDocumentBuilder();
Document document = builder.parse(configFile);
loadTomcatConfig(document);
}
public void loadTomcatConfig(Document document) throws Exception {
XPathFactory xPathfactory = XPathFactory.newInstance();
XPath xpath = xPathfactory.newXPath();
Element connector = (Element) xpath.evaluate(
"/Server/Service[@name='Catalina']/Connector[@SSLEnabled='true']",
document, XPathConstants.NODE);
String certDb = connector.getAttribute("certdbDir");
if (certDb != null)
setCertdbDir(certDb);
String passwordClass = connector.getAttribute("passwordClass");
if (passwordClass != null)
setPasswordClass(passwordClass);
String passwordFile = connector.getAttribute("passwordFile");
if (passwordFile != null)
setPasswordFile(passwordFile);
String serverCertNickFile = connector.getAttribute("serverCertNickFile");
if (serverCertNickFile != null)
setServerCertNickFile(serverCertNickFile);
String enableOCSP = connector.getAttribute("enableOCSP");
if (enableOCSP != null)
setEnableOCSP(Boolean.parseBoolean(enableOCSP));
String ocspResponderURL = connector.getAttribute("ocspResponderURL");
if (ocspResponderURL != null)
setOcspResponderURL(ocspResponderURL);
String ocspResponderCertNickname = connector.getAttribute("ocspResponderCertNickname");
if (ocspResponderCertNickname != null)
setOcspResponderCertNickname(ocspResponderCertNickname);
String ocspCacheSize = connector.getAttribute("ocspCacheSize");
if (StringUtils.isNotEmpty(ocspCacheSize))
setOcspCacheSize(Integer.parseInt(ocspCacheSize));
String ocspMinCacheEntryDuration = connector.getAttribute("ocspMinCacheEntryDuration");
if (StringUtils.isNotEmpty(ocspMinCacheEntryDuration))
setOcspMinCacheEntryDuration(Integer.parseInt(ocspMinCacheEntryDuration));
String ocspMaxCacheEntryDuration = connector.getAttribute("ocspMaxCacheEntryDuration");
if (StringUtils.isNotEmpty(ocspMaxCacheEntryDuration))
setOcspMaxCacheEntryDuration(Integer.parseInt(ocspMaxCacheEntryDuration));
String ocspTimeout = connector.getAttribute("ocspTimeout");
if (StringUtils.isNotEmpty(ocspTimeout))
setOcspTimeout(Integer.parseInt(ocspTimeout));
String strictCiphers = connector.getAttribute("strictCiphers");
if (strictCiphers != null)
setStrictCiphers(strictCiphers);
String sslVersionRangeStream = connector.getAttribute("sslVersionRangeStream");
if (sslVersionRangeStream != null)
setSslVersionRangeStream(sslVersionRangeStream);
String sslVersionRangeDatagram = connector.getAttribute("sslVersionRangeDatagram");
if (sslVersionRangeDatagram != null)
setSslVersionRangeDatagram(sslVersionRangeDatagram);
String sslRangeCiphers = connector.getAttribute("sslRangeCiphers");
if (sslRangeCiphers != null)
setSslRangeCiphers(sslRangeCiphers);
String sslOptions = connector.getAttribute("sslOptions");
if (sslOptions != null)
setSslOptions(sslOptions);
String ssl2Ciphers = connector.getAttribute("ssl2Ciphers");
if (ssl2Ciphers != null)
setSsl2Ciphers(ssl2Ciphers);
String ssl3Ciphers = connector.getAttribute("ssl3Ciphers");
if (ssl3Ciphers != null)
setSsl3Ciphers(ssl3Ciphers);
String tlsCiphers = connector.getAttribute("tlsCiphers");
if (tlsCiphers != null)
setTlsCiphers(tlsCiphers);
}
public void init() throws Exception {
if (initialized) {
return;
}
logger.info("TomcatJSS: initialization");
if (certdbDir == null) {
certdbDir = System.getProperty("catalina.base") + File.separator + "alias";
}
logger.debug("TomcatJSS: certdbDir: " + certdbDir);
if (passwordClass == null) {
passwordClass = PlainPasswordFile.class.getName();
}
logger.debug("TomcatJSS: passwordClass: " + passwordClass);
if (passwordFile == null) {
passwordFile = System.getProperty("catalina.base") + File.separator +
"conf" + File.separator + "password.conf";
}
logger.debug("TomcatJSS: passwordFile: " + passwordFile);
if (serverCertNickFile != null) {
logger.debug("TomcatJSS: serverCertNickFile: " + serverCertNickFile);
}
InitializationValues vals = new InitializationValues(certdbDir);
vals.removeSunProvider = false;
vals.installJSSProvider = true;
try {
CryptoManager.initialize(vals);
} catch (AlreadyInitializedException e) {
logger.warn("TomcatJSS: " + e);
}
manager = CryptoManager.getInstance();
passwordStore = (IPasswordStore) Class.forName(passwordClass).newInstance();
passwordStore.init(passwordFile);
login();
if (serverCertNickFile != null) {
serverCertNick = new String(Files.readAllBytes(Paths.get(serverCertNickFile))).trim();
logger.debug("serverCertNick: " + serverCertNick);
}
logger.debug("clientAuth: " + clientAuth);
if (clientAuth.equalsIgnoreCase("true")) {
requireClientAuth = true;
} else if (clientAuth.equalsIgnoreCase("yes")) {
requireClientAuth = true;
logger.warn("The \"yes\" value for clientAuth has been deprecated. Use \"true\" instead.");
} else if (clientAuth.equalsIgnoreCase("want")) {
wantClientAuth = true;
}
logger.debug("requireClientAuth: " + requireClientAuth);
logger.debug("wantClientAuth: " + wantClientAuth);
if (requireClientAuth || wantClientAuth) {
configureOCSP();
}
// 12 hours = 43200 seconds
SSLServerSocket.configServerSessionIDCache(0, 43200, 43200, null);
logger.debug("strictCiphers: " + strictCiphers);
if ("true".equalsIgnoreCase(strictCiphers)) {
boolStrictCiphers = true;
} else if ("yes".equalsIgnoreCase(strictCiphers)) {
boolStrictCiphers = true;
logger.warn("The \"yes\" value for strictCiphers has been deprecated. Use \"true\" instead.");
}
if (boolStrictCiphers) {
// what ciphers do we have to start with? turn them all off
unsetSSLCiphers();
}
logger.debug("sslVersionRangeStream: " + sslVersionRangeStream);
if (StringUtils.isNotEmpty(sslVersionRangeStream)) {
setSSLVersionRangeDefault(
"STREAM",
SSLProtocolVariant.STREAM,
sslVersionRangeStream);
}
logger.debug("sslVersionRangeDatagram: " + sslVersionRangeDatagram);
if (StringUtils.isNotEmpty(sslVersionRangeDatagram)) {
setSSLVersionRangeDefault(
"DATA_GRAM",
SSLProtocolVariant.DATA_GRAM,
sslVersionRangeDatagram);
}
/*
* According to NSS: the SSL_OptionSet-based API for controlling the
* enabled protocol versions are obsolete and replaced by the
* setSSLVersionRange calls. Therefore, if the "range" parameters
* are present in the attributes then the sslOptions parameter is
* ignored. Using the new version range API in conjunction with the
* older SSL_OptionSet-based API for controlling the enabled
* protocol versions may cause unexpected results
*/
if (StringUtils.isNotEmpty(sslVersionRangeStream)
|| StringUtils.isNotEmpty(sslVersionRangeDatagram)) {
/* deliberately lose the ssl2 here */
setSSLCiphers("sslRangeCiphers", sslRangeCiphers);
} else {
setSSLOptions();
}
logger.info("TomcatJSS: initialization complete");
initialized = true;
}
public void login() throws Exception {
logger.debug("TomcatJSS: logging into tokens");
Enumeration tags = passwordStore.getTags();
while (tags.hasMoreElements()) {
String tag = tags.nextElement();
if (!tag.equals("internal") && !tag.startsWith("hardware-")) {
continue;
}
login(tag);
}
}
public void login(String tag) throws Exception {
CryptoToken token;
try {
token = getToken(tag);
} catch (NoSuchTokenException e) {
logger.warn("TomcatJSS: token for " + tag + " not found");
return;
}
if (token.isLoggedIn()) {
logger.debug("TomcatJSS: already logged into " + tag);
return;
}
logger.debug("TomcatJSS: logging into " + tag);
int iteration = 0;
do {
String strPassword = passwordStore.getPassword(tag, iteration);
if (strPassword == null) {
logger.debug("TomcatJSS: no password for " + tag);
return;
}
Password password = new Password(strPassword.toCharArray());
try {
token.login(password);
return;
} catch (IncorrectPasswordException e) {
logger.warn("TomcatJSS: incorrect password");
iteration ++;
} finally {
password.clear();
}
} while (iteration < MAX_LOGIN_ATTEMPTS);
logger.error("TomcatJSS: failed to log into " + tag);
}
public CryptoToken getToken(String tag) throws Exception {
if (tag.equals("internal")) {
return manager.getInternalKeyStorageToken();
}
if (tag.startsWith("hardware-")) {
String tokenName = tag.substring(9);
return manager.getTokenByName(tokenName);
}
// non-token password entry
return null;
}
public void configureOCSP() throws Exception {
logger.info("configuring OCSP");
logger.debug("enableOCSP: " + enableOCSP);
if (!enableOCSP) {
return;
}
logger.debug("ocspResponderURL: " + ocspResponderURL);
if (StringUtils.isEmpty(ocspResponderURL)) {
ocspResponderURL = null;
}
logger.debug("ocspResponderCertNickname: " + ocspResponderCertNickname);
if (StringUtils.isEmpty(ocspResponderCertNickname)) {
ocspResponderCertNickname = null;
}
// Check to see if the ocsp url and nickname are both set or not set
if (ocspResponderURL == null && ocspResponderCertNickname != null) {
throw new Exception("Missing OCSP responder URL");
}
if (ocspResponderURL != null && ocspResponderCertNickname == null) {
throw new Exception("Missing OCSP responder certificate nickname");
}
manager.configureOCSP(
true,
ocspResponderURL,
ocspResponderCertNickname);
logger.debug("ocspCacheSize: " + ocspCacheSize);
logger.debug("ocspMinCacheEntryDuration: " + ocspMinCacheEntryDuration);
logger.debug("ocspMaxCacheEntryDuration: " + ocspMaxCacheEntryDuration);
manager.OCSPCacheSettings(ocspCacheSize,
ocspMinCacheEntryDuration,
ocspMaxCacheEntryDuration);
logger.debug("ocspTimeout: " + ocspTimeout);
manager.setOCSPTimeout(ocspTimeout);
}
/**
* Disables all SSL ciphers to start with a clean slate.
*/
public void unsetSSLCiphers() throws SocketException {
logger.debug("Disabling SSL ciphers:");
int[] cipherIDs = SSLSocket.getImplementedCipherSuites();
if (cipherIDs == null) return;
for (int cipherID : cipherIDs) {
StringBuilder sb = new StringBuilder();
sb.append("* 0x");
sb.append(Integer.toHexString(cipherID));
SSLCipher cipher = SSLCipher.valueOf(cipherID);
if (cipher != null) {
sb.append(": ");
sb.append(cipher.name());
}
logger.debug(sb.toString());
SSLSocket.setCipherPreferenceDefault(cipherID, false);
}
}
/**
* setSSLVersionRangeDefault sets the range of allowed SSL versions. This
* replaces the obsolete SSL_Option* API.
*
* @param protoVariant indicates whether this setting is for type "stream"
* or "datagram".
*
* @param sslVersionRange_s takes on the form of "min:max" where min/max
* values can be "ssl3, tls1_0, tls1_1, tls1_2, tls1_3". ssl2 is not
* supported for tomcatjss via this interface. The format is
* "sslVersionRange=min:max".
*/
public void setSSLVersionRangeDefault(
String type,
SSLProtocolVariant protoVariant,
String sslVersionRange_s) throws SocketException,
IllegalArgumentException, IOException {
String[] sslVersionRange = sslVersionRange_s.split(":");
if (sslVersionRange.length != 2) {
throw new SocketException("SSL version range format error: " + sslVersionRange_s);
}
String min_s = sslVersionRange[0];
String max_s = sslVersionRange[1];
logger.debug("Setting SSL version range for " + type + ":");
logger.debug("* min: " + min_s);
logger.debug("* max: " + max_s);
SSLVersion minVersion = SSLVersion.findByAlias(min_s);
SSLVersion maxVersion = SSLVersion.findByAlias(max_s);
SSLVersionRange range = new SSLVersionRange(minVersion, maxVersion);
range = SSLSocket.boundSSLVersionRange(SSLProtocolVariant.STREAM, range);
logger.debug("Actual SSL version range for " + type + " after system policy correction:");
logger.debug("* min: " + range.getMinVersion());
logger.debug("* max: " + range.getMaxVersion());
SSLSocket.setSSLVersionRangeDefault(protoVariant, range);
}
public void setSSLCiphers(String attr, String ciphers) throws SocketException, IOException {
if (StringUtils.isEmpty(ciphers)) {
logger.debug("Missing " + attr);
return;
}
logger.debug("Processing " + attr + ":");
StringTokenizer st = new StringTokenizer(ciphers, ", ");
while (st.hasMoreTokens()) {
String cipherStr = st.nextToken();
String name;
boolean enabled;
if (cipherStr.startsWith("+")) {
enabled = true;
name = cipherStr.substring(1);
} else if (cipherStr.startsWith("-")) {
enabled = false;
name = cipherStr.substring(1);
} else {
enabled = true; // no enable/disable flag, assume enable
name = cipherStr;
}
logger.debug("* " + name);
logger.debug(" enabled: " + enabled);
int cipherID;
if (name.startsWith("0x") || name.startsWith("0X")) {
// this allows us to specify new ciphers
try {
cipherID = Integer.parseInt(name.substring(2), 16);
} catch (Exception e) {
logger.error("Invalid SSL cipher: " + name);
continue;
}
} else {
try {
SSLCipher cipher = SSLCipher.valueOf(name);
cipherID = cipher.getID();
} catch (IllegalArgumentException e) {
logger.error("Unknown SSL cipher: " + name);
continue;
}
}
logger.debug(" ID: 0x" + Integer.toHexString(cipherID));
try {
SSLSocket.setCipherPreferenceDefault(cipherID, enabled);
} catch (Exception e) {
logger.warn("Unable to set SSL cipher preference: " + e);
SSLCipher cipher = SSLCipher.valueOf(cipherID);
if (cipher != null && cipher.isECC()) {
logger.warn("SSL ECC cipher \""
+ name
+ "\" unsupported by NSS. "
+ "This is probably O.K. unless ECC support has been installed.");
} else {
logger.error("SSL cipher \"" + name
+ "\" unsupported by NSS");
}
}
}
}
/**
* note: the SSL_OptionSet-based API for controlling the enabled protocol
* versions are obsolete and replaced by the setSSLVersionRange calls. If
* the "range" parameters are present in the attributes then the sslOptions
* parameter is ignored.
*/
public void setSSLOptions() throws SocketException, IOException {
if (StringUtils.isEmpty(sslOptions)) {
logger.debug("JSSSocketFactory: no sslOptions specified");
return;
}
logger.debug("JSSSocketFactory: Processing sslOptions:");
StringTokenizer st = new StringTokenizer(sslOptions, ", ");
while (st.hasMoreTokens()) {
String option = st.nextToken();
logger.debug("JSSSocketFactory: - " + option);
StringTokenizer st1 = new StringTokenizer(option, "=");
String name = st1.nextToken();
String value = st1.nextToken();
if (name.equals("ssl2")) {
if (value.equals("true")) {
SSLSocket.enableSSL2Default(true);
setSSLCiphers("ssl2Ciphers", ssl2Ciphers);
} else {
SSLSocket.enableSSL2Default(false);
}
}
if (name.equals("ssl3")) {
if (value.equals("true")) {
SSLSocket.enableSSL3Default(true);
setSSLCiphers("ssl3Ciphers", ssl3Ciphers);
} else {
SSLSocket.enableSSL3Default(false);
}
}
if (name.equals("tls")) {
if (value.equals("true")) {
SSLSocket.enableTLSDefault(true);
setSSLCiphers("tlsCiphers", tlsCiphers);
} else {
SSLSocket.enableTLSDefault(false);
}
}
}
}
@Override
public void alertReceived(SSLAlertEvent event) {
for (SSLSocketListener listener : socketListeners) {
listener.alertReceived(event);
}
}
@Override
public void alertSent(SSLAlertEvent event) {
for (SSLSocketListener listener : socketListeners) {
listener.alertSent(event);
}
}
@Override
public void handshakeCompleted(SSLHandshakeCompletedEvent event) {
for (SSLSocketListener listener : socketListeners) {
listener.handshakeCompleted(event);
}
}
}
tomcatjss-7.4.1/src/org/dogtagpki/ 0000775 0000000 0000000 00000000000 13500240455 0017057 5 ustar 00root root 0000000 0000000 tomcatjss-7.4.1/src/org/dogtagpki/tomcat/ 0000775 0000000 0000000 00000000000 13500240455 0020346 5 ustar 00root root 0000000 0000000 tomcatjss-7.4.1/src/org/dogtagpki/tomcat/Http11NioProtocol.java 0000664 0000000 0000000 00000012305 13500240455 0024463 0 ustar 00root root 0000000 0000000 package org.dogtagpki.tomcat;
import java.io.IOException;
import java.nio.file.Files;
import java.nio.file.Path;
import java.nio.file.Paths;
import org.apache.tomcat.util.net.jss.TomcatJSS;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
public class Http11NioProtocol extends org.apache.coyote.http11.Http11NioProtocol {
public static Logger logger = LoggerFactory.getLogger(Http11NioProtocol.class);
TomcatJSS tomcatjss = TomcatJSS.getInstance();
public String getCertdbDir() {
return tomcatjss.getCertdbDir();
}
public void setCertdbDir(String certdbDir) {
tomcatjss.setCertdbDir(certdbDir);
}
public String getPasswordClass() {
return tomcatjss.getPasswordClass();
}
public void setPasswordClass(String passwordClass) {
tomcatjss.setPasswordClass(passwordClass);
}
public String getPasswordFile() {
return tomcatjss.getPasswordFile();
}
public void setPasswordFile(String passwordFile) {
tomcatjss.setPasswordFile(passwordFile);
}
public String getServerCertNickFile() {
return tomcatjss.getServerCertNickFile();
}
public void setServerCertNickFile(String serverCertNickFile) {
tomcatjss.setServerCertNickFile(serverCertNickFile);
}
public boolean getEnabledOCSP() {
return tomcatjss.getEnableOCSP();
}
public void setEnableOCSP(boolean enableOCSP) {
tomcatjss.setEnableOCSP(enableOCSP);
}
public String getOcspResponderURL() {
return tomcatjss.getOcspResponderURL();
}
public void setOcspResponderURL(String ocspResponderURL) {
tomcatjss.setOcspResponderURL(ocspResponderURL);
}
public String getOcspResponderCertNickname() {
return tomcatjss.getOcspResponderCertNickname();
}
public void setOcspResponderCertNickname(String ocspResponderCertNickname) {
tomcatjss.setOcspResponderCertNickname(ocspResponderCertNickname);
}
public int getOcspCacheSize() {
return tomcatjss.getOcspCacheSize();
}
public void setOcspCacheSize(int ocspCacheSize) {
tomcatjss.setOcspCacheSize(ocspCacheSize);
}
public int getOcspMinCacheEntryDuration() {
return tomcatjss.getOcspMinCacheEntryDuration();
}
public void setOcspMinCacheEntryDuration(int ocspMinCacheEntryDuration) {
tomcatjss.setOcspMinCacheEntryDuration(ocspMinCacheEntryDuration);
}
public int getOcspMaxCacheEntryDuration() {
return tomcatjss.getOcspMaxCacheEntryDuration();
}
public void setOcspMaxCacheEntryDuration(int ocspMaxCacheEntryDuration) {
tomcatjss.setOcspMaxCacheEntryDuration(ocspMaxCacheEntryDuration);
}
public int getOcspTimeout() {
return tomcatjss.getOcspTimeout();
}
public void setOcspTimeout(int ocspTimeout) {
tomcatjss.setOcspTimeout(ocspTimeout);
}
public String getStrictCiphers() {
return tomcatjss.getStrictCiphers();
}
public void setStrictCiphers(String strictCiphers) {
tomcatjss.setStrictCiphers(strictCiphers);
}
public String getSslVersionRangeStream() {
return tomcatjss.getSslVersionRangeStream();
}
public void setSslVersionRangeStream(String sslVersionRangeStream) {
tomcatjss.setSslVersionRangeStream(sslVersionRangeStream);
}
public String getSslVersionRangeDatagram() {
return tomcatjss.getSslVersionRangeDatagram();
}
public void setSslVersionRangeDatagram(String sslVersionRangeDatagram) {
tomcatjss.setSslVersionRangeDatagram(sslVersionRangeDatagram);;
}
public String getSslRangeCiphers() {
return tomcatjss.getSslRangeCiphers();
}
public void setSslRangeCiphers(String sslRangeCiphers) {
tomcatjss.setSslRangeCiphers(sslRangeCiphers);
}
public String getSslOptions() {
return tomcatjss.getSslOptions();
}
public void setSslOptions(String sslOptions) {
tomcatjss.setSslOptions(sslOptions);
}
public String getSsl2Ciphers() {
return tomcatjss.getSsl2Ciphers();
}
public void setSsl2Ciphers(String ssl2Ciphers) {
tomcatjss.setSsl2Ciphers(ssl2Ciphers);
}
public String getSsl3Ciphers() {
return tomcatjss.getSsl3Ciphers();
}
public void setSsl3Ciphers(String ssl3Ciphers) {
tomcatjss.setSsl3Ciphers(ssl3Ciphers);
}
public String getTlsCiphers() {
return tomcatjss.getTlsCiphers();
}
public void setTlsCiphers(String tlsCiphers) {
tomcatjss.setTlsCiphers(tlsCiphers);
}
public void setKeystorePassFile(String keystorePassFile) {
try {
Path path = Paths.get(keystorePassFile);
String password = new String(Files.readAllBytes(path)).trim();
setKeystorePass(password);
} catch (IOException e) {
throw new RuntimeException(e);
}
}
public void setTruststorePassFile(String truststorePassFile) {
try {
Path path = Paths.get(truststorePassFile);
String password = new String(Files.readAllBytes(path)).trim();
setTruststorePass(password);
} catch (IOException e) {
throw new RuntimeException(e);
}
}
}
tomcatjss-7.4.1/src/org/dogtagpki/tomcat/JSSKeyManager.java 0000664 0000000 0000000 00000011563 13500240455 0023622 0 ustar 00root root 0000000 0000000 /* BEGIN COPYRIGHT BLOCK
* This library is free software; you can redistribute it and/or
* modify it under the terms of the GNU Lesser General Public
* License as published by the Free Software Foundation; either
* version 2.1 of the License, or (at your option) any later version.
*
* This library is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
* Lesser General Public License for more details.
*
* You should have received a copy of the GNU Lesser General Public
* License along with this library; if not, write to the Free Software
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
*
* Copyright (C) 2017 Red Hat, Inc.
* All rights reserved.
* END COPYRIGHT BLOCK */
package org.dogtagpki.tomcat;
import java.net.Socket;
import java.security.Principal;
import java.security.PrivateKey;
import java.security.cert.X509Certificate;
import java.util.ArrayList;
import java.util.Collection;
import javax.net.ssl.X509KeyManager;
import org.mozilla.jss.CryptoManager;
import org.mozilla.jss.crypto.ObjectNotFoundException;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import sun.security.x509.X509CertImpl;
public class JSSKeyManager implements X509KeyManager {
final static Logger logger = LoggerFactory.getLogger(JSSKeyManager.class);
@Override
public String chooseClientAlias(String[] keyTypes, Principal[] issuers, Socket socket) {
logger.debug("JSSKeyManager: chooseClientAlias()");
logger.debug("JSSKeyManager: key types:");
for (String keyType : keyTypes) {
logger.debug("JSSKeyManager: - " + keyType);
}
logger.debug("JSSKeyManager: issuers:");
for (Principal issuer : issuers) {
logger.debug("JSSKeyManager: - " + issuer.getName());
}
return null; // not implemented
}
@Override
public String chooseServerAlias(String keyType, Principal[] issuers, Socket socket) {
logger.debug("JSSKeyManager: chooseServerAlias()");
logger.debug("JSSKeyManager: key type: " + keyType);
logger.debug("JSSKeyManager: issuers:");
for (Principal issuer : issuers) {
logger.debug("JSSKeyManager: - " + issuer.getName());
}
return null; // not implemented
}
@Override
public X509Certificate[] getCertificateChain(String alias) {
logger.debug("JSSKeyManager: getCertificateChain(" + alias + ")");
try {
CryptoManager cm = CryptoManager.getInstance();
org.mozilla.jss.crypto.X509Certificate cert = cm.findCertByNickname(alias);
org.mozilla.jss.crypto.X509Certificate[] chain = cm.buildCertificateChain(cert);
logger.debug("JSSKeyManager: cert chain:");
Collection list = new ArrayList<>();
for (org.mozilla.jss.crypto.X509Certificate c : chain) {
logger.debug("JSSKeyManager: - " + c.getSubjectDN());
list.add(new X509CertImpl(c.getEncoded()));
}
return list.toArray(new X509Certificate[list.size()]);
} catch (Throwable e) {
logger.error(e.getMessage(), e);
throw new RuntimeException(e);
}
}
@Override
public String[] getClientAliases(String keyType, Principal[] issuers) {
logger.debug("JSSKeyManager: getClientAliases()");
logger.debug("JSSKeyManager: key type: " + keyType);
logger.debug("JSSKeyManager: issuers:");
for (Principal issuer : issuers) {
logger.debug("JSSKeyManager: - " + issuer.getName());
}
return null; // not implemented
}
@Override
public PrivateKey getPrivateKey(String alias) {
logger.debug("JSSKeyManager: getPrivateKey(" + alias + ")");
try {
CryptoManager cm = CryptoManager.getInstance();
org.mozilla.jss.crypto.X509Certificate cert = cm.findCertByNickname(alias);
PrivateKey privateKey = cm.findPrivKeyByCert(cert);
logger.debug("JSSKeyManager: key found: " + alias);
return privateKey;
} catch (ObjectNotFoundException e) {
logger.debug("JSSKeyManager: key not found: " + alias);
return null;
} catch (Throwable e) {
logger.error(e.getMessage(), e);
throw new RuntimeException(e);
}
}
@Override
public String[] getServerAliases(String keyType, Principal[] issuers) {
logger.debug("JSSKeyManager: getServerAliases()");
logger.debug("JSSKeyManager: key type: " + keyType);
logger.debug("JSSKeyManager: issuers:");
for (Principal issuer : issuers) {
logger.debug("JSSKeyManager: - " + issuer.getName());
}
return null; // not implemented
}
}
tomcatjss-7.4.1/src/org/dogtagpki/tomcat/JSSListener.java 0000664 0000000 0000000 00000005020 13500240455 0023353 0 ustar 00root root 0000000 0000000 /* BEGIN COPYRIGHT BLOCK
* This library is free software; you can redistribute it and/or
* modify it under the terms of the GNU Lesser General Public
* License as published by the Free Software Foundation; either
* version 2.1 of the License, or (at your option) any later version.
*
* This library is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
* Lesser General Public License for more details.
*
* You should have received a copy of the GNU Lesser General Public
* License along with this library; if not, write to the Free Software
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
*
* Copyright (C) 2019 Red Hat, Inc.
* All rights reserved.
* END COPYRIGHT BLOCK */
package org.dogtagpki.tomcat;
import java.io.File;
import org.apache.catalina.Lifecycle;
import org.apache.catalina.LifecycleEvent;
import org.apache.catalina.LifecycleListener;
import org.apache.tomcat.util.net.jss.TomcatJSS;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
public class JSSListener implements LifecycleListener {
final static Logger logger = LoggerFactory.getLogger(JSSListener.class);
public String configFile;
public String getConfigFile() {
return configFile;
}
public void setConfigFile(String configFile) {
this.configFile = configFile;
}
@Override
public void lifecycleEvent(LifecycleEvent event) {
String type = event.getType();
if (type.equals(Lifecycle.BEFORE_INIT_EVENT)) {
initJSS();
}
}
public void initJSS() {
logger.info("JSSListener: Initializing JSS");
try {
TomcatJSS tomcatjss = TomcatJSS.getInstance();
String catalinaBase = System.getProperty("catalina.base");
String jssConf = catalinaBase + "/conf/jss.conf";
File configFile = new File(jssConf);
if (configFile.exists()) {
logger.info("JSSListener: Loading JSS configuration from " + jssConf);
tomcatjss.loadJSSConfig(configFile);
} else {
String serverXml = catalinaBase + "/conf/server.xml";
logger.info("JSSListener: Loading JSS configuration from " + serverXml);
tomcatjss.loadTomcatConfig(serverXml);
}
tomcatjss.init();
} catch (Exception e) {
throw new RuntimeException(e);
}
}
}
tomcatjss-7.4.1/src/org/dogtagpki/tomcat/JSSTrustManager.java 0000664 0000000 0000000 00000015662 13500240455 0024217 0 ustar 00root root 0000000 0000000 /* BEGIN COPYRIGHT BLOCK
* This library is free software; you can redistribute it and/or
* modify it under the terms of the GNU Lesser General Public
* License as published by the Free Software Foundation; either
* version 2.1 of the License, or (at your option) any later version.
*
* This library is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
* Lesser General Public License for more details.
*
* You should have received a copy of the GNU Lesser General Public
* License along with this library; if not, write to the Free Software
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
*
* Copyright (C) 2017 Red Hat, Inc.
* All rights reserved.
* END COPYRIGHT BLOCK */
package org.dogtagpki.tomcat;
import java.security.cert.CertificateException;
import java.security.cert.X509Certificate;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.Collection;
import java.util.List;
import javax.net.ssl.X509TrustManager;
import org.mozilla.jss.CryptoManager;
import org.mozilla.jss.NotInitializedException;
import org.mozilla.jss.netscape.security.util.Cert;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import sun.security.x509.X509CertImpl;
public class JSSTrustManager implements X509TrustManager {
final static Logger logger = LoggerFactory.getLogger(JSSTrustManager.class);
final static String SERVER_AUTH_OID = "1.3.6.1.5.5.7.3.1";
final static String CLIENT_AUTH_OID = "1.3.6.1.5.5.7.3.2";
public void checkCertChain(X509Certificate[] certChain, String keyUsage) throws Exception {
logger.debug("JSSTrustManager: checkCertChain(" + keyUsage + ")");
// sort cert chain from root to leaf
certChain = Cert.sortCertificateChain(certChain);
for (X509Certificate cert : certChain) {
logger.debug("JSSTrustManager: - " + cert.getSubjectDN());
}
// get CA certs
X509Certificate[] caCerts = getAcceptedIssuers();
// validating cert chain from root to leaf
for (int i = 0; i < certChain.length; i++) {
X509Certificate cert = certChain[i];
// validating key usage on leaf cert only
String usage;
if (i == certChain.length - 1) {
usage = keyUsage;
} else {
usage = null;
}
checkCert(cert, caCerts, usage);
// use the current cert as the CA cert for the next cert in the chain
caCerts = new X509Certificate[] { cert };
}
}
public void checkCert(X509Certificate cert, X509Certificate[] caCerts, String keyUsage) throws Exception {
logger.debug("JSSTrustManager: checkCert(" + cert.getSubjectDN() + "):");
boolean[] aki = cert.getIssuerUniqueID();
logger.debug("JSSTrustManager: cert AKI: " + Arrays.toString(aki));
X509Certificate issuer = null;
for (X509Certificate caCert : caCerts) {
boolean[] ski = caCert.getSubjectUniqueID();
logger.debug("JSSTrustManager: SKI of " + caCert.getSubjectDN() + ": " + Arrays.toString(ski));
try {
cert.verify(caCert.getPublicKey(), "Mozilla-JSS");
issuer = caCert;
break;
} catch (Exception e) {
logger.debug("JSSTrustManager: invalid certificate: " + e);
}
}
if (issuer == null) {
throw new CertificateException("Unable to validate signature: " + cert.getSubjectDN());
}
logger.debug("JSSTrustManager: cert signed by " + issuer.getSubjectDN());
logger.debug("JSSTrustManager: checking validity range:");
logger.debug("JSSTrustManager: - not before: " + cert.getNotBefore());
logger.debug("JSSTrustManager: - not after: " + cert.getNotAfter());
cert.checkValidity();
if (keyUsage != null) {
List extendedKeyUsages = cert.getExtendedKeyUsage();
logger.debug("JSSTrustManager: checking extended key usages:");
for (String extKeyUsage : extendedKeyUsages) {
logger.debug("JSSTrustManager: - " + extKeyUsage);
}
if (extendedKeyUsages.contains(keyUsage)) {
logger.debug("JSSTrustManager: extended key usage found: " + keyUsage);
} else {
throw new CertificateException("Missing extended key usage: " + keyUsage);
}
}
}
@Override
public void checkClientTrusted(X509Certificate[] certChain, String authType) throws CertificateException {
logger.debug("JSSTrustManager: checkClientTrusted(" + authType + "):");
try {
checkCertChain(certChain, CLIENT_AUTH_OID);
logger.debug("JSSTrustManager: SSL client certificate is valid");
} catch (CertificateException e) {
logger.warn("JSSTrustManager: Invalid SSL client certificate: " + e);
throw e;
} catch (Exception e) {
logger.warn("JSSTrustManager: Unable to validate certificate: " + e);
throw new CertificateException(e);
}
}
@Override
public void checkServerTrusted(X509Certificate[] certChain, String authType) throws CertificateException {
logger.debug("JSSTrustManager: checkServerTrusted(" + certChain.length + ", " + authType + "):");
try {
checkCertChain(certChain, SERVER_AUTH_OID);
logger.debug("JSSTrustManager: SSL server certificate is valid");
} catch (CertificateException e) {
logger.warn("JSSTrustManager: Invalid SSL server certificate: " + e);
throw e;
} catch (Exception e) {
logger.warn("JSSTrustManager: Unable to validate SSL server certificate: " + e);
throw new CertificateException(e);
}
}
@Override
public X509Certificate[] getAcceptedIssuers() {
logger.debug("JSSTrustManager: getAcceptedIssuers():");
Collection caCerts = new ArrayList<>();
try {
CryptoManager manager = CryptoManager.getInstance();
for (org.mozilla.jss.crypto.X509Certificate cert : manager.getCACerts()) {
logger.debug("JSSTrustManager: - " + cert.getSubjectDN());
try {
X509CertImpl caCert = new X509CertImpl(cert.getEncoded());
caCert.checkValidity();
caCerts.add(caCert);
} catch (Exception e) {
logger.debug("JSSTrustManager: invalid CA certificate: " + e);
}
}
} catch (NotInitializedException e) {
logger.error("JSSTrustManager: Unable to get CryptoManager: " + e, e);
throw new RuntimeException(e);
}
return caCerts.toArray(new X509Certificate[caCerts.size()]);
}
}
tomcatjss-7.4.1/tomcat-7.0/ 0000775 0000000 0000000 00000000000 13500240455 0015321 5 ustar 00root root 0000000 0000000 tomcatjss-7.4.1/tomcat-7.0/src/ 0000775 0000000 0000000 00000000000 13500240455 0016110 5 ustar 00root root 0000000 0000000 tomcatjss-7.4.1/tomcat-7.0/src/org/ 0000775 0000000 0000000 00000000000 13500240455 0016677 5 ustar 00root root 0000000 0000000 tomcatjss-7.4.1/tomcat-7.0/src/org/apache/ 0000775 0000000 0000000 00000000000 13500240455 0020120 5 ustar 00root root 0000000 0000000 tomcatjss-7.4.1/tomcat-7.0/src/org/apache/tomcat/ 0000775 0000000 0000000 00000000000 13500240455 0021407 5 ustar 00root root 0000000 0000000 tomcatjss-7.4.1/tomcat-7.0/src/org/apache/tomcat/util/ 0000775 0000000 0000000 00000000000 13500240455 0022364 5 ustar 00root root 0000000 0000000 tomcatjss-7.4.1/tomcat-7.0/src/org/apache/tomcat/util/net/ 0000775 0000000 0000000 00000000000 13500240455 0023152 5 ustar 00root root 0000000 0000000 tomcatjss-7.4.1/tomcat-7.0/src/org/apache/tomcat/util/net/jss/ 0000775 0000000 0000000 00000000000 13500240455 0023751 5 ustar 00root root 0000000 0000000 tomcatjss-7.4.1/tomcat-7.0/src/org/apache/tomcat/util/net/jss/IJSSFactory.java 0000664 0000000 0000000 00000002402 13500240455 0026712 0 ustar 00root root 0000000 0000000 /* BEGIN COPYRIGHT BLOCK
* This library is free software; you can redistribute it and/or
* modify it under the terms of the GNU Lesser General Public
* License as published by the Free Software Foundation; either
* version 2.1 of the License, or (at your option) any later version.
*
* This library is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
* Lesser General Public License for more details.
*
* You should have received a copy of the GNU Lesser General Public
* License along with this library; if not, write to the Free Software
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
*
* Copyright (C) 2007 Red Hat, Inc.
* All rights reserved.
* END COPYRIGHT BLOCK */
package org.apache.tomcat.util.net.jss;
import java.net.Socket;
import java.util.Properties;
import org.apache.tomcat.util.net.AbstractEndpoint;
import org.apache.tomcat.util.net.SSLSupport;
import org.apache.tomcat.util.net.ServerSocketFactory;
interface IJSSFactory {
public ServerSocketFactory getSocketFactory(AbstractEndpoint endpoint, Properties config);
public SSLSupport getSSLSupport(Socket socket);
}
tomcatjss-7.4.1/tomcat-7.0/src/org/apache/tomcat/util/net/jss/JSSFactory.java 0000664 0000000 0000000 00000002714 13500240455 0026607 0 ustar 00root root 0000000 0000000 /* BEGIN COPYRIGHT BLOCK
* This library is free software; you can redistribute it and/or
* modify it under the terms of the GNU Lesser General Public
* License as published by the Free Software Foundation; either
* version 2.1 of the License, or (at your option) any later version.
*
* This library is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
* Lesser General Public License for more details.
*
* You should have received a copy of the GNU Lesser General Public
* License along with this library; if not, write to the Free Software
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
*
* Copyright (C) 2007 Red Hat, Inc.
* All rights reserved.
* END COPYRIGHT BLOCK */
package org.apache.tomcat.util.net.jss;
import java.net.Socket;
import java.util.Properties;
import org.apache.tomcat.util.net.AbstractEndpoint;
import org.apache.tomcat.util.net.SSLSupport;
import org.apache.tomcat.util.net.ServerSocketFactory;
import org.mozilla.jss.ssl.SSLSocket;
class JSSFactory implements IJSSFactory {
JSSFactory() {
}
public ServerSocketFactory getSocketFactory(AbstractEndpoint endpoint, Properties config) {
return new JSSSocketFactory(endpoint, config);
}
public SSLSupport getSSLSupport(Socket socket) {
return new JSSSupport((SSLSocket) socket);
}
}
tomcatjss-7.4.1/tomcat-7.0/src/org/apache/tomcat/util/net/jss/JSSImplementation.java 0000664 0000000 0000000 00000010150 13500240455 0030156 0 ustar 00root root 0000000 0000000 /* BEGIN COPYRIGHT BLOCK
* This library is free software; you can redistribute it and/or
* modify it under the terms of the GNU Lesser General Public
* License as published by the Free Software Foundation; either
* version 2.1 of the License, or (at your option) any later version.
*
* This library is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
* Lesser General Public License for more details.
*
* You should have received a copy of the GNU Lesser General Public
* License along with this library; if not, write to the Free Software
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
*
* Copyright (C) 2007 Red Hat, Inc.
* All rights reserved.
* END COPYRIGHT BLOCK */
package org.apache.tomcat.util.net.jss;
import java.io.FileNotFoundException;
import java.io.FileReader;
import java.io.IOException;
import java.net.Socket;
import java.util.Properties;
import org.apache.tomcat.util.net.AbstractEndpoint;
import org.apache.tomcat.util.net.SSLImplementation;
import org.apache.tomcat.util.net.SSLSupport;
import org.apache.tomcat.util.net.SSLUtil;
import org.apache.tomcat.util.net.ServerSocketFactory;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
public class JSSImplementation extends SSLImplementation {
public static Logger logger = LoggerFactory.getLogger(JSSImplementation.class);
static final String JSSFactory = "org.apache.tomcat.util.net.jss.JSSFactory";
static final String SSLSocketClass = "org.mozilla.jss.ssl.SSLSocket";
private JSSFactory factory = null;
public JSSImplementation() throws ClassNotFoundException {
Class.forName(SSLSocketClass);
try {
Class factcl = Class.forName(JSSFactory);
factory = (JSSFactory) factcl.newInstance();
} catch (Exception e) {
logger.error("Error getting factory: " + JSSFactory, e);
}
}
public String getImplementationName() {
return "JSS";
}
public ServerSocketFactory getServerSocketFactory(AbstractEndpoint endpoint) {
Properties config = new Properties();
try {
String configFile = System.getProperty("catalina.base") + "/conf/tomcatjss.conf";
config.load(new FileReader(configFile));
} catch (FileNotFoundException e) {
// ignore
} catch (IOException e) {
throw new RuntimeException(e);
}
return factory.getSocketFactory(endpoint, config);
}
public SSLSupport getSSLSupport(Socket s) {
SSLSupport ssls = null;
ssls = factory.getSSLSupport(s);
return ssls;
}
public SSLSupport getSSLSupport(javax.net.ssl.SSLSession session) {
/*
* The Tomcat 6.0.26 docs says: This method has been deprecated since it
* adds a JSSE dependency to this interface. It will be removed in
* versions after 6.0.x.
*
* But we have to provide a implementation of this method because it's
* declared as abstract.
*
* Unfortunately there does not appear to be any way to get SSLSupport
* information from a session with JSS. JSS looks up the information
* based on a socket, not a session. This done in SSLSocket.c
* Java_org_mozilla_jss_ssl_SSLSocket_getStatus().
*
* So while it would be nice to provide a working implmentation there
* doesn't seem to be an easy way to do this. Given that this method is
* already deprecated and there hasn't been any evidence of it being
* called it therefore seems reasonable to just return null to satify
* the compiler's demand for an implementation.
*
* Once this abstract method is removed from SSLImplementation in a
* future release we can remove this stub.
*
* NOTE: This method has NOT yet been deprecated in Tomcat 7!
*/
return null;
}
public SSLUtil getSSLUtil(AbstractEndpoint endpoint) {
return null;
}
}
tomcatjss-7.4.1/tomcat-7.0/src/org/apache/tomcat/util/net/jss/JSSSocketFactory.java 0000664 0000000 0000000 00000023156 13500240455 0027763 0 ustar 00root root 0000000 0000000 /* BEGIN COPYRIGHT BLOCK
* This library is free software; you can redistribute it and/or
* modify it under the terms of the GNU Lesser General Public
* License as published by the Free Software Foundation; either
* version 2.1 of the License, or (at your option) any later version.
*
* This library is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
* Lesser General Public License for more details.
*
* You should have received a copy of the GNU Lesser General Public
* License along with this library; if not, write to the Free Software
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
*
* Copyright (C) 2007 Red Hat, Inc.
* All rights reserved.
* END COPYRIGHT BLOCK */
package org.apache.tomcat.util.net.jss;
import java.io.IOException;
import java.net.InetAddress;
import java.net.ServerSocket;
import java.net.Socket;
import java.net.SocketException;
import java.util.Properties;
import javax.net.ssl.KeyManager;
import javax.net.ssl.SSLContext;
import javax.net.ssl.TrustManager;
// Imports required to "implement" Tomcat 7 Interface
import org.apache.tomcat.util.net.AbstractEndpoint;
import org.mozilla.jss.ssl.SSLServerSocket;
import org.mozilla.jss.ssl.SSLSocket;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
public class JSSSocketFactory implements
org.apache.tomcat.util.net.ServerSocketFactory,
org.apache.tomcat.util.net.SSLUtil {
public static Logger logger = LoggerFactory.getLogger(JSSSocketFactory.class);
TomcatJSS tomcatjss = TomcatJSS.getInstance();
private AbstractEndpoint endpoint;
private Properties config;
public JSSSocketFactory(AbstractEndpoint endpoint) {
this(endpoint, null);
}
public JSSSocketFactory(AbstractEndpoint endpoint, Properties config) {
this.endpoint = endpoint;
this.config = config;
try {
init();
} catch (IOException e) {
throw new RuntimeException(e);
}
}
String getProperty(String tag) {
// check /conf/server.xml
String value = (String)endpoint.getAttribute(tag);
// if not available, check /conf/tomcatjss.conf
if (value == null) {
value = config.getProperty(tag);
}
return value;
}
String getProperty(String tag, String defaultValue) {
String value = getProperty(tag);
if (value == null) {
return defaultValue;
}
return value;
}
void init() throws IOException {
try {
String certdbDir = getProperty("certdbDir");
tomcatjss.setCertdbDir(certdbDir);
String passwordClass = getProperty("passwordClass");
tomcatjss.setPasswordClass(passwordClass);
String passwordFile = getProperty("passwordFile");
tomcatjss.setPasswordFile(passwordFile);
String serverCertNickFile = getProperty("serverCertNickFile");
tomcatjss.setServerCertNickFile(serverCertNickFile);
// MUST look for "clientauth" (ALL lowercase) since "clientAuth"
// (camel case) has already been processed by Tomcat 7
String clientAuth = getProperty("clientauth");
if (clientAuth != null) {
tomcatjss.setClientAuth(clientAuth);
}
String strEnableOCSP = getProperty("enableOCSP");
boolean enableOCSP = Boolean.parseBoolean(strEnableOCSP);
tomcatjss.setEnableOCSP(enableOCSP);
String ocspResponderURL = getProperty("ocspResponderURL");
tomcatjss.setOcspResponderURL(ocspResponderURL);
String ocspResponderCertNickname = getProperty("ocspResponderCertNickname");
tomcatjss.setOcspResponderCertNickname(ocspResponderCertNickname);
String strOcspCacheSize = getProperty("ocspCacheSize");
if (strOcspCacheSize != null) {
int ocspCacheSize = Integer.parseInt(strOcspCacheSize);
tomcatjss.setOcspCacheSize(ocspCacheSize);
}
String strOcspMinCacheEntryDuration = getProperty("ocspMinCacheEntryDuration");
if (strOcspMinCacheEntryDuration != null) {
int ocspMinCacheEntryDuration = Integer.parseInt(strOcspMinCacheEntryDuration);
tomcatjss.setOcspMinCacheEntryDuration(ocspMinCacheEntryDuration);
}
String strOcspMaxCacheEntryDuration = getProperty("ocspMaxCacheEntryDuration");
if (strOcspMaxCacheEntryDuration != null) {
int ocspMaxCacheEntryDuration = Integer.parseInt(strOcspMaxCacheEntryDuration);
tomcatjss.setOcspMaxCacheEntryDuration(ocspMaxCacheEntryDuration);
}
String strOcspTimeout = getProperty("ocspTimeout");
if (strOcspTimeout != null) {
int ocspTimeout = Integer.parseInt(strOcspTimeout);
tomcatjss.setOcspTimeout(ocspTimeout);
}
String strictCiphers = getProperty("strictCiphers");
tomcatjss.setStrictCiphers(strictCiphers);
String sslVersionRangeStream = getProperty("sslVersionRangeStream");
tomcatjss.setSslVersionRangeStream(sslVersionRangeStream);
String sslVersionRangeDatagram = getProperty("sslVersionRangeDatagram");
tomcatjss.setSslVersionRangeDatagram(sslVersionRangeDatagram);
String sslRangeCiphers = getProperty("sslRangeCiphers");
tomcatjss.setSslRangeCiphers(sslRangeCiphers);
String sslOptions = getProperty("sslOptions");
tomcatjss.setSslOptions(sslOptions);
String ssl2Ciphers = getProperty("ssl2Ciphers");
tomcatjss.setSsl2Ciphers(ssl2Ciphers);
String ssl3Ciphers = getProperty("ssl3Ciphers");
tomcatjss.setSsl3Ciphers(ssl3Ciphers);
String tlsCiphers = getProperty("tlsCiphers");
tomcatjss.setTlsCiphers(tlsCiphers);
tomcatjss.init();
} catch (Exception ex) {
logger.error("JSSSocketFactory: " + ex);
// The idea is, if admin take the trouble to configure the
// ocsp cache, and made a mistake, we want to make server
// unavailable until they get it right
if ((ex instanceof java.security.GeneralSecurityException)
|| (ex instanceof java.lang.NumberFormatException))
throw new IOException(ex);
}
}
public Socket acceptSocket(ServerSocket socket) throws IOException {
SSLSocket asock = null;
try {
asock = (SSLSocket) socket.accept();
asock.addSocketListener(tomcatjss);
if (tomcatjss.getRequireClientAuth() || tomcatjss.getWantClientAuth()) {
asock.requestClientAuth(true);
if (tomcatjss.getRequireClientAuth()) {
asock.requireClientAuth(SSLSocket.SSL_REQUIRE_ALWAYS);
} else {
asock.requireClientAuth(SSLSocket.SSL_REQUIRE_NEVER);
}
}
} catch (Exception e) {
throw new SocketException("SSL handshake error " + e.toString());
}
return asock;
}
public void handshake(Socket sock) throws IOException {
// ((SSLSocket)sock).forceHandshake();
}
public ServerSocket createSocket(int port) throws IOException {
return createSocket(port, SSLServerSocket.DEFAULT_BACKLOG, null);
}
public ServerSocket createSocket(int port, int backlog) throws IOException {
return createSocket(port, backlog, null);
}
public ServerSocket createSocket(int port, int backlog,
InetAddress ifAddress) throws IOException {
return createSocket(port, backlog, ifAddress, true);
}
public ServerSocket createSocket(int port, int backlog,
InetAddress ifAddress, boolean reuseAddr) throws IOException {
SSLServerSocket socket = null;
socket = new SSLServerSocket(port, backlog, ifAddress, null, reuseAddr);
initializeSocket(socket);
return socket;
}
private void initializeSocket(SSLServerSocket s) {
try {
/*
* Timeout's should not be enabled by default. Upper layers will
* call setSoTimeout() as needed. Zero means disable.
*/
s.setSoTimeout(0);
if (tomcatjss.getRequireClientAuth() || tomcatjss.getWantClientAuth()) {
s.requestClientAuth(true);
if (tomcatjss.getRequireClientAuth()) {
s.requireClientAuth(SSLSocket.SSL_REQUIRE_ALWAYS);
} else {
s.requireClientAuth(SSLSocket.SSL_REQUIRE_NEVER);
}
}
String serverCertNick = tomcatjss.getServerCertNick();
s.setServerCertNickname(serverCertNick);
} catch (Exception e) {
}
}
// Methods required to "implement" Tomcat 7 Interface
public SSLContext createSSLContext() throws Exception {
return null;
}
public KeyManager[] getKeyManagers() throws Exception {
return null;
}
public TrustManager[] getTrustManagers() throws Exception {
return null;
}
public void configureSessionContext(
javax.net.ssl.SSLSessionContext sslSessionContext) {
return;
}
public String[] getEnableableCiphers(SSLContext context) {
return null;
}
public String[] getEnableableProtocols(SSLContext context) {
return null;
}
}
tomcatjss-7.4.1/tomcat-7.0/src/org/apache/tomcat/util/net/jss/JSSSupport.java 0000664 0000000 0000000 00000006635 13500240455 0026662 0 ustar 00root root 0000000 0000000 /* BEGIN COPYRIGHT BLOCK
* This library is free software; you can redistribute it and/or
* modify it under the terms of the GNU Lesser General Public
* License as published by the Free Software Foundation; either
* version 2.1 of the License, or (at your option) any later version.
*
* This library is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
* Lesser General Public License for more details.
*
* You should have received a copy of the GNU Lesser General Public
* License along with this library; if not, write to the Free Software
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
*
* Copyright (C) 2007 Red Hat, Inc.
* All rights reserved.
* END COPYRIGHT BLOCK */
package org.apache.tomcat.util.net.jss;
import java.io.ByteArrayInputStream;
import java.io.IOException;
import java.security.cert.CertificateFactory;
import java.security.cert.X509Certificate;
import org.apache.tomcat.util.net.SSLSupport;
import org.mozilla.jss.ssl.SSLSecurityStatus;
import org.mozilla.jss.ssl.SSLSocket;
class JSSSupport implements SSLSupport {
private SSLSocket ssl = null;
private SSLSecurityStatus status = null;
JSSSupport(SSLSocket sock) {
ssl = sock;
try {
status = ssl.getStatus();
} catch (IOException e) {
}
}
public X509Certificate[] getPeerCertificateChain(boolean force)
throws IOException {
// retrieve the status when we need it. status cache
// the client certificate which may not be available
// at the creation of JSSSupport
status = ssl.getStatus();
if (status != null) {
org.mozilla.jss.crypto.X509Certificate peerCert = status
.getPeerCertificate();
if (peerCert == null) {
ssl.requireClientAuth(SSLSocket.SSL_REQUIRE_NO_ERROR);
try {
ssl.redoHandshake();
ssl.forceHandshake();
} catch (Exception e) {
}
status = ssl.getStatus();
peerCert = status.getPeerCertificate();
}
if (peerCert != null) {
X509Certificate[] certs = new X509Certificate[1];
try {
byte[] b = peerCert.getEncoded();
CertificateFactory cf = CertificateFactory
.getInstance("X.509");
ByteArrayInputStream stream = new ByteArrayInputStream(b);
certs[0] = (X509Certificate) cf.generateCertificate(stream);
} catch (Exception e) {
}
return certs;
}
}
return null;
}
public Object[] getPeerCertificateChain() throws IOException {
return getPeerCertificateChain(false);
}
public String getCipherSuite() throws IOException {
if (status != null)
return status.getCipher();
return null;
}
public Integer getKeySize() throws IOException {
if (status != null)
return (new Integer(status.getSessionKeySize()));
return null;
}
public String getProtocol() throws IOException {
return null;
}
public String getSessionId() throws IOException {
return null;
}
}
tomcatjss-7.4.1/tomcat-7.0/src/org/dogtagpki/ 0000775 0000000 0000000 00000000000 13500240455 0020650 5 ustar 00root root 0000000 0000000 tomcatjss-7.4.1/tomcat-7.0/src/org/dogtagpki/tomcat/ 0000775 0000000 0000000 00000000000 13500240455 0022137 5 ustar 00root root 0000000 0000000 tomcatjss-7.4.1/tomcat-7.0/src/org/dogtagpki/tomcat/Http11Protocol.java 0000664 0000000 0000000 00000012246 13500240455 0025612 0 ustar 00root root 0000000 0000000 package org.dogtagpki.tomcat;
import java.io.IOException;
import java.nio.file.Files;
import java.nio.file.Path;
import java.nio.file.Paths;
import java.util.logging.Logger;
import org.apache.tomcat.util.net.jss.TomcatJSS;
public class Http11Protocol extends org.apache.coyote.http11.Http11Protocol {
final static Logger logger = Logger.getLogger(Http11Protocol.class.getName());
TomcatJSS tomcatjss = TomcatJSS.getInstance();
public String getCertdbDir() {
return tomcatjss.getCertdbDir();
}
public void setCertdbDir(String certdbDir) {
tomcatjss.setCertdbDir(certdbDir);
}
public String getPasswordClass() {
return tomcatjss.getPasswordClass();
}
public void setPasswordClass(String passwordClass) {
tomcatjss.setPasswordClass(passwordClass);
}
public String getPasswordFile() {
return tomcatjss.getPasswordFile();
}
public void setPasswordFile(String passwordFile) {
tomcatjss.setPasswordFile(passwordFile);
}
public String getServerCertNickFile() {
return tomcatjss.getServerCertNickFile();
}
public void setServerCertNickFile(String serverCertNickFile) {
tomcatjss.setServerCertNickFile(serverCertNickFile);
}
public boolean getEnabledOCSP() {
return tomcatjss.getEnableOCSP();
}
public void setEnableOCSP(boolean enableOCSP) {
tomcatjss.setEnableOCSP(enableOCSP);
}
public String getOcspResponderURL() {
return tomcatjss.getOcspResponderURL();
}
public void setOcspResponderURL(String ocspResponderURL) {
tomcatjss.setOcspResponderURL(ocspResponderURL);
}
public String getOcspResponderCertNickname() {
return tomcatjss.getOcspResponderCertNickname();
}
public void setOcspResponderCertNickname(String ocspResponderCertNickname) {
tomcatjss.setOcspResponderCertNickname(ocspResponderCertNickname);
}
public int getOcspCacheSize() {
return tomcatjss.getOcspCacheSize();
}
public void setOcspCacheSize(int ocspCacheSize) {
tomcatjss.setOcspCacheSize(ocspCacheSize);
}
public int getOcspMinCacheEntryDuration() {
return tomcatjss.getOcspMinCacheEntryDuration();
}
public void setOcspMinCacheEntryDuration(int ocspMinCacheEntryDuration) {
tomcatjss.setOcspMinCacheEntryDuration(ocspMinCacheEntryDuration);
}
public int getOcspMaxCacheEntryDuration() {
return tomcatjss.getOcspMaxCacheEntryDuration();
}
public void setOcspMaxCacheEntryDuration(int ocspMaxCacheEntryDuration) {
tomcatjss.setOcspMaxCacheEntryDuration(ocspMaxCacheEntryDuration);
}
public int getOcspTimeout() {
return tomcatjss.getOcspTimeout();
}
public void setOcspTimeout(int ocspTimeout) {
tomcatjss.setOcspTimeout(ocspTimeout);
}
public String getStrictCiphers() {
return tomcatjss.getStrictCiphers();
}
public void setStrictCiphers(String strictCiphers) {
tomcatjss.setStrictCiphers(strictCiphers);
}
public String getSslVersionRangeStream() {
return tomcatjss.getSslVersionRangeStream();
}
public void setSslVersionRangeStream(String sslVersionRangeStream) {
tomcatjss.setSslVersionRangeStream(sslVersionRangeStream);
}
public String getSslVersionRangeDatagram() {
return tomcatjss.getSslVersionRangeDatagram();
}
public void setSslVersionRangeDatagram(String sslVersionRangeDatagram) {
tomcatjss.setSslVersionRangeDatagram(sslVersionRangeDatagram);;
}
public String getSslRangeCiphers() {
return tomcatjss.getSslRangeCiphers();
}
public void setSslRangeCiphers(String sslRangeCiphers) {
tomcatjss.setSslRangeCiphers(sslRangeCiphers);
}
public String getSslOptions() {
return tomcatjss.getSslOptions();
}
public void setSslOptions(String sslOptions) {
tomcatjss.setSslOptions(sslOptions);
}
public String getSsl2Ciphers() {
return tomcatjss.getSsl2Ciphers();
}
public void setSsl2Ciphers(String ssl2Ciphers) {
tomcatjss.setSsl2Ciphers(ssl2Ciphers);
}
public String getSsl3Ciphers() {
return tomcatjss.getSsl3Ciphers();
}
public void setSsl3Ciphers(String ssl3Ciphers) {
tomcatjss.setSsl3Ciphers(ssl3Ciphers);
}
public String getTlsCiphers() {
return tomcatjss.getTlsCiphers();
}
public void setTlsCiphers(String tlsCiphers) {
tomcatjss.setTlsCiphers(tlsCiphers);
}
public void setKeystorePassFile(String keystorePassFile) {
try {
Path path = Paths.get(keystorePassFile);
String password = new String(Files.readAllBytes(path)).trim();
setKeystorePass(password);
} catch (IOException e) {
throw new RuntimeException(e);
}
}
public void setTruststorePassFile(String truststorePassFile) {
try {
Path path = Paths.get(truststorePassFile);
String password = new String(Files.readAllBytes(path)).trim();
setTruststorePass(password);
} catch (IOException e) {
throw new RuntimeException(e);
}
}
}
tomcatjss-7.4.1/tomcat-8.0/ 0000775 0000000 0000000 00000000000 13500240455 0015322 5 ustar 00root root 0000000 0000000 tomcatjss-7.4.1/tomcat-8.0/src/ 0000775 0000000 0000000 00000000000 13500240455 0016111 5 ustar 00root root 0000000 0000000 tomcatjss-7.4.1/tomcat-8.0/src/org/ 0000775 0000000 0000000 00000000000 13500240455 0016700 5 ustar 00root root 0000000 0000000 tomcatjss-7.4.1/tomcat-8.0/src/org/apache/ 0000775 0000000 0000000 00000000000 13500240455 0020121 5 ustar 00root root 0000000 0000000 tomcatjss-7.4.1/tomcat-8.0/src/org/apache/tomcat/ 0000775 0000000 0000000 00000000000 13500240455 0021410 5 ustar 00root root 0000000 0000000 tomcatjss-7.4.1/tomcat-8.0/src/org/apache/tomcat/util/ 0000775 0000000 0000000 00000000000 13500240455 0022365 5 ustar 00root root 0000000 0000000 tomcatjss-7.4.1/tomcat-8.0/src/org/apache/tomcat/util/net/ 0000775 0000000 0000000 00000000000 13500240455 0023153 5 ustar 00root root 0000000 0000000 tomcatjss-7.4.1/tomcat-8.0/src/org/apache/tomcat/util/net/jss/ 0000775 0000000 0000000 00000000000 13500240455 0023752 5 ustar 00root root 0000000 0000000 tomcatjss-7.4.1/tomcat-8.0/src/org/apache/tomcat/util/net/jss/IJSSFactory.java 0000664 0000000 0000000 00000002402 13500240455 0026713 0 ustar 00root root 0000000 0000000 /* BEGIN COPYRIGHT BLOCK
* This library is free software; you can redistribute it and/or
* modify it under the terms of the GNU Lesser General Public
* License as published by the Free Software Foundation; either
* version 2.1 of the License, or (at your option) any later version.
*
* This library is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
* Lesser General Public License for more details.
*
* You should have received a copy of the GNU Lesser General Public
* License along with this library; if not, write to the Free Software
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
*
* Copyright (C) 2007 Red Hat, Inc.
* All rights reserved.
* END COPYRIGHT BLOCK */
package org.apache.tomcat.util.net.jss;
import java.net.Socket;
import java.util.Properties;
import org.apache.tomcat.util.net.AbstractEndpoint;
import org.apache.tomcat.util.net.SSLSupport;
import org.apache.tomcat.util.net.ServerSocketFactory;
interface IJSSFactory {
public ServerSocketFactory getSocketFactory(AbstractEndpoint endpoint, Properties config);
public SSLSupport getSSLSupport(Socket socket);
}
tomcatjss-7.4.1/tomcat-8.0/src/org/apache/tomcat/util/net/jss/JSSFactory.java 0000664 0000000 0000000 00000002714 13500240455 0026610 0 ustar 00root root 0000000 0000000 /* BEGIN COPYRIGHT BLOCK
* This library is free software; you can redistribute it and/or
* modify it under the terms of the GNU Lesser General Public
* License as published by the Free Software Foundation; either
* version 2.1 of the License, or (at your option) any later version.
*
* This library is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
* Lesser General Public License for more details.
*
* You should have received a copy of the GNU Lesser General Public
* License along with this library; if not, write to the Free Software
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
*
* Copyright (C) 2007 Red Hat, Inc.
* All rights reserved.
* END COPYRIGHT BLOCK */
package org.apache.tomcat.util.net.jss;
import java.net.Socket;
import java.util.Properties;
import org.apache.tomcat.util.net.AbstractEndpoint;
import org.apache.tomcat.util.net.SSLSupport;
import org.apache.tomcat.util.net.ServerSocketFactory;
import org.mozilla.jss.ssl.SSLSocket;
class JSSFactory implements IJSSFactory {
JSSFactory() {
}
public ServerSocketFactory getSocketFactory(AbstractEndpoint endpoint, Properties config) {
return new JSSSocketFactory(endpoint, config);
}
public SSLSupport getSSLSupport(Socket socket) {
return new JSSSupport((SSLSocket) socket);
}
}
tomcatjss-7.4.1/tomcat-8.0/src/org/apache/tomcat/util/net/jss/JSSImplementation.java 0000664 0000000 0000000 00000010150 13500240455 0030157 0 ustar 00root root 0000000 0000000 /* BEGIN COPYRIGHT BLOCK
* This library is free software; you can redistribute it and/or
* modify it under the terms of the GNU Lesser General Public
* License as published by the Free Software Foundation; either
* version 2.1 of the License, or (at your option) any later version.
*
* This library is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
* Lesser General Public License for more details.
*
* You should have received a copy of the GNU Lesser General Public
* License along with this library; if not, write to the Free Software
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
*
* Copyright (C) 2007 Red Hat, Inc.
* All rights reserved.
* END COPYRIGHT BLOCK */
package org.apache.tomcat.util.net.jss;
import java.io.FileNotFoundException;
import java.io.FileReader;
import java.io.IOException;
import java.net.Socket;
import java.util.Properties;
import org.apache.tomcat.util.net.AbstractEndpoint;
import org.apache.tomcat.util.net.SSLImplementation;
import org.apache.tomcat.util.net.SSLSupport;
import org.apache.tomcat.util.net.SSLUtil;
import org.apache.tomcat.util.net.ServerSocketFactory;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
public class JSSImplementation extends SSLImplementation {
public static Logger logger = LoggerFactory.getLogger(JSSImplementation.class);
static final String JSSFactory = "org.apache.tomcat.util.net.jss.JSSFactory";
static final String SSLSocketClass = "org.mozilla.jss.ssl.SSLSocket";
private JSSFactory factory = null;
public JSSImplementation() throws ClassNotFoundException {
Class.forName(SSLSocketClass);
try {
Class factcl = Class.forName(JSSFactory);
factory = (JSSFactory) factcl.newInstance();
} catch (Exception e) {
logger.error("Error getting factory: " + JSSFactory, e);
}
}
public String getImplementationName() {
return "JSS";
}
public ServerSocketFactory getServerSocketFactory(AbstractEndpoint endpoint) {
Properties config = new Properties();
try {
String configFile = System.getProperty("catalina.base") + "/conf/tomcatjss.conf";
config.load(new FileReader(configFile));
} catch (FileNotFoundException e) {
// ignore
} catch (IOException e) {
throw new RuntimeException(e);
}
return factory.getSocketFactory(endpoint, config);
}
public SSLSupport getSSLSupport(Socket s) {
SSLSupport ssls = null;
ssls = factory.getSSLSupport(s);
return ssls;
}
public SSLSupport getSSLSupport(javax.net.ssl.SSLSession session) {
/*
* The Tomcat 6.0.26 docs says: This method has been deprecated since it
* adds a JSSE dependency to this interface. It will be removed in
* versions after 6.0.x.
*
* But we have to provide a implementation of this method because it's
* declared as abstract.
*
* Unfortunately there does not appear to be any way to get SSLSupport
* information from a session with JSS. JSS looks up the information
* based on a socket, not a session. This done in SSLSocket.c
* Java_org_mozilla_jss_ssl_SSLSocket_getStatus().
*
* So while it would be nice to provide a working implmentation there
* doesn't seem to be an easy way to do this. Given that this method is
* already deprecated and there hasn't been any evidence of it being
* called it therefore seems reasonable to just return null to satify
* the compiler's demand for an implementation.
*
* Once this abstract method is removed from SSLImplementation in a
* future release we can remove this stub.
*
* NOTE: This method has NOT yet been deprecated in Tomcat 7!
*/
return null;
}
public SSLUtil getSSLUtil(AbstractEndpoint endpoint) {
return null;
}
}
tomcatjss-7.4.1/tomcat-8.0/src/org/apache/tomcat/util/net/jss/JSSSocketFactory.java 0000664 0000000 0000000 00000023156 13500240455 0027764 0 ustar 00root root 0000000 0000000 /* BEGIN COPYRIGHT BLOCK
* This library is free software; you can redistribute it and/or
* modify it under the terms of the GNU Lesser General Public
* License as published by the Free Software Foundation; either
* version 2.1 of the License, or (at your option) any later version.
*
* This library is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
* Lesser General Public License for more details.
*
* You should have received a copy of the GNU Lesser General Public
* License along with this library; if not, write to the Free Software
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
*
* Copyright (C) 2007 Red Hat, Inc.
* All rights reserved.
* END COPYRIGHT BLOCK */
package org.apache.tomcat.util.net.jss;
import java.io.IOException;
import java.net.InetAddress;
import java.net.ServerSocket;
import java.net.Socket;
import java.net.SocketException;
import java.util.Properties;
import javax.net.ssl.KeyManager;
import javax.net.ssl.SSLContext;
import javax.net.ssl.TrustManager;
// Imports required to "implement" Tomcat 7 Interface
import org.apache.tomcat.util.net.AbstractEndpoint;
import org.mozilla.jss.ssl.SSLServerSocket;
import org.mozilla.jss.ssl.SSLSocket;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
public class JSSSocketFactory implements
org.apache.tomcat.util.net.ServerSocketFactory,
org.apache.tomcat.util.net.SSLUtil {
public static Logger logger = LoggerFactory.getLogger(JSSSocketFactory.class);
TomcatJSS tomcatjss = TomcatJSS.getInstance();
private AbstractEndpoint endpoint;
private Properties config;
public JSSSocketFactory(AbstractEndpoint endpoint) {
this(endpoint, null);
}
public JSSSocketFactory(AbstractEndpoint endpoint, Properties config) {
this.endpoint = endpoint;
this.config = config;
try {
init();
} catch (IOException e) {
throw new RuntimeException(e);
}
}
String getProperty(String tag) {
// check /conf/server.xml
String value = (String)endpoint.getAttribute(tag);
// if not available, check /conf/tomcatjss.conf
if (value == null) {
value = config.getProperty(tag);
}
return value;
}
String getProperty(String tag, String defaultValue) {
String value = getProperty(tag);
if (value == null) {
return defaultValue;
}
return value;
}
void init() throws IOException {
try {
String certdbDir = getProperty("certdbDir");
tomcatjss.setCertdbDir(certdbDir);
String passwordClass = getProperty("passwordClass");
tomcatjss.setPasswordClass(passwordClass);
String passwordFile = getProperty("passwordFile");
tomcatjss.setPasswordFile(passwordFile);
String serverCertNickFile = getProperty("serverCertNickFile");
tomcatjss.setServerCertNickFile(serverCertNickFile);
// MUST look for "clientauth" (ALL lowercase) since "clientAuth"
// (camel case) has already been processed by Tomcat 7
String clientAuth = getProperty("clientauth");
if (clientAuth != null) {
tomcatjss.setClientAuth(clientAuth);
}
String strEnableOCSP = getProperty("enableOCSP");
boolean enableOCSP = Boolean.parseBoolean(strEnableOCSP);
tomcatjss.setEnableOCSP(enableOCSP);
String ocspResponderURL = getProperty("ocspResponderURL");
tomcatjss.setOcspResponderURL(ocspResponderURL);
String ocspResponderCertNickname = getProperty("ocspResponderCertNickname");
tomcatjss.setOcspResponderCertNickname(ocspResponderCertNickname);
String strOcspCacheSize = getProperty("ocspCacheSize");
if (strOcspCacheSize != null) {
int ocspCacheSize = Integer.parseInt(strOcspCacheSize);
tomcatjss.setOcspCacheSize(ocspCacheSize);
}
String strOcspMinCacheEntryDuration = getProperty("ocspMinCacheEntryDuration");
if (strOcspMinCacheEntryDuration != null) {
int ocspMinCacheEntryDuration = Integer.parseInt(strOcspMinCacheEntryDuration);
tomcatjss.setOcspMinCacheEntryDuration(ocspMinCacheEntryDuration);
}
String strOcspMaxCacheEntryDuration = getProperty("ocspMaxCacheEntryDuration");
if (strOcspMaxCacheEntryDuration != null) {
int ocspMaxCacheEntryDuration = Integer.parseInt(strOcspMaxCacheEntryDuration);
tomcatjss.setOcspMaxCacheEntryDuration(ocspMaxCacheEntryDuration);
}
String strOcspTimeout = getProperty("ocspTimeout");
if (strOcspTimeout != null) {
int ocspTimeout = Integer.parseInt(strOcspTimeout);
tomcatjss.setOcspTimeout(ocspTimeout);
}
String strictCiphers = getProperty("strictCiphers");
tomcatjss.setStrictCiphers(strictCiphers);
String sslVersionRangeStream = getProperty("sslVersionRangeStream");
tomcatjss.setSslVersionRangeStream(sslVersionRangeStream);
String sslVersionRangeDatagram = getProperty("sslVersionRangeDatagram");
tomcatjss.setSslVersionRangeDatagram(sslVersionRangeDatagram);
String sslRangeCiphers = getProperty("sslRangeCiphers");
tomcatjss.setSslRangeCiphers(sslRangeCiphers);
String sslOptions = getProperty("sslOptions");
tomcatjss.setSslOptions(sslOptions);
String ssl2Ciphers = getProperty("ssl2Ciphers");
tomcatjss.setSsl2Ciphers(ssl2Ciphers);
String ssl3Ciphers = getProperty("ssl3Ciphers");
tomcatjss.setSsl3Ciphers(ssl3Ciphers);
String tlsCiphers = getProperty("tlsCiphers");
tomcatjss.setTlsCiphers(tlsCiphers);
tomcatjss.init();
} catch (Exception ex) {
logger.error("JSSSocketFactory: " + ex);
// The idea is, if admin take the trouble to configure the
// ocsp cache, and made a mistake, we want to make server
// unavailable until they get it right
if ((ex instanceof java.security.GeneralSecurityException)
|| (ex instanceof java.lang.NumberFormatException))
throw new IOException(ex);
}
}
public Socket acceptSocket(ServerSocket socket) throws IOException {
SSLSocket asock = null;
try {
asock = (SSLSocket) socket.accept();
asock.addSocketListener(tomcatjss);
if (tomcatjss.getRequireClientAuth() || tomcatjss.getWantClientAuth()) {
asock.requestClientAuth(true);
if (tomcatjss.getRequireClientAuth()) {
asock.requireClientAuth(SSLSocket.SSL_REQUIRE_ALWAYS);
} else {
asock.requireClientAuth(SSLSocket.SSL_REQUIRE_NEVER);
}
}
} catch (Exception e) {
throw new SocketException("SSL handshake error " + e.toString());
}
return asock;
}
public void handshake(Socket sock) throws IOException {
// ((SSLSocket)sock).forceHandshake();
}
public ServerSocket createSocket(int port) throws IOException {
return createSocket(port, SSLServerSocket.DEFAULT_BACKLOG, null);
}
public ServerSocket createSocket(int port, int backlog) throws IOException {
return createSocket(port, backlog, null);
}
public ServerSocket createSocket(int port, int backlog,
InetAddress ifAddress) throws IOException {
return createSocket(port, backlog, ifAddress, true);
}
public ServerSocket createSocket(int port, int backlog,
InetAddress ifAddress, boolean reuseAddr) throws IOException {
SSLServerSocket socket = null;
socket = new SSLServerSocket(port, backlog, ifAddress, null, reuseAddr);
initializeSocket(socket);
return socket;
}
private void initializeSocket(SSLServerSocket s) {
try {
/*
* Timeout's should not be enabled by default. Upper layers will
* call setSoTimeout() as needed. Zero means disable.
*/
s.setSoTimeout(0);
if (tomcatjss.getRequireClientAuth() || tomcatjss.getWantClientAuth()) {
s.requestClientAuth(true);
if (tomcatjss.getRequireClientAuth()) {
s.requireClientAuth(SSLSocket.SSL_REQUIRE_ALWAYS);
} else {
s.requireClientAuth(SSLSocket.SSL_REQUIRE_NEVER);
}
}
String serverCertNick = tomcatjss.getServerCertNick();
s.setServerCertNickname(serverCertNick);
} catch (Exception e) {
}
}
// Methods required to "implement" Tomcat 7 Interface
public SSLContext createSSLContext() throws Exception {
return null;
}
public KeyManager[] getKeyManagers() throws Exception {
return null;
}
public TrustManager[] getTrustManagers() throws Exception {
return null;
}
public void configureSessionContext(
javax.net.ssl.SSLSessionContext sslSessionContext) {
return;
}
public String[] getEnableableCiphers(SSLContext context) {
return null;
}
public String[] getEnableableProtocols(SSLContext context) {
return null;
}
}
tomcatjss-7.4.1/tomcat-8.0/src/org/apache/tomcat/util/net/jss/JSSSupport.java 0000664 0000000 0000000 00000006635 13500240455 0026663 0 ustar 00root root 0000000 0000000 /* BEGIN COPYRIGHT BLOCK
* This library is free software; you can redistribute it and/or
* modify it under the terms of the GNU Lesser General Public
* License as published by the Free Software Foundation; either
* version 2.1 of the License, or (at your option) any later version.
*
* This library is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
* Lesser General Public License for more details.
*
* You should have received a copy of the GNU Lesser General Public
* License along with this library; if not, write to the Free Software
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
*
* Copyright (C) 2007 Red Hat, Inc.
* All rights reserved.
* END COPYRIGHT BLOCK */
package org.apache.tomcat.util.net.jss;
import java.io.ByteArrayInputStream;
import java.io.IOException;
import java.security.cert.CertificateFactory;
import java.security.cert.X509Certificate;
import org.apache.tomcat.util.net.SSLSupport;
import org.mozilla.jss.ssl.SSLSecurityStatus;
import org.mozilla.jss.ssl.SSLSocket;
class JSSSupport implements SSLSupport {
private SSLSocket ssl = null;
private SSLSecurityStatus status = null;
JSSSupport(SSLSocket sock) {
ssl = sock;
try {
status = ssl.getStatus();
} catch (IOException e) {
}
}
public X509Certificate[] getPeerCertificateChain(boolean force)
throws IOException {
// retrieve the status when we need it. status cache
// the client certificate which may not be available
// at the creation of JSSSupport
status = ssl.getStatus();
if (status != null) {
org.mozilla.jss.crypto.X509Certificate peerCert = status
.getPeerCertificate();
if (peerCert == null) {
ssl.requireClientAuth(SSLSocket.SSL_REQUIRE_NO_ERROR);
try {
ssl.redoHandshake();
ssl.forceHandshake();
} catch (Exception e) {
}
status = ssl.getStatus();
peerCert = status.getPeerCertificate();
}
if (peerCert != null) {
X509Certificate[] certs = new X509Certificate[1];
try {
byte[] b = peerCert.getEncoded();
CertificateFactory cf = CertificateFactory
.getInstance("X.509");
ByteArrayInputStream stream = new ByteArrayInputStream(b);
certs[0] = (X509Certificate) cf.generateCertificate(stream);
} catch (Exception e) {
}
return certs;
}
}
return null;
}
public Object[] getPeerCertificateChain() throws IOException {
return getPeerCertificateChain(false);
}
public String getCipherSuite() throws IOException {
if (status != null)
return status.getCipher();
return null;
}
public Integer getKeySize() throws IOException {
if (status != null)
return (new Integer(status.getSessionKeySize()));
return null;
}
public String getProtocol() throws IOException {
return null;
}
public String getSessionId() throws IOException {
return null;
}
}
tomcatjss-7.4.1/tomcat-8.0/src/org/dogtagpki/ 0000775 0000000 0000000 00000000000 13500240455 0020651 5 ustar 00root root 0000000 0000000 tomcatjss-7.4.1/tomcat-8.0/src/org/dogtagpki/tomcat/ 0000775 0000000 0000000 00000000000 13500240455 0022140 5 ustar 00root root 0000000 0000000 tomcatjss-7.4.1/tomcat-8.0/src/org/dogtagpki/tomcat/Http11Protocol.java 0000664 0000000 0000000 00000012274 13500240455 0025614 0 ustar 00root root 0000000 0000000 package org.dogtagpki.tomcat;
import java.io.IOException;
import java.nio.file.Files;
import java.nio.file.Path;
import java.nio.file.Paths;
import org.apache.tomcat.util.net.jss.TomcatJSS;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
public class Http11Protocol extends org.apache.coyote.http11.Http11Protocol {
public static Logger logger = LoggerFactory.getLogger(Http11Protocol.class);
TomcatJSS tomcatjss = TomcatJSS.getInstance();
public String getCertdbDir() {
return tomcatjss.getCertdbDir();
}
public void setCertdbDir(String certdbDir) {
tomcatjss.setCertdbDir(certdbDir);
}
public String getPasswordClass() {
return tomcatjss.getPasswordClass();
}
public void setPasswordClass(String passwordClass) {
tomcatjss.setPasswordClass(passwordClass);
}
public String getPasswordFile() {
return tomcatjss.getPasswordFile();
}
public void setPasswordFile(String passwordFile) {
tomcatjss.setPasswordFile(passwordFile);
}
public String getServerCertNickFile() {
return tomcatjss.getServerCertNickFile();
}
public void setServerCertNickFile(String serverCertNickFile) {
tomcatjss.setServerCertNickFile(serverCertNickFile);
}
public boolean getEnabledOCSP() {
return tomcatjss.getEnableOCSP();
}
public void setEnableOCSP(boolean enableOCSP) {
tomcatjss.setEnableOCSP(enableOCSP);
}
public String getOcspResponderURL() {
return tomcatjss.getOcspResponderURL();
}
public void setOcspResponderURL(String ocspResponderURL) {
tomcatjss.setOcspResponderURL(ocspResponderURL);
}
public String getOcspResponderCertNickname() {
return tomcatjss.getOcspResponderCertNickname();
}
public void setOcspResponderCertNickname(String ocspResponderCertNickname) {
tomcatjss.setOcspResponderCertNickname(ocspResponderCertNickname);
}
public int getOcspCacheSize() {
return tomcatjss.getOcspCacheSize();
}
public void setOcspCacheSize(int ocspCacheSize) {
tomcatjss.setOcspCacheSize(ocspCacheSize);
}
public int getOcspMinCacheEntryDuration() {
return tomcatjss.getOcspMinCacheEntryDuration();
}
public void setOcspMinCacheEntryDuration(int ocspMinCacheEntryDuration) {
tomcatjss.setOcspMinCacheEntryDuration(ocspMinCacheEntryDuration);
}
public int getOcspMaxCacheEntryDuration() {
return tomcatjss.getOcspMaxCacheEntryDuration();
}
public void setOcspMaxCacheEntryDuration(int ocspMaxCacheEntryDuration) {
tomcatjss.setOcspMaxCacheEntryDuration(ocspMaxCacheEntryDuration);
}
public int getOcspTimeout() {
return tomcatjss.getOcspTimeout();
}
public void setOcspTimeout(int ocspTimeout) {
tomcatjss.setOcspTimeout(ocspTimeout);
}
public String getStrictCiphers() {
return tomcatjss.getStrictCiphers();
}
public void setStrictCiphers(String strictCiphers) {
tomcatjss.setStrictCiphers(strictCiphers);
}
public String getSslVersionRangeStream() {
return tomcatjss.getSslVersionRangeStream();
}
public void setSslVersionRangeStream(String sslVersionRangeStream) {
tomcatjss.setSslVersionRangeStream(sslVersionRangeStream);
}
public String getSslVersionRangeDatagram() {
return tomcatjss.getSslVersionRangeDatagram();
}
public void setSslVersionRangeDatagram(String sslVersionRangeDatagram) {
tomcatjss.setSslVersionRangeDatagram(sslVersionRangeDatagram);;
}
public String getSslRangeCiphers() {
return tomcatjss.getSslRangeCiphers();
}
public void setSslRangeCiphers(String sslRangeCiphers) {
tomcatjss.setSslRangeCiphers(sslRangeCiphers);
}
public String getSslOptions() {
return tomcatjss.getSslOptions();
}
public void setSslOptions(String sslOptions) {
tomcatjss.setSslOptions(sslOptions);
}
public String getSsl2Ciphers() {
return tomcatjss.getSsl2Ciphers();
}
public void setSsl2Ciphers(String ssl2Ciphers) {
tomcatjss.setSsl2Ciphers(ssl2Ciphers);
}
public String getSsl3Ciphers() {
return tomcatjss.getSsl3Ciphers();
}
public void setSsl3Ciphers(String ssl3Ciphers) {
tomcatjss.setSsl3Ciphers(ssl3Ciphers);
}
public String getTlsCiphers() {
return tomcatjss.getTlsCiphers();
}
public void setTlsCiphers(String tlsCiphers) {
tomcatjss.setTlsCiphers(tlsCiphers);
}
public void setKeystorePassFile(String keystorePassFile) {
try {
Path path = Paths.get(keystorePassFile);
String password = new String(Files.readAllBytes(path)).trim();
setKeystorePass(password);
} catch (IOException e) {
throw new RuntimeException(e);
}
}
public void setTruststorePassFile(String truststorePassFile) {
try {
Path path = Paths.get(truststorePassFile);
String password = new String(Files.readAllBytes(path)).trim();
setTruststorePass(password);
} catch (IOException e) {
throw new RuntimeException(e);
}
}
}
tomcatjss-7.4.1/tomcat-8.5/ 0000775 0000000 0000000 00000000000 13500240455 0015327 5 ustar 00root root 0000000 0000000 tomcatjss-7.4.1/tomcat-8.5/src/ 0000775 0000000 0000000 00000000000 13500240455 0016116 5 ustar 00root root 0000000 0000000 tomcatjss-7.4.1/tomcat-8.5/src/org/ 0000775 0000000 0000000 00000000000 13500240455 0016705 5 ustar 00root root 0000000 0000000 tomcatjss-7.4.1/tomcat-8.5/src/org/dogtagpki/ 0000775 0000000 0000000 00000000000 13500240455 0020656 5 ustar 00root root 0000000 0000000 tomcatjss-7.4.1/tomcat-8.5/src/org/dogtagpki/tomcat/ 0000775 0000000 0000000 00000000000 13500240455 0022145 5 ustar 00root root 0000000 0000000 tomcatjss-7.4.1/tomcat-8.5/src/org/dogtagpki/tomcat/JSSImplementation.java 0000664 0000000 0000000 00000004115 13500240455 0026356 0 ustar 00root root 0000000 0000000 /* BEGIN COPYRIGHT BLOCK
* This library is free software; you can redistribute it and/or
* modify it under the terms of the GNU Lesser General Public
* License as published by the Free Software Foundation; either
* version 2.1 of the License, or (at your option) any later version.
*
* This library is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
* Lesser General Public License for more details.
*
* You should have received a copy of the GNU Lesser General Public
* License along with this library; if not, write to the Free Software
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
*
* Copyright (C) 2007 Red Hat, Inc.
* All rights reserved.
* END COPYRIGHT BLOCK */
package org.dogtagpki.tomcat;
import org.apache.tomcat.util.net.SSLHostConfig;
import org.apache.tomcat.util.net.SSLHostConfigCertificate;
import org.apache.tomcat.util.net.SSLUtil;
import org.apache.tomcat.util.net.jsse.JSSEImplementation;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
public class JSSImplementation extends JSSEImplementation {
public static Logger logger = LoggerFactory.getLogger(JSSUtil.class);
public JSSImplementation() {
logger.debug("JSSImplementation: instance created");
}
@Override
public SSLUtil getSSLUtil(SSLHostConfigCertificate cert) {
logger.debug("JSSImplementation: getSSLUtil()");
logger.debug("JSSImplementation: key alias: " + cert.getCertificateKeyAlias());
logger.debug("JSSImplementation: keystore provider: " + cert.getCertificateKeystoreProvider());
SSLHostConfig hostConfig = cert.getSSLHostConfig();
logger.debug("JSSImplementation: key manager alg: " + hostConfig.getKeyManagerAlgorithm());
logger.debug("JSSImplementation: truststore alg: " + hostConfig.getTruststoreAlgorithm());
logger.debug("JSSImplementation: truststore provider: " + hostConfig.getTruststoreProvider());
return new JSSUtil(cert);
}
}
tomcatjss-7.4.1/tomcat-8.5/src/org/dogtagpki/tomcat/JSSUtil.java 0000664 0000000 0000000 00000003640 13500240455 0024310 0 ustar 00root root 0000000 0000000 /* BEGIN COPYRIGHT BLOCK
* This library is free software; you can redistribute it and/or
* modify it under the terms of the GNU Lesser General Public
* License as published by the Free Software Foundation; either
* version 2.1 of the License, or (at your option) any later version.
*
* This library is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
* Lesser General Public License for more details.
*
* You should have received a copy of the GNU Lesser General Public
* License along with this library; if not, write to the Free Software
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
*
* Copyright (C) 2018 Red Hat, Inc.
* All rights reserved.
* END COPYRIGHT BLOCK */
package org.dogtagpki.tomcat;
import javax.net.ssl.KeyManager;
import javax.net.ssl.TrustManager;
import org.apache.tomcat.util.net.SSLHostConfigCertificate;
import org.apache.tomcat.util.net.jsse.JSSEKeyManager;
import org.apache.tomcat.util.net.jsse.JSSEUtil;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
public class JSSUtil extends JSSEUtil {
public static Logger logger = LoggerFactory.getLogger(JSSUtil.class);
public JSSUtil(SSLHostConfigCertificate cert) {
super(cert);
logger.debug("JSSUtil: instance created");
}
@Override
public KeyManager[] getKeyManagers() throws Exception {
logger.debug("JSSUtil: getKeyManagers()");
String keyAlias = certificate.getCertificateKeyAlias();
KeyManager keyManager = new JSSEKeyManager(new JSSKeyManager(), keyAlias);
return new KeyManager[] { keyManager };
}
@Override
public TrustManager[] getTrustManagers() throws Exception {
logger.debug("JSSUtil: getTrustManagers()");
return new TrustManager[] { new JSSTrustManager() };
}
}
tomcatjss-7.4.1/tomcatjss.spec 0000664 0000000 0000000 00000012551 13500240455 0016417 0 ustar 00root root 0000000 0000000 ################################################################################
Name: tomcatjss
################################################################################
Summary: JSS Connector for Apache Tomcat
URL: http://www.dogtagpki.org/wiki/TomcatJSS
License: LGPLv2+
BuildArch: noarch
Version: 7.4.1
Release: 1%{?_timestamp}%{?_commit_id}%{?dist}
# global _phase -a1
# To generate the source tarball:
# $ git clone https://github.com/dogtagpki/tomcatjss.git
# $ cd tomcatjss
# $ git archive \
# --format=tar.gz \
# --prefix tomcatjss-VERSION/ \
# -o tomcatjss-VERSION.tar.gz \
#
Source: https://github.com/dogtagpki/tomcatjss/archive/v%{version}%{?_phase}/tomcatjss-%{version}%{?_phase}.tar.gz
# To create a patch for all changes since a version tag:
# $ git format-patch \
# --stdout \
# \
# > tomcatjss-VERSION-RELEASE.patch
# Patch: tomcatjss-VERSION-RELEASE.patch
################################################################################
# Build Dependencies
################################################################################
# jpackage-utils requires versioning to meet both build and runtime requirements
# jss requires versioning to meet both build and runtime requirements
# tomcat requires versioning to meet both build and runtime requirements
# autosetup
BuildRequires: git
# Java
BuildRequires: ant
BuildRequires: apache-commons-lang
BuildRequires: java-devel
BuildRequires: jpackage-utils >= 0:1.7.5-15
# SLF4J
BuildRequires: slf4j
%if 0%{?rhel} && 0%{?rhel} <= 7
# no slf4j-jdk14
%else
BuildRequires: slf4j-jdk14
%endif
# JSS
%if 0%{?rhel} && 0%{?rhel} <= 7
BuildRequires: jss >= 4.4.0-7
%else
BuildRequires: jss >= 4.5.3
%endif
# Tomcat
%if 0%{?rhel} && 0%{?rhel} <= 7
BuildRequires: tomcat >= 7.0.69
%else
%if 0%{?fedora} && 0%{?fedora} <= 27
BuildRequires: tomcat >= 8.0.49
%else
%if 0%{?fedora} && 0%{?fedora} <= 28
BuildRequires: tomcat >= 1:8.5.23
%else
%if 0%{?rhel}
BuildRequires: pki-servlet-engine >= 1:9.0.7
%else
BuildRequires: tomcat >= 1:9.0.7
%endif
%endif
%endif
%endif
################################################################################
# Runtime Dependencies
################################################################################
# Java
Requires: apache-commons-lang
%if 0%{?fedora} >= 21
Requires: java-headless
%else
Requires: java
%endif
Requires: jpackage-utils >= 0:1.7.5-15
# SLF4J
Requires: slf4j
%if 0%{?rhel}
# no slf4j-jdk14
%else
Requires: slf4j-jdk14
%endif
# JSS
%if 0%{?rhel} && 0%{?rhel} <= 7
Requires: jss >= 4.4.0-7
%else
Requires: jss >= 4.5.3
%endif
# Tomcat
%if 0%{?rhel} && 0%{?rhel} <= 7
Requires: tomcat >= 7.0.69
%else
%if 0%{?fedora} && 0%{?fedora} <= 27
Requires: tomcat >= 8.0.49
%else
%if 0%{?fedora} && 0%{?fedora} <= 28
Requires: tomcat >= 1:8.5.23
%else
%if 0%{?rhel}
Requires: pki-servlet-engine >= 1:9.0.7
%else
Requires: tomcat >= 1:9.0.7
%endif
%endif
%endif
%endif
# The 'tomcatjss' package conflicts with the 'tomcat-native' package
# because it uses an underlying NSS security model rather than the
# OpenSSL security model, so these two packages may not co-exist.
# (see Bugzilla Bug #441974 for details)
Conflicts: tomcat-native
# PKI
Conflicts: pki-base < 10.6.5
%if 0%{?rhel}
# For EPEL, override the '_sharedstatedir' macro on RHEL
%define _sharedstatedir /var/lib
%endif
%description
JSS Connector for Apache Tomcat, installed via the tomcatjss package,
is a Java Secure Socket Extension (JSSE) module for Apache Tomcat that
uses Java Security Services (JSS), a Java interface to Network Security
Services (NSS).
NOTE: The 'tomcatjss' package conflicts with the 'tomcat-native' package
because it uses an underlying NSS security model rather than the
OpenSSL security model, so these two packages may not co-exist.
################################################################################
%prep
################################################################################
%autosetup -n tomcatjss-%{version}%{?_phase} -p 1 -S git
################################################################################
%install
################################################################################
# get Tomcat . version number
tomcat_version=`/usr/sbin/tomcat version | sed -n 's/Server number: *\([0-9]\+\.[0-9]\+\).*/\1/p'`
if [ $tomcat_version == "9.0" ]; then
app_server=tomcat-8.5
else
app_server=tomcat-$tomcat_version
fi
ant -f build.xml \
-Dversion=%{version} \
-Dsrc.dir=$app_server \
-Djnidir=%{_jnidir} \
-Dinstall.doc.dir=%{buildroot}%{_docdir}/%{name} \
-Dinstall.jar.dir=%{buildroot}%{_javadir} \
install
################################################################################
%files
################################################################################
%defattr(-,root,root)
%doc README
%doc LICENSE
%{_javadir}/*
################################################################################
%changelog
* Thu Mar 15 2018 Dogtag PKI Team 7.3.0-0
- To list changes in since :
$ git log --pretty=oneline --abbrev-commit --no-decorate ..