getTags();
public Object putPassword(String tag, String password);
public void commit() throws IOException, ClassCastException,
NullPointerException;
}
tomcatjss-8.0.0/core/src/main/java/org/apache/tomcat/util/net/jss/PlainPasswordFile.java 0000664 0000000 0000000 00000012740 14125500203 0031200 0 ustar 00root root 0000000 0000000 /* BEGIN COPYRIGHT BLOCK
* This library is free software; you can redistribute it and/or
* modify it under the terms of the GNU Lesser General Public
* License as published by the Free Software Foundation; either
* version 2.1 of the License, or (at your option) any later version.
*
* This library is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
* Lesser General Public License for more details.
*
* You should have received a copy of the GNU Lesser General Public
* License along with this library; if not, write to the Free Software
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
*
* Copyright (C) 2007 Red Hat, Inc.
* All rights reserved.
* END COPYRIGHT BLOCK */
package org.apache.tomcat.util.net.jss;
import java.io.BufferedReader;
import java.io.BufferedWriter;
import java.io.FileInputStream;
import java.io.FileOutputStream;
import java.io.IOException;
import java.io.InputStreamReader;
import java.io.OutputStreamWriter;
import java.util.Enumeration;
import java.util.Properties;
public class PlainPasswordFile implements IPasswordStore {
private String mPwdPath = "";
private Properties mPwdStore;
private static org.slf4j.Logger logger = org.slf4j.LoggerFactory.getLogger(PlainPasswordFile.class);
public PlainPasswordFile() {
mPwdStore = new Properties();
}
/**
* Initialization method to read passwords(key and element pairs) from a file.
*
* Every property occupies one line of the input stream. Each line is terminated by a line terminator (
* \n or \r or \r\n). Lines are processed until end of
* file is reached.
*
* A line that contains only whitespace or whose first non-whitespace character is an ASCII #
* is ignored (thus, # indicates comment line).
*
* Every line other than a blank line or a comment line describes one property to be added to the table.
* The characters before the delimiter = forms the key and the characters after
* the = is assigned as value to the key.
*
* As an example, each of the following lines specify the key "Truth" and the associated element
* value "Beauty":
*
*
*
* Truth = Beauty
* Truth= Beauty
* Truth =Beauty
*
*
*
* Note that the space appearing before/after = is ignored. However, the space appearing in between are
* stored.
*
* Example:
*
*
* Welcome Message = Hello World
*
*
* assigns value Hello World to key Welcome Message
*
*
* If the line doesn't have the delimiter =, the method throws an IOException
*
* @param pwdPath the input file path.
* @exception IOException if an error occurred when reading from the
* input stream.
*/
@Override
public void init(String pwdPath) throws IOException {
logger.debug("PlainPasswordFile: Initializing PlainPasswordFile");
// initialize mPwdStore
mPwdPath = pwdPath;
try (FileInputStream file = new FileInputStream(mPwdPath);
InputStreamReader isr = new InputStreamReader(file);
BufferedReader br = new BufferedReader(isr)) {
String line;
int index = 1;
while ((line = br.readLine()) != null) {
// Remove any leading or trailing spaces
line = line.trim();
if (line.startsWith("#") || line.isEmpty())
continue;
String[] parts = line.split("=", 2);
if (parts.length < 2) {
throw new IOException("Missing delimiter '=' in file " + mPwdPath + " in line " + index);
}
// Load key value into the password store
mPwdStore.put(parts[0].trim(), parts[1].trim());
index++;
}
}
}
@Override
public String getPassword(String tag) {
return getPassword(tag, 0);
}
@Override
public String getPassword(String tag, int iteration) {
return mPwdStore.getProperty(tag);
}
// return an array of String-based tag
@Override
@SuppressWarnings("unchecked")
public Enumeration getTags() {
return (Enumeration) mPwdStore.propertyNames();
}
@Override
public Object putPassword(String tag, String password) {
return mPwdStore.setProperty(tag, password);
}
@Override
public synchronized void commit()
throws IOException, ClassCastException, NullPointerException {
try (FileOutputStream file = new FileOutputStream(mPwdPath);
OutputStreamWriter osw = new OutputStreamWriter(file);
BufferedWriter bw = new BufferedWriter(osw)) {
for (Enumeration e = mPwdStore.keys(); e.hasMoreElements();) {
String key = ((String) e.nextElement()).trim();
String val = ((String) mPwdStore.get(key)).trim();
bw.write(key + "=" + val);
bw.newLine();
}
}
}
public int getSize() {
return mPwdStore.size();
}
}
tomcatjss-8.0.0/core/src/main/java/org/apache/tomcat/util/net/jss/TomcatJSS.java 0000664 0000000 0000000 00000044336 14125500203 0027427 0 ustar 00root root 0000000 0000000 /* BEGIN COPYRIGHT BLOCK
* This library is free software; you can redistribute it and/or
* modify it under the terms of the GNU Lesser General Public
* License as published by the Free Software Foundation; either
* version 2.1 of the License, or (at your option) any later version.
*
* This library is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
* Lesser General Public License for more details.
*
* You should have received a copy of the GNU Lesser General Public
* License along with this library; if not, write to the Free Software
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
*
* Copyright (C) 2017 Red Hat, Inc.
* All rights reserved.
* END COPYRIGHT BLOCK */
package org.apache.tomcat.util.net.jss;
import java.io.File;
import java.io.FileReader;
import java.nio.file.Files;
import java.nio.file.Paths;
import java.util.ArrayList;
import java.util.Collection;
import java.util.Enumeration;
import java.util.Properties;
import javax.xml.parsers.DocumentBuilder;
import javax.xml.parsers.DocumentBuilderFactory;
import javax.xml.xpath.XPath;
import javax.xml.xpath.XPathConstants;
import javax.xml.xpath.XPathFactory;
import org.apache.commons.lang3.StringUtils;
import org.mozilla.jss.CryptoManager;
import org.mozilla.jss.InitializationValues;
import org.mozilla.jss.crypto.AlreadyInitializedException;
import org.mozilla.jss.crypto.CryptoToken;
import org.mozilla.jss.ssl.SSLAlertEvent;
import org.mozilla.jss.ssl.SSLHandshakeCompletedEvent;
import org.mozilla.jss.ssl.SSLServerSocket;
import org.mozilla.jss.ssl.SSLSocketListener;
import org.mozilla.jss.util.IncorrectPasswordException;
import org.mozilla.jss.util.Password;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import org.w3c.dom.Document;
import org.w3c.dom.Element;
public class TomcatJSS implements SSLSocketListener {
public static Logger logger = LoggerFactory.getLogger(TomcatJSS.class);
public final static TomcatJSS INSTANCE = new TomcatJSS();
public static final int MAX_LOGIN_ATTEMPTS = 3;
public static TomcatJSS getInstance() { return INSTANCE; }
Collection socketListeners = new ArrayList<>();
String certdbDir;
CryptoManager manager;
String passwordClass;
String passwordFile;
IPasswordStore passwordStore;
String serverCertNickFile;
String serverCertNick;
String clientAuth = "want";
boolean requireClientAuth;
boolean wantClientAuth;
boolean enableOCSP;
String ocspResponderURL;
String ocspResponderCertNickname;
int ocspCacheSize = 1000; // entries
int ocspMinCacheEntryDuration = 3600; // seconds (default: 1 hour)
int ocspMaxCacheEntryDuration = 86400; // seconds (default: 24 hours)
int ocspTimeout = 60; // seconds (default: 1 minute)
String strictCiphers;
boolean boolStrictCiphers;
String sslRangeCiphers;
String sslOptions;
String ssl2Ciphers;
String ssl3Ciphers;
String tlsCiphers;
boolean initialized;
public void addSocketListener(SSLSocketListener listener) {
socketListeners.add(listener);
}
public void removeSocketListener(SSLSocketListener listener) {
socketListeners.remove(listener);
}
public Collection getSocketListeners() {
return socketListeners;
}
public String getCertdbDir() {
return certdbDir;
}
public void setCertdbDir(String certdbDir) {
this.certdbDir = certdbDir;
}
public String getPasswordClass() {
return passwordClass;
}
public void setPasswordClass(String passwordClass) {
this.passwordClass = passwordClass;
}
public String getPasswordFile() {
return passwordFile;
}
public void setPasswordFile(String passwordFile) {
this.passwordFile = passwordFile;
}
public String getServerCertNickFile() {
return serverCertNickFile;
}
public IPasswordStore getPasswordStore() {
return passwordStore;
}
public void setPasswordStore(IPasswordStore passwordStore) {
this.passwordStore = passwordStore;
}
public void setServerCertNickFile(String serverCertNickFile) {
this.serverCertNickFile = serverCertNickFile;
}
public String getServerCertNick() {
return serverCertNick;
}
public void setServerCertNick(String serverCertNick) {
this.serverCertNick = serverCertNick;
}
public String getClientAuth() {
return clientAuth;
}
public void setClientAuth(String clientAuth) {
this.clientAuth = clientAuth;
}
public boolean getRequireClientAuth() {
return requireClientAuth;
}
public boolean getWantClientAuth() {
return wantClientAuth;
}
public boolean getEnableOCSP() {
return enableOCSP;
}
public void setEnableOCSP(boolean enableOCSP) {
this.enableOCSP = enableOCSP;
}
public String getOcspResponderURL() {
return ocspResponderURL;
}
public void setOcspResponderURL(String ocspResponderURL) {
this.ocspResponderURL = ocspResponderURL;
}
public String getOcspResponderCertNickname() {
return ocspResponderCertNickname;
}
public void setOcspResponderCertNickname(String ocspResponderCertNickname) {
this.ocspResponderCertNickname = ocspResponderCertNickname;
}
public int getOcspCacheSize() {
return ocspCacheSize;
}
public void setOcspCacheSize(int ocspCacheSize) {
this.ocspCacheSize = ocspCacheSize;
}
public int getOcspMinCacheEntryDuration() {
return ocspMinCacheEntryDuration;
}
public void setOcspMinCacheEntryDuration(int ocspMinCacheEntryDuration) {
this.ocspMinCacheEntryDuration = ocspMinCacheEntryDuration;
}
public int getOcspMaxCacheEntryDuration() {
return ocspMaxCacheEntryDuration;
}
public void setOcspMaxCacheEntryDuration(int ocspMaxCacheEntryDuration) {
this.ocspMaxCacheEntryDuration = ocspMaxCacheEntryDuration;
}
public int getOcspTimeout() {
return ocspTimeout;
}
public void setOcspTimeout(int ocspTimeout) {
this.ocspTimeout = ocspTimeout;
}
public void loadJSSConfig(String jssConf) throws Exception {
File configFile = new File(jssConf);
loadJSSConfig(configFile);
}
public void loadJSSConfig(File configFile) throws Exception {
Properties config = new Properties();
config.load(new FileReader(configFile));
loadJSSConfig(config);
}
public void loadJSSConfig(Properties config) throws Exception {
String certDb = config.getProperty("certdbDir");
if (certDb != null)
setCertdbDir(certDb);
String passwordClass = config.getProperty("passwordClass");
if (passwordClass != null)
setPasswordClass(passwordClass);
String passwordFile = config.getProperty("passwordFile");
if (passwordFile != null)
setPasswordFile(passwordFile);
String enableOCSP = config.getProperty("enableOCSP");
if (enableOCSP != null)
setEnableOCSP(Boolean.parseBoolean(enableOCSP));
String ocspResponderURL = config.getProperty("ocspResponderURL");
if (ocspResponderURL != null)
setOcspResponderURL(ocspResponderURL);
String ocspResponderCertNickname = config.getProperty("ocspResponderCertNickname");
if (ocspResponderCertNickname != null)
setOcspResponderCertNickname(ocspResponderCertNickname);
String ocspCacheSize = config.getProperty("ocspCacheSize");
if (StringUtils.isNotEmpty(ocspCacheSize))
setOcspCacheSize(Integer.parseInt(ocspCacheSize));
String ocspMinCacheEntryDuration = config.getProperty("ocspMinCacheEntryDuration");
if (StringUtils.isNotEmpty(ocspMinCacheEntryDuration))
setOcspMinCacheEntryDuration(Integer.parseInt(ocspMinCacheEntryDuration));
String ocspMaxCacheEntryDuration = config.getProperty("ocspMaxCacheEntryDuration");
if (StringUtils.isNotEmpty(ocspMaxCacheEntryDuration))
setOcspMaxCacheEntryDuration(Integer.parseInt(ocspMaxCacheEntryDuration));
String ocspTimeout = config.getProperty("ocspTimeout");
if (StringUtils.isNotEmpty(ocspTimeout))
setOcspTimeout(Integer.parseInt(ocspTimeout));
}
public void loadTomcatConfig(String serverXml) throws Exception {
File configFile = new File(serverXml);
loadTomcatConfig(configFile);
}
public void loadTomcatConfig(File configFile) throws Exception {
DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
DocumentBuilder builder = factory.newDocumentBuilder();
Document document = builder.parse(configFile);
loadTomcatConfig(document);
}
public void loadTomcatConfig(Document document) throws Exception {
XPathFactory xPathfactory = XPathFactory.newInstance();
XPath xpath = xPathfactory.newXPath();
Element connector = (Element) xpath.evaluate(
"/Server/Service[@name='Catalina']/Connector[@SSLEnabled='true']",
document, XPathConstants.NODE);
String certDb = connector.getAttribute("certdbDir");
if (certDb != null)
setCertdbDir(certDb);
String passwordClass = connector.getAttribute("passwordClass");
if (passwordClass != null)
setPasswordClass(passwordClass);
String passwordFile = connector.getAttribute("passwordFile");
if (passwordFile != null)
setPasswordFile(passwordFile);
String serverCertNickFile = connector.getAttribute("serverCertNickFile");
if (serverCertNickFile != null)
setServerCertNickFile(serverCertNickFile);
String enableOCSP = connector.getAttribute("enableOCSP");
if (enableOCSP != null)
setEnableOCSP(Boolean.parseBoolean(enableOCSP));
String ocspResponderURL = connector.getAttribute("ocspResponderURL");
if (ocspResponderURL != null)
setOcspResponderURL(ocspResponderURL);
String ocspResponderCertNickname = connector.getAttribute("ocspResponderCertNickname");
if (ocspResponderCertNickname != null)
setOcspResponderCertNickname(ocspResponderCertNickname);
String ocspCacheSize = connector.getAttribute("ocspCacheSize");
if (StringUtils.isNotEmpty(ocspCacheSize))
setOcspCacheSize(Integer.parseInt(ocspCacheSize));
String ocspMinCacheEntryDuration = connector.getAttribute("ocspMinCacheEntryDuration");
if (StringUtils.isNotEmpty(ocspMinCacheEntryDuration))
setOcspMinCacheEntryDuration(Integer.parseInt(ocspMinCacheEntryDuration));
String ocspMaxCacheEntryDuration = connector.getAttribute("ocspMaxCacheEntryDuration");
if (StringUtils.isNotEmpty(ocspMaxCacheEntryDuration))
setOcspMaxCacheEntryDuration(Integer.parseInt(ocspMaxCacheEntryDuration));
String ocspTimeout = connector.getAttribute("ocspTimeout");
if (StringUtils.isNotEmpty(ocspTimeout))
setOcspTimeout(Integer.parseInt(ocspTimeout));
}
/**
* Load configuration from jss.conf (if available) or server.xml.
*/
public void loadConfig() throws Exception {
String catalinaBase = System.getProperty("catalina.base");
String jssConf = catalinaBase + "/conf/jss.conf";
File configFile = new File(jssConf);
if (configFile.exists()) {
logger.info("TomcatJSS: Loading JSS configuration from " + jssConf);
loadJSSConfig(configFile);
} else {
String serverXml = catalinaBase + "/conf/server.xml";
logger.info("TomcatJSS: Loading JSS configuration from " + serverXml);
loadTomcatConfig(serverXml);
}
}
public void init() throws Exception {
if (initialized) {
return;
}
logger.info("TomcatJSS: initialization");
if (certdbDir == null) {
certdbDir = System.getProperty("catalina.base") + File.separator + "alias";
}
logger.debug("TomcatJSS: certdbDir: " + certdbDir);
if (passwordClass == null) {
passwordClass = PlainPasswordFile.class.getName();
}
logger.debug("TomcatJSS: passwordClass: " + passwordClass);
if (passwordFile == null) {
passwordFile = System.getProperty("catalina.base") + File.separator +
"conf" + File.separator + "password.conf";
}
logger.debug("TomcatJSS: passwordFile: " + passwordFile);
if (serverCertNickFile != null) {
logger.debug("TomcatJSS: serverCertNickFile: " + serverCertNickFile);
}
InitializationValues vals = new InitializationValues(certdbDir);
vals.removeSunProvider = false;
vals.installJSSProvider = true;
try {
CryptoManager.initialize(vals);
} catch (AlreadyInitializedException e) {
logger.warn("TomcatJSS: " + e);
}
manager = CryptoManager.getInstance();
passwordStore = (IPasswordStore) Class.forName(passwordClass).newInstance();
passwordStore.init(passwordFile);
login();
if (serverCertNickFile != null) {
serverCertNick = new String(Files.readAllBytes(Paths.get(serverCertNickFile))).trim();
logger.debug("serverCertNick: " + serverCertNick);
}
logger.debug("clientAuth: " + clientAuth);
if (clientAuth.equalsIgnoreCase("true")) {
requireClientAuth = true;
} else if (clientAuth.equalsIgnoreCase("yes")) {
requireClientAuth = true;
logger.warn("The \"yes\" value for clientAuth has been deprecated. Use \"true\" instead.");
} else if (clientAuth.equalsIgnoreCase("want")) {
wantClientAuth = true;
}
logger.debug("requireClientAuth: " + requireClientAuth);
logger.debug("wantClientAuth: " + wantClientAuth);
if (requireClientAuth || wantClientAuth) {
configureOCSP();
}
// 12 hours = 43200 seconds
SSLServerSocket.configServerSessionIDCache(0, 43200, 43200, null);
logger.info("TomcatJSS: initialization complete");
initialized = true;
}
public void login() throws Exception {
logger.debug("TomcatJSS: logging into tokens");
Enumeration tags = passwordStore.getTags();
while (tags.hasMoreElements()) {
String tag = tags.nextElement();
if (!tag.equals("internal") && !tag.startsWith("hardware-")) {
continue;
}
login(tag);
}
}
public void login(String tag) throws Exception {
CryptoToken token = getToken(tag);
if (token.isLoggedIn()) {
logger.debug("TomcatJSS: already logged into " + tag);
return;
}
logger.debug("TomcatJSS: logging into " + tag);
int iteration = 0;
do {
String strPassword = passwordStore.getPassword(tag, iteration);
if (strPassword == null) {
logger.debug("TomcatJSS: no password for " + tag);
return;
}
Password password = new Password(strPassword.toCharArray());
try {
token.login(password);
return;
} catch (IncorrectPasswordException e) {
logger.warn("TomcatJSS: incorrect password");
iteration ++;
} finally {
password.clear();
}
} while (iteration < MAX_LOGIN_ATTEMPTS);
logger.error("TomcatJSS: failed to log into " + tag);
}
public CryptoToken getToken(String tag) throws Exception {
if (tag.equals("internal")) {
return manager.getInternalKeyStorageToken();
}
if (tag.startsWith("hardware-")) {
String tokenName = tag.substring(9);
return manager.getTokenByName(tokenName);
}
// non-token password entry
return null;
}
public void configureOCSP() throws Exception {
logger.info("configuring OCSP");
logger.debug("enableOCSP: " + enableOCSP);
if (!enableOCSP) {
return;
}
logger.debug("ocspResponderURL: " + ocspResponderURL);
if (StringUtils.isEmpty(ocspResponderURL)) {
ocspResponderURL = null;
}
logger.debug("ocspResponderCertNickname: " + ocspResponderCertNickname);
if (StringUtils.isEmpty(ocspResponderCertNickname)) {
ocspResponderCertNickname = null;
}
// Check to see if the ocsp url and nickname are both set or not set
if (ocspResponderURL == null && ocspResponderCertNickname != null) {
throw new Exception("Missing OCSP responder URL");
}
if (ocspResponderURL != null && ocspResponderCertNickname == null) {
throw new Exception("Missing OCSP responder certificate nickname");
}
manager.configureOCSP(
true,
ocspResponderURL,
ocspResponderCertNickname);
logger.debug("ocspCacheSize: " + ocspCacheSize);
logger.debug("ocspMinCacheEntryDuration: " + ocspMinCacheEntryDuration);
logger.debug("ocspMaxCacheEntryDuration: " + ocspMaxCacheEntryDuration);
manager.OCSPCacheSettings(ocspCacheSize,
ocspMinCacheEntryDuration,
ocspMaxCacheEntryDuration);
logger.debug("ocspTimeout: " + ocspTimeout);
manager.setOCSPTimeout(ocspTimeout);
}
@Override
public void alertReceived(SSLAlertEvent event) {
for (SSLSocketListener listener : socketListeners) {
listener.alertReceived(event);
}
}
@Override
public void alertSent(SSLAlertEvent event) {
for (SSLSocketListener listener : socketListeners) {
listener.alertSent(event);
}
}
@Override
public void handshakeCompleted(SSLHandshakeCompletedEvent event) {
for (SSLSocketListener listener : socketListeners) {
listener.handshakeCompleted(event);
}
}
}
tomcatjss-8.0.0/core/src/main/java/org/dogtagpki/ 0000775 0000000 0000000 00000000000 14125500203 0021642 5 ustar 00root root 0000000 0000000 tomcatjss-8.0.0/core/src/main/java/org/dogtagpki/tomcat/ 0000775 0000000 0000000 00000000000 14125500203 0023131 5 ustar 00root root 0000000 0000000 tomcatjss-8.0.0/core/src/main/java/org/dogtagpki/tomcat/Http11NioProtocol.java 0000664 0000000 0000000 00000007030 14125500203 0027245 0 ustar 00root root 0000000 0000000 package org.dogtagpki.tomcat;
import java.io.IOException;
import java.nio.file.Files;
import java.nio.file.Path;
import java.nio.file.Paths;
import org.apache.tomcat.util.net.jss.TomcatJSS;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
public class Http11NioProtocol extends org.apache.coyote.http11.Http11NioProtocol {
public static Logger logger = LoggerFactory.getLogger(Http11NioProtocol.class);
TomcatJSS tomcatjss = TomcatJSS.getInstance();
public String getCertdbDir() {
return tomcatjss.getCertdbDir();
}
public void setCertdbDir(String certdbDir) {
tomcatjss.setCertdbDir(certdbDir);
}
public String getPasswordClass() {
return tomcatjss.getPasswordClass();
}
public void setPasswordClass(String passwordClass) {
tomcatjss.setPasswordClass(passwordClass);
}
public String getPasswordFile() {
return tomcatjss.getPasswordFile();
}
public void setPasswordFile(String passwordFile) {
tomcatjss.setPasswordFile(passwordFile);
}
public String getServerCertNickFile() {
return tomcatjss.getServerCertNickFile();
}
public void setServerCertNickFile(String serverCertNickFile) {
tomcatjss.setServerCertNickFile(serverCertNickFile);
}
public boolean getEnabledOCSP() {
return tomcatjss.getEnableOCSP();
}
public void setEnableOCSP(boolean enableOCSP) {
tomcatjss.setEnableOCSP(enableOCSP);
}
public String getOcspResponderURL() {
return tomcatjss.getOcspResponderURL();
}
public void setOcspResponderURL(String ocspResponderURL) {
tomcatjss.setOcspResponderURL(ocspResponderURL);
}
public String getOcspResponderCertNickname() {
return tomcatjss.getOcspResponderCertNickname();
}
public void setOcspResponderCertNickname(String ocspResponderCertNickname) {
tomcatjss.setOcspResponderCertNickname(ocspResponderCertNickname);
}
public int getOcspCacheSize() {
return tomcatjss.getOcspCacheSize();
}
public void setOcspCacheSize(int ocspCacheSize) {
tomcatjss.setOcspCacheSize(ocspCacheSize);
}
public int getOcspMinCacheEntryDuration() {
return tomcatjss.getOcspMinCacheEntryDuration();
}
public void setOcspMinCacheEntryDuration(int ocspMinCacheEntryDuration) {
tomcatjss.setOcspMinCacheEntryDuration(ocspMinCacheEntryDuration);
}
public int getOcspMaxCacheEntryDuration() {
return tomcatjss.getOcspMaxCacheEntryDuration();
}
public void setOcspMaxCacheEntryDuration(int ocspMaxCacheEntryDuration) {
tomcatjss.setOcspMaxCacheEntryDuration(ocspMaxCacheEntryDuration);
}
public int getOcspTimeout() {
return tomcatjss.getOcspTimeout();
}
public void setOcspTimeout(int ocspTimeout) {
tomcatjss.setOcspTimeout(ocspTimeout);
}
public void setKeystorePassFile(String keystorePassFile) {
try {
Path path = Paths.get(keystorePassFile);
String password = new String(Files.readAllBytes(path)).trim();
setKeystorePass(password);
} catch (IOException e) {
throw new RuntimeException(e);
}
}
public void setTruststorePassFile(String truststorePassFile) {
try {
Path path = Paths.get(truststorePassFile);
String password = new String(Files.readAllBytes(path)).trim();
setTruststorePass(password);
} catch (IOException e) {
throw new RuntimeException(e);
}
}
}
tomcatjss-8.0.0/core/src/main/java/org/dogtagpki/tomcat/JSSListener.java 0000664 0000000 0000000 00000003670 14125500203 0026147 0 ustar 00root root 0000000 0000000 /* BEGIN COPYRIGHT BLOCK
* This library is free software; you can redistribute it and/or
* modify it under the terms of the GNU Lesser General Public
* License as published by the Free Software Foundation; either
* version 2.1 of the License, or (at your option) any later version.
*
* This library is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
* Lesser General Public License for more details.
*
* You should have received a copy of the GNU Lesser General Public
* License along with this library; if not, write to the Free Software
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
*
* Copyright (C) 2019 Red Hat, Inc.
* All rights reserved.
* END COPYRIGHT BLOCK */
package org.dogtagpki.tomcat;
import org.apache.catalina.Lifecycle;
import org.apache.catalina.LifecycleEvent;
import org.apache.catalina.LifecycleListener;
import org.apache.tomcat.util.net.jss.TomcatJSS;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
public class JSSListener implements LifecycleListener {
final static Logger logger = LoggerFactory.getLogger(JSSListener.class);
public String configFile;
public String getConfigFile() {
return configFile;
}
public void setConfigFile(String configFile) {
this.configFile = configFile;
}
@Override
public void lifecycleEvent(LifecycleEvent event) {
String type = event.getType();
if (type.equals(Lifecycle.BEFORE_INIT_EVENT)) {
initJSS();
}
}
public void initJSS() {
logger.info("JSSListener: Initializing JSS");
try {
TomcatJSS tomcatjss = TomcatJSS.getInstance();
tomcatjss.loadConfig();
tomcatjss.init();
} catch (Exception e) {
throw new RuntimeException(e);
}
}
}
tomcatjss-8.0.0/docs/ 0000775 0000000 0000000 00000000000 14125500203 0014446 5 ustar 00root root 0000000 0000000 tomcatjss-8.0.0/docs/development/ 0000775 0000000 0000000 00000000000 14125500203 0016770 5 ustar 00root root 0000000 0000000 tomcatjss-8.0.0/docs/development/Synchronizing-GitLab-Branch.adoc 0000664 0000000 0000000 00000003366 14125500203 0025027 0 ustar 00root root 0000000 0000000 = Synchronizing GitLab Branch =
== Overview ==
This page describes the procedure to synchronize a branch from an upstream repository
to a GitLab repository.
== Creating Access Token ==
In the GitLab repository create a project access token with a **write_repository** permission.
See link:https://docs.gitlab.com/ee/user/project/settings/project_access_tokens.html#creating-a-project-access-token[Creating a project access token].
== Configuring Synchronization ==
In the GitLab repository create the following variables:
* `UPSTREAM_URL`: The URL of the upstream repository.
** Unselect **Protect variable** to synchronize unprotected branches.
* `ACCESS_TOKEN`: The value of the access token.
** Unselect **Protect variable** to synchronize unprotected branches.
** Select **Mask variable** to keep the access token hidden.
See link:https://docs.gitlab.com/ee/ci/variables/#add-a-cicd-variable-to-a-project[Add a CI/CD variable to a project].
== Running Synchronization Manually ==
In the GitLab repository run a pipeline with the following parameters:
* **Run for branch name or tag**: The branch to be synchronized.
* **Variables**:
** `SYNC`: `true`
See link:https://docs.gitlab.com/ee/ci/pipelines/#run-a-pipeline-manually[Run a pipeline manually].
== Scheduling Automatic Synchronization ==
In the GitLab repository create a schedule with the following parameters:
* **Interval Pattern**: The frequency of synchronization.
** To synchronize every hour, enter: `0 * * * *`
* **Target Branch**: The branch to be synchronized.
* **Variables**:
** `SYNC`: `true`
Additional schedules can be created for synchronizing other branches.
See link:https://docs.gitlab.com/ee/ci/pipelines/schedules.html#configuring-pipeline-schedules[Configuring pipeline schedules].
tomcatjss-8.0.0/rhel.properties 0000664 0000000 0000000 00000000007 14125500203 0016563 0 ustar 00root root 0000000 0000000 rhel=1
tomcatjss-8.0.0/tests/ 0000775 0000000 0000000 00000000000 14125500203 0014660 5 ustar 00root root 0000000 0000000 tomcatjss-8.0.0/tests/bin/ 0000775 0000000 0000000 00000000000 14125500203 0015430 5 ustar 00root root 0000000 0000000 tomcatjss-8.0.0/tests/bin/ds-artifacts-save.sh 0000775 0000000 0000000 00000000761 14125500203 0021313 0 ustar 00root root 0000000 0000000 #!/bin/bash
CONTAINER=$1
INSTANCE=$2
if [ "$INSTANCE" == "" ]
then
INSTANCE=localhost
fi
ARTIFACTS=/tmp/artifacts/$CONTAINER
mkdir -p $ARTIFACTS/etc
mkdir -p $ARTIFACTS/var/log
docker exec $CONTAINER ls -la /etc/dirsrv
docker cp $CONTAINER:/etc/dirsrv $ARTIFACTS/etc
docker exec $CONTAINER ls -la /var/log/dirsrv
docker cp $CONTAINER:/var/log/dirsrv $ARTIFACTS/var/log
docker exec $CONTAINER journalctl -u dirsrv@$INSTANCE.service > $ARTIFACTS/var/log/dirsrv/slapd-$INSTANCE/systemd.log
tomcatjss-8.0.0/tests/bin/ds-create.sh 0000775 0000000 0000000 00000001132 14125500203 0017633 0 ustar 00root root 0000000 0000000 #!/bin/bash -ex
# This command needs to be executed as it pulls the machine name
# dynamically.
dscreate create-template ds.inf
sed -i \
-e "s/;instance_name = .*/instance_name = localhost/g" \
-e "s/;root_password = .*/root_password = Secret.123/g" \
-e "s/;suffix = .*/suffix = dc=example,dc=com/g" \
-e "s/;self_sign_cert = .*/self_sign_cert = False/g" \
ds.inf
dscreate from-file ds.inf
ldapadd -h $HOSTNAME -x -D "cn=Directory Manager" -w Secret.123 << EOF
dn: dc=example,dc=com
objectClass: domain
dc: example
dn: dc=pki,dc=example,dc=com
objectClass: domain
dc: pki
EOF
tomcatjss-8.0.0/tests/bin/ds-remove.sh 0000775 0000000 0000000 00000000066 14125500203 0017672 0 ustar 00root root 0000000 0000000 #!/bin/bash -ex
dsctl slapd-localhost remove --do-it
tomcatjss-8.0.0/tests/bin/init-workflow.sh 0000775 0000000 0000000 00000000565 14125500203 0020610 0 ustar 00root root 0000000 0000000 #!/bin/bash -e
if [ "$BASE64_MATRIX" == "" ]
then
MATRIX="{\"os\":[\"latest\"]}"
else
MATRIX=$(echo "$BASE64_MATRIX" | base64 -d)
fi
echo "MATRIX: $MATRIX"
echo "::set-output name=matrix::$MATRIX"
if [ "$BASE64_REPO" == "" ]
then
REPO="@pki/master"
else
REPO=$(echo "$BASE64_REPO" | base64 -d)
fi
echo "REPO: $REPO"
echo "::set-output name=repo::$REPO"
tomcatjss-8.0.0/tests/bin/pki-artifacts-save.sh 0000775 0000000 0000000 00000001056 14125500203 0021466 0 ustar 00root root 0000000 0000000 #!/bin/bash
CONTAINER=$1
INSTANCE=$2
if [ "$INSTANCE" == "" ]
then
INSTANCE=pki-tomcat
fi
ARTIFACTS=/tmp/artifacts/$CONTAINER
mkdir -p $ARTIFACTS/etc/pki
mkdir -p $ARTIFACTS/var/log
docker exec $CONTAINER ls -la /etc/pki
docker cp $CONTAINER:/etc/pki/pki.conf $ARTIFACTS/etc/pki
docker cp $CONTAINER:/etc/pki/$INSTANCE $ARTIFACTS/etc/pki
docker exec $CONTAINER ls -la /var/log/pki
docker cp $CONTAINER:/var/log/pki $ARTIFACTS/var/log
docker exec $CONTAINER journalctl -u pki-tomcatd@$INSTANCE.service > $ARTIFACTS/var/log/pki/$INSTANCE/systemd.log
tomcatjss-8.0.0/tests/bin/runner-init.sh 0000775 0000000 0000000 00000001003 14125500203 0020233 0 ustar 00root root 0000000 0000000 #!/bin/bash -ex
docker run \
--name=${NAME} \
--hostname=${HOSTNAME} \
--detach \
--privileged \
--tmpfs /tmp \
--tmpfs /run \
-v /sys/fs/cgroup:/sys/fs/cgroup:ro \
-v ${GITHUB_WORKSPACE}:${SHARED} \
-i \
${IMAGE}
# Pause 5 seconds to let the container start up.
# The container uses /usr/sbin/init as its entrypoint which requires few seconds
# to startup. This avoids the following error:
# [Errno 2] No such file or directory: '/var/cache/dnf/metadata_lock.pid'
sleep 5
tomcatjss-8.0.0/tomcat-9.0/ 0000775 0000000 0000000 00000000000 14125500203 0015311 5 ustar 00root root 0000000 0000000 tomcatjss-8.0.0/tomcat-9.0/src/ 0000775 0000000 0000000 00000000000 14125500203 0016100 5 ustar 00root root 0000000 0000000 tomcatjss-8.0.0/tomcat-9.0/src/main/ 0000775 0000000 0000000 00000000000 14125500203 0017024 5 ustar 00root root 0000000 0000000 tomcatjss-8.0.0/tomcat-9.0/src/main/java/ 0000775 0000000 0000000 00000000000 14125500203 0017745 5 ustar 00root root 0000000 0000000 tomcatjss-8.0.0/tomcat-9.0/src/main/java/org/ 0000775 0000000 0000000 00000000000 14125500203 0020534 5 ustar 00root root 0000000 0000000 tomcatjss-8.0.0/tomcat-9.0/src/main/java/org/dogtagpki/ 0000775 0000000 0000000 00000000000 14125500203 0022505 5 ustar 00root root 0000000 0000000 tomcatjss-8.0.0/tomcat-9.0/src/main/java/org/dogtagpki/tomcat/ 0000775 0000000 0000000 00000000000 14125500203 0023774 5 ustar 00root root 0000000 0000000 tomcatjss-8.0.0/tomcat-9.0/src/main/java/org/dogtagpki/tomcat/JSSContext.java 0000664 0000000 0000000 00000007311 14125500203 0026645 0 ustar 00root root 0000000 0000000 package org.dogtagpki.tomcat;
import java.security.KeyManagementException;
import java.security.SecureRandom;
import javax.net.ssl.KeyManager;
import javax.net.ssl.KeyManagerFactory;
import javax.net.ssl.TrustManager;
import javax.net.ssl.TrustManagerFactory;
import org.mozilla.jss.JSSProvider;
import org.mozilla.jss.provider.javax.crypto.JSSKeyManager;
import org.mozilla.jss.provider.javax.crypto.JSSTrustManager;
import org.mozilla.jss.ssl.javax.JSSEngine;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
public class JSSContext implements org.apache.tomcat.util.net.SSLContext {
public static Logger logger = LoggerFactory.getLogger(JSSContext.class);
private javax.net.ssl.SSLContext ctx;
private String alias;
private JSSKeyManager jkm;
private JSSTrustManager jtm;
public JSSContext(String alias) {
logger.debug("JSSContext(" + alias + ")");
this.alias = alias;
/* These KeyManagers and TrustManagers aren't used with the SSLEngine;
* they're only used to implement certain function calls below. */
try {
KeyManagerFactory kmf = KeyManagerFactory.getInstance("NssX509", "Mozilla-JSS");
jkm = (JSSKeyManager) kmf.getKeyManagers()[0];
TrustManagerFactory tmf = TrustManagerFactory.getInstance("NssX509", "Mozilla-JSS");
jtm = (JSSTrustManager) tmf.getTrustManagers()[0];
} catch (Exception e) {
throw new RuntimeException(e.getMessage(), e);
}
}
@Override
public void init(KeyManager[] kms, TrustManager[] tms, SecureRandom sr) throws KeyManagementException {
logger.debug("JSSContext.init(...)");
try {
String provider = "SunJSSE";
if (JSSProvider.ENABLE_JSSENGINE) {
provider = "Mozilla-JSS";
}
ctx = javax.net.ssl.SSLContext.getInstance("TLS", provider);
ctx.init(kms, tms, sr);
} catch (Exception e) {
throw new KeyManagementException(e.getMessage(), e);
}
}
@Override
public javax.net.ssl.SSLEngine createSSLEngine() {
logger.debug("JSSContext.createSSLEngine()");
javax.net.ssl.SSLEngine eng = ctx.createSSLEngine();
if (eng instanceof JSSEngine) {
JSSEngine j_eng = (JSSEngine) eng;
j_eng.setCertFromAlias(alias);
}
return eng;
}
@Override
public javax.net.ssl.SSLSessionContext getServerSessionContext() {
logger.debug("JSSContext.getServerSessionContext()");
return ctx.getServerSessionContext();
}
@Override
public javax.net.ssl.SSLServerSocketFactory getServerSocketFactory() {
logger.debug("JSSContext.getServerSocketFactory()");
return ctx.getServerSocketFactory();
}
@Override
public javax.net.ssl.SSLParameters getSupportedSSLParameters() {
logger.debug("JSSContext.getSupportedSSLParameters()");
return ctx.getSupportedSSLParameters();
}
@Override
public java.security.cert.X509Certificate[] getCertificateChain(java.lang.String alias) {
logger.debug("JSSContext.getCertificateChain(" + alias + ")");
try {
return jkm.getCertificateChain(alias);
} catch (Exception e) {
throw new RuntimeException(e.getMessage(), e);
}
}
@Override
public java.security.cert.X509Certificate[] getAcceptedIssuers() {
logger.debug("JSSContext.getAcceptedIssuers()");
try {
return jtm.getAcceptedIssuers();
} catch (Exception e) {
throw new RuntimeException(e.getMessage(), e);
}
}
@Override
public void destroy() {
logger.debug("JSSContext.destory()");
}
}
tomcatjss-8.0.0/tomcat-9.0/src/main/java/org/dogtagpki/tomcat/JSSImplementation.java 0000664 0000000 0000000 00000005017 14125500203 0030207 0 ustar 00root root 0000000 0000000 /* BEGIN COPYRIGHT BLOCK
* This library is free software; you can redistribute it and/or
* modify it under the terms of the GNU Lesser General Public
* License as published by the Free Software Foundation; either
* version 2.1 of the License, or (at your option) any later version.
*
* This library is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
* Lesser General Public License for more details.
*
* You should have received a copy of the GNU Lesser General Public
* License along with this library; if not, write to the Free Software
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
*
* Copyright (C) 2007 Red Hat, Inc.
* All rights reserved.
* END COPYRIGHT BLOCK */
package org.dogtagpki.tomcat;
import javax.net.ssl.SSLSession;
import org.apache.tomcat.util.net.jsse.JSSESupport;
import org.apache.tomcat.util.net.SSLHostConfig;
import org.apache.tomcat.util.net.SSLHostConfigCertificate;
import org.apache.tomcat.util.net.SSLImplementation;
import org.apache.tomcat.util.net.SSLSupport;
import org.apache.tomcat.util.net.SSLUtil;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
public class JSSImplementation extends SSLImplementation {
public static Logger logger = LoggerFactory.getLogger(JSSUtil.class);
public JSSImplementation() {
logger.debug("JSSImplementation: instance created");
}
@Override
public SSLSupport getSSLSupport(SSLSession session) {
logger.debug("JSSImplementation.getSSLSupport()");
return new JSSESupport(session);
}
@Override
public SSLUtil getSSLUtil(SSLHostConfigCertificate cert) {
logger.debug("JSSImplementation: getSSLUtil()");
logger.debug("JSSImplementation: key alias: " + cert.getCertificateKeyAlias());
logger.debug("JSSImplementation: keystore provider: " + cert.getCertificateKeystoreProvider());
SSLHostConfig hostConfig = cert.getSSLHostConfig();
logger.debug("JSSImplementation: key manager alg: " + hostConfig.getKeyManagerAlgorithm());
logger.debug("JSSImplementation: truststore alg: " + hostConfig.getTruststoreAlgorithm());
logger.debug("JSSImplementation: truststore provider: " + hostConfig.getTruststoreProvider());
return new JSSUtil(cert);
}
@Override
public boolean isAlpnSupported() {
// NSS supports ALPN but JSS doesn't yet support ALPN.
return false;
}
}
tomcatjss-8.0.0/tomcat-9.0/src/main/java/org/dogtagpki/tomcat/JSSUtil.java 0000664 0000000 0000000 00000007760 14125500203 0026146 0 ustar 00root root 0000000 0000000 /* BEGIN COPYRIGHT BLOCK
* This library is free software; you can redistribute it and/or
* modify it under the terms of the GNU Lesser General Public
* License as published by the Free Software Foundation; either
* version 2.1 of the License, or (at your option) any later version.
*
* This library is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
* Lesser General Public License for more details.
*
* You should have received a copy of the GNU Lesser General Public
* License along with this library; if not, write to the Free Software
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
*
* Copyright (C) 2018 Red Hat, Inc.
* All rights reserved.
* END COPYRIGHT BLOCK */
package org.dogtagpki.tomcat;
import java.util.Arrays;
import java.util.Collections;
import java.util.HashSet;
import java.util.List;
import java.util.Set;
import javax.net.ssl.KeyManager;
import javax.net.ssl.KeyManagerFactory;
import javax.net.ssl.SSLEngine;
import javax.net.ssl.TrustManager;
import javax.net.ssl.TrustManagerFactory;
import org.apache.juli.logging.Log;
import org.apache.juli.logging.LogFactory;
import org.apache.tomcat.util.net.SSLContext;
import org.apache.tomcat.util.net.SSLHostConfigCertificate;
import org.apache.tomcat.util.net.SSLUtilBase;
import org.mozilla.jss.JSSProvider;
import org.mozilla.jss.provider.javax.crypto.JSSNativeTrustManager;
public class JSSUtil extends SSLUtilBase {
public static Log logger = LogFactory.getLog(JSSUtil.class);
private String keyAlias;
private SSLEngine engine;
private Set protocols;
private Set ciphers;
public JSSUtil(SSLHostConfigCertificate cert) {
super(cert);
keyAlias = certificate.getCertificateKeyAlias();
logger.debug("JSSUtil: instance created");
}
private void init() {
if (engine != null) {
return;
}
try {
JSSContext ctx = new JSSContext(null);
ctx.init(null, null, null);
engine = ctx.createSSLEngine();
} catch (Exception e) {
throw new RuntimeException(e.getMessage(), e);
}
protocols = Collections.unmodifiableSet(
new HashSet<>(Arrays.asList(engine.getSupportedProtocols()))
);
ciphers = Collections.unmodifiableSet(
new HashSet<>(Arrays.asList(engine.getSupportedCipherSuites()))
);
}
@Override
public KeyManager[] getKeyManagers() throws Exception {
logger.debug("JSSUtil: getKeyManagers()");
KeyManagerFactory jkm = KeyManagerFactory.getInstance("NssX509", "Mozilla-JSS");
return jkm.getKeyManagers();
}
@Override
public TrustManager[] getTrustManagers() throws Exception {
logger.debug("JSSUtil: getTrustManagers()");
if (!JSSProvider.ENABLE_JSSENGINE) {
TrustManagerFactory tmf = TrustManagerFactory.getInstance("NssX509");
return tmf.getTrustManagers();
}
return new TrustManager[] { new JSSNativeTrustManager() };
}
@Override
public SSLContext createSSLContextInternal(List negotiableProtocols) throws Exception {
logger.debug("JSSUtil createSSLContextInternal(...) keyAlias=" + keyAlias);
return new JSSContext(keyAlias);
}
@Override
public boolean isTls13RenegAuthAvailable() {
logger.debug("JSSUtil: isTls13RenegAuthAvailable()");
return true;
}
@Override
public Log getLog() {
logger.debug("JSSUtil: getLog()");
return logger;
}
@Override
protected Set getImplementedProtocols() {
logger.debug("JSSUtil: getImplementedProtocols()");
init();
return protocols;
}
@Override
protected Set getImplementedCiphers() {
logger.debug("JSSUtil: getImplementedCiphers()");
init();
return ciphers;
}
}
tomcatjss-8.0.0/tomcatjss.spec 0000664 0000000 0000000 00000010744 14125500203 0016407 0 ustar 00root root 0000000 0000000 ################################################################################
Name: tomcatjss
################################################################################
Summary: JSS Connector for Apache Tomcat
URL: http://www.dogtagpki.org/wiki/TomcatJSS
License: LGPLv2+
BuildArch: noarch
# For development (i.e. unsupported) releases, use x.y.z-0.n..
# For official (i.e. supported) releases, use x.y.z-r where r >=1.
Version: 8.0.0
Release: 1%{?_timestamp}%{?_commit_id}%{?dist}
#global _phase -alpha1
# To generate the source tarball:
# $ git clone https://github.com/dogtagpki/tomcatjss.git
# $ cd tomcatjss
# $ git archive \
# --format=tar.gz \
# --prefix tomcatjss-VERSION/ \
# -o tomcatjss-VERSION.tar.gz \
#
Source: https://github.com/dogtagpki/tomcatjss/archive/v%{version}%{?_phase}/tomcatjss-%{version}%{?_phase}.tar.gz
# To create a patch for all changes since a version tag:
# $ git format-patch \
# --stdout \
# \
# > tomcatjss-VERSION-RELEASE.patch
# Patch: tomcatjss-VERSION-RELEASE.patch
################################################################################
# Java
################################################################################
%define java_devel java-11-openjdk-devel
%define java_headless java-11-openjdk-headless
%define java_home /usr/lib/jvm/jre-11-openjdk
################################################################################
# Build Dependencies
################################################################################
# jpackage-utils requires versioning to meet both build and runtime requirements
# jss requires versioning to meet both build and runtime requirements
# tomcat requires versioning to meet both build and runtime requirements
# Java
BuildRequires: ant
BuildRequires: apache-commons-lang3
BuildRequires: %{java_devel}
BuildRequires: jpackage-utils >= 0:1.7.5-15
# SLF4J
BuildRequires: slf4j
BuildRequires: slf4j-jdk14
# JSS
BuildRequires: jss >= 5.0.0
# Tomcat
%if 0%{?rhel} && ! 0%{?eln}
BuildRequires: pki-servlet-engine >= 1:9.0.7
%else
BuildRequires: tomcat >= 1:9.0.7
%endif
################################################################################
# Runtime Dependencies
################################################################################
# Java
Requires: apache-commons-lang3
Requires: %{java_headless}
Requires: jpackage-utils >= 0:1.7.5-15
# SLF4J
Requires: slf4j
Requires: slf4j-jdk14
# JSS
Requires: jss >= 5.0.0
# Tomcat
%if 0%{?rhel} && ! 0%{?eln}
Requires: pki-servlet-engine >= 1:9.0.7
%else
Requires: tomcat >= 1:9.0.7
%endif
# PKI
Conflicts: pki-base < 10.10.0
%if 0%{?rhel}
# For EPEL, override the '_sharedstatedir' macro on RHEL
%define _sharedstatedir /var/lib
%endif
%description
JSS Connector for Apache Tomcat, installed via the tomcatjss package,
is a Java Secure Socket Extension (JSSE) module for Apache Tomcat that
uses Java Security Services (JSS), a Java interface to Network Security
Services (NSS).
################################################################################
%prep
################################################################################
%autosetup -n tomcatjss-%{version}%{?_phase} -p 1
################################################################################
%install
################################################################################
# get Tomcat . version number
tomcat_version=`/usr/sbin/tomcat version | sed -n 's/Server number: *\([0-9]\+\.[0-9]\+\).*/\1/p'`
app_server=tomcat-$tomcat_version
ant -f build.xml \
-Dversion=%{version} \
-Dsrc.dir=$app_server \
-Ddist.dir=%{_vpath_builddir} \
-Djnidir=%{_jnidir} \
-Dinstall.doc.dir=%{buildroot}%{_docdir}/%{name} \
-Dinstall.jar.dir=%{buildroot}%{_javadir} \
install
################################################################################
%files
################################################################################
%license LICENSE
%defattr(-,root,root)
%doc README
%doc LICENSE
%{_javadir}/*
################################################################################
%changelog
* Thu Mar 15 2018 Dogtag PKI Team 7.3.0-0
- To list changes in since :
$ git log --pretty=oneline --abbrev-commit --no-decorate ..