Fixed PKCS12Export output.

The PKCS12Export has been modified such that if an error occurs
in normal mode it will display the error message and in debug
mode it will display the full stack trace.

The code has also been refactored such that it can be reused as a
library in addition to command-line tool. The code will now throw
exceptions instead of exiting to the system.

https://fedorahosted.org/pki/ticket/1224

1 files changed, 262 insertions, 206 deletions

diff --git a/base/java-tools/src/com/netscape/cmstools/PKCS12Export.java b/base/java-tools/src/com/netscape/cmstools/PKCS12Export.java
index 9ab2f8505..77e6b7cb8 100644
--- a/base/java-tools/src/com/netscape/cmstools/PKCS12Export.java
+++ b/base/java-tools/src/com/netscape/cmstools/PKCS12Export.java
@@ -21,7 +21,6 @@ import java.io.BufferedReader;
 import java.io.ByteArrayOutputStream;
 import java.io.FileOutputStream;
 import java.io.FileReader;
-import java.io.IOException;
 import java.security.MessageDigest;
 
 import org.mozilla.jss.CryptoManager;
@@ -62,262 +61,319 @@ import org.mozilla.jss.util.Password;
  */
 public class PKCS12Export {
 
-    private static boolean debugMode = false;
+    boolean debug;
 
-    private static void debug(String s) {
-        if (debugMode)
-            System.out.println("PKCS12Export debug: " + s);
+    String databaseDirectory;
+    String databasePasswordFilename;
+
+    String pkcs12PasswordFilename;
+    String pkcs12OutputFilename;
+
+    public boolean isDebug() {
+        return debug;
     }
 
-    private static void printUsage() {
-        System.out.println(
-                "Usage: PKCS12Export -d <cert/key db directory> -p <file containing password for keydb> -w <file containing pkcs12 password> -o <output file for pkcs12>");
-        System.out.println("");
-        System.out.println("If you want to turn on debug, do the following:");
-        System.out.println(
-                "Usage: PKCS12Export -debug -d <cert/key db directory> -p <file containing password for keydb> -w <file containing pkcs12 password> -o <output file for pkcs12>");
+    public void setDebug(boolean debug) {
+        this.debug = debug;
     }
 
-    private static byte[] getEncodedKey(org.mozilla.jss.crypto.PrivateKey pkey) {
-        try {
-            CryptoManager cm = CryptoManager.getInstance();
-            CryptoToken token = cm.getInternalKeyStorageToken();
-            KeyGenerator kg = token.getKeyGenerator(KeyGenAlgorithm.DES3);
-            SymmetricKey sk = kg.generate();
-            KeyWrapper wrapper = token.getKeyWrapper(KeyWrapAlgorithm.DES3_CBC_PAD);
-            byte iv[] = { 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1 };
-            IVParameterSpec param = new IVParameterSpec(iv);
-            wrapper.initWrap(sk, param);
-            byte[] enckey = wrapper.wrap(pkey);
-            Cipher c = token.getCipherContext(EncryptionAlgorithm.DES3_CBC_PAD);
-            c.initDecrypt(sk, param);
-            byte[] recovered = c.doFinal(enckey);
-            return recovered;
-        } catch (Exception e) {
-            debug("PKCS12Export  getEncodedKey: Exception=" + e.toString());
-            System.exit(1);
-        }
+    public String getDatabaseDirectory() {
+        return databaseDirectory;
+    }
 
-        return null;
+    public void setDatabaseDirectory(String databaseDirectory) {
+        this.databaseDirectory = databaseDirectory;
+    }
+    public String getDatabasePasswordFilename() {
+        return databasePasswordFilename;
     }
 
-    private static void addKeyBag(org.mozilla.jss.crypto.PrivateKey pkey, X509Certificate x509cert,
-            Password pass, byte[] localKeyId, SEQUENCE safeContents) {
-        try {
-            PasswordConverter passConverter = new PasswordConverter();
-            byte salt[] = { 0x01, 0x01, 0x01, 0x01 };
-            byte[] priData = getEncodedKey(pkey);
-
-            PrivateKeyInfo pki = (PrivateKeyInfo)
-                    ASN1Util.decode(PrivateKeyInfo.getTemplate(), priData);
-            ASN1Value key = EncryptedPrivateKeyInfo.createPBE(
-                    PBEAlgorithm.PBE_SHA1_DES3_CBC,
-                    pass, salt, 1, passConverter, pki);
-            SET keyAttrs = createBagAttrs(
-                    x509cert.getSubjectDN().toString(), localKeyId);
-            SafeBag keyBag = new SafeBag(SafeBag.PKCS8_SHROUDED_KEY_BAG,
-                    key, keyAttrs);
-            safeContents.addElement(keyBag);
-        } catch (Exception e) {
-            debug("PKCS12Export addKeyBag: Exception=" + e.toString());
-            System.exit(1);
-        }
+    public void setDatabasePasswordFilename(String databasePasswordFilename) {
+        this.databasePasswordFilename = databasePasswordFilename;
     }
 
-    private static byte[] addCertBag(X509Certificate x509cert, String nickname,
-            SEQUENCE safeContents) throws IOException {
-        byte[] localKeyId = null;
-        try {
-            ASN1Value cert = new OCTET_STRING(x509cert.getEncoded());
-            localKeyId = createLocalKeyId(x509cert);
-            SET certAttrs = null;
-            if (nickname != null)
-                certAttrs = createBagAttrs(nickname, localKeyId);
-            SafeBag certBag = new SafeBag(SafeBag.CERT_BAG,
-                    new CertBag(CertBag.X509_CERT_TYPE, cert), certAttrs);
-            safeContents.addElement(certBag);
-        } catch (Exception e) {
-            debug("PKCS12Export addCertBag: " + e.toString());
-            System.exit(1);
-        }
+    public String getPkcs12PasswordFilename() {
+        return pkcs12PasswordFilename;
+    }
+
+    public void setPkcs12PasswordFilename(String pkcs12PasswordFilename) {
+        this.pkcs12PasswordFilename = pkcs12PasswordFilename;
+    }
+
+    public String getPkcs12OutputFilename() {
+        return pkcs12OutputFilename;
+    }
+
+    public void setPkcs12OutputFilename(String pkcs12OutputFilename) {
+        this.pkcs12OutputFilename = pkcs12OutputFilename;
+    }
+
+    void debug(String s) {
+        if (debug)
+            System.out.println("PKCS12Export: " + s);
+    }
+
+    byte[] getEncodedKey(org.mozilla.jss.crypto.PrivateKey pkey) throws Exception {
+
+        CryptoManager cm = CryptoManager.getInstance();
+        CryptoToken token = cm.getInternalKeyStorageToken();
+
+        KeyGenerator kg = token.getKeyGenerator(KeyGenAlgorithm.DES3);
+        SymmetricKey sk = kg.generate();
+
+        KeyWrapper wrapper = token.getKeyWrapper(KeyWrapAlgorithm.DES3_CBC_PAD);
+        byte iv[] = { 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1 };
+        IVParameterSpec param = new IVParameterSpec(iv);
+        wrapper.initWrap(sk, param);
+        byte[] enckey = wrapper.wrap(pkey);
+
+        Cipher c = token.getCipherContext(EncryptionAlgorithm.DES3_CBC_PAD);
+        c.initDecrypt(sk, param);
+        return c.doFinal(enckey);
+    }
+
+    void addKeyBag(org.mozilla.jss.crypto.PrivateKey pkey, X509Certificate x509cert,
+            Password pass, byte[] localKeyId, SEQUENCE safeContents) throws Exception {
+
+        PasswordConverter passConverter = new PasswordConverter();
+        byte salt[] = { 0x01, 0x01, 0x01, 0x01 };
+        byte[] priData = getEncodedKey(pkey);
+
+        PrivateKeyInfo pki = (PrivateKeyInfo)
+                ASN1Util.decode(PrivateKeyInfo.getTemplate(), priData);
+
+        ASN1Value key = EncryptedPrivateKeyInfo.createPBE(
+                PBEAlgorithm.PBE_SHA1_DES3_CBC,
+                pass, salt, 1, passConverter, pki);
+
+        SET keyAttrs = createBagAttrs(
+                x509cert.getSubjectDN().toString(), localKeyId);
+
+        SafeBag keyBag = new SafeBag(SafeBag.PKCS8_SHROUDED_KEY_BAG,
+                key, keyAttrs);
+
+        safeContents.addElement(keyBag);
+    }
+
+    byte[] addCertBag(X509Certificate x509cert, String nickname,
+            SEQUENCE safeContents) throws Exception {
+
+        ASN1Value cert = new OCTET_STRING(x509cert.getEncoded());
+        byte[] localKeyId = createLocalKeyId(x509cert);
+
+        SET certAttrs = null;
+        if (nickname != null)
+            certAttrs = createBagAttrs(nickname, localKeyId);
+
+        SafeBag certBag = new SafeBag(SafeBag.CERT_BAG,
+                new CertBag(CertBag.X509_CERT_TYPE, cert), certAttrs);
+
+        safeContents.addElement(certBag);
 
         return localKeyId;
     }
 
-    private static byte[] createLocalKeyId(X509Certificate cert) {
-        try {
-            // SHA1 hash of the X509Cert der encoding
-            byte certDer[] = cert.getEncoded();
+    byte[] createLocalKeyId(X509Certificate cert) throws Exception {
 
-            MessageDigest md = MessageDigest.getInstance("SHA");
+        // SHA1 hash of the X509Cert der encoding
+        byte certDer[] = cert.getEncoded();
 
-            md.update(certDer);
-            return md.digest();
-        } catch (Exception e) {
-            debug("PKCS12Export createLocalKeyId: Exception: " + e.toString());
-            System.exit(1);
+        MessageDigest md = MessageDigest.getInstance("SHA");
+
+        md.update(certDer);
+        return md.digest();
+    }
+
+    SET createBagAttrs(String nickName, byte localKeyId[])
+            throws Exception {
+
+        SET attrs = new SET();
+        SEQUENCE nickNameAttr = new SEQUENCE();
+
+        nickNameAttr.addElement(SafeBag.FRIENDLY_NAME);
+        SET nickNameSet = new SET();
+
+        nickNameSet.addElement(new BMPString(nickName));
+        nickNameAttr.addElement(nickNameSet);
+        attrs.addElement(nickNameAttr);
+        SEQUENCE localKeyAttr = new SEQUENCE();
+
+        localKeyAttr.addElement(SafeBag.LOCAL_KEY_ID);
+        SET localKeySet = new SET();
+
+        localKeySet.addElement(new OCTET_STRING(localKeyId));
+        localKeyAttr.addElement(localKeySet);
+        attrs.addElement(localKeyAttr);
+
+        return attrs;
+    }
+
+    public byte[] generatePKCS12Data(Password password) throws Exception {
+
+        debug("Generating PKCS #12 data");
+
+        CryptoManager cm = CryptoManager.getInstance();
+        CryptoToken token = cm.getInternalKeyStorageToken();
+        CryptoStore store = token.getCryptoStore();
+
+        X509Certificate[] certs = store.getCertificates();
+
+        SEQUENCE encSafeContents = new SEQUENCE();
+        SEQUENCE safeContents = new SEQUENCE();
+
+        for (int i = 0; i < certs.length; i++) {
+            String nickname = certs[i].getNickname();
+            debug(" * Certificate: " + nickname);
+            org.mozilla.jss.crypto.PrivateKey prikey = cm.findPrivKeyByCert(certs[i]);
+
+            if (prikey == null) {
+                debug("   Private key does not exist");
+                addCertBag(certs[i], null, safeContents);
+
+            } else {
+                debug("   Private key exists");
+                byte localKeyId[] =
+                        addCertBag(certs[i], nickname, safeContents);
+                addKeyBag(prikey, certs[i], password, localKeyId, encSafeContents);
+            }
         }
 
-        return null;
+        AuthenticatedSafes authSafes = new AuthenticatedSafes();
+        authSafes.addSafeContents(safeContents);
+        authSafes.addSafeContents(encSafeContents);
+
+        PFX pfx = new PFX(authSafes);
+        pfx.computeMacData(password, null, 5);
+
+        ByteArrayOutputStream bos = new ByteArrayOutputStream();
+        pfx.encode(bos);
+
+        return bos.toByteArray();
     }
 
-    private static SET createBagAttrs(String nickName, byte localKeyId[])
-            throws IOException {
+    public void initDatabase() throws Exception {
+
+        debug("Initializing database in " + databaseDirectory);
+
+        CryptoManager.InitializationValues vals =
+                new CryptoManager.InitializationValues(
+                        databaseDirectory, "", "", "secmod.db");
+        CryptoManager.initialize(vals);
+
+        CryptoManager cm = CryptoManager.getInstance();
+        CryptoToken token = cm.getInternalKeyStorageToken();
+
+        debug("Reading database password from " + databasePasswordFilename);
+
+        String line;
+        try (BufferedReader in = new BufferedReader(new FileReader(databasePasswordFilename))) {
+            line = in.readLine();
+            if (line == null) {
+                line = "";
+            }
+        }
+        Password password = new Password(line.toCharArray());
+
+        debug("Logging into security token");
+
         try {
-            SET attrs = new SET();
-            SEQUENCE nickNameAttr = new SEQUENCE();
+            token.login(password);
+        } finally {
+            password.clear();
+        }
+    }
 
-            nickNameAttr.addElement(SafeBag.FRIENDLY_NAME);
-            SET nickNameSet = new SET();
+    public void exportData() throws Exception {
 
-            nickNameSet.addElement(new BMPString(nickName));
-            nickNameAttr.addElement(nickNameSet);
-            attrs.addElement(nickNameAttr);
-            SEQUENCE localKeyAttr = new SEQUENCE();
+        debug("Reading PKCS #12 password from " + pkcs12PasswordFilename);
 
-            localKeyAttr.addElement(SafeBag.LOCAL_KEY_ID);
-            SET localKeySet = new SET();
+        String line;
+        try (BufferedReader in = new BufferedReader(new FileReader(pkcs12PasswordFilename))) {
+            line = in.readLine();
+            if (line == null) {
+                line = "";
+            }
+        }
+        Password password = new Password(line.toCharArray());
 
-            localKeySet.addElement(new OCTET_STRING(localKeyId));
-            localKeyAttr.addElement(localKeySet);
-            attrs.addElement(localKeyAttr);
-            return attrs;
-        } catch (Exception e) {
-            debug("PKCS12Export createBagAttrs: Exception=" + e.toString());
-            System.exit(1);
+        byte[] data;
+        try {
+            data = generatePKCS12Data(password);
+        } finally {
+            password.clear();
+        }
+
+        debug("Storing PKCS #12 data into " + pkcs12OutputFilename);
+
+        try (FileOutputStream fos = new FileOutputStream(pkcs12OutputFilename)) {
+            fos.write(data);
         }
+    }
 
-        return null;
+    public static void printUsage() {
+        System.out.println(
+                "Usage: PKCS12Export -d <cert/key db directory> -p <file containing password for keydb> -w <file containing pkcs12 password> -o <output file for pkcs12>");
+        System.out.println();
+        System.out.println("If you want to turn on debug, do the following:");
+        System.out.println(
+                "Usage: PKCS12Export -debug -d <cert/key db directory> -p <file containing password for keydb> -w <file containing pkcs12 password> -o <output file for pkcs12>");
     }
 
-    public static void main(String args[]) {
+    public static void main(String args[]) throws Exception {
+
         if (args.length < 8) {
             printUsage();
             System.exit(1);
         }
 
-        String pwdfile = null;
-        String dir = null;
-        String pk12pwdfile = null;
-        String pk12output = null;
+        boolean debug = false;
+        String databaseDirectory = null;
+        String databasePasswordFilename = null;
+        String pkcs12PasswordFilename = null;
+        String pkcs12OutputFilename = null;
+
+        // TODO: get parameters using getopt
+
         for (int i = 0; i < args.length; i++) {
             if (args[i].equals("-d")) {
-                dir = args[i + 1];
+                databaseDirectory = args[i + 1];
+
             } else if (args[i].equals("-p")) {
-                pwdfile = args[i + 1];
+                databasePasswordFilename = args[i + 1];
+
             } else if (args[i].equals("-s")) {
                 // snickname = args[i + 1];
+
             } else if (args[i].equals("-w")) {
-                pk12pwdfile = args[i + 1];
+                pkcs12PasswordFilename = args[i + 1];
+
             } else if (args[i].equals("-o")) {
-                pk12output = args[i + 1];
+                pkcs12OutputFilename = args[i + 1];
+
             } else if (args[i].equals("-debug")) {
-                debugMode = true;
+                debug = true;
             }
         }
 
-        debug("The directory for certdb/keydb is " + dir);
-        debug("The password file for keydb is " + pwdfile);
+        // TODO: validate parameters
 
-        // get password
-        String pwd = null;
-        BufferedReader in = null;
         try {
-            in = new BufferedReader(new FileReader(pwdfile));
-            pwd = in.readLine();
-            if (pwd == null) {
-                pwd = "";
-            }
-        } catch (Exception e) {
-            debug("Failed to read the keydb password from the file. Exception: " + e.toString());
-            System.exit(1);
-        } finally {
-            if (in != null) {
-                try {
-                    in.close();
-                } catch (IOException e) {
-                    e.printStackTrace();
-                }
-            }
-        }
-        String pk12pwd = null;
+            PKCS12Export tool = new PKCS12Export();
+            tool.setDebug(debug);
+            tool.setDatabaseDirectory(databaseDirectory);
+            tool.setDatabasePasswordFilename(databasePasswordFilename);
+            tool.setPkcs12PasswordFilename(pkcs12PasswordFilename);
+            tool.setPkcs12OutputFilename(pkcs12OutputFilename);
 
-        try {
-            in = new BufferedReader(new FileReader(pk12pwdfile));
-            pk12pwd = in.readLine();
-            if (pk12pwd == null) {
-                pk12pwd = "";
-            }
-        } catch (Exception e) {
-            debug("Failed to read the keydb password from the file. Exception: " + e.toString());
-            System.exit(1);
-        } finally {
-            if (in != null) {
-                try {
-                    in.close();
-                } catch (IOException e) {
-                    e.printStackTrace();
-                }
-            }
-        }
+            tool.initDatabase();
+            tool.exportData();
 
-        CryptoManager cm = null;
-        try {
-            CryptoManager.InitializationValues vals =
-                    new CryptoManager.InitializationValues(dir, "", "", "secmod.db");
-            CryptoManager.initialize(vals);
-            cm = CryptoManager.getInstance();
         } catch (Exception e) {
-            debug("Failed to initialize the certdb.");
-            System.exit(1);
-        }
-
-        SEQUENCE encSafeContents = new SEQUENCE();
-        SEQUENCE safeContents = new SEQUENCE();
-        try {
-            CryptoToken token = cm.getInternalKeyStorageToken();
-            Password pass = new Password(pwd.toCharArray());
-            token.login(pass);
-            CryptoStore store = token.getCryptoStore();
-            X509Certificate[] certs = store.getCertificates();
-            debug("Number of user certificates = " + certs.length);
-            Password pass12 = new Password(pk12pwd.toCharArray());
-            for (int i = 0; i < certs.length; i++) {
-                String nickname = certs[i].getNickname();
-                debug("Certificate nickname = " + nickname);
-                org.mozilla.jss.crypto.PrivateKey prikey = null;
-                try {
-                    prikey = cm.findPrivKeyByCert(certs[i]);
-                } catch (Exception e) {
-                    debug("PKCS12Export Exception: " + e.toString());
-                }
-
-                if (prikey == null) {
-                    debug("Private key is null");
-                    addCertBag(certs[i], null, safeContents);
-                } else {
-                    debug("Private key is not null");
-                    byte localKeyId[] =
-                            addCertBag(certs[i], nickname, safeContents);
-                    addKeyBag(prikey, certs[i], pass12, localKeyId, encSafeContents);
-                }
+            if (debug) {
+                e.printStackTrace();
+            } else {
+                System.err.println("ERROR: " + e);
             }
-
-            AuthenticatedSafes authSafes = new AuthenticatedSafes();
-            authSafes.addSafeContents(safeContents);
-            authSafes.addSafeContents(encSafeContents);
-            PFX pfx = new PFX(authSafes);
-            pfx.computeMacData(pass12, null, 5);
-            ByteArrayOutputStream bos = new ByteArrayOutputStream();
-            pfx.encode(bos);
-            FileOutputStream fos = new FileOutputStream(pk12output);
-            fos.write(bos.toByteArray());
-            fos.flush();
-            fos.close();
-            pass.clear();
-            pass12.clear();
-        } catch (Exception e) {
-            debug("PKCS12Export Exception: " + e.toString());
             System.exit(1);
         }
     }