diff options
Diffstat (limited to 'base/common/src/com/netscape/cms')
3 files changed, 288 insertions, 52 deletions
diff --git a/base/common/src/com/netscape/cms/servlet/admin/KRAConnectorProcessor.java b/base/common/src/com/netscape/cms/servlet/admin/KRAConnectorProcessor.java new file mode 100644 index 000000000..5aadfba88 --- /dev/null +++ b/base/common/src/com/netscape/cms/servlet/admin/KRAConnectorProcessor.java @@ -0,0 +1,190 @@ +// --- BEGIN COPYRIGHT BLOCK --- +// This program is free software; you can redistribute it and/or modify +// it under the terms of the GNU General Public License as published by +// the Free Software Foundation; version 2 of the License. +// +// This program is distributed in the hope that it will be useful, +// but WITHOUT ANY WARRANTY; without even the implied warranty of +// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +// GNU General Public License for more details. +// +// You should have received a copy of the GNU General Public License along +// with this program; if not, write to the Free Software Foundation, Inc., +// 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. +// +// (C) 2013 Red Hat, Inc. +// All rights reserved. +// --- END COPYRIGHT BLOCK --- +package com.netscape.cms.servlet.admin; + +import java.util.Locale; + +import com.netscape.certsrv.apps.CMS; +import com.netscape.certsrv.base.BadRequestException; +import com.netscape.certsrv.base.EBaseException; +import com.netscape.certsrv.base.EPropertyNotFound; +import com.netscape.certsrv.base.IConfigStore; +import com.netscape.certsrv.base.PKIException; +import com.netscape.certsrv.ca.ICAService; +import com.netscape.certsrv.ca.ICertificateAuthority; +import com.netscape.certsrv.connector.IConnector; +import com.netscape.certsrv.system.KRAConnectorInfo; +import com.netscape.cms.servlet.processors.Processor; + +/** + * @author Ade Lee + */ +public class KRAConnectorProcessor extends Processor { + private boolean connectorExists = false; + + // Connector constants + public final static String PREFIX = "ca.connector.KRA"; + + public KRAConnectorProcessor(Locale locale) throws EPropertyNotFound, EBaseException { + super("kraconnector", locale); + ICertificateAuthority ca = (ICertificateAuthority)CMS.getSubsystem("ca"); + ICAService caService = (ICAService)ca.getCAService(); + connectorExists = (caService.getKRAConnector() != null)? true:false; + } + + public void removeConnector(String newHost, String newPort) throws EPropertyNotFound, EBaseException { + if (! connectorExists) { + CMS.debug("removeConnector: no KRA connector exists, returning success"); + return; + } + + if ((newHost == null) || (newPort == null)) { + CMS.debug("removeConnector: malformed request. newHost or newPort is null"); + throw new BadRequestException("Bad Request from KRA. KRA Host or Port not defined"); + } + IConfigStore cs = CMS.getConfigStore(); + String host = cs.getString(PREFIX + ".host"); + String port = cs.getString(PREFIX + ".port"); + + if ((host == null) || (port == null)) { + CMS.debug("removeConnector: bad connector configuration - host or port are null"); + throw new PKIException("Bad Connector configuration on this CA"); + } + + String hostport = newHost + ":" + newPort; + if ((host.equals(newHost)) && port.equals(newPort)) { + CMS.debug("removeConnector: Removing " + PREFIX + " substore"); + cs.removeSubStore(PREFIX); + cs.commit(true); + deleteConnector(); + } else if ((host.indexOf(' ') != -1) && host.contains(hostport)) { + CMS.debug("removeConnector: Removing " + hostport +"from " + PREFIX); + cs.putString(PREFIX + ".host", host.replace(hostport, "").replace(" ", " ")); + cs.commit(true); + replaceConnector(); + } else { + CMS.debug("removeConnector: no connector for " + hostport + " exists. Returning success"); + } + } + + public void stopConnector() { + ICertificateAuthority ca = (ICertificateAuthority)CMS.getSubsystem("ca"); + ICAService caService = (ICAService)ca.getCAService(); + IConnector kraConnector = caService.getKRAConnector(); + if (kraConnector != null) { + kraConnector.stop(); + } + } + + public void startConnector() { + ICertificateAuthority ca = (ICertificateAuthority)CMS.getSubsystem("ca"); + ICAService caService = (ICAService)ca.getCAService(); + IConnector kraConnector = caService.getKRAConnector(); + if (kraConnector != null) { + kraConnector.start(); + } + } + + public void replaceConnector() throws EBaseException { + // stop the old connector + stopConnector(); + + ICertificateAuthority ca = (ICertificateAuthority)CMS.getSubsystem("ca"); + ICAService caService = (ICAService)ca.getCAService(); + IConfigStore cs = CMS.getConfigStore(); + + IConnector kraConnector = caService.getConnector(cs.getSubStore(PREFIX)); + caService.setKRAConnector(kraConnector); + + startConnector(); + } + + public void deleteConnector() { + stopConnector(); + + ICertificateAuthority ca = (ICertificateAuthority)CMS.getSubsystem("ca"); + ICAService caService = (ICAService)ca.getCAService(); + caService.setKRAConnector(null); + } + + public void addConnector(KRAConnectorInfo info) throws EPropertyNotFound, EBaseException { + IConfigStore cs = CMS.getConfigStore(); + String newHost = info.getHost(); + String newPort = info.getPort(); + String newTransportCert = info.getTransportCert(); + + if ((newHost == null) || (newPort == null) || (newTransportCert == null)) { + CMS.debug("addConnector: malformed request. newHost, newPort or transport cert is null"); + throw new BadRequestException("Bad request from KRA: KRA host, port or transport cert not defined"); + } + + if (connectorExists) { + String host = cs.getString(PREFIX + ".host"); + String port = cs.getString(PREFIX + ".port"); + + if ((!host.equals(newHost)) || (!port.equals(newPort))) { //existing connector is not the same + + // check transport cert + String transportCert = cs.getString(PREFIX + ".transportCert"); + if (!transportCert.equals(newTransportCert)) { + CMS.debug("addConnector: Connector is already defined"); + throw new BadRequestException("KRA connector has already been deined for this CA"); + } + + String hostport = newHost + ":" + newPort; + if (host.indexOf(' ') != -1) { // host is a list + if (host.contains(hostport)) { + CMS.debug("addConnector: connector for " + hostport + " is already present. Returning success"); + return; + } else { + CMS.debug("addConnector: adding " + hostport + " to KRA connector host list"); + cs.putString(PREFIX + ".host", host + " " + hostport); + cs.commit(true); + replaceConnector(); + return; + } + } else { // host is not a list, turn it into one + CMS.debug("addConnector: adding " + hostport + " to KRA connector"); + cs.putString(PREFIX + ".host", host + ":" + port + " " + hostport); + cs.commit(true); + replaceConnector(); + return; + } + } + } + + // connector does not exist, or existing connector is the same host/port and we are replacing it + cs.putString(PREFIX + ".host", info.getHost()); + cs.putString(PREFIX + ".port", info.getPort()); + cs.putString(PREFIX + ".enable", info.getEnable() != null ? info.getEnable() : "true"); + cs.putString(PREFIX + ".local", info.getLocal() != null ? info.getLocal(): "false"); + cs.putString(PREFIX + ".timeout", info.getTimeout() != null ? info.getTimeout() : "30"); + cs.putString(PREFIX + ".uri", info.getUri() != null ? info.getUri() : "/kra/agent/kra/connector"); + cs.putString(PREFIX + ".transportCert", info.getTransportCert()); + + String nickname = cs.getString("ca.subsystem.nickname", ""); + String tokenname = cs.getString("ca.subsystem.tokenname", ""); + if (!tokenname.equals("Internal Key Storage Token")) + nickname = tokenname + ":" + nickname; + cs.putString(PREFIX + ".nickName", nickname); + cs.commit(true); + + replaceConnector(); + } + +} diff --git a/base/common/src/com/netscape/cms/servlet/admin/KRAConnectorService.java b/base/common/src/com/netscape/cms/servlet/admin/KRAConnectorService.java new file mode 100644 index 000000000..b1d0b07c2 --- /dev/null +++ b/base/common/src/com/netscape/cms/servlet/admin/KRAConnectorService.java @@ -0,0 +1,61 @@ +// --- BEGIN COPYRIGHT BLOCK --- +// This program is free software; you can redistribute it and/or modify +// it under the terms of the GNU General Public License as published by +// the Free Software Foundation; version 2 of the License. +// +// This program is distributed in the hope that it will be useful, +// but WITHOUT ANY WARRANTY; without even the implied warranty of +// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +// GNU General Public License for more details. +// +// You should have received a copy of the GNU General Public License along +// with this program; if not, write to the Free Software Foundation, Inc., +// 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. +// +// (C) 2013 Red Hat, Inc. +// All rights reserved. +// --- END COPYRIGHT BLOCK --- +package com.netscape.cms.servlet.admin; + +import javax.ws.rs.core.MultivaluedMap; + +import com.netscape.certsrv.base.EBaseException; +import com.netscape.certsrv.base.PKIException; +import com.netscape.certsrv.system.KRAConnectorInfo; +import com.netscape.certsrv.system.KRAConnectorResource; +import com.netscape.cms.servlet.base.PKIService; + +/** + * @author Ade Lee + */ +public class KRAConnectorService extends PKIService implements KRAConnectorResource { + + @Override + public void addConnector(KRAConnectorInfo info) { + try { + KRAConnectorProcessor processor = new KRAConnectorProcessor(getLocale()); + processor.addConnector(info); + } catch (EBaseException e) { + e.printStackTrace(); + throw new PKIException(e.getMessage()); + } + } + + @Override + public void removeConnector(String host, String port) { + try { + KRAConnectorProcessor processor = new KRAConnectorProcessor(getLocale()); + processor.removeConnector(host, port); + } catch (EBaseException e) { + e.printStackTrace(); + throw new PKIException(e.getMessage()); + } + } + + @Override + public void addConnector(MultivaluedMap<String, String> form) { + KRAConnectorInfo info = new KRAConnectorInfo(form); + addConnector(info); + } + +} diff --git a/base/common/src/com/netscape/cms/servlet/csadmin/UpdateConnector.java b/base/common/src/com/netscape/cms/servlet/csadmin/UpdateConnector.java index b62e184b7..efc0d5d34 100644 --- a/base/common/src/com/netscape/cms/servlet/csadmin/UpdateConnector.java +++ b/base/common/src/com/netscape/cms/servlet/csadmin/UpdateConnector.java @@ -18,7 +18,6 @@ package com.netscape.cms.servlet.csadmin; import java.io.IOException; -import java.util.Enumeration; import java.util.Locale; import javax.servlet.ServletConfig; @@ -26,6 +25,7 @@ import javax.servlet.ServletException; import javax.servlet.http.HttpServletRequest; import javax.servlet.http.HttpServletResponse; +import org.jboss.resteasy.spi.BadRequestException; import org.w3c.dom.Node; import com.netscape.certsrv.apps.CMS; @@ -33,11 +33,10 @@ import com.netscape.certsrv.authentication.IAuthToken; import com.netscape.certsrv.authorization.AuthzToken; import com.netscape.certsrv.authorization.EAuthzAccessDenied; import com.netscape.certsrv.base.EBaseException; -import com.netscape.certsrv.base.IConfigStore; -import com.netscape.certsrv.ca.ICAService; -import com.netscape.certsrv.ca.ICertificateAuthority; -import com.netscape.certsrv.connector.IConnector; +import com.netscape.certsrv.base.PKIException; import com.netscape.certsrv.logging.ILogger; +import com.netscape.certsrv.system.KRAConnectorInfo; +import com.netscape.cms.servlet.admin.KRAConnectorProcessor; import com.netscape.cms.servlet.base.CMSServlet; import com.netscape.cms.servlet.base.UserInfo; import com.netscape.cms.servlet.common.CMSRequest; @@ -46,9 +45,6 @@ import com.netscape.cmsutil.xml.XMLObject; public class UpdateConnector extends CMSServlet { - /** - * - */ private static final long serialVersionUID = 972871860008509849L; private final static String SUCCESS = "0"; private final static String FAILED = "1"; @@ -69,6 +65,18 @@ public class UpdateConnector extends CMSServlet { CMS.debug("UpdateConnector: done initializing..."); } + public KRAConnectorInfo createConnectorInfo(HttpServletRequest httpReq) { + KRAConnectorInfo info = new KRAConnectorInfo(); + info.setHost(httpReq.getParameter(KRAConnectorProcessor.PREFIX + ".host")); + info.setPort(httpReq.getParameter(KRAConnectorProcessor.PREFIX + ".port")); + info.setTimeout(httpReq.getParameter(KRAConnectorProcessor.PREFIX + ".timeout")); + info.setTransportCert(httpReq.getParameter(KRAConnectorProcessor.PREFIX + ".transportCert")); + info.setUri(httpReq.getParameter(KRAConnectorProcessor.PREFIX + ".uri")); + info.setLocal(httpReq.getParameter(KRAConnectorProcessor.PREFIX + ".local")); + info.setEnable(httpReq.getParameter(KRAConnectorProcessor.PREFIX + ".enable")); + return info; + } + /** * Process the HTTP request. */ @@ -122,47 +130,24 @@ public class UpdateConnector extends CMSServlet { return; } - // check if connector exists - ICertificateAuthority ca = (ICertificateAuthority)CMS.getSubsystem("ca"); - ICAService caService = (ICAService)ca.getCAService(); - boolean connectorExists = (caService.getKRAConnector() != null)? true:false; - if (connectorExists) { - CMS.debug("UpdateConnector: KRA connector already exists"); - } else { - IConfigStore cs = CMS.getConfigStore(); - - @SuppressWarnings("unchecked") - Enumeration<String> list = httpReq.getParameterNames(); - while (list.hasMoreElements()) { - String name = list.nextElement(); - String val = httpReq.getParameter(name); - if (name != null && name.startsWith("ca.connector")) { - CMS.debug("Adding connector update name=" + name + " val=" + val); - cs.putString(name, val); - } else { - CMS.debug("Skipping connector update name=" + name + " val=" + val); - } - } - - try { - String nickname = cs.getString("ca.subsystem.nickname", ""); - String tokenname = cs.getString("ca.subsystem.tokenname", ""); - if (!tokenname.equals("Internal Key Storage Token")) - nickname = tokenname + ":" + nickname; - cs.putString("ca.connector.KRA.nickName", nickname); - cs.commit(false); - } catch (Exception e) { - } + String op = httpReq.getParameter("op"); + if (op == null) { + op="add"; + } - // start the connector - try { - IConnector kraConnector = caService.getConnector( - cs.getSubStore("ca.connector.KRA")); - caService.setKRAConnector(kraConnector); - kraConnector.start(); - } catch (Exception e) { - CMS.debug("Failed to start connector " + e); + String status = SUCCESS; + String error = ""; + KRAConnectorProcessor processor = new KRAConnectorProcessor(getLocale(httpReq)); + KRAConnectorInfo info = createConnectorInfo(httpReq); + try { + if (op.equals("add")) { + processor.addConnector(info); + } else { + processor.removeConnector(info.getHost(), info.getPort()); } + } catch (BadRequestException | PKIException e) { + status = FAILED; + error = e.getMessage(); } // send success status back to the requestor @@ -170,13 +155,13 @@ public class UpdateConnector extends CMSServlet { CMS.debug("UpdateConnector: Sending response"); XMLObject xmlObj = new XMLObject(); Node root = xmlObj.createRoot("XMLResponse"); - - if (connectorExists) { - xmlObj.addItemToContainer(root, "Status", FAILED); - xmlObj.addItemToContainer(root, "Error", "DRM connector already exists."); - } else { + if (status.equals(SUCCESS)) { xmlObj.addItemToContainer(root, "Status", SUCCESS); + } else { + xmlObj.addItemToContainer(root, "Status", FAILED); + xmlObj.addItemToContainer(root, "Error", error); } + byte[] cb = xmlObj.toByteArray(); outputResult(httpResp, "application/xml", cb); |