summaryrefslogtreecommitdiffstats
path: root/base/util
diff options
context:
space:
mode:
Diffstat (limited to 'base/util')
-rw-r--r--base/util/src/netscape/security/pkcs/PKCS12.java136
-rw-r--r--base/util/src/netscape/security/pkcs/PKCS12Util.java185
2 files changed, 272 insertions, 49 deletions
diff --git a/base/util/src/netscape/security/pkcs/PKCS12.java b/base/util/src/netscape/security/pkcs/PKCS12.java
new file mode 100644
index 000000000..df7fde447
--- /dev/null
+++ b/base/util/src/netscape/security/pkcs/PKCS12.java
@@ -0,0 +1,136 @@
+// --- BEGIN COPYRIGHT BLOCK ---
+// This program is free software; you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation; version 2 of the License.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License along
+// with this program; if not, write to the Free Software Foundation, Inc.,
+// 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+//
+// (C) 2016 Red Hat, Inc.
+// All rights reserved.
+// --- END COPYRIGHT BLOCK ---
+package netscape.security.pkcs;
+
+import org.mozilla.jss.asn1.OBJECT_IDENTIFIER;
+
+public class PKCS12 {
+
+ // PKI OID: 2.16.840.1.113730.5
+ public final static OBJECT_IDENTIFIER PKI_OID = new OBJECT_IDENTIFIER("2.16.840.1.113730.5");
+
+ // PKCS #12 OID: 2.16.840.1.113730.5.1
+ public final static OBJECT_IDENTIFIER PKCS12_OID = PKI_OID.subBranch(1);
+
+ // PKCS #12 attributes OID: 2.16.840.1.113730.5.1.1
+ public final static OBJECT_IDENTIFIER PKCS12_ATTRIBUTES_OID = PKCS12_OID.subBranch(1);
+
+ // Certificate trust flags OID: 2.16.840.1.113730.5.1.1.1
+ public final static OBJECT_IDENTIFIER CERT_TRUST_FLAGS_OID = PKCS12_ATTRIBUTES_OID.subBranch(1);
+
+ // based on certdb.h in NSS
+ public final static int TERMINAL_RECORD = 1 << 0;
+ public final static int TRUSTED = 1 << 1;
+ public final static int SEND_WARN = 1 << 2;
+ public final static int VALID_CA = 1 << 3;
+ public final static int TRUSTED_CA = 1 << 4;
+ public final static int NS_TRUSTED_CA = 1 << 5;
+ public final static int USER = 1 << 6;
+ public final static int TRUSTED_CLIENT_CA = 1 << 7;
+ public final static int INVISIBLE_CA = 1 << 8;
+ public final static int GOVT_APPROVED_CA = 1 << 9;
+
+ public static boolean isFlagEnabled(int flag, int flags) {
+ return (flag & flags) > 0;
+ }
+
+ // based on printflags() in secutil.c in NSS
+ public static String encodeFlags(int flags) {
+
+ StringBuffer sb = new StringBuffer();
+
+ if (isFlagEnabled(VALID_CA, flags) && !isFlagEnabled(TRUSTED_CA, flags) && !isFlagEnabled(TRUSTED_CLIENT_CA, flags))
+ sb.append("c");
+
+ if (isFlagEnabled(TERMINAL_RECORD, flags) && !isFlagEnabled(TRUSTED, flags))
+ sb.append("p");
+
+ if (isFlagEnabled(TRUSTED_CA, flags))
+ sb.append("C");
+
+ if (isFlagEnabled(TRUSTED_CLIENT_CA, flags))
+ sb.append("T");
+
+ if (isFlagEnabled(TRUSTED, flags))
+ sb.append("P");
+
+ if (isFlagEnabled(USER, flags))
+ sb.append("u");
+
+ if (isFlagEnabled(SEND_WARN, flags))
+ sb.append("w");
+
+ if (isFlagEnabled(INVISIBLE_CA, flags))
+ sb.append("I");
+
+ if (isFlagEnabled(GOVT_APPROVED_CA, flags))
+ sb.append("G");
+
+ return sb.toString();
+ }
+
+ // based on CERT_DecodeTrustString() in certdb.c in NSS
+ public static int decodeFlags(String flags) throws Exception {
+
+ int value = 0;
+
+ for (char c : flags.toCharArray()) {
+ switch (c) {
+ case 'p':
+ value = value | TERMINAL_RECORD;
+ break;
+
+ case 'P':
+ value = value | TRUSTED | TERMINAL_RECORD;
+ break;
+
+ case 'w':
+ value = value | SEND_WARN;
+ break;
+
+ case 'c':
+ value = value | VALID_CA;
+ break;
+
+ case 'T':
+ value = value | TRUSTED_CLIENT_CA | VALID_CA;
+ break;
+
+ case 'C' :
+ value = value | TRUSTED_CA | VALID_CA;
+ break;
+
+ case 'u':
+ value = value | USER;
+ break;
+
+ case 'i':
+ value = value | INVISIBLE_CA;
+ break;
+ case 'g':
+ value = value | GOVT_APPROVED_CA;
+ break;
+
+ default:
+ throw new Exception("Invalid trust flag: " + c);
+ }
+ }
+
+ return value;
+ }
+}
diff --git a/base/util/src/netscape/security/pkcs/PKCS12Util.java b/base/util/src/netscape/security/pkcs/PKCS12Util.java
index bcd48970e..6acace0b9 100644
--- a/base/util/src/netscape/security/pkcs/PKCS12Util.java
+++ b/base/util/src/netscape/security/pkcs/PKCS12Util.java
@@ -45,6 +45,7 @@ import org.mozilla.jss.crypto.CryptoStore;
import org.mozilla.jss.crypto.CryptoToken;
import org.mozilla.jss.crypto.EncryptionAlgorithm;
import org.mozilla.jss.crypto.IVParameterSpec;
+import org.mozilla.jss.crypto.InternalCertificate;
import org.mozilla.jss.crypto.KeyGenAlgorithm;
import org.mozilla.jss.crypto.KeyGenerator;
import org.mozilla.jss.crypto.KeyWrapAlgorithm;
@@ -73,6 +74,7 @@ public class PKCS12Util {
private static Logger logger = Logger.getLogger(PKCS12Util.class.getName());
PFX pfx;
+ boolean trustFlagsEnabled = true;
public static class PKCS12KeyInfo {
public EncryptedPrivateKeyInfo encPrivateKeyInfo;
@@ -83,6 +85,42 @@ public class PKCS12Util {
public static class PKCS12CertInfo {
public X509CertImpl cert;
public String nickname;
+ public String trustFlags;
+ }
+
+ public boolean isTrustFlagsEnabled() {
+ return trustFlagsEnabled;
+ }
+
+ public void setTrustFlagsEnabled(boolean trustFlagsEnabled) {
+ this.trustFlagsEnabled = trustFlagsEnabled;
+ }
+
+ public String getTrustFlags(X509Certificate cert) {
+
+ InternalCertificate icert = (InternalCertificate) cert;
+
+ StringBuilder sb = new StringBuilder();
+
+ sb.append(PKCS12.encodeFlags(icert.getSSLTrust()));
+ sb.append(",");
+ sb.append(PKCS12.encodeFlags(icert.getEmailTrust()));
+ sb.append(",");
+ sb.append(PKCS12.encodeFlags(icert.getObjectSigningTrust()));
+
+ return sb.toString();
+ }
+
+ public void setTrustFlags(X509Certificate cert, String trustFlags) throws Exception {
+
+ InternalCertificate icert = (InternalCertificate) cert;
+
+ String[] flags = trustFlags.split(",");
+ if (flags.length < 3) throw new Exception("Invalid trust flags: " + trustFlags);
+
+ icert.setSSLTrust(PKCS12.decodeFlags(flags[0]));
+ icert.setEmailTrust(PKCS12.decodeFlags(flags[1]));
+ icert.setObjectSigningTrust(PKCS12.decodeFlags(flags[2]));
}
byte[] getEncodedKey(PrivateKey privateKey) throws Exception {
@@ -107,6 +145,8 @@ public class PKCS12Util {
public void addKeyBag(PrivateKey privateKey, X509Certificate x509cert,
Password pass, byte[] localKeyID, SEQUENCE safeContents) throws Exception {
+ logger.fine("Creating key bag for " + x509cert.getSubjectDN());
+
PasswordConverter passConverter = new PasswordConverter();
byte salt[] = { 0x01, 0x01, 0x01, 0x01 };
byte[] priData = getEncodedKey(privateKey);
@@ -118,7 +158,7 @@ public class PKCS12Util {
PBEAlgorithm.PBE_SHA1_DES3_CBC,
pass, salt, 1, passConverter, pki);
- SET keyAttrs = createBagAttrs(
+ SET keyAttrs = createKeyBagAttrs(
x509cert.getSubjectDN().toString(), localKeyID);
SafeBag keyBag = new SafeBag(SafeBag.PKCS8_SHROUDED_KEY_BAG,
@@ -130,12 +170,18 @@ public class PKCS12Util {
public byte[] addCertBag(X509Certificate x509cert, String nickname,
SEQUENCE safeContents) throws Exception {
+ logger.fine("Creating cert bag for " + nickname);
+
ASN1Value cert = new OCTET_STRING(x509cert.getEncoded());
byte[] localKeyID = createLocalKeyID(x509cert);
- SET certAttrs = null;
- if (nickname != null)
- certAttrs = createBagAttrs(nickname, localKeyID);
+ String trustFlags = null;
+ if (trustFlagsEnabled) {
+ trustFlags = getTrustFlags(x509cert);
+ logger.fine("Trust flags: " + trustFlags);
+ }
+
+ SET certAttrs = createCertBagAttrs(nickname, localKeyID, trustFlags);
SafeBag certBag = new SafeBag(SafeBag.CERT_BAG,
new CertBag(CertBag.X509_CERT_TYPE, cert), certAttrs);
@@ -156,27 +202,66 @@ public class PKCS12Util {
return md.digest();
}
- SET createBagAttrs(String nickname, byte localKeyID[])
+ SET createKeyBagAttrs(String subjectDN, byte localKeyID[])
+ throws Exception {
+
+ SET attrs = new SET();
+
+ SEQUENCE subjectAttr = new SEQUENCE();
+ subjectAttr.addElement(SafeBag.FRIENDLY_NAME);
+
+ SET subjectSet = new SET();
+ subjectSet.addElement(new BMPString(subjectDN));
+ subjectAttr.addElement(subjectSet);
+
+ attrs.addElement(subjectAttr);
+
+ SEQUENCE localKeyAttr = new SEQUENCE();
+ localKeyAttr.addElement(SafeBag.LOCAL_KEY_ID);
+
+ SET localKeySet = new SET();
+ localKeySet.addElement(new OCTET_STRING(localKeyID));
+ localKeyAttr.addElement(localKeySet);
+
+ attrs.addElement(localKeyAttr);
+
+ return attrs;
+ }
+
+ SET createCertBagAttrs(String nickname, byte localKeyID[], String trustFlags)
throws Exception {
SET attrs = new SET();
- SEQUENCE nicknameAttr = new SEQUENCE();
+ SEQUENCE nicknameAttr = new SEQUENCE();
nicknameAttr.addElement(SafeBag.FRIENDLY_NAME);
- SET nicknameSet = new SET();
+ SET nicknameSet = new SET();
nicknameSet.addElement(new BMPString(nickname));
nicknameAttr.addElement(nicknameSet);
+
attrs.addElement(nicknameAttr);
- SEQUENCE localKeyAttr = new SEQUENCE();
+ SEQUENCE localKeyAttr = new SEQUENCE();
localKeyAttr.addElement(SafeBag.LOCAL_KEY_ID);
- SET localKeySet = new SET();
+ SET localKeySet = new SET();
localKeySet.addElement(new OCTET_STRING(localKeyID));
localKeyAttr.addElement(localKeySet);
+
attrs.addElement(localKeyAttr);
+ if (trustFlags != null && trustFlagsEnabled) {
+ SEQUENCE trustFlagsAttr = new SEQUENCE();
+ trustFlagsAttr.addElement(PKCS12.CERT_TRUST_FLAGS_OID);
+
+ SET trustFlagsSet = new SET();
+ trustFlagsSet.addElement(new BMPString(trustFlags));
+ trustFlagsAttr.addElement(trustFlagsSet);
+
+ attrs.addElement(trustFlagsAttr);
+ }
+
return attrs;
}
@@ -191,7 +276,7 @@ public class PKCS12Util {
SEQUENCE encSafeContents = new SEQUENCE();
SEQUENCE safeContents = new SEQUENCE();
- logger.fine("Loading certificates:");
+ logger.fine("Loading certificates");
X509Certificate[] certs = store.getCertificates();
@@ -200,13 +285,13 @@ public class PKCS12Util {
try {
PrivateKey prikey = cm.findPrivKeyByCert(cert);
- logger.fine(" - cert " + nickname + " with private key");
+ logger.fine("Found certificate " + nickname + " with private key");
byte localKeyID[] = addCertBag(cert, nickname, safeContents);
addKeyBag(prikey, cert, password, localKeyID, encSafeContents);
} catch (ObjectNotFoundException e) {
- logger.fine(" - cert " + nickname + " without private key");
+ logger.fine("Found certificate " + nickname + " without private key");
addCertBag(cert, nickname, safeContents);
}
}
@@ -286,41 +371,47 @@ public class PKCS12Util {
public PKCS12CertInfo getCertInfo(SafeBag bag) throws Exception {
+ PKCS12CertInfo certInfo = new PKCS12CertInfo();
+
CertBag certBag = (CertBag) bag.getInterpretedBagContent();
- OCTET_STRING str = (OCTET_STRING) certBag.getInterpretedCert();
- byte[] x509cert = str.toByteArray();
+ OCTET_STRING certStr = (OCTET_STRING) certBag.getInterpretedCert();
+ byte[] x509cert = certStr.toByteArray();
+
+ certInfo.cert = new X509CertImpl(x509cert);
+ logger.fine("Found certificate " + certInfo.cert.getSubjectDN());
- // find cert's nickname
SET bagAttrs = bag.getBagAttributes();
- String nickname = null;
+ if (bagAttrs == null) return certInfo;
- if (bagAttrs != null) {
+ for (int i = 0; i < bagAttrs.size(); i++) {
- for (int k = 0; k < bagAttrs.size(); k++) {
+ Attribute attr = (Attribute) bagAttrs.elementAt(i);
+ OBJECT_IDENTIFIER oid = attr.getType();
- Attribute attr = (Attribute) bagAttrs.elementAt(k);
- OBJECT_IDENTIFIER oid = attr.getType();
+ if (oid.equals(SafeBag.FRIENDLY_NAME)) {
- if (!oid.equals(SafeBag.FRIENDLY_NAME)) continue;
SET values = attr.getValues();
ANY value = (ANY) values.elementAt(0);
- ByteArrayInputStream bbis = new ByteArrayInputStream(value.getEncoded());
- BMPString sss = (BMPString) (new BMPString.Template()).decode(bbis);
- nickname = sss.toString();
+ ByteArrayInputStream is = new ByteArrayInputStream(value.getEncoded());
+ BMPString nicknameStr = (BMPString) (new BMPString.Template()).decode(is);
- break;
- }
- }
+ certInfo.nickname = nicknameStr.toString();
+ logger.fine("Nickname: " + certInfo.nickname);
- X509CertImpl certImpl = new X509CertImpl(x509cert);
+ } else if (oid.equals(PKCS12.CERT_TRUST_FLAGS_OID) && trustFlagsEnabled) {
+
+ SET values = attr.getValues();
+ ANY value = (ANY) values.elementAt(0);
- logger.fine("Found certificate " + certImpl.getSubjectDN() + (nickname == null ? "" : " (" + nickname + ")"));
+ ByteArrayInputStream is = new ByteArrayInputStream(value.getEncoded());
+ BMPString trustFlagsStr = (BMPString) (new BMPString.Template()).decode(is);
- PKCS12CertInfo certInfo = new PKCS12CertInfo();
- certInfo.cert = certImpl;
- certInfo.nickname = nickname;
+ certInfo.trustFlags = trustFlagsStr.toString();
+ logger.fine("Trust flags: " + certInfo.trustFlags);
+ }
+ }
return certInfo;
}
@@ -481,35 +572,31 @@ public class PKCS12Util {
}
}
- public X509Certificate importCert(X509CertImpl cert) throws Exception {
+ public X509Certificate importCert(X509CertImpl cert, String nickname, String trustFlags) throws Exception {
logger.fine("Importing certificate " + cert.getSubjectDN());
CryptoManager cm = CryptoManager.getInstance();
- return cm.importCACertPackage(cert.getEncoded());
- }
- public X509Certificate importCert(X509CertImpl cert, String nickname) throws Exception {
+ X509Certificate xcert;
- logger.fine("Importing certificate " + cert.getSubjectDN() + " (" + nickname + ")");
+ if (nickname == null) {
+ xcert = cm.importCACertPackage(cert.getEncoded());
- CryptoManager cm = CryptoManager.getInstance();
- return cm.importUserCACertPackage(cert.getEncoded(), nickname);
+ } else {
+ xcert = cm.importUserCACertPackage(cert.getEncoded(), nickname);
+ }
+
+ if (trustFlags != null && trustFlagsEnabled)
+ setTrustFlags(xcert, trustFlags);
+
+ return xcert;
}
public void importCerts(List<PKCS12CertInfo> certInfos) throws Exception {
for (PKCS12CertInfo certInfo : certInfos) {
-
- X509CertImpl cert = certInfo.cert;
- String nickname = certInfo.nickname;
-
- if (nickname == null) {
- importCert(cert);
- continue;
- }
-
- importCert(cert, nickname);
+ importCert(certInfo.cert, certInfo.nickname, certInfo.trustFlags);
}
}
generated by cgit (git 2.34.1) at 2024-11-16 03:18:17 +0000