diff options
Diffstat (limited to 'pki/base/common/src/com/netscape/certsrv/dbs/certdb')
4 files changed, 839 insertions, 0 deletions
diff --git a/pki/base/common/src/com/netscape/certsrv/dbs/certdb/ICertRecord.java b/pki/base/common/src/com/netscape/certsrv/dbs/certdb/ICertRecord.java new file mode 100644 index 000000000..febb684cc --- /dev/null +++ b/pki/base/common/src/com/netscape/certsrv/dbs/certdb/ICertRecord.java @@ -0,0 +1,176 @@ +// --- BEGIN COPYRIGHT BLOCK --- +// This program is free software; you can redistribute it and/or modify +// it under the terms of the GNU General Public License as published by +// the Free Software Foundation; version 2 of the License. +// +// This program is distributed in the hope that it will be useful, +// but WITHOUT ANY WARRANTY; without even the implied warranty of +// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +// GNU General Public License for more details. +// +// You should have received a copy of the GNU General Public License along +// with this program; if not, write to the Free Software Foundation, Inc., +// 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. +// +// (C) 2007 Red Hat, Inc. +// All rights reserved. +// --- END COPYRIGHT BLOCK --- +package com.netscape.certsrv.dbs.certdb; + + +import java.util.Date; +import java.math.BigInteger; +import com.netscape.certsrv.dbs.IDBObj; +import com.netscape.certsrv.base.MetaInfo; +import netscape.security.x509.X509CertImpl; + + +/** + * An interface contains constants for certificate record. + * + * @version $Revision$, $Date$ + */ +public interface ICertRecord extends IDBObj { + + public final static String ATTR_ID = "certRecordId"; + public final static String ATTR_META_INFO = "certMetaInfo"; + public final static String ATTR_REVO_INFO = "certRevoInfo"; + public final static String ATTR_CERT_STATUS = "certStatus"; + public final static String ATTR_CREATE_TIME = "certCreateTime"; + public final static String ATTR_MODIFY_TIME = "certModifyTime"; + public final static String ATTR_AUTO_RENEW = "certAutoRenew"; + public final static String ATTR_ISSUED_BY = "certIssuedBy"; + public final static String ATTR_REVOKED_BY = "certRevokedBy"; + public final static String ATTR_REVOKED_ON = "certRevokedOn"; + public final static String ATTR_X509CERT = "x509cert"; + + public static final String META_LDAPPUBLISH = "inLdapPublishDir"; + public static final String META_REQUEST_ID = "requestId"; + public static final String META_RENEWED_CERT = "renewedCertSerialNo"; + public static final String META_OLD_CERT = "oldCertSerialNo"; + public static final String META_CERT_TYPE = "certType"; + public static final String META_CRMF_REQID = "crmfReqId"; + public static final String META_CHALLENGE_PHRASE = "challengePhrase"; + public static final String META_PROFILE_ID = "profileId"; + + public final static String STATUS_VALID = "VALID"; + public final static String STATUS_INVALID = "INVALID"; + public final static String STATUS_REVOKED = "REVOKED"; + public final static String STATUS_EXPIRED = "EXPIRED"; + public final static String STATUS_REVOKED_EXPIRED = "REVOKED_EXPIRED"; + + public final static String AUTO_RENEWAL_DISABLED = "DISABLED"; + public final static String AUTO_RENEWAL_ENABLED = "ENABLED"; + public final static String AUTO_RENEWAL_DONE = "DONE"; + public final static String AUTO_RENEWAL_NOTIFIED = "NOTIFIED"; + + public final static String X509CERT_NOT_BEFORE = "notBefore"; + public final static String X509CERT_NOT_AFTER = "notAfter"; + public final static String X509CERT_DURATION = "duration"; + public final static String X509CERT_EXTENSION = "extension"; + public final static String X509CERT_SUBJECT = "subject"; + public final static String X509CERT_PUBLIC_KEY_DATA ="publicKeyData"; + public final static String X509CERT_VERSION = "version"; + public final static String X509CERT_ALGORITHM = "algorithm"; + public final static String X509CERT_SIGNING_ALGORITHM = "signingAlgorithm"; + public final static String X509CERT_SERIAL_NUMBER = "serialNumber"; + + /* attribute type used the following with search filter */ + public final static String ATTR_X509CERT_NOT_BEFORE = + ATTR_X509CERT + "." + X509CERT_NOT_BEFORE; + public final static String ATTR_X509CERT_NOT_AFTER = + ATTR_X509CERT + "." + X509CERT_NOT_AFTER; + public final static String ATTR_X509CERT_DURATION = + ATTR_X509CERT + "." + X509CERT_DURATION; + public final static String ATTR_X509CERT_EXTENSION = + ATTR_X509CERT + "." + X509CERT_EXTENSION; + public final static String ATTR_X509CERT_SUBJECT = + ATTR_X509CERT + "." + X509CERT_SUBJECT; + public final static String ATTR_X509CERT_VERSION = + ATTR_X509CERT + "." + X509CERT_VERSION; + public final static String ATTR_X509CERT_ALGORITHM = + ATTR_X509CERT + "." + X509CERT_ALGORITHM; + public final static String ATTR_X509CERT_SIGNING_ALGORITHM = + ATTR_X509CERT + "." + X509CERT_SIGNING_ALGORITHM; + public final static String ATTR_X509CERT_SERIAL_NUMBER = + ATTR_X509CERT + "." + X509CERT_SERIAL_NUMBER; + public final static String ATTR_X509CERT_PUBLIC_KEY_DATA = + ATTR_X509CERT + "." + X509CERT_PUBLIC_KEY_DATA; + + /** + * Retrieves serial number from stored certificate. + * + * @return certificate serial number + */ + public BigInteger getCertificateSerialNumber(); + + /** + * Retrieves serial number from certificate record. + * + * @return certificate serial number + */ + public BigInteger getSerialNumber(); + + /** + * Retrieves certificate from certificate record. + * + * @return certificate + */ + public X509CertImpl getCertificate(); + + /** + * Retrieves name of who issued this certificate. + * + * @return name of who issued this certificate + */ + public String getIssuedBy(); + + /** + * Retrieves name of who revoked this certificate. + * + * @return name of who revoked this certificate + */ + public String getRevokedBy(); + + /** + * Retrieves date when this certificate was revoked. + * + * @return date when this certificate was revoked + */ + public Date getRevokedOn(); + + /** + * Retrieves meta info. + * + * @return meta info + */ + public MetaInfo getMetaInfo(); + + /** + * Retrieves certificate status. + * + * @return certificate status + */ + public String getStatus(); + + /** + * Retrieves time of creation of this certificate record. + * + * @return time of creation of this certificate record + */ + public Date getCreateTime(); + + /** + * Retrieves time of modification of this certificate record. + * + * @return time of modification of this certificate record + */ + public Date getModifyTime(); + + /** + * Retrieves revocation info. + * + * @return revocation info + */ + public IRevocationInfo getRevocationInfo(); +} diff --git a/pki/base/common/src/com/netscape/certsrv/dbs/certdb/ICertRecordList.java b/pki/base/common/src/com/netscape/certsrv/dbs/certdb/ICertRecordList.java new file mode 100644 index 000000000..cc8c38187 --- /dev/null +++ b/pki/base/common/src/com/netscape/certsrv/dbs/certdb/ICertRecordList.java @@ -0,0 +1,97 @@ +// --- BEGIN COPYRIGHT BLOCK --- +// This program is free software; you can redistribute it and/or modify +// it under the terms of the GNU General Public License as published by +// the Free Software Foundation; version 2 of the License. +// +// This program is distributed in the hope that it will be useful, +// but WITHOUT ANY WARRANTY; without even the implied warranty of +// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +// GNU General Public License for more details. +// +// You should have received a copy of the GNU General Public License along +// with this program; if not, write to the Free Software Foundation, Inc., +// 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. +// +// (C) 2007 Red Hat, Inc. +// All rights reserved. +// --- END COPYRIGHT BLOCK --- +package com.netscape.certsrv.dbs.certdb; + + +import java.util.*; +import java.io.*; +import java.math.*; +import com.netscape.certsrv.base.*; +import com.netscape.certsrv.dbs.*; + + +/** + * A class represents a list of certificate records. + * <P> + * + * @version $Revision$, $Date$ + */ +public interface ICertRecordList { + + /** + * Gets the current index. + * + * @return current index + */ + public int getCurrentIndex(); + + /** + * Retrieves the size of request list. + * + * @return size + */ + public int getSize(); + + /** + * Gets size before jump to index. + * + * @return size + */ + public int getSizeBeforeJumpTo(); + + /** + * Gets size after jump to index. + * + * @return size + */ + public int getSizeAfterJumpTo(); + + /** + * Process certificate record as soon as it is returned. + * + * @param startidx starting index + * @param endidx ending index + * @param ep element processor + * @exception EBaseException failed to process cert records + */ + public void processCertRecords(int startidx, int endidx, + IElementProcessor ep) throws EBaseException; + + /** + * Retrieves requests. + * It's no good to call this if you didnt check + * if the startidx, endidx are valid. + * + * @param startidx starting index + * @param endidx ending index + * @exception EBaseException failed to retrieve + */ + public Enumeration getCertRecords(int startidx, int endidx) + throws EBaseException; + + /** + * Gets one single record at a time similar to + * processCertRecords but no extra class needed. + * + * @param index position of the record to be retrieved + * @return object + * @exception EBaseException failed to retrieve + */ + public Object getCertRecord(int index) + throws EBaseException; +} diff --git a/pki/base/common/src/com/netscape/certsrv/dbs/certdb/ICertificateRepository.java b/pki/base/common/src/com/netscape/certsrv/dbs/certdb/ICertificateRepository.java new file mode 100644 index 000000000..c036909de --- /dev/null +++ b/pki/base/common/src/com/netscape/certsrv/dbs/certdb/ICertificateRepository.java @@ -0,0 +1,512 @@ +// --- BEGIN COPYRIGHT BLOCK --- +// This program is free software; you can redistribute it and/or modify +// it under the terms of the GNU General Public License as published by +// the Free Software Foundation; version 2 of the License. +// +// This program is distributed in the hope that it will be useful, +// but WITHOUT ANY WARRANTY; without even the implied warranty of +// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +// GNU General Public License for more details. +// +// You should have received a copy of the GNU General Public License along +// with this program; if not, write to the Free Software Foundation, Inc., +// 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. +// +// (C) 2007 Red Hat, Inc. +// All rights reserved. +// --- END COPYRIGHT BLOCK --- +package com.netscape.certsrv.dbs.certdb; + + +import java.math.*; +import java.util.*; +import java.io.*; +import java.security.*; +import java.security.cert.*; +import java.security.cert.Certificate; +import netscape.security.x509.*; +import netscape.ldap.*; +import com.netscape.certsrv.base.*; +import com.netscape.certsrv.dbs.*; +import com.netscape.certsrv.dbs.repository.*; + + +/** + * An interface represents a CMS certificate repository. + * It stores all the issued certificate. + * <P> + * + * @version $Revision$, $Date$ + */ +public interface ICertificateRepository extends IRepository { + + /** + * Adds a certificate record to the repository. Each certificate + * record contains four parts: certificate, meta-attributes, + * issue information and reovcation information. + * <P> + * + * @param record X.509 certificate + * @exception EBaseException failed to add new certificate to + * the repository + */ + public void addCertificateRecord(ICertRecord record) + throws EBaseException; + + /** + * Reads the certificate identified by the given serial no. + * + * @param serialNo serial number of certificate + * @return certificate + * @exception EBaseException failed to retrieve certificate + */ + public X509CertImpl getX509Certificate(BigInteger serialNo) + throws EBaseException; + + /** + * Reads certificate from repository. + * + * @param serialNo serial number of certificate + * @return certificate record + * @exception EBaseException failed to retrieve certificate + */ + public ICertRecord readCertificateRecord(BigInteger serialNo) + throws EBaseException; + + /** + * Sets certificate status update internal + * + * @param requestRepo request repository + * @param interval update interval + * @param listenToCloneModifications enable listening to clone modifications + */ + public void setCertStatusUpdateInterval(IRepository requestRepo, + int interval, + boolean listenToCloneModifications); + + /** + * Updates certificate status now. This is a blocking method. + * + * @exception EBaseException failed to update + */ + public void updateCertStatus() throws EBaseException; + + /** + * Modifies certificate record. + * + * @param serialNo serial number of record + * @param mods modifications + * @exception EBaseException failed to modify + */ + public void modifyCertificateRecord(BigInteger serialNo, + ModificationSet mods) throws EBaseException; + + /** + * Checks if the certificate exists in this repository. + * + * @param serialNo serial number of certificate + * @return true if it exists + * @exception EBaseException failed to check + */ + public boolean containsCertificate(BigInteger serialNo) + throws EBaseException; + + /** + * Deletes certificate from this repository. + * + * @param serialNo serial number of certificate + * @exception EBaseException failed to delete + */ + public void deleteCertificateRecord(BigInteger serialNo) + throws EBaseException; + + /** + * Marks certificate as revoked. + * + * @param id serial number + * @param info revocation information + * @exception EBaseException failed to mark + */ + public void markAsRevoked(BigInteger id, IRevocationInfo info) + throws EBaseException; + + /** + * Updates certificate status. + * + * @param id serial number + * @param status certificate status + * @exception EBaseException failed to update status + */ + public void updateStatus(BigInteger id, String status) + throws EBaseException; + + /** + * Marks certificate as renewable. + * + * @param record certificate record to modify + * @exception EBaseException failed to update + */ + public void markCertificateAsRenewable(ICertRecord record) + throws EBaseException; + + /** + * Marks certificate as not renewable. + * + * @param record certificate record to modify + * @exception EBaseException failed to update + */ + public void markCertificateAsNotRenewable(ICertRecord record) + throws EBaseException; + + /** + * Marks certificate as renewed. + * + * @param serialNo certificate record to modify + * @exception EBaseException failed to update + */ + public void markCertificateAsRenewed(String serialNo) + throws EBaseException; + + /** + * Marks certificate as renewed and notified. + * + * @param serialNo certificate record to modify + * @exception EBaseException failed to update + */ + public void markCertificateAsRenewalNotified(String serialNo) + throws EBaseException; + + /** + * Finds a list of certificate records that satisifies + * the filter. + * Here is a list of filter + * attribute can be used: + * <pre> + * certRecordId + * certMetaInfo + * certStatus + * certCreateTime + * certModifyTime + * x509Cert.notBefore + * x509Cert.notAfter + * x509Cert.subject + * </pre> + * The filter should follow RFC1558 LDAP filter syntax. + * For example, + * <pre> + * (&(certRecordId=5)(x509Cert.notBefore=934398398)) + * </pre> + * + * @param filter search filter + * @param maxSize max size to return + * @return a list of certificates + * @exception EBaseException failed to search + */ + public Enumeration searchCertificates(String filter, int maxSize) + throws EBaseException; + + /** + * Finds a list of certificate records that satisifies + * the filter. + * + * @param filter search filter + * @param maxSize max size to return + * @param timeLimit timeout value + * @return a list of certificates + * @exception EBaseException failed to search + */ + public Enumeration searchCertificates(String filter, int maxSize, + int timeLimit) throws EBaseException; + + /** + * Finds a list of certificate records that satisifies + * the filter. + * + * @param filter search filter + * @param attrs selected attribute + * @param pageSize page size + * @return a list of certificates + * @exception EBaseException failed to search + */ + public ICertRecordList findCertRecordsInList(String filter, + String attrs[], int pageSize) throws EBaseException; + + /** + * Finds a list of certificate records that satisifies + * the filter. + * + * @param filter search filter + * @param attrs selected attribute + * @param sortKey key to use for sorting the returned elements + * @param pageSize page size + * @return a list of certificates + * @exception EBaseException failed to search + */ + public ICertRecordList findCertRecordsInList(String filter, + String attrs[], String sortKey, int pageSize) + throws EBaseException; + + /** + * Finds a list of certificate records that satisifies + * the filter. + * + * @param filter search filter + * @param attrs selected attribute + * @param jumpTo jump to index + * @param sortKey key to use for sorting the returned elements + * @param pageSize page size + * @return a list of certificates + * @exception EBaseException failed to search + */ + public ICertRecordList findCertRecordsInList(String filter, + String attrs[], String jumpTo, String sortKey, int pageSize) + throws EBaseException; + + public ICertRecordList findCertRecordsInList(String filter, + String attrs[], String jumpTo, boolean hardJumpTo, String sortKey, int pageSize) + throws EBaseException; + + /** + * Finds a list of certificate records that satisifies + * the filter. + * + * @param filter search filter + * @param attrs selected attribute + * @param jumpTo jump to index + * @param sortKey key to use for sorting the returned elements + * @param pageSize page size + * @return a list of certificates + * @exception EBaseException failed to search + */ + public ICertRecordList findCertRecordsInListRawJumpto(String filter, + String attrs[], String jumpTo, String sortKey, int pageSize) + throws EBaseException; + + public static final int ALL_CERTS = 0; + public static final int ALL_VALID_CERTS = 1; + public static final int ALL_UNREVOKED_CERTS = 2; + + /** + * Gets all valid and unexpired certificates pertaining + * to a subject DN. + * + * @param subjectDN The distinguished name of the subject. + * @param validityType The type of certificatese to retrieve. + * @return An array of certificates. + * @throws EBaseException on error. + */ + public X509CertImpl[] getX509Certificates(String subjectDN, + int validityType) throws EBaseException; + + /** + * Retrieves all the revoked certificates that have not expired. + * + * @param asOfDate as of date + * @return a list of revoked certificates + * @exception EBaseException failed to retrieve + */ + public Enumeration getRevokedCertificates(Date asOfDate) + throws EBaseException; + + /** + * Retrieves all revoked certificates including ones that have expired + * or that are not yet valid. + * + * @return a list of revoked certificates + * @exception EBaseException failed to search + */ + public Enumeration getAllRevokedCertificates() + throws EBaseException; + + /** + * Retrieves all revoked but not expired certificates. + * + * @return a list of revoked certificates + * @exception EBaseException failed to search + */ + public Enumeration getAllRevokedNonExpiredCertificates() + throws EBaseException; + + /** + * Finds all certificates given a filter. + * + * @param filter search filter + * @return a list of certificates + * @exception EBaseException failed to search + */ + public Enumeration findCertificates(String filter) + throws EBaseException; + + /** + * Finds all certificate records given a filter. + * + * @param filter search filter + * @return a list of certificates + * @exception EBaseException failed to search + */ + public Enumeration findCertRecords(String filter) + throws EBaseException; + + /** + * Gets Revoked certs orderes by noAfter date, jumps to records + * where notAfter date is greater than current. + * + * @param date reference date + * @param pageSize page size + * @return a list of certificate records + * @exception EBaseException failed to retrieve + */ + public ICertRecordList getRevokedCertsByNotAfterDate(Date date, + int pageSize) throws EBaseException; + + /** + * Gets Invalid certs orderes by noAfter date, jumps to records + * where notAfter date is greater than current. + * + * @param date reference date + * @param pageSize page size + * @return a list of certificate records + * @exception EBaseException failed to retrieve + */ + public ICertRecordList getInvalidCertsByNotBeforeDate(Date date, + int pageSize) throws EBaseException; + + /** + * Gets valid certs orderes by noAfter date, jumps to records + * where notAfter date is greater than current. + * + * @param date reference date + * @param pageSize page size + * @return a list of certificate records + * @exception EBaseException failed to retrieve + */ + public ICertRecordList getValidCertsByNotAfterDate(Date date, + int pageSize) throws EBaseException; + + /** + * Creates certificate record. + * + * @param id serial number + * @param cert certificate + * @param meta meta information + * @return certificate record + */ + public ICertRecord createCertRecord(BigInteger id, + Certificate cert, MetaInfo meta); + + /** + * Finds certificate records. + * + * @param filter search filter + * @return a list of certificate records + * @exception EBaseException failed to retrieve cert records + */ + public Enumeration findCertRecs(String filter) + throws EBaseException; + + /** + * Retrieves renewable certificates. + * + * @param renewalTime renewal time + * @return certificates + * @exception EBaseException failed to retrieve + */ + public Hashtable getRenewableCertificates(String renewalTime) + throws EBaseException; + + /** + * Unmark a revoked certificates. + * + * @param id serial number + * @param info revocation information + * @param revokedOn revocation date + * @param revokedBy userid + * @exception EBaseException failed to unmark + */ + public void unmarkRevoked(BigInteger id, IRevocationInfo info, + Date revokedOn, String revokedBy) + throws EBaseException; + + /** + * Retrieves valid and not published certificates. + * + * @param from starting serial number + * @param to ending serial number + * @return a list of certificates + * @exception EBaseException failed to retrieve + */ + public Enumeration getValidNotPublishedCertificates(String from, String to) + throws EBaseException; + + /** + * Retrieves expired and published certificates. + * + * @param from starting serial number + * @param to ending serial number + * @return a list of certificates + * @exception EBaseException failed to retrieve + */ + public Enumeration getExpiredPublishedCertificates(String from, String to) + throws EBaseException; + + /** + * Retrieves revoked and published certificates. + * + * @param from starting serial number + * @param to ending serial number + * @return a list of certificates + * @exception EBaseException failed to retrieve + */ + public Enumeration getRevokedPublishedCertificates(String from, String to) + throws EBaseException; + + /** + * Retrieves valid certificates. + * + * @param from starting serial number + * @param to ending serial number + * @return a list of certificates + * @exception EBaseException failed to retrieve + */ + public Enumeration getValidCertificates(String from, String to) + throws EBaseException; + + /** + * Retrieves expired certificates. + * + * @param from starting serial number + * @param to ending serial number + * @return a list of certificates + * @exception EBaseException failed to retrieve + */ + public Enumeration getExpiredCertificates(String from, String to) + throws EBaseException; + + /** + * Retrieves revoked certificates. + * + * @param from starting serial number + * @param to ending serial number + * @return a list of certificates + * @exception EBaseException failed to retrieve + */ + public Enumeration getRevokedCertificates(String from, String to) + throws EBaseException; + + /** + * Retrieves modified certificate records. + * + * @param entry LDAPEntry with modified data + */ + public void getModifications(LDAPEntry entry); + + /** + * Removes certificate records with this repository. + * + * @param beginS BigInteger with radix 16 + * @param endS BigInteger with radix 16 + */ + public void removeCertRecords(BigInteger beginS, BigInteger endS) throws EBaseException; + + public void shutdown(); +} diff --git a/pki/base/common/src/com/netscape/certsrv/dbs/certdb/IRevocationInfo.java b/pki/base/common/src/com/netscape/certsrv/dbs/certdb/IRevocationInfo.java new file mode 100644 index 000000000..15e396943 --- /dev/null +++ b/pki/base/common/src/com/netscape/certsrv/dbs/certdb/IRevocationInfo.java @@ -0,0 +1,54 @@ +// --- BEGIN COPYRIGHT BLOCK --- +// This program is free software; you can redistribute it and/or modify +// it under the terms of the GNU General Public License as published by +// the Free Software Foundation; version 2 of the License. +// +// This program is distributed in the hope that it will be useful, +// but WITHOUT ANY WARRANTY; without even the implied warranty of +// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +// GNU General Public License for more details. +// +// You should have received a copy of the GNU General Public License along +// with this program; if not, write to the Free Software Foundation, Inc., +// 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. +// +// (C) 2007 Red Hat, Inc. +// All rights reserved. +// --- END COPYRIGHT BLOCK --- +package com.netscape.certsrv.dbs.certdb; + + +import java.util.*; +import java.io.*; +import java.math.*; +import java.security.cert.*; +import netscape.security.x509.*; +import netscape.security.util.*; +import netscape.security.pkcs.*; +import com.netscape.certsrv.base.*; + + +/** + * A class represents a certificate revocation info. This + * object is written as an attribute of certificate record + * which essentially signifies a revocation act. + * <P> + * + * @version $Revision$, $Date$ + */ +public interface IRevocationInfo { + + /** + * Retrieves revocation date. + * + * @return revocation date + */ + public Date getRevocationDate(); + + /** + * Retrieves CRL entry extensions. + * + * @return CRL entry extensions + */ + public CRLExtensions getCRLEntryExtensions(); +} |