summaryrefslogtreecommitdiffstats
path: root/pki/base/common/src/com/netscape/cmscore/security/PWsdrCache.java
diff options
context:
space:
mode:
Diffstat (limited to 'pki/base/common/src/com/netscape/cmscore/security/PWsdrCache.java')
-rw-r--r--pki/base/common/src/com/netscape/cmscore/security/PWsdrCache.java639
1 files changed, 0 insertions, 639 deletions
diff --git a/pki/base/common/src/com/netscape/cmscore/security/PWsdrCache.java b/pki/base/common/src/com/netscape/cmscore/security/PWsdrCache.java
deleted file mode 100644
index 6c834d0e0..000000000
--- a/pki/base/common/src/com/netscape/cmscore/security/PWsdrCache.java
+++ /dev/null
@@ -1,639 +0,0 @@
-// --- BEGIN COPYRIGHT BLOCK ---
-// This program is free software; you can redistribute it and/or modify
-// it under the terms of the GNU General Public License as published by
-// the Free Software Foundation; version 2 of the License.
-//
-// This program is distributed in the hope that it will be useful,
-// but WITHOUT ANY WARRANTY; without even the implied warranty of
-// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
-// GNU General Public License for more details.
-//
-// You should have received a copy of the GNU General Public License along
-// with this program; if not, write to the Free Software Foundation, Inc.,
-// 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
-//
-// (C) 2007 Red Hat, Inc.
-// All rights reserved.
-// --- END COPYRIGHT BLOCK ---
-package com.netscape.cmscore.security;
-
-import java.io.ByteArrayOutputStream;
-import java.io.File;
-import java.io.FileInputStream;
-import java.io.FileNotFoundException;
-import java.io.FileOutputStream;
-import java.io.FilterOutputStream;
-import java.io.IOException;
-import java.io.PrintStream;
-import java.util.Enumeration;
-import java.util.Hashtable;
-import java.util.StringTokenizer;
-
-import org.mozilla.jss.CryptoManager;
-import org.mozilla.jss.CryptoManager.NotInitializedException;
-import org.mozilla.jss.SecretDecoderRing.Decryptor;
-import org.mozilla.jss.SecretDecoderRing.Encryptor;
-import org.mozilla.jss.SecretDecoderRing.KeyManager;
-import org.mozilla.jss.crypto.CryptoToken;
-import org.mozilla.jss.crypto.TokenException;
-import org.mozilla.jss.util.Base64OutputStream;
-import org.mozilla.jss.util.Password;
-
-import com.netscape.certsrv.apps.CMS;
-import com.netscape.certsrv.base.EBaseException;
-import com.netscape.certsrv.logging.ILogger;
-import com.netscape.cmsutil.util.Utils;
-
-/*
- * A class for managing passwords in the SDR password cache
- *
- * @author Christina Fu
- * @version $Revision$, $Date$
- */
-public class PWsdrCache {
- public static final String PROP_PWC_TOKEN_NAME = "pwcTokenname";
- public static final String PROP_PWC_KEY_ID = "pwcKeyid";
- public static final String PROP_PWC_NICKNAME = "sso_key";
-
- private ILogger mLogger = null;
- private String mPWcachedb = null;
- // mTool tells if this is called from the PasswordCache tool
- private boolean mIsTool = false;
- private byte[] mKeyID = null;
- private String mTokenName = null;
- private CryptoToken mToken = null;
-
- // for CMSEngine
- public PWsdrCache() throws EBaseException {
- mLogger = CMS.getLogger();
- try {
- mPWcachedb = CMS.getConfigStore().getString("pwCache");
- CMS.debug("got pwCache file path from configstore");
- } catch (Exception e) {
- log(ILogger.LL_FAILURE, CMS.getLogMessage("CMSCORE_SECURITY_GET_CONFIG"));
- // let it fall through
- }
- initToken();
- initKey();
- }
-
- private void initToken() throws EBaseException {
- if (mToken == null) {
- CryptoManager cm = null;
- try {
- cm = CryptoManager.getInstance();
- mTokenName = CMS.getConfigStore().getString(PROP_PWC_TOKEN_NAME);
- log(ILogger.LL_DEBUG, "pwcTokenname specified. Use token for SDR key. tokenname= " + mTokenName);
- mToken = cm.getTokenByName(mTokenName);
- } catch (NotInitializedException e) {
- log(ILogger.LL_FAILURE, e.toString());
- throw new EBaseException(e.toString());
- } catch (Exception e) {
- log(ILogger.LL_DEBUG, "no pwcTokenname specified, use internal token for SDR key");
- mToken = cm.getInternalKeyStorageToken();
- }
- }
- }
-
- // called from PWCBsdr or CMSEngine only
- private void initKey() throws EBaseException {
- if (mKeyID == null) {
- try {
- String keyID = CMS.getConfigStore().getString(PROP_PWC_KEY_ID);
- log(ILogger.LL_DEBUG, "retrieved PWC SDR key");
- mKeyID = base64Decode(keyID);
-
- } catch (Exception e) {
- log(ILogger.LL_DEBUG, "no pwcSDRKey specified");
- throw new EBaseException(e.toString());
- }
- }
- }
-
- // for PasswordCache tool (isTool == true)
- // and installation wizard (isTool == false)
- // Do not use for PWCBsdr, since we don't want to mistakenly
- // generate SDR keys in case of configuration errors
- public PWsdrCache(String pwCache, String pwcTokenname, byte[] keyId,
- boolean isTool) throws Exception {
- mPWcachedb = pwCache;
- mIsTool = isTool;
- mTokenName = pwcTokenname;
- CryptoManager cm = null;
-
- if (keyId != null) {
- mKeyID = keyId;
- }
-
- cm = CryptoManager.getInstance();
- if (mTokenName != null) {
- mToken = cm.getTokenByName(mTokenName);
- mToken = cm.getInternalKeyStorageToken();
- debug("PWsdrCache: mToken = " + mTokenName);
- } else {
- mToken = cm.getInternalKeyStorageToken();
- debug("PWsdrCache: mToken = internal");
- }
- }
-
- public byte[] getKeyId() {
- return mKeyID;
- }
-
- public String getTokenName() {
- return mTokenName;
- }
-
- public void deleteUniqueNamedKey(String nickName)
- throws Exception {
- KeyManager km = new KeyManager(mToken);
- km.deleteUniqueNamedKey(nickName);
- }
-
- public byte[] generateSDRKey() throws Exception {
- return generateSDRKeyWithNickName(PROP_PWC_NICKNAME);
- }
-
- public byte[] generateSDRKeyWithNickName(String nickName)
- throws Exception {
- try {
-
- if (mIsTool != true) {
- // generate SDR key
- KeyManager km = new KeyManager(mToken);
- try {
- // Bugscape Bug #54838: Due to the CMS cloning feature,
- // we must check for the presence of
- // a uniquely named symmetric key
- // prior to making an attempt to
- // generate it!
- //
- if (!(km.uniqueNamedKeyExists(nickName))) {
- mKeyID = km.generateUniqueNamedKey(nickName);
- }
- } catch (TokenException e) {
- log(0, "generateSDRKey() failed on " + e.toString());
- throw e;
- }
- }
- } catch (Exception e) {
- log(ILogger.LL_FAILURE, e.toString());
- throw e;
- }
- return mKeyID;
- }
-
- public byte[] base64Decode(String s) throws IOException {
- byte[] d = Utils.base64decode(s);
- return d;
- }
-
- public static String base64Encode(byte[] bytes) throws IOException {
- // All this streaming is lame, but Base64OutputStream needs a
- // PrintStream
- ByteArrayOutputStream output = new ByteArrayOutputStream();
- Base64OutputStream b64 = new Base64OutputStream(new
- PrintStream(new
- FilterOutputStream(output)
- )
- );
-
- b64.write(bytes);
- b64.flush();
-
- // This is internationally safe because Base64 chars are
- // contained within 8859_1
- return output.toString("8859_1");
- }
-
- // for PWCBsdr
- public PWsdrCache(String pwCache, ILogger logger) throws
- EBaseException {
- mLogger = logger;
- mPWcachedb = pwCache;
- initToken();
- initKey();
- }
-
- public void addEntry(String tag, String pwd) throws EBaseException {
- addEntry(tag, pwd, (Hashtable<String, String>) null);
- }
-
- /*
- * Store passwd in pwcache.
- */
- public void addEntry(Hashtable<String, String> ht) throws EBaseException {
- addEntry((String) null, (String) null, ht);
- }
-
- /*
- * add passwd in pwcache.
- */
- public void addEntry(String tag, String pwd, Hashtable<String, String> tagPwds) throws EBaseException {
-
- String stringToAdd = null;
- String bufs = null;
-
- if (tagPwds == null) {
- stringToAdd = tag + ":" + pwd + "\n";
- } else {
- Enumeration<String> enum1 = tagPwds.keys();
-
- while (enum1.hasMoreElements()) {
- tag = enum1.nextElement();
- pwd = tagPwds.get(tag);
- debug("password tag: " + tag + " stored in " + mPWcachedb);
-
- if (stringToAdd == null) {
- stringToAdd = tag + ":" + pwd + "\n";
- } else {
- stringToAdd += tag + ":" + pwd + "\n";
- }
- }
- }
-
- String dcrypts = readPWcache();
-
- if (dcrypts != null) {
- // converts to Hashtable, replace if tag exists, add
- // if tag doesn't exist
- Hashtable<String, String> ht = string2Hashtable(dcrypts);
-
- if (ht.containsKey(tag) == false) {
- debug("adding new tag: " + tag);
- ht.put(tag, pwd);
- } else {
- debug("replacing tag: " + tag);
- ht.put(tag, pwd);
- }
- bufs = hashtable2String(ht);
- } else {
- debug("adding new tag: " + tag);
- bufs = stringToAdd;
- }
-
- // write update to cache
- writePWcache(bufs);
- }
-
- /*
- * delete passwd in pwcache.
- */
- public void deleteEntry(String tag) throws EBaseException {
- String bufs = null;
-
- String dcrypts = readPWcache();
-
- if (dcrypts != null) {
- // converts to Hashtable, replace if tag exists, add
- // if tag doesn't exist
- Hashtable<String, String> ht = string2Hashtable(dcrypts);
-
- if (ht.containsKey(tag) == false) {
- debug("tag: " + tag + " does not exist");
- return;
- } else {
- debug("deleting tag: " + tag);
- ht.remove(tag);
- }
- bufs = hashtable2String(ht);
- } else {
- debug("password cache contains no tags");
- return;
- }
-
- // write update to cache
- writePWcache(bufs);
- }
-
- /*
- * reads and decrypts the pwcache.db content
- */
- public String readPWcache() throws EBaseException {
- debug("about to read password cache");
- String dcrypts = null;
- Decryptor sdr = new Decryptor(mToken);
-
- // not used, but could used for debugging
- int totalRead = 0;
- FileInputStream inputs = null;
- ByteArrayOutputStream bos = new ByteArrayOutputStream();
-
- try {
- // for SDR -> read, decrypt, append, and write
- inputs = new FileInputStream(mPWcachedb);
- byte[] readbuf = new byte[2048]; // for now
- int numRead = 0;
-
- while ((numRead = inputs.read(readbuf)) != -1) {
- bos.write(readbuf, 0, numRead);
- totalRead += numRead;
- }
- inputs.close();
- } catch (FileNotFoundException e) {
- log(ILogger.LL_FAILURE, CMS.getLogMessage("CMSCORE_SECURITY_PW_FILE", mPWcachedb, e.toString()));
- throw new EBaseException(e.toString() + ": " + mPWcachedb);
- } catch (IOException e) {
- log(ILogger.LL_FAILURE, CMS.getLogMessage("CMSCORE_SECURITY_PW_FILE", mPWcachedb, e.toString()));
- throw new EBaseException(e.toString() + ": " + mPWcachedb);
- }
-
- if (totalRead > 0) {
- try {
- // decrypt it first to append
- byte[] dcryptb = sdr.decrypt(bos.toByteArray());
-
- dcrypts = new String(dcryptb, "UTF-8");
- } catch (Exception e) {
- log(ILogger.LL_FAILURE, CMS.getLogMessage("CMSCORE_SECURITY_PW_DECRYPT", e.toString()));
- e.printStackTrace();
- throw new EBaseException("password cache decrypt failed");
- }
- }
-
- return dcrypts;
- }
-
- /*
- * encrypts and writes the whole String buf into pwcache.db
- */
- public void writePWcache(String bufs) throws EBaseException {
- try {
- Encryptor sdr = new Encryptor(mToken, mKeyID,
- Encryptor.DEFAULT_ENCRYPTION_ALG);
-
- byte[] writebuf = null;
-
- try {
- // now encrypt it again
- writebuf = sdr.encrypt(bufs.getBytes("UTF-8"));
- } catch (Exception e) {
- log(ILogger.LL_FAILURE, CMS.getLogMessage("CMSCORE_SECURITY_PW_ENCRYPT", e.toString()));
- e.printStackTrace();
- throw new EBaseException("password cache encrypt failed");
- }
-
- File tmpPWcache = new File(mPWcachedb + ".tmp");
-
- if (tmpPWcache.exists()) {
- // it wasn't removed?
- tmpPWcache.delete();
- tmpPWcache = new File(mPWcachedb + ".tmp");
- }
- FileOutputStream outstream = new FileOutputStream(mPWcachedb + ".tmp");
-
- outstream.write(writebuf);
- outstream.close();
-
- File origFile = new File(mPWcachedb);
-
- try {
- if (Utils.isNT()) {
- // NT is very picky on the path
- Utils.exec("copy " +
- tmpPWcache.getAbsolutePath().replace('/',
- '\\') +
- " " +
- origFile.getAbsolutePath().replace('/',
- '\\'));
- } else {
- // Create a copy of the original file which
- // preserves the original file permissions.
- Utils.exec("cp -p " + tmpPWcache.getAbsolutePath() + " " +
- origFile.getAbsolutePath());
- }
-
- // Remove the original file if and only if
- // the backup copy was successful.
- if (origFile.exists()) {
- if (!Utils.isNT()) {
- try {
- Utils.exec("chmod 00660 " +
- origFile.getCanonicalPath());
- } catch (IOException e) {
- CMS.debug("Unable to change file permissions on "
- + origFile.toString());
- }
- }
- tmpPWcache.delete();
- debug("operation completed for " + mPWcachedb);
- }
- } catch (Exception exx) {
- log(ILogger.LL_FAILURE, CMS.getLogMessage("CMSCORE_SECURITY_PW_CACHE", exx.toString()));
- throw new EBaseException(exx.toString() + ": " + mPWcachedb);
- }
- } catch (FileNotFoundException e) {
- log(ILogger.LL_FAILURE, CMS.getLogMessage("CMSCORE_SECURITY_PW_FILE", mPWcachedb, e.toString()));
- throw new EBaseException(e.toString() + ": " + mPWcachedb);
- } catch (IOException e) {
- log(ILogger.LL_FAILURE, CMS.getLogMessage("CMSCORE_SECURITY_PW_FILE", mPWcachedb, e.toString()));
- throw new EBaseException(e.toString() + ": " + mPWcachedb);
- } catch (Exception e) {
- log(ILogger.LL_FAILURE, CMS.getLogMessage("CMSCORE_SECURITY_PW_FILE", mPWcachedb, e.toString()));
- throw new EBaseException(e.toString() + ": " + mPWcachedb);
- }
- }
-
- public String hashtable2String(Hashtable<String, String> ht) {
- Enumeration<String> enum1 = ht.keys();
- String returnString = null;
-
- while (enum1.hasMoreElements()) {
- String tag = enum1.nextElement();
- String pwd = ht.get(tag);
-
- if (returnString == null) {
- returnString = tag + ":" + pwd + "\n";
- } else {
- returnString += tag + ":" + pwd + "\n";
- }
- }
- return returnString;
- }
-
- public Hashtable<String, String> string2Hashtable(String cache) {
- Hashtable<String, String> ht = new Hashtable<String, String>();
-
- // first, break into lines
- StringTokenizer st = new StringTokenizer(cache, "\n");
-
- while (st.hasMoreTokens()) {
- String line = (String) st.nextToken();
- // break into tag:password format for each line
- int colonIdx = line.indexOf(":");
-
- if (colonIdx != -1) {
- String tag = line.substring(0, colonIdx);
- String passwd = line.substring(colonIdx + 1,
- line.length());
-
- ht.put(tag.trim(), passwd.trim());
- } else {
- //invalid format...log or throw...later
- }
- }
- return ht;
- }
-
- /*
- * get password from cache. This one supplies cache file name
- */
- public Password getEntry(String fileName, String tag) {
- mPWcachedb = fileName;
- return getEntry(tag);
- }
-
- /*
- * if tag found with pwd, return it
- * if tag not found, return null, which will cause it to give up
- */
- public Password getEntry(String tag) {
- Hashtable<String, String> pwTable = null;
- String pw = null;
-
- debug("in getEntry, tag=" + tag);
-
- if (mPWcachedb == null) {
- debug("mPWcachedb file path name is not initialized");
- return null;
- }
-
- String dcrypts = null;
-
- try {
- dcrypts = readPWcache();
- } catch (EBaseException e) {
- log(ILogger.LL_FAILURE, CMS.getLogMessage("CMSCORE_SECURITY_PW_READ", e.toString()));
- return null;
- }
-
- if (dcrypts != null) {
- // parse the cache
- String cache = dcrypts;
-
- // this is created and destroyed at each use
- pwTable = string2Hashtable(cache);
- debug("in getEntry, pw cache parsed");
- pw = (String) pwTable.get(tag);
- }
-
- if (pw != null) {
- debug("getEntry gotten password for " + tag);
- return new Password(pw.toCharArray());
- } else {
- log(ILogger.LL_FAILURE, CMS.getLogMessage("CMSCORE_SECURITY_PW_TAG", tag));
- return null;
- }
- }
-
- //copied from IOUtil.java
- /**
- * Checks if this is NT.
- */
- public static boolean isNT() {
- return ((File.separator).equals("\\"));
- }
-
- public static boolean exec(String cmd) throws EBaseException {
- try {
- String cmds[] = null;
-
- if (isNT()) {
- // NT
- cmds = new String[3];
- cmds[0] = "cmd";
- cmds[1] = "/c";
- cmds[2] = cmd;
- } else {
- // UNIX
- cmds = new String[3];
- cmds[0] = "/bin/sh";
- cmds[1] = "-c";
- cmds[2] = cmd;
- }
- Process process = Runtime.getRuntime().exec(cmds);
-
- process.waitFor();
-
- if (process.exitValue() == 0) {
-
- /**
- * pOut = new BufferedReader(
- * new InputStreamReader(process.getInputStream()));
- * while ((l = pOut.readLine()) != null) {
- * System.out.println(l);
- * }
- **/
- return true;
- } else {
-
- /**
- * pOut = new BufferedReader(
- * new InputStreamReader(process.getErrorStream()));
- * l = null;
- * while ((l = pOut.readLine()) != null) {
- * System.out.println(l);
- * }
- **/
- return false;
- }
- } catch (Exception e) {
- return false;
- }
- }
-
- public void debug(String msg) {
- if (mLogger != null) {
- CMS.debug(msg);
- }
- }
-
- public void log(int level, String msg) {
- if (mLogger != null) {
- mLogger.log(ILogger.EV_SYSTEM, ILogger.S_OTHER, level,
- "PWsdrCache " + msg);
- } else if (mIsTool) {
- System.out.println(msg);
- } // else it's most likely the installation wizard...no logging
- }
-
- /*
- * list passwds in pwcache.
- */
- public boolean pprint() {
- String dcrypts = null;
-
- try {
- dcrypts = readPWcache();
- } catch (EBaseException e) {
- log(ILogger.LL_FAILURE, CMS.getLogMessage("CMSCORE_SECURITY_PW_READ", e.toString()));
- return false;
- }
-
- debug("----- Password Cache Content -----");
-
- if (dcrypts != null) {
- // first, break into lines
- StringTokenizer st = new StringTokenizer(dcrypts, "\n");
-
- while (st.hasMoreTokens()) {
- String line = (String) st.nextToken();
- // break into tag:password format for each line
- int colonIdx = line.indexOf(":");
-
- if (colonIdx != -1) {
- String tag = line.substring(0, colonIdx);
- String passwd = line.substring(colonIdx + 1,
- line.length());
-
- debug(tag.trim() +
- " : " + passwd.trim());
- } else {
- //invalid format...log or throw...later
- debug("invalid format");
- }
- }
- } // else print nothing
- return true;
- }
-}
generated by cgit (git 2.34.1) at 2024-07-03 09:48:18 +0000