From 621d9e5c413e561293d7484b93882d985b3fe15f Mon Sep 17 00:00:00 2001 From: Endi Sukma Dewata Date: Sat, 24 Mar 2012 02:27:47 -0500 Subject: Removed unnecessary pki folder. Previously the source code was located inside a pki folder. This folder was created during svn migration and is no longer needed. This folder has now been removed and the contents have been moved up one level. Ticket #131 --- .../src/com/netscape/certsrv/ocsp/IDefStore.java | 177 ++++++++++++++++++++ .../com/netscape/certsrv/ocsp/IOCSPAuthority.java | 184 +++++++++++++++++++++ .../com/netscape/certsrv/ocsp/IOCSPService.java | 77 +++++++++ .../src/com/netscape/certsrv/ocsp/IOCSPStore.java | 71 ++++++++ 4 files changed, 509 insertions(+) create mode 100644 base/common/src/com/netscape/certsrv/ocsp/IDefStore.java create mode 100644 base/common/src/com/netscape/certsrv/ocsp/IOCSPAuthority.java create mode 100644 base/common/src/com/netscape/certsrv/ocsp/IOCSPService.java create mode 100644 base/common/src/com/netscape/certsrv/ocsp/IOCSPStore.java (limited to 'base/common/src/com/netscape/certsrv/ocsp') diff --git a/base/common/src/com/netscape/certsrv/ocsp/IDefStore.java b/base/common/src/com/netscape/certsrv/ocsp/IDefStore.java new file mode 100644 index 000000000..ee4c76a08 --- /dev/null +++ b/base/common/src/com/netscape/certsrv/ocsp/IDefStore.java @@ -0,0 +1,177 @@ +// --- BEGIN COPYRIGHT BLOCK --- +// This program is free software; you can redistribute it and/or modify +// it under the terms of the GNU General Public License as published by +// the Free Software Foundation; version 2 of the License. +// +// This program is distributed in the hope that it will be useful, +// but WITHOUT ANY WARRANTY; without even the implied warranty of +// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +// GNU General Public License for more details. +// +// You should have received a copy of the GNU General Public License along +// with this program; if not, write to the Free Software Foundation, Inc., +// 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. +// +// (C) 2007 Red Hat, Inc. +// All rights reserved. +// --- END COPYRIGHT BLOCK --- +package com.netscape.certsrv.ocsp; + +import java.math.BigInteger; +import java.security.cert.X509CRL; +import java.util.Date; +import java.util.Enumeration; + +import com.netscape.certsrv.base.EBaseException; +import com.netscape.certsrv.dbs.crldb.ICRLIssuingPointRecord; +import com.netscape.certsrv.dbs.repository.IRepositoryRecord; + +/** + * This class defines an Online Certificate Status Protocol (OCSP) store which + * has been extended to provide information from the internal database. + *

+ * + * @version $Revision$, $Date$ + */ +public interface IDefStore extends IOCSPStore { + /** + * This method retrieves the number of CRL updates since startup. + *

+ * + * @return count the number of OCSP default stores + */ + public int getStateCount(); + + /** + * This method retrieves the number of OCSP requests since startup. + *

+ * + * @param id a string associated with an OCSP request + * @return count the number of this type of OCSP requests + */ + public long getReqCount(String id); + + /** + * This method creates a an OCSP default store repository record. + *

+ * + * @return IRepositoryRecord an instance of the repository record object + */ + public IRepositoryRecord createRepositoryRecord(); + + /** + * This method adds a request to the default OCSP store repository. + *

+ * + * @param name a string representing the name of this request + * @param thisUpdate the current request + * @param rec an instance of the repository record object + * @exception EBaseException occurs when there is an error attempting to + * add this request to the repository + */ + public void addRepository(String name, String thisUpdate, + IRepositoryRecord rec) + throws EBaseException; + + /** + * This method specifies whether or not to wait for the Certificate + * Revocation List (CRL) to be updated. + *

+ * + * @return boolean true or false + */ + public boolean waitOnCRLUpdate(); + + /** + * This method updates the specified CRL. + *

+ * + * @param crl the CRL to be updated + * @exception EBaseException occurs when the CRL cannot be updated + */ + public void updateCRL(X509CRL crl) throws EBaseException; + + /** + * This method attempts to read the CRL issuing point. + *

+ * + * @param name the name of the CRL to be read + * @return ICRLIssuingPointRecord the CRL issuing point + * @exception EBaseException occurs when the specified CRL cannot be located + */ + public ICRLIssuingPointRecord readCRLIssuingPoint(String name) + throws EBaseException; + + /** + * This method searches all CRL issuing points. + *

+ * + * @param maxSize specifies the largest number of hits from the search + * @return Enumeration a list of the CRL issuing points + * @exception EBaseException occurs when no CRL issuing point exists + */ + public Enumeration searchAllCRLIssuingPointRecord( + int maxSize) + throws EBaseException; + + /** + * This method searches all CRL issuing points constrained by the specified + * filtering mechanism. + *

+ * + * @param filter a string which constrains the search + * @param maxSize specifies the largest number of hits from the search + * @return Enumeration a list of the CRL issuing points + * @exception EBaseException occurs when no CRL issuing point exists + */ + public Enumeration searchCRLIssuingPointRecord(String filter, + int maxSize) + throws EBaseException; + + /** + * This method creates a CRL issuing point record. + *

+ * + * @param name a string representation of this CRL issuing point record + * @param crlNumber the number of this CRL issuing point record + * @param crlSize the size of this CRL issuing point record + * @param thisUpdate the time for this CRL issuing point record + * @param nextUpdate the time for the next CRL issuing point record + * @return ICRLIssuingPointRecord this CRL issuing point record + */ + public ICRLIssuingPointRecord createCRLIssuingPointRecord( + String name, BigInteger crlNumber, + Long crlSize, Date thisUpdate, Date nextUpdate); + + /** + * This method adds a CRL issuing point + *

+ * + * @param name a string representation of this CRL issuing point record + * @param rec this CRL issuing point record + * @exception EBaseException occurs when the specified CRL issuing point + * record cannot be added + */ + public void addCRLIssuingPoint(String name, ICRLIssuingPointRecord rec) + throws EBaseException; + + /** + * This method deletes a CRL issuing point record + *

+ * + * @param id a string representation of this CRL issuing point record + * @exception EBaseException occurs when the specified CRL issuing point + * record cannot be deleted + */ + public void deleteCRLIssuingPointRecord(String id) + throws EBaseException; + + /** + * This method checks to see if the OCSP response should return good + * when the certificate is not found. + *

+ * + * @return boolean true or false + */ + public boolean isNotFoundGood(); +} diff --git a/base/common/src/com/netscape/certsrv/ocsp/IOCSPAuthority.java b/base/common/src/com/netscape/certsrv/ocsp/IOCSPAuthority.java new file mode 100644 index 000000000..0219d357d --- /dev/null +++ b/base/common/src/com/netscape/certsrv/ocsp/IOCSPAuthority.java @@ -0,0 +1,184 @@ +// --- BEGIN COPYRIGHT BLOCK --- +// This program is free software; you can redistribute it and/or modify +// it under the terms of the GNU General Public License as published by +// the Free Software Foundation; version 2 of the License. +// +// This program is distributed in the hope that it will be useful, +// but WITHOUT ANY WARRANTY; without even the implied warranty of +// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +// GNU General Public License for more details. +// +// You should have received a copy of the GNU General Public License along +// with this program; if not, write to the Free Software Foundation, Inc., +// 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. +// +// (C) 2007 Red Hat, Inc. +// All rights reserved. +// --- END COPYRIGHT BLOCK --- +package com.netscape.certsrv.ocsp; + +import netscape.security.x509.X500Name; + +import org.mozilla.jss.asn1.OBJECT_IDENTIFIER; +import org.mozilla.jss.pkix.primitive.AlgorithmIdentifier; + +import com.netscape.certsrv.base.EBaseException; +import com.netscape.certsrv.base.ISubsystem; +import com.netscape.certsrv.security.ISigningUnit; +import com.netscape.cmsutil.ocsp.BasicOCSPResponse; +import com.netscape.cmsutil.ocsp.ResponderID; +import com.netscape.cmsutil.ocsp.ResponseData; + +/** + * This class represents the primary interface for the Online Certificate + * Status Protocol (OCSP) server. + *

+ * + * @version $Revision$, $Date$ + */ +public interface IOCSPAuthority extends ISubsystem { + public static final String ID = "ocsp"; + + public final static OBJECT_IDENTIFIER OCSP_NONCE = new OBJECT_IDENTIFIER("1.3.6.1.5.5.7.48.1.2"); + + public final static String PROP_DEF_STORE_ID = "storeId"; + public final static String PROP_STORE = "store"; + public final static String PROP_SIGNING_SUBSTORE = "signing"; + public static final String PROP_NICKNAME = "certNickname"; + public final static String PROP_NEW_NICKNAME = "newNickname"; + + /** + * This method retrieves the OCSP store given its name. + *

+ * + * @param id the string representation of an OCSP store + * @return IOCSPStore an instance of an OCSP store object + */ + public IOCSPStore getOCSPStore(String id); + + /** + * This method retrieves the signing unit. + *

+ * + * @return ISigningUnit an instance of a signing unit object + */ + public ISigningUnit getSigningUnit(); + + /** + * This method retrieves the responder ID by its name. + *

+ * + * @return ResponderID an instance of a responder ID + */ + public ResponderID getResponderIDByName(); + + /** + * This method retrieves the responder ID by its hash. + *

+ * + * @return ResponderID an instance of a responder ID + */ + public ResponderID getResponderIDByHash(); + + /** + * This method retrieves the default OCSP store + * (i. e. - information from the internal database). + *

+ * + * @return IDefStore an instance of the default OCSP store + */ + public IDefStore getDefaultStore(); + + /** + * This method sets the supplied algorithm as the default signing algorithm. + *

+ * + * @param algorithm a string representing the requested algorithm + * @exception EBaseException if the algorithm is unknown or disallowed + */ + public void setDefaultAlgorithm(String algorithm) + throws EBaseException; + + /** + * This method retrieves the default signing algorithm. + *

+ * + * @return String the name of the default signing algorithm + */ + public String getDefaultAlgorithm(); + + /** + * This method retrieves all potential OCSP signing algorithms. + *

+ * + * @return String[] the names of all potential OCSP signing algorithms + */ + public String[] getOCSPSigningAlgorithms(); + + /** + * This method logs the specified message at the specified level. + *

+ * + * @param level the log level + * @param msg the log message + */ + public void log(int level, String msg); + + /** + * This method logs the specified message at the specified level given + * the specified event. + *

+ * + * @param event the log event + * @param level the log message + * @param msg the log message + */ + public void log(int event, int level, String msg); + + /** + * This method retrieves the X500Name of an OCSP server instance. + *

+ * + * @return X500Name an instance of the X500 name object + */ + public X500Name getName(); + + /** + * This method retrieves an OCSP server instance digest name as a string. + *

+ * + * @param alg the signing algorithm + * @return String the digest name of the related OCSP server + */ + public String getDigestName(AlgorithmIdentifier alg); + + /** + * This method signs the basic OCSP response data provided as a parameter. + *

+ * + * @param rd response data + * @return BasicOCSPResponse signed response data + * @exception EBaseException error associated with an inability to sign + * the specified response data + */ + public BasicOCSPResponse sign(ResponseData rd) + throws EBaseException; + + /** + * This method compares two byte arrays to see if they are equivalent. + *

+ * + * @param bytes the first byte array + * @param ints the second byte array + * @return boolean true or false + */ + public boolean arraysEqual(byte[] bytes, byte[] ints); + + public void incTotalTime(long inc); + + public void incSignTime(long inc); + + public void incLookupTime(long inc); + + public void incNumOCSPRequest(long inc); +} diff --git a/base/common/src/com/netscape/certsrv/ocsp/IOCSPService.java b/base/common/src/com/netscape/certsrv/ocsp/IOCSPService.java new file mode 100644 index 000000000..574289c29 --- /dev/null +++ b/base/common/src/com/netscape/certsrv/ocsp/IOCSPService.java @@ -0,0 +1,77 @@ +// --- BEGIN COPYRIGHT BLOCK --- +// This program is free software; you can redistribute it and/or modify +// it under the terms of the GNU General Public License as published by +// the Free Software Foundation; version 2 of the License. +// +// This program is distributed in the hope that it will be useful, +// but WITHOUT ANY WARRANTY; without even the implied warranty of +// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +// GNU General Public License for more details. +// +// You should have received a copy of the GNU General Public License along +// with this program; if not, write to the Free Software Foundation, Inc., +// 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. +// +// (C) 2007 Red Hat, Inc. +// All rights reserved. +// --- END COPYRIGHT BLOCK --- +package com.netscape.certsrv.ocsp; + +import com.netscape.certsrv.base.EBaseException; +import com.netscape.cmsutil.ocsp.OCSPRequest; +import com.netscape.cmsutil.ocsp.OCSPResponse; + +/** + * This class represents the servlet that serves the Online Certificate + * Status Protocol (OCSP) requests. + * + * @version $Revision$ $Date$ + */ +public interface IOCSPService { + /** + * This method validates the information associated with the specified + * OCSP request and returns an OCSP response. + *

+ * + * @param r an OCSP request + * @return OCSPResponse the OCSP response associated with the specified + * OCSP request + * @exception EBaseException an error associated with the inability to + * process the supplied OCSP request + */ + public OCSPResponse validate(OCSPRequest r) + throws EBaseException; + + /** + * Returns the in-memory count of the processed OCSP requests. + * + * @return number of processed OCSP requests in memory + */ + public long getNumOCSPRequest(); + + /** + * Returns the in-memory time (in mini-second) of + * the processed time for OCSP requests. + * + * @return processed times for OCSP requests + */ + public long getOCSPRequestTotalTime(); + + /** + * Returns the in-memory time (in mini-second) of + * the signing time for OCSP requests. + * + * @return processed times for OCSP requests + */ + public long getOCSPTotalSignTime(); + + public long getOCSPTotalLookupTime(); + + /** + * Returns the total data signed + * for OCSP requests. + * + * @return processed times for OCSP requests + */ + public long getOCSPTotalData(); +} diff --git a/base/common/src/com/netscape/certsrv/ocsp/IOCSPStore.java b/base/common/src/com/netscape/certsrv/ocsp/IOCSPStore.java new file mode 100644 index 000000000..676122105 --- /dev/null +++ b/base/common/src/com/netscape/certsrv/ocsp/IOCSPStore.java @@ -0,0 +1,71 @@ +// --- BEGIN COPYRIGHT BLOCK --- +// This program is free software; you can redistribute it and/or modify +// it under the terms of the GNU General Public License as published by +// the Free Software Foundation; version 2 of the License. +// +// This program is distributed in the hope that it will be useful, +// but WITHOUT ANY WARRANTY; without even the implied warranty of +// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +// GNU General Public License for more details. +// +// You should have received a copy of the GNU General Public License along +// with this program; if not, write to the Free Software Foundation, Inc., +// 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. +// +// (C) 2007 Red Hat, Inc. +// All rights reserved. +// --- END COPYRIGHT BLOCK --- +package com.netscape.certsrv.ocsp; + +import com.netscape.certsrv.base.EBaseException; +import com.netscape.certsrv.base.ISubsystem; +import com.netscape.certsrv.common.NameValuePairs; +import com.netscape.cmsutil.ocsp.OCSPRequest; +import com.netscape.cmsutil.ocsp.OCSPResponse; + +/** + * This class represents the generic interface for an Online Certificate + * Status Protocol (OCSP) store. Users can plugin different OCSP stores + * by extending this class. For example, imagine that if a user wants to + * use the corporate LDAP server for revocation checking, then the user + * would merely create a new class that extends this class (e. g. - + * "public interface ICorporateLDAPStore extends IOCSPStore"). + *

+ * + * @version $Revision$, $Date$ + */ +public interface IOCSPStore extends ISubsystem { + /** + * This method validates the information associated with the specified + * OCSP request and returns an OCSP response. + *

+ * + * @param req an OCSP request + * @return OCSPResponse the OCSP response associated with the specified + * OCSP request + * @exception EBaseException an error associated with the inability to + * process the supplied OCSP request + */ + public OCSPResponse validate(OCSPRequest req) + throws EBaseException; + + /** + * This method retrieves the configuration parameters associated with this + * OCSP store. + *

+ * + * @return NameValuePairs all configuration items + */ + public NameValuePairs getConfigParameters(); + + /** + * This method stores the configuration parameters specified by the + * passed-in Name Value pairs object. + *

+ * + * @param pairs a name-value pair object + * @exception EBaseException an illegal name-value pair + */ + public void setConfigParameters(NameValuePairs pairs) + throws EBaseException; +} -- cgit