From 621d9e5c413e561293d7484b93882d985b3fe15f Mon Sep 17 00:00:00 2001 From: Endi Sukma Dewata Date: Sat, 24 Mar 2012 02:27:47 -0500 Subject: Removed unnecessary pki folder. Previously the source code was located inside a pki folder. This folder was created during svn migration and is no longer needed. This folder has now been removed and the contents have been moved up one level. Ticket #131 --- .../src/com/netscape/cms/selftests/ASelfTest.java | 193 +++++++++++++ .../com/netscape/cms/selftests/ca/CAPresence.java | 262 ++++++++++++++++++ .../com/netscape/cms/selftests/ca/CAValidity.java | 262 ++++++++++++++++++ .../selftests/common/SystemCertsVerification.java | 213 +++++++++++++++ .../netscape/cms/selftests/kra/KRAPresence.java | 251 +++++++++++++++++ .../netscape/cms/selftests/ocsp/OCSPPresence.java | 280 +++++++++++++++++++ .../netscape/cms/selftests/ocsp/OCSPValidity.java | 280 +++++++++++++++++++ .../com/netscape/cms/selftests/ra/RAPresence.java | 261 ++++++++++++++++++ .../cms/selftests/tks/TKSKnownSessionKey.java | 302 +++++++++++++++++++++ 9 files changed, 2304 insertions(+) create mode 100644 base/common/src/com/netscape/cms/selftests/ASelfTest.java create mode 100644 base/common/src/com/netscape/cms/selftests/ca/CAPresence.java create mode 100644 base/common/src/com/netscape/cms/selftests/ca/CAValidity.java create mode 100644 base/common/src/com/netscape/cms/selftests/common/SystemCertsVerification.java create mode 100644 base/common/src/com/netscape/cms/selftests/kra/KRAPresence.java create mode 100644 base/common/src/com/netscape/cms/selftests/ocsp/OCSPPresence.java create mode 100644 base/common/src/com/netscape/cms/selftests/ocsp/OCSPValidity.java create mode 100644 base/common/src/com/netscape/cms/selftests/ra/RAPresence.java create mode 100644 base/common/src/com/netscape/cms/selftests/tks/TKSKnownSessionKey.java (limited to 'base/common/src/com/netscape/cms/selftests') diff --git a/base/common/src/com/netscape/cms/selftests/ASelfTest.java b/base/common/src/com/netscape/cms/selftests/ASelfTest.java new file mode 100644 index 000000000..cdd86ccaf --- /dev/null +++ b/base/common/src/com/netscape/cms/selftests/ASelfTest.java @@ -0,0 +1,193 @@ +// --- BEGIN COPYRIGHT BLOCK --- +// This program is free software; you can redistribute it and/or modify +// it under the terms of the GNU General Public License as published by +// the Free Software Foundation; version 2 of the License. +// +// This program is distributed in the hope that it will be useful, +// but WITHOUT ANY WARRANTY; without even the implied warranty of +// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +// GNU General Public License for more details. +// +// You should have received a copy of the GNU General Public License along +// with this program; if not, write to the Free Software Foundation, Inc., +// 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. +// +// (C) 2007 Red Hat, Inc. +// All rights reserved. +// --- END COPYRIGHT BLOCK --- +// package statement // +/////////////////////// + +package com.netscape.cms.selftests; + +/////////////////////// +// import statements // +/////////////////////// + +import java.util.Locale; + +import com.netscape.certsrv.apps.CMS; +import com.netscape.certsrv.base.IConfigStore; +import com.netscape.certsrv.logging.ILogEventListener; +import com.netscape.certsrv.selftests.EDuplicateSelfTestException; +import com.netscape.certsrv.selftests.EInvalidSelfTestException; +import com.netscape.certsrv.selftests.EMissingSelfTestException; +import com.netscape.certsrv.selftests.ESelfTestException; +import com.netscape.certsrv.selftests.ISelfTest; +import com.netscape.certsrv.selftests.ISelfTestSubsystem; + +////////////////////// +// class definition // +////////////////////// + +/** + * This class implements an individual self test. + *

+ * + * @author mharmsen + * @author thomask + * @version $Revision$, $Date$ + */ +public abstract class ASelfTest + implements ISelfTest { + //////////////////////// + // default parameters // + //////////////////////// + + ////////////////////////// + // ISelfTest parameters // + ////////////////////////// + + // parameter information + private static final String SELF_TEST_NAME = "ASelfTest"; + + // variables associated with this specific object + protected ISelfTestSubsystem mSelfTestSubsystem = null; + protected String mInstanceName = null; + protected IConfigStore mConfig = null; + protected String mPrefix = null; + + ///////////////////// + // default methods // + ///////////////////// + + /////////////////////// + // ISelfTest methods // + /////////////////////// + + /** + * Initializes this subsystem with the configuration store + * associated with this instance name. + *

+ * + * @param subsystem the associated subsystem + * @param instanceName the name of this self test instance + * @param parameters configuration store (self test parameters) + * @exception EDuplicateSelfTestException subsystem has duplicate name/value + * @exception EInvalidSelfTestException subsystem has invalid name/value + * @exception EMissingSelfTestException subsystem has missing name/value + */ + public void initSelfTest(ISelfTestSubsystem subsystem, + String instanceName, + IConfigStore parameters) + throws EDuplicateSelfTestException, + EInvalidSelfTestException, + EMissingSelfTestException { + // store individual self test class values for this instance + mSelfTestSubsystem = (ISelfTestSubsystem) subsystem; + + // strip preceding/trailing whitespace + // from passed-in String parameters + if (instanceName != null) { + instanceName = instanceName.trim(); + } else { + mSelfTestSubsystem.log(mSelfTestSubsystem.getSelfTestLogger(), + CMS.getLogMessage( + "SELFTESTS_PARAMETER_WAS_NULL", + SELF_TEST_NAME)); + + throw new EMissingSelfTestException(); + } + + // store additional individual self test class values for this instance + mInstanceName = instanceName; + + // compose self test plugin parameter property prefix + String pluginPath = PROP_PLUGIN + "." + instanceName; + + mConfig = parameters.getSubStore(pluginPath); + + if ((mConfig != null) && + (mConfig.getName() != null) && + (mConfig.getName() != "")) { + mPrefix = mConfig.getName().trim(); + } else { + mSelfTestSubsystem.log(mSelfTestSubsystem.getSelfTestLogger(), + CMS.getLogMessage( + "SELFTESTS_PARAMETER_WAS_NULL", + SELF_TEST_NAME)); + + throw new EMissingSelfTestException(); + } + + return; + } + + /** + * Notifies this subsystem if it is in execution mode. + *

+ * + * @exception ESelfTestException failed to start + */ + public abstract void startupSelfTest() + throws ESelfTestException; + + /** + * Stops this subsystem. The subsystem may call shutdownSelfTest + * anytime after initialization. + *

+ */ + public abstract void shutdownSelfTest(); + + /** + * Returns the name associated with this self test. This method may + * return null if the self test has not been intialized. + *

+ * + * @return instanceName of this self test + */ + public String getSelfTestName() { + return mInstanceName; + } + + /** + * Returns the root configuration storage (self test parameters) + * associated with this subsystem. + *

+ * + * @return configuration store (self test parameters) of this subsystem + */ + public IConfigStore getSelfTestConfigStore() { + return mConfig; + } + + /** + * Retrieves description associated with an individual self test. + * This method may return null. + *

+ * + * @param locale locale of the client that requests the description + * @return description of self test + */ + public abstract String getSelfTestDescription(Locale locale); + + /** + * Execute an individual self test. + *

+ * + * @param logger specifies logging subsystem + * @exception ESelfTestException self test exception + */ + public abstract void runSelfTest(ILogEventListener logger) + throws ESelfTestException; +} diff --git a/base/common/src/com/netscape/cms/selftests/ca/CAPresence.java b/base/common/src/com/netscape/cms/selftests/ca/CAPresence.java new file mode 100644 index 000000000..c9c12bb42 --- /dev/null +++ b/base/common/src/com/netscape/cms/selftests/ca/CAPresence.java @@ -0,0 +1,262 @@ +// --- BEGIN COPYRIGHT BLOCK --- +// This program is free software; you can redistribute it and/or modify +// it under the terms of the GNU General Public License as published by +// the Free Software Foundation; version 2 of the License. +// +// This program is distributed in the hope that it will be useful, +// but WITHOUT ANY WARRANTY; without even the implied warranty of +// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +// GNU General Public License for more details. +// +// You should have received a copy of the GNU General Public License along +// with this program; if not, write to the Free Software Foundation, Inc., +// 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. +// +// (C) 2007 Red Hat, Inc. +// All rights reserved. +// --- END COPYRIGHT BLOCK --- +// package statement // +/////////////////////// + +package com.netscape.cms.selftests.ca; + +/////////////////////// +// import statements // +/////////////////////// + +import java.security.cert.CertificateParsingException; +import java.util.Locale; + +import netscape.security.x509.X509CertImpl; +import netscape.security.x509.X509Key; + +import com.netscape.certsrv.apps.CMS; +import com.netscape.certsrv.base.EBaseException; +import com.netscape.certsrv.base.IConfigStore; +import com.netscape.certsrv.ca.ICertificateAuthority; +import com.netscape.certsrv.logging.ILogEventListener; +import com.netscape.certsrv.selftests.EDuplicateSelfTestException; +import com.netscape.certsrv.selftests.EInvalidSelfTestException; +import com.netscape.certsrv.selftests.EMissingSelfTestException; +import com.netscape.certsrv.selftests.ESelfTestException; +import com.netscape.certsrv.selftests.ISelfTestSubsystem; +import com.netscape.cms.selftests.ASelfTest; + +////////////////////// +// class definition // +////////////////////// + +/** + * This class implements a self test to check for CA presence. + *

+ * + * @author mharmsen + * @author thomask + * @version $Revision$, $Date$ + */ +public class CAPresence + extends ASelfTest { + //////////////////////// + // default parameters // + //////////////////////// + + /////////////////////////// + // CAPresence parameters // + /////////////////////////// + + // parameter information + public static final String PROP_CA_SUB_ID = "CaSubId"; + private String mCaSubId = null; + + ///////////////////// + // default methods // + ///////////////////// + + //////////////////////// + // CAPresence methods // + //////////////////////// + + /** + * Initializes this subsystem with the configuration store + * associated with this instance name. + *

+ * + * @param subsystem the associated subsystem + * @param instanceName the name of this self test instance + * @param parameters configuration store (self test parameters) + * @exception EDuplicateSelfTestException subsystem has duplicate name/value + * @exception EInvalidSelfTestException subsystem has invalid name/value + * @exception EMissingSelfTestException subsystem has missing name/value + */ + public void initSelfTest(ISelfTestSubsystem subsystem, + String instanceName, + IConfigStore parameters) + throws EDuplicateSelfTestException, + EInvalidSelfTestException, + EMissingSelfTestException { + super.initSelfTest(subsystem, instanceName, parameters); + + // retrieve mandatory parameter(s) + try { + mCaSubId = mConfig.getString(PROP_CA_SUB_ID); + if (mCaSubId != null) { + mCaSubId = mCaSubId.trim(); + } else { + mSelfTestSubsystem.log(mSelfTestSubsystem.getSelfTestLogger(), + CMS.getLogMessage( + "SELFTESTS_MISSING_VALUES", + getSelfTestName(), + mPrefix + + "." + + PROP_CA_SUB_ID)); + + throw new EMissingSelfTestException(PROP_CA_SUB_ID); + } + } catch (EBaseException e) { + mSelfTestSubsystem.log(mSelfTestSubsystem.getSelfTestLogger(), + CMS.getLogMessage( + "SELFTESTS_MISSING_NAME", + getSelfTestName(), + mPrefix + + "." + + PROP_CA_SUB_ID)); + + throw new EMissingSelfTestException(mPrefix, + PROP_CA_SUB_ID, + null); + } + + // retrieve optional parameter(s) + + return; + } + + /** + * Notifies this subsystem if it is in execution mode. + *

+ * + * @exception ESelfTestException failed to start + */ + public void startupSelfTest() + throws ESelfTestException { + return; + } + + /** + * Stops this subsystem. The subsystem may call shutdownSelfTest + * anytime after initialization. + *

+ */ + public void shutdownSelfTest() { + return; + } + + /** + * Returns the name associated with this self test. This method may + * return null if the self test has not been intialized. + *

+ * + * @return instanceName of this self test + */ + public String getSelfTestName() { + return super.getSelfTestName(); + } + + /** + * Returns the root configuration storage (self test parameters) + * associated with this subsystem. + *

+ * + * @return configuration store (self test parameters) of this subsystem + */ + public IConfigStore getSelfTestConfigStore() { + return super.getSelfTestConfigStore(); + } + + /** + * Retrieves description associated with an individual self test. + * This method may return null. + *

+ * + * @param locale locale of the client that requests the description + * @return description of self test + */ + public String getSelfTestDescription(Locale locale) { + return CMS.getUserMessage(locale, + "CMS_SELFTESTS_CA_PRESENCE_DESCRIPTION"); + } + + /** + * Execute an individual self test. + *

+ * + * @param logger specifies logging subsystem + * @exception ESelfTestException self test exception + */ + public void runSelfTest(ILogEventListener logger) + throws ESelfTestException { + String logMessage = null; + ICertificateAuthority ca = null; + X509CertImpl caCert = null; + X509Key caPubKey = null; + + ca = (ICertificateAuthority) CMS.getSubsystem(mCaSubId); + + if (ca == null) { + // log that the CA is not installed + logMessage = CMS.getLogMessage("SELFTESTS_CA_IS_NOT_PRESENT", + getSelfTestName()); + + mSelfTestSubsystem.log(logger, + logMessage); + + throw new ESelfTestException(logMessage); + } else { + // Retrieve the CA certificate + caCert = ca.getCACert(); + + if (caCert == null) { + // log that the CA is not yet initialized + logMessage = CMS.getLogMessage( + "SELFTESTS_CA_IS_NOT_INITIALIZED", + getSelfTestName()); + + mSelfTestSubsystem.log(logger, + logMessage); + + throw new ESelfTestException(logMessage); + } + + // Retrieve the CA certificate public key + try { + caPubKey = (X509Key) caCert.get(X509CertImpl.PUBLIC_KEY); + + if (caPubKey == null) { + // log that something is seriously wrong with the CA + logMessage = CMS.getLogMessage("SELFTESTS_CA_IS_CORRUPT", + getSelfTestName()); + + mSelfTestSubsystem.log(logger, + logMessage); + + throw new ESelfTestException(logMessage); + } + } catch (CertificateParsingException e) { + // log that something is seriously wrong with the CA + mSelfTestSubsystem.log(logger, + e.toString()); + + throw new ESelfTestException(e.toString()); + } + + // log that the CA is present + logMessage = CMS.getLogMessage("SELFTESTS_CA_IS_PRESENT", + getSelfTestName()); + + mSelfTestSubsystem.log(logger, + logMessage); + } + + return; + } +} diff --git a/base/common/src/com/netscape/cms/selftests/ca/CAValidity.java b/base/common/src/com/netscape/cms/selftests/ca/CAValidity.java new file mode 100644 index 000000000..9325208f9 --- /dev/null +++ b/base/common/src/com/netscape/cms/selftests/ca/CAValidity.java @@ -0,0 +1,262 @@ +// --- BEGIN COPYRIGHT BLOCK --- +// This program is free software; you can redistribute it and/or modify +// it under the terms of the GNU General Public License as published by +// the Free Software Foundation; version 2 of the License. +// +// This program is distributed in the hope that it will be useful, +// but WITHOUT ANY WARRANTY; without even the implied warranty of +// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +// GNU General Public License for more details. +// +// You should have received a copy of the GNU General Public License along +// with this program; if not, write to the Free Software Foundation, Inc., +// 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. +// +// (C) 2007 Red Hat, Inc. +// All rights reserved. +// --- END COPYRIGHT BLOCK --- +// package statement // +/////////////////////// + +package com.netscape.cms.selftests.ca; + +/////////////////////// +// import statements // +/////////////////////// + +import java.security.cert.CertificateExpiredException; +import java.security.cert.CertificateNotYetValidException; +import java.util.Locale; + +import netscape.security.x509.X509CertImpl; + +import com.netscape.certsrv.apps.CMS; +import com.netscape.certsrv.base.EBaseException; +import com.netscape.certsrv.base.IConfigStore; +import com.netscape.certsrv.ca.ICertificateAuthority; +import com.netscape.certsrv.logging.ILogEventListener; +import com.netscape.certsrv.selftests.EDuplicateSelfTestException; +import com.netscape.certsrv.selftests.EInvalidSelfTestException; +import com.netscape.certsrv.selftests.EMissingSelfTestException; +import com.netscape.certsrv.selftests.ESelfTestException; +import com.netscape.certsrv.selftests.ISelfTestSubsystem; +import com.netscape.cms.selftests.ASelfTest; + +////////////////////// +// class definition // +////////////////////// + +/** + * This class implements a self test to check the validity of the CA. + *

+ * + * @author mharmsen + * @author thomask + * @version $Revision$, $Date$ + */ +public class CAValidity + extends ASelfTest { + //////////////////////// + // default parameters // + //////////////////////// + + /////////////////////////// + // CAValidity parameters // + /////////////////////////// + + // parameter information + public static final String PROP_CA_SUB_ID = "CaSubId"; + private String mCaSubId = null; + + ///////////////////// + // default methods // + ///////////////////// + + //////////////////////// + // CAValidity methods // + //////////////////////// + + /** + * Initializes this subsystem with the configuration store + * associated with this instance name. + *

+ * + * @param subsystem the associated subsystem + * @param instanceName the name of this self test instance + * @param parameters configuration store (self test parameters) + * @exception EDuplicateSelfTestException subsystem has duplicate name/value + * @exception EInvalidSelfTestException subsystem has invalid name/value + * @exception EMissingSelfTestException subsystem has missing name/value + */ + public void initSelfTest(ISelfTestSubsystem subsystem, + String instanceName, + IConfigStore parameters) + throws EDuplicateSelfTestException, + EInvalidSelfTestException, + EMissingSelfTestException { + super.initSelfTest(subsystem, instanceName, parameters); + + // retrieve mandatory parameter(s) + try { + mCaSubId = mConfig.getString(PROP_CA_SUB_ID); + if (mCaSubId != null) { + mCaSubId = mCaSubId.trim(); + } else { + mSelfTestSubsystem.log(mSelfTestSubsystem.getSelfTestLogger(), + CMS.getLogMessage( + "SELFTESTS_MISSING_VALUES", + getSelfTestName(), + mPrefix + + "." + + PROP_CA_SUB_ID)); + + throw new EMissingSelfTestException(PROP_CA_SUB_ID); + } + } catch (EBaseException e) { + mSelfTestSubsystem.log(mSelfTestSubsystem.getSelfTestLogger(), + CMS.getLogMessage( + "SELFTESTS_MISSING_NAME", + getSelfTestName(), + mPrefix + + "." + + PROP_CA_SUB_ID)); + + throw new EMissingSelfTestException(mPrefix, + PROP_CA_SUB_ID, + null); + } + + // retrieve optional parameter(s) + + return; + } + + /** + * Notifies this subsystem if it is in execution mode. + *

+ * + * @exception ESelfTestException failed to start + */ + public void startupSelfTest() + throws ESelfTestException { + return; + } + + /** + * Stops this subsystem. The subsystem may call shutdownSelfTest + * anytime after initialization. + *

+ */ + public void shutdownSelfTest() { + return; + } + + /** + * Returns the name associated with this self test. This method may + * return null if the self test has not been intialized. + *

+ * + * @return instanceName of this self test + */ + public String getSelfTestName() { + return super.getSelfTestName(); + } + + /** + * Returns the root configuration storage (self test parameters) + * associated with this subsystem. + *

+ * + * @return configuration store (self test parameters) of this subsystem + */ + public IConfigStore getSelfTestConfigStore() { + return super.getSelfTestConfigStore(); + } + + /** + * Retrieves description associated with an individual self test. + * This method may return null. + *

+ * + * @param locale locale of the client that requests the description + * @return description of self test + */ + public String getSelfTestDescription(Locale locale) { + return CMS.getUserMessage(locale, + "CMS_SELFTESTS_CA_VALIDITY_DESCRIPTION"); + } + + /** + * Execute an individual self test. + *

+ * + * @param logger specifies logging subsystem + * @exception ESelfTestException self test exception + */ + public void runSelfTest(ILogEventListener logger) + throws ESelfTestException { + String logMessage = null; + ICertificateAuthority ca = null; + X509CertImpl caCert = null; + + ca = (ICertificateAuthority) CMS.getSubsystem(mCaSubId); + + if (ca == null) { + // log that the CA is not installed + logMessage = CMS.getLogMessage("SELFTESTS_CA_IS_NOT_PRESENT", + getSelfTestName()); + + mSelfTestSubsystem.log(logger, + logMessage); + + throw new ESelfTestException(logMessage); + } else { + // Retrieve the CA certificate + caCert = ca.getCACert(); + + if (caCert == null) { + // log that the CA is not yet initialized + logMessage = CMS.getLogMessage( + "SELFTESTS_CA_IS_NOT_INITIALIZED", + getSelfTestName()); + + mSelfTestSubsystem.log(logger, + logMessage); + + throw new ESelfTestException(logMessage); + } + + // Retrieve the CA validity period + try { + caCert.checkValidity(); + } catch (CertificateNotYetValidException e) { + // log that the CA is not yet valid + logMessage = CMS.getLogMessage("SELFTESTS_CA_IS_NOT_YET_VALID", + getSelfTestName()); + + mSelfTestSubsystem.log(logger, + logMessage); + + throw new ESelfTestException(logMessage); + } catch (CertificateExpiredException e) { + // log that the CA is expired + logMessage = CMS.getLogMessage("SELFTESTS_CA_IS_EXPIRED", + getSelfTestName()); + + mSelfTestSubsystem.log(logger, + logMessage); + + throw new ESelfTestException(logMessage); + } + + // log that the CA is valid + logMessage = CMS.getLogMessage("SELFTESTS_CA_IS_VALID", + getSelfTestName()); + + mSelfTestSubsystem.log(logger, + logMessage); + } + + return; + } +} diff --git a/base/common/src/com/netscape/cms/selftests/common/SystemCertsVerification.java b/base/common/src/com/netscape/cms/selftests/common/SystemCertsVerification.java new file mode 100644 index 000000000..57afffdf2 --- /dev/null +++ b/base/common/src/com/netscape/cms/selftests/common/SystemCertsVerification.java @@ -0,0 +1,213 @@ +// --- BEGIN COPYRIGHT BLOCK --- +// This program is free software; you can redistribute it and/or modify +// it under the terms of the GNU General Public License as published by +// the Free Software Foundation; version 2 of the License. +// +// This program is distributed in the hope that it will be useful, +// but WITHOUT ANY WARRANTY; without even the implied warranty of +// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +// GNU General Public License for more details. +// +// You should have received a copy of the GNU General Public License along +// with this program; if not, write to the Free Software Foundation, Inc., +// 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. +// +// (C) 2010 Red Hat, Inc. +// All rights reserved. +// --- END COPYRIGHT BLOCK --- +// package statement // +/////////////////////// + +package com.netscape.cms.selftests.common; + +/////////////////////// +// import statements // +/////////////////////// + +import java.util.Locale; + +import com.netscape.certsrv.apps.CMS; +import com.netscape.certsrv.base.EBaseException; +import com.netscape.certsrv.base.IConfigStore; +import com.netscape.certsrv.logging.ILogEventListener; +import com.netscape.certsrv.selftests.EDuplicateSelfTestException; +import com.netscape.certsrv.selftests.EInvalidSelfTestException; +import com.netscape.certsrv.selftests.EMissingSelfTestException; +import com.netscape.certsrv.selftests.ESelfTestException; +import com.netscape.certsrv.selftests.ISelfTestSubsystem; +import com.netscape.cms.selftests.ASelfTest; + +////////////////////// +// class definition // +////////////////////// + +/** + * This class implements a self test to check the system certs + * of the subsystem + *

+ * + * @version $Revision: $, $Date: $ + */ +public class SystemCertsVerification + extends ASelfTest { + //////////////////////// + // default parameters // + //////////////////////// + + /////////////////////////// + // SystemCertsVerification parameters // + /////////////////////////// + + // parameter information + public static final String PROP_SUB_ID = "SubId"; + private String mSubId = null; + + ///////////////////// + // default methods // + ///////////////////// + + //////////////////////// + // SystemCertsVerification methods // + //////////////////////// + + /** + * Initializes this subsystem with the configuration store + * associated with this instance name. + *

+ * + * @param subsystem the associated subsystem + * @param instanceName the name of this self test instance + * @param parameters configuration store (self test parameters) + * @exception EDuplicateSelfTestException subsystem has duplicate name/value + * @exception EInvalidSelfTestException subsystem has invalid name/value + * @exception EMissingSelfTestException subsystem has missing name/value + */ + public void initSelfTest(ISelfTestSubsystem subsystem, + String instanceName, + IConfigStore parameters) + throws EDuplicateSelfTestException, + EInvalidSelfTestException, + EMissingSelfTestException { + super.initSelfTest(subsystem, instanceName, parameters); + + // retrieve mandatory parameter(s) + try { + mSubId = mConfig.getString(PROP_SUB_ID); + if (mSubId != null) { + mSubId = mSubId.trim(); + } else { + mSelfTestSubsystem.log(mSelfTestSubsystem.getSelfTestLogger(), + CMS.getLogMessage( + "SELFTESTS_MISSING_VALUES", + getSelfTestName(), + mPrefix + + "." + + PROP_SUB_ID)); + + throw new EMissingSelfTestException(PROP_SUB_ID); + } + } catch (EBaseException e) { + mSelfTestSubsystem.log(mSelfTestSubsystem.getSelfTestLogger(), + CMS.getLogMessage( + "SELFTESTS_MISSING_NAME", + getSelfTestName(), + mPrefix + + "." + + PROP_SUB_ID)); + + throw new EMissingSelfTestException(mPrefix, + PROP_SUB_ID, + null); + } + + // retrieve optional parameter(s) + + return; + } + + /** + * Notifies this subsystem if it is in execution mode. + *

+ * + * @exception ESelfTestException failed to start + */ + public void startupSelfTest() + throws ESelfTestException { + return; + } + + /** + * Stops this subsystem. The subsystem may call shutdownSelfTest + * anytime after initialization. + *

+ */ + public void shutdownSelfTest() { + return; + } + + /** + * Returns the name associated with this self test. This method may + * return null if the self test has not been intialized. + *

+ * + * @return instanceName of this self test + */ + public String getSelfTestName() { + return super.getSelfTestName(); + } + + /** + * Returns the root configuration storage (self test parameters) + * associated with this subsystem. + *

+ * + * @return configuration store (self test parameters) of this subsystem + */ + public IConfigStore getSelfTestConfigStore() { + return super.getSelfTestConfigStore(); + } + + /** + * Retrieves description associated with an individual self test. + * This method may return null. + *

+ * + * @param locale locale of the client that requests the description + * @return description of self test + */ + public String getSelfTestDescription(Locale locale) { + return CMS.getUserMessage(locale, + "CMS_SELFTESTS_SYSTEM_CERTS_VERIFICATION_DESCRIPTION"); + } + + /** + * Execute an individual self test. + *

+ * + * @param logger specifies logging subsystem + * @exception ESelfTestException self test exception + */ + public void runSelfTest(ILogEventListener logger) + throws ESelfTestException { + String logMessage = null; + boolean rc = false; + + rc = CMS.verifySystemCerts(); + if (rc == true) { + logMessage = CMS.getLogMessage("SELFTESTS_COMMON_SYSTEM_CERTS_VERIFICATION_SUCCESS", + getSelfTestName()); + + mSelfTestSubsystem.log(logger, + logMessage); + } else { + logMessage = CMS.getLogMessage("SELFTESTS_COMMON_SYSTEM_CERTS_VERIFICATION_FAILURE", + getSelfTestName()); + + mSelfTestSubsystem.log(logger, + logMessage); + throw new ESelfTestException(logMessage); + } + + return; + } +} diff --git a/base/common/src/com/netscape/cms/selftests/kra/KRAPresence.java b/base/common/src/com/netscape/cms/selftests/kra/KRAPresence.java new file mode 100644 index 000000000..01f5609bf --- /dev/null +++ b/base/common/src/com/netscape/cms/selftests/kra/KRAPresence.java @@ -0,0 +1,251 @@ +// --- BEGIN COPYRIGHT BLOCK --- +// This program is free software; you can redistribute it and/or modify +// it under the terms of the GNU General Public License as published by +// the Free Software Foundation; version 2 of the License. +// +// This program is distributed in the hope that it will be useful, +// but WITHOUT ANY WARRANTY; without even the implied warranty of +// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +// GNU General Public License for more details. +// +// You should have received a copy of the GNU General Public License along +// with this program; if not, write to the Free Software Foundation, Inc., +// 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. +// +// (C) 2007 Red Hat, Inc. +// All rights reserved. +// --- END COPYRIGHT BLOCK --- +// package statement // +/////////////////////// + +package com.netscape.cms.selftests.kra; + +/////////////////////// +// import statements // +/////////////////////// + +import java.security.PublicKey; +import java.util.Locale; + +import com.netscape.certsrv.apps.CMS; +import com.netscape.certsrv.base.EBaseException; +import com.netscape.certsrv.base.IConfigStore; +import com.netscape.certsrv.kra.IKeyRecoveryAuthority; +import com.netscape.certsrv.logging.ILogEventListener; +import com.netscape.certsrv.selftests.EDuplicateSelfTestException; +import com.netscape.certsrv.selftests.EInvalidSelfTestException; +import com.netscape.certsrv.selftests.EMissingSelfTestException; +import com.netscape.certsrv.selftests.ESelfTestException; +import com.netscape.certsrv.selftests.ISelfTestSubsystem; +import com.netscape.cms.selftests.ASelfTest; + +////////////////////// +// class definition // +////////////////////// + +/** + * This class implements a self test to check for KRA presence. + *

+ * + * @author mharmsen + * @author thomask + * @version $Revision$, $Date$ + */ +public class KRAPresence + extends ASelfTest { + //////////////////////// + // default parameters // + //////////////////////// + + /////////////////////////// + // KRAPresence parameters // + /////////////////////////// + + // parameter information + public static final String PROP_KRA_SUB_ID = "SubId"; + private String mSubId = null; + + ///////////////////// + // default methods // + ///////////////////// + + //////////////////////// + // KRAPresence methods // + //////////////////////// + + /** + * Initializes this subsystem with the configuration store + * associated with this instance name. + *

+ * + * @param subsystem the associated subsystem + * @param instanceName the name of this self test instance + * @param parameters configuration store (self test parameters) + * @exception EDuplicateSelfTestException subsystem has duplicate name/value + * @exception EInvalidSelfTestException subsystem has invalid name/value + * @exception EMissingSelfTestException subsystem has missing name/value + */ + public void initSelfTest(ISelfTestSubsystem subsystem, + String instanceName, + IConfigStore parameters) + throws EDuplicateSelfTestException, + EInvalidSelfTestException, + EMissingSelfTestException { + super.initSelfTest(subsystem, instanceName, parameters); + + // retrieve mandatory parameter(s) + try { + mSubId = mConfig.getString(PROP_KRA_SUB_ID); + if (mSubId != null) { + mSubId = mSubId.trim(); + } else { + mSelfTestSubsystem.log(mSelfTestSubsystem.getSelfTestLogger(), + CMS.getLogMessage( + "SELFTESTS_MISSING_VALUES", + getSelfTestName(), + mPrefix + + "." + + PROP_KRA_SUB_ID)); + + throw new EMissingSelfTestException(PROP_KRA_SUB_ID); + } + } catch (EBaseException e) { + mSelfTestSubsystem.log(mSelfTestSubsystem.getSelfTestLogger(), + CMS.getLogMessage( + "SELFTESTS_MISSING_NAME", + getSelfTestName(), + mPrefix + + "." + + PROP_KRA_SUB_ID)); + + throw new EMissingSelfTestException(mPrefix, + PROP_KRA_SUB_ID, + null); + } + + // retrieve optional parameter(s) + + return; + } + + /** + * Notifies this subsystem if it is in execution mode. + *

+ * + * @exception ESelfTestException failed to start + */ + public void startupSelfTest() + throws ESelfTestException { + return; + } + + /** + * Stops this subsystem. The subsystem may call shutdownSelfTest + * anytime after initialization. + *

+ */ + public void shutdownSelfTest() { + return; + } + + /** + * Returns the name associated with this self test. This method may + * return null if the self test has not been intialized. + *

+ * + * @return instanceName of this self test + */ + public String getSelfTestName() { + return super.getSelfTestName(); + } + + /** + * Returns the root configuration storage (self test parameters) + * associated with this subsystem. + *

+ * + * @return configuration store (self test parameters) of this subsystem + */ + public IConfigStore getSelfTestConfigStore() { + return super.getSelfTestConfigStore(); + } + + /** + * Retrieves description associated with an individual self test. + * This method may return null. + *

+ * + * @param locale locale of the client that requests the description + * @return description of self test + */ + public String getSelfTestDescription(Locale locale) { + return CMS.getUserMessage(locale, + "CMS_SELFTESTS_KRA_PRESENCE_DESCRIPTION"); + } + + /** + * Execute an individual self test. + *

+ * + * @param logger specifies logging subsystem + * @exception ESelfTestException self test exception + */ + public void runSelfTest(ILogEventListener logger) + throws ESelfTestException { + String logMessage = null; + IKeyRecoveryAuthority kra = null; + org.mozilla.jss.crypto.X509Certificate kraCert = null; + PublicKey kraPubKey = null; + + kra = (IKeyRecoveryAuthority) CMS.getSubsystem(mSubId); + + if (kra == null) { + // log that the KRA is not installed + logMessage = CMS.getLogMessage("SELFTESTS_KRA_IS_NOT_PRESENT", + getSelfTestName()); + + mSelfTestSubsystem.log(logger, + logMessage); + + throw new ESelfTestException(logMessage); + } else { + // Retrieve the KRA certificate + kraCert = kra.getTransportCert(); + + if (kraCert == null) { + // log that the RA is not yet initialized + logMessage = CMS.getLogMessage( + "SELFTESTS_KRA_IS_NOT_INITIALIZED", + getSelfTestName()); + + mSelfTestSubsystem.log(logger, + logMessage); + + throw new ESelfTestException(logMessage); + } + + // Retrieve the KRA certificate public key + kraPubKey = (PublicKey) kraCert.getPublicKey(); + + if (kraPubKey == null) { + // log that something is seriously wrong with the KRA + logMessage = CMS.getLogMessage("SELFTESTS_KRA_IS_CORRUPT", + getSelfTestName()); + + mSelfTestSubsystem.log(logger, + logMessage); + + throw new ESelfTestException(logMessage); + } + + // log that the KRA is present + logMessage = CMS.getLogMessage("SELFTESTS_KRA_IS_PRESENT", + getSelfTestName()); + + mSelfTestSubsystem.log(logger, + logMessage); + } + + return; + } +} diff --git a/base/common/src/com/netscape/cms/selftests/ocsp/OCSPPresence.java b/base/common/src/com/netscape/cms/selftests/ocsp/OCSPPresence.java new file mode 100644 index 000000000..c862362a2 --- /dev/null +++ b/base/common/src/com/netscape/cms/selftests/ocsp/OCSPPresence.java @@ -0,0 +1,280 @@ +// --- BEGIN COPYRIGHT BLOCK --- +// This program is free software; you can redistribute it and/or modify +// it under the terms of the GNU General Public License as published by +// the Free Software Foundation; version 2 of the License. +// +// This program is distributed in the hope that it will be useful, +// but WITHOUT ANY WARRANTY; without even the implied warranty of +// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +// GNU General Public License for more details. +// +// You should have received a copy of the GNU General Public License along +// with this program; if not, write to the Free Software Foundation, Inc., +// 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. +// +// (C) 2007 Red Hat, Inc. +// All rights reserved. +// --- END COPYRIGHT BLOCK --- +// package statement // +/////////////////////// + +package com.netscape.cms.selftests.ocsp; + +/////////////////////// +// import statements // +/////////////////////// + +import java.security.cert.CertificateParsingException; +import java.util.Locale; + +import netscape.security.x509.X509CertImpl; +import netscape.security.x509.X509Key; + +import com.netscape.certsrv.apps.CMS; +import com.netscape.certsrv.base.EBaseException; +import com.netscape.certsrv.base.IConfigStore; +import com.netscape.certsrv.logging.ILogEventListener; +import com.netscape.certsrv.ocsp.IOCSPAuthority; +import com.netscape.certsrv.security.ISigningUnit; +import com.netscape.certsrv.selftests.EDuplicateSelfTestException; +import com.netscape.certsrv.selftests.EInvalidSelfTestException; +import com.netscape.certsrv.selftests.EMissingSelfTestException; +import com.netscape.certsrv.selftests.ESelfTestException; +import com.netscape.certsrv.selftests.ISelfTestSubsystem; +import com.netscape.cms.selftests.ASelfTest; + +////////////////////// +// class definition // +////////////////////// + +/** + * This class implements a self test to check for OCSP presence. + *

+ * + * @author mharmsen + * @author thomask + * @version $Revision$, $Date$ + */ +public class OCSPPresence + extends ASelfTest { + //////////////////////// + // default parameters // + //////////////////////// + + ///////////////////////////// + // OCSPPresence parameters // + ///////////////////////////// + + // parameter information + public static final String PROP_OCSP_SUB_ID = "OcspSubId"; + private String mOcspSubId = null; + + ///////////////////// + // default methods // + ///////////////////// + + ////////////////////////// + // OCSPPresence methods // + ////////////////////////// + + /** + * Initializes this subsystem with the configuration store + * associated with this instance name. + *

+ * + * @param subsystem the associated subsystem + * @param instanceName the name of this self test instance + * @param parameters configuration store (self test parameters) + * @exception EDuplicateSelfTestException subsystem has duplicate name/value + * @exception EInvalidSelfTestException subsystem has invalid name/value + * @exception EMissingSelfTestException subsystem has missing name/value + */ + public void initSelfTest(ISelfTestSubsystem subsystem, + String instanceName, + IConfigStore parameters) + throws EDuplicateSelfTestException, + EInvalidSelfTestException, + EMissingSelfTestException { + super.initSelfTest(subsystem, instanceName, parameters); + + // retrieve mandatory parameter(s) + try { + mOcspSubId = mConfig.getString(PROP_OCSP_SUB_ID); + if (mOcspSubId != null) { + mOcspSubId = mOcspSubId.trim(); + } else { + mSelfTestSubsystem.log(mSelfTestSubsystem.getSelfTestLogger(), + CMS.getLogMessage( + "SELFTESTS_MISSING_VALUES", + getSelfTestName(), + mPrefix + + "." + + PROP_OCSP_SUB_ID)); + + throw new EMissingSelfTestException(PROP_OCSP_SUB_ID); + } + } catch (EBaseException e) { + mSelfTestSubsystem.log(mSelfTestSubsystem.getSelfTestLogger(), + CMS.getLogMessage( + "SELFTESTS_MISSING_NAME", + getSelfTestName(), + mPrefix + + "." + + PROP_OCSP_SUB_ID)); + + throw new EMissingSelfTestException(mPrefix, + PROP_OCSP_SUB_ID, + null); + } + + // retrieve optional parameter(s) + + return; + } + + /** + * Notifies this subsystem if it is in execution mode. + *

+ * + * @exception ESelfTestException failed to start + */ + public void startupSelfTest() + throws ESelfTestException { + return; + } + + /** + * Stops this subsystem. The subsystem may call shutdownSelfTest + * anytime after initialization. + *

+ */ + public void shutdownSelfTest() { + return; + } + + /** + * Returns the name associated with this self test. This method may + * return null if the self test has not been intialized. + *

+ * + * @return instanceName of this self test + */ + public String getSelfTestName() { + return super.getSelfTestName(); + } + + /** + * Returns the root configuration storage (self test parameters) + * associated with this subsystem. + *

+ * + * @return configuration store (self test parameters) of this subsystem + */ + public IConfigStore getSelfTestConfigStore() { + return super.getSelfTestConfigStore(); + } + + /** + * Retrieves description associated with an individual self test. + * This method may return null. + *

+ * + * @param locale locale of the client that requests the description + * @return description of self test + */ + public String getSelfTestDescription(Locale locale) { + return CMS.getUserMessage(locale, + "CMS_SELFTESTS_OCSP_PRESENCE_DESCRIPTION"); + } + + /** + * Execute an individual self test. + *

+ * + * @param logger specifies logging subsystem + * @exception ESelfTestException self test exception + */ + public void runSelfTest(ILogEventListener logger) + throws ESelfTestException { + String logMessage = null; + IOCSPAuthority ocsp = null; + ISigningUnit ocspSigningUnit = null; + X509CertImpl ocspCert = null; + X509Key ocspPubKey = null; + + ocsp = (IOCSPAuthority) CMS.getSubsystem(mOcspSubId); + + if (ocsp == null) { + // log that the OCSP is not installed + logMessage = CMS.getLogMessage("SELFTESTS_OCSP_IS_NOT_PRESENT", + getSelfTestName()); + + mSelfTestSubsystem.log(logger, + logMessage); + + throw new ESelfTestException(logMessage); + } else { + // Retrieve the OCSP signing unit + ocspSigningUnit = ocsp.getSigningUnit(); + + if (ocspSigningUnit == null) { + // log that the OCSP is not yet initialized + logMessage = CMS.getLogMessage( + "SELFTESTS_OCSP_IS_NOT_INITIALIZED", + getSelfTestName()); + + mSelfTestSubsystem.log(logger, + logMessage); + + throw new ESelfTestException(logMessage); + } + + // Retrieve the OCSP certificate + ocspCert = ocspSigningUnit.getCertImpl(); + + if (ocspCert == null) { + // log that the OCSP is not yet initialized + logMessage = CMS.getLogMessage( + "SELFTESTS_OCSP_IS_NOT_INITIALIZED", + getSelfTestName()); + + mSelfTestSubsystem.log(logger, + logMessage); + + throw new ESelfTestException(logMessage); + } + + // Retrieve the OCSP certificate public key + try { + ocspPubKey = (X509Key) + ocspCert.get(X509CertImpl.PUBLIC_KEY); + + if (ocspPubKey == null) { + // log that something is seriously wrong with the OCSP + logMessage = CMS.getLogMessage("SELFTESTS_OCSP_IS_CORRUPT", + getSelfTestName()); + + mSelfTestSubsystem.log(logger, + logMessage); + + throw new ESelfTestException(logMessage); + } + } catch (CertificateParsingException e) { + // log that something is seriously wrong with the OCSP + mSelfTestSubsystem.log(logger, + e.toString()); + + throw new ESelfTestException(e.toString()); + } + + // log that the OCSP is present + logMessage = CMS.getLogMessage("SELFTESTS_OCSP_IS_PRESENT", + getSelfTestName()); + + mSelfTestSubsystem.log(logger, + logMessage); + } + + return; + } +} diff --git a/base/common/src/com/netscape/cms/selftests/ocsp/OCSPValidity.java b/base/common/src/com/netscape/cms/selftests/ocsp/OCSPValidity.java new file mode 100644 index 000000000..478746827 --- /dev/null +++ b/base/common/src/com/netscape/cms/selftests/ocsp/OCSPValidity.java @@ -0,0 +1,280 @@ +// --- BEGIN COPYRIGHT BLOCK --- +// This program is free software; you can redistribute it and/or modify +// it under the terms of the GNU General Public License as published by +// the Free Software Foundation; version 2 of the License. +// +// This program is distributed in the hope that it will be useful, +// but WITHOUT ANY WARRANTY; without even the implied warranty of +// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +// GNU General Public License for more details. +// +// You should have received a copy of the GNU General Public License along +// with this program; if not, write to the Free Software Foundation, Inc., +// 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. +// +// (C) 2007 Red Hat, Inc. +// All rights reserved. +// --- END COPYRIGHT BLOCK --- +// package statement // +/////////////////////// + +package com.netscape.cms.selftests.ocsp; + +/////////////////////// +// import statements // +/////////////////////// + +import java.security.cert.CertificateExpiredException; +import java.security.cert.CertificateNotYetValidException; +import java.util.Locale; + +import netscape.security.x509.X509CertImpl; + +import com.netscape.certsrv.apps.CMS; +import com.netscape.certsrv.base.EBaseException; +import com.netscape.certsrv.base.IConfigStore; +import com.netscape.certsrv.logging.ILogEventListener; +import com.netscape.certsrv.ocsp.IOCSPAuthority; +import com.netscape.certsrv.security.ISigningUnit; +import com.netscape.certsrv.selftests.EDuplicateSelfTestException; +import com.netscape.certsrv.selftests.EInvalidSelfTestException; +import com.netscape.certsrv.selftests.EMissingSelfTestException; +import com.netscape.certsrv.selftests.ESelfTestException; +import com.netscape.certsrv.selftests.ISelfTestSubsystem; +import com.netscape.cms.selftests.ASelfTest; + +////////////////////// +// class definition // +////////////////////// + +/** + * This class implements a self test to check the validity of the OCSP. + *

+ * + * @author mharmsen + * @author thomask + * @version $Revision$, $Date$ + */ +public class OCSPValidity + extends ASelfTest { + //////////////////////// + // default parameters // + //////////////////////// + + ///////////////////////////// + // OCSPValidity parameters // + ///////////////////////////// + + // parameter information + public static final String PROP_OCSP_SUB_ID = "OcspSubId"; + private String mOcspSubId = null; + + ///////////////////// + // default methods // + ///////////////////// + + ////////////////////////// + // OCSPValidity methods // + ////////////////////////// + + /** + * Initializes this subsystem with the configuration store + * associated with this instance name. + *

+ * + * @param subsystem the associated subsystem + * @param instanceName the name of this self test instance + * @param parameters configuration store (self test parameters) + * @exception EDuplicateSelfTestException subsystem has duplicate name/value + * @exception EInvalidSelfTestException subsystem has invalid name/value + * @exception EMissingSelfTestException subsystem has missing name/value + */ + public void initSelfTest(ISelfTestSubsystem subsystem, + String instanceName, + IConfigStore parameters) + throws EDuplicateSelfTestException, + EInvalidSelfTestException, + EMissingSelfTestException { + super.initSelfTest(subsystem, instanceName, parameters); + + // retrieve mandatory parameter(s) + try { + mOcspSubId = mConfig.getString(PROP_OCSP_SUB_ID); + if (mOcspSubId != null) { + mOcspSubId = mOcspSubId.trim(); + } else { + mSelfTestSubsystem.log(mSelfTestSubsystem.getSelfTestLogger(), + CMS.getLogMessage( + "SELFTESTS_MISSING_VALUES", + getSelfTestName(), + mPrefix + + "." + + PROP_OCSP_SUB_ID)); + + throw new EMissingSelfTestException(PROP_OCSP_SUB_ID); + } + } catch (EBaseException e) { + mSelfTestSubsystem.log(mSelfTestSubsystem.getSelfTestLogger(), + CMS.getLogMessage( + "SELFTESTS_MISSING_NAME", + getSelfTestName(), + mPrefix + + "." + + PROP_OCSP_SUB_ID)); + + throw new EMissingSelfTestException(mPrefix, + PROP_OCSP_SUB_ID, + null); + } + + // retrieve optional parameter(s) + + return; + } + + /** + * Notifies this subsystem if it is in execution mode. + *

+ * + * @exception ESelfTestException failed to start + */ + public void startupSelfTest() + throws ESelfTestException { + return; + } + + /** + * Stops this subsystem. The subsystem may call shutdownSelfTest + * anytime after initialization. + *

+ */ + public void shutdownSelfTest() { + return; + } + + /** + * Returns the name associated with this self test. This method may + * return null if the self test has not been intialized. + *

+ * + * @return instanceName of this self test + */ + public String getSelfTestName() { + return super.getSelfTestName(); + } + + /** + * Returns the root configuration storage (self test parameters) + * associated with this subsystem. + *

+ * + * @return configuration store (self test parameters) of this subsystem + */ + public IConfigStore getSelfTestConfigStore() { + return super.getSelfTestConfigStore(); + } + + /** + * Retrieves description associated with an individual self test. + * This method may return null. + *

+ * + * @param locale locale of the client that requests the description + * @return description of self test + */ + public String getSelfTestDescription(Locale locale) { + return CMS.getUserMessage(locale, + "CMS_SELFTESTS_OCSP_VALIDITY_DESCRIPTION"); + } + + /** + * Execute an individual self test. + *

+ * + * @param logger specifies logging subsystem + * @exception ESelfTestException self test exception + */ + public void runSelfTest(ILogEventListener logger) + throws ESelfTestException { + String logMessage = null; + IOCSPAuthority ocsp = null; + ISigningUnit ocspSigningUnit = null; + X509CertImpl ocspCert = null; + + ocsp = (IOCSPAuthority) CMS.getSubsystem(mOcspSubId); + + if (ocsp == null) { + // log that the OCSP is not installed + logMessage = CMS.getLogMessage("SELFTESTS_OCSP_IS_NOT_PRESENT", + getSelfTestName()); + + mSelfTestSubsystem.log(logger, + logMessage); + + throw new ESelfTestException(logMessage); + } else { + // Retrieve the OCSP signing unit + ocspSigningUnit = ocsp.getSigningUnit(); + + if (ocspSigningUnit == null) { + // log that the OCSP is not yet initialized + logMessage = CMS.getLogMessage( + "SELFTESTS_OCSP_IS_NOT_INITIALIZED", + getSelfTestName()); + + mSelfTestSubsystem.log(logger, + logMessage); + + throw new ESelfTestException(logMessage); + } + + // Retrieve the OCSP certificate + ocspCert = ocspSigningUnit.getCertImpl(); + + if (ocspCert == null) { + // log that the OCSP is not yet initialized + logMessage = CMS.getLogMessage( + "SELFTESTS_OCSP_IS_NOT_INITIALIZED", + getSelfTestName()); + + mSelfTestSubsystem.log(logger, + logMessage); + + throw new ESelfTestException(logMessage); + } + + // Retrieve the OCSP validity period + try { + ocspCert.checkValidity(); + } catch (CertificateNotYetValidException e) { + // log that the OCSP is not yet valid + logMessage = CMS.getLogMessage( + "SELFTESTS_OCSP_IS_NOT_YET_VALID", + getSelfTestName()); + + mSelfTestSubsystem.log(logger, + logMessage); + + throw new ESelfTestException(logMessage); + } catch (CertificateExpiredException e) { + // log that the OCSP is expired + logMessage = CMS.getLogMessage("SELFTESTS_OCSP_IS_EXPIRED", + getSelfTestName()); + + mSelfTestSubsystem.log(logger, + logMessage); + + throw new ESelfTestException(logMessage); + } + + // log that the OCSP is valid + logMessage = CMS.getLogMessage("SELFTESTS_OCSP_IS_VALID", + getSelfTestName()); + + mSelfTestSubsystem.log(logger, + logMessage); + } + + return; + } +} diff --git a/base/common/src/com/netscape/cms/selftests/ra/RAPresence.java b/base/common/src/com/netscape/cms/selftests/ra/RAPresence.java new file mode 100644 index 000000000..9790bf619 --- /dev/null +++ b/base/common/src/com/netscape/cms/selftests/ra/RAPresence.java @@ -0,0 +1,261 @@ +// --- BEGIN COPYRIGHT BLOCK --- +// This program is free software; you can redistribute it and/or modify +// it under the terms of the GNU General Public License as published by +// the Free Software Foundation; version 2 of the License. +// +// This program is distributed in the hope that it will be useful, +// but WITHOUT ANY WARRANTY; without even the implied warranty of +// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +// GNU General Public License for more details. +// +// You should have received a copy of the GNU General Public License along +// with this program; if not, write to the Free Software Foundation, Inc., +// 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. +// +// (C) 2007 Red Hat, Inc. +// All rights reserved. +// --- END COPYRIGHT BLOCK --- +// package statement // +/////////////////////// + +package com.netscape.cms.selftests.ra; + +/////////////////////// +// import statements // +/////////////////////// + +import java.security.PublicKey; +import java.util.Locale; + +import com.netscape.certsrv.apps.CMS; +import com.netscape.certsrv.base.EBaseException; +import com.netscape.certsrv.base.IConfigStore; +import com.netscape.certsrv.logging.ILogEventListener; +import com.netscape.certsrv.ra.IRegistrationAuthority; +import com.netscape.certsrv.selftests.EDuplicateSelfTestException; +import com.netscape.certsrv.selftests.EInvalidSelfTestException; +import com.netscape.certsrv.selftests.EMissingSelfTestException; +import com.netscape.certsrv.selftests.ESelfTestException; +import com.netscape.certsrv.selftests.ISelfTestSubsystem; +import com.netscape.cms.selftests.ASelfTest; + +////////////////////// +// class definition // +////////////////////// + +/** + * This class implements a self test to check for RA presence. + *

+ * + * 

+ * NOTE:  This self-test is for Registration Authorities prior to
+ *        Netscape Certificate Management System 7.0.  It does NOT
+ *        apply to the Registration Authority found in
+ *        Red Hat Certificate System 7.3 or later (including
+ *        ALL versions of Dogtag Certificate System).
+ *
+ *

+ * + * @deprecated + * @author mharmsen + * @author thomask + * @version $Revision$, $Date$ + */ +public class RAPresence + extends ASelfTest { + //////////////////////// + // default parameters // + //////////////////////// + + /////////////////////////// + // RAPresence parameters // + /////////////////////////// + + // parameter information + public static final String PROP_RA_SUB_ID = "RaSubId"; + private String mRaSubId = null; + + ///////////////////// + // default methods // + ///////////////////// + + //////////////////////// + // RAPresence methods // + //////////////////////// + + /** + * Initializes this subsystem with the configuration store + * associated with this instance name. + *

+ * + * @param subsystem the associated subsystem + * @param instanceName the name of this self test instance + * @param parameters configuration store (self test parameters) + * @exception EDuplicateSelfTestException subsystem has duplicate name/value + * @exception EInvalidSelfTestException subsystem has invalid name/value + * @exception EMissingSelfTestException subsystem has missing name/value + */ + public void initSelfTest(ISelfTestSubsystem subsystem, + String instanceName, + IConfigStore parameters) + throws EDuplicateSelfTestException, + EInvalidSelfTestException, + EMissingSelfTestException { + super.initSelfTest(subsystem, instanceName, parameters); + + // retrieve mandatory parameter(s) + try { + mRaSubId = mConfig.getString(PROP_RA_SUB_ID); + if (mRaSubId != null) { + mRaSubId = mRaSubId.trim(); + } else { + mSelfTestSubsystem.log(mSelfTestSubsystem.getSelfTestLogger(), + CMS.getLogMessage( + "SELFTESTS_MISSING_VALUES", + getSelfTestName(), + mPrefix + + "." + + PROP_RA_SUB_ID)); + + throw new EMissingSelfTestException(PROP_RA_SUB_ID); + } + } catch (EBaseException e) { + mSelfTestSubsystem.log(mSelfTestSubsystem.getSelfTestLogger(), + CMS.getLogMessage( + "SELFTESTS_MISSING_NAME", + getSelfTestName(), + mPrefix + + "." + + PROP_RA_SUB_ID)); + + throw new EMissingSelfTestException(mPrefix, + PROP_RA_SUB_ID, + null); + } + + // retrieve optional parameter(s) + + return; + } + + /** + * Notifies this subsystem if it is in execution mode. + *

+ * + * @exception ESelfTestException failed to start + */ + public void startupSelfTest() + throws ESelfTestException { + return; + } + + /** + * Stops this subsystem. The subsystem may call shutdownSelfTest + * anytime after initialization. + *

+ */ + public void shutdownSelfTest() { + return; + } + + /** + * Returns the name associated with this self test. This method may + * return null if the self test has not been intialized. + *

+ * + * @return instanceName of this self test + */ + public String getSelfTestName() { + return super.getSelfTestName(); + } + + /** + * Returns the root configuration storage (self test parameters) + * associated with this subsystem. + *

+ * + * @return configuration store (self test parameters) of this subsystem + */ + public IConfigStore getSelfTestConfigStore() { + return super.getSelfTestConfigStore(); + } + + /** + * Retrieves description associated with an individual self test. + * This method may return null. + *

+ * + * @param locale locale of the client that requests the description + * @return description of self test + */ + public String getSelfTestDescription(Locale locale) { + return CMS.getUserMessage(locale, + "CMS_SELFTESTS_RA_PRESENCE_DESCRIPTION"); + } + + /** + * Execute an individual self test. + *

+ * + * @param logger specifies logging subsystem + * @exception ESelfTestException self test exception + */ + public void runSelfTest(ILogEventListener logger) + throws ESelfTestException { + String logMessage = null; + IRegistrationAuthority ra = null; + org.mozilla.jss.crypto.X509Certificate raCert = null; + PublicKey raPubKey = null; + + ra = (IRegistrationAuthority) CMS.getSubsystem(mRaSubId); + + if (ra == null) { + // log that the RA is not installed + logMessage = CMS.getLogMessage("SELFTESTS_RA_IS_NOT_PRESENT", + getSelfTestName()); + + mSelfTestSubsystem.log(logger, + logMessage); + + throw new ESelfTestException(logMessage); + } else { + // Retrieve the RA certificate + raCert = ra.getRACert(); + + if (raCert == null) { + // log that the RA is not yet initialized + logMessage = CMS.getLogMessage( + "SELFTESTS_RA_IS_NOT_INITIALIZED", + getSelfTestName()); + + mSelfTestSubsystem.log(logger, + logMessage); + + throw new ESelfTestException(logMessage); + } + + // Retrieve the RA certificate public key + raPubKey = (PublicKey) raCert.getPublicKey(); + + if (raPubKey == null) { + // log that something is seriously wrong with the RA + logMessage = CMS.getLogMessage("SELFTESTS_RA_IS_CORRUPT", + getSelfTestName()); + + mSelfTestSubsystem.log(logger, + logMessage); + + throw new ESelfTestException(logMessage); + } + + // log that the RA is present + logMessage = CMS.getLogMessage("SELFTESTS_RA_IS_PRESENT", + getSelfTestName()); + + mSelfTestSubsystem.log(logger, + logMessage); + } + + return; + } +} diff --git a/base/common/src/com/netscape/cms/selftests/tks/TKSKnownSessionKey.java b/base/common/src/com/netscape/cms/selftests/tks/TKSKnownSessionKey.java new file mode 100644 index 000000000..69edeb24f --- /dev/null +++ b/base/common/src/com/netscape/cms/selftests/tks/TKSKnownSessionKey.java @@ -0,0 +1,302 @@ +// --- BEGIN COPYRIGHT BLOCK --- +// This program is free software; you can redistribute it and/or modify +// it under the terms of the GNU General Public License as published by +// the Free Software Foundation; version 2 of the License. +// +// This program is distributed in the hope that it will be useful, +// but WITHOUT ANY WARRANTY; without even the implied warranty of +// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +// GNU General Public License for more details. +// +// You should have received a copy of the GNU General Public License along +// with this program; if not, write to the Free Software Foundation, Inc., +// 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. +// +// (C) 2007 Red Hat, Inc. +// All rights reserved. +// --- END COPYRIGHT BLOCK --- +// package statement // +/////////////////////// + +package com.netscape.cms.selftests.tks; + +/////////////////////// +// import statements // +/////////////////////// + +import java.util.Arrays; +import java.util.Locale; + +import com.netscape.certsrv.apps.CMS; +import com.netscape.certsrv.base.EBaseException; +import com.netscape.certsrv.base.IConfigStore; +import com.netscape.certsrv.base.ISubsystem; +import com.netscape.certsrv.logging.ILogEventListener; +import com.netscape.certsrv.selftests.EDuplicateSelfTestException; +import com.netscape.certsrv.selftests.EInvalidSelfTestException; +import com.netscape.certsrv.selftests.EMissingSelfTestException; +import com.netscape.certsrv.selftests.ESelfTestException; +import com.netscape.certsrv.selftests.ISelfTestSubsystem; +import com.netscape.cms.selftests.ASelfTest; +import com.netscape.symkey.SessionKey; + +////////////////////// +// class definition // +////////////////////// + +/** + * This class implements a self test to check for TKS known session key. + *

+ * + * @author mharmsen + * @author thomask + * @author awnuk + * @version $Revision$, $Date$ + */ +public class TKSKnownSessionKey + extends ASelfTest { + // parameter information + public static final String PROP_TKS_SUB_ID = "TksSubId"; + private String mTksSubId = null; + private String mToken = null; + private String mUseSoftToken = null; + private String mKeyName = null; + private byte[] mKeyInfo = null; + private byte[] mCardChallenge = null; + private byte[] mHostChallenge = null; + private byte[] mCUID = null; + private byte[] mMacKey = null; + private byte[] mSessionKey = null; + + /** + * Initializes this subsystem with the configuration store + * associated with this instance name. + *

+ * + * @param subsystem the associated subsystem + * @param instanceName the name of this self test instance + * @param parameters configuration store (self test parameters) + * @exception EDuplicateSelfTestException subsystem has duplicate name/value + * @exception EInvalidSelfTestException subsystem has invalid name/value + * @exception EMissingSelfTestException subsystem has missing name/value + */ + public void initSelfTest(ISelfTestSubsystem subsystem, + String instanceName, + IConfigStore parameters) + throws EDuplicateSelfTestException, + EInvalidSelfTestException, + EMissingSelfTestException { + ISubsystem tks = null; + IConfigStore tksConfig = null; + + super.initSelfTest(subsystem, instanceName, parameters); + + mTksSubId = getConfigString(PROP_TKS_SUB_ID); + mToken = getConfigString("token"); + mKeyName = getConfigString("keyName"); + mCardChallenge = getConfigByteArray("cardChallenge", 8); + mHostChallenge = getConfigByteArray("hostChallenge", 8); + mKeyInfo = getConfigByteArray("keyName", 2); + mCUID = getConfigByteArray("CUID", 10); + mMacKey = getConfigByteArray("macKey", 16); + mUseSoftToken = getConfigString("useSoftToken"); + + String defKeySetMacKey = null; + tks = (ISubsystem) CMS.getSubsystem(mTksSubId); + if (tks != null) { + tksConfig = tks.getConfigStore(); + if (tksConfig != null) { + try { + defKeySetMacKey = tksConfig.getString("defKeySet.mac_key"); + byte defMacKey[] = com.netscape.cmsutil.util.Utils.SpecialDecode(defKeySetMacKey); + if (!Arrays.equals(mMacKey, defMacKey)) { + defKeySetMacKey = null; + } + } catch (EBaseException e) { + defKeySetMacKey = null; + } + } + } + if (defKeySetMacKey == null) { + CMS.debug("TKSKnownSessionKey: invalid mac key"); + CMS.debug("TKSKnownSessionKey self test FAILED"); + mSelfTestSubsystem.log(mSelfTestSubsystem.getSelfTestLogger(), + CMS.getLogMessage("SELFTESTS_INVALID_VALUES", + getSelfTestName(), mPrefix + "." + "macKey")); + throw new EInvalidSelfTestException(mPrefix, "macKey", null); + } + + try { + mSessionKey = getConfigByteArray("sessionKey", 16); + } catch (EMissingSelfTestException e) { + if (mSessionKey == null) { + mSessionKey = SessionKey.ComputeSessionKey(mToken, mKeyName, + mCardChallenge, mHostChallenge, + mKeyInfo, mCUID, mMacKey, mUseSoftToken, null, null); + if (mSessionKey == null || mSessionKey.length != 16) { + mSelfTestSubsystem.log(mSelfTestSubsystem.getSelfTestLogger(), + CMS.getLogMessage("SELFTESTS_MISSING_VALUES", + getSelfTestName(), mPrefix + ".sessionKey")); + throw new EMissingSelfTestException("sessionKey"); + } + String sessionKey = SpecialEncode(mSessionKey); + mConfig.putString("sessionKey", sessionKey); + try { + CMS.getConfigStore().commit(true); + } catch (EBaseException be) { + mSelfTestSubsystem.log(mSelfTestSubsystem.getSelfTestLogger(), + CMS.getLogMessage("SELFTESTS_MISSING_VALUES", + getSelfTestName(), mPrefix + ".sessionKey")); + throw new EMissingSelfTestException("sessionKey"); + } + } + } + + return; + } + + private String SpecialEncode(byte data[]) { + StringBuffer sb = new StringBuffer(); + + for (int i = 0; i < data.length; i++) { + sb.append("#"); + if ((data[i] & 0xff) < 16) { + sb.append("0"); + } + sb.append(Integer.toHexString((data[i] & 0xff))); + } + + return sb.toString(); + } + + private String getConfigString(String name) throws EMissingSelfTestException { + String value = null; + + try { + value = mConfig.getString(name); + if (value != null) { + value = value.trim(); + } else { + mSelfTestSubsystem.log(mSelfTestSubsystem.getSelfTestLogger(), + CMS.getLogMessage("SELFTESTS_MISSING_VALUES", + getSelfTestName(), mPrefix + "." + name)); + throw new EMissingSelfTestException(name); + } + } catch (EBaseException e) { + mSelfTestSubsystem.log(mSelfTestSubsystem.getSelfTestLogger(), + CMS.getLogMessage("SELFTESTS_MISSING_NAME", + getSelfTestName(), mPrefix + "." + name)); + throw new EMissingSelfTestException(mPrefix, name, null); + } + + return value; + } + + private byte[] getConfigByteArray(String name, int size) throws EMissingSelfTestException, + EInvalidSelfTestException { + String stringValue = getConfigString(name); + + byte byteValue[] = com.netscape.cmsutil.util.Utils.SpecialDecode(stringValue); + if (byteValue == null) { + mSelfTestSubsystem.log(mSelfTestSubsystem.getSelfTestLogger(), + CMS.getLogMessage("SELFTESTS_MISSING_NAME", + getSelfTestName(), mPrefix + "." + name)); + throw new EMissingSelfTestException(name); + } + if (byteValue.length != size) { + mSelfTestSubsystem.log(mSelfTestSubsystem.getSelfTestLogger(), + CMS.getLogMessage("SELFTESTS_INVALID_VALUES", + getSelfTestName(), mPrefix + "." + name)); + throw new EInvalidSelfTestException(mPrefix, name, stringValue); + } + + return byteValue; + } + + /** + * Notifies this subsystem if it is in execution mode. + *

+ * + * @exception ESelfTestException failed to start + */ + public void startupSelfTest() + throws ESelfTestException { + return; + } + + /** + * Stops this subsystem. The subsystem may call shutdownSelfTest + * anytime after initialization. + *

+ */ + public void shutdownSelfTest() { + return; + } + + /** + * Returns the name associated with this self test. This method may + * return null if the self test has not been intialized. + *

+ * + * @return instanceName of this self test + */ + public String getSelfTestName() { + return super.getSelfTestName(); + } + + /** + * Returns the root configuration storage (self test parameters) + * associated with this subsystem. + *

+ * + * @return configuration store (self test parameters) of this subsystem + */ + public IConfigStore getSelfTestConfigStore() { + return super.getSelfTestConfigStore(); + } + + /** + * Retrieves description associated with an individual self test. + * This method may return null. + *

+ * + * @param locale locale of the client that requests the description + * @return description of self test + */ + public String getSelfTestDescription(Locale locale) { + return CMS.getUserMessage(locale, "CMS_SELFTESTS_TKS_PRESENCE_DESCRIPTION"); + } + + /** + * Execute an individual self test. + *

+ * + * @param logger specifies logging subsystem + * @exception ESelfTestException self test exception + */ + public void runSelfTest(ILogEventListener logger) + throws ESelfTestException { + String logMessage = null; + String keySet = "defKeySet"; + + byte[] sessionKey = SessionKey.ComputeSessionKey(mToken, mKeyName, + mCardChallenge, mHostChallenge, + mKeyInfo, mCUID, mMacKey, mUseSoftToken, keySet, null); + + // Now we just see if we can successfully generate a session key. + // For FIPS compliance, the routine now returns a wrapped key, which can't be extracted and compared. + if (sessionKey == null) { + CMS.debug("TKSKnownSessionKey: generated no session key"); + CMS.debug("TKSKnownSessionKey self test FAILED"); + logMessage = CMS.getLogMessage("SELFTESTS_TKS_FAILED", getSelfTestName(), getSelfTestName()); + mSelfTestSubsystem.log(logger, logMessage); + throw new ESelfTestException(logMessage); + } else { + logMessage = CMS.getLogMessage("SELFTESTS_TKS_SUCCEEDED", getSelfTestName(), getSelfTestName()); + mSelfTestSubsystem.log(logger, logMessage); + CMS.debug("TKSKnownSessionKey self test SUCCEEDED"); + } + + return; + } +} -- cgit