summaryrefslogtreecommitdiffstats
path: root/pki/base/common/src/com/netscape/cms/publish/publishers/LdapCrlPublisher.java
diff options
context:
space:
mode:
Diffstat (limited to 'pki/base/common/src/com/netscape/cms/publish/publishers/LdapCrlPublisher.java')
-rw-r--r--pki/base/common/src/com/netscape/cms/publish/publishers/LdapCrlPublisher.java226
1 files changed, 124 insertions, 102 deletions
diff --git a/pki/base/common/src/com/netscape/cms/publish/publishers/LdapCrlPublisher.java b/pki/base/common/src/com/netscape/cms/publish/publishers/LdapCrlPublisher.java
index 22dc1294..e6a4e45c 100644
--- a/pki/base/common/src/com/netscape/cms/publish/publishers/LdapCrlPublisher.java
+++ b/pki/base/common/src/com/netscape/cms/publish/publishers/LdapCrlPublisher.java
@@ -17,7 +17,6 @@
// --- END COPYRIGHT BLOCK ---
package com.netscape.cms.publish.publishers;
-
import java.security.cert.CRLException;
import java.security.cert.X509CRL;
import java.util.Locale;
@@ -42,10 +41,9 @@ import com.netscape.certsrv.ldap.ELdapServerDownException;
import com.netscape.certsrv.logging.ILogger;
import com.netscape.certsrv.publish.ILdapPublisher;
-
/**
- * For publishing master or global CRL.
- * Publishes (replaces) the CRL in the CA's LDAP entry.
+ * For publishing master or global CRL. Publishes (replaces) the CRL in the CA's
+ * LDAP entry.
*
* @version $Revision$, $Date$
*/
@@ -81,16 +79,15 @@ public class LdapCrlPublisher implements ILdapPublisher, IExtendedPluginInfo {
public String[] getExtendedPluginInfo(Locale locale) {
String[] params = {
"crlAttr;string;Name of Ldap attribute in which to store the CRL",
- "crlObjectClass;string;The name of the objectclasses which should be " +
- "added to this entry, if they do not already exist. This can be a comma-" +
- "separated list such as 'certificationAuthority,certificationAuthority-V2' " +
- "(if using RFC 2256) or 'pkiCA, deltaCRL' (if using RFC 4523)",
- IExtendedPluginInfo.HELP_TOKEN +
- ";configuration-ldappublish-publisher-crlpublisher",
- IExtendedPluginInfo.HELP_TEXT +
- ";This plugin knows how to publish CRL's to " +
- "'certificateAuthority' and 'pkiCA' -type entries"
- };
+ "crlObjectClass;string;The name of the objectclasses which should be "
+ + "added to this entry, if they do not already exist. This can be a comma-"
+ + "separated list such as 'certificationAuthority,certificationAuthority-V2' "
+ + "(if using RFC 2256) or 'pkiCA, deltaCRL' (if using RFC 4523)",
+ IExtendedPluginInfo.HELP_TOKEN
+ + ";configuration-ldappublish-publisher-crlpublisher",
+ IExtendedPluginInfo.HELP_TEXT
+ + ";This plugin knows how to publish CRL's to "
+ + "'certificateAuthority' and 'pkiCA' -type entries" };
return params;
}
@@ -115,14 +112,13 @@ public class LdapCrlPublisher implements ILdapPublisher, IExtendedPluginInfo {
return mConfig;
}
- public void init(IConfigStore config)
- throws EBaseException {
+ public void init(IConfigStore config) throws EBaseException {
if (mInited)
return;
mConfig = config;
mCrlAttr = mConfig.getString("crlAttr", LDAP_CRL_ATTR);
mCrlObjectClass = mConfig.getString("crlObjectClass",
- LDAP_CRL_OBJECTCLASS);
+ LDAP_CRL_OBJECTCLASS);
mObjAdded = mConfig.getString("crlObjectClassAdded", "");
mObjDeleted = mConfig.getString("crlObjectClassDeleted", "");
@@ -142,11 +138,11 @@ public class LdapCrlPublisher implements ILdapPublisher, IExtendedPluginInfo {
}
/**
- * Replaces the CRL in the certificateRevocationList attribute.
- * CRL's are published as a DER encoded blob.
+ * Replaces the CRL in the certificateRevocationList attribute. CRL's are
+ * published as a DER encoded blob.
*/
public void publish(LDAPConnection conn, String dn, Object crlObj)
- throws ELdapException {
+ throws ELdapException {
if (conn == null) {
log(ILogger.LL_INFO, "publish CRL: no LDAP connection");
return;
@@ -154,7 +150,8 @@ public class LdapCrlPublisher implements ILdapPublisher, IExtendedPluginInfo {
try {
mCrlAttr = mConfig.getString("crlAttr", LDAP_CRL_ATTR);
- mCrlObjectClass = mConfig.getString("crlObjectClass", LDAP_CRL_OBJECTCLASS);
+ mCrlObjectClass = mConfig.getString("crlObjectClass",
+ LDAP_CRL_OBJECTCLASS);
} catch (EBaseException e) {
}
@@ -162,28 +159,29 @@ public class LdapCrlPublisher implements ILdapPublisher, IExtendedPluginInfo {
// see if we should create local connection
LDAPConnection altConn = null;
try {
- String host = mConfig.getString("host", null);
- String port = mConfig.getString("port", null);
- if (host != null && port != null) {
- int portVal = Integer.parseInt(port);
- int version = Integer.parseInt(mConfig.getString("version", "2"));
- String cert_nick = mConfig.getString("clientCertNickname", null);
- LDAPSSLSocketFactoryExt sslSocket = null;
- if (cert_nick != null) {
- sslSocket = CMS.getLdapJssSSLSocketFactory(cert_nick);
+ String host = mConfig.getString("host", null);
+ String port = mConfig.getString("port", null);
+ if (host != null && port != null) {
+ int portVal = Integer.parseInt(port);
+ int version = Integer.parseInt(mConfig
+ .getString("version", "2"));
+ String cert_nick = mConfig
+ .getString("clientCertNickname", null);
+ LDAPSSLSocketFactoryExt sslSocket = null;
+ if (cert_nick != null) {
+ sslSocket = CMS.getLdapJssSSLSocketFactory(cert_nick);
+ }
+ String mgr_dn = mConfig.getString("bindDN", null);
+ String mgr_pwd = mConfig.getString("bindPWD", null);
+
+ altConn = CMS.getBoundConnection(host, portVal, version,
+ sslSocket, mgr_dn, mgr_pwd);
+ conn = altConn;
}
- String mgr_dn = mConfig.getString("bindDN", null);
- String mgr_pwd = mConfig.getString("bindPWD", null);
-
- altConn = CMS.getBoundConnection(host, portVal,
- version,
- sslSocket, mgr_dn, mgr_pwd);
- conn = altConn;
- }
} catch (LDAPException e) {
- CMS.debug("Failed to create alt connection " + e);
+ CMS.debug("Failed to create alt connection " + e);
} catch (EBaseException e) {
- CMS.debug("Failed to create alt connection " + e);
+ CMS.debug("Failed to create alt connection " + e);
}
try {
@@ -194,10 +192,11 @@ public class LdapCrlPublisher implements ILdapPublisher, IExtendedPluginInfo {
LDAPSearchResults res = null;
if (mCrlAttr.equals(LDAP_CRL_ATTR)) {
res = conn.search(dn, LDAPv2.SCOPE_BASE, "(objectclass=*)",
- new String[] { LDAP_CACERT_ATTR, LDAP_ARL_ATTR }, true);
+ new String[] { LDAP_CACERT_ATTR, LDAP_ARL_ATTR }, true);
} else {
res = conn.search(dn, LDAPv2.SCOPE_BASE, "(objectclass=*)",
- new String[] { LDAP_CRL_ATTR, LDAP_CACERT_ATTR, LDAP_ARL_ATTR }, true);
+ new String[] { LDAP_CRL_ATTR, LDAP_CACERT_ATTR,
+ LDAP_ARL_ATTR }, true);
}
LDAPEntry entry = res.next();
@@ -216,50 +215,56 @@ public class LdapCrlPublisher implements ILdapPublisher, IExtendedPluginInfo {
String[] oclist = mCrlObjectClass.split(",");
boolean attrsAdded = false;
- for (int i=0; i < oclist.length; i++) {
+ for (int i = 0; i < oclist.length; i++) {
String oc = oclist[i].trim();
- boolean hasoc = LdapUserCertPublisher.StringValueExists(ocs, oc);
+ boolean hasoc = LdapUserCertPublisher
+ .StringValueExists(ocs, oc);
if (!hasoc) {
- log(ILogger.LL_INFO, "adding CRL objectclass " + oc + " to " + dn);
- modSet.add(LDAPModification.ADD,
- new LDAPAttribute("objectclass", oc));
+ log(ILogger.LL_INFO, "adding CRL objectclass " + oc
+ + " to " + dn);
+ modSet.add(LDAPModification.ADD, new LDAPAttribute(
+ "objectclass", oc));
- if ((!attrsAdded) && oc.equalsIgnoreCase("certificationAuthority")) {
+ if ((!attrsAdded)
+ && oc.equalsIgnoreCase("certificationAuthority")) {
// add MUST attributes
if (arls == null)
- modSet.add(LDAPModification.ADD,
- new LDAPAttribute(LDAP_ARL_ATTR, ""));
+ modSet.add(LDAPModification.ADD, new LDAPAttribute(
+ LDAP_ARL_ATTR, ""));
if (certs == null)
- modSet.add(LDAPModification.ADD,
- new LDAPAttribute(LDAP_CACERT_ATTR, ""));
+ modSet.add(LDAPModification.ADD, new LDAPAttribute(
+ LDAP_CACERT_ATTR, ""));
- if ((crls == null) && (!mCrlAttr.equals(LDAP_CRL_ATTR)))
- modSet.add(LDAPModification.ADD,
- new LDAPAttribute(LDAP_CRL_ATTR, ""));
+ if ((crls == null) && (!mCrlAttr.equals(LDAP_CRL_ATTR)))
+ modSet.add(LDAPModification.ADD, new LDAPAttribute(
+ LDAP_CRL_ATTR, ""));
attrsAdded = true;
}
}
}
- modSet.add(LDAPModification.REPLACE, new LDAPAttribute(mCrlAttr, crlEnc));
+ modSet.add(LDAPModification.REPLACE, new LDAPAttribute(mCrlAttr,
+ crlEnc));
// delete objectclasses that have been deleted from config
String[] delList = mObjDeleted.split(",");
if (delList.length > 0) {
- for (int i=0; i< delList.length; i++) {
+ for (int i = 0; i < delList.length; i++) {
String deloc = delList[i].trim();
- boolean hasoc = LdapUserCertPublisher.StringValueExists(ocs, deloc);
+ boolean hasoc = LdapUserCertPublisher.StringValueExists(
+ ocs, deloc);
boolean match = false;
- for (int j=0; j< oclist.length; j++) {
+ for (int j = 0; j < oclist.length; j++) {
if ((oclist[j].trim()).equals(deloc)) {
match = true;
break;
}
}
if (!match && hasoc) {
- log(ILogger.LL_INFO, "deleting CRL objectclass " + deloc + " from " + dn);
- modSet.add(LDAPModification.DELETE,
- new LDAPAttribute("objectclass", deloc));
+ log(ILogger.LL_INFO, "deleting CRL objectclass "
+ + deloc + " from " + dn);
+ modSet.add(LDAPModification.DELETE, new LDAPAttribute(
+ "objectclass", deloc));
}
}
}
@@ -273,56 +278,64 @@ public class LdapCrlPublisher implements ILdapPublisher, IExtendedPluginInfo {
try {
mConfig.commit(false);
} catch (Exception e) {
- log(ILogger.LL_INFO, "Failure in updating mObjAdded and mObjDeleted");
+ log(ILogger.LL_INFO,
+ "Failure in updating mObjAdded and mObjDeleted");
}
- }
+ }
conn.modify(dn, modSet);
} catch (CRLException e) {
- log(ILogger.LL_FAILURE, CMS.getLogMessage("PUBLISH_PUBLISH_ERROR", e.toString()));
- throw new ELdapException(CMS.getUserMessage("CMS_LDAP_PUBLISH_CRL_ERROR", e.toString()));
+ log(ILogger.LL_FAILURE,
+ CMS.getLogMessage("PUBLISH_PUBLISH_ERROR", e.toString()));
+ throw new ELdapException(CMS.getUserMessage(
+ "CMS_LDAP_PUBLISH_CRL_ERROR", e.toString()));
} catch (LDAPException e) {
if (e.getLDAPResultCode() == LDAPException.UNAVAILABLE) {
// need to intercept this because message from LDAP is
// "DSA is unavailable" which confuses with DSA PKI.
log(ILogger.LL_FAILURE,
- CMS.getLogMessage("PUBLISH_NO_LDAP_SERVER"));
- throw new ELdapServerDownException(CMS.getUserMessage("CMS_LDAP_SERVER_UNAVAILABLE", conn.getHost(), "" + conn.getPort()));
+ CMS.getLogMessage("PUBLISH_NO_LDAP_SERVER"));
+ throw new ELdapServerDownException(CMS.getUserMessage(
+ "CMS_LDAP_SERVER_UNAVAILABLE", conn.getHost(), ""
+ + conn.getPort()));
} else {
- log(ILogger.LL_FAILURE, CMS.getLogMessage("PUBLISH_PUBLISH_ERROR", e.toString()));
- throw new ELdapException(CMS.getUserMessage("CMS_LDAP_PUBLISH_CRL_ERROR", e.toString()));
+ log(ILogger.LL_FAILURE, CMS.getLogMessage(
+ "PUBLISH_PUBLISH_ERROR", e.toString()));
+ throw new ELdapException(CMS.getUserMessage(
+ "CMS_LDAP_PUBLISH_CRL_ERROR", e.toString()));
}
} finally {
- if (altConn != null) {
- try {
- altConn.disconnect();
- } catch (LDAPException e) {
- // safely ignored
- }
- }
+ if (altConn != null) {
+ try {
+ altConn.disconnect();
+ } catch (LDAPException e) {
+ // safely ignored
+ }
+ }
}
}
/**
- * There shouldn't be a need to call this.
- * CRLs are always replaced but this is implemented anyway in case
- * there is ever a reason to remove a global CRL.
+ * There shouldn't be a need to call this. CRLs are always replaced but this
+ * is implemented anyway in case there is ever a reason to remove a global
+ * CRL.
*/
public void unpublish(LDAPConnection conn, String dn, Object crlObj)
- throws ELdapException {
+ throws ELdapException {
try {
byte[] crlEnc = ((X509CRL) crlObj).getEncoded();
try {
mCrlAttr = mConfig.getString("crlAttr", LDAP_CRL_ATTR);
- mCrlObjectClass = mConfig.getString("crlObjectClass", LDAP_CRL_OBJECTCLASS);
+ mCrlObjectClass = mConfig.getString("crlObjectClass",
+ LDAP_CRL_OBJECTCLASS);
} catch (EBaseException e) {
}
-
LDAPSearchResults res = conn.search(dn, LDAPv2.SCOPE_BASE,
- "(objectclass=*)", new String[] { mCrlAttr, "objectclass" }, false);
+ "(objectclass=*)",
+ new String[] { mCrlAttr, "objectclass" }, false);
LDAPEntry e = res.next();
LDAPAttribute crls = e.getAttribute(mCrlAttr);
LDAPAttribute ocs = e.getAttribute("objectclass");
@@ -330,21 +343,23 @@ public class LdapCrlPublisher implements ILdapPublisher, IExtendedPluginInfo {
LDAPModificationSet modSet = new LDAPModificationSet();
boolean hasOC = false;
- boolean hasCRL =
- LdapUserCertPublisher.ByteValueExists(crls, crlEnc);
+ boolean hasCRL = LdapUserCertPublisher
+ .ByteValueExists(crls, crlEnc);
if (hasCRL) {
- modSet.add(LDAPModification.DELETE,
- new LDAPAttribute(mCrlAttr, crlEnc));
+ modSet.add(LDAPModification.DELETE, new LDAPAttribute(mCrlAttr,
+ crlEnc));
}
-
+
String[] oclist = mCrlObjectClass.split(",");
- for (int i=0; i < oclist.length; i++) {
+ for (int i = 0; i < oclist.length; i++) {
String oc = oclist[i].trim();
if (LdapUserCertPublisher.StringValueExists(ocs, oc)) {
- log(ILogger.LL_INFO, "unpublish: deleting CRL object class " + oc + " from " + dn);
- modSet.add(LDAPModification.DELETE,
- new LDAPAttribute("objectClass", oc));
+ log(ILogger.LL_INFO,
+ "unpublish: deleting CRL object class " + oc
+ + " from " + dn);
+ modSet.add(LDAPModification.DELETE, new LDAPAttribute(
+ "objectClass", oc));
hasOC = true;
}
}
@@ -352,22 +367,29 @@ public class LdapCrlPublisher implements ILdapPublisher, IExtendedPluginInfo {
if (hasCRL || hasOC) {
conn.modify(dn, modSet);
} else {
- log(ILogger.LL_INFO,
- "unpublish: " + dn + " already has not CRL");
+ log(ILogger.LL_INFO, "unpublish: " + dn
+ + " already has not CRL");
}
} catch (CRLException e) {
- log(ILogger.LL_FAILURE, CMS.getLogMessage("PUBLISH_UNPUBLISH_ERROR", e.toString()));
- throw new ELdapException(CMS.getUserMessage("CMS_LDAP_PUBLISH_CRL_ERROR", e.toString()));
+ log(ILogger.LL_FAILURE,
+ CMS.getLogMessage("PUBLISH_UNPUBLISH_ERROR", e.toString()));
+ throw new ELdapException(CMS.getUserMessage(
+ "CMS_LDAP_PUBLISH_CRL_ERROR", e.toString()));
} catch (LDAPException e) {
if (e.getLDAPResultCode() == LDAPException.UNAVAILABLE) {
// need to intercept this because message from LDAP is
// "DSA is unavailable" which confuses with DSA PKI.
log(ILogger.LL_FAILURE,
- CMS.getLogMessage("PUBLISH_NO_LDAP_SERVER"));
- throw new ELdapServerDownException(CMS.getUserMessage("CMS_LDAP_SERVER_UNAVAILABLE", conn.getHost(), "" + conn.getPort()));
+ CMS.getLogMessage("PUBLISH_NO_LDAP_SERVER"));
+ throw new ELdapServerDownException(CMS.getUserMessage(
+ "CMS_LDAP_SERVER_UNAVAILABLE", conn.getHost(), ""
+ + conn.getPort()));
} else {
- log(ILogger.LL_FAILURE, CMS.getLogMessage("PUBLISH_UNPUBLISH_ERROR", e.toString()));
- throw new ELdapException(CMS.getUserMessage("CMS_LDAP_UNPUBLISH_CRL_ERROR", e.toString()));
+ log(ILogger.LL_FAILURE,
+ CMS.getLogMessage("PUBLISH_UNPUBLISH_ERROR",
+ e.toString()));
+ throw new ELdapException(CMS.getUserMessage(
+ "CMS_LDAP_UNPUBLISH_CRL_ERROR", e.toString()));
}
}
return;
@@ -375,6 +397,6 @@ public class LdapCrlPublisher implements ILdapPublisher, IExtendedPluginInfo {
private void log(int level, String msg) {
mLogger.log(ILogger.EV_SYSTEM, ILogger.S_LDAP, level,
- "LdapCrlPublisher: " + msg);
+ "LdapCrlPublisher: " + msg);
}
}
generated by cgit (git 2.34.1) at 2024-05-05 10:46:56 +0000