1 package club.wpia.gigi.pages.account.certs;
3 import java.io.IOException;
4 import java.io.PrintWriter;
5 import java.math.BigInteger;
6 import java.net.URLEncoder;
7 import java.security.GeneralSecurityException;
8 import java.security.cert.X509Certificate;
9 import java.util.HashMap;
10 import java.util.List;
13 import javax.servlet.ServletOutputStream;
14 import javax.servlet.http.HttpServletRequest;
15 import javax.servlet.http.HttpServletResponse;
17 import club.wpia.gigi.GigiApiException;
18 import club.wpia.gigi.dbObjects.Certificate;
19 import club.wpia.gigi.dbObjects.Certificate.CertificateStatus;
20 import club.wpia.gigi.dbObjects.Certificate.SubjectAlternateName;
21 import club.wpia.gigi.dbObjects.CertificateOwner;
22 import club.wpia.gigi.dbObjects.Organisation;
23 import club.wpia.gigi.dbObjects.SupportedUser;
24 import club.wpia.gigi.dbObjects.User;
25 import club.wpia.gigi.localisation.Language;
26 import club.wpia.gigi.output.TrustchainIterable;
27 import club.wpia.gigi.output.template.Form;
28 import club.wpia.gigi.output.template.IterableDataset;
29 import club.wpia.gigi.output.template.Template;
30 import club.wpia.gigi.pages.HandlesMixedRequest;
31 import club.wpia.gigi.pages.LoginPage;
32 import club.wpia.gigi.pages.Page;
33 import club.wpia.gigi.util.AuthorizationContext;
34 import club.wpia.gigi.util.CertExporter;
35 import club.wpia.gigi.util.PEM;
37 public class Certificates extends Page implements HandlesMixedRequest {
39 private static final Template certDisplay = new Template(Certificates.class.getResource("CertificateDisplay.templ"));
41 public static final String PATH = "/account/certs";
43 public static final String SUPPORT_PATH = "/support/certs";
45 private final boolean support;
47 public Certificates(boolean support) {
48 super(support ? "Support Certificates" : "Certificates");
49 this.support = support;
53 public boolean beforeTemplate(HttpServletRequest req, HttpServletResponse resp) throws IOException {
54 if ("POST".equals(req.getMethod())) {
55 return beforePost(req, resp);
58 String pi = req.getPathInfo().substring(PATH.length());
59 if (pi.length() == 0) {
65 resp.setContentType("application/pkix-cert");
66 if (pi.endsWith(".crt") || pi.endsWith(".pem")) {
68 pi = pi.substring(0, pi.length() - 4);
69 } else if (pi.endsWith(".cer")) {
71 pi = pi.substring(0, pi.length() - 4);
73 BigInteger serial = new BigInteger(pi, 16);
75 Certificate c = Certificate.getBySerial(serial);
76 if (c == null || ( !support && LoginPage.getAuthorizationContext(req).getTarget().getId() != c.getOwner().getId())) {
83 ServletOutputStream out = resp.getOutputStream();
84 boolean doChain = req.getParameter("chain") != null;
85 boolean includeAnchor = req.getParameter("noAnchor") == null;
86 boolean includeLeaf = req.getParameter("noLeaf") == null;
88 CertExporter.writeCertCrt(c, out, doChain, includeAnchor, includeLeaf);
90 CertExporter.writeCertCer(c, out, doChain, includeAnchor);
92 } catch (IllegalArgumentException e) {
95 } catch (GigiApiException e) {
98 } catch (GeneralSecurityException e) {
107 public boolean beforePost(HttpServletRequest req, HttpServletResponse resp) throws IOException {
108 if (support && "revoke".equals(req.getParameter("action"))) {
109 return Form.getForm(req, RevokeSingleCertForm.class).submitExceptionProtected(req, resp);
111 if ( !req.getPathInfo().equals(PATH)) {
115 return Form.getForm(req, CertificateModificationForm.class).submitExceptionProtected(req, resp);
119 public void doPost(HttpServletRequest req, HttpServletResponse resp) throws IOException {
120 if (req.getQueryString() != null && !req.getQueryString().equals("") && !req.getQueryString().equals("withRevoked")) {
121 return;// Block actions by get parameters.
124 if (support && "revoke".equals(req.getParameter("action"))) {
125 if (Form.printFormErrors(req, resp.getWriter())) {
126 Form.getForm(req, RevokeSingleCertForm.class).output(resp.getWriter(), getLanguage(req), new HashMap<String, Object>());
130 if ( !req.getPathInfo().equals(PATH)) {
134 Form.getForm(req, CertificateModificationForm.class).output(resp.getWriter(), getLanguage(req), new HashMap<String, Object>());
138 public void doGet(HttpServletRequest req, HttpServletResponse resp) throws IOException {
139 PrintWriter out = resp.getWriter();
140 String pi = req.getPathInfo().substring(PATH.length());
141 if (pi.length() != 0) {
142 pi = pi.substring(1);
145 Certificate c = Certificate.getBySerial(new BigInteger(serial, 16));
146 Language l = LoginPage.getLanguage(req);
148 if (c == null || ( !support && LoginPage.getAuthorizationContext(req).getTarget().getId() != c.getOwner().getId())) {
152 Map<String, Object> vars = getDefaultVars(req);
153 vars.put("serial", URLEncoder.encode(serial, "UTF-8"));
155 CertificateStatus st = c.getStatus();
158 vars.put("support", "support");
159 CertificateOwner user = c.getOwner();
160 if (st == CertificateStatus.ISSUED) {
161 if (user instanceof User) {
162 vars.put("revokeForm", new RevokeSingleCertForm(req, c, new SupportedUser((User) user, getUser(req), LoginPage.getAuthorizationContext(req).getSupporterTicketId())));
167 CertificateOwner co = c.getOwner();
168 int ownerId = co.getId();
169 vars.put("certid", c.getStatus());
170 if (co instanceof Organisation) {
171 vars.put("type", l.getTranslation("Organisation Acount"));
172 vars.put("name", Organisation.getById(ownerId).getName());
173 vars.put("link", ""); // TODO
175 vars.put("type", l.getTranslation("Personal Account"));
176 vars.put("name", User.getById(ownerId).getPreferredName());
177 vars.put("link", "/support/user/" + ownerId + "/");
179 vars.put("status", c.getStatus());
180 vars.put("DN", c.getDistinguishedName());
181 vars.put("digest", c.getMessageDigest());
182 vars.put("profile", c.getProfile().getVisibleName());
184 vars.put("fingerprintSHA1", c.getFingerprint("sha-1"));
185 vars.put("fingerprintSHA256", c.getFingerprint("sha-256"));
186 } catch (GeneralSecurityException e) {
188 } catch (GigiApiException e) {
189 e.format(out, l, getDefaultVars(req));
194 if (st == CertificateStatus.ISSUED || st == CertificateStatus.REVOKED) {
195 X509Certificate certx = c.cert();
196 vars.put("issued", certx.getNotBefore());
197 vars.put("expire", certx.getNotAfter());
198 vars.put("cert", PEM.encode("CERTIFICATE", c.cert().getEncoded()));
200 vars.put("issued", l.getTranslation("N/A"));
201 vars.put("expire", l.getTranslation("N/A"));
202 vars.put("cert", l.getTranslation("N/A"));
204 if (st == CertificateStatus.REVOKED) {
205 vars.put("revoked", c.getRevocationDate());
207 vars.put("revoked", l.getTranslation("N/A"));
209 if (st == CertificateStatus.ISSUED || st == CertificateStatus.REVOKED) {
210 vars.put("trustchain", new TrustchainIterable(c.getParent()));
212 vars.put("cert", PEM.encode("CERTIFICATE", c.cert().getEncoded()));
213 } catch (GeneralSecurityException e) {
217 vars.put("trustchain", l.getTranslation("N/A"));
218 vars.put("cert", l.getTranslation("N/A"));
220 final List<SubjectAlternateName> san = c.getSANs();
221 vars.put("san", new IterableDataset() {
226 public boolean next(Language l, Map<String, Object> vars) {
227 if (j == san.size()) {
230 vars.put("entry", san.get(j).getName() + (j < san.size() - 1 ? ", " : ""));
235 vars.put("login", c.isLoginEnabled());
236 } catch (GeneralSecurityException e) {
238 } catch (GigiApiException e) {
239 e.format(out, l, getDefaultVars(req));
241 certDisplay.output(out, getLanguage(req), vars);
246 HashMap<String, Object> vars = new HashMap<String, Object>();
247 new CertificateModificationForm(req, req.getParameter("withRevoked") != null).output(out, getLanguage(req), vars);
251 public boolean isPermitted(AuthorizationContext ac) {
256 return ac.canSupport();