X-Git-Url: https://code.wpia.club/?a=blobdiff_plain;f=src%2Forg%2Fcacert%2Fgigi%2Fpages%2Faccount%2Fcerts%2FCertificateRequest.java;h=0bf0bd2ff63b844b79bf8f5f8867b201f0a9a5db;hb=6f951295dfd62c5fa1ddb0977febeb58728bec50;hp=63c129e8e3c286e857acdc230767fc990f4612a6;hpb=9136e3e03b6881b32aada896be3241e46cbd33d9;p=gigi.git diff --git a/src/org/cacert/gigi/pages/account/certs/CertificateRequest.java b/src/org/cacert/gigi/pages/account/certs/CertificateRequest.java index 63c129e8..0bf0bd2f 100644 --- a/src/org/cacert/gigi/pages/account/certs/CertificateRequest.java +++ b/src/org/cacert/gigi/pages/account/certs/CertificateRequest.java @@ -23,7 +23,9 @@ import org.cacert.gigi.dbObjects.Certificate; import org.cacert.gigi.dbObjects.Certificate.CSRType; import org.cacert.gigi.dbObjects.Certificate.SANType; import org.cacert.gigi.dbObjects.Certificate.SubjectAlternateName; +import org.cacert.gigi.dbObjects.CertificateOwner; import org.cacert.gigi.dbObjects.CertificateProfile; +import org.cacert.gigi.dbObjects.CertificateProfile.PropertyTemplate; import org.cacert.gigi.dbObjects.Digest; import org.cacert.gigi.dbObjects.Organisation; import org.cacert.gigi.dbObjects.User; @@ -87,7 +89,7 @@ public class CertificateRequest { private String csr; - public String CN = DEFAULT_CN; + public String name = DEFAULT_CN; private Set SANs; @@ -119,7 +121,7 @@ public class CertificateRequest { if (value.contains(".") && !value.contains(" ")) { SANs.add(new SubjectAlternateName(SANType.DNS, value)); } else { - CN = value; + name = value; } } else if (a.getObjectIdentifier().equals((Object) PKIXExtensions.SubjectAlternativeName_Id)) { // TODO? parse invalid SANs @@ -231,9 +233,9 @@ public class CertificateRequest { } } - private TreeSet parseSANBox(String SANs) { + private Set parseSANBox(String SANs) { String[] SANparts = SANs.split("[\r\n]+|, *"); - TreeSet parsedNames = new TreeSet<>(); + Set parsedNames = new LinkedHashSet<>(); for (String SANline : SANparts) { String[] parts = SANline.split(":", 2); if (parts.length == 1) { @@ -265,8 +267,8 @@ public class CertificateRequest { return SANs; } - public String getCN() { - return CN; + public String getName() { + return name; } public Organisation getOrg() { @@ -285,9 +287,9 @@ public class CertificateRequest { return profile; } - public boolean update(String CNin, String hashAlg, String profileStr, String newOrgStr, String ou, String SANsStr, PrintWriter out, HttpServletRequest req) throws GigiApiException { + public synchronized boolean update(String nameIn, String hashAlg, String profileStr, String newOrgStr, String ou, String SANsStr, PrintWriter out, HttpServletRequest req) throws GigiApiException { GigiApiException error = new GigiApiException(); - this.CN = CNin; + this.name = nameIn; if (hashAlg != null) { selectedDigest = Digest.valueOf(hashAlg); } @@ -295,15 +297,29 @@ public class CertificateRequest { if (newOrgStr != null) { Organisation neworg = Organisation.getById(Integer.parseInt(newOrgStr)); if (neworg == null || u.getOrganisations().contains(neworg)) { - org = neworg; + PropertyTemplate orga = profile.getTemplates().get("orga"); + if (orga != null) { + org = neworg; + } else { + org = null; + error.mergeInto(new GigiApiException("No organisations for this certificate profile.")); + } } else { - error.mergeInto(new GigiApiException("Selected Organisation is not part of your account.")); + error.mergeInto(new GigiApiException("Selected organisation is not part of your account.")); } } + this.ou = ou; - boolean server = profile.getKeyName().equals("server"); - SANs = verifySANs(error, server, parseSANBox(SANsStr)); + if ( !this.profile.canBeIssuedBy(u)) { + this.profile = CertificateProfile.getById(1); + error.mergeInto(new GigiApiException("Certificate Profile is invalid.")); + throw error; + } + + CertificateOwner owner = org != null ? org : u; + + verifySANs(error, profile, parseSANBox(SANsStr), owner); if ( !error.isEmpty()) { throw error; @@ -311,79 +327,219 @@ public class CertificateRequest { return true; } - private Set verifySANs(GigiApiException error, boolean server, Set sANs2) { + private void verifySANs(GigiApiException error, CertificateProfile p, Set sANs2, CertificateOwner owner) { Set filteredSANs = new LinkedHashSet<>(); + PropertyTemplate domainTemp = p.getTemplates().get("domain"); + PropertyTemplate emailTemp = p.getTemplates().get("email"); + pDNS = null; + pMail = null; for (SubjectAlternateName san : sANs2) { if (san.getType() == SANType.DNS) { - if (u.isValidDomain(san.getName()) && server) { - if (pDNS == null) { - pDNS = san.getName(); + if (domainTemp != null && owner.isValidDomain(san.getName())) { + if (pDNS != null && !domainTemp.isMultiple()) { + // remove + } else { + if (pDNS == null) { + pDNS = san.getName(); + } + filteredSANs.add(san); + continue; } - filteredSANs.add(san); - continue; } } else if (san.getType() == SANType.EMAIL) { - if (u.isValidEmail(san.getName()) && !server) { - if (pMail == null) { - pMail = san.getName(); + if (emailTemp != null && owner.isValidEmail(san.getName())) { + if (pMail != null && !emailTemp.isMultiple()) { + // remove + } else { + if (pMail == null) { + pMail = san.getName(); + } + filteredSANs.add(san); + continue; } - filteredSANs.add(san); - continue; } } HashMap vars = new HashMap<>(); vars.put("SAN", san.getType().toString().toLowerCase() + ":" + san.getName()); error.mergeInto(new GigiApiException(new Scope(new SprintfCommand(// - "The requested Subject alternate name \"%s\" has been removed.", Arrays.asList("$SAN")), vars))); + "The requested Subject alternate name \"{0}\" has been removed.", Arrays.asList("${SAN}")), vars))); } - return filteredSANs; + SANs = filteredSANs; } - public Certificate draft() throws GigiApiException { + // domain email name name=WoTUser orga + public synchronized Certificate draft() throws GigiApiException { GigiApiException error = new GigiApiException(); - if ( !u.canIssue(this.profile)) { - this.profile = CertificateProfile.getById(1); - error.mergeInto(new GigiApiException("Certificate Profile is invalid.")); - throw error; - } - - boolean server = profile.getKeyName().equals("server"); - if ( !u.isValidName(CN) && !server && !CN.equals(DEFAULT_CN)) { - this.CN = DEFAULT_CN; - error.mergeInto(new GigiApiException("The name entered, does not match the details in your account. You cannot issue certificates with this name. Enter a name that matches the one that has been assured in your account.")); - } HashMap subject = new HashMap<>(); - if (server && pDNS != null) { - subject.put("CN", pDNS); - if (pMail != null) { - error.mergeInto(new GigiApiException("No email is included in this certificate.")); + PropertyTemplate domainTemp = profile.getTemplates().get("domain"); + PropertyTemplate emailTemp = profile.getTemplates().get("email"); + PropertyTemplate nameTemp = profile.getTemplates().get("name"); + PropertyTemplate wotUserTemp = profile.getTemplates().get("name=WoTUser"); + + // Ok, let's determine the CN + // the CN is + // 1. the user's "real name", iff the real name is to be included i.e. + // not empty (name), or to be forced to WOTUser + + // 2. the user's "primary domain", iff "1." doesn't match and there is a + // primary domain. (domainTemp != null) + + String verifiedCN = null; + if (org == null) { + verifiedCN = verifyName(error, nameTemp, wotUserTemp, verifiedCN); + } else { + if ( !name.equals("")) { + verifiedCN = name; } - if (CN.equals("")) { - CN = ""; - error.mergeInto(new GigiApiException("No real name is included in this certificate. The real name, you entered will be ignored.")); + } + if (pDNS == null && domainTemp != null && domainTemp.isRequired()) { + error.mergeInto(new GigiApiException("Server Certificates require a DNS name.")); + } else if (domainTemp != null && verifiedCN == null) { + // user may add domains + verifiedCN = pDNS; + } + if (verifiedCN != null) { + subject.put("CN", verifiedCN); + } + + if (pMail != null) { + if (emailTemp != null) { + subject.put("EMAIL", pMail); + } else { + // verify SANs should prevent this + pMail = null; + error.mergeInto(new GigiApiException("You may not include an email in this certificate.")); } } else { - u.isValidName(CN); - subject.put("CN", CN); - if (pMail != null) { - subject.put("EMAIL", pMail); + if (emailTemp != null && emailTemp.isRequired()) { + error.mergeInto(new GigiApiException("You need to include an email in this certificate.")); } } - this.SANs = verifySANs(error, server, SANs); + if (org != null) { subject.put("O", org.getName()); subject.put("C", org.getState()); subject.put("ST", org.getProvince()); subject.put("L", org.getCity()); - subject.put("OU", ou); + if (ou != null) { + subject.put("OU", ou); + } } - + System.out.println(subject); if ( !error.isEmpty()) { throw error; } return new Certificate(u, subject, selectedDigest.toString(), // this.csr, this.csrType, profile, SANs.toArray(new SubjectAlternateName[SANs.size()])); } + + private String verifyName(GigiApiException error, PropertyTemplate nameTemp, PropertyTemplate wotUserTemp, String verifiedCN) { + // real names, + // possible configurations: name {y,null,?}, name=WoTUser {y,null} + // semantics: + // y * -> real + // null y -> default + // null null -> null + // ? y -> real, default + // ? null -> real, null + boolean realIsOK = false; + boolean nullIsOK = false; + boolean defaultIsOK = false; + if (wotUserTemp != null && ( !wotUserTemp.isRequired() || wotUserTemp.isMultiple())) { + error.mergeInto(new GigiApiException("Internal configuration error detected.")); + } + if (nameTemp != null && nameTemp.isRequired() && !nameTemp.isMultiple()) { + realIsOK = true; + } else if (nameTemp == null) { + defaultIsOK = wotUserTemp != null; + nullIsOK = !defaultIsOK; + } else if (nameTemp != null && !nameTemp.isRequired() && !nameTemp.isMultiple()) { + realIsOK = true; + defaultIsOK = wotUserTemp != null; + nullIsOK = !defaultIsOK; + } else { + error.mergeInto(new GigiApiException("Internal configuration error detected.")); + } + if (u.isValidName(name)) { + if (realIsOK) { + verifiedCN = name; + } else { + error.mergeInto(new GigiApiException("Your real name is not allowed in this certificate.")); + if (defaultIsOK) { + name = DEFAULT_CN; + } else if (nullIsOK) { + name = ""; + } + } + } else if (name.equals(DEFAULT_CN)) { + if (defaultIsOK) { + verifiedCN = name; + } else { + error.mergeInto(new GigiApiException("The default name is not allowed in this certificate.")); + if (nullIsOK) { + name = ""; + } else if (realIsOK) { + name = u.getName().toString(); + } + } + } else if (name.equals("")) { + if (nullIsOK) { + verifiedCN = name; + } else { + error.mergeInto(new GigiApiException("A name is required in this certificate.")); + if (defaultIsOK) { + name = DEFAULT_CN; + } else if (realIsOK) { + name = u.getName().toString(); + } + } + } else { + error.mergeInto(new GigiApiException("The name you entered was invalid.")); + + } + if (wotUserTemp != null) { + if ( !wotUserTemp.isRequired() || wotUserTemp.isMultiple()) { + error.mergeInto(new GigiApiException("Internal configuration error detected.")); + } + if ( !name.equals(DEFAULT_CN)) { + name = DEFAULT_CN; + error.mergeInto(new GigiApiException("You may not change the name for this certificate type.")); + } else { + verifiedCN = DEFAULT_CN; + } + + } else { + if (nameTemp != null) { + if (name.equals("")) { + if (nameTemp.isRequired()) { + // nothing, but required + name = DEFAULT_CN; + error.mergeInto(new GigiApiException("No name entered, but one was required.")); + } else { + // nothing and not required + + } + } else if (u.isValidName(name)) { + verifiedCN = name; + } else { + if (nameTemp.isRequired()) { + error.mergeInto(new GigiApiException("The name entered, does not match the details in your account. You cannot issue certificates with this name. Enter a name that matches the one that has been assured in your account, because a name is required for this certificate type.")); + } else if (name.equals(DEFAULT_CN)) { + verifiedCN = DEFAULT_CN; + } else { + name = DEFAULT_CN; + error.mergeInto(new GigiApiException("The name entered, does not match the details in your account. You cannot issue certificates with this name. Enter a name that matches the one that has been assured in your account or keep the default name.")); + } + } + } else { + if ( !name.equals("")) { + name = ""; + error.mergeInto(new GigiApiException("No real name is included in this certificate. The real name, you entered will be ignored.")); + } + } + } + return verifiedCN; + } }