import java.security.GeneralSecurityException;
import java.security.cert.X509Certificate;
import java.util.HashMap;
-import java.util.LinkedList;
+import java.util.List;
import java.util.Map;
import javax.servlet.ServletOutputStream;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
-import org.cacert.gigi.dbObjects.CACertificate;
import org.cacert.gigi.dbObjects.Certificate;
+import org.cacert.gigi.dbObjects.Certificate.CertificateStatus;
+import org.cacert.gigi.dbObjects.Certificate.SubjectAlternateName;
+import org.cacert.gigi.dbObjects.CertificateOwner;
+import org.cacert.gigi.dbObjects.Organisation;
+import org.cacert.gigi.dbObjects.SupportedUser;
+import org.cacert.gigi.dbObjects.User;
import org.cacert.gigi.localisation.Language;
+import org.cacert.gigi.output.TrustchainIterable;
import org.cacert.gigi.output.template.Form;
import org.cacert.gigi.output.template.IterableDataset;
import org.cacert.gigi.output.template.Template;
import org.cacert.gigi.pages.HandlesMixedRequest;
import org.cacert.gigi.pages.LoginPage;
import org.cacert.gigi.pages.Page;
+import org.cacert.gigi.util.AuthorizationContext;
+import org.cacert.gigi.util.CertExporter;
import org.cacert.gigi.util.PEM;
-import sun.security.pkcs.ContentInfo;
-import sun.security.pkcs.PKCS7;
-import sun.security.pkcs.SignerInfo;
-import sun.security.x509.AlgorithmId;
-
public class Certificates extends Page implements HandlesMixedRequest {
- private Template certDisplay = new Template(Certificates.class.getResource("CertificateDisplay.templ"));
+ private static final Template certDisplay = new Template(Certificates.class.getResource("CertificateDisplay.templ"));
public static final String PATH = "/account/certs";
- static class TrustchainIterable implements IterableDataset {
-
- CACertificate cert;
-
- public TrustchainIterable(CACertificate cert) {
- this.cert = cert;
- }
-
- @Override
- public boolean next(Language l, Map<String, Object> vars) {
- if (cert == null) {
- return false;
- }
- vars.put("name", cert.getKeyname());
- vars.put("link", cert.getLink());
- if (cert.isSelfsigned()) {
- cert = null;
- return true;
- }
- cert = cert.getParent();
- return true;
- }
+ public static final String SUPPORT_PATH = "/support/certs";
- }
+ private final boolean support;
- public Certificates() {
- super("Certificates");
+ public Certificates(boolean support) {
+ super(support ? "Support Certificates" : "Certificates");
+ this.support = support;
}
@Override
public boolean beforeTemplate(HttpServletRequest req, HttpServletResponse resp) throws IOException {
+ if ("POST".equals(req.getMethod())) {
+ return beforePost(req, resp);
+ }
String pi = req.getPathInfo().substring(PATH.length());
if (pi.length() == 0) {
} else if (pi.endsWith(".cer")) {
cer = true;
pi = pi.substring(0, pi.length() - 4);
- } else if (pi.endsWith(".cer")) {
- cer = true;
- pi = pi.substring(0, pi.length() - 4);
}
String serial = pi;
try {
resp.sendError(404);
return true;
}
- X509Certificate cert = c.cert();
if ( !crt && !cer) {
return false;
}
ServletOutputStream out = resp.getOutputStream();
+ boolean doChain = req.getParameter("chain") != null;
+ boolean includeAnchor = req.getParameter("noAnchor") == null;
+ boolean includeLeaf = req.getParameter("noLeaf") == null;
if (crt) {
- out.println(PEM.encode("CERTIFICATE", cert.getEncoded()));
- if (req.getParameter("chain") != null) {
- CACertificate ca = c.getParent();
- while ( !ca.isSelfsigned()) {
- out.println(PEM.encode("CERTIFICATE", ca.getCertificate().getEncoded()));
- ca = ca.getParent();
- }
- if (req.getParameter("noAnchor") == null) {
- out.println(PEM.encode("CERTIFICATE", ca.getCertificate().getEncoded()));
- }
- }
+ CertExporter.writeCertCrt(c, out, doChain, includeAnchor, includeLeaf);
} else if (cer) {
- if (req.getParameter("install") != null) {
- PKCS7 p7 = toP7Chain(c);
- p7.encodeSignedData(out);
- /*
- * ContentInfo ci = toCIChain(c); try (DerOutputStream dos =
- * new DerOutputStream()) { ci.encode(dos);
- * out.write(dos.toByteArray()); }
- */
- } else {
- out.write(cert.getEncoded());
- }
+ CertExporter.writeCertCer(c, out, doChain, includeAnchor);
}
} catch (IllegalArgumentException e) {
resp.sendError(404);
return true;
}
- private static PKCS7 toP7Chain(Certificate c) throws IOException, GeneralSecurityException {
- LinkedList<X509Certificate> ll = getChain(c);
- PKCS7 p7 = new PKCS7(new AlgorithmId[0], new ContentInfo(ContentInfo.DATA_OID, null), ll.toArray(new X509Certificate[ll.size()]), new SignerInfo[0]);
- return p7;
- }
-
- private static LinkedList<X509Certificate> getChain(Certificate c) throws IOException, GeneralSecurityException {
- LinkedList<X509Certificate> ll = new LinkedList<>();
- ll.add(c.cert());
- CACertificate ca = c.getParent();
- while ( !ca.isSelfsigned()) {
- ll.add(ca.getCertificate());
- ca = ca.getParent();
+ @Override
+ public boolean beforePost(HttpServletRequest req, HttpServletResponse resp) throws IOException {
+ if (support && "revoke".equals(req.getParameter("action"))) {
+ if (Form.getForm(req, RevokeSingleCertForm.class).submitExceptionProtected(req)) {
+ resp.sendRedirect(req.getPathInfo());
+ return true;
+ }
+ return false;
+ }
+ if ( !req.getPathInfo().equals(PATH)) {
+ resp.sendError(500);
+ return true;
}
- ll.add(ca.getCertificate());
- return ll;
+ if (Form.getForm(req, CertificateModificationForm.class).submitExceptionProtected(req)) {
+ resp.sendRedirect(PATH);
+ return true;
+ }
+ return false;
}
@Override
if (req.getQueryString() != null && !req.getQueryString().equals("") && !req.getQueryString().equals("withRevoked")) {
return;// Block actions by get parameters.
}
+
+ if (support && "revoke".equals(req.getParameter("action"))) {
+ if (Form.printFormErrors(req, resp.getWriter())) {
+ Form.getForm(req, RevokeSingleCertForm.class).output(resp.getWriter(), getLanguage(req), new HashMap<String, Object>());
+ }
+ return;
+ }
if ( !req.getPathInfo().equals(PATH)) {
resp.sendError(500);
return;
}
- Form.getForm(req, CertificateModificationForm.class).submit(resp.getWriter(), req);
- doGet(req, resp);
+ Form.getForm(req, CertificateModificationForm.class).output(resp.getWriter(), getLanguage(req), new HashMap<String, Object>());
}
@Override
String serial = pi;
Certificate c = Certificate.getBySerial(serial);
- if (c == null || LoginPage.getAuthorizationContext(req).getTarget().getId() != c.getOwner().getId()) {
+ Language l = LoginPage.getLanguage(req);
+
+ if ( !support && (c == null || LoginPage.getAuthorizationContext(req).getTarget().getId() != c.getOwner().getId())) {
resp.sendError(404);
return;
}
HashMap<String, Object> vars = new HashMap<>();
vars.put("serial", URLEncoder.encode(serial, "UTF-8"));
- vars.put("trustchain", new TrustchainIterable(c.getParent()));
+
+ CertificateStatus st = c.getStatus();
+
+ if (support) {
+ vars.put("support", "support");
+ CertificateOwner user = c.getOwner();
+ if (st == CertificateStatus.ISSUED) {
+ if (user instanceof User) {
+ vars.put("revokeForm", new RevokeSingleCertForm(req, c, new SupportedUser((User) user, getUser(req), LoginPage.getAuthorizationContext(req).getSupporterTicketId())));
+ }
+ }
+ }
+
+ CertificateOwner co = c.getOwner();
+ int ownerId = co.getId();
+ vars.put("certid", c.getStatus());
+ if (co instanceof Organisation) {
+ vars.put("type", l.getTranslation("Organisation Acount"));
+ vars.put("name", Organisation.getById(ownerId).getName());
+ vars.put("link", ""); // TODO
+ } else {
+ vars.put("type", l.getTranslation("Personal Account"));
+ vars.put("name", User.getById(ownerId).getPreferredName());
+ vars.put("link", "/support/user/" + ownerId + "/");
+ }
+ vars.put("status", c.getStatus());
+ vars.put("DN", c.getDistinguishedName());
+ vars.put("digest", c.getMessageDigest());
+ vars.put("profile", c.getProfile().getVisibleName());
+ vars.put("fingerprint", "TBD"); // TODO function needs to be
+ // implemented in Certificate.java
try {
- vars.put("cert", c.cert());
+
+ if (st == CertificateStatus.ISSUED || st == CertificateStatus.REVOKED) {
+ X509Certificate certx = c.cert();
+ vars.put("issued", certx.getNotBefore());
+ vars.put("expire", certx.getNotAfter());
+ vars.put("cert", PEM.encode("CERTIFICATE", c.cert().getEncoded()));
+ } else {
+ vars.put("issued", l.getTranslation("N/A"));
+ vars.put("expire", l.getTranslation("N/A"));
+ vars.put("cert", l.getTranslation("N/A"));
+ }
+ if (st == CertificateStatus.REVOKED) {
+ vars.put("revoked", c.getRevocationDate());
+ } else {
+ vars.put("revoked", l.getTranslation("N/A"));
+ }
+ if (st == CertificateStatus.ISSUED || st == CertificateStatus.REVOKED) {
+ vars.put("trustchain", new TrustchainIterable(c.getParent()));
+ try {
+ vars.put("cert", PEM.encode("CERTIFICATE", c.cert().getEncoded()));
+ } catch (GeneralSecurityException e) {
+ e.printStackTrace();
+ }
+ } else {
+ vars.put("trustchain", l.getTranslation("N/A"));
+ vars.put("cert", l.getTranslation("N/A"));
+ }
+ final List<SubjectAlternateName> san = c.getSANs();
+ vars.put("san", new IterableDataset() {
+
+ int j = 0;
+
+ @Override
+ public boolean next(Language l, Map<String, Object> vars) {
+ if (j == san.size()) {
+ return false;
+ }
+ vars.put("entry", san.get(j).getName() + (j < san.size() - 1 ? ", " : ""));
+ j++;
+ return true;
+ }
+ });
+ vars.put("login", c.isLoginEnabled());
} catch (GeneralSecurityException e) {
e.printStackTrace();
}
new CertificateModificationForm(req, req.getParameter("withRevoked") != null).output(out, getLanguage(req), vars);
}
+ @Override
+ public boolean isPermitted(AuthorizationContext ac) {
+ if (ac == null) {
+ return false;
+ }
+ if (support) {
+ return ac.canSupport();
+ } else {
+ return true;
+ }
+ }
}
projects / gigi.git / blobdiff