org.glite.security.trustmanager
Class ContextWrapper

java.lang.Object
  extended by org.glite.security.trustmanager.ContextWrapper
All Implemented Interfaces:
SSLContextWrapper

public class ContextWrapper
extends java.lang.Object
implements SSLContextWrapper

A class wrapping the SSLContext. It adds support for PEM certs, grid proxy certs, timeouts, dynamic reloading of CRLs etc. ContextWrapper.java

Author:
Joni Hahkala Created on July 18, 2002, 6:10 PM

Field Summary
static java.lang.String CA_FILES
          CA file names
static java.lang.String CA_FILES_DEFAULT
          DOCUMENT ME!
static java.lang.String CA_STORE_ALIAS
          DOCUMENT ME!
static java.lang.String CA_STORE_FILE
          CA keystore file name
static java.lang.String CA_STORE_PASSWD
          CA store password
static java.lang.String CA_STORE_TYPE
          CA store type property name
 org.glite.security.util.FileCertReader certReader
          DOCUMENT ME!
static java.lang.String CONF_FILE
          DOCUMENT ME!
 org.glite.security.util.CaseInsensitiveProperties config
          DOCUMENT ME!
static java.lang.String CONNECT_TIMEOUT
          DOCUMENT ME!
static java.lang.String CREDENTIALS_CERT_FILE
          identity cert-key property names
static java.lang.String CREDENTIALS_KEY_FILE
          DOCUMENT ME!
static java.lang.String CREDENTIALS_KEY_PASSWD
          DOCUMENT ME!
static java.lang.String CREDENTIALS_PROXY_FILE
          identity proxy filename
static java.lang.String CREDENTIALS_STORE_FILE
          identity keystore property names
static java.lang.String CREDENTIALS_STORE_PASSWD
          DOCUMENT ME!
static java.lang.String CREDENTIALS_STORE_TYPE
          DOCUMENT ME!
static java.lang.String CREDENTIALS_UPDATE_INTERVAL
          DOCUMENT ME!
static java.lang.String CREDENTIALS_UPDATE_INTERVAL_DEAFULT
          DOCUMENT ME!
static java.lang.String CRL_ENABLED
          DOCUMENT ME!
static java.lang.String CRL_ENABLED_DEFAULT
          DOCUMENT ME!
static java.lang.String CRL_FILES
          DOCUMENT ME!
static java.lang.String CRL_FILES_DEFAULT
          DOCUMENT ME!
static java.lang.String CRL_REQUIRED
          DOCUMENT ME!
static java.lang.String CRL_REQUIRED_DEFAULT
          DOCUMENT ME!
static java.lang.String CRL_UPDATE_INTERVAL
          DOCUMENT ME!
static java.lang.String CRL_UPDATE_INTERVAL_DEFAULT
          DOCUMENT ME!
 java.util.Vector crls
          DOCUMENT ME!
static java.lang.String GRID_PROXY_STREAM
          The stream to load the proxy from
 javax.net.ssl.KeyManager[] identityKeyManagers
          DOCUMENT ME!
static java.lang.String INT_KEYSTORE_PASSWD
          DOCUMENT ME!
static java.lang.String KEYSTORE_TYPE_DEFAULT
          DOCUMENT ME!
static java.lang.String LOG_CONF_FILE
          DOCUMENT ME!
static java.lang.String LOG_FILE
          DOCUMENT ME!
static java.lang.String OVERRIDE_EXPIRATION_CHECK_ON_INIT
          DOCUMENT ME!
 boolean overrideExpirationCheck
          Switch to bypass the expiration check.
static java.lang.String SSL_PROTOCOL
          DOCUMENT ME!
static java.lang.String SSL_PROTOCOL_DEFAULT
          DOCUMENT ME!
static java.lang.String SSL_TIMEOUT_SETTING
          timeout for connections in milliseconds
static java.lang.String TIMEOUT_DEFAULT
          timeout default 1 minute
 java.util.Vector trustAnchors
          DOCUMENT ME!
 CRLFileTrustManager trustManager
          DOCUMENT ME!
 
Constructor Summary
ContextWrapper(java.util.Properties inputConfig)
          Creates a new ContextWrapper object.
ContextWrapper(java.util.Properties inputConfig, org.bouncycastle.openssl.PasswordFinder finder)
          Creates a new instance of ContextWrapper
ContextWrapper(java.util.Properties inputConfig, java.security.cert.X509Certificate[] chain, java.security.PrivateKey key)
          Creates a new ContextWrapper object.
 
Method Summary
 javax.net.ssl.SSLContext getContext()
          Returns the underlying SSLContext that is wrapped.
static long getIntervalSecs(java.lang.String intervalBlob)
          Parses a string representation of an interval into seconds.
 javax.net.ssl.X509KeyManager getKeyManager()
          Returns the internal key managers, only for debugging.
 javax.net.ssl.SSLServerSocketFactory getServerSocketFactory()
          Creates a ServerSocketFactory.
 javax.net.ssl.SSLSocketFactory getSocketFactory()
          Create a TimeoutSSLSocketFactory instance with the configuration requested.
 void init(org.bouncycastle.openssl.PasswordFinder finder, java.security.cert.X509Certificate[] chain, java.security.PrivateKey key)
          Initializes the key manager.
 void initKeyManagers(org.bouncycastle.openssl.PasswordFinder finder)
          Initializes the key manager.
 void initKeyManagers(java.security.cert.X509Certificate[] chain, java.security.PrivateKey key)
          Initializes the key manager.
 void loadConfig(java.util.Properties inputConfig)
          Depending on the configuration given either uses the configuration or loads the configuration from a file if the configuration file setting is set.
 void stop()
          Stops runing updater threads if there is any.
 
Methods inherited from class java.lang.Object
equals, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait
 

Field Detail

CREDENTIALS_PROXY_FILE

public static final java.lang.String CREDENTIALS_PROXY_FILE
identity proxy filename

See Also:
Constant Field Values

CREDENTIALS_UPDATE_INTERVAL

public static final java.lang.String CREDENTIALS_UPDATE_INTERVAL
DOCUMENT ME!

See Also:
Constant Field Values

CREDENTIALS_CERT_FILE

public static final java.lang.String CREDENTIALS_CERT_FILE
identity cert-key property names

See Also:
Constant Field Values

CREDENTIALS_KEY_FILE

public static final java.lang.String CREDENTIALS_KEY_FILE
DOCUMENT ME!

See Also:
Constant Field Values

CREDENTIALS_KEY_PASSWD

public static final java.lang.String CREDENTIALS_KEY_PASSWD
DOCUMENT ME!

See Also:
Constant Field Values

CREDENTIALS_STORE_FILE

public static final java.lang.String CREDENTIALS_STORE_FILE
identity keystore property names

See Also:
Constant Field Values

CREDENTIALS_STORE_TYPE

public static final java.lang.String CREDENTIALS_STORE_TYPE
DOCUMENT ME!

See Also:
Constant Field Values

CREDENTIALS_STORE_PASSWD

public static final java.lang.String CREDENTIALS_STORE_PASSWD
DOCUMENT ME!

See Also:
Constant Field Values

CA_FILES

public static final java.lang.String CA_FILES
CA file names

See Also:
Constant Field Values

CA_STORE_FILE

public static final java.lang.String CA_STORE_FILE
CA keystore file name

See Also:
Constant Field Values

CA_STORE_TYPE

public static final java.lang.String CA_STORE_TYPE
CA store type property name

See Also:
Constant Field Values

CA_STORE_PASSWD

public static final java.lang.String CA_STORE_PASSWD
CA store password

See Also:
Constant Field Values

CA_STORE_ALIAS

public static final java.lang.String CA_STORE_ALIAS
DOCUMENT ME!

See Also:
Constant Field Values

CRL_FILES

public static final java.lang.String CRL_FILES
DOCUMENT ME!

See Also:
Constant Field Values

CRL_ENABLED

public static final java.lang.String CRL_ENABLED
DOCUMENT ME!

See Also:
Constant Field Values

CRL_REQUIRED

public static final java.lang.String CRL_REQUIRED
DOCUMENT ME!

See Also:
Constant Field Values

CRL_UPDATE_INTERVAL

public static final java.lang.String CRL_UPDATE_INTERVAL
DOCUMENT ME!

See Also:
Constant Field Values

LOG_CONF_FILE

public static final java.lang.String LOG_CONF_FILE
DOCUMENT ME!

See Also:
Constant Field Values

LOG_FILE

public static final java.lang.String LOG_FILE
DOCUMENT ME!

See Also:
Constant Field Values

SSL_PROTOCOL

public static final java.lang.String SSL_PROTOCOL
DOCUMENT ME!

See Also:
Constant Field Values

CONF_FILE

public static final java.lang.String CONF_FILE
DOCUMENT ME!

See Also:
Constant Field Values

SSL_TIMEOUT_SETTING

public static final java.lang.String SSL_TIMEOUT_SETTING
timeout for connections in milliseconds

See Also:
Constant Field Values

CONNECT_TIMEOUT

public static final java.lang.String CONNECT_TIMEOUT
DOCUMENT ME!

See Also:
Constant Field Values

OVERRIDE_EXPIRATION_CHECK_ON_INIT

public static final java.lang.String OVERRIDE_EXPIRATION_CHECK_ON_INIT
DOCUMENT ME!

See Also:
Constant Field Values

GRID_PROXY_STREAM

public static final java.lang.String GRID_PROXY_STREAM
The stream to load the proxy from

See Also:
Constant Field Values

KEYSTORE_TYPE_DEFAULT

public static final java.lang.String KEYSTORE_TYPE_DEFAULT
DOCUMENT ME!

See Also:
Constant Field Values

CRL_UPDATE_INTERVAL_DEFAULT

public static final java.lang.String CRL_UPDATE_INTERVAL_DEFAULT
DOCUMENT ME!

See Also:
Constant Field Values

CRL_REQUIRED_DEFAULT

public static final java.lang.String CRL_REQUIRED_DEFAULT
DOCUMENT ME!

See Also:
Constant Field Values

SSL_PROTOCOL_DEFAULT

public static final java.lang.String SSL_PROTOCOL_DEFAULT
DOCUMENT ME!

See Also:
Constant Field Values

CRL_ENABLED_DEFAULT

public static final java.lang.String CRL_ENABLED_DEFAULT
DOCUMENT ME!

See Also:
Constant Field Values

CREDENTIALS_UPDATE_INTERVAL_DEAFULT

public static final java.lang.String CREDENTIALS_UPDATE_INTERVAL_DEAFULT
DOCUMENT ME!

See Also:
Constant Field Values

CA_FILES_DEFAULT

public static final java.lang.String CA_FILES_DEFAULT
DOCUMENT ME!

See Also:
Constant Field Values

CRL_FILES_DEFAULT

public static final java.lang.String CRL_FILES_DEFAULT
DOCUMENT ME!

See Also:
Constant Field Values

TIMEOUT_DEFAULT

public static final java.lang.String TIMEOUT_DEFAULT
timeout default 1 minute

See Also:
Constant Field Values

INT_KEYSTORE_PASSWD

public static final java.lang.String INT_KEYSTORE_PASSWD
DOCUMENT ME!

See Also:
Constant Field Values

config

public org.glite.security.util.CaseInsensitiveProperties config
DOCUMENT ME!


identityKeyManagers

public javax.net.ssl.KeyManager[] identityKeyManagers
DOCUMENT ME!


trustAnchors

public java.util.Vector trustAnchors
DOCUMENT ME!


crls

public java.util.Vector crls
DOCUMENT ME!


certReader

public org.glite.security.util.FileCertReader certReader
DOCUMENT ME!


trustManager

public CRLFileTrustManager trustManager
DOCUMENT ME!


overrideExpirationCheck

public boolean overrideExpirationCheck
Switch to bypass the expiration check. Only for testing! Overrides the expiration checking during the cert loading so that expired certs can be loaded to test the certificate rejection at the server end.

Constructor Detail

ContextWrapper

public ContextWrapper(java.util.Properties inputConfig)
               throws java.io.IOException,
                      java.security.GeneralSecurityException
Creates a new ContextWrapper object.

Parameters:
inputConfig - the configuration to use.
Throws:
java.io.IOException - in case there is a problem reading config file, certificates, key or CRLs.
java.security.GeneralSecurityException - if there is a problem initializing the SSLContext.

ContextWrapper

public ContextWrapper(java.util.Properties inputConfig,
                      java.security.cert.X509Certificate[] chain,
                      java.security.PrivateKey key)
               throws java.io.IOException,
                      java.security.GeneralSecurityException
Creates a new ContextWrapper object.

Parameters:
inputConfig - The configuration values given.
chain - the certificate chain to use for authentication.
key - the key to use for authentication.
Throws:
java.lang.Exception - in case the SSL context initialization fails.
java.io.IOException
java.security.GeneralSecurityException

ContextWrapper

public ContextWrapper(java.util.Properties inputConfig,
                      org.bouncycastle.openssl.PasswordFinder finder)
               throws java.io.IOException,
                      java.security.GeneralSecurityException
Creates a new instance of ContextWrapper

Throws:
java.io.IOException
java.security.GeneralSecurityException
Method Detail

loadConfig

public void loadConfig(java.util.Properties inputConfig)
                throws java.io.FileNotFoundException,
                       java.io.IOException
Depending on the configuration given either uses the configuration or loads the configuration from a file if the configuration file setting is set.

Parameters:
inputConfig - the configuration values.
Throws:
java.io.FileNotFoundException - if the config file pointed to by the config values is not found.
java.io.IOException - if the config file loagind fails.

getContext

public javax.net.ssl.SSLContext getContext()
Returns the underlying SSLContext that is wrapped. Only for debugging.

Returns:
The underlying SSLContext.

getServerSocketFactory

public javax.net.ssl.SSLServerSocketFactory getServerSocketFactory()
                                                            throws javax.net.ssl.SSLException
Creates a ServerSocketFactory.

Specified by:
getServerSocketFactory in interface SSLContextWrapper
Returns:
The SSLServerSocketFactory created using the configuration values.
Throws:
javax.net.ssl.SSLException - if a problem occurs while creating the factory.

getSocketFactory

public javax.net.ssl.SSLSocketFactory getSocketFactory()
                                                throws javax.net.ssl.SSLException
Create a TimeoutSSLSocketFactory instance with the configuration requested.

Specified by:
getSocketFactory in interface SSLContextWrapper
Returns:
SSLSocketFactory (TimeoutSSLSocketFactory) instance.
Throws:
javax.net.ssl.SSLException - In case of problems an exception is thrown.

init

public void init(org.bouncycastle.openssl.PasswordFinder finder,
                 java.security.cert.X509Certificate[] chain,
                 java.security.PrivateKey key)
          throws java.security.cert.CertificateException,
                 java.security.GeneralSecurityException,
                 java.io.IOException
Initializes the key manager.

Parameters:
finder - the Password Finder implementation to use to ask the user for password to access the private key.
chain - the certificate chain to be used as credentials.
key - the private key to be used as credential.
Throws:
java.security.cert.CertificateException - if certificate reading failed.
java.security.NoSuchAlgorithmException - if certificate or key uses unsupported algorithm.
java.io.IOException - if certificate reading failed.
java.security.GeneralSecurityException

initKeyManagers

public void initKeyManagers(org.bouncycastle.openssl.PasswordFinder finder)
                     throws java.security.cert.CertificateException,
                            java.security.NoSuchAlgorithmException
Initializes the key manager.

Parameters:
finder - the PasswordFinder implementation to use to ask the user for password to access the private key.
Throws:
java.security.cert.CertificateException - if certificate reading failed.
java.io.IOException - if certificate reading failed.
java.security.NoSuchAlgorithmException

initKeyManagers

public void initKeyManagers(java.security.cert.X509Certificate[] chain,
                            java.security.PrivateKey key)
                     throws java.security.cert.CertificateException,
                            java.security.NoSuchAlgorithmException,
                            java.io.IOException
Initializes the key manager.

Parameters:
chain - the certificate chain to be used as credentials.
key - the private key to be used as credential.
Throws:
java.security.cert.CertificateException - if certificate reading failed.
java.security.NoSuchAlgorithmException - if certificate or key uses unsupported algorithm.
java.io.IOException - if certificate reading failed.

getIntervalSecs

public static long getIntervalSecs(java.lang.String intervalBlob)
Parses a string representation of an interval into seconds. Format: n{s,m,h,d} (s=seconds, m=minutes, h=hours, d=days)

Parameters:
intervalBlob - String defining the interval.
Returns:
the seconds calculated from the interval.

getKeyManager

public javax.net.ssl.X509KeyManager getKeyManager()
Returns the internal key managers, only for debugging.

Returns:
the internal key manager in use.

stop

public void stop()
Stops runing updater threads if there is any.