Server class acts as a basic multi-threaded HTTPS
* server.
*
* @version $Revision: 1.31 $
*/
public class CallbackHandler extends BaseServer {
/** Registered jobs */
private Hashtable _jobs;
/**
* Construct a GRAM callback handler with default user
* credentials. Port will be dynamically assigned.
*/
public CallbackHandler()
throws IOException {
super(null, 0);
init();
}
/**
* Construct a GRAM callback handler with specifed credentials
* and given port.
*
* @param cred
* credentials to use. if null default
* user credentials will be used
* @param port
* server port to listen on. if set to 0
* the port will be dynamically assigned
*/
public CallbackHandler(GSSCredential cred, int port)
throws IOException {
super(cred, port);
init();
}
private void init() {
_jobs = new Hashtable();
super.initialize();
setAuthorization(SelfAuthorization.getInstance());
}
/**
* Registers gram job to listen for status updates
* @param job gram job
*/
public void registerJob(GramJob job) {
String id = job.getIDAsString();
_jobs.put(id, job);
}
/**
* Unregisters gram job from listening to status updates
* @param job gram job
*/
public void unregisterJob(GramJob job) {
String id = job.getIDAsString();
_jobs.remove(id);
}
protected GramJob getJob(String url) {
return (GramJob)_jobs.get(url);
}
/**
* Returns number of registered jobs
* @return int number of jobs
*/
public int getRegisteredJobsSize() {
return _jobs.size();
}
public String getURL() {
if (url == null) {
StringBuffer buf = new StringBuffer();
buf.append(getProtocol()).
append("://").
append(getHost()).
append(":").
append(String.valueOf(getPort())).
append("/").
append(String.valueOf(System.currentTimeMillis()));
url = buf.toString();
}
return url;
}
protected void handleConnection(Socket socket) {
GramCallbackHandler gcb = new GramCallbackHandler(this,
socket);
(new Thread(gcb)).start();
}
}
class GramCallbackHandler implements Runnable {
private static Log logger =
LogFactory.getLog(GramCallbackHandler.class.getName());
private CallbackHandler handler;
private Socket socket;
public GramCallbackHandler(CallbackHandler handler,
Socket socket) {
this.handler = handler;
this.socket = socket;
}
/**
* Listen on the server socket for a client, start another thread to
* keep listening on the server socket, then deal with the client.
*/
public void run() {
BufferedWriter out = null;
try {
out = new BufferedWriter(new OutputStreamWriter(socket.getOutputStream()));
try {
CallbackResponse hd =
new CallbackResponse( socket.getInputStream() );
if (hd.protocolVersion != GRAMProtocol.GRAM_PROTOCOL_VERSION) {
throw new Exception("Gram callback protocol version mismatch");
}
GramJob job = handler.getJob( hd.jobManagerUrl );
if (job == null) {
throw new Exception("Not registered with this handler: " +
hd.jobManagerUrl);
}
job.setError( hd.failureCode );
// the exit code needs to be set before the
// status, since setStatus triggers a listener
// notification
job.setExitCode ( hd.exitCode );
job.setStatus( hd.status );
if (job.getStatus() == GramJob.STATUS_DONE ||
job.getStatus() == GramJob.STATUS_FAILED) {
handler.unregisterJob(job);
}
try {
out.write(GRAMProtocol.OKReply());
out.flush();
} catch(IOException ignoreE) {
logger.debug("Ignoring IOException");
}
} catch(AuthorizationException ex) {
logger.debug("Authorization failed", ex);
out.write(GRAMProtocol.ErrorReply(401, "Authorization Failed"));
out.flush();
} catch (Exception ex) {
logger.debug("General error", ex);
out.write(GRAMProtocol.ErrorReply(400, ex.getMessage()));
out.flush();
}
} catch (IOException e) {
logger.debug("IO Error", e);
} finally {
try {
socket.close();
} catch (IOException e) { }
}
}
}
JGlobus-JGlobus-Release-2.1.0/gram/src/main/java/org/globus/gram/Gram.java 0000664 0000000 0000000 00000071550 12411160572 0026132 0 ustar 00root root 0000000 0000000 /*
* Copyright 1999-2006 University of Chicago
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package org.globus.gram;
import java.util.Hashtable;
import java.util.Enumeration;
import java.io.InputStream;
import java.io.OutputStream;
import java.io.IOException;
import java.net.Socket;
import java.net.MalformedURLException;
import org.globus.util.http.HttpResponse;
import org.globus.util.deactivator.Deactivator;
import org.globus.util.deactivator.DeactivationHandler;
import org.globus.util.GlobusURL;
import org.globus.common.ResourceManagerContact;
import org.globus.gram.internal.GRAMProtocol;
import org.globus.gram.internal.GRAMConstants;
import org.globus.gram.internal.GatekeeperReply;
import org.globus.gsi.GSIConstants;
import org.globus.gsi.gssapi.SSLUtil;
import org.globus.gsi.gssapi.GSSConstants;
import org.globus.gsi.gssapi.net.GssSocket;
import org.globus.gsi.gssapi.net.GssSocketFactory;
import org.globus.gsi.gssapi.net.impl.GSIGssOutputStream;
import org.globus.gsi.gssapi.net.impl.GSIGssInputStream;
import org.globus.gsi.gssapi.auth.GSSAuthorization;
import org.globus.gsi.gssapi.auth.IdentityAuthorization;
import org.globus.gsi.gssapi.auth.HostAuthorization;
import org.globus.gsi.gssapi.auth.SelfAuthorization;
import org.globus.gsi.gssapi.auth.NoAuthorization;
import org.gridforum.jgss.ExtendedGSSManager;
import org.gridforum.jgss.ExtendedGSSContext;
import org.ietf.jgss.GSSManager;
import org.ietf.jgss.GSSCredential;
import org.ietf.jgss.GSSException;
import org.ietf.jgss.GSSContext;
import org.ietf.jgss.GSSName;
import org.apache.commons.logging.Log;
import org.apache.commons.logging.LogFactory;
/**
* This is the main class for using the Globus GRAM API
* It implements all of the GRAM API functionality such as
* job submission, canceling, gatekeeper pinging, and job
* signaling. It also allows for callback registering and
* unregistering.
*/
public class Gram {
private static Log logger =
LogFactory.getLog(Gram.class.getName());
private static Socket gatekeeperConnect(GSSCredential cred,
ResourceManagerContact rmc,
boolean doDel,
boolean limitedDelegation)
throws GSSException, GramException {
GSSAuthorization auth = null;
String authDN = rmc.getDN();
if (authDN != null) {
auth = new IdentityAuthorization(authDN);
} else {
auth = HostAuthorization.getInstance();
}
GSSManager manager = ExtendedGSSManager.getInstance();
try {
GSSName name = auth.getExpectedName(cred, rmc.getHostName());
ExtendedGSSContext context =
(ExtendedGSSContext)manager.createContext(name,
GSSConstants.MECH_OID,
cred,
GSSContext.DEFAULT_LIFETIME);
context.requestCredDeleg(doDel);
context.setOption(GSSConstants.DELEGATION_TYPE,
(limitedDelegation) ?
GSIConstants.DELEGATION_TYPE_LIMITED :
GSIConstants.DELEGATION_TYPE_FULL);
GssSocketFactory factory = GssSocketFactory.getDefault();
GssSocket socket =
(GssSocket)factory.createSocket(rmc.getHostName(),
rmc.getPortNumber(),
context);
socket.setAuthorization(NoAuthorization.getInstance());
return socket;
} catch(IOException e) {
throw new GramException(GramException.ERROR_CONNECTION_FAILED, e);
}
}
/** */
private static void checkProtocolVersion(int protocolVersion)
throws GramException {
if (protocolVersion != GRAMProtocol.GRAM_PROTOCOL_VERSION) {
throw new GramException(GramException.VERSION_MISMATCH);
}
}
/**
* @exception GramException
* @param code
*/
private static void checkHttpReply(int code)
throws GramException {
if (code == 200) {
return;
} else if (code == 400) {
throw new GramException(GramException.PROTOCOL_FAILED);
} else if (code == 403) {
throw new GramException(GramException.ERROR_AUTHORIZATION);
} else if (code == 404) {
throw new GramException(GramException.ERROR_SERVICE_NOT_FOUND);
} else if (code == 500) {
throw new GramException(GramException.GATEKEEPER_MISCONFIGURED);
} else {
// from globus code
throw new GramException(GramException.HTTP_UNFRAME_FAILED,
new Exception("Unexpected reply: " +
code));
}
}
/** Returns total number of jobs currently running
* for all credentials -- all callback handlers
*
* @return number of jobs running
*/
public static int getActiveJobs() {
int jobs = 0;
Enumeration e = callbackHandlers.elements();
while(e.hasMoreElements()) {
CallbackHandler handler = (CallbackHandler)e.nextElement();
jobs += handler.getRegisteredJobsSize();
}
return jobs;
}
/** Returns number of jobs currently running
* for a specified credential (one credential one callback handler)
*
* @return number of jobs running for given credential
*/
public static int getActiveJobs(GSSCredential cred) {
if (cred == null) {
throw new IllegalArgumentException("cred == null");
}
CallbackHandler handler = (CallbackHandler)callbackHandlers.get(cred);
return (handler == null) ? 0 : handler.getRegisteredJobsSize();
}
// ----------- GATEKEEPER CALLS ---------------------------
/**
* Performs ping operation on the gatekeeper with
* default user credentials.
* Verifies if the user is authorized to submit a job
* to that gatekeeper.
*
* @throws GramException if an error occurs or user in unauthorized
* @param resourceManagerContact resource manager contact
*/
public static void ping(String resourceManagerContact)
throws GramException, GSSException {
ping(null, resourceManagerContact);
}
/**
* Performs ping operation on the gatekeeper with
* specified user credentials.
* Verifies if the user is authorized to submit a job
* to that gatekeeper.
*
* @throws GramException if an error occurs or user in unauthorized
* @param cred user credentials
* @param resourceManagerContact resource manager contact
*/
public static void ping(GSSCredential cred, String resourceManagerContact)
throws GramException, GSSException {
ResourceManagerContact rmc =
new ResourceManagerContact(resourceManagerContact);
Socket socket = gatekeeperConnect(cred, rmc, false, false);
HttpResponse hd = null;
try {
OutputStream out = socket.getOutputStream();
InputStream in = socket.getInputStream();
String msg = GRAMProtocol.PING(rmc.getServiceName(),
rmc.getHostName());
// send message
out.write(msg.getBytes());
out.flush();
debug("PG SENT:", msg);
// receive reply
hd = new HttpResponse(in);
} catch(IOException e) {
throw new GramException(GramException.ERROR_PROTOCOL_FAILED, e);
} finally {
try { socket.close(); } catch (Exception e) {}
}
debug("PG RECEIVED:", hd);
checkHttpReply(hd.httpCode);
}
/**
* Submits a GramJob to specified gatekeeper as an
* interactive job. Performs limited delegation.
*
* @throws GramException if an error occurs during submisson
* @param resourceManagerContact resource manager contact
* @param job gram job
*/
public static void request(String resourceManagerContact,
GramJob job)
throws GramException, GSSException {
request(resourceManagerContact, job, false);
}
/**
* Submits a GramJob to specified gatekeeper as
* a interactive or batch job. Performs limited delegation.
*
* @throws GramException if an error occurs during submisson
* @param resourceManagerContact resource manager contact
* @param job gram job
* @param batchJob true if batch job, interactive otherwise
*/
public static void request(String resourceManagerContact,
GramJob job,
boolean batchJob)
throws GramException, GSSException {
request(resourceManagerContact, job, batchJob, true);
}
/**
* Submits a GramJob to specified gatekeeper as
* a interactive or batch job.
*
* @throws GramException if an error occurs during submisson
* @param resourceManagerContact
* resource manager contact
* @param job
* gram job
* @param batchJob
* true if batch job, interactive otherwise.
* @param limitedDelegation
* true for limited delegation, false for full delegation.
* limited delegation should be the default option.
*/
public static void request(String resourceManagerContact,
GramJob job,
boolean batchJob,
boolean limitedDelegation)
throws GramException, GSSException {
GSSCredential cred = getJobCredentials(job);
// at this point proxy cannot be null
String callbackURL = null;
CallbackHandler handler = null;
if (!batchJob) {
handler = initCallbackHandler(cred);
callbackURL = handler.getURL();
logger.debug("Callback url: " + callbackURL);
} else {
callbackURL = "\"\"";
}
ResourceManagerContact rmc =
new ResourceManagerContact(resourceManagerContact);
Socket socket = gatekeeperConnect(cred, rmc, true, limitedDelegation);
GatekeeperReply hd = null;
try {
OutputStream out = socket.getOutputStream();
InputStream in = socket.getInputStream();
String msg = GRAMProtocol.REQUEST(rmc.getServiceName(),
rmc.getHostName(),
GRAMConstants.STATUS_ALL,
callbackURL,
job.getRSL());
// send message
out.write(msg.getBytes());
out.flush();
debug("REQ SENT:", msg);
// receive reply
hd = new GatekeeperReply(in);
} catch(IOException e) {
throw new GramException(GramException.ERROR_PROTOCOL_FAILED, e);
} finally {
try { socket.close(); } catch (Exception e) {}
}
debug("REQ RECEIVED:", hd);
// must be 200
checkHttpReply(hd.httpCode);
// protocol version must match
checkProtocolVersion(hd.protocolVersion);
if (hd.status == 0 || hd.status == GramException.WAITING_FOR_COMMIT) {
try {
job.setID( hd.jobManagerUrl );
} catch(MalformedURLException ex) {
throw new GramException(GramException.INVALID_JOB_CONTACT, ex);
}
if (!batchJob) handler.registerJob(job);
if (hd.status == GramException.WAITING_FOR_COMMIT) {
throw new WaitingForCommitException();
}
} else {
throw new GramException(hd.status);
}
}
// --------------------- JOB MANAGER CALLS --------------------------------
private static GatekeeperReply jmConnect(GSSCredential cred,
GlobusURL jobURL,
String msg)
throws GramException, GSSException {
GSSManager manager = ExtendedGSSManager.getInstance();
GatekeeperReply reply = null;
GssSocket socket = null;
try {
ExtendedGSSContext context =
(ExtendedGSSContext)manager.createContext(null,
GSSConstants.MECH_OID,
cred,
GSSContext.DEFAULT_LIFETIME);
context.setOption(GSSConstants.GSS_MODE,
GSIConstants.MODE_SSL);
GssSocketFactory factory = GssSocketFactory.getDefault();
socket = (GssSocket)factory.createSocket(jobURL.getHost(),
jobURL.getPort(),
context);
socket.setAuthorization(SelfAuthorization.getInstance());
OutputStream out = socket.getOutputStream();
InputStream in = socket.getInputStream();
out.write(msg.getBytes());
out.flush();
debug("JM SENT:", msg);
reply = new GatekeeperReply(in);
} catch(IOException e) {
throw new GramException(GramException.ERROR_CONNECTION_FAILED, e);
} finally {
if (socket != null) {
try { socket.close(); } catch (Exception e) {}
}
}
debug("JM RECEIVED:", reply);
// must be 200 otherwise throw exception
checkHttpReply(reply.httpCode);
// protocol version must match
checkProtocolVersion(reply.protocolVersion);
return reply;
}
/**
* Frames and wraps a token according to the GRAM "renew" protocol
* for use in a GSI delegation handshake. The input token is framed with
* a 4 byte big-endian token length header, and the resulting framed token
* wrapped in SSL mode (GSSContext's GSS_MODE option set to MODE_SSL)
*
* @param c The context used to wrap the token
* @param token The unaltered output of the context's initDelegation
* @throws GSSException if an error occurs during token wrapping or if
* context is insufficient
* @return a wrapped, framed token to send to globus job manager
*/
private static byte[] produceRenewToken(ExtendedGSSContext c,
byte[] token)
throws GSSException {
if (!GSIConstants.MODE_SSL.equals(c.getOption(GSSConstants.GSS_MODE))) {
throw new GSSException(GSSException.NO_CONTEXT);
}
byte[] framedToken = new byte[token.length + 4];
SSLUtil.writeInt(token.length, framedToken, 0);
System.arraycopy(token, 0, framedToken, 4, token.length);
return c.wrap(framedToken, 0, framedToken.length, null);
}
/**
* Unwraps and discards frame of a token according to the GRAM "renew"
* protocol for use in a GSI delegation handshake. The input token is
* received from a globus job manager and comes wrapped (SSL mode) and
* framed with a 4 byte big-endian token length header.
*
* @param c The context to use to unwrap the token
* @param wrappedToken Token received from job manager during GSI handshake
* @throws GSSException if an error occurs during token wrapping or if
* context is insufficient
* @return a token that can be passed to the context's next initDelegation
*/
private static byte[] consumeRenewToken(ExtendedGSSContext c,
byte[] wrappedToken)
throws GSSException {
if (!GSIConstants.MODE_SSL.equals(c.getOption(GSSConstants.GSS_MODE))) {
throw new GSSException(GSSException.NO_CONTEXT);
}
byte[] framedToken = c.unwrap(wrappedToken, 0,
wrappedToken.length, null);
byte[] token = new byte[framedToken.length - 4];
System.arraycopy(framedToken, 4, token, 0, framedToken.length - 4);
return token;
}
/**
* Completes a GSI delegation handshake with a globus job manager
* that has agreed to a (previously sent) GRAM "renew" request. After
* the job manager receives the last token in the handshake, it responds
* with a message following the GRAM protocol indicating delegation success
* or failure.
*
* @param context Previously established context with job manager
* @param newCred The credential used to generate a new delegated proxy
* @param out Stream used to send messages to job manager
* @param in Stream used to receive messages from job manager
* @throws GSSException if an error occurs during token wrapping/unwrapping
* @throws IOException if a communication error occurs
* @return the GRAM response message indicating delegation status
*/
private static GatekeeperReply renewDelegationHandshake(
ExtendedGSSContext context,
GSSCredential newCred,
GSIGssOutputStream out,
GSIGssInputStream in)
throws GSSException, IOException {
byte [] input = new byte[0];
byte [] output = null;
do {
output = produceRenewToken(context, context.initDelegation(
newCred, null, 0, input,
0, input.length));
out.writeToken(output);
if (!context.isDelegationFinished()) {
input = consumeRenewToken(context, in.readHandshakeToken());
}
} while (!context.isDelegationFinished());
GatekeeperReply reply = new GatekeeperReply(in);
return reply;
}
/**
* Requests that a globus job manager accept newly delegated credentials.
Uses limited delegation.
*
* @param job The job whose credentials are to be renewed/refreshed
* @param newCred The credentials to use in the delegation process
* @throws GSSException if a GSSAPI error occurs
* @throws GramException if a connection/communication error occurs or if
* delegation failed
*/
public static void renew(GramJob job, GSSCredential newCred)
throws GramException, GSSException {
renew(job, newCred, true);
}
/**
* Requests that a globus job manager accept newly delegated credentials.
* This consists of a "renew" message in the GRAM protocol followed by a
* GSI delegation handshake using wrapped/framed tokens. Upon successful
* delegation, the job's credentials are set to the ones used in delegation.
*
* @param job The job whose credentials are to be renewed/refreshed
* @param newCred The credentials to use in the delegation process
* @param limitedDelegation Whether to use a full or limited proxy
* @throws GSSException if a GSSAPI error occurs
* @throws GramException if a connection/communication error occurs or if
* delegation failed
*/
public static void renew(GramJob job, GSSCredential newCred,
boolean limitedDelegation)
throws GramException, GSSException {
GSSCredential currentCred = getJobCredentials(job);
GlobusURL jobURL = job.getID();
if (jobURL == null) {
throw new GramException(GramException.ERROR_JOB_CONTACT_NOT_SET);
}
GSSManager manager = ExtendedGSSManager.getInstance();
GssSocket socket = null;
try {
ExtendedGSSContext context =
(ExtendedGSSContext)manager.createContext(null,
GSSConstants.MECH_OID, currentCred,
GSSContext.DEFAULT_LIFETIME);
context.setOption(GSSConstants.GSS_MODE, GSIConstants.MODE_SSL);
context.setOption(GSSConstants.DELEGATION_TYPE,
(limitedDelegation) ?
GSIConstants.DELEGATION_TYPE_LIMITED :
GSIConstants.DELEGATION_TYPE_FULL);
GssSocketFactory factory = GssSocketFactory.getDefault();
socket = (GssSocket)factory.createSocket(jobURL.getHost(),
jobURL.getPort(), context);
socket.setAuthorization(SelfAuthorization.getInstance());
OutputStream out = socket.getOutputStream();
InputStream in = socket.getInputStream();
// send GRAM protocol "renew"
String msg = GRAMProtocol.RENEW(jobURL.getURL(), jobURL.getHost());
out.write(msg.getBytes());
out.flush();
debug("RENEW SENT:", msg);
GatekeeperReply reply = new GatekeeperReply(in);
debug("RENEW RECEIVED:", reply);
// proceed w/ delegation only if response looks ok
checkHttpReply(reply.httpCode);
if (reply.failureCode == GramException.JOB_CONTACT_NOT_FOUND) {
throw new GramException(GramException.JOB_CONTACT_NOT_FOUND);
}
reply = renewDelegationHandshake(context, newCred,
(GSIGssOutputStream) out,
(GSIGssInputStream) in);
debug("RENEW RECEIVED: ", reply);
checkHttpReply(reply.httpCode);
if (reply.failureCode == GramException.DELEGATION_FAILED) {
throw new GramException(GramException.DELEGATION_FAILED);
}
job.setCredentials(newCred);
}
catch (IOException e) {
throw new GramException(GramException.ERROR_CONNECTION_FAILED, e);
} finally {
if (socket != null) {
try { socket.close(); } catch (Exception e) {}
}
}
}
/**
* This function cancels an already running job.
*
* @throws GramException if an error occurs during cancel
* @param job job to be canceled
*/
public static void cancel(GramJob job)
throws GramException, GSSException {
GlobusURL jobURL = job.getID();
if (jobURL == null) {
throw new GramException(GramException.ERROR_JOB_CONTACT_NOT_SET);
}
GSSCredential cred = getJobCredentials(job);
String msg = GRAMProtocol.CANCEL_JOB(jobURL.getURL(),
jobURL.getHost());
GatekeeperReply reply = jmConnect(cred,
jobURL,
msg);
if (reply.failureCode != 0) {
throw new GramException(reply.failureCode);
}
// this might need to be fixed
// if (handler != null) handler.unregisterJob(jobContact);
}
/**
* This function updates the status of a job (within the job object),
* and throws an exception if the status is not OK. If the
* job manager cannot be contacted the job error code is
* set to GramException.ERROR_CONTACTING_JOB_MANAGER and an
* exception with the same error code is thrown.
*
* @throws GramException if an error occurs during status update.
* @param job the job whose status is to be updated.
*/
public static void jobStatus(GramJob job)
throws GramException, GSSException {
GlobusURL jobURL = job.getID();
GSSCredential cred = getJobCredentials(job);
String msg = GRAMProtocol.STATUS_POLL(jobURL.getURL(),
jobURL.getHost());
GatekeeperReply hd = null;
try {
hd = jmConnect(cred, jobURL, msg);
} catch(GramException e) {
// this is exactly what C does
if (e.getErrorCode() == GramException.ERROR_CONNECTION_FAILED) {
job.setError( GramException.ERROR_CONTACTING_JOB_MANAGER );
e.setErrorCode( GramException.ERROR_CONTACTING_JOB_MANAGER );
}
throw e;
}
// We didn't seem to care much about setting things
// before the status here, presumably because of the
// assumption that, when polling, listeners are not used
// on the GramJob. I disagree. There is no good reason
// why that couldn't happen
job.setExitCode( hd.exitCode );
job.setError( hd.failureCode );
job.setStatus( hd.status );
}
/**
* This function sends a signal to a job.
*
* @throws GramException if an error occurs during cancel
* @param job the signaled job
* @param signal type of the signal
* @param arg argument of the signal
*/
public static int jobSignal(GramJob job, int signal, String arg)
throws GramException, GSSException {
GlobusURL jobURL = job.getID();
GSSCredential cred = getJobCredentials(job);
String msg = GRAMProtocol.SIGNAL(jobURL.getURL(),
jobURL.getHost(),
signal,
arg);
GatekeeperReply hd = null;
hd = jmConnect(cred, jobURL, msg);
switch(signal) {
case GramJob.SIGNAL_PRIORITY:
return hd.failureCode;
case GramJob.SIGNAL_STDIO_SIZE:
case GramJob.SIGNAL_STDIO_UPDATE:
case GramJob.SIGNAL_COMMIT_REQUEST:
case GramJob.SIGNAL_COMMIT_EXTEND:
case GramJob.SIGNAL_COMMIT_END:
case GramJob.SIGNAL_STOP_MANAGER:
if (hd.failureCode != 0 && hd.status == GramJob.STATUS_FAILED) {
throw new GramException(hd.failureCode);
} else if (hd.failureCode == 0 && hd.jobFailureCode != 0) {
job.setError( hd.jobFailureCode );
job.setStatus(GramJob.STATUS_FAILED);
return hd.failureCode;
} else {
job.setStatus(hd.status);
return 0;
}
default:
job.setStatus( hd.status );
job.setError( hd.failureCode );
return 0;
}
}
/**
* This function registers the job for status updates.
*
* @throws GramException if an error occurs during registration
* @param job the job
*/
public static void registerListener(GramJob job)
throws GramException, GSSException {
CallbackHandler handler;
GSSCredential cred = getJobCredentials(job);
handler = initCallbackHandler(cred);
registerListener(job, handler);
}
public static void registerListener(GramJob job, CallbackHandler handler)
throws GramException, GSSException {
String callbackURL;
GlobusURL jobURL;
GSSCredential cred = getJobCredentials(job);
callbackURL = handler.getURL();
jobURL = job.getID();
String msg = GRAMProtocol.REGISTER_CALLBACK(jobURL.getURL(),
jobURL.getHost(),
GRAMConstants.STATUS_ALL,
callbackURL);
GatekeeperReply hd = jmConnect(cred, jobURL, msg);
if (hd.failureCode == 0) {
handler.registerJob(job);
} else {
throw new GramException(hd.failureCode);
}
}
/**
* This function unregisters the job from callback
* listener. The job status will not be updated.
*
* @throws GramException if an error occurs during unregistering
* @param job the job
*/
public static void unregisterListener(GramJob job)
throws GramException, GSSException {
CallbackHandler handler;
GSSCredential cred = getJobCredentials(job);
handler = initCallbackHandler(cred);
unregisterListener(job, handler);
}
public static void unregisterListener(GramJob job, CallbackHandler handler)
throws GramException, GSSException {
GlobusURL jobURL;
GSSCredential cred = getJobCredentials(job);
jobURL = job.getID();
String msg = GRAMProtocol.UNREGISTER_CALLBACK(jobURL.getURL(),
jobURL.getHost(),
handler.getURL());
GatekeeperReply reply = jmConnect(cred, jobURL, msg);
handler.unregisterJob(job);
}
/**
* Deactivates all callback handlers.
*/
public static void deactivateAllCallbackHandlers() {
synchronized(callbackHandlers) {
Enumeration e = callbackHandlers.elements();
while(e.hasMoreElements()) {
CallbackHandler handler = (CallbackHandler)e.nextElement();
handler.shutdown();
}
callbackHandlers.clear();
}
}
/**
* Deactivates a callback handler for a given credential.
*
* @param cred the credential of the callback handler.
* @return the callback handler that was deactivated. Null,
* if no callback handler is associated with the credential
*/
public static CallbackHandler deactivateCallbackHandler(GSSCredential cred) {
if (cred == null) {
return null;
}
CallbackHandler handler =
(CallbackHandler)callbackHandlers.remove(cred);
if (handler == null) {
return null;
}
handler.shutdown();
return handler;
}
// -------- INTERNAL CALLBACK STUFF -----------------------
/** */
protected static Hashtable callbackHandlers = new Hashtable();
static {
Deactivator.registerDeactivation(new DeactivationHandler() {
public void deactivate() {
Gram.deactivateAllCallbackHandlers();
}
});
}
/** */
private static synchronized CallbackHandler initCallbackHandler(GSSCredential cred)
throws GSSException, GramException {
if (cred == null) {
throw new IllegalArgumentException("cred == null");
}
CallbackHandler handler = (CallbackHandler)callbackHandlers.get(cred);
if (handler == null) {
try {
handler = new CallbackHandler(cred, 0);
// sets socket timeout to max cred lifetime
handler.setTimeout(cred.getRemainingLifetime());
callbackHandlers.put(cred, handler);
} catch(IOException e) {
throw new GramException(GramException.INIT_CALLBACK_HANDLER_FAILED, e);
}
}
return handler;
}
/** */
private static GSSCredential getJobCredentials(GramJob job)
throws GSSException {
GSSCredential cred = job.getCredentials();
if (cred == null) {
GSSManager manager = ExtendedGSSManager.getInstance();
cred = manager.createCredential(GSSCredential.INITIATE_AND_ACCEPT);
job.setCredentials(cred);
}
return cred;
}
// --------- DEBUG CONVINIENCE FUNCTIONS ------------
/**
* Debug function for displaying the gatekeeper reply.
*/
private static void debug(String header, GatekeeperReply reply) {
if (logger.isTraceEnabled()) {
logger.trace(header);
logger.trace(reply.toString());
}
}
/**
* Debug function for displaying HTTP responses.
*/
private static void debug(String header, HttpResponse response) {
if (logger.isTraceEnabled()) {
logger.trace(header);
logger.trace(response.toString());
}
}
/** A general debug message that prints the header and msg
* when the debug level is smaler than 3
*
* @param header The header to be printed
* @param msg The message to be printed
*/
private static void debug(String header, String msg) {
if (logger.isTraceEnabled()) {
logger.trace(header);
logger.trace(msg);
}
}
}
JGlobus-JGlobus-Release-2.1.0/gram/src/main/java/org/globus/gram/GramAttributes.java 0000664 0000000 0000000 00000026137 12411160572 0030202 0 ustar 00root root 0000000 0000000 /**
* $Id: GramAttributes.java,v 1.9 2006/04/09 05:56:59 gawor Exp $
*/
/*
* Copyright 1999-2006 University of Chicago
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package org.globus.gram;
import java.util.List;
import java.util.Map;
import org.globus.rsl.RslAttributes;
import org.globus.rsl.RslNode;
import org.globus.rsl.ParseException;
/**
* A convienience class for operating on GRAM-specific RSL attributes.
* Please note the attribute values for attributes such as setStdout,
* setStderr, setStdin, setDirectory, setExecutable, etc. are treated
* as single arguments. In case the value contains a RSL variable,
* the variable will not be properly resolved. For example, if you
* set the stdout to:
*
* atts.setStdout("$(MY_URL)/bar");
* atts.addEnvVariable("MY_URL", "http://foo");
*
* the resulting rsl will look like:
*
* &("stdout"="$(MY_URL)/hello")("environment"=("MY_URL" "http://foo"))
*
* Since the "$(MY_URL)/hello" is in double quotes it will be treated as
* a single string and the variable will never be resolved. The parser
* will set "stdout" to "$(MY_URL)/hello" instead of "http://foo/hello".
*/
public class GramAttributes extends RslAttributes {
public static final int JOBTYPE_SINGLE = 1;
public static final int JOBTYPE_MULTIPLE = 2;
public static final int JOBTYPE_MPI = 3;
public static final int JOBTYPE_CONDOR = 4;
/**
* Constructs a new, empty GramAttributes object.
*/
public GramAttributes() {
super();
}
/**
* Constructs a new GramAttributes object initialized with
* the specified RSL string.
*
* @param rsl the rsl string to initialize the class with.
* @throws ParseException if the rsl cannot be parsed.
*/
public GramAttributes(String rsl) throws ParseException {
super(rsl);
}
/**
* Constructs a new GramAttributes object initialized with
* the specified RSL parse tree.
*
* @param rslTree the rsl parse tree to initialize the class with.
*/
public GramAttributes(RslNode rslTree) {
super(rslTree);
}
/**
* Specify the name of the executable to run
*
* @param executable the name of the executable
*/
public void setExecutable(String executable) {
set("executable", executable);
}
/**
* Return executable name
*
* @return executable
*/
public String getExecutable() {
return getSingle("executable");
}
/**
* Specify the directory path the executable will be run in
*
* @param directory the directory path on the submission machine
*/
public void setDirectory(String directory) {
set("directory", directory);
}
/**
* Return directory path
*
* @return directory
*/
public String getDirectory() {
return getSingle("directory");
}
/**
* Specify the location to redirect stdout on the submission machine
*
* @param stdout the location to redirect stdout on the submission machine
*/
public void setStdout(String stdout) {
set("stdout", stdout);
}
/**
* Return the location used to redirect stdout on the submission machine
*
* @return stdout
*/
public String getStdout() {
return getSingle("stdout");
}
/**
* Specify the location to redirect stderr on the submission machine
*
* @param stderr the location to redirect stderr on the submission machine
*/
public void setStderr(String stderr) {
set("stderr", stderr);
}
/**
* Return the location used to redirect stderr on the submission machine
*
* @return stderr
*/
public String getStderr() {
return getSingle("stderr");
}
/**
* Specify the location to redirect stdin on the submission machine
*
* @param stdin the location to redirect stdin on the submission machine
*/
public void setStdin(String stdin) {
set("stdin", stdin);
}
/**
* Return the location used to redirect stdin on the submission machine
*
* @return stdin
*/
public String getStdin() {
return getSingle("stdin");
}
/**
* Sets the dryrun parameter.
*
* @param enable true to enable dryrun, false otherwise.
*/
public void setDryRun(boolean enable) {
set("dryrun", (enable) ? "yes" : "no");
}
/**
* Checks if dryryn is enabled.
*
* @return true only if dryrun is enabled. False,
* otherwise.
*/
public boolean isDryRun() {
String run = getSingle("dryrun");
if (run == null) return false;
if (run.equalsIgnoreCase("yes")) return true;
return false;
}
/**
* Specify the queue name to be used for this job
*
* @param queue the queue name to be used for this job
*/
public void setQueue(String queue) {
set("queue", queue);
}
/**
* Return the queue name used for this job
*
* @return queue
*/
public String getQueue() {
return getSingle("queue");
}
/**
* Specify the project to be charged for this job
*
* @param project the project to be charged for this job
*/
public void setProject(String project) {
set("project", project);
}
/**
* Return the project name charged for this job
*
* @return project
*/
public String getProject() {
return getSingle("project");
}
/**
* Sets a job type.
*
* @param jobType type of the job: One of the following:
* SINGLE, MULTIPLE, MPI, or CONDOR.
*/
public void setJobType(int jobType) {
String type = null;
switch(jobType) {
case JOBTYPE_SINGLE:
type = "single"; break;
case JOBTYPE_MULTIPLE:
type = "multiple"; break;
case JOBTYPE_MPI:
type = "mpi"; break;
case JOBTYPE_CONDOR:
type = "condor"; break;
}
if (type != null) {
set("jobtype", type);
}
}
/**
* Returns type of the job.
*
* @return job type. -1 if not set or job type
* is unknown.
*/
public int getJobType() {
String jobType = getSingle("jobtype");
if (jobType == null) return -1;
if (jobType.equalsIgnoreCase("single")) {
return JOBTYPE_SINGLE;
} else if (jobType.equalsIgnoreCase("multiple")) {
return JOBTYPE_MULTIPLE;
} else if (jobType.equalsIgnoreCase("mpi")) {
return JOBTYPE_MPI;
} else if (jobType.equalsIgnoreCase("condor")) {
return JOBTYPE_CONDOR;
} else {
return -1;
}
}
/**
* Specify the minimum memory limit for this job
*
* @param minmemory the minimum memory limit for this job
*/
public void setMinMemory(int minmemory) {
set("minmemory", String.valueOf(minmemory));
}
/**
* Return the minimum memory limit set for the job
*
* @return minmemory
*/
public int getMinMemory() {
String value = getSingle("minmemory");
try {
return Integer.parseInt(value);
} catch(Exception e) {
return -1;
}
}
/**
* Specify the nuber of processors to be used by the current executable
*
* @param numprocs the number of processors to use
*/
public void setNumProcs(int numprocs) {
set("count", String.valueOf(numprocs));
}
/**
* Return the number of processors
*
* @return numprocs
*/
public int getNumProcs() {
String value = getSingle("count");
try {
return Integer.parseInt(value);
} catch(Exception e) {
return -1;
}
}
/**
* Specify the maximum wall time limit for this job
*
* @param maxwalltime the maximum wall time limit for this job
*/
public void setMaxWallTime(int maxwalltime) {
set("maxwalltime", String.valueOf(maxwalltime));
}
/**
* Return the maximum wall time limit set for the job
*
* @return maxwalltime
*/
public int getMaxWallTime() {
String value = getSingle("maxwalltime");
try {
return Integer.parseInt(value);
} catch(Exception e) {
return -1;
}
}
/**
* Specify the maximum cpu time limit for this job
*
* @param maxcputime the maximum cpu time limit for this job
*/
public void setMaxCPUTime(int maxcputime) {
set("maxcputime", String.valueOf(maxcputime));
}
/**
* Return the maximum cpu time limit set for the job
*
* @return maxcputime
*/
public int getMaxCPUTime() {
String value = getSingle("maxcputime");
try {
return Integer.parseInt(value);
} catch(Exception e) {
return -1;
}
}
/**
* Specify the maximum memory limit for this job
*
* @param maxmemory the maximum memory limit for this job
*/
public void setMaxMemory(int maxmemory) {
set("maxmemory", String.valueOf(maxmemory));
}
/**
* Return the maximum memory limit set for the job
*
* @return maxmemory
*/
public int getMaxMemory() {
String value = getSingle("maxmemory");
try {
return Integer.parseInt(value);
} catch(Exception e) {
return -1;
}
}
/**
* Adds a single argument.
*
* @param argument an argument to add.
* It will be treated as a single argument.
*/
public void addArgument(String argument) {
add("arguments", argument);
}
/**
* Removes a specific argument from the argument list.
*
* @param argument argument to remove.
* @return true if the argument was removed,
* false otherwise.
*/
public boolean deleteArgument(String argument) {
return remove("arguments", argument);
}
/**
* Returns a list of arguments.
*
* @return list of arguments.
*/
public List getArguments() {
return getMulti("arguments");
}
/**
* Adds an environment variable.
*
* @param varName the variable name.
* @param value the value of the variable.
*/
public void addEnvVariable(String varName, String value) {
addMulti("environment", new String [] {varName, value});
}
/**
* Removes a specific environment variable from the
* environment list.
*
* @param varName name of the variable to remove.
* @return true if the environment variables was removed,
* false otherwise.
*/
public boolean deleteEnvVariable(String varName) {
return removeMap("environment", varName);
}
/**
* Returns a variable/value pair list of environment
* variables.
*
* @return the association list of environment
* variables.
*/
public Map getEnvironment() {
return getMap("environment");
}
}
JGlobus-JGlobus-Release-2.1.0/gram/src/main/java/org/globus/gram/GramException.java 0000664 0000000 0000000 00000005346 12411160572 0030011 0 ustar 00root root 0000000 0000000 /*
* Copyright 1999-2006 University of Chicago
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package org.globus.gram;
import java.util.ResourceBundle;
import java.util.MissingResourceException;
import java.util.Locale;
import org.globus.common.ChainedException;
import org.globus.gram.internal.GRAMProtocolErrorConstants;
/**
* This class defeines the Exceptions which are thrown by the various
* Gram and GramJob methods.
* This class contains many definitions for error codes of the
* form ERROR_* in addition to SUCCESS. The error codes are a superset
* of those defined for the GRAM C client. Additional error codes
* are added for errors that can occur in the Java code.
*
*/
public class GramException extends ChainedException implements GRAMProtocolErrorConstants {
private static ResourceBundle resources;
static {
try {
resources = ResourceBundle.getBundle("org.globus.gram.internal.errors",
Locale.getDefault());
} catch (MissingResourceException mre) {
System.err.println("org.globus.gram.internal.gramerrors.properties not found");
}
}
public static final int SUCCESS = 0;
public static final int INIT_CALLBACK_HANDLER_FAILED = 1000;
public static final int ERROR_JOB_CONTACT_NOT_SET = 1003;
/** */
public static final int CUSTOM_ERROR = 9999;
/** */
protected int errorCode;
/** */
public GramException() {
super( getMessage( SUCCESS ) );
errorCode = SUCCESS;
}
/** */
public GramException(int ec) {
super( getMessage( ec ) );
errorCode = ec;
}
public GramException(String msg) {
super( msg );
errorCode = CUSTOM_ERROR;
}
public GramException(int ec, Throwable ex) {
super( getMessage( ec ), ex );
errorCode = ec;
}
/** */
public void setErrorCode(int ec) {
errorCode = ec;
}
/** */
public int getErrorCode() {
return errorCode;
}
public static String getMessage(int errorCode) {
if (errorCode == SUCCESS) {
return "Success";
} else {
if (resources == null) return "Error code: " + errorCode;
try {
return resources.getString(String.valueOf(errorCode));
} catch (MissingResourceException mre) {
return "Error code: " + errorCode;
}
}
}
}
JGlobus-JGlobus-Release-2.1.0/gram/src/main/java/org/globus/gram/GramJob.java 0000664 0000000 0000000 00000031742 12411160572 0026564 0 ustar 00root root 0000000 0000000 /*
* Copyright 1999-2006 University of Chicago
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package org.globus.gram;
import java.util.Vector;
import java.net.MalformedURLException;
import org.globus.util.GlobusURL;
import org.globus.gram.internal.GRAMConstants;
import org.ietf.jgss.GSSException;
import org.ietf.jgss.GSSCredential;
/**
* This class represents a simple gram job. It allows
* for submitting a job to a gatekeeper, canceling it,
* sending a signal command and registering and
* unregistering from callback.
*/
public class GramJob implements GRAMConstants {
/* holds job credentials */
private GSSCredential credential;
private String rsl;
private GlobusURL id;
protected int status;
protected int error;
protected int exitCode;
private Vector listeners;
/**
* Creates a gram job with specified rsl with
* default user credentials.
*
* @param rsl resource specification string
*/
public GramJob(String rsl) {
this.rsl = rsl;
this.credential = null;
this.id = null;
this.status = 0;
this.exitCode = Integer.MIN_VALUE;
}
/**
* Creates a gram job with specified rsl and
* user credentials.
*
* @param cred user credentials
* @param rsl resource specification string
*/
public GramJob(GSSCredential cred, String rsl) {
this.rsl = rsl;
this.credential = cred;
this.id = null;
this.status = 0;
}
/**
* Add a listener to the GramJob. The listener will be notified whenever
* the status of the GramJob changes.
*
* @param listener The object that wishes to receive status updates.
* @see org.globus.gram.GramJobListener
*/
public void addListener(GramJobListener listener) {
if (listeners == null) listeners = new Vector();
listeners.addElement(listener);
}
/**
* Remove a listener from the GramJob. The listener will no longer be
* notified of status changes for the GramJob.
*
* @param listener The object that wishes to stop receiving status updates.
* @see org.globus.gram.GramJobListener
*/
public void removeListener(GramJobListener listener) {
if (listeners == null) return;
listeners.removeElement(listener);
}
/**
* Gets the rsl of this job.
*
* @return resource specification string
*/
public String getRSL() {
return rsl;
}
/**
* Gets the credentials of this job.
*
* @return job credentials. If null none were set.
*/
public GSSCredential getCredentials() {
return this.credential;
}
/**
* Sets credentials of the job
*
* @param credential user credentials
*/
public void setCredentials(GSSCredential credential) {
this.credential = credential;
}
/**
* Sets the job handle. It is automatically
* set after the job successfuly has been
* successfuly started on a gatekeeper.
*
* @param jobUrl job handle in form of url
* @throws MalformedURLException if the job
* handle is invalid
*/
public void setID(String jobUrl)
throws MalformedURLException {
this.id = new GlobusURL(jobUrl);
}
/**
* Gets the job handle of this job.
*
* @return job handle
*/
public GlobusURL getID() {
return id;
}
/**
* Gets the job handle of this job and
* returns it as a string representaion.
*
* @return job handle as string
*/
public String getIDAsString() {
if (id == null) return null;
return id.getURL();
}
/**
* Gets the current status of this job.
*
* @return current job status
*/
public int getStatus() {
return status;
}
/**
* Sets the status of the job.
* User should not call this function.
*
* @param status status of the job
*/
protected void setStatus(int status) {
if (this.status == status) return;
this.status = status;
if (listeners == null) return;
int size = listeners.size();
for(int i=0;i0 and {@link #isExitCodeValid()} will return
* false.
* @return the job exit code or 0 if the service did
* not provide one or the job has not completed.
*/
public int getExitCode() {
return exitCode == Integer.MIN_VALUE ? 0 : exitCode;
}
/**
* Can be used to determine whether the job exit code * returned by {@link #getExitCode()} is valid.
*This method will return false if either
* of the following is true:
*
Notification of state changes for GRAM jobs is supported by the user's class adding itself as a listener to a GramJob. See the example below for more details.
public class GramExample implements GramJobListener {
private someMethod() {
...
String gramContact = "pitcairn.mcs.anl.gov:6722:...";
String rsl = "&(executable=...)(...)(...)";
try {
Gram.ping(gramContact);
} catch (GramException e) {
// can't submit
return;
}
job.addListener(this);
// add this class as a listener for state changes
GramJob job = null;
try {
job = new GramJob(rsl);
Gram.request(gramContact,job);
} catch (GramException e) {
// request failed
...
}
...
try {
job.cancel();
} catch (GramException e) {
// cancel failed
...
}
}
// this method must be implemented in order for the class to
// implement the GramJobListener class
public stateChanged(GramJob job) {
System.out.println("Job state change \n" +
" ID : " + job.getID() + "\n" +
" State: " + job.getStateAsString());
}
}
QUIT command
* will be sent but the client will not wait for the
* server's reply. If false, the client will block
* for the server's reply.
**/
public void close(boolean ignoreQuitReply)
throws IOException, ServerException {
try {
if (ignoreQuitReply) {
controlChannel.write(Command.QUIT);
} else {
controlChannel.execute(Command.QUIT);
}
} catch (FTPReplyParseException rpe) {
throw ServerException.embedFTPReplyParseException(rpe);
} catch (UnexpectedReplyCodeException urce) {
throw ServerException.embedUnexpectedReplyCodeException(
urce,
"Server refused closing");
} finally {
try {
controlChannel.close();
} finally {
localServer.close();
}
}
}
/**
* Returns true if the given feature is supported by remote server,
* false otherwise.
*
* @return true if the given feature is supported by remote server,
* false otherwise.
*/
public boolean isFeatureSupported(String feature)
throws IOException, ServerException {
return getFeatureList().contains(feature);
}
/**
* Returns list of features supported by remote server.
* @return list of features supported by remote server.
*/
public FeatureList getFeatureList() throws IOException, ServerException {
if (this.session.featureList != null) {
return this.session.featureList;
}
// TODO: this can also be optimized. Instead of parsing the
// reply after it is reveiced, we can parse it as it is
// received.
Reply featReply = null;
try {
featReply = controlChannel.execute(Command.FEAT);
if (featReply.getCode() != 211) {
throw ServerException.embedUnexpectedReplyCodeException(
new UnexpectedReplyCodeException(featReply),
"Server refused returning features");
}
} catch (FTPReplyParseException rpe) {
throw ServerException.embedFTPReplyParseException(rpe);
} catch (UnexpectedReplyCodeException urce) {
throw ServerException.embedUnexpectedReplyCodeException(
urce,
"Server refused returning features");
}
this.session.featureList = new FeatureList(featReply.getMessage());
return session.featureList;
}
/**
* Sets remote server to passive server mode.
* @return the address at which the server is listening.
*/
public HostPort setPassive() throws IOException, ServerException {
Reply reply = null;
try {
reply = controlChannel.execute(
(controlChannel.isIPv6()) ? Command.EPSV : Command.PASV);
} catch (UnexpectedReplyCodeException urce) {
throw ServerException.embedUnexpectedReplyCodeException(urce);
} catch (FTPReplyParseException rpe) {
throw ServerException.embedFTPReplyParseException(rpe);
}
String pasvReplyMsg = null;
pasvReplyMsg = reply.getMessage();
int openBracket = pasvReplyMsg.indexOf("(");
int closeBracket = pasvReplyMsg.indexOf(")", openBracket);
String bracketContent =
pasvReplyMsg.substring(openBracket + 1, closeBracket);
this.session.serverMode = Session.SERVER_PASSIVE;
HostPort hp = null;
if (controlChannel.isIPv6()) {
hp = new HostPort6(bracketContent);
// since host information might be null
// fill it it
if (hp.getHost() == null) {
((HostPort6)hp).setVersion(HostPort6.IPv6);
((HostPort6)hp).setHost(controlChannel.getHost());
}
} else {
hp = new HostPort(bracketContent);
}
this.session.serverAddress = hp;
return hp;
}
/**
* Sets remote server active, telling it to connect to the given
* address.
* @param hostPort the address to which the server should connect
*/
public void setActive(HostPort hostPort)
throws IOException, ServerException {
Command cmd = new Command((controlChannel.isIPv6()) ? "EPRT" : "PORT",
hostPort.toFtpCmdArgument());
try {
controlChannel.execute(cmd);
} catch (UnexpectedReplyCodeException urce) {
throw ServerException.embedUnexpectedReplyCodeException(urce);
} catch (FTPReplyParseException rpe) {
throw ServerException.embedFTPReplyParseException(rpe);
}
this.session.serverMode = Session.SERVER_ACTIVE;
}
/**
Sets remote server active, telling it to connect to the client.
setLocalPassive() must be called beforehand.
**/
public void setActive()
throws IOException, ServerException, ClientException {
Session local = localServer.getSession();
if (local.serverAddress == null) {
throw new ClientException(ClientException.CALL_PASSIVE_FIRST);
}
setActive(local.serverAddress);
}
/** Starts local server in active server mode.
**/
public void setLocalActive() throws ClientException, IOException {
if (session.serverAddress == null) {
throw new ClientException(ClientException.CALL_PASSIVE_FIRST);
}
try {
localServer.setActive(session.serverAddress);
} catch (java.net.UnknownHostException e) {
throw new ClientException(ClientException.UNKNOWN_HOST);
}
}
/**
Starts local server in passive server mode, with default parameters.
In other words, behaves like
setLocalPassive(FTPServerFacade.ANY_PORT, FTPServerFacade.DEFAULT_QUEUE)
**/
public HostPort setLocalPassive() throws IOException {
return localServer.setPassive();
}
/**
Starts the local server in passive server mode.
@param port port at which local server should be listening;
can be set to FTPServerFacade.ANY_PORT
@param queue max size of queue of awaiting new connection
requests
@return the server address
**/
public HostPort setLocalPassive(int port, int queue) throws IOException {
return localServer.setPassive(port, queue);
}
/**
Changes the default client timeout parameters.
In the beginning of the transfer, the critical moment is the wait
for the initial server reply. If it does not arrive after timeout,
client assumes that the transfer could not start for some reason and
aborts the operation. Default timeout in miliseconds
is Session.DEFAULT_MAX_WAIT. During the waiting period,
client polls the control channel once a certain period, which is by
default set to Session.DEFAULT_WAIT_DELAY.
true if the client should try
* to send an ALLO command before a STOR request
*/
public void setUseAllo(boolean useAllo) {
this.useAllo = useAllo;
}
/**
* Determines whether this client is configured to send an ALLO
* command before a STOR request in the put/asyncPut methods.
*/
public boolean getUseAllo() {
return this.useAllo;
}
/**
* According to
* GridFTP v2 Protocol Description
* checksum feature has the following syntax:
*
* CKSUM [, …]
*
* getSupportedCksumAlgorithms parses checsum feauture parms and form a
* list of checksum algorithms supported by the server
* @return a list of checksum algorithms supported by the server in the order
* specified by the server
* @throws org.globus.ftp.exception.ClientException
* @throws org.globus.ftp.org.globus.ftp.exception.ServerException
* @throws java.io.IOException
*/
public List
* 5.1 CKSM
* This command is used by the client to request checksum calculation over a portion or
* whole file existing on the server. The syntax is:
* CKSM CRLF
* Server executes this command by calculating specified type of checksum over
* portion of the file starting at the offset and of the specified length. If length is –1,
* the checksum will be calculated through the end of the file. On success, the server
* replies with
* 2xx
* Actual format of checksum value depends on the algorithm used, but generally,
* hexadecimal representation should be used.
*
*
* @param algorithm ckeckum alorithm
* @param offset
* @param length
* @param path
* @return ckecksum value returned by the server
* @throws org.globus.ftp.exception.ClientException
* @throws org.globus.ftp.org.globus.ftp.exception.ServerException
* @throws java.io.IOException
*/
public String getChecksum(String algorithm,
long offset,
long length,
String path)
throws ClientException, ServerException, IOException {
// check if we the cksum commands and specific algorithm are supported
checkCksumSupport(algorithm);
// form CKSM command
String parameters = String.format("%s %d %d %s",algorithm, offset,length,path);
Command cmd = new Command("CKSM", parameters);
// transfer command, obtain reply
Reply cksumReply = doCommand(cmd);
// check for error
if( !Reply.isPositiveCompletion(cksumReply) ) {
throw new ServerException(ServerException.SERVER_REFUSED,
cksumReply.getMessage());
}
return cksumReply.getMessage();
}
/**
* GridFTP v2 CKSM command for the whole file
* @param algorithm ckeckum alorithm
* @param path
* @return ckecksum value returned by the server
* @throws org.globus.ftp.exception.ClientException
* @throws org.globus.ftp.org.globus.ftp.exception.ServerException
* @throws java.io.IOException
*/
public String getChecksum(String algorithm,
String path)
throws ClientException, ServerException, IOException {
return getChecksum(algorithm,0,-1,path);
}
/**
* implement GridFTP v2 SCKS command as described in
* GridFTP v2 Protocol Description
*
* 5.2 SCKS
* This command is sent prior to upload command such as STOR, ESTO, PUT. It is used
* to convey to the server that the checksum value for the file which is about to be
* uploaded. At the end of transfer, server will calculate checksum for the received file,
* and if it does not match, will consider the transfer to have failed. Syntax of the
* command is:
* SCKS CRLF
* Actual format of checksum value depends on the algorithm used, but generally,
* hexadecimal representation should be used.
*
* @param algorithm
* @param value
* @throws org.globus.ftp.exception.ClientException
* @throws org.globus.ftp.org.globus.ftp.exception.ServerException
* @throws java.io.IOException
*/
public void setChecksum(String algorithm, String value)
throws ClientException, ServerException, IOException {
// check if we the cksum commands and specific algorithm are supported
checkCksumSupport(algorithm);
// form CKSM command
String parameters = String.format("%s %s",algorithm, value);
Command cmd = new Command("SCKS", parameters);
// transfer command, obtain reply
Reply cksumReply = doCommand(cmd);
// check for error
if( !Reply.isPositiveCompletion(cksumReply) ) {
throw new ServerException(ServerException.SERVER_REFUSED,
cksumReply.getMessage());
}
return;
}
} //FTPClient
JGlobus-JGlobus-Release-2.1.0/gridftp/src/main/java/org/globus/ftp/FeatureList.java 0000664 0000000 0000000 00000014075 12411160572 0030046 0 ustar 00root root 0000000 0000000 /*
* Copyright 1999-2006 University of Chicago
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package org.globus.ftp;
import java.util.List;
import java.util.ArrayList;
import java.util.StringTokenizer;
/**
Represents features supported by server (as returned by FEAT command).
Use the static members of this class to refer to well known feature names.
Example: check if the server supports PARALLEL feature:
FeatureList fl = new FeatureList(client.getFeatureList());
if (fl.contains(FeatureList.PARALLEL)) {
...
}
**/
public class FeatureList {
/**
* RFC 2389 specified the following syntax for FEAT responce
*
* feat-response = error-response / no-features / feature-listing
* no-features = "211" SP *TCHAR CRLF
* feature-listing = "211-" *TCHAR CRLF
* 1*( SP feature CRLF )
* "211 End" CRLF
* feature = feature-label [ SP feature-parms ]
* feature-label = 1*VCHAR
* feature-parms = 1*TCHAR
*
* Feature class represence each individual feature and contain two fields
* required label and optional parms
*
*/
public static final class Feature {
private final String label;
private final String parms;
private Feature (String label) {
if(label == null ) {
throw new NullPointerException("label is null");
}
this.label = label;
this.parms = null;
}
private Feature (String label, String parms) {
if(label == null ) {
throw new NullPointerException("label is null");
}
this.label = label;
this.parms = parms;
}
/**
* @return the name
*/
public String getLabel() {
return label;
}
/**
* @return the qualifiers, null if no qualifiers
*/
public String getParms() {
return parms;
}
@Override
public boolean equals(Object obj) {
if( !(obj instanceof Feature)) {
return false;
}
Feature aFeature = (Feature) obj;
if( !label.equals(aFeature.label) ) {
return false;
}
if( parms == null ) {
return aFeature.parms == null;
}
return parms.equals( aFeature.parms);
}
}
// well known labels
public static final String SIZE = "SIZE";
public static final String MDTM = "MDTM";
public static final String PARALLEL = "PARALLEL";
public static final String ESTO = "ESTO";
public static final String ERET = "ERET";
public static final String SBUF = "SBUF";
public static final String ABUF = "ABUF";
public static final String DCAU = "DCAU";
public static final String PIPE = "PIPE";
public static final String MODEX = "MODEX";
public static final String GETPUT = "GETPUT";
public static final String CKSUM = "CKSUM";
protected final Listdrwxr-xr-x 2 guest other 1536 Jan 31 15:15 run.bat* or *
-rw-rw-r-- 1 globus 117579 Nov 29 13:24 AdGriP.pdf* If the entry corresponds to a device file, only the file type * will be set and the other parameters will be set to UNKNOWN. * * @param reply reply of FTP server for "dir" command. * @exception FTPException if unable to parse the reply */ //protected void parseUnixListReply(String reply) public void parseUnixListReply(String reply) throws FTPException { if (reply == null) return; StringTokenizer tokens = new StringTokenizer(reply); String token, previousToken; int numTokens = tokens.countTokens(); if (numTokens < 8) { throw new FTPException(FTPException.UNSPECIFIED, "Invalid number of tokens in the list reply [" + reply + "]"); } token = tokens.nextToken(); // permissions switch( token.charAt(0) ) { case 'd': setFileType(DIRECTORY_TYPE); break; case '-': setFileType(FILE_TYPE); break; case 'l': setFileType(SOFTLINK_TYPE); break; case 'c': case 'b': // do not try to parse device entries; // they aren't important anyway setFileType(DEVICE_TYPE); return; default: setFileType(UNKNOWN_TYPE); } try { for(int i=1;i<=9;i++) { if (token.charAt(i) != '-') { mode += 1 << (9 - i); } } } catch (IndexOutOfBoundsException e) { throw new FTPException(FTPException.UNSPECIFIED, "Could not parse access permission bits"); } // ??? can ignore tokens.nextToken(); // next token is the owner tokens.nextToken(); // In ls from System V, next token is the group // In ls from Berkeley (BSD), group token is missing previousToken = tokens.nextToken(); // size token = tokens.nextToken(); /* * if the group is missing this will try to parse the date field * as an integer and will fail. if so, then the previous field is the size field * and the current token is part of the date. */ try { setSize( Long.parseLong(token) ); token = null; } catch(NumberFormatException e) { // this might mean that the group is missing // and this token is part of date. try { setSize( Long.parseLong(previousToken) ); } catch(NumberFormatException ee) { throw new FTPException(FTPException.UNSPECIFIED, "Invalid size number in the ftp reply [" + previousToken + ", " + token + "]"); } } // date - two fields together if (token == null) { token = tokens.nextToken(); } String month = token; setDate(token + " " + tokens.nextToken()); //next token is either date or time token = tokens.nextToken(); this.setTime(token); // this is to handle spaces in the filenames // as well filenames with dates in them int ps = reply.indexOf(month); if (ps == -1) { // this should never happen throw new FTPException(FTPException.UNSPECIFIED, "Could not find date token"); } else { ps = reply.indexOf(this.time, ps+month.length()); if (ps == -1) { // this should never happen throw new FTPException(FTPException.UNSPECIFIED, "Could not find time token"); } else { this.setName(reply.substring(1+ps+this.time.length())); } } } // -------------------------------- /** * Sets the file size. * * @param size size of the file */ public void setSize(long size) { this.size = size; } /** * Sets the file name. * * @param name name of the file. */ public void setName(String name) { this.name = name; } /** * Sets the file date. * * @param date date of the file. */ public void setDate(String date) { this.date = date; } /** * Sets modification time of the file. * * @param time time of the file. */ public void setTime(String time) { this.time = time; } /** * Sets the file type. * * @param type one of the file types, * e.g. FILE_TYPE, DIRECTORY_TYPE * */ public void setFileType(byte type) { this.fileType = type; } // --------------------------------- /** * Returns size of the file. * * @return size of the file in bytes */ public long getSize() { return size; } /** * Returns name of the file. * * @return name of the file. */ public String getName() { return name; } /** * Returns date of the file. * * @return date of the file. */ public String getDate() { return date; } /** * Returns modification time of the file. * * @return time of the file. */ public String getTime() { return time; } /** * Tests if this file is a file. * * @return true if this represents a file, * otherwise, false. */ public boolean isFile() { return (fileType == FILE_TYPE); } /** * Tests if this file is a directory. * * @return true if this reprensets a directory, * otherwise, false. */ public boolean isDirectory() { return (fileType == DIRECTORY_TYPE); } /** * Tests if this file is a softlink. * * @return true if this reprensets a softlink, * otherwise, false. */ public boolean isSoftLink() { return (fileType == SOFTLINK_TYPE); } /** * Tests if this file is a device. */ public boolean isDevice() { return (fileType == DEVICE_TYPE); } public int getMode() { return mode; } public String getModeAsString() { StringBuffer modeStr = new StringBuffer(); for(int j=2;j>=0;j--) { int oct = 0; for(int i=2;i>=0;i--) { if ((mode & (1 << j*3+i)) != 0) { oct += (int)Math.pow(2,i); } } modeStr.append(String.valueOf(oct)); } return modeStr.toString(); } public boolean userCanRead() { return ((mode & (1 << 8)) != 0); } public boolean userCanWrite() { return ((mode & (1 << 7)) != 0); } public boolean userCanExecute() { return ((mode & (1 << 6)) != 0); } public boolean groupCanRead() { return ((mode & (1 << 5)) != 0); } public boolean groupCanWrite() { return ((mode & (1 << 4)) != 0); } public boolean groupCanExecute() { return ((mode & (1 << 3)) != 0); } public boolean allCanRead() { return ((mode & (1 << 2)) != 0); } public boolean allCanWrite() { return ((mode & (1 << 1)) != 0); } public boolean allCanExecute() { return ((mode & (1 << 0)) != 0); } // -------------------------------- public String toString() { StringBuffer buf = new StringBuffer(); buf.append("FileInfo: "); buf.append(getName() + " "); buf.append(getSize() + " "); buf.append(getDate() + " "); buf.append(getTime() + " "); switch( fileType ) { case DIRECTORY_TYPE: buf.append("directory"); break; case FILE_TYPE: buf.append("file"); break; case SOFTLINK_TYPE: buf.append("softlink"); break; default: buf.append("unknown type"); } buf.append(" "+getModeAsString()); return buf.toString(); } } JGlobus-JGlobus-Release-2.1.0/gridftp/src/main/java/org/globus/ftp/FileRandomIO.java 0000664 0000000 0000000 00000005264 12411160572 0030067 0 ustar 00root root 0000000 0000000 /* * Copyright 1999-2006 University of Chicago * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * You may obtain a copy of the License at * * http://www.apache.org/licenses/LICENSE-2.0 * * Unless required by applicable law or agreed to in writing, software * distributed under the License is distributed on an "AS IS" BASIS, * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. * See the License for the specific language governing permissions and * limitations under the License. */ package org.globus.ftp; import java.io.IOException; import java.io.RandomAccessFile; /** Thread safe reference implementation of DataSink and DataSource. Implements reading and writing data to a local file. Note: Does not work with {@link Session#MODE_STREAM Session.STREAM} transfer mode, only with {@link GridFTPSession#MODE_EBLOCK GridFTPSession.EBLOCK} mode. */ public class FileRandomIO implements DataSink, DataSource { public static final int DEFAULT_BUFFER_SIZE = 16384; protected int bufferSize; protected RandomAccessFile file; protected long offset; /** Behave like FileRandomIO(file, DEFAULT_BUFFER_SIZE) @param file local file that will be be used as data source or destination */ public FileRandomIO(RandomAccessFile file) { this(file, DEFAULT_BUFFER_SIZE); } /** @param file local file that will be be used as data source or destination @param bufferSize size of the buffer returned during single read operation */ public FileRandomIO(RandomAccessFile file, int bufferSize) { this.file = file; this.bufferSize = bufferSize; } public synchronized void write(Buffer buffer) throws IOException { long bufOffset = buffer.getOffset(); if (bufOffset == -1) { if (file.getFilePointer() != this.offset) { throw new IOException("Invalid offset: " + bufOffset); } } else { file.seek(bufOffset); } file.write(buffer.getBuffer(), 0, buffer.getLength()); this.offset += buffer.getLength(); } /** In this implementation, each read() returns data sequentially. */ public synchronized Buffer read() throws IOException { long offset = file.getFilePointer(); byte [] buf = new byte[bufferSize]; int read = file.read(buf); if (read == -1) { return null; } else { return new Buffer(buf, read, offset); } } /** Closes the underlying file */ public synchronized void close() throws IOException { file.close(); } public long totalSize() throws IOException { return file.length(); } } JGlobus-JGlobus-Release-2.1.0/gridftp/src/main/java/org/globus/ftp/GridFTPClient.java 0000664 0000000 0000000 00000120034 12411160572 0030206 0 ustar 00root root 0000000 0000000 /* * Copyright 1999-2006 University of Chicago * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * You may obtain a copy of the License at * * http://www.apache.org/licenses/LICENSE-2.0 * * Unless required by applicable law or agreed to in writing, software * distributed under the License is distributed on an "AS IS" BASIS, * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. * See the License for the specific language governing permissions and * limitations under the License. */ package org.globus.ftp; import java.io.IOException; import java.io.File; import java.io.RandomAccessFile; import java.util.Vector; import java.net.UnknownHostException; import org.globus.ftp.exception.ClientException; import org.globus.ftp.exception.ServerException; import org.globus.ftp.exception.FTPReplyParseException; import org.globus.ftp.exception.UnexpectedReplyCodeException; import org.globus.ftp.vanilla.Command; import org.globus.ftp.vanilla.Reply; import org.globus.ftp.vanilla.TransferState; import org.globus.ftp.vanilla.FTPControlChannel; import org.globus.ftp.extended.GridFTPServerFacade; import org.globus.ftp.extended.GridFTPControlChannel; import org.globus.gsi.gssapi.auth.Authorization; import org.globus.ftp.MultipleTransferComplete; import org.globus.ftp.MultipleTransferCompleteListener; import org.ietf.jgss.GSSCredential; import org.apache.commons.logging.Log; import org.apache.commons.logging.LogFactory; import org.globus.common.Version; import java.io.ByteArrayOutputStream; import java.text.DecimalFormat; import org.globus.ftp.exception.FTPException; /** * This is the main user interface for GridFTP operations. * Use this class for client - server or third party transfers * with mode E, parallelism, markers, striping or GSI authentication. * Consult the manual for general usage. *
list = new ByteRangeList(); marker = new GridFTPRestartMarker(reply.getMessage()); list.merge(marker.getVector());@see ByteRangeList **/ public class GridFTPRestartMarker implements Marker { private static Log logger = LogFactory.getLog(GridFTPRestartMarker.class.getName()); Vector vector; /** Constructs the restart marker by parsing the parameter string. @param msg The string in the format of FTP reply 111 message, for instance "Range Marker 0-29,30-89" @throws IllegalArgumentException if the parameter is in bad format **/ public GridFTPRestartMarker(String msg) throws IllegalArgumentException{ // expecting msg like "Range Marker 0-29,30-89" vector = new Vector(); StringTokenizer tokens = new StringTokenizer(msg); if (! tokens.hasMoreTokens()) { badMsg("message empty", msg); } if (! tokens.nextToken(" ").equals("Range")) { badMsg("should start with Range Marker", msg); } if (! tokens.nextToken(" ").equals("Marker")) { badMsg("should start with Range Marker", msg); } while(tokens.hasMoreTokens()) { long from =0; long to =0; try { String rangeStr = tokens.nextToken(","); StringTokenizer rangeTok = new StringTokenizer(rangeStr, "-"); from = Long.parseLong(rangeTok.nextToken().trim()); to = Long.parseLong(rangeTok.nextToken().trim()); if (rangeTok.hasMoreElements()) { badMsg("A range is followed by '-'", msg); } } catch(NoSuchElementException nse) { // range does not look like "from-to" badMsg("one of the ranges is malformatted", msg); } catch (NumberFormatException nfe) { badMsg("one of the integers is malformatted", msg); } try { vector.add(new ByteRange(from, to)); } catch(IllegalArgumentException iae) { // to < from badMsg("range beginning > range end", msg); } } //vector now contains all ranges if (vector.size() == 0 ) { badMsg("empty range list", msg); } }; private void badMsg(String why, String msg) { throw new IllegalArgumentException( "argument is not FTP 111 reply message (" + why + ": ->" + msg + "<-"); } /** Returns Vector representation of this object. Its elements are be ByteRange objects. They are in the order exactly as received in the FTP reply; no additional processing has been done on them. To order and merge them, use ByteRangeList. Subsequent calls of this method will return the same Vector object. @return Vector representation of this object. **/ public Vector toVector() { return vector; }; } JGlobus-JGlobus-Release-2.1.0/gridftp/src/main/java/org/globus/ftp/GridFTPSession.java 0000664 0000000 0000000 00000012640 12411160572 0030416 0 ustar 00root root 0000000 0000000 /* * Copyright 1999-2006 University of Chicago * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * You may obtain a copy of the License at * * http://www.apache.org/licenses/LICENSE-2.0 * * Unless required by applicable law or agreed to in writing, software * distributed under the License is distributed on an "AS IS" BASIS, * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. * See the License for the specific language governing permissions and * limitations under the License. */ package org.globus.ftp; import org.globus.ftp.exception.ClientException; import org.ietf.jgss.GSSCredential; /** * Represents parameters of an FTP session between a client and a server. */ public class GridFTPSession extends Session { /** * Indicates Extended Block Mode for data transfer. Used with * {@link GridFTPClient#setMode(int) GridFTPClient.setMode()}. */ public static final int MODE_EBLOCK = 3; /** * server in extended passive mode */ public static final int SERVER_EPAS = 3; /** * server in extended active mode */ public static final int SERVER_EACT = 4; /** * Indicates that the data channel will carry the raw data of the file * transfer, with no security applied. Used with * {@link GridFTPClient#setDataChannelProtection(int) * setDataChannelProtection()}. */ public static final int PROTECTION_CLEAR = 1; /** * Indicates that the data will be integrity protected. Used with * {@link GridFTPClient#setDataChannelProtection(int) * setDataChannelProtection()}. */ public static final int PROTECTION_SAFE = 2; /** * Indicates that the data will be confidentiality protected (Currently, not * support by GridFTP servers). Used with * {@link GridFTPClient#setDataChannelProtection(int) * setDataChannelProtection()}. */ public static final int PROTECTION_CONFIDENTIAL = 3; /** * Indicates that the data will be integrity and confidentiality protected. * Used with {@link GridFTPClient#setDataChannelProtection(int) * setDataChannelProtection()}. */ public static final int PROTECTION_PRIVATE = 4; /* default in gridftp - not in gsiftp */ public DataChannelAuthentication dataChannelAuthentication = DataChannelAuthentication.SELF; public int dataChannelProtection = PROTECTION_CLEAR; public GSSCredential credential = null; public int parallel = 1; public int TCPBufferSize = SERVER_DEFAULT; /** * This concerns local server. if in SERVER_EPAS mode, the server listener * socket list is stored here. If in SERVER_PASV mode, the server listener * sockets is stored in serverAddress variable. */ public HostPortList serverAddressList = null; /** * Sets maxWait to twice the time of DEFAULT_MAX_WAIT */ public GridFTPSession() { maxWait = 2 * DEFAULT_MAX_WAIT; } /** * In addition to the inherited functionality, this method also (1) checks * if extended active / passive server modes are set correctly, (2) checks * if Mode E is needed, and if so, checks whether it has been set. If not, * ClientException is thrown. */ public void matches(Session other) throws ClientException { compareTransferParams(other); compareServerMode(other); if (needsGridFTP() && transferMode != MODE_EBLOCK) { throw new ClientException(ClientException.BAD_MODE, "Extended block mode necessary"); } if (other instanceof GridFTPSession && ((GridFTPSession) other).needsGridFTP() && transferMode != MODE_EBLOCK) { throw new ClientException(ClientException.BAD_MODE, "Extended block mode necessary"); } } // called by inherited matches() method protected void compareServerMode(Session other) throws ClientException { if (transferMode != MODE_EBLOCK) { super.compareServerMode(other); } else { if (serverMode == SERVER_DEFAULT && other.serverMode == SERVER_DEFAULT) { // this is OK } else { // active and passive side had already been set; // make sure that it has been done correctly. // in mode E, source must be active and dest passive if (!((serverMode == SERVER_EACT && other.serverMode == SERVER_EPAS) || (serverMode == SERVER_EPAS && other.serverMode == SERVER_EACT) || (serverMode == SERVER_ACTIVE && other.serverMode == SERVER_PASSIVE) || (serverMode == SERVER_PASSIVE && other.serverMode == SERVER_ACTIVE))) { throw new ClientException(ClientException.BAD_SERVER_MODE, "One server must be active" + " and other must be passive"); } } } } // compareServerMode /** * @return true if this session requires GridFTP extensions; false if it * only requires vanilla FTP. */ public boolean needsGridFTP() { return (parallel > 1 || transferMode == MODE_EBLOCK || (serverMode == GridFTPSession.SERVER_EPAS || serverMode == GridFTPSession.SERVER_EACT)); } } JGlobus-JGlobus-Release-2.1.0/gridftp/src/main/java/org/globus/ftp/HostPort.java 0000664 0000000 0000000 00000006156 12411160572 0027402 0 ustar 00root root 0000000 0000000 /* * Copyright 1999-2006 University of Chicago * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * You may obtain a copy of the License at * * http://www.apache.org/licenses/LICENSE-2.0 * * Unless required by applicable law or agreed to in writing, software * distributed under the License is distributed on an "AS IS" BASIS, * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. * See the License for the specific language governing permissions and * limitations under the License. */ package org.globus.ftp; import java.util.StringTokenizer; import java.net.InetAddress; /** * Utility class for parsing and converting host-port information from PASV * and PORT ftp commands. */ public class HostPort { private int [] datainfo; protected HostPort() { } /** * Parses host-port from passive mode reply message. * Note that the argument is not the whole message, but * only the content of the brackets: * h1,h2,h3,h4,p1,p2 * * @param passiveReplyMessage reply message for the PASV command */ public HostPort(String passiveReplyMessage) { datainfo = new int[6]; int i = 0; StringTokenizer tokens = new StringTokenizer(passiveReplyMessage, ","); while(tokens.hasMoreTokens()) { datainfo[i] = Integer.parseInt( tokens.nextToken().trim() ); i++; } } /** * Creates the HostPort object from specified ip address * and port number. * * @param addr ip address * @param port port number */ public HostPort(InetAddress addr, int port) { this(addr.getHostAddress(), port); } /** * Creates the HostPort object from specified ip address * and port number. * @param ipAddress ip address * @param port port number */ public HostPort(String ipAddress, int port) { datainfo = new int[6]; int i = 0; StringTokenizer tokens = new StringTokenizer(ipAddress, "."); while(tokens.hasMoreTokens()) { datainfo[i] = Integer.parseInt( (String)tokens.nextToken() ); i++; } if (i != 4) { throw new IllegalArgumentException("Invalid ip address: " + ipAddress); } datainfo[4] = port/256; datainfo[5] = port - datainfo[4]*256; } /** * Returns the port number * * @return port number */ public int getPort() { return datainfo[4]*256 + datainfo[5]; } /** * Returns the ip address in the form "h1.h2.h3.h4" * * @return ip address */ public String getHost() { return datainfo[0] + "." + datainfo[1] + "." + datainfo[2] + "." + datainfo[3]; } /** * Returns the host-port information in the * format used by PORT command. * (h1,h2,h3,h4,p1,p2) * * @return host-port information in PORT command * representation. */ public String toFtpCmdArgument() { StringBuffer msg = new StringBuffer(); for (int i=0;i
In general, the meaning of a parameter values is as follows. A value of SERVER_DEFAULT (in case of integer values) or null (in case of objects) indicate that this parameter should not be explicitly set to the server, and the server will use its defaults. Any other value will be explicitly requested from the server on the control channel.
For example, if transferMode is set to SERVER_DEFAULT, client will not directly request any transfer mode, and the server should use its default which is stream mode. If transferMode is set to MODE_STREAM, stream mode will be explicitly requested from the server, so it will also use stream mode. To request extended block mode, set transferMode to MODE_EBLOCK.
Below is a list of parameters that can be set to TransferParams and can affect the transfer:
* Represents FTP Protocol Interpreter. Encapsulates * control channel communication. * *
*/ public class FTPControlChannel extends BasicClientControlChannel { private static Log logger = LogFactory.getLog(FTPControlChannel.class.getName()); public static final String CRLF = "\r\n"; // used in blocking waitForReply() private static final int WAIT_FOREVER = -1; protected Socket socket; //input stream protected BufferedReader ftpIn; //raw stream underlying ftpIn protected InputStream rawFtpIn; //output stream protected OutputStream ftpOut; protected String host; protected int port; //true if connection has already been opened. protected boolean hasBeenOpened = false; private boolean ipv6 = false; private Reply lastReply; public FTPControlChannel(String host, int port) { this.host = host; this.port = port; this.ipv6 = (this.host.indexOf(':') != -1); } /** * Using this constructor, you can initialize an instance that does not * talk directly to the socket. If you use this constructor using streams * that belong to an active connection, there's no need to call open() * afterwards. **/ public FTPControlChannel(InputStream in, OutputStream out) { setInputStream(in); setOutputStream(out); } public String getHost() { return this.host; } public int getPort() { return this.port; } public boolean isIPv6() { return this.ipv6; } protected BufferedReader getBufferedReader() { return ftpIn; } protected OutputStream getOutputStream() { return ftpOut; } // not intended to be public. you can set streams in the constructor. protected void setInputStream(InputStream in) { rawFtpIn = in; ftpIn = new BufferedReader(new InputStreamReader(rawFtpIn)); } protected void setOutputStream(OutputStream out) { ftpOut = out; } /** * opens the connection and returns after it is ready for communication. * Before returning, it intercepts the initial server reply(-ies), * and not positive, throws UnexpectedReplyCodeException. * After returning, there should be no more queued replies on the line. * * Here's the sequence for connection establishment (rfc959): *
* 120
* 220
* 220
* 421
*
* @throws IOException on I/O error
* @throws ServerException on negative or faulty server reply
**/
public void open() throws IOException, ServerException {
if (hasBeenOpened()) {
throw new IOException("Attempt to open an already opened connection");
}
InetAddress allIPs[];
//depending on constructor used, we may already have streams
if (!haveStreams()) {
boolean found = false;
int i = 0;
boolean firstPass = true;
allIPs = InetAddress.getAllByName(host);
while(!found)
{
try
{
logger.debug("opening control channel to "
+ allIPs[i] + " : " + port);
InetSocketAddress isa =
new InetSocketAddress(allIPs[i], port);
socket = new Socket();
socket.setSoTimeout(CoGProperties.getDefault().getSocketTimeout());
socket.connect(isa, CoGProperties.getDefault().getSocketTimeout());
found = true;
}
catch(IOException ioEx)
{
logger.debug("failed connecting to "
+ allIPs[i] + " : " + port +":"+ioEx);
i++;
if(i == allIPs.length)
{
if(firstPass)
{
firstPass = false;
i = 0;
}
else
{
throw ioEx;
}
}
}
}
String pv = System.getProperty("org.globus.ftp.IPNAME");
if(pv != null)
{
host = socket.getInetAddress().getHostAddress();
}
else
{
host = socket.getInetAddress().getCanonicalHostName();
}
setInputStream(socket.getInputStream());
setOutputStream(socket.getOutputStream());
}
readInitialReplies();
hasBeenOpened = true;
}
//intercepts the initial replies
//(that the server sends after opening control ch.)
protected void readInitialReplies() throws IOException, ServerException {
Reply reply = null;
try {
reply = read();
} catch (FTPReplyParseException rpe) {
throw ServerException.embedFTPReplyParseException(
rpe,
"Received faulty initial reply");
}
if (Reply.isPositivePreliminary(reply)) {
try {
reply = read();
} catch (FTPReplyParseException rpe) {
throw ServerException.embedFTPReplyParseException(
rpe,
"Received faulty second reply");
}
}
if (!Reply.isPositiveCompletion(reply)) {
close();
throw ServerException.embedUnexpectedReplyCodeException(
new UnexpectedReplyCodeException(reply),
"Server refused connection.");
}
}
/**
* Returns the last reply received from the server.
*/
public Reply getLastReply() {
return lastReply;
}
/**
* Closes the control channel
*/
public void close() throws IOException {
logger.debug("ftp socket closed");
if (ftpIn != null)
ftpIn.close();
if (ftpOut != null)
ftpOut.close();
if (socket != null)
socket.close();
hasBeenOpened = false;
}
private int checkSocketDone(Flag aborted, int ioDelay, int maxWait)
throws ServerException,
IOException, InterruptedException
{
int oldTOValue = this.socket.getSoTimeout();
int c = -10;
int time = 0;
boolean done = false;
if (ioDelay <= 0)
{
ioDelay = 2000;
}
while(!done)
{
try
{
if (aborted.flag)
{
throw new InterruptedException();
}
this.socket.setSoTimeout(ioDelay);
ftpIn.mark(2);
c = ftpIn.read();
done = true;
}
catch (SocketTimeoutException e)
{
// timeouts will happen
logger.debug("temp timeout" + e);
}
catch (Exception e)
{
throw new InterruptedException();
}
finally
{
ftpIn.reset();
this.socket.setSoTimeout(oldTOValue);
}
time += ioDelay;
if(time > maxWait && maxWait != WAIT_FOREVER)
{
throw new ServerException(ServerException.REPLY_TIMEOUT);
}
}
return c;
}
/**
Block until one of the conditions are true:
* Represents the FTP reply. *
*/ public class Reply implements Serializable { private static Log logger = LogFactory.getLog(Reply.class.getName()); public static final int POSITIVE_PRELIMINARY = 1; public static final int POSITIVE_COMPLETION = 2; public static final int POSITIVE_INTERMEDIATE = 3; public static final int TRANSIENT_NEGATIVE_COMPLETION = 4; public static final int PERMANENT_NEGATIVE_COMPLETION = 5; //minimum length of 1st line: //message is defined as 3 chars +* Returns the text that came with the reply, between the leading space and * terminating CRLF, excluding the mentioned space and CRLF. *
** If the reply is multi-line, this returns the text between the leading * dash "-" and the CRLF following the last line, excluding the mentioned * dash and CRLF. Note that lines are separated by the local line separator * [as returned by System.getProperty("line.separator")] rather than CRLF. * *
** *
*/ public String getMessage() { return message; } public static boolean isPositivePreliminary(Reply reply) { return (reply.getCategory() == POSITIVE_PRELIMINARY); } public static boolean isPositiveCompletion(Reply reply) { return (reply.getCategory() == POSITIVE_COMPLETION); } public static boolean isPositiveIntermediate(Reply reply) { return (reply.getCategory() == POSITIVE_INTERMEDIATE); } public static boolean isTransientNegativeCompletion(Reply reply) { return (reply.getCategory() == TRANSIENT_NEGATIVE_COMPLETION); } public static boolean isPermanentNegativeCompletion(Reply reply) { return (reply.getCategory() == PERMANENT_NEGATIVE_COMPLETION); } public String toString() { String mult = isMultiline ? "-" : " "; return code + mult + message; } /** GT2.0 wuftp server incorrectly inserts \0 between lines. We have to deal with that. **/ protected static String ignoreLeading0(String line) { if (line.length() > 0 && line.charAt(0) == 0) { logger.debug("WARNING: The first character of the reply is 0. Ignoring the character."); /* logger.debug( "\n\nWARNING:\n In the reply received from the server, the first character's code is 0! I will ignore it but this means the server is not following the protocol. Here's the details: \n first line of the reply ->" + line + "<-"); logger.debug( "First 3 chars of reply->" +line.substring(0,3)+"<-"); logger.debug( "char 0 ->" + line.charAt(0) + "<- code = " + (int)line.charAt(0)); logger.debug( "char 1 ->" + line.charAt(1) + "<- code = " + (int)line.charAt(1)); logger.debug( "char 2 ->" + line.charAt(2) + "<- code = " + (int)line.charAt(2)); logger.debug( "char 3 ->" + line.charAt(3) + "<- code = " + (int)line.charAt(3)); */ return line.substring(1, line.length()); } return line; } } // end Reply JGlobus-JGlobus-Release-2.1.0/gridftp/src/main/java/org/globus/ftp/vanilla/TransferMonitor.java 0000664 0000000 0000000 00000020140 12411160572 0032367 0 ustar 00root root 0000000 0000000 /* * Copyright 1999-2006 University of Chicago * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * You may obtain a copy of the License at * * http://www.apache.org/licenses/LICENSE-2.0 * * Unless required by applicable law or agreed to in writing, software * distributed under the License is distributed on an "AS IS" BASIS, * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. * See the License for the specific language governing permissions and * limitations under the License. */ package org.globus.ftp.vanilla; import org.globus.ftp.MarkerListener; import org.globus.ftp.PerfMarker; import org.globus.ftp.GridFTPRestartMarker; import org.globus.ftp.exception.ServerException; import org.globus.ftp.exception.UnexpectedReplyCodeException; import org.globus.ftp.exception.FTPReplyParseException; import java.io.InterruptedIOException; import java.io.IOException; import org.apache.commons.logging.Log; import org.apache.commons.logging.LogFactory; public class TransferMonitor implements Runnable { public final static int LOCAL = 1, REMOTE = 2; private int side; // source or dest private Log logger = null; private int maxWait; private int ioDelay; private BasicClientControlChannel controlChannel; private TransferState transferState; private MarkerListener mListener; private TransferMonitor other; private boolean abortable; private Flag aborted = new Flag(); private Thread thread; public TransferMonitor(BasicClientControlChannel controlChannel, TransferState transferState, MarkerListener mListener, int maxWait, int ioDelay, int side) { logger = LogFactory.getLog(TransferMonitor.class.getName() + ((side == LOCAL) ? ".Local" : ".Remote")); this.controlChannel = controlChannel; this.transferState = transferState; this.mListener = mListener; this.maxWait = maxWait; this.ioDelay = ioDelay; abortable = true; aborted.flag = false; this.side = side; } /** In this class, each instance gets a separate logger which is assigned the name in the constructor. This name is in the form "...GridFTPClient.thread host:port". @return the logger name. **/ public String getLoggerName() { return logger.toString(); } public void setOther(TransferMonitor other) { this.other = other; } /** * Abort the tpt transfer * but do not close resources */ public synchronized void abort() { logger.debug("abort"); if (!this.abortable) { return; } controlChannel.abortTransfer(); aborted.flag = true; } private synchronized void done() { this.abortable = false; } public void start(boolean blocking) { if (blocking) { this.thread = Thread.currentThread(); run(); } else { this.thread = new Thread(this); this.thread.setName("TransferMonitor" + this.thread.getName()); this.thread.start(); } } public void run() { try { // if the other thread had already terminated // with an error, behave as if it happened just now. if (transferState.hasError()) { logger.debug("the other thread terminated before this one started."); throw new InterruptedException(); } logger.debug("waiting for 1st reply; maxWait = " + maxWait + ", ioDelay = " + ioDelay); this.controlChannel.waitFor(aborted, ioDelay, maxWait); logger.debug("reading first reply"); Reply firstReply = controlChannel.read(); // 150 Opening BINARY mode data connection. // or // 125 Data connection already open; transfer starting if (Reply.isPositivePreliminary(firstReply)) { transferState.transferStarted(); logger.debug("first reply OK: " + firstReply.toString()); for(;;) { logger.debug("reading next reply"); this.controlChannel.waitFor(aborted, ioDelay, maxWait); logger.debug("got next reply"); Reply nextReply = controlChannel.read(); //perf marker if (nextReply.getCode() == 112) { logger.debug("marker arrived: " + nextReply.toString()); if (mListener != null) { mListener.markerArrived( new PerfMarker(nextReply.getMessage())); } continue; } //restart marker if (nextReply.getCode() == 111) { logger.debug("marker arrived: " + nextReply.toString()); if (mListener != null) { mListener.markerArrived( new GridFTPRestartMarker( nextReply.getMessage())); } continue; } //226 Transfer complete if (nextReply.getCode() == 226) { abortable = false; logger.debug("transfer complete: " + nextReply.toString()); break; } // any other reply logger.debug("unexpected reply: " + nextReply.toString()); logger.debug("exiting the transfer thread"); ServerException e = ServerException.embedUnexpectedReplyCodeException( new UnexpectedReplyCodeException(nextReply), "Server reported transfer failure"); transferState.transferError(e); other.abort(); break; } } else { //first reply negative logger.debug("first reply bad: " + firstReply.toString()); logger.debug("category: " + firstReply.getCategory()); abortable = false; ServerException e = ServerException.embedUnexpectedReplyCodeException( new UnexpectedReplyCodeException(firstReply)); transferState.transferError(e); other.abort(); } logger.debug("thread dying naturally"); } catch (InterruptedException td) { //other transfer thread called abort() logger.debug("thread dying of InterruptedException."); transferState.transferError(td); } catch (InterruptedIOException td) { //other transfer thread called abort() which occurred //while this thread was performing IO logger.debug("thread dying of InterruptedIOException."); transferState.transferError(td); } catch (IOException e) { logger.debug("thread dying of IOException"); transferState.transferError(e); other.abort(); } catch (FTPReplyParseException rpe) { logger.debug("thread dying of FTPReplyParseException"); ServerException se = ServerException.embedFTPReplyParseException(rpe); transferState.transferError(se); other.abort(); } catch (ServerException e) { logger.debug("thread dying of timeout"); transferState.transferError(e); other.abort(); } finally { done(); transferState.transferDone(); } } } JGlobus-JGlobus-Release-2.1.0/gridftp/src/main/java/org/globus/ftp/vanilla/TransferState.java 0000664 0000000 0000000 00000007430 12411160572 0032027 0 ustar 00root root 0000000 0000000 /* * Copyright 1999-2006 University of Chicago * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * You may obtain a copy of the License at * * http://www.apache.org/licenses/LICENSE-2.0 * * Unless required by applicable law or agreed to in writing, software * distributed under the License is distributed on an "AS IS" BASIS, * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. * See the License for the specific language governing permissions and * limitations under the License. */ package org.globus.ftp.vanilla; import java.io.InterruptedIOException; import java.io.IOException; import org.globus.ftp.MarkerListener; import org.globus.ftp.exception.ClientException; import org.globus.ftp.exception.ServerException; import org.apache.commons.logging.Log; import org.apache.commons.logging.LogFactory; public class TransferState { private static Log logger = LogFactory.getLog(TransferState.class.getName()); private int transferDone; private int transferStarted; private Exception transferException = null; public TransferState() { this.transferDone = 0; this.transferStarted = 0; this.transferException = null; } // this is called when transfer successfully started (opening data conn) public synchronized void transferStarted() { this.transferStarted++; notifyAll(); } // this is called when TransferMonitor thread is finished public synchronized void transferDone() { this.transferDone++; notifyAll(); } // this is called when an error occurs during transfer public synchronized void transferError(Exception e) { logger.debug("intercepted exception", e); if (transferException == null) { transferException = e; } else if (transferException instanceof InterruptedException || transferException instanceof InterruptedIOException) { //if one of the threads throws an error, it interrupts //the other thread (by InterruptedException). //Here we make sure that transferException will store the //primary failure reason, not the resulting InterruptedException transferException = e; } notifyAll(); } public synchronized boolean isDone() { return this.transferDone >= 2; } public synchronized boolean isStarted() { return this.transferStarted >= 2; } /** * Blocks until the transfer is complete or * the transfer fails. */ public synchronized void waitForEnd() throws ServerException, ClientException, IOException { try { while(!isDone() && !hasError()) { wait(); } } catch(InterruptedException e) { // break } checkError(); } /** * Blocks until the transfer begins or * the transfer fails to start. */ public synchronized void waitForStart() throws ServerException, ClientException, IOException { try { while(!isStarted() && !hasError()) { wait(); } } catch(InterruptedException e) { // break } checkError(); } public synchronized boolean hasError() { return (transferException != null); } public Exception getError() { return transferException; } public void checkError() throws ServerException, ClientException, IOException { if (transferException == null) { return; } if (transferException instanceof ServerException) { throw (ServerException)transferException; } else if (transferException instanceof IOException) { throw (IOException)transferException; } else if (transferException instanceof InterruptedException) { throw new ClientException(ClientException.THREAD_KILLED); } } } JGlobus-JGlobus-Release-2.1.0/gridftp/src/test/ 0000775 0000000 0000000 00000000000 12411160572 0021204 5 ustar 00root root 0000000 0000000 JGlobus-JGlobus-Release-2.1.0/gridftp/src/test/java/ 0000775 0000000 0000000 00000000000 12411160572 0022125 5 ustar 00root root 0000000 0000000 JGlobus-JGlobus-Release-2.1.0/gridftp/src/test/java/org/ 0000775 0000000 0000000 00000000000 12411160572 0022714 5 ustar 00root root 0000000 0000000 JGlobus-JGlobus-Release-2.1.0/gridftp/src/test/java/org/globus/ 0000775 0000000 0000000 00000000000 12411160572 0024207 5 ustar 00root root 0000000 0000000 JGlobus-JGlobus-Release-2.1.0/gridftp/src/test/java/org/globus/ftp/ 0000775 0000000 0000000 00000000000 12411160572 0025000 5 ustar 00root root 0000000 0000000 JGlobus-JGlobus-Release-2.1.0/gridftp/src/test/java/org/globus/ftp/test/ 0000775 0000000 0000000 00000000000 12411160572 0025757 5 ustar 00root root 0000000 0000000 JGlobus-JGlobus-Release-2.1.0/gridftp/src/test/java/org/globus/ftp/test/AsciiTranslatorTest.java 0000664 0000000 0000000 00000005507 12411160572 0032573 0 ustar 00root root 0000000 0000000 /* * Copyright 1999-2006 University of Chicago * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * You may obtain a copy of the License at * * http://www.apache.org/licenses/LICENSE-2.0 * * Unless required by applicable law or agreed to in writing, software * distributed under the License is distributed on an "AS IS" BASIS, * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. * See the License for the specific language governing permissions and * limitations under the License. */ package org.globus.ftp.test; import org.globus.ftp.dc.AsciiTranslator; import org.globus.ftp.Buffer; import junit.framework.TestCase; import junit.framework.Test; import junit.framework.TestSuite; import org.apache.commons.logging.Log; import org.apache.commons.logging.LogFactory; public class AsciiTranslatorTest extends TestCase { static Log logger = LogFactory.getLog(AsciiTranslatorTest.class); public static void main(String[] argv) { junit.textui.TestRunner.run (suite()); } public static Test suite() { return new TestSuite(AsciiTranslatorTest.class); } public AsciiTranslatorTest(String name) { super(name); } public void test1() { crlnTest("\n"); } public void test2() { crlnTest("\r\n"); } public void crlnTest(String lineSep) { AsciiTranslator t = new AsciiTranslator(true, false, lineSep.getBytes()); check(t, "1abcdef", "1abcdef"); check(t, "2abc\r\ndef", "2abc" + lineSep + "def"); check(t, "3abc\r\r\ndef", "3abc\r" + lineSep + "def"); check(t, "4abc\n\n\n\n", "4abc\n\n\n\n"); check(t, "a\rb\r\nc\n\n\r\rd", "a\rb" + lineSep + "c\n\n\r\rd"); check(t, "abc\r", "abc"); check(t, "def", "\rdef"); check(t, "a\r\n\nbc\r", "a" + lineSep + "\nbc"); check(t, "\n\r\ndef", lineSep + lineSep + "def"); } public void test3() { lnTest("\n"); } public void test4() { lnTest("\r\n"); } public void lnTest(String lineSep) { AsciiTranslator t = new AsciiTranslator(false, true, lineSep.getBytes()); check(t, "1abcdef", "1abcdef"); check(t, "2abc\r\ndef", "2abc\r" + lineSep + "def"); check(t, "3abc\r\r\ndef", "3abc\r\r" + lineSep + "def"); check(t, "4abc\n\n\n", "4abc" + lineSep + lineSep + lineSep); check(t, "a\rb\r\nc\n\n\r\rd", "a\rb\r" + lineSep + "c" + lineSep + lineSep + "\r\rd"); check(t, "abc\r", "abc\r"); check(t, "a\r\n\nbc\r", "a\r" + lineSep + lineSep + "bc\r"); check(t, "\n\r\ndef", lineSep + "\r" + lineSep + "def"); } private void check(AsciiTranslator t, String inputStr, String expectedStr) { byte [] input = inputStr.getBytes(); byte [] output = t.translate(new Buffer(input, input.length)).getBuffer(); assertEquals(expectedStr, new String(output)); } } JGlobus-JGlobus-Release-2.1.0/gridftp/src/test/java/org/globus/ftp/test/ByteRangeListTest.java 0000664 0000000 0000000 00000020160 12411160572 0032175 0 ustar 00root root 0000000 0000000 /* * Copyright 1999-2006 University of Chicago * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * You may obtain a copy of the License at * * http://www.apache.org/licenses/LICENSE-2.0 * * Unless required by applicable law or agreed to in writing, software * distributed under the License is distributed on an "AS IS" BASIS, * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. * See the License for the specific language governing permissions and * limitations under the License. */ package org.globus.ftp.test; import org.globus.ftp.ByteRange; import org.globus.ftp.ByteRangeList; import java.util.Vector; import junit.framework.TestCase; import junit.framework.Test; import junit.framework.TestSuite; import org.apache.commons.logging.Log; import org.apache.commons.logging.LogFactory; /** Test ByteRangeList **/ public class ByteRangeListTest extends TestCase { private static Log logger = LogFactory.getLog(ByteRangeListTest.class.getName()); public static void main(String[] argv) { junit.textui.TestRunner.run (suite()); } public static Test suite() { return new TestSuite(ByteRangeListTest.class); } public ByteRangeListTest(String name) { super(name); } /** Test merging ByteRange to ByteRangeList. Systematic test of most cases. Tests merge() and toFtpCmdArgument(). Assure that merge() does not modify parameter objects. **/ public void test1() { Vector v = new Vector(); v.add(new ByteRange(12, 17)); v.add(new ByteRange(24, 26)); v.add(new ByteRange(31, 31)); v.add(new ByteRange(40, 45)); v.add(new ByteRange(52, 52)); // t = vector // o = new range // t t t t t = // "12-17 24-26 31-31 40-45 52-52" // o t t t t t assertMerge1(v, 0,5, "0-5,12-17,24-26,31-31,40-45,52-52"); // ot t t t t assertMerge1(v, 7,11, "7-17,24-26,31-31,40-45,52-52"); // o-t t t t t assertMerge1(v, 3,15, "3-17,24-26,31-31,40-45,52-52"); // o-o t t t t assertMerge1(v, 10,18, "10-18,24-26,31-31,40-45,52-52"); // o-ot t t t assertMerge1(v, 10,23, "10-26,31-31,40-45,52-52"); // o-o-t t t t assertMerge1(v, 10,30, "10-31,40-45,52-52"); // o-o-o-o- t assertMerge1(v, 10,50, "10-50,52-52"); // o-o-o-o-o-o assertMerge1(v, 10,53, "10-53"); // t-t t t t t assertMerge1(v, 13,16, "12-17,24-26,31-31,40-45,52-52"); // - t t t t assertMerge1(v, 12,17, "12-17,24-26,31-31,40-45,52-52"); // t-o-o-t t t assertMerge1(v, 16,31, "12-31,40-45,52-52"); // -o-o-o-o-o assertMerge1(v, 12,100, "12-100"); // t o t t t t assertMerge1(v, 24,26, "12-17,24-26,31-31,40-45,52-52"); // t ot t t t assertMerge1(v, 20,23, "12-17,20-26,31-31,40-45,52-52"); // t o-o t t t assertMerge1(v, 20,29, "12-17,20-29,31-31,40-45,52-52"); // t o-ot t t assertMerge1(v, 20,30, "12-17,20-31,40-45,52-52"); // t o-o-o-o t assertMerge1(v, 20,49, "12-17,20-49,52-52"); // t to t t t assertMerge1(v, 27,27, "12-17,24-27,31-31,40-45,52-52"); // t tot t t assertMerge1(v, 27,30, "12-17,24-31,40-45,52-52"); // t to-ot t assertMerge1(v, 26,40, "12-17,24-45,52-52"); // t t t tot assertMerge1(v, 46,51, "12-17,24-26,31-31,40-52"); // t t t t o-t assertMerge1(v, 51,52, "12-17,24-26,31-31,40-45,51-52"); // t t t t -o assertMerge1(v, 52,53, "12-17,24-26,31-31,40-45,52-53"); // t t t t t o assertMerge1(v, 54,67, "12-17,24-26,31-31,40-45,52-52,54-67"); } /** real case (taken from transfer of 500 MB) **/ public void test2() { Vector v = new Vector(); v.add(new ByteRange(0, 134545408)); v.add(new ByteRange(134545408, 298778624)); assertMerge1(v, 298778624, 466747392, "0-466747392"); } /** Ad hoc tests of interesting merge cases. Test merging several ranges into 1 list. Test merge() and toFtpCmdArgument(). **/ public void test3() { //merge 2 -> 1 Vector v = new Vector();; v.add(new ByteRange(1,3)); v.add(new ByteRange(4,6)); assertMerge(v,"1-6"); //merge 3 -> 1, 2, or 3 v = new Vector(); v.add(new ByteRange(1,3)); v.add(new ByteRange(5,19)); v.add(new ByteRange(4,6)); assertMerge(v, "1-19"); v = new Vector(); v.add(new ByteRange(1,3)); v.add(new ByteRange(9,19)); v.add(new ByteRange(4,6)); assertMerge(v, "1-6,9-19"); v = new Vector(); v.add(new ByteRange(1,3)); v.add(new ByteRange(9,19)); v.add(new ByteRange(6,12)); assertMerge(v, "1-3,6-19"); v = new Vector(); v.add(new ByteRange(1,3)); v.add(new ByteRange(9,19)); v.add(new ByteRange(6,12)); assertMerge(v, "1-3,6-19"); v = new Vector(); v.add(new ByteRange(1,3)); v.add(new ByteRange(9,19)); v.add(new ByteRange(0,2)); assertMerge(v, "0-3,9-19"); v = new Vector(); v.add(new ByteRange(1,3)); v.add(new ByteRange(9,19)); v.add(new ByteRange(0,12)); assertMerge(v, "0-19"); //large number first v = new Vector(); v.add(new ByteRange(50,64)); v.add(new ByteRange(9,19)); v.add(new ByteRange(6,12)); assertMerge(v, "6-19,50-64"); v = new Vector(); v.add(new ByteRange(50,64)); v.add(new ByteRange(9,19)); v.add(new ByteRange(6,7)); assertMerge(v, "6-7,9-19,50-64"); //2 identical v = new Vector(); v.add(new ByteRange(6,7)); v.add(new ByteRange(9,19)); v.add(new ByteRange(6,7)); assertMerge(v, "6-7,9-19"); v = new Vector(); v.add(new ByteRange(30,40)); v.add(new ByteRange(6,7)); v.add(new ByteRange(30,40)); v.add(new ByteRange(6,7)); assertMerge(v, "6-7,30-40"); //1 superset v = new Vector(); v.add(new ByteRange(30,40)); v.add(new ByteRange(6,7)); v.add(new ByteRange(35,50)); v.add(new ByteRange(3,100)); assertMerge(v, "3-100"); v = new Vector(); v.add(new ByteRange(3,100)); v.add(new ByteRange(6,7)); v.add(new ByteRange(35,50)); v.add(new ByteRange(30,40)); assertMerge(v, "3-100"); //singletons v = new Vector(); v.add(new ByteRange(3,3)); v.add(new ByteRange(6,7)); v.add(new ByteRange(1,1)); v.add(new ByteRange(8,8)); assertMerge(v, "1-1,3-3,6-8"); v = new Vector(); v.add(new ByteRange(3,3)); v.add(new ByteRange(4,4)); v.add(new ByteRange(1,1)); v.add(new ByteRange(2,2)); assertMerge(v, "1-4"); } /** Create ByteRangeList from vector v, merge with new ByteRange(from, to), assure it renders toFtpCmdArgument() as expectedResult and that original vector and range did not change. Test merge(Vector), merge(ByteRange), toFtpCmdArgument() and **/ private void assertMerge1(Vector v, int from, int to, String expectedResult) { ByteRangeList list = new ByteRangeList(); list.merge(v); ByteRange newRange = new ByteRange(from, to); String vBefore = list.toFtpCmdArgument(); String rBefore = newRange.toString(); logger.info("merging range: " + vBefore + " + " + rBefore); // test merge list.merge(newRange); String actualResult = list.toFtpCmdArgument(); logger.debug(" -> " + actualResult); assertTrue(expectedResult.equals(actualResult)); logger.debug("ok, merged as expected."); // original vector and range did not change? ByteRangeList list2 = new ByteRangeList(); list2.merge(v); String vAfter = list2.toFtpCmdArgument(); String rAfter = newRange.toString(); assertTrue(vBefore.equals(vAfter)); assertTrue(rBefore.equals(rAfter)); logger.debug("ok, original objects intact"); }; /** Merge vector into a new ByteRangeList. Test merge(ByteRange), merge(Vector), toFtpCmdArgument(). **/ private void assertMerge(Vector v, String result) { logger.info("merging vector of ranges: " + result); ByteRangeList list1 = new ByteRangeList(); for (int i=0; iBoolean.TRUE or Boolean.FALSE.
* By default limited proxies are accepted.*/
public static final Oid REJECT_LIMITED_PROXY;
/** Context option. It is used to configure delegation type to be
* performed either during authentication or using the delegation API.
* It can be set to {@link org.globus.gsi.GSIConstants#DELEGATION_TYPE_LIMITED
* GSIConstants.DELEGATION_TYPE_LIMITED} or
* {@link org.globus.gsi.GSIConstants#DELEGATION_TYPE_FULL
* GSIConstants.DELEGATION_TYPE_FULL}
* By default limited delegation is performed. */
public static final Oid DELEGATION_TYPE;
/** Context option. It is used to enable/disable context expiration
* checking for methods like wrap, unwrap, verifyMIC, getMIC.
* In can be set to either Boolean.TRUE or
* Boolean.FALSE. By default context expiration checking
* is disabled. */
public static final Oid CHECK_CONTEXT_EXPIRATION;
/** Context option. It is used to enable/disable client authentication
* on acceptor side. In can be set to either Boolean.TRUE
* or Boolean.FALSE. By default client authentication is
* enabled.*/
public static final Oid REQUIRE_CLIENT_AUTH;
/** Context option. It is only used when client authentication is enabled.
* In can be set to either Boolean.TRUE or
* Boolean.FALSE. If set to Boolean.TRUE
* a context will be successfully established even though client
* send no certificates and client authentication was required.
* If set to Boolean.FALSE, the context establishment will fail
* if client does not send its certificates and client authentication
* was requested.
*/
public static final Oid ACCEPT_NO_CLIENT_CERTS;
/** Context option. It is used to set a policy handler for
* GRIM credentials. The value is an instance of
* {@link org.globus.gsi.proxy.ProxyPolicyHandler
* ProxyPolicyHandler}
* @deprecated Please use {@link GSSConstants#PROXY_POLICY_HANDLERS
* GSSConstants.PROXY_POLICY_HANDLERS} option instead.
*/
public static final Oid GRIM_POLICY_HANDLER;
/** Context option. It is used to pass a set of proxy policy handlers.
* The value if a Map type. It contains mappings of
* proxy policy language oids and instances of
* {@link org.globus.gsi.proxy.ProxyPolicyHandler ProxyPolicyHandler}
*/
public static final Oid PROXY_POLICY_HANDLERS;
/** Context option. It is used to set a list of trusted certificates
* to use during authentication (by default, the trusted certificates
* are loaded from a standard location) The value is an instance of
* {@link org.globus.gsi.TrustedCertificates TrustedCertificates}
*/
public static final Oid TRUSTED_CERTIFICATES;
/** Used in inquireByOid function. Returns the certificate chain. */
public static final Oid X509_CERT_CHAIN;
/** Used in inquireByOid method. Retuns if peer presented a
* limited credential
*/
public static final Oid RECEIVED_LIMITED_PROXY;
/** Context option. It is set to a Boolean value and if false,
* client authorization requirement with delegation is disabled. By
* default, client side authorization (to authorize the server) is
* required for delegation of credentials.
*/
public static final Oid AUTHZ_REQUIRED_WITH_DELEGATION;
/** Context option. It is set to a Boolean value and if true,
* the GSI/GSSAPI layer will force the underlying SSL/TLS to
* use SSLv3 and a narrow set of cipher suites so communication
* with GRAM servers can succeed.
*/
public static final Oid FORCE_SSLV3_AND_CONSTRAIN_CIPHERSUITES_FOR_GRAM;
/** Quality-of-Protection (QOP) value, indicates large block size support.
* Can be passed to wrap or set by unwrap
* methods */
public static final int GSI_BIG = 1; // GSS_C_QOP_GLOBUS_GSSAPI_OPENSSL_BIG
static {
try {
// globus mech oid
MECH_OID = new Oid("1.3.6.1.4.1.3536.1.1");
// options
GSS_MODE = new Oid("1.3.6.1.4.1.3536.1.1.1");
DELEGATION_TYPE = new Oid("1.3.6.1.4.1.3536.1.1.2");
CHECK_CONTEXT_EXPIRATION = new Oid("1.3.6.1.4.1.3536.1.1.3");
REJECT_LIMITED_PROXY = new Oid("1.3.6.1.4.1.3536.1.1.4");
REQUIRE_CLIENT_AUTH = new Oid("1.3.6.1.4.1.3536.1.1.5");
GRIM_POLICY_HANDLER = new Oid("1.3.6.1.4.1.3536.1.1.6");
TRUSTED_CERTIFICATES = new Oid("1.3.6.1.4.1.3536.1.1.7");
X509_CERT_CHAIN = new Oid("1.3.6.1.4.1.3536.1.1.8");
ACCEPT_NO_CLIENT_CERTS = new Oid("1.3.6.1.4.1.3536.1.1.19");
PROXY_POLICY_HANDLERS = new Oid("1.3.6.1.4.1.3536.1.1.20");
RECEIVED_LIMITED_PROXY = new Oid("1.3.6.1.4.1.3536.1.1.21");
AUTHZ_REQUIRED_WITH_DELEGATION =
new Oid("1.3.6.1.4.1.3536.1.1.22");
FORCE_SSLV3_AND_CONSTRAIN_CIPHERSUITES_FOR_GRAM =
new Oid("1.3.6.1.4.1.3536.1.1.23");
} catch (Exception e) {
throw new RuntimeException(e.getMessage());
}
}
}
JGlobus-JGlobus-Release-2.1.0/gss/src/main/java/org/globus/gsi/gssapi/GlobusGSSContextImpl.java 0000664 0000000 0000000 00000311063 12411160572 0032227 0 ustar 00root root 0000000 0000000 /*
* Copyright 1999-2010 University of Chicago
*
* Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in
* compliance with the License. You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software distributed under the License is
* distributed on an "AS IS" BASIS,WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either
* express or implied.
*
* See the License for the specific language governing permissions and limitations under the License.
*/
package org.globus.gsi.gssapi;
import org.globus.gsi.util.CertificateUtil;
import org.globus.gsi.util.ProxyCertificateUtil;
import org.ietf.jgss.GSSCredential;
import org.ietf.jgss.GSSException;
import org.ietf.jgss.GSSContext;
import org.ietf.jgss.GSSManager;
import org.ietf.jgss.GSSName;
import org.ietf.jgss.Oid;
import org.ietf.jgss.MessageProp;
import org.ietf.jgss.ChannelBinding;
import org.gridforum.jgss.ExtendedGSSContext;
import org.gridforum.jgss.ExtendedGSSCredential;
import java.io.IOException;
import java.io.InputStream;
import java.io.OutputStream;
import java.io.ByteArrayOutputStream;
import java.io.ByteArrayInputStream;
import java.nio.ByteBuffer;
import java.util.Arrays;
import java.util.ArrayList;
import java.util.LinkedList;
import java.util.Date;
import java.util.Calendar;
import java.util.Map;
import java.security.cert.Certificate;
import java.security.cert.X509Certificate;
import java.security.KeyPair;
import java.security.GeneralSecurityException;
import java.security.interfaces.RSAPublicKey;
import java.security.interfaces.RSAPrivateKey;
import org.globus.gsi.ProviderLoader;
import org.globus.gsi.stores.ResourceSigningPolicyStore;
import java.security.cert.CertStore;
import java.security.cert.CertificateFactory;
import java.security.KeyStore;
import org.globus.gsi.GSIConstants;
import org.globus.gsi.TrustedCertificates;
import org.globus.gsi.X509Credential;
import org.globus.gsi.util.CertificateLoadUtil;
import org.globus.gsi.bc.BouncyCastleUtil;
import org.globus.gsi.bc.BouncyCastleCertProcessingFactory;
import org.globus.util.I18n;
import javax.net.ssl.SSLContext;
import javax.net.ssl.SSLEngine;
import javax.net.ssl.SSLEngineResult;
import javax.net.ssl.SSLException;
import javax.net.ssl.SSLPeerUnverifiedException;
import org.globus.gsi.jsse.SSLConfigurator;
import org.bouncycastle.jce.provider.X509CertificateObject;
/*
import COM.claymoresystems.ptls.SSLConn;
import COM.claymoresystems.ptls.SSLRecord;
import COM.claymoresystems.ptls.SSLDebug;
import COM.claymoresystems.ptls.SSLCipherSuite;
import COM.claymoresystems.ptls.SSLCipherState;
import COM.claymoresystems.ptls.SSLHandshake;
import COM.claymoresystems.sslg.SSLPolicyInt;
import COM.claymoresystems.sslg.CertVerifyPolicyInt;
import COM.claymoresystems.cert.X509Cert;
import COM.claymoresystems.util.Util;
*/
import org.apache.commons.logging.Log;
import org.apache.commons.logging.LogFactory;
import org.globus.gsi.stores.Stores;
/**
* Implementation of SSL/GSI mechanism for Java GSS-API. The implementation
* is based on JSSE (for SSL API) and the
* BouncyCastle library
* (for certificate processing API).
* wrap with {@link GSSConstants#GSI_BIG
* GSSConstants.GSI_BIG}
* QoP and a regular token created by wrap. */
public static final int GSI_WRAP = 26; /** SSL3_RT_GSSAPI_OPENSSL */
private static final int GSI_SEQUENCE_SIZE = 8;
private static final int GSI_MESSAGE_DIGEST_PADDING = 12;
private static final String [] ENABLED_PROTOCOLS = {"TLSv1", "SSLv3"};
// TODO: Delete this once GRAM server is fixed and we no longer
// would be talking to old GRAM servers.
private static final String [] GRAM_PROTOCOLS = {"SSLv3"};
/*DEL
private static final short [] NO_ENCRYPTION = {SSLPolicyInt.TLS_RSA_WITH_NULL_MD5};
*/
private static final String [] NO_ENCRYPTION =
{"SSL_RSA_WITH_NULL_SHA", "SSL_RSA_WITH_NULL_MD5"};
// TODO: Delete these once GRAM server is fixed and we no longer
// would be talking to old GRAM servers.
private static final String [] GRAM_ENCRYPTION_CIPHER_SUITES =
{"SSL_RSA_WITH_3DES_EDE_CBC_SHA"};
private static final String [] GRAM_NO_ENCRYPTION_CIPHER_SUITES =
{"SSL_RSA_WITH_NULL_SHA"};
private static final byte[] DELEGATION_TOKEN = new byte[] {GSIConstants.DELEGATION_CHAR};
private static final int
UNDEFINED = 0,
INITIATE = 1,
ACCEPT = 2;
/** Handshake state */
protected int state = HANDSHAKE;
/* handshake states */
private static final int
HANDSHAKE = 0,
CLIENT_START_DEL = 2,
CLIENT_END_DEL = 3,
SERVER_START_DEL = 4,
SERVER_END_DEL = 5;
/** Delegation state */
protected int delegationState = DELEGATION_START;
/* delegation states */
private static final int
DELEGATION_START = 0,
DELEGATION_SIGN_CERT = 1,
DELEGATION_COMPLETE_CRED = 2;
/** Credential delegated using delegation API */
protected ExtendedGSSCredential delegatedCred;
/** Delegation finished indicator */
protected boolean delegationFinished = false;
// gss context state variables
protected boolean credentialDelegation = false;
protected boolean anonymity = false;
protected boolean encryption = true;
protected boolean established = false;
/** The name of the context initiator */
protected GSSName sourceName = null;
/** The name of the context acceptor */
protected GSSName targetName = null;
/** Context role */
protected int role = UNDEFINED;
/** Credential delegated during context establishment */
protected ExtendedGSSCredential delegCred;
// these can be set via setOption
/*DEL
protected Integer delegationType = GSIConstants.DELEGATION_TYPE_LIMITED;
*/
protected GSIConstants.DelegationType delegationType =
GSIConstants.DelegationType.LIMITED;
protected Integer gssMode = GSIConstants.MODE_GSI;
protected Boolean checkContextExpiration = Boolean.FALSE;
protected Boolean rejectLimitedProxy = Boolean.FALSE;
protected Boolean requireClientAuth = Boolean.TRUE;
protected Boolean acceptNoClientCerts = Boolean.FALSE;
protected Boolean requireAuthzWithDelegation = Boolean.TRUE;
protected Boolean forceSSLv3AndConstrainCipherSuitesForGram =
Boolean.FALSE;
// *** implementation-specific variables ***
/** Credential of this context. Might be anonymous */
protected GlobusGSSCredentialImpl ctxCred;
/** Expected target name. Used for authorization in initiator */
protected GSSName expectedTargetName = null;
/** Context expiration date. */
protected Date goodUntil = null;
protected SSLConfigurator sslConfigurator = null;
protected SSLContext sslContext = null;
protected SSLEngine sslEngine = null;
/*DEL
protected SSLConn conn;
*/
protected boolean conn = false;
/*DEL
protected PureTLSContext context;
protected SSLPolicyInt policy;
protected TokenInputStream in;
protected ByteArrayOutputStream out;
*/
private byte[] savedInBytes = null;
private ByteBuffer outByteBuff = null;
protected BouncyCastleCertProcessingFactory certFactory;
/** Used during delegation */
protected KeyPair keyPair;
protected TrustedCertificates tc;
protected Map proxyPolicyHandlers;
/** Limited peer credentials */
protected Boolean peerLimited = null;
private String[] bannedCiphers = new String[0];
/**
* @param target expected target name. Can be null.
* @param cred credential. Cannot be null. Might be anonymous.
*/
public GlobusGSSContextImpl(GSSName target,
GlobusGSSCredentialImpl cred)
throws GSSException {
if (cred == null) {
throw new GSSException(GSSException.NO_CRED);
}
this.expectedTargetName = target;
this.ctxCred = cred;
/*DEL
this.context = new PureTLSContext();
*/
try {
this.sslConfigurator = new SSLConfigurator();
// Need to set this so we are able to communicate properly with
// GT4.0.8 servers that use only SSLv3 (no TLSv1). Thanks to
// Jon Siwek for pointing this and the following link out:
// http://java.sun.com/j2se/1.4.2/relnotes.html#security
if (System.getProperty("com.sun.net.ssl.rsaPreMasterSecretFix") == null)
System.setProperty("com.sun.net.ssl.rsaPreMasterSecretFix", "true");
// WARNING WARNING:
// The new jglobus2-based srm-client is not compatible with old bestman2
// servers UNLESS we change this setting.
//
// The protection we are turning off helps against the BEAST attack.
// When enabled, it will insert empty TLS application records into the
// stream. However, the old server will deadlock on the extra records.
//
// To our knowledge, the BEAST attack is not applicable to this client as
// we don't have any concurrent insecure connections. Regardless, we ought
// to remove this as soon as we can drop support for the old servers.
//
// -BB. Sept 24, 2012.
//
System.setProperty("jsse.enableCBCProtection", "false");
} catch (Exception e) {
throw new GlobusGSSException(GSSException.FAILURE, e);
}
/*DEL
CertVerifyPolicyInt certPolicy = PureTLSUtil.getDefaultCertVerifyPolicy();
this.policy = new SSLPolicyInt();
this.policy.negotiateTLS(false);
this.policy.waitOnClose(false);
this.policy.setCertVerifyPolicy(certPolicy);
this.context.setPolicy(policy);
// TODO
setSSLDebugging();
*/
}
/*DEL
private void setSSLDebugging() {
if (sslLog.isTraceEnabled()) {
SSLDebug.setDebug( 0xffff );
} else if (sslLog.isDebugEnabled()) {
SSLDebug.setDebug( SSLDebug.DEBUG_CERT );
}
}
*/
/*
* If the result indicates that we have outstanding tasks to do,
* go ahead and run them in this thread.
*/
private void runDelegatedTasks(SSLEngine engine) throws Exception {
Runnable runnable;
while ((runnable = engine.getDelegatedTask()) != null) {
logger.debug("\trunning delegated task...");
runnable.run();
}
SSLEngineResult.HandshakeStatus hsStatus =
engine.getHandshakeStatus();
if (hsStatus == SSLEngineResult.HandshakeStatus.NEED_TASK) {
throw new Exception(
"handshake shouldn't need additional tasks");
}
logger.debug("\tnew HandshakeStatus: " + hsStatus);
}
private X509Certificate bcConvert(X509Certificate cert)
throws GSSException {
if (!(cert instanceof X509CertificateObject)) {
ByteArrayInputStream inputStream = null;
try {
inputStream = new ByteArrayInputStream(cert.getEncoded());
return CertificateLoadUtil.loadCertificate(inputStream);
} catch (Exception e) {
throw new GlobusGSSException(GSSException.FAILURE, e);
}finally{
if (inputStream != null) {
try {
inputStream.close();
} catch (Exception e) {
logger.warn("Unable to close streamreader.");
}
}
}
} else {
return cert;
}
}
/**
* This function drives the accepting side of the context establishment
* process. It is expected to be called in tandem with the
* {@link #initSecContext(byte[], int, int) initSecContext} function.
* wrap method on the other side of the context.
*/
public byte[] unwrap(byte []inBuf, int off, int len, MessageProp prop)
throws GSSException {
checkContext();
logger.debug("enter unwrap");
byte [] token = null;
/*
* see if the token is a straight SSL packet or
* one of ours made by wrap using get_mic
*/
if (inBuf[off] == GSI_WRAP &&
inBuf[off+1] == 3 &&
inBuf[off+2] == 0) {
throw new GSSException(GSSException.UNAVAILABLE);
/*DEL
int micLen = SSLUtil.toShort(inBuf[off+3], inBuf[off+4]);
int msgLen = len - 5 - micLen;
if (micLen > len-5 || msgLen < 0) {
throw new GSSException(GSSException.DEFECTIVE_TOKEN);
}
verifyMIC(inBuf, off+5, micLen,
inBuf, off+5+micLen, msgLen,
null);
if (prop != null) {
prop.setPrivacy(false);
prop.setQOP(GSSConstants.GSI_BIG);
}
// extract the data
token = new byte[msgLen];
System.arraycopy(inBuf, off+5+micLen, token, 0, msgLen);
*/
} else {
token = unwrap(inBuf, off, len);
if (prop != null) {
prop.setPrivacy(this.encryption);
prop.setQOP(0);
}
}
logger.debug("exit unwrap");
return token;
}
private byte[] unwrap(byte[] inBuf, int off, int len)
throws GSSException {
/*DEL
ByteArrayInputStream in =
new ByteArrayInputStream(inBuf, off, len);
ByteArrayOutputStream out =
new ByteArrayOutputStream();
// TODO: this might need to be rewritten
// to catch lower level exceptions
// e.g. mac too long, etc.
try {
while(in.available() > 0) {
SSLRecord r = new SSLRecord(null);
r.decode(this.conn, in);
switch (r.getType().getValue()) {
case SSLRecord.SSL_CT_APPLICATION_DATA:
out.write(r.getData().getValue());
break;
case SSLRecord.SSL_CT_ALERT:
this.conn.getRecordReader().processAlert(r.getData().getValue());
break;
default:
throw new Exception(i18n.getMessage("tokenFail03"));
}
}
} catch (IOException e) {
throw new GlobusGSSException(GSSException.BAD_MIC, e);
} catch (Exception e) {
throw new GlobusGSSException(GSSException.DEFECTIVE_TOKEN, e);
}
return out.toByteArray();
*/
ByteBuffer inByteBuff;
if (savedInBytes != null) {
if (len > 0) {
byte[] allInBytes = new byte[savedInBytes.length + len];
logger.debug("ALLOCATED for allInBytes " + savedInBytes.length + " + " + len + " bytes\n");
System.arraycopy(savedInBytes, 0, allInBytes, 0, savedInBytes.length);
System.arraycopy(inBuf, off, allInBytes, savedInBytes.length, len);
inByteBuff = ByteBuffer.wrap(allInBytes, 0, allInBytes.length);
} else {
inByteBuff = ByteBuffer.wrap(savedInBytes, 0, savedInBytes.length);
}
savedInBytes = null;
} else {
inByteBuff = ByteBuffer.wrap(inBuf, off, len);
}
this.outByteBuff.clear();
outByteBuff = this.sslDataUnwrap(inByteBuff, outByteBuff);
outByteBuff.flip();
if (inByteBuff.hasRemaining()) {
logger.debug("Not all data processed; Original: " + len
+ " Remaining: " + inByteBuff.remaining() +
" Handshaking status: " + sslEngine.getHandshakeStatus());
logger.debug("SAVING unprocessed " + inByteBuff.remaining() + "BYTES\n");
savedInBytes = new byte[inByteBuff.remaining()];
inByteBuff.get(savedInBytes, 0, savedInBytes.length);
}
if (this.outByteBuff.hasRemaining()) {
// TODO can we avoid this copy if the ByteBuffer is array based
// and we return that array, each time allocating a new array
// for outByteBuff?
byte [] out = new byte[this.outByteBuff.remaining()];
this.outByteBuff.get(out, 0, out.length);
return out;
} else
return null;
}
public void dispose()
throws GSSException {
// doesn't do anything right now
logger.debug("dipose");
}
public boolean isEstablished() {
return this.established;
}
public void requestCredDeleg(boolean state) throws GSSException {
this.credentialDelegation = state;
}
public boolean getCredDelegState() {
return this.credentialDelegation;
}
public boolean isInitiator()
throws GSSException {
if (this.role == UNDEFINED) {
throw new GSSException(GSSException.FAILURE);
}
return (this.role == INITIATE);
}
public boolean isProtReady() {
return isEstablished();
}
public void requestLifetime(int lifetime)
throws GSSException {
if (lifetime == GSSContext.INDEFINITE_LIFETIME) {
throw new GlobusGSSException(GSSException.FAILURE,
GlobusGSSException.UNKNOWN,
"badLifetime00");
}
if (lifetime != GSSContext.DEFAULT_LIFETIME) {
Calendar calendar = Calendar.getInstance();
calendar.add(Calendar.SECOND, lifetime);
setGoodUntil(calendar.getTime());
}
}
public int getLifetime() {
if (this.goodUntil != null) {
return (int)((this.goodUntil.getTime() - System.currentTimeMillis())/1000);
} else {
return -1;
}
}
public Oid getMech() throws GSSException {
return GSSConstants.MECH_OID;
}
public GSSCredential getDelegCred() throws GSSException {
return this.delegCred;
}
public void requestConf(boolean state)
throws GSSException {
// enabled encryption
this.encryption = state;
}
public boolean getConfState() {
return this.encryption;
}
/**
* Returns a cryptographic MIC (message integrity check)
* of a specified message.
*/
public byte[] getMIC(byte [] inBuf,
int off,
int len,
MessageProp prop)
throws GSSException {
throw new GSSException(GSSException.UNAVAILABLE);
/*TODO
checkContext();
logger.debug("enter getMic");
if (prop != null && (prop.getQOP() != 0 || prop.getPrivacy())) {
throw new GSSException(GSSException.BAD_QOP);
}
SSLCipherState st = this.conn.getWriteCipherState();
SSLCipherSuite cs = st.getCipherSuite();
long sequence = this.conn.getWriteSequence();
byte [] mic = new byte[GSI_MESSAGE_DIGEST_PADDING + cs.getDigestOutputLength()];
System.arraycopy(Util.toBytes(sequence), 0, mic, 0, GSI_SEQUENCE_SIZE);
System.arraycopy(Util.toBytes(len, 4), 0, mic, GSI_SEQUENCE_SIZE, 4);
this.conn.incrementWriteSequence();
int pad_ct = (cs.getDigestOutputLength()==16) ? 48 : 40;
try {
MessageDigest md =
MessageDigest.getInstance(cs.getDigestAlg());
md.update(st.getMacKey());
for(int i=0;iacceptDelegation if
* isDelegationFinished returns false. May be null.
* @exception GSSException containing the following major error codes:
* GSSException.FAILURE
*/
public byte[] initDelegation(GSSCredential credential,
Oid mechanism,
int lifetime,
byte[] buf, int off, int len)
throws GSSException {
logger.debug("Enter initDelegation: " + delegationState);
if (mechanism != null && !mechanism.equals(getMech())) {
throw new GSSException(GSSException.BAD_MECH);
}
if (this.gssMode != GSIConstants.MODE_SSL && buf != null && len > 0) {
buf = unwrap(buf, off, len);
off = 0;
len = buf.length;
}
byte [] token = null;
switch (delegationState) {
case DELEGATION_START:
this.delegationFinished = false;
token = DELEGATION_TOKEN;
this.delegationState = DELEGATION_SIGN_CERT;
break;
case DELEGATION_SIGN_CERT:
if (credential == null) {
// get default credential
GSSManager manager = new GlobusGSSManagerImpl();
credential = manager.createCredential(GSSCredential.INITIATE_AND_ACCEPT);
}
if (!(credential instanceof GlobusGSSCredentialImpl)) {
throw new GSSException(GSSException.DEFECTIVE_CREDENTIAL);
}
X509Credential cred =
((GlobusGSSCredentialImpl)credential).getX509Credential();
X509Certificate [] chain = cred.getCertificateChain();
int time = (lifetime == GSSCredential.DEFAULT_LIFETIME) ? -1 : lifetime;
ByteArrayInputStream inData = null;
ByteArrayOutputStream out = null;
try {
inData = new ByteArrayInputStream(buf, off, len);
X509Certificate cert =
this.certFactory.createCertificate(inData,
chain[0],
cred.getPrivateKey(),
time,
/*DEL
getDelegationType(chain[0]));
*/
BouncyCastleCertProcessingFactory.decideProxyType(chain[0], this.delegationType));
out = new ByteArrayOutputStream();
out.write(cert.getEncoded());
for (int i=0;iinitDelegation if
* isDelegationFinished returns false. May be null.
* @exception GSSException containing the following major error codes:
* GSSException.FAILURE
*/
public byte[] acceptDelegation(int lifetime,
byte[] buf, int off, int len)
throws GSSException {
logger.debug("Enter acceptDelegation: " + delegationState);
if (this.gssMode != GSIConstants.MODE_SSL && buf != null && len > 0) {
buf = unwrap(buf, off, len);
off = 0;
len = buf.length;
}
byte [] token = null;
switch (delegationState) {
case DELEGATION_START:
this.delegationFinished = false;
if (len != 1 && buf[off] != GSIConstants.DELEGATION_CHAR) {
throw new GlobusGSSException(GSSException.FAILURE,
GlobusGSSException.DELEGATION_ERROR,
"delegError00",
new Object[] {new Character((char)buf[off])});
}
try {
/*DEL
Vector certChain = this.conn.getCertificateChain();
*/
Certificate[] certChain;
try {
certChain = this.sslEngine.getSession().getPeerCertificates();
} catch (SSLPeerUnverifiedException e) {
certChain = null;
}
if (certChain == null || certChain.length == 0) {
throw new GlobusGSSException(GSSException.FAILURE,
GlobusGSSException.DELEGATION_ERROR,
"noClientCert");
}
X509Certificate tmpCert =
/*DEL
PureTLSUtil.convertCert((X509Cert)certChain.lastElement());
*/
(X509Certificate) certChain[0];
token = generateCertRequest(tmpCert);
} catch (GeneralSecurityException e) {
throw new GlobusGSSException(GSSException.FAILURE, e);
}
this.delegationState = DELEGATION_COMPLETE_CRED;
break;
case DELEGATION_COMPLETE_CRED:
ByteArrayInputStream in = null;
X509Certificate [] chain = null;
LinkedList certList = new LinkedList();
X509Certificate cert = null;
try {
in = new ByteArrayInputStream(buf, off, len);
while(in.available() > 0) {
cert = CertificateLoadUtil.loadCertificate(in);
certList.add(cert);
}
chain = new X509Certificate[certList.size()];
chain = (X509Certificate[])certList.toArray(chain);
verifyDelegatedCert(chain[0]);
} catch (GeneralSecurityException e) {
throw new GlobusGSSException(GSSException.FAILURE, e);
}finally{
if (in != null) {
try {
in.close();
} catch (Exception e) {
logger.warn("Unable to close streamreader.");
}
}
}
X509Credential proxy =
new X509Credential(this.keyPair.getPrivate(), chain);
this.delegatedCred =
new GlobusGSSCredentialImpl(proxy,
GSSCredential.INITIATE_AND_ACCEPT);
this.delegationState = DELEGATION_START;
this.delegationFinished = true;
break;
default:
throw new GSSException(GSSException.FAILURE);
}
logger.debug("Exit acceptDelegation");
if (this.gssMode != GSIConstants.MODE_SSL && token != null) {
// XXX: Why wrap() only when not in MODE_SSL?
return wrap(token, 0, token.length);
} else {
return token;
}
}
public GSSCredential getDelegatedCredential() {
return this.delegatedCred;
}
public boolean isDelegationFinished() {
return this.delegationFinished;
}
/**
* Retrieves arbitrary data about this context.
* Currently supported oid: X509Certificate[]).
* GSSException.FAILURE
*/
public Object inquireByOid(Oid oid)
throws GSSException {
if (oid == null) {
throw new GlobusGSSException(GSSException.FAILURE,
GlobusGSSException.BAD_ARGUMENT,
"nullOption");
}
if (oid.equals(GSSConstants.X509_CERT_CHAIN)) {
if (isEstablished()) {
// converting certs is slower but keeping coverted certs
// takes lots of memory.
try {
/*DEL
Vector peerCerts = this.conn.getCertificateChain();
*/
Certificate[] peerCerts;
try {
peerCerts = this.sslEngine.getSession().getPeerCertificates();
} catch (SSLPeerUnverifiedException e) {
peerCerts = null;
}
if (peerCerts != null && peerCerts.length > 0) {
/*DEL
return PureTLSUtil.certificateChainToArray(peerCerts);
*/
return (X509Certificate[])peerCerts;
} else {
return null;
}
} catch (Exception e) {
throw new GlobusGSSException(
GSSException.DEFECTIVE_CREDENTIAL,
e
);
}
}
} else if (oid.equals(GSSConstants.RECEIVED_LIMITED_PROXY)) {
return this.peerLimited;
}
return null;
}
public void setBannedCiphers(String[] ciphers) {
bannedCiphers = new String[ciphers.length];
System.arraycopy(ciphers, 0, bannedCiphers, 0, ciphers.length);
}
// ==================================================================
// Not implemented below
// ==================================================================
/**
* Currently not implemented.
*/
public int getWrapSizeLimit(int qop, boolean confReq,
int maxTokenSize)
throws GSSException {
throw new GSSException(GSSException.UNAVAILABLE);
}
/**
* Currently not implemented.
*/
public void wrap(InputStream inStream, OutputStream outStream,
MessageProp msgProp)
throws GSSException {
throw new GSSException(GSSException.UNAVAILABLE);
}
/**
* Currently not implemented.
*/
public void unwrap(InputStream inStream, OutputStream outStream,
MessageProp msgProp)
throws GSSException {
throw new GSSException(GSSException.UNAVAILABLE);
}
/**
* Currently not implemented.
*/
public void getMIC(InputStream inStream, OutputStream outStream,
MessageProp msgProp)
throws GSSException {
throw new GSSException(GSSException.UNAVAILABLE);
}
/**
* Currently not implemented.
*/
public void verifyMIC(InputStream tokStream, InputStream msgStream,
MessageProp msgProp)
throws GSSException {
throw new GSSException(GSSException.UNAVAILABLE);
}
/**
* Currently not implemented.
*/
public void setChannelBinding(ChannelBinding cb)
throws GSSException {
throw new GSSException(GSSException.UNAVAILABLE);
}
/**
* Currently not implemented.
*/
public boolean isTransferable()
throws GSSException {
throw new GSSException(GSSException.UNAVAILABLE);
}
/**
* Currently not implemented.
*/
public byte [] export()
throws GSSException {
throw new GSSException(GSSException.UNAVAILABLE);
}
}
JGlobus-JGlobus-Release-2.1.0/gss/src/main/java/org/globus/gsi/gssapi/GlobusGSSCredentialImpl.java 0000664 0000000 0000000 00000017140 12411160572 0032654 0 ustar 00root root 0000000 0000000 /*
* Copyright 1999-2010 University of Chicago
*
* Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in
* compliance with the License. You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software distributed under the License is
* distributed on an "AS IS" BASIS,WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either
* express or implied.
*
* See the License for the specific language governing permissions and limitations under the License.
*/
package org.globus.gsi.gssapi;
import org.globus.util.Util;
import org.ietf.jgss.GSSException;
import org.ietf.jgss.GSSName;
import org.ietf.jgss.Oid;
import org.gridforum.jgss.ExtendedGSSCredential;
import java.security.cert.X509Certificate;
import java.security.PrivateKey;
import java.io.ByteArrayOutputStream;
import java.io.Serializable;
import java.io.IOException;
import java.io.File;
import java.io.FileOutputStream;
import org.globus.gsi.X509Credential;
import java.security.cert.CertificateEncodingException;
import org.globus.gsi.CredentialException;
/**
* An implementation of GlobusGSSCredential.
*/
public class GlobusGSSCredentialImpl implements ExtendedGSSCredential,
Serializable {
private static final long serialVersionUID = 1L;
private int usage = 0;
private X509Credential cred;
private GSSName name;
/**
* Creates anonymous credential.
*/
public GlobusGSSCredentialImpl() {
this.cred = null;
this.name = new GlobusGSSName();
}
/**
* Creates regular credential from specified
* X509Credential object.
*
* @param cred the credential
* @param usage credential usage
*/
public GlobusGSSCredentialImpl(X509Credential cred,
int usage)
throws GSSException {
if (cred == null) {
throw new IllegalArgumentException("cred == null");
}
this.cred = cred;
this.usage = usage;
this.name = new GlobusGSSName(cred.getIdentity());
}
@Override
public int hashCode() {
if (this.cred == null) {
return this.usage;
} else {
return this.cred.hashCode() + this.usage;
}
}
@Override
public boolean equals(Object obj) {
if (obj instanceof GlobusGSSCredentialImpl) {
GlobusGSSCredentialImpl other = (GlobusGSSCredentialImpl)obj;
return other.usage == this.usage &&
(other.cred == this.cred || this.cred != null && this.cred.equals(other.cred));
}
return false;
}
public void dispose() throws GSSException {
this.cred = null;
}
public GSSName getName() throws GSSException {
return this.name;
}
public GSSName getName(Oid mech) throws GSSException {
GlobusGSSManagerImpl.checkMechanism(mech);
return this.name;
}
/**
* Currently not implemented.
*/
public void add(GSSName aName,
int initLifetime,
int acceptLifetime,
Oid mech,
int usage)
throws GSSException {
// currently we are not supporting multiple mechanism
// credentials
throw new GSSException(GSSException.UNAVAILABLE);
}
public int getUsage() throws GSSException {
return usage;
}
public int getUsage(Oid mech)
throws GSSException {
GlobusGSSManagerImpl.checkMechanism(mech);
return this.usage;
}
public int getRemainingLifetime()
throws GSSException {
return (this.cred == null) ? -1 : (int)this.cred.getTimeLeft();
}
public int getRemainingInitLifetime(Oid mech)
throws GSSException {
GlobusGSSManagerImpl.checkMechanism(mech);
if (this.usage == INITIATE_ONLY ||
this.usage == INITIATE_AND_ACCEPT) {
return getRemainingLifetime();
} else {
throw new GSSException(GSSException.FAILURE);
}
}
public int getRemainingAcceptLifetime(Oid mech)
throws GSSException {
GlobusGSSManagerImpl.checkMechanism(mech);
if (this.usage == ACCEPT_ONLY ||
this.usage == INITIATE_AND_ACCEPT) {
return getRemainingLifetime();
} else {
throw new GSSException(GSSException.FAILURE);
}
}
public Oid[] getMechs()
throws GSSException {
return GlobusGSSManagerImpl.MECHS;
}
public byte[] export(int option)
throws GSSException {
return export(option, null);
}
public byte[] export(int option, Oid mech)
throws GSSException {
GlobusGSSManagerImpl.checkMechanism(mech);
if (this.cred == null) {
throw new GlobusGSSException(GSSException.FAILURE,
GlobusGSSException.CREDENTIAL_ERROR,
"anonCred00");
}
switch (option) {
case IMPEXP_OPAQUE:
ByteArrayOutputStream bout = new ByteArrayOutputStream();
try {
this.cred.save(bout);
} catch (IOException e) {
throw new GlobusGSSException(GSSException.FAILURE, e);
} catch (CertificateEncodingException e) {
throw new GlobusGSSException(GSSException.FAILURE, e);
}
return bout.toByteArray();
case IMPEXP_MECH_SPECIFIC:
File file = null;
FileOutputStream fout = null;
try {
file = File.createTempFile("x509up_", ".tmp");
Util.setOwnerAccessOnly(file.getAbsolutePath());
fout = new FileOutputStream(file);
this.cred.save(fout);
} catch(IOException e) {
throw new GlobusGSSException(GSSException.FAILURE, e);
} catch (CertificateEncodingException e) {
throw new GlobusGSSException(GSSException.FAILURE, e);
} finally {
if (fout != null) {
try { fout.close(); } catch (Exception e) {}
}
}
String handle = "X509_USER_PROXY=" + file.getAbsolutePath();
return handle.getBytes();
default:
throw new GlobusGSSException(GSSException.FAILURE,
GlobusGSSException.BAD_ARGUMENT,
"unknownOption",
new Object[] {new Integer(option)});
}
}
/**
* Retrieves arbitrary data about this credential.
* Currently supported oid: X509Certificate[]).
* GSSException.FAILURE
*/
public Object inquireByOid(Oid oid)
throws GSSException {
if (oid == null) {
throw new GlobusGSSException(GSSException.FAILURE,
GlobusGSSException.BAD_ARGUMENT,
"nullOption");
}
if (oid.equals(GSSConstants.X509_CERT_CHAIN)) {
return (this.cred == null) ?
null :
this.cred.getCertificateChain();
}
return null;
}
/**
* Returns actual X509Credential object represented
* by this credential (if any).
*
* @return The credential object. Might be null if
* this is an anonymous credential.
*/
public X509Credential getX509Credential() {
return this.cred;
}
/**
* Returns the private key of this credential (if any).
*
* @return The private key. Might be null if this
* is an anonymous credential.
*/
public PrivateKey getPrivateKey()
throws GSSException {
try {
return (this.cred == null) ? null : this.cred.getPrivateKey();
} catch (CredentialException e) {
throw new GlobusGSSException(GSSException.FAILURE, e);
}
}
/**
* Returns certificate chain of this credential (if any).
*
* @return The certificate chain. Might be null if this
* is an anonymous credential.
*/
public X509Certificate [] getCertificateChain() {
return (this.cred == null) ? null : this.cred.getCertificateChain();
}
}
JGlobus-JGlobus-Release-2.1.0/gss/src/main/java/org/globus/gsi/gssapi/GlobusGSSException.java 0000664 0000000 0000000 00000016347 12411160572 0031726 0 ustar 00root root 0000000 0000000 /*
* Copyright 1999-2010 University of Chicago
*
* Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in
* compliance with the License. You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software distributed under the License is
* distributed on an "AS IS" BASIS,WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either
* express or implied.
*
* See the License for the specific language governing permissions and limitations under the License.
*/
package org.globus.gsi.gssapi;
import java.io.PrintStream;
import java.io.PrintWriter;
import java.text.MessageFormat;
import java.util.ResourceBundle;
import java.util.MissingResourceException;
import org.ietf.jgss.GSSException;
import javax.net.ssl.SSLException;
public class GlobusGSSException extends GSSException {
private static final long serialVersionUID = 1366868883920091438L;
public static final int
PROXY_VIOLATION = 5,
BAD_ARGUMENT = 7,
BAD_NAME = 25,
CREDENTIAL_ERROR = 27,
TOKEN_FAIL = 29,
DELEGATION_ERROR = 30,
BAD_MIC = 33,
UNKNOWN_OPTION = 37;
public static final int
BAD_OPTION_TYPE = 100,
BAD_OPTION = 101,
UNKNOWN = 102;
private static ResourceBundle resources;
static {
try {
resources = ResourceBundle.getBundle("org.globus.gsi.gssapi.errors");
} catch (MissingResourceException e) {
throw new RuntimeException(e.getMessage());
}
}
private final boolean hasCustomMessage;
public GlobusGSSException(int majorCode,
Throwable cause) {
super(majorCode);
initCause(cause);
hasCustomMessage = false;
}
public GlobusGSSException(int majorCode,
int minorCode,
String minorString,
Throwable cause) {
super(majorCode, minorCode, minorString);
initCause(cause);
hasCustomMessage = true;
}
public GlobusGSSException(int majorCode,
int minorCode,
String key) {
this(majorCode, minorCode, key, (Object[])null);
}
public GlobusGSSException(int majorCode,
int minorCode,
String key,
Object [] args) {
super(majorCode);
String msg = null;
try {
msg = MessageFormat.format(resources.getString(key), args);
} catch (MissingResourceException e) {
//msg = "No msg text defined for '" + key + "'";
throw new RuntimeException("bad" + key);
}
setMinor(minorCode, msg);
initCause(null);
hasCustomMessage = true;
}
/**
* Prints this exception's stack trace to System.err.
* If this exception has a root exception; the stack trace of the
* root exception is printed to System.err instead.
*/
@Override
public void printStackTrace() {
printStackTrace( System.err );
}
/**
* Prints this exception's stack trace to a print stream.
* If this exception has a root exception; the stack trace of the
* root exception is printed to the print stream instead.
* @param ps The non-null print stream to which to print.
*/
@Override
public void printStackTrace(PrintStream ps) {
if ( getCause() != null ) {
String superString = getLocalMessage();
synchronized ( ps ) {
ps.print(superString);
ps.print((superString.endsWith(".") ?
" Caused by " : ". Caused by "));
getCause().printStackTrace( ps );
}
} else {
super.printStackTrace( ps );
}
}
/**
* Prints this exception's stack trace to a print writer.
* If this exception has a root exception; the stack trace of the
* root exception is printed to the print writer instead.
* @param pw The non-null print writer to which to print.
*/
@Override
public void printStackTrace(PrintWriter pw) {
if ( getCause() != null ) {
String superString = getLocalMessage();
synchronized (pw) {
pw.print(superString);
pw.print((superString.endsWith(".") ?
" Caused by " : ". Caused by "));
getCause().printStackTrace( pw );
}
} else {
super.printStackTrace( pw );
}
}
@Override
public String getMessage() {
Throwable cause = getCause();
if (isBoring(this)) {
return getUsefulMessage(cause);
} else {
StringBuilder message = new StringBuilder(super.getMessage());
if (cause != null) {
message.append(" [Caused by: ").append(getUsefulMessage(cause)).append("]");
}
return message.toString();
}
}
/**
* Wrapper around getMessage method that tries to provide a meaningful
* message. This is needed because many GSSException objects provide no
* useful information and the actual useful information is in the Throwable
* that caused the exception.
*/
private static String getUsefulMessage(Throwable throwable) {
while(isBoring(throwable)) {
throwable = throwable.getCause();
}
String message = throwable.getMessage();
if (message == null) {
message = throwable.getClass().getName();
}
return message;
}
/**
* Use heuristics to determine whether the supplied Throwable has any
* semantic content (i.e., does it provide any additional information).
*
* It seems that many GSSException objects are created with no information.
* Instead, the useful information is contained within the causing
* Throwable.
*
* Also, an SSLException may be thrown by SSLEngine that wraps some more
* interesting exception but the message has no information.
*
* As part of a work-around for this problem, this method tries to guess
* whether the supplied Throwable contains useful information.
*
* @return true if the Throwable contains no useful information, false
* otherwise.
*/
private static boolean isBoring(Throwable t) {
// Last throwable in the causal chain is never boring.
if (t.getCause() == null) {
return false;
}
// Some GSSExceptions have no semantic content, therefore boring.
if (t instanceof GSSException) {
GSSException g = (GlobusGSSException) t;
if (g.getMajor() == GSSException.FAILURE && g.getMinor() == 0) {
if (g instanceof GlobusGSSException) {
return !((GlobusGSSException)g).hasCustomMessage;
} else {
// Unfortunately, for GSSException, we must compare the
// actual message.
return g.getMessage().equals("Failure unspecified at GSS-API level");
}
}
}
// SSLEngine can return a message with no meaning, therefore boring.
if (t instanceof SSLException &&
t.getMessage().equals("General SSLEngine problem")) {
return true;
}
return false;
}
private String getLocalMessage() {
String message = super.getMessage();
return (message == null) ? getClass().getName() : message;
}
}
JGlobus-JGlobus-Release-2.1.0/gss/src/main/java/org/globus/gsi/gssapi/GlobusGSSManagerImpl.java 0000664 0000000 0000000 00000025444 12411160572 0032162 0 ustar 00root root 0000000 0000000 /*
* Copyright 1999-2010 University of Chicago
*
* Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in
* compliance with the License. You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software distributed under the License is
* distributed on an "AS IS" BASIS,WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either
* express or implied.
*
* See the License for the specific language governing permissions and limitations under the License.
*/
package org.globus.gsi.gssapi;
import org.globus.gsi.gssapi.jaas.JaasSubject;
import java.io.InputStream;
import java.io.FileInputStream;
import java.io.ByteArrayInputStream;
import java.io.IOException;
import java.security.Provider;
import java.util.Set;
import java.util.Iterator;
import javax.security.auth.Subject;
import org.ietf.jgss.GSSName;
import org.ietf.jgss.GSSCredential;
import org.ietf.jgss.GSSException;
import org.ietf.jgss.GSSContext;
import org.ietf.jgss.Oid;
import org.gridforum.jgss.ExtendedGSSManager;
import org.gridforum.jgss.ExtendedGSSCredential;
import org.globus.gsi.X509Credential;
import org.globus.gsi.CredentialException;
import org.apache.commons.logging.Log;
import org.apache.commons.logging.LogFactory;
/**
* An implementation of GlobusGSSManager.
*/
public class GlobusGSSManagerImpl extends ExtendedGSSManager {
private static Log logger =
LogFactory.getLog(GlobusGSSManagerImpl.class.getName());
static final Oid[] MECHS;
static {
try {
MECHS = new Oid[] {GSSConstants.MECH_OID};
} catch(Exception e) {
throw new RuntimeException(e.getMessage());
}
}
private GlobusGSSCredentialImpl defaultCred;
/**
* Acquires GSI GSS credentials.
*
* @see #createCredential(GSSName, int, Oid, int)
*/
public GSSCredential createCredential (int usage)
throws GSSException {
return createCredential(null,
GSSCredential.DEFAULT_LIFETIME,
(Oid)null,
usage);
}
/** Acquires GSI GSS credentials. First, it tries to find the credentials
* in the private credential set of the current JAAS Subject. If the
* Subject is not set or credentials are not found in the Subject, it
* tries to get a default user credential (usually an user proxy file)
*
* @param lifetime Only lifetime set to
* {@link GSSCredential#DEFAULT_LIFETIME
* GSSCredential.DEFAULT_LIFETIME} is allowed.
* @see org.globus.gsi.X509Credential#getDefaultCredential()
*/
public GSSCredential createCredential (GSSName name,
int lifetime,
Oid mech,
int usage)
throws GSSException {
checkMechanism(mech);
if (name != null) {
if (name.isAnonymous()) {
return new GlobusGSSCredentialImpl();
} else {
throw new GSSException(GSSException.UNAVAILABLE);
}
}
X509Credential cred = null;
Subject subject = JaasSubject.getCurrentSubject();
if (subject != null) {
logger.debug("Getting credential from context");
Set gssCreds =
subject.getPrivateCredentials(GlobusGSSCredentialImpl.class);
if (gssCreds != null) {
Iterator iter = gssCreds.iterator();
if (iter.hasNext()) {
GlobusGSSCredentialImpl credImpl =
(GlobusGSSCredentialImpl)iter.next();
cred = credImpl.getX509Credential();
}
}
}
if (lifetime == GSSCredential.INDEFINITE_LIFETIME ||
lifetime > 0) {
// lifetime not supported
throw new GlobusGSSException(GSSException.FAILURE,
GlobusGSSException.BAD_ARGUMENT,
"badLifetime01");
}
if (cred == null) {
logger.debug("Getting default credential");
try {
cred = X509Credential.getDefaultCredential();
} catch(CredentialException e) {
throw new GlobusGSSException(GSSException.DEFECTIVE_CREDENTIAL,
e);
} catch(Exception e) {
throw new GlobusGSSException(GSSException.DEFECTIVE_CREDENTIAL,
e);
}
return getDefaultCredential(cred, usage);
} else {
return new GlobusGSSCredentialImpl(cred, usage);
}
}
private synchronized GSSCredential getDefaultCredential(
X509Credential cred,
int usage)
throws GSSException {
if (this.defaultCred != null &&
this.defaultCred.getUsage() == usage &&
this.defaultCred.getX509Credential() == cred) {
return this.defaultCred;
} else {
this.defaultCred = new GlobusGSSCredentialImpl(cred, usage);
return this.defaultCred;
}
}
/**
* Acquires GSI GSS credentials.
*
* @see #createCredential(GSSName, int, Oid, int)
*/
public GSSCredential createCredential(GSSName name,
int lifetime,
Oid mechs[],
int usage)
throws GSSException {
if (mechs == null || mechs.length == 0) {
return createCredential(name, lifetime, (Oid)null, usage);
} else {
// XXX: not sure this is correct
GSSCredential cred =
createCredential(name, lifetime, mechs[0], usage);
for (int i = 1; i < mechs.length; i++) {
cred.add(name, lifetime, lifetime, mechs[i], usage);
}
return cred;
}
}
/**
* Imports a credential.
*
* @param lifetime Only lifetime set to
* {@link GSSCredential#DEFAULT_LIFETIME
* GSSCredential.DEFAULT_LIFETIME} is allowed.
*/
public GSSCredential createCredential (byte[] buff,
int option,
int lifetime,
Oid mech,
int usage)
throws GSSException {
checkMechanism(mech);
if (buff == null || buff.length < 1) {
throw new GlobusGSSException(GSSException.FAILURE,
GlobusGSSException.BAD_ARGUMENT,
"invalidBuf");
}
if (lifetime == GSSCredential.INDEFINITE_LIFETIME ||
lifetime > 0) {
// lifetime not supported
throw new GlobusGSSException(GSSException.FAILURE,
GlobusGSSException.BAD_ARGUMENT,
"badLifetime01");
}
InputStream input = null;
switch (option) {
case ExtendedGSSCredential.IMPEXP_OPAQUE:
input = new ByteArrayInputStream(buff);
break;
case ExtendedGSSCredential.IMPEXP_MECH_SPECIFIC:
String s = new String(buff);
int pos = s.indexOf('=');
if (pos == -1) {
throw new GSSException(GSSException.FAILURE);
}
String filename = s.substring(pos+1).trim();
try {
input = new FileInputStream(filename);
} catch (IOException e) {
throw new GlobusGSSException(GSSException.FAILURE, e);
}
break;
default:
throw new GlobusGSSException(GSSException.FAILURE,
GlobusGSSException.BAD_ARGUMENT,
"unknownOption",
new Object[] {new Integer(option)});
}
X509Credential cred = null;
try {
cred = new X509Credential(input);
} catch(CredentialException e) {
throw new GlobusGSSException(GSSException.DEFECTIVE_CREDENTIAL, e);
} catch (Exception e) {
throw new GlobusGSSException(GSSException.DEFECTIVE_CREDENTIAL, e);
}
return new GlobusGSSCredentialImpl(cred, usage);
}
// for initiators
public GSSContext createContext(GSSName peer,
Oid mech,
GSSCredential cred,
int lifetime)
throws GSSException {
checkMechanism(mech);
GlobusGSSCredentialImpl globusCred = null;
if (cred == null) {
globusCred = (GlobusGSSCredentialImpl)createCredential(GSSCredential.INITIATE_ONLY);
} else if (cred instanceof GlobusGSSCredentialImpl) {
globusCred = (GlobusGSSCredentialImpl)cred;
} else {
throw new GSSException(GSSException.NO_CRED);
}
GSSContext ctx = new GlobusGSSContextImpl(peer, globusCred);
ctx.requestLifetime(lifetime);
return ctx;
}
// for acceptors
public GSSContext createContext(GSSCredential cred)
throws GSSException {
GlobusGSSCredentialImpl globusCred = null;
if (cred == null) {
globusCred = (GlobusGSSCredentialImpl)createCredential(GSSCredential.ACCEPT_ONLY);
} else if (cred instanceof GlobusGSSCredentialImpl) {
globusCred = (GlobusGSSCredentialImpl)cred;
} else {
throw new GSSException(GSSException.NO_CRED);
}
// XXX: don't know about the first argument
GSSContext ctx = new GlobusGSSContextImpl(null, globusCred);
return ctx;
}
public Oid[] getMechs() {
return MECHS;
}
public GSSName createName(String nameStr, Oid nameType)
throws GSSException {
return new GlobusGSSName(nameStr, nameType);
}
/**
* Checks if the specified mechanism matches
* the mechanism supported by this implementation.
*
* @param mech mechanism to check
* @exception GSSException if mechanism not supported.
*/
public static void checkMechanism(Oid mech)
throws GSSException {
if (mech != null && !mech.equals(GSSConstants.MECH_OID)) {
throw new GSSException(GSSException.BAD_MECH);
}
}
// ==================================================================
// Not implemented below
// ==================================================================
/**
* Currently not implemented.
*/
public GSSContext createContext(byte [] interProcessToken)
throws GSSException {
throw new GSSException(GSSException.UNAVAILABLE);
}
/**
* Currently not implemented.
*/
public Oid[] getNamesForMech(Oid mech)
throws GSSException {
throw new GSSException(GSSException.UNAVAILABLE);
}
/**
* Currently not implemented.
*/
public Oid[] getMechsForName(Oid nameType) {
// not implemented, not needed by Globus
return null;
}
/**
* Currently not implemented.
*/
public GSSName createName(String nameStr,
Oid nameType,
Oid mech)
throws GSSException {
throw new GSSException(GSSException.UNAVAILABLE);
}
/**
* Currently not implemented.
*/
public GSSName createName(byte name[], Oid nameType)
throws GSSException {
throw new GSSException(GSSException.UNAVAILABLE);
}
/**
* Currently not implemented.
*/
public GSSName createName(byte name[], Oid nameType, Oid mech)
throws GSSException {
throw new GSSException(GSSException.UNAVAILABLE);
}
/**
* Currently not implemented.
*/
public void addProviderAtFront(Provider p, Oid mech)
throws GSSException {
// this GSSManager implementation does not support an SPI
// with a pluggable provider architecture
throw new GSSException(GSSException.UNAVAILABLE);
}
/**
* Currently not implemented.
*/
public void addProviderAtEnd(Provider p, Oid mech)
throws GSSException {
// this GSSManager implementation does not support an SPI
// with a pluggable provider architecture
throw new GSSException(GSSException.UNAVAILABLE);
}
}
JGlobus-JGlobus-Release-2.1.0/gss/src/main/java/org/globus/gsi/gssapi/GlobusGSSName.java 0000664 0000000 0000000 00000031367 12411160572 0030647 0 ustar 00root root 0000000 0000000 /*
* Copyright 1999-2010 University of Chicago
*
* Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in
* compliance with the License. You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software distributed under the License is
* distributed on an "AS IS" BASIS,WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either
* express or implied.
*
* See the License for the specific language governing permissions and limitations under the License.
*/
package org.globus.gsi.gssapi;
import java.net.InetAddress;
import java.net.UnknownHostException;
import org.globus.common.CoGProperties;
import org.globus.gsi.util.CertificateUtil;
import org.ietf.jgss.GSSName;
import org.ietf.jgss.GSSException;
import org.ietf.jgss.Oid;
import javax.security.auth.x500.X500Principal;
import java.io.IOException;
import java.io.Serializable;
import java.io.ObjectInputStream;
import java.io.ObjectOutputStream;
import java.util.LinkedList;
import java.util.List;
import java.util.Map;
import java.util.TreeMap;
import java.util.concurrent.*;
import java.util.regex.Pattern;
/**
* An implementation of GSSName.
*/
public class GlobusGSSName implements GSSName, Serializable {
static class ReverseDNSCache {
static class MapEntry {
final FutureGSSName.ANONYMOUS name type.
*/
public GlobusGSSName(String name)
throws GSSException {
if (name == null) {
this.nameType = GSSName.NT_ANONYMOUS;
this.name = null;
} else {
try {
this.name = CertificateUtil.toPrincipal(name);
} catch (Exception e) {
throw new GlobusGSSException(GSSException.BAD_NAME, e);
}
}
}
/**
* Creates name from X509 name of specified type.
*
* @param name
* Globus DN (e.g. /C=US/O=Globus/..) or service@host name. If null
* it is considered set as GSSName.ANONYMOUS name type.
* @param nameType name type. Only GSSName.NT_ANONYMOUS
* or GSSName.NT_HOSTBASED_SERVICE is supported.
* Maybe be null.
*/
public GlobusGSSName(String name, Oid nameType)
throws GSSException {
if (name == null) {
if (nameType != null && !nameType.equals(GSSName.NT_ANONYMOUS)) {
throw new GSSException(GSSException.BAD_NAMETYPE);
}
this.name = null;
this.nameType = GSSName.NT_ANONYMOUS;
} else {
if (nameType != null) {
if (nameType.equals(GSSName.NT_HOSTBASED_SERVICE)) {
int atPos = name.indexOf('@');
if (atPos == -1 || (atPos+1 >= name.length())) {
throw new GlobusGSSException(GSSException.FAILURE,
GlobusGSSException.BAD_NAME,
"badName00");
}
// performs reverse DNS lookup
String host = name.substring(atPos+1);
try {
if (CoGProperties.getDefault().getReverseDNSCacheType().equals(CoGProperties.THREADED_CACHE)) {
host = reverseDNSCache.resolve(host);
} else {
host = queryHost(host);
}
} catch (UnknownHostException e) {
throw new GlobusGSSException(GSSException.FAILURE, e);
}
hostBasedServiceCN = name.substring(0, atPos) + "/" + host;
this.name = new X500Principal("CN=" + hostBasedServiceCN);
} else {
throw new GSSException(GSSException.BAD_NAMETYPE);
}
} else {
try {
this.name = CertificateUtil.toPrincipal(name);
} catch (Exception e) {
throw new GlobusGSSException(GSSException.BAD_NAME, e);
}
}
this.nameType = nameType;
}
// both subject & nameType might be null
}
public boolean isAnonymous() {
return (this.name == null);
}
public boolean isMN() {
return true;
}
public boolean equals(GSSName another)
throws GSSException {
if (another == null) {
return false;
}
if (isAnonymous()) {
return another.isAnonymous();
}
if (another.isAnonymous()) {
return false;
}
if (!(another instanceof GlobusGSSName)) {
throw new GSSException(GSSException.FAILURE);
}
GlobusGSSName other = (GlobusGSSName)another;
// both are not anonymous
// both have non-null subjects
// nametypes might be different! (null)
if ((nameType != null && nameType.equals(GSSName.NT_HOSTBASED_SERVICE)) ||
(other.nameType != null && other.nameType.equals(GSSName.NT_HOSTBASED_SERVICE))) {
// perform host based comparison
String hp1 = this.getHostBasedServiceCN(true);
String hp2 = other.getHostBasedServiceCN(true);
if (hp1 == null || hp2 == null) {
// something is really wrong
return false;
}
String service1 = getService(hp1);
String service2 = getService(hp2);
// service types do not match
if (!service1.equalsIgnoreCase(service2)) {
return false;
}
String host1 = getHost(hp1);
String host2 = getHost(hp2);
int i1=0;
int i2=0;
int s1 = host1.length();
int s2 = host2.length();
char h1;
char h2;
while (i1 < s1 && i2 < s2) {
h1 = Character.toUpperCase(host1.charAt(i1));
h2 = Character.toUpperCase(host2.charAt(i2));
if (h1 == h2) {
if (h1 == '.') {
return host1.equalsIgnoreCase(host2);
}
i1++;
i2++;
} else if (h1 == '.' && h2 == '-') {
return compareHost(host2, i2, host1, i1);
} else if (h1 == '-' && h2 == '.') {
return compareHost(host1, i1, host2, i2);
} else {
return false;
}
}
return (i1 == i2);
} else {
// perform regular comparison
// cross-check getStringNameType()
// that's not implemented right now
return toString().equalsIgnoreCase(another.toString());
}
}
/**
* Returns globus ID string representation of the name.
* If name represents is an anonymous name string
* "Subject object from specified
* GSSCredential. The GSSCredential is added
* to the private credential set of the Subject object.
* Also, if the GSSCredential.getName() is of type
* org.globus.gsi.gssapi.GlobusGSSName
* a org.globus.gsi.jaas.GlobusPrincipal
* is added to the principals set of the Subject object.
*/
public static Subject createSubject(GSSCredential cred)
throws GSSException {
return createSubject(null, cred);
}
/**
* Creates a new Subject object from specified
* GSSCredential and GSSName.
* If the GSSCredential is specified it is added
* to the private credential set of the Subject object.
* Also, if the GSSCredential.getName() is of type
* org.globus.gsi.gssapi.GlobusGSSName and the
* GSSName parameter was not specified a
* org.globus.gsi.jaas.GlobusPrincipal
* is added to the principals set of the Subject object.
* If the GSSName parameter was specified of type
* org.globus.gsi.gssapi.GlobusGSSName a
* org.globus.gsi.jaas.GlobusPrincipal
* is added to the principals set of the Subject object.
*/
public static Subject createSubject(GSSName name, GSSCredential cred)
throws GSSException {
if (cred == null && name == null) {
return null;
}
Subject subject = new Subject();
if (cred != null) {
subject.getPrivateCredentials().add(cred);
if (name == null) {
GlobusPrincipal nm = toGlobusPrincipal(cred.getName());
subject.getPrincipals().add(nm);
}
}
if (name != null) {
GlobusPrincipal nm = toGlobusPrincipal(name);
subject.getPrincipals().add(nm);
}
return subject;
}
/**
* Converts the specified GSSName to GlobusPrincipal.
* The GSSName is converted into the GlobusPrincipal
* only if the GSSName is of type
* org.globus.gsi.gssapi.GlobusGSSName
* and the name is not anonymous.
*/
public static GlobusPrincipal toGlobusPrincipal(GSSName name) {
return (!name.isAnonymous() &&
(name instanceof GlobusGSSName)) ?
new GlobusPrincipal(name.toString()) :
null;
}
/**
* Retrieves the first GSSCredential from the
* private credential set of the specified Subject
* object.
*
* @return the GSSCredential. Might be null.
*/
public static GSSCredential getCredential(Subject subject) {
if (subject == null) {
return null;
}
Set gssCreds = subject.getPrivateCredentials(GSSCredential.class);
if (gssCreds == null) {
return null;
}
Iterator iter = gssCreds.iterator();
return (iter.hasNext()) ?
(GSSCredential)iter.next() :
null;
}
}
JGlobus-JGlobus-Release-2.1.0/gss/src/main/java/org/globus/gsi/gssapi/Java_GSI_GSSAPI.html 0000664 0000000 0000000 00000026677 12411160572 0030722 0 ustar 00root root 0000000 0000000 Hashtable
* is significant, since we rely on access to the table being
* synchronized.
*/
private final Map entries = new Hashtable();
/**
* Creates a KeyPairCache object for the specified algorithm, as
* supplied from the specified provider.
*
* @param algorithm the standard string name of the algorithm. See
* Appendix A in the Java Cryptography Architecture API
* Specification & Reference for information about standard
* algorithm names.
* @param provider the string name of the provider.
* @param lifetime the lifetime of the cache in milliseconds.
*/
private KeyPairCache(String algorithm, String provider, long lifetime) {
this.algorithm = algorithm;
this.provider = provider;
this.lifetime = lifetime;
}
public static synchronized KeyPairCache getKeyPairCache() {
if (keyPairCache == null) {
keyPairCache = new KeyPairCache(DEFAULT_ALGORITHM, DEFAULT_PROVIDER,
CoGProperties.getDefault().
getDelegationKeyCacheLifetime());
}
return keyPairCache;
}
public static synchronized KeyPairCache getKeyPairCache(String algorithm,
String provider,
long lifetime) {
if (keyPairCache == null) {
keyPairCache = new KeyPairCache(algorithm, provider, lifetime);
}
return keyPairCache;
}
/**
* Returns a key pair of size bits. The same key pair
* may be returned several times within a period of the cache
* lifetime.
*
* If lifetime was set to zero or less than zero, no keys are cached.
*
* @param bits the keysize. This is an algorithm-specific metric,
* such as modulus length, specified in number of bits.
* @throws NoSuchAlgorithmException if the algorithm is not
* available in the environment.
* @throws NoSuchProviderException if the provider is not
* available in the environment.
*/
public KeyPair getKeyPair(int bits)
throws NoSuchAlgorithmException, NoSuchProviderException {
if (this.lifetime < 1) {
logger.debug("Cache lifetime is less than 1, generating new " +
"keypair each time");
KeyPairGenerator generator =
KeyPairGenerator.getInstance(this.algorithm, this.provider);
generator.initialize(bits);
return generator.generateKeyPair();
}
long st = System.currentTimeMillis();
Integer keysize = new Integer(bits);
KeyPairCacheEntry entry = (KeyPairCacheEntry)entries.get(keysize);
if (entry == null || st - entry.getCreatedAt() >= lifetime) {
logger.debug("Creating " + bits + " bits keypair");
KeyPairGenerator generator =
KeyPairGenerator.getInstance(algorithm, provider);
generator.initialize(bits);
logger.debug("Time to generate key pair: " +
(System.currentTimeMillis() - st));
entry = new KeyPairCacheEntry(generator.generateKeyPair(), st);
entries.put(keysize, entry);
}
return entry.getKeyPair();
}
} JGlobus-JGlobus-Release-2.1.0/gss/src/main/java/org/globus/gsi/gssapi/SSLUtil.java 0000664 0000000 0000000 00000015133 12411160572 0027526 0 ustar 00root root 0000000 0000000 /*
* Copyright 1999-2010 University of Chicago
*
* Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in
* compliance with the License. You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software distributed under the License is
* distributed on an "AS IS" BASIS,WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either
* express or implied.
*
* See the License for the specific language governing permissions and limitations under the License.
*/
package org.globus.gsi.gssapi;
import java.io.InputStream;
import java.io.IOException;
import java.io.EOFException;
/**
* A collection of SSL-protocol related functions.
*/
public class SSLUtil {
/**
* Reads some number of bytes from the input stream.
* This function reads maximum data available on the
* stream.
*
* @param in the input stream to read the bytes from.
* @param buf the buffer into which read the data is read.
* @param off the start offset in array b at which the data is written.
* @param len the maximum number of bytes to read.
* @exception IOException if I/O error occurs.
*/
public static int read(InputStream in, byte [] buf, int off, int len)
throws IOException {
int n = 0;
while (n < len) {
int count = in.read(buf, off + n, len - n);
if (count < 0) {
return count;
}
n += count;
}
return len;
}
/**
* Reads some number of bytes from the input stream.
* This function blocks until all data is read or an I/O
* error occurs.
*
* @param in the input stream to read the bytes from.
* @param buf the buffer into which read the data is read.
* @param off the start offset in array b at which the data is written.
* @param len the maximum number of bytes to read.
* @exception IOException if I/O error occurs.
*/
public static void readFully(InputStream in, byte [] buf, int off, int len)
throws IOException {
int n = 0;
while (n < len) {
int count = in.read(buf, off + n, len - n);
if (count < 0)
throw new EOFException();
n += count;
}
}
/**
* Reads an entire SSL message from the specified
* input stream.
*
* @param in the input stream to read the SSL message
* from.
* @return the byte array containing the SSL message
* @exception IOException if I/O error occurs.
*/
public static byte[] readSslMessage(InputStream in)
throws IOException {
byte [] header = new byte[5];
readFully(in, header, 0, header.length);
int length;
if (isSSLv3Packet(header))
length = toShort(header[3], header[4]);
else if (isSSLv2HelloPacket(header))
length = (((header[0] & 0x7f) << 8) | (header[1] & 0xff)) - 3;
else {
throw new IOException("Invalid SSL header");
}
byte [] inToken = new byte[header.length + length];
System.arraycopy(header, 0, inToken, 0, header.length);
readFully(in, inToken, header.length, length);
return inToken;
}
/**
* Determines if a given header is a SSL packet
* (has a SSL header)
*
* @return true if the header is a SSL header. False, otherwise.
*/
public static final boolean isSSLPacket(byte[] header) {
return ( isSSLv3Packet(header) || isSSLv2HelloPacket(header) );
}
/**
* Determines if a given header is a SSLv3 packet
* (has a SSL header) or a backward compatible version of TLS
* using the same header format.
*
* @return true if the header is a SSLv3 header. False, otherwise.
*/
public static final boolean isSSLv3Packet(byte[] header) {
return header[0] >= 20 && header[0] <= 26 &&
(header[1] == 3 || (header[1] == 2 && header[2] == 0));
}
/**
* Determines if a given header is a SSLv2 client or server hello packet
*
* @return true if the header is such a SSLv2 client or server hello
* packet. False, otherwise.
*/
public static final boolean isSSLv2HelloPacket(byte[] header) {
return ((header[0] & 0x80) != 0 && (header[2] == 1 || header[2] == 4));
}
/**
* Converts 2 bytes to a short.
*
* @param a byte 1
* @param b byte 2
* @return the short value of the 2 bytes
*/
public static short toShort(byte a, byte b) {
return (short)((a << 8) | (b & 0xff));
}
/**
* Converts 2 bytes to a
* unsigned short.
*
* @param a byte 1
* @param b byte 2
* @return the unsigned short value of the 2 bytes
*/
public static int toUnsignedShort(byte a, byte b) {
int n;
n = (a & 0xff) << 8;
n |= (b & 0xff);
return n;
}
/**
* Converts 4 bytes to an int at
* the specified offset in the given byte array.
*
* @param buf the byte array containing the 4 bytes
* to be converted to an int.
* @param off offset in the byte array
* @return the int value of the 4 bytes.
*/
public static int toInt(byte[] buf, int off) {
int lg = (buf[off] & 0xff) << 24;
lg |= (buf[off+1] & 0xff) << 16;
lg |= (buf[off+2] & 0xff) << 8;
lg |= (buf[off+3] & 0xff);
return lg;
}
/**
* Converts the specified int value into
* 4 bytes. The bytes are put into the
* specified byte array at a given offset
* location.
*
* @param v the int value to convert into 4 bytes.
* @param buf the byte array to put the resulting
* 4 bytes.
* @param off offset in the byte array
*/
public static void writeInt(int v, byte[] buf, int off) {
buf[off] = (byte)((v >>> 24) & 0xFF);
buf[off+1] = (byte)((v >>> 16) & 0xFF);
buf[off+2] = (byte)((v >>> 8) & 0xFF);
buf[off+3] = (byte)((v >>> 0) & 0xFF);
}
/**
* Converts 8 bytes to a long at the
* specified offset in the given byte array.
*
* @param buf the byte array containing the 8 bytes
* to be converted to a long.
* @param off offset in the byte array
* @return the long value of the 8 bytes.
*/
public static long toLong(byte[]buf, int off) {
return ((long)(toInt(buf, off)) << 32) + (toInt(buf, off+4) & 0xFFFFFFFFL);
}
}
JGlobus-JGlobus-Release-2.1.0/gss/src/main/java/org/globus/gsi/gssapi/TokenInputStream.java 0000664 0000000 0000000 00000006417 12411160572 0031510 0 ustar 00root root 0000000 0000000 /*
* Copyright 1999-2010 University of Chicago
*
* Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in
* compliance with the License. You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software distributed under the License is
* distributed on an "AS IS" BASIS,WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either
* express or implied.
*
* See the License for the specific language governing permissions and limitations under the License.
*/
package org.globus.gsi.gssapi;
import java.io.InputStream;
import java.io.IOException;
import java.util.LinkedList;
import org.apache.commons.logging.Log;
import org.apache.commons.logging.LogFactory;
/**
* Used as token-oriented input stream needed for SSL library I/O abstraction.
*/
public class TokenInputStream extends InputStream {
private static Log logger =
LogFactory.getLog(TokenInputStream.class.getName());
private LinkedList tokens; // list of buffers
private byte [] buff; // current buffer
private int index; // position within current buffer
private boolean closed;
public TokenInputStream() {
this.tokens = new LinkedList();
this.index = 0;
this.closed = false;
}
// main function
public void putToken(byte [] buf, int off, int len) {
if (buf == null || len <=0) {
return;
}
if (logger.isDebugEnabled()) {
logger.debug("put token: " + len);
}
byte[] localBuf = buf;
if (off != 0) {
localBuf = new byte[len];
System.arraycopy(buf, off, localBuf, 0, len);
}
synchronized(this) {
if (this.buff == null ||
this.buff != null && this.buff.length == this.index) {
this.buff = localBuf;
this.index = 0;
} else {
this.tokens.add(localBuf);
}
notify();
}
}
public int read(byte [] data)
throws IOException {
return read(data, 0, data.length);
}
public int read(byte [] data, int off, int len)
throws IOException {
if (logger.isDebugEnabled()) {
logger.debug("read byte array: " + len);
}
if (!checkData()) {
return -1;
}
int size = Math.min(len, buff.length-index);
System.arraycopy(buff, index, data, off, size);
index += size;
return size;
}
public int read()
throws IOException {
logger.debug("read byte");
if (!checkData()) {
return -1;
}
return buff[index++] & 0xff;
}
protected synchronized boolean checkData() {
try {
while(!hasData()) {
wait();
if (closed) {
return false;
}
}
} catch(Exception e) {
return false;
}
return true;
}
protected boolean hasData() {
if (this.buff == null) {
return false;
}
if (this.buff.length == this.index) {
if (tokens.isEmpty()) {
return false;
} else {
this.buff = (byte[])tokens.removeFirst();
this.index = 0;
return true;
}
}
return true;
}
public int available()
throws IOException {
if (!hasData()) {
return 0;
} else {
return buff.length-index;
}
}
public void close()
throws IOException {
logger.debug("close() called");
synchronized(this) {
this.closed = true;
notify();
}
}
public String toString() {
return tokens.toString() + " " + index + " " + buff.length;
}
}
JGlobus-JGlobus-Release-2.1.0/gss/src/main/java/org/globus/gsi/gssapi/auth/ 0000775 0000000 0000000 00000000000 12411160572 0026322 5 ustar 00root root 0000000 0000000 JGlobus-JGlobus-Release-2.1.0/gss/src/main/java/org/globus/gsi/gssapi/auth/Authorization.java 0000664 0000000 0000000 00000003606 12411160572 0032032 0 ustar 00root root 0000000 0000000 /*
* Copyright 1999-2010 University of Chicago
*
* Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in
* compliance with the License. You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software distributed under the License is
* distributed on an "AS IS" BASIS,WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either
* express or implied.
*
* See the License for the specific language governing permissions and limitations under the License.
*/
package org.globus.gsi.gssapi.auth;
import org.ietf.jgss.GSSContext;
import org.ietf.jgss.GSSName;
/**
* Interface for authorization mechanisms.
* The authorization is performed once the connection was authenticated.
*/
public abstract class Authorization {
/**
* Performes authorization checks. Throws
* AuthorizationException if the authorization fails.
* Otherwise, the function completes normally.
*
* @param context the securit context
* @param host host address of the peer.
* @exception AuthorizationException if the peer is
* not authorized to access/use the resource.
*/
public abstract void authorize(GSSContext context, String host)
throws AuthorizationException;
protected void generateAuthorizationException(GSSName expected,
GSSName target)
throws AuthorizationException {
String lineSep = System.getProperty("line.separator");
StringBuffer msg = new StringBuffer();
msg.append("Mutual authentication failed").append(lineSep)
.append(" Expected target subject name=\"")
.append(expected.toString()).append("\"")
.append(lineSep)
.append(" Target returned subject name=\"")
.append(target.toString())
.append("\"");
throw new AuthorizationException(msg.toString());
}
}
AuthorizationException.java 0000664 0000000 0000000 00000001621 12411160572 0033625 0 ustar 00root root 0000000 0000000 JGlobus-JGlobus-Release-2.1.0/gss/src/main/java/org/globus/gsi/gssapi/auth /*
* Copyright 1999-2010 University of Chicago
*
* Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in
* compliance with the License. You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software distributed under the License is
* distributed on an "AS IS" BASIS,WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either
* express or implied.
*
* See the License for the specific language governing permissions and limitations under the License.
*/
package org.globus.gsi.gssapi.auth;
import org.globus.common.ChainedIOException;
public class AuthorizationException extends ChainedIOException {
public AuthorizationException(String msg) {
super(msg);
}
public AuthorizationException(String msg, Throwable root) {
super(msg, root);
}
}
JGlobus-JGlobus-Release-2.1.0/gss/src/main/java/org/globus/gsi/gssapi/auth/GSSAuthorization.java 0000664 0000000 0000000 00000002327 12411160572 0032406 0 ustar 00root root 0000000 0000000 /*
* Copyright 1999-2010 University of Chicago
*
* Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in
* compliance with the License. You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software distributed under the License is
* distributed on an "AS IS" BASIS,WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either
* express or implied.
*
* See the License for the specific language governing permissions and limitations under the License.
*/
package org.globus.gsi.gssapi.auth;
import org.ietf.jgss.GSSException;
import org.ietf.jgss.GSSName;
import org.ietf.jgss.GSSCredential;
/**
* GSSAPI client authorization.
*/
public abstract class GSSAuthorization extends Authorization {
/**
* Returns expected GSSName used for authorization purposes.
* Can returns null for self authorization.
*
* @param cred credentials used
* @param host host address of the peer.
* @exception GSSException if unable to create the name.
*/
public abstract GSSName getExpectedName(GSSCredential cred, String host)
throws GSSException;
}
JGlobus-JGlobus-Release-2.1.0/gss/src/main/java/org/globus/gsi/gssapi/auth/HostAuthorization.java 0000664 0000000 0000000 00000007622 12411160572 0032672 0 ustar 00root root 0000000 0000000 /*
* Copyright 1999-2010 University of Chicago
*
* Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in
* compliance with the License. You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software distributed under the License is
* distributed on an "AS IS" BASIS,WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either
* express or implied.
*
* See the License for the specific language governing permissions and limitations under the License.
*/
package org.globus.gsi.gssapi.auth;
import org.gridforum.jgss.ExtendedGSSManager;
import org.ietf.jgss.GSSManager;
import org.ietf.jgss.GSSContext;
import org.ietf.jgss.GSSName;
import org.ietf.jgss.GSSException;
import org.ietf.jgss.GSSCredential;
import org.apache.commons.logging.Log;
import org.apache.commons.logging.LogFactory;
/**
* Implements a simple host authorization mechanism.
* The peer's host name (in FQDN form) is compared with the
* host name specified in the peer's certificate chain.
*/
public class HostAuthorization
extends GSSAuthorization {
private static Log logger =
LogFactory.getLog(HostAuthorization.class.getName());
public static final HostAuthorization ldapAuthorization =
new HostAuthorization("ldap");
private String _service = null;
private static HostAuthorization hostAuthorization;
public HostAuthorization(String service) {
_service = (service == null) ? "host" : service;
}
/**
* Returns an instance of host authentication.
*
* @return an instance of this class initialized with
* host as a service.
*/
public synchronized static HostAuthorization getInstance() {
if (hostAuthorization == null) {
hostAuthorization = new HostAuthorization("host");
}
return hostAuthorization;
}
public GSSName getExpectedName(GSSCredential cred, String host)
throws GSSException {
GSSManager manager = ExtendedGSSManager.getInstance();
return manager.createName(_service + "@" + host,
GSSName.NT_HOSTBASED_SERVICE);
}
/**
* Performs host authentication. The hostname of the peer is
* compared with the hostname specified in the peer's (topmost)
* certificate in the certificate chain. The hostnames must
* match exactly (in case-insensitive way)
*
* @param context the security context
* @param host host address of the peer.
* @exception AuthorizationException if the hostnames
* do not match.
*/
public void authorize(GSSContext context, String host)
throws AuthorizationException {
logger.debug("Authorization: HOST");
try {
GSSName expected = getExpectedName(null, host);
GSSName target = null;
if (context.isInitiator()) {
target = context.getTargName();
} else {
target = context.getSrcName();
}
if (!expected.equals(target)) {
generateAuthorizationException(expected, target);
}
} catch (GSSException e) {
throw new AuthorizationException("Authorization failure", e);
}
}
public boolean equals(Object o) {
if (o == null) {
return false;
}
if (this == o) {
return true;
}
if (o instanceof HostAuthorization) {
HostAuthorization other = (HostAuthorization)o;
if (this._service == null) {
return (other._service == null);
} else {
return this._service.equals(other._service);
}
}
return false;
}
public int hashCode() {
return (this._service == null) ? 0 : this._service.hashCode();
}
}
HostOrSelfAuthorization.java 0000664 0000000 0000000 00000005625 12411160572 0033727 0 ustar 00root root 0000000 0000000 JGlobus-JGlobus-Release-2.1.0/gss/src/main/java/org/globus/gsi/gssapi/auth /*
* Copyright 1999-2010 University of Chicago
*
* Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in
* compliance with the License. You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software distributed under the License is
* distributed on an "AS IS" BASIS,WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either
* express or implied.
*
* See the License for the specific language governing permissions and limitations under the License.
*/
package org.globus.gsi.gssapi.auth;
import org.ietf.jgss.GSSContext;
import org.ietf.jgss.GSSName;
import org.ietf.jgss.GSSException;
import org.ietf.jgss.GSSCredential;
import org.apache.commons.logging.Log;
import org.apache.commons.logging.LogFactory;
public class HostOrSelfAuthorization extends GSSAuthorization {
private static Log logger =
LogFactory.getLog(HostOrSelfAuthorization.class.getName());
private static HostOrSelfAuthorization authorization;
private HostAuthorization hostAuthz;
/**
* Returns a single instance of this class.
*
* @return the instance of this class.
*/
public synchronized static HostOrSelfAuthorization getInstance() {
if (authorization == null) {
authorization = new HostOrSelfAuthorization("host");
}
return authorization;
}
public HostOrSelfAuthorization(String service) {
if (service == null) {
service = "host";
}
this.hostAuthz = new HostAuthorization(service);
}
// returning null for now.
public GSSName getExpectedName(GSSCredential cred, String host)
throws GSSException {
return null;
}
/**
* Performs host authorization. If that fails, performs self authorization
*/
public void authorize(GSSContext context, String host)
throws AuthorizationException {
logger.debug("Authorization: HOST/SELF");
try {
GSSName expected = this.hostAuthz.getExpectedName(null, host);
GSSName target = null;
if (context.isInitiator()) {
target = context.getTargName();
} else {
target = context.getSrcName();
}
if (!expected.equals(target)) {
logger.debug("Host authorization failed. Expected "
+ expected + " target is " + target);
if (!context.getSrcName().equals(context.getTargName())) {
if (context.isInitiator()) {
expected = context.getSrcName();
} else {
expected = context.getTargName();
}
generateAuthorizationException(expected, target);
}
}
} catch (GSSException e) {
throw new AuthorizationException("Authorization failure", e);
}
}
}
IdentityAuthorization.java 0000664 0000000 0000000 00000007643 12411160572 0033472 0 ustar 00root root 0000000 0000000 JGlobus-JGlobus-Release-2.1.0/gss/src/main/java/org/globus/gsi/gssapi/auth /*
* Copyright 1999-2010 University of Chicago
*
* Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in
* compliance with the License. You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software distributed under the License is
* distributed on an "AS IS" BASIS,WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either
* express or implied.
*
* See the License for the specific language governing permissions and limitations under the License.
*/
package org.globus.gsi.gssapi.auth;
import org.gridforum.jgss.ExtendedGSSManager;
import org.ietf.jgss.GSSManager;
import org.ietf.jgss.GSSContext;
import org.ietf.jgss.GSSName;
import org.ietf.jgss.GSSException;
import org.ietf.jgss.GSSCredential;
import org.apache.commons.logging.Log;
import org.apache.commons.logging.LogFactory;
/**
* Implements a simple identity authorization mechanism.
* The given identify is compared with the peer's identity.
*/
public class IdentityAuthorization
extends GSSAuthorization {
private static Log logger =
LogFactory.getLog(IdentityAuthorization.class.getName());
protected String _identity;
/**
* Constructor used by superclasses.
*/
protected IdentityAuthorization() {
}
/**
* Creates a new instance of this class with given
* expected identity.
*
* @param identity the expected identity. Must not be null.
*/
public IdentityAuthorization(String identity) {
setIdentity(identity);
}
/**
* Sets the expected identity for the authorization
* check.
*
* @param identity the expected identity. Must not be null.
*/
public void setIdentity(String identity) {
if (identity == null) {
throw new IllegalArgumentException("Identity cannot be null");
}
_identity = identity;
}
/**
* Returns the expected identity.
*
* @return the expected identity.
*/
public String getIdentity() {
return _identity;
}
public GSSName getExpectedName(GSSCredential cred, String host)
throws GSSException {
GSSManager manager = ExtendedGSSManager.getInstance();
return manager.createName(_identity, null);
}
/**
* Performs identity authorization. The given identity is compared
* with the peer's identity.
*
* @param context the security context
* @param host host address of the peer.
* @exception AuthorizationException if the peer's
* identity does not match the expected identity.
*/
public void authorize(GSSContext context, String host)
throws AuthorizationException {
logger.debug("Authorization: IDENTITY");
try {
GSSName expected = getExpectedName(null, host);
GSSName target = null;
if (context.isInitiator()) {
target = context.getTargName();
} else {
target = context.getSrcName();
}
if (!expected.equals(target)) {
generateAuthorizationException(expected, target);
}
} catch (GSSException e) {
throw new AuthorizationException("Authorization failure", e);
}
}
public boolean equals(Object o) {
if (o == null) {
return false;
}
if (this == o) {
return true;
}
if (o instanceof IdentityAuthorization) {
IdentityAuthorization other = (IdentityAuthorization)o;
if (this._identity == null) {
return (other._identity == null);
} else {
return this._identity.equals(other._identity);
}
}
return false;
}
public int hashCode() {
return (this._identity == null) ? 0 : this._identity.hashCode();
}
}
JGlobus-JGlobus-Release-2.1.0/gss/src/main/java/org/globus/gsi/gssapi/auth/NoAuthorization.java 0000664 0000000 0000000 00000003536 12411160572 0032331 0 ustar 00root root 0000000 0000000 /*
* Copyright 1999-2010 University of Chicago
*
* Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in
* compliance with the License. You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software distributed under the License is
* distributed on an "AS IS" BASIS,WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either
* express or implied.
*
* See the License for the specific language governing permissions and limitations under the License.
*/
package org.globus.gsi.gssapi.auth;
import org.ietf.jgss.GSSContext;
import org.ietf.jgss.GSSCredential;
import org.ietf.jgss.GSSException;
import org.ietf.jgss.GSSName;
import org.apache.commons.logging.Log;
import org.apache.commons.logging.LogFactory;
/**
* Implements the simplest authorization mechanism that does
* not do any authorization checks.
*/
public class NoAuthorization extends GSSAuthorization {
private static Log logger =
LogFactory.getLog(NoAuthorization.class.getName());
private static NoAuthorization authorization;
/**
* Returns a single instance of this class.
*
* @return the instance of this class.
*/
public synchronized static NoAuthorization getInstance() {
if (authorization == null) {
authorization = new NoAuthorization();
}
return authorization;
}
/**
* Always returns null.
*/
public GSSName getExpectedName(GSSCredential cred, String host)
throws GSSException {
return null;
}
/**
* Performs no authorization checks. The function is always
* successful. It does not throw any exceptions.
*
*/
public void authorize(GSSContext context, String host)
throws AuthorizationException {
logger.debug("Authorization: NONE");
}
}
JGlobus-JGlobus-Release-2.1.0/gss/src/main/java/org/globus/gsi/gssapi/auth/SelfAuthorization.java 0000664 0000000 0000000 00000004750 12411160572 0032645 0 ustar 00root root 0000000 0000000 /*
* Copyright 1999-2010 University of Chicago
*
* Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in
* compliance with the License. You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software distributed under the License is
* distributed on an "AS IS" BASIS,WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either
* express or implied.
*
* See the License for the specific language governing permissions and limitations under the License.
*/
package org.globus.gsi.gssapi.auth;
import org.gridforum.jgss.ExtendedGSSManager;
import org.ietf.jgss.GSSManager;
import org.ietf.jgss.GSSContext;
import org.ietf.jgss.GSSName;
import org.ietf.jgss.GSSException;
import org.ietf.jgss.GSSCredential;
import org.apache.commons.logging.Log;
import org.apache.commons.logging.LogFactory;
/**
* Performs the identity authorization check. The identity
* is obtained from specified Globus credentials.
*/
public class SelfAuthorization
extends GSSAuthorization {
private static Log logger =
LogFactory.getLog(SelfAuthorization.class.getName());
private static SelfAuthorization authorization;
/**
* Returns a single instance of this class.
*
* @return the instance of this class.
*/
public synchronized static SelfAuthorization getInstance() {
if (authorization == null) {
authorization = new SelfAuthorization();
}
return authorization;
}
public GSSName getExpectedName(GSSCredential cred, String host)
throws GSSException {
if (cred == null) {
GSSManager manager = ExtendedGSSManager.getInstance();
cred = manager.createCredential(GSSCredential.INITIATE_AND_ACCEPT);
}
return cred.getName();
}
/**
* Performs self authorization.
*/
public void authorize(GSSContext context, String host)
throws AuthorizationException {
logger.debug("Authorization: SELF");
try {
if (!context.getSrcName().equals(context.getTargName())) {
GSSName expected = null;
GSSName target = null;
if (context.isInitiator()) {
expected = context.getSrcName();
target = context.getTargName();
} else {
expected = context.getTargName();
target = context.getSrcName();
}
generateAuthorizationException(expected, target);
}
} catch (GSSException e) {
throw new AuthorizationException("Authorization failure", e);
}
}
}
JGlobus-JGlobus-Release-2.1.0/gss/src/main/java/org/globus/gsi/gssapi/example/ 0000775 0000000 0000000 00000000000 12411160572 0027014 5 ustar 00root root 0000000 0000000 JGlobus-JGlobus-Release-2.1.0/gss/src/main/java/org/globus/gsi/gssapi/example/GetOpts.java 0000664 0000000 0000000 00000006175 12411160572 0031255 0 ustar 00root root 0000000 0000000 /*
* Copyright 1999-2010 University of Chicago
*
* Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in
* compliance with the License. You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software distributed under the License is
* distributed on an "AS IS" BASIS,WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either
* express or implied.
*
* See the License for the specific language governing permissions and limitations under the License.
*/
package org.globus.gsi.gssapi.example;
import org.ietf.jgss.GSSContext;
public class GetOpts {
public boolean conf = true;
public int lifetime = GSSContext.DEFAULT_LIFETIME;
public boolean gsiMode = true;
public boolean deleg = false;
public boolean limitedDeleg = true;
public boolean rejectLimitedProxy = false;
public boolean anonymity = false;
public String auth = null;
protected String usage;
protected String helpMsg;
public GetOpts(String usage, String helpMsg) {
this.usage = usage;
this.helpMsg = helpMsg;
}
public int parse(String[] args) {
int i = 0;
for (i=0;i0 creates a socket on any free port or if the
* tcp.port.range system property is set it creates a socket
* within the specified port range.
*
* The maximum queue length for incoming connection indications (a
* request to connect) is set to 50. If a connection
* indication arrives when the queue is full, the connection is refused.
*
* @param port the port number, or 0 to use any
* free port or if the tcp.port.range property set
* to use any available port within the specified port
* range.
* @exception IOException if an I/O error occurs when opening the socket.
*/
public ServerSocket createServerSocket(int port)
throws IOException {
return createServerSocket(port, 50, null);
}
/**
* Creates a server socket on a specified port. A port of
* 0 creates a socket on any free port or if the
* tcp.port.range system property is set it creates a socket
* within the specified port range.
*
* The maximum queue length for incoming connection indications (a
* request to connect) is set to the backlog parameter. If
* a connection indication arrives when the queue is full, the
* connection is refused.
*
* @param port the port number, or 0 to use any
* free port or if the tcp.port.range property set
* to use any available port within the specified port
* range.
* @param backlog the maximum length of the queue.
* @exception IOException if an I/O error occurs when opening the socket.
*/
public ServerSocket createServerSocket(int port, int backlog)
throws IOException {
return createServerSocket(port, backlog, null);
}
/**
* Create a server with the specified port, listen backlog, and
* local IP address to bind to. The bindAddr argument
* can be used on a multi-homed host for a ServerSocket that
* will only accept connect requests to one of its addresses.
* If bindAddr is null, it will default accepting
* connections on any/all local addresses.
* The port must be between 0 and 65535, inclusive.
*
* @param port the local TCP port
* @param backlog the listen backlog
* @param bindAddr the local InetAddress the server will bind to
* @exception IOException if an I/O error occurs when opening the socket.
*/
public ServerSocket createServerSocket(int port, int backlog,
InetAddress bindAddr)
throws IOException {
if (this.portRange.isEnabled() && port == 0) {
return createServerSocket(backlog, bindAddr);
} else {
return new ServerSocket(port, backlog, bindAddr);
}
}
/**
* Tries to find first available port within the port range specified.
* If it finds a free port, it first checks if the port is not used
* by any other server. If it is, it keeps looking for a next available
* port. If none found, it throws an exception. If the port is available
* the server instance is returned.
*/
private ServerSocket createServerSocket(int backlog, InetAddress binAddr)
throws IOException {
ServerSocket server = null ;
int port = 0;
while(true) {
port = this.portRange.getFreePort(port);
try {
server = new PrServerSocket(port, backlog, binAddr);
this.portRange.setUsed(port);
return server;
} catch(IOException e) {
// continue on
port++;
}
}
}
class PrServerSocket extends ServerSocket {
public PrServerSocket(int port, int backlog, InetAddress bindAddr)
throws IOException {
super(port, backlog, bindAddr);
}
public void close()
throws IOException {
int port = getLocalPort();
try {
super.close();
} finally {
if (port != -1) {
portRange.free(port);
}
}
}
}
}
JGlobus-JGlobus-Release-2.1.0/gss/src/main/java/org/globus/net/SocketFactory.java 0000664 0000000 0000000 00000007743 12411160572 0027535 0 ustar 00root root 0000000 0000000 /*
* Copyright 1999-2010 University of Chicago
*
* Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in
* compliance with the License. You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software distributed under the License is
* distributed on an "AS IS" BASIS,WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either
* express or implied.
*
* See the License for the specific language governing permissions and limitations under the License.
*/
package org.globus.net;
import org.globus.common.CoGProperties;
import java.net.InetSocketAddress;
import java.net.Socket;
import java.net.InetAddress;
import java.net.BindException;
import java.io.IOException;
/**
* This factory allows for creating regular sockets.
* If the tcp.source.port.range system property is set it will create
* sockets within the specified local port range (if the local port
* number is set to 0).
*/
public class SocketFactory {
private static SocketFactory defaultFactory = null;
private PortRange portRange = null;
protected SocketFactory() {
this.portRange = PortRange.getTcpSourceInstance();
}
/**
* Returns the default instance of this class.
*
* @return SocketFactory instance of this class.
*/
public static synchronized SocketFactory getDefault() {
if (defaultFactory == null) {
defaultFactory = new SocketFactory();
}
return defaultFactory;
}
public Socket createSocket(String host, int port)
throws IOException {
return createSocket(InetAddress.getByName(host), port, null, 0);
}
public Socket createSocket(InetAddress address, int port)
throws IOException {
return createSocket(address, port, null, 0);
}
public Socket createSocket(String host, int port,
InetAddress localAddr, int localPort)
throws IOException {
return createSocket(InetAddress.getByName(host), port,
localAddr, localPort);
}
public Socket createSocket(InetAddress address, int port,
InetAddress localAddr, int localPort)
throws IOException {
if (this.portRange.isEnabled() && localPort == 0) {
return new PrSocket(createSocket(address, port, localAddr));
} else {
Socket s = new Socket();
s.setSoTimeout(CoGProperties.getDefault().getSocketTimeout());
s.bind(new InetSocketAddress(localAddr, localPort));
s.connect(new InetSocketAddress(address, port), CoGProperties.getDefault().getSocketTimeout());
return s;
}
}
private Socket createSocket(InetAddress address, int port,
InetAddress localAddr)
throws IOException {
Socket socket = null;
int localPort = 0;
while(true) {
localPort = this.portRange.getFreePort(localPort);
try {
socket = new Socket();
socket.setSoTimeout(CoGProperties.getDefault().getSocketTimeout());
socket.bind(new InetSocketAddress(localAddr, localPort));
socket.connect(new InetSocketAddress(address, port), CoGProperties.getDefault().getSocketTimeout());
this.portRange.setUsed(localPort);
return socket;
} catch(BindException e) {
// continue on
localPort++;
}
}
}
class PrSocket extends WrappedSocket {
public PrSocket(Socket socket) {
super(socket);
}
public void close()
throws IOException {
int port = getLocalPort();
try {
super.close();
} finally {
if (port != -1) {
portRange.free(port);
}
}
}
}
}
JGlobus-JGlobus-Release-2.1.0/gss/src/main/java/org/globus/net/WrappedSocket.java 0000664 0000000 0000000 00000006310 12411160572 0027515 0 ustar 00root root 0000000 0000000 /*
* Copyright 1999-2010 University of Chicago
*
* Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in
* compliance with the License. You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software distributed under the License is
* distributed on an "AS IS" BASIS,WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either
* express or implied.
*
* See the License for the specific language governing permissions and limitations under the License.
*/
package org.globus.net;
import java.net.Socket;
import java.net.InetAddress;
import java.net.SocketException;
import java.io.IOException;
import java.io.InputStream;
import java.io.OutputStream;
public class WrappedSocket extends Socket {
protected Socket socket;
protected WrappedSocket() {}
public WrappedSocket(Socket socket) {
super();
this.socket = socket;
}
public Socket getWrappedSocket() {
return this.socket;
}
public OutputStream getOutputStream()
throws IOException {
return this.socket.getOutputStream();
}
public synchronized InputStream getInputStream()
throws IOException {
return this.socket.getInputStream();
}
public void close()
throws IOException {
this.socket.close();
}
public InetAddress getInetAddress() {
return this.socket.getInetAddress();
}
public boolean getKeepAlive()
throws SocketException {
return this.socket.getKeepAlive();
}
public InetAddress getLocalAddress() {
return this.socket.getLocalAddress();
}
public int getLocalPort() {
return this.socket.getLocalPort();
}
public int getPort() {
return this.socket.getPort();
}
public int getReceiveBufferSize()
throws SocketException {
return this.socket.getReceiveBufferSize();
}
public int getSendBufferSize()
throws SocketException {
return this.socket.getSendBufferSize();
}
public int getSoLinger()
throws SocketException {
return this.socket.getSoLinger();
}
public int getSoTimeout()
throws SocketException {
return this.socket.getSoTimeout();
}
public boolean getTcpNoDelay()
throws SocketException {
return this.socket.getTcpNoDelay();
}
public void setKeepAlive(boolean on)
throws SocketException {
this.socket.setKeepAlive(on);
}
public void setReceiveBufferSize(int size)
throws SocketException {
this.socket.setReceiveBufferSize(size);
}
public void setSendBufferSize(int size)
throws SocketException {
this.socket.setSendBufferSize(size);
}
public void setSoLinger(boolean on,
int linger)
throws SocketException {
this.socket.setSoLinger(on, linger);
}
public void setSoTimeout(int timeout)
throws SocketException {
this.socket.setSoTimeout(timeout);
}
public void setTcpNoDelay(boolean on)
throws SocketException {
this.socket.setTcpNoDelay(on);
}
public void shutdownInput()
throws IOException {
this.socket.shutdownInput();
}
public void shutdownOutput()
throws IOException {
this.socket.shutdownOutput();
}
public String toString() {
return this.socket.toString();
}
}
JGlobus-JGlobus-Release-2.1.0/gss/src/main/java/org/globus/net/package.html 0000664 0000000 0000000 00000000717 12411160572 0026365 0 ustar 00root root 0000000 0000000
String the properly formatted header to be sent to a
* gass server
*/
public static String GET(String path, String host) {
return HTTPProtocol.createGETHeader("/" + path, host, USER_AGENT);
}
/** This method concatenates a properly formatted header for performing
* Globus Gass PUTs with the given information.
*
* @param path the path of the remote file to put to
* @param host the host of the remote file to put to
* @param length the length of data which will be sent (the size of the file)
* @param append append mode
*
* @return String the properly formatted header to be sent to a
* gass server
*/
public static String PUT(String path, String host, long length, boolean append) {
String newPath = null;
if (append) {
newPath = APPEND_URI + "/" + path;
} else {
newPath = "/" + path;
}
return HTTPProtocol.createPUTHeader(newPath, host, USER_AGENT,
TYPE, length, append);
}
public static String SHUTDOWN(String path, String host) {
return HTTPProtocol.createPUTHeader(path, host, USER_AGENT,
TYPE, 0, false);
}
}
JGlobus-JGlobus-Release-2.1.0/io/src/main/java/org/globus/io/gass/client/internal/package.html 0000664 0000000 0000000 00000001023 12411160572 0032037 0 ustar 00root root 0000000 0000000
GassServer class acts as a basic multi-threaded HTTPS
* server that handles GASS requests.
*
* @version $Revision 1.21 $
*/
public class GassServer extends BaseServer {
private static Log logger =
LogFactory.getLog(GassServer.class.getName());
public static final int READ_ENABLE = 8;
public static final int WRITE_ENABLE = 16;
public static final int STDOUT_ENABLE = 32;
public static final int STDERR_ENABLE = 64;
public static final int CLIENT_SHUTDOWN_ENABLE = 128;
public static final String SHUTDOWN_STR = "/dev/globus_gass_client_shutdown";
private Hashtable jobOutputs = null;
private int options = 0;
/**
* Starts Gass Server with default user credentials.
* Port of the server will be dynamically assigned
*/
public GassServer()
throws IOException {
this(null, 0);
}
/**
* Starts Gass Server on given port with default user credentials.
*
* @param port
* port of the server, if 0 it will be dynamically assigned
*/
public GassServer(int port)
throws IOException {
this(null, port);
}
/**
* Starts Gass Server on given port and given credentials.
*
* @param cred
* credentials to use. if null default user credentials
* will be used
* @param port
* port of the server, if 0 it will be dynamically assigned
*/
public GassServer(GSSCredential cred, int port)
throws IOException {
super(cred, port);
init();
}
/**
* Starts Gass Server on given port and mode.
* If secure mode, it will use default user credentials
*
* @param secure
* if true starts server in secure mode, otherwise unsecure
* @param port
* port of the server, if 0 it will be dynamically assigned
*/
public GassServer(boolean secure, int port)
throws IOException {
super(secure, port);
init();
}
private void init() {
jobOutputs = new Hashtable();
options = READ_ENABLE | WRITE_ENABLE | STDOUT_ENABLE | STDERR_ENABLE;
super.initialize();
setAuthorization(SelfAuthorization.getInstance());
}
/**
* Sets the options of the gass server such
* as enabling client shutdown, etc.
*
* @param options server options
*/
public void setOptions(int options) {
this.options = options;
}
/**
* Returns current options of the server.
*
* @return options of the server. O if not
* none set.
*/
public int getOptions() {
return options;
}
/**
* Registers a output stream with a job. This is
* used for job stdout/err redirection.
* The label of the job should be the ending of the
* job redirected url. For example, given following RSL
* (stdout=$(GASS_URL)/dev/stdout-5) the label to register
* the output stream with should be 'out-5'.
*
* @param lb job label as described above.
* @param out the output stream to redirect output to.
*/
public void registerJobOutputStream(String lb, OutputStream out) {
jobOutputs.put(lb, out);
}
/**
* Unregisters a job output stream for specified output label. See
* registerJobOutputStream() for more details.
*
* @param lb job output label.
*/
public void unregisterJobOutputStream(String lb) {
jobOutputs.remove(lb);
}
/**
* Unregisters a job output stream. This method is deprecated.
*/
public void unregisterJobOutputStream(String lb, OutputStream out) {
unregisterJobOutputStream(lb);
}
protected OutputStream getJobOutputStream(String id) {
return (OutputStream)jobOutputs.get(id);
}
protected void handleConnection(Socket socket) {
GassClientHandler gcb = new GassClientHandler(this,
socket);
(new Thread(gcb)).start();
}
public String toString() {
StringBuffer buf = new StringBuffer("GassServer: ");
try {
buf.append(getURL());
} catch(Exception e) {}
buf.append(" options (");
boolean op = ((options & READ_ENABLE) != 0);
buf.append("r:" + ( (op) ? "+" : "-" ));
op = ((options & WRITE_ENABLE) != 0);
buf.append(" w:" + ( (op) ? "+" : "-" ));
op = ((options & STDOUT_ENABLE) != 0);
buf.append(" so:" + ( (op) ? "+" : "-"));
op = ((options & STDERR_ENABLE) != 0);
buf.append(" se:" + ( (op) ? "+" : "-"));
op = ((options & CLIENT_SHUTDOWN_ENABLE) != 0);
buf.append(" rc:" + ( (op) ? "+" : "-"));
buf.append(")");
return buf.toString();
}
/**
* Shutdowns a remote gass server. The server must have the
* CLIENT_SHUTDOWN option enabled for this to work.
*
* @param cred credentials to use.
* @param gassURL the url of the remote gass server.
*/
public static void shutdown(GSSCredential cred, GlobusURL gassURL)
throws IOException, GSSException {
OutputStream output = null;
InputStream input = null;
Socket socket = null;
try {
if (gassURL.getProtocol().equalsIgnoreCase("https")) {
GSSManager manager = ExtendedGSSManager.getInstance();
ExtendedGSSContext context =
(ExtendedGSSContext)manager.createContext(null,
GSSConstants.MECH_OID,
cred,
GSSContext.DEFAULT_LIFETIME);
context.setOption(GSSConstants.GSS_MODE,
GSIConstants.MODE_SSL);
GssSocketFactory factory = GssSocketFactory.getDefault();
socket = factory.createSocket(gassURL.getHost(),
gassURL.getPort(),
context);
((GssSocket)socket).setAuthorization(SelfAuthorization.getInstance());
} else {
SocketFactory factory = SocketFactory.getDefault();
socket = factory.createSocket(gassURL.getHost(),
gassURL.getPort());
}
output = socket.getOutputStream();
input = socket.getInputStream();
String msg = GASSProtocol.SHUTDOWN(SHUTDOWN_STR,
gassURL.getHost());
if (logger.isTraceEnabled()) {
logger.trace("Shutdown msg: " + msg);
}
output.write( msg.getBytes() );
output.flush();
HttpResponse rp = new HttpResponse(input);
if (rp.httpCode == -1 && rp.httpMsg == null) {
/* this is a workaround for C gass-server.
* The server just shuts down - it does
* not send the reply */
} else if (rp.httpCode != 200) {
throw new IOException("Remote shutdown failed (" + rp.httpCode + " " + rp.httpMsg + ")");
}
} finally {
try {
if (output != null) output.close();
if (input != null) input.close();
if (socket != null) socket.close();
} catch(Exception e) {}
}
}
}
class GassClientHandler implements Runnable {
private static Log logger =
LogFactory.getLog(GassClientHandler.class.getName());
private static final boolean DEBUG_ON = false;
private static final String CRLF = "\r\n";
private static final String OKHEADER = "HTTP/1.1 200 OK\r\n";
private static final String SERVER = "Server: Globus-GASS-HTTP/1.1.0\r\n";
private static final String CONTENT_LENGTH = "Content-Length:";
private static final String TRANSFER_ENCODING = "Transfer-Encoding: chunked";
private static final String JAVA_CLIENT = "User-Agent: Java-Globus-GASS-HTTP/1.1.0";
private static final String HTTP_CONTINUE = "HTTP/1.1 100 Continue\r\n";
private static final String CONTENT_BINARY = "Content-Type: application/octet-stream" + CRLF;
private static final String CONTENT_HTML = "Content-Type: text/html" + CRLF;
private static final String CONTENT_TEXT = "Content-Type: text/plain" + CRLF;
private static final String CONNECTION_CLOSE = "Connection: close\r\n";
private static final String HEADER404 = "HTTP/1.1 404 File Not Found\r\n";
private static final String MSG404 =
"
* This class is specificaly designed for jobs
* that generate textual output. Binary data
* might not be handled correctly.
*/
public class JobOutputStream extends OutputStream {
protected JobOutputListener listener;
/**
* Creates a job output stream with a specific
* job output listener to which the job output
* will be redirected to.
*
* @param jobListener an instance of the job output
* listener. Cannot be null.
*/
public JobOutputStream(JobOutputListener jobListener) {
if (jobListener == null) {
throw new IllegalArgumentException("jobListener cannot be null");
}
listener = jobListener;
}
/**
* Converts the byte array to a string and forwards
* it to the job output listener.
*
Called by the GassServer.
*/
public void write(byte[] b, int off, int len)
throws IOException {
String s = new String(b, off, len);
listener.outputChanged(s);
}
/**
* Converts the int to a string and forwards
* it to the job output listener.
*
Called by the GassServer.
*/
public void write(int b)
throws IOException {
listener.outputChanged(String.valueOf(b));
}
/**
* Notifies the job output listener that
* no more output will be produced.
*
Called by the GassServer.
*/
public void close()
throws IOException {
listener.outputClosed();
}
}
JGlobus-JGlobus-Release-2.1.0/io/src/main/java/org/globus/io/gass/server/RemoteGassServer.java 0000664 0000000 0000000 00000026144 12411160572 0032110 0 ustar 00root root 0000000 0000000 /*
* Copyright 1999-2006 University of Chicago
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package org.globus.io.gass.server;
import org.globus.gram.GramJob;
import org.globus.gram.GramJobListener;
import org.globus.util.GlobusURL;
import org.globus.io.gass.client.GassException;
import org.globus.util.deactivator.Deactivator;
import org.ietf.jgss.GSSCredential;
import org.apache.commons.logging.Log;
import org.apache.commons.logging.LogFactory;
/**
* This class allows for starting gass server remotely. The gass
* server is started via the globus gatekeeper.
*
*/
public class RemoteGassServer {
private static Log logger =
LogFactory.getLog(RemoteGassServer.class.getName());
public static final int LINE_BUFFER_ENABLE = 256;
public static final int TILDE_EXPAND_ENABLE = 512;
public static final int USER_EXPAND_ENABLE = 1024;
private int port = 0;
private int options = 0;
private boolean secure = true;
private GSSCredential cred = null;
private String url = null;
private GramJob job = null;
private boolean compatibilityMode = false;
private OutputListener stderrListener, stdoutListener;
private GassServerListener gassJobListener;
/**
* Starts Gass Server with default user credentials.
* Port of the server will be dynamically assigned.
*/
public RemoteGassServer() {
this(true, 0);
}
/**
* Starts Gass Server on given port and mode. Default
* credentials will be used to start the server.
*
* @param secure
* if true starts server in secure mode, otherwise unsecure.
* @param port
* port of the server, if 0 it will be dynamically assigned.
*/
public RemoteGassServer(boolean secure, int port) {
this(null, secure, port);
}
/**
* Starts Gass Server on given port and mode. The supplied
* credentials will be used to start the server.
*
* @param cred
* credentials to use to start the server.
* @param secure
* if true starts server in secure mode, otherwise unsecure.
* @param port
* port of the server, if 0 it will be dynamically assigned.
*/
public RemoteGassServer(GSSCredential cred, boolean secure, int port) {
this.cred = cred;
this.secure = secure;
this.port = port;
options = USER_EXPAND_ENABLE |
TILDE_EXPAND_ENABLE |
LINE_BUFFER_ENABLE |
GassServer.READ_ENABLE |
GassServer.WRITE_ENABLE;
}
/**
* Returns url of this server.
*
* @return url of this server
*/
public String getURL() {
return url;
}
/**
* Sets the options of the gass server such
* as enabling client shutdown, etc.
*
* @param options server options
*/
public void setOptions(int options) {
this.options = options;
}
/**
* Returns current options of the server.
*
* @return options of the server. O if not
* none set.
*/
public int getOptions() {
return options;
}
/**
* Sets the compatibility mode to work with the old
* globus 1.1.x installations.
*
* @param compatibility set to true if working with
* the old globus 1.1.x installation.
*
*/
public void setCompatibilityMode(boolean compatibility) {
this.compatibilityMode = compatibility;
}
/**
* Starts the gass server on the remote machine.
*
* @param rmc resource manager contact of the remote machine.
* @exception GassException if any error occurs during
* remote startup.
*/
public void start(String rmc)
throws GassException {
if (rmc == null) {
throw new IllegalArgumentException("Resource manager contact not specified");
}
GassServer gassServer = null;
String error = null;
try {
gassServer = new GassServer(this.cred, 0);
String gassURL = gassServer.getURL();
String rsl = getRSL(gassURL);
logger.debug("RSL: " + rsl);
stderrListener = new OutputListener();
stdoutListener = new OutputListener();
gassServer.registerJobOutputStream("err-rgs", new JobOutputStream(stderrListener));
gassServer.registerJobOutputStream("out-rgs", new JobOutputStream(stdoutListener));
job = new GramJob(this.cred, rsl);
gassJobListener = new GassServerListener();
job.addListener(gassJobListener);
job.request(rmc);
int status = gassJobListener.waitFor(1000*60*2);
if (status == GramJob.STATUS_ACTIVE) {
while(true) {
if (stderrListener.hasData()) {
// got some error
error = stderrListener.getOutput();
break;
} else if (stdoutListener.hasData()) {
// this could be the url
String fl = stdoutListener.getOutput();
if (fl.startsWith("https://") ||
fl.startsWith("http://")) {
// extract url
url = fl.trim();
break;
} else {
// something is wrong with stdout
error = "Unable to extract gass url : " + fl;
break;
}
} else {
// wait for stdout/err
logger.debug("waiting for stdout/err");
sleep(500);
}
}
} else if (status == GramJob.STATUS_FAILED ||
status == GramJob.STATUS_DONE) {
int errorCode = gassJobListener.getError();
if (stderrListener.hasData()) {
error = stderrListener.getOutput();
} else if (errorCode != 0) {
error = "Remote gass server stopped with error : " +
errorCode;
} else {
error = "Remote gass server stopped and returned no error";
}
} else {
error = "Unexpected state or received no notification";
}
} catch(Exception e) {
throw new GassException( e.getMessage() );
} finally {
if (gassServer != null) {
gassServer.shutdown();
}
}
if (error != null) {
throw new GassException(error);
}
}
/**
* Shutdowns remotely running gass server.
*
* @return true if server was successfully killed, false
* otherwise.
*/
public boolean shutdown() {
if (url != null) {
logger.debug("Trying to shutdown gass server directly...");
try {
GlobusURL u = new GlobusURL(url);
GassServer.shutdown(this.cred, u);
} catch(Exception e) {
logger.debug("gass server shutdown failed", e);
}
try {
gassJobListener.reset();
int status = gassJobListener.waitFor(1000*60);
if (status == GramJob.STATUS_FAILED ||
status == GramJob.STATUS_DONE) {
// shutdown successful
reset();
return true;
}
} catch(InterruptedException e) {
logger.debug("", e);
}
}
// otherwise just cancel the job.
if (job == null) return true;
logger.debug("Canceling gass server job.");
try {
job.cancel();
reset();
return true;
} catch(Exception e) {
return false;
}
}
private void reset() {
job = null;
url = null;
}
private String getRSL(String gassURL) {
StringBuffer buf = new StringBuffer();
if (compatibilityMode) {
buf.append("&(executable=$(GLOBUS_TOOLS_PREFIX)/bin/globus-gass-server)");
} else {
buf.append("&(executable=$(GLOBUS_LOCATION)/bin/globus-gass-server)");
buf.append("(environment=(LD_LIBRARY_PATH $(GLOBUS_LOCATION)/lib))");
}
buf.append("(rsl_substitution=(GLOBUSRUN_GASS_URL " + gassURL + "))");
buf.append("(stderr=$(GLOBUSRUN_GASS_URL)/dev/stderr-rgs)");
buf.append("(stdout=$(GLOBUSRUN_GASS_URL)/dev/stdout-rgs)");
setRSLArguments(buf);
return buf.toString();
}
private void setRSLArguments(StringBuffer buf) {
buf.append("(arguments=\"-c\"");
if (port != 0) {
buf.append(" \"-p\" \"" + port + "\"");
}
if (!secure) {
buf.append(" \"-i\"");
}
if ((options & LINE_BUFFER_ENABLE) != 0) {
buf.append(" \"-l\"");
}
if ((options & TILDE_EXPAND_ENABLE) != 0) {
buf.append(" \"-t\"");
}
if ((options & USER_EXPAND_ENABLE) != 0) {
buf.append(" \"-u\"");
}
if ((options & GassServer.READ_ENABLE) != 0) {
buf.append(" \"-r\"");
}
if ((options & GassServer.WRITE_ENABLE) != 0) {
buf.append(" \"-w\"");
}
buf.append(")");
}
private void sleep(int msec) {
try {
Thread.sleep(msec);
} catch(Exception e) {
}
}
// ---------- main ----------------
public static void main(String [] args) {
RemoteGassServer s = null;
int port = 0;
boolean secure = true;
String host = null;
for (int i = 0; i < args.length; i++) {
if (args[i].equals("-h")) {
host = args[++i];
} else if (args[i].equals("-p")) {
port = Integer.parseInt(args[++i]);
} else if (args[i].equalsIgnoreCase("-i")) {
secure = false;
} else {
System.err.println("Unknown command: " + args[i]);
System.exit(1);
}
}
try {
s = new RemoteGassServer(secure, port);
s.setOptions( USER_EXPAND_ENABLE |
TILDE_EXPAND_ENABLE |
LINE_BUFFER_ENABLE |
GassServer.READ_ENABLE |
GassServer.WRITE_ENABLE );
s.start(host);
System.out.println("Remote gass server url: " + s.getURL());
Thread.sleep(10000);
System.out.println("Shutting down...");
} catch(Exception e) {
e.printStackTrace();
} finally {
if (s != null) s.shutdown();
}
System.out.println("Done");
Deactivator.deactivateAll();
}
}
class GassServerListener implements GramJobListener {
private static Log logger =
LogFactory.getLog(RemoteGassServer.class.getName());
private int status = -1;
private int error = 0;
public int getError() {
return this.error;
}
public static boolean isStartState(int status) {
return (status == GramJob.STATUS_ACTIVE ||
status == GramJob.STATUS_FAILED ||
status == GramJob.STATUS_DONE);
}
public synchronized void reset() {
this.error = 0;
this.status = -1;
}
public synchronized int waitFor(int timeout)
throws InterruptedException {
for(;;) {
if (isStartState(status)) {
break;
}
wait(timeout);
if (status == -1) {
break;
}
}
return status;
}
public synchronized void statusChanged(GramJob job) {
int st = job.getStatus();
logger.debug("Gass job status: " + st);
if (status == -1 && isStartState(st)) {
status = st;
error = job.getError();
notify();
}
}
}
class OutputListener implements JobOutputListener {
private StringBuffer outputBuf = null;
public void outputChanged(String output) {
if (outputBuf == null) {
outputBuf = new StringBuffer();
}
outputBuf.append(output);
}
public void outputClosed() {
}
public String getOutput() {
return (outputBuf == null) ? null : outputBuf.toString();
}
public boolean hasData() {
return (outputBuf != null);
}
}
JGlobus-JGlobus-Release-2.1.0/io/src/main/java/org/globus/io/gass/server/package.html 0000664 0000000 0000000 00000002036 12411160572 0030260 0 ustar 00root root 0000000 0000000
The server is multi-threaded and accepts HTTPS connection from GASS clients to copy from, copy to, and append to files that are local to the server.
This version has not been fully tested against the full GASS protocol, but works for all cases tested with globus-url-copy.
* This method will perform the transfer and signal completion and * errors through the {@link UrlCopyListener#transferCompleted()} and * {@link UrlCopyListener#transferError(Exception)} of any registered listeners * (see {@link #addUrlCopyListener(UrlCopyListener)}). * */ public void run() { try { copy(); } catch(Exception e) { if (listeners != null) { Iterator iter = listeners.iterator(); while(iter.hasNext()) { ((UrlCopyListener)iter.next()).transferError(e); } } } finally { if (listeners != null) { Iterator iter = listeners.iterator(); while(iter.hasNext()) { ((UrlCopyListener)iter.next()).transferCompleted(); } } } } /** * Performs the copy function. * Source and destination urls must be specified otherwise * a exception is thrown. Also, if source and destination url * are ftp urls and thirdPartyCopy is enabled, third party transfer * will be performed. Urls, of course, must be of supported protocol. * Currently, gsiftp, ftp, https, http, and file are supported. *
* This method does not cause the {@link UrlCopyListener#transferCompleted()} * and {@link UrlCopyListener#transferError(Exception)} to be called. If you want * completion/failures to be signaled asynchronously, either call the * {@link #run} method or wrap this object in a {@link Thread}. * * @throws UrlCopyException in case of an error. */ public void copy() throws UrlCopyException { if (srcUrl == null) { throw new UrlCopyException("Source url is not specified"); } if (dstUrl == null) { throw new UrlCopyException("Destination url is not specified"); } String fromP = srcUrl.getProtocol(); String toP = dstUrl.getProtocol(); if (thirdParty && fromP.endsWith("ftp") && toP.endsWith("ftp")) { thirdPartyTransfer(); return; } GlobusInputStream in = null; GlobusOutputStream out = null; boolean rs = false; try { in = getInputStream(); long size = in.getSize(); if (size == -1) { logger.debug("Source size: unknown"); } else { logger.debug("Source size: " + size); } out = getOutputStream(size); rs = transfer(size, in, out); in.close(); out.close(); } catch(Exception e) { if (out != null) out.abort(); if (in != null) in.abort(); throw new UrlCopyException("UrlCopy transfer failed.", e); } if (!rs && isCanceled()) { throw new UrlCopyException("Transfer Aborted"); } } /** * Returns input stream based on the source url */ protected GlobusInputStream getInputStream() throws Exception { GlobusInputStream in = null; String fromP = srcUrl.getProtocol(); String fromFile = srcUrl.getPath(); if (fromP.equalsIgnoreCase("file")) { fromFile = URLDecoder.decode(fromFile); in = new GlobusFileInputStream(fromFile); } else if (fromP.equalsIgnoreCase("ftp")) { fromFile = URLDecoder.decode(fromFile); in = new FTPInputStream(srcUrl.getHost(), srcUrl.getPort(), srcUrl.getUser(), srcUrl.getPwd(), fromFile); } else if (fromP.equalsIgnoreCase("gsiftp") || fromP.equalsIgnoreCase("gridftp")) { Authorization auth = getSourceAuthorization(); if (auth == null) { auth = HostAuthorization.getInstance(); } fromFile = URLDecoder.decode(fromFile); in = new GridFTPInputStream(getSourceCredentials(), auth, srcUrl.getHost(), srcUrl.getPort(), fromFile, getDCAU()); } else if (fromP.equalsIgnoreCase("https")) { Authorization auth = getSourceAuthorization(); if (auth == null) { auth = SelfAuthorization.getInstance(); } in = new GassInputStream(getSourceCredentials(), auth, srcUrl.getHost(), srcUrl.getPort(), fromFile); } else if (fromP.equalsIgnoreCase("http")) { in = new HTTPInputStream(srcUrl.getHost(), srcUrl.getPort(), fromFile); } else { throw new Exception("Source protocol: " + fromP + " not supported!"); } return in; } /** * Returns output stream based on the destination url. */ protected GlobusOutputStream getOutputStream(long size) throws Exception { GlobusOutputStream out = null; String toP = dstUrl.getProtocol(); String toFile = dstUrl.getPath(); if (toP.equalsIgnoreCase("file")) { toFile = URLDecoder.decode(toFile); out = new GlobusFileOutputStream(toFile, appendMode); } else if (toP.equalsIgnoreCase("ftp")) { toFile = URLDecoder.decode(toFile); out = new FTPOutputStream(dstUrl.getHost(), dstUrl.getPort(), dstUrl.getUser(), dstUrl.getPwd(), toFile, appendMode); } else if (toP.equalsIgnoreCase("gsiftp") || toP.equalsIgnoreCase("gridftp")) { Authorization auth = getDestinationAuthorization(); if (auth == null) { auth = HostAuthorization.getInstance(); } toFile = URLDecoder.decode(toFile); out = new GridFTPOutputStream(getDestinationCredentials(), auth, dstUrl.getHost(), dstUrl.getPort(), toFile, appendMode, getDCAU(), (disableAllo ? -1 : size)); } else if (toP.equalsIgnoreCase("https")) { Authorization auth = getDestinationAuthorization(); if (auth == null) { auth = SelfAuthorization.getInstance(); } out = new GassOutputStream(getDestinationCredentials(), auth, dstUrl.getHost(), dstUrl.getPort(), toFile, size, appendMode); } else if (toP.equalsIgnoreCase("http")) { out = new HTTPOutputStream(dstUrl.getHost(), dstUrl.getPort(), toFile, size, appendMode); } else { throw new Exception("Destination protocol: " + toP + " not supported!"); } return out; } /** * This function performs the actual transfer. */ private boolean transfer(long total, GlobusInputStream in, GlobusOutputStream out) throws IOException { byte [] buffer = new byte[bufferSize]; int bytes = 0; long totalBytes = total; long transferedBytes = 0; if (total == -1) { while( (bytes = in.read(buffer)) != -1) { out.write(buffer, 0, bytes); out.flush(); if (listeners != null) { transferedBytes += bytes; fireUrlTransferProgressEvent(totalBytes, transferedBytes); } if (isCanceled()) return false; } } else { while ( total != 0 ) { bytes = bufferSize; if (total < bufferSize) bytes = (int)total; bytes = in.read(buffer); out.write(buffer, 0, bytes); out.flush(); total -= bytes; if (listeners != null) { transferedBytes += bytes; fireUrlTransferProgressEvent(totalBytes, transferedBytes); } if (isCanceled()) return false; } } return true; } private void fireUrlTransferProgressEvent(long totalBytes, long transferedBytes) { Iterator iter = listeners.iterator(); while(iter.hasNext()) { ((UrlCopyListener)iter.next()).transfer(transferedBytes, totalBytes); } } /** * This performs thrid party transfer only if source and destination urls * are ftp urls. */ private void thirdPartyTransfer() throws UrlCopyException { logger.debug("Trying third party transfer..."); FTPClient srcFTP = null; FTPClient dstFTP = null; try { srcFTP = createFTPConnection(srcUrl, true); dstFTP = createFTPConnection(dstUrl, false); negotiateDCAU(srcFTP, dstFTP); srcFTP.setType(Session.TYPE_IMAGE); dstFTP.setType(Session.TYPE_IMAGE); if (listeners != null) { fireUrlTransferProgressEvent(-1, -1); } if (this.sourceOffset == 0 && this.destinationOffset == 0 && this.sourceLength == Long.MAX_VALUE) { srcFTP.setMode(Session.MODE_STREAM); dstFTP.setMode(Session.MODE_STREAM); srcFTP.transfer(srcUrl.getPath(), dstFTP, dstUrl.getPath(), false, null); } else if (srcFTP instanceof GridFTPClient && dstFTP instanceof GridFTPClient) { GridFTPClient srcGridFTP = (GridFTPClient) srcFTP; GridFTPClient dstGridFTP = (GridFTPClient) dstFTP; srcGridFTP.setMode(GridFTPSession.MODE_EBLOCK); dstGridFTP.setMode(GridFTPSession.MODE_EBLOCK); srcGridFTP.extendedTransfer(srcUrl.getPath(), this.sourceOffset, this.sourceLength, dstGridFTP, dstUrl.getPath(), this.destinationOffset, null); } else { throw new UrlCopyException("Partial 3rd party transfers not supported " + "by FTP client. Use GridFTP for both source and destination."); } } catch(Exception e) { throw new UrlCopyException("UrlCopy third party transfer failed.", e); } finally { if (srcFTP != null) { try { srcFTP.close(); } catch (Exception ee) {} } if (dstFTP != null) { try { dstFTP.close(); } catch (Exception ee) {} } } } /* * This could replaced later with something more inteligent * where the user would set if dcau is required or not, etc. */ protected void negotiateDCAU(FTPClient src, FTPClient dst) throws IOException, FTPException { if (src instanceof GridFTPClient) { // src: dcau can be on or off if (dst instanceof GridFTPClient) { // dst: dca can be on or off GridFTPClient s = (GridFTPClient)src; GridFTPClient d = (GridFTPClient)dst; if (src.isFeatureSupported("DCAU") && dst.isFeatureSupported("DCAU")) { setDCAU(s, getDCAU()); setDCAU(d, getDCAU()); } else { setDCAU(s, false); setDCAU(d, false); setDCAU(false); } } else { // dst: no dcau supported - disable src setDCAU((GridFTPClient)src, false); setDCAU(false); } } else { // src: no dcau if (dst instanceof GridFTPClient) { // dst: just disable dcau setDCAU((GridFTPClient)dst, false); } else { // dst: no dcau // we are all set then } setDCAU(false); } } private static void setDCAU(GridFTPClient c, boolean dcau) throws IOException, FTPException { if (c.isFeatureSupported("DCAU")) { if (!dcau) { c.setDataChannelAuthentication(DataChannelAuthentication.NONE); } } else if (dcau) { throw new IOException("DCAU not supported but DCAU requested"); } } /** * Creates ftp connection based on the ftp url (secure vs. unsecure) */ private FTPClient createFTPConnection(GlobusURL ftpURL, boolean srcSide) throws Exception { String protocol = ftpURL.getProtocol(); if (protocol.equalsIgnoreCase("ftp")) { FTPClient ftp = new FTPClient(ftpURL.getHost(), ftpURL.getPort()); ftp.authorize(ftpURL.getUser(), ftpURL.getPwd()); return ftp; } else { GridFTPClient ftp = new GridFTPClient(ftpURL.getHost(), ftpURL.getPort()); if (srcSide) { Authorization auth = getSourceAuthorization(); if (auth == null) { auth = HostAuthorization.getInstance(); } ftp.setAuthorization(auth); ftp.authenticate(getSourceCredentials()); } else { Authorization auth = getDestinationAuthorization(); if (auth == null) { auth = HostAuthorization.getInstance(); } ftp.setAuthorization(auth); ftp.authenticate(getDestinationCredentials()); } if (tcpBufferSize != 0) { ftp.setTCPBufferSize(tcpBufferSize); } return ftp; } } } JGlobus-JGlobus-Release-2.1.0/io/src/main/java/org/globus/io/urlcopy/UrlCopyException.java 0000664 0000000 0000000 00000001720 12411160572 0031347 0 ustar 00root root 0000000 0000000 /* * Copyright 1999-2006 University of Chicago * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * You may obtain a copy of the License at * * http://www.apache.org/licenses/LICENSE-2.0 * * Unless required by applicable law or agreed to in writing, software * distributed under the License is distributed on an "AS IS" BASIS, * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. * See the License for the specific language governing permissions and * limitations under the License. */ package org.globus.io.urlcopy; import org.globus.common.ChainedException; /** * Encapsulates the exceptions caused by various errors * in the url-copy library. */ public class UrlCopyException extends ChainedException { public UrlCopyException(String msg) { super(msg); } public UrlCopyException(String msg, Throwable ex) { super(msg, ex); } } JGlobus-JGlobus-Release-2.1.0/io/src/main/java/org/globus/io/urlcopy/UrlCopyListener.java 0000664 0000000 0000000 00000003012 12411160572 0031172 0 ustar 00root root 0000000 0000000 /* * Copyright 1999-2006 University of Chicago * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * You may obtain a copy of the License at * * http://www.apache.org/licenses/LICENSE-2.0 * * Unless required by applicable law or agreed to in writing, software * distributed under the License is distributed on an "AS IS" BASIS, * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. * See the License for the specific language governing permissions and * limitations under the License. */ package org.globus.io.urlcopy; public interface UrlCopyListener { /** * This function is contniuosly called during url transfers. * * @param transferedBytes number of bytes currently trasfered * if -1, then performing thrid party transfer * @param totalBytes number of total bytes to transfer * if -1, the total size in unknown. */ public void transfer(long transferedBytes, long totalBytes); /** * This function is called only when an error occurs. * * @param exception the actual error exception */ public void transferError(Exception exception); /** * This function is called once the transfer is completed * either successfully or because of a failure. If an error occurred * during the transfer the transferError() function is called first. */ public void transferCompleted(); } JGlobus-JGlobus-Release-2.1.0/io/src/main/java/org/globus/io/urlcopy/package.html 0000664 0000000 0000000 00000001502 12411160572 0027507 0 ustar 00root root 0000000 0000000
Runnable is
* used to create a thread, starting the thread causes the object's
* run method to be called in that separately executing
* thread.
*
* The general contract of the method run is that it
* may take any action whatsoever.
*
* @see Thread#run()
*/
public void run() {
latch.countDown();
try {
SSLSocket sslsocket = (SSLSocket) sslserversocket.accept();
InputStream inputstream = sslsocket.getInputStream();
InputStreamReader inputstreamreader = new InputStreamReader(
inputstream);
BufferedReader bufferedreader = new BufferedReader(
inputstreamreader);
String line;
while ((line = bufferedreader.readLine()) != null) {
builder.append(line);
}
assertEquals(builder.toString().trim(), "hello");
} catch (IOException e) {
e.printStackTrace();
}
}
});
return sslserversocket;
}
}
JGlobus-JGlobus-Release-2.1.0/jsse/src/test/resources/ 0000775 0000000 0000000 00000000000 12411160572 0022523 5 ustar 00root root 0000000 0000000 JGlobus-JGlobus-Release-2.1.0/jsse/src/test/resources/configuratorTest/ 0000775 0000000 0000000 00000000000 12411160572 0026065 5 ustar 00root root 0000000 0000000 JGlobus-JGlobus-Release-2.1.0/jsse/src/test/resources/configuratorTest/TestCA1.signing_policy 0000664 0000000 0000000 00000000242 12411160572 0032226 0 ustar 00root root 0000000 0000000 #TestCA1.signing_policy
access_id_CA X509 '/O=Auto/OU=JGlobusTestCA/CN=CA'
pos_rights globus CA:sign
cond_subjects globus '"/*"'
JGlobus-JGlobus-Release-2.1.0/jsse/src/test/resources/configuratorTest/cacert.pem 0000664 0000000 0000000 00000001630 12411160572 0030031 0 ustar 00root root 0000000 0000000 -----BEGIN CERTIFICATE-----
MIICeTCCAeKgAwIBAgIBADANBgkqhkiG9w0BAQUFADA0MQ0wCwYDVQQKEwRBdXRv
MRYwFAYDVQQLEw1KR2xvYnVzVGVzdENBMQswCQYDVQQDEwJDQTAeFw0xMTAzMTUw
MTE4NTdaFw0xNjAzMTUwMTE5MDdaMDQxDTALBgNVBAoTBEF1dG8xFjAUBgNVBAsT
DUpHbG9idXNUZXN0Q0ExCzAJBgNVBAMTAkNBMIGfMA0GCSqGSIb3DQEBAQUAA4GN
ADCBiQKBgQCkfnJsLXlvbNFQB7k1i8A86R7e/9BSwYif/OG0bNhsnewgLekyrRa+
HmReo0cBc8+wvUexHEyBKhOCmpyCW4mzTvH6lVSQHb4Gef54tc4wZS/R6luGweRU
zW8CWOOTCj0nJIviefkKHhB5v/beHmhP+i4T0Y08Rz4FBraq/uL9AQIDAQABo4Ga
MIGXMA8GA1UdEwEB/wQFMAMBAf8wHQYDVR0OBBYEFHGg7KW9MikplKFKhlCEtrs+
pnw0MFgGA1UdIwRRME+AFHGg7KW9MikplKFKhlCEtrs+pnw0oTQxDTALBgNVBAoT
BEF1dG8xFjAUBgNVBAsTDUpHbG9idXNUZXN0Q0ExCzAJBgNVBAMTAkNBggEAMAsG
A1UdDwQEAwIBBjANBgkqhkiG9w0BAQUFAAOBgQBFwAHr43BToa1G3zcSX7jykigw
SBCOJgncdO7H4cYhP5xNrslzwo9J3iPFqT9Lgdfdw7b4i+ey9CektgiUHUK78EkS
4bM3L29V2bcEjLIXhWBzI18j2oIw+aybc5U/A0VgdPh9M1JpKT99FxzliWz541FR
MQvlvnnX4vUr0Th0HQ==
-----END CERTIFICATE-----
JGlobus-JGlobus-Release-2.1.0/jsse/src/test/resources/configuratorTest/mykeystore.properties 0000664 0000000 0000000 00000001667 12411160572 0032430 0 ustar 00root root 0000000 0000000 #
# Copyright 1999-2010 University of Chicago
#
# Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in
# compliance with the License. You may obtain a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software distributed under the License is
# distributed on an "AS IS" BASIS,WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either
# express or implied.
#
# See the License for the specific language governing permissions and limitations under the License.
#
# Properties file as input to the keystore (PEMFilebasedKeystore)
# Name of proxy file
#proxyFilename=/Users/ranantha/work/sos/gitRepository/Globus-Security/integratioon-example/target/classes/proxy.pem
# Name of certificate file
certificateFilename=classpath:/configuratorTest/usercert.pem
# Name of key file
keyFilename=classpath:/configuratorTest/userkey.pem
JGlobus-JGlobus-Release-2.1.0/jsse/src/test/resources/configuratorTest/mytruststore.properties 0000664 0000000 0000000 00000001202 12411160572 0033002 0 ustar 00root root 0000000 0000000 #
# Copyright 1999-2010 University of Chicago
#
# Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in
# compliance with the License. You may obtain a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software distributed under the License is
# distributed on an "AS IS" BASIS,WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either
# express or implied.
#
# See the License for the specific language governing permissions and limitations under the License.
#
directory_list=classpath:/configuratorTest/cacert.pem JGlobus-JGlobus-Release-2.1.0/jsse/src/test/resources/configuratorTest/usercert.pem 0000664 0000000 0000000 00000001371 12411160572 0030426 0 ustar 00root root 0000000 0000000 -----BEGIN CERTIFICATE-----
MIICBjCCAW+gAwIBAgIBADANBgkqhkiG9w0BAQUFADA0MQ0wCwYDVQQKEwRBdXRv
MRYwFAYDVQQLEw1KR2xvYnVzVGVzdENBMQswCQYDVQQDEwJDQTAeFw0xMTAzMTUw
MTIzMzdaFw0xNjAzMTUwMTIzNDdaMDwxDTALBgNVBAoTBEF1dG8xFjAUBgNVBAsT
DUpHbG9idXNUZXN0Q0ExEzARBgNVBAMTCmdsb2J1cy5vcmcwgZ8wDQYJKoZIhvcN
AQEBBQADgY0AMIGJAoGBAI7a/QhZuFGUCvvznueSxdFaKlTxcAWG790jm56417qK
1tktcNmoX3mzuY0yu5vVQ/6Mk7NWHTnijGfjdONLF5ImTY9SsXzEFgPCcXZUgJ4R
xkfl+PGLj/OBN4NCXYsF09W21DGa6d5ZCFS3hOjjGge+gQUHdP2gDh9hw0m2I/4t
AgMBAAGjIDAeMAwGA1UdEwEB/wQCMAAwDgYDVR0PAQH/BAQDAgSwMA0GCSqGSIb3
DQEBBQUAA4GBACRaJHra+dtyb1h2k4tUa019+sPkFV1y5IPWIxRs+fKV7JQrd42W
jrHPimRU8TJ/2b4aNCLXRTK2qHhbQ72+WKrH78aI2gYQK6AuDuy2WNNwPOnHg4uG
vJaczITE2FsUqXr4AVOxFyJsnljXfx05zD0zHbNqg+qqtpLxFuO3McQy
-----END CERTIFICATE-----
JGlobus-JGlobus-Release-2.1.0/jsse/src/test/resources/configuratorTest/userkey.pem 0000664 0000000 0000000 00000001567 12411160572 0030270 0 ustar 00root root 0000000 0000000 -----BEGIN RSA PRIVATE KEY-----
MIICWwIBAAKBgQCO2v0IWbhRlAr7857nksXRWipU8XAFhu/dI5ueuNe6itbZLXDZ
qF95s7mNMrub1UP+jJOzVh054oxn43TjSxeSJk2PUrF8xBYDwnF2VICeEcZH5fjx
i4/zgTeDQl2LBdPVttQxmuneWQhUt4To4xoHvoEFB3T9oA4fYcNJtiP+LQIDAQAB
AoGAdOw3/gWxHtQUyXL0tIUk89zgmPWjwmJXIKBsVtTjfQL2JntSylNNEcdQL4k+
lKVRKZ7VpQrukNokIUPB/+cOOogWFKGqGW3Tmi/3UvbnKWQZB9kanupC9HqxfS2O
5vhuWT3W20/B6/0P4Nkv4V6OHr4+hsn4LYbaBO4fCuRw8eECQQDuG//QZ8IGw+oE
jQ4yKzPk082EUMra2JqHO3dArkWh+bFdvTMJWKDSOP1Al4MZDmQkFgfWMYVOUaUC
qSolGoMHAkEAmZbK60CNJwS1bLadSi8UhXAccoVUmRybsGHf82yCju62mO1Vgxwz
CCWZ7oFL6Qzpc95icdTm2znrxEyrXeUkKwJAdyeT0Jrbwb7wsO5VmE1+XpiPVBOK
MBIM4nejqb6MIg5t79bqX1b2w7y5H0Wy2SsWeeh8a3fEmfjJdpdo+8BUqQJAQT3z
3rDiBOQUKST9dajAH9q6ys7mW8/yNp+s4RuD7jFq8VVH0NTmvJw0YkMcOtgYRvb9
fHtCwXc+NnmXBeCzVwJADEv5Y58PeUBZFSlGNNsWoFIdTN7J3yVpAtFFwgnG2xiA
DZfEG6OzgkQ87eikamg4SspAvorUgKf3IgV9C4dgPg==
-----END RSA PRIVATE KEY-----
JGlobus-JGlobus-Release-2.1.0/myproxy/ 0000775 0000000 0000000 00000000000 12411160572 0017526 5 ustar 00root root 0000000 0000000 JGlobus-JGlobus-Release-2.1.0/myproxy/pom.xml 0000664 0000000 0000000 00000001346 12411160572 0021047 0 ustar 00root root 0000000 0000000
changePassword operation.
*/
public class ChangePasswordParams
extends Params {
private String newPassphrase;
private String credentialName;
public ChangePasswordParams() {
super(MyProxy.CHANGE_PASSWORD);
}
public void setNewPassphrase(String newPassphrase) {
checkPassphrase(newPassphrase);
this.newPassphrase = newPassphrase;
}
public String getNewPassphrase() {
return this.newPassphrase;
}
public void setCredentialName(String credentialName) {
this.credentialName = credentialName;
}
public String getCredentialName() {
return this.credentialName;
}
protected String makeRequest(boolean includePassword) {
StringBuffer buf = new StringBuffer();
buf.append(super.makeRequest(includePassword));
buf.append(NEW_PHRASE);
if (includePassword) {
buf.append(newPassphrase);
} else {
for (int i=0;idestroy operation.
*/
public class DestroyParams
extends Params {
private String credentialName;
public DestroyParams() {
super(MyProxy.DESTROY_PROXY);
}
public DestroyParams(String username, String passphrase) {
super(MyProxy.DESTROY_PROXY, username, passphrase);
}
public void setCredentialName(String credentialName) {
this.credentialName = credentialName;
}
public String getCredentialName() {
return this.credentialName;
}
protected String makeRequest(boolean includePassword) {
StringBuffer buf = new StringBuffer();
buf.append(super.makeRequest(includePassword));
add(buf, CRED_NAME, credentialName);
return buf.toString();
}
}
JGlobus-JGlobus-Release-2.1.0/myproxy/src/main/java/org/globus/myproxy/GetParams.java 0000664 0000000 0000000 00000005415 12411160572 0030526 0 ustar 00root root 0000000 0000000 /*
* Copyright 1999-2006 University of Chicago
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package org.globus.myproxy;
import org.ietf.jgss.GSSCredential;
import java.util.List;
import java.util.Iterator;
/**
* Holds the parameters for the get operation.
*/
public class GetParams
extends Params {
private boolean wantTrustroots = false;
private String credentialName;
private GSSCredential authzcreds;
private List voname;
private List vomses;
public GetParams() {
super(MyProxy.GET_PROXY);
}
public GetParams(String username, String passphrase) {
super(MyProxy.GET_PROXY, username, passphrase);
}
public void setCredentialName(String credentialName) {
this.credentialName = credentialName;
}
public String getCredentialName() {
return this.credentialName;
}
public void setWantTrustroots(boolean wantTrustroots) {
this.wantTrustroots = wantTrustroots;
}
public boolean getWantTrustroots() {
return this.wantTrustroots;
}
public void setVoname(List voname) {
this.voname = voname;
}
public List getVoname() {
return this.voname;
}
public void setVomses(List vomses) {
this.vomses = vomses;
}
public List getVomses() {
return this.vomses;
}
/**
* Set credentials for renewal authorization.
* @param creds
* The credentials to renew.
*/
public void setAuthzCreds(GSSCredential creds) {
this.authzcreds = creds;
}
public GSSCredential getAuthzCreds() {
return this.authzcreds;
}
protected String makeRequest(boolean includePassword) {
StringBuffer buf = new StringBuffer();
buf.append(super.makeRequest(includePassword));
add(buf, CRED_NAME, credentialName);
add(buf, VONAME, this.voname);
add(buf, VOMSES, this.vomses);
if (this.wantTrustroots == true) {
add(buf, TRUSTROOTS, "1");
}
return buf.toString();
}
private void add(StringBuffer buf, String prefix, List values) {
if (values == null) {
return;
}
for (Iterator itr = values.iterator(); itr.hasNext(); ) {
String value = (String)itr.next();
add(buf, prefix, value);
}
}
}
JGlobus-JGlobus-Release-2.1.0/myproxy/src/main/java/org/globus/myproxy/GetTrustrootsParams.java 0000664 0000000 0000000 00000002043 12411160572 0032651 0 ustar 00root root 0000000 0000000 /*
* Copyright 1999-2006 University of Chicago
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package org.globus.myproxy;
/**
* Holds the parameters for the get-trustroots operation.
*/
public class GetTrustrootsParams
extends Params {
public GetTrustrootsParams() {
super(MyProxy.GET_TRUSTROOTS);
}
protected String makeRequest(boolean includePassword) {
StringBuffer buf = new StringBuffer();
buf.append(super.makeRequest(includePassword));
add(buf, TRUSTROOTS, "1");
return buf.toString();
}
}
JGlobus-JGlobus-Release-2.1.0/myproxy/src/main/java/org/globus/myproxy/InfoParams.java 0000664 0000000 0000000 00000001464 12411160572 0030702 0 ustar 00root root 0000000 0000000 /*
* Copyright 1999-2006 University of Chicago
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package org.globus.myproxy;
/**
* Holds the parameters for the info operation.
*/
public class InfoParams
extends Params {
public InfoParams() {
super(MyProxy.INFO_PROXY);
}
}
JGlobus-JGlobus-Release-2.1.0/myproxy/src/main/java/org/globus/myproxy/InitParams.java 0000664 0000000 0000000 00000005025 12411160572 0030707 0 ustar 00root root 0000000 0000000 /*
* Copyright 1999-2006 University of Chicago
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package org.globus.myproxy;
/**
* Holds the parameters for the put operation.
*/
public class InitParams
extends Params {
private String retriever;
private String renewer;
private String credentialName;
private String credentialDescription;
private String trusted_retriever;
public InitParams() {
super(MyProxy.PUT_PROXY);
}
public void setCredentialName(String credentialName) {
this.credentialName = credentialName;
}
public String getCredentialName() {
return this.credentialName;
}
public void setCredentialDescription(String description) {
this.credentialDescription = description;
}
public String getCredentialDescription() {
return this.credentialDescription;
}
public void setRetriever(String retriever) {
this.retriever = retriever;
}
public String getRetriever() {
return this.retriever;
}
public void setRenewer(String renewer) {
this.renewer = renewer;
}
public String getRenewer() {
return this.renewer;
}
public void setTrustedRetriever(String trusted_retriever) {
this.trusted_retriever = trusted_retriever;
}
public String getTrustedRetriever() {
return this.trusted_retriever;
}
/**
* If the passpharse is not set returns
* an empty string.
*/
public String getPassphrase() {
String pwd = super.getPassphrase();
return (pwd == null) ? "" : pwd;
}
protected String makeRequest(boolean includePassword) {
StringBuffer buf = new StringBuffer();
buf.append(super.makeRequest(includePassword));
add(buf, RETRIEVER, retriever);
add(buf, CRED_RETRIEVER_TRUSTED, trusted_retriever);
add(buf, RENEWER, renewer);
add(buf, CRED_NAME, credentialName);
add(buf, CRED_DESC, credentialDescription);
return buf.toString();
}
}
JGlobus-JGlobus-Release-2.1.0/myproxy/src/main/java/org/globus/myproxy/MyProxy.java 0000664 0000000 0000000 00000157067 12411160572 0030305 0 ustar 00root root 0000000 0000000 /*
* Copyright 1999-2006 University of Chicago
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package org.globus.myproxy;
import java.nio.charset.Charset;
import java.io.File;
import java.io.FileInputStream;
import java.io.FileOutputStream;
import java.io.Writer;
import java.io.InputStream;
import java.io.OutputStream;
import java.io.OutputStreamWriter;
import java.io.IOException;
import java.io.EOFException;
import java.io.ByteArrayOutputStream;
import java.io.ByteArrayInputStream;
import java.io.DataOutputStream;
import java.util.Map;
import java.util.HashMap;
import java.util.Iterator;
import java.net.Socket;
import java.net.InetAddress;
import java.net.InetSocketAddress;
import java.net.UnknownHostException;
import java.security.KeyPair;
import java.security.interfaces.RSAPrivateKey;
import java.security.interfaces.RSAPublicKey;
import java.security.cert.X509Certificate;
import java.security.MessageDigest;
import java.security.GeneralSecurityException;
import java.security.Signature;
import javax.security.auth.x500.X500Principal;
import javax.net.ssl.SSLContext;
import javax.net.ssl.SSLSocket;
import javax.net.ssl.SSLSocketFactory;
import javax.net.ssl.TrustManager;
import javax.net.ssl.X509TrustManager;
import org.bouncycastle.asn1.x509.X509Name;
import org.globus.common.CoGProperties;
import org.bouncycastle.util.encoders.Base64;
import org.globus.gsi.X509Credential;
import org.globus.gsi.GSIConstants;
import org.globus.gsi.util.CertificateIOUtil;
import org.globus.gsi.util.CertificateUtil;
import org.globus.gsi.OpenSSLKey;
import org.globus.gsi.gssapi.net.GssSocket;
import org.globus.gsi.gssapi.net.GssSocketFactory;
import org.globus.gsi.gssapi.auth.Authorization;
import org.globus.gsi.gssapi.auth.IdentityAuthorization;
import org.globus.gsi.gssapi.GlobusGSSCredentialImpl;
import org.globus.gsi.gssapi.GSSConstants;
import org.globus.gsi.bc.BouncyCastleCertProcessingFactory;
import org.gridforum.jgss.ExtendedGSSManager;
import org.ietf.jgss.GSSCredential;
import org.ietf.jgss.GSSContext;
import org.ietf.jgss.GSSManager;
import org.ietf.jgss.GSSException;
import org.ietf.jgss.GSSName;
import org.ietf.jgss.Oid;
import org.apache.commons.logging.Log;
import org.apache.commons.logging.LogFactory;
/**
* This class provides an API for communicating with MyProxy servers.
* It provides main functions for retrieving, removing and
* storing credentials on MyProxy server. It also provides functions
* for getting credential information and changing passwords.
* * More information about MyProxy is available on the * MyProxy Home Page. *
*
* @version 2.0
*/
public class MyProxy {
static Log logger =
LogFactory.getLog(MyProxy.class.getName());
public final static String version = "2.0";
public static final int MIN_PASSWORD_LENGTH =
MyProxyConstants.MIN_PASSWORD_LENGTH;
public static final String MYPROXY_PROTOCOL_VERSION =
MyProxyConstants.MYPROXY_PROTOCOL_VERSION;
private static final String RESPONSE = "RESPONSE=";
private static final String ERROR = "ERROR=";
private static final String AUTHZ_DATA = "AUTHORIZATION_DATA=";
private static final String CRED = "CRED_";
private static final String OWNER = "OWNER=";
private static final String START_TIME = "START_TIME=";
private static final String END_TIME = "END_TIME=";
private static final String DESC = "DESC=";
private static final String RETRIEVER = "RETRIEVER=";
private static final String RENEWER = "RENEWER=";
private static final String TRUSTROOTS = "TRUSTED_CERTS=";
private static final String CRED_START_TIME = CRED + START_TIME;
private static final String CRED_END_TIME = CRED + END_TIME;
private static final String CRED_OWNER = CRED + OWNER;
private static final String CRED_DESC = CRED + DESC;
private static final String CRED_RETRIEVER = CRED + RETRIEVER;
private static final String CRED_RENEWER = CRED + RENEWER;
private static final String CRED_NAME = CRED + "NAME=";
/** The default MyProxy server port (7512). */
public static final int DEFAULT_PORT = 7512;
/** The default key size (2048 bits). */
public static final int DEFAULT_KEYBITS = 2048;
/** The integer command number for the MyProxy 'Get' command (0). */
public static final int GET_PROXY = 0;
/** The integer command number for the MyProxy 'Put' command (1). */
public static final int PUT_PROXY = 1;
/** The integer command number for the MyProxy 'Info' command (2). */
public static final int INFO_PROXY = 2;
/** The integer command number for the MyProxy 'Destroy' command (3). */
public static final int DESTROY_PROXY = 3;
/** The integer command number for the MyProxy Password Change
* command (4). */
public static final int CHANGE_PASSWORD = 4;
/** The integer command number for the MyProxy 'Store' command (5). */
public static final int STORE_CREDENTIAL = 5;
/** The integer command number for the MyProxy 'Retrieve' command (6). */
public static final int RETRIEVE_CREDENTIAL = 6;
/** The integer command number for the MyProxy 'Get Trustroots' command (7). */
public static final int GET_TRUSTROOTS = 7;
/** The hostname(s) of the target MyProxy server(s). Multiple host names
can be specified comma delimited with each hostname optionally followed
by a ':' and port number. The client will communicate with the first
server it has a successful network connection with. */
protected String host;
/** The port of the target MyProxy server (default 7512). */
protected int port = DEFAULT_PORT;
/** The authorization policy in effect for the target MyProxy server. */
protected Authorization authorization;
/** The GSSContext for communication with the MyProxy server. */
protected GSSContext context;
/** Trustroot information and path constant. */
protected String[] trustrootFilenames;
protected String[] trustrootData;
private final static String TRUSTED_CERT_PATH = "/.globus/certificates";
/**
* Initialize the MyProxy client object with the default
* authorization policy.
*/
public MyProxy() {
setAuthorization(new MyProxyServerAuthorization());
}
/**
* Prepare to connect to the MyProxy server at the specified
* host and port using the default authorization policy.
*
* @param host
* The hostname(s) of the MyProxy server(s) with optional port
* info. Multiple hostnames can be specified in a comma separated
* list with each hostname optionally followed by a ':' and port
* number. The client will communicate with the first server it has
* a successful network connection with.
* @param port
* The port number of the MyProxy server to use if one is not
* specified as part of the host string.
*/
public MyProxy(String host, int port) {
setHost(host);
setPort(port);
setAuthorization(new MyProxyServerAuthorization());
}
/**
* Set MyProxy server hostname.
* @param host
* The hostname(s) of the MyProxy server(s). Multiple host names
* are comma delimited with each hostname optionally followed by a
* ':' and port number. The client will communicate with the first
* server it has a successful network connection with.
*/
public void setHost(String host) {
this.host = host;
}
/**
* Get MyProxy server hostname.
* @return The hostname of the MyProxy server.
*/
public String getHost() {
return host;
}
/**
* Set MyProxy server port.
* @param port
* The port number of the MyProxy server to use if one is not
* specified as part of the host string. Defaults to
* MyProxy.DEFAULT_PORT.
*/
public void setPort(int port) {
this.port = port;
}
/**
* Get MyProxy server port.
* @return The port number of the MyProxy server.
*/
public int getPort() {
return port;
}
/**
* Set MyProxy server authorization mechanism.
* @param authorization
* The authorization mechanism for the MyProxy server.
*/
public void setAuthorization(Authorization authorization) {
this.authorization = authorization;
}
/**
* Get MyProxy server authorization mechanism.
* @return The authorization mechanism for the MyProxy server.
*/
public Authorization getAuthorization() {
return this.authorization;
}
private GssSocket getSocket(GSSCredential credential)
throws IOException, GSSException {
GSSManager manager = ExtendedGSSManager.getInstance();
this.context = manager.createContext(null,
GSSConstants.MECH_OID,
credential,
GSSContext.DEFAULT_LIFETIME);
// no delegation
this.context.requestCredDeleg(false);
// Request confidentiality
this.context.requestConf(true);
IOException exception = null;
Socket socket = null;
String goodAddr = "";
int hostIdx = 0;
String hosts[] = host.split(",");
int socketTimeout = CoGProperties.getDefault().getSocketTimeout();
int currentPort = port;
search:
while (hostIdx < hosts.length) {
String hostPort[] = hosts[hostIdx].split(":");
hosts[hostIdx] = hostPort[0];
if (hostPort.length > 1 && hostPort[1] != null)
// port number specified
port = Integer.parseInt(hostPort[1].trim());
else
port = currentPort;
InetAddress addrs[] = null;
try {
addrs = InetAddress.getAllByName(hosts[hostIdx]);
} catch (UnknownHostException e) {
if (logger.isDebugEnabled()) {
logger.debug("getSocket(): Skipping unknown host " +
hosts[hostIdx]);
}
exception = e;
}
for (int addrIdx = 0; addrs != null && addrIdx < addrs.length;
addrIdx++) {
exception = null;
try {
if (logger.isDebugEnabled()) {
logger.debug("getSocket(): Trying " +
addrs[addrIdx].toString());
}
socket = new Socket();
socket.connect(
new InetSocketAddress(addrs[addrIdx],port),
socketTimeout);
goodAddr = addrs[addrIdx].toString();
if (logger.isDebugEnabled()) {
logger.debug(" Succeeded.");
}
break search;
} catch (IOException e) {
exception = e;
if (logger.isDebugEnabled()) {
logger.debug(" Failed.");
}
}
}
hostIdx += 1;
}
if (exception != null) {
if (logger.isDebugEnabled()) {
logger.debug("getSocket(): " +
"Unable to connect to a MyProxy host");
}
throw exception;
}
setHost(hosts[hostIdx]); // host we have successfully connected to
GssSocketFactory gssFactory = GssSocketFactory.getDefault();
GssSocket gssSocket =
(GssSocket)gssFactory.createSocket(socket,
hosts[hostIdx],
port,
this.context);
if (logger.isDebugEnabled()) {
logger.debug("getSocket(): Connected to " + goodAddr);
}
gssSocket.setAuthorization(this.authorization);
return gssSocket;
}
/**
* Delegate credentials to a MyProxy server.
*
* @param credential
* The GSI credentials to use.
* @param username
* The username to store the credentials under.
* @param passphrase
* The passphrase to use to encrypt the stored
* credentials.
* @param lifetime
* The maximum lifetime of credentials delegated by the server
* (in seconds).
* @exception MyProxyException
* If an error occurred during the operation.
*/
public void put(GSSCredential credential,
String username,
String passphrase,
int lifetime)
throws MyProxyException {
InitParams request = new InitParams();
request.setUserName(username);
request.setPassphrase(passphrase);
request.setLifetime(lifetime);
put(credential, request);
}
/**
* Delegate credentials to a MyProxy server.
*
* @param credential
* The GSI credentials to use.
* @param params
* The parameters for the put operation.
* @exception MyProxyException
* If an error occurred during the operation.
*/
public void put(GSSCredential credential,
InitParams params)
throws MyProxyException {
if (credential == null) {
throw new IllegalArgumentException("credential == null");
}
if (params == null) {
throw new IllegalArgumentException("params == null");
}
if (!(credential instanceof GlobusGSSCredentialImpl)) {
throw new IllegalArgumentException("wrong type of credentials");
}
String msg = params.makeRequest();
Socket gsiSocket = null;
OutputStream out = null;
InputStream in = null;
try {
gsiSocket = getSocket(credential);
out = gsiSocket.getOutputStream();
in = gsiSocket.getInputStream();
if (!((GssSocket)gsiSocket).getContext().getConfState())
throw new Exception("Confidentiality requested but not available");
// send message
out.write(msg.getBytes());
out.flush();
if (logger.isDebugEnabled()) {
logger.debug("Req sent:" + params);
}
handleReply(in);
BouncyCastleCertProcessingFactory certFactory =
BouncyCastleCertProcessingFactory.getDefault();
GlobusGSSCredentialImpl pkiCred =
(GlobusGSSCredentialImpl)credential;
X509Certificate [] certs = pkiCred.getCertificateChain();
// read in the cert request from socket and
// generate a certificate to be sent back to the server
X509Certificate cert =
certFactory.createCertificate(in,
certs[0],
pkiCred.getPrivateKey(),
-1,
BouncyCastleCertProcessingFactory.decideProxyType(certs[0],
GSIConstants.DelegationType.FULL));
// write the new cert we've generated to the socket to send it back
// to the server
// must put everything into one message
ByteArrayOutputStream buffer = new ByteArrayOutputStream(2048);
buffer.write( (byte)(certs.length+1) );
// write signed ceritifcate
buffer.write(cert.getEncoded());
for (int i=0;iPackage Specification
Related Documentation
For overviews, tutorials, examples, guides, and tool documentation,
please see:
JGlobus-JGlobus-Release-2.1.0/myproxy/src/test/ 0000775 0000000 0000000 00000000000 12411160572 0021274 5 ustar 00root root 0000000 0000000 JGlobus-JGlobus-Release-2.1.0/myproxy/src/test/java/ 0000775 0000000 0000000 00000000000 12411160572 0022215 5 ustar 00root root 0000000 0000000 JGlobus-JGlobus-Release-2.1.0/myproxy/src/test/java/org/ 0000775 0000000 0000000 00000000000 12411160572 0023004 5 ustar 00root root 0000000 0000000 JGlobus-JGlobus-Release-2.1.0/myproxy/src/test/java/org/globus/ 0000775 0000000 0000000 00000000000 12411160572 0024277 5 ustar 00root root 0000000 0000000 JGlobus-JGlobus-Release-2.1.0/myproxy/src/test/java/org/globus/myproxy/ 0000775 0000000 0000000 00000000000 12411160572 0026026 5 ustar 00root root 0000000 0000000 JGlobus-JGlobus-Release-2.1.0/myproxy/src/test/java/org/globus/myproxy/test/ 0000775 0000000 0000000 00000000000 12411160572 0027005 5 ustar 00root root 0000000 0000000 JGlobus-JGlobus-Release-2.1.0/myproxy/src/test/java/org/globus/myproxy/test/MyProxyTest.java 0000664 0000000 0000000 00000020501 12411160572 0032135 0 ustar 00root root 0000000 0000000 /*
* Copyright 1999-2006 University of Chicago
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package org.globus.myproxy.test;
import org.globus.myproxy.MyProxy;
import org.globus.myproxy.MyProxyException;
import org.globus.myproxy.CredentialInfo;
import org.globus.myproxy.GetParams;
import org.globus.myproxy.ChangePasswordParams;
import org.globus.myproxy.InfoParams;
import org.globus.myproxy.InitParams;
import org.globus.myproxy.StoreParams;
import org.globus.gsi.gssapi.auth.IdentityAuthorization;
import org.globus.gsi.gssapi.GlobusGSSCredentialImpl;
import org.globus.gsi.bc.BouncyCastleOpenSSLKey;
import org.globus.gsi.GlobusCredential;
import org.globus.util.TestUtil;
import junit.framework.TestCase;
import junit.framework.TestSuite;
import junit.framework.Test;
import org.gridforum.jgss.ExtendedGSSManager;
import org.ietf.jgss.GSSCredential;
import org.ietf.jgss.GSSManager;
public class MyProxyTest extends TestCase {
private static final String CONFIG =
"org/globus/myproxy/test/test.properties";
private static final String username = "testusername";
private static final String password = "123456";
private static final int lifetime = 2 * 3600;
private MyProxy myProxy;
private GSSCredential cred;
private static TestUtil util;
static {
try {
util = new TestUtil(CONFIG);
} catch (Exception e) {
e.printStackTrace();
System.exit(-1);
}
}
public MyProxyTest(String name) {
super(name);
}
public static void main (String[] args) {
junit.textui.TestRunner.run (suite());
}
public static Test suite() {
return new TestSuite(MyProxyTest.class);
}
public void setUp() throws Exception {
myProxy = new MyProxy(util.get("myproxy.host"),
util.getAsInt("myproxy.port"));
GSSManager manager = ExtendedGSSManager.getInstance();
cred = manager.createCredential(GSSCredential.INITIATE_ONLY);
String subjectDN = util.get("myproxy.subject");
if (subjectDN != null) {
myProxy.setAuthorization(new IdentityAuthorization(subjectDN));
}
}
public void testPutGet1() throws Exception {
myProxy.put(cred,
username,
password,
lifetime);
try {
myProxy.get(cred,
username,
"ascbdef",
lifetime);
fail("Did not throw exception as expected");
} catch (MyProxyException e) {
}
}
// public void testPutGet2() throws Exception {
// myProxy.put(cred,
// username,
// password,
// lifetime);
//
// GSSCredential mCred = myProxy.get(cred,
// username,
// password,
// lifetime);
// assertTrue(mCred != null);
// GlobusCredential gCred =
// ((GlobusGSSCredentialImpl)mCred).getGlobusCredential();
// assertTrue(gCred != null);
// gCred.verify();
// }
public void testDestroy() throws Exception {
myProxy.put(cred,
username,
password,
lifetime);
myProxy.destroy(cred,
username,
password);
try {
myProxy.get(cred,
username,
password,
lifetime);
fail("Did not fail as expected");
} catch (MyProxyException e) {
}
}
public void testInfo() throws Exception {
myProxy.put(cred,
username,
password,
lifetime);
CredentialInfo info = myProxy.info(cred,
username,
password);
assertTrue(info != null);
assertEquals(cred.getName().toString(),
info.getOwner());
long diff = ((info.getEndTime() - info.getStartTime())/1000) -
cred.getRemainingLifetime();
// 360 - 5 min diff in delegation plus 1 min for padding
assertTrue(diff > 0 && diff < 360);
}
public void testInfo2() throws Exception {
String credName1 = "foo";
String credDesc1 = "foo credential";
String credRetriever = "foo retriever";
String credName2 = "bar";
String credDesc2 = "bar credential";
String credRenewer = "bar renewer";
InitParams params1
= new InitParams();
params1.setUserName(username);
params1.setPassphrase(password);
params1.setLifetime(lifetime);
params1.setCredentialName(credName1);
params1.setCredentialDescription(credDesc1);
params1.setRetriever(credRetriever);
InitParams params2
= new InitParams();
params2.setUserName(username);
params2.setPassphrase(password);
params2.setLifetime(lifetime);
params2.setCredentialName(credName2);
params2.setCredentialDescription(credDesc2);
params2.setRenewer(credRenewer);
myProxy.put(cred, params1);
myProxy.put(cred, params2);
InfoParams infoParams
= new InfoParams();
infoParams.setUserName(username);
infoParams.setPassphrase(password);
CredentialInfo info[] = myProxy.info(cred, infoParams);
assertTrue(info != null);
assertTrue(info.length > 0);
boolean f1 = false;
boolean f2 = false;
for (int i=0;i
*
*/
public class CoGProperties extends Properties {
private static Log logger =
LogFactory.getLog(CoGProperties.class.getName());
private static final String DEFAULT_RANDOM_PROVIDER =
"org.bouncycastle.jce.provider.BouncyCastleProvider";
private static final String DEFAULT_RANDOM_ALGORITHM =
"DevRandom";
public static final String ENFORCE_SIGNING_POLICY =
"java.security.gsi.signing.policy";
public static final String DELEGATION_KEY_CACHE_LIFETIME =
"org.globus.jglobus.delegation.cache.lifetime";
@Deprecated
public static final String CRL_CACHE_LIFETIME =
"org.globus.jglobus.crl.cache.lifetime";
public static final String CERT_CACHE_LIFETIME =
"org.globus.jglobus.cert.cache.lifetime";
public static final String MDSHOST = "localhost";
public static final String MDSPORT = "2135";
public static final String BASEDN = "Mds-Vo-name=local, o=Grid";
final static String SOCKET_TIMEOUT = "org.globus.socket.timeout";
private static final String REVERSE_DNS_CACHETYPE = "org.globus.gsi.gssapi.cache.type";
private static final String REVERSE_DNS_CACHE_LIFETIME = "org.globus.gsi.gssapi.cache.lifetime";
final static public String NO_CACHE = "NoCache";
final static public String THREADED_CACHE = "ThreadedCache";
/** the configuration file properties are read from --
* located in ~/.globus" */
public static final String CONFIG_FILE = "cog.properties";
/** the default properties file **/
private static CoGProperties defaultProps = null;
/** the config file location **/
public static String configFile = null;
public CoGProperties() {
}
public CoGProperties(String file)
throws IOException {
load(file);
}
public synchronized static CoGProperties getDefault() {
if (defaultProps != null) {
return defaultProps;
}
defaultProps = new CoGProperties();
String file = System.getProperty("org.globus.config.file");
if (file == null) {
file = ConfigUtil.globus_dir + CONFIG_FILE;
} else if (file.equalsIgnoreCase("none")) {
return defaultProps;
}
configFile = file;
try {
defaultProps.load(configFile);
} catch(IOException e) {
logger.debug("Failed to load " + CONFIG_FILE + ". Using defaults.", e);
}
return defaultProps;
}
/**
* Sets default configuration. It can be used
* to set a different configuration dynamically.
*/
public static void setDefault(CoGProperties properties) {
defaultProps = properties;
}
public void save()
throws IOException {
save(configFile);
}
public void save(String file)
throws IOException {
OutputStream out = null;
try {
out = new FileOutputStream(file);
store(out, "Java CoG Kit Configuration File");
} finally {
if (out != null) {
try { out.close(); } catch (Exception e) {}
}
}
}
public void load(String file)
throws IOException {
FileInputStream in = null;
try {
in = new FileInputStream(file);
load(in);
} finally {
if (in != null) {
try { in.close(); } catch(Exception e) {}
}
}
}
public void load(InputStream in)
throws IOException {
super.load(in);
fixSpace(this);
}
public static void fixSpace(Properties p) {
// this will get rid off the trailing spaces
String key, value;
Enumeration e = p.keys();
while(e.hasMoreElements()) {
key = e.nextElement().toString();
value = p.getProperty(key);
p.put(key, value.trim());
}
}
/**
* Retrieves the location of the user cert file.
* It first checks the X509_USER_CERT system property. If the property
* is not set, it checks next the 'usercert' property in the current
* configuration. If that property is not set, it returns a default
* location of the user cert file. The default value
* is the 'usercert.pem' file in the user's globus directory. For example:
* ${user.home}/.globus/usercert.pem.
*
* @return String the location of the user cert file
*/
public String getUserCertFile() {
String location;
location = System.getProperty("X509_USER_CERT");
if (location != null) {
return location;
}
location = getProperty("usercert");
if (location != null) {
return location;
}
return ConfigUtil.discoverUserCertLocation();
}
public void setUserCertFile(String userCertFile) {
put("usercert", userCertFile);
}
public String getPKCS11LibraryName() {
String lib;
lib = System.getProperty("PKCS11_LIB");
if (lib != null) {
return lib;
}
lib = getProperty("pkcs11lib");
if (lib != null) {
return lib;
}
return ConfigUtil.discoverPKCS11LibName();
}
public String getDefaultPKCS11Handle() {
return getProperty("pkcs11.handle", "Globus User Credentials");
}
/**
* Retrieves the location of the user key file.
* It first checks the X509_USER_KEY system property. If the property
* is not set, it checks next the 'userkey' property in the current
* configuration. If that property is not set, it returns a default
* location of the user key file. The default value
* is the 'userkey.pem' file in the user's globus directory. For example:
* ${user.home}/.globus/userkey.pem.
*
* @return String the location of the user key file
*/
public String getUserKeyFile() {
String location;
location = System.getProperty("X509_USER_KEY");
if (location != null) {
return location;
}
location = getProperty("userkey");
if (location != null) {
return location;
}
return ConfigUtil.discoverUserKeyLocation();
}
/**
* Sets user key file location
* @param userKeyFile user key file location
*/
public void setUserKeyFile(String userKeyFile) {
put("userkey", userKeyFile);
}
/**
* Returns the user specified hostname. This is used
* for DHCP machines where java is unable to determine the
* right hostname/IP address.
* It first checks the 'GLOBUS_HOSTNAME' system property. If the property
* is not set, it checks the 'host' system property next. If the 'host'
* property is not set in the current configuration, null is returned
* (and default 'localhost' hostname will be used)
*
* @return String the hostname of the machine.
*/
public String getHostName() {
String value = System.getProperty("GLOBUS_HOSTNAME");
if (value != null) {
return value;
}
return getProperty("hostname", null);
}
/**
* Sets hostname
* @param host hostname
*/
public void setHostName(String host) {
put("hostname", host);
}
/**
* Returns the user specified ip address. This is used
* for DHCP machines where java is unable to determine the
* right IP address.
* It first checks the 'org.globus.ip' system property.
* If that property is not set, it checks next the 'ip' property
* in the current configuration. If the 'ip' property is not set in the
* current configuration, the hostname of the machine is looked up
* using the {@link #getHostName() getHostName()} function. If
* getHostName() returns a hostname that hostname is converted
* into an IP address and it is returned. Otherwise, null is returned
* (and default ip address will be used)
*
* @return String the ip address of the machine.
*/
public String getIPAddress() {
String value = System.getProperty("org.globus.ip");
if (value != null) {
return value;
}
value = getProperty("ip", null);
if (value != null) {
return value;
}
value = getHostName();
if (value != null) {
try {
return InetAddress.getByName(value).getHostAddress();
} catch (UnknownHostException e) {
return null;
}
}
return value;
}
/**
* Sets ip address
* @param ipAddress ip address
*/
public void setIPAddress(String ipAddress) {
put("ip", ipAddress);
}
/**
* Retrieves the location of the CA certificate files.
* It first checks the X509_CERT_DIR system property. If the property
* is not set, it checks next the 'cacert' property in the current
* configuration. If that property is not set, it tries to find
* the certificates using the following rules:
* First the ${user.home}/.globus/certificates directory is checked.
* If the directory does not exist, and on a Unix machine, the
* /etc/grid-security/certificates directory is checked next.
* If that directory does not exist and GLOBUS_LOCATION
* system property is set then the ${GLOBUS_LOCATION}/share/certificates
* directory is checked. Otherwise, null is returned.
* This indicates that the certificates directory could
* not be found.
*
* Moreover, this function can return multiple file and directory
* locations. The locations must be comma separated.
*
* @return String the locations of the CA certificates
*/
public String getCaCertLocations() {
String location;
location = System.getProperty("X509_CERT_DIR");
if (location != null) {
return location;
}
location = getProperty("cacert");
if (location != null) {
return location;
}
return ConfigUtil.discoverCertDirLocation();
}
public void setCaCertLocations(String list) {
put("cacert", list);
}
/**
* Retrieves the location of the proxy file.
* It first checks the X509_USER_PROXY system property. If the property
* is not set, it checks next the 'proxy' property in the current
* configuration. If that property is not set, then it defaults to a
* value based on the following rules:
* If a UID system property is set, and running on a Unix machine it
* returns /tmp/x509up_u${UID}. If any other machine then Unix, it returns
* ${tempdir}/x509up_u${UID}, where tempdir is a platform-specific
* temporary directory as indicated by the java.io.tmpdir system property.
* If a UID system property is not set, the username will be used instead
* of the UID. That is, it returns ${tempdir}/x509up_u_${username}
*
* This is done this way because Java is not able to obtain the current
* uid.
*
* @return String the location of the proxy file
*/
public String getProxyFile() {
String location;
location = System.getProperty("X509_USER_PROXY");
if (location != null) {
return location;
}
location = getProperty("proxy");
if (location != null) {
return location;
}
return ConfigUtil.discoverProxyLocation();
}
public void setProxyFile(String proxyFile) {
put("proxy", proxyFile);
}
/**
* Returns the tcp port range.
* It first checks the 'GLOBUS_TCP_PORT_RANGE' system property. If that
* system property is not set then 'org.globus.tcp.port.range' system
* property is checked. If that system property is not set then it returns
* the value specified in the configuration file. Returns null if the port
* range is not defined.
* The port range is in the following form: String the port range.
*/
public String getTcpPortRange() {
String value = null;
value = System.getProperty("GLOBUS_TCP_PORT_RANGE");
if (value != null) {
return value;
}
value = System.getProperty("org.globus.tcp.port.range");
if (value != null) {
return value;
}
return getProperty("tcp.port.range", null);
}
/**
* Returns the tcp source port range.
* It first checks the 'GLOBUS_TCP_SOURCE_PORT_RANGE' system property.
* If that system property is not set then
* 'org.globus.source.tcp.port.range' system property is checked.
* If that system property is not set then it returns
* the value specified in the configuration file. Returns null if the port
* range is not defined.
* The port range is in the following form: String the port range.
*/
public String getTcpSourcePortRange() {
String value = null;
value = System.getProperty("GLOBUS_TCP_SOURCE_PORT_RANGE");
if (value != null) {
return value;
}
value = System.getProperty("org.globus.tcp.source.port.range");
if (value != null) {
return value;
}
return getProperty("tcp.source.port.range", null);
}
/**
* Returns the udp source port range.
* It first checks the 'GLOBUS_UDP_SOURCE_PORT_RANGE' system property.
* If that system property is not set then
* 'org.globus.source.udp.port.range' system property is checked.
* If that system property is not set then it returns
* the value specified in the configuration file. Returns null if the port
* range is not defined.
* The port range is in the following form: String the port range.
*/
public String getUdpSourcePortRange() {
String value = null;
value = System.getProperty("GLOBUS_UDP_SOURCE_PORT_RANGE");
if (value != null) {
return value;
}
value = System.getProperty("org.globus.udp.source.port.range");
if (value != null) {
return value;
}
return getProperty("udp.source.port.range", null);
}
/**
* Returns whether to use the /dev/urandom device
* for seed generation.
*
* @return true if the device should be used (if available of course)
* Returns true by default unless specified otherwise by the
* user.
*/
public boolean useDevRandom() {
String value = System.getProperty("org.globus.dev.random");
if (value != null && value.equalsIgnoreCase("no")) {
return false;
}
return getAsBoolean("org.globus.dev.random", true);
}
public boolean enforceSigningPolicy() {
String value = System.getProperty(ENFORCE_SIGNING_POLICY);
if ((value != null) && (value.equalsIgnoreCase("no")
|| (value.equalsIgnoreCase("false")))) {
return false;
}
return getAsBoolean(ENFORCE_SIGNING_POLICY, true);
}
/**
* Returns the delegation key cache lifetime for all delegations from this
* JVM. If this property is not set or set to zero or less, no caching is
* done.
*
* @return the number of milliseconds the key/pair is cached
*/
public int getDelegationKeyCacheLifetime() {
int valueInt = 0;
String valueStr = System.getProperty(DELEGATION_KEY_CACHE_LIFETIME);
if (valueStr != null && valueStr.length() > 0) {
int parsedvalueInt = Integer.parseInt(valueStr);
if (parsedvalueInt > 0) {
valueInt = parsedvalueInt;
}
}
if (valueInt == -1) { // Didn't find a system property
valueStr = getProperty(DELEGATION_KEY_CACHE_LIFETIME);
if (valueStr != null && valueStr.length() > 0) {
int parsedvalueInt = Integer.parseInt(valueStr);
if (parsedvalueInt > 0) {
valueInt = parsedvalueInt;
}
}
}
return valueInt;
}
/**
* Returns the CRL cache lifetime. If this property is
* set to zero or less, no caching is done. The value is the
* number of milliseconds the CRLs are cached without checking for
* modifications on disk.
*
* Defaults to 60s.
*
* @throws NumberFormatException if the cache lifetime property
* could not be parsed
* @return the CRL cache lifetime in milliseconds
* @deprecated replaced by {@link #getCertCacheLifetime()}
*/
@Deprecated
public long getCRLCacheLifetime() {
long value = getCertCacheLifetime();
String property = getProperty(CRL_CACHE_LIFETIME);
if (property != null && property.length() > 0) {
long parsedValue = Long.parseLong(property);
if (parsedValue > 0) {
value = parsedValue;
}
}
// System property takes precedence
property = System.getProperty(CRL_CACHE_LIFETIME);
if (property != null && property.length() > 0) {
long parsedValue = Long.parseLong(property);
if (parsedValue > 0) {
value = parsedValue;
}
}
return value;
}
/**
* Returns the Cert cache lifetime. If this property is
* set to zero or less, no caching is done. The value is the
* number of milliseconds the certificates are cached without checking for
* modifications on disk.
*
* Defaults to 60s.
*
* @throws NumberFormatException if the cache lifetime property
* could not be parsed
* @return the Cert cache lifetime in milliseconds
*/
public long getCertCacheLifetime()
throws NumberFormatException {
long value = 60*1000;
String property = getProperty(CERT_CACHE_LIFETIME);
if (property != null && property.length() > 0) {
long parsedValue = Long.parseLong(property);
if (parsedValue > 0) {
value = parsedValue;
}
}
// System property takes precedence
property = System.getProperty(CERT_CACHE_LIFETIME);
if (property != null && property.length() > 0) {
long parsedValue = Long.parseLong(property);
if (parsedValue > 0) {
value = parsedValue;
}
}
return value;
}
/**
* Returns the reverse DNS cache time.
*
* Defaults to 1h.
*
* @throws NumberFormatException if the cache lifetime property
* could not be parsed
* @return the reverse DNS cache lifetime in milliseconds
*/
public long getReveseDNSCacheLifetime()
throws NumberFormatException {
long value = 60*60*1000;
String property = getProperty(REVERSE_DNS_CACHE_LIFETIME);
if (property != null && property.length() > 0) {
long parsedValue = Long.parseLong(property);
if (parsedValue > 0) {
value = parsedValue;
}
}
// System property takes precedence
property = System.getProperty(REVERSE_DNS_CACHE_LIFETIME);
if (property != null && property.length() > 0) {
long parsedValue = Long.parseLong(property);
if (parsedValue > 0) {
value = parsedValue;
}
}
return value;
}
/**
* Returns the reverse DNS cache type.
* Defaults to a threaded chache.
*
* @return the type of cache for reverse DNS requests
*/
public String getReverseDNSCacheType() {
String value = System.getProperty(REVERSE_DNS_CACHETYPE);
if (value != null) {
return value;
}
return getProperty(REVERSE_DNS_CACHETYPE, THREADED_CACHE);
}
public String getSecureRandomProvider() {
String value = System.getProperty("org.globus.random.provider");
if (value != null) {
return value;
}
return getProperty("random.provider",
DEFAULT_RANDOM_PROVIDER);
}
public String getSecureRandomAlgorithm() {
String value = System.getProperty("org.globus.random.algorithm");
if (value != null) {
return value;
}
return getProperty("random.algorithm",
DEFAULT_RANDOM_ALGORITHM);
}
/**
* Returns the timeout (in milliseconds) for sockets operations. The default
* timeout of 30 seconds (30,000 ms) is returned.
*
* @return The timeout for sockets operations. Defaults to 30 seconds.
*/
public int getSocketTimeout() {
int timeoutInt = -1; // -1 indicates it hasn't been set yet
String timeoutStr = System.getProperty(SOCKET_TIMEOUT);
if (timeoutStr != null && timeoutStr.length() > 0) {
int parsedTimeoutInt = Integer.parseInt(timeoutStr);
if (parsedTimeoutInt >= 0) {
timeoutInt = parsedTimeoutInt;
}
}
if (timeoutInt == -1) { // Didn't find a system property
timeoutStr = getProperty(SOCKET_TIMEOUT);
if (timeoutStr != null && timeoutStr.length() > 0) {
int parsedTimeoutInt = Integer.parseInt(timeoutStr);
if (parsedTimeoutInt >= 0) {
timeoutInt = parsedTimeoutInt;
}
}
}
if (timeoutInt == -1) { // Didn't find any property at all
timeoutInt = 120 * 1000;
}
return timeoutInt;
}
public void setSocketTimeout(int socketTimeout) {
put(SOCKET_TIMEOUT, String.valueOf(socketTimeout));
}
// -------------------------------------------------------
public int getProxyStrength() {
return getAsInt("proxy.strength", 512);
}
public void setProxyStrength(int strength) {
put("proxy.strength", String.valueOf(strength));
}
public int getProxyLifeTime() {
return getAsInt("proxy.lifetime", 12);
}
public void setProxyLifeTime(int lifeTimeInHours) {
put("proxy.lifetime", String.valueOf(lifeTimeInHours));
}
protected boolean getAsBoolean(String key, boolean defaultValue) {
String tmp = getProperty(key);
if (tmp == null) {
return defaultValue;
}
return (tmp.equalsIgnoreCase("yes") || tmp.equalsIgnoreCase("true"));
}
protected int getAsInt(String label, int defValue) {
String tmp = getProperty(label);
return (isNullOrEmpty(tmp)) ? defValue : Integer.parseInt(tmp);
}
protected final static boolean isNullOrEmpty(String tmp) {
return (tmp == null || (tmp != null && tmp.length() == 0));
}
}
ResourceManagerContact.java 0000664 0000000 0000000 00000010076 12411160572 0033463 0 ustar 00root root 0000000 0000000 JGlobus-JGlobus-Release-2.1.0/ssl-proxies/src/main/java/org/globus/common /*
* Copyright 1999-2010 University of Chicago
*
* Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in
* compliance with the License. You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software distributed under the License is
* distributed on an "AS IS" BASIS,WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either
* express or implied.
*
* See the License for the specific language governing permissions and limitations under the License.
*/
package org.globus.common;
import java.util.StringTokenizer;
/**
* The purpose of this class is to parse resource manager contact strings.
* It can handle literal IPv6 addresses enclosed in square brackets
* ('[' and ']').
*/
public class ResourceManagerContact {
public final static String DEFAULT_SERVICE = "/jobmanager";
public final static int DEFAULT_PORT = 2119;
protected String hostName = null;
protected int portNumber = -1;
protected String serviceName = null;
protected String globusDN = null;
/* just for the super classes */
protected ResourceManagerContact() {
}
public ResourceManagerContact(String contact) {
parse(contact);
}
protected void parse(String contact) {
char c;
int i;
i = getHostToken(contact);
if (i == -1) {
hostName = contact;
return;
}
hostName = contact.substring(0, i);
c = contact.charAt(i);
if (c == '/') {
parseService(contact, i);
} else {
int j = getToken(contact, i+1);
if (j == -1) {
portNumber = parsePort(contact.substring(i+1));
return;
}
portNumber = parsePort(contact.substring(i+1, j));
c = contact.charAt(j);
if (c == ':') {
globusDN = contact.substring(j+1);
return;
} else if (c == '/') {
parseService(contact, j);
}
}
}
private int parsePort(String port) {
if (port.length() == 0) {
return DEFAULT_PORT;
} else {
return Integer.parseInt(port);
}
}
private void parseService(String contact, int from) {
int pos = contact.indexOf(":", from);
if (pos == -1) {
serviceName = contact.substring(from);
} else {
serviceName = contact.substring(from, pos);
globusDN = contact.substring(pos+1);
}
}
private int getToken(String contact, int from) {
int len = contact.length();
char c;
int i;
for (i=from;iRelated Documentation
For overviews, tutorials, examples, guides, and tool documentation,
please see:
JGlobus-JGlobus-Release-2.1.0/ssl-proxies/src/main/java/org/globus/gsi/ 0000775 0000000 0000000 00000000000 12411160572 0025567 5 ustar 00root root 0000000 0000000 JGlobus-JGlobus-Release-2.1.0/ssl-proxies/src/main/java/org/globus/gsi/CertUtil.java 0000664 0000000 0000000 00000026524 12411160572 0030176 0 ustar 00root root 0000000 0000000 /*
* Copyright 1999-2010 University of Chicago
*
* Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in
* compliance with the License. You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software distributed under the License is
* distributed on an "AS IS" BASIS,WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either
* express or implied.
*
* See the License for the specific language governing permissions and limitations under the License.
*/
package org.globus.gsi;
import org.globus.gsi.util.CertificateIOUtil;
import org.globus.gsi.util.CertificateLoadUtil;
import org.globus.gsi.util.CertificateUtil;
import org.globus.gsi.util.ProxyCertificateUtil;
import java.security.Security;
import java.security.Provider;
import java.security.GeneralSecurityException;
import java.security.cert.CertificateEncodingException;
import java.security.cert.X509Certificate;
import java.security.cert.X509CRL;
import java.security.Principal;
import java.io.BufferedReader;
import java.io.InputStream;
import java.io.OutputStream;
import java.io.IOException;
import org.globus.util.I18n;
import org.globus.common.CoGProperties;
import org.apache.commons.logging.Log;
import org.apache.commons.logging.LogFactory;
import org.bouncycastle.jce.provider.BouncyCastleProvider;
/**
* Contains various security-related utility methods.
* @deprecated Use the various utils that are used here.
*/
public class CertUtil {
/**
* A no-op function that can be used to force the class
* to load and initialize.
*/
public static void init() {
CertificateUtil.init();
CertificateLoadUtil.init();
}
/**
* Installs SecureRandom provider.
* This function is automatically called when this class is loaded.
*/
public static void installSecureRandomProvider() {
CertificateUtil.installSecureRandomProvider();
}
/**
* Sets a provider name to use for loading certificates
* and for generating key pairs.
*
* @param providerName provider name to use.
*/
public static void setProvider(String providerName) {
CertificateUtil.setProvider(providerName);
CertificateLoadUtil.setProvider(providerName);
}
/**
* Loads a X509 certificate from the specified input stream.
* Input stream must contain DER-encoded certificate.
*
* @param in the input stream to read the certificate from.
* @return X509Certificate the loaded certificate.
* @exception GeneralSecurityException if certificate failed to load.
*/
public static X509Certificate loadCertificate(InputStream in)
throws GeneralSecurityException {
return CertificateLoadUtil.loadCertificate(in);
}
/**
* Loads an X.509 certificate from the specified file.
* The certificate file must be in PEM/Base64 format and start with
* "BEGIN CERTIFICATE" and end with "END CERTIFICATE" line.
*
* @param file the file to load the certificate from.
* @return java.security.cert.X509Certificate
* the loaded certificate.
* @exception IOException if I/O error occurs
* @exception GeneralSecurityException if security problems occurs.
*/
public static X509Certificate loadCertificate(String file)
throws IOException, GeneralSecurityException {
return CertificateLoadUtil.loadCertificate(file);
}
/**
* Loads multiple X.509 certificates from the specified file.
* Each certificate must be in PEM/Base64 format and start with
* "BEGIN CERTIFICATE" and end with "END CERTIFICATE" line.
*
* @param file the certificate file to load the certificate from.
* @return an array of certificates loaded from the file.
* @exception IOException if I/O error occurs
* @exception GeneralSecurityException if security problems occurs.
*/
public static X509Certificate[] loadCertificates(String file)
throws IOException, GeneralSecurityException {
return CertificateLoadUtil.loadCertificates(file);
}
/**
* Loads a X.509 certificate from the specified reader.
* The certificate contents must start with "BEGIN CERTIFICATE" line
* and end with "END CERTIFICATE" line, and be in PEM/Base64 format.
*
* This function does not close the input stream.
*
* @param reader the stream from which load the certificate.
* @return the loaded certificate or null if there was no certificate
* in the stream or the stream is closed.
* @exception IOException if I/O error occurs
* @exception GeneralSecurityException if security problems occurs.
*/
public static X509Certificate readCertificate(BufferedReader reader)
throws IOException, GeneralSecurityException {
return CertificateLoadUtil.readCertificate(reader);
}
/**
* Writes certificate to the specified output stream in PEM format.
*/
public static void writeCertificate(OutputStream out,
X509Certificate cert)
throws IOException, CertificateEncodingException {
CertificateIOUtil.writeCertificate(out, cert);
}
/**
* Converts DN of the form "CN=A, OU=B, O=C" into Globus
* format "/CN=A/OU=B/O=C".
* This function might return incorrect Globus-formatted ID when one of
* the RDNs in the DN contains commas.
* @see #toGlobusID(String, boolean)
*
* @param dn the DN to convert to Globus format.
* @return the converted DN in Globus format.
*/
public static String toGlobusID(String dn) {
return CertificateUtil.toGlobusID(dn);
}
/**
* Converts DN of the form "CN=A, OU=B, O=C" into Globus
* format "/CN=A/OU=B/O=C" or "/O=C/OU=B/CN=A" depending on the
* noreverse option. If noreverse is true
* the order of the DN components is not reveresed - "/CN=A/OU=B/O=C" is
* returned. If noreverse is false, the order of the
* DN components is reversed - "/O=C/OU=B/CN=A" is returned.
* This function might return incorrect Globus-formatted ID when one of
* the RDNs in the DN contains commas.
*
* @param dn the DN to convert to Globus format.
* @param noreverse the direction of the conversion.
* @return the converted DN in Globus format.
*/
public static String toGlobusID(String dn, boolean noreverse) {
return CertificateUtil.toGlobusID(dn, noreverse);
}
/**
* Converts the specified principal into Globus format.
* If the principal is of unrecognized type a simple string-based
* conversion is made using the {@link #toGlobusID(String) toGlobusID()}
* function.
*
* @see #toGlobusID(String)
*
* @param name the principal to convert to Globus format.
* @return the converted DN in Globus format.
*/
public static String toGlobusID(Principal name) {
return CertificateUtil.toGlobusID(name);
}
// proxy utilies
/**
* Determines if a specified certificate type indicates a GSI-2,
* GSI-3 or GSI-4proxy certificate.
*
* @param certType the certificate type to check.
* @return true if certType is a GSI-2 or GSI-3 or GSI-4 proxy, false
* otherwise.
*/
public static boolean isProxy(int certType) {
return ProxyCertificateUtil.isProxy(GSIConstants.CertificateType.get(certType));
}
/**
* Determines if a specified certificate type indicates a
* GSI-4 proxy certificate.
*
* @param certType the certificate type to check.
* @return true if certType is a GSI-4 proxy, false
* otherwise.
*/
public static boolean isGsi4Proxy(int certType) {
return ProxyCertificateUtil.isGsi4Proxy(GSIConstants.CertificateType.get(certType));
}
/**
* Determines if a specified certificate type indicates a
* GSI-3 proxy certificate.
*
* @param certType the certificate type to check.
* @return true if certType is a GSI-3 proxy, false
* otherwise.
*/
public static boolean isGsi3Proxy(int certType) {
return ProxyCertificateUtil.isGsi3Proxy(GSIConstants.CertificateType.get(certType));
}
/**
* Determines if a specified certificate type indicates a
* GSI-2 proxy certificate.
*
* @param certType the certificate type to check.
* @return true if certType is a GSI-2 proxy, false
* otherwise.
*/
public static boolean isGsi2Proxy(int certType) {
return ProxyCertificateUtil.isGsi2Proxy(GSIConstants.CertificateType.get(certType));
}
/**
* Determines if a specified certificate type indicates a
* GSI-2 or GSI-3 or GSI=4 limited proxy certificate.
*
* @param certType the certificate type to check.
* @return true if certType is a GSI-2 or GSI-3 or GSI-4 limited proxy,
* false otherwise.
*/
public static boolean isLimitedProxy(int certType) {
return ProxyCertificateUtil.isLimitedProxy(GSIConstants.CertificateType.get(certType));
}
/**
* Determines if a specified certificate type indicates a
* GSI-3 or GS-4 limited proxy certificate.
*
* @param certType the certificate type to check.
* @return true if certType is a GSI-3 or GSI-4 independent proxy,
* false otherwise.
*/
public static boolean isIndependentProxy(int certType) {
return ProxyCertificateUtil.isIndependentProxy(GSIConstants.CertificateType.get(certType));
}
/**
* Determines if a specified certificate type indicates a
* GSI-2 or GSI-3 or GSI-4 impersonation proxy certificate.
*
* @param certType the certificate type to check.
* @return true if certType is a GSI-2 or GSI-3 or GSI-4
* impersonation proxy, false otherwise.
*/
public static boolean isImpersonationProxy(int certType) {
return ProxyCertificateUtil.isImpersonationProxy(GSIConstants.CertificateType.get(certType));
}
/**
* Returns a string description of a specified proxy
* type.
*
* @param proxyType the proxy type to get the string
* description of.
* @return the string description of the proxy type.
*/
public static String getProxyTypeAsString(int proxyType) {
return ProxyCertificateUtil.getProxyTypeAsString(GSIConstants.CertificateType.get(proxyType));
}
/**
* Checks if GSI-3 mode is enabled.
*
* @return true if "org.globus.gsi.version" system property
* is set to "3". Otherwise, false.
*/
public static boolean isGsi3Enabled() {
return VersionUtil.isGsi3Enabled();
}
/**
* Checks if GSI-2 mode is enabled.
*
* @return true if "org.globus.gsi.version" system property
* is set to "2". Otherwise, false.
*/
public static boolean isGsi2Enabled() {
return VersionUtil.isGsi2Enabled();
}
// CRL Utilities JGLOBUS-91
public static X509CRL loadCrl(String file)
throws IOException, GeneralSecurityException {
return CertificateLoadUtil.loadCrl(file);
}
public static X509CRL loadCrl(InputStream in)
throws GeneralSecurityException {
return CertificateLoadUtil.loadCrl(in);
}
}
CertificateRevocationLists.java 0000664 0000000 0000000 00000017673 12411160572 0033664 0 ustar 00root root 0000000 0000000 JGlobus-JGlobus-Release-2.1.0/ssl-proxies/src/main/java/org/globus/gsi /*
* Copyright 1999-2010 University of Chicago
*
* Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in
* compliance with the License. You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software distributed under the License is
* distributed on an "AS IS" BASIS,WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either
* express or implied.
*
* See the License for the specific language governing permissions and limitations under the License.
*/
package org.globus.gsi;
import org.globus.gsi.stores.ResourceCertStoreParameters;
import org.globus.gsi.stores.Stores;
import org.globus.gsi.provider.GlobusProvider;
import javax.security.auth.x500.X500Principal;
import java.security.cert.X509CRLSelector;
import java.security.cert.CertStore;
import java.security.cert.X509CRL;
import java.util.Map;
import java.util.Collection;
import java.util.ArrayList;
import java.util.HashMap;
import java.util.LinkedList;
import java.util.ListIterator;
import java.util.StringTokenizer;
import java.io.File;
import org.globus.common.CoGProperties;
import org.apache.commons.logging.Log;
import org.apache.commons.logging.LogFactory;
// COMMENT: what should be used instead? Probably a cert-store. but that doesn't have a refresh or such
// COMMENT: We lost the functionality that stuff is only loaded when it didnt' exist or changed
/**
* @deprecated
*/
public class CertificateRevocationLists {
static {
new ProviderLoader();
}
private static Log logger =
LogFactory.getLog(CertificateRevocationLists.class.getName());
// the list of ca cert locations needed for getDefaultCRL call
private static String prevCaCertLocations = null;
// the default crl locations list derived from prevCaCertLocations
private static String defaultCrlLocations = null;
private static CertificateRevocationLists defaultCrl = null;
private volatile MapX509Certificate the identity cert. Null, if unable to get the identity certificate
* (an error occurred)
*/
public X509Certificate getIdentityCertificate() {
return cred.getIdentityCertificate();
}
/**
* Returns the path length constraint. The shortest length in the chain of certificates is returned as the
* credential's path length.
*
* @return The path length constraint of the credential. -1 is any error occurs.
*/
public int getPathConstraint() {
return cred.getPathConstraint();
}
/**
* Returns the identity of this credential.
*
* @see #getIdentityCertificate()
*
* @return The identity cert in Globus format (e.g. /C=US/..). Null, if unable to get the identity (an
* error occurred)
*/
public String getIdentity() {
return cred.getIdentity();
}
/**
* Returns the private key of this credential.
*
* @return PrivateKey the private key
*/
public PrivateKey getPrivateKey() {
try {
return (PrivateKey) cred.getPrivateKey();
} catch (Exception e) {
return null;
}
}
/**
* Returns the certificate chain of this credential.
*
* @return X509Certificate [] the certificate chain
*/
public X509Certificate[] getCertificateChain() {
return cred.getCertificateChain();
}
/**
* Returns the number of certificates in the credential without the self-signed certificates.
*
* @return number of certificates without counting self-signed certificates
*/
public int getCertNum() {
return cred.getCertNum();
}
/**
* Returns strength of the private/public key in bits.
*
* @return strength of the key in bits. Returns -1 if unable to determine it.
*/
public int getStrength() {
try {
return cred.getStrength();
} catch (Exception e) {
return -1;
}
}
/**
* Returns the subject DN of the first certificate in the chain.
*
* @return subject DN.
*/
public String getSubject() {
return cred.getSubject();
}
/**
* Returns the issuer DN of the first certificate in the chain.
*
* @return issuer DN.
*/
public String getIssuer() {
return cred.getIssuer();
}
/**
* Returns the certificate type of the first certificate in the chain. Returns -1 if unable to determine
* the certificate type (an error occurred)
*
* @see BouncyCastleUtil#getCertificateType(X509Certificate)
*
* @return the type of first certificate in the chain. -1 if unable to determine the certificate type.
*/
public int getProxyType() {
return cred.getProxyType().getCode();
}
/**
* Returns time left of this credential. The time left of the credential is based on the certificate with
* the shortest validity time.
*
* @return time left in seconds. Returns 0 if the certificate has expired.
*/
public long getTimeLeft() {
return cred.getTimeLeft();
}
/**
* Returns the default credential. The default credential is usually the user proxy certificate.
* The credential will be loaded on the initial call. It must not be expired. All subsequent calls to this
* function return cached credential object. Once the credential is cached, and the underlying file
* changes, the credential will be reloaded.
*
* @return the default credential.
* @exception GlobusCredentialException
* if the credential expired or some other error with the credential.
*/
public synchronized static GlobusCredential getDefaultCredential() throws GlobusCredentialException {
if (defaultCred == null) {
reloadDefaultCredential();
} else if (!credentialSet) {
if (credentialFile.lastModified() == credentialLastModified) {
defaultCred.verify();
} else {
defaultCred = null;
reloadDefaultCredential();
}
}
return defaultCred;
}
private static void reloadDefaultCredential()
throws GlobusCredentialException {
String proxyLocation = CoGProperties.getDefault().getProxyFile();
defaultCred = new GlobusCredential(proxyLocation);
credentialFile = new File(proxyLocation);
credentialLastModified = credentialFile.lastModified();
defaultCred.verify();
}
/**
* Sets default credential.
*
* @param cred
* the credential to set a default.
*/
public synchronized static void setDefaultCredential(GlobusCredential cred) {
credentialSet = (cred != null);
}
public String toString() {
return cred.toString();
}
}
GlobusCredentialException.java 0000664 0000000 0000000 00000004174 12411160572 0033466 0 ustar 00root root 0000000 0000000 JGlobus-JGlobus-Release-2.1.0/ssl-proxies/src/main/java/org/globus/gsi /*
* Copyright 1999-2010 University of Chicago
*
* Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in
* compliance with the License. You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software distributed under the License is
* distributed on an "AS IS" BASIS,WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either
* express or implied.
*
* See the License for the specific language governing permissions and limitations under the License.
*/
package org.globus.gsi;
import java.text.MessageFormat;
import java.util.ResourceBundle;
import java.util.MissingResourceException;
/**
* Encapsulates the exceptions caused
* by various errors in/problems with Globus proxies.
*/
public class GlobusCredentialException extends Exception {
public static final int FAILURE = -1;
public static final int EXPIRED = 1;
public static final int DEFECTIVE = 2;
public static final int IO_ERROR = 3;
public static final int SEC_ERROR = 3;
private static ResourceBundle resources;
static {
try {
resources = ResourceBundle.getBundle("org.globus.gsi.errors");
} catch (MissingResourceException e) {
throw new RuntimeException(e.getMessage());
}
}
private int errorCode = FAILURE;
public GlobusCredentialException(int errorCode,
String msgId,
Throwable root) {
this(errorCode, msgId, null, root);
}
public GlobusCredentialException(int errorCode,
String msgId,
Object [] args) {
this(errorCode, msgId, args, null);
}
public GlobusCredentialException(int errorCode,
String msgId,
Object [] args,
Throwable root) {
super(getMessage(msgId, args), root);
this.errorCode = errorCode;
}
public int getErrorCode() {
return this.errorCode;
}
private static String getMessage(String msgId, Object[] args) {
try {
return MessageFormat.format(resources.getString(msgId), args);
} catch (MissingResourceException e) {
throw new RuntimeException(msgId);
}
}
}
JGlobus-JGlobus-Release-2.1.0/ssl-proxies/src/main/java/org/globus/gsi/OpenSSLKey.java 0000664 0000000 0000000 00000046122 12411160572 0030373 0 ustar 00root root 0000000 0000000 /*
* Copyright 1999-2010 University of Chicago
*
* Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in
* compliance with the License. You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software distributed under the License is
* distributed on an "AS IS" BASIS,WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either
* express or implied.
*
* See the License for the specific language governing permissions and limitations under the License.
*/
package org.globus.gsi;
import org.globus.gsi.util.FileUtil;
import org.globus.gsi.util.PEMUtil;
import java.io.BufferedReader;
import java.io.ByteArrayOutputStream;
import java.io.File;
import java.io.FileOutputStream;
import java.io.FileReader;
import java.io.IOException;
import java.io.InputStream;
import java.io.InputStreamReader;
import java.io.ObjectInputStream;
import java.io.ObjectOutputStream;
import java.io.OutputStream;
import java.io.PrintWriter;
import java.io.Reader;
import java.io.Serializable;
import java.io.Writer;
import java.security.GeneralSecurityException;
import java.security.InvalidKeyException;
import java.security.Key;
import java.security.MessageDigest;
import java.security.PrivateKey;
import java.security.SecureRandom;
import java.util.StringTokenizer;
import javax.crypto.Cipher;
import javax.crypto.spec.IvParameterSpec;
import javax.crypto.spec.SecretKeySpec;
import org.bouncycastle.util.Arrays;
import org.bouncycastle.util.encoders.Base64;
/**
* Represents a OpenSSL-style PEM-formatted private key. It supports encryption and decryption of the key. Currently,
* only RSA keys are supported, and only TripleDES encryption is supported.
*
* This is based on work done by Ming Yung at DSTC.
*
* @version ${version}
* @since 1.0
*/
public abstract class OpenSSLKey implements Serializable {
private static final String HEADER = "-----BEGIN RSA PRIVATE KEY-----";
/* Key algorithm: RSA, DSA */
private String keyAlg;
/* Current state of this key class */
private boolean isEncrypted;
// base64 encoded key value
private byte[] encodedKey;
private PrivateKey intKey;
private byte[] ivData;
private transient IvParameterSpec initializationVector;
/*
* String representation of the encryption algorithm:
* DES-EDE3-CBC, AES-256-CBC, etc.
*/
private String encAlgStr;
/*
* Java string representation of the encryption algorithm:
* DES, DESede, AES.
*/
private String encAlg;
private int keyLength = -1;
private int ivLength = -1;
// ASN.1 encoded key value
private byte[] keyData;
/**
* Reads a OpenSSL private key from the specified input stream.
* The private key must be PEM encoded and can be encrypted.
*
* @param is input stream with OpenSSL key in PEM format.
* @throws IOException if I/O problems.
* @throws GeneralSecurityException if problems with the key
*/
public OpenSSLKey(InputStream is) throws IOException, GeneralSecurityException {
InputStreamReader isr = new InputStreamReader(is);
try {
readPEM(isr);
} finally {
isr.close();
}
}
/**
* Reads a OpenSSL private key from the specified file.
* The private key must be PEM encoded and can be encrypted.
*
* @param file file containing the OpenSSL key in PEM format.
* @throws IOException if I/O problems.
* @throws GeneralSecurityException if problems with the key
*/
public OpenSSLKey(String file) throws IOException, GeneralSecurityException {
FileReader f = new FileReader(file);
try {
readPEM(f);
} finally {
f.close();
}
}
/**
* Converts a RSAPrivateCrtKey into OpenSSL key.
*
* @param key private key - must be a RSAPrivateCrtKey
*/
public OpenSSLKey(PrivateKey key) {
this.intKey = key;
this.isEncrypted = false;
this.keyData = getEncoded(key);
this.encodedKey = null;
}
/**
* Initializes the OpenSSL key from raw byte array.
*
* @param algorithm the algorithm of the key. Currently only RSA algorithm is supported.
* @param data the DER encoded key data. If RSA algorithm, the key must be in PKCS#1 format.
* @throws GeneralSecurityException if any security problems.
*/
public OpenSSLKey(String algorithm, byte[] data) throws GeneralSecurityException {
if (data == null) {
throw new IllegalArgumentException("Data is null");
}
this.keyData = new byte[data.length];
System.arraycopy(data, 0, this.keyData, 0, data.length);
this.isEncrypted = false;
this.intKey = getKey(algorithm, data);
}
protected byte[] getEncoded() {
return this.keyData;
}
private void readPEM(Reader rd) throws IOException, GeneralSecurityException {
StringBuilder builder = new StringBuilder();
BufferedReader in = new BufferedReader(rd);
try {
parseKeyAlgorithm(in);
builder.append(extractEncryptionInfo(in));
builder.append(extractKey(in));
} finally {
in.close();
}
this.encodedKey = builder.toString().getBytes();
if (isEncrypted()) {
this.keyData = null;
} else {
this.keyData = Base64.decode(encodedKey);
this.intKey = getKey(keyAlg, keyData);
}
}
private String extractKey(BufferedReader in) throws IOException {
StringBuilder builder = new StringBuilder();
String next = in.readLine();
while (next != null) {
if (next.startsWith("-----END")) {
break;
}
builder.append(next);
next = in.readLine();
}
return builder.toString();
}
private String extractEncryptionInfo(BufferedReader in) throws IOException, GeneralSecurityException {
StringBuilder sb = new StringBuilder();
String next = in.readLine();
if (next != null && next.startsWith("Proc-Type: 4,ENCRYPTED")) {
this.isEncrypted = true;
next = in.readLine();
if (next != null) {
parseEncryptionInfo(next);
}
in.readLine();
} else {
this.isEncrypted = false;
sb.append(next);
}
return sb.toString();
}
private void parseKeyAlgorithm(BufferedReader in) throws IOException, InvalidKeyException {
String next = in.readLine();
while (next != null) {
if (next.indexOf("PRIVATE KEY") != -1) {
keyAlg = getKeyAlgorithm(next);
break;
}
next = in.readLine();
}
if (next == null) {
throw new InvalidKeyException("noPrivateKey");
}
if (keyAlg == null) {
throw new InvalidKeyException("algNotSup");
}
}
/**
* Check if the key was encrypted or not.
*
* @return true if the key is encrypted, false
* otherwise.
*/
public boolean isEncrypted() {
return this.isEncrypted;
}
/**
* Decrypts the private key with given password.
* Does nothing if the key is not encrypted.
*
* @param password password to decrypt the key with.
* @throws GeneralSecurityException whenever an error occurs during decryption.
*/
public void decrypt(String password) throws GeneralSecurityException {
decrypt(password.getBytes());
}
/**
* Decrypts the private key with given password.
* Does nothing if the key is not encrypted.
*
* @param password password to decrypt the key with.
* @throws GeneralSecurityException whenever an error occurs during decryption.
*/
public void decrypt(byte[] password) throws GeneralSecurityException {
if (!isEncrypted()) {
return;
}
byte[] enc = Base64.decode(this.encodedKey);
SecretKeySpec key = getSecretKey(password, this.initializationVector.getIV());
Cipher cipher = getCipher();
cipher.init(Cipher.DECRYPT_MODE, key, this.initializationVector);
enc = cipher.doFinal(enc);
this.intKey = getKey(this.keyAlg, enc);
this.keyData = enc;
this.isEncrypted = false;
this.encodedKey = null;
}
/**
* Encrypts the private key with given password.
* Does nothing if the key is encrypted already.
*
* @param password password to encrypt the key with.
* @throws GeneralSecurityException whenever an error occurs during encryption.
*/
public void encrypt(String password) throws GeneralSecurityException {
encrypt(password.getBytes());
}
/**
* Encrypts the private key with given password.
* Does nothing if the key is encrypted already.
*
* @param password password to encrypt the key with.
* @throws GeneralSecurityException whenever an error occurs during encryption.
*/
public void encrypt(byte[] password) throws GeneralSecurityException {
if (isEncrypted()) {
return;
}
if (this.encAlg == null) {
setEncryptionAlgorithm("DES-EDE3-CBC");
}
if (this.ivData == null) {
generateIV();
}
Key key = getSecretKey(password, this.initializationVector.getIV());
Cipher cipher = getCipher();
cipher.init(Cipher.ENCRYPT_MODE, key, this.initializationVector);
/* encrypt the raw PKCS11 */
this.keyData = cipher.doFinal(getEncoded(this.intKey));
this.isEncrypted = true;
this.encodedKey = null;
}
/**
* Sets algorithm for encryption.
*
* @param alg algorithm for encryption
* @throws GeneralSecurityException if algorithm is not supported
*/
public void setEncryptionAlgorithm(String alg) throws GeneralSecurityException {
setAlgorithmSettings(alg);
}
/**
* Returns the JCE (RSAPrivateCrtKey) key.
*
* @return the private key, null if the key
* was not decrypted yet.
*/
public PrivateKey getPrivateKey() {
return this.intKey;
}
/**
* Writes the private key to the specified output stream in PEM
* format. If the key was encrypted it will be encoded as an encrypted
* RSA key. If not, it will be encoded as a regular RSA key.
*
* @param output output stream to write the key to.
* @throws IOException if I/O problems writing the key
*/
public void writeTo(OutputStream output) throws IOException {
output.write(toPEM().getBytes());
}
/**
* Writes the private key to the specified writer in PEM format.
* If the key was encrypted it will be encoded as an encrypted
* RSA key. If not, it will be encoded as a regular RSA key.
*
* @param w writer to output the key to.
* @throws IOException if I/O problems writing the key
*/
public void writeTo(Writer w) throws IOException {
w.write(toPEM());
}
/**
* Writes the private key to the specified file in PEM format.
* If the key was encrypted it will be encoded as an encrypted
* RSA key. If not, it will be encoded as a regular RSA key.
*
* @param file file to write the key to.
* @throws IOException if I/O problems writing the key
*/
public void writeTo(String file) throws IOException {
File privateKey = FileUtil.createFile(file);
// JGLOBUS-96
try{
privateKey.setReadable(false, true);//setOwnerAccessOnly(file);
privateKey.setWritable(false, true);//setOwnerAccessOnly(file);
}catch(SecurityException e){
}
PrintWriter p = new PrintWriter(new FileOutputStream(privateKey));
try {
p.write(toPEM());
} finally {
p.close();
}
}
/*
* Returns DER encoded byte array (PKCS#1).
*/
protected abstract byte[] getEncoded(PrivateKey key);
/*
* Returns PrivateKey object initialized from give byte array (in PKCS#1 format)
*/
protected abstract PrivateKey getKey(String alg, byte[] data) throws GeneralSecurityException;
protected String getProvider() {
return null;
}
private Cipher getCipher() throws GeneralSecurityException {
String provider = getProvider();
if (provider == null) {
return Cipher.getInstance(this.encAlg + "/CBC/PKCS5Padding");
} else {
return Cipher.getInstance(this.encAlg + "/CBC/PKCS5Padding",
provider);
}
}
private String getKeyAlgorithm(String line) {
if (line.contains("RSA")) {
return "RSA";
} else if (line.contains("DSA")) {
return "DSA";
} else {
return null;
}
}
private void parseEncryptionInfo(String line) throws GeneralSecurityException {
// TODO: can make this better
String keyInfo = line.substring(10);
StringTokenizer tknz = new StringTokenizer(keyInfo, ",", false);
// set algorithm settings
setAlgorithmSettings(tknz.nextToken());
// set IV
setIV(tknz.nextToken());
}
private void setAlgorithmSettings(String alg) throws GeneralSecurityException {
if (alg.equals("DES-EDE3-CBC")) {
this.encAlg = "DESede";
this.keyLength = OpenSSLKeyConstants.DES_EDE3_CBC_KEY_LENGTH;
this.ivLength = OpenSSLKeyConstants.DES_EDE3_CBC_IV_LENGTH;
} else if (alg.equals("AES-128-CBC")) {
this.encAlg = "AES";
this.keyLength = OpenSSLKeyConstants.AES_128_CBC_KEY_LENGTH;
this.ivLength = OpenSSLKeyConstants.AES_128_CBC_IV_LENGTH;
} else if (alg.equals("AES-192-CBC")) {
this.encAlg = "AES";
this.keyLength = OpenSSLKeyConstants.AES_192_CBC_KEY_LENGTH;
this.ivLength = OpenSSLKeyConstants.AES_192_CBC_IV_LENGTH;
} else if (alg.equals("AES-256-CBC")) {
this.encAlg = "AES";
this.keyLength = OpenSSLKeyConstants.AES_256_CBC_KEY_LENGTH;
this.ivLength = OpenSSLKeyConstants.AES_256_CBC_IV_LENGTH;
} else if (alg.equals("DES-CBC")) {
this.encAlg = "DES";
this.keyLength = OpenSSLKeyConstants.DES_CBC_KEY_LENGTH;
this.ivLength = OpenSSLKeyConstants.DES_CBC_IV_LENGTH;
} else {
throw new GeneralSecurityException("unsupported Enc algorithm " + alg);
}
this.encAlgStr = alg;
}
private void setIV(String s) throws GeneralSecurityException {
int len = s.length() / 2;
if (len != this.ivLength) {
String err = "ivLength";
//JGLOBUS-91
throw new GeneralSecurityException(err);
}
byte[] ivBytes = new byte[len];
for (int j = 0; j < len; j++) {
ivBytes[j] = (byte) Integer.parseInt(s.substring(j * 2, j * 2 + 2), 16);
}
setIV(ivBytes);
}
private void generateIV() {
byte[] b = new byte[this.ivLength];
SecureRandom sr = new SecureRandom(); //.getInstance("PRNG");
sr.nextBytes(b);
setIV(b);
}
private void setIV(byte[] data) {
ivData = data;
initializationVector = new IvParameterSpec(data);
}
private SecretKeySpec getSecretKey(byte[] pwd, byte[] keyInitializationVector) throws GeneralSecurityException {
byte[] key = new byte[this.keyLength];
int offset = 0;
int bytesNeeded = this.keyLength;
MessageDigest md5 = MessageDigest.getInstance("MD5");
while (true) {
md5.update(pwd);
md5.update(keyInitializationVector, 0, 8);
byte[] b = md5.digest();
int len = (bytesNeeded > b.length) ? b.length : bytesNeeded;
System.arraycopy(b, 0, key, offset, len);
offset += len;
// check if we need any more
bytesNeeded = key.length - offset;
if (bytesNeeded == 0) {
break;
}
// do another round
md5.reset();
md5.update(b);
}
return new SecretKeySpec(key, this.encAlg);
}
// -------------------------------------------
/*
* Converts to PEM encoding.
* Assumes keyData is initialized.
*/
private String toPEM() {
byte[] data = (this.keyData == null) ? this.encodedKey : Base64.encode(this.keyData);
String header = HEADER;
if (isEncrypted()) {
StringBuffer buf = new StringBuffer(header);
buf.append(PEMUtil.LINE_SEP);
buf.append("Proc-Type: 4,ENCRYPTED");
buf.append(PEMUtil.LINE_SEP);
buf.append("DEK-Info: ").append(this.encAlgStr);
buf.append(",").append(PEMUtil.toHex(initializationVector.getIV()));
buf.append(PEMUtil.LINE_SEP);
header = buf.toString();
}
ByteArrayOutputStream out = new ByteArrayOutputStream();
try {
PEMUtil.writeBase64(out,
header,
data,
"-----END RSA PRIVATE KEY-----");
} catch (IOException e) {
// JGLOBUS-91
throw new RuntimeException("Unexpected error", e);
}
return new String(out.toByteArray());
}
private void readObject(ObjectInputStream s) throws IOException, ClassNotFoundException {
s.defaultReadObject();
if(ivData != null) {
initializationVector = new IvParameterSpec(ivData);
}
}
@Override
public boolean equals(Object other) {
if(other == this) {
return true;
}
if(!(other instanceof OpenSSLKey)) {
return false;
}
OpenSSLKey otherKey = (OpenSSLKey) other;
return this.isEncrypted == otherKey.isEncrypted &&
objectsEquals(this.keyAlg, otherKey.keyAlg) &&
Arrays.areEqual(this.encodedKey, otherKey.encodedKey) &&
objectsEquals(this.intKey, otherKey.intKey) &&
Arrays.areEqual(this.ivData, otherKey.ivData) &&
objectsEquals(this.encAlgStr, otherKey.encAlgStr) &&
objectsEquals(this.encAlg, otherKey.encAlg) &&
Arrays.areEqual(this.keyData, otherKey.keyData);
}
// Equivalent to Java 7 Objects#equals method; may be replaced when
// Java 7 is adopted
private static boolean objectsEquals(Object a, Object b) {
return (a == b) || (a != null && a.equals(b));
}
@Override
public int hashCode() {
return (isEncrypted ? 1 : 0) ^
(keyAlg == null ? 0 : keyAlg.hashCode()) ^
(encodedKey == null ? 0 : encodedKey.hashCode()) ^
(intKey == null ? 0 : intKey.hashCode()) ^
(ivData == null ? 0 : ivData.hashCode()) ^
(encAlgStr == null ? 0 : encAlgStr.hashCode()) ^
(encAlg == null ? 0 : encAlg.hashCode()) ^
(keyData == null ? 0 : keyData.hashCode());
}
}
JGlobus-JGlobus-Release-2.1.0/ssl-proxies/src/main/java/org/globus/gsi/OpenSSLKeyConstants.java 0000664 0000000 0000000 00000002705 12411160572 0032267 0 ustar 00root root 0000000 0000000 /*
* Copyright 1999-2010 University of Chicago
*
* Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in
* compliance with the License. You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software distributed under the License is
* distributed on an "AS IS" BASIS,WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either
* express or implied.
*
* See the License for the specific language governing permissions and limitations under the License.
*/
package org.globus.gsi;
/**
* Created by IntelliJ IDEA.
* User: turtlebender
* Date: Jan 21, 2010
* Time: 10:32:19 AM
* To change this template use File | Settings | File Templates.
*/
public final class OpenSSLKeyConstants {
public static final int DES_EDE3_CBC_KEY_LENGTH = 24;
public static final int DES_EDE3_CBC_IV_LENGTH = 8;
public static final int AES_128_CBC_KEY_LENGTH = 16;
public static final int AES_128_CBC_IV_LENGTH = 16;
public static final int AES_192_CBC_KEY_LENGTH = 24;
public static final int AES_192_CBC_IV_LENGTH = 16;
public static final int AES_256_CBC_KEY_LENGTH = 32;
public static final int AES_256_CBC_IV_LENGTH = 16;
public static final int DES_CBC_KEY_LENGTH = 8;
public static final int DES_CBC_IV_LENGTH = 8;
private OpenSSLKeyConstants() {
//should not be instantiated;
}
}
JGlobus-JGlobus-Release-2.1.0/ssl-proxies/src/main/java/org/globus/gsi/ProviderLoader.java 0000664 0000000 0000000 00000000514 12411160572 0031353 0 ustar 00root root 0000000 0000000 package org.globus.gsi;
import org.globus.gsi.provider.GlobusProvider;
import java.security.Security;
public class ProviderLoader {
private GlobusProvider provider;
public ProviderLoader(){
provider = new GlobusProvider();
Security.addProvider(provider);
}
public GlobusProvider getProvider(){
return provider;
}
}
JGlobus-JGlobus-Release-2.1.0/ssl-proxies/src/main/java/org/globus/gsi/SigningPolicy.java 0000664 0000000 0000000 00000011071 12411160572 0031210 0 ustar 00root root 0000000 0000000 /*
* Copyright 1999-2010 University of Chicago
*
* Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in
* compliance with the License. You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software distributed under the License is
* distributed on an "AS IS" BASIS,WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either
* express or implied.
*
* See the License for the specific language governing permissions and limitations under the License.
*/
package org.globus.gsi;
import org.globus.gsi.util.CertificateUtil;
import java.util.List;
import java.util.Vector;
import java.util.regex.Matcher;
import java.util.regex.Pattern;
import javax.security.auth.x500.X500Principal;
import org.globus.gsi.SigningPolicyParser;
/**
* Represents a signing policy associated with a particular CA. The signing policy defines a list of distinguished
* names which are allowed to sign certificates for a particular Certificate Authority subject distinguished name.
*
* @version ${version}
* @since 1.0
*/
// COMMENT: BCB: new method signatures
public class SigningPolicy {
private X500Principal caSubject;
private Listjava.security.cert.X509Certificate an array
* of loaded certificates
*/
public static X509Certificate[] loadCertificates(String locations) {
TrustedCertificates tc = TrustedCertificates.load(locations);
return (tc == null) ? null : tc.getCertificates();
}
public static TrustedCertificates load(String locations) {
TrustedCertificates tc = new TrustedCertificates();
tc.reload(locations);
return tc;
}
public static FilenameFilter getCertFilter() {
return certFileFilter;
}
public static class CertFilter implements FilenameFilter {
public boolean accept(File dir, String file) {
int length = file.length();
if (length > 2 &&
file.charAt(length-2) == '.' &&
file.charAt(length-1) >= '0' &&
file.charAt(length-1) <= '9') return true;
return false;
}
}
public synchronized void reload(String locations) {
if (locations == null) {
return;
}
this.changed = false;
StringTokenizer tokens = new StringTokenizer(locations, ",");
File caDir = null;
Map newCertSubjectDNMap = new HashMap();
Map newSigningDNMap = new HashMap();
while(tokens.hasMoreTokens()) {
caDir = new File(tokens.nextToken().toString().trim());
if (!caDir.canRead()) {
logger.debug("Cannot read: " + caDir.getAbsolutePath());
continue;
}
String caCertLocation = "file:" + caDir.getAbsolutePath();
// String sigPolPattern = caCertLocation + "/*.signing_policy";
// if (!caDir.isDirectory()) {
// sigPolPattern = getPolicyFileName(caCertLocation);
// }
try {
ms_trustStore = Stores.getTrustStore(caCertLocation + "/" + Stores.getDefaultCAFilesPattern());
Collection caCerts = KeyStoreUtil.getTrustedCertificates(ms_trustStore, new X509CertSelector());
Iterator iter = caCerts.iterator();
while (iter.hasNext()) {
X509Certificate cert = (X509Certificate) iter.next();
if (!newCertSubjectDNMap.containsKey(cert.getSubjectDN().toString()))
newCertSubjectDNMap.put(cert.getSubjectDN().toString(), cert);
}
} catch (Exception e) {
logger.warn("Failed to create trust store",e);
}
try {
ms_sigPolStore = Stores.getSigningPolicyStore(caCertLocation + "/" + Stores.getDefaultSigningPolicyFilesPattern());
} catch (GeneralSecurityException e) {
logger.warn("Failed to create signing_policy store",e);
}
try {
ms_sigPolStore = Stores.getSigningPolicyStore(caCertLocation+ "/" + Stores.getDefaultSigningPolicyFilesPattern());
Collection caCerts = KeyStoreUtil.getTrustedCertificates(ms_trustStore, new X509CertSelector());
Iterator iter = caCerts.iterator();
while (iter.hasNext()) {
X509Certificate cert = (X509Certificate) iter.next();
X500Principal principal = cert.getSubjectX500Principal();
if (!newCertSubjectDNMap.containsKey(cert.getSubjectDN().toString())) {
continue;
}
SigningPolicy policy;
try {
policy = ms_sigPolStore.getSigningPolicy(principal);
} catch (Exception e) {
if (!invalidPolicies.contains(principal)) {
logger.warn("Invalid signing policy for CA certificate; skipping");
logger.debug("Invalid signing policy for CA certificate; skipping",e);
invalidPolicies.add(principal);
}
continue;
}
if (policy != null) {
newSigningDNMap.put(CertificateUtil.toGlobusID(policy.getCASubjectDN()), policy);
} else {
if (!invalidPolicies.contains(principal)) {
logger.warn("no signing policy for ca cert " + cert.getSubjectDN());
invalidPolicies.add(principal);
}
}
}
} catch (Exception e) {
logger.warn("Failed to create signing policy store",e);
}
}
this.changed = true;
this.certSubjectDNMap = newCertSubjectDNMap;
this.policyDNMap = newSigningDNMap;
if (this.changed) {
this.certList = null;
}
}
/**
* Signing policy name is created as X509Certificate the identity cert. Null, if unable to get the identity certificate
* (an error occurred)
*/
public X509Certificate getIdentityCertificate() {
try {
return BouncyCastleUtil.getIdentityCertificate(this.certChain);
} catch (CertificateException e) {
logger.debug("Error getting certificate identity.", e);
return null;
}
}
/**
* Returns the path length constraint. The shortest length in the chain of
* certificates is returned as the credential's path length.
*
* @return The path length constraint of the credential. -1 is any error
* occurs.
*/
public int getPathConstraint() {
int pathLength = Integer.MAX_VALUE;
try {
for (int i=0; iCertPathParameters. Changes to the copy
* will not affect the original and vice versa.
*
* @return a copy of this CertPathParameters
*/
public Object clone() {
try {
return super.clone();
} catch (CloneNotSupportedException e) {
throw new InternalError(e.toString());
}
}
}
X509ProxyCertPathValidatorResult.java 0000664 0000000 0000000 00000003733 12411160572 0034570 0 ustar 00root root 0000000 0000000 JGlobus-JGlobus-Release-2.1.0/ssl-proxies/src/main/java/org/globus/gsi /*
* Copyright 1999-2010 University of Chicago
*
* Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in
* compliance with the License. You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software distributed under the License is
* distributed on an "AS IS" BASIS,WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either
* express or implied.
*
* See the License for the specific language governing permissions and limitations under the License.
*/
package org.globus.gsi;
import java.security.cert.CertPathValidatorResult;
import java.security.cert.X509Certificate;
/**
* FILL ME
*
* @author ranantha@mcs.anl.gov
*/
public class X509ProxyCertPathValidatorResult implements CertPathValidatorResult {
private X509Certificate idenX509Certificate;
private boolean limited;
public X509ProxyCertPathValidatorResult(
X509Certificate initIdentityCertificate) {
this(initIdentityCertificate, false);
}
public X509ProxyCertPathValidatorResult(
X509Certificate initIdentityCertificate, boolean initLimited) {
if (initIdentityCertificate != null) {
this.idenX509Certificate = initIdentityCertificate;
}
this.limited = initLimited;
}
public X509Certificate getIdentityCertificate() {
return this.idenX509Certificate;
}
public boolean isLimited() {
return this.limited;
}
/**
* Makes a copy of this CertPathValidatorResult. Changes to the
* copy will not affect the original and vice versa.
*
* @return a copy of this CertPathValidatorResult
*/
public Object clone() {
try {
return super.clone();
} catch (CloneNotSupportedException e) {
/* Cannot happen */
throw new RuntimeException(e.getMessage(), e);
}
}
}
JGlobus-JGlobus-Release-2.1.0/ssl-proxies/src/main/java/org/globus/gsi/bc/ 0000775 0000000 0000000 00000000000 12411160572 0026153 5 ustar 00root root 0000000 0000000 BouncyCastleCertProcessingFactory.java 0000664 0000000 0000000 00000150406 12411160572 0035543 0 ustar 00root root 0000000 0000000 JGlobus-JGlobus-Release-2.1.0/ssl-proxies/src/main/java/org/globus/gsi/bc /*
* Copyright 1999-2010 University of Chicago
*
* Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in
* compliance with the License. You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software distributed under the License is
* distributed on an "AS IS" BASIS,WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either
* express or implied.
*
* See the License for the specific language governing permissions and limitations under the License.
*/
package org.globus.gsi.bc;
import org.bouncycastle.asn1.x500.style.BCStyle;
import org.globus.gsi.util.CertificateLoadUtil;
import org.globus.gsi.util.ProxyCertificateUtil;
import org.globus.gsi.X509Credential;
import org.globus.gsi.VersionUtil;
import java.math.BigInteger;
import java.security.cert.CertificateException;
import java.util.Random;
import java.util.GregorianCalendar;
import java.util.TimeZone;
import java.util.Iterator;
import java.util.Calendar;
import java.io.InputStream;
import java.io.IOException;
import java.io.ByteArrayInputStream;
import java.security.cert.X509Certificate;
import java.security.PrivateKey;
import java.security.PublicKey;
import java.security.GeneralSecurityException;
import java.security.KeyPairGenerator;
import java.security.KeyPair;
import org.globus.util.I18n;
import org.globus.gsi.GlobusCredential;
import org.globus.gsi.GSIConstants;
import org.globus.gsi.X509ExtensionSet;
import org.globus.gsi.proxy.ext.ProxyCertInfo;
import org.globus.gsi.proxy.ext.ProxyPolicy;
import org.globus.gsi.proxy.ext.ProxyCertInfoExtension;
import org.globus.gsi.proxy.ext.GlobusProxyCertInfoExtension;
import org.bouncycastle.x509.X509V3CertificateGenerator;
import org.bouncycastle.jce.PKCS10CertificationRequest;
import org.bouncycastle.jce.provider.X509CertificateObject;
import org.bouncycastle.asn1.DERSet;
import org.bouncycastle.asn1.DERBitString;
import org.bouncycastle.asn1.x509.X509Name;
import org.bouncycastle.asn1.ASN1Primitive;
import org.bouncycastle.asn1.ASN1InputStream;
import org.bouncycastle.asn1.ASN1Sequence;
import org.bouncycastle.asn1.x509.Certificate;
import org.bouncycastle.asn1.x509.TBSCertificateStructure;
import org.bouncycastle.asn1.x509.X509Extensions;
import org.bouncycastle.asn1.x509.X509Extension;
import org.bouncycastle.asn1.x509.KeyUsage;
/**
* Provides certificate processing API such as creating new certificates, certificate requests, etc.
*/
public class BouncyCastleCertProcessingFactory {
private static I18n i18n = I18n.getI18n("org.globus.gsi.errors", BouncyCastleCertProcessingFactory.class
.getClassLoader());
private static BouncyCastleCertProcessingFactory factory;
protected BouncyCastleCertProcessingFactory() {
}
/**
* Returns an instance of this class..
*
* @return BouncyCastleCertProcessingFactory instance.
*/
public static synchronized BouncyCastleCertProcessingFactory getDefault() {
if (factory == null) {
factory = new BouncyCastleCertProcessingFactory();
}
return factory;
}
/**
* Creates a proxy certificate from the certificate request.
*
* @see #createCertificate(InputStream, X509Certificate, PrivateKey, int, int, X509ExtensionSet, String)
* createCertificate
* @deprecated
*/
public X509Certificate createCertificate(InputStream certRequestInputStream, X509Certificate cert,
PrivateKey privateKey, int lifetime, int delegationMode) throws IOException, GeneralSecurityException {
return createCertificate(certRequestInputStream, cert, privateKey, lifetime, delegationMode,
(X509ExtensionSet) null, null);
}
/**
* Creates a proxy certificate from the certificate request.
*
* @see #createCertificate(InputStream, X509Certificate, PrivateKey, int, int, X509ExtensionSet, String)
* createCertificate
* @deprecated
*/
public X509Certificate createCertificate(InputStream certRequestInputStream, X509Certificate cert,
PrivateKey privateKey, int lifetime, int delegationMode, X509ExtensionSet extSet) throws IOException,
GeneralSecurityException {
return createCertificate(certRequestInputStream, cert, privateKey, lifetime, delegationMode, extSet, null);
}
/**
* Creates a proxy certificate from the certificate request. (Signs a certificate request creating a new
* certificate)
*
* @see #createProxyCertificate(X509Certificate, PrivateKey, PublicKey, int, int, X509ExtensionSet,
* String) createProxyCertificate
* @param certRequestInputStream
* the input stream to read the certificate request from.
* @param cert
* the issuer certificate
* @param privateKey
* the private key to sign the new certificate with.
* @param lifetime
* lifetime of the new certificate in seconds. If 0 (or less then) the new certificate will
* have the same lifetime as the issuing certificate.
* @param delegationMode
* the type of proxy credential to create
* @param extSet
* a set of X.509 extensions to be included in the new proxy certificate. Can be null. If
* delegation mode is {@link org.globus.gsi.GSIConstants.CertificateType#GSI_3_RESTRICTED_PROXY
* GSIConstants.CertificateType.GSI_3_RESTRICTED_PROXY} or {@link org.globus.gsi.GSIConstants.CertificateType#GSI_4_RESTRICTED_PROXY
* GSIConstants.CertificateType.GSI_4_RESTRICTED_PROXY} then
* {@link org.globus.gsi.proxy.ext.ProxyCertInfoExtension ProxyCertInfoExtension} must be
* present in the extension set.
* @param cnValue
* the value of the CN component of the subject of the new certificate. If null, the defaults
* will be used depending on the proxy certificate type created.
* @return X509Certificate the new proxy certificate
* @exception IOException
* if error reading the certificate request
* @exception GeneralSecurityException
* if a security error occurs.
* @deprecated
*/
public X509Certificate createCertificate(InputStream certRequestInputStream, X509Certificate cert,
PrivateKey privateKey, int lifetime, int delegationMode, X509ExtensionSet extSet, String cnValue)
throws IOException, GeneralSecurityException {
ASN1InputStream derin = new ASN1InputStream(certRequestInputStream);
ASN1Primitive reqInfo = derin.readObject();
PKCS10CertificationRequest certReq = new PKCS10CertificationRequest((ASN1Sequence) reqInfo);
boolean rs = certReq.verify();
if (!rs) {
String err = i18n.getMessage("certReqVerification");
throw new GeneralSecurityException(err);
}
return createProxyCertificate(cert, privateKey, certReq.getPublicKey(), lifetime, delegationMode, extSet,
cnValue);
}
/**
* Creates a new proxy credential from the specified certificate chain and a private key.
*
* @see #createCredential(X509Certificate[], PrivateKey, int, int, int, X509ExtensionSet, String)
* createCredential
* @deprecated
*/
public GlobusCredential createCredential(X509Certificate[] certs, PrivateKey privateKey, int bits, int lifetime,
int delegationMode) throws GeneralSecurityException {
return createCredential(certs, privateKey, bits, lifetime, delegationMode, (X509ExtensionSet) null, null);
}
/**
* Creates a new proxy credential from the specified certificate chain and a private key.
*
* @see #createCredential(X509Certificate[], PrivateKey, int, int, int, X509ExtensionSet, String)
* createCredential
* @deprecated
*/
public GlobusCredential createCredential(X509Certificate[] certs, PrivateKey privateKey, int bits, int lifetime,
int delegationMode, X509ExtensionSet extSet) throws GeneralSecurityException {
return createCredential(certs, privateKey, bits, lifetime, delegationMode, extSet, null);
}
/**
* Creates a new proxy credential from the specified certificate chain and a private key. A set of X.509
* extensions can be optionally included in the new proxy certificate. This function automatically creates
* a "RSA"-based key pair.
*
* @see #createProxyCertificate(X509Certificate, PrivateKey, PublicKey, int, int, X509ExtensionSet,
* String) createProxyCertificate
* @param certs
* the certificate chain for the new proxy credential. The top-most certificate
* cert[0] will be designated as the issuing certificate.
* @param privateKey
* the private key of the issuing certificate. The new proxy certificate will be signed with
* that private key.
* @param bits
* the strength of the key pair for the new proxy certificate.
* @param lifetime
* lifetime of the new certificate in seconds. If 0 (or less then) the new certificate will
* have the same lifetime as the issuing certificate.
* @param delegationMode
* the type of proxy credential to create
* @param extSet
* a set of X.509 extensions to be included in the new proxy certificate. Can be null. If
* delegation mode is {@link org.globus.gsi.GSIConstants.CertificateType#GSI_3_RESTRICTED_PROXY
* GSIConstants.CertificateType.GSI_3_RESTRICTED_PROXY} or {@link org.globus.gsi.GSIConstants.CertificateType#GSI_4_RESTRICTED_PROXY
* GSIConstants.CertificateType.GSI_4_RESTRICTED_PROXY} then
* {@link org.globus.gsi.proxy.ext.ProxyCertInfoExtension ProxyCertInfoExtension} must be
* present in the extension set.
* @param cnValue
* the value of the CN component of the subject of the new proxy credential. If null, the
* defaults will be used depending on the proxy certificate type created.
* @return GlobusCredential the new proxy credential.
* @exception GeneralSecurityException
* if a security error occurs.
* @deprecated
*/
public GlobusCredential createCredential(X509Certificate[] certs, PrivateKey privateKey, int bits, int lifetime,
int delegationMode, X509ExtensionSet extSet, String cnValue) throws GeneralSecurityException {
X509Certificate[] bcCerts = getX509CertificateObjectChain(certs);
KeyPairGenerator keyGen = null;
keyGen = KeyPairGenerator.getInstance("RSA", "BC");
keyGen.initialize(bits);
KeyPair keyPair = keyGen.genKeyPair();
X509Certificate newCert = createProxyCertificate(bcCerts[0], privateKey, keyPair.getPublic(), lifetime,
delegationMode, extSet, cnValue);
X509Certificate[] newCerts = new X509Certificate[bcCerts.length + 1];
newCerts[0] = newCert;
System.arraycopy(certs, 0, newCerts, 1, certs.length);
return new GlobusCredential(keyPair.getPrivate(), newCerts);
}
/**
* Creates a proxy certificate. A set of X.509 extensions can be optionally included in the new proxy
* certificate.
* If a GSI-2 proxy is created, the serial number of the proxy certificate will be the same as of the
* issuing certificate. Also, none of the extensions in the issuing certificate will be copied into the
* proxy certificate.
* If a GSI-3 or GSI 4 proxy is created, the serial number of the proxy certificate will be picked
* randomly. If the issuing certificate contains a KeyUsage extension, the extension will be copied
* into the proxy certificate with keyCertSign and nonRepudiation bits turned off. No other
* extensions are currently copied.
*
* The methods defaults to creating GSI 4 proxy
*
* @param issuerCert_
* the issuing certificate
* @param issuerKey
* private key matching the public key of issuer certificate. The new proxy certificate will be
* signed by that key.
* @param publicKey
* the public key of the new certificate
* @param lifetime
* lifetime of the new certificate in seconds. If 0 (or less then) the new certificate will
* have the same lifetime as the issuing certificate.
* @param proxyType
* can be one of {@link GSIConstants#DELEGATION_LIMITED GSIConstants.DELEGATION_LIMITED},
* {@link GSIConstants#DELEGATION_FULL GSIConstants.DELEGATION_FULL},
*
* {@link GSIConstants#GSI_2_LIMITED_PROXY GSIConstants.GSI_2_LIMITED_PROXY},
* {@link GSIConstants#GSI_2_PROXY GSIConstants.GSI_2_PROXY},
* {@link GSIConstants#GSI_3_IMPERSONATION_PROXY GSIConstants.GSI_3_IMPERSONATION_PROXY},
* {@link GSIConstants#GSI_3_LIMITED_PROXY GSIConstants.GSI_3_LIMITED_PROXY},
* {@link GSIConstants#GSI_3_INDEPENDENT_PROXY GSIConstants.GSI_3_INDEPENDENT_PROXY},
* {@link GSIConstants#GSI_3_RESTRICTED_PROXY GSIConstants.GSI_3_RESTRICTED_PROXY}.
* {@link GSIConstants#GSI_4_IMPERSONATION_PROXY GSIConstants.GSI_4_IMPERSONATION_PROXY},
* {@link GSIConstants#GSI_4_LIMITED_PROXY GSIConstants.GSI_3_LIMITED_PROXY},
* {@link GSIConstants#GSI_4_INDEPENDENT_PROXY GSIConstants.GSI_4_INDEPENDENT_PROXY},
* {@link GSIConstants#GSI_4_RESTRICTED_PROXY GSIConstants.GSI_4_RESTRICTED_PROXY}.
*
* If {@link GSIConstants#DELEGATION_LIMITED GSIConstants.DELEGATION_LIMITED} and if
* {@link VersionUtil#isGsi2Enabled() CertUtil.isGsi2Enabled} returns true then a GSI-2 limited
* proxy will be created. Else if {@link VersionUtil#isGsi3Enabled() CertUtil.isGsi3Enabled}
* returns true then a GSI-3 limited proxy will be created. If not, a GSI-4 limited proxy will
* be created.
*
* If {@link GSIConstants#DELEGATION_FULL GSIConstants.DELEGATION_FULL} and if
* {@link VersionUtil#isGsi2Enabled() CertUtil.isGsi2Enabled} returns true then a GSI-2 full proxy
* will be created. Else if {@link VersionUtil#isGsi3Enabled() CertUtil.isGsi3Enabled} returns
* true then a GSI-3 full proxy will be created. If not, a GSI-4 full proxy will be created.
*
* @param extSet
* a set of X.509 extensions to be included in the new proxy certificate. Can be null. If
* delegation mode is {@link GSIConstants#GSI_3_RESTRICTED_PROXY
* GSIConstants.GSI_3_RESTRICTED_PROXY} or {@link GSIConstants#GSI_4_RESTRICTED_PROXY
* GSIConstants.GSI_4_RESTRICTED_PROXY} then
* {@link org.globus.gsi.proxy.ext.ProxyCertInfoExtension ProxyCertInfoExtension} must be
* present in the extension set.
*
* @param cnValue
* the value of the CN component of the subject of the new certificate. If null, the defaults
* will be used depending on the proxy certificate type created.
* @return X509Certificate the new proxy certificate.
* @exception GeneralSecurityException
* if a security error occurs.
* @deprecated
*/
public X509Certificate createProxyCertificate(X509Certificate issuerCert_, PrivateKey issuerKey,
PublicKey publicKey, int lifetime, int proxyType, X509ExtensionSet extSet, String cnValue)
throws GeneralSecurityException {
X509Certificate issuerCert = issuerCert_;
if (!(issuerCert_ instanceof X509CertificateObject)) {
issuerCert = CertificateLoadUtil.loadCertificate(new ByteArrayInputStream(issuerCert.getEncoded()));
}
if (proxyType == GSIConstants.DELEGATION_LIMITED) {
GSIConstants.CertificateType type = BouncyCastleUtil.getCertificateType(issuerCert);
if (ProxyCertificateUtil.isGsi4Proxy(type)) {
proxyType = GSIConstants.GSI_4_LIMITED_PROXY;
} else if (ProxyCertificateUtil.isGsi3Proxy(type)) {
proxyType = GSIConstants.GSI_3_LIMITED_PROXY;
} else if (ProxyCertificateUtil.isGsi2Proxy(type)) {
proxyType = GSIConstants.GSI_2_LIMITED_PROXY;
} else {
// default to RFC compliant proxy
if (VersionUtil.isGsi2Enabled()) {
proxyType = GSIConstants.GSI_2_LIMITED_PROXY;
} else {
proxyType = VersionUtil.isGsi3Enabled() ? GSIConstants.GSI_3_LIMITED_PROXY
: GSIConstants.GSI_4_LIMITED_PROXY;
}
}
} else if (proxyType == GSIConstants.DELEGATION_FULL) {
GSIConstants.CertificateType type = BouncyCastleUtil.getCertificateType(issuerCert);
if (ProxyCertificateUtil.isGsi4Proxy(type)) {
proxyType = GSIConstants.GSI_4_IMPERSONATION_PROXY;
} else if (ProxyCertificateUtil.isGsi3Proxy(type)) {
proxyType = GSIConstants.GSI_3_IMPERSONATION_PROXY;
} else if (ProxyCertificateUtil.isGsi2Proxy(type)) {
proxyType = GSIConstants.GSI_2_PROXY;
} else {
// Default to RFC complaint proxy
if (VersionUtil.isGsi2Enabled()) {
proxyType = GSIConstants.GSI_2_PROXY;
} else {
proxyType = (VersionUtil.isGsi3Enabled()) ? GSIConstants.GSI_3_IMPERSONATION_PROXY
: GSIConstants.GSI_4_IMPERSONATION_PROXY;
}
}
}
X509V3CertificateGenerator certGen = new X509V3CertificateGenerator();
org.globus.gsi.X509Extension x509Ext = null;
BigInteger serialNum = null;
String delegDN = null;
if (ProxyCertificateUtil.isGsi3Proxy(GSIConstants.CertificateType.get(proxyType)) ||
ProxyCertificateUtil.isGsi4Proxy(GSIConstants.CertificateType.get(proxyType))) {
Random rand = new Random();
delegDN = String.valueOf(Math.abs(rand.nextInt()));
serialNum = new BigInteger(20, rand);
if (extSet != null) {
x509Ext = extSet.get(ProxyCertInfo.OID.getId());
if (x509Ext == null) {
x509Ext = extSet.get(ProxyCertInfo.OLD_OID.getId());
}
}
if (x509Ext == null) {
// create ProxyCertInfo extension
ProxyPolicy policy = null;
if (ProxyCertificateUtil.isLimitedProxy(GSIConstants.CertificateType.get(proxyType))) {
policy = new ProxyPolicy(ProxyPolicy.LIMITED);
} else if (ProxyCertificateUtil.isIndependentProxy(GSIConstants.CertificateType.get(proxyType))) {
policy = new ProxyPolicy(ProxyPolicy.INDEPENDENT);
} else if (ProxyCertificateUtil.isImpersonationProxy(GSIConstants.CertificateType.get(proxyType))) {
// since limited has already been checked, this should work.
policy = new ProxyPolicy(ProxyPolicy.IMPERSONATION);
} else if ((proxyType == GSIConstants.GSI_3_RESTRICTED_PROXY)
|| (proxyType == GSIConstants.GSI_4_RESTRICTED_PROXY)) {
String err = i18n.getMessage("restrictProxy");
throw new IllegalArgumentException(err);
} else {
String err = i18n.getMessage("invalidProxyType");
throw new IllegalArgumentException(err);
}
ProxyCertInfo proxyCertInfo = new ProxyCertInfo(policy);
x509Ext = new ProxyCertInfoExtension(proxyCertInfo);
if (ProxyCertificateUtil.isGsi4Proxy(GSIConstants.CertificateType.get(proxyType))) {
// RFC compliant OID
x509Ext = new ProxyCertInfoExtension(proxyCertInfo);
} else {
// old OID
x509Ext = new GlobusProxyCertInfoExtension(proxyCertInfo);
}
}
try {
// add ProxyCertInfo extension to the new cert
certGen.addExtension(x509Ext.getOid(), x509Ext.isCritical(), x509Ext.getValue());
// handle KeyUsage in issuer cert
TBSCertificateStructure crt = BouncyCastleUtil.getTBSCertificateStructure(issuerCert);
X509Extensions extensions = crt.getExtensions();
if (extensions != null) {
X509Extension ext;
// handle key usage ext
ext = extensions.getExtension(X509Extension.keyUsage);
if (ext != null) {
// TBD: handle this better
if (extSet != null && (extSet.get(X509Extension.keyUsage.getId()) != null)) {
String err = i18n.getMessage("keyUsageExt");
throw new GeneralSecurityException(err);
}
DERBitString bits = (DERBitString) BouncyCastleUtil.getExtensionObject(ext);
byte[] bytes = bits.getBytes();
// make sure they are disabled
if ((bytes[0] & KeyUsage.nonRepudiation) != 0) {
bytes[0] ^= KeyUsage.nonRepudiation;
}
if ((bytes[0] & KeyUsage.keyCertSign) != 0) {
bytes[0] ^= KeyUsage.keyCertSign;
}
bits = new DERBitString(bytes, bits.getPadBits());
certGen.addExtension(X509Extension.keyUsage, ext.isCritical(), bits);
}
}
} catch (IOException e) {
// but this should not happen
throw new GeneralSecurityException(e.getMessage());
}
} else if (proxyType == GSIConstants.GSI_2_LIMITED_PROXY) {
delegDN = "limited proxy";
serialNum = issuerCert.getSerialNumber();
} else if (proxyType == GSIConstants.GSI_2_PROXY) {
delegDN = "proxy";
serialNum = issuerCert.getSerialNumber();
} else {
String err = i18n.getMessage("unsupportedProxy", Integer.toString(proxyType));
throw new IllegalArgumentException(err);
}
// add specified extensions
if (extSet != null) {
Iterator iter = extSet.oidSet().iterator();
while (iter.hasNext()) {
String oid = (String) iter.next();
// skip ProxyCertInfo extension
if (oid.equals(ProxyCertInfo.OID.getId()) || oid.equals(ProxyCertInfo.OLD_OID.getId())) {
continue;
}
x509Ext = (org.globus.gsi.X509Extension) extSet.get(oid);
certGen.addExtension(x509Ext.getOid(), x509Ext.isCritical(), x509Ext.getValue());
}
}
X509Name issuerDN;
if (issuerCert.getSubjectDN() instanceof X509Name) {
issuerDN = (X509Name)issuerCert.getSubjectDN();
} else {
issuerDN = new X509Name(true,issuerCert.getSubjectX500Principal().getName());
}
X509NameHelper issuer = new X509NameHelper(issuerDN);
X509NameHelper subject = new X509NameHelper(issuerDN);
subject.add(BCStyle.CN, (cnValue == null) ? delegDN : cnValue);
certGen.setSubjectDN(subject.getAsName());
certGen.setIssuerDN(issuer.getAsName());
certGen.setSerialNumber(serialNum);
certGen.setPublicKey(publicKey);
certGen.setSignatureAlgorithm(issuerCert.getSigAlgName());
GregorianCalendar date = new GregorianCalendar(TimeZone.getTimeZone("GMT"));
/* Allow for a five minute clock skew here. */
date.add(Calendar.MINUTE, -5);
certGen.setNotBefore(date.getTime());
/* If hours = 0, then cert lifetime is set to user cert */
if (lifetime <= 0) {
certGen.setNotAfter(issuerCert.getNotAfter());
} else {
date.add(Calendar.MINUTE, 5);
date.add(Calendar.SECOND, lifetime);
certGen.setNotAfter(date.getTime());
}
return certGen.generateX509Certificate(issuerKey);
}
/**
* Creates a proxy certificate from the certificate request.
*
* @see #createCertificate(InputStream, X509Certificate, PrivateKey, int, int, X509ExtensionSet, String)
* createCertificate
*/
public X509Certificate createCertificate(InputStream certRequestInputStream, X509Certificate cert,
PrivateKey privateKey, int lifetime, GSIConstants.CertificateType certType) throws IOException,
GeneralSecurityException {
return createCertificate(certRequestInputStream, cert, privateKey, lifetime, certType, (X509ExtensionSet) null,
null);
}
/**
* Creates a proxy certificate from the certificate request.
*
* @see #createCertificate(InputStream, X509Certificate, PrivateKey, int, GSIConstants.CertificateType, X509ExtensionSet, String)
* createCertificate
*/
public X509Certificate createCertificate(InputStream certRequestInputStream, X509Certificate cert,
PrivateKey privateKey, int lifetime, GSIConstants.CertificateType certType, X509ExtensionSet extSet)
throws IOException, GeneralSecurityException {
return createCertificate(certRequestInputStream, cert, privateKey, lifetime, certType, extSet, null);
}
/**
* Creates a proxy certificate from the certificate request. (Signs a certificate request creating a new
* certificate)
*
* @see #createProxyCertificate(X509Certificate, PrivateKey, PublicKey, int, int, X509ExtensionSet,
* String) createProxyCertificate
* @param certRequestInputStream
* the input stream to read the certificate request from.
* @param cert
* the issuer certificate
* @param privateKey
* the private key to sign the new certificate with.
* @param lifetime
* lifetime of the new certificate in seconds. If 0 (or less then) the new certificate will
* have the same lifetime as the issuing certificate.
* @param certType
* the type of proxy credential to create
* @param extSet
* a set of X.509 extensions to be included in the new proxy certificate. Can be null. If
* delegation mode is {@link org.globus.gsi.GSIConstants.CertificateType#GSI_3_RESTRICTED_PROXY
* GSIConstants.CertificateType.GSI_3_RESTRICTED_PROXY} or {@link org.globus.gsi.GSIConstants.CertificateType#GSI_4_RESTRICTED_PROXY
* GSIConstants.CertificateType.GSI_4_RESTRICTED_PROXY} then
* {@link org.globus.gsi.proxy.ext.ProxyCertInfoExtension ProxyCertInfoExtension} must be
* present in the extension set.
* @param cnValue
* the value of the CN component of the subject of the new certificate. If null, the defaults
* will be used depending on the proxy certificate type created.
* @return X509Certificate the new proxy certificate
* @exception IOException
* if error reading the certificate request
* @exception GeneralSecurityException
* if a security error occurs.
*/
public X509Certificate createCertificate(InputStream certRequestInputStream, X509Certificate cert,
PrivateKey privateKey, int lifetime, GSIConstants.CertificateType certType, X509ExtensionSet extSet,
String cnValue) throws IOException, GeneralSecurityException {
ASN1InputStream derin = new ASN1InputStream(certRequestInputStream);
ASN1Primitive reqInfo = derin.readObject();
PKCS10CertificationRequest certReq = new PKCS10CertificationRequest((ASN1Sequence) reqInfo);
boolean rs = certReq.verify();
if (!rs) {
String err = i18n.getMessage("certReqVerification");
throw new GeneralSecurityException(err);
}
return createProxyCertificate(cert, privateKey, certReq.getPublicKey(), lifetime, certType, extSet, cnValue);
}
/**
* Creates a new proxy credential from the specified certificate chain and a private key.
*
* @see #createCredential(X509Certificate[], PrivateKey, int, int, GSIConstants.CertificateType, X509ExtensionSet, String)
* createCredential
*/
public X509Credential createCredential(X509Certificate[] certs, PrivateKey privateKey, int bits, int lifetime,
GSIConstants.CertificateType certType) throws GeneralSecurityException {
return createCredential(certs, privateKey, bits, lifetime, certType, (X509ExtensionSet) null, null);
}
/**
* Creates a new proxy credential from the specified certificate chain and a private key.
*
* @see #createCredential(X509Certificate[], PrivateKey, int, int, GSIConstants.CertificateType, X509ExtensionSet, String)
* createCredential
*/
public X509Credential createCredential(X509Certificate[] certs, PrivateKey privateKey, int bits, int lifetime,
GSIConstants.CertificateType certType, X509ExtensionSet extSet) throws GeneralSecurityException {
return createCredential(certs, privateKey, bits, lifetime, certType, extSet, null);
}
/**
* Creates a new proxy credential from the specified certificate chain and a private key. A set of X.509
* extensions can be optionally included in the new proxy certificate. This function automatically creates
* a "RSA"-based key pair.
*
* @see #createProxyCertificate(X509Certificate, PrivateKey, PublicKey, int, int, X509ExtensionSet,
* String) createProxyCertificate
* @param certs
* the certificate chain for the new proxy credential. The top-most certificate
* cert[0] will be designated as the issuing certificate.
* @param privateKey
* the private key of the issuing certificate. The new proxy certificate will be signed with
* that private key.
* @param bits
* the strength of the key pair for the new proxy certificate.
* @param lifetime
* lifetime of the new certificate in seconds. If 0 (or less then) the new certificate will
* have the same lifetime as the issuing certificate.
* @param certType
* the type of proxy credential to create
* @param extSet
* a set of X.509 extensions to be included in the new proxy certificate. Can be null. If
* delegation mode is {@link org.globus.gsi.GSIConstants.CertificateType#GSI_3_RESTRICTED_PROXY
* GSIConstants.CertificateType.GSI_3_RESTRICTED_PROXY} or {@link org.globus.gsi.GSIConstants.CertificateType#GSI_4_RESTRICTED_PROXY
* GSIConstants.CertificateType.GSI_4_RESTRICTED_PROXY} then
* {@link org.globus.gsi.proxy.ext.ProxyCertInfoExtension ProxyCertInfoExtension} must be
* present in the extension set.
* @param cnValue
* the value of the CN component of the subject of the new proxy credential. If null, the
* defaults will be used depending on the proxy certificate type created.
* @return GlobusCredential the new proxy credential.
* @exception GeneralSecurityException
* if a security error occurs.
*/
public X509Credential createCredential(X509Certificate[] certs, PrivateKey privateKey, int bits, int lifetime,
GSIConstants.CertificateType certType, X509ExtensionSet extSet, String cnValue) throws GeneralSecurityException {
X509Certificate[] bcCerts = getX509CertificateObjectChain(certs);
KeyPairGenerator keyGen = null;
keyGen = KeyPairGenerator.getInstance("RSA", "BC");
keyGen.initialize(bits);
KeyPair keyPair = keyGen.genKeyPair();
X509Certificate newCert = createProxyCertificate(bcCerts[0], privateKey, keyPair.getPublic(), lifetime,
certType, extSet, cnValue);
X509Certificate[] newCerts = new X509Certificate[bcCerts.length + 1];
newCerts[0] = newCert;
System.arraycopy(certs, 0, newCerts, 1, certs.length);
return new X509Credential(keyPair.getPrivate(), newCerts);
}
/**
* Creates a new proxy credential from the specified certificate chain and a private key,
* using the given delegation mode.
*
* @see #createCredential(X509Certificate[], PrivateKey, int, int, GSIConstants.CertificateType, X509ExtensionSet, String)
* createCredential
*/
public X509Credential createCredential(X509Certificate[] certs, PrivateKey privateKey, int bits, int lifetime,
GSIConstants.DelegationType delegType) throws GeneralSecurityException {
return createCredential(certs, privateKey, bits, lifetime, delegType, (X509ExtensionSet) null, null);
}
/**
* Creates a new proxy credential from the specified certificate chain and a private key,
* using the given delegation mode.
*
* @see #createCredential(X509Certificate[], PrivateKey, int, int, GSIConstants.CertificateType, X509ExtensionSet, String)
* createCredential
*/
public X509Credential createCredential(X509Certificate[] certs, PrivateKey privateKey, int bits, int lifetime,
GSIConstants.DelegationType delegType, X509ExtensionSet extSet) throws GeneralSecurityException {
return createCredential(certs, privateKey, bits, lifetime, delegType, extSet, null);
}
/**
* Creates a new proxy credential from the specified certificate chain and a private key,
* using the given delegation mode.
* @see #createCredential(X509Certificate[], PrivateKey, int, int, GSIConstants.CertificateType, X509ExtensionSet, String)
*/
public X509Credential createCredential(X509Certificate[] certs, PrivateKey privateKey, int bits, int lifetime,
GSIConstants.DelegationType delegType, X509ExtensionSet extSet, String cnValue) throws GeneralSecurityException {
X509Certificate[] bcCerts = getX509CertificateObjectChain(certs);
return createCredential(bcCerts, privateKey, bits, lifetime, decideProxyType(bcCerts[0], delegType), extSet, cnValue);
}
/**
* Creates a proxy certificate. A set of X.509 extensions can be optionally included in the new proxy
* certificate.
* If a GSI-2 proxy is created, the serial number of the proxy certificate will be the same as of the
* issuing certificate. Also, none of the extensions in the issuing certificate will be copied into the
* proxy certificate.
* If a GSI-3 or GSI 4 proxy is created, the serial number of the proxy certificate will be picked
* randomly. If the issuing certificate contains a KeyUsage extension, the extension will be copied
* into the proxy certificate with keyCertSign and nonRepudiation bits turned off. No other
* extensions are currently copied.
*
* The methods defaults to creating GSI 4 proxy
*
* @param issuerCert_
* the issuing certificate
* @param issuerKey
* private key matching the public key of issuer certificate. The new proxy certificate will be
* signed by that key.
* @param publicKey
* the public key of the new certificate
* @param lifetime
* lifetime of the new certificate in seconds. If 0 (or less then) the new certificate will
* have the same lifetime as the issuing certificate.
* @param certType
* can be one of {@link org.globus.gsi.GSIConstants.CertificateType#GSI_2_LIMITED_PROXY GSIConstants.CertificateType.GSI_2_LIMITED_PROXY},
* {@link org.globus.gsi.GSIConstants.CertificateType#GSI_2_PROXY GSIConstants.CertificateType.GSI_2_PROXY},
* {@link org.globus.gsi.GSIConstants.CertificateType#GSI_3_IMPERSONATION_PROXY GSIConstants.CertificateType.GSI_3_IMPERSONATION_PROXY},
* {@link org.globus.gsi.GSIConstants.CertificateType#GSI_3_LIMITED_PROXY GSIConstants.CertificateType.GSI_3_LIMITED_PROXY},
* {@link org.globus.gsi.GSIConstants.CertificateType#GSI_3_INDEPENDENT_PROXY GSIConstants.CertificateType.GSI_3_INDEPENDENT_PROXY},
* {@link org.globus.gsi.GSIConstants.CertificateType#GSI_3_RESTRICTED_PROXY GSIConstants.CertificateType.GSI_3_RESTRICTED_PROXY}.
* {@link org.globus.gsi.GSIConstants.CertificateType#GSI_4_IMPERSONATION_PROXY GSIConstants.CertificateType.GSI_4_IMPERSONATION_PROXY},
* {@link org.globus.gsi.GSIConstants.CertificateType#GSI_4_LIMITED_PROXY GSIConstants.CertificateType.GSI_3_LIMITED_PROXY},
* {@link org.globus.gsi.GSIConstants.CertificateType#GSI_4_INDEPENDENT_PROXY GSIConstants.CertificateType.GSI_4_INDEPENDENT_PROXY},
* {@link org.globus.gsi.GSIConstants.CertificateType#GSI_4_RESTRICTED_PROXY GSIConstants.CertificateType.GSI_4_RESTRICTED_PROXY}.
*
* @param extSet
* a set of X.509 extensions to be included in the new proxy certificate. Can be null. If
* delegation mode is {@link org.globus.gsi.GSIConstants.CertificateType#GSI_3_RESTRICTED_PROXY
* GSIConstants.CertificateType.GSI_3_RESTRICTED_PROXY} or {@link org.globus.gsi.GSIConstants.CertificateType#GSI_4_RESTRICTED_PROXY
* GSIConstants.CertificateType.GSI_4_RESTRICTED_PROXY} then
* {@link org.globus.gsi.proxy.ext.ProxyCertInfoExtension ProxyCertInfoExtension} must be
* present in the extension set.
*
* @param cnValue
* the value of the CN component of the subject of the new certificate. If null, the defaults
* will be used depending on the proxy certificate type created.
* @return X509Certificate the new proxy certificate.
* @exception GeneralSecurityException
* if a security error occurs.
*/
public X509Certificate createProxyCertificate(X509Certificate issuerCert_, PrivateKey issuerKey,
PublicKey publicKey, int lifetime, GSIConstants.CertificateType certType, X509ExtensionSet extSet,
String cnValue) throws GeneralSecurityException {
X509Certificate issuerCert = issuerCert_;
if (!(issuerCert_ instanceof X509CertificateObject)) {
issuerCert = CertificateLoadUtil.loadCertificate(new ByteArrayInputStream(issuerCert.getEncoded()));
}
X509V3CertificateGenerator certGen = new X509V3CertificateGenerator();
org.globus.gsi.X509Extension x509Ext = null;
BigInteger serialNum = null;
String delegDN = null;
if (ProxyCertificateUtil.isGsi3Proxy(certType) || ProxyCertificateUtil.isGsi4Proxy(certType)) {
Random rand = new Random();
delegDN = String.valueOf(Math.abs(rand.nextInt()));
serialNum = new BigInteger(20, rand);
if (extSet != null) {
x509Ext = extSet.get(ProxyCertInfo.OID.getId());
if (x509Ext == null) {
x509Ext = extSet.get(ProxyCertInfo.OLD_OID.getId());
}
}
if (x509Ext == null) {
// create ProxyCertInfo extension
ProxyPolicy policy = null;
if (ProxyCertificateUtil.isLimitedProxy(certType)) {
policy = new ProxyPolicy(ProxyPolicy.LIMITED);
} else if (ProxyCertificateUtil.isIndependentProxy(certType)) {
policy = new ProxyPolicy(ProxyPolicy.INDEPENDENT);
} else if (ProxyCertificateUtil.isImpersonationProxy(certType)) {
// since limited has already been checked, this should work.
policy = new ProxyPolicy(ProxyPolicy.IMPERSONATION);
} else if ((certType == GSIConstants.CertificateType.GSI_3_RESTRICTED_PROXY)
|| (certType == GSIConstants.CertificateType.GSI_4_RESTRICTED_PROXY)) {
String err = i18n.getMessage("restrictProxy");
throw new IllegalArgumentException(err);
} else {
String err = i18n.getMessage("invalidProxyType");
throw new IllegalArgumentException(err);
}
ProxyCertInfo proxyCertInfo = new ProxyCertInfo(policy);
x509Ext = new ProxyCertInfoExtension(proxyCertInfo);
if (ProxyCertificateUtil.isGsi4Proxy(certType)) {
// RFC compliant OID
x509Ext = new ProxyCertInfoExtension(proxyCertInfo);
} else {
// old OID
x509Ext = new GlobusProxyCertInfoExtension(proxyCertInfo);
}
}
try {
// add ProxyCertInfo extension to the new cert
certGen.addExtension(x509Ext.getOid(), x509Ext.isCritical(), x509Ext.getValue());
// handle KeyUsage in issuer cert
TBSCertificateStructure crt = BouncyCastleUtil.getTBSCertificateStructure(issuerCert);
X509Extensions extensions = crt.getExtensions();
if (extensions != null) {
X509Extension ext;
// handle key usage ext
ext = extensions.getExtension(X509Extension.keyUsage);
if (ext != null) {
// TBD: handle this better
if (extSet != null && (extSet.get(X509Extension.keyUsage.getId()) != null)) {
String err = i18n.getMessage("keyUsageExt");
throw new GeneralSecurityException(err);
}
DERBitString bits = (DERBitString) BouncyCastleUtil.getExtensionObject(ext);
byte[] bytes = bits.getBytes();
// make sure they are disabled
if ((bytes[0] & KeyUsage.nonRepudiation) != 0) {
bytes[0] ^= KeyUsage.nonRepudiation;
}
if ((bytes[0] & KeyUsage.keyCertSign) != 0) {
bytes[0] ^= KeyUsage.keyCertSign;
}
bits = new DERBitString(bytes, bits.getPadBits());
certGen.addExtension(X509Extension.keyUsage, ext.isCritical(), bits);
}
}
} catch (IOException e) {
// but this should not happen
throw new GeneralSecurityException(e.getMessage());
}
} else if (certType == GSIConstants.CertificateType.GSI_2_LIMITED_PROXY) {
delegDN = "limited proxy";
serialNum = issuerCert.getSerialNumber();
} else if (certType == GSIConstants.CertificateType.GSI_2_PROXY) {
delegDN = "proxy";
serialNum = issuerCert.getSerialNumber();
} else {
String err = i18n.getMessage("unsupportedProxy", certType);
throw new IllegalArgumentException(err);
}
// add specified extensions
if (extSet != null) {
Iterator iter = extSet.oidSet().iterator();
while (iter.hasNext()) {
String oid = (String) iter.next();
// skip ProxyCertInfo extension
if (oid.equals(ProxyCertInfo.OID.getId()) || oid.equals(ProxyCertInfo.OLD_OID.getId())) {
continue;
}
x509Ext = (org.globus.gsi.X509Extension) extSet.get(oid);
certGen.addExtension(x509Ext.getOid(), x509Ext.isCritical(), x509Ext.getValue());
}
}
X509Name issuerDN;
if (issuerCert.getSubjectDN() instanceof X509Name) {
issuerDN = (X509Name)issuerCert.getSubjectDN();
} else {
issuerDN = new X509Name(true,issuerCert.getSubjectX500Principal().getName());
}
X509NameHelper issuer = new X509NameHelper(issuerDN);
X509NameHelper subject = new X509NameHelper(issuerDN);
subject.add(BCStyle.CN, (cnValue == null) ? delegDN : cnValue);
certGen.setSubjectDN(subject.getAsName());
certGen.setIssuerDN(issuer.getAsName());
certGen.setSerialNumber(serialNum);
certGen.setPublicKey(publicKey);
certGen.setSignatureAlgorithm(issuerCert.getSigAlgName());
GregorianCalendar date = new GregorianCalendar(TimeZone.getTimeZone("GMT"));
/* Allow for a five minute clock skew here. */
date.add(Calendar.MINUTE, -5);
certGen.setNotBefore(date.getTime());
/* If hours = 0, then cert lifetime is set to user cert */
if (lifetime <= 0) {
certGen.setNotAfter(issuerCert.getNotAfter());
} else {
date.add(Calendar.MINUTE, 5);
date.add(Calendar.SECOND, lifetime);
certGen.setNotAfter(date.getTime());
}
return certGen.generateX509Certificate(issuerKey);
}
/**
* Loads a X509 certificate from the specified input stream. Input stream must contain DER-encoded
* certificate.
*
* @param in
* the input stream to read the certificate from.
* @return X509Certificate the loaded certificate.
* @exception GeneralSecurityException
* if certificate failed to load.
*/
public X509Certificate loadCertificate(InputStream in) throws IOException, GeneralSecurityException {
ASN1InputStream derin = new ASN1InputStream(in);
ASN1Primitive certInfo = derin.readObject();
ASN1Sequence seq = ASN1Sequence.getInstance(certInfo);
return new X509CertificateObject(Certificate.getInstance(seq));
}
/**
* Creates a certificate request from the specified subject DN and a key pair. The
* "MD5WithRSAEncryption" is used as the signing algorithm of the certificate request.
*
* @param subject
* the subject of the certificate request
* @param keyPair
* the key pair of the certificate request
* @return the certificate request.
* @exception GeneralSecurityException
* if security error occurs.
*/
public byte[] createCertificateRequest(String subject, KeyPair keyPair) throws GeneralSecurityException {
X509Name name = new X509Name(subject);
return createCertificateRequest(name, "MD5WithRSAEncryption", keyPair);
}
/**
* Creates a certificate request from the specified certificate and a key pair. The certificate's subject
* DN with "CN=proxy" name component appended to the subject is used as the subject of the
* certificate request. Also the certificate's signing algorithm is used as the certificate request
* signing algorithm.
*
* @param cert
* the certificate to create the certificate request from.
* @param keyPair
* the key pair of the certificate request
* @return the certificate request.
* @exception GeneralSecurityException
* if security error occurs.
*/
public byte[] createCertificateRequest(X509Certificate cert, KeyPair keyPair) throws GeneralSecurityException {
String issuer = cert.getSubjectDN().getName();
X509Name subjectDN = new X509Name(issuer + ",CN=proxy");
String sigAlgName = cert.getSigAlgName();
return createCertificateRequest(subjectDN, sigAlgName, keyPair);
}
/**
* Creates a certificate request from the specified subject name, signing algorithm, and a key pair.
*
* @param subjectDN
* the subject name of the certificate request.
* @param sigAlgName
* the signing algorithm name.
* @param keyPair
* the key pair of the certificate request
* @return the certificate request.
* @exception GeneralSecurityException
* if security error occurs.
*/
public byte[] createCertificateRequest(X509Name subjectDN, String sigAlgName, KeyPair keyPair)
throws GeneralSecurityException {
DERSet attrs = null;
PKCS10CertificationRequest certReq = null;
certReq = new PKCS10CertificationRequest(sigAlgName, subjectDN, keyPair.getPublic(), attrs, keyPair
.getPrivate());
return certReq.getEncoded();
}
/**
* Given a delegation mode and an issuing certificate, decides an
* appropriate certificate type to use for proxies
* @param issuerCert the issuing certificate of a prospective proxy
* @param delegType the desired delegation mode
* @return the appropriate certificate type for proxies or
* GSIConstants.CertificateType.UNDEFINED when
* GSIConstants.DelegationType.NONE was specified
* @throws CertificateException when failing to get the certificate type
* of the issuing certificate
*/
public static GSIConstants.CertificateType decideProxyType(
X509Certificate issuerCert, GSIConstants.DelegationType delegType)
throws CertificateException {
GSIConstants.CertificateType proxyType = GSIConstants.CertificateType.UNDEFINED;
if (delegType == GSIConstants.DelegationType.LIMITED) {
GSIConstants.CertificateType type = BouncyCastleUtil.getCertificateType(issuerCert);
if (ProxyCertificateUtil.isGsi4Proxy(type)) {
proxyType = GSIConstants.CertificateType.GSI_4_LIMITED_PROXY;
} else if (ProxyCertificateUtil.isGsi3Proxy(type)) {
proxyType = GSIConstants.CertificateType.GSI_3_LIMITED_PROXY;
} else if (ProxyCertificateUtil.isGsi2Proxy(type)) {
proxyType = GSIConstants.CertificateType.GSI_2_LIMITED_PROXY;
} else {
// default to RFC compliant proxy
if (VersionUtil.isGsi2Enabled()) {
proxyType = GSIConstants.CertificateType.GSI_2_LIMITED_PROXY;
} else {
proxyType = VersionUtil.isGsi3Enabled() ?
GSIConstants.CertificateType.GSI_3_LIMITED_PROXY
: GSIConstants.CertificateType.GSI_4_LIMITED_PROXY;
}
}
} else if (delegType == GSIConstants.DelegationType.FULL) {
GSIConstants.CertificateType type = BouncyCastleUtil.getCertificateType(issuerCert);
if (ProxyCertificateUtil.isGsi4Proxy(type)) {
proxyType = GSIConstants.CertificateType.GSI_4_IMPERSONATION_PROXY;
} else if (ProxyCertificateUtil.isGsi3Proxy(type)) {
proxyType = GSIConstants.CertificateType.GSI_3_IMPERSONATION_PROXY;
} else if (ProxyCertificateUtil.isGsi2Proxy(type)) {
proxyType = GSIConstants.CertificateType.GSI_2_PROXY;
} else {
// Default to RFC complaint proxy
if (VersionUtil.isGsi2Enabled()) {
proxyType = GSIConstants.CertificateType.GSI_2_PROXY;
} else {
proxyType = (VersionUtil.isGsi3Enabled()) ?
GSIConstants.CertificateType.GSI_3_IMPERSONATION_PROXY
: GSIConstants.CertificateType.GSI_4_IMPERSONATION_PROXY;
}
}
}
return proxyType;
}
/**
* Returns a chain of X509Certificate's that are instances of X509CertificateObject
* This is related to http://bugzilla.globus.org/globus/show_bug.cgi?id=4933
* @param certs input certificate chain
* @return a new chain where all X509Certificate's are instances of X509CertificateObject
* @throws GeneralSecurityException when failing to get load certificate from encoding
*/
protected X509Certificate[] getX509CertificateObjectChain(X509Certificate[] certs)
throws GeneralSecurityException {
X509Certificate[] bcCerts = new X509Certificate[certs.length];
for (int i = 0; i < certs.length; i++) {
if (!(certs[i] instanceof X509CertificateObject)) {
bcCerts[i] = CertificateLoadUtil.loadCertificate(new ByteArrayInputStream(certs[i].getEncoded()));
} else {
bcCerts[i] = certs[i];
}
}
return bcCerts;
}
}
BouncyCastleOpenSSLKey.java 0000664 0000000 0000000 00000013541 12411160572 0033213 0 ustar 00root root 0000000 0000000 JGlobus-JGlobus-Release-2.1.0/ssl-proxies/src/main/java/org/globus/gsi/bc /*
* Copyright 1999-2010 University of Chicago
*
* Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in
* compliance with the License. You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software distributed under the License is
* distributed on an "AS IS" BASIS,WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either
* express or implied.
*
* See the License for the specific language governing permissions and limitations under the License.
*/
package org.globus.gsi.bc;
import org.apache.commons.logging.LogFactory;
import org.apache.commons.logging.Log;
import java.io.ByteArrayInputStream;
import java.io.IOException;
import java.io.InputStream;
import java.security.GeneralSecurityException;
import java.security.KeyFactory;
import java.security.PrivateKey;
import java.security.Security;
import java.security.interfaces.RSAPrivateCrtKey;
import java.security.spec.PKCS8EncodedKeySpec;
import org.bouncycastle.asn1.ASN1InputStream;
import org.bouncycastle.asn1.ASN1Primitive;
import org.bouncycastle.asn1.ASN1Sequence;
import org.bouncycastle.asn1.DERObjectIdentifier;
import org.bouncycastle.asn1.pkcs.PKCSObjectIdentifiers;
import org.bouncycastle.asn1.pkcs.PrivateKeyInfo;
import org.bouncycastle.asn1.pkcs.RSAPrivateKeyStructure;
import org.bouncycastle.asn1.x509.AlgorithmIdentifier;
import org.bouncycastle.jce.provider.BouncyCastleProvider;
import org.globus.gsi.OpenSSLKey;
/**
* BouncyCastle-based implementation of OpenSSLKey.
*
* @version ${version}
* @since 1.0
*/
public class BouncyCastleOpenSSLKey extends OpenSSLKey {
private static final long serialVersionUID = 1L;
private Log logger = LogFactory.getLog(getClass().getCanonicalName());
static {
Security.addProvider(new BouncyCastleProvider());
}
/**
* Reads a OpenSSL private key from the specified input stream. The private
* key must be PEM encoded and can be encrypted.
*
* @param is
* input stream with OpenSSL key in PEM format.
* @throws IOException
* if I/O problems.
* @throws GeneralSecurityException
* if problems with the key
*/
public BouncyCastleOpenSSLKey(InputStream is) throws IOException,
GeneralSecurityException {
super(is);
}
/**
* Reads a OpenSSL private key from the specified file. The private key must
* be PEM encoded and can be encrypted.
*
* @param file
* file containing the OpenSSL key in PEM format.
* @throws IOException
* if I/O problems.
* @throws GeneralSecurityException
* if problems with the key
*/
public BouncyCastleOpenSSLKey(String file) throws IOException,
GeneralSecurityException {
super(file);
}
/**
* Converts a RSAPrivateCrtKey into OpenSSL key.
*
* @param key
* private key - must be a RSAPrivateCrtKey
*/
public BouncyCastleOpenSSLKey(PrivateKey key) {
super(key);
}
/**
* Initializes the OpenSSL key from raw byte array.
*
* @param algorithm
* the algorithm of the key. Currently only RSA algorithm is
* supported.
* @param data
* the DER encoded key data. If RSA algorithm, the key must be in
* PKCS#1 format.
* @throws GeneralSecurityException
* if any security problems.
*/
public BouncyCastleOpenSSLKey(String algorithm, byte[] data)
throws GeneralSecurityException {
super(algorithm, data);
}
protected PrivateKey getKey(String alg, byte[] data)
throws GeneralSecurityException {
if (alg.equals("RSA")) {
try {
if (data.length == 0) {
throw new GeneralSecurityException(
"Cannot process empty byte stream.");
}
ByteArrayInputStream bis = new ByteArrayInputStream(data);
ASN1InputStream derin = new ASN1InputStream(bis);
ASN1Primitive keyInfo = derin.readObject();
DERObjectIdentifier rsaOid = PKCSObjectIdentifiers.rsaEncryption;
AlgorithmIdentifier rsa = new AlgorithmIdentifier(rsaOid);
PrivateKeyInfo pkeyinfo = new PrivateKeyInfo(rsa, keyInfo);
ASN1Primitive derkey = pkeyinfo.toASN1Primitive();
byte[] keyData = BouncyCastleUtil.toByteArray(derkey);
// The DER object needs to be mangled to
// create a proper ProvateKeyInfo object
PKCS8EncodedKeySpec spec = new PKCS8EncodedKeySpec(keyData);
KeyFactory kfac = KeyFactory.getInstance("RSA");
return kfac.generatePrivate(spec);
} catch (IOException e) {
// that should never happen
return null;
}
} else {
return null;
}
}
protected byte[] getEncoded(PrivateKey key) {
String format = key.getFormat();
if (format != null
&& (format.equalsIgnoreCase("PKCS#8") || format
.equalsIgnoreCase("PKCS8"))) {
try {
ASN1Primitive keyInfo = BouncyCastleUtil.toASN1Primitive(key
.getEncoded());
PrivateKeyInfo pkey = new PrivateKeyInfo((ASN1Sequence) keyInfo);
ASN1Primitive derKey = pkey.getPrivateKey();
return BouncyCastleUtil.toByteArray(derKey);
} catch (IOException e) {
// that should never happen
logger.warn("This shouldn't have happened.", e);
return new byte[] {};
}
} else if (format != null && format.equalsIgnoreCase("PKCS#1")
&& key instanceof RSAPrivateCrtKey) {
// this condition will rarely be true
RSAPrivateCrtKey pKey = (RSAPrivateCrtKey) key;
RSAPrivateKeyStructure st = new RSAPrivateKeyStructure(pKey
.getModulus(), pKey.getPublicExponent(), pKey
.getPrivateExponent(), pKey.getPrimeP(), pKey.getPrimeQ(),
pKey.getPrimeExponentP(), pKey.getPrimeExponentQ(), pKey
.getCrtCoefficient());
ASN1Primitive ob = st.toASN1Primitive();
try {
return BouncyCastleUtil.toByteArray(ob);
} catch (IOException e) {
// that should never happen
return new byte[0];
}
} else {
return new byte[0];
}
}
protected String getProvider() {
return "BC";
}
}
JGlobus-JGlobus-Release-2.1.0/ssl-proxies/src/main/java/org/globus/gsi/bc/BouncyCastleUtil.java 0000664 0000000 0000000 00000053103 12411160572 0032251 0 ustar 00root root 0000000 0000000 /*
* Copyright 1999-2010 University of Chicago
*
* Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in
* compliance with the License. You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software distributed under the License is
* distributed on an "AS IS" BASIS,WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either
* express or implied.
*
* See the License for the specific language governing permissions and limitations under the License.
*/
package org.globus.gsi.bc;
import java.io.ByteArrayInputStream;
import java.io.ByteArrayOutputStream;
import java.io.IOException;
import java.security.Security;
import java.security.cert.CertStore;
import java.security.cert.CertificateEncodingException;
import java.security.cert.CertificateException;
import java.security.cert.X509CertSelector;
import java.security.cert.X509Certificate;
import java.util.Collection;
import javax.naming.InvalidNameException;
import javax.naming.ldap.LdapName;
import javax.security.auth.x500.X500Principal;
import org.bouncycastle.asn1.ASN1InputStream;
import org.bouncycastle.asn1.ASN1OctetString;
import org.bouncycastle.asn1.ASN1Primitive;
import org.bouncycastle.asn1.ASN1Sequence;
import org.bouncycastle.asn1.ASN1Set;
import org.bouncycastle.asn1.ASN1String;
import org.bouncycastle.asn1.DERBitString;
import org.bouncycastle.asn1.DERObjectIdentifier;
import org.bouncycastle.asn1.DEROutputStream;
import org.bouncycastle.asn1.x500.X500Name;
import org.bouncycastle.asn1.x500.style.BCStyle;
import org.bouncycastle.asn1.x509.BasicConstraints;
import org.bouncycastle.asn1.x509.TBSCertificateStructure;
import org.bouncycastle.asn1.x509.X509Extension;
import org.bouncycastle.asn1.x509.X509Extensions;
import org.bouncycastle.asn1.x509.X509Name;
import org.bouncycastle.jce.provider.BouncyCastleProvider;
import org.globus.gsi.GSIConstants;
import org.globus.gsi.TrustedCertificates;
import org.globus.gsi.TrustedCertificatesUtil;
import org.globus.gsi.proxy.ext.ProxyCertInfo;
import org.globus.gsi.proxy.ext.ProxyPolicy;
import org.globus.gsi.util.ProxyCertificateUtil;
import org.globus.util.I18n;
// COMMENT: BCB: removed methods createCertificateType(...) that took a TBSCertificateStructure as parameter
/**
* A collection of various utility functions.
*/
public class BouncyCastleUtil {
static {
Security.addProvider(new BouncyCastleProvider());
}
private static I18n i18n =
I18n.getI18n("org.globus.gsi.errors",
BouncyCastleUtil.class.getClassLoader());
/**
* Converts given DERObject into
* a DER-encoded byte array.
*
* @param obj DERObject to convert.
* @return the DER-encoded byte array
* @exception IOException if conversion fails
*/
public static byte[] toByteArray(ASN1Primitive obj)
throws IOException {
ByteArrayOutputStream bout = new ByteArrayOutputStream();
DEROutputStream der = new DEROutputStream(bout);
der.writeObject(obj);
return bout.toByteArray();
}
/**
* Converts the DER-encoded byte array into a
* DERObject.
*
* @param data the DER-encoded byte array to convert.
* @return the DERObject.
* @exception IOException if conversion fails
*/
public static ASN1Primitive toASN1Primitive(byte[] data)
throws IOException {
ByteArrayInputStream inStream = new ByteArrayInputStream(data);
ASN1InputStream derInputStream = new ASN1InputStream(inStream);
return derInputStream.readObject();
}
/**
* Replicates a given DERObject.
*
* @param obj the DERObject to replicate.
* @return a copy of the DERObject.
* @exception IOException if replication fails
*/
public static ASN1Primitive duplicate(ASN1Primitive obj)
throws IOException {
return toASN1Primitive(toByteArray(obj));
}
/**
* Extracts the TBS certificate from the given certificate.
*
* @param cert the X.509 certificate to extract the TBS certificate from.
* @return the TBS certificate
* @exception IOException if extraction fails.
* @exception CertificateEncodingException if extraction fails.
*/
public static TBSCertificateStructure getTBSCertificateStructure(X509Certificate cert)
throws CertificateEncodingException, IOException {
ASN1Primitive obj = BouncyCastleUtil.toASN1Primitive(cert.getTBSCertificate());
return TBSCertificateStructure.getInstance(obj);
}
/**
* Extracts the value of a certificate extension.
*
* @param ext the certificate extension to extract the value from.
* @exception IOException if extraction fails.
*/
public static ASN1Primitive getExtensionObject(X509Extension ext)
throws IOException {
return toASN1Primitive(ext.getValue().getOctets());
}
/**
* Returns certificate type of the given certificate.
* Please see {@link #getCertificateType(TBSCertificateStructure,
* TrustedCertificates) getCertificateType} for details for
* determining the certificate type.
*
* @param cert the certificate to get the type of.
* @param trustedCerts the trusted certificates to double check the
* {@link GSIConstants#EEC GSIConstants.EEC}
* certificate against.
* @return the certificate type as determined by
* {@link #getCertificateType(TBSCertificateStructure,
* TrustedCertificates) getCertificateType}.
* @exception CertificateException if something goes wrong.
* @deprecated
*/
public static GSIConstants.CertificateType getCertificateType(X509Certificate cert,
TrustedCertificates trustedCerts)
throws CertificateException {
try {
return getCertificateType(cert, TrustedCertificatesUtil.createCertStore(trustedCerts));
} catch (Exception e) {
throw new CertificateException("", e);
}
}
/**
* Returns the certificate type of the given certificate.
* Please see {@link #getCertificateType(TBSCertificateStructure,
* TrustedCertificates) getCertificateType} for details for
* determining the certificate type.
*
* @param cert the certificate to get the type of.
* @param trustedCerts the trusted certificates to double check the
* {@link GSIConstants#EEC GSIConstants.EEC}
* certificate against.
* @return the certificate type as determined by
* {@link #getCertificateType(TBSCertificateStructure,
* TrustedCertificates) getCertificateType}.
* @exception CertificateException if something goes wrong.
*/
public static GSIConstants.CertificateType getCertificateType(X509Certificate cert, CertStore trustedCerts)
throws CertificateException {
try {
TBSCertificateStructure crt = getTBSCertificateStructure(cert);
GSIConstants.CertificateType type = getCertificateType(crt);
// check subject of the cert in trusted cert list
// to make sure the cert is not a ca cert
if (type == GSIConstants.CertificateType.EEC) {
X509CertSelector selector = new X509CertSelector();
selector.setSubject(cert.getSubjectX500Principal());
Collection c = trustedCerts.getCertificates(selector);
if (c != null && c.size() > 0) {
type = GSIConstants.CertificateType.CA;
}
}
return type;
} catch (Exception e) {
// but this should not happen
throw new CertificateException("", e);
}
}
/**
* Returns certificate type of the given certificate.
* Please see {@link #getCertificateType(TBSCertificateStructure)
* getCertificateType} for details for determining the certificate type.
*
* @param cert the certificate to get the type of.
* @return the certificate type as determined by
* {@link #getCertificateType(TBSCertificateStructure)
* getCertificateType}.
* @exception CertificateException if something goes wrong.
*/
public static GSIConstants.CertificateType getCertificateType(X509Certificate cert)
throws CertificateException {
try {
TBSCertificateStructure crt = getTBSCertificateStructure(cert);
return getCertificateType(crt);
} catch (IOException e) {
// but this should not happen
throw new CertificateException("", e);
}
}
public static GSIConstants.CertificateType getCertificateType(TBSCertificateStructure crt, TrustedCertificates trustedCerts)
throws CertificateException, IOException {
GSIConstants.CertificateType type = getCertificateType(crt);
// check subject of the cert in trusted cert list
// to make sure the cert is not a ca cert
if (type == GSIConstants.CertificateType.EEC) {
if (trustedCerts == null) {
trustedCerts = TrustedCertificates.getDefaultTrustedCertificates();
}
if (trustedCerts != null && trustedCerts.getCertificate(crt.getSubject().toString()) != null) {
type = GSIConstants.CertificateType.CA;
}
}
return type;
}
/**
* Returns certificate type of the given TBS certificate.
* The certificate type is {@link GSIConstants#CA GSIConstants.CA}
* only if the certificate contains a
* BasicConstraints extension and it is marked as CA.
* A certificate is a GSI-2 proxy when the subject DN of the certificate
* ends with "CN=proxy" (certificate type {@link
* GSIConstants#GSI_2_PROXY GSIConstants.GSI_2_PROXY}) or
* "CN=limited proxy" (certificate type {@link
* GSIConstants#GSI_2_LIMITED_PROXY GSIConstants.LIMITED_PROXY}) component
* and the issuer DN of the certificate matches the subject DN without
* the last proxy CN component.
* A certificate is a GSI-3 proxy when the subject DN of the certificate
* ends with a CN component, the issuer DN of the certificate
* matches the subject DN without the last CN component and
* the certificate contains {@link ProxyCertInfo ProxyCertInfo} critical
* extension.
* The certificate type is {@link GSIConstants#GSI_3_IMPERSONATION_PROXY
* GSIConstants.GSI_3_IMPERSONATION_PROXY} if the policy language of
* the {@link ProxyCertInfo ProxyCertInfo} extension is set to
* {@link ProxyPolicy#IMPERSONATION ProxyPolicy.IMPERSONATION} OID.
* The certificate type is {@link GSIConstants#GSI_3_LIMITED_PROXY
* GSIConstants.GSI_3_LIMITED_PROXY} if the policy language of
* the {@link ProxyCertInfo ProxyCertInfo} extension is set to
* {@link ProxyPolicy#LIMITED ProxyPolicy.LIMITED} OID.
* The certificate type is {@link GSIConstants#GSI_3_INDEPENDENT_PROXY
* GSIConstants.GSI_3_INDEPENDENT_PROXY} if the policy language of
* the {@link ProxyCertInfo ProxyCertInfo} extension is set to
* {@link ProxyPolicy#INDEPENDENT ProxyPolicy.INDEPENDENT} OID.
* The certificate type is {@link GSIConstants#GSI_3_RESTRICTED_PROXY
* GSIConstants.GSI_3_RESTRICTED_PROXY} if the policy language of
* the {@link ProxyCertInfo ProxyCertInfo} extension is set to
* any other OID then the above.
* The certificate type is {@link GSIConstants#EEC GSIConstants.EEC}
* if the certificate is not a CA certificate or a GSI-2 or GSI-3 proxy.
*
* @param crt the TBS certificate to get the type of.
* @return the certificate type. The certificate type is determined
* by rules described above.
* @exception IOException if something goes wrong.
* @exception CertificateException for proxy certificates, if
* the issuer DN of the certificate does not match
* the subject DN of the certificate without the
* last CN component. Also, for GSI-3 proxies
* when the ProxyCertInfo extension is
* not marked as critical.
*/
private static GSIConstants.CertificateType getCertificateType(TBSCertificateStructure crt)
throws CertificateException, IOException {
X509Extensions extensions = crt.getExtensions();
X509Extension ext = null;
if (extensions != null) {
ext = extensions.getExtension(X509Extension.basicConstraints);
if (ext != null) {
BasicConstraints basicExt = BasicConstraints.getInstance(ext);
if (basicExt.isCA()) {
return GSIConstants.CertificateType.CA;
}
}
}
GSIConstants.CertificateType type = GSIConstants.CertificateType.EEC;
// does not handle multiple AVAs
X500Name subject = crt.getSubject();
ASN1Set entry = X509NameHelper.getLastNameEntry(subject);
ASN1Sequence ava = (ASN1Sequence)entry.getObjectAt(0);
if (BCStyle.CN.equals(ava.getObjectAt(0))) {
String value = ((ASN1String)ava.getObjectAt(1)).getString();
if (value.equalsIgnoreCase("proxy")) {
type = GSIConstants.CertificateType.GSI_2_PROXY;
} else if (value.equalsIgnoreCase("limited proxy")) {
type = GSIConstants.CertificateType.GSI_2_LIMITED_PROXY;
} else if (extensions != null) {
boolean gsi4 = true;
// GSI_4
ext = extensions.getExtension(ProxyCertInfo.OID);
if (ext == null) {
// GSI_3
ext = extensions.getExtension(ProxyCertInfo.OLD_OID);
gsi4 = false;
}
if (ext != null) {
if (ext.isCritical()) {
ProxyCertInfo proxyCertExt = getProxyCertInfo(ext);
ProxyPolicy proxyPolicy =
proxyCertExt.getProxyPolicy();
DERObjectIdentifier oid =
proxyPolicy.getPolicyLanguage();
if (ProxyPolicy.IMPERSONATION.equals(oid)) {
if (gsi4) {
type = GSIConstants.CertificateType.GSI_4_IMPERSONATION_PROXY;
} else {
type = GSIConstants.CertificateType.GSI_3_IMPERSONATION_PROXY;
}
} else if (ProxyPolicy.INDEPENDENT.equals(oid)) {
if (gsi4) {
type = GSIConstants.CertificateType.GSI_4_INDEPENDENT_PROXY;
} else {
type = GSIConstants.CertificateType.GSI_3_INDEPENDENT_PROXY;
}
} else if (ProxyPolicy.LIMITED.equals(oid)) {
if (gsi4) {
type = GSIConstants.CertificateType.GSI_4_LIMITED_PROXY;
} else {
type = GSIConstants.CertificateType.GSI_3_LIMITED_PROXY;
}
} else {
if (gsi4) {
type = GSIConstants.CertificateType.GSI_4_RESTRICTED_PROXY;
} else {
type = GSIConstants.CertificateType.GSI_3_RESTRICTED_PROXY;
}
}
} else {
String err = i18n.getMessage("proxyCertCritical");
throw new CertificateException(err);
}
}
}
if (ProxyCertificateUtil.isProxy(type)) {
X509NameHelper iss = new X509NameHelper(crt.getIssuer());
iss.add((ASN1Set)BouncyCastleUtil.duplicate(entry));
X509Name issuer = iss.getAsName();
if (!issuer.equals(X509Name.getInstance(subject))) {
String err = i18n.getMessage("proxyDNErr");
throw new CertificateException(err);
}
}
}
return type;
}
/**
* Gets a boolean array representing bits of the KeyUsage extension.
*
* @see java.security.cert.X509Certificate#getKeyUsage
* @exception IOException if failed to extract the KeyUsage extension value.
*/
public static boolean[] getKeyUsage(X509Extension ext)
throws IOException {
DERBitString bits = (DERBitString)getExtensionObject(ext);
// copied from X509CertificateObject
byte [] bytes = bits.getBytes();
int length = (bytes.length * 8) - bits.getPadBits();
boolean[] keyUsage = new boolean[(length < 9) ? 9 : length];
for (int i = 0; i != length; i++) {
keyUsage[i] = (bytes[i / 8] & (0x80 >>> (i % 8))) != 0;
}
return keyUsage;
}
/**
* Creates a ProxyCertInfo object from given
* extension.
*
* @param ext the extension.
* @return the ProxyCertInfo object.
* @exception IOException if something fails.
*/
public static ProxyCertInfo getProxyCertInfo(X509Extension ext)
throws IOException {
return ProxyCertInfo.getInstance(BouncyCastleUtil.getExtensionObject(ext));
}
/**
* Returns the subject DN of the given certificate in the Globus format.
*
* @param cert the certificate to get the subject of. The certificate
* must be of X509CertificateObject type.
* @return the subject DN of the certificate in the Globus format.
*/
public static String getIdentity(X509Certificate cert) {
if (cert == null) {
return null;
}
String subjectDN = cert.getSubjectX500Principal().getName(X500Principal.RFC2253);
X509Name name = new X509Name(true, subjectDN);
return X509NameHelper.toString(name);
}
public static String getIdentityPrefix(X509Certificate cert) {
if (cert == null) {
return null;
}
String subjectDN = cert.getSubjectX500Principal().getName(X500Principal.RFC2253);
LdapName ldapname = null;
try {
ldapname = new LdapName(subjectDN);
ldapname.remove(ldapname.size() - 1);
} catch (InvalidNameException e) {
return null;
}
X509Name name = new X509Name(true, ldapname.toString());
return X509NameHelper.toString(name);
}
/**
* Finds the identity certificate in the given chain and
* returns the subject DN of that certificate in the Globus format.
*
* @param chain the certificate chain to find the identity
* certificate in. The certificates must be
* of X509CertificateObject type.
* @return the subject DN of the identity certificate in
* the Globus format.
* @exception CertificateException if something goes wrong.
*/
public static String getIdentity(X509Certificate [] chain)
throws CertificateException {
return getIdentity(getIdentityCertificate(chain));
}
/**
* Finds the identity certificate in the given chain.
* The identity certificate is the first certificate in the
* chain that is not an impersonation proxy (full or limited)
*
* @param chain the certificate chain to find the identity
* certificate in.
* @return the identity certificate.
* @exception CertificateException if something goes wrong.
*/
public static X509Certificate getIdentityCertificate(X509Certificate [] chain)
throws CertificateException {
if (chain == null) {
throw new IllegalArgumentException(i18n.getMessage("certChainNull"));
}
GSIConstants.CertificateType certType;
for (int i=0;iX500Name
*/
public X509NameHelper(X500Name name) {
try {
this.seq = (ASN1Sequence)BouncyCastleUtil.duplicate(name.toASN1Primitive());
} catch (IOException e) {
throw new RuntimeException(e.getMessage());
}
}
/**
* Creates an instance using existing {@link X509Name X509Name}
* object.
* This behaves like a copy constructor.
*
* @param name existing X509Name
*/
public X509NameHelper(X509Name name) {
try {
this.seq = (ASN1Sequence)BouncyCastleUtil.duplicate(name.toASN1Primitive());
} catch (IOException e) {
throw new RuntimeException(e.getMessage());
}
}
/**
* Converts to {@link X509Name X509Name} object.
*
* @return the X509Name object.
*/
public X509Name getAsName() {
return new X509Name(this.seq);
}
/**
* Appends the specified OID and value pair name component to the end of the
* current name.
*
* @param oid the name component oid, e.g. {@link org.bouncycastle.asn1.x500.style.BCStyle#CN
* BCStyle.CN}
* @param value the value (e.g. "proxy")
*/
public void add(
DERObjectIdentifier oid,
String value) {
ASN1EncodableVector v = new ASN1EncodableVector();
v.add(oid);
v.add(new DERPrintableString(value));
add(new DERSet(new DERSequence(v)));
}
/**
* Appends the specified name component entry to the current name. This can
* be used to add handle multiple AVAs in one name component.
*
* @param entry the name component to add.
*/
public void add(ASN1Set entry) {
ASN1EncodableVector v = new ASN1EncodableVector();
int size = seq.size();
for (int i = 0; i < size; i++) {
v.add(seq.getObjectAt(i));
}
v.add(entry);
seq = new DERSequence(v);
}
/**
* Gets the name component at specified position.
*
* @return the name component the specified position.
*/
public ASN1Set getNameEntryAt(int i) {
return (ASN1Set) seq.getObjectAt(i);
}
/**
* Gets the last name component in the current name.
*
* @return the last name component. Null if there is none.
*/
public ASN1Set getLastNameEntry() {
int size = seq.size();
return (size > 0) ? getNameEntryAt(size - 1) : null;
}
/**
* Gets the last name component from the {@link X509Name X509Name} name.
*
* @return the last name component. Null if there is none.
*/
public static ASN1Set getLastNameEntry(X500Name name) {
RDN[] rdns = name.getRDNs();
int size = rdns.length;
return (size > 0) ? (ASN1Set) rdns[size - 1].toASN1Primitive() : null;
}
/**
* Returns Globus format representation of the name. It handles names with
* multiple AVAs.
*
* @param name the name to get the Globus format of.
* @return the Globus format of the name
*/
public static String toString(X509Name name) {
if (name == null) {
return null;
}
return toString((ASN1Sequence)name.toASN1Primitive());
}
private static String toString(ASN1Sequence seq) {
if (seq == null) {
return null;
}
Enumeration e = seq.getObjects();
StringBuffer buf = new StringBuffer();
while (e.hasMoreElements()) {
ASN1Set set = (ASN1Set)e.nextElement();
Enumeration ee = set.getObjects();
buf.append('/');
while (ee.hasMoreElements()) {
ASN1Sequence s = (ASN1Sequence)ee.nextElement();
DERObjectIdentifier oid = (DERObjectIdentifier)s.getObjectAt(0);
String sym = (String)X509Name.DefaultSymbols.get(oid);
if (sym == null) {
buf.append(oid.getId());
} else {
buf.append(sym);
}
buf.append('=');
buf.append(((ASN1String)s.getObjectAt(1)).getString());
if (ee.hasMoreElements()) {
buf.append('+');
}
}
}
return buf.toString();
}
/**
* Returns Globus format representation of the name.
*/
public String toString() {
return toString(this.seq);
}
}
JGlobus-JGlobus-Release-2.1.0/ssl-proxies/src/main/java/org/globus/gsi/gridmap/ 0000775 0000000 0000000 00000000000 12411160572 0027212 5 ustar 00root root 0000000 0000000 JGlobus-JGlobus-Release-2.1.0/ssl-proxies/src/main/java/org/globus/gsi/gridmap/GridMap.java 0000664 0000000 0000000 00000042156 12411160572 0031410 0 ustar 00root root 0000000 0000000 /*
* Copyright 1999-2010 University of Chicago
*
* Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in
* compliance with the License. You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software distributed under the License is
* distributed on an "AS IS" BASIS,WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either
* express or implied.
*
* See the License for the specific language governing permissions and limitations under the License.
*/
package org.globus.gsi.gridmap;
import java.util.Map;
import java.util.Vector;
import java.util.HashMap;
import java.util.Iterator;
import java.util.StringTokenizer;
import java.io.IOException;
import java.io.File;
import java.io.BufferedReader;
import java.io.InputStreamReader;
import java.io.FileInputStream;
import java.io.InputStream;
import java.io.Serializable;
import org.globus.util.I18n;
import org.globus.util.QuotedStringTokenizer;
import org.globus.util.ConfigUtil;
import org.apache.commons.logging.Log;
import org.apache.commons.logging.LogFactory;
public class GridMap implements Serializable {
private static I18n i18n =
I18n.getI18n("org.globus.gsi.gridmap.errors",
GridMap.class.getClassLoader());
private static Log logger =
LogFactory.getLog(GridMap.class.getName());
private static final String COMMENT_CHARS = "#";
// keywords that need to be replaced
private static final char[] EMAIL_KEYWORD_1 = { 'e', '=' };
private static final char[] EMAIL_KEYWORD_2 = { 'e', 'm', 'a', 'i', 'l',
'=' };
private static final char[] UID_KEYWORD = { 'u', 'i', 'd', '=' };
// Length of key words that need to be replaced
private static final int EMAIL_KEYWORD_1_L = 2;
private static final int EMAIL_KEYWORD_2_L = 6;
private static final int UID_KEYWORD_L = 4;
// Keywords to be replaced with.
private static final String EMAIL_KEYWORD = "emailaddress=";
private static final String USERID_KEYWORD = "userid=";
protected Map map;
// the file the grim map was loaded from
private File file;
// last time the file was modified
private long lastModified;
// log or throw exception on bad entries
private boolean ignoreErrors = false;
/**
* Sets whether errors in the gridmap file
* should be ignored. Errors are not ignored by default.
*
* @param ignoreErrors if true, errors in the gridmap file
* will be ignored (warnings will be logged). If false,
* an exception will be raised on errors.
*/
public void setIgnoreErrors(boolean ignoreErrors) {
this.ignoreErrors = ignoreErrors;
}
/**
* Returns whether errors in the gridmap file are
* ignored.
*
* @return true if errors in the gridmap file are ignored.
* False, otherwise.
*/
public boolean getIgnoreErrors() {
return this.ignoreErrors;
}
/**
* Returns the absolute path anme of file used to load gridmap
* either using the {@link #load(File) load} or {@link
* #load(String) load} functions. If no file was used, returns
* null.
*
* @return absolute file path, if gridmap was loaded from
* file. Null otherwise.
*/
public String getFileName() {
if (this.file == null) {
return null;
}
return this.file.getAbsolutePath();
}
/**
* Loads grid map definition from a given file.
*
* @param file the grid map file
* @exception IOException in case of I/O error or
* when there are parsing errors in the file (only when errors
* are not ignored).
* @return true if the file was parsed and loaded successfully.
* False otherwise.
*/
public boolean load(String file)
throws IOException {
return load(new File(file));
}
/**
* Loads grid map definition from a given file.
*
* @param file the grid map file
* @exception IOException in case of I/O error or
* when there are parsing errors in the file (only when errors
* are not ignored).
* @return true if the file was parsed and loaded successfully.
* False otherwise.
*/
public boolean load(File file)
throws IOException {
InputStream in = null;
try {
in = new FileInputStream(file);
this.file = file;
this.lastModified = file.lastModified();
return load(in);
} finally {
if (in != null) {
try { in.close(); } catch(Exception e) {}
}
}
}
/**
* Reloads the gridmap from a file only if the gridmap
* was initially loaded using the {@link #load(File)
* load} or {@link #load(String) load} functions.
* The file will only be reloaded if it has changed
* since the last time.
*
* @exception IOException in case of I/O error or
* when there are parsing errors in the file (only when errors
* are not ignored).
* @return true if the file was parsed and refreshed successfully.
* False otherwise.
*/
public boolean refresh()
throws IOException {
if (this.file != null &&
this.file.lastModified() != this.lastModified) {
return load(this.file);
} else {
return true;
}
}
/**
* Loads grid map file definition from a given input stream. The input
* stream is not closed in case of an error.
*
* @param input the input stream that contains the gridmap
* definitions.
* @exception IOException in case of I/O error or
* when there are parsing errors in the input (only when errors
* are not ignored).
* @return true if the input was parsed successfully.
* False otherwise.
*/
public boolean load(InputStream input)
throws IOException {
boolean success = true;
BufferedReader reader =
new BufferedReader(new InputStreamReader(input));
Map localMap = new HashMap();
GridMapEntry entry;
QuotedStringTokenizer tokenizer;
StringTokenizer idTokenizer;
String line;
while( (line = reader.readLine()) != null) {
line = line.trim();
if ( (line.length() == 0) ||
( COMMENT_CHARS.indexOf(line.charAt(0)) != -1) ) {
continue;
}
tokenizer = new QuotedStringTokenizer(line);
String globusID = null;
if (tokenizer.hasMoreTokens()) {
globusID = tokenizer.nextToken();
} else {
if (this.ignoreErrors) {
success = false;
logger.warn("Globus ID missing: " + line);
continue;
} else {
throw new IOException(i18n.getMessage("globusIdErr",
line));
}
}
String userIDs = null;
if (tokenizer.hasMoreTokens()) {
userIDs = tokenizer.nextToken();
} else {
if (this.ignoreErrors) {
success = false;
logger.warn("User ID mapping missing: " + line);
continue;
} else {
throw new IOException(i18n.getMessage("userIdErr", line));
}
}
idTokenizer = new StringTokenizer(userIDs, ",");
String [] ids = new String [ idTokenizer.countTokens() ];
int i = 0;
while(idTokenizer.hasMoreTokens()) {
ids[i++] = idTokenizer.nextToken();
}
String normalizedDN = normalizeDN(globusID);
entry = (GridMapEntry)localMap.get(normalizedDN);
if (entry == null) {
entry = new GridMapEntry();
entry.setGlobusID(globusID);
entry.setUserIDs(ids);
localMap.put(normalizedDN, entry);
} else {
entry.addUserIDs(ids);
}
}
this.map = localMap;
return success;
}
/**
* Returns first local user name mapped to the specified
* globusID.
*
* @param globusID globusID
* @return local user name for the specified globusID.
* Null if the globusID is not mapped
* to a local user name.
*/
public String getUserID(String globusID) {
String [] ids = getUserIDs(globusID);
if (ids != null && ids.length > 0) {
return ids[0];
} else {
return null;
}
}
/**
* Returns local user names mapped to the specified
* globusID.
*
* @param globusID globusID
* @return array of local user names for the specified globusID.
* Null if the globusID is not mapped
* to any local user name.
*/
public String[] getUserIDs(String globusID) {
if (globusID == null) {
throw new IllegalArgumentException(i18n
.getMessage("globusIdNull"));
}
if (this.map == null) {
return null;
}
GridMapEntry entry = (GridMapEntry)this.map.get(normalizeDN(globusID));
return (entry == null) ? null : entry.getUserIDs();
}
/**
* Checks if a given globus ID is associated with given
* local user account.
*
* @param globusID globus ID
* @param userID userID
* @return true if globus ID is associated with given local
* user account, false, otherwise.
*/
public boolean checkUser(String globusID, String userID) {
if (globusID == null) {
throw new IllegalArgumentException(i18n.getMessage("glousIdNull"));
}
if (userID == null) {
throw new IllegalArgumentException(i18n.getMessage("userIdNull"));
}
if (this.map == null) {
return false;
}
GridMapEntry entry = (GridMapEntry)this.map.get(normalizeDN(globusID));
return (entry == null) ? false : entry.containsUserID(userID);
}
/**
* Returns globus ID associated with the
* specified local user name.
*
* @param userID local user name
* @return associated globus ID, null
* if there is not any.
*/
public String getGlobusID(String userID) {
if (userID == null) {
throw new IllegalArgumentException(i18n.getMessage("userIdNull"));
}
if (this.map == null) {
return null;
}
Iterator iter = this.map.entrySet().iterator();
Map.Entry mapEntry;
GridMapEntry entry;
while(iter.hasNext()) {
mapEntry = (Map.Entry)iter.next();
entry = (GridMapEntry)mapEntry.getValue();
if (entry.containsUserID(userID)) {
return entry.getGlobusID();
}
}
return null;
}
/**
* Returns all globus IDs associated with the
* specified local user name.
*
* @param userID local user name
* @return associated globus ID, null
* if there is not any.
*/
public String[] getAllGlobusID(String userID) {
if (userID == null) {
throw new IllegalArgumentException(i18n.getMessage("userIdNull"));
}
if (this.map == null) {
return null;
}
Vector v = new Vector();
Iterator iter = this.map.entrySet().iterator();
Map.Entry mapEntry;
GridMapEntry entry;
while(iter.hasNext()) {
mapEntry = (Map.Entry)iter.next();
entry = (GridMapEntry)mapEntry.getValue();
if (entry.containsUserID(userID)) {
v.add(entry.getGlobusID());
}
}
// create array of strings and add values back in
if(v.size() == 0) {
return null;
}
String idS[] = new String[v.size()];
for(int ctr = 0; ctr < v.size(); ctr++) {
idS[ctr] = (String) v.elementAt(ctr);
}
return idS;
}
public void map(String globusID, String userID) {
if (globusID == null) {
throw new IllegalArgumentException(i18n
.getMessage("globusIdNull"));
}
if (userID == null) {
throw new IllegalArgumentException(i18n.getMessage("userIdNull"));
}
if (this.map == null) {
this.map = new HashMap();
}
String normalizedDN = normalizeDN(globusID);
GridMapEntry entry = (GridMapEntry)this.map.get(normalizedDN);
if (entry == null) {
entry = new GridMapEntry();
entry.setGlobusID(globusID);
entry.setUserIDs(new String [] {userID});
this.map.put(normalizedDN, entry);
} else {
entry.addUserID(userID);
}
}
static class GridMapEntry implements Serializable {
String globusID;
String[] userIDs;
public String getFirstUserID() {
return userIDs[0];
}
public String[] getUserIDs() {
return userIDs;
}
public String getGlobusID() {
return globusID;
}
public void setGlobusID(String globusID) {
this.globusID = globusID;
}
public void setUserIDs(String [] userIDs) {
this.userIDs = userIDs;
}
public boolean containsUserID(String userID) {
if (userID == null) {
return false;
}
for (int i=0;iJaasSubject API to circumvent
* the JAAS problem of Subject propagation. The implementation uses
* a stackable version of
* {@link java.lang.InheritableThreadLocal InheritableThreadLocal}
* class to associate the Subject object with the current thread.
* Any new thread started within a thread that has a Subject object
* associated with it, will inherit the parent's Subject object.
* Also, nested doAs, runAs calls are supported.
*/
public class GlobusSubject extends JaasSubject {
private static StackableInheritableThreadLocal subjects =
new StackableInheritableThreadLocal();
protected GlobusSubject() {
super();
}
public Subject getSubject() {
return (Subject)subjects.peek();
}
public Object runAs(Subject subject, PrivilegedAction action) {
subjects.push(subject);
try {
return Subject.doAs(subject, action);
} finally {
subjects.pop();
}
}
public Object runAs(Subject subject, PrivilegedExceptionAction action)
throws PrivilegedActionException {
subjects.push(subject);
try {
return Subject.doAs(subject, action);
} finally {
subjects.pop();
}
}
}
class StackableInheritableThreadLocal extends InheritableThreadLocal {
protected Object initialValue() {
return new LinkedList();
}
protected Object childValue(Object parentValue) {
LinkedList list = (LinkedList)parentValue;
LinkedList newList = new LinkedList();
if (!list.isEmpty()) {
newList.add(list.getLast());
}
return newList;
}
public void push(Object object) {
LinkedList list = (LinkedList)get();
list.add(object);
}
public Object pop() {
LinkedList list = (LinkedList)get();
return (list.isEmpty()) ? null : list.removeLast();
}
public Object peek() {
LinkedList list = (LinkedList)get();
return (list.isEmpty()) ? null : list.getLast();
}
}
JGlobus-JGlobus-Release-2.1.0/ssl-proxies/src/main/java/org/globus/gsi/gssapi/jaas/JaasSubject.java 0000664 0000000 0000000 00000007600 12411160572 0033037 0 ustar 00root root 0000000 0000000 /*
* Copyright 1999-2010 University of Chicago
*
* Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in
* compliance with the License. You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software distributed under the License is
* distributed on an "AS IS" BASIS,WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either
* express or implied.
*
* See the License for the specific language governing permissions and limitations under the License.
*/
package org.globus.gsi.gssapi.jaas;
import org.globus.util.I18n;
import javax.security.auth.Subject;
import java.security.PrivilegedAction;
import java.security.PrivilegedExceptionAction;
import java.security.PrivilegedActionException;
/**
* Generic JAAS Subject helper API that provides abstraction layer on top of
* vendor-specific JAAS Subject extensions implementations.
* Most vendors defined their own JAAS Subject helper classes because of the
*
* Subject propagation issue in JAAS.
*/
public abstract class JaasSubject {
private static I18n i18n =
I18n.getI18n("org.globus.gsi.gssapi.errors",
JaasSubject.class.getClassLoader());
private static JaasSubject subject;
protected JaasSubject() {}
/**
* Gets current implementation of the JaasSubject API.
* The method attempts to load a JaasSubject implementation
* by loading a class specified by the
* "org.globus.jaas.provider" system property. If the property
* is not set the default Globus implementation is loaded.
*/
public static synchronized JaasSubject getJaasSubject() {
if (subject == null) {
String className = System.getProperty("org.globus.jaas.provider");
if (className == null) {
className = "org.globus.gsi.gssapi.jaas.GlobusSubject";
}
try {
Class clazz = Class.forName(className);
if (!JaasSubject.class.isAssignableFrom(clazz)) {
throw new RuntimeException(i18n.getMessage("invalidJaasSubject",
className));
}
subject = (JaasSubject)clazz.newInstance();
} catch (ClassNotFoundException e) {
throw new RuntimeException(i18n.getMessage("loadError", className) +
e.getMessage());
} catch (InstantiationException e) {
throw new RuntimeException(i18n.getMessage("instanError", className) +
e.getMessage());
} catch (IllegalAccessException e) {
throw new RuntimeException(i18n.getMessage("instanError", className), e);
}
}
return subject;
}
// SPI
/**
* SPI method.
*/
public abstract Subject getSubject();
/**
* SPI method.
*/
public abstract Object runAs(Subject subject, PrivilegedAction action);
/**
* SPI method.
*/
public abstract Object runAs(Subject subject, PrivilegedExceptionAction action)
throws PrivilegedActionException;
// API
/**
* A convenience method, calls
* JaasSubject.getJaasSubject().runAs().
*/
public static Object doAs(Subject subject, PrivilegedExceptionAction action)
throws PrivilegedActionException {
return JaasSubject.getJaasSubject().runAs(subject, action);
}
/**
* A convenience method, calls
* JaasSubject.getJaasSubject().runAs().
*/
public static Object doAs(Subject subject, PrivilegedAction action) {
return JaasSubject.getJaasSubject().runAs(subject, action);
}
/**
* A convenience method, calls
* JaasSubject.getJaasSubject().getSubject().
*/
public static Subject getCurrentSubject() {
return JaasSubject.getJaasSubject().getSubject();
}
}
PasswordCredential.java 0000664 0000000 0000000 00000002425 12411160572 0034357 0 ustar 00root root 0000000 0000000 JGlobus-JGlobus-Release-2.1.0/ssl-proxies/src/main/java/org/globus/gsi/gssapi/jaas /*
* Copyright 1999-2010 University of Chicago
*
* Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in
* compliance with the License. You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software distributed under the License is
* distributed on an "AS IS" BASIS,WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either
* express or implied.
*
* See the License for the specific language governing permissions and limitations under the License.
*/
package org.globus.gsi.gssapi.jaas;
import java.io.Serializable;
public class PasswordCredential implements Serializable {
private char[] password;
public PasswordCredential(String password) {
this.password = password.toCharArray();
}
public String getPassword() {
return new String(this.password);
}
public boolean equals(Object another) {
if (!(another instanceof PasswordCredential)) {
return false;
}
String pass = ((PasswordCredential)another).getPassword();
if (this.password == null) {
return (pass == null);
} else {
return (new String(this.password)).equals(pass);
}
}
public String toString() {
return getPassword();
}
}
SimplePrincipal.java 0000664 0000000 0000000 00000002642 12411160572 0033656 0 ustar 00root root 0000000 0000000 JGlobus-JGlobus-Release-2.1.0/ssl-proxies/src/main/java/org/globus/gsi/gssapi/jaas /*
* Copyright 1999-2010 University of Chicago
*
* Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in
* compliance with the License. You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software distributed under the License is
* distributed on an "AS IS" BASIS,WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either
* express or implied.
*
* See the License for the specific language governing permissions and limitations under the License.
*/
package org.globus.gsi.gssapi.jaas;
import java.security.Principal;
import java.io.Serializable;
/**
* Simple string-based principal.
*/
public class SimplePrincipal
implements Principal, Serializable {
private String name;
public SimplePrincipal() {
}
public SimplePrincipal(String name) {
this.name = name;
}
public String getName() {
return this.name;
}
public int hashCode() {
return (this.name == null) ? 0 : this.name.hashCode();
}
public boolean equals(Object another) {
if (!(another instanceof Principal)) {
return false;
}
String anotherName = ((Principal)another).getName();
if (this.name == null) {
return (this.name == anotherName);
} else {
return this.name.equals(anotherName);
}
}
public String toString() {
return getName();
}
}
StandardSubject.java 0000664 0000000 0000000 00000002750 12411160572 0033643 0 ustar 00root root 0000000 0000000 JGlobus-JGlobus-Release-2.1.0/ssl-proxies/src/main/java/org/globus/gsi/gssapi/jaas /*
* Copyright 1999-2010 University of Chicago
*
* Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in
* compliance with the License. You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software distributed under the License is
* distributed on an "AS IS" BASIS,WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either
* express or implied.
*
* See the License for the specific language governing permissions and limitations under the License.
*/
package org.globus.gsi.gssapi.jaas;
import java.security.AccessController;
import java.security.PrivilegedAction;
import java.security.PrivilegedExceptionAction;
import java.security.PrivilegedActionException;
import javax.security.auth.Subject;
/**
* Standard JAAS implementation of the JAAS Subject helper API.
* This implementation (because of a problem in JAAS) can cut off
* the Subject object from the thread context.
*/
public class StandardSubject extends JaasSubject {
protected StandardSubject() {
super();
}
public Subject getSubject() {
return Subject.getSubject(AccessController.getContext());
}
public Object runAs(Subject subject, PrivilegedAction action) {
return Subject.doAs(subject, action);
}
public Object runAs(Subject subject, PrivilegedExceptionAction action)
throws PrivilegedActionException {
return Subject.doAs(subject, action);
}
}
UserNamePrincipal.java 0000664 0000000 0000000 00000001576 12411160572 0034151 0 ustar 00root root 0000000 0000000 JGlobus-JGlobus-Release-2.1.0/ssl-proxies/src/main/java/org/globus/gsi/gssapi/jaas /*
* Copyright 1999-2010 University of Chicago
*
* Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in
* compliance with the License. You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software distributed under the License is
* distributed on an "AS IS" BASIS,WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either
* express or implied.
*
* See the License for the specific language governing permissions and limitations under the License.
*/
package org.globus.gsi.gssapi.jaas;
/**
* An user name principal. Represents the user name (the account) the user
* is mapped in the gridmap file.
*/
public class UserNamePrincipal
extends SimplePrincipal {
public UserNamePrincipal(String username) {
super(username);
}
}
JGlobus-JGlobus-Release-2.1.0/ssl-proxies/src/main/java/org/globus/gsi/package-info.java 0000664 0000000 0000000 00000001321 12411160572 0030753 0 ustar 00root root 0000000 0000000 /*
* Copyright 1999-2010 University of Chicago
*
* Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in
* compliance with the License. You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software distributed under the License is
* distributed on an "AS IS" BASIS,WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either
* express or implied.
*
* See the License for the specific language governing permissions and limitations under the License.
*/
/**
* This package conatins the basic security constructs used to build Globus security.
*/
package org.globus.gsi; JGlobus-JGlobus-Release-2.1.0/ssl-proxies/src/main/java/org/globus/gsi/provider/ 0000775 0000000 0000000 00000000000 12411160572 0027421 5 ustar 00root root 0000000 0000000 JGlobus-JGlobus-Release-2.1.0/ssl-proxies/src/main/java/org/globus/gsi/provider/GlobusProvider.java 0000664 0000000 0000000 00000004277 12411160572 0033244 0 ustar 00root root 0000000 0000000 /*
* Copyright 1999-2010 University of Chicago
*
* Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in
* compliance with the License. You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software distributed under the License is
* distributed on an "AS IS" BASIS,WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either
* express or implied.
*
* See the License for the specific language governing permissions and limitations under the License.
*/
package org.globus.gsi.provider;
import org.globus.gsi.trustmanager.PKITrustManagerFactory;
import org.globus.gsi.trustmanager.X509ProxyCertPathValidator;
import org.globus.gsi.stores.PEMKeyStore;
import org.globus.gsi.stores.ResourceCertStore;
import java.security.AccessController;
import java.security.PrivilegedAction;
import java.security.Provider;
/**
* This is a security provider for the Globus SSL support. This supplies a
* CertStore, CertValidator and KeyStore implementation
*
* @version ${version}
* @since 1.0
*/
public final class GlobusProvider extends Provider {
public static final String PROVIDER_NAME = "Globus";
public static final String CERTSTORE_TYPE = "PEMFilebasedCertStore";
public static final String CERT_PATH_VALIDATOR_TYPE = "X509ProxyPath";
public static final String KEYSTORE_TYPE = "PEMFilebasedKeyStore";
public static final String TRUSTMANAGER_TYPE = "GlobusTrustManager";
private static final long serialVersionUID = -6275241207604782362L;
/**
* Create Provider and add Components to the java security framework.
*/
public GlobusProvider() {
super(PROVIDER_NAME, 1.0, "Globus Security Providers");
AccessController.doPrivileged(new PrivilegedAction