*
* Alternatively, the contents of this file may be used under the terms of
* either of the GNU General Public License Version 2 or later (the "GPL"),
* or the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
* in which case the provisions of the GPL or the LGPL are applicable instead
* of those above. If you wish to allow use of your version of this file only
* under the terms of either the GPL or the LGPL, and not to allow others to
* use your version of this file under the terms of the EPL, indicate your
* decision by deleting the provisions above and replace them with the notice
* and other provisions required by the GPL or the LGPL. If you do not delete
* the provisions above, a recipient may use your version of this file under
* the terms of any one of the EPL, the GPL or the LGPL.
***** END LICENSE BLOCK *****/
package org.jruby.ext.openssl;
import java.math.BigInteger;
import java.security.SecureRandom;
import java.util.Collections;
import java.util.Random;
import org.jruby.Ruby;
import org.jruby.RubyBignum;
import org.jruby.RubyBoolean;
import org.jruby.RubyClass;
import org.jruby.RubyFixnum;
import org.jruby.RubyInteger;
import org.jruby.RubyModule;
import org.jruby.RubyNumeric;
import org.jruby.RubyObject;
import org.jruby.RubyString;
import org.jruby.anno.JRubyClass;
import org.jruby.anno.JRubyMethod;
import org.jruby.exceptions.RaiseException;
import org.jruby.runtime.Arity;
import org.jruby.runtime.ObjectAllocator;
import org.jruby.runtime.ThreadContext;
import org.jruby.runtime.builtin.IRubyObject;
import org.jruby.util.ByteList;
import org.jruby.runtime.Visibility;
/**
* OpenSSL::BN implementation. Wraps java.math.BigInteger, which provides
* most functionality directly; the rest is easily derived.
*
* Beware that BN's are mutable -- I don't agree with this approach, but
* must conform for compatibility with MRI's implementation. The offending methods
* are set_bit!, clear_bit!, mask_bits! and copy.
*
* I've included a few operations (& | ^ ~) that aren't defined by MRI/OpenSSL.
* These are non-portable (i.e., won't work in C-Ruby), so use at your own risk.
*
* @author Bill Dortch
*/
@JRubyClass(name = "OpenSSL::BN", include = "Comparable")
public class BN extends RubyObject {
private static final long serialVersionUID = -5660938062191525498L;
private static final BigInteger MAX_INT = BigInteger.valueOf(Integer.MAX_VALUE);
static final BigInteger TWO = BigInteger.valueOf(2);
private static final BigInteger MIN_LONG = BigInteger.valueOf(Long.MIN_VALUE);
private static final BigInteger MAX_LONG = BigInteger.valueOf(Long.MAX_VALUE);
private static final int DEFAULT_CERTAINTY = 100;
private static final ObjectAllocator BN_ALLOCATOR = new ObjectAllocator() {
public BN allocate(Ruby runtime, RubyClass klass) { return new BN(runtime, klass); }
};
public static BN newBN(Ruby runtime, BigInteger value) {
return newInstance(runtime, value);
}
static BN newInstance(final Ruby runtime, BigInteger value) {
return new BN(runtime, value != null ? value : BigInteger.ZERO);
}
//static BN newInstance(final Ruby runtime, long value) {
// return new BN(runtime, BigInteger.valueOf(value));
//}
public static void createBN(final Ruby runtime, final RubyModule OpenSSL) {
final RubyClass OpenSSLError = OpenSSL.getClass("OpenSSLError");
OpenSSL.defineClassUnder("BNError", OpenSSLError, OpenSSLError.getAllocator());
RubyClass BN = OpenSSL.defineClassUnder("BN", runtime.getObject(), BN_ALLOCATOR);
BN.includeModule( runtime.getModule("Comparable") );
BN.defineAnnotatedMethods(BN.class);
}
private volatile BigInteger value;
private BN(Ruby runtime, RubyClass clazz) {
super(runtime, clazz);
this.value = BigInteger.ZERO;
}
protected BN(Ruby runtime, BigInteger value) {
super(runtime, runtime.getModule("OpenSSL").getClass("BN"));
this.value = value;
}
public final BigInteger getValue() {
return value;
}
@JRubyMethod(name="initialize", required=1, optional=1, visibility = Visibility.PRIVATE)
public IRubyObject initialize(final ThreadContext context,
final IRubyObject[] args) {
final Ruby runtime = context.runtime;
if (this.value != BigInteger.ZERO) { // already initialized
throw newBNError(runtime, "illegal initialization");
}
int argc = Arity.checkArgumentCount(runtime, args, 1, 2);
int base = argc == 2 ? RubyNumeric.num2int(args[1]) : 10;
final RubyString str = args[0].asString();
switch (base) {
case 0:
final byte[] bytes = str.getBytes(); final int signum;
if ( ( bytes[0] & 0x80 ) != 0 ) {
bytes[0] &= 0x7f; signum = -1;
}
else {
signum = 1;
}
this.value = new BigInteger(signum, bytes);
break;
case 2:
// this seems wrong to me, but is the behavior of the
// MRI implementation. rather than interpreting the string
// as ASCII-encoded binary digits, the raw binary value of
// the string is used instead. the value is always interpreted
// as positive, hence the use of the signum version of the BI
// constructor here:
this.value = new BigInteger(1, str.getBytes());
break;
case 10:
case 16:
// here, the ASCII-encoded decimal or hex string is used
try {
this.value = new BigInteger(str.toString(), base);
break;
} catch (NumberFormatException e) {
throw runtime.newArgumentError("value " + str + " is not legal for radix " + base);
}
default:
throw runtime.newArgumentError("illegal radix: " + base);
}
return this;
}
@Override
public synchronized IRubyObject initialize_copy(final IRubyObject that) {
super.initialize_copy(that);
if ( this != that ) this.value = ((BN) that).value;
return this;
}
@JRubyMethod(name = "copy")
public IRubyObject copy(IRubyObject other) {
if (this != other) {
this.value = asBigInteger(other);
}
return this;
}
@JRubyMethod(name = "to_s", rest = true, optional = 1)
public RubyString to_s(IRubyObject[] args) {
int argc = Arity.checkArgumentCount(getRuntime(), args, 0, 1);
return to_s( argc == 1 ? RubyNumeric.num2int(args[0]) : 10 );
}
// 1.6.8 can not handle - this way :
@Override
//@JRubyMethod(name = "to_s")
public RubyString to_s() { return to_s(10); }
//@JRubyMethod(name = "to_s")
//public RubyString to_s(IRubyObject base) {
// return to_s( RubyNumeric.num2int(base) );
//}
private RubyString to_s(final int base) {
final Ruby runtime = getRuntime();
byte[] bytes;
switch (base) {
case 0:
bytes = this.value.abs().toByteArray();
int offset = 0;
if (bytes[0] == 0) {
offset = 1;
}
int length = bytes.length - offset;
boolean negative = BigInteger.ZERO.compareTo(this.value) > 0;
// for positive values with most significant bit in first byte,
// add leading '\0'
boolean need0 = !negative && (bytes[offset] & 0x80) != 0;
if (negative) {
// for negative values, set most significant bit in first byte
bytes[offset] |= 0x80;
} else if (need0) {
length++;
}
byte[] data = new byte[5 + length];
data[0] = (byte)(0xff & (length >> 24));
data[1] = (byte)(0xff & (length >> 16));
data[2] = (byte)(0xff & (length >> 8));
data[3] = (byte)(0xff & (length >> 0));
if (need0) {
data[4] = 0;
System.arraycopy(bytes, offset, data, 5, length - 1);
} else {
System.arraycopy(bytes, offset, data, 4, length);
}
return runtime.newString(new ByteList(data, 0, 4 + length, false));
case 2:
// again, following MRI implementation, wherein base 2 deals
// with strings as byte arrays rather than ASCII-encoded binary
// digits. note that negative values are returned as though positive:
bytes = this.value.abs().toByteArray();
// suppress leading 0 byte to conform to MRI behavior
if (bytes[0] == 0) {
return runtime.newString(new ByteList(bytes, 1, bytes.length - 1, false));
}
return runtime.newString(new ByteList(bytes, false));
case 10:
return runtime.newString(value.toString(10));
case 16:
final String hex = value.toString(16);
final int len = hex.length();
final ByteList val = new ByteList(len + 1);
if ( value.signum() == 1 && len % 2 != 0 ) val.append('0');
for ( int i = 0; i < len ; i++ ) {
val.append( Character.toUpperCase(hex.charAt(i)) );
}
return runtime.newString(val);
default:
throw runtime.newArgumentError("illegal radix: " + base);
}
}
@Override
public String toString() {
return to_s().toString();
}
public String toString(int base) {
return to_s(base).toString();
}
@Override
@SuppressWarnings("unchecked")
@JRubyMethod
public IRubyObject inspect() {
return ObjectSupport.inspect(this, Collections.EMPTY_LIST);
}
@Override
public boolean equals(Object other) {
return (other instanceof BN) ? this.value.equals(((BN) other).value) : false;
}
@Override
public int hashCode() {
return 997 * value.hashCode();
}
@JRubyMethod(name = "hash")
public RubyInteger hash(final ThreadContext context) {
return context.runtime.newFixnum(hashCode());
}
@JRubyMethod(name = "to_i")
public RubyInteger to_i() {
if ( value.compareTo( MAX_LONG ) > 0 || value.compareTo( MIN_LONG ) < 0 ) {
return RubyBignum.newBignum(getRuntime(), value);
}
return RubyFixnum.newFixnum(getRuntime(), value.longValue());
}
@JRubyMethod(name = "to_bn")
public BN to_bn() {
return this;
}
@JRubyMethod(name="coerce")
// FIXME: is this right? don't see how it would be useful...
public IRubyObject coerce(IRubyObject other) {
final Ruby runtime = getRuntime();
IRubyObject self;
if ( other instanceof RubyString ) {
self = runtime.newString(value.toString());
}
else if ( other instanceof RubyInteger ) {
self = to_i();
}
else if ( other instanceof BN ) {
self = this;
}
else {
throw runtime.newTypeError("don't know how to coerce to " + other.getMetaClass().getName());
}
return runtime.newArray(other, self);
}
@JRubyMethod(name="zero?")
public RubyBoolean zero_p(final ThreadContext context) {
return context.runtime.newBoolean( value.equals(BigInteger.ZERO) );
}
@JRubyMethod(name="one?")
public RubyBoolean one_p(final ThreadContext context) {
return context.runtime.newBoolean( value.equals(BigInteger.ONE) );
}
@JRubyMethod(name="odd?")
public RubyBoolean odd_p(final ThreadContext context) {
return context.runtime.newBoolean( value.testBit(0) );
}
@JRubyMethod(name={"cmp", "<=>"})
public IRubyObject cmp(final ThreadContext context, IRubyObject other) {
return context.runtime.newFixnum( value.compareTo( asBigInteger(other) ) );
}
@JRubyMethod(name="ucmp")
public IRubyObject ucmp(final ThreadContext context, IRubyObject other) {
return context.runtime.newFixnum( value.abs().compareTo( asBigInteger(other).abs() ) );
}
@JRubyMethod(name={"eql?", "==", "==="})
public RubyBoolean eql_p(final ThreadContext context, IRubyObject other) {
return context.runtime.newBoolean( value.equals( asBigInteger(other) ) );
}
@JRubyMethod(name="sqr")
public BN sqr(final ThreadContext context) {
// TODO: check whether mult n * n is faster
return newBN(context.runtime, value.pow(2));
}
@JRubyMethod(name="~")
public BN not(final ThreadContext context) {
return newBN(context.runtime, value.not());
}
@JRubyMethod(name="+")
public BN add(final ThreadContext context, IRubyObject other) {
return newBN(context.runtime, value.add(asBigInteger(other)));
}
@JRubyMethod(name="-")
public BN sub(final ThreadContext context, IRubyObject other) {
return newBN(context.runtime, value.subtract(asBigInteger(other)));
}
@JRubyMethod(name="*")
public BN mul(final ThreadContext context, IRubyObject other) {
return newBN(context.runtime, value.multiply(asBigInteger(other)));
}
@JRubyMethod(name="%")
public BN mod(final ThreadContext context, IRubyObject other) {
try {
return newBN(context.runtime, value.mod(asBigInteger(other)));
}
catch (ArithmeticException e) {
throw context.runtime.newZeroDivisionError();
}
}
@JRubyMethod(name="/")
public IRubyObject div(final ThreadContext context, IRubyObject other) {
final Ruby runtime = context.runtime;
try {
BigInteger[] result = value.divideAndRemainder(asBigInteger(other));
return runtime.newArray(newBN(runtime, result[0]), newBN(runtime, result[1]));
}
catch (ArithmeticException e) {
throw runtime.newZeroDivisionError();
}
}
@JRubyMethod(name="&")
public BN and(final ThreadContext context, IRubyObject other) {
return newBN(context.runtime, value.and(asBigInteger(other)));
}
@JRubyMethod(name="|")
public BN or(final ThreadContext context, IRubyObject other) {
return newBN(context.runtime, value.or(asBigInteger(other)));
}
@JRubyMethod(name="^")
public BN xor(final ThreadContext context, IRubyObject other) {
return newBN(context.runtime, value.xor(asBigInteger(other)));
}
@JRubyMethod(name="**")
public BN exp(final ThreadContext context, IRubyObject other) {
// somewhat strangely, BigInteger takes int rather than BigInteger
// as the argument to pow. so we'll have to narrow the value, and
// raise an exception if data would be lost. (on the other hand, an
// exponent even approaching Integer.MAX_VALUE would be silly big, and
// the value would take a very, very long time to calculate.)
// we'll check for values < 0 (illegal) while we're at it
int exp = -1;
if ( other instanceof RubyInteger ) {
long val = ((RubyInteger) other).getLongValue();
if ( val >= 0 && val <= Integer.MAX_VALUE ) {
exp = (int) val;
}
else if ( other instanceof RubyBignum ) { // inherently too big
throw newBNError(context.runtime, "invalid exponent");
}
}
if ( exp == -1 ) {
if ( ! (other instanceof BN) ) {
throw context.runtime.newTypeError("Cannot convert into " + other.getMetaClass().getName());
}
BigInteger val = ((BN) other).value;
if (val.compareTo(BigInteger.ZERO) < 0 || val.compareTo(MAX_INT) > 0) {
throw newBNError(context.runtime, "invalid exponent");
}
exp = val.intValue();
}
try {
return newBN(context.runtime, value.pow(exp));
}
catch (ArithmeticException e) {
// shouldn't happen, we've already checked for < 0
throw newBNError(context.runtime, "invalid exponent");
}
}
@JRubyMethod(name="gcd")
public BN gcd(final ThreadContext context, IRubyObject other) {
return newBN(context.runtime, value.gcd(asBigInteger(other)));
}
@JRubyMethod(name="mod_sqr")
public BN mod_sqr(final ThreadContext context, IRubyObject other) {
try {
return newBN(context.runtime, value.modPow(TWO, asBigInteger(other)));
}
catch (ArithmeticException e) {
throw context.runtime.newZeroDivisionError();
}
}
@JRubyMethod(name="mod_inverse")
public BN mod_inverse(final ThreadContext context, IRubyObject other) {
try {
return newBN(context.runtime, value.modInverse(asBigInteger(other)));
}
catch (ArithmeticException e) {
throw context.runtime.newZeroDivisionError();
}
}
@JRubyMethod(name="mod_add")
public BN mod_add(final ThreadContext context, IRubyObject other, IRubyObject mod) {
try {
return newBN(context.runtime, value.add(asBigInteger(other)).mod(asBigInteger(mod)));
}
catch (ArithmeticException e) {
throw context.runtime.newZeroDivisionError();
}
}
@JRubyMethod(name="mod_sub")
public BN mod_sub(final ThreadContext context, IRubyObject other, IRubyObject mod) {
try {
return newBN(context.runtime, value.subtract(asBigInteger(other)).mod(asBigInteger(mod)));
}
catch (ArithmeticException e) {
throw context.runtime.newZeroDivisionError();
}
}
@JRubyMethod(name="mod_mul")
public BN mod_mul(final ThreadContext context, IRubyObject other, IRubyObject mod) {
try {
return newBN(context.runtime, value.multiply(asBigInteger(other)).mod(asBigInteger(mod)));
}
catch (ArithmeticException e) {
throw context.runtime.newZeroDivisionError();
}
}
@JRubyMethod(name="mod_exp")
public BN mod_exp(final ThreadContext context, IRubyObject other, IRubyObject mod) {
try {
return newBN(context.runtime, value.modPow(asBigInteger(other), asBigInteger(mod)));
}
catch (ArithmeticException e) {
throw context.runtime.newZeroDivisionError();
}
}
@JRubyMethod(name="set_bit!")
public synchronized IRubyObject set_bit(IRubyObject n) {
// evil mutable BN
int pos = RubyNumeric.num2int(n);
BigInteger oldValue = this.value;
// FIXME? in MRI/OSSL-BIGNUM, the original sign of a BN is remembered, so if
// you set the value of an (originally) negative number to zero (through some
// combination of clear_bit! and/or mask_bits! calls), and later call set_bit!,
// the resulting value will be negative. this seems unintuitive and, frankly,
// wrong, not to mention expensive to carry the extra sign field.
// I'm not duplicating this behavior here at this time. -BD
try {
if (oldValue.signum() >= 0) {
this.value = oldValue.setBit(pos);
} else {
this.value = oldValue.abs().setBit(pos).negate();
}
} catch (ArithmeticException e) {
throw newBNError(getRuntime(), "invalid pos");
}
return this;
}
@JRubyMethod(name="clear_bit!")
public synchronized IRubyObject clear_bit(IRubyObject n) {
// evil mutable BN
int pos = RubyNumeric.num2int(n);
BigInteger oldValue = this.value;
try {
if (oldValue.signum() >= 0) {
this.value = oldValue.clearBit(pos);
} else {
this.value = oldValue.abs().clearBit(pos).negate();
}
} catch (ArithmeticException e) {
throw newBNError(getRuntime(), "invalid pos");
}
return this;
}
/**
* Truncates value to n bits
*/
@JRubyMethod(name="mask_bits!")
public synchronized IRubyObject mask_bits(IRubyObject n) {
// evil mutable BN
int pos = RubyNumeric.num2int(n);
if (pos < 0) throw newBNError(getRuntime(), "invalid pos");
BigInteger oldValue = this.value;
// TODO: cache 2 ** n values?
if (oldValue.signum() >= 0) {
if (oldValue.bitLength() < pos) throw newBNError(getRuntime(), "invalid pos");
this.value = oldValue.mod(TWO.pow(pos));
} else {
BigInteger absValue = oldValue.abs();
if (absValue.bitLength() < pos) throw newBNError(getRuntime(), "invalid pos");
this.value = absValue.mod(TWO.pow(pos)).negate();
}
return this;
}
@JRubyMethod(name="bit_set?")
public RubyBoolean bit_set_p(final ThreadContext context, IRubyObject n) {
int pos = RubyNumeric.num2int(n);
BigInteger val = this.value;
try {
if (val.signum() >= 0) {
return context.runtime.newBoolean(val.testBit(pos));
}
return context.runtime.newBoolean(val.abs().testBit(pos));
}
catch (ArithmeticException e) {
throw newBNError(context.runtime, "invalid pos");
}
}
@JRubyMethod(name="<<")
public BN lshift(final ThreadContext context, IRubyObject n) {
int nbits = RubyNumeric.num2int(n);
BigInteger val = this.value;
if (val.signum() >= 0) {
return newBN(context.runtime, val.shiftLeft(nbits));
}
return newBN(context.runtime, val.abs().shiftLeft(nbits).negate());
}
@JRubyMethod(name=">>")
public BN rshift(final ThreadContext context, IRubyObject n) {
int nbits = RubyNumeric.num2int(n);
BigInteger val = this.value;
if (val.signum() >= 0) {
return newBN(context.runtime, val.shiftRight(nbits));
}
return newBN(context.runtime, val.abs().shiftRight(nbits).negate());
}
@JRubyMethod(name="num_bits")
public RubyFixnum num_bits(final ThreadContext context) {
return context.runtime.newFixnum( this.value.abs().bitLength() );
}
@JRubyMethod(name="num_bytes")
public RubyFixnum num_bytes(final ThreadContext context) {
return context.runtime.newFixnum( (this.value.abs().bitLength() + 7) / 8 );
}
@JRubyMethod(name="num_bits_set")
public RubyFixnum num_bits_set(final ThreadContext context) {
return context.runtime.newFixnum( this.value.abs().bitCount() );
}
// note that there is a bug in the MRI version, in argument handling,
// so apparently no one ever calls this...
@JRubyMethod(name = "prime?", rest = true)
public IRubyObject prime_p(IRubyObject[] args) {
final Ruby runtime = getRuntime();
int argc = Arity.checkArgumentCount(runtime, args, 0, 1);
// negative numbers are always considered non-prime
if (this.value.signum() < 0) return runtime.getFalse();
int certainty = argc == 0 ? DEFAULT_CERTAINTY : RubyNumeric.fix2int(args[0]);
// BigInteger#isProbablePrime will actually limit checks to a maximum of 50,
// depending on bit count.
return runtime.newBoolean(this.value.isProbablePrime(certainty));
}
// NOTE: BigInteger doesn't supply this, so right now this is
// ... (essentially) the same as prime?
@JRubyMethod(name = "prime_fasttest?", rest = true)
public IRubyObject prime_fasttest_p(IRubyObject[] args) {
final Ruby runtime = getRuntime();
int argc = Arity.checkArgumentCount(runtime, args, 0, 2);
// negative numbers are always considered non-prime
if (this.value.signum() < 0) return runtime.getFalse();
int certainty = argc == 0 ? DEFAULT_CERTAINTY : RubyNumeric.fix2int(args[0]);
// BigInteger#isProbablePrime will actually limit checks to a maximum of 50,
// depending on bit count.
return runtime.newBoolean(this.value.isProbablePrime(certainty));
}
@JRubyMethod(name = "generate_prime", meta = true, rest = true)
public static IRubyObject generate_prime(IRubyObject recv, IRubyObject[] args) {
Ruby runtime = recv.getRuntime();
int argc = Arity.checkArgumentCount(runtime, args, 1, 4);
int bits = RubyNumeric.num2int(args[0]);
boolean safe = argc > 1 ? args[1] != runtime.getFalse() : true;
BigInteger add = argc > 2 ? asBigInteger(args[2]) : null;
BigInteger rem = argc > 3 ? asBigInteger(args[3]) : null;
if (bits < 3) {
if (safe) throw runtime.newArgumentError("bits < 3");
if (bits < 2) throw runtime.newArgumentError("bits < 2");
}
return newBN(runtime, generatePrime(bits, safe, add, rem));
}
public static BigInteger generatePrime(int bits, boolean safe, BigInteger add, BigInteger rem) {
// From OpenSSL man page BN_generate_prime(3):
//
// "If add is not NULL, the prime will fulfill the condition p % add == rem
// (p % add == 1 if rem == NULL) in order to suit a given generator."
//
// "If safe is true, it will be a safe prime (i.e. a prime p so that
// (p-1)/2 is also prime)."
//
// see [ossl]/crypto/bn/bn_prime.c #BN_generate_prime_ex
//
if (add != null && rem == null) {
rem = BigInteger.ONE;
}
// borrowing technique from org.bouncycastle.crypto.generators.DHParametersHelper
// (unfortunately the code has package visibility), wherein for safe primes,
// we'll use the lowest useful certainty (2) for generation of q, then if
// p ( = 2q + 1) is prime to our required certainty (100), we'll verify that q
// is as well.
//
// for typical bit lengths ( >= 1024), this should speed things up by reducing
// initial Miller-Rabin iterations from 2 to 1 for candidate values of q.
//
// it's still painfully slow...
//
BigInteger p, q;
int qbits = bits - 1;
SecureRandom secureRandom = getSecureRandom();
do {
if (safe) {
do {
q = new BigInteger(qbits, 2, secureRandom);
p = q.shiftLeft(1).setBit(0);
} while (!(p.isProbablePrime(DEFAULT_CERTAINTY) && q.isProbablePrime(DEFAULT_CERTAINTY)));
} else {
p = BigInteger.probablePrime(bits, secureRandom);
}
} while (add != null && !p.mod(add).equals(rem));
return p;
}
public static BigInteger generatePrime(int bits, boolean safe) {
return generatePrime(bits, safe, null, null);
}
@JRubyMethod(name = "rand", meta = true, rest = true)
public static IRubyObject rand(IRubyObject recv, IRubyObject[] args) {
return getRandomBN(recv.getRuntime(), args, getSecureRandom());
}
@JRubyMethod(name = "pseudo_rand", meta = true, rest = true)
public static IRubyObject pseudo_rand(IRubyObject recv, IRubyObject[] args) {
return getRandomBN(recv.getRuntime(), args, getRandom());
}
public static BN getRandomBN(Ruby runtime, IRubyObject[] args, Random random) {
int argc = Arity.checkArgumentCount(runtime, args, 1, 3);
int bits = RubyNumeric.num2int(args[0]);
int top;
boolean bottom;
if (argc > 1) {
top = RubyNumeric.fix2int(args[1]);
bottom = argc == 3 ? args[2].isTrue() : false;
} else {
top = 0;
bottom = false;
}
BigInteger value;
try {
value = getRandomBI(bits, top, bottom, random);
} catch (IllegalArgumentException e) {
throw runtime.newArgumentError(e.getMessage());
}
return newBN(runtime, value);
}
public static BigInteger getRandomBI(int bits, int top, boolean bottom, Random random) {
// From OpenSSL man page BN_rand(3):
//
// "If top is -1, the most significant bit of the random number can be zero.
// If top is 0, it is set to 1, and if top is 1, the two most significant bits
// of the number will be set to 1, so that the product of two such random numbers
// will always have 2*bits length."
//
// "If bottom is true, the number will be odd."
//
if (bits <= 0) {
if (bits == 0) return BigInteger.ZERO;
throw new IllegalArgumentException("Illegal bit length");
}
if (top < -1 || top > 1) {
throw new IllegalArgumentException("Illegal top value");
}
// top/bottom handling adapted from OpenSSL's crypto/bn/bn_rand.c
int bytes = (bits + 7) / 8;
int bit = (bits - 1) % 8;
int mask = 0xff << (bit + 1);
byte[] buf;
random.nextBytes(buf = new byte[bytes]);
if (top >= 0) {
if (top == 0) {
buf[0] |= (1 << bit);
} else {
if (bit == 0) {
buf[0] = 1;
buf[1] |= 0x80;
}
else {
buf[0] |= (3 << (bit - 1));
}
}
}
buf[0] &= ~mask;
if (bottom) {
buf[bytes-1] |= 1;
}
// treating result as unsigned
return new BigInteger(1, buf);
}
@JRubyMethod(name = "rand_range", meta = true)
public static IRubyObject rand_range(IRubyObject recv, IRubyObject arg) {
return randomValueInRange(recv.getRuntime(), asBigInteger(arg), getSecureRandom());
}
@JRubyMethod(name = "pseudo_rand_range", meta = true)
public static IRubyObject pseudo_rand_range(IRubyObject recv, IRubyObject arg) {
return randomValueInRange(recv.getRuntime(), asBigInteger(arg), getRandom());
}
private static BN randomValueInRange(Ruby runtime, BigInteger limit, Random random) {
BigInteger value;
try {
value = randomIntegerInRange(limit, random);
}
catch (IllegalArgumentException e) {
throw newBNError(runtime, e.getMessage());
}
return newInstance(runtime, value);
}
public static BigInteger randomIntegerInRange(BigInteger limit, Random random) {
if (limit.signum() < 0) {
throw new IllegalArgumentException("illegal range: " + limit);
}
int bits = limit.bitLength();
BigInteger value;
do {
value = new BigInteger(bits, random);
} while (value.compareTo(limit) >= 0);
return value;
}
private static Random random;
private static Random getRandom() {
final Random rnd;
if ( ( rnd = BN.random ) != null ) {
return rnd;
}
return BN.random = new Random();
}
private static SecureRandom secureRandom;
private static SecureRandom getSecureRandom() {
final SecureRandom rnd;
if ( ( rnd = BN.secureRandom ) != null ) {
return rnd;
}
// NOTE: will use (default) Sun's even if BC provider is set
return BN.secureRandom = new SecureRandom();
}
public static RaiseException newBNError(Ruby runtime, String message) {
return new RaiseException(runtime, runtime.getModule("OpenSSL").getClass("BNError"), message, true);
}
public static BigInteger asBigInteger(final IRubyObject arg) {
if ( arg.isNil() ) return null;
if ( arg instanceof RubyInteger ) {
return ((RubyInteger) arg).getBigIntegerValue();
}
if ( arg instanceof BN ) return ((BN) arg).value;
throw arg.getRuntime().newTypeError("Cannot convert into OpenSSL::BN");
}
public static BigInteger asBigInteger(final BN arg) {
return arg.isNil() ? null : arg.value;
}
@Deprecated
public static BigInteger getBigInteger(final IRubyObject arg) {
return asBigInteger(arg);
}
@Override
public Object toJava(Class target) {
if ( target.isAssignableFrom(BigInteger.class) || target == Number.class ) return value;
if ( target == Long.class || target == Long.TYPE ) return value.longValue();
if ( target == Integer.class || target == Integer.TYPE ) return value.intValue();
if ( target == Double.class || target == Double.TYPE ) return value.doubleValue();
if ( target == Float.class || target == Float.TYPE ) return value.floatValue();
return super.toJava(target);
}
}
jruby-openssl-0.9.21/src/main/java/org/jruby/ext/openssl/BouncyCastlePEMHandler.java 0000664 0000000 0000000 00000006761 13136616216 0030375 0 ustar 00root root 0000000 0000000 /***** BEGIN LICENSE BLOCK *****
* Version: EPL 1.0/GPL 2.0/LGPL 2.1
*
* The contents of this file are subject to the Eclipse Public
* License Version 1.0 (the "License"); you may not use this file
* except in compliance with the License. You may obtain a copy of
* the License at http://www.eclipse.org/legal/epl-v10.html
*
* Software distributed under the License is distributed on an "AS
* IS" basis, WITHOUT WARRANTY OF ANY KIND, either express or
* implied. See the License for the specific language governing
* rights and limitations under the License.
*
* Copyright (C) 2006 Ola Bini
*
* Alternatively, the contents of this file may be used under the terms of
* either of the GNU General Public License Version 2 or later (the "GPL"),
* or the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
* in which case the provisions of the GPL or the LGPL are applicable instead
* of those above. If you wish to allow use of your version of this file only
* under the terms of either the GPL or the LGPL, and not to allow others to
* use your version of this file under the terms of the EPL, indicate your
* decision by deleting the provisions above and replace them with the notice
* and other provisions required by the GPL or the LGPL. If you do not delete
* the provisions above, a recipient may use your version of this file under
* the terms of any one of the EPL, the GPL or the LGPL.
***** END LICENSE BLOCK *****/
package org.jruby.ext.openssl;
import java.io.Reader;
import java.io.Writer;
import java.lang.reflect.Method;
import java.security.SecureRandom;
//import org.bouncycastle.openssl.PEMReader; // uses Security API directly
import org.bouncycastle.openssl.PEMWriter;
import org.bouncycastle.openssl.PasswordFinder;
/**
* @author Ola Bini
*/
@Deprecated
public class BouncyCastlePEMHandler implements PEMHandler {
@SuppressWarnings("unchecked")
public Object readPEM(Reader read, String password) throws Exception {
// NOTE: class not longer available since BC 1.50 :
// return new PEMReader(read, new BasicPasswordFinder(password)).readObject();
Class PEMReader = Class.forName("org.bouncycastle.openssl.PEMReader");
Object pemReader = PEMReader.getConstructor(java.io.Reader.class, PasswordFinder.class).
newInstance(read, new BasicPasswordFinder(password));
return PEMReader.getMethod("readObject").invoke(pemReader);
}
public void writePEM(Writer writer, Object obj, String algorithm, char[] password) throws Exception {
final PEMWriter pemWriter = new PEMWriter(writer);
// NOTE: method parameters changed since BC 1.50 :
// pemWriter.writeObject(obj, algorithm, password, null);
Method writeObject = PEMWriter.class.getMethod("writeObject", Object.class, String.class, char[].class, SecureRandom.class);
writeObject.invoke(pemWriter, obj, algorithm, password, null);
pemWriter.flush();
}
public void writePEM(Writer writer, Object obj) throws Exception {
PEMWriter pemWriter = new PEMWriter(writer);
pemWriter.writeObject(obj);
pemWriter.flush();
}
private static class BasicPasswordFinder implements PasswordFinder {
private char[] pwd;
BasicPasswordFinder(final String pwd) {
if ( pwd != null ) this.pwd = pwd.toCharArray();
}
public char[] getPassword() {
return this.pwd;
}
}
}// BouncyCastlePEMHandler
jruby-openssl-0.9.21/src/main/java/org/jruby/ext/openssl/Cipher.java 0000664 0000000 0000000 00000165454 13136616216 0025361 0 ustar 00root root 0000000 0000000 /***** BEGIN LICENSE BLOCK *****
* Version: EPL 1.0/GPL 2.0/LGPL 2.1
*
* The contents of this file are subject to the Eclipse Public
* License Version 1.0 (the "License"); you may not use this file
* except in compliance with the License. You may obtain a copy of
* the License at http://www.eclipse.org/legal/epl-v10.html
*
* Software distributed under the License is distributed on an "AS
* IS" basis, WITHOUT WARRANTY OF ANY KIND, either express or
* implied. See the License for the specific language governing
* rights and limitations under the License.
*
* Copyright (C) 2006, 2007 Ola Bini
*
* Alternatively, the contents of this file may be used under the terms of
* either of the GNU General Public License Version 2 or later (the "GPL"),
* or the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
* in which case the provisions of the GPL or the LGPL are applicable instead
* of those above. If you wish to allow use of your version of this file only
* under the terms of either the GPL or the LGPL, and not to allow others to
* use your version of this file under the terms of the EPL, indicate your
* decision by deleting the provisions above and replace them with the notice
* and other provisions required by the GPL or the LGPL. If you do not delete
* the provisions above, a recipient may use your version of this file under
* the terms of any one of the EPL, the GPL or the LGPL.
***** END LICENSE BLOCK *****/
package org.jruby.ext.openssl;
import java.io.PrintStream;
import java.util.Arrays;
import java.util.Collection;
import java.util.HashSet;
import java.util.Set;
import java.security.GeneralSecurityException;
import java.security.InvalidKeyException;
import java.security.MessageDigest;
import java.security.NoSuchAlgorithmException;
import java.security.Provider;
import java.security.spec.AlgorithmParameterSpec;
import java.util.HashMap;
import java.util.LinkedHashMap;
import java.util.List;
import java.util.Map;
import static javax.crypto.Cipher.DECRYPT_MODE;
import static javax.crypto.Cipher.ENCRYPT_MODE;
import javax.crypto.NoSuchPaddingException;
import javax.crypto.spec.GCMParameterSpec;
import javax.crypto.spec.IvParameterSpec;
import javax.crypto.spec.RC2ParameterSpec;
import org.jruby.Ruby;
import org.jruby.RubyArray;
import org.jruby.RubyBoolean;
import org.jruby.RubyClass;
import org.jruby.RubyInteger;
import org.jruby.RubyModule;
import org.jruby.RubyNumeric;
import org.jruby.RubyObject;
import org.jruby.RubyString;
import org.jruby.common.IRubyWarnings.ID;
import org.jruby.anno.JRubyMethod;
import org.jruby.exceptions.RaiseException;
import org.jruby.runtime.Arity;
import org.jruby.runtime.ObjectAllocator;
import org.jruby.runtime.ThreadContext;
import org.jruby.runtime.builtin.IRubyObject;
import org.jruby.runtime.Visibility;
import org.jruby.util.ByteList;
import static org.jruby.ext.openssl.OpenSSL.*;
/**
* @author Ola Bini
*/
public class Cipher extends RubyObject {
private static final long serialVersionUID = -5390983669951165103L;
private static final ObjectAllocator ALLOCATOR = new ObjectAllocator() {
public Cipher allocate(Ruby runtime, RubyClass klass) { return new Cipher(runtime, klass); }
};
public static void createCipher(final Ruby runtime, final RubyModule OpenSSL) {
final RubyClass Cipher = OpenSSL.defineClassUnder("Cipher", runtime.getObject(), ALLOCATOR);
Cipher.defineAnnotatedMethods(Cipher.class);
final RubyClass OpenSSLError = OpenSSL.getClass("OpenSSLError");
Cipher.defineClassUnder("CipherError", OpenSSLError, OpenSSLError.getAllocator());
String cipherName;
cipherName = "AES"; // OpenSSL::Cipher::AES
Cipher.defineClassUnder(cipherName, Cipher, new NamedCipherAllocator(cipherName))
.defineAnnotatedMethods(Named.class);
cipherName = "CAST5"; // OpenSSL::Cipher::CAST5
Cipher.defineClassUnder(cipherName, Cipher, new NamedCipherAllocator(cipherName))
.defineAnnotatedMethods(Named.class);
cipherName = "BF"; // OpenSSL::Cipher::BF
Cipher.defineClassUnder(cipherName, Cipher, new NamedCipherAllocator(cipherName))
.defineAnnotatedMethods(Named.class);
cipherName = "DES"; // OpenSSL::Cipher::DES
Cipher.defineClassUnder(cipherName, Cipher, new NamedCipherAllocator(cipherName))
.defineAnnotatedMethods(Named.class);
cipherName = "IDEA"; // OpenSSL::Cipher::IDEA
Cipher.defineClassUnder(cipherName, Cipher, new NamedCipherAllocator(cipherName))
.defineAnnotatedMethods(Named.class);
cipherName = "RC2"; // OpenSSL::Cipher::RC2
Cipher.defineClassUnder(cipherName, Cipher, new NamedCipherAllocator(cipherName))
.defineAnnotatedMethods(Named.class);
cipherName = "RC4"; // OpenSSL::Cipher::RC4
Cipher.defineClassUnder(cipherName, Cipher, new NamedCipherAllocator(cipherName))
.defineAnnotatedMethods(Named.class);
cipherName = "RC5"; // OpenSSL::Cipher::RC5
Cipher.defineClassUnder(cipherName, Cipher, new NamedCipherAllocator(cipherName))
.defineAnnotatedMethods(Named.class);
String keyLength;
keyLength = "128"; // OpenSSL::Cipher::AES128
Cipher.defineClassUnder("AES" + keyLength, Cipher, new AESCipherAllocator(keyLength))
.defineAnnotatedMethods(AES.class);
keyLength = "192"; // OpenSSL::Cipher::AES192
Cipher.defineClassUnder("AES" + keyLength, Cipher, new AESCipherAllocator(keyLength))
.defineAnnotatedMethods(AES.class);
keyLength = "256"; // OpenSSL::Cipher::AES256
Cipher.defineClassUnder("AES" + keyLength, Cipher, new AESCipherAllocator(keyLength))
.defineAnnotatedMethods(AES.class);
}
static RubyClass _Cipher(final Ruby runtime) {
return (RubyClass) runtime.getModule("OpenSSL").getConstantAt("Cipher");
}
@JRubyMethod(meta = true)
public static IRubyObject ciphers(final ThreadContext context, final IRubyObject self) {
final Ruby runtime = context.runtime;
final Collection ciphers = Algorithm.allSupportedCiphers().keySet();
final RubyArray result = runtime.newArray( ciphers.size() * 2 );
for ( final String cipher : ciphers ) {
result.append( runtime.newString(cipher) ); // upper-case
}
for ( final String cipher : ciphers ) { // than lower-case OpenSSL compatibility
result.append( runtime.newString(cipher.toLowerCase()) );
}
return result;
}
public static boolean isSupportedCipher(final String name) {
final String osslName = name.toUpperCase();
//
if ( Algorithm.allSupportedCiphers().get( osslName ) != null ) {
return true;
}
//
final Algorithm alg = Algorithm.osslToJava(osslName);
if ( isDebug() ) debug("isSupportedCipher( "+ name +" ) try new cipher = " + alg.getRealName());
try {
return getCipherInstance(alg.getRealName(), true) != null;
}
catch (GeneralSecurityException e) {
return false;
}
}
private static String[] cipherModes(final String alg) {
final String[] modes = providerCipherModes(alg);
return modes == null ? registeredCipherModes(alg) : modes;
}
private static String[] providerCipherModes(final String alg) {
final Provider.Service service = providerCipherService(alg);
if ( service != null ) {
final String supportedModes = service.getAttribute("SupportedModes");
if ( supportedModes == null ) return Algorithm.OPENSSL_BLOCK_MODES;
return StringHelper.split(supportedModes, '|');
}
return null;
}
private static Provider.Service providerCipherService(final String alg) {
if ( SecurityHelper.securityProvider != null ) {
return SecurityHelper.securityProvider.getService("Cipher", alg);
}
return null;
}
private static String[] registeredCipherModes(final String alg) { // e.g. "AES"
/*
if ( SecurityHelper.securityProvider != null && ! SecurityHelper.isProviderRegistered() ) {
final Provider provider = SecurityHelper.securityProvider;
for ( Provider.Service service : provider.getServices() ) {
if ( "Cipher".equals( service.getType() ) ) {
services.add(service);
}
}
} */
boolean serviceFound = false;
final Provider[] providers = java.security.Security.getProviders();
for ( int i = 0; i < providers.length; i++ ) {
final Provider provider = providers[i];
final String name = provider.getName() == null ? "" : provider.getName();
// skip those that are known to provide no Cipher engines :
if ( name.contains("JGSS") ) continue; // SunJGSS
if ( name.contains("SASL") ) continue; // SunSASL
if ( name.contains("XMLD") ) continue; // XMLDSig
if ( name.contains("PCSC") ) continue; // SunPCSC
if ( name.contains("JSSE") ) continue; // SunJSSE
final Provider.Service service = provider.getService("Cipher", alg);
if ( service != null ) {
serviceFound = true;
final String supportedModes = service.getAttribute("SupportedModes");
if ( supportedModes != null ) return StringHelper.split(supportedModes, '|');
}
}
// if a service is found but has no SupportedModes configuration included
// e.g. BC provider does not provide those - assume all modes that OpenSSL
// supports (and are mappable to JSE) work with the cipher algorithm :
return serviceFound ? Algorithm.OPENSSL_BLOCK_MODES : null;
}
public static final class Algorithm {
final String base; // e.g. DES, AES
final String version; // e.g. EDE3, 256
final String mode; // CBC (default)
private String padding; // PKCS5Padding (default)
private String realName;
private boolean realNameNeedsPadding;
private int keyLength = -1, ivLength = -1;
Algorithm(String cryptoBase, String cryptoVersion, String cryptoMode) {
this.base = cryptoBase;
this.version = cryptoVersion;
this.mode = cryptoMode;
//this.padding = padding;
}
private static final Set KNOWN_BLOCK_MODES;
// NOTE: CFB1 does not work as (OpenSSL) expects with BC (@see GH-35)
private static final String[] OPENSSL_BLOCK_MODES = {
"CBC", "CFB", /* "CFB1", */ "CFB8", "ECB", "OFB" // that Java supports
};
static {
KNOWN_BLOCK_MODES = new HashSet();
for ( String mode : OPENSSL_BLOCK_MODES ) KNOWN_BLOCK_MODES.add(mode);
KNOWN_BLOCK_MODES.add("CTR");
KNOWN_BLOCK_MODES.add("CTS"); // not supported by OpenSSL
KNOWN_BLOCK_MODES.add("PCBC"); // not supported by OpenSSL
KNOWN_BLOCK_MODES.add("NONE"); // valid to pass into JCE
}
// Ruby to Java name String (or FALSE)
static final HashMap supportedCiphers = new LinkedHashMap(120, 1);
// we're _marking_ unsupported keys with a Boolean.FALSE mapping
// all cipher mappings are resolved on `OpenSSL::Cipher.ciphers`
// ... probably a slightly _rare_ case to be going for up front
static boolean supportedCiphersAll;
static Map allSupportedCiphers() {
if ( supportedCiphersAll ) return supportedCiphers;
synchronized ( supportedCiphers ) {
if ( supportedCiphersAll ) return supportedCiphers;
// cleanup all FALSE keys :
//for ( String key: supportedCiphers.keySet() ) {
//if ( supportedCiphers.get(key) == Boolean.FALSE ) supportedCiphers.remove(key);
//}
// OpenSSL: all the block ciphers normally use PKCS#5 padding
String[] modes;
modes = cipherModes("AES"); // null if not supported
if ( modes != null ) {
for ( final String mode : modes ) {
final String realName = "AES/" + mode; // + "/PKCS5Padding"
supportedCiphers.put( "AES-128-" + mode, new String[] { "AES", mode, "128", realName } );
supportedCiphers.put( "AES-192-" + mode, new String[] { "AES", mode, "192", realName } );
supportedCiphers.put( "AES-256-" + mode, new String[] { "AES", mode, "256", realName } );
}
final String realName = "AES/CBC";
supportedCiphers.put( "AES128", new String[] { "AES", "CBC", "128", realName } );
supportedCiphers.put( "AES192", new String[] { "AES", "CBC", "192", realName } );
supportedCiphers.put( "AES256", new String[] { "AES", "CBC", "256", realName } );
}
modes = cipherModes("Blowfish");
if ( modes != null ) {
supportedCiphers.put( "BF", new String[] { "BF", "CBC", null, "Blowfish/CBC" });
for ( final String mode : modes ) {
supportedCiphers.put( "BF-" + mode, new String[] { "BF", mode, null, "Blowfish/" + mode } );
}
}
modes = cipherModes("Camellia");
if ( modes != null ) {
for ( final String mode : modes ) {
final String realName = "Camellia/" + mode;
supportedCiphers.put( "CAMELLIA-128-" + mode, new String[] { "CAMELLIA", mode, "128", realName } );
supportedCiphers.put( "CAMELLIA-192-" + mode, new String[] { "CAMELLIA", mode, "192", realName } );
supportedCiphers.put( "CAMELLIA-256-" + mode, new String[] { "CAMELLIA", mode, "256", realName } );
}
final String realName = "Camellia/CBC";
supportedCiphers.put( "CAMELLIA128", new String[] { "CAMELLIA", "CBC", "128", realName } );
supportedCiphers.put( "CAMELLIA192", new String[] { "CAMELLIA", "CBC", "192", realName } );
supportedCiphers.put( "CAMELLIA256", new String[] { "CAMELLIA", "CBC", "256", realName } );
}
modes = cipherModes("CAST5");
if ( modes != null ) {
supportedCiphers.put( "CAST", new String[] { "CAST", "CBC", null, "CAST5/CBC" } );
supportedCiphers.put( "CAST-CBC", supportedCiphers.get("CAST") );
for ( final String mode : modes ) {
supportedCiphers.put( "CAST5-" + mode, new String[] { "CAST", mode, null, "CAST5/" + mode });
}
}
modes = cipherModes("CAST6");
if ( modes != null ) {
for ( final String mode : modes ) {
supportedCiphers.put( "CAST6-" + mode, new String[] { "CAST6", mode, null, "CAST6/" + mode });
}
}
modes = cipherModes("DES");
if ( modes != null ) {
supportedCiphers.put( "DES", new String[] { "DES", "CBC", null, "DES/CBC" } );
for ( final String mode : modes ) {
supportedCiphers.put( "DES-" + mode, new String[] { "DES", mode, null, "DES/" + mode });
}
}
modes = cipherModes("DESede");
if ( modes != null ) {
supportedCiphers.put( "DES-EDE", new String[] { "DES", "ECB", "EDE", "DESede/ECB" } );
supportedCiphers.put( "DES-EDE-CBC", new String[] { "DES", "CBC", "EDE", "DESede/CBC" } );
supportedCiphers.put( "DES-EDE-CFB", new String[] { "DES", "CBC", "EDE", "DESede/CFB" } );
supportedCiphers.put( "DES-EDE-OFB", new String[] { "DES", "CBC", "EDE", "DESede/OFB" } );
supportedCiphers.put( "DES-EDE3", new String[] { "DES", "ECB", "EDE3", "DESede/ECB" });
for ( final String mode : modes ) {
supportedCiphers.put( "DES-EDE3-" + mode, new String[] { "DES", mode, "EDE3", "DESede/" + mode });
}
supportedCiphers.put( "DES3", new String[] { "DES", "CBC", "EDE3", "DESede/CBC" } );
}
modes = cipherModes("RC2");
if ( modes != null ) {
supportedCiphers.put( "RC2", new String[] { "RC2", "CBC", null, "RC2/CBC" } );
for ( final String mode : modes ) {
supportedCiphers.put( "RC2-" + mode, new String[] { "RC2", mode, null, "RC2/" + mode } );
}
supportedCiphers.put( "RC2-40-CBC", new String[] { "RC2", "CBC", "40", "RC2/CBC" } );
supportedCiphers.put( "RC2-64-CBC", new String[] { "RC2", "CBC", "64", "RC2/CBC" } );
}
modes = cipherModes("RC4"); // NOTE: stream cipher (BC supported)
if ( modes != null ) {
supportedCiphers.put( "RC4", new String[] { "RC4", null, null, "RC4" } );
supportedCiphers.put( "RC4-40", new String[] { "RC4", null, "40", "RC4" } );
//supportedCiphers.put( "RC2-HMAC-MD5", new String[] { "RC4", null, null, "RC4" });
}
modes = cipherModes("SEED");
if ( modes != null ) {
supportedCiphers.put( "SEED", new String[] { "SEED", "CBC", null, "SEED/CBC" } );
for ( final String mode : modes ) {
supportedCiphers.put( "SEED-" + mode, new String[] { "SEED", mode, null, "SEED/" + mode });
}
}
supportedCiphersAll = true;
return supportedCiphers;
}
}
@Deprecated
public static String jsseToOssl(final String cipherName, final int keyLength) {
return javaToOssl(cipherName, keyLength);
}
public static String javaToOssl(final String cipherName, final int keyLength) {
String cryptoBase;
String cryptoVersion = null;
String cryptoMode = null;
final List parts = StringHelper.split((CharSequence) cipherName, '/');
final int partsLength = parts.size();
if ( partsLength != 1 && partsLength != 3 ) return null;
if ( partsLength > 2 ) {
cryptoMode = (String) parts.get(1); // padding: parts[2] not used
}
cryptoBase = (String) parts.get(0);
if ( ! KNOWN_BLOCK_MODES.contains(cryptoMode) ) {
cryptoVersion = cryptoMode;
cryptoMode = "CBC";
}
if (cryptoMode == null) {
cryptoMode = "CBC";
}
if ( "DESede".equals(cryptoBase) ) {
cryptoBase = "DES"; cryptoVersion = "EDE3";
}
else if ( "Blowfish".equals(cryptoBase) ) {
cryptoBase = "BF";
}
if (cryptoVersion == null) {
cryptoVersion = String.valueOf(keyLength);
}
return cryptoBase + '-' + cryptoVersion + '-' + cryptoMode;
}
static Algorithm osslToJava(final String osslName) {
return osslToJava(osslName, null); // assume PKCS5Padding
}
private static Algorithm osslToJava(final String osslName, final String padding) {
final String[] algVals = supportedCiphers.get(osslName);
if ( algVals != null ) {
final String cryptoMode = algVals[1];
Algorithm alg = new Algorithm(algVals[0], algVals[2], cryptoMode);
alg.realName = algVals[3];
alg.realNameNeedsPadding = true;
alg.padding = getPaddingType(padding, cryptoMode);
return alg;
}
String cryptoBase, cryptoVersion = null, cryptoMode, realName;
String paddingType = null;
// EXPERIMENTAL: if there's '/' assume it's a "real" JCE name :
if ( osslName.indexOf('/') != -1 ) {
// e.g. "DESedeWrap/CBC/NOPADDING"
final List names = StringHelper.split((CharSequence) osslName, '/');
cryptoBase = (String) names.get(0);
cryptoMode = names.size() > 1 ? (String) names.get(1) : "CBC";
paddingType = getPaddingType(padding, cryptoMode);
if ( names.size() > 2 ) paddingType = (String) names.get(2);
Algorithm alg = new Algorithm(cryptoBase, null, cryptoMode);
alg.realName = osslName;
alg.padding = paddingType;
return alg;
}
int s = osslName.indexOf('-'); int i = 0;
if (s == -1) {
cryptoBase = osslName; cryptoMode = null;
}
else {
cryptoBase = osslName.substring(i, s);
s = osslName.indexOf('-', i = s + 1);
if (s == -1) cryptoMode = osslName.substring(i); // "base-mode"
else { // two separators : "base-version-mode"
cryptoVersion = osslName.substring(i, s);
s = osslName.indexOf('-', i = s + 1);
if (s == -1) {
cryptoMode = osslName.substring(i);
}
else {
cryptoMode = osslName.substring(i, s);
}
}
}
cryptoBase = cryptoBase.toUpperCase(); // allways upper e.g. "AES"
if ( cryptoMode != null ) cryptoMode = cryptoMode.toUpperCase();
boolean realNameSet = false; boolean setDefaultCryptoMode = true;
if ( "BF".equals(cryptoBase) ) realName = "Blowfish";
else if ( "CAST".equals(cryptoBase) ) realName = "CAST5";
else if ( cryptoBase.startsWith("DES") ) {
if ( "DES3".equals(cryptoBase) ) {
cryptoBase = "DES"; realName = "DESede"; cryptoVersion = "EDE3"; // cryptoMode = "CBC";
}
else if ( "EDE3".equalsIgnoreCase(cryptoVersion) || "EDE".equalsIgnoreCase(cryptoVersion) ) {
realName = "DESede"; if ( cryptoMode == null ) cryptoMode = "ECB";
}
else if ( "EDE3".equalsIgnoreCase(cryptoMode) || "EDE".equalsIgnoreCase(cryptoMode) ) {
realName = "DESede"; cryptoVersion = cryptoMode; cryptoMode = "ECB";
}
else realName = "DES";
}
else if ( cryptoBase.length() > 3 && cryptoBase.startsWith("AES") ) {
try { // try parsing e.g. "AES256"
final String version = cryptoBase.substring(3);
Integer.parseInt( version );
realName = cryptoBase = "AES"; cryptoVersion = version;
}
catch (NumberFormatException e) { realName = cryptoBase; }
}
else if ( cryptoBase.length() > 8 && cryptoBase.startsWith("CAMELLIA") ) {
try { // try parsing e.g. "CAMELLIA192"
final String version = cryptoBase.substring(8);
Integer.parseInt( version );
realName = cryptoBase = "CAMELLIA"; cryptoVersion = version;
}
catch (NumberFormatException e) { realName = cryptoBase; }
}
else {
realName = cryptoBase;
// streaming ciphers - no padding/mode to be used ...
// e.g. only SecurityHelper.getCipherInstance("RC4") will work
if ( "RC4".equals(cryptoBase) ) {
if ( ! KNOWN_BLOCK_MODES.contains(cryptoMode) ) {
cryptoVersion = cryptoMode;
}
cryptoMode = null; // padding = null;
setDefaultCryptoMode = false;
// cryptoMode = "NONE"; paddingType = "NoPadding";
realNameSet = true;
}
}
if ( cryptoMode == null && setDefaultCryptoMode ) cryptoMode = "CBC";
if ( paddingType == null ) paddingType = getPaddingType(padding, cryptoMode);
if ( cryptoMode != null ) {
//if ( ! KNOWN_BLOCK_MODES.contains(cryptoMode) ) {
// if ( ! "XTS".equals(cryptoMode) ) {
// // valid but likely not supported by JCE/provider
// //cryptoVersion = cryptoMode; cryptoMode = "CBC";
// }
//}
if ( ! realNameSet ) {
realName = realName + '/' + cryptoMode + '/' + paddingType;
}
}
else if ( ! realNameSet ) {
if ( padding != null ) {
realName = realName + '/' + "NONE" + '/' + paddingType;
}
//else paddingType = null; // else realName is cryptoBase
}
Algorithm alg = new Algorithm(cryptoBase, cryptoVersion, cryptoMode);
alg.realName = realName;
alg.padding = paddingType;
return alg;
}
String getPadding() {
if ( mode == null ) return null; // if ( "RC4".equals(base) ) return null;
return padding;
}
private static String getPaddingType(final String padding, final String cryptoMode) {
//if ( "ECB".equals(cryptoMode) ) return "NoPadding";
// TODO check cryptoMode CFB/OFB
final String defaultPadding = "PKCS5Padding";
if ( padding == null ) {
if ( "GCM".equalsIgnoreCase(cryptoMode) ) {
return "NoPadding";
}
return defaultPadding;
}
if ( padding.equalsIgnoreCase("PKCS5Padding") ) {
return "PKCS5Padding";
}
if ( padding.equals("0") || padding.equalsIgnoreCase("NoPadding") ) {
return "NoPadding";
}
if ( padding.equalsIgnoreCase("ISO10126Padding") ) {
return "ISO10126Padding";
}
if ( padding.equalsIgnoreCase("PKCS1Padding") ) {
return "PKCS1Padding";
}
if ( padding.equalsIgnoreCase("SSL3Padding") ) {
return "SSL3Padding";
}
if (padding.equalsIgnoreCase("OAEPPadding")) {
return "OAEPPadding";
}
return defaultPadding; // "PKCS5Padding"; // default
}
String getRealName() {
if ( realName != null ) {
if ( realNameNeedsPadding ) {
final String padding = getPadding();
if ( padding != null ) {
realName = realName + '/' + padding;
}
realNameNeedsPadding = false;
}
return realName;
}
return realName = base + '/' + (mode == null ? "NONE" : mode) + '/' + padding;
}
public static String getAlgorithmBase(javax.crypto.Cipher cipher) {
final String algorithm = cipher.getAlgorithm();
final int idx = algorithm.indexOf('/');
if ( idx != -1 ) return algorithm.substring(0, idx);
return algorithm;
}
public static String getRealName(final String osslName) {
return osslToJava(osslName).getRealName();
}
public int getIvLength() {
if ( ivLength != -1 ) return ivLength;
getKeyLength();
if ( ivLength == -1 ) {
if ( "AES".equals(base) ) {
ivLength = 16; // OpenSSL defaults to 12
// NOTE: we can NOT handle 12 for non GCM mode
if ( "GCM".equals(mode) || "CCM".equals(mode) ) ivLength = 12;
}
//else if ( "DES".equals(base) ) {
// ivLength = 8;
//}
//else if ( "RC4".equals(base) ) {
// ivLength = 8;
//}
else if ( "ECB".equals(mode) ) {
ivLength = 0;
}
else {
ivLength = 8;
}
}
return ivLength;
}
public int getKeyLength() {
if ( keyLength != -1 ) return keyLength;
int keyLen = -1;
if ( version != null ) {
try {
keyLen = Integer.parseInt(version) / 8;
}
catch (NumberFormatException e) {
keyLen = -1;
}
}
if ( keyLen == -1 ) {
if ( "DES".equals(base) ) {
if ( "EDE".equalsIgnoreCase(version) ) keyLen = 16;
else if ( "EDE3".equalsIgnoreCase(version) ) keyLen = 24;
else keyLen = 8;
}
else if ( "RC4".equals(base) ) {
keyLen = 16;
}
else {
keyLen = 16;
try {
final String name = getRealName();
int maxLen = javax.crypto.Cipher.getMaxAllowedKeyLength(name) / 8;
if (maxLen < keyLen) keyLen = maxLen;
}
catch (NoSuchAlgorithmException e) { }
}
}
return keyLength = keyLen;
}
@Deprecated
public static int[] osslKeyIvLength(final String cipherName) {
final Algorithm alg = Algorithm.osslToJava(cipherName);
return new int[] { alg.getKeyLength(), alg.getIvLength() };
}
@Override
public String toString() {
return getClass().getSimpleName() + '@' + Integer.toHexString(hashCode()) +
"";
}
}
private static javax.crypto.Cipher getCipherInstance(final String transformation, boolean silent)
throws NoSuchAlgorithmException, NoSuchPaddingException {
try {
return SecurityHelper.getCipher(transformation); // tries BC if it's available
}
catch (NoSuchAlgorithmException e) {
if ( silent ) return null;
throw e;
}
catch (NoSuchPaddingException e) {
if ( silent ) return null;
throw e;
}
}
public Cipher(Ruby runtime, RubyClass type) {
super(runtime, type);
}
private javax.crypto.Cipher cipher; // the "real" (Java) Cipher object
private String name;
private String cryptoBase;
private String cryptoVersion;
private String cryptoMode;
private String paddingType;
private String realName; // Cipher's "real" (Java) name - used to instantiate
private int keyLength = -1;
private int generateKeyLength = -1;
private int ivLength = -1;
private boolean encryptMode = true;
//private IRubyObject[] modeParams;
private boolean cipherInited = false;
private byte[] key;
private byte[] realIV;
private byte[] orgIV;
private String padding;
private void dumpVars(final PrintStream out, final String header) {
out.println(this.toString() + ' ' + header +
"\n" +
" name = " + name +
" cryptoBase = " + cryptoBase +
" cryptoVersion = " + cryptoVersion +
" cryptoMode = " + cryptoMode +
" padding_type = " + paddingType +
" realName = " + realName +
" keyLength = " + keyLength +
" ivLength = " + ivLength +
"\n" +
" cipher.alg = " + (cipher == null ? null : cipher.getAlgorithm()) +
" cipher.blockSize = " + (cipher == null ? null : cipher.getBlockSize()) +
" encryptMode = " + encryptMode + " cipherInited = " + cipherInited +
" key.length = " + (key == null ? 0 : key.length) +
" iv.length = " + (realIV == null ? 0 : realIV.length) +
" padding = " + padding);
}
@JRubyMethod(required = 1, visibility = Visibility.PRIVATE)
public IRubyObject initialize(final ThreadContext context, final IRubyObject name) {
initializeImpl(context.runtime, name.toString());
return this;
}
final void initializeImpl(final Ruby runtime, final String name) {
//if ( ! isSupportedCipher(name) ) {
// throw newCipherError(runtime, "unsupported cipher algorithm ("+ name +")");
//}
if ( cipher != null ) {
throw runtime.newRuntimeError("Cipher already inititalized!");
}
updateCipher(name, padding);
}
@Override
@JRubyMethod(required = 1, visibility = Visibility.PRIVATE)
public IRubyObject initialize_copy(final IRubyObject obj) {
if ( this == obj ) return this;
checkFrozen();
final Cipher other = (Cipher) obj;
cryptoBase = other.cryptoBase;
cryptoVersion = other.cryptoVersion;
cryptoMode = other.cryptoMode;
paddingType = other.paddingType;
realName = other.realName;
name = other.name;
keyLength = other.keyLength;
ivLength = other.ivLength;
encryptMode = other.encryptMode;
cipherInited = false;
if ( other.key != null ) {
key = Arrays.copyOf(other.key, other.key.length);
} else {
key = null;
}
if (other.realIV != null) {
realIV = Arrays.copyOf(other.realIV, other.realIV.length);
} else {
realIV = null;
}
this.orgIV = this.realIV;
padding = other.padding;
cipher = getCipherInstance();
return this;
}
@JRubyMethod
public final RubyString name() {
return getRuntime().newString(name);
}
@JRubyMethod
public final RubyInteger key_len() {
return getRuntime().newFixnum(keyLength);
}
@JRubyMethod
public final RubyInteger iv_len() {
return getRuntime().newFixnum(ivLength);
}
@JRubyMethod(name = "key_len=", required = 1)
public final IRubyObject set_key_len(IRubyObject len) {
this.keyLength = RubyNumeric.fix2int(len);
return len;
}
@JRubyMethod(name = "key=", required = 1)
public IRubyObject set_key(final ThreadContext context, final IRubyObject key) {
final ByteList keyBytes;
try {
keyBytes = key.asString().getByteList();
}
catch (Exception e) {
final Ruby runtime = context.runtime;
debugStackTrace(runtime, e);
throw newCipherError(runtime, e);
}
if ( keyBytes.length() < keyLength ) {
throw newCipherError(context.runtime, "key length too short");
}
final byte[] k = new byte[keyLength];
System.arraycopy(keyBytes.unsafeBytes(), keyBytes.getBegin(), k, 0, keyLength);
this.key = k;
return key;
}
@JRubyMethod(name = "iv=", required = 1)
public IRubyObject set_iv(final ThreadContext context, final IRubyObject iv) {
final ByteList ivBytes;
try {
ivBytes = iv.asString().getByteList();
}
catch (Exception e) {
final Ruby runtime = context.runtime;
debugStackTrace(runtime, e);
throw newCipherError(runtime, e);
}
if ( ivBytes.length() < ivLength ) {
throw newCipherError(context.runtime, "iv length too short");
}
// EVP_CipherInit_ex uses leading IV length of given sequence.
final byte[] i = new byte[ivLength];
System.arraycopy(ivBytes.unsafeBytes(), ivBytes.getBegin(), i, 0, ivLength);
this.realIV = i;
this.orgIV = this.realIV;
if ( ! isStreamCipher() ) cipherInited = false;
return iv;
}
@JRubyMethod
public IRubyObject block_size(final ThreadContext context) {
final Ruby runtime = context.runtime;
checkCipherNotNull(runtime);
if ( isStreamCipher() ) {
// getBlockSize() returns 0 for stream cipher in JCE
// OpenSSL returns 1 for RC4.
return runtime.newFixnum(1);
}
return runtime.newFixnum(cipher.getBlockSize());
}
private void init(final ThreadContext context, final IRubyObject[] args, final boolean encrypt) {
final Ruby runtime = context.runtime;
Arity.checkArgumentCount(runtime, args, 0, 2);
encryptMode = encrypt;
cipherInited = false;
if ( args.length > 0 ) {
/*
* oops. this code mistakes salt for IV.
* We deprecated the arguments for this method, but we decided
* keeping this behaviour for backward compatibility.
*/
byte[] pass = args[0].asString().getBytes();
byte[] iv = null;
try {
iv = "OpenSSL for Ruby rulez!".getBytes("ISO8859-1");
byte[] iv2 = new byte[this.ivLength];
System.arraycopy(iv, 0, iv2, 0, this.ivLength);
iv = iv2;
} catch (Exception e) {
}
if ( args.length > 1 && ! args[1].isNil() ) {
runtime.getWarnings().warning(ID.MISCELLANEOUS, "key derivation by " + getMetaClass().getRealClass().getName() + "#encrypt is deprecated; use " + getMetaClass().getRealClass().getName() + "::pkcs5_keyivgen instead");
iv = args[1].asString().getBytes();
if (iv.length > this.ivLength) {
byte[] iv2 = new byte[this.ivLength];
System.arraycopy(iv, 0, iv2, 0, this.ivLength);
iv = iv2;
}
}
final MessageDigest digest = Digest.getDigest(runtime, "MD5");
KeyAndIv result = evpBytesToKey(keyLength, ivLength, digest, iv, pass, 2048);
this.key = result.key;
this.realIV = iv;
this.orgIV = this.realIV;
}
}
@JRubyMethod(optional = 2)
public IRubyObject encrypt(final ThreadContext context, IRubyObject[] args) {
this.realIV = orgIV;
init(context, args, true);
return this;
}
@JRubyMethod(optional = 2)
public IRubyObject decrypt(final ThreadContext context, IRubyObject[] args) {
this.realIV = orgIV;
init(context, args, false);
return this;
}
@JRubyMethod
public IRubyObject reset(final ThreadContext context) {
final Ruby runtime = context.runtime;
checkCipherNotNull(runtime);
if ( ! isStreamCipher() ) {
this.realIV = orgIV;
doInitCipher(runtime);
}
return this;
}
private void updateCipher(final String name, final String padding) {
// given 'rc4' must be 'RC4' here. OpenSSL checks it as a LN of object
// ID and set SN. We don't check 'name' is allowed as a LN in ASN.1 for
// the possibility of JCE specific algorithm so just do upperCase here
// for OpenSSL compatibility.
this.name = name.toUpperCase();
this.padding = padding;
final Algorithm alg = Algorithm.osslToJava(this.name, this.padding);
cryptoBase = alg.base;
cryptoVersion = alg.version;
cryptoMode = alg.mode;
realName = alg.getRealName();
paddingType = alg.getPadding();
keyLength = alg.getKeyLength();
ivLength = alg.getIvLength();
if ( "DES".equalsIgnoreCase(cryptoBase) ) {
generateKeyLength = keyLength / 8 * 7;
}
cipher = getCipherInstance();
}
final javax.crypto.Cipher getCipherInstance() {
try {
return getCipherInstance(realName, false);
}
catch (NoSuchAlgorithmException e) {
throw newCipherError(getRuntime(), "unsupported cipher algorithm (" + realName + ")");
}
catch (NoSuchPaddingException e) {
throw newCipherError(getRuntime(), "unsupported cipher padding (" + realName + ")");
}
}
@JRubyMethod(required = 1, optional = 3)
public IRubyObject pkcs5_keyivgen(final ThreadContext context, final IRubyObject[] args) {
final Ruby runtime = context.runtime;
Arity.checkArgumentCount(runtime, args, 1, 4);
byte[] pass = args[0].asString().getBytes();
byte[] salt = null;
int iter = 2048;
IRubyObject vdigest = runtime.getNil();
if ( args.length > 1 ) {
if ( ! args[1].isNil() ) {
salt = args[1].asString().getBytes();
}
if ( args.length > 2 ) {
if ( ! args[2].isNil() ) {
iter = RubyNumeric.fix2int(args[2]);
}
if ( args.length > 3 ) {
vdigest = args[3];
}
}
}
if ( salt != null && salt.length != 8 ) {
throw newCipherError(runtime, "salt must be an 8-octet string");
}
final String algorithm;
if ( vdigest.isNil() ) algorithm = "MD5";
else {
algorithm = (vdigest instanceof Digest) ? ((Digest) vdigest).getAlgorithm() : vdigest.asJavaString();
}
final MessageDigest digest = Digest.getDigest(runtime, algorithm);
KeyAndIv result = evpBytesToKey(keyLength, ivLength, digest, salt, pass, iter);
this.key = result.key;
this.realIV = result.iv;
this.orgIV = this.realIV;
doInitCipher(runtime);
return runtime.getNil();
}
private void doInitCipher(final Ruby runtime) {
if ( isDebug(runtime) ) {
dumpVars( runtime.getOut(), "doInitCipher()" );
}
checkCipherNotNull(runtime);
if ( key == null ) { //key = emptyKey(keyLength);
throw newCipherError(runtime, "key not specified");
}
try {
// ECB mode is the only mode that does not require an IV
if ( "ECB".equalsIgnoreCase(cryptoMode) ) {
cipher.init(encryptMode ? ENCRYPT_MODE : DECRYPT_MODE,
new SimpleSecretKey(getCipherAlgorithm(), this.key)
);
}
else {
// if no IV yet, start out with all \0s
if ( realIV == null ) realIV = new byte[ivLength];
if ( "RC2".equalsIgnoreCase(cryptoBase) ) {
cipher.init(encryptMode ? ENCRYPT_MODE : DECRYPT_MODE,
new SimpleSecretKey("RC2", this.key),
new RC2ParameterSpec(this.key.length * 8, this.realIV)
);
}
else if ( "RC4".equalsIgnoreCase(cryptoBase) ) {
cipher.init(encryptMode ? ENCRYPT_MODE : DECRYPT_MODE,
new SimpleSecretKey("RC4", this.key)
);
}
else {
final AlgorithmParameterSpec ivSpec;
if ( "GCM".equalsIgnoreCase(cryptoMode) ) { // e.g. 'aes-128-gcm'
ivSpec = new GCMParameterSpec(getAuthTagLength() * 8, this.realIV);
}
else {
ivSpec = new IvParameterSpec(this.realIV);
}
cipher.init(encryptMode ? ENCRYPT_MODE : DECRYPT_MODE,
new SimpleSecretKey(getCipherAlgorithm(), this.key),
ivSpec
);
}
}
}
catch (InvalidKeyException e) {
throw newCipherError(runtime, e + "\n possibly you need to install Java Cryptography Extension (JCE) Unlimited Strength Jurisdiction Policy Files for your JRE");
}
catch (Exception e) {
debugStackTrace(runtime, e);
throw newCipherError(runtime, e);
}
cipherInited = true;
processedDataBytes = 0;
//outBuffer = new ByteList(keyLength);
}
private String getCipherAlgorithm() {
final int idx = realName.indexOf('/');
return idx <= 0 ? realName : realName.substring(0, idx);
}
private int processedDataBytes = 0;
//private volatile ByteList outBuffer;
private byte[] lastIV;
@JRubyMethod
public IRubyObject update(final ThreadContext context, final IRubyObject arg) {
final Ruby runtime = context.runtime;
if ( isDebug(runtime) ) dumpVars( runtime.getOut(), "update()" );
checkCipherNotNull(runtime);
checkAuthTag(runtime);
final ByteList data = arg.asString().getByteList();
final int length = data.length();
if ( length == 0 ) {
throw runtime.newArgumentError("data must not be empty");
}
if ( ! cipherInited ) doInitCipher(runtime);
final ByteList str;
try {
updateAuthData(runtime); // if any
final byte[] in = data.getUnsafeBytes();
final int offset = data.begin();
final byte[] out = cipher.update(in, offset, length);
if ( out != null ) {
str = new ByteList(out, false);
if ( realIV != null ) {
if ( encryptMode ) setLastIVIfNeeded( out );
else setLastIVIfNeeded( in, offset, length );
}
processedDataBytes += length;
}
else {
str = new ByteList(ByteList.NULL_ARRAY);
}
}
catch (Exception e) {
debugStackTrace( runtime, e );
throw newCipherError(runtime, e);
}
return RubyString.newString(runtime, str);
}
@JRubyMethod(name = "<<")
public IRubyObject update_deprecated(final ThreadContext context, final IRubyObject data) {
context.runtime.getWarnings().warn(ID.DEPRECATED_METHOD, getMetaClass().getRealClass().getName() + "#<< is deprecated; use #update instead");
return update(context, data);
}
@JRubyMethod(name = "final")
public IRubyObject do_final(final ThreadContext context) {
final Ruby runtime = context.runtime;
checkCipherNotNull(runtime);
checkAuthTag(runtime);
if ( ! cipherInited ) doInitCipher(runtime);
// trying to allow update after final like cruby-openssl. Bad idea.
if ( "RC4".equalsIgnoreCase(cryptoBase) ) return runtime.newString("");
final ByteList str;
try {
if ( isAuthDataMode() ) {
str = do_final_with_auth(runtime);
}
else {
final byte[] out = cipher.doFinal();
if ( out != null ) {
// TODO: Modifying this line appears to fix the issue, but I do
// not have a good reason for why. Best I can tell, lastIv needs
// to be set regardless of encryptMode, so we'll go with this
// for now. JRUBY-3335.
//if ( realIV != null && encryptMode ) ...
str = new ByteList(out, false);
if ( realIV != null ) setLastIVIfNeeded(out);
}
else {
str = new ByteList(ByteList.NULL_ARRAY);
}
}
//if ( ! isStreamCipher() ) {
//if ( str.length() > processedDataBytes && processedDataBytes > 0 ) {
// MRI compatibility only trailing bytes :
//str.setRealSize(processedDataBytes);
//}
//}
if (realIV != null) {
realIV = lastIV;
doInitCipher(runtime);
}
}
catch (GeneralSecurityException e) { // cipher.doFinal
debugStackTrace(runtime, e);
throw newCipherError(runtime, e);
}
catch (RuntimeException e) {
debugStackTrace(runtime, e);
throw newCipherError(runtime, e);
}
return RubyString.newString(runtime, str);
}
private ByteList do_final_with_auth(final Ruby runtime) throws GeneralSecurityException {
updateAuthData(runtime); // if any
final ByteList str;
// if GCM/CCM is being used, the authentication tag is appended
// in the case of encryption, or verified in the case of decryption.
// The result is stored in a new buffer.
if ( encryptMode ) {
final byte[] out = cipher.doFinal();
final int len = getAuthTagLength(); int strLen;
if ( ( strLen = out.length - len ) > 0 ) {
str = new ByteList(out, 0, strLen, false);
}
else {
str = new ByteList(ByteList.NULL_ARRAY); strLen = 0;
}
auth_tag = new ByteList(out, strLen, out.length - strLen);
return str;
}
else {
final byte[] out;
if ( auth_tag != null ) {
final byte[] tag = auth_tag.getUnsafeBytes();
out = cipher.doFinal(tag, auth_tag.begin(), auth_tag.length());
}
else {
out = cipher.doFinal();
}
return new ByteList(out, false);
}
}
private void checkAuthTag(final Ruby runtime) {
if ( auth_tag != null && encryptMode ) {
throw newCipherError(runtime, "authentication tag already generated by cipher");
}
}
private void setLastIVIfNeeded(final byte[] tmpIV) {
setLastIVIfNeeded(tmpIV, 0, tmpIV.length);
}
private void setLastIVIfNeeded(final byte[] tmpIV, final int offset, final int length) {
final int ivLen = this.ivLength;
if ( lastIV == null ) lastIV = new byte[ivLen];
if ( length >= ivLen ) {
System.arraycopy(tmpIV, offset + (length - ivLen), lastIV, 0, ivLen);
}
}
@JRubyMethod(name = "padding=")
public IRubyObject set_padding(IRubyObject padding) {
updateCipher(name, padding.toString());
return padding;
}
private transient ByteList auth_tag;
@JRubyMethod(name = "auth_tag")
public IRubyObject auth_tag(final ThreadContext context) {
if ( auth_tag != null ) {
return RubyString.newString(context.runtime, auth_tag);
}
if ( ! isAuthDataMode() ) {
throw newCipherError(context.runtime, "authentication tag not supported by this cipher");
}
return context.nil;
}
@JRubyMethod(name = "auth_tag=")
public IRubyObject set_auth_tag(final ThreadContext context, final IRubyObject tag) {
if ( ! isAuthDataMode() ) {
throw newCipherError(context.runtime, "authentication tag not supported by this cipher");
}
final RubyString auth_tag = tag.asString();
this.auth_tag = StringHelper.setByteListShared(auth_tag);
return auth_tag;
}
private boolean isAuthDataMode() { // Authenticated Encryption with Associated Data (AEAD)
return "GCM".equalsIgnoreCase(cryptoMode) || "CCM".equalsIgnoreCase(cryptoMode);
}
private static final int MAX_AUTH_TAG_LENGTH = 16;
private int getAuthTagLength() {
return Math.min(MAX_AUTH_TAG_LENGTH, this.key.length); // in bytes
}
private transient ByteList auth_data;
@JRubyMethod(name = "auth_data=")
public IRubyObject set_auth_data(final ThreadContext context, final IRubyObject data) {
if ( ! isAuthDataMode() ) {
throw newCipherError(context.runtime, "authentication data not supported by this cipher");
}
final RubyString auth_data = data.asString();
this.auth_data = StringHelper.setByteListShared(auth_data);
return auth_data;
}
private boolean updateAuthData(final Ruby runtime) {
if ( auth_data == null ) return false; // only to be set if auth-mode
//try {
final byte[] data = auth_data.getUnsafeBytes();
cipher.updateAAD(data, auth_data.begin(), auth_data.length());
//}
//catch (RuntimeException e) {
// debugStackTrace( runtime, e );
// throw newCipherError(runtime, e);
//}
auth_data = null;
return true;
}
@JRubyMethod(name = "authenticated?")
public RubyBoolean authenticated_p(final ThreadContext context) {
return context.runtime.newBoolean( isAuthDataMode() );
}
@JRubyMethod
public IRubyObject random_key(final ThreadContext context) {
// str = OpenSSL::Random.random_bytes(self.key_len)
// self.key = str
// return str
RubyString str = Random.random_bytes(context, this.keyLength);
this.set_key(context, str); return str;
}
@JRubyMethod
public IRubyObject random_iv(final ThreadContext context) {
// str = OpenSSL::Random.random_bytes(self.iv_len)
// self.iv = str
// return str
RubyString str = Random.random_bytes(context, this.ivLength);
this.set_iv(context, str); return str;
}
//String getAlgorithm() {
// return this.cipher.getAlgorithm();
//}
final String getName() {
return this.name;
}
//String getCryptoBase() {
// return this.cryptoBase;
//}
//String getCryptoMode() {
// return this.cryptoMode;
//}
final int getKeyLength() {
return keyLength;
}
final int getGenerateKeyLength() {
return (generateKeyLength == -1) ? keyLength : generateKeyLength;
}
private void checkCipherNotNull(final Ruby runtime) {
if ( cipher == null ) {
throw runtime.newRuntimeError("Cipher not inititalized!");
}
}
private boolean isStreamCipher() {
return cipher.getBlockSize() == 0;
}
private static RaiseException newCipherError(Ruby runtime, Exception e) {
return Utils.newError(runtime, _Cipher(runtime).getClass("CipherError"), e);
}
private static RaiseException newCipherError(Ruby runtime, String message) {
return Utils.newError(runtime, _Cipher(runtime).getClass("CipherError"), message);
}
private static class KeyAndIv {
final byte[] key;
final byte[] iv;
KeyAndIv(byte[] key, byte[] iv) {
this.key = key;
this.iv = iv;
}
}
private static KeyAndIv evpBytesToKey(
final int key_len, final int iv_len,
final MessageDigest md,
final byte[] salt,
final byte[] data,
final int count) {
final byte[] key = new byte[key_len]; final byte[] iv = new byte[iv_len];
if ( data == null ) return new KeyAndIv(key, iv);
int key_ix = 0; int iv_ix = 0;
byte[] md_buf = null;
int nkey = key_len; int niv = iv_len;
int i; int addmd = 0;
for(;;) {
md.reset();
if ( addmd++ > 0 ) md.update(md_buf);
md.update(data);
if ( salt != null ) md.update(salt, 0, 8);
md_buf = md.digest();
for ( i = 1; i < count; i++ ) {
md.reset();
md.update(md_buf);
md_buf = md.digest();
}
i = 0;
if ( nkey > 0 ) {
for(;;) {
if ( nkey == 0) break;
if ( i == md_buf.length ) break;
key[ key_ix++ ] = md_buf[i];
nkey--; i++;
}
}
if ( niv > 0 && i != md_buf.length ) {
for(;;) {
if ( niv == 0 ) break;
if ( i == md_buf.length ) break;
iv[ iv_ix++ ] = md_buf[i];
niv--; i++;
}
}
if ( nkey == 0 && niv == 0 ) break;
}
return new KeyAndIv(key,iv);
}
private static class NamedCipherAllocator implements ObjectAllocator {
private final String cipherBase;
NamedCipherAllocator(final String cipherBase) {
this.cipherBase = cipherBase;
}
public Named allocate(Ruby runtime, RubyClass klass) {
return new Named(runtime, klass, cipherBase);
}
};
public static class Named extends Cipher {
private static final long serialVersionUID = 5599069534014317221L;
final String cipherBase;
Named(Ruby runtime, RubyClass type, String cipherBase) {
super(runtime, type);
this.cipherBase = cipherBase; // e.g. "AES"
}
/*
AES = Class.new(Cipher) do
define_method(:initialize) do |*args|
cipher_name = args.inject('AES'){|n, arg| "#{n}-#{arg}" }
super(cipher_name)
end
end
*/
@JRubyMethod(rest = true, visibility = Visibility.PRIVATE)
public IRubyObject initialize(final ThreadContext context, final IRubyObject[] args) {
final StringBuilder name = new StringBuilder();
name.append(cipherBase);
if ( args != null ) {
for ( int i = 0; i < args.length; i++ ) {
name.append('-').append( args[i].asString() );
}
}
initializeImpl(context.runtime, name.toString());
return this;
}
}
private static class AESCipherAllocator implements ObjectAllocator {
private final String keyLength;
AESCipherAllocator(final String keyLength) {
this.keyLength = keyLength;
}
public AES allocate(Ruby runtime, RubyClass klass) {
return new AES(runtime, klass, keyLength);
}
};
public static class AES extends Cipher {
private static final long serialVersionUID = -3627749495034257750L;
final String keyLength;
AES(Ruby runtime, RubyClass type, String keyLength) {
super(runtime, type);
this.keyLength = keyLength; // e.g. "256"
}
/*
AES256 = Class.new(Cipher) do
define_method(:initialize) do |mode|
mode ||= "CBC"
cipher_name = "AES-256-#{mode}"
super(cipher_name)
end
end
*/
@JRubyMethod(rest = true, visibility = Visibility.PRIVATE)
public IRubyObject initialize(final ThreadContext context, final IRubyObject[] args) {
final String mode;
if ( args != null && args.length > 0 ) {
mode = args[0].toString();
}
else {
mode = "CBC";
}
initializeImpl(context.runtime, "AES-" + keyLength + '-' + mode);
return this;
}
}
}
jruby-openssl-0.9.21/src/main/java/org/jruby/ext/openssl/CipherStrings.java 0000664 0000000 0000000 00000277103 13136616216 0026726 0 ustar 00root root 0000000 0000000 /***** BEGIN LICENSE BLOCK *****
* Version: EPL 1.0/GPL 2.0/LGPL 2.1
*
* The contents of this file are subject to the Eclipse Public
* License Version 1.0 (the "License"); you may not use this file
* except in compliance with the License. You may obtain a copy of
* the License at http://www.eclipse.org/legal/epl-v10.html
*
* Software distributed under the License is distributed on an "AS
* IS" basis, WITHOUT WARRANTY OF ANY KIND, either express or
* implied. See the License for the specific language governing
* rights and limitations under the License.
*
* Copyright (C) 2008 Ola Bini
*
* Alternatively, the contents of this file may be used under the terms of
* either of the GNU General Public License Version 2 or later (the "GPL"),
* or the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
* in which case the provisions of the GPL or the LGPL are applicable instead
* of those above. If you wish to allow use of your version of this file only
* under the terms of either the GPL or the LGPL, and not to allow others to
* use your version of this file under the terms of the EPL, indicate your
* decision by deleting the provisions above and replace them with the notice
* and other provisions required by the GPL or the LGPL. If you do not delete
* the provisions above, a recipient may use your version of this file under
* the terms of any one of the EPL, the GPL or the LGPL.
***** END LICENSE BLOCK *****/
package org.jruby.ext.openssl;
import java.util.ArrayList;
import java.util.Collection;
import java.util.Collections;
import java.util.HashMap;
import java.util.HashSet;
import java.util.LinkedHashSet;
import java.util.LinkedList;
import java.util.List;
import java.util.Map;
import java.util.Set;
/**
*
* @author Ola Bini
*/
public class CipherStrings {
public final static String SSL2_TXT_DES_64_CFB64_WITH_MD5_1 = "DES-CFB-M1";
public final static String SSL2_TXT_NULL_WITH_MD5 = "NULL-MD5";
public final static String SSL2_TXT_RC4_128_WITH_MD5 = "RC4-MD5";
public final static String SSL2_TXT_RC4_128_EXPORT40_WITH_MD5 = "EXP-RC4-MD5";
public final static String SSL2_TXT_RC2_128_CBC_WITH_MD5 = "RC2-CBC-MD5";
public final static String SSL2_TXT_RC2_128_CBC_EXPORT40_WITH_MD5 = "EXP-RC2-CBC-MD5";
public final static String SSL2_TXT_IDEA_128_CBC_WITH_MD5 = "IDEA-CBC-MD5";
public final static String SSL2_TXT_DES_64_CBC_WITH_MD5 = "DES-CBC-MD5";
public final static String SSL2_TXT_DES_64_CBC_WITH_SHA = "DES-CBC-SHA";
public final static String SSL2_TXT_DES_192_EDE3_CBC_WITH_MD5 = "DES-CBC3-MD5";
public final static String SSL2_TXT_DES_192_EDE3_CBC_WITH_SHA = "DES-CBC3-SHA";
public final static String SSL2_TXT_RC4_64_WITH_MD5 = "RC4-64-MD5";
public final static String SSL2_TXT_NULL = "NULL";
public final static String SSL3_TXT_RSA_NULL_MD5 = "NULL-MD5";
public final static String SSL3_TXT_RSA_NULL_SHA = "NULL-SHA";
public final static String SSL3_TXT_RSA_RC4_40_MD5 = "EXP-RC4-MD5";
public final static String SSL3_TXT_RSA_RC4_128_MD5 = "RC4-MD5";
public final static String SSL3_TXT_RSA_RC4_128_SHA = "RC4-SHA";
public final static String SSL3_TXT_RSA_RC2_40_MD5 = "EXP-RC2-CBC-MD5";
public final static String SSL3_TXT_RSA_IDEA_128_SHA = "IDEA-CBC-SHA";
public final static String SSL3_TXT_RSA_DES_40_CBC_SHA = "EXP-DES-CBC-SHA";
public final static String SSL3_TXT_RSA_DES_64_CBC_SHA = "DES-CBC-SHA";
public final static String SSL3_TXT_RSA_DES_192_CBC3_SHA = "DES-CBC3-SHA";
public final static String SSL3_TXT_DH_DSS_DES_40_CBC_SHA = "EXP-DH-DSS-DES-CBC-SHA";
public final static String SSL3_TXT_DH_DSS_DES_64_CBC_SHA = "DH-DSS-DES-CBC-SHA";
public final static String SSL3_TXT_DH_DSS_DES_192_CBC3_SHA = "DH-DSS-DES-CBC3-SHA";
public final static String SSL3_TXT_DH_RSA_DES_40_CBC_SHA = "EXP-DH-RSA-DES-CBC-SHA";
public final static String SSL3_TXT_DH_RSA_DES_64_CBC_SHA = "DH-RSA-DES-CBC-SHA";
public final static String SSL3_TXT_DH_RSA_DES_192_CBC3_SHA = "DH-RSA-DES-CBC3-SHA";
public final static String SSL3_TXT_EDH_DSS_DES_40_CBC_SHA = "EXP-EDH-DSS-DES-CBC-SHA";
public final static String SSL3_TXT_EDH_DSS_DES_64_CBC_SHA = "EDH-DSS-DES-CBC-SHA";
public final static String SSL3_TXT_EDH_DSS_DES_192_CBC3_SHA = "EDH-DSS-DES-CBC3-SHA";
public final static String SSL3_TXT_EDH_RSA_DES_40_CBC_SHA = "EXP-EDH-RSA-DES-CBC-SHA";
public final static String SSL3_TXT_EDH_RSA_DES_64_CBC_SHA = "EDH-RSA-DES-CBC-SHA";
public final static String SSL3_TXT_EDH_RSA_DES_192_CBC3_SHA = "EDH-RSA-DES-CBC3-SHA";
public final static String SSL3_TXT_ADH_RC4_40_MD5 = "EXP-ADH-RC4-MD5";
public final static String SSL3_TXT_ADH_RC4_128_MD5 = "ADH-RC4-MD5";
public final static String SSL3_TXT_ADH_DES_40_CBC_SHA = "EXP-ADH-DES-CBC-SHA";
public final static String SSL3_TXT_ADH_DES_64_CBC_SHA = "ADH-DES-CBC-SHA";
public final static String SSL3_TXT_ADH_DES_192_CBC_SHA = "ADH-DES-CBC3-SHA";
public final static String SSL3_TXT_FZA_DMS_NULL_SHA = "FZA-NULL-SHA";
public final static String SSL3_TXT_FZA_DMS_FZA_SHA = "FZA-FZA-CBC-SHA";
public final static String SSL3_TXT_FZA_DMS_RC4_SHA = "FZA-RC4-SHA";
public final static String SSL3_TXT_KRB5_DES_64_CBC_SHA = "KRB5-DES-CBC-SHA";
public final static String SSL3_TXT_KRB5_DES_192_CBC3_SHA = "KRB5-DES-CBC3-SHA";
public final static String SSL3_TXT_KRB5_RC4_128_SHA = "KRB5-RC4-SHA";
public final static String SSL3_TXT_KRB5_IDEA_128_CBC_SHA = "KRB5-IDEA-CBC-SHA";
public final static String SSL3_TXT_KRB5_DES_64_CBC_MD5 = "KRB5-DES-CBC-MD5";
public final static String SSL3_TXT_KRB5_DES_192_CBC3_MD5 = "KRB5-DES-CBC3-MD5";
public final static String SSL3_TXT_KRB5_RC4_128_MD5 = "KRB5-RC4-MD5";
public final static String SSL3_TXT_KRB5_IDEA_128_CBC_MD5 = "KRB5-IDEA-CBC-MD5";
public final static String SSL3_TXT_KRB5_DES_40_CBC_SHA = "EXP-KRB5-DES-CBC-SHA";
public final static String SSL3_TXT_KRB5_RC2_40_CBC_SHA = "EXP-KRB5-RC2-CBC-SHA";
public final static String SSL3_TXT_KRB5_RC4_40_SHA = "EXP-KRB5-RC4-SHA";
public final static String SSL3_TXT_KRB5_DES_40_CBC_MD5 = "EXP-KRB5-DES-CBC-MD5";
public final static String SSL3_TXT_KRB5_RC2_40_CBC_MD5 = "EXP-KRB5-RC2-CBC-MD5";
public final static String SSL3_TXT_KRB5_RC4_40_MD5 = "EXP-KRB5-RC4-MD5";
public final static String SSL_TXT_NULL_WITH_MD5 = SSL2_TXT_NULL_WITH_MD5;
public final static String SSL_TXT_RC4_128_WITH_MD5 = SSL2_TXT_RC4_128_WITH_MD5;
public final static String SSL_TXT_RC4_128_EXPORT40_WITH_MD5 = SSL2_TXT_RC4_128_EXPORT40_WITH_MD5;
public final static String SSL_TXT_RC2_128_CBC_WITH_MD5 = SSL2_TXT_RC2_128_CBC_WITH_MD5;
public final static String SSL_TXT_RC2_128_CBC_EXPORT40_WITH_MD5 = SSL2_TXT_RC2_128_CBC_EXPORT40_WITH_MD5;
public final static String SSL_TXT_IDEA_128_CBC_WITH_MD5 = SSL2_TXT_IDEA_128_CBC_WITH_MD5;
public final static String SSL_TXT_DES_64_CBC_WITH_MD5 = SSL2_TXT_DES_64_CBC_WITH_MD5;
public final static String SSL_TXT_DES_64_CBC_WITH_SHA = SSL2_TXT_DES_64_CBC_WITH_SHA;
public final static String SSL_TXT_DES_192_EDE3_CBC_WITH_MD5 = SSL2_TXT_DES_192_EDE3_CBC_WITH_MD5;
public final static String SSL_TXT_DES_192_EDE3_CBC_WITH_SHA = SSL2_TXT_DES_192_EDE3_CBC_WITH_SHA;
public final static String SSL_TXT_KRB5_DES_64_CBC_SHA = SSL3_TXT_KRB5_DES_64_CBC_SHA;
public final static String SSL_TXT_KRB5_DES_192_CBC3_SHA = SSL3_TXT_KRB5_DES_192_CBC3_SHA;
public final static String SSL_TXT_KRB5_RC4_128_SHA = SSL3_TXT_KRB5_RC4_128_SHA;
public final static String SSL_TXT_KRB5_IDEA_128_CBC_SHA = SSL3_TXT_KRB5_IDEA_128_CBC_SHA;
public final static String SSL_TXT_KRB5_DES_64_CBC_MD5 = SSL3_TXT_KRB5_DES_64_CBC_MD5;
public final static String SSL_TXT_KRB5_DES_192_CBC3_MD5 = SSL3_TXT_KRB5_DES_192_CBC3_MD5;
public final static String SSL_TXT_KRB5_RC4_128_MD5 = SSL3_TXT_KRB5_RC4_128_MD5;
public final static String SSL_TXT_KRB5_IDEA_128_CBC_MD5 = SSL3_TXT_KRB5_IDEA_128_CBC_MD5;
public final static String SSL_TXT_KRB5_DES_40_CBC_SHA = SSL3_TXT_KRB5_DES_40_CBC_SHA;
public final static String SSL_TXT_KRB5_RC2_40_CBC_SHA = SSL3_TXT_KRB5_RC2_40_CBC_SHA;
public final static String SSL_TXT_KRB5_RC4_40_SHA = SSL3_TXT_KRB5_RC4_40_SHA;
public final static String SSL_TXT_KRB5_DES_40_CBC_MD5 = SSL3_TXT_KRB5_DES_40_CBC_MD5;
public final static String SSL_TXT_KRB5_RC2_40_CBC_MD5 = SSL3_TXT_KRB5_RC2_40_CBC_MD5;
public final static String SSL_TXT_KRB5_RC4_40_MD5 = SSL3_TXT_KRB5_RC4_40_MD5;
public final static String SSL_TXT_LOW = "LOW";
public final static String SSL_TXT_MEDIUM = "MEDIUM";
public final static String SSL_TXT_HIGH = "HIGH";
public final static String SSL_TXT_kFZA = "kFZA";
public final static String SSL_TXT_aFZA = "aFZA";
public final static String SSL_TXT_eFZA = "eFZA";
public final static String SSL_TXT_FZA = "FZA";
public final static String SSL_TXT_aNULL = "aNULL";
public final static String SSL_TXT_eNULL = "eNULL";
public final static String SSL_TXT_NULL = "NULL";
public final static String SSL_TXT_kKRB5 = "kKRB5";
public final static String SSL_TXT_aKRB5 = "aKRB5";
public final static String SSL_TXT_KRB5 = "KRB5";
public final static String SSL_TXT_kRSA = "kRSA";
public final static String SSL_TXT_kDHr = "kDHr";
public final static String SSL_TXT_kDHd = "kDHd";
public final static String SSL_TXT_kEDH = "kEDH";
public final static String SSL_TXT_aRSA = "aRSA";
public final static String SSL_TXT_aDSS = "aDSS";
public final static String SSL_TXT_aDH = "aDH";
public final static String SSL_TXT_DSS = "DSS";
public final static String SSL_TXT_DH = "DH";
public final static String SSL_TXT_EDH = "EDH";
public final static String SSL_TXT_ADH = "ADH";
public final static String SSL_TXT_RSA = "RSA";
public final static String SSL_TXT_DES = "DES";
public final static String SSL_TXT_3DES = "3DES";
public final static String SSL_TXT_RC4 = "RC4";
public final static String SSL_TXT_RC2 = "RC2";
public final static String SSL_TXT_IDEA = "IDEA";
public final static String SSL_TXT_AES = "AES";
public final static String SSL_TXT_MD5 = "MD5";
public final static String SSL_TXT_SHA1 = "SHA1";
public final static String SSL_TXT_SHA = "SHA";
public final static String SSL_TXT_EXP = "EXP";
public final static String SSL_TXT_EXPORT = "EXPORT";
public final static String SSL_TXT_EXP40 = "EXPORT40";
public final static String SSL_TXT_EXP56 = "EXPORT56";
public final static String SSL_TXT_SSLV2 = "SSLv2";
public final static String SSL_TXT_SSLV3 = "SSLv3";
public final static String SSL_TXT_TLSV1 = "TLSv1";
public final static String SSL_TXT_ALL = "ALL";
public final static String SSL_TXT_ECC = "ECCdraft";
public final static String SSL_TXT_CMPALL = "COMPLEMENTOFALL";
public final static String SSL_TXT_CMPDEF = "COMPLEMENTOFDEFAULT";
// "ALL:!aNULL:!eNULL:!SSLv2" is for OpenSSL 1.0.0 GA
public final static String SSL_DEFAULT_CIPHER_LIST = "AES:ALL:!aNULL:!eNULL:+RC4:@STRENGTH";
public final static long SSL_MKEY_MASK = 0x000000FFL;
public final static long SSL_kRSA = 0x00000001L;
public final static long SSL_kDHr = 0x00000002L;
public final static long SSL_kDHd = 0x00000004L;
public final static long SSL_kFZA = 0x00000008L;
public final static long SSL_kEDH = 0x00000010L;
public final static long SSL_kKRB5 = 0x00000020L;
public final static long SSL_kECDH = 0x00000040L;
public final static long SSL_kECDHE = 0x00000080L;
public final static long SSL_aNULL = 0x00000800L;
public final static long SSL_AUTH_MASK = 0x00007F00L;
public final static long SSL_EDH = (SSL_kEDH|(SSL_AUTH_MASK^SSL_aNULL));
public final static long SSL_aRSA = 0x00000100L;
public final static long SSL_aDSS = 0x00000200L;
public final static long SSL_DSS = SSL_aDSS;
public final static long SSL_aFZA = 0x00000400L;
public final static long SSL_aDH = 0x00001000L;
public final static long SSL_aKRB5 = 0x00002000L;
public final static long SSL_aECDSA = 0x00004000L;
public final static long SSL_eNULL = 0x00200000L;
public final static long SSL_eFZA = 0x00100000L;
public final static long SSL_NULL = (SSL_eNULL);
public final static long SSL_ADH = (SSL_kEDH|SSL_aNULL);
public final static long SSL_RSA = (SSL_kRSA|SSL_aRSA);
public final static long SSL_DH = (SSL_kDHr|SSL_kDHd|SSL_kEDH);
public final static long SSL_ECDH = (SSL_kECDH|SSL_kECDHE);
public final static long SSL_FZA = (SSL_aFZA|SSL_kFZA|SSL_eFZA);
public final static long SSL_KRB5 = (SSL_kKRB5|SSL_aKRB5);
public final static long SSL_ENC_MASK = 0x043F8000L;
public final static long SSL_DES = 0x00008000L;
public final static long SSL_3DES = 0x00010000L;
public final static long SSL_RC4 = 0x00020000L;
public final static long SSL_RC2 = 0x00040000L;
public final static long SSL_IDEA = 0x00080000L;
public final static long SSL_AES = 0x04000000L;
public final static long SSL_MAC_MASK = 0x00c00000L;
public final static long SSL_MD5 = 0x00400000L;
public final static long SSL_SHA1 = 0x00800000L;
public final static long SSL_SHA = (SSL_SHA1);
public final static long SSL_SSL_MASK = 0x03000000L;
public final static long SSL_SSLV2 = 0x01000000L;
public final static long SSL_SSLV3 = 0x02000000L;
public final static long SSL_TLSV1 = SSL_SSLV3;
public final static long SSL_EXP_MASK = 0x00000003L;
public final static long SSL_NOT_EXP = 0x00000001L;
public final static long SSL_EXPORT = 0x00000002L;
public final static long SSL_STRONG_MASK = 0x000000fcL;
public final static long SSL_STRONG_NONE = 0x00000004L;
public final static long SSL_EXP40 = 0x00000008L;
public final static long SSL_MICRO = (SSL_EXP40);
public final static long SSL_EXP56 = 0x00000010L;
public final static long SSL_MINI = (SSL_EXP56);
public final static long SSL_LOW = 0x00000020L;
public final static long SSL_MEDIUM = 0x00000040L;
public final static long SSL_HIGH = 0x00000080L;
public final static long SSL_ALL = 0xffffffffL;
public final static long SSL_ALL_CIPHERS = (SSL_MKEY_MASK|SSL_AUTH_MASK|SSL_ENC_MASK|SSL_MAC_MASK);
public final static long SSL_ALL_STRENGTHS = (SSL_EXP_MASK|SSL_STRONG_MASK);
public final static long SSL_PKEY_RSA_ENC = 0;
public final static long SSL_PKEY_RSA_SIGN = 1;
public final static long SSL_PKEY_DSA_SIGN = 2;
public final static long SSL_PKEY_DH_RSA = 3;
public final static long SSL_PKEY_DH_DSA = 4;
public final static long SSL_PKEY_ECC = 5;
public final static long SSL_PKEY_NUM = 6;
public final static long SSL3_CK_RSA_NULL_MD5 = 0x03000001;
public final static long SSL3_CK_RSA_NULL_SHA = 0x03000002;
public final static long SSL3_CK_RSA_RC4_40_MD5 = 0x03000003;
public final static long SSL3_CK_RSA_RC4_128_MD5 = 0x03000004;
public final static long SSL3_CK_RSA_RC4_128_SHA = 0x03000005;
public final static long SSL3_CK_RSA_RC2_40_MD5 = 0x03000006;
public final static long SSL3_CK_RSA_IDEA_128_SHA = 0x03000007;
public final static long SSL3_CK_RSA_DES_40_CBC_SHA = 0x03000008;
public final static long SSL3_CK_RSA_DES_64_CBC_SHA = 0x03000009;
public final static long SSL3_CK_RSA_DES_192_CBC3_SHA = 0x0300000A;
public final static long SSL3_CK_DH_DSS_DES_40_CBC_SHA = 0x0300000B;
public final static long SSL3_CK_DH_DSS_DES_64_CBC_SHA = 0x0300000C;
public final static long SSL3_CK_DH_DSS_DES_192_CBC3_SHA = 0x0300000D;
public final static long SSL3_CK_DH_RSA_DES_40_CBC_SHA = 0x0300000E;
public final static long SSL3_CK_DH_RSA_DES_64_CBC_SHA = 0x0300000F;
public final static long SSL3_CK_DH_RSA_DES_192_CBC3_SHA = 0x03000010;
public final static long SSL3_CK_EDH_DSS_DES_40_CBC_SHA = 0x03000011;
public final static long SSL3_CK_EDH_DSS_DES_64_CBC_SHA = 0x03000012;
public final static long SSL3_CK_EDH_DSS_DES_192_CBC3_SHA = 0x03000013;
public final static long SSL3_CK_EDH_RSA_DES_40_CBC_SHA = 0x03000014;
public final static long SSL3_CK_EDH_RSA_DES_64_CBC_SHA = 0x03000015;
public final static long SSL3_CK_EDH_RSA_DES_192_CBC3_SHA = 0x03000016;
public final static long SSL3_CK_ADH_RC4_40_MD5 = 0x03000017;
public final static long SSL3_CK_ADH_RC4_128_MD5 = 0x03000018;
public final static long SSL3_CK_ADH_DES_40_CBC_SHA = 0x03000019;
public final static long SSL3_CK_ADH_DES_64_CBC_SHA = 0x0300001A;
public final static long SSL3_CK_ADH_DES_192_CBC_SHA = 0x0300001B;
public final static long SSL3_CK_FZA_DMS_NULL_SHA = 0x0300001C;
public final static long SSL3_CK_FZA_DMS_FZA_SHA = 0x0300001D;
public final static long SSL3_CK_KRB5_DES_64_CBC_SHA = 0x0300001E;
public final static long SSL3_CK_KRB5_DES_192_CBC3_SHA = 0x0300001F;
public final static long SSL3_CK_KRB5_RC4_128_SHA = 0x03000020;
public final static long SSL3_CK_KRB5_IDEA_128_CBC_SHA = 0x03000021;
public final static long SSL3_CK_KRB5_DES_64_CBC_MD5 = 0x03000022;
public final static long SSL3_CK_KRB5_DES_192_CBC3_MD5 = 0x03000023;
public final static long SSL3_CK_KRB5_RC4_128_MD5 = 0x03000024;
public final static long SSL3_CK_KRB5_IDEA_128_CBC_MD5 = 0x03000025;
public final static long SSL3_CK_KRB5_DES_40_CBC_SHA = 0x03000026;
public final static long SSL3_CK_KRB5_RC2_40_CBC_SHA = 0x03000027;
public final static long SSL3_CK_KRB5_RC4_40_SHA = 0x03000028;
public final static long SSL3_CK_KRB5_DES_40_CBC_MD5 = 0x03000029;
public final static long SSL3_CK_KRB5_RC2_40_CBC_MD5 = 0x0300002A;
public final static long SSL3_CK_KRB5_RC4_40_MD5 = 0x0300002B;
public final static long TLS1_CK_RSA_EXPORT1024_WITH_RC4_56_MD5 = 0x03000060;
public final static long TLS1_CK_RSA_EXPORT1024_WITH_RC2_CBC_56_MD5 = 0x03000061;
public final static long TLS1_CK_RSA_EXPORT1024_WITH_DES_CBC_SHA = 0x03000062;
public final static long TLS1_CK_DHE_DSS_EXPORT1024_WITH_DES_CBC_SHA = 0x03000063;
public final static long TLS1_CK_RSA_EXPORT1024_WITH_RC4_56_SHA = 0x03000064;
public final static long TLS1_CK_DHE_DSS_EXPORT1024_WITH_RC4_56_SHA = 0x03000065;
public final static long TLS1_CK_DHE_DSS_WITH_RC4_128_SHA = 0x03000066;
public final static long TLS1_CK_RSA_WITH_AES_128_SHA = 0x0300002F;
public final static long TLS1_CK_DH_DSS_WITH_AES_128_SHA = 0x03000030;
public final static long TLS1_CK_DH_RSA_WITH_AES_128_SHA = 0x03000031;
public final static long TLS1_CK_DHE_DSS_WITH_AES_128_SHA = 0x03000032;
public final static long TLS1_CK_DHE_RSA_WITH_AES_128_SHA = 0x03000033;
public final static long TLS1_CK_ADH_WITH_AES_128_SHA = 0x03000034;
public final static long TLS1_CK_RSA_WITH_AES_256_SHA = 0x03000035;
public final static long TLS1_CK_DH_DSS_WITH_AES_256_SHA = 0x03000036;
public final static long TLS1_CK_DH_RSA_WITH_AES_256_SHA = 0x03000037;
public final static long TLS1_CK_DHE_DSS_WITH_AES_256_SHA = 0x03000038;
public final static long TLS1_CK_DHE_RSA_WITH_AES_256_SHA = 0x03000039;
public final static long TLS1_CK_ADH_WITH_AES_256_SHA = 0x0300003A;
public final static long TLS1_CK_ECDH_ECDSA_WITH_NULL_SHA = 0x0300C001;
public final static long TLS1_CK_ECDH_ECDSA_WITH_RC4_128_SHA = 0x0300C002;
public final static long TLS1_CK_ECDH_ECDSA_WITH_DES_192_CBC3_SHA = 0x0300C003;
public final static long TLS1_CK_ECDH_ECDSA_WITH_AES_128_CBC_SHA = 0x0300C004;
public final static long TLS1_CK_ECDH_ECDSA_WITH_AES_256_CBC_SHA = 0x0300C005;
public final static long TLS1_CK_ECDHE_ECDSA_WITH_NULL_SHA = 0x0300C006;
public final static long TLS1_CK_ECDHE_ECDSA_WITH_RC4_128_SHA = 0x0300C007;
public final static long TLS1_CK_ECDHE_ECDSA_WITH_DES_192_CBC3_SHA = 0x0300C008;
final static long TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA = 0x0300C009;
final static long TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA = 0x0300C00A;
public final static long TLS1_CK_ECDH_RSA_WITH_NULL_SHA = 0x0300C00B;
public final static long TLS1_CK_ECDH_RSA_WITH_RC4_128_SHA = 0x0300C00C;
public final static long TLS1_CK_ECDH_RSA_WITH_DES_192_CBC3_SHA = 0x0300C00D;
final static long TLS_ECDH_RSA_WITH_AES_128_CBC_SHA = 0x0300C00E;
final static long TLS_ECDH_RSA_WITH_AES_256_CBC_SHA = 0x0300C00F;
public final static long TLS1_CK_ECDHE_RSA_WITH_NULL_SHA = 0x0300C010;
public final static long TLS1_CK_ECDHE_RSA_WITH_RC4_128_SHA = 0x0300C011;
public final static long TLS1_CK_ECDHE_RSA_WITH_DES_192_CBC3_SHA = 0x0300C012;
final static long TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA = 0x0300C013;
final static long TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA = 0x0300C014;
public final static long TLS1_CK_ECDH_anon_WITH_NULL_SHA = 0x0300C015;
final static long TLS_ECDH_anon_WITH_RC4_128_SHA = 0x0300C016;
final static long TLS_ECDH_anon_WITH_DES_192_CBC3_SHA = 0x0300C017;
final static long TLS_ECDH_anon_WITH_AES_128_CBC_SHA = 0x0300C018;
final static long TLS_ECDH_anon_WITH_AES_256_CBC_SHA = 0x0300C019;
public final static String TLS1_TXT_RSA_EXPORT1024_WITH_RC4_56_MD5 = "EXP1024-RC4-MD5";
public final static String TLS1_TXT_RSA_EXPORT1024_WITH_RC2_CBC_56_MD5 = "EXP1024-RC2-CBC-MD5";
public final static String TLS1_TXT_RSA_EXPORT1024_WITH_DES_CBC_SHA = "EXP1024-DES-CBC-SHA";
public final static String TLS1_TXT_DHE_DSS_EXPORT1024_WITH_DES_CBC_SHA = "EXP1024-DHE-DSS-DES-CBC-SHA";
public final static String TLS1_TXT_RSA_EXPORT1024_WITH_RC4_56_SHA = "EXP1024-RC4-SHA";
public final static String TLS1_TXT_DHE_DSS_EXPORT1024_WITH_RC4_56_SHA = "EXP1024-DHE-DSS-RC4-SHA";
public final static String TLS1_TXT_DHE_DSS_WITH_RC4_128_SHA = "DHE-DSS-RC4-SHA";
public final static String TLS1_TXT_RSA_WITH_AES_128_SHA = "AES128-SHA";
public final static String TLS1_TXT_DH_DSS_WITH_AES_128_SHA = "DH-DSS-AES128-SHA";
public final static String TLS1_TXT_DH_RSA_WITH_AES_128_SHA = "DH-RSA-AES128-SHA";
public final static String TLS1_TXT_DHE_DSS_WITH_AES_128_SHA = "DHE-DSS-AES128-SHA";
public final static String TLS1_TXT_DHE_RSA_WITH_AES_128_SHA = "DHE-RSA-AES128-SHA";
public final static String TLS1_TXT_ADH_WITH_AES_128_SHA = "ADH-AES128-SHA";
public final static String TLS1_TXT_RSA_WITH_AES_256_SHA = "AES256-SHA";
public final static String TLS1_TXT_DH_DSS_WITH_AES_256_SHA = "DH-DSS-AES256-SHA";
public final static String TLS1_TXT_DH_RSA_WITH_AES_256_SHA = "DH-RSA-AES256-SHA";
public final static String TLS1_TXT_DHE_DSS_WITH_AES_256_SHA = "DHE-DSS-AES256-SHA";
public final static String TLS1_TXT_DHE_RSA_WITH_AES_256_SHA = "DHE-RSA-AES256-SHA";
public final static String TLS1_TXT_ADH_WITH_AES_256_SHA = "ADH-AES256-SHA";
public final static String TLS1_TXT_ECDH_ECDSA_WITH_NULL_SHA = "ECDH-ECDSA-NULL-SHA";
public final static String TLS1_TXT_ECDH_ECDSA_WITH_RC4_128_SHA = "ECDH-ECDSA-RC4-SHA";
public final static String TLS1_TXT_ECDH_ECDSA_WITH_DES_192_CBC3_SHA = "ECDH-ECDSA-DES-CBC3-SHA";
public final static String TLS1_TXT_ECDHE_ECDSA_WITH_NULL_SHA = "ECDHE-ECDSA-NULL-SHA";
public final static String TLS1_TXT_ECDHE_ECDSA_WITH_RC4_128_SHA = "ECDHE-ECDSA-RC4-SHA";
public final static String TLS1_TXT_ECDHE_ECDSA_WITH_DES_192_CBC3_SHA = "ECDHE-ECDSA-DES-CBC3-SHA";
public final static String TLS1_TXT_ECDH_RSA_WITH_NULL_SHA = "ECDH-RSA-NULL-SHA";
public final static String TLS1_TXT_ECDH_RSA_WITH_RC4_128_SHA = "ECDH-RSA-RC4-SHA";
public final static String TLS1_TXT_ECDH_RSA_WITH_DES_192_CBC3_SHA = "ECDH-RSA-DES-CBC3-SHA";
public final static String TLS1_TXT_ECDHE_RSA_WITH_NULL_SHA = "ECDHE-RSA-NULL-SHA";
public final static String TLS1_TXT_ECDHE_RSA_WITH_RC4_128_SHA = "ECDHE-RSA-RC4-SHA";
public final static String TLS1_TXT_ECDHE_RSA_WITH_DES_192_CBC3_SHA = "ECDHE-RSA-DES-CBC3-SHA";
public final static String TLS1_TXT_ECDH_anon_WITH_NULL_SHA = "AECDH-NULL-SHA";
static final class Def implements Comparable, Cloneable {
//private final byte valid;
final String name;
//private final long id;
final long algorithms;
private final long algStrength;
//final long algorithm2;
final int algStrengthBits;
final int algBits;
private final long mask;
private final long algStrengthMask;
private volatile String cipherSuite;
Def(int valid, String name, long id, long algorithms, long algo_strength, long algorithm2, int strength_bits, int alg_bits, long mask, long maskStrength) {
//this.valid = (byte) valid;
this.name = name;
//this.id = id;
this.algorithms = algorithms;
this.algStrength = algo_strength;
//this.algorithm2 = algorithm2;
this.algStrengthBits = strength_bits;
this.algBits = alg_bits;
this.mask = mask;
this.algStrengthMask = maskStrength;
}
Def(String name, long algorithms, long algo_strength, int strength_bits, int alg_bits, long mask, long maskStrength) {
this.name = name;
this.algorithms = algorithms;
this.algStrength = algo_strength;
this.algStrengthBits = strength_bits;
this.algBits = alg_bits;
this.mask = mask;
this.algStrengthMask = maskStrength;
}
public String getCipherSuite() {
return cipherSuite;
}
Def setCipherSuite(final String suite) {
if ( this.cipherSuite == null ) {
synchronized (this) {
if ( this.cipherSuite == null ) {
this.cipherSuite = suite; return this;
}
}
}
if ( suite.equals(this.cipherSuite) ) return this;
try {
Def clone = (Def) super.clone();
clone.cipherSuite = suite;
return clone;
}
catch (CloneNotSupportedException e) {
throw new RuntimeException(e); // won't happen
}
}
@Override
public int hashCode() {
return name.hashCode();
}
@Override
public boolean equals(Object other) {
if ( this == other ) return true;
if ( other instanceof Def ) {
return this.name.equals(((Def) other).name);
}
return false;
}
@Override
public int compareTo(final Def that) {
return this.algStrengthBits - that.algStrengthBits;
}
@Override
public String toString() {
return getClass().getSimpleName() + '@' +
Integer.toHexString(System.identityHashCode(this)) +
'<' + name + '>';
}
// from ssl_cipher_apply_rule
public boolean matches(Def current) {
// ma = mask & cp->algorithms;
// ma_s = mask_strength & cp->algo_strength;
//
// // Select: if none of the mask bit was met from the
// // cipher or not all of the bits were met, the
// // selection does not apply.
// if (((ma == 0) && (ma_s == 0)) ||
// ((ma & algorithms) != ma) ||
// ((ma_s & algo_strength) != ma_s))
// continue; // does not apply
// }
final long ma = this.mask & current.algorithms;
final long ma_s = this.algStrengthMask & current.algStrength;
if ( ( ma == 0 && ma_s == 0 ) ||
( (ma & this.algorithms) != ma ) ||
( (ma_s & this.algStrength) != ma_s) ) {
return false;
}
return true;
}
}
static Collection matchingCiphers(final String cipherString, final String[] all,
final boolean setSuite) {
final List matchedList = new LinkedList();
Set removed = null;
/*
* If the rule_string begins with DEFAULT, apply the default rule
* before using the (possibly available) additional rules.
* (Matching OpenSSL behaviour)
*/
int offset = 0;
final String[] parts = cipherString.split("[:, ]+");
if ( parts.length >= 1 && "DEFAULT".equals(parts[0]) ) {
final Collection matching = matchingCiphers(SSL_DEFAULT_CIPHER_LIST, all, setSuite);
matchedList.addAll(matching);
offset = offset + 1;
}
for ( int i = offset; i < parts.length; i++ ) {
final String part = parts[i];
if ( part.equals("@STRENGTH") ) {
Collections.sort(matchedList); continue;
}
int index = 0;
switch ( part.charAt(0) ) {
case '!': case '+': case '-': index++; break;
}
final Collection matching;
final String[] defs = part.substring(index).split("[+]");
if ( defs.length == 1 ) {
matching = matchingExact(defs[0], all, setSuite);
}
else {
matching = matching(defs, all, setSuite);
}
if ( matching != null ) {
if ( index > 0 ) {
switch ( part.charAt(0) ) {
case '!':
matchedList.removeAll(matching);
if ( removed == null ) removed = new HashSet();
removed.addAll(matching);
break;
case '+': // '+' is for moving entry in the list
for ( final Def def : matching ) {
if ( removed == null || ! removed.contains(def) ) {
if ( matchedList.remove(def) ) matchedList.add(def);
}
}
break;
case '-':
matchedList.removeAll(matching);
break;
}
}
else {
for ( final Def def : matching ) {
if ( removed == null || ! removed.contains(def) ) {
if ( ! matchedList.contains(def) ) matchedList.add(def);
}
}
}
}
}
return matchedList;
}
private static Collection matchingExact(final String name, final String[] all,
final boolean setSuite) {
final Def pattern = Definitions.get(name);
if ( pattern != null ) {
return matchingPattern(pattern, all, true, setSuite);
}
return null; // Collections.emptyList();
}
private static Collection matching(final String[] defs, final String[] all,
final boolean setSuite) {
Collection matching = null;
for ( final String name : defs ) {
final Def pattern = Definitions.get(name);
if ( pattern != null ) {
if ( matching == null ) {
matching = matchingPattern(pattern, all, true, setSuite);
}
else {
matching.retainAll( matchingPattern(pattern, all, false, setSuite) );
}
}
}
return matching;
}
private static Collection matchingPattern(
final Def pattern, final String[] all, final boolean useSet,
final boolean setSuite) {
final Collection matching;
if ( useSet ) matching = new LinkedHashSet();
else matching = new ArrayList(all.length);
for ( final String entry : all ) {
final String ossl = SuiteToOSSL.get(entry);
if ( ossl != null ) {
final Def def = CipherNames.get(ossl);
if ( def != null && pattern.matches(def) ) {
if ( setSuite ) {
matching.add( def.setCipherSuite(entry) );
}
else {
matching.add( def );
}
}
}
}
return matching;
}
private final static Map Definitions;
//private final static ArrayList Ciphers;
private final static Map CipherNames;
private final static Map SuiteToOSSL;
static {
Definitions = new HashMap( 48, 1 );
// TODO review base on OpenSSL's static const SSL_CIPHER cipher_aliases[] ?!
Definitions.put(SSL_TXT_ALL,new Def(0,SSL_TXT_ALL, 0,SSL_ALL & ~SSL_eNULL, SSL_ALL ,0,0,0,SSL_ALL,SSL_ALL));
Definitions.put(SSL_TXT_CMPALL,new Def(0,SSL_TXT_CMPALL,0,SSL_eNULL,0,0,0,0,SSL_ENC_MASK,0));
Definitions.put(SSL_TXT_CMPDEF,new Def(0,SSL_TXT_CMPDEF,0,SSL_ADH, 0,0,0,0,SSL_AUTH_MASK,0));
Definitions.put(SSL_TXT_kKRB5,new Def(0,SSL_TXT_kKRB5,0,SSL_kKRB5,0,0,0,0,SSL_MKEY_MASK,0));
Definitions.put(SSL_TXT_kRSA,new Def(0,SSL_TXT_kRSA,0,SSL_kRSA, 0,0,0,0,SSL_MKEY_MASK,0));
Definitions.put(SSL_TXT_kDHr,new Def(0,SSL_TXT_kDHr,0,SSL_kDHr, 0,0,0,0,SSL_MKEY_MASK,0));
Definitions.put(SSL_TXT_kDHd,new Def(0,SSL_TXT_kDHd,0,SSL_kDHd, 0,0,0,0,SSL_MKEY_MASK,0));
Definitions.put(SSL_TXT_kEDH,new Def(0,SSL_TXT_kEDH,0,SSL_kEDH, 0,0,0,0,SSL_MKEY_MASK,0));
Definitions.put(SSL_TXT_kFZA,new Def(0,SSL_TXT_kFZA,0,SSL_kFZA, 0,0,0,0,SSL_MKEY_MASK,0));
Definitions.put(SSL_TXT_DH,new Def(0,SSL_TXT_DH, 0,SSL_DH, 0,0,0,0,SSL_MKEY_MASK,0));
Definitions.put(SSL_TXT_ECC,new Def(0,SSL_TXT_ECC, 0,(SSL_kECDH|SSL_kECDHE), 0,0,0,0,SSL_MKEY_MASK,0));
Definitions.put(SSL_TXT_EDH,new Def(0,SSL_TXT_EDH, 0,SSL_EDH, 0,0,0,0,SSL_MKEY_MASK|SSL_AUTH_MASK,0));
Definitions.put(SSL_TXT_aKRB5,new Def(0,SSL_TXT_aKRB5,0,SSL_aKRB5,0,0,0,0,SSL_AUTH_MASK,0));
Definitions.put(SSL_TXT_aRSA,new Def(0,SSL_TXT_aRSA,0,SSL_aRSA, 0,0,0,0,SSL_AUTH_MASK,0));
Definitions.put(SSL_TXT_aDSS,new Def(0,SSL_TXT_aDSS,0,SSL_aDSS, 0,0,0,0,SSL_AUTH_MASK,0));
Definitions.put(SSL_TXT_aFZA,new Def(0,SSL_TXT_aFZA,0,SSL_aFZA, 0,0,0,0,SSL_AUTH_MASK,0));
Definitions.put(SSL_TXT_aNULL,new Def(0,SSL_TXT_aNULL,0,SSL_aNULL,0,0,0,0,SSL_AUTH_MASK,0));
Definitions.put(SSL_TXT_aDH,new Def(0,SSL_TXT_aDH, 0,SSL_aDH, 0,0,0,0,SSL_AUTH_MASK,0));
Definitions.put(SSL_TXT_DSS,new Def(0,SSL_TXT_DSS, 0,SSL_DSS, 0,0,0,0,SSL_AUTH_MASK,0));
Definitions.put(SSL_TXT_DES,new Def(0,SSL_TXT_DES, 0,SSL_DES, 0,0,0,0,SSL_ENC_MASK,0));
Definitions.put(SSL_TXT_3DES,new Def(0,SSL_TXT_3DES,0,SSL_3DES, 0,0,0,0,SSL_ENC_MASK,0));
Definitions.put(SSL_TXT_RC4,new Def(0,SSL_TXT_RC4, 0,SSL_RC4, 0,0,0,0,SSL_ENC_MASK,0));
Definitions.put(SSL_TXT_RC2,new Def(0,SSL_TXT_RC2, 0,SSL_RC2, 0,0,0,0,SSL_ENC_MASK,0));
Definitions.put(SSL_TXT_IDEA,new Def(0,SSL_TXT_IDEA,0,SSL_IDEA, 0,0,0,0,SSL_ENC_MASK,0));
Definitions.put(SSL_TXT_eNULL,new Def(0,SSL_TXT_eNULL,0,SSL_eNULL,0,0,0,0,SSL_ENC_MASK,0));
Definitions.put(SSL_TXT_eFZA,new Def(0,SSL_TXT_eFZA,0,SSL_eFZA, 0,0,0,0,SSL_ENC_MASK,0));
Definitions.put(SSL_TXT_AES,new Def(0,SSL_TXT_AES, 0,SSL_AES, 0,0,0,0,SSL_ENC_MASK,0));
Definitions.put(SSL_TXT_MD5,new Def(0,SSL_TXT_MD5, 0,SSL_MD5, 0,0,0,0,SSL_MAC_MASK,0));
Definitions.put(SSL_TXT_SHA1,new Def(0,SSL_TXT_SHA1,0,SSL_SHA1, 0,0,0,0,SSL_MAC_MASK,0));
Definitions.put(SSL_TXT_SHA,new Def(0,SSL_TXT_SHA, 0,SSL_SHA, 0,0,0,0,SSL_MAC_MASK,0));
Definitions.put(SSL_TXT_NULL,new Def(0,SSL_TXT_NULL,0,SSL_NULL, 0,0,0,0,SSL_ENC_MASK,0));
Definitions.put(SSL_TXT_KRB5,new Def(0,SSL_TXT_KRB5,0,SSL_KRB5, 0,0,0,0,SSL_AUTH_MASK|SSL_MKEY_MASK,0));
Definitions.put(SSL_TXT_RSA,new Def(0,SSL_TXT_RSA, 0,SSL_RSA, 0,0,0,0,SSL_AUTH_MASK|SSL_MKEY_MASK,0));
Definitions.put(SSL_TXT_ADH,new Def(0,SSL_TXT_ADH, 0,SSL_ADH, 0,0,0,0,SSL_AUTH_MASK|SSL_MKEY_MASK,0));
Definitions.put(SSL_TXT_FZA,new Def(0,SSL_TXT_FZA, 0,SSL_FZA, 0,0,0,0,SSL_AUTH_MASK|SSL_MKEY_MASK|SSL_ENC_MASK,0));
Definitions.put(SSL_TXT_SSLV2,new Def(0,SSL_TXT_SSLV2, 0,SSL_SSLV2, 0,0,0,0,SSL_SSL_MASK,0));
Definitions.put(SSL_TXT_SSLV3,new Def(0,SSL_TXT_SSLV3, 0,SSL_SSLV3, 0,0,0,0,SSL_SSL_MASK,0));
Definitions.put(SSL_TXT_TLSV1,new Def(0,SSL_TXT_TLSV1, 0,SSL_TLSV1, 0,0,0,0,SSL_SSL_MASK,0));
Definitions.put(SSL_TXT_EXP,new Def(0,SSL_TXT_EXP ,0, 0,SSL_EXPORT, 0,0,0,0,SSL_EXP_MASK));
Definitions.put(SSL_TXT_EXPORT,new Def(0,SSL_TXT_EXPORT,0, 0,SSL_EXPORT, 0,0,0,0,SSL_EXP_MASK));
Definitions.put(SSL_TXT_EXP40,new Def(0,SSL_TXT_EXP40, 0, 0, SSL_EXP40, 0,0,0,0,SSL_STRONG_MASK));
Definitions.put(SSL_TXT_EXP56,new Def(0,SSL_TXT_EXP56, 0, 0, SSL_EXP56, 0,0,0,0,SSL_STRONG_MASK));
Definitions.put(SSL_TXT_LOW,new Def(0,SSL_TXT_LOW, 0, 0, SSL_LOW, 0,0,0,0,SSL_STRONG_MASK));
Definitions.put(SSL_TXT_MEDIUM,new Def(0,SSL_TXT_MEDIUM,0, 0,SSL_MEDIUM, 0,0,0,0,SSL_STRONG_MASK));
Definitions.put(SSL_TXT_HIGH,new Def(0,SSL_TXT_HIGH, 0, 0, SSL_HIGH, 0,0,0,0,SSL_STRONG_MASK));
final ArrayList Ciphers = new ArrayList( 96 );
/* Cipher 01 */
Ciphers.add(new Def(
1,
SSL3_TXT_RSA_NULL_MD5,
SSL3_CK_RSA_NULL_MD5,
SSL_kRSA|SSL_aRSA|SSL_eNULL |SSL_MD5|SSL_SSLV3,
SSL_NOT_EXP|SSL_STRONG_NONE,
0,
0,
0,
SSL_ALL_CIPHERS,
SSL_ALL_STRENGTHS
));
/* Cipher 02 */
Ciphers.add(new Def(
1,
SSL3_TXT_RSA_NULL_SHA,
SSL3_CK_RSA_NULL_SHA,
SSL_kRSA|SSL_aRSA|SSL_eNULL |SSL_SHA1|SSL_SSLV3,
SSL_NOT_EXP|SSL_STRONG_NONE,
0,
0,
0,
SSL_ALL_CIPHERS,
SSL_ALL_STRENGTHS
));
/* Cipher 03 */
Ciphers.add(new Def(
1,
SSL3_TXT_RSA_RC4_40_MD5,
SSL3_CK_RSA_RC4_40_MD5,
SSL_kRSA|SSL_aRSA|SSL_RC4 |SSL_MD5 |SSL_SSLV3,
SSL_EXPORT|SSL_EXP40,
0,
40,
128,
SSL_ALL_CIPHERS,
SSL_ALL_STRENGTHS
));
/* Cipher 04 */
Ciphers.add(new Def(
1,
SSL3_TXT_RSA_RC4_128_MD5,
SSL3_CK_RSA_RC4_128_MD5,
SSL_kRSA|SSL_aRSA|SSL_RC4 |SSL_MD5|SSL_SSLV3,
SSL_NOT_EXP|SSL_MEDIUM,
0,
128,
128,
SSL_ALL_CIPHERS,
SSL_ALL_STRENGTHS
));
/* Cipher 05 */
Ciphers.add(new Def(
1,
SSL3_TXT_RSA_RC4_128_SHA,
SSL3_CK_RSA_RC4_128_SHA,
SSL_kRSA|SSL_aRSA|SSL_RC4 |SSL_SHA1|SSL_SSLV3,
SSL_NOT_EXP|SSL_MEDIUM,
0,
128,
128,
SSL_ALL_CIPHERS,
SSL_ALL_STRENGTHS
));
/* Cipher 06 */
Ciphers.add(new Def(
1,
SSL3_TXT_RSA_RC2_40_MD5,
SSL3_CK_RSA_RC2_40_MD5,
SSL_kRSA|SSL_aRSA|SSL_RC2 |SSL_MD5 |SSL_SSLV3,
SSL_EXPORT|SSL_EXP40,
0,
40,
128,
SSL_ALL_CIPHERS,
SSL_ALL_STRENGTHS
));
/* Cipher 07 */
Ciphers.add(new Def(
1,
SSL3_TXT_RSA_IDEA_128_SHA,
SSL3_CK_RSA_IDEA_128_SHA,
SSL_kRSA|SSL_aRSA|SSL_IDEA |SSL_SHA1|SSL_SSLV3,
SSL_NOT_EXP|SSL_MEDIUM,
0,
128,
128,
SSL_ALL_CIPHERS,
SSL_ALL_STRENGTHS
));
/* Cipher 08 */
Ciphers.add(new Def(
1,
SSL3_TXT_RSA_DES_40_CBC_SHA,
SSL3_CK_RSA_DES_40_CBC_SHA,
SSL_kRSA|SSL_aRSA|SSL_DES|SSL_SHA1|SSL_SSLV3,
SSL_EXPORT|SSL_EXP40,
0,
40,
56,
SSL_ALL_CIPHERS,
SSL_ALL_STRENGTHS
));
/* Cipher 09 */
Ciphers.add(new Def(
1,
SSL3_TXT_RSA_DES_64_CBC_SHA,
SSL3_CK_RSA_DES_64_CBC_SHA,
SSL_kRSA|SSL_aRSA|SSL_DES |SSL_SHA1|SSL_SSLV3,
SSL_NOT_EXP|SSL_LOW,
0,
56,
56,
SSL_ALL_CIPHERS,
SSL_ALL_STRENGTHS
));
/* Cipher 0A */
Ciphers.add(new Def(
1,
SSL3_TXT_RSA_DES_192_CBC3_SHA,
SSL3_CK_RSA_DES_192_CBC3_SHA,
SSL_kRSA|SSL_aRSA|SSL_3DES |SSL_SHA1|SSL_SSLV3,
SSL_NOT_EXP|SSL_HIGH,
0,
168,
168,
SSL_ALL_CIPHERS,
SSL_ALL_STRENGTHS
));
/* The DH ciphers */
/* Cipher 0B */
Ciphers.add(new Def(
0,
SSL3_TXT_DH_DSS_DES_40_CBC_SHA,
SSL3_CK_DH_DSS_DES_40_CBC_SHA,
SSL_kDHd |SSL_aDH|SSL_DES|SSL_SHA1|SSL_SSLV3,
SSL_EXPORT|SSL_EXP40,
0,
40,
56,
SSL_ALL_CIPHERS,
SSL_ALL_STRENGTHS
));
/* Cipher 0C */
Ciphers.add(new Def(
0,
SSL3_TXT_DH_DSS_DES_64_CBC_SHA,
SSL3_CK_DH_DSS_DES_64_CBC_SHA,
SSL_kDHd |SSL_aDH|SSL_DES |SSL_SHA1|SSL_SSLV3,
SSL_NOT_EXP|SSL_LOW,
0,
56,
56,
SSL_ALL_CIPHERS,
SSL_ALL_STRENGTHS
));
/* Cipher 0D */
Ciphers.add(new Def(
0,
SSL3_TXT_DH_DSS_DES_192_CBC3_SHA,
SSL3_CK_DH_DSS_DES_192_CBC3_SHA,
SSL_kDHd |SSL_aDH|SSL_3DES |SSL_SHA1|SSL_SSLV3,
SSL_NOT_EXP|SSL_HIGH,
0,
168,
168,
SSL_ALL_CIPHERS,
SSL_ALL_STRENGTHS
));
/* Cipher 0E */
Ciphers.add(new Def(
0,
SSL3_TXT_DH_RSA_DES_40_CBC_SHA,
SSL3_CK_DH_RSA_DES_40_CBC_SHA,
SSL_kDHr |SSL_aDH|SSL_DES|SSL_SHA1|SSL_SSLV3,
SSL_EXPORT|SSL_EXP40,
0,
40,
56,
SSL_ALL_CIPHERS,
SSL_ALL_STRENGTHS
));
/* Cipher 0F */
Ciphers.add(new Def(
0,
SSL3_TXT_DH_RSA_DES_64_CBC_SHA,
SSL3_CK_DH_RSA_DES_64_CBC_SHA,
SSL_kDHr |SSL_aDH|SSL_DES |SSL_SHA1|SSL_SSLV3,
SSL_NOT_EXP|SSL_LOW,
0,
56,
56,
SSL_ALL_CIPHERS,
SSL_ALL_STRENGTHS
));
/* Cipher 10 */
Ciphers.add(new Def(
0,
SSL3_TXT_DH_RSA_DES_192_CBC3_SHA,
SSL3_CK_DH_RSA_DES_192_CBC3_SHA,
SSL_kDHr |SSL_aDH|SSL_3DES |SSL_SHA1|SSL_SSLV3,
SSL_NOT_EXP|SSL_HIGH,
0,
168,
168,
SSL_ALL_CIPHERS,
SSL_ALL_STRENGTHS
));
/* The Ephemeral DH ciphers */
/* Cipher 11 */
Ciphers.add(new Def(
1,
SSL3_TXT_EDH_DSS_DES_40_CBC_SHA,
SSL3_CK_EDH_DSS_DES_40_CBC_SHA,
SSL_kEDH|SSL_aDSS|SSL_DES|SSL_SHA1|SSL_SSLV3,
SSL_EXPORT|SSL_EXP40,
0,
40,
56,
SSL_ALL_CIPHERS,
SSL_ALL_STRENGTHS
));
/* Cipher 12 */
Ciphers.add(new Def(
1,
SSL3_TXT_EDH_DSS_DES_64_CBC_SHA,
SSL3_CK_EDH_DSS_DES_64_CBC_SHA,
SSL_kEDH|SSL_aDSS|SSL_DES |SSL_SHA1|SSL_SSLV3,
SSL_NOT_EXP|SSL_LOW,
0,
56,
56,
SSL_ALL_CIPHERS,
SSL_ALL_STRENGTHS
));
/* Cipher 13 */
Ciphers.add(new Def(
1,
SSL3_TXT_EDH_DSS_DES_192_CBC3_SHA,
SSL3_CK_EDH_DSS_DES_192_CBC3_SHA,
SSL_kEDH|SSL_aDSS|SSL_3DES |SSL_SHA1|SSL_SSLV3,
SSL_NOT_EXP|SSL_HIGH,
0,
168,
168,
SSL_ALL_CIPHERS,
SSL_ALL_STRENGTHS
));
/* Cipher 14 */
Ciphers.add(new Def(
1,
SSL3_TXT_EDH_RSA_DES_40_CBC_SHA,
SSL3_CK_EDH_RSA_DES_40_CBC_SHA,
SSL_kEDH|SSL_aRSA|SSL_DES|SSL_SHA1|SSL_SSLV3,
SSL_EXPORT|SSL_EXP40,
0,
40,
56,
SSL_ALL_CIPHERS,
SSL_ALL_STRENGTHS
));
/* Cipher 15 */
Ciphers.add(new Def(
1,
SSL3_TXT_EDH_RSA_DES_64_CBC_SHA,
SSL3_CK_EDH_RSA_DES_64_CBC_SHA,
SSL_kEDH|SSL_aRSA|SSL_DES |SSL_SHA1|SSL_SSLV3,
SSL_NOT_EXP|SSL_LOW,
0,
56,
56,
SSL_ALL_CIPHERS,
SSL_ALL_STRENGTHS
));
/* Cipher 16 */
Ciphers.add(new Def(
1,
SSL3_TXT_EDH_RSA_DES_192_CBC3_SHA,
SSL3_CK_EDH_RSA_DES_192_CBC3_SHA,
SSL_kEDH|SSL_aRSA|SSL_3DES |SSL_SHA1|SSL_SSLV3,
SSL_NOT_EXP|SSL_HIGH,
0,
168,
168,
SSL_ALL_CIPHERS,
SSL_ALL_STRENGTHS
));
/* Cipher 17 */
Ciphers.add(new Def(
1,
SSL3_TXT_ADH_RC4_40_MD5,
SSL3_CK_ADH_RC4_40_MD5,
SSL_kEDH |SSL_aNULL|SSL_RC4 |SSL_MD5 |SSL_SSLV3,
SSL_EXPORT|SSL_EXP40,
0,
40,
128,
SSL_ALL_CIPHERS,
SSL_ALL_STRENGTHS
));
/* Cipher 18 */
Ciphers.add(new Def(
1,
SSL3_TXT_ADH_RC4_128_MD5,
SSL3_CK_ADH_RC4_128_MD5,
SSL_kEDH |SSL_aNULL|SSL_RC4 |SSL_MD5 |SSL_SSLV3,
SSL_NOT_EXP|SSL_MEDIUM,
0,
128,
128,
SSL_ALL_CIPHERS,
SSL_ALL_STRENGTHS
));
/* Cipher 19 */
Ciphers.add(new Def(
1,
SSL3_TXT_ADH_DES_40_CBC_SHA,
SSL3_CK_ADH_DES_40_CBC_SHA,
SSL_kEDH |SSL_aNULL|SSL_DES|SSL_SHA1|SSL_SSLV3,
SSL_EXPORT|SSL_EXP40,
0,
40,
128,
SSL_ALL_CIPHERS,
SSL_ALL_STRENGTHS
));
/* Cipher 1A */
Ciphers.add(new Def(
1,
SSL3_TXT_ADH_DES_64_CBC_SHA,
SSL3_CK_ADH_DES_64_CBC_SHA,
SSL_kEDH |SSL_aNULL|SSL_DES |SSL_SHA1|SSL_SSLV3,
SSL_NOT_EXP|SSL_LOW,
0,
56,
56,
SSL_ALL_CIPHERS,
SSL_ALL_STRENGTHS
));
/* Cipher 1B */
Ciphers.add(new Def(
1,
SSL3_TXT_ADH_DES_192_CBC_SHA,
SSL3_CK_ADH_DES_192_CBC_SHA,
SSL_kEDH |SSL_aNULL|SSL_3DES |SSL_SHA1|SSL_SSLV3,
SSL_NOT_EXP|SSL_HIGH,
0,
168,
168,
SSL_ALL_CIPHERS,
SSL_ALL_STRENGTHS
));
/* Fortezza */
/* Cipher 1C */
Ciphers.add(new Def(
0,
SSL3_TXT_FZA_DMS_NULL_SHA,
SSL3_CK_FZA_DMS_NULL_SHA,
SSL_kFZA|SSL_aFZA |SSL_eNULL |SSL_SHA1|SSL_SSLV3,
SSL_NOT_EXP|SSL_STRONG_NONE,
0,
0,
0,
SSL_ALL_CIPHERS,
SSL_ALL_STRENGTHS
));
/* Cipher 1D */
Ciphers.add(new Def(
0,
SSL3_TXT_FZA_DMS_FZA_SHA,
SSL3_CK_FZA_DMS_FZA_SHA,
SSL_kFZA|SSL_aFZA |SSL_eFZA |SSL_SHA1|SSL_SSLV3,
SSL_NOT_EXP|SSL_STRONG_NONE,
0,
0,
0,
SSL_ALL_CIPHERS,
SSL_ALL_STRENGTHS
));
/* Cipher 1E VRS */
Ciphers.add(new Def(
1,
SSL3_TXT_KRB5_DES_64_CBC_SHA,
SSL3_CK_KRB5_DES_64_CBC_SHA,
SSL_kKRB5|SSL_aKRB5| SSL_DES|SSL_SHA1 |SSL_SSLV3,
SSL_NOT_EXP|SSL_LOW,
0,
56,
56,
SSL_ALL_CIPHERS,
SSL_ALL_STRENGTHS
));
/* Cipher 1F VRS */
Ciphers.add(new Def(
1,
SSL3_TXT_KRB5_DES_192_CBC3_SHA,
SSL3_CK_KRB5_DES_192_CBC3_SHA,
SSL_kKRB5|SSL_aKRB5| SSL_3DES|SSL_SHA1 |SSL_SSLV3,
SSL_NOT_EXP|SSL_HIGH,
0,
112,
168,
SSL_ALL_CIPHERS,
SSL_ALL_STRENGTHS
));
/* Cipher 20 VRS */
Ciphers.add(new Def(
1,
SSL3_TXT_KRB5_RC4_128_SHA,
SSL3_CK_KRB5_RC4_128_SHA,
SSL_kKRB5|SSL_aKRB5| SSL_RC4|SSL_SHA1 |SSL_SSLV3,
SSL_NOT_EXP|SSL_MEDIUM,
0,
128,
128,
SSL_ALL_CIPHERS,
SSL_ALL_STRENGTHS
));
/* Cipher 21 VRS */
Ciphers.add(new Def(
1,
SSL3_TXT_KRB5_IDEA_128_CBC_SHA,
SSL3_CK_KRB5_IDEA_128_CBC_SHA,
SSL_kKRB5|SSL_aKRB5| SSL_IDEA|SSL_SHA1 |SSL_SSLV3,
SSL_NOT_EXP|SSL_MEDIUM,
0,
128,
128,
SSL_ALL_CIPHERS,
SSL_ALL_STRENGTHS
));
/* Cipher 22 VRS */
Ciphers.add(new Def(
1,
SSL3_TXT_KRB5_DES_64_CBC_MD5,
SSL3_CK_KRB5_DES_64_CBC_MD5,
SSL_kKRB5|SSL_aKRB5| SSL_DES|SSL_MD5 |SSL_SSLV3,
SSL_NOT_EXP|SSL_LOW,
0,
56,
56,
SSL_ALL_CIPHERS,
SSL_ALL_STRENGTHS
));
/* Cipher 23 VRS */
Ciphers.add(new Def(
1,
SSL3_TXT_KRB5_DES_192_CBC3_MD5,
SSL3_CK_KRB5_DES_192_CBC3_MD5,
SSL_kKRB5|SSL_aKRB5| SSL_3DES|SSL_MD5 |SSL_SSLV3,
SSL_NOT_EXP|SSL_HIGH,
0,
112,
168,
SSL_ALL_CIPHERS,
SSL_ALL_STRENGTHS
));
/* Cipher 24 VRS */
Ciphers.add(new Def(
1,
SSL3_TXT_KRB5_RC4_128_MD5,
SSL3_CK_KRB5_RC4_128_MD5,
SSL_kKRB5|SSL_aKRB5| SSL_RC4|SSL_MD5 |SSL_SSLV3,
SSL_NOT_EXP|SSL_MEDIUM,
0,
128,
128,
SSL_ALL_CIPHERS,
SSL_ALL_STRENGTHS
));
/* Cipher 25 VRS */
Ciphers.add(new Def(
1,
SSL3_TXT_KRB5_IDEA_128_CBC_MD5,
SSL3_CK_KRB5_IDEA_128_CBC_MD5,
SSL_kKRB5|SSL_aKRB5| SSL_IDEA|SSL_MD5 |SSL_SSLV3,
SSL_NOT_EXP|SSL_MEDIUM,
0,
128,
128,
SSL_ALL_CIPHERS,
SSL_ALL_STRENGTHS
));
/* Cipher 26 VRS */
Ciphers.add(new Def(
1,
SSL3_TXT_KRB5_DES_40_CBC_SHA,
SSL3_CK_KRB5_DES_40_CBC_SHA,
SSL_kKRB5|SSL_aKRB5| SSL_DES|SSL_SHA1 |SSL_SSLV3,
SSL_EXPORT|SSL_EXP40,
0,
40,
56,
SSL_ALL_CIPHERS,
SSL_ALL_STRENGTHS
));
/* Cipher 27 VRS */
Ciphers.add(new Def(
1,
SSL3_TXT_KRB5_RC2_40_CBC_SHA,
SSL3_CK_KRB5_RC2_40_CBC_SHA,
SSL_kKRB5|SSL_aKRB5| SSL_RC2|SSL_SHA1 |SSL_SSLV3,
SSL_EXPORT|SSL_EXP40,
0,
40,
128,
SSL_ALL_CIPHERS,
SSL_ALL_STRENGTHS
));
/* Cipher 28 VRS */
Ciphers.add(new Def(
1,
SSL3_TXT_KRB5_RC4_40_SHA,
SSL3_CK_KRB5_RC4_40_SHA,
SSL_kKRB5|SSL_aKRB5| SSL_RC4|SSL_SHA1 |SSL_SSLV3,
SSL_EXPORT|SSL_EXP40,
0,
128,
128,
SSL_ALL_CIPHERS,
SSL_ALL_STRENGTHS
));
/* Cipher 29 VRS */
Ciphers.add(new Def(
1,
SSL3_TXT_KRB5_DES_40_CBC_MD5,
SSL3_CK_KRB5_DES_40_CBC_MD5,
SSL_kKRB5|SSL_aKRB5| SSL_DES|SSL_MD5 |SSL_SSLV3,
SSL_EXPORT|SSL_EXP40,
0,
40,
56,
SSL_ALL_CIPHERS,
SSL_ALL_STRENGTHS
));
/* Cipher 2A VRS */
Ciphers.add(new Def(
1,
SSL3_TXT_KRB5_RC2_40_CBC_MD5,
SSL3_CK_KRB5_RC2_40_CBC_MD5,
SSL_kKRB5|SSL_aKRB5| SSL_RC2|SSL_MD5 |SSL_SSLV3,
SSL_EXPORT|SSL_EXP40,
0,
40,
128,
SSL_ALL_CIPHERS,
SSL_ALL_STRENGTHS
));
/* Cipher 2B VRS */
Ciphers.add(new Def(
1,
SSL3_TXT_KRB5_RC4_40_MD5,
SSL3_CK_KRB5_RC4_40_MD5,
SSL_kKRB5|SSL_aKRB5| SSL_RC4|SSL_MD5 |SSL_SSLV3,
SSL_EXPORT|SSL_EXP40,
0,
128,
128,
SSL_ALL_CIPHERS,
SSL_ALL_STRENGTHS
));
/* Cipher 2F */
Ciphers.add(new Def(
1,
TLS1_TXT_RSA_WITH_AES_128_SHA,
TLS1_CK_RSA_WITH_AES_128_SHA,
SSL_kRSA|SSL_aRSA|SSL_AES|SSL_SHA |SSL_TLSV1,
SSL_NOT_EXP|SSL_HIGH,
0,
128,
128,
SSL_ALL_CIPHERS,
SSL_ALL_STRENGTHS
));
/* Cipher 30 */
Ciphers.add(new Def(
0,
TLS1_TXT_DH_DSS_WITH_AES_128_SHA,
TLS1_CK_DH_DSS_WITH_AES_128_SHA,
SSL_kDHd|SSL_aDH|SSL_AES|SSL_SHA|SSL_TLSV1,
SSL_NOT_EXP|SSL_HIGH,
0,
128,
128,
SSL_ALL_CIPHERS,
SSL_ALL_STRENGTHS
));
/* Cipher 31 */
Ciphers.add(new Def(
0,
TLS1_TXT_DH_RSA_WITH_AES_128_SHA,
TLS1_CK_DH_RSA_WITH_AES_128_SHA,
SSL_kDHr|SSL_aDH|SSL_AES|SSL_SHA|SSL_TLSV1,
SSL_NOT_EXP|SSL_HIGH,
0,
128,
128,
SSL_ALL_CIPHERS,
SSL_ALL_STRENGTHS
));
/* Cipher 32 */
Ciphers.add(new Def(
1,
TLS1_TXT_DHE_DSS_WITH_AES_128_SHA,
TLS1_CK_DHE_DSS_WITH_AES_128_SHA,
SSL_kEDH|SSL_aDSS|SSL_AES|SSL_SHA|SSL_TLSV1,
SSL_NOT_EXP|SSL_HIGH,
0,
128,
128,
SSL_ALL_CIPHERS,
SSL_ALL_STRENGTHS
));
/* Cipher 33 */
Ciphers.add(new Def(
1,
TLS1_TXT_DHE_RSA_WITH_AES_128_SHA,
TLS1_CK_DHE_RSA_WITH_AES_128_SHA,
SSL_kEDH|SSL_aRSA|SSL_AES|SSL_SHA|SSL_TLSV1,
SSL_NOT_EXP|SSL_HIGH,
0,
128,
128,
SSL_ALL_CIPHERS,
SSL_ALL_STRENGTHS
));
/* Cipher 34 */
Ciphers.add(new Def(
1,
TLS1_TXT_ADH_WITH_AES_128_SHA,
TLS1_CK_ADH_WITH_AES_128_SHA,
SSL_kEDH|SSL_aNULL|SSL_AES|SSL_SHA|SSL_TLSV1,
SSL_NOT_EXP|SSL_HIGH,
0,
128,
128,
SSL_ALL_CIPHERS,
SSL_ALL_STRENGTHS
));
/* Cipher 35 */
Ciphers.add(new Def(
1,
TLS1_TXT_RSA_WITH_AES_256_SHA,
TLS1_CK_RSA_WITH_AES_256_SHA,
SSL_kRSA|SSL_aRSA|SSL_AES|SSL_SHA |SSL_TLSV1,
SSL_NOT_EXP|SSL_HIGH,
0,
256,
256,
SSL_ALL_CIPHERS,
SSL_ALL_STRENGTHS
));
/* Cipher 36 */
Ciphers.add(new Def(
0,
TLS1_TXT_DH_DSS_WITH_AES_256_SHA,
TLS1_CK_DH_DSS_WITH_AES_256_SHA,
SSL_kDHd|SSL_aDH|SSL_AES|SSL_SHA|SSL_TLSV1,
SSL_NOT_EXP|SSL_HIGH,
0,
256,
256,
SSL_ALL_CIPHERS,
SSL_ALL_STRENGTHS
));
/* Cipher 37 */
Ciphers.add(new Def(
0,
TLS1_TXT_DH_RSA_WITH_AES_256_SHA,
TLS1_CK_DH_RSA_WITH_AES_256_SHA,
SSL_kDHr|SSL_aDH|SSL_AES|SSL_SHA|SSL_TLSV1,
SSL_NOT_EXP|SSL_HIGH,
0,
256,
256,
SSL_ALL_CIPHERS,
SSL_ALL_STRENGTHS
));
/* Cipher 38 */
Ciphers.add(new Def(
1,
TLS1_TXT_DHE_DSS_WITH_AES_256_SHA,
TLS1_CK_DHE_DSS_WITH_AES_256_SHA,
SSL_kEDH|SSL_aDSS|SSL_AES|SSL_SHA|SSL_TLSV1,
SSL_NOT_EXP|SSL_HIGH,
0,
256,
256,
SSL_ALL_CIPHERS,
SSL_ALL_STRENGTHS
));
/* Cipher 39 */
Ciphers.add(new Def(
1,
TLS1_TXT_DHE_RSA_WITH_AES_256_SHA,
TLS1_CK_DHE_RSA_WITH_AES_256_SHA,
SSL_kEDH|SSL_aRSA|SSL_AES|SSL_SHA|SSL_TLSV1,
SSL_NOT_EXP|SSL_HIGH,
0,
256,
256,
SSL_ALL_CIPHERS,
SSL_ALL_STRENGTHS
));
/* Cipher 3A */
Ciphers.add(new Def(
1,
TLS1_TXT_ADH_WITH_AES_256_SHA,
TLS1_CK_ADH_WITH_AES_256_SHA,
SSL_kEDH|SSL_aNULL|SSL_AES|SSL_SHA|SSL_TLSV1,
SSL_NOT_EXP|SSL_HIGH,
0,
256,
256,
SSL_ALL_CIPHERS,
SSL_ALL_STRENGTHS
));
/* New TLS Export CipherSuites */
/* Cipher 60 */
Ciphers.add(new Def(
1,
TLS1_TXT_RSA_EXPORT1024_WITH_RC4_56_MD5,
TLS1_CK_RSA_EXPORT1024_WITH_RC4_56_MD5,
SSL_kRSA|SSL_aRSA|SSL_RC4|SSL_MD5|SSL_TLSV1,
SSL_EXPORT|SSL_EXP56,
0,
56,
128,
SSL_ALL_CIPHERS,
SSL_ALL_STRENGTHS
));
/* Cipher 61 */
Ciphers.add(new Def(
1,
TLS1_TXT_RSA_EXPORT1024_WITH_RC2_CBC_56_MD5,
TLS1_CK_RSA_EXPORT1024_WITH_RC2_CBC_56_MD5,
SSL_kRSA|SSL_aRSA|SSL_RC2|SSL_MD5|SSL_TLSV1,
SSL_EXPORT|SSL_EXP56,
0,
56,
128,
SSL_ALL_CIPHERS,
SSL_ALL_STRENGTHS
));
/* Cipher 62 */
Ciphers.add(new Def(
1,
TLS1_TXT_RSA_EXPORT1024_WITH_DES_CBC_SHA,
TLS1_CK_RSA_EXPORT1024_WITH_DES_CBC_SHA,
SSL_kRSA|SSL_aRSA|SSL_DES|SSL_SHA|SSL_TLSV1,
SSL_EXPORT|SSL_EXP56,
0,
56,
56,
SSL_ALL_CIPHERS,
SSL_ALL_STRENGTHS
));
/* Cipher 63 */
Ciphers.add(new Def(
1,
TLS1_TXT_DHE_DSS_EXPORT1024_WITH_DES_CBC_SHA,
TLS1_CK_DHE_DSS_EXPORT1024_WITH_DES_CBC_SHA,
SSL_kEDH|SSL_aDSS|SSL_DES|SSL_SHA|SSL_TLSV1,
SSL_EXPORT|SSL_EXP56,
0,
56,
56,
SSL_ALL_CIPHERS,
SSL_ALL_STRENGTHS
));
/* Cipher 64 */
Ciphers.add(new Def(
1,
TLS1_TXT_RSA_EXPORT1024_WITH_RC4_56_SHA,
TLS1_CK_RSA_EXPORT1024_WITH_RC4_56_SHA,
SSL_kRSA|SSL_aRSA|SSL_RC4|SSL_SHA|SSL_TLSV1,
SSL_EXPORT|SSL_EXP56,
0,
56,
128,
SSL_ALL_CIPHERS,
SSL_ALL_STRENGTHS
));
/* Cipher 65 */
Ciphers.add(new Def(
1,
TLS1_TXT_DHE_DSS_EXPORT1024_WITH_RC4_56_SHA,
TLS1_CK_DHE_DSS_EXPORT1024_WITH_RC4_56_SHA,
SSL_kEDH|SSL_aDSS|SSL_RC4|SSL_SHA|SSL_TLSV1,
SSL_EXPORT|SSL_EXP56,
0,
56,
128,
SSL_ALL_CIPHERS,
SSL_ALL_STRENGTHS
));
/* Cipher 66 */
Ciphers.add(new Def(
1,
TLS1_TXT_DHE_DSS_WITH_RC4_128_SHA,
TLS1_CK_DHE_DSS_WITH_RC4_128_SHA,
SSL_kEDH|SSL_aDSS|SSL_RC4|SSL_SHA|SSL_TLSV1,
SSL_NOT_EXP|SSL_MEDIUM,
0,
128,
128,
SSL_ALL_CIPHERS,
SSL_ALL_STRENGTHS
));
/* Cipher C001 */
Ciphers.add(new Def(
1,
TLS1_TXT_ECDH_ECDSA_WITH_NULL_SHA,
TLS1_CK_ECDH_ECDSA_WITH_NULL_SHA,
SSL_kECDH|SSL_aECDSA|SSL_eNULL|SSL_SHA|SSL_TLSV1,
SSL_NOT_EXP,
0,
0,
0,
SSL_ALL_CIPHERS,
SSL_ALL_STRENGTHS
));
/* Cipher C002 */
Ciphers.add(new Def(
1,
TLS1_TXT_ECDH_ECDSA_WITH_RC4_128_SHA,
TLS1_CK_ECDH_ECDSA_WITH_RC4_128_SHA,
SSL_kECDH|SSL_aECDSA|SSL_RC4|SSL_SHA|SSL_TLSV1,
SSL_NOT_EXP,
0,
128,
128,
SSL_ALL_CIPHERS,
SSL_ALL_STRENGTHS
));
/* Cipher C003 */
Ciphers.add(new Def(
1,
TLS1_TXT_ECDH_ECDSA_WITH_DES_192_CBC3_SHA,
TLS1_CK_ECDH_ECDSA_WITH_DES_192_CBC3_SHA,
SSL_kECDH|SSL_aECDSA|SSL_3DES|SSL_SHA|SSL_TLSV1,
SSL_NOT_EXP|SSL_HIGH,
0,
168,
168,
SSL_ALL_CIPHERS,
SSL_ALL_STRENGTHS
));
/* Cipher C006 */
Ciphers.add(new Def(
1,
TLS1_TXT_ECDHE_ECDSA_WITH_NULL_SHA,
TLS1_CK_ECDHE_ECDSA_WITH_NULL_SHA,
SSL_kECDHE|SSL_aECDSA|SSL_eNULL|SSL_SHA|SSL_TLSV1,
SSL_NOT_EXP,
0,
0,
0,
SSL_ALL_CIPHERS,
SSL_ALL_STRENGTHS
));
/* Cipher C007 */
Ciphers.add(new Def(
1,
TLS1_TXT_ECDHE_ECDSA_WITH_RC4_128_SHA,
TLS1_CK_ECDHE_ECDSA_WITH_RC4_128_SHA,
SSL_kECDHE|SSL_aECDSA|SSL_RC4|SSL_SHA|SSL_TLSV1,
SSL_NOT_EXP,
0,
128,
128,
SSL_ALL_CIPHERS,
SSL_ALL_STRENGTHS
));
/* Cipher C008 */
Ciphers.add(new Def(
1,
TLS1_TXT_ECDHE_ECDSA_WITH_DES_192_CBC3_SHA,
TLS1_CK_ECDHE_ECDSA_WITH_DES_192_CBC3_SHA,
SSL_kECDHE|SSL_aECDSA|SSL_3DES|SSL_SHA|SSL_TLSV1,
SSL_NOT_EXP|SSL_HIGH,
0,
168,
168,
SSL_ALL_CIPHERS,
SSL_ALL_STRENGTHS
));
/* Cipher C00B */
Ciphers.add(new Def(
1,
TLS1_TXT_ECDH_RSA_WITH_NULL_SHA,
TLS1_CK_ECDH_RSA_WITH_NULL_SHA,
SSL_kECDH|SSL_aRSA|SSL_eNULL|SSL_SHA|SSL_TLSV1,
SSL_NOT_EXP,
0,
0,
0,
SSL_ALL_CIPHERS,
SSL_ALL_STRENGTHS
));
/* Cipher C00C */
Ciphers.add(new Def(
1,
TLS1_TXT_ECDH_RSA_WITH_RC4_128_SHA,
TLS1_CK_ECDH_RSA_WITH_RC4_128_SHA,
SSL_kECDH|SSL_aRSA|SSL_RC4|SSL_SHA|SSL_TLSV1,
SSL_NOT_EXP,
0,
128,
128,
SSL_ALL_CIPHERS,
SSL_ALL_STRENGTHS
));
/* Cipher C00D */
Ciphers.add(new Def(
1,
TLS1_TXT_ECDH_RSA_WITH_DES_192_CBC3_SHA,
TLS1_CK_ECDH_RSA_WITH_DES_192_CBC3_SHA,
SSL_kECDH|SSL_aRSA|SSL_3DES|SSL_SHA|SSL_TLSV1,
SSL_NOT_EXP|SSL_HIGH,
0,
168,
168,
SSL_ALL_CIPHERS,
SSL_ALL_STRENGTHS
));
/* Cipher C010 */
Ciphers.add(new Def(
1,
TLS1_TXT_ECDHE_RSA_WITH_NULL_SHA,
TLS1_CK_ECDHE_RSA_WITH_NULL_SHA,
SSL_kECDHE|SSL_aRSA|SSL_eNULL|SSL_SHA|SSL_TLSV1,
SSL_NOT_EXP,
0,
0,
0,
SSL_ALL_CIPHERS,
SSL_ALL_STRENGTHS
));
/* Cipher C011 */
Ciphers.add(new Def(
1,
TLS1_TXT_ECDHE_RSA_WITH_RC4_128_SHA,
TLS1_CK_ECDHE_RSA_WITH_RC4_128_SHA,
SSL_kECDHE|SSL_aRSA|SSL_RC4|SSL_SHA|SSL_TLSV1,
SSL_NOT_EXP,
0,
128,
128,
SSL_ALL_CIPHERS,
SSL_ALL_STRENGTHS
));
/* Cipher C012 */
Ciphers.add(new Def(
1,
TLS1_TXT_ECDHE_RSA_WITH_DES_192_CBC3_SHA,
TLS1_CK_ECDHE_RSA_WITH_DES_192_CBC3_SHA,
SSL_kECDHE|SSL_aRSA|SSL_3DES|SSL_SHA|SSL_TLSV1,
SSL_NOT_EXP|SSL_HIGH,
0,
168,
168,
SSL_ALL_CIPHERS,
SSL_ALL_STRENGTHS
));
/* Cipher C015 */
Ciphers.add(new Def(
1,
TLS1_TXT_ECDH_anon_WITH_NULL_SHA,
TLS1_CK_ECDH_anon_WITH_NULL_SHA,
SSL_kECDHE|SSL_aNULL|SSL_eNULL|SSL_SHA|SSL_TLSV1,
SSL_NOT_EXP,
0,
0,
0,
SSL_ALL_CIPHERS,
SSL_ALL_STRENGTHS
));
String name;
CipherNames = new HashMap(Ciphers.size() + 24, 1);
SuiteToOSSL = new HashMap( 120, 1 );
SuiteToOSSL.put("SSL_RSA_WITH_NULL_MD5", "NULL-MD5");
SuiteToOSSL.put("SSL_RSA_WITH_NULL_SHA", "NULL-SHA");
SuiteToOSSL.put("SSL_RSA_EXPORT_WITH_RC4_40_MD5", "EXP-RC4-MD5");
SuiteToOSSL.put("SSL_RSA_WITH_RC4_128_MD5", "RC4-MD5");
SuiteToOSSL.put("SSL_RSA_WITH_RC4_128_SHA", "RC4-SHA");
SuiteToOSSL.put("SSL_RSA_EXPORT_WITH_RC2_CBC_40_MD5","EXP-RC2-CBC-MD5");
SuiteToOSSL.put("SSL_RSA_WITH_IDEA_CBC_SHA","IDEA-CBC-SHA");
SuiteToOSSL.put("SSL_RSA_EXPORT_WITH_DES40_CBC_SHA", "EXP-DES-CBC-SHA");
SuiteToOSSL.put("SSL_RSA_WITH_DES_CBC_SHA", "DES-CBC-SHA");
SuiteToOSSL.put("SSL_RSA_WITH_3DES_EDE_CBC_SHA", "DES-CBC3-SHA");
SuiteToOSSL.put("SSL_DHE_DSS_EXPORT_WITH_DES40_CBC_SHA", "EXP-EDH-DSS-DES-CBC-SHA");
SuiteToOSSL.put("SSL_DHE_DSS_WITH_DES_CBC_SHA", "EDH-DSS-CBC-SHA");
SuiteToOSSL.put("SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA", "EDH-DSS-DES-CBC3-SHA");
SuiteToOSSL.put("SSL_DHE_RSA_EXPORT_WITH_DES40_CBC_SHA", "EXP-EDH-RSA-DES-CBC-SHA");
SuiteToOSSL.put("SSL_DHE_RSA_WITH_DES_CBC_SHA", "EDH-RSA-DES-CBC-SHA");
SuiteToOSSL.put("SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA", "EDH-RSA-DES-CBC3-SHA");
SuiteToOSSL.put("SSL_DH_anon_EXPORT_WITH_RC4_40_MD5", "EXP-ADH-RC4-MD5");
SuiteToOSSL.put("SSL_DH_anon_WITH_RC4_128_MD5", "ADH-RC4-MD5");
SuiteToOSSL.put("SSL_DH_anon_EXPORT_WITH_DES40_CBC_SHA", "EXP-ADH-DES-CBC-SHA");
SuiteToOSSL.put("SSL_DH_anon_WITH_DES_CBC_SHA", "ADH-DES-CBC-SHA");
SuiteToOSSL.put("SSL_DH_anon_WITH_3DES_EDE_CBC_SHA", "ADH-DES-CBC3-SHA");
SuiteToOSSL.put("TLS_RSA_WITH_NULL_MD5","NULL-MD5");
SuiteToOSSL.put("TLS_RSA_WITH_NULL_SHA","NULL-SHA");
SuiteToOSSL.put("TLS_RSA_WITH_NULL_SHA256", "NULL-SHA256");
SuiteToOSSL.put("TLS_RSA_EXPORT_WITH_RC4_40_MD5","EXP-RC4-MD5");
SuiteToOSSL.put("TLS_RSA_WITH_RC4_128_MD5","RC4-MD5");
SuiteToOSSL.put("TLS_RSA_WITH_RC4_128_SHA","RC4-SHA");
SuiteToOSSL.put("TLS_RSA_EXPORT_WITH_RC2_CBC_40_MD5","EXP-RC2-CBC-MD5");
SuiteToOSSL.put("TLS_RSA_WITH_IDEA_CBC_SHA","IDEA-CBC-SHA");
SuiteToOSSL.put("TLS_RSA_EXPORT_WITH_DES40_CBC_SHA","EXP-DES-CBC-SHA");
SuiteToOSSL.put("TLS_RSA_WITH_DES_CBC_SHA","DES-CBC-SHA");
SuiteToOSSL.put("TLS_RSA_WITH_3DES_EDE_CBC_SHA","DES-CBC3-SHA");
SuiteToOSSL.put("TLS_DHE_DSS_EXPORT_WITH_DES40_CBC_SHA","EXP-EDH-DSS-DES-CBC-SHA");
SuiteToOSSL.put("TLS_DHE_DSS_WITH_DES_CBC_SHA","EDH-DSS-CBC-SHA");
SuiteToOSSL.put("TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA","EDH-DSS-DES-CBC3-SHA");
SuiteToOSSL.put("TLS_DHE_RSA_EXPORT_WITH_DES40_CBC_SHA","EXP-EDH-RSA-DES-CBC-SHA");
SuiteToOSSL.put("TLS_DHE_RSA_WITH_DES_CBC_SHA","EDH-RSA-DES-CBC-SHA");
SuiteToOSSL.put("TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA","EDH-RSA-DES-CBC3-SHA");
SuiteToOSSL.put("TLS_DH_anon_EXPORT_WITH_RC4_40_MD5","EXP-ADH-RC4-MD5");
SuiteToOSSL.put("TLS_DH_anon_WITH_RC4_128_MD5","ADH-RC4-MD5");
SuiteToOSSL.put("TLS_DH_anon_EXPORT_WITH_DES40_CBC_SHA","EXP-ADH-DES-CBC-SHA");
SuiteToOSSL.put("TLS_DH_anon_WITH_DES_CBC_SHA","ADH-DES-CBC-SHA");
SuiteToOSSL.put("TLS_DH_anon_WITH_3DES_EDE_CBC_SHA","ADH-DES-CBC3-SHA");
SuiteToOSSL.put("TLS_RSA_WITH_AES_128_CBC_SHA", "AES128-SHA");
SuiteToOSSL.put("TLS_RSA_WITH_AES_256_CBC_SHA", "AES256-SHA");
SuiteToOSSL.put("TLS_RSA_WITH_AES_128_CBC_SHA256", "AES128-SHA256");
SuiteToOSSL.put("TLS_RSA_WITH_AES_256_CBC_SHA256", "AES256-SHA256");
SuiteToOSSL.put("TLS_DH_DSS_WITH_AES_128_CBC_SHA","DH-DSS-AES128-SHA");
SuiteToOSSL.put("TLS_DH_DSS_WITH_AES_256_CBC_SHA","DH-DSS-AES256-SHA");
SuiteToOSSL.put("TLS_DH_RSA_WITH_AES_128_CBC_SHA","DH-RSA-AES128-SHA");
SuiteToOSSL.put("TLS_DH_RSA_WITH_AES_256_CBC_SHA","DH-RSA-AES256-SHA");
SuiteToOSSL.put("TLS_DHE_DSS_WITH_AES_128_CBC_SHA", "DHE-DSS-AES128-SHA");
SuiteToOSSL.put("TLS_DHE_DSS_WITH_AES_256_CBC_SHA","DHE-DSS-AES256-SHA");
SuiteToOSSL.put("TLS_DHE_DSS_WITH_AES_128_CBC_SHA256", "DHE-DSS-AES128-SHA256");
SuiteToOSSL.put("TLS_DHE_DSS_WITH_AES_256_CBC_SHA256", "DHE-DSS-AES256-SHA256");
SuiteToOSSL.put("TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "DHE-RSA-AES128-SHA");
SuiteToOSSL.put("TLS_DHE_RSA_WITH_AES_256_CBC_SHA","DHE-RSA-AES256-SHA");
SuiteToOSSL.put("TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "DHE-RSA-AES128-SHA256");
SuiteToOSSL.put("TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "DHE-RSA-AES256-SHA256");
SuiteToOSSL.put("TLS_DH_anon_WITH_AES_128_CBC_SHA","ADH-AES128-SHA");
SuiteToOSSL.put("TLS_DH_anon_WITH_AES_256_CBC_SHA","ADH-AES256-SHA");
SuiteToOSSL.put("TLS_DH_anon_WITH_AES_128_CBC_SHA256", "ADH-AES128-SHA256");
SuiteToOSSL.put("TLS_DH_anon_WITH_AES_256_CBC_SHA256", "ADH-AES256-SHA256");
SuiteToOSSL.put("TLS_RSA_EXPORT1024_WITH_DES_CBC_SHA","EXP1024-DES-CBC-SHA");
SuiteToOSSL.put("TLS_RSA_EXPORT1024_WITH_RC4_56_SHA","EXP1024-RC4-SHA");
SuiteToOSSL.put("TLS_DHE_DSS_EXPORT1024_WITH_DES_CBC_SHA","EXP1024-DHE-DSS-DES-CBC-SHA");
SuiteToOSSL.put("TLS_DHE_DSS_EXPORT1024_WITH_RC4_56_SHA","EXP1024-DHE-DSS-RC4-SHA");
SuiteToOSSL.put("TLS_DHE_DSS_WITH_RC4_128_SHA","DHE-DSS-RC4-SHA");
SuiteToOSSL.put("SSL_CK_RC4_128_WITH_MD5","RC4-MD5");
SuiteToOSSL.put("SSL_CK_RC4_128_EXPORT40_WITH_MD5","EXP-RC4-MD5");
SuiteToOSSL.put("SSL_CK_RC2_128_CBC_WITH_MD5","RC2-MD5");
SuiteToOSSL.put("SSL_CK_RC2_128_CBC_EXPORT40_WITH_MD5","EXP-RC2-MD5");
SuiteToOSSL.put("SSL_CK_IDEA_128_CBC_WITH_MD5","IDEA-CBC-MD5");
SuiteToOSSL.put("SSL_CK_DES_64_CBC_WITH_MD5","DES-CBC-MD5");
SuiteToOSSL.put("SSL_CK_DES_192_EDE3_CBC_WITH_MD5","DES-CBC3-MD5");
SuiteToOSSL.put("TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", name = "ECDHE-ECDSA-AES128-SHA");
CipherNames.put(name, new Def(name,
SSL_kECDHE|SSL_aECDSA|SSL_AES|SSL_SHA|SSL_TLSV1,
SSL_NOT_EXP|SSL_HIGH, 128, 128, SSL_ALL_CIPHERS, SSL_ALL_STRENGTHS
));
SuiteToOSSL.put("TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", name = "ECDHE-ECDSA-AES256-SHA");
CipherNames.put(name, new Def(name,
SSL_kECDHE|SSL_aECDSA|SSL_AES|SSL_SHA|SSL_TLSV1,
SSL_NOT_EXP|SSL_HIGH, 256, 256, SSL_ALL_CIPHERS, SSL_ALL_STRENGTHS
));
SuiteToOSSL.put("TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", name = "ECDHE-ECDSA-AES128-SHA256");
CipherNames.put(name, new Def(name,
SSL_kECDHE|SSL_aECDSA|SSL_AES|SSL_SHA|SSL_TLSV1,
SSL_NOT_EXP|SSL_HIGH, 128, 256, SSL_ALL_CIPHERS, SSL_ALL_STRENGTHS
));
SuiteToOSSL.put("TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", name = "ECDHE-ECDSA-AES256-SHA384");
CipherNames.put(name, new Def(name,
SSL_kECDHE|SSL_aECDSA|SSL_AES|SSL_SHA|SSL_TLSV1,
SSL_NOT_EXP|SSL_HIGH, 256, 384, SSL_ALL_CIPHERS, SSL_ALL_STRENGTHS
));
SuiteToOSSL.put("TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", name = "ECDHE-RSA-AES128-SHA");
CipherNames.put(name, new Def(name,
SSL_kECDHE|SSL_aRSA|SSL_AES|SSL_SHA|SSL_TLSV1,
SSL_NOT_EXP|SSL_HIGH, 128, 128, SSL_ALL_CIPHERS, SSL_ALL_STRENGTHS
));
SuiteToOSSL.put("TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", name = "ECDHE-RSA-AES256-SHA");
CipherNames.put(name, new Def(name,
SSL_kECDHE|SSL_aRSA|SSL_AES|SSL_SHA|SSL_TLSV1,
SSL_NOT_EXP|SSL_HIGH, 256, 256, SSL_ALL_CIPHERS, SSL_ALL_STRENGTHS
));
SuiteToOSSL.put("TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", name = "ECDHE-RSA-AES128-SHA256");
CipherNames.put(name, new Def(name,
SSL_kECDHE|SSL_aRSA|SSL_AES|SSL_SHA|SSL_TLSV1,
SSL_NOT_EXP|SSL_HIGH, 128, 256, SSL_ALL_CIPHERS, SSL_ALL_STRENGTHS
));
SuiteToOSSL.put("TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", name = "ECDHE-RSA-AES256-SHA384");
CipherNames.put(name, new Def(name,
SSL_kECDHE|SSL_aRSA|SSL_AES|SSL_SHA|SSL_TLSV1,
SSL_NOT_EXP|SSL_HIGH, 256, 384, SSL_ALL_CIPHERS, SSL_ALL_STRENGTHS
));
SuiteToOSSL.put("TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA", name = "ECDH-ECDSA-AES128-SHA");
CipherNames.put(name, new Def(name,
SSL_kECDH|SSL_aECDSA|SSL_AES|SSL_SHA|SSL_TLSV1,
SSL_NOT_EXP|SSL_HIGH, 128, 128, SSL_ALL_CIPHERS, SSL_ALL_STRENGTHS
));
SuiteToOSSL.put("TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA", name = "ECDH-ECDSA-AES256-SHA");
CipherNames.put(name, new Def(name,
SSL_kECDH|SSL_aECDSA|SSL_AES|SSL_SHA|SSL_TLSV1,
SSL_NOT_EXP|SSL_HIGH, 256, 256, SSL_ALL_CIPHERS, SSL_ALL_STRENGTHS
));
SuiteToOSSL.put("TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256", name = "ECDH-ECDSA-AES128-SHA256");
CipherNames.put(name, new Def(name,
SSL_kECDH|SSL_aECDSA|SSL_AES|SSL_SHA|SSL_TLSV1,
SSL_NOT_EXP|SSL_HIGH, 128, 256, SSL_ALL_CIPHERS, SSL_ALL_STRENGTHS
));
SuiteToOSSL.put("TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384", name = "ECDH-ECDSA-AES256-SHA384");
CipherNames.put(name, new Def(name,
SSL_kECDH|SSL_aECDSA|SSL_AES|SSL_SHA|SSL_TLSV1,
SSL_NOT_EXP|SSL_HIGH, 256, 384, SSL_ALL_CIPHERS, SSL_ALL_STRENGTHS
));
SuiteToOSSL.put("TLS_ECDH_RSA_WITH_AES_128_CBC_SHA", name = "ECDH-RSA-AES128-SHA");
CipherNames.put(name, new Def(name,
SSL_kECDH|SSL_aRSA|SSL_AES|SSL_SHA|SSL_TLSV1,
SSL_NOT_EXP|SSL_HIGH, 128, 128, SSL_ALL_CIPHERS, SSL_ALL_STRENGTHS
));
SuiteToOSSL.put("TLS_ECDH_RSA_WITH_AES_256_CBC_SHA", name = "ECDH-RSA-AES256-SHA");
CipherNames.put(name, new Def(name,
SSL_kECDH|SSL_aRSA|SSL_AES|SSL_SHA|SSL_TLSV1,
SSL_NOT_EXP|SSL_HIGH, 256, 256, SSL_ALL_CIPHERS, SSL_ALL_STRENGTHS
));
SuiteToOSSL.put("TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256", name = "ECDH-RSA-AES128-SHA256");
CipherNames.put(name, new Def(name,
SSL_kECDH|SSL_aRSA|SSL_AES|SSL_SHA|SSL_TLSV1,
SSL_NOT_EXP|SSL_HIGH, 128, 256, SSL_ALL_CIPHERS, SSL_ALL_STRENGTHS
));
SuiteToOSSL.put("TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384", name = "ECDH-RSA-AES256-SHA384");
CipherNames.put(name, new Def(name,
SSL_kECDH|SSL_aRSA|SSL_AES|SSL_SHA|SSL_TLSV1,
SSL_NOT_EXP|SSL_HIGH, 256, 384, SSL_ALL_CIPHERS, SSL_ALL_STRENGTHS
));
SuiteToOSSL.put("TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA", "ECDHE-ECDSA-DES-CBC3-SHA");
SuiteToOSSL.put("TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA", "ECDH-ECDSA-DES-CBC3-SHA");
SuiteToOSSL.put("TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "ECDHE-RSA-DES-CBC3-SHA");
SuiteToOSSL.put("TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA", "ECDH-RSA-DES-CBC3-SHA");
SuiteToOSSL.put("TLS_ECDHE_ECDSA_WITH_RC4_128_SHA", "ECDHE-ECDSA-RC4-SHA");
SuiteToOSSL.put("TLS_ECDHE_RSA_WITH_RC4_128_SHA", "ECDHE-RSA-RC4-SHA");
SuiteToOSSL.put("TLS_ECDH_ECDSA_WITH_RC4_128_SHA", "ECDH-ECDSA-RC4-SHA");
SuiteToOSSL.put("TLS_ECDH_RSA_WITH_RC4_128_SHA", "ECDH-RSA-RC4-SHA");
SuiteToOSSL.put("TLS_ECDH_anon_WITH_AES_128_CBC_SHA", name = "AECDH-AES128-SHA");
CipherNames.put(name, new Def(name,
SSL_kECDHE|SSL_aNULL|SSL_AES|SSL_SHA|SSL_TLSV1,
SSL_NOT_EXP|SSL_HIGH, 128, 128, SSL_ALL_CIPHERS, SSL_ALL_STRENGTHS
));
SuiteToOSSL.put("TLS_ECDH_anon_WITH_AES_256_CBC_SHA", name = "AECDH-AES256-SHA");
CipherNames.put(name, new Def(name,
SSL_kECDHE|SSL_aNULL|SSL_AES|SSL_SHA|SSL_TLSV1,
SSL_NOT_EXP|SSL_HIGH, 256, 256, SSL_ALL_CIPHERS, SSL_ALL_STRENGTHS
));
SuiteToOSSL.put("TLS_ECDH_anon_WITH_3DES_EDE_CBC_SHA", name = "AECDH-DES-CBC3-SHA");
CipherNames.put(name, new Def(name,
SSL_kECDHE|SSL_aNULL|SSL_3DES|SSL_SHA|SSL_TLSV1,
SSL_NOT_EXP|SSL_HIGH, 168, 168, SSL_ALL_CIPHERS, SSL_ALL_STRENGTHS
));
SuiteToOSSL.put("TLS_ECDH_anon_WITH_RC4_128_SHA", name = "AECDH-RC4-SHA");
CipherNames.put(name, new Def(name,
SSL_kECDHE|SSL_aNULL|SSL_RC4|SSL_SHA|SSL_TLSV1,
SSL_NOT_EXP, 128, 128, SSL_ALL_CIPHERS, SSL_ALL_STRENGTHS
));
SuiteToOSSL.put("TLS_ECDHE_ECDSA_WITH_NULL_SHA", "ECDHE-ECDSA-NULL-SHA");
SuiteToOSSL.put("TLS_ECDHE_RSA_WITH_NULL_SHA", "ECDHE-RSA-NULL-SHA");
SuiteToOSSL.put("TLS_ECDH_ECDSA_WITH_NULL_SHA", "ECDH-ECDSA-NULL-SHA");
SuiteToOSSL.put("TLS_ECDH_RSA_WITH_NULL_SHA", "ECDH-RSA-NULL-SHA");
SuiteToOSSL.put("TLS_ECDH_anon_WITH_NULL_SHA", "AECDH-NULL-SHA");
/* For IBM JRE: suite names start with "SSL_". On Oracle JRE, the suite names start with "TLS_" */
SuiteToOSSL.put("SSL_DH_anon_WITH_AES_128_CBC_SHA", "ADH-AES128-SHA");
SuiteToOSSL.put("SSL_DH_anon_WITH_AES_128_CBC_SHA256", "ADH-AES128-SHA256");
SuiteToOSSL.put("SSL_DH_anon_WITH_AES_128_GCM_SHA256", "ADH-AES128-GCM-SHA256");
SuiteToOSSL.put("SSL_DH_anon_WITH_AES_256_CBC_SHA", "ADH-AES256-SHA");
SuiteToOSSL.put("SSL_DH_anon_WITH_AES_256_CBC_SHA256", "ADH-AES256-SHA256");
SuiteToOSSL.put("SSL_DH_anon_WITH_AES_256_GCM_SHA384", "ADH-AES256-GCM-SHA384");
SuiteToOSSL.put("SSL_DHE_DSS_WITH_AES_128_CBC_SHA", "DHE-DSS-AES128-SHA");
SuiteToOSSL.put("SSL_DHE_DSS_WITH_AES_128_CBC_SHA256", "DHE-DSS-AES128-SHA256");
SuiteToOSSL.put("SSL_DHE_DSS_WITH_AES_128_GCM_SHA256", "DHE-DSS-AES128-GCM-SHA256");
SuiteToOSSL.put("SSL_DHE_DSS_WITH_AES_256_CBC_SHA", "DHE-DSS-AES256-SHA");
SuiteToOSSL.put("SSL_DHE_DSS_WITH_AES_256_CBC_SHA256", "DHE-DSS-AES256-SHA256");
SuiteToOSSL.put("SSL_DHE_DSS_WITH_AES_256_GCM_SHA384", "DHE-DSS-AES256-GCM-SHA384");
SuiteToOSSL.put("SSL_DHE_RSA_WITH_AES_128_CBC_SHA", "DHE-RSA-AES128-SHA");
SuiteToOSSL.put("SSL_DHE_RSA_WITH_AES_128_CBC_SHA256", "DHE-RSA-AES128-SHA256");
SuiteToOSSL.put("SSL_DHE_RSA_WITH_AES_128_GCM_SHA256", "DHE-RSA-AES128-GCM-SHA256");
SuiteToOSSL.put("SSL_DHE_RSA_WITH_AES_256_CBC_SHA", "DHE-RSA-AES256-SHA");
SuiteToOSSL.put("SSL_DHE_RSA_WITH_AES_256_CBC_SHA256", "DHE-RSA-AES256-SHA256");
SuiteToOSSL.put("SSL_DHE_RSA_WITH_AES_256_GCM_SHA384", "DHE-RSA-AES256-GCM-SHA384");
SuiteToOSSL.put("SSL_ECDH_anon_WITH_AES_128_CBC_SHA", "AECDH-AES128-SHA");
SuiteToOSSL.put("SSL_ECDH_anon_WITH_AES_256_CBC_SHA", "AECDH-AES256-SHA");
SuiteToOSSL.put("SSL_ECDH_anon_WITH_NULL_SHA", "AECDH-NULL-SHA");
SuiteToOSSL.put("SSL_ECDH_ECDSA_WITH_AES_128_CBC_SHA", "ECDH-ECDSA-AES128-SHA");
SuiteToOSSL.put("SSL_ECDH_ECDSA_WITH_AES_128_CBC_SHA256", "ECDH-ECDSA-AES128-SHA256");
SuiteToOSSL.put("SSL_ECDH_ECDSA_WITH_AES_128_GCM_SHA256", "ECDH-ECDSA-AES128-GCM-SHA256");
SuiteToOSSL.put("SSL_ECDH_ECDSA_WITH_AES_256_CBC_SHA", "ECDH-ECDSA-AES256-SHA");
SuiteToOSSL.put("SSL_ECDH_ECDSA_WITH_AES_256_CBC_SHA384", "ECDH-ECDSA-AES256-SHA384");
SuiteToOSSL.put("SSL_ECDH_ECDSA_WITH_AES_256_GCM_SHA384", "ECDH-ECDSA-AES256-GCM-SHA384");
SuiteToOSSL.put("SSL_ECDH_ECDSA_WITH_NULL_SHA", "ECDH-ECDSA-NULL-SHA");
SuiteToOSSL.put("SSL_ECDH_RSA_WITH_AES_128_CBC_SHA", "ECDH-RSA-AES128-SHA");
SuiteToOSSL.put("SSL_ECDH_RSA_WITH_AES_128_CBC_SHA256", "ECDH-RSA-AES128-SHA256");
SuiteToOSSL.put("SSL_ECDH_RSA_WITH_AES_128_GCM_SHA256", "ECDH-RSA-AES128-GCM-SHA256");
SuiteToOSSL.put("SSL_ECDH_RSA_WITH_AES_256_CBC_SHA", "ECDH-RSA-AES256-SHA");
SuiteToOSSL.put("SSL_ECDH_RSA_WITH_AES_256_CBC_SHA384", "ECDH-RSA-AES256-SHA384");
SuiteToOSSL.put("SSL_ECDH_RSA_WITH_AES_256_GCM_SHA384", "ECDH-RSA-AES256-GCM-SHA384");
SuiteToOSSL.put("SSL_ECDH_RSA_WITH_NULL_SHA", "ECDH-RSA-NULL-SHA");
SuiteToOSSL.put("SSL_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "ECDHE-ECDSA-AES128-SHA");
SuiteToOSSL.put("SSL_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "ECDHE-ECDSA-AES128-SHA256");
SuiteToOSSL.put("SSL_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "ECDHE-ECDSA-AES128-GCM-SHA256");
SuiteToOSSL.put("SSL_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "ECDHE-ECDSA-AES256-SHA");
SuiteToOSSL.put("SSL_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "ECDHE-ECDSA-AES256-SHA384");
SuiteToOSSL.put("SSL_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "ECDHE-ECDSA-AES256-GCM-SHA384");
SuiteToOSSL.put("SSL_ECDHE_ECDSA_WITH_NULL_SHA", "ECDHE-ECDSA-NULL-SHA");
SuiteToOSSL.put("SSL_ECDHE_RSA_WITH_AES_128_CBC_SHA", "ECDHE-RSA-AES128-SHA");
SuiteToOSSL.put("SSL_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "ECDHE-RSA-AES128-SHA256");
SuiteToOSSL.put("SSL_ECDHE_RSA_WITH_AES_256_CBC_SHA", "ECDHE-RSA-AES256-SHA");
SuiteToOSSL.put("SSL_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "ECDHE-RSA-AES128-SHA384");
SuiteToOSSL.put("SSL_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "ECDHE-RSA-AES256-GCM-SHA384");
SuiteToOSSL.put("SSL_ECDHE_RSA_WITH_NULL_SHA", "ECDHE-RSA-NULL-SHA");
SuiteToOSSL.put("SSL_RSA_WITH_AES_128_CBC_SHA", "AES128-SHA");
SuiteToOSSL.put("SSL_RSA_WITH_AES_128_CBC_SHA256", "AES128-SHA256");
SuiteToOSSL.put("SSL_RSA_WITH_AES_128_GCM_SHA256", "AES128-GCM-SHA256");
SuiteToOSSL.put("SSL_RSA_WITH_AES_256_CBC_SHA", "AES256-SHA");
SuiteToOSSL.put("SSL_RSA_WITH_AES_256_CBC_SHA256", "AES256-SHA256");
SuiteToOSSL.put("SSL_RSA_WITH_AES_256_GCM_SHA384", "AES256-GCM-SHA384");
SuiteToOSSL.put("SSL_RSA_WITH_NULL_SHA256", "NULL-SHA256");
// left overs supported by Java 7's SSLv3 / TLS v1.2 :
// TLS_EMPTY_RENEGOTIATION_INFO_SCSV,
// TLS_KRB5_WITH_3DES_EDE_CBC_SHA,
// TLS_KRB5_WITH_3DES_EDE_CBC_MD5,
// TLS_KRB5_WITH_RC4_128_SHA,
// TLS_KRB5_WITH_RC4_128_MD5,
// TLS_KRB5_WITH_DES_CBC_SHA,
// TLS_KRB5_WITH_DES_CBC_MD5,
// TLS_KRB5_EXPORT_WITH_DES_CBC_40_SHA,
// TLS_KRB5_EXPORT_WITH_DES_CBC_40_MD5,
// TLS_KRB5_EXPORT_WITH_RC4_40_SHA,
// TLS_KRB5_EXPORT_WITH_RC4_40_MD5
for ( Def def : Ciphers ) CipherNames.put(def.name, def);
}
}// CipherStrings
jruby-openssl-0.9.21/src/main/java/org/jruby/ext/openssl/Config.java 0000664 0000000 0000000 00000004552 13136616216 0025343 0 ustar 00root root 0000000 0000000 /***** BEGIN LICENSE BLOCK *****
* Version: EPL 1.0/GPL 2.0/LGPL 2.1
*
* The contents of this file are subject to the Eclipse Public
* License Version 1.0 (the "License"); you may not use this file
* except in compliance with the License. You may obtain a copy of
* the License at http://www.eclipse.org/legal/epl-v10.html
*
* Software distributed under the License is distributed on an "AS
* IS" basis, WITHOUT WARRANTY OF ANY KIND, either express or
* implied. See the License for the specific language governing
* rights and limitations under the License.
*
* Copyright (C) 2006 Ola Bini
*
* Alternatively, the contents of this file may be used under the terms of
* either of the GNU General Public License Version 2 or later (the "GPL"),
* or the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
* in which case the provisions of the GPL or the LGPL are applicable instead
* of those above. If you wish to allow use of your version of this file only
* under the terms of either the GPL or the LGPL, and not to allow others to
* use your version of this file under the terms of the EPL, indicate your
* decision by deleting the provisions above and replace them with the notice
* and other provisions required by the GPL or the LGPL. If you do not delete
* the provisions above, a recipient may use your version of this file under
* the terms of any one of the EPL, the GPL or the LGPL.
***** END LICENSE BLOCK *****/
package org.jruby.ext.openssl;
import org.jruby.Ruby;
import org.jruby.RubyClass;
import org.jruby.RubyModule;
/**
* @author Ola Bini
*/
public class Config {
// TODO: we cannot detect OS's default config file. ignore?
public static final String DEFAULT_CONFIG_FILE = "./openssl.cnf";
public static void createConfig(Ruby runtime, RubyModule mOSSL) {
RubyClass cConfig = mOSSL.defineClassUnder("Config", runtime.getObject(), runtime.getObject().getAllocator());
cConfig.defineAnnotatedMethods(Config.class);
RubyClass openSSLError = mOSSL.getClass("OpenSSLError");
mOSSL.defineClassUnder("ConfigError", openSSLError, openSSLError.getAllocator());
// TODO: we should define this constant with proper path. (see above)
//cConfig.setConstant("DEFAULT_CONFIG_FILE", runtime.newString(DEFAULT_CONFIG_FILE));
}
}// Config
jruby-openssl-0.9.21/src/main/java/org/jruby/ext/openssl/DefaultPEMHandler.java 0000664 0000000 0000000 00000003625 13136616216 0027362 0 ustar 00root root 0000000 0000000 /***** BEGIN LICENSE BLOCK *****
* Version: EPL 1.0/GPL 2.0/LGPL 2.1
*
* The contents of this file are subject to the Eclipse Public
* License Version 1.0 (the "License"); you may not use this file
* except in compliance with the License. You may obtain a copy of
* the License at http://www.eclipse.org/legal/epl-v10.html
*
* Software distributed under the License is distributed on an "AS
* IS" basis, WITHOUT WARRANTY OF ANY KIND, either express or
* implied. See the License for the specific language governing
* rights and limitations under the License.
*
* Copyright (C) 2006 Ola Bini
*
* Alternatively, the contents of this file may be used under the terms of
* either of the GNU General Public License Version 2 or later (the "GPL"),
* or the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
* in which case the provisions of the GPL or the LGPL are applicable instead
* of those above. If you wish to allow use of your version of this file only
* under the terms of either the GPL or the LGPL, and not to allow others to
* use your version of this file under the terms of the EPL, indicate your
* decision by deleting the provisions above and replace them with the notice
* and other provisions required by the GPL or the LGPL. If you do not delete
* the provisions above, a recipient may use your version of this file under
* the terms of any one of the EPL, the GPL or the LGPL.
***** END LICENSE BLOCK *****/
package org.jruby.ext.openssl;
import java.io.Reader;
import java.io.Writer;
/**
* @author Ola Bini
*/
public class DefaultPEMHandler implements PEMHandler {
public Object readPEM(Reader read, String password) {
return null;
}
public void writePEM(Writer writ, Object obj, String algorithm, char[] password) {
}
public void writePEM(Writer writ, Object obj) {
}
}// DefaultPEMHandler
jruby-openssl-0.9.21/src/main/java/org/jruby/ext/openssl/Digest.java 0000664 0000000 0000000 00000035223 13136616216 0025354 0 ustar 00root root 0000000 0000000 /***** BEGIN LICENSE BLOCK *****
* Version: EPL 1.0/GPL 2.0/LGPL 2.1
*
* The contents of this file are subject to the Eclipse Public
* License Version 1.0 (the "License"); you may not use this file
* except in compliance with the License. You may obtain a copy of
* the License at http://www.eclipse.org/legal/epl-v10.html
*
* Software distributed under the License is distributed on an "AS
* IS" basis, WITHOUT WARRANTY OF ANY KIND, either express or
* implied. See the License for the specific language governing
* rights and limitations under the License.
*
* Copyright (C) 2006, 2007 Ola Bini
*
* Alternatively, the contents of this file may be used under the terms of
* either of the GNU General Public License Version 2 or later (the "GPL"),
* or the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
* in which case the provisions of the GPL or the LGPL are applicable instead
* of those above. If you wish to allow use of your version of this file only
* under the terms of either the GPL or the LGPL, and not to allow others to
* use your version of this file under the terms of the EPL, indicate your
* decision by deleting the provisions above and replace them with the notice
* and other provisions required by the GPL or the LGPL. If you do not delete
* the provisions above, a recipient may use your version of this file under
* the terms of any one of the EPL, the GPL or the LGPL.
***** END LICENSE BLOCK *****/
package org.jruby.ext.openssl;
import java.security.MessageDigest;
import java.security.NoSuchAlgorithmException;
import org.jruby.Ruby;
import org.jruby.RubyClass;
import org.jruby.RubyFixnum;
import org.jruby.RubyInteger;
import org.jruby.RubyModule;
import org.jruby.RubyObject;
import org.jruby.RubyString;
import org.jruby.anno.JRubyMethod;
import org.jruby.runtime.ObjectAllocator;
import org.jruby.runtime.ThreadContext;
import org.jruby.runtime.builtin.IRubyObject;
import org.jruby.runtime.Visibility;
import org.jruby.util.ByteList;
import static org.jruby.ext.openssl.OpenSSL.*;
/**
* @author Ola Bini
*/
public class Digest extends RubyObject {
private static final long serialVersionUID = 7409857414064319518L;
private static final ObjectAllocator ALLOCATOR = new ObjectAllocator() {
public Digest allocate(Ruby runtime, RubyClass klass) { return new Digest(runtime, klass); }
};
public static void createDigest(Ruby runtime, RubyModule OpenSSL) {
runtime.getLoadService().require("digest");
final RubyModule coreDigest = runtime.getModule("Digest");
final RubyClass DigestClass = coreDigest.getClass("Class"); // ::Digest::Class
RubyClass Digest = OpenSSL.defineClassUnder("Digest", DigestClass, ALLOCATOR);
Digest.defineAnnotatedMethods(Digest.class);
RubyClass OpenSSLError = OpenSSL.getClass("OpenSSLError");
OpenSSL.defineClassUnder("DigestError", OpenSSLError, OpenSSLError.getAllocator());
String digestName;
digestName = "DSS"; // OpenSSL::Digest::DSS
Digest.defineClassUnder(digestName, Digest, new NamedDigestAllocator(digestName))
.defineAnnotatedMethods(Named.class);
digestName = "DSS1"; // OpenSSL::Digest::DSS1
Digest.defineClassUnder(digestName, Digest, new NamedDigestAllocator(digestName))
.defineAnnotatedMethods(Named.class);
digestName = "MD2"; // OpenSSL::Digest::MD2
Digest.defineClassUnder(digestName, Digest, new NamedDigestAllocator(digestName))
.defineAnnotatedMethods(Named.class);
digestName = "MD4"; // OpenSSL::Digest::MD4
Digest.defineClassUnder(digestName, Digest, new NamedDigestAllocator(digestName))
.defineAnnotatedMethods(Named.class);
digestName = "MD5"; // OpenSSL::Digest::MD5
Digest.defineClassUnder(digestName, Digest, new NamedDigestAllocator(digestName))
.defineAnnotatedMethods(Named.class);
digestName = "MDC2"; // OpenSSL::Digest::MDC2 NOTE: not really supported on Java
Digest.defineClassUnder(digestName, Digest, new NamedDigestAllocator(digestName))
.defineAnnotatedMethods(Named.class);
digestName = "RIPEMD160"; // OpenSSL::Digest::RIPEMD160
Digest.defineClassUnder(digestName, Digest, new NamedDigestAllocator(digestName))
.defineAnnotatedMethods(Named.class);
digestName = "SHA"; // OpenSSL::Digest::SHA
Digest.defineClassUnder(digestName, Digest, new NamedDigestAllocator(digestName))
.defineAnnotatedMethods(Named.class);
digestName = "SHA1"; // OpenSSL::Digest::SHA1
Digest.defineClassUnder(digestName, Digest, new NamedDigestAllocator(digestName))
.defineAnnotatedMethods(Named.class);
//
digestName = "SHA224"; // OpenSSL::Digest::SHA224
Digest.defineClassUnder(digestName, Digest, new NamedDigestAllocator(digestName))
.defineAnnotatedMethods(Named.class);
digestName = "SHA256"; // OpenSSL::Digest::SHA256
Digest.defineClassUnder(digestName, Digest, new NamedDigestAllocator(digestName))
.defineAnnotatedMethods(Named.class);
digestName = "SHA384"; // OpenSSL::Digest::SHA384
Digest.defineClassUnder(digestName, Digest, new NamedDigestAllocator(digestName))
.defineAnnotatedMethods(Named.class);
digestName = "SHA512"; // OpenSSL::Digest::SHA512
Digest.defineClassUnder(digestName, Digest, new NamedDigestAllocator(digestName))
.defineAnnotatedMethods(Named.class);
}
static RubyClass _Digest(final Ruby runtime) {
return (RubyClass) runtime.getModule("OpenSSL").getConstantAt("Digest");
}
static MessageDigest getDigest(final Ruby runtime, final String name) {
final String algorithm = osslToJava( name );
try {
return SecurityHelper.getMessageDigest(algorithm);
}
catch (NoSuchAlgorithmException e) {
debug(runtime, "getMessageDigest failed: " + e);
throw runtime.newNotImplementedError("Unsupported digest algorithm (" + name + ")");
}
}
private static Digest newInstance(final Ruby runtime, final IRubyObject name, final IRubyObject data) {
final RubyClass klass = _Digest(runtime);
final Digest instance = new Digest(runtime, klass);
instance.initializeImpl(runtime, name.asString(), data);
return instance;
}
public Digest(Ruby runtime, RubyClass type) {
super(runtime,type);
}
private RubyString name;
private MessageDigest digest;
String getRealName() {
return osslToJava(name.toString());
}
MessageDigest getDigestImpl() {
return digest;
}
public String getName() {
return name.toString();
}
@JRubyMethod(required = 1, optional = 1, visibility = Visibility.PRIVATE)
public IRubyObject initialize(final ThreadContext context, final IRubyObject[] args) {
IRubyObject data = context.nil;
if ( args.length > 1 ) data = args[1];
initializeImpl(context.runtime, args[0].asString(), data);
return this;
}
void initializeImpl(final Ruby runtime, final RubyString name, final IRubyObject data) {
this.name = name; // e.g. "MD5"
this.digest = getDigest(runtime, name.toString());
if ( ! data.isNil() ) update( data.asString() );
}
@Override
@JRubyMethod(visibility = Visibility.PRIVATE)
public IRubyObject initialize_copy(final IRubyObject obj) {
checkFrozen();
if ( this == obj ) return this;
final Digest that = ((Digest) obj);
this.name = (RubyString) that.name.dup();
try {
this.digest = (MessageDigest) that.digest.clone();
}
catch (CloneNotSupportedException e) {
final Ruby runtime = getRuntime();
debug(runtime, "MessageDigest.clone() failed: " + e);
throw runtime.newTypeError("Could not initialize copy of digest (" + name + ")");
}
return this;
}
@JRubyMethod(name = "update", alias = "<<")
public IRubyObject update(final IRubyObject obj) {
final ByteList bytes = obj.asString().getByteList();
digest.update(bytes.getUnsafeBytes(), bytes.getBegin(), bytes.getRealSize());
return this;
}
@JRubyMethod
public IRubyObject reset() {
digest.reset();
return this;
}
@JRubyMethod
public RubyString finish() {
final byte[] hash = digest.digest();
digest.reset();
return StringHelper.newString(getRuntime(), hash);
}
@JRubyMethod
public RubyString name() { return name; }
@JRubyMethod
public IRubyObject digest_length() {
return RubyFixnum.newFixnum(getRuntime(), digest.getDigestLength());
}
@JRubyMethod
public RubyInteger block_length(final ThreadContext context) {
final Ruby runtime = context.runtime;
final int blockLength = getBlockLength( digest.getAlgorithm() );
if ( blockLength == -1 ) {
throw runtime.newRuntimeError(getMetaClass() + " doesn't implement block_length()");
}
return runtime.newFixnum(blockLength);
}
String getAlgorithm() {
return this.digest.getAlgorithm();
}
String getShortAlgorithm() {
return getAlgorithm().replace("-", "");
}
// name mapping for openssl -> JCE
private static String osslToJava(final String digestName) {
String name = digestName.toString();
final String[] parts = name.split("::");
if ( parts.length > 1 ) { // only want Digest names from the last part of class name
name = parts[ parts.length - 1 ];
}
// DSS, DSS1 (Pseudo algorithms to be used for DSA signatures.
// DSS is equal to SHA and DSS1 is equal to SHA1)
if ( "DSS".equalsIgnoreCase(name) ) return "SHA";
if ( "DSS1".equalsIgnoreCase(name) ) return "SHA-1";
// BC accepts "SHA1" but it should be "SHA-1" per spec
if ( "SHA1".equalsIgnoreCase(name) ) return "SHA-1";
if ( name.toUpperCase().startsWith("SHA") &&
name.length() > 4 && name.charAt(3) != '-' ) { // SHA512
return "SHA-" + name.substring(3); // SHA-512
}
// BC handles MD2, MD4 and RIPEMD160 names fine ...
return name;
}
private static int getBlockLength(final String algorithm) {
final String alg = algorithm.toUpperCase();
if ( alg.startsWith("SHA") ) {
if ( alg.equals("SHA-384") ) return 128;
if ( alg.equals("SHA-512") ) return 128;
return 64; // others 224/256 have 512 bit blocks
}
if ( alg.equals("MD5") ) return 64;
if ( alg.equals("MD4") ) return 64;
if ( alg.equals("MD2") ) return 48;
if ( alg.equals("RIPEMD160") ) return 64;
return -1;
}
@JRubyMethod(meta = true) // OpenSSL::Digest.digest("SHA256, "abc")
public static RubyString digest(final ThreadContext context, final IRubyObject self,
final IRubyObject name, final IRubyObject data) {
return newInstance(context.runtime, name, data).finish();
}
@JRubyMethod(meta = true) // OpenSSL::Digest.hexdigest("SHA1" "abc")
public static RubyString hexdigest(final ThreadContext context, final IRubyObject self,
final IRubyObject name, final IRubyObject data) {
final Ruby runtime = context.runtime;
return hexString( newInstance(runtime, name, data).finish() );
}
private final static byte[] HEX = {
'0', '1', '2', '3', '4', '5', '6', '7', '8', '9', 'a', 'b', 'c', 'd', 'e', 'f'
};
private static RubyString hexString(final RubyString str) {
final byte[] plain = str.getBytes(); final int len = plain.length;
final ByteList bytes = str.getByteList(); // modify str in-place !
bytes.length( len * 2 ); bytes.invalidate();
final byte[] unsafeBytes = bytes.getUnsafeBytes();
int index = bytes.getBegin();
for ( int i = 0; i < len; i++ ) {
final int b = plain[i] & 0xFF;
unsafeBytes[ index++ ] = HEX[ b >> 4 ];
unsafeBytes[ index++ ] = HEX[ b & 0xF ];
}
return str;
}
private static class NamedDigestAllocator implements ObjectAllocator {
private final String digestName;
NamedDigestAllocator(final String digestName) {
this.digestName = digestName;
}
public Named allocate(Ruby runtime, RubyClass klass) {
return new Named(runtime, klass, digestName);
}
};
public static class Named extends Digest {
private static final long serialVersionUID = -8794569678070129828L;
private final RubyString digestName;
Named(Ruby runtime, RubyClass type, String digestName) {
super(runtime, type);
this.digestName = RubyString.newString(runtime, digestName); // e.g. "MD5"
}
/*
MD5 = Class.new(Digest) do
define_method(:initialize) do |*data|
if data.length > 1
raise ArgumentError, "wrong number of arguments (#{data.length} for 1)"
end
super(name, data.first)
end
end
*/
@Override
@JRubyMethod(required = 0, optional = 1, visibility = Visibility.PRIVATE)
public IRubyObject initialize(final ThreadContext context, final IRubyObject[] args) {
IRubyObject data = context.nil;
if ( args.length > 0 ) data = args[0];
initializeImpl(context.runtime, digestName, data); // super(name, args[0])
return this;
}
/*
define_method(:digest){ |data| Digest.digest(name, data) }
define_method(:hexdigest){ |data| Digest.hexdigest(name, data) }
*/
@JRubyMethod(meta = true)
public static RubyString digest(final ThreadContext context, final IRubyObject self,
final IRubyObject data) {
return newInstance(context.runtime, (RubyClass) self, data).finish();
}
@JRubyMethod(meta = true)
public static RubyString hexdigest(final ThreadContext context, final IRubyObject self,
final IRubyObject data) {
final Ruby runtime = context.runtime;
return hexString( newInstance(runtime, (RubyClass) self, data).finish() );
}
private static Named newInstance(final Ruby runtime,
final RubyClass klass, final IRubyObject data) {
final String name = klass.getBaseName();
final Named instance = new Named(runtime, klass, name);
instance.initializeImpl(runtime, instance.digestName, data);
return instance;
}
}
}
jruby-openssl-0.9.21/src/main/java/org/jruby/ext/openssl/HMAC.java 0000664 0000000 0000000 00000021673 13136616216 0024651 0 ustar 00root root 0000000 0000000 /***** BEGIN LICENSE BLOCK *****
* Version: EPL 1.0/GPL 2.0/LGPL 2.1
*
* The contents of this file are subject to the Eclipse Public
* License Version 1.0 (the "License"); you may not use this file
* except in compliance with the License. You may obtain a copy of
* the License at http://www.eclipse.org/legal/epl-v10.html
*
* Software distributed under the License is distributed on an "AS
* IS" basis, WITHOUT WARRANTY OF ANY KIND, either express or
* implied. See the License for the specific language governing
* rights and limitations under the License.
*
* Copyright (C) 2006, 2007 Ola Bini
*
* Alternatively, the contents of this file may be used under the terms of
* either of the GNU General Public License Version 2 or later (the "GPL"),
* or the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
* in which case the provisions of the GPL or the LGPL are applicable instead
* of those above. If you wish to allow use of your version of this file only
* under the terms of either the GPL or the LGPL, and not to allow others to
* use your version of this file under the terms of the EPL, indicate your
* decision by deleting the provisions above and replace them with the notice
* and other provisions required by the GPL or the LGPL. If you do not delete
* the provisions above, a recipient may use your version of this file under
* the terms of any one of the EPL, the GPL or the LGPL.
***** END LICENSE BLOCK *****/
package org.jruby.ext.openssl;
import java.security.GeneralSecurityException;
import java.security.NoSuchAlgorithmException;
import javax.crypto.Mac;
import org.jruby.Ruby;
import org.jruby.RubyClass;
import org.jruby.RubyModule;
import org.jruby.RubyObject;
import org.jruby.RubyString;
import org.jruby.anno.JRubyMethod;
import org.jruby.runtime.ObjectAllocator;
import org.jruby.runtime.builtin.IRubyObject;
import org.jruby.util.ByteList;
import org.jruby.runtime.Visibility;
import static org.jruby.ext.openssl.OpenSSL.isDebug;
/**
* @author Ola Bini
*/
public class HMAC extends RubyObject {
private static final long serialVersionUID = 7602535792884680307L;
private static final ObjectAllocator ALLOCATOR = new ObjectAllocator() {
public HMAC allocate(Ruby runtime, RubyClass klass) { return new HMAC(runtime, klass); }
};
public static void createHMAC(final Ruby runtime, final RubyModule OpenSSL) {
RubyClass HMAC = OpenSSL.defineClassUnder("HMAC", runtime.getObject(), ALLOCATOR);
RubyClass openSSLError = OpenSSL.getClass("OpenSSLError");
OpenSSL.defineClassUnder("HMACError",openSSLError,openSSLError.getAllocator());
HMAC.defineAnnotatedMethods(HMAC.class);
}
private static Mac getMacInstance(final String algorithmName) throws NoSuchAlgorithmException {
// final String algorithmSuffix = algorithmName.replaceAll("-", "");
final StringBuilder algName = new StringBuilder(5 + algorithmName.length());
algName.append("HMAC"); // .append(algorithmSuffix);
for ( int i = 0; i < algorithmName.length(); i++ ) {
char c = algorithmName.charAt(i);
if ( c != '-' ) algName.append(c);
}
try {
return SecurityHelper.getMac(algName.toString());
} // some algorithms need the - removed; this is ugly, I know.
catch (NoSuchAlgorithmException e) {
algName.insert(5, '-'); // "HMAC-" + algorithmSuffix
return SecurityHelper.getMac(algName.toString());
}
}
@JRubyMethod(name = "digest", meta = true)
public static IRubyObject digest(IRubyObject self, IRubyObject digest, IRubyObject key, IRubyObject data) {
final Ruby runtime = self.getRuntime();
final String algName = getDigestAlgorithmName(digest);
final byte[] keyBytes = key.asString().getBytes();
final ByteList bytes = data.asString().getByteList();
try {
Mac mac = getMacInstance(algName);
mac.init( new SimpleSecretKey(mac.getAlgorithm(), keyBytes) );
mac.update(bytes.getUnsafeBytes(), bytes.getBegin(), bytes.getRealSize());
return runtime.newString( new ByteList(mac.doFinal(), false) );
}
catch (NoSuchAlgorithmException e) {
throw runtime.newNotImplementedError("Unsupported MAC algorithm (HMAC[-]" + algName + ")");
}
catch (GeneralSecurityException e) {
if ( isDebug(runtime) ) e.printStackTrace(runtime.getOut());
throw runtime.newNotImplementedError(e.getMessage());
}
}
@JRubyMethod(name = "hexdigest", meta = true)
public static IRubyObject hexdigest(IRubyObject self, IRubyObject digest, IRubyObject key, IRubyObject data) {
final Ruby runtime = self.getRuntime();
final String algName = getDigestAlgorithmName(digest);
final byte[] keyBytes = key.asString().getBytes();
final ByteList bytes = data.asString().getByteList();
try {
final Mac mac = getMacInstance(algName);
mac.init( new SimpleSecretKey(mac.getAlgorithm(), keyBytes) );
mac.update(bytes.getUnsafeBytes(), bytes.getBegin(), bytes.getRealSize());
return runtime.newString( toHEX( mac.doFinal() ) );
}
catch (NoSuchAlgorithmException e) {
throw runtime.newNotImplementedError("Unsupported MAC algorithm (HMAC[-]" + algName + ")");
}
catch (GeneralSecurityException e) {
if ( isDebug(runtime) ) e.printStackTrace(runtime.getOut());
throw runtime.newNotImplementedError(e.getMessage());
}
}
public HMAC(Ruby runtime, RubyClass type) {
super(runtime,type);
}
private Mac mac;
private byte[] key;
private ByteList data = new ByteList(64);
@JRubyMethod(visibility = Visibility.PRIVATE)
public IRubyObject initialize(IRubyObject key, IRubyObject digest) {
final String algName = getDigestAlgorithmName(digest);
try {
this.mac = getMacInstance(algName);
this.key = key.asString().getBytes();
mac.init( SimpleSecretKey.copy(mac.getAlgorithm(), this.key) );
}
catch (NoSuchAlgorithmException e) {
throw getRuntime().newNotImplementedError("Unsupported MAC algorithm (HMAC[-]" + algName + ")");
}
catch (GeneralSecurityException e) {
if ( isDebug(getRuntime()) ) e.printStackTrace(getRuntime().getOut());
throw getRuntime().newNotImplementedError(e.getMessage());
}
return this;
}
@Override
@JRubyMethod(visibility = Visibility.PRIVATE)
public IRubyObject initialize_copy(final IRubyObject obj) {
if ( this == obj ) return this;
checkFrozen();
final HMAC that = ((HMAC) obj);
final String algName = that.mac.getAlgorithm();
try {
this.mac = SecurityHelper.getMac(algName);
this.key = that.key;
mac.init( SimpleSecretKey.copy(algName, key) );
}
catch (NoSuchAlgorithmException e) {
throw getRuntime().newNotImplementedError("Unsupported MAC algorithm (" + algName + ")");
}
catch (GeneralSecurityException e) {
if ( isDebug(getRuntime()) ) e.printStackTrace(getRuntime().getOut());
throw getRuntime().newNotImplementedError(e.getMessage());
}
data = new ByteList(that.data);
return this;
}
@JRubyMethod(name = { "update", "<<" })
public IRubyObject update(final IRubyObject obj) {
data.append(obj.asString().getByteList());
return this;
}
@JRubyMethod
public IRubyObject reset() {
data = new ByteList(64);
return this;
}
@JRubyMethod
public IRubyObject digest() {
return RubyString.newString( getRuntime(), getSignatureBytes() );
}
@JRubyMethod(name = { "hexdigest", "inspect", "to_s" })
public IRubyObject hexdigest() {
return getRuntime().newString( toHEX(getSignatureBytes()) );
}
String getAlgorithm() {
return mac.getAlgorithm();
}
private byte[] getSignatureBytes() {
mac.reset();
mac.update(data.getUnsafeBytes(), data.getBegin(), data.getRealSize());
return mac.doFinal();
}
private static String getDigestAlgorithmName(final IRubyObject digest) {
if ( digest instanceof Digest ) {
return ((Digest) digest).getShortAlgorithm();
}
return digest.asString().toString();
}
private static final char[] HEX = {
'0' , '1' , '2' , '3' , '4' , '5' , '6' , '7' ,
'8' , '9' , 'a' , 'b' , 'c' , 'd' , 'e' , 'f'
};
private static ByteList toHEX(final byte[] data) {
final ByteList out = new ByteList(data.length * 2);
for ( int i = 0; i < data.length; i++ ) {
final byte b = data[i];
out.append( HEX[ (b >> 4) & 0xF ] );
out.append( HEX[ b & 0xF ] );
}
return out;
}
}// HMAC
jruby-openssl-0.9.21/src/main/java/org/jruby/ext/openssl/NetscapeSPKI.java 0000664 0000000 0000000 00000024325 13136616216 0026367 0 ustar 00root root 0000000 0000000 /***** BEGIN LICENSE BLOCK *****
* Version: EPL 1.0/GPL 2.0/LGPL 2.1
*
* The contents of this file are subject to the Eclipse Public
* License Version 1.0 (the "License"); you may not use this file
* except in compliance with the License. You may obtain a copy of
* the License at http://www.eclipse.org/legal/epl-v10.html
*
* Software distributed under the License is distributed on an "AS
* IS" basis, WITHOUT WARRANTY OF ANY KIND, either express or
* implied. See the License for the specific language governing
* rights and limitations under the License.
*
* Copyright (C) 2006, 2007 Ola Bini
*
* Alternatively, the contents of this file may be used under the terms of
* either of the GNU General Public License Version 2 or later (the "GPL"),
* or the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
* in which case the provisions of the GPL or the LGPL are applicable instead
* of those above. If you wish to allow use of your version of this file only
* under the terms of either the GPL or the LGPL, and not to allow others to
* use your version of this file under the terms of the EPL, indicate your
* decision by deleting the provisions above and replace them with the notice
* and other provisions required by the GPL or the LGPL. If you do not delete
* the provisions above, a recipient may use your version of this file under
* the terms of any one of the EPL, the GPL or the LGPL.
***** END LICENSE BLOCK *****/
package org.jruby.ext.openssl;
import java.io.IOException;
import java.security.GeneralSecurityException;
import java.security.NoSuchAlgorithmException;
import java.security.PublicKey;
import org.bouncycastle.asn1.ASN1EncodableVector;
import org.bouncycastle.asn1.DERBitString;
import org.bouncycastle.asn1.DERIA5String;
import org.bouncycastle.asn1.DERNull;
import org.bouncycastle.asn1.ASN1ObjectIdentifier;
import org.bouncycastle.asn1.ASN1Sequence;
import org.bouncycastle.asn1.DLSequence;
import org.bouncycastle.asn1.x509.AlgorithmIdentifier;
import org.jruby.Ruby;
import org.jruby.RubyClass;
import org.jruby.RubyModule;
import org.jruby.RubyObject;
import org.jruby.RubyString;
import org.jruby.anno.JRubyMethod;
import org.jruby.exceptions.RaiseException;
import org.jruby.ext.openssl.impl.Base64;
import org.jruby.runtime.ObjectAllocator;
import org.jruby.runtime.builtin.IRubyObject;
import org.jruby.runtime.ThreadContext;
import org.jruby.runtime.Visibility;
import org.jruby.util.ByteList;
// org.bouncycastle.jce.netscape.NetscapeCertRequest emulator:
import org.jruby.ext.openssl.impl.NetscapeCertRequest;
import static org.jruby.ext.openssl.PKeyDSA._DSA;
import static org.jruby.ext.openssl.PKeyRSA._RSA;
import static org.jruby.ext.openssl.OpenSSL.*;
/**
* @author Ola Bini
*/
public class NetscapeSPKI extends RubyObject {
private static final long serialVersionUID = 3211242351810109432L;
private static ObjectAllocator NETSCAPESPKI_ALLOCATOR = new ObjectAllocator() {
public IRubyObject allocate(Ruby runtime, RubyClass klass) {
return new NetscapeSPKI(runtime, klass);
}
};
public static void createNetscapeSPKI(Ruby runtime, RubyModule ossl) {
RubyModule mNetscape = ossl.defineModuleUnder("Netscape");
RubyClass cSPKI = mNetscape.defineClassUnder("SPKI",runtime.getObject(),NETSCAPESPKI_ALLOCATOR);
RubyClass openSSLError = ossl.getClass("OpenSSLError");
mNetscape.defineClassUnder("SPKIError",openSSLError,openSSLError.getAllocator());
cSPKI.defineAnnotatedMethods(NetscapeSPKI.class);
}
private static RubyModule _Netscape(final Ruby runtime) {
return (RubyModule) runtime.getModule("OpenSSL").getConstant("Netscape");
}
public NetscapeSPKI(Ruby runtime, RubyClass type) {
super(runtime,type);
}
private IRubyObject public_key;
private IRubyObject challenge;
private Object cert;
@JRubyMethod(name = "initialize", rest = true, visibility = Visibility.PRIVATE)
public IRubyObject initialize(final ThreadContext context, final IRubyObject[] args) {
final Ruby runtime = context.runtime;
if ( args.length > 0 ) {
byte[] request = args[0].convertToString().getBytes();
request = tryBase64Decode(request);
final NetscapeCertRequest cert;
try {
this.cert = cert = new NetscapeCertRequest(request);
challenge = runtime.newString( cert.getChallenge() );
}
catch (GeneralSecurityException e) { throw newSPKIError(e); }
catch (IllegalArgumentException e) { throw newSPKIError(e); }
final PublicKey publicKey = cert.getPublicKey();
final String algorithm = publicKey.getAlgorithm();
final RubyString pub_key = RubyString.newString(runtime, publicKey.getEncoded());
if ( "RSA".equalsIgnoreCase(algorithm) ) {
this.public_key = _RSA(runtime).callMethod(context, "new", pub_key);
}
else if ( "DSA".equalsIgnoreCase(algorithm) ) {
this.public_key = _DSA(runtime).callMethod(context, "new", pub_key);
}
else {
throw runtime.newLoadError("not implemented algo for public key: " + algorithm);
}
}
return this;
}
// just try to decode for the time when the given bytes are base64 encoded.
private static byte[] tryBase64Decode(byte[] b) {
try {
b = Base64.decode(b, 0, b.length, Base64.NO_OPTIONS);
}
catch (IOException ignored) { }
catch (IllegalArgumentException ignored) { }
return b;
}
@JRubyMethod
public IRubyObject to_der() {
try {
final byte[] derBytes = toDER();
return getRuntime().newString(new ByteList(derBytes, false));
}
catch (IOException ioe) { throw newSPKIError(ioe); }
}
@JRubyMethod(name = { "to_pem", "to_s" })
public IRubyObject to_pem() {
try {
byte[] source = toDER();
// no Base64.DO_BREAK_LINES option needed for NSPKI :
source = Base64.encodeBytesToBytes(source, 0, source.length, Base64.NO_OPTIONS);
return getRuntime().newString(new ByteList(source, false));
}
catch (IOException ioe) { throw newSPKIError(ioe); }
}
private byte[] toDER() throws IOException {
ASN1Sequence b = (ASN1Sequence) ((NetscapeCertRequest) cert).toASN1Primitive();
ASN1ObjectIdentifier encType = (ASN1ObjectIdentifier)((ASN1Sequence)((ASN1Sequence)((ASN1Sequence)b.getObjectAt(0)).getObjectAt(0)).getObjectAt(0)).getObjectAt(0);
ASN1ObjectIdentifier sigAlg = ((AlgorithmIdentifier)b.getObjectAt(1)).getAlgorithm();
DERBitString sig = (DERBitString) b.getObjectAt(2);
DERBitString publicKey = new DERBitString(((PKey) public_key).to_der().convertToString().getBytes());
DERIA5String encodedChallenge = new DERIA5String(this.challenge.toString());
ASN1EncodableVector v1 = new ASN1EncodableVector();
ASN1EncodableVector v1_2 = new ASN1EncodableVector();
ASN1EncodableVector v2 = new ASN1EncodableVector();
ASN1EncodableVector v3 = new ASN1EncodableVector();
ASN1EncodableVector v4 = new ASN1EncodableVector();
v4.add(encType);
v4.add(DERNull.INSTANCE);
v3.add(new DLSequence(v4));
v3.add(publicKey);
v2.add(new DLSequence(v3));
v2.add(encodedChallenge);
v1.add(new DLSequence(v2));
v1_2.add(sigAlg);
v1_2.add(DERNull.INSTANCE);
v1.add(new DLSequence(v1_2));
v1.add(sig);
return new DLSequence(v1).getEncoded();
}
@JRubyMethod
public IRubyObject to_text() {
warn(getRuntime().getCurrentContext(), "WARNING: unimplemented method called: Netscape::SPKI#to_text");
return getRuntime().getNil();
}
@JRubyMethod
public IRubyObject public_key() {
return this.public_key;
}
@JRubyMethod(name="public_key=")
public IRubyObject set_public_key(final IRubyObject public_key) {
return this.public_key = public_key;
}
@JRubyMethod
public IRubyObject sign(final IRubyObject key, final IRubyObject digest) {
final String keyAlg = ((PKey) key).getAlgorithm();
final String digAlg = ((Digest) digest).getShortAlgorithm();
final String symKey = keyAlg.toLowerCase() + '-' + digAlg.toLowerCase();
try {
final ASN1ObjectIdentifier alg = ASN1.sym2Oid( getRuntime(), symKey );
final PublicKey publicKey = ( (PKey) this.public_key ).getPublicKey();
final String challengeStr = challenge.toString();
final NetscapeCertRequest cert;
this.cert = cert = new NetscapeCertRequest(challengeStr, new AlgorithmIdentifier(alg), publicKey);
cert.sign( ((PKey) key).getPrivateKey() );
}
catch (NoSuchAlgorithmException e) {
debugStackTrace(getRuntime(), e);
throw newSPKIError(e);
}
catch (GeneralSecurityException e) {
throw newSPKIError(e);
}
return this;
}
@JRubyMethod
public IRubyObject verify(final IRubyObject pkey) {
final NetscapeCertRequest cert = (NetscapeCertRequest) this.cert;
cert.setPublicKey( ((PKey) pkey).getPublicKey() );
try {
boolean result = cert.verify(challenge.toString());
return getRuntime().newBoolean(result);
}
catch (NoSuchAlgorithmException e) {
debugStackTrace(getRuntime(), e);
throw newSPKIError(e);
}
catch (GeneralSecurityException e) {
throw newSPKIError(e);
}
}
@JRubyMethod
public IRubyObject challenge() {
return this.challenge;
}
@JRubyMethod(name="challenge=")
public IRubyObject set_challenge(final IRubyObject challenge) {
return this.challenge = challenge;
}
private RaiseException newSPKIError(final Exception e) {
return newSPKIError(getRuntime(), e.getMessage());
}
private static RaiseException newSPKIError(Ruby runtime, String message) {
return Utils.newError(runtime, _Netscape(runtime).getClass("SPKIError"), message);
}
}// NetscapeSPKI
jruby-openssl-0.9.21/src/main/java/org/jruby/ext/openssl/OCSP.java 0000664 0000000 0000000 00000026117 13136616216 0024703 0 ustar 00root root 0000000 0000000 /*
* The contents of this file are subject to the Common Public License Version 1.0
* (the "License"); you may not use this file except in compliance with the License.
* You may obtain a copy of the License at http://www.eclipse.org/legal/cpl-v10.html
*
* THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
* IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
* FOR APARTICULAR PURPOSE AND NONINFRINGEMENT.
* IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM,
* DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,
* ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
* DEALINGS IN THE SOFTWARE.
*
* Copyright (C) 2017 Donovan Lampa
* Copyright (C) 2009-2017 The JRuby Team
*
* Alternatively, the contents of this file may be used under the terms of
* either of the GNU General Public License Version 2 or later (the "GPL"),
* or the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
* in which case the provisions of the GPL or the LGPL are applicable instead
* of those above. If you wish to allow use of your version of this file only
* under the terms of either the GPL or the LGPL, and not to allow others to
* use your version of this file under the terms of the EPL, indicate your
* decision by deleting the provisions above and replace them with the notice
* and other provisions required by the GPL or the LGPL. If you do not delete
* the provisions above, a recipient may use your version of this file under
* the terms of any one of the EPL, the GPL or the LGPL.
*
*
* JRuby-OpenSSL includes software by The Legion of the Bouncy Castle Inc.
* Please, visit (http://bouncycastle.org/license.html) for licensing details.
*/
package org.jruby.ext.openssl;
import java.security.Security;
import java.util.HashMap;
import java.util.Map;
import org.bouncycastle.jce.provider.BouncyCastleProvider;
import org.jruby.Ruby;
import org.jruby.RubyClass;
import org.jruby.RubyFixnum;
import org.jruby.RubyModule;
import org.jruby.exceptions.RaiseException;
import org.jruby.runtime.builtin.IRubyObject;
/**
* OCSP
*
* @author lampad
*/
public class OCSP {
//Response has valid confirmations
private static final String _RESPONSE_STATUS_SUCCESSFUL_STR = "RESPONSE_STATUS_SUCCESSFUL";
private static final int _RESPONSE_STATUS_SUCCESSFUL = 0;
//Illegal confirmation request
private static final String _RESPONSE_STATUS_MALFORMEDREQUEST_STR = "RESPONSE_STATUS_MALFORMEDREQUEST";
private static final int _RESPONSE_STATUS_MALFORMEDREQUEST = 1;
//Internal error in issuer
private static final String _RESPONSE_STATUS_INTERNALERROR_STR = "RESPONSE_STATUS_INTERNALERROR";
private static final int _RESPONSE_STATUS_INTERNALERROR = 2;
//Try again later
private static final String _RESPONSE_STATUS_TRYLATER_STR = "RESPONSE_STATUS_TRYLATER";
private static final int _RESPONSE_STATUS_TRYLATER = 3;
//You must sign the request and resubmit
private static final String _RESPONSE_STATUS_SIGREQUIRED_STR = "RESPONSE_STATUS_SIGREQUIRED";
private static final int _RESPONSE_STATUS_SIGREQUIRED = 5;
//Your request is unauthorized.
private static final String _RESPONSE_STATUS_UNAUTHORIZED_STR = "RESPONSE_STATUS_UNAUTHORIZED";
private static final int _RESPONSE_STATUS_UNAUTHORIZED = 6;
private static final Map responseMap;
//The certificate was revoked for an unknown reason
private static final int _REVOKED_STATUS_NOSTATUS = -1;
//The certificate was revoked for an unspecified reason
private static final int _REVOKED_STATUS_UNSPECIFIED = 0;
//The certificate was revoked due to a key compromise
private static final int _REVOKED_STATUS_KEYCOMPROMISE = 1;
//This CA certificate was revoked due to a key compromise
private static final int _REVOKED_STATUS_CACOMPROMISE = 2;
//The certificate subject's name or other information changed
private static final int _REVOKED_STATUS_AFFILIATIONCHANGED = 3;
//The certificate was superseded by a new certificate
private static final int _REVOKED_STATUS_SUPERSEDED = 4;
//The certificate is no longer needed
private static final int _REVOKED_STATUS_CESSATIONOFOPERATION = 5;
//The certificate is on hold
private static final int _REVOKED_STATUS_CERTIFICATEHOLD = 6;
//The certificate was previously on hold and should now be removed from the CRL
private static final int _REVOKED_STATUS_REMOVEFROMCRL = 8;
//Do not include certificates in the response
private static final int _NOCERTS = 0x1;
//Do not search certificates contained in the response for a signer
private static final int _NOINTERN = 0x2;
//Do not check the signature on the response
private static final int _NOSIGS = 0x4;
//Do not verify the certificate chain on the response
private static final int _NOCHAIN = 0x8;
//Do not verify the response at all
private static final int _NOVERIFY = 0x10;
//Do not check trust
private static final int _NOEXPLICIT = 0x20;
//(This flag is not used by OpenSSL 1.0.1g)
private static final int _NOCASIGN = 0x40;
//(This flag is not used by OpenSSL 1.0.1g)
private static final int _NODELEGATED = 0x80;
//Do not make additional signing certificate checks
private static final int _NOCHECKS = 0x100;
//Do not verify additional certificates
private static final int _TRUSTOTHER = 0x200;
//Identify the response by signing the certificate key ID
private static final int _RESPID_KEY = 0x400;
//Do not include producedAt time in response
private static final int _NOTIME = 0x800;
/*
* Indicates the certificate is not revoked but does not necessarily mean
* the certificate was issued or that this response is within the
* certificate's validity interval
*/
private static final int _V_CERTSTATUS_GOOD = 0;
/* Indicates the certificate has been revoked either permanently or
* temporarily (on hold).
*/
private static final int _V_CERTSTATUS_REVOKED = 1;
/* Indicates the responder does not know about the certificate being
* requested.
*/
private static final int _V_CERTSTATUS_UNKNOWN = 2;
//The responder ID is based on the key name.
private static final int _V_RESPID_NAME = 0;
//The responder ID is based on the public key.
private static final int _V_RESPID_KEY =1;
static {
Map resMap = new HashMap();
resMap.put(_RESPONSE_STATUS_SUCCESSFUL, _RESPONSE_STATUS_SUCCESSFUL_STR);
resMap.put(_RESPONSE_STATUS_MALFORMEDREQUEST, _RESPONSE_STATUS_MALFORMEDREQUEST_STR);
resMap.put(_RESPONSE_STATUS_INTERNALERROR, _RESPONSE_STATUS_INTERNALERROR_STR);
resMap.put(_RESPONSE_STATUS_TRYLATER, _RESPONSE_STATUS_TRYLATER_STR);
resMap.put(_RESPONSE_STATUS_SIGREQUIRED, _RESPONSE_STATUS_SIGREQUIRED_STR);
resMap.put(_RESPONSE_STATUS_UNAUTHORIZED, _RESPONSE_STATUS_UNAUTHORIZED_STR);
responseMap = resMap;
}
public static void createOCSP(final Ruby runtime, final RubyModule OpenSSL) {
final RubyModule OCSP = OpenSSL.defineModuleUnder("OCSP");
final RubyClass OpenSSLError = OpenSSL.getClass("OpenSSLError");
Security.addProvider(new BouncyCastleProvider());
OCSP.defineClassUnder("OCSPError", OpenSSLError, OpenSSLError.getAllocator());
OCSPBasicResponse.createBasicResponse(runtime, OCSP);
OCSPCertificateId.createCertificateId(runtime, OCSP);
OCSPRequest.createRequest(runtime, OCSP);
OCSPResponse.createResponse(runtime, OCSP);
OCSPSingleResponse.createSingleResponse(runtime, OCSP);
//ResponseStatuses
OCSP.setConstant(_RESPONSE_STATUS_SUCCESSFUL_STR, runtime.newFixnum(_RESPONSE_STATUS_SUCCESSFUL));
OCSP.setConstant(_RESPONSE_STATUS_MALFORMEDREQUEST_STR, runtime.newFixnum(_RESPONSE_STATUS_MALFORMEDREQUEST));
OCSP.setConstant(_RESPONSE_STATUS_INTERNALERROR_STR, runtime.newFixnum(_RESPONSE_STATUS_INTERNALERROR));
OCSP.setConstant(_RESPONSE_STATUS_TRYLATER_STR, runtime.newFixnum(_RESPONSE_STATUS_TRYLATER));
OCSP.setConstant(_RESPONSE_STATUS_SIGREQUIRED_STR, runtime.newFixnum(_RESPONSE_STATUS_SIGREQUIRED));
OCSP.setConstant(_RESPONSE_STATUS_UNAUTHORIZED_STR, runtime.newFixnum(_RESPONSE_STATUS_UNAUTHORIZED));
//RevocationReasons
OCSP.setConstant("REVOKED_STATUS_NOSTATUS", runtime.newFixnum(_REVOKED_STATUS_NOSTATUS));
OCSP.setConstant("REVOKED_STATUS_UNSPECIFIED", runtime.newFixnum(_REVOKED_STATUS_UNSPECIFIED));
OCSP.setConstant("REVOKED_STATUS_KEYCOMPROMISE", runtime.newFixnum(_REVOKED_STATUS_KEYCOMPROMISE));
OCSP.setConstant("REVOKED_STATUS_CACOMPROMISE", runtime.newFixnum(_REVOKED_STATUS_CACOMPROMISE));
OCSP.setConstant("REVOKED_STATUS_AFFILIATIONCHANGED", runtime.newFixnum(_REVOKED_STATUS_AFFILIATIONCHANGED));
OCSP.setConstant("REVOKED_STATUS_SUPERSEDED", runtime.newFixnum(_REVOKED_STATUS_SUPERSEDED));
OCSP.setConstant("REVOKED_STATUS_CESSATIONOFOPERATION", runtime.newFixnum(_REVOKED_STATUS_CESSATIONOFOPERATION));
OCSP.setConstant("REVOKED_STATUS_CERTIFICATEHOLD", runtime.newFixnum(_REVOKED_STATUS_CERTIFICATEHOLD));
OCSP.setConstant("REVOKED_STATUS_REMOVEFROMCRL", runtime.newFixnum(_REVOKED_STATUS_REMOVEFROMCRL));
OCSP.setConstant("NOCERTS", runtime.newFixnum(_NOCERTS));
OCSP.setConstant("NOINTERN", runtime.newFixnum(_NOINTERN));
OCSP.setConstant("NOSIGS", runtime.newFixnum(_NOSIGS));
OCSP.setConstant("NOCHAIN", runtime.newFixnum(_NOCHAIN));
OCSP.setConstant("NOVERIFY", runtime.newFixnum(_NOVERIFY));
OCSP.setConstant("NOEXPLICIT", runtime.newFixnum(_NOEXPLICIT));
OCSP.setConstant("NOCASIGN", runtime.newFixnum(_NOCASIGN));
OCSP.setConstant("NODELEGATED", runtime.newFixnum(_NODELEGATED));
OCSP.setConstant("NOCHECKS", runtime.newFixnum(_NOCHECKS));
OCSP.setConstant("TRUSTOTHER", runtime.newFixnum(_TRUSTOTHER));
OCSP.setConstant("RESPID_KEY", runtime.newFixnum(_RESPID_KEY));
OCSP.setConstant("NOTIME", runtime.newFixnum(_NOTIME));
OCSP.setConstant("V_CERTSTATUS_GOOD", runtime.newFixnum(_V_CERTSTATUS_GOOD));
OCSP.setConstant("V_CERTSTATUS_REVOKED", runtime.newFixnum(_V_CERTSTATUS_REVOKED));
OCSP.setConstant("V_CERTSTATUS_UNKNOWN", runtime.newFixnum(_V_CERTSTATUS_UNKNOWN));
OCSP.setConstant("V_RESPID_NAME", runtime.newFixnum(_V_RESPID_NAME));
OCSP.setConstant("V_RESPID_KEY", runtime.newFixnum(_V_RESPID_KEY));
}
public static String getResponseStringForValue(IRubyObject fixnum) {
RubyFixnum rubyFixnum = (RubyFixnum) fixnum;
return responseMap.get((int)rubyFixnum.getLongValue());
}
static RaiseException newOCSPError(Ruby runtime, Exception ex) {
return Utils.newError(runtime, _OCSP(runtime).getClass("OCSPError"), ex);
}
static RubyModule _OCSP(final Ruby runtime) {
return (RubyModule) runtime.getModule("OpenSSL").getConstant("OCSP");
}
}
jruby-openssl-0.9.21/src/main/java/org/jruby/ext/openssl/OCSPBasicResponse.java 0000664 0000000 0000000 00000072340 13136616216 0027363 0 ustar 00root root 0000000 0000000 /*
* The contents of this file are subject to the Common Public License Version 1.0
* (the "License"); you may not use this file except in compliance with the License.
* You may obtain a copy of the License at http://www.eclipse.org/legal/cpl-v10.html
*
* THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
* IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
* FOR APARTICULAR PURPOSE AND NONINFRINGEMENT.
* IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM,
* DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,
* ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
* DEALINGS IN THE SOFTWARE.
*
* Copyright (C) 2017 Donovan Lampa
* Copyright (C) 2009-2017 The JRuby Team
*
* Alternatively, the contents of this file may be used under the terms of
* either of the GNU General Public License Version 2 or later (the "GPL"),
* or the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
* in which case the provisions of the GPL or the LGPL are applicable instead
* of those above. If you wish to allow use of your version of this file only
* under the terms of either the GPL or the LGPL, and not to allow others to
* use your version of this file under the terms of the EPL, indicate your
* decision by deleting the provisions above and replace them with the notice
* and other provisions required by the GPL or the LGPL. If you do not delete
* the provisions above, a recipient may use your version of this file under
* the terms of any one of the EPL, the GPL or the LGPL.
*
*
* JRuby-OpenSSL includes software by The Legion of the Bouncy Castle Inc.
* Please, visit (http://bouncycastle.org/license.html) for licensing details.
*/
package org.jruby.ext.openssl;
import org.bouncycastle.asn1.ASN1GeneralizedTime;
import org.bouncycastle.asn1.ASN1ObjectIdentifier;
import org.bouncycastle.asn1.DERNull;
import org.bouncycastle.asn1.ocsp.BasicOCSPResponse;
import org.bouncycastle.asn1.ocsp.CertID;
import org.bouncycastle.asn1.ocsp.CertStatus;
import org.bouncycastle.asn1.ocsp.OCSPObjectIdentifiers;
import org.bouncycastle.asn1.ocsp.ResponderID;
import org.bouncycastle.asn1.ocsp.RevokedInfo;
import org.bouncycastle.asn1.ocsp.SingleResponse;
import org.bouncycastle.asn1.x509.CRLReason;
import org.bouncycastle.asn1.x509.Extension;
import org.bouncycastle.asn1.x509.Extensions;
import org.bouncycastle.asn1.x509.SubjectPublicKeyInfo;
import org.bouncycastle.cert.X509CertificateHolder;
import org.bouncycastle.cert.ocsp.BasicOCSPResp;
import org.bouncycastle.cert.ocsp.BasicOCSPRespBuilder;
import org.bouncycastle.cert.ocsp.CertificateID;
import org.bouncycastle.cert.ocsp.RespID;
import org.bouncycastle.cert.ocsp.SingleResp;
import org.bouncycastle.operator.ContentSigner;
import org.bouncycastle.operator.ContentVerifierProvider;
import org.bouncycastle.operator.DigestCalculator;
import org.bouncycastle.operator.DigestCalculatorProvider;
import org.bouncycastle.operator.OperatorCreationException;
import org.bouncycastle.operator.jcajce.JcaContentSignerBuilder;
import org.bouncycastle.operator.jcajce.JcaContentVerifierProviderBuilder;
import org.bouncycastle.operator.jcajce.JcaDigestCalculatorProviderBuilder;
import org.jruby.Ruby;
import org.jruby.RubyArray;
import org.jruby.RubyBoolean;
import org.jruby.RubyClass;
import org.jruby.RubyFixnum;
import org.jruby.RubyInteger;
import org.jruby.RubyModule;
import org.jruby.RubyObject;
import org.jruby.RubyString;
import org.jruby.RubyTime;
import org.jruby.anno.JRubyMethod;
import org.jruby.exceptions.RaiseException;
import org.jruby.ext.openssl.impl.ASN1Registry;
import org.jruby.ext.openssl.x509store.X509AuxCertificate;
import org.jruby.ext.openssl.x509store.X509Utils;
import org.jruby.runtime.Arity;
import org.jruby.runtime.ObjectAllocator;
import org.jruby.runtime.ThreadContext;
import org.jruby.runtime.Visibility;
import org.jruby.runtime.builtin.IRubyObject;
import static org.jruby.ext.openssl.Digest._Digest;
import static org.jruby.ext.openssl.OCSP._OCSP;
import static org.jruby.ext.openssl.OCSP.newOCSPError;
import static org.jruby.ext.openssl.X509._X509;
import java.io.IOException;
import java.security.MessageDigest;
import java.security.PublicKey;
import java.security.cert.CertificateEncodingException;
import java.security.cert.CertificateParsingException;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.Date;
import java.util.Iterator;
import java.util.List;
/*
* An OpenSSL::OCSP::BasicResponse contains the status of a certificate
* check which is created from an OpenSSL::OCSP::Request.
* A BasicResponse is more detailed than a Response.
*
* @author lampad
*/
public class OCSPBasicResponse extends RubyObject {
private static final long serialVersionUID = 8755480816625884227L;
private static final String OCSP_NOCERTS = "NOCERTS";
private static final String OCSP_NOCHAIN = "NOCHAIN";
private static final String OCSP_NOCHECKS = "NOCHECKS";
private static final String OCSP_NOTIME = "NOTIME";
private static final String OCSP_NOSIGS = "NOSIGS";
private static final String OCSP_NOVERIFY = "NOVERIFY";
private static final String OCSP_NOINTERN = "NOINTERN";
private static final String OCSP_RESPID_KEY = "RESPID_KEY";
private static final String OCSP_TRUSTOTHER = "TRUSTOTHER";
private static ObjectAllocator BASICRESPONSE_ALLOCATOR = new ObjectAllocator() {
public IRubyObject allocate(Ruby runtime, RubyClass klass) {
return new OCSPBasicResponse(runtime, klass);
}
};
public static void createBasicResponse(final Ruby runtime, final RubyModule OCSP) {
RubyClass BasicResponse = OCSP.defineClassUnder("BasicResponse", runtime.getObject(), BASICRESPONSE_ALLOCATOR);
BasicResponse.defineAnnotatedMethods(OCSPBasicResponse.class);
}
private byte[] nonce;
private List singleResponses = new ArrayList();
private BasicOCSPResponse asn1BCBasicOCSPResp;
private List extensions = new ArrayList();
public OCSPBasicResponse(Ruby runtime, RubyClass metaClass) {
super(runtime, metaClass);
}
public OCSPBasicResponse(Ruby runtime) {
this(runtime, (RubyClass) _OCSP(runtime).getConstantAt("BasicResponse"));
}
@JRubyMethod(name = "initialize", visibility = Visibility.PRIVATE)
public IRubyObject initialize(final ThreadContext context, IRubyObject der) {
if (der == null || der.isNil()) return this;
asn1BCBasicOCSPResp = BasicOCSPResponse.getInstance(StringHelper.readPossibleDERInput(context, der).getBytes());
return this;
}
@JRubyMethod(name = "initialize", visibility = Visibility.PRIVATE)
public IRubyObject initialize(final ThreadContext context) {
return this;
}
@Override
@JRubyMethod(name = "initialize_copy", visibility = Visibility.PRIVATE)
public IRubyObject initialize_copy(IRubyObject obj) {
if ( this == obj ) return this;
checkFrozen();
this.asn1BCBasicOCSPResp = ((OCSPBasicResponse)obj).getASN1BCOCSPResp();
return this;
}
@JRubyMethod(name = "add_nonce", rest = true)
public OCSPBasicResponse add_nonce(IRubyObject[] args) {
Ruby runtime = getRuntime();
byte[] tmpNonce;
if ( Arity.checkArgumentCount(runtime, args, 0, 1) == 0 ) {
tmpNonce = generateNonce();
}
else {
RubyString input = (RubyString)args[0];
tmpNonce = input.getBytes();
}
extensions.add(new Extension(OCSPObjectIdentifiers.id_pkix_ocsp_nonce, false, tmpNonce));
nonce = tmpNonce;
return this;
}
@JRubyMethod(name = "add_status", rest = true)
public OCSPBasicResponse add_status(final ThreadContext context, IRubyObject[] args) {
Ruby runtime = context.getRuntime();
Arity.checkArgumentCount(runtime, args, 7, 7);
IRubyObject certificateId = args[0];
IRubyObject status = args[1];
IRubyObject reason = args[2];
IRubyObject revocation_time = args[3];
IRubyObject this_update = args[4];
IRubyObject next_update = args[5];
IRubyObject extensions = args[6];
CertStatus certStatus = null;
switch (RubyFixnum.fix2int((RubyFixnum)status)) {
case 0 :
certStatus = new CertStatus();
break;
case 1 :
ASN1GeneralizedTime revTime = rubyIntOrTimeToGenTime(revocation_time);
RevokedInfo revokedInfo = new RevokedInfo(revTime,
CRLReason.lookup(RubyFixnum.fix2int((RubyFixnum)reason)));
certStatus = new CertStatus(revokedInfo);
break;
case 2 :
certStatus = new CertStatus(2, DERNull.INSTANCE);
break;
default :
break;
}
ASN1GeneralizedTime thisUpdate = rubyIntOrTimeToGenTime(this_update);
ASN1GeneralizedTime nextUpdate = rubyIntOrTimeToGenTime(next_update);
Extensions singleExtensions = convertRubyExtensions(extensions);
CertID certID = ((OCSPCertificateId)certificateId).getCertID();
SingleResponse ocspSingleResp = new SingleResponse(certID, certStatus, thisUpdate, nextUpdate, singleExtensions);
OCSPSingleResponse rubySingleResp = new OCSPSingleResponse(runtime);
try {
rubySingleResp.initialize(context, RubyString.newString(runtime, ocspSingleResp.getEncoded()));
singleResponses.add(rubySingleResp);
}
catch (IOException e) {
throw newOCSPError(runtime, e);
}
return this;
}
@JRubyMethod(name = "copy_nonce")
public IRubyObject copy_nonce(final ThreadContext context, IRubyObject request) {
add_nonce(new IRubyObject[] {RubyString.newString(getRuntime(), ((OCSPRequest)request).getNonce())});
return RubyFixnum.one(context.getRuntime());
}
@JRubyMethod(name = "find_response")
public IRubyObject find_response(final ThreadContext context, IRubyObject certId) {
if (certId.isNil()) return context.nil;
OCSPCertificateId rubyCertId = (OCSPCertificateId)certId;
IRubyObject retResp = context.nil;
for (OCSPSingleResponse singleResp : singleResponses) {
CertID thisId = rubyCertId.getCertID();
CertID thatId = singleResp.getBCSingleResp().getCertID();
if (thisId.equals(thatId)) {
retResp = singleResp;
break;
}
}
return retResp;
}
@JRubyMethod(name = "responses")
public IRubyObject responses() {
return RubyArray.newArray(getRuntime(), singleResponses);
}
@JRubyMethod(name = "sign", rest = true)
public IRubyObject sign(final ThreadContext context, IRubyObject[] args) {
Ruby runtime = context.getRuntime();
int flag = 0;
IRubyObject additionalCerts = context.nil;
IRubyObject flags = context.nil;
IRubyObject digest = context.nil;
Digest digestInstance = new Digest(runtime, _Digest(runtime));
List addlCerts = new ArrayList();
switch (Arity.checkArgumentCount(runtime, args, 2, 5)) {
case 3 :
additionalCerts = args[2];
break;
case 4 :
additionalCerts = args[2];
flags = args[3];
break;
case 5 :
additionalCerts = args[2];
flags = args[3];
digest = args[4];
break;
default :
break;
}
if (digest.isNil()) digest = digestInstance.initialize(context, new IRubyObject[] { RubyString.newString(runtime, "SHA1") });
if (!flags.isNil()) flag = RubyFixnum.fix2int(flags);
if (additionalCerts.isNil()) flag |= RubyFixnum.fix2int((RubyFixnum)_OCSP(runtime).getConstant(OCSP_NOCERTS));
X509Cert signer = (X509Cert) args[0];
PKey signerKey = (PKey) args[1];
String keyAlg = signerKey.getAlgorithm();
String digAlg = ((Digest) digest).getShortAlgorithm();
JcaContentSignerBuilder signerBuilder = new JcaContentSignerBuilder(digAlg + "with" + keyAlg);
signerBuilder.setProvider("BC");
ContentSigner contentSigner = null;
try {
contentSigner = signerBuilder.build(signerKey.getPrivateKey());
}
catch (OperatorCreationException e) {
throw newOCSPError(runtime, e);
}
BasicOCSPRespBuilder respBuilder = null;
try {
if ((flag & RubyFixnum.fix2int((RubyFixnum)_OCSP(runtime).getConstant(OCSP_RESPID_KEY))) != 0) {
JcaDigestCalculatorProviderBuilder dcpb = new JcaDigestCalculatorProviderBuilder();
dcpb.setProvider("BC");
DigestCalculatorProvider dcp = dcpb.build();
DigestCalculator calculator = dcp.get(contentSigner.getAlgorithmIdentifier());
respBuilder = new BasicOCSPRespBuilder(SubjectPublicKeyInfo.getInstance(signerKey.getPublicKey().getEncoded()), calculator);
}
else {
respBuilder = new BasicOCSPRespBuilder(new RespID(signer.getSubject().getX500Name()));
}
}
catch (Exception e) {
throw newOCSPError(runtime, e);
}
X509CertificateHolder[] chain = null;
try {
if ((flag & RubyFixnum.fix2int((RubyFixnum)_OCSP(runtime).getConstant(OCSP_NOCERTS))) == 0) {
addlCerts.add(new X509CertificateHolder(signer.getAuxCert().getEncoded()));
if (!additionalCerts.isNil()) {
Iterator rubyAddlCerts = ((RubyArray)additionalCerts).iterator();
while (rubyAddlCerts.hasNext()) {
java.security.cert.Certificate cert = rubyAddlCerts.next();
addlCerts.add(new X509CertificateHolder(cert.getEncoded()));
}
}
chain = addlCerts.toArray(new X509CertificateHolder[addlCerts.size()]);
}
}
catch (Exception e) {
throw newOCSPError(runtime, e);
}
Date producedAt = null;
if ((flag & RubyFixnum.fix2int((RubyFixnum)_OCSP(runtime).getConstant(OCSP_NOTIME))) == 0) {
producedAt = new Date();
}
for (OCSPSingleResponse resp : singleResponses) {
SingleResp singleResp = new SingleResp(resp.getBCSingleResp());
respBuilder.addResponse(singleResp.getCertID(),
singleResp.getCertStatus(),
singleResp.getThisUpdate(),
singleResp.getNextUpdate(),
resp.getBCSingleResp().getSingleExtensions());
}
try {
Extension[] respExtAry = new Extension[extensions.size()];
Extensions respExtensions = new Extensions(extensions.toArray(respExtAry));
BasicOCSPResp bcBasicOCSPResp = respBuilder.setResponseExtensions(respExtensions).build(contentSigner, chain, producedAt);
asn1BCBasicOCSPResp = BasicOCSPResponse.getInstance(bcBasicOCSPResp.getEncoded());
}
catch (Exception e) {
throw newOCSPError(runtime, e);
}
return this;
}
@JRubyMethod(name = "verify", rest = true)
public IRubyObject verify(final ThreadContext context, IRubyObject[] args) {
Ruby runtime = context.runtime;
int flags = 0;
IRubyObject certificates = args[0];
IRubyObject store = args[1];
boolean ret = false;
if (Arity.checkArgumentCount(runtime, args, 2, 3) == 3) {
flags = RubyFixnum.fix2int(args[2]);
}
JcaContentVerifierProviderBuilder jcacvpb = new JcaContentVerifierProviderBuilder();
jcacvpb.setProvider("BC");
BasicOCSPResp basicOCSPResp = getBasicOCSPResp();
java.security.cert.Certificate signer = findSignerCert(context, asn1BCBasicOCSPResp, convertRubyCerts(certificates), flags);
if ( signer == null ) return RubyBoolean.newBoolean(runtime, false);
if ( (flags & RubyFixnum.fix2int((RubyFixnum)_OCSP(runtime).getConstant(OCSP_NOINTERN))) == 0 &&
(flags & RubyFixnum.fix2int((RubyFixnum)_OCSP(runtime).getConstant(OCSP_TRUSTOTHER))) != 0 ) {
flags |= RubyFixnum.fix2int((RubyFixnum)_OCSP(runtime).getConstant(OCSP_NOVERIFY));
}
if ( (flags & RubyFixnum.fix2int((RubyFixnum)_OCSP(runtime).getConstant(OCSP_NOSIGS))) == 0 ) {
PublicKey sPKey = signer.getPublicKey();
if ( sPKey == null ) return RubyBoolean.newBoolean(runtime, false);
try {
ContentVerifierProvider cvp = jcacvpb.build(sPKey);
ret = basicOCSPResp.isSignatureValid(cvp);
}
catch (Exception e) {
throw newOCSPError(runtime, e);
}
}
if ((flags & RubyFixnum.fix2int((RubyFixnum)_OCSP(runtime).getConstant(OCSP_NOVERIFY))) == 0) {
List untrustedCerts = null;
if ((flags & RubyFixnum.fix2int((RubyFixnum)_OCSP(runtime).getConstant(OCSP_NOCHAIN))) != 0) {
}
else if (basicOCSPResp.getCerts() != null && (certificates != null && !((RubyArray)certificates).isEmpty())) {
untrustedCerts = getCertsFromResp();
Iterator certIt = ((RubyArray)certificates).iterator();
while (certIt.hasNext()) {
try {
untrustedCerts.add(X509Cert.wrap(context, certIt.next().getEncoded()));
}
catch (CertificateEncodingException e) {
throw newOCSPError(runtime, e);
}
}
}
else {
untrustedCerts = getCertsFromResp();
}
RubyArray rUntrustedCerts = RubyArray.newEmptyArray(runtime);
if (untrustedCerts != null) {
X509Cert[] rubyCerts = new X509Cert[untrustedCerts.size()];
rUntrustedCerts = RubyArray.newArray(runtime, untrustedCerts.toArray(rubyCerts));
}
X509StoreContext ctx;
try {
ctx = X509StoreContext.newStoreContext(context, (X509Store)store, X509Cert.wrap(runtime, signer), rUntrustedCerts);
}
catch (CertificateEncodingException e) {
throw newOCSPError(runtime, e);
}
ctx.set_purpose(context, _X509(runtime).getConstant("PURPOSE_OCSP_HELPER"));
ret = ctx.verify(context).isTrue();
IRubyObject chain = ctx.chain(context);
if ((flags & RubyFixnum.fix2int((RubyFixnum)_OCSP(runtime).getConstant(OCSP_NOCHECKS))) > 0) {
ret = true;
}
try {
if (checkIssuer(getBasicOCSPResp(), chain)) return RubyBoolean.newBoolean(runtime, true);
}
catch (IOException e) {
throw newOCSPError(runtime, e);
}
if ((flags & RubyFixnum.fix2int((RubyFixnum)_OCSP(runtime).getConstant(OCSP_NOCHAIN))) != 0) {
return RubyBoolean.newBoolean(runtime, ret);
}
else {
X509Cert rootCA = (X509Cert)((RubyArray)chain).last();
PublicKey rootKey = rootCA.getAuxCert().getPublicKey();
try {
// check if self-signed and valid (trusts itself)
rootCA.getAuxCert().verify(rootKey);
ret = true;
}
catch (Exception e) {
ret = false;
}
}
}
return RubyBoolean.newBoolean(runtime, ret);
}
@JRubyMethod(name = "status")
public IRubyObject status(ThreadContext context) {
final Ruby runtime = context.runtime;
RubyArray ret = RubyArray.newArray(runtime, singleResponses.size());
for (OCSPSingleResponse resp : singleResponses) {
RubyArray respAry = RubyArray.newArray(runtime, 7);
respAry.append(resp.certid(context));
respAry.append(resp.cert_status());
respAry.append(resp.revocation_reason());
respAry.append(resp.revocation_time());
respAry.append(resp.this_update());
respAry.append(resp.next_update());
respAry.append(resp.extensions());
ret.add(respAry);
}
return ret;
}
@JRubyMethod(name = "to_der")
public IRubyObject to_der() {
Ruby runtime = getRuntime();
IRubyObject ret;
try {
ret = RubyString.newString(runtime, asn1BCBasicOCSPResp.getEncoded());
}
catch (IOException e) {
throw newOCSPError(runtime, e);
}
return ret;
}
private boolean checkIssuer(BasicOCSPResp basicOCSPResp, IRubyObject chain) throws IOException {
boolean ret = false;
if ( ((RubyArray)chain).size() <= 0 ) return false;
List singleResponses = Arrays.asList(basicOCSPResp.getResponses());
CertificateID certId = checkCertIds(singleResponses);
X509Cert signer = (X509Cert)((RubyArray)chain).first();
if (((RubyArray)chain).size() > 1) {
X509Cert signerCA = (X509Cert)((RubyArray)chain).entry(1);
if(matchIssuerId(signerCA, certId, singleResponses)) {
return checkDelegated(signerCA);
}
}
else {
ret = matchIssuerId(signer, certId, singleResponses);
}
return ret;
}
private boolean checkDelegated(X509Cert signerCA) {
try {
return (signerCA.getAuxCert().getExFlags() & X509Utils.EXFLAG_XKUSAGE) != 0 &&
(signerCA.getAuxCert().getExtendedKeyUsage().contains(ASN1Registry.OBJ_OCSP_sign));
}
catch (CertificateParsingException e) {
throw newOCSPError(getRuntime(), e);
}
}
private boolean matchIssuerId(X509Cert signerCA, CertificateID certId, List singleResponses) throws IOException {
Ruby runtime = getRuntime();
if (certId == null) {
//gotta check em all
for(SingleResp resp : singleResponses) {
CertificateID tempId = resp.getCertID();
if(!matchIssuerId(signerCA, tempId, null)) return false;
}
return true;
}
else {
// we have a matching cid
ASN1ObjectIdentifier alg = certId.getHashAlgOID();
String sym = ASN1.oid2Sym(runtime, alg);
MessageDigest md = Digest.getDigest(runtime, sym);
byte[] issuerNameDigest = md.digest(signerCA.getIssuer().getX500Name().getEncoded());
byte[] issuerKeyDigest = md.digest(signerCA.getAuxCert().getPublicKey().getEncoded());
if(!issuerNameDigest.equals(certId.getIssuerNameHash())) return false;
if(!issuerKeyDigest.equals(certId.getIssuerKeyHash())) return false;
return true;
}
}
private CertificateID checkCertIds(List singleResponses) {
ArrayList ary = new ArrayList(singleResponses);
CertificateID cid = ary.remove(0).getCertID();
for (SingleResp singleResp : ary) {
if (!cid.equals(singleResp.getCertID())) return null;
}
return cid;
}
public BasicOCSPResponse getASN1BCOCSPResp() {
return this.asn1BCBasicOCSPResp;
}
public byte[] getNonce() {
return this.nonce;
}
private byte[] generateNonce() {
// OSSL currently generates 16 byte nonce by default
return generateNonce(new byte[16]);
}
private byte[] generateNonce(byte[] bytes) {
OpenSSL.getSecureRandom(getRuntime()).nextBytes(bytes);
return bytes;
}
private ASN1GeneralizedTime rubyIntOrTimeToGenTime(IRubyObject intOrTime) {
if (intOrTime.isNil()) return null;
Date retTime = new Date();
if (intOrTime instanceof RubyInteger) {
retTime.setTime(retTime.getTime() + RubyFixnum.fix2int((RubyFixnum)intOrTime)*1000);
}
else if (intOrTime instanceof RubyTime) {
retTime = ((RubyTime)intOrTime).getJavaDate();
}
else {
throw Utils.newArgumentError(
getRuntime(), new IllegalArgumentException("Unknown Revocation Time class: " + intOrTime.getClass().getName())
);
}
return new ASN1GeneralizedTime(retTime);
}
private Extensions convertRubyExtensions(IRubyObject extensions) {
if (extensions.isNil()) return null;
List retExtensions = new ArrayList();
Iterator rubyExtensions = ((RubyArray)extensions).iterator();
while (rubyExtensions.hasNext()) {
X509Extension rubyExt = (X509Extension)rubyExtensions.next();
Extension ext = Extension.getInstance(((RubyString)rubyExt.to_der()).getBytes());
retExtensions.add(ext);
}
Extension[] exts = new Extension[retExtensions.size()];
retExtensions.toArray(exts);
return new Extensions(exts);
}
private List convertRubyCerts(IRubyObject certificates) {
Iterator it = ((RubyArray)certificates).iterator();
List ret = new ArrayList();
while (it.hasNext()) {
ret.add(it.next());
}
return ret;
}
private java.security.cert.Certificate findSignerCert(final ThreadContext context,
BasicOCSPResponse basicResp, List certificates, int flags) {
final Ruby runtime = context.runtime;
ResponderID respID = basicResp.getTbsResponseData().getResponderID();
java.security.cert.Certificate ret;
ret = findSignerByRespId(context, certificates, respID);
if (ret == null && (flags & RubyFixnum.fix2int((RubyFixnum)_OCSP(runtime).getConstant(OCSP_NOINTERN))) == 0) {
List javaCerts = new ArrayList();
for (X509CertificateHolder cert : getBasicOCSPResp().getCerts()) {
try {
javaCerts.add(X509Cert.wrap(context, cert.getEncoded()).getAuxCert());
}
catch (IOException e) {
throw newOCSPError(runtime, e);
}
}
ret = findSignerByRespId(context, javaCerts, respID);
}
return ret;
}
private java.security.cert.Certificate findSignerByRespId(final ThreadContext context, List certificates, ResponderID respID) {
if (respID.getName() != null) {
for (java.security.cert.Certificate cert : certificates) {
try {
X509Cert rubyCert = X509Cert.wrap(context, cert);
if (rubyCert.getSubject().getX500Name().equals(respID.getName())) return cert;
}
catch (CertificateEncodingException e) {
throw newOCSPError(context.runtime, e);
}
}
}
else {
// Ignore anything that's not SHA1 (weirdly) SHA_DIGEST_LENGTH == 20
if (respID.getKeyHash().length != 20) return null;
for (java.security.cert.Certificate cert : certificates) {
byte[] pubKeyDigest = Digest.digest(
context,
this,
RubyString.newString(context.runtime, "SHA1"),
RubyString.newString(context.runtime, cert.getPublicKey().getEncoded())
).getBytes();
if (respID.getKeyHash().equals(pubKeyDigest)) return cert;
}
}
return null;
}
private List getCertsFromResp() {
Ruby runtime = getRuntime();
ThreadContext context = runtime.getCurrentContext();
List retCerts = new ArrayList();
List respCerts = Arrays.asList(getBasicOCSPResp().getCerts());
for (X509CertificateHolder cert : respCerts) {
try {
retCerts.add(X509Cert.wrap(context, cert.getEncoded()));
}
catch (IOException e) {
throw newOCSPError(runtime, e);
}
}
return retCerts;
}
private BasicOCSPResp getBasicOCSPResp() {
return new BasicOCSPResp(asn1BCBasicOCSPResp);
}
}
jruby-openssl-0.9.21/src/main/java/org/jruby/ext/openssl/OCSPCertificateId.java 0000664 0000000 0000000 00000031542 13136616216 0027321 0 ustar 00root root 0000000 0000000 /*
* The contents of this file are subject to the Common Public License Version 1.0
* (the "License"); you may not use this file except in compliance with the License.
* You may obtain a copy of the License at http://www.eclipse.org/legal/cpl-v10.html
*
* THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
* IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
* FOR APARTICULAR PURPOSE AND NONINFRINGEMENT.
* IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM,
* DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,
* ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
* DEALINGS IN THE SOFTWARE.
*
* Copyright (C) 2017 Donovan Lampa
* Copyright (C) 2009-2017 The JRuby Team
*
* Alternatively, the contents of this file may be used under the terms of
* either of the GNU General Public License Version 2 or later (the "GPL"),
* or the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
* in which case the provisions of the GPL or the LGPL are applicable instead
* of those above. If you wish to allow use of your version of this file only
* under the terms of either the GPL or the LGPL, and not to allow others to
* use your version of this file under the terms of the EPL, indicate your
* decision by deleting the provisions above and replace them with the notice
* and other provisions required by the GPL or the LGPL. If you do not delete
* the provisions above, a recipient may use your version of this file under
* the terms of any one of the EPL, the GPL or the LGPL.
*
*
* JRuby-OpenSSL includes software by The Legion of the Bouncy Castle Inc.
* Please, visit (http://bouncycastle.org/license.html) for licensing details.
*/
package org.jruby.ext.openssl;
import java.io.IOException;
import java.math.BigInteger;
import org.bouncycastle.asn1.ASN1Encoding;
import org.bouncycastle.asn1.ASN1ObjectIdentifier;
import org.bouncycastle.asn1.ocsp.CertID;
import org.bouncycastle.asn1.x509.AlgorithmIdentifier;
import org.bouncycastle.cert.X509CertificateHolder;
import org.bouncycastle.cert.ocsp.CertificateID;
import org.bouncycastle.operator.DigestCalculator;
import org.bouncycastle.operator.OperatorCreationException;
import org.bouncycastle.operator.bc.BcDigestCalculatorProvider;
import org.jruby.Ruby;
import org.jruby.RubyBignum;
import org.jruby.RubyClass;
import org.jruby.RubyFixnum;
import org.jruby.RubyModule;
import org.jruby.RubyObject;
import org.jruby.RubyString;
import org.jruby.anno.JRubyMethod;
import org.jruby.exceptions.RaiseException;
import org.jruby.runtime.ObjectAllocator;
import org.jruby.runtime.ThreadContext;
import org.jruby.runtime.Visibility;
import org.jruby.runtime.builtin.IRubyObject;
import static org.jruby.ext.openssl.OCSP._OCSP;
import static org.jruby.ext.openssl.Digest._Digest;
import static org.jruby.ext.openssl.OCSP.newOCSPError;
/**
* An OpenSSL::OCSP::CertificateId identifies a certificate to the
* CA so that a status check can be performed.
*
* @author lampad
*/
public class OCSPCertificateId extends RubyObject {
private static final long serialVersionUID = 6324454052172773918L;
private static ObjectAllocator CERTIFICATEID_ALLOCATOR = new ObjectAllocator() {
public IRubyObject allocate(Ruby runtime, RubyClass klass) {
return new OCSPCertificateId(runtime, klass);
}
};
public static void createCertificateId(final Ruby runtime, final RubyModule _OCSP) {
RubyClass _certificateId = _OCSP.defineClassUnder("CertificateId", runtime.getObject(), CERTIFICATEID_ALLOCATOR);
_certificateId.defineAnnotatedMethods(OCSPCertificateId.class);
}
private CertID bcCertId;
private X509Cert originalIssuer;
public OCSPCertificateId(Ruby runtime, RubyClass metaClass) {
super(runtime, metaClass);
}
public OCSPCertificateId(Ruby runtime) {
this(runtime, (RubyClass) _OCSP(runtime).getConstantAt("CertificateId"));
}
@JRubyMethod(name = "initialize", visibility = Visibility.PRIVATE)
public IRubyObject initialize(final ThreadContext context, IRubyObject subject, IRubyObject issuer, IRubyObject digest) {
if (digest == null || digest.isNil()) {
return initialize(context, subject, issuer);
}
X509Cert subjectCert = (X509Cert) subject;
originalIssuer = (X509Cert) issuer;
BigInteger serial = subjectCert.getSerial();
return initializeImpl(context, serial, originalIssuer, digest);
}
@JRubyMethod(name = "initialize", visibility = Visibility.PRIVATE)
public IRubyObject initialize(final ThreadContext context, IRubyObject subject, IRubyObject issuer) {
Ruby runtime = context.getRuntime();
X509Cert subjectCert = (X509Cert) subject;
originalIssuer = (X509Cert) issuer;
BigInteger serial = subjectCert.getSerial();
Digest digestInstance = new Digest(runtime, _Digest(runtime));
IRubyObject digest = digestInstance.initialize(context, new IRubyObject[] { RubyString.newString(runtime, "SHA1") });
return initializeImpl(context, serial, originalIssuer, digest);
}
@JRubyMethod(name = "initialize", visibility = Visibility.PRIVATE)
public IRubyObject initialize(final ThreadContext context, IRubyObject der) {
Ruby runtime = context.getRuntime();
RubyString derStr = StringHelper.readPossibleDERInput(context, der);
try {
return initializeImpl(derStr.getBytes());
}
catch (IOException e) {
throw newOCSPError(runtime, e);
}
}
private IRubyObject initializeImpl(final ThreadContext context, BigInteger serial,
IRubyObject issuerCert, IRubyObject digest) {
Ruby runtime = context.getRuntime();
Digest rubyDigest = (Digest) digest;
ASN1ObjectIdentifier oid = ASN1.sym2Oid(runtime, rubyDigest.getName().toLowerCase());
AlgorithmIdentifier bcAlgId = new AlgorithmIdentifier(oid);
BcDigestCalculatorProvider calculatorProvider = new BcDigestCalculatorProvider();
DigestCalculator calc;
try {
calc = calculatorProvider.get(bcAlgId);
}
catch (OperatorCreationException e) {
throw newOCSPError(runtime, e);
}
X509Cert rubyCert = (X509Cert) issuerCert;
try {
this.bcCertId = new CertificateID(calc, new X509CertificateHolder(rubyCert.getAuxCert().getEncoded()), serial).toASN1Primitive();
}
catch (Exception e) {
throw newOCSPError(runtime, e);
}
return this;
}
private IRubyObject initializeImpl(byte[] derByteStream) throws IOException {
this.bcCertId = CertID.getInstance(derByteStream);
return this;
}
@JRubyMethod(name = "serial")
public IRubyObject serial() {
return RubyBignum.newBignum(getRuntime(), bcCertId.getSerialNumber().getValue());
}
@JRubyMethod(name = "issuer_name_hash")
public IRubyObject issuer_name_hash() {
Ruby runtime = getRuntime();
String oidSym = ASN1.oid2Sym(runtime, getBCCertificateID().getHashAlgOID());
RubyString digestName = RubyString.newString(runtime, oidSym);
// For whatever reason, the MRI Ruby tests appear to suggest that they compute the hexdigest hash
// of the issuer name over the original name instead of the hash computed in the created CertID.
// I'm not sure how it's supposed to work with a passed in DER string since presumably the hash
// is already computed and can't be reversed to get to the original name and thus we just compute
// a hash of a hash if we don't have the original issuer around.
if (originalIssuer == null) {
try {
return Digest.hexdigest(runtime.getCurrentContext(), this, digestName,
RubyString.newString(runtime, bcCertId.getIssuerNameHash().getEncoded("DER")));
}
catch (IOException e) {
throw newOCSPError(runtime, e);
}
}
else {
return Digest.hexdigest(runtime.getCurrentContext(), this, digestName,
originalIssuer.getSubject().to_der(runtime.getCurrentContext()));
}
}
// For whatever reason, the MRI Ruby tests appear to suggest that they compute the hexdigest hash
// of the issuer key over the original key instead of the hash computed in the created CertID.
// I'm not sure how it's supposed to work with a passed in DER string since presumably the hash
// is already computed and can't be reversed to get to the original key, so we just compute
// a hash of a hash if we don't have the original issuer around.
@JRubyMethod(name = "issuer_key_hash")
public IRubyObject issuer_key_hash() {
Ruby runtime = getRuntime();
String oidSym = ASN1.oid2Sym(runtime, getBCCertificateID().getHashAlgOID());
RubyString digestName = RubyString.newString(runtime, oidSym);
if (originalIssuer == null) {
try {
return Digest.hexdigest(runtime.getCurrentContext(), this, RubyString.newString(runtime, oidSym),
RubyString.newString(runtime, bcCertId.getIssuerKeyHash().getEncoded("DER")));
}
catch (IOException e) {
throw newOCSPError(runtime, e);
}
}
else {
PKey key = (PKey)originalIssuer.public_key(runtime.getCurrentContext());
return Digest.hexdigest(runtime.getCurrentContext(), this, digestName, key.to_der());
}
}
@JRubyMethod(name = "hash_algorithm")
public IRubyObject hash_algorithm() {
Ruby runtime = getRuntime();
ASN1ObjectIdentifier oid = bcCertId.getHashAlgorithm().getAlgorithm();
Integer nid = ASN1.oid2nid(runtime, oid);
String ln = ASN1.nid2ln(runtime, nid);
return RubyString.newString(runtime, ln);
}
@JRubyMethod(name = "cmp")
public IRubyObject cmp(IRubyObject other) {
Ruby runtime = getRuntime();
RubyFixnum ret = (RubyFixnum) this.cmp_issuer(other);
if (!ret.eql(RubyFixnum.zero(runtime))) return ret;
OCSPCertificateId that = (OCSPCertificateId) other;
return RubyFixnum.newFixnum(
runtime,
this.getCertID().getSerialNumber().getValue().compareTo(
that.getCertID().getSerialNumber().getValue()
)
);
}
@JRubyMethod(name = "cmp_issuer")
public IRubyObject cmp_issuer(IRubyObject other) {
Ruby runtime = getRuntime();
if ( equals(other) ) {
return RubyFixnum.zero(runtime);
}
if (other instanceof OCSPCertificateId) {
OCSPCertificateId that = (OCSPCertificateId) other;
CertID thisCert = this.getCertID();
CertID thatCert = that.getCertID();
int ret = thisCert.getHashAlgorithm().getAlgorithm().toString().compareTo(
thatCert.getHashAlgorithm().getAlgorithm().toString());
if (ret != 0) return RubyFixnum.newFixnum(runtime, ret);
ret = thisCert.getIssuerNameHash().toString().compareTo(
thatCert.getIssuerNameHash().toString());
if (ret != 0) return RubyFixnum.newFixnum(runtime, ret);
return RubyFixnum.newFixnum(runtime,
thisCert.getIssuerKeyHash().toString().compareTo(
thatCert.getIssuerKeyHash().toString()));
}
else {
return runtime.getCurrentContext().nil;
}
}
@JRubyMethod(name = "to_der")
public IRubyObject to_der() {
Ruby runtime = getRuntime();
try {
return StringHelper.newString(runtime, bcCertId.getEncoded(ASN1Encoding.DER));
}
catch (IOException e) {
throw newOCSPError(runtime, e);
}
}
@Override
@JRubyMethod(visibility = Visibility.PRIVATE)
public IRubyObject initialize_copy(IRubyObject obj) {
if ( this == obj ) return this;
checkFrozen();
this.bcCertId = ((OCSPCertificateId)obj).getCertID();
return this;
}
@Override
public boolean equals(Object other) {
if ( this == other ) return true;
if ( other instanceof OCSPCertificateId ) {
OCSPCertificateId that = (OCSPCertificateId) other;
return this.getCertID().equals(that.getCertID());
}
else {
return false;
}
}
public CertID getCertID() {
return bcCertId;
}
public CertificateID getBCCertificateID() {
if (bcCertId == null) return null;
return new CertificateID(bcCertId);
}
}
jruby-openssl-0.9.21/src/main/java/org/jruby/ext/openssl/OCSPRequest.java 0000664 0000000 0000000 00000046113 13136616216 0026252 0 ustar 00root root 0000000 0000000 /*
* The contents of this file are subject to the Common Public License Version 1.0
* (the "License"); you may not use this file except in compliance with the License.
* You may obtain a copy of the License at http://www.eclipse.org/legal/cpl-v10.html
*
* THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
* IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
* FOR APARTICULAR PURPOSE AND NONINFRINGEMENT.
* IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM,
* DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,
* ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
* DEALINGS IN THE SOFTWARE.
*
* Copyright (C) 2017 Donovan Lampa
* Copyright (C) 2009-2017 The JRuby Team
*
* Alternatively, the contents of this file may be used under the terms of
* either of the GNU General Public License Version 2 or later (the "GPL"),
* or the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
* in which case the provisions of the GPL or the LGPL are applicable instead
* of those above. If you wish to allow use of your version of this file only
* under the terms of either the GPL or the LGPL, and not to allow others to
* use your version of this file under the terms of the EPL, indicate your
* decision by deleting the provisions above and replace them with the notice
* and other provisions required by the GPL or the LGPL. If you do not delete
* the provisions above, a recipient may use your version of this file under
* the terms of any one of the EPL, the GPL or the LGPL.
*
*
* JRuby-OpenSSL includes software by The Legion of the Bouncy Castle Inc.
* Please, visit (http://bouncycastle.org/license.html) for licensing details.
*/
package org.jruby.ext.openssl;
import static org.jruby.ext.openssl.Digest._Digest;
import static org.jruby.ext.openssl.OCSP._OCSP;
import static org.jruby.ext.openssl.OCSP.newOCSPError;
import static org.jruby.ext.openssl.OpenSSL.debugStackTrace;
import static org.jruby.ext.openssl.X509._X509;
import java.io.IOException;
import java.security.PublicKey;
import java.security.cert.CertificateException;
import java.security.cert.X509Certificate;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.Enumeration;
import java.util.Iterator;
import java.util.List;
import org.bouncycastle.asn1.ASN1Encodable;
import org.bouncycastle.asn1.ASN1Encoding;
import org.bouncycastle.asn1.ASN1ObjectIdentifier;
import org.bouncycastle.asn1.ASN1Sequence;
import org.bouncycastle.asn1.DERSequence;
import org.bouncycastle.asn1.ocsp.OCSPObjectIdentifiers;
import org.bouncycastle.asn1.ocsp.Signature;
import org.bouncycastle.asn1.ocsp.TBSRequest;
import org.bouncycastle.asn1.x500.X500Name;
import org.bouncycastle.asn1.x509.Certificate;
import org.bouncycastle.asn1.x509.Extension;
import org.bouncycastle.asn1.x509.Extensions;
import org.bouncycastle.asn1.x509.GeneralName;
import org.bouncycastle.cert.X509CertificateHolder;
import org.bouncycastle.cert.ocsp.CertificateID;
import org.bouncycastle.cert.ocsp.OCSPReq;
import org.bouncycastle.cert.ocsp.OCSPReqBuilder;
import org.bouncycastle.operator.ContentSigner;
import org.bouncycastle.operator.ContentVerifierProvider;
import org.bouncycastle.operator.OperatorCreationException;
import org.bouncycastle.operator.jcajce.JcaContentSignerBuilder;
import org.bouncycastle.operator.jcajce.JcaContentVerifierProviderBuilder;
import org.jruby.Ruby;
import org.jruby.RubyArray;
import org.jruby.RubyBoolean;
import org.jruby.RubyClass;
import org.jruby.RubyFixnum;
import org.jruby.RubyModule;
import org.jruby.RubyObject;
import org.jruby.RubyString;
import org.jruby.anno.JRubyMethod;
import org.jruby.exceptions.RaiseException;
import org.jruby.ext.openssl.x509store.X509AuxCertificate;
import org.jruby.runtime.Arity;
import org.jruby.runtime.ObjectAllocator;
import org.jruby.runtime.ThreadContext;
import org.jruby.runtime.Visibility;
import org.jruby.runtime.builtin.IRubyObject;
/*
* An OpenSSL::OCSP::Request contains the certificate information for determining
* if a certificate has been revoked or not. A Request can be created for a
* certificate or from a DER-encoded request created elsewhere.
*
* @author lampad
*/
public class OCSPRequest extends RubyObject {
private static final long serialVersionUID = -4020616730425816999L;
private static ObjectAllocator REQUEST_ALLOCATOR = new ObjectAllocator() {
public IRubyObject allocate(Ruby runtime, RubyClass klass) {
return new OCSPRequest(runtime, klass);
}
};
public OCSPRequest(Ruby runtime, RubyClass metaClass) {
super(runtime, metaClass);
}
public static void createRequest(final Ruby runtime, final RubyModule _OCSP) {
RubyClass _request = _OCSP.defineClassUnder("Request", runtime.getObject(), REQUEST_ALLOCATOR);
_request.defineAnnotatedMethods(OCSPRequest.class);
}
private final static String OCSP_NOCERTS = "NOCERTS";
private final static String OCSP_NOSIGS = "NOSIGS";
private final static String OCSP_NOINTERN = "NOINTERN";
private final static String OCSP_NOVERIFY = "NOVERIFY";
private final static String OCSP_TRUSTOTHER = "TRUSTOTHER";
private final static String OCSP_NOCHAIN = "NOCHAIN";
private org.bouncycastle.asn1.ocsp.OCSPRequest asn1bcReq;
private List certificateIds = new ArrayList();
private byte[] nonce;
@JRubyMethod(name = "initialize", rest = true, visibility = Visibility.PRIVATE)
public IRubyObject initialize(final ThreadContext context, IRubyObject[] args) {
Ruby runtime = context.getRuntime();
if ( Arity.checkArgumentCount(runtime, args, 0, 1) == 0 ) return this;
RubyString derString = StringHelper.readPossibleDERInput(context, args[0]);
asn1bcReq = org.bouncycastle.asn1.ocsp.OCSPRequest.getInstance(derString.getBytes());
return this;
}
@JRubyMethod(name = "add_certid")
public IRubyObject add_certid(IRubyObject certId) {
Ruby runtime = getRuntime();
OCSPCertificateId rubyCertId = (OCSPCertificateId) certId;
certificateIds.add(rubyCertId);
OCSPReqBuilder builder = new OCSPReqBuilder();
for (OCSPCertificateId certificateId : certificateIds) {
builder.addRequest(new CertificateID(certificateId.getCertID()));
}
try {
asn1bcReq = org.bouncycastle.asn1.ocsp.OCSPRequest.getInstance(builder.build().getEncoded());
}
catch (Exception e) {
throw newOCSPError(runtime, e);
}
if (nonce != null) {
addNonceImpl();
}
return this;
}
@JRubyMethod(name = "add_nonce", rest = true)
public IRubyObject add_nonce(IRubyObject[] args) {
Ruby runtime = getRuntime();
if ( Arity.checkArgumentCount(runtime, args, 0, 1) == 0 ) {
nonce = generateNonce();
}
else {
RubyString input = (RubyString)args[0];
nonce = input.getBytes();
}
addNonceImpl();
return this;
}
// BC doesn't have support for nonces... gotta do things manually
private void addNonceImpl() {
GeneralName requestorName = null;
ASN1Sequence requestList = new DERSequence();
Extensions extensions = null;
Signature sig = null;
List tmpExtensions = new ArrayList();
if (asn1bcReq != null) {
TBSRequest currentTbsReq = asn1bcReq.getTbsRequest();
extensions = currentTbsReq.getRequestExtensions();
sig = asn1bcReq.getOptionalSignature();
Enumeration oids = extensions.oids();
while (oids.hasMoreElements()) {
tmpExtensions.add(extensions.getExtension(oids.nextElement()));
}
}
tmpExtensions.add(new Extension(OCSPObjectIdentifiers.id_pkix_ocsp_nonce, false, nonce));
Extension[] exts = new Extension[tmpExtensions.size()];
Extensions newExtensions = new Extensions(tmpExtensions.toArray(exts));
TBSRequest newTbsReq = new TBSRequest(requestorName, requestList, newExtensions);
asn1bcReq = new org.bouncycastle.asn1.ocsp.OCSPRequest(newTbsReq, sig);
}
@JRubyMethod(name = "certid")
public IRubyObject certid() {
Ruby runtime = getRuntime();
return RubyArray.newArray(runtime, certificateIds);
}
@JRubyMethod(name = "check_nonce")
public IRubyObject check_nonce(ThreadContext context, IRubyObject response) {
final Ruby runtime = context.runtime;
if (response instanceof OCSPBasicResponse) {
OCSPBasicResponse rubyBasicRes = (OCSPBasicResponse) response;
return checkNonceImpl(runtime, this.nonce, rubyBasicRes.getNonce());
}
else if (response instanceof OCSPResponse) {
OCSPResponse rubyResp = (OCSPResponse) response;
return checkNonceImpl(runtime, this.nonce, ((OCSPBasicResponse)rubyResp.basic(context)).getNonce());
}
else {
return checkNonceImpl(runtime, this.nonce, null);
}
}
@JRubyMethod(name = "sign", rest = true)
public IRubyObject sign(final ThreadContext context, IRubyObject[] args) {
final Ruby runtime = context.runtime;
int flag = 0;
IRubyObject additionalCerts = context.nil;
IRubyObject flags = context.nil;
IRubyObject digest = context.nil;
Digest digestInstance = new Digest(runtime, _Digest(runtime));
IRubyObject nocerts = (RubyFixnum)_OCSP(runtime).getConstant(OCSP_NOCERTS);
switch (Arity.checkArgumentCount(runtime, args, 2, 5)) {
case 3 :
additionalCerts = args[2];
break;
case 4 :
additionalCerts = args[2];
flags = args[3];
break;
case 5 :
additionalCerts = args[2];
flags = args[3];
digest = args[4];
break;
default :
break;
}
if (digest.isNil()) digest = digestInstance.initialize(context, new IRubyObject[] { RubyString.newString(runtime, "SHA1") });
if (additionalCerts.isNil()) flag |= RubyFixnum.fix2int(nocerts);
if (!flags.isNil()) flag = RubyFixnum.fix2int(flags);
X509Cert signer = (X509Cert) args[0];
PKey signerKey = (PKey) args[1];
String keyAlg = signerKey.getAlgorithm();
String digAlg = ((Digest) digest).getShortAlgorithm();
JcaContentSignerBuilder signerBuilder = new JcaContentSignerBuilder(digAlg + "with" + keyAlg);
signerBuilder.setProvider("BC");
ContentSigner contentSigner = null;
try {
contentSigner = signerBuilder.build(signerKey.getPrivateKey());
}
catch (OperatorCreationException e) {
throw newOCSPError(runtime, e);
}
OCSPReqBuilder builder = new OCSPReqBuilder();
builder.setRequestorName(signer.getSubject().getX500Name());
for (OCSPCertificateId certId : certificateIds) {
builder.addRequest(new CertificateID(certId.getCertID()));
}
List certChain = new ArrayList();
if (flag != RubyFixnum.fix2int(nocerts)) {
try {
certChain.add(new X509CertificateHolder(signer.getAuxCert().getEncoded()));
if (!additionalCerts.isNil()) {
Iterator certIt = ((RubyArray)additionalCerts).iterator();
while (certIt.hasNext()) {
certChain.add(new X509CertificateHolder(certIt.next().getEncoded()));
}
}
}
catch (Exception e) {
throw newOCSPError(runtime, e);
}
}
X509CertificateHolder[] chain = new X509CertificateHolder[certChain.size()];
certChain.toArray(chain);
try {
asn1bcReq = org.bouncycastle.asn1.ocsp.OCSPRequest.getInstance(builder.build(contentSigner, chain).getEncoded());
}
catch (Exception e) {
throw newOCSPError(runtime, e);
}
if (nonce != null) {
addNonceImpl();
}
return this;
}
@JRubyMethod(name = "verify", rest = true)
public IRubyObject verify(IRubyObject[] args) {
Ruby runtime = getRuntime();
ThreadContext context = runtime.getCurrentContext();
int flags = 0;
boolean ret = false;
if (Arity.checkArgumentCount(runtime, args, 2, 3) == 3) {
flags = RubyFixnum.fix2int((RubyFixnum)args[2]);
}
IRubyObject certificates = args[0];
IRubyObject store = args[1];
OCSPReq bcOCSPReq = getBCOCSPReq();
if (bcOCSPReq == null) {
throw newOCSPError(runtime, new NullPointerException("Missing BC asn1bcReq. Missing certIDs or signature?"));
}
if (!bcOCSPReq.isSigned()) {
return RubyBoolean.newBoolean(runtime, ret);
}
GeneralName genName = bcOCSPReq.getRequestorName();
if (genName.getTagNo() != 4) {
return RubyBoolean.newBoolean(runtime, ret);
}
X500Name genX500Name = X500Name.getInstance(genName.getName());
X509StoreContext storeContext = null;
JcaContentVerifierProviderBuilder jcacvpb = new JcaContentVerifierProviderBuilder();
jcacvpb.setProvider("BC");
try {
java.security.cert.Certificate signer = findCertByName(genX500Name, certificates, flags);
if (signer == null) return RubyBoolean.newBoolean(runtime, ret);
if ((flags & RubyFixnum.fix2int(_OCSP(runtime).getConstant(OCSP_NOINTERN))) > 0 &&
((flags & RubyFixnum.fix2int(_OCSP(runtime).getConstant(OCSP_TRUSTOTHER))) > 0))
flags |= RubyFixnum.fix2int(_OCSP(runtime).getConstant(OCSP_NOVERIFY));
if ((flags & RubyFixnum.fix2int(_OCSP(runtime).getConstant(OCSP_NOSIGS))) == 0) {
PublicKey signerPubKey = signer.getPublicKey();
ContentVerifierProvider cvp = jcacvpb.build(signerPubKey);
ret = bcOCSPReq.isSignatureValid(cvp);
if (!ret) {
return RubyBoolean.newBoolean(runtime, ret);
}
}
if ((flags & RubyFixnum.fix2int(_OCSP(runtime).getConstant(OCSP_NOVERIFY))) == 0) {
if ((flags & RubyFixnum.fix2int(_OCSP(runtime).getConstant(OCSP_NOCHAIN))) > 0) {
storeContext = X509StoreContext.newStoreContext(context, (X509Store)store, X509Cert.wrap(runtime, signer), context.nil);
}
else {
RubyArray certs = RubyArray.newEmptyArray(runtime);
ASN1Sequence bcCerts = asn1bcReq.getOptionalSignature().getCerts();
if (bcCerts != null) {
Iterator it = bcCerts.iterator();
while (it.hasNext()) {
Certificate cert = Certificate.getInstance(it.next());
certs.add(X509Cert.wrap(runtime, new X509AuxCertificate(cert)));
}
}
storeContext = X509StoreContext.newStoreContext(context, (X509Store)store, X509Cert.wrap(runtime, signer), certs);
}
storeContext.set_purpose(context, _X509(runtime).getConstant("PURPOSE_OCSP_HELPER"));
storeContext.set_trust(context, _X509(runtime).getConstant("TRUST_OCSP_REQUEST"));
ret = storeContext.verify(context).isTrue();
if (!ret) return RubyBoolean.newBoolean(runtime, false);
}
}
catch (Exception e) {
debugStackTrace(e);
throw newOCSPError(runtime, e);
}
return RubyBoolean.newBoolean(getRuntime(), ret);
}
@JRubyMethod(name = "to_der")
public IRubyObject to_der() {
Ruby runtime = getRuntime();
try {
return RubyString.newString(runtime, this.asn1bcReq.getEncoded(ASN1Encoding.DER));
}
catch (IOException e) {
throw newOCSPError(runtime, e);
}
}
@Override
@JRubyMethod(visibility = Visibility.PRIVATE)
public IRubyObject initialize_copy(IRubyObject obj) {
if ( this == obj ) return this;
checkFrozen();
this.asn1bcReq = ((OCSPRequest)obj).getBCRequest();
return this;
}
private java.security.cert.Certificate findCertByName(ASN1Encodable genX500Name, IRubyObject certificates, int flags) throws CertificateException, IOException {
Ruby runtime = getRuntime();
if ((flags & RubyFixnum.fix2int(_OCSP(runtime).getConstant(OCSP_NOINTERN))) == 0) {
ASN1Sequence certs = asn1bcReq.getOptionalSignature().getCerts();
if (certs != null) {
Iterator it = certs.iterator();
while (it.hasNext()) {
Certificate cert = Certificate.getInstance(it.next());
if (genX500Name.equals(cert.getSubject())) return new X509AuxCertificate(cert);
}
}
}
@SuppressWarnings("unchecked")
List certList = (RubyArray)certificates;
for (X509Certificate cert : certList) {
if (genX500Name.equals(X500Name.getInstance(cert.getSubjectX500Principal().getEncoded()))) return new X509AuxCertificate(cert);
}
return null;
}
public byte[] getNonce() {
return this.nonce;
}
private IRubyObject checkNonceImpl(Ruby runtime, byte[] reqNonce, byte[] respNonce) {
if (reqNonce != null && respNonce != null) {
if (Arrays.equals(reqNonce, respNonce)) {
return RubyFixnum.one(runtime);
}
else {
return RubyFixnum.zero(runtime);
}
}
else if (reqNonce == null && respNonce == null) {
return RubyFixnum.two(runtime);
}
else if (reqNonce != null && respNonce == null) {
return RubyFixnum.newFixnum(runtime, -1);
}
else {
return RubyFixnum.three(runtime);
}
}
private byte[] generateNonce() {
// OSSL currently generates 16 byte nonce by default
return generateNonce(new byte[16]);
}
private byte[] generateNonce(byte[] bytes) {
OpenSSL.getSecureRandom(getRuntime()).nextBytes(bytes);
return bytes;
}
public org.bouncycastle.asn1.ocsp.OCSPRequest getBCRequest() {
return asn1bcReq;
}
public OCSPReq getBCOCSPReq() {
if (asn1bcReq == null) return null;
return new OCSPReq(asn1bcReq);
}
}
jruby-openssl-0.9.21/src/main/java/org/jruby/ext/openssl/OCSPResponse.java 0000664 0000000 0000000 00000016702 13136616216 0026421 0 ustar 00root root 0000000 0000000 /*
* The contents of this file are subject to the Common Public License Version 1.0
* (the "License"); you may not use this file except in compliance with the License.
* You may obtain a copy of the License at http://www.eclipse.org/legal/cpl-v10.html
*
* THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
* IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
* FOR APARTICULAR PURPOSE AND NONINFRINGEMENT.
* IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM,
* DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,
* ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
* DEALINGS IN THE SOFTWARE.
*
* Copyright (C) 2017 Donovan Lampa
* Copyright (C) 2009-2017 The JRuby Team
*
* Alternatively, the contents of this file may be used under the terms of
* either of the GNU General Public License Version 2 or later (the "GPL"),
* or the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
* in which case the provisions of the GPL or the LGPL are applicable instead
* of those above. If you wish to allow use of your version of this file only
* under the terms of either the GPL or the LGPL, and not to allow others to
* use your version of this file under the terms of the EPL, indicate your
* decision by deleting the provisions above and replace them with the notice
* and other provisions required by the GPL or the LGPL. If you do not delete
* the provisions above, a recipient may use your version of this file under
* the terms of any one of the EPL, the GPL or the LGPL.
*
*
* JRuby-OpenSSL includes software by The Legion of the Bouncy Castle Inc.
* Please, visit (http://bouncycastle.org/license.html) for licensing details.
*/
package org.jruby.ext.openssl;
import static org.jruby.ext.openssl.OCSP._OCSP;
import static org.jruby.ext.openssl.OCSP.newOCSPError;
import java.io.IOException;
import org.bouncycastle.asn1.ASN1TaggedObject;
import org.bouncycastle.cert.ocsp.BasicOCSPResp;
import org.bouncycastle.cert.ocsp.OCSPResp;
import org.bouncycastle.cert.ocsp.OCSPRespBuilder;
import org.jruby.Ruby;
import org.jruby.RubyClass;
import org.jruby.RubyFixnum;
import org.jruby.RubyModule;
import org.jruby.RubyObject;
import org.jruby.RubyString;
import org.jruby.anno.JRubyMethod;
import org.jruby.exceptions.RaiseException;
import org.jruby.runtime.Arity;
import org.jruby.runtime.ObjectAllocator;
import org.jruby.runtime.ThreadContext;
import org.jruby.runtime.Visibility;
import org.jruby.runtime.builtin.IRubyObject;
/*
* An OpenSSL::OCSP::Response contains the status of a certificate check which
* is created from an OpenSSL::OCSP::Request.
*
* @author lampad
*/
public class OCSPResponse extends RubyObject {
private static final long serialVersionUID = 5763247988029815198L;
private static ObjectAllocator RESPONSE_ALLOCATOR = new ObjectAllocator() {
public IRubyObject allocate(Ruby runtime, RubyClass klass) {
return new OCSPResponse(runtime, klass);
}
};
public OCSPResponse(Ruby runtime, RubyClass metaClass) {
super(runtime, metaClass);
}
public OCSPResponse(Ruby runtime) {
this(runtime, (RubyClass) _OCSP(runtime).getConstantAt("Response"));
}
public static void createResponse(final Ruby runtime, final RubyModule OCSP) {
RubyClass Response = OCSP.defineClassUnder("Response", runtime.getObject(), RESPONSE_ALLOCATOR);
Response.defineAnnotatedMethods(OCSPResponse.class);
}
private org.bouncycastle.asn1.ocsp.OCSPResponse bcResp;
@JRubyMethod(name = "initialize", rest = true, visibility = Visibility.PRIVATE)
public IRubyObject initialize(final ThreadContext context, IRubyObject args[]) {
Ruby runtime = context.getRuntime();
if ( Arity.checkArgumentCount(runtime, args, 0, 1) == 0 ) return this;
RubyString derString = (RubyString) args[0];
try {
bcResp = org.bouncycastle.asn1.ocsp.OCSPResponse.getInstance(ASN1TaggedObject.fromByteArray(derString.getBytes()));
}
catch (IOException e) {
throw newOCSPError(runtime, e);
}
return this;
}
@JRubyMethod(name = "create", meta = true)
public static IRubyObject create(final ThreadContext context, final IRubyObject self, IRubyObject status) {
Ruby runtime = context.runtime;
OCSPRespBuilder builder = new OCSPRespBuilder();
OCSPResp tmpResp;
OCSPResponse ret = new OCSPResponse(runtime);
try {
tmpResp = builder.build(RubyFixnum.fix2int((RubyFixnum)status), null);
ret.initialize(context, new IRubyObject[] { RubyString.newString(runtime, tmpResp.getEncoded())});
}
catch (Exception e) {
throw newOCSPError(runtime, e);
}
return ret;
}
@JRubyMethod(name = "create", meta = true)
public static IRubyObject create(final ThreadContext context, final IRubyObject self, IRubyObject status, IRubyObject basicResponse) {
Ruby runtime = context.runtime;
if (basicResponse == null || basicResponse.isNil()) {
return create(context, self, status);
}
else {
OCSPResponse ret = new OCSPResponse(runtime);
OCSPBasicResponse rubyBasicResp = (OCSPBasicResponse) basicResponse;
OCSPRespBuilder builder = new OCSPRespBuilder();
try {
OCSPResp tmpResp = builder.build(RubyFixnum.fix2int((RubyFixnum)status), new BasicOCSPResp(rubyBasicResp.getASN1BCOCSPResp()));
ret.initialize(context, new IRubyObject[] { RubyString.newString(runtime, tmpResp.getEncoded())});
}
catch (Exception e) {
throw newOCSPError(runtime, e);
}
return ret;
}
}
@Override
@JRubyMethod(name = "initialize_copy", visibility = Visibility.PRIVATE)
public IRubyObject initialize_copy(IRubyObject obj) {
if ( this == obj ) return this;
checkFrozen();
this.bcResp = ((OCSPResponse)obj).getBCResp();
return this;
}
@JRubyMethod(name = "basic")
public IRubyObject basic(ThreadContext context) {
Ruby runtime = context.runtime;
if (bcResp == null || bcResp.getResponseBytes() == null || bcResp.getResponseBytes().getResponse() == null) {
return context.nil;
}
else {
OCSPBasicResponse ret = new OCSPBasicResponse(runtime);
return ret.initialize(context, RubyString.newString(runtime, bcResp.getResponseBytes().getResponse().getOctets()));
}
}
@JRubyMethod(name = "status")
public IRubyObject status() {
return RubyFixnum.newFixnum(getRuntime(), bcResp.getResponseStatus().getValue().longValue());
}
@JRubyMethod(name = "status_string")
public IRubyObject status_string() {
String statusStr = OCSP.getResponseStringForValue(status());
return RubyString.newString(getRuntime(), statusStr);
}
@JRubyMethod(name = "to_der")
public IRubyObject to_der() {
Ruby runtime = getRuntime();
try {
return RubyString.newString(runtime, bcResp.getEncoded());
}
catch (IOException e) {
throw newOCSPError(runtime, e);
}
}
public org.bouncycastle.asn1.ocsp.OCSPResponse getBCResp() {
return bcResp;
}
}
jruby-openssl-0.9.21/src/main/java/org/jruby/ext/openssl/OCSPSingleResponse.java 0000664 0000000 0000000 00000026745 13136616216 0027573 0 ustar 00root root 0000000 0000000 /*
* The contents of this file are subject to the Common Public License Version 1.0
* (the "License"); you may not use this file except in compliance with the License.
* You may obtain a copy of the License at http://www.eclipse.org/legal/cpl-v10.html
*
* THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
* IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
* FOR APARTICULAR PURPOSE AND NONINFRINGEMENT.
* IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM,
* DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,
* ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
* DEALINGS IN THE SOFTWARE.
*
* Copyright (C) 2017 Donovan Lampa
* Copyright (C) 2009-2017 The JRuby Team
*
* Alternatively, the contents of this file may be used under the terms of
* either of the GNU General Public License Version 2 or later (the "GPL"),
* or the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
* in which case the provisions of the GPL or the LGPL are applicable instead
* of those above. If you wish to allow use of your version of this file only
* under the terms of either the GPL or the LGPL, and not to allow others to
* use your version of this file under the terms of the EPL, indicate your
* decision by deleting the provisions above and replace them with the notice
* and other provisions required by the GPL or the LGPL. If you do not delete
* the provisions above, a recipient may use your version of this file under
* the terms of any one of the EPL, the GPL or the LGPL.
*
*
* JRuby-OpenSSL includes software by The Legion of the Bouncy Castle Inc.
* Please, visit (http://bouncycastle.org/license.html) for licensing details.
*/
package org.jruby.ext.openssl;
import static org.jruby.ext.openssl.OCSP._OCSP;
import static org.jruby.ext.openssl.OCSP.newOCSPError;
import java.io.IOException;
import java.text.ParseException;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.Date;
import java.util.List;
import org.bouncycastle.asn1.ASN1Encodable;
import org.bouncycastle.asn1.ASN1GeneralizedTime;
import org.bouncycastle.asn1.ASN1ObjectIdentifier;
import org.bouncycastle.asn1.DERTaggedObject;
import org.bouncycastle.asn1.ocsp.CertID;
import org.bouncycastle.asn1.ocsp.RevokedInfo;
import org.bouncycastle.asn1.ocsp.SingleResponse;
import org.bouncycastle.asn1.x509.Extension;
import org.bouncycastle.asn1.x509.Extensions;
import org.jruby.Ruby;
import org.jruby.RubyArray;
import org.jruby.RubyBoolean;
import org.jruby.RubyClass;
import org.jruby.RubyFixnum;
import org.jruby.RubyModule;
import org.jruby.RubyObject;
import org.jruby.RubyString;
import org.jruby.RubyTime;
import org.jruby.anno.JRubyMethod;
import org.jruby.exceptions.RaiseException;
import org.jruby.runtime.Arity;
import org.jruby.runtime.ObjectAllocator;
import org.jruby.runtime.ThreadContext;
import org.jruby.runtime.Visibility;
import org.jruby.runtime.builtin.IRubyObject;
/*
* An OpenSSL::OCSP::SingleResponse represents an OCSP SingleResponse structure,
* which contains the basic information of the status of the certificate.
*
* @author lampad
*/
public class OCSPSingleResponse extends RubyObject {
private static final long serialVersionUID = 7947277768033100227L;
private static ObjectAllocator SINGLERESPONSE_ALLOCATOR = new ObjectAllocator() {
public IRubyObject allocate(Ruby runtime, RubyClass klass) {
return new OCSPSingleResponse(runtime, klass);
}
};
public static void createSingleResponse(final Ruby runtime, final RubyModule _OCSP) {
RubyClass _request = _OCSP.defineClassUnder("SingleResponse", runtime.getObject(), SINGLERESPONSE_ALLOCATOR);
_request.defineAnnotatedMethods(OCSPSingleResponse.class);
}
public OCSPSingleResponse(Ruby runtime, RubyClass metaClass) {
super(runtime, metaClass);
}
public OCSPSingleResponse(Ruby runtime) {
this(runtime, (RubyClass) _OCSP(runtime).getConstantAt("SingleResponse"));
}
private SingleResponse bcSingleResponse;
@JRubyMethod(name = "initialize", visibility = Visibility.PRIVATE)
public IRubyObject initialize(final ThreadContext context, IRubyObject derStr) {
Ruby runtime = context.getRuntime();
RubyString rubyDerStr = (RubyString) derStr;
try {
bcSingleResponse = SingleResponse.getInstance(DERTaggedObject.fromByteArray(rubyDerStr.getBytes()));
}
catch (IOException e) {
throw newOCSPError(runtime, e);
}
return this;
}
@JRubyMethod(name = "cert_status")
public IRubyObject cert_status() {
return RubyFixnum.newFixnum(getRuntime(), bcSingleResponse.getCertStatus().getTagNo());
}
@JRubyMethod(name = "certid")
public IRubyObject certid(ThreadContext context) {
Ruby runtime = context.runtime;
CertID bcCertId = bcSingleResponse.getCertID();
OCSPCertificateId rubyCertId = new OCSPCertificateId(runtime);
try {
rubyCertId.initialize(context, RubyString.newString(runtime, bcCertId.getEncoded()));
}
catch (IOException e) {
throw newOCSPError(runtime, e);
}
return rubyCertId;
}
@JRubyMethod(name = "check_validity", rest = true)
public IRubyObject check_validity(IRubyObject[] args) {
Ruby runtime = getRuntime();
int nsec, maxsec;
Date thisUpdate, nextUpdate;
if ( Arity.checkArgumentCount(runtime, args, 0, 2) == 0 ) {
nsec = 0;
maxsec = -1;
}
else if ( Arity.checkArgumentCount(runtime, args, 0, 2) == 1 ) {
RubyFixnum rNsec = (RubyFixnum) args[0];
nsec = (int)rNsec.getLongValue();
maxsec = -1;
}
else {
RubyFixnum rNsec = (RubyFixnum) args[0];
RubyFixnum rMaxsec = (RubyFixnum) args[1];
nsec = (int)rNsec.getLongValue();
maxsec = (int)rMaxsec.getLongValue();
}
try {
ASN1GeneralizedTime bcThisUpdate = bcSingleResponse.getThisUpdate();
if (bcThisUpdate == null) {
thisUpdate = null;
}
else {
thisUpdate = bcThisUpdate.getDate();
}
ASN1GeneralizedTime bcNextUpdate = bcSingleResponse.getNextUpdate();
if (bcNextUpdate == null) {
nextUpdate = null;
}
else {
nextUpdate = bcNextUpdate.getDate();
}
}
catch (ParseException e) {
throw newOCSPError(runtime, e);
}
return RubyBoolean.newBoolean(runtime, checkValidityImpl(thisUpdate, nextUpdate, nsec, maxsec));
}
@JRubyMethod(name = "extensions")
public IRubyObject extensions() {
Ruby runtime = getRuntime();
Extensions exts = bcSingleResponse.getSingleExtensions();
if (exts == null) return RubyArray.newEmptyArray(runtime);
ASN1ObjectIdentifier[] extOIDs = exts.getExtensionOIDs();
RubyArray retExts = runtime.newArray(extOIDs.length);
for (ASN1ObjectIdentifier extOID : extOIDs) {
Extension ext = exts.getExtension(extOID);
ASN1Encodable extAsn1 = ext.getParsedValue();
X509Extension retExt = X509Extension.newExtension(runtime, extOID, extAsn1, ext.isCritical());
retExts.append(retExt);
}
return retExts;
}
@JRubyMethod(name = "next_update")
public IRubyObject next_update() {
Ruby runtime = getRuntime();
if (bcSingleResponse.getNextUpdate() == null) return runtime.getNil();
Date nextUpdate;
try {
nextUpdate = bcSingleResponse.getNextUpdate().getDate();
}
catch (ParseException e) {
throw newOCSPError(runtime, e);
}
if (nextUpdate == null) {
return runtime.getNil();
}
return RubyTime.newTime(runtime, nextUpdate.getTime());
}
@JRubyMethod(name = "this_update")
public IRubyObject this_update() {
Ruby runtime = getRuntime();
if (bcSingleResponse.getThisUpdate() == null) return runtime.getNil();
Date thisUpdate;
try {
thisUpdate = bcSingleResponse.getThisUpdate().getDate();
}
catch (ParseException e) {
throw newOCSPError(runtime, e);
}
return RubyTime.newTime(runtime, thisUpdate.getTime());
}
@JRubyMethod(name = "revocation_reason")
public IRubyObject revocation_reason() {
Ruby runtime = getRuntime();
RubyFixnum revoked = (RubyFixnum) _OCSP(runtime).getConstant("V_CERTSTATUS_REVOKED");
if (bcSingleResponse.getCertStatus().getTagNo() == (int) revoked.getLongValue()) {
try {
RevokedInfo revokedInfo = RevokedInfo.getInstance(
DERTaggedObject.fromByteArray(bcSingleResponse.getCertStatus().getStatus().toASN1Primitive().getEncoded())
);
return RubyFixnum.newFixnum(runtime, revokedInfo.getRevocationReason().getValue().intValue());
}
catch (IOException e) {
throw newOCSPError(runtime, e);
}
}
return runtime.getNil();
}
@JRubyMethod(name = "revocation_time")
public IRubyObject revocation_time() {
Ruby runtime = getRuntime();
RubyFixnum revoked = (RubyFixnum) _OCSP(runtime).getConstant("V_CERTSTATUS_REVOKED");
if (bcSingleResponse.getCertStatus().getTagNo() == (int)revoked.getLongValue()) {
try {
RevokedInfo revokedInfo = RevokedInfo.getInstance(
DERTaggedObject.fromByteArray(bcSingleResponse.getCertStatus().getStatus().toASN1Primitive().getEncoded())
);
return RubyTime.newTime(runtime, revokedInfo.getRevocationTime().getDate().getTime());
}
catch (Exception e) {
throw newOCSPError(runtime, e);
}
}
return runtime.getNil();
}
@JRubyMethod(name = "to_der")
public IRubyObject to_der() {
Ruby runtime = getRuntime();
try {
return RubyString.newString(runtime, bcSingleResponse.getEncoded());
}
catch (IOException e) {
throw newOCSPError(runtime, e);
}
}
public SingleResponse getBCSingleResp() {
return bcSingleResponse;
}
// see OCSP_check_validity in ocsp_cl.c
private boolean checkValidityImpl(Date thisUpdate, Date nextUpdate, int nsec, int maxsec) {
boolean ret = true;
Date currentTime = new Date();
Date tempTime = new Date();
tempTime.setTime(currentTime.getTime() + (nsec*1000));
if (thisUpdate.compareTo(tempTime) > 0) {
ret = false;
}
if (maxsec >= 0) {
tempTime.setTime(currentTime.getTime() - (maxsec*1000));
if (thisUpdate.compareTo(tempTime) < 0) {
ret = false;
}
}
if (nextUpdate == null) {
return ret;
}
tempTime.setTime(currentTime.getTime() - (nsec*1000));
if (nextUpdate.compareTo(tempTime) < 0) {
ret = false;
}
if (nextUpdate.compareTo(thisUpdate) < 0) {
ret = false;
}
return ret;
}
}
jruby-openssl-0.9.21/src/main/java/org/jruby/ext/openssl/OSSLLibrary.java 0000664 0000000 0000000 00000000636 13136616216 0026242 0 ustar 00root root 0000000 0000000 package org.jruby.ext.openssl;
import org.jruby.Ruby;
import org.jruby.runtime.load.Library;
import java.io.IOException;
/**
* @deprecated
* @see OpenSSL
*/
public class OSSLLibrary implements Library {
public static void load(final Ruby runtime) {
OpenSSL.load(runtime);
}
@Override
public void load(Ruby runtime, boolean wrap) throws IOException {
load(runtime);
}
}
jruby-openssl-0.9.21/src/main/java/org/jruby/ext/openssl/ObjectSupport.java 0000664 0000000 0000000 00000006624 13136616216 0026743 0 ustar 00root root 0000000 0000000 /*
* The MIT License
*
* Copyright 2014 Karol Bucek.
*
* Permission is hereby granted, free of charge, to any person obtaining a copy
* of this software and associated documentation files (the "Software"), to deal
* in the Software without restriction, including without limitation the rights
* to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
* copies of the Software, and to permit persons to whom the Software is
* furnished to do so, subject to the following conditions:
*
* The above copyright notice and this permission notice shall be included in
* all copies or substantial portions of the Software.
*
* THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
* IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
* FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
* AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
* LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
* OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
* THE SOFTWARE.
*/
package org.jruby.ext.openssl;
import java.util.List;
import org.jruby.Ruby;
import org.jruby.RubyBasicObject;
import org.jruby.RubyString;
import org.jruby.runtime.ThreadContext;
import org.jruby.runtime.builtin.IRubyObject;
import org.jruby.runtime.builtin.Variable;
/**
* (Ruby) Object support.
*
* @author kares
*/
abstract class ObjectSupport {
@SuppressWarnings("unchecked")
static RubyString inspect(final RubyBasicObject self) {
return inspect(self, (List) self.getInstanceVariableList());
}
static RubyString inspect(final RubyBasicObject self, final List variableList) {
final Ruby runtime = self.getRuntime();
return RubyString.newString(runtime, inspect(runtime, self, variableList));
}
private static StringBuilder inspect(final Ruby runtime, final RubyBasicObject self,
final List variableList) {
final StringBuilder part = new StringBuilder();
String cname = self.getMetaClass().getRealClass().getName();
part.append("#<").append(cname).append(":0x");
part.append(Integer.toHexString(System.identityHashCode(self)));
if (runtime.isInspecting(self)) {
/* 6:tags 16:addr 1:eos */
part.append(" ...>");
return part;
}
try {
runtime.registerInspecting(self);
final ThreadContext context = runtime.getCurrentContext();
return inspectObj(context, variableList, part);
} finally {
runtime.unregisterInspecting(self);
}
}
private static StringBuilder inspectObj(final ThreadContext context,
final List variableList,
final StringBuilder part) {
String sep = "";
for ( final Variable ivar : variableList ) {
part.append(sep).append(' ').append( ivar.getName() ).append('=');
final Object ival = ivar.getValue();
if ( ival instanceof IRubyObject ) {
part.append( ((IRubyObject) ival).callMethod(context, "inspect") );
}
else { // allow the variable to come formatted (as is) already :
part.append( ival ); // ival == null ? "nil" : ival.toString()
}
sep = ",";
}
part.append('>');
return part;
}
}
jruby-openssl-0.9.21/src/main/java/org/jruby/ext/openssl/OpenSSL.java 0000664 0000000 0000000 00000032670 13136616216 0025423 0 ustar 00root root 0000000 0000000 /*
* The MIT License
*
* Copyright (c) 2014 Karol Bucek LTD.
*
* Permission is hereby granted, free of charge, to any person obtaining a copy
* of this software and associated documentation files (the "Software"), to deal
* in the Software without restriction, including without limitation the rights
* to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
* copies of the Software, and to permit persons to whom the Software is
* furnished to do so, subject to the following conditions:
*
* The above copyright notice and this permission notice shall be included in
* all copies or substantial portions of the Software.
*
* THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
* IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
* FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
* AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
* LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
* OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
* THE SOFTWARE.
*/
package org.jruby.ext.openssl;
import java.security.NoSuchProviderException;
import java.security.SecureRandom;
import java.util.Map;
import org.jruby.CompatVersion;
import org.jruby.Ruby;
import org.jruby.RubyArray;
import org.jruby.RubyClass;
import org.jruby.RubyModule;
import org.jruby.RubyString;
import org.jruby.anno.JRubyMethod;
import org.jruby.anno.JRubyModule;
import org.jruby.runtime.ThreadContext;
import org.jruby.runtime.Visibility;
import org.jruby.runtime.builtin.IRubyObject;
import org.jruby.util.ByteList;
import org.jruby.util.SafePropertyAccessor;
/**
* OpenSSL (methods as well as an entry point)
*
* @author kares
*/
@JRubyModule(name = "OpenSSL")
public final class OpenSSL {
public static void load(final Ruby runtime) {
createOpenSSL(runtime);
}
public static boolean isProviderAvailable() {
return SecurityHelper.isProviderAvailable("BC");
}
public static void createOpenSSL(final Ruby runtime) {
SecurityHelper.setRegisterProvider( SafePropertyAccessor.getBoolean("jruby.openssl.provider.register") );
final RubyModule _OpenSSL = runtime.getOrCreateModule("OpenSSL");
RubyClass _StandardError = runtime.getClass("StandardError");
_OpenSSL.defineClassUnder("OpenSSLError", _StandardError, _StandardError.getAllocator());
_OpenSSL.defineAnnotatedMethods(OpenSSL.class);
// set OpenSSL debug internal flag early on so it can print traces even while loading extension
setDebug(_OpenSSL, runtime.newBoolean( SafePropertyAccessor.getBoolean("jruby.openssl.debug") ) );
final String warn = SafePropertyAccessor.getProperty("jruby.openssl.warn");
if ( warn != null ) OpenSSL.warn = Boolean.parseBoolean(warn);
PKey.createPKey(runtime, _OpenSSL);
BN.createBN(runtime, _OpenSSL);
Digest.createDigest(runtime, _OpenSSL);
Cipher.createCipher(runtime, _OpenSSL);
Random.createRandom(runtime, _OpenSSL);
HMAC.createHMAC(runtime, _OpenSSL);
Config.createConfig(runtime, _OpenSSL);
ASN1.createASN1(runtime, _OpenSSL);
X509.createX509(runtime, _OpenSSL);
NetscapeSPKI.createNetscapeSPKI(runtime, _OpenSSL);
SSL.createSSL(runtime, _OpenSSL);
PKCS7.createPKCS7(runtime, _OpenSSL);
PKCS5.createPKCS5(runtime, _OpenSSL);
OCSP.createOCSP(runtime, _OpenSSL);
runtime.getLoadService().require("jopenssl/version");
// MRI 1.8.7 :
// OpenSSL::VERSION: "1.0.0"
// OpenSSL::OPENSSL_VERSION: "OpenSSL 1.0.1c 10 May 2012"
// OpenSSL::OPENSSL_VERSION_NUMBER: 268439615
// MRI 1.9.3 / 2.2.3 :
// OpenSSL::VERSION: "1.1.0"
// OpenSSL::OPENSSL_VERSION: "OpenSSL 1.0.1f 6 Jan 2014"
// OpenSSL::OPENSSL_VERSION_NUMBER: 268439663
// OpenSSL::OPENSSL_LIBRARY_VERSION: ""OpenSSL 1.0.2d 9 Jul 2015"
// OpenSSL::FIPS: false
final byte[] version = { '1','.','1','.','0' };
final boolean ruby18 = runtime.getInstanceConfig().getCompatVersion() == CompatVersion.RUBY1_8;
if ( ruby18 ) version[2] = '0'; // 1.0.0 compatible on 1.8
_OpenSSL.setConstant("VERSION", StringHelper.newString(runtime, version));
final RubyModule _Jopenssl = runtime.getModule("Jopenssl");
final RubyModule _Version = (RubyModule) _Jopenssl.getConstantAt("Version");
final RubyString jVERSION = _Version.getConstantAt("VERSION").asString();
final byte[] JRuby_OpenSSL_ = { 'J','R','u','b','y','-','O','p','e','n','S','S','L',' ' };
final int OPENSSL_VERSION_NUMBER = 999999999; // NOTE: smt more useful?
ByteList OPENSSL_VERSION = new ByteList( jVERSION.getByteList().length() + JRuby_OpenSSL_.length );
OPENSSL_VERSION.setEncoding( jVERSION.getEncoding() );
OPENSSL_VERSION.append( JRuby_OpenSSL_ );
OPENSSL_VERSION.append( jVERSION.getByteList() );
final RubyString VERSION;
_OpenSSL.setConstant("OPENSSL_VERSION", VERSION = runtime.newString(OPENSSL_VERSION));
_OpenSSL.setConstant("OPENSSL_VERSION_NUMBER", runtime.newFixnum(OPENSSL_VERSION_NUMBER));
if ( ! ruby18 ) {
// MRI 2.3 tests do: /\AOpenSSL +0\./ !~ OpenSSL::OPENSSL_LIBRARY_VERSION
_OpenSSL.setConstant("OPENSSL_LIBRARY_VERSION", VERSION);
_OpenSSL.setConstant("OPENSSL_FIPS", runtime.getFalse());
}
}
static RubyClass _OpenSSLError(final Ruby runtime) {
return runtime.getModule("OpenSSL").getClass("OpenSSLError");
}
// OpenSSL module methods :
@JRubyMethod(name = "errors", meta = true)
public static IRubyObject errors(IRubyObject self) {
final Ruby runtime = self.getRuntime();
RubyArray result = runtime.newArray();
for (Map.Entry e : X509.getErrors().entrySet()) {
result.add( runtime.newString( e.getValue() ) );
}
return result;
}
@JRubyMethod(name = "debug", meta = true)
public static IRubyObject getDebug(IRubyObject self) {
return (IRubyObject) getDebug((RubyModule) self);
}
private static Object getDebug(RubyModule self) {
return self.getInternalVariable("debug");
}
@JRubyMethod(name = "debug=", meta = true)
public static IRubyObject setDebug(IRubyObject self, IRubyObject debug) {
((RubyModule) self).setInternalVariable("debug", debug);
OpenSSL.debug = debug.isTrue();
return debug;
}
@JRubyMethod(name = "Digest", meta = true)
public static IRubyObject Digest(final IRubyObject self, final IRubyObject name) {
// OpenSSL::Digest("MD5") -> OpenSSL::Digest::MD5
final Ruby runtime = self.getRuntime();
final RubyClass Digest = runtime.getModule("OpenSSL").getClass("Digest");
return Digest.getConstantAt( name.asString().toString() );
}
// API "stubs" in JRuby-OpenSSL :
@JRubyMethod(meta = true)
public static IRubyObject deprecated_warning_flag(final IRubyObject self) {
return self.getRuntime().getNil(); // no-op in JRuby-OpenSSL
}
@JRubyMethod(meta = true, rest = true) // check_func(func, header)
public static IRubyObject check_func(final IRubyObject self, final IRubyObject[] args) {
return self.getRuntime().getNil(); // no-op in JRuby-OpenSSL
}
// Added in 2.0; not masked because it does nothing anyway (there's no reader in MRI)
@JRubyMethod(name = "fips_mode=", meta = true)
public static IRubyObject set_fips_mode(ThreadContext context, IRubyObject self, IRubyObject value) {
if ( value.isTrue() ) {
warn(context, "WARNING: FIPS mode not supported on JRuby-OpenSSL");
}
return value;
}
// internal (package-level) helpers :
/**
* PRIMARILY MEANT FOR TESTING ONLY, USAGE IS DISCOURAGED!
* @see org.jruby.ext.openssl.util.CryptoSecurity
*/
@JRubyMethod(name = "_disable_security_restrictions!", visibility = Visibility.PRIVATE, meta = true)
public static IRubyObject _disable_security_restrictions(ThreadContext context, IRubyObject self) {
Boolean unrestrict = org.jruby.ext.openssl.util.CryptoSecurity.unrestrictSecurity();
Boolean allPerm = org.jruby.ext.openssl.util.CryptoSecurity.setAllPermissionPolicy();
if ( unrestrict == null || allPerm == null ) return context.nil;
return context.runtime.newBoolean( unrestrict && allPerm );
}
private static boolean debug;
// on by default, warnings can be disabled using -Djruby.openssl.warn=false
private static boolean warn = true;
static boolean isDebug() { return debug; }
public static void debugStackTrace(final Throwable e) {
if ( isDebug() ) e.printStackTrace(System.out);
}
public static void debug(final String msg) {
if ( isDebug() ) System.out.println(msg);
}
public static void debug(final String msg, final Throwable e) {
if ( isDebug() ) System.out.println(msg + ' ' + e);
}
static boolean isDebug(final Ruby runtime) {
final RubyModule OpenSSL = runtime.getModule("OpenSSL");
if ( OpenSSL == null ) return debug; // debug early on
return getDebug( OpenSSL ) == runtime.getTrue();
}
static void debugStackTrace(final Ruby runtime, final Throwable e) {
if ( isDebug(runtime) ) e.printStackTrace(runtime.getOut());
}
public static void debug(final Ruby runtime, final CharSequence msg) {
if ( isDebug(runtime) ) runtime.getOut().println(msg.toString());
}
public static void debug(final Ruby runtime, final CharSequence msg, final Throwable e) {
if ( isDebug(runtime) ) runtime.getOut().println(msg.toString() + ' ' + e);
}
static void warn(final ThreadContext context, final CharSequence msg) {
warn(context, RubyString.newString(context.runtime, msg));
}
static void warn(final ThreadContext context, final RubyString msg) {
warn(context, (IRubyObject) msg);
}
static void warn(final ThreadContext context, final IRubyObject msg) {
if ( warn ) context.runtime.getModule("OpenSSL").callMethod(context, "warn", msg);
}
public static String javaVersion(final String def) {
final String javaVersionProperty =
SafePropertyAccessor.getProperty("java.version", def);
if ( javaVersionProperty == "0" ) return "1.7.0"; // Android
return javaVersionProperty;
}
static boolean javaVersion6(final boolean atLeast) {
final int gt = "1.6".compareTo( javaVersion("0.0").substring(0, 3) );
return atLeast ? gt <= 0 : gt == 0;
}
static boolean javaVersion7(final boolean atLeast) {
final int gt = "1.7".compareTo( javaVersion("0.0").substring(0, 3) );
return atLeast ? gt <= 0 : gt == 0;
}
static boolean javaVersion8(final boolean atLeast) {
final int gt = "1.8".compareTo( javaVersion("0.0").substring(0, 3) );
return atLeast ? gt <= 0 : gt == 0;
}
static boolean javaVersion9(final boolean atLeast) {
final int gt = "9".compareTo( javaVersion("0").substring(0, 1) );
return atLeast ? gt <= 0 : gt == 0;
}
private static String javaName(final String def) {
// Sun Java 6 or Oracle Java 7/8
// "Java HotSpot(TM) Server VM" or "Java HotSpot(TM) 64-Bit Server VM"
// OpenJDK :
// "OpenJDK 64-Bit Server VM"
return SafePropertyAccessor.getProperty("java.vm.name", def);
}
public static boolean javaHotSpot() {
return javaName("").contains("HotSpot(TM)");
}
public static boolean javaOpenJDK() {
return javaName("").contains("OpenJDK");
}
// shared secure-random :
private static boolean tryContextSecureRandom = true;
static SecureRandom getSecureRandom(final Ruby runtime) {
return getSecureRandom(runtime, false);
}
static SecureRandom getSecureRandom(final Ruby runtime, final boolean nullByDefault) {
if ( tryContextSecureRandom ) {
SecureRandom random = getSecureRandomFrom(runtime.getCurrentContext());
if ( random != null ) return random;
}
return nullByDefault ? null : new SecureRandom();
}
static SecureRandom getSecureRandomFrom(final ThreadContext context) {
if ( tryContextSecureRandom ) {
try {
SecureRandom random = context.secureRandom;
if (random == null) { // public SecureRandom getSecureRandom() on 9K
random = (SecureRandom) context.getClass().getMethod("getSecureRandom").invoke(context);
}
return random;
}
catch (Throwable ex) {
tryContextSecureRandom = false;
debug(context.runtime, "JRuby-OpenSSL failed to retrieve secure random from thread-context", ex);
}
}
return null;
}
// internals
static IRubyObject to_der_if_possible(final ThreadContext context, IRubyObject obj) {
if ( ! obj.respondsTo("to_der")) return obj;
return obj.callMethod(context, "to_der");
}
//
static String bcExceptionMessage(NoSuchProviderException ex) {
return "You need to configure JVM/classpath to enable BouncyCastle Security Provider: " + ex;
}
static String bcExceptionMessage(NoClassDefFoundError ex) {
return "You need to configure JVM/classpath to enable BouncyCastle Security Provider: " + ex;
}
}
jruby-openssl-0.9.21/src/main/java/org/jruby/ext/openssl/OpenSSLImpl.java 0000664 0000000 0000000 00000004355 13136616216 0026244 0 ustar 00root root 0000000 0000000 /***** BEGIN LICENSE BLOCK *****
* Version: EPL 1.0/GPL 2.0/LGPL 2.1
*
* The contents of this file are subject to the Eclipse Public
* License Version 1.0 (the "License"); you may not use this file
* except in compliance with the License. You may obtain a copy of
* the License at http://www.eclipse.org/legal/epl-v10.html
*
* Software distributed under the License is distributed on an "AS
* IS" basis, WITHOUT WARRANTY OF ANY KIND, either express or
* implied. See the License for the specific language governing
* rights and limitations under the License.
*
* Copyright (C) 2006 Ola Bini
*
* Alternatively, the contents of this file may be used under the terms of
* either of the GNU General Public License Version 2 or later (the "GPL"),
* or the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
* in which case the provisions of the GPL or the LGPL are applicable instead
* of those above. If you wish to allow use of your version of this file only
* under the terms of either the GPL or the LGPL, and not to allow others to
* use your version of this file under the terms of the EPL, indicate your
* decision by deleting the provisions above and replace them with the notice
* and other provisions required by the GPL or the LGPL. If you do not delete
* the provisions above, a recipient may use your version of this file under
* the terms of any one of the EPL, the GPL or the LGPL.
***** END LICENSE BLOCK *****/
package org.jruby.ext.openssl;
import org.jruby.runtime.builtin.IRubyObject;
/**
* @deprecated no longer used
* @see OpenSSL
* @author Ola Bini
*/
@Deprecated
public class OpenSSLImpl {
private OpenSSLImpl() { /* no instances */ }
@Deprecated
public static IRubyObject to_der_if_possible(IRubyObject obj) {
return OpenSSL.to_der_if_possible(obj.getRuntime().getCurrentContext(), obj);
}
@Deprecated // NOTE: seems to be no longer used !
public static PEMHandler getPEMHandler() {
try {
return new BouncyCastlePEMHandler();
}
catch (Exception e) {
if ( OpenSSL.isDebug() ) e.printStackTrace(System.out);
}
return new DefaultPEMHandler();
}
}// OpenSSLImpl
jruby-openssl-0.9.21/src/main/java/org/jruby/ext/openssl/OpenSSLReal.java 0000664 0000000 0000000 00000010143 13136616216 0026216 0 ustar 00root root 0000000 0000000 /***** BEGIN LICENSE BLOCK *****
* Version: EPL 1.0/GPL 2.0/LGPL 2.1
*
* The contents of this file are subject to the Eclipse Public
* License Version 1.0 (the "License"); you may not use this file
* except in compliance with the License. You may obtain a copy of
* the License at http://www.eclipse.org/legal/epl-v10.html
*
* Software distributed under the License is distributed on an "AS
* IS" basis, WITHOUT WARRANTY OF ANY KIND, either express or
* implied. See the License for the specific language governing
* rights and limitations under the License.
*
* Copyright (C) 2006 Ola Bini
*
* Alternatively, the contents of this file may be used under the terms of
* either of the GNU General Public License Version 2 or later (the "GPL"),
* or the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
* in which case the provisions of the GPL or the LGPL are applicable instead
* of those above. If you wish to allow use of your version of this file only
* under the terms of either the GPL or the LGPL, and not to allow others to
* use your version of this file under the terms of the EPL, indicate your
* decision by deleting the provisions above and replace them with the notice
* and other provisions required by the GPL or the LGPL. If you do not delete
* the provisions above, a recipient may use your version of this file under
* the terms of any one of the EPL, the GPL or the LGPL.
***** END LICENSE BLOCK *****/
package org.jruby.ext.openssl;
import java.security.GeneralSecurityException;
import java.security.NoSuchProviderException;
import java.security.Provider;
/**
* @deprecated no longer used
* @see OpenSSL
* @author Ola Bini
*/
public class OpenSSLReal {
private OpenSSLReal() { /* no instances */ }
@Deprecated
public static interface Runnable {
public void run() throws GeneralSecurityException;
}
public static interface Callable {
public T call() throws GeneralSecurityException;
}
/**
* Run a block of code with 'BC' provider installed.
*
* @deprecated No longer used within the JRuby-OpenSSL code-base, please avoid!
*
* @param block
* @throws GeneralSecurityException
*/
@Deprecated
public static void doWithBCProvider(final Runnable block) throws GeneralSecurityException {
getWithBCProvider(new Callable() {
public Void call() throws GeneralSecurityException {
block.run(); return null;
}
});
}
/**
* Adds BouncyCastleProvider if it's allowed (no security exceptions thrown)
* and runs the block of code. Once added the provider will stay registered
* within java.security.Security API. This might lead to memory
* leaks e.g. when the Ruby runtime that loaded BC is teared down.
*
* Removing the 'BC' provided (once the block run) can remove pre-installed
* or another runtime-added BC provider thus causing unknown runtime errors.
*
* @deprecated No longer used within the JRuby-OpenSSL code-base, please avoid!
*
* @param
* @param block
* @return
* @throws GeneralSecurityException
*/
@Deprecated
public static T getWithBCProvider(final Callable block) throws GeneralSecurityException {
try {
final Provider provider = SecurityHelper.getSecurityProvider(); // BC
if (provider != null && java.security.Security.getProvider(provider.getName()) == null) {
java.security.Security.addProvider(provider);
}
return block.call();
} catch (NoSuchProviderException nspe) {
throw new GeneralSecurityException(bcExceptionMessage(nspe), nspe);
} catch (Exception e) {
throw new GeneralSecurityException(e.getMessage(), e);
}
}
public static String bcExceptionMessage(NoSuchProviderException e) {
return OpenSSL.bcExceptionMessage(e);
}
public static String bcExceptionMessage(NoClassDefFoundError e) {
return OpenSSL.bcExceptionMessage(e);
}
} jruby-openssl-0.9.21/src/main/java/org/jruby/ext/openssl/PEMHandler.java 0000664 0000000 0000000 00000003646 13136616216 0026060 0 ustar 00root root 0000000 0000000 /***** BEGIN LICENSE BLOCK *****
* Version: EPL 1.0/GPL 2.0/LGPL 2.1
*
* The contents of this file are subject to the Eclipse Public
* License Version 1.0 (the "License"); you may not use this file
* except in compliance with the License. You may obtain a copy of
* the License at http://www.eclipse.org/legal/epl-v10.html
*
* Software distributed under the License is distributed on an "AS
* IS" basis, WITHOUT WARRANTY OF ANY KIND, either express or
* implied. See the License for the specific language governing
* rights and limitations under the License.
*
* Copyright (C) 2006 Ola Bini
*
* Alternatively, the contents of this file may be used under the terms of
* either of the GNU General Public License Version 2 or later (the "GPL"),
* or the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
* in which case the provisions of the GPL or the LGPL are applicable instead
* of those above. If you wish to allow use of your version of this file only
* under the terms of either the GPL or the LGPL, and not to allow others to
* use your version of this file under the terms of the EPL, indicate your
* decision by deleting the provisions above and replace them with the notice
* and other provisions required by the GPL or the LGPL. If you do not delete
* the provisions above, a recipient may use your version of this file under
* the terms of any one of the EPL, the GPL or the LGPL.
***** END LICENSE BLOCK *****/
package org.jruby.ext.openssl;
import java.io.Reader;
import java.io.Writer;
/**
* @deprecated
* @see PEMUtils
* @author Ola Bini
*/
@Deprecated // no longer used
public interface PEMHandler {
Object readPEM(Reader read, String password) throws Exception;
void writePEM(Writer writ, Object obj, String algorithm, char[] password) throws Exception;
void writePEM(Writer writ, Object obj) throws Exception;
}// PEMHandler
jruby-openssl-0.9.21/src/main/java/org/jruby/ext/openssl/PEMUtils.java 0000664 0000000 0000000 00000034645 13136616216 0025606 0 ustar 00root root 0000000 0000000 /*
* The MIT License
*
* Copyright 2014 Karol Bucek.
*
* Permission is hereby granted, free of charge, to any person obtaining a copy
* of this software and associated documentation files (the "Software"), to deal
* in the Software without restriction, including without limitation the rights
* to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
* copies of the Software, and to permit persons to whom the Software is
* furnished to do so, subject to the following conditions:
*
* The above copyright notice and this permission notice shall be included in
* all copies or substantial portions of the Software.
*
* THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
* IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
* FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
* AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
* LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
* OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
* THE SOFTWARE.
*/
package org.jruby.ext.openssl;
import java.io.ByteArrayInputStream;
import java.io.IOException;
import java.io.Reader;
import java.io.Writer;
import java.security.GeneralSecurityException;
import java.security.Key;
import java.security.KeyFactory;
import java.security.KeyPair;
import java.security.KeyStore;
import java.security.Provider;
import java.security.SecureRandom;
import java.security.cert.Certificate;
import java.security.spec.AlgorithmParameterSpec;
import java.security.spec.PKCS8EncodedKeySpec;
import java.security.spec.X509EncodedKeySpec;
import java.util.Collection;
import javax.crypto.SecretKey;
import javax.crypto.spec.IvParameterSpec;
import javax.crypto.spec.RC2ParameterSpec;
import javax.crypto.spec.SecretKeySpec;
import org.bouncycastle.crypto.PBEParametersGenerator;
import org.bouncycastle.crypto.generators.OpenSSLPBEParametersGenerator;
import org.bouncycastle.crypto.params.KeyParameter;
//import org.bouncycastle.openssl.MiscPEMGenerator;
import org.bouncycastle.openssl.PEMWriter;
import org.bouncycastle.operator.OperatorCreationException;
import org.jruby.ext.openssl.impl.pem.MiscPEMGenerator;
import org.jruby.ext.openssl.impl.pem.PEMDecryptor;
import org.jruby.ext.openssl.impl.pem.PEMDecryptorProvider;
import org.jruby.ext.openssl.impl.pem.PEMEncryptedKeyPair;
import org.jruby.ext.openssl.impl.pem.PEMException;
import org.jruby.ext.openssl.impl.pem.PEMKeyPair;
import org.jruby.ext.openssl.impl.pem.PEMParser;
import org.jruby.ext.openssl.util.ByteArrayOutputStream;
//import org.bouncycastle.util.io.pem.PemReader;
import static org.jruby.ext.openssl.x509store.PEMInputOutput.getKeyFactory;
/**
* PEM Utilities, for now mostly to replace {@link PEMHandler}.
*
* @author kares
*/
public abstract class PEMUtils {
/*
private static boolean bcPEMParser;
private static Class pemReaderImpl;
private static Reader newPemReader(final Reader reader) {
if ( pemReaderImpl == null ) {
synchronized(BouncyCastlePEMHandler.class) {
if ( pemReaderImpl == null ) {
try {
pemReaderImpl = Class.forName("org.bouncycastle.openssl.PEMParser");
bcPEMParser = true;
}
catch (ClassNotFoundException ex) {
pemReaderImpl = org.jruby.ext.openssl.impl.pem.PEMParser.class;
}
}
}
}
try {
Constructor constructor = (Constructor)
pemReaderImpl.getConstructor(new Class[] { Reader.class });
return constructor.newInstance(reader);
}
catch (NoSuchMethodException e) {
throw new IllegalStateException(e.getMessage(), e);
}
//catch (InstantiationException e) {
//}
catch (InvocationTargetException e) {
throw new IllegalStateException(e.getTargetException());
}
catch (Exception e) {
if ( e instanceof RuntimeException ) throw (RuntimeException) e;
throw new IllegalStateException(e);
}
}
private static Object doInvoke(Object obj, String methodName, Class[] paramTypes, Object... params)
throws IOException {
final Method method;
try {
method = obj.getClass().getDeclaredMethod(methodName, paramTypes);
method.setAccessible(true);
return method.invoke(obj, params);
}
catch (NoSuchMethodException e) {
throw new IllegalStateException(e.getMessage(), e);
}
catch (InvocationTargetException e) {
final Throwable target = e.getTargetException();
if ( target instanceof IOException ) throw (IOException) target;
if ( target instanceof RuntimeException ) throw (RuntimeException) target;
throw new IllegalStateException(target);
}
catch (Exception e) {
if ( e instanceof IOException ) throw (IOException) e;
if ( e instanceof RuntimeException ) throw (RuntimeException) e;
throw new IllegalStateException(e);
}
}
*/
public static KeyPair readKeyPair(final Reader reader) throws IOException {
return readKeyPair(reader, null);
}
public static KeyPair readKeyPair(final Reader reader, final char[] password) throws IOException {
PEMKeyPair pemKeyPair = readInternal(reader, password);
return toKeyPair(pemKeyPair);
}
static PEMKeyPair readInternal(final Reader reader, final char[] password) throws IOException {
Object keyPair = new PEMParser(reader).readObject();
if ( keyPair instanceof PEMEncryptedKeyPair ) {
return ((PEMEncryptedKeyPair) keyPair).decryptKeyPair(new PEMDecryptorImpl(password));
}
return (PEMKeyPair) keyPair;
}
private static KeyPair toKeyPair(final PEMKeyPair pemKeyPair) throws IOException {
try {
KeyFactory keyFactory = getKeyFactory( pemKeyPair.getPrivateKeyInfo().getPrivateKeyAlgorithm() );
return new KeyPair(
keyFactory.generatePublic( new X509EncodedKeySpec( pemKeyPair.getPublicKeyInfo().getEncoded() ) ),
keyFactory.generatePrivate( new PKCS8EncodedKeySpec( pemKeyPair.getPrivateKeyInfo().getEncoded() ) )
);
}
catch (Exception e) {
throw new PEMException("unable to convert key pair: " + e.getMessage(), e);
}
}
public static void writePEM(final Writer writer, final Object obj,
final String algorithm, final char[] password) throws IOException {
final PEMWriter pemWriter = new PEMWriter(writer);
final SecureRandom random = SecurityHelper.getSecureRandom();
pemWriter.writeObject(MiscPEMGenerator.newInstance(obj, algorithm, password, random));
pemWriter.flush();
}
public static void writePEM(final Writer writer, final Object obj) throws IOException {
writePEM(writer, obj, null, null);
}
public static byte[] generatePKCS12(final Reader keyReader, final byte[] cert,
final String aliasName, final char[] password)
throws IOException, GeneralSecurityException {
final Collection certChain =
SecurityHelper.getCertificateFactory("X.509").generateCertificates(new ByteArrayInputStream(cert));
final PEMKeyPair pemKeyPair = readInternal(keyReader, null);
final KeyFactory keyFactory = getKeyFactory( pemKeyPair.getPrivateKeyInfo().getPrivateKeyAlgorithm() );
Key privateKey = keyFactory.generatePrivate( new PKCS8EncodedKeySpec( pemKeyPair.getPrivateKeyInfo().getEncoded() ) );
final KeyStore keyStore = SecurityHelper.getKeyStore("PKCS12");
keyStore.load(null, null);
keyStore.setKeyEntry( aliasName, privateKey, null, certChain.toArray(new Certificate[certChain.size()]) );
final ByteArrayOutputStream pkcs12Out = new ByteArrayOutputStream();
keyStore.store(pkcs12Out, password == null ? new char[0] : password);
return pkcs12Out.toByteArray();
}
private static class PEMDecryptorImpl implements PEMDecryptorProvider, PEMDecryptor {
PEMDecryptorImpl(char[] password) { this.password = password; }
private char[] password;
private String dekAlgName;
public PEMDecryptor get(String dekAlgName) throws OperatorCreationException {
this.dekAlgName = dekAlgName;
return this; // PEMDecryptor
}
public byte[] decrypt(byte[] keyBytes, byte[] iv) throws PEMException {
return decrypt(keyBytes, password, dekAlgName, iv);
}
static byte[] decrypt(
byte[] bytes,
char[] password,
String dekAlgName,
byte[] iv)
throws PEMException
{
return decrypt(SecurityHelper.getSecurityProvider(), bytes, password, dekAlgName, iv);
}
static byte[] decrypt(
Provider provider,
byte[] bytes,
char[] password,
String dekAlgName,
byte[] iv)
throws PEMException
{
AlgorithmParameterSpec paramSpec = new IvParameterSpec(iv);
String alg;
String blockMode = "CBC";
String padding = "PKCS5Padding";
Key sKey;
// Figure out block mode and padding.
if (dekAlgName.endsWith("-CFB"))
{
blockMode = "CFB";
padding = "NoPadding";
}
if (dekAlgName.endsWith("-ECB") ||
"DES-EDE".equals(dekAlgName) ||
"DES-EDE3".equals(dekAlgName))
{
// ECB is actually the default (though seldom used) when OpenSSL
// uses DES-EDE (des2) or DES-EDE3 (des3).
blockMode = "ECB";
paramSpec = null;
}
if (dekAlgName.endsWith("-OFB"))
{
blockMode = "OFB";
padding = "NoPadding";
}
// Figure out algorithm and key size.
if (dekAlgName.startsWith("DES-EDE"))
{
alg = "DESede";
// "DES-EDE" is actually des2 in OpenSSL-speak!
// "DES-EDE3" is des3.
boolean des2 = !dekAlgName.startsWith("DES-EDE3");
sKey = secretKeySpec(password, alg, 24, iv, des2);
}
else if (dekAlgName.startsWith("DES-"))
{
alg = "DES";
sKey = secretKeySpec(password, alg, 8, iv);
}
else if (dekAlgName.startsWith("BF-"))
{
alg = "Blowfish";
sKey = secretKeySpec(password, alg, 16, iv);
}
else if (dekAlgName.startsWith("RC2-"))
{
alg = "RC2";
int keyBits = 128;
if (dekAlgName.startsWith("RC2-40-"))
{
keyBits = 40;
}
else if (dekAlgName.startsWith("RC2-64-"))
{
keyBits = 64;
}
sKey = secretKeySpec(password, alg, keyBits / 8, iv);
if (paramSpec == null) // ECB block mode
{
paramSpec = new RC2ParameterSpec(keyBits);
}
else
{
paramSpec = new RC2ParameterSpec(keyBits, iv);
}
}
else if (dekAlgName.startsWith("AES-"))
{
alg = "AES";
byte[] salt = iv;
if (salt.length > 8)
{
salt = new byte[8];
System.arraycopy(iv, 0, salt, 0, 8);
}
int keyBits;
if (dekAlgName.startsWith("AES-128-"))
{
keyBits = 128;
}
else if (dekAlgName.startsWith("AES-192-"))
{
keyBits = 192;
}
else if (dekAlgName.startsWith("AES-256-"))
{
keyBits = 256;
}
else
{
throw new PEMException("unknown AES encryption with private key");
}
sKey = secretKeySpec(password, "AES", keyBits / 8, salt);
}
else
{
throw new PEMException("unknown encryption with private key");
}
String transformation = alg + "/" + blockMode + "/" + padding;
try
{
javax.crypto.Cipher cipher = SecurityHelper.getCipher(transformation);
final int decryptMode = javax.crypto.Cipher.DECRYPT_MODE;
if (paramSpec == null) // ECB block mode
{
cipher.init(decryptMode, sKey);
}
else
{
cipher.init(decryptMode, sKey, paramSpec);
}
return cipher.doFinal(bytes);
}
catch (Exception e)
{
throw new PEMException("exception using cipher - please check password and data.", e);
}
}
private static SecretKey secretKeySpec(
char[] password,
String algorithm,
int keyLength,
byte[] salt)
{
return secretKeySpec(password, algorithm, keyLength, salt, false);
}
private static SecretKey secretKeySpec(
char[] password,
String algorithm,
int keyLength,
byte[] salt,
boolean des2)
{
OpenSSLPBEParametersGenerator pGen = new OpenSSLPBEParametersGenerator();
pGen.init(PBEParametersGenerator.PKCS5PasswordToBytes(password), salt);
KeyParameter keyParam;
keyParam = (KeyParameter)pGen.generateDerivedParameters(keyLength * 8);
byte[] key = keyParam.getKey();
if (des2 && key.length >= 24)
{
// For DES2, we must copy first 8 bytes into the last 8 bytes.
System.arraycopy(key, 0, key, 16, 8);
}
return new SecretKeySpec(key, algorithm);
}
}
}
jruby-openssl-0.9.21/src/main/java/org/jruby/ext/openssl/PKCS5.java 0000664 0000000 0000000 00000015675 13136616216 0024773 0 ustar 00root root 0000000 0000000 /*
* The MIT License
*
* Copyright 2014-2015 Karol Bucek.
*
* Permission is hereby granted, free of charge, to any person obtaining a copy
* of this software and associated documentation files (the "Software"), to deal
* in the Software without restriction, including without limitation the rights
* to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
* copies of the Software, and to permit persons to whom the Software is
* furnished to do so, subject to the following conditions:
*
* The above copyright notice and this permission notice shall be included in
* all copies or substantial portions of the Software.
*
* THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
* IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
* FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
* AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
* LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
* OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
* THE SOFTWARE.
*/
package org.jruby.ext.openssl;
import java.security.InvalidKeyException;
import java.security.NoSuchAlgorithmException;
import javax.crypto.Mac;
import org.bouncycastle.crypto.CipherParameters;
import org.bouncycastle.crypto.PBEParametersGenerator;
import org.bouncycastle.crypto.generators.PKCS5S2ParametersGenerator;
import org.bouncycastle.crypto.params.KeyParameter;
import org.jruby.Ruby;
import org.jruby.RubyModule;
import org.jruby.RubyString;
import org.jruby.anno.JRubyMethod;
import org.jruby.anno.JRubyModule;
import org.jruby.runtime.builtin.IRubyObject;
/**
* OpenSSL::PKCS5
*
* @author kares
*/
@JRubyModule(name = "OpenSSL::PKCS5")
public class PKCS5 {
public static void createPKCS5(final Ruby runtime, final RubyModule ossl) {
final RubyModule PKCS5 = ossl.defineModuleUnder("PKCS5");
PKCS5.defineAnnotatedMethods(PKCS5.class);
}
// def pbkdf2_hmac_sha1(pass, salt, iter, keylen)
@JRubyMethod(meta = true, required = 4)
public static IRubyObject pbkdf2_hmac_sha1(final IRubyObject self, final IRubyObject[] args) {
//final byte[] pass = args[0].asString().getBytes();
final char[] pass = args[0].asString().toString().toCharArray();
final byte[] salt = args[1].asString().getBytes();
final int iter = (int) args[2].convertToInteger().getLongValue();
final int keySize = (int) args[3].convertToInteger().getLongValue(); // e.g. 64
return generatePBEKey(self.getRuntime(), pass, salt, iter, keySize);
}
// def pbkdf2_hmac_sha1(pass, salt, iter, keylen, digest)
@JRubyMethod(meta = true, required = 5)
public static IRubyObject pbkdf2_hmac(final IRubyObject self, final IRubyObject[] args) {
final byte[] pass = args[0].asString().getBytes();
final byte[] salt = args[1].asString().getBytes();
final int iter = (int) args[2].convertToInteger().getLongValue();
final int keylen = (int) args[3].convertToInteger().getLongValue();
final String digestAlg;
final IRubyObject digest = args[4];
if ( digest instanceof Digest ) {
digestAlg = mapDigestName( ((Digest) digest).getRealName() );
}
else {
digestAlg = mapDigestName( digest.asString().toString() );
}
// NOTE: on our own since e.g. "PBKDF2WithHmacMD5" not supported by Java
final String macAlg = "Hmac" + digestAlg;
final Ruby runtime = self.getRuntime();
try {
final Mac mac = SecurityHelper.getMac( macAlg );
mac.init( new SimpleSecretKey(macAlg, pass) );
final byte[] key = deriveKey(mac, salt, iter, keylen);
return StringHelper.newString(runtime, key);
}
catch (NoSuchAlgorithmException ex) {
throw Utils.newRuntimeError(runtime, ex); // should no happen
}
catch (InvalidKeyException ex) {
throw Utils.newRuntimeError(runtime, ex); // TODO
}
}
private static String mapDigestName(final String name) {
final String mapped = name.toUpperCase();
if ( mapped.startsWith("SHA-") ) { // SHA-512
return "SHA" + mapped.substring(4); // SHA512
}
return mapped;
}
private static RubyString generatePBEKey(final Ruby runtime,
final char[] pass, final byte[] salt, final int iter, final int keySize) {
PBEParametersGenerator generator = new PKCS5S2ParametersGenerator();
generator.init(PBEParametersGenerator.PKCS5PasswordToBytes(pass), salt, iter);
CipherParameters params = generator.generateDerivedParameters(keySize * 8);
return StringHelper.newString(runtime, ((KeyParameter) params).getKey());
}
// http://stackoverflow.com/questions/9147463/java-pbkdf2-with-hmacsha256-as-the-prf
public static byte[] deriveKey( final Mac prf, byte[] salt, int iterationCount, int dkLen )
throws NoSuchAlgorithmException, InvalidKeyException {
// Note: hLen, dkLen, l, r, T, F, etc. are horrible names for
// variables and functions in this day and age, but they
// reflect the terse symbols used in RFC 2898 to describe
// the PBKDF2 algorithm, which improves validation of the
// code vs. the RFC.
//
// dklen is expressed in bytes. (16 for a 128-bit key)
int hLen = prf.getMacLength(); // 20 for SHA1
int l = Math.max( dkLen, hLen); // 1 for 128bit (16-byte) keys
int r = dkLen - (l-1)*hLen; // 16 for 128bit (16-byte) keys
byte T[] = new byte[l * hLen];
int ti_offset = 0;
for (int i = 1; i <= l; i++) {
F( T, ti_offset, prf, salt, iterationCount, i );
ti_offset += hLen;
}
if (r < hLen) {
// Incomplete last block
byte DK[] = new byte[dkLen];
System.arraycopy(T, 0, DK, 0, dkLen);
return DK;
}
return T;
}
private static void F( byte[] dest, int offset, Mac prf, byte[] S, int c, int blockIndex ) {
final int hLen = prf.getMacLength();
byte U_r[] = new byte[ hLen ];
// U0 = S || INT (i);
byte U_i[] = new byte[S.length + 4];
System.arraycopy( S, 0, U_i, 0, S.length );
doINT( U_i, S.length, blockIndex );
for( int i = 0; i < c; i++ ) {
U_i = prf.doFinal( U_i );
doXOR( U_r, U_i );
}
System.arraycopy( U_r, 0, dest, offset, hLen );
}
private static void doXOR( byte[] dest, byte[] src ) {
for( int i = 0; i < dest.length; i++ ) {
dest[i] ^= src[i];
}
}
private static void doINT( byte[] dest, int offset, int i ) {
dest[offset + 0] = (byte) (i / (256 * 256 * 256));
dest[offset + 1] = (byte) (i / (256 * 256));
dest[offset + 2] = (byte) (i / (256));
dest[offset + 3] = (byte) (i);
}
}
jruby-openssl-0.9.21/src/main/java/org/jruby/ext/openssl/PKCS7.java 0000664 0000000 0000000 00000070204 13136616216 0024762 0 ustar 00root root 0000000 0000000 /***** BEGIN LICENSE BLOCK *****
* Version: EPL 1.0/GPL 2.0/LGPL 2.1
*
* The contents of this file are subject to the Eclipse Public
* License Version 1.0 (the "License"); you may not use this file
* except in compliance with the License. You may obtain a copy of
* the License at http://www.eclipse.org/legal/epl-v10.html
*
* Software distributed under the License is distributed on an "AS
* IS" basis, WITHOUT WARRANTY OF ANY KIND, either express or
* implied. See the License for the specific language governing
* rights and limitations under the License.
*
* Copyright (C) 2006, 2007 Ola Bini
*
* Alternatively, the contents of this file may be used under the terms of
* either of the GNU General Public License Version 2 or later (the "GPL"),
* or the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
* in which case the provisions of the GPL or the LGPL are applicable instead
* of those above. If you wish to allow use of your version of this file only
* under the terms of either the GPL or the LGPL, and not to allow others to
* use your version of this file under the terms of the EPL, indicate your
* decision by deleting the provisions above and replace them with the notice
* and other provisions required by the GPL or the LGPL. If you do not delete
* the provisions above, a recipient may use your version of this file under
* the terms of any one of the EPL, the GPL or the LGPL.
***** END LICENSE BLOCK *****/
package org.jruby.ext.openssl;
import java.io.IOException;
import java.io.StringWriter;
import java.util.ArrayList;
import java.util.Collection;
import java.util.HashSet;
import java.util.List;
import java.security.GeneralSecurityException;
import java.security.PrivateKey;
import java.security.cert.CertificateEncodingException;
import org.bouncycastle.asn1.ASN1Encodable;
import org.jruby.Ruby;
import org.jruby.RubyArray;
import org.jruby.RubyBignum;
import org.jruby.RubyClass;
import org.jruby.RubyFile;
import org.jruby.RubyModule;
import org.jruby.RubyNumeric;
import org.jruby.RubyObject;
import org.jruby.RubyString;
import org.jruby.anno.JRubyClass;
import org.jruby.anno.JRubyMethod;
import org.jruby.exceptions.RaiseException;
import org.jruby.runtime.Arity;
import org.jruby.runtime.ObjectAllocator;
import org.jruby.runtime.ThreadContext;
import org.jruby.runtime.Visibility;
import org.jruby.runtime.builtin.IRubyObject;
import org.jruby.util.ByteList;
import org.jruby.ext.openssl.impl.ASN1Registry;
import org.jruby.ext.openssl.impl.BIO;
import org.jruby.ext.openssl.impl.CipherSpec;
import org.jruby.ext.openssl.impl.MemBIO;
import org.jruby.ext.openssl.impl.Mime;
import org.jruby.ext.openssl.impl.NotVerifiedPKCS7Exception;
import org.jruby.ext.openssl.impl.PKCS7Exception;
import org.jruby.ext.openssl.impl.RecipInfo;
import org.jruby.ext.openssl.impl.SMIME;
import org.jruby.ext.openssl.impl.SignerInfoWithPkey;
import org.jruby.ext.openssl.x509store.PEMInputOutput;
import org.jruby.ext.openssl.x509store.Store;
import org.jruby.ext.openssl.x509store.X509AuxCertificate;
import static org.jruby.ext.openssl.OpenSSL.*;
/**
* @author Ola Bini
*/
@JRubyClass(name = "OpenSSL::PKCS7")
public class PKCS7 extends RubyObject {
private static final long serialVersionUID = -3925104500966826973L;
private static ObjectAllocator PKCS7_ALLOCATOR = new ObjectAllocator() {
public IRubyObject allocate(Ruby runtime, RubyClass klass) {
return new PKCS7(runtime, klass);
}
};
public static void createPKCS7(final Ruby runtime, final RubyModule _OpenSSL) {
RubyClass _PKCS7 = _OpenSSL.defineClassUnder("PKCS7", runtime.getObject(), PKCS7_ALLOCATOR);
RubyClass _OpenSSLError = runtime.getModule("OpenSSL").getClass("OpenSSLError");
_PKCS7.defineClassUnder("PKCS7Error", _OpenSSLError, _OpenSSLError.getAllocator());
_PKCS7.addReadWriteAttribute(runtime.getCurrentContext(), "data");
_PKCS7.addReadWriteAttribute(runtime.getCurrentContext(), "error_string");
_PKCS7.defineAnnotatedMethods(PKCS7.class);
SignerInfo.createSignerInfo(runtime, _PKCS7);
RecipientInfo.createRecipientInfo(runtime, _PKCS7);
_PKCS7.setConstant("TEXT", runtime.newFixnum(1));
_PKCS7.setConstant("NOCERTS", runtime.newFixnum(2));
_PKCS7.setConstant("NOSIGS", runtime.newFixnum(4));
_PKCS7.setConstant("NOCHAIN", runtime.newFixnum(8));
_PKCS7.setConstant("NOINTERN", runtime.newFixnum(16));
_PKCS7.setConstant("NOVERIFY", runtime.newFixnum(32));
_PKCS7.setConstant("DETACHED", runtime.newFixnum(64));
_PKCS7.setConstant("BINARY", runtime.newFixnum(128));
_PKCS7.setConstant("NOATTR", runtime.newFixnum(256));
_PKCS7.setConstant("NOSMIMECAP", runtime.newFixnum(512));
}
public static BIO obj2bio(IRubyObject obj) {
if ( obj instanceof RubyFile ) {
throw obj.getRuntime().newNotImplementedError("TODO: handle RubyFile correctly");
// if (TYPE(obj) == T_FILE) {
// OpenFile *fptr;
// GetOpenFile(obj, fptr);
// rb_io_check_readable(fptr);
// bio = BIO_new_fp(fptr->f, BIO_NOCLOSE);
}
else {
final ByteList str = obj.asString().getByteList();
return BIO.memBuf(str.getUnsafeBytes(), str.getBegin(), str.getRealSize());
}
}
@Deprecated // no loger used
public static PKCS7 wrap(RubyClass klass, org.jruby.ext.openssl.impl.PKCS7 p7) {
PKCS7 wrapped = new PKCS7(klass.getRuntime(), klass);
wrapped.p7 = p7;
return wrapped;
}
private static PKCS7 wrap(final Ruby runtime, org.jruby.ext.openssl.impl.PKCS7 p7) {
PKCS7 wrapped = new PKCS7(runtime, _PKCS7(runtime));
wrapped.p7 = p7;
return wrapped;
}
public static IRubyObject membio2str(Ruby runtime, BIO bio) {
return runtime.newString( new ByteList(((MemBIO) bio).getMemCopy(), false) );
}
private static List getAuxCerts(final IRubyObject arg) {
final RubyArray arr = (RubyArray) arg;
List certs = new ArrayList(arr.size());
for ( int i = 0; i auxCerts = certs.isNil() ? null : getAuxCerts(certs);
org.jruby.ext.openssl.impl.PKCS7 pkcs7Impl;
try {
pkcs7Impl = org.jruby.ext.openssl.impl.PKCS7.sign(auxCert, privKey, auxCerts, dataBIO, flg);
}
catch (PKCS7Exception e) {
throw newPKCS7Error(runtime, e);
}
final PKCS7 pkcs7 = wrap(runtime, pkcs7Impl);
pkcs7.setData(data);
return pkcs7;
}
/** ossl_pkcs7_s_encrypt
*
*/
@JRubyMethod(meta = true, rest = true)
public static IRubyObject encrypt(IRubyObject self, IRubyObject[] args) {
final Ruby runtime = self.getRuntime();
IRubyObject certs, data, cipher = runtime.getNil(), flags = runtime.getNil();
switch ( Arity.checkArgumentCount(self.getRuntime(), args, 2, 4) ) {
case 4: flags = args[3];
case 3: cipher = args[2];
}
data = args[1]; certs = args[0];
CipherSpec cipherSpec = null;
if ( cipher.isNil() ) {
try {
javax.crypto.Cipher c = SecurityHelper.getCipher("RC2/CBC/PKCS5Padding");
cipherSpec = new CipherSpec(c, Cipher.Algorithm.javaToOssl("RC2/CBC/PKCS5Padding", 40), 40);
}
catch (GeneralSecurityException e) { throw newPKCS7Error(runtime, e); }
}
else {
final Cipher c = (Cipher) cipher;
cipherSpec = new CipherSpec(c.getCipherInstance(), c.getName(), c.getGenerateKeyLength() * 8);
}
final int flg = flags.isNil() ? 0 : RubyNumeric.fix2int(flags);
final List auxCerts = getAuxCerts(certs);
final byte[] dataBytes = data.asString().getBytes();
org.jruby.ext.openssl.impl.PKCS7 pkcs7Impl;
try {
pkcs7Impl = org.jruby.ext.openssl.impl.PKCS7.encrypt(auxCerts, dataBytes, cipherSpec, flg);
}
catch (PKCS7Exception pkcs7e) {
throw newPKCS7Error(self.getRuntime(), pkcs7e);
}
final PKCS7 pkcs7 = wrap(runtime, pkcs7Impl);
pkcs7.setData(data);
return pkcs7;
}
public PKCS7(Ruby runtime, RubyClass type) {
super(runtime,type);
}
private org.jruby.ext.openssl.impl.PKCS7 p7;
@JRubyMethod(name="initialize", rest = true, visibility = Visibility.PRIVATE)
public IRubyObject initialize(final ThreadContext context, IRubyObject[] args) {
if ( Arity.checkArgumentCount(getRuntime(), args, 0, 1) == 0 ) {
p7 = new org.jruby.ext.openssl.impl.PKCS7();
try {
p7.setType(ASN1Registry.NID_undef);
}
catch (PKCS7Exception e) {
throw newPKCS7Error(getRuntime(), e);
}
return this;
}
IRubyObject arg = to_der_if_possible(context, args[0]);
BIO input = obj2bio(arg);
try {
p7 = org.jruby.ext.openssl.impl.PKCS7.readPEM(input);
if (p7 == null) {
input.reset();
p7 = org.jruby.ext.openssl.impl.PKCS7.fromASN1(input);
}
}
catch (IllegalArgumentException e) {
throw getRuntime().newArgumentError(e.getMessage());
}
catch (IOException ioe) {
throw newPKCS7Error(getRuntime(), ioe.getMessage());
}
catch (PKCS7Exception pkcs7e) {
throw newPKCS7Error(getRuntime(), pkcs7e);
}
setData( getRuntime().getNil() );
return this;
}
@Override
@JRubyMethod(visibility = Visibility.PRIVATE)
public IRubyObject initialize_copy(IRubyObject obj) {
warn(getRuntime().getCurrentContext(), "WARNING: unimplemented method called: PKCS7#initialize_copy");
return this;
}
@JRubyMethod(name="type=")
public IRubyObject set_type(IRubyObject type) {
final String typeStr = type.toString(); // likely a Symbol
int typeId = ASN1Registry.NID_undef;
if ("signed".equals(typeStr)) {
typeId = ASN1Registry.NID_pkcs7_signed;
} else if ("data".equals(typeStr)) {
typeId = ASN1Registry.NID_pkcs7_data;
} else if ("signedAndEnveloped".equals(typeStr)) {
typeId = ASN1Registry.NID_pkcs7_signedAndEnveloped;
} else if ("enveloped".equals(typeStr)) {
typeId = ASN1Registry.NID_pkcs7_enveloped;
} else if ("encrypted".equals(typeStr)) {
typeId = ASN1Registry.NID_pkcs7_encrypted;
}
try {
p7.setType(typeId);
}
catch (PKCS7Exception pkcs7e) {
throw newPKCS7Error(getRuntime(), pkcs7e);
}
return type;
}
@JRubyMethod(name="type")
public IRubyObject get_type() {
if(p7.isSigned()) {
return getRuntime().newSymbol("signed");
}
if(p7.isEncrypted()) {
return getRuntime().newSymbol("encrypted");
}
if(p7.isEnveloped()) {
return getRuntime().newSymbol("enveloped");
}
if(p7.isSignedAndEnveloped()) {
return getRuntime().newSymbol("signedAndEnveloped");
}
if(p7.isData()) {
return getRuntime().newSymbol("data");
}
return getRuntime().getNil();
}
@JRubyMethod(name = "detached")
public IRubyObject detached() {
warn(getRuntime().getCurrentContext(), "WARNING: unimplemented method called: PKCS7#detached");
return getRuntime().getNil();
}
@JRubyMethod(name = "detached=")
public IRubyObject set_detached(IRubyObject obj) {
warn(getRuntime().getCurrentContext(), "WARNING: unimplemented method called: PKCS7#detached=");
return getRuntime().getNil();
}
@JRubyMethod(name = "detached?")
public IRubyObject detached_p() {
warn(getRuntime().getCurrentContext(), "WARNING: unimplemented method called: PKCS7#detached?");
return getRuntime().getNil();
}
@JRubyMethod(name="cipher=")
public IRubyObject set_cipher(IRubyObject obj) {
warn(getRuntime().getCurrentContext(), "WARNING: unimplemented method called: PKCS7#cipher=");
return getRuntime().getNil();
}
@JRubyMethod
public IRubyObject add_signer(IRubyObject obj) {
SignerInfoWithPkey signedInfo = ((SignerInfo) obj).getSignerInfo().dup();
try {
p7.addSigner(signedInfo);
}
catch (PKCS7Exception e) {
throw newPKCS7Error(getRuntime(), e);
}
// TODO: Handle exception here
if ( p7.isSigned() ) {
ASN1Encodable objectId = org.jruby.ext.openssl.impl.PKCS7.OID_pkcs7_data;
signedInfo.addSignedAttribute(ASN1Registry.NID_pkcs9_contentType, objectId);
}
return this;
}
/** ossl_pkcs7_get_signer
*
* This seems to return a list of SignerInfo objects.
*
*/
@JRubyMethod
public IRubyObject signers() {
Collection signerInfos = p7.getSignerInfo();
RubyArray ary = getRuntime().newArray(signerInfos.size());
for ( SignerInfoWithPkey signerInfo : signerInfos ) {
ary.append( SignerInfo.create(getRuntime(), signerInfo) );
}
return ary;
}
@JRubyMethod
public IRubyObject add_recipient(IRubyObject obj) {
warn(getRuntime().getCurrentContext(), "WARNING: unimplemented method called: PKCS7#add_recipient");
return getRuntime().getNil();
}
@JRubyMethod
public IRubyObject recipients() {
Collection sk;
if(p7.isEnveloped()) {
sk = p7.getEnveloped().getRecipientInfo();
} else if(p7.isSignedAndEnveloped()) {
sk = p7.getSignedAndEnveloped().getRecipientInfo();
} else {
sk = null;
}
if(sk == null) {
return getRuntime().newArray();
}
RubyArray ary = getRuntime().newArray(sk.size());
for(RecipInfo ri : sk) {
ary.append(RecipientInfo.create(getRuntime(), ri));
}
return ary;
}
@JRubyMethod
public IRubyObject add_certificate(IRubyObject obj) {
try {
p7.addCertificate(((X509Cert)obj).getAuxCert());
} catch (PKCS7Exception pkcse) {
throw newPKCS7Error(getRuntime(), pkcse);
}
return this;
}
@JRubyMethod(name="certificates=")
public IRubyObject set_certificates(IRubyObject obj) {
warn(getRuntime().getCurrentContext(), "WARNING: unimplemented method called: PKCS7#certificates=");
return getRuntime().getNil();
}
private Collection getCertificates() {
Collection certs;
int i = p7.getType();
switch(i) {
case ASN1Registry.NID_pkcs7_signed:
certs = p7.getSign().getCert();
break;
case ASN1Registry.NID_pkcs7_signedAndEnveloped:
certs = p7.getSignedAndEnveloped().getCert();
break;
default:
certs = new HashSet();
break;
}
return certs;
}
private RubyArray certsToArray(Collection certs) throws CertificateEncodingException {
RubyArray ary = getRuntime().newArray(certs.size());
for(X509AuxCertificate x509 : certs) {
ary.append(X509Cert.wrap(getRuntime(), x509));
}
return ary;
}
@JRubyMethod
public IRubyObject certificates() {
try {
return certsToArray(getCertificates());
} catch (CertificateEncodingException cee) {
throw newPKCS7Error(getRuntime(), cee.getMessage());
}
}
@JRubyMethod
public IRubyObject add_crl(IRubyObject obj) {
warn(getRuntime().getCurrentContext(), "WARNING: unimplemented method called: PKCS7#add_crl");
return getRuntime().getNil();
}
@JRubyMethod(name="crls=")
public IRubyObject set_crls(IRubyObject obj) {
warn(getRuntime().getCurrentContext(), "WARNING: unimplemented method called: PKCS7#crls=");
return getRuntime().getNil();
}
@JRubyMethod
public IRubyObject crls() {
warn(getRuntime().getCurrentContext(), "WARNING: unimplemented method called: PKCS7#crls");
return getRuntime().getNil();
}
@JRubyMethod(name={"add_data", "data="})
public IRubyObject add_data(IRubyObject obj) {
if (p7.isSigned()) {
try {
p7.contentNew(ASN1Registry.NID_pkcs7_data);
} catch (PKCS7Exception pkcs7e) {
throw newPKCS7Error(getRuntime(), pkcs7e);
}
}
BIO in = obj2bio(obj);
BIO out = null;
try {
out = p7.dataInit(null);
} catch (PKCS7Exception pkcs7e) {
throw newPKCS7Error(getRuntime(), pkcs7e);
}
byte[] buf = new byte[4096];
for(;;) {
try {
int i = in.read(buf, 0, buf.length);
if(i <= 0) {
break;
}
if(out != null) {
out.write(buf, 0, i);
}
} catch(IOException e) {
throw getRuntime().newIOErrorFromException(e);
}
}
try {
p7.dataFinal(out);
} catch (PKCS7Exception pkcs7e) {
throw newPKCS7Error(getRuntime(), pkcs7e);
}
setData(getRuntime().getNil());
return obj;
}
@JRubyMethod(rest=true)
public IRubyObject verify(IRubyObject[] args) {
final Ruby runtime = getRuntime();
IRubyObject certs; X509Store store;
IRubyObject indata = runtime.getNil();
IRubyObject vflags = runtime.getNil();
switch ( Arity.checkArgumentCount(runtime, args, 2, 4) ) {
case 4: vflags = args[3];
case 3: indata = args[2];
default: store = (X509Store) args[1]; certs = args[0];
}
final int flg = vflags.isNil() ? 0 : RubyNumeric.fix2int(vflags);
if ( indata.isNil() ) indata = getData();
final BIO in = indata.isNil() ? null : obj2bio(indata);
List x509s = certs.isNil() ? null : getAuxCerts(certs);
final Store storeStr = store.getStore();
final BIO out = BIO.mem();
boolean result = false;
try {
p7.verify(x509s, storeStr, in, out, flg);
result = true;
}
catch (NotVerifiedPKCS7Exception e) {
// result = false;
}
catch (PKCS7Exception pkcs7e) {
if ( isDebug(runtime) ) {
// runtime.getOut().println(pkcs7e);
pkcs7e.printStackTrace(runtime.getOut());
}
// result = false;
}
IRubyObject data = membio2str(getRuntime(), out);
setData(data);
return result ? runtime.getTrue() : runtime.getFalse();
}
@JRubyMethod(rest=true)
public IRubyObject decrypt(IRubyObject[] args) {
IRubyObject dflags;
if ( Arity.checkArgumentCount(getRuntime(), args, 2, 3) == 3 ) {
dflags = args[2];
}
else {
dflags = getRuntime().getNil();
}
PKey pkey = (PKey) args[0];
X509Cert cert = (X509Cert) args[1];
final PrivateKey privKey = pkey.getPrivateKey();
final X509AuxCertificate auxCert = cert.getAuxCert();
final int flg = dflags.isNil() ? 0 : RubyNumeric.fix2int(dflags);
final BIO out = BIO.mem();
try {
p7.decrypt(privKey, auxCert, out, flg);
}
catch (PKCS7Exception pkcs7e) {
throw newPKCS7Error(getRuntime(), pkcs7e);
}
return membio2str(getRuntime(), out);
}
@JRubyMethod(name = {"to_pem", "to_s"})
public IRubyObject to_pem() {
StringWriter writer = new StringWriter();
try {
PEMInputOutput.writePKCS7(writer, p7.toASN1());
return getRuntime().newString( writer.toString() );
}
catch (IOException e) {
throw getRuntime().newIOErrorFromException(e);
}
}
@JRubyMethod
public IRubyObject to_der() {
try {
return getRuntime().newString(new ByteList(p7.toASN1(), false));
}
catch (IOException e) {
throw newPKCS7Error(getRuntime(), e.getMessage());
}
}
public void setData(IRubyObject object) {
setInstanceVariable("@data", object);
}
public IRubyObject getData() {
return getInstanceVariable("@data");
}
@JRubyClass(name = "OpenSSL::PKCS7::SignerInfo")
public static class SignerInfo extends RubyObject {
private static final long serialVersionUID = -3799397032272738848L;
private static ObjectAllocator SIGNERINFO_ALLOCATOR = new ObjectAllocator() {
public IRubyObject allocate(Ruby runtime, RubyClass klass) {
return new SignerInfo(runtime, klass);
}
};
public static void createSignerInfo(final Ruby runtime, final RubyModule _PKCS7) {
RubyClass _SignerInfo = _PKCS7.defineClassUnder("SignerInfo", runtime.getObject(), SIGNERINFO_ALLOCATOR);
_PKCS7.defineConstant("Signer",_SignerInfo);
_SignerInfo.defineAnnotatedMethods(SignerInfo.class);
}
private static RubyClass _SignerInfo(final Ruby runtime) {
return _PKCS7(runtime).getClass("SignerInfo");
}
public static SignerInfo create(Ruby runtime, SignerInfoWithPkey info) {
SignerInfo instance = new SignerInfo(runtime, _SignerInfo(runtime));
instance.info = info;
return instance;
}
public SignerInfo(Ruby runtime, RubyClass type) {
super(runtime,type);
}
private SignerInfoWithPkey info;
SignerInfoWithPkey getSignerInfo() {
return info;
}
@JRubyMethod(visibility = Visibility.PRIVATE)
public IRubyObject initialize(final ThreadContext context,
IRubyObject arg1, IRubyObject arg2, IRubyObject arg3) {
warn(context, "WARNING: unimplemented method called: signerInfo#initialize");
return this;
}
@JRubyMethod(name={"issuer","name"})
public IRubyObject issuer() {
return X509Name.newName(getRuntime(), info.getIssuerAndSerialNumber().getName());
}
@JRubyMethod
public IRubyObject serial() {
return RubyBignum.bignorm(getRuntime(), info.getIssuerAndSerialNumber().getCertificateSerialNumber().getValue());
}
@JRubyMethod
public IRubyObject signed_time(final ThreadContext context) {
warn(context, "WARNING: unimplemented method called: signerInfo#signed_time");
return context.runtime.getNil();
}
}
@JRubyClass(name = "OpenSSL::PKCS7::RecipientInfo")
public static class RecipientInfo extends RubyObject {
private static final long serialVersionUID = 6977793206950149902L;
private static ObjectAllocator RECIPIENTINFO_ALLOCATOR = new ObjectAllocator() {
public IRubyObject allocate(Ruby runtime, RubyClass klass) {
return new RecipientInfo(runtime, klass);
}
};
public static void createRecipientInfo(final Ruby runtime, final RubyModule _PKCS7) {
RubyClass _Recipient = _PKCS7.defineClassUnder("RecipientInfo", runtime.getObject(), RECIPIENTINFO_ALLOCATOR);
_Recipient.defineAnnotatedMethods(RecipientInfo.class);
}
private static RubyClass _RecipientInfo(final Ruby runtime) {
return _PKCS7(runtime).getClass("RecipientInfo");
}
public RecipientInfo(Ruby runtime, RubyClass type) {
super(runtime, type);
}
public static RecipientInfo create(Ruby runtime, RecipInfo info) {
RecipientInfo instance = new RecipientInfo(runtime, _RecipientInfo(runtime));
instance.info = info;
return instance;
}
private RecipInfo info;
@JRubyMethod(visibility = Visibility.PRIVATE)
public IRubyObject initialize(final ThreadContext context, IRubyObject arg) {
warn(context, "WARNING: unimplemented method called: recipientInfo#initialize");
return this;
}
@JRubyMethod
public IRubyObject issuer() {
return X509Name.newName(getRuntime(), info.getIssuerAndSerial().getName());
}
@JRubyMethod
public IRubyObject serial() {
return RubyBignum.bignorm(getRuntime(), info.getIssuerAndSerial().getCertificateSerialNumber().getValue());
}
@JRubyMethod
public IRubyObject enc_key(final ThreadContext context) {
warn(context, "WARNING: unimplemented method called: recipientInfo#enc_key");
return context.runtime.getNil();
}
}
private static RaiseException newPKCS7Error(Ruby runtime, Exception e) {
return Utils.newError(runtime, _PKCS7(runtime).getClass("PKCS7Error"), e);
}
private static RaiseException newPKCS7Error(Ruby runtime, String message) {
return Utils.newError(runtime, _PKCS7(runtime).getClass("PKCS7Error"), message);
}
static RubyClass _PKCS7(final Ruby runtime) {
return (RubyClass) runtime.getModule("OpenSSL").getConstant("PKCS7");
}
}// PKCS7
jruby-openssl-0.9.21/src/main/java/org/jruby/ext/openssl/PKey.java 0000664 0000000 0000000 00000042470 13136616216 0025007 0 ustar 00root root 0000000 0000000 /***** BEGIN LICENSE BLOCK *****
* Version: EPL 1.0/GPL 2.0/LGPL 2.1
*
* The contents of this file are subject to the Eclipse Public
* License Version 1.0 (the "License"); you may not use this file
* except in compliance with the License. You may obtain a copy of
* the License at http://www.eclipse.org/legal/epl-v10.html
*
* Software distributed under the License is distributed on an "AS
* IS" basis, WITHOUT WARRANTY OF ANY KIND, either express or
* implied. See the License for the specific language governing
* rights and limitations under the License.
*
* Copyright (C) 2006, 2007 Ola Bini
*
* Alternatively, the contents of this file may be used under the terms of
* either of the GNU General Public License Version 2 or later (the "GPL"),
* or the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
* in which case the provisions of the GPL or the LGPL are applicable instead
* of those above. If you wish to allow use of your version of this file only
* under the terms of either the GPL or the LGPL, and not to allow others to
* use your version of this file under the terms of the EPL, indicate your
* decision by deleting the provisions above and replace them with the notice
* and other provisions required by the GPL or the LGPL. If you do not delete
* the provisions above, a recipient may use your version of this file under
* the terms of any one of the EPL, the GPL or the LGPL.
***** END LICENSE BLOCK *****/
package org.jruby.ext.openssl;
import java.io.ByteArrayInputStream;
import java.io.IOException;
import java.io.InputStreamReader;
import java.io.StringReader;
import java.math.BigInteger;
import java.security.*;
import java.security.interfaces.DSAPrivateKey;
import java.security.interfaces.DSAPublicKey;
import java.security.interfaces.RSAPrivateCrtKey;
import java.security.interfaces.RSAPublicKey;
import java.security.spec.InvalidKeySpecException;
import java.security.spec.PKCS8EncodedKeySpec;
import java.security.spec.X509EncodedKeySpec;
import org.jruby.Ruby;
import org.jruby.RubyClass;
import org.jruby.RubyModule;
import org.jruby.RubyObject;
import org.jruby.RubyString;
import org.jruby.anno.JRubyMethod;
import org.jruby.exceptions.RaiseException;
import org.jruby.runtime.ObjectAllocator;
import org.jruby.runtime.ThreadContext;
import org.jruby.runtime.builtin.IRubyObject;
import org.jruby.runtime.Visibility;
import org.jruby.ext.openssl.x509store.PEMInputOutput;
import static org.jruby.ext.openssl.OpenSSL.*;
import org.jruby.ext.openssl.impl.CipherSpec;
import org.jruby.util.ByteList;
/**
* @author Ola Bini
*/
public abstract class PKey extends RubyObject {
private static final long serialVersionUID = 6114668087816965720L;
public static void createPKey(final Ruby runtime, final RubyModule OpenSSL) {
final RubyModule PKey = OpenSSL.defineModuleUnder("PKey");
PKey.defineAnnotatedMethods(PKeyModule.class);
// PKey is abstract
RubyClass PKeyPKey = PKey.defineClassUnder("PKey", runtime.getObject(), ObjectAllocator.NOT_ALLOCATABLE_ALLOCATOR);
RubyClass OpenSSLError = OpenSSL.getClass("OpenSSLError");
PKey.defineClassUnder("PKeyError", OpenSSLError, OpenSSLError.getAllocator());
PKeyPKey.defineAnnotatedMethods(PKey.class);
PKeyRSA.createPKeyRSA(runtime, PKey, PKeyPKey);
PKeyDSA.createPKeyDSA(runtime, PKey, PKeyPKey);
PKeyDH.createPKeyDH(runtime, PKey, PKeyPKey);
PKeyEC.createPKeyEC(runtime, PKey, PKeyPKey);
}
public static RaiseException newPKeyError(Ruby runtime, String message) {
return Utils.newError(runtime, _PKey(runtime).getClass("PKeyError"), message);
}
static RubyModule _PKey(final Ruby runtime) {
return (RubyModule) runtime.getModule("OpenSSL").getConstantAt("PKey");
}
public static class PKeyModule {
@JRubyMethod(name = "read", meta = true, required = 1, optional = 1)
public static IRubyObject read(final ThreadContext context, IRubyObject recv, IRubyObject[] args) {
final Ruby runtime = context.runtime;
final IRubyObject data; final char[] pass;
switch (args.length) {
case 1:
data = args[0];
pass = null;
break;
default:
data = args[0];
pass = args[1].isNil() ? null : args[1].toString().toCharArray();
}
final byte[] input = StringHelper.readX509PEM(context, data);
KeyPair key = null;
// d2i_PrivateKey_bio
try {
key =org.jruby.ext.openssl.impl.PKey.readPrivateKey(input);
} catch (IOException ioe) {
// ignore
} catch (GeneralSecurityException gse) {
// ignore
}
// PEM_read_bio_PrivateKey
if (key == null) {
try {
key = PEMInputOutput.readPrivateKey(new InputStreamReader(new ByteArrayInputStream(input)), pass);
} catch (IOException ioe) {
// ignore
}
}
if (key != null) {
final String alg = getAlgorithm(key);
if ( "RSA".equals(alg) ) {
return new PKeyRSA(runtime, _PKey(runtime).getClass("RSA"),
(RSAPrivateCrtKey) key.getPrivate(), (RSAPublicKey) key.getPublic()
);
}
if ( "DSA".equals(alg) ) {
return new PKeyDSA(runtime, _PKey(runtime).getClass("DSA"),
(DSAPrivateKey) key.getPrivate(), (DSAPublicKey) key.getPublic()
);
}
if ( "ECDSA".equals(alg) ) {
return new PKeyEC(runtime, _PKey(runtime).getClass("EC"),
(PrivateKey) key.getPrivate(), (PublicKey) key.getPublic()
);
}
}
PublicKey pubKey = null;
// d2i_PUBKEY_bio
try {
pubKey = org.jruby.ext.openssl.impl.PKey.readPublicKey(input);
} catch (IOException ioe) {
// ignore
} catch (GeneralSecurityException gse) {
// ignore
}
// PEM_read_bio_PUBKEY
if (pubKey == null) {
try {
pubKey = PEMInputOutput.readPubKey(new InputStreamReader(new ByteArrayInputStream(input)));
} catch (IOException ioe) {
// ignore
}
}
if (pubKey != null) {
if ( "RSA".equals(pubKey.getAlgorithm()) ) {
return new PKeyRSA(runtime, (RSAPublicKey) pubKey);
}
if ( "DSA".equals(pubKey.getAlgorithm()) ) {
return new PKeyDSA(runtime, (DSAPublicKey) pubKey);
}
if ( "ECDSA".equals(pubKey.getAlgorithm()) ) {
return new PKeyEC(runtime, pubKey);
}
}
throw runtime.newArgumentError("Could not parse PKey");
}
private static String getAlgorithm(final KeyPair key) {
if ( key.getPrivate() != null ) return key.getPrivate().getAlgorithm();
if ( key.getPublic() != null ) return key.getPublic().getAlgorithm();
return null;
}
}
public PKey(Ruby runtime, RubyClass type) {
super(runtime,type);
}
@Override
@JRubyMethod(visibility = Visibility.PRIVATE)
public IRubyObject initialize(ThreadContext context) {
return this;
}
public abstract PublicKey getPublicKey() ;
public abstract PrivateKey getPrivateKey() ;
public String getAlgorithm() { return "NONE"; }
public boolean isPrivateKey() { return getPrivateKey() != null; }
public abstract RubyString to_der() ;
public abstract RubyString to_pem(final IRubyObject[] args) ;
@Deprecated
public RubyString export(final IRubyObject[] args) {
return to_pem(args);
}
@JRubyMethod(name = "sign")
public IRubyObject sign(IRubyObject digest, IRubyObject data) {
final Ruby runtime = getRuntime();
if ( ! isPrivateKey() ) throw runtime.newArgumentError("Private key is needed.");
String digAlg = (digest instanceof Digest) ? ((Digest) digest).getShortAlgorithm() : digest.asJavaString();
try {
ByteList sign = sign(digAlg + "WITH" + getAlgorithm(), getPrivateKey(), data.convertToString().getByteList());
return RubyString.newString(runtime, sign);
}
catch (GeneralSecurityException ex) {
throw newPKeyError(runtime, ex.getMessage());
}
}
static ByteList sign(final String signAlg, final PrivateKey privateKey, final ByteList data)
throws NoSuchAlgorithmException, InvalidKeyException, SignatureException {
Signature signature = SecurityHelper.getSignature(signAlg);
signature.initSign( privateKey );
signature.update( data.getUnsafeBytes(), data.getBegin(), data.getRealSize() );
return new ByteList(signature.sign(), false);
}
@JRubyMethod(name = "verify")
public IRubyObject verify(IRubyObject digest, IRubyObject sign, IRubyObject data) {
final Ruby runtime = getRuntime();
ByteList sigBytes = convertToString(runtime, sign, "OpenSSL::PKey::PKeyError", "invalid signature").getByteList();
ByteList dataBytes = convertToString(runtime, data, "OpenSSL::PKey::PKeyError", "invalid data").getByteList();
String digAlg = (digest instanceof Digest) ? ((Digest) digest).getShortAlgorithm() : digest.asJavaString();
final String algorithm = digAlg + "WITH" + getAlgorithm();
try {
return runtime.newBoolean( verify(algorithm, getPublicKey(), dataBytes, sigBytes) );
}
catch (NoSuchAlgorithmException e) {
throw newPKeyError(runtime, "unsupported algorithm: " + algorithm);
}
catch (SignatureException e) {
throw newPKeyError(runtime, "invalid signature");
}
catch (InvalidKeyException e) {
throw newPKeyError(runtime, "invalid key");
}
}
static RubyString convertToString(final Ruby runtime, final IRubyObject str, final String errorType, final CharSequence errorMsg) {
try {
return str.convertToString();
}
catch (RaiseException ex) { // to_str conversion failed
throw Utils.newError(runtime, (RubyClass) runtime.getClassFromPath(errorType), errorMsg == null ? null : errorMsg.toString());
}
}
static boolean verify(final String signAlg, final PublicKey publicKey, final ByteList data, final ByteList sign)
throws NoSuchAlgorithmException, InvalidKeyException, SignatureException {
Signature signature = SecurityHelper.getSignature(signAlg);
signature.initVerify(publicKey);
signature.update(data.getUnsafeBytes(), data.getBegin(), data.getRealSize());
return signature.verify(sign.getUnsafeBytes(), sign.getBegin(), sign.getRealSize());
}
static SecureRandom getSecureRandom(final Ruby runtime) {
return OpenSSL.getSecureRandom(runtime);
}
// shared Helpers for PKeyRSA / PKEyDSA :
protected PrivateKey tryPKCS8EncodedKey(final Ruby runtime, final KeyFactory keyFactory, final byte[] encodedKey) {
try {
return keyFactory.generatePrivate(new PKCS8EncodedKeySpec(encodedKey));
}
catch (InvalidKeySpecException e) {
if ( isDebug(runtime) ) {
debug(runtime, getClass().getSimpleName() + " could not generate (PKCS8) private key", e);
}
}
catch (RuntimeException e) {
if ( isKeyGenerationFailure(e) ) {
if( isDebug(runtime) ) {
debug(runtime, getClass().getSimpleName() + " could not generate (PKCS8) private key", e);
}
}
else debugStackTrace(runtime, e);
}
return null;
}
protected static boolean isKeyGenerationFailure(final RuntimeException e) {
// NOTE handle "common-failure" more gently (no need for stack trace) :
// java.lang.ClassCastException: org.bouncycastle.asn1.DLSequence cannot be cast to org.bouncycastle.asn1.ASN1Integer
// at org.bouncycastle.asn1.pkcs.PrivateKeyInfo.(Unknown Source)
// at org.bouncycastle.asn1.pkcs.PrivateKeyInfo.getInstance(Unknown Source)
// at org.bouncycastle.jcajce.provider.asymmetric.util.BaseKeyFactorySpi.engineGeneratePrivate(Unknown Source)
// at org.bouncycastle.jcajce.provider.asymmetric.dsa.KeyFactorySpi.engineGeneratePrivate(Unknown Source)
// at java.security.KeyFactory.generatePrivate(KeyFactory.java:366)
if ( e instanceof ClassCastException ) {
// RSA :
final String msg = e.getMessage();
if ( msg != null && msg.contains("DLSequence cannot be cast to") ) {
return true;
}
}
return false;
}
protected PublicKey tryX509EncodedKey(final Ruby runtime, final KeyFactory keyFactory, final byte[] encodedKey) {
try {
return keyFactory.generatePublic(new X509EncodedKeySpec(encodedKey));
}
catch (InvalidKeySpecException e) {
if ( isDebug(runtime) ) {
debug(runtime, getClass().getSimpleName() + " could not generate (X509) public key", e);
}
}
catch (RuntimeException e) {
if ( isKeyGenerationFailure(e) ) { // NOTE: not (yet) detected with X.509
if( isDebug(runtime) ) {
debug(runtime, getClass().getSimpleName() + " could not generate (X509) public key", e);
}
}
else debugStackTrace(runtime, e);
}
return null;
}
protected static void addSplittedAndFormatted(StringBuilder result, BigInteger value) {
String v = value.toString(16);
if ((v.length() % 2) != 0) {
v = "0" + v;
}
String sep = "";
for (int i = 0; i < v.length(); i += 2) {
result.append(sep);
if ((i % 30) == 0) {
result.append("\n ");
}
result.append(v.substring(i, i + 2));
sep = ":";
}
result.append("\n");
}
protected static CipherSpec cipherSpec(final IRubyObject cipher) {
if ( cipher != null && ! cipher.isNil() ) {
final Cipher c = (Cipher) cipher;
return new CipherSpec(c.getCipherInstance(), c.getName(), c.getKeyLength() * 8);
}
return null;
}
protected static char[] password(final IRubyObject pass) {
if ( pass != null && ! pass.isNil() ) {
return pass.toString().toCharArray();
}
return null;
}
protected static char[] passwordPrompt(final ThreadContext context) {
return passwordPrompt(context, "Enter PEM pass phrase:");
}
protected static char[] passwordPrompt(final ThreadContext context, final String prompt) {
final RubyModule Kernel = context.runtime.getKernel();
// NOTE: just a fast and simple print && gets - hopefully better than nothing!
Kernel.callMethod("print", context.runtime.newString(prompt));
final RubyString gets = Kernel.callMethod(context, "gets").convertToString();
gets.chomp_bang(context);
return gets.toString().toCharArray();
}
protected static boolean ttySTDIN(final ThreadContext context) {
final IRubyObject stdin = context.runtime.getGlobalVariables().get("$stdin");
if ( stdin == null || stdin.isNil() ) return false;
try {
final IRubyObject tty = stdin.callMethod(context, "tty?");
return ! tty.isNil() && ! ( tty == context.runtime.getFalse() );
}
catch (RaiseException ex) { return false; }
}
static Object readPrivateKey(final String str, final char[] passwd)
throws PEMInputOutput.PasswordRequiredException, IOException {
return PEMInputOutput.readPrivateKey(new StringReader(str), passwd);
}
static Object readPrivateKey(final RubyString str, final char[] passwd)
throws PEMInputOutput.PasswordRequiredException, IOException {
return readPrivateKey(str.toString(), passwd);
}
protected static RubyString readInitArg(final ThreadContext context, IRubyObject arg) {
return StringHelper.readPossibleDERInput(context, arg);
}
static void supportedSignatureAlgorithm(final Ruby runtime, final RubyClass errorClass,
final PKey key, final Digest digest) {
// Have to obey some artificial constraints of the OpenSSL implementation. Stupid.
final String keyAlg = key.getAlgorithm();
final String digAlg = digest.getShortAlgorithm();
if ( ( "DSA".equalsIgnoreCase(keyAlg) && "MD5".equalsIgnoreCase(digAlg)) ||
( "RSA".equalsIgnoreCase(keyAlg) && "DSS1".equals( digest.name().toString() ) ) ) {
throw Utils.newError(runtime, errorClass, "unsupported key / digest algorithm ( "+ keyAlg +" / "+ digAlg +" )");
}
}
static void supportedSignatureAlgorithm(final Ruby runtime, final PKey key, final Digest digest) {
supportedSignatureAlgorithm(runtime, _OpenSSLError(runtime), key, digest);
}
}// PKey
jruby-openssl-0.9.21/src/main/java/org/jruby/ext/openssl/PKeyDH.java 0000664 0000000 0000000 00000037323 13136616216 0025224 0 ustar 00root root 0000000 0000000 /***** BEGIN LICENSE BLOCK *****
* Version: EPL 1.0/GPL 2.0/LGPL 2.1
*
* The contents of this file are subject to the Eclipse Public
* License Version 1.0 (the "License"); you may not use this file
* except in compliance with the License. You may obtain a copy of
* the License at http://www.eclipse.org/legal/epl-v10.html
*
* Software distributed under the License is distributed on an "AS
* IS" basis, WITHOUT WARRANTY OF ANY KIND, either express or
* implied. See the License for the specific language governing
* rights and limitations under the License.
*
* Copyright (C) 2007 William N Dortch
*
* Alternatively, the contents of this file may be used under the terms of
* either of the GNU General Public License Version 2 or later (the "GPL"),
* or the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
* in which case the provisions of the GPL or the LGPL are applicable instead
* of those above. If you wish to allow use of your version of this file only
* under the terms of either the GPL or the LGPL, and not to allow others to
* use your version of this file under the terms of the EPL, indicate your
* decision by deleting the provisions above and replace them with the notice
* and other provisions required by the GPL or the LGPL. If you do not delete
* the provisions above, a recipient may use your version of this file under
* the terms of any one of the EPL, the GPL or the LGPL.
***** END LICENSE BLOCK *****/
package org.jruby.ext.openssl;
import java.io.IOException;
import java.io.StringReader;
import java.io.StringWriter;
import java.math.BigInteger;
import java.security.KeyFactory;
import java.security.NoSuchAlgorithmException;
import java.security.PrivateKey;
import java.security.PublicKey;
import java.util.HashMap;
import java.security.SecureRandom;
import java.security.spec.InvalidKeySpecException;
import javax.crypto.spec.DHParameterSpec;
import javax.crypto.spec.DHPrivateKeySpec;
import javax.crypto.spec.DHPublicKeySpec;
import org.jruby.Ruby;
import org.jruby.RubyBoolean;
import org.jruby.RubyClass;
import org.jruby.RubyHash;
import org.jruby.RubyModule;
import org.jruby.RubyNumeric;
import org.jruby.RubyString;
import org.jruby.anno.JRubyMethod;
import org.jruby.exceptions.RaiseException;
import org.jruby.ext.openssl.x509store.PEMInputOutput;
import org.jruby.runtime.Arity;
import org.jruby.runtime.ObjectAllocator;
import org.jruby.runtime.ThreadContext;
import org.jruby.runtime.builtin.IRubyObject;
import org.jruby.util.ByteList;
import org.jruby.runtime.Visibility;
import static org.jruby.ext.openssl.OpenSSL.bcExceptionMessage;
/**
* OpenSSL::PKey::DH implementation.
*
* @author Bill Dortch
*/
public class PKeyDH extends PKey {
private static final long serialVersionUID = -1893518804744046740L;
private static final BigInteger TWO = BN.TWO;
// from [ossl]/crypto/dh/dh.h
private static final int OPENSSL_DH_MAX_MODULUS_BITS = 10000;
private static final ObjectAllocator ALLOCATOR = new ObjectAllocator() {
public PKeyDH allocate(Ruby runtime, RubyClass klass) { return new PKeyDH(runtime, klass); }
};
public static void createPKeyDH(final Ruby runtime, final RubyModule PKey, final RubyClass PKeyPKey) {
RubyClass DH = PKey.defineClassUnder("DH", PKeyPKey, ALLOCATOR);
RubyClass PKeyError = PKey.getClass("PKeyError");
PKey.defineClassUnder("DHError", PKeyError, PKeyError.getAllocator());
DH.defineAnnotatedMethods(PKeyDH.class);
}
public static RaiseException newDHError(Ruby runtime, String message) {
return Utils.newError(runtime, _PKey(runtime).getClass("DHError"), message);
}
// transient because: we do not want these value serialized (insecure)
// volatile because: permits unsynchronized reads in some cases
private transient volatile BigInteger dh_p;
private transient volatile BigInteger dh_g;
private transient volatile BigInteger dh_y;
private transient volatile BigInteger dh_x;
// FIXME! need to figure out what it means in MRI/OSSL code to
// claim a DH is(/has) private if an engine is present -- doesn't really
// map to Java implementation.
//private volatile boolean haveEngine;
public PKeyDH(Ruby runtime, RubyClass clazz) {
super(runtime, clazz);
}
@Override
public IRubyObject initialize_copy(final IRubyObject original) {
if (this == original) return this;
checkFrozen();
final PKeyDH that = (PKeyDH) original;
this.dh_p = that.dh_p;
this.dh_g = that.dh_g;
this.dh_y = that.dh_y;
this.dh_x = that.dh_x;
return this;
}
@JRubyMethod(name="initialize", rest=true, visibility = Visibility.PRIVATE)
public synchronized IRubyObject initialize(final ThreadContext context, final IRubyObject[] args) {
final Ruby runtime = context.runtime;
if (this.dh_p != null || this.dh_g != null || this.dh_y != null || this.dh_x != null) {
throw newDHError(runtime, "illegal initialization");
}
final int argc = Arity.checkArgumentCount(runtime, args, 0, 2);
if ( argc > 0 ) {
IRubyObject arg0 = args[0];
if ( argc == 1 && arg0 instanceof RubyString ) {
try {
DHParameterSpec spec = PEMInputOutput.readDHParameters(new StringReader(arg0.toString()));
if (spec == null) {
spec = org.jruby.ext.openssl.impl.PKey.readDHParameter(arg0.asString().getByteList().bytes());
}
if (spec == null) {
throw runtime.newArgumentError("invalid DH PARAMETERS");
}
this.dh_p = spec.getP();
this.dh_g = spec.getG();
}
catch (NoClassDefFoundError e) {
throw newDHError(runtime, bcExceptionMessage(e));
}
catch (IOException e) {
throw runtime.newIOErrorFromException(e);
}
} else {
int bits = RubyNumeric.fix2int(arg0);
// g defaults to 2
int gval = argc == 2 ? RubyNumeric.fix2int(args[1]) : 2;
BigInteger p;
try {
p = generateP(bits, gval);
}
catch(IllegalArgumentException e) {
throw runtime.newArgumentError(e.getMessage());
}
BigInteger g = BigInteger.valueOf(gval);
BigInteger x = generateX(p);
BigInteger y = generateY(p, g, x);
this.dh_p = p;
this.dh_g = g;
this.dh_x = x; // private key
this.dh_y = y; // public key
}
}
return this;
}
public static BigInteger generateP(int bits, int g) {
// FIXME? I'm following algorithms used in OpenSSL, could use JCE provider instead.
// (Note that I tried that, but got mystifying values of g returned by the param generator.
// In any case, in OpenSSL/MRI-OpenSSL, the caller supplies g, or it defaults to 2.)
// see [ossl]/crypto/dh/dh_gen.c #dh_builtin_genparams
if (bits < 2) throw new IllegalArgumentException("invalid bit length");
if (g < 2) throw new IllegalArgumentException("invalid generator");
// generate safe prime meeting appropriate add/rem (mod) criteria
switch (g) {
// parameters used in generating 'p'; see [ossl]/crypto/dh/dh_gen.c #dh_builtin_genparams
case 2 : // add = 24, rem = 11
return BN.generatePrime(bits, true, BigInteger.valueOf(24), BigInteger.valueOf(11));
case 5 : // add = 10, rem = 3
return BN.generatePrime(bits, true, BigInteger.valueOf(10), BigInteger.valueOf(3));
default: // add = 2, rem = 1
return BN.generatePrime(bits, true, TWO, BigInteger.ONE);
}
}
public static BigInteger generateX(BigInteger p, int limit) {
if (limit < 0) throw new IllegalArgumentException("invalid limit");
BigInteger x;
SecureRandom secureRandom = new SecureRandom();
// adapting algorithm from org.bouncycastle.crypto.generators.DHKeyGeneratorHelper,
// which seems a little stronger (?) than OpenSSL's (OSSL just generates a random,
// while BC generates a random potential prime [for limit > 0], though it's not
// subject to Miller-Rabin [certainty = 0], but is subject to other constraints)
// see also [ossl]/crypto/dh/dh_key.c #generate_key
if (limit == 0) {
final BigInteger pSub2 = p.subtract(TWO);
do {
x = BN.randomIntegerInRange(pSub2, secureRandom);
} while (x.equals(BigInteger.ZERO));
} else {
do {
// generate potential prime, though with 0 certainty (no Miller-Rabin tests)
x = new BigInteger(limit, 0, secureRandom);
} while (x.equals(BigInteger.ZERO));
}
return x;
}
public static BigInteger generateX(BigInteger p) {
// OpenSSL default l(imit) is p bits - 1 -- see [ossl]/crypto/dh/dh_key.c #generate_key
return generateX(p, p.bitLength() - 1);
}
public static BigInteger generateY(BigInteger p, BigInteger g, BigInteger x) {
return g.modPow(x, p);
}
public static BigInteger generateY(BigInteger p, int g, BigInteger x) {
return generateY(p, BigInteger.valueOf(g), x);
}
@JRubyMethod(name = "generate_key!")
public synchronized IRubyObject generate_key() {
BigInteger p, g, x, y;
if ((p = this.dh_p) == null || (g = this.dh_g) == null) {
throw newDHError(getRuntime(), "can't generate key");
}
if ((x = this.dh_x) == null) {
x = generateX(p);
}
y = generateY(p, g, x);
this.dh_x = x;
this.dh_y = y;
return this;
}
@JRubyMethod(name = "compute_key")
public synchronized IRubyObject compute_key(IRubyObject other_pub_key) {
BigInteger x, y, p;
if ((y = BN.asBigInteger(other_pub_key)) == null) {
throw getRuntime().newArgumentError("invalid public key");
}
if ((x = this.dh_x) == null || (p = this.dh_p) == null) {
throw newDHError(getRuntime(), "incomplete DH");
}
int plen;
if ((plen = p.bitLength()) == 0 || plen > OPENSSL_DH_MAX_MODULUS_BITS) {
throw newDHError(getRuntime(), "can't compute key");
}
return getRuntime().newString(new ByteList(computeKey(y, x, p), false));
}
public static byte[] computeKey(BigInteger y, BigInteger x, BigInteger p) {
return y.modPow(x, p).toByteArray();
}
@JRubyMethod(name = "public?")
public RubyBoolean public_p() {
return getRuntime().newBoolean(dh_y != null);
}
@Override
public boolean isPrivateKey() {
return dh_x != null /* || haveEngine */;
}
@JRubyMethod(name = "private?")
public RubyBoolean private_p() {
// FIXME! need to figure out what it means in MRI/OSSL code to
// claim a DH is private if an engine is present -- doesn't really
// map to Java implementation.
return getRuntime().newBoolean(isPrivateKey());
}
@Override
@JRubyMethod(name = { "to_pem", "to_s" }, alias = "export", rest = true)
public RubyString to_pem(final IRubyObject[] args) {
//Arity.checkArgumentCount(getRuntime(), args, 0, 2);
//CipherSpec spec = null; char[] passwd = null;
//if ( args.length > 0 ) {
// spec = cipherSpec( args[0] );
// if ( args.length > 1 ) passwd = password(args[1]);
//}
BigInteger p, g;
synchronized(this) {
p = this.dh_p;
g = this.dh_g;
}
final StringWriter writer = new StringWriter();
try {
PEMInputOutput.writeDHParameters(writer, new DHParameterSpec(p, g));
}
catch (NoClassDefFoundError e) {
throw newDHError(getRuntime(), bcExceptionMessage(e));
}
catch (IOException e) { // shouldn't happen (string/buffer io only)
throw getRuntime().newIOErrorFromException(e);
}
return RubyString.newString(getRuntime(), writer.getBuffer());
}
@Override
@JRubyMethod(name = "to_der")
public RubyString to_der() {
BigInteger p, g;
synchronized (this) {
p = this.dh_p;
g = this.dh_g;
}
try {
byte[] bytes = org.jruby.ext.openssl.impl.PKey.toDerDHKey(p, g);
return StringHelper.newString(getRuntime(), bytes);
} catch (NoClassDefFoundError e) {
throw newDHError(getRuntime(), bcExceptionMessage(e));
} catch (IOException ioe) {
throw newDHError(getRuntime(), ioe.getMessage());
}
}
@JRubyMethod(name = "params")
public IRubyObject params() {
BigInteger p, g, x, y;
synchronized(this) {
p = this.dh_p;
g = this.dh_g;
x = this.dh_x;
y = this.dh_y;
}
final Ruby runtime = getRuntime();
HashMap params = new HashMap();
params.put(runtime.newString("p"), BN.newBN(runtime, p));
params.put(runtime.newString("g"), BN.newBN(runtime, g));
params.put(runtime.newString("pub_key"), BN.newBN(runtime, x));
params.put(runtime.newString("priv_key"), BN.newBN(runtime, y));
return RubyHash.newHash(runtime, params, runtime.getNil());
}
// don't need synchronized as value is volatile
@JRubyMethod(name = "p")
public IRubyObject get_p() {
return newBN(dh_p);
}
@JRubyMethod(name = "p=")
public synchronized IRubyObject set_p(IRubyObject arg) {
this.dh_p = BN.asBigInteger(arg);
return arg;
}
// don't need synchronized as value is volatile
@JRubyMethod(name = "g")
public IRubyObject get_g() {
return newBN(dh_g);
}
@JRubyMethod(name = "g=")
public synchronized IRubyObject set_g(IRubyObject arg) {
this.dh_g = BN.asBigInteger(arg);
return arg;
}
// don't need synchronized as value is volatile
@JRubyMethod(name = "pub_key")
public IRubyObject pub_key() {
return newBN(dh_y);
}
@Override
public PublicKey getPublicKey() {
try {
return getKeyFactory().generatePublic(new DHPublicKeySpec(dh_y, dh_p, dh_g));
}
catch (InvalidKeySpecException ex) { throw new RuntimeException(ex); }
}
@JRubyMethod(name = "pub_key=")
public synchronized IRubyObject set_pub_key(IRubyObject arg) {
this.dh_y = BN.asBigInteger(arg);
return arg;
}
// don't need synchronized as value is volatile
@JRubyMethod(name = "priv_key")
public IRubyObject priv_key() {
return newBN(dh_x);
}
@Override
public PrivateKey getPrivateKey() {
try {
return getKeyFactory().generatePrivate(new DHPrivateKeySpec(dh_x, dh_p, dh_g));
}
catch (InvalidKeySpecException ex) { throw new RuntimeException(ex); }
}
@JRubyMethod(name = "priv_key=")
public synchronized IRubyObject set_priv_key(IRubyObject arg) {
this.dh_x = BN.asBigInteger(arg);
return arg;
}
private IRubyObject newBN(BigInteger value) {
if (value == null) return getRuntime().getNil();
return BN.newBN(getRuntime(), value);
}
private static KeyFactory getKeyFactory() {
try {
return SecurityHelper.getKeyFactory("DiffieHellman");
}
catch (NoSuchAlgorithmException ex) { throw new RuntimeException(ex); }
}
}
jruby-openssl-0.9.21/src/main/java/org/jruby/ext/openssl/PKeyDSA.java 0000664 0000000 0000000 00000052575 13136616216 0025346 0 ustar 00root root 0000000 0000000 /***** BEGIN LICENSE BLOCK *****
* Version: EPL 1.0/GPL 2.0/LGPL 2.1
*
* The contents of this file are subject to the Eclipse Public
* License Version 1.0 (the "License"); you may not use this file
* except in compliance with the License. You may obtain a copy of
* the License at http://www.eclipse.org/legal/epl-v10.html
*
* Software distributed under the License is distributed on an "AS
* IS" basis, WITHOUT WARRANTY OF ANY KIND, either express or
* implied. See the License for the specific language governing
* rights and limitations under the License.
*
* Copyright (C) 2006, 2007 Ola Bini
* Copyright (C) 2007 Wiliam N Dortch
*
* Alternatively, the contents of this file may be used under the terms of
* either of the GNU General Public License Version 2 or later (the "GPL"),
* or the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
* in which case the provisions of the GPL or the LGPL are applicable instead
* of those above. If you wish to allow use of your version of this file only
* under the terms of either the GPL or the LGPL, and not to allow others to
* use your version of this file under the terms of the EPL, indicate your
* decision by deleting the provisions above and replace them with the notice
* and other provisions required by the GPL or the LGPL. If you do not delete
* the provisions above, a recipient may use your version of this file under
* the terms of any one of the EPL, the GPL or the LGPL.
***** END LICENSE BLOCK *****/
package org.jruby.ext.openssl;
import java.io.IOException;
import java.io.StringReader;
import java.io.StringWriter;
import java.math.BigInteger;
import java.security.*;
import java.security.interfaces.DSAKey;
import java.security.interfaces.DSAPrivateKey;
import java.security.interfaces.DSAPublicKey;
import java.security.spec.DSAPrivateKeySpec;
import java.security.spec.DSAPublicKeySpec;
import java.security.spec.InvalidKeySpecException;
import org.jruby.Ruby;
import org.jruby.RubyBoolean;
import org.jruby.RubyClass;
import org.jruby.RubyFixnum;
import org.jruby.RubyModule;
import org.jruby.RubyNumeric;
import org.jruby.RubyString;
import org.jruby.anno.JRubyMethod;
import org.jruby.exceptions.RaiseException;
import org.jruby.ext.openssl.impl.CipherSpec;
import org.jruby.ext.openssl.x509store.PEMInputOutput;
import org.jruby.runtime.Arity;
import org.jruby.runtime.ObjectAllocator;
import org.jruby.runtime.builtin.IRubyObject;
import org.jruby.runtime.ThreadContext;
import org.jruby.runtime.Visibility;
import org.jruby.util.ByteList;
import static org.jruby.ext.openssl.OpenSSL.*;
import static org.jruby.ext.openssl.impl.PKey.readDSAPrivateKey;
import static org.jruby.ext.openssl.impl.PKey.readDSAPublicKey;
import static org.jruby.ext.openssl.impl.PKey.toDerDSAKey;
import static org.jruby.ext.openssl.PKey._PKey;
/**
* @author Ola Bini
*/
public class PKeyDSA extends PKey {
private static final long serialVersionUID = 6351851846414049890L;
private static final ObjectAllocator ALLOCATOR = new ObjectAllocator() {
public PKeyDSA allocate(Ruby runtime, RubyClass klass) { return new PKeyDSA(runtime, klass); }
};
public static void createPKeyDSA(final Ruby runtime, final RubyModule PKey, final RubyClass PKeyPKey) {
RubyClass DSA = PKey.defineClassUnder("DSA", PKeyPKey, ALLOCATOR);
RubyClass PKeyError = PKey.getClass("PKeyError");
PKey.defineClassUnder("DSAError", PKeyError, PKeyError.getAllocator());
DSA.defineAnnotatedMethods(PKeyDSA.class);
}
static RubyClass _DSA(final Ruby runtime) {
return _PKey(runtime).getClass("DSA");
}
public PKeyDSA(Ruby runtime, RubyClass type) {
super(runtime, type);
}
public PKeyDSA(Ruby runtime, RubyClass type, DSAPrivateKey privKey, DSAPublicKey pubKey) {
super(runtime, type);
this.privateKey = privKey;
this.publicKey = pubKey;
}
PKeyDSA(Ruby runtime, DSAPublicKey pubKey) {
this(runtime, _DSA(runtime), null, pubKey);
}
private volatile DSAPublicKey publicKey;
private volatile transient DSAPrivateKey privateKey;
// specValues holds individual DSAPublicKeySpec components. this allows
// a public key to be constructed incrementally, as required by the
// current implementation of Net::SSH.
// (see net-ssh-1.1.2/lib/net/ssh/transport/ossl/buffer.rb #read_keyblob)
private transient volatile BigInteger dsa_x;
private transient volatile BigInteger dsa_y;
private transient volatile BigInteger dsa_p;
private transient volatile BigInteger dsa_q;
private transient volatile BigInteger dsa_g;
@Override
public IRubyObject initialize_copy(final IRubyObject original) {
if (this == original) return this;
checkFrozen();
final PKeyDSA that = (PKeyDSA) original;
this.publicKey = that.publicKey;
this.privateKey = that.privateKey;
this.dsa_x = that.dsa_x;
this.dsa_y = that.dsa_y;
this.dsa_p = that.dsa_p;
this.dsa_q = that.dsa_q;
this.dsa_g = that.dsa_g;
return this;
}
@Override
public PublicKey getPublicKey() { return publicKey; }
@Override
public PrivateKey getPrivateKey() { return privateKey; }
@Override
public String getAlgorithm() { return "DSA"; }
@JRubyMethod(name = "generate", meta = true)
public static IRubyObject generate(IRubyObject self, IRubyObject arg) {
final Ruby runtime = self.getRuntime();
final int keySize = RubyNumeric.fix2int(arg);
return dsaGenerate(runtime, new PKeyDSA(runtime, (RubyClass) self), keySize);
}
/*
* c: dsa_generate
*/
private static PKeyDSA dsaGenerate(final Ruby runtime,
PKeyDSA dsa, int keySize) throws RaiseException {
try {
KeyPairGenerator gen = SecurityHelper.getKeyPairGenerator("DSA");
gen.initialize(keySize, getSecureRandom(runtime));
KeyPair pair = gen.generateKeyPair();
dsa.privateKey = (DSAPrivateKey) pair.getPrivate();
dsa.publicKey = (DSAPublicKey) pair.getPublic();
return dsa;
}
catch (NoSuchAlgorithmException e) {
throw newDSAError(runtime, e.getMessage());
}
catch (RuntimeException e) {
throw newDSAError(runtime, e.getMessage(), e);
}
}
static PKeyDSA newInstance(final Ruby runtime, final PublicKey publicKey) {
//if ( publicKey instanceof DSAPublicKey ) {
return new PKeyDSA(runtime, (DSAPublicKey) publicKey);
//}
}
@JRubyMethod(rest = true, visibility = Visibility.PRIVATE)
public IRubyObject initialize(final ThreadContext context, final IRubyObject[] args) {
final Ruby runtime = context.runtime;
if ( Arity.checkArgumentCount(runtime, args, 0, 2) == 0 ) {
this.privateKey = null; this.publicKey = null; return this;
}
IRubyObject arg = args[0]; IRubyObject pass = null;
if ( args.length > 1 ) pass = args[1];
if ( arg instanceof RubyFixnum ) {
int keySize = RubyNumeric.fix2int((RubyFixnum) arg);
return dsaGenerate(context.runtime, this, keySize);
}
final char[] passwd = password(pass);
final RubyString str = readInitArg(context, arg);
final String strJava = str.toString();
Object key = null;
final KeyFactory dsaFactory;
try {
dsaFactory = SecurityHelper.getKeyFactory("DSA");
}
catch (NoSuchAlgorithmException e) {
throw runtime.newRuntimeError("unsupported key algorithm (DSA)");
}
catch (RuntimeException e) {
throw runtime.newRuntimeError("unsupported key algorithm (DSA) " + e);
}
// TODO: ugly NoClassDefFoundError catching for no BC env. How can we remove this?
boolean noClassDef = false;
if ( key == null && ! noClassDef ) { // PEM_read_bio_DSAPrivateKey
try {
key = readPrivateKey(strJava, passwd);
}
catch (NoClassDefFoundError e) { noClassDef = true; debugStackTrace(runtime, e); }
catch (PEMInputOutput.PasswordRequiredException retry) {
if ( ttySTDIN(context) ) {
try { key = readPrivateKey(strJava, passwordPrompt(context)); }
catch (Exception e) { debugStackTrace(runtime, e); }
}
}
catch (Exception e) { debugStackTrace(runtime, e); }
}
if ( key == null && ! noClassDef ) { // PEM_read_bio_DSAPublicKey
try {
key = PEMInputOutput.readDSAPublicKey(new StringReader(strJava), passwd);
}
catch (NoClassDefFoundError e) { noClassDef = true; debugStackTrace(runtime, e); }
catch (Exception e) { debugStackTrace(runtime, e); }
}
if ( key == null && ! noClassDef ) { // PEM_read_bio_DSA_PUBKEY
try {
key = PEMInputOutput.readDSAPubKey(new StringReader(strJava));
}
catch (NoClassDefFoundError e) { noClassDef = true; debugStackTrace(runtime, e); }
catch (Exception e) { debugStackTrace(runtime, e); }
}
if ( key == null && ! noClassDef ) { // d2i_DSAPrivateKey_bio
try {
key = readDSAPrivateKey(dsaFactory, str.getBytes());
}
catch (NoClassDefFoundError e) { noClassDef = true; debugStackTrace(runtime, e); }
catch (InvalidKeySpecException e) { debug(runtime, "PKeyDSA could not read private key", e); }
catch (IOException e) { debug(runtime, "PKeyDSA could not read private key", e); }
catch (RuntimeException e) {
if ( isKeyGenerationFailure(e) ) debug(runtime, "PKeyDSA could not read private key", e);
else debugStackTrace(runtime, e);
}
}
if ( key == null && ! noClassDef ) { // d2i_DSA_PUBKEY_bio
try {
key = readDSAPublicKey(dsaFactory, str.getBytes());
}
catch (NoClassDefFoundError e) { noClassDef = true; debugStackTrace(runtime, e); }
catch (InvalidKeySpecException e) { debug(runtime, "PKeyDSA could not read public key", e); }
catch (IOException e) { debug(runtime, "PKeyDSA could not read public key", e); }
catch (RuntimeException e) {
if ( isKeyGenerationFailure(e) ) debug(runtime, "PKeyDSA could not read public key", e);
else debugStackTrace(runtime, e);
}
}
if ( key == null ) key = tryPKCS8EncodedKey(runtime, dsaFactory, str.getBytes());
if ( key == null ) key = tryX509EncodedKey(runtime, dsaFactory, str.getBytes());
if ( key == null ) throw newDSAError(runtime, "Neither PUB key nor PRIV key:");
if ( key instanceof KeyPair ) {
final PublicKey pubKey = ((KeyPair) key).getPublic();
final PrivateKey privKey = ((KeyPair) key).getPrivate();
if ( ! ( privKey instanceof DSAPrivateKey ) ) {
if ( privKey == null ) {
throw newDSAError(runtime, "Neither PUB key nor PRIV key: (private key is null)");
}
throw newDSAError(runtime, "Neither PUB key nor PRIV key: (invalid key type " + privKey.getClass().getName() + ")");
}
this.privateKey = (DSAPrivateKey) privKey;
this.publicKey = (DSAPublicKey) pubKey;
}
else if ( key instanceof DSAPrivateKey ) {
this.privateKey = (DSAPrivateKey) key;
}
else if ( key instanceof DSAPublicKey ) {
this.publicKey = (DSAPublicKey) key; this.privateKey = null;
}
else {
throw newDSAError(runtime, "Neither PUB key nor PRIV key: " + key.getClass().getName());
}
return this;
}
//private static Object readPrivateKey(final RubyString str, final char[] passwd)
// throws PEMInputOutput.PasswordRequiredException, IOException {
// return PEMInputOutput.readDSAPrivateKey(new StringReader(str.toString()), passwd);
//}
@JRubyMethod(name = "public?")
public RubyBoolean public_p() {
return publicKey != null ? getRuntime().getTrue() : getRuntime().getFalse();
}
@JRubyMethod(name = "private?")
public RubyBoolean private_p() {
return privateKey != null ? getRuntime().getTrue() : getRuntime().getFalse();
}
@Override
@JRubyMethod(name = "to_der")
public RubyString to_der() {
final byte[] bytes;
try {
bytes = toDerDSAKey(publicKey, privateKey);
}
catch (NoClassDefFoundError e) {
throw newDSAError(getRuntime(), bcExceptionMessage(e));
}
catch (IOException e) {
throw newDSAError(getRuntime(), e.getMessage(), e);
}
return StringHelper.newString(getRuntime(), bytes);
}
@JRubyMethod
public RubyString to_text() {
StringBuilder result = new StringBuilder();
if (privateKey != null) {
int len = privateKey.getParams().getP().bitLength();
result.append("Private-Key: (").append(len).append(" bit)").append("\n");
result.append("priv:");
addSplittedAndFormatted(result, privateKey.getX());
}
result.append("pub:");
addSplittedAndFormatted(result, publicKey.getY());
result.append("P:");
addSplittedAndFormatted(result, publicKey.getParams().getP());
result.append("Q:");
addSplittedAndFormatted(result, publicKey.getParams().getQ());
result.append("G:");
addSplittedAndFormatted(result, publicKey.getParams().getG());
return RubyString.newString(getRuntime(), result);
}
@JRubyMethod
public PKeyDSA public_key() {
return new PKeyDSA(getRuntime(), this.publicKey);
}
@Override
@JRubyMethod(name = { "to_pem", "to_s" }, alias = "export", rest = true)
public RubyString to_pem(final IRubyObject[] args) {
Arity.checkArgumentCount(getRuntime(), args, 0, 2);
CipherSpec spec = null; char[] passwd = null;
if ( args.length > 0 ) {
spec = cipherSpec( args[0] );
if ( args.length > 1 ) passwd = password(args[1]);
}
try {
final StringWriter writer = new StringWriter();
if ( privateKey != null ) {
PEMInputOutput.writeDSAPrivateKey(writer, privateKey, spec, passwd);
}
else {
PEMInputOutput.writeDSAPublicKey(writer, publicKey);
}
return RubyString.newString(getRuntime(), writer.getBuffer());
}
catch (NoClassDefFoundError ncdfe) {
throw newDSAError(getRuntime(), bcExceptionMessage(ncdfe));
}
catch (IOException e) {
throw newDSAError(getRuntime(), e.getMessage(), e);
}
}
@JRubyMethod // ossl_dsa_sign
public IRubyObject syssign(IRubyObject data) {
final Ruby runtime = getRuntime();
DSAPrivateKey privateKey;
if ((privateKey = this.privateKey) == null) {
throw newDSAError(runtime, "Private DSA key needed!");
}
try {
ByteList sign = sign("NONEwithDSA", privateKey, data.convertToString().getByteList()); // DSS1
return RubyString.newString(runtime, sign);
}
catch (GeneralSecurityException ex) {
throw newDSAError(runtime, ex.getMessage());
}
}
@JRubyMethod // ossl_dsa_verify
public IRubyObject sysverify(IRubyObject data, IRubyObject sign) {
final Ruby runtime = getRuntime();
ByteList sigBytes = convertToString(runtime, sign, "OpenSSL::PKey::DSAError", "invalid signature").getByteList();
ByteList dataBytes = convertToString(runtime, data, "OpenSSL::PKey::DSAError", "invalid data").getByteList();
try {
return runtime.newBoolean( verify("NONEwithDSA", getPublicKey(), dataBytes, sigBytes) );
}
catch (NoSuchAlgorithmException e) {
throw newDSAError(runtime, e.getMessage());
}
catch (SignatureException e) {
throw newDSAError(runtime, "invalid signature");
}
catch (InvalidKeyException e) {
throw newDSAError(runtime, "invalid key");
}
}
private DSAKey getDsaKey() {
DSAKey result;
return (result = publicKey) != null ? result : privateKey;
}
private IRubyObject toBN(BigInteger value) {
return value == null ? getRuntime().getNil() : BN.newBN(getRuntime(), value);
}
private synchronized BigInteger getP() {
DSAKey key = getDsaKey();
if (key != null) {
return key.getParams().getP();
}
return dsa_p;
}
@JRubyMethod(name = "p")
public IRubyObject get_p() {
return toBN(getP());
}
@JRubyMethod(name = "p=")
public synchronized IRubyObject set_p(IRubyObject p) {
return setKeySpecComponent(SPEC_P, p);
}
private synchronized BigInteger getQ() {
DSAKey key = getDsaKey();
if (key != null) {
return key.getParams().getQ();
}
return dsa_q;
}
@JRubyMethod(name = "q")
public IRubyObject get_q() {
return toBN(getQ());
}
@JRubyMethod(name = "q=")
public synchronized IRubyObject set_q(IRubyObject q) {
return setKeySpecComponent(SPEC_Q, q);
}
private synchronized BigInteger getG() {
DSAKey key = getDsaKey();
if (key != null) {
return key.getParams().getG();
}
return dsa_g;
}
@JRubyMethod(name = "g")
public IRubyObject get_g() {
return toBN(getG());
}
@JRubyMethod(name = "g=")
public synchronized IRubyObject set_g(IRubyObject g) {
return setKeySpecComponent(SPEC_G, g);
}
@JRubyMethod(name = "priv_key")
public synchronized IRubyObject get_priv_key() {
DSAPrivateKey key;
if ((key = this.privateKey) != null) {
return toBN(key.getX());
}
return toBN(dsa_x);
}
@JRubyMethod(name = "priv_key=")
public synchronized IRubyObject set_priv_key(IRubyObject priv_key) {
return setKeySpecComponent(SPEC_X, priv_key);
}
@JRubyMethod(name = "pub_key")
public synchronized IRubyObject get_pub_key() {
DSAPublicKey key;
if ( ( key = this.publicKey ) != null ) {
return toBN(key.getY());
}
return toBN(dsa_y);
}
@JRubyMethod(name = "pub_key=")
public synchronized IRubyObject set_pub_key(IRubyObject pub_key) {
return setKeySpecComponent(SPEC_Y, pub_key);
}
private IRubyObject setKeySpecComponent(final int index, final IRubyObject value) {
final BigInteger val = BN.getBigInteger(value);
switch (index) {
case SPEC_X: this.dsa_x = val; break;
case SPEC_Y: this.dsa_y = val; break;
case SPEC_P: this.dsa_p = val; break;
case SPEC_Q: this.dsa_q = val; break;
case SPEC_G: this.dsa_g = val; break;
}
// Don't access the dsa_p, dsa_q and dsa_g fields directly. They may
// have already been consumed and cleared.
BigInteger _dsa_p = getP();
BigInteger _dsa_q = getQ();
BigInteger _dsa_g = getG();
if ( dsa_x != null && _dsa_p != null && _dsa_q != null && _dsa_g != null ) {
// we now have all private key components. create the key :
DSAPrivateKeySpec spec = new DSAPrivateKeySpec(dsa_x, _dsa_p, _dsa_q, _dsa_g);
try {
this.privateKey = (DSAPrivateKey) SecurityHelper.getKeyFactory("DSA").generatePrivate(spec);
}
catch (InvalidKeySpecException e) {
throw newDSAError(getRuntime(), "invalid keyspec", e);
}
catch (NoSuchAlgorithmException e) {
throw newDSAError(getRuntime(), "unsupported key algorithm (DSA)", e);
}
// clear out the specValues
this.dsa_x = this.dsa_p = this.dsa_q = this.dsa_g = null;
}
if ( dsa_y != null && _dsa_p != null && _dsa_q != null && _dsa_g != null ) {
// we now have all public key components. create the key :
DSAPublicKeySpec spec = new DSAPublicKeySpec(dsa_y, _dsa_p, _dsa_q, _dsa_g);
try {
this.publicKey = (DSAPublicKey) SecurityHelper.getKeyFactory("DSA").generatePublic(spec);
}
catch (InvalidKeySpecException e) {
throw newDSAError(getRuntime(), "invalid keyspec", e);
}
catch (NoSuchAlgorithmException e) {
throw newDSAError(getRuntime(), "unsupported key algorithm (DSA)", e);
}
// clear out the specValues
this.dsa_y = this.dsa_p = this.dsa_q = this.dsa_g = null;
}
return value;
}
private static final int SPEC_X = 0;
private static final int SPEC_Y = 1;
private static final int SPEC_P = 2;
private static final int SPEC_Q = 3;
private static final int SPEC_G = 4;
public static RaiseException newDSAError(Ruby runtime, String message) {
return Utils.newError(runtime, _PKey(runtime).getClass("DSAError"), message);
}
static RaiseException newDSAError(Ruby runtime, String message, Exception cause) {
return Utils.newError(runtime, _PKey(runtime).getClass("DSAError"), message, cause);
}
}// PKeyDSA
jruby-openssl-0.9.21/src/main/java/org/jruby/ext/openssl/PKeyEC.java 0000664 0000000 0000000 00000107370 13136616216 0025220 0 ustar 00root root 0000000 0000000 /*
* Copyright (c) 2016 Karol Bucek.
* All rights reserved. This program and the accompanying materials
* are made available under the terms of the Eclipse Public License v1.0
* which accompanies this distribution, and is available at
* http://www.eclipse.org/legal/epl-v10.html
*/
package org.jruby.ext.openssl;
import java.io.IOException;
import java.io.StringReader;
import java.io.StringWriter;
import java.math.BigInteger;
import java.security.GeneralSecurityException;
import java.security.InvalidKeyException;
import java.security.KeyFactory;
import java.security.KeyPair;
import java.security.KeyPairGenerator;
import java.security.NoSuchAlgorithmException;
import java.security.PrivateKey;
import java.security.PublicKey;
import java.security.SecureRandom;
import java.security.interfaces.ECPrivateKey;
import java.security.interfaces.ECPublicKey;
import java.security.spec.ECGenParameterSpec;
import java.security.spec.ECParameterSpec;
import java.security.spec.ECPoint;
import java.security.spec.ECPrivateKeySpec;
import java.security.spec.ECPublicKeySpec;
import java.security.spec.EllipticCurve;
import java.security.spec.InvalidKeySpecException;
import java.util.Collections;
import java.util.Enumeration;
import java.util.List;
import javax.crypto.KeyAgreement;
import org.bouncycastle.asn1.ASN1EncodableVector;
import org.bouncycastle.asn1.ASN1Integer;
import org.bouncycastle.asn1.ASN1ObjectIdentifier;
import org.bouncycastle.asn1.ASN1OutputStream;
import org.bouncycastle.asn1.DLSequence;
import org.bouncycastle.crypto.params.ECNamedDomainParameters;
import org.bouncycastle.crypto.params.ECPrivateKeyParameters;
import org.bouncycastle.crypto.signers.ECDSASigner;
import org.bouncycastle.jce.ECNamedCurveTable;
import org.bouncycastle.jce.ECPointUtil;
import org.bouncycastle.jce.spec.ECNamedCurveParameterSpec;
import org.bouncycastle.jce.spec.ECNamedCurveSpec;
import org.jruby.Ruby;
import org.jruby.RubyArray;
import org.jruby.RubyBoolean;
import org.jruby.RubyClass;
import org.jruby.RubyModule;
import org.jruby.RubyObject;
import org.jruby.RubyString;
import org.jruby.anno.JRubyClass;
import org.jruby.anno.JRubyMethod;
import org.jruby.exceptions.RaiseException;
import org.jruby.runtime.Arity;
import org.jruby.runtime.ObjectAllocator;
import org.jruby.runtime.ThreadContext;
import org.jruby.runtime.Visibility;
import org.jruby.runtime.builtin.IRubyObject;
import org.jruby.runtime.component.VariableEntry;
import org.jruby.ext.openssl.impl.CipherSpec;
import static org.jruby.ext.openssl.OpenSSL.debug;
import static org.jruby.ext.openssl.OpenSSL.debugStackTrace;
import static org.jruby.ext.openssl.PKey._PKey;
import org.jruby.ext.openssl.impl.ECPrivateKeyWithName;
import static org.jruby.ext.openssl.impl.PKey.readECPrivateKey;
import org.jruby.ext.openssl.util.ByteArrayOutputStream;
import org.jruby.ext.openssl.x509store.PEMInputOutput;
/**
* OpenSSL::PKey::EC implementation.
*
* @author kares
*/
public final class PKeyEC extends PKey {
private static final long serialVersionUID = 1L;
private static final ObjectAllocator ALLOCATOR = new ObjectAllocator() {
public PKeyEC allocate(Ruby runtime, RubyClass klass) { return new PKeyEC(runtime, klass); }
};
public static void createPKeyEC(final Ruby runtime, final RubyModule PKey, final RubyClass PKeyPKey) {
RubyClass EC = PKey.defineClassUnder("EC", PKeyPKey, ALLOCATOR);
RubyClass PKeyError = PKey.getClass("PKeyError");
PKey.defineClassUnder("ECError", PKeyError, PKeyError.getAllocator());
EC.defineAnnotatedMethods(PKeyEC.class);
EC.setConstant("NAMED_CURVE", runtime.newFixnum(1));
Point.createPoint(runtime, EC);
Group.createGroup(runtime, EC);
}
static RubyClass _EC(final Ruby runtime) {
return _PKey(runtime).getClass("EC");
}
public static RaiseException newECError(Ruby runtime, String message) {
return Utils.newError(runtime, _PKey(runtime).getClass("ECError"), message);
}
@JRubyMethod(meta = true)
public static RubyArray builtin_curves(ThreadContext context, IRubyObject self) {
final Ruby runtime = context.runtime;
final RubyArray curves = runtime.newArray();
Enumeration names;
names = org.bouncycastle.asn1.x9.X962NamedCurves.getNames();
while ( names.hasMoreElements() ) {
final String name = (String) names.nextElement();
RubyString desc;
if ( name.startsWith("prime") ) {
desc = RubyString.newString(runtime, "X9.62 curve over a xxx bit prime field");
}
else {
desc = RubyString.newString(runtime, "X9.62 curve over a xxx bit binary field");
}
curves.append(RubyArray.newArrayNoCopy(runtime, new IRubyObject[] { RubyString.newString(runtime, name), desc }));
}
names = org.bouncycastle.asn1.sec.SECNamedCurves.getNames();
while ( names.hasMoreElements() ) {
RubyString name = RubyString.newString(runtime, (String) names.nextElement());
RubyString desc = RubyString.newString(runtime, "SECG curve over a xxx bit binary field");
curves.append(RubyArray.newArrayNoCopy(runtime, new IRubyObject[] { name, desc }));
}
names = org.bouncycastle.asn1.nist.NISTNamedCurves.getNames();
while ( names.hasMoreElements() ) {
RubyString name = RubyString.newString(runtime, (String) names.nextElement());
IRubyObject[] nameAndDesc = new IRubyObject[] { name, RubyString.newEmptyString(runtime) };
curves.append(RubyArray.newArrayNoCopy(runtime, nameAndDesc));
}
names = org.bouncycastle.asn1.teletrust.TeleTrusTNamedCurves.getNames();
while ( names.hasMoreElements() ) {
RubyString name = RubyString.newString(runtime, (String) names.nextElement());
RubyString desc = RubyString.newString(runtime, "RFC 5639 curve over a xxx bit prime field");
curves.append(RubyArray.newArrayNoCopy(runtime, new IRubyObject[] { name, desc }));
}
return curves;
}
private static ASN1ObjectIdentifier getCurveOID(final String curveName) {
ASN1ObjectIdentifier id;
id = org.bouncycastle.asn1.sec.SECNamedCurves.getOID(curveName);
if ( id != null ) return id;
id = org.bouncycastle.asn1.x9.X962NamedCurves.getOID(curveName);
if ( id != null ) return id;
id = org.bouncycastle.asn1.nist.NISTNamedCurves.getOID(curveName);
if ( id != null ) return id;
id = org.bouncycastle.asn1.teletrust.TeleTrusTNamedCurves.getOID(curveName);
if ( id != null ) return id;
throw new IllegalStateException("could not identify curve name: " + curveName);
}
private static boolean isCurveName(final String curveName) {
try {
return getCurveOID(curveName) != null;
}
catch (IllegalStateException ex) { return false; }
}
private static String getCurveName(final ASN1ObjectIdentifier oid) {
String name;
name = org.bouncycastle.asn1.sec.SECNamedCurves.getName(oid);
if ( name != null ) return name;
name = org.bouncycastle.asn1.x9.X962NamedCurves.getName(oid);
if ( name != null ) return name;
name = org.bouncycastle.asn1.nist.NISTNamedCurves.getName(oid);
if ( name != null ) return name;
name = org.bouncycastle.asn1.teletrust.TeleTrusTNamedCurves.getName(oid);
if ( name != null ) return name;
throw new IllegalStateException("could not identify curve name from: " + oid);
}
public PKeyEC(Ruby runtime, RubyClass type) {
super(runtime, type);
}
PKeyEC(Ruby runtime, PublicKey pubKey) {
this(runtime, _EC(runtime), null, pubKey);
}
PKeyEC(Ruby runtime, RubyClass type, PrivateKey privKey, PublicKey pubKey) {
super(runtime, type);
this.privateKey = privKey;
this.publicKey = (ECPublicKey) pubKey;
}
private transient Group group;
private ECPublicKey publicKey;
private transient PrivateKey privateKey;
private String curveName;
private String getCurveName() { return curveName; }
// private ECNamedCurveParameterSpec getParameterSpec() {
// return ECNamedCurveTable.getParameterSpec( getCurveName() );
// }
@Override
public PublicKey getPublicKey() { return publicKey; }
@Override
public PrivateKey getPrivateKey() { return privateKey; }
@Override
public String getAlgorithm() { return "EC"; }
@JRubyMethod(rest = true, visibility = Visibility.PRIVATE)
public IRubyObject initialize(final ThreadContext context, final IRubyObject[] args) {
final Ruby runtime = context.runtime;
privateKey = null; publicKey = null;
if ( Arity.checkArgumentCount(runtime, args, 0, 2) == 0 ) {
return this;
}
IRubyObject arg = args[0];
if ( arg instanceof Group ) {
this.group = (Group) arg;
this.curveName = this.group.getCurveName();
return this;
}
IRubyObject pass = null;
if ( args.length > 1 ) pass = args[1];
final char[] passwd = password(pass);
final RubyString str = readInitArg(context, arg);
final String strJava = str.toString();
if ( isCurveName(strJava) ) {
this.curveName = strJava;
return this;
}
Object key = null;
final KeyFactory ecdsaFactory;
try {
ecdsaFactory = SecurityHelper.getKeyFactory("ECDSA");
}
catch (NoSuchAlgorithmException e) {
throw runtime.newRuntimeError("unsupported key algorithm (ECDSA)");
}
catch (RuntimeException e) {
throw runtime.newRuntimeError("unsupported key algorithm (ECDSA) " + e);
}
// TODO: ugly NoClassDefFoundError catching for no BC env. How can we remove this?
boolean noClassDef = false;
if ( key == null && ! noClassDef ) { // PEM_read_bio_DSAPrivateKey
try {
key = readPrivateKey(strJava, passwd);
}
catch (NoClassDefFoundError e) { noClassDef = true; debugStackTrace(runtime, e); }
catch (PEMInputOutput.PasswordRequiredException retry) {
if ( ttySTDIN(context) ) {
try { key = readPrivateKey(str, passwordPrompt(context)); }
catch (Exception e) { debugStackTrace(runtime, e); }
}
}
catch (Exception e) { debugStackTrace(runtime, e); }
}
if ( key == null && ! noClassDef ) {
try {
key = PEMInputOutput.readECPublicKey(new StringReader(strJava), passwd);
}
catch (NoClassDefFoundError e) { noClassDef = true; debugStackTrace(runtime, e); }
catch (Exception e) { debugStackTrace(runtime, e); }
}
if ( key == null && ! noClassDef ) {
try {
key = PEMInputOutput.readECPubKey(new StringReader(strJava));
}
catch (NoClassDefFoundError e) { noClassDef = true; debugStackTrace(runtime, e); }
catch (Exception e) { debugStackTrace(runtime, e); }
}
if ( key == null && ! noClassDef ) {
try {
key = readECPrivateKey(ecdsaFactory, str.getBytes());
}
catch (NoClassDefFoundError e) { noClassDef = true; debugStackTrace(runtime, e); }
catch (InvalidKeySpecException e) { debug(runtime, "PKeyEC could not read private key", e); }
catch (IOException e) { debug(runtime, "PKeyEC could not read private key", e); }
catch (RuntimeException e) {
if ( isKeyGenerationFailure(e) ) debug(runtime, "PKeyEC could not read private key", e);
else debugStackTrace(runtime, e);
}
}
// if ( key == null && ! noClassDef ) {
// try { // readECParameters
// ASN1ObjectIdentifier oid = ASN1ObjectIdentifier.getInstance(str.getBytes());
// ECNamedCurveParameterSpec paramSpec = ECNamedCurveTable.getParameterSpec(oid.getId());
//
// // ecdsaFactory.generatePublic(keySpec)
//
// }
// catch (NoClassDefFoundError e) { noClassDef = true; debugStackTrace(runtime, e); }
// catch (InvalidKeySpecException e) { debug(runtime, "PKeyEC could not read public key", e); }
// catch (IOException e) { debug(runtime, "PKeyEC could not read public key", e); }
// catch (RuntimeException e) {
// if ( isKeyGenerationFailure(e) ) debug(runtime, "PKeyEC could not read public key", e);
// else debugStackTrace(runtime, e);
// }
// }
if ( key == null ) key = tryPKCS8EncodedKey(runtime, ecdsaFactory, str.getBytes());
if ( key == null ) key = tryX509EncodedKey(runtime, ecdsaFactory, str.getBytes());
if ( key == null ) throw newECError(runtime, "Neither PUB key nor PRIV key:");
if ( key instanceof KeyPair ) {
final PublicKey pubKey = ((KeyPair) key).getPublic();
final PrivateKey privKey = ((KeyPair) key).getPrivate();
if ( ! ( privKey instanceof ECPrivateKey ) ) {
if ( privKey == null ) {
throw newECError(runtime, "Neither PUB key nor PRIV key: (private key is null)");
}
throw newECError(runtime, "Neither PUB key nor PRIV key: (invalid key type " + privKey.getClass().getName() + ")");
}
this.publicKey = (ECPublicKey) pubKey;
this.privateKey = (ECPrivateKey) privKey;
unwrapPrivateKeyWithName();
}
else if ( key instanceof ECPrivateKey ) {
this.privateKey = (ECPrivateKey) key;
unwrapPrivateKeyWithName();
}
else if ( key instanceof ECPublicKey ) {
this.publicKey = (ECPublicKey) key; this.privateKey = null;
}
else {
throw newECError(runtime, "Neither PUB key nor PRIV key: " + key.getClass().getName());
}
if ( publicKey != null ) {
publicKey.getParams().getCurve();
}
// TODO set curveName ?!?!?!?!?!?!?!
return this;
}
private void unwrapPrivateKeyWithName() {
final ECPrivateKey privKey = (ECPrivateKey) this.privateKey;
if ( privKey instanceof ECPrivateKeyWithName ) {
this.privateKey = ((ECPrivateKeyWithName) privKey).unwrap();
this.curveName = getCurveName( ((ECPrivateKeyWithName) privKey).getCurveNameOID() );
}
}
//private static ECNamedCurveParameterSpec readECParameters(final byte[] input) throws IOException {
// ASN1ObjectIdentifier oid = ASN1ObjectIdentifier.getInstance(input);
// return ECNamedCurveTable.getParameterSpec(oid.getId());
//}
@JRubyMethod
public IRubyObject check_key(final ThreadContext context) {
return context.runtime.getTrue(); // TODO not implemented stub
}
@JRubyMethod(name = "generate_key")
public PKeyEC generate_key(final ThreadContext context) {
// final ECDomainParameters params = getDomainParameters();
try {
ECGenParameterSpec genSpec = new ECGenParameterSpec(getCurveName());
KeyPairGenerator gen = SecurityHelper.getKeyPairGenerator("ECDSA"); // "BC"
gen.initialize(genSpec, new SecureRandom());
KeyPair pair = gen.generateKeyPair();
this.publicKey = (ECPublicKey) pair.getPublic();
this.privateKey = pair.getPrivate();
}
catch (GeneralSecurityException ex) {
throw newECError(context.runtime, ex.toString());
}
return this;
}
@JRubyMethod(name = "dsa_sign_asn1")
public IRubyObject dsa_sign_asn1(final ThreadContext context, final IRubyObject data) {
try {
ECNamedCurveParameterSpec params = ECNamedCurveTable.getParameterSpec(getCurveName());
ASN1ObjectIdentifier oid = getCurveOID(getCurveName());
ECNamedDomainParameters domainParams = new ECNamedDomainParameters(oid,
params.getCurve(), params.getG(), params.getN(), params.getH(), params.getSeed()
);
final ECDSASigner signer = new ECDSASigner();
final ECPrivateKey privKey = (ECPrivateKey) this.privateKey;
signer.init(true, new ECPrivateKeyParameters(privKey.getS(), domainParams));
final byte[] message = data.convertToString().getBytes();
BigInteger[] signature = signer.generateSignature(message); // [r, s]
// final byte[] r = signature[0].toByteArray();
// final byte[] s = signature[1].toByteArray();
// // ASN.1 encode as: 0x30 len 0x02 rlen (r) 0x02 slen (s)
// final int len = 1 + (1 + r.length) + 1 + (1 + s.length);
//
// final byte[] encoded = new byte[1 + 1 + len]; int i;
// encoded[0] = 0x30;
// encoded[1] = (byte) len;
// encoded[2] = 0x20;
// encoded[3] = (byte) r.length;
// System.arraycopy(r, 0, encoded, i = 4, r.length); i += r.length;
// encoded[i++] = 0x20;
// encoded[i++] = (byte) s.length;
// System.arraycopy(s, 0, encoded, i, s.length);
ByteArrayOutputStream bytes = new ByteArrayOutputStream();
ASN1OutputStream asn1 = new ASN1OutputStream(bytes);
ASN1EncodableVector v = new ASN1EncodableVector();
v.add(new ASN1Integer(signature[0])); // r
v.add(new ASN1Integer(signature[1])); // s
asn1.writeObject(new DLSequence(v));
return StringHelper.newString(context.runtime, bytes.buffer(), bytes.size());
}
catch (IOException ex) {
throw newECError(context.runtime, ex.toString());
}
catch (RuntimeException ex) {
throw newECError(context.runtime, ex.toString());
}
}
@JRubyMethod(name = "dh_compute_key")
public IRubyObject dh_compute_key(final ThreadContext context, final IRubyObject point) {
try {
KeyAgreement agreement = SecurityHelper.getKeyAgreement("ECDH"); // "BC"
agreement.init(getPrivateKey());
if ( point.isNil() ) {
agreement.doPhase(getPublicKey(), true);
}
else {
final ECPoint ecPoint = ((Point) point).asECPoint();
final String name = getCurveName();
KeyFactory keyFactory = KeyFactory.getInstance("EC"); // "BC"
ECParameterSpec spec = getParamSpec(name);
ECPublicKey ecPublicKey = (ECPublicKey) keyFactory.generatePublic(new ECPublicKeySpec(ecPoint, spec));
agreement.doPhase(ecPublicKey, true);
}
final byte[] secret = agreement.generateSecret();
return StringHelper.newString(context.runtime, secret);
}
catch (NoSuchAlgorithmException ex) {
throw newECError(context.runtime, ex.toString());
}
catch (InvalidKeyException ex) {
throw newECError(context.runtime, ex.toString());
}
catch (GeneralSecurityException ex) {
throw newECError(context.runtime, ex.toString());
}
}
private Group getGroup(boolean required) {
if (group == null) {
if (publicKey != null) {
return group = new Group(getRuntime(), this);
}
if (required) throw new IllegalStateException("no group (without public key)");
}
return group;
}
/**
* @return OpenSSL::PKey::EC::Group
*/
@JRubyMethod
public IRubyObject group() {
final Group group = getGroup(false);
return group == null ? getRuntime().getNil() : group;
}
@JRubyMethod(name = "group=")
public IRubyObject set_group(IRubyObject group) {
this.group = group.isNil() ? null : (Group) group;
return group;
}
/**
* @return OpenSSL::PKey::EC::Point
*/
@JRubyMethod
public IRubyObject public_key(final ThreadContext context) {
if ( publicKey == null ) return context.nil;
return new Point(context.runtime, publicKey, getGroup(true));
}
@JRubyMethod(name = "public_key=")
public IRubyObject set_public_key(final ThreadContext context, final IRubyObject arg) {
if ( ! ( arg instanceof Point ) ) {
throw context.runtime.newTypeError(arg, _EC(context.runtime).getClass("Point"));
}
final Point point = (Point) arg;
ECPublicKeySpec keySpec = new ECPublicKeySpec(point.asECPoint(), getParamSpec());
try {
this.publicKey = (ECPublicKey) SecurityHelper.getKeyFactory("ECDSA").generatePublic(keySpec);
return arg;
}
catch (GeneralSecurityException ex) {
throw newECError(context.runtime, ex.getMessage());
}
}
private static ECParameterSpec getParamSpec(final String curveName) {
ECNamedCurveParameterSpec spec = ECNamedCurveTable.getParameterSpec(curveName);
return new ECNamedCurveSpec(spec.getName(), spec.getCurve(), spec.getG(), spec.getN(), spec.getH(), spec.getSeed());
}
private ECParameterSpec getParamSpec() {
return getParamSpec(getCurveName());
}
/**
* @return OpenSSL::BN
*/
@JRubyMethod
public IRubyObject private_key(final ThreadContext context) {
if ( privateKey == null ) return context.nil;
return BN.newBN(context.runtime, ((ECPrivateKey) privateKey).getS());
}
@JRubyMethod(name = "private_key=")
public IRubyObject set_private_key(final ThreadContext context, final IRubyObject arg) {
final BigInteger s;
if ( arg instanceof BN ) {
s = ((BN) (arg)).getValue();
}
else {
s = (BigInteger) arg;
}
ECPrivateKeySpec keySpec = new ECPrivateKeySpec(s, getParamSpec());
try {
this.privateKey = SecurityHelper.getKeyFactory("ECDSA").generatePrivate(keySpec);
return arg;
}
catch (GeneralSecurityException ex) {
throw newECError(context.runtime, ex.getMessage());
}
}
@JRubyMethod(name = "public_key?")
public RubyBoolean public_p() {
return publicKey != null ? getRuntime().getTrue() : getRuntime().getFalse();
}
@JRubyMethod(name = "private_key?")
public RubyBoolean private_p() {
return privateKey != null ? getRuntime().getTrue() : getRuntime().getFalse();
}
@Override
@JRubyMethod(name = "to_der")
public RubyString to_der() {
final byte[] bytes;
try {
bytes = toDER();
}
catch (IOException e) {
throw newECError(getRuntime(), e.getMessage());
}
return StringHelper.newString(getRuntime(), bytes);
}
private byte[] toDER() throws IOException {
if ( publicKey != null && privateKey == null ) {
return publicKey.getEncoded();
}
if ( privateKey == null ) {
throw new IllegalStateException("private key as well as public key are null");
}
return privateKey.getEncoded();
}
@Override
@JRubyMethod(name = "to_pem", alias = "export", rest = true)
public RubyString to_pem(final IRubyObject[] args) {
Arity.checkArgumentCount(getRuntime(), args, 0, 2);
CipherSpec spec = null; char[] passwd = null;
if ( args.length > 0 ) {
spec = cipherSpec( args[0] );
if ( args.length > 1 ) passwd = password( args[1] );
}
try {
final StringWriter writer = new StringWriter();
if ( privateKey != null ) {
PEMInputOutput.writeECPrivateKey(writer, (ECPrivateKey) privateKey, spec, passwd);
}
else {
PEMInputOutput.writeECPublicKey(writer, publicKey);
}
return RubyString.newString(getRuntime(), writer.getBuffer());
}
catch (IOException ex) {
throw newECError(getRuntime(), ex.getMessage());
}
}
@JRubyClass(name = "OpenSSL::PKey::EC::Group")
public static final class Group extends RubyObject {
private static final ObjectAllocator ALLOCATOR = new ObjectAllocator() {
public Group allocate(Ruby runtime, RubyClass klass) { return new Group(runtime, klass); }
};
static void createGroup(final Ruby runtime, final RubyClass EC) {
RubyClass Group = EC.defineClassUnder("Group", runtime.getObject(), ALLOCATOR);
// OpenSSL::PKey::EC::Group::Error
RubyClass OpenSSLError = OpenSSL._OpenSSLError(runtime);
Group.defineClassUnder("Error", OpenSSLError, OpenSSLError.getAllocator());
Group.defineAnnotatedMethods(Group.class);
}
private transient PKeyEC key;
private ECParameterSpec paramSpec;
private RubyString curve_name;
public Group(Ruby runtime, RubyClass type) {
super(runtime, type);
}
Group(Ruby runtime, PKeyEC key) {
this(runtime, _EC(runtime).getClass("Group"));
this.key = key;
this.paramSpec = key.publicKey.getParams();
}
private String getCurveName() {
if (key != null) return key.getCurveName();
return curve_name.toString();
}
@JRubyMethod(rest = true, visibility = Visibility.PRIVATE)
public IRubyObject initialize(final ThreadContext context, final IRubyObject[] args) {
final Ruby runtime = context.runtime;
if ( Arity.checkArgumentCount(runtime, args, 1, 4) == 1 ) {
IRubyObject arg = args[0];
if ( arg instanceof Group ) {
IRubyObject curve_name = ((Group) arg).curve_name(context);
this.curve_name = curve_name.isNil() ? null : (RubyString) curve_name;
return this;
}
this.curve_name = ((RubyString) arg);
// TODO PEM/DER parsing not implemented
}
return this;
}
@Override
@JRubyMethod(name = { "==", "eql?" })
public IRubyObject op_equal(final ThreadContext context, final IRubyObject obj) {
if ( paramSpec == null ) return context.nil;
if ( obj instanceof Group ) {
final Group that = (Group) obj;
boolean equals = this.paramSpec.equals(that.paramSpec);
return context.runtime.newBoolean(equals);
}
return context.runtime.getFalse();
}
@JRubyMethod
public IRubyObject curve_name(final ThreadContext context) {
if (curve_name == null) {
String prefix, curveName = key.getCurveName();
// BC 1.54: "brainpoolP512t1" 1.55: "brainpoolp512t1"
if (curveName.startsWith(prefix = "brainpoolp")) {
curveName = "brainpoolP" + curveName.substring(prefix.length());
}
curve_name = RubyString.newString(context.runtime, curveName);
}
return curve_name.dup();
}
@JRubyMethod
public IRubyObject order(final ThreadContext context) {
if ( paramSpec == null ) return context.nil;
return BN.newBN(context.runtime, paramSpec.getOrder());
}
@JRubyMethod
public IRubyObject cofactor(final ThreadContext context) {
if ( paramSpec == null ) return context.nil;
return context.runtime.newFixnum(paramSpec.getCofactor());
}
@JRubyMethod
public IRubyObject seed(final ThreadContext context) {
if ( paramSpec == null ) return context.nil;
final byte[] seed = paramSpec.getCurve().getSeed();
return seed == null ? context.nil : StringHelper.newString(context.runtime, seed);
}
@JRubyMethod
public IRubyObject degree(final ThreadContext context) {
if ( paramSpec == null ) return context.nil;
final int fieldSize = paramSpec.getCurve().getField().getFieldSize();
return context.runtime.newFixnum(fieldSize);
}
@JRubyMethod
public IRubyObject generator(final ThreadContext context) {
if ( paramSpec == null ) return context.nil;
final ECPoint generator = paramSpec.getGenerator();
//final int bitLength = paramSpec.getOrder().bitLength();
return new Point(context.runtime, generator, this);
}
@JRubyMethod(name = { "to_pem" }, alias = "export", rest = true)
public RubyString to_pem(final ThreadContext context, final IRubyObject[] args) {
Arity.checkArgumentCount(context.runtime, args, 0, 2);
CipherSpec spec = null; char[] passwd = null;
if ( args.length > 0 ) {
spec = cipherSpec( args[0] );
if ( args.length > 1 ) passwd = password(args[1]);
}
try {
final StringWriter writer = new StringWriter();
PEMInputOutput.writeECParameters(writer, getCurveOID(getCurveName()), spec, passwd);
return RubyString.newString(context.runtime, writer.getBuffer());
}
catch (IOException ex) {
throw newECError(context.runtime, ex.getMessage());
}
}
final EllipticCurve getCurve() {
if (paramSpec == null) {
paramSpec = getParamSpec(getCurveName());
}
return paramSpec.getCurve();
}
// @Override
// @JRubyMethod
// @SuppressWarnings("unchecked")
// public IRubyObject inspect() {
// final EllipticCurve curve = getCurve();
// final StringBuilder part = new StringBuilder();
// String cname = getMetaClass().getRealClass().getName();
// part.append("#<").append(cname).append(":0x");
// part.append(Integer.toHexString(System.identityHashCode(this)));
// // part.append(' ');
// part.append(" a:").append(curve.getA()).append(" b:").append(curve.getA());
// return RubyString.newString(getRuntime(), part.append('>'));
// }
}
@JRubyClass(name = "OpenSSL::PKey::EC::Point")
public static final class Point extends RubyObject {
private static final ObjectAllocator ALLOCATOR = new ObjectAllocator() {
public Point allocate(Ruby runtime, RubyClass klass) { return new Point(runtime, klass); }
};
static void createPoint(final Ruby runtime, final RubyClass EC) {
RubyClass Point = EC.defineClassUnder("Point", runtime.getObject(), ALLOCATOR);
// OpenSSL::PKey::EC::Point::Error
RubyClass OpenSSLError = OpenSSL._OpenSSLError(runtime);
Point.defineClassUnder("Error", OpenSSLError, OpenSSLError.getAllocator());
Point.defineAnnotatedMethods(Point.class);
}
public Point(Ruby runtime, RubyClass type) {
super(runtime, type);
}
// private transient ECPublicKey publicKey;
private ECPoint point;
//private int bitLength;
private Group group;
Point(Ruby runtime, ECPublicKey publicKey, Group group) {
this(runtime, _EC(runtime).getClass("Point"));
//this.publicKey = publicKey;
this.point = publicKey.getW();
this.group = group;
}
Point(Ruby runtime, ECPoint point, Group group) {
this(runtime, _EC(runtime).getClass("Point"));
this.point = point;
this.group = group;
}
private static RaiseException newError(final Ruby runtime, final String message) {
final RubyClass Error = _EC(runtime).getClass("Point").getClass("Error");
return Utils.newError(runtime, Error, message);
}
@JRubyMethod(rest = true, visibility = Visibility.PRIVATE)
public IRubyObject initialize(final ThreadContext context, final IRubyObject[] args) {
final Ruby runtime = context.runtime;
final int argc = Arity.checkArgumentCount(runtime, args, 1, 2);
final IRubyObject arg = args[0];
if ( arg instanceof Point ) {
this.group = ((Point) arg).group;
this.point = ((Point) arg).point;
return this;
}
if ( arg instanceof Group ) {
this.group = (Group) arg;
}
if ( argc == 2 ) { // (group, bn)
final byte[] encoded = ((BN) args[1]).getValue().abs().toByteArray();
try {
this.point = ECPointUtil.decodePoint(group.getCurve(), encoded);
}
catch (IllegalArgumentException ex) {
// MRI: OpenSSL::PKey::EC::Point::Error: invalid encoding
throw newError(context.runtime, ex.getMessage());
}
}
return this;
}
@Override
@JRubyMethod(name = { "==", "eql?" })
public IRubyObject op_equal(final ThreadContext context, final IRubyObject obj) {
if (obj instanceof Point) {
final Point that = (Point) obj;
boolean equals = this.point.equals(that.point);
return context.runtime.newBoolean(equals);
}
return context.runtime.getFalse();
}
/**
* @return OpenSSL::PKey::EC::Group
*/
@JRubyMethod
public IRubyObject group() {
return group == null ? getRuntime().getNil() : group;
}
private ECPoint asECPoint() {
return point; // return publicKey.getW();
}
private int bitLength() {
return group.paramSpec.getOrder().bitLength();
}
@JRubyMethod
public BN to_bn(final ThreadContext context) {
final byte[] encoded = encode(bitLength(), point);
return BN.newBN(context.runtime, new BigInteger(1, encoded));
}
private boolean isInfinity() {
return point == ECPoint.POINT_INFINITY;
}
@JRubyMethod(name = "infinity?")
public RubyBoolean infinity_p() {
return getRuntime().newBoolean( isInfinity() );
}
@JRubyMethod(name = "set_to_infinity!")
public IRubyObject set_to_infinity_b() {
this.point = ECPoint.POINT_INFINITY;
return this;
}
@Override
@JRubyMethod
@SuppressWarnings("unchecked")
public IRubyObject inspect() {
VariableEntry entry = new VariableEntry( "group", group == null ? (Object) "nil" : group );
return ObjectSupport.inspect(this, (List) Collections.singletonList(entry));
}
}
static byte[] encode(final ECPublicKey pubKey) {
return encode(pubKey.getParams().getOrder().bitLength(), pubKey.getW());
}
private static byte[] encode(final int bitLength, final ECPoint point) {
if ( point == ECPoint.POINT_INFINITY ) return new byte[1];
final int bytesLength = (bitLength + 7) / 8;
byte[] encoded = new byte[1 + bytesLength + bytesLength];
encoded[0] = 0x04;
addIntBytes(point.getAffineX(), bytesLength, encoded, 1);
addIntBytes(point.getAffineY(), bytesLength, encoded, 1 + bytesLength);
return encoded;
}
private static void addIntBytes(BigInteger i, final int length, final byte[] dest, final int destOffset) {
final byte[] bytes = i.toByteArray();
if (length < bytes.length) {
System.arraycopy(bytes, bytes.length - length, dest, destOffset, length);
}
else if (length > bytes.length) {
System.arraycopy(bytes, 0, dest, destOffset + (length - bytes.length), bytes.length);
}
else {
System.arraycopy(bytes, 0, dest, destOffset, length);
}
}
} jruby-openssl-0.9.21/src/main/java/org/jruby/ext/openssl/PKeyRSA.java 0000664 0000000 0000000 00000076653 13136616216 0025367 0 ustar 00root root 0000000 0000000 /***** BEGIN LICENSE BLOCK *****
* Version: EPL 1.0/GPL 2.0/LGPL 2.1
*
* The contents of this file are subject to the Eclipse Public
* License Version 1.0 (the "License"); you may not use this file
* except in compliance with the License. You may obtain a copy of
* the License at http://www.eclipse.org/legal/epl-v10.html
*
* Software distributed under the License is distributed on an "AS
* IS" basis, WITHOUT WARRANTY OF ANY KIND, either express or
* implied. See the License for the specific language governing
* rights and limitations under the License.
*
* Copyright (C) 2006, 2007 Ola Bini
*
* Alternatively, the contents of this file may be used under the terms of
* either of the GNU General Public License Version 2 or later (the "GPL"),
* or the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
* in which case the provisions of the GPL or the LGPL are applicable instead
* of those above. If you wish to allow use of your version of this file only
* under the terms of either the GPL or the LGPL, and not to allow others to
* use your version of this file under the terms of the EPL, indicate your
* decision by deleting the provisions above and replace them with the notice
* and other provisions required by the GPL or the LGPL. If you do not delete
* the provisions above, a recipient may use your version of this file under
* the terms of any one of the EPL, the GPL or the LGPL.
***** END LICENSE BLOCK *****/
package org.jruby.ext.openssl;
import java.io.IOException;
import java.io.StringReader;
import java.io.StringWriter;
import java.math.BigInteger;
import java.security.GeneralSecurityException;
import java.security.InvalidAlgorithmParameterException;
import java.security.Key;
import java.security.KeyFactory;
import java.security.KeyPair;
import java.security.KeyPairGenerator;
import java.security.NoSuchAlgorithmException;
import java.security.PrivateKey;
import java.security.PublicKey;
import java.security.SecureRandom;
import java.security.interfaces.RSAPrivateCrtKey;
import java.security.interfaces.RSAPublicKey;
import java.security.spec.InvalidKeySpecException;
import java.security.spec.RSAKeyGenParameterSpec;
import java.security.spec.RSAPrivateCrtKeySpec;
import java.security.spec.RSAPublicKeySpec;
import static javax.crypto.Cipher.*;
import org.jruby.Ruby;
import org.jruby.RubyClass;
import org.jruby.RubyBignum;
import org.jruby.RubyBoolean;
import org.jruby.RubyFixnum;
import org.jruby.RubyHash;
import org.jruby.RubyModule;
import org.jruby.RubyNumeric;
import org.jruby.RubyString;
import org.jruby.anno.JRubyMethod;
import org.jruby.exceptions.RaiseException;
import org.jruby.runtime.Arity;
import org.jruby.runtime.ObjectAllocator;
import org.jruby.runtime.ThreadContext;
import org.jruby.runtime.builtin.IRubyObject;
import org.jruby.runtime.Visibility;
import org.jruby.ext.openssl.impl.CipherSpec;
import org.jruby.ext.openssl.x509store.PEMInputOutput;
import static org.jruby.ext.openssl.OpenSSL.*;
import static org.jruby.ext.openssl.PKey._PKey;
import static org.jruby.ext.openssl.impl.PKey.readRSAPrivateKey;
import static org.jruby.ext.openssl.impl.PKey.readRSAPublicKey;
import static org.jruby.ext.openssl.impl.PKey.toDerRSAKey;
/**
* @author Ola Bini
*/
public class PKeyRSA extends PKey {
private static final long serialVersionUID = -2540383779256333197L;
private static final ObjectAllocator ALLOCATOR = new ObjectAllocator() {
public PKeyRSA allocate(Ruby runtime, RubyClass klass) { return new PKeyRSA(runtime, klass); }
};
public static void createPKeyRSA(final Ruby runtime, final RubyModule PKey, final RubyClass PKeyPKey) {
RubyClass RSA = PKey.defineClassUnder("RSA", PKeyPKey, ALLOCATOR);
RubyClass PKeyError = PKey.getClass("PKeyError");
PKey.defineClassUnder("RSAError", PKeyError, PKeyError.getAllocator());
RSA.defineAnnotatedMethods(PKeyRSA.class);
RSA.setConstant("PKCS1_PADDING", runtime.newFixnum(1));
RSA.setConstant("SSLV23_PADDING", runtime.newFixnum(2));
RSA.setConstant("NO_PADDING", runtime.newFixnum(3));
RSA.setConstant("PKCS1_OAEP_PADDING", runtime.newFixnum(4));
}
static RubyClass _RSA(final Ruby runtime) {
return _PKey(runtime).getClass("RSA");
}
public static RaiseException newRSAError(Ruby runtime, String message) {
return Utils.newError(runtime, _PKey(runtime).getClass("RSAError"), message);
}
static RaiseException newRSAError(Ruby runtime, Throwable cause) {
return Utils.newError(runtime, _PKey(runtime).getClass("RSAError"), cause.getMessage(), cause);
}
public PKeyRSA(Ruby runtime, RubyClass type) {
super(runtime, type);
}
public PKeyRSA(Ruby runtime, RubyClass type, RSAPrivateCrtKey privKey, RSAPublicKey pubKey) {
super(runtime, type);
this.privateKey = privKey;
this.publicKey = pubKey;
}
PKeyRSA(Ruby runtime, RSAPublicKey pubKey) {
this(runtime, _RSA(runtime), null, pubKey);
}
private volatile RSAPublicKey publicKey;
private volatile transient RSAPrivateCrtKey privateKey;
// fields to hold individual RSAPublicKeySpec components. this allows
// a public key to be constructed incrementally, as required by the
// current implementation of Net::SSH.
// (see net-ssh-1.1.2/lib/net/ssh/transport/ossl/buffer.rb #read_keyblob)
private transient volatile BigInteger rsa_e;
private transient volatile BigInteger rsa_n;
private transient volatile BigInteger rsa_d;
private transient volatile BigInteger rsa_p;
private transient volatile BigInteger rsa_q;
private transient volatile BigInteger rsa_dmp1;
private transient volatile BigInteger rsa_dmq1;
private transient volatile BigInteger rsa_iqmp;
@Override
public IRubyObject initialize_copy(final IRubyObject original) {
if (this == original) return this;
checkFrozen();
final PKeyRSA that = (PKeyRSA) original;
this.publicKey = that.publicKey;
this.privateKey = that.privateKey;
this.rsa_e = that.rsa_e;
this.rsa_n = that.rsa_n;
this.rsa_d = that.rsa_d;
this.rsa_p = that.rsa_p;
this.rsa_q = that.rsa_q;
this.rsa_dmp1 = that.rsa_dmp1;
this.rsa_dmq1 = that.rsa_dmq1;
this.rsa_iqmp = that.rsa_iqmp;
return this;
}
@Override
public PublicKey getPublicKey() { return publicKey; }
@Override
public PrivateKey getPrivateKey() { return privateKey; }
@Override
public String getAlgorithm() { return "RSA"; }
@JRubyMethod(name = "generate", meta = true, rest = true)
public static IRubyObject generate(IRubyObject self, IRubyObject[] args) {
final Ruby runtime = self.getRuntime();
BigInteger exp = RSAKeyGenParameterSpec.F4;
if ( Arity.checkArgumentCount(runtime, args, 1, 2) == 2 ) {
if (args[1] instanceof RubyFixnum) {
exp = BigInteger.valueOf(RubyNumeric.num2long(args[1]));
} else {
exp = ((RubyBignum) args[1]).getValue();
}
}
final int keySize = RubyNumeric.fix2int(args[0]);
return rsaGenerate(runtime, new PKeyRSA(runtime, (RubyClass) self), keySize, exp);
}
/*
* c: rsa_generate
*/
private static PKeyRSA rsaGenerate(final Ruby runtime,
PKeyRSA rsa, int keySize, BigInteger exp) throws RaiseException {
try {
KeyPairGenerator gen = SecurityHelper.getKeyPairGenerator("RSA");
if ( "IBMJCEFIPS".equals( gen.getProvider().getName() ) ) {
gen.initialize(keySize); // IBMJCEFIPS does not support parameters
} else {
gen.initialize(new RSAKeyGenParameterSpec(keySize, exp), getSecureRandom(runtime));
}
KeyPair pair = gen.generateKeyPair();
rsa.privateKey = (RSAPrivateCrtKey) pair.getPrivate();
rsa.publicKey = (RSAPublicKey) pair.getPublic();
}
catch (NoSuchAlgorithmException e) {
throw newRSAError(runtime, e.getMessage());
}
catch (InvalidAlgorithmParameterException e) {
throw newRSAError(runtime, e.getMessage());
}
catch (RuntimeException e) {
throw newRSAError(rsa.getRuntime(), e);
}
return rsa;
}
static PKeyRSA newInstance(final Ruby runtime, final PublicKey publicKey) {
//if ( publicKey instanceof RSAPublicKey ) {
return new PKeyRSA(runtime, (RSAPublicKey) publicKey);
//}
}
@JRubyMethod(rest = true, visibility = Visibility.PRIVATE)
public IRubyObject initialize(final ThreadContext context, final IRubyObject[] args) {
final Ruby runtime = context.runtime;
if ( Arity.checkArgumentCount(runtime, args, 0, 2) == 0 ) {
privateKey = null; publicKey = null; return this;
}
IRubyObject arg = args[0]; IRubyObject pass = null;
if ( args.length > 1 ) pass = args[1];
if ( arg instanceof RubyFixnum ) {
int keySize = RubyNumeric.fix2int((RubyFixnum) arg);
BigInteger exp = RSAKeyGenParameterSpec.F4;
if ( pass != null && ! pass.isNil() ) {
exp = BigInteger.valueOf(RubyNumeric.num2long(pass));
}
return rsaGenerate(runtime, this, keySize, exp);
}
final char[] passwd = password(pass);
final RubyString str = readInitArg(context, arg);
final String strJava = str.toString();
Object key = null;
final KeyFactory rsaFactory;
try {
rsaFactory = SecurityHelper.getKeyFactory("RSA");
}
catch (NoSuchAlgorithmException e) {
throw runtime.newRuntimeError("unsupported key algorithm (RSA)");
}
catch (RuntimeException e) {
throw runtime.newRuntimeError("unsupported key algorithm (RSA) " + e);
}
// TODO: ugly NoClassDefFoundError catching for no BC env. How can we remove this?
boolean noClassDef = false;
if ( key == null && ! noClassDef ) { // PEM_read_bio_RSAPrivateKey
try {
key = readPrivateKey(strJava, passwd);
}
catch (NoClassDefFoundError e) { noClassDef = true; debugStackTrace(runtime, e); }
catch (PEMInputOutput.PasswordRequiredException retry) {
if ( ttySTDIN(context) ) {
try { key = readPrivateKey(strJava, passwordPrompt(context)); }
catch (Exception e) { debugStackTrace(runtime, e); }
}
}
catch (Exception e) { debugStackTrace(runtime, e); }
}
if ( key == null && ! noClassDef ) { // PEM_read_bio_RSAPublicKey
try {
key = PEMInputOutput.readRSAPublicKey(new StringReader(strJava), passwd);
}
catch (NoClassDefFoundError e) { noClassDef = true; debugStackTrace(runtime, e); }
catch (Exception e) { debugStackTrace(runtime, e); }
}
if ( key == null && ! noClassDef ) { // PEM_read_bio_RSA_PUBKEY
try {
key = PEMInputOutput.readRSAPubKey(new StringReader(strJava));
}
catch (NoClassDefFoundError e) { noClassDef = true; debugStackTrace(runtime, e); }
catch (Exception e) { debugStackTrace(runtime, e); }
}
if ( key == null && ! noClassDef ) { // d2i_RSAPrivateKey_bio
try { key = readRSAPrivateKey(rsaFactory, str.getBytes()); }
catch (NoClassDefFoundError e) { noClassDef = true; debugStackTrace(runtime, e); }
catch (InvalidKeySpecException e) { debug(runtime, "PKeyRSA could not read private key", e); }
catch (IOException e) { debug(runtime, "PKeyRSA could not read private key", e); }
catch (RuntimeException e) {
if ( isKeyGenerationFailure(e) ) debug(runtime, "PKeyRSA could not read private key", e);
else debugStackTrace(runtime, e);
}
}
if ( key == null && ! noClassDef ) { // d2i_RSAPublicKey_bio
try { key = readRSAPublicKey(rsaFactory, str.getBytes()); }
catch (NoClassDefFoundError e) { noClassDef = true; debugStackTrace(runtime, e); }
catch (InvalidKeySpecException e) { debug(runtime, "PKeyRSA could not read public key", e); }
catch (IOException e) { debug(runtime, "PKeyRSA could not read public key", e); }
catch (RuntimeException e) {
if ( isKeyGenerationFailure(e) ) debug(runtime, "PKeyRSA could not read public key", e);
else debugStackTrace(runtime, e);
}
}
if ( key == null ) key = tryPKCS8EncodedKey(runtime, rsaFactory, str.getBytes());
if ( key == null ) key = tryX509EncodedKey(runtime, rsaFactory, str.getBytes());
if ( key == null ) throw newRSAError(runtime, "Neither PUB key nor PRIV key:");
if ( key instanceof KeyPair ) {
PublicKey publicKey = ((KeyPair) key).getPublic();
PrivateKey privateKey = ((KeyPair) key).getPrivate();
if ( ! ( privateKey instanceof RSAPrivateCrtKey ) ) {
if ( privateKey == null ) {
throw newRSAError(runtime, "Neither PUB key nor PRIV key: (private key is null)");
}
throw newRSAError(runtime, "Neither PUB key nor PRIV key: (invalid key type " + privateKey.getClass().getName() + ")");
}
this.privateKey = (RSAPrivateCrtKey) privateKey;
this.publicKey = (RSAPublicKey) publicKey;
}
else if ( key instanceof RSAPrivateCrtKey ) {
this.privateKey = (RSAPrivateCrtKey) key;
try {
this.publicKey = (RSAPublicKey) rsaFactory.generatePublic(new RSAPublicKeySpec(privateKey.getModulus(), privateKey.getPublicExponent()));
} catch (GeneralSecurityException e) {
throw newRSAError(runtime, e.getMessage());
} catch (RuntimeException e) {
debugStackTrace(runtime, e);
throw newRSAError(runtime, e.toString());
}
}
else if ( key instanceof RSAPublicKey ) {
this.publicKey = (RSAPublicKey) key; this.privateKey = null;
}
else {
throw newRSAError(runtime, "Neither PUB key nor PRIV key: " + key.getClass().getName());
}
return this;
}
@JRubyMethod(name = "public?")
public RubyBoolean public_p() {
return publicKey != null ? getRuntime().getTrue() : getRuntime().getFalse();
}
@Override
public boolean isPrivateKey() {
return privateKey != null;
}
@JRubyMethod(name = "private?")
public RubyBoolean private_p() {
return getRuntime().newBoolean(isPrivateKey());
}
@Override
@JRubyMethod(name = "to_der")
public RubyString to_der() {
final byte[] bytes;
try {
bytes = toDerRSAKey(publicKey, privateKey);
}
catch (NoClassDefFoundError e) {
throw newRSAError(getRuntime(), bcExceptionMessage(e));
}
catch (IOException e) {
throw newRSAError(getRuntime(), e.getMessage());
}
return StringHelper.newString(getRuntime(), bytes);
}
@JRubyMethod
public PKeyRSA public_key() {
return new PKeyRSA(getRuntime(), this.publicKey);
}
@JRubyMethod
public IRubyObject params(final ThreadContext context) {
final Ruby runtime = context.runtime;
RubyHash hash = RubyHash.newHash(runtime);
if ( privateKey != null ) {
hash.op_aset(context, runtime.newString("iqmp"), BN.newBN(runtime, privateKey.getCrtCoefficient()));
hash.op_aset(context, runtime.newString("n"), BN.newBN(runtime, privateKey.getModulus()));
hash.op_aset(context, runtime.newString("d"), BN.newBN(runtime, privateKey.getPrivateExponent()));
hash.op_aset(context, runtime.newString("p"), BN.newBN(runtime, privateKey.getPrimeP()));
hash.op_aset(context, runtime.newString("e"), BN.newBN(runtime, privateKey.getPublicExponent()));
hash.op_aset(context, runtime.newString("q"), BN.newBN(runtime, privateKey.getPrimeQ()));
hash.op_aset(context, runtime.newString("dmq1"), BN.newBN(runtime, privateKey.getPrimeExponentQ()));
hash.op_aset(context, runtime.newString("dmp1"), BN.newBN(runtime, privateKey.getPrimeExponentP()));
} else {
hash.op_aset(context, runtime.newString("iqmp"), BN.newBN(runtime, BigInteger.ZERO));
hash.op_aset(context, runtime.newString("n"), BN.newBN(runtime, publicKey.getModulus()));
hash.op_aset(context, runtime.newString("d"), BN.newBN(runtime, BigInteger.ZERO));
hash.op_aset(context, runtime.newString("p"), BN.newBN(runtime, BigInteger.ZERO));
hash.op_aset(context, runtime.newString("e"), BN.newBN(runtime, publicKey.getPublicExponent()));
hash.op_aset(context, runtime.newString("q"), BN.newBN(runtime, BigInteger.ZERO));
hash.op_aset(context, runtime.newString("dmq1"), BN.newBN(runtime, BigInteger.ZERO));
hash.op_aset(context, runtime.newString("dmp1"), BN.newBN(runtime, BigInteger.ZERO));
}
return hash;
}
@JRubyMethod
public RubyString to_text() {
StringBuilder result = new StringBuilder();
if (privateKey != null) {
int len = privateKey.getModulus().bitLength();
result.append("Private-Key: (").append(len).append(" bit)").append('\n');
result.append("modulus:");
addSplittedAndFormatted(result, privateKey.getModulus());
result.append("publicExponent: ").append(privateKey.getPublicExponent()).append(" (0x").append(privateKey.getPublicExponent().toString(16)).append(")\n");
result.append("privateExponent:");
addSplittedAndFormatted(result, privateKey.getPrivateExponent());
result.append("prime1:");
addSplittedAndFormatted(result, privateKey.getPrimeP());
result.append("prime2:");
addSplittedAndFormatted(result, privateKey.getPrimeQ());
result.append("exponent1:");
addSplittedAndFormatted(result, privateKey.getPrimeExponentP());
result.append("exponent2:");
addSplittedAndFormatted(result, privateKey.getPrimeExponentQ());
result.append("coefficient:");
addSplittedAndFormatted(result, privateKey.getCrtCoefficient());
} else {
int len = publicKey.getModulus().bitLength();
result.append("Modulus (").append(len).append(" bit):");
addSplittedAndFormatted(result, publicKey.getModulus());
result.append("Exponent: ").append(publicKey.getPublicExponent()).append(" (0x").append(publicKey.getPublicExponent().toString(16)).append(")\n");
}
return RubyString.newString(getRuntime(), result);
}
@Override
@JRubyMethod(name = { "to_pem", "to_s" }, alias = "export", rest = true)
public RubyString to_pem(final IRubyObject[] args) {
Arity.checkArgumentCount(getRuntime(), args, 0, 2);
CipherSpec spec = null; char[] passwd = null;
if ( args.length > 0 ) {
spec = cipherSpec( args[0] );
if ( args.length > 1 ) passwd = password(args[1]);
}
try {
final StringWriter writer = new StringWriter();
if ( privateKey != null ) {
PEMInputOutput.writeRSAPrivateKey(writer, privateKey, spec, passwd);
}
else {
PEMInputOutput.writeRSAPublicKey(writer, publicKey);
}
return RubyString.newString(getRuntime(), writer.getBuffer());
}
catch (NoClassDefFoundError ncdfe) {
throw newRSAError(getRuntime(), bcExceptionMessage(ncdfe));
}
catch (IOException ioe) {
throw newRSAError(getRuntime(), ioe.getMessage());
}
}
private String getPadding(final int padding) {
if ( padding < 1 || padding > 4 ) {
throw newRSAError(getRuntime(), "");
}
// BC accepts "/NONE/*" but SunJCE doesn't. use "/ECB/*"
String p = "/ECB/PKCS1Padding";
if ( padding == 3 ) {
p = "/ECB/NoPadding";
} else if ( padding == 4 ) {
p = "/ECB/OAEPWithSHA1AndMGF1Padding";
} else if ( padding == 2 ) {
p = "/ECB/ISO9796-1Padding";
}
return p;
}
@JRubyMethod(rest = true)
public IRubyObject private_encrypt(final ThreadContext context, final IRubyObject[] args) {
int padding = 1;
if ( Arity.checkArgumentCount(context.runtime, args, 1, 2) == 2 && ! args[1].isNil() ) {
padding = RubyNumeric.fix2int(args[1]);
}
if ( privateKey == null ) throw newRSAError(context.runtime, "incomplete RSA");
return doCipherRSA(context.runtime, args[0], padding, ENCRYPT_MODE, privateKey);
}
@JRubyMethod(rest = true)
public IRubyObject private_decrypt(final ThreadContext context, final IRubyObject[] args) {
int padding = 1;
if ( Arity.checkArgumentCount(context.runtime, args, 1, 2) == 2 && ! args[1].isNil()) {
padding = RubyNumeric.fix2int(args[1]);
}
if ( privateKey == null ) throw newRSAError(context.runtime, "incomplete RSA");
return doCipherRSA(context.runtime, args[0], padding, DECRYPT_MODE, privateKey);
}
@JRubyMethod(rest = true)
public IRubyObject public_encrypt(final ThreadContext context, final IRubyObject[] args) {
int padding = 1;
if ( Arity.checkArgumentCount(context.runtime, args, 1, 2) == 2 && ! args[1].isNil()) {
padding = RubyNumeric.fix2int(args[1]);
}
if ( publicKey == null ) throw newRSAError(context.runtime, "incomplete RSA");
return doCipherRSA(context.runtime, args[0], padding, ENCRYPT_MODE, publicKey);
}
@JRubyMethod(rest = true)
public IRubyObject public_decrypt(final ThreadContext context, final IRubyObject[] args) {
int padding = 1;
if ( Arity.checkArgumentCount(context.runtime, args, 1, 2) == 2 && ! args[1].isNil() ) {
padding = RubyNumeric.fix2int(args[1]);
}
if ( publicKey == null ) throw newRSAError(context.runtime, "incomplete RSA");
return doCipherRSA(context.runtime, args[0], padding, DECRYPT_MODE, publicKey);
}
private RubyString doCipherRSA(final Ruby runtime,
final IRubyObject content, final int padding,
final int initMode, final Key initKey) {
final String cipherPadding = getPadding(padding);
final RubyString buffer = content.convertToString();
try {
javax.crypto.Cipher engine = SecurityHelper.getCipher("RSA" + cipherPadding);
engine.init(initMode, initKey);
byte[] output = engine.doFinal(buffer.getBytes());
return StringHelper.newString(runtime, output);
}
catch (GeneralSecurityException gse) {
throw newRSAError(runtime, gse.getMessage());
}
}
@JRubyMethod(name="d=")
public synchronized IRubyObject set_d(final ThreadContext context, IRubyObject value) {
if ( privateKey != null ) {
throw newRSAError(context.runtime, "illegal modification");
}
rsa_d = BN.getBigInteger(value);
generatePrivateKeyIfParams(context);
return value;
}
@JRubyMethod(name="p=")
public synchronized IRubyObject set_p(final ThreadContext context, IRubyObject value) {
if ( privateKey != null ) {
throw newRSAError(context.runtime, "illegal modification");
}
rsa_p = BN.getBigInteger(value);
generatePrivateKeyIfParams(context);
return value;
}
@JRubyMethod(name="q=")
public synchronized IRubyObject set_q(final ThreadContext context, IRubyObject value) {
if ( privateKey != null ) {
throw newRSAError(context.runtime, "illegal modification");
}
rsa_q = BN.getBigInteger(value);
generatePrivateKeyIfParams(context);
return value;
}
@JRubyMethod(name="dmp1=")
public synchronized IRubyObject set_dmp1(final ThreadContext context, IRubyObject value) {
if ( privateKey != null ) {
throw newRSAError(context.runtime, "illegal modification");
}
rsa_dmp1 = BN.asBigInteger(value);
generatePrivateKeyIfParams(context);
return value;
}
@JRubyMethod(name="dmq1=")
public synchronized IRubyObject set_dmq1(final ThreadContext context, IRubyObject value) {
if ( privateKey != null ) {
throw newRSAError(context.runtime, "illegal modification");
}
rsa_dmq1 = BN.asBigInteger(value);
generatePrivateKeyIfParams(context);
return value;
}
@JRubyMethod(name="iqmp=")
public synchronized IRubyObject set_iqmp(final ThreadContext context, IRubyObject value) {
if ( privateKey != null ) {
throw newRSAError(context.runtime, "illegal modification");
}
rsa_iqmp = BN.asBigInteger(value);
generatePrivateKeyIfParams(context);
return value;
}
@JRubyMethod(name="iqmp")
public synchronized IRubyObject get_iqmp() {
BigInteger iqmp;
if (privateKey != null) {
iqmp = privateKey.getCrtCoefficient();
} else {
iqmp = rsa_iqmp;
}
if (iqmp != null) {
return BN.newBN(getRuntime(), iqmp);
}
return getRuntime().getNil();
}
@JRubyMethod(name="dmp1")
public synchronized IRubyObject get_dmp1() {
BigInteger dmp1;
if (privateKey != null) {
dmp1 = privateKey.getPrimeExponentP();
} else {
dmp1 = rsa_dmp1;
}
if (dmp1 != null) {
return BN.newBN(getRuntime(), dmp1);
}
return getRuntime().getNil();
}
@JRubyMethod(name="dmq1")
public synchronized IRubyObject get_dmq1() {
BigInteger dmq1;
if (privateKey != null) {
dmq1 = privateKey.getPrimeExponentQ();
} else {
dmq1 = rsa_dmq1;
}
if (dmq1 != null) {
return BN.newBN(getRuntime(), dmq1);
}
return getRuntime().getNil();
}
@JRubyMethod(name="d")
public synchronized IRubyObject get_d() {
BigInteger d;
if (privateKey != null) {
d = privateKey.getPrivateExponent();
} else {
d = rsa_d;
}
if (d != null) {
return BN.newBN(getRuntime(), d);
}
return getRuntime().getNil();
}
@JRubyMethod(name="p")
public synchronized IRubyObject get_p() {
BigInteger p;
if (privateKey != null) {
p = privateKey.getPrimeP();
} else {
p = rsa_p;
}
if (p != null) {
return BN.newBN(getRuntime(), p);
}
return getRuntime().getNil();
}
@JRubyMethod(name="q")
public synchronized IRubyObject get_q() {
BigInteger q;
if (privateKey != null) {
q = privateKey.getPrimeQ();
} else {
q = rsa_q;
}
if (q != null) {
return BN.newBN(getRuntime(), q);
}
return getRuntime().getNil();
}
private BigInteger getPublicExponent() {
if (publicKey != null) {
return publicKey.getPublicExponent();
} else if (privateKey != null) {
return privateKey.getPublicExponent();
} else {
return rsa_e;
}
}
@JRubyMethod(name="e")
public synchronized IRubyObject get_e() {
BigInteger e = getPublicExponent();
if (e != null) {
return BN.newBN(getRuntime(), e);
}
return getRuntime().getNil();
}
@JRubyMethod(name="e=")
public synchronized IRubyObject set_e(final ThreadContext context, IRubyObject value) {
this.rsa_e = BN.getBigInteger(value);
if ( privateKey == null ) {
generatePrivateKeyIfParams(context);
}
if ( publicKey == null ) {
generatePublicKeyIfParams(context);
}
return value;
}
private BigInteger getModulus() {
if (publicKey != null) {
return publicKey.getModulus();
} else if (privateKey != null) {
return privateKey.getModulus();
} else {
return rsa_n;
}
}
@JRubyMethod(name="n")
public synchronized IRubyObject get_n() {
BigInteger n = getModulus();
if (n != null) {
return BN.newBN(getRuntime(), n);
}
return getRuntime().getNil();
}
@JRubyMethod(name="n=")
public synchronized IRubyObject set_n(final ThreadContext context, IRubyObject value) {
this.rsa_n = BN.getBigInteger(value);
if ( privateKey == null ) {
generatePrivateKeyIfParams(context);
}
if ( publicKey == null ) {
generatePublicKeyIfParams(context);
}
return value;
}
private void generatePublicKeyIfParams(final ThreadContext context) {
final Ruby runtime = context.runtime;
if ( publicKey != null ) throw newRSAError(runtime, "illegal modification");
// Don't access the rsa_n and rsa_e fields directly. They may have
// already been consumed and cleared by generatePrivateKeyIfParams.
BigInteger _rsa_n = getModulus();
BigInteger _rsa_e = getPublicExponent();
if (_rsa_n != null && _rsa_e != null) {
final KeyFactory rsaFactory;
try {
rsaFactory = SecurityHelper.getKeyFactory("RSA");
}
catch (Exception ex) {
throw runtime.newLoadError("unsupported key algorithm (RSA)");
}
try {
publicKey = (RSAPublicKey) rsaFactory.generatePublic(new RSAPublicKeySpec(_rsa_n, _rsa_e));
}
catch (InvalidKeySpecException ex) {
throw newRSAError(runtime, "invalid parameters");
}
rsa_e = null;
rsa_n = null;
}
}
private void generatePrivateKeyIfParams(final ThreadContext context) {
final Ruby runtime = context.runtime;
if ( privateKey != null ) throw newRSAError(runtime, "illegal modification");
// Don't access the rsa_n and rsa_e fields directly. They may have
// already been consumed and cleared by generatePublicKeyIfParams.
BigInteger _rsa_n = getModulus();
BigInteger _rsa_e = getPublicExponent();
if (_rsa_n != null && _rsa_e != null && rsa_p != null && rsa_q != null && rsa_d != null && rsa_dmp1 != null && rsa_dmq1 != null && rsa_iqmp != null) {
final KeyFactory rsaFactory;
try {
rsaFactory = SecurityHelper.getKeyFactory("RSA");
}
catch (NoSuchAlgorithmException e) {
throw runtime.newLoadError("unsupported key algorithm (RSA)");
}
try {
privateKey = (RSAPrivateCrtKey) rsaFactory.generatePrivate(
new RSAPrivateCrtKeySpec(_rsa_n, _rsa_e, rsa_d, rsa_p, rsa_q, rsa_dmp1, rsa_dmq1, rsa_iqmp)
);
}
catch (InvalidKeySpecException e) {
throw newRSAError(runtime, "invalid parameters");
}
rsa_n = null; rsa_e = null;
rsa_d = null; rsa_p = null; rsa_q = null;
rsa_dmp1 = null; rsa_dmq1 = null; rsa_iqmp = null;
}
}
}// PKeyRSA
jruby-openssl-0.9.21/src/main/java/org/jruby/ext/openssl/Random.java 0000664 0000000 0000000 00000035273 13136616216 0025362 0 ustar 00root root 0000000 0000000 /***** BEGIN LICENSE BLOCK *****
* Version: EPL 1.0/GPL 2.0/LGPL 2.1
*
* The contents of this file are subject to the Eclipse Public
* License Version 1.0 (the "License"); you may not use this file
* except in compliance with the License. You may obtain a copy of
* the License at http://www.eclipse.org/legal/epl-v10.html
*
* Software distributed under the License is distributed on an "AS
* IS" basis, WITHOUT WARRANTY OF ANY KIND, either express or
* implied. See the License for the specific language governing
* rights and limitations under the License.
*
* Copyright (C) 2006 Ola Bini
*
* Alternatively, the contents of this file may be used under the terms of
* either of the GNU General Public License Version 2 or later (the "GPL"),
* or the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
* in which case the provisions of the GPL or the LGPL are applicable instead
* of those above. If you wish to allow use of your version of this file only
* under the terms of either the GPL or the LGPL, and not to allow others to
* use your version of this file under the terms of the EPL, indicate your
* decision by deleting the provisions above and replace them with the notice
* and other provisions required by the GPL or the LGPL. If you do not delete
* the provisions above, a recipient may use your version of this file under
* the terms of any one of the EPL, the GPL or the LGPL.
***** END LICENSE BLOCK *****/
package org.jruby.ext.openssl;
import org.jruby.Ruby;
import org.jruby.RubyClass;
import org.jruby.RubyModule;
import org.jruby.RubyNumeric;
import org.jruby.RubyString;
import org.jruby.anno.JRubyMethod;
import org.jruby.runtime.ThreadContext;
import org.jruby.runtime.builtin.IRubyObject;
import org.jruby.util.ByteList;
import org.jruby.util.SafePropertyAccessor;
import java.lang.reflect.Field;
import java.lang.reflect.InvocationTargetException;
import java.lang.reflect.Method;
import java.lang.reflect.Modifier;
import java.util.concurrent.ThreadLocalRandom;
/**
* @author Ola Bini
*/
public class Random {
// thread-local (default), shared, strong
static final String HOLDER_TYPE = SafePropertyAccessor.getProperty("jruby.openssl.random", "");
private static Holder createHolderImpl() {
if (HOLDER_TYPE.equals("default") || HOLDER_TYPE.equals("thread-local")) {
return new ThreadLocalHolder();
}
if (HOLDER_TYPE.equals("")) {
// NOTE: fine to remove when support for running on Java 6 is gone ...
if (OpenSSL.javaVersion6(false)) {
return new SharedHolder(); // can not-use ThreadLocalRandom.current()
}
}
if (HOLDER_TYPE.equals("shared")) {
return new SharedHolder();
}
if (HOLDER_TYPE.equals("strong")) { // TODO strong (thread-local) makes sense
return new StrongHolder();
}
if (ThreadLocalHolder.secureRandomField == null) {
return new SharedHolder(); // fall-back on (older) JRuby <= 1.7.4
}
return new ThreadLocalHolder();
}
static abstract class Holder {
abstract java.util.Random getPlainRandom() ;
abstract java.security.SecureRandom getSecureRandom(ThreadContext context) ;
void seedSecureRandom(ThreadContext context, byte[] seed) {
getSecureRandom(context).setSeed(seed);
}
void seedPlainRandom(long seed) {
getPlainRandom().setSeed(seed);
}
}
private static class SharedHolder extends Holder {
private volatile java.util.Random plainRandom;
private volatile java.security.SecureRandom secureRandom;
java.util.Random getPlainRandom() {
if (plainRandom == null) {
synchronized(this) {
if (plainRandom == null) {
plainRandom = new java.util.Random();
}
}
}
return plainRandom;
}
java.security.SecureRandom getSecureRandom(ThreadContext context) {
if (secureRandom == null) {
synchronized(this) {
if (secureRandom == null) {
secureRandom = SecurityHelper.getSecureRandom();
}
}
}
return secureRandom;
}
}
private static class ThreadLocalHolder extends Holder {
@Override
java.util.Random getPlainRandom() {
return ThreadLocalRandom.current();
}
@Override
void seedPlainRandom(long seed) {
return; // NO-OP - UnsupportedOperationException
}
@Override
java.security.SecureRandom getSecureRandom(ThreadContext context) {
java.security.SecureRandom secureRandom = context.secureRandom;
if (secureRandom == null) {
secureRandom = getSecureRandomImpl();
setSecureRandom(context, secureRandom); // context.secureRandom = ...
}
return secureRandom;
}
private static final Field secureRandomField;
private static void setSecureRandom(ThreadContext context, java.security.SecureRandom secureRandom) {
if (secureRandomField != null) {
try {
secureRandomField.set(context, secureRandom);
}
catch (IllegalAccessException ex) { Utils.throwException(ex); /* should not happen */ }
}
}
private static final String PREFERRED_PRNG;
static {
String prng = SafePropertyAccessor.getProperty("jruby.preferred.prng", null);
if (prng == null) { // make sure the default experience is non-blocking for users
prng = "NativePRNGNonBlocking";
if (SafePropertyAccessor.getProperty("os.name") != null) {
if (jnr.posix.util.Platform.IS_WINDOWS) { // System.getProperty("os.name") won't fail
prng = "Windows-PRNG";
}
}
}
// setting it to "" (empty) or "default" should just use new SecureRandom() :
if (prng.isEmpty() || prng.equalsIgnoreCase("default")) {
prng = null; tryPreferredPRNG = false; trySHA1PRNG = false;
}
PREFERRED_PRNG = prng;
Field secureRandom = null;
try {
secureRandom = ThreadContext.class.getField("secureRandom");
if ( ! secureRandom.isAccessible() || Modifier.isFinal(secureRandom.getModifiers()) ) {
secureRandom = null;
}
}
catch (Exception ex) { /* ignore NoSuchFieldException */ }
secureRandomField = secureRandom;
}
private static boolean tryPreferredPRNG = true;
private static boolean trySHA1PRNG = true;
private static boolean tryStrongPRNG = false; // NOT-YET-IMPLEMENTED
// copied from JRuby (not available in all 1.7.x) :
public java.security.SecureRandom getSecureRandomImpl() {
java.security.SecureRandom secureRandom = null;
// Try preferred PRNG, which defaults to NativePRNGNonBlocking
if (tryPreferredPRNG) {
try {
secureRandom = java.security.SecureRandom.getInstance(PREFERRED_PRNG);
}
catch (Exception e) {
tryPreferredPRNG = false;
OpenSSL.debug("SecureRandom '"+ PREFERRED_PRNG +"' failed:", e);
}
}
// Try SHA1PRNG
if (secureRandom == null && trySHA1PRNG) {
try {
secureRandom = java.security.SecureRandom.getInstance("SHA1PRNG");
}
catch (Exception e) {
trySHA1PRNG = false;
OpenSSL.debug("SecureRandom SHA1PRNG failed:", e);
}
}
// Just let JDK do whatever it does
if (secureRandom == null) {
secureRandom = new java.security.SecureRandom();
}
return secureRandom;
}
}
private static class StrongHolder extends Holder {
static {
Method method = null;
if (OpenSSL.javaVersion8(true)) {
try {
method = java.security.SecureRandom.class.getMethod("getInstanceStrong");
}
catch (NoSuchMethodException ex) { OpenSSL.debugStackTrace(ex); }
}
getInstanceStrong = method;
}
private static final Method getInstanceStrong;
@Override
java.util.Random getPlainRandom() {
return new java.util.Random();
}
@Override
java.security.SecureRandom getSecureRandom(ThreadContext context) {
// return java.security.SecureRandom.getInstanceStrong(); (on Java 8)
if (getInstanceStrong == null) return SecurityHelper.getSecureRandom();
try {
return (java.security.SecureRandom) getInstanceStrong.invoke(null);
}
catch (IllegalAccessException ex) {
Utils.throwException(ex); return null; // won't happen
}
catch (InvocationTargetException ex) {
Utils.throwException(ex.getTargetException()); return null;
}
}
void seedSecureRandom(ThreadContext context, byte[] seed) {
// NOOP - new instance returned for getSecureRandom
}
void seedPlainRandom(long seed) {
// NOOP - new instance returned for getPlainRandom
}
}
public static void createRandom(final Ruby runtime, final RubyModule OpenSSL) {
final RubyModule Random = OpenSSL.defineModuleUnder("Random");
RubyClass OpenSSLError = (RubyClass) OpenSSL.getConstant("OpenSSLError");
Random.defineClassUnder("RandomError", OpenSSLError, OpenSSLError.getAllocator());
Random.defineAnnotatedMethods(Random.class);
Random.dataWrapStruct(createHolderImpl());
}
@JRubyMethod(meta = true)
public static RubyString random_bytes(final ThreadContext context,
final IRubyObject self, final IRubyObject arg) {
return random_bytes(context, self, toInt(context.runtime, arg));
}
static RubyString random_bytes(final ThreadContext context, final int len) {
final RubyModule Random = (RubyModule) context.runtime.getModule("OpenSSL").getConstantAt("Random");
return generate(context, Random, len, true); // secure-random
}
private static RubyString random_bytes(final ThreadContext context,
final IRubyObject self, final int len) {
return generate(context, self, len, true); // secure-random
}
@JRubyMethod(meta = true)
public static RubyString pseudo_bytes(final ThreadContext context,
final IRubyObject self, final IRubyObject len) {
return generate(context, self, toInt(context.runtime, len), false); // plain-random
}
private static int toInt(final Ruby runtime, final IRubyObject arg) {
final long len = RubyNumeric.fix2long(arg);
if ( len < 0 || len > Integer.MAX_VALUE ) {
throw runtime.newArgumentError("negative string size (or size too big) " + len);
}
return (int) len;
}
private static RubyString generate(final ThreadContext context,
final IRubyObject self, final int len, final boolean secure) {
final Holder holder = retrieveHolder((RubyModule) self);
final byte[] bytes = new byte[len];
( secure ? holder.getSecureRandom(context) : holder.getPlainRandom() ).nextBytes(bytes);
return RubyString.newString(context.runtime, new ByteList(bytes, false));
}
static Holder getHolder(final Ruby runtime) {
return retrieveHolder((RubyModule) runtime.getModule("OpenSSL").getConstantAt("Random"));
}
private static Holder retrieveHolder(final RubyModule Random) {
return (Holder) Random.dataGetStruct();
}
@JRubyMethod(meta = true) // seed(str) -> str
public static IRubyObject seed(final ThreadContext context,
final IRubyObject self, IRubyObject str) {
seedImpl(context, (RubyModule) self, str);
return str;
}
private static void seedImpl(ThreadContext context, final RubyModule Random, final IRubyObject str) {
final byte[] seed = str.asString().getBytes();
final Holder holder = retrieveHolder(Random);
holder.seedSecureRandom(context, seed); // seed supplements existing (secure) seeding mechanism
long s; int l = seed.length;
if ( l >= 4 ) {
s = (seed[0] << 24) | (seed[1] << 16) | (seed[2] << 8) | seed[3];
if ( l >= 8 ) {
s = s ^ (seed[l-4] << 24) | (seed[l-3] << 16) | (seed[l-2] << 8) | seed[l-1];
}
holder.seedPlainRandom(s);
}
}
// true if the PRNG has been seeded with enough data, false otherwise
@JRubyMethod(meta = true, name = "status?") // status? => true | false
public static IRubyObject status_p(final ThreadContext context, final IRubyObject self) {
return context.runtime.newBoolean(true);
}
@JRubyMethod(meta = true, name = { "random_add", "add" }) // random_add(str, entropy) -> self
public static IRubyObject random_add(final ThreadContext context,
final IRubyObject self, IRubyObject str, IRubyObject entropy) {
seedImpl(context, (RubyModule) self, str); // simply ignoring _entropy_ hint
return self;
}
// C-Ruby OpenSSL::Random API stubs :
@JRubyMethod(meta = true) // load_random_file(filename)
public static IRubyObject load_random_file(final ThreadContext context,
final IRubyObject self, IRubyObject fname) {
return context.runtime.getNil();
}
@JRubyMethod(meta = true) // write_random_file(filename) -> true
public static IRubyObject write_random_file(final ThreadContext context,
final IRubyObject self, IRubyObject fname) {
return context.runtime.getNil();
}
@JRubyMethod(meta = true) // egd(filename) -> true
public static IRubyObject egd(final ThreadContext context,
final IRubyObject self, IRubyObject fname) {
// no-op let the JVM security infrastructure to its internal seeding
return context.runtime.getTrue();
}
@JRubyMethod(meta = true) // egd_bytes(filename, length) -> true
public static IRubyObject egd_bytes(final ThreadContext context,
final IRubyObject self, IRubyObject fname, IRubyObject len) {
// no-op let the JVM security infrastructure to its internal seeding
return context.runtime.getTrue();
}
}
jruby-openssl-0.9.21/src/main/java/org/jruby/ext/openssl/SSL.java 0000664 0000000 0000000 00000037544 13136616216 0024606 0 ustar 00root root 0000000 0000000 /***** BEGIN LICENSE BLOCK *****
* Version: EPL 1.0/GPL 2.0/LGPL 2.1
*
* The contents of this file are subject to the Eclipse Public
* License Version 1.0 (the "License"); you may not use this file
* except in compliance with the License. You may obtain a copy of
* the License at http://www.eclipse.org/legal/epl-v10.html
*
* Software distributed under the License is distributed on an "AS
* IS" basis, WITHOUT WARRANTY OF ANY KIND, either express or
* implied. See the License for the specific language governing
* rights and limitations under the License.
*
* Copyright (C) 2006 Ola Bini
*
* Alternatively, the contents of this file may be used under the terms of
* either of the GNU General Public License Version 2 or later (the "GPL"),
* or the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
* in which case the provisions of the GPL or the LGPL are applicable instead
* of those above. If you wish to allow use of your version of this file only
* under the terms of either the GPL or the LGPL, and not to allow others to
* use your version of this file under the terms of the EPL, indicate your
* decision by deleting the provisions above and replace them with the notice
* and other provisions required by the GPL or the LGPL. If you do not delete
* the provisions above, a recipient may use your version of this file under
* the terms of any one of the EPL, the GPL or the LGPL.
***** END LICENSE BLOCK *****/
package org.jruby.ext.openssl;
import org.jruby.Ruby;
import org.jruby.RubyClass;
import org.jruby.RubyFixnum;
import org.jruby.RubyModule;
import org.jruby.anno.JRubyMethod;
import org.jruby.anno.JRubyModule;
import org.jruby.exceptions.RaiseException;
import org.jruby.internal.runtime.methods.DynamicMethod;
import org.jruby.runtime.Block;
import org.jruby.runtime.ThreadContext;
import org.jruby.runtime.builtin.IRubyObject;
import org.jruby.util.SafePropertyAccessor;
/**
* @author Ola Bini
*/
public class SSL {
public static final int VERIFY_NONE = 0x00;
public static final int VERIFY_PEER = 0x01;
public static final int VERIFY_FAIL_IF_NO_PEER_CERT = 0x02;
public static final int VERIFY_CLIENT_ONCE = 0x04;
public static final long OP_ALL = 0x00000FFFL;
public static final long OP_NO_TICKET = 0x00004000L;
public static final long OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION = 0x00010000L;
public static final long OP_SINGLE_ECDH_USE = 0x00080000L;
public static final long OP_SINGLE_DH_USE = 0x00100000L;
public static final long OP_EPHEMERAL_RSA = 0x00200000L;
public static final long OP_CIPHER_SERVER_PREFERENCE = 0x00400000L;
public static final long OP_TLS_ROLLBACK_BUG = 0x00800000L;
public static final long OP_NO_SSLv2 = 0x01000000L; // supported
public static final long OP_NO_SSLv3 = 0x02000000L; // supported
public static final long OP_NO_TLSv1 = 0x04000000L; // supported
public static final long OP_PKCS1_CHECK_1 = 0x08000000L;
public static final long OP_PKCS1_CHECK_2 = 0x10000000L;
public static final long OP_NETSCAPE_CA_DN_BUG = 0x20000000L;
public static final long OP_NETSCAPE_DEMO_CIPHER_CHANGE_BUG = 0x40000000L;
private static final String JSSE_TLS_ephemeralDHKeySize = "jdk.tls.ephemeralDHKeySize" ;
private static final String JSSE_TLS_ephemeralDHKeySize_default = "matched" ;
private static final String JSSE_TLS_disabledAlgorithms = "jdk.tls.disabledAlgorithms" ;
private static final String JSSE_TLS_disabledAlgorithms_default = "SSLv3, DHE" ;
static { configureJSSE(); }
private static void configureJSSE() {
if ( OpenSSL.javaVersion8(true) ) { // >= 1.8
try {
if ( System.getProperty(JSSE_TLS_ephemeralDHKeySize) == null ) {
// The key size is the same as the authentication certificate,
// but must be between 1024 bits and 2048 bits, inclusively.
// However, the SunJCE provider only supports 2048-bit DH keys larger
// than 1024 bits. Consequently, you may use the values 1024 or 2048 only.
System.setProperty(JSSE_TLS_ephemeralDHKeySize, JSSE_TLS_ephemeralDHKeySize_default);
}
}
catch (SecurityException ex) {
OpenSSL.debug("setting " + JSSE_TLS_ephemeralDHKeySize + " failed: " + ex);
}
}
else { // on JDK 7 DHE is weak - disable completely (unless user-set)
try {
if ( System.getProperty(JSSE_TLS_disabledAlgorithms) == null ) {
System.setProperty(JSSE_TLS_disabledAlgorithms, JSSE_TLS_disabledAlgorithms_default);
}
}
catch (SecurityException se) {
OpenSSL.debug("setting " + JSSE_TLS_disabledAlgorithms + " failed: " + se);
}
}
}
static RaiseException handleCouldNotGenerateDHKeyPairError(final Ruby runtime, final RuntimeException ex) {
String message = ex.getMessage();
if ( OpenSSL.javaHotSpot() || OpenSSL.javaOpenJDK() ) {
if ( OpenSSL.javaVersion8(false) ) { // == 1.8
message += " (try disabling DHE using -D"+ JSSE_TLS_disabledAlgorithms +" as only keys of size 1024/2048 are supported in Java 8)";
}
else if ( ! OpenSSL.javaVersion8(true) ) { // < 1.8
message += " (try disabling DHE using -D"+ JSSE_TLS_disabledAlgorithms +" as prior to Java 8 only keys of size < 1024 are supported)";
}
}
return newSSLError(runtime, message, ex);
}
public static void createSSL(final Ruby runtime, final RubyModule OpenSSL) {
final RubyModule SSL = OpenSSL.defineModuleUnder("SSL");
final RubyClass OpenSSLError = OpenSSL.getClass("OpenSSLError");
final RubyClass SSLError = SSL.defineClassUnder("SSLError", OpenSSLError, OpenSSLError.getAllocator());
final IRubyObject WaitReadable = runtime.getIO().getConstantAt("WaitReadable");
if ( WaitReadable != null ) { // since 2.0 (do not exist in 1.8 / 1.9)
SSL.defineClassUnder("SSLErrorWaitReadable", SSLError, OpenSSLError.getAllocator()).
include(new IRubyObject[]{ WaitReadable });
}
final IRubyObject WaitWritable = runtime.getIO().getConstantAt("WaitWritable");
if ( WaitWritable != null ) { // since 2.0 (do not exist in 1.8 / 1.9)
SSL.defineClassUnder("SSLErrorWaitWritable", SSLError, OpenSSLError.getAllocator()).
include(new IRubyObject[]{ WaitWritable });
}
SSL.setConstant("VERIFY_NONE", runtime.newFixnum(VERIFY_NONE));
SSL.setConstant("VERIFY_PEER", runtime.newFixnum(VERIFY_PEER));
SSL.setConstant("VERIFY_FAIL_IF_NO_PEER_CERT", runtime.newFixnum(VERIFY_FAIL_IF_NO_PEER_CERT));
SSL.setConstant("VERIFY_CLIENT_ONCE", runtime.newFixnum(VERIFY_CLIENT_ONCE));
SSL.setConstant("OP_ALL", runtime.newFixnum(OP_ALL));
SSL.setConstant("OP_NO_TICKET", runtime.newFixnum(OP_NO_TICKET));
SSL.setConstant("OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION", runtime.newFixnum(OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION));
SSL.setConstant("OP_SINGLE_ECDH_USE", runtime.newFixnum(OP_SINGLE_ECDH_USE));
SSL.setConstant("OP_SINGLE_DH_USE", runtime.newFixnum(OP_SINGLE_DH_USE));
SSL.setConstant("OP_EPHEMERAL_RSA", runtime.newFixnum(OP_EPHEMERAL_RSA));
SSL.setConstant("OP_CIPHER_SERVER_PREFERENCE", runtime.newFixnum(OP_CIPHER_SERVER_PREFERENCE));
SSL.setConstant("OP_TLS_ROLLBACK_BUG", runtime.newFixnum(OP_TLS_ROLLBACK_BUG));
SSL.setConstant("OP_NO_SSLv2", runtime.newFixnum(OP_NO_SSLv2));
SSL.setConstant("OP_NO_SSLv3", runtime.newFixnum(OP_NO_SSLv3));
SSL.setConstant("OP_NO_TLSv1", runtime.newFixnum(OP_NO_TLSv1));
SSL.setConstant("OP_PKCS1_CHECK_1", runtime.newFixnum(OP_PKCS1_CHECK_1));
SSL.setConstant("OP_PKCS1_CHECK_2", runtime.newFixnum(OP_PKCS1_CHECK_2));
SSL.setConstant("OP_NETSCAPE_CA_DN_BUG", runtime.newFixnum(OP_NETSCAPE_CA_DN_BUG));
SSL.setConstant("OP_NETSCAPE_DEMO_CIPHER_CHANGE_BUG", runtime.newFixnum(OP_NETSCAPE_DEMO_CIPHER_CHANGE_BUG));
SSLContext.createSSLContext(runtime, SSL);
SSLSocket.createSSLSocket(runtime, SSL);
SSLSession.createSession(runtime, SSL);
createSocketForwarder(SSL);
createNonblock(SSL);
}
public static RaiseException newSSLError(Ruby runtime, Exception ex) {
return Utils.newError(runtime, _SSL(runtime).getClass("SSLError"), ex);
}
public static RaiseException newSSLError(Ruby runtime, String message) {
return Utils.newError(runtime, _SSL(runtime).getClass("SSLError"), message, false);
}
private static RaiseException newSSLError(Ruby runtime, String message, Exception ex) {
return Utils.newError(runtime, _SSL(runtime).getClass("SSLError"), message, ex);
}
public static RaiseException newSSLErrorWaitReadable(Ruby runtime, String message) {
return newWaitSSLError(runtime, "SSLErrorWaitReadable", message);
}
public static RaiseException newSSLErrorWaitWritable(Ruby runtime, String message) {
return newWaitSSLError(runtime, "SSLErrorWaitWritable", message);
}
// -Djruby.openssl.ssl.error_wait_nonblock.backtrace=false disables backtrace for WaitReadable/Writable
private static final boolean waitErrorBacktrace;
static {
String backtrace = SafePropertyAccessor.getProperty("jruby.openssl.ssl.error_wait_nonblock.backtrace");
if (backtrace == null) {
// default to JRuby's Option ERRNO_BACKTRACE =
// ... "Generate backtraces for heavily-used Errno exceptions (EAGAIN)."
backtrace = SafePropertyAccessor.getProperty("jruby.errno.backtrace", "false");
}
waitErrorBacktrace = Boolean.parseBoolean(backtrace);
}
private static RaiseException newWaitSSLError(final Ruby runtime, final String name,
final String message) {
RubyClass errorClass = _SSL(runtime).getClass(name);
if ( errorClass == null ) { // < Ruby 2.0
errorClass = _SSL(runtime).getClass("SSLError"); // fallback
}
if ( waitErrorBacktrace ) {
return Utils.newError(runtime, errorClass, message, false);
}
return Utils.newErrorWithoutTrace(runtime, errorClass, message, false);
}
static RubyModule _SSL(final Ruby runtime) {
return (RubyModule) runtime.getModule("OpenSSL").getConstant("SSL");
}
private static RubyModule createSocketForwarder(final RubyModule SSL) { // OpenSSL::SSL
final RubyModule SocketForwarder = SSL.defineModuleUnder("SocketForwarder");
SocketForwarder.defineAnnotatedMethods(SocketForwarder.class);
return SocketForwarder;
}
@JRubyModule(name = "OpenSSL::SSL::SocketForwarder")
public static class SocketForwarder {
@JRubyMethod
public static IRubyObject addr(ThreadContext context, IRubyObject self) {
return to_io(context, self).callMethod(context, "addr");
}
@JRubyMethod
public static IRubyObject peeraddr(ThreadContext context, IRubyObject self) {
return to_io(context, self).callMethod(context, "peeraddr");
}
@JRubyMethod(name = "closed?")
public static IRubyObject closed_p(ThreadContext context, IRubyObject self) {
return to_io(context, self).callMethod(context, "closed?");
}
@JRubyMethod
//@JRubyMethod(required = 2) // def getsockopt(level, optname)
//public static IRubyObject getsockopt(ThreadContext context, IRubyObject self, IRubyObject[] args) {
public static IRubyObject getsockopt(ThreadContext context, IRubyObject self, IRubyObject level, IRubyObject optname) {
//return to_io(context, self).callMethod(context, "getsockopt", args);
return to_io(context, self).callMethod(context, "getsockopt", new IRubyObject[] { level, optname });
}
@JRubyMethod
//@JRubyMethod(required = 3) // def setsockopt(level, optname, optval)
//public static IRubyObject setsockopt(ThreadContext context, IRubyObject self, IRubyObject[] args) {
public static IRubyObject setsockopt(ThreadContext context, IRubyObject self, IRubyObject level, IRubyObject optname, IRubyObject optval) {
//return to_io(context, self).callMethod(context, "setsockopt", args);
return to_io(context, self).callMethod(context, "setsockopt", new IRubyObject[] { level, optname, optval });
}
@JRubyMethod(name = "do_not_reverse_lookup=") // def do_not_reverse_lookup=(flag)
public static IRubyObject do_not_reverse_lookup_eq(ThreadContext context, IRubyObject self, IRubyObject flag) {
return to_io(context, self).callMethod(context, "do_not_reverse_lookup=", flag);
}
@JRubyMethod(rest = true) // def fcntl(*args)
public static IRubyObject fcntl(ThreadContext context, IRubyObject self, IRubyObject[] args) {
return to_io(context, self).callMethod(context, "fcntl", args);
}
private static IRubyObject to_io(ThreadContext context, IRubyObject self) {
return self.callMethod(context, "to_io");
}
} // SocketForwarder
private static RubyModule createNonblock(final RubyModule SSL) { // OpenSSL::SSL
final RubyModule Nonblock = SSL.defineModuleUnder("Nonblock");
Nonblock.defineAnnotatedMethods(Nonblock.class);
return Nonblock;
}
@JRubyModule(name = "OpenSSL::SSL::Nonblock")
public static class Nonblock {
@JRubyMethod(rest = true, frame = true) // framed due super
public static IRubyObject initialize(ThreadContext context, IRubyObject self, IRubyObject[] args) {
final Ruby runtime = context.runtime;
IRubyObject flag = runtime.getFile().getConstant("NONBLOCK"); // File::NONBLOCK
IRubyObject Fcntl = runtime.getObject().getConstantAt("Fcntl");
if ( /* Fcntl != null && */ Fcntl instanceof RubyModule ) {
final IRubyObject io = self.getInstanceVariables().getInstanceVariable("@io");
final RubyClass ioClass = self.getMetaClass();
final DynamicMethod fcntl = ioClass.searchMethod("fcntl");
IRubyObject F_GETFL = ((RubyModule) Fcntl).getConstantAt("F_GETFL");
if ( F_GETFL != null ) { // if defined?(Fcntl::F_GETFL)
// flag |= @io.fcntl(Fcntl::F_GETFL) :
flag = or(context, flag, fcntl.call(context, io, ioClass, "fcntl", F_GETFL));
}
IRubyObject F_SETFL = ((RubyModule) Fcntl).getConstant("F_SETFL");
fcntl.call(context, io, ioClass, "fcntl", new IRubyObject[] { F_SETFL, flag }); // @io.fcntl(Fcntl::F_SETFL, flag)
}
return Utils.invokeSuper(context, self, args, Block.NULL_BLOCK); // super
}
private static IRubyObject or(final ThreadContext context, final IRubyObject flag, final IRubyObject flags) {
if ( flag instanceof RubyFixnum && flags instanceof RubyFixnum ) {
final long f = ((RubyFixnum) flag).getLongValue();
final long fs = ((RubyFixnum) flags).getLongValue();
return RubyFixnum.newFixnum(context.runtime, f | fs);
}
return flag.callMethod(context, "|", flags);
}
} // Nonblock
}// SSL
jruby-openssl-0.9.21/src/main/java/org/jruby/ext/openssl/SSLContext.java 0000664 0000000 0000000 00000131467 13136616216 0026152 0 ustar 00root root 0000000 0000000 /***** BEGIN LICENSE BLOCK *****
* Version: EPL 1.0/GPL 2.0/LGPL 2.1
*
* The contents of this file are subject to the Eclipse Public
* License Version 1.0 (the "License"); you may not use this file
* except in compliance with the License. You may obtain a copy of
* the License at http://www.eclipse.org/legal/epl-v10.html
*
* Software distributed under the License is distributed on an "AS
* IS" basis, WITHOUT WARRANTY OF ANY KIND, either express or
* implied. See the License for the specific language governing
* rights and limitations under the License.
*
* Copyright (C) 2006 Ola Bini
*
* Alternatively, the contents of this file may be used under the terms of
* either of the GNU General Public License Version 2 or later (the "GPL"),
* or the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
* in which case the provisions of the GPL or the LGPL are applicable instead
* of those above. If you wish to allow use of your version of this file only
* under the terms of either the GPL or the LGPL, and not to allow others to
* use your version of this file under the terms of the EPL, indicate your
* decision by deleting the provisions above and replace them with the notice
* and other provisions required by the GPL or the LGPL. If you do not delete
* the provisions above, a recipient may use your version of this file under
* the terms of any one of the EPL, the GPL or the LGPL.
***** END LICENSE BLOCK *****/
package org.jruby.ext.openssl;
import java.util.ArrayList;
import java.util.Collection;
import java.util.HashMap;
import java.util.List;
import java.util.LinkedHashMap;
import java.util.Map;
import java.util.Set;
import java.security.GeneralSecurityException;
import java.security.KeyManagementException;
import java.security.NoSuchAlgorithmException;
import java.security.PrivateKey;
import java.security.cert.CertificateException;
import java.security.cert.X509Certificate;
import java.util.Collections;
import javax.net.ssl.KeyManager;
import javax.net.ssl.SSLEngine;
import javax.net.ssl.SSLSessionContext;
import javax.net.ssl.TrustManager;
import javax.net.ssl.X509ExtendedKeyManager;
import javax.net.ssl.X509TrustManager;
import org.jruby.Ruby;
import org.jruby.RubyArray;
import org.jruby.RubyClass;
import org.jruby.RubyHash;
import org.jruby.RubyInteger;
import org.jruby.RubyModule;
import org.jruby.RubyNumeric;
import org.jruby.RubyObject;
import org.jruby.RubySymbol;
import org.jruby.anno.JRubyMethod;
import org.jruby.common.IRubyWarnings.ID;
import org.jruby.runtime.Arity;
import org.jruby.runtime.Block;
import org.jruby.runtime.BlockCallback;
import org.jruby.runtime.CallBlock;
import org.jruby.runtime.ObjectAllocator;
import org.jruby.runtime.ThreadContext;
import org.jruby.runtime.builtin.IRubyObject;
import org.jruby.runtime.Visibility;
import org.jruby.util.ByteList;
import org.jruby.ext.openssl.x509store.Certificate;
import org.jruby.ext.openssl.x509store.Name;
import org.jruby.ext.openssl.x509store.Store;
import org.jruby.ext.openssl.x509store.StoreContext;
import org.jruby.ext.openssl.x509store.X509AuxCertificate;
import org.jruby.ext.openssl.x509store.X509Object;
import org.jruby.ext.openssl.x509store.X509Utils;
import static org.jruby.ext.openssl.StringHelper.*;
import static org.jruby.ext.openssl.SSL.*;
import static org.jruby.ext.openssl.X509._X509;
import static org.jruby.ext.openssl.X509Cert._Certificate;
import static org.jruby.ext.openssl.OpenSSL.debug;
import static org.jruby.ext.openssl.OpenSSL.debugStackTrace;
import static org.jruby.ext.openssl.OpenSSL.warn;
import static org.jruby.ext.openssl.Utils.hasNonNilInstanceVariable;
/**
* @author Ola Bini
*/
public class SSLContext extends RubyObject {
private static final long serialVersionUID = -6955774230685920773L;
// Mapping table for OpenSSL's SSL_METHOD -> JSSE's SSLContext algorithm.
private static final HashMap SSL_VERSION_OSSL2JSSE;
// Mapping table for JSEE's enabled protocols for the algorithm.
private static final Map ENABLED_PROTOCOLS;
static {
SSL_VERSION_OSSL2JSSE = new LinkedHashMap(20, 1);
ENABLED_PROTOCOLS = new HashMap(8, 1);
SSL_VERSION_OSSL2JSSE.put("TLSv1", "TLSv1");
SSL_VERSION_OSSL2JSSE.put("TLSv1_server", "TLSv1");
SSL_VERSION_OSSL2JSSE.put("TLSv1_client", "TLSv1");
ENABLED_PROTOCOLS.put("TLSv1", new String[] { "TLSv1" });
SSL_VERSION_OSSL2JSSE.put("SSLv2", "SSLv2");
SSL_VERSION_OSSL2JSSE.put("SSLv2_server", "SSLv2");
SSL_VERSION_OSSL2JSSE.put("SSLv2_client", "SSLv2");
ENABLED_PROTOCOLS.put("SSLv2", new String[] { "SSLv2" });
SSL_VERSION_OSSL2JSSE.put("SSLv3", "SSLv3");
SSL_VERSION_OSSL2JSSE.put("SSLv3_server", "SSLv3");
SSL_VERSION_OSSL2JSSE.put("SSLv3_client", "SSLv3");
ENABLED_PROTOCOLS.put("SSLv3", new String[] { "SSLv3" });
SSL_VERSION_OSSL2JSSE.put("SSLv23", "SSL");
SSL_VERSION_OSSL2JSSE.put("SSLv23_server", "SSL");
SSL_VERSION_OSSL2JSSE.put("SSLv23_client", "SSL");
if ( OpenSSL.javaVersion7(true) ) { // >= 1.7
ENABLED_PROTOCOLS.put("SSL", new String[] { "SSLv2", "SSLv3", "TLSv1", "TLSv1.1", "TLSv1.2" });
} else {
ENABLED_PROTOCOLS.put("SSL", new String[] { "SSLv2", "SSLv3", "TLSv1" });
}
// Historically we were ahead of MRI to support TLS
// ... thus the non-standard names version names :
SSL_VERSION_OSSL2JSSE.put("TLS", "TLS");
ENABLED_PROTOCOLS.put("TLS", new String[] { "TLSv1", "TLSv1.1", "TLSv1.2" });
SSL_VERSION_OSSL2JSSE.put("TLSv1.1", "TLSv1.1");
SSL_VERSION_OSSL2JSSE.put("TLSv1_1_server", "TLSv1.1");
SSL_VERSION_OSSL2JSSE.put("TLSv1_1_client", "TLSv1.1");
ENABLED_PROTOCOLS.put("TLSv1.1", new String[] { "TLSv1.1" });
SSL_VERSION_OSSL2JSSE.put("TLSv1_1", "TLSv1.1"); // supported on MRI 2.x
SSL_VERSION_OSSL2JSSE.put("TLSv1_2", "TLSv1.2"); // supported on MRI 2.x
ENABLED_PROTOCOLS.put("TLSv1.2", new String[] { "TLSv1.2" });
SSL_VERSION_OSSL2JSSE.put("TLSv1.2", "TLSv1.2"); // just for completeness
SSL_VERSION_OSSL2JSSE.put("TLSv1_2_server", "TLSv1.2");
SSL_VERSION_OSSL2JSSE.put("TLSv1_2_client", "TLSv1.2");
}
private static ObjectAllocator SSLCONTEXT_ALLOCATOR = new ObjectAllocator() {
public IRubyObject allocate(Ruby runtime, RubyClass klass) {
return new SSLContext(runtime, klass);
}
};
public static void createSSLContext(final Ruby runtime, final RubyModule SSL) { // OpenSSL::SSL
RubyClass SSLContext = SSL.defineClassUnder("SSLContext", runtime.getObject(), SSLCONTEXT_ALLOCATOR);
final ThreadContext context = runtime.getCurrentContext();
SSLContext.addReadWriteAttribute(context, "cert");
SSLContext.addReadWriteAttribute(context, "key");
SSLContext.addReadWriteAttribute(context, "client_ca");
SSLContext.addReadWriteAttribute(context, "ca_file");
SSLContext.addReadWriteAttribute(context, "ca_path");
SSLContext.addReadWriteAttribute(context, "timeout");
SSLContext.addReadWriteAttribute(context, "verify_mode");
SSLContext.addReadWriteAttribute(context, "verify_depth");
SSLContext.addReadWriteAttribute(context, "verify_callback");
SSLContext.addReadWriteAttribute(context, "options");
SSLContext.addReadWriteAttribute(context, "cert_store");
SSLContext.addReadWriteAttribute(context, "extra_chain_cert");
SSLContext.addReadWriteAttribute(context, "client_cert_cb");
SSLContext.addReadWriteAttribute(context, "session_id_context");
SSLContext.addReadWriteAttribute(context, "tmp_dh_callback");
SSLContext.addReadWriteAttribute(context, "servername_cb");
SSLContext.addReadWriteAttribute(context, "renegotiation_cb");
SSLContext.defineAlias("ssl_timeout", "timeout");
SSLContext.defineAlias("ssl_timeout=", "timeout=");
SSLContext.defineAnnotatedMethods(SSLContext.class);
SSLContext.undefineMethod("dup");
final Set methodKeys = SSL_VERSION_OSSL2JSSE.keySet();
final RubyArray methods = runtime.newArray( methodKeys.size() );
for ( final String method : methodKeys ) {
if ( method.equals("SSLv2") || method.startsWith("SSLv2_") ) {
continue; // do not report SSLv2, SSLv2_server, SSLv2_client
}
if ( method.indexOf('.') == -1 ) {
// do not "officially" report TLSv1.1 and TLSv1.2
methods.append( runtime.newSymbol(method) );
}
}
SSLContext.defineConstant("METHODS", methods);
// in 1.8.7 as well as 1.9.3 :
// [:TLSv1, :TLSv1_server, :TLSv1_client, :SSLv3, :SSLv3_server, :SSLv3_client, :SSLv23, :SSLv23_server, :SSLv23_client]
// in 2.0.0 :
// [:TLSv1, :TLSv1_server, :TLSv1_client, :TLSv1_2, :TLSv1_2_server, :TLSv1_2_client, :TLSv1_1, :TLSv1_1_server,
// :TLSv1_1_client, :SSLv3, :SSLv3_server, :SSLv3_client, :SSLv23, :SSLv23_server, :SSLv23_client]
SSLContext.setConstant("SESSION_CACHE_OFF", runtime.newFixnum(SESSION_CACHE_OFF));
SSLContext.setConstant("SESSION_CACHE_CLIENT", runtime.newFixnum(SESSION_CACHE_CLIENT));
SSLContext.setConstant("SESSION_CACHE_SERVER", runtime.newFixnum(SESSION_CACHE_SERVER));
SSLContext.setConstant("SESSION_CACHE_BOTH", runtime.newFixnum(SESSION_CACHE_BOTH));
SSLContext.setConstant("SESSION_CACHE_NO_AUTO_CLEAR", runtime.newFixnum(SESSION_CACHE_NO_AUTO_CLEAR));
SSLContext.setConstant("SESSION_CACHE_NO_INTERNAL_LOOKUP", runtime.newFixnum(SESSION_CACHE_NO_INTERNAL_LOOKUP));
SSLContext.setConstant("SESSION_CACHE_NO_INTERNAL_STORE", runtime.newFixnum(SESSION_CACHE_NO_INTERNAL_STORE));
SSLContext.setConstant("SESSION_CACHE_NO_INTERNAL", runtime.newFixnum(SESSION_CACHE_NO_INTERNAL));
// DEFAULT_CERT_STORE = OpenSSL::X509::Store.new
// DEFAULT_CERT_STORE.set_default_paths
// if defined?(OpenSSL::X509::V_FLAG_CRL_CHECK_ALL)
// DEFAULT_CERT_STORE.flags = OpenSSL::X509::V_FLAG_CRL_CHECK_ALL
// end
final X509Store DEFAULT_CERT_STORE = X509Store.newStore(runtime);
DEFAULT_CERT_STORE.set_default_paths(context);
final IRubyObject V_FLAG_CRL_CHECK_ALL = _X509(runtime).getConstantAt("V_FLAG_CRL_CHECK_ALL");
if ( V_FLAG_CRL_CHECK_ALL != null ) DEFAULT_CERT_STORE.set_flags(V_FLAG_CRL_CHECK_ALL);
SSLContext.setConstant("DEFAULT_CERT_STORE", DEFAULT_CERT_STORE);
// DEFAULT_PARAMS = {
// :ssl_version => "SSLv23",
// :verify_mode => OpenSSL::SSL::VERIFY_PEER,
// :ciphers => "ALL:!ADH:!EXPORT:!SSLv2:RC4+RSA:+HIGH:+MEDIUM:+LOW",
// :options => OpenSSL::SSL::OP_ALL,
// }
// on MRI 2.1 (should not matter for us) :
// :options => defined?(OpenSSL::SSL::OP_DONT_INSERT_EMPTY_FRAGMENTS) ?
// OpenSSL::SSL::OP_ALL & ~OpenSSL::SSL::OP_DONT_INSERT_EMPTY_FRAGMENTS :
// OpenSSL::SSL::OP_ALL
final RubyHash DEFAULT_PARAMS = new RubyHash(runtime);
IRubyObject ssl_version = StringHelper.newString(runtime, new byte[] { 'S','S','L','v','2','3' });
DEFAULT_PARAMS.op_aset(context, runtime.newSymbol("ssl_version"), ssl_version);
IRubyObject verify_mode = runtime.newFixnum(VERIFY_PEER);
DEFAULT_PARAMS.op_aset(context, runtime.newSymbol("verify_mode"), verify_mode);
IRubyObject ciphers = StringHelper.newString(runtime, new byte[] {
'A','L','L',':',
'!','A','D','H',':',
'!','E','X','P','O','R','T',':',
'!','S','S','L','v','2',':',
'R','C','4','+','R','S','A',':',
'+','H','I','G','H',':',
'+','M','E','D','I','U','M',':',
'+','L','O','W'
});
DEFAULT_PARAMS.op_aset(context, runtime.newSymbol("ciphers"), ciphers);
IRubyObject options = runtime.newFixnum(OP_ALL);
DEFAULT_PARAMS.op_aset(context, runtime.newSymbol("options"), options);
SSLContext.setConstant("DEFAULT_PARAMS", DEFAULT_PARAMS);
}
static final int SESSION_CACHE_OFF = 0;
static final int SESSION_CACHE_CLIENT = 1;
static final int SESSION_CACHE_SERVER = 2;
static final int SESSION_CACHE_BOTH = 3; // 1 | 2
static final int SESSION_CACHE_NO_AUTO_CLEAR = 128;
static final int SESSION_CACHE_NO_INTERNAL_LOOKUP = 256;
static final int SESSION_CACHE_NO_INTERNAL_STORE = 512;
static final int SESSION_CACHE_NO_INTERNAL = 768;
public SSLContext(Ruby runtime, RubyClass type) {
super(runtime,type);
}
SSLContext(Ruby runtime) {
super(runtime, _SSLContext(runtime));
}
private String ciphers = CipherStrings.SSL_DEFAULT_CIPHER_LIST;
private String protocol = "SSL"; // SSLv23 in OpenSSL by default
private boolean protocolForServer = true;
private boolean protocolForClient = true;
private PKey t_key;
private X509Cert t_cert;
private int verifyResult = 1; /* avoid 0 (= X509_V_OK) just in case */
//private int sessionCacheMode; // 2 default on MRI
private int sessionCacheSize; // 20480
private InternalContext internalContext;
@JRubyMethod(required = 0, optional = 1, visibility = Visibility.PRIVATE)
public IRubyObject initialize(IRubyObject[] args) {
if ( args.length > 0 ) set_ssl_version(args[0]);
return initializeImpl();
}
final SSLContext initializeImpl() { return this; }
@JRubyMethod
public IRubyObject setup(final ThreadContext context) {
final Ruby runtime = context.runtime;
if ( isFrozen() ) return runtime.getNil();
synchronized(this) {
if ( isFrozen() ) return runtime.getNil();
this.freeze(context);
}
final X509Store certStore = getCertStore();
// TODO: handle tmp_dh_callback :
// #if !defined(OPENSSL_NO_DH)
// if (RTEST(ossl_sslctx_get_tmp_dh_cb(self))){
// SSL_CTX_set_tmp_dh_callback(ctx, ossl_tmp_dh_callback);
// }
// else{
// SSL_CTX_set_tmp_dh_callback(ctx, ossl_default_tmp_dh_callback);
// }
// #endif
IRubyObject value;
value = getInstanceVariable("@key");
final PKey key;
if ( value != null && ! value.isNil() ) {
if ( ! ( value instanceof PKey ) ) {
throw runtime.newTypeError("OpenSSL::PKey::PKey expected but got @key = " + value.inspect());
}
key = (PKey) value;
} else {
key = getCallbackKey(context);
}
value = getInstanceVariable("@cert");
final X509Cert cert;
if ( value != null && ! value.isNil() ) {
if ( ! ( value instanceof X509Cert ) ) {
throw runtime.newTypeError("OpenSSL::X509::Certificate expected but got @cert = " + value.inspect());
}
cert = (X509Cert) value;
} else {
cert = getCallbackCert(context);
}
value = getInstanceVariable("@client_ca");
final List clientCert;
if ( value != null && ! value.isNil() ) {
if ( value.respondsTo("each") ) {
clientCert = convertToAuxCerts(context, value);
} else {
if ( ! ( value instanceof X509Cert ) ) {
throw runtime.newTypeError("OpenSSL::X509::Certificate expected but got @client_ca = " + value.inspect());
}
clientCert = Collections.singletonList( ((X509Cert) value).getAuxCert() );
}
}
else clientCert = Collections.emptyList();
value = getInstanceVariable("@extra_chain_cert");
final List extraChainCert;
if ( value != null && ! value.isNil() ) {
extraChainCert = convertToAuxCerts(context, value);
}
else {
extraChainCert = null;
}
value = getInstanceVariable("@verify_mode");
final int verifyMode;
if ( value != null && ! value.isNil() ) {
verifyMode = RubyNumeric.fix2int(value);
}
else {
verifyMode = SSL.VERIFY_NONE; // 0x00
}
value = getInstanceVariable("@timeout");
final int timeout;
if ( value != null && ! value.isNil() ) {
timeout = RubyNumeric.fix2int(value);
}
else {
timeout = 0;
}
final Store store = certStore != null ? certStore.getStore() : new Store();
final String caFile = getCaFile();
final String caPath = getCaPath();
if (caFile != null || caPath != null) {
try {
if (store.loadLocations(runtime, caFile, caPath) == 0) {
runtime.getWarnings().warn(ID.MISCELLANEOUS, "can't set verify locations");
}
}
catch (Exception e) {
if ( e instanceof RuntimeException ) debugStackTrace(runtime, e);
throw newSSLError(runtime, e);
}
}
value = getInstanceVariable("@verify_callback");
if ( value != null && ! value.isNil() ) {
store.setExtraData(1, value);
} else {
store.setExtraData(1, null);
}
value = getInstanceVariable("@verify_depth");
if ( value != null && ! value.isNil() ) {
store.setDepth(RubyNumeric.fix2int(value));
} else {
store.setDepth(-1);
}
value = getInstanceVariable("@servername_cb");
if ( value != null && ! value.isNil() ) {
// SSL_CTX_set_tlsext_servername_callback(ctx, ssl_servername_cb);
}
// NOTE: no API under javax.net to support session get/new/remove callbacks
/*
val = ossl_sslctx_get_sess_id_ctx(self);
if (!NIL_P(val)){
StringValue(val);
if (!SSL_CTX_set_session_id_context(ctx, (unsigned char *)RSTRING_PTR(val),
RSTRING_LEN(val))){
ossl_raise(eSSLError, "SSL_CTX_set_session_id_context:");
}
}
if (RTEST(rb_iv_get(self, "@session_get_cb"))) {
SSL_CTX_sess_set_get_cb(ctx, ossl_sslctx_session_get_cb);
OSSL_Debug("SSL SESSION get callback added");
}
if (RTEST(rb_iv_get(self, "@session_new_cb"))) {
SSL_CTX_sess_set_new_cb(ctx, ossl_sslctx_session_new_cb);
OSSL_Debug("SSL SESSION new callback added");
}
if (RTEST(rb_iv_get(self, "@session_remove_cb"))) {
SSL_CTX_sess_set_remove_cb(ctx, ossl_sslctx_session_remove_cb);
OSSL_Debug("SSL SESSION remove callback added");
}
*/
try {
internalContext = createInternalContext(context, cert, key, store, clientCert, extraChainCert, verifyMode, timeout);
}
catch (GeneralSecurityException e) {
throw newSSLError(runtime, e);
}
return runtime.getTrue();
}
@JRubyMethod
public RubyArray ciphers(final ThreadContext context) {
return matchedCiphers(context);
}
private RubyArray matchedCiphers(final ThreadContext context) {
final Ruby runtime = context.runtime;
try {
final String[] supported = getSupportedCipherSuites(this.protocol);
final Collection cipherDefs =
CipherStrings.matchingCiphers(this.ciphers, supported, false);
final IRubyObject[] cipherList = new IRubyObject[ cipherDefs.size() ];
int i = 0; for ( CipherStrings.Def def : cipherDefs ) {
cipherList[i++] = runtime.newArrayNoCopy(
newUTF8String(runtime, def.name), // 0
newUTF8String(runtime, sslVersionString(def.algorithms)), // 1
runtime.newFixnum(def.algStrengthBits), // 2
runtime.newFixnum(def.algBits) // 3
);
}
return runtime.newArrayNoCopy(cipherList);
}
catch (GeneralSecurityException gse) {
throw newSSLError(runtime, gse.getMessage());
}
}
@JRubyMethod(name = "ciphers=")
public IRubyObject set_ciphers(final ThreadContext context, final IRubyObject ciphers) {
if ( ciphers.isNil() ) {
this.ciphers = CipherStrings.SSL_DEFAULT_CIPHER_LIST;
}
else if ( ciphers instanceof RubyArray ) {
final RubyArray ciphs = (RubyArray) ciphers;
StringBuilder cipherStr = new StringBuilder();
String sep = "";
for ( int i = 0; i < ciphs.size(); i++ ) {
cipherStr.append(sep).append( ciphs.eltInternal(i).toString() );
sep = ":";
}
this.ciphers = cipherStr.toString();
}
else {
this.ciphers = ciphers.asString().toString();
}
if ( matchedCiphers(context).isEmpty() ) {
throw newSSLError(context.runtime, "no cipher match");
}
return ciphers;
}
@JRubyMethod(name = "ssl_version=")
public IRubyObject set_ssl_version(IRubyObject version) {
final String versionStr;
if ( version instanceof RubySymbol ) {
versionStr = version.toString();
} else {
versionStr = version.convertToString().toString();
}
final String protocol = SSL_VERSION_OSSL2JSSE.get(versionStr);
if ( protocol == null ) {
throw getRuntime().newArgumentError("unknown SSL method `"+ versionStr +"'");
}
this.protocol = protocol;
protocolForServer = ! versionStr.endsWith("_client");
protocolForClient = ! versionStr.endsWith("_server");
return version;
}
final String getProtocol() { return this.protocol; }
// ##
// # Sets the parameters for this SSL context to the values in +params+.
// # The keys in +params+ must be assignment methods on SSLContext.
// #
// # If the verify_mode is not VERIFY_NONE and ca_file, ca_path and
// # cert_store are not set then the system default certificate store is
// # used.
//
// def set_params(params={})
// params = DEFAULT_PARAMS.merge(params)
// params.each{|name, value| self.__send__("#{name}=", value) }
// if self.verify_mode != OpenSSL::SSL::VERIFY_NONE
// unless self.ca_file or self.ca_path or self.cert_store
// self.cert_store = DEFAULT_CERT_STORE
// end
// end
// return params
// end
@JRubyMethod(optional = 1)
public IRubyObject set_params(final ThreadContext context, final IRubyObject[] args) {
final RubyHash params;
final RubyClass SSLContext = _SSLContext(context.runtime);
RubyHash DEFAULT_PARAMS = (RubyHash) SSLContext.getConstantAt("DEFAULT_PARAMS");
if ( args.length == 0 ) params = DEFAULT_PARAMS;
else {
params = (RubyHash) DEFAULT_PARAMS.merge(context, args[0], Block.NULL_BLOCK);
}
final SSLContext self = this;
params.visitAll(new RubyHash.Visitor() {
@Override
public void visit(IRubyObject name, IRubyObject value) {
self.callMethod(context, name.toString() + '=', value);
}
});
IRubyObject verify_mode = self.getInstanceVariable("@verify_mode");
if ( verify_mode != null && ! verify_mode.isNil()
&& RubyNumeric.fix2int(verify_mode) != SSL.VERIFY_NONE ) {
if ( ! hasNonNilInstanceVariable(self, "@ca_file")
&& ! hasNonNilInstanceVariable(self, "@ca_path")
&& ! hasNonNilInstanceVariable(self, "@cert_store") ) {
IRubyObject DEFAULT_CERT_STORE = SSLContext.getConstantAt("DEFAULT_CERT_STORE");
self.setInstanceVariable("@cert_store", DEFAULT_CERT_STORE);
}
}
return params;
}
@JRubyMethod(name = "session_cache_mode")
public IRubyObject session_cache_mode() {
return getRuntime().getNil();
//return getRuntime().newFixnum(sessionCacheMode);
}
@JRubyMethod(name = "session_cache_mode=")
public IRubyObject set_session_cache_mode(IRubyObject mode) {
//this.sessionCacheMode = RubyInteger.fix2int(mode);
//return mode;
warn(getRuntime().getCurrentContext(), "SSLContext#session_cache_mode= has no effect under JRuby");
return session_cache_mode();
}
@JRubyMethod(name = "session_cache_size")
public IRubyObject session_cache_size() {
return getRuntime().newFixnum(sessionCacheSize);
}
@JRubyMethod(name = "session_cache_size=")
public IRubyObject set_session_cache_size(IRubyObject size) {
this.sessionCacheSize = RubyInteger.fix2int(size);
return size;
}
@JRubyMethod(name = "session_cache_stats")
public RubyHash session_cache_stats(final ThreadContext context) {
// NOTE: session cache NOT IMPLEMENTED
// { :connect_renegotiate=>0, :cache_full=>0, :accept_good=>0,
// :connect=>0, :timeouts=>0, :accept_renegotiate=>0, :accept=>0,
// :cache_hits=>0, :cache_num=>0, :cb_hits=>0, :connect_good=>0,
// :cache_misses=>0 }
return RubyHash.newHash(context.runtime);
}
@JRubyMethod(name = "security_level=")
public IRubyObject set_security_level(ThreadContext context, IRubyObject level) {
warn(context, "WARNING: SSLContext#security_level= has no effect under JRuby");
return context.nil;
}
boolean isProtocolForServer() {
return protocolForServer;
}
boolean isProtocolForClient() {
return protocolForClient;
}
int getLastVerifyResult() {
return verifyResult;
}
void setLastVerifyResult(int verifyResult) {
this.verifyResult = verifyResult;
}
private static String cachedProtocol = null;
private static String[] cachedSupportedCipherSuites;
private static String[] getSupportedCipherSuites(final String protocol)
throws GeneralSecurityException {
if ( cachedProtocol == null ) {
synchronized(SSLContext.class) {
if ( cachedProtocol == null ) {
cachedSupportedCipherSuites = dummySSLEngine(protocol).getSupportedCipherSuites();
cachedProtocol = protocol;
return cachedSupportedCipherSuites;
}
}
}
if ( protocol.equals(cachedProtocol) ) return cachedSupportedCipherSuites;
return dummySSLEngine(protocol).getSupportedCipherSuites();
}
private static SSLEngine dummySSLEngine(final String protocol) throws GeneralSecurityException {
javax.net.ssl.SSLContext sslContext = SecurityHelper.getSSLContext(protocol);
sslContext.init(null, null, null);
return sslContext.createSSLEngine();
}
// should keep SSLContext as a member for introducin SSLSession. later...
final SSLEngine createSSLEngine(String peerHost, int peerPort)
throws NoSuchAlgorithmException, KeyManagementException {
final SSLEngine engine;
// an empty peerHost implies no SNI (RFC 3546) support requested
if ( peerHost == null || peerHost.length() == 0 ) {
// no hints for an internal session reuse strategy
engine = internalContext.getSSLContext().createSSLEngine();
}
// SNI is attempted for valid peerHost hostname on Java >= 7
// if peerHost is set to an IP address Java does not use SNI
else {
engine = internalContext.getSSLContext().createSSLEngine(peerHost, peerPort);
}
engine.setEnabledCipherSuites( getCipherSuites(engine.getSupportedCipherSuites()) );
engine.setEnabledProtocols( getEnabledProtocols(engine) );
return engine;
}
private String[] getCipherSuites(final String[] supported) {
Collection cipherDefs =
CipherStrings.matchingCiphers(this.ciphers, supported, true);
final String[] result = new String[ cipherDefs.size() ]; int i = 0;
for ( CipherStrings.Def def : cipherDefs ) {
result[ i++ ] = def.getCipherSuite();
}
return result;
}
private String[] getEnabledProtocols(final SSLEngine engine) {
final String[] enabledProtocols = ENABLED_PROTOCOLS.get(protocol);
if ( enabledProtocols != null ) {
final long options = getOptions();
final String[] engineProtocols = engine.getEnabledProtocols();
final List protocols = new ArrayList(enabledProtocols.length);
for ( final String enabled : enabledProtocols ) {
if (((options & SSL.OP_NO_SSLv2) != 0) && enabled.equals("SSLv2")) {
continue;
}
if (((options & SSL.OP_NO_SSLv3) != 0) && enabled.equals("SSLv3")) {
continue;
}
if (((options & SSL.OP_NO_TLSv1) != 0) && enabled.equals("TLSv1")) {
continue;
}
for ( final String allowed : engineProtocols ) {
if ( allowed.equals(enabled) ) protocols.add(allowed);
}
}
return protocols.toArray( new String[ protocols.size() ] );
}
return new String[0];
}
private static final byte[] TLSv1 = { 'T','L','S','v','1' };
private static final byte[] SSLv2 = { 'S','S','L','v','2' };
private static final byte[] SSLv3 = { 'S','S','L','v','3' };
private ByteList sslVersionString(long bits) {
final ByteList str = new ByteList(18);
boolean first = true;
if ( ( bits & CipherStrings.SSL_SSLV3 ) != 0 ) {
if ( ! first ) str.append('/'); first = false;
str.append( TLSv1 ); str.append('/'); str.append( SSLv3 );
}
if ( ( bits & CipherStrings.SSL_SSLV2 ) != 0 ) {
if ( ! first ) str.append('/'); // first = false;
str.append( SSLv2 );
}
return str;
}
private PKey getCallbackKey(final ThreadContext context) {
if ( t_key != null ) return t_key;
initFromCallback(context);
return t_key;
}
private X509Cert getCallbackCert(final ThreadContext context) {
if ( t_cert != null ) return t_cert;
initFromCallback(context);
return t_cert;
}
private void initFromCallback(final ThreadContext context) {
final IRubyObject callback = getInstanceVariable("@client_cert_cb");
if ( callback != null && ! callback.isNil() ) {
IRubyObject arr = callback.callMethod(context, "call", this);
if ( ! ( arr instanceof RubyArray ) ) {
throw context.runtime.newTypeError("expected @client_cert_cb.call to return an Array but got: " + arr.getMetaClass().getName());
}
final IRubyObject cert = ((RubyArray) arr).entry(0);
final IRubyObject key = ((RubyArray) arr).entry(1);
if ( ! ( cert instanceof X509Cert ) ) {
throw context.runtime.newTypeError(cert.inspect() + " is not an instance of OpenSSL::X509::Certificate");
}
if ( ! ( key instanceof PKey ) ) {
throw context.runtime.newTypeError(key.inspect() + " is not an instance of OpenSSL::PKey::PKey");
}
t_cert = (X509Cert) cert;
t_key = (PKey) key;
}
}
private X509Store getCertStore() {
IRubyObject cert_store = getInstanceVariable("@cert_store");
if ( cert_store instanceof X509Store ) {
return (X509Store) cert_store;
}
return null;
}
private String getCaFile() {
IRubyObject ca_file = getInstanceVariable("@ca_file");
if ( ca_file != null && ! ca_file.isNil() ) {
return ca_file.asString().toString();
}
return null;
}
private String getCaPath() {
IRubyObject ca_path = getInstanceVariable("@ca_path");
if ( ca_path != null && ! ca_path.isNil() ) {
return ca_path.asString().toString();
}
return null;
}
private long getOptions() {
IRubyObject options = getInstanceVariable("@options");
if ( options != null && ! options.isNil() ) {
return RubyNumeric.fix2long(options);
}
return 0;
}
private static List convertToAuxCerts(final ThreadContext context, IRubyObject value) {
final RubyModule SSLContext = _SSLContext(context.runtime);
final RubyModule Certificate = _Certificate(context.runtime);
if ( value instanceof RubyArray ) {
final RubyArray val = (RubyArray) value;
final int size = val.size();
final ArrayList result = new ArrayList(size);
for ( int i=0; i val = (List) value;
final int size = val.size();
final ArrayList result = new ArrayList(size);
for ( int i=0; i result = new ArrayList();
Utils.invoke(context, value, "each",
CallBlock.newCallClosure(value, SSLContext, Arity.NO_ARGUMENTS, new BlockCallback() {
public IRubyObject call(ThreadContext context, IRubyObject[] args, Block block) {
result.add( assureCertificate(context, Certificate, args[0]).getAuxCert() );
return context.nil;
}
}, context)
);
return result;
}
private static X509Cert assureCertificate(final ThreadContext context, final RubyModule Certificate, final IRubyObject cert) {
if ( ! ( Certificate.isInstance(cert) ) ) {
throw context.runtime.newTypeError("wrong argument : " + cert.inspect() + " is not a " + Certificate.getName());
}
return (X509Cert) cert;
}
static RubyClass _SSLContext(final Ruby runtime) {
return (RubyClass) _SSL(runtime).getConstantAt("SSLContext");
}
private InternalContext createInternalContext(ThreadContext context,
final X509Cert xCert, final PKey pKey, final Store store,
final List clientCert, final List extraChainCert,
final int verifyMode, final int timeout) throws NoSuchAlgorithmException, KeyManagementException {
InternalContext internalContext = new InternalContext(xCert, pKey, store, clientCert, extraChainCert, verifyMode, timeout);
internalContext.initSSLContext(context);
return internalContext;
}
/**
* c: SSL_CTX
*/
private class InternalContext {
InternalContext(
final X509Cert xCert,
final PKey pKey,
final Store store,
final List clientCert,
final List extraChainCert,
final int verifyMode,
final int timeout) throws NoSuchAlgorithmException, KeyManagementException {
if ( pKey != null && xCert != null ) {
this.privateKey = pKey.getPrivateKey();
this.keyAlgorithm = pKey.getAlgorithm();
this.cert = xCert.getAuxCert();
}
else {
this.privateKey = null;
this.keyAlgorithm = null;
this.cert = null;
}
this.store = store;
this.clientCert = clientCert;
this.extraChainCert = extraChainCert;
this.verifyMode = verifyMode;
//this.timeout = timeout;
// initialize SSL context :
final javax.net.ssl.SSLContext sslContext = SecurityHelper.getSSLContext(protocol);
if ( protocolForClient ) {
final SSLSessionContext clientContext = sslContext.getClientSessionContext();
clientContext.setSessionTimeout(timeout);
if ( sessionCacheSize >= 0 ) {
clientContext.setSessionCacheSize(sessionCacheSize);
}
}
if ( protocolForServer ) {
final SSLSessionContext serverContext = sslContext.getClientSessionContext();
serverContext.setSessionTimeout(timeout);
if ( sessionCacheSize >= 0 ) {
serverContext.setSessionCacheSize(sessionCacheSize);
}
}
this.sslContext = sslContext;
}
protected void initSSLContext(final ThreadContext context) throws KeyManagementException {
final KeyManager[] keyManager = new KeyManager[] { new KeyManagerImpl(this) };
final TrustManager[] trustManager = new TrustManager[] { new TrustManagerImpl(this) };
// SSLContext (internals) on Sun JDK :
// private final java.security.Provider provider; "SunJSSE"
// private final javax.net.ssl.SSLContextSpi; sun.security.ssl.SSLContextImpl
sslContext.init(keyManager, trustManager, OpenSSL.getSecureRandomFrom(context));
// if secureRandom == null JSSE will try :
// - new SecureRandom();
// - SecureRandom.getInstance("PKCS11", cryptoProvider);
}
final Store store;
final X509AuxCertificate cert;
final String keyAlgorithm;
final PrivateKey privateKey;
final int verifyMode;
final List clientCert; // assumed always != null
final List extraChainCert; // empty assumed == null
//final int timeout;
private final javax.net.ssl.SSLContext sslContext;
// part of ssl_verify_cert_chain
StoreContext createStoreContext(final String purpose) {
if ( store == null ) return null;
final StoreContext storeContext = new StoreContext(store);
if ( storeContext.init(null, null) == 0 ) return null;
// for verify_cb
storeContext.setExtraData(1, store.getExtraData(1));
if ( purpose != null ) storeContext.setDefault(purpose);
storeContext.verifyParameter.inherit(store.verifyParameter);
return storeContext;
}
final javax.net.ssl.SSLContext getSSLContext() { return sslContext; }
void setLastVerifyResult(int lastVerifyResult) {
SSLContext.this.setLastVerifyResult(lastVerifyResult);
}
}
private static class KeyManagerImpl extends X509ExtendedKeyManager {
final InternalContext internalContext;
KeyManagerImpl(InternalContext internalContext) {
super();
this.internalContext = internalContext;
}
@Override
public String chooseEngineClientAlias(String[] keyType, java.security.Principal[] issuers, javax.net.ssl.SSLEngine engine) {
if (internalContext.privateKey == null) return null;
for (int i = 0; i < keyType.length; i++) {
if (keyType[i].equalsIgnoreCase(internalContext.keyAlgorithm)) {
return keyType[i];
}
}
return null;
}
@Override
public String chooseEngineServerAlias(String keyType, java.security.Principal[] issuers, javax.net.ssl.SSLEngine engine) {
if (internalContext.privateKey == null) return null;
if (keyType.equalsIgnoreCase(internalContext.keyAlgorithm)) {
return keyType;
}
return null;
}
@Override
public String chooseClientAlias(String[] keyType, java.security.Principal[] issuers, java.net.Socket socket) {
return null;
}
@Override
public String chooseServerAlias(String keyType, java.security.Principal[] issuers, java.net.Socket socket) {
return null;
}
@Override // c: ssl3_output_cert_chain
public java.security.cert.X509Certificate[] getCertificateChain(String alias) {
final List chain;
if ( internalContext.extraChainCert != null ) {
chain = (List) internalContext.extraChainCert;
}
else if ( internalContext.cert != null ) {
chain = new ArrayList(8);
StoreContext storeCtx = internalContext.createStoreContext(null);
X509AuxCertificate x = internalContext.cert;
while (true) {
chain.add(x);
if ( x.getIssuerDN().equals(x.getSubjectDN()) ) break;
try {
final Name name = new Name(x.getIssuerX500Principal());
X509Object[] s_obj = new X509Object[1];
if (storeCtx.getBySubject(X509Utils.X509_LU_X509, name, s_obj) <= 0) {
break;
}
x = ((Certificate) s_obj[0]).x509;
}
catch (RuntimeException e) {
debugStackTrace(e);
break;
}
catch (Exception e) {
debug("KeyManagerImpl bySubject failed", e);
break;
}
}
}
else {
chain = Collections.EMPTY_LIST;
}
return chain.toArray( new java.security.cert.X509Certificate[chain.size()] );
}
@Override
public String[] getClientAliases(String keyType, java.security.Principal[] issuers) {
return null;
}
@Override
public java.security.PrivateKey getPrivateKey(String alias) {
return internalContext.privateKey; // might be null
}
@Override
public String[] getServerAliases(String keyType, java.security.Principal[] issuers) {
return null;
}
}
private static class TrustManagerImpl implements X509TrustManager {
final InternalContext internalContext;
TrustManagerImpl(InternalContext internalContext) {
super();
this.internalContext = internalContext;
}
@Override
public void checkClientTrusted(java.security.cert.X509Certificate[] chain, String authType) throws CertificateException {
checkTrusted("ssl_client", chain);
}
@Override
public void checkServerTrusted(java.security.cert.X509Certificate[] chain, String authType) throws CertificateException {
checkTrusted("ssl_server", chain);
}
@Override
public java.security.cert.X509Certificate[] getAcceptedIssuers() {
final int size = internalContext.clientCert.size();
return internalContext.clientCert.toArray( new java.security.cert.X509Certificate[size] );
}
// c: ssl_verify_cert_chain
private void checkTrusted(final String purpose, final X509Certificate[] chain) throws CertificateException {
if ( chain != null && chain.length > 0 ) {
if ( (internalContext.verifyMode & SSL.VERIFY_PEER) != 0 ) {
// verify_peer
final StoreContext storeContext = internalContext.createStoreContext(purpose);
if ( storeContext == null ) {
throw new CertificateException("couldn't initialize store");
}
storeContext.setCertificate(chain[0]);
storeContext.setChain(chain);
verifyChain(storeContext);
}
} else {
if ( (internalContext.verifyMode & SSL.VERIFY_FAIL_IF_NO_PEER_CERT) != 0 ) {
// fail if no peer cert
throw new CertificateException("no peer certificate");
}
}
}
private void verifyChain(final StoreContext storeContext) throws CertificateException {
final int ok;
try {
ok = storeContext.verifyCertificate();
}
catch (Exception e) {
internalContext.setLastVerifyResult(storeContext.error);
if ( storeContext.error == X509Utils.V_OK ) {
internalContext.setLastVerifyResult(X509Utils.V_ERR_CERT_REJECTED);
}
throw new CertificateException("certificate verify failed", e);
}
internalContext.setLastVerifyResult(storeContext.error);
if ( ok == 0 ) {
throw new CertificateException("certificate verify failed");
}
}
}
}// SSLContext
jruby-openssl-0.9.21/src/main/java/org/jruby/ext/openssl/SSLSession.java 0000664 0000000 0000000 00000014342 13136616216 0026141 0 ustar 00root root 0000000 0000000 /*
* The MIT License
*
* Copyright 2015 Karol Bucek.
*
* Permission is hereby granted, free of charge, to any person obtaining a copy
* of this software and associated documentation files (the "Software"), to deal
* in the Software without restriction, including without limitation the rights
* to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
* copies of the Software, and to permit persons to whom the Software is
* furnished to do so, subject to the following conditions:
*
* The above copyright notice and this permission notice shall be included in
* all copies or substantial portions of the Software.
*
* THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
* IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
* FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
* AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
* LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
* OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
* THE SOFTWARE.
*/
package org.jruby.ext.openssl;
import java.util.Arrays;
import javax.net.ssl.SSLSessionContext;
import org.jruby.Ruby;
import org.jruby.RubyClass;
import org.jruby.RubyFixnum;
import org.jruby.RubyModule;
import org.jruby.RubyNumeric;
import org.jruby.RubyObject;
import org.jruby.RubyString;
import org.jruby.RubyTime;
import org.jruby.anno.JRubyMethod;
import org.jruby.runtime.ObjectAllocator;
import org.jruby.runtime.ThreadContext;
import org.jruby.runtime.Visibility;
import org.jruby.runtime.builtin.IRubyObject;
import org.jruby.util.ByteList;
import static org.jruby.ext.openssl.OpenSSL._OpenSSLError;
import static org.jruby.ext.openssl.OpenSSL.warn;
import static org.jruby.ext.openssl.SSL._SSL;
import static org.jruby.ext.openssl.OpenSSL.warn;
/**
* OpenSSL::SSL::Session
*
* @author kares
*/
public class SSLSession extends RubyObject {
private static final ObjectAllocator SESSION_ALLOCATOR = new ObjectAllocator() {
public IRubyObject allocate(Ruby runtime, RubyClass klass) {
return new SSLSession(runtime, klass);
}
};
public static void createSession(final Ruby runtime, final RubyModule SSL) { // OpenSSL::SSL
RubyClass Session = SSL.defineClassUnder("Session", runtime.getObject(), SESSION_ALLOCATOR);
Session.defineAnnotatedMethods(SSLSession.class);
// OpenSSL::SSL::Session::SessionError
RubyClass OpenSSLError = _OpenSSLError(runtime);
Session.defineClassUnder("SessionError", OpenSSLError, OpenSSLError.getAllocator());
}
private javax.net.ssl.SSLSession sslSession;
SSLSession(Ruby runtime, RubyClass metaClass) {
super(runtime, metaClass);
}
SSLSession(Ruby runtime) {
this(runtime, (RubyClass) _SSL(runtime).getConstantAt("Session"));
}
@JRubyMethod(name = "initialize", visibility = Visibility.PRIVATE)
public IRubyObject initialize(final ThreadContext context, final IRubyObject arg) {
final Ruby runtime = context.runtime;
if ( arg instanceof SSLSocket ) {
return initializeImpl((SSLSocket) arg);
}
throw runtime.newNotImplementedError("Session#initialize with " + arg.getMetaClass().getName());
}
SSLSession initializeImpl(final SSLSocket socket) {
sslSession = socket.sslSession();
return this;
}
final javax.net.ssl.SSLSession sslSession() {
return sslSession;
}
@JRubyMethod(name = "==")
public IRubyObject op_eqq(final ThreadContext context, final IRubyObject other) {
return context.runtime.newBoolean( equals(other) );
}
@Override
public boolean equals(final Object other) {
if ( other instanceof SSLSession ) {
final SSLSession that = (SSLSession) other;
if ( this.sslSession.getProtocol().equals( that.sslSession.getProtocol() ) ) {
if ( Arrays.equals( this.sslSession.getId(), that.sslSession.getId() ) ) {
return true;
}
}
}
return false;
}
@Override
public final int hashCode() {
return 17 * sslSession.hashCode();
}
@Override
public RubyFixnum hash() {
return getRuntime().newFixnum(hashCode());
}
@JRubyMethod(name = "id")
public RubyString id(final ThreadContext context) {
final byte[] id = sslSession().getId();
return context.runtime.newString( new ByteList(id) );
}
@JRubyMethod(name = "id=")
public IRubyObject set_id(final ThreadContext context, IRubyObject id) {
warn(context, "WARNING: Session#id= is not supported (read-only)");
return context.nil;
}
@JRubyMethod(name = "time")
public RubyTime time(final ThreadContext context) {
final long time = sslSession().getCreationTime();
return RubyTime.newTime(context.runtime, time);
}
@JRubyMethod(name = "time=")
public IRubyObject set_time(final ThreadContext context, IRubyObject time) {
warn(context, "WARNING: Session#time= is not supported (read-only)");
return context.nil;
}
@JRubyMethod(name = "timeout")
public IRubyObject timeout(final ThreadContext context) {
final SSLSessionContext sessionContext = sslSession().getSessionContext();
// default in OpenSSL is 300
if ( sessionContext == null ) return context.runtime.newFixnum(300);
return context.runtime.newFixnum(sessionContext.getSessionTimeout());
}
@JRubyMethod(name = "timeout=")
public IRubyObject set_timeout(final ThreadContext context, IRubyObject timeout) {
final SSLSessionContext sessionContext = sslSession().getSessionContext();
if ( sessionContext == null ) {
warn(context, "WARNING: can not set Session#timeout=("+ timeout +") no session context");
return context.nil;
}
sessionContext.setSessionTimeout(RubyNumeric.fix2int(timeout)); // in seconds as well
return timeout;
}
@Override
public Object toJava(Class target) {
if ( javax.net.ssl.SSLSession.class.isAssignableFrom(target) ) {
return sslSession();
}
return super.toJava(target);
}
}
jruby-openssl-0.9.21/src/main/java/org/jruby/ext/openssl/SSLSocket.java 0000664 0000000 0000000 00000134255 13136616216 0025754 0 ustar 00root root 0000000 0000000 /***** BEGIN LICENSE BLOCK *****
* Version: EPL 1.0/GPL 2.0/LGPL 2.1
*
* The contents of this file are subject to the Eclipse Public
* License Version 1.0 (the "License"); you may not use this file
* except in compliance with the License. You may obtain a copy of
* the License at http://www.eclipse.org/legal/epl-v10.html
*
* Software distributed under the License is distributed on an "AS
* IS" basis, WITHOUT WARRANTY OF ANY KIND, either express or
* implied. See the License for the specific language governing
* rights and limitations under the License.
*
* Copyright (C) 2006, 2007 Ola Bini
*
* Alternatively, the contents of this file may be used under the terms of
* either of the GNU General Public License Version 2 or later (the "GPL"),
* or the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
* in which case the provisions of the GPL or the LGPL are applicable instead
* of those above. If you wish to allow use of your version of this file only
* under the terms of either the GPL or the LGPL, and not to allow others to
* use your version of this file under the terms of the EPL, indicate your
* decision by deleting the provisions above and replace them with the notice
* and other provisions required by the GPL or the LGPL. If you do not delete
* the provisions above, a recipient may use your version of this file under
* the terms of any one of the EPL, the GPL or the LGPL.
***** END LICENSE BLOCK *****/
package org.jruby.ext.openssl;
import java.io.IOException;
import java.net.Socket;
import java.nio.ByteBuffer;
import java.nio.channels.Channel;
import java.nio.channels.ClosedChannelException;
import java.nio.channels.NotYetConnectedException;
import java.nio.channels.SelectableChannel;
import java.nio.channels.SelectionKey;
import java.nio.channels.Selector;
import java.nio.channels.SocketChannel;
import java.security.KeyManagementException;
import java.security.NoSuchAlgorithmException;
import java.security.cert.Certificate;
import java.security.cert.CertificateEncodingException;
import javax.net.ssl.SSLEngine;
import javax.net.ssl.SSLEngineResult;
import javax.net.ssl.SSLException;
import javax.net.ssl.SSLHandshakeException;
import javax.net.ssl.SSLPeerUnverifiedException;
import org.jruby.Ruby;
import org.jruby.RubyArray;
import org.jruby.RubyClass;
import org.jruby.RubyHash;
import org.jruby.RubyIO;
import org.jruby.RubyModule;
import org.jruby.RubyNumeric;
import org.jruby.RubyObject;
import org.jruby.RubyString;
import org.jruby.RubyThread;
import org.jruby.anno.JRubyMethod;
import org.jruby.exceptions.RaiseException;
import org.jruby.ext.openssl.x509store.X509Utils;
import org.jruby.runtime.Arity;
import org.jruby.runtime.Block;
import org.jruby.runtime.ObjectAllocator;
import org.jruby.runtime.ThreadContext;
import org.jruby.runtime.builtin.IRubyObject;
import org.jruby.util.ByteList;
import org.jruby.runtime.Visibility;
import static org.jruby.ext.openssl.SSL.newSSLErrorWaitReadable;
import static org.jruby.ext.openssl.SSL.newSSLErrorWaitWritable;
import static org.jruby.ext.openssl.OpenSSL.*;
/**
* @author Ola Bini
*/
public class SSLSocket extends RubyObject {
private static final long serialVersionUID = -2084816623554406237L;
private static final ObjectAllocator ALLOCATOR = new ObjectAllocator() {
public IRubyObject allocate(Ruby runtime, RubyClass klass) {
return new SSLSocket(runtime, klass);
}
};
public static void createSSLSocket(final Ruby runtime, final RubyModule SSL) { // OpenSSL::SSL
final ThreadContext context = runtime.getCurrentContext();
RubyClass SSLSocket = SSL.defineClassUnder("SSLSocket", runtime.getObject(), ALLOCATOR);
// SSLSocket.addReadAttribute(context, "io");
// SSLSocket.defineAlias("to_io", "io");
// SSLSocket.addReadAttribute(context, "context");
SSLSocket.addReadWriteAttribute(context, "sync_close");
SSLSocket.addReadWriteAttribute(context, "hostname");
SSLSocket.defineAnnotatedMethods(SSLSocket.class);
SSLSocket.undefineMethod("dup");
}
public SSLSocket(Ruby runtime, RubyClass type) {
super(runtime, type);
}
private static RaiseException newSSLError(Ruby runtime, Exception exception) {
return SSL.newSSLError(runtime, exception);
}
private static RaiseException newSSLError(Ruby runtime, String message) {
return SSL.newSSLError(runtime, message);
}
private static RaiseException newSSLErrorFromHandshake(Ruby runtime, SSLHandshakeException exception) {
// SSLHandshakeException is always a wrap around another exception that
// is the actual cause. In some cases the diagnostic message from the original
// exception is also lost and the handshake exception reads "General SSLEngine problem"
// Follow the cause chain until we get the real message and use that to ensure
// we raise an exception that contains the real reason for failure
Exception cause = exception;
while (cause.getCause() != null && (cause instanceof SSLHandshakeException)) {
cause = (Exception) cause.getCause();
}
return SSL.newSSLError(runtime, cause);
}
private SSLContext sslContext;
private SSLEngine engine;
private RubyIO io;
private ByteBuffer peerAppData;
private ByteBuffer peerNetData;
private ByteBuffer netData;
private ByteBuffer dummy;
private boolean initialHandshake = false;
private SSLEngineResult.HandshakeStatus handshakeStatus;
private SSLEngineResult.Status status;
int verifyResult = X509Utils.V_OK;
@Deprecated
public IRubyObject _initialize(final ThreadContext context,
final IRubyObject[] args, final Block unused) {
return initialize(context, args);
}
@JRubyMethod(name = "initialize", rest = true, frame = true, visibility = Visibility.PRIVATE)
public IRubyObject initialize(final ThreadContext context, final IRubyObject[] args) {
final Ruby runtime = context.runtime;
if ( Arity.checkArgumentCount(runtime, args, 1, 2) == 1 ) {
sslContext = new SSLContext(runtime).initializeImpl();
} else {
sslContext = (SSLContext) args[1];
}
if ( ! ( args[0] instanceof RubyIO ) ) {
throw runtime.newTypeError("IO expected but got " + args[0].getMetaClass().getName());
}
setInstanceVariable("@io", this.io = (RubyIO) args[0]); // compat (we do not read @io)
// Ruby 2.3 : @io.nonblock = true if @io.respond_to?(:nonblock=)
if (io.respondsTo("nonblock=")) {
io.callMethod(context, "nonblock=", runtime.getTrue());
}
setInstanceVariable("@context", this.sslContext); // only compat (we do not use @context)
// This is a bit of a hack: SSLSocket should share code with
// RubyBasicSocket, which always sets sync to true.
// Instead we set it here for now.
this.set_sync(context, runtime.getTrue()); // io.sync = true
this.callMethod(context, "sync_close=", runtime.getFalse());
sslContext.setup(context);
return Utils.invokeSuper(context, this, args, Block.NULL_BLOCK); // super()
}
private SSLEngine ossl_ssl_setup(final ThreadContext context)
throws NoSuchAlgorithmException, KeyManagementException, IOException {
SSLEngine engine = this.engine;
if ( engine != null ) return engine;
// Server Name Indication (SNI) RFC 3546
// SNI support will not be attempted unless hostname is explicitly set by the caller
String peerHost = this.callMethod(context, "hostname").toString();
final int peerPort = socketChannelImpl().getRemotePort();
engine = sslContext.createSSLEngine(peerHost, peerPort);
final javax.net.ssl.SSLSession session = engine.getSession();
peerNetData = ByteBuffer.allocate(session.getPacketBufferSize());
peerAppData = ByteBuffer.allocate(session.getApplicationBufferSize());
netData = ByteBuffer.allocate(session.getPacketBufferSize());
peerNetData.limit(0);
peerAppData.limit(0);
netData.limit(0);
dummy = ByteBuffer.allocate(0);
this.engine = engine;
copySessionSetupIfSet();
return engine;
}
@JRubyMethod(name = "io", alias = "to_io")
public final RubyIO io() { return this.io; }
@JRubyMethod(name = "context")
public final SSLContext context() { return this.sslContext; }
@JRubyMethod(name = "sync")
public IRubyObject sync(final ThreadContext context) {
return this.io.callMethod(context, "sync");
}
@JRubyMethod(name = "sync=")
public IRubyObject set_sync(final ThreadContext context, final IRubyObject sync) {
return this.io.callMethod(context, "sync=", sync);
}
@JRubyMethod
public IRubyObject connect(final ThreadContext context) {
return connectImpl(context, true, true);
}
@JRubyMethod
public IRubyObject connect_nonblock(final ThreadContext context) {
return connectImpl(context, false, true);
}
@JRubyMethod
public IRubyObject connect_nonblock(final ThreadContext context, IRubyObject opts) {
return connectImpl(context, false, getExceptionOpt(context, opts));
}
private IRubyObject connectImpl(final ThreadContext context, final boolean blocking, final boolean exception) {
if ( ! sslContext.isProtocolForClient() ) {
throw newSSLError(context.runtime, "called a function you should not call");
}
try {
if ( ! initialHandshake ) {
SSLEngine engine = ossl_ssl_setup(context);
engine.setUseClientMode(true);
engine.beginHandshake();
handshakeStatus = engine.getHandshakeStatus();
initialHandshake = true;
}
callRenegotiationCallback(context);
final IRubyObject ex = doHandshake(blocking, exception);
if ( ex != null ) return ex; // :wait_readable | :wait_writable
}
catch (SSLHandshakeException e) {
//debugStackTrace(runtime, e);
// unlike server side, client should close outbound channel even if
// we have remaining data to be sent.
forceClose();
throw newSSLErrorFromHandshake(context.runtime, e);
}
catch (NoSuchAlgorithmException e) {
debugStackTrace(context.runtime, e);
forceClose();
throw newSSLError(context.runtime, e);
}
catch (KeyManagementException e) {
debugStackTrace(context.runtime, e);
forceClose();
throw newSSLError(context.runtime, e);
}
catch (IOException e) {
//debugStackTrace(context.runtime, e);
forceClose();
throw newSSLError(context.runtime, e);
}
catch (NotYetConnectedException e) {
throw newErrnoEPIPEError(context.runtime, "SSL_connect");
}
return this;
}
private static RaiseException newErrnoEPIPEError(final Ruby runtime, final String detail) {
return Utils.newError(runtime, runtime.getErrno().getClass("EPIPE"), detail);
}
@JRubyMethod
public IRubyObject accept(final ThreadContext context) {
return acceptImpl(context, true, true);
}
@JRubyMethod
public IRubyObject accept_nonblock(final ThreadContext context) {
return acceptImpl(context, false, true);
}
@JRubyMethod
public IRubyObject accept_nonblock(final ThreadContext context, IRubyObject opts) {
return acceptImpl(context, false, getExceptionOpt(context, opts));
}
@Deprecated
public SSLSocket acceptCommon(ThreadContext context, boolean blocking) {
return (SSLSocket) acceptImpl(context, blocking, true);
}
private IRubyObject acceptImpl(final ThreadContext context, final boolean blocking, final boolean exception) {
if ( ! sslContext.isProtocolForServer() ) {
throw newSSLError(context.runtime, "called a function you should not call");
}
try {
if ( ! initialHandshake ) {
final SSLEngine engine = ossl_ssl_setup(context);
engine.setUseClientMode(false);
final IRubyObject verify_mode = sslContext.callMethod(context, "verify_mode");
if ( ! verify_mode.isNil() ) {
final int verify = RubyNumeric.fix2int(verify_mode);
if ( verify == 0 ) { // VERIFY_NONE
engine.setNeedClientAuth(false);
engine.setWantClientAuth(false);
}
if ( ( verify & 1 ) != 0 ) { // VERIFY_PEER
engine.setWantClientAuth(true);
}
if ( ( verify & 2 ) != 0 ) { // VERIFY_FAIL_IF_NO_PEER_CERT
engine.setNeedClientAuth(true);
}
}
engine.beginHandshake();
handshakeStatus = engine.getHandshakeStatus();
initialHandshake = true;
}
callRenegotiationCallback(context);
final IRubyObject ex = doHandshake(blocking, exception);
if ( ex != null ) return ex; // :wait_readable | :wait_writable
}
catch (SSLHandshakeException e) {
final String msg = e.getMessage();
// updated JDK (>= 1.7.0_75) with deprecated SSL protocols :
// javax.net.ssl.SSLHandshakeException: No appropriate protocol (protocol is disabled or cipher suites are inappropriate)
if ( e.getCause() == null && msg != null &&
msg.contains("(protocol is disabled or cipher suites are inappropriate)") ) {
debug(context.runtime, sslContext.getProtocol() + " protocol has been deactivated and is not available by default\n see the java.security.Security property jdk.tls.disabledAlgorithms in /lib/security/java.security file");
}
else {
debugStackTrace(context.runtime, e);
}
throw newSSLErrorFromHandshake(context.runtime, e);
}
catch (NoSuchAlgorithmException e) {
debugStackTrace(context.runtime, e);
throw newSSLError(context.runtime, e);
}
catch (KeyManagementException e) {
debugStackTrace(context.runtime, e);
throw newSSLError(context.runtime, e);
}
catch (IOException e) {
debugStackTrace(context.runtime, e);
throw newSSLError(context.runtime, e);
}
catch (RaiseException e) {
throw e;
}
catch (RuntimeException e) {
debugStackTrace(context.runtime, e);
if ( "Could not generate DH keypair".equals( e.getMessage() ) ) {
throw SSL.handleCouldNotGenerateDHKeyPairError(context.runtime, e);
}
throw newSSLError(context.runtime, e);
}
return this;
}
@JRubyMethod
public IRubyObject verify_result(final ThreadContext context) {
final Ruby runtime = context.runtime;
if (engine == null) {
runtime.getWarnings().warn("SSL session is not started yet.");
return runtime.getNil();
}
return runtime.newFixnum(verifyResult);
}
// This select impl is a copy of RubyThread.select, then blockingLock is
// removed. This impl just set
// SelectableChannel.configureBlocking(false) permanently instead of setting
// temporarily. SSLSocket requires wrapping IO to be selectable so it should
// be OK to set configureBlocking(false) permanently.
private Object waitSelect(final int operations, final boolean blocking, final boolean exception)
throws IOException {
final SocketChannelImpl channel = socketChannelImpl();
if ( ! channel.isSelectable() ) return Boolean.TRUE;
final Ruby runtime = getRuntime();
final RubyThread thread = runtime.getCurrentContext().getThread();
channel.configureBlocking(false);
final Selector selector = runtime.getSelectorPool().get();
final SelectionKey key = channel.register(selector, operations);
try {
final int[] result = new int[1];
if ( ! blocking ) {
try {
result[0] = selector.selectNow();
if ( result[0] == 0 ) {
if ((operations & SelectionKey.OP_READ) != 0 && (operations & SelectionKey.OP_WRITE) != 0) {
if ( key.isReadable() ) {
writeWouldBlock(runtime, exception, result);
}
//else if ( key.isWritable() ) {
// readWouldBlock(runtime, exception, result);
//}
else { //neither, pick one
readWouldBlock(runtime, exception, result);
}
}
else if ((operations & SelectionKey.OP_READ) != 0) {
readWouldBlock(runtime, exception, result);
}
else if ((operations & SelectionKey.OP_WRITE) != 0) {
writeWouldBlock(runtime, exception, result);
}
}
}
catch (IOException ioe) {
throw runtime.newRuntimeError("Error with selector: " + ioe.getMessage());
}
} else {
io.addBlockingThread(thread);
thread.executeBlockingTask(new RubyThread.BlockingTask() {
public void run() throws InterruptedException {
try {
result[0] = selector.select();
}
catch (IOException ioe) {
throw runtime.newRuntimeError("Error with selector: " + ioe.getMessage());
}
}
public void wakeup() {
selector.wakeup();
}
});
}
switch ( result[0] ) {
case READ_WOULD_BLOCK_RESULT :
return runtime.newSymbol("wait_readable"); // exception: false
case WRITE_WOULD_BLOCK_RESULT :
return runtime.newSymbol("wait_writable"); // exception: false
case 0 : return Boolean.FALSE;
default :
//key should always be contained in selectedKeys() here, however there is a bug in
//JRuby <= 9.1.2.0 that makes this not always the case, so we have to check
return selector.selectedKeys().contains(key) ? Boolean.TRUE : Boolean.FALSE;
}
}
catch (InterruptedException interrupt) { return Boolean.FALSE; }
finally {
// Note: I don't like ignoring these exceptions, but it's
// unclear how likely they are to happen or what damage we
// might do by ignoring them. Note that the pieces are separate
// so that we can ensure one failing does not affect the others
// running.
// clean up the key in the selector
try {
if ( key != null ) key.cancel();
if ( selector != null ) selector.selectNow();
}
catch (Exception e) { // ignore
debugStackTrace(runtime, e);
}
// shut down and null out the selector
try {
if ( selector != null ) {
runtime.getSelectorPool().put(selector);
}
}
catch (Exception e) { // ignore
debugStackTrace(runtime, e);
}
if (blocking) {
// remove this thread as a blocker against the given IO
io.removeBlockingThread(thread);
// clear thread state from blocking call
thread.afterBlockingCall();
}
}
}
private static final int READ_WOULD_BLOCK_RESULT = Integer.MIN_VALUE + 1;
private static final int WRITE_WOULD_BLOCK_RESULT = Integer.MIN_VALUE + 2;
private static void readWouldBlock(final Ruby runtime, final boolean exception, final int[] result) {
if ( exception ) throw newSSLErrorWaitReadable(runtime, "read would block");
result[0] = READ_WOULD_BLOCK_RESULT;
}
private static void writeWouldBlock(final Ruby runtime, final boolean exception, final int[] result) {
if ( exception ) throw newSSLErrorWaitWritable(runtime, "write would block");
result[0] = WRITE_WOULD_BLOCK_RESULT;
}
private void doHandshake(final boolean blocking) throws IOException {
doHandshake(blocking, true);
}
// might return :wait_readable | :wait_writable in case (true, false)
private IRubyObject doHandshake(final boolean blocking, final boolean exception) throws IOException {
while (true) {
Object sel = waitSelect(SelectionKey.OP_READ | SelectionKey.OP_WRITE, blocking, exception);
if ( sel instanceof IRubyObject ) return (IRubyObject) sel; // :wait_readable | :wait_writable
// if not blocking, raise EAGAIN
if ( ! blocking && sel != Boolean.TRUE ) {
throw getRuntime().newErrnoEAGAINError("Resource temporarily unavailable");
}
// otherwise, proceed as before
switch (handshakeStatus) {
case FINISHED:
case NOT_HANDSHAKING:
if ( initialHandshake ) finishInitialHandshake();
return null; // OK
case NEED_TASK:
doTasks();
break;
case NEED_UNWRAP:
if (readAndUnwrap(blocking) == -1 && handshakeStatus != SSLEngineResult.HandshakeStatus.FINISHED) {
throw new SSLHandshakeException("Socket closed");
}
// during initialHandshake, calling readAndUnwrap that results UNDERFLOW
// does not mean writable. we explicitly wait for readable channel to avoid
// busy loop.
if (initialHandshake && status == SSLEngineResult.Status.BUFFER_UNDERFLOW) {
sel = waitSelect(SelectionKey.OP_READ, blocking, exception);
if ( sel instanceof IRubyObject ) return (IRubyObject) sel; // :wait_readable
}
break;
case NEED_WRAP:
if ( netData.hasRemaining() ) {
while ( flushData(blocking) ) { /* loop */ }
}
netData.clear();
SSLEngineResult result = engine.wrap(dummy, netData);
handshakeStatus = result.getHandshakeStatus();
netData.flip();
flushData(blocking);
break;
default:
throw new IllegalStateException("Unknown handshaking status: " + handshakeStatus);
}
}
}
private void doTasks() {
Runnable task;
while ((task = engine.getDelegatedTask()) != null) {
task.run();
}
handshakeStatus = engine.getHandshakeStatus();
verifyResult = sslContext.getLastVerifyResult();
}
private boolean flushData(boolean blocking) throws IOException {
try {
writeToChannel(netData, blocking);
}
catch (IOException ioe) {
netData.position(netData.limit());
throw ioe;
}
if ( netData.hasRemaining() ) {
return true;
}
return false;
}
private int writeToChannel(ByteBuffer buffer, boolean blocking) throws IOException {
int totalWritten = 0;
while ( buffer.hasRemaining() ) {
totalWritten += socketChannelImpl().write(buffer);
if ( ! blocking ) break; // don't continue attempting to read
}
return totalWritten;
}
private void finishInitialHandshake() {
initialHandshake = false;
}
private void callRenegotiationCallback(final ThreadContext context) throws RaiseException {
IRubyObject renegotiationCallback = sslContext.getInstanceVariable("@renegotiation_cb");
if(renegotiationCallback == null || renegotiationCallback.isNil()) {
return;
}
else {
// the return of the Proc is not important
// Can throw ruby exception to "disallow" renegotiations
renegotiationCallback.callMethod(context, "call", this);
}
}
public int write(ByteBuffer src, boolean blocking) throws SSLException, IOException {
if ( initialHandshake ) {
throw new IOException("Writing not possible during handshake");
}
SocketChannelImpl channel = socketChannelImpl();
final boolean blockingMode = channel.isBlocking();
if ( ! blocking ) channel.configureBlocking(false);
try {
if ( netData.hasRemaining() ) {
flushData(blocking);
}
netData.clear();
final SSLEngineResult result = engine.wrap(src, netData);
if ( result.getStatus() == SSLEngineResult.Status.CLOSED ) {
throw getRuntime().newIOError("closed SSL engine");
}
netData.flip();
flushData(blocking);
return result.bytesConsumed();
}
finally {
if ( ! blocking ) channel.configureBlocking(blockingMode);
}
}
public int read(final ByteBuffer dst, final boolean blocking) throws IOException {
if ( initialHandshake ) return 0;
if ( engine.isInboundDone() ) return -1;
if ( ! peerAppData.hasRemaining() ) {
int appBytesProduced = readAndUnwrap(blocking);
if (appBytesProduced == -1 || appBytesProduced == 0) {
return appBytesProduced;
}
}
int limit = Math.min(peerAppData.remaining(), dst.remaining());
peerAppData.get(dst.array(), dst.arrayOffset(), limit);
dst.position(dst.arrayOffset() + limit);
return limit;
}
private int readAndUnwrap(final boolean blocking) throws IOException {
final int bytesRead = socketChannelImpl().read(peerNetData);
if ( bytesRead == -1 ) {
if ( ! peerNetData.hasRemaining() ||
( status == SSLEngineResult.Status.BUFFER_UNDERFLOW ) ) {
closeInbound();
return -1;
}
// inbound channel has been already closed but closeInbound() must
// be defered till the last engine.unwrap() call.
// peerNetData could not be empty.
}
peerAppData.clear();
peerNetData.flip();
SSLEngineResult result;
do {
result = engine.unwrap(peerNetData, peerAppData);
}
while ( result.getStatus() == SSLEngineResult.Status.OK &&
result.getHandshakeStatus() == SSLEngineResult.HandshakeStatus.NEED_UNWRAP &&
result.bytesProduced() == 0 );
if ( result.getHandshakeStatus() == SSLEngineResult.HandshakeStatus.FINISHED ) {
finishInitialHandshake();
}
if ( peerAppData.position() == 0 &&
result.getStatus() == SSLEngineResult.Status.OK &&
peerNetData.hasRemaining() ) {
result = engine.unwrap(peerNetData, peerAppData);
}
status = result.getStatus();
handshakeStatus = result.getHandshakeStatus();
if ( bytesRead == -1 && ! peerNetData.hasRemaining() ) {
// now it's safe to call closeInbound().
closeInbound();
}
if ( status == SSLEngineResult.Status.CLOSED ) {
doShutdown();
return -1;
}
peerNetData.compact();
peerAppData.flip();
if ( ! initialHandshake && (
handshakeStatus == SSLEngineResult.HandshakeStatus.NEED_TASK ||
handshakeStatus == SSLEngineResult.HandshakeStatus.NEED_WRAP ||
handshakeStatus == SSLEngineResult.HandshakeStatus.FINISHED ) ) {
doHandshake(blocking);
}
return peerAppData.remaining();
}
private void closeInbound() {
try {
engine.closeInbound();
}
catch (SSLException e) {
debug(getRuntime(), "SSLSocket.closeInbound", e);
// ignore any error on close. possibly an error like this;
// Inbound closed before receiving peer's close_notify: possible truncation attack?
}
}
private void doShutdown() throws IOException {
if ( engine.isOutboundDone() ) return;
netData.clear();
try {
engine.wrap(dummy, netData);
}
catch (SSLException e) {
debug(getRuntime(), "SSLSocket.doShutdown", e);
return;
}
catch (RuntimeException e) {
debugStackTrace(getRuntime(), e);
return;
}
netData.flip();
flushData(true);
}
private IRubyObject sysreadImpl(final ThreadContext context,
IRubyObject len, IRubyObject buff, final boolean blocking, final boolean exception) {
final Ruby runtime = context.runtime;
final int length = RubyNumeric.fix2int(len);
final RubyString buffStr;
if ( buff != null && ! buff.isNil() ) {
buffStr = buff.asString();
} else {
buffStr = RubyString.newEmptyString(runtime); // fine since we're setValue
}
if ( length == 0 ) {
buffStr.clear();
return buffStr;
}
if ( length < 0 ) {
throw runtime.newArgumentError("negative string size (or size too big)");
}
try {
// So we need to make sure to only block when there is no data left to process
if ( engine == null || ! ( peerAppData.hasRemaining() || peerNetData.position() > 0 ) ) {
final Object ex = waitSelect(SelectionKey.OP_READ, blocking, exception);
if ( ex instanceof IRubyObject ) return (IRubyObject) ex; // :wait_readable
}
final ByteBuffer dst = ByteBuffer.allocate(length);
int read = -1;
// ensure >0 bytes read; sysread is blocking read.
while ( read <= 0 ) {
if ( engine == null ) {
read = socketChannelImpl().read(dst);
} else {
read = read(dst, blocking);
}
if ( read == -1 ) {
if ( exception ) throw runtime.newEOFError();
return runtime.getNil();
}
if ( read == 0 && status == SSLEngineResult.Status.BUFFER_UNDERFLOW ) {
// If we didn't get any data back because we only read in a partial TLS record,
// instead of spinning until the rest comes in, call waitSelect to either block
// until the rest is available, or throw a "read would block" error if we are in
// non-blocking mode.
final Object ex = waitSelect(SelectionKey.OP_READ, blocking, exception);
if ( ex instanceof IRubyObject ) return (IRubyObject) ex; // :wait_readable
}
}
final byte[] bytesRead = dst.array();
final int offset = dst.position() - read;
buffStr.setValue(new ByteList(bytesRead, offset, read, false));
return buffStr;
}
catch (IOException ioe) {
throw runtime.newIOError(ioe.getMessage());
}
}
@JRubyMethod
public IRubyObject sysread(ThreadContext context, IRubyObject len) {
return sysreadImpl(context, len, null, true, true);
}
@JRubyMethod
public IRubyObject sysread(ThreadContext context, IRubyObject len, IRubyObject buff) {
return sysreadImpl(context, len, buff, true, true);
}
@Deprecated // @JRubyMethod(rest = true, required = 1, optional = 1)
public IRubyObject sysread(ThreadContext context, IRubyObject[] args) {
switch ( args.length) {
case 1 :
return sysread(context, args[0]);
case 2 :
return sysread(context, args[0], args[1]);
}
Arity.checkArgumentCount(context.runtime, args.length, 1, 2);
return null; // won't happen as checkArgumentCount raises
}
@JRubyMethod
public IRubyObject sysread_nonblock(ThreadContext context, IRubyObject len) {
return sysreadImpl(context, len, null, false, true);
}
@JRubyMethod
public IRubyObject sysread_nonblock(ThreadContext context, IRubyObject len, IRubyObject arg) {
if ( arg instanceof RubyHash ) { // exception: false
// NOTE: on Ruby 2.3 this is expected to raise a TypeError (but not on 2.2)
return sysreadImpl(context, len, null, false, getExceptionOpt(context, arg));
}
return sysreadImpl(context, len, arg, false, true); // buffer arg
}
@JRubyMethod
public IRubyObject sysread_nonblock(ThreadContext context, IRubyObject len, IRubyObject buff, IRubyObject opts) {
return sysreadImpl(context, len, buff, false, getExceptionOpt(context, opts));
}
@Deprecated // @JRubyMethod(rest = true, required = 1, optional = 2)
public IRubyObject sysread_nonblock(ThreadContext context, IRubyObject[] args) {
switch ( args.length) {
case 1 :
return sysread_nonblock(context, args[0]);
case 2 :
return sysread_nonblock(context, args[0], args[1]);
case 3 :
return sysread_nonblock(context, args[0], args[1], args[2]);
}
Arity.checkArgumentCount(context.runtime, args.length, 1, 3);
return null; // won't happen as checkArgumentCount raises
}
private IRubyObject syswriteImpl(final ThreadContext context,
final IRubyObject arg, final boolean blocking, final boolean exception) {
final Ruby runtime = context.runtime;
try {
checkClosed();
final Object ex = waitSelect(SelectionKey.OP_WRITE, blocking, exception);
if ( ex instanceof IRubyObject ) return (IRubyObject) ex; // :wait_writable
ByteList bytes = arg.asString().getByteList();
ByteBuffer buff = ByteBuffer.wrap(bytes.getUnsafeBytes(), bytes.getBegin(), bytes.getRealSize());
final int written;
if ( engine == null ) {
written = writeToChannel(buff, blocking);
} else {
written = write(buff, blocking);
}
this.io.callMethod(context, "flush");
return runtime.newFixnum(written);
}
catch (IOException ioe) {
throw runtime.newIOError(ioe.getMessage());
}
}
@JRubyMethod
public IRubyObject syswrite(ThreadContext context, IRubyObject arg) {
return syswriteImpl(context, arg, true, true);
}
@JRubyMethod
public IRubyObject syswrite_nonblock(ThreadContext context, IRubyObject arg) {
return syswriteImpl(context, arg, false, true);
}
@JRubyMethod
public IRubyObject syswrite_nonblock(ThreadContext context, IRubyObject arg, IRubyObject opts) {
return syswriteImpl(context, arg, false, getExceptionOpt(context, opts));
}
private static boolean getExceptionOpt(final ThreadContext context, final IRubyObject opts) {
if ( opts instanceof RubyHash ) { // exception: true
final Ruby runtime = context.runtime;
IRubyObject exc = ((RubyHash) opts).op_aref(context, runtime.newSymbol("exception"));
return exc != runtime.getFalse();
}
return true;
}
private void checkClosed() {
if ( ! socketChannelImpl().isOpen() ) {
throw getRuntime().newIOError("closed stream");
}
}
// do shutdown even if we have remaining data to be sent.
// call this when you get an exception from client side.
private void forceClose() {
close(true);
}
private void close(boolean force) {
if ( engine == null ) {
// if ( force ) throw getRuntime().newEOFError();
return;
}
engine.closeOutbound();
if ( ! force && netData.hasRemaining() ) return;
try {
doShutdown();
}
catch (IOException e) { // ignore?
debug(getRuntime(), "SSLSocket.close doShutdown failed", e);
}
catch (NotYetConnectedException e) {
debug(getRuntime(), "SSLSocket.close doShutdown failed", e);
}
}
@JRubyMethod
public IRubyObject sysclose(final ThreadContext context) {
//if ( isClosed() ) return context.runtime.getNil();
if ( this.io.callMethod(context, "closed?").isTrue() ) {
return context.runtime.getNil();
} // Ruby 2.3
// no need to try shutdown when it's a server
close( sslContext.isProtocolForClient() );
if ( this.callMethod(context, "sync_close").isTrue() ) {
return this.io.callMethod(context, "close");
}
return context.runtime.getNil();
}
@JRubyMethod
public IRubyObject cert(final ThreadContext context) {
final Ruby runtime = context.runtime;
if ( engine == null ) return runtime.getNil();
try {
Certificate[] cert = engine.getSession().getLocalCertificates();
if ( cert != null && cert.length > 0 ) {
return X509Cert.wrap(context, cert[0]);
}
}
catch (CertificateEncodingException e) {
throw X509Cert.newCertificateError(runtime, e);
}
return runtime.getNil();
}
// @Deprecated
public final IRubyObject cert() {
return cert(getRuntime().getCurrentContext());
}
@JRubyMethod
public IRubyObject peer_cert(final ThreadContext context) {
final Ruby runtime = context.runtime;
if ( engine == null ) return runtime.getNil();
try {
Certificate[] cert = engine.getSession().getPeerCertificates();
if ( cert.length > 0 ) {
return X509Cert.wrap(context, cert[0]);
}
}
catch (CertificateEncodingException e) {
throw X509Cert.newCertificateError(runtime, e);
}
catch (SSLPeerUnverifiedException e) {
if (OpenSSL.isDebug(runtime)) {
runtime.getWarnings().warning(String.format("%s: %s", e.getClass().getName(), e.getMessage()));
}
}
return runtime.getNil();
}
// @Deprecated
public final IRubyObject peer_cert() {
return peer_cert(getRuntime().getCurrentContext());
}
@JRubyMethod
public IRubyObject peer_cert_chain(final ThreadContext context) {
final Ruby runtime = context.runtime;
if ( engine == null ) return runtime.getNil();
try {
javax.security.cert.Certificate[] certs = engine.getSession().getPeerCertificateChain();
IRubyObject[] cert_chain = new IRubyObject[ certs.length ];
for ( int i = 0; i < certs.length; i++ ) {
cert_chain[i] = X509Cert.wrap(context, certs[i]);
}
return runtime.newArrayNoCopy(cert_chain);
}
catch (javax.security.cert.CertificateEncodingException e) {
throw X509Cert.newCertificateError(getRuntime(), e);
}
catch (SSLPeerUnverifiedException e) {
if (runtime.isVerbose() || OpenSSL.isDebug(runtime)) {
runtime.getWarnings().warning(String.format("%s: %s", e.getClass().getName(), e.getMessage()));
}
}
return runtime.getNil();
}
// @Deprecated
public final IRubyObject peer_cert_chain() {
return peer_cert_chain(getRuntime().getCurrentContext());
}
@JRubyMethod
public IRubyObject cipher() {
if ( engine == null ) return getRuntime().getNil();
return getRuntime().newString( engine.getSession().getCipherSuite() );
}
@JRubyMethod
public IRubyObject npn_protocol() {
if ( engine == null ) return getRuntime().getNil();
// NOTE: maybe a time to use https://github.com/benmmurphy/ssl_npn
warn(getRuntime().getCurrentContext(), "WARNING: SSLSocket#npn_protocol is not supported");
return getRuntime().getNil(); // throw new UnsupportedOperationException();
}
@JRubyMethod
public IRubyObject state() {
warn(getRuntime().getCurrentContext(), "WARNING: unimplemented method called: SSLSocket#state");
return getRuntime().getNil();
}
@JRubyMethod
public IRubyObject pending() {
warn(getRuntime().getCurrentContext(), "WARNING: unimplemented method called: SSLSocket#pending");
return getRuntime().getNil();
}
private boolean reusableSSLEngine() {
if ( engine != null ) {
final String peerHost = engine.getPeerHost();
if ( peerHost != null && peerHost.length() > 0 ) {
// NOT getSSLContext().createSSLEngine() - no hints for session reuse
return true;
}
}
return false;
}
@JRubyMethod(name = "session_reused?")
public IRubyObject session_reused_p() {
if ( reusableSSLEngine() ) {
if ( ! engine.getEnableSessionCreation() ) {
// if session creation is disabled we can be sure its to be re-used
return getRuntime().getTrue();
}
//return getRuntime().getFalse(); // NOTE: likely incorrect (we can not decide)
}
//warn(getRuntime().getCurrentContext(), "WARNING: SSLSocket#session_reused? is not supported");
return getRuntime().getNil(); // can not decide - probably not
}
// JSSE: SSL Sessions can be reused only if connecting to the same host at the same port
final javax.net.ssl.SSLSession sslSession() {
return engine == null ? null : engine.getSession();
}
private transient SSLSession session;
@JRubyMethod(name = "session")
public IRubyObject session(final ThreadContext context) {
if ( sslSession() == null ) return context.nil;
return getSession(context.runtime);
}
private SSLSession getSession(final Ruby runtime) {
if ( session == null ) {
return session = new SSLSession(runtime).initializeImpl(this);
}
return session;
}
private transient SSLSession setSession = null;
@JRubyMethod(name = "session=")
public IRubyObject set_session(IRubyObject session) {
// NOTE: we can not fully support this without the SSL provider internals
// but we can assume setting a session= is meant as a forced session re-use
if ( session instanceof SSLSession ) {
setSession = (SSLSession) session;
if ( engine != null ) copySessionSetupIfSet();
}
//warn(context, "WARNING: SSLSocket#session= has not effect");
return getRuntime().getNil();
}
private void copySessionSetupIfSet() {
if ( setSession != null ) {
if ( reusableSSLEngine() ) {
engine.setEnableSessionCreation(false);
final ThreadContext context = getRuntime().getCurrentContext();
if ( ! setSession.equals( getSession(context.runtime) ) ) {
getSession(context.runtime).set_timeout(context, setSession.timeout(context));
}
}
}
}
@JRubyMethod
public IRubyObject ssl_version() {
if ( engine == null ) return getRuntime().getNil();
return getRuntime().newString( engine.getSession().getProtocol() );
}
private transient SocketChannelImpl socketChannel;
private SocketChannelImpl socketChannelImpl() {
if ( socketChannel != null ) return socketChannel;
final Channel channel = io.getChannel();
if ( channel instanceof SocketChannel ) {
return socketChannel = new JavaSocketChannel((SocketChannel) channel);
}
// TODO JNR
throw new IllegalStateException("unknow channel impl: " + channel + " of type " + channel.getClass().getName());
}
private interface SocketChannelImpl {
boolean isOpen() ;
int read(ByteBuffer dst) throws IOException ;
int write(ByteBuffer src) throws IOException ;
int getRemotePort();
boolean isSelectable() ;
// SelectableChannel
boolean isBlocking() ;
void configureBlocking(boolean block) throws IOException ;
SelectionKey register(Selector selector, int ops) throws IOException ;
//boolean selectionOpsReadable(final int readyOps);
//boolean selectionOpsWritable(final int readyOps) ;
}
private static final class JavaSocketChannel implements SocketChannelImpl {
JavaSocketChannel(final SocketChannel channel) {
this.channel = channel;
}
private final SocketChannel channel;
public boolean isOpen() { return channel.isOpen(); }
public int read(ByteBuffer dst) throws IOException {
return channel.read(dst);
}
public int write(ByteBuffer src) throws IOException {
return channel.write(src);
}
public int getRemotePort() { return channel.socket().getPort(); }
public boolean isSelectable() {
return true; // return channel instanceof SelectableChannel;
}
public boolean isBlocking() { return channel.isBlocking(); }
public void configureBlocking(boolean block) throws IOException {
channel.configureBlocking(block);
}
public SelectionKey register(Selector selector, int ops) throws ClosedChannelException {
return channel.register(selector, ops);
}
public boolean selectionOpsReadable(final int readyOps) {
return (readyOps & SelectionKey.OP_READ) != 0;
}
public boolean selectionOpsWritable(final int readyOps) {
return (readyOps & SelectionKey.OP_WRITE) != 0;
}
}
private static boolean jnrChannel(final Channel channel) {
return channel.getClass().getName().startsWith("jnr.");
}
}// SSLSocket
jruby-openssl-0.9.21/src/main/java/org/jruby/ext/openssl/SecurityHelper.java 0000664 0000000 0000000 00000104167 13136616216 0027110 0 ustar 00root root 0000000 0000000 /*
* The MIT License
*
* Copyright 2014 Karol Bucek.
*
* Permission is hereby granted, free of charge, to any person obtaining a copy
* of this software and associated documentation files (the "Software"), to deal
* in the Software without restriction, including without limitation the rights
* to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
* copies of the Software, and to permit persons to whom the Software is
* furnished to do so, subject to the following conditions:
*
* The above copyright notice and this permission notice shall be included in
* all copies or substantial portions of the Software.
*
* THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
* IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
* FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
* AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
* LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
* OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
* THE SOFTWARE.
*/
package org.jruby.ext.openssl;
import static org.jruby.ext.openssl.OpenSSL.debugStackTrace;
import java.io.IOException;
import java.lang.reflect.Constructor;
import java.lang.reflect.Field;
import java.lang.reflect.InvocationTargetException;
import java.lang.reflect.Method;
import java.math.BigInteger;
import java.security.InvalidKeyException;
import java.security.KeyFactory;
import java.security.KeyFactorySpi;
import java.security.KeyPairGenerator;
import java.security.KeyPairGeneratorSpi;
import java.security.KeyStore;
import java.security.KeyStoreException;
import java.security.MessageDigest;
import java.security.MessageDigestSpi;
import java.security.NoSuchAlgorithmException;
import java.security.Provider;
import java.security.PublicKey;
import java.security.SecureRandom;
import java.security.SecureRandomSpi;
import java.security.Security;
import java.security.Signature;
import java.security.SignatureException;
import java.security.SignatureSpi;
import java.security.cert.CRLException;
import java.security.cert.CertificateException;
import java.security.cert.CertificateFactory;
import java.security.cert.CertificateFactorySpi;
import java.security.cert.X509CRL;
import java.security.interfaces.DSAParams;
import java.security.interfaces.DSAPublicKey;
import java.security.interfaces.RSAPublicKey;
import java.util.Locale;
import java.util.Map;
import java.util.StringTokenizer;
import java.util.concurrent.ConcurrentHashMap;
import javax.crypto.Cipher;
import javax.crypto.CipherSpi;
import javax.crypto.KeyAgreement;
import javax.crypto.KeyAgreementSpi;
import javax.crypto.KeyGenerator;
import javax.crypto.KeyGeneratorSpi;
import javax.crypto.Mac;
import javax.crypto.MacSpi;
import javax.crypto.NoSuchPaddingException;
import javax.crypto.SecretKeyFactory;
import javax.crypto.SecretKeyFactorySpi;
import javax.net.ssl.SSLContext;
import org.bouncycastle.asn1.x509.AlgorithmIdentifier;
import org.bouncycastle.asn1.x509.CertificateList;
import org.bouncycastle.cert.CertException;
import org.bouncycastle.cert.X509CRLHolder;
import org.bouncycastle.crypto.params.AsymmetricKeyParameter;
import org.bouncycastle.crypto.params.DSAParameters;
import org.bouncycastle.crypto.params.DSAPublicKeyParameters;
import org.bouncycastle.crypto.params.RSAKeyParameters;
import org.bouncycastle.jce.provider.X509CRLObject;
import org.bouncycastle.operator.ContentVerifierProvider;
import org.bouncycastle.operator.DefaultDigestAlgorithmIdentifierFinder;
import org.bouncycastle.operator.DigestAlgorithmIdentifierFinder;
import org.bouncycastle.operator.OperatorException;
import org.bouncycastle.operator.bc.BcDSAContentVerifierProviderBuilder;
import org.bouncycastle.operator.bc.BcRSAContentVerifierProviderBuilder;
/**
* Java Security (and JCE) helpers.
*
* @author kares
*/
public abstract class SecurityHelper {
private static String BC_PROVIDER_CLASS = "org.bouncycastle.jce.provider.BouncyCastleProvider";
private static String BC_PROVIDER_NAME = "BC";
static boolean setBouncyCastleProvider = true; // (package access for tests)
static Provider securityProvider; // 'BC' provider (package access for tests)
private static volatile Boolean registerProvider = null;
static final Map implEngines = new ConcurrentHashMap(16, 0.75f, 1);
/**
* inject under a given name a cipher. also ensures that the registered
* classes are getting used.
*
* @param name the name under which the class gets registered
* @param clazz the CipherSpi class
*/
public static void addCipher(String name, Class clazz) {
implEngines.put("Cipher:" + name, clazz);
tryCipherInternal = true;
}
/**
* inject under a given name a signature
*
* @param name the name under which the class gets registered
* @param clazz the SignaturSpi class
*/
public static void addSignature(String name, Class clazz) {
implEngines.put("Signature:" + name, clazz);
}
public static Provider getSecurityProvider() {
if ( setBouncyCastleProvider && securityProvider == null ) {
synchronized(SecurityHelper.class) {
if ( setBouncyCastleProvider && securityProvider == null ) {
setBouncyCastleProvider(); setBouncyCastleProvider = false;
}
}
}
doRegisterProvider();
return securityProvider;
}
static final boolean SPI_ACCESSIBLE;
static {
boolean canSetAccessible = true;
if ( OpenSSL.javaVersion9(true) ) {
final Provider provider = getSecurityProvider();
if ( provider != null ) {
try {
// NOTE: some getXxx pieces might still work
// where SPI are returned directly + there's a public e.g. MessageDigest(...)
getCertificateFactory("X.509", provider); // !!! disables EVERYTHING :(
}
catch (CertificateException ex) {
debugStackTrace(ex);
canSetAccessible = false;
}
catch (RuntimeException ex) {
debugStackTrace(ex);
// java.lang.reflect.InaccessibleObjectException (extends RuntimeException)
canSetAccessible = false;
}
}
}
SPI_ACCESSIBLE = canSetAccessible;
}
static Provider getSecurityProviderIfAccessible() {
return SPI_ACCESSIBLE ? getSecurityProvider() : null;
}
public static synchronized void setSecurityProvider(final Provider provider) {
if ( provider != null ) OpenSSL.debug("using provider: " + provider);
securityProvider = provider;
}
static synchronized void setBouncyCastleProvider() {
setSecurityProvider( newBouncyCastleProvider() );
}
private static Provider newBouncyCastleProvider() {
try {
return (Provider) Class.forName(BC_PROVIDER_CLASS).newInstance();
}
catch (Throwable ignored) { /* no bouncy castle available */ }
return null;
}
public static synchronized void setRegisterProvider(final boolean register) {
registerProvider = Boolean.valueOf(register);
if ( register ) getSecurityProvider(); // so that securityProvider != null
// getSecurityProvider does doRegisterProvider();
}
static boolean isProviderAvailable(final String name) {
return Security.getProvider(name) != null;
}
public static boolean isProviderRegistered() {
if ( securityProvider == null ) return false;
return Security.getProvider(securityProvider.getName()) != null;
}
private static void doRegisterProvider() {
if ( registerProvider != null ) {
synchronized(SecurityHelper.class) {
final Boolean register = registerProvider;
if ( register != null && register.booleanValue() ) {
if ( securityProvider != null ) {
Security.addProvider(securityProvider);
registerProvider = null;
}
}
}
}
}
/**
* @note code calling this should not assume BC provider internals !
*/
public static CertificateFactory getCertificateFactory(final String type)
throws CertificateException {
try {
final Provider provider = getSecurityProviderIfAccessible();
if ( provider != null ) return getCertificateFactory(type, provider);
}
catch (CertificateException e) { debugStackTrace(e); }
return CertificateFactory.getInstance(type);
}
static CertificateFactory getCertificateFactory(final String type, final Provider provider)
throws CertificateException {
final CertificateFactorySpi spi;
boolean addedBC = false;
synchronized(SecurityHelper.class) {
try { // TODO fixed since BC 1.55 (only needed on 1.54) and should be removed eventually ...
if (provider.getName().equals(BC_PROVIDER_NAME) && Security.getProvider(BC_PROVIDER_NAME) == null) {
Security.addProvider(provider);
addedBC = true;
}
spi = (CertificateFactorySpi) getImplEngine("CertificateFactory", type);
} finally {
if (addedBC) {
Security.removeProvider(BC_PROVIDER_NAME);
}
}
}
if ( spi == null ) throw new CertificateException(type + " not found");
return newInstance(CertificateFactory.class,
new Class[]{ CertificateFactorySpi.class, Provider.class, String.class },
new Object[]{ spi, provider, type }
);
}
/**
* @note code calling this should not assume BC provider internals !
*/
public static KeyFactory getKeyFactory(final String algorithm)
throws NoSuchAlgorithmException {
try {
final Provider provider = getSecurityProviderIfAccessible();
if ( provider != null ) return getKeyFactory(algorithm, provider);
}
catch (NoSuchAlgorithmException e) { }
return KeyFactory.getInstance(algorithm);
}
static KeyFactory getKeyFactory(final String algorithm, final Provider provider)
throws NoSuchAlgorithmException {
KeyFactorySpi spi = (KeyFactorySpi) getImplEngine("KeyFactory", algorithm);
if ( spi == null ) throw new NoSuchAlgorithmException(algorithm + " not found");
return newInstance(KeyFactory.class,
new Class[] { KeyFactorySpi.class, Provider.class, String.class },
new Object[] { spi, provider, algorithm }
);
}
/**
* @note code calling this should not assume BC provider internals !
*/
public static KeyPairGenerator getKeyPairGenerator(final String algorithm)
throws NoSuchAlgorithmException {
try {
final Provider provider = getSecurityProviderIfAccessible();
if ( provider != null ) return getKeyPairGenerator(algorithm, provider);
}
catch (NoSuchAlgorithmException e) { }
return KeyPairGenerator.getInstance(algorithm);
}
@SuppressWarnings("unchecked")
static KeyPairGenerator getKeyPairGenerator(final String algorithm, final Provider provider)
throws NoSuchAlgorithmException {
final Object spi = getImplEngine("KeyPairGenerator", algorithm);
if ( spi == null ) {
throw new NoSuchAlgorithmException(algorithm + " KeyPairGenerator not available");
}
final KeyPairGenerator keyPairGenerator;
if ( spi instanceof KeyPairGenerator ) {
keyPairGenerator = (KeyPairGenerator) spi;
}
else {
final Class delegate;
try {
delegate = (Class)
Class.forName(KeyPairGenerator.class.getName() + "$Delegate");
} catch (ClassNotFoundException e) { throw new RuntimeException(e); }
keyPairGenerator = newInstance(delegate,
new Class[] { KeyPairGeneratorSpi.class, String.class }, spi, algorithm
);
}
setField(keyPairGenerator, KeyPairGenerator.class, "provider", provider);
return keyPairGenerator;
}
/**
* @note code calling this should not assume BC provider internals !
*/
public static KeyStore getKeyStore(final String type)
throws KeyStoreException {
try {
final Provider provider = getSecurityProviderIfAccessible();
if ( provider != null ) return getKeyStore(type, provider);
}
catch (KeyStoreException e) { }
return KeyStore.getInstance(type);
}
static KeyStore getKeyStore(final String type, final Provider provider)
throws KeyStoreException {
return KeyStore.getInstance(type, provider);
}
/**
* @note code calling this should not assume BC provider internals !
*/
public static MessageDigest getMessageDigest(final String algorithm) throws NoSuchAlgorithmException {
try {
final Provider provider = getSecurityProviderIfAccessible();
if ( provider != null ) return getMessageDigest(algorithm, provider);
}
catch (NoSuchAlgorithmException e) { }
return MessageDigest.getInstance(algorithm);
}
@SuppressWarnings("unchecked")
static MessageDigest getMessageDigest(final String algorithm, final Provider provider)
throws NoSuchAlgorithmException {
final Object spi = getImplEngine("MessageDigest", algorithm);
if ( spi == null ) throw new NoSuchAlgorithmException(algorithm + " not found");
final MessageDigest messageDigest;
if ( spi instanceof MessageDigest ) {
messageDigest = (MessageDigest) spi;
}
else {
final Class delegate;
try {
delegate = (Class)
Class.forName(MessageDigest.class.getName() + "$Delegate");
} catch (ClassNotFoundException e) { throw new RuntimeException(e); }
messageDigest = newInstance(delegate,
new Class[] { MessageDigestSpi.class, String.class }, spi, algorithm
);
}
setField(messageDigest, MessageDigest.class, "provider", provider);
return messageDigest;
}
public static SecureRandom getSecureRandom() {
try {
final Provider provider = getSecurityProviderIfAccessible();
if ( provider != null ) {
final String algorithm = getSecureRandomAlgorithm(provider);
if ( algorithm != null ) {
return getSecureRandom(algorithm, provider);
}
}
}
catch (NoSuchAlgorithmException e) { }
return new SecureRandom(); // likely "SHA1PRNG" from SPI sun.security.provider.SecureRandom
}
private static SecureRandom getSecureRandom(final String algorithm, final Provider provider)
throws NoSuchAlgorithmException {
final SecureRandomSpi spi = (SecureRandomSpi) getImplEngine("SecureRandom", algorithm);
if ( spi == null ) throw new NoSuchAlgorithmException(algorithm + " not found");
return newInstance(SecureRandom.class,
new Class[] { SecureRandomSpi.class, Provider.class, String.class },
new Object[] { spi, provider, algorithm }
);
}
// NOTE: none (at least for BC 1.47)
private static String getSecureRandomAlgorithm(final Provider provider) {
for ( Provider.Service service : provider.getServices() ) {
if ( "SecureRandom".equals( service.getType() ) ) {
return service.getAlgorithm();
}
}
return null;
}
private static Boolean tryCipherInternal = Boolean.FALSE;
/**
* @note code calling this should not assume BC provider internals !
*/
public static Cipher getCipher(final String transformation)
throws NoSuchAlgorithmException, NoSuchPaddingException {
try {
if ( tryCipherInternal == Boolean.FALSE ) {
final Provider provider = getSecurityProvider();
if ( provider != null ) {
return getCipher(transformation, provider);
}
}
}
catch (NoSuchAlgorithmException e) { }
catch (NoSuchPaddingException e) { }
catch (SecurityException e) {
// java.lang.SecurityException: JCE cannot authenticate the provider BC
if ( tryCipherInternal != null ) tryCipherInternal = Boolean.TRUE;
debugStackTrace(e);
}
if ( tryCipherInternal == Boolean.TRUE ) {
try {
final Provider provider = getSecurityProvider();
if ( provider != null ) {
return getCipherInternal(transformation, provider);
}
}
catch (NoSuchAlgorithmException e) { }
catch (RuntimeException e) {
// likely javax.crypto.JceSecurityManager.isCallerTrusted gets
// us a NPE from javax.crypto.Cipher.(Cipher.java:264)
tryCipherInternal = null; // do not try BC at all
debugStackTrace(e);
}
}
return Cipher.getInstance(transformation);
}
static Cipher getCipher(final String transformation, final Provider provider)
throws NoSuchAlgorithmException, NoSuchPaddingException {
return Cipher.getInstance(transformation, provider);
}
private static final Class[] STRING_PARAM = { String.class };
private static Cipher getCipherInternal(String transformation, final Provider provider)
throws NoSuchAlgorithmException {
CipherSpi spi = (CipherSpi) getImplEngine("Cipher", transformation);
if ( spi == null ) {
//
// try the long way
//
StringTokenizer tok = new StringTokenizer(transformation, "/");
final String algorithm = tok.nextToken();
spi = (CipherSpi) getImplEngine("Cipher", algorithm);
if ( spi == null ) {
// if ( silent ) return null;
throw new NoSuchAlgorithmException(transformation + " not found");
}
//
// make sure we don't get fooled by a "//" in the string
//
if ( tok.hasMoreTokens() && ! transformation.regionMatches(algorithm.length(), "//", 0, 2) ) {
// spi.engineSetMode(tok.nextToken()) :
invoke(spi, CipherSpi.class, "engineSetMode", STRING_PARAM, tok.nextToken());
}
if ( tok.hasMoreTokens() ) {
// spi.engineSetPadding(tok.nextToken()) :
invoke(spi, CipherSpi.class, "engineSetPadding", STRING_PARAM, tok.nextToken());
}
}
try {
// this constructor does not verify the provider
Cipher cipher = newInstance(Cipher.class,
new Class[] { CipherSpi.class, String.class },
new Object[] { spi, transformation }
);
setField(cipher, Cipher.class, "provider", provider);
return cipher;
}
catch( Exception e ) {
// this constructor does verify the provider which might fail
return newInstance(Cipher.class,
new Class[] { CipherSpi.class, Provider.class, String.class },
new Object[] { spi, provider, transformation }
);
}
}
/**
* @note code calling this should not assume BC provider internals !
*/
public static Signature getSignature(final String algorithm) throws NoSuchAlgorithmException {
try {
final Provider provider = getSecurityProviderIfAccessible();
if ( provider != null ) return getSignature(algorithm, provider);
}
catch (NoSuchAlgorithmException e) { }
return Signature.getInstance(algorithm);
}
@SuppressWarnings("unchecked")
static Signature getSignature(final String algorithm, final Provider provider)
throws NoSuchAlgorithmException {
final Object spi = getImplEngine("Signature", algorithm);
if ( spi == null ) throw new NoSuchAlgorithmException(algorithm + " Signature not available");
final Signature signature;
if ( spi instanceof Signature ) {
signature = (Signature) spi;
} else {
final Class delegate;
try {
delegate = (Class)
Class.forName(Signature.class.getName() + "$Delegate");
} catch (ClassNotFoundException e) { throw new RuntimeException(e); }
signature = newInstance(delegate,
new Class[] { SignatureSpi.class, String.class }, spi, algorithm
);
}
setField(signature, Signature.class, "provider", provider);
return signature;
}
/**
* @note code calling this should not assume BC provider internals !
*/
public static Mac getMac(final String algorithm) throws NoSuchAlgorithmException {
Mac mac = null;
final Provider provider = getSecurityProviderIfAccessible();
if ( provider != null ) {
mac = getMac(algorithm, provider, true);
}
if ( mac == null ) mac = Mac.getInstance(algorithm);
return mac;
}
static Mac getMac(final String algorithm, final Provider provider)
throws NoSuchAlgorithmException {
return getMac(algorithm, provider, false);
}
private static Mac getMac(final String algorithm, final Provider provider, boolean silent)
throws NoSuchAlgorithmException {
MacSpi spi = (MacSpi) getImplEngine("Mac", algorithm);
if ( spi == null ) {
if ( silent ) return null;
throw new NoSuchAlgorithmException(algorithm + " not found");
}
return newInstance(Mac.class,
new Class[] { MacSpi.class, Provider.class, String.class },
new Object[] { spi, provider, algorithm }
);
}
/**
* @note code calling this should not assume BC provider internals !
*/
public static KeyGenerator getKeyGenerator(final String algorithm) throws NoSuchAlgorithmException {
try {
final Provider provider = getSecurityProviderIfAccessible();
if ( provider != null ) return getKeyGenerator(algorithm, provider);
}
catch (NoSuchAlgorithmException e) { }
catch (SecurityException e) { debugStackTrace(e); }
return KeyGenerator.getInstance(algorithm);
}
static KeyGenerator getKeyGenerator(final String algorithm, final Provider provider)
throws NoSuchAlgorithmException {
final KeyGeneratorSpi spi = (KeyGeneratorSpi) getImplEngine("KeyGenerator", algorithm);
if ( spi == null ) throw new NoSuchAlgorithmException(algorithm + " not found");
return newInstance(KeyGenerator.class,
new Class[] { KeyGeneratorSpi.class, Provider.class, String.class },
new Object[] { spi, provider, algorithm }
);
}
/**
* @note code calling this should not assume BC provider internals !
*/
public static KeyAgreement getKeyAgreement(final String algorithm) throws NoSuchAlgorithmException {
try {
final Provider provider = getSecurityProviderIfAccessible();
if ( provider != null ) return getKeyAgreement(algorithm, provider);
}
catch (NoSuchAlgorithmException e) { }
catch (SecurityException e) { debugStackTrace(e); }
return KeyAgreement.getInstance(algorithm);
}
static KeyAgreement getKeyAgreement(final String algorithm, final Provider provider)
throws NoSuchAlgorithmException {
final KeyAgreementSpi spi = (KeyAgreementSpi) getImplEngine("KeyAgreement", algorithm);
if ( spi == null ) throw new NoSuchAlgorithmException(algorithm + " not found");
return newInstance(KeyAgreement.class,
new Class[] { KeyAgreementSpi.class, Provider.class, String.class },
new Object[] { spi, provider, algorithm }
);
}
/**
* @note code calling this should not assume BC provider internals !
*/
public static SecretKeyFactory getSecretKeyFactory(final String algorithm) throws NoSuchAlgorithmException {
try {
final Provider provider = getSecurityProviderIfAccessible();
if ( provider != null ) return getSecretKeyFactory(algorithm, provider);
}
catch (NoSuchAlgorithmException e) { }
catch (SecurityException e) { debugStackTrace(e); }
return SecretKeyFactory.getInstance(algorithm);
}
static SecretKeyFactory getSecretKeyFactory(final String algorithm, final Provider provider)
throws NoSuchAlgorithmException {
final SecretKeyFactorySpi spi = (SecretKeyFactorySpi) getImplEngine("SecretKeyFactory", algorithm);
if ( spi == null ) throw new NoSuchAlgorithmException(algorithm + " not found");
return newInstance(SecretKeyFactory.class,
new Class[] { SecretKeyFactorySpi.class, Provider.class, String.class },
new Object[] { spi, provider, algorithm }
);
}
private static boolean providerSSLContext = false; // BC does not implement + JDK default is fine
public static SSLContext getSSLContext(final String protocol)
throws NoSuchAlgorithmException {
try {
if ( providerSSLContext ) {
final Provider provider = getSecurityProviderIfAccessible();
if ( provider != null ) {
return getSSLContext(protocol, provider);
}
}
}
catch (NoSuchAlgorithmException e) { }
return SSLContext.getInstance(protocol);
}
private static SSLContext getSSLContext(final String protocol, final Provider provider)
throws NoSuchAlgorithmException {
return SSLContext.getInstance(protocol, provider);
}
public static boolean verify(final X509CRL crl, final PublicKey publicKey)
throws NoSuchAlgorithmException, CRLException, InvalidKeyException, SignatureException {
return verify(crl, publicKey, false);
}
static boolean verify(final X509CRL crl, final PublicKey publicKey, final boolean silent)
throws NoSuchAlgorithmException, CRLException, InvalidKeyException, SignatureException {
if ( crl instanceof X509CRLObject ) {
final CertificateList crlList = (CertificateList) getCertificateList(crl);
final AlgorithmIdentifier tbsSignatureId = crlList.getTBSCertList().getSignature();
if ( ! crlList.getSignatureAlgorithm().equals(tbsSignatureId) ) {
if ( silent ) return false;
throw new CRLException("Signature algorithm on CertificateList does not match TBSCertList.");
}
final Signature signature = getSignature(crl.getSigAlgName(), securityProvider);
signature.initVerify(publicKey);
signature.update(crl.getTBSCertList());
if ( ! signature.verify( crl.getSignature() ) ) {
if ( silent ) return false;
throw new SignatureException("CRL does not verify with supplied public key.");
}
return true;
}
else {
try {
final DigestAlgorithmIdentifierFinder digestAlgFinder = new DefaultDigestAlgorithmIdentifierFinder();
final ContentVerifierProvider verifierProvider;
if ( "DSA".equalsIgnoreCase( publicKey.getAlgorithm() )) {
BigInteger y = ((DSAPublicKey) publicKey).getY();
DSAParams params = ((DSAPublicKey) publicKey).getParams();
DSAParameters parameters = new DSAParameters(params.getP(), params.getQ(), params.getG());
AsymmetricKeyParameter dsaKey = new DSAPublicKeyParameters(y, parameters);
verifierProvider = new BcDSAContentVerifierProviderBuilder(digestAlgFinder).build(dsaKey);
}
else {
BigInteger mod = ((RSAPublicKey) publicKey).getModulus();
BigInteger exp = ((RSAPublicKey) publicKey).getPublicExponent();
AsymmetricKeyParameter rsaKey = new RSAKeyParameters(false, mod, exp);
verifierProvider = new BcRSAContentVerifierProviderBuilder(digestAlgFinder).build(rsaKey);
}
return new X509CRLHolder(crl.getEncoded()).isSignatureValid( verifierProvider );
}
catch (OperatorException e) {
throw new SignatureException(e);
}
catch (CertException e) {
throw new SignatureException(e);
}
// can happen if the input is DER but does not match expected strucure
catch (ClassCastException e) {
throw new SignatureException(e);
}
catch (IOException e) {
throw new SignatureException(e);
}
}
}
private static Object getCertificateList(final Object crl) { // X509CRLObject
try { // private CertificateList c;
final Field cField = X509CRLObject.class.getDeclaredField("c");
cField.setAccessible(true);
return cField.get(crl);
}
catch (NoSuchFieldException e) {
debugStackTrace(e); return null;
}
catch (IllegalAccessException e) { return null; }
catch (SecurityException e) { return null; }
}
// these are BC JCE (@see javax.crypto.JCEUtil) inspired internals :
// https://github.com/bcgit/bc-java/blob/master/jce/src/main/java/javax/crypto/JCEUtil.java
private static Object getImplEngine(String baseName, String algorithm) {
Object engine = findImplEngine(baseName, algorithm.toUpperCase(Locale.ENGLISH));
if (engine == null) {
engine = findImplEngine(baseName, algorithm);
}
return engine;
}
private static Object findImplEngine(final String baseName, String algorithm) {
Class implEngineClass = implEngines.get(baseName + ":" + algorithm);
if (implEngineClass == null) {
final Provider bcProvider = securityProvider;
String alias;
while ((alias = bcProvider.getProperty("Alg.Alias." + baseName + "." + algorithm)) != null) {
algorithm = alias;
}
final String className = bcProvider.getProperty(baseName + "." + algorithm);
if (className != null) {
try {
ClassLoader loader = bcProvider.getClass().getClassLoader();
if (loader != null) {
implEngineClass = loader.loadClass(className);
} else {
implEngineClass = Class.forName(className);
}
implEngineClass.newInstance(); // this instance is thrown away to test newInstance, but only once
} catch (ClassNotFoundException e) {
throw new IllegalStateException("algorithm " + algorithm + " in provider " + bcProvider.getName() + " but no class \"" + className + "\" found!");
} catch (Exception e) {
throw new IllegalStateException("algorithm " + algorithm + " in provider " + bcProvider.getName() + " but class \"" + className + "\" inaccessible!");
}
} else {
return null;
}
implEngines.put(baseName + ":" + algorithm, implEngineClass);
}
try {
return implEngineClass.newInstance();
} catch (Exception e) {
final Provider bcProvider = securityProvider;
String className = implEngineClass.getName();
throw new IllegalStateException("algorithm " + algorithm + " in provider " + bcProvider.getName() + " but class \"" + className + "\" inaccessible!");
}
}
// the obligratory "reflection crap" :
private static T newInstance(Class klass, Class[] paramTypes, Object... params) {
final Constructor constructor;
try {
constructor = klass.getDeclaredConstructor(paramTypes);
constructor.setAccessible(true);
return constructor.newInstance(params);
} catch (NoSuchMethodException e) {
throw new IllegalStateException(e.getMessage(), e);
} catch (InvocationTargetException e) {
throw new IllegalStateException(e.getTargetException());
} catch (InstantiationException e) {
throw new IllegalStateException(e);
} catch (IllegalAccessException e) {
throw new IllegalStateException(e);
}
}
@SuppressWarnings("unchecked")
private static