pkernel_jce 0.1

data/lib/pkernel_jce/certificate.rb

@@ -0,0 +1,467 @@
+
+require 'pkernel'
+require_relative 'provider'
+require_relative 'utils'
+require_relative 'global'
+require_relative 'error'
+require_relative 'certificate_owner'
+
+require 'active_support/core_ext/time'
+
+
+module PkernelJce
+  module Certificate
+    
+		module KeyUsage
+			# bouncycastle v1.57
+			DIGITAL_SIGNATURE = Java::OrgBouncycastleAsn1X509::KeyUsage::digitalSignature
+			NON_REPUDIATION = Java::OrgBouncycastleAsn1X509::KeyUsage::nonRepudiation
+			KEY_ENCIPHERMENT = Java::OrgBouncycastleAsn1X509::KeyUsage::keyEncipherment
+			DATA_ENCIPHERMENT = Java::OrgBouncycastleAsn1X509::KeyUsage::dataEncipherment
+			KEY_AGREEMENT = Java::OrgBouncycastleAsn1X509::KeyUsage::keyAgreement
+			KEY_CERT_SIGN = Java::OrgBouncycastleAsn1X509::KeyUsage::keyCertSign
+			CRL_SIGN = Java::OrgBouncycastleAsn1X509::KeyUsage::cRLSign
+			# only meaningful of KEY_AGREEMENT is set
+			ENCIPHER_ONLY = Java::OrgBouncycastleAsn1X509::KeyUsage::encipherOnly
+			DECIPHER_ONLY = Java::OrgBouncycastleAsn1X509::KeyUsage::decipherOnly
+			
+			DEF_USER_IDENTITY = DIGITAL_SIGNATURE | NON_REPUDIATION | KEY_ENCIPHERMENT | KEY_AGREEMENT 
+			DEF_USER_DATA_SEC = DATA_ENCIPHERMENT | ENCIPHER_ONLY | DECIPHER_ONLY
+			DEF_ISSUER = DIGITAL_SIGNATURE | NON_REPUDIATION | KEY_ENCIPHERMENT | CRL_SIGN | KEY_CERT_SIGN
+		end
+    # end module CertKeyUsage
+
+		module ExtKeyUsage
+			ANY_EXT_KEY_USAGE = org.bouncycastle.asn1.x509.KeyPurposeId::anyExtendedKeyUsage
+			TLS_SERVER_AUTH = org.bouncycastle.asn1.x509.KeyPurposeId::id_kp_serverAuth
+			TLS_CLIENT_AUTH = org.bouncycastle.asn1.x509.KeyPurposeId::id_kp_clientAuth
+			CODE_SIGNING = org.bouncycastle.asn1.x509.KeyPurposeId::id_kp_codeSigning
+			EMAIL_PROTECTION = org.bouncycastle.asn1.x509.KeyPurposeId::id_kp_emailProtection
+			TIMESTAMPING = org.bouncycastle.asn1.x509.KeyPurposeId::id_kp_timeStamping 
+			OCSP_SIGNING = org.bouncycastle.asn1.x509.KeyPurposeId::id_kp_OCSPSigning
+			DVCS = org.bouncycastle.asn1.x509.KeyPurposeId::id_kp_dvcs 
+			SPGP_CERT_AA_SERVER_AUTH = org.bouncycastle.asn1.x509.KeyPurposeId::id_kp_sbgpCertAAServerAuth
+		end
+    # end CertExtKeyUsage
+    
+
+    def generate(params = {}, &block)
+
+      raise PkernelJce::Error, "Block is required for certificate generation function" if block.nil?
+
+      PkernelJce::GConf.instance.glog.debug "Certificate generate parameters: #{params.inspect}"
+      owner = params[:owner]
+      pubKey = params[:pubKey]
+      serial = params[:serial]
+      kProv = params[:keypair_provider] 
+      cProv = params[:cert_provider]
+      issuer = params[:issuer]
+      matchIssuerValidity = params[:match_issuer_validity] || true
+
+      issuer = false if issuer.nil?
+
+      pubKey = PkernelJce::KeyPair.public_key(pubKey)
+
+      if cProv.nil?
+        cProv = PkernelJce::Provider.add_provider(PkernelJce::Provider::DefProvider)
+      else
+        cProv = PkernelJce::Provider.add_provider(cProv)
+      end
+
+      if kProv.nil?
+        kProv = PkernelJce::Provider.add_provider(PkernelJce::Provider::DefProvider)
+      else
+        kProv = PkernelJce::Provider.add_provider(kProv)
+      end
+
+      extUtils = org.bouncycastle.cert.bc.BcX509ExtensionUtils.new
+
+      if serial.nil? or serial.empty?
+        serial = block.call(:serial)
+      end
+
+      if serial.is_a?(java.math.BigInteger)
+      else
+        serial = java.math.BigInteger.new(serial,16)
+      end
+
+      signHash = block.call(:signHash)
+      issuerKey = block.call(:issuerKey)
+      issuerCert = block.call(:issuerCert)
+
+      issuerKey = PkernelJce::KeyPair.private_key(issuerKey)
+      if issuerKey.nil?
+        raise PkernelJce::Error, "Issuer key cannot be nil"
+      end
+
+      signAlgo = PkernelJce::KeyPair.derive_signing_algo(issuerKey, signHash)
+      signer = org.bouncycastle.operator.jcajce.JcaContentSignerBuilder.new(signAlgo).setProvider(kProv).build(issuerKey)
+      x500Name = owner.to_x500_subject
+      
+      if not issuerCert.nil?
+
+        issuerCert = issuerCert.to_java_cert if issuerCert.java_kind_of?(org.bouncycastle.cert.X509CertificateHolder)
+        
+        validFrom, validTo = calculate_validity(params) do |from, to|
+          if matchIssuerValidity
+            
+            PkernelJce::GConf.instance.glog.debug "Match issuer validity against issuer certificate is activated."
+            PkernelJce::GConf.instance.glog.debug "Issuer Cert : #{issuerCert.subject_dn.to_s} / #{issuerCert.not_before} / #{issuerCert.not_after}"
+
+            if from.to_java_date.before(issuerCert.not_before)
+              PkernelJce::GConf.instance.glog.warn "Certificate valid from has adjusted to match issuer valid from: #{from} [User requested] / #{issuerCert.not_before} [Adjusted to issuer]"
+              from = issuerCert.not_before
+            end
+            
+            if to.to_java_date.after(issuerCert.not_after)
+              PkernelJce::GConf.instance.glog.warn "Certificate valid to has adjusted to match issuer valid to: #{to} [User requested] / #{issuerCert.not_after} [Adjusted to issuer]"
+              to = issuerCert.not_after
+            end
+
+            [from, to]
+          else
+            [from, to]
+          end
+        end
+
+        certGen = org.bouncycastle.cert.jcajce.JcaX509v3CertificateBuilder.new(issuerCert, serial, validFrom, validTo, x500Name, pubKey)
+        # generate authority key identifier
+        certGen.addExtension(org.bouncycastle.asn1.x509.Extension::authorityKeyIdentifier, false, extUtils.createAuthorityKeyIdentifier(org.bouncycastle.asn1.x509.SubjectPublicKeyInfo.getInstance(issuerCert.getPublicKey.getEncoded)))
+      else
+
+        validFrom, validTo = calculate_validity(params)
+
+        certGen = org.bouncycastle.cert.jcajce.JcaX509v3CertificateBuilder.new(x500Name, serial, validFrom, validTo, x500Name, pubKey)
+        # generate authority key identifier
+        certGen.addExtension(org.bouncycastle.asn1.x509.Extension::authorityKeyIdentifier, false, extUtils.createAuthorityKeyIdentifier(org.bouncycastle.asn1.x509.SubjectPublicKeyInfo.getInstance(pubKey.getEncoded)))
+      end
+
+      keyUsage = block.call(:keyUsage)
+      if issuer
+        certGen.addExtension(org.bouncycastle.asn1.x509.Extension::basicConstraints, true, org.bouncycastle.asn1.x509.BasicConstraints.new(true))
+        if not keyUsage.nil?
+          certGen.addExtension(org.bouncycastle.asn1.x509.Extension::keyUsage, false, org.bouncycastle.asn1.x509.KeyUsage.new(keyUsage))
+        else
+          certGen.addExtension(org.bouncycastle.asn1.x509.Extension::keyUsage, false, org.bouncycastle.asn1.x509.KeyUsage.new(KeyUsage::DEF_ISSUER))
+        end
+      else
+        if not keyUsage.nil?
+          certGen.addExtension(org.bouncycastle.asn1.x509.Extension::keyUsage, false, org.bouncycastle.asn1.x509.KeyUsage.new(keyUsage))
+        else
+          certGen.addExtension(org.bouncycastle.asn1.x509.Extension::keyUsage, false, org.bouncycastle.asn1.x509.KeyUsage.new(KeyUsage::DEF_USER_IDENTITY))
+        end
+      end
+
+      extKeyUsage = block.call(:extKeyUsage)
+      if not extKeyUsage.nil?
+        if extKeyUsage.is_a?(Hash)
+          # allow user to give eku -> true/false 
+          # Since timestamping required this extension to be true, not sure others
+          extKeyUsage.each do |k,v|
+            certGen.addExtension(org.bouncycastle.asn1.x509.Extension::extendedKeyUsage, v, org.bouncycastle.asn1.x509.ExtendedKeyUsage.new(k))
+          end
+        elsif extKeyUsage.is_a?(Array)
+          certGen.addExtension(org.bouncycastle.asn1.x509.Extension::extendedKeyUsage, false, org.bouncycastle.asn1.x509.ExtendedKeyUsage.new(extKeyUsage.to_vector))
+        else
+          certGen.addExtension(org.bouncycastle.asn1.x509.Extension::extendedKeyUsage, false, org.bouncycastle.asn1.x509.ExtendedKeyUsage.new([extKeyUsage].to_vector))
+        end
+      end	
+
+      # 
+      # handle alternative name
+      # 
+      altName = []
+      if owner.emails.length > 0
+        owner.emails.each do |e|
+          altName << org.bouncycastle.asn1.x509.GeneralName.new(org.bouncycastle.asn1.x509.GeneralName::rfc822Name,e)
+        end
+      end
+
+      owner.dns_names.each do |n|
+        altName << org.bouncycastle.asn1.x509.GeneralName.new(org.bouncycastle.asn1.x509.GeneralName::dNSName,n)
+      end
+
+      if altName.length > 0
+        certGen.addExtension(org.bouncycastle.asn1.x509.Extension::subjectAlternativeName, false, org.bouncycastle.asn1.x509.GeneralNames.new(altName.to_java(org.bouncycastle.asn1.x509.GeneralName)) )
+      end
+      # 
+      # Done alternative name
+      #
+
+      # 
+      # handle CRL distribution point
+      # 
+      crl = block.call(:crls)
+      if not crl.nil?
+        crls = []
+        if crl.is_a?(Array)
+          crl.each do |c|
+            crls << org.bouncycastle.asn1.x509.GeneralName.new(org.bouncycastle.asn1.x509.GeneralName::uniformResourceIdentifier, org.bouncycastle.asn1.DERIA5String.new(c));
+          end
+          gns = org.bouncycastle.asn1.x509.GeneralNames.new(crls.to_java(org.bouncycastle.asn1.x509.GeneralName));
+        else
+          gn = org.bouncycastle.asn1.x509.GeneralName.new(org.bouncycastle.asn1.x509.GeneralName::uniformResourceIdentifier, org.bouncycastle.asn1.DERIA5String.new(crl));
+          gns = org.bouncycastle.asn1.x509.GeneralNames.new(gn);
+        end
+        
+        dpn = org.bouncycastle.asn1.x509.DistributionPointName.new(gns);
+        dp =  org.bouncycastle.asn1.x509.DistributionPoint.new(dpn,nil,nil);
+        certGen.addExtension(org.bouncycastle.asn1.x509.X509Extensions::CRLDistributionPoints,false,org.bouncycastle.asn1.DERSequence.new(dp));      
+      end
+      # done adding CRL distribution point
+
+
+      # 
+      # handle OCSP
+      #
+      ocsp = block.call(:ocsp)
+      if not ocsp.nil? and not ocsp.empty?
+        ocspName = org.bouncycastle.asn1.x509.GeneralName.new(org.bouncycastle.asn1.x509.GeneralName.uniformResourceIdentifier, ocsp);
+        authorityInformationAccess = org.bouncycastle.asn1.x509.AuthorityInformationAccess.new(org.bouncycastle.asn1.x509.X509ObjectIdentifiers.ocspAccessMethod, ocspName);
+        certGen.addExtension(org.bouncycastle.asn1.x509.X509Extensions::AuthorityInfoAccess, false, authorityInformationAccess);			        
+      end
+      # done OCSP
+
+      # Let's generate subject key ID as default...	
+      certGen.addExtension(org.bouncycastle.asn1.x509.Extension::subjectKeyIdentifier, false, extUtils.createSubjectKeyIdentifier(org.bouncycastle.asn1.x509.SubjectPublicKeyInfo.getInstance(pubKey.getEncoded)))
+
+      cert = org.bouncycastle.cert.jcajce.JcaX509CertificateConverter.new().setProvider(cProv).getCertificate(certGen.build(signer))
+      cert
+
+    end
+    # end generate
+
+    def dump(cert, params = {})
+      if cert.nil?
+        raise PkernelJce::Error, "Certificate object to be written is nil"
+      end
+      
+      file = params[:file]
+      baos = java.io.ByteArrayOutputStream.new
+
+      if not file.nil?
+        PkernelJce::GConf.instance.glog.debug "Dump certificate to file '#{file}'"
+        writer = org.bouncycastle.openssl.jcajce.JcaPEMWriter.new(java.io.OutputStreamWriter.new(java.io.FileOutputStream.new(file)))
+      else
+        PkernelJce::GConf.instance.glog.debug "Dump certificate to memory"
+        writer = org.bouncycastle.openssl.jcajce.JcaPEMWriter.new(java.io.OutputStreamWriter.new(baos))
+      end
+
+      begin
+        writer.writeObject(cert)
+      ensure
+        writer.flush
+        writer.close  
+      end 
+
+      if file.nil?
+        baos.toByteArray
+      end
+      
+    end
+    # end write to
+
+
+    def load(options = {})
+      #is = options[:inputStream]
+      #if is.nil?
+      #  raise PkernelJce::Error, "InputStream to load certificate is nil"
+      #end
+     
+      file = options[:file]
+      bin = options[:bin]
+      baos = java.io.ByteArrayOutputStream.new
+
+      if not file.nil? and not file.empty?
+        PkernelJce::GConf.instance.glog.debug "Load certificate from #{file}"
+        f = java.io.File.new(file)
+        if f.exists?
+          b = Java::byte[f.length].new
+          dis = java.io.DataInputStream.new(java.io.FileInputStream.new(f))
+          dis.readFully(b)
+          dis.close
+
+          baos.write(b)
+        else 
+          raise PkernelJce::Error, "File '#{f.absolute_path}' not found"
+        end
+
+      elsif not bin.nil?
+        PkernelJce::GConf.instance.glog.debug "Load certificate from memory"
+        baos.write(bin)
+      else
+        raise PkernelJce::Error, "No bin or file input is given to load"
+      end
+
+      reader = org.bouncycastle.openssl.PEMParser.new(java.io.InputStreamReader.new(java.io.ByteArrayInputStream.new(baos.toByteArray)))
+      obj = reader.readObject
+      # object here shall be org.bouncycastle.cert.X509CertificateHolder
+      # Hence other place using Java Certificate object shall call to_java_cert on this object
+      obj
+      #org.bouncycastle.cert.jcajce.JcaX509CertificateConverter.new.setProvider(PkernelJce::Provider::DefProvider).getCertificate(obj)
+    end
+    # end read_from
+
+    def Certificate.is_self_signed?(cert) 
+      if cert.nil?
+        false
+      else
+        begin
+          cert.verify(cert.public_key)
+          true
+        rescue Exception
+          false
+        end
+      end
+    end
+
+    def Certificate.is_issuer_cert?(cert)
+      if cert.nil?
+        false
+      else
+        cert = Certificate.ensure_java_cert(cert)
+        (cert.getKeyUsage[5] and cert.getBasicConstraints != -1)
+      end
+    end
+    # end is_issuer_cert?
+
+    def Certificate.ensure_java_cert(cert)
+      if cert.nil?
+        raise PkernelJce::Error, "Certificate for conversion to java is nil"
+      else
+        case cert
+        when java.security.cert.Certificate
+          cert
+        when Java::OrgBouncycastleCert::X509CertificateHolder
+          cert.to_java_cert
+        else
+          raise PkernelJce::Error, "Unknown certificate type '#{cert.class}'"
+        end
+      end  
+    end
+    Certificate.singleton_class.send(:alias_method, :to_java_cert, :ensure_java_cert)
+    # end ensure_java_cert
+
+    def Certificate.ensure_bc_cert(cert)
+      if cert.nil?
+        raise PkernelJce::Error, "Certificate for conversion to bc is nil"
+      else
+        if cert.is_a?(Array)
+          cert.map! do |c|
+            case c
+            when java.security.cert.Certificate
+              c.to_bc_cert_holder
+            when Java::OrgBouncycastleCert::X509CertificateHolder
+              c
+            else
+              raise PkernelJce::Error, "Unknown certificate type '#{c.class}'"
+            end
+          end
+          cert
+        else
+          case cert
+          when java.security.cert.Certificate
+            cert.to_bc_cert_holder
+          when Java::OrgBouncycastleCert::X509CertificateHolder
+            cert
+          else
+            raise PkernelJce::Error, "Unknown certificate type '#{cert.class}'"
+          end
+        end
+      end
+    end
+    Certificate.singleton_class.send(:alias_method, :to_bc_cert, :ensure_bc_cert)
+    # end ensure_bc_cert
+    # 
+
+    def Certificate.public_key(cert)
+      if cert.nil?
+        raise PkernelJce::Error, "Object pass to public_key on certificate is nil"
+      end
+
+      case cert
+      when java.security.cert.Certificate
+        cert.public_key
+      when Java::OrgBouncycastleCert::X509CertificateHolder
+        PkernelJce::KeyPair.public_key(cert.subject_public_key_info)
+      else
+        raise PkernelJce::Error, "Unknown certificate type '#{cert.class}'"
+      end
+
+    end
+    
+    def Certificate.is_cert_object?(obj)
+      if obj.nil?
+        false
+      else
+        case obj
+        when java.security.cert.Certificate, Java::OrgBouncycastleCert::X509CertificateHolder, Java::OrgBouncycastleJcajceProviderAsymmetricX509::X509CertificateObject
+          true
+        else
+          false
+        end
+      end
+    end
+
+    def Certificate.is_ext_key_usage_set?(cert, eku)
+      raise PkernelJce::Error, "Certificate not given to check eku." if cert.nil?
+
+      c = Certificate.to_bc_cert(cert)
+      ext = c.getExtension(org.bouncycastle.asn1.x509.Extension.extendedKeyUsage)
+      extKey = org.bouncycastle.asn1.x509.ExtendedKeyUsage.getInstance(ext.getParsedValue)
+      
+      extKey.hasKeyPurposeId(eku)
+    end
+
+    private
+    # 
+    # all date must be in Ruby datetime object?
+    #
+    def calculate_validity(params, &block)
+      validFrom = params[:validFrom]
+      validTo = params[:validTo]
+      validity = params[:validity] || 2
+      validityUnit = params[:validityUnit] || :years
+
+      validity = validity.to_i
+
+      if validFrom.nil?
+        raise PkernelJce::Error, "Valid from has to be given."
+      end
+
+      if validFrom.is_a?(Time) #or validFrom.is_a?(DateTime)
+      else
+        raise PkernelJce::Error, "Invalid valid from date object type : '#{validFrom.class}'"
+      end 
+
+      if validTo.nil? or validTo.empty?
+        if (validity.nil?) and (validityUnit.nil?)
+          raise PkernelJce::Error, "Valid until and validity period both are not defined."
+        else
+          validTo = validFrom.advance( validityUnit => validity )
+          if block
+            # allow caller to check with issuer validity see if the valid to already surpass issuer's valid to
+            #validTo = block.call(validFrom, validTo)
+            validFrom, validTo = block.call(validFrom, validTo)
+          end
+        end
+      elsif validTo.is_a?(Time) or validTo.is_a?(DateTime)
+      else
+        raise PkernelJce::Error, "Invalid valid to date object type : '#{validTo.class}'"
+      end
+
+      [validFrom, validTo]
+
+    end
+
+  end
+  # end module certificate
+
+
+  class CertificateEngine
+    extend Certificate
+  end
+
+
+end
+

data/lib/pkernel_jce/certificate_owner.rb

@@ -0,0 +1,90 @@
+
+
+
+
+require 'pkernel'
+require_relative 'csr'
+require_relative 'global'
+
+
+class Pkernel::Certificate::Owner
+
+  def to_x500_subject
+
+    PkernelJce::Provider.add_default
+    builder = Java::OrgBouncycastleAsn1X500::X500NameBuilder.new
+    builder.addRDN(Java::OrgBouncycastleAsn1X500Style::BCStyle::CN, @name)
+
+    builder.addRDN(Java::OrgBouncycastleAsn1X500Style::BCStyle::O, @org) if @org != nil and not @org.empty?
+    builder.addRDN(Java::OrgBouncycastleAsn1X500Style::BCStyle::OU, @orgUnit) if @orgUnit != nil and not @orgUnit.empty?
+    builder.addRDN(Java::OrgBouncycastleAsn1X500Style::BCStyle::SN, @serial) if @serial != nil and not @serial.empty?
+
+    # this should not be here...	
+    if @emails.length > 0
+      builder.addRDN(Java::OrgBouncycastleAsn1X500Style::BCStyle::EmailAddress, @emails[0]) 
+    end
+
+    builder.build
+
+  end
+
+  def self.parse_x500_subject(subject, &block)
+    if block
+    else
+      raise PkernelJce::Error, "Block required to parse x500 subject"
+    end
+    
+    subject.getRDNs.each do |rd|
+      rd.getTypesAndValues.each do |tv|
+        case tv.type
+        when Java::OrgBouncycastleAsn1X500Style::BCStyle::CN
+          block.call(:cn, tv.value.string)
+        when Java::OrgBouncycastleAsn1X500Style::BCStyle::O
+          block.call(:o, tv.value.string)
+        when Java::OrgBouncycastleAsn1X500Style::BCStyle::OU
+          block.call(:ou, tv.value.string)
+        when Java::OrgBouncycastleAsn1X500Style::BCStyle::SN
+          block.call(:serial, tv.value.string)
+        when Java::OrgBouncycastleAsn1X500Style::BCStyle::EmailAddress
+          block.call(:email, tv.value.string)
+        else
+          PkernelJce::GConf.instance.glog.warn "Uncaught key-value in subject parsing '#{tv.type}-#{tv.value}'"
+        end
+      end
+    end
+  end
+  # from_x500_subject
+
+  # assumption: CSR here already in object of PKCS10CertificationRequest
+  def self.from_p10(csr)
+    if csr.nil?
+      raise PkernelJce::Error, "Cannot load CSR from nil"
+    end
+
+    if PkernelJce::CSRProxy.is_signature_valid?(csr)
+      owner = Pkernel::Certificate::Owner.new
+      parse_x500_subject(csr.subject) do |k,v|
+        case k
+        when :cn
+          owner.name = v
+        when :o
+          owner.org = v
+        when :ou
+          owner.orgUnit = v
+        when :serial
+          owner.serial = v
+        when :email
+          owner.emails << v
+        end
+      end
+
+      owner
+    else
+      raise PkernelJce::Error, "Signature of CSR is not valid"
+    end
+  end
+  # load_from_csr
+
+end
+# end class Owner
+