redcar 0.3.2dev → 0.3.3

data/lib/openssl/src/java/org/jruby/ext/openssl/x509store/PKey.java

@@ -0,0 +1,41 @@
+/***** BEGIN LICENSE BLOCK *****
+ * Version: CPL 1.0/GPL 2.0/LGPL 2.1
+ *
+ * The contents of this file are subject to the Common Public
+ * License Version 1.0 (the "License"); you may not use this file
+ * except in compliance with the License. You may obtain a copy of
+ * the License at http://www.eclipse.org/legal/cpl-v10.html
+ *
+ * Software distributed under the License is distributed on an "AS
+ * IS" basis, WITHOUT WARRANTY OF ANY KIND, either express or
+ * implied. See the License for the specific language governing
+ * rights and limitations under the License.
+ *
+ * Copyright (C) 2006 Ola Bini <ola@ologix.com>
+ * 
+ * Alternatively, the contents of this file may be used under the terms of
+ * either of the GNU General Public License Version 2 or later (the "GPL"),
+ * or the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
+ * in which case the provisions of the GPL or the LGPL are applicable instead
+ * of those above. If you wish to allow use of your version of this file only
+ * under the terms of either the GPL or the LGPL, and not to allow others to
+ * use your version of this file under the terms of the CPL, indicate your
+ * decision by deleting the provisions above and replace them with the notice
+ * and other provisions required by the GPL or the LGPL. If you do not delete
+ * the provisions above, a recipient may use your version of this file under
+ * the terms of any one of the CPL, the GPL or the LGPL.
+ ***** END LICENSE BLOCK *****/
+package org.jruby.ext.openssl.x509store;
+
+/**
+ * c: X509_OBJECT
+ *
+ * @author <a href="mailto:ola.bini@ki.se">Ola Bini</a>
+ */
+public class PKey extends X509Object {
+    public java.security.PrivateKey pkey;
+
+    public int type() {
+        return X509Utils.X509_LU_PKEY;
+    }
+}// X509_OBJECT_PKEY

data/lib/openssl/src/java/org/jruby/ext/openssl/x509store/PolicyTree.java

@@ -0,0 +1,36 @@
+/***** BEGIN LICENSE BLOCK *****
+ * Version: CPL 1.0/GPL 2.0/LGPL 2.1
+ *
+ * The contents of this file are subject to the Common Public
+ * License Version 1.0 (the "License"); you may not use this file
+ * except in compliance with the License. You may obtain a copy of
+ * the License at http://www.eclipse.org/legal/cpl-v10.html
+ *
+ * Software distributed under the License is distributed on an "AS
+ * IS" basis, WITHOUT WARRANTY OF ANY KIND, either express or
+ * implied. See the License for the specific language governing
+ * rights and limitations under the License.
+ *
+ * Copyright (C) 2006 Ola Bini <ola@ologix.com>
+ * 
+ * Alternatively, the contents of this file may be used under the terms of
+ * either of the GNU General Public License Version 2 or later (the "GPL"),
+ * or the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
+ * in which case the provisions of the GPL or the LGPL are applicable instead
+ * of those above. If you wish to allow use of your version of this file only
+ * under the terms of either the GPL or the LGPL, and not to allow others to
+ * use your version of this file under the terms of the CPL, indicate your
+ * decision by deleting the provisions above and replace them with the notice
+ * and other provisions required by the GPL or the LGPL. If you do not delete
+ * the provisions above, a recipient may use your version of this file under
+ * the terms of any one of the CPL, the GPL or the LGPL.
+ ***** END LICENSE BLOCK *****/
+package org.jruby.ext.openssl.x509store;
+
+/**
+ * c: X509_POLICY_TREE
+ *
+ * @author <a href="mailto:ola.bini@ki.se">Ola Bini</a>
+ */
+public class PolicyTree {
+}// X509_POLICY_TREE

data/lib/openssl/src/java/org/jruby/ext/openssl/x509store/Purpose.java

@@ -0,0 +1,475 @@
+/***** BEGIN LICENSE BLOCK *****
+ * Version: CPL 1.0/GPL 2.0/LGPL 2.1
+ *
+ * The contents of this file are subject to the Common Public
+ * License Version 1.0 (the "License"); you may not use this file
+ * except in compliance with the License. You may obtain a copy of
+ * the License at http://www.eclipse.org/legal/cpl-v10.html
+ *
+ * Software distributed under the License is distributed on an "AS
+ * IS" basis, WITHOUT WARRANTY OF ANY KIND, either express or
+ * implied. See the License for the specific language governing
+ * rights and limitations under the License.
+ *
+ * Copyright (C) 2006 Ola Bini <ola@ologix.com>
+ * 
+ * Alternatively, the contents of this file may be used under the terms of
+ * either of the GNU General Public License Version 2 or later (the "GPL"),
+ * or the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
+ * in which case the provisions of the GPL or the LGPL are applicable instead
+ * of those above. If you wish to allow use of your version of this file only
+ * under the terms of either the GPL or the LGPL, and not to allow others to
+ * use your version of this file under the terms of the CPL, indicate your
+ * decision by deleting the provisions above and replace them with the notice
+ * and other provisions required by the GPL or the LGPL. If you do not delete
+ * the provisions above, a recipient may use your version of this file under
+ * the terms of any one of the CPL, the GPL or the LGPL.
+ ***** END LICENSE BLOCK *****/
+package org.jruby.ext.openssl.x509store;
+
+
+import java.util.ArrayList;
+import java.util.List;
+
+/**
+ * c: X509_PURPOSE
+ *
+ * @author <a href="mailto:ola.bini@ki.se">Ola Bini</a>
+ */
+public class Purpose {
+    private static final String XKU_EMAIL_PROTECT = "1.3.6.1.5.5.7.3.4";    // Email protection
+    private static final String XKU_SSL_CLIENT = "1.3.6.1.5.5.7.3.2";       // SSL Client Authentication
+    private static final String[] XKU_SSL_SERVER = new String[]{
+        "1.3.6.1.5.5.7.3.1",        // SSL Server Authentication
+        "2.16.840.1.113730.4.1",    // Netscape Server Gated Crypto
+        "1.3.6.1.4.1.311.10.3.3"    // Microsoft Server Gated Crypto
+    };
+
+    public static interface CheckPurposeFunction extends Function3 {
+        public static final CheckPurposeFunction EMPTY = new CheckPurposeFunction(){
+                public int call(Object arg0, Object arg1, Object arg2) {
+                    return -1;
+                }
+            };
+    }
+
+    public int purpose;
+    public int trust;		/* Default trust ID */
+    public int flags;
+    public CheckPurposeFunction checkPurpose;
+    public String name;
+    public String sname;
+    public Object userData;
+
+    public Purpose() {}
+
+    public Purpose(int p, int t, int f, CheckPurposeFunction cp, String n, String s, Object u) {
+        this.purpose = p; this.trust = t;
+        this.flags = f; this.checkPurpose = cp;
+        this.name = n; this.sname = s;
+        this.userData = u;
+    }
+
+    /**
+     * c: X509_check_purpose
+     */
+    public static int checkPurpose(X509AuxCertificate x, int id, int ca) throws Exception {
+        if(id == -1) {
+            return 1;
+        }
+        int idx = getByID(id);
+        if(idx == -1) {
+            return -1;
+        }
+        Purpose pt = getFirst(idx);
+        return pt.checkPurpose.call(pt,x,new Integer(ca));
+    }
+
+    /**
+     * c: X509_PURPOSE_set
+     */
+    public static int set(int[] p, int purpose) {
+        if(getByID(purpose) == -1) {
+            X509Error.addError(X509Utils.X509V3_R_INVALID_PURPOSE);
+            return 0;
+        }
+        p[0] = purpose;
+        return 1;
+    }
+
+    private final static List<Purpose> xptable = new ArrayList<Purpose>();
+
+    /**
+     * c: X509_PURPOSE_get_count
+     */
+    public static int getCount() {
+        return xptable.size() + xstandard.length;
+    }
+
+    /**
+     * c: X509_PURPOSE_get0
+     */
+    public static Purpose getFirst(int idx) {
+        if(idx < 0) {
+            return null;
+        }
+        if(idx < xstandard.length) {
+            return xstandard[idx];
+        }
+        return (Purpose)xptable.get(idx - xstandard.length);
+    }
+
+    /**
+     * c: X509_PURPOSE_get_by_sname
+     */
+    public static int getBySName(String sname) {
+        for(int i=0;i<getCount();i++) {
+            Purpose xptmp = getFirst(i);
+            if(xptmp.sname.equals(sname)) {
+                return i;
+            }
+        }
+        return -1;
+    }
+
+    /**
+     * c: X509_PURPOSE_getby_id
+     */
+    public static int getByID(int purpose) {
+        if(purpose >= X509Utils.X509_PURPOSE_MIN && (purpose <= X509Utils.X509_PURPOSE_MAX)) {
+            return purpose - X509Utils.X509_PURPOSE_MIN;
+        }
+        int i = 0;
+        for(Purpose p : xptable) {
+            if(p.purpose == purpose) {
+                return i + xstandard.length;
+            }
+        }
+        return -1;
+    }
+
+    /**
+     * c: X509_PURPOSE_add
+     */
+    public static int add(int id, int trust, int flags, CheckPurposeFunction ck, String name, String sname, Object arg) {
+        flags &= ~X509Utils.X509_PURPOSE_DYNAMIC;
+        flags |= X509Utils.X509_PURPOSE_DYNAMIC_NAME;
+        int idx = getByID(id);
+        Purpose ptmp;
+        if(idx == -1) {
+            ptmp = new Purpose();
+            ptmp.flags = X509Utils.X509_PURPOSE_DYNAMIC;
+        } else {
+            ptmp = getFirst(idx);
+        }
+        ptmp.name = name;
+        ptmp.sname = sname;
+        ptmp.flags &= X509Utils.X509_PURPOSE_DYNAMIC;
+        ptmp.flags |= flags;
+        ptmp.purpose = id;
+        ptmp.trust = trust;
+        ptmp.checkPurpose = ck;
+        ptmp.userData = arg;
+        if(idx == -1) {
+            xptable.add(ptmp);
+        }
+        return 1;
+    }
+
+    /**
+     * c: X509_PURPOSE_cleanup
+     */
+    public static void cleanup() {
+        xptable.clear();
+    }
+
+    /**
+     * c: X509_PURPOSE_get_id
+     */
+    public int getID() {
+        return purpose;
+    }
+
+    /**
+     * c: X509_PURPOSE_get0_name
+     */
+    public String getName() {
+        return name;
+    }
+
+    /**
+     * c: X509_PURPOSE_get0_sname
+     */
+    public String getSName() {
+        return sname;
+    }
+
+    /**
+     * c: X509_PURPOSE_get_trust
+     */
+    public int getTrust() {
+        return trust;
+    }
+ 
+    /**
+     * c: X509_check_ca
+     */
+    public static int checkCA(X509AuxCertificate x) throws Exception {
+        if(x.getKeyUsage() != null && !x.getKeyUsage()[5]) { // KEY_CERT_SIGN
+            return 0;
+        }
+        if(x.getExtensionValue("2.5.29.19") != null) { // BASIC_CONSTRAINTS
+            if(x.getBasicConstraints() != -1) { // is CA.
+                return 1;
+            } else {
+                return 0;
+            }
+        } else {
+            if(x.getVersion() == 1 && x.getIssuerX500Principal().equals(x.getSubjectX500Principal())) { // V1_ROOT
+                return 3;
+            }
+            if(x.getKeyUsage() != null) {
+                return 4;
+            }
+            Integer nsCertType = x.getNsCertType();
+            if (nsCertType != null && (nsCertType & X509Utils.NS_ANY_CA) != 0) {
+                return 5;
+            }
+            return 0;
+        }
+    }
+
+     /**
+     * c: check_ssl_ca
+     */
+    public static int checkSSLCA(X509AuxCertificate x) throws Exception {
+        int ca_ret = checkCA(x);
+        if(ca_ret == 0) {
+            return 0;
+        }
+        Integer nsCertType = x.getNsCertType();
+        boolean v2 = nsCertType != null && (nsCertType & X509Utils.NS_SSL_CA) != 0;
+        if(ca_ret != 5 || v2) {
+            return ca_ret;
+        }
+        return 0;
+    }
+
+     /**
+     * c: xku_reject: check if the cert must be rejected(true) or not
+     */
+    public static boolean xkuReject(X509AuxCertificate x, String mustHaveXku) throws Exception {
+        List<String> xku = x.getExtendedKeyUsage();
+        return (xku != null) && !xku.contains(mustHaveXku);
+    }
+    public static boolean xkuReject(X509AuxCertificate x, String[] mustHaveOneOfXku) throws Exception {
+        List<String> xku = x.getExtendedKeyUsage();
+        if(xku == null) {
+            return false;
+        }
+        for (String mustHaveXku : mustHaveOneOfXku) {
+            if(xku.contains(mustHaveXku)) {
+                return false;
+            }
+        }
+        return true;
+    }
+
+     /**
+     * c: ns_reject
+     */
+    public static boolean nsReject(X509AuxCertificate x, int mustHaveCertType) throws Exception {
+        Integer nsCertType = x.getNsCertType();
+        return (nsCertType != null) && (nsCertType & mustHaveCertType) == 0;
+    }
+
+     /**
+     * c: purpose_smime
+     */
+    public static int purposeSMIME(X509AuxCertificate x, int ca) throws Exception {
+        if(xkuReject(x,XKU_EMAIL_PROTECT)) {
+            return 0; // must allow email protection
+        }
+        if(ca != 0) {
+            int ca_ret = checkCA(x);
+            if(ca_ret == 0) {
+                return 0;
+            }
+            Integer nsCertType = x.getNsCertType();
+            boolean v2 = nsCertType != null && (nsCertType & X509Utils.NS_SMIME_CA) != 0;
+            if(ca_ret != 5 || v2) {
+                return ca_ret;
+            } else {
+                return 0;
+            }
+        }
+        Integer nsCertType = x.getNsCertType();
+        if (nsCertType != null) {
+            if ((nsCertType & X509Utils.NS_SMIME) != 0) {
+                return 1;
+            }
+            if ((nsCertType & X509Utils.NS_SSL_CLIENT) != 0) {
+                return 2;
+            }
+            return 0;
+        }
+        return 1;
+    }
+
+    /**
+     * c: check_purpose_ssl_client
+     */
+     public final static CheckPurposeFunction checkPurposeSSLClient = new CheckPurposeFunction() {
+            public int call(Object _xp, Object _x, Object _ca) throws Exception {
+                X509AuxCertificate x = (X509AuxCertificate)_x;
+                if(xkuReject(x, XKU_SSL_CLIENT)) {
+                    return 0;
+                }
+                int ca = ((Integer)_ca).intValue();
+                if(ca != 0) {
+                    return checkSSLCA(x);
+                }
+                if(x.getKeyUsage() != null && !x.getKeyUsage()[0]) {
+                    return 0;
+                }
+                if(nsReject(x, X509Utils.NS_SSL_CLIENT)) {
+                    // when the cert has nsCertType, it must include NS_SSL_CLIENT
+                    return 0;
+                }
+                return 1;
+            }
+        };
+
+    /**
+     * c: check_purpose_ssl_server
+     */
+    public final static CheckPurposeFunction checkPurposeSSLServer =  new CheckPurposeFunction() {
+            public int call(Object _xp, Object _x, Object _ca) throws Exception {
+                X509AuxCertificate x = (X509AuxCertificate)_x;
+                int ca = ((Integer)_ca).intValue();
+                if(xkuReject(x, XKU_SSL_SERVER)) {
+                    return 0;
+                }
+                if(ca != 0) {
+                    return checkSSLCA(x);
+                }
+                if(nsReject(x, X509Utils.NS_SSL_SERVER)) {
+                    // when the cert has nsCertType, it must include NS_SSL_SERVER
+                    return 0;
+                }
+                if(x.getKeyUsage() != null && (!x.getKeyUsage()[0] || !x.getKeyUsage()[2])) {
+                    return 0;
+                }
+                return 1;
+            }
+        };
+
+    /**
+     * c: check_purpose_ns_ssl_server
+     */
+    public final static CheckPurposeFunction checkPurposeNSSSLServer = new CheckPurposeFunction() {
+            public int call(Object _xp, Object _x, Object _ca) throws Exception {
+                Purpose xp = (Purpose)_xp;
+                X509AuxCertificate x = (X509AuxCertificate)_x;
+                int ca = ((Integer)_ca).intValue();
+                int ret = checkPurposeSSLServer.call(xp,x,_ca);
+                if(ret == 0 || ca != 0) {
+                    return ret;
+                }
+                if(x.getKeyUsage() != null && !x.getKeyUsage()[2]) {
+                    return 0;
+                }
+                return 1;
+            }
+        };
+
+    /**
+     * c: check_purpose_smime_sign
+     */
+    public final static CheckPurposeFunction checkPurposeSMIMESign = new CheckPurposeFunction() {
+            public int call(Object _xp, Object _x, Object _ca) throws Exception {
+                X509AuxCertificate x = (X509AuxCertificate)_x;
+                int ca = ((Integer)_ca).intValue();
+                int ret = purposeSMIME(x,ca);
+                if(ret == 0 || ca != 0) {
+                    return ret;
+                }
+                if(x.getKeyUsage() != null && (!x.getKeyUsage()[0] || !x.getKeyUsage()[1])) {
+                    return 0;
+                }
+                return ret;
+            }
+        };
+
+    /**
+     * c: check_purpose_smime_encrypt
+     */
+    public final static CheckPurposeFunction checkPurposeSMIMEEncrypt = new CheckPurposeFunction() {
+            public int call(Object _xp, Object _x, Object _ca) throws Exception {
+                X509AuxCertificate x = (X509AuxCertificate)_x;
+                int ca = ((Integer)_ca).intValue();
+                int ret = purposeSMIME(x,ca);
+                if(ret == 0 || ca != 0) {
+                    return ret;
+                }
+                if(x.getKeyUsage() != null && !x.getKeyUsage()[2]) {
+                    return 0;
+                }
+                return ret;
+            }
+        };
+
+    /**
+     * c: check_purpose_crl_sign
+     */
+    public final static CheckPurposeFunction checkPurposeCRLSign = new CheckPurposeFunction() {
+            public int call(Object _xp, Object _x, Object _ca) throws Exception {
+                X509AuxCertificate x = (X509AuxCertificate)_x;
+                int ca = ((Integer)_ca).intValue();
+                
+                if(ca != 0) {
+                    int ca_ret = checkCA(x);
+                    if(ca_ret != 2) {
+                        return ca_ret;
+                    }
+                    return 0;
+                }
+                if(x.getKeyUsage() != null && !x.getKeyUsage()[6]) {
+                    return 0;
+                }
+                return 1;
+            }
+        };
+
+    /**
+     * c: no_check
+     */
+    public final static CheckPurposeFunction noCheck = new CheckPurposeFunction() {
+            public int call(Object _xp, Object _x, Object _ca) {
+                return 1;
+            }
+        };
+
+    /**
+     * c: ocsp_helper
+     */
+    public final static CheckPurposeFunction oscpHelper = new CheckPurposeFunction() {
+            public int call(Object _xp, Object _x, Object _ca) throws Exception {
+                if(((Integer)_ca).intValue() != 0) {
+                    return checkCA((X509AuxCertificate)_x);
+                }
+                return 1;
+            }
+        };
+
+    public final static Purpose[] xstandard = new Purpose[] {
+	new Purpose(X509Utils.X509_PURPOSE_SSL_CLIENT, X509Utils.X509_TRUST_SSL_CLIENT, 0, checkPurposeSSLClient, "SSL client", "sslclient", null),
+	new Purpose(X509Utils.X509_PURPOSE_SSL_SERVER, X509Utils.X509_TRUST_SSL_SERVER, 0, checkPurposeSSLServer, "SSL server", "sslserver", null),
+	new Purpose(X509Utils.X509_PURPOSE_NS_SSL_SERVER, X509Utils.X509_TRUST_SSL_SERVER, 0, checkPurposeNSSSLServer, "Netscape SSL server", "nssslserver", null),
+	new Purpose(X509Utils.X509_PURPOSE_SMIME_SIGN, X509Utils.X509_TRUST_EMAIL, 0, checkPurposeSMIMESign, "S/MIME signing", "smimesign", null),
+	new Purpose(X509Utils.X509_PURPOSE_SMIME_ENCRYPT, X509Utils.X509_TRUST_EMAIL, 0, checkPurposeSMIMEEncrypt, "S/MIME encryption", "smimeencrypt", null),
+	new Purpose(X509Utils.X509_PURPOSE_CRL_SIGN, X509Utils.X509_TRUST_COMPAT, 0, checkPurposeCRLSign, "CRL signing", "crlsign", null),
+	new Purpose(X509Utils.X509_PURPOSE_ANY, X509Utils.X509_TRUST_DEFAULT, 0, noCheck, "Any Purpose", "any", null),
+	new Purpose(X509Utils.X509_PURPOSE_OCSP_HELPER, X509Utils.X509_TRUST_COMPAT, 0, oscpHelper, "OCSP helper", "ocsphelper", null),
+    };
+}// X509_PURPOSE