Subversion Repositories openrisc

/* Command.java -- Abstract implementation of a keytool command handler

   Copyright (C) 2006 Free Software Foundation, Inc.

This file is part of GNU Classpath.

GNU Classpath is free software; you can redistribute it and/or modify

it under the terms of the GNU General Public License as published by

the Free Software Foundation; either version 2, or (at your option)

any later version.

GNU Classpath is distributed in the hope that it will be useful, but

WITHOUT ANY WARRANTY; without even the implied warranty of

MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU

General Public License for more details.

You should have received a copy of the GNU General Public License

along with GNU Classpath; see the file COPYING.  If not, write to the

Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA

02110-1301 USA.

Linking this library statically or dynamically with other modules is

making a combined work based on this library.  Thus, the terms and

conditions of the GNU General Public License cover the whole

combination.

As a special exception, the copyright holders of this library give you

permission to link this library with independent modules to produce an

executable, regardless of the license terms of these independent

modules, and to copy and distribute the resulting executable under

terms of your choice, provided that you also meet, for each linked

independent module, the terms and conditions of the license of that

module.  An independent module is a module which is not derived from

or based on this library.  If you modify this library, you may extend

this exception to your version of the library, but you are not

obligated to do so.  If you do not wish to do so, delete this

exception statement from your version. */

package gnu.classpath.tools.keytool;

import gnu.classpath.Configuration;

import gnu.classpath.SystemProperties;

import gnu.classpath.tools.common.CallbackUtil;

import gnu.classpath.tools.common.ProviderUtil;

import gnu.classpath.tools.common.SecurityProviderInfo;

import gnu.classpath.tools.getopt.Parser;

import gnu.java.security.OID;

import gnu.java.security.Registry;

import gnu.java.security.der.BitString;

import gnu.java.security.der.DER;

import gnu.java.security.der.DERReader;

import gnu.java.security.der.DERValue;

import gnu.java.security.der.DERWriter;

import gnu.java.security.hash.IMessageDigest;

import gnu.java.security.hash.MD5;

import gnu.java.security.hash.Sha160;

import gnu.java.security.util.Util;

import gnu.java.security.x509.X500DistinguishedName;

import java.io.ByteArrayOutputStream;

import java.io.File;

import java.io.FileInputStream;

import java.io.FileNotFoundException;

import java.io.FileOutputStream;

import java.io.IOException;

import java.io.InputStream;

import java.io.OutputStream;

import java.io.PrintWriter;

import java.math.BigInteger;

import java.net.URL;

import java.net.URLConnection;

import java.security.InvalidKeyException;

import java.security.InvalidParameterException;

import java.security.Key;

import java.security.KeyPairGenerator;

import java.security.KeyStore;

import java.security.KeyStoreException;

import java.security.NoSuchAlgorithmException;

import java.security.PrivateKey;

import java.security.Provider;

import java.security.PublicKey;

import java.security.Signature;

import java.security.SignatureException;

import java.security.UnrecoverableKeyException;

import java.security.cert.Certificate;

import java.security.cert.CertificateEncodingException;

import java.security.cert.CertificateException;

import java.security.cert.X509Certificate;

import java.security.interfaces.DSAKey;

import java.security.interfaces.RSAKey;

import java.util.ArrayList;

import java.util.Date;

import java.util.logging.Logger;

import java.util.prefs.Preferences;

import javax.security.auth.callback.Callback;

import javax.security.auth.callback.CallbackHandler;

import javax.security.auth.callback.NameCallback;

import javax.security.auth.callback.PasswordCallback;

import javax.security.auth.callback.UnsupportedCallbackException;

/**

 * A base class of the keytool command to facilitate implementation of concrete

 * keytool Handlers.

 */

abstract class Command

{

  // Fields and constants -----------------------------------------------------

  private static final Logger log = Logger.getLogger(Command.class.getName());

  /** Default value for the ALIAS argument. */

  private static final String DEFAULT_ALIAS = "mykey"; //$NON-NLS-1$

  /** Default algorithm for key-pair generation. */

  private static final String DEFAULT_KEY_ALGORITHM = "DSA"; //$NON-NLS-1$

  /** Default DSA digital signature algorithm to use with DSA keys. */

  private static final String DSA_SIGNATURE_ALGORITHM = "SHA1withDSA"; //$NON-NLS-1$

  /** Default RSA digital signature algorithm to use with RSA keys. */

  private static final String RSA_SIGNATURE_ALGORITHM = "MD5withRSA"; //$NON-NLS-1$

  /** Default validity (in days) of newly generated certificates. */

  private static final int DEFAULT_VALIDITY = 90;

  /** OID of SHA1withDSA signature algorithm as stated in RFC-2459. */

  protected static final OID SHA1_WITH_DSA = new OID("1.2.840.10040.4.3"); //$NON-NLS-1$

  /** OID of MD2withRSA signature algorithm as stated in RFC-2459. */

  private static final OID MD2_WITH_RSA = new OID("1.2.840.113549.1.1.2"); //$NON-NLS-1$

  /** OID of MD5withRSA signature algorithm as stated in RFC-2459. */

  private static final OID MD5_WITH_RSA = new OID("1.2.840.113549.1.1.4"); //$NON-NLS-1$

  /** OID of SHA1withRSA signature algorithm as stated in RFC-2459. */

  private static final OID SHA1_WITH_RSA = new OID("1.2.840.113549.1.1.5"); //$NON-NLS-1$

  /** Number of milliseconds in one day. */

  private static final long MILLIS_IN_A_DAY = 24 * 60 * 60 * 1000L;

  /** The Alias to use. */

  protected String alias;

  /** The password characters protecting a Key Entry. */

  protected char[] keyPasswordChars;

  /** A security provider to add. */

  protected Provider provider;

  /** The key store type. */

  protected String storeType;

  /** The password characters protecting the key store. */

  protected char[] storePasswordChars;

  /** The key store URL. */

  protected URL storeURL;

  /** The input stream from the key store URL. */

  protected InputStream storeStream;

  /** The key store instance to use. */

  protected KeyStore store;

  /** The output stream the concrete handler will use. */

  protected OutputStream outStream;

  /** Whether we are printing to System.out. */

  protected boolean systemOut;

  /** The key-pair generation algorithm instance to use. */

  protected KeyPairGenerator keyPairGenerator;

  /** The digital signature algorithm instance to use. */

  protected Signature signatureAlgorithm;

  /** Validity period, in number of days, to use when generating certificates. */

  protected int validityInDays;

  /** The input stream the concrete handler will use. */

  protected InputStream inStream;

  /** Whether verbose output is required or not. */

  protected boolean verbose;

  /** MD5 hash to use when generating certificate fingerprints. */

  private IMessageDigest md5 = new MD5();

  /** SHA1 hash to use when generating certificate fingerprints. */

  private IMessageDigest sha = new Sha160();

  /** The new position of a user-defined provider if it is not already installed. */

  private int providerNdx = -2;

  /** The callback handler to use when needing to interact with user. */

  private CallbackHandler handler;

  /** The shutdown hook. */

  private ShutdownHook shutdownThread;

  // Constructor(s) -----------------------------------------------------------

  protected Command()

  {

    super();

    shutdownThread = new ShutdownHook();

    Runtime.getRuntime().addShutdownHook(shutdownThread);

  }

  // Methods ------------------------------------------------------------------

  /**

   * A public method to allow using any keytool command handler programmatically

   * by using a JavaBeans style of parameter(s) initialization. The user is

   * assumed to have set individually the required options through their

   * respective setters before invoking this method.

   * <p>

   * If an exception is encountered during the processing of the command, this

   * implementation attempts to release any resources that may have been

   * allocated at the time the exception occurs, before re-throwing that

   * exception.

   *

   * @throws Exception if an exception occurs during the processing of this

   *           command. For a more comprehensive list of exceptions that may

   *           occur, see the documentation of the {@link #setup()} and

   *           {@link #start()} methods.

   */

  public void doCommand() throws Exception

  {

    try

      {

        setup();

        start();

      }

    finally

      {

        teardown();

        if (shutdownThread != null)

          Runtime.getRuntime().removeShutdownHook(shutdownThread);

      }

  }

  /**

   * @param flag whether to use, or not, more verbose output while processing

   *          the command.

   */

  public void setVerbose(String flag)

  {

    this.verbose = Boolean.valueOf(flag).booleanValue();

  }

  // life-cycle methods -------------------------------------------------------

  /**

   * Given a potential sub-array of options for this concrete handler, starting

   * at position <code>startIndex + 1</code>, potentially followed by other

   * commands and their options, this method sets up this concrete command

   * handler with its own options and returns the index of the first unprocessed

   * argument in the array.

   * <p>

   * The general contract of this method is that it is invoked with the

   * <code>startIndex</code> argument pointing to the keyword argument that

   * uniquelly identifies the command itself; e.g. <code>-genkey</code> or

   * <code>-list</code>, etc...

   *

   * @param args an array of options for this handler and possibly other

   *          commands and their options.

   * @return the remaining un-processed <code>args</code>.

   */

  String[] processArgs(String[] args)

  {

    if (Configuration.DEBUG)

      log.entering(this.getClass().getName(), "processArgs", args); //$NON-NLS-1$

    Parser cmdOptionsParser = getParser();

    String[] result = cmdOptionsParser.parse(args);

    if (Configuration.DEBUG)

      log.exiting(this.getClass().getName(), "processArgs", result); //$NON-NLS-1$

    return result;

  }

  /**

   * Initialize this concrete command handler for later invocation of the

   * {@link #start()} or {@link #doCommand()} methods.

   * <p>

   * Handlers usually initialize their local variables and resources within the

   * scope of this call.

   *

   * @throws IOException if an I/O related exception, such as opening an input

   *           stream, occurs during the execution of this method.

   * @throws UnsupportedCallbackException if a requested callback handler

   *           implementation was not found, or was found but encountered an

   *           exception during its processing.

   * @throws ClassNotFoundException if a designated security provider class was

   *           not found.

   * @throws IllegalAccessException no 0-arguments constructor for the

   *           designated security provider class was found.

   * @throws InstantiationException the designated security provider class is

   *           not instantiable.

   * @throws KeyStoreException if an exception occurs during the instantiation

   *           of the KeyStore.

   * @throws CertificateException if a certificate related exception, such as

   *           expiry, occurs during the loading of the KeyStore.

   * @throws NoSuchAlgorithmException if no current security provider can

   *           provide a needed algorithm referenced by the KeyStore or one of

   *           its Key Entries or Certificates.

   */

  abstract void setup() throws Exception;

  /**

   * Do the real work this handler is supposed to do.

   * <p>

   * The code in this (abstract) class throws a <i>Not implemented yet</i>

   * runtime exception. Concrete implementations MUST override this method.

   *

   * @throws CertificateException If no concrete implementation was found for a

   *           certificate Factory of a designated type. In this tool, the type

   *           is usually X.509 v1.

   * @throws KeyStoreException if a keys-store related exception occurs; e.g.

   *           the key store has not been initialized.

   * @throws IOException if an I/O related exception occurs during the process.

   * @throws SignatureException if a digital signature related exception occurs.

   * @throws InvalidKeyException if the genereated keys are invalid.

   * @throws UnrecoverableKeyException if the password used to unlock a key in

   *           the key store was invalid.

   * @throws NoSuchAlgorithmException if a concrete implementation of an

   *           algorithm used to store a Key Entry was not found at runtime.

   * @throws UnsupportedCallbackException if a requested callback handler

   *           implementation was not found, or was found but encountered an

   *           exception during its processing.

   */

  void start() throws Exception

  {

    throw new RuntimeException("Not implemented yet"); //$NON-NLS-1$

  }

  /**

   * Tear down the handler, releasing any resources which may have been

   * allocated at setup time.

   */

  void teardown()

  {

    if (Configuration.DEBUG)

      log.entering(this.getClass().getName(), "teardown"); //$NON-NLS-1$

    if (storeStream != null)

      try

        {

          storeStream.close();

        }

      catch (IOException ignored)

        {

          if (Configuration.DEBUG)

            log.fine("Exception while closing key store URL stream. Ignored: " //$NON-NLS-1$

                     + ignored);

        }

    if (outStream != null)

      {

        try

          {

            outStream.flush();

          }

        catch (IOException ignored)

          {

          }

        if (! systemOut)

          try

            {

              outStream.close();

            }

          catch (IOException ignored)

            {

            }

      }

    if (inStream != null)

      try

        {

          inStream.close();

        }

      catch (IOException ignored)

        {

        }

    if (providerNdx > 0)

      ProviderUtil.removeProvider(provider.getName());

    if (Configuration.DEBUG)

      log.exiting(this.getClass().getName(), "teardown"); //$NON-NLS-1$

  }

  // parameter setup and validation methods -----------------------------------

  /**

   * @return a {@link Parser} that knows how to parse the concrete command's

   *         options.

   */

  abstract Parser getParser();

  /**

   * Convenience method to setup the key store given its type, its password, its

   * location and portentially a specialized security provider.

   * <p>

   * Calls the method with the same name and 5 arguments passing

   * <code>false</code> to the first argument implying that no attempt to

   * create the keystore will be made if one was not found at the designated

   * location.

   *

   * @param className the potentially null fully qualified class name of a

   *          security provider to add at runtime, if no installed provider is

   *          able to provide a key store implementation of the desired type.

   * @param type the potentially null type of the key store to request from the

   *          key store factory.

   * @param password the potentially null password protecting the key store.

   * @param url the URL of the key store.

   */

  protected void setKeyStoreParams(String className, String type,

                                   String password, String url)

      throws IOException, UnsupportedCallbackException, KeyStoreException,

      NoSuchAlgorithmException, CertificateException

  {

    setKeyStoreParams(false, className, type, password, url);

  }

  /**

   * Convenience method to setup the key store given its type, its password, its

   * location and portentially a specialized security provider.

   *

   * @param createIfNotFound if <code>true</code> then create the keystore if

   *          it was not found; otherwise do not.

   * @param className the potentially null fully qualified class name of a

   *          security provider to add at runtime, if no installed provider is

   *          able to provide a key store implementation of the desired type.

   * @param type the potentially null type of the key store to request from the

   *          key store factory.

   * @param password the potentially null password protecting the key store.

   * @param url the URL of the key store.

   */

  protected void setKeyStoreParams(boolean createIfNotFound, String className,

                                   String type, String password, String url)

      throws IOException, UnsupportedCallbackException, KeyStoreException,

      NoSuchAlgorithmException, CertificateException

  {

    setProviderClassNameParam(className);

    setKeystoreTypeParam(type);

    setKeystoreURLParam(createIfNotFound, url, password);

  }

  /**

   * Set a security provider class name to (install and) use for key store

   * related operations.

   *

   * @param className the possibly null, fully qualified class name of a

   *          security provider to add, if it is not already installed, to the

   *          set of available providers.

   */

  private void setProviderClassNameParam(String className)

  {

    if (Configuration.DEBUG)

      log.fine("setProviderClassNameParam(" + className + ")"); //$NON-NLS-1$ //$NON-NLS-2$

    if (className != null && className.trim().length() > 0)

      {

        className = className.trim();

        SecurityProviderInfo spi = ProviderUtil.addProvider(className);

        provider = spi.getProvider();

        if (provider == null)

          {

            if (Configuration.DEBUG)

              log.fine("Was unable to add provider from class " + className);

          }

        providerNdx = spi.getPosition();

      }

  }

  /**

   * Set the type of key store to initialize, load and use.

   *

   * @param type the possibly null type of the key store. if this argument is

   *          <code>null</code>, or is an empty string, then this method sets

   *          the type of the key store to be the default value returned from

   *          the invocation of the {@link KeyStore#getDefaultType()} method.

   *          For GNU Classpath this is <i>gkr</i> which stands for the "Gnu

   *          KeyRing" specifications.

   */

  private void setKeystoreTypeParam(String type)

  {

    if (Configuration.DEBUG)

      log.fine("setKeystoreTypeParam(" + type + ")"); //$NON-NLS-1$ //$NON-NLS-2$

    if (type == null || type.trim().length() == 0)

      storeType = KeyStore.getDefaultType();

    else

      storeType = type.trim();

  }

  /**

   * Set the key password given a command line option argument. If no value was

   * present on the command line then prompt the user to provide one.

   *

   * @param password a possibly null key password gleaned from the command line.

   * @throws IOException if an I/O related exception occurs.

   * @throws UnsupportedCallbackException if no concrete implementation of a

   *         password callback was found at runtime.

   */

  protected void setKeyPasswordParam(String password) throws IOException,

      UnsupportedCallbackException

  {

    setKeyPasswordNoPrompt(password);

    if (keyPasswordChars == null)

      setKeyPasswordParam();

  }

  /**

   * Set the Alias to use when associating Key Entries and Trusted Certificates

   * in the current key store.

   *

   * @param name the possibly null alias to use. If this arfument is

   *          <code>null</code>, then a default value of <code>mykey</code>

   *          will be used instead.

   */

  protected void setAliasParam(String name)

  {

    alias = name == null ? DEFAULT_ALIAS : name.trim();

  }

  /**

   * Set the key password given a command line option argument.

   *

   * @param password a possibly null key password gleaned from the command line.

   */

  protected void setKeyPasswordNoPrompt(String password)

  {

    if (password != null)

      keyPasswordChars = password.toCharArray();

  }

  /**

   * Prompt the user to provide a password to protect a Key Entry in the key

   * store.

   *

   * @throws IOException if an I/O related exception occurs.

   * @throws UnsupportedCallbackException if no concrete implementation of a

   *           password callback was found at runtime.

   * @throws SecurityException if no password is available, even after prompting

   *           the user.

   */

  private void setKeyPasswordParam() throws IOException,

      UnsupportedCallbackException

  {

    String prompt = Messages.getFormattedString("Command.21", alias); //$NON-NLS-1$

    PasswordCallback pcb = new PasswordCallback(prompt, false);

    getCallbackHandler().handle(new Callback[] { pcb });

    keyPasswordChars = pcb.getPassword();

    pcb.clearPassword();

    if (keyPasswordChars == null)

      throw new SecurityException(Messages.getString("Command.23")); //$NON-NLS-1$

  }

  private void setKeystorePasswordParam(String password) throws IOException,

      UnsupportedCallbackException

  {

    if (password != null)

      storePasswordChars = password.toCharArray();

    else // ask the user to provide one

      {

        String prompt = Messages.getString("Command.24"); //$NON-NLS-1$

        PasswordCallback pcb = new PasswordCallback(prompt, false);

        getCallbackHandler().handle(new Callback[] { pcb });

        storePasswordChars = pcb.getPassword();

        pcb.clearPassword();

      }

  }

  /**

   * Set the key store URL to use.

   *

   * @param createIfNotFound when <code>true</code> an attempt to create a

   *          keystore at the designated location will be made. If

   *          <code>false</code> then no file creation is carried out, which

   *          may cause an exception to be thrown later.

   * @param url the full, or partial, URL to the keystore location.

   * @param password an eventually null string to use when loading the keystore.

   * @throws IOException

   * @throws KeyStoreException

   * @throws UnsupportedCallbackException

   * @throws NoSuchAlgorithmException

   * @throws CertificateException

   */

  private void setKeystoreURLParam(boolean createIfNotFound, String url,

                                     String password) throws IOException,

      KeyStoreException, UnsupportedCallbackException, NoSuchAlgorithmException,

      CertificateException

  {

    if (Configuration.DEBUG)

      log.fine("setKeystoreURLParam(" + url + ")"); //$NON-NLS-1$ //$NON-NLS-2$

    if (url == null || url.trim().length() == 0)

      {

        String userHome = SystemProperties.getProperty("user.home"); //$NON-NLS-1$

        if (userHome == null || userHome.trim().length() == 0)

          throw new InvalidParameterException(Messages.getString("Command.36")); //$NON-NLS-1$

        url = userHome.trim() + "/.keystore"; //$NON-NLS-1$

        // if it does not exist create it if required

        if (createIfNotFound)

          new File(url).createNewFile();

        url = "file:" + url; //$NON-NLS-1$

      }

    else

      {

        url = url.trim();

        if (url.indexOf(":") == -1) // if it does not exist create it //$NON-NLS-1$

          {

            if (createIfNotFound)

              new File(url).createNewFile();

          }

        url = "file:" + url; //$NON-NLS-1$

      }

    boolean newKeyStore = false;

    storeURL = new URL(url);

    storeStream = storeURL.openStream();

    if (storeStream.available() == 0)

      {

        if (Configuration.DEBUG)

          log.fine("Store is empty. Will use <null> when loading, to create it"); //$NON-NLS-1$

        newKeyStore = true;

      }

    try

      {

        store = KeyStore.getInstance(storeType);

      }

    catch (KeyStoreException x)

      {

        if (provider != null)

          throw x;

        if (Configuration.DEBUG)

          log.fine("Exception while getting key store with default provider(s)." //$NON-NLS-1$

                   + " Will prompt user for another provider and continue"); //$NON-NLS-1$

        String prompt = Messages.getString("Command.40"); //$NON-NLS-1$

        NameCallback ncb = new NameCallback(prompt);

        getCallbackHandler().handle(new Callback[] { ncb });

        String className = ncb.getName();

        setProviderClassNameParam(className); // we may have a Provider

        if (provider == null)

          {

            x.fillInStackTrace();

            throw x;

          }

        // try again

        store = KeyStore.getInstance(storeType, provider);

      }

    setKeystorePasswordParam(password);

    // now we have a KeyStore instance. load it

    // KeyStore public API claims: "...In order to create an empty keystore,

    // you pass null as the InputStream argument to the load method.

    if (newKeyStore)

      store.load(null, storePasswordChars);

    else

      store.load(storeStream, storePasswordChars);

    // close the stream

    try

    {

      storeStream.close();

      storeStream = null;

    }

    catch (IOException x)

    {

      if (Configuration.DEBUG)

        log.fine("Exception while closing the key store input stream: " + x //$NON-NLS-1$

                 + ". Ignore"); //$NON-NLS-1$

    }

  }

  protected void setOutputStreamParam(String fileName) throws SecurityException,

      IOException

  {

    if (fileName == null || fileName.trim().length() == 0)

      {

        outStream = System.out;

        systemOut = true;

      }

    else

      {

        fileName = fileName.trim();

        File outFile = new File(fileName);

        if (! outFile.exists())

          {

            boolean ok = outFile.createNewFile();

            if (!ok)

              throw new InvalidParameterException(Messages.getFormattedString("Command.19", //$NON-NLS-1$

                                                                              fileName));

          }

        else

          {

            if (! outFile.isFile())

              throw new InvalidParameterException(Messages.getFormattedString("Command.42", //$NON-NLS-1$

                                                                              fileName));

            if (! outFile.canWrite())

              throw new InvalidParameterException(Messages.getFormattedString("Command.44", //$NON-NLS-1$

                                                                              fileName));

          }

        outStream = new FileOutputStream(outFile);

      }

  }

  protected void setInputStreamParam(String fileName)

      throws FileNotFoundException

  {

    if (fileName == null || fileName.trim().length() == 0)

      inStream = System.in;

    else

      {

        fileName = fileName.trim();

        File inFile = new File(fileName);

        if (! (inFile.exists() && inFile.isFile() && inFile.canRead()))

          throw new InvalidParameterException(Messages.getFormattedString("Command.46", //$NON-NLS-1$

                                                                          fileName));

        inStream = new FileInputStream(inFile);

      }

  }

  /**

   * Set both the key-pair generation algorithm, and the digital signature

   * algorithm instances to use when generating new entries.

   *

   * @param kpAlg the possibly null name of a key-pair generator algorithm.

   *          if this argument is <code>null</code> or is an empty string, the