javaxt-express/src/javaxt/express/KeyManager.java at master · javaxt-project/javaxt-express · GitHub

History

176 lines (150 loc) · 7.2 KB

Raw

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

121

122

123

124

125

126

127

128

129

130

131

132

133

134

135

136

137

138

139

140

141

142

143

144

145

146

147

148

149

150

151

152

153

154

155

156

157

158

159

160

161

162

163

164

165

166

167

168

169

170

171

172

173

174

175

176

package javaxt.express;

import java.util.*;

import javax.net.ssl.*;

import java.net.Socket;

import java.net.InetAddress;

import java.security.KeyStore;

import java.security.Principal;

import java.security.PrivateKey;

import java.security.cert.X509Certificate;

//******************************************************************************

//** KeyManager

//******************************************************************************

/**

* Custom implementation of a X509KeyManager. This class is used to support

* keystores with multiple SSL certificates. By default, the standard Java

* X509KeyManager and the SunX509 implementation will pick the first alias

* it finds for which there is a private key and a key type that matches

* the chosen cipher suite (typically RSA).

* Instead, this class tries to find an alias in the keystore that best

* matches the requested hostname found in the SSL handshake. This assumes

* that the keystore aliases contain hostnames (e.g. "www.acme.com") or top

* level domain names (e.g. "acme.com").

* In addition, this class requires a mapping of aliases/hostnames to IP

* addresses on the host server. This is required for the chooseServerAlias()

* method which is called early in the SSL handshake process (well before

* the hostname is known). When the chooseServerAlias() method is called, all

* we have is a IP address to identify the alias so a hashmap is used to tie

* a domain name to an IP address.

******************************************************************************/

public class KeyManager extends X509ExtendedKeyManager { //implements X509KeyManager

private KeyStore keyStore;

private char[] password;

private HashMap<InetAddress, String> aliases;

//**************************************************************************

//** Constructor

//**************************************************************************

public KeyManager(KeyStore keystore, char[] password, HashMap<InetAddress, String> aliases) {

if (aliases==null || aliases.isEmpty()) throw new IllegalArgumentException("Hosts is null or empty.");

this.keyStore = keystore;

this.password = password;

this.aliases = aliases;

}

//**************************************************************************

//** chooseEngineServerAlias

//**************************************************************************

/** Returns an alias in the keystore that best matches the requested

* hostname found in the SSL handshake

* @param keyType Not used

* @param issuers Not used

* @param engine SSLEngine with a handshake session

public String chooseEngineServerAlias(String keyType, Principal[] issuers, SSLEngine engine) {

try{

//Get hostname from SSL handshake (www.acme.com)

String hostname = null;

ExtendedSSLSession session = (ExtendedSSLSession) engine.getHandshakeSession();

for (SNIServerName name : session.getRequestedServerNames()) {

if (name.getType() == StandardConstants.SNI_HOST_NAME) {

hostname = ((SNIHostName) name).getAsciiName();

break;

}

if (hostname==null) return null;

else hostname = hostname.toLowerCase();

//Get top-level domain name (acme.com)

String[] arr = hostname.split("\\.");

String domainName = arr[arr.length-2] + "." + arr[arr.length-1];

//Special case for keystores with wildcard certs and top-level domain

//certs. When creating aliases for wildcard certs, I use the top-level

//domain name as the alias (e.g. "acme.com" alias for a "*.acme.com"

//wildcard cert). However, in some cases we also want a cert for the

//top-level domain (e.g. "acme.com"). So for top-level domain certs,

//I use an underscore prefix (e.g. "_acme.com" alias for a "acme.com"

//cert). The following code will search for an alias with an

//underscore prefix whenever a top-level domain name is requested.

if (domainName.equals(hostname)){

Enumeration enumeration = keyStore.aliases();

while (enumeration.hasMoreElements()) {

String alias = (String) enumeration.nextElement();

if (alias.equals("_"+domainName)) return alias;

}

//Return the alias associated with the IP address of the top-level

//domain name.

return aliases.get(InetAddress.getByName(domainName));

}

catch(Exception e){

return null;

}

//**************************************************************************

//** chooseEngineServerAlias

//**************************************************************************

/** Returns an alias that best matches the given HTTP socket.

* @param keyType Not used

* @param issuers Not used

* @param socket HTTP socket

public String chooseServerAlias(String keyType, Principal[] issuers, Socket socket) {

//System.out.println("chooseServerAlias: " + socket.getLocalAddress());

return aliases.get(socket.getLocalAddress());

}

//**************************************************************************

//** getPrivateKey

//**************************************************************************

/** Returns the private key from the keystore for a given alias.

public PrivateKey getPrivateKey(String alias) {

try {

return (PrivateKey) keyStore.getKey(alias, password);

}

catch (Exception e) {

return null;

}

//**************************************************************************

//** getPrivateKey

//**************************************************************************

/** Returns the x509 certificate chain from the keystore for a given alias.

public X509Certificate[] getCertificateChain(String alias) {

try {

java.security.cert.Certificate[] certs = keyStore.getCertificateChain(alias);

if (certs == null || certs.length == 0) return null;

X509Certificate[] x509 = new X509Certificate[certs.length];

for (int i = 0; i < certs.length; i++){

x509[i] = (X509Certificate)certs[i];

}

return x509;

}

catch (Exception e) {

return null;

}

public String[] getServerAliases(String keyType, Principal[] issuers) {

throw new UnsupportedOperationException("Method getServerAliases() not implemented.");

}

public String[] getClientAliases(String keyType, Principal[] issuers) {

throw new UnsupportedOperationException("Method getClientAliases() not implemented.");

}

public String chooseClientAlias(String keyTypes[], Principal[] issuers, Socket socket) {

throw new UnsupportedOperationException("Method chooseClientAlias() not implemented.");

}

public String chooseEngineClientAlias(String[] strings, Principal[] prncpls, SSLEngine ssle) {

throw new UnsupportedOperationException("Method chooseEngineClientAlias() not implemented.");

}

javaxt-express/src/javaxt/express/KeyManager.java at master · javaxt-project/javaxt-express · GitHub

Uh oh!

Expand file tree

Breadcrumbs

KeyManager.java

Latest commit

History

Breadcrumbs

KeyManager.java

File metadata and controls