|
3
|
1 package org.tn5250j.framework.transport.SSL;
|
|
|
2
|
|
|
3 /*
|
|
|
4 * @(#)SSLImplementation.java
|
|
|
5 * @author Stephen M. Kennedy
|
|
|
6 *
|
|
|
7 * Copyright: Copyright (c) 2001
|
|
|
8 *
|
|
|
9 * This program is free software; you can redistribute it and/or modify
|
|
|
10 * it under the terms of the GNU General Public License as published by
|
|
|
11 * the Free Software Foundation; either version 2, or (at your option)
|
|
|
12 * any later version.
|
|
|
13 *
|
|
|
14 * This program is distributed in the hope that it will be useful,
|
|
|
15 * but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
|
16 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
|
17 * GNU General Public License for more details.
|
|
|
18 *
|
|
|
19 * You should have received a copy of the GNU General Public License
|
|
|
20 * along with this software; see the file COPYING. If not, write to
|
|
|
21 * the Free Software Foundation, Inc., 59 Temple Place, Suite 330,
|
|
|
22 * Boston, MA 02111-1307 USA
|
|
|
23 *
|
|
|
24 */
|
|
|
25
|
|
|
26 import java.io.File;
|
|
|
27 import java.io.FileInputStream;
|
|
|
28 import java.io.FileOutputStream;
|
|
|
29 import java.net.Socket;
|
|
|
30 import java.security.KeyStore;
|
|
|
31 import java.security.cert.CertificateException;
|
|
|
32 import java.security.cert.X509Certificate;
|
|
|
33
|
|
|
34 import javax.net.ssl.KeyManagerFactory;
|
|
|
35 import javax.net.ssl.SSLContext;
|
|
|
36 import javax.net.ssl.SSLSocket;
|
|
|
37 import javax.net.ssl.TrustManager;
|
|
|
38 import javax.net.ssl.TrustManagerFactory;
|
|
|
39 import javax.net.ssl.X509TrustManager;
|
|
8
|
40
|
|
|
41 import com.five_ten_sg.connectbot.service.TerminalBridge;
|
|
|
42 import com.five_ten_sg.connectbot.service.TerminalManager;
|
|
3
|
43
|
|
|
44 import org.tn5250j.GlobalConfigure;
|
|
|
45 import org.tn5250j.framework.transport.SSLInterface;
|
|
|
46 import org.tn5250j.tools.logging.TN5250jLogFactory;
|
|
|
47 import org.tn5250j.tools.logging.TN5250jLogger;
|
|
|
48
|
|
|
49 /**
|
|
|
50 * <p>
|
|
|
51 * This class implements the SSLInterface and is used to create SSL socket
|
|
|
52 * instances.
|
|
|
53 * </p>
|
|
8
|
54 *
|
|
3
|
55 * @author Stephen M. Kennedy <skennedy@tenthpowertech.com>
|
|
8
|
56 *
|
|
3
|
57 */
|
|
|
58 public class SSLImplementation implements SSLInterface, X509TrustManager {
|
|
|
59
|
|
|
60 SSLContext sslContext = null;
|
|
|
61
|
|
|
62 KeyStore userks = null;
|
|
|
63 private String userKsPath;
|
|
|
64 private char[] userksPassword = "changeit".toCharArray();
|
|
|
65
|
|
8
|
66 TerminalBridge bridge = null;
|
|
|
67 TerminalManager manager = null;
|
|
|
68 String target = null; // destination:port
|
|
|
69
|
|
3
|
70 KeyManagerFactory userkmf = null;
|
|
|
71
|
|
|
72 TrustManagerFactory usertmf = null;
|
|
|
73
|
|
|
74 TrustManager[] userTrustManagers = null;
|
|
|
75
|
|
|
76 X509Certificate[] acceptedIssuers;
|
|
|
77
|
|
|
78 TN5250jLogger logger;
|
|
|
79
|
|
8
|
80 public SSLImplementation(TerminalBridge bridge, TerminalManager manager) {
|
|
|
81 this.bridge = bridge;
|
|
|
82 this.manager = manager;
|
|
3
|
83 logger = TN5250jLogFactory.getLogger(getClass());
|
|
|
84 }
|
|
|
85
|
|
|
86 public void init(String sslType) {
|
|
|
87 try {
|
|
|
88 logger.debug("Initializing User KeyStore");
|
|
|
89 userKsPath = System.getProperty("user.home") + File.separator
|
|
|
90 + GlobalConfigure.TN5250J_FOLDER + File.separator + "keystore";
|
|
|
91 File userKsFile = new File(userKsPath);
|
|
|
92 userks = KeyStore.getInstance(KeyStore.getDefaultType());
|
|
|
93 userks.load(userKsFile.exists() ? new FileInputStream(userKsFile)
|
|
|
94 : null, userksPassword);
|
|
|
95 logger.debug("Initializing User Key Manager Factory");
|
|
|
96 userkmf = KeyManagerFactory.getInstance(KeyManagerFactory
|
|
|
97 .getDefaultAlgorithm());
|
|
|
98 userkmf.init(userks, userksPassword);
|
|
|
99 logger.debug("Initializing User Trust Manager Factory");
|
|
|
100 usertmf = TrustManagerFactory.getInstance(TrustManagerFactory
|
|
|
101 .getDefaultAlgorithm());
|
|
|
102 usertmf.init(userks);
|
|
|
103 userTrustManagers = usertmf.getTrustManagers();
|
|
|
104 logger.debug("Initializing SSL Context");
|
|
|
105 sslContext = SSLContext.getInstance(sslType);
|
|
|
106 sslContext.init(userkmf.getKeyManagers(), new TrustManager[] {this}, null);
|
|
|
107 } catch (Exception ex) {
|
|
|
108 logger.error("Error initializing SSL [" + ex.getMessage() + "]");
|
|
|
109 }
|
|
|
110
|
|
|
111 }
|
|
|
112
|
|
|
113 public Socket createSSLSocket(String destination, int port) {
|
|
|
114 if (sslContext == null)
|
|
|
115 throw new IllegalStateException("SSL Context Not Initialized");
|
|
|
116 SSLSocket socket = null;
|
|
|
117 try {
|
|
8
|
118 target = destination + ":" + String.valueOf(port);
|
|
3
|
119 socket = (SSLSocket) sslContext.getSocketFactory().createSocket(
|
|
|
120 destination, port);
|
|
|
121 } catch (Exception e) {
|
|
|
122 logger.error("Error creating ssl socket [" + e.getMessage() + "]");
|
|
|
123 }
|
|
|
124 return socket;
|
|
|
125 }
|
|
|
126
|
|
|
127 // X509TrustManager Methods
|
|
|
128
|
|
|
129 /*
|
|
|
130 * (non-Javadoc)
|
|
8
|
131 *
|
|
3
|
132 * @see javax.net.ssl.X509TrustManager#getAcceptedIssuers()
|
|
|
133 */
|
|
|
134 public X509Certificate[] getAcceptedIssuers() {
|
|
|
135 return acceptedIssuers;
|
|
|
136 }
|
|
|
137
|
|
|
138 /*
|
|
|
139 * (non-Javadoc)
|
|
8
|
140 *
|
|
3
|
141 * @see
|
|
|
142 * javax.net.ssl.X509TrustManager#checkClientTrusted(java.security.cert.
|
|
|
143 * X509Certificate[], java.lang.String)
|
|
|
144 */
|
|
|
145 public void checkClientTrusted(X509Certificate[] arg0, String arg1)
|
|
|
146 throws CertificateException {
|
|
|
147 throw new SecurityException("checkClientTrusted unsupported");
|
|
|
148
|
|
|
149 }
|
|
|
150
|
|
|
151 /*
|
|
|
152 * (non-Javadoc)
|
|
8
|
153 *
|
|
3
|
154 * @see
|
|
|
155 * javax.net.ssl.X509TrustManager#checkServerTrusted(java.security.cert.
|
|
|
156 * X509Certificate[], java.lang.String)
|
|
|
157 */
|
|
|
158 public void checkServerTrusted(X509Certificate[] chain, String type)
|
|
|
159 throws CertificateException {
|
|
|
160 try {
|
|
|
161 for (int i = 0; i < userTrustManagers.length; i++) {
|
|
|
162 if (userTrustManagers[i] instanceof X509TrustManager) {
|
|
|
163 X509TrustManager trustManager = (X509TrustManager) userTrustManagers[i];
|
|
|
164 X509Certificate[] calist = trustManager
|
|
|
165 .getAcceptedIssuers();
|
|
|
166 if (calist.length > 0) {
|
|
|
167 trustManager.checkServerTrusted(chain, type);
|
|
|
168 } else {
|
|
|
169 throw new CertificateException(
|
|
|
170 "Empty list of accepted issuers (a.k.a. root CA list).");
|
|
|
171 }
|
|
|
172 }
|
|
|
173 }
|
|
|
174 return;
|
|
|
175 } catch (CertificateException ce) {
|
|
|
176 X509Certificate cert = chain[0];
|
|
|
177 String certInfo = "Version: " + cert.getVersion() + "\n";
|
|
|
178 certInfo = certInfo.concat("Serial Number: "
|
|
|
179 + cert.getSerialNumber() + "\n");
|
|
|
180 certInfo = certInfo.concat("Signature Algorithm: "
|
|
|
181 + cert.getSigAlgName() + "\n");
|
|
|
182 certInfo = certInfo.concat("Issuer: "
|
|
|
183 + cert.getIssuerDN().getName() + "\n");
|
|
|
184 certInfo = certInfo.concat("Valid From: " + cert.getNotBefore()
|
|
|
185 + "\n");
|
|
|
186 certInfo = certInfo
|
|
|
187 .concat("Valid To: " + cert.getNotAfter() + "\n");
|
|
|
188 certInfo = certInfo.concat("Subject DN: "
|
|
|
189 + cert.getSubjectDN().getName() + "\n");
|
|
|
190 certInfo = certInfo.concat("Public Key: "
|
|
|
191 + cert.getPublicKey().getFormat() + "\n");
|
|
|
192
|
|
8
|
193 bridge.outputLine(manager.res.getString(R.string.host_authenticity_warning, target));
|
|
|
194 bridge.outputLine(manager.res.getString(R.string.host_certificate, certInfo));
|
|
|
195 Boolean result = bridge.promptHelper.requestBooleanPrompt(null, manager.res.getString(R.string.prompt_accept_certificate));
|
|
9
|
196 if ((result == null) || (!result.booleanValue())) {
|
|
3
|
197 throw new java.security.cert.CertificateException(
|
|
|
198 "Certificate Rejected");
|
|
|
199 }
|
|
|
200
|
|
8
|
201 result = bridge.promptHelper.requestBooleanPrompt(null, manager.res.getString(R.string.prompt_save_certificate));
|
|
9
|
202 if ((result != null) && (result.booleanValue())) {
|
|
3
|
203 try {
|
|
|
204 userks.setCertificateEntry(cert.getSubjectDN().getName(),
|
|
|
205 cert);
|
|
|
206 userks.store(new FileOutputStream(userKsPath),
|
|
|
207 userksPassword);
|
|
|
208 } catch (Exception e) {
|
|
|
209 logger.error("Error saving certificate [" + e.getMessage()
|
|
|
210 + "]");
|
|
|
211 e.printStackTrace();
|
|
|
212 }
|
|
|
213 }
|
|
|
214 }
|
|
|
215 }
|
|
|
216 } |
