Java > Open Source Codes > org > objectweb > proactive > ext > security > PolicyServer


1 /*
2 * ################################################################
3 *
4 * ProActive: The Java(TM) library for Parallel, Distributed,
5 * Concurrent computing with Security and Mobility
6 *
7 * Copyright (C) 1997-2002 INRIA/University of Nice-Sophia Antipolis
8 * Contact: proactive-support@inria.fr
9 *
10 * This library is free software; you can redistribute it and/or
11 * modify it under the terms of the GNU Lesser General Public
12 * License as published by the Free Software Foundation; either
13 * version 2.1 of the License, or any later version.
14 *
15 * This library is distributed in the hope that it will be useful,
16 * but WITHOUT ANY WARRANTY; without even the implied warranty of
17 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
18 * Lesser General Public License for more details.
19 *
20 * You should have received a copy of the GNU Lesser General Public
21 * License along with this library; if not, write to the Free Software
22 * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307
23 * USA
24 *
25 * Initial developer(s): The ProActive Team
26 * http://www.inria.fr/oasis/ProActive/contacts.html
27 * Contributor(s):
28 *
29 * ################################################################
30 */
31 package org.objectweb.proactive.ext.security;
32
33 import java.io.ByteArrayOutputStream ;
34 import java.io.FileInputStream ;
35 import java.io.IOException ;
36 import java.io.InputStream ;
37 import java.io.Serializable ;
38 import java.security.KeyFactory ;
39 import java.security.PrivateKey ;
40 import java.security.Provider ;
41 import java.security.Security ;
42 import java.security.cert.CertificateFactory ;
43 import java.security.cert.X509Certificate ;
44 import java.security.interfaces.RSAPrivateKey ;
45 import java.security.spec.PKCS8EncodedKeySpec ;
46 import java.util.ArrayList ;
47 import java.util.Hashtable ;
48 import java.util.Vector ;
49
50 import org.apache.log4j.Logger;
51 import org.bouncycastle.asn1.x509.X509Name;
52 import org.bouncycastle.jce.X509Principal;
53 import org.objectweb.proactive.core.runtime.VMInformation;
54 import org.objectweb.proactive.core.xml.XMLPropertiesStore;
55
56
57 public class PolicyServer implements Serializable {
58     protected static Logger logger = Logger.getLogger(PolicyServer.class.getName());
59     private static int REQUIRED = 1;
60     private static int DENIED = -1;
61     private static int OPTIONAL = 0;
62     private static String XML_CERTIFICATE = "/Policy/Certificate";
63     private static String XML_PRIVATE_KEY = "/Policy/PrivateKey";
64     private static String XML_TRUSTED_CERTIFICATION_AUTHORITY = "/Policy/TrustedCertificationAuthority/CertificationAuthority";
65     private static String XML_CERTIFICATION_AUTHORITY_CERTIFICATE = "Certificate";
66     private XMLPropertiesStore p;
67     private Hashtable certificates;
68     private Policy[] policy;
69     private String VNName;
70     protected X509Certificate certificate;
71     protected PrivateKey privateKey;
72     protected ArrayList policies;
73     protected X509Certificate applicationCertificate;
74     protected PrivateKey applicationPrivateKey;
75     protected String f;
76     protected String applicationName;
77
78     public PolicyServer() {
79         Provider myProvider = new org.bouncycastle.jce.provider.BouncyCastleProvider();
80         Security.addProvider(myProvider);
81     }
82
83     /*public PolicyServer(String file) {
84         try {
85             p = new XMLPropertiesStore(file);
86         } catch (IOException e) {
87             logger.warn("can't find file " + file);
88             e.printStackTrace();
89         }
90
91         certificates = new Hashtable();
92         storeCertificate(p.getAllNodes("/Policy/Rules/Rule/From"));
93         storeCertificate(p.getAllNodes("/Policy/Rules/Rule/To"));
94
95         System.out.println("done");
96
97
98
99
100     }
101     */
102
103     /**
104      * Method storeCertificate.
105      * read all certificates and store them in a hashtable
106      * used when the security is turned on. When the active object migrate,
107      * it takes all the certificates with it.
108      */
109     private void storeCertificate(org.w3c.dom.Node [] nodes) {
110         int i = 0;
111         for (; i < nodes.length; i++) {
112             String targetType = p.getValueAsString("Entity/@type", nodes[i])
113                                  .trim();
114             if ((targetType != null) && targetType.equals("certificate")) {
115                 String certificateFile = p.getValueAsString("Target", nodes[i])
116                                           .trim();
117                 System.out.println("Storing certificate " + certificateFile);
118                 if (certificateFile.equals("Default")) {
119                     break;
120                 }
121                 try {
122                     InputStream inStream = new FileInputStream (certificateFile);
123                     CertificateFactory cfe = CertificateFactory.getInstance(
124                             "X.509");
125                     X509Certificate certificate = (X509Certificate ) cfe.generateCertificate(inStream);
126                     certificates.put(certificateFile, certificate);
127                     inStream.close();
128                 } catch (IOException e) {
129                     logger.warn(" Certificate file " + certificateFile +
130                         " not found");
131                     e.printStackTrace();
132                 } catch (java.security.cert.CertificateException e) {
133                     logger.warn(
134                         "An error occurs while loading active object certificate");
135                     e.printStackTrace();
136                 }
137             }
138         }
139     }
140
141     private int convert(String name) {
142         if (name.equals("required") || name.equals("allowed") ||
143                 name.equals("authorized")) {
144             return REQUIRED;
145         } else if (name.equals("denied")) {
146             return DENIED;
147         } else {
148             return OPTIONAL;
149         }
150     }
151
152     public Policy getPolicyTo(X509Certificate distantOA) {
153         int[] tab = new int[4];
154         int i = 0;
155         boolean cont = true;
156
157         if (distantOA != null) {
158             // logger.info("looking for a policy to " + distantOA.getIssuerDN());
159 } else {
160             // logger.info("looking for a policy to an masked/unsecure distantOA");
161 }
162
163         org.w3c.dom.Node [] nodes = p.getAllNodes("/Policy/Rules/Rule");
164         Policy defaultPolicy = null;
165
166         for (; i < nodes.length; i++) {
167             String certificateName = p.getValueAsString("Target", nodes[i])
168                                       .trim();
169
170             if (certificateName.equals("Default")) {
171                 String s = p.getValueAsString("Communication/To/@value",
172                         nodes[i]).trim();
173                 tab[0] = convert(s);
174                 s = p.getValueAsString("Communication/To/Attributes/@authentication",
175                         nodes[i]).trim();
176                 tab[1] = convert(s);
177                 tab[2] = convert(p.getValueAsString(
178                             "Communication/To/Attributes/@confidentiality",
179                             nodes[i]).trim());
180                 tab[3] = convert(p.getValueAsString(
181                             "Communication/To/Attributes/@integrity", nodes[i])
182                                   .trim());
183                 defaultPolicy = new Policy(); //(tab[0], tab[1], tab[2], tab[3]);
184 } else {
185                 X509Certificate cert = (X509Certificate ) certificates.get(certificateName);
186                 if (cert.equals(distantOA)) {
187                     tab[0] = convert(p.getValueAsString(
188                                 "Communication/To/@value", nodes[i]).trim());
189                     tab[1] = convert(p.getValueAsString(
190                                 "Communication/To/Attributes/@authentication",
191                                 nodes[i]).trim());
192                     tab[2] = convert(p.getValueAsString(
193                                 "Communication/To/Attributes/@confidentiality",
194                                 nodes[i]).trim());
195                     tab[3] = convert(p.getValueAsString(
196                                 "Communication/To/Attributes/@integrity",
197                                 nodes[i]).trim());
198
199                     Policy policy = new Policy(); //(tab[0], tab[1], tab[2], tab[3]);
200
201                     return policy;
202                 }
203             }
204         }
205
206         // logger.info("sending my default policy" + defaultPolicy);
207 return defaultPolicy;
208     }
209
210     public SecurityContext getPolicy(SecurityContext securityContext)
211         throws SecurityNotAvailableException {
212         Communication result = null;
213         ArrayList entitiesFrom = securityContext.getEntitiesFrom();
214         ArrayList entitiesTo = securityContext.getEntitiesTo();
215         ArrayList localEntities = new ArrayList ();
216
217         if (policies == null) {
218             logger.debug("trying to find a policy whereas none has been set" +
219                 this + " " + policies);
220             throw new SecurityNotAvailableException();
221         }
222
223         // setting local entities
224 // localEntities.add(new EntityVirtualNode(VNName));
225 //org.w3c.dom.Node[] rules = p.getAllNodes("/Policy/Rules/Rule");
226 Policy policy = null;
227         Policy matchingPolicy = null;
228         Policy defaultPolicy = new Policy();
229         Communication communication;
230         Communication defaultCommunication = new Communication();
231         if (entitiesFrom == null) {
232             entitiesFrom = new ArrayList ();
233             entitiesFrom.add(new DefaultEntity());
234         }
235         if (entitiesTo == null) {
236             entitiesTo = new ArrayList ();
237             entitiesTo.add(new DefaultEntity());
238         }
239
240         //System.out.println("from " + virtualNodeFrom + " -> to " + virtualNodeTo);
241 int[] tab = new int[4];
242         boolean matchingFrom;
243         boolean matchingTo;
244         boolean matchingFromDefault;
245         boolean matchingToDefault;
246         matchingFrom = matchingTo = matchingFromDefault = matchingToDefault = false;
247         int length = policies.size();
248
249         String s = "From :";
250         for (int i = 0; i < entitiesFrom.size(); i++)
251             s += (((Entity) entitiesFrom.get(i)) + " ");
252         System.out.println(s);
253         s = "To :";
254         for (int i = 0; i < entitiesTo.size(); i++)
255             s += (((Entity) entitiesTo.get(i)) + " ");
256         System.out.println(s);
257         for (int i = 0; i < length; i++) {
258             policy = (Policy) policies.get(i);
259
260             ArrayList policyEntitiesFrom = policy.getEntitiesFrom();
261             for (int j = 0; !matchingFrom && (j < policyEntitiesFrom.size());
262                     j++) {
263                 Entity policyEntityFrom = (Entity) policyEntitiesFrom.get(j);
264
265                System.out.println("testing from" + policyEntityFrom);
266                 for (int z = 0; !matchingFrom && (z < entitiesFrom.size());
267                         z++) {
268                     Entity entity = (Entity) entitiesFrom.get(z);
269
270                     // System.out.println("testing from ---------" + entity);
271 if (policyEntityFrom instanceof DefaultEntity) {
272                         matchingFromDefault = true;
273                     } else if (policyEntityFrom.equals(entity)) {
274                         System.out.println("Matching From " + policyEntityFrom);
275                         matchingFrom = true;
276                     }
277                 }
278             }
279
280             // System.out.println("testing from matching :" + matchingFrom +
281 // " -- matchingFromDefault " + matchingFromDefault);
282 ArrayList policyEntitiesTo = policy.getEntitiesTo();
283
284             for (int j = 0; !matchingTo && (j < policyEntitiesTo.size());
285                     j++) {
286                 Entity policyEntityTo = (Entity) policyEntitiesTo.get(j);
287
288                  System.out.println("testing to" + policyEntityTo );
289                 for (int z = 0; !matchingTo && (z < entitiesTo.size()); z++) {
290                     Entity entity = (Entity) entitiesTo.get(z);
291
292                       System.out.println("testing to -------------" + entity);
293                     if (policyEntityTo instanceof DefaultEntity) {
294                         matchingToDefault = true;
295                     } else if (policyEntityTo.equals(entity)) {
296                         System.out.println("Matching To " + policyEntityTo);
297                         matchingTo = true;
298                     }
299                 }
300             }
301
302             // System.out.println("testing to matching :" + matchingTo +
303 // " -- matchingToDefault " + matchingToDefault);
304 if (matchingFrom && matchingTo) {
305                 matchingPolicy = policy;
306                 System.out.println("matching policy " + policy);
307                 break;
308             }
309             if (matchingToDefault && matchingFromDefault) {
310                 defaultPolicy = policy;
311             }
312             matchingToDefault = matchingFromDefault = false;
313             matchingTo = matchingFrom = false;
314             // System.out.println("-- reset matching --");
315 }
316
317         if (matchingPolicy == null) {
318             matchingPolicy = defaultPolicy;
319         }
320
321         if (matchingPolicy == null) {
322             logger.warn("default Policy is null !!!!!!!!!!!!!!");
323         }
324
325         System.out.println("Policy is : " + matchingPolicy);
326
327         // TODO split receive of a request or a reply
328 if ((securityContext.getType() == SecurityContext.COMMUNICATION_RECEIVE_REQUEST_FROM) ||
329                 (securityContext.getType() == SecurityContext.COMMUNICATION_RECEIVE_REPLY_FROM)) {
330             communication = matchingPolicy.getCommunicationReply();
331             communication.setCommunication(1);
332             securityContext.setReceiveReply(communication);
333             securityContext.setReceiveRequest(communication);
334         } else {
335             communication = matchingPolicy.getCommunicationRequest();
336             System.out.println("communication is " + communication);
337             communication.setCommunication(1);
338             securityContext.setSendReply(communication);
339             securityContext.setSendRequest(communication);
340         }
341
342         if (securityContext.getType() == SecurityContext.MIGRATION_TO) {
343             System.out.println(policy);
344             securityContext.setMigration(matchingPolicy.isMigration());
345         }
346
347         return securityContext;
348     }
349
350     public Communication getPolicyTo(String type, String virtualNodeFrom,
351         String virtualNodeTo) throws SecurityNotAvailableException {
352         // if (p == null) {
353 // logger.debug("SEcurityNamfndjdhuidss crac r cd boium");
354 // throw new SecurityNotAvailableException();
355 // }
356 if (true) {
357             throw new RuntimeException ("DEPRECATED METHOD : UPDATE !!!");
358         }
359         return null;
360     }
361
362     public int[] computePolicy(int[] from, int[] to)
363         throws ComputePolicyException {
364         // logger.info("calculating composed policy");
365 if (((from[0] == REQUIRED) && (to[0] == DENIED)) ||
366                 ((from[1] == REQUIRED) && (to[1] == DENIED)) ||
367                 ((from[2] == REQUIRED) && (to[2] == DENIED)) ||
368                 ((from[0] == DENIED) && (to[0] == REQUIRED)) ||
369                 ((from[1] == DENIED) && (to[1] == REQUIRED)) ||
370                 ((from[2] == DENIED) && (to[2] == REQUIRED))) {
371             throw new ComputePolicyException("incompatible policies");
372         }
373
374         return new int[] { from[0] + to[0], from[1] + to[1], from[2] + to[2] };
375     }
376
377     public boolean CanSendRequestTo(X509Certificate distantOA) {
378         return false;
379     }
380
381     public boolean CanReceiveRequestFrom(X509Certificate distantOA) {
382         return false;
383     }
384
385     public boolean CanSendReplyTo(X509Certificate distantOA) {
386         return false;
387     }
388
389     public boolean CanReceiveReplyFrom(X509Certificate distantOA) {
390         return false;
391     }
392
393     public boolean CanMigrateTo(X509Certificate distantOA) {
394         return false;
395     }
396
397     public boolean canMigrateTo(String type, String from, String to) {
398         Communication pol = null;
399         try {
400             System.out.println("Migration from " + from + "to" + to);
401             ArrayList arrayFrom = new ArrayList ();
402             ArrayList arrayTo = new ArrayList ();
403
404             // arrayFrom.add(new EntityVirtualNode(from));
405 // arrayTo.add(new EntityVirtualNode(to));
406 SecurityContext sc = new SecurityContext(SecurityContext.MIGRATION_TO,
407                     arrayFrom, arrayTo);
408             return getPolicy(sc).isMigration();
409         } catch (SecurityNotAvailableException e) {
410             // no security all is permitted
411 return true;
412         }
413     }
414
415     public String toString() {
416         String s = null;
417         s = "file: " + f + "\n";
418         for (int i = 0; i < policies.size(); i++) {
419             s += policies.get(i);
420         }
421
422         return s;
423     }
424
425     // implements Serializable
426 private void writeObject(java.io.ObjectOutputStream out)
427         throws IOException {
428         out.defaultWriteObject();
429     }
430
431     private void readObject(java.io.ObjectInputStream in)
432         throws IOException , ClassNotFoundException {
433         in.defaultReadObject();
434     }
435
436     /**
437      * @param string
438      */
439     public void setVNName(String string) {
440         this.VNName = string;
441     }
442
443     /**
444      * @return virtual node name
445      */
446     public String getVNName() {
447         return VNName;
448     }
449
450     /**
451      * @param string
452      */
453     public void setPrivateKey(String privateKeyFile) {
454         logger.debug("Loading private key ...");
455
456         RSAPrivateKey privateKey = null;
457         PKCS8EncodedKeySpec keySpec = null;
458
459         byte[] key_bytes = null;
460
461         try {
462             FileInputStream fis = new FileInputStream (privateKeyFile.trim());
463
464             ByteArrayOutputStream key_baos = new ByteArrayOutputStream ();
465             byte[] input = new byte[fis.available()];
466             fis.read(input, 0, input.length);
467             // int aByte = 0;
468 // while ((aByte = fis.read()) != -1) {
469 // key_baos.write(aByte);
470 // }
471 fis.close();
472
473             //key_bytes = key_baos.toByteArray();
474 //key_baos.close();
475 KeyFactory key_factory = KeyFactory.getInstance("RSA", "BC");
476             keySpec = new PKCS8EncodedKeySpec (input);
477             privateKey = (RSAPrivateKey ) key_factory.generatePrivate(keySpec);
478         } catch (IOException e) {
479             System.out.println("Private Key not found : file " +
480                 privateKeyFile + " not found");
481             e.printStackTrace();
482         } catch (java.security.spec.InvalidKeySpecException e) {
483             System.out.println("private key invalide :" + privateKeyFile);
484             e.printStackTrace();
485         } catch (java.security.NoSuchAlgorithmException e) {
486             e.printStackTrace();
487         } catch (java.security.NoSuchProviderException e) {
488             e.printStackTrace();
489         }
490
491         this.privateKey = privateKey;
492         logger.info("Loading private key done ...");
493     }
494
495     /**
496      * @param string
497      */
498     public void setCertificate(String certificateFile) {
499         try {
500             InputStream inStream = new FileInputStream (certificateFile);
501             CertificateFactory cfe = CertificateFactory.getInstance("X.509");
502             certificate = (X509Certificate ) cfe.generateCertificate(inStream);
503             inStream.close();
504         } catch (IOException e) {
505             logger.warn(" Certificate file " + certificateFile + " not found");
506             e.printStackTrace();
507         } catch (java.security.cert.CertificateException e) {
508             logger.warn(
509                 "An error occurs while loading active object certificate");
510             e.printStackTrace();
511         }
512         logger.debug("certificate loaded");
513     }
514
515     /**
516      * @param policies
517      */
518     public void setPolicies(ArrayList policies) {
519         logger.info("storing policies");
520         this.policies = policies;
521     }
522
523     /**
524      * @param uri
525      */
526     public void setFile(String uri) {
527         // TODO remove it !!!!! only for test
528 f = uri;
529     }
530
531     /**
532      * @return application certificate
533      */
534     public X509Certificate getApplicationCertificate() {
535         return this.applicationCertificate;
536     }
537
538     /**
539      * @param certificate
540      */
541     public void setApplicationCertificate(String pathToApplicationcertificate) {
542         try {
543             InputStream inStream = new FileInputStream (pathToApplicationcertificate);
544             CertificateFactory cfe = CertificateFactory.getInstance("X.509");
545             certificate = (X509Certificate ) cfe.generateCertificate(inStream);
546             inStream.close();
547         } catch (IOException e) {
548             logger.warn(" Certificate file " + pathToApplicationcertificate +
549                 " not found");
550             e.printStackTrace();
551         } catch (java.security.cert.CertificateException e) {
552             logger.warn(
553                 "An error occurs while loading active object certificate");
554             e.printStackTrace();
555         }
556         this.applicationCertificate = certificate;
557     // logger.debug("Application certificate loaded" + applicationCertificate);
558 }
559
560     /**
561      * @param key
562      */
563     public void setApplicationPrivateKey(String pathToApplicationPrivateKey) {
564         if (applicationPrivateKey == null) {
565             RSAPrivateKey privateKey = null;
566             PKCS8EncodedKeySpec keySpec = null;
567
568             byte[] key_bytes = null;
569
570             try {
571                 FileInputStream fis = new FileInputStream (pathToApplicationPrivateKey.trim());
572
573                 ByteArrayOutputStream key_baos = new ByteArrayOutputStream ();
574                 byte[] input = new byte[fis.available()];
575                 fis.read(input, 0, input.length);
576                 // int aByte = 0;
577 // while ((aByte = fis.read()) != -1) {
578 // key_baos.write(aByte);
579 // }
580 fis.close();
581
582                 //key_bytes = key_baos.toByteArray();
583 //key_baos.close();
584 KeyFactory key_factory = KeyFactory.getInstance("RSA", "BC");
585                 keySpec = new PKCS8EncodedKeySpec (input);
586                 privateKey = (RSAPrivateKey ) key_factory.generatePrivate(keySpec);
587             } catch (IOException e) {
588                 System.out.println("Private Key not found : file " +
589                     pathToApplicationPrivateKey + " not found");
590                 e.printStackTrace();
591             } catch (java.security.spec.InvalidKeySpecException e) {
592                 System.out.println("private key invalide :" +
593                     pathToApplicationPrivateKey);
594                 e.printStackTrace();
595             } catch (java.security.NoSuchAlgorithmException e) {
596                 e.printStackTrace();
597             } catch (java.security.NoSuchProviderException e) {
598                 e.printStackTrace();
599             }
600
601             this.applicationPrivateKey = privateKey;
602             logger.info("Loading private key done ...");
603         }
604     }
605
606     /**
607      * @param vnName
608      * @param vmInformation
609      */
610     public void generateNodeCertificate(String vnName,
611         VMInformation vmInformation) {
612         if (certificate != null) {
613             // Node certificate already generated
614 return;
615         }
616
617         Object [] secret = null;
618
619         // create node certificate
620 if (applicationCertificate != null) {
621             X509Name name = new X509Name(applicationCertificate.getSubjectDN()
622                                                                .getName());
623             Vector vName = name.getValues();
624             Vector order = name.getOIDs();
625
626             int index = order.indexOf(X509Principal.CN);
627
628             String subject = applicationName + " " + vnName;
629
630             vName.set(index, subject);
631
632             name = new X509Name(order, vName);
633
634             secret = ProActiveSecurity.generateCertificate(name.toString(),
635                     applicationCertificate.getSubjectDN().toString(),
636                     applicationPrivateKey, applicationCertificate.getPublicKey());
637             this.certificate = (X509Certificate ) secret[0];
638             this.privateKey = (PrivateKey ) secret[1];
639         }
640     }
641
642     /**
643      * @return certificate of the entity
644      */
645     public X509Certificate getCertificate() {
646         return certificate;
647     }
648
649     /**
650      * @param set application name
651      */
652     public void setApplicationName(String applicationName) {
653         this.applicationName = applicationName;
654     }
655
656     public String getApplicationName() {
657         return applicationName;
658     }
659 }
660

A to Z: JavaDoc & Examples

---

Daily Java News & Articles

---

Open Source Projects

---

Open Source Codes

---

Free Computer Books

---

Remove Frame

---

Popular Tags