|
| 1 | +package iot.technology.mqtt.server.ssl; |
| 2 | + |
| 3 | +import org.springframework.util.StringUtils; |
| 4 | + |
| 5 | +import javax.net.ssl.KeyManagerFactory; |
| 6 | +import java.security.KeyStore.PrivateKeyEntry; |
| 7 | +import javax.net.ssl.TrustManagerFactory; |
| 8 | +import java.io.IOException; |
| 9 | +import java.security.*; |
| 10 | +import java.security.cert.Certificate; |
| 11 | +import java.security.cert.X509Certificate; |
| 12 | +import java.util.*; |
| 13 | + |
| 14 | +public abstract class AbstractSslCredentials implements SslCredentials { |
| 15 | + |
| 16 | + private char[] keyPasswordArray; |
| 17 | + |
| 18 | + private KeyStore keyStore; |
| 19 | + |
| 20 | + private PrivateKey privateKey; |
| 21 | + |
| 22 | + private PublicKey publicKey; |
| 23 | + |
| 24 | + private X509Certificate[] chain; |
| 25 | + |
| 26 | + private X509Certificate[] trusts; |
| 27 | + |
| 28 | + @Override |
| 29 | + public void init(boolean trustsOnly) throws IOException, GeneralSecurityException { |
| 30 | + String keyPassword = getKeyPassword(); |
| 31 | + if (StringUtils.isEmpty(keyPassword)) { |
| 32 | + this.keyPasswordArray = new char[0]; |
| 33 | + } else { |
| 34 | + this.keyPasswordArray = keyPassword.toCharArray(); |
| 35 | + } |
| 36 | + this.keyStore = this.loadKeyStore(trustsOnly, this.keyPasswordArray); |
| 37 | + Set<X509Certificate> trustedCerts = getTrustedCerts(this.keyStore, trustsOnly); |
| 38 | + this.trusts = trustedCerts.toArray(new X509Certificate[0]); |
| 39 | + if (!trustsOnly) { |
| 40 | + PrivateKeyEntry privateKeyEntry = null; |
| 41 | + String keyAlias = this.getKeyAlias(); |
| 42 | + if (!StringUtils.isEmpty(keyAlias)) { |
| 43 | + privateKeyEntry = tryGetPrivateKeyEntry(this.keyStore, keyAlias, this.keyPasswordArray); |
| 44 | + } else { |
| 45 | + for (Enumeration<String> e = this.keyStore.aliases(); e.hasMoreElements(); ) { |
| 46 | + String alias = e.nextElement(); |
| 47 | + privateKeyEntry = tryGetPrivateKeyEntry(this.keyStore, alias, this.keyPasswordArray); |
| 48 | + if (privateKeyEntry != null) { |
| 49 | + this.updateKeyAlias(alias); |
| 50 | + break; |
| 51 | + } |
| 52 | + } |
| 53 | + } |
| 54 | + if (privateKeyEntry == null) { |
| 55 | + throw new IllegalArgumentException("Failed to get private key from the keystore or pem files. " + |
| 56 | + "Please check if the private key exists in the keystore or pem files and if the provided private key password is valid."); |
| 57 | + } |
| 58 | + this.chain = asX509Certificates(privateKeyEntry.getCertificateChain()); |
| 59 | + this.privateKey = privateKeyEntry.getPrivateKey(); |
| 60 | + if (this.chain.length > 0) { |
| 61 | + this.publicKey = this.chain[0].getPublicKey(); |
| 62 | + } |
| 63 | + } |
| 64 | + |
| 65 | + } |
| 66 | + |
| 67 | + @Override |
| 68 | + public KeyStore getKeyStore() { |
| 69 | + return this.keyStore; |
| 70 | + } |
| 71 | + |
| 72 | + @Override |
| 73 | + public PrivateKey getPrivateKey() { |
| 74 | + return this.privateKey; |
| 75 | + } |
| 76 | + |
| 77 | + @Override |
| 78 | + public PublicKey getPublicKey() { |
| 79 | + return this.publicKey; |
| 80 | + } |
| 81 | + |
| 82 | + @Override |
| 83 | + public X509Certificate[] getCertificateChain() { |
| 84 | + return this.chain; |
| 85 | + } |
| 86 | + |
| 87 | + @Override |
| 88 | + public X509Certificate[] getTrustedCertificates() { |
| 89 | + return this.trusts; |
| 90 | + } |
| 91 | + |
| 92 | + @Override |
| 93 | + public TrustManagerFactory createTrustManagerFactory() throws NoSuchAlgorithmException, KeyStoreException { |
| 94 | + TrustManagerFactory tmFactory = TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm()); |
| 95 | + tmFactory.init(this.keyStore); |
| 96 | + return tmFactory; |
| 97 | + } |
| 98 | + |
| 99 | + @Override |
| 100 | + public KeyManagerFactory createKeyManagerFactory() throws NoSuchAlgorithmException, UnrecoverableKeyException, KeyStoreException { |
| 101 | + KeyManagerFactory kmf = KeyManagerFactory.getInstance(KeyManagerFactory.getDefaultAlgorithm()); |
| 102 | + kmf.init(this.keyStore, this.keyPasswordArray); |
| 103 | + return kmf; |
| 104 | + } |
| 105 | + |
| 106 | + @Override |
| 107 | + public String getValueFromSubjectNameByKey(String subjectName, String key) { |
| 108 | + String[] dns = subjectName.split(","); |
| 109 | + Optional<String> cn = (Arrays.stream(dns).filter(dn -> dn.contains(key + "="))).findFirst(); |
| 110 | + String value = cn.isPresent() ? cn.get().replace(key + "=", "") : null; |
| 111 | + return StringUtils.isEmpty(value) ? null : value; |
| 112 | + } |
| 113 | + |
| 114 | + protected abstract boolean canUse(); |
| 115 | + |
| 116 | + protected abstract KeyStore loadKeyStore(boolean isPrivateKeyRequired, char[] keyPasswordArray) throws IOException, GeneralSecurityException; |
| 117 | + |
| 118 | + protected abstract void updateKeyAlias(String keyAlias); |
| 119 | + |
| 120 | + private static X509Certificate[] asX509Certificates(Certificate[] certificates) { |
| 121 | + if (null == certificates || 0 == certificates.length) { |
| 122 | + throw new IllegalArgumentException("certificates missing!"); |
| 123 | + } |
| 124 | + X509Certificate[] x509Certificates = new X509Certificate[certificates.length]; |
| 125 | + for (int index = 0; certificates.length > index; ++index) { |
| 126 | + if (null == certificates[index]) { |
| 127 | + throw new IllegalArgumentException("[" + index + "] is null!"); |
| 128 | + } |
| 129 | + try { |
| 130 | + x509Certificates[index] = (X509Certificate) certificates[index]; |
| 131 | + } catch (ClassCastException e) { |
| 132 | + throw new IllegalArgumentException("[" + index + "] is not a x509 certificate! Instead it's a " |
| 133 | + + certificates[index].getClass().getName()); |
| 134 | + } |
| 135 | + } |
| 136 | + return x509Certificates; |
| 137 | + } |
| 138 | + |
| 139 | + private static PrivateKeyEntry tryGetPrivateKeyEntry(KeyStore keyStore, String alias, char[] pwd) { |
| 140 | + PrivateKeyEntry entry = null; |
| 141 | + try { |
| 142 | + if (keyStore.entryInstanceOf(alias, PrivateKeyEntry.class)) { |
| 143 | + try { |
| 144 | + entry = (PrivateKeyEntry) keyStore |
| 145 | + .getEntry(alias, new KeyStore.PasswordProtection(pwd)); |
| 146 | + } catch (UnsupportedOperationException e) { |
| 147 | + PrivateKey key = (PrivateKey) keyStore.getKey(alias, pwd); |
| 148 | + Certificate[] certs = keyStore.getCertificateChain(alias); |
| 149 | + entry = new KeyStore.PrivateKeyEntry(key, certs); |
| 150 | + } |
| 151 | + } |
| 152 | + } catch (KeyStoreException | NoSuchAlgorithmException | UnrecoverableEntryException e) { |
| 153 | + } |
| 154 | + return entry; |
| 155 | + } |
| 156 | + |
| 157 | + private static Set<X509Certificate> getTrustedCerts(KeyStore ks, boolean trustsOnly) { |
| 158 | + Set<X509Certificate> set = new HashSet<>(); |
| 159 | + try { |
| 160 | + for (Enumeration<String> e = ks.aliases(); e.hasMoreElements(); ) { |
| 161 | + String alias = e.nextElement(); |
| 162 | + if (ks.isCertificateEntry(alias)) { |
| 163 | + Certificate cert = ks.getCertificate(alias); |
| 164 | + if (cert instanceof X509Certificate) { |
| 165 | + if (trustsOnly) { |
| 166 | + // is CA certificate |
| 167 | + if (((X509Certificate) cert).getBasicConstraints() >= 0) { |
| 168 | + set.add((X509Certificate) cert); |
| 169 | + } |
| 170 | + } else { |
| 171 | + set.add((X509Certificate) cert); |
| 172 | + } |
| 173 | + } |
| 174 | + } else if (ks.isKeyEntry(alias)) { |
| 175 | + Certificate[] certs = ks.getCertificateChain(alias); |
| 176 | + if ((certs != null) && (certs.length > 0) && (certs[0] instanceof X509Certificate)) { |
| 177 | + if (trustsOnly) { |
| 178 | + for (Certificate cert : certs) { |
| 179 | + // is CA certificate |
| 180 | + if (((X509Certificate) cert).getBasicConstraints() >= 0) { |
| 181 | + set.add((X509Certificate) cert); |
| 182 | + } |
| 183 | + } |
| 184 | + } else { |
| 185 | + set.add((X509Certificate) certs[0]); |
| 186 | + } |
| 187 | + } |
| 188 | + |
| 189 | + } |
| 190 | + } |
| 191 | + } catch (KeyStoreException ignored) {} |
| 192 | + return Collections.unmodifiableSet(set); |
| 193 | + } |
| 194 | +} |
0 commit comments