1 package org
.argeo
.cms
.internal
.kernel
;
3 import java
.io
.IOException
;
4 import java
.net
.Inet6Address
;
5 import java
.net
.InetAddress
;
7 import java
.net
.UnknownHostException
;
8 import java
.nio
.file
.Files
;
9 import java
.nio
.file
.Path
;
10 import java
.security
.PrivilegedExceptionAction
;
11 import java
.util
.ArrayList
;
12 import java
.util
.Iterator
;
14 import javax
.security
.auth
.Subject
;
15 import javax
.security
.auth
.callback
.Callback
;
16 import javax
.security
.auth
.callback
.CallbackHandler
;
17 import javax
.security
.auth
.callback
.NameCallback
;
18 import javax
.security
.auth
.callback
.UnsupportedCallbackException
;
19 import javax
.security
.auth
.kerberos
.KerberosPrincipal
;
20 import javax
.security
.auth
.login
.Configuration
;
21 import javax
.security
.auth
.login
.LoginContext
;
22 import javax
.security
.auth
.login
.LoginException
;
24 import org
.apache
.commons
.httpclient
.auth
.AuthPolicy
;
25 import org
.apache
.commons
.httpclient
.auth
.CredentialsProvider
;
26 import org
.apache
.commons
.httpclient
.cookie
.CookiePolicy
;
27 import org
.apache
.commons
.httpclient
.params
.DefaultHttpParams
;
28 import org
.apache
.commons
.httpclient
.params
.HttpMethodParams
;
29 import org
.apache
.commons
.httpclient
.params
.HttpParams
;
30 import org
.apache
.commons
.logging
.Log
;
31 import org
.apache
.commons
.logging
.LogFactory
;
32 import org
.argeo
.cms
.CmsException
;
33 import org
.argeo
.cms
.internal
.http
.NodeHttp
;
34 import org
.argeo
.cms
.internal
.http
.client
.SpnegoAuthScheme
;
35 import org
.argeo
.cms
.internal
.http
.client
.SpnegoCredentialProvider
;
36 import org
.argeo
.naming
.DnsBrowser
;
37 import org
.argeo
.node
.NodeConstants
;
38 import org
.ietf
.jgss
.GSSCredential
;
39 import org
.ietf
.jgss
.GSSException
;
40 import org
.ietf
.jgss
.GSSManager
;
41 import org
.ietf
.jgss
.GSSName
;
42 import org
.ietf
.jgss
.Oid
;
44 /** Low-level kernel security */
45 public class CmsSecurity
implements KernelConstants
{
46 private final static Log log
= LogFactory
.getLog(CmsSecurity
.class);
47 // http://java.sun.com/javase/6/docs/technotes/guides/security/jgss/jgss-features.html
48 public final static Oid KERBEROS_OID
;
51 KERBEROS_OID
= new Oid("1.3.6.1.5.5.2");
52 } catch (GSSException e
) {
53 throw new IllegalStateException("Cannot create Kerberos OID", e
);
57 public final static int DEPLOYED
= 30;
58 public final static int STANDALONE
= 20;
59 public final static int DEV
= 10;
60 public final static int UNKNOWN
= 0;
62 private String hostname
;
64 private final int securityLevel
;
65 private Subject nodeSubject
;
68 private String kerberosDomain
;
69 private String service
= null;
70 private GSSCredential acceptorCredentials
;
72 private Path nodeKeyTab
= KernelUtils
.getOsgiInstancePath(KernelConstants
.NODE_KEY_TAB_PATH
);
75 // Register client-side SPNEGO auth scheme
76 AuthPolicy
.registerAuthScheme(SpnegoAuthScheme
.NAME
, SpnegoAuthScheme
.class);
77 HttpParams params
= DefaultHttpParams
.getDefaultParams();
78 ArrayList
<String
> schemes
= new ArrayList
<>();
79 schemes
.add(SpnegoAuthScheme
.NAME
);
80 params
.setParameter(AuthPolicy
.AUTH_SCHEME_PRIORITY
, schemes
);
81 params
.setParameter(CredentialsProvider
.PROVIDER
, new SpnegoCredentialProvider());
82 params
.setParameter(HttpMethodParams
.COOKIE_POLICY
, CookiePolicy
.BROWSER_COMPATIBILITY
);
83 // params.setCookiePolicy(CookiePolicy.BROWSER_COMPATIBILITY);
85 if (!DeployConfig
.isInitialized()) // first init
86 FirstInit
.prepareInstanceArea();
88 securityLevel
= evaluateSecurityLevel();
89 // Configure JAAS first
90 if (System
.getProperty(JAAS_CONFIG_PROP
) == null) {
91 String jaasConfig
= securityLevel
< DEPLOYED ? JAAS_CONFIG
: JAAS_CONFIG_IPA
;
92 URL url
= getClass().getClassLoader().getResource(jaasConfig
);
93 System
.setProperty(JAAS_CONFIG_PROP
, url
.toExternalForm());
95 // explicitly load JAAS configuration
96 Configuration
.getConfiguration();
97 nodeSubject
= logInKernel();
99 // firstInit = !new File(getOsgiInstanceDir(), DIR_NODE).exists();
101 // this.keyStoreFile = new File(KernelUtils.getOsgiInstanceDir(),
103 // createKeyStoreIfNeeded();
106 private int evaluateSecurityLevel() {
108 try (DnsBrowser dnsBrowser
= new DnsBrowser()) {
109 InetAddress localhost
= InetAddress
.getLocalHost();
110 hostname
= localhost
.getHostName();
111 String dnsZone
= hostname
.substring(hostname
.indexOf('.') + 1);
112 String ipfromDns
= dnsBrowser
.getRecord(hostname
, localhost
instanceof Inet6Address ?
"AAAA" : "A");
113 boolean consistentIp
= localhost
.getHostAddress().equals(ipfromDns
);
114 kerberosDomain
= dnsBrowser
.getRecord("_kerberos." + dnsZone
, "TXT");
115 if (consistentIp
&& kerberosDomain
!= null && Files
.exists(nodeKeyTab
)) {
119 kerberosDomain
= null;
120 // FIXME make state more robust
122 } catch (UnknownHostException e
) {
123 hostname
= "localhost";
124 log
.warn("Cannot determine hostname, using " + hostname
+ ":" + e
.getMessage());
126 } catch (Exception e
) {
127 log
.warn("Exception when evaluating security level, setting it to DEV", e
);
132 throw new CmsException("Undefined security level");
136 private Subject
logInKernel() {
137 final Subject nodeSubject
= new Subject();
139 CallbackHandler callbackHandler
;
140 if (Files
.exists(nodeKeyTab
)) {
141 service
= NodeHttp
.DEFAULT_SERVICE
;
142 // service = NodeConstants.NODE_SERVICE;
143 callbackHandler
= new CallbackHandler() {
146 public void handle(Callback
[] callbacks
) throws IOException
, UnsupportedCallbackException
{
147 for (Callback callback
: callbacks
)
148 if (callback
instanceof NameCallback
)
149 ((NameCallback
) callback
).setName(getKerberosServicePrincipal());
154 LoginContext kernelLc
= new LoginContext(NodeConstants
.LOGIN_CONTEXT_NODE
, nodeSubject
,
157 } catch (LoginException e
) {
158 throw new CmsException("Cannot log in kernel", e
);
161 callbackHandler
= null;
163 // callbackHandler = (CallbackHandler)
164 // Class.forName("com.sun.security.auth.callback.TextCallbackHandler")
166 // } catch (ReflectiveOperationException e) {
167 // throw new CmsException("Cannot create text callback handler", e);
170 LoginContext kernelLc
= new LoginContext(NodeConstants
.LOGIN_CONTEXT_NODE
, nodeSubject
);
172 } catch (LoginException e
) {
173 throw new CmsException("Cannot log in kernel", e
);
177 if (securityLevel
>= DEPLOYED
) {
178 acceptorCredentials
= logInAsAcceptor(nodeSubject
);
183 private String
getKerberosServicePrincipal() {
184 if (hostname
== null || "locahost".equals(hostname
) || kerberosDomain
== null || service
== null)
185 throw new IllegalStateException("Cannot determine kerberos principal");
186 return service
+ "/" + hostname
+ "@" + kerberosDomain
;
189 private GSSCredential
logInAsAcceptor(Subject nodeSubject
) {
191 Iterator
<KerberosPrincipal
> krb5It
= nodeSubject
.getPrincipals(KerberosPrincipal
.class).iterator();
192 if (!krb5It
.hasNext())
194 KerberosPrincipal krb5Principal
= null;
195 while (krb5It
.hasNext()) {
196 KerberosPrincipal principal
= krb5It
.next();
197 if (service
== null && krb5Principal
== null)// first as default
198 krb5Principal
= principal
;
199 if (service
!= null && principal
.getName().equals(getKerberosServicePrincipal()))
200 krb5Principal
= principal
;
203 if (krb5Principal
== null)
206 GSSManager manager
= GSSManager
.getInstance();
208 GSSName gssName
= manager
.createName(krb5Principal
.getName(), null);
209 GSSCredential serverCredentials
= Subject
.doAs(nodeSubject
, new PrivilegedExceptionAction
<GSSCredential
>() {
212 public GSSCredential
run() throws GSSException
{
213 return manager
.createCredential(gssName
, GSSCredential
.INDEFINITE_LIFETIME
, KERBEROS_OID
,
214 GSSCredential
.ACCEPT_ONLY
);
219 if (log
.isDebugEnabled())
220 log
.debug("GSS acceptor configured for " + krb5Principal
);
221 return serverCredentials
;
222 } catch (Exception gsse
) {
223 throw new CmsException("Cannot create acceptor credentials for " + krb5Principal
, gsse
);
227 // private Subject logInHardenedKernel() {
228 // final Subject kernelSubject = new Subject();
229 // createKeyStoreIfNeeded();
231 // CallbackHandler cbHandler = new CallbackHandler() {
234 // public void handle(Callback[] callbacks) throws IOException,
235 // UnsupportedCallbackException {
237 //// ((NameCallback) callbacks[1]).setName(AuthConstants.ROLE_KERNEL);
239 // ((PasswordCallback) callbacks[2]).setPassword("changeit".toCharArray());
241 // ((PasswordCallback) callbacks[3]).setPassword("changeit".toCharArray());
245 // LoginContext kernelLc = new
246 // LoginContext(KernelConstants.LOGIN_CONTEXT_HARDENED_KERNEL,
250 // } catch (LoginException e) {
251 // throw new CmsException("Cannot log in kernel", e);
253 // return kernelSubject;
259 LoginContext kernelLc
= new LoginContext(NodeConstants
.LOGIN_CONTEXT_NODE
, nodeSubject
);
261 } catch (LoginException e
) {
262 throw new CmsException("Cannot log out kernel", e
);
265 // Security.removeProvider(SECURITY_PROVIDER);
268 public synchronized int getSecurityLevel() {
269 return securityLevel
;
272 public String
getKerberosDomain() {
273 return kerberosDomain
;
276 public Subject
getNodeSubject() {
280 public GSSCredential
getServerCredentials() {
281 return acceptorCredentials
;
284 // public void setSecurityLevel(int newValue) {
285 // if (newValue != STANDALONE || newValue != DEV)
286 // throw new CmsException("Invalid value for security level " + newValue);
287 // if (newValue >= securityLevel)
288 // throw new CmsException(
289 // "Impossible to increase security level (from " + securityLevel + " to " +
291 // securityLevel = newValue;
294 // private void createKeyStoreIfNeeded() {
295 // // for (Provider provider : Security.getProviders())
296 // // System.out.println(provider.getName());
298 // char[] ksPwd = "changeit".toCharArray();
299 // char[] keyPwd = Arrays.copyOf(ksPwd, ksPwd.length);
300 // if (!keyStoreFile.exists()) {
302 // keyStoreFile.getParentFile().mkdirs();
303 // KeyStore keyStore = PkiUtils.getKeyStore(keyStoreFile, ksPwd);
304 // // PkiUtils.generateSelfSignedCertificate(keyStore, new
305 // // X500Principal(AuthConstants.ROLE_KERNEL), 1024,
307 // PkiUtils.saveKeyStore(keyStoreFile, ksPwd, keyStore);
308 // if (log.isDebugEnabled())
309 // log.debug("Created keystore " + keyStoreFile);
310 // } catch (Exception e) {
311 // if (keyStoreFile.length() == 0)
312 // keyStoreFile.delete();
313 // log.error("Cannot create keystore " + keyStoreFile, e);
318 // private final static String SECURITY_PROVIDER = "BC";// Bouncy Castle
319 // private final static Log log;
321 // log = LogFactory.getLog(NodeSecurity.class);
322 // // Make Bouncy Castle the default provider
323 // Provider provider = new BouncyCastleProvider();
324 // int position = Security.insertProviderAt(provider, 1);
325 // if (position == -1)
326 // log.error("Provider " + provider.getName()
327 // + " already installed and could not be set as default");
328 // Provider defaultProvider = Security.getProviders()[0];
329 // if (!defaultProvider.getName().equals(SECURITY_PROVIDER))
330 // log.error("Provider name is " + defaultProvider.getName()
331 // + " but it should be " + SECURITY_PROVIDER);