Prepare next development cycle

[lgpl/argeo-commons.git] / org.argeo.cms.lib.sshd / src / org / argeo / cms / bc / BcUtils.java

diff --git a/org.argeo.cms.lib.sshd/src/org/argeo/cms/bc/BcUtils.java b/org.argeo.cms.lib.sshd/src/org/argeo/cms/bc/BcUtils.java
index d2fc89f795a2e3a872147b0e8ebe78cfcbea56c9..81ab6772768264a5afbf942be6f1b97b93d11f2a 100644 (file)
--- a/org.argeo.cms.lib.sshd/src/org/argeo/cms/bc/BcUtils.java
+++ b/org.argeo.cms.lib.sshd/src/org/argeo/cms/bc/BcUtils.java
@@ -4,6 +4,7 @@ import java.io.IOException;
 import java.io.InputStream;
 import java.io.OutputStream;
 import java.io.Reader;
+import java.lang.reflect.InvocationTargetException;
 import java.math.BigInteger;
 import java.net.InetAddress;
 import java.nio.file.Files;
@@ -13,6 +14,7 @@ import java.security.KeyPair;
 import java.security.KeyPairGenerator;
 import java.security.KeyStore;
 import java.security.PrivateKey;
+import java.security.Provider;
 import java.security.SecureRandom;
 import java.security.Security;
 import java.security.cert.Certificate;
@@ -29,7 +31,6 @@ import org.bouncycastle.cert.X509CertificateHolder;
 import org.bouncycastle.cert.X509v3CertificateBuilder;
 import org.bouncycastle.cert.jcajce.JcaX509CertificateConverter;
 import org.bouncycastle.cert.jcajce.JcaX509v3CertificateBuilder;
-import org.bouncycastle.jce.provider.BouncyCastleProvider;
 import org.bouncycastle.openssl.PEMParser;
 import org.bouncycastle.openssl.jcajce.JcaPEMKeyConverter;
 import org.bouncycastle.openssl.jcajce.JceOpenSSLPKCS8DecryptorProviderBuilder;
@@ -44,12 +45,43 @@ import org.bouncycastle.pkcs.PKCSException;
 public class BcUtils {
        private final static CmsLog log = CmsLog.getLog(BcUtils.class);
 
-       private final static String BC_SECURITY_PROVIDER;
+       private final static String BC_SECURITY_PROVIDER_FIPS = "BCFIPS";
+//     private final static String BC_SECURITY_PROVIDER_NON_FIPS = "BC";
+       public final static String BC_SECURITY_PROVIDER;
        static {
-               Security.addProvider(new BouncyCastleProvider());
-               BC_SECURITY_PROVIDER = "BC";
+               Class<?> clss = null;
+               try {
+                       clss = Class.forName("org.bouncycastle.jcajce.provider.BouncyCastleFipsProvider");
+               } catch (ClassNotFoundException e) {
+                       log.warn("Bouncy Castle FIPS provider could not be initialised,"
+                                       + " we assume the non-FIPS provider is configured externally. (" + e + ")");
+                       try {
+                               clss = Class.forName("org.bouncycastle.jce.provider.BouncyCastleProvider");
+                       } catch (ClassNotFoundException e1) {
+                               // silent
+                       }
+               }
+               if (clss != null) {
+                       try {
+                               Provider provider = (Provider) clss.getDeclaredConstructor().newInstance();
+                               Security.addProvider(provider);
+                               BC_SECURITY_PROVIDER = provider.getName();
+                       } catch (IllegalAccessException | InstantiationException | IllegalArgumentException
+                                       | InvocationTargetException | NoSuchMethodException | SecurityException e) {
+                               throw new IllegalStateException("Cannot load Bouncy Castle provider " + clss, e);
+                       }
+               } else {
+                       throw new IllegalStateException("Cannot load any Bouncy Castle provider");
+               }
        }
 
+       public static boolean isFipsProvider() {
+               return BC_SECURITY_PROVIDER.equals(BC_SECURITY_PROVIDER_FIPS);
+       }
+
+       /*
+        * openssl req -x509 -newkey rsa:3072 -keyout node.key -out node.crt -sha256 -days 365 -nodes -subj "/O=UNSECURE/OU=UNSECURE/CN=$(hostname)"
+        */
        public static void createSelfSignedKeyStore(Path keyStorePath, char[] keyStorePassword, String keyStoreType) {
                // for (Provider provider : Security.getProviders())
                // System.out.println(provider.getName());
@@ -61,7 +93,7 @@ public class BcUtils {
                                KeyStore keyStore = getKeyStore(keyStorePath, keyStorePassword, keyStoreType);
                                generateSelfSignedCertificate(keyStore,
                                                new X500Principal("CN=" + InetAddress.getLocalHost().getHostName() + ",OU=UNSECURE,O=UNSECURE"),
-                                               1024, keyPwd);
+                                               3072, keyPwd);
                                saveKeyStore(keyStorePath, keyStorePassword, keyStore);
                                if (log.isDebugEnabled())
                                        log.debug("Created self-signed unsecure keystore " + keyStorePath);
@@ -165,4 +197,8 @@ public class BcUtils {
        /** singleton */
        private BcUtils() {
        }
+
+//     public static void main(String args[]) {
+//             createSelfSignedKeyStore(Paths.get("./selfsigned.p12"), "demo".toCharArray(), "PKCS12");
+//     }
 }