NodeSecurity.java

   1 package org.argeo.cms.internal.kernel;
   2
   3 import java.io.File;
   4 import java.io.IOException;
   5 import java.net.URL;
   6 import java.security.KeyStore;
   7 import java.security.Provider;
   8 import java.security.Security;
   9 import java.util.Arrays;
  10
  11 import javax.security.auth.Subject;
  12 import javax.security.auth.callback.Callback;
  13 import javax.security.auth.callback.CallbackHandler;
  14 import javax.security.auth.callback.NameCallback;
  15 import javax.security.auth.callback.PasswordCallback;
  16 import javax.security.auth.callback.UnsupportedCallbackException;
  17 import javax.security.auth.login.LoginContext;
  18 import javax.security.auth.login.LoginException;
  19 import javax.security.auth.x500.X500Principal;
  20
  21 import org.apache.commons.logging.Log;
  22 import org.apache.commons.logging.LogFactory;
  23 import org.argeo.cms.CmsException;
  24 import org.argeo.cms.auth.AuthConstants;
  25 import org.bouncycastle.jce.provider.BouncyCastleProvider;
  26
  27 /** Low-level kernel security */
  28 class NodeSecurity {
  29         public final static int HARDENED = 3;
  30         public final static int STAGING = 2;
  31         public final static int DEV = 1;
  32
  33         final static String SECURITY_PROVIDER = "BC";// Bouncy Castle
  34
  35         private final static Log log;
  36         static {
  37                 log = LogFactory.getLog(NodeSecurity.class);
  38                 // Make Bouncy Castle the default provider
  39                 Provider provider = new BouncyCastleProvider();
  40                 int position = Security.insertProviderAt(provider, 1);
  41                 if (position == -1)
  42                         log.error("Provider " + provider.getName()
  43                                         + " already installed and could not be set as default");
  44                 Provider defaultProvider = Security.getProviders()[0];
  45                 if (!defaultProvider.getName().equals(SECURITY_PROVIDER))
  46                         log.error("Provider name is " + defaultProvider.getName()
  47                                         + " but it should be " + SECURITY_PROVIDER);
  48         }
  49
  50         private final Subject kernelSubject;
  51         private int securityLevel = STAGING;
  52
  53         public NodeSecurity() {
  54                 // Configure JAAS first
  55                 URL url = getClass().getClassLoader().getResource(
  56                                 KernelConstants.JAAS_CONFIG);
  57                 System.setProperty("java.security.auth.login.config",
  58                                 url.toExternalForm());
  59
  60                 this.kernelSubject = logInKernel();
  61         }
  62
  63         private Subject logInKernel() {
  64                 final Subject kernelSubject = new Subject();
  65                 createKeyStoreIfNeeded();
  66
  67                 CallbackHandler cbHandler = new CallbackHandler() {
  68
  69                         @Override
  70                         public void handle(Callback[] callbacks) throws IOException,
  71                                         UnsupportedCallbackException {
  72                                 // alias
  73                                 ((NameCallback) callbacks[1])
  74                                                 .setName(AuthConstants.ROLE_KERNEL);
  75                                 // store pwd
  76                                 ((PasswordCallback) callbacks[2]).setPassword("changeit"
  77                                                 .toCharArray());
  78                                 // key pwd
  79                                 ((PasswordCallback) callbacks[3]).setPassword("changeit"
  80                                                 .toCharArray());
  81                         }
  82                 };
  83                 try {
  84                         LoginContext kernelLc = new LoginContext(
  85                                         KernelConstants.LOGIN_CONTEXT_KERNEL, kernelSubject,
  86                                         cbHandler);
  87                         kernelLc.login();
  88                 } catch (LoginException e) {
  89                         throw new CmsException("Cannot log in kernel", e);
  90                 }
  91                 return kernelSubject;
  92         }
  93
  94         void destroy() {
  95                 // Logout kernel
  96                 try {
  97                         LoginContext kernelLc = new LoginContext(
  98                                         KernelConstants.LOGIN_CONTEXT_KERNEL, kernelSubject);
  99                         kernelLc.logout();
 100                 } catch (LoginException e) {
 101                         throw new CmsException("Cannot log out kernel", e);
 102                 }
 103
 104                 Security.removeProvider(SECURITY_PROVIDER);
 105         }
 106
 107         public Subject getKernelSubject() {
 108                 return kernelSubject;
 109         }
 110
 111         public synchronized int getSecurityLevel() {
 112                 return securityLevel;
 113         }
 114
 115         public void setSecurityLevel(int newValue) {
 116                 if (newValue != STAGING || newValue != DEV)
 117                         throw new CmsException("Invalid value for security level "
 118                                         + newValue);
 119                 if (newValue >= securityLevel)
 120                         throw new CmsException(
 121                                         "Impossible to increase security level (from "
 122                                                         + securityLevel + " to " + newValue + ")");
 123                 securityLevel = newValue;
 124         }
 125
 126         private void createKeyStoreIfNeeded() {
 127                 char[] ksPwd = "changeit".toCharArray();
 128                 char[] keyPwd = Arrays.copyOf(ksPwd, ksPwd.length);
 129                 File keyStoreFile = new File(KernelUtils.getOsgiInstanceDir(),
 130                                 "node.p12");
 131                 if (!keyStoreFile.exists()) {
 132                         try {
 133                                 keyStoreFile.getParentFile().mkdirs();
 134                                 KeyStore keyStore = PkiUtils.getKeyStore(keyStoreFile, ksPwd);
 135                                 PkiUtils.generateSelfSignedCertificate(keyStore,
 136                                                 new X500Principal(AuthConstants.ROLE_KERNEL), keyPwd);
 137                                 PkiUtils.saveKeyStore(keyStoreFile, ksPwd, keyStore);
 138                         } catch (Exception e) {
 139                                 throw new CmsException("Cannot create key store "
 140                                                 + keyStoreFile, e);
 141                         }
 142                 }
 143         }
 144 }