Changeset 5898 for branches/2.3/security/ExpressoCert/src/br/gov/serpro/cert/DigitalCertificate.java

Timestamp:

04/09/12 15:21:57 (12 years ago)

Author:

rafaelraymundo

Message:

Ticket #2256 - Problemas com o token iKey 2032 / 4000.

File:

• branches/2.3/security/ExpressoCert/src/br/gov/serpro/cert/DigitalCertificate.java (modified) (17 diffs)

branches/2.3/security/ExpressoCert/src/br/gov/serpro/cert/DigitalCertificate.java

@@ -65 +65 @@
 import java.security.AlgorithmParameters;
 import java.security.cert.CertificateEncodingException;
+import java.text.DateFormat;
 import java.util.HashMap;
+import java.util.Locale;
 import java.util.regex.Matcher;
 import java.util.regex.Pattern;
@@ -109 +111 @@
     // caso seja necessário.
     private int keystoreStatus;
+    private static boolean useMSCapi = false;
     public static final int KEYSTORE_DETECTED = 0;
     public static final int KEYSTORE_NOT_DETECTED = 1;
@@ -133 +136 @@
             HOME_SUBDIR = "\\dados de aplicativos\\sun\\java\\deployment\\security";
             EPASS_2000 = System.getenv("SystemRoot") + "\\system32\\ngp11v211.dll";
-            //EPASS_2000 = System.getenv("ProgramFiles")+"\\Gemplus\\GemSafe Libraries\\BIN\\gclib.dll";
+            DigitalCertificate.useMSCapi = true;
         }
 
@@ -201 +204 @@
     }
 
+    public static boolean isUseMSCapi() {
+        return useMSCapi;
+    }
+
     public KeyStore getKeyStore() {
         return keyStore;
@@ -219 +226 @@
     public void destroy() {
 
-        AuthProvider ap = null;
-
-        if (this.setup.getParameter("debug").equalsIgnoreCase("true")) {
-            System.out.println("logout no provider");
-        }
-        if (keyStore != null) {
-            ap = (AuthProvider) this.keyStore.getProvider();
-        }
-
-        if (ap != null) {
-            try {
-                ap.logout();
-            } catch (LoginException e) {
-                if (this.setup.getParameter("debug").equalsIgnoreCase("true")) {
-                    e.printStackTrace();
-                }
-            }
-        }
-
-        if (providerName != null) {
-            Security.removeProvider(providerName);
-        }
-
-        this.cert = null;
+        AuthProvider ap = null;
+
+        if (this.setup.getParameter("debug").equalsIgnoreCase("true")) {
+            System.out.println("logout no provider");
+        }
+        
+        if (this.keyStore != null && this.keyStore.getProvider() instanceof AuthProvider) {
+            ap = (AuthProvider) this.keyStore.getProvider();
+        
+            try {
+                ap.logout();
+            } catch (LoginException e) {
+                if (this.setup.getParameter("debug").equalsIgnoreCase("true")) {
+                    e.printStackTrace();
+                }
+            }
+
+            if (this.providerName != null) {
+                Security.removeProvider(providerName);
+            }
+        }
+        
+        this.cert = null;
         this.selectedCertificateAlias = null;
-        this.keyStore = null;
-        this.pkcs12Input = null;
-        this.providerName = null;
-
+        this.keyStore = null;
+        this.pkcs12Input = null;
+        this.providerName = null;
     }
 
@@ -262 +267 @@
     public int init() {
 
-        // TODO: Usar dentro de um "loop" para testar outros modelos de tokens.
-        this.tokens = new TokenCollection(setup);
+        if (!DigitalCertificate.useMSCapi){
+            this.tokens = new TokenCollection(setup);
+        }
 
         Provider[] providers = Security.getProviders();
@@ -272 +278 @@
         }
 
-        int interfaceType = DigitalCertificate.KEYSTORE_DETECTED;
+        int interfaceType = DigitalCertificate.KEYSTORE_NOT_DETECTED;
 
         try {
@@ -312 +318 @@
             try {
                 // Testa se uma keystore já foi carregada previamente
-                if (keyStore.getType().equalsIgnoreCase("pkcs11")) {
+                if (keyStore.getType().equalsIgnoreCase("pkcs11") 
+                        || keyStore.getType().equalsIgnoreCase("windows-my")) {
                     keyStore.load(null, null);
                 } else {
@@ -319 +326 @@
 
                 // Se chegou aqui KeyStore está liberada, mostrar tela de login sem pedir o pin.
-                this.keystoreStatus = DigitalCertificate.KEYSTORE_ALREADY_LOADED;
+                this.keystoreStatus = DigitalCertificate.useMSCapi ? DigitalCertificate.KEYSTORE_DETECTED : DigitalCertificate.KEYSTORE_ALREADY_LOADED ;
 
             } catch (ProviderException e) {
@@ -402 +409 @@
                         while (headers.hasMoreElements()){
                             String header = (String) headers.nextElement();
-                            System.out.println("header: "+header);
                             headersString += header+"\r\n";
                         }
@@ -455 +461 @@
     public String signMail(Map<String, String> data) throws IOException, GeneralSecurityException, SMIMEException, MessagingException {
 
-        Key privateKey = null;
+        Key privateKey = null;
         if (this.keystoreStatus == DigitalCertificate.KEYSTORE_DETECTED) {
-            String pin = DialogBuilder.showPinDialog(this.parentFrame, this.setup);
-            if (pin != null) {
-                openKeyStore(pin.toCharArray());
-                if (this.selectedCertificateAlias == null){
+            char[] pin = null;
+            if (!DigitalCertificate.useMSCapi) {
+                String sPin = DialogBuilder.showPinDialog(this.parentFrame, this.setup);
+                if (sPin != null) {
+                    pin = sPin.toCharArray();
+                }
+                else {
                     return null;
                 }
-                privateKey = this.keyStore.getKey(this.selectedCertificateAlias, pin.toCharArray());
-            } else {
-                return null;
-            }
+            }
+
+            try {
+                openKeyStore(pin);
+            }
+            catch (Exception e)
+            {
+                if (e instanceof IOException){
+                    throw new IOException(e);
+                }
+                else if (e instanceof GeneralSecurityException){
+                    throw new GeneralSecurityException(e);
+                }
+            }
+            
+            if (this.selectedCertificateAlias == null){
+                return null;
+            }
+            privateKey = this.keyStore.getKey(this.selectedCertificateAlias, pin);
+            
         } /*
         else if (this.keystoreStatus == DigitalCertificate.KEYSTORE_ALREADY_LOADED){
@@ -671 +696 @@
         Key privateKey = null;
         if (this.keystoreStatus == DigitalCertificate.KEYSTORE_DETECTED) {
-            String pin = DialogBuilder.showPinDialog(this.parentFrame, this.setup);
-            if (pin != null) {
-                openKeyStore(pin.toCharArray());
-                if (this.selectedCertificateAlias == null){
-                    return null;
-                }
-                privateKey = this.keyStore.getKey(this.selectedCertificateAlias, pin.toCharArray());
-            } else {
-                return null;
-            }
+            char[] pin = null;
+            if (!DigitalCertificate.useMSCapi) {
+               String sPin = DialogBuilder.showPinDialog(this.parentFrame, this.setup);
+               if (sPin != null) {
+                   pin = sPin.toCharArray();
+               }
+               else {
+                   return null;
+               }
+            }
+
+            openKeyStore(pin);
+            if (this.selectedCertificateAlias == null){
+                return null;
+            }
+            privateKey = this.keyStore.getKey(this.selectedCertificateAlias, pin);
+            
         } /*
         else if (this.keystoreStatus == DigitalCertificate.KEYSTORE_ALREADY_LOADED){
@@ -847 +879 @@
                 if (Integer.parseInt(resposta[0].trim()) == 0) {
                     // Se código da resposta for zero, decripta a senha criptografada do usuário
-                    resposta[2] = decriptPassword(resposta[2].trim(), pin);
+                    resposta[2] = decryptPassword(resposta[2].trim(), pin);
                 }
             }
@@ -875 +907 @@
      * @throws GeneralSecurityException se algum problema ocorrer na decriptação da senha.
      */
-    public String decriptPassword(String encodedPassword, String pin) throws GeneralSecurityException {
-
-        String decodedPassword = new String();
-
-        // Pega a chave privada do primeiro certificado armazenado na KeyStore
-        Key privateKey = this.keyStore.getKey(selectedCertificateAlias, pin.toCharArray());
+    public String decryptPassword(String encodedPassword, String pin) throws GeneralSecurityException, IOException {
+
+        String decodedPassword = new String();
+
+        // Pega a chave privada do primeiro certificado armazenado na KeyStore
+        Key privateKey = pin == null ? this.keyStore.getKey(selectedCertificateAlias, null) :
+            this.keyStore.getKey(selectedCertificateAlias, pin.toCharArray());
+
+        Cipher dcipher = Cipher.getInstance("RSA/ECB/PKCS1Padding");
+        dcipher.init(Cipher.DECRYPT_MODE, privateKey);
 
         // Inicializa os cipher com os parâmetros corretos para realizar a decriptação
-        Cipher dcipher = Cipher.getInstance("RSA/ECB/PKCS1Padding");
-        dcipher.init(Cipher.DECRYPT_MODE, privateKey);
+//      Cipher dcipher = DigitalCertificate.useMSCapi ?
+//            Cipher.getInstance("RSA/ECB/PKCS1Padding", Security.getProvider(this.providerName))
+//            : Cipher.getInstance("RSA/ECB/PKCS1Padding");
+//      dcipher.init(Cipher.DECRYPT_MODE, privateKey);
 
         // Decodifica a senha em base64 e a decripta
-        decodedPassword = new String(dcipher.doFinal(Base64Utils.base64Decode(encodedPassword)));
-
+        decodedPassword = new String(dcipher.doFinal(Base64Utils.base64Decode(encodedPassword)));
+       
         return decodedPassword.trim();
 
@@ -902 +940 @@
 
         try{
-            if (this.setup.getParameter("debug").equalsIgnoreCase("true")) {
-                System.out.println("Carregando provider: PKCS11");
-            }
-            this.keyStore = KeyStore.getInstance("PKCS11");
-            this.providerName = keyStore.getProvider().getName();
+            if (!DigitalCertificate.useMSCapi) {
+                if (this.setup.getParameter("debug").equalsIgnoreCase("true")) {
+                    System.out.println("Carregando provider: PKCS11");
+                }
+                this.keyStore = KeyStore.getInstance("PKCS11");
+                this.providerName = keyStore.getProvider().getName();
+            }
+            else {
+                if (this.setup.getParameter("debug").equalsIgnoreCase("true")) {
+                    System.out.println("Carregando provider: SunMSCAPI");
+                }
+                this.keyStore = KeyStore.getInstance("Windows-MY", "SunMSCAPI");
+                this.providerName = this.keyStore.getProvider().getName();
+
+                if (this.setup.getParameter("debug").equalsIgnoreCase("true")) {
+                    System.out.println(keyStore.getProvider().getName() +" carregado!");
+                }
+            }
         }
         catch (GeneralSecurityException kex){
@@ -921 +972 @@
     }
 
+    Map<String, String> getAliasesList() throws IOException, KeyStoreException{
+
+        if (setup.getParameter("debug").equalsIgnoreCase("true")) {
+            System.out.println("Getting Aliases");
+        }
+
+        Map<String, String> aliases = new HashMap<String, String>();
+      
+        for (Enumeration<String> al = this.keyStore.aliases(); al.hasMoreElements();){
+            String alias = al.nextElement();
+            X509Certificate certObj = (X509Certificate) this.keyStore.getCertificate(alias);
+            
+            StringBuilder selector = new StringBuilder();
+            // get more info to generate the value
+            // Subject's CN / Issuer's CN / Expiration Data
+            String subject = certObj.getSubjectX500Principal().getName();
+            int pInicial = subject.indexOf('=')+1;
+            int pFinal = subject.indexOf(',', pInicial);
+            selector.append(subject.substring(pInicial, pFinal)+" | ");
+
+            String issuer = certObj.getIssuerX500Principal().getName();
+            pInicial = issuer.indexOf('=')+1;
+            pFinal = issuer.indexOf(',', pInicial);
+            selector.append(issuer.substring(pInicial, pFinal)+" | ");
+
+            // TODO: get the system locale
+            Locale locale = new Locale("pt", "BR");
+            DateFormat df = DateFormat.getDateInstance(DateFormat.MEDIUM, locale);
+            selector.append(df.format(certObj.getNotAfter())+" | ");
+
+            selector.append("("+certObj.getSerialNumber()+")");
+
+            aliases.put(alias, selector.toString());
+            
+        }
+
+        return aliases;
+    }
+
+//    public void removeCertificate() throws IOException {
+//        Token token = tokens.getRegisteredTokens().iterator().next();
+//        token.removeCertificate();
+//    }
+//
+//    public void writeCerts(char[] pin, LinkedHashMap<char[], Certificate> certs) throws IOException{
+//        Token token = tokens.getRegisteredTokens().iterator().next();
+//        token.getAliases();
+//
+//        for (Map.Entry<char[], Certificate> entry : certs.entrySet()) {
+//            token.writeCert(pin, entry.getKey(), entry.getValue());
+//        }
+//    }
+
     /**
      *  Abre a keystore passando o pin
      *  @param pin pin para acessar o Token
      */
+    @SuppressWarnings("empty-statement")
     public void openKeyStore(char[] pin) throws IOException {
         // TODO:  Verify if object DigitalCertificate was initiated
@@ -931 +1036 @@
             if (this.keyStore.getType().equals("PKCS11")) {
                 this.keyStore.load(null, pin);
-            } else {
+            } else if (this.keyStore.getType().equals("Windows-MY")) {
+                this.keyStore.load(null, null);
+            } else {
                 this.keyStore.load(this.pkcs12Input, pin);
             }
 
-            Map<String, String> aliases = new HashMap<String, String>();
-            for (Token token : tokens.getRegisteredTokens()){
-                aliases.putAll(token.getAliases());
-            }
-
             // selecionador de certificado
-            this.selectedCertificateAlias = DialogBuilder.showCertificateSelector(this.parentFrame, this.setup, aliases);
+            this.selectedCertificateAlias = DialogBuilder.showCertificateSelector(this.parentFrame,
+                    this.setup, this.getAliasesList());
             if (this.selectedCertificateAlias != null){
                 this.cert = this.keyStore.getCertificate(this.selectedCertificateAlias);