/*
|
* The contents of this file are subject to the terms of the Common Development and
|
* Distribution License (the License). You may not use this file except in compliance with the
|
* License.
|
*
|
* You can obtain a copy of the License at legal/CDDLv1.0.txt. See the License for the
|
* specific language governing permission and limitations under the License.
|
*
|
* When distributing Covered Software, include this CDDL Header Notice in each file and include
|
* the License file at legal/CDDLv1.0.txt. If applicable, add the following below the CDDL
|
* Header, with the fields enclosed by brackets [] replaced by your own identifying
|
* information: "Portions Copyright [year] [name of copyright owner]".
|
*
|
* Copyright 2006-2010 Sun Microsystems, Inc.
|
* Portions Copyright 2014-2016 ForgeRock AS.
|
* Portions Copyright 2026 3A Systems, LLC.
|
*/
|
package org.opends.server.extensions;
|
|
import com.forgerock.opendj.util.FipsStaticUtils;
|
import org.forgerock.i18n.LocalizableMessage;
|
import java.io.File;
|
import java.io.FileInputStream;
|
import java.net.Socket;
|
import java.security.KeyStore;
|
import java.security.KeyStoreException;
|
import java.security.cert.CertificateException;
|
import java.security.cert.X509Certificate;
|
import java.util.Arrays;
|
import java.util.List;
|
import javax.net.ssl.SSLEngine;
|
import javax.net.ssl.TrustManager;
|
import javax.net.ssl.TrustManagerFactory;
|
import javax.net.ssl.X509ExtendedTrustManager;
|
import javax.net.ssl.X509TrustManager;
|
|
import org.forgerock.opendj.config.server.ConfigurationChangeListener;
|
import org.forgerock.opendj.server.config.server.TrustManagerProviderCfg;
|
import org.forgerock.opendj.server.config.server.FileBasedTrustManagerProviderCfg;
|
import org.opends.server.api.TrustManagerProvider;
|
import org.forgerock.opendj.config.server.ConfigException;
|
import org.opends.server.core.DirectoryServer;
|
import org.forgerock.opendj.config.server.ConfigChangeResult;
|
import org.opends.server.types.DirectoryException;
|
import org.opends.server.types.InitializationException;
|
import org.forgerock.opendj.ldap.ResultCode;
|
import org.opends.server.util.ExpirationCheckTrustManager;
|
|
import org.forgerock.i18n.slf4j.LocalizedLogger;
|
import static org.opends.messages.ExtensionMessages.*;
|
import static org.opends.server.extensions.FileBasedKeyManagerProvider.getKeyStorePIN;
|
import static org.opends.server.util.StaticUtils.*;
|
|
import static com.forgerock.opendj.util.StaticUtils.isFips;
|
|
/**
|
* This class defines a trust manager provider that will reference certificates
|
* stored in a file located on the Directory Server filesystem.
|
*/
|
public class FileBasedTrustManagerProvider
|
extends TrustManagerProvider<FileBasedTrustManagerProviderCfg>
|
implements ConfigurationChangeListener<FileBasedTrustManagerProviderCfg>
|
{
|
private static final LocalizedLogger logger = LocalizedLogger.getLoggerForThisClass();
|
|
/** The handle to the configuration for this trust manager. */
|
private FileBasedTrustManagerProviderCfg currentConfig;
|
|
/** The path to the trust store backing file. */
|
private String trustStoreFile;
|
|
/** The trust store type to use. */
|
private String trustStoreType;
|
|
/**
|
* The number of configuration changes applied. It is counted after the fields above are set,
|
* and read before them.
|
*/
|
private volatile int configurationChanges;
|
|
/**
|
* A trust manager loaded from the trust store file, with the configuration change and the
|
* stamps of the files it was loaded under.
|
*/
|
private static final class LoadedTrustManager
|
{
|
private final int configurationChanges;
|
private final List<FileStamp> stamps;
|
private final X509TrustManager trustManager;
|
|
private LoadedTrustManager(int configurationChanges, List<FileStamp> stamps, X509TrustManager trustManager)
|
{
|
this.configurationChanges = configurationChanges;
|
this.stamps = stamps;
|
this.trustManager = trustManager;
|
}
|
|
private boolean isLoadedFrom(int configurationChanges, List<FileStamp> stamps)
|
{
|
return this.configurationChanges == configurationChanges && this.stamps.equals(stamps);
|
}
|
}
|
|
/**
|
* What a trust manager handed out by {@link #getTrustManagers()} delegates to. Each trust
|
* manager handed out loads the file on its own, so asking the provider again, as a component
|
* does to check a configuration change, leaves those in use alone.
|
*/
|
private final class TrustStoreFollower
|
{
|
/**
|
* Whether the server ran in FIPS mode when the trust manager was handed out. The trust store
|
* is loaded again as it was loaded then, so that what is loaded stays of the kind handed
|
* out, even where the server has turned to FIPS mode since, or away from it.
|
*/
|
private final boolean fipsMode;
|
/** Whether the trust manager handed out is an extended one, which needs an extended one to delegate to. */
|
private final boolean extended;
|
/** The trust manager last loaded, when this one was handed out or by a check since. */
|
private volatile LoadedTrustManager loaded;
|
|
private TrustStoreFollower(boolean fipsMode, LoadedTrustManager loaded)
|
{
|
this.fipsMode = fipsMode;
|
this.extended = loaded.trustManager instanceof X509ExtendedTrustManager;
|
this.loaded = loaded;
|
}
|
|
/**
|
* Returns the trust manager to check a certificate with, first loading the trust store file
|
* again when it has changed since it was last loaded, or the configuration has. A file that
|
* cannot be loaded leaves the trust manager last loaded in use, and is not tried again until
|
* it changes again.
|
*/
|
private X509TrustManager currentTrustManager()
|
{
|
LoadedTrustManager current = loaded;
|
if (current.isLoadedFrom(configurationChanges, stampFiles()))
|
{
|
return current.trustManager;
|
}
|
// the provider's lock, which applyConfigurationChange takes too: a load reads the
|
// configuration as it was before a change or after it, never a mix of both
|
synchronized (FileBasedTrustManagerProvider.this)
|
{
|
// stamped again under the lock: stamps taken before it may be those of a write another
|
// thread has loaded past meanwhile
|
final int changes = configurationChanges;
|
final List<FileStamp> stamps = stampFiles();
|
current = loaded;
|
if (current.isLoadedFrom(changes, stamps))
|
{
|
return current.trustManager;
|
}
|
try
|
{
|
final TrustManager[] trustManagers = loadTrustManagers(currentPIN(), fipsMode);
|
if (trustManagers.length != 1 || !(trustManagers[0] instanceof X509TrustManager)
|
|| extended != trustManagers[0] instanceof X509ExtendedTrustManager)
|
{
|
throw new DirectoryException(DirectoryServer.getCoreConfigManager().getServerErrorResultCode(),
|
ERR_FILE_TRUSTMANAGER_CANNOT_CREATE_FACTORY.get(trustStoreFile, Arrays.toString(trustManagers)));
|
}
|
loaded = new LoadedTrustManager(changes, stamps, (X509TrustManager) trustManagers[0]);
|
logger.info(NOTE_FILE_TRUSTMANAGER_RELOADED, trustStoreFile, currentConfig.dn());
|
}
|
catch (DirectoryException e)
|
{
|
logger.traceException(e);
|
loaded = new LoadedTrustManager(changes, stamps, current.trustManager);
|
logger.error(ERR_FILE_TRUSTMANAGER_CANNOT_RELOAD, trustStoreFile, currentConfig.dn(), e.getMessageObject());
|
}
|
return loaded.trustManager;
|
}
|
}
|
}
|
|
/** The trust manager handed out by {@link #getTrustManagers()} over a plain trust manager. */
|
private static final class ReloadingTrustManager implements X509TrustManager
|
{
|
private final TrustStoreFollower follower;
|
|
private ReloadingTrustManager(TrustStoreFollower follower)
|
{
|
this.follower = follower;
|
}
|
|
@Override
|
public void checkClientTrusted(X509Certificate[] chain, String authType) throws CertificateException
|
{
|
follower.currentTrustManager().checkClientTrusted(chain, authType);
|
}
|
|
@Override
|
public void checkServerTrusted(X509Certificate[] chain, String authType) throws CertificateException
|
{
|
follower.currentTrustManager().checkServerTrusted(chain, authType);
|
}
|
|
@Override
|
public X509Certificate[] getAcceptedIssuers()
|
{
|
return follower.currentTrustManager().getAcceptedIssuers();
|
}
|
}
|
|
/** The trust manager handed out by {@link #getTrustManagers()} over an extended trust manager. */
|
private static final class ReloadingExtendedTrustManager extends X509ExtendedTrustManager
|
{
|
private final TrustStoreFollower follower;
|
|
private ReloadingExtendedTrustManager(TrustStoreFollower follower)
|
{
|
this.follower = follower;
|
}
|
|
private X509ExtendedTrustManager current()
|
{
|
return (X509ExtendedTrustManager) follower.currentTrustManager();
|
}
|
|
@Override
|
public void checkClientTrusted(X509Certificate[] chain, String authType) throws CertificateException
|
{
|
current().checkClientTrusted(chain, authType);
|
}
|
|
@Override
|
public void checkClientTrusted(X509Certificate[] chain, String authType, Socket socket)
|
throws CertificateException
|
{
|
current().checkClientTrusted(chain, authType, socket);
|
}
|
|
@Override
|
public void checkClientTrusted(X509Certificate[] chain, String authType, SSLEngine engine)
|
throws CertificateException
|
{
|
current().checkClientTrusted(chain, authType, engine);
|
}
|
|
@Override
|
public void checkServerTrusted(X509Certificate[] chain, String authType) throws CertificateException
|
{
|
current().checkServerTrusted(chain, authType);
|
}
|
|
@Override
|
public void checkServerTrusted(X509Certificate[] chain, String authType, Socket socket)
|
throws CertificateException
|
{
|
current().checkServerTrusted(chain, authType, socket);
|
}
|
|
@Override
|
public void checkServerTrusted(X509Certificate[] chain, String authType, SSLEngine engine)
|
throws CertificateException
|
{
|
current().checkServerTrusted(chain, authType, engine);
|
}
|
|
@Override
|
public X509Certificate[] getAcceptedIssuers()
|
{
|
return current().getAcceptedIssuers();
|
}
|
}
|
|
/**
|
* Creates a new instance of this file-based trust manager provider. The
|
* <CODE>initializeTrustManagerProvider</CODE> method must be called on the
|
* resulting object before it may be used.
|
*/
|
public FileBasedTrustManagerProvider()
|
{
|
// No implementation is required.
|
}
|
|
@Override
|
public void initializeTrustManagerProvider(FileBasedTrustManagerProviderCfg cfg)
|
throws ConfigException, InitializationException
|
{
|
final ConfigChangeResult ccr = new ConfigChangeResult();
|
|
currentConfig = cfg;
|
trustStoreFile = getTrustStoreFile(cfg, ccr);
|
trustStoreType = getTrustStoreType(cfg, ccr);
|
getTrustStorePIN(cfg, ccr);
|
if (!ccr.getMessages().isEmpty())
|
{
|
throw new InitializationException(ccr.getMessages().get(0));
|
}
|
|
cfg.addFileBasedChangeListener(this);
|
}
|
|
@Override
|
public void finalizeTrustManagerProvider()
|
{
|
currentConfig.removeFileBasedChangeListener(this);
|
}
|
|
/**
|
* {@inheritDoc}
|
* <p>
|
* The trust manager returned reads the trust store file again when a certificate is checked
|
* after the file, or the PIN file, has changed, so that a renewed trust store is used without
|
* restarting the server or the component using it.
|
*/
|
@Override
|
public TrustManager[] getTrustManagers() throws DirectoryException
|
{
|
final int changes = configurationChanges;
|
final List<FileStamp> stamps = stampFiles();
|
final boolean fipsMode = isFipsMode();
|
final TrustManager[] trustManagers = loadTrustManagers(currentPIN(), fipsMode);
|
if (trustManagers.length != 1 || !(trustManagers[0] instanceof X509TrustManager))
|
{
|
return trustManagers;
|
}
|
final TrustStoreFollower follower = new TrustStoreFollower(
|
fipsMode, new LoadedTrustManager(changes, stamps, (X509TrustManager) trustManagers[0]));
|
// an extended trust manager stays one, and a plain one stays plain, for JSSE adds checks
|
// of its own around a plain one
|
return new TrustManager[] { follower.extended
|
? new ReloadingExtendedTrustManager(follower) : new ReloadingTrustManager(follower) };
|
}
|
|
/**
|
* Returns the PIN the configuration names now, rather than the one it named when the provider
|
* was configured: a PIN file may have been renewed since, together with the trust store.
|
*/
|
private char[] currentPIN() throws DirectoryException
|
{
|
final ConfigChangeResult ccr = new ConfigChangeResult();
|
final char[] pin = getTrustStorePIN(currentConfig, ccr);
|
if (ccr.getResultCode() != ResultCode.SUCCESS)
|
{
|
throw new DirectoryException(ccr.getResultCode(), ccr.getMessages().get(0));
|
}
|
return pin;
|
}
|
|
private List<FileStamp> stampFiles()
|
{
|
final String pinFile = currentConfig.getTrustStorePinFile();
|
return FileStamp.of(getFileForPath(trustStoreFile), pinFile != null ? getFileForPath(pinFile) : null);
|
}
|
|
/**
|
* Loads the trust managers of the trust store file: in FIPS mode as they are, and otherwise each
|
* within an expiration check.
|
*/
|
private TrustManager[] loadTrustManagers(char[] trustStorePIN, boolean fipsMode) throws DirectoryException
|
{
|
KeyStore trustStore;
|
try (FileInputStream inputStream = new FileInputStream(getFileForPath(trustStoreFile)))
|
{
|
trustStore = KeyStore.getInstance(trustStoreType);
|
trustStore.load(inputStream, trustStorePIN);
|
}
|
catch (Exception e)
|
{
|
logger.traceException(e);
|
LocalizableMessage message = ERR_FILE_TRUSTMANAGER_CANNOT_LOAD.get(trustStoreFile, getExceptionMessage(e));
|
throw new DirectoryException(DirectoryServer.getCoreConfigManager().getServerErrorResultCode(), message, e);
|
}
|
|
try
|
{
|
String trustManagerAlgorithm = TrustManagerFactory.getDefaultAlgorithm();
|
TrustManagerFactory trustManagerFactory = TrustManagerFactory.getInstance(trustManagerAlgorithm);
|
trustManagerFactory.init(trustStore);
|
TrustManager[] trustManagers = trustManagerFactory.getTrustManagers();
|
TrustManager[] newTrustManagers = new TrustManager[trustManagers.length];
|
if (fipsMode) {
|
newTrustManagers = trustManagers;
|
} else {
|
for (int i=0; i < trustManagers.length; i++)
|
{
|
newTrustManagers[i] = new ExpirationCheckTrustManager((X509TrustManager) trustManagers[i]);
|
}
|
}
|
return newTrustManagers;
|
}
|
catch (Exception e)
|
{
|
logger.traceException(e);
|
|
LocalizableMessage message =
|
ERR_FILE_TRUSTMANAGER_CANNOT_CREATE_FACTORY.get(trustStoreFile, getExceptionMessage(e));
|
throw new DirectoryException(DirectoryServer.getCoreConfigManager().getServerErrorResultCode(), message, e);
|
}
|
}
|
|
/**
|
* Tells whether the server runs in FIPS mode, where the trust managers loaded are handed out as
|
* they are, without an expiration check around them.
|
*
|
* @return {@code true} if the server runs in FIPS mode
|
*/
|
boolean isFipsMode()
|
{
|
return isFips();
|
}
|
|
@Override
|
public boolean isConfigurationAcceptable(TrustManagerProviderCfg cfg, List<LocalizableMessage> unacceptableReasons)
|
{
|
FileBasedTrustManagerProviderCfg config = (FileBasedTrustManagerProviderCfg) cfg;
|
return isConfigurationChangeAcceptable(config, unacceptableReasons);
|
}
|
|
@Override
|
public boolean isConfigurationChangeAcceptable(FileBasedTrustManagerProviderCfg cfg,
|
List<LocalizableMessage> unacceptableReasons)
|
{
|
int startSize = unacceptableReasons.size();
|
|
final ConfigChangeResult ccr = new ConfigChangeResult();
|
getTrustStoreFile(cfg, ccr);
|
getTrustStoreType(cfg, ccr);
|
getTrustStorePIN(cfg, ccr);
|
unacceptableReasons.addAll(ccr.getMessages());
|
|
return startSize == unacceptableReasons.size();
|
}
|
|
@Override
|
public ConfigChangeResult applyConfigurationChange(FileBasedTrustManagerProviderCfg cfg)
|
{
|
final ConfigChangeResult ccr = new ConfigChangeResult();
|
String newTrustStoreFile = getTrustStoreFile(cfg, ccr);
|
String newTrustStoreType = getTrustStoreType(cfg, ccr);
|
getTrustStorePIN(cfg, ccr);
|
|
if (ccr.getResultCode() == ResultCode.SUCCESS)
|
{
|
synchronized (this)
|
{
|
currentConfig = cfg;
|
trustStoreFile = newTrustStoreFile;
|
trustStoreType = newTrustStoreType;
|
// the trust managers already handed out load the trust store the new configuration
|
// names on their next check, even where its files are those they were loaded from
|
configurationChanges++;
|
}
|
}
|
|
return ccr;
|
}
|
|
/** Get the path to the key store file. */
|
private String getTrustStoreFile(FileBasedTrustManagerProviderCfg cfg, ConfigChangeResult ccr)
|
{
|
final String keyStoreFile = cfg.getTrustStoreFile();
|
final File f = getFileForPath(keyStoreFile);
|
if (!f.exists() || !f.isFile())
|
{
|
ccr.setResultCode(DirectoryServer.getCoreConfigManager().getServerErrorResultCode());
|
ccr.addMessage(ERR_FILE_TRUSTMANAGER_NO_SUCH_FILE.get(keyStoreFile, cfg.dn()));
|
}
|
return keyStoreFile;
|
}
|
|
/** Get the keystore type. If none is specified, then use the default type. */
|
private String getTrustStoreType(FileBasedTrustManagerProviderCfg cfg, ConfigChangeResult ccr)
|
{
|
final String trustStoreType = cfg.getTrustStoreType();
|
if (trustStoreType != null)
|
{
|
if(trustStoreType.equals("BCFKS")) {
|
FipsStaticUtils.registerBcProvider(true);
|
}
|
try
|
{
|
KeyStore.getInstance(trustStoreType);
|
return trustStoreType;
|
}
|
catch (KeyStoreException e)
|
{
|
logger.traceException(e);
|
ccr.setResultCode(DirectoryServer.getCoreConfigManager().getServerErrorResultCode());
|
ccr.addMessage(ERR_FILE_TRUSTMANAGER_INVALID_TYPE.get(trustStoreType, cfg.dn(), getExceptionMessage(e)));
|
}
|
}
|
return KeyStore.getDefaultType();
|
}
|
|
private char[] getTrustStorePIN(FileBasedTrustManagerProviderCfg cfg, ConfigChangeResult ccr)
|
{
|
try
|
{
|
return getKeyStorePIN(cfg.getTrustStorePinProperty(),
|
cfg.getTrustStorePinEnvironmentVariable(),
|
cfg.getTrustStorePinFile(),
|
cfg.getTrustStorePin(),
|
cfg.dn(),
|
ERR_FILE_TRUSTMANAGER_PIN_PROPERTY_NOT_SET,
|
ERR_FILE_TRUSTMANAGER_PIN_ENVAR_NOT_SET,
|
ERR_FILE_TRUSTMANAGER_PIN_NO_SUCH_FILE,
|
ERR_FILE_TRUSTMANAGER_PIN_FILE_CANNOT_READ,
|
ERR_FILE_TRUSTMANAGER_PIN_FILE_EMPTY);
|
}
|
catch (InitializationException e)
|
{
|
ccr.setResultCode(DirectoryServer.getCoreConfigManager().getServerErrorResultCode());
|
ccr.addMessage(e.getMessageObject());
|
return null;
|
}
|
}
|
}
|
