| | |
| | | import org.opends.server.core.DirectoryServer; |
| | | import org.opends.server.core.AddOperation; |
| | | import org.opends.server.core.ModifyOperation; |
| | | import static org.opends.server.loggers.debug.DebugLogger.*; |
| | | import org.opends.server.loggers.debug.DebugTracer; |
| | | import org.forgerock.i18n.slf4j.LocalizedLogger; |
| | | import static org.opends.server.util.StaticUtils.*; |
| | | import org.forgerock.util.Reject; |
| | | import org.opends.server.util.SelectableCertificateKeyManager; |
| | |
| | | public class CryptoManagerImpl |
| | | implements ConfigurationChangeListener<CryptoManagerCfg>, CryptoManager |
| | | { |
| | | /** |
| | | * The tracer object for the debug logger. |
| | | */ |
| | | private static final DebugTracer TRACER = getTracer(); |
| | | private static final LocalizedLogger logger = LocalizedLogger.getLoggerForThisClass(); |
| | | |
| | | // Various schema element references. |
| | | private static AttributeType attrKeyID; |
| | |
| | | DN.valueOf("cn=Servers")); |
| | | } |
| | | catch (DirectoryException ex) { |
| | | if (debugEnabled()) { |
| | | TRACER.debugCaught(DebugLogLevel.ERROR, ex); |
| | | } |
| | | logger.traceException(ex); |
| | | throw new InitializationException(ex.getMessageObject()); |
| | | } |
| | | |
| | |
| | | MessageDigest.getInstance(requestedDigestAlgorithm); |
| | | } |
| | | catch (Exception ex) { |
| | | if (debugEnabled()) { |
| | | TRACER.debugCaught(DebugLogLevel.ERROR, ex); |
| | | } |
| | | logger.traceException(ex); |
| | | unacceptableReasons.add( |
| | | ERR_CRYPTOMGR_CANNOT_GET_REQUESTED_DIGEST.get( |
| | | requestedDigestAlgorithm, getExceptionMessage(ex))); |
| | |
| | | requestedCipherTransformationKeyLengthBits); |
| | | } |
| | | catch (Exception ex) { |
| | | if (debugEnabled()) { |
| | | TRACER.debugCaught(DebugLogLevel.ERROR, ex); |
| | | } |
| | | logger.traceException(ex); |
| | | unacceptableReasons.add( |
| | | ERR_CRYPTOMGR_CANNOT_GET_REQUESTED_ENCRYPTION_CIPHER.get( |
| | | requestedCipherTransformation, getExceptionMessage(ex))); |
| | |
| | | requestedMACAlgorithmKeyLengthBits); |
| | | } |
| | | catch (Exception ex) { |
| | | if (debugEnabled()) { |
| | | TRACER.debugCaught(DebugLogLevel.ERROR, ex); |
| | | } |
| | | logger.traceException(ex); |
| | | unacceptableReasons.add( |
| | | ERR_CRYPTOMGR_CANNOT_GET_REQUESTED_MAC_ENGINE.get( |
| | | requestedMACAlgorithm, getExceptionMessage(ex))); |
| | |
| | | keyID, certificate, macKey); |
| | | } |
| | | catch (Exception ex) { |
| | | if (debugEnabled()) { |
| | | TRACER.debugCaught(DebugLogLevel.ERROR, ex); |
| | | } |
| | | logger.traceException(ex); |
| | | unacceptableReasons.add( |
| | | ERR_CRYPTOMGR_CANNOT_GET_PREFERRED_KEY_WRAPPING_CIPHER.get( |
| | | getExceptionMessage(ex))); |
| | |
| | | } |
| | | } |
| | | catch (DirectoryException ex) { |
| | | if (debugEnabled()) { |
| | | TRACER.debugCaught(DebugLogLevel.ERROR, ex); |
| | | } |
| | | logger.traceException(ex); |
| | | throw new CryptoManagerException( |
| | | ERR_CRYPTOMGR_FAILED_TO_RETRIEVE_INSTANCE_CERTIFICATE.get( |
| | | entryDN.toString(), getExceptionMessage(ex)), ex); |
| | |
| | | md = MessageDigest.getInstance(mdAlgorithmName); |
| | | } |
| | | catch (NoSuchAlgorithmException ex) { |
| | | if (debugEnabled()) { |
| | | TRACER.debugCaught(DebugLogLevel.ERROR, ex); |
| | | } |
| | | logger.traceException(ex); |
| | | throw new CryptoManagerException( |
| | | ERR_CRYPTOMGR_FAILED_TO_COMPUTE_INSTANCE_KEY_IDENTIFIER.get( |
| | | getExceptionMessage(ex)), ex); |
| | |
| | | } |
| | | } |
| | | } catch (DirectoryException ex) { |
| | | if (debugEnabled()) { |
| | | TRACER.debugCaught(DebugLogLevel.ERROR, ex); |
| | | } |
| | | logger.traceException(ex); |
| | | throw new CryptoManagerException( |
| | | ERR_CRYPTOMGR_FAILED_TO_PUBLISH_INSTANCE_KEY_ENTRY.get( |
| | | getExceptionMessage(ex)), ex); |
| | |
| | | } |
| | | } |
| | | catch (DirectoryException ex) { |
| | | if (debugEnabled()) { |
| | | TRACER.debugCaught(DebugLogLevel.ERROR, ex); |
| | | } |
| | | logger.traceException(ex); |
| | | throw new CryptoManagerException( |
| | | ERR_CRYPTOMGR_FAILED_TO_RETRIEVE_ADS_TRUSTSTORE_CERTS.get( |
| | | instanceKeysDN.toString(), |
| | |
| | | wrappedKeyElement = StaticUtils.bytesToHexNoSpace(wrappedKey); |
| | | } |
| | | catch (GeneralSecurityException ex) { |
| | | if (debugEnabled()) { |
| | | TRACER.debugCaught(DebugLogLevel.ERROR, ex); |
| | | } |
| | | logger.traceException(ex); |
| | | throw new CryptoManagerException( |
| | | ERR_CRYPTOMGR_FAILED_TO_ENCODE_SYMMETRIC_KEY_ATTRIBUTE.get( |
| | | getExceptionMessage(ex)), ex); |
| | |
| | | = StaticUtils.hexStringToByteArray(elements[3]); |
| | | } |
| | | catch (ParseException ex) { |
| | | if (debugEnabled()) { |
| | | TRACER.debugCaught(DebugLogLevel.ERROR, ex); |
| | | } |
| | | logger.traceException(ex); |
| | | throw new CryptoManagerException( |
| | | ERR_CRYPTOMGR_DECODE_SYMMETRIC_KEY_ATTRIBUTE_SYNTAX.get( |
| | | symmetricKeyAttribute, fieldName, |
| | |
| | | } |
| | | catch (IdentifiedException ex) { |
| | | // ConfigException, DirectoryException |
| | | if (debugEnabled()) { |
| | | TRACER.debugCaught(DebugLogLevel.ERROR, ex); |
| | | } |
| | | logger.traceException(ex); |
| | | throw new CryptoManagerException( |
| | | ERR_CRYPTOMGR_DECODE_SYMMETRIC_KEY_ATTRIBUTE_NO_PRIVATE.get( |
| | | getExceptionMessage(ex)), ex); |
| | |
| | | secretKey = (SecretKey)unwrapper.unwrap(wrappedKeyCipherTextElement, |
| | | wrappedKeyAlgorithmElement, Cipher.SECRET_KEY); |
| | | } catch(GeneralSecurityException ex) { |
| | | if (debugEnabled()) { |
| | | TRACER.debugCaught(DebugLogLevel.ERROR, ex); |
| | | } |
| | | logger.traceException(ex); |
| | | throw new CryptoManagerException( |
| | | ERR_CRYPTOMGR_DECODE_SYMMETRIC_KEY_ATTRIBUTE_DECIPHER.get( |
| | | getExceptionMessage(ex)), ex); |
| | |
| | | } |
| | | catch (DirectoryException ex) |
| | | { |
| | | if (debugEnabled()) { |
| | | TRACER.debugCaught(DebugLogLevel.ERROR, ex); |
| | | } |
| | | logger.traceException(ex); |
| | | throw new CryptoManagerException( |
| | | ERR_CRYPTOMGR_IMPORT_KEY_ENTRY_FAILED_OTHER.get( |
| | | entry.getName().toString(), ex.getMessage()), ex); |
| | |
| | | } |
| | | catch (DirectoryException ex) |
| | | { |
| | | if (debugEnabled()) { |
| | | TRACER.debugCaught(DebugLogLevel.ERROR, ex); |
| | | } |
| | | logger.traceException(ex); |
| | | throw new CryptoManagerException( |
| | | ERR_CRYPTOMGR_IMPORT_KEY_ENTRY_FAILED_OTHER.get( |
| | | entry.getName().toString(), ex.getMessage()), ex); |
| | |
| | | fValue = UUID.fromString(keyEntryID); |
| | | } |
| | | catch (IllegalArgumentException ex) { |
| | | if (debugEnabled()) { |
| | | TRACER.debugCaught(DebugLogLevel.ERROR, ex); |
| | | } |
| | | logger.traceException(ex); |
| | | throw new CryptoManagerException( |
| | | ERR_CRYPTOMGR_INVALID_KEY_IDENTIFIER_SYNTAX.get( |
| | | keyEntryID, getExceptionMessage(ex)), ex); |
| | |
| | | } |
| | | catch (GeneralSecurityException ex) { |
| | | // NoSuchAlgorithmException, NoSuchPaddingException |
| | | if (debugEnabled()) { |
| | | TRACER.debugCaught(DebugLogLevel.ERROR, ex); |
| | | } |
| | | logger.traceException(ex); |
| | | throw new CryptoManagerException( |
| | | ERR_CRYPTOMGR_GET_CIPHER_INVALID_CIPHER_TRANSFORMATION.get( |
| | | keyEntry.getType(), getExceptionMessage(ex)), ex); |
| | |
| | | } |
| | | catch (GeneralSecurityException ex) { |
| | | // InvalidKeyException, InvalidAlgorithmParameterException |
| | | if (debugEnabled()) { |
| | | TRACER.debugCaught(DebugLogLevel.ERROR, ex); |
| | | } |
| | | logger.traceException(ex); |
| | | throw new CryptoManagerException( |
| | | ERR_CRYPTOMGR_GET_CIPHER_CANNOT_INITIALIZE.get( |
| | | getExceptionMessage(ex)), ex); |
| | |
| | | mac = Mac.getInstance(keyEntry.getType()); |
| | | } |
| | | catch (NoSuchAlgorithmException ex){ |
| | | if (debugEnabled()) { |
| | | TRACER.debugCaught(DebugLogLevel.ERROR, ex); |
| | | } |
| | | logger.traceException(ex); |
| | | throw new CryptoManagerException( |
| | | ERR_CRYPTOMGR_GET_MAC_ENGINE_INVALID_MAC_ALGORITHM.get( |
| | | keyEntry.getType(), getExceptionMessage(ex)), |
| | |
| | | mac.init(keyEntry.getSecretKey()); |
| | | } |
| | | catch (InvalidKeyException ex) { |
| | | if (debugEnabled()) { |
| | | TRACER.debugCaught(DebugLogLevel.ERROR, ex); |
| | | } |
| | | logger.traceException(ex); |
| | | throw new CryptoManagerException( |
| | | ERR_CRYPTOMGR_GET_MAC_ENGINE_CANNOT_INITIALIZE.get( |
| | | getExceptionMessage(ex)), ex); |
| | |
| | | } |
| | | } |
| | | catch (IOException ex) { |
| | | if (debugEnabled()) { |
| | | TRACER.debugCaught(DebugLogLevel.ERROR, ex); |
| | | } |
| | | logger.traceException(ex); |
| | | throw new CryptoManagerException( |
| | | ERR_CRYPTOMGR_GET_CIPHER_STREAM_PROLOGUE_WRITE_ERROR.get( |
| | | getExceptionMessage(ex)), ex); |
| | |
| | | } |
| | | catch (Exception ex) { |
| | | // IndexOutOfBoundsException, ArrayStoreException, ... |
| | | if (debugEnabled()) { |
| | | TRACER.debugCaught(DebugLogLevel.ERROR, ex); |
| | | } |
| | | logger.traceException(ex); |
| | | throw new CryptoManagerException( |
| | | ERR_CRYPTOMGR_DECRYPT_FAILED_TO_READ_PROLOGUE_VERSION.get( |
| | | ex.getMessage()), ex); |
| | |
| | | } |
| | | catch (Exception ex) { |
| | | // IndexOutOfBoundsException, ArrayStoreException, ... |
| | | if (debugEnabled()) { |
| | | TRACER.debugCaught(DebugLogLevel.ERROR, ex); |
| | | } |
| | | logger.traceException(ex); |
| | | throw new CryptoManagerException( |
| | | ERR_CRYPTOMGR_DECRYPT_FAILED_TO_READ_KEY_IDENTIFIER.get( |
| | | ex.getMessage()), ex); |
| | |
| | | } |
| | | catch (Exception ex) { |
| | | // IndexOutOfBoundsException, ArrayStoreException, ... |
| | | if (debugEnabled()) { |
| | | TRACER.debugCaught(DebugLogLevel.ERROR, ex); |
| | | } |
| | | logger.traceException(ex); |
| | | throw new CryptoManagerException( |
| | | ERR_CRYPTOMGR_DECRYPT_FAILED_TO_READ_IV.get(), ex); |
| | | } |
| | |
| | | } |
| | | catch (Exception e) |
| | | { |
| | | if (debugEnabled()) |
| | | { |
| | | TRACER.debugCaught(DebugLogLevel.ERROR, e); |
| | | } |
| | | logger.traceException(e); |
| | | |
| | | LocalizableMessage message = |
| | | ERR_CRYPTOMGR_SSL_CONTEXT_CANNOT_INITIALIZE.get( |