[Pki-devel] [PATCH] 630 Fixed PKCS12Export output.

Endi Sukma Dewata edewata at redhat.com
Tue Jul 14 02:42:33 UTC 2015


The PKCS12Export has been modified such that if an error occurs
in normal mode it will display the error message and in debug
mode it will display the full stack trace.

The code has also been refactored such that it can be reused as a
library in addition to command-line tool. The code will now throw
exceptions instead of exiting to the system.

https://fedorahosted.org/pki/ticket/1224

-- 
Endi S. Dewata
-------------- next part --------------
From 855851917b146242473dbadfe2bc1e0526e0511c Mon Sep 17 00:00:00 2001
From: "Endi S. Dewata" <edewata at redhat.com>
Date: Mon, 13 Jul 2015 19:09:57 -0400
Subject: [PATCH] Fixed PKCS12Export output.

The PKCS12Export has been modified such that if an error occurs
in normal mode it will display the error message and in debug
mode it will display the full stack trace.

The code has also been refactored such that it can be reused as a
library in addition to command-line tool. The code will now throw
exceptions instead of exiting to the system.

https://fedorahosted.org/pki/ticket/1224
---
 .../src/com/netscape/cmstools/PKCS12Export.java    | 504 ++++++++++++---------
 .../cms/servlet/csadmin/ConfigurationUtils.java    |   4 +-
 2 files changed, 283 insertions(+), 225 deletions(-)

diff --git a/base/java-tools/src/com/netscape/cmstools/PKCS12Export.java b/base/java-tools/src/com/netscape/cmstools/PKCS12Export.java
index 9ab2f85052435b77685c42819d35942d1a8d376e..77e6b7cb842d1669a44c5652ee5b8f724306e107 100644
--- a/base/java-tools/src/com/netscape/cmstools/PKCS12Export.java
+++ b/base/java-tools/src/com/netscape/cmstools/PKCS12Export.java
@@ -21,7 +21,6 @@ import java.io.BufferedReader;
 import java.io.ByteArrayOutputStream;
 import java.io.FileOutputStream;
 import java.io.FileReader;
-import java.io.IOException;
 import java.security.MessageDigest;
 
 import org.mozilla.jss.CryptoManager;
@@ -62,262 +61,319 @@ import org.mozilla.jss.util.Password;
  */
 public class PKCS12Export {
 
-    private static boolean debugMode = false;
+    boolean debug;
 
-    private static void debug(String s) {
-        if (debugMode)
-            System.out.println("PKCS12Export debug: " + s);
+    String databaseDirectory;
+    String databasePasswordFilename;
+
+    String pkcs12PasswordFilename;
+    String pkcs12OutputFilename;
+
+    public boolean isDebug() {
+        return debug;
+    }
+
+    public void setDebug(boolean debug) {
+        this.debug = debug;
+    }
+
+    public String getDatabaseDirectory() {
+        return databaseDirectory;
+    }
+
+    public void setDatabaseDirectory(String databaseDirectory) {
+        this.databaseDirectory = databaseDirectory;
+    }
+    public String getDatabasePasswordFilename() {
+        return databasePasswordFilename;
+    }
+
+    public void setDatabasePasswordFilename(String databasePasswordFilename) {
+        this.databasePasswordFilename = databasePasswordFilename;
+    }
+
+    public String getPkcs12PasswordFilename() {
+        return pkcs12PasswordFilename;
+    }
+
+    public void setPkcs12PasswordFilename(String pkcs12PasswordFilename) {
+        this.pkcs12PasswordFilename = pkcs12PasswordFilename;
+    }
+
+    public String getPkcs12OutputFilename() {
+        return pkcs12OutputFilename;
+    }
+
+    public void setPkcs12OutputFilename(String pkcs12OutputFilename) {
+        this.pkcs12OutputFilename = pkcs12OutputFilename;
+    }
+
+    void debug(String s) {
+        if (debug)
+            System.out.println("PKCS12Export: " + s);
+    }
+
+    byte[] getEncodedKey(org.mozilla.jss.crypto.PrivateKey pkey) throws Exception {
+
+        CryptoManager cm = CryptoManager.getInstance();
+        CryptoToken token = cm.getInternalKeyStorageToken();
+
+        KeyGenerator kg = token.getKeyGenerator(KeyGenAlgorithm.DES3);
+        SymmetricKey sk = kg.generate();
+
+        KeyWrapper wrapper = token.getKeyWrapper(KeyWrapAlgorithm.DES3_CBC_PAD);
+        byte iv[] = { 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1 };
+        IVParameterSpec param = new IVParameterSpec(iv);
+        wrapper.initWrap(sk, param);
+        byte[] enckey = wrapper.wrap(pkey);
+
+        Cipher c = token.getCipherContext(EncryptionAlgorithm.DES3_CBC_PAD);
+        c.initDecrypt(sk, param);
+        return c.doFinal(enckey);
+    }
+
+    void addKeyBag(org.mozilla.jss.crypto.PrivateKey pkey, X509Certificate x509cert,
+            Password pass, byte[] localKeyId, SEQUENCE safeContents) throws Exception {
+
+        PasswordConverter passConverter = new PasswordConverter();
+        byte salt[] = { 0x01, 0x01, 0x01, 0x01 };
+        byte[] priData = getEncodedKey(pkey);
+
+        PrivateKeyInfo pki = (PrivateKeyInfo)
+                ASN1Util.decode(PrivateKeyInfo.getTemplate(), priData);
+
+        ASN1Value key = EncryptedPrivateKeyInfo.createPBE(
+                PBEAlgorithm.PBE_SHA1_DES3_CBC,
+                pass, salt, 1, passConverter, pki);
+
+        SET keyAttrs = createBagAttrs(
+                x509cert.getSubjectDN().toString(), localKeyId);
+
+        SafeBag keyBag = new SafeBag(SafeBag.PKCS8_SHROUDED_KEY_BAG,
+                key, keyAttrs);
+
+        safeContents.addElement(keyBag);
+    }
+
+    byte[] addCertBag(X509Certificate x509cert, String nickname,
+            SEQUENCE safeContents) throws Exception {
+
+        ASN1Value cert = new OCTET_STRING(x509cert.getEncoded());
+        byte[] localKeyId = createLocalKeyId(x509cert);
+
+        SET certAttrs = null;
+        if (nickname != null)
+            certAttrs = createBagAttrs(nickname, localKeyId);
+
+        SafeBag certBag = new SafeBag(SafeBag.CERT_BAG,
+                new CertBag(CertBag.X509_CERT_TYPE, cert), certAttrs);
+
+        safeContents.addElement(certBag);
+
+        return localKeyId;
+    }
+
+    byte[] createLocalKeyId(X509Certificate cert) throws Exception {
+
+        // SHA1 hash of the X509Cert der encoding
+        byte certDer[] = cert.getEncoded();
+
+        MessageDigest md = MessageDigest.getInstance("SHA");
+
+        md.update(certDer);
+        return md.digest();
+    }
+
+    SET createBagAttrs(String nickName, byte localKeyId[])
+            throws Exception {
+
+        SET attrs = new SET();
+        SEQUENCE nickNameAttr = new SEQUENCE();
+
+        nickNameAttr.addElement(SafeBag.FRIENDLY_NAME);
+        SET nickNameSet = new SET();
+
+        nickNameSet.addElement(new BMPString(nickName));
+        nickNameAttr.addElement(nickNameSet);
+        attrs.addElement(nickNameAttr);
+        SEQUENCE localKeyAttr = new SEQUENCE();
+
+        localKeyAttr.addElement(SafeBag.LOCAL_KEY_ID);
+        SET localKeySet = new SET();
+
+        localKeySet.addElement(new OCTET_STRING(localKeyId));
+        localKeyAttr.addElement(localKeySet);
+        attrs.addElement(localKeyAttr);
+
+        return attrs;
+    }
+
+    public byte[] generatePKCS12Data(Password password) throws Exception {
+
+        debug("Generating PKCS #12 data");
+
+        CryptoManager cm = CryptoManager.getInstance();
+        CryptoToken token = cm.getInternalKeyStorageToken();
+        CryptoStore store = token.getCryptoStore();
+
+        X509Certificate[] certs = store.getCertificates();
+
+        SEQUENCE encSafeContents = new SEQUENCE();
+        SEQUENCE safeContents = new SEQUENCE();
+
+        for (int i = 0; i < certs.length; i++) {
+            String nickname = certs[i].getNickname();
+            debug(" * Certificate: " + nickname);
+            org.mozilla.jss.crypto.PrivateKey prikey = cm.findPrivKeyByCert(certs[i]);
+
+            if (prikey == null) {
+                debug("   Private key does not exist");
+                addCertBag(certs[i], null, safeContents);
+
+            } else {
+                debug("   Private key exists");
+                byte localKeyId[] =
+                        addCertBag(certs[i], nickname, safeContents);
+                addKeyBag(prikey, certs[i], password, localKeyId, encSafeContents);
+            }
+        }
+
+        AuthenticatedSafes authSafes = new AuthenticatedSafes();
+        authSafes.addSafeContents(safeContents);
+        authSafes.addSafeContents(encSafeContents);
+
+        PFX pfx = new PFX(authSafes);
+        pfx.computeMacData(password, null, 5);
+
+        ByteArrayOutputStream bos = new ByteArrayOutputStream();
+        pfx.encode(bos);
+
+        return bos.toByteArray();
+    }
+
+    public void initDatabase() throws Exception {
+
+        debug("Initializing database in " + databaseDirectory);
+
+        CryptoManager.InitializationValues vals =
+                new CryptoManager.InitializationValues(
+                        databaseDirectory, "", "", "secmod.db");
+        CryptoManager.initialize(vals);
+
+        CryptoManager cm = CryptoManager.getInstance();
+        CryptoToken token = cm.getInternalKeyStorageToken();
+
+        debug("Reading database password from " + databasePasswordFilename);
+
+        String line;
+        try (BufferedReader in = new BufferedReader(new FileReader(databasePasswordFilename))) {
+            line = in.readLine();
+            if (line == null) {
+                line = "";
+            }
+        }
+        Password password = new Password(line.toCharArray());
+
+        debug("Logging into security token");
+
+        try {
+            token.login(password);
+        } finally {
+            password.clear();
+        }
+    }
+
+    public void exportData() throws Exception {
+
+        debug("Reading PKCS #12 password from " + pkcs12PasswordFilename);
+
+        String line;
+        try (BufferedReader in = new BufferedReader(new FileReader(pkcs12PasswordFilename))) {
+            line = in.readLine();
+            if (line == null) {
+                line = "";
+            }
+        }
+        Password password = new Password(line.toCharArray());
+
+        byte[] data;
+        try {
+            data = generatePKCS12Data(password);
+        } finally {
+            password.clear();
+        }
+
+        debug("Storing PKCS #12 data into " + pkcs12OutputFilename);
+
+        try (FileOutputStream fos = new FileOutputStream(pkcs12OutputFilename)) {
+            fos.write(data);
+        }
     }
 
-    private static void printUsage() {
+    public static void printUsage() {
         System.out.println(
                 "Usage: PKCS12Export -d <cert/key db directory> -p <file containing password for keydb> -w <file containing pkcs12 password> -o <output file for pkcs12>");
-        System.out.println("");
+        System.out.println();
         System.out.println("If you want to turn on debug, do the following:");
         System.out.println(
                 "Usage: PKCS12Export -debug -d <cert/key db directory> -p <file containing password for keydb> -w <file containing pkcs12 password> -o <output file for pkcs12>");
     }
 
-    private static byte[] getEncodedKey(org.mozilla.jss.crypto.PrivateKey pkey) {
-        try {
-            CryptoManager cm = CryptoManager.getInstance();
-            CryptoToken token = cm.getInternalKeyStorageToken();
-            KeyGenerator kg = token.getKeyGenerator(KeyGenAlgorithm.DES3);
-            SymmetricKey sk = kg.generate();
-            KeyWrapper wrapper = token.getKeyWrapper(KeyWrapAlgorithm.DES3_CBC_PAD);
-            byte iv[] = { 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1 };
-            IVParameterSpec param = new IVParameterSpec(iv);
-            wrapper.initWrap(sk, param);
-            byte[] enckey = wrapper.wrap(pkey);
-            Cipher c = token.getCipherContext(EncryptionAlgorithm.DES3_CBC_PAD);
-            c.initDecrypt(sk, param);
-            byte[] recovered = c.doFinal(enckey);
-            return recovered;
-        } catch (Exception e) {
-            debug("PKCS12Export  getEncodedKey: Exception=" + e.toString());
-            System.exit(1);
-        }
+    public static void main(String args[]) throws Exception {
 
-        return null;
-    }
-
-    private static void addKeyBag(org.mozilla.jss.crypto.PrivateKey pkey, X509Certificate x509cert,
-            Password pass, byte[] localKeyId, SEQUENCE safeContents) {
-        try {
-            PasswordConverter passConverter = new PasswordConverter();
-            byte salt[] = { 0x01, 0x01, 0x01, 0x01 };
-            byte[] priData = getEncodedKey(pkey);
-
-            PrivateKeyInfo pki = (PrivateKeyInfo)
-                    ASN1Util.decode(PrivateKeyInfo.getTemplate(), priData);
-            ASN1Value key = EncryptedPrivateKeyInfo.createPBE(
-                    PBEAlgorithm.PBE_SHA1_DES3_CBC,
-                    pass, salt, 1, passConverter, pki);
-            SET keyAttrs = createBagAttrs(
-                    x509cert.getSubjectDN().toString(), localKeyId);
-            SafeBag keyBag = new SafeBag(SafeBag.PKCS8_SHROUDED_KEY_BAG,
-                    key, keyAttrs);
-            safeContents.addElement(keyBag);
-        } catch (Exception e) {
-            debug("PKCS12Export addKeyBag: Exception=" + e.toString());
-            System.exit(1);
-        }
-    }
-
-    private static byte[] addCertBag(X509Certificate x509cert, String nickname,
-            SEQUENCE safeContents) throws IOException {
-        byte[] localKeyId = null;
-        try {
-            ASN1Value cert = new OCTET_STRING(x509cert.getEncoded());
-            localKeyId = createLocalKeyId(x509cert);
-            SET certAttrs = null;
-            if (nickname != null)
-                certAttrs = createBagAttrs(nickname, localKeyId);
-            SafeBag certBag = new SafeBag(SafeBag.CERT_BAG,
-                    new CertBag(CertBag.X509_CERT_TYPE, cert), certAttrs);
-            safeContents.addElement(certBag);
-        } catch (Exception e) {
-            debug("PKCS12Export addCertBag: " + e.toString());
-            System.exit(1);
-        }
-
-        return localKeyId;
-    }
-
-    private static byte[] createLocalKeyId(X509Certificate cert) {
-        try {
-            // SHA1 hash of the X509Cert der encoding
-            byte certDer[] = cert.getEncoded();
-
-            MessageDigest md = MessageDigest.getInstance("SHA");
-
-            md.update(certDer);
-            return md.digest();
-        } catch (Exception e) {
-            debug("PKCS12Export createLocalKeyId: Exception: " + e.toString());
-            System.exit(1);
-        }
-
-        return null;
-    }
-
-    private static SET createBagAttrs(String nickName, byte localKeyId[])
-            throws IOException {
-        try {
-            SET attrs = new SET();
-            SEQUENCE nickNameAttr = new SEQUENCE();
-
-            nickNameAttr.addElement(SafeBag.FRIENDLY_NAME);
-            SET nickNameSet = new SET();
-
-            nickNameSet.addElement(new BMPString(nickName));
-            nickNameAttr.addElement(nickNameSet);
-            attrs.addElement(nickNameAttr);
-            SEQUENCE localKeyAttr = new SEQUENCE();
-
-            localKeyAttr.addElement(SafeBag.LOCAL_KEY_ID);
-            SET localKeySet = new SET();
-
-            localKeySet.addElement(new OCTET_STRING(localKeyId));
-            localKeyAttr.addElement(localKeySet);
-            attrs.addElement(localKeyAttr);
-            return attrs;
-        } catch (Exception e) {
-            debug("PKCS12Export createBagAttrs: Exception=" + e.toString());
-            System.exit(1);
-        }
-
-        return null;
-    }
-
-    public static void main(String args[]) {
         if (args.length < 8) {
             printUsage();
             System.exit(1);
         }
 
-        String pwdfile = null;
-        String dir = null;
-        String pk12pwdfile = null;
-        String pk12output = null;
+        boolean debug = false;
+        String databaseDirectory = null;
+        String databasePasswordFilename = null;
+        String pkcs12PasswordFilename = null;
+        String pkcs12OutputFilename = null;
+
+        // TODO: get parameters using getopt
+
         for (int i = 0; i < args.length; i++) {
             if (args[i].equals("-d")) {
-                dir = args[i + 1];
+                databaseDirectory = args[i + 1];
+
             } else if (args[i].equals("-p")) {
-                pwdfile = args[i + 1];
+                databasePasswordFilename = args[i + 1];
+
             } else if (args[i].equals("-s")) {
                 // snickname = args[i + 1];
+
             } else if (args[i].equals("-w")) {
-                pk12pwdfile = args[i + 1];
+                pkcs12PasswordFilename = args[i + 1];
+
             } else if (args[i].equals("-o")) {
-                pk12output = args[i + 1];
+                pkcs12OutputFilename = args[i + 1];
+
             } else if (args[i].equals("-debug")) {
-                debugMode = true;
+                debug = true;
             }
         }
 
-        debug("The directory for certdb/keydb is " + dir);
-        debug("The password file for keydb is " + pwdfile);
+        // TODO: validate parameters
 
-        // get password
-        String pwd = null;
-        BufferedReader in = null;
         try {
-            in = new BufferedReader(new FileReader(pwdfile));
-            pwd = in.readLine();
-            if (pwd == null) {
-                pwd = "";
-            }
-        } catch (Exception e) {
-            debug("Failed to read the keydb password from the file. Exception: " + e.toString());
-            System.exit(1);
-        } finally {
-            if (in != null) {
-                try {
-                    in.close();
-                } catch (IOException e) {
-                    e.printStackTrace();
-                }
-            }
-        }
-        String pk12pwd = null;
+            PKCS12Export tool = new PKCS12Export();
+            tool.setDebug(debug);
+            tool.setDatabaseDirectory(databaseDirectory);
+            tool.setDatabasePasswordFilename(databasePasswordFilename);
+            tool.setPkcs12PasswordFilename(pkcs12PasswordFilename);
+            tool.setPkcs12OutputFilename(pkcs12OutputFilename);
 
-        try {
-            in = new BufferedReader(new FileReader(pk12pwdfile));
-            pk12pwd = in.readLine();
-            if (pk12pwd == null) {
-                pk12pwd = "";
-            }
-        } catch (Exception e) {
-            debug("Failed to read the keydb password from the file. Exception: " + e.toString());
-            System.exit(1);
-        } finally {
-            if (in != null) {
-                try {
-                    in.close();
-                } catch (IOException e) {
-                    e.printStackTrace();
-                }
-            }
-        }
+            tool.initDatabase();
+            tool.exportData();
 
-        CryptoManager cm = null;
-        try {
-            CryptoManager.InitializationValues vals =
-                    new CryptoManager.InitializationValues(dir, "", "", "secmod.db");
-            CryptoManager.initialize(vals);
-            cm = CryptoManager.getInstance();
         } catch (Exception e) {
-            debug("Failed to initialize the certdb.");
-            System.exit(1);
-        }
-
-        SEQUENCE encSafeContents = new SEQUENCE();
-        SEQUENCE safeContents = new SEQUENCE();
-        try {
-            CryptoToken token = cm.getInternalKeyStorageToken();
-            Password pass = new Password(pwd.toCharArray());
-            token.login(pass);
-            CryptoStore store = token.getCryptoStore();
-            X509Certificate[] certs = store.getCertificates();
-            debug("Number of user certificates = " + certs.length);
-            Password pass12 = new Password(pk12pwd.toCharArray());
-            for (int i = 0; i < certs.length; i++) {
-                String nickname = certs[i].getNickname();
-                debug("Certificate nickname = " + nickname);
-                org.mozilla.jss.crypto.PrivateKey prikey = null;
-                try {
-                    prikey = cm.findPrivKeyByCert(certs[i]);
-                } catch (Exception e) {
-                    debug("PKCS12Export Exception: " + e.toString());
-                }
-
-                if (prikey == null) {
-                    debug("Private key is null");
-                    addCertBag(certs[i], null, safeContents);
-                } else {
-                    debug("Private key is not null");
-                    byte localKeyId[] =
-                            addCertBag(certs[i], nickname, safeContents);
-                    addKeyBag(prikey, certs[i], pass12, localKeyId, encSafeContents);
-                }
+            if (debug) {
+                e.printStackTrace();
+            } else {
+                System.err.println("ERROR: " + e);
             }
-
-            AuthenticatedSafes authSafes = new AuthenticatedSafes();
-            authSafes.addSafeContents(safeContents);
-            authSafes.addSafeContents(encSafeContents);
-            PFX pfx = new PFX(authSafes);
-            pfx.computeMacData(pass12, null, 5);
-            ByteArrayOutputStream bos = new ByteArrayOutputStream();
-            pfx.encode(bos);
-            FileOutputStream fos = new FileOutputStream(pk12output);
-            fos.write(bos.toByteArray());
-            fos.flush();
-            fos.close();
-            pass.clear();
-            pass12.clear();
-        } catch (Exception e) {
-            debug("PKCS12Export Exception: " + e.toString());
             System.exit(1);
         }
     }
diff --git a/base/server/cms/src/com/netscape/cms/servlet/csadmin/ConfigurationUtils.java b/base/server/cms/src/com/netscape/cms/servlet/csadmin/ConfigurationUtils.java
index 7e6c2a3c1fe41684bddd895557ff055b690ede68..5566e91e9aaa64acbcea3c5cfa89b9956142483b 100644
--- a/base/server/cms/src/com/netscape/cms/servlet/csadmin/ConfigurationUtils.java
+++ b/base/server/cms/src/com/netscape/cms/servlet/csadmin/ConfigurationUtils.java
@@ -865,6 +865,8 @@ public class ConfigurationUtils {
             BadPaddingException, NotInitializedException, NicknameConflictException, UserCertConflictException,
             NoSuchItemOnTokenException, InvalidBERException, IOException {
 
+        // TODO: refactor into a PKCS #12 utility class
+
         byte b[] = new byte[1000000];
         FileInputStream fis = new FileInputStream(p12File);
         while (fis.available() > 0)
@@ -886,7 +888,7 @@ public class ConfigurationUtils {
         Vector<Vector<Object>> pkeyinfo_collection = new Vector<Vector<Object>>();
         Vector<Vector<Object>> cert_collection = new Vector<Vector<Object>>();
 
-        CMS.debug("PKCS #12:");
+        CMS.debug("Importing PKCS #12 data");
 
         for (int i = 0; i < safes.getSize(); i++) {
 
-- 
1.9.3



More information about the Pki-devel mailing list