CLOUDSTACK-5296: Add certificate chain support for netscaler

Syed Ahmed · murali-reddy · commit ee7380ace201 · 2013-12-05T15:35:28.000+05:30
This patch adds support for trust chains in the netscaler.

I initially planned on using the 10.1 API's "bundle" feature but during
my testing I found that was not working. So I am doing the chain linking
myself. Also NS can have only one entity of a certificate ie lets say
two different users try to add the same certificate on the netscaler
only one of them will go through. The other one says resouce already
exists even though they have different files.

This can be a problem in trust chains where the chain can be shared
between multiple accounts/certificates. So, I am using the figerprint as
an identifier of a certificate and making sure that we delete it only
when no one references it.
diff --git a/.gitignore b/.gitignore
@@ -1,4 +1,4 @@
-G# Licensed to the Apache Software Foundation (ASF) under one
+# Licensed to the Apache Software Foundation (ASF) under one
 # or more contributor license agreements.  See the NOTICE file
 # distributed with this work for additional information
 # regarding copyright ownership.  The ASF licenses this file
diff --git a/api/src/com/cloud/network/lb/LoadBalancingRule.java b/api/src/com/cloud/network/lb/LoadBalancingRule.java
@@ -437,13 +437,15 @@ public static class LbSslCert {
         private String key;
         private String password = null;
         private String chain = null;
+        private String fingerprint;
         private boolean revoked;
 
-        public LbSslCert(String cert, String key, String password, String chain, boolean revoked) {
+        public LbSslCert(String cert, String key, String password, String chain, String fingerprint, boolean revoked) {
             this.cert = cert;
             this.key = key;
             this.password = password;
             this.chain = chain;
+            this.fingerprint = fingerprint;
             this.revoked = revoked;
         }
 
@@ -464,6 +466,10 @@ public String getChain() {
             return chain;
         }
 
+        public String getFingerprint() {
+            return fingerprint;
+        }
+
         public boolean isRevoked() {
             return revoked;
         }
diff --git a/engine/schema/src/com/cloud/network/dao/SslCertDaoImpl.java b/engine/schema/src/com/cloud/network/dao/SslCertDaoImpl.java
@@ -33,7 +33,7 @@ public SslCertDaoImpl() {
         listByAccountId = createSearchBuilder();
         listByAccountId.and("accountId", listByAccountId.entity().getAccountId(), SearchCriteria.Op.EQ);
         listByAccountId.done();
-    }
+   }
 
     @Override
     public List<SslCertVO> listByAccountId(Long accountId) {
diff --git a/plugins/network-elements/netscaler/src/com/cloud/network/resource/NetscalerResource.java b/plugins/network-elements/netscaler/src/com/cloud/network/resource/NetscalerResource.java
diff --git a/server/src/com/cloud/network/lb/LoadBalancingRulesManagerImpl.java b/server/src/com/cloud/network/lb/LoadBalancingRulesManagerImpl.java
@@ -1074,7 +1074,7 @@ public LbSslCert getLbSslCert(long lbRuleId) {
             return null;
         }
 
-        return new LbSslCert(certVO.getCertificate(), certVO.getKey(), certVO.getChain(), certVO.getPassword(), lbCertMap.isRevoke());
+        return new LbSslCert(certVO.getCertificate(), certVO.getKey(), certVO.getPassword(), certVO.getChain(), certVO.getFingerPrint(), lbCertMap.isRevoke());
     }
 
     @Override
@@ -1124,11 +1124,6 @@ public boolean assignCertToLoadBalancer(long lbRuleId, Long certId) {
             LoadBalancerCertMapVO certMap = new LoadBalancerCertMapVO(lbRuleId, certId, false);
             _lbCertMapDao.persist(certMap);
             applyLoadBalancerConfig(loadBalancer.getId());
-            /*s_logger.warn("Failed to apply Ssl Cert to LB " + loadBalancer.getId());
-            CloudRuntimeException ex = new CloudRuntimeException(
-                    "Failed to apply Ssl Cert to LB " + loadBalancer.getId());
-            ex.addProxyObject(loadBalancer.getUuid(), "loadBalancerId");
-            throw ex;*/
             success = true;
         } catch (ResourceUnavailableException e) {
             if (isRollBackAllowedForProvider(loadBalancer)) {
diff --git a/server/src/org/apache/cloudstack/network/lb/CertServiceImpl.java b/server/src/org/apache/cloudstack/network/lb/CertServiceImpl.java
@@ -25,6 +25,7 @@
 import java.security.KeyPair;
 import java.security.MessageDigest;
 import java.security.NoSuchAlgorithmException;
+import java.security.NoSuchProviderException;
 import java.security.Principal;
 import java.security.PrivateKey;
 import java.security.PublicKey;
@@ -115,6 +116,7 @@ public SslCertResponse uploadSslCert(UploadSslCertCmd certCmd) {
 
             validate(cert, key, password, chain);
             s_logger.debug("Certificate Validation succeeded");
+
             String fingerPrint = generateFingerPrint(parseCertificate(cert));
 
             Long accountId = CallContext.current().getCallingAccount().getId();
@@ -379,14 +381,17 @@ private void validateChain(List<Certificate> chain, Certificate cert) {
             params = new PKIXBuilderParameters(anchors, target);
             params.setRevocationEnabled(false);
             params.addCertStore(CertStore.getInstance("Collection", new CollectionCertStoreParameters(certs)));
-            CertPathBuilder builder = CertPathBuilder.getInstance("PKIX");
+            CertPathBuilder builder = CertPathBuilder.getInstance("PKIX", "BC");
             builder.build(params);
+
         } catch (InvalidAlgorithmParameterException e) {
             throw new IllegalArgumentException("Invalid certificate chain", e);
         } catch (CertPathBuilderException e) {
             throw new IllegalArgumentException("Invalid certificate chain", e);
         } catch (NoSuchAlgorithmException e) {
             throw new IllegalArgumentException("Invalid certificate chain", e);
+        } catch (NoSuchProviderException e) {
+            throw new CloudRuntimeException("No provider for certificate validation", e);
         }
 
     }
diff --git a/utils/src/com/cloud/utils/security/CertificateHelper.java b/utils/src/com/cloud/utils/security/CertificateHelper.java
@@ -20,21 +20,28 @@
 import java.io.ByteArrayInputStream;
 import java.io.ByteArrayOutputStream;
 import java.io.IOException;
+import java.io.StringReader;
 import java.security.Key;
 import java.security.KeyFactory;
 import java.security.KeyStore;
 import java.security.KeyStoreException;
+import java.security.MessageDigest;
 import java.security.NoSuchAlgorithmException;
 import java.security.cert.Certificate;
+import java.security.cert.CertificateEncodingException;
 import java.security.cert.CertificateException;
 import java.security.cert.CertificateFactory;
+import java.security.cert.X509Certificate;
 import java.security.spec.InvalidKeySpecException;
 import java.security.spec.PKCS8EncodedKeySpec;
+import java.util.ArrayList;
 import java.util.List;
 
+import com.cloud.utils.exception.CloudRuntimeException;
 import org.apache.commons.codec.binary.Base64;
 
 import com.cloud.utils.Ternary;
+import org.bouncycastle.openssl.PEMReader;
 
 public class CertificateHelper {
     public static byte[] buildAndSaveKeystore(String alias, String cert, String privateKey, String storePassword) throws KeyStoreException, CertificateException,
@@ -106,4 +113,53 @@ public static Key buildPrivateKey(String base64EncodedKeyContent) throws NoSuchA
         PKCS8EncodedKeySpec keysp = new PKCS8EncodedKeySpec(Base64.decodeBase64(base64EncodedKeyContent));
         return kf.generatePrivate(keysp);
     }
+
+   public static List<Certificate> parseChain(String chain) throws IOException {
+
+        List<Certificate> certs = new ArrayList<Certificate>();
+        PEMReader reader = new PEMReader(new StringReader(chain));
+
+        Certificate crt = null;
+
+        while ((crt = (Certificate)reader.readObject()) != null) {
+            if (crt instanceof X509Certificate) {
+                certs.add(crt);
+            }
+        }
+        if (certs.size() == 0)
+            throw new IllegalArgumentException("Unable to decode certificate chain");
+
+        return certs;
+    }
+
+    public static String generateFingerPrint(Certificate cert) {
+
+        final char[] HEX = {'0', '1', '2', '3', '4', '5', '6', '7', '8', '9', 'A', 'B', 'C', 'D', 'E', 'F'};
+
+        StringBuilder buffer = new StringBuilder(60);
+        try {
+
+            MessageDigest md = MessageDigest.getInstance("SHA-1");
+            byte[] data = md.digest(cert.getEncoded());
+
+            for (int i = 0; i < data.length; i++) {
+                if (buffer.length() > 0) {
+                    buffer.append(":");
+                }
+
+                buffer.append(HEX[(0xF0 & data[i]) >>> 4]);
+                buffer.append(HEX[0x0F & data[i]]);
+            }
+
+        } catch (CertificateEncodingException e) {
+            throw new CloudRuntimeException("Bad certificate encoding");
+        } catch (NoSuchAlgorithmException e) {
+            throw new CloudRuntimeException("Bad certificate algorithm");
+        }
+
+        return buffer.toString();
+    }
+
+
+
 }

Original file line number	Diff line number	Diff line change
`@@ -1,4 +1,4 @@`
`1`		`-G# Licensed to the Apache Software Foundation (ASF) under one`
	`1`	`+# Licensed to the Apache Software Foundation (ASF) under one`
`2`	`2`	`# or more contributor license agreements. See the NOTICE file`
`3`	`3`	`# distributed with this work for additional information`
`4`	`4`	`# regarding copyright ownership. The ASF licenses this file`