java.lang.Object

javax.servlet.GenericServlet

javax.servlet.http.HttpServlet

com.netscape.cms.servlet.base.CMSServlet

com.netscape.cms.servlet.ocsp.OCSPServlet

All Implemented Interfaces:: Serializable, javax.servlet.Servlet, javax.servlet.ServletConfig

public class OCSPServlet extends CMSServlet

Process OCSP messages, According to RFC 2560 See http://www.ietf.org/rfc/rfc2560.txt

Version:

$Revision$ $Date$

See Also:

Field Summary

Fields

Modifier and Type

Field

Description

static org.slf4j.Logger

logger

static final String

PROP_AUTHORITY

static final String

PROP_CLIENTAUTH

static final String

PROP_ID

static final String

PROP_MAX_REQUEST_SIZE

Fields inherited from class CMSServlet
ADMIN_GROUP, AUTH_FAILURE, AUTHMGR_PARAM, AUTHZ_MGR_BASIC, AUTHZ_MGR_LDAP, AUTHZ_SRC_LDAP, AUTHZ_SRC_TYPE, AUTHZ_SRC_XML, CA_AGENT_GROUP, CERT_ATTR, certAuthority, engine, ERROR_MSG_TOKEN, ERROR_TEMPLATE, EXCEPTION_TEMPLATE, FAILURE, FINAL_ERROR_MSG, FULL_ENROLLMENT_REQUEST, FULL_ENROLLMENT_RESPONSE, FULL_RESPONSE, KRA_AGENT_GROUP, mAclMethod, mAuthMgr, mAuthority, mAuthz, mAuthzResourceName, mConfig, mDontSaveHttpParams, mFinalErrorMsg, mGetClientCert, mId, mLogCategory, mOutputTemplatePath, mRenderResult, mRequestQueue, mSaveHttpHeaders, mServletConfig, mServletContext, mTemplates, OCSP_AGENT_GROUP, PENDING_TEMPLATE, PFX_AUTH_TOKEN, PFX_HTTP_HEADER, PFX_HTTP_PARAM, PROP_ACL, PROP_AUTHMGR, PROP_AUTHORITYID, PROP_AUTHZ_MGR, PROP_ERROR_TEMPLATE, PROP_EXCEPTION_TEMPLATE, PROP_FINAL_ERROR_MSG, PROP_PENDING_TEMPLATE, PROP_REJECTED_TEMPLATE, PROP_RESOURCEID, PROP_SUCCESS_TEMPLATE, PROP_SUCCESS_TEMPLATE_FILLER, PROP_SVC_PENDING_TEMPLATE, PROP_UNAUTHORIZED_TEMPLATE, RA_AGENT_GROUP, REJECTED_TEMPLATE, requestRepository, servletConfig, signedAuditLogger, SIMPLE_ENROLLMENT_REQUEST, SIMPLE_ENROLLMENT_RESPONSE, SUCCESS, SUCCESS_TEMPLATE, SVC_PENDING_TEMPLATE, TEMPLATE_NAME, TRUSTED_RA_GROUP, UNAUTHORIZED_TEMPLATE

Modifier and Type

Field

Description

protected static final String

ADMIN_GROUP

static final String

AUTH_FAILURE

protected static final String

AUTHMGR_PARAM

static final String

AUTHZ_MGR_BASIC

static final String

AUTHZ_MGR_LDAP

static final String

AUTHZ_SRC_LDAP

static final String

AUTHZ_SRC_TYPE

static final String

AUTHZ_SRC_XML

protected static final String

CA_AGENT_GROUP

static final String

CERT_ATTR

protected ICertificateAuthority

certAuthority

protected CMSEngine

engine

static final String

ERROR_MSG_TOKEN

protected static final String

ERROR_TEMPLATE

protected static final String

EXCEPTION_TEMPLATE

static final String

FAILURE

static final String

FINAL_ERROR_MSG

static final String

FULL_ENROLLMENT_REQUEST

static final String

FULL_ENROLLMENT_RESPONSE

static String

FULL_RESPONSE

handy routine to check if client want full enrollment response

protected static final String

KRA_AGENT_GROUP

protected String

mAclMethod

protected String

mAuthMgr

protected IAuthority

mAuthority

protected AuthzSubsystem

mAuthz

protected String

mAuthzResourceName

protected IConfigStore

mConfig

protected Vector<String>

mDontSaveHttpParams

protected String

mFinalErrorMsg

protected String

mGetClientCert

protected String

mId

protected LogSource

mLogCategory

protected String

mOutputTemplatePath

protected boolean

mRenderResult

protected ARequestQueue

mRequestQueue

protected Vector<String>

mSaveHttpHeaders

protected javax.servlet.ServletConfig

mServletConfig

protected javax.servlet.ServletContext

mServletContext

protected Hashtable<Integer, CMSLoadTemplate>

mTemplates

protected static final String

OCSP_AGENT_GROUP

protected static final String

PENDING_TEMPLATE

static final String

PFX_AUTH_TOKEN

static final String

PFX_HTTP_HEADER

static final String

PFX_HTTP_PARAM

static final String

PROP_ACL

static final String

PROP_AUTHMGR

static final String

PROP_AUTHORITYID

static final String

PROP_AUTHZ_MGR

protected static final String

PROP_ERROR_TEMPLATE

protected static final String

PROP_EXCEPTION_TEMPLATE

static final String

PROP_FINAL_ERROR_MSG

protected static final String

PROP_PENDING_TEMPLATE

protected static final String

PROP_REJECTED_TEMPLATE

static final String

PROP_RESOURCEID

protected static final String

PROP_SUCCESS_TEMPLATE

protected static final String

PROP_SUCCESS_TEMPLATE_FILLER

protected static final String

PROP_SVC_PENDING_TEMPLATE

protected static final String

PROP_UNAUTHORIZED_TEMPLATE

protected static final String

RA_AGENT_GROUP

protected static final String

REJECTED_TEMPLATE

protected RequestRepository

requestRepository

protected javax.servlet.ServletConfig

servletConfig

protected static Logger

signedAuditLogger

static final String

SIMPLE_ENROLLMENT_REQUEST

static final String

SIMPLE_ENROLLMENT_RESPONSE

static final String

SUCCESS

protected static final String

SUCCESS_TEMPLATE

protected static final String

SVC_PENDING_TEMPLATE

static final String

TEMPLATE_NAME

protected static final String

TRUSTED_RA_GROUP

protected static final String

UNAUTHORIZED_TEMPLATE
Constructor Summary

Constructors

Constructor

Description

OCSPServlet()
Method Summary

Modifier and Type

Method

Description

void

init(javax.servlet.ServletConfig sc)

initialize the servlet.

protected void

process(CMSRequest cmsReq)

Process the HTTP request.

Methods inherited from class CMSServlet
areCertsFromCA, audit, audit, auditGroupID, auditSubjectID, authenticate, authenticate, authenticate, authenticate, authorize, authorize, certIsRevoked, checkImportCertToNav, clientIsMSIE, clientIsNav, connectionIsSSL, doCMMFResponse, doFullResponse, formCRLEntry, generateSalt, getAuthCreds, getAuthMgr, getAuthToken, getCertRecord, getDontSaveHttpParams, getId, getLangFile, getLocale, getLocale, getRelPath, getSaveHttpHeaders, getSSLClientCertificate, getSSLClientCertificate, getTemplate, getX509Certificate, hashPassword, importCertToNav, invalidateSSLSession, isCertFromCA, isClientCertRequired, isSystemCertificate, newCMSRequest, newFillerObject, outputArgBlockAsXML, outputError, outputError, outputError, outputHttpParameters, outputResult, outputXML, renderException, renderFinalError, renderResult, renderTemplate, saveAuthToken, saveHttpHeaders, saveHttpParams, service, setDefaultTemplates, toHashtable

Modifier and Type

Method

Description

protected boolean

areCertsFromCA(X509Certificate[] certs)

handy routine for checking if a list of certs is from this CA.

protected void

audit(LogEvent event)

protected void

audit(String msg)

Signed Audit Log This method is inherited by all extended "CMSServlet"s, and is called to store messages to the signed audit log.

protected String

auditGroupID()

Signed Audit Log Group ID This method is inherited by all extended "CMSServlet"s, and is called to obtain the "gid" for a signed audit log message.

protected String

auditSubjectID()

Signed Audit Log Subject ID This method is inherited by all extended "CMSServlet"s, and is called to obtain the "SubjectID" for a signed audit log message.

IAuthToken

authenticate(CMSRequest req)

IAuthToken

authenticate(CMSRequest req, String authMgrName)

IAuthToken

authenticate(javax.servlet.http.HttpServletRequest httpReq)

IAuthToken

authenticate(javax.servlet.http.HttpServletRequest httpReq, String authMgrName)

Authentication

AuthzToken

authorize(String authzMgrName, IAuthToken authToken, String resource, String operation)

Authorize must occur after Authenticate

AuthzToken

authorize(String authzMgrName, String resource, IAuthToken authToken, String exp)

protected boolean

certIsRevoked(BigInteger serialNum)

check if a certificate (serial number) is revoked on a CA.

protected boolean

checkImportCertToNav(javax.servlet.http.HttpServletResponse httpResp, IArgBlock httpParams, org.mozilla.jss.netscape.security.x509.X509CertImpl cert)

static boolean

clientIsMSIE(javax.servlet.http.HttpServletRequest httpReq)

handy routine to check if client is msie based on user-agent.

static boolean

clientIsNav(javax.servlet.http.HttpServletRequest httpReq)

handy routine to check if client is navigator based on user-agent.

protected static boolean

connectionIsSSL(javax.servlet.http.HttpServletRequest httpReq)

static boolean

doCMMFResponse(IArgBlock httpParams)

static boolean

doFullResponse(IArgBlock httpParams)

protected org.mozilla.jss.netscape.security.x509.RevokedCertImpl

formCRLEntry(BigInteger serialNo, org.mozilla.jss.netscape.security.x509.RevocationReason reason)

make a CRL entry from a serial number and revocation reason.

static String

generateSalt()

static AuthCredentials

getAuthCreds(AuthManager authMgr, IArgBlock argBlock, X509Certificate clientCert)

construct a authentication credentials to pass into authentication manager.

String

getAuthMgr()

protected IAuthToken

getAuthToken(IRequest req)

protected CertRecord

getCertRecord(BigInteger serialNo)

handy routine for getting a cert record given a serial number.

protected void

getDontSaveHttpParams(javax.servlet.ServletConfig sc)

get http parameters not to save from configuration.

String

getId()

static File

getLangFile(javax.servlet.http.HttpServletRequest req, File realpathFile, Locale[] locale)

static Locale

getLocale(String lang)

protected Locale

getLocale(javax.servlet.http.HttpServletRequest req)

Retrieves locale based on the request.

protected String

getRelPath(IAuthority authority)

handy routine for getting agent's relative path

protected void

getSaveHttpHeaders(javax.servlet.ServletConfig sc)

get http headers to save from configuration.

protected X509Certificate

getSSLClientCertificate(javax.servlet.http.HttpServletRequest httpReq)

get ssl client authenticated certificate

protected X509Certificate

getSSLClientCertificate(javax.servlet.http.HttpServletRequest httpReq, boolean clientCertRequired)

protected CMSTemplate

getTemplate(String templateName, javax.servlet.http.HttpServletRequest httpReq, Locale[] locale)

get a template based on result status.

protected X509Certificate

getX509Certificate(BigInteger serialNo)

handy routine for getting a certificate from the certificate repository.

protected String

hashPassword(String pwd)

void

importCertToNav(javax.servlet.http.HttpServletResponse httpResp, org.mozilla.jss.netscape.security.x509.X509CertImpl cert, String contentType, boolean importCAChain)

handy routine to import cert to old navigator in nav mime type.

protected static void

invalidateSSLSession(javax.servlet.http.HttpServletRequest httpReq)

Invalidates a SSL Session.

protected boolean

isCertFromCA(X509Certificate cert)

handy routine for validating if a cert is from this CA.

boolean

isClientCertRequired()

protected boolean

isSystemCertificate(BigInteger serialNo)

A system certificate such as the CA signing certificate should not be allowed to delete.

protected CMSRequest

newCMSRequest()

Create a new CMSRequest object.

protected ICMSTemplateFiller

newFillerObject(String fillerClass)

instantiate a new filler from a class name,

protected void

outputArgBlockAsXML(XMLObject xmlObj, Node parent, String argBlockName, IArgBlock argBlock)

protected void

outputError(javax.servlet.http.HttpServletResponse httpResp, String errorString)

protected void

outputError(javax.servlet.http.HttpServletResponse httpResp, String errorString, String requestId)

protected void

outputError(javax.servlet.http.HttpServletResponse httpResp, String status, String errorString, String requestId)

void

outputHttpParameters(javax.servlet.http.HttpServletRequest httpReq)

protected void

outputResult(javax.servlet.http.HttpServletResponse httpResp, String contentType, byte[] content)

protected void

outputXML(javax.servlet.http.HttpServletResponse httpResp, CMSTemplateParams params)

protected void

renderException(CMSRequest cmsReq, EBaseException e)

Output exception (unexpected error) template This is different from other templates in that if an exception occurs while rendering the exception a message is printed out directly.

void

renderFinalError(CMSRequest cmsReq, Exception ex)

protected void

renderResult(CMSRequest cmsReq)

Output a template.

protected void

renderTemplate(CMSRequest cmsReq, String templateName, ICMSTemplateFiller filler)

protected static void

saveAuthToken(IAuthToken token, IRequest req)

protected void

saveHttpHeaders(javax.servlet.http.HttpServletRequest httpReq, IRequest req)

save http headers in a IRequest.

protected void

saveHttpParams(IArgBlock httpParams, IRequest req)

save http headers in a IRequest.

void

service(javax.servlet.http.HttpServletRequest httpReq, javax.servlet.http.HttpServletResponse httpResp)

protected void

setDefaultTemplates(javax.servlet.ServletConfig sc)

set default templates.

static Hashtable<String,String>

toHashtable(javax.servlet.http.HttpServletRequest req)

Methods inherited from class javax.servlet.http.HttpServlet
doDelete, doGet, doHead, doOptions, doPost, doPut, doTrace, getLastModified, service

Methods inherited from class javax.servlet.GenericServlet
destroy, getInitParameter, getInitParameterNames, getServletConfig, getServletContext, getServletInfo, getServletName, init, log, log

Methods inherited from class Object
clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Details
- logger
  
  public static org.slf4j.Logger logger
- PROP_AUTHORITY
  public static final String PROP_AUTHORITY
  
  See Also:
  
  Constant Field Values
- PROP_CLIENTAUTH
  public static final String PROP_CLIENTAUTH
  
  See Also:
  
  Constant Field Values
- PROP_MAX_REQUEST_SIZE
  public static final String PROP_MAX_REQUEST_SIZE
  
  See Also:
  
  Constant Field Values
- PROP_ID
  public static final String PROP_ID
  
  See Also:
  
  Constant Field Values
Constructor Details
- OCSPServlet
  
  public OCSPServlet()
Method Details
- init
  
  public void init(javax.servlet.ServletConfig sc) throws javax.servlet.ServletException
  
  initialize the servlet. This servlet uses the template file "ImportCert.template" to process the response.
  
  Specified by:
  
  init in interface javax.servlet.Servlet
  
  Overrides:
  
  init in class CMSServlet
  
  Parameters:
  
  sc - servlet configuration, read from the web.xml file
  
  Throws:
  
  javax.servlet.ServletException
- process
  
  protected void process(CMSRequest cmsReq) throws EBaseException
  
  Process the HTTP request. This method is invoked when the OCSP service receives a OCSP request. Based on RFC 2560, the request should have the OCSP request in the HTTP body as binary blob.
  
  Overrides:
  
  process in class CMSServlet
  
  Parameters:
  
  cmsReq - the object holding the request and response information
  
  Throws:
  
  EBaseException - if the servlet was unable to satisfactorily process the request

Class OCSPServlet

Field Summary

Fields inherited from class CMSServlet

Constructor Summary

Method Summary

Methods inherited from class CMSServlet

Methods inherited from class javax.servlet.http.HttpServlet

Methods inherited from class javax.servlet.GenericServlet

Methods inherited from class Object

Field Details

logger

PROP_AUTHORITY

PROP_CLIENTAUTH

PROP_MAX_REQUEST_SIZE

PROP_ID

Constructor Details

OCSPServlet

Method Details

init

process