From 627633480be599ac20bca6c5c72bf4e065337112 Mon Sep 17 00:00:00 2001
From: "Endi S. Dewata" <edewata@redhat.com>
Date: Thu, 15 May 2014 08:32:08 -0400
Subject: [PATCH] Refactored ConfigurationUtils.configCert().

The ConfigurationUtils.configCert() has been refactored into smaller
methods: createRemoteCert() and createLocalCert().

Ticket #990
---
 .../cms/servlet/csadmin/ConfigurationUtils.java    | 402 ++++++++++++---------
 1 file changed, 228 insertions(+), 174 deletions(-)

diff --git a/base/server/cms/src/com/netscape/cms/servlet/csadmin/ConfigurationUtils.java b/base/server/cms/src/com/netscape/cms/servlet/csadmin/ConfigurationUtils.java
index e7aaa4e5867beae9df9e89a229204235b3040078..605b943e40d86332eecc82f4c9ea54ef8ee5f981 100644
--- a/base/server/cms/src/com/netscape/cms/servlet/csadmin/ConfigurationUtils.java
+++ b/base/server/cms/src/com/netscape/cms/servlet/csadmin/ConfigurationUtils.java
@@ -2224,20 +2224,8 @@ public class ConfigurationUtils {
         try {
             String selection = config.getString("preop.subsystem.select");
             String csType = config.getString("cs.type");
-            String preop_ca_type = null;
-            String preop_cert_signing_type = null;
-            String preop_cert_signing_profile = null;
-            String preop_cert_sslserver_type = null;
-            String preop_cert_sslserver_profile = null;
-            boolean sign_clone_sslserver_cert_using_master = false;
 
             if (selection.equals("clone") && csType.equals("CA") && certTag.equals("sslserver")) {
-                // retrieve and store original 'CS.cfg' entries
-                preop_ca_type = config.getString("preop.ca.type", "");
-                preop_cert_signing_type = config.getString("preop.cert.signing.type", "");
-                preop_cert_signing_profile = config.getString("preop.cert.signing.profile","");
-                preop_cert_sslserver_type = config.getString("preop.cert.sslserver.type", "");
-                preop_cert_sslserver_profile = config.getString("preop.cert.sslserver.profile","");
 
                 // add/modify 'CS.cfg' entries
                 config.putString("preop.ca.type", "sdca");
@@ -2252,175 +2240,15 @@ public class ConfigurationUtils {
                 // fetch revised caType
                 caType = certObj.getType();
                 CMS.debug("configCert: caType is " + caType + " (revised)");
-
-                // set master/clone signature flag
-                sign_clone_sslserver_cert_using_master = true;
             }
 
             updateConfig(config, certTag);
             if (caType.equals("remote")) {
-                String v = config.getString("preop.ca.type", "");
+                cert = createRemoteCert(request, response, context, certObj, panel, caType);
 
-                CMS.debug("configCert: remote CA");
-                String pkcs10 = CertUtil.getPKCS10(config, PCERT_PREFIX, certObj, context);
-                certObj.setRequest(pkcs10);
-                String subsystem = config.getString(PCERT_PREFIX + certTag + ".subsystem");
-                config.putString(subsystem + "." + certTag + ".certreq", pkcs10);
-                String profileId = config.getString(PCERT_PREFIX + certTag + ".profile");
-                String session_id = CMS.getConfigSDSessionId();
-                String sd_hostname = "";
-                int sd_ee_port = -1;
-                try {
-                    sd_hostname = config.getString("securitydomain.host", "");
-                    sd_ee_port = config.getInteger("securitydomain.httpseeport", -1);
-                } catch (Exception ee) {
-                    CMS.debug("configCert(): exception caught:" + ee.toString());
-                }
-                String sysType = config.getString("cs.type", "");
-                String machineName = config.getString("machineName", "");
-                String securePort = config.getString("service.securePort", "");
-                if (certTag.equals("subsystem")) {
-                    boolean standalone = config.getBoolean(sysType.toLowerCase() + ".standalone", false);
-                    if (standalone) {
-                        // Treat standalone subsystem the same as "otherca"
-                        config.putString(subsystem + "." + certTag + ".cert",
-                                         "...paste certificate here...");
-                    } else {
-                        String content =
-                                "requestor_name="
-                                        + sysType + "-" + machineName + "-" + securePort + "&profileId=" + profileId
-                                        + "&cert_request_type=pkcs10&cert_request=" + URLEncoder.encode(pkcs10, "UTF-8")
-                                        + "&xmlOutput=true&sessionID=" + session_id;
-                        cert = CertUtil.createRemoteCert(sd_hostname, sd_ee_port,
-                                content, response, panel);
-                        if (cert == null) {
-                            throw new IOException("Error: remote certificate is null");
-                        }
-                    }
-                } else if (v.equals("sdca")) {
-                    String ca_hostname = "";
-                    int ca_port = -1;
-                    try {
-                        if (sign_clone_sslserver_cert_using_master) {
-                            CMS.debug("NamePanel: For this Cloned CA, always use its Master CA to generate " +
-                                      "the 'sslserver' certificate to avoid any changes which may have been " +
-                                      "made to the X500Name directory string encoding order.");
-                            ca_hostname = config.getString("preop.master.hostname", "");
-                            ca_port = config.getInteger("preop.master.httpsport", -1);
-                        } else {
-                            ca_hostname = config.getString("preop.ca.hostname", "");
-                            ca_port = config.getInteger("preop.ca.httpsport", -1);
-                        }
-                    } catch (Exception ee) {
-                    }
-
-                    String content =
-                            "requestor_name="
-                                    + sysType + "-" + machineName + "-" + securePort + "&profileId=" + profileId
-                                    + "&cert_request_type=pkcs10&cert_request=" + URLEncoder.encode(pkcs10, "UTF-8")
-                                    + "&xmlOutput=true&sessionID=" + session_id;
-                    cert = CertUtil.createRemoteCert(ca_hostname, ca_port,
-                            content, response, panel);
-                    if (cert == null) {
-                        throw new IOException("Error: remote certificate is null");
-                    }
-
-                    if (sign_clone_sslserver_cert_using_master) {
-                        // restore original 'CS.cfg' entries
-                        config.putString("preop.ca.type", preop_ca_type);
-                        config.putString("preop.cert.signing.type", preop_cert_signing_type);
-                        config.putString("preop.cert.signing.profile", preop_cert_signing_profile);
-                        config.putString("preop.cert.sslserver.type", preop_cert_sslserver_type);
-                        config.putString("preop.cert.sslserver.profile", preop_cert_sslserver_profile);
-
-                        // reset master/clone signature flag
-                        sign_clone_sslserver_cert_using_master = false;
-                    }
-                } else if (v.equals("otherca")) {
-                    config.putString(subsystem + "." + certTag + ".cert",
-                            "...paste certificate here...");
-                } else {
-                    CMS.debug("NamePanel: no preop.ca.type is provided");
-                }
             } else { // not remote CA, ie, self-signed or local
-                ISubsystem ca = CMS.getSubsystem(ICertificateAuthority.ID);
+                cert = createLocalCert(context, certObj, caType);
 
-                if (ca == null) {
-                    String s = PCERT_PREFIX + certTag + ".type";
-
-                    CMS.debug(
-                            "The value for " + s
-                                    + " should be remote, nothing else.");
-                    throw new IOException(
-                            "The value for " + s + " should be remote");
-                }
-
-                String pubKeyType = config.getString(
-                        PCERT_PREFIX + certTag + ".keytype");
-                if (pubKeyType.equals("rsa")) {
-
-                    String pubKeyModulus = config.getString(
-                            PCERT_PREFIX + certTag + ".pubkey.modulus");
-                    String pubKeyPublicExponent = config.getString(
-                            PCERT_PREFIX + certTag + ".pubkey.exponent");
-                    String subsystem = config.getString(
-                            PCERT_PREFIX + certTag + ".subsystem");
-
-                    if (certTag.equals("signing")) {
-                        X509Key x509key = CryptoUtil.getPublicX509Key(
-                                CryptoUtil.string2byte(pubKeyModulus),
-                                CryptoUtil.string2byte(pubKeyPublicExponent));
-
-                        cert = CertUtil.createLocalCert(config, x509key,
-                                PCERT_PREFIX, certTag, caType, context);
-                    } else {
-                        String cacert = config.getString("ca.signing.cert", "");
-
-                        if (cacert.equals("") || cacert.startsWith("...")) {
-                            certObj.setCert(
-                                    "...certificate be generated internally...");
-                            config.putString(subsystem + "." + certTag + ".cert",
-                                    "...certificate be generated internally...");
-                        } else {
-                            X509Key x509key = CryptoUtil.getPublicX509Key(
-                                    CryptoUtil.string2byte(pubKeyModulus),
-                                    CryptoUtil.string2byte(pubKeyPublicExponent));
-
-                            cert = CertUtil.createLocalCert(config, x509key,
-                                    PCERT_PREFIX, certTag, caType, context);
-                        }
-                    }
-                } else if (pubKeyType.equals("ecc")) {
-                    String pubKeyEncoded = config.getString(
-                            PCERT_PREFIX + certTag + ".pubkey.encoded");
-                    String subsystem = config.getString(
-                            PCERT_PREFIX + certTag + ".subsystem");
-
-                    if (certTag.equals("signing")) {
-
-                        X509Key x509key = CryptoUtil.getPublicX509ECCKey(CryptoUtil.string2byte(pubKeyEncoded));
-                        cert = CertUtil.createLocalCert(config, x509key,
-                                PCERT_PREFIX, certTag, caType, context);
-                    } else {
-                        String cacert = config.getString("ca.signing.cert", "");
-
-                        if (cacert.equals("") || cacert.startsWith("...")) {
-                            certObj.setCert(
-                                    "...certificate be generated internally...");
-                            config.putString(subsystem + "." + certTag + ".cert",
-                                    "...certificate be generated internally...");
-                        } else {
-                            X509Key x509key = CryptoUtil.getPublicX509ECCKey(
-                                    CryptoUtil.string2byte(pubKeyEncoded));
-
-                            cert = CertUtil.createLocalCert(config, x509key,
-                                    PCERT_PREFIX, certTag, caType, context);
-                        }
-                    }
-                } else {
-                    // invalid key type
-                    CMS.debug("Invalid key type " + pubKeyType);
-                }
                 if (cert != null) {
                     if (certTag.equals("subsystem"))
                         CertUtil.addUserCertificate(cert);
@@ -2444,6 +2272,232 @@ public class ConfigurationUtils {
         }
     }
 
+    public static X509CertImpl createRemoteCert(
+            HttpServletRequest request, HttpServletResponse response,
+            Context context, Cert certObj, WizardPanelBase panel,
+            String caType)
+                    throws EPropertyNotFound, EBaseException, IOException {
+
+        CMS.debug("ConfigurationUtils.createRemoteCert(): remote CA");
+
+        X509CertImpl cert = null;
+
+        IConfigStore config = CMS.getConfigStore();
+        String selection = config.getString("preop.subsystem.select");
+        String csType = config.getString("cs.type");
+
+        String preop_ca_type = null;
+        String preop_cert_signing_type = null;
+        String preop_cert_signing_profile = null;
+        String preop_cert_sslserver_type = null;
+        String preop_cert_sslserver_profile = null;
+        boolean sign_clone_sslserver_cert_using_master = false;
+
+        String certTag = certObj.getCertTag();
+
+        if (selection.equals("clone") && csType.equals("CA") && certTag.equals("sslserver")) {
+            // retrieve and store original 'CS.cfg' entries
+            preop_ca_type = config.getString("preop.ca.type", "");
+            preop_cert_signing_type = config.getString("preop.cert.signing.type", "");
+            preop_cert_signing_profile = config.getString("preop.cert.signing.profile","");
+            preop_cert_sslserver_type = config.getString("preop.cert.sslserver.type", "");
+            preop_cert_sslserver_profile = config.getString("preop.cert.sslserver.profile","");
+
+            // set master/clone signature flag
+            sign_clone_sslserver_cert_using_master = true;
+        }
+
+        String v = config.getString("preop.ca.type", "");
+
+        String pkcs10 = CertUtil.getPKCS10(config, PCERT_PREFIX, certObj, context);
+        certObj.setRequest(pkcs10);
+
+        String subsystem = config.getString(PCERT_PREFIX + certTag + ".subsystem");
+        config.putString(subsystem + "." + certTag + ".certreq", pkcs10);
+
+        String profileId = config.getString(PCERT_PREFIX + certTag + ".profile");
+        String sessionId = CMS.getConfigSDSessionId();
+
+        String sdHostname = "";
+        int sdEePort = -1;
+
+        try {
+            sdHostname = config.getString("securitydomain.host", "");
+            sdEePort = config.getInteger("securitydomain.httpseeport", -1);
+
+        } catch (Exception ee) {
+            CMS.debug(ee);
+        }
+
+        String sysType = config.getString("cs.type", "");
+        String machineName = config.getString("machineName", "");
+        String securePort = config.getString("service.securePort", "");
+
+        if (certTag.equals("subsystem")) {
+
+            boolean standalone = config.getBoolean(sysType.toLowerCase() + ".standalone", false);
+
+            if (standalone) {
+                // Treat standalone subsystem the same as "otherca"
+                config.putString(subsystem + "." + certTag + ".cert",
+                                 "...paste certificate here...");
+
+            } else {
+                String content = "requestor_name=" + sysType + "-" + machineName + "-" + securePort
+                        + "&profileId=" + profileId
+                        + "&cert_request_type=pkcs10&cert_request=" + URLEncoder.encode(pkcs10, "UTF-8")
+                        + "&xmlOutput=true"
+                        + "&sessionID=" + sessionId;
+
+                cert = CertUtil.createRemoteCert(sdHostname, sdEePort, content, response, panel);
+
+                if (cert == null) {
+                    throw new IOException("Error: remote certificate is null");
+                }
+            }
+
+        } else if (v.equals("sdca")) {
+
+            String caHostname = "";
+            int caPort = -1;
+
+            try {
+                if (sign_clone_sslserver_cert_using_master) {
+                    CMS.debug("NamePanel: For this Cloned CA, always use its Master CA to generate " +
+                              "the 'sslserver' certificate to avoid any changes which may have been " +
+                              "made to the X500Name directory string encoding order.");
+                    caHostname = config.getString("preop.master.hostname", "");
+                    caPort = config.getInteger("preop.master.httpsport", -1);
+
+                } else {
+                    caHostname = config.getString("preop.ca.hostname", "");
+                    caPort = config.getInteger("preop.ca.httpsport", -1);
+                }
+
+            } catch (Exception ee) {
+                CMS.debug(ee);
+            }
+
+            String content = "requestor_name=" + sysType + "-" + machineName + "-" + securePort
+                    + "&profileId=" + profileId
+                    + "&cert_request_type=pkcs10&cert_request=" + URLEncoder.encode(pkcs10, "UTF-8")
+                    + "&xmlOutput=true"
+                    + "&sessionID=" + sessionId;
+
+            cert = CertUtil.createRemoteCert(caHostname, caPort, content, response, panel);
+
+            if (cert == null) {
+                throw new IOException("Error: remote certificate is null");
+            }
+
+            if (sign_clone_sslserver_cert_using_master) {
+                // restore original 'CS.cfg' entries
+                config.putString("preop.ca.type", preop_ca_type);
+                config.putString("preop.cert.signing.type", preop_cert_signing_type);
+                config.putString("preop.cert.signing.profile", preop_cert_signing_profile);
+                config.putString("preop.cert.sslserver.type", preop_cert_sslserver_type);
+                config.putString("preop.cert.sslserver.profile", preop_cert_sslserver_profile);
+
+                // reset master/clone signature flag
+                sign_clone_sslserver_cert_using_master = false;
+            }
+
+        } else if (v.equals("otherca")) {
+            config.putString(subsystem + "." + certTag + ".cert",
+                    "...paste certificate here...");
+
+        } else {
+            CMS.debug("ConfigurationUtils.createRemoteCert(): no preop.ca.type is provided");
+        }
+
+        return cert;
+    }
+
+    public static X509CertImpl createLocalCert(Context context, Cert certObj, String caType)
+            throws IOException, EBaseException, InvalidKeyException {
+
+        String certTag = certObj.getCertTag();
+
+        IConfigStore config = CMS.getConfigStore();
+        ISubsystem ca = CMS.getSubsystem(ICertificateAuthority.ID);
+
+        if (ca == null) {
+            String s = PCERT_PREFIX + certTag + ".type";
+
+            CMS.debug("The value for " + s + " should be remote, nothing else.");
+            throw new IOException("The value for " + s + " should be remote");
+        }
+
+        String pubKeyType = config.getString(PCERT_PREFIX + certTag + ".keytype");
+
+        if (pubKeyType.equals("rsa")) {
+
+            String pubKeyModulus = config.getString(PCERT_PREFIX + certTag + ".pubkey.modulus");
+            String pubKeyPublicExponent = config.getString(PCERT_PREFIX + certTag + ".pubkey.exponent");
+            String subsystem = config.getString(PCERT_PREFIX + certTag + ".subsystem");
+
+            if (certTag.equals("signing")) {
+                X509Key x509key = CryptoUtil.getPublicX509Key(
+                        CryptoUtil.string2byte(pubKeyModulus),
+                        CryptoUtil.string2byte(pubKeyPublicExponent));
+
+                return CertUtil.createLocalCert(config, x509key,
+                        PCERT_PREFIX, certTag, caType, context);
+
+            } else {
+                String cacert = config.getString("ca.signing.cert", "");
+
+                if (cacert.equals("") || cacert.startsWith("...")) {
+                    certObj.setCert(
+                            "...certificate be generated internally...");
+                    config.putString(subsystem + "." + certTag + ".cert",
+                            "...certificate be generated internally...");
+
+                } else {
+                    X509Key x509key = CryptoUtil.getPublicX509Key(
+                            CryptoUtil.string2byte(pubKeyModulus),
+                            CryptoUtil.string2byte(pubKeyPublicExponent));
+
+                    return CertUtil.createLocalCert(config, x509key,
+                            PCERT_PREFIX, certTag, caType, context);
+                }
+            }
+
+        } else if (pubKeyType.equals("ecc")) {
+
+            String pubKeyEncoded = config.getString(PCERT_PREFIX + certTag + ".pubkey.encoded");
+            String subsystem = config.getString(PCERT_PREFIX + certTag + ".subsystem");
+
+            if (certTag.equals("signing")) {
+                X509Key x509key = CryptoUtil.getPublicX509ECCKey(CryptoUtil.string2byte(pubKeyEncoded));
+                return CertUtil.createLocalCert(config, x509key,
+                        PCERT_PREFIX, certTag, caType, context);
+
+            } else {
+                String cacert = config.getString("ca.signing.cert", "");
+
+                if (cacert.equals("") || cacert.startsWith("...")) {
+                    certObj.setCert("...certificate be generated internally...");
+                    config.putString(subsystem + "." + certTag + ".cert",
+                            "...certificate be generated internally...");
+
+                } else {
+                    X509Key x509key = CryptoUtil.getPublicX509ECCKey(
+                            CryptoUtil.string2byte(pubKeyEncoded));
+
+                    return CertUtil.createLocalCert(config, x509key,
+                            PCERT_PREFIX, certTag, caType, context);
+                }
+            }
+
+        } else {
+            // invalid key type
+            CMS.debug("Invalid key type " + pubKeyType);
+        }
+
+        return null;
+    }
+
     public static void updateConfig(IConfigStore config, String certTag)
             throws EBaseException, IOException {
         String token = config.getString("preop.module.token");
-- 
1.8.4.2

