diff options
7 files changed, 170 insertions, 17 deletions
diff --git a/juick-server/src/main/java/com/juick/server/KeystoreManager.java b/juick-server/src/main/java/com/juick/server/KeystoreManager.java new file mode 100644 index 00000000..bb0de79d --- /dev/null +++ b/juick-server/src/main/java/com/juick/server/KeystoreManager.java @@ -0,0 +1,116 @@ +package com.juick.server; + +import org.slf4j.Logger; +import org.slf4j.LoggerFactory; +import org.springframework.beans.factory.annotation.Value; +import org.springframework.stereotype.Component; +import org.springframework.util.Base64Utils; +import sun.security.x509.*; + +import javax.annotation.PostConstruct; +import javax.net.ssl.KeyManagerFactory; +import java.io.FileInputStream; +import java.io.FileNotFoundException; +import java.io.IOException; +import java.io.InputStream; +import java.math.BigInteger; +import java.security.*; +import java.security.cert.Certificate; +import java.security.cert.CertificateException; +import java.security.cert.X509Certificate; +import java.util.Date; + +@Component +public class KeystoreManager { + private static final Logger logger = LoggerFactory.getLogger("com.juick.server"); + @Value("${keystore:juick.p12}") + private String keystore; + @Value("${keystore_password:secret}") + private String keystorePassword; + + private KeyStore ks; + + private KeyManagerFactory kmf; + + @PostConstruct + public void init() throws GeneralSecurityException, IOException { + try (InputStream ksIs = new FileInputStream(keystore)) { + ks = KeyStore.getInstance("PKCS12"); + ks.load(ksIs, keystorePassword.toCharArray()); + kmf = KeyManagerFactory.getInstance(KeyManagerFactory + .getDefaultAlgorithm()); + kmf.init(ks, keystorePassword.toCharArray()); + } catch (IOException | KeyStoreException | NoSuchAlgorithmException | UnrecoverableKeyException | CertificateException e) { + logger.warn("Keystore error, creating self-signed", e); + KeyPairGenerator keyPairGenerator = KeyPairGenerator.getInstance("RSA"); + keyPairGenerator.initialize(4096); + KeyPair keyPair = keyPairGenerator.generateKeyPair(); + + Certificate[] chain = {generateCertificate("cn=localhost", keyPair, 365, "SHA256withRSA")}; + + ks = KeyStore.getInstance(KeyStore.getDefaultType()); + ks.load(null, null); + ks.setKeyEntry("1", keyPair.getPrivate(), keystorePassword.toCharArray(), chain); + kmf = KeyManagerFactory.getInstance(KeyManagerFactory + .getDefaultAlgorithm()); + kmf.init(ks, keystorePassword.toCharArray()); + } + } + + public KeyStore getKeystore() { + return ks; + } + + public KeyManagerFactory getKeymanagerFactory() { + return kmf; + } + + private KeyPair getKeyPair() { + Key privateKey = null; + try { + privateKey = ks.getKey("1", keystorePassword.toCharArray()); + Certificate certificate = ks.getCertificate("1"); + return new KeyPair(certificate.getPublicKey(), (PrivateKey) privateKey); + } catch (KeyStoreException | NoSuchAlgorithmException | UnrecoverableKeyException e) { + e.printStackTrace(); + } + return null; + } + public String getPublicKey() { + return String.format("-----BEGIN RSA PUBLIC KEY-----\n%s\\n-----END RSA PUBLIC KEY-----\\n", + new String(Base64Utils.encode(getKeyPair().getPublic().getEncoded()))); + } + private X509Certificate generateCertificate(String dn, KeyPair keyPair, int validity, String sigAlgName) throws GeneralSecurityException, IOException { + PrivateKey privateKey = keyPair.getPrivate(); + + X509CertInfo info = new X509CertInfo(); + + Date from = new Date(); + Date to = new Date(from.getTime() + validity * 1000L * 24L * 60L * 60L); + + CertificateValidity interval = new CertificateValidity(from, to); + BigInteger serialNumber = new BigInteger(64, new SecureRandom()); + X500Name owner = new X500Name(dn); + AlgorithmId sigAlgId = new AlgorithmId(AlgorithmId.sha256WithRSAEncryption_oid); + + info.set(X509CertInfo.VALIDITY, interval); + info.set(X509CertInfo.SERIAL_NUMBER, new CertificateSerialNumber(serialNumber)); + info.set(X509CertInfo.SUBJECT, owner); + info.set(X509CertInfo.ISSUER, owner); + info.set(X509CertInfo.KEY, new CertificateX509Key(keyPair.getPublic())); + info.set(X509CertInfo.VERSION, new CertificateVersion(CertificateVersion.V3)); + info.set(X509CertInfo.ALGORITHM_ID, new CertificateAlgorithmId(sigAlgId)); + + // Sign the cert to identify the algorithm that's used. + X509CertImpl certificate = new X509CertImpl(info); + certificate.sign(privateKey, sigAlgName); + + // Update the algorith, and resign. + sigAlgId = (AlgorithmId) certificate.get(X509CertImpl.SIG_ALG); + info.set(CertificateAlgorithmId.NAME + "." + CertificateAlgorithmId.ALGORITHM, sigAlgId); + certificate = new X509CertImpl(info); + certificate.sign(privateKey, sigAlgName); + + return certificate; + } +} diff --git a/juick-server/src/main/java/com/juick/server/XMPPServer.java b/juick-server/src/main/java/com/juick/server/XMPPServer.java index 675d79da..f2e41750 100644 --- a/juick-server/src/main/java/com/juick/server/XMPPServer.java +++ b/juick-server/src/main/java/com/juick/server/XMPPServer.java @@ -70,10 +70,6 @@ public class XMPPServer implements ConnectionListener { private Jid jid; @Value("${s2s_port:5269}") private int s2sPort; - @Value("${keystore:juick.p12}") - public String keystore; - @Value("${keystore_password:secret}") - public String keystorePassword; @Value("${broken_ssl_hosts:}") public String[] brokenSSLhosts; @Value("${banned_hosts:}") @@ -111,21 +107,17 @@ public class XMPPServer implements ConnectionListener { private BasicXmppSession session; @Inject private UserService userService; + @Inject + private KeystoreManager keystoreManager; @PostConstruct public void init() throws KeyStoreException { closeFlag.set(false); - KeyStore ks = KeyStore.getInstance("PKCS12"); - try (InputStream ksIs = new FileInputStream(keystore)) { - ks.load(ksIs, keystorePassword.toCharArray()); - KeyManagerFactory kmf = KeyManagerFactory.getInstance(KeyManagerFactory - .getDefaultAlgorithm()); - kmf.init(ks, keystorePassword.toCharArray()); + try { sc = SSLContext.getInstance("TLSv1.2"); - sc.init(kmf.getKeyManagers(), trustAllCerts, new SecureRandom()); + sc.init(keystoreManager.getKeymanagerFactory().getKeyManagers(), trustAllCerts, new SecureRandom()); TrustManagerFactory trustManagerFactory = TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm()); - Set<TrustAnchor> ca = new HashSet<>(); trustManagerFactory.init((KeyStore)null); Arrays.stream(trustManagerFactory.getTrustManagers()).forEach(t -> Arrays.stream(((X509TrustManager)t).getAcceptedIssuers()).forEach(cert -> ca.add(new TrustAnchor(cert, null)))); diff --git a/juick-server/src/main/java/com/juick/server/api/activity/Profile.java b/juick-server/src/main/java/com/juick/server/api/activity/Profile.java index c0dcc3f6..0d987b58 100644 --- a/juick-server/src/main/java/com/juick/server/api/activity/Profile.java +++ b/juick-server/src/main/java/com/juick/server/api/activity/Profile.java @@ -1,6 +1,7 @@ package com.juick.server.api.activity; import com.juick.User; +import com.juick.server.KeystoreManager; import com.juick.server.api.activity.model.*; import com.juick.server.util.HttpNotFoundException; import com.juick.server.util.UserUtils; @@ -28,6 +29,8 @@ public class Profile { private UserService userService; @Inject private MessagesService messagesService; + @Inject + private KeystoreManager keystoreManager; @Value("${web_domain:localhost}") private String domain; @Value("${ap_base_uri:http://localhost:8080/}") @@ -44,6 +47,11 @@ public class Profile { uri.replacePath(String.format("/u/%s", userName)); person.setId(uri.toUriString()); person.setName(userName); + Key publicKey = new Key(); + publicKey.setId(person.getId() + "#main-key"); + publicKey.setOwner(person.getId()); + publicKey.setPublicKeyPem(keystoreManager.getPublicKey()); + person.setPublicKey(publicKey); uri.replacePath("/post"); person.setInbox(uri.toUriString()); person.setOutbox(uri.replacePath(String.format("/u/%s/blog/toc", userName)).toUriString()); diff --git a/juick-server/src/main/java/com/juick/server/api/activity/model/ActivityObject.java b/juick-server/src/main/java/com/juick/server/api/activity/model/ActivityObject.java index 7859be86..84a3e018 100644 --- a/juick-server/src/main/java/com/juick/server/api/activity/model/ActivityObject.java +++ b/juick-server/src/main/java/com/juick/server/api/activity/model/ActivityObject.java @@ -3,6 +3,9 @@ package com.juick.server.api.activity.model; import com.fasterxml.jackson.annotation.JsonProperty; import java.time.Instant; +import java.util.Arrays; +import java.util.Collections; +import java.util.List; public abstract class ActivityObject { @@ -23,11 +26,12 @@ public abstract class ActivityObject { } @JsonProperty("@context") - public String getContext() { - return CONTEXT_URI; + public List<String> getContext() { + return Arrays.asList(ACTIVITY_STREAMS_URI, SECURITY_URI); } - public final static String CONTEXT_URI = "https://www.w3.org/ns/activitystreams"; + public final static String ACTIVITY_STREAMS_URI = "https://www.w3.org/ns/activitystreams"; + public final static String SECURITY_URI = "https://w3id.org/security/v1"; public final static String LD_JSON_MEDIA_TYPE = "application/ld+json; profile=\"https://www.w3.org/ns/activitystreams\""; public final static String ACTIVITY_JSON_MEDIA_TYPE = "application/activity+json; profile=\"https://www.w3.org/ns/activitystreams\""; diff --git a/juick-server/src/main/java/com/juick/server/api/activity/model/Key.java b/juick-server/src/main/java/com/juick/server/api/activity/model/Key.java new file mode 100644 index 00000000..32417778 --- /dev/null +++ b/juick-server/src/main/java/com/juick/server/api/activity/model/Key.java @@ -0,0 +1,22 @@ +package com.juick.server.api.activity.model; + +public class Key extends ActivityObject { + private String owner; + private String publicKeyPem; + + public String getOwner() { + return owner; + } + + public void setOwner(String owner) { + this.owner = owner; + } + + public String getPublicKeyPem() { + return publicKeyPem; + } + + public void setPublicKeyPem(String publicKeyPem) { + this.publicKeyPem = publicKeyPem; + } +} diff --git a/juick-server/src/main/java/com/juick/server/api/activity/model/Person.java b/juick-server/src/main/java/com/juick/server/api/activity/model/Person.java index f4312ffc..97fa5ae8 100644 --- a/juick-server/src/main/java/com/juick/server/api/activity/model/Person.java +++ b/juick-server/src/main/java/com/juick/server/api/activity/model/Person.java @@ -9,6 +9,7 @@ public class Person extends ActivityObject { private String following; private String followers; private Link url; + private Key publicKey; @Override public String getType() { @@ -70,4 +71,12 @@ public class Person extends ActivityObject { public void setUrl(Link url) { this.url = url; } + + public Key getPublicKey() { + return publicKey; + } + + public void setPublicKey(Key publicKey) { + this.publicKey = publicKey; + } } diff --git a/juick-server/src/test/java/com/juick/server/tests/ServerTests.java b/juick-server/src/test/java/com/juick/server/tests/ServerTests.java index 3f196461..1931f13b 100644 --- a/juick-server/src/test/java/com/juick/server/tests/ServerTests.java +++ b/juick-server/src/test/java/com/juick/server/tests/ServerTests.java @@ -156,6 +156,8 @@ public class ServerTests { private ImagesService imagesService; @Inject private ServerManager serverManager; + @Inject + private KeystoreManager keystoreManager; @Value("${hostname:localhost}") private Jid jid; @Value("${xmppbot_jid:juick@localhost}") @@ -1342,8 +1344,8 @@ public class ServerTests { public void userProfileAndBlogShouldBeExposedAsActivityStream() throws Exception { mockMvc.perform(get("/u/ugnich").accept(ActivityObject.LD_JSON_MEDIA_TYPE)) .andExpect(status().isOk()) - .andExpect(jsonPath("$.@context", is(ActivityObject.CONTEXT_URI))) - .andExpect(jsonPath("$.icon.url", is("http://localhost:8080/i/a/1.png"))); + .andExpect(jsonPath("$.icon.url", is("http://localhost:8080/i/a/1.png"))) + .andExpect(jsonPath("$.publicKey.publicKeyPem", is(keystoreManager.getPublicKey()))); jdbcTemplate.execute("DELETE FROM messages"); List<Integer> mids = IteratorUtils.toList(IntStream.rangeClosed(1, 30) .mapToObj(i -> messagesService.createMessage(ugnich.getUid(), |