Csiv2IorInterceptor.java

package org.objectweb.jonas.security.iiop;

import java.rmi.Remote;

import javax.rmi.CORBA.Tie;

import org.jacorb.orb.iiop.IIOPProfile;
import org.jacorb.poa.RequestProcessor;
import org.omg.CORBA.Any;
import org.omg.CORBA.INV_POLICY;
import org.omg.CSIIOP.AS_ContextSec;
import org.omg.CSIIOP.CompoundSecMech;
import org.omg.CSIIOP.CompoundSecMechList;
import org.omg.CSIIOP.CompoundSecMechListHelper;
import org.omg.CSIIOP.DetectMisordering;
import org.omg.CSIIOP.DetectReplay;
import org.omg.CSIIOP.Integrity;
import org.omg.CSIIOP.SAS_ContextSec;
import org.omg.CSIIOP.ServiceConfiguration;
import org.omg.CSIIOP.TAG_CSI_SEC_MECH_LIST;
import org.omg.CSIIOP.TAG_NULL_TAG;
import org.omg.CSIIOP.TAG_TLS_SEC_TRANS;
import org.omg.CSIIOP.TLS_SEC_TRANS;
import org.omg.CSIIOP.TLS_SEC_TRANSHelper;
import org.omg.IOP.Codec;
import org.omg.IOP.TAG_INTERNET_IOP;
import org.omg.IOP.TaggedComponent;
import org.omg.IOP.CodecPackage.InvalidTypeForEncoding;
import org.omg.PortableInterceptor.IORInfo;
import org.omg.PortableServer.Servant;
import org.omg.SSLIOP.SSL;
import org.omg.SSLIOP.SSLHelper;
import org.omg.SSLIOP.TAG_SSL_SEC_TRANS;

import org.objectweb.carol.util.csiv2.SasComponent;
import org.objectweb.carol.util.csiv2.SasPolicy;
import org.objectweb.carol.util.csiv2.struct.AsStruct;
import org.objectweb.carol.util.csiv2.struct.SasStruct;
import org.objectweb.carol.util.csiv2.struct.TransportStruct;

import org.objectweb.jonas_ejb.container.JHome;
import org.objectweb.jonas_ejb.container.JRemote;
import org.objectweb.jonas_ejb.deployment.api.BeanDesc;

import org.objectweb.util.monolog.api.BasicLevel;
import org.objectweb.util.monolog.api.Logger;

public class Csiv2IorInterceptor extends org.omg.CORBA.LocalObject implements
        org.omg.PortableInterceptor.IORInterceptor {

    private static final String NAME = "Csiv2IorInterceptor";

    private Codec codec = null;

    private Logger logger = null;

    private Logger loggerDetails = null;

    public Csiv2IorInterceptor(Codec codec, Logger logger, Logger loggerDetails) {
        this.codec = codec;
        this.logger = logger;
        this.loggerDetails = loggerDetails;
    }

    public void establish_components(IORInfo info) {
        SasPolicy sasPolicy = null;
        SasComponent sasComponent = null;

        try {
            sasPolicy = (SasPolicy) info.get_effective_policy(SasPolicy.POLICY_TYPE);

            // build CSiv2 tagged component as required by spec
            // 16.3.1 compound mechnaisms [62] and 16.5.1 [132]
            TaggedComponent taggedComponent = null;

            if (sasPolicy != null) {
                sasComponent = sasPolicy.getSasComponent();
            } else {
                // It may be a remote interface
                Thread currentThread = Thread.currentThread();
                if (!(currentThread instanceof RequestProcessor)) {
                    return;
                }
                RequestProcessor rp = (RequestProcessor) currentThread;
                Servant servant = rp.getServant();
                if (servant == null) {
                    return;
                }
                Tie tie = null;
                if (!(servant instanceof Tie)) {
                    return;
                }
                tie = (Tie) servant;
                Remote target = tie.getTarget();
                if (target == null) {
                    return;
                }

                if (!(target instanceof JHome) && !(target instanceof JRemote)) {
                    return;
                }
                BeanDesc bd = null;
                if (target instanceof JHome) {
                    bd = ((JHome) target).getDd();
                } else if (target instanceof JRemote) {
                    bd =  ((JRemote) target).getBf().getDeploymentDescriptor();
                }
                sasComponent = bd.getSasComponent();
            }

            if (sasComponent == null) {
                loggerDetails.log(BasicLevel.DEBUG, "No Sas component was found, will not write any infos into IOR.");
                return;
            }

            try {

                taggedComponent = buildCSIv2Component(sasComponent);

                // And add it into the ior
                info.add_ior_component_to_profile(taggedComponent, TAG_INTERNET_IOP.value);

            } catch (Csiv2InterceptorException cie) {
                logger.log(BasicLevel.ERROR, "Cannot build Csiv2 component, cannot add it. Component = "
                        + taggedComponent);
            }

        } catch (INV_POLICY e) {
            if (logger.isLoggable(BasicLevel.DEBUG)) {
                logger.log(BasicLevel.DEBUG, "No policy found");
            }

        } finally {

            // Add SSL
            if (sasComponent != null) {
                // Need to patch profile port if SSL (port should be 0)
                TransportStruct transportStruct = sasComponent.getTransport();
                if (transportStruct.getTargetRequires() > 0) {
                    org.omg.ETF.Profile profile = ((org.jacorb.orb.portableInterceptor.IORInfoImpl) info).get_profile(0);
                    if (profile instanceof IIOPProfile) {
                        logger.log(BasicLevel.DEBUG, "Set port to 0");
                        ((IIOPProfile) profile).patchPrimaryAddress(null, 0);
                    }
                }
            }

            try {
                info.add_ior_component_to_profile(buildSslTaggedComponent(sasComponent), TAG_INTERNET_IOP.value);
            } catch (Csiv2InterceptorException cie) {
                logger.log(BasicLevel.ERROR, "Cannot add SSL tagged component" + cie.getMessage(), cie);
            }


        }


    }

    public void destroy() {
    }

    public String name() {
        return NAME;
    }

    private TaggedComponent buildCSIv2Component(SasComponent sasComponent) throws Csiv2InterceptorException {
        if (logger.isLoggable(BasicLevel.DEBUG)) {
            logger.log(BasicLevel.DEBUG, "");
        }

        // @see 16.5.1 [132] SecMechList
        // build list of compound_sec_mech
        CompoundSecMech[] mechanismList = buildCompoundSecMechs(sasComponent);
        CompoundSecMechList compoundSecMechList = new CompoundSecMechList(Csiv2Const.STATEFUL_MODE, mechanismList);


        // use Any object
        Any pAny = ORBHelper.getOrb().create_any();
        CompoundSecMechListHelper.insert(pAny, compoundSecMechList);
        byte[] componentData = null;
        try {
            componentData = codec.encode_value(pAny);
        } catch (InvalidTypeForEncoding itfe) {
            throw new Csiv2InterceptorException("Cannot encode a given any corba object", itfe);
        }

        // Create tagged component TAG_CSI_SEC_MECH_LIST
        TaggedComponent taggedComponent = new TaggedComponent(TAG_CSI_SEC_MECH_LIST.value, componentData);

        return taggedComponent;
    }

    private CompoundSecMech[] buildCompoundSecMechs(SasComponent sasComponent) throws Csiv2InterceptorException {
        if (logger.isLoggable(BasicLevel.DEBUG)) {
            logger.log(BasicLevel.DEBUG, "");
        }

        // build transport_mech
        TaggedComponent transportMech = buildTransportMech(sasComponent);

        // build as_context_mech
        AS_ContextSec asContextMech = buildAsContextMech(sasComponent);

        // build sas_context_mech
        SAS_ContextSec sasContextMech = buildSasContextMech(sasComponent);

        // See [135]
        // The target_requires field of the CompoundSecMech structure is used to
        // designate a required outcome that shall be satisfied by one or more
        // supporting (but not requiring) layers. The target_requires field also
        // represents all the options required independently by the various
        // layers as defined within the mechanism.
        short targetRequires = (short) (sasComponent.getTransport().getTargetRequires() | asContextMech.target_requires | sasContextMech.target_requires);

        // Only one compound sec mech
        CompoundSecMech[] compoundSecMechs = new CompoundSecMech[1];
        compoundSecMechs[0] = new CompoundSecMech(targetRequires, transportMech, asContextMech, sasContextMech);

        // return objects
        return compoundSecMechs;
    }

    private TaggedComponent buildTransportMech(SasComponent sasComponent) throws Csiv2InterceptorException {

        TaggedComponent taggedComponent = null;

        TransportStruct transportStruct = sasComponent.getTransport();

        if (transportStruct.getTargetSupports() == 0 && transportStruct.getTargetRequires() == 0) {
            // TAG_NULL_TAG [150] This new tagged component is used in the
            // transport_mech field of a CompoundSecMech structure to indicate that
            // the compound mechanism does not implement security functionality at
            // the transport layer.

            return new TaggedComponent(TAG_NULL_TAG.value, Csiv2Const.EMPTY_BYTES);
        }

        TLS_SEC_TRANS tlsSecTrans = new TLS_SEC_TRANS(transportStruct.getTargetSupports(), transportStruct.getTargetRequires(), transportStruct.getTransportAddress());

        // use Any object
        Any pAny = ORBHelper.getOrb().create_any();
        TLS_SEC_TRANSHelper.insert(pAny, tlsSecTrans);
        byte[] componentData = null;
        try {
            componentData = codec.encode_value(pAny);
        } catch (InvalidTypeForEncoding itfe) {
            throw new Csiv2InterceptorException("Cannot encode a given any corba object", itfe);
        }

        // Create tagged component TAG_CSI_SEC_MECH_LIST
        taggedComponent = new TaggedComponent(TAG_TLS_SEC_TRANS.value, componentData);

        return taggedComponent;
    }

    private TaggedComponent buildSslTaggedComponent(SasComponent sasComponent) throws Csiv2InterceptorException {

        SSL ssl = null;
        int minSSlOptions = Integrity.value | DetectReplay.value | DetectMisordering.value;
        if (sasComponent != null) {
            TransportStruct transportStruct = sasComponent.getTransport();

            ssl = new SSL(transportStruct.getTargetSupports(), transportStruct.getTargetRequires(), (short) transportStruct.getSslPort());
        } else {
            ssl = new SSL((short) minSSlOptions, (short) 0, (short) TransportStruct.DEFAULT_SSL_PORT);
        }

        // use Any object
        Any pAny = ORBHelper.getOrb().create_any();
        SSLHelper.insert(pAny, ssl);
        byte[] componentData = null;
        try {
            componentData = codec.encode_value(pAny);
        } catch (InvalidTypeForEncoding itfe) {
            throw new Csiv2InterceptorException("Cannot encode a given any corba object", itfe);
        }
        return new TaggedComponent(TAG_SSL_SEC_TRANS.value, componentData);

    }




    private AS_ContextSec buildAsContextMech(SasComponent sasComponent) {

        AsStruct asStruct = sasComponent.getAs();

        // The asStruct object could be for authenticated or no authenticated
        AS_ContextSec asContextMech = new AS_ContextSec(asStruct.getTargetSupports(), asStruct
                .getTargetRequires(), asStruct.getClientAuthenticationMech(), asStruct.getTargetName());

        return asContextMech;

    }

    private SAS_ContextSec buildSasContextMech(SasComponent sasComponent) {

        SasStruct sasStruct = sasComponent.getSas();

        ServiceConfiguration[] privilegeAuthorities = new ServiceConfiguration[0];

        byte[][] supportedNamingMechanisms = sasStruct.getSupportedNamingMechanisms();
        if (logger.isLoggable(BasicLevel.DEBUG)) {
            logger.log(BasicLevel.DEBUG, "supported mechanisms = " + supportedNamingMechanisms + " and identity = "
                    + sasStruct.getSupportedIdentityTypes());
            logger.log(BasicLevel.DEBUG, "supported mechanisms size= " + supportedNamingMechanisms.length);
            logger.log(BasicLevel.DEBUG, "target supports= " + sasStruct.getTargetSupports());
        }
        // should be ITTPrincipalName if supported
        int supportedIdentityTypes = sasStruct.getSupportedIdentityTypes();

        // build sas context with info of the given object.
        SAS_ContextSec sasContextMech = new SAS_ContextSec(sasStruct.getTargetSupports(),
                sasStruct.getTargetRequires(), privilegeAuthorities, supportedNamingMechanisms, supportedIdentityTypes);

        return sasContextMech;
    }



}

---