};
public static final ServiceResponseInfo checkClientCert(HttpServletRequest request, File x509CRLLocation)
{
log.info("Checking Client Certificate");
ServiceResponseInfo sb = null;
sb = new ServiceResponseInfo();
String hostName = request.getRemoteHost();
X509Certificate[] certs = (X509Certificate[]) request
.getAttribute("javax.servlet.request.X509Certificate");
if (certs == null)
{
sb.noteError("Client certificate is missing");
return sb;
}
X509Certificate cert = certs[0];
log.debug("Content Type: " + request.getContentType());
log.debug("Prinicipal Name" + cert.getSubjectX500Principal().getName());
log.debug("Host Name: " + hostName);
log.debug(cert.getIssuerDN());
try {
// Get the InetAddress.
InetAddress inetClient = InetAddress.getByName(request.getRemoteAddr());
log.debug ("Client Host: " + inetClient.getHostName());
log.debug ("Client IP Address: " + inetClient.getHostAddress());
String hostNameStringArray[] = cert.getSubjectDN().getName().split(
",");
String hostNameString = hostNameStringArray[0].substring(3);
InetAddress inetCN = InetAddress.getByName(hostNameString);
log.debug ("Host from cert: " + inetCN.getHostName());
log.debug ("Host IP from cert: " + inetCN.getHostAddress());
//TODO We need to figure out we want to conduct this test, We might not want to allow anyone in if this fails
if (!inetClient.getHostAddress().toString().equals(inetCN.getHostAddress().toString()))
{
log.warn("Client Host name on wire: " + inetClient.getHostName() + " for IP Address: " + inetClient.getHostAddress()
+ " did not match address from cert, host name: " + inetCN.getHostName() + ", host address " + inetCN.getHostAddress());
}
} catch( UnknownHostException uhe ){
//log.debug("UnknownHostException: "+uhe.toString());
//sb.noteError(uhe.getMessage());
//return sb;
log.warn("UnknownHostException", uhe);
}
try {
SecurityHelperMethods.checkCRL(cert, x509CRLLocation, true);
} catch (CertPathValidatorException e1) {
log.error("The CRL check return an exception", e1);
sb.noteError(e1.getMessage());
return sb;
}
try {
certs[0].checkValidity();
} catch (CertificateExpiredException e) {
log.error("The certificate validity check return an exception", e);
sb.noteError(e.getMessage());
return sb;
} catch (CertificateNotYetValidException e) {
log.error("The certificate validity check return an exception", e);
sb.noteError(e.getMessage());
return sb;
}
return sb;
}