<commit_before>package com.izforge.izpack.util;

import java.io.File;
import java.io.FileOutputStream;
import java.io.FileWriter;
import java.math.BigInteger;
import java.security.InvalidKeyException;
import java.security.KeyPair;
import java.security.KeyPairGenerator;
import java.security.KeyStore;
import java.security.NoSuchProviderException;
import java.security.SecureRandom;
import java.security.Security;
import java.security.SignatureException;
import java.security.cert.Certificate;
import java.security.cert.X509Certificate;
import java.util.ArrayList;
import java.util.Calendar;
import java.util.Date;
import java.util.List;

import org.bouncycastle.asn1.x500.X500NameBuilder;
import org.bouncycastle.asn1.x500.style.BCStyle;
import org.bouncycastle.asn1.x509.AuthorityKeyIdentifier;
import org.bouncycastle.asn1.x509.BasicConstraints;
import org.bouncycastle.asn1.x509.ExtendedKeyUsage;
import org.bouncycastle.asn1.x509.Extension;
import org.bouncycastle.asn1.x509.GeneralName;
import org.bouncycastle.asn1.x509.GeneralNames;
import org.bouncycastle.asn1.x509.KeyPurposeId;
import org.bouncycastle.asn1.x509.KeyUsage;
import org.bouncycastle.asn1.x509.X509Extension;
import org.bouncycastle.asn1.x509.X509Extensions;
import org.bouncycastle.cert.X509v3CertificateBuilder;
import org.bouncycastle.cert.jcajce.JcaX509CertificateConverter;
import org.bouncycastle.cert.jcajce.JcaX509v3CertificateBuilder;
import org.bouncycastle.openssl.PEMWriter;
import org.bouncycastle.operator.ContentSigner;
import org.bouncycastle.operator.jcajce.JcaContentSignerBuilder;
import org.bouncycastle.x509.X509V3CertificateGenerator;
import org.bouncycastle.x509.extension.AuthorityKeyIdentifierStructure;
import org.bouncycastle.x509.extension.SubjectKeyIdentifierStructure;

import com.izforge.izpack.installer.AutomatedInstallData;
import com.izforge.izpack.installer.DataValidator;
import com.izforge.izpack.installer.DataValidator.Status;


public class CreateCertsValidator implements DataValidator
{

    private String strMessage = "";
    public static final String strMessageId = "messageid";
    public static final String strMessageValue = "message.oldvalue"; // not to be stored

    public Status validateData(AutomatedInstallData adata)
    {

        try
        {
            // first create CA
            KeyPair pairCA = generateRSAKeyPair(4096);
            
            String countryCode = adata.getVariable("mongodb.ssl.certificate.countrycode");
            String state = adata.getVariable("mongodb.ssl.certificate.state");
            String city = adata.getVariable("mongodb.ssl.certificate.city");
            String organization = adata.getVariable("mongodb.ssl.certificate.organization");
            String organizationalUnit = adata.getVariable("mongodb.ssl.certificate.organisationalunit");
            String name = adata.getVariable("mongodb.ssl.certificate.name");
            String email = adata.getVariable("mongodb.ssl.certificate.email");
            int validity = Integer.parseInt(adata.getVariable("mongodb.ssl.certificate.validity"));

            X509Certificate cacert = generateCAV3Certificate(pairCA, countryCode, organization, organizationalUnit,
                    state, city, name, email, validity);
            
            String strCertPath = adata.getVariable("mongodb.dir.certs");
            File dirCerts =  new File (strCertPath);
            if (!dirCerts.exists()) dirCerts.mkdirs();
            
            FileWriter cacertfile = new FileWriter(strCertPath + File.separator + "ca.cacrt");
            PEMWriter pem = new PEMWriter(cacertfile);
            pem.writeObject(cacert);
            pem.close();
            
            String capassphrase = adata.getVariable("mongodb.ssl.capassphrase");
            KeyPairGeneratorDataValidator.writePrivateKey(strCertPath + File.separator + "ca.key", pairCA, capassphrase.toCharArray());
            
            
            // then create server cert
            KeyPair pairServer = generateRSAKeyPair(2048);
            
            String hostname = adata.getVariable("mongodb.ssl.certificate.hostname");
            X509Certificate servercert = generateServerV3Certificate(pairServer, countryCode, organization, organizationalUnit,
                    state, city, hostname, null, validity, cacert , pairCA);
            
            FileWriter servercertfile = new FileWriter(strCertPath + File.separator + hostname + ".crt");
            pem = new PEMWriter(servercertfile);
            pem.writeObject(servercert);
            pem.close();
            
            KeyStore keyStore = KeyStore.getInstance("PKCS12", "BC");
            keyStore.load(null, null);
            keyStore.setKeyEntry("trust", pairServer.getPrivate(), null, new Certificate[] { servercert });
            String exportPassword = "<PASSWORD>";
            keyStore.store(new FileOutputStream( strCertPath + File.separator + hostname + ".p12"), exportPassword.toCharArray());

            
            String serverpassphrase = adata.getVariable("mongodb.ssl.serverpassphrase");
            if (serverpassphrase != null) {
              KeyPairGeneratorDataValidator.writePrivateKey(strCertPath + File.separator + hostname + ".key", pairServer, serverpassphrase.toCharArray());
            } else {
              KeyPairGeneratorDataValidator.writePrivateKey(strCertPath + File.separator + hostname + ".key", pairServer, null);
            }
            adata.setVariable("mongodb.ssl.usecafile", "true");
            
            File pemKeyFile = new File(strCertPath + File.separator + hostname + ".pem");
            File certFile = new File(strCertPath + File.separator + hostname + ".crt");
            File privKeyFile = new File(strCertPath + File.separator + hostname + ".key");
            
            KeyPairGeneratorDataValidator.mergeFiles(new File[]{certFile,privKeyFile}, pemKeyFile);

            // then  create a client cert
            KeyPair pairClient = generateRSAKeyPair(2048);
            X509Certificate clientcert = generateClientV3Certificate(pairClient, countryCode, organization, organizationalUnit,
                    state, city, name, email, validity, cacert , pairCA);
            
            FileWriter clientcertfile = new FileWriter(strCertPath + File.separator + "client.crt");
            pem = new PEMWriter(clientcertfile);
            pem.writeObject(clientcert);
            pem.close();
            
            //String serverpassphrase = adata.getVariable("mongodb.ssl.serverpassphrase");
            KeyPairGeneratorDataValidator.writePrivateKey(strCertPath + File.separator + "client.key", pairClient, null);

            File pemClientKeyFile = new File(strCertPath + File.separator + "client.pem");
            File certClientFile = new File(strCertPath + File.separator + "client.crt");
            File privClientKeyFile = new File(strCertPath + File.separator + "client.key");
            
            KeyPairGeneratorDataValidator.mergeFiles(new File[]{certClientFile,privClientKeyFile}, pemClientKeyFile);
            
            // we need to says that this step was done at least one time
            adata.setVariable("mongodb.ssl.alreadydone", "true");
            
            return Status.OK;
            
        }
        catch (Exception ex)
        {
            strMessage = ex.getMessage();<commit_msg>X3-196435 - windows store<commit_after>package com.izforge.izpack.util;

import java.io.File;
import java.io.FileOutputStream;
import java.io.FileWriter;
import java.math.BigInteger;
import java.security.InvalidKeyException;
import java.security.KeyPair;
import java.security.KeyPairGenerator;
import java.security.KeyStore;
import java.security.NoSuchProviderException;
import java.security.SecureRandom;
import java.security.Security;
import java.security.SignatureException;
import java.security.cert.Certificate;
import java.security.cert.X509Certificate;
import java.util.ArrayList;
import java.util.Calendar;
import java.util.Date;
import java.util.List;

import org.bouncycastle.asn1.x500.X500NameBuilder;
import org.bouncycastle.asn1.x500.style.BCStyle;
import org.bouncycastle.asn1.x509.AuthorityKeyIdentifier;
import org.bouncycastle.asn1.x509.BasicConstraints;
import org.bouncycastle.asn1.x509.ExtendedKeyUsage;
import org.bouncycastle.asn1.x509.Extension;
import org.bouncycastle.asn1.x509.GeneralName;
import org.bouncycastle.asn1.x509.GeneralNames;
import org.bouncycastle.asn1.x509.KeyPurposeId;
import org.bouncycastle.asn1.x509.KeyUsage;
import org.bouncycastle.asn1.x509.X509Extension;
import org.bouncycastle.asn1.x509.X509Extensions;
import org.bouncycastle.cert.X509v3CertificateBuilder;
import org.bouncycastle.cert.jcajce.JcaX509CertificateConverter;
import org.bouncycastle.cert.jcajce.JcaX509v3CertificateBuilder;
import org.bouncycastle.openssl.PEMWriter;
import org.bouncycastle.operator.ContentSigner;
import org.bouncycastle.operator.jcajce.JcaContentSignerBuilder;
import org.bouncycastle.x509.X509V3CertificateGenerator;
import org.bouncycastle.x509.extension.AuthorityKeyIdentifierStructure;
import org.bouncycastle.x509.extension.SubjectKeyIdentifierStructure;

import com.izforge.izpack.installer.AutomatedInstallData;
import com.izforge.izpack.installer.DataValidator;
import com.izforge.izpack.installer.DataValidator.Status;


public class CreateCertsValidator implements DataValidator
{

    private String strMessage = "";
    public static final String strMessageId = "messageid";
    public static final String strMessageValue = "message.oldvalue"; // not to be stored

    public Status validateData(AutomatedInstallData adata)
    {

        try
        {
            // first create CA
            KeyPair pairCA = generateRSAKeyPair(4096);
            
            String countryCode = adata.getVariable("mongodb.ssl.certificate.countrycode");
            String state = adata.getVariable("mongodb.ssl.certificate.state");
            String city = adata.getVariable("mongodb.ssl.certificate.city");
            String organization = adata.getVariable("mongodb.ssl.certificate.organization");
            String organizationalUnit = adata.getVariable("mongodb.ssl.certificate.organisationalunit");
            String name = adata.getVariable("mongodb.ssl.certificate.name");
            String email = adata.getVariable("mongodb.ssl.certificate.email");
            int validity = Integer.parseInt(adata.getVariable("mongodb.ssl.certificate.validity"));

            X509Certificate cacert = generateCAV3Certificate(pairCA, countryCode, organization, organizationalUnit,
                    state, city, name, email, validity);
            
            String strCertPath = adata.getVariable("mongodb.dir.certs");
            File dirCerts =  new File (strCertPath);
            if (!dirCerts.exists()) dirCerts.mkdirs();
            
            FileWriter cacertfile = new FileWriter(strCertPath + File.separator + "ca.cacrt");
            PEMWriter pem = new PEMWriter(cacertfile);
            pem.writeObject(cacert);
            pem.close();
            
            String capassphrase = adata.getVariable("mongodb.ssl.capassphrase");
            KeyPairGeneratorDataValidator.writePrivateKey(strCertPath + File.separator + "ca.key", pairCA, capassphrase.toCharArray());
            
            
            // then create server cert
            KeyPair pairServer = generateRSAKeyPair(4096);
            
            String hostname = adata.getVariable("mongodb.ssl.certificate.hostname");
            X509Certificate servercert = generateServerV3Certificate(pairServer, countryCode, organization, organizationalUnit,
                    state, city, hostname, null, validity, cacert , pairCA);
            
            FileWriter servercertfile = new FileWriter(strCertPath + File.separator + hostname + ".crt");
            pem = new PEMWriter(servercertfile);
            pem.writeObject(servercert);
            pem.close();
            
            // Starting with mongo 4.0 on windows the certificate must be put in windows store
            KeyStore keyStore = KeyStore.getInstance("PKCS12", "BC");
            keyStore.load(null, null);
            keyStore.setKeyEntry("trust", pairServer.getPrivate(), null, new Certificate[] { servercert });
            String serverpassphrase = adata.getVariable("mongodb.ssl.serverpassphrase");
            keyStore.store(new FileOutputStream( strCertPath + File.separator + hostname + ".p12"), serverpassphrase.toCharArray());
            
            KeyPairGeneratorDataValidator.writePrivateKey(strCertPath + File.separator + hostname + ".key", pairServer, serverpassphrase.toCharArray());
            
            adata.setVariable("mongodb.ssl.usecafile", "true");
            
            File pemKeyFile = new File(strCertPath + File.separator + hostname + ".pem");
            File certFile = new File(strCertPath + File.separator + hostname + ".crt");
            File privKeyFile = new File(strCertPath + File.separator + hostname + ".key");
            
            KeyPairGeneratorDataValidator.mergeFiles(new File[]{certFile,privKeyFile}, pemKeyFile);

            // then  create a client cert
            KeyPair pairClient = generateRSAKeyPair(4096);
            X509Certificate clientcert = generateClientV3Certificate(pairClient, countryCode, organization, organizationalUnit,
                    state, city, name, email, validity, cacert , pairCA);
            
            FileWriter clientcertfile = new FileWriter(strCertPath + File.separator + "client.crt");
            pem = new PEMWriter(clientcertfile);
            pem.writeObject(clientcert);
            pem.close();
            
            //String serverpassphrase = adata.getVariable("mongodb.ssl.serverpassphrase");
            KeyPairGeneratorDataValidator.writePrivateKey(strCertPath + File.separator + "client.key", pairClient, null);

            File pemClientKeyFile = new File(strCertPath + File.separator + "client.pem");
            File certClientFile = new File(strCertPath + File.separator + "client.crt");
            File privClientKeyFile = new File(strCertPath + File.separator + "client.key");
            
            KeyPairGeneratorDataValidator.mergeFiles(new File[]{certClientFile,privClientKeyFile}, pemClientKeyFile);
            
            // we need to says that this step was done at least one time
            adata.setVariable("mongodb.ssl.alreadydone", "true");
            
            return Status.OK;
            
        }
        catch (Exception ex)
        {
            strMessage = ex.getMessage();
{'fraction_non_alphanumeric': 0.09534899650661004, 'fraction_numerical': 0.015959997260086307, 'mean_word_length': 3.0499306518723994, 'pattern_counts': {'":': 0, '<': 4, '<?xml version=': 0, '>': 4, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '1690220', 'n_tokens_mistral': 4228, 'n_tokens_neox': 3976, 'n_words': 746}