December 1st, 2009

X.509 Certificate Validation in Java: Build and Verify Chain and Verify CLR with Bouncy Castle

For one of my recent projects I needed to implement X.509 certificate validation library that validates a certificate across given set of trusted root certificated and a set of intermediate certificate. Initially I thought this is a problem that has already out-of-the-box solution in BouncyCastle but the CRL verification was found to be unpleasant to implement and not available out-of-the-box.
The task was formulated as follows: given a X.509 certificate and a set of trusted root certificates and a set of intermediate certificates to build a certification chain (if possible) and to extract the CRL distribution point from the certificate (if available) and to check whether the certificate is not revoked. It was required to support HTTP, HTPS, FTP and LDAP based distribution points.
I will not get into more details because I don’t heve too much time but I think the code is clear enough, so most developers will be able to read, understand and use it:

import java.security.GeneralSecurityException;
import java.security.InvalidKeyException;
import java.security.NoSuchAlgorithmException;
import java.security.NoSuchProviderException;
import java.security.PublicKey;
import java.security.SignatureException;
import java.security.cert.CertPathBuilder;
import java.security.cert.CertPathBuilderException;
import java.security.cert.CertStore;
import java.security.cert.CertificateException;
import java.security.cert.CollectionCertStoreParameters;
import java.security.cert.PKIXBuilderParameters;
import java.security.cert.PKIXCertPathBuilderResult;
import java.security.cert.TrustAnchor;
import java.security.cert.X509CertSelector;
import java.security.cert.X509Certificate;
import java.util.HashSet;
import java.util.Set;

/**
 * Class for building a certification chain for given certificate and verifying
 * it. Relies on a set of root CA certificates and intermediate certificates
 * that will be used for building the certification chain. The verification
 * process assumes that all self-signed certificates in the set are trusted
 * root CA certificates and all other certificates in the set are intermediate
 * certificates.
 * 
 * @author Svetlin Nakov
 */
public class CertificateVerifier {
	
	/**
	 * Attempts to build a certification chain for given certificate and to verify
	 * it. Relies on a set of root CA certificates and intermediate certificates
	 * that will be used for building the certification chain. The verification
	 * process assumes that all self-signed certificates in the set are trusted
	 * root CA certificates and all other certificates in the set are intermediate
	 * certificates. 
	 * 
	 * @param cert - certificate for validation
	 * @param additionalCerts - set of trusted root CA certificates that will be
	 * 		used as "trust anchors" and intermediate CA certificates that will be
	 * 		used as part of the certification chain. All self-signed certificates
	 * 		are considered to be trusted root CA certificates. All the rest are
	 * 		considered to be intermediate CA certificates.
	 * @return the certification chain (if verification is successful)
	 * @throws CertificateVerificationException - if the certification is not
	 * 		successful (e.g. certification path cannot be built or some
	 * 		certificate in the chain is expired or CRL checks are failed)
	 */
	public static PKIXCertPathBuilderResult verifyCertificate(X509Certificate cert, 
			Set<x509certificate> additionalCerts)
			throws CertificateVerificationException {
		try {
			// Check for self-signed certificate
			if (isSelfSigned(cert)) {
				throw new CertificateVerificationException(
					"The certificate is self-signed.");
			}
			
			// Prepare a set of trusted root CA certificates
			// and a set of intermediate certificates
			Set</x509certificate><x509certificate> trustedRootCerts = new HashSet</x509certificate><x509certificate>();
			Set</x509certificate><x509certificate> intermediateCerts = new HashSet</x509certificate><x509certificate>();
			for (X509Certificate additionalCert : additionalCerts) {
				if (isSelfSigned(additionalCert)) {
					trustedRootCerts.add(additionalCert);
				} else {
					intermediateCerts.add(additionalCert);
				}
			}
			
			// Attempt to build the certification chain and verify it
			PKIXCertPathBuilderResult verifiedCertChain = 
				verifyCertificate(cert, trustedRootCerts, intermediateCerts);
			
			// Check whether the certificate is revoked by the CRL
			// given in its CRL distribution point extension
			CRLVerifier.verifyCertificateCRLs(cert);
	
			// The chain is built and verified. Return it as a result
			return verifiedCertChain;
		} catch (CertPathBuilderException certPathEx) {
			throw new CertificateVerificationException(
				"Error building certification path: " + 
				cert.getSubjectX500Principal(), certPathEx);
		} catch (CertificateVerificationException cvex) {
			throw cvex;
		} catch (Exception ex) {
			throw new CertificateVerificationException(
				"Error verifying the certificate: " + 
				cert.getSubjectX500Principal(), ex);
		}		
	}
	
	/**
	 * Checks whether given X.509 certificate is self-signed.
	 */
	public static boolean isSelfSigned(X509Certificate cert)
			throws CertificateException, NoSuchAlgorithmException,
			NoSuchProviderException {
		try {
			// Try to verify certificate signature with its own public key
			PublicKey key = cert.getPublicKey();
			cert.verify(key);
			return true;
		} catch (SignatureException sigEx) {
			// Invalid signature --> not self-signed
			return false;
		} catch (InvalidKeyException keyEx) {
			// Invalid key --> not self-signed
			return false;
		}
	}
	
	/**
	 * Attempts to build a certification chain for given certificate and to verify
	 * it. Relies on a set of root CA certificates (trust anchors) and a set of
	 * intermediate certificates (to be used as part of the chain).
	 * @param cert - certificate for validation
	 * @param trustedRootCerts - set of trusted root CA certificates
	 * @param intermediateCerts - set of intermediate certificates
	 * @return the certification chain (if verification is successful)
	 * @throws GeneralSecurityException - if the verification is not successful
	 * 		(e.g. certification path cannot be built or some certificate in the
	 * 		chain is expired)
	 */
	private static PKIXCertPathBuilderResult verifyCertificate(X509Certificate cert, Set</x509certificate><x509certificate> trustedRootCerts,
			Set</x509certificate><x509certificate> intermediateCerts) throws GeneralSecurityException {
		
		// Create the selector that specifies the starting certificate
		X509CertSelector selector = new X509CertSelector(); 
	    selector.setCertificate(cert);
	    
	    // Create the trust anchors (set of root CA certificates)
	    Set<trustanchor> trustAnchors = new HashSet</trustanchor><trustanchor>();
	    for (X509Certificate trustedRootCert : trustedRootCerts) {
	    	trustAnchors.add(new TrustAnchor(trustedRootCert, null));
	    }
	    
	    // Configure the PKIX certificate builder algorithm parameters
	    PKIXBuilderParameters pkixParams = 
			new PKIXBuilderParameters(trustAnchors, selector);
		
		// Disable CRL checks (this is done manually as additional step)
		pkixParams.setRevocationEnabled(false);
	
		// Specify a list of intermediate certificates
		CertStore intermediateCertStore = CertStore.getInstance("Collection",
			new CollectionCertStoreParameters(intermediateCerts), "BC");
		pkixParams.addCertStore(intermediateCertStore);
	
		// Build and verify the certification chain
		CertPathBuilder builder = CertPathBuilder.getInstance("PKIX", "BC");
		PKIXCertPathBuilderResult result = 
			(PKIXCertPathBuilderResult) builder.build(pkixParams);
		return result;
	}
	
}

------------------------

import java.io.ByteArrayInputStream;
import java.io.IOException;
import java.io.InputStream;
import java.net.MalformedURLException;
import java.net.URL;
import java.security.cert.CRLException;
import java.security.cert.CertificateException;
import java.security.cert.CertificateFactory;
import java.security.cert.CertificateParsingException;
import java.security.cert.X509CRL;
import java.security.cert.X509Certificate;
import java.util.ArrayList;
import java.util.Hashtable;
import java.util.List;

import javax.naming.Context;
import javax.naming.NamingException;
import javax.naming.directory.Attribute;
import javax.naming.directory.Attributes;
import javax.naming.directory.DirContext;
import javax.naming.directory.InitialDirContext;

import org.bouncycastle.asn1.ASN1InputStream;
import org.bouncycastle.asn1.DERIA5String;
import org.bouncycastle.asn1.DERObject;
import org.bouncycastle.asn1.DEROctetString;
import org.bouncycastle.asn1.x509.CRLDistPoint;
import org.bouncycastle.asn1.x509.DistributionPoint;
import org.bouncycastle.asn1.x509.DistributionPointName;
import org.bouncycastle.asn1.x509.GeneralName;
import org.bouncycastle.asn1.x509.GeneralNames;
import org.bouncycastle.asn1.x509.X509Extensions;

/**
 * Class that verifies CRLs for given X509 certificate. Extracts the CRL
 * distribution points from the certificate (if available) and checks the
 * certificate revocation status against the CRLs coming from the
 * distribution points. Supports HTTP, HTTPS, FTP and LDAP based URLs.
 * 
 * @author Svetlin Nakov
 */
public class CRLVerifier {

/**
	 * Extracts the CRL distribution points from the certificate (if available)
	 * and checks the certificate revocation status against the CRLs coming from
	 * the distribution points. Supports HTTP, HTTPS, FTP and LDAP based URLs.
	 * 
	 * @param cert the certificate to be checked for revocation
	 * @throws CertificateVerificationException if the certificate is revoked
	 */
	public static void verifyCertificateCRLs(X509Certificate cert)
			throws CertificateVerificationException {
		try {
			List<string> crlDistPoints = getCrlDistributionPoints(cert);
			for (String crlDP : crlDistPoints) {
				X509CRL crl = downloadCRL(crlDP);
				if (crl.isRevoked(cert)) {
					throw new CertificateVerificationException(
							"The certificate is revoked by CRL: " + crlDP);
				}
			}
		} catch (Exception ex) {
			if (ex instanceof CertificateVerificationException) {
				throw (CertificateVerificationException) ex;
			} else {
				throw new CertificateVerificationException(
						"Can not verify CRL for certificate: " + 
						cert.getSubjectX500Principal());
			}
		}
	}

/**
	 * Downloads CRL from given URL. Supports http, https, ftp and ldap based URLs.
	 */
	private static X509CRL downloadCRL(String crlURL) throws IOException,
			CertificateException, CRLException,
			CertificateVerificationException, NamingException {
		if (crlURL.startsWith("http://") || crlURL.startsWith("https://")
				|| crlURL.startsWith("ftp://")) {
			X509CRL crl = downloadCRLFromWeb(crlURL);
			return crl;
		} else if (crlURL.startsWith("ldap://")) {
			X509CRL crl = downloadCRLFromLDAP(crlURL);
			return crl;
		} else {
			throw new CertificateVerificationException(
					"Can not download CRL from certificate " +
					"distribution point: " + crlURL);
		}
	}

/**
	 * Downloads a CRL from given LDAP url, e.g.
	 * ldap://ldap.infonotary.com/dc=identity-ca,dc=infonotary,dc=com
	 */
	private static X509CRL downloadCRLFromLDAP(String ldapURL) 
			throws CertificateException, NamingException, CRLException, 
			CertificateVerificationException {
		Hashtable</string><string , String> env = new Hashtable</string><string , String>();
		env.put(Context.INITIAL_CONTEXT_FACTORY, 
				"com.sun.jndi.ldap.LdapCtxFactory");
        env.put(Context.PROVIDER_URL, ldapURL);

DirContext ctx = new InitialDirContext(env);
        Attributes avals = ctx.getAttributes("");
        Attribute aval = avals.get("certificateRevocationList;binary");
        byte[] val = (byte[])aval.get();
        if ((val == null) || (val.length == 0)) {
        	throw new CertificateVerificationException(
        			"Can not download CRL from: " + ldapURL);
        } else {
        	InputStream inStream = new ByteArrayInputStream(val);
            CertificateFactory cf = CertificateFactory.getInstance("X.509");
        	X509CRL crl = (X509CRL)cf.generateCRL(inStream);
        	return crl;
        }
	}
	
	/**
	 * Downloads a CRL from given HTTP/HTTPS/FTP URL, e.g.
	 * http://crl.infonotary.com/crl/identity-ca.crl
	 */
	private static X509CRL downloadCRLFromWeb(String crlURL)
			throws MalformedURLException, IOException, CertificateException,
			CRLException {
		URL url = new URL(crlURL);
		InputStream crlStream = url.openStream();
		try {
			CertificateFactory cf = CertificateFactory.getInstance("X.509");
			X509CRL crl = (X509CRL) cf.generateCRL(crlStream);
			return crl;
		} finally {
			crlStream.close();
		}
	}

/**
	 * Extracts all CRL distribution point URLs from the "CRL Distribution Point"
	 * extension in a X.509 certificate. If CRL distribution point extension is
	 * unavailable, returns an empty list. 
	 */
	public static List</string><string> getCrlDistributionPoints(
			X509Certificate cert) throws CertificateParsingException, IOException {
		byte[] crldpExt = cert.getExtensionValue(
				X509Extensions.CRLDistributionPoints.getId());
		if (crldpExt == null) {
			List</string><string> emptyList = new ArrayList</string><string>();
			return emptyList;
		}
		ASN1InputStream oAsnInStream = new ASN1InputStream(
				new ByteArrayInputStream(crldpExt));
		DERObject derObjCrlDP = oAsnInStream.readObject();
		DEROctetString dosCrlDP = (DEROctetString) derObjCrlDP;
		byte[] crldpExtOctets = dosCrlDP.getOctets();
		ASN1InputStream oAsnInStream2 = new ASN1InputStream(
				new ByteArrayInputStream(crldpExtOctets));
		DERObject derObj2 = oAsnInStream2.readObject();
		CRLDistPoint distPoint = CRLDistPoint.getInstance(derObj2);
		List</string><string> crlUrls = new ArrayList</string><string>();
		for (DistributionPoint dp : distPoint.getDistributionPoints()) {
            DistributionPointName dpn = dp.getDistributionPoint();
            // Look for URIs in fullName
            if (dpn != null) {
                if (dpn.getType() == DistributionPointName.FULL_NAME) {
                    GeneralName[] genNames = GeneralNames.getInstance(
                        dpn.getName()).getNames();
                    // Look for an URI
                    for (int j = 0; j < genNames.length; j++) {
                        if (genNames[j].getTagNo() == GeneralName.uniformResourceIdentifier) {
                            String url = DERIA5String.getInstance(
                                genNames[j].getName()).getString();
                            crlUrls.add(url);
                        }
                    }
                }
            }
		}
		return crlUrls;
	}

}

------------------------

import java.security.cert.PKIXCertPathBuilderResult;

/**
 * This class keeps the result from the certificate verification
 * process. If the the certificate is verified as valid, the built
 * certification chain is stored in the Result property. If the
 * certificate is invalid, the problem is stored in the Exception
 * property. 
 * 
 * @author Svetlin Nakov
 */
public class CertificateVerificationResult {
	private boolean valid;
	private PKIXCertPathBuilderResult result;
	private Throwable exception;
	
	/**
	 * Constructs a certificate verification result for valid
	 * certificate by given certification path.
	 */
	public CertificateVerificationResult(
			PKIXCertPathBuilderResult result) {
		this.valid = true;
		this.result = result;
	}

/**
	 * Constructs a certificate verification result for invalid
	 * certificate by given exception that keeps the problem
	 * occurred during the verification process.
	 */
	public CertificateVerificationResult(Throwable exception) {
		this.valid = false;
		this.exception = exception;
	}

public boolean isValid() {
		return valid;
	}

public PKIXCertPathBuilderResult getResult() {
		return result;
	}

public Throwable getException() {
		return exception;
	}	
}

------------------------

/**
 * This class wraps an exception that could be thrown during
 * the certificate verification process.
 * 
 * @author Svetlin Nakov
 */
public class CertificateVerificationException extends Exception {
	private static final long serialVersionUID = 1L;

public CertificateVerificationException(String message, Throwable cause) {
        super(message, cause);
    }

public CertificateVerificationException(String message) {
        super(message);
    }
}

I hope the above coude could be useful to anybody trying to build and validate X.509 certificate chain and check the CRL revocation status.

Posted by nakov as java, blog at 12:10 AM EET

Comments Off

October 20th, 2009

Introduction to Programming with Java Book - New Web Site

My open-source book “Introduction to Programming with Java” has new Web site: www.introprogramming.info. The book is written by a team of 30 authors managed by me and is an excellent tutorial for beginners. It is a book about the fundamentals of computer programming, data strustures, algorithms and logical thinking, not just a Java book. The only weakness (or respectively a plus) is that it is entirely in Bulgarian (sorry, no transaltions are available).

Ето няколко полезни линка, свързани с книгата:

Posted by nakov as news, java, blog at 4:45 AM EEST

Comments Off

September 22nd, 2009

Java2Days Conference: 8-9 October 2009 in Bulgaria

All Java and Java EE developers are invited to the unique for the Balkans and Eastern Europe conference on Java technologies called Java2Days. At the conference distinguished speakers will talk in Sofia about Java, Java EE 6, JBoss, EJB 3.1, Spring Framework, JPA, OSGi, GWT, JSF, jBPM, Wicket, JRockit, cloud computing and other hot technologies. Some of the speakers:

Reza Rahman - independent Java EE consultant, co-author of the book “EJB 3 in Action”
Mircea Markus - core developer and trainer at JBoss
Bruno Bossola - agile coach at Vodafone Global and Java champion
John Willis - CEO at Zabovo Corp., cloud computing expert
Josh Long - enterprise architect, speaker, consultant, and author

For more information visit the conference official Web site: http://java2days.com/.

Posted by nakov as news, java, blog at 7:14 PM EEST

Comments Off

July 15th, 2009

JAX-RS, @Path, @PathParam and Optional Parameters

In a recent Java project I needed to develop and provide to external clients a RESTful Web Services interface to an internal system. After some research I found that using JAX-RS and its open-source implementation Jersey with Spring and Hibernate as back-end will be great technologies stack for this project. Seems easy but unfortunately I found that JAX-RS does not support optional path parameters.

Customer requested each service to have an optional path parameter called “format” that specifies the output format. All services were required to support multiple output formats: XML, plain text, CSV, JSON, PDF, etc. For example if I request this URL: http://myserver.com/services/location/3/format/xml, the output should be XML, but if I request just http://myserver.com/services/location/3 without “format” parameter, the result should be plain text.

Mandatory Path Parameters

Using a path pattern like this:

makes the parameter “format” mandatory. If we skip it, the request will not match the path.

Optional @Path Parameters in JAX-RS

Using regular expressions and a simple hack can overcome this limitation in JAX-RS. The following example defines two optional path parameters “format” and “encoding”:

Requesting http://localhost:8080/services/user/3, will return “No format specified. No encoding specified”.
Requesting http://localhost:8080/services/user/3/format/pdf/encoding/utf8, will return “Format=pdf Encoding=utf8″.
Requesting http://localhost:8080/services/user/3/encoding/utf8, will return “No format specified. Encoding=utf8″.

Flexible @Path Parameters in JAX-RS

If we need more flexibility, we can match the entire path ending in the REST request and map it in key-value style (HashMap< String, String >):

@GET
@Produces({"application/xml", "application/json", "plain/text"})
@Path("/location/{locationId}{path:.*}")
public Response getLocation(
  @PathParam("locationId") int locationId,
  @PathParam("path") String path) {
 Map< String, String> params = parsePath(path);
 String format = params.get("format");
 if ("xml".equals(format)) {
  String xml = "<location></location><id></id>" + locationId + "";
  return Response.status(200).type("application/xml").entity(xml).build();
 } else if ("json".equals(format)) {
  String json = "{ 'location' : { 'id' : '" + locationId + "' } }";
  return Response.status(200).type("application/json").entity(json).build();
 } else {
  String text = "Location: id=" + locationId;
  return Response.status(200).type("text/plain").entity(text).build();
 }
}

private Map< String, String > parsePath(String path) {
 if (path.startsWith("/")) {
  path = path.substring(1);
 }
 String[] pathParts = path.split("/");
 Map< String, String > pathMap = new HashMap< String, String >();
 for (int i=0; i < pathParts.length/2; i++) {
  String key = pathParts[2*i];
  String value = pathParts[2*i+1];
  pathMap.put(key, value);
 }
 return pathMap;
}

Requesting http://localhost:8080/services/location/3, will return “Location: id=3″.
Requesting http://localhost:8080/services/location/3/format/json, will return “{ ‘location’ : { ‘id’ : ‘3′ } }”.

Enjoy!

Posted by nakov as java, blog at 2:47 AM EEST

Comments Off

December 26th, 2008

The Book “Introduction to Programming with Java” is Finally Published

Recently my team of 20 authors and few editors working on creating a contemporary book about the fundamentals of computer programming, data structures and algorithms is ready with the public official release of the book: http://introjavabook.googlecode.com/files/Introduction-to-Programing-with-Java-Book-v1.01.pdf.

The book “Introduction to Programming with Java” focuses on the fundamentals of computer programming, logical, algorithmical thinking, problem solving, data structures and algorithms. It uses a contemporary object-oriented approach and language but is valuable for any non-Java programmer in the begginning of his career. The book is free and open-source.

The contents of the book:

Chapter 0. Preface
Chapter 1. Introduction to Programming
Chapter 2. Primitive Types and Variables
Chapter 3. Operators and Expressions
Chapter 4. Console Input and Output
Chapter 5. Conditional Statements
Chapter 6. Loops
Chapter 7. Arrays
Chapter 8. Numeral Systems
Chapter 9. Methods
Chapter 10. Recursion
Chapter 11. Creating and Using Objects
Chapter 12. Exceptions Handling
Chapter 13. Strings
Chapter 14. Defining Classes
Chapter 15. Text Files
Chapter 16. Linear Data Structures
Chapter 17. Trees and Graphs
Chapter 18. Dictionaries, Hash Tables and Sets
Chapter 19. Data Structures: Comparison and Best Practices
Chapter 20. Object-Oriented Programming Principles
Chapter 21. High-Quality Programming Code
Chapter 22. How to Solve Programming Tasks?
Chapter 23. Example Topic from Exam in NASD – 30.09.2005
Chapter 24. Example Topic from Exam in NASD – 8.04.2006
Chapter 25. Example Topic from Exam in NASD – 11.12.2005

More information is available on the book’s official Web site: http://www.introprogramming.info/.

Posted by nakov as news, java, blog at 3:36 PM EET

Comments Off

November 30th, 2008

Java SWING Error Dialog with Exception Details

I use SWING for long time but I am amazed how slowly this GUI framework evolve and how far is it comparing to Windows Forms, WPF and Flex. One of the small missing things in Swing is that there is not standard way to display an error message with Exception stacktrace. So I created such dialog and I want to share it with everybody using SWING. The result look like this (shrinked form):

When the dialog is expanded, it shows the exception:

It seems like creating such a dialog is trivial task but unfortunately you need to solve a number of problems related to correct positioning, scrolling issues, etc. When the exception is large, it needs a scroller. When the error description is logn it needs good layout and scroller. This makes the things a little bit challenging. See the code below (the ErrorDilaog class):

import java.awt.BorderLayout;
import java.awt.Dimension;
import java.awt.FlowLayout;
import java.awt.Font;
import java.awt.Point;
import java.awt.Toolkit;
import java.awt.event.ActionEvent;
import java.awt.event.ActionListener;
import java.awt.event.KeyEvent;
import java.io.PrintWriter;
import java.io.StringWriter;
import java.io.Writer;
import javax.swing.*;
import javax.swing.text.*;

/**
 * @author Svetlin Nakov
 */
@SuppressWarnings("serial")
public class ErrorDialog extends JDialog {

private static final String SHOW_DETAILS_TEXT = "Show Details ...";
 private static final String HIDE_DETAILS_TEXT = "Hide Details";
 private JButton jButtonClose;
 private ImagePanel imagePanelErrorIcon;
 private JButton jButtonShowHideDetails;
 private JPanel jPanelBottom;
 private JPanel jPanelCenter;
 private JPanel jPanelTop;
 private JScrollPane jScrollPaneErrorMsg;
 private JTextPane jTextPaneErrorMsg;
 private JScrollPane jScrollPaneException;
 private JTextArea jTextAreaException;

private static final String ERROR_ICON_RESOURCE_LOCATION =
  "Error-Icon.gif";

public ErrorDialog(String errorMessage) {
  this(errorMessage, null);
 }
 
 public ErrorDialog(String errorMessage, Throwable exception) {
  this.setTitle("Error");
  this.setModal(true);
  this.setResizable(false);
  this.setDefaultCloseOperation(DISPOSE_ON_CLOSE);

jPanelTop = new JPanel();
        imagePanelErrorIcon = new ImagePanel(ERROR_ICON_RESOURCE_LOCATION);
        jPanelTop.setLayout(null);
        jPanelTop.setPreferredSize(new Dimension(480, 100));
        imagePanelErrorIcon.setLocation(new Point(20, 36));
        jPanelTop.add(imagePanelErrorIcon);

jTextPaneErrorMsg = new JTextPane();
        jTextPaneErrorMsg.setFont(jTextPaneErrorMsg.getFont().deriveFont(
         jTextPaneErrorMsg.getFont().getStyle() | Font.BOLD,
         jTextPaneErrorMsg.getFont().getSize()+1));
        jTextPaneErrorMsg.setBorder(null);
        jTextPaneErrorMsg.setEditable(false);
        jTextPaneErrorMsg.setBackground(null);
        jScrollPaneErrorMsg = new JScrollPane(jTextPaneErrorMsg);
        jScrollPaneErrorMsg.setBorder(null);
        jScrollPaneErrorMsg.setSize(new Dimension(405, 80));
        jScrollPaneErrorMsg.setLocation(new Point(71, 13));
        jPanelTop.add(jScrollPaneErrorMsg);

jPanelCenter = new JPanel();
        jPanelCenter.setSize(new Dimension(420, 300));
        jTextAreaException = new JTextArea();
        jScrollPaneException = new JScrollPane(jTextAreaException);
        jScrollPaneException.setPreferredSize(new Dimension(470, 300));
        jPanelCenter.setLayout(new FlowLayout(FlowLayout.CENTER, 5, 5));
        jPanelCenter.add(jScrollPaneException);

jPanelBottom = new JPanel();
        jButtonShowHideDetails = new JButton();
        jButtonClose = new JButton();
        jPanelBottom.setLayout(new FlowLayout(FlowLayout.CENTER, 30, 15));

jButtonShowHideDetails.setText(SHOW_DETAILS_TEXT);
        jButtonShowHideDetails.addActionListener(new ActionListener() {
            public void actionPerformed(ActionEvent evt) {
                showHideExceptionDetails();
            }
        });
        jPanelBottom.add(jButtonShowHideDetails);

jButtonClose.setText("Close");
        jButtonClose.addActionListener(new ActionListener() {
            public void actionPerformed(ActionEvent evt) {
             dispose();
            }
        });
        jPanelBottom.add(jButtonClose);
 
        this.setLayout(new BorderLayout());
        this.add(jPanelTop, BorderLayout.NORTH);
        this.add(jPanelCenter, BorderLayout.CENTER);
        this.add(jPanelBottom, BorderLayout.SOUTH);

this.jTextPaneErrorMsg.setEditorKit(new VerticalCenteredEditorKit());
        this.jTextPaneErrorMsg.setText(errorMessage);
       
        this.jPanelCenter.setVisible(false);
       
        if (exception != null) {
         String exceptionText = getStackTraceAsString(exception);
         jTextAreaException.setText(exceptionText);
         jTextAreaException.setEditable(false);
        } else {
         this.jButtonShowHideDetails.setVisible(false);
        }

// Make [Escape] key as close button
  this.registerEscapeKey();

setDefaultCloseOperation(WindowConstants.DISPOSE_ON_CLOSE);
        setModal(true);
  this.pack();
  centerDialogOnTheScreen();
 }

private void centerDialogOnTheScreen() {
  Dimension screenSize = Toolkit.getDefaultToolkit().getScreenSize();
  Dimension dialogSize = this.getSize();
  int centerPosX = (screenSize.width - dialogSize.width) / 2;
  int centerPosY = (screenSize.height - dialogSize.height) / 2;
  setLocation(centerPosX, centerPosY);
 }
 
 private void showHideExceptionDetails() {
        if (this.jPanelCenter.isVisible()) {
            // Hide the exception details
            this.jButtonShowHideDetails.setText(SHOW_DETAILS_TEXT);
            this.jPanelCenter.setVisible(false);
      this.pack();
            centerDialogOnTheScreen();
        } else {
            // Show the exception details
            this.jButtonShowHideDetails.setText(HIDE_DETAILS_TEXT);
            this.jPanelCenter.setVisible(true);
      this.pack();
            centerDialogOnTheScreen();
        }
 }

private String getStackTraceAsString(Throwable exception) {
  Writer result = new StringWriter();
  PrintWriter printWriter = new PrintWriter(result);
  exception.printStackTrace(printWriter);
  return result.toString();
 }

/**
  * Make the [Escape] key to behave like the [Close] button.
  */
 public void registerEscapeKey() {
  KeyStroke escapeKeyStroke =
   KeyStroke.getKeyStroke(KeyEvent.VK_ESCAPE, 0, false);
  Action escapeAction = new AbstractAction() {
   private static final long serialVersionUID = 1L;

public void actionPerformed(ActionEvent e) {
    jButtonClose.doClick();
   }
  };

this.rootPane.getInputMap(JComponent.WHEN_IN_FOCUSED_WINDOW).put(
    escapeKeyStroke, "ESCAPE");
  this.rootPane.getActionMap().put("ESCAPE", escapeAction);
 }
 
 public void hideAndDisposeDialog() {
  this.setVisible(false);
  this.dispose();
 }

public static void showError(String errorMessage,
   Throwable throwable) {
  ErrorDialog errorDialog =
   new ErrorDialog(errorMessage, throwable);
  errorDialog.setVisible(true);  
 }

public static void showError(String errorMessage) {
  ErrorDialog.showError(errorMessage, null); 
 }
 
 public static void main(String[] args) {
  ErrorDialog.showError("This is an error message.", new Exception());
 }
}

@SuppressWarnings("serial")
class VerticalCenteredEditorKit extends StyledEditorKit {
 public ViewFactory getViewFactory() {
  return new StyledViewFactory();
 }

static class StyledViewFactory implements ViewFactory {
  public View create(Element elem) {
   String kind = elem.getName();
   if (kind != null) {
    if (kind.equals(AbstractDocument.ContentElementName)) {
     return new LabelView(elem);
    } else if (kind.equals(AbstractDocument.ParagraphElementName)) {
     return new ParagraphView(elem);
    } else if (kind.equals(AbstractDocument.SectionElementName)) {
     return new CenteredBoxView(elem, View.Y_AXIS);
    } else if (kind.equals(StyleConstants.ComponentElementName)) {
     return new ComponentView(elem);
    } else if (kind.equals(StyleConstants.IconElementName)) {
     return new IconView(elem);
    }
   }

// Default to text display
   return new LabelView(elem);
  }
 }
 
 static class CenteredBoxView extends BoxView {
  public CenteredBoxView(Element elem, int axis) {
   super(elem, axis);
  }

protected void layoutMajorAxis(int targetSpan, int axis, int[] offsets,
    int[] spans) {
   super.layoutMajorAxis(targetSpan, axis, offsets, spans);
   int textBlockHeight = 0;
   int offset = 0;

for (int i = 0; i < spans.length; i++) {
    textBlockHeight += spans[i];
   }
   offset = (targetSpan - textBlockHeight) / 2;
   for (int i = 0; i < offsets.length; i++) {
    offsets[i] += offset;
   }
  }
 }
}

The ImageUtils class provides a simplified API for loading images from a file:

import java.awt.Component;
import java.awt.Image;
import java.awt.MediaTracker;
import java.awt.Toolkit;
import java.io.ByteArrayOutputStream;
import java.io.IOException;
import java.io.InputStream;

/**
 * @author Svetlin Nakov
 */
public class ImageUtils {
 
 private static final int BUF_SIZE = 4096;

public static Image loadImageFromResource(String resourceLocation,
   Component imageOwner) {
  InputStream inputStream = ImageUtils.class.getClassLoader()
    .getResourceAsStream(resourceLocation);
  try {
   byte[] imageBinaryData = readStreamToEnd(inputStream);
   Image image = Toolkit.getDefaultToolkit().createImage(imageBinaryData);
   ImageUtils.ensureImageIsLoaded(image, imageOwner);
   return image;
  } catch (Exception ex) {
   throw new RuntimeException(
    "Cannot load image from resource: " + resourceLocation, ex);
  } finally {
   try {
    inputStream.close();
   } catch (IOException e) {
    // Ignore IO exceptions during file closing
   }
  }
 }

private static byte[] readStreamToEnd(InputStream inputStream)
 throws IOException {
  ByteArrayOutputStream output = new ByteArrayOutputStream(BUF_SIZE);
  byte[] buf = new byte[BUF_SIZE];
  while (true) {
   int bytesRead = inputStream.read(buf);
   if (bytesRead == -1) {
    // End of stream reached
    break;
   }
   output.write(buf, 0, bytesRead);
  }
  byte[] streamData = output.toByteArray();
  return streamData;
 }

public static void ensureImageIsLoaded(Image image, Component imageOwner) {
  MediaTracker mediaTracker = new MediaTracker(imageOwner);
  mediaTracker.addImage(image, 0);
  try {
   mediaTracker.waitForAll();
  } catch (InterruptedException intEx) {
   throw new RuntimeException("Image loading was interrupted.", intEx);
  }
 }

}

The class ImagePanel shows image in a JPanel:

import java.awt.Dimension;
import java.awt.Graphics;
import java.awt.Image;
import javax.swing.JPanel;

/**
 * @author Svetlin Nakov
 */
public class ImagePanel extends JPanel {

private static final long serialVersionUID = 3813223397371003521L;

private Image image;
 private int imageWidth;
 private int imageHeight;

public ImagePanel(String resourceLocation) {
  Image image = ImageUtils.loadImageFromResource(resourceLocation, this);
  setImage(image);
 }

public ImagePanel(Image image) {
  setImage(image);
 }

private void setImage(Image image) {
  this.image = image;
  this.imageWidth = this.image.getWidth(null);
  this.imageHeight = this.image.getHeight(null);
  Dimension imageSize = new Dimension(this.imageWidth, this.imageHeight);
  this.setSize(imageSize);
  this.setPreferredSize(imageSize);
 }
 
 @Override
 protected void paintComponent(Graphics gr) {
  super.paintComponent(gr);
  if (this.image != null) {
   gr.drawImage(image, 0, 0, this.imageWidth, this.imageHeight, this);
  }
 }
}

Download the entire example source code (Eclipse project): errordialog.zip.

I hope all this would be helpful to anyone. Enjoy!

Posted by nakov as java, blog at 11:31 PM EET

Comments Off

August 27th, 2008

Extract All Classes Loaded in the JVM into a Single JAR

Today I needed to optimize the file size for a commercial Java applet (Web form signer) that my team is developing in the last month. We use few external libraries (Bouncy Castle Crypto API and few others) and these libraries are above 2 MB in several JAR files. If we were developing server side application, it would not be a problem, but when we are building an applet, the size of the applet and all its JARs matters.

I needed to remove all unused classes from the JARs that my applet was including a part of itself. For example the Bouncy Castle JARs were about 1,6 MB but the applet used only a small part of all algorithms and standards implemented by these JARs.

Extracting All Classes Loaded in the JVM

My final goal was not only to remove all unused classes from all JAR files but also merge these JARs along with the applet classes into a single JAR file that has the smallest possible size. I came with the idea to run the applet, to go through all its functionality and to get a list of all classes currently loaded into the JVM executing the applet. At this moment all classes required by the applet for its normal work will be loaded in the JVM and all classes that was never used by the applet will not be loaded in the JVM. If I package all these classes into a new JARs, it will contain the minimal set of classes nedded by the applet along with the applet classes.

As fas as I know how the JVM and the class loaders behave, this should be correct - we can expect all classes required by the applet to be loaded in the JVM after its entire functionality is accessed at least once.

I had a serious problem: how to get a list of all classes loaded in the JVM.

List All Classes Loaded in the JVM

Geting a list of all classes that are loaded in the JVM at some moment is not easy job. We can write Java agent through the java.lang.instrument API but I needed to do this at runtime (just to add few lines to the applet). I found in Google a very nice class for accessing all classes loaded in the JVM written by Vladimir Roubtsov and published in Java World (http://www.javaworld.com/javaworld/javaqa/2003-07/01-qa-0711-classsrc.html). With few modifications it successfully listed all classes loaded in my applet.

Create a Single JAR with All Classes Loaded in the JVM

The next step was to create a single JAR with all classes loaded in the JVM. This was not complex. I created a class with few methods for copying all currently loaded classes into some directory specified as parameter. Here is the source code:

import java.io.File;
import java.io.FileOutputStream;
import java.io.IOException;
import java.io.InputStream;
import java.io.OutputStream;
import java.net.URL;

/***
 * This class extracts all classes loaded in the JVM and their binary contents
 * (.class files) into given directory so that you can create JAR archive later.
 * @author Svetlin Nakov - http://www.nakov.com
 */
public class AllClassesInJVMExtractor {

private final static int BUFFER_SIZE = 4096;

public static void extractAllClassesFromJVM(String destFolder)
			throws IOException {
		ClassLoader appLoader = ClassLoader.getSystemClassLoader();
		ClassLoader currentLoader = AllClassesInJVMExtractor.class.getClassLoader();

ClassLoader[] loaders = new ClassLoader[] { appLoader, currentLoader };
		final Class< ?>[] classes = ClassScope.getLoadedClasses(loaders);
		for (Class< ?> cls : classes) {
			String className = cls.getName();
			URL classLocation = ClassScope.getClassLocation(cls);
			System.out.println("Extracting class: " + className + " from " + 
					classLocation);
			String destFileName = destFolder + "/"
					+ className.replace(".", "/") + ".class";
			copyFile(classLocation, destFileName);
		}
	}

private static void copyFile(URL sourceURL, String destFileName)
			throws IOException {
		File destFile = new File(destFileName);
		File destDirectory = destFile.getParentFile();
		destDirectory.mkdirs();
		InputStream srcStream = sourceURL.openStream();
		try {
			OutputStream destStream = new FileOutputStream(destFile);
			try {
				copyStreams(srcStream, destStream);
			} finally {
				destStream.close();
			}
		} finally {
			srcStream.close();
		}
	}

private static void copyStreams(InputStream srcStream,
			OutputStream destStream) throws IOException {
		byte[] buf = new byte[BUFFER_SIZE];
		while (true) {
			int bytesRead = srcStream.read(buf);
			if (bytesRead == -1) {
				// End of stream reached
				return;
			}
			destStream.write(buf, 0, bytesRead);
		}
	}

}

It is not a rocket science. I go through all classes loaded by the current class loader and by the system class loader, get their fully qualified name (e.g. org.bouncycastle.cms.CMSSignedData) and their source URL location (e.g. jar:file:/C:/PROJECTS/GeneratePKCS7andVerify/lib/bcmail-jdk15-140.zip!/org/bouncycastle/cms/CMSSignedData.class) and I copy their binary contents (from the URL) to the destination folder (into a .class file). In the mean time I recreate the package structure (following the full class name with all its packages). Finally I get a directory containing all class files loaded in the JVM at the time of caling my method and I can manually package them in a JAR (removing beforehand all system Java classes). That’s all. I use slightly modified version of ClassScope.java.

You can download a fully functional example here (Eclipse project): ExtractAllClassesFromJVMIntoJAR.zip.

Posted by nakov as java, blog at 11:32 PM EEST

Comments Off

August 25th, 2008

BGJUG Meeting - Java FX (28 August 2008)

The next meeting of the Bulgarian Java Users Group (BGJUG) will be held on 28 August 2008 in the Chemistry Faculty, Hall 210 in Sofia, starting at 18:30.

The topicwill be the Java FX technology. Speaker will be Naiden Gochev.

Posted by nakov as news, java at 2:08 PM EEST

Comments Off

August 24th, 2008

JSObject is not Thread-Safe

In one of my last projects I was working on Java applet that needed to digitally sign data forms at the client side in a Web browser. I with my team developed the applet and it did the job well. Unfortunately our customer decided to put multiple instances of the
applet in a single Web page. This resulted to unexpected behaviour: sometimes (from time to time) the browser window hangs. You can achieve this by refreshing the browser window continuously very fast pressing [F5] key many times). Strange problem, right?

JSObject is not thread-safe

Initially I thought that this is some kind of threading issue because:

it happens only when we have multiple instances of the applet
it happens sometimes, not regularly

After experimenting with lots of examples I found that the problem is related to JSObject. I created simple applet and it was able to run with multiple instances. After that I added access to the browser DOM by using JSObject.getWindow(this) and the “hang” problem was introduced.

It was clear that the JSObject class is not thread-safe and this causes the unregular hangs of the browser window. When we have several instances of the applet running in different browser windows we don’t have this issue. It appears only when we have several applets on a single Web page. The reason is simple: when multiple applets are running in the same browser window, all of them share the same instance of the JVM (Java Virtual Machine). In the same time all these applets share the same browser window and thus the same browser DOM tree. This means that JSObject.getWindow(this) could be called by multiple threads in the same time.

JSObject is not thread-safe

To overcome this problem we synchronize all code accessing JSObject by JSObject.class. Why JSObject.class? In a single virtual machine this class should be loaded only in the JVM so synchronizing by it will block multiple threads runngin in a single JVM to access JSObject at the same time.

Below is a sample applet that illustrates how to perform such synchronization:

If you remove the synchronization of the code above, and put the applet several times in a single form, it will randomly hang the Web browser.

Posted by nakov as java, blog at 5:29 PM EEST

Comments Off

August 20th, 2008

Debugging Java Applets in Eclipse

Today I needed to debug Java applet running in Internet Explorer from Eclipse. I was not straightforward. Let me share the experience how to do this:

1) First enable remote debugging in the Java Plugin:

a) Start –> Settings –> Control Panel –> Java –> Java Applet Runtime Settings –> View

b) Add the following to the “Java Runtime Parameters”:

-Djava.compiler=NONE -Xnoagent -Xdebug -Xrunjdwp:transport=dt_socket,address=8000,server=y,suspend=n

Java Plugin - Runtime Settings

This will enable remote debuging on TCP port 8000 for all applications running inside the Java Plugin (in Internet Explorer). Make sure this port is not used by other applications.

3) Close all Web browser Windows

4) Put breakpoints in your source code (you need to have an Eclipse project containing the applet source code)

4) In Eclipse create a remote debugging configuration:

a) Run –> Open Debug Dialog –> Remote Java Application –> New

b) Assign host = localhost and port = 8000

Eclipse - Remote Debug Configuration

Press the “Debug” button and enjoy debugging.

Note: Don’t forget to build your applet with debug information (javac -g). I am buidling my applet with ant so I just added <javac debug=”true” … />.

Posted by nakov as java at 6:53 PM EEST

Comments Off

« Previous Entries

Svetlin Nakov - Blog

Thoughts on Software Engineering

My Projects

Useful Links

X.509 Certificate Validation in Java: Build and Verify Chain and Verify CLR with Bouncy Castle

Introduction to Programming with Java Book - New Web Site

Java2Days Conference: 8-9 October 2009 in Bulgaria

JAX-RS, @Path, @PathParam and Optional Parameters

Mandatory Path Parameters

Optional @Path Parameters in JAX-RS

Flexible @Path Parameters in JAX-RS

The Book “Introduction to Programming with Java” is Finally Published

Java SWING Error Dialog with Exception Details

Extract All Classes Loaded in the JVM into a Single JAR

Extracting All Classes Loaded in the JVM

List All Classes Loaded in the JVM

Create a Single JAR with All Classes Loaded in the JVM

BGJUG Meeting - Java FX (28 August 2008)

JSObject is not Thread-Safe

JSObject is not thread-safe

JSObject is not thread-safe

Debugging Java Applets in Eclipse