ssl-proxies: Fix CRL refresh bug

The CertifcationRevocationList class caches CRL information to
reduce the cost of reloading them too often.

The caching logic contains a bug in which any call to the refresh
method will update the timestamp for the last reload even when
CRLs have not been reloaded. The consequence is that if refresh is
called sufficiently often, the CRLs will never be reloaded.

Signed-off-by: Tigran Mkrtchyan <tigran.mkrtchyan@desy.de>
ssl-proxies: Fix CRL check race condition

JGlobus uses CRLs as if they were immutable objects, however when
using the Bouncy Castle provider, the ASN.1 parser uses lazy
evaluation internally, which means the X509CRL object is not
thread safe.

Signed-off-by: Tigran Mkrtchyan <tigran.mkrtchyan@desy.de>
ssl-proxies: Performance and bug fixes in principal conversion utilities

The CertificateUtil class provides utilities for converting between
Globus DN notation and other string representations.

This patch fixes an O(n^2) problem in toGlobusId() caused by repeatedly
prepending a string to a StringBuffer, thus causing a growing string
to be copied internally.

The patch optimizes toPrincipal() by avoiding the rather expensive
LinkedList and replacing it with an ArrayDeque preallocated to the
correct size.

The patch also replaces the use of StringBuffer with the more efficient
StringBuilder class.

The patch fixes a bug in toPrincipal() in which white space around a
slash appearing inside an attribute value was stripped.

The patch adds unit tests for all three methods.

Signed-off-by: Tigran Mkrtchyan <tigran.mkrtchyan@desy.de>
gsi: fix unit tests to work with Java7
Add LICENSE and updated README per issue #71.
Add support for removing one or more ciphers from the list of ciphers available
during GSI handshake.
fix String to principal parsing

The current implementation fail to parse DN with http:// in the value of an attribute

Conflicts:

	ssl-proxies/src/test/java/org/globus/gsi/util/CertificateUtilTest.java
Update GlobusGSSException to avoid boring messages

Quite often, a GlobusGSSException is used to wrap an existing
Exception where it adds no additional meaning.

The result of this problem is Exception messages with many chained
"Failure unspecified at GSS-API level" messages.

In addition, SSLEngine suffers from the same problem, throwing an
SSLException with a message that has no meaning and with a Throwable
(that cause the SSLException) containing the meaningful message.

As a work-around, this patch skips over these semantically-null
Exception messages.

This is really a work-around, but fixing the underlying problems will
take sufficiently long that such a work-around is necessary.
Make trustmanager reload CRLs by default.  Fixes #80.
Merge pull request #83 from paulmillar/fix_GlobusGSSException_v2_0

Update GlobusGSSException to avoid boring messages (v2.0)
ssl-proxies: Add support for more RDN keywords

Java's X500Principal class only supports a limited number of
RDN keywords. Real world certificates make use of many more
keywords and bouncy castle and the EMI CANL library support
these. JGlobus 2 does not. This is a regression since JGlobus
1.x.

This patch adds additional mappings when mapping to and from
the X500Principal class. The mappings are copied from bouncy
castle 2.46 and CANL.

Signed-off-by: Tigran Mkrtchyan <tigran.mkrtchyan@desy.de>

Conflicts:
	ssl-proxies/src/test/java/org/globus/gsi/util/CertificateUtilTest.java
Make GlobusGSSCredentialImpl honour its Serializable identifier.

In JGlobus v1.8, GlobusGSSCredentialImpl was Serializable.  This
feature is relied upon in application that use JGlobus.

Currently, the GlobusGSSCredentialImpl is marked Serializable, but
contains a field, X509Credential, that is not serialisable.  This then
breaks the Serializable contract and attempts to serialise the object
will fail.

X509Credential is not currently Serializable, but contains only one
field member that prevents this: OpenSSLKey.  Therefore, the
critical part of this patch makes the abstract OpenSSLKey
Serializable.

Note that the abstract class OpenSSLKey is a holder for the private
key of a credential and allows certain operations on it.  Only the
IvParameterSpec field member prevents OpenSSLKey from being
Serializable.  The patch records the byte-array used to build
the IvParameterSpec independently of the IvParameterSpec field
member and marks the latter transient.  When deserialising,
the IvParameterSpec field member is rebuilt if the byte-array
is not null.

A number of unit-tests are included to verify that, for both
OpenSSLKey and GlobusGSSCredentialImpl, an object is equal to a
serialised-then-deserialised version of that object.  For this to
work, missing equals methods were implemented and an existing equals
method was fixed.  Unit-tests are also added for these equals
methods.

Signed-off-by: Tigran Mkrtchyan <tigran.mkrtchyan@desy.de>
Add better error message when certificate chain verification fails
Fix GlobusGSSContextTest

The GlobusGSSContextTest relies on having a credential, which then relies
on X509Credential class not having a cached copy of such a credential.
However, it does not ensure there is no such cached credential.

Since multiple tests (and test-suites) are run within the same JVM
instance, the effect is that, if another test-suite caches a
(deliberately) invalid, self-signed certificate then this cached
copy is returned instead of the expected certificate.

This patch fixes this problem by ensuring the cache is cleared.  It
introduces a (negliable) overhead as the cache is flushed between
tests; however, the additional robustness justifies this cost.
Add better error message when certificate chain verification fails
Fix error message and list implementation, as suggested by code review.
ssl-proxies: Improve RFC 3820 compliance of key usage check

Each certificate in a certificate chain can have a key usage field.
The existing JGlobus code checks that each proxy certificate does not
have more key usages than the issuing certificate. This seems like
a sensible check, however it conflicts with the algorithm described
in RFC 3820.

The RFC states that all key usage (and extended key usage) extensions
of all proxy certificates and the EEC must be collected in a list and
the effective key usage computed by the intersection of all extensions:

   *  If a certificate is a proxy certificate with a policy other than
      id-ppl-independent, the effective key usage and extended key usage
      functionality of the proxy certificate is the intersection of the
      functionality of those extensions in the proxy certificate and the
      effective key usage functionality of the proxy issuer.

We have observed real-world proxy certificates that failed with the
existing check in JGlobus 2, even though they are valid proxies
according to the RFC. These proxies also work with JGlobus 1.
Merge pull request #90 from gbehrmann/fix/2.0/keyusage

ssl-proxies: Improve RFC 3820 compliance of key usage check
Merge pull request #88 from paulmillar/fix_GlobusGSSContextTest

Fix GlobusGSSContextTest
Merge pull request #86 from paulmillar/better-error-msg_v2.0

Add better error message when certificate chain verification fails