Wednesday, November 5, 2008

Disabled Form Elements in HTML are never submitted

Maybe I am too naive. But if a check box in a form is checked but disabled, it will never be submitted by the browser. This is what the W3 spec says "Disabled form controls are not successful" (Reference here). I am not sure if the Spec is correct in its design choice. But that's what it is.

A simple workaround to overcome this is to of course to add a hidden variable in the form with the same name as the check box. The hidden variable can contain the value that corresponds to a checked check box.

Saturday, September 27, 2008

Creating Forms In Java Swing (Manually)

Such a simple topic but sadly google does not throw up good results on how to create a simple form in Java Swing. This definition is not needed but by form, I mean, a simple data entry utility like one where a user can add a contact to an address book application. This post assumes that you prefer coding out the form manually instead of using an IDE. This is essential when you want more control over the form code. Of course it is more complex and if you have an option always is an IDE like Netbeans, go for it. Manual coding, for example could be useful when coding in an existing application.There are about 3 ways that I researched on but tried just the first one:

1. Using A SpringLayout and SpringUtilities

I am not going to explain what a Spring Layout. My aim is just to provide a Java Developer for links to investigate and hopefully to save their time.

This is what a Spring Layout is: http://java.sun.com/docs/books/tutorial/uiswing/layout/spring.html

A Very Useful Utility:

http://java.sun.com/docs/books/tutorial/uiswing/examples/layout/SpringGridProject/src/layout/SpringUtilities.java

Here is a quick example, of course taken from Sun's javadoc. This creates a simple form with two columns (the left column contains labels such as name and the right column contains a text field to enter data):


//these are your labels in the form
String[] labels = {"Name: ", "Fax: ", "Email: ", "Address: "};
int numPairs = labels.length;

//Create and populate the panel.
JPanel p = new JPanel(new SpringLayout());
for (int i = 0; i < l =" new" textfield =" new">
where rows is number of items in the form, cols is the number of columns (here it is two one for label and other for textfield), initX is the initial X position from where you can start the form and initY is the initial Y position from where you can start the form. xPad is the amount of space between each row and ypad is the amount of space between each column.

There are other complex Layout such as GridBag Layout and GroupLayout which are not good for manual coding.
These layouts are used mainly in code that is auto generated by IDEs

2. If you have been a web developer like me and like to make use of CSS like styling properties to make UIs (as in Google Android, Flex), then this one is for you: http://www.miglayout.com/

3. Similarly, there is one called JGoodies Forms which seems to be very popular. http://www.jgoodies.com/freeware/forms/index.html. JGoodies has a wonderful demo where you can manually play around with form elements and view their properties.

2 and 3 are open source and free to use.

4. If you wish to use your own form layout utility, you can begin from here: http://www.javaworld.com/javaworld/jw-10-2002/jw-1004-dialog.html?page=2

Sunday, September 21, 2008

My Tryst with Date/Calendar Pickers for Java Swing

For one of my recent projects, I had to work on Java Swing and check out some date/calendar pickers for Java Swing. My expectations were not stringnet. I could use any Date Picker as long it was free and open source :). Customization was not important either. So I narrowed down on the following three simple Date Picker which are available as Swing components:

1. JCalendar: https://jcalendar.dev.java.net/ - Seems to have a lot of options to customize
2. JxDatePicker - http://wiki.java.net/bin/view/Javadesktop/SwingXCalendar. It is part of a much larger Swing component Library called SwingX.
3. Finally Settled on Microba Date Picker - http://microba.sourceforge.net/

There are many more options. The free ones are fairly useful and each of them have many customization options such as timezone, setting the date at instantiation time, look and feel, number of years a user is allowed to navigate to, etc that must be looked into and exploited

Friday, April 25, 2008

SIP User Agent for Android

A legend: when I refer to "mjsip User Agent", I am talking of MjSip UA

For a class assignment, I decided to build a VOIP client for Android. But it turns out Android does not have any inbuilt support for the session initiation protocol (SIP) and real time protocol (RTP). However, guys at HSC.com have ported the Java based open source SIP stack mjsip (http://www.mjsip.org) and have discussed it here. They have even shown a screencast in which they show up a client on Android and call a Xlite soft phone. The source code of the stack is also available on the same site. However, they have not released the SIP User Agent yet and this is what I am going to do here (I would suggest you track their site for a more concrete and practical implementation later).

Note that the Android user agent can only make a call to another non-Android SIP Client. A SIP call establishment is done and no voice converstion is possible since Android emulator does not allow coice capture yet. I will try to stream a media file later over the same call. My next step would be to stream a media file using RTP from the Android client to the non-android SIP client. (The mjsip User Agent also has RTP implementation)

However, the code that I have has been made over a night long session. Not technically challenging but required some patience. And so, I have mixed up all the classes of the standard mjsip User agent at mjsip.org and the android port of the stack at hsc.com. I had to replace all System.out statements with the Android logging at info level. There is no GUI yet for the user agent that I have developed. When the application starts up it initates a call and you can hear a ring on the non-Android Client. You will have to step through the code to understand what I have done and to be able to use it in your application. Also, the constructors for the SIP Stack, SIP Provider, etc take a file name as a string, I added a new constructor in some classes to take an InputStream. Its not a neat implementation but should help until HSC.com releases a nicer client and if you have been eager to do some VOIP based or to be more general SIP-based applications. So this is how to run it:

  1. Download the binaries for MjSip UA
  2. Download the project that I made from here
  3. Copy the file /Non-AndroidClient/non-android.cfg into the /lib folder of the MjSip UA
  4. In non-android.cfg do this:
    1. The parameter from_url="Bob" . After the '@ ' sign put the IP address of your local machine.
    2. Let "realm" be also equal to the IP address of the same machine
  5. To start up the mjSip User Agent, co to your command prompt and enter the root of the mjsip files you just downloaded and type in "uaw -f config\non-android.cfg"
  6. Now lets see what to with Android. Somehow try to import the files stored in /AndroidUA into an Android Project in Eclipse IDE (IDE must come with the Android extension and SDK) and include/copy the Activity class that I have created.
  7. In the android project, open to /res/raw/a.txt and edit it as explained:
    1. Change the "call_to" parameter to be: call_to= sip::5080
      where the "IP addr" is the IP address in 4. This file is now actually added as a resource/asset to the application and will be opened by the reference to the Activity instance like this:
      1. this.getResources().openRawResource(R.raw.a) which returns an InputStream and hence, I had to change many methods/constructors to take an inputstream instead of a string file name.
  8. Thats it. You are done. Start up the Android client and voila...you shall here a ring on the non-Android client
Though HSC.com has shown a screencast on their blog, if you want me to do the same, please drop a line and I can try to make one. Questions/comments are most welcome. And thanks to people at hsc.com and mjsip.org. Please feel free the use the code the way you want and spare me if there is any problemo :)

Thursday, March 27, 2008

InvalidJadException in Netbeans Mobility Pack

If one comes across the following error in Netbeans 5.5 Mobility Pack with Sun Wireless Toolkit 2.5, then a possible reason could be that you copied the Midlet from another project and placed it into the mobile project where this error is occuring.

com.sun.kvem.midletsuite.InvalidJadException: Reason = 22
The manifest or the application descriptor MUST contain the attribute: MIDlet-1


This is how I fixed the problem:

In your problematic Netbeans Mobility Project go to /nbproject/project.properties
Search for the property "manifest.midlets". In my case, this property had no value and so I had to add one like this

manifest.midlets=MIDlet-1: , , \n

Put a new line feed "\n" if using Notepad in Windows. and include the space between the two commas above.

So for example:

manifest.midlets=MIDlet-1: HelloMidlet, , com.midlet.HelloMidlet

If there are other reasons/solutions to this above problems, please drop a line

Amazon EC2 and S3 Simplified

Amazon S3 is known as Simple Storage Services. It lets web sites store images, videos, and other heavy content on an Amazon Storage Server. As per the video below which gives more simplified information on this service, when you use twitter, the image icons are pulled from Amazon Storage services. Now, what is Elastic Computing Cloud (EC2).....it is a service that allows developers and startups, etc to build and provide their applications over a highly scalable server. The scalability increases with increase in number of requests. So basically S3 rents storage space and EC2 rents processing power. A set of services that can even let individual developers launch their applications at a cheap cost and high availability. Please view the video for more simplified description on these services and head on to Amazon for detailed information or to use it :)

Saturday, March 8, 2008

J2ME Wireless Toolkit creates temporary folder for its emulators

So you are using the FileConnection Optional Package in J2ME and you are wondering why the hell you can't read the files, you created. Well, this post helped me. It turns out, the first time you run your Wireless Toolkit Emulator, say with the DefaultColorSkin, WTK creates a in.use file in the $WTKHomeDir\emulator\appdb\DefaultColorPhone directory. Now, in my case, after closing the emulator, this file did not get deleted. Hence, the next time, I started the emulator, I could not see the files are saw the first time. This is because, the original DefaultColorPhone folder, is now locked by the presence of the in.use file. Hence, WTK creates a temporary folder like temp.DefaultCOlorPhone44 to run the midlet instead. Now you must either create your files in the fileSystem folder of this folder or delete the in.use file in the original, so that the emulator uses the original DefaultColorPhone folder and you can now see the files/folders created when you first ran the midlet

Wednesday, February 13, 2008

Avoiding DataLengthException in Bouncy Castle

This exception occurs usually when the output buffer is too small to accomodate the result of an encryption/decryption/has computation, etc. A (possible) way to avoid it is like this:

PaddedBufferedBlockCipher padBufBlockCipher = new PaddedBufferedBlockCipher(new AESEngine());
byte[] key = ......
KeyParameter keyParam = new KeyParameter(key);
padBufBlockCipher.init(true, keyParam);

String l_message = "Himanshu";
byte[] out = new byte[padBufBlockCipher.getOutputSize(l_message.getBytes().length)];

Now the output buffer will be set to a minimum size that can accomodate a block generated while encrypting a block of length l_message.getBytes().length

Another method for reference is BufferedBlockCipher.getUpdateOutputSize(). Refer javadoc for Bouncy Castle.

Thursday, February 7, 2008

Converting Time Object of Bouncy Castle into a Date Object

Platforms: J2ME CLDC 1.1 MIDP 2.1
BouncyCastle LightweightCryptoAPI for J2ME (www.bouncycastle.org)

The code fragment here is to convert an instance of org.bouncycastle.asn1.x509.Time into a J2ME java.util.Date instance that contains the current time according to the timezone and time specified as per UTC. This code can be used for example, to get a Date instance of TBSCertificateStructure.getStartDate() or getEndDate(). The Date objects can than be used to check if the certificate has not expired.

One requirement would be to get the current timezone of the user somehow. Right now, I have hardcoded it as "-08:30" for PST. For an Indian timezone, it must be "+05:30" and so on.



import java.util.Calendar;
import java.util.Date;
import java.util.TimeZone;
import org.bouncycastle.asn1.x509.Time;

/**
*
* @author Himanshu Ranavat
*/
public class BouncyCastleDateUtil {


/** Creates a new instance of BouncyCastleDateUtil */
public BouncyCastleDateUtil() {
}

public Date convertTime2Date(Time time) {

//get string representation of Time Object. will be usually as per GMT+00:00
String date = time.getTime();

//eg: time = 2008 0207 2300 00 GMT + 00:00
int year = getIntValueForString(date.substring(0, 4)) ;

int month = getIntValueForString(date.substring(4,6));

int day = getIntValueForString(date.substring(6,8));

int hour = getIntValueForString(date.substring(8,10));

int minutes = getIntValueForString(date.substring(10,12));

int seconds = getIntValueForString(date.substring(12,14));

String meanTime = date.substring(14,17);

//check if mean time is UTC or GMT is supported
meanTime = getActualMeanTime(meanTime);

String timeZoneDetails = date.substring(17);
long timeZoneHr = getLongValueForString(timeZoneDetails.substring(1,3)) * 60 * 60 * 1000;
long timeZoneMin = getLongValueForString(timeZoneDetails.substring(4,6)) * 60 * 1000;
//get current time zone offset in milliseconds as +ve or -ve
long timeZoneOffset = 0;

if ( timeZoneDetails.charAt(0) == '-' ) { //adjust time as per GMT
timeZoneOffset = timeZoneHr + timeZoneMin;
} else {
timeZoneOffset = -(timeZoneHr + timeZoneMin);
}


//set the calendar object with the parameters passed in from Time object
Calendar cal = Calendar.getInstance();

cal.setTimeZone(TimeZone.getTimeZone(meanTime));

cal.set(Calendar.YEAR, year);

//reduce month by 1 since 0 indicates January
cal.set(Calendar.MONTH, month - 1);

cal.set(Calendar.DAY_OF_MONTH, day);

cal.set(Calendar.HOUR_OF_DAY, hour);

cal.set(Calendar.MINUTE, minutes);

cal.set(Calendar.SECOND, seconds);

//date in Calendar instance is as per GMT or UTC. we need to add the time zone offset
//obtained from the Time object
return new Date(cal.getTime().getTime() + timeZoneOffset);

}

private int getIntValueForString (String p_value){
return Integer.valueOf(p_value).intValue();
}

private long getLongValueForString (String p_value){
return Integer.valueOf(p_value).longValue();
}

private String getActualMeanTime(String p_meanTime){
String[] zones = TimeZone.getAvailableIDs();

for (int i = 0 ; i < defaulttimezone = "GMT">

Sample Output:

Thu Feb 07 23:49:00 UTC 2008 - for a Time instance whose getTime method returns "20080207234900GMT+00:00"
Thu Feb 07 23:49:43 UTC 2008 - Date representation of the same time as in example


The precision is not to the seconds as shown by the sample output but I think it should be sufficient. It servers my purpose and hope it helps you'll too. Please leave me comments or suggestions to improve it.

Saturday, February 2, 2008

KeyTool IUI to generate and manage EC keys and certificates

Came across this neat tool to generate EC/Elliptic Curve keys and certificates (in addition to DSA and RSA Keys). Keys can be stored in a keystore of a JKS/JCEKS format. It is a nice GUI based tool that can even create certificates from entries stored in the key store.

Some quick steps on how to get started with your first EC Key Pair and certificate:

  1. Select View -> Select -> Create -> KeyStore and create a keystore
  2. Select View -> Select -> Create -> KeyStore Entry -> EC Key to create a EC Key
    1. EC Keys can be created with 192, 239 and 256 bits
    2. Signature algorithms are available SHA1withECDSA upto SHA512ECDSA
    3. It supports X500 Certificate v1 and v3
  3. Go to View -> Select Task -> Export -> Certificate -> From Private Key Entry to create your first EC Certificate.

Voila !!!!


KeyTool IUI is available here: http://yellowcat1.free.fr/index_ktl.html

Another link on how to do certain tasks using this tool: http://yellowcat1.free.fr/howto/ktl/20/howto.html#_ecc_

Wednesday, January 30, 2008

Elliptic Curve Cryptography is not your usual encrypt-decrypt

When I began work on my security project for securing m-commerce transactions, I made all the design around the single concept (used in SSL, etc), of encrypting a secret/symmetric key with a public key of party X and sending it to the party X who will decrypt it with its private key. Subsequent communication will occur using the symmetric key. This encrypt-decrypt can happen using RSA.

However, after coming across many online documents and posts on the Bouncy Castle forums, I realized that ECC is not designed this way, at least in Bouncy Castle. You need to use something called as ECIES or Elliptic Curve Integrated Encryption Scheme. (See Wikipedia). ECIES takes care of key exchange (Diffie-Hellman) to establish a symmetric key (Confidentiality) and Message Authentication for Integrity.

However, encrypt-decrypt in ECC can be done using El Gamal Encryption over an Elliptic Curve. An open source Java library has been developed in this direction at the National University of Ireland Maynooth. Check out the publication and software section here

I learnt my lessons the hard way and need to stick to Bouncy Castle due to several reasons and had to change my design extensively. However, the library provided by the Irish University seems promising.

Monday, January 28, 2008

TOP 10 Tech Startups

Top 10 Start ups selected at an awards show called Crunchies :-)


And yes, there are no surprises, Facebook is in the list.

Getting your J2ME project working with Netbeans Mobility Pack and Bouncy Castle Lightweight API

This is just a quick way to get started with BC API and ECC. It is not the best or perfect way.

  1. Visit Bouncy Castle Download Page. Download Lightweight API for J2ME zip file. Search for Lightweight API or J2ME on the page to find the exact file.
  2. Unzip the file to say folder /BouncyCastle.
  3. Create a Mobile Application Project in Netbeans.
  4. Go to Project Properties -> Build -> Libraries and Resources ->Click on Add Jar/Zip
  5. Add BouncyCastle/lightwt....j2me/zips/cldc_classes.zip
  6. Go to Project Properties -> Build -> Obfuscation -> Select High Obfuscation Level and add following to Additional Obfuscation Settings.

-dontskipnonpubliclibraryclasses

-dontskipnonpubliclibraryclassmembers

-ignorewarnings

Using ASN.1 Notation DER Encoded ECDSA Signature in BC Lightweight API

So this is my first post and my first attempt to give back to the open source software community...

I have been working on a secure mobile payment system project for the past few months at university (www.sjsu.edu). We are using elliptic curve cryptography for our security needs. For implementation purposes, I am using Bouncy Castle Light Weight API for J2ME (http://www.bouncycastle.org/latest_releases.html).


Currently, I am attempting to create Certificate Requests using the API and I came across a hurdle that the API does not have a supporting Signature class that lets one create ASN.1 form of EC DSA (Elliptic curve DSA signatures) signatures that are embedded in certificates and so I set about creating one and is available here and here

This class was made to fulfil my need for a class that mimics the ECDSA functionality of java.Security.Signature and org.bouncycastle.jce.provider.JDKDSASignature. However, the class does not extend the Signature class since the Signature class in BC Lite API does not have a constructor. The class can be used to create and verify an ECDSA Signature in J2ME with the Bouncy Castle Lightweight Crypto API for J2ME.

The ECDSA Signature in ASN.1 Notation, this string is given as:
SEQUENCE {
r INTEGER,
s INTEGER
}

Signatures can be made of a CertificateRequestInfo Object and used to create a CertificationRequest (a pkcs 10 certificate request)

All classes mentioned above are classes of BouncyCastle Lightweight J2ME API and is needed to run this class as well.

Please refer comments in the file and accompanying test classes to understand the proper usage.


I hope to make available the PKI Infrastructure asap.