summaryrefslogtreecommitdiffstats
path: root/certService/src/main/java
diff options
context:
space:
mode:
authorBartosz Gardziejewski <bartosz.gardziejewski@nokia.com>2020-02-11 13:27:08 +0100
committerBartosz Gardziejewski <bartosz.gardziejewski@nokia.com>2020-02-11 13:29:13 +0100
commitbddd4f0e38e09fb8479e9f97313fdb41297c2990 (patch)
treea74810e1817d4e848ea37a15a7331cfc811b7bfd /certService/src/main/java
parent5dfe938a07dcaa2e0a2da4cf40d434ab200667b2 (diff)
Add decoding CSR received from client.
Issue-ID: AAF-995 Signed-off-by: Bartosz Gardziejewski <bartosz.gardziejewski@nokia.com> Change-Id: I7c868f4835397f58ae4e6fad0e764e21d886d3d3
Diffstat (limited to 'certService/src/main/java')
-rw-r--r--certService/src/main/java/org/onap/aaf/certservice/api/CertificationService.java82
-rw-r--r--certService/src/main/java/org/onap/aaf/certservice/certification/CsrModelFactory.java70
-rw-r--r--certService/src/main/java/org/onap/aaf/certservice/certification/PemObjectFactory.java44
-rw-r--r--certService/src/main/java/org/onap/aaf/certservice/certification/exceptions/CsrDecryptionException.java27
-rw-r--r--certService/src/main/java/org/onap/aaf/certservice/certification/model/CsrModel.java85
-rw-r--r--certService/src/main/java/org/onap/aaf/certservice/rest/CertificationService.java61
6 files changed, 308 insertions, 61 deletions
diff --git a/certService/src/main/java/org/onap/aaf/certservice/api/CertificationService.java b/certService/src/main/java/org/onap/aaf/certservice/api/CertificationService.java
new file mode 100644
index 00000000..a46e07fc
--- /dev/null
+++ b/certService/src/main/java/org/onap/aaf/certservice/api/CertificationService.java
@@ -0,0 +1,82 @@
+/*
+ * ============LICENSE_START=======================================================
+ * PROJECT
+ * ================================================================================
+ * Copyright (C) 2020 Nokia. All rights reserved.
+ * ================================================================================
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ * ============LICENSE_END=========================================================
+ */
+
+package org.onap.aaf.certservice.api;
+
+import org.onap.aaf.certservice.certification.CsrModelFactory;
+import org.onap.aaf.certservice.certification.CsrModelFactory.StringBase64;
+import org.onap.aaf.certservice.certification.exceptions.CsrDecryptionException;
+import org.onap.aaf.certservice.certification.model.CsrModel;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.http.HttpStatus;
+import org.springframework.http.ResponseEntity;
+import org.springframework.web.bind.annotation.GetMapping;
+import org.springframework.web.bind.annotation.PathVariable;
+import org.springframework.web.bind.annotation.RequestHeader;
+import org.springframework.web.bind.annotation.RestController;
+
+
+@RestController
+public class CertificationService {
+
+ private static final Logger LOGGER = LoggerFactory.getLogger(CertificationService.class);
+
+ private final CsrModelFactory csrModelFactory;
+
+ @Autowired
+ CertificationService(CsrModelFactory csrModelFactory) {
+ this.csrModelFactory = csrModelFactory;
+ }
+
+ /**
+ * Request for signing certificate by given CA.
+ *
+ *
+ * @param caName the name of Certification Authority that will sign root certificate
+ * @param encodedCsr Certificate Sign Request encoded in Base64 form
+ * @param encodedPrivateKey Private key for CSR, needed for PoP, encoded in Base64 form
+ * @return JSON containing trusted certificates and certificate chain
+ */
+ @GetMapping("v1/certificate/{caName}")
+ public ResponseEntity<String> signCertificate(
+ @PathVariable String caName,
+ @RequestHeader("CSR") String encodedCsr,
+ @RequestHeader("PK") String encodedPrivateKey
+ ) {
+ caName = caName.replaceAll("[\n|\r|\t]", "_");
+ LOGGER.info("Received certificate signing request for CA named: {}", caName);
+
+ try {
+ CsrModel csrModel = csrModelFactory.createCsrModel(
+ new StringBase64(encodedCsr),
+ new StringBase64(encodedPrivateKey)
+ );
+ LOGGER.debug("Received CSR meta data: \n{}", csrModel);
+ return new ResponseEntity<>(csrModel.toString(), HttpStatus.OK);
+ } catch (CsrDecryptionException e) {
+ LOGGER.error("Exception occurred during certificate signing:", e);
+ return new ResponseEntity<>("Wrong certificate signing request (CSR) format", HttpStatus.BAD_REQUEST);
+ }
+ }
+
+
+}
diff --git a/certService/src/main/java/org/onap/aaf/certservice/certification/CsrModelFactory.java b/certService/src/main/java/org/onap/aaf/certservice/certification/CsrModelFactory.java
new file mode 100644
index 00000000..80858f4d
--- /dev/null
+++ b/certService/src/main/java/org/onap/aaf/certservice/certification/CsrModelFactory.java
@@ -0,0 +1,70 @@
+/*
+ * ============LICENSE_START=======================================================
+ * PROJECT
+ * ================================================================================
+ * Copyright (C) 2020 Nokia. All rights reserved.
+ * ================================================================================
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ * ============LICENSE_END=========================================================
+ */
+
+package org.onap.aaf.certservice.certification;
+
+import java.io.IOException;
+import java.util.Base64;
+
+import org.bouncycastle.pkcs.PKCS10CertificationRequest;
+import org.bouncycastle.util.io.pem.PemObject;
+import org.onap.aaf.certservice.certification.exceptions.CsrDecryptionException;
+import org.onap.aaf.certservice.certification.model.CsrModel;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+import org.springframework.stereotype.Service;
+
+
+@Service
+public class CsrModelFactory {
+
+ private static final Logger LOGGER = LoggerFactory.getLogger(CsrModelFactory.class);
+ private final PemObjectFactory pemObjectFactory = new PemObjectFactory();
+
+ public CsrModel createCsrModel(StringBase64 csr, StringBase64 privateKey) throws CsrDecryptionException {
+ LOGGER.debug("Decoded CSR: \n{}", csr.asString());
+
+ try {
+ PemObject pemObject = pemObjectFactory.createPmObject(csr.asString());
+ PKCS10CertificationRequest decodedCsr = new PKCS10CertificationRequest(
+ pemObject.getContent()
+ );
+ PemObject decodedPrivateKey = pemObjectFactory.createPmObject(privateKey.asString());
+ return new CsrModel(decodedCsr, decodedPrivateKey);
+ } catch (IOException e) {
+ throw new CsrDecryptionException("Incorrect CSR, decryption failed", e);
+ }
+ }
+
+ public static class StringBase64 {
+ private final String value;
+ private final Base64.Decoder decoder = Base64.getDecoder();
+
+ public StringBase64(String value) {
+ this.value = value;
+ }
+
+ public String asString() {
+ return new String(decoder.decode(value));
+ }
+ }
+}
+
+
diff --git a/certService/src/main/java/org/onap/aaf/certservice/certification/PemObjectFactory.java b/certService/src/main/java/org/onap/aaf/certservice/certification/PemObjectFactory.java
new file mode 100644
index 00000000..e3339cc4
--- /dev/null
+++ b/certService/src/main/java/org/onap/aaf/certservice/certification/PemObjectFactory.java
@@ -0,0 +1,44 @@
+/*
+ * ============LICENSE_START=======================================================
+ * PROJECT
+ * ================================================================================
+ * Copyright (C) 2020 Nokia. All rights reserved.
+ * ================================================================================
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ * ============LICENSE_END=========================================================
+ */
+
+package org.onap.aaf.certservice.certification;
+
+import java.io.IOException;
+import java.io.StringReader;
+
+import org.bouncycastle.util.io.pem.PemObject;
+import org.bouncycastle.util.io.pem.PemReader;
+
+import org.onap.aaf.certservice.certification.exceptions.CsrDecryptionException;
+
+
+public class PemObjectFactory {
+
+ public PemObject createPmObject(String pem) throws CsrDecryptionException {
+
+ try (StringReader stringReader = new StringReader(pem);
+ PemReader pemReader = new PemReader(stringReader)) {
+ return pemReader.readPemObject();
+ } catch (IOException e) {
+ throw new CsrDecryptionException("Unable to create PEM", e);
+ }
+ }
+
+}
diff --git a/certService/src/main/java/org/onap/aaf/certservice/certification/exceptions/CsrDecryptionException.java b/certService/src/main/java/org/onap/aaf/certservice/certification/exceptions/CsrDecryptionException.java
new file mode 100644
index 00000000..fb16ad91
--- /dev/null
+++ b/certService/src/main/java/org/onap/aaf/certservice/certification/exceptions/CsrDecryptionException.java
@@ -0,0 +1,27 @@
+/*
+ * ============LICENSE_START=======================================================
+ * PROJECT
+ * ================================================================================
+ * Copyright (C) 2020 Nokia. All rights reserved.
+ * ================================================================================
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ * ============LICENSE_END=========================================================
+ */
+
+package org.onap.aaf.certservice.certification.exceptions;
+
+public class CsrDecryptionException extends Exception {
+ public CsrDecryptionException(String message, Throwable cause) {
+ super(message, cause);
+ }
+}
diff --git a/certService/src/main/java/org/onap/aaf/certservice/certification/model/CsrModel.java b/certService/src/main/java/org/onap/aaf/certservice/certification/model/CsrModel.java
new file mode 100644
index 00000000..ef76144b
--- /dev/null
+++ b/certService/src/main/java/org/onap/aaf/certservice/certification/model/CsrModel.java
@@ -0,0 +1,85 @@
+/*
+ * ============LICENSE_START=======================================================
+ * PROJECT
+ * ================================================================================
+ * Copyright (C) 2020 Nokia. All rights reserved.
+ * ================================================================================
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ * ============LICENSE_END=========================================================
+ */
+
+package org.onap.aaf.certservice.certification.model;
+
+import java.io.IOException;
+import java.util.Arrays;
+import java.util.List;
+import java.util.Objects;
+import java.util.stream.Collectors;
+
+import org.bouncycastle.asn1.x500.X500Name;
+import org.bouncycastle.asn1.x509.Extension;
+import org.bouncycastle.asn1.x509.Extensions;
+import org.bouncycastle.asn1.x509.GeneralName;
+import org.bouncycastle.asn1.x509.GeneralNames;
+import org.bouncycastle.pkcs.PKCS10CertificationRequest;
+import org.bouncycastle.util.io.pem.PemObject;
+
+import org.onap.aaf.certservice.certification.exceptions.CsrDecryptionException;
+
+
+public class CsrModel {
+
+
+ private final PKCS10CertificationRequest csr;
+ private final PemObject privateKey;
+
+ public CsrModel(PKCS10CertificationRequest csr, PemObject privateKey) {
+ this.csr = csr;
+ this.privateKey = privateKey;
+ }
+
+ public PemObject getPublicKey() throws CsrDecryptionException {
+ try {
+ return new PemObject("PUBLIC KEY", csr.getSubjectPublicKeyInfo().getEncoded());
+ } catch (IOException e) {
+ throw new CsrDecryptionException("Reading Public Key from CSR failed", e.getCause());
+ }
+ }
+
+ public PemObject getPrivateKey() {
+ return privateKey;
+ }
+
+ public X500Name getSubjectData() {
+ return csr.getSubject();
+ }
+
+ public List<String> getSansData() {
+ Extensions extensions =
+ Extensions.getInstance(csr.getAttributes()[0].getAttrValues().getObjectAt(0));
+ GeneralName[] arrayOfAlternativeNames =
+ GeneralNames.fromExtensions(extensions, Extension.subjectAlternativeName).getNames();
+
+ return Arrays.stream(arrayOfAlternativeNames)
+ .map(GeneralName::getName)
+ .map(Objects::toString)
+ .collect(Collectors.toList());
+ }
+
+ @Override
+ public String toString() {
+ return "Subject: { " + getSubjectData().toString()
+ + " ,SANs: " + getSansData().toString() + " }";
+ }
+
+}
diff --git a/certService/src/main/java/org/onap/aaf/certservice/rest/CertificationService.java b/certService/src/main/java/org/onap/aaf/certservice/rest/CertificationService.java
deleted file mode 100644
index 7a93bffa..00000000
--- a/certService/src/main/java/org/onap/aaf/certservice/rest/CertificationService.java
+++ /dev/null
@@ -1,61 +0,0 @@
-/*
- * ============LICENSE_START=======================================================
- * PROJECT
- * ================================================================================
- * Copyright (C) 2020 Nokia. All rights reserved.
- * ================================================================================
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- * ============LICENSE_END=========================================================
- */
-
-package org.onap.aaf.certservice.rest;
-
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
-import org.springframework.http.HttpStatus;
-import org.springframework.http.ResponseEntity;
-import org.springframework.web.bind.annotation.GetMapping;
-import org.springframework.web.bind.annotation.PathVariable;
-import org.springframework.web.bind.annotation.RequestHeader;
-import org.springframework.web.bind.annotation.RestController;
-
-import java.util.Base64;
-
-@RestController
-public class CertificationService {
-
- private static final Logger LOGGER = LoggerFactory.getLogger(CertificationService.class);
- private static final Base64.Decoder DECODER = Base64.getDecoder();
-
- @GetMapping("/csr/{caName}")
- public ResponseEntity<String> getEncodesCSR(
- @PathVariable String caName,
- @RequestHeader("CSR") String encodedCSR,
- @RequestHeader("PK") String encodedPrivateKey
- ) {
-
- String csr = decode(encodedCSR);
- String privateKey = decode(encodedPrivateKey);
-
- LOGGER.info("Received CSR for CA named: {}",caName);
- LOGGER.debug("Decoded received CSR: \n{}", csr);
-
- return new ResponseEntity<>(csr, HttpStatus.OK);
-
- }
-
- private String decode(String encodedData) {
- return new String(DECODER.decode(encodedData));
- }
-
-}