diff options
Diffstat (limited to 'certService/src/main/java/org')
8 files changed, 55 insertions, 178 deletions
diff --git a/certService/src/main/java/org/onap/aaf/certservice/certification/adapter/CertificateFactoryProvider.java b/certService/src/main/java/org/onap/aaf/certservice/certification/CertificateFactoryProvider.java index 79f59363..b633f905 100644 --- a/certService/src/main/java/org/onap/aaf/certservice/certification/adapter/CertificateFactoryProvider.java +++ b/certService/src/main/java/org/onap/aaf/certservice/certification/CertificateFactoryProvider.java @@ -18,7 +18,7 @@ * ============LICENSE_END========================================================= */ -package org.onap.aaf.certservice.certification.adapter; +package org.onap.aaf.certservice.certification; import java.io.InputStream; import java.security.NoSuchProviderException; diff --git a/certService/src/main/java/org/onap/aaf/certservice/certification/CertificationProvider.java b/certService/src/main/java/org/onap/aaf/certservice/certification/CertificationProvider.java index fa2d88ab..4435aa75 100644 --- a/certService/src/main/java/org/onap/aaf/certservice/certification/CertificationProvider.java +++ b/certService/src/main/java/org/onap/aaf/certservice/certification/CertificationProvider.java @@ -20,28 +20,58 @@ package org.onap.aaf.certservice.certification; -import org.onap.aaf.certservice.certification.adapter.Cmpv2ClientAdapter; +import org.bouncycastle.openssl.jcajce.JcaMiscPEMGenerator; +import org.bouncycastle.util.io.pem.PemObjectGenerator; +import org.bouncycastle.util.io.pem.PemWriter; import org.onap.aaf.certservice.certification.configuration.model.Cmpv2Server; -import org.onap.aaf.certservice.certification.exception.Cmpv2ClientAdapterException; import org.onap.aaf.certservice.certification.model.CertificationModel; import org.onap.aaf.certservice.certification.model.CsrModel; +import org.onap.aaf.certservice.cmpv2client.api.CmpClient; import org.onap.aaf.certservice.cmpv2client.exceptions.CmpClientException; +import org.slf4j.Logger; +import org.slf4j.LoggerFactory; import org.springframework.beans.factory.annotation.Autowired; import org.springframework.stereotype.Service; +import java.io.IOException; +import java.io.StringWriter; +import java.security.cert.X509Certificate; +import java.util.List; +import java.util.stream.Collectors; + @Service public class CertificationProvider { - private final Cmpv2ClientAdapter cmpv2ClientAdapter; + private static final Logger LOGGER = LoggerFactory.getLogger(CertificationProvider.class); + + private final CmpClient cmpClient; @Autowired - public CertificationProvider(Cmpv2ClientAdapter cmpv2ClientAdapter) { - this.cmpv2ClientAdapter = cmpv2ClientAdapter; + public CertificationProvider(CmpClient cmpClient) { + this.cmpClient = cmpClient; + } + + public CertificationModel signCsr(CsrModel csrModel, Cmpv2Server server) + throws CmpClientException { + List<List<X509Certificate>> certificates = cmpClient.createCertificate(csrModel, server); + return new CertificationModel(convertFromX509CertificateListToPemList(certificates.get(0)), + convertFromX509CertificateListToPemList(certificates.get(1))); + } + + private static List<String> convertFromX509CertificateListToPemList(List<X509Certificate> certificates) { + return certificates.stream().map(CertificationProvider::convertFromX509CertificateToPem).filter(cert -> !cert.isEmpty()) + .collect(Collectors.toList()); } - CertificationModel signCsr(CsrModel csrModel, Cmpv2Server server) - throws CmpClientException, Cmpv2ClientAdapterException { - return cmpv2ClientAdapter.callCmpClient(csrModel, server); + private static String convertFromX509CertificateToPem(X509Certificate certificate) { + StringWriter sw = new StringWriter(); + try (PemWriter pw = new PemWriter(sw)) { + PemObjectGenerator gen = new JcaMiscPEMGenerator(certificate); + pw.writeObject(gen); + } catch (IOException e) { + LOGGER.error("Exception occurred during convert of X509 certificate", e); + } + return sw.toString(); } } diff --git a/certService/src/main/java/org/onap/aaf/certservice/certification/adapter/RsaContentSignerBuilder.java b/certService/src/main/java/org/onap/aaf/certservice/certification/RsaContentSignerBuilder.java index bda89235..12f00f9c 100644 --- a/certService/src/main/java/org/onap/aaf/certservice/certification/adapter/RsaContentSignerBuilder.java +++ b/certService/src/main/java/org/onap/aaf/certservice/certification/RsaContentSignerBuilder.java @@ -18,7 +18,7 @@ * ============LICENSE_END========================================================= */ -package org.onap.aaf.certservice.certification.adapter; +package org.onap.aaf.certservice.certification; import java.io.IOException; import java.security.PrivateKey; diff --git a/certService/src/main/java/org/onap/aaf/certservice/certification/adapter/X509CertificateBuilder.java b/certService/src/main/java/org/onap/aaf/certservice/certification/X509CertificateBuilder.java index f96cec8e..70591759 100644 --- a/certService/src/main/java/org/onap/aaf/certservice/certification/adapter/X509CertificateBuilder.java +++ b/certService/src/main/java/org/onap/aaf/certservice/certification/X509CertificateBuilder.java @@ -18,7 +18,7 @@ * ============LICENSE_END========================================================= */ -package org.onap.aaf.certservice.certification.adapter; +package org.onap.aaf.certservice.certification; import java.io.IOException; import java.math.BigInteger; @@ -38,7 +38,7 @@ public class X509CertificateBuilder { private static final int SECURE_NEXT_BYTES = 16; private static final int VALID_PERIOD_IN_DAYS = 365; - X509v3CertificateBuilder build(PKCS10CertificationRequest csr) throws IOException { + public X509v3CertificateBuilder build(PKCS10CertificationRequest csr) throws IOException { return new X509v3CertificateBuilder(csr.getSubject(), createSerial(), Date.from(LocalDateTime.now().toInstant(ZoneOffset.UTC)), Date.from(LocalDateTime.now().plusDays(VALID_PERIOD_IN_DAYS).toInstant(ZoneOffset.UTC)), diff --git a/certService/src/main/java/org/onap/aaf/certservice/certification/adapter/Cmpv2ClientAdapter.java b/certService/src/main/java/org/onap/aaf/certservice/certification/adapter/Cmpv2ClientAdapter.java deleted file mode 100644 index 2477c421..00000000 --- a/certService/src/main/java/org/onap/aaf/certservice/certification/adapter/Cmpv2ClientAdapter.java +++ /dev/null @@ -1,119 +0,0 @@ -/* - * ============LICENSE_START======================================================= - * Cert Service - * ================================================================================ - * Copyright (C) 2020 Nokia. All rights reserved. - * ================================================================================ - * Licensed under the Apache License, Version 2.0 (the "License"); - * you may not use this file except in compliance with the License. - * You may obtain a copy of the License at - * - * http://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, software - * distributed under the License is distributed on an "AS IS" BASIS, - * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. - * See the License for the specific language governing permissions and - * limitations under the License. - * ============LICENSE_END========================================================= - */ - -package org.onap.aaf.certservice.certification.adapter; - -import java.io.ByteArrayInputStream; -import java.io.IOException; -import java.io.StringWriter; -import java.security.NoSuchProviderException; -import java.security.PrivateKey; -import java.security.cert.CertificateException; -import java.security.cert.X509Certificate; -import java.util.List; -import java.util.stream.Collectors; - -import org.bouncycastle.cert.X509CertificateHolder; -import org.bouncycastle.cert.X509v3CertificateBuilder; -import org.bouncycastle.openssl.jcajce.JcaMiscPEMGenerator; -import org.bouncycastle.operator.ContentSigner; -import org.bouncycastle.operator.OperatorCreationException; -import org.bouncycastle.pkcs.PKCS10CertificationRequest; -import org.bouncycastle.util.io.pem.PemObjectGenerator; -import org.bouncycastle.util.io.pem.PemWriter; -import org.onap.aaf.certservice.certification.configuration.model.Cmpv2Server; -import org.onap.aaf.certservice.certification.exception.Cmpv2ClientAdapterException; -import org.onap.aaf.certservice.certification.model.CertificationModel; -import org.onap.aaf.certservice.certification.model.CsrModel; -import org.onap.aaf.certservice.cmpv2client.api.CmpClient; -import org.onap.aaf.certservice.cmpv2client.exceptions.CmpClientException; -import org.slf4j.Logger; -import org.slf4j.LoggerFactory; -import org.springframework.beans.factory.annotation.Autowired; -import org.springframework.stereotype.Component; - -@Component -public class Cmpv2ClientAdapter { - - private static final Logger LOGGER = LoggerFactory.getLogger(Cmpv2ClientAdapter.class); - - private final CmpClient cmpClient; - private final RsaContentSignerBuilder rsaContentSignerBuilder; - private final X509CertificateBuilder x509CertificateBuilder; - private final CertificateFactoryProvider certificateFactoryProvider; - - @Autowired - public Cmpv2ClientAdapter(CmpClient cmpClient, RsaContentSignerBuilder rsaContentSignerBuilder, - X509CertificateBuilder x509CertificateBuilder, - CertificateFactoryProvider certificateFactoryProvider) { - this.cmpClient = cmpClient; - this.rsaContentSignerBuilder = rsaContentSignerBuilder; - this.x509CertificateBuilder = x509CertificateBuilder; - this.certificateFactoryProvider = certificateFactoryProvider; - } - - /** - * Uses CmpClient to call to Cmp Server and gather certificates data - * - * @param csrModel Certificate Signing Request from Service external API - * @param server Cmp Server configuration from cmpServers.json - * @return container for returned certificates - * @throws CmpClientException Exceptions which comes from Cmp Client - * @throws Cmpv2ClientAdapterException Exceptions which comes from Adapter itself - */ - public CertificationModel callCmpClient(CsrModel csrModel, Cmpv2Server server) - throws CmpClientException, Cmpv2ClientAdapterException { - List<List<X509Certificate>> certificates = cmpClient.createCertificate(server.getCaName(), - server.getCaMode().getProfile(), csrModel, server, - convertCsrToX509Certificate(csrModel.getCsr(), csrModel.getPrivateKey())); - return new CertificationModel(convertFromX509CertificateListToPemList(certificates.get(0)), - convertFromX509CertificateListToPemList(certificates.get(1))); - } - - private String convertFromX509CertificateToPem(X509Certificate certificate) { - StringWriter sw = new StringWriter(); - try (PemWriter pw = new PemWriter(sw)) { - PemObjectGenerator gen = new JcaMiscPEMGenerator(certificate); - pw.writeObject(gen); - } catch (IOException e) { - LOGGER.error("Exception occurred during convert of X509 certificate", e); - } - return sw.toString(); - } - - private X509Certificate convertCsrToX509Certificate(PKCS10CertificationRequest csr, PrivateKey privateKey) - throws Cmpv2ClientAdapterException { - try { - X509v3CertificateBuilder certificateGenerator = x509CertificateBuilder.build(csr); - ContentSigner signer = rsaContentSignerBuilder.build(csr, privateKey); - X509CertificateHolder holder = certificateGenerator.build(signer); - return certificateFactoryProvider - .generateCertificate(new ByteArrayInputStream(holder.toASN1Structure().getEncoded())); - } catch (IOException | CertificateException | OperatorCreationException | NoSuchProviderException e) { - throw new Cmpv2ClientAdapterException(e); - } - } - - private List<String> convertFromX509CertificateListToPemList(List<X509Certificate> certificates) { - return certificates.stream().map(this::convertFromX509CertificateToPem).filter(cert -> !cert.isEmpty()) - .collect(Collectors.toList()); - } - -} diff --git a/certService/src/main/java/org/onap/aaf/certservice/cmpv2client/api/CmpClient.java b/certService/src/main/java/org/onap/aaf/certservice/cmpv2client/api/CmpClient.java index 7de3b712..6ff1bf68 100644 --- a/certService/src/main/java/org/onap/aaf/certservice/cmpv2client/api/CmpClient.java +++ b/certService/src/main/java/org/onap/aaf/certservice/cmpv2client/api/CmpClient.java @@ -41,13 +41,8 @@ public interface CmpClient { * IAK/RV, Verification of the signature (proof-of-possession) on the request is performed and an * Exception thrown if verification fails or issue encountered in fetching certificate from CA. * - * @param caName Information about the External Root Certificate Authority (CA) performing the - * event CA Name. Could be {@code null}. - * @param profile Profile on CA server Client/RA Mode configuration on Server. Could be {@code - * null}. * @param csrModel Certificate Signing Request model. Must not be {@code null}. * @param server CMPv2 Server. Must not be {@code null}. - * @param csr Certificate Signing Request {.cer} file. Must not be {@code null}. * @param notBefore An optional validity to set in the created certificate, Certificate not valid * before this date. * @param notAfter An optional validity to set in the created certificate, Certificate not valid @@ -56,11 +51,8 @@ public interface CmpClient { * @throws CmpClientException if client error occurs. */ List<List<X509Certificate>> createCertificate( - String caName, - String profile, CsrModel csrModel, Cmpv2Server server, - X509Certificate csr, Date notBefore, Date notAfter) throws CmpClientException; @@ -71,21 +63,13 @@ public interface CmpClient { * IAK/RV, Verification of the signature (proof-of-possession) on the request is performed and an * Exception thrown if verification fails or issue encountered in fetching certificate from CA. * - * @param caName Information about the External Root Certificate Authority (CA) performing the - * event CA Name. Could be {@code null}. - * @param profile Profile on CA server Client/RA Mode configuration on Server. Could be {@code - * null}. * @param csrModel Certificate Signing Request Model. Must not be {@code null}. * @param server CMPv2 server. Must not be {@code null}. - * @param csr Certificate Signing Request {.cer} file. Must not be {@code null}. * @return {@link X509Certificate} The newly created Certificate. * @throws CmpClientException if client error occurs. */ List<List<X509Certificate>> createCertificate( - String caName, - String profile, CsrModel csrModel, - Cmpv2Server server, - X509Certificate csr) + Cmpv2Server server) throws CmpClientException; } diff --git a/certService/src/main/java/org/onap/aaf/certservice/cmpv2client/impl/CmpClientImpl.java b/certService/src/main/java/org/onap/aaf/certservice/cmpv2client/impl/CmpClientImpl.java index 79656e91..28731f29 100644 --- a/certService/src/main/java/org/onap/aaf/certservice/cmpv2client/impl/CmpClientImpl.java +++ b/certService/src/main/java/org/onap/aaf/certservice/cmpv2client/impl/CmpClientImpl.java @@ -48,6 +48,7 @@ import org.bouncycastle.asn1.cmp.PKIBody; import org.bouncycastle.asn1.cmp.PKIHeader; import org.bouncycastle.asn1.cmp.PKIMessage; import org.bouncycastle.asn1.x509.AlgorithmIdentifier; +import org.onap.aaf.certservice.certification.configuration.model.CaMode; import org.onap.aaf.certservice.certification.configuration.model.Cmpv2Server; import org.onap.aaf.certservice.certification.model.CsrModel; import org.onap.aaf.certservice.cmpv2client.exceptions.CmpClientException; @@ -64,8 +65,8 @@ public class CmpClientImpl implements CmpClient { private static final Logger LOG = LoggerFactory.getLogger(CmpClientImpl.class); private final CloseableHttpClient httpClient; - private static final String DEFAULT_PROFILE = "RA"; private static final String DEFAULT_CA_NAME = "Certification Authority"; + private static final String DEFAULT_PROFILE = CaMode.RA.getProfile(); public CmpClientImpl(CloseableHttpClient httpClient) { this.httpClient = httpClient; @@ -73,16 +74,13 @@ public class CmpClientImpl implements CmpClient { @Override public List<List<X509Certificate>> createCertificate( - String caName, - String profile, CsrModel csrModel, Cmpv2Server server, - X509Certificate cert, Date notBefore, Date notAfter) throws CmpClientException { - validate(csrModel, server, cert, caName, profile, httpClient, notBefore, notAfter); + validate(csrModel, server, httpClient, notBefore, notAfter); KeyPair keyPair = new KeyPair(csrModel.getPublicKey(), csrModel.getPrivateKey()); final CreateCertRequest certRequest = @@ -99,14 +97,13 @@ public class CmpClientImpl implements CmpClient { final PKIMessage pkiMessage = certRequest.generateCertReq(); Cmpv2HttpClient cmpv2HttpClient = new Cmpv2HttpClient(httpClient); - return retrieveCertificates(caName, csrModel, server, pkiMessage, cmpv2HttpClient); + return retrieveCertificates(csrModel, server, pkiMessage, cmpv2HttpClient); } @Override - public List<List<X509Certificate>> createCertificate( - String caName, String profile, CsrModel csrModel, Cmpv2Server server, X509Certificate csr) + public List<List<X509Certificate>> createCertificate(CsrModel csrModel, Cmpv2Server server) throws CmpClientException { - return createCertificate(caName, profile, csrModel, server, csr, null, null); + return createCertificate(csrModel, server, null, null); } private void checkCmpResponse( @@ -197,25 +194,19 @@ public class CmpClientImpl implements CmpClient { * * @param csrModel Certificate Signing Request model. Must not be {@code null}. * @param server CMPv2 Server. Must not be {@code null}. - * @param cert Certificate object needed to validate response from CA server. - * @param incomingCaName Date specifying certificate is not valid before this date. - * @param incomingProfile Date specifying certificate is not valid after this date. * @throws IllegalArgumentException if Before Date is set after the After Date. */ private static void validate( final CsrModel csrModel, final Cmpv2Server server, - final X509Certificate cert, - final String incomingCaName, - final String incomingProfile, final CloseableHttpClient httpClient, final Date notBefore, final Date notAfter) { - String caName = CmpUtil.isNullOrEmpty(incomingCaName) ? incomingCaName : DEFAULT_CA_NAME; - String caProfile = CmpUtil.isNullOrEmpty(incomingProfile) ? incomingProfile : DEFAULT_PROFILE; + String caName = CmpUtil.isNullOrEmpty(server.getCaName()) ? server.getCaName() : DEFAULT_CA_NAME; + String profile = server.getCaMode() != null ? server.getCaMode().getProfile() : DEFAULT_PROFILE; LOG.info( - "Validate before creating Certificate Request for CA :{} in Mode {} ", caName, caProfile); + "Validate before creating Certificate Request for CA :{} in Mode {} ", caName, profile); CmpUtil.notNull(csrModel, "CsrModel Instance"); CmpUtil.notNull(csrModel.getSubjectData(), "Subject DN"); @@ -224,7 +215,6 @@ public class CmpClientImpl implements CmpClient { CmpUtil.notNull(server.getIssuerDN(), "Issuer DN"); CmpUtil.notNull(server.getUrl(), "External CA URL"); CmpUtil.notNull(server.getAuthentication().getIak(), "IAK/RV Password"); - CmpUtil.notNull(cert, "Certificate Signing Request (CSR)"); CmpUtil.notNull(httpClient, "Closeable Http Client"); if (notBefore != null && notAfter != null && notBefore.compareTo(notAfter) > 0) { @@ -233,9 +223,9 @@ public class CmpClientImpl implements CmpClient { } private List<List<X509Certificate>> retrieveCertificates( - String caName, CsrModel csrModel, Cmpv2Server server, PKIMessage pkiMessage, Cmpv2HttpClient cmpv2HttpClient) + CsrModel csrModel, Cmpv2Server server, PKIMessage pkiMessage, Cmpv2HttpClient cmpv2HttpClient) throws CmpClientException { - final byte[] respBytes = cmpv2HttpClient.postRequest(pkiMessage, server.getUrl(), caName); + final byte[] respBytes = cmpv2HttpClient.postRequest(pkiMessage, server.getUrl(), server.getCaName()); try { final PKIMessage respPkiMessage = PKIMessage.getInstance(respBytes); LOG.info("Received response from Server"); diff --git a/certService/src/main/java/org/onap/aaf/certservice/cmpv2client/impl/CreateCertRequest.java b/certService/src/main/java/org/onap/aaf/certservice/cmpv2client/impl/CreateCertRequest.java index 687c47d1..74380d84 100644 --- a/certService/src/main/java/org/onap/aaf/certservice/cmpv2client/impl/CreateCertRequest.java +++ b/certService/src/main/java/org/onap/aaf/certservice/cmpv2client/impl/CreateCertRequest.java @@ -28,12 +28,9 @@ import java.security.KeyPair; import java.util.Date; import java.util.List; -import org.bouncycastle.asn1.DERUTF8String; import org.bouncycastle.asn1.cmp.PKIBody; import org.bouncycastle.asn1.cmp.PKIHeader; import org.bouncycastle.asn1.cmp.PKIMessage; -import org.bouncycastle.asn1.crmf.AttributeTypeAndValue; -import org.bouncycastle.asn1.crmf.CRMFObjectIdentifiers; import org.bouncycastle.asn1.crmf.CertReqMessages; import org.bouncycastle.asn1.crmf.CertReqMsg; import org.bouncycastle.asn1.crmf.CertRequest; @@ -114,12 +111,7 @@ class CreateCertRequest { final ProofOfPossession proofOfPossession = CmpMessageHelper.generateProofOfPossession(certRequest, subjectKeyPair); - final AttributeTypeAndValue[] attrTypeVal = { - new AttributeTypeAndValue( - CRMFObjectIdentifiers.id_regCtrl_regToken, new DERUTF8String(initAuthPassword)) - }; - - final CertReqMsg certReqMsg = new CertReqMsg(certRequest, proofOfPossession, attrTypeVal); + final CertReqMsg certReqMsg = new CertReqMsg(certRequest, proofOfPossession, null); final CertReqMessages certReqMessages = new CertReqMessages(certReqMsg); final PKIHeader pkiHeader = |