diff options
Diffstat (limited to 'certService/src/main')
6 files changed, 308 insertions, 61 deletions
diff --git a/certService/src/main/java/org/onap/aaf/certservice/api/CertificationService.java b/certService/src/main/java/org/onap/aaf/certservice/api/CertificationService.java new file mode 100644 index 00000000..a46e07fc --- /dev/null +++ b/certService/src/main/java/org/onap/aaf/certservice/api/CertificationService.java @@ -0,0 +1,82 @@ +/* + * ============LICENSE_START======================================================= + * PROJECT + * ================================================================================ + * Copyright (C) 2020 Nokia. All rights reserved. + * ================================================================================ + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END========================================================= + */ + +package org.onap.aaf.certservice.api; + +import org.onap.aaf.certservice.certification.CsrModelFactory; +import org.onap.aaf.certservice.certification.CsrModelFactory.StringBase64; +import org.onap.aaf.certservice.certification.exceptions.CsrDecryptionException; +import org.onap.aaf.certservice.certification.model.CsrModel; +import org.slf4j.Logger; +import org.slf4j.LoggerFactory; +import org.springframework.beans.factory.annotation.Autowired; +import org.springframework.http.HttpStatus; +import org.springframework.http.ResponseEntity; +import org.springframework.web.bind.annotation.GetMapping; +import org.springframework.web.bind.annotation.PathVariable; +import org.springframework.web.bind.annotation.RequestHeader; +import org.springframework.web.bind.annotation.RestController; + + +@RestController +public class CertificationService { + + private static final Logger LOGGER = LoggerFactory.getLogger(CertificationService.class); + + private final CsrModelFactory csrModelFactory; + + @Autowired + CertificationService(CsrModelFactory csrModelFactory) { + this.csrModelFactory = csrModelFactory; + } + + /** + * Request for signing certificate by given CA. + * + * + * @param caName the name of Certification Authority that will sign root certificate + * @param encodedCsr Certificate Sign Request encoded in Base64 form + * @param encodedPrivateKey Private key for CSR, needed for PoP, encoded in Base64 form + * @return JSON containing trusted certificates and certificate chain + */ + @GetMapping("v1/certificate/{caName}") + public ResponseEntity<String> signCertificate( + @PathVariable String caName, + @RequestHeader("CSR") String encodedCsr, + @RequestHeader("PK") String encodedPrivateKey + ) { + caName = caName.replaceAll("[\n|\r|\t]", "_"); + LOGGER.info("Received certificate signing request for CA named: {}", caName); + + try { + CsrModel csrModel = csrModelFactory.createCsrModel( + new StringBase64(encodedCsr), + new StringBase64(encodedPrivateKey) + ); + LOGGER.debug("Received CSR meta data: \n{}", csrModel); + return new ResponseEntity<>(csrModel.toString(), HttpStatus.OK); + } catch (CsrDecryptionException e) { + LOGGER.error("Exception occurred during certificate signing:", e); + return new ResponseEntity<>("Wrong certificate signing request (CSR) format", HttpStatus.BAD_REQUEST); + } + } + + +} diff --git a/certService/src/main/java/org/onap/aaf/certservice/certification/CsrModelFactory.java b/certService/src/main/java/org/onap/aaf/certservice/certification/CsrModelFactory.java new file mode 100644 index 00000000..80858f4d --- /dev/null +++ b/certService/src/main/java/org/onap/aaf/certservice/certification/CsrModelFactory.java @@ -0,0 +1,70 @@ +/* + * ============LICENSE_START======================================================= + * PROJECT + * ================================================================================ + * Copyright (C) 2020 Nokia. All rights reserved. + * ================================================================================ + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END========================================================= + */ + +package org.onap.aaf.certservice.certification; + +import java.io.IOException; +import java.util.Base64; + +import org.bouncycastle.pkcs.PKCS10CertificationRequest; +import org.bouncycastle.util.io.pem.PemObject; +import org.onap.aaf.certservice.certification.exceptions.CsrDecryptionException; +import org.onap.aaf.certservice.certification.model.CsrModel; +import org.slf4j.Logger; +import org.slf4j.LoggerFactory; +import org.springframework.stereotype.Service; + + +@Service +public class CsrModelFactory { + + private static final Logger LOGGER = LoggerFactory.getLogger(CsrModelFactory.class); + private final PemObjectFactory pemObjectFactory = new PemObjectFactory(); + + public CsrModel createCsrModel(StringBase64 csr, StringBase64 privateKey) throws CsrDecryptionException { + LOGGER.debug("Decoded CSR: \n{}", csr.asString()); + + try { + PemObject pemObject = pemObjectFactory.createPmObject(csr.asString()); + PKCS10CertificationRequest decodedCsr = new PKCS10CertificationRequest( + pemObject.getContent() + ); + PemObject decodedPrivateKey = pemObjectFactory.createPmObject(privateKey.asString()); + return new CsrModel(decodedCsr, decodedPrivateKey); + } catch (IOException e) { + throw new CsrDecryptionException("Incorrect CSR, decryption failed", e); + } + } + + public static class StringBase64 { + private final String value; + private final Base64.Decoder decoder = Base64.getDecoder(); + + public StringBase64(String value) { + this.value = value; + } + + public String asString() { + return new String(decoder.decode(value)); + } + } +} + + diff --git a/certService/src/main/java/org/onap/aaf/certservice/certification/PemObjectFactory.java b/certService/src/main/java/org/onap/aaf/certservice/certification/PemObjectFactory.java new file mode 100644 index 00000000..e3339cc4 --- /dev/null +++ b/certService/src/main/java/org/onap/aaf/certservice/certification/PemObjectFactory.java @@ -0,0 +1,44 @@ +/* + * ============LICENSE_START======================================================= + * PROJECT + * ================================================================================ + * Copyright (C) 2020 Nokia. All rights reserved. + * ================================================================================ + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END========================================================= + */ + +package org.onap.aaf.certservice.certification; + +import java.io.IOException; +import java.io.StringReader; + +import org.bouncycastle.util.io.pem.PemObject; +import org.bouncycastle.util.io.pem.PemReader; + +import org.onap.aaf.certservice.certification.exceptions.CsrDecryptionException; + + +public class PemObjectFactory { + + public PemObject createPmObject(String pem) throws CsrDecryptionException { + + try (StringReader stringReader = new StringReader(pem); + PemReader pemReader = new PemReader(stringReader)) { + return pemReader.readPemObject(); + } catch (IOException e) { + throw new CsrDecryptionException("Unable to create PEM", e); + } + } + +} diff --git a/certService/src/main/java/org/onap/aaf/certservice/certification/exceptions/CsrDecryptionException.java b/certService/src/main/java/org/onap/aaf/certservice/certification/exceptions/CsrDecryptionException.java new file mode 100644 index 00000000..fb16ad91 --- /dev/null +++ b/certService/src/main/java/org/onap/aaf/certservice/certification/exceptions/CsrDecryptionException.java @@ -0,0 +1,27 @@ +/* + * ============LICENSE_START======================================================= + * PROJECT + * ================================================================================ + * Copyright (C) 2020 Nokia. All rights reserved. + * ================================================================================ + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END========================================================= + */ + +package org.onap.aaf.certservice.certification.exceptions; + +public class CsrDecryptionException extends Exception { + public CsrDecryptionException(String message, Throwable cause) { + super(message, cause); + } +} diff --git a/certService/src/main/java/org/onap/aaf/certservice/certification/model/CsrModel.java b/certService/src/main/java/org/onap/aaf/certservice/certification/model/CsrModel.java new file mode 100644 index 00000000..ef76144b --- /dev/null +++ b/certService/src/main/java/org/onap/aaf/certservice/certification/model/CsrModel.java @@ -0,0 +1,85 @@ +/* + * ============LICENSE_START======================================================= + * PROJECT + * ================================================================================ + * Copyright (C) 2020 Nokia. All rights reserved. + * ================================================================================ + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * ============LICENSE_END========================================================= + */ + +package org.onap.aaf.certservice.certification.model; + +import java.io.IOException; +import java.util.Arrays; +import java.util.List; +import java.util.Objects; +import java.util.stream.Collectors; + +import org.bouncycastle.asn1.x500.X500Name; +import org.bouncycastle.asn1.x509.Extension; +import org.bouncycastle.asn1.x509.Extensions; +import org.bouncycastle.asn1.x509.GeneralName; +import org.bouncycastle.asn1.x509.GeneralNames; +import org.bouncycastle.pkcs.PKCS10CertificationRequest; +import org.bouncycastle.util.io.pem.PemObject; + +import org.onap.aaf.certservice.certification.exceptions.CsrDecryptionException; + + +public class CsrModel { + + + private final PKCS10CertificationRequest csr; + private final PemObject privateKey; + + public CsrModel(PKCS10CertificationRequest csr, PemObject privateKey) { + this.csr = csr; + this.privateKey = privateKey; + } + + public PemObject getPublicKey() throws CsrDecryptionException { + try { + return new PemObject("PUBLIC KEY", csr.getSubjectPublicKeyInfo().getEncoded()); + } catch (IOException e) { + throw new CsrDecryptionException("Reading Public Key from CSR failed", e.getCause()); + } + } + + public PemObject getPrivateKey() { + return privateKey; + } + + public X500Name getSubjectData() { + return csr.getSubject(); + } + + public List<String> getSansData() { + Extensions extensions = + Extensions.getInstance(csr.getAttributes()[0].getAttrValues().getObjectAt(0)); + GeneralName[] arrayOfAlternativeNames = + GeneralNames.fromExtensions(extensions, Extension.subjectAlternativeName).getNames(); + + return Arrays.stream(arrayOfAlternativeNames) + .map(GeneralName::getName) + .map(Objects::toString) + .collect(Collectors.toList()); + } + + @Override + public String toString() { + return "Subject: { " + getSubjectData().toString() + + " ,SANs: " + getSansData().toString() + " }"; + } + +} diff --git a/certService/src/main/java/org/onap/aaf/certservice/rest/CertificationService.java b/certService/src/main/java/org/onap/aaf/certservice/rest/CertificationService.java deleted file mode 100644 index 7a93bffa..00000000 --- a/certService/src/main/java/org/onap/aaf/certservice/rest/CertificationService.java +++ /dev/null @@ -1,61 +0,0 @@ -/* - * ============LICENSE_START======================================================= - * PROJECT - * ================================================================================ - * Copyright (C) 2020 Nokia. All rights reserved. - * ================================================================================ - * Licensed under the Apache License, Version 2.0 (the "License"); - * you may not use this file except in compliance with the License. - * You may obtain a copy of the License at - * - * http://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, software - * distributed under the License is distributed on an "AS IS" BASIS, - * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. - * See the License for the specific language governing permissions and - * limitations under the License. - * ============LICENSE_END========================================================= - */ - -package org.onap.aaf.certservice.rest; - -import org.slf4j.Logger; -import org.slf4j.LoggerFactory; -import org.springframework.http.HttpStatus; -import org.springframework.http.ResponseEntity; -import org.springframework.web.bind.annotation.GetMapping; -import org.springframework.web.bind.annotation.PathVariable; -import org.springframework.web.bind.annotation.RequestHeader; -import org.springframework.web.bind.annotation.RestController; - -import java.util.Base64; - -@RestController -public class CertificationService { - - private static final Logger LOGGER = LoggerFactory.getLogger(CertificationService.class); - private static final Base64.Decoder DECODER = Base64.getDecoder(); - - @GetMapping("/csr/{caName}") - public ResponseEntity<String> getEncodesCSR( - @PathVariable String caName, - @RequestHeader("CSR") String encodedCSR, - @RequestHeader("PK") String encodedPrivateKey - ) { - - String csr = decode(encodedCSR); - String privateKey = decode(encodedPrivateKey); - - LOGGER.info("Received CSR for CA named: {}",caName); - LOGGER.debug("Decoded received CSR: \n{}", csr); - - return new ResponseEntity<>(csr, HttpStatus.OK); - - } - - private String decode(String encodedData) { - return new String(DECODER.decode(encodedData)); - } - -} |