1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
|
/*-
* ============LICENSE_START=======================================================
* Copyright (C) 2020 Nordix Foundation.
* Copyright (C) 2021 Nokia.
* ================================================================================
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*
* SPDX-License-Identifier: Apache-2.0
* ============LICENSE_END=========================================================
*/
package org.onap.oom.certservice.cmpv2client.impl;
import org.bouncycastle.asn1.ASN1Encodable;
import org.bouncycastle.asn1.ASN1Encoding;
import org.bouncycastle.asn1.ASN1EncodableVector;
import org.bouncycastle.asn1.ASN1GeneralizedTime;
import org.bouncycastle.asn1.ASN1OctetString;
import org.bouncycastle.asn1.ASN1OutputStream;
import org.bouncycastle.asn1.DEROctetString;
import org.bouncycastle.asn1.DERSequence;
import org.bouncycastle.asn1.cmp.CMPObjectIdentifiers;
import org.bouncycastle.asn1.cmp.InfoTypeAndValue;
import org.bouncycastle.asn1.cmp.PKIBody;
import org.bouncycastle.asn1.cmp.PKIHeader;
import org.bouncycastle.asn1.cmp.PKIHeaderBuilder;
import org.bouncycastle.asn1.x500.X500Name;
import org.bouncycastle.asn1.x509.AlgorithmIdentifier;
import org.bouncycastle.asn1.x509.GeneralName;
import org.onap.oom.certservice.cmpv2client.exceptions.CmpClientException;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import java.io.ByteArrayOutputStream;
import java.io.IOException;
import java.security.SecureRandom;
import java.util.Date;
import java.util.Objects;
public final class CmpUtil {
private static final Logger LOGGER = LoggerFactory.getLogger(CmpUtil.class);
private static final SecureRandom SECURE_RANDOM = new SecureRandom();
public static final int RANDOM_BYTE_LENGTH = 16;
public static final int RANDOM_SEED = 1000;
private CmpUtil() {
}
/**
* Validates specified object reference is not null.
*
* @param argument T - the type of the reference.
* @param message message - detail message to be used in the event that a NullPointerException is
* thrown.
* @return The Object if not null
*/
public static <T> T notNull(T argument, String message) {
return Objects.requireNonNull(argument, message + " must not be null");
}
/**
* Validates String object reference is not null and not empty.
*
* @param stringArg String Object that need to be validated.
* @return boolean
*/
public static boolean isNullOrEmpty(String stringArg) {
return (stringArg != null && !stringArg.trim().isEmpty());
}
/**
* Creates a random number than can be used for sendernonce, transactionId and salts.
*
* @return bytes containing a random number string representing a nonce
*/
public static byte[] createRandomBytes() {
LOGGER.debug("Generating random array of bytes");
byte[] randomBytes = new byte[RANDOM_BYTE_LENGTH];
SECURE_RANDOM.nextBytes(randomBytes);
return randomBytes;
}
/**
* Creates a random integer than can be used to represent a transactionId or determine the number
* iterations in a protection algorithm.
*
* @return bytes containing a random number string representing a nonce
*/
public static int createRandomInt(int range) {
LOGGER.debug("Generating random integer");
return SECURE_RANDOM.nextInt(range) + RANDOM_SEED;
}
/**
* Generates protected bytes of a combined PKIHeader and PKIBody.
*
* @param header Header of PKIMessage containing common parameters
* @param body Body of PKIMessage containing specific information for message
* @return bytes representing the PKIHeader and PKIBody thats to be protected
*/
public static byte[] generateProtectedBytes(PKIHeader header, PKIBody body) throws CmpClientException {
LOGGER.debug("Generating array of bytes representing PkiHeader and PkiBody");
byte[] res;
ASN1EncodableVector vector = new ASN1EncodableVector();
vector.add(header);
vector.add(body);
ASN1Encodable protectedPart = new DERSequence(vector);
try (ByteArrayOutputStream baos = new ByteArrayOutputStream()) {
ASN1OutputStream out = ASN1OutputStream.create(baos,ASN1Encoding.DER);
out.writeObject(protectedPart);
res = baos.toByteArray();
} catch (IOException ioe) {
CmpClientException cmpClientException =
new CmpClientException("IOException occurred while creating protectedBytes", ioe);
LOGGER.error("IOException occurred while creating protectedBytes");
throw cmpClientException;
}
return res;
}
/**
* Generates a PKIHeader object.
*
* @param subjectDn distinguished name of Subject
* @param issuerDn distinguished name of external CA
* @param protectionAlg protection Algorithm used to protect PKIMessage
* @param senderKid sender identifier for receiver used for verification
* @return PKIHeader
*/
static PKIHeader generatePkiHeader(
X500Name subjectDn, X500Name issuerDn, AlgorithmIdentifier protectionAlg, String senderKid) {
LOGGER.debug("Generating a Pki Header Builder");
PKIHeaderBuilder pkiHeaderBuilder =
new PKIHeaderBuilder(
PKIHeader.CMP_2000, new GeneralName(subjectDn), new GeneralName(issuerDn));
pkiHeaderBuilder.setMessageTime(new ASN1GeneralizedTime(new Date()));
pkiHeaderBuilder.setSenderNonce(new DEROctetString(createRandomBytes()));
pkiHeaderBuilder.setTransactionID(new DEROctetString(createRandomBytes()));
pkiHeaderBuilder.setProtectionAlg(protectionAlg);
pkiHeaderBuilder.setGeneralInfo(new InfoTypeAndValue(CMPObjectIdentifiers.it_implicitConfirm));
pkiHeaderBuilder.setSenderKID(mapToAsn1OctetString(senderKid));
return pkiHeaderBuilder.build();
}
private static ASN1OctetString mapToAsn1OctetString(String string) {
return string != null ? new DEROctetString(string.getBytes()) : null;
}
}
|
