1 files changed, 14 insertions, 63 deletions

diff --git a/csarvalidation/src/main/java/org/onap/cvc/csar/security/CmsSignatureValidator.java b/csarvalidation/src/main/java/org/onap/cvc/csar/security/CmsSignatureValidator.java
index 47d4bef..5d7b879 100644
--- a/csarvalidation/src/main/java/org/onap/cvc/csar/security/CmsSignatureValidator.java
+++ b/csarvalidation/src/main/java/org/onap/cvc/csar/security/CmsSignatureValidator.java
@@ -17,30 +17,14 @@
 
 package org.onap.cvc.csar.security;
 
-import org.bouncycastle.asn1.cms.ContentInfo;
-import org.bouncycastle.cert.X509CertificateHolder;
 import org.bouncycastle.cms.CMSException;
-import org.bouncycastle.cms.CMSProcessableByteArray;
-import org.bouncycastle.cms.CMSSignedData;
 import org.bouncycastle.cms.CMSSignerDigestMismatchException;
-import org.bouncycastle.cms.CMSTypedData;
-import org.bouncycastle.cms.SignerInformation;
 import org.bouncycastle.cms.jcajce.JcaSimpleSignerInfoVerifierBuilder;
-import org.bouncycastle.openssl.PEMParser;
 import org.bouncycastle.operator.OperatorCreationException;
-import org.bouncycastle.util.Store;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
-import java.io.ByteArrayInputStream;
-import java.io.IOException;
-import java.io.InputStream;
-import java.io.InputStreamReader;
-import java.nio.charset.Charset;
-import java.security.cert.CertificateException;
-import java.security.cert.CertificateFactory;
 import java.security.cert.X509Certificate;
-import java.util.Collection;
 import java.util.Optional;
 
 public class CmsSignatureValidator {
@@ -52,63 +36,30 @@ public class CmsSignatureValidator {
             final Optional<byte[]> certificate,
             final byte[] fileContent) throws CmsSignatureValidatorException {
 
-        try (ByteArrayInputStream cmsSignatureStream = new ByteArrayInputStream(cmsSignature)) {
-            CMSSignedData signedData = getCMSSignedData(fileContent, cmsSignatureStream);
-            Collection<SignerInformation> signers = signedData.getSignerInfos().getSigners();
-            SignerInformation firstSigner = signers.iterator().next();
-
-            Store<X509CertificateHolder> certificates = signedData.getCertificates();
-            Collection<X509CertificateHolder> firstSignerCertificates = certificates.getMatches(firstSigner.getSID());
-            X509Certificate cert;
-            if (!firstSignerCertificates.isEmpty()) {
-                X509CertificateHolder firstSignerFirstCertificate = getX509CertificateHolder(firstSignerCertificates);
-                cert = loadCertificate(firstSignerFirstCertificate.getEncoded());
-            } else {
-                cert = loadCertificate(certificate.orElseThrow(() -> new CmsSignatureValidatorException("No certificate found in cms signature and ETSI-Entry-Certificate doesn't exist")));
+        try {
+            CmsSignatureData signatureData = new CmsSignatureDataFactory().createForFirstSigner(cmsSignature, fileContent);
+            if( signatureData.getCertificate().isEmpty() ) {
+                signatureData.loadCertificate(certificate.orElseThrow(() -> new CmsSignatureValidatorException("No certificate found in cms signature and ETSI-Entry-Certificate doesn't exist")));
             }
+            return verifySignedData(signatureData);
+        } catch ( CmsSignatureLoadingException e) {
+            throw new CmsSignatureValidatorException("Unexpected error occurred during signature validation!", e);
+        }
+    }
 
-            return firstSigner.verify(new JcaSimpleSignerInfoVerifierBuilder().build(cert));
+    public boolean verifySignedData(final CmsSignatureData signatureData) throws CmsSignatureValidatorException {
+        try {
+            X509Certificate certificate = signatureData.getCertificate().orElseThrow(() -> new CMSException("No certificate found in signature data!"));
+            return signatureData.getSignerInformation().verify(new JcaSimpleSignerInfoVerifierBuilder().build(certificate));
         } catch (CMSSignerDigestMismatchException e){
             //message-digest attribute value does not match calculated value
             LOG.warn("CMS signer digest mismatch.", e);
             return false;
         }
-        catch (OperatorCreationException | IOException | CMSException e) {
+        catch (OperatorCreationException | CMSException e) {
             throw new CmsSignatureValidatorException("Unexpected error occurred during signature validation!", e);
         }
     }
 
-    private X509CertificateHolder getX509CertificateHolder(Collection<X509CertificateHolder> firstSignerCertificates) throws CmsSignatureValidatorException {
-        if(!firstSignerCertificates.iterator().hasNext()){
-            throw new CmsSignatureValidatorException("No certificate found in cms signature that should contain one!");
-        }
-        return firstSignerCertificates.iterator().next();
-    }
-
-    private CMSSignedData getCMSSignedData(byte[] innerPackageFileCSAR, ByteArrayInputStream signatureStream) throws IOException, CmsSignatureValidatorException, CMSException {
-        ContentInfo signature = produceSignature(signatureStream);
-        CMSTypedData signedContent = new CMSProcessableByteArray(innerPackageFileCSAR);
-        return new CMSSignedData(signedContent, signature);
-    }
-
-    private ContentInfo produceSignature(ByteArrayInputStream signatureStream) throws IOException, CmsSignatureValidatorException {
-        Object parsedObject = new PEMParser(new InputStreamReader(signatureStream, Charset.defaultCharset())).readObject();
-        if (!(parsedObject instanceof ContentInfo)) {
-            throw new CmsSignatureValidatorException("Signature is not recognized!");
-        }
-        return ContentInfo.getInstance(parsedObject);
-    }
-
-
-    private X509Certificate loadCertificate(byte[] certFile) throws CmsSignatureValidatorException {
-        try (InputStream in = new ByteArrayInputStream(certFile)) {
-            CertificateFactory factory = CertificateFactory.getInstance("X.509");
-            return (X509Certificate) factory.generateCertificate(in);
-        } catch (CertificateException | IOException e) {
-            throw new CmsSignatureValidatorException("Error during loading Certificate from bytes!", e);
-        }
-    }
-
-
 }