List of usage examples for org.bouncycastle.asn1.cmp GenMsgContent getInstance
public static GenMsgContent getInstance(Object o)
From source file:org.xipki.commons.remotep11.server.CmpResponder.java
License:Open Source License
PKIMessage processPkiMessage(final LocalP11CryptServicePool p11CryptServicePool, final String moduleName, final PKIMessage pkiMessage) { ParamUtil.requireNonNull("p11CryptServicePool", p11CryptServicePool); ParamUtil.requireNonNull("pkiMessage", pkiMessage); GeneralPKIMessage message = new GeneralPKIMessage(pkiMessage); PKIHeader reqHeader = message.getHeader(); ASN1OctetString tid = reqHeader.getTransactionID(); if (tid == null) { byte[] randomBytes = randomTransactionId(); tid = new DEROctetString(randomBytes); }/*from w w w.j av a 2 s .c om*/ String tidStr = Hex.toHexString(tid.getOctets()); PKIHeaderBuilder respHeaderBuilder = new PKIHeaderBuilder(reqHeader.getPvno().getValue().intValue(), sender, reqHeader.getSender()); respHeaderBuilder.setTransactionID(tid); PKIBody reqBody = message.getBody(); final int type = reqBody.getType(); PKIHeader respHeader = respHeaderBuilder.build(); if (type != PKIBody.TYPE_GEN_MSG) { ErrorMsgContent emc = new ErrorMsgContent(new PKIStatusInfo(PKIStatus.rejection, new PKIFreeText("unsupported type " + type), new PKIFailureInfo(PKIFailureInfo.badRequest))); PKIBody respBody = new PKIBody(PKIBody.TYPE_ERROR, emc); return new PKIMessage(respHeader, respBody); } GenMsgContent genMsgBody = GenMsgContent.getInstance(reqBody.getContent()); InfoTypeAndValue[] itvs = genMsgBody.toInfoTypeAndValueArray(); InfoTypeAndValue itv = null; if (itvs != null && itvs.length > 0) { for (InfoTypeAndValue m : itvs) { ASN1ObjectIdentifier itvType = m.getInfoType(); if (ObjectIdentifiers.id_xipki_cmp_cmpGenmsg.equals(itvType)) { itv = m; break; } } } if (itv == null) { final String statusMessage = String.format("PKIBody type %s is only supported with the sub-knownTypes", ObjectIdentifiers.id_xipki_cmp_cmpGenmsg.getId()); return createRejectionPkiMessage(respHeader, PKIFailureInfo.badRequest, statusMessage); } try { return doProcessPkiMessage(p11CryptServicePool, moduleName, itv, respHeader); } catch (BadAsn1ObjectException ex) { LogUtil.error(LOG, ex, "could not process CMP message " + tidStr); return createRejectionPkiMessage(respHeader, PKIFailureInfo.badRequest, ex.getMessage()); } catch (P11TokenException ex) { LogUtil.error(LOG, ex, "could not process CMP message " + tidStr); String p11ErrorType; if (ex instanceof P11UnknownEntityException) { p11ErrorType = P11ProxyConstants.ERROR_UNKNOWN_ENTITY; } else if (ex instanceof P11DuplicateEntityException) { p11ErrorType = P11ProxyConstants.ERROR_DUPLICATE_ENTITY; } else if (ex instanceof P11UnsupportedMechanismException) { p11ErrorType = P11ProxyConstants.ERROR_UNSUPPORTED_MECHANISM; } else { p11ErrorType = P11ProxyConstants.ERROR_P11_TOKENERROR; } String errorMessage = ex.getMessage(); if (errorMessage == null) { errorMessage = "NULL"; } else if (StringUtil.isBlank(errorMessage.trim())) { errorMessage = "NULL"; } ConfPairs confPairs = new ConfPairs(p11ErrorType, errorMessage); return createRejectionPkiMessage(respHeader, PKIFailureInfo.badRequest, confPairs.getEncoded()); } catch (Throwable th) { LogUtil.error(LOG, th, "could not process CMP message " + tidStr); return createRejectionPkiMessage(respHeader, PKIFailureInfo.systemFailure, "SYSTEM_FAILURE"); } }
From source file:org.xipki.pki.ca.server.impl.cmp.X509CaCmpResponder.java
License:Open Source License
private PKIBody cmpGeneralMsg(final PKIHeaderBuilder respHeader, final CmpControl cmpControl, final PKIHeader reqHeader, final PKIBody reqBody, final CmpRequestorInfo requestor, final String user, final ASN1OctetString tid, final String msgId, final AuditEvent event) throws InsuffientPermissionException { GenMsgContent genMsgBody = GenMsgContent.getInstance(reqBody.getContent()); InfoTypeAndValue[] itvs = genMsgBody.toInfoTypeAndValueArray(); InfoTypeAndValue itv = null;/*from ww w . j a v a 2 s.c o m*/ if (itvs != null && itvs.length > 0) { for (InfoTypeAndValue entry : itvs) { String itvType = entry.getInfoType().getId(); if (KNOWN_GENMSG_IDS.contains(itvType)) { itv = entry; break; } } } if (itv == null) { String statusMessage = "PKIBody type " + PKIBody.TYPE_GEN_MSG + " is only supported with the sub-types " + KNOWN_GENMSG_IDS.toString(); return buildErrorMsgPkiBody(PKIStatus.rejection, PKIFailureInfo.badRequest, statusMessage); } InfoTypeAndValue itvResp = null; ASN1ObjectIdentifier infoType = itv.getInfoType(); int failureInfo; try { X509Ca ca = getCa(); if (CMPObjectIdentifiers.it_currentCRL.equals(infoType)) { event.addEventType(CaAuditConstants.TYPE_CMP_genm_currentCrl); checkPermission(requestor, Permission.GET_CRL); CertificateList crl = ca.getBcCurrentCrl(); if (itv.getInfoValue() == null) { // as defined in RFC 4210 crl = ca.getBcCurrentCrl(); } else { // xipki extension ASN1Integer crlNumber = ASN1Integer.getInstance(itv.getInfoValue()); crl = ca.getBcCrl(crlNumber.getPositiveValue()); } if (crl == null) { String statusMessage = "no CRL is available"; return buildErrorMsgPkiBody(PKIStatus.rejection, PKIFailureInfo.systemFailure, statusMessage); } itvResp = new InfoTypeAndValue(infoType, crl); } else if (ObjectIdentifiers.id_xipki_cmp_cmpGenmsg.equals(infoType)) { ASN1Encodable asn1 = itv.getInfoValue(); ASN1Integer asn1Code = null; ASN1Encodable reqValue = null; try { ASN1Sequence seq = ASN1Sequence.getInstance(asn1); asn1Code = ASN1Integer.getInstance(seq.getObjectAt(0)); if (seq.size() > 1) { reqValue = seq.getObjectAt(1); } } catch (IllegalArgumentException ex) { String statusMessage = "invalid value of the InfoTypeAndValue for " + ObjectIdentifiers.id_xipki_cmp_cmpGenmsg.getId(); return buildErrorMsgPkiBody(PKIStatus.rejection, PKIFailureInfo.badRequest, statusMessage); } ASN1Encodable respValue; int action = asn1Code.getPositiveValue().intValue(); switch (action) { case XiSecurityConstants.CMP_ACTION_GEN_CRL: event.addEventType(CaAuditConstants.TYPE_CMP_genm_genCrl); checkPermission(requestor, Permission.GEN_CRL); X509CRL tmpCrl = ca.generateCrlOnDemand(msgId); if (tmpCrl == null) { String statusMessage = "CRL generation is not activated"; return buildErrorMsgPkiBody(PKIStatus.rejection, PKIFailureInfo.systemFailure, statusMessage); } else { respValue = CertificateList.getInstance(tmpCrl.getEncoded()); } break; case XiSecurityConstants.CMP_ACTION_GET_CRL_WITH_SN: event.addEventType(CaAuditConstants.TYPE_CMP_genm_crlForNumber); checkPermission(requestor, Permission.GET_CRL); ASN1Integer crlNumber = ASN1Integer.getInstance(reqValue); respValue = ca.getBcCrl(crlNumber.getPositiveValue()); if (respValue == null) { String statusMessage = "no CRL is available"; return buildErrorMsgPkiBody(PKIStatus.rejection, PKIFailureInfo.systemFailure, statusMessage); } break; case XiSecurityConstants.CMP_ACTION_GET_CAINFO: event.addEventType(CaAuditConstants.TYPE_CMP_genm_cainfo); Set<Integer> acceptVersions = new HashSet<>(); if (reqValue != null) { ASN1Sequence seq = DERSequence.getInstance(reqValue); int size = seq.size(); for (int i = 0; i < size; i++) { ASN1Integer ai = ASN1Integer.getInstance(seq.getObjectAt(i)); acceptVersions.add(ai.getPositiveValue().intValue()); } } if (CollectionUtil.isEmpty(acceptVersions)) { acceptVersions.add(1); } String systemInfo = getSystemInfo(requestor, acceptVersions); respValue = new DERUTF8String(systemInfo); break; default: String statusMessage = "unsupported XiPKI action code '" + action + "'"; return buildErrorMsgPkiBody(PKIStatus.rejection, PKIFailureInfo.badRequest, statusMessage); } // end switch (action) ASN1EncodableVector vec = new ASN1EncodableVector(); vec.add(asn1Code); if (respValue != null) { vec.add(respValue); } itvResp = new InfoTypeAndValue(infoType, new DERSequence(vec)); } GenRepContent genRepContent = new GenRepContent(itvResp); return new PKIBody(PKIBody.TYPE_GEN_REP, genRepContent); } catch (OperationException ex) { failureInfo = getPKiFailureInfo(ex); ErrorCode code = ex.getErrorCode(); String errorMessage; switch (code) { case DATABASE_FAILURE: case SYSTEM_FAILURE: errorMessage = code.name(); break; default: errorMessage = code.name() + ": " + ex.getErrorMessage(); break; } // end switch code return buildErrorMsgPkiBody(PKIStatus.rejection, failureInfo, errorMessage); } catch (CRLException ex) { String statusMessage = "CRLException: " + ex.getMessage(); return buildErrorMsgPkiBody(PKIStatus.rejection, PKIFailureInfo.systemFailure, statusMessage); } }