List of usage examples for org.bouncycastle.asn1.cmp InfoTypeAndValue InfoTypeAndValue
public InfoTypeAndValue(ASN1ObjectIdentifier infoType, ASN1Encodable optionalValue)
From source file:org.xipki.ca.client.impl.CmpRequestor.java
License:Open Source License
protected PKIMessage buildMessageWithXipkAction(final int action, final ASN1Encodable value) throws CmpRequestorException { PKIHeader header = buildPKIHeader(null); ASN1EncodableVector v = new ASN1EncodableVector(); v.add(new ASN1Integer(action)); if (value != null) { v.add(value);/*from w w w .j a v a2 s . c o m*/ } InfoTypeAndValue itv = new InfoTypeAndValue(ObjectIdentifiers.id_xipki_cmp, new DERSequence(v)); GenMsgContent genMsgContent = new GenMsgContent(itv); PKIBody body = new PKIBody(PKIBody.TYPE_GEN_MSG, genMsgContent); PKIMessage pkiMessage = new PKIMessage(header, body); return pkiMessage; }
From source file:org.xipki.ca.client.impl.CmpRequestor.java
License:Open Source License
protected PKIMessage buildMessageWithGeneralMsgContent(final ASN1ObjectIdentifier type, final ASN1Encodable value) throws CmpRequestorException { PKIHeader header = buildPKIHeader(null); InfoTypeAndValue itv;/*from w w w . j av a 2 s . c o m*/ if (value != null) { itv = new InfoTypeAndValue(type, value); } else { itv = new InfoTypeAndValue(type); } GenMsgContent genMsgContent = new GenMsgContent(itv); PKIBody body = new PKIBody(PKIBody.TYPE_GEN_MSG, genMsgContent); PKIMessage pkiMessage = new PKIMessage(header, body); return pkiMessage; }
From source file:org.xipki.ca.common.cmp.CmpUtil.java
License:Open Source License
public static InfoTypeAndValue getImplictConfirmGeneralInfo() { return new InfoTypeAndValue(CMPObjectIdentifiers.it_implicitConfirm, DERNull.INSTANCE); }
From source file:org.xipki.ca.common.cmp.CmpUtil.java
License:Open Source License
public static InfoTypeAndValue buildInfoTypeAndValue(final CmpUtf8Pairs utf8Pairs) { return new InfoTypeAndValue(CMPObjectIdentifiers.regInfo_utf8Pairs, new DERUTF8String(utf8Pairs.getEncoded())); }
From source file:org.xipki.ca.server.impl.X509CACmpResponder.java
License:Open Source License
private PKIBody cmpEnrollCert(final PKIHeaderBuilder respHeader, final CmpControl cmpControl, final PKIHeader reqHeader, final PKIBody reqBody, final CmpRequestorInfo requestor, final String user, final ASN1OctetString tid, final AuditEvent auditEvent) throws InsuffientPermissionException { long confirmWaitTime = cmpControl.getConfirmWaitTime(); if (confirmWaitTime < 0) { confirmWaitTime *= -1;//from w w w. j a va 2 s .c o m } confirmWaitTime *= 1000; // second to millisecond boolean sendCaCert = cmpControl.isSendCaCert(); PKIBody respBody; int type = reqBody.getType(); switch (type) { case PKIBody.TYPE_CERT_REQ: addAutitEventType(auditEvent, "CERT_REQ"); checkPermission(requestor, Permission.ENROLL_CERT); respBody = processCr(requestor, user, tid, reqHeader, (CertReqMessages) reqBody.getContent(), confirmWaitTime, sendCaCert, auditEvent); break; case PKIBody.TYPE_KEY_UPDATE_REQ: addAutitEventType(auditEvent, "KEY_UPDATE"); checkPermission(requestor, Permission.KEY_UPDATE); respBody = processKur(requestor, user, tid, reqHeader, (CertReqMessages) reqBody.getContent(), confirmWaitTime, sendCaCert, auditEvent); break; case PKIBody.TYPE_P10_CERT_REQ: addAutitEventType(auditEvent, "CERT_REQ"); checkPermission(requestor, Permission.ENROLL_CERT); respBody = processP10cr(requestor, user, tid, reqHeader, (CertificationRequest) reqBody.getContent(), confirmWaitTime, sendCaCert, auditEvent); break; case PKIBody.TYPE_CROSS_CERT_REQ: addAutitEventType(auditEvent, "CROSS_CERT_REQ"); checkPermission(requestor, Permission.CROSS_CERT_ENROLL); respBody = processCcp(requestor, user, tid, reqHeader, (CertReqMessages) reqBody.getContent(), confirmWaitTime, sendCaCert, auditEvent); break; default: throw new RuntimeException("should not reach here"); } // switch type InfoTypeAndValue tv = null; if (cmpControl.isConfirmCert() == false && CmpUtil.isImplictConfirm(reqHeader)) { pendingCertPool.removeCertificates(tid.getOctets()); tv = CmpUtil.getImplictConfirmGeneralInfo(); } else { Date now = new Date(); respHeader.setMessageTime(new ASN1GeneralizedTime(now)); tv = new InfoTypeAndValue(CMPObjectIdentifiers.it_confirmWaitTime, new ASN1GeneralizedTime(new Date(System.currentTimeMillis() + confirmWaitTime))); } respHeader.setGeneralInfo(tv); return respBody; }
From source file:org.xipki.ca.server.impl.X509CACmpResponder.java
License:Open Source License
private PKIBody cmpGeneralMsg(final PKIHeaderBuilder respHeader, final CmpControl cmpControl, final PKIHeader reqHeader, final PKIBody reqBody, final CmpRequestorInfo requestor, final String user, final ASN1OctetString tid, final AuditEvent auditEvent) throws InsuffientPermissionException { GenMsgContent genMsgBody = (GenMsgContent) reqBody.getContent(); InfoTypeAndValue[] itvs = genMsgBody.toInfoTypeAndValueArray(); InfoTypeAndValue itv = null;//from w ww .j ava2s . c o m if (itvs != null && itvs.length > 0) { for (InfoTypeAndValue _itv : itvs) { String itvType = _itv.getInfoType().getId(); if (knownGenMsgIds.contains(itvType)) { itv = _itv; break; } } } if (itv == null) { String statusMessage = "PKIBody type " + PKIBody.TYPE_GEN_MSG + " is only supported with the sub-types " + knownGenMsgIds.toString(); return createErrorMsgPKIBody(PKIStatus.rejection, PKIFailureInfo.badRequest, statusMessage); } InfoTypeAndValue itvResp = null; ASN1ObjectIdentifier infoType = itv.getInfoType(); int failureInfo; try { X509CA ca = getCA(); if (CMPObjectIdentifiers.it_currentCRL.equals(infoType)) { addAutitEventType(auditEvent, "CRL_DOWNLOAD"); checkPermission(requestor, Permission.GET_CRL); CertificateList crl = ca.getCurrentCRL(); if (itv.getInfoValue() == null) { // as defined in RFC 4210 crl = ca.getCurrentCRL(); } else { // xipki extension ASN1Integer crlNumber = ASN1Integer.getInstance(itv.getInfoValue()); crl = ca.getCRL(crlNumber.getPositiveValue()); } if (crl == null) { String statusMessage = "no CRL is available"; return createErrorMsgPKIBody(PKIStatus.rejection, PKIFailureInfo.systemFailure, statusMessage); } itvResp = new InfoTypeAndValue(infoType, crl); } else if (ObjectIdentifiers.id_xipki_cmp.equals(infoType)) { ASN1Encodable asn1 = itv.getInfoValue(); ASN1Integer asn1Code = null; ASN1Encodable reqValue = null; try { ASN1Sequence seq = ASN1Sequence.getInstance(asn1); asn1Code = ASN1Integer.getInstance(seq.getObjectAt(0)); if (seq.size() > 1) { reqValue = seq.getObjectAt(1); } } catch (IllegalArgumentException e) { String statusMessage = "invalid value of the InfoTypeAndValue for " + ObjectIdentifiers.id_xipki_cmp.getId(); return createErrorMsgPKIBody(PKIStatus.rejection, PKIFailureInfo.badRequest, statusMessage); } ASN1Encodable respValue; int action = asn1Code.getPositiveValue().intValue(); switch (action) { case XipkiCmpConstants.ACTION_GEN_CRL: addAutitEventType(auditEvent, "CRL_GEN_ONDEMAND"); checkPermission(requestor, Permission.GEN_CRL); X509CRL _crl = ca.generateCRLonDemand(auditEvent); if (_crl == null) { String statusMessage = "CRL generation is not activated"; return createErrorMsgPKIBody(PKIStatus.rejection, PKIFailureInfo.systemFailure, statusMessage); } else { respValue = CertificateList.getInstance(_crl.getEncoded()); } break; case XipkiCmpConstants.ACTION_GET_CRL_WITH_SN: addAutitEventType(auditEvent, "CRL_DOWNLOAD_WITH_SN"); checkPermission(requestor, Permission.GET_CRL); ASN1Integer crlNumber = ASN1Integer.getInstance(reqValue); respValue = ca.getCRL(crlNumber.getPositiveValue()); if (respValue == null) { String statusMessage = "no CRL is available"; return createErrorMsgPKIBody(PKIStatus.rejection, PKIFailureInfo.systemFailure, statusMessage); } break; case XipkiCmpConstants.ACTION_GET_CAINFO: addAutitEventType(auditEvent, "GET_SYSTEMINFO"); Set<Integer> acceptVersions = new HashSet<>(); if (reqValue != null) { ASN1Sequence seq = DERSequence.getInstance(reqValue); int size = seq.size(); for (int i = 0; i < size; i++) { ASN1Integer a = ASN1Integer.getInstance(seq.getObjectAt(i)); acceptVersions.add(a.getPositiveValue().intValue()); } } if (CollectionUtil.isEmpty(acceptVersions)) { acceptVersions.add(1); } String systemInfo = getSystemInfo(requestor, acceptVersions); respValue = new DERUTF8String(systemInfo); break; case XipkiCmpConstants.ACTION_REMOVE_EXPIRED_CERTS: checkPermission(requestor, Permission.REMOVE_CERT); String info = removeExpiredCerts(requestor, itv.getInfoValue()); respValue = new DERUTF8String(info); break; default: String statusMessage = "unsupported XiPKI action code '" + action + "'"; return createErrorMsgPKIBody(PKIStatus.rejection, PKIFailureInfo.badRequest, statusMessage); } // end switch(action) ASN1EncodableVector v = new ASN1EncodableVector(); v.add(asn1Code); if (respValue != null) { v.add(respValue); } itvResp = new InfoTypeAndValue(infoType, new DERSequence(v)); } GenRepContent genRepContent = new GenRepContent(itvResp); return new PKIBody(PKIBody.TYPE_GEN_REP, genRepContent); } catch (OperationException e) { failureInfo = PKIFailureInfo.systemFailure; String statusMessage = null; ErrorCode code = e.getErrorCode(); switch (code) { case BAD_REQUEST: failureInfo = PKIFailureInfo.badRequest; statusMessage = e.getErrorMessage(); break; case DATABASE_FAILURE: case SYSTEM_FAILURE: statusMessage = code.name(); break; default: statusMessage = code.name() + ": " + e.getErrorMessage(); break; } // end switch(code) return createErrorMsgPKIBody(PKIStatus.rejection, failureInfo, statusMessage); } catch (CRLException e) { String statusMessage = "CRLException: " + e.getMessage(); return createErrorMsgPKIBody(PKIStatus.rejection, PKIFailureInfo.systemFailure, statusMessage); } }
From source file:org.xipki.commons.remotep11.server.CmpResponder.java
License:Open Source License
private PKIMessage doProcessPkiMessage(final LocalP11CryptServicePool p11CryptServicePool, final String moduleName, final InfoTypeAndValue itv, final PKIHeader respHeader) throws BadAsn1ObjectException, P11TokenException, CertificateException, XiSecurityException, InvalidKeyException {// w w w . j ava2 s .co m ASN1Sequence seq = Asn1Util.getSequence(itv.getInfoValue()); Asn1Util.requireRange(seq, 3, 3); int protocolVersion = Asn1Util.getInteger(seq.getObjectAt(0)).intValue(); int action = Asn1Util.getInteger(seq.getObjectAt(1)).intValue(); ASN1Encodable reqValue = seq.getObjectAt(2); P11CryptService p11CryptService = p11CryptServicePool.getP11CryptService(moduleName); ASN1Encodable respItvInfoValue = null; if (P11ProxyConstants.ACTION_addCert == action) { Asn1EntityIdAndCert asn1 = Asn1EntityIdAndCert.getInstance(reqValue); P11Slot slot = getSlot(p11CryptService, asn1.getEntityId()); X509Certificate cert = X509Util.toX509Cert(asn1.getCertificate()); slot.addCert(asn1.getEntityId().getObjectId().getObjectId(), cert); } else if (P11ProxyConstants.ACTION_genKeypair_DSA == action) { Asn1GenDSAKeypairParams asn1 = Asn1GenDSAKeypairParams.getInstance(reqValue); P11Slot slot = getSlot(p11CryptService, asn1.getSlotId()); P11ObjectIdentifier keyId = slot.generateDSAKeypair(asn1.getP(), asn1.getQ(), asn1.getG(), asn1.getLabel()); respItvInfoValue = new Asn1P11EntityIdentifier(asn1.getSlotId().getSlotId(), keyId); } else if (P11ProxyConstants.ACTION_genKeypair_EC == action) { Asn1GenECKeypairParams asn1 = Asn1GenECKeypairParams.getInstance(reqValue); P11Slot slot = getSlot(p11CryptService, asn1.getSlotId()); P11ObjectIdentifier keyId = slot.generateECKeypair(asn1.getCurveId().getId(), asn1.getLabel()); respItvInfoValue = new Asn1P11EntityIdentifier(asn1.getSlotId().getSlotId(), keyId); } else if (P11ProxyConstants.ACTION_genKeypair_RSA == action) { Asn1GenRSAKeypairParams asn1 = Asn1GenRSAKeypairParams.getInstance(reqValue); P11Slot slot = getSlot(p11CryptService, asn1.getSlotId()); P11ObjectIdentifier keyId = slot.generateRSAKeypair(asn1.getKeysize(), asn1.getPublicExponent(), asn1.getLabel()); respItvInfoValue = new Asn1P11EntityIdentifier(asn1.getSlotId().getSlotId(), keyId); } else if (P11ProxyConstants.ACTION_getCertificate == action) { P11EntityIdentifier entityId = Asn1P11EntityIdentifier.getInstance(reqValue).getEntityId(); X509Certificate cert = p11CryptService.getIdentity(entityId).getCertificate(); respItvInfoValue = Certificate.getInstance(cert.getEncoded()); } else if (P11ProxyConstants.ACTION_getCertIdentifiers == action || P11ProxyConstants.ACTION_getIdentityIdentifiers == action) { Asn1P11SlotIdentifier slotId = Asn1P11SlotIdentifier.getInstance(reqValue); P11Slot slot = p11CryptService.getModule().getSlot(slotId.getSlotId()); Set<P11ObjectIdentifier> objectIds; if (P11ProxyConstants.ACTION_getCertIdentifiers == action) { objectIds = slot.getCertIdentifiers(); } else { objectIds = slot.getIdentityIdentifiers(); } ASN1EncodableVector vec = new ASN1EncodableVector(); for (P11ObjectIdentifier objectId : objectIds) { vec.add(new Asn1P11ObjectIdentifier(objectId)); } respItvInfoValue = new DERSequence(vec); } else if (P11ProxyConstants.ACTION_getMechanisms == action) { P11SlotIdentifier slotId = Asn1P11SlotIdentifier.getInstance(reqValue).getSlotId(); Set<Long> mechs = p11CryptService.getSlot(slotId).getMechanisms(); ASN1EncodableVector vec = new ASN1EncodableVector(); for (Long mech : mechs) { vec.add(new ASN1Integer(mech)); } respItvInfoValue = new DERSequence(vec); } else if (P11ProxyConstants.ACTION_getPublicKey == action) { P11EntityIdentifier identityId = Asn1P11EntityIdentifier.getInstance(reqValue).getEntityId(); PublicKey pubKey = p11CryptService.getIdentity(identityId).getPublicKey(); if (pubKey == null) { throw new P11UnknownEntityException(identityId); } respItvInfoValue = KeyUtil.createSubjectPublicKeyInfo(pubKey); } else if (P11ProxyConstants.ACTION_getSlotIds == action) { List<P11SlotIdentifier> slotIds = p11CryptService.getModule().getSlotIdentifiers(); ASN1EncodableVector vector = new ASN1EncodableVector(); for (P11SlotIdentifier slotId : slotIds) { vector.add(new Asn1P11SlotIdentifier(slotId)); } respItvInfoValue = new DERSequence(vector); } else if (P11ProxyConstants.ACTION_removeCerts == action) { Asn1P11EntityIdentifier asn1 = Asn1P11EntityIdentifier.getInstance(reqValue); P11Slot slot = getSlot(p11CryptService, asn1); slot.removeCerts(asn1.getObjectId().getObjectId()); } else if (P11ProxyConstants.ACTION_removeIdentity == action) { Asn1P11EntityIdentifier asn1 = Asn1P11EntityIdentifier.getInstance(reqValue); P11Slot slot = getSlot(p11CryptService, asn1); slot.removeIdentity(asn1.getObjectId().getObjectId()); } else if (P11ProxyConstants.ACTION_sign == action) { Asn1SignTemplate signTemplate = Asn1SignTemplate.getInstance(reqValue); long mechanism = signTemplate.getMechanism().getMechanism(); Asn1P11Params tmpParams = signTemplate.getMechanism().getParams(); ASN1Encodable asn1Params = null; if (tmpParams != null) { asn1Params = tmpParams.getP11Params(); } P11Params params = null; if (asn1Params instanceof Asn1RSAPkcsPssParams) { params = Asn1RSAPkcsPssParams.getInstance(asn1Params).getPkcsPssParams(); } else if (asn1Params != null) { throw new BadAsn1ObjectException("unknown SignTemplate.params"); } byte[] content = signTemplate.getMessage(); P11Identity identity = p11CryptService.getIdentity(signTemplate.getIdentityId().getEntityId()); byte[] signature = identity.sign(mechanism, params, content); respItvInfoValue = new DEROctetString(signature); } else if (P11ProxyConstants.ACTION_updateCerificate == action) { Asn1EntityIdAndCert asn1 = Asn1EntityIdAndCert.getInstance(reqValue); P11Slot slot = getSlot(p11CryptService, asn1.getEntityId()); slot.updateCertificate(asn1.getEntityId().getObjectId().getObjectId(), X509Util.toX509Cert(asn1.getCertificate())); } else if (P11ProxyConstants.ACTION_removeObjects == action) { Asn1RemoveObjectsParams asn1 = Asn1RemoveObjectsParams.getInstance(reqValue); P11Slot slot = getSlot(p11CryptService, asn1.getSlotId()); int num = slot.removeObjects(asn1.getObjectId(), asn1.getObjectLabel()); respItvInfoValue = new ASN1Integer(num); } else { final String statusMessage = "unsupported XiPKI action code '" + action + "'"; return createRejectionPkiMessage(respHeader, PKIFailureInfo.badRequest, statusMessage); } ASN1EncodableVector vec = new ASN1EncodableVector(); vec.add(new ASN1Integer(protocolVersion)); vec.add(new ASN1Integer(action)); if (respItvInfoValue != null) { vec.add(respItvInfoValue); } InfoTypeAndValue respItv = new InfoTypeAndValue(ObjectIdentifiers.id_xipki_cmp_cmpGenmsg, new DERSequence(vec)); GenRepContent genRepContent = new GenRepContent(respItv); PKIBody respBody = new PKIBody(PKIBody.TYPE_GEN_REP, genRepContent); return new PKIMessage(respHeader, respBody); }
From source file:org.xipki.commons.security.pkcs11.proxy.ProxyP11Module.java
License:Open Source License
ASN1Encodable send(final int action, final ASN1Encodable content) throws P11TokenException { ASN1EncodableVector vec = new ASN1EncodableVector(); vec.add(new ASN1Integer(version)); vec.add(new ASN1Integer(action)); vec.add((content != null) ? content : DERNull.INSTANCE); InfoTypeAndValue itvReq = new InfoTypeAndValue(ObjectIdentifiers.id_xipki_cmp_cmpGenmsg, new DERSequence(vec)); GenMsgContent genMsgContent = new GenMsgContent(itvReq); PKIHeader header = buildPkiHeader(null); PKIBody body = new PKIBody(PKIBody.TYPE_GEN_MSG, genMsgContent); PKIMessage request = new PKIMessage(header, body); byte[] encodedRequest; try {/*w w w . j a v a 2 s. com*/ encodedRequest = request.getEncoded(); } catch (IOException ex) { final String msg = "could not encode the PKI request"; LOG.error(msg + " {}", request); throw new P11TokenException(msg + ": " + ex.getMessage(), ex); } byte[] encodedResponse; try { encodedResponse = send(encodedRequest); } catch (IOException ex) { final String msg = "could not send the PKI request"; LOG.error(msg + " {}", request); throw new P11TokenException(msg + ": " + ex.getMessage(), ex); } GeneralPKIMessage response; try { response = new GeneralPKIMessage(encodedResponse); } catch (IOException ex) { final String msg = "could not decode the received PKI message"; LOG.error(msg + ": {}", Hex.toHexString(encodedResponse)); throw new P11TokenException(msg + ": " + ex.getMessage(), ex); } PKIHeader respHeader = response.getHeader(); ASN1OctetString tid = respHeader.getTransactionID(); GeneralName rec = respHeader.getRecipient(); if (!sender.equals(rec)) { LOG.warn("tid={}: unknown CMP requestor '{}'", tid, rec); } return extractItvInfoValue(action, response); }
From source file:org.xipki.pki.ca.client.impl.CmpRequestor.java
License:Open Source License
protected PKIMessage buildMessageWithXipkAction(final int action, final ASN1Encodable value) throws CmpRequestorException { PKIHeader header = buildPkiHeader(null); ASN1EncodableVector vec = new ASN1EncodableVector(); vec.add(new ASN1Integer(action)); if (value != null) { vec.add(value);/*from ww w . j a v a 2 s .co m*/ } InfoTypeAndValue itv = new InfoTypeAndValue(ObjectIdentifiers.id_xipki_cmp_cmpGenmsg, new DERSequence(vec)); GenMsgContent genMsgContent = new GenMsgContent(itv); PKIBody body = new PKIBody(PKIBody.TYPE_GEN_MSG, genMsgContent); PKIMessage pkiMessage = new PKIMessage(header, body); return pkiMessage; }
From source file:org.xipki.pki.ca.client.impl.CmpRequestor.java
License:Open Source License
protected PKIMessage buildMessageWithGeneralMsgContent(final ASN1ObjectIdentifier type, final ASN1Encodable value) throws CmpRequestorException { ParamUtil.requireNonNull("type", type); PKIHeader header = buildPkiHeader(null); InfoTypeAndValue itv = (value != null) ? new InfoTypeAndValue(type, value) : new InfoTypeAndValue(type); GenMsgContent genMsgContent = new GenMsgContent(itv); PKIBody body = new PKIBody(PKIBody.TYPE_GEN_MSG, genMsgContent); PKIMessage pkiMessage = new PKIMessage(header, body); return pkiMessage; }