Example usage for org.bouncycastle.asn1.cmp PKIFreeText PKIFreeText

List of usage examples for org.bouncycastle.asn1.cmp PKIFreeText PKIFreeText

  1. HOME
  2. Java
  3. org.bouncycastle
  4. org.bouncycastle.asn1.cmp.*
  5. PKIFreeText
  6. PKIFreeText

Introduction

In this page you can find the example usage for org.bouncycastle.asn1.cmp PKIFreeText PKIFreeText.

Prototype

public PKIFreeText(String[] strs)

Source Link

Usage

From source file:org.ejbca.core.protocol.cmp.CmpErrorResponseMessage.java

License:Open Source License

@Override
public boolean create() throws InvalidKeyException, NoSuchAlgorithmException, NoSuchProviderException {
    final PKIHeaderBuilder myPKIHeaderBuilder = CmpMessageHelper.createPKIHeaderBuilder(getSender(),
            getRecipient(), getSenderNonce(), getRecipientNonce(), getTransactionId());
    boolean pbeProtected = (getPbeDigestAlg() != null) && (getPbeMacAlg() != null) && (getPbeKeyId() != null)
            && (getPbeKey() != null);
    if (pbeProtected) {
        myPKIHeaderBuilder.setProtectionAlg(new AlgorithmIdentifier(CMPObjectIdentifiers.passwordBasedMac));
    }/* w w w  .  j av  a 2 s. c o m*/
    final PKIHeader myPKIHeader = myPKIHeaderBuilder.build();

    PKIStatusInfo myPKIStatusInfo = new PKIStatusInfo(PKIStatus.rejection);
    if (failInfo != null && failText != null) {
        myPKIStatusInfo = new PKIStatusInfo(PKIStatus.rejection, new PKIFreeText(new DERUTF8String(failText)),
                CmpMessageHelper.getPKIFailureInfo(failInfo.intValue()));
    } else if (failText != null) {
        myPKIStatusInfo = new PKIStatusInfo(PKIStatus.rejection, new PKIFreeText(new DERUTF8String(failText)));
    }

    PKIBody myPKIBody = null;
    log.debug("Create error message from requestType: " + requestType);
    if (requestType == 0 || requestType == 2) {
        myPKIBody = CmpMessageHelper.createCertRequestRejectBody(myPKIStatusInfo, requestId, requestType);
    } else {
        ErrorMsgContent myErrorContent = new ErrorMsgContent(myPKIStatusInfo);
        myPKIBody = new PKIBody(23, myErrorContent); // 23 = error                  
    }
    PKIMessage myPKIMessage = new PKIMessage(myPKIHeader, myPKIBody);
    if (pbeProtected) {
        responseMessage = CmpMessageHelper.protectPKIMessageWithPBE(myPKIMessage, getPbeKeyId(), getPbeKey(),
                getPbeDigestAlg(), getPbeMacAlg(), getPbeIterationCount());
    } else {
        responseMessage = CmpMessageHelper.pkiMessageToByteArray(myPKIMessage);
    }
    return true;
}

From source file:org.ejbca.core.protocol.cmp.CmpResponseMessage.java

License:Open Source License

@Override
public boolean create() throws InvalidKeyException, NoSuchAlgorithmException, NoSuchProviderException {
    boolean ret = false;
    // Some general stuff, common for all types of messages
    String issuer = null;//from ww  w . j a  v a2 s  .c  om
    String subject = null;
    if (cert != null) {
        X509Certificate x509cert = (X509Certificate) cert;
        issuer = x509cert.getIssuerDN().getName();
        subject = x509cert.getSubjectDN().getName();
    } else if ((signCertChain != null) && (signCertChain.size() > 0)) {
        issuer = ((X509Certificate) signCertChain.iterator().next()).getSubjectDN().getName();
        subject = "CN=fooSubject";
    } else {
        issuer = "CN=fooIssuer";
        subject = "CN=fooSubject";
    }

    final GeneralName issuerName = new GeneralName(new X500Name(issuer));
    final GeneralName subjectName = new GeneralName(new X500Name(subject));
    final PKIHeaderBuilder myPKIHeader = CmpMessageHelper.createPKIHeaderBuilder(issuerName, subjectName,
            senderNonce, recipientNonce, transactionId);
    PKIBody myPKIBody = null;
    final PKIMessage myPKIMessage;

    try {
        if (status.equals(ResponseStatus.SUCCESS)) {
            if (cert != null) {
                if (log.isDebugEnabled()) {
                    log.debug("Creating a CertRepMessage 'accepted'");
                }
                PKIStatusInfo myPKIStatusInfo = new PKIStatusInfo(PKIStatus.granted); // 0 = accepted
                ASN1InputStream certASN1InputStream = new ASN1InputStream(
                        new ByteArrayInputStream(cert.getEncoded()));
                ASN1InputStream cacertASN1InputStream = new ASN1InputStream(
                        new ByteArrayInputStream(cacert.getEncoded()));
                try {
                    try {
                        CMPCertificate cmpcert = CMPCertificate.getInstance(certASN1InputStream.readObject());
                        CertOrEncCert retCert = new CertOrEncCert(cmpcert);
                        CertifiedKeyPair myCertifiedKeyPair = new CertifiedKeyPair(retCert);
                        CertResponse myCertResponse = new CertResponse(new ASN1Integer(requestId),
                                myPKIStatusInfo, myCertifiedKeyPair, null);

                        CertResponse[] certRespos = { myCertResponse };
                        CMPCertificate[] caPubs = {
                                CMPCertificate.getInstance(cacertASN1InputStream.readObject()) };

                        CertRepMessage myCertRepMessage = new CertRepMessage(caPubs, certRespos);

                        int respType = requestType + 1; // 1 = intitialization response, 3 = certification response etc
                        if (log.isDebugEnabled()) {
                            log.debug("Creating response body of type " + respType);
                        }
                        myPKIBody = new PKIBody(respType, myCertRepMessage);
                    } finally {
                        certASN1InputStream.close();
                        cacertASN1InputStream.close();
                    }
                } catch (IOException e) {
                    throw new IllegalStateException("Unexpected IOException caught.", e);
                }
            }
        } else if (status.equals(ResponseStatus.FAILURE)) {
            if (log.isDebugEnabled()) {
                log.debug("Creating a CertRepMessage 'rejected'");
            }
            // Create a failure message
            ASN1EncodableVector statusInfoV = new ASN1EncodableVector();
            statusInfoV.add(ASN1Integer.getInstance(PKIStatus.rejection.toASN1Primitive()));
            if (failText != null) {
                statusInfoV.add(new PKIFreeText(new DERUTF8String(failText)));
            }
            statusInfoV.add(CmpMessageHelper.getPKIFailureInfo(failInfo.intValue()));
            PKIStatusInfo myPKIStatusInfo = PKIStatusInfo
                    .getInstance(ASN1Sequence.getInstance(new DERSequence(statusInfoV)));
            myPKIBody = CmpMessageHelper.createCertRequestRejectBody(myPKIStatusInfo, requestId, requestType);

        } else {
            if (log.isDebugEnabled()) {
                log.debug("Creating a 'waiting' message?");
            }
            // Not supported, lets create a PKIError failure instead
            // Create a failure message
            ASN1EncodableVector statusInfoV = new ASN1EncodableVector();
            statusInfoV.add(PKIStatus.rejection); // 2 = rejection
            if (failText != null) {
                statusInfoV.add(new PKIFreeText(new DERUTF8String(failText)));
            }
            statusInfoV.add(CmpMessageHelper.getPKIFailureInfo(failInfo.intValue()));
            PKIStatusInfo myPKIStatusInfo = PKIStatusInfo.getInstance(new DERSequence(statusInfoV));

            ErrorMsgContent myErrorContent = new ErrorMsgContent(myPKIStatusInfo);
            myPKIBody = new PKIBody(23, myErrorContent); // 23 = error                
        }

        if ((pbeKeyId != null) && (pbeKey != null) && (pbeDigestAlg != null) && (pbeMacAlg != null)) {
            myPKIHeader.setProtectionAlg(new AlgorithmIdentifier(CMPObjectIdentifiers.passwordBasedMac));
            PKIHeader header = myPKIHeader.build();
            myPKIMessage = new PKIMessage(header, myPKIBody);
            responseMessage = CmpMessageHelper.protectPKIMessageWithPBE(myPKIMessage, pbeKeyId, pbeKey,
                    pbeDigestAlg, pbeMacAlg, pbeIterationCount);
        } else {
            myPKIHeader.setProtectionAlg(new AlgorithmIdentifier(digest));
            PKIHeader header = myPKIHeader.build();
            myPKIMessage = new PKIMessage(header, myPKIBody);
            responseMessage = CmpMessageHelper.signPKIMessage(myPKIMessage, signCertChain, signKey, digest,
                    provider);
        }

        ret = true;

    } catch (CertificateEncodingException e) {
        log.error("Error creating CertRepMessage: ", e);
    } catch (InvalidKeyException e) {
        log.error("Error creating CertRepMessage: ", e);
    } catch (NoSuchProviderException e) {
        log.error("Error creating CertRepMessage: ", e);
    } catch (NoSuchAlgorithmException e) {
        log.error("Error creating CertRepMessage: ", e);
    } catch (SecurityException e) {
        log.error("Error creating CertRepMessage: ", e);
    } catch (SignatureException e) {
        log.error("Error creating CertRepMessage: ", e);
    }

    return ret;
}

From source file:org.ejbca.core.protocol.cmp.CmpRevokeResponseMessage.java

License:Open Source License

@Override
public boolean create() throws InvalidKeyException, NoSuchAlgorithmException, NoSuchProviderException {
    final PKIHeaderBuilder myPKIHeader = CmpMessageHelper.createPKIHeaderBuilder(getSender(), getRecipient(),
            getSenderNonce(), getRecipientNonce(), getTransactionId());
    PKIStatusInfo myPKIStatusInfo = new PKIStatusInfo(PKIStatus.granted); // 0 = accepted
    if (status != ResponseStatus.SUCCESS && status != ResponseStatus.GRANTED_WITH_MODS) {
        if (log.isDebugEnabled()) {
            log.debug("Creating a rejection message");
        }/*from ww  w. jav  a 2  s  .  c  o  m*/
        myPKIStatusInfo = new PKIStatusInfo(PKIStatus.rejection, null,
                CmpMessageHelper.getPKIFailureInfo(failInfo.intValue()));
        if (failText != null && failInfo != null) {
            myPKIStatusInfo = new PKIStatusInfo(PKIStatus.rejection, new PKIFreeText(failText),
                    CmpMessageHelper.getPKIFailureInfo(failInfo.intValue()));
        }
    }
    RevRepContentBuilder revBuilder = new RevRepContentBuilder();
    revBuilder.add(myPKIStatusInfo);
    RevRepContent myRevrepMessage = revBuilder.build();

    PKIBody myPKIBody = new PKIBody(CmpPKIBodyConstants.REVOCATIONRESPONSE, myRevrepMessage);
    PKIMessage myPKIMessage;

    if ((getPbeDigestAlg() != null) && (getPbeMacAlg() != null) && (getPbeKeyId() != null)
            && (getPbeKey() != null)) {
        myPKIHeader.setProtectionAlg(new AlgorithmIdentifier(CMPObjectIdentifiers.passwordBasedMac));
        myPKIMessage = new PKIMessage(myPKIHeader.build(), myPKIBody);
        responseMessage = CmpMessageHelper.protectPKIMessageWithPBE(myPKIMessage, getPbeKeyId(), getPbeKey(),
                getPbeDigestAlg(), getPbeMacAlg(), getPbeIterationCount());
    } else {
        myPKIHeader.setProtectionAlg(new AlgorithmIdentifier(digestAlg));
        myPKIMessage = new PKIMessage(myPKIHeader.build(), myPKIBody);
        try {
            responseMessage = CmpMessageHelper.signPKIMessage(myPKIMessage, signCertChain, signKey, digestAlg,
                    provider);
        } catch (CertificateEncodingException e) {
            log.error("Failed to sign CMPRevokeResponseMessage");
            log.error(e.getLocalizedMessage(), e);
            responseMessage = getUnprotectedResponseMessage(myPKIMessage);
        } catch (SecurityException e) {
            log.error("Failed to sign CMPRevokeResponseMessage");
            log.error(e.getLocalizedMessage(), e);
            responseMessage = getUnprotectedResponseMessage(myPKIMessage);
        } catch (SignatureException e) {
            log.error("Failed to sign CMPRevokeResponseMessage");
            log.error(e.getLocalizedMessage(), e);
            responseMessage = getUnprotectedResponseMessage(myPKIMessage);
        }
    }
    return true;
}

From source file:org.jnotary.dvcs.SimpleResponseTest.java

License:Open Source License

@Test
public void errorResponse() throws IOException {

    PKIStatus status = PKIStatus.getInstance(new DERInteger(PKIStatus.REJECTION));
    PKIFreeText statusString = new PKIFreeText("Free text");
    PKIFailureInfo failInfo = new PKIFailureInfo(PKIFailureInfo.badRequest);

    PKIStatusInfo transactionStatus = new PKIStatusInfo(status, statusString, failInfo);

    DVCSErrorNotice dvErrorNote = new DVCSErrorNotice(transactionStatus);
    DVCSResponse respOut = new DVCSResponse(dvErrorNote);

    DVCSResponse respIn = DVCSResponse.getInstance(respOut.getEncoded());
    assertTrue("Status igetInstances incorrect", respIn.getDvErrorNote().getTransactionStatus().getStatus()
            .equals(respOut.getDvErrorNote().getTransactionStatus().getStatus()));
    assertTrue("Status string is incorrect", respIn.getDvErrorNote().getTransactionStatus().getStatusString()
            .equals(respOut.getDvErrorNote().getTransactionStatus().getStatusString()));
    assertTrue("Status is incorrect", respIn.getDvErrorNote().getTransactionStatus().getFailInfo()
            .equals(respOut.getDvErrorNote().getTransactionStatus().getFailInfo()));

}

From source file:org.jnotary.dvcs.util.StatusInfoFactory.java

License:Open Source License

public static PKIStatusInfo getInstance(int pkiStatus, String freeText, Integer pkiFailInfo) {
    PKIStatus status = PKIStatus.getInstance(new DERInteger(pkiStatus));
    PKIFreeText statusString = (freeText == null ? null : new PKIFreeText(freeText));
    PKIFailureInfo failInfo = (pkiFailInfo == null ? null : new PKIFailureInfo(pkiFailInfo));

    return new PKIStatusInfo(status, statusString, failInfo);
}

From source file:org.votingsystem.signature.util.TimeStampResponseGenerator.java

License:Open Source License

private PKIStatusInfo getPKIStatusInfo() {
    ASN1EncodableVector v = new ASN1EncodableVector();
    v.add(new DERInteger(this.status));
    if (this.statusStrings.size() > 0) {
        v.add(new PKIFreeText(new DERSequence(this.statusStrings)));
    }//w w w  .  jav a  2 s.c  o m

    if (this.failInfo != 0) {
        FailInfo failInfoBitString = new FailInfo(this.failInfo);
        v.add(failInfoBitString);
    }

    return new PKIStatusInfo(new DERSequence(v));
}

From source file:org.xipki.ca.server.impl.CmpResponder.java

License:Open Source License

protected PKIStatusInfo generateCmpRejectionStatus(final Integer info, final String errorMessage) {
    PKIFreeText statusMessage = (errorMessage == null) ? null : new PKIFreeText(errorMessage);
    PKIFailureInfo failureInfo = (info == null) ? null : new PKIFailureInfo(info);
    return new PKIStatusInfo(PKIStatus.rejection, statusMessage, failureInfo);
}

From source file:org.xipki.ca.server.impl.X509CACmpResponder.java

License:Open Source License

@Override
protected PKIMessage intern_processPKIMessage(final RequestorInfo requestor, final String user,
        final ASN1OctetString tid, final GeneralPKIMessage message, final AuditEvent auditEvent)
        throws ConfigurationException {
    if (requestor instanceof CmpRequestorInfo == false) {
        throw new IllegalArgumentException("unknown requestor type " + requestor.getClass().getName());
    }/*from  w  w  w . j  a va 2 s. com*/

    CmpRequestorInfo _requestor = (CmpRequestorInfo) requestor;
    if (_requestor != null && auditEvent != null) {
        auditEvent.addEventData(new AuditEventData("requestor", _requestor.getCert().getSubject()));
    }

    PKIHeader reqHeader = message.getHeader();
    PKIHeaderBuilder respHeader = new PKIHeaderBuilder(reqHeader.getPvno().getValue().intValue(), getSender(),
            reqHeader.getSender());
    respHeader.setTransactionID(tid);

    PKIBody respBody;
    PKIBody reqBody = message.getBody();
    final int type = reqBody.getType();

    CmpControl cmpControl = getCmpControl();

    try {
        switch (type) {
        case PKIBody.TYPE_CERT_REQ:
        case PKIBody.TYPE_KEY_UPDATE_REQ:
        case PKIBody.TYPE_P10_CERT_REQ:
        case PKIBody.TYPE_CROSS_CERT_REQ: {
            respBody = cmpEnrollCert(respHeader, cmpControl, reqHeader, reqBody, _requestor, user, tid,
                    auditEvent);
            break;
        }
        case PKIBody.TYPE_CERT_CONFIRM: {
            addAutitEventType(auditEvent, "CERT_CONFIRM");
            CertConfirmContent certConf = (CertConfirmContent) reqBody.getContent();
            respBody = confirmCertificates(tid, certConf);
            break;
        }
        case PKIBody.TYPE_REVOCATION_REQ: {
            respBody = cmpRevokeOrUnrevokeOrRemoveCertificates(respHeader, cmpControl, reqHeader, reqBody,
                    _requestor, user, tid, auditEvent);
            break;
        }
        case PKIBody.TYPE_CONFIRM: {
            addAutitEventType(auditEvent, "CONFIRM");
            respBody = new PKIBody(PKIBody.TYPE_CONFIRM, DERNull.INSTANCE);
        }
        case PKIBody.TYPE_ERROR: {
            addAutitEventType(auditEvent, "ERROR");
            revokePendingCertificates(tid);
            respBody = new PKIBody(PKIBody.TYPE_CONFIRM, DERNull.INSTANCE);
            break;
        }
        case PKIBody.TYPE_GEN_MSG: {
            respBody = cmpGeneralMsg(respHeader, cmpControl, reqHeader, reqBody, _requestor, user, tid,
                    auditEvent);
            break;
        }
        default: {
            addAutitEventType(auditEvent, "PKIBody." + type);
            respBody = createErrorMsgPKIBody(PKIStatus.rejection, PKIFailureInfo.badRequest,
                    "unsupported type " + type);
            break;
        }
        } // end switch(type)
    } catch (InsuffientPermissionException e) {
        ErrorMsgContent emc = new ErrorMsgContent(new PKIStatusInfo(PKIStatus.rejection,
                new PKIFreeText(e.getMessage()), new PKIFailureInfo(PKIFailureInfo.notAuthorized)));

        respBody = new PKIBody(PKIBody.TYPE_ERROR, emc);
    }

    if (auditEvent != null) {
        if (respBody.getType() == PKIBody.TYPE_ERROR) {
            ErrorMsgContent errorMsgContent = (ErrorMsgContent) respBody.getContent();

            AuditStatus auditStatus = AuditStatus.FAILED;
            org.xipki.ca.common.cmp.PKIStatusInfo pkiStatus = new org.xipki.ca.common.cmp.PKIStatusInfo(
                    errorMsgContent.getPKIStatusInfo());

            if (pkiStatus.getPkiFailureInfo() == PKIFailureInfo.systemFailure) {
                auditStatus = AuditStatus.FAILED;
            }
            auditEvent.setStatus(auditStatus);

            String statusString = pkiStatus.getStatusMessage();
            if (statusString != null) {
                auditEvent.addEventData(new AuditEventData("message", statusString));
            }
        } else if (auditEvent.getStatus() == null) {
            auditEvent.setStatus(AuditStatus.SUCCESSFUL);
        }
    }

    return new PKIMessage(respHeader.build(), respBody);
}

From source file:org.xipki.ca.server.impl.X509CACmpResponder.java

License:Open Source License

private CertResponse generateCertificate(final CmpRequestorInfo requestor, final String user,
        final ASN1OctetString tid, final ASN1Integer certReqId, final X500Name subject,
        final SubjectPublicKeyInfo publicKeyInfo, final OptionalValidity validity, final Extensions extensions,
        final String certprofileName, final boolean keyUpdate, final long confirmWaitTime,
        final AuditChildEvent childAuditEvent) throws InsuffientPermissionException {
    checkPermission(requestor, certprofileName);

    Date notBefore = null;/*  w ww.jav a2  s  .  com*/
    Date notAfter = null;
    if (validity != null) {
        Time t = validity.getNotBefore();
        if (t != null) {
            notBefore = t.getDate();
        }
        t = validity.getNotAfter();
        if (t != null) {
            notAfter = t.getDate();
        }
    }

    try {
        X509CA ca = getCA();
        X509CertificateInfo certInfo;
        if (keyUpdate) {
            certInfo = ca.regenerateCertificate(requestor.isRA(), requestor, certprofileName, user, subject,
                    publicKeyInfo, notBefore, notAfter, extensions);
        } else {
            certInfo = ca.generateCertificate(requestor.isRA(), requestor, certprofileName, user, subject,
                    publicKeyInfo, notBefore, notAfter, extensions);
        }
        certInfo.setRequestor(requestor);
        certInfo.setUser(user);

        if (childAuditEvent != null) {
            childAuditEvent.addEventData(new AuditEventData("subject", certInfo.getCert().getSubject()));
        }

        pendingCertPool.addCertificate(tid.getOctets(), certReqId.getPositiveValue(), certInfo,
                System.currentTimeMillis() + confirmWaitTime);
        String warningMsg = certInfo.getWarningMessage();

        PKIStatusInfo statusInfo;
        if (StringUtil.isBlank(warningMsg)) {
            if (certInfo.isAlreadyIssued()) {
                statusInfo = new PKIStatusInfo(PKIStatus.grantedWithMods, new PKIFreeText("ALREADY_ISSUED"));
            } else {
                statusInfo = new PKIStatusInfo(PKIStatus.granted);
            }
        } else {
            statusInfo = new PKIStatusInfo(PKIStatus.grantedWithMods, new PKIFreeText(warningMsg));
        }

        if (childAuditEvent != null) {
            childAuditEvent.setStatus(AuditStatus.SUCCESSFUL);
        }

        CertOrEncCert cec = new CertOrEncCert(CMPCertificate.getInstance(certInfo.getCert().getEncodedCert()));
        CertifiedKeyPair kp = new CertifiedKeyPair(cec);
        CertResponse certResp = new CertResponse(certReqId, statusInfo, kp, null);
        return certResp;
    } catch (OperationException e) {
        ErrorCode code = e.getErrorCode();
        LOG.warn("generate certificate, OperationException: code={}, message={}", code.name(),
                e.getErrorMessage());

        String auditMessage;

        int failureInfo;
        switch (code) {
        case ALREADY_ISSUED:
            failureInfo = PKIFailureInfo.badRequest;
            auditMessage = "ALREADY_ISSUED";
            break;
        case BAD_CERT_TEMPLATE:
            failureInfo = PKIFailureInfo.badCertTemplate;
            auditMessage = "BAD_CERT_TEMPLATE";
            break;
        case BAD_REQUEST:
            failureInfo = PKIFailureInfo.badRequest;
            auditMessage = "BAD_REQUEST";
        case CERT_REVOKED:
            failureInfo = PKIFailureInfo.certRevoked;
            auditMessage = "CERT_REVOKED";
            break;
        case CRL_FAILURE:
            failureInfo = PKIFailureInfo.systemFailure;
            auditMessage = "CRL_FAILURE";
            break;
        case DATABASE_FAILURE:
            failureInfo = PKIFailureInfo.systemFailure;
            auditMessage = "DATABASE_FAILURE";
            break;
        case NOT_PERMITTED:
            failureInfo = PKIFailureInfo.notAuthorized;
            auditMessage = "NOT_PERMITTED";
            break;
        case INSUFFICIENT_PERMISSION:
            failureInfo = PKIFailureInfo.notAuthorized;
            auditMessage = "INSUFFICIENT_PERMISSION";
            break;
        case INVALID_EXTENSION:
            failureInfo = PKIFailureInfo.systemFailure;
            auditMessage = "INVALID_EXTENSION";
            break;
        case SYSTEM_FAILURE:
            failureInfo = PKIFailureInfo.systemFailure;
            auditMessage = "System_Failure";
            break;
        case SYSTEM_UNAVAILABLE:
            failureInfo = PKIFailureInfo.systemUnavail;
            auditMessage = "System_Unavailable";
            break;
        case UNKNOWN_CERT:
            failureInfo = PKIFailureInfo.badCertId;
            auditMessage = "UNKNOWN_CERT";
            break;
        case UNKNOWN_CERT_PROFILE:
            failureInfo = PKIFailureInfo.badCertTemplate;
            auditMessage = "UNKNOWN_CERT_PROFILE";
            break;
        default:
            failureInfo = PKIFailureInfo.systemFailure;
            auditMessage = "InternalErrorCode " + e.getErrorCode();
            break;
        } // end switch(code)

        if (childAuditEvent != null) {
            childAuditEvent.setStatus(AuditStatus.FAILED);
            childAuditEvent.addEventData(new AuditEventData("message", auditMessage));
        }

        String errorMessage;
        switch (code) {
        case DATABASE_FAILURE:
        case SYSTEM_FAILURE:
            errorMessage = code.name();
            break;
        default:
            errorMessage = code.name() + ": " + e.getErrorMessage();
            break;
        } // end switch code
        PKIStatusInfo status = generateCmpRejectionStatus(failureInfo, errorMessage);
        return new CertResponse(certReqId, status);
    }
}

From source file:org.xipki.ca.server.impl.X509CACmpResponder.java

License:Open Source License

private PKIBody cmpRevokeOrUnrevokeOrRemoveCertificates(final PKIHeaderBuilder respHeader,
        final CmpControl cmpControl, final PKIHeader reqHeader, final PKIBody reqBody,
        final CmpRequestorInfo requestor, final String user, final ASN1OctetString tid,
        final AuditEvent auditEvent) throws InsuffientPermissionException {
    Permission requiredPermission = null;
    boolean allRevdetailsOfSameType = true;

    RevReqContent rr = (RevReqContent) reqBody.getContent();
    RevDetails[] revContent = rr.toRevDetailsArray();

    int n = revContent.length;
    for (int i = 0; i < n; i++) {
        RevDetails revDetails = revContent[i];
        Extensions crlDetails = revDetails.getCrlEntryDetails();
        int reasonCode = CRLReason.UNSPECIFIED.getCode();
        if (crlDetails != null) {
            ASN1ObjectIdentifier extId = Extension.reasonCode;
            ASN1Encodable extValue = crlDetails.getExtensionParsedValue(extId);
            if (extValue != null) {
                reasonCode = ((ASN1Enumerated) extValue).getValue().intValue();
            }//from w ww .j  av  a 2s  .c o  m
        }

        if (reasonCode == XipkiCmpConstants.CRL_REASON_REMOVE) {
            if (requiredPermission == null) {
                addAutitEventType(auditEvent, "CERT_REMOVE");
                requiredPermission = Permission.REMOVE_CERT;
            } else if (requiredPermission != Permission.REMOVE_CERT) {
                allRevdetailsOfSameType = false;
                break;
            }
        } else if (reasonCode == CRLReason.REMOVE_FROM_CRL.getCode()) {
            if (requiredPermission == null) {
                addAutitEventType(auditEvent, "CERT_UNREVOKE");
                requiredPermission = Permission.UNREVOKE_CERT;
            } else if (requiredPermission != Permission.UNREVOKE_CERT) {
                allRevdetailsOfSameType = false;
                break;
            }
        } else {
            if (requiredPermission == null) {
                addAutitEventType(auditEvent, "CERT_REVOKE");
                requiredPermission = Permission.REVOKE_CERT;
            } else if (requiredPermission != Permission.REVOKE_CERT) {
                allRevdetailsOfSameType = false;
                break;
            }
        }
    }

    if (allRevdetailsOfSameType == false) {
        ErrorMsgContent emc = new ErrorMsgContent(new PKIStatusInfo(PKIStatus.rejection,
                new PKIFreeText("not all revDetails are of the same type"),
                new PKIFailureInfo(PKIFailureInfo.badRequest)));

        return new PKIBody(PKIBody.TYPE_ERROR, emc);
    } else {
        checkPermission(requestor, requiredPermission);
        return revokeOrUnrevokeOrRemoveCertificates(rr, auditEvent, requiredPermission);
    }
}