Example usage for org.bouncycastle.asn1.cmp PKIHeader getPvno

List of usage examples for org.bouncycastle.asn1.cmp PKIHeader getPvno

  1. HOME
  2. Java
  3. org.bouncycastle
  4. org.bouncycastle.asn1.cmp.*
  5. PKIHeader
  6. getPvno

Introduction

In this page you can find the example usage for org.bouncycastle.asn1.cmp PKIHeader getPvno.

Prototype

public ASN1Integer getPvno()

Source Link

Usage

From source file:org.ejbca.core.protocol.cmp.CmpMessageDispatcherSessionBean.java

License:Open Source License

/** The message may have been received by any transport protocol, and is passed here in it's binary ASN.1 form.
 * //  ww  w .ja  va  2s . c  o  m
 * @param message der encoded CMP message
 * @return IResponseMessage containing the CMP response message or null if there is no message to send back or some internal error has occurred
 */
private ResponseMessage dispatch(final AuthenticationToken admin, final ASN1Primitive derObject,
        final boolean authenticated, String confAlias) {

    this.cmpConfiguration = (CmpConfiguration) this.globalConfigSession
            .getCachedConfiguration(CmpConfiguration.CMP_CONFIGURATION_ID);

    if (!cmpConfiguration.aliasExists(confAlias)) {
        log.info("There is no CMP alias: " + confAlias);
        return CmpMessageHelper.createUnprotectedErrorMessage(null, ResponseStatus.FAILURE,
                FailInfo.INCORRECT_DATA, "Wrong URL. CMP alias '" + confAlias + "' does not exist");
    }

    final PKIMessage req;
    try {
        req = PKIMessage.getInstance(derObject);
        if (req == null) {
            throw new Exception("No CMP message could be parsed from received Der object.");
        }
    } catch (Throwable t) { // NOPMD: catch all to report errors back to client
        final String eMsg = intres.getLocalizedMessage("cmp.errornotcmpmessage");
        log.error(eMsg, t);
        // If we could not read the message, we should return an error BAD_REQUEST
        return CmpMessageHelper.createUnprotectedErrorMessage(null, ResponseStatus.FAILURE,
                FailInfo.BAD_REQUEST, eMsg);
    }
    try {
        final PKIBody body = req.getBody();
        final int tagno = body.getType();
        if (log.isDebugEnabled()) {
            final PKIHeader header = req.getHeader();
            log.debug("Received CMP message with pvno=" + header.getPvno() + ", sender="
                    + header.getSender().toString() + ", recipient=" + header.getRecipient().toString());
            log.debug("Cmp configuration alias: " + confAlias);
            log.debug("The CMP message is already authenticated: " + authenticated);
            log.debug("Body is of type: " + tagno);
            log.debug("Transaction id: " + header.getTransactionID());
            //log.debug(ASN1Dump.dumpAsString(req));
        }

        BaseCmpMessage cmpMessage = null;
        ICmpMessageHandler handler = null;
        int unknownMessageType = -1;
        switch (tagno) {
        case 0:
            // 0 (ir, Initialization Request) and 2 (cr, Certification Req) are both certificate requests
            handler = new CrmfMessageHandler(admin, confAlias, caSession, certificateProfileSession,
                    certificateRequestSession, endEntityAccessSession, endEntityProfileSession, signSession,
                    certificateStoreSession, authSession, authenticationProviderSession,
                    endEntityManagementSession, globalConfigSession);
            cmpMessage = new CrmfRequestMessage(req, this.cmpConfiguration.getCMPDefaultCA(confAlias),
                    this.cmpConfiguration.getAllowRAVerifyPOPO(confAlias),
                    this.cmpConfiguration.getExtractUsernameComponent(confAlias));
            break;
        case 2:
            handler = new CrmfMessageHandler(admin, confAlias, caSession, certificateProfileSession,
                    certificateRequestSession, endEntityAccessSession, endEntityProfileSession, signSession,
                    certificateStoreSession, authSession, authenticationProviderSession,
                    endEntityManagementSession, globalConfigSession);
            cmpMessage = new CrmfRequestMessage(req, this.cmpConfiguration.getCMPDefaultCA(confAlias),
                    this.cmpConfiguration.getAllowRAVerifyPOPO(confAlias),
                    this.cmpConfiguration.getExtractUsernameComponent(confAlias));
            break;
        case 7:
            // Key Update request (kur, Key Update Request)
            handler = new CrmfKeyUpdateHandler(admin, confAlias, caSession, certificateProfileSession,
                    endEntityAccessSession, endEntityProfileSession, signSession, certificateStoreSession,
                    authSession, authenticationProviderSession, endEntityManagementSession,
                    globalConfigSession);
            cmpMessage = new CrmfRequestMessage(req, this.cmpConfiguration.getCMPDefaultCA(confAlias),
                    this.cmpConfiguration.getAllowRAVerifyPOPO(confAlias),
                    this.cmpConfiguration.getExtractUsernameComponent(confAlias));
            break;
        case 19:
            // PKI confirm (pkiconf, Confirmation)
        case 24:
            // Certificate confirmation (certConf, Certificate confirm)
            handler = new ConfirmationMessageHandler(admin, confAlias, caSession, endEntityProfileSession,
                    certificateProfileSession, authSession, authenticationProviderSession, cryptoTokenSession,
                    globalConfigSession);
            cmpMessage = new GeneralCmpMessage(req);
            break;
        case 11:
            // Revocation request (rr, Revocation Request)
            handler = new RevocationMessageHandler(admin, confAlias, endEntityManagementSession, caSession,
                    endEntityProfileSession, certificateProfileSession, certificateStoreSession, authSession,
                    endEntityAccessSession, authenticationProviderSession, cryptoTokenSession,
                    globalConfigSession);
            cmpMessage = new GeneralCmpMessage(req);
            break;
        case 20:
            // NestedMessageContent (nested)
            if (log.isDebugEnabled()) {
                log.debug("Received a NestedMessageContent");
            }

            final NestedMessageContent nestedMessage = new NestedMessageContent(req, confAlias,
                    globalConfigSession);
            if (nestedMessage.verify()) {
                if (log.isDebugEnabled()) {
                    log.debug("The NestedMessageContent was verified successfully");
                }
                try {
                    PKIMessages nestesMessages = (PKIMessages) nestedMessage.getPKIMessage().getBody()
                            .getContent();
                    PKIMessage msg = nestesMessages.toPKIMessageArray()[0];
                    return dispatch(admin, msg.toASN1Primitive(), true, confAlias);
                } catch (IllegalArgumentException e) {
                    final String errMsg = e.getLocalizedMessage();
                    log.info(errMsg, e);
                    cmpMessage = new NestedMessageContent(req, confAlias, globalConfigSession);
                    return CmpMessageHelper.createUnprotectedErrorMessage(cmpMessage, ResponseStatus.FAILURE,
                            FailInfo.BAD_REQUEST, errMsg);
                }
            } else {
                final String errMsg = "Could not verify the RA, signature verification on NestedMessageContent failed.";
                log.info(errMsg);
                cmpMessage = new NestedMessageContent(req, confAlias, globalConfigSession);
                return CmpMessageHelper.createUnprotectedErrorMessage(cmpMessage, ResponseStatus.FAILURE,
                        FailInfo.BAD_REQUEST, errMsg);
            }

        default:
            unknownMessageType = tagno;
            log.info("Received an unknown message type, tagno=" + tagno);
            break;
        }
        if (handler == null || cmpMessage == null) {
            if (unknownMessageType > -1) {
                final String eMsg = intres.getLocalizedMessage("cmp.errortypenohandle",
                        Integer.valueOf(unknownMessageType));
                log.error(eMsg);
                return CmpMessageHelper.createUnprotectedErrorMessage(null, ResponseStatus.FAILURE,
                        FailInfo.BAD_REQUEST, eMsg);
            }
            throw new Exception("Something is null! Handler=" + handler + ", cmpMessage=" + cmpMessage);
        }
        final ResponseMessage ret = handler.handleMessage(cmpMessage, authenticated);
        if (ret != null) {
            log.debug("Received a response message of type '" + ret.getClass().getName()
                    + "' from CmpMessageHandler.");
        } else {
            log.error(intres.getLocalizedMessage("cmp.errorresponsenull"));
        }
        return ret;
    } catch (Exception e) {
        log.error(intres.getLocalizedMessage("cmp.errorprocess"), e);
        return null;
    }
}

From source file:org.ejbca.core.protocol.cmp.CmpMessageHelper.java

License:Open Source License

public static PKIHeaderBuilder getHeaderBuilder(PKIHeader head) {
    PKIHeaderBuilder builder = new PKIHeaderBuilder(head.getPvno().getValue().intValue(), head.getSender(),
            head.getRecipient());//from ww  w . jav  a  2s .  co m
    builder.setFreeText(head.getFreeText());
    builder.setGeneralInfo(head.getGeneralInfo());
    builder.setMessageTime(head.getMessageTime());
    builder.setRecipKID((DEROctetString) head.getRecipKID());
    builder.setRecipNonce(head.getRecipNonce());
    builder.setSenderKID(head.getSenderKID());
    builder.setSenderNonce(head.getSenderNonce());
    builder.setTransactionID(head.getTransactionID());
    return builder;
}

From source file:org.ejbca.ui.cmpclient.CmpClientMessageHelper.java

License:Open Source License

private PKIHeaderBuilder getHeaderBuilder(PKIHeader head) {
    PKIHeaderBuilder builder = new PKIHeaderBuilder(head.getPvno().getValue().intValue(), head.getSender(),
            head.getRecipient());//from   w  ww  . j  a v  a 2  s  . c om
    builder.setFreeText(head.getFreeText());
    builder.setGeneralInfo(head.getGeneralInfo());
    builder.setMessageTime(head.getMessageTime());
    builder.setRecipKID((DEROctetString) head.getRecipKID());
    builder.setRecipNonce(head.getRecipNonce());
    builder.setSenderKID(head.getSenderKID());
    builder.setSenderNonce(head.getSenderNonce());
    builder.setTransactionID(head.getTransactionID());
    return builder;
}

From source file:org.xipki.ca.server.impl.CmpResponder.java

License:Open Source License

protected PKIMessage buildErrorPkiMessage(final ASN1OctetString tid, final PKIHeader requestHeader,
        final int failureCode, final String statusText) throws ConfigurationException {
    GeneralName respRecipient = requestHeader.getSender();

    PKIHeaderBuilder respHeader = new PKIHeaderBuilder(requestHeader.getPvno().getValue().intValue(),
            getSender(), respRecipient);
    respHeader.setMessageTime(new ASN1GeneralizedTime(new Date()));
    if (tid != null) {
        respHeader.setTransactionID(tid);
    }/*  w  w w  .  ja  v  a  2 s .  com*/

    PKIStatusInfo status = generateCmpRejectionStatus(failureCode, statusText);
    ErrorMsgContent error = new ErrorMsgContent(status);
    PKIBody body = new PKIBody(PKIBody.TYPE_ERROR, error);

    return new PKIMessage(respHeader.build(), body);
}

From source file:org.xipki.ca.server.impl.Rfc6712Servlet.java

License:Open Source License

@Override
public void doPost(final HttpServletRequest request, final HttpServletResponse response)
        throws ServletException, IOException {
    X509Certificate[] certs = (X509Certificate[]) request.getAttribute("javax.servlet.request.X509Certificate");
    X509Certificate clientCert = (certs == null || certs.length < 1) ? null : certs[0];

    AuditLoggingService auditLoggingService = auditServiceRegister.getAuditLoggingService();
    AuditEvent auditEvent = (auditLoggingService != null) ? new AuditEvent(new Date()) : null;
    if (auditEvent != null) {
        auditEvent.setApplicationName("CA");
        auditEvent.setName("PERF");
    }// ww  w  .j a  v  a2 s  . co m

    AuditLevel auditLevel = AuditLevel.INFO;
    AuditStatus auditStatus = AuditStatus.SUCCESSFUL;
    String auditMessage = null;
    try {
        if (responderManager == null) {
            String message = "caManager in servlet not configured";
            LOG.error(message);
            response.setStatus(HttpServletResponse.SC_INTERNAL_SERVER_ERROR);
            response.setContentLength(0);

            auditLevel = AuditLevel.ERROR;
            auditStatus = AuditStatus.FAILED;
            auditMessage = message;
            return;
        }

        if (CT_REQUEST.equalsIgnoreCase(request.getContentType()) == false) {
            response.setContentLength(0);
            response.setStatus(HttpServletResponse.SC_UNSUPPORTED_MEDIA_TYPE);

            auditStatus = AuditStatus.FAILED;
            auditMessage = "unsupported media type " + request.getContentType();
            return;
        }

        String requestURI = request.getRequestURI();
        String servletPath = request.getServletPath();

        String caName = null;
        X509CACmpResponder responder = null;
        int n = servletPath.length();
        if (requestURI.length() > n + 1) {
            String caAlias = URLDecoder.decode(requestURI.substring(n + 1), "UTF-8");
            caName = responderManager.getCaNameForAlias(caAlias);
            if (caName == null) {
                caName = caAlias;
            }
            caName = caName.toUpperCase();
            responder = responderManager.getX509CACmpResponder(caName);
        }

        if (caName == null || responder == null || responder.isInService() == false) {
            if (caName == null) {
                auditMessage = "no CA is specified";
            } else if (responder == null) {
                auditMessage = "unknown CA '" + caName + "'";
            } else {
                auditMessage = "CA '" + caName + "' is out of service";
            }
            LOG.warn(auditMessage);

            response.setContentLength(0);
            response.setStatus(HttpServletResponse.SC_NOT_FOUND);

            auditStatus = AuditStatus.FAILED;
            return;
        }

        if (auditEvent != null) {
            auditEvent.addEventData(new AuditEventData("CA", responder.getCA().getCAInfo().getName()));
        }

        PKIMessage pkiReq;
        try {
            pkiReq = generatePKIMessage(request.getInputStream());
        } catch (Exception e) {
            response.setContentLength(0);
            response.setStatus(HttpServletResponse.SC_BAD_REQUEST);

            auditStatus = AuditStatus.FAILED;
            auditMessage = "bad request";

            final String message = "could not parse the request (PKIMessage)";
            if (LOG.isErrorEnabled()) {
                LOG.error(LogUtil.buildExceptionLogFormat(message), e.getClass().getName(), e.getMessage());
            }
            LOG.debug(message, e);

            return;
        }

        PKIHeader reqHeader = pkiReq.getHeader();
        ASN1OctetString tid = reqHeader.getTransactionID();

        PKIHeaderBuilder respHeader = new PKIHeaderBuilder(reqHeader.getPvno().getValue().intValue(),
                reqHeader.getRecipient(), reqHeader.getSender());
        respHeader.setTransactionID(tid);

        PKIMessage pkiResp = responder.processPKIMessage(pkiReq, clientCert, auditEvent);
        byte[] pkiRespBytes = pkiResp.getEncoded("DER");

        response.setContentType(Rfc6712Servlet.CT_RESPONSE);
        response.setStatus(HttpServletResponse.SC_OK);
        response.setContentLength(pkiRespBytes.length);
        response.getOutputStream().write(pkiRespBytes);
    } catch (EOFException e) {
        final String message = "connection reset by peer";
        if (LOG.isErrorEnabled()) {
            LOG.warn(LogUtil.buildExceptionLogFormat(message), e.getClass().getName(), e.getMessage());
        }
        LOG.debug(message, e);

        response.setStatus(HttpServletResponse.SC_INTERNAL_SERVER_ERROR);
        response.setContentLength(0);
    } catch (Throwable t) {
        final String message = "Throwable thrown, this should not happen!";
        LOG.error(message, t);

        response.setStatus(HttpServletResponse.SC_INTERNAL_SERVER_ERROR);
        response.setContentLength(0);
        auditLevel = AuditLevel.ERROR;
        auditStatus = AuditStatus.FAILED;
        auditMessage = "internal error";
    } finally {
        try {
            response.flushBuffer();
        } finally {
            if (auditEvent != null) {
                audit(auditLoggingService, auditEvent, auditLevel, auditStatus, auditMessage);
            }
        }
    }
}

From source file:org.xipki.ca.server.impl.X509CACmpResponder.java

License:Open Source License

@Override
protected PKIMessage intern_processPKIMessage(final RequestorInfo requestor, final String user,
        final ASN1OctetString tid, final GeneralPKIMessage message, final AuditEvent auditEvent)
        throws ConfigurationException {
    if (requestor instanceof CmpRequestorInfo == false) {
        throw new IllegalArgumentException("unknown requestor type " + requestor.getClass().getName());
    }/*from  w w  w  .  ja  v  a2  s . co m*/

    CmpRequestorInfo _requestor = (CmpRequestorInfo) requestor;
    if (_requestor != null && auditEvent != null) {
        auditEvent.addEventData(new AuditEventData("requestor", _requestor.getCert().getSubject()));
    }

    PKIHeader reqHeader = message.getHeader();
    PKIHeaderBuilder respHeader = new PKIHeaderBuilder(reqHeader.getPvno().getValue().intValue(), getSender(),
            reqHeader.getSender());
    respHeader.setTransactionID(tid);

    PKIBody respBody;
    PKIBody reqBody = message.getBody();
    final int type = reqBody.getType();

    CmpControl cmpControl = getCmpControl();

    try {
        switch (type) {
        case PKIBody.TYPE_CERT_REQ:
        case PKIBody.TYPE_KEY_UPDATE_REQ:
        case PKIBody.TYPE_P10_CERT_REQ:
        case PKIBody.TYPE_CROSS_CERT_REQ: {
            respBody = cmpEnrollCert(respHeader, cmpControl, reqHeader, reqBody, _requestor, user, tid,
                    auditEvent);
            break;
        }
        case PKIBody.TYPE_CERT_CONFIRM: {
            addAutitEventType(auditEvent, "CERT_CONFIRM");
            CertConfirmContent certConf = (CertConfirmContent) reqBody.getContent();
            respBody = confirmCertificates(tid, certConf);
            break;
        }
        case PKIBody.TYPE_REVOCATION_REQ: {
            respBody = cmpRevokeOrUnrevokeOrRemoveCertificates(respHeader, cmpControl, reqHeader, reqBody,
                    _requestor, user, tid, auditEvent);
            break;
        }
        case PKIBody.TYPE_CONFIRM: {
            addAutitEventType(auditEvent, "CONFIRM");
            respBody = new PKIBody(PKIBody.TYPE_CONFIRM, DERNull.INSTANCE);
        }
        case PKIBody.TYPE_ERROR: {
            addAutitEventType(auditEvent, "ERROR");
            revokePendingCertificates(tid);
            respBody = new PKIBody(PKIBody.TYPE_CONFIRM, DERNull.INSTANCE);
            break;
        }
        case PKIBody.TYPE_GEN_MSG: {
            respBody = cmpGeneralMsg(respHeader, cmpControl, reqHeader, reqBody, _requestor, user, tid,
                    auditEvent);
            break;
        }
        default: {
            addAutitEventType(auditEvent, "PKIBody." + type);
            respBody = createErrorMsgPKIBody(PKIStatus.rejection, PKIFailureInfo.badRequest,
                    "unsupported type " + type);
            break;
        }
        } // end switch(type)
    } catch (InsuffientPermissionException e) {
        ErrorMsgContent emc = new ErrorMsgContent(new PKIStatusInfo(PKIStatus.rejection,
                new PKIFreeText(e.getMessage()), new PKIFailureInfo(PKIFailureInfo.notAuthorized)));

        respBody = new PKIBody(PKIBody.TYPE_ERROR, emc);
    }

    if (auditEvent != null) {
        if (respBody.getType() == PKIBody.TYPE_ERROR) {
            ErrorMsgContent errorMsgContent = (ErrorMsgContent) respBody.getContent();

            AuditStatus auditStatus = AuditStatus.FAILED;
            org.xipki.ca.common.cmp.PKIStatusInfo pkiStatus = new org.xipki.ca.common.cmp.PKIStatusInfo(
                    errorMsgContent.getPKIStatusInfo());

            if (pkiStatus.getPkiFailureInfo() == PKIFailureInfo.systemFailure) {
                auditStatus = AuditStatus.FAILED;
            }
            auditEvent.setStatus(auditStatus);

            String statusString = pkiStatus.getStatusMessage();
            if (statusString != null) {
                auditEvent.addEventData(new AuditEventData("message", statusString));
            }
        } else if (auditEvent.getStatus() == null) {
            auditEvent.setStatus(AuditStatus.SUCCESSFUL);
        }
    }

    return new PKIMessage(respHeader.build(), respBody);
}

From source file:org.xipki.commons.remotep11.server.CmpResponder.java

License:Open Source License

PKIMessage processPkiMessage(final LocalP11CryptServicePool p11CryptServicePool, final String moduleName,
        final PKIMessage pkiMessage) {
    ParamUtil.requireNonNull("p11CryptServicePool", p11CryptServicePool);
    ParamUtil.requireNonNull("pkiMessage", pkiMessage);
    GeneralPKIMessage message = new GeneralPKIMessage(pkiMessage);

    PKIHeader reqHeader = message.getHeader();
    ASN1OctetString tid = reqHeader.getTransactionID();

    if (tid == null) {
        byte[] randomBytes = randomTransactionId();
        tid = new DEROctetString(randomBytes);
    }// w ww .  j a  v  a  2 s  .c  o m
    String tidStr = Hex.toHexString(tid.getOctets());

    PKIHeaderBuilder respHeaderBuilder = new PKIHeaderBuilder(reqHeader.getPvno().getValue().intValue(), sender,
            reqHeader.getSender());
    respHeaderBuilder.setTransactionID(tid);

    PKIBody reqBody = message.getBody();
    final int type = reqBody.getType();

    PKIHeader respHeader = respHeaderBuilder.build();

    if (type != PKIBody.TYPE_GEN_MSG) {
        ErrorMsgContent emc = new ErrorMsgContent(new PKIStatusInfo(PKIStatus.rejection,
                new PKIFreeText("unsupported type " + type), new PKIFailureInfo(PKIFailureInfo.badRequest)));

        PKIBody respBody = new PKIBody(PKIBody.TYPE_ERROR, emc);
        return new PKIMessage(respHeader, respBody);
    }

    GenMsgContent genMsgBody = GenMsgContent.getInstance(reqBody.getContent());
    InfoTypeAndValue[] itvs = genMsgBody.toInfoTypeAndValueArray();

    InfoTypeAndValue itv = null;
    if (itvs != null && itvs.length > 0) {
        for (InfoTypeAndValue m : itvs) {
            ASN1ObjectIdentifier itvType = m.getInfoType();
            if (ObjectIdentifiers.id_xipki_cmp_cmpGenmsg.equals(itvType)) {
                itv = m;
                break;
            }
        }
    }

    if (itv == null) {
        final String statusMessage = String.format("PKIBody type %s is only supported with the sub-knownTypes",
                ObjectIdentifiers.id_xipki_cmp_cmpGenmsg.getId());
        return createRejectionPkiMessage(respHeader, PKIFailureInfo.badRequest, statusMessage);
    }

    try {
        return doProcessPkiMessage(p11CryptServicePool, moduleName, itv, respHeader);
    } catch (BadAsn1ObjectException ex) {
        LogUtil.error(LOG, ex, "could not process CMP message " + tidStr);
        return createRejectionPkiMessage(respHeader, PKIFailureInfo.badRequest, ex.getMessage());
    } catch (P11TokenException ex) {
        LogUtil.error(LOG, ex, "could not process CMP message " + tidStr);

        String p11ErrorType;
        if (ex instanceof P11UnknownEntityException) {
            p11ErrorType = P11ProxyConstants.ERROR_UNKNOWN_ENTITY;
        } else if (ex instanceof P11DuplicateEntityException) {
            p11ErrorType = P11ProxyConstants.ERROR_DUPLICATE_ENTITY;
        } else if (ex instanceof P11UnsupportedMechanismException) {
            p11ErrorType = P11ProxyConstants.ERROR_UNSUPPORTED_MECHANISM;
        } else {
            p11ErrorType = P11ProxyConstants.ERROR_P11_TOKENERROR;
        }

        String errorMessage = ex.getMessage();

        if (errorMessage == null) {
            errorMessage = "NULL";
        } else if (StringUtil.isBlank(errorMessage.trim())) {
            errorMessage = "NULL";
        }

        ConfPairs confPairs = new ConfPairs(p11ErrorType, errorMessage);
        return createRejectionPkiMessage(respHeader, PKIFailureInfo.badRequest, confPairs.getEncoded());
    } catch (Throwable th) {
        LogUtil.error(LOG, th, "could not process CMP message " + tidStr);
        return createRejectionPkiMessage(respHeader, PKIFailureInfo.systemFailure, "SYSTEM_FAILURE");
    }
}

From source file:org.xipki.pki.ca.server.impl.cmp.CmpResponder.java

License:Open Source License

protected PKIMessage buildErrorPkiMessage(final ASN1OctetString tid, final PKIHeader requestHeader,
        final int failureCode, final String statusText) {
    GeneralName respRecipient = requestHeader.getSender();

    PKIHeaderBuilder respHeader = new PKIHeaderBuilder(requestHeader.getPvno().getValue().intValue(),
            getSender(), respRecipient);
    respHeader.setMessageTime(new ASN1GeneralizedTime(new Date()));
    if (tid != null) {
        respHeader.setTransactionID(tid);
    }//from  w ww .j  a v  a 2s . co m

    PKIStatusInfo status = generateRejectionStatus(failureCode, statusText);
    ErrorMsgContent error = new ErrorMsgContent(status);
    PKIBody body = new PKIBody(PKIBody.TYPE_ERROR, error);

    return new PKIMessage(respHeader.build(), body);
}

From source file:org.xipki.pki.ca.server.impl.cmp.HttpCmpServlet.java

License:Open Source License

@Override
public void doPost(final HttpServletRequest request, final HttpServletResponse response)
        throws ServletException, IOException {
    X509Certificate clientCert = ClientCertCache.getTlsClientCert(request, sslCertInHttpHeader);

    AuditService auditService = auditServiceRegister.getAuditService();
    AuditEvent event = new AuditEvent(new Date());
    event.setApplicationName(CaAuditConstants.APPNAME);
    event.setName(CaAuditConstants.NAME_PERF);
    event.addEventData(CaAuditConstants.NAME_reqType, RequestType.CMP.name());

    AuditLevel auditLevel = AuditLevel.INFO;
    AuditStatus auditStatus = AuditStatus.SUCCESSFUL;
    String auditMessage = null;//from  w ww . j  a va2 s. c om
    try {
        if (responderManager == null) {
            String message = "responderManager in servlet not configured";
            LOG.error(message);
            throw new HttpRespAuditException(HttpServletResponse.SC_INTERNAL_SERVER_ERROR, message,
                    AuditLevel.ERROR, AuditStatus.FAILED);
        }

        if (!CT_REQUEST.equalsIgnoreCase(request.getContentType())) {
            String message = "unsupported media type " + request.getContentType();
            throw new HttpRespAuditException(HttpServletResponse.SC_UNSUPPORTED_MEDIA_TYPE, message,
                    AuditLevel.INFO, AuditStatus.FAILED);
        }

        String requestUri = request.getRequestURI();
        String servletPath = request.getServletPath();

        String caName = null;
        X509CaCmpResponder responder = null;
        int len = servletPath.length();
        if (requestUri.length() > len + 1) {
            String caAlias = URLDecoder.decode(requestUri.substring(len + 1), "UTF-8");
            caName = responderManager.getCaNameForAlias(caAlias);
            if (caName == null) {
                caName = caAlias;
            }
            caName = caName.toUpperCase();
            responder = responderManager.getX509CaCmpResponder(caName);
        }

        if (caName == null || responder == null || !responder.isInService()) {
            String message;
            if (caName == null) {
                message = "no CA is specified";
            } else if (responder == null) {
                message = "unknown CA '" + caName + "'";
            } else {
                message = "CA '" + caName + "' is out of service";
            }
            LOG.warn(message);
            throw new HttpRespAuditException(HttpServletResponse.SC_NOT_FOUND, message, AuditLevel.INFO,
                    AuditStatus.FAILED);
        }

        event.addEventData(CaAuditConstants.NAME_CA, responder.getCa().getCaName());

        PKIMessage pkiReq;
        try {
            pkiReq = generatePkiMessage(request.getInputStream());
        } catch (Exception ex) {
            LogUtil.error(LOG, ex, "could not parse the request (PKIMessage)");
            throw new HttpRespAuditException(HttpServletResponse.SC_BAD_REQUEST, "bad request", AuditLevel.INFO,
                    AuditStatus.FAILED);
        }

        PKIHeader reqHeader = pkiReq.getHeader();
        ASN1OctetString tid = reqHeader.getTransactionID();
        String tidStr = Base64.toBase64String(tid.getOctets());
        event.addEventData(CaAuditConstants.NAME_tid, tidStr);

        PKIHeaderBuilder respHeader = new PKIHeaderBuilder(reqHeader.getPvno().getValue().intValue(),
                reqHeader.getRecipient(), reqHeader.getSender());
        respHeader.setTransactionID(tid);

        PKIMessage pkiResp = responder.processPkiMessage(pkiReq, clientCert, tidStr, event);
        response.setContentType(HttpCmpServlet.CT_RESPONSE);
        response.setStatus(HttpServletResponse.SC_OK);
        ASN1OutputStream asn1Out = new ASN1OutputStream(response.getOutputStream());
        asn1Out.writeObject(pkiResp);
        asn1Out.flush();
    } catch (HttpRespAuditException ex) {
        auditStatus = ex.getAuditStatus();
        auditLevel = ex.getAuditLevel();
        auditMessage = ex.getAuditMessage();
        response.setContentLength(0);
        response.setStatus(ex.getHttpStatus());
    } catch (EOFException ex) {
        LogUtil.warn(LOG, ex, "connection reset by peer");
        response.setStatus(HttpServletResponse.SC_INTERNAL_SERVER_ERROR);
        response.setContentLength(0);
    } catch (Throwable th) {
        final String message = "Throwable thrown, this should not happen!";
        LogUtil.error(LOG, th, message);

        response.setStatus(HttpServletResponse.SC_INTERNAL_SERVER_ERROR);
        response.setContentLength(0);
        auditLevel = AuditLevel.ERROR;
        auditStatus = AuditStatus.FAILED;
        auditMessage = "internal error";
    } finally {
        try {
            response.flushBuffer();
        } finally {
            audit(auditService, event, auditLevel, auditStatus, auditMessage);
        }
    }
}

From source file:org.xipki.pki.ca.server.impl.cmp.X509CaCmpResponder.java

License:Open Source License

@Override
protected PKIMessage doProcessPkiMessage(PKIMessage request, final RequestorInfo requestor, final String user,
        final ASN1OctetString tid, final GeneralPKIMessage message, final String msgId,
        final AuditEvent event) {
    if (!(requestor instanceof CmpRequestorInfo)) {
        throw new IllegalArgumentException("unknown requestor type " + requestor.getClass().getName());
    }//from  w ww  .j  a  v  a  2 s.c  o m

    CmpRequestorInfo tmpRequestor = (CmpRequestorInfo) requestor;
    event.addEventData(CaAuditConstants.NAME_requestor, tmpRequestor.getName());

    PKIHeader reqHeader = message.getHeader();
    PKIHeaderBuilder respHeader = new PKIHeaderBuilder(reqHeader.getPvno().getValue().intValue(), getSender(),
            reqHeader.getSender());
    respHeader.setTransactionID(tid);

    PKIBody respBody;
    PKIBody reqBody = message.getBody();
    final int type = reqBody.getType();

    CmpControl cmpControl = getCmpControl();

    try {
        switch (type) {
        case PKIBody.TYPE_CERT_REQ:
        case PKIBody.TYPE_KEY_UPDATE_REQ:
        case PKIBody.TYPE_P10_CERT_REQ:
        case PKIBody.TYPE_CROSS_CERT_REQ:
            String eventType = null;
            if (PKIBody.TYPE_CERT_REQ == type) {
                eventType = CaAuditConstants.TYPE_CMP_cr;
            } else if (PKIBody.TYPE_KEY_UPDATE_REQ == type) {
                eventType = CaAuditConstants.TYPE_CMP_kur;
            } else if (PKIBody.TYPE_KEY_UPDATE_REQ == type) {
                eventType = CaAuditConstants.TYPE_CMP_p10Cr;
            } else if (PKIBody.TYPE_CROSS_CERT_REQ == type) {
                eventType = CaAuditConstants.TYPE_CMP_ccr;
            }

            if (eventType != null) {
                event.addEventType(eventType);
            }
            respBody = cmpEnrollCert(request, respHeader, cmpControl, reqHeader, reqBody, tmpRequestor, user,
                    tid, msgId, event);
            break;
        case PKIBody.TYPE_CERT_CONFIRM:
            event.addEventType(CaAuditConstants.TYPE_CMP_certConf);
            CertConfirmContent certConf = (CertConfirmContent) reqBody.getContent();
            respBody = confirmCertificates(tid, certConf, msgId);
            break;
        case PKIBody.TYPE_REVOCATION_REQ:
            respBody = cmpUnRevokeRemoveCertificates(request, respHeader, cmpControl, reqHeader, reqBody,
                    tmpRequestor, user, msgId, event);
            break;
        case PKIBody.TYPE_CONFIRM:
            event.addEventType(CaAuditConstants.TYPE_CMP_pkiConf);
            respBody = new PKIBody(PKIBody.TYPE_CONFIRM, DERNull.INSTANCE);
            break;
        case PKIBody.TYPE_GEN_MSG:
            respBody = cmpGeneralMsg(respHeader, cmpControl, reqHeader, reqBody, tmpRequestor, user, tid, msgId,
                    event);
            break;
        case PKIBody.TYPE_ERROR:
            event.addEventType(CaAuditConstants.TYPE_CMP_error);
            revokePendingCertificates(tid, msgId);
            respBody = new PKIBody(PKIBody.TYPE_CONFIRM, DERNull.INSTANCE);
            break;
        default:
            event.addEventType("PKIBody." + type);
            respBody = buildErrorMsgPkiBody(PKIStatus.rejection, PKIFailureInfo.badRequest,
                    "unsupported type " + type);
            break;
        } // end switch (type)
    } catch (InsuffientPermissionException ex) {
        ErrorMsgContent emc = new ErrorMsgContent(new PKIStatusInfo(PKIStatus.rejection,
                new PKIFreeText(ex.getMessage()), new PKIFailureInfo(PKIFailureInfo.notAuthorized)));

        respBody = new PKIBody(PKIBody.TYPE_ERROR, emc);
    }

    if (respBody.getType() == PKIBody.TYPE_ERROR) {
        ErrorMsgContent errorMsgContent = (ErrorMsgContent) respBody.getContent();

        AuditStatus auditStatus = AuditStatus.FAILED;
        org.xipki.pki.ca.common.cmp.PkiStatusInfo pkiStatus = new org.xipki.pki.ca.common.cmp.PkiStatusInfo(
                errorMsgContent.getPKIStatusInfo());

        if (pkiStatus.getPkiFailureInfo() == PKIFailureInfo.systemFailure) {
            auditStatus = AuditStatus.FAILED;
        }
        event.setStatus(auditStatus);

        String statusString = pkiStatus.getStatusMessage();
        if (statusString != null) {
            event.addEventData(CaAuditConstants.NAME_message, statusString);
        }
    } else if (event.getStatus() == null) {
        event.setStatus(AuditStatus.SUCCESSFUL);
    }

    return new PKIMessage(respHeader.build(), respBody);
}