Example usage for org.bouncycastle.cert.cmp GeneralPKIMessage getBody

List of usage examples for org.bouncycastle.cert.cmp GeneralPKIMessage getBody

  1. HOME
  2. Java
  3. org.bouncycastle
  4. org.bouncycastle.cert.cmp.*
  5. GeneralPKIMessage
  6. getBody

Introduction

In this page you can find the example usage for org.bouncycastle.cert.cmp GeneralPKIMessage getBody.

Prototype

public PKIBody getBody()

Source Link

Usage

From source file:org.xipki.ca.client.impl.CmpRequestor.java

License:Open Source License

protected PKIResponse signAndSend(final PKIMessage request, final RequestResponseDebug debug)
        throws CmpRequestorException {
    PKIMessage _request;//from w w w.ja  v  a  2  s  .  c om
    if (signRequest) {
        _request = sign(request);
    } else {
        _request = request;
    }

    if (responderCert == null) {
        throw new CmpRequestorException("CMP responder is not configured");
    }

    byte[] encodedRequest;
    try {
        encodedRequest = _request.getEncoded();
    } catch (IOException e) {
        LOG.error("error while encode the PKI request {}", _request);
        throw new CmpRequestorException(e.getMessage(), e);
    }

    RequestResponsePair reqResp = null;
    if (debug != null) {
        reqResp = new RequestResponsePair();
        debug.add(reqResp);
        reqResp.setRequest(encodedRequest);
    }

    byte[] encodedResponse;
    try {
        encodedResponse = send(encodedRequest);
    } catch (IOException e) {
        LOG.error("error while send the PKI request {} to server", _request);
        throw new CmpRequestorException("TRANSPORT_ERROR", e);
    }

    if (reqResp != null) {
        reqResp.setResponse(encodedResponse);
    }

    GeneralPKIMessage response;
    try {
        response = new GeneralPKIMessage(encodedResponse);
    } catch (IOException e) {
        if (LOG.isErrorEnabled()) {
            LOG.error("error while decode the received PKI message: {}", Hex.toHexString(encodedResponse));
        }
        throw new CmpRequestorException(e.getMessage(), e);
    }

    PKIHeader respHeader = response.getHeader();
    ASN1OctetString tid = respHeader.getTransactionID();
    GeneralName recipient = respHeader.getRecipient();
    if (sender.equals(recipient) == false) {
        LOG.warn("tid={}: unknown CMP requestor '{}'", tid, recipient);
    }

    PKIResponse ret = new PKIResponse(response);
    if (response.hasProtection()) {
        try {
            ProtectionVerificationResult verifyProtection = verifyProtection(Hex.toHexString(tid.getOctets()),
                    response, responderCert);
            ret.setProtectionVerificationResult(verifyProtection);
        } catch (InvalidKeyException | OperatorCreationException | CMPException e) {
            throw new CmpRequestorException(e.getMessage(), e);
        }
    } else if (signRequest) {
        PKIBody respBody = response.getBody();
        int bodyType = respBody.getType();
        if (bodyType != PKIBody.TYPE_ERROR) {
            throw new CmpRequestorException("response is not signed");
        }
    }

    return ret;
}

From source file:org.xipki.ca.server.impl.X509CACmpResponder.java

License:Open Source License

@Override
protected PKIMessage intern_processPKIMessage(final RequestorInfo requestor, final String user,
        final ASN1OctetString tid, final GeneralPKIMessage message, final AuditEvent auditEvent)
        throws ConfigurationException {
    if (requestor instanceof CmpRequestorInfo == false) {
        throw new IllegalArgumentException("unknown requestor type " + requestor.getClass().getName());
    }/* w  w  w .  j  a v  a 2 s  . co m*/

    CmpRequestorInfo _requestor = (CmpRequestorInfo) requestor;
    if (_requestor != null && auditEvent != null) {
        auditEvent.addEventData(new AuditEventData("requestor", _requestor.getCert().getSubject()));
    }

    PKIHeader reqHeader = message.getHeader();
    PKIHeaderBuilder respHeader = new PKIHeaderBuilder(reqHeader.getPvno().getValue().intValue(), getSender(),
            reqHeader.getSender());
    respHeader.setTransactionID(tid);

    PKIBody respBody;
    PKIBody reqBody = message.getBody();
    final int type = reqBody.getType();

    CmpControl cmpControl = getCmpControl();

    try {
        switch (type) {
        case PKIBody.TYPE_CERT_REQ:
        case PKIBody.TYPE_KEY_UPDATE_REQ:
        case PKIBody.TYPE_P10_CERT_REQ:
        case PKIBody.TYPE_CROSS_CERT_REQ: {
            respBody = cmpEnrollCert(respHeader, cmpControl, reqHeader, reqBody, _requestor, user, tid,
                    auditEvent);
            break;
        }
        case PKIBody.TYPE_CERT_CONFIRM: {
            addAutitEventType(auditEvent, "CERT_CONFIRM");
            CertConfirmContent certConf = (CertConfirmContent) reqBody.getContent();
            respBody = confirmCertificates(tid, certConf);
            break;
        }
        case PKIBody.TYPE_REVOCATION_REQ: {
            respBody = cmpRevokeOrUnrevokeOrRemoveCertificates(respHeader, cmpControl, reqHeader, reqBody,
                    _requestor, user, tid, auditEvent);
            break;
        }
        case PKIBody.TYPE_CONFIRM: {
            addAutitEventType(auditEvent, "CONFIRM");
            respBody = new PKIBody(PKIBody.TYPE_CONFIRM, DERNull.INSTANCE);
        }
        case PKIBody.TYPE_ERROR: {
            addAutitEventType(auditEvent, "ERROR");
            revokePendingCertificates(tid);
            respBody = new PKIBody(PKIBody.TYPE_CONFIRM, DERNull.INSTANCE);
            break;
        }
        case PKIBody.TYPE_GEN_MSG: {
            respBody = cmpGeneralMsg(respHeader, cmpControl, reqHeader, reqBody, _requestor, user, tid,
                    auditEvent);
            break;
        }
        default: {
            addAutitEventType(auditEvent, "PKIBody." + type);
            respBody = createErrorMsgPKIBody(PKIStatus.rejection, PKIFailureInfo.badRequest,
                    "unsupported type " + type);
            break;
        }
        } // end switch(type)
    } catch (InsuffientPermissionException e) {
        ErrorMsgContent emc = new ErrorMsgContent(new PKIStatusInfo(PKIStatus.rejection,
                new PKIFreeText(e.getMessage()), new PKIFailureInfo(PKIFailureInfo.notAuthorized)));

        respBody = new PKIBody(PKIBody.TYPE_ERROR, emc);
    }

    if (auditEvent != null) {
        if (respBody.getType() == PKIBody.TYPE_ERROR) {
            ErrorMsgContent errorMsgContent = (ErrorMsgContent) respBody.getContent();

            AuditStatus auditStatus = AuditStatus.FAILED;
            org.xipki.ca.common.cmp.PKIStatusInfo pkiStatus = new org.xipki.ca.common.cmp.PKIStatusInfo(
                    errorMsgContent.getPKIStatusInfo());

            if (pkiStatus.getPkiFailureInfo() == PKIFailureInfo.systemFailure) {
                auditStatus = AuditStatus.FAILED;
            }
            auditEvent.setStatus(auditStatus);

            String statusString = pkiStatus.getStatusMessage();
            if (statusString != null) {
                auditEvent.addEventData(new AuditEventData("message", statusString));
            }
        } else if (auditEvent.getStatus() == null) {
            auditEvent.setStatus(AuditStatus.SUCCESSFUL);
        }
    }

    return new PKIMessage(respHeader.build(), respBody);
}

From source file:org.xipki.commons.remotep11.server.CmpResponder.java

License:Open Source License

PKIMessage processPkiMessage(final LocalP11CryptServicePool p11CryptServicePool, final String moduleName,
        final PKIMessage pkiMessage) {
    ParamUtil.requireNonNull("p11CryptServicePool", p11CryptServicePool);
    ParamUtil.requireNonNull("pkiMessage", pkiMessage);
    GeneralPKIMessage message = new GeneralPKIMessage(pkiMessage);

    PKIHeader reqHeader = message.getHeader();
    ASN1OctetString tid = reqHeader.getTransactionID();

    if (tid == null) {
        byte[] randomBytes = randomTransactionId();
        tid = new DEROctetString(randomBytes);
    }/*from www  .ja va 2 s  . c o  m*/
    String tidStr = Hex.toHexString(tid.getOctets());

    PKIHeaderBuilder respHeaderBuilder = new PKIHeaderBuilder(reqHeader.getPvno().getValue().intValue(), sender,
            reqHeader.getSender());
    respHeaderBuilder.setTransactionID(tid);

    PKIBody reqBody = message.getBody();
    final int type = reqBody.getType();

    PKIHeader respHeader = respHeaderBuilder.build();

    if (type != PKIBody.TYPE_GEN_MSG) {
        ErrorMsgContent emc = new ErrorMsgContent(new PKIStatusInfo(PKIStatus.rejection,
                new PKIFreeText("unsupported type " + type), new PKIFailureInfo(PKIFailureInfo.badRequest)));

        PKIBody respBody = new PKIBody(PKIBody.TYPE_ERROR, emc);
        return new PKIMessage(respHeader, respBody);
    }

    GenMsgContent genMsgBody = GenMsgContent.getInstance(reqBody.getContent());
    InfoTypeAndValue[] itvs = genMsgBody.toInfoTypeAndValueArray();

    InfoTypeAndValue itv = null;
    if (itvs != null && itvs.length > 0) {
        for (InfoTypeAndValue m : itvs) {
            ASN1ObjectIdentifier itvType = m.getInfoType();
            if (ObjectIdentifiers.id_xipki_cmp_cmpGenmsg.equals(itvType)) {
                itv = m;
                break;
            }
        }
    }

    if (itv == null) {
        final String statusMessage = String.format("PKIBody type %s is only supported with the sub-knownTypes",
                ObjectIdentifiers.id_xipki_cmp_cmpGenmsg.getId());
        return createRejectionPkiMessage(respHeader, PKIFailureInfo.badRequest, statusMessage);
    }

    try {
        return doProcessPkiMessage(p11CryptServicePool, moduleName, itv, respHeader);
    } catch (BadAsn1ObjectException ex) {
        LogUtil.error(LOG, ex, "could not process CMP message " + tidStr);
        return createRejectionPkiMessage(respHeader, PKIFailureInfo.badRequest, ex.getMessage());
    } catch (P11TokenException ex) {
        LogUtil.error(LOG, ex, "could not process CMP message " + tidStr);

        String p11ErrorType;
        if (ex instanceof P11UnknownEntityException) {
            p11ErrorType = P11ProxyConstants.ERROR_UNKNOWN_ENTITY;
        } else if (ex instanceof P11DuplicateEntityException) {
            p11ErrorType = P11ProxyConstants.ERROR_DUPLICATE_ENTITY;
        } else if (ex instanceof P11UnsupportedMechanismException) {
            p11ErrorType = P11ProxyConstants.ERROR_UNSUPPORTED_MECHANISM;
        } else {
            p11ErrorType = P11ProxyConstants.ERROR_P11_TOKENERROR;
        }

        String errorMessage = ex.getMessage();

        if (errorMessage == null) {
            errorMessage = "NULL";
        } else if (StringUtil.isBlank(errorMessage.trim())) {
            errorMessage = "NULL";
        }

        ConfPairs confPairs = new ConfPairs(p11ErrorType, errorMessage);
        return createRejectionPkiMessage(respHeader, PKIFailureInfo.badRequest, confPairs.getEncoded());
    } catch (Throwable th) {
        LogUtil.error(LOG, th, "could not process CMP message " + tidStr);
        return createRejectionPkiMessage(respHeader, PKIFailureInfo.systemFailure, "SYSTEM_FAILURE");
    }
}

From source file:org.xipki.commons.security.pkcs11.proxy.ProxyP11Module.java

License:Open Source License

private ASN1Encodable extractItvInfoValue(final int action, final GeneralPKIMessage response)
        throws P11TokenException {
    PKIBody respBody = response.getBody();
    int bodyType = respBody.getType();

    if (PKIBody.TYPE_ERROR == bodyType) {
        ErrorMsgContent content = (ErrorMsgContent) respBody.getContent();
        PKIStatusInfo statusInfo = content.getPKIStatusInfo();
        String failureInfo = null;
        if (statusInfo.getStatusString() != null) {
            int size = statusInfo.getStatusString().size();
            if (size > 0) {
                failureInfo = statusInfo.getStatusString().getStringAt(0).getString();
            }//from   ww w  .  j a v  a 2 s . c o m
        }

        if (failureInfo == null) {
            throw new P11TokenException(
                    "server answered with ERROR: " + CmpFailureUtil.formatPkiStatusInfo(statusInfo));
        }

        if (failureInfo.startsWith(P11ProxyConstants.ERROR_P11_TOKENERROR)) {
            ConfPairs pairs = new ConfPairs(failureInfo);
            String errorMesage = pairs.getValue(P11ProxyConstants.ERROR_P11_TOKENERROR);
            throw new P11TokenException(errorMesage);
        } else if (failureInfo.startsWith(P11ProxyConstants.ERROR_UNKNOWN_ENTITY)) {
            ConfPairs pairs = new ConfPairs(failureInfo);
            String errorMesage = pairs.getValue(P11ProxyConstants.ERROR_UNKNOWN_ENTITY);
            throw new P11UnknownEntityException(errorMesage);
        } else if (failureInfo.startsWith(P11ProxyConstants.ERROR_UNSUPPORTED_MECHANISM)) {
            ConfPairs pairs = new ConfPairs(failureInfo);
            String errorMesage = pairs.getValue(P11ProxyConstants.ERROR_UNSUPPORTED_MECHANISM);
            throw new P11UnsupportedMechanismException(errorMesage);
        } else if (failureInfo.startsWith(P11ProxyConstants.ERROR_DUPLICATE_ENTITY)) {
            ConfPairs pairs = new ConfPairs(failureInfo);
            String errorMesage = pairs.getValue(P11ProxyConstants.ERROR_UNSUPPORTED_MECHANISM);
            throw new P11DuplicateEntityException(errorMesage);
        } else {
            throw new P11TokenException(
                    "server answered with ERROR: " + CmpFailureUtil.formatPkiStatusInfo(statusInfo));
        }
    } else if (PKIBody.TYPE_GEN_REP != bodyType) {
        throw new P11TokenException("unknown PKI body type " + bodyType + " instead the expected ["
                + PKIBody.TYPE_GEN_REP + ", " + PKIBody.TYPE_ERROR + "]");
    }

    GenRepContent genRep = (GenRepContent) respBody.getContent();

    InfoTypeAndValue[] itvs = genRep.toInfoTypeAndValueArray();
    InfoTypeAndValue itv = null;
    if (itvs != null && itvs.length > 0) {
        for (InfoTypeAndValue m : itvs) {
            if (ObjectIdentifiers.id_xipki_cmp_cmpGenmsg.equals(m.getInfoType())) {
                itv = m;
                break;
            }
        }
    }
    if (itv == null) {
        throw new P11TokenException("the response does not contain InfoTypeAndValue '"
                + ObjectIdentifiers.id_xipki_cmp_cmpGenmsg.getId() + "'");
    }

    ASN1Encodable itvValue = itv.getInfoValue();
    if (itvValue == null) {
        throw new P11TokenException("value of InfoTypeAndValue '"
                + ObjectIdentifiers.id_xipki_cmp_cmpGenmsg.getId() + "' is incorrect");
    }

    try {
        ASN1Sequence seq = Asn1Util.getSequence(itvValue);
        Asn1Util.requireRange(seq, 2, 3);

        int receivedversion = Asn1Util.getInteger(seq.getObjectAt(0)).intValue();
        if (receivedversion != version) {
            throw new P11TokenException(
                    "version '" + receivedversion + "' is not the expected '" + version + "'");
        }

        int receivedAction = Asn1Util.getInteger(seq.getObjectAt(1)).intValue();
        if (receivedAction != action) {
            throw new P11TokenException("action '" + receivedAction + "' is not the expected '" + action + "'");
        }

        return (seq.size() > 2) ? seq.getObjectAt(2) : null;
    } catch (BadAsn1ObjectException ex) {
        throw new P11TokenException("bad ASN1 object: " + ex.getMessage(), ex);
    }
}

From source file:org.xipki.pki.ca.client.impl.CmpRequestor.java

License:Open Source License

protected PkiResponse signAndSend(final PKIMessage request, final RequestResponseDebug debug)
        throws CmpRequestorException {
    ParamUtil.requireNonNull("request", request);

    PKIMessage tmpRequest = (signRequest) ? sign(request) : request;

    byte[] encodedRequest;
    try {//from  w w  w  .j ava  2  s .c  o  m
        encodedRequest = tmpRequest.getEncoded();
    } catch (IOException ex) {
        LOG.error("could not encode the PKI request {}", tmpRequest);
        throw new CmpRequestorException(ex.getMessage(), ex);
    }

    RequestResponsePair reqResp = null;
    if (debug != null) {
        reqResp = new RequestResponsePair();
        debug.add(reqResp);
        reqResp.setRequest(encodedRequest);
    }

    byte[] encodedResponse;
    try {
        encodedResponse = send(encodedRequest);
    } catch (IOException ex) {
        LOG.error("could not send the PKI request {} to server", tmpRequest);
        throw new CmpRequestorException("TRANSPORT_ERROR", ex);
    }

    if (reqResp != null) {
        reqResp.setResponse(encodedResponse);
    }

    GeneralPKIMessage response;
    try {
        response = new GeneralPKIMessage(encodedResponse);
    } catch (IOException ex) {
        LOG.error("could not decode the received PKI message: {}", Hex.toHexString(encodedResponse));
        throw new CmpRequestorException(ex.getMessage(), ex);
    }

    PKIHeader respHeader = response.getHeader();
    ASN1OctetString tid = respHeader.getTransactionID();
    GeneralName rec = respHeader.getRecipient();
    if (!sender.equals(rec)) {
        LOG.warn("tid={}: unknown CMP requestor '{}'", tid, rec);
    }

    PkiResponse ret = new PkiResponse(response);
    if (response.hasProtection()) {
        try {
            ProtectionVerificationResult verifyProtection = verifyProtection(Hex.toHexString(tid.getOctets()),
                    response);
            ret.setProtectionVerificationResult(verifyProtection);
        } catch (InvalidKeyException | OperatorCreationException | CMPException ex) {
            throw new CmpRequestorException(ex.getMessage(), ex);
        }
    } else if (signRequest) {
        PKIBody respBody = response.getBody();
        int bodyType = respBody.getType();
        if (bodyType != PKIBody.TYPE_ERROR) {
            throw new CmpRequestorException("response is not signed");
        }
    }

    return ret;
}

From source file:org.xipki.pki.ca.server.impl.cmp.X509CaCmpResponder.java

License:Open Source License

@Override
protected PKIMessage doProcessPkiMessage(PKIMessage request, final RequestorInfo requestor, final String user,
        final ASN1OctetString tid, final GeneralPKIMessage message, final String msgId,
        final AuditEvent event) {
    if (!(requestor instanceof CmpRequestorInfo)) {
        throw new IllegalArgumentException("unknown requestor type " + requestor.getClass().getName());
    }/*from   ww  w  .j  av a2  s  .  c  o m*/

    CmpRequestorInfo tmpRequestor = (CmpRequestorInfo) requestor;
    event.addEventData(CaAuditConstants.NAME_requestor, tmpRequestor.getName());

    PKIHeader reqHeader = message.getHeader();
    PKIHeaderBuilder respHeader = new PKIHeaderBuilder(reqHeader.getPvno().getValue().intValue(), getSender(),
            reqHeader.getSender());
    respHeader.setTransactionID(tid);

    PKIBody respBody;
    PKIBody reqBody = message.getBody();
    final int type = reqBody.getType();

    CmpControl cmpControl = getCmpControl();

    try {
        switch (type) {
        case PKIBody.TYPE_CERT_REQ:
        case PKIBody.TYPE_KEY_UPDATE_REQ:
        case PKIBody.TYPE_P10_CERT_REQ:
        case PKIBody.TYPE_CROSS_CERT_REQ:
            String eventType = null;
            if (PKIBody.TYPE_CERT_REQ == type) {
                eventType = CaAuditConstants.TYPE_CMP_cr;
            } else if (PKIBody.TYPE_KEY_UPDATE_REQ == type) {
                eventType = CaAuditConstants.TYPE_CMP_kur;
            } else if (PKIBody.TYPE_KEY_UPDATE_REQ == type) {
                eventType = CaAuditConstants.TYPE_CMP_p10Cr;
            } else if (PKIBody.TYPE_CROSS_CERT_REQ == type) {
                eventType = CaAuditConstants.TYPE_CMP_ccr;
            }

            if (eventType != null) {
                event.addEventType(eventType);
            }
            respBody = cmpEnrollCert(request, respHeader, cmpControl, reqHeader, reqBody, tmpRequestor, user,
                    tid, msgId, event);
            break;
        case PKIBody.TYPE_CERT_CONFIRM:
            event.addEventType(CaAuditConstants.TYPE_CMP_certConf);
            CertConfirmContent certConf = (CertConfirmContent) reqBody.getContent();
            respBody = confirmCertificates(tid, certConf, msgId);
            break;
        case PKIBody.TYPE_REVOCATION_REQ:
            respBody = cmpUnRevokeRemoveCertificates(request, respHeader, cmpControl, reqHeader, reqBody,
                    tmpRequestor, user, msgId, event);
            break;
        case PKIBody.TYPE_CONFIRM:
            event.addEventType(CaAuditConstants.TYPE_CMP_pkiConf);
            respBody = new PKIBody(PKIBody.TYPE_CONFIRM, DERNull.INSTANCE);
            break;
        case PKIBody.TYPE_GEN_MSG:
            respBody = cmpGeneralMsg(respHeader, cmpControl, reqHeader, reqBody, tmpRequestor, user, tid, msgId,
                    event);
            break;
        case PKIBody.TYPE_ERROR:
            event.addEventType(CaAuditConstants.TYPE_CMP_error);
            revokePendingCertificates(tid, msgId);
            respBody = new PKIBody(PKIBody.TYPE_CONFIRM, DERNull.INSTANCE);
            break;
        default:
            event.addEventType("PKIBody." + type);
            respBody = buildErrorMsgPkiBody(PKIStatus.rejection, PKIFailureInfo.badRequest,
                    "unsupported type " + type);
            break;
        } // end switch (type)
    } catch (InsuffientPermissionException ex) {
        ErrorMsgContent emc = new ErrorMsgContent(new PKIStatusInfo(PKIStatus.rejection,
                new PKIFreeText(ex.getMessage()), new PKIFailureInfo(PKIFailureInfo.notAuthorized)));

        respBody = new PKIBody(PKIBody.TYPE_ERROR, emc);
    }

    if (respBody.getType() == PKIBody.TYPE_ERROR) {
        ErrorMsgContent errorMsgContent = (ErrorMsgContent) respBody.getContent();

        AuditStatus auditStatus = AuditStatus.FAILED;
        org.xipki.pki.ca.common.cmp.PkiStatusInfo pkiStatus = new org.xipki.pki.ca.common.cmp.PkiStatusInfo(
                errorMsgContent.getPKIStatusInfo());

        if (pkiStatus.getPkiFailureInfo() == PKIFailureInfo.systemFailure) {
            auditStatus = AuditStatus.FAILED;
        }
        event.setStatus(auditStatus);

        String statusString = pkiStatus.getStatusMessage();
        if (statusString != null) {
            event.addEventData(CaAuditConstants.NAME_message, statusString);
        }
    } else if (event.getStatus() == null) {
        event.setStatus(AuditStatus.SUCCESSFUL);
    }

    return new PKIMessage(respHeader.build(), respBody);
}

From source file:org.xipki.remotep11.server.impl.CmpResponder.java

License:Open Source License

PKIMessage processPKIMessage(final LocalP11CryptServicePool localP11CryptServicePool, final String moduleName,
        final PKIMessage pkiMessage) {
    GeneralPKIMessage message = new GeneralPKIMessage(pkiMessage);

    PKIHeader reqHeader = message.getHeader();
    ASN1OctetString tid = reqHeader.getTransactionID();

    if (tid == null) {
        byte[] randomBytes = randomTransactionId();
        tid = new DEROctetString(randomBytes);
    }//from   w  w w. ja  v  a2s . c o  m
    String tidStr = Hex.toHexString(tid.getOctets());

    PKIHeaderBuilder respHeaderBuilder = new PKIHeaderBuilder(reqHeader.getPvno().getValue().intValue(), sender,
            reqHeader.getSender());
    respHeaderBuilder.setTransactionID(tid);

    PKIBody reqBody = message.getBody();
    final int type = reqBody.getType();

    PKIHeader respHeader = respHeaderBuilder.build();

    if (type != PKIBody.TYPE_GEN_MSG) {
        ErrorMsgContent emc = new ErrorMsgContent(new PKIStatusInfo(PKIStatus.rejection,
                new PKIFreeText("unsupported type " + type), new PKIFailureInfo(PKIFailureInfo.badRequest)));

        PKIBody respBody = new PKIBody(PKIBody.TYPE_ERROR, emc);

        return new PKIMessage(respHeader, respBody);
    }

    GenMsgContent genMsgBody = (GenMsgContent) reqBody.getContent();
    InfoTypeAndValue[] itvs = genMsgBody.toInfoTypeAndValueArray();

    InfoTypeAndValue itv = null;
    if (itvs != null && itvs.length > 0) {
        for (InfoTypeAndValue m : itvs) {
            ASN1ObjectIdentifier itvType = m.getInfoType();
            if (ObjectIdentifiers.id_xipki_cmp.equals(itvType)) {
                itv = m;
                break;
            }
        }
    }

    if (itv == null) {
        final String statusMessage = String.format("PKIBody type %s is only supported with the sub-knownTypes",
                ObjectIdentifiers.id_xipki_cmp.getId());
        return createRejectionPKIMessage(respHeader, PKIFailureInfo.badRequest, statusMessage);
    }

    try {
        ASN1Encodable asn1 = itv.getInfoValue();
        ASN1Integer asn1Code = null;
        ASN1Encodable reqValue = null;

        try {
            ASN1Sequence seq = ASN1Sequence.getInstance(asn1);
            asn1Code = ASN1Integer.getInstance(seq.getObjectAt(0));
            if (seq.size() > 1) {
                reqValue = seq.getObjectAt(1);
            }
        } catch (IllegalArgumentException e) {
            final String statusMessage = "invalid value of the InfoTypeAndValue for "
                    + ObjectIdentifiers.id_xipki_cmp.getId();
            return createRejectionPKIMessage(respHeader, PKIFailureInfo.badRequest, statusMessage);
        }

        int action = asn1Code.getPositiveValue().intValue();
        ASN1Encodable respItvInfoValue;

        P11CryptService p11CryptService = localP11CryptServicePool.getP11CryptService(moduleName);

        switch (action) {
        case XipkiCmpConstants.ACTION_RP11_VERSION: {
            respItvInfoValue = new ASN1Integer(localP11CryptServicePool.getVersion());
            break;
        }
        case XipkiCmpConstants.ACTION_RP11_PSO_DSA_PLAIN:
        case XipkiCmpConstants.ACTION_RP11_PSO_DSA_X962:
        case XipkiCmpConstants.ACTION_RP11_PSO_ECDSA_PLAIN:
        case XipkiCmpConstants.ACTION_RP11_PSO_ECDSA_X962:
        case XipkiCmpConstants.ACTION_RP11_PSO_RSA_PKCS:
        case XipkiCmpConstants.ACTION_RP11_PSO_RSA_X509: {
            byte[] psoMessage = null;
            P11SlotIdentifier slot = null;
            P11KeyIdentifier keyId = null;
            {
                try {
                    PSOTemplate psoTemplate = PSOTemplate.getInstance(reqValue);
                    psoMessage = psoTemplate.getMessage();
                    SlotAndKeyIdentifer slotAndKeyIdentifier = psoTemplate.getSlotAndKeyIdentifer();
                    slot = slotAndKeyIdentifier.getSlotIdentifier().getSlotId();
                    KeyIdentifier keyIdentifier = slotAndKeyIdentifier.getKeyIdentifier();
                    keyId = keyIdentifier.getKeyId();
                } catch (IllegalArgumentException e) {
                    final String statusMessage = "invalid PSOTemplate";
                    return createRejectionPKIMessage(respHeader, PKIFailureInfo.badRequest, statusMessage);
                }
            }

            byte[] signature;

            if (XipkiCmpConstants.ACTION_RP11_PSO_ECDSA_PLAIN == action) {
                signature = p11CryptService.CKM_ECDSA_Plain(psoMessage, slot, keyId);
            } else if (XipkiCmpConstants.ACTION_RP11_PSO_ECDSA_X962 == action) {
                signature = p11CryptService.CKM_ECDSA_X962(psoMessage, slot, keyId);
            } else if (XipkiCmpConstants.ACTION_RP11_PSO_DSA_PLAIN == action) {
                signature = p11CryptService.CKM_DSA_Plain(psoMessage, slot, keyId);
            } else if (XipkiCmpConstants.ACTION_RP11_PSO_DSA_X962 == action) {
                signature = p11CryptService.CKM_DSA_X962(psoMessage, slot, keyId);
            } else if (XipkiCmpConstants.ACTION_RP11_PSO_RSA_X509 == action) {
                signature = p11CryptService.CKM_RSA_X509(psoMessage, slot, keyId);
            } else if (XipkiCmpConstants.ACTION_RP11_PSO_RSA_PKCS == action) {
                signature = p11CryptService.CKM_RSA_PKCS(psoMessage, slot, keyId);
            } else {
                throw new RuntimeException("should not reach here");
            }

            respItvInfoValue = new DEROctetString(signature);
            break;
        }
        case XipkiCmpConstants.ACTION_RP11_GET_CERTIFICATE:
        case XipkiCmpConstants.ACTION_RP11_GET_PUBLICKEY: {
            P11SlotIdentifier slot = null;
            P11KeyIdentifier keyId = null;
            try {
                SlotAndKeyIdentifer slotAndKeyIdentifier = SlotAndKeyIdentifer.getInstance(reqValue);
                slot = slotAndKeyIdentifier.getSlotIdentifier().getSlotId();
                KeyIdentifier keyIdentifier = slotAndKeyIdentifier.getKeyIdentifier();
                keyId = keyIdentifier.getKeyId();
            } catch (IllegalArgumentException e) {
                final String statusMessage = "invalid SlotAndKeyIdentifier";
                return createRejectionPKIMessage(respHeader, PKIFailureInfo.badRequest, statusMessage);
            }

            byte[] encodeCertOrKey;
            if (XipkiCmpConstants.ACTION_RP11_GET_CERTIFICATE == action) {
                encodeCertOrKey = p11CryptService.getCertificate(slot, keyId).getEncoded();
            } else if (XipkiCmpConstants.ACTION_RP11_GET_PUBLICKEY == action) {
                encodeCertOrKey = p11CryptService.getPublicKey(slot, keyId).getEncoded();
            } else {
                throw new RuntimeException("should not reach here");
            }

            respItvInfoValue = new DEROctetString(encodeCertOrKey);
            break;
        }
        case XipkiCmpConstants.ACTION_RP11_LIST_SLOTS: {
            P11SlotIdentifier[] slotIds = p11CryptService.getSlotIdentifiers();

            ASN1EncodableVector vector = new ASN1EncodableVector();
            for (P11SlotIdentifier slotId : slotIds) {
                vector.add(new SlotIdentifier(slotId));
            }
            respItvInfoValue = new DERSequence(vector);
            break;
        }
        case XipkiCmpConstants.ACTION_RP11_LIST_KEYLABELS: {
            SlotIdentifier slotId = SlotIdentifier.getInstance(reqValue);
            String[] keyLabels = p11CryptService.getKeyLabels(slotId.getSlotId());

            ASN1EncodableVector vector = new ASN1EncodableVector();
            for (String keyLabel : keyLabels) {
                vector.add(new DERUTF8String(keyLabel));
            }
            respItvInfoValue = new DERSequence(vector);
            break;
        }
        default: {
            final String statusMessage = "unsupported XiPKI action code '" + action + "'";
            return createRejectionPKIMessage(respHeader, PKIFailureInfo.badRequest, statusMessage);
        }
        } // end switch(code)

        ASN1EncodableVector v = new ASN1EncodableVector();
        v.add(new ASN1Integer(action));
        if (respItvInfoValue != null) {
            v.add(respItvInfoValue);
        }
        InfoTypeAndValue respItv = new InfoTypeAndValue(ObjectIdentifiers.id_xipki_cmp, new DERSequence(v));
        GenRepContent genRepContent = new GenRepContent(respItv);
        PKIBody respBody = new PKIBody(PKIBody.TYPE_GEN_REP, genRepContent);
        return new PKIMessage(respHeader, respBody);
    } catch (Throwable t) {
        LOG.error("error while processing CMP message {}, message: {}", tidStr, t.getMessage());
        LOG.debug("error while processing CMP message " + tidStr, t);
        return createRejectionPKIMessage(respHeader, PKIFailureInfo.systemFailure, t.getMessage());
    }
}

From source file:org.xipki.security.p11.remote.RemoteP11CryptService.java

License:Open Source License

private static ASN1Encodable extractItvInfoValue(final int action, final GeneralPKIMessage response)
        throws SignerException {
    PKIBody respBody = response.getBody();
    int bodyType = respBody.getType();

    if (PKIBody.TYPE_ERROR == bodyType) {
        ErrorMsgContent content = (ErrorMsgContent) respBody.getContent();
        PKIStatusInfo statusInfo = content.getPKIStatusInfo();
        throw new SignerException(
                "server answered with ERROR: " + SecurityUtil.formatPKIStatusInfo(statusInfo));
    }//from w ww  . j a  v a 2 s  .  co m

    else if (PKIBody.TYPE_GEN_REP != bodyType) {
        throw new SignerException("unknown PKI body type " + bodyType + " instead the exceptected ["
                + PKIBody.TYPE_GEN_REP + ", " + PKIBody.TYPE_ERROR + "]");
    }

    GenRepContent genRep = (GenRepContent) respBody.getContent();

    InfoTypeAndValue[] itvs = genRep.toInfoTypeAndValueArray();
    InfoTypeAndValue itv = null;
    if (itvs != null && itvs.length > 0) {
        for (InfoTypeAndValue m : itvs) {
            if (ObjectIdentifiers.id_xipki_cmp.equals(m.getInfoType())) {
                itv = m;
                break;
            }
        }
    }
    if (itv == null) {
        throw new SignerException("the response does not contain InfoTypeAndValue '"
                + ObjectIdentifiers.id_xipki_cmp.getId() + "'");
    }

    ASN1Encodable itvValue = itv.getInfoValue();
    if (itvValue == null) {
        throw new SignerException(
                "value of InfoTypeAndValue '" + ObjectIdentifiers.id_xipki_cmp.getId() + "'  is incorrect");
    }
    try {
        ASN1Sequence seq = ASN1Sequence.getInstance(itvValue);
        int receivedAction = ASN1Integer.getInstance(seq.getObjectAt(0)).getPositiveValue().intValue();
        if (receivedAction != action) {
            throw new SignerException(
                    "xipki action '" + receivedAction + "'  is not the expected '" + action + "'");
        }
        return seq.size() > 1 ? seq.getObjectAt(1) : null;
    } catch (IllegalArgumentException | ArrayIndexOutOfBoundsException e) {
        throw new SignerException("value of response (type nfoTypeAndValue) '"
                + ObjectIdentifiers.id_xipki_cmp.getId() + "'  is incorrect");
    }
}