Example usage for org.bouncycastle.tsp TimeStampResponse validate

Introduction

In this page you can find the example usage for org.bouncycastle.tsp TimeStampResponse validate.

Prototype

public void validate(TimeStampRequest request) throws TSPException 

Source Link

Document

Check this response against to see if it a well formed response for the passed in request.

Usage

From source file:org.signserver.client.cli.defaultimpl.TimeStampCommand.java

License:Open Source License

@SuppressWarnings("SleepWhileInLoop") // We are just using the sleep for rate limiting
private void tsaRequest() throws Exception {
    final Random rand = new Random();
    final TimeStampRequestGenerator timeStampRequestGenerator = new TimeStampRequestGenerator();
    boolean doRun = true;
    do {//from   w  w  w .  j ava  2  s  .c om

        final int nonce = rand.nextInt();

        byte[] digest = new byte[20];
        if (instring != null) {
            final byte[] digestBytes = instring.getBytes("UTF-8");
            final MessageDigest dig = MessageDigest.getInstance(TSPAlgorithms.SHA1.getId(), "BC");
            dig.update(digestBytes);
            digest = dig.digest();
            // When we have given input, we don't want to loop
            doRun = false;
        }
        if (infilestring != null) {
            // TSPAlgorithms constants changed from Strings to ASN1Encoded objects
            digest = digestFile(infilestring, TSPAlgorithms.SHA1.getId());
            doRun = false;
        }
        final byte[] hexDigest = Hex.encode(digest);

        if (LOG.isDebugEnabled()) {
            LOG.debug("MessageDigest=" + new String(hexDigest));
        }

        final TimeStampRequest timeStampRequest;
        if (inreqstring == null) {
            LOG.debug("Generating a new request");
            timeStampRequestGenerator.setCertReq(certReq);
            if (reqPolicy != null) {
                timeStampRequestGenerator.setReqPolicy(new ASN1ObjectIdentifier(reqPolicy));
            }
            timeStampRequest = timeStampRequestGenerator.generate(TSPAlgorithms.SHA1, digest,
                    BigInteger.valueOf(nonce));
        } else {
            LOG.debug("Reading request from file");
            timeStampRequest = new TimeStampRequest(readFiletoBuffer(inreqstring));
        }
        final byte[] requestBytes = timeStampRequest.getEncoded();

        if (outreqstring != null) {
            // Store request
            byte[] outBytes;
            if (base64) {
                outBytes = Base64.encode(requestBytes);
            } else {
                outBytes = requestBytes;
            }
            FileOutputStream fos = null;
            try {
                fos = new FileOutputStream(outreqstring);
                fos.write(outBytes);
            } finally {
                if (fos != null) {
                    fos.close();
                }
            }
        }

        keyStoreOptions.setupHTTPS();

        URL url;
        URLConnection urlConn;
        DataOutputStream printout;
        DataInputStream input;

        url = new URL(urlstring);

        // Take start time
        final long startMillis = System.currentTimeMillis();
        final long startTime = System.nanoTime();
        if (LOG.isDebugEnabled()) {
            LOG.debug("Sending request at: " + startMillis);
        }

        urlConn = url.openConnection();

        urlConn.setDoInput(true);
        urlConn.setDoOutput(true);
        urlConn.setUseCaches(false);
        urlConn.setRequestProperty("Content-Type", "application/timestamp-query");

        // Send POST output.
        printout = new DataOutputStream(urlConn.getOutputStream());
        printout.write(requestBytes);
        printout.flush();
        printout.close();

        // Get response data.
        input = new DataInputStream(urlConn.getInputStream());

        final ByteArrayOutputStream baos = new ByteArrayOutputStream();
        int b;
        while ((b = input.read()) != -1) {
            baos.write(b);
        }

        // Take stop time
        final long estimatedTime = System.nanoTime() - startTime;

        LOG.info("Got reply after " + TimeUnit.NANOSECONDS.toMillis(estimatedTime) + " ms");

        final byte[] replyBytes = baos.toByteArray();
        if (outrepstring != null) {
            // Store request
            byte[] outBytes;
            if (base64) {
                outBytes = Base64.encode(replyBytes);
            } else {
                outBytes = replyBytes;
            }
            FileOutputStream fos = null;
            try {
                fos = new FileOutputStream(outrepstring);
                fos.write(outBytes);
            } finally {
                if (fos != null) {
                    fos.close();
                }
            }
        }

        final TimeStampResponse timeStampResponse = new TimeStampResponse(replyBytes);
        timeStampResponse.validate(timeStampRequest);

        LOG.info("TimeStampRequest validated");

        if (LOG.isDebugEnabled()) {
            final Date genTime;
            if (timeStampResponse.getTimeStampToken() != null
                    && timeStampResponse.getTimeStampToken().getTimeStampInfo() != null) {
                genTime = timeStampResponse.getTimeStampToken().getTimeStampInfo().getGenTime();
            } else {
                genTime = null;
            }
            LOG.debug("(Status: " + timeStampResponse.getStatus() + ", " + timeStampResponse.getFailInfo()
                    + "): " + timeStampResponse.getStatusString()
                    + (genTime != null ? (", genTime: " + genTime.getTime()) : "") + "\n");

        }

        if (doRun) {
            Thread.sleep(sleep);
        }
    } while (doRun);
}

---

From source file:org.signserver.module.tsa.RequestedPolicyDispatcherTest.java

License:Open Source License

private void assertValid(TimeStampRequest req, TimeStampResponse res) {
    try {/*from   ww  w . j a  v  a 2  s . c  o m*/
        res.validate(req);
    } catch (TSPException ex) {
        fail(ex.getMessage());
    }
}

---

From source file:org.signserver.module.tsa.RequestedPolicyDispatcherTest.java

License:Open Source License

private void assertSuccessfulTimestamp(int worker) throws Exception {
    final int reqid = random.nextInt();
    final BigInteger nounce = createNounce();

    TimeStampRequestGenerator timeStampRequestGenerator = new TimeStampRequestGenerator();
    TimeStampRequest timeStampRequest = timeStampRequestGenerator.generate(TSPAlgorithms.SHA1, new byte[20],
            nounce);//  ww w  .jav  a 2 s.  c  om
    byte[] requestBytes = timeStampRequest.getEncoded();

    GenericSignRequest signRequest = new GenericSignRequest(reqid, requestBytes);

    final GenericSignResponse res = (GenericSignResponse) workerSession.process(worker, signRequest,
            new RequestContext());

    assertEquals("Request ID", reqid, res.getRequestID());

    Certificate signercert = res.getSignerCertificate();
    assertNotNull("contains certificate", signercert);

    final TimeStampResponse timeStampResponse = new TimeStampResponse((byte[]) res.getProcessedData());
    timeStampResponse.validate(timeStampRequest);

    assertEquals("Token granted", PKIStatus.GRANTED, timeStampResponse.getStatus());
    assertNotNull("Got timestamp token", timeStampResponse.getTimeStampToken());
}

---

From source file:org.signserver.module.tsa.TimeStampSignerTest.java

License:Open Source License

/**
 * Test successfully doing a TSA request.
 * /*from   ww  w  .  ja  v  a 2 s.  co  m*/
 * @param worker Worker ID
 * @param includeSigningTime If the signingTime signed CMS attribute is expected or not
 * @return Time stamp response
 * @throws Exception
 */
private TimeStampResponse assertSuccessfulTimestamp(int worker, final boolean includeSigningTime)
        throws Exception {
    int reqid = random.nextInt();

    TimeStampRequestGenerator timeStampRequestGenerator = new TimeStampRequestGenerator();
    TimeStampRequest timeStampRequest = timeStampRequestGenerator.generate(TSPAlgorithms.SHA1, new byte[20],
            BigInteger.valueOf(100));
    byte[] requestBytes = timeStampRequest.getEncoded();

    GenericSignRequest signRequest = new GenericSignRequest(reqid, requestBytes);

    final GenericSignResponse res = (GenericSignResponse) workerSession.process(worker, signRequest,
            new RequestContext());

    assertTrue(reqid == res.getRequestID());

    Certificate signercert = res.getSignerCertificate();

    assertNotNull(signercert);

    final TimeStampResponse timeStampResponse = new TimeStampResponse((byte[]) res.getProcessedData());
    timeStampResponse.validate(timeStampRequest);

    assertEquals("Token granted", PKIStatus.GRANTED, timeStampResponse.getStatus());
    assertNotNull("Got timestamp token", timeStampResponse.getTimeStampToken());

    // Validate the signature of the token
    try {
        final SignerInformationVerifier infoVerifier = new JcaSimpleSignerInfoVerifierBuilder()
                .setProvider("BC").build((X509Certificate) signercert);
        timeStampResponse.getTimeStampToken().validate(infoVerifier);
    } catch (TSPValidationException ex) {
        LOG.error("Token validation failed", ex);
        fail("Token validation failed: " + ex.getMessage());
    }

    // check the signingTime signed attribute
    final AttributeTable attrs = timeStampResponse.getTimeStampToken().getSignedAttributes();
    final Attribute attr = attrs.get(CMSAttributes.signingTime);

    if (includeSigningTime) {
        assertNotNull("Should contain signingTime signed attribute", attr);
    } else {
        assertNull("Should not contain signingTime signed attribute", attr);
    }

    return timeStampResponse;
}

---

From source file:org.signserver.module.tsa.TimeStampSignerTest.java

License:Open Source License

/**
 * Test that a timestamp token is not granted for an policy not listed in
 * ACCEPTEDPOLICIES and that a proper resoonse is sent back.
 * @throws Exception in case of exception
 *//*from  w w w. ja  va 2 s  .  c om*/
@Test
public void test03NotAcceptedPolicy() throws Exception {
    // WORKER2 has ACCEPTEDPOLICIES=1.2.3
    // Create an request with another policy (1.2.3.5 != 1.2.3)
    final TimeStampRequest timeStampRequest = new TimeStampRequest(
            Base64.decode(REQUEST_WITH_POLICY1235.getBytes()));

    final byte[] requestBytes = timeStampRequest.getEncoded();

    final GenericSignRequest signRequest = new GenericSignRequest(13, requestBytes);

    final GenericSignResponse res = (GenericSignResponse) workerSession.process(WORKER2, signRequest,
            new RequestContext());

    final TimeStampResponse timeStampResponse = new TimeStampResponse((byte[]) res.getProcessedData());
    timeStampResponse.validate(timeStampRequest);

    LOG.info("Response: " + timeStampResponse.getStatusString());

    assertEquals("Token rejected", PKIStatus.REJECTION, timeStampResponse.getStatus());
}

---

From source file:org.signserver.module.tsa.TimeStampSignerTest.java

License:Open Source License

private int testWithHash(final ASN1ObjectIdentifier hashAlgo) throws Exception {
    int reqid = random.nextInt();
    TimeStampRequestGenerator timeStampRequestGenerator = new TimeStampRequestGenerator();
    final TimeStampRequest timeStampRequest = timeStampRequestGenerator.generate(hashAlgo,
            new byte[getHashLength(hashAlgo)], BigInteger.valueOf(100));

    byte[] requestBytes = timeStampRequest.getEncoded();

    GenericSignRequest signRequest = new GenericSignRequest(reqid, requestBytes);

    final GenericSignResponse res = (GenericSignResponse) workerSession.process(WORKER1, signRequest,
            new RequestContext());

    final CertificateFactory factory = CertificateFactory.getInstance("X.509");
    final X509Certificate cert = (X509Certificate) factory
            .generateCertificate(new ByteArrayInputStream(Base64.decode(CERTSTRING.getBytes())));

    TimeStampResponse timeStampResponse = null;
    try {/*w  w w. j av a  2s .  co  m*/
        // check response
        timeStampResponse = new TimeStampResponse((byte[]) res.getProcessedData());
        timeStampResponse.validate(timeStampRequest);

        if (timeStampResponse.getStatus() != PKIStatus.GRANTED) {
            // return early and don't attempt to get a token
            return timeStampResponse.getStatus();
        }

        // check the hash value from the response
        TimeStampToken token = timeStampResponse.getTimeStampToken();
        AlgorithmIdentifier algo = token.getTimeStampInfo().getHashAlgorithm();
        assertEquals("Timestamp response is using incorrect hash algorithm", hashAlgo, algo.getAlgorithm());

        Collection signerInfos = token.toCMSSignedData().getSignerInfos().getSigners();

        // there should be one SignerInfo
        assertEquals("There should only be one signer in the timestamp response", 1, signerInfos.size());

        for (Object o : signerInfos) {
            SignerInformation si = (SignerInformation) o;

            // test the response signature algorithm
            assertEquals("Timestamp used unexpected signature algorithm", TSPAlgorithms.SHA1.toString(),
                    si.getDigestAlgOID());
            assertEquals("Timestamp is signed with unexpected signature encryption algorithm",
                    "1.2.840.113549.1.1.1", si.getEncryptionAlgOID());

            final AttributeTable attrs = si.getSignedAttributes();
            final ASN1EncodableVector scAttrs = attrs.getAll(PKCSObjectIdentifiers.id_aa_signingCertificate);

            assertEquals("Should contain a signingCertificate signed attribute", 1, scAttrs.size());

            TestUtils.checkSigningCertificateAttribute(ASN1Sequence.getInstance(scAttrs.get(0)), cert);
        }

    } catch (TSPException e) {
        fail("Failed to verify response");
    } catch (IOException e) {
        fail("Failed to verify response");
    }

    final TimeStampToken token = timeStampResponse.getTimeStampToken();

    try {

        token.validate(cert, "BC");

    } catch (TSPException e) {
        fail("Failed to validate response token");
    }

    return timeStampResponse.getStatus();
}

---

From source file:org.signserver.module.tsa.TimeStampSignerTest.java

License:Open Source License

private void assertTimeNotAvailable(int worker) throws Exception {
    final int reqid = random.nextInt();

    final TimeStampRequestGenerator timeStampRequestGenerator = new TimeStampRequestGenerator();
    final TimeStampRequest timeStampRequest = timeStampRequestGenerator.generate(TSPAlgorithms.SHA1,
            new byte[20], BigInteger.valueOf(114));
    final byte[] requestBytes = timeStampRequest.getEncoded();

    final GenericSignRequest signRequest = new GenericSignRequest(reqid, requestBytes);

    final GenericSignResponse res = (GenericSignResponse) workerSession.process(worker, signRequest,
            new RequestContext());

    assertTrue(reqid == res.getRequestID());

    final TimeStampResponse timeStampResponse = new TimeStampResponse((byte[]) res.getProcessedData());
    timeStampResponse.validate(timeStampRequest);

    LOG.info("Response: " + timeStampResponse.getStatusString());

    assertEquals("Token not granted", PKIStatus.REJECTION, timeStampResponse.getStatus());

    assertEquals("PKIFailureInfo.timeNotAvailable", new PKIFailureInfo(PKIFailureInfo.timeNotAvailable),
            timeStampResponse.getFailInfo());

    assertNull("No timestamp token", timeStampResponse.getTimeStampToken());
}

---

From source file:org.signserver.module.tsa.TimeStampSignerTest.java

License:Open Source License

/**
 * Check that we either include the signer certificate if it is missing or
 * otherwise fails the request.//from   w  ww. ja  v  a 2 s.  com
 * 
 * In addition Health check should also report an error for this.
 * 
 * RFC#3161 2.4.1:
 * "If the certReq field is present and set to true, the TSA's public key
 *  certificate that is referenced by the ESSCertID identifier inside a
 *  SigningCertificate attribute in the response MUST be provided by the
 *  TSA in the certificates field from the SignedData structure in that
 *  response.  That field may also contain other certificates."
 */
@Test
public void test09SignerCertificateMustBeIncluded() throws Exception {
    List<Certificate> chain = workerSession.getSignerCertificateChain(WORKER2);
    final X509Certificate subject = (X509Certificate) chain.get(0);
    X509Certificate issuer = (X509Certificate) chain.get(1);

    // Now, don't include the signer certificate in the chain
    // For some reason we need to upload the signer certificate again :S
    workerSession.uploadSignerCertificate(WORKER2, subject.getEncoded(), GlobalConfiguration.SCOPE_GLOBAL);
    workerSession.uploadSignerCertificateChain(WORKER2, Arrays.asList(issuer.getEncoded()),
            GlobalConfiguration.SCOPE_GLOBAL);
    workerSession.reloadConfiguration(WORKER2);

    if (!subject.equals(workerSession.getSignerCertificate(WORKER2))) {
        LOG.info("Subject: " + subject);
        LOG.info("Signer: " + workerSession.getSignerCertificate(WORKER2));
        throw new Exception("Something is fishy. Test assumed the signer certificate to be present");
    }
    // Test the status of the worker
    WorkerStatus actualStatus = workerSession.getStatus(WORKER2);
    assertEquals("should be error as signer certificate is not included in chain", 1,
            actualStatus.getFatalErrors().size());
    assertTrue("error should talk about missing signer certificate: " + actualStatus.getFatalErrors(),
            actualStatus.getFatalErrors().get(0).contains("ertificate"));

    // Send a request including certificates
    TimeStampRequestGenerator timeStampRequestGenerator = new TimeStampRequestGenerator();
    timeStampRequestGenerator.setCertReq(true);
    TimeStampRequest timeStampRequest = timeStampRequestGenerator.generate(TSPAlgorithms.SHA1, new byte[20],
            BigInteger.valueOf(100));
    byte[] requestBytes = timeStampRequest.getEncoded();
    GenericSignRequest signRequest = new GenericSignRequest(123124, requestBytes);
    try {
        final GenericSignResponse res = (GenericSignResponse) workerSession.process(WORKER2, signRequest,
                new RequestContext());

        final TimeStampResponse timeStampResponse = new TimeStampResponse((byte[]) res.getProcessedData());
        timeStampResponse.validate(timeStampRequest);

        if (PKIStatus.GRANTED == timeStampResponse.getStatus()) {
            fail("Should have failed as the signer is miss-configured");
        }
    } catch (CryptoTokenOfflineException ex) {
        assertTrue("message should talk about missing signer certificate",
                ex.getMessage().contains("igner certificate"));
    } finally {
        // Restore
        workerSession.uploadSignerCertificate(WORKER2, subject.getEncoded(), GlobalConfiguration.SCOPE_GLOBAL);
        workerSession.uploadSignerCertificateChain(WORKER2, asListOfByteArrays(chain),
                GlobalConfiguration.SCOPE_GLOBAL);
        workerSession.reloadConfiguration(WORKER2);
    }
}

---

From source file:org.signserver.module.tsa.TimeStampSignerTest.java

License:Open Source License

/**
 * Tests that status is not OK and that an failure is generated when trying
 * to sign when the right signer certificate is not configured.
 *
 *//*from w w w.  ja va 2  s .  c om*/
@Test
public void test10WrongSignerCertificate() throws Exception {
    final List<Certificate> chain = workerSession.getSignerCertificateChain(WORKER2);
    final X509Certificate subject = (X509Certificate) workerSession.getSignerCertificate(WORKER2);

    // Any other certificate that will no match the key-pair
    final X509Certificate other = new JcaX509CertificateConverter()
            .getCertificate(new CertBuilder().setSubject("CN=Other")
                    .addExtension(new CertExt(org.bouncycastle.asn1.x509.X509Extension.extendedKeyUsage, true,
                            new ExtendedKeyUsage(KeyPurposeId.id_kp_timeStamping)))
                    .build());

    try {
        // Use the other certificate which will not match the key + the right cert in chain        
        workerSession.uploadSignerCertificate(WORKER2, other.getEncoded(), GlobalConfiguration.SCOPE_GLOBAL);
        workerSession.uploadSignerCertificateChain(WORKER2, Arrays.asList(subject.getEncoded()),
                GlobalConfiguration.SCOPE_GLOBAL);
        workerSession.reloadConfiguration(WORKER2);

        // Test the status of the worker
        WorkerStatus actualStatus = workerSession.getStatus(WORKER2);
        assertEquals("should be error as the right signer certificate is not configured", 2,
                actualStatus.getFatalErrors().size());
        assertTrue("error should talk about incorrect signer certificate: " + actualStatus.getFatalErrors(),
                actualStatus.getFatalErrors().get(0).contains("ertificate"));

        // Send a request including certificates
        TimeStampRequestGenerator timeStampRequestGenerator = new TimeStampRequestGenerator();
        timeStampRequestGenerator.setCertReq(true);
        TimeStampRequest timeStampRequest = timeStampRequestGenerator.generate(TSPAlgorithms.SHA1, new byte[20],
                BigInteger.valueOf(100));
        byte[] requestBytes = timeStampRequest.getEncoded();
        GenericSignRequest signRequest = new GenericSignRequest(123124, requestBytes);
        try {
            final GenericSignResponse res = (GenericSignResponse) workerSession.process(WORKER2, signRequest,
                    new RequestContext());

            final TimeStampResponse timeStampResponse = new TimeStampResponse((byte[]) res.getProcessedData());
            timeStampResponse.validate(timeStampRequest);

            if (PKIStatus.GRANTED == timeStampResponse.getStatus()) {
                fail("Should have failed as the signer is miss-configured");
            }
        } catch (CryptoTokenOfflineException ex) {
            assertTrue("message should talk about incorrect signer certificate",
                    ex.getMessage().contains("igner certificate"));
        }
    } finally {
        // Restore
        workerSession.uploadSignerCertificate(WORKER2, subject.getEncoded(), GlobalConfiguration.SCOPE_GLOBAL);
        workerSession.uploadSignerCertificateChain(WORKER2, asListOfByteArrays(chain),
                GlobalConfiguration.SCOPE_GLOBAL);
        workerSession.reloadConfiguration(WORKER2);
    }
}

---

From source file:org.signserver.module.tsa.TimeStampSignerTest.java

License:Open Source License

/**
 * Tests that status is not OK and that an failure is generated when trying
 * to sign when the right signer certificate is not configured in the 
 * certificate chain property./*from  w w w  .java 2s.c o  m*/
 *
 */
@Test
public void test10WrongSignerCertificate_InChain() throws Exception {
    final List<Certificate> chain = workerSession.getSignerCertificateChain(WORKER2);
    final X509Certificate subject = (X509Certificate) workerSession.getSignerCertificate(WORKER2);

    // Any other certificate that will no match the key-pair
    final X509Certificate other = new JcaX509CertificateConverter()
            .getCertificate(new CertBuilder().setSubject("CN=Other").build());

    try {
        // Use the right certificate but the other in the certificate chain
        workerSession.uploadSignerCertificate(WORKER2, subject.getEncoded(), GlobalConfiguration.SCOPE_GLOBAL);
        workerSession.uploadSignerCertificateChain(WORKER2, Arrays.asList(other.getEncoded()),
                GlobalConfiguration.SCOPE_GLOBAL);
        workerSession.reloadConfiguration(WORKER2);

        // Test the status of the worker
        WorkerStatus actualStatus = workerSession.getStatus(WORKER2);
        assertEquals("should be error as the right signer certificate is not configured", 1,
                actualStatus.getFatalErrors().size());
        assertTrue("error should talk about incorrect signer certificate: " + actualStatus.getFatalErrors(),
                actualStatus.getFatalErrors().get(0).contains("ertificate"));

        // Send a request including certificates
        TimeStampRequestGenerator timeStampRequestGenerator = new TimeStampRequestGenerator();
        timeStampRequestGenerator.setCertReq(true);
        TimeStampRequest timeStampRequest = timeStampRequestGenerator.generate(TSPAlgorithms.SHA1, new byte[20],
                BigInteger.valueOf(100));
        byte[] requestBytes = timeStampRequest.getEncoded();
        GenericSignRequest signRequest = new GenericSignRequest(123124, requestBytes);
        try {
            final GenericSignResponse res = (GenericSignResponse) workerSession.process(WORKER2, signRequest,
                    new RequestContext());

            final TimeStampResponse timeStampResponse = new TimeStampResponse((byte[]) res.getProcessedData());
            timeStampResponse.validate(timeStampRequest);

            if (PKIStatus.GRANTED == timeStampResponse.getStatus()) {
                fail("Should have failed as the signer is miss-configured");
            }
        } catch (CryptoTokenOfflineException ex) {
            assertTrue("message should talk about incorrect signer certificate",
                    ex.getMessage().contains("igner certificate"));
        }
    } finally {
        // Restore
        workerSession.uploadSignerCertificate(WORKER2, subject.getEncoded(), GlobalConfiguration.SCOPE_GLOBAL);
        workerSession.uploadSignerCertificateChain(WORKER2, asListOfByteArrays(chain),
                GlobalConfiguration.SCOPE_GLOBAL);
        workerSession.reloadConfiguration(WORKER2);
    }
}

---

• «
• 1
• 2
• 3
• 4
• 5
• »