auth/auth-certman/src/main/java/org/onap/aaf/auth/cm/cert/CSRMeta.java

   1 /**
   2  * ============LICENSE_START====================================================
   3  * org.onap.aaf
   4  * ===========================================================================
   5  * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved.
   6  * ===========================================================================
   7  * Licensed under the Apache License, Version 2.0 (the "License");
   8  * you may not use this file except in compliance with the License.
   9  * You may obtain a copy of the License at
  10  *
  11  *      http://www.apache.org/licenses/LICENSE-2.0
  12  *
  13  * Unless required by applicable law or agreed to in writing, software
  14  * distributed under the License is distributed on an "AS IS" BASIS,
  15  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  16  * See the License for the specific language governing permissions and
  17  * limitations under the License.
  18  * ============LICENSE_END====================================================
  19  *
  20  */
  21 package org.onap.aaf.auth.cm.cert;
  22
  23 import java.io.IOException;
  24 import java.math.BigInteger;
  25 import java.security.KeyPair;
  26 import java.security.SecureRandom;
  27 import java.security.cert.CertificateException;
  28 import java.security.cert.X509Certificate;
  29 import java.util.ArrayList;
  30 import java.util.Date;
  31 import java.util.GregorianCalendar;
  32 import java.util.List;
  33
  34 import org.bouncycastle.asn1.ASN1Sequence;
  35 import org.bouncycastle.asn1.DERPrintableString;
  36 import org.bouncycastle.asn1.pkcs.Attribute;
  37 import org.bouncycastle.asn1.pkcs.PKCSObjectIdentifiers;
  38 import org.bouncycastle.asn1.x500.X500Name;
  39 import org.bouncycastle.asn1.x500.X500NameBuilder;
  40 import org.bouncycastle.asn1.x500.style.BCStyle;
  41 import org.bouncycastle.asn1.x509.Extension;
  42 import org.bouncycastle.asn1.x509.Extensions;
  43 import org.bouncycastle.asn1.x509.GeneralName;
  44 import org.bouncycastle.asn1.x509.GeneralNames;
  45 import org.bouncycastle.asn1.x509.SubjectPublicKeyInfo;
  46 import org.bouncycastle.cert.X509v3CertificateBuilder;
  47 import org.bouncycastle.cert.jcajce.JcaX509CertificateConverter;
  48 import org.bouncycastle.operator.OperatorCreationException;
  49 import org.bouncycastle.pkcs.PKCS10CertificationRequest;
  50 import org.bouncycastle.pkcs.PKCS10CertificationRequestBuilder;
  51 import org.bouncycastle.pkcs.jcajce.JcaPKCS10CertificationRequestBuilder;
  52 import org.onap.aaf.cadi.cm.CertException;
  53 import org.onap.aaf.cadi.cm.Factory;
  54 import org.onap.aaf.misc.env.Trans;
  55
  56 public class CSRMeta {
  57         private String cn;
  58         private String mechID;
  59         private String environment;
  60         private String email;
  61         private String challenge;
  62         private List<RDN> rdns;
  63
  64         public CSRMeta(List<RDN> rdns) {
  65                 this.rdns = rdns;
  66         }
  67
  68         private ArrayList<String> sanList = new ArrayList<String>();
  69         private KeyPair keyPair;
  70         private X500Name name = null;
  71         private SecureRandom random = new SecureRandom();
  72
  73         public X500Name x500Name() throws IOException {
  74                 if(name==null) {
  75                         X500NameBuilder xnb = new X500NameBuilder();
  76                         xnb.addRDN(BCStyle.CN,cn);
  77                         xnb.addRDN(BCStyle.E,email);
  78                         if(mechID!=null) {
  79                                 if(environment==null) {
  80                                         xnb.addRDN(BCStyle.OU,mechID);
  81                                 } else {
  82                                         xnb.addRDN(BCStyle.OU,mechID+':'+environment);
  83                                 }
  84                         }
  85                         for(RDN rdn : rdns) {
  86                                 xnb.addRDN(rdn.aoi,rdn.value);
  87                         }
  88                         name = xnb.build();
  89                 }
  90                 return name;
  91         }
  92
  93
  94         public PKCS10CertificationRequest  generateCSR(Trans trans) throws IOException, CertException {
  95                 PKCS10CertificationRequestBuilder builder = new JcaPKCS10CertificationRequestBuilder(x500Name(),keypair(trans).getPublic());
  96                 if(challenge!=null) {
  97                         DERPrintableString password = new DERPrintableString(challenge);
  98                         builder.addAttribute(PKCSObjectIdentifiers.pkcs_9_at_challengePassword, password);
  99                 }
 100
 101                 int plus = email==null?0:1;
 102                 if(sanList.size()>0) {
 103                         GeneralName[] gna = new GeneralName[sanList.size()+plus];
 104                         int i=-1;
 105                         for(String s : sanList) {
 106                                 gna[++i]=new GeneralName(GeneralName.dNSName,s);
 107                         }
 108                         gna[++i]=new GeneralName(GeneralName.rfc822Name,email);
 109
 110                         builder.addAttribute(
 111                                         PKCSObjectIdentifiers.pkcs_9_at_extensionRequest,
 112                                         new Extensions(new Extension[] {
 113                                                         new Extension(Extension.subjectAlternativeName,false,new GeneralNames(gna).getEncoded())
 114                                         })
 115                         );
 116                 }
 117
 118                 if(email!=null) {
 119
 120                 }
 121                 try {
 122                         return builder.build(BCFactory.contentSigner(keypair(trans).getPrivate()));
 123                 } catch (OperatorCreationException e) {
 124                         throw new CertException(e);
 125                 }
 126         }
 127
 128         @SuppressWarnings("deprecation")
 129         public static void dump(PKCS10CertificationRequest csr) {
 130                  Attribute[] certAttributes = csr.getAttributes();
 131                  for (Attribute attribute : certAttributes) {
 132                      if (attribute.getAttrType().equals(PKCSObjectIdentifiers.pkcs_9_at_extensionRequest)) {
 133                          Extensions extensions = Extensions.getInstance(attribute.getAttrValues().getObjectAt(0));
 134                          GeneralNames gns = GeneralNames.fromExtensions(extensions,Extension.subjectAlternativeName);
 135                          GeneralName[] names = gns.getNames();
 136                          for(int k=0; k < names.length; k++) {
 137                              String title = "";
 138                              if(names[k].getTagNo() == GeneralName.dNSName) {
 139                                  title = "dNSName";
 140                              } else if(names[k].getTagNo() == GeneralName.iPAddress) {
 141                                  title = "iPAddress";
 142                                  // Deprecated, but I don't see anything better to use.
 143                                  names[k].toASN1Object();
 144                              } else if(names[k].getTagNo() == GeneralName.otherName) {
 145                                  title = "otherName";
 146                              } else if(names[k].getTagNo() == GeneralName.rfc822Name) {
 147                                  title = "email";
 148                              }
 149
 150                              System.out.println(title + ": "+ names[k].getName());
 151                          }
 152                      }
 153                  }
 154         }
 155
 156         public X509Certificate initialConversationCert(Trans trans) throws IOException, CertificateException, OperatorCreationException {
 157                 GregorianCalendar gc = new GregorianCalendar();
 158                 Date start = gc.getTime();
 159                 gc.add(GregorianCalendar.DAY_OF_MONTH,2);
 160                 Date end = gc.getTime();
 161                 X509v3CertificateBuilder xcb = new X509v3CertificateBuilder(
 162                                 x500Name(),
 163                                 new BigInteger(12,random), // replace with Serialnumber scheme
 164                                 start,
 165                                 end,
 166                                 x500Name(),
 167                                 new SubjectPublicKeyInfo(ASN1Sequence.getInstance(keypair(trans).getPublic().getEncoded()))
 168                                 );
 169                 return new JcaX509CertificateConverter().getCertificate(
 170                                 xcb.build(BCFactory.contentSigner(keypair(trans).getPrivate())));
 171         }
 172
 173         public CSRMeta san(String v) {
 174                 sanList.add(v);
 175                 return this;
 176         }
 177
 178         public List<String> sans() {
 179                 return sanList;
 180         }
 181
 182
 183         public KeyPair keypair(Trans trans) {
 184                 if(keyPair == null) {
 185                         keyPair = Factory.generateKeyPair(trans);
 186                 }
 187                 return keyPair;
 188         }
 189
 190         /**
 191          * @return the cn
 192          */
 193         public String cn() {
 194                 return cn;
 195         }
 196
 197
 198         /**
 199          * @param cn the cn to set
 200          */
 201         public void cn(String cn) {
 202                 this.cn = cn;
 203         }
 204
 205         /**
 206          * Environment of Service MechID is good for
 207          */
 208         public void environment(String env) {
 209                 environment = env;
 210         }
 211
 212         /**
 213          *
 214          * @return
 215          */
 216         public String environment() {
 217                 return environment;
 218         }
 219
 220         /**
 221          * @return the mechID
 222          */
 223         public String mechID() {
 224                 return mechID;
 225         }
 226
 227
 228         /**
 229          * @param mechID the mechID to set
 230          */
 231         public void mechID(String mechID) {
 232                 this.mechID = mechID;
 233         }
 234
 235
 236         /**
 237          * @return the email
 238          */
 239         public String email() {
 240                 return email;
 241         }
 242
 243
 244         /**
 245          * @param email the email to set
 246          */
 247         public void email(String email) {
 248                 this.email = email;
 249         }
 250
 251         /**
 252          * @return the challenge
 253          */
 254         public String challenge() {
 255                 return challenge;
 256         }
 257
 258
 259         /**
 260          * @param challenge the challenge to set
 261          */
 262         public void challenge(String challenge) {
 263                 this.challenge = challenge;
 264         }
 265
 266 }