Java tutorial
/* * Copyright 2011 by Graz University of Technology, Austria * MOCCA has been developed by the E-Government Innovation Center EGIZ, a joint * initiative of the Federal Chancellery Austria and Graz University of Technology. * * Licensed under the EUPL, Version 1.1 or - as soon they will be approved by * the European Commission - subsequent versions of the EUPL (the "Licence"); * You may not use this work except in compliance with the Licence. * You may obtain a copy of the Licence at: * http://www.osor.eu/eupl/ * * Unless required by applicable law or agreed to in writing, software * distributed under the Licence is distributed on an "AS IS" basis, * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. * See the Licence for the specific language governing permissions and * limitations under the Licence. * * This product combines work with different licenses. See the "NOTICE" text * file for details on the various modules and licenses. * The "NOTICE" text file is part of the distribution. Any derivative works * that you distribute must include a readable copy of the "NOTICE" text file. */ package at.gv.egiz.bku.local.stal; import iaik.me.security.CryptoException; import iaik.me.security.MessageDigest; import java.awt.event.ActionListener; import java.io.ByteArrayOutputStream; import java.io.IOException; import java.io.InputStream; import java.security.DigestException; import java.security.NoSuchAlgorithmException; import java.util.ArrayList; import java.util.Arrays; import java.util.Collection; import java.util.Collections; import java.util.List; import org.apache.commons.io.IOUtils; import org.slf4j.Logger; import org.slf4j.LoggerFactory; import at.gv.egiz.bku.gui.BKUGUIFacade; import at.gv.egiz.bku.gui.hashdata.HashDataInputLoader; import at.gv.egiz.bku.gui.viewer.SecureViewer; import at.gv.egiz.bku.slcommands.impl.DataObjectHashDataInput; import at.gv.egiz.bku.slcommands.impl.cms.ReferencedHashDataInput; import at.gv.egiz.stal.HashDataInput; import at.gv.egiz.stal.SignatureInfo; import at.gv.egiz.stal.hashdata.StubHashDataInput; import at.gv.egiz.stal.impl.ByteArrayHashDataInput; import at.gv.egiz.stal.signedinfo.ReferenceType; /** * * @author Clemens Orthacker <clemens.orthacker@iaik.tugraz.at> */ public class LocalSecureViewer implements SecureViewer, HashDataInputLoader { private final Logger log = LoggerFactory.getLogger(LocalSecureViewer.class); private List<HashDataInput> hashDataInputs = Collections.emptyList(); protected BKUGUIFacade gui; public LocalSecureViewer(BKUGUIFacade gui) { this.gui = gui; } public void setDataToBeSigned(List<HashDataInput> dataToBeSigned) { this.hashDataInputs = dataToBeSigned; } /** * * @param signedInfo * @param okListener * @param okCommand * @throws java.lang.Exception */ @Override public void displayDataToBeSigned(SignatureInfo signedInfo, ActionListener okListener, String okCommand) throws Exception { log.info("Retrieve data to be signed for dsig:SignedInfo {}.", signedInfo.getId()); List<HashDataInput> hdi = getHashDataInputs(signedInfo); List<HashDataInput> verifiedDataToBeSigned = verifyHashDataInput(signedInfo.getReference(), hdi.get(0)); ArrayList<HashDataInput> selectedHashDataInputs = new ArrayList<HashDataInput>(); selectedHashDataInputs.addAll(verifiedDataToBeSigned); if (selectedHashDataInputs.size() < 1) { log.error("dsig:SignedInfo does not contain a data reference."); throw new Exception("dsig:SignedInfo does not contain a data reference."); } gui.showSecureViewer(selectedHashDataInputs, okListener, okCommand, this); } private HashDataInput ensureCachedHashDataInput(HashDataInput hashDataInput) throws IOException { if (!(hashDataInput instanceof DataObjectHashDataInput)) { log.warn("Expected DataObjectHashDataInput for LocalSignRequestHandler, got {}.", hashDataInput.getClass().getName()); InputStream hdIs = hashDataInput.getHashDataInput(); ByteArrayOutputStream baos = new ByteArrayOutputStream(hdIs.available()); int b; while ((b = hdIs.read()) != -1) { baos.write(b); } hashDataInput = new ByteArrayHashDataInput(baos.toByteArray(), hashDataInput.getReferenceId(), hashDataInput.getMimeType(), hashDataInput.getEncoding(), hashDataInput.getFilename()); } return hashDataInput; } @Override public void displayDataToBeSigned(List<SignatureInfo> signedInfo, ActionListener okListener, String okCommand) throws DigestException, Exception { log.warn("Called displayDataToBeSigned"); ArrayList<HashDataInput> selectedHashDataInputs = new ArrayList<HashDataInput>(); for (SignatureInfo nextSignedInfo : signedInfo) { selectedHashDataInputs.addAll(addEmptyHashDataInputs(nextSignedInfo)); } gui.showSecureViewer(selectedHashDataInputs, okListener, okCommand, this); } private Collection<? extends HashDataInput> addEmptyHashDataInputs(SignatureInfo signedInfo) throws Exception { if (signedInfo.getReference().size() == 0) { log.error("No hashdata input selected to be displayed: null."); throw new Exception("No HashData Input selected to be displayed."); } ArrayList<HashDataInput> selectedHashDataInputs = new ArrayList<HashDataInput>(); for (ReferenceType dsigRef : signedInfo.getReference()) { if (dsigRef.getType() == null) { selectedHashDataInputs .add(new StubHashDataInput(dsigRef, signedInfo.getDisplayName(), signedInfo.getMimeType())); } } return selectedHashDataInputs; } @Override public HashDataInput getHashDataInput(HashDataInput hashDataInput) throws Exception { if (hashDataInput instanceof StubHashDataInput) { String referenceId = hashDataInput.getReferenceId(); byte[] digest = hashDataInput.getDigest(); if (referenceId != null || digest != null) { boolean hdiAvailable = false; for (HashDataInput currentHashDataInput : hashDataInputs) { if (Arrays.equals(digest, currentHashDataInput.getDigest())) { log.debug("Display hashdata input for dsig:SignedReference {}.", referenceId); if (currentHashDataInput instanceof ReferencedHashDataInput) { ReferenceType reference = ((StubHashDataInput) hashDataInput).getReference(); return verifyHashDataInput(Arrays.asList(reference), currentHashDataInput).get(0); } else { return (ensureCachedHashDataInput(currentHashDataInput)); } } } if (!hdiAvailable) { for (HashDataInput currentHashDataInput : hashDataInputs) { if (referenceId.equals(hashDataInput.getReferenceId())) { log.debug("Display hashdata input for dsig:SignedReference {}.", referenceId); if (currentHashDataInput instanceof ReferencedHashDataInput) { ReferenceType reference = ((StubHashDataInput) hashDataInput).getReference(); return verifyHashDataInput(Arrays.asList(reference), currentHashDataInput).get(0); } else { return (ensureCachedHashDataInput(currentHashDataInput)); } } } } if (!hdiAvailable) { log.error("No hashdata input for dsig:SignedReference {}.", referenceId); throw new Exception("No HashDataInput available for dsig:SignedReference " + referenceId); } } else { throw new Exception("Cannot get HashDataInput for dsig:Reference without Id or digest attribute"); } } return hashDataInput; } public List<HashDataInput> getHashDataInputs(SignatureInfo signedInfo) throws Exception { ArrayList<HashDataInput> selectedHashDataInputs = new ArrayList<HashDataInput>(); if (signedInfo.getReference().size() == 0) { log.error("No hashdata input selected to be displayed: null."); throw new Exception("No HashData Input selected to be displayed."); } for (ReferenceType dsigRef : signedInfo.getReference()) { // don't get Manifest, QualifyingProperties, ... if (dsigRef.getType() == null) { HashDataInput emptyHashDataInput = new StubHashDataInput(dsigRef, signedInfo.getDisplayName(), signedInfo.getMimeType()); selectedHashDataInputs.add(getHashDataInput(emptyHashDataInput)); } } return selectedHashDataInputs; } private List<HashDataInput> verifyHashDataInput(List<ReferenceType> signedReferences, HashDataInput hashDataInput) throws DigestException, NoSuchAlgorithmException, Exception { ArrayList<HashDataInput> verifiedHashDataInputs = new ArrayList<HashDataInput>(); for (ReferenceType signedRef : signedReferences) { if (signedRef.getType() == null) { log.info("Verifying digest for signed reference {}.", signedRef.getId()); String signedRefId = signedRef.getId(); byte[] signedDigest = signedRef.getDigestValue(); String signedDigestAlg = null; if (signedRef.getDigestMethod() != null) { signedDigestAlg = signedRef.getDigestMethod().getAlgorithm(); } else { throw new NoSuchAlgorithmException( "Failed to verify digest value for reference " + signedRefId + ": no digest algorithm"); } if (hashDataInput == null) { throw new Exception("No hashdata input for reference " + signedRefId + " returned by service"); } byte[] hdi = null; try { hdi = IOUtils.toByteArray(hashDataInput.getHashDataInput()); } catch (IOException e) { throw new Exception("No hashdata input for reference " + signedRefId + " provided by service.", e); } String mimeType = hashDataInput.getMimeType(); String encoding = hashDataInput.getEncoding(); String filename = hashDataInput.getFilename(); if (log.isDebugEnabled()) { log.debug("Digesting reference " + signedRefId + " (" + mimeType + ";" + encoding + ")"); } byte[] hashDataInputDigest; if ((signedRef.getURI() != null) && signedRef.getURI().startsWith("CMSExcludedByteRange:")) { String range = signedRef.getURI().substring(21); int sep = range.indexOf('-'); int from = Integer.parseInt(range.substring(0, sep)); int to = Integer.parseInt(range.substring(sep + 1)); Arrays.fill(hdi, from, to + 1, (byte) 0); byte[] hashData = new byte[hdi.length - ((to + 1) - from)]; if (from > 0) System.arraycopy(hdi, 0, hashData, 0, from); if ((to + 1) < hdi.length) System.arraycopy(hdi, to + 1, hashData, from, hdi.length - (to + 1)); hashDataInputDigest = digest(hashData, signedDigestAlg); } else { hashDataInputDigest = digest(hdi, signedDigestAlg); } log.debug("Comparing digest to claimed digest value for reference {}.", signedRefId); if (!Arrays.equals(hashDataInputDigest, signedDigest)) { log.error("Bad digest value for reference {}.", signedRefId); throw new DigestException("Bad digest value for reference " + signedRefId); } verifiedHashDataInputs .add(new ByteArrayHashDataInput(hdi, signedRefId, mimeType, encoding, filename)); } } return verifiedHashDataInputs; } private byte[] digest(byte[] hashDataInput, String mdAlg) throws NoSuchAlgorithmException { if ("http://www.w3.org/2000/09/xmldsig#sha1".equals(mdAlg)) { mdAlg = "SHA-1"; } else if ("http://www.w3.org/2001/04/xmlenc#sha256".equals(mdAlg)) { mdAlg = "SHA-256"; } else if ("http://www.w3.org/2001/04/xmlenc#sha224".equals(mdAlg)) { mdAlg = "SHA-224"; } else if ("http://www.w3.org/2001/04/xmldsig-more#sha224".equals(mdAlg)) { mdAlg = "SHA-224"; } else if ("http://www.w3.org/2001/04/xmldsig-more#sha384".equals(mdAlg)) { mdAlg = "SHA-384"; } else if ("http://www.w3.org/2001/04/xmlenc#sha512".equals(mdAlg)) { mdAlg = "SHA-512"; } else if ("http://www.w3.org/2001/04/xmldsig-more#md2".equals(mdAlg)) { mdAlg = "MD2"; } else if ("http://www.w3.org/2001/04/xmldsig-more#md5".equals(mdAlg)) { mdAlg = "MD5"; } else if ("http://www.w3.org/2001/04/xmlenc#ripemd160".equals(mdAlg)) { mdAlg = "RIPEMD160"; } else { throw new NoSuchAlgorithmException( "Failed to verify digest value: unsupported digest algorithm " + mdAlg); } MessageDigest md; try { md = MessageDigest.getInstance(mdAlg); } catch (CryptoException e) { throw new NoSuchAlgorithmException(e); } return md.digest(hashDataInput); } }