Java tutorial
/** * Copyright (c) Istituto Nazionale di Fisica Nucleare, 2006-2014. * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * You may obtain a copy of the License at * * http://www.apache.org/licenses/LICENSE-2.0 * * Unless required by applicable law or agreed to in writing, software * distributed under the License is distributed on an "AS IS" BASIS, * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. * See the License for the specific language governing permissions and * limitations under the License. */ package org.italiangrid.voms.asn1; import java.io.ByteArrayInputStream; import java.io.ByteArrayOutputStream; import java.io.IOException; import java.io.OutputStream; import java.math.BigInteger; import java.security.cert.CertificateEncodingException; import java.security.cert.X509Certificate; import java.util.Date; import java.util.EnumSet; import java.util.List; import java.util.Random; import org.bouncycastle.asn1.ASN1Encodable; import org.bouncycastle.asn1.ASN1EncodableVector; import org.bouncycastle.asn1.ASN1InputStream; import org.bouncycastle.asn1.ASN1ObjectIdentifier; import org.bouncycastle.asn1.DEREncodable; import org.bouncycastle.asn1.DERNull; import org.bouncycastle.asn1.DERObject; import org.bouncycastle.asn1.DEROctetString; import org.bouncycastle.asn1.DERSequence; import org.bouncycastle.asn1.DERTaggedObject; import org.bouncycastle.asn1.x509.AlgorithmIdentifier; import org.bouncycastle.asn1.x509.AuthorityKeyIdentifier; import org.bouncycastle.asn1.x509.GeneralName; import org.bouncycastle.asn1.x509.GeneralNames; import org.bouncycastle.asn1.x509.X509Extension; import org.bouncycastle.cert.AttributeCertificateHolder; import org.bouncycastle.cert.AttributeCertificateIssuer; import org.bouncycastle.cert.X509AttributeCertificateHolder; import org.bouncycastle.cert.X509v2AttributeCertificateBuilder; import org.bouncycastle.cert.jcajce.JcaX509CertificateHolder; import org.bouncycastle.jce.provider.BouncyCastleProvider; import org.bouncycastle.operator.ContentSigner; import org.bouncycastle.operator.DefaultSignatureAlgorithmIdentifierFinder; import org.bouncycastle.operator.OperatorCreationException; import org.bouncycastle.operator.jcajce.JcaContentSignerBuilder; import org.italiangrid.voms.VOMSError; import org.italiangrid.voms.VOMSGenericAttribute; import eu.emi.security.authn.x509.X509Credential; import eu.emi.security.authn.x509.proxy.CertificateExtension; /** * * This AC generator provides the VOMS AC encoding starting from a set of * attributes. * * @author Andrea Ceccanti * */ public class VOMSACGenerator implements VOMSConstants { public static enum ACGenerationProperties { SKIP_AC_CERTS_EXTENSION, FAKE_SIGNATURE_BITS, INCLUDE_FAKE_CRITICAL_EXTENSION, INCLUDE_CRITICAL_NO_REV_AVAIL_EXTENSION, INCLUDE_CRITICAL_AKID_EXTENSION, INCLUDE_EMPTY_AC_CERTS_EXTENSION } public static final EnumSet<ACGenerationProperties> defaultGenerationProperties = EnumSet .noneOf(ACGenerationProperties.class); static class RandomContentSigner implements ContentSigner { public static int SIG_LENGHT = 1024; ByteArrayOutputStream bos = new ByteArrayOutputStream(); AlgorithmIdentifier sigAlgId; public RandomContentSigner(String sigAlgName) { this.sigAlgId = new DefaultSignatureAlgorithmIdentifierFinder().find(sigAlgName); } public AlgorithmIdentifier getAlgorithmIdentifier() { return sigAlgId; } public OutputStream getOutputStream() { return bos; } public byte[] getSignature() { try { bos.close(); } catch (IOException e) { } Random r = new Random(); byte[] sigBytes = new byte[SIG_LENGHT]; r.nextBytes(sigBytes); return sigBytes; } } public static final ASN1ObjectIdentifier FAKE_EXT_OID = new ASN1ObjectIdentifier("1.3.6.1.4.1.8005.100.120.82"); private X509Credential aaCredential; private ContentSigner signer; private ContentSigner getSigner(EnumSet<ACGenerationProperties> properties) { if (signer == null) { JcaContentSignerBuilder builder = new JcaContentSignerBuilder( aaCredential.getCertificate().getSigAlgName()); builder.setProvider(BouncyCastleProvider.PROVIDER_NAME); try { if (properties.contains(ACGenerationProperties.FAKE_SIGNATURE_BITS)) signer = new RandomContentSigner(aaCredential.getCertificate().getSigAlgName()); else signer = builder.build(aaCredential.getKey()); } catch (OperatorCreationException e) { throw new VOMSError(e.getMessage(), e); } } return signer; } public VOMSACGenerator(X509Credential aaCredential) { this.aaCredential = aaCredential; } private String buildVOURI(String voName, String host, int port) { return String.format("%s://%s:%d", voName, host, port); } private ASN1Encodable buildACCertsExtensionContent(EnumSet<ACGenerationProperties> properties) { ASN1EncodableVector issuerCertsContainer = new ASN1EncodableVector(); if (properties.contains(ACGenerationProperties.INCLUDE_EMPTY_AC_CERTS_EXTENSION)) issuerCertsContainer.add(new DERSequence()); else issuerCertsContainer.add(new DERSequence(getCertAsDEREncodable(aaCredential.getCertificate()))); return new DERSequence(issuerCertsContainer); } private AuthorityKeyIdentifier buildAuthorityKeyIdentifier() { byte[] authKeyId = aaCredential.getCertificate() .getExtensionValue(X509Extension.authorityKeyIdentifier.toString()); if (authKeyId != null) { return new AuthorityKeyIdentifier(authKeyId); } return null; } private ASN1Encodable buildFQANsAttributeContent(List<String> fqans, GeneralName policyAuthorityInfo) { ASN1EncodableVector container = new ASN1EncodableVector(); ASN1EncodableVector encodedFQANs = new ASN1EncodableVector(); // Policy authority info DERTaggedObject pai = new DERTaggedObject(0, policyAuthorityInfo); container.add(pai); for (String s : fqans) encodedFQANs.add(new DEROctetString(s.getBytes())); container.add(new DERSequence(encodedFQANs)); return new DERSequence(container); } private ASN1Encodable buildGAExtensionContent(EnumSet<ACGenerationProperties> properties, List<VOMSGenericAttribute> gas, GeneralName policyAuthorityInfo) { ASN1EncodableVector tagContainer = new ASN1EncodableVector(); ASN1EncodableVector tagSequences = new ASN1EncodableVector(); for (VOMSGenericAttribute a : gas) tagSequences.add(buildTagSequence(a)); tagContainer.add(new GeneralNames(policyAuthorityInfo)); tagContainer.add(new DERSequence(tagSequences)); DERSequence finalSequence; // We wrap this three times as VOMS core does, even if I think this // is a bug finalSequence = new DERSequence(new DERSequence(new DERSequence(tagContainer))); return finalSequence; } private AttributeCertificateHolder buildHolder(X509Certificate holderCert) throws CertificateEncodingException { JcaX509CertificateHolder holderWrappedCert = new JcaX509CertificateHolder(holderCert); AttributeCertificateHolder acHolder = new AttributeCertificateHolder(holderWrappedCert.getSubject(), holderCert.getSerialNumber()); return acHolder; } private AttributeCertificateIssuer buildIssuer() throws CertificateEncodingException { JcaX509CertificateHolder issuer = new JcaX509CertificateHolder(aaCredential.getCertificate()); return new AttributeCertificateIssuer(issuer.getSubject()); } private GeneralName buildPolicyAuthorityInfo(String voName, String host, int port) { return new GeneralName(GeneralName.uniformResourceIdentifier, buildVOURI(voName, host, port)); } private DERSequence buildTagSequence(VOMSGenericAttribute ga) { ASN1EncodableVector tagSequence = new ASN1EncodableVector(); tagSequence.add(getDEROctetString(ga.getName())); tagSequence.add(getDEROctetString(ga.getValue())); tagSequence.add(getDEROctetString(ga.getContext())); return new DERSequence(tagSequence); } private ASN1Encodable buildTargetsExtensionContent(EnumSet<ACGenerationProperties> properties, List<String> targets) { ASN1EncodableVector targetSeq = new ASN1EncodableVector(); for (String s : targets) { DERTaggedObject encodedTarget = new DERTaggedObject(0, new GeneralName(GeneralName.uniformResourceIdentifier, s)); // We wrap the target in another sequence as the old VOMS does targetSeq.add(new DERSequence(encodedTarget)); } DERSequence targetExtensionContent = new DERSequence(new DERSequence(targetSeq)); return targetExtensionContent; } public X509AttributeCertificateHolder generateVOMSAttributeCertificate(List<String> fqans, List<VOMSGenericAttribute> gas, List<String> targets, X509Certificate holderCert, BigInteger serialNumber, Date notBefore, Date notAfter, String voName, String host, int port) { return generateVOMSAttributeCertificate(defaultGenerationProperties, fqans, gas, targets, holderCert, serialNumber, notBefore, notAfter, voName, host, port); } public X509AttributeCertificateHolder generateVOMSAttributeCertificate( EnumSet<ACGenerationProperties> generationProperties, List<String> fqans, List<VOMSGenericAttribute> gas, List<String> targets, X509Certificate holderCert, BigInteger serialNumber, Date notBefore, Date notAfter, String voName, String host, int port) { AttributeCertificateHolder holder = null; AttributeCertificateIssuer issuer = null; try { holder = buildHolder(holderCert); issuer = buildIssuer(); } catch (CertificateEncodingException e) { throw new VOMSError(e.getMessage(), e); } X509v2AttributeCertificateBuilder builder = new X509v2AttributeCertificateBuilder(holder, issuer, serialNumber, notBefore, notAfter); GeneralName policyAuthorityInfo = buildPolicyAuthorityInfo(voName, host, port); builder.addAttribute(VOMS_FQANS_OID, buildFQANsAttributeContent(fqans, policyAuthorityInfo)); if (gas != null && !gas.isEmpty()) builder.addExtension(VOMS_GENERIC_ATTRS_OID, false, buildGAExtensionContent(generationProperties, gas, policyAuthorityInfo)); if (targets != null && !targets.isEmpty()) builder.addExtension(X509Extension.targetInformation, true, buildTargetsExtensionContent(generationProperties, targets)); if (!generationProperties.contains(ACGenerationProperties.SKIP_AC_CERTS_EXTENSION)) builder.addExtension(VOMS_CERTS_OID, false, buildACCertsExtensionContent(generationProperties)); if (generationProperties.contains(ACGenerationProperties.INCLUDE_FAKE_CRITICAL_EXTENSION)) builder.addExtension(FAKE_EXT_OID, true, new DERSequence()); boolean noRevAvailIsCritical = false; boolean akidIsCritical = false; if (generationProperties.contains(ACGenerationProperties.INCLUDE_CRITICAL_NO_REV_AVAIL_EXTENSION)) noRevAvailIsCritical = true; if (generationProperties.contains(ACGenerationProperties.INCLUDE_CRITICAL_AKID_EXTENSION)) akidIsCritical = true; builder.addExtension(X509Extension.noRevAvail, noRevAvailIsCritical, new DERNull()); AuthorityKeyIdentifier akid = buildAuthorityKeyIdentifier(); builder.addExtension(X509Extension.authorityKeyIdentifier, akidIsCritical, akid != null ? akid : new DERNull()); return builder.build(getSigner(generationProperties)); } public CertificateExtension generateVOMSExtension(List<X509AttributeCertificateHolder> acs) { ASN1EncodableVector vomsACs = new ASN1EncodableVector(); for (X509AttributeCertificateHolder ac : acs) vomsACs.add(ac.toASN1Structure()); DERSequence acSeq = new DERSequence(vomsACs); CertificateExtension ext = new CertificateExtension(VOMS_EXTENSION_OID.getId(), acSeq.toASN1Object(), false); return ext; } private DEREncodable getCertAsDEREncodable(X509Certificate cert) { try { byte[] certBytes = cert.getEncoded(); ByteArrayInputStream bais = new ByteArrayInputStream(certBytes); ASN1InputStream is = new ASN1InputStream(bais); DERObject derCert = is.readObject(); is.close(); return derCert; } catch (CertificateEncodingException e) { throw new VOMSError("Error encoding X509 certificate: " + e.getMessage(), e); } catch (IOException e) { throw new VOMSError("Error encoding X509 certificate: " + e.getMessage(), e); } } private DEROctetString getDEROctetString(String s) { return new DEROctetString(s.getBytes()); } }