Examples with X509ExtensionWrapper org.candlepin.pki.X509ExtensionWrapper used on opensource projects

Example 16 with X509ExtensionWrapper

use of org.candlepin.pki.X509ExtensionWrapper in project candlepin by candlepin.

the class BouncyCastlePKIUtility method createX509Certificate.

@Override
public X509Certificate createX509Certificate(String dn, Set<X509ExtensionWrapper> extensions, Set<X509ByteExtensionWrapper> byteExtensions, Date startDate, Date endDate, KeyPair clientKeyPair, BigInteger serialNumber, String alternateName) throws GeneralSecurityException, IOException {
    X509Certificate caCert = reader.getCACert();
    byte[] publicKeyEncoded = clientKeyPair.getPublic().getEncoded();
    X509v3CertificateBuilder certGen = new X509v3CertificateBuilder(X500Name.getInstance(caCert.getSubjectX500Principal().getEncoded()), serialNumber, startDate, endDate, new X500Name(dn), SubjectPublicKeyInfo.getInstance(publicKeyEncoded));
    // set key usage - required for proper x509 function
    KeyUsage keyUsage = new KeyUsage(KeyUsage.digitalSignature | KeyUsage.keyEncipherment | KeyUsage.dataEncipherment);
    // add SSL extensions - required for proper x509 function
    NetscapeCertType certType = new NetscapeCertType(NetscapeCertType.sslClient | NetscapeCertType.smime);
    certGen.addExtension(MiscObjectIdentifiers.netscapeCertType, false, certType);
    certGen.addExtension(Extension.keyUsage, false, keyUsage);
    JcaX509ExtensionUtils extensionUtil = new JcaX509ExtensionUtils();
    AuthorityKeyIdentifier aki = extensionUtil.createAuthorityKeyIdentifier(caCert);
    certGen.addExtension(Extension.authorityKeyIdentifier, false, aki.getEncoded());
    certGen.addExtension(Extension.subjectKeyIdentifier, false, subjectKeyWriter.getSubjectKeyIdentifier(clientKeyPair, extensions));
    certGen.addExtension(Extension.extendedKeyUsage, false, new ExtendedKeyUsage(KeyPurposeId.id_kp_clientAuth));
    // Add an additional alternative name if provided.
    if (alternateName != null) {
        /*
             Why add the certificate subject again as an alternative name?  RFC 6125 Section 6.4.4
             stipulates that if SANs are provided, a validator MUST use them instead of the certificate
             subject.  If no SANs are present, the RFC allows the validator to use the subject field.  So,
             if we do have an SAN to add, we need to add the subject field again as an SAN.

             See http://stackoverflow.com/questions/5935369 and
             https://tools.ietf.org/html/rfc6125#section-6.4.4 and

             NB: These extensions should *not* be marked critical since the subject field is not empty.
            */
        GeneralName subject = new GeneralName(GeneralName.directoryName, dn);
        GeneralName name = new GeneralName(GeneralName.directoryName, "CN=" + alternateName);
        ASN1Encodable[] altNameArray = { subject, name };
        GeneralNames altNames = GeneralNames.getInstance(new DERSequence(altNameArray));
        certGen.addExtension(Extension.subjectAlternativeName, false, altNames);
    }
    if (extensions != null) {
        for (X509ExtensionWrapper wrapper : extensions) {
            // Bouncycastle hates null values. So, set them to blank
            // if they are null
            String value = wrapper.getValue() == null ? "" : wrapper.getValue();
            certGen.addExtension(wrapper.toASN1Primitive(), wrapper.isCritical(), new DERUTF8String(value));
        }
    }
    if (byteExtensions != null) {
        for (X509ByteExtensionWrapper wrapper : byteExtensions) {
            // Bouncycastle hates null values. So, set them to blank
            // if they are null
            byte[] value = wrapper.getValue() == null ? new byte[0] : wrapper.getValue();
            certGen.addExtension(wrapper.toASN1Primitive(), wrapper.isCritical(), new DEROctetString(value));
        }
    }
    JcaContentSignerBuilder builder = new JcaContentSignerBuilder(SIGNATURE_ALGO).setProvider(BC_PROVIDER);
    ContentSigner signer;
    try {
        signer = builder.build(reader.getCaKey());
    } catch (OperatorCreationException e) {
        throw new IOException(e);
    }
    // Generate the certificate
    return new JcaX509CertificateConverter().getCertificate(certGen.build(signer));
}

Example 17 with X509ExtensionWrapper

use of org.candlepin.pki.X509ExtensionWrapper in project candlepin by candlepin.

the class DefaultEntitlementCertServiceAdapterTest method testPrepareV3EntitlementDataNoConsumerArch.

@Test
public void testPrepareV3EntitlementDataNoConsumerArch() throws IOException, GeneralSecurityException {
    Set<Product> products = new HashSet<>();
    products.add(product);
    setupEntitlements(null, "3.3");
    Set<X509ExtensionWrapper> extensions = certServiceAdapter.prepareV3Extensions();
    Map<String, X509ExtensionWrapper> map = new HashMap<>();
    for (X509ExtensionWrapper ext : extensions) {
        map.put(ext.getOid(), ext);
    }
    byte[] payload = v3extensionUtil.createEntitlementDataPayload(getProductModels(product, products, "prefix", entitlement), consumer, pool, entitlement.getQuantity());
    String stringValue = "";
    try {
        stringValue = processPayload(payload);
    } catch (Exception e) {
        throw new RuntimeException(e);
    }
    Map<String, Object> data = (Map<String, Object>) Util.fromJson(stringValue, Map.class);
    List<Map<String, Object>> prods = (List<Map<String, Object>>) data.get("products");
    List<Map<String, Object>> contents = null;
    for (Map<String, Object> prod : prods) {
        String arch = product.hasAttribute(Product.Attributes.ARCHITECTURE) ? product.getAttributeValue(Product.Attributes.ARCHITECTURE) : "";
        StringTokenizer st = new StringTokenizer(arch, ",");
        while (st.hasMoreElements()) {
            assertTrue(((List) prod.get("architectures")).contains(st.nextElement()));
        }
        contents = (List<Map<String, Object>>) prod.get("content");
        for (Map<String, Object> cont : contents) {
            assertEquals(cont.get("id"), CONTENT_ID);
            assertEquals(cont.get("path"), "prefix" + CONTENT_URL);
            assertFalse((Boolean) cont.get("enabled"));
            // since we dont know the consumer arch, we dont filter
            // any contents out
            List<String> arches = new ArrayList<>();
            arches.add(ARCH_LABEL);
            assertEquals(cont.get("arches"), arches);
        }
    }
}

Example 18 with X509ExtensionWrapper

use of org.candlepin.pki.X509ExtensionWrapper in project candlepin by candlepin.

the class DefaultEntitlementCertServiceAdapterTest method testPrepareV3EntitlementDataNoContentArch.

@Test
public void testPrepareV3EntitlementDataNoContentArch() throws IOException, GeneralSecurityException {
    Set<Product> products = new HashSet<>();
    // our content with no arch should inherit this arch
    Product inheritedArchProduct = TestUtil.createProduct("12345", "a product");
    inheritedArchProduct.setAttribute(Product.Attributes.VERSION, "version");
    inheritedArchProduct.setAttribute(Product.Attributes.VARIANT, "variant");
    inheritedArchProduct.setAttribute(Product.Attributes.TYPE, "SVC");
    inheritedArchProduct.setAttribute(Product.Attributes.ARCHITECTURE, ARCH_LABEL);
    inheritedArchProduct.addContent(noArchContent, false);
    products.add(inheritedArchProduct);
    setupEntitlements(ARCH_LABEL, "3.3");
    Set<X509ExtensionWrapper> extensions = certServiceAdapter.prepareV3Extensions();
    Map<String, X509ExtensionWrapper> map = new HashMap<>();
    for (X509ExtensionWrapper ext : extensions) {
        map.put(ext.getOid(), ext);
    }
    assertTrue(map.containsKey("1.3.6.1.4.1.2312.9.6"));
    assertEquals(map.get("1.3.6.1.4.1.2312.9.6").getValue(), ("3.3"));
    byte[] payload = v3extensionUtil.createEntitlementDataPayload(getProductModels(product, products, "prefix", entitlement), consumer, pool, entitlement.getQuantity());
    String stringValue = "";
    try {
        stringValue = processPayload(payload);
    } catch (Exception e) {
        throw new RuntimeException(e);
    }
    Map<String, Object> data = (Map<String, Object>) Util.fromJson(stringValue, Map.class);
    List<Map<String, Object>> prods = (List<Map<String, Object>>) data.get("products");
    List<Map<String, Object>> contents = null;
    for (Map<String, Object> prod : prods) {
        String arch = product.hasAttribute(Product.Attributes.ARCHITECTURE) ? product.getAttributeValue(Product.Attributes.ARCHITECTURE) : "";
        StringTokenizer st = new StringTokenizer(arch, ",");
        while (st.hasMoreElements()) {
            assertTrue(((List) prod.get("architectures")).contains(st.nextElement()));
        }
        contents = (List<Map<String, Object>>) prod.get("content");
        for (Map<String, Object> cont : contents) {
            // We dont set an arch on Content, but we inherit it
            // from product, so the arch should match ARCH_LABEL,
            // that the Product was created with
            List<String> arches = new ArrayList<>();
            arches.add(ARCH_LABEL);
            assertEquals(cont.get("arches"), arches);
        }
    }
}

Example 19 with X509ExtensionWrapper

use of org.candlepin.pki.X509ExtensionWrapper in project candlepin by candlepin.

the class X509ExtensionUtil method consumerExtensions.

public Set<X509ExtensionWrapper> consumerExtensions(Consumer consumer) {
    Set<X509ExtensionWrapper> toReturn = new LinkedHashSet<>();
    // 1.3.6.1.4.1.2312.9.5.1
    // REDHAT_OID here seems wrong...
    String consumerOid = OIDUtil.REDHAT_OID + "." + OIDUtil.TOPLEVEL_NAMESPACES.get(OIDUtil.SYSTEM_NAMESPACE_KEY);
    toReturn.add(new X509ExtensionWrapper(consumerOid + "." + OIDUtil.SYSTEM_OIDS.get(OIDUtil.UUID_KEY), false, consumer.getUuid()));
    return toReturn;
}

Example 20 with X509ExtensionWrapper

use of org.candlepin.pki.X509ExtensionWrapper in project candlepin by candlepin.

the class X509ExtensionUtil method productExtensions.

public Set<X509ExtensionWrapper> productExtensions(Product product) {
    Set<X509ExtensionWrapper> toReturn = new LinkedHashSet<>();
    String productCertOid = OIDUtil.REDHAT_OID + "." + OIDUtil.TOPLEVEL_NAMESPACES.get(OIDUtil.PRODUCT_CERT_NAMESPACE_KEY);
    // XXX need to deal with non hash style IDs
    String productOid = productCertOid + "." + product.getId();
    toReturn.add(new X509ExtensionWrapper(productOid + "." + OIDUtil.ORDER_PRODUCT_OIDS.get(OIDUtil.OP_NAME_KEY), false, product.getName()));
    String arch = product.getAttributeValue(Product.Attributes.ARCHITECTURE);
    toReturn.add(new X509ExtensionWrapper(productOid + "." + OIDUtil.ORDER_PRODUCT_OIDS.get(OIDUtil.OP_ARCH_KEY), false, arch != null ? arch : ""));
    String version = product.getAttributeValue(Product.Attributes.VERSION);
    toReturn.add(new X509ExtensionWrapper(productOid + "." + OIDUtil.ORDER_PRODUCT_OIDS.get(OIDUtil.OP_VERSION_KEY), false, version != null ? version : ""));
    String brandType = product.getAttributeValue(Product.Attributes.BRANDING_TYPE);
    toReturn.add(new X509ExtensionWrapper(productOid + "." + OIDUtil.ORDER_PRODUCT_OIDS.get(OIDUtil.OP_BRAND_TYPE_KEY), false, brandType != null ? brandType : ""));
    return toReturn;
}