| /* |
| * Licensed to the Apache Software Foundation (ASF) under one |
| * or more contributor license agreements. See the NOTICE file |
| * distributed with this work for additional information |
| * regarding copyright ownership. The ASF licenses this file |
| * to you under the Apache License, Version 2.0 (the |
| * "License"); you may not use this file except in compliance |
| * with the License. You may obtain a copy of the License at |
| * |
| * http://www.apache.org/licenses/LICENSE-2.0 |
| * |
| * Unless required by applicable law or agreed to in writing, |
| * software distributed under the License is distributed on an |
| * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY |
| * KIND, either express or implied. See the License for the |
| * specific language governing permissions and limitations |
| * under the License. |
| */ |
| package org.apache.felix.deploymentadmin.itest.util; |
| |
| import java.io.ByteArrayOutputStream; |
| import java.io.DataOutputStream; |
| import java.io.IOException; |
| import java.io.InputStream; |
| import java.io.OutputStream; |
| import java.lang.reflect.InvocationTargetException; |
| import java.lang.reflect.Method; |
| import java.security.Key; |
| import java.security.MessageDigest; |
| import java.security.NoSuchAlgorithmException; |
| import java.security.PrivateKey; |
| import java.security.cert.X509Certificate; |
| import java.security.interfaces.DSAKey; |
| import java.security.interfaces.ECKey; |
| import java.security.interfaces.RSAKey; |
| import java.util.Arrays; |
| import java.util.List; |
| import java.util.Map; |
| import java.util.Map.Entry; |
| import java.util.jar.Attributes; |
| import java.util.jar.JarFile; |
| import java.util.jar.Manifest; |
| import java.util.zip.ZipEntry; |
| import java.util.zip.ZipOutputStream; |
| |
| import org.apache.commons.codec.binary.Base64; |
| import org.bouncycastle.cert.jcajce.JcaCertStore; |
| import org.bouncycastle.cms.CMSProcessableByteArray; |
| import org.bouncycastle.cms.CMSSignedData; |
| import org.bouncycastle.cms.CMSSignedDataGenerator; |
| import org.bouncycastle.cms.jcajce.JcaSignerInfoGeneratorBuilder; |
| import org.bouncycastle.operator.ContentSigner; |
| import org.bouncycastle.operator.DigestCalculatorProvider; |
| import org.bouncycastle.operator.jcajce.JcaContentSignerBuilder; |
| import org.bouncycastle.operator.jcajce.JcaDigestCalculatorProviderBuilder; |
| |
| /** |
| * Signs a deployment package using a given keypair. |
| */ |
| public class DPSigner { |
| private static final String META_INF = "META-INF/"; |
| |
| public static String getSignatureAlgorithm(Key key) { |
| if (key instanceof RSAKey) { |
| return "SHA256withRSA"; |
| } |
| else if (key instanceof DSAKey) { |
| return "SHA1withDSA"; |
| } |
| else if (key instanceof ECKey) { |
| return "SHA256withECDSA"; |
| } |
| else { |
| throw new IllegalArgumentException("Invalid/unsupported key: " + key.getClass().getName()); |
| } |
| } |
| private static String getBlockFileExtension(Key key) { |
| if (key instanceof RSAKey) { |
| return ".RSA"; |
| } |
| else if (key instanceof DSAKey) { |
| return ".DSA"; |
| } |
| else if (key instanceof ECKey) { |
| return ".EC"; |
| } |
| else { |
| throw new IllegalArgumentException("Invalid/unsupported key: " + key.getClass().getName()); |
| } |
| } |
| private final MessageDigest m_digest; |
| |
| private final String m_digestAlg; |
| |
| private final String m_baseName; |
| |
| public DPSigner() { |
| this("DP"); |
| } |
| |
| public DPSigner(String baseName) { |
| try { |
| m_baseName = META_INF.concat(baseName); |
| m_digest = MessageDigest.getInstance("SHA-256"); |
| m_digestAlg = m_digest.getAlgorithm(); |
| } |
| catch (NoSuchAlgorithmException e) { |
| throw new RuntimeException("SHA-256 not supported by default?!"); |
| } |
| } |
| |
| public void addDigestAttribute(Attributes attrs, ArtifactData file) throws IOException { |
| attrs.putValue(m_digestAlg.concat("-Digest"), calculateDigest(file)); |
| } |
| |
| public void sign(DeploymentPackageBuilder builder, PrivateKey privKey, X509Certificate cert, OutputStream os) throws Exception { |
| Manifest manifest = builder.createManifest(); |
| List<ArtifactData> artifacts = builder.getArtifactList(); |
| sign(manifest, artifacts, privKey, cert, os); |
| } |
| |
| public void sign(Manifest manifest, List<ArtifactData> files, PrivateKey privKey, X509Certificate cert, OutputStream os) throws Exception { |
| // For each file, add its signature to the manifest |
| for (ArtifactData file : files) { |
| String filename = file.getFilename(); |
| Attributes attrs = manifest.getAttributes(filename); |
| addDigestAttribute(attrs, file); |
| } |
| |
| try (ZipOutputStream zos = new ZipOutputStream(os)) { |
| writeSignedManifest(manifest, zos, privKey, cert); |
| |
| for (ArtifactData file : files) { |
| ZipEntry entry = new ZipEntry(file.getFilename()); |
| zos.putNextEntry(entry); |
| |
| try (InputStream is = file.createInputStream()) { |
| byte[] buf = new byte[1024]; |
| int read; |
| while ((read = is.read(buf)) > 0) { |
| zos.write(buf, 0, read); |
| } |
| } |
| } |
| } |
| } |
| |
| public void writeSignedManifest(Manifest manifest, ZipOutputStream zos, PrivateKey privKey, X509Certificate cert) throws Exception { |
| zos.putNextEntry(new ZipEntry(JarFile.MANIFEST_NAME)); |
| manifest.write(zos); |
| zos.closeEntry(); |
| |
| long now = System.currentTimeMillis(); |
| |
| // Determine the signature-file manifest... |
| Manifest sf = createSignatureFile(manifest); |
| |
| byte[] sfRawBytes; |
| try (ByteArrayOutputStream baos = new ByteArrayOutputStream()) { |
| sf.write(baos); |
| sfRawBytes = baos.toByteArray(); |
| } |
| |
| ZipEntry sigFileEntry = new ZipEntry(m_baseName.concat(".SF")); |
| sigFileEntry.setTime(now); |
| zos.putNextEntry(sigFileEntry); |
| // Write the actual entry data... |
| zos.write(sfRawBytes, 0, sfRawBytes.length); |
| zos.closeEntry(); |
| |
| // Create a PKCS#7 signature... |
| byte[] encoded = calculateSignatureBlock(privKey, cert, sfRawBytes); |
| |
| ZipEntry blockFileEntry = new ZipEntry(m_baseName.concat(getBlockFileExtension(privKey))); |
| blockFileEntry.setTime(now); |
| zos.putNextEntry(blockFileEntry); |
| zos.write(encoded); |
| zos.closeEntry(); |
| } |
| |
| private String calculateDigest(ArtifactData file) throws IOException { |
| m_digest.reset(); |
| try (InputStream is = file.createInputStream()) { |
| byte[] buffer = new byte[1024]; |
| int read; |
| while ((read = is.read(buffer)) > 0) { |
| m_digest.update(buffer, 0, read); |
| } |
| } |
| return Base64.encodeBase64String(m_digest.digest()); |
| } |
| |
| private String calculateDigest(byte[] rawData) throws IOException { |
| m_digest.reset(); |
| m_digest.update(rawData, 0, rawData.length); |
| return Base64.encodeBase64String(m_digest.digest()); |
| } |
| |
| private byte[] calculateSignatureBlock(PrivateKey privKey, X509Certificate cert, byte[] sfRawBytes) throws Exception { |
| String signatureAlgorithm = getSignatureAlgorithm(privKey); |
| |
| DigestCalculatorProvider digestCalculatorProvider = new JcaDigestCalculatorProviderBuilder().build(); |
| ContentSigner signer = new JcaContentSignerBuilder(signatureAlgorithm).build(privKey); |
| |
| CMSSignedDataGenerator gen = new CMSSignedDataGenerator(); |
| gen.addSignerInfoGenerator(new JcaSignerInfoGeneratorBuilder(digestCalculatorProvider).build(signer, cert)); |
| gen.addCertificates(new JcaCertStore(Arrays.asList(cert))); |
| |
| CMSSignedData sigData = gen.generate(new CMSProcessableByteArray(sfRawBytes)); |
| |
| return sigData.getEncoded(); |
| } |
| |
| private Manifest createSignatureFile(Manifest manifest) throws IOException { |
| byte[] mfRawBytes; |
| try (ByteArrayOutputStream baos = new ByteArrayOutputStream()) { |
| manifest.write(baos); |
| mfRawBytes = baos.toByteArray(); |
| } |
| |
| Manifest sf = new Manifest(); |
| Attributes sfMain = sf.getMainAttributes(); |
| Map<String, Attributes> sfEntries = sf.getEntries(); |
| |
| sfMain.put(Attributes.Name.SIGNATURE_VERSION, "1.0"); |
| sfMain.putValue("Created-By", "Apache Felix DeploymentPackageBuilder"); |
| sfMain.putValue(m_digestAlg + "-Digest-Manifest", calculateDigest(mfRawBytes)); |
| sfMain.putValue(m_digestAlg + "-Digest-Manifest-Main-Attribute", calculateDigest(getRawBytesMainAttributes(manifest))); |
| |
| for (Entry<String, Attributes> entry : manifest.getEntries().entrySet()) { |
| String name = entry.getKey(); |
| byte[] entryData = getRawBytesAttributes(entry.getValue()); |
| |
| sfEntries.put(name, getDigestAttributes(entryData)); |
| } |
| return sf; |
| } |
| |
| private Attributes getDigestAttributes(byte[] rawData) throws IOException { |
| Attributes attrs = new Attributes(); |
| attrs.putValue(m_digestAlg + "-Digest", calculateDigest(rawData)); |
| return attrs; |
| } |
| |
| private byte[] getRawBytesAttributes(Attributes attrs) throws IOException { |
| try (ByteArrayOutputStream baos = new ByteArrayOutputStream(); DataOutputStream dos = new DataOutputStream(baos)) { |
| |
| Method m = Attributes.class.getDeclaredMethod("write", DataOutputStream.class); |
| m.setAccessible(true); |
| m.invoke(attrs, dos); |
| |
| return baos.toByteArray(); |
| } |
| catch (NoSuchMethodException | SecurityException | InvocationTargetException | IllegalAccessException e) { |
| throw new RuntimeException("Failed to get raw bytes of main attributes!", e); |
| } |
| } |
| |
| private byte[] getRawBytesMainAttributes(Manifest manifest) throws IOException { |
| try (ByteArrayOutputStream baos = new ByteArrayOutputStream(); DataOutputStream dos = new DataOutputStream(baos)) { |
| Attributes attrs = manifest.getMainAttributes(); |
| |
| Method m = Attributes.class.getDeclaredMethod("writeMain", DataOutputStream.class); |
| m.setAccessible(true); |
| m.invoke(attrs, dos); |
| |
| return baos.toByteArray(); |
| } |
| catch (NoSuchMethodException | SecurityException | InvocationTargetException | IllegalAccessException e) { |
| throw new RuntimeException("Failed to get raw bytes of main attributes!", e); |
| } |
| } |
| } |