From 9662ac90b6aa84bc54543d3c8670ba6c8e42bbac Mon Sep 17 00:00:00 2001 From: clemenso Date: Thu, 13 Nov 2008 18:24:57 +0000 Subject: FRAME HashDataDisplay FRAME Help git-svn-id: https://joinup.ec.europa.eu/svn/mocca/trunk@165 8a26b1a7-26f0-462f-b9ef-d0e30c41f5a4 --- .../bku/online/applet/AppletHashDataDisplay.java | 217 +++++++++++++-------- 1 file changed, 133 insertions(+), 84 deletions(-) (limited to 'BKUApplet/src/main/java/at/gv/egiz/bku/online/applet/AppletHashDataDisplay.java') diff --git a/BKUApplet/src/main/java/at/gv/egiz/bku/online/applet/AppletHashDataDisplay.java b/BKUApplet/src/main/java/at/gv/egiz/bku/online/applet/AppletHashDataDisplay.java index b77485d9..29a60f1d 100644 --- a/BKUApplet/src/main/java/at/gv/egiz/bku/online/applet/AppletHashDataDisplay.java +++ b/BKUApplet/src/main/java/at/gv/egiz/bku/online/applet/AppletHashDataDisplay.java @@ -14,9 +14,9 @@ * See the License for the specific language governing permissions and * limitations under the License. */ - package at.gv.egiz.bku.online.applet; +import at.gv.egiz.bku.gui.BKUGUIFacade; import java.security.DigestException; import java.security.MessageDigest; import java.util.ArrayList; @@ -30,39 +30,69 @@ import org.apache.commons.logging.LogFactory; import at.gv.egiz.bku.smccstal.SignRequestHandler; import at.gv.egiz.stal.HashDataInput; import at.gv.egiz.stal.impl.ByteArrayHashDataInput; +import at.gv.egiz.stal.service.GetHashDataInputFault; import at.gv.egiz.stal.service.STALPortType; import at.gv.egiz.stal.service.types.GetHashDataInputResponseType; import at.gv.egiz.stal.service.types.GetHashDataInputType; import at.gv.egiz.stal.signedinfo.DigestMethodType; import at.gv.egiz.stal.signedinfo.ReferenceType; +import java.security.NoSuchAlgorithmException; /** - * A SignRequesthandler displaying hashdata inputs in the applet - * (only plaintext data is displayed, other hashdata inputs may be saved to disk). + * A SignRequesthandler that obtains hashdata inputs from a STAL webservice and + * displays these either within the applet or in a separate frame. + * The internal viewer displays plaintext data only, other mimetypes can be saved to disk. + * The standalone (frame) viewer displays all mimetypes. + * + * (This class depends on STALService and therefore is not part of BKUCommonGUI.) * * @author Clemens Orthacker */ public class AppletHashDataDisplay extends SignRequestHandler { + public static enum DISPLAY { + applet, frame + } private static final Log log = LogFactory.getLog(AppletHashDataDisplay.class); - STALPortType stalPort; - String sessId; + protected STALPortType stalPort; + protected String sessId; + protected DISPLAY display; - public AppletHashDataDisplay(STALPortType stalPort, String sessId) { + public AppletHashDataDisplay(STALPortType stalPort, String sessId, DISPLAY display) { if (stalPort == null || sessId == null) { throw new NullPointerException("STAL port must not be null"); } this.sessId = sessId; this.stalPort = stalPort; + this.display = display; } @Override - public void displayHashDataInputs(List signedReferences) throws Exception { - + public void displayHashDataInputs(List signedReferences) throws DigestException, Exception { + + List hdi = getHashDataInput(signedReferences); + List verifiedHashDataInputs = verifyHashDataInput(signedReferences, hdi); + + if (verifiedHashDataInputs.size() > 1) { + gui.showHashDataInputDialog(verifiedHashDataInputs, false, this, "ok"); + } else if (verifiedHashDataInputs.size() == 1) { + gui.showHashDataInputDialog(verifiedHashDataInputs, display==DISPLAY.frame, this, "ok"); + } else { + throw new Exception("No signature data (apart from any QualifyingProperties or a Manifest)"); + } + } + + /** + * Get all hashdata inputs that contain an ID attribute but no Type attribute. + * @param signedReferences + * @return + * @throws at.gv.egiz.stal.service.GetHashDataInputFault + */ + private List getHashDataInput(List signedReferences) throws GetHashDataInputFault, Exception { GetHashDataInputType request = new GetHashDataInputType(); request.setSessionId(sessId); - HashMap idSignedRefMap = new HashMap(); +// HashMap idSignedRefMap = new HashMap(); for (ReferenceType signedRef : signedReferences) { //don't get Manifest, QualifyingProperties, ... if (signedRef.getType() == null) { @@ -71,97 +101,116 @@ public class AppletHashDataDisplay extends SignRequestHandler { if (log.isTraceEnabled()) { log.trace("requesting hashdata input for reference " + signedRefId); } - idSignedRefMap.put(signedRefId, signedRef); +// idSignedRefMap.put(signedRefId, signedRef); GetHashDataInputType.Reference ref = new GetHashDataInputType.Reference(); ref.setID(signedRefId); request.getReference().add(ref); } else { - throw new Exception("Cannot resolve HashDataInput for reference without Id attribute"); + throw new Exception("Cannot resolve signature data for dsig:Reference without Id attribute"); } } } if (log.isDebugEnabled()) { - log.debug("Calling GetHashDataInput for " + request.getReference().size() + " references in session " + sessId); + log.debug("WebService call GetHashDataInput for " + request.getReference().size() + " references in session " + sessId); } GetHashDataInputResponseType response = stalPort.getHashDataInput(request); - ArrayList hashDataInputs = new ArrayList(); - - //hashdata inputs returned from service - HashMap idRefMap = new HashMap(); - for (GetHashDataInputResponseType.Reference reference : response.getReference()) { - String id = reference.getID(); - byte[] hdi = reference.getValue(); - if (hdi == null) { - throw new Exception("Did not receive hashdata input for reference " + id); + return response.getReference(); + } + + /** + * Verifies all signed references and returns STAL HashDataInputs + * @param signedReferences + * @param hashDataInputs + * @return + * @throws java.security.DigestException + * @throws java.security.NoSuchAlgorithmException + * @throws Exception if no hashdata input is provided for a signed reference + */ + private List verifyHashDataInput(List signedReferences, List hashDataInputs) throws DigestException, NoSuchAlgorithmException, Exception { + + ArrayList verifiedHashDataInputs = new ArrayList(); + + for (ReferenceType signedRef : signedReferences) { + if (signedRef.getType() == null) { + log.info("Verifying digest for signed reference " + signedRef.getId()); + + String signedRefId = signedRef.getId(); + byte[] signedDigest = signedRef.getDigestValue(); + String signedDigestAlg = null; + if (signedRef.getDigestMethod() != null) { + signedDigestAlg = signedRef.getDigestMethod().getAlgorithm(); + } else { + throw new NoSuchAlgorithmException("Failed to verify digest value for reference " + signedRefId + ": no digest algorithm"); + } + + // usually, there is just one item here + GetHashDataInputResponseType.Reference hashDataInput = null; + for (GetHashDataInputResponseType.Reference hdi : hashDataInputs) { + if (signedRefId.equals(hdi.getID())) { + hashDataInput = hdi; + break; + } + } + if (hashDataInput == null) { + throw new Exception("No hashdata input for reference " + signedRefId + " returned by service"); + } + + byte[] hdi = hashDataInput.getValue(); + String mimeType = hashDataInput.getMimeType(); + String encoding = hashDataInput.getEncoding(); + + if (hdi == null) { + throw new Exception("No hashdata input for reference " + signedRefId + " provided by service"); + } + if (log.isDebugEnabled()) { + log.debug("Got HashDataInput " + signedRefId + " (" + mimeType + ";" + encoding + ")"); + } + + byte[] hashDataInputDigest = digest(hdi, signedDigestAlg); + + if (log.isDebugEnabled()) { + log.debug("Comparing digest values... "); + } +// log.warn("***************** DISABLED HASHDATA VERIFICATION"); + if (!Arrays.equals(hashDataInputDigest, signedDigest)) { + log.error("Bad digest value for reference " + signedRefId); + throw new DigestException("Bad digest value for reference " + signedRefId); + } + + verifiedHashDataInputs.add(new ByteArrayHashDataInput(hdi, signedRefId, mimeType, encoding)); } - idRefMap.put(id, reference); } - for (String signedRefId : idSignedRefMap.keySet()) { - log.info("validating hashdata input for reference " + signedRefId); - - GetHashDataInputResponseType.Reference reference = idRefMap.get(signedRefId); - if (reference == null) { - throw new Exception("No hashdata input for reference " + signedRefId + " returned by service"); - } - -// } -// -// for (GetHashDataInputResponseType.Reference reference : response.getReference()) { -// -// String id = reference.getID(); - byte[] hdi = reference.getValue(); - String mimeType = reference.getMimeType(); - String encoding = reference.getEncoding(); - - if (hdi == null) { - throw new Exception("No hashdata input provided for reference " + signedRefId); - } - if (log.isDebugEnabled()) { - log.debug("Got HashDataInput " + signedRefId + " (" + mimeType + ";" + encoding + ")"); - } + return verifiedHashDataInputs; + } - ReferenceType dsigRef = idSignedRefMap.get(signedRefId); - DigestMethodType dm = dsigRef.getDigestMethod(); - - if (dm == null) { - throw new Exception("Failed to verify digest value for reference " + signedRefId + ": no digest algorithm"); - } - String mdAlg = dm.getAlgorithm(); - if ("http://www.w3.org/2000/09/xmldsig#sha1".equals(mdAlg)) - mdAlg = "SHA-1"; - else if ("http://www.w3.org/2001/04/xmlenc#sha256".equals(mdAlg)) - mdAlg = "SHA-256"; - else if ("http://www.w3.org/2001/04/xmlenc#sha224 ".equals(mdAlg)) - mdAlg = "SHA-224"; - else if ("http://www.w3.org/2001/04/xmldsig-more#sha224 ".equals(mdAlg)) - mdAlg = "SHA-224"; - else if ("http://www.w3.org/2001/04/xmldsig-more#sha384".equals(mdAlg)) - mdAlg = "SHA-384"; - else if ("http://www.w3.org/2001/04/xmlenc#sha512".equals(mdAlg)) - mdAlg = "SHA-512"; - else if ("http://www.w3.org/2001/04/xmldsig-more#md2 ".equals(mdAlg)) - mdAlg = "MD2"; - else if ("http://www.w3.org/2001/04/xmldsig-more#md5".equals(mdAlg)) - mdAlg = "MD5"; - else if ("http://www.w3.org/2001/04/xmlenc#ripemd160 ".equals(mdAlg)) - mdAlg = "RipeMD-160"; - else { - throw new Exception("Failed to verify digest value for reference " + signedRefId + ": unsupported digest algorithm " + mdAlg); - } - MessageDigest md = MessageDigest.getInstance(mdAlg); - byte[] hdiDigest = md.digest(hdi); - if (log.isDebugEnabled()) - log.debug("Comparing digest values... "); - if (!Arrays.equals(hdiDigest, dsigRef.getDigestValue())) { - log.error("digest values differ: " + new String(hdiDigest) + ", " + new String(dsigRef.getDigestValue())); - throw new DigestException("Bad digest value for reference " + signedRefId + ": " + new String(dsigRef.getDigestValue())); - } - hashDataInputs.add(new ByteArrayHashDataInput(hdi, signedRefId, mimeType, encoding)); + //TODO + private byte[] digest(byte[] hashDataInput, String mdAlg) throws NoSuchAlgorithmException { + if ("http://www.w3.org/2000/09/xmldsig#sha1".equals(mdAlg)) { + mdAlg = "SHA-1"; + } else if ("http://www.w3.org/2001/04/xmlenc#sha256".equals(mdAlg)) { + mdAlg = "SHA-256"; + } else if ("http://www.w3.org/2001/04/xmlenc#sha224".equals(mdAlg)) { + mdAlg = "SHA-224"; + } else if ("http://www.w3.org/2001/04/xmldsig-more#sha224".equals(mdAlg)) { + mdAlg = "SHA-224"; + } else if ("http://www.w3.org/2001/04/xmldsig-more#sha384".equals(mdAlg)) { + mdAlg = "SHA-384"; + } else if ("http://www.w3.org/2001/04/xmlenc#sha512".equals(mdAlg)) { + mdAlg = "SHA-512"; + } else if ("http://www.w3.org/2001/04/xmldsig-more#md2".equals(mdAlg)) { + mdAlg = "MD2"; + } else if ("http://www.w3.org/2001/04/xmldsig-more#md5".equals(mdAlg)) { + mdAlg = "MD5"; + } else if ("http://www.w3.org/2001/04/xmlenc#ripemd160".equals(mdAlg)) { + mdAlg = "RipeMD-160"; + } else { + throw new NoSuchAlgorithmException("Failed to verify digest value: unsupported digest algorithm " + mdAlg); } - - gui.showHashDataInputDialog(hashDataInputs, false, this, "ok"); + + MessageDigest md = MessageDigest.getInstance(mdAlg); + return md.digest(hashDataInput); } } -- cgit v1.2.3