MOA integration sign/verification (not finished yet ...)

Lots of PDF-AS Web implementation

2 files changed, 159 insertions, 41 deletions

diff --git a/signature-standards/sigs-pades/src/main/java/at/gv/egiz/pdfas/sigs/pades/PAdESSigner.java b/signature-standards/sigs-pades/src/main/java/at/gv/egiz/pdfas/sigs/pades/PAdESSigner.java
index 91237d98..7fc0081b 100644
--- a/signature-standards/sigs-pades/src/main/java/at/gv/egiz/pdfas/sigs/pades/PAdESSigner.java
+++ b/signature-standards/sigs-pades/src/main/java/at/gv/egiz/pdfas/sigs/pades/PAdESSigner.java
@@ -2,63 +2,32 @@ package at.gv.egiz.pdfas.sigs.pades;
 
 import iaik.x509.X509Certificate;
 
-import java.io.IOException;
-import java.security.cert.CertificateException;
-import java.util.Iterator;
-
-import org.apache.pdfbox.exceptions.SignatureException;
 import org.apache.pdfbox.pdmodel.interactive.digitalsignature.PDSignature;
 
 import at.gv.egiz.pdfas.common.exceptions.PdfAsException;
 import at.gv.egiz.pdfas.lib.api.sign.IPlainSigner;
-import at.gv.egiz.sl.CreateCMSSignatureRequestType;
-import at.gv.egiz.sl.CreateCMSSignatureResponseType;
-import at.gv.egiz.sl.InfoboxAssocArrayPairType;
-import at.gv.egiz.sl.InfoboxReadRequestType;
-import at.gv.egiz.sl.InfoboxReadResponseType;
-import at.gv.egiz.sl.util.BKUSLConnector;
+import at.gv.egiz.sl.util.ISignatureConnector;
+import at.gv.egiz.sl.util.ISignatureConnectorSLWrapper;
 import at.gv.egiz.sl.util.ISLConnector;
-import at.gv.egiz.sl.util.BaseSLConnector;
 
 public class PAdESSigner implements IPlainSigner {
 
-	private ISLConnector connector;
+	private ISignatureConnector plainSigner;
 	
 	public PAdESSigner(ISLConnector connector) {
-		this.connector = connector;
+		this.plainSigner = new ISignatureConnectorSLWrapper(connector);
+	}
+	
+	public PAdESSigner(ISignatureConnector signer) {
+		this.plainSigner = signer;
 	}
 
 	public X509Certificate getCertificate() throws PdfAsException {
-		X509Certificate certificate = null;
-		try {
-			InfoboxReadRequestType request = connector
-					.createInfoboxReadRequest();
-			InfoboxReadResponseType response = connector
-					.sendInfoboxReadRequest(request);
-
-			Iterator<InfoboxAssocArrayPairType> iterator = response
-					.getAssocArrayData().getPair().iterator();
-
-			while (iterator.hasNext()) {
-				InfoboxAssocArrayPairType pair = iterator.next();
-				if (pair.getKey().equals("SecureSignatureKeypair")) {
-					byte[] certData = pair.getBase64Content();
-					certificate = new X509Certificate(certData);
-					break;
-				}
-			}
-		} catch (CertificateException e) {
-			// TODO Auto-generated catch block
-			e.printStackTrace();
-		}
-		return certificate;
+		return this.plainSigner.getCertificate();
 	}
 
 	public byte[] sign(byte[] input, int[] byteRange) throws PdfAsException {
-		CreateCMSSignatureRequestType request = connector.createCMSRequest(input, byteRange);
-		CreateCMSSignatureResponseType response = connector.sendCMSRequest(request);
-		
-		return response.getCMSSignature();
+		return this.plainSigner.sign(input, byteRange);
 	}
 
 	public String getPDFSubFilter() {
diff --git a/signature-standards/sigs-pades/src/main/java/at/gv/egiz/pdfas/sigs/pades/PAdESVerifier.java b/signature-standards/sigs-pades/src/main/java/at/gv/egiz/pdfas/sigs/pades/PAdESVerifier.java
new file mode 100644
index 00000000..71b24213
--- /dev/null
+++ b/signature-standards/sigs-pades/src/main/java/at/gv/egiz/pdfas/sigs/pades/PAdESVerifier.java
@@ -0,0 +1,149 @@
+package at.gv.egiz.pdfas.sigs.pades;
+
+import iaik.security.ecc.provider.ECCProvider;
+import iaik.security.provider.IAIK;
+import iaik.x509.X509Certificate;
+
+import java.util.ArrayList;
+import java.util.List;
+
+import javax.activation.DataHandler;
+import javax.xml.bind.JAXBElement;
+
+import org.apache.axis2.databinding.types.Token;
+import org.apache.pdfbox.pdmodel.interactive.digitalsignature.PDSignature;
+
+import at.gv.egiz.dsig.X509DataType;
+import at.gv.egiz.dsig.util.DsigMarschaller;
+import at.gv.egiz.moa.ByteArrayDataSource;
+import at.gv.egiz.moa.SignatureVerificationServiceStub;
+import at.gv.egiz.moa.SignatureVerificationServiceStub.CMSContentBaseType;
+import at.gv.egiz.moa.SignatureVerificationServiceStub.CMSDataObjectOptionalMetaType;
+import at.gv.egiz.moa.SignatureVerificationServiceStub.KeyInfoTypeChoice;
+import at.gv.egiz.moa.SignatureVerificationServiceStub.VerifyCMSSignatureRequest;
+import at.gv.egiz.moa.SignatureVerificationServiceStub.VerifyCMSSignatureResponse;
+import at.gv.egiz.moa.SignatureVerificationServiceStub.VerifyCMSSignatureResponseTypeSequence;
+import at.gv.egiz.pdfas.common.exceptions.PdfAsException;
+import at.gv.egiz.pdfas.lib.api.Configuration;
+import at.gv.egiz.pdfas.lib.api.verify.SignatureCheck;
+import at.gv.egiz.pdfas.lib.api.verify.VerifyResult;
+import at.gv.egiz.pdfas.lib.impl.verify.FilterEntry;
+import at.gv.egiz.pdfas.lib.impl.verify.IVerifyFilter;
+import at.gv.egiz.pdfas.lib.impl.verify.SignatureCheckImpl;
+import at.gv.egiz.pdfas.lib.impl.verify.VerifyResultImpl;
+
+public class PAdESVerifier  implements IVerifyFilter  {
+
+	private static final String MOA_VERIFY_URL = "moa.verify.url";
+	private static final String MOA_VERIFY_TRUSTPROFILE = "moa.verify.TrustProfileID";
+	
+	private String moaEndpoint;
+	private String moaTrustProfile;
+	
+	public PAdESVerifier(Configuration config) {
+		IAIK.getInstance();
+		ECCProvider.addAsProvider();
+		this.moaEndpoint = config.getValue(MOA_VERIFY_URL);
+		this.moaTrustProfile = config.getValue(MOA_VERIFY_TRUSTPROFILE);
+	}
+	
+	@SuppressWarnings("rawtypes")
+	public List<VerifyResult> verify(byte[] contentData, byte[] signatureContent)
+			throws PdfAsException {
+
+		List<VerifyResult> resultList = new ArrayList<VerifyResult>();
+		try {
+			SignatureVerificationServiceStub service = new SignatureVerificationServiceStub(
+					this.moaEndpoint);
+			VerifyCMSSignatureRequest verifyCMSSignatureRequest = new VerifyCMSSignatureRequest();
+			Token token = new Token();
+			token.setValue(this.moaTrustProfile);
+			verifyCMSSignatureRequest.setTrustProfileID(token);
+
+			byte[] data = contentData;
+			byte[] signature = signatureContent;
+
+			CMSDataObjectOptionalMetaType cmsDataObjectOptionalMetaType = new CMSDataObjectOptionalMetaType();
+			CMSContentBaseType cmsDataContent = new CMSContentBaseType();
+			cmsDataContent.setBase64Content(new DataHandler(
+					new ByteArrayDataSource(data, "application/pdf")));
+			DataHandler cmsSignature = new DataHandler(new ByteArrayDataSource(
+					signature, "application/pdf"));
+			cmsDataObjectOptionalMetaType.setContent(cmsDataContent);
+			verifyCMSSignatureRequest.setCMSSignature(cmsSignature);
+			verifyCMSSignatureRequest
+					.setDataObject(cmsDataObjectOptionalMetaType);
+			
+			// cmsDataObjectOptionalMetaType.
+			VerifyCMSSignatureResponse response = service
+					.verifyCMSSignature(verifyCMSSignatureRequest);
+			
+			VerifyCMSSignatureResponseTypeSequence[] verifySequence = response.getVerifyCMSSignatureResponse().getVerifyCMSSignatureResponseTypeSequence();
+			for(int i = 0 ; i < verifySequence.length; i++) {
+				VerifyResultImpl result = new VerifyResultImpl();
+				
+				SignatureCheck certificateCheck;
+				
+				 verifySequence[i].getSignerInfo().getKeyInfoTypeChoice()[0].getExtraElement();
+				if(verifySequence[i].getCertificateCheck() != null) {
+					certificateCheck = new SignatureCheckImpl(
+						verifySequence[i].getCertificateCheck().getCode().intValue(),
+						verifySequence[i].getCertificateCheck().isInfoSpecified() ?
+						verifySequence[i].getCertificateCheck().getInfo().toString() : 
+							"");
+				} else {
+					certificateCheck = new SignatureCheckImpl(
+							1,
+							"Es konnte keine formal korrekte Zertifikatskette vom Signatorzertifikat zu einem vertrauenswürdigen Wurzelzertifikat konstruiert werden.");
+				}
+				
+				
+				SignatureCheck signatureCheck = new SignatureCheckImpl(
+						verifySequence[i].getSignatureCheck().getCode().intValue(),
+						verifySequence[i].getSignatureCheck().isInfoSpecified() ?
+								verifySequence[i].getSignatureCheck().getInfo().toString() : 
+									"");
+				
+				result.setCertificateCheck(certificateCheck);
+				result.setValueCheckCode(signatureCheck);
+				result.setVerificationDone(true);
+				
+				KeyInfoTypeChoice[] keyInfo = verifySequence[i].getSignerInfo().getKeyInfoTypeChoice();
+				String xmldisg = keyInfo[0].getExtraElement().toString();
+				JAXBElement jaxbElement = (JAXBElement) DsigMarschaller.unmarshalFromString(xmldisg);
+				result.setSignatureData(signatureContent);
+				if(jaxbElement.getValue() instanceof X509DataType) {
+					X509DataType x509Data = (X509DataType)jaxbElement.getValue();
+					List<Object> dsigElements = x509Data.getX509IssuerSerialOrX509SKIOrX509SubjectName();
+					for(int j = 0; j < dsigElements.size(); j++) {
+						Object jaxElement = dsigElements.get(j);
+						if(jaxElement instanceof JAXBElement) {
+							JAXBElement jaxbElementMember = (JAXBElement)jaxElement;
+							if(jaxbElementMember.getName().equals(
+									DsigMarschaller.X509DataTypeX509Certificate_QNAME)) {
+								if(jaxbElementMember.getValue() instanceof byte[]) {
+									byte[] certData = (byte[])jaxbElementMember.getValue();
+									X509Certificate certificate = new X509Certificate(certData);
+									result.setSignerCertificate(certificate);
+									break;
+								}
+							}
+						}
+					}
+				}
+
+				resultList.add(result);
+			}
+		} catch (Throwable e) {
+			e.printStackTrace();
+		}
+		return resultList;
+	}
+
+	public List<FilterEntry> getFiters() {
+		List<FilterEntry> result = new ArrayList<FilterEntry>();
+		result.add(new FilterEntry(PDSignature.FILTER_ADOBE_PPKLITE, PDSignature.SUBFILTER_ADBE_PKCS7_DETACHED));
+		return result;
+	}
+
+}