2015-06-01 08:19:09 -07:00
|
|
|
/*******************************************************************************
|
2017-07-20 12:06:26 -07:00
|
|
|
* The MIT License (MIT)
|
2015-06-01 08:19:09 -07:00
|
|
|
*
|
2017-07-20 12:06:26 -07:00
|
|
|
* Copyright (c) 2015-207 V2G Clarity (Dr.-Ing. Marc Mültin)
|
|
|
|
*
|
|
|
|
* Permission is hereby granted, free of charge, to any person obtaining a copy
|
|
|
|
* of this software and associated documentation files (the "Software"), to deal
|
|
|
|
* in the Software without restriction, including without limitation the rights
|
|
|
|
* to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
|
|
|
|
* copies of the Software, and to permit persons to whom the Software is
|
|
|
|
* furnished to do so, subject to the following conditions:
|
|
|
|
*
|
|
|
|
* The above copyright notice and this permission notice shall be included in
|
|
|
|
* all copies or substantial portions of the Software.
|
|
|
|
*
|
|
|
|
* THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
|
|
|
|
* IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
|
|
|
|
* FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
|
|
|
|
* AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
|
|
|
|
* LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
|
|
|
|
* OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
|
|
|
|
* THE SOFTWARE.
|
2015-06-01 08:19:09 -07:00
|
|
|
*******************************************************************************/
|
2017-10-13 03:30:15 -07:00
|
|
|
package com.v2gclarity.risev2g.secc.states;
|
2015-06-01 08:19:09 -07:00
|
|
|
|
|
|
|
import java.security.KeyPair;
|
|
|
|
import java.security.interfaces.ECPublicKey;
|
|
|
|
import java.util.HashMap;
|
2017-10-13 03:30:15 -07:00
|
|
|
|
|
|
|
import com.v2gclarity.risev2g.secc.session.V2GCommunicationSessionSECC;
|
|
|
|
import com.v2gclarity.risev2g.shared.enumerations.GlobalValues;
|
|
|
|
import com.v2gclarity.risev2g.shared.enumerations.PKI;
|
|
|
|
import com.v2gclarity.risev2g.shared.enumerations.V2GMessages;
|
|
|
|
import com.v2gclarity.risev2g.shared.messageHandling.ReactionToIncomingMessage;
|
|
|
|
import com.v2gclarity.risev2g.shared.utils.SecurityUtils;
|
|
|
|
import com.v2gclarity.risev2g.shared.v2gMessages.msgDef.BodyBaseType;
|
|
|
|
import com.v2gclarity.risev2g.shared.v2gMessages.msgDef.CertificateChainType;
|
|
|
|
import com.v2gclarity.risev2g.shared.v2gMessages.msgDef.CertificateUpdateReqType;
|
|
|
|
import com.v2gclarity.risev2g.shared.v2gMessages.msgDef.CertificateUpdateResType;
|
|
|
|
import com.v2gclarity.risev2g.shared.v2gMessages.msgDef.ContractSignatureEncryptedPrivateKeyType;
|
|
|
|
import com.v2gclarity.risev2g.shared.v2gMessages.msgDef.ResponseCodeType;
|
|
|
|
import com.v2gclarity.risev2g.shared.v2gMessages.msgDef.SignatureType;
|
|
|
|
import com.v2gclarity.risev2g.shared.v2gMessages.msgDef.V2GMessage;
|
2015-06-01 08:19:09 -07:00
|
|
|
|
|
|
|
public class WaitForCertificateUpdateReq extends ServerState {
|
|
|
|
|
|
|
|
private CertificateUpdateResType certificateUpdateRes;
|
|
|
|
|
|
|
|
public WaitForCertificateUpdateReq(V2GCommunicationSessionSECC commSessionContext) {
|
|
|
|
super(commSessionContext);
|
|
|
|
certificateUpdateRes = new CertificateUpdateResType();
|
|
|
|
}
|
|
|
|
|
|
|
|
@Override
|
|
|
|
public ReactionToIncomingMessage processIncomingMessage(Object message) {
|
|
|
|
if (isIncomingMessageValid(message, CertificateUpdateReqType.class, certificateUpdateRes)) {
|
|
|
|
V2GMessage v2gMessageReq = (V2GMessage) message;
|
|
|
|
CertificateUpdateReqType certificateUpdateReq =
|
|
|
|
(CertificateUpdateReqType) v2gMessageReq.getBody().getBodyElement().getValue();
|
|
|
|
|
|
|
|
if (isResponseCodeOK(
|
|
|
|
certificateUpdateReq,
|
|
|
|
v2gMessageReq.getHeader().getSignature())) {
|
|
|
|
// The ECDH (elliptic curve Diffie Hellman) key pair is also needed for the generation of the shared secret
|
2017-07-20 06:50:43 -07:00
|
|
|
KeyPair ecdhKeyPair = SecurityUtils.getECKeyPair();
|
2015-06-01 08:19:09 -07:00
|
|
|
if (ecdhKeyPair == null) {
|
|
|
|
getLogger().error("ECDH keypair could not be generated");
|
|
|
|
return null;
|
|
|
|
}
|
|
|
|
|
|
|
|
// Encrypt private key
|
|
|
|
ContractSignatureEncryptedPrivateKeyType encryptedContractCertPrivateKey =
|
|
|
|
SecurityUtils.encryptContractCertPrivateKey(
|
|
|
|
(ECPublicKey) SecurityUtils.getCertificate(certificateUpdateReq.getContractSignatureCertChain().getCertificate()).getPublicKey(),
|
|
|
|
ecdhKeyPair,
|
|
|
|
getCommSessionContext().getBackendInterface().getContractCertificatePrivateKey());
|
|
|
|
|
2016-04-11 05:59:47 -07:00
|
|
|
/*
|
|
|
|
* Experience from the test symposium in San Diego (April 2016):
|
|
|
|
* The Id element of the signature is not restricted in size by the standard itself. But on embedded
|
|
|
|
* systems, the memory is very limited which is why we should not use long IDs for the signature reference
|
|
|
|
* element. A good size would be 3 characters max (like the example in the ISO 15118-2 annex J)
|
|
|
|
*/
|
|
|
|
certificateUpdateRes.getContractSignatureCertChain().setId("id1"); // contractSignatureCertChain
|
2015-06-01 08:19:09 -07:00
|
|
|
certificateUpdateRes.setContractSignatureEncryptedPrivateKey(encryptedContractCertPrivateKey);
|
2016-04-11 05:59:47 -07:00
|
|
|
certificateUpdateRes.getContractSignatureEncryptedPrivateKey().setId("id2"); // contractSignatureEncryptedPrivateKey
|
2015-06-01 08:19:09 -07:00
|
|
|
certificateUpdateRes.setDHpublickey(SecurityUtils.getDHPublicKey(ecdhKeyPair));
|
2016-04-11 05:59:47 -07:00
|
|
|
certificateUpdateRes.getDHpublickey().setId("id3"); // dhPublicKey
|
2017-08-20 14:26:22 -07:00
|
|
|
certificateUpdateRes.setEMAID(SecurityUtils.getEMAID(certificateUpdateReq.getContractSignatureCertChain()));
|
2016-04-11 05:59:47 -07:00
|
|
|
certificateUpdateRes.getEMAID().setId("id4"); // emaid
|
2017-07-20 06:50:43 -07:00
|
|
|
certificateUpdateRes.setSAProvisioningCertificateChain(getCommSessionContext().getBackendInterface().getCPSCertificateChain());
|
2015-06-01 08:19:09 -07:00
|
|
|
|
|
|
|
// In case of negative response code, try at next charging (retryCounter = 0)
|
|
|
|
if (!certificateUpdateRes.getResponseCode().toString().startsWith("OK"))
|
|
|
|
certificateUpdateRes.setRetryCounter((short) 0);
|
|
|
|
|
|
|
|
// Set xml reference elements
|
|
|
|
getXMLSignatureRefElements().put(
|
|
|
|
certificateUpdateRes.getContractSignatureCertChain().getId(),
|
2017-09-15 07:15:25 -07:00
|
|
|
SecurityUtils.generateDigest(
|
|
|
|
certificateUpdateRes.getContractSignatureCertChain().getId(),
|
|
|
|
getMessageHandler().getJaxbElement(certificateUpdateRes.getContractSignatureCertChain())));
|
2015-06-01 08:19:09 -07:00
|
|
|
getXMLSignatureRefElements().put(
|
|
|
|
certificateUpdateRes.getContractSignatureEncryptedPrivateKey().getId(),
|
2017-09-15 07:15:25 -07:00
|
|
|
SecurityUtils.generateDigest(
|
|
|
|
certificateUpdateRes.getContractSignatureEncryptedPrivateKey().getId(),
|
|
|
|
getMessageHandler().getJaxbElement(certificateUpdateRes.getContractSignatureEncryptedPrivateKey())));
|
2015-06-01 08:19:09 -07:00
|
|
|
getXMLSignatureRefElements().put(
|
|
|
|
certificateUpdateRes.getDHpublickey().getId(),
|
2017-09-15 07:15:25 -07:00
|
|
|
SecurityUtils.generateDigest(
|
|
|
|
certificateUpdateRes.getDHpublickey().getId(),
|
|
|
|
getMessageHandler().getJaxbElement(certificateUpdateRes.getDHpublickey())));
|
2015-06-01 08:19:09 -07:00
|
|
|
getXMLSignatureRefElements().put(
|
|
|
|
certificateUpdateRes.getEMAID().getId(),
|
2017-09-15 07:15:25 -07:00
|
|
|
SecurityUtils.generateDigest(
|
|
|
|
certificateUpdateRes.getEMAID().getId(),
|
|
|
|
getMessageHandler().getJaxbElement(certificateUpdateRes.getEMAID())));
|
2015-06-01 08:19:09 -07:00
|
|
|
|
|
|
|
// Set signing private key
|
2017-07-20 06:50:43 -07:00
|
|
|
setSignaturePrivateKey(getCommSessionContext().getBackendInterface().getCPSLeafPrivateKey());
|
2015-06-01 08:19:09 -07:00
|
|
|
} else {
|
2017-08-20 14:26:22 -07:00
|
|
|
setMandatoryFieldsForFailedRes(certificateUpdateRes, certificateUpdateRes.getResponseCode());
|
2015-06-01 08:19:09 -07:00
|
|
|
}
|
2017-07-20 06:50:43 -07:00
|
|
|
} else {
|
2017-08-20 14:26:22 -07:00
|
|
|
if (certificateUpdateRes.getResponseCode().equals(ResponseCodeType.FAILED_SEQUENCE_ERROR)) {
|
|
|
|
BodyBaseType responseMessage = getSequenceErrorResMessage(new CertificateUpdateResType(), message);
|
|
|
|
|
|
|
|
return getSendMessage(responseMessage, V2GMessages.NONE, certificateUpdateRes.getResponseCode());
|
|
|
|
} else {
|
|
|
|
setMandatoryFieldsForFailedRes(certificateUpdateRes, certificateUpdateRes.getResponseCode());
|
|
|
|
}
|
2015-06-01 08:19:09 -07:00
|
|
|
}
|
|
|
|
|
|
|
|
return getSendMessage(certificateUpdateRes,
|
|
|
|
(certificateUpdateRes.getResponseCode().toString().startsWith("OK") ?
|
2017-08-20 14:26:22 -07:00
|
|
|
V2GMessages.PAYMENT_DETAILS_REQ : V2GMessages.NONE),
|
|
|
|
certificateUpdateRes.getResponseCode()
|
2015-06-01 08:19:09 -07:00
|
|
|
);
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
private boolean isResponseCodeOK(
|
|
|
|
CertificateUpdateReqType certificateUpdateReq,
|
|
|
|
SignatureType signature) {
|
|
|
|
// Check for FAILED_NoCertificateAvailable
|
2017-08-21 13:13:09 -07:00
|
|
|
CertificateChainType saContractCertificateChain =
|
|
|
|
getCommSessionContext().getBackendInterface().getContractCertificateChain(
|
|
|
|
certificateUpdateReq.getContractSignatureCertChain()
|
|
|
|
);
|
2015-06-01 08:19:09 -07:00
|
|
|
if (saContractCertificateChain == null || saContractCertificateChain.getCertificate() == null) {
|
|
|
|
certificateUpdateRes.setResponseCode(ResponseCodeType.FAILED_NO_CERTIFICATE_AVAILABLE);
|
|
|
|
return false;
|
2017-08-21 13:13:09 -07:00
|
|
|
} else {
|
|
|
|
certificateUpdateRes.setContractSignatureCertChain(saContractCertificateChain);
|
2015-06-01 08:19:09 -07:00
|
|
|
}
|
|
|
|
|
2017-08-20 14:26:22 -07:00
|
|
|
// Check complete contract certificate chain
|
|
|
|
ResponseCodeType certChainResponseCode = SecurityUtils.verifyCertificateChain(
|
|
|
|
certificateUpdateReq.getContractSignatureCertChain(),
|
|
|
|
GlobalValues.SECC_TRUSTSTORE_FILEPATH.toString(),
|
|
|
|
PKI.MO);
|
|
|
|
if (!certChainResponseCode.equals(ResponseCodeType.OK)) {
|
|
|
|
certificateUpdateRes.setResponseCode(certChainResponseCode);
|
2015-06-01 08:19:09 -07:00
|
|
|
return false;
|
|
|
|
}
|
|
|
|
|
|
|
|
// Check for FAILED_CertificateRevoked
|
|
|
|
// TODO check for revocation with OCSP
|
|
|
|
|
|
|
|
// Verify signature
|
|
|
|
HashMap<String, byte[]> verifyXMLSigRefElements = new HashMap<String, byte[]>();
|
2017-08-20 14:26:22 -07:00
|
|
|
verifyXMLSigRefElements.put(
|
|
|
|
certificateUpdateReq.getId(),
|
2017-09-15 07:15:25 -07:00
|
|
|
SecurityUtils.generateDigest(
|
|
|
|
certificateUpdateReq.getId(),
|
|
|
|
getMessageHandler().getJaxbElement(certificateUpdateReq)));
|
2017-07-20 06:50:43 -07:00
|
|
|
|
|
|
|
if (!SecurityUtils.verifySignature(
|
|
|
|
signature,
|
2017-08-20 14:26:22 -07:00
|
|
|
getMessageHandler().getJaxbElement(signature.getSignedInfo()),
|
2017-07-20 06:50:43 -07:00
|
|
|
verifyXMLSigRefElements,
|
|
|
|
certificateUpdateReq.getContractSignatureCertChain().getCertificate())) {
|
2015-06-01 08:19:09 -07:00
|
|
|
certificateUpdateRes.setResponseCode(ResponseCodeType.FAILED_SIGNATURE_ERROR);
|
|
|
|
return false;
|
|
|
|
}
|
|
|
|
|
|
|
|
return true;
|
|
|
|
}
|
2017-07-20 06:50:43 -07:00
|
|
|
|
|
|
|
@Override
|
2017-08-20 14:26:22 -07:00
|
|
|
public BodyBaseType getResponseMessage() {
|
|
|
|
return certificateUpdateRes;
|
2017-07-20 06:50:43 -07:00
|
|
|
}
|
2015-06-01 08:19:09 -07:00
|
|
|
}
|