/* * Decompiled with CFR 0.152. * * Could not load the following classes: * com.l7tech.common.io.CertGenParams * com.l7tech.common.io.CertUtils * com.l7tech.gateway.common.LicenseException * com.l7tech.gateway.common.security.keystore.SsgKeyEntry * com.l7tech.gateway.common.transport.SsgConnector$Endpoint * com.l7tech.identity.BadCredentialsException * com.l7tech.identity.IdentityProviderConfig * com.l7tech.identity.IdentityProviderConfigManager * com.l7tech.identity.IssuedCertNotPresentedException * com.l7tech.identity.MissingCredentialsException * com.l7tech.identity.User * com.l7tech.identity.internal.InternalUser * com.l7tech.objectmodel.FindException * com.l7tech.objectmodel.Goid * com.l7tech.objectmodel.UpdateException * com.l7tech.security.prov.JceProvider * com.l7tech.security.prov.RsaSignerEngine * com.l7tech.util.ExceptionUtils * com.l7tech.util.IOUtils * jakarta.servlet.ServletConfig * jakarta.servlet.ServletException * jakarta.servlet.http.HttpServletRequest * jakarta.servlet.http.HttpServletResponse * org.springframework.context.ApplicationEvent */ package com.l7tech.server.identity.cert; import com.l7tech.common.io.CertGenParams; import com.l7tech.common.io.CertUtils; import com.l7tech.gateway.common.LicenseException; import com.l7tech.gateway.common.security.keystore.SsgKeyEntry; import com.l7tech.gateway.common.transport.SsgConnector; import com.l7tech.identity.BadCredentialsException; import com.l7tech.identity.IdentityProviderConfig; import com.l7tech.identity.IdentityProviderConfigManager; import com.l7tech.identity.IssuedCertNotPresentedException; import com.l7tech.identity.MissingCredentialsException; import com.l7tech.identity.User; import com.l7tech.identity.internal.InternalUser; import com.l7tech.objectmodel.FindException; import com.l7tech.objectmodel.Goid; import com.l7tech.objectmodel.UpdateException; import com.l7tech.security.prov.JceProvider; import com.l7tech.security.prov.RsaSignerEngine; import com.l7tech.server.AuthenticatableHttpServlet; import com.l7tech.server.DefaultKey; import com.l7tech.server.audit.AuditContextUtils; import com.l7tech.server.event.system.CertificateSigningServiceEvent; import com.l7tech.server.transport.ListenerException; import com.l7tech.util.ExceptionUtils; import com.l7tech.util.IOUtils; import jakarta.servlet.ServletConfig; import jakarta.servlet.ServletException; import jakarta.servlet.http.HttpServletRequest; import jakarta.servlet.http.HttpServletResponse; import java.io.IOException; import java.io.InputStream; import java.security.UnrecoverableKeyException; import java.security.cert.Certificate; import java.security.cert.CertificateEncodingException; import java.security.cert.X509Certificate; import java.util.Date; import java.util.logging.Level; import javax.security.auth.x500.X500Principal; import org.springframework.context.ApplicationEvent; public class CSRHandler extends AuthenticatableHttpServlet { private DefaultKey defaultKey; private IdentityProviderConfigManager providerConfigManager; public static final String AUTH_HEADER_NAME; public static final String ROUTED_FROM_PEER; private static final String PROP_PKIX_CSR_DEFAULT_EXPIRY_AGE; static final long serialVersionUID = -1312528994084368316L; private static final String[] b; @Override public void init(ServletConfig servletConfig) throws ServletException { super.init(servletConfig); String[] stringArray = b; this.defaultKey = (DefaultKey)this.getApplicationContext().getBean(stringArray[35], DefaultKey.class); this.providerConfigManager = (IdentityProviderConfigManager)this.getApplicationContext().getBean(stringArray[29], IdentityProviderConfigManager.class); } @Override protected String getFeature() { return b[23]; } @Override protected SsgConnector.Endpoint getRequiredEndpoint() { return SsgConnector.Endpoint.CSRHANDLER; } /* * WARNING - Removed try catching itself - possible behaviour change. * Unable to fully structure code * Could not resolve type clashes */ protected void doPost(HttpServletRequest var1_1, HttpServletResponse var2_2) throws ServletException, IOException { block34: { try { if (!var1_1.isSecure()) { var2_2.sendError(403, CSRHandler.b[1]); return; } } catch (BadCredentialsException v0) { throw CSRHandler.a((Exception)v0); } try { var3_3 = this.authenticateRequestBasic(var1_1); } catch (BadCredentialsException var4_4) { var15_11 = CSRHandler.b; var2_2.sendError(401, var15_11[12]); this.logger.log(Level.WARNING, var15_11[17] + ExceptionUtils.getMessage((Throwable)var4_4), ExceptionUtils.getDebugException((Throwable)var4_4)); return; } catch (MissingCredentialsException var4_5) { var15_12 = CSRHandler.b; var2_2.sendError(401, var15_12[5]); this.logger.log(Level.WARNING, var15_12[18] + ExceptionUtils.getMessage((Throwable)var4_5), ExceptionUtils.getDebugException((Throwable)var4_5)); return; } catch (IssuedCertNotPresentedException var4_6) { var15_13 = CSRHandler.b; this.logger.log(Level.WARNING, var15_13[10]); var2_2.sendError(403, var15_13[22]); return; } catch (LicenseException var4_7) { var15_14 = CSRHandler.b; this.logger.log(Level.WARNING, var15_14[8], ExceptionUtils.getDebugException((Throwable)var4_7)); var2_2.sendError(503, var15_14[6]); return; } catch (ListenerException var4_8) { var15_15 = CSRHandler.b; this.logger.log(Level.WARNING, var15_15[21], ExceptionUtils.getDebugException((Throwable)var4_8)); var2_2.sendError(503, var15_15[15]); return; } if (var3_3 == null) ** GOTO lbl43 try { block36: { if (var3_3.length >= 1) break block34; break block36; catch (BadCredentialsException v1) { throw CSRHandler.a((Exception)v1); } } var2_2.sendError(401, CSRHandler.b[5]); this.logger.warning(CSRHandler.b[2]); return; } catch (BadCredentialsException v2) { throw CSRHandler.a((Exception)v2); } } if (var3_3.length > 1) { var15_16 = CSRHandler.b; var4_9 = var15_16[19]; var2_2.sendError(409, var4_9); this.logger.warning(var4_9); return; } var4_10 = var3_3[0]; var5_20 = var4_10.getUser(); var6_21 = var4_10.getAuthenticatedCert(); try { if (!this.clientCertManager.userCanGenCert(var5_20, (Certificate)var6_21)) { this.logger.log(Level.SEVERE, CSRHandler.b[24] + var5_20.getLogin()); var2_2.sendError(403, CSRHandler.b[25]); return; } } catch (BadCredentialsException v3) { throw CSRHandler.a((Exception)v3); } try { var7_22 /* !! */ = var5_20.getProviderId(); var8_24 = (IdentityProviderConfig)this.providerConfigManager.findByPrimaryKey(var7_22 /* !! */ ); if (!var8_24.canIssueCertificates()) { var15_17 = CSRHandler.b; this.logger.log(Level.WARNING, var15_17[4] + var8_24.getName() + var15_17[0]); var2_2.sendError(403, var15_17[25]); return; } } catch (FindException var7_23) { var15_18 = CSRHandler.b; this.logger.log(Level.SEVERE, var15_18[34] + var5_20.getLogin() + var15_18[3]); var2_2.sendError(403, var15_18[25]); return; } var7_22 /* !! */ = (Goid)this.readCSRFromRequest(var1_1); var15_19 = CSRHandler.b; var9_25 = new X500Principal(var15_19[27] + var5_20.getLogin()); try { var10_26 = this.config.getIntProperty(var15_19[30], 730); var11_29 /* !! */ = new CertGenParams(var9_25, (int)var10_26, false, null).useUserCertDefaults(); if (var5_20 instanceof InternalUser) { var12_32 = ((InternalUser)var5_20).getExpiration(); try { if (var12_32 != -1L) { var11_29 /* !! */ .setNotAfter(new Date(var12_32)); } } catch (BadCredentialsException v4) { throw CSRHandler.a((Exception)v4); } } var8_24 = this.getSigner().createCertificate((byte[])var7_22 /* !! */ , var11_29 /* !! */ ); } catch (NoCaException var10_27) { var15_19 = CSRHandler.b; var2_2.sendError(503, var15_19[36]); this.logger.log(Level.WARNING, var15_19[37]); return; } catch (Exception var10_28) { var2_2.sendError(500, var10_28.getMessage()); this.logger.log(Level.SEVERE, ExceptionUtils.getMessage((Throwable)var10_28), var10_28); return; } var10_26 = AuditContextUtils.isSystem(); AuditContextUtils.setSystem(true); try { this.clientCertManager.recordNewUserCert(var5_20, (Certificate)var8_24, var4_10.isCertSignedByStaleCA()); var11_29 /* !! */ = this.buildIssuedMessage(var5_20); this.getApplicationContext().publishEvent((ApplicationEvent)new CertificateSigningServiceEvent((Object)this, Level.INFO, var1_1.getRemoteAddr(), (String)var11_29 /* !! */ , var5_20.getProviderId(), this.getName(var5_20), var5_20.getId())); } catch (UpdateException var11_30) { var15_19 = CSRHandler.b; var12_33 = var15_19[28] + var11_30.getMessage(); var2_2.sendError(500, var12_33); this.logger.log(Level.SEVERE, var12_33, var11_30); return; } finally { AuditContextUtils.setSystem(var10_26); } try { var11_29 /* !! */ = (CertGenParams)var8_24.getEncoded(); var2_2.setStatus(200); var15_19 = CSRHandler.b; var2_2.setContentType(var15_19[31]); var2_2.setContentLength(((CertGenParams)var11_29 /* !! */ ).length); var2_2.getOutputStream().write((byte[])var11_29 /* !! */ ); var2_2.flushBuffer(); this.logger.fine(var15_19[33] + var5_20.getLogin() + var15_19[9] + ((X509Certificate)var8_24).getSubjectDN().toString()); } catch (CertificateEncodingException var11_31) { var2_2.sendError(500, var11_31.getMessage()); this.logger.log(Level.SEVERE, ExceptionUtils.getMessage((Throwable)var11_31), var11_31); } } private String buildIssuedMessage(User user) { StringBuilder stringBuilder = new StringBuilder(); String[] stringArray = b; stringBuilder.append(stringArray[20]); stringBuilder.append(this.getName(user)); stringBuilder.append(stringArray[26]); stringBuilder.append(user.getId()); stringBuilder.append(stringArray[7]); stringBuilder.append(this.getIdentityProviderName(user.getProviderId())); stringBuilder.append(stringArray[11]); stringBuilder.append(user.getProviderId()); stringBuilder.append(")"); return stringBuilder.toString(); } private String getName(User user) { return user.getLogin() != null ? user.getLogin() : user.getId(); } private byte[] readCSRFromRequest(HttpServletRequest httpServletRequest) throws IOException { byte[] byArray = IOUtils.slurpStream((InputStream)httpServletRequest.getInputStream()); try { return CertUtils.csrPemToBinary((byte[])byArray); } catch (IOException iOException) { return byArray; } } private RsaSignerEngine getSigner() throws NoCaException { SsgKeyEntry ssgKeyEntry = this.defaultKey.getCaInfo(); try { if (ssgKeyEntry == null) { throw new NoCaException(); } } catch (UnrecoverableKeyException unrecoverableKeyException) { throw CSRHandler.a(unrecoverableKeyException); } try { return JceProvider.getInstance().createRsaSignerEngine(ssgKeyEntry.getPrivate(), ssgKeyEntry.getCertificateChain()); } catch (UnrecoverableKeyException unrecoverableKeyException) { throw new NoCaException(b[13] + ExceptionUtils.getMessage((Throwable)unrecoverableKeyException), unrecoverableKeyException); } } private static Exception a(Exception exception) { return exception; } /* * Unable to fully structure code */ static { block10: { block9: { var5 = new String[38]; var3_1 = 0; var2_2 = "|\u00071o_v_0H! J`\r3N! yV-p'\u001dt\u0007 H`\u000e+B&tI%\u0012+T! Yj\u0012;\u0007!hHj\n9OusIi_.H't&\u001dt\u0007 rd\u0011:K0r\u001af\u001e2K0d\u001ar\u0016*O:uN%\u001c,B1eTq\u0016?K&\u000b~d\u0006R\u001aa\u001a0N0d\u0017\nO0 sa\u001a0S 52; case 1 -> 77; case 2 -> 63; case 3 -> 106; case 4 -> 80; case 5 -> 111; default -> 21; }))); ++n3; n4 = n4; } while (n4 > n3); } return new String(cArray2).intern(); } private static final class NoCaException extends Exception { static final long serialVersionUID = -6515174456756153779L; private NoCaException() { } private NoCaException(String string, Throwable throwable) { super(string, throwable); } } }