1package eu.siacs.conversations.utils;
2
3import android.os.Bundle;
4import android.util.Pair;
5
6import org.bouncycastle.asn1.x500.X500Name;
7import org.bouncycastle.asn1.x500.style.BCStyle;
8import org.bouncycastle.asn1.x500.style.IETFUtils;
9import org.bouncycastle.cert.jcajce.JcaX509CertificateHolder;
10
11import java.net.MalformedURLException;
12import java.net.URL;
13import java.security.MessageDigest;
14import java.security.NoSuchAlgorithmException;
15import java.security.cert.CertificateEncodingException;
16import java.security.cert.CertificateParsingException;
17import java.security.cert.X509Certificate;
18import java.text.Normalizer;
19import java.util.ArrayList;
20import java.util.Arrays;
21import java.util.Collection;
22import java.util.Iterator;
23import java.util.LinkedHashSet;
24import java.util.List;
25import java.util.Locale;
26import java.util.regex.Pattern;
27
28import eu.siacs.conversations.Config;
29import eu.siacs.conversations.R;
30import eu.siacs.conversations.entities.Account;
31import eu.siacs.conversations.entities.Message;
32import eu.siacs.conversations.http.AesGcmURLStreamHandler;
33import eu.siacs.conversations.xmpp.jid.InvalidJidException;
34import eu.siacs.conversations.xmpp.jid.Jid;
35
36public final class CryptoHelper {
37 public static final String FILETRANSFER = "?FILETRANSFERv1:";
38 private final static char[] hexArray = "0123456789abcdef".toCharArray();
39
40 public static final Pattern UUID_PATTERN = Pattern.compile("[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}");
41 final public static byte[] ONE = new byte[] { 0, 0, 0, 1 };
42
43 public static String bytesToHex(byte[] bytes) {
44 char[] hexChars = new char[bytes.length * 2];
45 for (int j = 0; j < bytes.length; j++) {
46 int v = bytes[j] & 0xFF;
47 hexChars[j * 2] = hexArray[v >>> 4];
48 hexChars[j * 2 + 1] = hexArray[v & 0x0F];
49 }
50 return new String(hexChars);
51 }
52
53 public static byte[] hexToBytes(String hexString) {
54 int len = hexString.length();
55 byte[] array = new byte[len / 2];
56 for (int i = 0; i < len; i += 2) {
57 array[i / 2] = (byte) ((Character.digit(hexString.charAt(i), 16) << 4) + Character
58 .digit(hexString.charAt(i + 1), 16));
59 }
60 return array;
61 }
62
63 public static String hexToString(final String hexString) {
64 return new String(hexToBytes(hexString));
65 }
66
67 public static byte[] concatenateByteArrays(byte[] a, byte[] b) {
68 byte[] result = new byte[a.length + b.length];
69 System.arraycopy(a, 0, result, 0, a.length);
70 System.arraycopy(b, 0, result, a.length, b.length);
71 return result;
72 }
73
74 /**
75 * Escapes usernames or passwords for SASL.
76 */
77 public static String saslEscape(final String s) {
78 final StringBuilder sb = new StringBuilder((int) (s.length() * 1.1));
79 for (int i = 0; i < s.length(); i++) {
80 char c = s.charAt(i);
81 switch (c) {
82 case ',':
83 sb.append("=2C");
84 break;
85 case '=':
86 sb.append("=3D");
87 break;
88 default:
89 sb.append(c);
90 break;
91 }
92 }
93 return sb.toString();
94 }
95
96 public static String saslPrep(final String s) {
97 return Normalizer.normalize(s, Normalizer.Form.NFKC);
98 }
99
100 public static String prettifyFingerprint(String fingerprint) {
101 if (fingerprint==null) {
102 return "";
103 } else if (fingerprint.length() < 40) {
104 return fingerprint;
105 }
106 StringBuilder builder = new StringBuilder(fingerprint.toLowerCase(Locale.US).replaceAll("\\s", ""));
107 for(int i=8;i<builder.length();i+=9) {
108 builder.insert(i, ' ');
109 }
110 return builder.toString();
111 }
112
113 public static String prettifyFingerprintCert(String fingerprint) {
114 StringBuilder builder = new StringBuilder(fingerprint);
115 for(int i=2;i < builder.length(); i+=3) {
116 builder.insert(i,':');
117 }
118 return builder.toString();
119 }
120
121 public static String[] getOrderedCipherSuites(final String[] platformSupportedCipherSuites) {
122 final Collection<String> cipherSuites = new LinkedHashSet<>(Arrays.asList(Config.ENABLED_CIPHERS));
123 final List<String> platformCiphers = Arrays.asList(platformSupportedCipherSuites);
124 cipherSuites.retainAll(platformCiphers);
125 cipherSuites.addAll(platformCiphers);
126 filterWeakCipherSuites(cipherSuites);
127 return cipherSuites.toArray(new String[cipherSuites.size()]);
128 }
129
130 private static void filterWeakCipherSuites(final Collection<String> cipherSuites) {
131 final Iterator<String> it = cipherSuites.iterator();
132 while (it.hasNext()) {
133 String cipherName = it.next();
134 // remove all ciphers with no or very weak encryption or no authentication
135 for (String weakCipherPattern : Config.WEAK_CIPHER_PATTERNS) {
136 if (cipherName.contains(weakCipherPattern)) {
137 it.remove();
138 break;
139 }
140 }
141 }
142 }
143
144 public static Pair<Jid,String> extractJidAndName(X509Certificate certificate) throws CertificateEncodingException, InvalidJidException, CertificateParsingException {
145 Collection<List<?>> alternativeNames = certificate.getSubjectAlternativeNames();
146 List<String> emails = new ArrayList<>();
147 if (alternativeNames != null) {
148 for(List<?> san : alternativeNames) {
149 Integer type = (Integer) san.get(0);
150 if (type == 1) {
151 emails.add((String) san.get(1));
152 }
153 }
154 }
155 X500Name x500name = new JcaX509CertificateHolder(certificate).getSubject();
156 if (emails.size() == 0) {
157 emails.add(IETFUtils.valueToString(x500name.getRDNs(BCStyle.EmailAddress)[0].getFirst().getValue()));
158 }
159 String name = IETFUtils.valueToString(x500name.getRDNs(BCStyle.CN)[0].getFirst().getValue());
160 if (emails.size() >= 1) {
161 return new Pair<>(Jid.fromString(emails.get(0)), name);
162 } else {
163 return null;
164 }
165 }
166
167 public static Bundle extractCertificateInformation(X509Certificate certificate) {
168 Bundle information = new Bundle();
169 try {
170 JcaX509CertificateHolder holder = new JcaX509CertificateHolder(certificate);
171 X500Name subject = holder.getSubject();
172 try {
173 information.putString("subject_cn", subject.getRDNs(BCStyle.CN)[0].getFirst().getValue().toString());
174 } catch (Exception e) {
175 //ignored
176 }
177 try {
178 information.putString("subject_o",subject.getRDNs(BCStyle.O)[0].getFirst().getValue().toString());
179 } catch (Exception e) {
180 //ignored
181 }
182
183 X500Name issuer = holder.getIssuer();
184 try {
185 information.putString("issuer_cn", issuer.getRDNs(BCStyle.CN)[0].getFirst().getValue().toString());
186 } catch (Exception e) {
187 //ignored
188 }
189 try {
190 information.putString("issuer_o", issuer.getRDNs(BCStyle.O)[0].getFirst().getValue().toString());
191 } catch (Exception e) {
192 //ignored
193 }
194 try {
195 information.putString("sha1", getFingerprintCert(certificate.getEncoded()));
196 } catch (Exception e) {
197
198 }
199 return information;
200 } catch (CertificateEncodingException e) {
201 return information;
202 }
203 }
204
205 public static String getFingerprintCert(byte[] input) throws NoSuchAlgorithmException {
206 MessageDigest md = MessageDigest.getInstance("SHA-1");
207 byte[] fingerprint = md.digest(input);
208 return prettifyFingerprintCert(bytesToHex(fingerprint));
209 }
210
211 public static String getAccountFingerprint(Account account) {
212 return getFingerprint(account.getJid().toBareJid().toString());
213 }
214
215 public static String getFingerprint(String value) {
216 try {
217 MessageDigest md = MessageDigest.getInstance("SHA-256");
218 return bytesToHex(md.digest(value.getBytes("UTF-8")));
219 } catch (Exception e) {
220 return "";
221 }
222 }
223
224 public static int encryptionTypeToText(int encryption) {
225 switch (encryption) {
226 case Message.ENCRYPTION_OTR:
227 return R.string.encryption_choice_otr;
228 case Message.ENCRYPTION_AXOLOTL:
229 return R.string.encryption_choice_omemo;
230 case Message.ENCRYPTION_NONE:
231 return R.string.encryption_choice_unencrypted;
232 default:
233 return R.string.encryption_choice_pgp;
234 }
235 }
236
237 public static URL toAesGcmUrl(URL url) {
238 if (!url.getProtocol().equalsIgnoreCase("https")) {
239 return url;
240 }
241 try {
242 return new URL(AesGcmURLStreamHandler.PROTOCOL_NAME+url.toString().substring(url.getProtocol().length()));
243 } catch (MalformedURLException e) {
244 return url;
245 }
246 }
247
248 public static URL toHttpsUrl(URL url) {
249 if (!url.getProtocol().equalsIgnoreCase(AesGcmURLStreamHandler.PROTOCOL_NAME)) {
250 return url;
251 }
252 try {
253 return new URL("https"+url.toString().substring(url.getProtocol().length()));
254 } catch (MalformedURLException e) {
255 return url;
256 }
257 }
258
259 public static boolean isPgpEncryptedUrl(String url) {
260 if (url == null) {
261 return false;
262 }
263 final String u = url.toLowerCase();
264 return !u.contains(" ") && (u.startsWith("https://") || u.startsWith("http://")) && u.endsWith(".pgp");
265 }
266}