1package eu.siacs.conversations.utils;
2
3import android.os.Bundle;
4import android.util.Base64;
5import android.util.Pair;
6
7import org.bouncycastle.asn1.x500.X500Name;
8import org.bouncycastle.asn1.x500.style.BCStyle;
9import org.bouncycastle.asn1.x500.style.IETFUtils;
10import org.bouncycastle.cert.jcajce.JcaX509CertificateHolder;
11
12import java.net.MalformedURLException;
13import java.net.URL;
14import java.security.MessageDigest;
15import java.security.NoSuchAlgorithmException;
16import java.security.SecureRandom;
17import java.security.cert.CertificateEncodingException;
18import java.security.cert.CertificateParsingException;
19import java.security.cert.X509Certificate;
20import java.text.Normalizer;
21import java.util.ArrayList;
22import java.util.Arrays;
23import java.util.Collection;
24import java.util.Iterator;
25import java.util.LinkedHashSet;
26import java.util.List;
27import java.util.Locale;
28import java.util.regex.Pattern;
29
30import eu.siacs.conversations.Config;
31import eu.siacs.conversations.R;
32import eu.siacs.conversations.entities.Account;
33import eu.siacs.conversations.entities.Message;
34import eu.siacs.conversations.http.AesGcmURLStreamHandler;
35import rocks.xmpp.addr.Jid;
36
37public final class CryptoHelper {
38 public static final String FILETRANSFER = "?FILETRANSFERv1:";
39 private final static char[] hexArray = "0123456789abcdef".toCharArray();
40
41 public static final Pattern UUID_PATTERN = Pattern.compile("[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}");
42 final public static byte[] ONE = new byte[] { 0, 0, 0, 1 };
43
44 public static String bytesToHex(byte[] bytes) {
45 char[] hexChars = new char[bytes.length * 2];
46 for (int j = 0; j < bytes.length; j++) {
47 int v = bytes[j] & 0xFF;
48 hexChars[j * 2] = hexArray[v >>> 4];
49 hexChars[j * 2 + 1] = hexArray[v & 0x0F];
50 }
51 return new String(hexChars);
52 }
53
54 public static byte[] hexToBytes(String hexString) {
55 int len = hexString.length();
56 byte[] array = new byte[len / 2];
57 for (int i = 0; i < len; i += 2) {
58 array[i / 2] = (byte) ((Character.digit(hexString.charAt(i), 16) << 4) + Character
59 .digit(hexString.charAt(i + 1), 16));
60 }
61 return array;
62 }
63
64 public static String hexToString(final String hexString) {
65 return new String(hexToBytes(hexString));
66 }
67
68 public static byte[] concatenateByteArrays(byte[] a, byte[] b) {
69 byte[] result = new byte[a.length + b.length];
70 System.arraycopy(a, 0, result, 0, a.length);
71 System.arraycopy(b, 0, result, a.length, b.length);
72 return result;
73 }
74
75 /**
76 * Escapes usernames or passwords for SASL.
77 */
78 public static String saslEscape(final String s) {
79 final StringBuilder sb = new StringBuilder((int) (s.length() * 1.1));
80 for (int i = 0; i < s.length(); i++) {
81 char c = s.charAt(i);
82 switch (c) {
83 case ',':
84 sb.append("=2C");
85 break;
86 case '=':
87 sb.append("=3D");
88 break;
89 default:
90 sb.append(c);
91 break;
92 }
93 }
94 return sb.toString();
95 }
96
97 public static String saslPrep(final String s) {
98 return Normalizer.normalize(s, Normalizer.Form.NFKC);
99 }
100
101 public static String random(int length, SecureRandom random) {
102 final byte[] bytes = new byte[length];
103 random.nextBytes(bytes);
104 return Base64.encodeToString(bytes,Base64.NO_PADDING|Base64.NO_WRAP|Base64.URL_SAFE);
105 }
106
107 public static String prettifyFingerprint(String fingerprint) {
108 if (fingerprint==null) {
109 return "";
110 } else if (fingerprint.length() < 40) {
111 return fingerprint;
112 }
113 StringBuilder builder = new StringBuilder(fingerprint);
114 for(int i=8;i<builder.length();i+=9) {
115 builder.insert(i, ' ');
116 }
117 return builder.toString();
118 }
119
120 public static String prettifyFingerprintCert(String fingerprint) {
121 StringBuilder builder = new StringBuilder(fingerprint);
122 for(int i=2;i < builder.length(); i+=3) {
123 builder.insert(i,':');
124 }
125 return builder.toString();
126 }
127
128 public static String[] getOrderedCipherSuites(final String[] platformSupportedCipherSuites) {
129 final Collection<String> cipherSuites = new LinkedHashSet<>(Arrays.asList(Config.ENABLED_CIPHERS));
130 final List<String> platformCiphers = Arrays.asList(platformSupportedCipherSuites);
131 cipherSuites.retainAll(platformCiphers);
132 cipherSuites.addAll(platformCiphers);
133 filterWeakCipherSuites(cipherSuites);
134 return cipherSuites.toArray(new String[cipherSuites.size()]);
135 }
136
137 private static void filterWeakCipherSuites(final Collection<String> cipherSuites) {
138 final Iterator<String> it = cipherSuites.iterator();
139 while (it.hasNext()) {
140 String cipherName = it.next();
141 // remove all ciphers with no or very weak encryption or no authentication
142 for (String weakCipherPattern : Config.WEAK_CIPHER_PATTERNS) {
143 if (cipherName.contains(weakCipherPattern)) {
144 it.remove();
145 break;
146 }
147 }
148 }
149 }
150
151 public static Pair<Jid,String> extractJidAndName(X509Certificate certificate) throws CertificateEncodingException, IllegalArgumentException, CertificateParsingException {
152 Collection<List<?>> alternativeNames = certificate.getSubjectAlternativeNames();
153 List<String> emails = new ArrayList<>();
154 if (alternativeNames != null) {
155 for(List<?> san : alternativeNames) {
156 Integer type = (Integer) san.get(0);
157 if (type == 1) {
158 emails.add((String) san.get(1));
159 }
160 }
161 }
162 X500Name x500name = new JcaX509CertificateHolder(certificate).getSubject();
163 if (emails.size() == 0 && x500name.getRDNs(BCStyle.EmailAddress).length > 0) {
164 emails.add(IETFUtils.valueToString(x500name.getRDNs(BCStyle.EmailAddress)[0].getFirst().getValue()));
165 }
166 String name = x500name.getRDNs(BCStyle.CN).length > 0 ? IETFUtils.valueToString(x500name.getRDNs(BCStyle.CN)[0].getFirst().getValue()) : null;
167 if (emails.size() >= 1) {
168 return new Pair<>(Jid.of(emails.get(0)), name);
169 } else if (name != null){
170 try {
171 Jid jid = Jid.of(name);
172 if (jid.isBareJid() && jid.getLocal() != null) {
173 return new Pair<>(jid,null);
174 }
175 } catch (IllegalArgumentException e) {
176 return null;
177 }
178 }
179 return null;
180 }
181
182 public static Bundle extractCertificateInformation(X509Certificate certificate) {
183 Bundle information = new Bundle();
184 try {
185 JcaX509CertificateHolder holder = new JcaX509CertificateHolder(certificate);
186 X500Name subject = holder.getSubject();
187 try {
188 information.putString("subject_cn", subject.getRDNs(BCStyle.CN)[0].getFirst().getValue().toString());
189 } catch (Exception e) {
190 //ignored
191 }
192 try {
193 information.putString("subject_o",subject.getRDNs(BCStyle.O)[0].getFirst().getValue().toString());
194 } catch (Exception e) {
195 //ignored
196 }
197
198 X500Name issuer = holder.getIssuer();
199 try {
200 information.putString("issuer_cn", issuer.getRDNs(BCStyle.CN)[0].getFirst().getValue().toString());
201 } catch (Exception e) {
202 //ignored
203 }
204 try {
205 information.putString("issuer_o", issuer.getRDNs(BCStyle.O)[0].getFirst().getValue().toString());
206 } catch (Exception e) {
207 //ignored
208 }
209 try {
210 information.putString("sha1", getFingerprintCert(certificate.getEncoded()));
211 } catch (Exception e) {
212
213 }
214 return information;
215 } catch (CertificateEncodingException e) {
216 return information;
217 }
218 }
219
220 public static String getFingerprintCert(byte[] input) throws NoSuchAlgorithmException {
221 MessageDigest md = MessageDigest.getInstance("SHA-1");
222 byte[] fingerprint = md.digest(input);
223 return prettifyFingerprintCert(bytesToHex(fingerprint));
224 }
225
226 public static String getAccountFingerprint(Account account) {
227 return getFingerprint(account.getJid().asBareJid().toString());
228 }
229
230 public static String getFingerprint(String value) {
231 try {
232 MessageDigest md = MessageDigest.getInstance("SHA-256");
233 return bytesToHex(md.digest(value.getBytes("UTF-8")));
234 } catch (Exception e) {
235 return "";
236 }
237 }
238
239 public static int encryptionTypeToText(int encryption) {
240 switch (encryption) {
241 case Message.ENCRYPTION_OTR:
242 return R.string.encryption_choice_otr;
243 case Message.ENCRYPTION_AXOLOTL:
244 return R.string.encryption_choice_omemo;
245 case Message.ENCRYPTION_NONE:
246 return R.string.encryption_choice_unencrypted;
247 default:
248 return R.string.encryption_choice_pgp;
249 }
250 }
251
252 public static URL toAesGcmUrl(URL url) {
253 if (!url.getProtocol().equalsIgnoreCase("https")) {
254 return url;
255 }
256 try {
257 return new URL(AesGcmURLStreamHandler.PROTOCOL_NAME+url.toString().substring(url.getProtocol().length()));
258 } catch (MalformedURLException e) {
259 return url;
260 }
261 }
262
263 public static URL toHttpsUrl(URL url) {
264 if (!url.getProtocol().equalsIgnoreCase(AesGcmURLStreamHandler.PROTOCOL_NAME)) {
265 return url;
266 }
267 try {
268 return new URL("https"+url.toString().substring(url.getProtocol().length()));
269 } catch (MalformedURLException e) {
270 return url;
271 }
272 }
273
274 public static boolean isPgpEncryptedUrl(String url) {
275 if (url == null) {
276 return false;
277 }
278 final String u = url.toLowerCase();
279 return !u.contains(" ") && (u.startsWith("https://") || u.startsWith("http://")) && u.endsWith(".pgp");
280 }
281}