AbstractPushService.java

Go to the documentation of this file.

/*
 * Turró i Cutiller Foundation. License notice.
 * Copyright (C) 2022 Lluis Turró Cutiller <http://www.turro.org/>
 *
 * This program is free software: you can redistribute it and/or modify
 * it under the terms of the GNU Affero General Public License as published by
 * the Free Software Foundation, either version 3 of the License, or
 * (at your option) any later version.
 *
 * This program is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU Affero General Public License for more details.
 *
 * You should have received a copy of the GNU Affero General Public License
 * along with this program.  If not, see <http://www.gnu.org/licenses/>.
 */
package org.turro.push.service;
 
import java.io.IOException;
import java.security.GeneralSecurityException;
import java.security.InvalidAlgorithmParameterException;
import java.security.KeyPair;
import java.security.KeyPairGenerator;
import java.security.NoSuchAlgorithmException;
import java.security.NoSuchProviderException;
import java.security.PrivateKey;
import java.security.PublicKey;
import java.security.SecureRandom;
import java.security.spec.InvalidKeySpecException;
import java.util.HashMap;
import java.util.Map;
import org.apache.commons.codec.binary.Base64;
import org.bouncycastle.jce.ECNamedCurveTable;
import org.bouncycastle.jce.interfaces.ECPublicKey;
import org.bouncycastle.jce.spec.ECNamedCurveParameterSpec;
import org.jose4j.jws.AlgorithmIdentifiers;
import org.jose4j.jws.JsonWebSignature;
import org.jose4j.jwt.JwtClaims;
import org.jose4j.lang.JoseException;
import org.turro.push.security.ServerKeys;
 
public abstract class AbstractPushService<T extends AbstractPushService<T>> {
 
  private static final SecureRandom SECURE_RANDOM = new SecureRandom();
  public static final String SERVER_KEY_ID = "server-key-id";
  public static final String SERVER_KEY_CURVE = "P-256";
 
  private String gcmApiKey;
 
  private String subject;
 
  private PublicKey publicKey;
 
  private PrivateKey privateKey;
 
  public AbstractPushService() {
  }
 
  public AbstractPushService(String gcmApiKey) {
    this.gcmApiKey = gcmApiKey;
  }
 
  public AbstractPushService(KeyPair keyPair) {
    this.publicKey = keyPair.getPublic();
    this.privateKey = keyPair.getPrivate();
  }
 
  public AbstractPushService(KeyPair keyPair, String subject) {
    this(keyPair);
    this.subject = subject;
  }
 
  public AbstractPushService(String publicKey, String privateKey) throws GeneralSecurityException {
    this.publicKey = ServerKeys.loadPublicKey(publicKey);
    this.privateKey = ServerKeys.loadPrivateKey(privateKey);
  }
 
  public AbstractPushService(String publicKey, String privateKey, String subject) throws GeneralSecurityException {
    this(publicKey, privateKey);
    this.subject = subject;
  }
 
  public static Encrypted encrypt(byte[] payload, ECPublicKey userPublicKey, byte[] userAuth, Encoding encoding) throws GeneralSecurityException {
    KeyPair localKeyPair = generateLocalKeyPair();
 
    Map<String, KeyPair> keys = new HashMap<>();
    keys.put(SERVER_KEY_ID, localKeyPair);
 
    Map<String, String> labels = new HashMap<>();
    labels.put(SERVER_KEY_ID, SERVER_KEY_CURVE);
 
    byte[] salt = new byte[16];
    SECURE_RANDOM.nextBytes(salt);
 
    HttpEce httpEce = new HttpEce(keys, labels);
    byte[] ciphertext = httpEce.encrypt(payload, salt, null, SERVER_KEY_ID, userPublicKey, userAuth, encoding);
 
    return new Encrypted.Builder()
            .withSalt(salt)
            .withPublicKey(localKeyPair.getPublic())
            .withCiphertext(ciphertext)
            .build();
  }
 
  private static KeyPair generateLocalKeyPair() throws NoSuchAlgorithmException, NoSuchProviderException, InvalidAlgorithmParameterException {
    ECNamedCurveParameterSpec parameterSpec = ECNamedCurveTable.getParameterSpec("prime256v1");
    KeyPairGenerator keyPairGenerator = KeyPairGenerator.getInstance("ECDH", "BC");
    keyPairGenerator.initialize(parameterSpec);
 
    return keyPairGenerator.generateKeyPair();
  }
 
  protected final HttpRequest prepareRequest(Notification notification, Encoding encoding) throws GeneralSecurityException, IOException, JoseException {
    if (getPrivateKey() != null && getPublicKey() != null) {
      if (!ServerKeys.verifyKeyPair(getPrivateKey(), getPublicKey())) {
        throw new IllegalStateException("Public key and private key do not match.");
      }
    }
 
    Encrypted encrypted = encrypt(
            notification.getPayload(),
            notification.getUserPublicKey(),
            notification.getUserAuth(),
            encoding
    );
 
    byte[] dh = ServerKeys.encode((ECPublicKey) encrypted.getPublicKey());
    byte[] salt = encrypted.getSalt();
 
    String url = notification.getEndpoint();
    Map<String, String> headers = new HashMap<>();
    byte[] body = null;
 
    headers.put("TTL", String.valueOf(notification.getTTL()));
 
    if (notification.hasUrgency()) {
      headers.put("Urgency", notification.getUrgency().getHeaderValue());
    }
 
    if (notification.hasTopic()) {
      headers.put("Topic", notification.getTopic());
    }
 
    if (notification.hasPayload()) {
      headers.put("Content-Type", "application/octet-stream");
 
      if (encoding == Encoding.AES128GCM) {
        headers.put("Content-Encoding", "aes128gcm");
      } else if (encoding == Encoding.AESGCM) {
        headers.put("Content-Encoding", "aesgcm");
        headers.put("Encryption", "salt=" + Base64.encodeBase64URLSafeString(salt));
        headers.put("Crypto-Key", "dh=" + Base64.encodeBase64URLSafeString(dh));
      }
 
      body = encrypted.getCiphertext();
    }
 
    if (notification.isGcm()) {
      if (getGcmApiKey() == null) {
        throw new IllegalStateException("An GCM API key is needed to send a push notification to a GCM endpoint.");
      }
 
      headers.put("Authorization", "key=" + getGcmApiKey());
    } else if (vapidEnabled()) {
      if (encoding == Encoding.AES128GCM) {
        if (notification.getEndpoint().startsWith("https://fcm.googleapis.com")) {
          url = notification.getEndpoint().replace("fcm/send", "wp");
        }
      }
 
      JwtClaims claims = new JwtClaims();
      claims.setAudience(notification.getOrigin());
      claims.setExpirationTimeMinutesInTheFuture(12 * 60);
      if (getSubject() != null) {
        claims.setSubject(getSubject());
      }
 
      JsonWebSignature jws = new JsonWebSignature();
      jws.setHeader("typ", "JWT");
      jws.setHeader("alg", "ES256");
      jws.setPayload(claims.toJson());
      jws.setKey(getPrivateKey());
      jws.setAlgorithmHeaderValue(AlgorithmIdentifiers.ECDSA_USING_P256_CURVE_AND_SHA256);
 
      byte[] pk = ServerKeys.encode((ECPublicKey) getPublicKey());
 
      if (encoding == Encoding.AES128GCM) {
        headers.put("Authorization", "vapid t=" + jws.getCompactSerialization() + ", k=" + Base64.encodeBase64URLSafeString(pk));
      } else if (encoding == Encoding.AESGCM) {
        headers.put("Authorization", "WebPush " + jws.getCompactSerialization());
      }
 
      if (headers.containsKey("Crypto-Key")) {
        headers.put("Crypto-Key", headers.get("Crypto-Key") + ";p256ecdsa=" + Base64.encodeBase64URLSafeString(pk));
      } else {
        headers.put("Crypto-Key", "p256ecdsa=" + Base64.encodeBase64URLSafeString(pk));
      }
    } else if (notification.isFcm() && getGcmApiKey() != null) {
      headers.put("Authorization", "key=" + getGcmApiKey());
    }
 
    return new HttpRequest(url, headers, body);
  }
 
  public T setGcmApiKey(String gcmApiKey) {
    this.gcmApiKey = gcmApiKey;
 
    return (T) this;
  }
 
  public String getGcmApiKey() {
    return gcmApiKey;
  }
 
  public String getSubject() {
    return subject;
  }
 
  public T setSubject(String subject) {
    this.subject = subject;
 
    return (T) this;
  }
 
  public T setKeyPair(KeyPair keyPair) {
    setPublicKey(keyPair.getPublic());
    setPrivateKey(keyPair.getPrivate());
 
    return (T) this;
  }
 
  public PublicKey getPublicKey() {
    return publicKey;
  }
 
  public T setPublicKey(String publicKey) throws NoSuchAlgorithmException, NoSuchProviderException, InvalidKeySpecException {
    setPublicKey(ServerKeys.loadPublicKey(publicKey));
 
    return (T) this;
  }
 
  public PrivateKey getPrivateKey() {
    return privateKey;
  }
 
  public KeyPair getKeyPair() {
    return new KeyPair(publicKey, privateKey);
  }
 
  public T setPublicKey(PublicKey publicKey) {
    this.publicKey = publicKey;
 
    return (T) this;
  }
 
  public T setPrivateKey(String privateKey) throws NoSuchAlgorithmException, NoSuchProviderException, InvalidKeySpecException {
    setPrivateKey(ServerKeys.loadPrivateKey(privateKey));
 
    return (T) this;
  }
 
  public T setPrivateKey(PrivateKey privateKey) {
    this.privateKey = privateKey;
 
    return (T) this;
  }
 
  protected boolean vapidEnabled() {
    return publicKey != null && privateKey != null;
  }
}