NLIC-2579 Support verification of signed Agent validation responses

NetLicensingClient/pom.xml

@@ -19,6 +19,10 @@
             <groupId>com.helger</groupId>
             <artifactId>ph-xmldsig</artifactId>
         </dependency>
+        <dependency>
+            <groupId>com.nimbusds</groupId>
+            <artifactId>nimbus-jose-jwt</artifactId>
+        </dependency>
         <dependency>
             <groupId>com.sun.xml.bind</groupId>
             <artifactId>jaxb-impl</artifactId>

NetLicensingClient/src/main/java/com/labs64/netlicensing/domain/Constants.java

@@ -213,6 +213,7 @@ public static final class Shop {
     public static final class Validation {
         public static final String DRY_RUN = "dryRun";
         public static final String FOR_OFFLINE_USE = "forOfflineUse";
+        public static final String NONCE = "nonce";
     }
 
     public static final class ValidationResult {

NetLicensingClient/src/main/java/com/labs64/netlicensing/domain/vo/ValidationParameters.java

@@ -11,6 +11,7 @@ public class ValidationParameters {
     private Map<String, String> licenseeProperties;
     private Boolean dryRun;
     private Boolean forOfflineUse;
+    private String nonce;
     private Map<String, Map<String, String>> parameters;
 
     /**
@@ -107,6 +108,20 @@ public Boolean isForOfflineUse() {
         return forOfflineUse;
     }
 
+    /**
+     * Sets an optional request value that must be returned as the signed validation response identifier.
+     *
+     * @param nonce
+     *            correlation value, up to 255 characters
+     */
+    public void setNonce(final String nonce) {
+        this.nonce = nonce;
+    }
+
+    public String getNonce() {
+        return nonce;
+    }
+
     public Map<String, Map<String, String>> getParameters() {
         if (parameters == null) {
             parameters = new HashMap<>();

NetLicensingClient/src/main/java/com/labs64/netlicensing/exception/BadSignatureException.java

@@ -29,4 +29,16 @@ public BadSignatureException(final String msg) {
         super(msg);
     }
 
+    /**
+     * Construct a <code>BadSignatureException</code> with the specified detail message and cause.
+     *
+     * @param msg
+     *            the detail message
+     * @param cause
+     *            the cause exception
+     */
+    public BadSignatureException(final String msg, final Throwable cause) {
+        super(msg, cause);
+    }
+
 }

NetLicensingClient/src/main/java/com/labs64/netlicensing/provider/RestProviderImpl.java

@@ -111,6 +111,7 @@ public <REQ, RES> RestResponse<RES> call(final String httpMethod, final String u
             final RestResponse<RES> restResponse = new RestResponse<>();
             restResponse.setStatusCode(response.statusCode());
             restResponse.setHeaders(response.headers().map());
+            restResponse.setRawEntity(response.body());
             restResponse.setEntity(readEntity(response.body(), response.statusCode(), responseType));
             return restResponse;
         } catch (final IOException | InterruptedException e) {

NetLicensingClient/src/main/java/com/labs64/netlicensing/provider/RestResponse.java

@@ -34,6 +34,8 @@ public class RestResponse<T> {
 
     private T entity;
 
+    private String rawEntity;
+
     public int getStatusCode() {
         return this.statusCode;
     }
@@ -68,4 +70,12 @@ public void setEntity(final T entity) {
         this.entity = entity;
     }
 
+    public String getRawEntity() {
+        return rawEntity;
+    }
+
+    public void setRawEntity(final String rawEntity) {
+        this.rawEntity = rawEntity;
+    }
+
 }

NetLicensingClient/src/main/java/com/labs64/netlicensing/service/NetLicensingService.java

@@ -25,6 +25,7 @@
 import com.labs64.netlicensing.domain.vo.Context;
 import com.labs64.netlicensing.domain.vo.MetaInfo;
 import com.labs64.netlicensing.domain.vo.Page;
+import com.labs64.netlicensing.exception.BadSignatureException;
 import com.labs64.netlicensing.exception.NetLicensingException;
 import com.labs64.netlicensing.exception.RestException;
 import com.labs64.netlicensing.exception.ServiceException;
@@ -33,6 +34,7 @@
 import com.labs64.netlicensing.provider.RestResponse;
 import com.labs64.netlicensing.schema.SchemaFunction;
 import com.labs64.netlicensing.schema.context.Netlicensing;
+import com.labs64.netlicensing.util.AgentResponseSignatureVerifier;
 import com.labs64.netlicensing.util.CheckUtils;
 import com.labs64.netlicensing.util.SignatureUtils;
 
@@ -170,8 +172,16 @@ void delete(final Context context, final String urlTemplate, final Map<String, S
     public Netlicensing request(final Context context, final HttpMethod method, final String urlTemplate,
             final Form request,
             final Map<String, String> queryParams) throws NetLicensingException {
+        return request(context, method, urlTemplate, request, queryParams, null);
+    }
+
+    Netlicensing request(final Context context, final HttpMethod method, final String urlTemplate,
+            final Form request, final Map<String, String> queryParams, final String expectedLicensee)
+            throws NetLicensingException {
         CheckUtils.paramNotNull(context, "context");
 
+        final String expectedNonce = request == null ? null : request.getParams().get(Constants.Validation.NONCE);
+
         Form combinedRequest = request;
         Map<String, String> combinedQueryParams = queryParams;
         if (StringUtils.isNotBlank(context.getVendorNumber())) {
@@ -190,21 +200,32 @@ public Netlicensing request(final Context context, final HttpMethod method, fina
 
         final RestProviderImpl restProvider = new RestProviderImpl(context.getBaseUrl());
         configure(restProvider, context);
-        
-        final RestResponse<Netlicensing> response = restProvider.call(method.name(), urlTemplate, combinedRequest, Netlicensing.class,
-                combinedQueryParams);
+
+        final RestResponse<Netlicensing> response = restProvider.call(method.name(), urlTemplate, combinedRequest,
+                Netlicensing.class, combinedQueryParams);
 
         if (!isErrorStatus(response.getStatusCode())) {
             switch (response.getStatusCode()) {
-            case 200:
-                final Netlicensing netlicensing = response.getEntity();
-                SignatureUtils.check(context, netlicensing);
-                return netlicensing;
-            case 204:
-                return null;
-            default:
-                throw new RestException(String.format("Unsupported response status code %s.",
-                        response.getStatusCode()));
+                case 200:
+                    final Netlicensing netlicensing = response.getEntity();
+                    if (StringUtils.isNotEmpty(context.getPublicKey()) && netlicensing.getAgentSigning() != null) {
+                        AgentResponseSignatureVerifier.verify(response.getRawEntity(), expectedLicensee,
+                                context.getPublicKey());
+                    } else {
+                        SignatureUtils.check(context, netlicensing);
+                    }
+
+                    if (StringUtils.isNotBlank(expectedNonce) && !expectedNonce.equals(netlicensing.getId())) {
+                        throw new BadSignatureException(
+                                "Validation response identifier does not match the request nonce.");
+                    }
+
+                    return netlicensing;
+                case 204:
+                    return null;
+                default:
+                    throw new RestException(String.format("Unsupported response status code %s.",
+                            response.getStatusCode()));
             }
         } else {
             if (SchemaFunction.hasErrorInfos(response.getEntity())) {

NetLicensingClient/src/main/java/com/labs64/netlicensing/service/ValidationService.java

@@ -80,7 +80,7 @@ public static Netlicensing retrieveValidationFile(final Context context, final S
         final NetLicensingService service = NetLicensingService.getInstance();
         return service.request(context, HttpMethod.POST,
                 Constants.Licensee.ENDPOINT_PATH + "/" + number + "/" + Constants.Licensee.ENDPOINT_PATH_VALIDATE, form,
-                null);
+                null, number);
     }
 
     /**
@@ -121,6 +121,9 @@ private static Form convertValidationParameters(final ValidationParameters valid
             if (Boolean.TRUE.equals(validationParameters.isForOfflineUse())) {
                 form.param(Constants.Validation.FOR_OFFLINE_USE, Boolean.TRUE.toString());
             }
+            if (StringUtils.isNotBlank(validationParameters.getNonce())) {
+                form.param(Constants.Validation.NONCE, validationParameters.getNonce());
+            }
             int pmIndex = 0;
             for (final Entry<String, Map<String, String>> productModuleValidationParams : validationParameters
                     .getParameters().entrySet()) {
@@ -144,4 +147,4 @@ private static ValidationResult convertValidationResult(final Netlicensing valid
             return service.processResponse(meta, validationFile, ValidationResult.class);
         }
     }
-}
+}