Improve certificate path probing with demo UNC target and remove Sonic container scan.
Co-authored-by: Cursor <cursoragent@cursor.com>
This commit is contained in:
Cursor
@@ -0,0 +1,302 @@
|
||||
using System.Security.Cryptography;
|
||||
using System.Security.Cryptography.X509Certificates;
|
||||
using ZA.CoreService.ESBCertificateManager.Models;
|
||||
|
||||
namespace ZA.CoreService.ESBCertificateManager.Services;
|
||||
|
||||
public sealed class CertificateProbeService
|
||||
{
|
||||
public static readonly string[] SupportedExtensions =
|
||||
[
|
||||
".cer",
|
||||
".crt",
|
||||
".pem",
|
||||
".pfx",
|
||||
".p12"
|
||||
];
|
||||
|
||||
public CertificateProbeResult Probe(
|
||||
string certificatePath,
|
||||
Func<string?>? passwordPrompt = null)
|
||||
{
|
||||
string? normalized = NormalizePath(certificatePath);
|
||||
|
||||
if (normalized is null)
|
||||
{
|
||||
return CertificateProbeResult.Failed(
|
||||
"Kein gültiger Zertifikatspfad angegeben.");
|
||||
}
|
||||
|
||||
if (!IsSupportedExtension(normalized))
|
||||
{
|
||||
return CertificateProbeResult.Failed(
|
||||
"Nicht unterstütztes Format. Erlaubt: "
|
||||
+ string.Join(", ", SupportedExtensions));
|
||||
}
|
||||
|
||||
if (!File.Exists(normalized))
|
||||
{
|
||||
return CertificateProbeResult.Missing(
|
||||
normalized,
|
||||
"Am Zielpfad liegt noch keine Zertifikatsdatei.");
|
||||
}
|
||||
|
||||
try
|
||||
{
|
||||
CertificateInfo info = ReadCertificate(normalized, password: null);
|
||||
return CertificateProbeResult.Found(normalized, info);
|
||||
}
|
||||
catch (CryptographicException) when (IsPasswordProtected(normalized))
|
||||
{
|
||||
if (passwordPrompt is null)
|
||||
{
|
||||
return CertificateProbeResult.PasswordRequired(normalized);
|
||||
}
|
||||
|
||||
string? password = passwordPrompt.Invoke();
|
||||
|
||||
if (password is null)
|
||||
{
|
||||
return CertificateProbeResult.Failed(
|
||||
"Zum Lesen der PFX/P12-Datei wird ein Kennwort benötigt.");
|
||||
}
|
||||
|
||||
try
|
||||
{
|
||||
CertificateInfo info = ReadCertificate(normalized, password);
|
||||
return CertificateProbeResult.Found(normalized, info);
|
||||
}
|
||||
catch (CryptographicException)
|
||||
{
|
||||
return CertificateProbeResult.Failed(
|
||||
"Das Kennwort ist falsch oder die Datei ist beschädigt.");
|
||||
}
|
||||
}
|
||||
catch (Exception ex)
|
||||
{
|
||||
return CertificateProbeResult.Failed(
|
||||
$"Zertifikat konnte nicht gelesen werden: {ex.Message}");
|
||||
}
|
||||
}
|
||||
|
||||
public static bool TrySplitTargetPath(
|
||||
string fullPath,
|
||||
out string directory,
|
||||
out string fileName,
|
||||
out string? error)
|
||||
{
|
||||
directory = string.Empty;
|
||||
fileName = string.Empty;
|
||||
error = null;
|
||||
|
||||
string? normalized = NormalizePath(fullPath);
|
||||
|
||||
if (normalized is null)
|
||||
{
|
||||
error = "Bitte einen vollständigen Pfad zur Zertifikatsdatei angeben.";
|
||||
return false;
|
||||
}
|
||||
|
||||
if (!IsSupportedExtension(normalized))
|
||||
{
|
||||
error =
|
||||
"Dateiendung nicht unterstützt. Erlaubt: "
|
||||
+ string.Join(", ", SupportedExtensions);
|
||||
return false;
|
||||
}
|
||||
|
||||
string? dir = Path.GetDirectoryName(normalized);
|
||||
string file = Path.GetFileName(normalized);
|
||||
|
||||
if (string.IsNullOrWhiteSpace(dir) || string.IsNullOrWhiteSpace(file))
|
||||
{
|
||||
error =
|
||||
"Pfad muss Verzeichnis und Dateiname enthalten, z. B.\n"
|
||||
+ @"\\server\e$\...\certs\server.p12";
|
||||
return false;
|
||||
}
|
||||
|
||||
if (Path.GetFileName(file) != file)
|
||||
{
|
||||
error = "Dateiname darf keinen weiteren Verzeichnisanteil enthalten.";
|
||||
return false;
|
||||
}
|
||||
|
||||
directory = dir;
|
||||
fileName = file;
|
||||
return true;
|
||||
}
|
||||
|
||||
public static string CombineTargetPath(
|
||||
string directory,
|
||||
string fileName)
|
||||
{
|
||||
return Path.Combine(
|
||||
directory.Trim().TrimEnd('\\', '/'),
|
||||
fileName.Trim());
|
||||
}
|
||||
|
||||
public static bool IsSupportedExtension(string path)
|
||||
{
|
||||
string extension = Path.GetExtension(path);
|
||||
return SupportedExtensions.Contains(
|
||||
extension,
|
||||
StringComparer.OrdinalIgnoreCase);
|
||||
}
|
||||
|
||||
private static bool IsPasswordProtected(string path)
|
||||
{
|
||||
string extension = Path.GetExtension(path);
|
||||
return extension.Equals(".pfx", StringComparison.OrdinalIgnoreCase)
|
||||
|| extension.Equals(".p12", StringComparison.OrdinalIgnoreCase);
|
||||
}
|
||||
|
||||
private static string? NormalizePath(string? path)
|
||||
{
|
||||
if (string.IsNullOrWhiteSpace(path))
|
||||
{
|
||||
return null;
|
||||
}
|
||||
|
||||
string trimmed = path.Trim().Trim('"');
|
||||
|
||||
if (trimmed.Length == 0)
|
||||
{
|
||||
return null;
|
||||
}
|
||||
|
||||
// UNC und absolute lokale Pfade akzeptieren
|
||||
if (!Path.IsPathRooted(trimmed)
|
||||
&& !trimmed.StartsWith(@"\\", StringComparison.Ordinal))
|
||||
{
|
||||
return null;
|
||||
}
|
||||
|
||||
return trimmed;
|
||||
}
|
||||
|
||||
private static CertificateInfo ReadCertificate(
|
||||
string certificatePath,
|
||||
string? password)
|
||||
{
|
||||
string extension = Path.GetExtension(certificatePath);
|
||||
|
||||
using X509Certificate2 certificate =
|
||||
IsPasswordProtected(certificatePath)
|
||||
? new X509Certificate2(
|
||||
certificatePath,
|
||||
password,
|
||||
X509KeyStorageFlags.EphemeralKeySet)
|
||||
: new X509Certificate2(certificatePath);
|
||||
|
||||
string subject = certificate.GetNameInfo(
|
||||
X509NameType.SimpleName,
|
||||
forIssuer: false);
|
||||
|
||||
string issuer = certificate.GetNameInfo(
|
||||
X509NameType.SimpleName,
|
||||
forIssuer: true);
|
||||
|
||||
if (string.IsNullOrWhiteSpace(subject))
|
||||
{
|
||||
subject = certificate.Subject;
|
||||
}
|
||||
|
||||
if (string.IsNullOrWhiteSpace(issuer))
|
||||
{
|
||||
issuer = certificate.Issuer;
|
||||
}
|
||||
|
||||
string fingerprint = certificate.GetCertHashString(
|
||||
HashAlgorithmName.SHA256);
|
||||
|
||||
fingerprint = string.Join(
|
||||
":",
|
||||
Enumerable.Range(0, fingerprint.Length / 2)
|
||||
.Select(index => fingerprint.Substring(index * 2, 2)));
|
||||
|
||||
DateTimeOffset validFrom = new(certificate.NotBefore);
|
||||
DateTimeOffset validUntil = new(certificate.NotAfter);
|
||||
DateTimeOffset now = DateTimeOffset.Now;
|
||||
|
||||
return new CertificateInfo
|
||||
{
|
||||
Subject = subject,
|
||||
Issuer = issuer,
|
||||
FingerprintSha256 = fingerprint,
|
||||
ValidFrom = validFrom,
|
||||
ValidUntil = validUntil,
|
||||
IsCurrentlyValid = now >= validFrom && now <= validUntil
|
||||
};
|
||||
}
|
||||
}
|
||||
|
||||
public sealed class CertificateProbeResult
|
||||
{
|
||||
public bool Success { get; init; }
|
||||
|
||||
public bool FileExists { get; init; }
|
||||
|
||||
public string Path { get; init; } = string.Empty;
|
||||
|
||||
public string Message { get; init; } = string.Empty;
|
||||
|
||||
public CertificateInfo? Certificate { get; init; }
|
||||
|
||||
public static CertificateProbeResult Found(
|
||||
string path,
|
||||
CertificateInfo certificate)
|
||||
{
|
||||
string expiry = certificate.ValidUntil.ToLocalTime()
|
||||
.ToString("dd.MM.yyyy HH:mm");
|
||||
|
||||
string validity = certificate.IsCurrentlyValid
|
||||
? "gültig"
|
||||
: "abgelaufen / ungültig";
|
||||
|
||||
return new CertificateProbeResult
|
||||
{
|
||||
Success = true,
|
||||
FileExists = true,
|
||||
Path = path,
|
||||
Certificate = certificate,
|
||||
Message =
|
||||
$"Zertifikat gefunden · Subject: {certificate.Subject} · "
|
||||
+ $"Ablauf: {expiry} ({validity})"
|
||||
};
|
||||
}
|
||||
|
||||
public static CertificateProbeResult Missing(
|
||||
string path,
|
||||
string message)
|
||||
{
|
||||
return new CertificateProbeResult
|
||||
{
|
||||
Success = true,
|
||||
FileExists = false,
|
||||
Path = path,
|
||||
Message = message
|
||||
};
|
||||
}
|
||||
|
||||
public static CertificateProbeResult Failed(string message)
|
||||
{
|
||||
return new CertificateProbeResult
|
||||
{
|
||||
Success = false,
|
||||
FileExists = false,
|
||||
Message = message
|
||||
};
|
||||
}
|
||||
|
||||
public static CertificateProbeResult PasswordRequired(string path)
|
||||
{
|
||||
return new CertificateProbeResult
|
||||
{
|
||||
Success = false,
|
||||
FileExists = true,
|
||||
Path = path,
|
||||
Message = "PFX/P12 vorhanden – Kennwort nötig zum Lesen des Ablaufs"
|
||||
};
|
||||
}
|
||||
}
|
||||
Reference in New Issue
Block a user