| /* |
| * Copyright (c) 2015, Oracle and/or its affiliates. All rights reserved. |
| * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. |
| * |
| * This code is free software; you can redistribute it and/or modify it |
| * under the terms of the GNU General Public License version 2 only, as |
| * published by the Free Software Foundation. |
| * |
| * This code is distributed in the hope that it will be useful, but WITHOUT |
| * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or |
| * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License |
| * version 2 for more details (a copy is included in the LICENSE file that |
| * accompanied this code). |
| * |
| * You should have received a copy of the GNU General Public License version |
| * 2 along with this work; if not, write to the Free Software Foundation, |
| * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA. |
| * |
| * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA |
| * or visit www.oracle.com if you need additional information or have any |
| * questions. |
| */ |
| |
| /* |
| * @test |
| * @bug 8046321 |
| * @summary OCSP Stapling for TLS (ResponderId tests) |
| * @modules java.base/sun.security.provider.certpath |
| * java.base/sun.security.x509 |
| */ |
| |
| import java.io.*; |
| import java.security.cert.*; |
| import java.security.KeyPair; |
| import java.security.KeyPairGenerator; |
| import java.util.AbstractMap; |
| import java.util.Arrays; |
| import java.util.Map; |
| import java.util.List; |
| import java.util.ArrayList; |
| import javax.security.auth.x500.X500Principal; |
| import sun.security.x509.KeyIdentifier; |
| import sun.security.provider.certpath.ResponderId; |
| |
| /* |
| * NOTE: this test uses Sun private classes which are subject to change. |
| */ |
| public class ResponderIdTests { |
| |
| private static final boolean debug = true; |
| |
| // Source certificate created with the following command: |
| // keytool -genkeypair -alias test1 -keyalg rsa -keysize 2048 \ |
| // -validity 7300 -keystore test1.jks \ |
| // -dname "CN=SelfSignedResponder, OU=Validation Services, O=FakeCompany" |
| private static final String RESP_CERT_1 = |
| "-----BEGIN CERTIFICATE-----\n" + |
| "MIIDQzCCAiugAwIBAgIEXTqCCjANBgkqhkiG9w0BAQsFADBSMRQwEgYDVQQKEwtG\n" + |
| "YWtlQ29tcGFueTEcMBoGA1UECxMTVmFsaWRhdGlvbiBTZXJ2aWNlczEcMBoGA1UE\n" + |
| "AxMTU2VsZlNpZ25lZFJlc3BvbmRlcjAeFw0xNDA4MTcwNDM2MzBaFw0zNDA4MTIw\n" + |
| "NDM2MzBaMFIxFDASBgNVBAoTC0Zha2VDb21wYW55MRwwGgYDVQQLExNWYWxpZGF0\n" + |
| "aW9uIFNlcnZpY2VzMRwwGgYDVQQDExNTZWxmU2lnbmVkUmVzcG9uZGVyMIIBIjAN\n" + |
| "BgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEApt2Cmw2k9tviLxaxE8aWNuoosWKL\n" + |
| "h+K4mNcDGKSoiChsqRqeJEnOxijDZqyFwfkaXvpAduFqYjz+Lij2HumvAjHDTui6\n" + |
| "bGcbsndRDPjvVo1S7f1oWsg7oiA8Lzmjl452S7UNBsDX5Dt1e84Xxwi40B1J2y8D\n" + |
| "FRPfYRWRlC1Z4kzqkBBa7JhANS+W8KDstFZxL4AwWH/byNwB5dl2j04ohg/Ar54e\n" + |
| "mu08PIH3hmi0pAu5wn9ariA7UA5lFWRJzvgGXV5J+QVEFuvKmeJ/Q6tU5OBJGw98\n" + |
| "zjd7F5B0iE+rJHTNF1aGaQfIorz04onV2WjH2VZA18AaMwqlY2br1SBdTQIDAQAB\n" + |
| "oyEwHzAdBgNVHQ4EFgQUG09HasSTYaTIh/CxxV/rcJV1LvowDQYJKoZIhvcNAQEL\n" + |
| "BQADggEBAIcUomNpZxGkocIzzybLyeyC6vLF1k0/unuPAHZLDP3o2JTstPhLHOCg\n" + |
| "FYw1VG2i23pjwKK2x/o80tJAOmW6vowbAPnNmtNIYO3gB/ZGiKeORoGKBCRDNvFa\n" + |
| "6ZrWxwTzT3EpVwRe7ameES0uP8+S4q2P5LhwMIMw7vGHoOQJgkAh/NUiCli1qRnJ\n" + |
| "FYd6cHMJJK5gF2FqQ7tdbA26pS06bkIEvil2M5wyKKWOydOa/pr1LgMf9KxljJ8J\n" + |
| "XlAOO/mGZGkYmWnQaQuBIDyWunWYlhsyCXMa8AScgs0uUeQp19tO7R0f03q/JXoZ\n" + |
| "1At1gZiMS7SdQaRWP5q+FunAeFWjsFE=\n" + |
| "-----END CERTIFICATE-----"; |
| |
| private static final String RESP_CERT_1_SUBJ = |
| "CN=SelfSignedResponder, OU=Validation Services, O=FakeCompany"; |
| |
| private static X509Certificate cert = null; |
| |
| // The expected DER-encoding for a byName ResponderId derived |
| // from RESP_CERT_1 |
| private static final byte[] EXP_NAME_ID_BYTES = { |
| -95, 84, 48, 82, 49, 20, 48, 18, |
| 6, 3, 85, 4, 10, 19, 11, 70, |
| 97, 107, 101, 67, 111, 109, 112, 97, |
| 110, 121, 49, 28, 48, 26, 6, 3, |
| 85, 4, 11, 19, 19, 86, 97, 108, |
| 105, 100, 97, 116, 105, 111, 110, 32, |
| 83, 101, 114, 118, 105, 99, 101, 115, |
| 49, 28, 48, 26, 6, 3, 85, 4, |
| 3, 19, 19, 83, 101, 108, 102, 83, |
| 105, 103, 110, 101, 100, 82, 101, 115, |
| 112, 111, 110, 100, 101, 114 |
| }; |
| |
| // The expected DER-encoding for a byKey ResponderId derived |
| // from RESP_CERT_1 |
| private static final byte[] EXP_KEY_ID_BYTES = { |
| -94, 22, 4, 20, 27, 79, 71, 106, |
| -60, -109, 97, -92, -56, -121, -16, -79, |
| -59, 95, -21, 112, -107, 117, 46, -6 |
| }; |
| |
| // The DER encoding of a byKey ResponderId, but using an |
| // incorrect explicit tagging (CONTEXT CONSTRUCTED 3) |
| private static final byte[] INV_EXPLICIT_TAG_KEY_ID = { |
| -93, 22, 4, 20, 27, 79, 71, 106, |
| -60, -109, 97, -92, -56, -121, -16, -79, |
| -59, 95, -21, 112, -107, 117, 46, -6 |
| }; |
| |
| // These two ResponderId objects will have objects attached to them |
| // after the pos_CtorByName and pos_CtorByKeyId tests run. Those |
| // two tests should always be the first two that run. |
| public static ResponderId respByName; |
| public static ResponderId respByKeyId; |
| |
| public static void main(String[] args) throws Exception { |
| List<TestCase> testList = new ArrayList<>(); |
| |
| testList.add(pos_CtorByName); |
| testList.add(pos_CtorByKeyId); |
| testList.add(pos_CtorByEncoding); |
| testList.add(neg_CtorByEncoding); |
| testList.add(pos_Equality); |
| testList.add(pos_GetEncoded); |
| testList.add(pos_GetRespName); |
| testList.add(pos_GetRespKeyId); |
| |
| // Load the certificate object we can use for subsequent tests |
| CertificateFactory cf = CertificateFactory.getInstance("X.509"); |
| cert = (X509Certificate)cf.generateCertificate( |
| new ByteArrayInputStream(RESP_CERT_1.getBytes())); |
| |
| System.out.println("============ Tests ============"); |
| int testNo = 0; |
| int numberFailed = 0; |
| Map.Entry<Boolean, String> result; |
| for (TestCase test : testList) { |
| System.out.println("Test " + ++testNo + ": " + test.getName()); |
| result = test.runTest(); |
| System.out.print("Result: " + (result.getKey() ? "PASS" : "FAIL")); |
| System.out.println(" " + |
| (result.getValue() != null ? result.getValue() : "")); |
| System.out.println("-------------------------------------------"); |
| if (!result.getKey()) { |
| numberFailed++; |
| } |
| } |
| System.out.println("End Results: " + (testList.size() - numberFailed) + |
| " Passed" + ", " + numberFailed + " Failed."); |
| if (numberFailed > 0) { |
| throw new RuntimeException( |
| "One or more tests failed, see test output for details"); |
| } |
| } |
| |
| private static void dumpHexBytes(byte[] data) { |
| if (data != null) { |
| for (int i = 0; i < data.length; i++) { |
| if (i % 16 == 0 && i != 0) { |
| System.out.print("\n"); |
| } |
| System.out.print(String.format("%02X ", data[i])); |
| } |
| System.out.print("\n"); |
| } |
| } |
| |
| public interface TestCase { |
| String getName(); |
| Map.Entry<Boolean, String> runTest(); |
| } |
| |
| public static final TestCase pos_CtorByName = new TestCase() { |
| @Override |
| public String getName() { |
| return "CTOR Test (by-name)"; |
| } |
| |
| @Override |
| public Map.Entry<Boolean, String> runTest() { |
| Boolean pass = Boolean.FALSE; |
| String message = null; |
| try { |
| respByName = new ResponderId(cert.getSubjectX500Principal()); |
| pass = Boolean.TRUE; |
| } catch (Exception e) { |
| e.printStackTrace(System.out); |
| message = e.getClass().getName(); |
| } |
| |
| return new AbstractMap.SimpleEntry<>(pass, message); |
| } |
| }; |
| |
| public static final TestCase pos_CtorByKeyId = new TestCase() { |
| @Override |
| public String getName() { |
| return "CTOR Test (by-keyID)"; |
| } |
| |
| @Override |
| public Map.Entry<Boolean, String> runTest() { |
| Boolean pass = Boolean.FALSE; |
| String message = null; |
| try { |
| respByKeyId = new ResponderId(cert.getPublicKey()); |
| pass = Boolean.TRUE; |
| } catch (Exception e) { |
| e.printStackTrace(System.out); |
| message = e.getClass().getName(); |
| } |
| |
| return new AbstractMap.SimpleEntry<>(pass, message); |
| } |
| }; |
| |
| public static final TestCase pos_CtorByEncoding = new TestCase() { |
| @Override |
| public String getName() { |
| return "CTOR Test (encoded bytes)"; |
| } |
| |
| @Override |
| public Map.Entry<Boolean, String> runTest() { |
| Boolean pass = Boolean.FALSE; |
| String message = null; |
| try { |
| ResponderId ridByNameBytes = new ResponderId(EXP_NAME_ID_BYTES); |
| ResponderId ridByKeyIdBytes = new ResponderId(EXP_KEY_ID_BYTES); |
| |
| if (!ridByNameBytes.equals(respByName)) { |
| throw new RuntimeException( |
| "Equals failed: respNameFromBytes vs. respByName"); |
| } else if (!ridByKeyIdBytes.equals(respByKeyId)) { |
| throw new RuntimeException( |
| "Equals failed: respKeyFromBytes vs. respByKeyId"); |
| } |
| pass = Boolean.TRUE; |
| } catch (Exception e) { |
| e.printStackTrace(System.out); |
| message = e.getClass().getName(); |
| } |
| |
| return new AbstractMap.SimpleEntry<>(pass, message); |
| } |
| }; |
| |
| public static final TestCase neg_CtorByEncoding = new TestCase() { |
| @Override |
| public String getName() { |
| return "CTOR Test (by encoding, unknown explicit tag)"; |
| } |
| |
| @Override |
| public Map.Entry<Boolean, String> runTest() { |
| Boolean pass = Boolean.FALSE; |
| String message = null; |
| try { |
| ResponderId ridByKeyIdBytes = |
| new ResponderId(INV_EXPLICIT_TAG_KEY_ID); |
| throw new RuntimeException("Expected IOException not thrown"); |
| } catch (IOException ioe) { |
| // Make sure it's the IOException we're looking for |
| if (ioe.getMessage().contains("Invalid ResponderId content")) { |
| pass = Boolean.TRUE; |
| } else { |
| ioe.printStackTrace(System.out); |
| message = ioe.getClass().getName(); |
| } |
| } catch (Exception e) { |
| e.printStackTrace(System.out); |
| message = e.getClass().getName(); |
| } |
| |
| return new AbstractMap.SimpleEntry<>(pass, message); |
| } |
| }; |
| |
| |
| public static final TestCase pos_Equality = new TestCase() { |
| @Override |
| public String getName() { |
| return "Simple Equality Test"; |
| } |
| |
| @Override |
| public Map.Entry<Boolean, String> runTest() { |
| Boolean pass = Boolean.FALSE; |
| String message = null; |
| |
| try { |
| // byName ResponderId equality test |
| ResponderId compName = |
| new ResponderId(new X500Principal(RESP_CERT_1_SUBJ)); |
| if (!respByName.equals(compName)) { |
| message = "ResponderId mismatch in byName comparison"; |
| } else if (respByKeyId.equals(compName)) { |
| message = "Invalid ResponderId match in byKeyId comparison"; |
| } else { |
| pass = Boolean.TRUE; |
| } |
| } catch (Exception e) { |
| e.printStackTrace(System.out); |
| message = e.getClass().getName(); |
| } |
| |
| return new AbstractMap.SimpleEntry<>(pass, message); |
| } |
| }; |
| |
| public static final TestCase pos_GetEncoded = new TestCase() { |
| @Override |
| public String getName() { |
| return "Get Encoded Value"; |
| } |
| |
| @Override |
| public Map.Entry<Boolean, String> runTest() { |
| Boolean pass = Boolean.FALSE; |
| String message = null; |
| |
| try { |
| // Pull out byName and byKey encodings, they should match |
| // the expected values |
| if (!Arrays.equals(respByName.getEncoded(), EXP_NAME_ID_BYTES)) { |
| message = "ResponderId byName encoding did not " + |
| "match expected value"; |
| } else if (!Arrays.equals(respByKeyId.getEncoded(), EXP_KEY_ID_BYTES)) { |
| message = "ResponderId byKeyId encoding did not " + |
| "match expected value"; |
| } else { |
| pass = Boolean.TRUE; |
| } |
| } catch (Exception e) { |
| e.printStackTrace(System.out); |
| message = e.getClass().getName(); |
| } |
| |
| return new AbstractMap.SimpleEntry<>(pass, message); |
| } |
| }; |
| |
| public static final TestCase pos_GetRespName = new TestCase() { |
| @Override |
| public String getName() { |
| return "Get Underlying Responder Name"; |
| } |
| |
| @Override |
| public Map.Entry<Boolean, String> runTest() { |
| Boolean pass = Boolean.FALSE; |
| String message = null; |
| |
| try { |
| // Test methods for pulling out the underlying |
| // X500Principal object |
| X500Principal testPrincipal = |
| new X500Principal(RESP_CERT_1_SUBJ); |
| if (!respByName.getResponderName().equals(testPrincipal)) { |
| message = "ResponderId Name did not match expected value"; |
| } else if (respByKeyId.getResponderName() != null) { |
| message = "Non-null responder name returned from " + |
| "ResponderId constructed byKey"; |
| } else { |
| pass = Boolean.TRUE; |
| } |
| } catch (Exception e) { |
| e.printStackTrace(System.out); |
| message = e.getClass().getName(); |
| } |
| |
| return new AbstractMap.SimpleEntry<>(pass, message); |
| } |
| }; |
| |
| public static final TestCase pos_GetRespKeyId = new TestCase() { |
| @Override |
| public String getName() { |
| return "Get Underlying Responder Key ID"; |
| } |
| |
| @Override |
| public Map.Entry<Boolean, String> runTest() { |
| Boolean pass = Boolean.FALSE; |
| String message = null; |
| |
| try { |
| // Test methods for pulling out the underlying |
| // KeyIdentifier object. Note: There is a minute chance that |
| // an RSA public key, once hashed into a key ID might collide |
| // with the one extracted from the certificate used to create |
| // respByKeyId. This is so unlikely to happen it is considered |
| // virtually impossible. |
| KeyPairGenerator kpg = KeyPairGenerator.getInstance("RSA"); |
| kpg.initialize(2048); |
| KeyPair rsaKey = kpg.generateKeyPair(); |
| KeyIdentifier testKeyId = new KeyIdentifier(rsaKey.getPublic()); |
| |
| if (respByKeyId.getKeyIdentifier().equals(testKeyId)) { |
| message = "Unexpected match in ResponderId Key ID"; |
| } else if (respByName.getKeyIdentifier() != null) { |
| message = "Non-null key ID returned from " + |
| "ResponderId constructed byName"; |
| } else { |
| pass = Boolean.TRUE; |
| } |
| } catch (Exception e) { |
| e.printStackTrace(System.out); |
| message = e.getClass().getName(); |
| } |
| |
| return new AbstractMap.SimpleEntry<>(pass, message); |
| } |
| }; |
| |
| } |