tests/org/cacert/gigi/pages/account/TestCertificateAdd.java

   1 package org.cacert.gigi.pages.account;
   2
   3 import static org.hamcrest.CoreMatchers.*;
   4 import static org.junit.Assert.*;
   5
   6 import java.io.ByteArrayInputStream;
   7 import java.io.IOException;
   8 import java.io.InputStreamReader;
   9 import java.io.OutputStream;
  10 import java.io.UnsupportedEncodingException;
  11 import java.net.HttpURLConnection;
  12 import java.net.MalformedURLException;
  13 import java.net.URL;
  14 import java.net.URLConnection;
  15 import java.net.URLEncoder;
  16 import java.security.GeneralSecurityException;
  17 import java.security.KeyPair;
  18 import java.security.Signature;
  19 import java.security.cert.CertificateException;
  20 import java.security.cert.CertificateFactory;
  21 import java.security.cert.X509Certificate;
  22 import java.text.SimpleDateFormat;
  23 import java.util.Arrays;
  24 import java.util.Base64;
  25 import java.util.Calendar;
  26 import java.util.Date;
  27 import java.util.TimeZone;
  28 import java.util.Vector;
  29 import java.util.regex.Matcher;
  30 import java.util.regex.Pattern;
  31
  32 import org.cacert.gigi.crypto.SPKAC;
  33 import org.cacert.gigi.dbObjects.Digest;
  34 import org.cacert.gigi.pages.account.certs.CertificateAdd;
  35 import org.cacert.gigi.pages.account.certs.CertificateRequest;
  36 import org.cacert.gigi.testUtils.ClientTest;
  37 import org.cacert.gigi.testUtils.IOUtils;
  38 import org.cacert.gigi.util.PEM;
  39 import org.junit.Test;
  40
  41 import sun.security.pkcs.PKCS7;
  42 import sun.security.pkcs.PKCS9Attribute;
  43 import sun.security.pkcs10.PKCS10Attribute;
  44 import sun.security.pkcs10.PKCS10Attributes;
  45 import sun.security.util.ObjectIdentifier;
  46 import sun.security.x509.CertificateExtensions;
  47 import sun.security.x509.DNSName;
  48 import sun.security.x509.ExtendedKeyUsageExtension;
  49 import sun.security.x509.GeneralName;
  50 import sun.security.x509.GeneralNameInterface;
  51 import sun.security.x509.GeneralNames;
  52 import sun.security.x509.RFC822Name;
  53 import sun.security.x509.SubjectAlternativeNameExtension;
  54 import sun.security.x509.X509Key;
  55
  56 public class TestCertificateAdd extends ClientTest {
  57
  58     KeyPair kp = generateKeypair();
  59
  60     String csrf;
  61
  62     public TestCertificateAdd() throws GeneralSecurityException, IOException {
  63         TestDomain.addDomain(cookie, uniq + ".tld");
  64
  65     }
  66
  67     @Test
  68     public void testSimpleServer() throws IOException, GeneralSecurityException {
  69         PKCS10Attributes atts = buildAtts(new ObjectIdentifier[] {
  70             CertificateRequest.OID_KEY_USAGE_SSL_SERVER
  71         }, new DNSName(uniq + ".tld"));
  72
  73         String pem = generatePEMCSR(kp, "CN=a." + uniq + ".tld", atts);
  74
  75         String[] res = fillOutForm("CSR=" + URLEncoder.encode(pem, "UTF-8"));
  76         assertArrayEquals(new String[] {
  77                 "server", "CAcert WoT User", "dns:a." + uniq + ".tld\ndns:" + uniq + ".tld\n", Digest.SHA256.toString()
  78         }, res);
  79     }
  80
  81     @Test
  82     public void testSimpleMail() throws IOException, GeneralSecurityException {
  83         PKCS10Attributes atts = buildAtts(new ObjectIdentifier[] {
  84             CertificateRequest.OID_KEY_USAGE_EMAIL_PROTECTION
  85         }, new DNSName("a." + uniq + ".tld"), new DNSName("b." + uniq + ".tld"), new RFC822Name(email));
  86
  87         String pem = generatePEMCSR(kp, "CN=a b", atts, "SHA384WithRSA");
  88
  89         String[] res = fillOutForm("CSR=" + URLEncoder.encode(pem, "UTF-8"));
  90         assertArrayEquals(new String[] {
  91                 "mail", "a b", "email:" + email + "\ndns:a." + uniq + ".tld\ndns:b." + uniq + ".tld\n", Digest.SHA384.toString()
  92         }, res);
  93     }
  94
  95     @Test
  96     public void testSimpleClient() throws IOException, GeneralSecurityException {
  97         PKCS10Attributes atts = buildAtts(new ObjectIdentifier[] {
  98             CertificateRequest.OID_KEY_USAGE_SSL_CLIENT
  99         }, new RFC822Name(email));
 100
 101         String pem = generatePEMCSR(kp, "CN=a b,email=" + email, atts, "SHA512WithRSA");
 102
 103         String[] res = fillOutForm("CSR=" + URLEncoder.encode(pem, "UTF-8"));
 104         assertArrayEquals(new String[] {
 105                 "client", "a b", "email:" + email + "\n", Digest.SHA512.toString()
 106         }, res);
 107     }
 108
 109     @Test
 110     public void testSPKAC() throws GeneralSecurityException, IOException {
 111         testSPKAC(false);
 112         testSPKAC(true);
 113     }
 114
 115     @Test
 116     public void testIssue() throws IOException, GeneralSecurityException {
 117         PKCS10Attributes atts = buildAtts(new ObjectIdentifier[] {
 118             CertificateRequest.OID_KEY_USAGE_SSL_CLIENT
 119         }, new RFC822Name(email));
 120
 121         String pem = generatePEMCSR(kp, "CN=a b,email=" + email, atts, "SHA512WithRSA");
 122
 123         String[] res = fillOutForm("CSR=" + URLEncoder.encode(pem, "UTF-8"));
 124         assertArrayEquals(new String[] {
 125                 "client", "a b", "email:" + email + "\n", Digest.SHA512.toString()
 126         }, res);
 127
 128         HttpURLConnection huc = (HttpURLConnection) ncert.openConnection();
 129         huc.setRequestProperty("Cookie", cookie);
 130         huc.setDoOutput(true);
 131         OutputStream out = huc.getOutputStream();
 132         out.write(("csrf=" + URLEncoder.encode(csrf, "UTF-8")).getBytes("UTF-8"));
 133         out.write(("&CN=CAcert+WoT+User&profile=client&SANs=" + URLEncoder.encode("email:" + email + "\n", "UTF-8")).getBytes("UTF-8"));
 134         out.write(("&hash_alg=SHA512&CCA=y").getBytes("UTF-8"));
 135         URLConnection uc = authenticate(new URL(huc.getHeaderField("Location") + ".crt"));
 136         String crt = IOUtils.readURL(new InputStreamReader(uc.getInputStream(), "UTF-8"));
 137
 138         uc = authenticate(new URL(huc.getHeaderField("Location") + ".cer"));
 139         byte[] cer = IOUtils.readURL(uc.getInputStream());
 140         assertArrayEquals(cer, PEM.decode("CERTIFICATE", crt));
 141
 142         uc = authenticate(new URL(huc.getHeaderField("Location") + ".cer?install&chain"));
 143         byte[] pkcs7 = IOUtils.readURL(uc.getInputStream());
 144         PKCS7 p7 = new PKCS7(pkcs7);
 145         byte[] sub = verifyChain(p7.getCertificates());
 146         assertArrayEquals(cer, sub);
 147         assertEquals("application/x-x509-user-cert", uc.getHeaderField("Content-type"));
 148
 149         uc = authenticate(new URL(huc.getHeaderField("Location")));
 150         String gui = IOUtils.readURL(uc);
 151         assertThat(gui, containsString("clientAuth"));
 152         assertThat(gui, containsString("CN=CAcert WoT User"));
 153         assertThat(gui, containsString("SHA512withRSA"));
 154         assertThat(gui, containsString("RFC822Name: " + email));
 155
 156     }
 157
 158     private byte[] verifyChain(X509Certificate[] x509Certificates) throws GeneralSecurityException {
 159         X509Certificate current = null;
 160         nextCert:
 161         while (true) {
 162             for (int i = 0; i < x509Certificates.length; i++) {
 163                 X509Certificate cert = x509Certificates[i];
 164                 if (current == null) {
 165                     if (cert.getSubjectX500Principal().equals(cert.getIssuerX500Principal())) {
 166                         current = cert;
 167                         continue nextCert;
 168                     }
 169                 } else {
 170                     if (cert.getSubjectX500Principal().equals(cert.getIssuerX500Principal())) {
 171                         continue;
 172                     }
 173                     if (current.getSubjectX500Principal().equals(cert.getIssuerX500Principal())) {
 174                         Signature s = Signature.getInstance(cert.getSigAlgName());
 175                         s.initVerify(current.getPublicKey());
 176                         s.update(cert.getTBSCertificate());
 177                         assertTrue(s.verify(cert.getSignature()));
 178                         current = cert;
 179                         continue nextCert;
 180                     }
 181                 }
 182             }
 183             assertNotNull(current);
 184             return current.getEncoded();
 185         }
 186     }
 187
 188     @Test
 189     public void testValidityPeriodCalendar() throws IOException, GeneralSecurityException {
 190         testCertificateValidityRelative(Calendar.YEAR, 2, "2y", true);
 191         testCertificateValidityRelative(Calendar.YEAR, 1, "1y", true);
 192         testCertificateValidityRelative(Calendar.MONTH, 3, "3m", true);
 193         testCertificateValidityRelative(Calendar.MONTH, 7, "7m", true);
 194         testCertificateValidityRelative(Calendar.MONTH, 13, "13m", true);
 195
 196         testCertificateValidityRelative(Calendar.MONTH, 13, "-1m", false);
 197     }
 198
 199     @Test
 200     public void testValidityPeriodWhishStart() throws IOException, GeneralSecurityException {
 201         long now = System.currentTimeMillis();
 202         final long MS_PER_DAY = 24 * 60 * 60 * 1000;
 203         now -= now % MS_PER_DAY;
 204         now += MS_PER_DAY;
 205         SimpleDateFormat sdf = new SimpleDateFormat("yyyy-MM-dd");
 206         sdf.setTimeZone(TimeZone.getTimeZone("UTC"));
 207
 208         Date start = new Date(now);
 209         Date end = new Date(now + MS_PER_DAY * 10);
 210         String validity = "&validFrom=" + sdf.format(start) + "&validity=" + sdf.format(end);
 211         X509Certificate res = createCertWithValidity(validity);
 212         assertNotNull(validity, res);
 213         assertEquals(start, res.getNotBefore());
 214         assertEquals(end, res.getNotAfter());
 215     }
 216
 217     private void testCertificateValidityRelative(int field, int amount, String length, boolean shouldsucceed) throws IOException, GeneralSecurityException, UnsupportedEncodingException, MalformedURLException, CertificateException {
 218         X509Certificate parsed = createCertWithValidity("&validFrom=now&validity=" + length);
 219         if (parsed == null) {
 220             assertTrue( !shouldsucceed);
 221             return;
 222         } else {
 223             assertTrue(shouldsucceed);
 224         }
 225
 226         long now = System.currentTimeMillis();
 227         Date start = parsed.getNotBefore();
 228         Date end = parsed.getNotAfter();
 229         Calendar c = Calendar.getInstance();
 230         c.setTimeZone(TimeZone.getTimeZone("UTC"));
 231         c.setTime(start);
 232         c.add(field, amount);
 233         assertTrue(Math.abs(start.getTime() - now) < 10000);
 234         assertEquals(c.getTime(), end);
 235     }
 236
 237     private X509Certificate createCertWithValidity(String validity) throws IOException, GeneralSecurityException, UnsupportedEncodingException, MalformedURLException, CertificateException {
 238         PKCS10Attributes atts = buildAtts(new ObjectIdentifier[] {
 239             CertificateRequest.OID_KEY_USAGE_SSL_CLIENT
 240         }, new RFC822Name(email));
 241
 242         String pem = generatePEMCSR(kp, "CN=a b", atts, "SHA512WithRSA");
 243         fillOutForm("CSR=" + URLEncoder.encode(pem, "UTF-8"));
 244
 245         HttpURLConnection huc = (HttpURLConnection) ncert.openConnection();
 246         huc.setRequestProperty("Cookie", cookie);
 247         huc.setDoOutput(true);
 248         OutputStream out = huc.getOutputStream();
 249         out.write(("csrf=" + URLEncoder.encode(csrf, "UTF-8")).getBytes("UTF-8"));
 250         out.write(("&profile=client&CN=" + CertificateRequest.DEFAULT_CN + "&SANs=" + URLEncoder.encode("email:" + email + "\n", "UTF-8")).getBytes("UTF-8"));
 251         out.write(("&hash_alg=SHA512&CCA=y&").getBytes("UTF-8"));
 252         out.write(validity.getBytes("UTF-8"));
 253
 254         String certurl = huc.getHeaderField("Location");
 255         if (certurl == null) {
 256             return null;
 257         }
 258         URLConnection uc = authenticate(new URL(certurl + ".crt"));
 259         String crt = IOUtils.readURL(new InputStreamReader(uc.getInputStream(), "UTF-8"));
 260
 261         CertificateFactory cf = CertificateFactory.getInstance("X.509");
 262         X509Certificate parsed = (X509Certificate) cf.generateCertificate(new ByteArrayInputStream(crt.getBytes("UTF-8")));
 263         return parsed;
 264     }
 265
 266     private URLConnection authenticate(URL url) throws IOException {
 267         URLConnection uc = url.openConnection();
 268         uc.setRequestProperty("Cookie", cookie);
 269         return uc;
 270     }
 271
 272     protected String testSPKAC(boolean correctChallange) throws GeneralSecurityException, IOException {
 273         HttpURLConnection uc = (HttpURLConnection) ncert.openConnection();
 274         uc.setRequestProperty("Cookie", cookie);
 275         String s = IOUtils.readURL(uc);
 276
 277         csrf = extractPattern(s, Pattern.compile("<input [^>]*name='csrf' [^>]*value='([^']*)'>"));
 278         String challenge = extractPattern(s, Pattern.compile("<keygen [^>]*name=\"SPKAC\" [^>]*challenge=\"([^\"]*)\"/>"));
 279
 280         SPKAC spk = new SPKAC((X509Key) kp.getPublic(), challenge + (correctChallange ? "" : "b"));
 281         Signature sign = Signature.getInstance("SHA512WithRSA");
 282         sign.initSign(kp.getPrivate());
 283         try {
 284             String[] res = fillOutFormDirect("SPKAC=" + URLEncoder.encode(Base64.getEncoder().encodeToString(spk.getEncoded(sign)), "UTF-8"));
 285             if ( !correctChallange) {
 286                 fail("Should not succeed with wrong challange.");
 287             }
 288             assertArrayEquals(new String[] {
 289                     "client", CertificateRequest.DEFAULT_CN, "", Digest.SHA512.toString()
 290             }, res);
 291         } catch (Error e) {
 292             assertTrue(e.getMessage().startsWith("<div>Challenge mismatch"));
 293         }
 294         return csrf;
 295     }
 296
 297     private PKCS10Attributes buildAtts(ObjectIdentifier[] ekuOIDs, GeneralNameInterface... SANs) throws IOException {
 298         CertificateExtensions attributeValue = new CertificateExtensions();
 299         GeneralNames names = new GeneralNames();
 300
 301         for (GeneralNameInterface name : SANs) {
 302             names.add(new GeneralName(name));
 303         }
 304         attributeValue.set("SANs", new SubjectAlternativeNameExtension(names));
 305         PKCS10Attributes atts = new PKCS10Attributes(new PKCS10Attribute[] {
 306             new PKCS10Attribute(PKCS9Attribute.EXTENSION_REQUEST_OID, attributeValue)
 307         });
 308         ExtendedKeyUsageExtension eku = new ExtendedKeyUsageExtension(//
 309                 new Vector<>(Arrays.<ObjectIdentifier>asList(ekuOIDs)));
 310         attributeValue.set("eku", eku);
 311         return atts;
 312     }
 313
 314     private final URL ncert = new URL("https://" + getServerName() + CertificateAdd.PATH);
 315
 316     private String[] fillOutForm(String pem) throws IOException {
 317         HttpURLConnection uc = (HttpURLConnection) ncert.openConnection();
 318         uc.setRequestProperty("Cookie", cookie);
 319         csrf = getCSRF(uc);
 320         return fillOutFormDirect(pem);
 321
 322     }
 323
 324     private String[] fillOutFormDirect(String pem) throws IOException {
 325
 326         HttpURLConnection uc = (HttpURLConnection) ncert.openConnection();
 327         uc.setRequestProperty("Cookie", cookie);
 328         uc.setDoOutput(true);
 329         uc.getOutputStream().write(("csrf=" + URLEncoder.encode(csrf, "UTF-8") + "&" + pem).getBytes("UTF-8"));
 330         uc.getOutputStream().flush();
 331
 332         return extractFormData(uc);
 333     }
 334
 335     private String[] extractFormData(HttpURLConnection uc) throws IOException, Error {
 336         String result = IOUtils.readURL(uc);
 337         if (result.contains("<div class='formError'>")) {
 338             String s = fetchStartErrorMessage(result);
 339             throw new Error(s);
 340         }
 341
 342         String profileKey = extractPattern(result, Pattern.compile("<option value=\"([^\"]*)\" selected>"));
 343         String resultingCN = extractPattern(result, Pattern.compile("<input [^>]*name='CN' [^>]*value='([^']*)'/>"));
 344         String txt = extractPattern(result, Pattern.compile("<textarea [^>]*name='SANs' [^>]*>([^<]*)</textarea>"));
 345         String md = extractPattern(result, Pattern.compile("<input type=\"radio\" [^>]*name=\"hash_alg\" value=\"([^\"]*)\" checked='checked'/>"));
 346         return new String[] {
 347                 profileKey, resultingCN, txt, md
 348         };
 349     }
 350
 351     private String extractPattern(String result, Pattern p) {
 352         Matcher m = p.matcher(result);
 353         assertTrue(m.find());
 354         String resultingCN = m.group(1);
 355         return resultingCN;
 356     }
 357 }