1 package org.cacert.gigi.pages.account;
3 import static org.junit.Assert.*;
4 import static org.hamcrest.CoreMatchers.*;
6 import java.io.ByteArrayInputStream;
7 import java.io.IOException;
8 import java.io.InputStreamReader;
9 import java.io.OutputStream;
10 import java.io.UnsupportedEncodingException;
11 import java.net.HttpURLConnection;
12 import java.net.MalformedURLException;
14 import java.net.URLConnection;
15 import java.net.URLEncoder;
16 import java.security.GeneralSecurityException;
17 import java.security.KeyPair;
18 import java.security.Signature;
19 import java.security.cert.CertificateException;
20 import java.security.cert.CertificateFactory;
21 import java.security.cert.X509Certificate;
22 import java.text.SimpleDateFormat;
23 import java.util.Arrays;
24 import java.util.Base64;
25 import java.util.Calendar;
26 import java.util.Date;
27 import java.util.TimeZone;
28 import java.util.Vector;
29 import java.util.regex.Matcher;
30 import java.util.regex.Pattern;
32 import org.cacert.gigi.Digest;
33 import org.cacert.gigi.User;
34 import org.cacert.gigi.crypto.SPKAC;
35 import org.cacert.gigi.testUtils.IOUtils;
36 import org.cacert.gigi.testUtils.ManagedTest;
37 import org.cacert.gigi.util.PEM;
38 import org.junit.Test;
40 import sun.security.pkcs.PKCS9Attribute;
41 import sun.security.pkcs10.PKCS10Attribute;
42 import sun.security.pkcs10.PKCS10Attributes;
43 import sun.security.util.ObjectIdentifier;
44 import sun.security.x509.CertificateExtensions;
45 import sun.security.x509.DNSName;
46 import sun.security.x509.ExtendedKeyUsageExtension;
47 import sun.security.x509.GeneralName;
48 import sun.security.x509.GeneralNameInterface;
49 import sun.security.x509.GeneralNames;
50 import sun.security.x509.RFC822Name;
51 import sun.security.x509.SubjectAlternativeNameExtension;
52 import sun.security.x509.X509Key;
54 public class TestCertificateAdd extends ManagedTest {
56 KeyPair kp = generateKeypair();
58 User u = User.getById(createVerifiedUser("testuser", "testname", uniq + "@testdom.com", TEST_PASSWORD));
60 String session = login(uniq + "@testdom.com", TEST_PASSWORD);
64 public TestCertificateAdd() throws GeneralSecurityException, IOException {
65 TestDomain.addDomain(session, uniq + ".tld");
70 public void testSimpleServer() throws IOException, GeneralSecurityException {
71 PKCS10Attributes atts = buildAtts(new ObjectIdentifier[] {
72 CertificateIssueForm.OID_KEY_USAGE_SSL_SERVER
73 }, new DNSName(uniq + ".tld"));
75 String pem = generatePEMCSR(kp, "CN=a." + uniq + ".tld", atts);
77 String[] res = fillOutForm("CSR=" + URLEncoder.encode(pem, "UTF-8"));
78 assertArrayEquals(new String[] {
79 "server", "CAcert WoT User", "dns:a." + uniq + ".tld\ndns:" + uniq + ".tld\n", Digest.SHA256.toString()
84 public void testSimpleMail() throws IOException, GeneralSecurityException {
85 PKCS10Attributes atts = buildAtts(new ObjectIdentifier[] {
86 CertificateIssueForm.OID_KEY_USAGE_EMAIL_PROTECTION
87 }, new DNSName("a." + uniq + ".tld"), new DNSName("b." + uniq + ".tld"), new RFC822Name(uniq + "@testdom.com"));
89 String pem = generatePEMCSR(kp, "CN=testuser testname", atts, "SHA384WithRSA");
91 String[] res = fillOutForm("CSR=" + URLEncoder.encode(pem, "UTF-8"));
92 assertArrayEquals(new String[] {
93 "mail", "testuser testname", "dns:a." + uniq + ".tld\ndns:b." + uniq + ".tld\nemail:" + uniq + "@testdom.com\n", Digest.SHA384.toString()
98 public void testSimpleClient() throws IOException, GeneralSecurityException {
99 PKCS10Attributes atts = buildAtts(new ObjectIdentifier[] {
100 CertificateIssueForm.OID_KEY_USAGE_SSL_CLIENT
101 }, new RFC822Name(uniq + "@testdom.com"));
103 String pem = generatePEMCSR(kp, "CN=testuser testname,email=" + uniq + "@testdom.com", atts, "SHA512WithRSA");
105 String[] res = fillOutForm("CSR=" + URLEncoder.encode(pem, "UTF-8"));
106 assertArrayEquals(new String[] {
107 "client", "testuser testname", "email:" + uniq + "@testdom.com\n", Digest.SHA512.toString()
112 public void testSPKAC() throws GeneralSecurityException, IOException {
118 public void testIssue() throws IOException, GeneralSecurityException {
119 PKCS10Attributes atts = buildAtts(new ObjectIdentifier[] {
120 CertificateIssueForm.OID_KEY_USAGE_SSL_CLIENT
121 }, new RFC822Name(uniq + "@testdom.com"));
123 String pem = generatePEMCSR(kp, "CN=testuser testname,email=" + uniq + "@testdom.com", atts, "SHA512WithRSA");
125 String[] res = fillOutForm("CSR=" + URLEncoder.encode(pem, "UTF-8"));
126 assertArrayEquals(new String[] {
127 "client", "testuser testname", "email:" + uniq + "@testdom.com\n", Digest.SHA512.toString()
130 HttpURLConnection huc = (HttpURLConnection) ncert.openConnection();
131 huc.setRequestProperty("Cookie", session);
132 huc.setDoOutput(true);
133 OutputStream out = huc.getOutputStream();
134 out.write(("csrf=" + URLEncoder.encode(csrf, "UTF-8")).getBytes());
135 out.write(("&profile=client&CN=testuser+testname&SANs=" + URLEncoder.encode("email:" + uniq + "@testdom.com\n", "UTF-8")).getBytes());
136 out.write(("&hash_alg=SHA512&CCA=y").getBytes());
137 URLConnection uc = authenticate(new URL(huc.getHeaderField("Location") + ".crt"));
138 String crt = IOUtils.readURL(new InputStreamReader(uc.getInputStream(), "UTF-8"));
140 uc = authenticate(new URL(huc.getHeaderField("Location") + ".cer"));
141 byte[] cer = IOUtils.readURL(uc.getInputStream());
142 assertArrayEquals(cer, PEM.decode("CERTIFICATE", crt));
144 uc = authenticate(new URL(huc.getHeaderField("Location") + ".cer?install"));
145 byte[] cer2 = IOUtils.readURL(uc.getInputStream());
146 assertArrayEquals(cer, cer2);
147 assertEquals("application/x-x509-user-cert", uc.getHeaderField("Content-type"));
149 uc = authenticate(new URL(huc.getHeaderField("Location")));
150 String gui = IOUtils.readURL(uc);
151 assertThat(gui, containsString("clientAuth"));
152 assertThat(gui, containsString("CN=testuser testname"));
153 assertThat(gui, containsString("SHA512withRSA"));
154 assertThat(gui, containsString("RFC822Name: " + uniq + "@testdom.com"));
159 public void testValidityPeriodCalendar() throws IOException, GeneralSecurityException {
160 testCertificateValidityRelative(Calendar.YEAR, 2, "2y", true);
161 testCertificateValidityRelative(Calendar.YEAR, 1, "1y", true);
162 testCertificateValidityRelative(Calendar.MONTH, 3, "3m", true);
163 testCertificateValidityRelative(Calendar.MONTH, 7, "7m", true);
164 testCertificateValidityRelative(Calendar.MONTH, 13, "13m", true);
166 testCertificateValidityRelative(Calendar.MONTH, 13, "-1m", false);
170 public void testValidityPeriodWhishStart() throws IOException, GeneralSecurityException {
171 long now = System.currentTimeMillis();
172 final long MS_PER_DAY = 24 * 60 * 60 * 1000;
173 now -= now % MS_PER_DAY;
175 SimpleDateFormat sdf = new SimpleDateFormat("YYYY-MM-dd");
176 sdf.setTimeZone(TimeZone.getTimeZone("UTC"));
178 Date start = new Date(now);
179 Date end = new Date(now + MS_PER_DAY * 10);
180 X509Certificate res = createCertWithValidity("&validFrom=" + sdf.format(start) + "&validity=" + sdf.format(end));
181 assertEquals(start, res.getNotBefore());
182 assertEquals(end, res.getNotAfter());
185 private void testCertificateValidityRelative(int field, int amount, String length, boolean shouldsucceed) throws IOException, GeneralSecurityException, UnsupportedEncodingException, MalformedURLException, CertificateException {
186 X509Certificate parsed = createCertWithValidity("&validFrom=now&validity=" + length);
187 if (parsed == null) {
188 assertTrue( !shouldsucceed);
191 assertTrue(shouldsucceed);
194 long now = System.currentTimeMillis();
195 Date start = parsed.getNotBefore();
196 Date end = parsed.getNotAfter();
197 Calendar c = Calendar.getInstance();
198 c.setTimeZone(TimeZone.getTimeZone("UTC"));
200 c.add(field, amount);
201 assertTrue(Math.abs(start.getTime() - now) < 10000);
202 assertEquals(c.getTime(), end);
205 private X509Certificate createCertWithValidity(String validity) throws IOException, GeneralSecurityException, UnsupportedEncodingException, MalformedURLException, CertificateException {
206 PKCS10Attributes atts = buildAtts(new ObjectIdentifier[] {
207 CertificateIssueForm.OID_KEY_USAGE_SSL_CLIENT
208 }, new RFC822Name(uniq + "@testdom.com"));
210 String pem = generatePEMCSR(kp, "CN=testuser testname", atts, "SHA512WithRSA");
211 fillOutForm("CSR=" + URLEncoder.encode(pem, "UTF-8"));
213 HttpURLConnection huc = (HttpURLConnection) ncert.openConnection();
214 huc.setRequestProperty("Cookie", session);
215 huc.setDoOutput(true);
216 OutputStream out = huc.getOutputStream();
217 out.write(("csrf=" + URLEncoder.encode(csrf, "UTF-8")).getBytes());
218 out.write(("&profile=client&CN=testuser+testname&SANs=" + URLEncoder.encode("email:" + uniq + "@testdom.com\n", "UTF-8")).getBytes());
219 out.write(("&hash_alg=SHA512&CCA=y&").getBytes());
220 out.write(validity.getBytes());
222 String certurl = huc.getHeaderField("Location");
223 if (certurl == null) {
226 URLConnection uc = authenticate(new URL(certurl + ".crt"));
227 String crt = IOUtils.readURL(new InputStreamReader(uc.getInputStream(), "UTF-8"));
229 CertificateFactory cf = CertificateFactory.getInstance("X.509");
230 X509Certificate parsed = (X509Certificate) cf.generateCertificate(new ByteArrayInputStream(crt.getBytes()));
234 private URLConnection authenticate(URL url) throws IOException {
235 URLConnection uc = url.openConnection();
236 uc.setRequestProperty("Cookie", session);
240 protected String testSPKAC(boolean correctChallange) throws GeneralSecurityException, IOException {
241 HttpURLConnection uc = (HttpURLConnection) ncert.openConnection();
242 uc.setRequestProperty("Cookie", session);
243 String s = IOUtils.readURL(uc);
245 csrf = extractPattern(s, Pattern.compile("<input [^>]*name='csrf' [^>]*value='([^']*)'>"));
246 String challenge = extractPattern(s, Pattern.compile("<keygen [^>]*name=\"SPKAC\" [^>]*challenge=\"([^\"]*)\"/>"));
248 SPKAC spk = new SPKAC((X509Key) kp.getPublic(), challenge + (correctChallange ? "" : "b"));
249 Signature sign = Signature.getInstance("SHA512WithRSA");
250 sign.initSign(kp.getPrivate());
252 String[] res = fillOutFormDirect("SPKAC=" + URLEncoder.encode(Base64.getEncoder().encodeToString(spk.getEncoded(sign)), "UTF-8"));
253 if ( !correctChallange) {
254 fail("Should not succeed with wrong challange.");
256 assertArrayEquals(new String[] {
257 "client", CertificateIssueForm.DEFAULT_CN, "", Digest.SHA512.toString()
260 assertTrue(e.getMessage().startsWith("<div>Challenge mismatch"));
265 private PKCS10Attributes buildAtts(ObjectIdentifier[] ekuOIDs, GeneralNameInterface... SANs) throws IOException {
266 CertificateExtensions attributeValue = new CertificateExtensions();
267 GeneralNames names = new GeneralNames();
269 for (GeneralNameInterface name : SANs) {
270 names.add(new GeneralName(name));
272 attributeValue.set("SANs", new SubjectAlternativeNameExtension(names));
273 PKCS10Attributes atts = new PKCS10Attributes(new PKCS10Attribute[] {
274 new PKCS10Attribute(PKCS9Attribute.EXTENSION_REQUEST_OID, attributeValue)
276 ExtendedKeyUsageExtension eku = new ExtendedKeyUsageExtension(//
277 new Vector<>(Arrays.<ObjectIdentifier>asList(ekuOIDs)));
278 attributeValue.set("eku", eku);
282 private final URL ncert = new URL("https://" + getServerName() + CertificateAdd.PATH);
284 private String[] fillOutForm(String pem) throws IOException {
285 HttpURLConnection uc = (HttpURLConnection) ncert.openConnection();
286 uc.setRequestProperty("Cookie", session);
288 return fillOutFormDirect(pem);
292 private String[] fillOutFormDirect(String pem) throws IOException {
294 HttpURLConnection uc = (HttpURLConnection) ncert.openConnection();
295 uc.setRequestProperty("Cookie", session);
296 uc.setDoOutput(true);
297 uc.getOutputStream().write(("csrf=" + URLEncoder.encode(csrf, "UTF-8") + "&" + pem).getBytes());
298 uc.getOutputStream().flush();
300 return extractFormData(uc);
303 private String[] extractFormData(HttpURLConnection uc) throws IOException, Error {
304 String result = IOUtils.readURL(uc);
305 if (result.contains("<div class='formError'>")) {
306 String s = fetchStartErrorMessage(result);
310 String profileKey = extractPattern(result, Pattern.compile("<option value=\"([^\"]*)\" selected>"));
311 String resultingCN = extractPattern(result, Pattern.compile("<input [^>]*name='CN' [^>]*value='([^']*)'>"));
312 String txt = extractPattern(result, Pattern.compile("<textarea [^>]*name='SANs' [^>]*>([^<]*)</textarea>"));
313 String md = extractPattern(result, Pattern.compile("<input type=\"radio\" [^>]*name=\"hash_alg\" value=\"([^\"]*)\" checked='checked'/>"));
314 return new String[] {
315 profileKey, resultingCN, txt, md
319 private String extractPattern(String result, Pattern p) {
320 Matcher m = p.matcher(result);
321 assertTrue(m.find());
322 String resultingCN = m.group(1);