package org.cacert.gigi;
+import static org.junit.Assert.*;
+
import java.io.IOException;
-import java.net.HttpURLConnection;
-import java.net.MalformedURLException;
-import java.net.Socket;
-import java.net.URL;
import java.security.GeneralSecurityException;
-import java.security.KeyManagementException;
-import java.security.NoSuchAlgorithmException;
-import java.security.Principal;
+import java.security.KeyPair;
import java.security.PrivateKey;
import java.security.cert.X509Certificate;
import java.sql.SQLException;
-
-import javax.net.ssl.HttpsURLConnection;
-import javax.net.ssl.KeyManager;
-import javax.net.ssl.SSLContext;
-import javax.net.ssl.X509KeyManager;
-
-import org.cacert.gigi.Certificate.CertificateStatus;
+import java.util.Collection;
+import java.util.List;
+
+import org.cacert.gigi.dbObjects.Certificate;
+import org.cacert.gigi.dbObjects.Certificate.CSRType;
+import org.cacert.gigi.dbObjects.Certificate.CertificateStatus;
+import org.cacert.gigi.dbObjects.Certificate.SANType;
+import org.cacert.gigi.dbObjects.Certificate.SubjectAlternateName;
+import org.cacert.gigi.dbObjects.Digest;
+import org.cacert.gigi.dbObjects.User;
+import org.cacert.gigi.pages.account.certs.Certificates;
+import org.cacert.gigi.testUtils.IOUtils;
import org.cacert.gigi.testUtils.ManagedTest;
-import org.cacert.gigi.testUtils.PemKey;
import org.junit.Test;
-import static org.junit.Assert.*;
+import sun.security.x509.GeneralNameInterface;
public class TestCertificate extends ManagedTest {
- @Test
- public void testClientCertLoginStates() throws IOException, GeneralSecurityException, SQLException,
- InterruptedException {
- String[] key1 = generateCSR("/CN=testmail@example.com");
- Certificate c = new Certificate(1, "/CN=testmail@example.com", "sha256", key1[1]);
- final PrivateKey pk = PemKey.parsePEMPrivateKey(key1[0]);
- c.issue();
- c.waitFor(60000);
- final X509Certificate ce = c.cert();
- testLogin(pk, ce, true);
- }
-
- private void testLogin(final PrivateKey pk, final X509Certificate ce, boolean success)
- throws NoSuchAlgorithmException, KeyManagementException, IOException, MalformedURLException {
- KeyManager km = new X509KeyManager() {
-
- @Override
- public String chooseClientAlias(String[] arg0, Principal[] arg1, Socket arg2) {
- return "client";
- }
-
- @Override
- public String chooseServerAlias(String arg0, Principal[] arg1, Socket arg2) {
- return null;
- }
-
- @Override
- public X509Certificate[] getCertificateChain(String arg0) {
- return new X509Certificate[] { ce };
- }
-
- @Override
- public String[] getClientAliases(String arg0, Principal[] arg1) {
- return new String[] { "client" };
- }
-
- @Override
- public PrivateKey getPrivateKey(String arg0) {
- if (arg0.equals("client")) {
- return pk;
- }
- return null;
- }
-
- @Override
- public String[] getServerAliases(String arg0, Principal[] arg1) {
- return new String[] { "client" };
- }
- };
- SSLContext sc = SSLContext.getInstance("TLS");
- sc.init(new KeyManager[] { km }, null, null);
-
- HttpURLConnection connection = (HttpURLConnection) new URL("https://"
- + getServerName().replaceFirst("^www.", "secure.") + "/login").openConnection();
- if (connection instanceof HttpsURLConnection) {
- ((HttpsURLConnection) connection).setSSLSocketFactory(sc.getSocketFactory());
- }
- if (success) {
- assertEquals(302, connection.getResponseCode());
- assertEquals("https://" + getServerName().replaceFirst("^www.", "secure.").replaceFirst(":443$", "") + "/",
- connection.getHeaderField("Location").replaceFirst(":443$", ""));
- } else {
- assertNotEquals(302, connection.getResponseCode());
- assertNull(connection.getHeaderField("Location"));
- }
- }
-
- @Test
- public void testCertLifeCycle() throws IOException, GeneralSecurityException, SQLException, InterruptedException {
- String[] key1 = generateCSR("/CN=testmail@example.com");
- Certificate c = new Certificate(1, "/CN=testmail@example.com", "sha256", key1[1]);
- final PrivateKey pk = PemKey.parsePEMPrivateKey(key1[0]);
-
- testFails(CertificateStatus.DRAFT, c);
- c.issue();
-
- testFails(CertificateStatus.SIGNING, c);
- c.waitFor(60000);
-
- testFails(CertificateStatus.ISSUED, c);
- X509Certificate cert = c.cert();
- testLogin(pk, cert, true);
- c.revoke();
-
- testFails(CertificateStatus.BEING_REVOKED, c);
- c.waitFor(60000);
-
- testFails(CertificateStatus.REVOKED, c);
- testLogin(pk, cert, false);
-
- }
-
- private void testFails(CertificateStatus status, Certificate c) throws IOException, GeneralSecurityException,
- SQLException {
- if (status != CertificateStatus.ISSUED) {
- try {
- c.revoke();
- fail("is in invalid state");
- } catch (IllegalStateException ise) {
-
- }
- }
- if (status != CertificateStatus.DRAFT) {
- try {
- c.issue();
- fail("is in invalid state");
- } catch (IllegalStateException ise) {
-
- }
- }
- if (status != CertificateStatus.ISSUED) {
- try {
- c.cert();
- fail("is in invalid state");
- } catch (IllegalStateException ise) {
-
- }
- }
- }
+
+ User u = User.getById(createVerifiedUser("fn", "ln", createUniqueName() + "@example.com", TEST_PASSWORD));
+
+ @Test
+ public void testClientCertLoginStates() throws IOException, GeneralSecurityException, SQLException, InterruptedException, GigiApiException {
+ KeyPair kp = generateKeypair();
+ String key1 = generatePEMCSR(kp, "CN=testmail@example.com");
+ Certificate c = new Certificate(u, u, Certificate.buildDN("CN", "testmail@example.com"), Digest.SHA256, key1, CSRType.CSR, getClientProfile());
+ final PrivateKey pk = kp.getPrivate();
+ await(c.issue(null, "2y", u));
+ final X509Certificate ce = c.cert();
+ c.setLoginEnabled(true);
+ assertNotNull(login(pk, ce));
+ }
+
+ @Test
+ public void testSANs() throws IOException, GeneralSecurityException, SQLException, InterruptedException, GigiApiException {
+ KeyPair kp = generateKeypair();
+ String key = generatePEMCSR(kp, "CN=testmail@example.com");
+ Certificate c = new Certificate(u, u, Certificate.buildDN("CN", "testmail@example.com"), Digest.SHA256, key, CSRType.CSR, getClientProfile(),//
+ new SubjectAlternateName(SANType.EMAIL, "testmail@example.com"), new SubjectAlternateName(SANType.DNS, "testmail.example.com"));
+
+ testFails(CertificateStatus.DRAFT, c);
+ await(c.issue(null, "2y", u));
+ X509Certificate cert = c.cert();
+ Collection<List<?>> sans = cert.getSubjectAlternativeNames();
+ assertEquals(2, sans.size());
+ boolean hadDNS = false;
+ boolean hadEmail = false;
+ for (List<?> list : sans) {
+ assertEquals(2, list.size());
+ Integer type = (Integer) list.get(0);
+ switch (type) {
+ case GeneralNameInterface.NAME_RFC822:
+ hadEmail = true;
+ assertEquals("testmail@example.com", list.get(1));
+ break;
+ case GeneralNameInterface.NAME_DNS:
+ hadDNS = true;
+ assertEquals("testmail.example.com", list.get(1));
+ break;
+ default:
+ fail("Unknown type");
+
+ }
+ }
+ assertTrue(hadDNS);
+ assertTrue(hadEmail);
+
+ testFails(CertificateStatus.ISSUED, c);
+
+ Certificate c2 = Certificate.getBySerial(c.getSerial());
+ assertNotNull(c2);
+ assertEquals(2, c2.getSANs().size());
+ assertEquals(c.getSANs().get(0).getName(), c2.getSANs().get(0).getName());
+ assertEquals(c.getSANs().get(0).getType(), c2.getSANs().get(0).getType());
+ assertEquals(c.getSANs().get(1).getName(), c2.getSANs().get(1).getName());
+ assertEquals(c.getSANs().get(1).getType(), c2.getSANs().get(1).getType());
+
+ try {
+ c2.getSANs().remove(0);
+ fail("the list should not be modifiable");
+ } catch (UnsupportedOperationException e) {
+ // expected
+ }
+ }
+
+ @Test
+ public void testCertLifeCycle() throws IOException, GeneralSecurityException, SQLException, InterruptedException, GigiApiException {
+ KeyPair kp = generateKeypair();
+ String key = generatePEMCSR(kp, "CN=testmail@example.com");
+ Certificate c = new Certificate(u, u, Certificate.buildDN("CN", "testmail@example.com"), Digest.SHA256, key, CSRType.CSR, getClientProfile());
+ final PrivateKey pk = kp.getPrivate();
+
+ testFails(CertificateStatus.DRAFT, c);
+ await(c.issue(null, "2y", u));
+
+ String cookie = login(u.getEmail(), TEST_PASSWORD);
+ testFails(CertificateStatus.ISSUED, c);
+ X509Certificate cert = c.cert();
+ c.setLoginEnabled(true);
+ assertNotNull(login(pk, cert));
+ assertEquals(1, countRegex(IOUtils.readURL(get(cookie, Certificates.PATH)), "<td>(?:REVOKED|ISSUED)</td>"));
+ assertEquals(1, countRegex(IOUtils.readURL(get(cookie, Certificates.PATH + "?withRevoked")), "<td>(?:REVOKED|ISSUED)</td>"));
+ await(c.revoke());
+
+ testFails(CertificateStatus.REVOKED, c);
+ assertNull(login(pk, cert));
+
+ assertEquals(0, countRegex(IOUtils.readURL(get(cookie, Certificates.PATH)), "<td>(?:REVOKED|ISSUED)</td>"));
+ assertEquals(1, countRegex(IOUtils.readURL(get(cookie, Certificates.PATH + "?withRevoked")), "<td>(?:REVOKED|ISSUED)</td>"));
+ }
+
+ private void testFails(CertificateStatus status, Certificate c) throws IOException, GeneralSecurityException, SQLException, GigiApiException {
+ assertEquals(status, c.getStatus());
+ if (status != CertificateStatus.ISSUED) {
+ try {
+ c.revoke();
+ fail(status + " is in invalid state");
+ } catch (IllegalStateException ise) {
+
+ }
+ }
+ if (status != CertificateStatus.DRAFT) {
+ try {
+ c.issue(null, "2y", u);
+ fail(status + " is in invalid state");
+ } catch (IllegalStateException ise) {
+
+ }
+ }
+ if (status != CertificateStatus.ISSUED) {
+ try {
+ c.cert();
+ if (status != CertificateStatus.REVOKED) {
+ fail(status + " is in invalid state");
+ }
+ } catch (IllegalStateException ise) {
+
+ }
+ }
+ }
}
projects / gigi.git / blobdiff