]> WPIA git - gigi.git/blobdiff - util-testing/org/cacert/gigi/pages/Manager.java
Merge "Update notes about password security"
[gigi.git] / util-testing / org / cacert / gigi / pages / Manager.java
index 711f48e21137e1c0df5b60499411ef53bfc5380d..649b7944ef99cf64f455bd0b03743de10ec65efe 100644 (file)
@@ -7,7 +7,6 @@ import java.security.GeneralSecurityException;
 import java.security.KeyPair;
 import java.security.KeyPairGenerator;
 import java.security.Signature;
-import java.sql.Date;
 import java.util.Base64;
 import java.util.Calendar;
 import java.util.GregorianCalendar;
@@ -18,6 +17,8 @@ import java.util.Locale;
 import java.util.Map;
 import java.util.Properties;
 import java.util.TreeSet;
+import java.util.regex.Matcher;
+import java.util.regex.Pattern;
 
 import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpServletResponse;
@@ -26,6 +27,7 @@ import org.cacert.gigi.Gigi;
 import org.cacert.gigi.GigiApiException;
 import org.cacert.gigi.crypto.SPKAC;
 import org.cacert.gigi.database.GigiPreparedStatement;
+import org.cacert.gigi.dbObjects.Assurance.AssuranceType;
 import org.cacert.gigi.dbObjects.Certificate;
 import org.cacert.gigi.dbObjects.Certificate.CertificateStatus;
 import org.cacert.gigi.dbObjects.CertificateOwner;
@@ -44,6 +46,7 @@ import org.cacert.gigi.pages.account.certs.CertificateRequest;
 import org.cacert.gigi.ping.DomainPinger;
 import org.cacert.gigi.ping.PingerDaemon;
 import org.cacert.gigi.util.AuthorizationContext;
+import org.cacert.gigi.util.DayDate;
 import org.cacert.gigi.util.Notary;
 
 import sun.security.x509.X509Key;
@@ -52,20 +55,10 @@ public class Manager extends Page {
 
     public static final String PATH = "/manager";
 
-    Field f;
-
     private static HashMap<DomainPingType, DomainPinger> dps;
 
     private Manager() {
         super("Test Manager");
-        try {
-            f = EmailAddress.class.getDeclaredField("hash");
-            f.setAccessible(true);
-        } catch (ReflectiveOperationException e) {
-            // TODO
-            System.out.println("I don't have 'hash', we are working probably in layered mode. Test Manager may not work.");
-            // throw new Error(e);
-        }
 
         try {
             Field gigiInstance = Gigi.class.getDeclaredField("instance");
@@ -89,36 +82,38 @@ public class Manager extends Page {
         }
     }
 
-    public User[] getAssurers() {
-        if (assurers != null) {
-            return assurers;
+    public User getAssurer(int i) {
+        if (assurers[i] != null) {
+            return assurers[i];
         }
-        assurers = new User[10];
         try {
-            try (GigiPreparedStatement ps = new GigiPreparedStatement("INSERT INTO `notary` SET `from`=?, `to`=?, `points`=?, `location`=?, `date`=?")) {
-                for (int i = 0; i < assurers.length; i++) {
-                    String mail = "test-assurer" + i + "@example.com";
-                    User u = User.getByEmail(mail);
-                    if (u == null) {
-                        System.out.println("Creating assurer");
-                        createUser(mail);
-                        u = User.getByEmail(mail);
-                        passCATS(u);
-                        ps.setInt(1, u.getId());
-                        ps.setInt(2, u.getId());
-                        ps.setInt(3, 100);
-                        ps.setString(4, "Manager init code");
-                        ps.setString(5, "1990-01-01");
-                        ps.execute();
-                    }
-                    assurers[i] = u;
+            User u = createAssurer(i);
+            assurers[i] = u;
 
-                }
-            }
         } catch (ReflectiveOperationException | GigiApiException e) {
             e.printStackTrace();
         }
-        return assurers;
+        return assurers[i];
+    }
+
+    private User createAssurer(int i) throws GigiApiException, IllegalAccessException {
+        try (GigiPreparedStatement ps = new GigiPreparedStatement("INSERT INTO `notary` SET `from`=?, `to`=?, `points`=?, `location`=?, `date`=?")) {
+            String mail = "test-assurer" + i + "@example.com";
+            User u = User.getByEmail(mail);
+            if (u == null) {
+                System.out.println("Creating assurer");
+                createUser(mail);
+                u = User.getByEmail(mail);
+                passCATS(u);
+                ps.setInt(1, u.getId());
+                ps.setInt(2, u.getId());
+                ps.setInt(3, 100);
+                ps.setString(4, "Manager init code");
+                ps.setString(5, "1990-01-01");
+                ps.execute();
+            }
+            return u;
+        }
     }
 
     private void passCATS(User u) {
@@ -207,18 +202,26 @@ public class Manager extends Page {
     private void createUser(String email) throws GigiApiException, IllegalAccessException {
         Calendar gc = GregorianCalendar.getInstance();
         gc.set(1990, 0, 1);
-        User u = new User(email, "xvXV12°§", new Name("Först", "Läst", "Müddle", "Süffix"), new Date(gc.getTime().getTime()), Locale.ENGLISH);
+        User u = new User(email, "xvXV12°§", new Name("Först", "Läst", "Müddle", "Süffix"), new DayDate(gc.getTime().getTime()), Locale.ENGLISH);
         EmailAddress ea = u.getEmails()[0];
-        if (f == null) {
-            System.out.println("verification failed");
-            return;
-        }
-        String hash = (String) f.get(ea);
+        verify(email, ea);
+    }
 
-        ea.verify(hash);
+    private void verify(String email, EmailAddress ea) throws GigiApiException {
+        LinkedList<String> i = emails.get(email);
+        while (i.size() > 0 && !ea.isVerified()) {
+            String lst = i.getLast();
+            Pattern p = Pattern.compile("hash=([a-zA-Z0-9]+)");
+            Matcher m = p.matcher(lst);
+            if (m.find()) {
+                ea.verify(m.group(1));
+            }
+            i.removeLast();
+        }
+        // ea.verify(hash);
     }
 
-    User[] assurers;
+    User[] assurers = new User[25];
 
     @Override
     public void doPost(HttpServletRequest req, HttpServletResponse resp) throws IOException {
@@ -258,30 +261,32 @@ public class Manager extends Page {
                 return;
             }
             try {
-                for (int i = 0; i < getAssurers().length; i++) {
-                    Notary.assure(getAssurers()[i], byEmail, byEmail.getName(), byEmail.getDoB(), 10, "Testmanager Assure up code", "2014-11-06");
+                for (int i = 0; i < 10; i++) {
+                    Notary.assure(getAssurer(i), byEmail, byEmail.getName(), byEmail.getDoB(), 10, "Testmanager Assure up code", "2014-11-06", AssuranceType.FACE_TO_FACE);
                 }
             } catch (GigiApiException e) {
                 throw new Error(e);
             }
             resp.getWriter().println("User has been assured.");
+        } else if (req.getParameter("letassure") != null) {
+            String mail = req.getParameter("letassureEmail");
+            User byEmail = User.getByEmail(mail);
+            try {
+                for (int i = 0; i < 25; i++) {
+                    User a = getAssurer(i);
+                    Notary.assure(byEmail, a, a.getName(), a.getDoB(), 10, "Testmanager exp up code", "2014-11-06", AssuranceType.FACE_TO_FACE);
+                }
+            } catch (GigiApiException e) {
+                throw new Error(e);
+            }
         } else if (req.getParameter("addEmail") != null) {
             User u = User.getByEmail(req.getParameter("addEmailEmail"));
             try {
                 EmailAddress ea = new EmailAddress(u, req.getParameter("addEmailNew"), Locale.ENGLISH);
-                if (f != null) {
-                    String hash = (String) f.get(ea);
-                    ea.verify(hash);
-                    resp.getWriter().println("Email added and verified");
-                } else {
-                    resp.getWriter().println("Email added but verificatio failed.");
-                }
+                verify(ea.getAddress(), ea);
             } catch (IllegalArgumentException e) {
                 e.printStackTrace();
                 resp.getWriter().println("An internal error occured.");
-            } catch (IllegalAccessException e) {
-                e.printStackTrace();
-                resp.getWriter().println("An internal error occured.");
             } catch (GigiApiException e) {
                 e.format(resp.getWriter(), Language.getInstance(Locale.ENGLISH));
             }
@@ -364,7 +369,6 @@ public class Manager extends Page {
 
     @Override
     public void doGet(HttpServletRequest req, HttpServletResponse resp) throws IOException {
-        getAssurers();
         String pi = req.getPathInfo().substring(PATH.length());
         if (pi.length() > 1 && pi.startsWith("/fetch-")) {
             String mail = pi.substring(pi.indexOf('-', 2) + 1);