X-Git-Url: https://code.wpia.club/?p=gigi.git;a=blobdiff_plain;f=tests%2Forg%2Fcacert%2Fgigi%2FTestCertificate.java;h=0305d50968537b038e1079a75c2d9c6645c813b3;hp=f0fe0209df9e1dfa68a82615313ed34f5e6ad3e8;hb=f4fa4314692900e57a074d9f65a558e136dadb44;hpb=bb61b2ef886a4ada4e073e2b3879d9207d89350a diff --git a/tests/org/cacert/gigi/TestCertificate.java b/tests/org/cacert/gigi/TestCertificate.java index f0fe0209..0305d509 100644 --- a/tests/org/cacert/gigi/TestCertificate.java +++ b/tests/org/cacert/gigi/TestCertificate.java @@ -1,148 +1,151 @@ package org.cacert.gigi; +import static org.junit.Assert.*; + import java.io.IOException; -import java.net.HttpURLConnection; -import java.net.MalformedURLException; -import java.net.Socket; -import java.net.URL; import java.security.GeneralSecurityException; -import java.security.KeyManagementException; -import java.security.NoSuchAlgorithmException; -import java.security.Principal; +import java.security.KeyPair; import java.security.PrivateKey; import java.security.cert.X509Certificate; import java.sql.SQLException; - -import javax.net.ssl.HttpsURLConnection; -import javax.net.ssl.KeyManager; -import javax.net.ssl.SSLContext; -import javax.net.ssl.X509KeyManager; - -import org.cacert.gigi.Certificate.CertificateStatus; +import java.util.Collection; +import java.util.List; + +import org.cacert.gigi.dbObjects.Certificate; +import org.cacert.gigi.dbObjects.Certificate.CSRType; +import org.cacert.gigi.dbObjects.Certificate.CertificateStatus; +import org.cacert.gigi.dbObjects.Certificate.SANType; +import org.cacert.gigi.dbObjects.Certificate.SubjectAlternateName; +import org.cacert.gigi.dbObjects.Digest; +import org.cacert.gigi.dbObjects.User; +import org.cacert.gigi.pages.account.certs.Certificates; +import org.cacert.gigi.testUtils.IOUtils; import org.cacert.gigi.testUtils.ManagedTest; -import org.cacert.gigi.testUtils.PemKey; import org.junit.Test; -import static org.junit.Assert.*; +import sun.security.x509.GeneralNameInterface; public class TestCertificate extends ManagedTest { - @Test - public void testClientCertLoginStates() throws IOException, GeneralSecurityException, SQLException, - InterruptedException { - String[] key1 = generateCSR("/CN=testmail@example.com"); - Certificate c = new Certificate(1, "/CN=testmail@example.com", "sha256", key1[1]); - final PrivateKey pk = PemKey.parsePEMPrivateKey(key1[0]); - c.issue(); - c.waitFor(60000); - final X509Certificate ce = c.cert(); - testLogin(pk, ce, true); - } - - private void testLogin(final PrivateKey pk, final X509Certificate ce, boolean success) - throws NoSuchAlgorithmException, KeyManagementException, IOException, MalformedURLException { - KeyManager km = new X509KeyManager() { - - @Override - public String chooseClientAlias(String[] arg0, Principal[] arg1, Socket arg2) { - return "client"; - } - - @Override - public String chooseServerAlias(String arg0, Principal[] arg1, Socket arg2) { - return null; - } - - @Override - public X509Certificate[] getCertificateChain(String arg0) { - return new X509Certificate[] { ce }; - } - - @Override - public String[] getClientAliases(String arg0, Principal[] arg1) { - return new String[] { "client" }; - } - - @Override - public PrivateKey getPrivateKey(String arg0) { - if (arg0.equals("client")) { - return pk; - } - return null; - } - - @Override - public String[] getServerAliases(String arg0, Principal[] arg1) { - return new String[] { "client" }; - } - }; - SSLContext sc = SSLContext.getInstance("TLS"); - sc.init(new KeyManager[] { km }, null, null); - - HttpURLConnection connection = (HttpURLConnection) new URL("https://" - + getServerName().replaceFirst("^www.", "secure.") + "/login").openConnection(); - if (connection instanceof HttpsURLConnection) { - ((HttpsURLConnection) connection).setSSLSocketFactory(sc.getSocketFactory()); - } - if (success) { - assertEquals(302, connection.getResponseCode()); - assertEquals("https://" + getServerName().replaceFirst("^www.", "secure.").replaceFirst(":443$", "") + "/", - connection.getHeaderField("Location").replaceFirst(":443$", "")); - } else { - assertNotEquals(302, connection.getResponseCode()); - assertNull(connection.getHeaderField("Location")); - } - } - - @Test - public void testCertLifeCycle() throws IOException, GeneralSecurityException, SQLException, InterruptedException { - String[] key1 = generateCSR("/CN=testmail@example.com"); - Certificate c = new Certificate(1, "/CN=testmail@example.com", "sha256", key1[1]); - final PrivateKey pk = PemKey.parsePEMPrivateKey(key1[0]); - - testFails(CertificateStatus.DRAFT, c); - c.issue(); - - testFails(CertificateStatus.SIGNING, c); - c.waitFor(60000); - - testFails(CertificateStatus.ISSUED, c); - X509Certificate cert = c.cert(); - testLogin(pk, cert, true); - c.revoke(); - - testFails(CertificateStatus.BEING_REVOKED, c); - c.waitFor(60000); - - testFails(CertificateStatus.REVOKED, c); - testLogin(pk, cert, false); - - } - - private void testFails(CertificateStatus status, Certificate c) throws IOException, GeneralSecurityException, - SQLException { - if (status != CertificateStatus.ISSUED) { - try { - c.revoke(); - fail("is in invalid state"); - } catch (IllegalStateException ise) { - - } - } - if (status != CertificateStatus.DRAFT) { - try { - c.issue(); - fail("is in invalid state"); - } catch (IllegalStateException ise) { - - } - } - if (status != CertificateStatus.ISSUED) { - try { - c.cert(); - fail("is in invalid state"); - } catch (IllegalStateException ise) { - - } - } - } + + User u = User.getById(createVerifiedUser("fn", "ln", createUniqueName() + "@example.com", TEST_PASSWORD)); + + @Test + public void testClientCertLoginStates() throws IOException, GeneralSecurityException, SQLException, InterruptedException, GigiApiException { + KeyPair kp = generateKeypair(); + String key1 = generatePEMCSR(kp, "CN=testmail@example.com"); + Certificate c = new Certificate(u, u, Certificate.buildDN("CN", "testmail@example.com"), Digest.SHA256, key1, CSRType.CSR, getClientProfile()); + final PrivateKey pk = kp.getPrivate(); + await(c.issue(null, "2y", u)); + final X509Certificate ce = c.cert(); + c.setLoginEnabled(true); + assertNotNull(login(pk, ce)); + } + + @Test + public void testSANs() throws IOException, GeneralSecurityException, SQLException, InterruptedException, GigiApiException { + KeyPair kp = generateKeypair(); + String key = generatePEMCSR(kp, "CN=testmail@example.com"); + Certificate c = new Certificate(u, u, Certificate.buildDN("CN", "testmail@example.com"), Digest.SHA256, key, CSRType.CSR, getClientProfile(),// + new SubjectAlternateName(SANType.EMAIL, "testmail@example.com"), new SubjectAlternateName(SANType.DNS, "testmail.example.com")); + + testFails(CertificateStatus.DRAFT, c); + await(c.issue(null, "2y", u)); + X509Certificate cert = c.cert(); + Collection> sans = cert.getSubjectAlternativeNames(); + assertEquals(2, sans.size()); + boolean hadDNS = false; + boolean hadEmail = false; + for (List list : sans) { + assertEquals(2, list.size()); + Integer type = (Integer) list.get(0); + switch (type) { + case GeneralNameInterface.NAME_RFC822: + hadEmail = true; + assertEquals("testmail@example.com", list.get(1)); + break; + case GeneralNameInterface.NAME_DNS: + hadDNS = true; + assertEquals("testmail.example.com", list.get(1)); + break; + default: + fail("Unknown type"); + + } + } + assertTrue(hadDNS); + assertTrue(hadEmail); + + testFails(CertificateStatus.ISSUED, c); + + Certificate c2 = Certificate.getBySerial(c.getSerial()); + assertNotNull(c2); + assertEquals(2, c2.getSANs().size()); + assertEquals(c.getSANs().get(0).getName(), c2.getSANs().get(0).getName()); + assertEquals(c.getSANs().get(0).getType(), c2.getSANs().get(0).getType()); + assertEquals(c.getSANs().get(1).getName(), c2.getSANs().get(1).getName()); + assertEquals(c.getSANs().get(1).getType(), c2.getSANs().get(1).getType()); + + try { + c2.getSANs().remove(0); + fail("the list should not be modifiable"); + } catch (UnsupportedOperationException e) { + // expected + } + } + + @Test + public void testCertLifeCycle() throws IOException, GeneralSecurityException, SQLException, InterruptedException, GigiApiException { + KeyPair kp = generateKeypair(); + String key = generatePEMCSR(kp, "CN=testmail@example.com"); + Certificate c = new Certificate(u, u, Certificate.buildDN("CN", "testmail@example.com"), Digest.SHA256, key, CSRType.CSR, getClientProfile()); + final PrivateKey pk = kp.getPrivate(); + + testFails(CertificateStatus.DRAFT, c); + await(c.issue(null, "2y", u)); + + String cookie = login(u.getEmail(), TEST_PASSWORD); + testFails(CertificateStatus.ISSUED, c); + X509Certificate cert = c.cert(); + c.setLoginEnabled(true); + assertNotNull(login(pk, cert)); + assertEquals(1, countRegex(IOUtils.readURL(get(cookie, Certificates.PATH)), "(?:REVOKED|ISSUED)")); + assertEquals(1, countRegex(IOUtils.readURL(get(cookie, Certificates.PATH + "?withRevoked")), "(?:REVOKED|ISSUED)")); + await(c.revoke()); + + testFails(CertificateStatus.REVOKED, c); + assertNull(login(pk, cert)); + + assertEquals(0, countRegex(IOUtils.readURL(get(cookie, Certificates.PATH)), "(?:REVOKED|ISSUED)")); + assertEquals(1, countRegex(IOUtils.readURL(get(cookie, Certificates.PATH + "?withRevoked")), "(?:REVOKED|ISSUED)")); + } + + private void testFails(CertificateStatus status, Certificate c) throws IOException, GeneralSecurityException, SQLException, GigiApiException { + assertEquals(status, c.getStatus()); + if (status != CertificateStatus.ISSUED) { + try { + c.revoke(); + fail(status + " is in invalid state"); + } catch (IllegalStateException ise) { + + } + } + if (status != CertificateStatus.DRAFT) { + try { + c.issue(null, "2y", u); + fail(status + " is in invalid state"); + } catch (IllegalStateException ise) { + + } + } + if (status != CertificateStatus.ISSUED) { + try { + c.cert(); + if (status != CertificateStatus.REVOKED) { + fail(status + " is in invalid state"); + } + } catch (IllegalStateException ise) { + + } + } + } }