|
| 1 | +/* |
| 2 | + * Copyright (c) 2023, Oracle and/or its affiliates. All rights reserved. |
| 3 | + * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. |
| 4 | + * |
| 5 | + * This code is free software; you can redistribute it and/or modify it |
| 6 | + * under the terms of the GNU General Public License version 2 only, as |
| 7 | + * published by the Free Software Foundation. |
| 8 | + * |
| 9 | + * This code is distributed in the hope that it will be useful, but WITHOUT |
| 10 | + * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or |
| 11 | + * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License |
| 12 | + * version 2 for more details (a copy is included in the LICENSE file that |
| 13 | + * accompanied this code). |
| 14 | + * |
| 15 | + * You should have received a copy of the GNU General Public License version |
| 16 | + * 2 along with this work; if not, write to the Free Software Foundation, |
| 17 | + * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA. |
| 18 | + * |
| 19 | + * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA |
| 20 | + * or visit www.oracle.com if you need additional information or have any |
| 21 | + * questions. |
| 22 | + */ |
| 23 | + |
| 24 | +/* @test |
| 25 | + * @bug 8301154 |
| 26 | + * @summary test cert chain deletion logic w/ NSS PKCS11 KeyStore |
| 27 | + * @library /test/lib .. |
| 28 | + * @run testng/othervm CertChainRemoval |
| 29 | + */ |
| 30 | +import jdk.test.lib.SecurityTools; |
| 31 | +import java.io.*; |
| 32 | +import java.nio.file.Path; |
| 33 | +import java.util.*; |
| 34 | + |
| 35 | +import java.security.Key; |
| 36 | +import java.security.KeyStore; |
| 37 | +import java.security.KeyStoreException; |
| 38 | +import java.security.Provider; |
| 39 | +import java.security.cert.Certificate; |
| 40 | + |
| 41 | +import org.testng.annotations.BeforeClass; |
| 42 | +import org.testng.annotations.Test; |
| 43 | + |
| 44 | + |
| 45 | +public class CertChainRemoval extends PKCS11Test { |
| 46 | + |
| 47 | + private static final Path TEST_DATA_PATH = Path.of(BASE) |
| 48 | + .resolve("CertChainRemoval"); |
| 49 | + private static final String DIR = TEST_DATA_PATH.toString(); |
| 50 | + |
| 51 | + private record KeyStoreInfo(File file, String type, char[] passwd) {} |
| 52 | + |
| 53 | + private static final KeyStoreInfo TEMP = new KeyStoreInfo( |
| 54 | + new File(DIR, "temp.ks"), |
| 55 | + "JKS", |
| 56 | + new char[] { 'c', 'h', 'a', 'n', 'g', 'e', 'i', 't' }); |
| 57 | + |
| 58 | + private static final KeyStoreInfo PKCS11KS = new KeyStoreInfo( |
| 59 | + null, |
| 60 | + "PKCS11", |
| 61 | + new char[] { 't', 'e', 's', 't', '1', '2' }); |
| 62 | + |
| 63 | + @BeforeClass |
| 64 | + public void setUp() throws Exception { |
| 65 | + copyNssCertKeyToClassesDir(); |
| 66 | + setCommonSystemProps(); |
| 67 | + // if temp keystore already exists; skip the creation |
| 68 | + if (!TEMP.file.exists()) { |
| 69 | + createKeyStore(TEMP); |
| 70 | + } |
| 71 | + System.setProperty("CUSTOM_P11_CONFIG", |
| 72 | + TEST_DATA_PATH.resolve("p11-nss.txt").toString()); |
| 73 | + } |
| 74 | + |
| 75 | + @Test |
| 76 | + public void test() throws Exception { |
| 77 | + main(new CertChainRemoval()); |
| 78 | + } |
| 79 | + |
| 80 | + private static void printKeyStore(String header, KeyStore ks) |
| 81 | + throws KeyStoreException { |
| 82 | + System.out.println(header); |
| 83 | + Enumeration enu = ks.aliases(); |
| 84 | + int count = 0; |
| 85 | + while (enu.hasMoreElements()) { |
| 86 | + count++; |
| 87 | + System.out.println("Entry# " + count + |
| 88 | + " = " + (String)enu.nextElement()); |
| 89 | + } |
| 90 | + System.out.println("========"); |
| 91 | + } |
| 92 | + |
| 93 | + private static void checkEntry(KeyStore ks, String alias, |
| 94 | + Certificate[] expChain) throws KeyStoreException { |
| 95 | + Certificate c = ks.getCertificate(alias); |
| 96 | + Certificate[] chain = ks.getCertificateChain(alias); |
| 97 | + if (expChain == null) { |
| 98 | + if (c != null || (chain != null && chain.length != 0)) { |
| 99 | + throw new RuntimeException("Fail: " + alias + " not removed"); |
| 100 | + } |
| 101 | + } else { |
| 102 | + if (!c.equals(expChain[0]) || !Arrays.equals(chain, expChain)) { |
| 103 | + System.out.println("expChain: " + expChain.length); |
| 104 | + System.out.println("actualChain: " + chain.length); |
| 105 | + throw new RuntimeException("Fail: " + alias + |
| 106 | + " chain check diff"); |
| 107 | + } |
| 108 | + } |
| 109 | + } |
| 110 | + |
| 111 | + public void main(Provider p) throws Exception { |
| 112 | + KeyStore sunks = KeyStore.getInstance(TEMP.type, "SUN"); |
| 113 | + sunks.load(new FileInputStream(TEMP.file), TEMP.passwd); |
| 114 | + printKeyStore("Starting with: ", sunks); |
| 115 | + |
| 116 | + KeyStore p11ks; |
| 117 | + try { |
| 118 | + p11ks = KeyStore.getInstance(PKCS11KS.type, p); |
| 119 | + p11ks.load(null, PKCS11KS.passwd); |
| 120 | + printKeyStore("Initial PKCS11 KeyStore: ", p11ks); |
| 121 | + } catch (Exception e) { |
| 122 | + System.out.println("Skip test, due to " + e); |
| 123 | + return; |
| 124 | + } |
| 125 | + |
| 126 | + // get the necessary keys from the temp keystore |
| 127 | + Key pk1PrivKey = sunks.getKey("pk1", TEMP.passwd); |
| 128 | + Certificate pk1Cert = sunks.getCertificate("pk1"); |
| 129 | + Key caPrivKey = sunks.getKey("ca1", TEMP.passwd); |
| 130 | + Certificate ca1Cert = sunks.getCertificate("ca1"); |
| 131 | + Key rootPrivKey = sunks.getKey("root", TEMP.passwd); |
| 132 | + Certificate rootCert = sunks.getCertificate("root"); |
| 133 | + |
| 134 | + Certificate[] pk1Chain = { pk1Cert, ca1Cert, rootCert }; |
| 135 | + Certificate[] ca1Chain = { ca1Cert, rootCert }; |
| 136 | + Certificate[] rootChain = { rootCert }; |
| 137 | + |
| 138 | + // populate keystore with "pk1" and "ca", then delete "pk1" |
| 139 | + System.out.println("Add pk1, ca1 and root, then delete pk1"); |
| 140 | + p11ks.setKeyEntry("pk1", pk1PrivKey, null, pk1Chain); |
| 141 | + p11ks.setKeyEntry("ca1", caPrivKey, null, ca1Chain); |
| 142 | + p11ks.setKeyEntry("root", rootPrivKey, null, rootChain); |
| 143 | + p11ks.deleteEntry("pk1"); |
| 144 | + |
| 145 | + // reload the keystore |
| 146 | + p11ks.store(null, PKCS11KS.passwd); |
| 147 | + p11ks.load(null, PKCS11KS.passwd); |
| 148 | + printKeyStore("Reload#1: ca1 / root", p11ks); |
| 149 | + |
| 150 | + // should only have "ca1" and "root" |
| 151 | + checkEntry(p11ks, "pk1", null); |
| 152 | + checkEntry(p11ks, "ca1", ca1Chain); |
| 153 | + checkEntry(p11ks, "root", rootChain); |
| 154 | + |
| 155 | + // now add "pk1" and delete "ca1" |
| 156 | + System.out.println("Now add pk1 and delete ca1"); |
| 157 | + p11ks.setKeyEntry("pk1", pk1PrivKey, null, pk1Chain); |
| 158 | + p11ks.deleteEntry("ca1"); |
| 159 | + |
| 160 | + // reload the keystore |
| 161 | + p11ks.store(null, PKCS11KS.passwd); |
| 162 | + p11ks.load(null, PKCS11KS.passwd); |
| 163 | + printKeyStore("Reload#2: pk1 / root", p11ks); |
| 164 | + |
| 165 | + // should only have "pk1" and "root" now |
| 166 | + checkEntry(p11ks, "pk1", pk1Chain); |
| 167 | + checkEntry(p11ks, "ca1", null); |
| 168 | + checkEntry(p11ks, "root", rootChain); |
| 169 | + |
| 170 | + // now delete "root" |
| 171 | + System.out.println("Now delete root"); |
| 172 | + p11ks.deleteEntry("root"); |
| 173 | + |
| 174 | + // reload the keystore |
| 175 | + p11ks.store(null, PKCS11KS.passwd); |
| 176 | + p11ks.load(null, PKCS11KS.passwd); |
| 177 | + printKeyStore("Reload#3: pk1", p11ks); |
| 178 | + |
| 179 | + // should only have "pk1" now |
| 180 | + checkEntry(p11ks, "pk1", pk1Chain); |
| 181 | + checkEntry(p11ks, "ca1", null); |
| 182 | + checkEntry(p11ks, "root", null); |
| 183 | + |
| 184 | + // now delete "pk1" |
| 185 | + System.out.println("Now delete pk1"); |
| 186 | + p11ks.deleteEntry("pk1"); |
| 187 | + |
| 188 | + // reload the keystore |
| 189 | + p11ks.store(null, PKCS11KS.passwd); |
| 190 | + p11ks.load(null, PKCS11KS.passwd); |
| 191 | + printKeyStore("Reload#4: ", p11ks); |
| 192 | + |
| 193 | + // should have nothing now |
| 194 | + checkEntry(p11ks, "pk1", null); |
| 195 | + checkEntry(p11ks, "ca1", null); |
| 196 | + checkEntry(p11ks, "root", null); |
| 197 | + |
| 198 | + System.out.println("Test Passed"); |
| 199 | + } |
| 200 | + |
| 201 | + private static void createKeyStore(KeyStoreInfo ksi) throws Exception { |
| 202 | + System.out.println("Creating keypairs and storing them into " + |
| 203 | + ksi.file.getAbsolutePath()); |
| 204 | + String keyGenOptions = " -keyalg RSA -keysize 2048 "; |
| 205 | + String keyStoreOptions = " -keystore " + ksi.file.getAbsolutePath() + |
| 206 | + " -storetype " + ksi.type + " -storepass " + |
| 207 | + new String(ksi.passwd); |
| 208 | + |
| 209 | + String[] aliases = { "ROOT", "CA1", "PK1" }; |
| 210 | + for (String n : aliases) { |
| 211 | + SecurityTools.keytool("-genkeypair -alias " + n + |
| 212 | + " -dname CN=" + n + keyGenOptions + keyStoreOptions); |
| 213 | + String issuer = switch (n) { |
| 214 | + case "CA1"-> "ROOT"; |
| 215 | + case "PK1"-> "CA1"; |
| 216 | + default-> null; |
| 217 | + }; |
| 218 | + if (issuer != null) { |
| 219 | + // export CSR and issue the cert using the issuer |
| 220 | + SecurityTools.keytool("-certreq -alias " + n + |
| 221 | + " -file tmp.req" + keyStoreOptions); |
| 222 | + SecurityTools.keytool("-gencert -alias " + issuer + |
| 223 | + " -infile tmp.req -outfile tmp.cert -validity 3650" + |
| 224 | + keyStoreOptions); |
| 225 | + SecurityTools.keytool("-importcert -alias " + n + |
| 226 | + " -file tmp.cert" + keyStoreOptions); |
| 227 | + } |
| 228 | + } |
| 229 | + } |
| 230 | + |
| 231 | +} |
1 commit comments
openjdk-notifier[bot] commentedon May 23, 2023
Review
Issues