Skip to content

Commit c5992ca

Browse files
myankelevwangweij
myankelev
authored and
wangweij
committed
8349533: Refactor validator tests shell files to java
Reviewed-by: weijun
1 parent dea7a9f commit c5992ca

File tree

3 files changed

+168
-184
lines changed

3 files changed

+168
-184
lines changed

‎test/jdk/sun/security/validator/CertReplace.java

Lines changed: 168 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright (c) 2010, Oracle and/or its affiliates. All rights reserved.
2+
* Copyright (c) 2010, 2025, Oracle and/or its affiliates. All rights reserved.
33
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
44
*
55
* This code is free software; you can redistribute it and/or modify it
@@ -21,29 +21,186 @@
2121
* questions.
2222
*/
2323

24-
/*
25-
* This test is called by certreplace.sh
26-
*/
27-
2824
import java.io.FileInputStream;
25+
import java.io.FileOutputStream;
26+
import java.nio.file.Files;
27+
import java.nio.file.Path;
28+
import java.nio.file.Paths;
29+
import java.nio.file.StandardOpenOption;
2930
import java.security.KeyStore;
31+
import java.security.PrivateKey;
3032
import java.security.cert.Certificate;
3133
import java.security.cert.CertificateFactory;
3234
import java.security.cert.X509Certificate;
33-
import java.util.Arrays;
3435
import java.util.ArrayList;
3536
import java.util.List;
37+
38+
import jdk.test.lib.SecurityTools;
39+
import jdk.test.lib.security.CertUtils;
40+
import jdk.test.lib.security.KeyStoreUtils;
3641
import sun.security.validator.Validator;
3742

43+
/*
44+
* @test id=certreplace
45+
* @bug 6948803
46+
* @summary CertPath validation regression caused by SHA1 replacement root and MD2 disable feature
47+
* @library /test/lib
48+
* @modules java.base/sun.security.validator
49+
*
50+
* @run main CertReplace certreplace.jks certreplace.certs
51+
*/
52+
53+
/*
54+
* @test id=samedn
55+
* @bug 6958869
56+
* @summary Regression: PKIXValidator fails when multiple trust anchors have same dn
57+
* @library /test/lib
58+
* @modules java.base/sun.security.validator
59+
*
60+
* @run main CertReplace samedn.jks samedn1.certs
61+
* @run main CertReplace samedn.jks samedn2.certs
62+
*/
63+
3864
public class CertReplace {
3965

66+
private static final String SAMEDN_JKS = "samedn.jks";
67+
private static final String CERTREPLACE_JKS = "certreplace.jks";
68+
private static final String PASSWORD = "changeit";
69+
private static final char[] PASSWORD_CHAR_ARR = PASSWORD.toCharArray();
70+
71+
/**
72+
* This method creates certs for the Cert Replace test
73+
*
74+
* @throws Exception
75+
*/
76+
private static void certReplace() throws Exception {
77+
78+
final String ktBaseParameters = "-storepass " + PASSWORD + " " +
79+
"-keypass " + PASSWORD + " " +
80+
"-keystore " + CERTREPLACE_JKS + " " +
81+
"-keyalg rsa ";
82+
83+
final Path keystoreFilePath = Paths.get(CERTREPLACE_JKS);
84+
Files.deleteIfExists(keystoreFilePath);
85+
86+
// 1. Generate 3 aliases in a keystore: ca, int, user
87+
SecurityTools.keytool(ktBaseParameters +
88+
"-genkeypair -alias ca -dname CN=CA -keyalg rsa -sigalg md2withrsa -ext bc");
89+
SecurityTools.keytool(ktBaseParameters +
90+
"-genkeypair -alias int -dname CN=Int -keyalg rsa");
91+
SecurityTools.keytool(ktBaseParameters +
92+
"-genkeypair -alias user -dname CN=User -keyalg rsa");
93+
94+
final KeyStore keyStore = KeyStoreUtils.loadKeyStore(CERTREPLACE_JKS, PASSWORD);
95+
96+
// 2. Signing: ca -> int -> user
97+
98+
SecurityTools.keytool(ktBaseParameters +
99+
"-certreq -alias int -file int.req");
100+
SecurityTools.keytool(ktBaseParameters +
101+
"-gencert -rfc -alias ca -ext bc -infile int.req " +
102+
"-outfile int.cert");
103+
104+
//putting the certificate in the keystore
105+
try (final FileInputStream certInputStream = new FileInputStream("int.cert")) {
106+
final Certificate[] certs = new Certificate[]{
107+
CertUtils.getCertFromStream(
108+
certInputStream
109+
)
110+
};
111+
112+
final PrivateKey privateKey = (PrivateKey) keyStore.getKey("int", PASSWORD_CHAR_ARR);
113+
keyStore.setKeyEntry("int", privateKey, PASSWORD_CHAR_ARR, certs);
114+
keyStore.store(new FileOutputStream(CERTREPLACE_JKS), PASSWORD_CHAR_ARR);
115+
}
116+
117+
SecurityTools.keytool(ktBaseParameters +
118+
"-certreq -alias user -file user.req");
119+
SecurityTools.keytool(ktBaseParameters +
120+
"-gencert -rfc -alias int " +
121+
"-infile user.req " +
122+
"-outfile certreplace.certs"); // this will create certreplace.certs which is later appended
123+
124+
// 3. Create the certchain file
125+
final Path certPath = Paths.get("certreplace.certs");
126+
127+
Files.write(certPath, Files.readAllBytes(Path.of("int.cert")), StandardOpenOption.APPEND);
128+
129+
final String outputCa = SecurityTools.keytool(ktBaseParameters +
130+
"-export -rfc -alias ca").getOutput();
131+
Files.write(certPath, outputCa.getBytes(), StandardOpenOption.APPEND);
132+
133+
// 4. Upgrade ca from MD2withRSA to SHA256withRSA, remove other aliases and make this keystore the cacerts file
134+
keyStore.deleteEntry("int");
135+
keyStore.deleteEntry("user");
136+
keyStore.store(new FileOutputStream(CERTREPLACE_JKS), PASSWORD_CHAR_ARR);
137+
138+
SecurityTools.keytool(ktBaseParameters +
139+
"-selfcert -alias ca");
140+
}
141+
142+
/**
143+
* This method creates certs for the Same DN test
144+
*
145+
* @throws Exception
146+
*/
147+
private static void sameDn() throws Exception {
148+
149+
final String ktBaseParameters = "-storepass " + PASSWORD + " " +
150+
"-keypass " + PASSWORD + " " +
151+
"-keystore " + SAMEDN_JKS + " " +
152+
"-keyalg rsa ";
153+
154+
final Path keystoreFilePath = Paths.get(SAMEDN_JKS);
155+
Files.deleteIfExists(keystoreFilePath);
156+
157+
// 1. Generate 3 aliases in a keystore: ca1, ca2, user. The CAs' startdate
158+
// is set to one year ago so that they are expired now
159+
SecurityTools.keytool(ktBaseParameters +
160+
"-genkeypair -alias ca1 -dname CN=CA -keyalg rsa " +
161+
"-sigalg md5withrsa -ext bc -startdate -1y");
162+
SecurityTools.keytool(ktBaseParameters +
163+
"-genkeypair -alias ca2 -dname CN=CA -keyalg rsa " +
164+
"-sigalg sha1withrsa -ext bc -startdate -1y");
165+
SecurityTools.keytool(ktBaseParameters +
166+
"-genkeypair -alias user -dname CN=User -keyalg rsa");
167+
168+
// 2. Signing: ca -> user. The startdate is set to 1 minute in the past to ensure the certificate
169+
// is valid at the time of validation and to prevent any issues with timing discrepancies
170+
// Automatically saves the certs to the certs files
171+
172+
SecurityTools.keytool(ktBaseParameters +
173+
"-certreq -alias user -file user.req");
174+
SecurityTools.keytool(ktBaseParameters +
175+
"-gencert -rfc -alias ca1 " +
176+
"-startdate -1M -infile user.req -outfile samedn1.certs");
177+
SecurityTools.keytool(ktBaseParameters +
178+
"-gencert -rfc -alias ca2 " +
179+
"-startdate -1M -infile user.req -outfile samedn2.certs");
180+
181+
// 3. Remove user for cacerts
182+
final KeyStore keyStore = KeyStoreUtils.loadKeyStore(SAMEDN_JKS, PASSWORD);
183+
keyStore.deleteEntry("user");
184+
keyStore.store(new FileOutputStream(CERTREPLACE_JKS), PASSWORD_CHAR_ARR);
185+
}
186+
40187
/**
41188
* @param args {cacerts keystore, cert chain}
42189
*/
43190
public static void main(String[] args) throws Exception {
44191

192+
if (args[0].equals(CERTREPLACE_JKS)) {
193+
certReplace();
194+
} else if (args[0].equals(SAMEDN_JKS)) {
195+
sameDn();
196+
} else {
197+
throw new RuntimeException("Not recognised test " + args[0]);
198+
}
199+
45200
KeyStore ks = KeyStore.getInstance("JKS");
46-
ks.load(new FileInputStream(args[0]), "changeit".toCharArray());
201+
try (final FileInputStream certInputStream = new FileInputStream(args[0])) {
202+
ks.load(certInputStream, PASSWORD_CHAR_ARR);
203+
}
47204
Validator v = Validator.getInstance
48205
(Validator.TYPE_PKIX, Validator.VAR_GENERIC, ks);
49206
X509Certificate[] chain = createPath(args[1]);
@@ -57,9 +214,10 @@ public static void main(String[] args) throws Exception {
57214
public static X509Certificate[] createPath(String chain) throws Exception {
58215
CertificateFactory cf = CertificateFactory.getInstance("X.509");
59216
List list = new ArrayList();
60-
for (Certificate c: cf.generateCertificates(
61-
new FileInputStream(chain))) {
62-
list.add((X509Certificate)c);
217+
try (final FileInputStream certInputStream = new FileInputStream(chain)) {
218+
for (Certificate c : cf.generateCertificates(certInputStream)) {
219+
list.add((X509Certificate) c);
220+
}
63221
}
64222
return (X509Certificate[]) list.toArray(new X509Certificate[0]);
65223
}

‎test/jdk/sun/security/validator/certreplace.sh

Lines changed: 0 additions & 88 deletions
This file was deleted.

‎test/jdk/sun/security/validator/samedn.sh

Lines changed: 0 additions & 86 deletions
This file was deleted.

0 commit comments

Comments
 (0)