Skip to content

Commit 19dee4f

Browse files
yulian-gaponenkoUbuntu
yulian-gaponenko
authored and
Ubuntu
committed
Add test for PdfSigner#signDetached with crl and no ocsp
DEVSIX-6151
1 parent 6d6df8f commit 19dee4f

File tree

13 files changed

+225
-137
lines changed

13 files changed

+225
-137
lines changed

‎sign/src/main/java/com/itextpdf/signatures/CrlClientOnline.java

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -136,8 +136,8 @@ public Collection<byte[]> getEncoded(X509Certificate checkCert, String url) {
136136
if (checkCert == null) {
137137
return null;
138138
}
139-
List<URL> urllist = new ArrayList<>(urls);
140-
if (urllist.size() == 0) {
139+
List<URL> urlList = new ArrayList<>(urls);
140+
if (urlList.size() == 0) {
141141
LOGGER.info("Looking for CRL for certificate " + checkCert.getSubjectDN());
142142
try {
143143
if (url == null) {
@@ -146,14 +146,14 @@ public Collection<byte[]> getEncoded(X509Certificate checkCert, String url) {
146146
if (url == null) {
147147
throw new IllegalArgumentException("Passed url can not be null.");
148148
}
149-
urllist.add(new URL(url));
149+
urlList.add(new URL(url));
150150
LOGGER.info("Found CRL url: " + url);
151151
} catch (Exception e) {
152152
LOGGER.info("Skipped CRL url: " + e.getMessage());
153153
}
154154
}
155155
List<byte[]> ar = new ArrayList<>();
156-
for (URL urlt : urllist) {
156+
for (URL urlt : urlList) {
157157
try {
158158
LOGGER.info("Checking CRL: " + urlt);
159159
InputStream inp = SignUtils.getHttpResponse(urlt);

‎sign/src/main/java/com/itextpdf/signatures/PdfPKCS7.java

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1063,8 +1063,9 @@ private DERSet getAuthenticatedAttributeSet(byte[] secondDigest, Collection<byte
10631063
if (haveCrl) {
10641064
ASN1EncodableVector v2 = new ASN1EncodableVector();
10651065
for (byte[] bCrl : crlBytes) {
1066-
if (bCrl == null)
1066+
if (bCrl == null) {
10671067
continue;
1068+
}
10681069
ASN1InputStream t = new ASN1InputStream(new ByteArrayInputStream(bCrl));
10691070
v2.add(t.readObject());
10701071
}

‎sign/src/main/java/com/itextpdf/signatures/PdfSigner.java

Lines changed: 5 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -820,17 +820,16 @@ protected Collection<byte[]> processCrl(Certificate cert, Collection<ICrlClient>
820820
}
821821
List<byte[]> crlBytes = new ArrayList<>();
822822
for (ICrlClient cc : crlList) {
823-
if (cc == null)
823+
if (cc == null) {
824824
continue;
825+
}
825826
Collection<byte[]> b = cc.getEncoded((X509Certificate) cert, null);
826-
if (b == null)
827+
if (b == null) {
827828
continue;
829+
}
828830
crlBytes.addAll(b);
829831
}
830-
if (crlBytes.size() == 0)
831-
return null;
832-
else
833-
return crlBytes;
832+
return crlBytes.size() == 0 ? null : crlBytes;
834833
}
835834

836835
protected void addDeveloperExtension(PdfDeveloperExtension extension) {

‎sign/src/test/java/com/itextpdf/signatures/LtvVerificationTest.java

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -110,7 +110,7 @@ public void addVerificationToDocumentWithAlreadyExistedDss() throws IOException,
110110
X509Certificate caCert = (X509Certificate) Pkcs12FileHelper.readFirstChain(rootCertPath, PASSWORD)[0];
111111
PrivateKey caPrivateKey = Pkcs12FileHelper.readFirstKey(rootCertPath, PASSWORD, PASSWORD);
112112

113-
verification.addVerification("TestSignature", null, new TestCrlClient(caCert, caPrivateKey),
113+
verification.addVerification("TestSignature", null, new TestCrlClient().addBuilderForCertIssuer(caCert, caPrivateKey),
114114
CertificateOption.SIGNING_CERTIFICATE, Level.CRL, CertificateInclusion.NO);
115115

116116
verification.merge();

‎sign/src/test/java/com/itextpdf/signatures/sign/LtvSigTest.java

Lines changed: 144 additions & 80 deletions
Large diffs are not rendered by default.

‎sign/src/test/java/com/itextpdf/signatures/sign/LtvWithTwoSignaturesTest.java

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -98,7 +98,7 @@ public void addLtvInfo() throws GeneralSecurityException, java.io.IOException {
9898
TestOcspClient testOcspClient = new TestOcspClient()
9999
.addBuilderForCertIssuer(interCert, interPrivateKey)
100100
.addBuilderForCertIssuer(caCert, caPrivateKey);
101-
TestCrlClient testCrlClient = new TestCrlClient(caCert, caPrivateKey);
101+
TestCrlClient testCrlClient = new TestCrlClient().addBuilderForCertIssuer(caCert, caPrivateKey);
102102

103103
addLtvInfo(srcFileName, ltvFileName, "Signature1", testOcspClient, testCrlClient);
104104
addLtvInfo(ltvFileName, ltvFileName2, "Signature2", testOcspClient, testCrlClient);

‎sign/src/test/java/com/itextpdf/signatures/sign/PadesSignatureLevelTest.java

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -134,7 +134,7 @@ public void padesSignatureLevelLTTest01() throws GeneralSecurityException, IOExc
134134
X509Certificate caCert = (X509Certificate) Pkcs12FileHelper.readFirstChain(caCertFileName, password)[0];
135135
PrivateKey caPrivateKey = Pkcs12FileHelper.readFirstKey(caCertFileName, password, password);
136136

137-
ICrlClient crlClient = new TestCrlClient(caCert, caPrivateKey);
137+
ICrlClient crlClient = new TestCrlClient().addBuilderForCertIssuer(caCert, caPrivateKey);
138138
TestOcspClient ocspClient = new TestOcspClient().addBuilderForCertIssuer(caCert, caPrivateKey);
139139

140140
PdfDocument document = new PdfDocument(new PdfReader(srcFileName), new PdfWriter(outFileName), new StampingProperties().useAppendMode());

‎sign/src/test/java/com/itextpdf/signatures/testutils/builder/TestCrlBuilder.java

Lines changed: 12 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -42,8 +42,8 @@ This file is part of the iText (R) project.
4242
*/
4343
package com.itextpdf.signatures.testutils.builder;
4444

45-
4645
import com.itextpdf.commons.utils.DateTimeUtil;
46+
4747
import java.io.IOException;
4848
import java.security.PrivateKey;
4949
import java.security.cert.CertificateEncodingException;
@@ -62,12 +62,15 @@ public class TestCrlBuilder {
6262

6363
private static final String SIGN_ALG = "SHA256withRSA";
6464

65-
private X509v2CRLBuilder crlBuilder;
65+
private final PrivateKey issuerPrivateKey;
66+
private final X509v2CRLBuilder crlBuilder;
6667
private Date nextUpdate = DateTimeUtil.addDaysToDate(DateTimeUtil.getCurrentTimeDate(), 30);
6768

68-
public TestCrlBuilder(X509Certificate caCert, Date thisUpdate) throws CertificateEncodingException {
69-
X500Name issuerDN = new X500Name(PrincipalUtil.getIssuerX509Principal(caCert).getName());
70-
crlBuilder = new X509v2CRLBuilder(issuerDN, thisUpdate);
69+
public TestCrlBuilder(X509Certificate issuerCert, PrivateKey issuerPrivateKey, Date thisUpdate)
70+
throws CertificateEncodingException {
71+
String issuerCertSubjectDn = PrincipalUtil.getSubjectX509Principal(issuerCert).getName();
72+
this.crlBuilder = new X509v2CRLBuilder(new X500Name(issuerCertSubjectDn), thisUpdate);
73+
this.issuerPrivateKey = issuerPrivateKey;
7174
}
7275

7376
public void setNextUpdate(Date nextUpdate) {
@@ -81,8 +84,10 @@ public void addCrlEntry(X509Certificate certificate, Date revocationDate, int re
8184
crlBuilder.addCRLEntry(certificate.getSerialNumber(), revocationDate, reason);
8285
}
8386

84-
public byte[] makeCrl(PrivateKey caPrivateKey) throws IOException, OperatorCreationException {
85-
ContentSigner signer = new JcaContentSignerBuilder(SIGN_ALG).setProvider(BouncyCastleProvider.PROVIDER_NAME).build(caPrivateKey);
87+
public byte[] makeCrl() throws IOException, OperatorCreationException {
88+
ContentSigner signer =
89+
new JcaContentSignerBuilder(SIGN_ALG).setProvider(BouncyCastleProvider.PROVIDER_NAME)
90+
.build(issuerPrivateKey);
8691
crlBuilder.setNextUpdate(nextUpdate);
8792
X509CRLHolder crl = crlBuilder.build(signer);
8893
return crl.getEncoded();

‎sign/src/test/java/com/itextpdf/signatures/testutils/client/TestCrlClient.java

Lines changed: 27 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -46,36 +46,46 @@ This file is part of the iText (R) project.
4646
import com.itextpdf.kernel.exceptions.PdfException;
4747
import com.itextpdf.signatures.ICrlClient;
4848
import com.itextpdf.signatures.testutils.builder.TestCrlBuilder;
49+
4950
import java.security.PrivateKey;
5051
import java.security.cert.CertificateEncodingException;
5152
import java.security.cert.X509Certificate;
53+
import java.util.ArrayList;
5254
import java.util.Collection;
53-
import java.util.Collections;
55+
import java.util.Date;
56+
import java.util.List;
57+
import java.util.stream.Collectors;
5458

5559
public class TestCrlClient implements ICrlClient {
5660

57-
private final TestCrlBuilder crlBuilder;
58-
private final PrivateKey caPrivateKey;
61+
private final List<TestCrlBuilder> crlBuilders;
62+
63+
public TestCrlClient() {
64+
crlBuilders = new ArrayList<>();
65+
}
5966

60-
public TestCrlClient(TestCrlBuilder crlBuilder, PrivateKey caPrivateKey) {
61-
this.crlBuilder = crlBuilder;
62-
this.caPrivateKey = caPrivateKey;
67+
public TestCrlClient addBuilderForCertIssuer(TestCrlBuilder crlBuilder) {
68+
crlBuilders.add(crlBuilder);
69+
return this;
6370
}
6471

65-
public TestCrlClient(X509Certificate caCert, PrivateKey caPrivateKey) throws CertificateEncodingException {
66-
this.crlBuilder = new TestCrlBuilder(caCert, DateTimeUtil.addDaysToDate(DateTimeUtil.getCurrentTimeDate(), -1));
67-
this.caPrivateKey = caPrivateKey;
72+
public TestCrlClient addBuilderForCertIssuer(X509Certificate issuerCert, PrivateKey issuerPrivateKey)
73+
throws CertificateEncodingException {
74+
Date yesterday = DateTimeUtil.addDaysToDate(DateTimeUtil.getCurrentTimeDate(), -1);
75+
crlBuilders.add(new TestCrlBuilder(issuerCert, issuerPrivateKey, yesterday));
76+
return this;
6877
}
6978

7079
@Override
7180
public Collection<byte[]> getEncoded(X509Certificate checkCert, String url) {
72-
Collection<byte[]> crls = null;
73-
try {
74-
byte[] crl = crlBuilder.makeCrl(caPrivateKey);
75-
crls = Collections.singletonList(crl);
76-
} catch (Exception ignore) {
77-
throw new PdfException(ignore);
78-
}
79-
return crls;
81+
return crlBuilders.stream()
82+
.map(testCrlBuilder -> {
83+
try {
84+
return testCrlBuilder.makeCrl();
85+
} catch (Exception ignore) {
86+
throw new PdfException(ignore);
87+
}
88+
})
89+
.collect(Collectors.toList());
8090
}
8191
}

‎sign/src/test/java/com/itextpdf/signatures/verify/CertificateVerificationClassTest.java

Lines changed: 15 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -94,6 +94,7 @@ public class CertificateVerificationClassTest extends ExtendedITextTest {
9494

9595
// Such messageTemplate is equal to any log message. This is required for porting reasons.
9696
private static final String ANY_LOG_MESSAGE = "{0}";
97+
private static final int COUNTER_TO_MAKE_CRL_AVAILABLE_AT_THE_CURRENT_TIME = -1;
9798

9899
private static final String CERTS_SRC = "./src/test/resources/com/itextpdf/signatures/certs/";
99100
private static final char[] PASSWORD = "testpass".toCharArray();
@@ -178,28 +179,30 @@ public void unsupportedCriticalExtensionTest()
178179
public void clrWithGivenCertificateTest()
179180
throws CertificateException, KeyStoreException, IOException, NoSuchAlgorithmException,
180181
UnrecoverableKeyException, CRLException {
181-
final int COUNTER_TO_MAKE_CRL_AVAILABLE_AT_THE_CURRENT_TIME = -1;
182+
182183
final String caCertFileName = CERTS_SRC + "rootRsa.p12";
183184
X509Certificate caCert = (X509Certificate) Pkcs12FileHelper.readFirstChain(caCertFileName, PASSWORD)[0];
184-
TestCrlBuilder crlBuilder = new TestCrlBuilder(caCert,
185-
DateTimeUtil.addDaysToDate(DateTimeUtil.getCurrentTimeDate(),
186-
COUNTER_TO_MAKE_CRL_AVAILABLE_AT_THE_CURRENT_TIME));
185+
PrivateKey caPrivateKey = Pkcs12FileHelper.readFirstKey(caCertFileName, PASSWORD, PASSWORD);
187186

188187
final String checkCertFileName = CERTS_SRC + "signCertRsa01.p12";
189188
X509Certificate checkCert = (X509Certificate) Pkcs12FileHelper.readFirstChain(checkCertFileName, PASSWORD)[0];
190-
TestCrlBuilder crlForCheckBuilder = new TestCrlBuilder(caCert,
189+
190+
TestCrlBuilder crlBuilder = new TestCrlBuilder(caCert, caPrivateKey,
191191
DateTimeUtil.addDaysToDate(DateTimeUtil.getCurrentTimeDate(),
192192
COUNTER_TO_MAKE_CRL_AVAILABLE_AT_THE_CURRENT_TIME));
193193
crlBuilder.addCrlEntry(caCert, DateTimeUtil.addDaysToDate(DateTimeUtil.getCurrentTimeDate(),
194194
COUNTER_TO_MAKE_CRL_AVAILABLE_AT_THE_CURRENT_TIME),
195195
CRLReason.keyCompromise);
196+
197+
TestCrlBuilder crlForCheckBuilder = new TestCrlBuilder(caCert, caPrivateKey,
198+
DateTimeUtil.addDaysToDate(DateTimeUtil.getCurrentTimeDate(),
199+
COUNTER_TO_MAKE_CRL_AVAILABLE_AT_THE_CURRENT_TIME));
196200
crlForCheckBuilder.addCrlEntry(checkCert, DateTimeUtil.addDaysToDate(DateTimeUtil.getCurrentTimeDate(),
197201
COUNTER_TO_MAKE_CRL_AVAILABLE_AT_THE_CURRENT_TIME),
198202
CRLReason.keyCompromise);
199203

200-
PrivateKey caPrivateKey = Pkcs12FileHelper.readFirstKey(caCertFileName, PASSWORD, PASSWORD);
201-
TestCrlClient crlClient = new TestCrlClient(crlBuilder, caPrivateKey);
202-
TestCrlClient crlForCheckClient = new TestCrlClient(crlForCheckBuilder, caPrivateKey);
204+
TestCrlClient crlClient = new TestCrlClient().addBuilderForCertIssuer(crlBuilder);
205+
TestCrlClient crlForCheckClient = new TestCrlClient().addBuilderForCertIssuer(crlForCheckBuilder);
203206

204207
Collection<byte[]> crlBytesForRootCertCollection = crlClient.getEncoded(caCert, null);
205208
Collection<byte[]> crlBytesForCheckCertCollection = crlForCheckClient.getEncoded(checkCert, null);
@@ -239,12 +242,13 @@ public void validCertWithCrlDoesNotContainCertTest()
239242
final String certForAddingToCrlName = CERTS_SRC + "signCertRsa01.p12";
240243
X509Certificate certForCrl = (X509Certificate) Pkcs12FileHelper.readFirstChain(certForAddingToCrlName,
241244
PASSWORD)[0];
242-
TestCrlBuilder crlForCheckBuilder = new TestCrlBuilder(certForCrl,
245+
PrivateKey caPrivateKey = Pkcs12FileHelper.readFirstKey(certForAddingToCrlName, PASSWORD, PASSWORD);
246+
247+
TestCrlBuilder crlForCheckBuilder = new TestCrlBuilder(certForCrl, caPrivateKey,
243248
DateTimeUtil.addDaysToDate(DateTimeUtil.getCurrentTimeDate(),
244249
COUNTER_TO_MAKE_CRL_AVAILABLE_AT_THE_CURRENT_TIME));
245250

246-
PrivateKey caPrivateKey = Pkcs12FileHelper.readFirstKey(rootCertFileName, PASSWORD, PASSWORD);
247-
TestCrlClient crlClient = new TestCrlClient(crlForCheckBuilder, caPrivateKey);
251+
TestCrlClient crlClient = new TestCrlClient().addBuilderForCertIssuer(crlForCheckBuilder);
248252

249253
Collection<byte[]> crlBytesForRootCertCollection = crlClient.getEncoded(certForCrl, null);
250254

0 commit comments

Comments
 (0)