test/jdk/sun/security/tools/jarsigner/ConciseJarsigner.java - platform/libcore - Git at Google

 /*
  * Copyright (c) 2009, 2021, Oracle and/or its affiliates. All rights reserved.
  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
  *
  * This code is free software; you can redistribute it and/or modify it
  * under the terms of the GNU General Public License version 2 only, as
  * published by the Free Software Foundation.
  *
  * This code is distributed in the hope that it will be useful, but WITHOUT
  * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
  * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
  * version 2 for more details (a copy is included in the LICENSE file that
  * accompanied this code).
  *
  * You should have received a copy of the GNU General Public License version
  * 2 along with this work; if not, write to the Free Software Foundation,
  * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
  *
  * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
  * or visit www.oracle.com if you need additional information or have any
  * questions.
  */

 /*
  * @test
  * @bug 6802846 8172529 8227758 8260960
  * @summary jarsigner needs enhanced cert validation(options)
  * @library /test/lib
  * @run main/timeout=240 ConciseJarsigner
  */

 import jdk.test.lib.Asserts;
 import jdk.test.lib.SecurityTools;
 import jdk.test.lib.process.OutputAnalyzer;

 import java.nio.file.Files;
 import java.nio.file.Path;
 import java.util.Calendar;
 import java.util.List;

 public class ConciseJarsigner {

     static OutputAnalyzer kt(String cmd) throws Exception {
         // Choose 2048-bit RSA to make sure it runs fine and fast. In
         // fact, every keyalg/keysize combination is OK for this test.
         return SecurityTools.keytool("-storepass changeit -keypass changeit "
                 + "-keystore ks -keyalg rsa -keysize 2048 " + cmd);
     }

     static void gencert(String owner, String cmd) throws Exception {
         kt("-certreq -alias " + owner + " -file tmp.req");
         kt("-gencert -infile tmp.req -outfile tmp.cert " + cmd);
         kt("-import -alias " + owner + " -file tmp.cert");
     }

     static OutputAnalyzer js(String cmd) throws Exception {
         return SecurityTools.jarsigner("-debug " + cmd);
     }

     public static void main(String[] args) throws Exception {

         Files.write(Path.of("A1"), List.of("a1"));
         Files.write(Path.of("A2"), List.of("a2"));
         Files.write(Path.of("A3"), List.of("a3"));
         Files.write(Path.of("A4"), List.of("a4"));
         Files.write(Path.of("A5"), List.of("a5"));
         Files.write(Path.of("A6"), List.of("a6"));

         String year = "" + Calendar.getInstance().get(Calendar.YEAR);

         // ==========================================================
         // First part: output format
         // ==========================================================

         kt("-genkeypair -alias a1 -dname CN=a1 -validity 366");
         kt("-genkeypair -alias a2 -dname CN=a2 -validity 366");

         // a.jar includes 8 unsigned, 2 signed by a1 and a2, 2 signed by a3
         SecurityTools.jar("cvf a.jar A1 A2");
         js("-keystore ks -storepass changeit a.jar a1");
         SecurityTools.jar("uvf a.jar A3 A4");
         js("-keystore ks -storepass changeit a.jar a2");
         SecurityTools.jar("uvf a.jar A5 A6");

         // Verify OK
         js("-verify a.jar").shouldHaveExitValue(0);

         // 4(chainNotValidated)+16(hasUnsignedEntry)
         js("-verify a.jar -strict").shouldHaveExitValue(20);

         // 16(hasUnsignedEntry)
         js("-verify a.jar -strict -keystore ks -storepass changeit")
                 .shouldHaveExitValue(16);

         // 16(hasUnsignedEntry)+32(notSignedByAlias)
         js("-verify a.jar a1 -strict -keystore ks -storepass changeit")
                 .shouldHaveExitValue(48);

         // 16(hasUnsignedEntry)
         js("-verify a.jar a1 a2 -strict -keystore ks -storepass changeit")
                 .shouldHaveExitValue(16);

         // 12 entries all together
         Asserts.assertTrue(js("-verify a.jar -verbose")
                 .asLines().stream()
                 .filter(s -> s.contains(year))
                 .count() == 12);

         // 12 entries all listed
         Asserts.assertTrue(js("-verify a.jar -verbose:grouped")
                 .asLines().stream()
                 .filter(s -> s.contains(year))
                 .count() == 12);

         // 5 groups: MANIFEST, signature related entries, directory entries,
         // signed entries, and unsigned entries.
         Asserts.assertTrue(js("-verify a.jar -verbose:summary")
                 .asLines().stream()
                 .filter(s -> s.contains(year))
                 .count() == 5);

         // still 5 groups, but MANIFEST group and directiry entry group
         // have no other file
         Asserts.assertTrue(js("-verify a.jar -verbose:summary")
                 .asLines().stream()
                 .filter(s -> s.contains("more)"))
                 .count() == 3);

         // 6 groups: MANIFEST, signature related entries, directory entries,
         // signed entries by a1/a2, signed entries by a2, and unsigned entries.
         Asserts.assertTrue(js("-verify a.jar -verbose:summary -certs")
                 .asLines().stream()
                 .filter(s -> s.contains(year))
                 .count() == 6);

         // 2 for MANIFEST, 2*2 for A1/A2, 2 for A3/A4
         Asserts.assertTrue(js("-verify a.jar -verbose -certs")
                 .asLines().stream()
                 .filter(s -> s.contains("[certificate"))
                 .count() == 8);

         // a1,a2 for MANIFEST, a1,a2 for A1/A2, a2 for A3/A4
         Asserts.assertTrue(js("-verify a.jar -verbose:grouped -certs")
                 .asLines().stream()
                 .filter(s -> s.contains("[certificate"))
                 .count() == 5);

         // a1,a2 for MANIFEST, a1,a2 for A1/A2, a2 for A3/A4
         Asserts.assertTrue(js("-verify a.jar -verbose:summary -certs")
                 .asLines().stream()
                 .filter(s -> s.contains("[certificate"))
                 .count() == 5);

         // still 6 groups, but MANIFEST group and directory entry group
         // have no other file
         Asserts.assertTrue(js("-verify a.jar -verbose:summary -certs")
                 .asLines().stream()
                 .filter(s -> s.contains("more)"))
                 .count() == 4);

         // ==========================================================
         // Second part: exit code 2, 4, 8.
         // 16 and 32 already covered in the first part
         // ==========================================================

         kt("-genkeypair -alias ca -dname CN=ca -ext bc -validity 365");
         kt("-genkeypair -alias expired -dname CN=expired");
         gencert("expired", "-alias ca -startdate -10m");
         kt("-genkeypair -alias notyetvalid -dname CN=notyetvalid");
         gencert("notyetvalid", "-alias ca -startdate +1m");
         kt("-genkeypair -alias badku -dname CN=badku");
         gencert("badku", "-alias ca -ext KU=cRLSign -validity 365");
         kt("-genkeypair -alias badeku -dname CN=badeku");
         gencert("badeku", "-alias ca -ext EKU=sa -validity 365");
         kt("-genkeypair -alias goodku -dname CN=goodku");
         gencert("goodku", "-alias ca -ext KU=dig -validity 365");
         kt("-genkeypair -alias goodeku -dname CN=goodeku");
         gencert("goodeku", "-alias ca -ext EKU=codesign -validity 365");

         js("-strict -keystore ks -storepass changeit a.jar expired")
                 .shouldHaveExitValue(4);

         js("-strict -keystore ks -storepass changeit a.jar notyetvalid")
                 .shouldHaveExitValue(4);

         js("-strict -keystore ks -storepass changeit a.jar badku")
                 .shouldHaveExitValue(8);

         js("-strict -keystore ks -storepass changeit a.jar badeku")
                 .shouldHaveExitValue(8);

         js("-strict -keystore ks -storepass changeit a.jar goodku")
                 .shouldHaveExitValue(0);

         js("-strict -keystore ks -storepass changeit a.jar goodeku")
                 .shouldHaveExitValue(0);

         // badchain signed by ca1, but ca1 is removed later
         kt("-genkeypair -alias badchain -dname CN=badchain -validity 365");
         kt("-genkeypair -alias ca1 -dname CN=ca1 -ext bc -validity 365");
         gencert("badchain", "-alias ca1 -validity 365");

         // save ca1.cert for easy replay
         kt("-exportcert -file ca1.cert -alias ca1");
         kt("-delete -alias ca1");

         js("-strict -keystore ks -storepass changeit a.jar badchain")
                 .shouldHaveExitValue(4);

         js("-verify a.jar").shouldHaveExitValue(0);

         // ==========================================================
         // Third part: -certchain test
         // ==========================================================

         // altchain signed by ca2
         kt("-genkeypair -alias altchain -dname CN=altchain -validity 365");
         kt("-genkeypair -alias ca2 -dname CN=ca2 -ext bc -validity 365");
         kt("-certreq -alias altchain -file altchain.req");
         Files.write(Path.of("certchain"), List.of(
                 kt("-gencert -alias ca2 -validity 365 -rfc -infile altchain.req")
                         .getOutput(),
                 kt("-exportcert -alias ca2 -rfc").getOutput()));

         // Self-signed cert does not work
         js("-strict -keystore ks -storepass changeit a.jar altchain")
                 .shouldHaveExitValue(4);

         // -certchain works
         js("-strict -keystore ks -storepass changeit -certchain certchain "
                 + "a.jar altchain")
                 .shouldHaveExitValue(0);

         // if ca2 is removed and cert is imported, -certchain won't work
         // because this certificate entry is not trusted
         // save ca2.cert for easy replay
         kt("-exportcert -file ca2.cert -alias ca2");
         kt("-delete -alias ca2");
         kt("-importcert -file certchain -alias altchain -noprompt");
         js("-strict -keystore ks -storepass changeit "
                 + "-certchain certchain a.jar altchain")
                 .shouldHaveExitValue(4);

         js("-verify a.jar").shouldHaveExitValue(0);

         // ==========================================================
         // 8172529
         // ==========================================================

         kt("-genkeypair -alias ee -dname CN=ee");
         kt("-genkeypair -alias caone -dname CN=caone -ext bc:c");
         kt("-genkeypair -alias catwo -dname CN=catwo -ext bc:c");

         kt("-certreq -alias ee -file ee.req");
         kt("-certreq -alias catwo -file catwo.req");

         // This certchain contains a cross-signed weak catwo.cert
         Files.write(Path.of("ee2"), List.of(
                 kt("-gencert -alias catwo -rfc -infile ee.req").getOutput(),
                 kt("-gencert -alias caone -sigalg MD5withRSA -rfc "
                         + "-infile catwo.req").getOutput()));

         kt("-importcert -alias ee -file ee2");

         SecurityTools.jar("cvf a.jar A1");
         js("-strict -keystore ks -storepass changeit a.jar ee")
                 .shouldHaveExitValue(0);
         js("-strict -keystore ks -storepass changeit -verify a.jar")
                 .shouldHaveExitValue(0);
     }
 }
	/*
	* Copyright (c) 2009, 2021, Oracle and/or its affiliates. All rights reserved.
	* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
	*
	* This code is free software; you can redistribute it and/or modify it
	* under the terms of the GNU General Public License version 2 only, as
	* published by the Free Software Foundation.
	*
	* This code is distributed in the hope that it will be useful, but WITHOUT
	* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
	* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
	* version 2 for more details (a copy is included in the LICENSE file that
	* accompanied this code).
	*
	* You should have received a copy of the GNU General Public License version
	* 2 along with this work; if not, write to the Free Software Foundation,
	* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
	*
	* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
	* or visit www.oracle.com if you need additional information or have any
	* questions.
	*/

	/*
	* @test
	* @bug 6802846 8172529 8227758 8260960
	* @summary jarsigner needs enhanced cert validation(options)
	* @library /test/lib
	* @run main/timeout=240 ConciseJarsigner
	*/

	import jdk.test.lib.Asserts;
	import jdk.test.lib.SecurityTools;
	import jdk.test.lib.process.OutputAnalyzer;

	import java.nio.file.Files;
	import java.nio.file.Path;
	import java.util.Calendar;
	import java.util.List;

	public class ConciseJarsigner {

	static OutputAnalyzer kt(String cmd) throws Exception {
	// Choose 2048-bit RSA to make sure it runs fine and fast. In
	// fact, every keyalg/keysize combination is OK for this test.
	return SecurityTools.keytool("-storepass changeit -keypass changeit "
	+ "-keystore ks -keyalg rsa -keysize 2048 " + cmd);
	}

	static void gencert(String owner, String cmd) throws Exception {
	kt("-certreq -alias " + owner + " -file tmp.req");
	kt("-gencert -infile tmp.req -outfile tmp.cert " + cmd);
	kt("-import -alias " + owner + " -file tmp.cert");
	}

	static OutputAnalyzer js(String cmd) throws Exception {
	return SecurityTools.jarsigner("-debug " + cmd);
	}

	public static void main(String[] args) throws Exception {

	Files.write(Path.of("A1"), List.of("a1"));
	Files.write(Path.of("A2"), List.of("a2"));
	Files.write(Path.of("A3"), List.of("a3"));
	Files.write(Path.of("A4"), List.of("a4"));
	Files.write(Path.of("A5"), List.of("a5"));
	Files.write(Path.of("A6"), List.of("a6"));

	String year = "" + Calendar.getInstance().get(Calendar.YEAR);

	// ==========================================================
	// First part: output format
	// ==========================================================

	kt("-genkeypair -alias a1 -dname CN=a1 -validity 366");
	kt("-genkeypair -alias a2 -dname CN=a2 -validity 366");

	// a.jar includes 8 unsigned, 2 signed by a1 and a2, 2 signed by a3
	SecurityTools.jar("cvf a.jar A1 A2");
	js("-keystore ks -storepass changeit a.jar a1");
	SecurityTools.jar("uvf a.jar A3 A4");
	js("-keystore ks -storepass changeit a.jar a2");
	SecurityTools.jar("uvf a.jar A5 A6");

	// Verify OK
	js("-verify a.jar").shouldHaveExitValue(0);

	// 4(chainNotValidated)+16(hasUnsignedEntry)
	js("-verify a.jar -strict").shouldHaveExitValue(20);

	// 16(hasUnsignedEntry)
	js("-verify a.jar -strict -keystore ks -storepass changeit")
	.shouldHaveExitValue(16);

	// 16(hasUnsignedEntry)+32(notSignedByAlias)
	js("-verify a.jar a1 -strict -keystore ks -storepass changeit")
	.shouldHaveExitValue(48);

	// 16(hasUnsignedEntry)
	js("-verify a.jar a1 a2 -strict -keystore ks -storepass changeit")
	.shouldHaveExitValue(16);

	// 12 entries all together
	Asserts.assertTrue(js("-verify a.jar -verbose")
	.asLines().stream()
	.filter(s -> s.contains(year))
	.count() == 12);

	// 12 entries all listed
	Asserts.assertTrue(js("-verify a.jar -verbose:grouped")
	.asLines().stream()
	.filter(s -> s.contains(year))
	.count() == 12);

	// 5 groups: MANIFEST, signature related entries, directory entries,
	// signed entries, and unsigned entries.
	Asserts.assertTrue(js("-verify a.jar -verbose:summary")
	.asLines().stream()
	.filter(s -> s.contains(year))
	.count() == 5);

	// still 5 groups, but MANIFEST group and directiry entry group
	// have no other file
	Asserts.assertTrue(js("-verify a.jar -verbose:summary")
	.asLines().stream()
	.filter(s -> s.contains("more)"))
	.count() == 3);

	// 6 groups: MANIFEST, signature related entries, directory entries,
	// signed entries by a1/a2, signed entries by a2, and unsigned entries.
	Asserts.assertTrue(js("-verify a.jar -verbose:summary -certs")
	.asLines().stream()
	.filter(s -> s.contains(year))
	.count() == 6);

	// 2 for MANIFEST, 2*2 for A1/A2, 2 for A3/A4
	Asserts.assertTrue(js("-verify a.jar -verbose -certs")
	.asLines().stream()
	.filter(s -> s.contains("[certificate"))
	.count() == 8);

	// a1,a2 for MANIFEST, a1,a2 for A1/A2, a2 for A3/A4
	Asserts.assertTrue(js("-verify a.jar -verbose:grouped -certs")
	.asLines().stream()
	.filter(s -> s.contains("[certificate"))
	.count() == 5);

	// a1,a2 for MANIFEST, a1,a2 for A1/A2, a2 for A3/A4
	Asserts.assertTrue(js("-verify a.jar -verbose:summary -certs")
	.asLines().stream()
	.filter(s -> s.contains("[certificate"))
	.count() == 5);

	// still 6 groups, but MANIFEST group and directory entry group
	// have no other file
	Asserts.assertTrue(js("-verify a.jar -verbose:summary -certs")
	.asLines().stream()
	.filter(s -> s.contains("more)"))
	.count() == 4);

	// ==========================================================
	// Second part: exit code 2, 4, 8.
	// 16 and 32 already covered in the first part
	// ==========================================================

	kt("-genkeypair -alias ca -dname CN=ca -ext bc -validity 365");
	kt("-genkeypair -alias expired -dname CN=expired");
	gencert("expired", "-alias ca -startdate -10m");
	kt("-genkeypair -alias notyetvalid -dname CN=notyetvalid");
	gencert("notyetvalid", "-alias ca -startdate +1m");
	kt("-genkeypair -alias badku -dname CN=badku");
	gencert("badku", "-alias ca -ext KU=cRLSign -validity 365");
	kt("-genkeypair -alias badeku -dname CN=badeku");
	gencert("badeku", "-alias ca -ext EKU=sa -validity 365");
	kt("-genkeypair -alias goodku -dname CN=goodku");
	gencert("goodku", "-alias ca -ext KU=dig -validity 365");
	kt("-genkeypair -alias goodeku -dname CN=goodeku");
	gencert("goodeku", "-alias ca -ext EKU=codesign -validity 365");

	js("-strict -keystore ks -storepass changeit a.jar expired")
	.shouldHaveExitValue(4);

	js("-strict -keystore ks -storepass changeit a.jar notyetvalid")
	.shouldHaveExitValue(4);

	js("-strict -keystore ks -storepass changeit a.jar badku")
	.shouldHaveExitValue(8);

	js("-strict -keystore ks -storepass changeit a.jar badeku")
	.shouldHaveExitValue(8);

	js("-strict -keystore ks -storepass changeit a.jar goodku")
	.shouldHaveExitValue(0);

	js("-strict -keystore ks -storepass changeit a.jar goodeku")
	.shouldHaveExitValue(0);

	// badchain signed by ca1, but ca1 is removed later
	kt("-genkeypair -alias badchain -dname CN=badchain -validity 365");
	kt("-genkeypair -alias ca1 -dname CN=ca1 -ext bc -validity 365");
	gencert("badchain", "-alias ca1 -validity 365");

	// save ca1.cert for easy replay
	kt("-exportcert -file ca1.cert -alias ca1");
	kt("-delete -alias ca1");

	js("-strict -keystore ks -storepass changeit a.jar badchain")
	.shouldHaveExitValue(4);

	js("-verify a.jar").shouldHaveExitValue(0);

	// ==========================================================
	// Third part: -certchain test
	// ==========================================================

	// altchain signed by ca2
	kt("-genkeypair -alias altchain -dname CN=altchain -validity 365");
	kt("-genkeypair -alias ca2 -dname CN=ca2 -ext bc -validity 365");
	kt("-certreq -alias altchain -file altchain.req");
	Files.write(Path.of("certchain"), List.of(
	kt("-gencert -alias ca2 -validity 365 -rfc -infile altchain.req")
	.getOutput(),
	kt("-exportcert -alias ca2 -rfc").getOutput()));

	// Self-signed cert does not work
	js("-strict -keystore ks -storepass changeit a.jar altchain")
	.shouldHaveExitValue(4);

	// -certchain works
	js("-strict -keystore ks -storepass changeit -certchain certchain "
	+ "a.jar altchain")
	.shouldHaveExitValue(0);

	// if ca2 is removed and cert is imported, -certchain won't work
	// because this certificate entry is not trusted
	// save ca2.cert for easy replay
	kt("-exportcert -file ca2.cert -alias ca2");
	kt("-delete -alias ca2");
	kt("-importcert -file certchain -alias altchain -noprompt");
	js("-strict -keystore ks -storepass changeit "
	+ "-certchain certchain a.jar altchain")
	.shouldHaveExitValue(4);

	js("-verify a.jar").shouldHaveExitValue(0);

	// ==========================================================
	// 8172529
	// ==========================================================

	kt("-genkeypair -alias ee -dname CN=ee");
	kt("-genkeypair -alias caone -dname CN=caone -ext bc:c");
	kt("-genkeypair -alias catwo -dname CN=catwo -ext bc:c");

	kt("-certreq -alias ee -file ee.req");
	kt("-certreq -alias catwo -file catwo.req");

	// This certchain contains a cross-signed weak catwo.cert
	Files.write(Path.of("ee2"), List.of(
	kt("-gencert -alias catwo -rfc -infile ee.req").getOutput(),
	kt("-gencert -alias caone -sigalg MD5withRSA -rfc "
	+ "-infile catwo.req").getOutput()));

	kt("-importcert -alias ee -file ee2");

	SecurityTools.jar("cvf a.jar A1");
	js("-strict -keystore ks -storepass changeit a.jar ee")
	.shouldHaveExitValue(0);
	js("-strict -keystore ks -storepass changeit -verify a.jar")
	.shouldHaveExitValue(0);
	}
	}