Skip to content

Fix expired test certificates #54

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
m-atlantis merged 4 commits into from
Jan 15, 2025
Merged

Fix expired test certificates #54

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
139d25b
Make constant names readable
Bohlski Sep 30, 2024
8a2836c
Update expired certificates
Bohlski Oct 2, 2024
8ecbacb
Add class to provide test certificates dynamically and remove the har…
Bohlski Oct 2, 2024
bfba5c9
Add script to update certkeys
Bohlski Oct 2, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
21 changes: 6 additions & 15 deletions bitrepository-core/src/test/java/org/bitrepository/protocol/security/CertificateIDTest.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -46,15 +46,12 @@ public void positiveCertificateIdentificationTest() throws Exception {
addStep("Create CertificateID object based on the certificate used to sign the data", "CertificateID object not null");
Security.addProvider(new BouncyCastleProvider());

ByteArrayInputStream bs = new ByteArrayInputStream(
SecurityTestConstants.getPositiveCertificate().getBytes(SecurityModuleConstants.defaultEncodingType));
X509Certificate myCertificate = (X509Certificate) CertificateFactory.getInstance(
SecurityModuleConstants.CertificateType).generateCertificate(bs);
X509Certificate myCertificate = TestCertProvider.loadPositiveCert();
CertificateID certificateIDfromCertificate =
new CertificateID(myCertificate.getIssuerX500Principal(), myCertificate.getSerialNumber());

addStep("Create CertificateID object based on signature", "Certificate object not null");
byte[] decodeSig = Base64.decode(SecurityTestConstants.getSignature().getBytes(StandardCharsets.UTF_8));
byte[] decodeSig = Base64.decode(TestCertProvider.getPositiveCertSignature().getBytes(StandardCharsets.UTF_8));
CMSSignedData s = new CMSSignedData(new CMSProcessableByteArray(
SecurityTestConstants.getTestData().getBytes(SecurityModuleConstants.defaultEncodingType)), decodeSig);
SignerInformation signer = s.getSignerInfos().getSigners().iterator().next();
Expand All @@ -70,21 +67,18 @@ public void negativeCertificateIdentificationTest() throws Exception {
addStep("Create CertificateID object based on a certificate not used for signing the data", "CertificateID object not null");
Security.addProvider(new BouncyCastleProvider());

ByteArrayInputStream bs = new ByteArrayInputStream(
SecurityTestConstants.getNegativeCertificate().getBytes(SecurityModuleConstants.defaultEncodingType));
X509Certificate myCertificate = (X509Certificate) CertificateFactory.getInstance(
SecurityModuleConstants.CertificateType).generateCertificate(bs);
X509Certificate myCertificate = TestCertProvider.loadNegativeCert();
CertificateID certificateIDFromCertificate =
new CertificateID(myCertificate.getIssuerX500Principal(), myCertificate.getSerialNumber());

addStep("Create CertificateID object based on signature", "Certificate object not null");
byte[] decodeSig = Base64.decode(SecurityTestConstants.getSignature().getBytes(StandardCharsets.UTF_8));
byte[] decodeSig = Base64.decode(TestCertProvider.getPositiveCertSignature().getBytes(StandardCharsets.UTF_8));
CMSSignedData s = new CMSSignedData(new CMSProcessableByteArray(
SecurityTestConstants.getTestData().getBytes(SecurityModuleConstants.defaultEncodingType)), decodeSig);
SignerInformation signer = s.getSignerInfos().getSigners().iterator().next();
CertificateID certificateIDFromSignature = new CertificateID(signer.getSID().getIssuer(), signer.getSID().getSerialNumber());

addStep("Assert that the two CertificateID objects are equal", "Assert succeeds");
addStep("Assert that the two CertificateID objects are not equal", "Assert succeeds");
Assert.assertNotSame(certificateIDFromCertificate, certificateIDFromSignature);
}

Expand All @@ -94,10 +88,7 @@ public void equalTest() throws Exception {
addStep("Setup", "");
Security.addProvider(new BouncyCastleProvider());

ByteArrayInputStream bs = new ByteArrayInputStream(
SecurityTestConstants.getNegativeCertificate().getBytes(SecurityModuleConstants.defaultEncodingType));
X509Certificate myCertificate = (X509Certificate) CertificateFactory.getInstance(
SecurityModuleConstants.CertificateType).generateCertificate(bs);
X509Certificate myCertificate = TestCertProvider.loadNegativeCert();
X500Principal issuer = myCertificate.getIssuerX500Principal();
BigInteger serial = myCertificate.getSerialNumber();
CertificateID certificateID1 = new CertificateID(issuer, serial);
Expand Down
23 changes: 7 additions & 16 deletions ...epository-core/src/test/java/org/bitrepository/protocol/security/PermissionStoreTest.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -30,11 +30,8 @@
import org.testng.annotations.BeforeMethod;
import org.testng.annotations.Test;

import java.io.ByteArrayInputStream;
import java.math.BigInteger;
import java.security.cert.CertificateFactory;
import java.security.cert.X509Certificate;
import java.util.Locale;

import static org.testng.Assert.assertEquals;

Expand All @@ -53,16 +50,13 @@ public void positiveCertificateRetrievalTest() throws Exception {
addDescription("Tests that a certificate can be retrieved based on the correct signerId.");
addStep("Create signer to lookup certificate", "No exceptions");
byte[] decodeSig =
Base64.decode(SecurityTestConstants.getSignature().getBytes(SecurityModuleConstants.defaultEncodingType));
Base64.decode(TestCertProvider.getPositiveCertSignature().getBytes(SecurityModuleConstants.defaultEncodingType));
CMSSignedData s = new CMSSignedData(new CMSProcessableByteArray(
SecurityTestConstants.getTestData().getBytes(SecurityModuleConstants.defaultEncodingType)), decodeSig);
SignerInformation signer = s.getSignerInfos().getSigners().iterator().next();
addStep("Lookup certificate based on signerId", "No exceptions");
X509Certificate certificateFromStore = permissionStore.getCertificate(signer.getSID());
ByteArrayInputStream bs = new ByteArrayInputStream(
SecurityTestConstants.getPositiveCertificate().getBytes(SecurityModuleConstants.defaultEncodingType));
X509Certificate positiveCertificate = (X509Certificate) CertificateFactory.getInstance(
SecurityModuleConstants.CertificateType).generateCertificate(bs);
X509Certificate positiveCertificate = TestCertProvider.loadPositiveCert();
assertEquals(positiveCertificate, certificateFromStore);
}

Expand All @@ -71,7 +65,7 @@ public void negativeCertificateRetrievalTest() throws Exception {
addDescription("Tests that a certificate cannot be retrieved based on the wrong signerId.");
addStep("Create signer and modify its ID so lookup will fail", "No exceptions");
byte[] decodeSig =
Base64.decode(SecurityTestConstants.getSignature().getBytes(SecurityModuleConstants.defaultEncodingType));
Base64.decode(TestCertProvider.getPositiveCertSignature().getBytes(SecurityModuleConstants.defaultEncodingType));
CMSSignedData s = new CMSSignedData(new CMSProcessableByteArray(
SecurityTestConstants.getTestData().getBytes(SecurityModuleConstants.defaultEncodingType)), decodeSig);
SignerInformation signer = s.getSignerInfos().getSigners().iterator().next();
Expand All @@ -81,10 +75,7 @@ public void negativeCertificateRetrievalTest() throws Exception {
signerId = new SignerId(signerId.getIssuer(), serial);
addStep("Lookup certificate based on signerId", "No exceptions");
X509Certificate certificateFromStore = permissionStore.getCertificate(signerId);
ByteArrayInputStream bs = new ByteArrayInputStream(
SecurityTestConstants.getPositiveCertificate().getBytes(SecurityModuleConstants.defaultEncodingType));
X509Certificate positiveCertificate = (X509Certificate) CertificateFactory.getInstance(
SecurityModuleConstants.CertificateType).generateCertificate(bs);
X509Certificate positiveCertificate = TestCertProvider.loadPositiveCert();
assertEquals(positiveCertificate, certificateFromStore);
}

Expand All @@ -103,15 +94,15 @@ public void certificateFingerprintTest() throws Exception {
addDescription("Tests that a certificate fingerprint can correctly be retrieved for a signer.");
addFixture("Create signer to lookup fingerprint");
byte[] decodeSig =
Base64.decode(SecurityTestConstants.getSignature().getBytes(SecurityModuleConstants.defaultEncodingType));
Base64.decode(TestCertProvider.getPositiveCertSignature().getBytes(SecurityModuleConstants.defaultEncodingType));
CMSSignedData s = new CMSSignedData(new CMSProcessableByteArray(
SecurityTestConstants.getTestData().getBytes(SecurityModuleConstants.defaultEncodingType)), decodeSig);
SignerInformation signer = s.getSignerInfos().getSigners().iterator().next();

addStep("Lookup fingerprint based on signerId", "The correct finger print should be returned with openssl" +
"used to generate reference finger print");
String certificateFingerprintFromStore = permissionStore.getCertificateFingerprint(signer.getSID());
String referenceCertificateFingerprint = SecurityTestConstants.getFingerprintForSignatureCert();
assertEquals(referenceCertificateFingerprint.toLowerCase(Locale.ROOT).replaceAll(":", ""), certificateFingerprintFromStore);
String referenceCertificateFingerprint = TestCertProvider.getFingerprintForPositiveCert();
assertEquals(referenceCertificateFingerprint, certificateFingerprintFromStore);
}
}
27 changes: 12 additions & 15 deletions ...epository-core/src/test/java/org/bitrepository/protocol/security/SecurityManagerTest.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -44,7 +44,7 @@
import org.testng.annotations.BeforeMethod;
import org.testng.annotations.Test;

import java.io.UnsupportedEncodingException;
import java.io.IOException;
import java.nio.charset.StandardCharsets;
import java.util.List;

Expand Down Expand Up @@ -93,13 +93,13 @@ public void operationAuthorizationBehaviourTest() throws Exception {
addStep("Check that PUT_FILE is allowed for both collections.", "PUT_FILE is allowed.");
try {
securityManager.authorizeOperation(PutFileRequest.class.getSimpleName(),
SecurityTestConstants.getTestData(), SecurityTestConstants.getSignature(), collectionID1);
SecurityTestConstants.getTestData(), TestCertProvider.getPositiveCertSignature(), collectionID1);
} catch (OperationAuthorizationException e) {
Assert.fail(e.getMessage());
}
try {
securityManager.authorizeOperation(PutFileRequest.class.getSimpleName(),
SecurityTestConstants.getTestData(), SecurityTestConstants.getSignature(), collectionID2);
SecurityTestConstants.getTestData(), TestCertProvider.getPositiveCertSignature(), collectionID2);
} catch (OperationAuthorizationException e) {
Assert.fail(e.getMessage());
}
Expand All @@ -110,14 +110,14 @@ public void operationAuthorizationBehaviourTest() throws Exception {

try {
securityManager.authorizeOperation(GetFileRequest.class.getSimpleName(),
SecurityTestConstants.getTestData(), SecurityTestConstants.getSignature(), collectionID1);
SecurityTestConstants.getTestData(), TestCertProvider.getPositiveCertSignature(), collectionID1);
} catch (OperationAuthorizationException e) {
Assert.fail(e.getMessage());
}

try {
securityManager.authorizeOperation(GetFileRequest.class.getSimpleName(),
SecurityTestConstants.getTestData(), SecurityTestConstants.getSignature(), collectionID2);
SecurityTestConstants.getTestData(), TestCertProvider.getPositiveCertSignature(), collectionID2);
Assert.fail("SecurityManager did not throw the expected OperationAuthorizationException");
} catch (OperationAuthorizationException ignored) {
}
Expand All @@ -132,15 +132,15 @@ public void certificateAuthorizationBehaviourTest() throws Exception {

try {
securityManager.authorizeCertificateUse(SecurityTestConstants.getAllowedCertificateUser(),
SecurityTestConstants.getTestData(), SecurityTestConstants.getSignature());
SecurityTestConstants.getTestData(), TestCertProvider.getPositiveCertSignature());
} catch (CertificateUseException e) {
Assert.fail(e.getMessage());
}
Assert.assertNotNull(getSigningCertPermission().getPermission().get(0).getCertificate().getAllowedCertificateUsers());
addStep("Check that an unregistered component is not allowed.", "The unregistered component is not allowed.");
try {
securityManager.authorizeCertificateUse(SecurityTestConstants.getDisallowedCertificateUser(),
SecurityTestConstants.getTestData(), SecurityTestConstants.getSignature());
SecurityTestConstants.getTestData(), TestCertProvider.getPositiveCertSignature());
Assert.fail("SecurityManager did not throw the expected CertificateUseException");
} catch (CertificateUseException ignored) {
}
Expand Down Expand Up @@ -175,7 +175,7 @@ public void positiveSigningAuthenticationRoundtripTest() throws Exception {
public void negativeSigningAuthenticationRoundtripUnkonwnCertificateTest() throws Exception {
addDescription("Tests that a roundtrip of signing a request and afterwards authenticating it fails due to " +
"a unknown certificate.");
addStep("Sign a chunck of data.", "Data is signed succesfully");
addStep("Sign a chunk of data.", "Data is signed successfully");
String signature = null;
try {
signature = securityManager.signMessage(SecurityTestConstants.getTestData());
Expand Down Expand Up @@ -223,13 +223,12 @@ public void negativeSigningAuthenticationRoundtripBadDataTest() throws Exception
}
}

private PermissionSet getCollectionLimitedPermissionSet() throws UnsupportedEncodingException {
private PermissionSet getCollectionLimitedPermissionSet() throws Exception {
PermissionSet permissions = new PermissionSet();
Permission signingCertPerm = new Permission();

Certificate signingCert = new Certificate();
signingCert.setCertificateData(SecurityTestConstants.getPositiveCertificate()
.getBytes(SecurityModuleConstants.defaultEncodingType));
signingCert.setCertificateData(TestCertProvider.loadPositiveCert().getEncoded());

signingCertPerm.setCertificate(signingCert);
OperationPermission opPerm1 = new OperationPermission();
Expand All @@ -245,16 +244,14 @@ private PermissionSet getCollectionLimitedPermissionSet() throws UnsupportedEnco
return permissions;
}


private PermissionSet getSigningCertPermission() throws UnsupportedEncodingException {
private PermissionSet getSigningCertPermission() throws Exception {
PermissionSet permissions = new PermissionSet();
ComponentIDs allowedUsers = new ComponentIDs();
allowedUsers.getIDs().add(SecurityTestConstants.getAllowedCertificateUser());
Permission signingCertPerm = new Permission();

Certificate signingCert = new Certificate();
signingCert.setCertificateData(SecurityTestConstants.getSigningCertificate()
.getBytes(SecurityModuleConstants.defaultEncodingType));
signingCert.setCertificateData(TestCertProvider.loadSigningCert().getEncoded());
signingCert.setAllowedCertificateUsers(allowedUsers);

signingCertPerm.setCertificate(signingCert);
Expand Down
Loading