mirror of https://github.com/grpc/grpc-java.git
xds: SdsX509TrustManager implementation for XDS and SDS (#6254)
This commit is contained in:
sanjaypujare
GitHub
parent
024a46bd11
commit
a633b53f95
|
|
@ -0,0 +1,53 @@
|
||||||
|
/*
|
||||||
|
* Copyright 2019 The gRPC Authors
|
||||||
|
*
|
||||||
|
* Licensed under the Apache License, Version 2.0 (the "License");
|
||||||
|
* you may not use this file except in compliance with the License.
|
||||||
|
* You may obtain a copy of the License at
|
||||||
|
*
|
||||||
|
* http://www.apache.org/licenses/LICENSE-2.0
|
||||||
|
*
|
||||||
|
* Unless required by applicable law or agreed to in writing, software
|
||||||
|
* distributed under the License is distributed on an "AS IS" BASIS,
|
||||||
|
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||||
|
* See the License for the specific language governing permissions and
|
||||||
|
* limitations under the License.
|
||||||
|
*/
|
||||||
|
|
||||||
|
package io.grpc.xds.sds.trust;
|
||||||
|
|
||||||
|
import java.io.BufferedInputStream;
|
||||||
|
import java.io.FileInputStream;
|
||||||
|
import java.io.IOException;
|
||||||
|
import java.security.cert.Certificate;
|
||||||
|
import java.security.cert.CertificateException;
|
||||||
|
import java.security.cert.CertificateFactory;
|
||||||
|
import java.security.cert.X509Certificate;
|
||||||
|
import java.util.Collection;
|
||||||
|
|
||||||
|
/**
|
||||||
|
* Contains certificate utility method(s).
|
||||||
|
*/
|
||||||
|
final class CertificateUtils {
|
||||||
|
|
||||||
|
private static CertificateFactory factory;
|
||||||
|
|
||||||
|
private static synchronized void initInstance() throws CertificateException {
|
||||||
|
if (factory == null) {
|
||||||
|
factory = CertificateFactory.getInstance("X.509");
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
static synchronized X509Certificate[] toX509Certificates(String fileName)
|
||||||
|
throws CertificateException, IOException {
|
||||||
|
initInstance();
|
||||||
|
FileInputStream fis = new FileInputStream(fileName);
|
||||||
|
BufferedInputStream bis = new BufferedInputStream(fis);
|
||||||
|
try {
|
||||||
|
Collection<? extends Certificate> certs = factory.generateCertificates(bis);
|
||||||
|
return certs.toArray(new X509Certificate[0]);
|
||||||
|
} finally {
|
||||||
|
bis.close();
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
@ -0,0 +1,280 @@
|
||||||
|
/*
|
||||||
|
* Copyright 2019 The gRPC Authors
|
||||||
|
*
|
||||||
|
* Licensed under the Apache License, Version 2.0 (the "License");
|
||||||
|
* you may not use this file except in compliance with the License.
|
||||||
|
* You may obtain a copy of the License at
|
||||||
|
*
|
||||||
|
* http://www.apache.org/licenses/LICENSE-2.0
|
||||||
|
*
|
||||||
|
* Unless required by applicable law or agreed to in writing, software
|
||||||
|
* distributed under the License is distributed on an "AS IS" BASIS,
|
||||||
|
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||||
|
* See the License for the specific language governing permissions and
|
||||||
|
* limitations under the License.
|
||||||
|
*/
|
||||||
|
|
||||||
|
package io.grpc.xds.sds.trust;
|
||||||
|
|
||||||
|
import static com.google.common.base.Preconditions.checkNotNull;
|
||||||
|
|
||||||
|
import com.google.common.annotations.VisibleForTesting;
|
||||||
|
import io.envoyproxy.envoy.api.v2.auth.CertificateValidationContext;
|
||||||
|
import java.net.Socket;
|
||||||
|
import java.security.cert.CertificateException;
|
||||||
|
import java.security.cert.CertificateParsingException;
|
||||||
|
import java.security.cert.X509Certificate;
|
||||||
|
import java.util.Collection;
|
||||||
|
import java.util.List;
|
||||||
|
import java.util.Locale;
|
||||||
|
import javax.annotation.Nullable;
|
||||||
|
import javax.net.ssl.SSLEngine;
|
||||||
|
import javax.net.ssl.X509ExtendedTrustManager;
|
||||||
|
import javax.net.ssl.X509TrustManager;
|
||||||
|
|
||||||
|
/**
|
||||||
|
* Extension of {@link X509ExtendedTrustManager} that implements verification of
|
||||||
|
* SANs (subject-alternate-names) against the list in CertificateValidationContext.
|
||||||
|
*/
|
||||||
|
final class SdsX509TrustManager extends X509ExtendedTrustManager implements X509TrustManager {
|
||||||
|
|
||||||
|
// ref: io.grpc.okhttp.internal.OkHostnameVerifier and
|
||||||
|
// sun.security.x509.GeneralNameInterface
|
||||||
|
private static final int ALT_DNS_NAME = 2;
|
||||||
|
private static final int ALT_URI_NAME = 6;
|
||||||
|
private static final int ALT_IPA_NAME = 7;
|
||||||
|
|
||||||
|
private final X509ExtendedTrustManager delegate;
|
||||||
|
private final CertificateValidationContext certContext;
|
||||||
|
|
||||||
|
SdsX509TrustManager(@Nullable CertificateValidationContext certContext,
|
||||||
|
X509ExtendedTrustManager delegate) {
|
||||||
|
checkNotNull(delegate, "delegate");
|
||||||
|
this.certContext = certContext;
|
||||||
|
this.delegate = delegate;
|
||||||
|
}
|
||||||
|
|
||||||
|
// Copied from OkHostnameVerifier.verifyHostName().
|
||||||
|
private static boolean verifyDnsNameInPattern(String pattern, String sanToVerify) {
|
||||||
|
// Basic sanity checks
|
||||||
|
// Check length == 0 instead of .isEmpty() to support Java 5.
|
||||||
|
if (sanToVerify == null
|
||||||
|
|| sanToVerify.length() == 0
|
||||||
|
|| sanToVerify.startsWith(".")
|
||||||
|
|| sanToVerify.endsWith("..")) {
|
||||||
|
// Invalid domain name
|
||||||
|
return false;
|
||||||
|
}
|
||||||
|
if (pattern == null
|
||||||
|
|| pattern.length() == 0
|
||||||
|
|| pattern.startsWith(".")
|
||||||
|
|| pattern.endsWith("..")) {
|
||||||
|
// Invalid pattern/domain name
|
||||||
|
return false;
|
||||||
|
}
|
||||||
|
|
||||||
|
// Normalize sanToVerify and pattern by turning them into absolute domain names if they are not
|
||||||
|
// yet absolute. This is needed because server certificates do not normally contain absolute
|
||||||
|
// names or patterns, but they should be treated as absolute. At the same time, any sanToVerify
|
||||||
|
// presented to this method should also be treated as absolute for the purposes of matching
|
||||||
|
// to the server certificate.
|
||||||
|
// www.android.com matches www.android.com
|
||||||
|
// www.android.com matches www.android.com.
|
||||||
|
// www.android.com. matches www.android.com.
|
||||||
|
// www.android.com. matches www.android.com
|
||||||
|
if (!sanToVerify.endsWith(".")) {
|
||||||
|
sanToVerify += '.';
|
||||||
|
}
|
||||||
|
if (!pattern.endsWith(".")) {
|
||||||
|
pattern += '.';
|
||||||
|
}
|
||||||
|
// sanToVerify and pattern are now absolute domain names.
|
||||||
|
|
||||||
|
pattern = pattern.toLowerCase(Locale.US);
|
||||||
|
// sanToVerify and pattern are now in lower case -- domain names are case-insensitive.
|
||||||
|
|
||||||
|
if (!pattern.contains("*")) {
|
||||||
|
// Not a wildcard pattern -- sanToVerify and pattern must match exactly.
|
||||||
|
return sanToVerify.equals(pattern);
|
||||||
|
}
|
||||||
|
// Wildcard pattern
|
||||||
|
|
||||||
|
// WILDCARD PATTERN RULES:
|
||||||
|
// 1. Asterisk (*) is only permitted in the left-most domain name label and must be the
|
||||||
|
// only character in that label (i.e., must match the whole left-most label).
|
||||||
|
// For example, *.example.com is permitted, while *a.example.com, a*.example.com,
|
||||||
|
// a*b.example.com, a.*.example.com are not permitted.
|
||||||
|
// 2. Asterisk (*) cannot match across domain name labels.
|
||||||
|
// For example, *.example.com matches test.example.com but does not match
|
||||||
|
// sub.test.example.com.
|
||||||
|
// 3. Wildcard patterns for single-label domain names are not permitted.
|
||||||
|
|
||||||
|
if (!pattern.startsWith("*.") || pattern.indexOf('*', 1) != -1) {
|
||||||
|
// Asterisk (*) is only permitted in the left-most domain name label and must be the only
|
||||||
|
// character in that label
|
||||||
|
return false;
|
||||||
|
}
|
||||||
|
|
||||||
|
// Optimization: check whether sanToVerify is too short to match the pattern. sanToVerify must
|
||||||
|
// be at
|
||||||
|
// least as long as the pattern because asterisk must match the whole left-most label and
|
||||||
|
// sanToVerify starts with a non-empty label. Thus, asterisk has to match one or more
|
||||||
|
// characters.
|
||||||
|
if (sanToVerify.length() < pattern.length()) {
|
||||||
|
// sanToVerify too short to match the pattern.
|
||||||
|
return false;
|
||||||
|
}
|
||||||
|
|
||||||
|
if ("*.".equals(pattern)) {
|
||||||
|
// Wildcard pattern for single-label domain name -- not permitted.
|
||||||
|
return false;
|
||||||
|
}
|
||||||
|
|
||||||
|
// sanToVerify must end with the region of pattern following the asterisk.
|
||||||
|
String suffix = pattern.substring(1);
|
||||||
|
if (!sanToVerify.endsWith(suffix)) {
|
||||||
|
// sanToVerify does not end with the suffix
|
||||||
|
return false;
|
||||||
|
}
|
||||||
|
|
||||||
|
// Check that asterisk did not match across domain name labels.
|
||||||
|
int suffixStartIndexInHostName = sanToVerify.length() - suffix.length();
|
||||||
|
// Asterisk is matching across domain name labels -- not permitted.
|
||||||
|
return suffixStartIndexInHostName <= 0
|
||||||
|
|| sanToVerify.lastIndexOf('.', suffixStartIndexInHostName - 1) == -1;
|
||||||
|
|
||||||
|
// sanToVerify matches pattern
|
||||||
|
}
|
||||||
|
|
||||||
|
private static boolean verifyDnsNameInSanList(String altNameFromCert,
|
||||||
|
List<String> verifySanList) {
|
||||||
|
for (String verifySan : verifySanList) {
|
||||||
|
if (verifyDnsNameInPattern(altNameFromCert, verifySan)) {
|
||||||
|
return true;
|
||||||
|
}
|
||||||
|
}
|
||||||
|
return false;
|
||||||
|
}
|
||||||
|
|
||||||
|
/**
|
||||||
|
* helper function for verifying URI or IP address. For now we compare IP addresses as strings
|
||||||
|
* without any regard to IPv4 vs IPv6.
|
||||||
|
*
|
||||||
|
* @param stringFromCert either URI or IP address
|
||||||
|
* @param verifySanList list of SANs from certificate context
|
||||||
|
* @return true if there is a match
|
||||||
|
*/
|
||||||
|
private static boolean verifyStringInSanList(String stringFromCert, List<String> verifySanList) {
|
||||||
|
for (String sanToVerify : verifySanList) {
|
||||||
|
if (sanToVerify.equalsIgnoreCase(stringFromCert)) {
|
||||||
|
return true;
|
||||||
|
}
|
||||||
|
}
|
||||||
|
return false;
|
||||||
|
}
|
||||||
|
|
||||||
|
private static boolean verifyOneSanInList(List<?> entry, List<String> verifySanList)
|
||||||
|
throws CertificateParsingException {
|
||||||
|
// from OkHostnameVerifier.getSubjectAltNames
|
||||||
|
if (entry == null || entry.size() < 2) {
|
||||||
|
throw new CertificateParsingException("Invalid SAN entry");
|
||||||
|
}
|
||||||
|
Integer altNameType = (Integer) entry.get(0);
|
||||||
|
if (altNameType == null) {
|
||||||
|
throw new CertificateParsingException("Invalid SAN entry: null altNameType");
|
||||||
|
}
|
||||||
|
String altNameFromCert = (String) entry.get(1);
|
||||||
|
switch (altNameType) {
|
||||||
|
case ALT_DNS_NAME:
|
||||||
|
return verifyDnsNameInSanList(altNameFromCert, verifySanList);
|
||||||
|
case ALT_URI_NAME:
|
||||||
|
case ALT_IPA_NAME:
|
||||||
|
return verifyStringInSanList(altNameFromCert, verifySanList);
|
||||||
|
default:
|
||||||
|
throw new CertificateParsingException("Unsupported altNameType: " + altNameType);
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
// logic from Envoy::Extensions::TransportSockets::Tls::ContextImpl::verifySubjectAltName
|
||||||
|
private static void verifySubjectAltNameInLeaf(X509Certificate cert, List<String> verifyList)
|
||||||
|
throws CertificateException {
|
||||||
|
Collection<List<?>> names = cert.getSubjectAlternativeNames();
|
||||||
|
if (names == null || names.size() == 0) {
|
||||||
|
throw new CertificateException("Peer certificate SAN check failed");
|
||||||
|
}
|
||||||
|
for (List<?> name : names) {
|
||||||
|
if (verifyOneSanInList(name, verifyList)) {
|
||||||
|
return;
|
||||||
|
}
|
||||||
|
}
|
||||||
|
// at this point there's no match
|
||||||
|
throw new CertificateException("Peer certificate SAN check failed");
|
||||||
|
}
|
||||||
|
|
||||||
|
/**
|
||||||
|
* Verifies SANs in the peer cert chain against verify_subject_alt_name in the certContext.
|
||||||
|
* This is called from various check*Trusted methods.
|
||||||
|
*/
|
||||||
|
@VisibleForTesting
|
||||||
|
void verifySubjectAltNameInChain(X509Certificate[] peerCertChain) throws CertificateException {
|
||||||
|
if (certContext == null) {
|
||||||
|
return;
|
||||||
|
}
|
||||||
|
List<String> verifyList = certContext.getVerifySubjectAltNameList();
|
||||||
|
if (verifyList == null || verifyList.isEmpty()) {
|
||||||
|
return;
|
||||||
|
}
|
||||||
|
if (peerCertChain == null || peerCertChain.length < 1) {
|
||||||
|
throw new CertificateException("Peer certificate(s) missing");
|
||||||
|
}
|
||||||
|
// verify SANs only in the top cert (leaf cert)
|
||||||
|
verifySubjectAltNameInLeaf(peerCertChain[0], verifyList);
|
||||||
|
}
|
||||||
|
|
||||||
|
@Override
|
||||||
|
public void checkClientTrusted(X509Certificate[] chain, String authType, Socket socket)
|
||||||
|
throws CertificateException {
|
||||||
|
delegate.checkClientTrusted(chain, authType, socket);
|
||||||
|
verifySubjectAltNameInChain(chain);
|
||||||
|
}
|
||||||
|
|
||||||
|
@Override
|
||||||
|
public void checkClientTrusted(X509Certificate[] chain, String authType, SSLEngine sslEngine)
|
||||||
|
throws CertificateException {
|
||||||
|
delegate.checkClientTrusted(chain, authType, sslEngine);
|
||||||
|
verifySubjectAltNameInChain(chain);
|
||||||
|
}
|
||||||
|
|
||||||
|
@Override
|
||||||
|
public void checkClientTrusted(X509Certificate[] chain, String authType)
|
||||||
|
throws CertificateException {
|
||||||
|
delegate.checkClientTrusted(chain, authType);
|
||||||
|
verifySubjectAltNameInChain(chain);
|
||||||
|
}
|
||||||
|
|
||||||
|
@Override
|
||||||
|
public void checkServerTrusted(X509Certificate[] chain, String authType, Socket socket)
|
||||||
|
throws CertificateException {
|
||||||
|
delegate.checkServerTrusted(chain, authType, socket);
|
||||||
|
verifySubjectAltNameInChain(chain);
|
||||||
|
}
|
||||||
|
|
||||||
|
@Override
|
||||||
|
public void checkServerTrusted(X509Certificate[] chain, String authType, SSLEngine sslEngine)
|
||||||
|
throws CertificateException {
|
||||||
|
delegate.checkServerTrusted(chain, authType, sslEngine);
|
||||||
|
verifySubjectAltNameInChain(chain);
|
||||||
|
}
|
||||||
|
|
||||||
|
@Override
|
||||||
|
public void checkServerTrusted(X509Certificate[] chain, String authType)
|
||||||
|
throws CertificateException {
|
||||||
|
delegate.checkServerTrusted(chain, authType);
|
||||||
|
verifySubjectAltNameInChain(chain);
|
||||||
|
}
|
||||||
|
|
||||||
|
@Override
|
||||||
|
public X509Certificate[] getAcceptedIssuers() {
|
||||||
|
return delegate.getAcceptedIssuers();
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
@ -0,0 +1,18 @@
|
||||||
|
-----BEGIN CERTIFICATE-----
|
||||||
|
MIIC6TCCAlKgAwIBAgIBCjANBgkqhkiG9w0BAQsFADBWMQswCQYDVQQGEwJBVTET
|
||||||
|
MBEGA1UECBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQ
|
||||||
|
dHkgTHRkMQ8wDQYDVQQDEwZ0ZXN0Y2EwHhcNMTUxMTEwMDEwOTU4WhcNMjUxMTA3
|
||||||
|
MDEwOTU4WjBaMQswCQYDVQQGEwJBVTETMBEGA1UECAwKU29tZS1TdGF0ZTEhMB8G
|
||||||
|
A1UECgwYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMRMwEQYDVQQDDAp0ZXN0Y2xp
|
||||||
|
ZW50MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDsVEfbob4W3lVCDLOVmx9K
|
||||||
|
cdJnoZdvurGaTY87xNiopmaR8zCR7pFR9BX5L4bNG/PkuVLfVTVAKndyDCQggBBr
|
||||||
|
UTaEITNbfWK9swHJEr20WnKfhS/wo/Xg5sqNNCrFRmnnnwOA4eDlvmYZEzSnJXV6
|
||||||
|
pEro9bBH9uOCWWLqmaev7QIDAQABo4HCMIG/MAkGA1UdEwQCMAAwCwYDVR0PBAQD
|
||||||
|
AgXgMB0GA1UdDgQWBBQAdbW5Vml/CnYwqdP3mOHDARU+8zBwBgNVHSMEaTBnoVqk
|
||||||
|
WDBWMQswCQYDVQQGEwJBVTETMBEGA1UECBMKU29tZS1TdGF0ZTEhMB8GA1UEChMY
|
||||||
|
SW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMQ8wDQYDVQQDEwZ0ZXN0Y2GCCQCRxhke
|
||||||
|
HRoqBzAJBgNVHREEAjAAMAkGA1UdEgQCMAAwDQYJKoZIhvcNAQELBQADgYEAf4MM
|
||||||
|
k+sdzd720DfrQ0PF2gDauR3M9uBubozDuMuF6ufAuQBJSKGQEGibXbUelrwHmnql
|
||||||
|
UjTyfolVcxEBVaF4VFHmn7u6vP7S1NexIDdNUHcULqxIb7Tzl8JYq8OOHD2rQy4H
|
||||||
|
s8BXaVIzw4YcaCGAMS0iDX052Sy7e2JhP8Noxvo=
|
||||||
|
-----END CERTIFICATE-----
|
||||||
|
|
@ -0,0 +1,16 @@
|
||||||
|
-----BEGIN CERTIFICATE-----
|
||||||
|
MIICnDCCAgWgAwIBAgIBBzANBgkqhkiG9w0BAQsFADBWMQswCQYDVQQGEwJBVTET
|
||||||
|
MBEGA1UECBMKU29tZS1TdGF0ZTEhMB8GA1UEChMYSW50ZXJuZXQgV2lkZ2l0cyBQ
|
||||||
|
dHkgTHRkMQ8wDQYDVQQDEwZ0ZXN0Y2EwHhcNMTUxMTA0MDIyMDI0WhcNMjUxMTAx
|
||||||
|
MDIyMDI0WjBlMQswCQYDVQQGEwJVUzERMA8GA1UECBMISWxsaW5vaXMxEDAOBgNV
|
||||||
|
BAcTB0NoaWNhZ28xFTATBgNVBAoTDEV4YW1wbGUsIENvLjEaMBgGA1UEAxQRKi50
|
||||||
|
ZXN0Lmdvb2dsZS5jb20wgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAOHDFSco
|
||||||
|
LCVJpYDDM4HYtIdV6Ake/sMNaaKdODjDMsux/4tDydlumN+fm+AjPEK5GHhGn1Bg
|
||||||
|
zkWF+slf3BxhrA/8dNsnunstVA7ZBgA/5qQxMfGAq4wHNVX77fBZOgp9VlSMVfyd
|
||||||
|
9N8YwbBYAckOeUQadTi2X1S6OgJXgQ0m3MWhAgMBAAGjazBpMAkGA1UdEwQCMAAw
|
||||||
|
CwYDVR0PBAQDAgXgME8GA1UdEQRIMEaCECoudGVzdC5nb29nbGUuZnKCGHdhdGVy
|
||||||
|
em9vaS50ZXN0Lmdvb2dsZS5iZYISKi50ZXN0LnlvdXR1YmUuY29thwTAqAEDMA0G
|
||||||
|
CSqGSIb3DQEBCwUAA4GBAJFXVifQNub1LUP4JlnX5lXNlo8FxZ2a12AFQs+bzoJ6
|
||||||
|
hM044EDjqyxUqSbVePK0ni3w1fHQB5rY9yYC5f8G7aqqTY1QOhoUk8ZTSTRpnkTh
|
||||||
|
y4jjdvTZeLDVBlueZUTDRmy2feY5aZIU18vFDK08dTG0A87pppuv1LNIR3loveU8
|
||||||
|
-----END CERTIFICATE-----
|
||||||
|
|
@ -0,0 +1,236 @@
|
||||||
|
/*
|
||||||
|
* Copyright 2019 The gRPC Authors
|
||||||
|
*
|
||||||
|
* Licensed under the Apache License, Version 2.0 (the "License");
|
||||||
|
* you may not use this file except in compliance with the License.
|
||||||
|
* You may obtain a copy of the License at
|
||||||
|
*
|
||||||
|
* http://www.apache.org/licenses/LICENSE-2.0
|
||||||
|
*
|
||||||
|
* Unless required by applicable law or agreed to in writing, software
|
||||||
|
* distributed under the License is distributed on an "AS IS" BASIS,
|
||||||
|
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||||
|
* See the License for the specific language governing permissions and
|
||||||
|
* limitations under the License.
|
||||||
|
*/
|
||||||
|
|
||||||
|
package io.grpc.xds.sds.trust;
|
||||||
|
|
||||||
|
import static com.google.common.truth.Truth.assertThat;
|
||||||
|
|
||||||
|
import io.envoyproxy.envoy.api.v2.auth.CertificateValidationContext;
|
||||||
|
import java.io.FileNotFoundException;
|
||||||
|
import java.io.IOException;
|
||||||
|
import java.security.cert.CertificateException;
|
||||||
|
import java.security.cert.X509Certificate;
|
||||||
|
import javax.net.ssl.X509ExtendedTrustManager;
|
||||||
|
import org.junit.Assert;
|
||||||
|
import org.junit.Rule;
|
||||||
|
import org.junit.Test;
|
||||||
|
import org.junit.runner.RunWith;
|
||||||
|
import org.junit.runners.JUnit4;
|
||||||
|
import org.mockito.Mock;
|
||||||
|
import org.mockito.junit.MockitoJUnit;
|
||||||
|
import org.mockito.junit.MockitoRule;
|
||||||
|
|
||||||
|
/**
|
||||||
|
* Unit tests for {@link SdsX509TrustManager}.
|
||||||
|
*/
|
||||||
|
@RunWith(JUnit4.class)
|
||||||
|
public class SdsX509TrustManagerTest {
|
||||||
|
/**
|
||||||
|
* server1 has 4 SANs.
|
||||||
|
*/
|
||||||
|
private static final String SERVER_1_PEM_FILE = "src/test/certs/server1.pem";
|
||||||
|
|
||||||
|
/**
|
||||||
|
* client has no SANs.
|
||||||
|
*/
|
||||||
|
private static final String CLIENT_PEM_FILE = "src/test/certs/client.pem";
|
||||||
|
|
||||||
|
@Rule
|
||||||
|
public final MockitoRule mockitoRule = MockitoJUnit.rule();
|
||||||
|
|
||||||
|
@Mock
|
||||||
|
private X509ExtendedTrustManager mockDelegate;
|
||||||
|
|
||||||
|
@Test
|
||||||
|
public void nullCertContextTest() throws CertificateException, IOException {
|
||||||
|
SdsX509TrustManager trustManager = new SdsX509TrustManager(null, mockDelegate);
|
||||||
|
X509Certificate[] certs = CertificateUtils.toX509Certificates(SERVER_1_PEM_FILE);
|
||||||
|
trustManager.verifySubjectAltNameInChain(certs);
|
||||||
|
}
|
||||||
|
|
||||||
|
@Test
|
||||||
|
public void emptySanListContextTest() throws CertificateException, IOException {
|
||||||
|
CertificateValidationContext certContext = CertificateValidationContext.getDefaultInstance();
|
||||||
|
SdsX509TrustManager trustManager = new SdsX509TrustManager(certContext, mockDelegate);
|
||||||
|
X509Certificate[] certs = CertificateUtils.toX509Certificates(SERVER_1_PEM_FILE);
|
||||||
|
trustManager.verifySubjectAltNameInChain(certs);
|
||||||
|
}
|
||||||
|
|
||||||
|
@Test
|
||||||
|
public void missingPeerCerts() throws CertificateException, FileNotFoundException {
|
||||||
|
CertificateValidationContext certContext = CertificateValidationContext
|
||||||
|
.newBuilder()
|
||||||
|
.addVerifySubjectAltName("foo.com")
|
||||||
|
.build();
|
||||||
|
SdsX509TrustManager trustManager = new SdsX509TrustManager(certContext, mockDelegate);
|
||||||
|
try {
|
||||||
|
trustManager.verifySubjectAltNameInChain(null);
|
||||||
|
Assert.fail("no exception thrown");
|
||||||
|
} catch (CertificateException expected) {
|
||||||
|
assertThat(expected).hasMessageThat()
|
||||||
|
.isEqualTo("Peer certificate(s) missing");
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
@Test
|
||||||
|
public void emptyArrayPeerCerts() throws CertificateException, FileNotFoundException {
|
||||||
|
CertificateValidationContext certContext = CertificateValidationContext
|
||||||
|
.newBuilder()
|
||||||
|
.addVerifySubjectAltName("foo.com")
|
||||||
|
.build();
|
||||||
|
SdsX509TrustManager trustManager = new SdsX509TrustManager(certContext, mockDelegate);
|
||||||
|
try {
|
||||||
|
trustManager.verifySubjectAltNameInChain(new X509Certificate[0]);
|
||||||
|
Assert.fail("no exception thrown");
|
||||||
|
} catch (CertificateException expected) {
|
||||||
|
assertThat(expected).hasMessageThat()
|
||||||
|
.isEqualTo("Peer certificate(s) missing");
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
@Test
|
||||||
|
public void noSansInPeerCerts() throws CertificateException, IOException {
|
||||||
|
CertificateValidationContext certContext = CertificateValidationContext
|
||||||
|
.newBuilder()
|
||||||
|
.addVerifySubjectAltName("foo.com")
|
||||||
|
.build();
|
||||||
|
SdsX509TrustManager trustManager = new SdsX509TrustManager(certContext, mockDelegate);
|
||||||
|
X509Certificate[] certs = CertificateUtils.toX509Certificates(CLIENT_PEM_FILE);
|
||||||
|
try {
|
||||||
|
trustManager.verifySubjectAltNameInChain(certs);
|
||||||
|
Assert.fail("no exception thrown");
|
||||||
|
} catch (CertificateException expected) {
|
||||||
|
assertThat(expected).hasMessageThat()
|
||||||
|
.isEqualTo("Peer certificate SAN check failed");
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
@Test
|
||||||
|
public void oneSanInPeerCertsVerifies() throws CertificateException, IOException {
|
||||||
|
CertificateValidationContext certContext = CertificateValidationContext
|
||||||
|
.newBuilder()
|
||||||
|
.addVerifySubjectAltName("waterzooi.test.google.be")
|
||||||
|
.build();
|
||||||
|
SdsX509TrustManager trustManager = new SdsX509TrustManager(certContext, mockDelegate);
|
||||||
|
X509Certificate[] certs = CertificateUtils.toX509Certificates(SERVER_1_PEM_FILE);
|
||||||
|
trustManager.verifySubjectAltNameInChain(certs);
|
||||||
|
}
|
||||||
|
|
||||||
|
@Test
|
||||||
|
public void oneSanInPeerCertsVerifiesMultipleVerifySans()
|
||||||
|
throws CertificateException, IOException {
|
||||||
|
CertificateValidationContext certContext =
|
||||||
|
CertificateValidationContext.newBuilder()
|
||||||
|
.addVerifySubjectAltName("x.foo.com")
|
||||||
|
.addVerifySubjectAltName("waterzooi.test.google.be")
|
||||||
|
.build();
|
||||||
|
SdsX509TrustManager trustManager = new SdsX509TrustManager(certContext, mockDelegate);
|
||||||
|
X509Certificate[] certs = CertificateUtils.toX509Certificates(SERVER_1_PEM_FILE);
|
||||||
|
trustManager.verifySubjectAltNameInChain(certs);
|
||||||
|
}
|
||||||
|
|
||||||
|
@Test
|
||||||
|
public void oneSanInPeerCertsNotFoundException()
|
||||||
|
throws CertificateException, IOException {
|
||||||
|
CertificateValidationContext certContext =
|
||||||
|
CertificateValidationContext.newBuilder().addVerifySubjectAltName("x.foo.com").build();
|
||||||
|
SdsX509TrustManager trustManager = new SdsX509TrustManager(certContext, mockDelegate);
|
||||||
|
X509Certificate[] certs = CertificateUtils.toX509Certificates(SERVER_1_PEM_FILE);
|
||||||
|
try {
|
||||||
|
trustManager.verifySubjectAltNameInChain(certs);
|
||||||
|
Assert.fail("no exception thrown");
|
||||||
|
} catch (CertificateException expected) {
|
||||||
|
assertThat(expected).hasMessageThat().isEqualTo("Peer certificate SAN check failed");
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
@Test
|
||||||
|
public void wildcardSanInPeerCertsVerifiesMultipleVerifySans()
|
||||||
|
throws CertificateException, IOException {
|
||||||
|
CertificateValidationContext certContext = CertificateValidationContext
|
||||||
|
.newBuilder()
|
||||||
|
.addVerifySubjectAltName("x.foo.com")
|
||||||
|
.addVerifySubjectAltName("abc.test.youtube.com") // should match *.test.youtube.com
|
||||||
|
.build();
|
||||||
|
SdsX509TrustManager trustManager = new SdsX509TrustManager(certContext, mockDelegate);
|
||||||
|
X509Certificate[] certs = CertificateUtils.toX509Certificates(SERVER_1_PEM_FILE);
|
||||||
|
trustManager.verifySubjectAltNameInChain(certs);
|
||||||
|
}
|
||||||
|
|
||||||
|
@Test
|
||||||
|
public void wildcardSanInPeerCertsVerifiesMultipleVerifySans1()
|
||||||
|
throws CertificateException, IOException {
|
||||||
|
CertificateValidationContext certContext = CertificateValidationContext
|
||||||
|
.newBuilder()
|
||||||
|
.addVerifySubjectAltName("x.foo.com")
|
||||||
|
.addVerifySubjectAltName("abc.test.google.fr") // should match *.test.google.fr
|
||||||
|
.build();
|
||||||
|
SdsX509TrustManager trustManager = new SdsX509TrustManager(certContext, mockDelegate);
|
||||||
|
X509Certificate[] certs = CertificateUtils.toX509Certificates(SERVER_1_PEM_FILE);
|
||||||
|
trustManager.verifySubjectAltNameInChain(certs);
|
||||||
|
}
|
||||||
|
|
||||||
|
@Test
|
||||||
|
public void wildcardSanInPeerCertsSubdomainMismatch()
|
||||||
|
throws CertificateException, IOException {
|
||||||
|
// 2. Asterisk (*) cannot match across domain name labels.
|
||||||
|
// For example, *.example.com matches test.example.com but does not match
|
||||||
|
// sub.test.example.com.
|
||||||
|
CertificateValidationContext certContext = CertificateValidationContext
|
||||||
|
.newBuilder()
|
||||||
|
.addVerifySubjectAltName("sub.abc.test.youtube.com")
|
||||||
|
.build();
|
||||||
|
SdsX509TrustManager trustManager = new SdsX509TrustManager(certContext, mockDelegate);
|
||||||
|
X509Certificate[] certs = CertificateUtils.toX509Certificates(SERVER_1_PEM_FILE);
|
||||||
|
try {
|
||||||
|
trustManager.verifySubjectAltNameInChain(certs);
|
||||||
|
Assert.fail("no exception thrown");
|
||||||
|
} catch (CertificateException expected) {
|
||||||
|
assertThat(expected).hasMessageThat()
|
||||||
|
.isEqualTo("Peer certificate SAN check failed");
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
@Test
|
||||||
|
public void oneIpAddressInPeerCertsVerifies() throws CertificateException, IOException {
|
||||||
|
CertificateValidationContext certContext = CertificateValidationContext
|
||||||
|
.newBuilder()
|
||||||
|
.addVerifySubjectAltName("x.foo.com")
|
||||||
|
.addVerifySubjectAltName("192.168.1.3")
|
||||||
|
.build();
|
||||||
|
SdsX509TrustManager trustManager = new SdsX509TrustManager(certContext, mockDelegate);
|
||||||
|
X509Certificate[] certs = CertificateUtils.toX509Certificates(SERVER_1_PEM_FILE);
|
||||||
|
trustManager.verifySubjectAltNameInChain(certs);
|
||||||
|
}
|
||||||
|
|
||||||
|
@Test
|
||||||
|
public void oneIpAddressInPeerCertsMismatch() throws CertificateException, IOException {
|
||||||
|
CertificateValidationContext certContext = CertificateValidationContext
|
||||||
|
.newBuilder()
|
||||||
|
.addVerifySubjectAltName("x.foo.com")
|
||||||
|
.addVerifySubjectAltName("192.168.2.3")
|
||||||
|
.build();
|
||||||
|
SdsX509TrustManager trustManager = new SdsX509TrustManager(certContext, mockDelegate);
|
||||||
|
X509Certificate[] certs = CertificateUtils.toX509Certificates(SERVER_1_PEM_FILE);
|
||||||
|
try {
|
||||||
|
trustManager.verifySubjectAltNameInChain(certs);
|
||||||
|
Assert.fail("no exception thrown");
|
||||||
|
} catch (CertificateException expected) {
|
||||||
|
assertThat(expected).hasMessageThat()
|
||||||
|
.isEqualTo("Peer certificate SAN check failed");
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
Loading…
Reference in New Issue