1251N/A/*
2362N/A * Copyright (c) 2009, Oracle and/or its affiliates. All rights reserved.
1251N/A * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
1251N/A *
1251N/A * This code is free software; you can redistribute it and/or modify it
1251N/A * under the terms of the GNU General Public License version 2 only, as
1251N/A * published by the Free Software Foundation.
1251N/A *
1251N/A * This code is distributed in the hope that it will be useful, but WITHOUT
1251N/A * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
1251N/A * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
1251N/A * version 2 for more details (a copy is included in the LICENSE file that
1251N/A * accompanied this code).
1251N/A *
1251N/A * You should have received a copy of the GNU General Public License version
1251N/A * 2 along with this work; if not, write to the Free Software Foundation,
1251N/A * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
1251N/A *
2362N/A * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
2362N/A * or visit www.oracle.com if you need additional information or have any
2362N/A * questions.
1251N/A */
1251N/A
1251N/A/**
1251N/A * @test
1251N/A *
1251N/A * @bug 6720721
1251N/A * @summary CRL check with circular depency support needed
1251N/A * @author Xuelei Fan
1251N/A */
1251N/A
1251N/Aimport java.io.*;
1251N/Aimport java.net.SocketException;
1251N/Aimport java.util.*;
1251N/Aimport java.security.Security;
1251N/Aimport java.security.cert.*;
1251N/Aimport java.security.cert.CertPathValidatorException.BasicReason;
1251N/A
1251N/Apublic class CircularCRLOneLevelRevoked {
1251N/A
1251N/A static String selfSignedCertStr =
1251N/A "-----BEGIN CERTIFICATE-----\n" +
1251N/A "MIICPjCCAaegAwIBAgIBADANBgkqhkiG9w0BAQQFADAfMQswCQYDVQQGEwJVUzEQ\n" +
1251N/A "MA4GA1UEChMHRXhhbXBsZTAeFw0wOTA0MjcwMjI0MzJaFw0zMDA0MDcwMjI0MzJa\n" +
1251N/A "MB8xCzAJBgNVBAYTAlVTMRAwDgYDVQQKEwdFeGFtcGxlMIGfMA0GCSqGSIb3DQEB\n" +
1251N/A "AQUAA4GNADCBiQKBgQC4OTag24sTxL2tXTNuvpmUEtdxrYAZoFsslFQ60T+WD9wQ\n" +
1251N/A "Jeiw87FSPsR2vxRuv0j8DNm2a4h7LNNIFcLurfNldbz5pvgZ7VqdbbUMPE9qP85n\n" +
1251N/A "jgDl4woyRTSUeRI4A7O0CO6NpES21dtbdhroWQrEkHxpnrDPxsxrz5gf2m3gqwID\n" +
1251N/A "AQABo4GJMIGGMB0GA1UdDgQWBBSCJd0hpl5PdAD9IZS+Hzng4lXLGzBHBgNVHSME\n" +
1251N/A "QDA+gBSCJd0hpl5PdAD9IZS+Hzng4lXLG6EjpCEwHzELMAkGA1UEBhMCVVMxEDAO\n" +
1251N/A "BgNVBAoTB0V4YW1wbGWCAQAwDwYDVR0TAQH/BAUwAwEB/zALBgNVHQ8EBAMCAgQw\n" +
1251N/A "DQYJKoZIhvcNAQEEBQADgYEAluy6HIjWcq009lTLmhp+Np6dxU78pInBK8RZkza0\n" +
1251N/A "484qGaxFGD3UGyZkI5uWmsH2XuMbuox5khfIq6781gmkPBHXBIEtJN8eLusOHEye\n" +
1251N/A "iE8h7WI+N3qa6Pj56WionMrioqC/3X+b06o147bbhx8U0vkYv/HyPaITOFfMXTdz\n" +
1251N/A "Vjw=\n" +
1251N/A "-----END CERTIFICATE-----";
1251N/A
1251N/A static String dumCaCertStr =
1251N/A "-----BEGIN CERTIFICATE-----\n" +
1251N/A "MIICUDCCAbmgAwIBAgIBBTANBgkqhkiG9w0BAQQFADAfMQswCQYDVQQGEwJVUzEQ\n" +
1251N/A "MA4GA1UEChMHRXhhbXBsZTAeFw0wOTA0MjcwMjI0MzVaFw0yOTAxMTIwMjI0MzVa\n" +
1251N/A "MDExCzAJBgNVBAYTAlVTMRAwDgYDVQQKEwdFeGFtcGxlMRAwDgYDVQQLEwdDbGFz\n" +
1251N/A "cy1EMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDAwfZ3wIYzdCkiFIKjrUKc\n" +
1251N/A "0B32HaRkUeVJthadinLmoAVruCi3GRkLZUIPXDD9b7dFBbdeT1+8qDHV5wu/ES8W\n" +
1251N/A "bgfirO8ng8h2hRuJbZgtfljNnVc3fptjxo7x73aP++w2oIcmjzVwaV08sgahoaY4\n" +
1251N/A "f249t4EXbvjJQ8kuj1I8qQIDAQABo4GJMIGGMB0GA1UdDgQWBBR3fwdjpP4WiuyL\n" +
1251N/A "/MDVrXUORrarXDBHBgNVHSMEQDA+gBSCJd0hpl5PdAD9IZS+Hzng4lXLG6EjpCEw\n" +
1251N/A "HzELMAkGA1UEBhMCVVMxEDAOBgNVBAoTB0V4YW1wbGWCAQAwDwYDVR0TAQH/BAUw\n" +
1251N/A "AwEB/zALBgNVHQ8EBAMCAgQwDQYJKoZIhvcNAQEEBQADgYEAp/2sXI/XLtXu+X05\n" +
1251N/A "EISyBPQqdE3kgN3dmXOuoK9J7Io8jhgetdbr9S1WTSGBonaXZgc52FNsaaDU+VIp\n" +
1251N/A "TGTYU5SFloUyOu/e095eAf9Q867pAPcE5zArfKpXEBLbJwhLFwrsKPk/WZM7Yaxs\n" +
1251N/A "mihnXyZWWTA1sPZlVJu7/abJ2v0=\n" +
1251N/A "-----END CERTIFICATE-----";
1251N/A
1251N/A // a revoked certificate
1251N/A static String targetCertStr = dumCaCertStr;
1251N/A
1251N/A static String crlIssuerCertStr =
1251N/A "-----BEGIN CERTIFICATE-----\n" +
1251N/A "MIICKzCCAZSgAwIBAgIBAjANBgkqhkiG9w0BAQQFADAfMQswCQYDVQQGEwJVUzEQ\n" +
1251N/A "MA4GA1UEChMHRXhhbXBsZTAeFw0wOTA0MjcwMjI0MzNaFw0yOTAxMTIwMjI0MzNa\n" +
1251N/A "MB8xCzAJBgNVBAYTAlVTMRAwDgYDVQQKEwdFeGFtcGxlMIGfMA0GCSqGSIb3DQEB\n" +
1251N/A "AQUAA4GNADCBiQKBgQDMJeBMBybHykI/YpwUJ4O9euqDSLb1kpWpceBS8TVqvgBC\n" +
1251N/A "SgUJWtFZL0i6bdvF6mMdlbuBkGzhXqHiVAi96/zRLbUC9F8SMEJ6MuD+YhQ0ZFTQ\n" +
1251N/A "atKy8zf8O9XzztelLJ26Gqb7QPV133WY3haAqHtCXOhEKkCN16NOYNC37DTaJwID\n" +
1251N/A "AQABo3cwdTAdBgNVHQ4EFgQULXSWzXzUOIpOJpzbSCpW42IJUugwRwYDVR0jBEAw\n" +
1251N/A "PoAUgiXdIaZeT3QA/SGUvh854OJVyxuhI6QhMB8xCzAJBgNVBAYTAlVTMRAwDgYD\n" +
1251N/A "VQQKEwdFeGFtcGxlggEAMAsGA1UdDwQEAwIBAjANBgkqhkiG9w0BAQQFAAOBgQAY\n" +
1251N/A "eMnf5AHSNlyUlzXk8o2S0h4gCuvKX6C3kFfKuZcWvFAbx4yQOWLS2s15/nzR4+AP\n" +
1251N/A "FGX3lgJjROyAh7fGedTQK+NFWwkM2ag1g3hXktnlnT1qHohi0w31nVBJxXEDO/Ck\n" +
1251N/A "uJTpJGt8XxxbFaw5v7cHy7XuTAeU/sekvjEiNHW00Q==\n" +
1251N/A "-----END CERTIFICATE-----";
1251N/A
1251N/A static String crlStr =
1251N/A "-----BEGIN X509 CRL-----\n" +
1251N/A "MIIBGzCBhQIBATANBgkqhkiG9w0BAQQFADAfMQswCQYDVQQGEwJVUzEQMA4GA1UE\n" +
1251N/A "ChMHRXhhbXBsZRcNMDkwNDI3MDIzODA0WhcNMjgwNjI2MDIzODA0WjAiMCACAQUX\n" +
1251N/A "DTA5MDQyNzAyMzgwMFowDDAKBgNVHRUEAwoBBKAOMAwwCgYDVR0UBAMCAQIwDQYJ\n" +
1251N/A "KoZIhvcNAQEEBQADgYEAoarfzXEtw3ZDi4f9U8eSvRIipHSyxOrJC7HR/hM5VhmY\n" +
1251N/A "CErChny6x9lBVg9s57tfD/P9PSzBLusCcHwHMAbMOEcTltVVKUWZnnbumpywlYyg\n" +
1251N/A "oKLrE9+yCOkYUOpiRlz43/3vkEL5hjIKMcDSZnPKBZi1h16Yj2hPe9GMibNip54=\n" +
1251N/A "-----END X509 CRL-----";
1251N/A
1251N/A private static CertPath generateCertificatePath()
1251N/A throws CertificateException {
1251N/A // generate certificate from cert strings
1251N/A CertificateFactory cf = CertificateFactory.getInstance("X.509");
1251N/A
1251N/A ByteArrayInputStream is;
1251N/A
1251N/A is = new ByteArrayInputStream(targetCertStr.getBytes());
1251N/A Certificate targetCert = cf.generateCertificate(is);
1251N/A
1251N/A is = new ByteArrayInputStream(selfSignedCertStr.getBytes());
1251N/A Certificate selfSignedCert = cf.generateCertificate(is);
1251N/A
1251N/A // generate certification path
1251N/A List<Certificate> list = Arrays.asList(new Certificate[] {
1251N/A targetCert, selfSignedCert});
1251N/A
1251N/A return cf.generateCertPath(list);
1251N/A }
1251N/A
1251N/A private static Set<TrustAnchor> generateTrustAnchors()
1251N/A throws CertificateException {
1251N/A // generate certificate from cert string
1251N/A CertificateFactory cf = CertificateFactory.getInstance("X.509");
1251N/A
1251N/A ByteArrayInputStream is =
1251N/A new ByteArrayInputStream(selfSignedCertStr.getBytes());
1251N/A Certificate selfSignedCert = cf.generateCertificate(is);
1251N/A
1251N/A // generate a trust anchor
1251N/A TrustAnchor anchor =
1251N/A new TrustAnchor((X509Certificate)selfSignedCert, null);
1251N/A
1251N/A return Collections.singleton(anchor);
1251N/A }
1251N/A
1251N/A private static CertStore generateCertificateStore() throws Exception {
1251N/A // generate CRL from CRL string
1251N/A CertificateFactory cf = CertificateFactory.getInstance("X.509");
1251N/A
1251N/A ByteArrayInputStream is =
1251N/A new ByteArrayInputStream(crlStr.getBytes());
1251N/A
1251N/A // generate a cert store
1251N/A Collection crls = cf.generateCRLs(is);
1251N/A
1251N/A is = new ByteArrayInputStream(crlIssuerCertStr.getBytes());
1251N/A Collection certs = cf.generateCertificates(is);
1251N/A
1251N/A Collection entries = new HashSet();
1251N/A entries.addAll(crls);
1251N/A entries.addAll(certs);
1251N/A
1251N/A return CertStore.getInstance("Collection",
1251N/A new CollectionCertStoreParameters(entries));
1251N/A }
1251N/A
1251N/A public static void main(String args[]) throws Exception {
1251N/A CertPath path = generateCertificatePath();
1251N/A Set<TrustAnchor> anchors = generateTrustAnchors();
1251N/A CertStore crls = generateCertificateStore();
1251N/A
1251N/A PKIXParameters params = new PKIXParameters(anchors);
1251N/A
1251N/A // add the CRL store
1251N/A params.addCertStore(crls);
1251N/A
1251N/A // Activate certificate revocation checking
1251N/A params.setRevocationEnabled(true);
1251N/A
1251N/A // set the validation time
1251N/A params.setDate(new Date(109, 5, 1)); // 2009-05-01
1251N/A
1251N/A // disable OCSP checker
1251N/A Security.setProperty("ocsp.enable", "false");
1251N/A
1251N/A // enable CRL checker
1251N/A System.setProperty("com.sun.security.enableCRLDP", "true");
1251N/A
1251N/A CertPathValidator validator = CertPathValidator.getInstance("PKIX");
1251N/A
1251N/A try {
1251N/A validator.validate(path, params);
1251N/A throw new Exception("unexpected status, should be REVOKED");
1251N/A } catch (CertPathValidatorException cpve) {
1251N/A if (cpve.getReason() != BasicReason.REVOKED) {
1251N/A throw new Exception(
1251N/A "unexpected exception, should be a REVOKED CPVE", cpve);
1251N/A }
1251N/A }
1251N/A
1251N/A }
1251N/A}