2307N/A/*
2362N/A * Copyright (c) 2003, 2010, Oracle and/or its affiliates. All rights reserved.
2307N/A * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
2307N/A *
2307N/A * This code is free software; you can redistribute it and/or modify it
2307N/A * under the terms of the GNU General Public License version 2 only, as
2307N/A * published by the Free Software Foundation.
2307N/A *
2307N/A * This code is distributed in the hope that it will be useful, but WITHOUT
2307N/A * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
2307N/A * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
2307N/A * version 2 for more details (a copy is included in the LICENSE file that
2307N/A * accompanied this code).
2307N/A *
2307N/A * You should have received a copy of the GNU General Public License version
2307N/A * 2 along with this work; if not, write to the Free Software Foundation,
2307N/A * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
2307N/A *
2362N/A * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
2362N/A * or visit www.oracle.com if you need additional information or have any
2362N/A * questions.
2307N/A */
2307N/A
2307N/Aimport com.sun.net.httpserver.*;
2307N/Aimport java.io.BufferedReader;
2307N/Aimport java.io.ByteArrayOutputStream;
2307N/Aimport java.io.File;
2307N/Aimport java.io.FileInputStream;
2307N/Aimport java.io.FileOutputStream;
2307N/Aimport java.io.IOException;
2307N/Aimport java.io.InputStreamReader;
2307N/Aimport java.io.OutputStream;
2307N/Aimport java.math.BigInteger;
2307N/Aimport java.net.InetSocketAddress;
2307N/Aimport java.security.KeyStore;
2307N/Aimport java.security.PrivateKey;
2307N/Aimport java.security.Signature;
2307N/Aimport java.security.cert.Certificate;
2307N/Aimport java.security.cert.X509Certificate;
2307N/Aimport java.util.Calendar;
2307N/Aimport sun.security.pkcs.ContentInfo;
2307N/Aimport sun.security.pkcs.PKCS7;
2307N/Aimport sun.security.pkcs.SignerInfo;
2307N/Aimport sun.security.util.DerOutputStream;
2307N/Aimport sun.security.util.DerValue;
2307N/Aimport sun.security.util.ObjectIdentifier;
2307N/Aimport sun.security.x509.AlgorithmId;
2307N/Aimport sun.security.x509.X500Name;
2307N/A
2307N/Apublic class TimestampCheck {
2307N/A static final String TSKS = "tsks";
2307N/A static final String JAR = "old.jar";
2307N/A
2307N/A static class Handler implements HttpHandler {
2307N/A public void handle(HttpExchange t) throws IOException {
2307N/A int len = 0;
2307N/A for (String h: t.getRequestHeaders().keySet()) {
2307N/A if (h.equalsIgnoreCase("Content-length")) {
2307N/A len = Integer.valueOf(t.getRequestHeaders().get(h).get(0));
2307N/A }
2307N/A }
2307N/A byte[] input = new byte[len];
2307N/A t.getRequestBody().read(input);
2307N/A
2307N/A try {
2307N/A int path = 0;
2307N/A if (t.getRequestURI().getPath().length() > 1) {
2307N/A path = Integer.parseInt(
2307N/A t.getRequestURI().getPath().substring(1));
2307N/A }
2307N/A byte[] output = sign(input, path);
2307N/A Headers out = t.getResponseHeaders();
2307N/A out.set("Content-Type", "application/timestamp-reply");
2307N/A
2307N/A t.sendResponseHeaders(200, output.length);
2307N/A OutputStream os = t.getResponseBody();
2307N/A os.write(output);
2307N/A } catch (Exception e) {
2307N/A e.printStackTrace();
2307N/A t.sendResponseHeaders(500, 0);
2307N/A }
2307N/A t.close();
2307N/A }
2307N/A
2307N/A /**
2307N/A * @param input The data to sign
2307N/A * @param path different cases to simulate, impl on URL path
2307N/A * 0: normal
2307N/A * 1: Missing nonce
2307N/A * 2: Different nonce
2307N/A * 3: Bad digets octets in messageImprint
2307N/A * 4: Different algorithmId in messageImprint
2307N/A * 5: whole chain in cert set
2307N/A * 6: extension is missing
2307N/A * 7: extension is non-critical
2307N/A * 8: extension does not have timestamping
2307N/A * @returns the signed
2307N/A */
2307N/A byte[] sign(byte[] input, int path) throws Exception {
2307N/A // Read TSRequest
2307N/A DerValue value = new DerValue(input);
2307N/A System.err.println("\nIncoming Request\n===================");
2307N/A System.err.println("Version: " + value.data.getInteger());
2307N/A DerValue messageImprint = value.data.getDerValue();
2307N/A AlgorithmId aid = AlgorithmId.parse(
2307N/A messageImprint.data.getDerValue());
2307N/A System.err.println("AlgorithmId: " + aid);
2307N/A
2307N/A BigInteger nonce = null;
2307N/A while (value.data.available() > 0) {
2307N/A DerValue v = value.data.getDerValue();
2307N/A if (v.tag == DerValue.tag_Integer) {
2307N/A nonce = v.getBigInteger();
2307N/A System.err.println("nonce: " + nonce);
2307N/A } else if (v.tag == DerValue.tag_Boolean) {
2307N/A System.err.println("certReq: " + v.getBoolean());
2307N/A }
2307N/A }
2307N/A
2307N/A // Write TSResponse
2307N/A System.err.println("\nResponse\n===================");
2307N/A KeyStore ks = KeyStore.getInstance("JKS");
2307N/A ks.load(new FileInputStream(TSKS), "changeit".toCharArray());
2307N/A
2307N/A String alias = "ts";
2307N/A if (path == 6) alias = "tsbad1";
2307N/A if (path == 7) alias = "tsbad2";
2307N/A if (path == 8) alias = "tsbad3";
2307N/A
2307N/A DerOutputStream statusInfo = new DerOutputStream();
2307N/A statusInfo.putInteger(0);
5827N/A DerOutputStream statusStrings = new DerOutputStream();
5827N/A statusStrings.putUTF8String("Status for " + path);
5827N/A statusInfo.write(DerValue.tag_Sequence, statusStrings);
2307N/A
2307N/A DerOutputStream token = new DerOutputStream();
2307N/A AlgorithmId[] algorithms = {aid};
2307N/A Certificate[] chain = ks.getCertificateChain(alias);
2307N/A X509Certificate[] signerCertificateChain = null;
2307N/A X509Certificate signer = (X509Certificate)chain[0];
2307N/A if (path == 5) { // Only case 5 uses full chain
2307N/A signerCertificateChain = new X509Certificate[chain.length];
2307N/A for (int i=0; i<chain.length; i++) {
2307N/A signerCertificateChain[i] = (X509Certificate)chain[i];
2307N/A }
2307N/A } else if (path == 9) {
2307N/A signerCertificateChain = new X509Certificate[0];
2307N/A } else {
2307N/A signerCertificateChain = new X509Certificate[1];
2307N/A signerCertificateChain[0] = (X509Certificate)chain[0];
2307N/A }
2307N/A
2307N/A DerOutputStream tst = new DerOutputStream();
2307N/A
2307N/A tst.putInteger(1);
2307N/A tst.putOID(new ObjectIdentifier("1.2.3.4")); // policy
2307N/A
2307N/A if (path != 3 && path != 4) {
2307N/A tst.putDerValue(messageImprint);
2307N/A } else {
2307N/A byte[] data = messageImprint.toByteArray();
2307N/A if (path == 4) {
2307N/A data[6] = (byte)0x01;
2307N/A } else {
2307N/A data[data.length-1] = (byte)0x01;
2307N/A data[data.length-2] = (byte)0x02;
2307N/A data[data.length-3] = (byte)0x03;
2307N/A }
2307N/A tst.write(data);
2307N/A }
2307N/A
2307N/A tst.putInteger(1);
2307N/A
2307N/A Calendar cal = Calendar.getInstance();
2307N/A tst.putGeneralizedTime(cal.getTime());
2307N/A
2307N/A if (path == 2) {
2307N/A tst.putInteger(1234);
2307N/A } else if (path == 1) {
2307N/A // do nothing
2307N/A } else {
2307N/A tst.putInteger(nonce);
2307N/A }
2307N/A
2307N/A DerOutputStream tstInfo = new DerOutputStream();
2307N/A tstInfo.write(DerValue.tag_Sequence, tst);
2307N/A
2307N/A DerOutputStream tstInfo2 = new DerOutputStream();
2307N/A tstInfo2.putOctetString(tstInfo.toByteArray());
2307N/A
2307N/A Signature sig = Signature.getInstance("SHA1withDSA");
2307N/A sig.initSign((PrivateKey)(ks.getKey(
2307N/A alias, "changeit".toCharArray())));
2307N/A sig.update(tstInfo.toByteArray());
2307N/A
2307N/A ContentInfo contentInfo = new ContentInfo(new ObjectIdentifier(
2307N/A "1.2.840.113549.1.9.16.1.4"),
2307N/A new DerValue(tstInfo2.toByteArray()));
2307N/A
2307N/A System.err.println("Signing...");
2307N/A System.err.println(new X500Name(signer
2307N/A .getIssuerX500Principal().getName()));
2307N/A System.err.println(signer.getSerialNumber());
2307N/A
2307N/A SignerInfo signerInfo = new SignerInfo(
2307N/A new X500Name(signer.getIssuerX500Principal().getName()),
2307N/A signer.getSerialNumber(),
2307N/A aid, AlgorithmId.get("DSA"), sig.sign());
2307N/A
2307N/A SignerInfo[] signerInfos = {signerInfo};
2307N/A PKCS7 p7 =
2307N/A new PKCS7(algorithms, contentInfo, signerCertificateChain,
2307N/A signerInfos);
2307N/A ByteArrayOutputStream p7out = new ByteArrayOutputStream();
2307N/A p7.encodeSignedData(p7out);
2307N/A
2307N/A DerOutputStream response = new DerOutputStream();
2307N/A response.write(DerValue.tag_Sequence, statusInfo);
2307N/A response.putDerValue(new DerValue(p7out.toByteArray()));
2307N/A
2307N/A DerOutputStream out = new DerOutputStream();
2307N/A out.write(DerValue.tag_Sequence, response);
2307N/A
2307N/A return out.toByteArray();
2307N/A }
2307N/A }
2307N/A
2307N/A public static void main(String[] args) throws Exception {
2307N/A
2307N/A Handler h = new Handler();
2307N/A HttpServer server = HttpServer.create(new InetSocketAddress(0), 0);
2307N/A int port = server.getAddress().getPort();
2307N/A HttpContext ctx = server.createContext("/", h);
2307N/A server.start();
2307N/A
2307N/A String cmd = null;
2307N/A // Use -J-Djava.security.egd=file:/dev/./urandom to speed up
2307N/A // nonce generation in timestamping request. Not avaibale on
2307N/A // Windows and defaults to thread seed generator, not too bad.
2307N/A if (System.getProperty("java.home").endsWith("jre")) {
2307N/A cmd = System.getProperty("java.home") + "/../bin/jarsigner" +
2307N/A " -J-Djava.security.egd=file:/dev/./urandom" +
2307N/A " -debug -keystore " + TSKS + " -storepass changeit" +
2307N/A " -tsa http://localhost:" + port + "/%d" +
2307N/A " -signedjar new.jar " + JAR + " old";
2307N/A } else {
2307N/A cmd = System.getProperty("java.home") + "/bin/jarsigner" +
2307N/A " -J-Djava.security.egd=file:/dev/./urandom" +
2307N/A " -debug -keystore " + TSKS + " -storepass changeit" +
2307N/A " -tsa http://localhost:" + port + "/%d" +
2307N/A " -signedjar new.jar " + JAR + " old";
2307N/A }
2307N/A
2307N/A try {
2307N/A if (args.length == 0) { // Run this test
2307N/A jarsigner(cmd, 0, true); // Success, normal call
2307N/A jarsigner(cmd, 1, false); // These 4 should fail
2307N/A jarsigner(cmd, 2, false);
2307N/A jarsigner(cmd, 3, false);
2307N/A jarsigner(cmd, 4, false);
2307N/A jarsigner(cmd, 5, true); // Success, 6543440 solved.
2307N/A jarsigner(cmd, 6, false); // tsbad1
2307N/A jarsigner(cmd, 7, false); // tsbad2
2307N/A jarsigner(cmd, 8, false); // tsbad3
2307N/A jarsigner(cmd, 9, false); // no cert in timestamp
2307N/A } else { // Run as a standalone server
2307N/A System.err.println("Press Enter to quit server");
2307N/A System.in.read();
2307N/A }
2307N/A } finally {
2307N/A server.stop(0);
2307N/A new File("x.jar").delete();
2307N/A }
2307N/A }
2307N/A
2307N/A /**
2307N/A * @param cmd the command line (with a hole to plug in)
2307N/A * @param path the path in the URL, i.e, http://localhost/path
2307N/A * @param expected if this command should succeed
2307N/A */
2307N/A static void jarsigner(String cmd, int path, boolean expected)
2307N/A throws Exception {
2307N/A System.err.println("Test " + path);
2307N/A Process p = Runtime.getRuntime().exec(String.format(cmd, path));
2307N/A BufferedReader reader = new BufferedReader(
2307N/A new InputStreamReader(p.getErrorStream()));
2307N/A while (true) {
2307N/A String s = reader.readLine();
2307N/A if (s == null) break;
2307N/A System.err.println(s);
2307N/A }
2307N/A int result = p.waitFor();
2307N/A if (expected && result != 0 || !expected && result == 0) {
2307N/A throw new Exception("Failed");
2307N/A }
2307N/A }
2307N/A}