Skip to content

Commit

Permalink
Merge branch 'develop' into devsecops
Browse files Browse the repository at this point in the history
  • Loading branch information
aleks-ivanov committed Apr 9, 2024
2 parents 1832d18 + 6ace9e4 commit d511f08
Show file tree
Hide file tree
Showing 41 changed files with 1,258 additions and 33 deletions.
Original file line number Diff line number Diff line change
Expand Up @@ -23,6 +23,7 @@ You should have received a copy of the GNU Affero General Public License
using System;
using iText.Bouncycastleconnector;
using iText.Commons.Bouncycastle;
using iText.Commons.Bouncycastle.Asn1;
using iText.Commons.Bouncycastle.Asn1.X500;
using iText.Commons.Bouncycastle.Cert;
using iText.Commons.Bouncycastle.Crypto;
Expand Down Expand Up @@ -61,6 +62,11 @@ public virtual void AddCrlEntry(IX509Certificate certificate, int reason) {
crlBuilder.AddCRLEntry(certificate.GetSerialNumber(), nextUpdate, reason);
}

public virtual void AddExtension(IDerObjectIdentifier objectIdentifier, bool isCritical,
IAsn1Encodable extension) {
crlBuilder.AddExtension(objectIdentifier, isCritical, extension);
}

public virtual byte[] MakeCrl() {
crlBuilder.SetNextUpdate(nextUpdate);
IX509Crl crl = crlBuilder.Build(FACTORY.CreateContentSigner(SIGN_ALG, issuerPrivateKey));
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -173,6 +173,154 @@ public virtual void CrlSignatureMismatch() {
NUnit.Framework.Assert.AreEqual(CRLValidator.CRL_INVALID, report.GetFailures()[0].GetMessage());
}

[NUnit.Framework.Test]
public virtual void CrlContainsOnlyCACertsTest() {
String crlPath = SOURCE_FOLDER + "issuingDistributionPointTest/onlyCA.crl";
ValidationReport report = CheckCrlScope(crlPath);
NUnit.Framework.Assert.AreEqual(ValidationReport.ValidationResult.INDETERMINATE, report.GetValidationResult
());
NUnit.Framework.Assert.AreEqual(1, report.GetFailures().Count);
NUnit.Framework.Assert.AreEqual(CRLValidator.CERTIFICATE_IS_NOT_IN_THE_CRL_SCOPE, report.GetFailures()[0].
GetMessage());
}

[NUnit.Framework.Test]
public virtual void CrlContainsOnlyUserCertsTest() {
String crlPath = SOURCE_FOLDER + "issuingDistributionPointTest/onlyUser.crl";
ValidationReport report = CheckCrlScope(crlPath);
NUnit.Framework.Assert.AreEqual(ValidationReport.ValidationResult.VALID, report.GetValidationResult());
NUnit.Framework.Assert.AreEqual(0, report.GetFailures().Count);
}

[NUnit.Framework.Test]
public virtual void CrlContainsOnlyAttributeCertsTest() {
String crlPath = SOURCE_FOLDER + "issuingDistributionPointTest/onlyAttr.crl";
ValidationReport report = CheckCrlScope(crlPath);
NUnit.Framework.Assert.AreEqual(ValidationReport.ValidationResult.INDETERMINATE, report.GetValidationResult
());
NUnit.Framework.Assert.AreEqual(1, report.GetFailures().Count);
NUnit.Framework.Assert.AreEqual(CRLValidator.ATTRIBUTE_CERTS_ASSERTED, report.GetFailures()[0].GetMessage(
));
}

[NUnit.Framework.Test]
public virtual void OnlySomeReasonsTest() {
String root = SOURCE_FOLDER + "issuingDistributionPointTest/root.pem";
String sign = SOURCE_FOLDER + "issuingDistributionPointTest/sign.pem";
IX509Certificate rootCert = (IX509Certificate)PemFileHelper.ReadFirstChain(root)[0];
IPrivateKey rootKey = PemFileHelper.ReadFirstKey(root, KEY_PASSWORD);
IX509Certificate signCert = (IX509Certificate)PemFileHelper.ReadFirstChain(sign)[0];
TestCrlBuilder builder = new TestCrlBuilder(rootCert, rootKey);
builder.AddExtension(FACTORY.CreateExtensions().GetIssuingDistributionPoint(), true, FACTORY.CreateIssuingDistributionPoint
(null, false, false, FACTORY.CreateReasonFlags(CRLValidator.ALL_REASONS - 31), false, false));
IssuingCertificateRetriever certificateRetriever = new IssuingCertificateRetriever();
certificateRetriever.SetTrustedCertificates(JavaCollectionsUtil.SingletonList(rootCert));
ValidationReport report = new ValidationReport();
validator.SetIssuingCertificateRetriever(certificateRetriever);
validator.Validate(report, signCert, (IX509Crl)CertificateUtil.ParseCrlFromStream(new MemoryStream(builder
.MakeCrl())), TimeTestUtil.TEST_DATE_TIME);
NUnit.Framework.Assert.AreEqual(ValidationReport.ValidationResult.INDETERMINATE, report.GetValidationResult
());
NUnit.Framework.Assert.AreEqual(1, report.GetFailures().Count);
CertificateReportItem reportItem = (CertificateReportItem)report.GetFailures()[0];
NUnit.Framework.Assert.AreEqual(signCert, reportItem.GetCertificate());
NUnit.Framework.Assert.AreEqual(CRLValidator.ONLY_SOME_REASONS_CHECKED, reportItem.GetMessage());
}

[NUnit.Framework.Test]
public virtual void CheckLessReasonsTest() {
String fullCrlPath = SOURCE_FOLDER + "issuingDistributionPointTest/onlyUser.crl";
String root = SOURCE_FOLDER + "issuingDistributionPointTest/root.pem";
String sign = SOURCE_FOLDER + "issuingDistributionPointTest/sign.pem";
IX509Certificate rootCert = (IX509Certificate)PemFileHelper.ReadFirstChain(root)[0];
IPrivateKey rootKey = PemFileHelper.ReadFirstKey(root, KEY_PASSWORD);
IX509Certificate signCert = (IX509Certificate)PemFileHelper.ReadFirstChain(sign)[0];
TestCrlBuilder builder = new TestCrlBuilder(rootCert, rootKey);
builder.AddExtension(FACTORY.CreateExtensions().GetIssuingDistributionPoint(), true, FACTORY.CreateIssuingDistributionPoint
(null, false, false, FACTORY.CreateReasonFlags(CRLValidator.ALL_REASONS - 31), false, false));
IssuingCertificateRetriever certificateRetriever = new IssuingCertificateRetriever();
certificateRetriever.SetTrustedCertificates(JavaCollectionsUtil.SingletonList(rootCert));
ValidationReport report = new ValidationReport();
validator.SetIssuingCertificateRetriever(certificateRetriever);
// Validate full CRL.
validator.Validate(report, signCert, (IX509Crl)CertificateUtil.ParseCrlFromStream(FileUtil.GetInputStreamForFile
(fullCrlPath)), TimeTestUtil.TEST_DATE_TIME);
// Validate CRL with onlySomeReasons.
validator.Validate(report, signCert, (IX509Crl)CertificateUtil.ParseCrlFromStream(new MemoryStream(builder
.MakeCrl())), TimeTestUtil.TEST_DATE_TIME);
NUnit.Framework.Assert.AreEqual(ValidationReport.ValidationResult.VALID, report.GetValidationResult());
NUnit.Framework.Assert.AreEqual(0, report.GetFailures().Count);
CertificateReportItem reportItem = (CertificateReportItem)report.GetLogs()[1];
NUnit.Framework.Assert.AreEqual(signCert, reportItem.GetCertificate());
NUnit.Framework.Assert.AreEqual(CRLValidator.SAME_REASONS_CHECK, reportItem.GetMessage());
}

[NUnit.Framework.Test]
public virtual void RemoveFromCrlTest() {
String root = SOURCE_FOLDER + "issuingDistributionPointTest/root.pem";
String sign = SOURCE_FOLDER + "issuingDistributionPointTest/sign.pem";
IX509Certificate rootCert = (IX509Certificate)PemFileHelper.ReadFirstChain(root)[0];
IPrivateKey rootKey = PemFileHelper.ReadFirstKey(root, KEY_PASSWORD);
IX509Certificate signCert = (IX509Certificate)PemFileHelper.ReadFirstChain(sign)[0];
TestCrlBuilder builder = new TestCrlBuilder(rootCert, rootKey);
builder.AddCrlEntry(signCert, TimeTestUtil.TEST_DATE_TIME.AddDays(-1), FACTORY.CreateCRLReason().GetRemoveFromCRL
());
IssuingCertificateRetriever certificateRetriever = new IssuingCertificateRetriever();
certificateRetriever.SetTrustedCertificates(JavaCollectionsUtil.SingletonList(rootCert));
ValidationReport report = new ValidationReport();
validator.SetIssuingCertificateRetriever(certificateRetriever);
validator.Validate(report, signCert, (IX509Crl)CertificateUtil.ParseCrlFromStream(new MemoryStream(builder
.MakeCrl())), TimeTestUtil.TEST_DATE_TIME);
NUnit.Framework.Assert.AreEqual(ValidationReport.ValidationResult.VALID, report.GetValidationResult());
NUnit.Framework.Assert.AreEqual(0, report.GetFailures().Count);
CertificateReportItem reportItem = (CertificateReportItem)report.GetLogs()[1];
NUnit.Framework.Assert.AreEqual(signCert, reportItem.GetCertificate());
NUnit.Framework.Assert.AreEqual(CRLValidator.CERTIFICATE_IS_UNREVOKED, reportItem.GetMessage());
}

[NUnit.Framework.Test]
public virtual void FullCrlButDistributionPointWithReasonsTest() {
DateTime checkDate = TimeTestUtil.TEST_DATE_TIME;
IX509Certificate caCert = (IX509Certificate)PemFileHelper.ReadFirstChain(SOURCE_FOLDER + "issuingDistributionPointTest/rootCert.pem"
)[0];
IPrivateKey caPrivateKey = PemFileHelper.ReadFirstKey(SOURCE_FOLDER + "issuingDistributionPointTest/rootCert.pem"
, KEY_PASSWORD);
IX509Certificate cert = (IX509Certificate)PemFileHelper.ReadFirstChain(SOURCE_FOLDER + "issuingDistributionPointTest/certWithDPReasons.pem"
)[0];
TestCrlBuilder builder = new TestCrlBuilder(caCert, caPrivateKey);
builder.AddExtension(FACTORY.CreateExtensions().GetIssuingDistributionPoint(), true, FACTORY.CreateIssuingDistributionPoint
(FACTORY.CreateDistributionPointName(FACTORY.CreateCRLDistPoint(CertificateUtil.GetExtensionValue(cert
, FACTORY.CreateExtensions().GetCRlDistributionPoints().GetId())).GetDistributionPoints()[0].GetCRLIssuer
()), false, false, null, false, false));
IssuingCertificateRetriever certificateRetriever = new IssuingCertificateRetriever();
certificateRetriever.SetTrustedCertificates(JavaCollectionsUtil.SingletonList(caCert));
ValidationReport report = new ValidationReport();
validator.SetIssuingCertificateRetriever(certificateRetriever);
validator.Validate(report, cert, (IX509Crl)CertificateUtil.ParseCrlFromStream(new MemoryStream(builder.MakeCrl
())), checkDate);
NUnit.Framework.Assert.AreEqual(ValidationReport.ValidationResult.INDETERMINATE, report.GetValidationResult
());
NUnit.Framework.Assert.AreEqual(1, report.GetFailures().Count);
CertificateReportItem reportItem = (CertificateReportItem)report.GetLogs()[1];
NUnit.Framework.Assert.AreEqual(ReportItem.ReportItemStatus.INDETERMINATE, reportItem.GetStatus());
NUnit.Framework.Assert.AreEqual(cert, reportItem.GetCertificate());
NUnit.Framework.Assert.AreEqual(CRLValidator.ONLY_SOME_REASONS_CHECKED, reportItem.GetMessage());
}

private ValidationReport CheckCrlScope(String crlPath) {
String root = SOURCE_FOLDER + "issuingDistributionPointTest/root.pem";
String sign = SOURCE_FOLDER + "issuingDistributionPointTest/sign.pem";
IX509Certificate rootCert = (IX509Certificate)PemFileHelper.ReadFirstChain(root)[0];
IX509Certificate signCert = (IX509Certificate)PemFileHelper.ReadFirstChain(sign)[0];
IssuingCertificateRetriever certificateRetriever = new IssuingCertificateRetriever();
certificateRetriever.SetTrustedCertificates(JavaCollectionsUtil.SingletonList(rootCert));
ValidationReport report = new ValidationReport();
validator.SetIssuingCertificateRetriever(certificateRetriever);
validator.Validate(report, signCert, (IX509Crl)CertificateUtil.ParseCrlFromStream(FileUtil.GetInputStreamForFile
(crlPath)), TimeTestUtil.TEST_DATE_TIME);
return report;
}

private void RetrieveTestResources(String path) {
String resourcePath = SOURCE_FOLDER + path + "/";
crlIssuerCert = (IX509Certificate)PemFileHelper.ReadFirstChain(resourcePath + "crl-issuer.cert.pem")[0];
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -259,7 +259,7 @@ public virtual void CrlEncodingErrorTest() {
crl[5] = 0;
ValidationReport report = new ValidationReport();
new RevocationDataValidator().SetIssuingCertificateRetriever(new IssuingCertificateRetriever()).SetOnlineFetching
(RevocationDataValidator.OnlineFetching.NEVER_FETCH).AddCrlClient(new _ICrlClient_309(crl)).Validate(report
(RevocationDataValidator.OnlineFetching.NEVER_FETCH).AddCrlClient(new _ICrlClient_310(crl)).Validate(report
, checkCert, TimeTestUtil.TEST_DATE_TIME);
CertificateReportItem item = (CertificateReportItem)report.GetLogs()[0];
NUnit.Framework.Assert.AreEqual(RevocationDataValidator.REVOCATION_DATA_CHECK, item.GetCheckName());
Expand All @@ -271,8 +271,8 @@ public virtual void CrlEncodingErrorTest() {
());
}

private sealed class _ICrlClient_309 : ICrlClient {
public _ICrlClient_309(byte[] crl) {
private sealed class _ICrlClient_310 : ICrlClient {
public _ICrlClient_310(byte[] crl) {
this.crl = crl;
}

Expand Down Expand Up @@ -348,5 +348,33 @@ public virtual void SortResponsesTest() {
NUnit.Framework.Assert.AreEqual(ValidationReport.ValidationResult.VALID, report.GetValidationResult());
NUnit.Framework.Assert.AreEqual(ValidationReport.ValidationResult.VALID, report.GetValidationResult());
}

[NUnit.Framework.Test]
public virtual void CrlWithOnlySomeReasonsTest() {
TestCrlBuilder builder1 = new TestCrlBuilder(caCert, caPrivateKey);
builder1.AddExtension(FACTORY.CreateExtensions().GetIssuingDistributionPoint(), true, FACTORY.CreateIssuingDistributionPoint
(null, false, false, FACTORY.CreateReasonFlags(CRLValidator.ALL_REASONS - 31), false, false));
TestCrlBuilder builder2 = new TestCrlBuilder(caCert, caPrivateKey);
builder2.AddExtension(FACTORY.CreateExtensions().GetIssuingDistributionPoint(), true, FACTORY.CreateIssuingDistributionPoint
(null, false, false, FACTORY.CreateReasonFlags(31), false, false));
TestCrlClient crlClient = new TestCrlClient().AddBuilderForCertIssuer(builder1).AddBuilderForCertIssuer(builder2
);
TestOcspResponseBuilder ocspBuilder = new TestOcspResponseBuilder(responderCert, ocspRespPrivateKey);
ocspBuilder.SetProducedAt(TimeTestUtil.TEST_DATE_TIME.AddDays(-100));
IssuingCertificateRetriever certificateRetriever = new IssuingCertificateRetriever();
certificateRetriever.SetTrustedCertificates(JavaCollectionsUtil.SingletonList(caCert));
ValidationReport report = new ValidationReport();
RevocationDataValidator validator = new RevocationDataValidator();
validator.SetIssuingCertificateRetriever(certificateRetriever).SetOnlineFetching(RevocationDataValidator.OnlineFetching
.NEVER_FETCH).AddOcspClient(new TestOcspClient().AddBuilderForCertIssuer(caCert, ocspBuilder)).AddCrlClient
(crlClient);
validator.Validate(report, checkCert, TimeTestUtil.TEST_DATE_TIME);
NUnit.Framework.Assert.AreEqual(ValidationReport.ValidationResult.VALID, report.GetValidationResult());
NUnit.Framework.Assert.AreEqual(0, report.GetFailures().Count);
CertificateReportItem reportItem = (CertificateReportItem)report.GetLogs()[2];
NUnit.Framework.Assert.AreEqual(ReportItem.ReportItemStatus.INFO, reportItem.GetStatus());
NUnit.Framework.Assert.AreEqual(checkCert, reportItem.GetCertificate());
NUnit.Framework.Assert.AreEqual(CRLValidator.ONLY_SOME_REASONS_CHECKED, reportItem.GetMessage());
}
}
}
Original file line number Diff line number Diff line change
@@ -0,0 +1,43 @@
-----BEGIN CERTIFICATE-----
MIIDpDCCAoygAwIBAgIGAY6kl7FUMA0GCSqGSIb3DQEBCwUAMDgxCzAJBgNVBAYTAkJZMQ4wDAYD
VQQKDAVpVGV4dDEZMBcGA1UEAwwQaVRleHRUZXN0Um9vdFJzYTAeFw0wMDAyMTQxNDE0MDJaFw0w
MDA1MjQxMzE0MDJaMDcxFjAUBgNVBAMMDWlUZXh0VGVzdENlcnQxDTALBgNVBAsMBHRlc3QxDjAM
BgNVBAoMBWlUZXh0MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAq4m0V6uRujr5h2FQ
vezGQjlP9BtOEZEPwdvIJczqQWhAG7Olesllm2udi4OEmnitka+XYHlJPBXnnxteywwktmMcaWGx
mnuTKKFEx5V/m84Az5GV+5tKM1gVSVunpamewshc3YGCN97/gFdz8nGmKvNkOQ7SZeq22+FITrTK
Hj87GBJM8BzGBiqaR5c0nopOzlvZDvok//IGrmvN2dgSLOD4Igvt2xrDTT46gYd3Q6k8/FITEEcJ
W2aG2s1bHcxaZgiceDs19rG0pEFrkTsG8tf8M3nClznTHSLUL+qS2ERuMVM2aJ+OB0BfYj/GI+wX
yEvb1QlhRz6r199N7NfSPQIDAQABo4G0MIGxME0GA1UdHwRGMEQwQoECBkCiPKQ6MDgxCzAJBgNV
BAYTAkJZMQ4wDAYDVQQKDAVpVGV4dDEZMBcGA1UEAwwQaVRleHRUZXN0Um9vdFJzYTALBgNVHQ8E
BAMCBsAwEwYDVR0lBAwwCgYIKwYBBQUHAwkwHwYDVR0jBBgwFoAUKYO2iYwywrpWL5ROacKs3Ao0
hUEwHQYDVR0OBBYEFCmDtomMMsK6Vi+UTmnCrNwKNIVBMA0GCSqGSIb3DQEBCwUAA4IBAQApJXsL
9qwK9cpTh6U2u3Wtf4Tm73Wkdb1nbnj1PWyUdH4W0fRGIjkyiCD5u133e1LkYPRT4MYdbQ43nNiI
nxCPPpE4bnoSRAs6vT2hkifVXQYAw+8fvji8vkyD1TbhZNyP+/FV73GmxetWV+jSXpe4UMe9gDaN
hbIyTAzR6FHJH7i3wEaThcO+03jZZjLNJxEt5hwY0DgaOLtvrnR7ym2Rsj7FoTIJyXRovlTo6MC8
vj5SjdwTxN7FWg80xioTcw7oJq+u1KJzId7XC0+zzcXvFjILDFP15fQvEN+vr0Kwsm43zae8tprT
QOA7FKDF5H3PeLppzjOFMsuCkEAH52FQ
-----END CERTIFICATE-----
-----BEGIN PRIVATE KEY-----
MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQCribRXq5G6OvmHYVC97MZCOU/0
G04RkQ/B28glzOpBaEAbs6V6yWWba52Lg4SaeK2Rr5dgeUk8FeefG17LDCS2YxxpYbGae5MooUTH
lX+bzgDPkZX7m0ozWBVJW6elqZ7CyFzdgYI33v+AV3PycaYq82Q5DtJl6rbb4UhOtMoePzsYEkzw
HMYGKppHlzSeik7OW9kO+iT/8gaua83Z2BIs4PgiC+3bGsNNPjqBh3dDqTz8UhMQRwlbZobazVsd
zFpmCJx4OzX2sbSkQWuROwby1/wzecKXOdMdItQv6pLYRG4xUzZon44HQF9iP8Yj7BfIS9vVCWFH
PqvX303s19I9AgMBAAECggEAEw9f/IXR0XGQHFzRzeirNtyLZ8JI8Ga/63hyStD0DoR46xsQ/g22
vog8ny3j5A4YqyFpnoybeJOugt1VsRYOVj25AHSceV/VwCP7MnoIDdXb/TReB/D/U6kr5FTM0fmA
7H+64dnsEC01EpulBIFgR1F4B2cANdbYrqHfmO85rhaFij2/XwozBfzzYTTWpzeHmPvbR3/7SEn+
k9aeJV6PDY5Iaqcz27L0igXIDECJU031UIa9ILFs4bWsbFwxs37qXzJRaFT+hUB81dNgOLIOE5yO
VBX3BH56S9Of6vd04grf1k4ZZlJCxC7Lncg/TFLqOTh+9TPPSGOW4UkM7qIr+QKBgQDvyXbXy+al
nPWtoZxx9gkauBE+hf/w3Tcl7LP9IVh/wxbyiaZu0Hytq0DcsifHr5tvxAcclL/FmMYvlJwGxCyP
l/6BUytA7sm0Y8mgkPFHr3aHwwY9aLcDaaJyTEm37ETYSzBUAmAh2+lWdtjFkI7bbsdr4+3fLbR9
L1uT8+px6wKBgQC3IuY2C54vB2fr8JI2vRllkUiOLt2PUZUFQPAQbB3TYEAS695FfvPa0aYb25ZU
9DF/XoovGjMMPthfo9MKiP3fQt78C3SKkoXYO/Xtl2AUI7gCTZEnBR2tYQe9IZgAWDbsjNgno+v/
CDNBAcQOIB436lTUtQkR4KDHD3OMJCEadwKBgQCCLxH7tTMjBSWJQC3M3XQx8m9CT8QWBDRVvb42
lu0SaFvEECGxFjYqn8iWSY85ZcjxFC98P/IiGIC5Amj3b3h1+WJu2jWoijwuWOL17ttgPQ4QRTzV
CE4cZzSP84UuevMhryis46FHoLp9fAbStForHmjc1aGmwoy0Torct9e4QwKBgBkgkLWZonqRaZDV
0TnxeCqXZH0dsQiZCPlPj6CxNOZrrl7qPfULFipP2Zq45keBucjgD9WmopprhQSaVbp8UVjws+eh
KrxYnkSs9XFD88rPm8+1FNVlvkyro4Qvt8tUTzTlnkLSGu9DEMU6mMvXXE4PuNP2gugRCf5GAHSa
AHDBAoGBANHVYky0X8/RX3e6kBIruduz9VNIfST/ozrY2FTxBL6Ft/US8QrsYzVx7iMwmLz5JMKo
aevScZftgDCwul0Zzu1ZwSzo7G9eyG7DOgMB9w8RJTvx5tIF3VbcrqtdGfAKzOqHk+cj7mJS2yqw
4zsYcbor3uQDF8EIxtli5fI50FDf
-----END PRIVATE KEY-----
Binary file not shown.
Binary file not shown.
Binary file not shown.
Loading

0 comments on commit d511f08

Please sign in to comment.