1 /*
   2  * Copyright (c) 2013, Oracle and/or its affiliates. All rights reserved.
   3  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
   4  *
   5  * This code is free software; you can redistribute it and/or modify it
   6  * under the terms of the GNU General Public License version 2 only, as
   7  * published by the Free Software Foundation.
   8  *
   9  * This code is distributed in the hope that it will be useful, but WITHOUT
  10  * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
  11  * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
  12  * version 2 for more details (a copy is included in the LICENSE file that
  13  * accompanied this code).
  14  *
  15  * You should have received a copy of the GNU General Public License version
  16  * 2 along with this work; if not, write to the Free Software Foundation,
  17  * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
  18  *
  19  * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
  20  * or visit www.oracle.com if you need additional information or have any
  21  * questions.
  22  */
  23 
  24 /*
  25  * @test
  26  * @bug 8011402
  27  * @summary Move blacklisting certificate logic from hard code to data
  28  */
  29 
  30 import sun.security.util.UntrustedCertificates;
  31 
  32 import java.io.*;
  33 import java.security.KeyStore;
  34 import java.security.cert.*;
  35 import java.util.*;
  36 
  37 public class CheckBlacklistedCerts {
  38     public static void main(String[] args) throws Exception {
  39 
  40         String home = System.getProperty("java.home");
  41         boolean failed = false;
  42 
  43         // Root CAs should always be trusted
  44         File file = new File(home, "lib/security/cacerts");
  45         KeyStore ks = KeyStore.getInstance(KeyStore.getDefaultType());
  46         try (FileInputStream fis = new FileInputStream(file)) {
  47             ks.load(new FileInputStream(file), null);
  48         }
  49         System.out.println("Check for cacerts: " + ks.size());
  50         for (String alias: Collections.list(ks.aliases())) {
  51             X509Certificate cert = (X509Certificate)ks.getCertificate(alias);
  52             if (UntrustedCertificates.isUntrusted(cert)) {
  53                 System.out.print(alias + " is untrusted");
  54                 failed = true;
  55             }
  56         }
  57 
  58         // All certs in the pem files
  59         Set<Certificate> blacklisted = new HashSet<>();
  60 
  61         // Hopefully src comes with test, but it might be missing if doing
  62         // a -testonly JPRT job.
  63         File[] blacklists = {
  64             new File(System.getProperty("test.src"),
  65                 "../../../make/data/blacklistedcertsconverter/blacklisted.certs.pem"),
  66             new File(System.getProperty("test.src"),
  67                 "../../../make/closed/data/blacklistedcertsconverter/blacklisted.certs.pem")
  68         };
  69 
  70         // Is this an OPENJDK build?
  71         if (!new File(home, "lib/security/local_policy.jar").exists()) {
  72             blacklists = Arrays.copyOf(blacklists, 1);
  73         }
  74 
  75         CertificateFactory cf = CertificateFactory.getInstance("X.509");
  76         for (File blacklist: blacklists) {
  77             System.out.print("Check for " + blacklist + ": ");
  78             if (!blacklist.exists()) {
  79                 System.out.println("does not exist");
  80             } else {
  81                 try (FileInputStream fis = new FileInputStream(blacklist)) {
  82                     Collection<? extends Certificate> certs
  83                             = cf.generateCertificates(fis);
  84                     System.out.println(certs.size());
  85                     for (Certificate c: certs) {
  86                         blacklisted.add(c);
  87                         X509Certificate cert = ((X509Certificate)c);
  88                         if (!UntrustedCertificates.isUntrusted(cert)) {
  89                             System.out.println(cert.getSubjectDN() + " is trusted");
  90                             failed = true;
  91                         }
  92                     }
  93                 }
  94             }
  95         }
  96 
  97         // Check the blacklisted.certs file itself
  98         file = new File(home, "lib/security/blacklisted.certs");
  99         System.out.print("Check for " + file + ": ");
 100         try (BufferedReader reader = new BufferedReader(
 101                 new InputStreamReader(new FileInputStream(file)))) {
 102             int acount = 0;
 103             int ccount = 0;
 104             while (true) {
 105                 String line = reader.readLine();
 106                 if (line == null) break;
 107                 if (line.startsWith("Algorithm")) {
 108                     acount++;
 109                 } else if (!line.isEmpty() && !line.startsWith("#")) {
 110                     ccount++;
 111                 }
 112             }
 113             System.out.println(acount + " algs, " + ccount + " certs" );
 114             if (acount != 1) {
 115                 System.out.println("There are " + acount + " algorithms");
 116                 failed = true;
 117             }
 118             if (ccount != blacklisted.size()
 119                     && !blacklisted.isEmpty()) {
 120                 System.out.println("Wrong blacklisted.certs size: "
 121                         + ccount + " fingerprints, "
 122                         + blacklisted.size() + " certs");
 123                 failed = true;
 124             }
 125         }
 126 
 127         if (failed) {
 128             throw new Exception("Failed");
 129         }
 130     }
 131 }