1 /*
   2  * Copyright (c) 2013, Oracle and/or its affiliates. All rights reserved.
   3  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
   4  *
   5  * This code is free software; you can redistribute it and/or modify it
   6  * under the terms of the GNU General Public License version 2 only, as
   7  * published by the Free Software Foundation.
   8  *
   9  * This code is distributed in the hope that it will be useful, but WITHOUT
  10  * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
  11  * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
  12  * version 2 for more details (a copy is included in the LICENSE file that
  13  * accompanied this code).
  14  *
  15  * You should have received a copy of the GNU General Public License version
  16  * 2 along with this work; if not, write to the Free Software Foundation,
  17  * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
  18  *
  19  * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
  20  * or visit www.oracle.com if you need additional information or have any
  21  * questions.
  22  */
  23 
  24 /*
  25  * @test
  26  * @bug 8011402
  27  * @summary Move blacklisting certificate logic from hard code to data
  28  * @modules java.base/sun.security.util
  29  */
  30 
  31 import sun.security.util.UntrustedCertificates;
  32 
  33 import java.io.*;
  34 import java.security.KeyStore;
  35 import java.security.cert.*;
  36 import java.util.*;
  37 
  38 public class CheckBlacklistedCerts {
  39     public static void main(String[] args) throws Exception {
  40 
  41         String home = System.getProperty("java.home");
  42         boolean failed = false;
  43 
  44         // Root CAs should always be trusted
  45         File file = new File(home, "lib/security/cacerts");
  46         KeyStore ks = KeyStore.getInstance(KeyStore.getDefaultType());
  47         try (FileInputStream fis = new FileInputStream(file)) {
  48             ks.load(new FileInputStream(file), null);
  49         }
  50         System.out.println("Check for cacerts: " + ks.size());
  51         for (String alias: Collections.list(ks.aliases())) {
  52             X509Certificate cert = (X509Certificate)ks.getCertificate(alias);
  53             if (UntrustedCertificates.isUntrusted(cert)) {
  54                 System.out.print(alias + " is untrusted");
  55                 failed = true;
  56             }
  57         }
  58 
  59         // All certs in the pem files
  60         Set<Certificate> blacklisted = new HashSet<>();
  61 
  62         // Hopefully src comes with test, but it might be missing if doing
  63         // a -testonly JPRT job.
  64         File[] blacklists = {
  65             new File(System.getProperty("test.src"),
  66                 "../../../make/data/blacklistedcertsconverter/blacklisted.certs.pem"),
  67             new File(System.getProperty("test.src"),
  68                 "../../../make/closed/data/blacklistedcertsconverter/blacklisted.certs.pem")
  69         };
  70 
  71         // Is this an OPENJDK build?
  72         if (!new File(home, "lib/security/local_policy.jar").exists()) {
  73             blacklists = Arrays.copyOf(blacklists, 1);
  74         }
  75 
  76         CertificateFactory cf = CertificateFactory.getInstance("X.509");
  77         for (File blacklist: blacklists) {
  78             System.out.print("Check for " + blacklist + ": ");
  79             if (!blacklist.exists()) {
  80                 System.out.println("does not exist");
  81             } else {
  82                 try (FileInputStream fis = new FileInputStream(blacklist)) {
  83                     Collection<? extends Certificate> certs
  84                             = cf.generateCertificates(fis);
  85                     System.out.println(certs.size());
  86                     for (Certificate c: certs) {
  87                         blacklisted.add(c);
  88                         X509Certificate cert = ((X509Certificate)c);
  89                         if (!UntrustedCertificates.isUntrusted(cert)) {
  90                             System.out.println(cert.getSubjectDN() + " is trusted");
  91                             failed = true;
  92                         }
  93                     }
  94                 }
  95             }
  96         }
  97 
  98         // Check the blacklisted.certs file itself
  99         file = new File(home, "lib/security/blacklisted.certs");
 100         System.out.print("Check for " + file + ": ");
 101         try (BufferedReader reader = new BufferedReader(
 102                 new InputStreamReader(new FileInputStream(file)))) {
 103             int acount = 0;
 104             int ccount = 0;
 105             while (true) {
 106                 String line = reader.readLine();
 107                 if (line == null) break;
 108                 if (line.startsWith("Algorithm")) {
 109                     acount++;
 110                 } else if (!line.isEmpty() && !line.startsWith("#")) {
 111                     ccount++;
 112                 }
 113             }
 114             System.out.println(acount + " algs, " + ccount + " certs" );
 115             if (acount != 1) {
 116                 System.out.println("There are " + acount + " algorithms");
 117                 failed = true;
 118             }
 119             if (ccount != blacklisted.size()
 120                     && !blacklisted.isEmpty()) {
 121                 System.out.println("Wrong blacklisted.certs size: "
 122                         + ccount + " fingerprints, "
 123                         + blacklisted.size() + " certs");
 124                 failed = true;
 125             }
 126         }
 127 
 128         if (failed) {
 129             throw new Exception("Failed");
 130         }
 131     }
 132 }