1 /*
   2  * Copyright (c) 2012, Oracle and/or its affiliates. All rights reserved.
   3  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
   4  *
   5  * This code is free software; you can redistribute it and/or modify it
   6  * under the terms of the GNU General Public License version 2 only, as
   7  * published by the Free Software Foundation.
   8  *
   9  * This code is distributed in the hope that it will be useful, but WITHOUT
  10  * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
  11  * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
  12  * version 2 for more details (a copy is included in the LICENSE file that
  13  * accompanied this code).
  14  *
  15  * You should have received a copy of the GNU General Public License version
  16  * 2 along with this work; if not, write to the Free Software Foundation,
  17  * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
  18  *
  19  * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
  20  * or visit www.oracle.com if you need additional information or have any
  21  * questions.
  22  */
  23 
  24 /*
  25  * @test
  26  * @bug 7143872
  27  * @summary Improve certificate extension processing
  28  * @modules java.base/sun.security.util
  29  *          java.base/sun.security.x509
  30  */
  31 import java.io.ByteArrayInputStream;
  32 import java.math.BigInteger;
  33 import java.security.KeyPairGenerator;
  34 import java.security.cert.CertificateFactory;
  35 import java.security.cert.X509CRLEntry;
  36 import java.util.Date;
  37 import sun.security.util.DerInputStream;
  38 import sun.security.util.DerValue;
  39 import sun.security.x509.*;
  40 
  41 public class OrderAndDup {
  42     public static void main(String[] args) throws Exception {
  43 
  44         // Generate 20 serial numbers with dup and a special order
  45         int count = 20;
  46         BigInteger[] serials = new BigInteger[count];
  47         for (int i=0; i<count; i++) {
  48             serials[i] = BigInteger.valueOf(i*7%10);
  49         }
  50 
  51         // Generates a CRL
  52         X509CRLEntry[] badCerts = new X509CRLEntry[count];
  53         for (int i=0; i<count; i++) {
  54             badCerts[i] = new X509CRLEntryImpl(serials[i],
  55                     new Date(System.currentTimeMillis()+i*1000));
  56         }
  57         X500Name owner = new X500Name("CN=CA");
  58         X509CRLImpl crl = new X509CRLImpl(owner, new Date(), new Date(), badCerts);
  59         KeyPairGenerator kpg = KeyPairGenerator.getInstance("RSA");
  60         crl.sign(kpg.genKeyPair().getPrivate(), "SHA1withRSA");
  61         byte[] data = crl.getEncodedInternal();
  62 
  63         // Check the encoding
  64         checkData(crl, data, serials);
  65 
  66         // Load a CRL from raw data
  67         CertificateFactory cf = CertificateFactory.getInstance("X.509");
  68         X509CRLImpl crl2 = (X509CRLImpl)cf.generateCRL(new ByteArrayInputStream(data));
  69 
  70         // Check the encoding again
  71         data = crl2.getEncodedInternal();
  72         checkData(crl2, data, serials);
  73     }
  74 
  75     // Check the raw data's ASN.1 structure to see if the revoked certs
  76     // have the same number and correct order as inserted
  77     static void checkData(X509CRLImpl c, byte[] data, BigInteger[] expected)
  78             throws Exception {
  79         if (c.getRevokedCertificates().size() != expected.length) {
  80             throw new Exception("Wrong count in CRL object, now " +
  81                     c.getRevokedCertificates().size());
  82         }
  83         DerValue d1 = new DerValue(data);
  84         // revokedCertificates at 5th place of TBSCertList
  85         DerValue[] d2 = new DerInputStream(
  86                 d1.data.getSequence(0)[4].toByteArray())
  87                 .getSequence(0);
  88         if (d2.length != expected.length) {
  89             throw new Exception("Wrong count in raw data, now " + d2.length);
  90         }
  91         for (int i=0; i<d2.length; i++) {
  92             // Serial is first in revokedCertificates entry
  93             BigInteger bi = d2[i].data.getBigInteger();
  94             if (!bi.equals(expected[i])) {
  95                 throw new Exception("Entry at #" + i + " is " + bi
  96                         + ", should be " + expected[i]);
  97             }
  98         }
  99     }
 100 }
 101