/*

 * Copyright (c) 2015, 2017, Oracle and/or its affiliates. All rights reserved.

 * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.

 *

 * This code is free software; you can redistribute it and/or modify it

 * under the terms of the GNU General Public License version 2 only, as

 * published by the Free Software Foundation.

 *

 * This code is distributed in the hope that it will be useful, but WITHOUT

 * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or

 * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License

 * version 2 for more details (a copy is included in the LICENSE file that

 * accompanied this code).

 *

 * You should have received a copy of the GNU General Public License version

 * 2 along with this work; if not, write to the Free Software Foundation,

 * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.

 *

 * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA

 * or visit www.oracle.com if you need additional information or have any

 * questions.

 */

// SunJSSE does not support dynamic system properties, no way to re-use

// system properties in samevm/agentvm mode.

/*

 * @test

 * @bug 8046321 8153829

 * @summary OCSP Stapling for TLS

 * @library ../../../../java/security/testlibrary

 * @build CertificateBuilder SimpleOCSPServer

 * @run main/othervm SSLSocketWithStapling

 */

import java.io.*;

import java.math.BigInteger;

import java.security.KeyPair;

import java.security.KeyPairGenerator;

import javax.net.ssl.*;

import java.security.KeyStore;

import java.security.PublicKey;

import java.security.Security;

import java.security.cert.CertPathValidator;

import java.security.cert.CertPathValidatorException;

import java.security.cert.CertPathValidatorException.BasicReason;

import java.security.cert.Certificate;

import java.security.cert.PKIXBuilderParameters;

import java.security.cert.X509CertSelector;

import java.security.cert.X509Certificate;

import java.security.cert.PKIXRevocationChecker;

import java.security.cert.PKIXRevocationChecker.Option;

import java.util.ArrayList;

import java.util.Collections;

import java.util.Date;

import java.util.EnumSet;

import java.util.List;

import java.util.Map;

import java.util.HashMap;

import java.util.concurrent.TimeUnit;

import sun.security.testlibrary.SimpleOCSPServer;

import sun.security.testlibrary.CertificateBuilder;

public class SSLSocketWithStapling {

    /*

     * =============================================================

     * Set the various variables needed for the tests, then

     * specify what tests to run on each side.

     */

    // Turn on TLS debugging

    /*

     * Should we run the client or server in a separate thread?

     * Both sides can throw exceptions, but do you have a preference

     * as to which side should be the main thread.

     */

    static boolean separateServerThread = true;

    Thread clientThread = null;

    Thread serverThread = null;

    static String passwd = "passphrase";

    static String ROOT_ALIAS = "root";

    static String INT_ALIAS = "intermediate";

    static String SSL_ALIAS = "ssl";

    /*

     * Is the server ready to serve?

     */

    volatile static boolean serverReady = false;

    volatile int serverPort = 0;

    volatile Exception serverException = null;

    volatile Exception clientException = null;

    // PKI components we will need for this test

    static KeyStore rootKeystore;           // Root CA Keystore

    static KeyStore intKeystore;            // Intermediate CA Keystore

    static KeyStore serverKeystore;         // SSL Server Keystore

    static KeyStore trustStore;             // SSL Client trust store

    static SimpleOCSPServer rootOcsp;       // Root CA OCSP Responder

    static int rootOcspPort;                // Port number for root OCSP

    static SimpleOCSPServer intOcsp;        // Intermediate CA OCSP Responder

    static int intOcspPort;                 // Port number for intermed. OCSP

    /*

     * If the client or server is doing some kind of object creation

     * that the other side depends on, and that thread prematurely

     * exits, you may experience a hang.  The test harness will

     * terminate all hung threads after its timeout has expired,

     * currently 3 minutes by default, but you might try to be

     * smart about it....

     */

    public static void main(String[] args) throws Exception {

        if (debug) {

        }

        try {

            // Create the PKI we will use for the test and start the OCSP servers

            createPKI();

        } finally {

            // shut down the OCSP responders before finishing the test

            intOcsp.stop();

            rootOcsp.stop();

        }

    }

    /**

     * Default test using no externally-configured PKIXBuilderParameters

     */

        ClientParameters cliParams = new ClientParameters();

        ServerParameters servParams = new ServerParameters();

        serverReady = false;

        Map<BigInteger, SimpleOCSPServer.CertStatusInfo> revInfo =

                new HashMap<>();

        // We will prove revocation checking is disabled by marking the SSL

        // certificate as revoked.  The test would only pass if revocation

        // checking did not happen.

        X509Certificate sslCert =

                (X509Certificate)serverKeystore.getCertificate(SSL_ALIAS);

        Date fiveMinsAgo = new Date(System.currentTimeMillis() -

                TimeUnit.MINUTES.toMillis(5));

        revInfo.put(sslCert.getSerialNumber(),

                new SimpleOCSPServer.CertStatusInfo(

                        SimpleOCSPServer.CertStatus.CERT_STATUS_REVOKED,

                        fiveMinsAgo));

        intOcsp.updateStatusDb(revInfo);

        System.out.println("=======================================");

        System.out.println("Stapling enabled, default configuration");

        System.out.println("=======================================");

        SSLSocketWithStapling sslTest = new SSLSocketWithStapling(cliParams,

                servParams);

        TestResult tr = sslTest.getResult();

        if (tr.clientExc != null) {

            throw tr.clientExc;

        } else if (tr.serverExc != null) {

            throw tr.serverExc;

        }

        // Return the ssl certificate to non-revoked status

        revInfo.put(sslCert.getSerialNumber(),

                new SimpleOCSPServer.CertStatusInfo(

                        SimpleOCSPServer.CertStatus.CERT_STATUS_GOOD));

        intOcsp.updateStatusDb(revInfo);

        System.out.println("                PASS");

        System.out.println("=======================================\n");

    }

    /**

     * Do a basic connection using PKIXParameters with revocation checking

     * enabled and client-side OCSP disabled.  It will only pass if all

     * stapled responses are present, valid and have a GOOD status.

     */

        ClientParameters cliParams = new ClientParameters();

        ServerParameters servParams = new ServerParameters();

        serverReady = false;

        System.out.println("=====================================");

        System.out.println("Stapling enabled, PKIXParameters with");

        System.out.println("Revocation checking enabled ");

        System.out.println("=====================================");

        cliParams.pkixParams = new PKIXBuilderParameters(trustStore,

                new X509CertSelector());

        cliParams.pkixParams.setRevocationEnabled(true);

        Security.setProperty("ocsp.enable", "false");

        SSLSocketWithStapling sslTest = new SSLSocketWithStapling(cliParams,

                servParams);

        TestResult tr = sslTest.getResult();

        if (tr.clientExc != null) {

            throw tr.clientExc;

        } else if (tr.serverExc != null) {

            throw tr.serverExc;

        }

        System.out.println("                PASS");

        System.out.println("=====================================\n");

    }

    /**

     * Perform a test where the certificate is revoked and placed in the

     * TLS handshake.  Client-side OCSP is disabled, so this test will only

     * pass if the OCSP response is found, since we will check the

     * CertPathValidatorException reason for revoked status.

     */

        ClientParameters cliParams = new ClientParameters();

        ServerParameters servParams = new ServerParameters();

        serverReady = false;

        Map<BigInteger, SimpleOCSPServer.CertStatusInfo> revInfo =

                new HashMap<>();

        // We will prove revocation checking is disabled by marking the SSL

        // certificate as revoked.  The test would only pass if revocation

        // checking did not happen.

        X509Certificate sslCert =

                (X509Certificate)serverKeystore.getCertificate(SSL_ALIAS);

        Date fiveMinsAgo = new Date(System.currentTimeMillis() -

                TimeUnit.MINUTES.toMillis(5));

        revInfo.put(sslCert.getSerialNumber(),

                new SimpleOCSPServer.CertStatusInfo(

                        SimpleOCSPServer.CertStatus.CERT_STATUS_REVOKED,

                        fiveMinsAgo));

        intOcsp.updateStatusDb(revInfo);

        cliParams.pkixParams = new PKIXBuilderParameters(trustStore,

                new X509CertSelector());

        cliParams.pkixParams.setRevocationEnabled(true);

        Security.setProperty("ocsp.enable", "false");

        SSLSocketWithStapling sslTest = new SSLSocketWithStapling(cliParams,

                servParams);

        TestResult tr = sslTest.getResult();

        if (!checkClientValidationFailure(tr.clientExc, BasicReason.REVOKED)) {

            if (tr.clientExc != null) {

                throw tr.clientExc;

            } else {

                throw new RuntimeException(

                        "Expected client failure, but the client succeeded");

            }

        }

        // Return the ssl certificate to non-revoked status

        revInfo.put(sslCert.getSerialNumber(),

                new SimpleOCSPServer.CertStatusInfo(

                        SimpleOCSPServer.CertStatus.CERT_STATUS_GOOD));

        intOcsp.updateStatusDb(revInfo);

        System.out.println("                 PASS");

        System.out.println("=======================================\n");

    }

    /**

     * Test a case where client-side stapling is attempted, but does not

     * occur because OCSP responders are unreachable.  This should use a

     * default hard-fail behavior.

     */

        ClientParameters cliParams = new ClientParameters();

        ServerParameters servParams = new ServerParameters();

        serverReady = false;

        // make OCSP responders reject connections

        intOcsp.rejectConnections();

        rootOcsp.rejectConnections();

        System.out.println("=======================================");

        System.out.println("Stapling enbled in client and server,");

        System.out.println("but OCSP responders disabled.");

        System.out.println("PKIXParameters with Revocation checking");

        System.out.println("enabled.");

        System.out.println("=======================================");

        Security.setProperty("ocsp.enable", "true");

        cliParams.pkixParams = new PKIXBuilderParameters(trustStore,

                new X509CertSelector());

        cliParams.pkixParams.setRevocationEnabled(true);

        SSLSocketWithStapling sslTest = new SSLSocketWithStapling(cliParams,

                servParams);

        TestResult tr = sslTest.getResult();

        if (!checkClientValidationFailure(tr.clientExc,

                BasicReason.UNDETERMINED_REVOCATION_STATUS)) {

            if (tr.clientExc != null) {

                throw tr.clientExc;

            } else {

                throw new RuntimeException(

                        "Expected client failure, but the client succeeded");

            }

        }

        System.out.println("                 PASS");

        System.out.println("=======================================\n");

        // Make OCSP responders accept connections

        intOcsp.acceptConnections();

        rootOcsp.acceptConnections();

        // Wait 5 seconds for server ready

            Thread.sleep(50);

        }

        if (!intOcsp.isServerReady() || !rootOcsp.isServerReady()) {

            throw new RuntimeException("Server not ready yet");

        }

    }

    /**

     * Test a case where client-side stapling is attempted, but does not

     * occur because OCSP responders are unreachable.  Client-side OCSP

     * checking is enabled for this, with SOFT_FAIL.

     */