/*

 * Copyright (c) 2017, Oracle and/or its affiliates. All rights reserved.

 * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.

 *

 * This code is free software; you can redistribute it and/or modify it

 * under the terms of the GNU General Public License version 2 only, as

 * published by the Free Software Foundation.

 *

 * This code is distributed in the hope that it will be useful, but WITHOUT

 * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or

 * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License

 * version 2 for more details (a copy is included in the LICENSE file that

 * accompanied this code).

 *

 * You should have received a copy of the GNU General Public License version

 * 2 along with this work; if not, write to the Free Software Foundation,

 * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.

 *

 * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA

 * or visit www.oracle.com if you need additional information or have any

 * questions.

 */

/*

 * @test

 * @summary This test is used to verify the compatibility on jarsigner cross

 *     different JDK releases. It also can be used to check jar signing (w/

 *     and w/o TSA) and verifying on some specific key algorithms and digest

 *     algorithms.

 *     Note that, this is a manual test. For more details about the test and

 *     its usages, please look through README.

 *

 * @modules java.base/sun.security.pkcs

 *          java.base/sun.security.timestamp

 *          java.base/sun.security.tools.keytool

 *          java.base/sun.security.util

 *          java.base/sun.security.x509

 * @library /test/lib /lib/testlibrary ../warnings

 * @compile -source 1.6 -target 1.6 JdkUtils.java

 * @run main/manual/othervm Compatibility

 */

import java.io.BufferedReader;

import java.io.File;

import java.io.FileReader;

import java.io.FileWriter;

import java.io.IOException;

import java.io.PrintStream;

import java.text.DateFormat;

import java.text.SimpleDateFormat;

import java.util.ArrayList;

import java.util.Calendar;

import java.util.Date;

import java.util.HashMap;

import java.util.HashSet;

import java.util.List;

import java.util.Map;

import java.util.Set;

import java.util.concurrent.TimeUnit;

import java.util.regex.Matcher;

import java.util.regex.Pattern;

import jdk.test.lib.process.OutputAnalyzer;

import jdk.test.lib.process.ProcessTools;

import jdk.test.lib.util.JarUtils;

public class Compatibility {

    private static final String TEST_JAR_NAME = "test.jar";

    private static final String TEST_SRC = System.getProperty("test.src");

    private static final String TEST_CLASSES = System.getProperty("test.classes");

    private static final String TEST_JDK = System.getProperty("test.jdk");

    private static final String TEST_JARSIGNER = jarsignerPath(TEST_JDK);

    private static final String PROXY_HOST = System.getProperty("proxyHost");

    private static final String PROXY_PORT = System.getProperty("proxyPort", "80");

    // An alternative security properties file.

    // The test provides a default one, which only contains two lines:

    // jdk.certpath.disabledAlgorithms=MD2, MD5

    // jdk.jar.disabledAlgorithms=MD2, MD5

    private static final String JAVA_SECURITY = System.getProperty(

            "javaSecurityFile", TEST_SRC + "/java.security");

    private static final String PASSWORD = "testpass";

    private static final String KEYSTORE = "testKeystore";

    private static final String RSA = "RSA";

    private static final String DSA = "DSA";

    private static final String EC = "EC";

    private static final String[] KEY_ALGORITHMS = new String[] {

            RSA,

            DSA,

            EC};

    private static final String SHA1 = "SHA-1";

    private static final String SHA256 = "SHA-256";

    private static final String SHA512 = "SHA-512";

    private static final String DEFAULT = "DEFAULT";

    private static final String[] DIGEST_ALGORITHMS = new String[] {

            SHA1,

            SHA256,

            SHA512,

            DEFAULT};

    private static final boolean[] EXPIRED = new boolean[] {

            false,

            true};

    private static final Calendar CALENDAR = Calendar.getInstance();

    private static final DateFormat DATE_FORMAT

            = new SimpleDateFormat("yyyy/MM/dd HH:mm:ss");

    // The certificate validity period in minutes. The default value is 1440

    // minutes, namely 1 day.

    private static final int CERT_VALIDITY

            = Integer.valueOf(System.getProperty("certValidity", "1440"));

    static {

        if (CERT_VALIDITY < 1 || CERT_VALIDITY > 1440) {

            throw new RuntimeException(

                    "certValidity if out of range [1, 1440]: " + CERT_VALIDITY);

        }

    }

    // If true, an additional verifying will be triggered after all of

    // valid certificates expire. The default value is false.

    public static final boolean DELAY_VERIFY

            = Boolean.valueOf(System.getProperty("delayVerify", "false"));

    private static long lastCertStartTime;

    private static DetailsOutputStream detailsOutput;

    public static void main(String[] args) throws Throwable {

        // Backups stdout and stderr.

        PrintStream origStdOut = System.out;

        PrintStream origStdErr = System.err;

        detailsOutput = new DetailsOutputStream();

        // Redirects the system output to a custom one.

        PrintStream printStream = new PrintStream(detailsOutput);

        System.setOut(printStream);

        System.setErr(printStream);

        List<TsaInfo> tsaList = tsaInfoList();

        if (tsaList.size() == 0) {

            throw new RuntimeException("TSA service is mandatory.");

        }

        List<JdkInfo> jdkInfoList = jdkInfoList();

        List<CertInfo> certList = createCertificates(jdkInfoList);

        createJar();

        List<SignItem> signItems = test(jdkInfoList, tsaList, certList);

        boolean failed = generateReport(tsaList, signItems);

        // Restores the original stdout and stderr.

        System.setOut(origStdOut);

        System.setErr(origStdErr);

        if (failed) {

            throw new RuntimeException("At least one test case failed. "

                    + "Please check the failed row(s) in report.html "

                    + "or failedReport.html.");

        }

    }

    // Creates a jar file that contains an empty file.

    private static void createJar() throws IOException {

        String testFile = "test";

        new File(testFile).createNewFile();

        JarUtils.createJar(TEST_JAR_NAME, testFile);

    }

    // Creates a key store that includes a set of valid/expired certificates

    // with various algorithms.

    private static List<CertInfo> createCertificates(List<JdkInfo> jdkInfoList)

            throws Throwable {

        List<CertInfo> certList = new ArrayList<CertInfo>();

        Set<String> expiredCertFilter = new HashSet<String>();

        for(JdkInfo jdkInfo : jdkInfoList) {

            for(String keyAlgorithm : KEY_ALGORITHMS) {

                for(String digestAlgorithm : DIGEST_ALGORITHMS) {

                    for(int keySize : keySizes(keyAlgorithm)) {

                        for(boolean expired : EXPIRED) {

                            // It creates only one expired certificate for one

                            // key algorithm.

                            if (expired

                                    && !expiredCertFilter.add(keyAlgorithm)) {

                                continue;

                            }

                            CertInfo certInfo = new CertInfo(

                                    jdkInfo.version,

                                    keyAlgorithm,

                                    digestAlgorithm,

                                    keySize,

                                    expired);

                            if (!certList.contains(certInfo)) {

                                String alias = createCertificate(

                                        jdkInfo.jdkPath, certInfo);

                                if (alias != null) {

                                    certList.add(certInfo);

                                }

                            }

                        }

                    }

                }

            }

        }

        return certList;

    }

    // Creates/Updates a key store that adds a certificate with specific algorithm.

    private static String createCertificate(String jdkPath, CertInfo certInfo)

            throws Throwable {

        String alias = certInfo.alias();

        List<String> arguments = new ArrayList<String>();

        arguments.add("-J-Djava.security.properties=" + JAVA_SECURITY);

        arguments.add("-v");

        arguments.add("-storetype");

        arguments.add("jks");

        arguments.add("-genkey");

        arguments.add("-keyalg");

        arguments.add(certInfo.keyAlgorithm);

        String sigalg = sigalg(certInfo.digestAlgorithm, certInfo.keyAlgorithm);

        if (sigalg != null) {

            arguments.add("-sigalg");

            arguments.add(sigalg);

        }

        if (certInfo.keySize != 0) {

            arguments.add("-keysize");

            arguments.add(certInfo.keySize + "");

        }

        arguments.add("-dname");

        arguments.add("CN=Test");

        arguments.add("-alias");

        arguments.add(alias);

        arguments.add("-keypass");

        arguments.add(PASSWORD);

        arguments.add("-storepass");

        arguments.add(PASSWORD);

        arguments.add("-startdate");

        arguments.add(startDate(certInfo.expired));

        arguments.add("-validity");

        arguments.add("1");

        arguments.add("-keystore");

        arguments.add(KEYSTORE);

        OutputAnalyzer outputAnalyzer = execTool(

                jdkPath + "/bin/keytool",

                arguments.toArray(new String[arguments.size()]));

        if (outputAnalyzer.getExitValue() == 0

                && !outputAnalyzer.getOutput().matches("[Ee]xception")) {

            return alias;

        } else {

            return null;

        }

    }

    private static String sigalg(String digestAlgorithm, String keyAlgorithm) {

        if (digestAlgorithm == DEFAULT) {

            return null;

        }

        String keyName = keyAlgorithm == EC ? "ECDSA" : keyAlgorithm;

        return digestAlgorithm.replace("-", "") + "with" + keyName;

    }

    // The validity period of a certificate always be 1 day. For creating an

    // expired certificate, the start date is the time before 1 day, then the

    // certificate expires immediately. And for creating a valid certificate,

    // the start date is the time before (1 day - CERT_VALIDITY minutes), then

    // the certificate will expires in CERT_VALIDITY minutes.

    private static String startDate(boolean expiredCert) {

        CALENDAR.setTime(new Date());

        CALENDAR.add(Calendar.DAY_OF_MONTH, -1);

        if (!expiredCert) {

            CALENDAR.add(Calendar.MINUTE, CERT_VALIDITY);

        }

        Date startDate = CALENDAR.getTime();

        lastCertStartTime = startDate.getTime();

        return DATE_FORMAT.format(startDate);

    }

    // Retrieves JDK info from the file which is specified by property jdkListFile,

    // or from property jdkList if jdkListFile is not available.

    private static List<JdkInfo> jdkInfoList() throws Throwable {

        String[] jdkList = list("jdkList");

        if (jdkList.length == 0) {

            jdkList = new String[] { TEST_JDK };

        }

        List<JdkInfo> jdkInfoList = new ArrayList<JdkInfo>();

        for (String jdkPath : jdkList) {

            JdkInfo jdkInfo = new JdkInfo(jdkPath);

            // The JDK version must be unique.

            if (!jdkInfoList.contains(jdkInfo)) {

                jdkInfoList.add(jdkInfo);

            } else {

                System.out.println("The JDK version is duplicate: " + jdkPath);

            }

        }

        return jdkInfoList;

    }

    // Retrieves TSA info from the file which is specified by property tsaListFile,

    // or from property tsaList if tsaListFile is not available.

    private static List<TsaInfo> tsaInfoList() throws IOException {

        String[] tsaList = list("tsaList");

        List<TsaInfo> tsaInfoList = new ArrayList<TsaInfo>();

        for (int i = 0; i < tsaList.length; i++) {

            String[] values = tsaList[i].split(";digests=");

            String[] digests = new String[0];

            if (values.length == 2) {

                digests = values[1].split(",");

            }

            TsaInfo bufTsa = new TsaInfo(i, values[0]);

            for (String digest : digests) {

                bufTsa.addDigest(digest);

            }

            tsaInfoList.add(bufTsa);

        }

        return tsaInfoList;

    }

    private static String[] list(String listProp)

            throws IOException {

        String listFileProp = listProp + "File";

        String listFile = System.getProperty(listFileProp);

        if (!isEmpty(listFile)) {

            System.out.println(listFileProp + "=" + listFile);

            List<String> list = new ArrayList<String>();

            BufferedReader reader = new BufferedReader(

                    new FileReader(listFile));

            String line;

            while ((line = reader.readLine()) != null) {

                String item = line.trim();

                if (!item.isEmpty()) {

                    list.add(item);

                }

            }

            reader.close();

            return list.toArray(new String[list.size()]);

        }

        String list = System.getProperty(listProp);

        System.out.println(listProp + "=" + list);

        return !isEmpty(list) ? list.split("#") : new String[0];

    }

    private static boolean isEmpty(String str) {

        return str == null || str.isEmpty();

    }

    // A JDK (signer) signs a jar with a variety of algorithms, and then all of

    // JDKs (verifiers), including the signer itself, try to verify the signed

    // jars respectively.

    private static List<SignItem> test(List<JdkInfo> jdkInfoList,

            List<TsaInfo> tsaInfoList, List<CertInfo> certList)

            throws Throwable {

        detailsOutput.transferPhase();

        List<SignItem> signItems = signing(jdkInfoList, tsaInfoList, certList);

        detailsOutput.transferPhase();

        for (SignItem signItem : signItems) {

            for (JdkInfo verifierInfo : jdkInfoList) {

                // JDK 6 doesn't support EC

                if (!verifierInfo.isJdk6()

                        || signItem.certInfo.keyAlgorithm != EC) {

                    verifying(signItem, VerifyItem.build(verifierInfo));

                }

            }

        }

        if (DELAY_VERIFY) {

            detailsOutput.transferPhase();

            System.out.print("Waiting for delay verifying");

            long lastCertExpirationTime = lastCertStartTime + 24 * 60 * 60 * 1000;

            while (System.currentTimeMillis() < lastCertExpirationTime) {

                TimeUnit.SECONDS.sleep(30);

                System.out.print(".");

            }

            System.out.println();

            System.out.println("Delay verifying starts");

            for (SignItem signItem : signItems) {

                for (VerifyItem verifyItem : signItem.verifyItems) {

                    verifying(signItem, verifyItem);

                }

            }

        }

        detailsOutput.transferPhase();

        return signItems;

    }

    private static List<SignItem> signing(List<JdkInfo> jdkInfos,

            List<TsaInfo> tsaList, List<CertInfo> certList) throws Throwable {

        List<SignItem> signItems = new ArrayList<SignItem>();

        Set<String> signFilter = new HashSet<String>();

        for (JdkInfo signerInfo : jdkInfos) {

            for (String keyAlgorithm : KEY_ALGORITHMS) {

                // JDK 6 doesn't support EC

                if (signerInfo.isJdk6() && keyAlgorithm == EC) {

                    continue;

                }

                for (String digestAlgorithm : DIGEST_ALGORITHMS) {

                    String sigalg = sigalg(digestAlgorithm, keyAlgorithm);

                    // If the signature algorithm is not supported by the JDK,

                    // it cannot try to sign jar with this algorithm.

                    if (sigalg != null && !signerInfo.isSupportedSigalg(sigalg)) {

                        continue;

                    }

                    // If the JDK doesn't support option -tsadigestalg, the

                    // associated cases just be ignored.

                    if (digestAlgorithm != DEFAULT

                            && !signerInfo.supportsTsadigestalg) {

                        continue;

                    }

                    for (int keySize : keySizes(keyAlgorithm)) {

                        for (boolean expired : EXPIRED) {

                            CertInfo certInfo = new CertInfo(

                                    signerInfo.version,

                                    keyAlgorithm,

                                    digestAlgorithm,

                                    keySize,

                                    expired);

                            if (!certList.contains(certInfo)) {

                                continue;

                            }

                            String tsadigestalg = digestAlgorithm != DEFAULT

                                                ? digestAlgorithm

                                                : null;

                            for (TsaInfo tsaInfo : tsaList) {

                                // It has to ignore the digest algorithm, which

                                // is not supported by the TSA server.

                                if(!tsaInfo.isDigestSupported(tsadigestalg)) {

                                    continue;

                                }

                                String tsaUrl = tsaInfo.tsaUrl;

                                if (TsaFilter.filter(

                                        signerInfo.version,

                                        digestAlgorithm,

                                        expired,

                                        tsaInfo.index)) {

                                    tsaUrl = null;

                                }

                                String signedJar = "JDK_"

                                        + signerInfo.version + "-CERT_"

                                        + certInfo

                                        + (tsaUrl == null

                                           ? ""

                                           : "-TSA_" + tsaInfo.index);

                                // It has to ignore the same jar signing.

                                if (!signFilter.add(signedJar)) {

                                    continue;

                                }

                                SignItem signItem = SignItem.build()

                                        .certInfo(certInfo)

                                        .version(signerInfo.version)

                                        .signatureAlgorithm(sigalg)

                                        .tsaDigestAlgorithm(

                                                tsaUrl == null

                                                ? null

                                                : tsadigestalg)

                                        .tsaIndex(

                                                tsaUrl == null

                                                ? -1

                                                : tsaInfo.index)

                                        .signedJar(signedJar);

                                String signingId = signingId(signItem);

                                detailsOutput.writeAnchorName(signingId,

                                        "Signing: " + signingId);

                                OutputAnalyzer signOA = signJar(

                                        signerInfo.jarsignerPath,

                                        sigalg,

                                        tsadigestalg,

                                        tsaUrl,

                                        certInfo.alias(),

                                        signedJar);

                                Status signingStatus = signingStatus(signOA);

                                signItem.status(signingStatus);

                                if (signingStatus != Status.ERROR) {

                                    // Using the testing JDK, which is specified

                                    // by jtreg option "-jdk", to verify the

                                    // signed jar and extract the signature

                                    // algorithm and timestamp digest algorithm.

                                    String output = verifyJar(TEST_JARSIGNER,

                                            signedJar).getOutput();

                                    signItem.extractedSignatureAlgorithm(

                                            extract(output,

                                                    " *Signature algorithm.*",

                                                    ".*: |,.*"));

                                    signItem.extractedTsaDigestAlgorithm(

                                            extract(output,

                                                    " *Timestamp digest algorithm.*",

                                                    ".*: "));

                                }

                                signItems.add(signItem);

                            }

                        }