/*

 * Copyright (c) 2019, Oracle and/or its affiliates. All rights reserved.

 * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.

 *

 * This code is free software; you can redistribute it and/or modify it

 * under the terms of the GNU General Public License version 2 only, as

 * published by the Free Software Foundation.

 *

 * This code is distributed in the hope that it will be useful, but WITHOUT

 * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or

 * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License

 * version 2 for more details (a copy is included in the LICENSE file that

 * accompanied this code).

 *

 * You should have received a copy of the GNU General Public License version

 * 2 along with this work; if not, write to the Free Software Foundation,

 * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.

 *

 * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA

 * or visit www.oracle.com if you need additional information or have any

 * questions.

 */

import java.io.ByteArrayOutputStream;

import java.io.File;

import java.io.FilterOutputStream;

import java.io.IOException;

import java.io.InputStream;

import java.io.OutputStream;

import java.io.PrintStream;

import java.nio.file.Files;

import java.nio.file.Path;

import java.util.ArrayList;

import java.util.Arrays;

import java.util.List;

import java.util.Map;

import java.util.Collections;

import java.util.stream.Collectors;

import java.util.function.Function;

import java.util.jar.Attributes;

import java.util.jar.Attributes.Name;

import java.util.jar.Manifest;

import java.util.jar.JarEntry;

import java.util.jar.JarFile;

import java.util.zip.ZipFile;

import java.util.zip.ZipEntry;

import jdk.test.lib.process.OutputAnalyzer;

import jdk.test.lib.Platform;

import jdk.test.lib.SecurityTools;

import jdk.test.lib.util.JarUtils;

import org.testng.annotations.BeforeTest;

import org.testng.annotations.DataProvider;

import org.testng.annotations.Test;

import static java.nio.charset.StandardCharsets.UTF_8;

import static org.testng.Assert.*;

/**

 * @test

 * @bug 8217375

 * @library /test/lib

 * @modules jdk.jartool/sun.security.tools.jarsigner

 * @run testng/timeout=1200 PreserveRawManifestEntryAndDigest

 * @summary Verifies that JarSigner does not change manifest file entries

 * in a binary view if its decoded map view does not change so that an

 * unchanged (individual section) entry continues to produce the same digest.

 * The same manifest (in terms of {@link Manifest#equals}) could be encoded

 * with different line breaks ("{@code \r}", "{@code \n}", or "{@code \r\n}")

 * or with arbitrary line break positions (as is also the case with the change

 * of the default line width in JDK 11, bug 6372077) resulting in a different

 * digest for manifest entries with identical values.

 *

 * <p>See also:<ul>

 * <li>{@code oldsig.sh} and {@code diffend.sh} in

 * {@code /test/jdk/sun/security/tools/jarsigner/}</li>

 * <li>{@code Compatibility.java} in

 * {@code /test/jdk/sun/security/tools/jarsigner/compatibility}</li>

 * <li>{@link ReproduceRaw} testing relevant

 * {@sun.security.util.ManifestDigester} api in much more detail</li>

 * </ul>

 */

/*

 * debug with "run testng" += "/othervm -Djava.security.debug=jar"

 */

public class PreserveRawManifestEntryAndDigest {

    static final String KEYSTORE_FILENAME = "test.jks";

    static final String FILENAME_INITIAL_CONTENTS = "initial-contents";

    static final String FILENAME_UPDATED_CONTENTS = "updated-contents";

    /**

     * @see sun.security.tools.jarsigner.Main#run

     */

    static final int NOTSIGNEDBYALIASORALIASNOTINSTORE = 32;

    @BeforeTest

    public void prepareContentFiles() throws IOException {

        Files.write(Path.of(FILENAME_INITIAL_CONTENTS),

                FILENAME_INITIAL_CONTENTS.getBytes(UTF_8));

        Files.write(Path.of(FILENAME_UPDATED_CONTENTS),

                FILENAME_UPDATED_CONTENTS.getBytes(UTF_8));

    }

    @BeforeTest

    public void prepareCertificates() throws Exception {

        SecurityTools.keytool("-genkeypair -keyalg DSA -keystore "

                + KEYSTORE_FILENAME + " -storepass changeit -keypass changeit"

                + " -alias a -dname CN=A").shouldHaveExitValue(0);

        SecurityTools.keytool("-genkeypair -keyalg DSA -keystore "

                + KEYSTORE_FILENAME + " -storepass changeit -keypass changeit"

                + " -alias b -dname CN=B").shouldHaveExitValue(0);

    }

    static class TeeOutputStream extends FilterOutputStream {

        final OutputStream tee; // don't flush or close

        public TeeOutputStream(OutputStream out, OutputStream tee) {

            super(out);

            this.tee = tee;

        }

        @Override

        public void write(int b) throws IOException {

            super.write(b);

            tee.write(b);

        }

    }

    /**

     * runs jarsigner in its own child process and captures exit code and the

     * output of stdout and stderr, as opposed to {@link #karsignerMain}

     */

    OutputAnalyzer jarsignerProc(String args) throws Exception {

        long start = System.currentTimeMillis();

        try {

            return SecurityTools.jarsigner(args);

        } finally {

            long end = System.currentTimeMillis();

            System.out.println("jarsignerProc duration [ms]: " + (end - start));

        }

    }

    /**

     * assume non-zero exit code would call System.exit but is faster than

     * {@link #jarsignerProc}

     */

    void jarsignerMain(String args) throws Exception {

        long start = System.currentTimeMillis();

        try {

            new sun.security.tools.jarsigner.Main().run(args.split("\\s+"));

        } finally {

            long end = System.currentTimeMillis();

            System.out.println("jarsignerMain duration [ms]: " + (end - start));

        }

    }

    void createSignedJarA(String jarFilename, Manifest manifest,

            String additionalJarsignerOptions, String dummyContentsFilename)

                    throws Exception {

        JarUtils.createJarFile(Path.of(jarFilename), manifest, Path.of("."),

                dummyContentsFilename == null ? new Path[]{} :

                    new Path[] { Path.of(dummyContentsFilename) });

        jarsignerMain("-keystore " + KEYSTORE_FILENAME + " -storepass changeit"

                + (additionalJarsignerOptions == null ? "" :

                    " " + additionalJarsignerOptions) +

                " -verbose -debug " + jarFilename + " a");

        Utils.echoManifest(Utils.readJarManifestBytes(

                jarFilename), "original signed jar by signer a");

        // check assumption that jar is valid at this point

        jarsignerMain("-verify -keystore " + KEYSTORE_FILENAME +

                " -storepass changeit -verbose -debug " + jarFilename + " a");

    }

    void manipulateManifestSignAgainA(String srcJarFilename, String tmpFilename,

            String dstJarFilename, String additionalJarsignerOptions,

            Function<Manifest, byte[]> manifestManipulation) throws Exception {

        Manifest mf;

        try (JarFile jar = new JarFile(srcJarFilename)) {

            mf = jar.getManifest();

        }

        byte[] manipulatedManifest = manifestManipulation.apply(mf);

        Utils.echoManifest(manipulatedManifest, "manipulated manifest");

        JarUtils.updateJar(srcJarFilename, tmpFilename, Map.of(

                JarFile.MANIFEST_NAME, manipulatedManifest,

                // add a fake sig-related file to trigger wasSigned in JarSigner

                "META-INF/.SF", Name.SIGNATURE_VERSION + ": 1.0\r\n"));

        jarsignerMain("-keystore " + KEYSTORE_FILENAME + " -storepass changeit"

                + (additionalJarsignerOptions == null ? "" :

                    " " + additionalJarsignerOptions) +

                " -verbose -debug " + tmpFilename + " a");

        // remove META-INF/.SF from signed jar again which would not validate

        JarUtils.updateJar(tmpFilename, dstJarFilename,

                Map.of("META-INF/.SF", false));

        Utils.echoManifest(Utils.readJarManifestBytes(

                dstJarFilename), "manipulated jar signed again with a");

        // check assumption that jar is valid at this point

        jarsignerMain("-verify -keystore " + KEYSTORE_FILENAME + " " +

                "-storepass changeit -verbose -debug " + dstJarFilename + " a");

    }

    OutputAnalyzer signB(String jarFilename, String additionalJarsignerOptions,

            int updateExitCodeVerifyA) throws Exception {

        jarsignerMain("-keystore " + KEYSTORE_FILENAME + " -storepass changeit"

                + (additionalJarsignerOptions == null ? "" :

                    " " + additionalJarsignerOptions)

                + " -verbose -debug " + jarFilename + " b");

        Utils.echoManifest(Utils.readJarManifestBytes(

                jarFilename), "signed again with signer b");

        // check assumption that jar is valid at this point with any alias

        jarsignerMain("-verify -strict -keystore " + KEYSTORE_FILENAME +

                " -storepass changeit -debug -verbose " + jarFilename);

        // check assumption that jar is valid at this point with b just signed

        jarsignerMain("-verify -strict -keystore " + KEYSTORE_FILENAME +

                " -storepass changeit -debug -verbose " + jarFilename + " b");

        // return result of verification of signature by a before update

        return jarsignerProc("-verify -strict " + "-keystore " +

                KEYSTORE_FILENAME + " -storepass changeit " + "-debug " +

                "-verbose " + jarFilename + " a")

                .shouldHaveExitValue(updateExitCodeVerifyA);

    }

    String[] fromFirstToSecondEmptyLine(String[] lines) {

        int from = 0;

        for (int i = 0; i < lines.length; i++) {

            if ("".equals(lines[i])) {

                from = i + 1;

                break;

            }

        }

        int to = lines.length - 1;

        for (int i = from; i < lines.length; i++) {

            if ("".equals(lines[i])) {

                to = i - 1;

                break;

            }

        }

        return Arrays.copyOfRange(lines, from, to + 1);

    }

    /**

     * @see "concise_jarsigner.sh"

     */

    String[] getExpectedJarSignerOutputUpdatedContentNotValidatedBySignerA(

            String jarFilename, String digestalg,

            String firstAddedFilename, String secondAddedFilename) {

        final String TS = ".{28,29}"; // matches a timestamp

        List<String> expLines = new ArrayList<>();

        expLines.add("s k   *\\d+ " + TS + " META-INF/MANIFEST[.]MF");

        expLines.add("      *\\d+ " + TS + " META-INF/B[.]SF");

        expLines.add("      *\\d+ " + TS + " META-INF/B[.]DSA");

        expLines.add("      *\\d+ " + TS + " META-INF/A[.]SF");

        expLines.add("      *\\d+ " + TS + " META-INF/A[.]DSA");

        if (firstAddedFilename != null) {

            expLines.add("smk   *\\d+ " + TS + " " + firstAddedFilename);

        }

        if (secondAddedFilename != null) {

            expLines.add("smkX  *\\d+ " + TS + " " + secondAddedFilename);

        }

        return expLines.toArray(new String[expLines.size()]);

    }

    void assertMatchByLines(String[] actLines, String[] expLines) {

        for (int i = 0; i < actLines.length && i < expLines.length; i++) {

            String actLine = actLines[i];

            String expLine = expLines[i];

            assertTrue(actLine.matches("^" + expLine + "$"),

                "\"" + actLine + "\" should have matched \"" + expLine + "\"");

        }

        assertEquals(actLines.length, expLines.length);

    }

    String test(String name, Function<Manifest, byte[]> mm) throws Exception {

        return test(name, FILENAME_INITIAL_CONTENTS, FILENAME_UPDATED_CONTENTS,

                mm);

    }

    String test(String name,

            String firstAddedFilename, String secondAddedFilename,

            Function<Manifest, byte[]> mm) throws Exception {

        return test(name, firstAddedFilename, secondAddedFilename, mm, null,

                true, true);

    }

    /**

     * Essentially, creates a first signed JAR file with a single contained

     * file or without and a manipulation applied to its manifest signed by

     * signer a and then signes it again with a different signer b.

     * The jar file is signed twice with signer a in order to make the digests

     * available to the manipulation function that might use it.

     *

     * @param name Prefix for the JAR filenames used throughout the test.

     * @param firstAddedFilename Name of a file to add before the first

     * signature by signer a or null. The name will also become the contents

     * if not null.

     * @param secondAddedFilename Name of a file to add after the first

     * signature by signer a and before the second signature by signer b or

     * null. The name will also become the contents if not null.

     * @param manifestManipulation A callback hook to manipulate the manifest

     * after the first signature by signer a and before the second signature by

     * signer b.

     * @param digestalg The digest algorithm name to be used or null for

     * default.

     * @param assertMainAttrsDigestsUnchanged Assert that the

     * manifest main attributes digests have not changed. In any case the test

     * also checks that the digests are still valid whether changed or not

     * by {@code jarsigner -verify} which might use

     * {@link ManifestDigester.Entry#digestWorkaround}

     * @param assertFirstAddedFileDigestsUnchanged Assert that the

     * digest of the file firstAddedFilename has not changed with the second

     * signature. In any case the test checks that the digests are valid whether

     * changed or not by {@code jarsigner -verify} which might use

     * {@link ManifestDigester.Entry#digestWorkaround}

     * @return The name of the resulting JAR file that has passed the common

     * assertions ready for further examination

     */

    String test(String name,

            String firstAddedFilename, String secondAddedFilename,

            Function<Manifest, byte[]> manifestManipulation,

            String digestalg, boolean assertMainAttrsDigestsUnchanged,

            boolean assertFirstAddedFileDigestsUnchanged)

                    throws Exception {

        String digOpts = (digestalg != null ? "-digestalg " + digestalg : "");

        String jarFilename1 = "test-" + name + "-step1.jar";

        createSignedJarA(jarFilename1,

                /* no manifest will let jarsigner create a default one */ null,

                digOpts, firstAddedFilename);

        // manipulate the manifest, write it back, and sign the jar again with

        // the same certificate a as before overwriting the first signature

        String jarFilename2 = "test-" + name + "-step2.jar";

        String jarFilename3 = "test-" + name + "-step3.jar";

        manipulateManifestSignAgainA(jarFilename1, jarFilename2, jarFilename3,

                digOpts, manifestManipulation);

        // add another file, sign it with the other certificate, and verify it

        String jarFilename4 = "test-" + name + "-step4.jar";

        JarUtils.updateJar(jarFilename3, jarFilename4,

                secondAddedFilename != null ?

                Map.of(secondAddedFilename, secondAddedFilename)

                : Collections.EMPTY_MAP);

        OutputAnalyzer o = signB(jarFilename4, digOpts,

           secondAddedFilename != null ? NOTSIGNEDBYALIASORALIASNOTINSTORE : 0);

        // check that secondAddedFilename is the only entry which is not signed

        // by signer with alias "a" unless secondAddedFilename is null

        assertMatchByLines(

                fromFirstToSecondEmptyLine(o.getStdout().split("\\R")),

                getExpectedJarSignerOutputUpdatedContentNotValidatedBySignerA(

                        jarFilename4, digestalg,

                        firstAddedFilename, secondAddedFilename));

        // double-check reading the files with a verifying JarFile

        try (JarFile jar = new JarFile(jarFilename4, true)) {

            if (firstAddedFilename != null) {

                JarEntry je1 = jar.getJarEntry(firstAddedFilename);

                jar.getInputStream(je1).readAllBytes();

                assertTrue(je1.getCodeSigners().length > 0);

            }

            if (secondAddedFilename != null) {

                JarEntry je2 = jar.getJarEntry(secondAddedFilename);

                jar.getInputStream(je2).readAllBytes();

                assertTrue(je2.getCodeSigners().length > 0);

            }

        }

        // assert that the signature of firstAddedFilename signed by signer

        // with alias "a" is not lost and its digest remains the same

        try (ZipFile zip = new ZipFile(jarFilename4)) {

            ZipEntry ea = zip.getEntry("META-INF/A.SF");

            Manifest sfa = new Manifest(zip.getInputStream(ea));

            ZipEntry eb = zip.getEntry("META-INF/B.SF");

            Manifest sfb = new Manifest(zip.getInputStream(eb));

            if (assertMainAttrsDigestsUnchanged) {

                String mainAttrsDigKey =

                        (digestalg != null ? digestalg : "SHA-256") +

                        "-Digest-Manifest-Main-Attributes";

                assertEquals(sfa.getMainAttributes().getValue(mainAttrsDigKey),

                             sfb.getMainAttributes().getValue(mainAttrsDigKey));

            }

            if (assertFirstAddedFileDigestsUnchanged) {

                assertEquals(sfa.getAttributes(firstAddedFilename),

                             sfb.getAttributes(firstAddedFilename));

            }

        }

        return jarFilename4;

    }

    /**

     * Test that signing a jar with manifest entries with arbitrary line break

     * positions in individual section headers does not destroy an existing

     * signature<ol>

     * <li>create two self-signed certificates</li>

     * <li>sign a jar with at least one non-META-INF file in it with a JDK

     * before 11 or place line breaks not at 72 bytes in an individual section

     * header</li>

     * <li>add a new file to the jar</li>

     * <li>sign the jar with a JDK 11, 12, or 13 with bug 8217375 not yet

     * resolved with a different signer</li>

     * </ol>&rarr; first signature will not validate anymore even though it

     * should.

     */

    @Test

    public void arbitraryLineBreaksSectionName() throws Exception {

        test("arbitraryLineBreaksSectionName", m -> {

            return (

                Name.MANIFEST_VERSION + ": 1.0\r\n" +

                "Created-By: " +

                        m.getMainAttributes().getValue("Created-By") + "\r\n" +

                "\r\n" +

                "Name: Test\r\n" +

                " -\r\n" +

                " Section\r\n" +

                "Key: Value \r\n" +

                "\r\n" +

                "Name: " + FILENAME_INITIAL_CONTENTS.substring(0, 1) + "\r\n" +

                " " + FILENAME_INITIAL_CONTENTS.substring(1, 8) + "\r\n" +

                " " + FILENAME_INITIAL_CONTENTS.substring(8) + "\r\n" +

                "SHA-256-Digest: " + m.getAttributes(FILENAME_INITIAL_CONTENTS)

                        .getValue("SHA-256-Digest") + "\r\n" +

                "\r\n"

            ).getBytes(UTF_8);

        });

    }

    /**

     * Test that signing a jar with manifest entries with arbitrary line break

     * positions in individual section headers does not destroy an existing

     * signature<ol>

     * <li>create two self-signed certificates</li>

     * <li>sign a jar with at least one non-META-INF file in it with a JDK

     * before 11 or place line breaks not at 72 bytes in an individual section

     * header</li>

     * <li>add a new file to the jar</li>

     * <li>sign the jar with a JDK 11 or 12 with a different signer</li>

     * </ol>&rarr; first signature will not validate anymore even though it

     * should.

     */

    @Test

    public void arbitraryLineBreaksHeader() throws Exception {

        test("arbitraryLineBreaksHeader", m -> {

            String digest = m.getAttributes(FILENAME_INITIAL_CONTENTS)

                    .getValue("SHA-256-Digest");

            return (

                Name.MANIFEST_VERSION + ": 1.0\r\n" +

                "Created-By: " +

                        m.getMainAttributes().getValue("Created-By") + "\r\n" +

                "\r\n" +

                "Name: Test-Section\r\n" +

                "Key: Value \r\n" +

                " with\r\n" +

                "  strange \r\n" +

                " line breaks.\r\n" +

                "\r\n" +

                "Name: " + FILENAME_INITIAL_CONTENTS + "\r\n" +

                "SHA-256-Digest: " + digest.substring(0, 11) + "\r\n" +

                " " + digest.substring(11) + "\r\n" +

                "\r\n"

            ).getBytes(UTF_8);

        });

    }

    /**

     * Breaks {@code line} at 70 bytes even though the name says 72 but when

     * also counting the line delimiter ("{@code \r\n}") the line totals to 72

     * bytes.

     * Borrowed from {@link Manifest#make72Safe} before JDK 11

     *

     * @see Manifest#make72Safe

     */

    static void make72Safe(StringBuffer line) {

        int length = line.length();

        if (length > 72) {

            int index = 70;

            while (index < length - 2) {

                line.insert(index, "\r\n ");

                index += 72;

                length += 3;

            }

        }

        return;

    }

    /**

     * Test that signing a jar with manifest entries with line breaks at

     * position where Manifest would not place them now anymore (72 instead of

     * 70 bytes after line starts) does not destroy an existing signature<ol>

     * <li>create two self-signed certificates</li>

     * <li>simulate a manifest as it would have been written by a JDK before 11

     * by re-positioning line breaks at 70 bytes (which makes a difference by

     * digests that grow headers longer than 70 characters such as SHA-512 as

     * opposed to default SHA-256, long file names, or manual editing)</li>

     * <li>add a new file to the jar</li>

     * <li>sign the jar with a JDK 11 or 12 with a different signer</li>

     * </ol><p>&rarr;

     * The first signature will not validate anymore even though it should.

     */

    public void lineWidth70(String name, String digestalg) throws Exception {

        Files.write(Path.of(name), name.getBytes(UTF_8));

        test(name, name, FILENAME_UPDATED_CONTENTS, m -> {

            // force a line break with a header exceeding line width limit

            m.getEntries().put("Test-Section", new Attributes());

            m.getAttributes("Test-Section").put(

                    Name.IMPLEMENTATION_VERSION, "1" + "0".repeat(100));

            StringBuilder sb = new StringBuilder();

            StringBuffer[] buf = new StringBuffer[] { null };

            manifestToString(m).lines().forEach(line -> {

                if (line.startsWith(" ")) {

                    buf[0].append(line.substring(1));

                } else {

                    if (buf[0] != null) {

                        make72Safe(buf[0]);

                        sb.append(buf[0].toString());

                        sb.append("\r\n");

                    }

                    buf[0] = new StringBuffer();

                    buf[0].append(line);

                }

            });

            make72Safe(buf[0]);

            sb.append(buf[0].toString());

            sb.append("\r\n");

            return sb.toString().getBytes(UTF_8);

        }, digestalg, false, false);

    }