/*

 * Copyright (c) 2017, 2019, Oracle and/or its affiliates. All rights reserved.

 * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.

 *

 * This code is free software; you can redistribute it and/or modify it

 * under the terms of the GNU General Public License version 2 only, as

 * published by the Free Software Foundation.

 *

 * This code is distributed in the hope that it will be useful, but WITHOUT

 * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or

 * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License

 * version 2 for more details (a copy is included in the LICENSE file that

 * accompanied this code).

 *

 * You should have received a copy of the GNU General Public License version

 * 2 along with this work; if not, write to the Free Software Foundation,

 * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.

 *

 * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA

 * or visit www.oracle.com if you need additional information or have any

 * questions.

 */

/*

 * @test

 * @bug 8217375

 * @summary This test is used to verify the compatibility of jarsigner across

 *     different JDK releases. It also can be used to check jar signing (w/

 *     and w/o TSA) and to verify some specific signing and digest algorithms.

 *     Note that this is a manual test. For more details about the test and

 *     its usages, please look through the README.

 *

 * @library /test/lib ../warnings

 * @compile -source 1.7 -target 1.7 JdkUtils.java

 * @run main/manual/othervm Compatibility

 */

import static java.nio.charset.StandardCharsets.UTF_8;

import java.io.BufferedReader;

import java.io.File;

import java.io.FileOutputStream;

import java.io.FileReader;

import java.io.FileWriter;

import java.io.IOException;

import java.io.OutputStream;

import java.io.PrintStream;

import java.nio.file.Files;

import java.nio.file.Path;

import java.text.DateFormat;

import java.text.SimpleDateFormat;

import java.util.ArrayList;

import java.util.Arrays;

import java.util.Calendar;

import java.util.Date;

import java.util.HashMap;

import java.util.HashSet;

import java.util.List;

import java.util.Locale;

import java.util.Map;

import java.util.Set;

import java.util.concurrent.TimeUnit;

import java.util.function.Consumer;

import java.util.function.Function;

import java.util.jar.Attributes.Name;

import java.util.jar.Manifest;

import java.util.stream.Collectors;

import java.util.stream.IntStream;

import jdk.test.lib.process.OutputAnalyzer;

import jdk.test.lib.process.ProcessTools;

import jdk.test.lib.util.JarUtils;

public class Compatibility {

    private static final String TEST_SRC = System.getProperty("test.src");

    private static final String TEST_CLASSES = System.getProperty("test.classes");

    private static final String TEST_JDK = System.getProperty("test.jdk");

    private static JdkInfo TEST_JDK_INFO;

    private static final String PROXY_HOST = System.getProperty("proxyHost");

    private static final String PROXY_PORT = System.getProperty("proxyPort", "80");

    // An alternative security properties file.

    // The test provides a default one, which only contains two lines:

    // jdk.certpath.disabledAlgorithms=MD2, MD5

    // jdk.jar.disabledAlgorithms=MD2, MD5

    private static final String JAVA_SECURITY = System.getProperty(

            "javaSecurityFile", TEST_SRC + "/java.security");

    private static final String PASSWORD = "testpass";

    private static final String KEYSTORE = "testKeystore.jks";

    private static final String RSA = "RSA";

    private static final String DSA = "DSA";

    private static final String EC = "EC";

    private static String[] KEY_ALGORITHMS;

    private static final String[] DEFAULT_KEY_ALGORITHMS = new String[] {

            RSA,

            DSA,

            EC};

    private static final String SHA1 = "SHA-1";

    private static final String SHA256 = "SHA-256";

    private static final String SHA384 = "SHA-384";

    private static final String SHA512 = "SHA-512";

    private static final String DEFAULT = "DEFAULT";

    private static String[] DIGEST_ALGORITHMS;

    private static final String[] DEFAULT_DIGEST_ALGORITHMS = new String[] {

            SHA1,

            SHA256,

            SHA384,

            SHA512, // note: digests break onto continuation line in manifest

            DEFAULT};

    private static final boolean[] EXPIRED =

            Boolean.valueOf(System.getProperty("expired", "true")) ?

                    new boolean[] { false, true } : new boolean[] { false };

    private static final boolean TEST_COMPREHENSIVE_JAR_CONTENTS =

            Boolean.valueOf(System.getProperty(

                    "testComprehensiveJarContents", "false"));

    private static final boolean TEST_JAR_UPDATE =

            Boolean.valueOf(System.getProperty("testJarUpdate", "false"));

    private static final boolean STRICT =

            Boolean.valueOf(System.getProperty("strict", "false"));

    private static final Calendar CALENDAR = Calendar.getInstance();

    private static final DateFormat DATE_FORMAT

            = new SimpleDateFormat("yyyy/MM/dd HH:mm:ss");

    // The certificate validity period in minutes. The default value is 1440

    // minutes, namely 1 day.

    private static final int CERT_VALIDITY

            = Integer.valueOf(System.getProperty("certValidity", "1440"));

    static {

        if (CERT_VALIDITY < 1 || CERT_VALIDITY > 1440) {

            throw new RuntimeException(

                    "certValidity out of range [1, 1440]: " + CERT_VALIDITY);

        }

    }

    // If true, an additional verifying will be triggered after all of

    // valid certificates expire. The default value is false.

    public static final boolean DELAY_VERIFY

            = Boolean.valueOf(System.getProperty("delayVerify", "false"));

    private static long lastCertStartTime;

    private static DetailsOutputStream detailsOutput;

    private static int sigfileCounter;

    private static String nextSigfileName(String alias, String u, String s) {

        String sigfileName = "" + (++sigfileCounter);

        System.out.println("using sigfile " + sigfileName + " for alias "

                    + alias + " signing " + u + ".jar to " + s + ".jar");

        return sigfileName;

    }

    public static void main(String... args) throws Throwable {

        // Backups stdout and stderr.

        PrintStream origStdOut = System.out;

        PrintStream origStdErr = System.err;

        detailsOutput = new DetailsOutputStream(outfile());

        // Redirects the system output to a custom one.

        PrintStream printStream = new PrintStream(detailsOutput);

        System.setOut(printStream);

        System.setErr(printStream);

        TEST_JDK_INFO = new JdkInfo(TEST_JDK);

        List<TsaInfo> tsaList = tsaInfoList();

        List<JdkInfo> jdkInfoList = jdkInfoList();

        List<CertInfo> certList = createCertificates(jdkInfoList);

        List<SignItem> signItems =

                test(jdkInfoList, tsaList, certList, createJars());

        boolean failed = generateReport(jdkInfoList, tsaList, signItems);

        // Restores the original stdout and stderr.

        System.setOut(origStdOut);

        System.setErr(origStdErr);

        if (failed) {

            throw new RuntimeException("At least one test case failed. "

                    + "Please check the failed row(s) in report.html "

                    + "or failedReport.html.");

        }

    }

    private static SignItem createJarFile(String jar, Manifest m,

            String... files) throws IOException {

        JarUtils.createJarFile(Path.of(jar), m, Path.of("."),

                Arrays.stream(files).map(Path::of).toArray(Path[]::new));

        return SignItem.build()

                .signedJar(jar.replaceAll("[.]jar$", ""))

            .addContentFiles(Arrays.stream(files).collect(Collectors.toList()));

    }

    private static String createDummyFile(String name) throws IOException {

        if (name.contains("/")) new File(name).getParentFile().mkdir();

        try (OutputStream fos = new FileOutputStream(name)) {

            fos.write(name.getBytes(UTF_8));

        }

        return name;

    }

    // Creates one or more jar files to test

    private static List<SignItem> createJars() throws IOException {

        List<SignItem> jarList = new ArrayList<>();

        Manifest m = new Manifest();

        m.getMainAttributes().put(Name.MANIFEST_VERSION, "1.0");

        // creates a jar file that contains a dummy file

        jarList.add(createJarFile("test.jar", m, createDummyFile("dummy")));

        if (TEST_COMPREHENSIVE_JAR_CONTENTS) {

            // empty jar file so that jarsigner will add a default manifest

            jarList.add(createJarFile("empty.jar", m));

            // jar file that contains only an empty manifest with empty main

            // attributes (due to missing "Manifest-Version" header)

            JarUtils.createJar("nomainatts.jar");

            jarList.add(SignItem.build().signedJar("nomainatts"));

            // creates a jar file that contains several files.

            jarList.add(createJarFile("files.jar", m,

                    IntStream.range(1, 9).boxed().map(i -> {

                        try {

                            return createDummyFile("dummy" + i);

                        } catch (IOException e) {

                            throw new RuntimeException(e);

                        }

                    }).toArray(String[]::new)

            ));

            // forces a line break by exceeding the line width limit of 72 bytes

            // in the filename and hence manifest entry name

            jarList.add(createJarFile("longfilename.jar", m,

                    createDummyFile("test".repeat(20))));

            // another interesting case is with different digest algorithms

            // resulting in digests broken across line breaks onto continuation

            // lines. these however are set with the 'digestAlgs' option or

            // include all digest algorithms by default, see SignTwice.java.

        }

        return jarList;

    }

    // updates a signed jar file by adding another file

    private static List<SignItem> updateJar(SignItem prev) throws IOException {

        List<SignItem> jarList = new ArrayList<>();

        // sign unmodified jar again

        Files.copy(Path.of(prev.signedJar + ".jar"),

                Path.of(prev.signedJar + "-signagainunmodified.jar"));

        jarList.add(SignItem.build(prev)

                .signedJar(prev.signedJar + "-signagainunmodified"));

        String oldJar = prev.signedJar;

        String newJar = oldJar + "-addfile";

        String triggerUpdateFile = "addfile";

        JarUtils.updateJar(oldJar + ".jar", newJar + ".jar", triggerUpdateFile);

        jarList.add(SignItem.build(prev).signedJar(newJar)

                .addContentFiles(Arrays.asList(triggerUpdateFile)));

        return jarList;

    }

    // Creates a key store that includes a set of valid/expired certificates

    // with various algorithms.

    private static List<CertInfo> createCertificates(List<JdkInfo> jdkInfoList)

            throws Throwable {

        List<CertInfo> certList = new ArrayList<>();

        Set<String> expiredCertFilter = new HashSet<>();

        for (JdkInfo jdkInfo : jdkInfoList) {

            for (String keyAlgorithm : keyAlgs()) {

                if (!jdkInfo.supportsKeyAlg(keyAlgorithm)) continue;

                for (int keySize : keySizes(keyAlgorithm)) {

                    for (String digestAlgorithm : digestAlgs()) {

                        for(boolean expired : EXPIRED) {

                            // It creates only one expired certificate for one

                            // key algorithm.

                            if (expired

                                    && !expiredCertFilter.add(keyAlgorithm)) {

                                continue;

                            }

                            CertInfo certInfo = new CertInfo(

                                    jdkInfo,

                                    keyAlgorithm,

                                    digestAlgorithm,

                                    keySize,

                                    expired);

                            // If the signature algorithm is not supported by the

                            // JDK, it cannot try to sign jar with this algorithm.

                            String sigalg = certInfo.sigalg();

                            if (sigalg != null &&

                                    !jdkInfo.isSupportedSigalg(sigalg)) {

                                continue;

                            }

                            createCertificate(jdkInfo, certInfo);

                            certList.add(certInfo);

                        }

                    }

                }

            }

        }

        System.out.println("the keystore contents:");

        for (JdkInfo jdkInfo : jdkInfoList) {

            execTool(jdkInfo.jdkPath + "/bin/keytool", new String[] {

                    "-v",

                    "-storetype",

                    "jks",

                    "-storepass",

                    PASSWORD,

                    "-keystore",

                    KEYSTORE,

                    "-list"

            });

        }

        return certList;

    }

    // Creates/Updates a key store that adds a certificate with specific algorithm.

    private static void createCertificate(JdkInfo jdkInfo, CertInfo certInfo)

            throws Throwable {

        List<String> arguments = new ArrayList<>();

        arguments.add("-J-Djava.security.properties=" + JAVA_SECURITY);

        arguments.add("-v");

        arguments.add("-debug");

        arguments.add("-storetype");

        arguments.add("jks");

        arguments.add("-keystore");

        arguments.add(KEYSTORE);

        arguments.add("-storepass");

        arguments.add(PASSWORD);

        arguments.add(jdkInfo.majorVersion < 6 ? "-genkey" : "-genkeypair");

        arguments.add("-keyalg");

        arguments.add(certInfo.keyAlgorithm);

        String sigalg = certInfo.sigalg();

        if (sigalg != null) {

            arguments.add("-sigalg");

            arguments.add(sigalg);

        }

        if (certInfo.keySize != 0) {

            arguments.add("-keysize");

            arguments.add(certInfo.keySize + "");

        }

        arguments.add("-dname");

        arguments.add("CN=" + certInfo);

        arguments.add("-alias");

        arguments.add(certInfo.alias());

        arguments.add("-keypass");

        arguments.add(PASSWORD);

        arguments.add("-startdate");

        arguments.add(startDate(certInfo.expired));

        arguments.add("-validity");

//        arguments.add(DELAY_VERIFY ? "1" : "222"); // > six months no warn

        arguments.add("1");

        OutputAnalyzer outputAnalyzer = execTool(

                jdkInfo.jdkPath + "/bin/keytool",

                arguments.toArray(new String[arguments.size()]));

        if (outputAnalyzer.getExitValue() != 0

                || outputAnalyzer.getOutput().matches("[Ee]xception")

                || outputAnalyzer.getOutput().matches(Test.ERROR + " ?")) {

            System.out.println(outputAnalyzer.getOutput());

            throw new Exception("error generating a key pair: " + arguments);

        }

    }

    // The validity period of a certificate always be 1 day. For creating an

    // expired certificate, the start date is the time before 1 day, then the

    // certificate expires immediately. And for creating a valid certificate,

    // the start date is the time before (1 day - CERT_VALIDITY minutes), then

    // the certificate will expires in CERT_VALIDITY minutes.

    private static String startDate(boolean expiredCert) {

        CALENDAR.setTime(new Date());

        if (DELAY_VERIFY || expiredCert) {

            // corresponds to '-validity 1'

            CALENDAR.add(Calendar.DAY_OF_MONTH, -1);

        }

        if (DELAY_VERIFY && !expiredCert) {

            CALENDAR.add(Calendar.MINUTE, CERT_VALIDITY);

        }

        Date startDate = CALENDAR.getTime();

        if (!expiredCert) {

            lastCertStartTime = startDate.getTime();

        }

        return DATE_FORMAT.format(startDate);

    }

    private static String outfile() {

        return System.getProperty("o");

    }

    // Retrieves JDK info from the file which is specified by property

    // jdkListFile, or from property jdkList if jdkListFile is not available.

    private static List<JdkInfo> jdkInfoList() throws Throwable {

        String[] jdkList = list("jdkList");

        if (jdkList.length == 0) {

            jdkList = new String[] { "TEST_JDK" };

        }

        List<JdkInfo> jdkInfoList = new ArrayList<>();

        int index = 0;

        for (String jdkPath : jdkList) {

            JdkInfo jdkInfo = "TEST_JDK".equalsIgnoreCase(jdkPath) ?

                    TEST_JDK_INFO : new JdkInfo(jdkPath);

            // The JDK version must be unique.

            if (!jdkInfoList.contains(jdkInfo)) {

                jdkInfo.index = index++;

                jdkInfo.version = String.format(

                        "%s(%d)", jdkInfo.version, jdkInfo.index);

                jdkInfoList.add(jdkInfo);

            } else {

                System.out.println("The JDK version is duplicate: " + jdkPath);

            }

        }

        return jdkInfoList;

    }

    private static List<String> keyAlgs() throws IOException {

        if (KEY_ALGORITHMS == null) KEY_ALGORITHMS = list("keyAlgs");

        if (KEY_ALGORITHMS.length == 0)

            return Arrays.asList(DEFAULT_KEY_ALGORITHMS);

        return Arrays.stream(KEY_ALGORITHMS).map(a -> a.split(";")[0])

                .collect(Collectors.toList());

    }

    // Return key sizes according to the specified key algorithm.

    private static int[] keySizes(String keyAlgorithm) throws IOException {

        if (KEY_ALGORITHMS == null) KEY_ALGORITHMS = list("keyAlgs");

        for (String keyAlg : KEY_ALGORITHMS) {

            String[] split = (keyAlg + " ").split(";");

            if (keyAlgorithm.equals(split[0].trim()) && split.length > 1) {

                int sizes[] = new int[split.length - 1];

                for (int i = 1; i <= sizes.length; i++)

                    sizes[i - 1] = split[i].isBlank() ? 0 : // default

                        Integer.parseInt(split[i].trim());

                return sizes;

            }

        }

        // defaults

        if (RSA.equals(keyAlgorithm) || DSA.equals(keyAlgorithm)) {

            return new int[] { 1024, 2048, 0 }; // 0 is no keysize specified

        } else if (EC.equals(keyAlgorithm)) {

            return new int[] { 384, 571, 0 }; // 0 is no keysize specified

        } else {

            throw new RuntimeException("problem determining key sizes");

        }

    }

    private static List<String> digestAlgs() throws IOException {

        if (DIGEST_ALGORITHMS == null) DIGEST_ALGORITHMS = list("digestAlgs");

        if (DIGEST_ALGORITHMS.length == 0)

            return Arrays.asList(DEFAULT_DIGEST_ALGORITHMS);

        return Arrays.asList(DIGEST_ALGORITHMS);

    }

    // Retrieves TSA info from the file which is specified by property tsaListFile,

    // or from property tsaList if tsaListFile is not available.

    private static List<TsaInfo> tsaInfoList() throws IOException {

        String[] tsaList = list("tsaList");

        List<TsaInfo> tsaInfoList = new ArrayList<>();

        for (int i = 0; i < tsaList.length; i++) {

            String[] values = tsaList[i].split(";digests=");

            String[] digests = new String[0];

            if (values.length == 2) {

                digests = values[1].split(",");

            }

            String tsaUrl = values[0];

            if (tsaUrl.isEmpty() || tsaUrl.equalsIgnoreCase("notsa")) {

                tsaUrl = null;

            }

            TsaInfo bufTsa = new TsaInfo(i, tsaUrl);

            for (String digest : digests) {

                bufTsa.addDigest(digest.toUpperCase());

            }

            tsaInfoList.add(bufTsa);

        }

        if (tsaInfoList.size() == 0) {

            throw new RuntimeException("TSA service is mandatory unless "

                    + "'notsa' specified explicitly.");

        }