/*

 * Copyright (c) 2000, 2015, Oracle and/or its affiliates. All rights reserved.

 * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.

 *

 * This code is free software; you can redistribute it and/or modify it

 * under the terms of the GNU General Public License version 2 only, as

 * published by the Free Software Foundation.

 *

 * This code is distributed in the hope that it will be useful, but WITHOUT

 * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or

 * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License

 * version 2 for more details (a copy is included in the LICENSE file that

 * accompanied this code).

 *

 * You should have received a copy of the GNU General Public License version

 * 2 along with this work; if not, write to the Free Software Foundation,

 * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.

 *

 * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA

 * or visit www.oracle.com if you need additional information or have any

 * questions.

 */

import static sun.security.x509.GeneralNameInterface.NAME_DIRECTORY;

import static sun.security.x509.NameConstraintsExtension.EXCLUDED_SUBTREES;

import static sun.security.x509.NameConstraintsExtension.PERMITTED_SUBTREES;

import java.io.ByteArrayInputStream;

import java.io.ByteArrayOutputStream;

import java.io.IOException;

import java.io.InputStream;

import java.math.BigInteger;

import java.security.GeneralSecurityException;

import java.security.KeyFactory;

import java.security.PublicKey;

import java.security.cert.CertificateException;

import java.security.cert.CertificateFactory;

import java.security.cert.X509CertSelector;

import java.security.cert.X509Certificate;

import java.security.spec.X509EncodedKeySpec;

import java.util.Base64;

import java.util.Calendar;

import java.util.Date;

import java.util.HashSet;

import java.util.Iterator;

import java.util.List;

import java.util.Set;

import sun.security.util.DerInputStream;

import sun.security.util.DerOutputStream;

import sun.security.util.DerValue;

import sun.security.util.ObjectIdentifier;

import sun.security.x509.AlgorithmId;

import sun.security.x509.AuthorityKeyIdentifierExtension;

import sun.security.x509.CertificatePoliciesExtension;

import sun.security.x509.DNSName;

import sun.security.x509.GeneralName;

import sun.security.x509.GeneralNameInterface;

import sun.security.x509.GeneralNames;

import sun.security.x509.GeneralSubtree;

import sun.security.x509.GeneralSubtrees;

import sun.security.x509.KeyIdentifier;

import sun.security.x509.NameConstraintsExtension;

import sun.security.x509.PolicyInformation;

import sun.security.x509.PrivateKeyUsageExtension;

import sun.security.x509.SubjectAlternativeNameExtension;

import sun.security.x509.X500Name;

/*

 * @test

 * @bug 8074931

 * @summary This class tests the X509CertSelector. The tests check particular criteria

 *          by setting them to a value that should match our test certificate and

 *          ensuring that they do match, then setting them to a value that should not

 *          match our test certificate and ensuring that they do not match.

 * @modules java.base/sun.security.x509

 *          java.base/sun.security.util

 */

public class X509CertSelectorTest {

    /*

            Certificate:

                Data:

                    Version: 3 (0x2)

                    Serial Number: 954172088 (0x38df82b8)

                Signature Algorithm: dsaWithSHA1

                    Issuer: C=us, O=sun, OU=testing

                    Validity

                        Not Before: Mar 27 15:48:08 2000 GMT

                        Not After : Jun 25 14:48:08 2000 GMT

                    Subject: C=us, O=sun, OU=testing, CN=mullan

                    Subject Public Key Info:

                        Public Key Algorithm: dsaEncryption

                            pub:  0

                            P:    0

                            Q:    0

                            G:    0

                    X509v3 extensions:

                        X509v3 Name Constraints: critical

                            0D.B0@.>1.0...U....us1.0

            ..U.

            ..sun1.0...U....testing1.0

            ..U....mullan

                        X509v3 Subject Key Identifier:

                            56:E8:88:AE:9D:B5:3F:2B:CB:A0:4C:4B:E2:87:53:07:33:77:1B:DF

                        X509v3 Authority Key Identifier:

                            keyid:8E:DD:AF:6F:EE:02:12:F4:61:E9:2F:E3:64:1A:6F:71:32:25:20:C0

                        X509v3 Subject Alternative Name:

                            email:mullan@east.sun.com

                        X509v3 Private Key Usage Period:

                            Not Before: Jan  1 05:00:00 2000 GMT, Not After: Jan  1 05:00:00 2001 GMT

                        X509v3 Key Usage: critical

                            Digital Signature

                        X509v3 Certificate Policies:

                            0$0\..*...0.0...+.......0..

            Testing...

                Signature Algorithm: dsaWithSHA1

                     r:

                         44:c7:35:40:5d:6c:28:75:7f:73:b2:f8:0d:72:6c:

                         09:65:b8:81:14

                     s:

                         76:79:f5:c7:37:3b:0d:9b:db:70:2f:20:80:36:e3:

                         80:e8:a6:c6:71

    */

    private static final String testCert =

            "-----BEGIN CERTIFICATE-----\n" +

            "MIICLjCCAeygAwIBAgIEON+CuDALBgcqhkjOOAQDBQAwLTELMAkGA1UEBhMCdXMx\n" +

            "DDAKBgNVBAoTA3N1bjEQMA4GA1UECxMHdGVzdGluZzAeFw0wMDAzMjcxNTQ4MDha\n" +

            "Fw0wMDA2MjUxNDQ4MDhaMD4xCzAJBgNVBAYTAnVzMQwwCgYDVQQKEwNzdW4xEDAO\n" +

            "BgNVBAsTB3Rlc3RpbmcxDzANBgNVBAMTBm11bGxhbjAcMBQGByqGSM44BAEwCQIB\n" +

            "AAIBAAIBAAMEAAIBAKOCASMwggEfMFAGA1UdHgEB/wRGMESgQjBApD4xCzAJBgNV\n" +

            "BAYTAnVzMQwwCgYDVQQKEwNzdW4xEDAOBgNVBAsTB3Rlc3RpbmcxDzANBgNVBAMT\n" +

            "Bm11bGxhbjAdBgNVHQ4EFgQUVuiIrp21PyvLoExL4odTBzN3G98wHwYDVR0jBBgw\n" +

            "FoAUjt2vb+4CEvRh6S/jZBpvcTIlIMAwHgYDVR0RBBcwFYETbXVsbGFuQGVhc3Qu\n" +

            "c3VuLmNvbTArBgNVHRAEJDAigA8yMDAwMDEwMTA1MDAwMFqBDzIwMDEwMTAxMDUw\n" +

            "MDAwWjAPBgNVHQ8BAf8EBQMDB4AAMC0GA1UdIAQmMCQwIgYEKoSAADAaMBgGCCsG\n" +

            "AQUFBwICMAwSClRlc3RpbmcuLi4wCwYHKoZIzjgEAwUAAy8AMCwCFETHNUBdbCh1\n" +

            "f3Oy+A1ybAlluIEUAhR2efXHNzsNm9twLyCANuOA6KbGcQ==\n" +

            "-----END CERTIFICATE-----\n" +

            "";

    private static final String testKey =

            "MIIBtjCCASsGByqGSM44BAEwggEeAoGBAIVWPEkcxbxhQRCqVzg55tNqbP5j0K4kdu4bkmXvfqC5\n" +

            "+qA75DvnfzsOJseb+9AuKXWk/DvCzFDmrY1YaU3scZC3OQEO9lEO3F4VDKOaudY6OT1SI22pAIwz\n" +

            "j5pvq+i7zOp4xUqkQUeh/4iQSfxOT5UrFGjkcbnbpVkCXD/GxAz7AhUAjtnm3dVIddUUHl6wxpZ7\n" +

            "GcA6gSsCgYAf/PXzQtemgIDjpFrNNSgTEKkLposBXKatAM+gUKlMUjf8SQvquqPxDtRrscGjXkoL\n" +

            "oTkaR7/akULYFpBvUcFkeIFiCnJg8M9XhCWdLvn9MPt+jR2oxookvCb9xLtD6WvIM/wd/nZ1iK4u\n" +

            "iY1+q85xvns/Awbtwl7oZDAwE2TUKAOBhAACgYBDc9UZ+3xsZubUZvRG5cpyJceYpJp2exOPVJXn\n" +

            "jR4CcR+cT9bAJpFSxqE/8KtNHXxHdu4f3DU67IMOVDpugzihyzXJvNm3w2H9x+6xczHG2wjvAJeh\n" +

            "X62EWbUatxPXFAoVKZWuUbaYaZzdWBDtNRrCuKKsLo0GFy8g2BZISuD3jw==\n" +

            "";

    // Certificate to run tests on

    private final X509Certificate cert;

    public static void main(String[] args) throws Exception {

        X509CertSelectorTest test = new X509CertSelectorTest();

        test.doTest();

    }

    public X509CertSelectorTest() throws CertificateException, IOException {

        cert = (X509Certificate) CertificateFactory.getInstance("X.509")

                .generateCertificate(new ByteArrayInputStream(testCert.getBytes()));

    }

    // Runs the test.

    private void doTest() throws Exception {

        System.out.println("START OF TESTS FOR " + "X509CertSelector");

        testSerialNumber();

        testIssuer();

        testSubjectKeyIdentifier();

        testAuthorityKeyIdentifier();

        testCertificateValid();

        testPrivateKeyValid();

        testSubjectPublicKeyAlgID();

        testKeyUsage();

        testSubjectAltName();

        testPolicy();

        testPathToName();

        testSubject();

        testSubjectPublicKey();

        testNameConstraints();

        testBasicConstraints();

        testCertificate();

    }

    // Tests matching on the serial number contained in the certificate.

    private void testSerialNumber() {

        System.out.println("X.509 Certificate Match on serialNumber");

        // bad match

        X509CertSelector selector = new X509CertSelector();

        selector.setSerialNumber(new BigInteger("999999999"));

        checkMatch(selector, cert, false);

        // good match

        selector.setSerialNumber(cert.getSerialNumber());

        checkMatch(selector, cert, true);

    }

    // Tests matching on the issuer name contained in the certificate.

    private void testIssuer() throws IOException {

        System.out.println("X.509 Certificate Match on issuer");

        // bad match

        X509CertSelector selector = new X509CertSelector();

        selector.setIssuer("ou=bogus,ou=east,o=sun,c=us");

        checkMatch(selector, cert, false);

        // good match

        selector.setIssuer((cert.getIssuerX500Principal()).getName("RFC2253"));

        checkMatch(selector, cert, true);

    }

    /*

     * Tests matching on the subject key identifier contained in the

     * certificate.

     */

    private void testSubjectKeyIdentifier() throws IOException {

        System.out.println("X.509 Certificate Match on subjectKeyIdentifier");

        // bad match

        X509CertSelector selector = new X509CertSelector();

        byte[] b = { 0, 1, 2, 3, 4, 5, 6, 7, 8, 9 };

        selector.setSubjectKeyIdentifier(b);

        checkMatch(selector, cert, false);

        // good match

        DerInputStream in = new DerInputStream(cert.getExtensionValue("2.5.29.14"));

        byte[] encoded = in.getOctetString();

        selector.setSubjectKeyIdentifier(encoded);

        checkMatch(selector, cert, true);

    }

    /*

     * Tests matching on the authority key identifier contained in the

     * certificate.

     */

    private void testAuthorityKeyIdentifier() throws IOException {

        System.out.println("X.509 Certificate Match on authorityKeyIdentifier");

        // bad match

        X509CertSelector selector = new X509CertSelector();

        byte[] b = { 0, 1, 2, 3, 4, 5, 6, 7, 8, 9 };

        AuthorityKeyIdentifierExtension a = new AuthorityKeyIdentifierExtension(new KeyIdentifier(b), null, null);

        selector.setAuthorityKeyIdentifier(a.getExtensionValue());

        checkMatch(selector, cert, false);

        // good match

        DerInputStream in = new DerInputStream(cert.getExtensionValue("2.5.29.35"));

        byte[] encoded = in.getOctetString();

        selector.setAuthorityKeyIdentifier(encoded);

        checkMatch(selector, cert, true);

    }

    /*

     * Tests matching on the certificate validity component contained in the

     * certificate.

     */

    private void testCertificateValid() {

        System.out.println("X.509 Certificate Match on certificateValid");

        // bad match

        X509CertSelector selector = new X509CertSelector();

        Calendar cal = Calendar.getInstance();

        cal.set(1968, 12, 31);

        selector.setCertificateValid(cal.getTime());

        checkMatch(selector, cert, false);

        // good match

        selector.setCertificateValid(cert.getNotBefore());

        checkMatch(selector, cert, true);

    }

    /*

     * Tests matching on the private key validity component contained in the

     * certificate.

     */

    private void testPrivateKeyValid() throws IOException, CertificateException {

        System.out.println("X.509 Certificate Match on privateKeyValid");

        // bad match

        X509CertSelector selector = new X509CertSelector();

        Calendar cal = Calendar.getInstance();

        cal.set(1968, 12, 31);

        selector.setPrivateKeyValid(cal.getTime());

        checkMatch(selector, cert, false);

        // good match

        DerInputStream in = new DerInputStream(cert.getExtensionValue("2.5.29.16"));

        byte[] encoded = in.getOctetString();

        PrivateKeyUsageExtension ext = new PrivateKeyUsageExtension(false, encoded);

        Date validDate = (Date) ext.get(PrivateKeyUsageExtension.NOT_BEFORE);

        selector.setPrivateKeyValid(validDate);

        checkMatch(selector, cert, true);

    }

    private ObjectIdentifier getCertPubKeyAlgOID(X509Certificate xcert) throws IOException {

        byte[] encodedKey = xcert.getPublicKey().getEncoded();

        DerValue val = new DerValue(encodedKey);

        if (val.tag != DerValue.tag_Sequence) {

            throw new RuntimeException("invalid key format");

        }

        return AlgorithmId.parse(val.data.getDerValue()).getOID();

    }

    /*

     * Tests matching on the subject public key algorithm ID component contained

     * in the certificate.

     */

    private void testSubjectPublicKeyAlgID() throws IOException {

        System.out.println("X.509 Certificate Match on subjectPublicKeyAlgID");

        // bad match

        X509CertSelector selector = new X509CertSelector();

        selector.setSubjectPublicKeyAlgID("2.5.29.14");

        checkMatch(selector, cert, false);

        // good match

        selector.setSubjectPublicKeyAlgID(getCertPubKeyAlgOID(cert).toString());

        checkMatch(selector, cert, true);

    }

    // Tests matching on the key usage extension contained in the certificate.

    private void testKeyUsage() {

        System.out.println("X.509 Certificate Match on keyUsage");

        // bad match

        X509CertSelector selector = new X509CertSelector();

        boolean[] keyUsage = { true, false, true, false, true, false, true, false };

        selector.setKeyUsage(keyUsage);

        System.out.println("Selector = " + selector.toString());

        checkMatch(selector, cert, false);

        // good match

        selector.setKeyUsage(cert.getKeyUsage());

        System.out.println("Selector = " + selector.toString());

        checkMatch(selector, cert, true);

    }

    /*

     * Tests matching on the subject alternative name extension contained in the

     * certificate.

     */

    private void testSubjectAltName() throws IOException {

        System.out.println("X.509 Certificate Match on subjectAltName");

        // bad match

        X509CertSelector selector = new X509CertSelector();

        GeneralNameInterface dnsName = new DNSName("foo.com");

        DerOutputStream tmp = new DerOutputStream();

        dnsName.encode(tmp);

        selector.addSubjectAlternativeName(2, tmp.toByteArray());

        checkMatch(selector, cert, false);

        // good match

        DerInputStream in = new DerInputStream(cert.getExtensionValue("2.5.29.17"));

        byte[] encoded = in.getOctetString();

        SubjectAlternativeNameExtension ext = new SubjectAlternativeNameExtension(false, encoded);

        GeneralNames names = (GeneralNames) ext.get(SubjectAlternativeNameExtension.SUBJECT_NAME);

        GeneralName name = (GeneralName) names.get(0);

        selector.setSubjectAlternativeNames(null);

        DerOutputStream tmp2 = new DerOutputStream();

        name.getName().encode(tmp2);

        selector.addSubjectAlternativeName(name.getType(), tmp2.toByteArray());

        checkMatch(selector, cert, true);

        // good match 2 (matches at least one)

        selector.setMatchAllSubjectAltNames(false);

        selector.addSubjectAlternativeName(2, "foo.com");

        checkMatch(selector, cert, true);

    }

    /*

     * Tests matching on the policy constraints extension contained in the

     * certificate.

     */

    private void testPolicy() throws IOException {

        System.out.println("X.509 Certificate Match on certificatePolicies");

        // test encoding of CertificatePoliciesExtension because we wrote the

        // code

        // bad match

        X509CertSelector selector = new X509CertSelector();

        Set<String> s = new HashSet<>();

        s.add(new String("1.2.5.7.68"));

        selector.setPolicy(s);

        checkMatch(selector, cert, false);

        // good match

        DerInputStream in = new DerInputStream(cert.getExtensionValue("2.5.29.32"));

        CertificatePoliciesExtension ext = new CertificatePoliciesExtension(false, in.getOctetString());

        List<PolicyInformation> policies = ext.get(CertificatePoliciesExtension.POLICIES);

        // match on the first policy id

        PolicyInformation policyInfo = (PolicyInformation) policies.get(0);

        s.clear();

        s.add(policyInfo.getPolicyIdentifier().getIdentifier().toString());

        selector.setPolicy(s);

        checkMatch(selector, cert, true);

    }

    /*

     * Tests matching on the name constraints extension contained in the

     * certificate.

     */

    private void testPathToName() throws IOException {

        System.out.println("X.509 Certificate Match on pathToName");

        X509CertSelector selector = null;

        DerInputStream in = new DerInputStream(cert.getExtensionValue("2.5.29.30"));

        byte[] encoded = in.getOctetString();

        NameConstraintsExtension ext = new NameConstraintsExtension(false, encoded);

        GeneralSubtrees permitted = (GeneralSubtrees) ext.get(PERMITTED_SUBTREES);

        GeneralSubtrees excluded = (GeneralSubtrees) ext.get(EXCLUDED_SUBTREES);

        // bad matches on pathToName within excluded subtrees

        if (excluded != null) {

            Iterator<GeneralSubtree> e = excluded.iterator();

            while (e.hasNext()) {

                GeneralSubtree tree = e.next();

                if (tree.getName().getType() == NAME_DIRECTORY) {

                    X500Name excludedDN1 = new X500Name(tree.getName().toString());

                    X500Name excludedDN2 = new X500Name("CN=Bogus, " + tree.getName().toString());

                    DerOutputStream derDN1 = new DerOutputStream();

                    DerOutputStream derDN2 = new DerOutputStream();

                    excludedDN1.encode(derDN1);

                    excludedDN2.encode(derDN2);

                    selector = new X509CertSelector();

                    selector.addPathToName(NAME_DIRECTORY, derDN1.toByteArray());

                    checkMatch(selector, cert, false);

                    selector.setPathToNames(null);

                    selector.addPathToName(NAME_DIRECTORY, derDN2.toByteArray());

                    checkMatch(selector, cert, false);

                }

            }

        }

        // good matches on pathToName within permitted subtrees

        if (permitted != null) {

            Iterator<GeneralSubtree> e = permitted.iterator();

            while (e.hasNext()) {

                GeneralSubtree tree = e.next();

                if (tree.getName().getType() == NAME_DIRECTORY) {

                    X500Name permittedDN1 = new X500Name(tree.getName().toString());

                    X500Name permittedDN2 = new X500Name("CN=good, " + tree.getName().toString());

                    DerOutputStream derDN1 = new DerOutputStream();

                    DerOutputStream derDN2 = new DerOutputStream();

                    permittedDN1.encode(derDN1);

                    permittedDN2.encode(derDN2);

                    selector = new X509CertSelector();

                    selector.addPathToName(NAME_DIRECTORY, derDN1.toByteArray());

                    checkMatch(selector, cert, true);

                    selector.setPathToNames(null);

                    selector.addPathToName(NAME_DIRECTORY, derDN2.toByteArray());

                    checkMatch(selector, cert, true);

                }

            }

        }

    }

    // Tests matching on the subject name contained in the certificate.

    private void testSubject() throws IOException {

        System.out.println("X.509 Certificate Match on subject");

        // bad match

        X509CertSelector selector = new X509CertSelector();

        selector.setSubject("ou=bogus,ou=east,o=sun,c=us");

        checkMatch(selector, cert, false);

        // good match

        selector.setSubject(cert.getSubjectX500Principal().getName("RFC2253"));

        checkMatch(selector, cert, true);

    }

    // Tests matching on the subject public key contained in the certificate.

    private void testSubjectPublicKey() throws IOException, GeneralSecurityException {

        System.out.println("X.509 Certificate Match on subject public key");

        // bad match

        X509CertSelector selector = new X509CertSelector();

        X509EncodedKeySpec keySpec = new X509EncodedKeySpec(

                Base64.getMimeDecoder().decode(testKey.getBytes()));

        KeyFactory keyFactory = KeyFactory.getInstance("DSA");

        PublicKey pubKey = keyFactory.generatePublic(keySpec);

        selector.setSubjectPublicKey(pubKey);

        checkMatch(selector, cert, false);

        // good match

        selector.setSubjectPublicKey(cert.getPublicKey());

        checkMatch(selector, cert, true);

    }

    // Tests matching on the name constraints contained in the certificate.

    private void testNameConstraints() throws IOException {

        System.out.println("X.509 Certificate Match on name constraints");

        // bad match

        GeneralSubtrees subjectTree = new GeneralSubtrees();

        subjectTree.add(getGeneralSubtree((X500Name) cert.getSubjectDN()));

        NameConstraintsExtension ext = new NameConstraintsExtension((GeneralSubtrees) null, subjectTree);

        X509CertSelector selector = new X509CertSelector();

        selector.setNameConstraints(ext.getExtensionValue());

        checkMatch(selector, cert, false);

        // good match

        ext = new NameConstraintsExtension(subjectTree, null);

        selector.setNameConstraints(ext.getExtensionValue());

        checkMatch(selector, cert, true);

    }

    // Tests matching on basic constraints.

    private void testBasicConstraints() {

        System.out.println("X.509 Certificate Match on basic constraints");

        // bad match

        X509CertSelector selector = new X509CertSelector();

        int mpl = cert.getBasicConstraints();

        selector.setBasicConstraints(0);

        checkMatch(selector, cert, false);

        // good match

        selector.setBasicConstraints(mpl);

        checkMatch(selector, cert, true);

    }

    // Tests certificateEquals criterion

    private void testCertificate() {

        System.out.println("X.509 Certificate Match on certificateEquals criterion");

        X509CertSelector selector = new X509CertSelector();

        // good match

        selector.setCertificate(cert);

        checkMatch(selector, cert, true);

    }

    private void checkMatch(X509CertSelector selector, X509Certificate cert, boolean match) {

        boolean result = selector.match(cert);

        if (match != result)

            throw new RuntimeException(selector + " match " + cert + " is " + result + ", but expect " + match);

    }