1 /* 2 * Copyright (c) 2014, Oracle and/or its affiliates. All rights reserved. 3 * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. 4 * 5 * This code is free software; you can redistribute it and/or modify it 6 * under the terms of the GNU General Public License version 2 only, as 7 * published by the Free Software Foundation. 8 * 9 * This code is distributed in the hope that it will be useful, but WITHOUT 10 * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or 11 * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License 12 * version 2 for more details (a copy is included in the LICENSE file that 13 * accompanied this code). 14 * 15 * You should have received a copy of the GNU General Public License version 16 * 2 along with this work; if not, write to the Free Software Foundation, 17 * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA. 18 * 19 * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA 20 * or visit www.oracle.com if you need additional information or have any 21 * questions. 22 */ 23 24 /** 25 * @test 26 * @bug 8025708 27 * @summary make sure a PKIX CertPathBuilder can build a path when an 28 * intermediate CA certificate contains an AKI extension with a key 29 * identifier and no serial number and the end-entity certificate contains 30 * an AKI extension with both a key identifier and a serial number. 31 */ 32 // Android-changed: Adapted from 33 // jdk/test/java/security/cert/CertPathBuilder/akiExt/AKISerialNumber.java 34 // Android-changed: Added package & Test import 35 package test.java.security.cert; 36 import org.testng.annotations.Test; 37 38 import java.io.ByteArrayInputStream; 39 import java.security.cert.*; 40 import java.util.ArrayList; 41 import java.util.Base64; 42 import java.util.Collections; 43 44 public class AKISerialNumberTest { 45 46 private static final String ROOT_CERT = 47 "MIICfTCCAeagAwIBAgIBATANBgkqhkiG9w0BAQUFADB3MQ0wCwYDVQQDEwRSb290\n" + 48 "MRYwFAYDVQQLEw1UZXN0IE9yZyBVbml0MREwDwYDVQQKEwhUZXN0IE9yZzEWMBQG\n" + 49 "A1UEBxMNVGVzdCBMb2NhbGl0eTEWMBQGA1UECBMNTWFzc2FjaHVzZXR0czELMAkG\n" + 50 "A1UEBhMCVVMwHhcNMTQwMjAxMDUwMDAwWhcNMjQwMjAxMDUwMDAwWjB3MQ0wCwYD\n" + 51 "VQQDEwRSb290MRYwFAYDVQQLEw1UZXN0IE9yZyBVbml0MREwDwYDVQQKEwhUZXN0\n" + 52 "IE9yZzEWMBQGA1UEBxMNVGVzdCBMb2NhbGl0eTEWMBQGA1UECBMNTWFzc2FjaHVz\n" + 53 "ZXR0czELMAkGA1UEBhMCVVMwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAJvL\n" + 54 "cZu6Rzf9IrduEDjJxEFv5uBvUNMlIAph7NhfmFH9puPW3Ksci4a5yTCzxI9VeVf3\n" + 55 "oYZ/UrZdF+mNZmS23RUh71X5tjMO+xew196M1xNpCRLbjcZ6i4tNdZYkdRIe8ejN\n" + 56 "sbBoD7OAvPbQqTygeG4jYjK6ODofSrba3BndNoFxAgMBAAGjGTAXMBUGA1UdEwEB\n" + 57 "/wQLMAkBAf8CBH////8wDQYJKoZIhvcNAQEFBQADgYEATvCqn69pNHv0zLiZAXk7\n" + 58 "3AKwAoza0wa+1S2rVuZGfBWbV7CxmBHbgcDDbU7/I8pQVkCwOHNkVFnBgNpMuAvU\n" + 59 "aDyrHSNS/av5d1yk5WAuGX2B9mSwZdhnAvtz2fsV1q9NptdF54EkIiKtQQmTGnr9\n" + 60 "TID8CFEk/qje+AB272B1UJw=\n"; 61 62 /** 63 * This certificate contains an AuthorityKeyIdentifier with only the 64 * keyIdentifier field filled in. 65 */ 66 private static final String INT_CERT_WITH_KEYID_AKI = 67 "MIICqTCCAhKgAwIBAgIBAjANBgkqhkiG9w0BAQUFADB3MQ0wCwYDVQQDEwRSb290\n" + 68 "MRYwFAYDVQQLEw1UZXN0IE9yZyBVbml0MREwDwYDVQQKEwhUZXN0IE9yZzEWMBQG\n" + 69 "A1UEBxMNVGVzdCBMb2NhbGl0eTEWMBQGA1UECBMNTWFzc2FjaHVzZXR0czELMAkG\n" + 70 "A1UEBhMCVVMwHhcNMTQwMjAxMDUwMDAwWhcNMjQwMjAxMDUwMDAwWjCBhDEaMBgG\n" + 71 "A1UEAxMRSW50ZXJtZWRpYXRlIENBIDIxFjAUBgNVBAsTDVRlc3QgT3JnIFVuaXQx\n" + 72 "ETAPBgNVBAoTCFRlc3QgT3JnMRYwFAYDVQQHEw1UZXN0IExvY2FsaXR5MRYwFAYD\n" + 73 "VQQIEw1NYXNzYWNodXNldHRzMQswCQYDVQQGEwJVUzCBnzANBgkqhkiG9w0BAQEF\n" + 74 "AAOBjQAwgYkCgYEAwKTZekCqb9F9T54s2IXjkQbmLIjQamMpkUlZNrpjjNq9CpTT\n" + 75 "POkfxv2UPwzTz3Ij4XFL/kJFBLm8NUOsS5xPJ62pGoZBPw9R0iMTsTce+Fpukqnr\n" + 76 "I+8jTRaAvr0tR3pqrE6uHKg7dWYN2SsWesDia/LHhwEN38yyWtSuTTLo4hcCAwEA\n" + 77 "AaM3MDUwHwYDVR0jBBgwFoAU6gZP1pO8v7+i8gsFf1gWTf/j3PkwEgYDVR0TAQH/\n" + 78 "BAgwBgEB/wIBADANBgkqhkiG9w0BAQUFAAOBgQAQxeQruav4AqQM4gmEfrHr5hOq\n" + 79 "mB2CNJ1ZqVfpDZ8GHijncKTpjNoXzzQtV23Ge+39JHOVBNWtk+aghB3iu6xGq7Qn\n" + 80 "HlBhg9meqHFqd3igDDD/jhABL2/bEo/M9rv6saYWDFZ8nCIEE6iTLTpRRko4W2Xb\n" + 81 "DyzMzMsO1kPNrJaxRg==\n"; 82 83 /** 84 * This certificate contains an AuthorityKeyIdentifier with all 3 fields 85 * (keyIdentifier, authorityCertIssuer, and authorityCertSerialNumber) 86 * filled in. 87 */ 88 private static final String EE_CERT_WITH_FULL_AKI = 89 "MIIDLjCCApegAwIBAgIBAzANBgkqhkiG9w0BAQUFADCBhDEaMBgGA1UEAxMRSW50\n" + 90 "ZXJtZWRpYXRlIENBIDIxFjAUBgNVBAsTDVRlc3QgT3JnIFVuaXQxETAPBgNVBAoT\n" + 91 "CFRlc3QgT3JnMRYwFAYDVQQHEw1UZXN0IExvY2FsaXR5MRYwFAYDVQQIEw1NYXNz\n" + 92 "YWNodXNldHRzMQswCQYDVQQGEwJVUzAeFw0xNDAyMDEwNTAwMDBaFw0yNDAyMDEw\n" + 93 "NTAwMDBaMH0xEzARBgNVBAMTCkVuZCBFbnRpdHkxFjAUBgNVBAsTDVRlc3QgT3Jn\n" + 94 "IFVuaXQxETAPBgNVBAoTCFRlc3QgT3JnMRYwFAYDVQQHEw1UZXN0IExvY2FsaXR5\n" + 95 "MRYwFAYDVQQIEw1NYXNzYWNodXNldHRzMQswCQYDVQQGEwJVUzCBnzANBgkqhkiG\n" + 96 "9w0BAQEFAAOBjQAwgYkCgYEAqady46PdwlKHVP1iaP11CxVyL6cDlPjpwhHCcIUv\n" + 97 "nKHbzdamqmHebDcWVBNN/I0TLNCl3ga7n8KyygSN379fG7haU8SNjpy4IDAXM0/x\n" + 98 "mwTWNTbKfJEkSoiqx1WUy2JTzRUMhgYPguQNECPxBXAdQrthZ7wQosv6Ro2ySP9O\n" + 99 "YqsCAwEAAaOBtTCBsjCBoQYDVR0jBIGZMIGWgBQdeoKxTvlTgW2KgprD69vgHV4X\n" + 100 "kKF7pHkwdzENMAsGA1UEAxMEUm9vdDEWMBQGA1UECxMNVGVzdCBPcmcgVW5pdDER\n" + 101 "MA8GA1UEChMIVGVzdCBPcmcxFjAUBgNVBAcTDVRlc3QgTG9jYWxpdHkxFjAUBgNV\n" + 102 "BAgTDU1hc3NhY2h1c2V0dHMxCzAJBgNVBAYTAlVTggECMAwGA1UdEwEB/wQCMAAw\n" + 103 "DQYJKoZIhvcNAQEFBQADgYEAuG4mM1nLF7STQWwmceELZEl49ntapH/RVoekknmd\n" + 104 "aNzcL4XQf6BTl8KFUXuThHaukQnGIzFbSZV0hrpSQ5fTN2cSZgD4Fji+HuNURmmd\n" + 105 "+Kayl0piHyO1FSbrty0TFhlVNvzKXjmMp6Jdn42KyGOSCoROQcvUWN6xkV3Hvrei\n" + 106 "0ZE=\n"; 107 108 private static Base64.Decoder b64Decoder = Base64.getMimeDecoder(); 109 private static CertificateFactory cf; 110 111 // Android-changed: Removed args & added @Test 112 @Test main()113 public static void main() throws Exception { 114 115 cf = CertificateFactory.getInstance("X.509"); 116 117 X509Certificate rootCert = getCertFromMimeEncoding(ROOT_CERT); 118 TrustAnchor anchor = new TrustAnchor(rootCert, null); 119 120 X509Certificate eeCert = getCertFromMimeEncoding(EE_CERT_WITH_FULL_AKI); 121 X509Certificate intCert = getCertFromMimeEncoding(INT_CERT_WITH_KEYID_AKI); 122 123 X509CertSelector sel = new X509CertSelector(); 124 sel.setCertificate(eeCert); 125 PKIXBuilderParameters params = new PKIXBuilderParameters 126 (Collections.singleton(anchor), sel); 127 params.setRevocationEnabled(false); 128 129 ArrayList<X509Certificate> certs = new ArrayList<>(); 130 certs.add(intCert); 131 certs.add(eeCert); 132 CollectionCertStoreParameters ccsp = 133 new CollectionCertStoreParameters(certs); 134 CertStore cs = CertStore.getInstance("Collection", ccsp); 135 params.addCertStore(cs); 136 137 CertPathBuilder cpb = CertPathBuilder.getInstance("PKIX"); 138 CertPathBuilderResult res = cpb.build(params); 139 } 140 getCertFromMimeEncoding(String encoded)141 private static X509Certificate getCertFromMimeEncoding(String encoded) 142 throws CertificateException 143 { 144 byte[] bytes = b64Decoder.decode(encoded); 145 ByteArrayInputStream stream = new ByteArrayInputStream(bytes); 146 return (X509Certificate)cf.generateCertificate(stream); 147 } 148 }