DefaultEntitlementCertServiceAdapter extends BaseEntitlementCertServiceAdapter { public X509Certificate createX509Certificate(Consumer consumer, Owner owner, Pool pool, Entitlement ent, Product product, Set<Product> products, List<org.candlepin.model.dto.Product> productModels, BigInteger serialNumber, KeyPair keyPair, boolean useContentPrefix) throws GeneralSecurityException, IOException { Set<X509ExtensionWrapper> extensions; Set<X509ByteExtensionWrapper> byteExtensions = new LinkedHashSet<>(); products.add(product); Map<String, EnvironmentContent> promotedContent = getPromotedContent(consumer); String contentPrefix = getContentPrefix(consumer, owner, useContentPrefix); if (shouldGenerateV3(consumer)) { extensions = prepareV3Extensions(); byteExtensions = prepareV3ByteExtensions(product, productModels, contentPrefix, promotedContent); } else { extensions = prepareV1Extensions(products, pool, consumer, ent.getQuantity(), contentPrefix, promotedContent); } Date endDate = setupEntitlementEndDate(pool, consumer); ent.setEndDateOverride(endDate); Calendar calNow = Calendar.getInstance(); Calendar calMinusHour = Calendar.getInstance(); calMinusHour.add(Calendar.HOUR, -1); Date startDate = pool.getStartDate(); if (pool.getStartDate().getTime() > calMinusHour.getTime().getTime() && pool.getStartDate().getTime() < calNow.getTime().getTime()) { startDate = calMinusHour.getTime(); } X509Certificate x509Cert = this.pki.createX509Certificate( createDN(ent, owner), extensions, byteExtensions, startDate, endDate, keyPair, serialNumber, null); return x509Cert; } @Inject  DefaultEntitlementCertServiceAdapter(PKIUtility pki,
        X509ExtensionUtil extensionUtil,
        X509V3ExtensionUtil v3extensionUtil,
        EntitlementCertificateCurator entCertCurator,
        KeyPairCurator keyPairCurator,
        CertificateSerialCurator serialCurator,
        OwnerCurator ownerCurator,
        EntitlementCurator entCurator, I18n i18n,
        Configuration config,
        ProductCurator productCurator,
        ConsumerTypeCurator consumerTypeCurator,
        EnvironmentCurator environmentCurator); @Override EntitlementCertificate generateEntitlementCert(Entitlement entitlement, Product product); @Override Map<String, EntitlementCertificate> generateEntitlementCerts(Consumer consumer,
        Map<String, PoolQuantity> poolQuantities, Map<String, Entitlement> entitlements,
        Map<String, Product> products, boolean save); X509Certificate createX509Certificate(Consumer consumer, Owner owner, Pool pool,
        Entitlement ent, Product product, Set<Product> products,
        List<org.candlepin.model.dto.Product> productModels, BigInteger serialNumber,
        KeyPair keyPair, boolean useContentPrefix); Set<X509ExtensionWrapper> prepareV1Extensions(Set<Product> products,
        Pool pool, Consumer consumer, Integer quantity, String contentPrefix,
        Map<String, EnvironmentContent> promotedContent); Set<X509ExtensionWrapper> prepareV3Extensions(); Set<X509ByteExtensionWrapper> prepareV3ByteExtensions(Product sku,
        List<org.candlepin.model.dto.Product> productModels, String contentPrefix,
        Map<String, EnvironmentContent> promotedContent); String cleanUpPrefix(String contentPrefix); List<Long> listEntitlementSerialIds(Consumer consumer);  }
@Test public void temporaryCertificateForUnmappedGuests() throws Exception { Date now = new Date(); consumer.setCreated(now); pool.setAttribute(Pool.Attributes.UNMAPPED_GUESTS_ONLY, "true"); certServiceAdapter = new DefaultEntitlementCertServiceAdapter( realPKI, extensionUtil, v3extensionUtil, mock(EntitlementCertificateCurator.class), keyPairCurator, serialCurator, ownerCurator, entCurator, I18nFactory.getI18n(getClass(), Locale.US, I18nFactory.FALLBACK), config, productCurator, this.mockConsumerTypeCurator, this.mockEnvironmentCurator); X509Certificate result = certServiceAdapter.createX509Certificate(consumer, owner, pool, entitlement, product, new HashSet<>(), getProductModels(product, new HashSet<>(), "prefix", entitlement), new BigInteger("1234"), keyPair, true); Date oneHourAfterSevenDays = new Date(now.getTime() + 169 * 60 * 60 * 1000); Date oneHourBeforeSevenDays = new Date(now.getTime() + 167 * 60 * 60 * 1000); result.checkValidity(oneHourBeforeSevenDays); assertThrows(CertificateExpiredException.class, () -> result.checkValidity(oneHourAfterSevenDays)); }
@Test public void predateEntitlementCerts() throws Exception { consumer.setCreated(new Date()); certServiceAdapter = new DefaultEntitlementCertServiceAdapter( realPKI, extensionUtil, v3extensionUtil, mock(EntitlementCertificateCurator.class), keyPairCurator, serialCurator, ownerCurator, entCurator, I18nFactory.getI18n(getClass(), Locale.US, I18nFactory.FALLBACK), config, productCurator, this.mockConsumerTypeCurator, this.mockEnvironmentCurator); Calendar cal = Calendar.getInstance(); cal.add(Calendar.HOUR, -2); pool.setStartDate(cal.getTime()); X509Certificate result = certServiceAdapter.createX509Certificate(consumer, owner, pool, entitlement, product, new HashSet<>(), getProductModels(product, new HashSet<>(), "prefix", entitlement), new BigInteger("1234"), keyPair, true); assertEquals(result.getNotBefore().getTime(), pool.getStartDate().getTime() / 1000 * 1000); cal.add(Calendar.MINUTE, 90); pool.setStartDate(cal.getTime()); result = certServiceAdapter.createX509Certificate(consumer, owner, pool, entitlement, product, new HashSet<>(), getProductModels(product, new HashSet<>(), "prefix", entitlement), new BigInteger("1234"), keyPair, true); assertTrue(result.getNotBefore().getTime() < pool.getStartDate().getTime() / 1000 * 1000); }
@Test public void tooManyContentSetsAcrossMultipleProducts() { Set<Product> providedProducts = new HashSet<>(); Product pp1 = new Product("12346", "Provided 1", "variant", "version", ARCH_LABEL, "SVC"); for (Content content : generateContent(100, "PP1")) { pp1.addContent(content, false); } providedProducts.add(pp1); Product pp2 = new Product("12347", "Provided 2", "variant", "version", ARCH_LABEL, "SVC"); for (Content content : generateContent(100, "PP2")) { pp2.addContent(content, false); } providedProducts.add(pp2); List<org.candlepin.model.dto.Product> productModels = getProductModels(product, providedProducts, "prefix", entitlement); assertThrows(CertificateSizeException.class, () -> certServiceAdapter.createX509Certificate(consumer, owner, pool, entitlement, product, providedProducts, productModels, new BigInteger("1234"), keyPair, true) ); }
@Test public void tooManyContentSets() { Set<Content> productContent = generateContent(X509ExtensionUtil.V1_CONTENT_LIMIT + 1, "TestContent"); product.setProductContent(null); for (Content content : productContent) { product.addContent(content, false); } assertThrows(CertificateSizeException.class, () -> certServiceAdapter.createX509Certificate(consumer, owner, pool, entitlement, product, new HashSet<>(), getProductModels(product, new HashSet<>(), "prefix", entitlement), new BigInteger("1234"), keyPair, true) ); }
@Test public void testPrefixesShouldBeUsed() throws Exception { owner.setContentPrefix("/somePrefix/"); certServiceAdapter.createX509Certificate(consumer, owner, pool, entitlement, product, new HashSet<>(), getProductModels(product, new HashSet<>(), "prefix", entitlement), new BigInteger("1234"), keyPair, true); verify(mockedPKI).createX509Certificate(any(String.class), argThat(new ListContainsContentUrl("/somePrefix" + CONTENT_URL, CONTENT_ID)), any(Set.class), any(Date.class), any(Date.class), any(KeyPair.class), any(BigInteger.class), nullable(String.class)); }
@Test @SuppressWarnings("checkstyle:indentation") public void testPrefixExpandsEnvIfConsumerHasOne() throws Exception { owner.setContentPrefix("/someorg/$env/"); Environment e = this.mockEnvironment(new Environment("env1", "Awesome Environment #1", owner)); e.getEnvironmentContent().add(new EnvironmentContent(e, content, true)); this.consumer.setEnvironment(e); certServiceAdapter.createX509Certificate(consumer, owner, pool, entitlement, product, new HashSet<>(), getProductModels(product, new HashSet<>(), "prefix", entitlement), new BigInteger("1234"), keyPair, true); verify(mockedPKI).createX509Certificate(any(String.class), argThat( new ListContainsContentUrl("/someorg/Awesome+Environment+%231" + CONTENT_URL, CONTENT_ID)), any(Set.class), any(Date.class), any(Date.class), any(KeyPair.class), any(BigInteger.class), nullable(String.class)); }
@Test @SuppressWarnings("checkstyle:indentation") public void testURLEncoding() throws Exception { owner.setContentPrefix("/some org/$env/"); Environment e = this.mockEnvironment(new Environment("env1", "Awesome Environment #1", owner)); e.getEnvironmentContent().add(new EnvironmentContent(e, content, true)); this.consumer.setEnvironment(e); certServiceAdapter.createX509Certificate(consumer, owner, pool, entitlement, product, new HashSet<>(), getProductModels(product, new HashSet<>(), "prefix", entitlement), new BigInteger("1234"), keyPair, true); verify(mockedPKI).createX509Certificate(any(String.class), argThat( new ListContainsContentUrl("/some+org/Awesome+Environment+%231" + CONTENT_URL, CONTENT_ID)), any(Set.class), any(Date.class), any(Date.class), any(KeyPair.class), any(BigInteger.class), nullable(String.class)); }
@Test public void testPrefixIgnoresEnvIfConsumerHasNone() throws Exception { owner.setContentPrefix("/someorg/$env/"); certServiceAdapter.createX509Certificate(consumer, owner, pool, entitlement, product, new HashSet<>(), getProductModels(product, new HashSet<>(), "prefix", entitlement), new BigInteger("1234"), keyPair, true); verify(mockedPKI).createX509Certificate(any(String.class), argThat(new ListContainsContentUrl("/someorg/$env" + CONTENT_URL, CONTENT_ID)), any(Set.class), any(Date.class), any(Date.class), any(KeyPair.class), any(BigInteger.class), nullable(String.class)); }
@Test public void testPrefixesAreNotUsedForUeberCertificate() throws Exception { owner.setContentPrefix("/somePrefix/"); certServiceAdapter.createX509Certificate(consumer, owner, pool, entitlement, product, new HashSet<>(), getProductModels(product, new HashSet<>(), "prefix", entitlement), new BigInteger("1234"), keyPair, false); verify(mockedPKI).createX509Certificate(any(String.class), argThat(new ListContainsContentUrl(CONTENT_URL, CONTENT_ID)), any(Set.class), any(Date.class), any(Date.class), any(KeyPair.class), any(BigInteger.class), nullable(String.class)); }
@Test public void testBlankPrefixesShouldNotEffectAnything() throws Exception { owner.setContentPrefix(""); certServiceAdapter.createX509Certificate(consumer, owner, pool, entitlement, product, new HashSet<>(), getProductModels(product, new HashSet<>(), "prefix", entitlement), new BigInteger("1234"), keyPair, true); verify(mockedPKI).createX509Certificate(any(String.class), argThat(new ListContainsContentUrl(CONTENT_URL, CONTENT_ID)), any(Set.class), any(Date.class), any(Date.class), any(KeyPair.class), any(BigInteger.class), nullable(String.class)); }
@Test public void testNullPrefixesShouldNotEffectAnything() throws Exception { owner.setContentPrefix(null); certServiceAdapter.createX509Certificate(consumer, owner, pool, entitlement, product, new HashSet<>(), getProductModels(product, new HashSet<>(), "prefix", entitlement), new BigInteger("1234"), keyPair, true); verify(mockedPKI).createX509Certificate(any(String.class), argThat(new ListContainsContentUrl(CONTENT_URL, CONTENT_ID)), any(Set.class), any(Date.class), any(Date.class), any(KeyPair.class), any(BigInteger.class), nullable(String.class)); }
@Test public void contentExtentionsShouldBeAddedDuringCertificateGeneration() throws Exception { certServiceAdapter.createX509Certificate(consumer, owner, pool, entitlement, product, new HashSet<>(), getProductModels(product, new HashSet<>(), "prefix", entitlement), new BigInteger("1234"), keyPair, true); verify(mockedPKI).createX509Certificate(any(String.class), argThat(new ListContainsContentExtensions()), any(Set.class), any(Date.class), any(Date.class), any(KeyPair.class), any(BigInteger.class), nullable(String.class)); }
@Test public void entitlementQuantityShouldBeAddedDuringCertificateGeneration() throws Exception { certServiceAdapter.createX509Certificate(consumer, owner, pool, entitlement, product, new HashSet<>(), getProductModels(product, new HashSet<>(), "prefix", entitlement), new BigInteger("1234"), keyPair, true); verify(mockedPKI).createX509Certificate(any(String.class), argThat(new ListContainsEntitlementExtensions()), any(Set.class), any(Date.class), any(Date.class), any(KeyPair.class), any(BigInteger.class), nullable(String.class)); }
@Test public void managementDisabledByDefault() throws Exception { certServiceAdapter.createX509Certificate(consumer, owner, pool, entitlement, product, new HashSet<>(), getProductModels(product, new HashSet<>(), "prefix", entitlement), new BigInteger("1234"), keyPair, true); verify(mockedPKI).createX509Certificate(any(String.class), argThat(new ListContainsProvidesManagement("0")), any(Set.class), any(Date.class), any(Date.class), any(KeyPair.class), any(BigInteger.class), nullable(String.class)); }
@Test public void managementEnabledByAttribute() throws Exception { pool.getProduct().setAttribute(Product.Attributes.MANAGEMENT_ENABLED, "1"); certServiceAdapter.createX509Certificate(consumer, owner, pool, entitlement, product, new HashSet<>(), getProductModels(product, new HashSet<>(), "prefix", entitlement), new BigInteger("1234"), keyPair, true); verify(mockedPKI).createX509Certificate(any(String.class), argThat(new ListContainsProvidesManagement("1")), any(Set.class), any(Date.class), any(Date.class), any(KeyPair.class), any(BigInteger.class), nullable(String.class)); }
@Test public void stackingIdByAttribute() throws Exception { pool.getProduct().setAttribute(Product.Attributes.STACKING_ID, "3456"); certServiceAdapter.createX509Certificate(consumer, owner, pool, entitlement, product, new HashSet<>(), getProductModels(product, new HashSet<>(), "prefix", entitlement), new BigInteger("1234"), keyPair, true); verify(mockedPKI).createX509Certificate(any(String.class), argThat(new ListContainsStackingId("3456")), any(Set.class), any(Date.class), any(Date.class), any(KeyPair.class), any(BigInteger.class), nullable(String.class)); }
@Test public void virtOnlyByAttribute() throws Exception { entitlement.getPool().setAttribute(Product.Attributes.VIRT_ONLY, "true"); certServiceAdapter.createX509Certificate(consumer, owner, pool, entitlement, product, new HashSet<>(), getProductModels(product, new HashSet<>(), "prefix", entitlement), new BigInteger("1234"), keyPair, true); verify(mockedPKI).createX509Certificate(any(String.class), argThat(new ListContainsVirtOnlyKey("1")), any(Set.class), any(Date.class), any(Date.class), any(KeyPair.class), any(BigInteger.class), nullable(String.class)); }
@Test public void orderNumberAttribute() throws Exception { pool.setOrderNumber("this_order"); certServiceAdapter.createX509Certificate(consumer, owner, pool, entitlement, product, new HashSet<>(), getProductModels(product, new HashSet<>(), "prefix", entitlement), new BigInteger("1234"), keyPair, true); verify(mockedPKI).createX509Certificate(any(String.class), argThat(new ListContainsOrderNumberKey("this_order")), any(Set.class), any(Date.class), any(Date.class), any(KeyPair.class), any(BigInteger.class), nullable(String.class)); }
@Test public void supportValuesPresentOnCertIfAttributePresent() throws Exception { pool.getProduct().setAttribute(Product.Attributes.SUPPORT_LEVEL, "Premium"); pool.getProduct().setAttribute(Product.Attributes.SUPPORT_TYPE, "Level 3"); certServiceAdapter.createX509Certificate(consumer, owner, pool, entitlement, product, new HashSet<>(), getProductModels(product, new HashSet<>(), "prefix", entitlement), new BigInteger("1234"), keyPair, true); verify(mockedPKI).createX509Certificate(any(String.class), argThat(new ListContainsSupportLevel("Premium")), any(Set.class), any(Date.class), any(Date.class), any(KeyPair.class), any(BigInteger.class), nullable(String.class)); verify(mockedPKI).createX509Certificate(any(String.class), argThat(new ListContainsSupportType("Level 3")), any(Set.class), any(Date.class), any(Date.class), any(KeyPair.class), any(BigInteger.class), nullable(String.class)); }
@Test public void ensureV3CertificateCreationOkWhenConsumerSupportsV3Dot1Certs() throws Exception { consumer.setFact("system.certificate_version", X509V3ExtensionUtil.CERT_VERSION); subscription.getProduct().setAttribute(Product.Attributes.RAM, "4"); subscription.getProduct().setAttribute(Product.Attributes.ROLES, "role1, role2 "); DefaultEntitlementCertServiceAdapter entAdapter = this.initCertServiceAdapter(); entAdapter.createX509Certificate(consumer, owner, pool, entitlement, product, new HashSet<>(), getProductModels(product, new HashSet<>(), "prefix", entitlement), new BigInteger("1234"), keyPair, true); }
@Test public void supportValuesAbsentOnCertIfNoSupportAttributes() throws Exception { certServiceAdapter.createX509Certificate(consumer, owner, pool, entitlement, product, new HashSet<>(), getProductModels(product, new HashSet<>(), "prefix", entitlement), new BigInteger("1234"), keyPair, true); verify(mockedPKI).createX509Certificate(any(String.class), argThat(new ListDoesNotContainSupportLevel()), any(Set.class), any(Date.class), any(Date.class), any(KeyPair.class), any(BigInteger.class), nullable(String.class)); verify(mockedPKI).createX509Certificate(any(String.class), argThat(new ListDoesNotContainSupportType()), any(Set.class), any(Date.class), any(Date.class), any(KeyPair.class), any(BigInteger.class), nullable(String.class)); }
@Test public void ensureV3CertIsCreatedWhenEnableCertV3ConfigIsTrue() throws Exception { consumer.setFact("system.certificate_version", "3.0"); DefaultEntitlementCertServiceAdapter entAdapter = this.initCertServiceAdapter(); entAdapter.createX509Certificate(consumer, owner, pool, entitlement, product, new HashSet<>(), getProductModels(product, new HashSet<>(), "prefix", entitlement), new BigInteger("1234"), keyPair, true); verify(mockV3extensionUtil).getExtensions(); verify(mockV3extensionUtil).getByteExtensions(eq(product), any(List.class), nullable(String.class), any(Map.class)); verifyZeroInteractions(mockExtensionUtil); }
@Test public void ensureV3CertIsCreatedWhenV3CapabilityPresent() throws Exception { ConsumerType ctype = new ConsumerType(ConsumerType.ConsumerTypeEnum.CANDLEPIN); ctype.setId("test-id"); consumer.setType(ctype); when(mockConsumerTypeCurator.get(eq(ctype.getId()))).thenReturn(ctype); when(mockConsumerTypeCurator.getConsumerType(consumer)).thenReturn(ctype); Set<ConsumerCapability> set = new HashSet<>(); set.add(new ConsumerCapability(consumer, "cert_v3")); consumer.setCapabilities(set); DefaultEntitlementCertServiceAdapter entAdapter = this.initCertServiceAdapter(); entAdapter.createX509Certificate(consumer, owner, pool, entitlement, product, new HashSet<>(), getProductModels(product, new HashSet<>(), "prefix", entitlement), new BigInteger("1234"), keyPair, true); verify(mockV3extensionUtil).getExtensions(); verify(mockV3extensionUtil).getByteExtensions(eq(product), any(List.class), nullable(String.class), any(Map.class)); verifyZeroInteractions(mockExtensionUtil); }
@Test public void ensureV1CertIsCreatedWhenV3factNotPresent() throws Exception { ConsumerType ctype = new ConsumerType(ConsumerType.ConsumerTypeEnum.SYSTEM); ctype.setId("test-id"); consumer.setType(ctype); when(mockConsumerTypeCurator.get(eq(ctype.getId()))).thenReturn(ctype); when(mockConsumerTypeCurator.getConsumerType(consumer)).thenReturn(ctype); DefaultEntitlementCertServiceAdapter entAdapter = this.initCertServiceAdapter(); entAdapter.createX509Certificate(consumer, owner, pool, entitlement, product, new HashSet<>(), getProductModels(product, new HashSet<>(), "prefix", entitlement), new BigInteger("1234"), keyPair, true); verify(mockExtensionUtil).consumerExtensions(eq(consumer)); verifyZeroInteractions(mockV3extensionUtil); }
@Test public void ensureV3CertIsCreatedWhenHypervisor() throws Exception { ConsumerType ctype = new ConsumerType(ConsumerType.ConsumerTypeEnum.HYPERVISOR); ctype.setId("test-id"); consumer.setType(ctype); when(mockConsumerTypeCurator.get(eq(ctype.getId()))).thenReturn(ctype); when(mockConsumerTypeCurator.getConsumerType(consumer)).thenReturn(ctype); DefaultEntitlementCertServiceAdapter entAdapter = this.initCertServiceAdapter(); entAdapter.createX509Certificate(consumer, owner, pool, entitlement, product, new HashSet<>(), getProductModels(product, new HashSet<>(), "prefix", entitlement), new BigInteger("1234"), keyPair, true); verify(mockV3extensionUtil).getExtensions(); verify(mockV3extensionUtil).getByteExtensions(eq(product), any(List.class), nullable(String.class), any(Map.class)); verifyZeroInteractions(mockExtensionUtil); }