X509CertRequest { public boolean validatePublicKeys(final String publicKey) { if (publicKey == null) { LOGGER.error("comparePublicKeys: No public key provided for validation"); return false; } if (!extractCsrPublicKey()) { LOGGER.error("comparePublicKeys: Unable to extract CSR public key"); return false; } if (!compareCsrPublicKey(publicKey)) { LOGGER.error("comparePublicKeys: Public key mismatch"); return false; } return true; } X509CertRequest(String csr); PKCS10CertificationRequest getCertReq(); void setCertReq(PKCS10CertificationRequest certReq); boolean validateDnsNames(final String domainName, final String serviceName, final String provider,
            final DataCache athenzSysDomainCache, final String serviceDnsSuffix, final String instanceHostname,
            final List<String> instanceHostCnames, HostnameResolver hostnameResolver); boolean validateDnsNames(X509Certificate cert); boolean validateInstanceId(final String reqInstanceId, X509Certificate cert); boolean validateCommonName(String reqCommonName); boolean validateSubjectOField(Set<String> validValues); boolean validateSubjectOUField(final String provider, final String certSubjectOU,
            Set<String> validValues); boolean validatePublicKeys(final String publicKey); boolean validatePublicKeys(X509Certificate cert); boolean validateIPAddress(final String ip); void setNormCsrPublicKey(String normCsrPublicKey); String getCommonName(); String getInstanceId(); String getUriHostname(); List<String> getDnsNames(); List<String> getProviderDnsNames(); List<String> getUris(); List<String> getIpAddresses();  }
@Test public void testValidatePublicKeysCert() throws IOException { Path path = Paths.get("src/test/resources/valid_provider_refresh.csr"); String csr = new String(Files.readAllBytes(path)); X509CertRequest certReq = new X509CertRequest(csr); assertNotNull(certReq); path = Paths.get("src/test/resources/valid_provider_refresh.pem"); String pem = new String(Files.readAllBytes(path)); X509Certificate cert = Crypto.loadX509Certificate(pem); assertTrue(certReq.validatePublicKeys(cert)); }
@Test public void testValidatePublicKeysCertFailure() throws IOException { Path path = Paths.get("src/test/resources/valid_provider_refresh.csr"); String csr = new String(Files.readAllBytes(path)); X509CertRequest certReq = new X509CertRequest(csr); assertNotNull(certReq); X509Certificate cert = Mockito.mock(X509Certificate.class); Mockito.when(cert.getPublicKey()).thenReturn(null); assertFalse(certReq.validatePublicKeys(cert)); }
@Test public void testValidatePublicKeysCertMismatch() throws IOException { Path path = Paths.get("src/test/resources/athenz.mismatch.dns.csr"); String csr = new String(Files.readAllBytes(path)); X509CertRequest certReq = new X509CertRequest(csr); assertNotNull(certReq); path = Paths.get("src/test/resources/athenz.instanceid.pem"); String pem = new String(Files.readAllBytes(path)); X509Certificate cert = Crypto.loadX509Certificate(pem); assertFalse(certReq.validatePublicKeys(cert)); }
@Test public void testValidatePublicKeysNull() throws IOException { Path path = Paths.get("src/test/resources/athenz.instanceid.csr"); String csr = new String(Files.readAllBytes(path)); X509CertRequest certReq = new X509CertRequest(csr); assertNotNull(certReq); assertFalse(certReq.validatePublicKeys((String) null)); }
@Test public void testValidatePublicKeysString() throws IOException { Path path = Paths.get("src/test/resources/valid.csr"); String csr = new String(Files.readAllBytes(path)); X509CertRequest certReq = new X509CertRequest(csr); final String ztsPublicKey = "-----BEGIN PUBLIC KEY-----\n" + "MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBAKrvfvBgXWqWAorw5hYJu3dpOJe0gp3n\n" + "TgiiPGT7+jzm6BRcssOBTPFIMkePT2a8Tq+FYSmFnHfbQjwmYw2uMK8CAwEAAQ==\n" + "-----END PUBLIC KEY-----"; assertTrue(certReq.validatePublicKeys(ztsPublicKey)); }
@Test public void testValidateCertReqPublicKey() throws IOException { Path path = Paths.get("src/test/resources/valid.csr"); String csr = new String(Files.readAllBytes(path)); X509CertRequest certReq = new X509CertRequest(csr); assertNotNull(certReq); final String ztsPublicKey = "-----BEGIN PUBLIC KEY-----\n" + "MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBAKrvfvBgXWqWAorw5hYJu3dpOJe0gp3n\n" + "TgiiPGT7+jzm6BRcssOBTPFIMkePT2a8Tq+FYSmFnHfbQjwmYw2uMK8CAwEAAQ==\n" + "-----END PUBLIC KEY-----"; assertTrue(certReq.validatePublicKeys(ztsPublicKey)); }
@Test public void testValidateCertReqPublicKeyMismatch() throws IOException { Path path = Paths.get("src/test/resources/valid.csr"); String csr = new String(Files.readAllBytes(path)); X509CertRequest certReq = new X509CertRequest(csr); assertNotNull(certReq); final String ztsPublicKey = "-----BEGIN PUBLIC KEY-----\n" + "MFwwDQYJKoZIhvcNasdfsdfsadfwSAJBAKrvfvBgXWqWAorw5hYJu3dpOJe0gp3n\n" + "TgiiPGT7+jzm6BRcssOBTPFIMkePT2a8Tq+FYSmFnHfbQjwmYw2uMK8CAwEAAQ==\n" + "-----END PUBLIC KEY-----"; assertFalse(certReq.validatePublicKeys(ztsPublicKey)); }
@Test public void testValidateCertReqPublicKeyWhitespace() throws IOException { Path path = Paths.get("src/test/resources/valid.csr"); String csr = new String(Files.readAllBytes(path)); X509CertRequest certReq = new X509CertRequest(csr); assertNotNull(certReq); final String ztsPublicKey1 = " -----BEGIN PUBLIC KEY-----\n" + "MFwwDQYJKoZIhvcNA QEBBQADSwAwSAJBAKrvfvBgXWqW Aorw5hYJu3dpOJe0gp3n\n\r\r\n" + "TgiiPGT7+jzm6BRcssOBTPFIMkePT2a8Tq+FYSmFnHfbQjwmYw2uMK8CAwEAAQ==\n\r" + "-----END PUBLIC KEY----- \n"; final String ztsPublicKey2 = "-----BEGIN PUBLIC KEY-----" + "MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBAKrvfvBgXWqWAorw5hYJu3dpOJe0gp3n" + "TgiiPGT7+jzm6BRcssOBTPFIMkePT2a8Tq+FYSmFnHfbQjwmYw2uMK8CAwEAAQ==" + "-----END PUBLIC KEY-----"; assertTrue(certReq.validatePublicKeys(ztsPublicKey1)); assertTrue(certReq.validatePublicKeys(ztsPublicKey2)); }