PolicyUpdater { static boolean validateSignedPolicies(ZTSClient zts, PolicyUpdaterConfiguration configuration, DomainSignedPolicyData domainSignedPolicyData, String domain) { if (domainSignedPolicyData == null || domain == null) { throw new IllegalArgumentException("null parameters are not valid arguments"); } LOG.info("Checking expiration time for:" + domain); Timestamp expires = domainSignedPolicyData.getSignedPolicyData().getExpires(); if (System.currentTimeMillis() > expires.millis()) { LOG.error("Signed policy for domain:" + domain + " was expired."); return false; } LOG.info("Verifying ZTS signature for: " + domain); SignedPolicyData signedPolicyData = domainSignedPolicyData.getSignedPolicyData(); LOG.debug("Policies retrieved from the ZTS server: " + signedPolicyData); String signature = domainSignedPolicyData.getSignature(); String keyId = domainSignedPolicyData.getKeyId(); LOG.debug("validateSignedPolicies: domain=" + domain + " zts key id=" + keyId + " Digital ZTS signature=" + signature); PublicKey ztsPublicKey = configuration.getZtsPublicKey(zts, keyId); if (ztsPublicKey == null) { LOG.error("validateSignedPolicies: Missing ZTS Public key for id: " + keyId); return false; } boolean verified = Crypto.verify(SignUtils.asCanonicalString(signedPolicyData), ztsPublicKey, signature); if (verified == false) { LOG.error("Signed policy for domain:" + domain + " failed ZTS signature verification."); LOG.error("ZTS Signature: " + signature + ". Policies data returned from ZTS: " + signedPolicyData); return false; } LOG.info("Verifying ZMS signature for: " + domain); PolicyData policyData = signedPolicyData.getPolicyData(); signature = signedPolicyData.getZmsSignature(); LOG.debug("Digital ZMS signature: " + signature); keyId = signedPolicyData.getZmsKeyId(); LOG.debug("Digital ZMS signature key Id: " + keyId); PublicKey zmsPublicKey = configuration.getZmsPublicKey(zts, keyId); if (zmsPublicKey == null) { LOG.error("Missing ZMS Public key with id: " + keyId); return false; } verified = Crypto.verify(SignUtils.asCanonicalString(policyData), zmsPublicKey, signature); if (verified == false) { LOG.error("Signed policy for domain:" + domain + " failed ZMS signature verification."); LOG.error("ZMS Signature: " + signature + ". Policies data returned from ZTS: " + policyData); } return verified; }  static void main(String[] args); static void postDomainMetrics(ZTSClient zts); static final String ZPE_METRIC_FILE_PATH; static final String ZPE_PROP_METRIC_FILE_PATH; }
@Test public void TestVerifySignature() throws Exception { PolicyUpdaterConfiguration configuration = new PolicyUpdaterConfiguration(); configuration.init(pathToAthenzConfigFile, pathToZPUConfigFile); SignPoliciesUtility.signPolicies("./src/test/resources/unit_test_zts_private_k0.pem", "./src/test/resources/unit_test_zms_private_k0.pem", "./src/test/resources/sys.auth.pol", "./src/test/resources/sys.auth.new.pol"); Path path = Paths.get("./src/test/resources/sys.auth.new.pol"); DomainSignedPolicyData domainPolicySignedData = JSON.fromBytes(Files.readAllBytes(path), DomainSignedPolicyData.class); Assert.assertTrue(PolicyUpdater.validateSignedPolicies(null, configuration, domainPolicySignedData, "sys.auth.new")); PolicyUpdaterConfiguration confMock = Mockito.mock(PolicyUpdaterConfiguration.class); Mockito.when(confMock.getZtsPublicKey(Mockito.any(ZTSClient.class), Mockito.<String>any())).thenReturn(null); Assert.assertFalse(PolicyUpdater.validateSignedPolicies(null, confMock, domainPolicySignedData, "sys.auth.new")); confMock = Mockito.mock(PolicyUpdaterConfiguration.class); PublicKey pKey = Crypto.loadPublicKey(Crypto.ybase64DecodeString("LS0tLS1CRUdJTiBQVUJMSUMgS0VZLS0tLS0KTUZ3d0" + "RRWUpLb1pJaHZjTkFRRUJCUUFEU3dBd1NBSkJBTHpmU09UUUpmRW0xZW00TD" + "Nza3lOVlEvYngwTU9UcQphK1J3T0gzWmNNS3lvR3hPSm85QXllUmE2RlhNbX" + "ZKSkdZczVQMzRZc3pGcG5qMnVBYmkyNG5FQ0F3RUFBUT09Ci0tLS0tRU5EIF" + "BVQkxJQyBLRVktLS0tLQo-")); Mockito.when(confMock.getZtsPublicKey(Mockito.any(ZTSClient.class), Mockito.<String>any())).thenReturn(pKey); Mockito.when(confMock.getZmsPublicKey(Mockito.any(ZTSClient.class), Mockito.<String>any())).thenReturn(null); Assert.assertFalse(PolicyUpdater.validateSignedPolicies(null, confMock, domainPolicySignedData, "sys.auth.new")); path = Paths.get("./src/test/resources/sys.auth.pol.tampered.zts"); domainPolicySignedData = JSON.fromBytes(Files.readAllBytes(path), DomainSignedPolicyData.class); Assert.assertFalse(PolicyUpdater.validateSignedPolicies(null, configuration, domainPolicySignedData, "sys.auth.new")); path = Paths.get("./src/test/resources/sys.auth.pol.tampered.zms"); domainPolicySignedData = JSON.fromBytes(Files.readAllBytes(path), DomainSignedPolicyData.class); Assert.assertFalse(PolicyUpdater.validateSignedPolicies(null, configuration, domainPolicySignedData, "sys.auth.new")); boolean exceptionCaught = false; try { PolicyUpdater.validateSignedPolicies(null, configuration, null, "sys.auth.new"); } catch (IllegalArgumentException ex) { exceptionCaught = true; } Assert.assertTrue(exceptionCaught); exceptionCaught = false; try { PolicyUpdater.validateSignedPolicies(null, configuration, domainPolicySignedData, null); } catch (IllegalArgumentException ex) { exceptionCaught = true; } Assert.assertTrue(exceptionCaught); }
@Test public void TestValidateExpiredPolicies() throws Exception { PolicyUpdaterConfiguration configuration = new PolicyUpdaterConfiguration(); configuration.init(pathToAthenzConfigFile, pathToZPUConfigFile); ZTSMock zts = new ZTSMock(); zts.setPublicKeyId("0"); DomainSignedPolicyData domainPolicySignedData = zts.getDomainSignedPolicyData("expiredDomain", null, null); Assert.assertFalse(PolicyUpdater.validateSignedPolicies(null, configuration, domainPolicySignedData, "expiredDomain")); }