X509CertRequest { public boolean validateDnsNames(final String domainName, final String serviceName, final String provider, final DataCache athenzSysDomainCache, final String serviceDnsSuffix, final String instanceHostname, final List<String> instanceHostCnames, HostnameResolver hostnameResolver) { if (dnsNames.isEmpty()) { return true; } if (!validateInstanceHostname(provider, athenzSysDomainCache, instanceHostname, hostnameResolver)) { LOGGER.error("Unable to validate Instance hostname: {}", instanceHostname); return false; } if (!validateInstanceCnames(provider, athenzSysDomainCache, domainName + "." + serviceName, instanceHostname, instanceHostCnames, hostnameResolver)) { return false; } providerDnsNames.clear(); final String wildCardPrefix = "*." + serviceName + "." + domainName.replace('.', '-') + "."; final String serviceDnsSuffixCheck = (serviceDnsSuffix != null) ? "." + serviceDnsSuffix : null; final List<String> providerDnsSuffixList = athenzSysDomainCache.getProviderDnsSuffixList(provider); for (String dnsName : dnsNames) { if (!dnsSuffixCheck(dnsName, providerDnsSuffixList, serviceDnsSuffixCheck, wildCardPrefix, instanceHostname, instanceHostCnames)) { return false; } } return true; } X509CertRequest(String csr); PKCS10CertificationRequest getCertReq(); void setCertReq(PKCS10CertificationRequest certReq); boolean validateDnsNames(final String domainName, final String serviceName, final String provider,
            final DataCache athenzSysDomainCache, final String serviceDnsSuffix, final String instanceHostname,
            final List<String> instanceHostCnames, HostnameResolver hostnameResolver); boolean validateDnsNames(X509Certificate cert); boolean validateInstanceId(final String reqInstanceId, X509Certificate cert); boolean validateCommonName(String reqCommonName); boolean validateSubjectOField(Set<String> validValues); boolean validateSubjectOUField(final String provider, final String certSubjectOU,
            Set<String> validValues); boolean validatePublicKeys(final String publicKey); boolean validatePublicKeys(X509Certificate cert); boolean validateIPAddress(final String ip); void setNormCsrPublicKey(String normCsrPublicKey); String getCommonName(); String getInstanceId(); String getUriHostname(); List<String> getDnsNames(); List<String> getProviderDnsNames(); List<String> getUris(); List<String> getIpAddresses();  }
@Test public void testValidateDnsNamesWithCert() throws IOException { Path path = Paths.get("src/test/resources/athenz.instanceid.csr"); String csr = new String(Files.readAllBytes(path)); X509CertRequest certReq = new X509CertRequest(csr); assertNotNull(certReq); path = Paths.get("src/test/resources/athenz.instanceid.pem"); String pem = new String(Files.readAllBytes(path)); X509Certificate cert = Crypto.loadX509Certificate(pem); assertTrue(certReq.validateDnsNames(cert)); }
@Test public void testValidateDnsNamesWithValues() throws IOException { Path path = Paths.get("src/test/resources/athenz.instanceid.csr"); String csr = new String(Files.readAllBytes(path)); X509CertRequest certReq = new X509CertRequest(csr); assertNotNull(certReq); List<String> providerDnsSuffixList = new ArrayList<>(); DataCache athenzSysDomainCache = Mockito.mock(DataCache.class); Mockito.when(athenzSysDomainCache.getProviderDnsSuffixList("provider")) .thenReturn(null) .thenReturn(providerDnsSuffixList); List<String> providerHostnameAllowedSuffixList = Collections.singletonList("athenz.cloud"); Mockito.when(athenzSysDomainCache.getProviderHostnameAllowedSuffixList("provider")) .thenReturn(providerHostnameAllowedSuffixList); Mockito.when(athenzSysDomainCache.getProviderHostnameDeniedSuffixList("provider")) .thenReturn(null); assertTrue(certReq.validateDnsNames("athenz", "production", "provider", athenzSysDomainCache, "ostk.athenz.cloud", null, null, null)); assertTrue(certReq.validateDnsNames("athenz", "production", "provider", athenzSysDomainCache, "ostk.athenz.cloud", null, null, null)); providerDnsSuffixList.add("ostk.myathenz.cloud"); assertTrue(certReq.validateDnsNames("athenz", "production", "provider", athenzSysDomainCache, "ostk.athenz.cloud", null, null, null)); assertFalse(certReq.validateDnsNames("athenz", "production", "provider", athenzSysDomainCache, "ostk.athenz2.cloud", null, null, null)); providerDnsSuffixList.add("ostk.athenz.cloud"); assertTrue(certReq.validateDnsNames("athenz", "production", "provider", athenzSysDomainCache, "ostk.athenz2.cloud", null, null, null)); assertTrue(certReq.validateDnsNames("athenz", "production", "provider", athenzSysDomainCache, "ostk.athenz.cloud", null, null, null)); assertTrue(certReq.validateDnsNames("athenz", "production", "provider", athenzSysDomainCache, "", null, null, null)); assertTrue(certReq.validateDnsNames("athenz", "production", "provider", athenzSysDomainCache, null, null, null, null)); }
@Test public void testValidateDnsNamesWithCnameValues() throws IOException { Path path = Paths.get("src/test/resources/athenz.instanceid.cname.csr"); String csr = new String(Files.readAllBytes(path)); String service = "athenz.production"; X509CertRequest certReq = new X509CertRequest(csr); assertNotNull(certReq); DataCache athenzSysDomainCache = Mockito.mock(DataCache.class); Mockito.when(athenzSysDomainCache.getProviderDnsSuffixList("provider")) .thenReturn(Collections.singletonList("ostk.athenz.cloud")); List<String> allowedSuffixList = new ArrayList<>(); allowedSuffixList.add("athenz.info"); allowedSuffixList.add("athenz.cloud"); Mockito.when(athenzSysDomainCache.getProviderHostnameAllowedSuffixList("provider")) .thenReturn(allowedSuffixList); Mockito.when(athenzSysDomainCache.getProviderHostnameDeniedSuffixList("provider")) .thenReturn(null); List<String> cnameList = new ArrayList<>(); cnameList.add("cname1.athenz.info"); cnameList.add("cname2.athenz.info"); HostnameResolver resolver = Mockito.mock(HostnameResolver.class); Mockito.when(resolver.isValidHostCnameList(service, "host1.athenz.cloud", cnameList, CertType.X509)) .thenReturn(false) .thenReturn(true); Mockito.when(resolver.isValidHostname("host1.athenz.cloud")).thenReturn(true); assertFalse(certReq.validateDnsNames("athenz", "production", "provider", athenzSysDomainCache, "ostk.athenz.cloud", "host1.athenz.cloud", cnameList, resolver)); assertTrue(certReq.validateDnsNames("athenz", "production", "provider", athenzSysDomainCache, "ostk.athenz.cloud", "host1.athenz.cloud", cnameList, resolver)); }
@Test public void testValidateDnsNamesWithCnameValuesWithSameSuffix() throws IOException { Path path = Paths.get("src/test/resources/athenz.instanceid.cname.suffix.csr"); String csr = new String(Files.readAllBytes(path)); String service = "athenz.production"; X509CertRequest certReq = new X509CertRequest(csr); assertNotNull(certReq); DataCache athenzSysDomainCache = Mockito.mock(DataCache.class); Mockito.when(athenzSysDomainCache.getProviderDnsSuffixList("provider")) .thenReturn(Collections.singletonList("ostk.athenz.cloud")); List<String> allowedSuffixList = new ArrayList<>(); allowedSuffixList.add("athenz.info"); allowedSuffixList.add("athenz.cloud"); Mockito.when(athenzSysDomainCache.getProviderHostnameAllowedSuffixList("provider")) .thenReturn(allowedSuffixList); Mockito.when(athenzSysDomainCache.getProviderHostnameDeniedSuffixList("provider")) .thenReturn(null); List<String> cnameList = new ArrayList<>(); cnameList.add("cname1.ostk.athenz.cloud"); cnameList.add("cname2.athenz.info"); HostnameResolver resolver = Mockito.mock(HostnameResolver.class); Mockito.when(resolver.isValidHostCnameList(service, "host1.athenz.cloud", cnameList, CertType.X509)) .thenReturn(true); Mockito.when(resolver.isValidHostname("host1.athenz.cloud")).thenReturn(true); assertTrue(certReq.validateDnsNames("athenz", "production", "provider", athenzSysDomainCache, "ostk.athenz.cloud", "host1.athenz.cloud", cnameList, resolver)); }
@Test public void testValidateDnsNamesWithMultipleDomainValues() throws IOException { Path path = Paths.get("src/test/resources/multi_dns_domain.csr"); String csr = new String(Files.readAllBytes(path)); X509CertRequest certReq = new X509CertRequest(csr); assertNotNull(certReq); List<String> providerDnsSuffixList = new ArrayList<>(); DataCache athenzSysDomainCache = Mockito.mock(DataCache.class); Mockito.when(athenzSysDomainCache.getProviderDnsSuffixList("provider")) .thenReturn(null) .thenReturn(providerDnsSuffixList); assertFalse(certReq.validateDnsNames("athenz", "api", "provider", athenzSysDomainCache, "ostk.athenz.info", null, null, null)); providerDnsSuffixList.add("ostk.athenz.cloud"); assertFalse(certReq.validateDnsNames("athenz", "api", "provider", athenzSysDomainCache, null, null, null, null)); assertTrue(certReq.validateDnsNames("athenz", "api", "provider", athenzSysDomainCache, "ostk.athenz.info", null, null, null)); assertFalse(certReq.validateDnsNames("athenz", "api", "provider", athenzSysDomainCache, "zts.athenz.info", null, null, null)); assertFalse(certReq.validateDnsNames("athenz", "api", "provider", athenzSysDomainCache, "zts.athenz.info", "host1.athenz.info", null, null)); assertFalse(certReq.validateDnsNames("athenz", "api", "provider", athenzSysDomainCache, "zts.athenz.info", "athenz.ostk.athenz.info", null, null)); List<String> providerHostnameAllowedSuffixList = new ArrayList<>(); providerHostnameAllowedSuffixList.add(".ostk.athenz.info"); Mockito.when(athenzSysDomainCache.getProviderHostnameAllowedSuffixList("provider")) .thenReturn(providerHostnameAllowedSuffixList); assertTrue(certReq.validateDnsNames("athenz", "api", "provider", athenzSysDomainCache, "zts.athenz.info", "api.athenz.ostk.athenz.info", null, null)); HostnameResolver resolver = new TestHostnameResolver(); assertFalse(certReq.validateDnsNames("athenz", "api", "provider", athenzSysDomainCache, "zts.athenz.info", "api.athenz.ostk.athenz.info", null, resolver)); ((TestHostnameResolver) resolver).addValidHostname("api1.athenz.ostk.athenz.info"); assertFalse(certReq.validateDnsNames("athenz", "api", "provider", athenzSysDomainCache, "zts.athenz.info", "api.athenz.ostk.athenz.info", null, resolver)); ((TestHostnameResolver) resolver).addValidHostname("api.athenz.ostk.athenz.info"); assertTrue(certReq.validateDnsNames("athenz", "api", "provider", athenzSysDomainCache, "zts.athenz.info", "api.athenz.ostk.athenz.info", null, resolver)); }
@Test public void testValidateUri() throws IOException { Path path = Paths.get("src/test/resources/multi_dns_domain.csr"); String csr = new String(Files.readAllBytes(path)); X509CertRequest certReq = new X509CertRequest(csr); assertNotNull(certReq); List<String> providerDnsSuffixList = new ArrayList<>(); providerDnsSuffixList.add("ostk.athenz.cloud"); DataCache athenzSysDomainCache = Mockito.mock(DataCache.class); Mockito.when(athenzSysDomainCache.getProviderDnsSuffixList("provider")) .thenReturn(providerDnsSuffixList); Mockito.when(athenzSysDomainCache.getProviderHostnameAllowedSuffixList("provider")) .thenReturn(null); Mockito.when(athenzSysDomainCache.getProviderHostnameDeniedSuffixList("provider")) .thenReturn(null); assertFalse(certReq.validateDnsNames("athenz", "api", "provider", athenzSysDomainCache, "zts.athenz.info", "api.athenz.ostk.athenz.info", null, null)); }
@Test public void testValidateDnsNamesHostnameNullLists() throws IOException { Path path = Paths.get("src/test/resources/multi_dns_domain.csr"); String csr = new String(Files.readAllBytes(path)); X509CertRequest certReq = new X509CertRequest(csr); assertNotNull(certReq); List<String> providerDnsSuffixList = new ArrayList<>(); providerDnsSuffixList.add("ostk.athenz.cloud"); DataCache athenzSysDomainCache = Mockito.mock(DataCache.class); Mockito.when(athenzSysDomainCache.getProviderDnsSuffixList("provider")) .thenReturn(providerDnsSuffixList); Mockito.when(athenzSysDomainCache.getProviderHostnameAllowedSuffixList("provider")) .thenReturn(null); Mockito.when(athenzSysDomainCache.getProviderHostnameDeniedSuffixList("provider")) .thenReturn(null); assertFalse(certReq.validateDnsNames("athenz", "api", "provider", athenzSysDomainCache, "zts.athenz.info", "api.athenz.ostk.athenz.info", null, null)); }
@Test public void testValidateDnsNamesHostnameNotAllowed() throws IOException { Path path = Paths.get("src/test/resources/multi_dns_domain.csr"); String csr = new String(Files.readAllBytes(path)); X509CertRequest certReq = new X509CertRequest(csr); assertNotNull(certReq); List<String> providerDnsSuffixList = new ArrayList<>(); providerDnsSuffixList.add("ostk.athenz.cloud"); DataCache athenzSysDomainCache = Mockito.mock(DataCache.class); Mockito.when(athenzSysDomainCache.getProviderDnsSuffixList("provider")) .thenReturn(providerDnsSuffixList); List<String> providerHostnameAllowedSuffixList = new ArrayList<>(); providerHostnameAllowedSuffixList.add(".ostk.athenz.data"); Mockito.when(athenzSysDomainCache.getProviderHostnameAllowedSuffixList("provider")) .thenReturn(providerHostnameAllowedSuffixList); assertFalse(certReq.validateDnsNames("athenz", "api", "provider", athenzSysDomainCache, "zts.athenz.info", "api.athenz.ostk.athenz.info", null, null)); providerHostnameAllowedSuffixList.add(".ostk.athenz.info"); assertTrue(certReq.validateDnsNames("athenz", "api", "provider", athenzSysDomainCache, "zts.athenz.info", "api.athenz.ostk.athenz.info", null, null)); List<String> providerHostnameDeniedSuffixList = new ArrayList<>(); providerHostnameDeniedSuffixList.add(".ostk.athenz.data"); Mockito.when(athenzSysDomainCache.getProviderHostnameDeniedSuffixList("provider")) .thenReturn(providerHostnameDeniedSuffixList); assertTrue(certReq.validateDnsNames("athenz", "api", "provider", athenzSysDomainCache, "zts.athenz.info", "api.athenz.ostk.athenz.info", null, null)); providerHostnameDeniedSuffixList.add(".ostk.athenz.info"); assertFalse(certReq.validateDnsNames("athenz", "api", "provider", athenzSysDomainCache, "zts.athenz.info", "api.athenz.ostk.athenz.info", null, null)); }
@Test public void testValidateDnsNamesNoValues() throws IOException { Path path = Paths.get("src/test/resources/valid_cn_only.csr"); String csr = new String(Files.readAllBytes(path)); X509CertRequest certReq = new X509CertRequest(csr); assertNotNull(certReq); DataCache athenzSysDomainCache = Mockito.mock(DataCache.class); Mockito.when(athenzSysDomainCache.getProviderDnsSuffixList("provider")) .thenReturn(null); assertTrue(certReq.validateDnsNames("domain", "service1", "provider", athenzSysDomainCache, null, null, null, null)); }
@Test public void testValidateDnsNamesMismatchSize() throws IOException { Path path = Paths.get("src/test/resources/athenz.instanceid.csr"); String csr = new String(Files.readAllBytes(path)); X509CertRequest certReq = new X509CertRequest(csr); assertNotNull(certReq); path = Paths.get("src/test/resources/valid_cn_x509.cert"); String pem = new String(Files.readAllBytes(path)); X509Certificate cert = Crypto.loadX509Certificate(pem); assertFalse(certReq.validateDnsNames(cert)); }
@Test public void testValidateDnsNamesMismatchValues() throws IOException { Path path = Paths.get("src/test/resources/athenz.mismatch.dns.csr"); String csr = new String(Files.readAllBytes(path)); X509CertRequest certReq = new X509CertRequest(csr); assertNotNull(certReq); path = Paths.get("src/test/resources/athenz.instanceid.pem"); String pem = new String(Files.readAllBytes(path)); X509Certificate cert = Crypto.loadX509Certificate(pem); assertFalse(certReq.validateDnsNames(cert)); }