CertificateManager { public synchronized SignCertResponse signAgentCrt(String agentHostname, String agentCrtReqContent, String passphraseAgent) { SignCertResponse response = new SignCertResponse(); LOG.info("Signing agent certificate"); agentHostname = StringUtils.trim(agentHostname); if(StringUtils.isEmpty(agentHostname)) { LOG.warn("The agent hostname is missing"); response.setResult(SignCertResponse.ERROR_STATUS); response.setMessage("The agent hostname is missing"); return response; } if(configs.validateAgentHostnames()) { LOG.info("Validating agent hostname: {}", agentHostname); if(!HostUtils.isValidHostname(agentHostname)) { LOG.warn("The agent hostname is not a valid hostname"); response.setResult(SignCertResponse.ERROR_STATUS); response.setMessage("The agent hostname is not a valid hostname"); return response; } } else { LOG.info("Skipping validation of agent hostname: {}", agentHostname); } LOG.info("Verifying passphrase"); String passphraseSrvr = configs.getConfigsMap().get(Configuration. PASSPHRASE.getKey()).trim(); if (!passphraseSrvr.equals(passphraseAgent.trim())) { LOG.warn("Incorrect passphrase from the agent"); response.setResult(SignCertResponse.ERROR_STATUS); response.setMessage("Incorrect passphrase from the agent"); return response; } Map<String, String> configsMap = configs.getConfigsMap(); String srvrKstrDir = configsMap.get(Configuration.SRVR_KSTR_DIR.getKey()); String srvrCrtPass = configsMap.get(Configuration.SRVR_CRT_PASS.getKey()); String srvrCrtName = configsMap.get(Configuration.SRVR_CRT_NAME.getKey()); String srvrKeyName = configsMap.get(Configuration.SRVR_KEY_NAME.getKey()); String agentCrtReqName = agentHostname + ".csr"; String agentCrtName = agentHostname + ".crt"; Object[] scriptArgs = {srvrKstrDir, agentCrtReqName, agentCrtName, srvrCrtPass, srvrKeyName, srvrCrtName}; File agentCrtFile = new File(srvrKstrDir + File.separator + agentCrtName); if (agentCrtFile.exists()) { LOG.info("Revoking of " + agentHostname + " certificate."); String command = MessageFormat.format(REVOKE_AGENT_CRT, scriptArgs); int commandExitCode = runCommand(command); if (commandExitCode != 0) { response.setResult(SignCertResponse.ERROR_STATUS); response.setMessage(ShellCommandUtil.getOpenSslCommandResult(command, commandExitCode)); return response; } } File agentCrtReqFile = new File(srvrKstrDir + File.separator + agentCrtReqName); try { FileUtils.writeStringToFile(agentCrtReqFile, agentCrtReqContent); } catch (IOException e1) { e1.printStackTrace(); } String command = MessageFormat.format(SIGN_AGENT_CRT, scriptArgs); LOG.debug(ShellCommandUtil.hideOpenSslPassword(command)); int commandExitCode = runCommand(command); if (commandExitCode != 0) { response.setResult(SignCertResponse.ERROR_STATUS); response.setMessage(ShellCommandUtil.getOpenSslCommandResult(command, commandExitCode)); return response; } String agentCrtContent = ""; try { agentCrtContent = FileUtils.readFileToString(agentCrtFile); } catch (IOException e) { e.printStackTrace(); LOG.error("Error reading signed agent certificate"); response.setResult(SignCertResponse.ERROR_STATUS); response.setMessage("Error reading signed agent certificate"); return response; } response.setResult(SignCertResponse.OK_STATUS); response.setSignedCa(agentCrtContent); return response; }  void initRootCert(); String getServerCert(); synchronized SignCertResponse signAgentCrt(String agentHostname, String agentCrtReqContent, String passphraseAgent);  }
@Test public void testSignAgentCrt() throws Exception { Injector injector = getInjector(); File directory = folder.newFolder(); String hostname = "host1.example.com"; Map<String, String> configurationMap = new HashMap<String, String>(); configurationMap.put(Configuration.SRVR_KSTR_DIR.getKey(), directory.getAbsolutePath()); configurationMap.put(Configuration.SRVR_CRT_PASS.getKey(), "server_cert_pass"); configurationMap.put(Configuration.SRVR_CRT_NAME.getKey(), "server_cert_name"); configurationMap.put(Configuration.SRVR_KEY_NAME.getKey(), "server_key_name"); configurationMap.put(Configuration.PASSPHRASE.getKey(), "passphrase"); Configuration configuration = injector.getInstance(Configuration.class); expect(configuration.validateAgentHostnames()).andReturn(true).once(); expect(configuration.getConfigsMap()).andReturn(configurationMap).anyTimes(); Method runCommand = CertificateManager.class.getDeclaredMethod("runCommand", String.class); final File agentCrtFile = new File(directory, String.format("%s.crt", hostname)); String expectedCommand = String.format("openssl ca -config %s/ca.config -in %s/%s.csr -out %s -batch -passin pass:%s -keyfile %s/%s -cert %s/%s", directory.getAbsolutePath(), directory.getAbsolutePath(), hostname, agentCrtFile.getAbsolutePath(), configurationMap.get(Configuration.SRVR_CRT_PASS.getKey()), directory.getAbsolutePath(), configurationMap.get(Configuration.SRVR_KEY_NAME.getKey()), directory.getAbsolutePath(), configurationMap.get(Configuration.SRVR_CRT_NAME.getKey())); CertificateManager certificateManager = createMockBuilder(CertificateManager.class) .addMockedMethod(runCommand) .createMock(); expect(certificateManager.runCommand(expectedCommand)) .andAnswer(new IAnswer<Integer>() { @Override public Integer answer() throws Throwable { return (agentCrtFile.createNewFile()) ? 0 : 1; } }) .once(); injector.injectMembers(certificateManager); replayAll(); SignCertResponse response = certificateManager.signAgentCrt(hostname, "crtContent", "passphrase"); verifyAll(); Assert.assertEquals(SignCertResponse.OK_STATUS, response.getResult()); }
@Test public void testSignAgentCrtInvalidHostname() throws Exception { Injector injector = getInjector(); Configuration configuration = injector.getInstance(Configuration.class); expect(configuration.validateAgentHostnames()).andReturn(true).once(); replayAll(); CertificateManager certificateManager = new CertificateManager(); injector.injectMembers(certificateManager); SignCertResponse response = certificateManager.signAgentCrt("hostname; echo \"hello\" > /tmp/hello.txt;", "crtContent", "passphrase"); verifyAll(); Assert.assertEquals(SignCertResponse.ERROR_STATUS, response.getResult()); Assert.assertEquals("The agent hostname is not a valid hostname", response.getMessage()); }
@Test public void testSignAgentCrtBadPassphrase() throws Exception { Injector injector = getInjector(); Configuration configuration = injector.getInstance(Configuration.class); expect(configuration.validateAgentHostnames()).andReturn(true).once(); expect(configuration.getConfigsMap()).andReturn(Collections.singletonMap(Configuration.PASSPHRASE.getKey(), "some_passphrase")).once(); replayAll(); CertificateManager certificateManager = new CertificateManager(); injector.injectMembers(certificateManager); SignCertResponse response = certificateManager.signAgentCrt("host1.example.com", "crtContent", "passphrase"); verifyAll(); Assert.assertEquals(SignCertResponse.ERROR_STATUS, response.getResult()); Assert.assertEquals("Incorrect passphrase from the agent", response.getMessage()); }
@Test public void testSignAgentCrtInvalidHostnameIgnoreBadPassphrase() throws Exception { Injector injector = getInjector(); Configuration configuration = injector.getInstance(Configuration.class); expect(configuration.validateAgentHostnames()).andReturn(false).once(); expect(configuration.getConfigsMap()).andReturn(Collections.singletonMap(Configuration.PASSPHRASE.getKey(), "some_passphrase")).once(); replayAll(); CertificateManager certificateManager = new CertificateManager(); injector.injectMembers(certificateManager); SignCertResponse response = certificateManager.signAgentCrt("hostname; echo \"hello\" > /tmp/hello.txt;", "crtContent", "passphrase"); verifyAll(); Assert.assertEquals(SignCertResponse.ERROR_STATUS, response.getResult()); Assert.assertEquals("Incorrect passphrase from the agent", response.getMessage()); }