1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119
|
/*
* Copyright (c) 2023, Oracle and/or its affiliates. All rights reserved.
* Copyright (c) 2023 SAP SE. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License version 2 only, as
* published by the Free Software Foundation.
*
* This code is distributed in the hope that it will be useful, but WITHOUT
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* version 2 for more details (a copy is included in the LICENSE file that
* accompanied this code).
*
* You should have received a copy of the GNU General Public License version
* 2 along with this work; if not, write to the Free Software Foundation,
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
*
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
* or visit www.oracle.com if you need additional information or have any
* questions.
*/
import java.security.KeyStore;
import java.util.HashSet;
import java.util.Set;
import jdk.test.lib.process.OutputAnalyzer;
import jdk.test.lib.process.ProcessTools;
/*
* @test
* @bug 8303465
* @library /test/lib
* @requires os.family == "mac"
* @summary Check whether loading of certificates from MacOS Keychain correctly
* honors trust settings
*/
public class CheckMacOSKeyChainTrust {
private static Set<String> trusted = new HashSet<>();
private static Set<String> distrusted = new HashSet<>();
public static void main(String[] args) throws Throwable {
loadUser();
loadAdmin();
System.out.println("Trusted Certs: " + trusted);
System.out.println("Distrusted Certs: " + distrusted);
KeyStore ks = KeyStore.getInstance("KEYCHAINSTORE");
ks.load(null, null);
for (String alias : trusted) {
if (!ks.containsAlias(alias)) {
throw new RuntimeException("Not found: " + alias);
}
}
for (String alias : distrusted) {
if (ks.containsAlias(alias)) {
throw new RuntimeException("Found: " + alias);
}
}
}
private static void loadUser() throws Throwable {
populate(ProcessTools.executeProcess("security", "dump-trust-settings"));
}
private static void loadAdmin() throws Throwable {
populate(ProcessTools.executeProcess("security", "dump-trust-settings", "-d"));
}
private static void populate(OutputAnalyzer output) throws Throwable {
if (output.getExitValue() != 0) {
return; // No Trust Settings were found
}
String certName = null;
boolean trustRootFound = false;
boolean trustAsRootFound = false;
boolean denyFound = false;
boolean unspecifiedFound = false;
for (String line : output.asLines()) {
if (line.startsWith("Cert ")) {
if (certName != null) {
if (!denyFound &&
!(unspecifiedFound && !(trustRootFound || trustAsRootFound)) &&
!distrusted.contains(certName)) {
trusted.add(certName);
} else {
distrusted.add(certName);
trusted.remove(certName);
}
}
certName = line.split(":", 2)[1].trim().toLowerCase();
trustRootFound = false;
trustAsRootFound = false;
denyFound = false;
unspecifiedFound = false;
} else if (line.contains("kSecTrustSettingsResultTrustRoot")) {
trustRootFound = true;
} else if (line.contains("kSecTrustSettingsResultTrustAsRoot")) {
trustAsRootFound = true;
} else if (line.contains("kSecTrustSettingsResultDeny")) {
denyFound = true;
} else if (line.contains("kSecTrustSettingsResultUnspecified")) {
unspecifiedFound = true;
}
}
if (certName != null) {
if (!denyFound &&
!(unspecifiedFound && !(trustRootFound || trustAsRootFound)) &&
!distrusted.contains(certName)) {
trusted.add(certName);
} else {
distrusted.add(certName);
trusted.remove(certName);
}
}
}
}
|