|
@@ -18,20 +18,6 @@
|
|
|
|
|
|
package org.apache.hadoop.yarn.server.webproxy;
|
|
package org.apache.hadoop.yarn.server.webproxy;
|
|
|
|
|
|
-import org.apache.hadoop.security.ssl.KeyStoreTestUtil;
|
|
|
|
-import org.apache.hadoop.yarn.api.records.ApplicationId;
|
|
|
|
-import org.junit.Assert;
|
|
|
|
-import org.junit.Test;
|
|
|
|
-import org.mockito.Mockito;
|
|
|
|
-import org.mockito.invocation.InvocationOnMock;
|
|
|
|
-import org.mockito.stubbing.Answer;
|
|
|
|
-
|
|
|
|
-import javax.net.ssl.HostnameVerifier;
|
|
|
|
-import javax.net.ssl.SSLPeerUnverifiedException;
|
|
|
|
-import javax.net.ssl.SSLSession;
|
|
|
|
-import javax.net.ssl.X509KeyManager;
|
|
|
|
-import javax.net.ssl.X509TrustManager;
|
|
|
|
-import javax.security.auth.x500.X500Principal;
|
|
|
|
import java.security.InvalidKeyException;
|
|
import java.security.InvalidKeyException;
|
|
import java.security.Key;
|
|
import java.security.Key;
|
|
import java.security.KeyPair;
|
|
import java.security.KeyPair;
|
|
@@ -52,109 +38,132 @@ import java.util.GregorianCalendar;
|
|
import java.util.HashSet;
|
|
import java.util.HashSet;
|
|
import java.util.Random;
|
|
import java.util.Random;
|
|
import java.util.Set;
|
|
import java.util.Set;
|
|
|
|
+import javax.net.ssl.HostnameVerifier;
|
|
|
|
+import javax.net.ssl.SSLPeerUnverifiedException;
|
|
|
|
+import javax.net.ssl.SSLSession;
|
|
|
|
+import javax.net.ssl.X509KeyManager;
|
|
|
|
+import javax.net.ssl.X509TrustManager;
|
|
|
|
+import javax.security.auth.x500.X500Principal;
|
|
|
|
+
|
|
|
|
+import org.junit.jupiter.api.Test;
|
|
|
|
+import org.mockito.Mockito;
|
|
|
|
+import org.mockito.invocation.InvocationOnMock;
|
|
|
|
+import org.mockito.stubbing.Answer;
|
|
|
|
+
|
|
|
|
+import org.apache.hadoop.security.ssl.KeyStoreTestUtil;
|
|
|
|
+import org.apache.hadoop.yarn.api.records.ApplicationId;
|
|
|
|
+
|
|
|
|
+import static org.junit.jupiter.api.Assertions.assertArrayEquals;
|
|
|
|
+import static org.junit.jupiter.api.Assertions.assertEquals;
|
|
|
|
+import static org.junit.jupiter.api.Assertions.assertFalse;
|
|
|
|
+import static org.junit.jupiter.api.Assertions.assertNotEquals;
|
|
|
|
+import static org.junit.jupiter.api.Assertions.assertNotNull;
|
|
|
|
+import static org.junit.jupiter.api.Assertions.assertNull;
|
|
|
|
+import static org.junit.jupiter.api.Assertions.assertTrue;
|
|
|
|
+import static org.junit.jupiter.api.Assertions.fail;
|
|
|
|
|
|
public class TestProxyCA {
|
|
public class TestProxyCA {
|
|
|
|
|
|
@Test
|
|
@Test
|
|
- public void testInit() throws Exception {
|
|
|
|
|
|
+ void testInit() throws Exception {
|
|
ProxyCA proxyCA = new ProxyCA();
|
|
ProxyCA proxyCA = new ProxyCA();
|
|
- Assert.assertNull(proxyCA.getCaCert());
|
|
|
|
- Assert.assertNull(proxyCA.getCaKeyPair());
|
|
|
|
- Assert.assertNull(proxyCA.getX509KeyManager());
|
|
|
|
- Assert.assertNull(proxyCA.getHostnameVerifier());
|
|
|
|
|
|
+ assertNull(proxyCA.getCaCert());
|
|
|
|
+ assertNull(proxyCA.getCaKeyPair());
|
|
|
|
+ assertNull(proxyCA.getX509KeyManager());
|
|
|
|
+ assertNull(proxyCA.getHostnameVerifier());
|
|
|
|
|
|
proxyCA.init();
|
|
proxyCA.init();
|
|
- Assert.assertNotNull(proxyCA.getCaCert());
|
|
|
|
- Assert.assertNotNull(proxyCA.getCaKeyPair());
|
|
|
|
- Assert.assertNotNull(proxyCA.getX509KeyManager());
|
|
|
|
- Assert.assertNotNull(proxyCA.getHostnameVerifier());
|
|
|
|
|
|
+ assertNotNull(proxyCA.getCaCert());
|
|
|
|
+ assertNotNull(proxyCA.getCaKeyPair());
|
|
|
|
+ assertNotNull(proxyCA.getX509KeyManager());
|
|
|
|
+ assertNotNull(proxyCA.getHostnameVerifier());
|
|
}
|
|
}
|
|
|
|
|
|
@Test
|
|
@Test
|
|
- public void testInit2Null() throws Exception {
|
|
|
|
|
|
+ void testInit2Null() throws Exception {
|
|
ProxyCA proxyCA = new ProxyCA();
|
|
ProxyCA proxyCA = new ProxyCA();
|
|
- Assert.assertNull(proxyCA.getCaCert());
|
|
|
|
- Assert.assertNull(proxyCA.getCaKeyPair());
|
|
|
|
- Assert.assertNull(proxyCA.getX509KeyManager());
|
|
|
|
- Assert.assertNull(proxyCA.getHostnameVerifier());
|
|
|
|
|
|
+ assertNull(proxyCA.getCaCert());
|
|
|
|
+ assertNull(proxyCA.getCaKeyPair());
|
|
|
|
+ assertNull(proxyCA.getX509KeyManager());
|
|
|
|
+ assertNull(proxyCA.getHostnameVerifier());
|
|
|
|
|
|
// null certificate and private key
|
|
// null certificate and private key
|
|
proxyCA.init(null, null);
|
|
proxyCA.init(null, null);
|
|
- Assert.assertNotNull(proxyCA.getCaCert());
|
|
|
|
- Assert.assertNotNull(proxyCA.getCaKeyPair());
|
|
|
|
- Assert.assertNotNull(proxyCA.getX509KeyManager());
|
|
|
|
- Assert.assertNotNull(proxyCA.getHostnameVerifier());
|
|
|
|
|
|
+ assertNotNull(proxyCA.getCaCert());
|
|
|
|
+ assertNotNull(proxyCA.getCaKeyPair());
|
|
|
|
+ assertNotNull(proxyCA.getX509KeyManager());
|
|
|
|
+ assertNotNull(proxyCA.getHostnameVerifier());
|
|
}
|
|
}
|
|
|
|
|
|
@Test
|
|
@Test
|
|
- public void testInit2Mismatch() throws Exception {
|
|
|
|
|
|
+ void testInit2Mismatch() throws Exception {
|
|
ProxyCA proxyCA = new ProxyCA();
|
|
ProxyCA proxyCA = new ProxyCA();
|
|
- Assert.assertNull(proxyCA.getCaCert());
|
|
|
|
- Assert.assertNull(proxyCA.getCaKeyPair());
|
|
|
|
- Assert.assertNull(proxyCA.getX509KeyManager());
|
|
|
|
- Assert.assertNull(proxyCA.getHostnameVerifier());
|
|
|
|
|
|
+ assertNull(proxyCA.getCaCert());
|
|
|
|
+ assertNull(proxyCA.getCaKeyPair());
|
|
|
|
+ assertNull(proxyCA.getX509KeyManager());
|
|
|
|
+ assertNull(proxyCA.getHostnameVerifier());
|
|
|
|
|
|
// certificate and private key don't match
|
|
// certificate and private key don't match
|
|
CertKeyPair pair1 = createCertAndKeyPair();
|
|
CertKeyPair pair1 = createCertAndKeyPair();
|
|
CertKeyPair pair2 = createCertAndKeyPair();
|
|
CertKeyPair pair2 = createCertAndKeyPair();
|
|
- Assert.assertNotEquals(pair1.getCert(), pair2.getCert());
|
|
|
|
- Assert.assertNotEquals(pair1.getKeyPair().getPrivate(),
|
|
|
|
|
|
+ assertNotEquals(pair1.getCert(), pair2.getCert());
|
|
|
|
+ assertNotEquals(pair1.getKeyPair().getPrivate(),
|
|
pair2.getKeyPair().getPrivate());
|
|
pair2.getKeyPair().getPrivate());
|
|
- Assert.assertNotEquals(pair1.getKeyPair().getPublic(),
|
|
|
|
|
|
+ assertNotEquals(pair1.getKeyPair().getPublic(),
|
|
pair2.getKeyPair().getPublic());
|
|
pair2.getKeyPair().getPublic());
|
|
proxyCA.init(pair1.getCert(), pair2.getKeyPair().getPrivate());
|
|
proxyCA.init(pair1.getCert(), pair2.getKeyPair().getPrivate());
|
|
- Assert.assertNotNull(proxyCA.getCaCert());
|
|
|
|
- Assert.assertNotNull(proxyCA.getCaKeyPair());
|
|
|
|
- Assert.assertNotNull(proxyCA.getX509KeyManager());
|
|
|
|
- Assert.assertNotNull(proxyCA.getHostnameVerifier());
|
|
|
|
- Assert.assertNotEquals(proxyCA.getCaCert(), pair1.getCert());
|
|
|
|
- Assert.assertNotEquals(proxyCA.getCaKeyPair().getPrivate(),
|
|
|
|
|
|
+ assertNotNull(proxyCA.getCaCert());
|
|
|
|
+ assertNotNull(proxyCA.getCaKeyPair());
|
|
|
|
+ assertNotNull(proxyCA.getX509KeyManager());
|
|
|
|
+ assertNotNull(proxyCA.getHostnameVerifier());
|
|
|
|
+ assertNotEquals(proxyCA.getCaCert(), pair1.getCert());
|
|
|
|
+ assertNotEquals(proxyCA.getCaKeyPair().getPrivate(),
|
|
pair2.getKeyPair().getPrivate());
|
|
pair2.getKeyPair().getPrivate());
|
|
- Assert.assertNotEquals(proxyCA.getCaKeyPair().getPublic(),
|
|
|
|
|
|
+ assertNotEquals(proxyCA.getCaKeyPair().getPublic(),
|
|
pair2.getKeyPair().getPublic());
|
|
pair2.getKeyPair().getPublic());
|
|
}
|
|
}
|
|
|
|
|
|
@Test
|
|
@Test
|
|
- public void testInit2Invalid() throws Exception {
|
|
|
|
|
|
+ void testInit2Invalid() throws Exception {
|
|
ProxyCA proxyCA = new ProxyCA();
|
|
ProxyCA proxyCA = new ProxyCA();
|
|
- Assert.assertNull(proxyCA.getCaCert());
|
|
|
|
- Assert.assertNull(proxyCA.getCaKeyPair());
|
|
|
|
- Assert.assertNull(proxyCA.getX509KeyManager());
|
|
|
|
- Assert.assertNull(proxyCA.getHostnameVerifier());
|
|
|
|
|
|
+ assertNull(proxyCA.getCaCert());
|
|
|
|
+ assertNull(proxyCA.getCaKeyPair());
|
|
|
|
+ assertNull(proxyCA.getX509KeyManager());
|
|
|
|
+ assertNull(proxyCA.getHostnameVerifier());
|
|
|
|
|
|
// Invalid key - fail the verification
|
|
// Invalid key - fail the verification
|
|
X509Certificate certificate = Mockito.mock(X509Certificate.class);
|
|
X509Certificate certificate = Mockito.mock(X509Certificate.class);
|
|
PrivateKey privateKey = Mockito.mock(PrivateKey.class);
|
|
PrivateKey privateKey = Mockito.mock(PrivateKey.class);
|
|
try {
|
|
try {
|
|
proxyCA.init(certificate, privateKey);
|
|
proxyCA.init(certificate, privateKey);
|
|
- Assert.fail("Expected InvalidKeyException");
|
|
|
|
|
|
+ fail("Expected InvalidKeyException");
|
|
} catch (InvalidKeyException e) {
|
|
} catch (InvalidKeyException e) {
|
|
// expected
|
|
// expected
|
|
}
|
|
}
|
|
}
|
|
}
|
|
|
|
|
|
@Test
|
|
@Test
|
|
- public void testInit2() throws Exception {
|
|
|
|
|
|
+ void testInit2() throws Exception {
|
|
ProxyCA proxyCA = new ProxyCA();
|
|
ProxyCA proxyCA = new ProxyCA();
|
|
- Assert.assertNull(proxyCA.getCaCert());
|
|
|
|
- Assert.assertNull(proxyCA.getCaKeyPair());
|
|
|
|
- Assert.assertNull(proxyCA.getX509KeyManager());
|
|
|
|
- Assert.assertNull(proxyCA.getHostnameVerifier());
|
|
|
|
|
|
+ assertNull(proxyCA.getCaCert());
|
|
|
|
+ assertNull(proxyCA.getCaKeyPair());
|
|
|
|
+ assertNull(proxyCA.getX509KeyManager());
|
|
|
|
+ assertNull(proxyCA.getHostnameVerifier());
|
|
|
|
|
|
// certificate and private key do match
|
|
// certificate and private key do match
|
|
CertKeyPair pair = createCertAndKeyPair();
|
|
CertKeyPair pair = createCertAndKeyPair();
|
|
proxyCA.init(pair.getCert(), pair.getKeyPair().getPrivate());
|
|
proxyCA.init(pair.getCert(), pair.getKeyPair().getPrivate());
|
|
- Assert.assertEquals(pair.getCert(), proxyCA.getCaCert());
|
|
|
|
- Assert.assertEquals(pair.getKeyPair().getPrivate(),
|
|
|
|
|
|
+ assertEquals(pair.getCert(), proxyCA.getCaCert());
|
|
|
|
+ assertEquals(pair.getKeyPair().getPrivate(),
|
|
proxyCA.getCaKeyPair().getPrivate());
|
|
proxyCA.getCaKeyPair().getPrivate());
|
|
- Assert.assertEquals(pair.getKeyPair().getPublic(),
|
|
|
|
|
|
+ assertEquals(pair.getKeyPair().getPublic(),
|
|
proxyCA.getCaKeyPair().getPublic());
|
|
proxyCA.getCaKeyPair().getPublic());
|
|
- Assert.assertNotNull(proxyCA.getX509KeyManager());
|
|
|
|
- Assert.assertNotNull(proxyCA.getHostnameVerifier());
|
|
|
|
|
|
+ assertNotNull(proxyCA.getX509KeyManager());
|
|
|
|
+ assertNotNull(proxyCA.getHostnameVerifier());
|
|
}
|
|
}
|
|
|
|
|
|
@Test
|
|
@Test
|
|
- public void testCreateChildKeyStore() throws Exception {
|
|
|
|
|
|
+ void testCreateChildKeyStore() throws Exception {
|
|
ProxyCA proxyCA = new ProxyCA();
|
|
ProxyCA proxyCA = new ProxyCA();
|
|
proxyCA.init();
|
|
proxyCA.init();
|
|
ApplicationId appId =
|
|
ApplicationId appId =
|
|
@@ -163,29 +172,29 @@ public class TestProxyCA {
|
|
"password");
|
|
"password");
|
|
KeyStore keyStore = KeyStoreTestUtil.bytesToKeyStore(keystoreBytes,
|
|
KeyStore keyStore = KeyStoreTestUtil.bytesToKeyStore(keystoreBytes,
|
|
"password");
|
|
"password");
|
|
- Assert.assertEquals(1, keyStore.size());
|
|
|
|
|
|
+ assertEquals(1, keyStore.size());
|
|
Certificate[] certChain = keyStore.getCertificateChain("server");
|
|
Certificate[] certChain = keyStore.getCertificateChain("server");
|
|
- Assert.assertEquals(2, certChain.length);
|
|
|
|
|
|
+ assertEquals(2, certChain.length);
|
|
X509Certificate caCert = (X509Certificate) certChain[1];
|
|
X509Certificate caCert = (X509Certificate) certChain[1];
|
|
X509Certificate cert = (X509Certificate) certChain[0];
|
|
X509Certificate cert = (X509Certificate) certChain[0];
|
|
|
|
|
|
// check child cert
|
|
// check child cert
|
|
- Assert.assertEquals(caCert.getSubjectX500Principal().toString(),
|
|
|
|
|
|
+ assertEquals(caCert.getSubjectX500Principal().toString(),
|
|
cert.getIssuerDN().toString());
|
|
cert.getIssuerDN().toString());
|
|
- Assert.assertEquals(new X500Principal("CN=" + appId),
|
|
|
|
|
|
+ assertEquals(new X500Principal("CN=" + appId),
|
|
cert.getSubjectX500Principal());
|
|
cert.getSubjectX500Principal());
|
|
- Assert.assertFalse("Found multiple fields in X500 Principal, when there " +
|
|
|
|
- "should have only been one: " + cert.getSubjectX500Principal(),
|
|
|
|
- cert.getSubjectX500Principal().toString().contains(","));
|
|
|
|
- Assert.assertEquals("SHA512withRSA", cert.getSigAlgName());
|
|
|
|
- Assert.assertEquals(cert.getNotBefore(), cert.getNotAfter());
|
|
|
|
- Assert.assertTrue("Expected certificate to be expired but was not: "
|
|
|
|
- + cert.getNotAfter(), cert.getNotAfter().before(new Date()));
|
|
|
|
- Assert.assertEquals(new X500Principal("CN=" + appId).toString(),
|
|
|
|
|
|
+ assertFalse(cert.getSubjectX500Principal().toString().contains(","),
|
|
|
|
+ "Found multiple fields in X500 Principal, when there " +
|
|
|
|
+ "should have only been one: " + cert.getSubjectX500Principal());
|
|
|
|
+ assertEquals("SHA512withRSA", cert.getSigAlgName());
|
|
|
|
+ assertEquals(cert.getNotBefore(), cert.getNotAfter());
|
|
|
|
+ assertTrue(cert.getNotAfter().before(new Date()),
|
|
|
|
+ "Expected certificate to be expired but was not: " + cert.getNotAfter());
|
|
|
|
+ assertEquals(new X500Principal("CN=" + appId).toString(),
|
|
cert.getSubjectDN().toString());
|
|
cert.getSubjectDN().toString());
|
|
Key privateKey = keyStore.getKey("server", "password".toCharArray());
|
|
Key privateKey = keyStore.getKey("server", "password".toCharArray());
|
|
- Assert.assertEquals("RSA", privateKey.getAlgorithm());
|
|
|
|
- Assert.assertEquals(-1, cert.getBasicConstraints());
|
|
|
|
|
|
+ assertEquals("RSA", privateKey.getAlgorithm());
|
|
|
|
+ assertEquals(-1, cert.getBasicConstraints());
|
|
|
|
|
|
// verify signature on child cert
|
|
// verify signature on child cert
|
|
PublicKey caPublicKey = caCert.getPublicKey();
|
|
PublicKey caPublicKey = caCert.getPublicKey();
|
|
@@ -193,7 +202,7 @@ public class TestProxyCA {
|
|
|
|
|
|
// check CA cert
|
|
// check CA cert
|
|
checkCACert(caCert);
|
|
checkCACert(caCert);
|
|
- Assert.assertEquals(proxyCA.getCaCert(), caCert);
|
|
|
|
|
|
+ assertEquals(proxyCA.getCaCert(), caCert);
|
|
|
|
|
|
// verify signature on CA cert
|
|
// verify signature on CA cert
|
|
caCert.verify(caPublicKey);
|
|
caCert.verify(caPublicKey);
|
|
@@ -202,24 +211,24 @@ public class TestProxyCA {
|
|
PrivateKey caPrivateKey =
|
|
PrivateKey caPrivateKey =
|
|
proxyCA.getX509KeyManager().getPrivateKey(null);
|
|
proxyCA.getX509KeyManager().getPrivateKey(null);
|
|
checkPrivatePublicKeys(caPrivateKey, caPublicKey);
|
|
checkPrivatePublicKeys(caPrivateKey, caPublicKey);
|
|
- Assert.assertEquals(proxyCA.getCaKeyPair().getPublic(), caPublicKey);
|
|
|
|
- Assert.assertEquals(proxyCA.getCaKeyPair().getPrivate(), caPrivateKey);
|
|
|
|
|
|
+ assertEquals(proxyCA.getCaKeyPair().getPublic(), caPublicKey);
|
|
|
|
+ assertEquals(proxyCA.getCaKeyPair().getPrivate(), caPrivateKey);
|
|
}
|
|
}
|
|
|
|
|
|
@Test
|
|
@Test
|
|
- public void testGetChildTrustStore() throws Exception {
|
|
|
|
|
|
+ void testGetChildTrustStore() throws Exception {
|
|
ProxyCA proxyCA = new ProxyCA();
|
|
ProxyCA proxyCA = new ProxyCA();
|
|
proxyCA.init();
|
|
proxyCA.init();
|
|
byte[] truststoreBytes = proxyCA.getChildTrustStore("password");
|
|
byte[] truststoreBytes = proxyCA.getChildTrustStore("password");
|
|
KeyStore truststore = KeyStoreTestUtil.bytesToKeyStore(truststoreBytes,
|
|
KeyStore truststore = KeyStoreTestUtil.bytesToKeyStore(truststoreBytes,
|
|
"password");
|
|
"password");
|
|
- Assert.assertEquals(1, truststore.size());
|
|
|
|
|
|
+ assertEquals(1, truststore.size());
|
|
X509Certificate caCert =
|
|
X509Certificate caCert =
|
|
(X509Certificate) truststore.getCertificate("client");
|
|
(X509Certificate) truststore.getCertificate("client");
|
|
|
|
|
|
// check CA cert
|
|
// check CA cert
|
|
checkCACert(caCert);
|
|
checkCACert(caCert);
|
|
- Assert.assertEquals(proxyCA.getCaCert(), caCert);
|
|
|
|
|
|
+ assertEquals(proxyCA.getCaCert(), caCert);
|
|
|
|
|
|
// verify signature on CA cert
|
|
// verify signature on CA cert
|
|
PublicKey caPublicKey = caCert.getPublicKey();
|
|
PublicKey caPublicKey = caCert.getPublicKey();
|
|
@@ -229,12 +238,12 @@ public class TestProxyCA {
|
|
PrivateKey caPrivateKey =
|
|
PrivateKey caPrivateKey =
|
|
proxyCA.getX509KeyManager().getPrivateKey(null);
|
|
proxyCA.getX509KeyManager().getPrivateKey(null);
|
|
checkPrivatePublicKeys(caPrivateKey, caPublicKey);
|
|
checkPrivatePublicKeys(caPrivateKey, caPublicKey);
|
|
- Assert.assertEquals(proxyCA.getCaKeyPair().getPublic(), caPublicKey);
|
|
|
|
- Assert.assertEquals(proxyCA.getCaKeyPair().getPrivate(), caPrivateKey);
|
|
|
|
|
|
+ assertEquals(proxyCA.getCaKeyPair().getPublic(), caPublicKey);
|
|
|
|
+ assertEquals(proxyCA.getCaKeyPair().getPrivate(), caPrivateKey);
|
|
}
|
|
}
|
|
|
|
|
|
@Test
|
|
@Test
|
|
- public void testGenerateKeyStorePassword() throws Exception {
|
|
|
|
|
|
+ void testGenerateKeyStorePassword() throws Exception {
|
|
// We can't possibly test every possible string, but we can at least verify
|
|
// We can't possibly test every possible string, but we can at least verify
|
|
// a few things about a few of the generated strings as a sanity check
|
|
// a few things about a few of the generated strings as a sanity check
|
|
ProxyCA proxyCA = new ProxyCA();
|
|
ProxyCA proxyCA = new ProxyCA();
|
|
@@ -243,23 +252,23 @@ public class TestProxyCA {
|
|
|
|
|
|
for (int i = 0; i < 5; i++) {
|
|
for (int i = 0; i < 5; i++) {
|
|
String password = proxyCA.generateKeyStorePassword();
|
|
String password = proxyCA.generateKeyStorePassword();
|
|
- Assert.assertEquals(16, password.length());
|
|
|
|
|
|
+ assertEquals(16, password.length());
|
|
for (char c : password.toCharArray()) {
|
|
for (char c : password.toCharArray()) {
|
|
- Assert.assertFalse("Found character '" + c + "' in password '"
|
|
|
|
- + password + "' which is outside of the expected range", c < ' ');
|
|
|
|
- Assert.assertFalse("Found character '" + c + "' in password '"
|
|
|
|
- + password + "' which is outside of the expected range", c > 'z');
|
|
|
|
|
|
+ assertFalse(c < ' ', "Found character '" + c + "' in password '"
|
|
|
|
+ + password + "' which is outside of the expected range");
|
|
|
|
+ assertFalse(c > 'z', "Found character '" + c + "' in password '"
|
|
|
|
+ + password + "' which is outside of the expected range");
|
|
}
|
|
}
|
|
- Assert.assertFalse("Password " + password
|
|
|
|
- + " was generated twice, which is _extremely_ unlikely"
|
|
|
|
- + " and shouldn't practically happen: " + passwords,
|
|
|
|
- passwords.contains(password));
|
|
|
|
|
|
+ assertFalse(passwords.contains(password),
|
|
|
|
+ "Password " + password
|
|
|
|
+ + " was generated twice, which is _extremely_ unlikely"
|
|
|
|
+ + " and shouldn't practically happen: " + passwords);
|
|
passwords.add(password);
|
|
passwords.add(password);
|
|
}
|
|
}
|
|
}
|
|
}
|
|
|
|
|
|
@Test
|
|
@Test
|
|
- public void testCreateTrustManagerDefaultTrustManager() throws Exception {
|
|
|
|
|
|
+ void testCreateTrustManagerDefaultTrustManager() throws Exception {
|
|
ProxyCA proxyCA = new ProxyCA();
|
|
ProxyCA proxyCA = new ProxyCA();
|
|
proxyCA.init();
|
|
proxyCA.init();
|
|
X509TrustManager defaultTrustManager = Mockito.mock(X509TrustManager.class);
|
|
X509TrustManager defaultTrustManager = Mockito.mock(X509TrustManager.class);
|
|
@@ -272,13 +281,13 @@ public class TestProxyCA {
|
|
"CN=foo", KeyStoreTestUtil.generateKeyPair("RSA"), 30,
|
|
"CN=foo", KeyStoreTestUtil.generateKeyPair("RSA"), 30,
|
|
"SHA1withRSA")});
|
|
"SHA1withRSA")});
|
|
|
|
|
|
- Assert.assertArrayEquals(defaultTrustManager.getAcceptedIssuers(),
|
|
|
|
|
|
+ assertArrayEquals(defaultTrustManager.getAcceptedIssuers(),
|
|
trustManager.getAcceptedIssuers());
|
|
trustManager.getAcceptedIssuers());
|
|
trustManager.checkClientTrusted(null, null);
|
|
trustManager.checkClientTrusted(null, null);
|
|
}
|
|
}
|
|
|
|
|
|
@Test
|
|
@Test
|
|
- public void testCreateTrustManagerYarnCert() throws Exception {
|
|
|
|
|
|
+ void testCreateTrustManagerYarnCert() throws Exception {
|
|
ProxyCA proxyCA = new ProxyCA();
|
|
ProxyCA proxyCA = new ProxyCA();
|
|
proxyCA.init();
|
|
proxyCA.init();
|
|
X509TrustManager defaultTrustManager = Mockito.mock(X509TrustManager.class);
|
|
X509TrustManager defaultTrustManager = Mockito.mock(X509TrustManager.class);
|
|
@@ -297,7 +306,7 @@ public class TestProxyCA {
|
|
}
|
|
}
|
|
|
|
|
|
@Test
|
|
@Test
|
|
- public void testCreateTrustManagerWrongApp() throws Exception {
|
|
|
|
|
|
+ void testCreateTrustManagerWrongApp() throws Exception {
|
|
ProxyCA proxyCA = new ProxyCA();
|
|
ProxyCA proxyCA = new ProxyCA();
|
|
proxyCA.init();
|
|
proxyCA.init();
|
|
X509TrustManager defaultTrustManager = Mockito.mock(X509TrustManager.class);
|
|
X509TrustManager defaultTrustManager = Mockito.mock(X509TrustManager.class);
|
|
@@ -314,15 +323,15 @@ public class TestProxyCA {
|
|
.getCertificateChain("server"));
|
|
.getCertificateChain("server"));
|
|
try {
|
|
try {
|
|
trustManager.checkServerTrusted(certChain, "RSA");
|
|
trustManager.checkServerTrusted(certChain, "RSA");
|
|
- Assert.fail("Should have thrown a CertificateException, but did not");
|
|
|
|
|
|
+ fail("Should have thrown a CertificateException, but did not");
|
|
} catch (CertificateException ce) {
|
|
} catch (CertificateException ce) {
|
|
- Assert.assertEquals("Expected to find Subject X500 Principal with CN=" +
|
|
|
|
|
|
+ assertEquals("Expected to find Subject X500 Principal with CN=" +
|
|
appId + " but found CN=" + appId2, ce.getMessage());
|
|
appId + " but found CN=" + appId2, ce.getMessage());
|
|
}
|
|
}
|
|
}
|
|
}
|
|
|
|
|
|
@Test
|
|
@Test
|
|
- public void testCreateTrustManagerWrongRM() throws Exception {
|
|
|
|
|
|
+ void testCreateTrustManagerWrongRM() throws Exception {
|
|
ProxyCA proxyCA = new ProxyCA();
|
|
ProxyCA proxyCA = new ProxyCA();
|
|
proxyCA.init();
|
|
proxyCA.init();
|
|
X509TrustManager defaultTrustManager = Mockito.mock(X509TrustManager.class);
|
|
X509TrustManager defaultTrustManager = Mockito.mock(X509TrustManager.class);
|
|
@@ -345,7 +354,7 @@ public class TestProxyCA {
|
|
}
|
|
}
|
|
|
|
|
|
@Test
|
|
@Test
|
|
- public void testCreateTrustManagerRealCert() throws Exception {
|
|
|
|
|
|
+ void testCreateTrustManagerRealCert() throws Exception {
|
|
ProxyCA proxyCA = new ProxyCA();
|
|
ProxyCA proxyCA = new ProxyCA();
|
|
proxyCA.init();
|
|
proxyCA.init();
|
|
X509TrustManager defaultTrustManager = Mockito.mock(X509TrustManager.class);
|
|
X509TrustManager defaultTrustManager = Mockito.mock(X509TrustManager.class);
|
|
@@ -357,8 +366,8 @@ public class TestProxyCA {
|
|
// "real" cert
|
|
// "real" cert
|
|
X509Certificate[]
|
|
X509Certificate[]
|
|
certChain = new X509Certificate[]{
|
|
certChain = new X509Certificate[]{
|
|
- KeyStoreTestUtil.generateCertificate("CN=foo.com",
|
|
|
|
- KeyStoreTestUtil.generateKeyPair("RSA"), 30, "SHA1withRSA")};
|
|
|
|
|
|
+ KeyStoreTestUtil.generateCertificate("CN=foo.com",
|
|
|
|
+ KeyStoreTestUtil.generateKeyPair("RSA"), 30, "SHA1withRSA")};
|
|
Mockito.verify(defaultTrustManager, Mockito.times(0))
|
|
Mockito.verify(defaultTrustManager, Mockito.times(0))
|
|
.checkServerTrusted(certChain, "RSA");
|
|
.checkServerTrusted(certChain, "RSA");
|
|
trustManager.checkServerTrusted(certChain, "RSA");
|
|
trustManager.checkServerTrusted(certChain, "RSA");
|
|
@@ -379,7 +388,7 @@ public class TestProxyCA {
|
|
}
|
|
}
|
|
|
|
|
|
@Test
|
|
@Test
|
|
- public void testCreateTrustManagerExceptions() throws Exception {
|
|
|
|
|
|
+ void testCreateTrustManagerExceptions() throws Exception {
|
|
ProxyCA proxyCA = new ProxyCA();
|
|
ProxyCA proxyCA = new ProxyCA();
|
|
proxyCA.init();
|
|
proxyCA.init();
|
|
X509TrustManager defaultTrustManager = Mockito.mock(X509TrustManager.class);
|
|
X509TrustManager defaultTrustManager = Mockito.mock(X509TrustManager.class);
|
|
@@ -409,37 +418,37 @@ public class TestProxyCA {
|
|
}
|
|
}
|
|
|
|
|
|
@Test
|
|
@Test
|
|
- public void testCreateKeyManager() throws Exception {
|
|
|
|
|
|
+ void testCreateKeyManager() throws Exception {
|
|
ProxyCA proxyCA = new ProxyCA();
|
|
ProxyCA proxyCA = new ProxyCA();
|
|
proxyCA.init();
|
|
proxyCA.init();
|
|
X509KeyManager keyManager = proxyCA.getX509KeyManager();
|
|
X509KeyManager keyManager = proxyCA.getX509KeyManager();
|
|
|
|
|
|
- Assert.assertArrayEquals(new String[]{"client"},
|
|
|
|
|
|
+ assertArrayEquals(new String[]{"client"},
|
|
keyManager.getClientAliases(null, null));
|
|
keyManager.getClientAliases(null, null));
|
|
- Assert.assertEquals("client",
|
|
|
|
|
|
+ assertEquals("client",
|
|
keyManager.chooseClientAlias(null, null, null));
|
|
keyManager.chooseClientAlias(null, null, null));
|
|
- Assert.assertNull(keyManager.getServerAliases(null, null));
|
|
|
|
- Assert.assertNull(keyManager.chooseServerAlias(null, null, null));
|
|
|
|
|
|
+ assertNull(keyManager.getServerAliases(null, null));
|
|
|
|
+ assertNull(keyManager.chooseServerAlias(null, null, null));
|
|
|
|
|
|
byte[] truststoreBytes = proxyCA.getChildTrustStore("password");
|
|
byte[] truststoreBytes = proxyCA.getChildTrustStore("password");
|
|
KeyStore truststore = KeyStoreTestUtil.bytesToKeyStore(truststoreBytes,
|
|
KeyStore truststore = KeyStoreTestUtil.bytesToKeyStore(truststoreBytes,
|
|
"password");
|
|
"password");
|
|
- Assert.assertEquals(1, truststore.size());
|
|
|
|
|
|
+ assertEquals(1, truststore.size());
|
|
X509Certificate caCert =
|
|
X509Certificate caCert =
|
|
(X509Certificate) truststore.getCertificate("client");
|
|
(X509Certificate) truststore.getCertificate("client");
|
|
- Assert.assertArrayEquals(new X509Certificate[]{caCert},
|
|
|
|
|
|
+ assertArrayEquals(new X509Certificate[]{caCert},
|
|
keyManager.getCertificateChain(null));
|
|
keyManager.getCertificateChain(null));
|
|
- Assert.assertEquals(proxyCA.getCaCert(), caCert);
|
|
|
|
|
|
+ assertEquals(proxyCA.getCaCert(), caCert);
|
|
|
|
|
|
PrivateKey caPrivateKey = keyManager.getPrivateKey(null);
|
|
PrivateKey caPrivateKey = keyManager.getPrivateKey(null);
|
|
PublicKey caPublicKey = caCert.getPublicKey();
|
|
PublicKey caPublicKey = caCert.getPublicKey();
|
|
checkPrivatePublicKeys(caPrivateKey, caPublicKey);
|
|
checkPrivatePublicKeys(caPrivateKey, caPublicKey);
|
|
- Assert.assertEquals(proxyCA.getCaKeyPair().getPublic(), caPublicKey);
|
|
|
|
- Assert.assertEquals(proxyCA.getCaKeyPair().getPrivate(), caPrivateKey);
|
|
|
|
|
|
+ assertEquals(proxyCA.getCaKeyPair().getPublic(), caPublicKey);
|
|
|
|
+ assertEquals(proxyCA.getCaKeyPair().getPrivate(), caPrivateKey);
|
|
}
|
|
}
|
|
|
|
|
|
@Test
|
|
@Test
|
|
- public void testCreateHostnameVerifier() throws Exception {
|
|
|
|
|
|
+ void testCreateHostnameVerifier() throws Exception {
|
|
ProxyCA proxyCA = new ProxyCA();
|
|
ProxyCA proxyCA = new ProxyCA();
|
|
proxyCA.init();
|
|
proxyCA.init();
|
|
HostnameVerifier verifier = proxyCA.getHostnameVerifier();
|
|
HostnameVerifier verifier = proxyCA.getHostnameVerifier();
|
|
@@ -450,11 +459,11 @@ public class TestProxyCA {
|
|
proxyCA.createChildKeyStore(
|
|
proxyCA.createChildKeyStore(
|
|
ApplicationId.newInstance(System.currentTimeMillis(), 1),
|
|
ApplicationId.newInstance(System.currentTimeMillis(), 1),
|
|
"password"), "password").getCertificateChain("server"));
|
|
"password"), "password").getCertificateChain("server"));
|
|
- Assert.assertTrue(verifier.verify("foo", sslSession));
|
|
|
|
|
|
+ assertTrue(verifier.verify("foo", sslSession));
|
|
}
|
|
}
|
|
|
|
|
|
@Test
|
|
@Test
|
|
- public void testCreateHostnameVerifierSSLPeerUnverifiedException()
|
|
|
|
|
|
+ void testCreateHostnameVerifierSSLPeerUnverifiedException()
|
|
throws Exception {
|
|
throws Exception {
|
|
ProxyCA proxyCA = new ProxyCA();
|
|
ProxyCA proxyCA = new ProxyCA();
|
|
proxyCA.init();
|
|
proxyCA.init();
|
|
@@ -463,11 +472,11 @@ public class TestProxyCA {
|
|
SSLSession sslSession = Mockito.mock(SSLSession.class);
|
|
SSLSession sslSession = Mockito.mock(SSLSession.class);
|
|
Mockito.when(sslSession.getPeerCertificates()).thenThrow(
|
|
Mockito.when(sslSession.getPeerCertificates()).thenThrow(
|
|
new SSLPeerUnverifiedException(""));
|
|
new SSLPeerUnverifiedException(""));
|
|
- Assert.assertFalse(verifier.verify("foo", sslSession));
|
|
|
|
|
|
+ assertFalse(verifier.verify("foo", sslSession));
|
|
}
|
|
}
|
|
|
|
|
|
@Test
|
|
@Test
|
|
- public void testCreateHostnameVerifierWrongRM() throws Exception {
|
|
|
|
|
|
+ void testCreateHostnameVerifierWrongRM() throws Exception {
|
|
ProxyCA proxyCA = new ProxyCA();
|
|
ProxyCA proxyCA = new ProxyCA();
|
|
proxyCA.init();
|
|
proxyCA.init();
|
|
HostnameVerifier verifier = proxyCA.getHostnameVerifier();
|
|
HostnameVerifier verifier = proxyCA.getHostnameVerifier();
|
|
@@ -480,11 +489,11 @@ public class TestProxyCA {
|
|
proxyCA2.createChildKeyStore(
|
|
proxyCA2.createChildKeyStore(
|
|
ApplicationId.newInstance(System.currentTimeMillis(), 1),
|
|
ApplicationId.newInstance(System.currentTimeMillis(), 1),
|
|
"password"), "password").getCertificateChain("server"));
|
|
"password"), "password").getCertificateChain("server"));
|
|
- Assert.assertFalse(verifier.verify("foo", sslSession));
|
|
|
|
|
|
+ assertFalse(verifier.verify("foo", sslSession));
|
|
}
|
|
}
|
|
|
|
|
|
@Test
|
|
@Test
|
|
- public void testCreateHostnameVerifierExceptions() throws Exception {
|
|
|
|
|
|
+ void testCreateHostnameVerifierExceptions() throws Exception {
|
|
ProxyCA proxyCA = new ProxyCA();
|
|
ProxyCA proxyCA = new ProxyCA();
|
|
proxyCA.init();
|
|
proxyCA.init();
|
|
HostnameVerifier verifier = proxyCA.getHostnameVerifier();
|
|
HostnameVerifier verifier = proxyCA.getHostnameVerifier();
|
|
@@ -510,12 +519,12 @@ public class TestProxyCA {
|
|
return certChain;
|
|
return certChain;
|
|
}
|
|
}
|
|
});
|
|
});
|
|
- Assert.assertFalse(verifier.verify("foo", sslSession));
|
|
|
|
|
|
+ assertFalse(verifier.verify("foo", sslSession));
|
|
}
|
|
}
|
|
}
|
|
}
|
|
|
|
|
|
@Test
|
|
@Test
|
|
- public void testCreateHostnameVerifierRealCert() throws Exception {
|
|
|
|
|
|
+ void testCreateHostnameVerifierRealCert() throws Exception {
|
|
ProxyCA proxyCA = new ProxyCA();
|
|
ProxyCA proxyCA = new ProxyCA();
|
|
proxyCA.init();
|
|
proxyCA.init();
|
|
HostnameVerifier verifier = proxyCA.getHostnameVerifier();
|
|
HostnameVerifier verifier = proxyCA.getHostnameVerifier();
|
|
@@ -534,11 +543,11 @@ public class TestProxyCA {
|
|
return certChain;
|
|
return certChain;
|
|
}
|
|
}
|
|
});
|
|
});
|
|
- Assert.assertTrue(verifier.verify("foo.com", sslSession));
|
|
|
|
|
|
+ assertTrue(verifier.verify("foo.com", sslSession));
|
|
}
|
|
}
|
|
|
|
|
|
@Test
|
|
@Test
|
|
- public void testCreateHostnameVerifierRealCertBad() throws Exception {
|
|
|
|
|
|
+ void testCreateHostnameVerifierRealCertBad() throws Exception {
|
|
ProxyCA proxyCA = new ProxyCA();
|
|
ProxyCA proxyCA = new ProxyCA();
|
|
proxyCA.init();
|
|
proxyCA.init();
|
|
HostnameVerifier verifier = proxyCA.getHostnameVerifier();
|
|
HostnameVerifier verifier = proxyCA.getHostnameVerifier();
|
|
@@ -557,27 +566,27 @@ public class TestProxyCA {
|
|
return certChain;
|
|
return certChain;
|
|
}
|
|
}
|
|
});
|
|
});
|
|
- Assert.assertFalse(verifier.verify("bar.com", sslSession));
|
|
|
|
|
|
+ assertFalse(verifier.verify("bar.com", sslSession));
|
|
}
|
|
}
|
|
|
|
|
|
private void checkCACert(X509Certificate caCert) {
|
|
private void checkCACert(X509Certificate caCert) {
|
|
- Assert.assertEquals(caCert.getSubjectX500Principal().toString(),
|
|
|
|
|
|
+ assertEquals(caCert.getSubjectX500Principal().toString(),
|
|
caCert.getIssuerDN().toString());
|
|
caCert.getIssuerDN().toString());
|
|
- Assert.assertEquals(caCert.getSubjectX500Principal().toString(),
|
|
|
|
|
|
+ assertEquals(caCert.getSubjectX500Principal().toString(),
|
|
caCert.getSubjectDN().toString());
|
|
caCert.getSubjectDN().toString());
|
|
- Assert.assertTrue("Expected CA certificate X500 Principal to start with" +
|
|
|
|
- " 'OU=YARN-', but did not: " + caCert.getSubjectX500Principal(),
|
|
|
|
- caCert.getSubjectX500Principal().toString().startsWith("OU=YARN-"));
|
|
|
|
- Assert.assertFalse("Found multiple fields in X500 Principal, when there " +
|
|
|
|
- "should have only been one: " + caCert.getSubjectX500Principal(),
|
|
|
|
- caCert.getSubjectX500Principal().toString().contains(","));
|
|
|
|
- Assert.assertEquals("SHA512withRSA", caCert.getSigAlgName());
|
|
|
|
- Assert.assertEquals(
|
|
|
|
|
|
+ assertTrue(caCert.getSubjectX500Principal().toString().startsWith("OU=YARN-"),
|
|
|
|
+ "Expected CA certificate X500 Principal to start with" +
|
|
|
|
+ " 'OU=YARN-', but did not: " + caCert.getSubjectX500Principal());
|
|
|
|
+ assertFalse(caCert.getSubjectX500Principal().toString().contains(","),
|
|
|
|
+ "Found multiple fields in X500 Principal, when there " +
|
|
|
|
+ "should have only been one: " + caCert.getSubjectX500Principal());
|
|
|
|
+ assertEquals("SHA512withRSA", caCert.getSigAlgName());
|
|
|
|
+ assertEquals(
|
|
new GregorianCalendar(2037, Calendar.DECEMBER, 31).getTime(),
|
|
new GregorianCalendar(2037, Calendar.DECEMBER, 31).getTime(),
|
|
caCert.getNotAfter());
|
|
caCert.getNotAfter());
|
|
- Assert.assertTrue("Expected certificate to have started but was not: "
|
|
|
|
- + caCert.getNotBefore(), caCert.getNotBefore().before(new Date()));
|
|
|
|
- Assert.assertEquals(0, caCert.getBasicConstraints());
|
|
|
|
|
|
+ assertTrue(caCert.getNotBefore().before(new Date()),
|
|
|
|
+ "Expected certificate to have started but was not: " + caCert.getNotBefore());
|
|
|
|
+ assertEquals(0, caCert.getBasicConstraints());
|
|
}
|
|
}
|
|
|
|
|
|
private void checkPrivatePublicKeys(PrivateKey privateKey,
|
|
private void checkPrivatePublicKeys(PrivateKey privateKey,
|
|
@@ -592,7 +601,7 @@ public class TestProxyCA {
|
|
signer = Signature.getInstance("SHA512withRSA");
|
|
signer = Signature.getInstance("SHA512withRSA");
|
|
signer.initVerify(publicKey);
|
|
signer.initVerify(publicKey);
|
|
signer.update(data);
|
|
signer.update(data);
|
|
- Assert.assertTrue(signer.verify(sig));
|
|
|
|
|
|
+ assertTrue(signer.verify(sig));
|
|
}
|
|
}
|
|
|
|
|
|
private X509Certificate[] castCertificateArrayToX509CertificateArray(
|
|
private X509Certificate[] castCertificateArrayToX509CertificateArray(
|