You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@poi.apache.org by ki...@apache.org on 2014/08/17 21:53:35 UTC
svn commit: r1618515 - in /poi/branches/xml_signature: .classpath build.xml
src/ooxml/java/org/apache/poi/poifs/crypt/dsig/services/TSPTimeStampService.java
src/ooxml/testcases/org/apache/poi/poifs/crypt/TestSignatureInfo.java
Author: kiwiwings
Date: Sun Aug 17 19:53:34 2014
New Revision: 1618515
URL: http://svn.apache.org/r1618515
Log:
starting tsp tests / removed mockito stuff again
Modified:
poi/branches/xml_signature/.classpath
poi/branches/xml_signature/build.xml
poi/branches/xml_signature/src/ooxml/java/org/apache/poi/poifs/crypt/dsig/services/TSPTimeStampService.java
poi/branches/xml_signature/src/ooxml/testcases/org/apache/poi/poifs/crypt/TestSignatureInfo.java
Modified: poi/branches/xml_signature/.classpath
URL: http://svn.apache.org/viewvc/poi/branches/xml_signature/.classpath?rev=1618515&r1=1618514&r2=1618515&view=diff
==============================================================================
--- poi/branches/xml_signature/.classpath (original)
+++ poi/branches/xml_signature/.classpath Sun Aug 17 19:53:34 2014
@@ -24,8 +24,6 @@
<classpathentry kind="lib" path="lib/junit-4.11.jar"/>
<classpathentry kind="lib" path="ooxml-lib/ooxml-schemas-1.1.jar" sourcepath="ooxml-lib/ooxml-schemas-src-1.1.jar"/>
<classpathentry kind="lib" path="ooxml-lib/ooxml-encryption-1.2.jar" sourcepath="ooxml-lib/ooxml-encryption-src-1.2.jar"/>
- <classpathentry kind="lib" path="lib/com.springsource.org.objenesis-1.0.0.jar"/>
<classpathentry kind="con" path="org.eclipse.jdt.launching.JRE_CONTAINER"/>
- <classpathentry kind="lib" path="lib/mockito-core-1.9.5.jar" sourcepath="E:/tmp/mavenRepo/org/mockito/mockito-core/1.9.5/mockito-core-1.9.5-sources.jar"/>
<classpathentry kind="output" path="build/eclipse"/>
</classpath>
Modified: poi/branches/xml_signature/build.xml
URL: http://svn.apache.org/viewvc/poi/branches/xml_signature/build.xml?rev=1618515&r1=1618514&r2=1618515&view=diff
==============================================================================
--- poi/branches/xml_signature/build.xml (original)
+++ poi/branches/xml_signature/build.xml Sun Aug 17 19:53:34 2014
@@ -151,10 +151,6 @@ under the License.
<property name="test.bouncycastle-prov.url" value="${repository.m2}/maven2/org/bouncycastle/bcprov-ext-jdk15on/1.51/bcprov-ext-jdk15on-1.51.jar"/>
<property name="test.bouncycastle-pkix.jar" location="${main.lib}/bcpkix-jdk15on-151.jar"/>
<property name="test.bouncycastle-pkix.url" value="${repository.m2}/maven2/org/bouncycastle/bcpkix-jdk15on/1.51/bcpkix-jdk15on-151.jar"/>
- <property name="test.mockito.jar" location="${main.lib}/mockito-core-1.9.5.jar"/>
- <property name="test.mockito.url" value="${repository.m2}/maven2/org/mockito/mockito-core/1.9.5/mockito-core-1.9.5.jar"/>
- <property name="test.objenesis.jar" location="${main.lib}/com.springsource.org.objenesis-1.0.0.jar"/>
- <property name="test.objenesis.url" value="http://repository.springsource.com/ivy/bundles/external/org.objenesis/com.springsource.org.objenesis/1.0.0/com.springsource.org.objenesis-1.0.0.jar"/>
<!-- jars in the lib-ooxml directory, see the fetch-ooxml-jars target-->
<property name="ooxml.xmlbeans23.jar" location="${ooxml.lib}/xmlbeans-2.3.0.jar"/>
@@ -267,8 +263,6 @@ under the License.
<pathelement location="${ooxml.output.dir}"/>
<pathelement location="${ooxml.output.test.dir}"/>
<pathelement location="${main.output.test.dir}"/>
- <pathelement location="${test.mockito.jar}"/>
- <pathelement location="${test.objenesis.jar}"/>
</path>
<path id="ooxml-lite.classpath">
@@ -444,14 +438,6 @@ under the License.
<param name="destfile" value="${rat.jar}"/>
</antcall>
<antcall target="downloadfile">
- <param name="sourcefile" value="${test.mockito.url}"/>
- <param name="destfile" value="${test.mockito.jar}"/>
- </antcall>
- <antcall target="downloadfile">
- <param name="sourcefile" value="${test.objenesis.url}"/>
- <param name="destfile" value="${test.objenesis.jar}"/>
- </antcall>
- <antcall target="downloadfile">
<param name="sourcefile" value="${test.bouncycastle-prov.url}"/>
<param name="destfile" value="${test.bouncycastle-prov.jar}"/>
</antcall>
Modified: poi/branches/xml_signature/src/ooxml/java/org/apache/poi/poifs/crypt/dsig/services/TSPTimeStampService.java
URL: http://svn.apache.org/viewvc/poi/branches/xml_signature/src/ooxml/java/org/apache/poi/poifs/crypt/dsig/services/TSPTimeStampService.java?rev=1618515&r1=1618514&r2=1618515&view=diff
==============================================================================
--- poi/branches/xml_signature/src/ooxml/java/org/apache/poi/poifs/crypt/dsig/services/TSPTimeStampService.java (original)
+++ poi/branches/xml_signature/src/ooxml/java/org/apache/poi/poifs/crypt/dsig/services/TSPTimeStampService.java Sun Aug 17 19:53:34 2014
@@ -24,6 +24,9 @@
package org.apache.poi.poifs.crypt.dsig.services;
+import static org.apache.poi.poifs.crypt.dsig.HorribleProxy.createProxy;
+import static org.apache.poi.poifs.crypt.dsig.HorribleProxy.newProxy;
+
import java.io.ByteArrayInputStream;
import java.io.ByteArrayOutputStream;
import java.io.OutputStream;
@@ -48,6 +51,7 @@ import javax.xml.bind.DatatypeConverter;
import org.apache.commons.codec.binary.Hex;
import org.apache.poi.poifs.crypt.CryptoFunctions;
+import org.apache.poi.poifs.crypt.HashAlgorithm;
import org.apache.poi.poifs.crypt.dsig.HorribleProxies.ASN1InputStreamIf;
import org.apache.poi.poifs.crypt.dsig.HorribleProxies.ASN1OctetStringIf;
import org.apache.poi.poifs.crypt.dsig.HorribleProxies.AuthorityKeyIdentifierIf;
@@ -64,7 +68,6 @@ import org.apache.poi.poifs.crypt.dsig.H
import org.apache.poi.poifs.crypt.dsig.HorribleProxies.TimeStampResponseIf;
import org.apache.poi.poifs.crypt.dsig.HorribleProxies.TimeStampTokenIf;
import org.apache.poi.poifs.crypt.dsig.HorribleProxies.X509CertificateHolderIf;
-import org.apache.poi.poifs.crypt.dsig.HorribleProxy;
import org.apache.poi.util.IOUtils;
import org.apache.poi.util.POILogFactory;
import org.apache.poi.util.POILogger;
@@ -83,7 +86,7 @@ public class TSPTimeStampService impleme
CryptoFunctions.registerBouncyCastle();
}
- public static final String DEFAULT_USER_AGENT = "eID Applet Service TSP Client";
+ public static final String DEFAULT_USER_AGENT = "POI XmlSign Service TSP Client";
private final String tspServiceUrl;
@@ -101,7 +104,7 @@ public class TSPTimeStampService impleme
private int proxyPort;
- private String digestAlgo;
+ private HashAlgorithm digestAlgo;
private String digestAlgoOid;
@@ -143,9 +146,8 @@ public class TSPTimeStampService impleme
} else {
this.userAgent = DEFAULT_USER_AGENT;
}
-
- this.digestAlgo = "SHA-1";
- this.digestAlgoOid = "1.3.14.3.2.26";
+
+ setDigestAlgo(HashAlgorithm.sha1);
}
/**
@@ -183,16 +185,21 @@ public class TSPTimeStampService impleme
*
* @param digestAlgo
*/
- public void setDigestAlgo(String digestAlgo) {
- if ("SHA-1".equals(digestAlgo)) {
- this.digestAlgoOid = "1.3.14.3.2.26";
- } else if ("SHA-256".equals(digestAlgo)) {
- this.digestAlgoOid = "2.16.840.1.101.3.4.2.1";
- } else if ("SHA-384".equals(digestAlgo)) {
- this.digestAlgoOid = "2.16.840.1.101.3.4.2.2";
- } else if ("SHA-512".equals(digestAlgo)) {
- this.digestAlgoOid = "2.16.840.1.101.3.4.2.3";
- } else {
+ public void setDigestAlgo(HashAlgorithm digestAlgo) {
+ switch (digestAlgo) {
+ case sha1:
+ digestAlgoOid = "1.3.14.3.2.26";
+ break;
+ case sha256:
+ digestAlgoOid = "2.16.840.1.101.3.4.2.1";
+ break;
+ case sha384:
+ digestAlgoOid = "2.16.840.1.101.3.4.2.2";
+ break;
+ case sha512:
+ digestAlgoOid = "2.16.840.1.101.3.4.2.3";
+ break;
+ default:
throw new IllegalArgumentException("unsupported digest algo: " + digestAlgo);
}
@@ -222,13 +229,12 @@ public class TSPTimeStampService impleme
public byte[] timeStamp(byte[] data, RevocationData revocationData)
throws Exception {
// digest the message
- MessageDigest messageDigest = MessageDigest
- .getInstance(this.digestAlgo);
+ MessageDigest messageDigest = CryptoFunctions.getMessageDigest(this.digestAlgo);
byte[] digest = messageDigest.digest(data);
// generate the TSP request
BigInteger nonce = new BigInteger(128, new SecureRandom());
- TimeStampRequestGeneratorIf requestGenerator = HorribleProxy.newProxy(TimeStampRequestGeneratorIf.class);
+ TimeStampRequestGeneratorIf requestGenerator = newProxy(TimeStampRequestGeneratorIf.class);
requestGenerator.setCertReq(true);
if (null != this.requestPolicy) {
requestGenerator.setReqPolicy(this.requestPolicy);
@@ -250,7 +256,8 @@ public class TSPTimeStampService impleme
huc.setDoOutput(true); // also sets method to POST.
huc.setRequestProperty("User-Agent", this.userAgent);
- huc.setRequestProperty("Content-Type", "application/timestamp-query;charset=ISO-8859-1");
+ // "application/timestamp-query;charset=ISO-8859-1"
+ huc.setRequestProperty("Content-Type", "application/timestamp-request");
OutputStream hucOut = huc.getOutputStream();
hucOut.write(encodedRequest);
@@ -274,7 +281,8 @@ public class TSPTimeStampService impleme
IOUtils.copy(huc.getInputStream(), bos);
LOG.log(POILogger.DEBUG, "response content: ", bos.toString());
- if (!contentType.startsWith("application/timestamp-reply")) {
+ // "application/timestamp-reply"
+ if (!contentType.startsWith("application/timestamp-response")) {
throw new RuntimeException("invalid Content-Type: " + contentType);
}
@@ -283,7 +291,7 @@ public class TSPTimeStampService impleme
}
// TSP response parsing and validation
- TimeStampResponseIf timeStampResponse = HorribleProxy.newProxy(TimeStampResponseIf.class, bos.toByteArray());
+ TimeStampResponseIf timeStampResponse = newProxy(TimeStampResponseIf.class, bos.toByteArray());
timeStampResponse.validate(request);
if (0 != timeStampResponse.getStatus()) {
@@ -346,10 +354,10 @@ public class TSPTimeStampService impleme
} while (null != certificate);
// verify TSP signer signature
- X509CertificateHolderIf holder = HorribleProxy.newProxy(X509CertificateHolderIf.class, tspCertificateChain.get(0).getEncoded());
- DefaultDigestAlgorithmIdentifierFinderIf finder = HorribleProxy.newProxy(DefaultDigestAlgorithmIdentifierFinderIf.class);
- BcDigestCalculatorProviderIf calculator = HorribleProxy.newProxy(BcDigestCalculatorProviderIf.class);
- BcRSASignerInfoVerifierBuilderIf verifierBuilder = HorribleProxy.newProxy(BcRSASignerInfoVerifierBuilderIf.class, finder, calculator);
+ X509CertificateHolderIf holder = newProxy(X509CertificateHolderIf.class, tspCertificateChain.get(0).getEncoded());
+ DefaultDigestAlgorithmIdentifierFinderIf finder = newProxy(DefaultDigestAlgorithmIdentifierFinderIf.class);
+ BcDigestCalculatorProviderIf calculator = newProxy(BcDigestCalculatorProviderIf.class);
+ BcRSASignerInfoVerifierBuilderIf verifierBuilder = newProxy(BcRSASignerInfoVerifierBuilderIf.class, finder, calculator);
SignerInformationVerifierIf verifier = verifierBuilder.build(holder);
timeStampToken.validate(verifier);
@@ -369,10 +377,10 @@ public class TSPTimeStampService impleme
byte[] extvalue = cert.getExtensionValue("2.5.29.14");
if (extvalue == null) return null;
- ASN1InputStreamIf keyCntStream = HorribleProxy.newProxy(ASN1InputStreamIf.class, new ByteArrayInputStream(extvalue));
- ASN1OctetStringIf cntStr = HorribleProxy.createProxy(ASN1OctetStringIf.class, "getInstance", keyCntStream.readObject$Object());
- ASN1InputStreamIf keyIdStream = HorribleProxy.newProxy(ASN1InputStreamIf.class, new ByteArrayInputStream(cntStr.getOctets()));
- SubjectKeyIdentifierIf keyId = HorribleProxy.createProxy(SubjectKeyIdentifierIf.class, "getInstance", keyIdStream.readObject$Object());
+ ASN1InputStreamIf keyCntStream = newProxy(ASN1InputStreamIf.class, new ByteArrayInputStream(extvalue));
+ ASN1OctetStringIf cntStr = createProxy(ASN1OctetStringIf.class, "getInstance", keyCntStream.readObject$Object());
+ ASN1InputStreamIf keyIdStream = newProxy(ASN1InputStreamIf.class, new ByteArrayInputStream(cntStr.getOctets()));
+ SubjectKeyIdentifierIf keyId = createProxy(SubjectKeyIdentifierIf.class, "getInstance", keyIdStream.readObject$Object());
return keyId.getKeyIdentifier();
}
@@ -382,10 +390,10 @@ public class TSPTimeStampService impleme
byte[] extvalue = cert.getExtensionValue("2.5.29.35");
if (extvalue == null) return null;
- ASN1InputStreamIf keyCntStream = HorribleProxy.newProxy(ASN1InputStreamIf.class, new ByteArrayInputStream(extvalue));
+ ASN1InputStreamIf keyCntStream = newProxy(ASN1InputStreamIf.class, new ByteArrayInputStream(extvalue));
DEROctetStringIf cntStr = keyCntStream.readObject$DERString();
- ASN1InputStreamIf keyIdStream = HorribleProxy.newProxy(ASN1InputStreamIf.class, new ByteArrayInputStream(cntStr.getOctets()));
- AuthorityKeyIdentifierIf keyId = HorribleProxy.newProxy(AuthorityKeyIdentifierIf.class, keyIdStream.readObject$Sequence());
+ ASN1InputStreamIf keyIdStream = newProxy(ASN1InputStreamIf.class, new ByteArrayInputStream(cntStr.getOctets()));
+ AuthorityKeyIdentifierIf keyId = newProxy(AuthorityKeyIdentifierIf.class, keyIdStream.readObject$Sequence());
return keyId.getKeyIdentifier();
}
Modified: poi/branches/xml_signature/src/ooxml/testcases/org/apache/poi/poifs/crypt/TestSignatureInfo.java
URL: http://svn.apache.org/viewvc/poi/branches/xml_signature/src/ooxml/testcases/org/apache/poi/poifs/crypt/TestSignatureInfo.java?rev=1618515&r1=1618514&r2=1618515&view=diff
==============================================================================
--- poi/branches/xml_signature/src/ooxml/testcases/org/apache/poi/poifs/crypt/TestSignatureInfo.java (original)
+++ poi/branches/xml_signature/src/ooxml/testcases/org/apache/poi/poifs/crypt/TestSignatureInfo.java Sun Aug 17 19:53:34 2014
@@ -26,12 +26,6 @@ package org.apache.poi.poifs.crypt;
import static org.junit.Assert.assertEquals;
import static org.junit.Assert.assertNotNull;
import static org.junit.Assert.assertTrue;
-import static org.mockito.Matchers.any;
-import static org.mockito.Matchers.eq;
-import static org.mockito.Mockito.mock;
-import static org.mockito.Mockito.times;
-import static org.mockito.Mockito.verify;
-import static org.mockito.Mockito.when;
import java.io.File;
import java.io.FileInputStream;
@@ -73,7 +67,9 @@ import org.apache.poi.poifs.crypt.dsig.f
import org.apache.poi.poifs.crypt.dsig.facets.XAdESXLSignatureFacet;
import org.apache.poi.poifs.crypt.dsig.services.RevocationData;
import org.apache.poi.poifs.crypt.dsig.services.RevocationDataService;
+import org.apache.poi.poifs.crypt.dsig.services.TSPTimeStampService;
import org.apache.poi.poifs.crypt.dsig.services.TimeStampService;
+import org.apache.poi.poifs.crypt.dsig.services.TimeStampServiceValidator;
import org.apache.poi.poifs.crypt.dsig.services.XmlSignatureService;
import org.apache.poi.poifs.crypt.dsig.spi.DigestInfo;
import org.apache.poi.util.IOUtils;
@@ -84,8 +80,6 @@ import org.etsi.uri.x01903.v13.DigestAlg
import org.etsi.uri.x01903.v13.QualifyingPropertiesType;
import org.junit.BeforeClass;
import org.junit.Test;
-import org.mockito.invocation.InvocationOnMock;
-import org.mockito.stubbing.Answer;
import org.w3.x2000.x09.xmldsig.SignatureDocument;
public class TestSignatureInfo {
@@ -210,23 +204,38 @@ public class TestSignatureInfo {
String testFile = "hello-world-unsigned.xlsx";
OPCPackage pkg = OPCPackage.open(copy(testdata.getFile(testFile)), PackageAccess.READ_WRITE);
+ initKeyPair("Test", "CN=Test");
+
// setup
EnvelopedSignatureFacet envelopedSignatureFacet = new EnvelopedSignatureFacet();
KeyInfoSignatureFacet keyInfoSignatureFacet = new KeyInfoSignatureFacet(true, false, false);
SignaturePolicyService signaturePolicyService = null;
XAdESSignatureFacet xadesSignatureFacet = new XAdESSignatureFacet(null, null, signaturePolicyService);
+ final X509CRL crl = PkiTestUtils.generateCrl(x509, keyPair.getPrivate());
+// TimeStampService timeStampService = new TimeStampService(){
+// public byte[] timeStamp(byte[] data, RevocationData revocationData) throws Exception {
+// revocationData.addCRL(crl);
+// return "time-stamp-token".getBytes();
+// }
+// };
+
+ // http://timestamping.edelweb.fr/service/tsp
+ // http://tsa.belgium.be/connect
+ String tspServiceUrl = "http://timestamping.edelweb.fr/service/tsp";
+ TimeStampServiceValidator tspValidator = new TimeStampServiceValidator() {
+ @Override
+ public void validate(List<X509Certificate> certificateChain,
+ RevocationData revocationData) throws Exception {
+ for (X509Certificate certificate : certificateChain) {
+ LOG.log(POILogger.DEBUG, "certificate: " + certificate.getSubjectX500Principal());
+ LOG.log(POILogger.DEBUG, "validity: " + certificate.getNotBefore() + " - " + certificate.getNotAfter());
+ }
+ }
+ };
- TimeStampService mockTimeStampService = mock(TimeStampService.class);
- RevocationDataService mockRevocationDataService = mock(RevocationDataService.class);
-
- XAdESXLSignatureFacet xadesXLSignatureFacet = new XAdESXLSignatureFacet(
- mockTimeStampService, mockRevocationDataService);
- XmlSignatureService testedInstance = new XmlSignatureService(HashAlgorithm.sha1, pkg);
- testedInstance.addSignatureFacet(envelopedSignatureFacet, keyInfoSignatureFacet,
- xadesSignatureFacet, xadesXLSignatureFacet);
+ TimeStampService timeStampService = new TSPTimeStampService(tspServiceUrl, tspValidator);
- initKeyPair("Test", "CN=Test");
List<X509Certificate> certificateChain = new ArrayList<X509Certificate>();
/*
* We need at least 2 certificates for the XAdES-C complete certificate
@@ -235,25 +244,25 @@ public class TestSignatureInfo {
certificateChain.add(x509);
certificateChain.add(x509);
- RevocationData revocationData = new RevocationData();
- final X509CRL crl = PkiTestUtils.generateCrl(x509, keyPair.getPrivate());
+ final RevocationData revocationData = new RevocationData();
revocationData.addCRL(crl);
OCSPRespIf ocspResp = PkiTestUtils.createOcspResp(x509, false,
x509, x509, keyPair.getPrivate(), "SHA1withRSA", cal.getTimeInMillis());
revocationData.addOCSP(ocspResp.getEncoded());
+
+ RevocationDataService revocationDataService = new RevocationDataService(){
+ public RevocationData getRevocationData(List<X509Certificate> certificateChain) {
+ return revocationData;
+ }
+ };
+
+ XAdESXLSignatureFacet xadesXLSignatureFacet = new XAdESXLSignatureFacet(
+ timeStampService, revocationDataService);
+ XmlSignatureService testedInstance = new XmlSignatureService(HashAlgorithm.sha1, pkg);
+ testedInstance.addSignatureFacet(envelopedSignatureFacet, keyInfoSignatureFacet,
+ xadesSignatureFacet, xadesXLSignatureFacet);
- when(mockTimeStampService.timeStamp(any(byte[].class), any(RevocationData.class)))
- .thenAnswer(new Answer<byte[]>(){
- public byte[] answer(InvocationOnMock invocation) throws Throwable {
- Object[] arguments = invocation.getArguments();
- RevocationData revocationData = (RevocationData) arguments[1];
- revocationData.addCRL(crl);
- return "time-stamp-token".getBytes();
- }
- });
- when(mockRevocationDataService.getRevocationData(eq(certificateChain)))
- .thenReturn(revocationData);
// operate
DigestInfo digestInfo = testedInstance.preSign(null, certificateChain, null, null, null);
@@ -279,10 +288,6 @@ public class TestSignatureInfo {
// Operate: postSign
testedInstance.postSign(signatureValue, certificateChain);
- // verify
- verify(mockTimeStampService, times(2)).timeStamp(any(byte[].class), any(RevocationData.class));
- verify(mockRevocationDataService).getRevocationData(certificateChain);
-
DOMValidateContext domValidateContext = new DOMValidateContext(
KeySelector.singletonKeySelector(keyPair.getPublic()),
testedInstance.getSignatureDocument().getDomNode());
@@ -389,4 +394,5 @@ public class TestSignatureInfo {
fos.close();
return tmpFile;
}
+
}
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@poi.apache.org
For additional commands, e-mail: commits-help@poi.apache.org