diff --git a/ReleaseNotes.md b/ReleaseNotes.md index 235dd3c..f8978c7 100644 --- a/ReleaseNotes.md +++ b/ReleaseNotes.md @@ -2,6 +2,10 @@ # Release notes PKI Test Suite +## Release 1.0.6 + +- upload binaries + ## Release 1.0.1 - migrate from maven based execution of approval tests to binary (jar) based diff --git a/docs/img/components.png b/docs/img/components.png index 4bc68d7..b2f365b 100644 Binary files a/docs/img/components.png and b/docs/img/components.png differ diff --git a/pki-testsuite/pom.xml b/pki-testsuite/pom.xml index 676896e..a9fec4d 100644 --- a/pki-testsuite/pom.xml +++ b/pki-testsuite/pom.xml @@ -4,10 +4,11 @@ de.gematik.pki.pkits pkits-global - 1.0.1 + 1.0.6 pki-testsuite + 1.0.6 pom PKITS Packaging diff --git a/pkits-common/pom.xml b/pkits-common/pom.xml index c2eb660..45b8e6e 100644 --- a/pkits-common/pom.xml +++ b/pkits-common/pom.xml @@ -4,10 +4,11 @@ de.gematik.pki.pkits pkits-global - 1.0.1 + 1.0.6 pkits-common + 1.0.6 Common Code Common code diff --git a/pkits-coverage-reports/pom.xml b/pkits-coverage-reports/pom.xml index abd7827..78d25a9 100644 --- a/pkits-coverage-reports/pom.xml +++ b/pkits-coverage-reports/pom.xml @@ -4,10 +4,11 @@ de.gematik.pki.pkits pkits-global - 1.0.1 + 1.0.6 pkits-coverage-reports + 1.0.6 Code Coverage Reports Code coverage reports diff --git a/pkits-ocsp-responder/pom.xml b/pkits-ocsp-responder/pom.xml index fbc7b20..50c14d1 100644 --- a/pkits-ocsp-responder/pom.xml +++ b/pkits-ocsp-responder/pom.xml @@ -4,10 +4,11 @@ de.gematik.pki.pkits pkits-global - 1.0.1 + 1.0.6 pkits-ocsp-responder + 1.0.6 OCSP Responder Simulator Spring Boot OCSP Responder diff --git a/pkits-sut-server-sim/pom.xml b/pkits-sut-server-sim/pom.xml index 27a0c77..538a3e8 100644 --- a/pkits-sut-server-sim/pom.xml +++ b/pkits-sut-server-sim/pom.xml @@ -4,10 +4,11 @@ de.gematik.pki.pkits pkits-global - 1.0.1 + 1.0.6 pkits-sut-server-sim + 1.0.6 Test Object Simulator (Server) Test object simulator (server) diff --git a/pkits-testsuite/pom.xml b/pkits-testsuite/pom.xml index 537f79f..6095c10 100644 --- a/pkits-testsuite/pom.xml +++ b/pkits-testsuite/pom.xml @@ -4,10 +4,11 @@ de.gematik.pki.pkits pkits-global - 1.0.1 + 1.0.6 pkits-testsuite + 1.0.6 PKI Test Suite PKI test suite @@ -29,7 +30,6 @@ 3.3.0 ${version.maven-surefire-plugin} - 1.6.1 http://localhost:8084/tsl/tsl.xml?activeTslSeqNr=700000 diff --git a/pkits-testsuite/src/main/java/de/gematik/pki/pkits/testsuite/approval/ApprovalTestsBaseIT.java b/pkits-testsuite/src/main/java/de/gematik/pki/pkits/testsuite/approval/ApprovalTestsBaseIT.java index 5d4eda6..8ae7f2e 100644 --- a/pkits-testsuite/src/main/java/de/gematik/pki/pkits/testsuite/approval/ApprovalTestsBaseIT.java +++ b/pkits-testsuite/src/main/java/de/gematik/pki/pkits/testsuite/approval/ApprovalTestsBaseIT.java @@ -36,6 +36,7 @@ import de.gematik.pki.gemlibpki.tsl.TslConverter; import de.gematik.pki.gemlibpki.tsl.TslReader; +import de.gematik.pki.gemlibpki.tsl.TslUtils; import de.gematik.pki.gemlibpki.utils.CertReader; import de.gematik.pki.gemlibpki.utils.GemLibPkiUtils; import de.gematik.pki.gemlibpki.utils.P12Container; @@ -44,6 +45,7 @@ import de.gematik.pki.pkits.ocsp.responder.data.OcspResponderConfigDto; import de.gematik.pki.pkits.testsuite.UseCase; import de.gematik.pki.pkits.testsuite.approval.support.OcspResponderType; +import de.gematik.pki.pkits.testsuite.approval.support.OcspSeqNrUpdateMode; import de.gematik.pki.pkits.testsuite.approval.support.PcapHelper; import de.gematik.pki.pkits.testsuite.approval.support.PcapManager; import de.gematik.pki.pkits.testsuite.approval.support.TestResultLoggerExtension; @@ -66,6 +68,7 @@ import de.gematik.pki.pkits.testsuite.config.TestSuiteConfig; import de.gematik.pki.pkits.testsuite.config.TslSettings; import de.gematik.pki.pkits.testsuite.exceptions.TestSuiteException; +import eu.europa.esig.trustedlist.jaxb.tsl.TrustStatusListType; import java.io.IOException; import java.lang.reflect.Method; import java.math.BigInteger; @@ -78,6 +81,7 @@ import java.util.List; import java.util.Map; import java.util.Optional; +import java.util.function.Consumer; import java.util.function.Function; import javax.xml.datatype.DatatypeConfigurationException; import lombok.NonNull; @@ -85,6 +89,11 @@ import org.apache.commons.lang3.ObjectUtils; import org.apache.commons.lang3.StringUtils; import org.awaitility.core.ConditionTimeoutException; +import org.bouncycastle.asn1.x500.RDN; +import org.bouncycastle.asn1.x500.X500Name; +import org.bouncycastle.asn1.x500.style.BCStyle; +import org.bouncycastle.asn1.x500.style.IETFUtils; +import org.bouncycastle.cert.jcajce.JcaX509CertificateHolder; import org.junit.jupiter.api.AfterAll; import org.junit.jupiter.api.AfterEach; import org.junit.jupiter.api.BeforeAll; @@ -304,7 +313,7 @@ protected void testCaseMessage(@NonNull final TestInfo testInfo) { .forEach(afo -> log.info("{} - {}", afo.afoId(), afo.description())); } - protected void initialState() throws DatatypeConfigurationException, IOException { + protected void initialState() { currentTestInfo.setPhase("initialState"); @@ -313,7 +322,6 @@ protected void initialState() throws DatatypeConfigurationException, IOException if (tslSettings.isInitialStateTslImport()) { initialTslDownloadByTestObject(); } else { - // tslSequenceNr.setExpectedNrInTestObject(tslSequenceNr.getCurrentNrInTestObject()); log.info( "\n===> Initial state TSL import skipped by user request. - {}\n", currentTestInfo); } @@ -330,7 +338,9 @@ protected void initialState() throws DatatypeConfigurationException, IOException currentTestInfo.resetPhase(); } - void initialStateWithAlternativeTemplate() throws DatatypeConfigurationException, IOException { + void initialStateWithAlternativeTemplate() { + + currentTestInfo.setPhase("initialStateWithAlternativeTemplate"); log.info("initialStateWithAlternativeTemplate - start"); final int offeredSeqNr = tslSequenceNr.getNextTslSeqNr(); @@ -344,7 +354,8 @@ void initialStateWithAlternativeTemplate() throws DatatypeConfigurationException tslTemplate, defaultTslSigner, SIGNER_KEY_USAGE_CHECK_ENABLED, - SIGNER_VALIDITY_CHECK_ENABLED); + SIGNER_VALIDITY_CHECK_ENABLED, + null); tslSequenceNr.setLastOfferedNr(offeredSeqNr); tslDownload.waitUntilTslDownloadCompleted(IGNORE_SEQUENCE_NUMBER, IGNORE_SEQUENCE_NUMBER); @@ -354,17 +365,20 @@ void initialStateWithAlternativeTemplate() throws DatatypeConfigurationException final Path certPath = getPathOfAlternativeCertificate(); useCaseWithCert(certPath, USECASE_VALID, OCSP_RESP_TYPE_DEFAULT_USECASE, OCSP_REQUEST_EXPECT); + + currentTestInfo.resetPhase(); log.info("initialStateWithAlternativeTemplate - finish\n\n"); } void updateTrustStore( + final String description, final Path tslTemplate, final Path tslSignerP12Path, final OcspRequestExpectationBehaviour ocspRequestExpectationBehaviour, final Path useCaseCertPath, - final UseCaseResult useCaseResult) - throws DatatypeConfigurationException, IOException { + final UseCaseResult useCaseResult) { updateTrustStore( + description, tslTemplate, tslSignerP12Path, ocspRequestExpectationBehaviour, @@ -374,16 +388,46 @@ void updateTrustStore( } void updateTrustStore( + final String description, final Path tslTemplate, final Path tslSignerP12Path, final OcspRequestExpectationBehaviour ocspRequestExpectationBehaviour, final Path useCaseCertPath, final UseCaseResult useCaseResult, - final OcspRequestExpectationBehaviour ocspRequestExpectationBehaviourForUseCase) - throws DatatypeConfigurationException, IOException { + final OcspRequestExpectationBehaviour ocspRequestExpectationBehaviourForUseCase) { + updateTrustStore( + description, + tslTemplate, + tslSignerP12Path, + ocspRequestExpectationBehaviour, + useCaseCertPath, + useCaseResult, + ocspRequestExpectationBehaviourForUseCase, + null, + OcspSeqNrUpdateMode.DO_NOT_UPDATE_OCSP_SEQ_NR); + } + + void updateTrustStore( + final String description, + final Path tslTemplate, + final Path tslSignerP12Path, + final OcspRequestExpectationBehaviour ocspRequestExpectationBehaviour, + final Path useCaseCertPath, + final UseCaseResult useCaseResult, + final OcspRequestExpectationBehaviour ocspRequestExpectationBehaviourForUseCase, + final Consumer modifyTsl, + final OcspSeqNrUpdateMode ocspSeqNrUpdateMode) { + + final String customPhaseName = StringUtils.substringBetween(description, "<", ">"); + final String phaseName = StringUtils.defaultString(customPhaseName, "updateTrustStore"); + + currentTestInfo.setPhase(phaseName); + + log.info( + "START updateTrustStore -\ndescription: {},\n{}\n", + description, + PkitsTestSuiteUtils.getCallerTrace()); - currentTestInfo.setPhase("updateTrustStore"); - log.info("START updateTrustStore - {}", PkitsTestSuiteUtils.getCallerTrace()); final int offeredSeqNr = tslSequenceNr.getNextTslSeqNr(); log.info("Offering TSL with seqNr. {} for download.", offeredSeqNr); @@ -393,7 +437,8 @@ void updateTrustStore( tslTemplate, tslSignerP12Path, SIGNER_KEY_USAGE_CHECK_ENABLED, - SIGNER_VALIDITY_CHECK_ENABLED); + SIGNER_VALIDITY_CHECK_ENABLED, + modifyTsl); tslDownload.configureOcspResponderTslSignerStatusGood(); tslSequenceNr.setLastOfferedNr(offeredSeqNr); @@ -406,12 +451,17 @@ void updateTrustStore( } else if (ocspRequestExpectationBehaviour == OCSP_REQUEST_IGNORE) { tslDownload.waitUntilOcspRequestForSignerOptional(); } else { - throw new TestSuiteException("not implemented"); + assertNoOcspRequest(tslDownload); + } + + if (ocspSeqNrUpdateMode == OcspSeqNrUpdateMode.UPDATE_OCSP_SEQ_NR) { + setExpectedOcspTslSeqNr(tslSequenceNr.getExpectedNrInTestObject()); } if (useCaseResult == null) { log.info( - "END updateTrustStore (without useCaseResult) - {}", + "END updateTrustStore (without useCaseResult) -\ndescription: {},\n{}\n", + description, PkitsTestSuiteUtils.getCallerTrace()); return; } @@ -428,7 +478,11 @@ void updateTrustStore( useCaseWithCert( useCaseCertPath, useCaseResult, OCSP_RESP_TYPE_DEFAULT_USECASE, ocspRequestExpectation); - log.info("END updateTrustStore - {}", PkitsTestSuiteUtils.getCallerTrace()); + log.info( + "END updateTrustStore (with useCaseResult) -\ndescription: {},\n{}\n", + description, + PkitsTestSuiteUtils.getCallerTrace()); + currentTestInfo.resetPhase(); } @@ -504,7 +558,6 @@ private void useCaseWithCert( ocspRequestExpectationBehaviour); assertThat(UseCase.exec(certPath)).as(message).isEqualTo(useCaseResult.getExpectedReturnCode()); - // mje 14.2. tslSequenceNr.saveCurrentTestObjectSeqNr(tslSequenceNr.getLastOfferedNr()); if (ocspRequestExpectationBehaviour != OCSP_REQUEST_IGNORE) { log.info("{}", tslSequenceNr); @@ -597,31 +650,29 @@ private void checkOcspHistory( OcspHistory.check(ocspRespUri, certSerialNr, tslSequenceNr, ocspRequestExpectationBehaviour); } - TslDownload getTslDownloadDefaultTemplate(final int offeredSeqNr) - throws DatatypeConfigurationException, IOException { + TslDownload getTslDownloadDefaultTemplate(final int offeredSeqNr) { return getTslDownloadWithTemplate(offeredSeqNr, tslSettings.getDefaultTemplate()); } - TslDownload getTslDownloadAlternativeTemplate(final int offeredSeqNr) - throws DatatypeConfigurationException, IOException { + TslDownload getTslDownloadAlternativeTemplate(final int offeredSeqNr) { return getTslDownloadWithTemplate(offeredSeqNr, tslSettings.getAlternativeTemplate()); } protected static final String TSL_DIRNAME = "./out/tsl"; protected static final String TSL_FILENAME_PREFIX = "Tsl_"; - protected static Path getTslOutputPath(final BigInteger tslSeqNr, final String tslId) { - return Path.of(TSL_DIRNAME, "%s%04d_%s.xml".formatted(TSL_FILENAME_PREFIX, tslSeqNr, tslId)); + protected static Path getTslOutputPath(final BigInteger tslSeqNr, final String postfix) { + return Path.of(TSL_DIRNAME, "%s%04d_%s.xml".formatted(TSL_FILENAME_PREFIX, tslSeqNr, postfix)); } - TslDownload getTslDownloadWithTemplate(final int offeredSeqNr, final Path template) - throws DatatypeConfigurationException, IOException { + TslDownload getTslDownloadWithTemplate(final int offeredSeqNr, final Path template) { return getTslDownloadWithTemplateAndSigner( offeredSeqNr, template, defaultTslSigner, SIGNER_KEY_USAGE_CHECK_ENABLED, - SIGNER_VALIDITY_CHECK_ENABLED); + SIGNER_VALIDITY_CHECK_ENABLED, + null); } TslDownload getTslDownloadWithTemplateAndSigner( @@ -629,8 +680,8 @@ TslDownload getTslDownloadWithTemplateAndSigner( final Path tslTemplate, final Path tslSignerP12Path, final boolean signerKeyUsageCheck, - final boolean signerValidityCheck) - throws DatatypeConfigurationException, IOException { + final boolean signerValidityCheck, + final Consumer modifyTsl) { final P12Container tslSignerP12 = P12Reader.getContentFromP12( @@ -658,6 +709,10 @@ TslDownload getTslDownloadWithTemplateAndSigner( .tslSignerCert(tslSignerCert) .build(); + if (modifyTsl != null) { + modifyTsl.accept(tslDownload); + } + writeTsl(tslDownload, ""); return tslDownload; @@ -679,30 +734,55 @@ protected void signAndSetTslBytes( tslDownload.setTslBytes(tslBytesSigned); } - protected void writeTsl(final TslDownload tslDownload, final String postfix) throws IOException { + private static String getCertIssuerCn(final TrustStatusListType tsl) { + try { + final X509Certificate signerCert = TslUtils.getFirstTslSignerCertificate(tsl); + + final X500Name x500name = new JcaX509CertificateHolder(signerCert).getIssuer(); + final RDN cnRdn = x500name.getRDNs(BCStyle.CN)[0]; + + final String issuerCn = IETFUtils.valueToString(cnRdn.getFirst().getValue()); + + return "_" + StringUtils.replace(issuerCn, " ", "_"); + + } catch (final Exception e) { + } + + return ""; + } + + protected void writeTsl(final TslDownload tslDownload, final String postfix) { final String phase = StringUtils.isNotBlank(currentTestInfo.getPhase()) ? "__" + currentTestInfo.getPhase() : ""; + final String trustAnchorIssuerCn = getCertIssuerCn(tslDownload.getTsl()); + + final String extendedPostfix = + "%s__%s_n%d%s%s%s" + .formatted( + tslDownload.getTsl().getId(), + currentTestInfo.getMethodName(), + currentTestInfo.tslCounter, + phase, + postfix, + trustAnchorIssuerCn); + final Path tslOutputPath = - getTslOutputPath( - TslReader.getSequenceNumber(tslDownload.getTsl()), - tslDownload.getTsl().getId() - + "__" - + currentTestInfo.getMethodName() - + "_n" - + currentTestInfo.tslCounter - + phase - + postfix); + getTslOutputPath(TslReader.getSequenceNumber(tslDownload.getTsl()), extendedPostfix); currentTestInfo.tslCounter++; - if (!Files.exists(tslOutputPath.getParent())) { - Files.createDirectories(tslOutputPath.getParent()); - Files.createFile(tslOutputPath); + try { + if (!Files.exists(tslOutputPath.getParent())) { + Files.createDirectories(tslOutputPath.getParent()); + Files.createFile(tslOutputPath); + } + Files.write(tslOutputPath, tslDownload.getTslBytes()); + log.info("saved TSL to file: {}", tslOutputPath); + } catch (final IOException e) { + throw new TestSuiteException("cannot save TSL to file", e); } - Files.write(tslOutputPath, tslDownload.getTslBytes()); - log.info("saved TSL to file: {}", tslOutputPath); } protected void assignOcspTslSeqNrFromHistory( @@ -713,15 +793,10 @@ protected void assignOcspTslSeqNrFromHistory( final int currentTslSeqNrForOcsp = lastOcspRequestHistoryEntries.get(lastOcspRequestHistoryEntries.size() - 1).getTslSeqNr(); - // if (currentTslSeqNrForOcsp == offeredSeqNr) { - // throw new TestSuiteException("tslSeqNr equals to offeredSeqNr " + offeredSeqNr); - // } - setExpectedOcspTslSeqNr(currentTslSeqNrForOcsp); } - protected TslDownload initialTslDownloadByTestObject() - throws DatatypeConfigurationException, IOException { + protected TslDownload initialTslDownloadByTestObject() { final int offeredSeqNr = tslSequenceNr.getNextTslSeqNr(); log.info("Offering TSL with seqNr. {} for download.", offeredSeqNr); @@ -747,17 +822,20 @@ protected static byte[] createTslForTestObject( final String tslSingerPassw, final int seqNr, final boolean signerKeyUsageCheck, - final boolean signerValidityCheck) - throws DatatypeConfigurationException { + final boolean signerValidityCheck) { final TslModification tslModification = getTslModification(seqNr); - return TslGeneration.createTslFromFile( - tslTemplate, - tslModification, - tslSinger, - tslSingerPassw, - signerKeyUsageCheck, - signerValidityCheck); + try { + return TslGeneration.createTslFromFile( + tslTemplate, + tslModification, + tslSinger, + tslSingerPassw, + signerKeyUsageCheck, + signerValidityCheck); + } catch (final DatatypeConfigurationException e) { + throw new TestSuiteException("cannot create TSL", e); + } } private static String getTslDownloadUrlPrimary(final int seqNr) { @@ -816,8 +894,7 @@ void retrieveCurrentTslSeqNrInTestObject() { @Test @Order(1) @DisplayName("Check initial state") - void checkInitialState(final TestInfo testInfo) - throws DatatypeConfigurationException, IOException { + void checkInitialState(final TestInfo testInfo) { testCaseMessage(testInfo); retrieveCurrentTslSeqNrInTestObject(); diff --git a/pkits-testsuite/src/main/java/de/gematik/pki/pkits/testsuite/approval/CertificateApprovalTestsIT.java b/pkits-testsuite/src/main/java/de/gematik/pki/pkits/testsuite/approval/CertificateApprovalTestsIT.java index d405975..759cf19 100644 --- a/pkits-testsuite/src/main/java/de/gematik/pki/pkits/testsuite/approval/CertificateApprovalTestsIT.java +++ b/pkits-testsuite/src/main/java/de/gematik/pki/pkits/testsuite/approval/CertificateApprovalTestsIT.java @@ -33,9 +33,7 @@ import de.gematik.pki.pkits.testsuite.common.VariableSource; import de.gematik.pki.pkits.testsuite.config.Afo; import de.gematik.pki.pkits.testsuite.config.TestEnvironment; -import java.io.IOException; import java.nio.file.Path; -import javax.xml.datatype.DatatypeConfigurationException; import lombok.extern.slf4j.Slf4j; import org.junit.jupiter.api.Disabled; import org.junit.jupiter.api.DisplayName; @@ -63,10 +61,11 @@ class CertificateApprovalTestsIT extends ApprovalTestsBaseIT { @ArgumentsSource(CertificateProvider.class) @VariableSource(value = PKITS_CERT_VALID) @DisplayName("Test use case with valid certificates") - void verifyConnectCertsValid(final Path certPath, final TestInfo testInfo) - throws DatatypeConfigurationException, IOException { + void verifyConnectCertsValid(final Path certPath, final TestInfo testInfo) { + testCaseMessage(testInfo); initialState(); + useCaseWithCert(certPath, USECASE_VALID, OCSP_RESP_TYPE_DEFAULT_USECASE, OCSP_REQUEST_EXPECT); } @@ -76,11 +75,9 @@ void verifyConnectCertsValid(final Path certPath, final TestInfo testInfo) @Afo(afoId = "GS-A_4384", description = "RSA cipher suites for TLS") @Disabled("Our SUT does not support RSA yet") @DisplayName("Test use case with valid RSA certificate") - void verifyConnectCertsValidRsa(final TestInfo testInfo) - throws DatatypeConfigurationException, IOException { + void verifyConnectCertsValidRsa(final TestInfo testInfo) { testCaseMessage(testInfo); - initialState(); final Path certPath = Path.of("./testDataTemplates/certificates/valid-rsa/ee_default-rsa.p12"); @@ -114,12 +111,11 @@ void verifyConnectCertsValidRsa(final TestInfo testInfo) @ArgumentsSource(CertificateProvider.class) @VariableSource(value = PKITS_CERT_INVALID) @DisplayName("Test use case with invalid certificates") - void verifyConnectCertsInvalid(final Path certPath, final TestInfo testInfo) - throws DatatypeConfigurationException, IOException { + void verifyConnectCertsInvalid(final Path certPath, final TestInfo testInfo) { testCaseMessage(testInfo); - initialState(); + useCaseWithCert(certPath, USECASE_INVALID, OCSP_RESP_TYPE_DEFAULT_USECASE, OCSP_REQUEST_IGNORE); } } diff --git a/pkits-testsuite/src/main/java/de/gematik/pki/pkits/testsuite/approval/ListApprovalTestsAndAfos.java b/pkits-testsuite/src/main/java/de/gematik/pki/pkits/testsuite/approval/ListApprovalTestsAndAfos.java index c2ca01a..9483cb7 100644 --- a/pkits-testsuite/src/main/java/de/gematik/pki/pkits/testsuite/approval/ListApprovalTestsAndAfos.java +++ b/pkits-testsuite/src/main/java/de/gematik/pki/pkits/testsuite/approval/ListApprovalTestsAndAfos.java @@ -440,6 +440,14 @@ public int compareTo(final CustomTestInfo o) { .toComparison(); } + boolean sameClassName(final String className) { + return StringUtils.equalsAny(className, getSimpleClassName(), getClassName()); + } + + boolean sameMethodName(final String methodName) { + return method.getName().equals(methodName); + } + @Override public String toString() { return "CustomTestInfo{class='%s', declaringClassName='%s', method='%s', displayName='%s'}" diff --git a/pkits-testsuite/src/main/java/de/gematik/pki/pkits/testsuite/approval/OcspApprovalTestsIT.java b/pkits-testsuite/src/main/java/de/gematik/pki/pkits/testsuite/approval/OcspApprovalTestsIT.java index 1bbd377..93efc83 100644 --- a/pkits-testsuite/src/main/java/de/gematik/pki/pkits/testsuite/approval/OcspApprovalTestsIT.java +++ b/pkits-testsuite/src/main/java/de/gematik/pki/pkits/testsuite/approval/OcspApprovalTestsIT.java @@ -37,9 +37,7 @@ import de.gematik.pki.pkits.testsuite.config.Afo; import de.gematik.pki.pkits.testsuite.config.TestEnvironment; import eu.europa.esig.dss.spi.x509.revocation.ocsp.OCSPRespStatus; -import java.io.IOException; import java.nio.file.Path; -import javax.xml.datatype.DatatypeConfigurationException; import lombok.extern.slf4j.Slf4j; import org.junit.jupiter.api.DisplayName; import org.junit.jupiter.api.Order; @@ -59,8 +57,7 @@ class OcspApprovalTestsIT extends ApprovalTestsBaseIT { @Test @Afo(afoId = "GS-A_4657", description = "TUC_PKI_006: OCSP-Abfrage - Schritt 1") @DisplayName("Test OCSP grace period") - void verifyOcspGracePeriod(final TestInfo testInfo) - throws DatatypeConfigurationException, IOException { + void verifyOcspGracePeriod(final TestInfo testInfo) { testCaseMessage(testInfo); initialState(); @@ -91,8 +88,7 @@ void verifyOcspGracePeriod(final TestInfo testInfo) @Test @Afo(afoId = "GS-A_4657", description = "TUC_PKI_006: OCSP-Abfrage - Schritt 4c") @DisplayName("Test OCSP response with timeout and delay") - void verifyOcspResponseTimeoutAndDelay(final TestInfo testInfo) - throws DatatypeConfigurationException, IOException { + void verifyOcspResponseTimeoutAndDelay(final TestInfo testInfo) { testCaseMessage(testInfo); initialState(); @@ -135,11 +131,11 @@ void verifyOcspResponseTimeoutAndDelay(final TestInfo testInfo) TestSuiteConstants.OCSP_SIGNER_NOT_IN_TSL_FILENAME, TestSuiteConstants.OCSP_SIGNER_DIFFERENT_KEY }) - void verifyMissingOcspSignerInTsl(final String signerFilename, final TestInfo testInfo) - throws DatatypeConfigurationException, IOException { + void verifyMissingOcspSignerInTsl(final String signerFilename, final TestInfo testInfo) { testCaseMessage(testInfo); initialState(); + final P12Container signer = P12Reader.getContentFromP12( ocspSettings.getKeystorePathOcsp().resolve(signerFilename), @@ -162,8 +158,7 @@ void verifyMissingOcspSignerInTsl(final String signerFilename, final TestInfo te @Test @Afo(afoId = "GS-A_4657", description = "TUC_PKI_006: OCSP-Abfrage - Schritt 5a1") @DisplayName("Test invalid signature in OCSP response") - void verifyInvalidSignatureInOcspResponse(final TestInfo testInfo) - throws DatatypeConfigurationException, IOException { + void verifyInvalidSignatureInOcspResponse(final TestInfo testInfo) { testCaseMessage(testInfo); initialState(); @@ -208,8 +203,7 @@ private void verifyOcspResponseDate( @Test @Afo(afoId = "GS-A_4657", description = "TUC_PKI_006: OCSP-Abfrage - Schritt 6") @DisplayName("Test OCSP response with producedAt in past within tolerance") - void verifyOcspResponseProducedAtPastWithinTolerance(final TestInfo testInfo) - throws DatatypeConfigurationException, IOException { + void verifyOcspResponseProducedAtPastWithinTolerance(final TestInfo testInfo) { testCaseMessage(testInfo); initialState(); @@ -226,8 +220,7 @@ void verifyOcspResponseProducedAtPastWithinTolerance(final TestInfo testInfo) @Test @Afo(afoId = "GS-A_4657", description = "TUC_PKI_006: OCSP-Abfrage - Schritt 6") @DisplayName("Test OCSP response with producedAt in past out of tolerance") - void verifyOcspResponseProducedAtPastOutOfTolerance(final TestInfo testInfo) - throws DatatypeConfigurationException, IOException { + void verifyOcspResponseProducedAtPastOutOfTolerance(final TestInfo testInfo) { testCaseMessage(testInfo); initialState(); @@ -244,8 +237,7 @@ void verifyOcspResponseProducedAtPastOutOfTolerance(final TestInfo testInfo) @Test @Afo(afoId = "GS-A_4657", description = "TUC_PKI_006: OCSP-Abfrage - Schritt 6") @DisplayName("Test OCSP response with producedAt in future within tolerance") - void verifyOcspResponseProducedAtFutureWithinTolerance(final TestInfo testInfo) - throws DatatypeConfigurationException, IOException { + void verifyOcspResponseProducedAtFutureWithinTolerance(final TestInfo testInfo) { testCaseMessage(testInfo); initialState(); @@ -272,8 +264,7 @@ void verifyOcspResponseProducedAtFutureWithinTolerance(final TestInfo testInfo) @Test @Afo(afoId = "GS-A_4657", description = "TUC_PKI_006: OCSP-Abfrage - Schritt 6") @DisplayName("Test OCSP response with producedAt in future out of tolerance") - void verifyOcspResponseProducedAtFutureOutOfTolerance(final TestInfo testInfo) - throws DatatypeConfigurationException, IOException { + void verifyOcspResponseProducedAtFutureOutOfTolerance(final TestInfo testInfo) { testCaseMessage(testInfo); initialState(); @@ -299,8 +290,7 @@ void verifyOcspResponseProducedAtFutureOutOfTolerance(final TestInfo testInfo) @Test @Afo(afoId = "GS-A_4657", description = "TUC_PKI_006: OCSP-Abfrage - Schritt 6") @DisplayName("Test OCSP response with thisUpdate in future within tolerance") - void verifyOcspResponseThisUpdateFutureWithinTolerance(final TestInfo testInfo) - throws DatatypeConfigurationException, IOException { + void verifyOcspResponseThisUpdateFutureWithinTolerance(final TestInfo testInfo) { testCaseMessage(testInfo); initialState(); @@ -327,8 +317,7 @@ void verifyOcspResponseThisUpdateFutureWithinTolerance(final TestInfo testInfo) @Test @Afo(afoId = "GS-A_4657", description = "TUC_PKI_006: OCSP-Abfrage - Schritt 6") @DisplayName("Test OCSP response with thisUpdate in future out of tolerance") - void verifyOcspResponseThisUpdateFutureOutOfTolerance(final TestInfo testInfo) - throws DatatypeConfigurationException, IOException { + void verifyOcspResponseThisUpdateFutureOutOfTolerance(final TestInfo testInfo) { testCaseMessage(testInfo); initialState(); @@ -355,8 +344,7 @@ void verifyOcspResponseThisUpdateFutureOutOfTolerance(final TestInfo testInfo) @Test @Afo(afoId = "GS-A_4657", description = "TUC_PKI_006: OCSP-Abfrage - Schritt 6") @DisplayName("Test OCSP response with nextUpdate in past within tolerance") - void verifyOcspResponseNextUpdatePastWithinTolerance(final TestInfo testInfo) - throws DatatypeConfigurationException, IOException { + void verifyOcspResponseNextUpdatePastWithinTolerance(final TestInfo testInfo) { testCaseMessage(testInfo); initialState(); @@ -373,8 +361,7 @@ void verifyOcspResponseNextUpdatePastWithinTolerance(final TestInfo testInfo) @Test @Afo(afoId = "GS-A_4657", description = "TUC_PKI_006: OCSP-Abfrage - Schritt 6") @DisplayName("Test OCSP response with nextUpdate in past out of tolerance") - void verifyOcspResponseNextUpdatePastOutOfTolerance(final TestInfo testInfo) - throws DatatypeConfigurationException, IOException { + void verifyOcspResponseNextUpdatePastOutOfTolerance(final TestInfo testInfo) { testCaseMessage(testInfo); initialState(); @@ -391,8 +378,7 @@ void verifyOcspResponseNextUpdatePastOutOfTolerance(final TestInfo testInfo) @Test @Afo(afoId = "GS-A_4657", description = "TUC_PKI_006: OCSP-Abfrage - Schritt 6") @DisplayName("Test OCSP response with missing nextUpdate") - void verifyOcspResponseMissingNextUpdate(final TestInfo testInfo) - throws DatatypeConfigurationException, IOException { + void verifyOcspResponseMissingNextUpdate(final TestInfo testInfo) { testCaseMessage(testInfo); initialState(); @@ -417,8 +403,9 @@ void verifyOcspResponseMissingNextUpdate(final TestInfo testInfo) "de.gematik.pki.pkits.testsuite.common.TestSuiteConstants#provideOcspResponseVariousStatusAndResponseBytes") @DisplayName("Test various status of OCSP responses with and without response bytes") void verifyOcspResponseVariousStatusAndResponseBytes( - final OCSPRespStatus ocspRespStatus, final boolean withResponseBytes, final TestInfo testInfo) - throws DatatypeConfigurationException, IOException { + final OCSPRespStatus ocspRespStatus, + final boolean withResponseBytes, + final TestInfo testInfo) { testCaseMessage(testInfo); initialState(); @@ -445,8 +432,7 @@ void verifyOcspResponseVariousStatusAndResponseBytes( @Afo(afoId = "GS-A_4657", description = "TUC_PKI_006: OCSP-Abfrage - Schritt 6b") @DisplayName("Test invalid cert id in OCSP response") void verifyInvalidCerIdInOcspResponse( - final CertificateIdGeneration certificateIdGeneration, final TestInfo testInfo) - throws DatatypeConfigurationException, IOException { + final CertificateIdGeneration certificateIdGeneration, final TestInfo testInfo) { testCaseMessage(testInfo); initialState(); @@ -469,8 +455,7 @@ void verifyInvalidCerIdInOcspResponse( @Test @Afo(afoId = "GS-A_4657", description = "TUC_PKI_006: OCSP-Abfrage - Schritt 7b") @DisplayName("Test missing CertHash in OCSP response") - void verifyMissingCertHashInOcspResponse(final TestInfo testInfo) - throws DatatypeConfigurationException, IOException { + void verifyMissingCertHashInOcspResponse(final TestInfo testInfo) { testCaseMessage(testInfo); initialState(); @@ -493,11 +478,11 @@ void verifyMissingCertHashInOcspResponse(final TestInfo testInfo) @Test @Afo(afoId = "GS-A_4657", description = "TUC_PKI_006: OCSP-Abfrage - Schritt 7c") @DisplayName("Test invalid CertHash in OCSP response") - void verifyInvalidCertHashInOcspResponse(final TestInfo testInfo) - throws DatatypeConfigurationException, IOException { + void verifyInvalidCertHashInOcspResponse(final TestInfo testInfo) { testCaseMessage(testInfo); initialState(); + final Path certPath = getPathOfFirstValidCert(); final OcspResponderConfigDto dto = @@ -520,8 +505,7 @@ void verifyInvalidCertHashInOcspResponse(final TestInfo testInfo) @Afo(afoId = "GS-A_4657", description = "TUC_PKI_006: OCSP-Abfrage - Schritt 8b und 8c") @DisplayName("Test OCSP response with certificate status revoked and unknown") void verifyOcspCertificateStatusRevokedAndUnknown( - final CustomCertificateStatusType customCertificateStatusType, final TestInfo testInfo) - throws DatatypeConfigurationException, IOException { + final CustomCertificateStatusType customCertificateStatusType, final TestInfo testInfo) { testCaseMessage(testInfo); initialState(); @@ -543,8 +527,7 @@ void verifyOcspCertificateStatusRevokedAndUnknown( @Test @Afo(afoId = "RFC 6960", description = "4.2.1. ASN.1 Specification of the OCSP Response") @DisplayName("Test OCSP response with responder id byName") - void verifyOcspResponseResponderIdByName(final TestInfo testInfo) - throws DatatypeConfigurationException, IOException { + void verifyOcspResponseResponderIdByName(final TestInfo testInfo) { testCaseMessage(testInfo); initialState(); @@ -569,8 +552,7 @@ void verifyOcspResponseResponderIdByName(final TestInfo testInfo) @ValueSource(booleans = {true, false}) @DisplayName("Test OCSP response with null parameter in CertId") void verifyOcspResponseWithNullParameterInCertId( - final boolean withNullParameterHashAlgoOfCertId, final TestInfo testInfo) - throws DatatypeConfigurationException, IOException { + final boolean withNullParameterHashAlgoOfCertId, final TestInfo testInfo) { testCaseMessage(testInfo); initialState(); diff --git a/pkits-testsuite/src/main/java/de/gematik/pki/pkits/testsuite/approval/PkitsTestsuiteRunner.java b/pkits-testsuite/src/main/java/de/gematik/pki/pkits/testsuite/approval/PkitsTestsuiteRunner.java index db774c2..4354f68 100644 --- a/pkits-testsuite/src/main/java/de/gematik/pki/pkits/testsuite/approval/PkitsTestsuiteRunner.java +++ b/pkits-testsuite/src/main/java/de/gematik/pki/pkits/testsuite/approval/PkitsTestsuiteRunner.java @@ -301,13 +301,27 @@ private static List parseTestNamesToInputTestInfos(final String t StringUtils.splitByWholeSeparatorPreserveAllTokens(testNamesStr, ","); return Arrays.stream(testNames) .map( - testName -> { + testOrClass -> { final String classNameSeparator = "#"; - String className = ""; - String methodName = testName; - if (testName.contains(classNameSeparator)) { - className = StringUtils.substringBefore(testName, classNameSeparator); - methodName = StringUtils.substringAfter(testName, classNameSeparator); + + String className; + String methodName; + + if (testOrClass.contains(classNameSeparator)) { + className = StringUtils.substringBefore(testOrClass, classNameSeparator); + methodName = StringUtils.substringAfter(testOrClass, classNameSeparator); + } else { + try { + // assuming all approval and utils test classes are in the same package as + // ApprovalTestsBaseIT + Class.forName( + ClassUtils.getPackageName(ApprovalTestsBaseIT.class) + "." + testOrClass); + className = testOrClass; + methodName = ""; + } catch (final ClassNotFoundException e) { + className = ""; + methodName = testOrClass; + } } return new InputTestInfo(className, methodName, true); }) @@ -321,27 +335,27 @@ static List getTestToRun( return inputTestInfoList.stream() .filter(inputTestInfo -> inputTestInfo.selected) - .map( + .flatMap( inputTestInfo -> { + final List matchedCustomTestInfos = new ArrayList<>(); for (final CustomTestInfo customTestInfo : customTestInfoList) { - final boolean sameClassName = - StringUtils.isBlank(inputTestInfo.className) - || StringUtils.equalsAny( - inputTestInfo.className, - customTestInfo.getSimpleClassName(), - customTestInfo.getClassName()); + final boolean sameClassName = customTestInfo.sameClassName(inputTestInfo.className); + final boolean sameMethodName = - customTestInfo.method.getName().equals(inputTestInfo.methodName); + customTestInfo.sameMethodName(inputTestInfo.methodName); - if (sameClassName && sameMethodName) { - return customTestInfo; + if (sameClassName || sameMethodName) { + matchedCustomTestInfos.add(customTestInfo); } } - throw new TestSuiteException( - "unknown test case: %s of class %s" - .formatted(inputTestInfo.methodName, inputTestInfo.className)); + if (matchedCustomTestInfos.isEmpty()) { + throw new TestSuiteException( + "unknown test case method <%s> or class with test cases <%s>" + .formatted(inputTestInfo.methodName, inputTestInfo.className)); + } + return matchedCustomTestInfos.stream(); }) .toList(); } diff --git a/pkits-testsuite/src/main/java/de/gematik/pki/pkits/testsuite/approval/TslApprovalTestsIT.java b/pkits-testsuite/src/main/java/de/gematik/pki/pkits/testsuite/approval/TslApprovalTestsIT.java index e2cc40d..529e16b 100644 --- a/pkits-testsuite/src/main/java/de/gematik/pki/pkits/testsuite/approval/TslApprovalTestsIT.java +++ b/pkits-testsuite/src/main/java/de/gematik/pki/pkits/testsuite/approval/TslApprovalTestsIT.java @@ -35,22 +35,24 @@ import de.gematik.pki.gemlibpki.utils.CertReader; import de.gematik.pki.gemlibpki.utils.GemLibPkiUtils; import de.gematik.pki.pkits.common.PkitsConstants; +import de.gematik.pki.pkits.testsuite.approval.support.OcspSeqNrUpdateMode; import de.gematik.pki.pkits.testsuite.common.PkitsTestSuiteUtils; import de.gematik.pki.pkits.testsuite.common.TestSuiteConstants; import de.gematik.pki.pkits.testsuite.common.tsl.TslDownload; import de.gematik.pki.pkits.testsuite.config.Afo; import de.gematik.pki.pkits.testsuite.config.TestEnvironment; +import de.gematik.pki.pkits.testsuite.exceptions.TestSuiteException; import de.gematik.pki.pkits.tsl.provider.api.TslProviderManager; import de.gematik.pki.pkits.tsl.provider.data.TslProviderConfigDto.TslProviderEndpointsConfig; import de.gematik.pki.pkits.tsl.provider.data.TslRequestHistoryEntryDto; import eu.europa.esig.trustedlist.jaxb.tsl.TrustStatusListType; -import java.io.IOException; import java.nio.charset.StandardCharsets; import java.nio.file.Path; import java.security.cert.X509Certificate; import java.time.ZonedDateTime; import java.util.List; import java.util.concurrent.Callable; +import java.util.function.Consumer; import java.util.stream.Collectors; import javax.xml.datatype.DatatypeConfigurationException; import lombok.extern.slf4j.Slf4j; @@ -67,11 +69,16 @@ class TslApprovalTestsIT extends ApprovalTestsBaseIT { public static final X509Certificate VALID_ISSUER_CERT_TSL_CA8 = CertReader.readX509(TestSuiteConstants.VALID_ISSUER_CERT_TSL_CA8_PATH); + + /** TSLTypeID 4 */ public static final Path alternativeCaRevokedPretty = Path.of(TSL_TEMPLATES_DIRNAME, "TSL_altCA_revoked_pretty.xml"); - private void verifyUpdateTrustStoreInTestObject_initialStateWithAlternativeCert() - throws DatatypeConfigurationException, IOException { + /** TSLTypeID 194 */ + public final Path tslAlternativeCaRevokedLater = + Path.of(TSL_TEMPLATES_DIRNAME, "TSL_altCA_revokedLater.xml"); + + private void verifyUpdateTrustStoreInTestObject_initialStateWithAlternativeCert() { log.info("verifyUpdateTrustStoreInTestObject: initialStateWithAlternativeCert"); @@ -89,8 +96,7 @@ private void verifyUpdateTrustStoreInTestObject_initialStateWithAlternativeCert( useCaseWithCert(certPath, USECASE_VALID, OCSP_RESP_TYPE_DEFAULT_USECASE, OCSP_REQUEST_EXPECT); } - private void verifyUpdateTrustStoreInTestObject1_AlternativeCaRevoked() - throws DatatypeConfigurationException, IOException { + private void verifyUpdateTrustStoreInTestObject1_AlternativeCaRevoked() { log.info("verifyUpdateTrustStoreInTestObject: case 1 - AlternativeCaRevoked"); final Path tslTemplatePath = tslSettings.getAlternativeRevokedTemplate(); @@ -109,8 +115,7 @@ private void verifyUpdateTrustStoreInTestObject1_AlternativeCaRevoked() useCaseWithCert(certPath, USECASE_INVALID, OCSP_RESP_TYPE_DEFAULT_USECASE, OCSP_REQUEST_EXPECT); } - private void verifyUpdateTrustStoreInTestObject2_AlternativeCaNoLineBreaks() - throws DatatypeConfigurationException, IOException { + private void verifyUpdateTrustStoreInTestObject2_AlternativeCaNoLineBreaks() { log.info("verifyUpdateTrustStoreInTestObject: case 2 - AlternativeCaNoLineBreaks"); final Path tslTemplatePath = testSuiteConfig @@ -132,8 +137,7 @@ private void verifyUpdateTrustStoreInTestObject2_AlternativeCaNoLineBreaks() useCaseWithCert(certPath, USECASE_VALID, OCSP_RESP_TYPE_DEFAULT_USECASE, OCSP_REQUEST_EXPECT); } - private void verifyUpdateTrustStoreInTestObject3_Default() - throws DatatypeConfigurationException, IOException { + private void verifyUpdateTrustStoreInTestObject3_Default() { log.info("verifyUpdateTrustStoreInTestObject: case 3 - Default"); final Path tslTemplatePath = testSuiteConfig.getTestSuiteParameter().getTslSettings().getDefaultTemplate(); @@ -158,8 +162,7 @@ private void verifyUpdateTrustStoreInTestObject3_Default() @Afo(afoId = "GS-A_4649", description = "TUC_PKI_020: XML-Dokument validieren") @DisplayName("Test update of TSL with different XML format (pretty print)") @Disabled("Correct Testcase with PrettyPrint TSL (PKITS-158 and GLP-263)") - void verifyUpdateTrustStoreInTestObject(final TestInfo testInfo) - throws DatatypeConfigurationException, IOException { + void verifyUpdateTrustStoreInTestObject(final TestInfo testInfo) { testCaseMessage(testInfo); @@ -176,8 +179,7 @@ void verifyUpdateTrustStoreInTestObject(final TestInfo testInfo) afoId = "TIP1-A_5120", description = "Clients des TSL-Dienstes: HTTP-Komprimierung unterstützen") @DisplayName("Test compression of TSL download") - void verifyTslDownloadCompression(final TestInfo testInfo) - throws DatatypeConfigurationException, IOException { + void verifyTslDownloadCompression(final TestInfo testInfo) { testCaseMessage(testInfo); initialState(); @@ -208,8 +210,7 @@ void verifyTslDownloadCompression(final TestInfo testInfo) @Test @Afo(afoId = "GS-A_4648", description = "TUC_PKI_019: Prüfung der Aktualität der TSL - Schritt 6") @DisplayName("Test TSL service does not provide updated TSL") - void verifyIrregularDifferencesBetweenCurrentAndNewTsls(final TestInfo testInfo) - throws DatatypeConfigurationException, IOException { + void verifyIrregularDifferencesBetweenCurrentAndNewTsls(final TestInfo testInfo) { testCaseMessage(testInfo); initialState(); @@ -262,25 +263,27 @@ void verifyIrregularDifferencesBetweenCurrentAndNewTsls(final TestInfo testInfo) "initial tsl seqNr: {}, id: {}", initialTslDownload.getTsl().getId(), initialTslDownload.getTsl().getSchemeInformation().getTSLSequenceNumber()); - final int offeredSeqNr = tslSequenceNr.getNextTslSeqNr(); - log.info("Offering TSL with seqNr. {} for download.", offeredSeqNr); - - final TslDownload tslDownload = getTslDownloadAlternativeTemplate(offeredSeqNr); - - final byte[] tslBytes = tslDownload.getTslBytes(); - - final String newId = initialTslDownload.getTsl().getId(); - final byte[] tslBytesWithNewId = TslModifier.modifiedTslId(tslBytes, newId); - signAndSetTslBytes(tslDownload, defaultTslSigner, tslBytesWithNewId); - writeTsl(tslDownload, "_modified"); - - tslSequenceNr.setLastOfferedNr(offeredSeqNr); - tslDownload.waitUntilTslDownloadCompletedOptional(tslSequenceNr.getExpectedNrInTestObject()); - - final Path certPath = getPathOfAlternativeCertificate(); - useCaseWithCert( - certPath, USECASE_INVALID, OCSP_RESP_TYPE_DEFAULT_USECASE, OCSP_REQUEST_DO_NOT_EXPECT); + final Consumer rewriteTslIdToInitial = + (tslDownload) -> { + final byte[] tslBytes = tslDownload.getTslBytes(); + + final String newId = initialTslDownload.getTsl().getId(); + final byte[] tslBytesWithNewId = TslModifier.modifiedTslId(tslBytes, newId); + + signAndSetTslBytes(tslDownload, defaultTslSigner, tslBytesWithNewId); + }; + + updateTrustStore( + "Offer a TSL with the same tsl id, but new (incremented) seqNr", + tslSettings.getAlternativeTemplate(), + defaultTslSigner, + OCSP_REQUEST_IGNORE, + getPathOfAlternativeCertificate(), + USECASE_INVALID, + OCSP_REQUEST_DO_NOT_EXPECT, + rewriteTslIdToInitial, + OcspSeqNrUpdateMode.DO_NOT_UPDATE_OCSP_SEQ_NR); } } @@ -290,13 +293,13 @@ void verifyIrregularDifferencesBetweenCurrentAndNewTsls(final TestInfo testInfo) afoId = "GS-A_4642", description = "TUC_PKI_001: Periodische Aktualisierung TI-Vertrauensraum - Schritt 6") @DisplayName("Test bad CA certificate is not extractable from TSL") - void verifyForBadCertificateOfTSPService(final TestInfo testInfo) - throws DatatypeConfigurationException, IOException { + void verifyForBadCertificateOfTSPService(final TestInfo testInfo) { testCaseMessage(testInfo); initialState(); updateTrustStore( + "Offer a TSL with alternative test CAs whose ASN1 structure is invalid.", tslSettings.getDefectAlternativeCaBrokenTemplate(), defaultTslSigner, OCSP_REQUEST_EXPECT, @@ -316,13 +319,13 @@ void verifyForBadCertificateOfTSPService(final TestInfo testInfo) afoId = "GS-A_4642", description = "TUC_PKI_001: Periodische Aktualisierung TI-Vertrauensraum - Schritt 6") @DisplayName("Test proper handling of unspecified CA certificate in TSL") - void verifyForUnspecifiedCertificateOfTSPService(final TestInfo testInfo) - throws DatatypeConfigurationException, IOException { + void verifyForUnspecifiedCertificateOfTSPService(final TestInfo testInfo) { testCaseMessage(testInfo); initialState(); updateTrustStore( + "Offer a TSL with alternative test CAs and \"irrelevant, unexpected\" CA.", tslSettings.getDefectAlternativeCaUnspecifiedTemplate(), defaultTslSigner, OCSP_REQUEST_EXPECT, @@ -340,13 +343,14 @@ void verifyForUnspecifiedCertificateOfTSPService(final TestInfo testInfo) @Test @Afo(afoId = "GS-A_4749", description = "TUC_PKI_007: Prüfung Zertifikatstyp - Schritt 8") @DisplayName("Test CA certificate with missing service information extension in TSL") - void verifyForWrongServiceInfoExtCertificateOfTSPService(final TestInfo testInfo) - throws DatatypeConfigurationException, IOException { + void verifyForWrongServiceInfoExtCertificateOfTSPService(final TestInfo testInfo) { testCaseMessage(testInfo); initialState(); updateTrustStore( + "Offer a TSL with alternative test CAs whose ServiceInformationExtension elements are" + + " wrong.", tslSettings.getDefectAlternativeCaWrongSrvInfoExtTemplate(), defaultTslSigner, OCSP_REQUEST_EXPECT, @@ -365,13 +369,13 @@ void verifyForWrongServiceInfoExtCertificateOfTSPService(final TestInfo testInfo @Test @Afo(afoId = "A_17700", description = "TSL-Auswertung ServiceTypeIdentifier \"unspecified\"") @DisplayName("Test CA certificate with ServiceTypeIdentifier \"unspecified\" in TSL") - void verifyForUnspecifiedServiceTypeIdentifierOfTSPService(final TestInfo testInfo) - throws DatatypeConfigurationException, IOException { + void verifyForUnspecifiedServiceTypeIdentifierOfTSPService(final TestInfo testInfo) { testCaseMessage(testInfo); initialState(); updateTrustStore( + "Import TSL with ServiceTypeIdentifier \"unspecified\"", tslSettings.getAlternativeCaUnspecifiedStiTemplate(), defaultTslSigner, OCSP_REQUEST_EXPECT, @@ -383,8 +387,7 @@ void verifyForUnspecifiedServiceTypeIdentifierOfTSPService(final TestInfo testIn @Test @Afo(afoId = "GS-A_4652", description = "TUC_PKI_018: Zertifikatsprüfung in der TI - Schritt 5a") @DisplayName("Test CA certificate in TSL is revoked and EE certificate is issued later.") - void verifyRevokedCaCertificateInTslLater(final TestInfo testInfo) - throws DatatypeConfigurationException, IOException { + void verifyRevokedCaCertificateInTslLater(final TestInfo testInfo) { testCaseMessage(testInfo); initialState(); @@ -392,6 +395,7 @@ void verifyRevokedCaCertificateInTslLater(final TestInfo testInfo) waitForOcspCacheToExpire(); updateTrustStore( + "Offer a TSL with alternative test CAs with ServiceStatus REVOKED", alternativeCaRevokedPretty, defaultTslSigner, OCSP_REQUEST_EXPECT, @@ -409,43 +413,46 @@ void verifyRevokedCaCertificateInTslLater(final TestInfo testInfo) @Test @Afo(afoId = "GS-A_4652", description = "TUC_PKI_018: Zertifikatsprüfung in der TI - Schritt 5") @DisplayName("Test CA certificate in TSL is revoked and EE certificate is issued earlier.") - void verifyRevokedCaCertificateInTsl(final TestInfo testInfo) - throws DatatypeConfigurationException, IOException { + void verifyRevokedCaCertificateInTsl(final TestInfo testInfo) { testCaseMessage(testInfo); initialState(); waitForOcspCacheToExpire(); - final Path tslTemplatePath = Path.of(TSL_TEMPLATES_DIRNAME, "TSL_altCA_revokedLater.xml"); - - final int offeredSeqNr = tslSequenceNr.getNextTslSeqNr(); - log.info("Offering TSL with seqNr. {} for download.", offeredSeqNr); - - final TslDownload tslDownload = getTslDownloadWithTemplate(offeredSeqNr, tslTemplatePath); - - final ZonedDateTime newStatusStartingTime = GemLibPkiUtils.now().plusDays(1); - - final byte[] tslBytes = tslDownload.getTslBytes(); - final byte[] tslBytesWithNewStatusStartingTime = - TslModifier.modifiedStatusStartingTime( - tslBytes, - PkitsConstants.GEMATIK_TEST_TSP, - null, - TslConstants.SVCSTATUS_REVOKED, - newStatusStartingTime); - - signAndSetTslBytes(tslDownload, defaultTslSigner, tslBytesWithNewStatusStartingTime); - writeTsl(tslDownload, "_modified"); - - printCurrentTslSeqNr(); - tslSequenceNr.setLastOfferedNr(offeredSeqNr); - tslDownload.waitUntilTslDownloadCompleted( - tslSequenceNr.getExpectedNrInTestObject(), getExpectedOcspTslSeqNr()); - tslSequenceNr.setExpectedNrInTestObject(offeredSeqNr); + final Consumer rewriteStatusStartingTimeToNowPlusOneDay = + tslDownload -> { + final ZonedDateTime newStatusStartingTime = GemLibPkiUtils.now().plusDays(1); + + final byte[] tslBytes = tslDownload.getTslBytes(); + final byte[] tslBytesWithNewStatusStartingTime; + try { + + tslBytesWithNewStatusStartingTime = + TslModifier.modifiedStatusStartingTime( + tslBytes, + PkitsConstants.GEMATIK_TEST_TSP, + null, + TslConstants.SVCSTATUS_REVOKED, + newStatusStartingTime); + } catch (final DatatypeConfigurationException e) { + throw new TestSuiteException("cannot modify TSL", e); + } + + signAndSetTslBytes(tslDownload, defaultTslSigner, tslBytesWithNewStatusStartingTime); + }; - final Path certPath = getPathOfAlternativeCertificate(); - useCaseWithCert(certPath, USECASE_VALID, OCSP_RESP_TYPE_DEFAULT_USECASE, OCSP_REQUEST_EXPECT); + updateTrustStore( + "Offer a TSL with alternative CAs, ServiceStatus REVOKED, StatusStartingTime one day in the" + + " future.", + tslAlternativeCaRevokedLater, + defaultTslSigner, + OCSP_REQUEST_EXPECT, + getPathOfAlternativeCertificate(), + USECASE_VALID, + OCSP_REQUEST_EXPECT, + rewriteStatusStartingTimeToNowPlusOneDay, + OcspSeqNrUpdateMode.DO_NOT_UPDATE_OCSP_SEQ_NR); } /** gematikId: UE_PKI_TC_0105_009 */ @@ -453,39 +460,43 @@ void verifyRevokedCaCertificateInTsl(final TestInfo testInfo) @Afo(afoId = "GS-A_4648", description = "Prüfung der Aktualität der TSL - Schritt 4") @Afo(afoId = "GS-GS-A_4651", description = "TUC_PKI_012: XML-Signatur-Prüfung") @DisplayName("Test TSL signature invalid - \"to be signed block\" with integrity violation") - void verifyTslSignatureInvalid(final TestInfo testInfo) - throws DatatypeConfigurationException, IOException { + void verifyTslSignatureInvalid(final TestInfo testInfo) { testCaseMessage(testInfo); initialState(); - final int offeredSeqNr = tslSequenceNr.getNextTslSeqNr(); - log.info("Offering TSL with seqNr. {} for download.", offeredSeqNr); - - // create TSL and verify signature - final TslDownload tslDownload = getTslDownloadAlternativeTemplate(offeredSeqNr); - assertThat(TslValidator.checkSignature(tslDownload.getTslBytes(), VALID_ISSUER_CERT_TSL_CA8)) - .isTrue(); - - // break integrity of TSL and verify signature again - final String mailToStrOld = getFirstSchemeOperatorMailAddressOfTsl(tslDownload.getTslBytes()); - final String mailToStrNew = "mailto:signatureInvalid@gematik.de"; - final String tslStr = new String(tslDownload.getTslBytes(), StandardCharsets.UTF_8); - final byte[] brokenTsl = - tslStr.replace(mailToStrOld, mailToStrNew).getBytes(StandardCharsets.UTF_8); - - tslDownload.setTslBytes(brokenTsl); - writeTsl(tslDownload, "_modified"); - - log.info("Verify test tsl has wrong signature."); - assertThat(TslValidator.checkSignature(tslDownload.getTslBytes(), VALID_ISSUER_CERT_TSL_CA8)) - .isFalse(); - - tslSequenceNr.setLastOfferedNr(offeredSeqNr); - tslDownload.waitUntilTslDownloadCompletedOptional(tslSequenceNr.getExpectedNrInTestObject()); + final Consumer rewriteMailToInvalidateSignature = + tslDownload -> { + assertThat( + TslValidator.checkSignature(tslDownload.getTslBytes(), VALID_ISSUER_CERT_TSL_CA8)) + .isTrue(); + + // break integrity of TSL and verify signature again + final String mailToStrOld = + getFirstSchemeOperatorMailAddressOfTsl(tslDownload.getTslBytes()); + final String mailToStrNew = "mailto:signatureInvalid@gematik.de"; + final String tslStr = new String(tslDownload.getTslBytes(), StandardCharsets.UTF_8); + final byte[] brokenTsl = + tslStr.replace(mailToStrOld, mailToStrNew).getBytes(StandardCharsets.UTF_8); + + tslDownload.setTslBytes(brokenTsl); + + log.info("Verify test tsl has wrong signature."); + assertThat( + TslValidator.checkSignature(tslDownload.getTslBytes(), VALID_ISSUER_CERT_TSL_CA8)) + .isFalse(); + }; - final Path certPath = getPathOfAlternativeCertificate(); - useCaseWithCert(certPath, USECASE_INVALID, OCSP_RESP_TYPE_DEFAULT_USECASE, OCSP_REQUEST_IGNORE); + updateTrustStore( + "Offer a TSL with alternative test CAs. The signature of the TSL is invalid.", + tslSettings.getAlternativeTemplate(), + defaultTslSigner, + OCSP_REQUEST_IGNORE, + getPathOfAlternativeCertificate(), + USECASE_INVALID, + OCSP_REQUEST_IGNORE, + rewriteMailToInvalidateSignature, + OcspSeqNrUpdateMode.DO_NOT_UPDATE_OCSP_SEQ_NR); useCaseWithCert( getPathOfFirstValidCert(), @@ -510,8 +521,7 @@ private String getFirstSchemeOperatorMailAddressOfTsl(final byte[] tslBytes) { @Afo(afoId = "GS-A_4648", description = "TUC_PKI_019: Prüfung der Aktualität der TSL - Schritt 1") @Afo(afoId = "GS-A_4647", description = "TUC_PKI_016: Download der TSL-Datei - Schritt 3 und 4") @DisplayName("Test TSL download not possible") - void verifyRetryFailingTslDownload(final TestInfo testInfo) - throws DatatypeConfigurationException, IOException { + void verifyRetryFailingTslDownload(final TestInfo testInfo) { testCaseMessage(testInfo); initialState(); @@ -599,8 +609,7 @@ void verifyRetryFailingTslDownload(final TestInfo testInfo) @Afo(afoId = "GS-A_4648", description = "TUC_PKI_019: Prüfung der Aktualität der TSL - Schritt 1") @Afo(afoId = "GS-A_4647", description = "TUC_PKI_016: Download der TSL-Datei - Schritt 3 und 4") @DisplayName("Test TSL download on primary endpoint not possible") - void verifyUseBackupTslDownload(final TestInfo testInfo) - throws DatatypeConfigurationException, IOException { + void verifyUseBackupTslDownload(final TestInfo testInfo) { testCaseMessage(testInfo); initialState(); diff --git a/pkits-testsuite/src/main/java/de/gematik/pki/pkits/testsuite/approval/TslSignerApprovalTestsIT.java b/pkits-testsuite/src/main/java/de/gematik/pki/pkits/testsuite/approval/TslSignerApprovalTestsIT.java index e4af5d3..f7ff715 100644 --- a/pkits-testsuite/src/main/java/de/gematik/pki/pkits/testsuite/approval/TslSignerApprovalTestsIT.java +++ b/pkits-testsuite/src/main/java/de/gematik/pki/pkits/testsuite/approval/TslSignerApprovalTestsIT.java @@ -43,6 +43,7 @@ import de.gematik.pki.pkits.ocsp.responder.data.OcspResponderConfigDto.CustomCertificateStatusDto; import de.gematik.pki.pkits.ocsp.responder.data.OcspResponderConfigDto.CustomCertificateStatusType; import de.gematik.pki.pkits.ocsp.responder.data.OcspResponderConfigDto.OcspResponderConfigDtoBuilder; +import de.gematik.pki.pkits.testsuite.approval.support.OcspSeqNrUpdateMode; import de.gematik.pki.pkits.testsuite.approval.support.UseCaseResult; import de.gematik.pki.pkits.testsuite.common.PkitsTestSuiteUtils; import de.gematik.pki.pkits.testsuite.common.TestSuiteConstants; @@ -50,13 +51,13 @@ import de.gematik.pki.pkits.testsuite.common.ocsp.OcspHistory.OcspRequestExpectationBehaviour; import de.gematik.pki.pkits.testsuite.common.tsl.TslDownload; import de.gematik.pki.pkits.testsuite.config.Afo; +import de.gematik.pki.pkits.testsuite.exceptions.TestSuiteException; import eu.europa.esig.dss.spi.x509.revocation.ocsp.OCSPRespStatus; import eu.europa.esig.trustedlist.jaxb.tsl.TrustStatusListType; -import java.io.IOException; import java.nio.file.Path; import java.security.cert.CertificateEncodingException; import java.security.cert.X509Certificate; -import javax.xml.datatype.DatatypeConfigurationException; +import java.util.function.Consumer; import lombok.extern.slf4j.Slf4j; import org.junit.jupiter.api.DisplayName; import org.junit.jupiter.api.Order; @@ -82,8 +83,7 @@ private void updateTrustStoreUsingOcspResponderConfig( final OcspResponderConfigDtoBuilder ocspResponderConfigDtoBuilder, final TslUpdateExpectation tslUpdateExpected, final Path certPath, - final UseCaseResult useCaseResult) - throws DatatypeConfigurationException, IOException { + final UseCaseResult useCaseResult) { currentTestInfo.setPhase("updateTrustStoreUsingOcspResponderConfig"); @@ -130,8 +130,7 @@ private void updateTrustStoreUsingOcspResponderConfig( TestSuiteConstants.OCSP_SIGNER_DIFFERENT_KEY }) void verifyMissingOcspSignerInTslForTslSignerCert( - final String ocspSignerFilename, final TestInfo testInfo) - throws DatatypeConfigurationException, IOException { + final String ocspSignerFilename, final TestInfo testInfo) { testCaseMessage(testInfo); initialState(); @@ -165,8 +164,7 @@ void verifyMissingOcspSignerInTslForTslSignerCert( description = "TUC_PKI_001: Periodische Aktualisierung TI-Vertrauensraum - Schritt 4") @Afo(afoId = "GS-A_4657", description = "TUC_PKI_006: OCSP-Abfrage - Schritt 5a1") @DisplayName("Test invalid OCSP response signature for TSL signer certificate") - void verifyOcspResponseWithInvalidSignatureForTslSignerCert(final TestInfo testInfo) - throws DatatypeConfigurationException, IOException { + void verifyOcspResponseWithInvalidSignatureForTslSignerCert(final TestInfo testInfo) { testCaseMessage(testInfo); initialState(); @@ -195,8 +193,7 @@ private void verifyOcspResponseDateForTslSignerCert( final DtoDateConfigOption dateConfigOption, final int deltaMilliseconds, final TslUpdateExpectation tslUpdateExcected, - final UseCaseResult useCaseResult) - throws DatatypeConfigurationException, IOException { + final UseCaseResult useCaseResult) { final OcspResponderConfigDtoBuilder dtoBuilder = OcspResponderConfigDto.builder().eeCert(getDefaultTslSignerCert()).signer(ocspSigner); @@ -223,8 +220,7 @@ private void verifyOcspResponseDateForTslSignerCert( @Afo(afoId = "GS-A_4657", description = "TUC_PKI_006: OCSP-Abfrage - Schritt 6") @DisplayName( "Test OCSP response of TSL signer certificate with producedAt in past within tolerance") - void verifyOcspResponseTslSignerCertProducedAtPastWithinTolerance(final TestInfo testInfo) - throws DatatypeConfigurationException, IOException { + void verifyOcspResponseTslSignerCertProducedAtPastWithinTolerance(final TestInfo testInfo) { testCaseMessage(testInfo); initialState(); @@ -254,8 +250,7 @@ void verifyOcspResponseTslSignerCertProducedAtPastWithinTolerance(final TestInfo @Afo(afoId = "GS-A_4657", description = "TUC_PKI_006: OCSP-Abfrage - Schritt 6") @DisplayName( "Test OCSP response of TSL signer certificate with producedAt in past out of tolerance") - void verifyOcspResponseTslSignerCertProducedAtPastOutOfTolerance(final TestInfo testInfo) - throws DatatypeConfigurationException, IOException { + void verifyOcspResponseTslSignerCertProducedAtPastOutOfTolerance(final TestInfo testInfo) { testCaseMessage(testInfo); initialState(); @@ -285,8 +280,7 @@ void verifyOcspResponseTslSignerCertProducedAtPastOutOfTolerance(final TestInfo @Afo(afoId = "GS-A_4657", description = "TUC_PKI_006: OCSP-Abfrage - Schritt 6") @DisplayName( "Test OCSP response of TSL signer certificate with producedAt in future within tolerance") - void verifyOcspResponseTslSignerCertProducedAtFutureWithinTolerance(final TestInfo testInfo) - throws DatatypeConfigurationException, IOException { + void verifyOcspResponseTslSignerCertProducedAtFutureWithinTolerance(final TestInfo testInfo) { testCaseMessage(testInfo); initialState(); @@ -299,11 +293,13 @@ void verifyOcspResponseTslSignerCertProducedAtFutureWithinTolerance(final TestIn producedAtDeltaMilliseconds, TSL_UPDATE_EXPECTED, USECASE_VALID); + useCaseWithCert( getPathOfFirstValidCert(), USECASE_VALID, OCSP_RESP_TYPE_DEFAULT_USECASE, OCSP_REQUEST_EXPECT); + waitForOcspCacheToExpire( testSuiteConfig.getTestObject().getOcspGracePeriodSeconds() + producedAtDeltaMilliseconds / 1000); @@ -317,8 +313,7 @@ void verifyOcspResponseTslSignerCertProducedAtFutureWithinTolerance(final TestIn @Afo(afoId = "GS-A_4657", description = "TUC_PKI_006: OCSP-Abfrage - Schritt 6") @DisplayName( "Test OCSP response of TSL signer certificate with producedAt in future out of tolerance") - void verifyOcspResponseTslSignerCertProducedAtFutureOutOfTolerance(final TestInfo testInfo) - throws DatatypeConfigurationException, IOException { + void verifyOcspResponseTslSignerCertProducedAtFutureOutOfTolerance(final TestInfo testInfo) { testCaseMessage(testInfo); initialState(); @@ -351,8 +346,7 @@ void verifyOcspResponseTslSignerCertProducedAtFutureOutOfTolerance(final TestInf @Afo(afoId = "GS-A_4657", description = "TUC_PKI_006: OCSP-Abfrage - Schritt 6") @DisplayName( "Test OCSP response of TSL signer certificate with thisUpdate in future within tolerance") - void verifyOcspResponseTslSignerCertThisUpdateFutureWithinTolerance(final TestInfo testInfo) - throws DatatypeConfigurationException, IOException { + void verifyOcspResponseTslSignerCertThisUpdateFutureWithinTolerance(final TestInfo testInfo) { testCaseMessage(testInfo); initialState(); @@ -365,11 +359,13 @@ void verifyOcspResponseTslSignerCertThisUpdateFutureWithinTolerance(final TestIn thisUpdateDeltaMilliseconds, TSL_UPDATE_EXPECTED, USECASE_VALID); + useCaseWithCert( getPathOfFirstValidCert(), USECASE_VALID, OCSP_RESP_TYPE_DEFAULT_USECASE, OCSP_REQUEST_EXPECT); + waitForOcspCacheToExpire( testSuiteConfig.getTestObject().getOcspGracePeriodSeconds() + thisUpdateDeltaMilliseconds / 1000); @@ -383,8 +379,7 @@ void verifyOcspResponseTslSignerCertThisUpdateFutureWithinTolerance(final TestIn @Afo(afoId = "GS-A_4657", description = "TUC_PKI_006: OCSP-Abfrage - Schritt 6") @DisplayName( "Test OCSP response of TSL signer certificate with thisUpdate in future out of tolerance") - void verifyOcspResponseTslSignerCertThisUpdateFutureOutOfTolerance(final TestInfo testInfo) - throws DatatypeConfigurationException, IOException { + void verifyOcspResponseTslSignerCertThisUpdateFutureOutOfTolerance(final TestInfo testInfo) { testCaseMessage(testInfo); initialState(); @@ -415,8 +410,7 @@ void verifyOcspResponseTslSignerCertThisUpdateFutureOutOfTolerance(final TestInf @Afo(afoId = "GS-A_4657", description = "TUC_PKI_006: OCSP-Abfrage - Schritt 6") @DisplayName( "Test OCSP response of TSL signer certificate with nextUpdate in past within tolerance") - void verifyOcspResponseTslSignerCertNextUpdatePastWithinTolerance(final TestInfo testInfo) - throws DatatypeConfigurationException, IOException { + void verifyOcspResponseTslSignerCertNextUpdatePastWithinTolerance(final TestInfo testInfo) { testCaseMessage(testInfo); initialState(); @@ -445,8 +439,7 @@ void verifyOcspResponseTslSignerCertNextUpdatePastWithinTolerance(final TestInfo @Afo(afoId = "GS-A_4657", description = "TUC_PKI_006: OCSP-Abfrage - Schritt 6") @DisplayName( "Test OCSP response of TSL signer certificate with nextUpdate in past out of tolerance") - void verifyOcspResponseTslSignerCertNextUpdatePastOutOfTolerance(final TestInfo testInfo) - throws DatatypeConfigurationException, IOException { + void verifyOcspResponseTslSignerCertNextUpdatePastOutOfTolerance(final TestInfo testInfo) { testCaseMessage(testInfo); initialState(); @@ -474,8 +467,7 @@ void verifyOcspResponseTslSignerCertNextUpdatePastOutOfTolerance(final TestInfo description = "TUC_PKI_001: Periodische Aktualisierung TI-Vertrauensraum - Schritt 4") @Afo(afoId = "GS-A_4657", description = "TUC_PKI_006: OCSP-Abfrage - Schritt 6") @DisplayName("Test OCSP response of TSL signer certificate with missing nextUpdate") - void verifyOcspResponseTslSignerCertMissingNextUpdate(final TestInfo testInfo) - throws DatatypeConfigurationException, IOException { + void verifyOcspResponseTslSignerCertMissingNextUpdate(final TestInfo testInfo) { testCaseMessage(testInfo); initialState(); @@ -512,8 +504,9 @@ void verifyOcspResponseTslSignerCertMissingNextUpdate(final TestInfo testInfo) "Test various status of OCSP responses of TSL signer certificate with and without response" + " bytes") void verifyOcspResponseTslSignerCertVariousStatusAndResponseBytes( - final OCSPRespStatus ocspRespStatus, final boolean withResponseBytes, final TestInfo testInfo) - throws DatatypeConfigurationException, IOException { + final OCSPRespStatus ocspRespStatus, + final boolean withResponseBytes, + final TestInfo testInfo) { testCaseMessage(testInfo); initialState(); @@ -546,8 +539,7 @@ void verifyOcspResponseTslSignerCertVariousStatusAndResponseBytes( description = "TUC_PKI_001: Periodische Aktualisierung TI-Vertrauensraum - Schritt 4") @Afo(afoId = "GS-A_4657", description = "TUC_PKI_006: OCSP-Abfrage - Schritt 7b") @DisplayName("Test OCSP response of TSL signer certificate with missing CertHash") - void verifyOcspResponseTslSignerCertMissingCertHash(final TestInfo testInfo) - throws DatatypeConfigurationException, IOException { + void verifyOcspResponseTslSignerCertMissingCertHash(final TestInfo testInfo) { testCaseMessage(testInfo); initialState(); @@ -579,8 +571,7 @@ void verifyOcspResponseTslSignerCertMissingCertHash(final TestInfo testInfo) description = "TUC_PKI_001: Periodische Aktualisierung TI-Vertrauensraum - Schritt 4") @Afo(afoId = "GS-A_4657", description = "TUC_PKI_006: OCSP-Abfrage - Schritt 7c") @DisplayName("Test OCSP response of TSL signer certificate with invalid CertHash") - void verifyOcspResponseTslSignerCertInvalidCertHash(final TestInfo testInfo) - throws DatatypeConfigurationException, IOException { + void verifyOcspResponseTslSignerCertInvalidCertHash(final TestInfo testInfo) { testCaseMessage(testInfo); initialState(); @@ -616,8 +607,7 @@ void verifyOcspResponseTslSignerCertInvalidCertHash(final TestInfo testInfo) @Afo(afoId = "GS-A_4657", description = "TUC_PKI_006: OCSP-Abfrage - Schritt 8b und 8c") @DisplayName("Test OCSP response of TSL signer certificate with status revoked and unknown") void verifyOcspResponseTslSignerCertStatusRevokedAndUnknown( - final CustomCertificateStatusType customCertificateStatusType, final TestInfo testInfo) - throws DatatypeConfigurationException, IOException { + final CustomCertificateStatusType customCertificateStatusType, final TestInfo testInfo) { testCaseMessage(testInfo); initialState(); @@ -649,8 +639,7 @@ void verifyOcspResponseTslSignerCertStatusRevokedAndUnknown( description = "TUC_PKI_001: Periodische Aktualisierung TI-Vertrauensraum - Schritt 4") @Afo(afoId = "RFC 6960", description = "4.2.1. ASN.1 Specification of the OCSP Response") @DisplayName("Test OCSP response of TSL signer certificate with responder id byName") - void verifyOcspResponseTslSignerCertResponderIdByName(final TestInfo testInfo) - throws DatatypeConfigurationException, IOException { + void verifyOcspResponseTslSignerCertResponderIdByName(final TestInfo testInfo) { testCaseMessage(testInfo); initialState(); @@ -684,8 +673,7 @@ void verifyOcspResponseTslSignerCertResponderIdByName(final TestInfo testInfo) @ValueSource(booleans = {true, false}) @DisplayName("Test OCSP response of TSL signer certificate with null parameter in CertId") void verifyOcspResponseTslSignerCertWithNullParameterInCertId( - final boolean withNullParameterHashAlgoOfCertId, final TestInfo testInfo) - throws DatatypeConfigurationException, IOException { + final boolean withNullParameterHashAlgoOfCertId, final TestInfo testInfo) { testCaseMessage(testInfo); initialState(); @@ -717,8 +705,7 @@ void verifyOcspResponseTslSignerCertWithNullParameterInCertId( description = "TUC_PKI_001: Periodische Aktualisierung TI-Vertrauensraum - Schritt 4") @Afo(afoId = "GS-A_4657", description = "TUC_PKI_006: OCSP check - step 4c") @DisplayName("Test OCSP response TSL signer certificate with timeout and delay") - void verifyOcspResponseTslSignerCertTimeoutAndDelay(final TestInfo testInfo) - throws DatatypeConfigurationException, IOException { + void verifyOcspResponseTslSignerCertTimeoutAndDelay(final TestInfo testInfo) { testCaseMessage(testInfo); initialState(); @@ -789,8 +776,7 @@ void verifyOcspResponseTslSignerCertTimeoutAndDelay(final TestInfo testInfo) @Afo(afoId = "GS-A_4657", description = "TUC_PKI_006: OCSP check - step 6b") @DisplayName("Test invalid cert id in OCSP response for TSL signer cert") void verifyOcspResponseTslSignerCertInvalidCertId( - final CertificateIdGeneration certificateIdGeneration, final TestInfo testInfo) - throws DatatypeConfigurationException, IOException { + final CertificateIdGeneration certificateIdGeneration, final TestInfo testInfo) { testCaseMessage(testInfo); initialState(); @@ -826,8 +812,7 @@ void verifyOcspResponseTslSignerCertInvalidCertId( description = "TUC_PKI_011: Prüfung des TSL-Signer-Zertifikates - Schritt 2") @Afo(afoId = "GS-A_4653", description = "TUC_PKI_002: Gültigkeitsprüfung des Zertifikats") @DisplayName("Test TSL signer certificate that is not yet valid - notBefore is in the future") - void verifyTslSignerCertNotYetValid(final TestInfo testInfo) - throws DatatypeConfigurationException, IOException { + void verifyTslSignerCertNotYetValid(final TestInfo testInfo) { testCaseMessage(testInfo); initialState(); @@ -852,8 +837,7 @@ void verifyTslSignerCertNotYetValid(final TestInfo testInfo) description = "TUC_PKI_011: Prüfung des TSL-Signer-Zertifikates - Schritt 2") @Afo(afoId = "GS-A_4653", description = "TUC_PKI_002: Gültigkeitsprüfung des Zertifikats") @DisplayName("Test TSL signer certificate that is expired") - void verifyTslSignerCertExpired(final TestInfo testInfo) - throws DatatypeConfigurationException, IOException { + void verifyTslSignerCertExpired(final TestInfo testInfo) { testCaseMessage(testInfo); initialState(); @@ -867,22 +851,26 @@ void verifyTslSignerCertExpired(final TestInfo testInfo) OCSP_REQUEST_EXPECT); } - private void breakTslSigner(final TslDownload tslDownload) - throws CertificateEncodingException, IOException { + private final Consumer breakTslSigner = + tslDownload -> { + final byte[] tslBytes = tslDownload.getTslBytes(); + final TrustStatusListType tsl = TslConverter.bytesToTsl(tslBytes); + final X509Certificate signerCert = TslUtils.getFirstTslSignerCertificate(tsl); - final byte[] tslBytes = tslDownload.getTslBytes(); - final TrustStatusListType tsl = TslConverter.bytesToTsl(tslBytes); - final X509Certificate signerCert = TslUtils.getFirstTslSignerCertificate(tsl); + final byte[] signerCertBrokenBytes; + try { + signerCertBrokenBytes = signerCert.getEncoded(); + } catch (CertificateEncodingException e) { + throw new TestSuiteException("cannot read signerCert", e); + } - final byte[] signerCertBrokenBytes = signerCert.getEncoded(); - GemLibPkiUtils.change4Bytes(signerCertBrokenBytes, 4); + GemLibPkiUtils.change4Bytes(signerCertBrokenBytes, 4); - final byte[] tslWithSignerCertBroken = - TslModifier.modifiedSignerCert(tslBytes, signerCertBrokenBytes); + final byte[] tslWithSignerCertBroken = + TslModifier.modifiedSignerCert(tslBytes, signerCertBrokenBytes); - tslDownload.setTslBytes(tslWithSignerCertBroken); - writeTsl(tslDownload, "_modified"); - } + tslDownload.setTslBytes(tslWithSignerCertBroken); + }; /** gematikId: UE_PKI_TC_0105_001 */ @Test @@ -890,28 +878,22 @@ private void breakTslSigner(final TslDownload tslDownload) afoId = "GS-A_4642", description = "TUC_PKI_001: Periodische Aktualisierung TI-Vertrauensraum - Schritt 3") @DisplayName("Test TSL signer certificate is broken") - void verifyTslSignerCertBroken(final TestInfo testInfo) - throws DatatypeConfigurationException, IOException, CertificateEncodingException { + void verifyTslSignerCertBroken(final TestInfo testInfo) { testCaseMessage(testInfo); initialState(); - final int offeredSeqNr = tslSequenceNr.getNextTslSeqNr(); - log.info("Offering TSL with seqNr. {} for download.", offeredSeqNr); - final TslDownload tslDownload = getTslDownloadAlternativeTemplate(offeredSeqNr); - - tslDownload.configureOcspResponderTslSignerStatusGood(); - - breakTslSigner(tslDownload); - - tslSequenceNr.setLastOfferedNr(offeredSeqNr); - tslDownload.waitForTslDownload(tslSequenceNr.getExpectedNrInTestObject()); - - assertNoOcspRequest(tslDownload); - - final Path certPath = getPathOfAlternativeCertificate(); - useCaseWithCert( - certPath, USECASE_INVALID, OCSP_RESP_TYPE_DEFAULT_USECASE, OCSP_REQUEST_DO_NOT_EXPECT); + updateTrustStore( + "Offer a TSL with alternative test CAs (the TSL signer certificate contains an invalid ASN1" + + " structure).", + tslSettings.getAlternativeTemplate(), + defaultTslSigner, + OCSP_REQUEST_DO_NOT_EXPECT, + getPathOfAlternativeCertificate(), + USECASE_INVALID, + OCSP_REQUEST_DO_NOT_EXPECT, + breakTslSigner, + OcspSeqNrUpdateMode.DO_NOT_UPDATE_OCSP_SEQ_NR); final Path validCertPath = getPathOfFirstValidCert(); useCaseWithCert( @@ -926,8 +908,7 @@ void verifyTslSignerCertBroken(final TestInfo testInfo) private void verifyForBadCertificateFromTrustAnchors( final String p12Filename, final boolean signerKeyUsageCheck, - final boolean signerValidityCheck) - throws DatatypeConfigurationException, IOException { + final boolean signerValidityCheck) { final Path p12ContainerBadPath = Path.of(TRUST_ANCHOR_TEMPLATES_DIRNAME, p12Filename); final P12Container p12ContainerBad = P12Reader.getContentFromP12(p12ContainerBadPath, "00"); @@ -942,7 +923,8 @@ private void verifyForBadCertificateFromTrustAnchors( tslTemplate, p12ContainerBadPath, signerKeyUsageCheck, - signerValidityCheck); + signerValidityCheck, + null); final OcspResponderConfigDtoBuilder dtoBuilder = OcspResponderConfigDto.builder() @@ -969,8 +951,7 @@ private void verifyForBadCertificateFromTrustAnchors( afoId = "GS-A_4650", description = "TUC_PKI_011: Prüfung des TSL-Signer-Zertifikates - Schritt 3") @DisplayName("Test TSL signer certificates with invalid key usage and extended key usage") - void verifyTslSignerCertInvalidKeyUsageAndExtendedKeyUsage(final TestInfo testInfo) - throws DatatypeConfigurationException, IOException { + void verifyTslSignerCertInvalidKeyUsageAndExtendedKeyUsage(final TestInfo testInfo) { testCaseMessage(testInfo); initialState(); diff --git a/pkits-testsuite/src/main/java/de/gematik/pki/pkits/testsuite/approval/TslVaApprovalTestsIT.java b/pkits-testsuite/src/main/java/de/gematik/pki/pkits/testsuite/approval/TslVaApprovalTestsIT.java index d235f95..762ff10 100644 --- a/pkits-testsuite/src/main/java/de/gematik/pki/pkits/testsuite/approval/TslVaApprovalTestsIT.java +++ b/pkits-testsuite/src/main/java/de/gematik/pki/pkits/testsuite/approval/TslVaApprovalTestsIT.java @@ -26,13 +26,13 @@ import de.gematik.pki.gemlibpki.utils.GemLibPkiUtils; import de.gematik.pki.pkits.common.PkitsCommonUtils; -import de.gematik.pki.pkits.testsuite.approval.support.UseCaseResult; +import de.gematik.pki.pkits.testsuite.approval.support.OcspSeqNrUpdateMode; import de.gematik.pki.pkits.testsuite.common.ocsp.OcspHistory.OcspRequestExpectationBehaviour; +import de.gematik.pki.pkits.testsuite.common.tsl.TslDownload; import de.gematik.pki.pkits.testsuite.config.Afo; -import java.io.IOException; import java.nio.file.Path; import java.time.ZonedDateTime; -import javax.xml.datatype.DatatypeConfigurationException; +import java.util.function.Consumer; import lombok.extern.slf4j.Slf4j; import org.junit.jupiter.api.Assertions; import org.junit.jupiter.api.DisplayName; @@ -106,8 +106,6 @@ class TslVaApprovalTestsIT extends TslVaApprovalUtilsBaseIT { static final Path tslTemplateAlternativeTrustAnchor2TrustAnchorChange = Path.of(TSL_TEMPLATES_DIRNAME, "TSL_altTA2_TAchange.xml"); - private static final UseCaseResult SKIP_USECASE = null; - /** gematikId: UE_PKI_TC_0106_001 */ @Test @Afo( @@ -115,15 +113,14 @@ class TslVaApprovalTestsIT extends TslVaApprovalUtilsBaseIT { description = "TUC_PKI_001: Periodische Aktualisierung TI-Vertrauensraum - Schritt 5") @Afo(afoId = "GS-A_4643", description = "TUC_PKI_013: Import TI-Vertrauensanker aus TSL") @DisplayName("Test updating trust anchor") - void verifyUpdateTrustAnchor(final TestInfo testInfo) - throws DatatypeConfigurationException, IOException { + void verifyUpdateTrustAnchor(final TestInfo testInfo) { testCaseMessage(testInfo); initialState(); - log.info("verifyUpdateTrustAnchor step 2.1"); - updateTrustStore( + "Offer a TSL with announcement of trust anchor change." + + " ", tslTemplateTrustAnchorChange, defaultTslSigner, OCSP_REQUEST_EXPECT, @@ -134,11 +131,16 @@ void verifyUpdateTrustAnchor(final TestInfo testInfo) log.info("verifyUpdateTrustAnchor - new trust anchor should be activated now"); - verifyInvalidTrustAnchorWasNotImported(tslSettings.getAlternativeTemplate(), defaultTslSigner); + verifyInvalidTrustAnchorWasNotImported( + "Offer a TSL (with alternative test CAs), signed with old (no longer active) trust anchor." + + " ", + tslSettings.getAlternativeTemplate(), + defaultTslSigner); - log.info("verifyUpdateTrustAnchor step 2.3"); printCurrentTslSeqNr(); updateTrustStore( + "Offer a TSL (with alternate test CAs), signed with the new (announced) first alternative" + + " trust anchor. ", tslTemplateAlternativeTrustAnchorAlternativeCa, alternativeTslSignerP12Path, OCSP_REQUEST_EXPECT, @@ -148,48 +150,41 @@ void verifyUpdateTrustAnchor(final TestInfo testInfo) fallBackFromAlternativeToDefaultTrustAnchorAndCheck(alternativeTslSignerP12Path); } - private void fallBackFromAlternativeToDefaultTrustAnchorAndCheck(final Path tslSignerP12Path) - throws DatatypeConfigurationException, IOException { + private void fallBackFromAlternativeToDefaultTrustAnchorAndCheck(final Path tslSignerP12Path) { log.info("fallBackFromAlternativeToDefaultTrustAnchorAndCheck - start"); updateTrustStore( + getSwitchMessage(TA_NAME_ALT1, TA_NAME_DEFAULT) + + " ", tslTemplateAlternativeTrustAnchorTrustAnchorChange, tslSignerP12Path, OCSP_REQUEST_EXPECT, getPathOfFirstValidCert(), - USECASE_VALID); - - setExpectedOcspTslSeqNr(tslSequenceNr.getExpectedNrInTestObject()); + USECASE_VALID, + OCSP_REQUEST_EXPECT, + null, + OcspSeqNrUpdateMode.UPDATE_OCSP_SEQ_NR); log.info("fallBackFromAlternativeToDefaultTrustAnchorAndCheck - finish\n\n"); } - private void tryToImportAnnouncedInvalidTrustAnchor( - final Path tslTemplate, - final Path tslSignerP12Path, - final OcspRequestExpectationBehaviour ocspRequestExpectationBehaviour) - throws DatatypeConfigurationException, IOException { + private void verifyInvalidTrustAnchorWasNotImported( + final String description, final Path tslTemplate, final Path tslSignerP12Path) { - log.info("tryToImportAnnouncedInvalidTrustAnchor - start: tsl template {}", tslTemplate); + log.info("Test if Trust Anchor was erroneously imported"); + log.info("verifyInvalidTrustAnchorWasNotImported - start: tslTemplate {}", tslTemplate); updateTrustStore( + description, tslTemplate, tslSignerP12Path, - ocspRequestExpectationBehaviour, - getPathOfAlternativeCertificate(), - USECASE_INVALID); - - log.info("tryToImportAnnouncedInvalidTrustAnchor - finish\n\n"); - } - - private void verifyInvalidTrustAnchorWasNotImported( - final Path tslTemplate, final Path tslSignerP12Path) - throws DatatypeConfigurationException, IOException { - - log.info("verifyInvalidTrustAnchorWasNotImported - start: tslTemplate {}", tslTemplate); - - updateTrustStore(tslTemplate, tslSignerP12Path, OCSP_REQUEST_IGNORE, null, SKIP_USECASE); + OCSP_REQUEST_IGNORE, + null, + SKIP_USECASE, + null, + null, + OcspSeqNrUpdateMode.DO_NOT_UPDATE_OCSP_SEQ_NR); final Path certPath = getPathOfAlternativeCertificate(); @@ -229,39 +224,79 @@ private void verifyInvalidTrustAnchorWasNotImported( afoId = "GS-A_4643", description = "TUC_PKI_013: Import TI-Vertrauensanker aus TSL - Schritt 4") @DisplayName("Test updating trust anchor with certificates that have invalid times") - void verifyNewTrustAnchorInvalidTime(final TestInfo testInfo) - throws DatatypeConfigurationException, IOException { + void verifyNewTrustAnchorInvalidTime(final TestInfo testInfo) { testCaseMessage(testInfo); initialState(); - log.info("case 1: verify new trust anchor expired"); + final ZonedDateTime now = GemLibPkiUtils.now(); + final Consumer rewriteStatusStartingTime = + getActivationTimeModifier(defaultTslSigner, now); + + // --------------------------------------------------------------------------------- + + log.info("start case 1: verify new trust anchor expired"); initialStateWithAlternativeTemplate(); - tryToImportAnnouncedInvalidTrustAnchor( - tslTemplateDefectTrustAnchorChangeExpired, defaultTslSigner, OCSP_REQUEST_EXPECT); + log.info("StartingStatusTime of announced trust anchor: {}", now); + updateTrustStore( + "Try to import invalid trust anchor: offer a TSL announcing a new trust anchor (but" + + " expired). ", + tslTemplateDefectTrustAnchorChangeExpired, + defaultTslSigner, + OCSP_REQUEST_EXPECT, + getPathOfAlternativeCertificate(), + USECASE_INVALID, + OCSP_REQUEST_DO_NOT_EXPECT, + rewriteStatusStartingTime, + OcspSeqNrUpdateMode.DO_NOT_UPDATE_OCSP_SEQ_NR); verifyInvalidTrustAnchorWasNotImported( + "Offer a TSL with alternative CAs and the TSL signer certificate from the new trust anchor" + + " (but expired). ", tslTemplateInvalidAlternativeTrustAnchorExpiredAlternativeCa, tslSignerFromExpiredTrustAnchorP12Path); - log.info("case 2: verify new trust anchor not yet valid"); - initialStateWithAlternativeTemplate(); + // --------------------------------------------------------------------------------- - tryToImportAnnouncedInvalidTrustAnchor( - tslTemplateDefectTrustAnchorChangeNotYetValid, defaultTslSigner, OCSP_REQUEST_EXPECT); + log.info("start case 2: verify new trust anchor not yet valid"); + initialStateWithAlternativeTemplate(); + log.info("StartingStatusTime of announced trust anchor: {}", now); + updateTrustStore( + "Try to import invalid trust anchor: offer a TSL announcing a new trust anchor (but not yet" + + " valid). ", + tslTemplateDefectTrustAnchorChangeNotYetValid, + defaultTslSigner, + OCSP_REQUEST_EXPECT, + getPathOfAlternativeCertificate(), + USECASE_INVALID, + OCSP_REQUEST_DO_NOT_EXPECT, + rewriteStatusStartingTime, + OcspSeqNrUpdateMode.DO_NOT_UPDATE_OCSP_SEQ_NR); verifyInvalidTrustAnchorWasNotImported( + "Offer a TSL with alternative CAs and with the TSL signer certificate from the new trust" + + " anchor (but not yet valid). ", tslTemplateInvalidAlternativeTrustAnchorNotYetValidAlternativeCa, tslSignerFromNotYetValidTrustAnchorP12Path); + // --------------------------------------------------------------------------------- log.info("case 3: StatusStartingTime is expired"); initialStateWithAlternativeTemplate(); - tryToImportAnnouncedInvalidTrustAnchor( + updateTrustStore( + "Try to import invalid trust anchor: offer a TSL announcing a new valid trust anchor, that" + + " would expire to the time of specified StatusStartingTime." + + " ", tslTemplateDefectTrustAnchorChangeStartingTimeFuture, defaultTslSigner, - OCSP_REQUEST_EXPECT); + OCSP_REQUEST_EXPECT, + getPathOfAlternativeCertificate(), + USECASE_INVALID); + // --------------------------------------------------------------------------------- + log.info( + "Check if expected TSL is in the test object (TSL sequence number is in" + + " ServiceSupplyPoint)"); useCaseWithCert( getPathOfFirstValidCert(), USECASE_VALID, @@ -278,23 +313,46 @@ void verifyNewTrustAnchorInvalidTime(final TestInfo testInfo) afoId = "GS-A_4643", description = "TUC_PKI_013: Import TI-Vertrauensanker aus TSL - Schritt 1") @DisplayName("Test multiple announced trust anchors in single TSL") - void verifyMultipleAnnouncedTrustAnchorsInTsl(final TestInfo testInfo) - throws DatatypeConfigurationException, IOException { + void verifyMultipleAnnouncedTrustAnchorsInTsl(final TestInfo testInfo) { testCaseMessage(testInfo); initialState(); initialStateWithAlternativeTemplate(); - tryToImportAnnouncedInvalidTrustAnchor( - tslTemplateDefectTrustAnchorChangeTwoEntries, defaultTslSigner, OCSP_REQUEST_EXPECT); + final ZonedDateTime now = GemLibPkiUtils.now(); + final Consumer rewriteStatusStartingTime = + getActivationTimeModifier(defaultTslSigner, now); + + log.info("StartingStatusTime of announced trust anchor: {}", now); + + updateTrustStore( + "Try to import invalid trust anchor: offer a TSL announcing two trust - the first and" + + " second alternative - anchors at the same time, but without alternative CAs." + + " ", + tslTemplateDefectTrustAnchorChangeTwoEntries, + defaultTslSigner, + OCSP_REQUEST_EXPECT, + getPathOfAlternativeCertificate(), + USECASE_INVALID, + OCSP_REQUEST_DO_NOT_EXPECT, + rewriteStatusStartingTime, + OcspSeqNrUpdateMode.DO_NOT_UPDATE_OCSP_SEQ_NR); + // --------------------------------------------------------------------------------- verifyInvalidTrustAnchorWasNotImported( - tslTemplateAlternativeTrustAnchorAlternativeCa, alternativeTslSignerP12Path); + "Offer a TSL with alternative CAs and the first alternative TSL signer certificate." + + " ", + tslTemplateAlternativeTrustAnchorAlternativeCa, + alternativeTslSignerP12Path); verifyInvalidTrustAnchorWasNotImported( - tslTemplateAlternativeTrustAnchorAlternativeCa, alternativeSecondTslSignerP12Path); + "Offer a TSL with alternative CAs and the second alternative TSL signer certificate." + + " ", + tslTemplateAlternativeTrustAnchorAlternativeCa, + alternativeSecondTslSignerP12Path); + // --------------------------------------------------------------------------------- useCaseWithCert( getPathOfFirstValidCert(), USECASE_VALID, @@ -311,21 +369,29 @@ void verifyMultipleAnnouncedTrustAnchorsInTsl(final TestInfo testInfo) afoId = "GS-A_4643", description = "TUC_PKI_013: Import TI-Vertrauensanker aus TSL - Schritt 2") @DisplayName("Test for an announced broken trust anchor and cannot be extracted") - void verifyNewTrustAnchorsIsBroken(final TestInfo testInfo) - throws DatatypeConfigurationException, IOException { + void verifyNewTrustAnchorsIsBroken(final TestInfo testInfo) { testCaseMessage(testInfo); initialStateWithAlternativeTemplate(); - tryToImportAnnouncedInvalidTrustAnchor( - tslTemplateDefectTrustAnchorChangeBroken, defaultTslSigner, OCSP_REQUEST_EXPECT); + log.info("Announce new trust anchor, TSL signer CA is broken"); + updateTrustStore( + "Try to import invalid trust anchor: offer of a TSL (without alternative CAs) announcing a" + + " new trust anchor that has broken ASN.1 certificate structure. ", + tslTemplateDefectTrustAnchorChangeBroken, + defaultTslSigner, + OCSP_REQUEST_EXPECT, + getPathOfAlternativeCertificate(), + USECASE_INVALID); - useCaseWithCert( + updateTrustStore( + "Offer the default TSL.", + tslSettings.getDefaultTemplate(), + defaultTslSigner, + OCSP_REQUEST_EXPECT, getPathOfFirstValidCert(), - USECASE_VALID, - OCSP_RESP_TYPE_DEFAULT_USECASE, - OCSP_REQUEST_EXPECT); + USECASE_VALID); } /** gematikId: UE_PKI_TC_0106_005, UE_PKI_TC_0106_006 */ @@ -341,8 +407,7 @@ void verifyNewTrustAnchorsIsBroken(final TestInfo testInfo) "Test overwrite behaviour and proper handling of StatusStartingTime of announced trust" + " anchors") void verifyHandlingOfStatusStartingTimeAndOverwriteAnnouncedInactiveTrustAnchors( - final int testOrder, final TestInfo testInfo) - throws DatatypeConfigurationException, IOException { + final int testOrder, final TestInfo testInfo) { if (testOrder == 1) { log.info("execute test case verifyHandlingOfStatusStartingTimeOfAnnouncedTrustAnchor"); @@ -361,8 +426,7 @@ private void waitWithExtraSeconds(long waitingTimeSeconds) { log.info("waiting is over"); } - private void verifyHandlingOfStatusStartingTimeOfAnnouncedTrustAnchor(final TestInfo testInfo) - throws DatatypeConfigurationException, IOException { + private void verifyHandlingOfStatusStartingTimeOfAnnouncedTrustAnchor(final TestInfo testInfo) { testCaseMessage(testInfo); initialState(); @@ -370,25 +434,32 @@ private void verifyHandlingOfStatusStartingTimeOfAnnouncedTrustAnchor(final Test final long tripleTslDownloadTime = getTripleTslDownloadTime(); final ZonedDateTime newActivationTime = GemLibPkiUtils.now().plusSeconds(tripleTslDownloadTime); - log.info("StartingStatusTime of new trust anchor: {}", newActivationTime); + log.info("StartingStatusTime of announced trust anchor: {}", newActivationTime); - importNewValidTrustAnchor( + updateTrustStore( + "Offer a TSL without alternative test CAs and with announcement of a new trust anchor to be" + + " activated after next 3 TSL downloads." + + " ", tslTemplateTrustAnchorChange, defaultTslSigner, - newActivationTime, - OcspSeqNrUpdateMode.UPDATE_OCSP_SEQ_NR); - - useCaseWithCert( + OCSP_REQUEST_EXPECT, getPathOfAlternativeCertificate(), USECASE_INVALID, - OCSP_RESP_TYPE_DEFAULT_USECASE, - OCSP_REQUEST_DO_NOT_EXPECT); + OCSP_REQUEST_DO_NOT_EXPECT, + getActivationTimeModifier(defaultTslSigner, newActivationTime), + OcspSeqNrUpdateMode.UPDATE_OCSP_SEQ_NR); + // --------------------------------------------------------------------------------- try { - tryToImportAnnouncedInvalidTrustAnchor( + updateTrustStore( + "Try to import invalid trust anchor - too early: Offer a TSL with alternative CAs and the" + + " TSL signer certificate from the new trust anchor. Trust anchor is not yet" + + " active. ", tslTemplateAlternativeTrustAnchorAlternativeCa, alternativeTslSignerP12Path, - OCSP_REQUEST_IGNORE); + OCSP_REQUEST_IGNORE, + getPathOfAlternativeCertificate(), + USECASE_INVALID); } catch (final Exception e) { // TODO integrate this fallback into tryToImportAnnouncedInvalidTrustAnchor around // useCaseWithCert @@ -399,23 +470,28 @@ private void verifyHandlingOfStatusStartingTimeOfAnnouncedTrustAnchor(final Test "a trust anchor was unexpectedly imported into the test object - a fallback was performed" + " to switch to the default trust anchor"); } + // --------------------------------------------------------------------------------- waitWithExtraSeconds(tripleTslDownloadTime); log.info( "new trust anchor should be activated now - StartingStatusTime: {}", newActivationTime); + verifyInvalidTrustAnchorWasNotImported( + "Offer a TSL with alternative CAs and TSL signer certificate from the standard trust" + + " space. ", + tslSettings.getAlternativeTemplate(), + defaultTslSigner); - verifyInvalidTrustAnchorWasNotImported(tslSettings.getAlternativeTemplate(), defaultTslSigner); + // --------------------------------------------------------------------------------- - importNewValidTrustAnchor( + updateTrustStore( + "Offer a TSL with alternative test CAs and TSL signer certificate from the new trust" + + " anchor. Trust anchor should be active." + + " ", tslTemplateAlternativeTrustAnchorAlternativeCa, alternativeTslSignerP12Path, - null, - OcspSeqNrUpdateMode.DO_NOT_UPDATE_OCSP_SEQ_NR); - - useCaseWithCert( + OCSP_REQUEST_EXPECT, getPathOfAlternativeCertificate(), USECASE_VALID, - OCSP_RESP_TYPE_DEFAULT_USECASE, OCSP_REQUEST_EXPECT); fallBackFromAlternativeToDefaultTrustAnchorAndCheck(alternativeTslSignerP12Path); @@ -441,8 +517,7 @@ private static long getTripleTslDownloadTime() { return tripleTslDownloadTime; } - private void verifyOverwriteAnnouncedInactiveTrustAnchor(final TestInfo testInfo) - throws DatatypeConfigurationException, IOException { + private void verifyOverwriteAnnouncedInactiveTrustAnchor(final TestInfo testInfo) { testCaseMessage(testInfo); initialState(); @@ -452,51 +527,81 @@ private void verifyOverwriteAnnouncedInactiveTrustAnchor(final TestInfo testInfo final long tripleTslDownloadTime = getTripleTslDownloadTime(); final ZonedDateTime newActivationTime = now.plusSeconds(tripleTslDownloadTime); - importNewValidTrustAnchor( + log.info("StartingStatusTime of announced trust anchor: {}", newActivationTime); + updateTrustStore( + "Announce first new trust anchor (TA1): Offer a TSL without alternative test CAs and with" + + " announcement of a new trust anchor. Activation time: 3 x TSL download interval." + + " ", tslTemplateTrustAnchorChangeFuture, defaultTslSigner, - newActivationTime, + OCSP_REQUEST_EXPECT, + null, + SKIP_USECASE, + null, + getActivationTimeModifier(defaultTslSigner, newActivationTime), OcspSeqNrUpdateMode.DO_NOT_UPDATE_OCSP_SEQ_NR); + // --------------------------------------------------------------------------------- + final long tripleTslDownloadTimeM10 = tripleTslDownloadTime - 10; if (tripleTslDownloadTimeM10 < 0) { // TODO implement fallback log.error("activation of new trust anchor is in the past (too early)"); } - final ZonedDateTime newActivationTime2 = now.plusSeconds(tripleTslDownloadTimeM10); + log.info("StartingStatusTime of announced trust anchor: {}", newActivationTime2); - log.info("StartingStatusTime of new trust anchor: {}", newActivationTime2); - - importNewValidTrustAnchor( + updateTrustStore( + "Announce first new trust anchor (TA2): Offer a TSL without alternative test CAs and with" + + " announcement of another new trust anchor. Activation time: (3 x TSL download" + + " interval) - 10 seconds. ", tslTemplateTrustAnchorChangeAlternativeTrustAnchor2FutureShort, defaultTslSigner, - newActivationTime2, + OCSP_REQUEST_EXPECT, + null, + SKIP_USECASE, + null, + getActivationTimeModifier(defaultTslSigner, newActivationTime2), OcspSeqNrUpdateMode.UPDATE_OCSP_SEQ_NR); + // --------------------------------------------------------------------------------- waitWithExtraSeconds(tripleTslDownloadTime); log.info( "new trust anchor should be activated now - StartingStatusTime: {}", newActivationTime2); + log.info( + "Try to use first new trust anchor TA1 (must not be in the truststore of the test object)"); verifyInvalidTrustAnchorWasNotImported( - tslTemplateAlternativeTrustAnchorAlternativeCa, alternativeTslSignerP12Path); + "Offer a TSL with alternative test CAs and TSL signer certificate from the first new trust" + + " anchor. ", + tslTemplateAlternativeTrustAnchorAlternativeCa, + alternativeTslSignerP12Path); + + log.info( + "Try to use second new trust anchor TA2 (should be in the truststore of the test object)"); - importNewValidTrustAnchor( + updateTrustStore( + "Offer a TSL with alternative test CAs and TSL signer certificate from the second" + + " (alternative) new trust anchor. ", tslTemplateAlternativeTrustAnchor2AlternativeCa, alternativeSecondTslSignerP12Path, - null, - OcspSeqNrUpdateMode.DO_NOT_UPDATE_OCSP_SEQ_NR); - - useCaseWithCert( + OcspRequestExpectationBehaviour.OCSP_REQUEST_EXPECT, getPathOfAlternativeCertificate(), USECASE_VALID, - OCSP_RESP_TYPE_DEFAULT_USECASE, OCSP_REQUEST_EXPECT); - importNewValidTrustAnchor( + // --------------------------------------------------------------------------------- + + updateTrustStore( + getSwitchMessage(TA_NAME_ALT2, TA_NAME_DEFAULT) + + "", tslTemplateAlternativeTrustAnchor2TrustAnchorChange, alternativeSecondTslSignerP12Path, + OCSP_REQUEST_EXPECT, + null, + SKIP_USECASE, + null, null, OcspSeqNrUpdateMode.UPDATE_OCSP_SEQ_NR); diff --git a/pkits-testsuite/src/main/java/de/gematik/pki/pkits/testsuite/approval/TslVaApprovalUtilsBaseIT.java b/pkits-testsuite/src/main/java/de/gematik/pki/pkits/testsuite/approval/TslVaApprovalUtilsBaseIT.java index 7258c02..10840f2 100644 --- a/pkits-testsuite/src/main/java/de/gematik/pki/pkits/testsuite/approval/TslVaApprovalUtilsBaseIT.java +++ b/pkits-testsuite/src/main/java/de/gematik/pki/pkits/testsuite/approval/TslVaApprovalUtilsBaseIT.java @@ -16,16 +16,15 @@ package de.gematik.pki.pkits.testsuite.approval; -import static de.gematik.pki.pkits.testsuite.common.TestSuiteConstants.SIGNER_KEY_USAGE_CHECK_ENABLED; -import static de.gematik.pki.pkits.testsuite.common.TestSuiteConstants.SIGNER_VALIDITY_CHECK_ENABLED; - import de.gematik.pki.gemlibpki.tsl.TslConstants; import de.gematik.pki.gemlibpki.tsl.TslModifier; import de.gematik.pki.pkits.common.PkitsConstants; +import de.gematik.pki.pkits.testsuite.approval.support.UseCaseResult; import de.gematik.pki.pkits.testsuite.common.tsl.TslDownload; -import java.io.IOException; +import de.gematik.pki.pkits.testsuite.exceptions.TestSuiteException; import java.nio.file.Path; import java.time.ZonedDateTime; +import java.util.function.Consumer; import javax.xml.datatype.DatatypeConfigurationException; import lombok.NonNull; import lombok.extern.slf4j.Slf4j; @@ -33,6 +32,7 @@ @Slf4j public abstract class TslVaApprovalUtilsBaseIT extends ApprovalTestsBaseIT { + protected static final UseCaseResult SKIP_USECASE = null; final Path alternativeTslSignerP12Path = Path.of(TRUST_ANCHOR_TEMPLATES_DIRNAME, "TSL-Signing-Unit-9-TEST-ONLY.p12"); @@ -42,63 +42,43 @@ public abstract class TslVaApprovalUtilsBaseIT extends ApprovalTestsBaseIT { final Path tslSignerFromExpiredTrustAnchorP12Path = Path.of(TRUST_ANCHOR_TEMPLATES_DIRNAME, "valid_tsl_signer_from_expired_ta.p12"); - protected enum OcspSeqNrUpdateMode { - UPDATE_OCSP_SEQ_NR, - DO_NOT_UPDATE_OCSP_SEQ_NR + protected static final String TA_NAME_DEFAULT = "default"; + protected static final String TA_NAME_ALT1 = "first alternative"; + protected static final String TA_NAME_ALT2 = "second alternative"; + + protected static String getSwitchMessage(final String anchorType1, final String anchorType2) { + return "Offer a TSL to switch from the %s trust anchor to the %s trust anchor." + .formatted(anchorType1, anchorType2); + } + + Consumer getActivationTimeModifier( + final Path tslSignerPath, final ZonedDateTime newActivationTime) { + return (tslDownload) -> { + if (newActivationTime != null) { + setNewActivationTime(tslDownload, tslSignerPath, newActivationTime); + } + }; } private void setNewActivationTime( final TslDownload tslDownload, @NonNull final Path tslSignerPath, - final ZonedDateTime newActivationTime) - throws DatatypeConfigurationException, IOException { + final ZonedDateTime newActivationTime) { byte[] tslBytes = tslDownload.getTslBytes(); - tslBytes = - TslModifier.modifiedStatusStartingTime( - tslBytes, - PkitsConstants.GEMATIK_TEST_TSP, - TslConstants.STI_SRV_CERT_CHANGE, - null, - newActivationTime); - - signAndSetTslBytes(tslDownload, tslSignerPath, tslBytes); - writeTsl(tslDownload, "_modified"); - } - - protected void importNewValidTrustAnchor( - @NonNull final Path tslTemplate, - @NonNull final Path tslSignerPath, - final ZonedDateTime newActivationTime, - final OcspSeqNrUpdateMode ocspSeqNrUpdateMode) - throws DatatypeConfigurationException, IOException { - - log.info("importNewValidTrustAnchor - start: tsl template {}", tslTemplate); - - final int offeredSeqNr = tslSequenceNr.getNextTslSeqNr(); - log.info("Offering TSL with seqNr. {} for download.", offeredSeqNr); - - final TslDownload tslDownload = - getTslDownloadWithTemplateAndSigner( - offeredSeqNr, - tslTemplate, - tslSignerPath, - SIGNER_KEY_USAGE_CHECK_ENABLED, - SIGNER_VALIDITY_CHECK_ENABLED); - if (newActivationTime != null) { - setNewActivationTime(tslDownload, tslSignerPath, newActivationTime); + try { + tslBytes = + TslModifier.modifiedStatusStartingTime( + tslBytes, + PkitsConstants.GEMATIK_TEST_TSP, + TslConstants.STI_SRV_CERT_CHANGE, + null, + newActivationTime); + } catch (final DatatypeConfigurationException e) { + throw new TestSuiteException("cannot modify TSL", e); } - printCurrentTslSeqNr(); - tslSequenceNr.setLastOfferedNr(offeredSeqNr); - tslDownload.waitUntilTslDownloadCompleted(offeredSeqNr, getExpectedOcspTslSeqNr()); - tslSequenceNr.setExpectedNrInTestObject(offeredSeqNr); - - if (ocspSeqNrUpdateMode == OcspSeqNrUpdateMode.UPDATE_OCSP_SEQ_NR) { - setExpectedOcspTslSeqNr(tslSequenceNr.getExpectedNrInTestObject()); - } - - log.info("importNewValidTrustAnchor - finish\n\n"); + signAndSetTslBytes(tslDownload, tslSignerPath, tslBytes); } } diff --git a/pkits-testsuite/src/main/java/de/gematik/pki/pkits/testsuite/approval/TslVaSwitchUtils.java b/pkits-testsuite/src/main/java/de/gematik/pki/pkits/testsuite/approval/TslVaSwitchUtils.java index 409725b..22610a4 100644 --- a/pkits-testsuite/src/main/java/de/gematik/pki/pkits/testsuite/approval/TslVaSwitchUtils.java +++ b/pkits-testsuite/src/main/java/de/gematik/pki/pkits/testsuite/approval/TslVaSwitchUtils.java @@ -20,9 +20,8 @@ import static de.gematik.pki.pkits.testsuite.common.ocsp.OcspHistory.OcspRequestExpectationBehaviour.OCSP_REQUEST_EXPECT; import de.gematik.pki.gemlibpki.utils.GemLibPkiUtils; -import java.io.IOException; +import de.gematik.pki.pkits.testsuite.approval.support.OcspSeqNrUpdateMode; import java.nio.file.Path; -import javax.xml.datatype.DatatypeConfigurationException; import lombok.extern.slf4j.Slf4j; import org.junit.jupiter.api.Order; import org.junit.jupiter.api.Test; @@ -32,11 +31,17 @@ class TslVaSwitchUtils extends TslVaApprovalUtilsBaseIT { @Test @Order(101) - void switchFromDefaultToAlternativeFirst() throws DatatypeConfigurationException, IOException { + void switchFromDefaultToAlternativeFirst() { - switchTrustAnchor(TslVaApprovalTestsIT.tslTemplateTrustAnchorChange, defaultTslSigner, true); + switchTrustAnchor( + getSwitchMessage(TA_NAME_DEFAULT, TA_NAME_ALT1), + TslVaApprovalTestsIT.tslTemplateTrustAnchorChange, + defaultTslSigner, + true); updateTrustStore( + "Offer a TSL (with alternate test CAs), signed with the new (announced) first alternative" + + " trust anchor.", TslVaApprovalTestsIT.tslTemplateAlternativeTrustAnchorAlternativeCa, alternativeTslSignerP12Path, OCSP_REQUEST_EXPECT, @@ -46,13 +51,15 @@ void switchFromDefaultToAlternativeFirst() throws DatatypeConfigurationException @Test @Order(102) - void switchFromAlternativeFirstToDefault() throws DatatypeConfigurationException, IOException { + void switchFromAlternativeFirstToDefault() { switchTrustAnchor( + getSwitchMessage(TA_NAME_ALT1, TA_NAME_DEFAULT), TslVaApprovalTestsIT.tslTemplateAlternativeTrustAnchorTrustAnchorChange, alternativeTslSignerP12Path, false); updateTrustStore( + "Offer the default TSL.", tslSettings.getDefaultTemplate(), defaultTslSigner, OCSP_REQUEST_EXPECT, @@ -62,13 +69,16 @@ void switchFromAlternativeFirstToDefault() throws DatatypeConfigurationException @Test @Order(103) - void switchFromDefaultToAlternativeSecond() throws DatatypeConfigurationException, IOException { + void switchFromDefaultToAlternativeSecond() { switchTrustAnchor( + getSwitchMessage(TA_NAME_DEFAULT, TA_NAME_ALT2), TslVaApprovalTestsIT.tslTemplateTrustAnchorChangeAlternativeTrustAnchor2FutureShort, defaultTslSigner, true); updateTrustStore( + "Offer a TSL with alternative test CAs and TSL signer certificate from the second" + + " (alternative) new trust anchor.", TslVaApprovalTestsIT.tslTemplateAlternativeTrustAnchor2AlternativeCa, alternativeSecondTslSignerP12Path, OCSP_REQUEST_EXPECT, @@ -78,13 +88,15 @@ void switchFromDefaultToAlternativeSecond() throws DatatypeConfigurationExceptio @Test @Order(104) - void switchFromAlternativeSecondToDefault() throws DatatypeConfigurationException, IOException { + void switchFromAlternativeSecondToDefault() { switchTrustAnchor( + getSwitchMessage(TA_NAME_ALT2, TA_NAME_DEFAULT), TslVaApprovalTestsIT.tslTemplateAlternativeTrustAnchor2TrustAnchorChange, alternativeSecondTslSignerP12Path, false); updateTrustStore( + "Offer the default TSL.", tslSettings.getDefaultTemplate(), defaultTslSigner, OCSP_REQUEST_EXPECT, @@ -93,8 +105,10 @@ void switchFromAlternativeSecondToDefault() throws DatatypeConfigurationExceptio } void switchTrustAnchor( - final Path tslTemplate, final Path tslSignerP12Path, final boolean withInitialState) - throws DatatypeConfigurationException, IOException { + final String description, + final Path tslTemplate, + final Path tslSignerP12Path, + final boolean withInitialState) { retrieveCurrentTslSeqNrInTestObject(); if (withInitialState) { @@ -107,10 +121,15 @@ void switchTrustAnchor( log.info( "switchTrustAnchor:\ntslTemplate {}\n, tslSignerP12Path {}", tslTemplate, tslSignerP12Path); - importNewValidTrustAnchor( + updateTrustStore( + description, tslTemplate, tslSignerP12Path, - GemLibPkiUtils.now(), + OCSP_REQUEST_EXPECT, + null, + SKIP_USECASE, + null, + getActivationTimeModifier(tslSignerP12Path, GemLibPkiUtils.now()), OcspSeqNrUpdateMode.UPDATE_OCSP_SEQ_NR); log.info("switchTrustAnchor\n\n"); diff --git a/pkits-testsuite/src/main/java/de/gematik/pki/pkits/testsuite/approval/support/OcspSeqNrUpdateMode.java b/pkits-testsuite/src/main/java/de/gematik/pki/pkits/testsuite/approval/support/OcspSeqNrUpdateMode.java new file mode 100644 index 0000000..3688b32 --- /dev/null +++ b/pkits-testsuite/src/main/java/de/gematik/pki/pkits/testsuite/approval/support/OcspSeqNrUpdateMode.java @@ -0,0 +1,22 @@ +/* + * Copyright (c) 2023 gematik GmbH + * + * Licensed under the Apache License, Version 2.0 (the License); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an 'AS IS' BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +package de.gematik.pki.pkits.testsuite.approval.support; + +public enum OcspSeqNrUpdateMode { + UPDATE_OCSP_SEQ_NR, + DO_NOT_UPDATE_OCSP_SEQ_NR +} diff --git a/pkits-testsuite/src/main/java/de/gematik/pki/pkits/testsuite/common/PkitsTestSuiteUtils.java b/pkits-testsuite/src/main/java/de/gematik/pki/pkits/testsuite/common/PkitsTestSuiteUtils.java index a0503e3..6798d85 100644 --- a/pkits-testsuite/src/main/java/de/gematik/pki/pkits/testsuite/common/PkitsTestSuiteUtils.java +++ b/pkits-testsuite/src/main/java/de/gematik/pki/pkits/testsuite/common/PkitsTestSuiteUtils.java @@ -62,8 +62,10 @@ public static long waitForEventMillis( .pollInterval(Duration.ofMillis(pollIntervalMillis)) .until(eventChecker); } catch (final ConditionTimeoutException e) { - final String message = "Timeout for event \"%s\":: %s".formatted(name, getCallerTrace()); - log.error(message, e); + final String message = + "Timeout for event \"%s\"\n%s:%s\n:: %s%n" + .formatted(name, e.getClass().getCanonicalName(), e.getMessage(), getCallerTrace()); + log.error(message); throw new TestSuiteException(message, e); } final ZonedDateTime zdtEnd = ZonedDateTime.now(); diff --git a/pkits-testsuite/src/main/java/de/gematik/pki/pkits/testsuite/common/tsl/TslDownload.java b/pkits-testsuite/src/main/java/de/gematik/pki/pkits/testsuite/common/tsl/TslDownload.java index fdcb816..40b9401 100644 --- a/pkits-testsuite/src/main/java/de/gematik/pki/pkits/testsuite/common/tsl/TslDownload.java +++ b/pkits-testsuite/src/main/java/de/gematik/pki/pkits/testsuite/common/tsl/TslDownload.java @@ -148,7 +148,7 @@ public void waitUntilOcspRequestForSignerOptional() { try { waitUntilOcspRequestForSigner(); } catch (final TestSuiteException e) { - log.info("no ocsp optional requests received -> continue\n\n"); + log.info("no (optional) OCSP requests received -> CONTINUE\n\n"); } } diff --git a/pkits-testsuite/src/main/java/de/gematik/pki/pkits/testsuite/config/TslSettings.java b/pkits-testsuite/src/main/java/de/gematik/pki/pkits/testsuite/config/TslSettings.java index 4da6334..497f6ed 100644 --- a/pkits-testsuite/src/main/java/de/gematik/pki/pkits/testsuite/config/TslSettings.java +++ b/pkits-testsuite/src/main/java/de/gematik/pki/pkits/testsuite/config/TslSettings.java @@ -39,6 +39,7 @@ public class TslSettings { description = "Alternative template to generate a TSL with additional CAs during tests.") Path alternativeTemplate = Path.of("./testDataTemplates/tsl/TSL_altCA.xml"); + /** TSLTypeID 202 */ @ParameterDescription( withDefault = true, description = @@ -46,6 +47,7 @@ public class TslSettings { Path defectAlternativeCaBrokenTemplate = Path.of("./testDataTemplates/tsl/TSL_defect_altCA_broken.xml"); + /** TSLTypeID 203 */ @ParameterDescription( withDefault = true, description = @@ -53,6 +55,7 @@ public class TslSettings { Path defectAlternativeCaUnspecifiedTemplate = Path.of("./testDataTemplates/tsl/TSL_defect_unspecified-CA_altCA.xml"); + /** TSLTypeID 204 */ @ParameterDescription( withDefault = true, description = diff --git a/pkits-testsuite/src/site/pdf.xml b/pkits-testsuite/src/site/pdf.xml deleted file mode 100644 index 9d80adf..0000000 --- a/pkits-testsuite/src/site/pdf.xml +++ /dev/null @@ -1,30 +0,0 @@ - - - - - - gematik PKI test suite test report - gematik GmbH - - - - - - - - - ${project.name} - v. ${project.version} - Test report - ${project.name} - - ${project.organization.name} - - - diff --git a/pkits-testsuite/src/site/resources/pdf-config.xml b/pkits-testsuite/src/site/resources/pdf-config.xml deleted file mode 100644 index d9260ed..0000000 --- a/pkits-testsuite/src/site/resources/pdf-config.xml +++ /dev/null @@ -1,45 +0,0 @@ - - - - - - - - - - - 16.50in - 11.70in - 0.3in - 0.3in - 0.5in - 0.5in - - - - - \ No newline at end of file diff --git a/pkits-tls-client/pom.xml b/pkits-tls-client/pom.xml index 7d4bf05..1d09f38 100644 --- a/pkits-tls-client/pom.xml +++ b/pkits-tls-client/pom.xml @@ -4,10 +4,11 @@ de.gematik.pki.pkits pkits-global - 1.0.1 + 1.0.6 pkits-tls-client + 1.0.6 TLS Client TLS Client diff --git a/pkits-tsl-provider/pom.xml b/pkits-tsl-provider/pom.xml index 3737f9a..b19eb49 100644 --- a/pkits-tsl-provider/pom.xml +++ b/pkits-tsl-provider/pom.xml @@ -4,10 +4,11 @@ de.gematik.pki.pkits pkits-global - 1.0.1 + 1.0.6 pkits-tsl-provider + 1.0.6 TSL Server Simulator Spring Boot TSL Provider diff --git a/pom.xml b/pom.xml index 62206e4..cdb7ac2 100644 --- a/pom.xml +++ b/pom.xml @@ -9,7 +9,7 @@ de.gematik.pki.pkits pkits-global - 1.0.1 + 1.0.6 pom PkiTs Uebergreifende Java PKI Testsuite @@ -104,6 +104,7 @@ 3.4.2 3.2.0 3.10.1 + 3.1.1 3.2.1 ${version.maven-surefire-plugin} 3.5.0 @@ -331,6 +332,11 @@ + + org.apache.maven.plugins + maven-deploy-plugin + ${version.maven-deploy-plugin} + @@ -512,6 +518,10 @@ + + org.apache.maven.plugins + maven-deploy-plugin +