allow to parse and handle multiple certs in a pem file

4 files changed, 99 insertions, 3 deletions

diff --git a/app/src/test/java/se/leap/bitmaskclient/eip/ProviderApiManagerTest.java b/app/src/test/java/se/leap/bitmaskclient/eip/ProviderApiManagerTest.java
index d6ee0def..f3fd5dbb 100644
--- a/app/src/test/java/se/leap/bitmaskclient/eip/ProviderApiManagerTest.java
+++ b/app/src/test/java/se/leap/bitmaskclient/eip/ProviderApiManagerTest.java
@@ -322,6 +322,7 @@ public class ProviderApiManagerTest {
     public void test_handleIntentSetupProvider_preseededProviderAndCA_outdatedCertificate() throws IOException, CertificateEncodingException, NoSuchAlgorithmException, JSONException {
         Provider provider = getProvider(null ,null, null, null, "outdated_cert.pem", null, null, null);
         mockProviderApiConnector(NO_ERROR);
+        mockConfigHelper("a5244308a1374709a9afce95e3ae47c1b44bc2398c0a70ccbf8b3a8a97f29494");
         providerApiManager = new ProviderApiManager(mockPreferences, mockResources, mockClientGenerator(), new TestProviderApiServiceCallback());
 
         Bundle expectedResult = mockBundle();
@@ -343,6 +344,7 @@ public class ProviderApiManagerTest {
     public void test_handleIntentSetupProvider_storedProviderAndCAFromPreviousSetup_outdatedCertificate() throws IOException, CertificateEncodingException, NoSuchAlgorithmException, JSONException {
         Provider provider = getConfiguredProvider(); //new Provider("https://riseup.net");
         mockProviderApiConnector(NO_ERROR);
+        mockConfigHelper("a5244308a1374709a9afce95e3ae47c1b44bc2398c0a70ccbf8b3a8a97f29494");
         mockPreferences.edit().putString(Provider.KEY + ".riseup.net", getInputAsString(getClass().getClassLoader().getResourceAsStream("riseup.net.json"))).apply();
         mockPreferences.edit().putString(Provider.CA_CERT + ".riseup.net", getInputAsString(getClass().getClassLoader().getResourceAsStream("outdated_cert.pem"))).apply();
         providerApiManager = new ProviderApiManager(mockPreferences, mockResources, mockClientGenerator(), new TestProviderApiServiceCallback());
diff --git a/app/src/test/java/se/leap/bitmaskclient/eip/VpnCertificateValidatorTest.java b/app/src/test/java/se/leap/bitmaskclient/eip/VpnCertificateValidatorTest.java
new file mode 100644
index 00000000..32c0d0e4
--- /dev/null
+++ b/app/src/test/java/se/leap/bitmaskclient/eip/VpnCertificateValidatorTest.java
@@ -0,0 +1,69 @@
+package se.leap.bitmaskclient.eip;
+
+import org.junit.Before;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.powermock.core.classloader.annotations.PrepareForTest;
+import org.powermock.modules.junit4.PowerMockRunner;
+
+import java.io.IOException;
+import java.security.NoSuchAlgorithmException;
+import java.security.cert.CertificateEncodingException;
+import java.util.Calendar;
+
+import se.leap.bitmaskclient.base.utils.ConfigHelper;
+import se.leap.bitmaskclient.testutils.TestCalendarProvider;
+
+import static org.junit.Assert.assertFalse;
+import static org.junit.Assert.assertTrue;
+import static se.leap.bitmaskclient.testutils.MockHelper.mockConfigHelper;
+import static se.leap.bitmaskclient.testutils.TestSetupHelper.getInputAsString;
+
+@RunWith(PowerMockRunner.class)
+@PrepareForTest({ConfigHelper.class})
+public class VpnCertificateValidatorTest {
+
+    @Before
+    public void setup() {
+    }
+
+    @Test
+    public void test_isValid() throws NoSuchAlgorithmException, CertificateEncodingException, IOException {
+        String cert = getInputAsString(getClass().getClassLoader().getResourceAsStream("riseup.net.pem"));
+        Calendar c = new Calendar.Builder().setDate(2018, 1, 1).setCalendarType("gregorian").build();
+        mockConfigHelper("falseFingerPrint");
+        VpnCertificateValidator validator = new VpnCertificateValidator(cert);
+        validator.setCalendarProvider(new TestCalendarProvider(c.getTimeInMillis()));
+        assertTrue( validator.isValid());
+    }
+
+    @Test
+    public void test_isValid_lessThan15days_returnFalse() throws NoSuchAlgorithmException, CertificateEncodingException, IOException {
+        String cert = getInputAsString(getClass().getClassLoader().getResourceAsStream("riseup.net.pem"));
+        Calendar c = new Calendar.Builder().setDate(2024, 4, 14).setCalendarType("gregorian").build();
+        mockConfigHelper("falseFingerPrint");
+        VpnCertificateValidator validator = new VpnCertificateValidator(cert);
+        validator.setCalendarProvider(new TestCalendarProvider(c.getTimeInMillis()));
+        assertFalse( validator.isValid());
+    }
+
+    @Test
+    public void test_isValid_multipleCerts_failIfOneExpires() throws NoSuchAlgorithmException, CertificateEncodingException, IOException {
+        String cert = getInputAsString(getClass().getClassLoader().getResourceAsStream("float.hexacab.org.pem"));
+        Calendar c = new Calendar.Builder().setDate(2024, 4, 14).setCalendarType("gregorian").build();
+        mockConfigHelper("falseFingerPrint");
+        VpnCertificateValidator validator = new VpnCertificateValidator(cert);
+        validator.setCalendarProvider(new TestCalendarProvider(c.getTimeInMillis()));
+        assertFalse(validator.isValid());
+    }
+
+    @Test
+    public void test_isValid_multipleCerts_allValid() throws NoSuchAlgorithmException, CertificateEncodingException, IOException {
+        String cert = getInputAsString(getClass().getClassLoader().getResourceAsStream("float.hexacab.org.pem"));
+        Calendar c = new Calendar.Builder().setDate(2024, 4, 13).setCalendarType("gregorian").build();
+        mockConfigHelper("falseFingerPrint");
+        VpnCertificateValidator validator = new VpnCertificateValidator(cert);
+        validator.setCalendarProvider(new TestCalendarProvider(c.getTimeInMillis()));
+        assertFalse(validator.isValid());
+    }
+}
\ No newline at end of file
diff --git a/app/src/test/java/se/leap/bitmaskclient/testutils/MockHelper.java b/app/src/test/java/se/leap/bitmaskclient/testutils/MockHelper.java
index dd3053df..f80f41ed 100644
--- a/app/src/test/java/se/leap/bitmaskclient/testutils/MockHelper.java
+++ b/app/src/test/java/se/leap/bitmaskclient/testutils/MockHelper.java
@@ -38,7 +38,6 @@ import java.util.Vector;
 import java.util.concurrent.TimeoutException;
 import java.util.concurrent.atomic.AtomicBoolean;
 
-import okhttp3.Connection;
 import okhttp3.OkHttpClient;
 import se.leap.bitmaskclient.R;
 import se.leap.bitmaskclient.base.models.Provider;
@@ -413,7 +412,7 @@ public class MockHelper {
         mockStatic(ConfigHelper.class);
         when(ConfigHelper.getFingerprintFromCertificate(any(X509Certificate.class), anyString())).thenReturn(mockedFingerprint);
         when(ConfigHelper.checkErroneousDownload(anyString())).thenCallRealMethod();
-        when(ConfigHelper.parseX509CertificateFromString(anyString())).thenCallRealMethod();
+        when(ConfigHelper.parseX509CertificatesFromString(anyString())).thenCallRealMethod();
         when(ConfigHelper.getProviderFormattedString(any(Resources.class), anyInt())).thenCallRealMethod();
         when(ConfigHelper.timezoneDistance(anyInt(), anyInt())).thenCallRealMethod();
         when(ConfigHelper.isIPv4(anyString())).thenCallRealMethod();
@@ -507,7 +506,7 @@ public class MockHelper {
         mockStatic(ConfigHelper.class);
         when(ConfigHelper.getFingerprintFromCertificate(any(X509Certificate.class), anyString())).thenReturn(mockedFingerprint);
         when(ConfigHelper.checkErroneousDownload(anyString())).thenCallRealMethod();
-        when(ConfigHelper.parseX509CertificateFromString(anyString())).thenCallRealMethod();
+        when(ConfigHelper.parseX509CertificatesFromString(anyString())).thenCallRealMethod();
         when(ConfigHelper.getProviderFormattedString(any(Resources.class), anyInt())).thenCallRealMethod();
     }
 
diff --git a/app/src/test/java/se/leap/bitmaskclient/testutils/TestCalendarProvider.java b/app/src/test/java/se/leap/bitmaskclient/testutils/TestCalendarProvider.java
new file mode 100644
index 00000000..ea202ab4
--- /dev/null
+++ b/app/src/test/java/se/leap/bitmaskclient/testutils/TestCalendarProvider.java
@@ -0,0 +1,26 @@
+package se.leap.bitmaskclient.testutils;
+
+import java.util.Calendar;
+
+import se.leap.bitmaskclient.eip.CalendarProviderInterface;
+
+/**
+ * Created by cyberta on 13.09.17.
+ */
+
+public class TestCalendarProvider implements CalendarProviderInterface {
+
+    private long currentTimeInMillis = 0;
+
+    public TestCalendarProvider(long currentTimeInMillis) {
+        this.currentTimeInMillis = currentTimeInMillis;
+    }
+
+    @Override
+    public Calendar getCalendar() {
+        Calendar calendar = Calendar.getInstance();
+        calendar.setTimeInMillis(currentTimeInMillis);
+        return calendar;
+    }
+
+}