xref: /external/conscrypt/platform/src/test/java/org/conscrypt/TrustedCertificateStoreTest.java

/*
 * Copyright (C) 2011 The Android Open Source Project
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 *
 *      http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */

package org.conscrypt;

import java.io.ByteArrayInputStream;
import java.io.ByteArrayOutputStream;
import java.io.File;
import java.io.FileInputStream;
import java.io.FileOutputStream;
import java.io.IOException;
import java.io.InputStream;
import java.io.OutputStream;
import java.security.KeyStore;
import java.security.KeyStore.PrivateKeyEntry;
import java.security.KeyStore.TrustedCertificateEntry;
import java.security.PrivateKey;
import java.security.PublicKey;
import java.security.cert.Certificate;
import java.security.cert.CertificateFactory;
import java.security.cert.X509Certificate;
import java.util.Arrays;
import java.util.HashSet;
import java.util.List;
import java.util.Random;
import java.util.Set;
import java.util.concurrent.Callable;
import java.util.concurrent.ExecutorService;
import java.util.concurrent.Executors;
import java.util.concurrent.Future;
import java.util.concurrent.TimeUnit;
import java.util.concurrent.TimeoutException;
import javax.security.auth.x500.X500Principal;
import junit.framework.TestCase;
import libcore.java.security.TestKeyStore;

public class TrustedCertificateStoreTest extends TestCase {
    private static final Random tempFileRandom = new Random();

    private final File dirTest = new File(System.getProperty("java.io.tmpdir", "."),
            "cert-store-test" + tempFileRandom.nextInt());
    private final File dirSystem = new File(dirTest, "system");
    private final File dirAdded = new File(dirTest, "added");
    private final File dirDeleted = new File(dirTest, "removed");

    private static X509Certificate CA1;
    private static X509Certificate CA2;

    private static KeyStore.PrivateKeyEntry PRIVATE;
    private static X509Certificate[] CHAIN;

    private static X509Certificate CA3_WITH_CA1_SUBJECT;
    private static String ALIAS_SYSTEM_CA1;
    private static String ALIAS_SYSTEM_CA2;
    private static String ALIAS_USER_CA1;
    private static String ALIAS_USER_CA2;

    private static String ALIAS_SYSTEM_CHAIN0;
    private static String ALIAS_SYSTEM_CHAIN1;
    private static String ALIAS_SYSTEM_CHAIN2;
    private static String ALIAS_USER_CHAIN0;
    private static String ALIAS_USER_CHAIN1;
    private static String ALIAS_USER_CHAIN2;

    private static String ALIAS_SYSTEM_CA3;
    private static String ALIAS_SYSTEM_CA3_COLLISION;
    private static String ALIAS_USER_CA3;
    private static String ALIAS_USER_CA3_COLLISION;

    private static X509Certificate CERTLOOP_EE;
    private static X509Certificate CERTLOOP_CA1;
    private static X509Certificate CERTLOOP_CA2;
    private static String ALIAS_USER_CERTLOOP_EE;
    private static String ALIAS_USER_CERTLOOP_CA1;
    private static String ALIAS_USER_CERTLOOP_CA2;

    private static X509Certificate MULTIPLE_ISSUERS_CA1;
    private static X509Certificate MULTIPLE_ISSUERS_CA1_CROSS;
    private static X509Certificate MULTIPLE_ISSUERS_CA2;
    private static X509Certificate MULTIPLE_ISSUERS_EE;
    private static String ALIAS_MULTIPLE_ISSUERS_CA1;
    private static String ALIAS_MULTIPLE_ISSUERS_CA1_CROSS;
    private static String ALIAS_MULTIPLE_ISSUERS_CA2;
    private static String ALIAS_MULTIPLE_ISSUERS_EE;

    private static X509Certificate getCa1() {
        initCerts();
        return CA1;
    }
    private static X509Certificate getCa2() {
        initCerts();
        return CA2;
    }

    private static KeyStore.PrivateKeyEntry getPrivate() {
        initCerts();
        return PRIVATE;
    }
    private static X509Certificate[] getChain() {
        initCerts();
        return CHAIN;
    }

    private static X509Certificate getCa3WithCa1Subject() {
        initCerts();
        return CA3_WITH_CA1_SUBJECT;
    }

    private static String getAliasSystemCa1() {
        initCerts();
        return ALIAS_SYSTEM_CA1;
    }
    private static String getAliasSystemCa2() {
        initCerts();
        return ALIAS_SYSTEM_CA2;
    }
    private static String getAliasUserCa1() {
        initCerts();
        return ALIAS_USER_CA1;
    }
    private static String getAliasUserCa2() {
        initCerts();
        return ALIAS_USER_CA2;
    }

    private static String getAliasSystemChain0() {
        initCerts();
        return ALIAS_SYSTEM_CHAIN0;
    }
    private static String getAliasSystemChain1() {
        initCerts();
        return ALIAS_SYSTEM_CHAIN1;
    }
    private static String getAliasSystemChain2() {
        initCerts();
        return ALIAS_SYSTEM_CHAIN2;
    }
    private static String getAliasUserChain0() {
        initCerts();
        return ALIAS_USER_CHAIN0;
    }
    private static String getAliasUserChain1() {
        initCerts();
        return ALIAS_USER_CHAIN1;
    }
    private static String getAliasUserChain2() {
        initCerts();
        return ALIAS_USER_CHAIN2;
    }

    private static String getAliasSystemCa3() {
        initCerts();
        return ALIAS_SYSTEM_CA3;
    }
    private static String getAliasSystemCa3Collision() {
        initCerts();
        return ALIAS_SYSTEM_CA3_COLLISION;
    }
    private static String getAliasUserCa3() {
        initCerts();
        return ALIAS_USER_CA3;
    }
    private static String getAliasUserCa3Collision() {
        initCerts();
        return ALIAS_USER_CA3_COLLISION;
    }
    private static X509Certificate getCertLoopEe() {
        initCerts();
        return CERTLOOP_EE;
    }
    private static X509Certificate getCertLoopCa1() {
        initCerts();
        return CERTLOOP_CA1;
    }
    private static X509Certificate getCertLoopCa2() {
        initCerts();
        return CERTLOOP_CA2;
    }
    private static String getAliasCertLoopEe() {
        initCerts();
        return ALIAS_USER_CERTLOOP_EE;
    }
    private static String getAliasCertLoopCa1() {
        initCerts();
        return ALIAS_USER_CERTLOOP_CA1;
    }
    private static String getAliasCertLoopCa2() {
        initCerts();
        return ALIAS_USER_CERTLOOP_CA2;
    }
    private static String getAliasMultipleIssuersCa1() {
        initCerts();
        return ALIAS_MULTIPLE_ISSUERS_CA1;
    }
    private static String getAliasMultipleIssuersCa2() {
        initCerts();
        return ALIAS_MULTIPLE_ISSUERS_CA2;
    }
    private static String getAliasMultipleIssuersCa1Cross() {
        initCerts();
        return ALIAS_MULTIPLE_ISSUERS_CA1_CROSS;
    }
    private static String getAliasMultipleIssuersEe() {
        initCerts();
        return ALIAS_MULTIPLE_ISSUERS_EE;
    }
    private static X509Certificate getMultipleIssuersCa1() {
        initCerts();
        return MULTIPLE_ISSUERS_CA1;
    }
    private static X509Certificate getMultipleIssuersCa2() {
        initCerts();
        return MULTIPLE_ISSUERS_CA2;
    }
    private static X509Certificate getMultipleIssuersCa1Cross() {
        initCerts();
        return MULTIPLE_ISSUERS_CA1_CROSS;
    }
    private static X509Certificate getMultipleIssuersEe() {
        initCerts();
        return MULTIPLE_ISSUERS_EE;
    }

    /**
     * Lazily create shared test certificates.
     */
    private static synchronized void initCerts() {
        if (CA1 != null) {
            return;
        }
        try {
            CA1 = TestKeyStore.getClient().getRootCertificate("RSA");
            CA2 = TestKeyStore.getClientCA2().getRootCertificate("RSA");
            PRIVATE = TestKeyStore.getServer().getPrivateKey("RSA", "RSA");
            CHAIN = (X509Certificate[]) PRIVATE.getCertificateChain();
            CA3_WITH_CA1_SUBJECT = new TestKeyStore.Builder()
                    .aliasPrefix("unused")
                    .subject(CA1.getSubjectX500Principal())
                    .ca(true)
                    .build().getRootCertificate("RSA");


            ALIAS_SYSTEM_CA1 = alias(false, CA1, 0);
            ALIAS_SYSTEM_CA2 = alias(false, CA2, 0);
            ALIAS_USER_CA1 = alias(true, CA1, 0);
            ALIAS_USER_CA2 = alias(true, CA2, 0);

            ALIAS_SYSTEM_CHAIN0 = alias(false, getChain()[0], 0);
            ALIAS_SYSTEM_CHAIN1 = alias(false, getChain()[1], 0);
            ALIAS_SYSTEM_CHAIN2 = alias(false, getChain()[2], 0);
            ALIAS_USER_CHAIN0 = alias(true, getChain()[0], 0);
            ALIAS_USER_CHAIN1 = alias(true, getChain()[1], 0);
            ALIAS_USER_CHAIN2 = alias(true, getChain()[2], 0);

            ALIAS_SYSTEM_CA3 = alias(false, CA3_WITH_CA1_SUBJECT, 0);
            ALIAS_SYSTEM_CA3_COLLISION = alias(false, CA3_WITH_CA1_SUBJECT, 1);
            ALIAS_USER_CA3 = alias(true, CA3_WITH_CA1_SUBJECT, 0);
            ALIAS_USER_CA3_COLLISION = alias(true, CA3_WITH_CA1_SUBJECT, 1);

            /*
             * The construction below is to build a certificate chain that has a loop
             * in it:
             *
             *   EE ---> CA1 ---> CA2 ---+
             *            ^              |
             *            |              |
             *            +--------------+
             */
            TestKeyStore certLoopTempCa1 = new TestKeyStore.Builder()
                    .keyAlgorithms("RSA")
                    .aliasPrefix("certloop-ca1")
                    .subject("CN=certloop-ca1")
                    .ca(true)
                    .build();
            Certificate certLoopTempCaCert1 = ((TrustedCertificateEntry) certLoopTempCa1
                    .getEntryByAlias("certloop-ca1-public-RSA")).getTrustedCertificate();
            PrivateKeyEntry certLoopCaKey1 = (PrivateKeyEntry) certLoopTempCa1
                    .getEntryByAlias("certloop-ca1-private-RSA");

            TestKeyStore certLoopCa2 = new TestKeyStore.Builder()
                    .keyAlgorithms("RSA")
                    .aliasPrefix("certloop-ca2")
                    .subject("CN=certloop-ca2")
                    .rootCa(certLoopTempCaCert1)
                    .signer(certLoopCaKey1)
                    .ca(true)
                    .build();
            CERTLOOP_CA2 = (X509Certificate) ((TrustedCertificateEntry) certLoopCa2
                    .getEntryByAlias("certloop-ca2-public-RSA")).getTrustedCertificate();
            ALIAS_USER_CERTLOOP_CA2 = alias(true, CERTLOOP_CA2, 0);
            PrivateKeyEntry certLoopCaKey2 = (PrivateKeyEntry) certLoopCa2
                    .getEntryByAlias("certloop-ca2-private-RSA");

            TestKeyStore certLoopCa1 = new TestKeyStore.Builder()
                    .keyAlgorithms("RSA")
                    .aliasPrefix("certloop-ca1")
                    .subject("CN=certloop-ca1")
                    .privateEntry(certLoopCaKey1)
                    .rootCa(CERTLOOP_CA2)
                    .signer(certLoopCaKey2)
                    .ca(true)
                    .build();
            CERTLOOP_CA1 = (X509Certificate) ((TrustedCertificateEntry) certLoopCa1
                    .getEntryByAlias("certloop-ca1-public-RSA")).getTrustedCertificate();
            ALIAS_USER_CERTLOOP_CA1 = alias(true, CERTLOOP_CA1, 0);

            TestKeyStore certLoopEe = new TestKeyStore.Builder()
                    .keyAlgorithms("RSA")
                    .aliasPrefix("certloop-ee")
                    .subject("CN=certloop-ee")
                    .rootCa(CERTLOOP_CA1)
                    .signer(certLoopCaKey1)
                    .build();
            CERTLOOP_EE = (X509Certificate) ((TrustedCertificateEntry) certLoopEe
                    .getEntryByAlias("certloop-ee-public-RSA")).getTrustedCertificate();
            ALIAS_USER_CERTLOOP_EE = alias(true, CERTLOOP_EE, 0);

            /*
             * The construction below creates a certificate with multiple possible issuer certs.
             *
             *    EE ----> CA1 ---> CA2
             *
             *    Where CA1 also exists in a self-issued form.
             */
            TestKeyStore multipleIssuersCa1 = new TestKeyStore.Builder()
                    .keyAlgorithms("RSA")
                    .aliasPrefix("multiple-issuers-ca1")
                    .subject("CN=multiple-issuers-ca1")
                    .ca(true)
                    .build();
            MULTIPLE_ISSUERS_CA1 = (X509Certificate) ((TrustedCertificateEntry) multipleIssuersCa1
                    .getEntryByAlias("multiple-issuers-ca1-public-RSA")).getTrustedCertificate();
            ALIAS_MULTIPLE_ISSUERS_CA1 = alias(false, MULTIPLE_ISSUERS_CA1, 0);
            PrivateKeyEntry multipleIssuersCa1Key = (PrivateKeyEntry) multipleIssuersCa1
                    .getEntryByAlias("multiple-issuers-ca1-private-RSA");

            TestKeyStore multipleIssuersCa2 = new TestKeyStore.Builder()
                    .keyAlgorithms("RSA")
                    .aliasPrefix("multiple-issuers-ca2")
                    .subject("CN=multiple-issuers-ca2")
                    .ca(true)
                    .build();
            MULTIPLE_ISSUERS_CA2 = (X509Certificate) ((TrustedCertificateEntry) multipleIssuersCa2
                    .getEntryByAlias("multiple-issuers-ca2-public-RSA")).getTrustedCertificate();
            ALIAS_MULTIPLE_ISSUERS_CA2 = alias(false, MULTIPLE_ISSUERS_CA2, 0);
            PrivateKeyEntry multipleIssuersCa2Key = (PrivateKeyEntry) multipleIssuersCa2
                    .getEntryByAlias("multiple-issuers-ca2-private-RSA");

            TestKeyStore multipleIssuersCa1SignedByCa2 = new TestKeyStore.Builder()
                    .keyAlgorithms("RSA")
                    .aliasPrefix("multiple-issuers-ca1")
                    .subject("CN=multiple-issuers-ca1")
                    .privateEntry(multipleIssuersCa1Key)
                    .rootCa(MULTIPLE_ISSUERS_CA2)
                    .signer(multipleIssuersCa2Key)
                    .ca(true)
                    .build();
            MULTIPLE_ISSUERS_CA1_CROSS =
                    (X509Certificate) ((TrustedCertificateEntry) multipleIssuersCa1SignedByCa2
                            .getEntryByAlias("multiple-issuers-ca1-public-RSA"))
                    .getTrustedCertificate();
            ALIAS_MULTIPLE_ISSUERS_CA1_CROSS = alias(false, MULTIPLE_ISSUERS_CA1_CROSS, 1);

            TestKeyStore multipleIssuersEe = new TestKeyStore.Builder()
                    .keyAlgorithms("RSA")
                    .aliasPrefix("multiple-issuers-ee")
                    .subject("CN=multiple-issuers-ee")
                    .rootCa(MULTIPLE_ISSUERS_CA1)
                    .signer(multipleIssuersCa1Key)
                    .build();
            MULTIPLE_ISSUERS_EE = (X509Certificate) ((TrustedCertificateEntry) multipleIssuersEe
                    .getEntryByAlias("multiple-issuers-ee-public-RSA")).getTrustedCertificate();
            ALIAS_MULTIPLE_ISSUERS_EE = alias(false, MULTIPLE_ISSUERS_EE, 0);
        } catch (Exception e) {
            throw new RuntimeException(e);
        }
    }

    private TrustedCertificateStore store;

    @Override protected void setUp() {
        setupStore();
    }

    private void setupStore() {
        dirSystem.mkdirs();
        cleanStore();
        createStore();
    }

    private void createStore() {
        store = new TrustedCertificateStore(dirSystem, dirAdded, dirDeleted);
    }

    @Override protected void tearDown() {
        cleanStore();
    }

    private void cleanStore() {
        for (File dir : new File[] { dirSystem, dirAdded, dirDeleted, dirTest }) {
            File[] files = dir.listFiles();
            if (files == null) {
                continue;
            }
            for (File file : files) {
                assertTrue("Should delete " + file.getPath(), file.delete());
            }
        }
        store = null;
    }

    private void resetStore() {
        cleanStore();
        setupStore();
    }

    public void testEmptyDirectories() throws Exception {
        assertEmpty();
    }

    public void testOneSystemOneDeleted() throws Exception {
        install(getCa1(), getAliasSystemCa1());
        store.deleteCertificateEntry(getAliasSystemCa1());
        assertEmpty();
        assertDeleted(getCa1(), getAliasSystemCa1());
    }

    public void testTwoSystemTwoDeleted() throws Exception {
        install(getCa1(), getAliasSystemCa1());
        store.deleteCertificateEntry(getAliasSystemCa1());
        install(getCa2(), getAliasSystemCa2());
        store.deleteCertificateEntry(getAliasSystemCa2());
        assertEmpty();
        assertDeleted(getCa1(), getAliasSystemCa1());
        assertDeleted(getCa2(), getAliasSystemCa2());
    }

    public void testPartialFileIsIgnored() throws Exception {
        File file = file(getAliasSystemCa1());
        file.getParentFile().mkdirs();
        OutputStream os = new FileOutputStream(file);
        os.write(0);
        os.close();
        assertTrue(file.exists());
        assertEmpty();
        assertTrue(file.exists());
    }

    private void assertEmpty() throws Exception {
        try {
            store.getCertificate(null);
            fail();
        } catch (NullPointerException expected) {
        }
        assertNull(store.getCertificate(""));

        try {
            store.getCreationDate(null);
            fail();
        } catch (NullPointerException expected) {
        }
        assertNull(store.getCreationDate(""));

        Set<String> s = store.aliases();
        assertNotNull(s);
        assertTrue(s.isEmpty());
        assertAliases();

        Set<String> u = store.userAliases();
        assertNotNull(u);
        assertTrue(u.isEmpty());

        try {
            store.containsAlias(null);
            fail();
        } catch (NullPointerException expected) {
        }
        assertFalse(store.containsAlias(""));

        assertNull(store.getCertificateAlias(null));
        assertNull(store.getCertificateAlias(getCa1()));

        try {
            store.getTrustAnchor(null);
            fail();
        } catch (NullPointerException expected) {
        }
        assertNull(store.getTrustAnchor(getCa1()));

        try {
            store.findIssuer(null);
            fail();
        } catch (NullPointerException expected) {
        }
        assertNull(store.findIssuer(getCa1()));

        try {
            store.installCertificate(null);
            fail();
        } catch (NullPointerException expected) {
        }

        store.deleteCertificateEntry(null);
        store.deleteCertificateEntry("");

        String[] userFiles = dirAdded.list();
        assertTrue(userFiles == null || userFiles.length == 0);
    }

    public void testTwoSystem() throws Exception {
        testTwo(getCa1(), getAliasSystemCa1(),
                getCa2(), getAliasSystemCa2());
    }

    public void testTwoUser() throws Exception {
        testTwo(getCa1(), getAliasUserCa1(),
                getCa2(), getAliasUserCa2());
    }

    public void testOneSystemOneUser() throws Exception {
        testTwo(getCa1(), getAliasSystemCa1(),
                getCa2(), getAliasUserCa2());
    }

    public void testTwoSystemSameSubject() throws Exception {
        testTwo(getCa1(), getAliasSystemCa1(),
                getCa3WithCa1Subject(), getAliasSystemCa3Collision());
    }

    public void testTwoUserSameSubject() throws Exception {
        testTwo(getCa1(), getAliasUserCa1(),
                getCa3WithCa1Subject(), getAliasUserCa3Collision());

        store.deleteCertificateEntry(getAliasUserCa1());
        assertDeleted(getCa1(), getAliasUserCa1());
        assertTombstone(getAliasUserCa1());
        assertRootCa(getCa3WithCa1Subject(), getAliasUserCa3Collision());
        assertAliases(getAliasUserCa3Collision());

        store.deleteCertificateEntry(getAliasUserCa3Collision());
        assertDeleted(getCa3WithCa1Subject(), getAliasUserCa3Collision());
        assertNoTombstone(getAliasUserCa3Collision());
        assertNoTombstone(getAliasUserCa1());
        assertEmpty();
    }

    public void testOneSystemOneUserSameSubject() throws Exception {
        testTwo(getCa1(), getAliasSystemCa1(),
                getCa3WithCa1Subject(), getAliasUserCa3());
        testTwo(getCa1(), getAliasUserCa1(),
                getCa3WithCa1Subject(), getAliasSystemCa3());
    }

    private void testTwo(X509Certificate x1, String alias1,
                         X509Certificate x2, String alias2) {
        install(x1, alias1);
        install(x2, alias2);
        assertRootCa(x1, alias1);
        assertRootCa(x2, alias2);
        assertAliases(alias1, alias2);
    }


    public void testOneSystemOneUserOneDeleted() throws Exception {
        install(getCa1(), getAliasSystemCa1());
        store.installCertificate(getCa2());
        store.deleteCertificateEntry(getAliasSystemCa1());
        assertDeleted(getCa1(), getAliasSystemCa1());
        assertRootCa(getCa2(), getAliasUserCa2());
        assertAliases(getAliasUserCa2());
    }

    public void testOneSystemOneUserOneDeletedSameSubject() throws Exception {
        install(getCa1(), getAliasSystemCa1());
        store.installCertificate(getCa3WithCa1Subject());
        store.deleteCertificateEntry(getAliasSystemCa1());
        assertDeleted(getCa1(), getAliasSystemCa1());
        assertRootCa(getCa3WithCa1Subject(), getAliasUserCa3());
        assertAliases(getAliasUserCa3());
    }

    public void testUserMaskingSystem() throws Exception {
        install(getCa1(), getAliasSystemCa1());
        install(getCa1(), getAliasUserCa1());
        assertMasked(getCa1(), getAliasSystemCa1());
        assertRootCa(getCa1(), getAliasUserCa1());
        assertAliases(getAliasSystemCa1(), getAliasUserCa1());
    }

    public void testChain() throws Exception {
        testChain(getAliasSystemChain1(), getAliasSystemChain2());
        testChain(getAliasSystemChain1(), getAliasUserChain2());
        testChain(getAliasUserChain1(), getAliasSystemCa1());
        testChain(getAliasUserChain1(), getAliasUserChain2());
    }

    private void testChain(String alias1, String alias2) throws Exception {
        install(getChain()[1], alias1);
        install(getChain()[2], alias2);
        assertIntermediateCa(getChain()[1], alias1);
        assertRootCa(getChain()[2], alias2);
        assertAliases(alias1, alias2);
        assertEquals(getChain()[2], store.findIssuer(getChain()[1]));
        assertEquals(getChain()[1], store.findIssuer(getChain()[0]));

        X509Certificate[] expected = getChain();
        List<X509Certificate> actualList = store.getCertificateChain(expected[0]);

        assertEquals("Generated CA list should be same length", expected.length, actualList.size());
        for (int i = 0; i < expected.length; i++) {
            assertEquals("Chain value should be the same for position " + i, expected[i],
                    actualList.get(i));
        }
        resetStore();
    }

    public void testMissingSystemDirectory() throws Exception {
        cleanStore();
        createStore();
        assertEmpty();
    }

    public void testWithExistingUserDirectories() throws Exception {
        dirAdded.mkdirs();
        dirDeleted.mkdirs();
        install(getCa1(), getAliasSystemCa1());
        assertRootCa(getCa1(), getAliasSystemCa1());
        assertAliases(getAliasSystemCa1());
    }

    public void testIsTrustAnchorWithReissuedgetCa() throws Exception {
        PublicKey publicKey = getPrivate().getCertificate().getPublicKey();
        PrivateKey privateKey = getPrivate().getPrivateKey();
        String name = "CN=CA4";
        X509Certificate ca1 = TestKeyStore.createCa(publicKey, privateKey, name);
        Thread.sleep(1 * 1000); // wait to ensure CAs vary by expiration
        X509Certificate ca2 = TestKeyStore.createCa(publicKey, privateKey, name);
        assertFalse(ca1.equals(ca2));

        String systemAlias = alias(false, ca1, 0);
        install(ca1, systemAlias);
        assertRootCa(ca1, systemAlias);
        assertEquals(ca1, store.getTrustAnchor(ca2));
        assertEquals(ca1, store.findIssuer(ca2));
        resetStore();

        String userAlias = alias(true, ca1, 0);
        store.installCertificate(ca1);
        assertRootCa(ca1, userAlias);
        assertNotNull(store.getTrustAnchor(ca2));
        assertEquals(ca1, store.findIssuer(ca2));
        resetStore();
    }

    public void testInstallEmpty() throws Exception {
        store.installCertificate(getCa1());
        assertRootCa(getCa1(), getAliasUserCa1());
        assertAliases(getAliasUserCa1());

        // reinstalling should not change anything
        store.installCertificate(getCa1());
        assertRootCa(getCa1(), getAliasUserCa1());
        assertAliases(getAliasUserCa1());
    }

    public void testInstallEmptySystemExists() throws Exception {
        install(getCa1(), getAliasSystemCa1());
        assertRootCa(getCa1(), getAliasSystemCa1());
        assertAliases(getAliasSystemCa1());

        // reinstalling should not affect system CA
        store.installCertificate(getCa1());
        assertRootCa(getCa1(), getAliasSystemCa1());
        assertAliases(getAliasSystemCa1());

    }

    public void testInstallEmptyDeletedSystemExists() throws Exception {
        install(getCa1(), getAliasSystemCa1());
        store.deleteCertificateEntry(getAliasSystemCa1());
        assertEmpty();
        assertDeleted(getCa1(), getAliasSystemCa1());

        // installing should restore deleted system CA
        store.installCertificate(getCa1());
        assertRootCa(getCa1(), getAliasSystemCa1());
        assertAliases(getAliasSystemCa1());
    }

    public void testDeleteEmpty() throws Exception {
        store.deleteCertificateEntry(getAliasSystemCa1());
        assertEmpty();
        assertDeleted(getCa1(), getAliasSystemCa1());
    }

    public void testDeleteUser() throws Exception {
        store.installCertificate(getCa1());
        assertRootCa(getCa1(), getAliasUserCa1());
        assertAliases(getAliasUserCa1());

        store.deleteCertificateEntry(getAliasUserCa1());
        assertEmpty();
        assertDeleted(getCa1(), getAliasUserCa1());
        assertNoTombstone(getAliasUserCa1());
    }

    public void testDeleteSystem() throws Exception {
        install(getCa1(), getAliasSystemCa1());
        assertRootCa(getCa1(), getAliasSystemCa1());
        assertAliases(getAliasSystemCa1());

        store.deleteCertificateEntry(getAliasSystemCa1());
        assertEmpty();
        assertDeleted(getCa1(), getAliasSystemCa1());

        // deleting again should not change anything
        store.deleteCertificateEntry(getAliasSystemCa1());
        assertEmpty();
        assertDeleted(getCa1(), getAliasSystemCa1());
    }

    public void testGetLoopedCert() throws Exception {
        install(getCertLoopEe(), getAliasCertLoopEe());
        install(getCertLoopCa1(), getAliasCertLoopCa1());
        install(getCertLoopCa2(), getAliasCertLoopCa2());

        ExecutorService executor = Executors.newSingleThreadExecutor();
        Future<List<X509Certificate>> future = executor
                .submit(new Callable<List<X509Certificate>>() {
                    @Override
                    public List<X509Certificate> call() throws Exception {
                        return store.getCertificateChain(getCertLoopEe());
                    }
                });
        executor.shutdown();
        final List<X509Certificate> certs;
        try {
            certs = future.get(10, TimeUnit.SECONDS);
        } catch (TimeoutException e) {
            fail("Could not finish building chain; possibly confused by loops");
            return; // Not actually reached.
        }
        assertEquals(3, certs.size());
        assertEquals(getCertLoopEe(), certs.get(0));
        assertEquals(getCertLoopCa1(), certs.get(1));
        assertEquals(getCertLoopCa2(), certs.get(2));
    }

    public void testIsUserAddedCertificate() throws Exception {
        assertFalse(store.isUserAddedCertificate(getCa1()));
        assertFalse(store.isUserAddedCertificate(getCa2()));
        install(getCa1(), getAliasSystemCa1());
        assertFalse(store.isUserAddedCertificate(getCa1()));
        assertFalse(store.isUserAddedCertificate(getCa2()));
        install(getCa1(), getAliasUserCa1());
        assertTrue(store.isUserAddedCertificate(getCa1()));
        assertFalse(store.isUserAddedCertificate(getCa2()));
        install(getCa2(), getAliasUserCa2());
        assertTrue(store.isUserAddedCertificate(getCa1()));
        assertTrue(store.isUserAddedCertificate(getCa2()));
        store.deleteCertificateEntry(getAliasUserCa1());
        assertFalse(store.isUserAddedCertificate(getCa1()));
        assertTrue(store.isUserAddedCertificate(getCa2()));
        store.deleteCertificateEntry(getAliasUserCa2());
        assertFalse(store.isUserAddedCertificate(getCa1()));
        assertFalse(store.isUserAddedCertificate(getCa2()));
    }

    public void testSystemCaCertsUseCorrectFileNames() throws Exception {
        TrustedCertificateStore store = new TrustedCertificateStore();

        // Assert that all the certificates in the system cacerts directory are stored in files with
        // expected names.
        CertificateFactory certificateFactory = CertificateFactory.getInstance("X.509");
        File dir = new File(System.getenv("ANDROID_ROOT") + "/etc/security/cacerts");
        int systemCertFileCount = 0;
        for (File actualFile : listFilesNoNull(dir)) {
            if (!actualFile.isFile()) {
                continue;
            }
            systemCertFileCount++;
            X509Certificate cert = (X509Certificate) certificateFactory.generateCertificate(
                    new ByteArrayInputStream(readFully(actualFile)));

            File expectedFile = store.getCertificateFile(dir, cert);
            assertEquals("System certificate stored in the wrong file",
                    expectedFile.getAbsolutePath(), actualFile.getAbsolutePath());

            // The two statements below indirectly assert that the certificate can be looked up
            // from a file (hopefully the same one as the expectedFile above). As opposed to
            // getCertifiacteFile above, these are the actual methods used when verifying chain of
            // trust. Thus, we assert that they work as expected for all system certificates.
            assertNotNull("Issuer certificate not found for system certificate " + actualFile,
                    store.findIssuer(cert));
            assertNotNull("Trust anchor not found for system certificate " + actualFile,
                    store.getTrustAnchor(cert));
        }

        // Assert that all files corresponding to all system certs/aliases known to the store are
        // present.
        int systemCertAliasCount = 0;
        for (String alias : store.aliases()) {
            if (!TrustedCertificateStore.isSystem(alias)) {
                continue;
            }
            systemCertAliasCount++;
            // Checking that the certificate is stored in a file is extraneous given the current
            // implementation of the class under test. We do it just in case the implementation
            // changes.
            X509Certificate cert = (X509Certificate) store.getCertificate(alias);
            File expectedFile = store.getCertificateFile(dir, cert);
            if (!expectedFile.isFile()) {
                fail("Missing certificate file for alias " + alias
                        + ": " + expectedFile.getAbsolutePath());
            }
        }

        assertEquals("Number of system cert files and aliases doesn't match",
                systemCertFileCount, systemCertAliasCount);
    }

    public void testMultipleIssuers() throws Exception {
        Set<X509Certificate> result;
        install(getMultipleIssuersCa1(), getAliasMultipleIssuersCa1());
        result = store.findAllIssuers(getMultipleIssuersEe());
        assertEquals("Unexpected number of issuers found", 1, result.size());
        assertTrue("findAllIssuers does not contain expected issuer",
                result.contains(getMultipleIssuersCa1()));
        install(getMultipleIssuersCa1Cross(), getAliasMultipleIssuersCa1Cross());
        result = store.findAllIssuers(getMultipleIssuersEe());
        assertEquals("findAllIssuers did not return all issuers", 2, result.size());
        assertTrue("findAllIssuers does not contain CA1",
                result.contains(getMultipleIssuersCa1()));
        assertTrue("findAllIssuers does not contain CA1 signed by CA2",
                result.contains(getMultipleIssuersCa1Cross()));
    }

    private static File[] listFilesNoNull(File dir) {
        File[] files = dir.listFiles();
        return (files != null) ? files : new File[0];
    }

    private static byte[] readFully(File file) throws IOException {
        InputStream in = null;
        try {
            in = new FileInputStream(file);
            ByteArrayOutputStream out = new ByteArrayOutputStream();
            byte[] buf = new byte[16384];
            int chunkSize;
            while ((chunkSize = in.read(buf)) != -1) {
                out.write(buf, 0, chunkSize);
            }
            return out.toByteArray();
        } finally {
            if (in != null) {
                in.close();
            }
        }
    }

    private void assertRootCa(X509Certificate x, String alias) {
        assertIntermediateCa(x, alias);
        assertEquals(x, store.findIssuer(x));
    }

    private void assertTrusted(X509Certificate x, String alias) {
        assertEquals(x, store.getCertificate(alias));
        assertEquals(file(alias).lastModified(), store.getCreationDate(alias).getTime());
        assertTrue(store.containsAlias(alias));
        assertEquals(x, store.getTrustAnchor(x));
    }

    private void assertIntermediateCa(X509Certificate x, String alias) {
        assertTrusted(x, alias);
        assertEquals(alias, store.getCertificateAlias(x));
    }

    private void assertMasked(X509Certificate x, String alias) {
        assertTrusted(x, alias);
        assertFalse(alias.equals(store.getCertificateAlias(x)));
    }

    private void assertDeleted(X509Certificate x, String alias) {
        assertNull(store.getCertificate(alias));
        assertFalse(store.containsAlias(alias));
        assertNull(store.getCertificateAlias(x));
        assertNull(store.getTrustAnchor(x));
        assertEquals(store.allSystemAliases().contains(alias),
                     store.getCertificate(alias, true) != null);
    }

    private void assertTombstone(String alias) {
        assertTrue(TrustedCertificateStore.isUser(alias));
        File file = file(alias);
        assertTrue(file.exists());
        assertEquals(0, file.length());
    }

    private void assertNoTombstone(String alias) {
        assertTrue(TrustedCertificateStore.isUser(alias));
        assertFalse(file(alias).exists());
    }

    private void assertAliases(String... aliases) {
        Set<String> expected = new HashSet<String>(Arrays.asList(aliases));
        Set<String> actual = new HashSet<String>();
        for (String alias : store.aliases()) {
            boolean system = TrustedCertificateStore.isSystem(alias);
            boolean user = TrustedCertificateStore.isUser(alias);
            if (system || user) {
                assertEquals(system, store.allSystemAliases().contains(alias));
                assertEquals(user, store.userAliases().contains(alias));
                actual.add(alias);
            } else {
                throw new AssertionError(alias);
            }
        }
        assertEquals(expected, actual);
    }

    /**
     * format a certificate alias
     */
    private static String alias(boolean user, X509Certificate x, int index) {
        String prefix = user ? "user:" : "system:";

        X500Principal subject = x.getSubjectX500Principal();
        int intHash = NativeCrypto.X509_NAME_hash_old(subject);
        String strHash = Hex.intToHexString(intHash, 8);

        return prefix + strHash + '.' + index;
    }

    /**
     * Install certificate under specified alias
     */
    private void install(X509Certificate x, String alias) {
        try {
            File file = file(alias);
            file.getParentFile().mkdirs();
            OutputStream out = new FileOutputStream(file);
            out.write(x.getEncoded());
            out.close();
        } catch (Exception e) {
            throw new RuntimeException(e);
        }
    }

    /**
     * Compute file for an alias
     */
    private File file(String alias) {
        File dir;
        if (TrustedCertificateStore.isSystem(alias)) {
            dir = dirSystem;
        } else if (TrustedCertificateStore.isUser(alias)) {
            dir = dirAdded;
        } else {
            throw new IllegalArgumentException(alias);
        }

        int index = alias.lastIndexOf(":");
        if (index == -1) {
            throw new IllegalArgumentException(alias);
        }
        String filename = alias.substring(index+1);

        return new File(dir, filename);
    }
}