From 61251002727a84e3185b19bc0a1894ed21acaafe Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Aleksander=20Aas=20Sja=CC=8Afjell?= Date: Thu, 29 Dec 2016 14:18:17 +0100 Subject: [PATCH 1/5] Legger til metode for validering av sertifikat og kjede uten orgnr MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Fordi det i Oppslagstjenesten ikke er noen verdi i å sjekke om det er utstedt til rett organisasjonsnummer. Det bare er et krav at det er et virksomhetssertifikat og vi har ikke noe organisasjonsnummer å matche med. --- .../CertificateValidatorTests.cs | 80 ++++++++++++----- Difi.Felles.Utility/CertificateValidator.cs | 85 +++++++++++++++++++ 2 files changed, 146 insertions(+), 19 deletions(-) diff --git a/Difi.Felles.Utility.Tester/CertificateValidatorTests.cs b/Difi.Felles.Utility.Tester/CertificateValidatorTests.cs index 9094932..83f604b 100755 --- a/Difi.Felles.Utility.Tester/CertificateValidatorTests.cs +++ b/Difi.Felles.Utility.Tester/CertificateValidatorTests.cs @@ -6,7 +6,7 @@ namespace Difi.Felles.Utility.Tester { public class CertificateValidatorTests { - public class ValidateCertificateAndChainMethod : CertificateValidatorTests + public class ValidateCertificateAndChainInternalMethod : CertificateValidatorTests { [Fact] public void Returns_fail_if_certificate_error() @@ -15,7 +15,7 @@ public void Returns_fail_if_certificate_error() var funksjoneltTestmiljøSertifikater = CertificateChainUtility.FunksjoneltTestmiljøSertifikater(); //Act - var result = CertificateValidator.ValidateCertificateAndChain(CertificateResource.UnitTests.GetExpiredSelfSignedTestCertificate(), "988015814", funksjoneltTestmiljøSertifikater); + var result = CertificateValidator.ValidateCertificateAndChainInternal(CertificateResource.UnitTests.GetExpiredSelfSignedTestCertificate(), "988015814", funksjoneltTestmiljøSertifikater); //Assert Assert.Equal(CertificateValidationType.InvalidCertificate, result.Type); @@ -29,7 +29,7 @@ public void Returns_fail_if_self_signed_certificate() var funksjoneltTestmiljøSertifikater = CertificateChainUtility.FunksjoneltTestmiljøSertifikater(); //Act - var result = CertificateValidator.ValidateCertificateAndChain(CertificateResource.UnitTests.GetValidSelfSignedTestCertificate(), "988015814", funksjoneltTestmiljøSertifikater); + var result = CertificateValidator.ValidateCertificateAndChainInternal(CertificateResource.UnitTests.GetValidSelfSignedTestCertificate(), "988015814", funksjoneltTestmiljøSertifikater); //Assert Assert.Equal(CertificateValidationType.InvalidChain, result.Type); @@ -43,7 +43,7 @@ public void Returns_ok_if_valid_certificate_and_chain() var funksjoneltTestmiljøSertifikater = CertificateChainUtility.FunksjoneltTestmiljøSertifikater(); //Act - var result = CertificateValidator.ValidateCertificateAndChain(CertificateResource.UnitTests.GetPostenCertificate(), "984661185", funksjoneltTestmiljøSertifikater); + var result = CertificateValidator.ValidateCertificateAndChainInternal(CertificateResource.UnitTests.GetPostenCertificate(), "984661185", funksjoneltTestmiljøSertifikater); //Assert Assert.Equal(CertificateValidationType.Valid, result.Type); @@ -51,16 +51,19 @@ public void Returns_ok_if_valid_certificate_and_chain() } } - public class ValidateCertificateMethod : CertificateValidatorTests + public class ValidateCertificateMethodWithOrganizationNumber : CertificateValidatorTests { + /// + /// To ensure we are calling the overload doing checking for expiration, activation and not null. + /// [Fact] - public void Returns_fail_if_expired() + public void Calls_validate_certificate_overload_with_no_organization_number() { //Arrange - const string certificateOrganizationNumber = "988015814"; + const string organizationNumber = "988015814"; //Act - var result = CertificateValidator.ValidateCertificate(CertificateResource.UnitTests.GetExpiredSelfSignedTestCertificate(), certificateOrganizationNumber); + var result = CertificateValidator.ValidateCertificate(CertificateResource.UnitTests.GetExpiredSelfSignedTestCertificate(), organizationNumber); //Assert Assert.Equal(CertificateValidationType.InvalidCertificate, result.Type); @@ -68,17 +71,14 @@ public void Returns_fail_if_expired() } [Fact] - public void Returns_fail_if_not_activated() + public void Ignores_issued_to_organization_if_no_organization_number() { - //Arrange - const string certificateOrganizationNumber = "988015814"; - //Act - var result = CertificateValidator.ValidateCertificate(CertificateResource.UnitTests.NotActivatedSelfSignedTestCertificate(), certificateOrganizationNumber); + var result = CertificateValidator.ValidateCertificate(CertificateResource.UnitTests.GetPostenCertificate(), string.Empty); //Assert - Assert.Equal(CertificateValidationType.InvalidCertificate, result.Type); - Assert.Contains("aktiveres ikke før", result.Message); + Assert.Equal(CertificateValidationType.Valid, result.Type); + Assert.Contains("er et gyldig sertifikat", result.Message); } [Fact] @@ -95,14 +95,56 @@ public void Returns_fail_if_not_issued_to_organization_number() Assert.Contains("ikke utstedt til organisasjonsnummer", result.Message); } + [Fact] + public void Returns_ok_if_valid() + { + //Arrange + const string certificateOrganizationNumber = "984661185"; + + //Act + var result = CertificateValidator.ValidateCertificate(CertificateResource.UnitTests.GetPostenCertificate(), certificateOrganizationNumber); + + //Assert + Assert.Equal(CertificateValidationType.Valid, result.Type); + Assert.Contains("er et gyldig sertifikat", result.Message); + } + } + + public class ValidateCertificateMethodWithNoOrganizationNumber : CertificateValidatorTests + { + [Fact] + public void Returns_fail_if_expired() + { + //Arrange + + //Act + var result = CertificateValidator.ValidateCertificate(CertificateResource.UnitTests.GetExpiredSelfSignedTestCertificate()); + + //Assert + Assert.Equal(CertificateValidationType.InvalidCertificate, result.Type); + Assert.Contains("gikk ut", result.Message); + } + + [Fact] + public void Returns_fail_if_not_activated() + { + //Arrange + + //Act + var result = CertificateValidator.ValidateCertificate(CertificateResource.UnitTests.NotActivatedSelfSignedTestCertificate()); + + //Assert + Assert.Equal(CertificateValidationType.InvalidCertificate, result.Type); + Assert.Contains("aktiveres ikke før", result.Message); + } + [Fact] public void Returns_fail_with_null_certificate() { //Arrange - const string organizationNumber = "123456789"; //Act - var result = CertificateValidator.ValidateCertificate(null, organizationNumber); + var result = CertificateValidator.ValidateCertificate(null); //Assert Assert.Equal(CertificateValidationType.InvalidCertificate, result.Type); @@ -113,15 +155,15 @@ public void Returns_fail_with_null_certificate() public void Returns_ok_if_valid() { //Arrange - const string certificateOrganizationNumber = "984661185"; //Act - var result = CertificateValidator.ValidateCertificate(CertificateResource.UnitTests.GetPostenCertificate(), certificateOrganizationNumber); + var result = CertificateValidator.ValidateCertificate(CertificateResource.UnitTests.GetPostenCertificate()); //Assert Assert.Equal(CertificateValidationType.Valid, result.Type); Assert.Contains("er et gyldig sertifikat", result.Message); } + } public class IsValidCertificateMethod : CertificateValidatorTests diff --git a/Difi.Felles.Utility/CertificateValidator.cs b/Difi.Felles.Utility/CertificateValidator.cs index 4eea477..15aa3c8 100755 --- a/Difi.Felles.Utility/CertificateValidator.cs +++ b/Difi.Felles.Utility/CertificateValidator.cs @@ -14,7 +14,47 @@ public static bool IsValidCertificate(X509Certificate2 certificate, string certi return ValidateCertificate(certificate, certificateOrganizationNumber).Type == CertificateValidationType.Valid; } + /// + /// Validates the certificate and chain. Validates that certificate is + /// + /// Not null + /// Issued to organization number + /// Is activated + /// Not Expired + /// Has a valid chain. A valid chain is one built with the allowed chain certificates. + /// + /// + /// The certificate to validate + /// The organization number which the certificate is issued to + /// + /// public static CertificateValidationResult ValidateCertificateAndChain(X509Certificate2 certificate, string certificateOrganizationNumber, X509Certificate2Collection allowedChainCertificates) + { + return ValidateCertificateAndChainInternal(certificate, certificateOrganizationNumber, allowedChainCertificates); + } + + + /// + /// Validates the certificate and chain. Validates that certificate is + /// + /// Not null + /// Is activated + /// Not Expired + /// Has a valid chain. A valid chain is one built with the allowed chain certificates. + /// + /// + /// The certificate to validate + /// The organization number which the certificate is issued to + /// + /// + public static CertificateValidationResult ValidateCertificateAndChain(X509Certificate2 certificate, X509Certificate2Collection allowedChainCertificates) + { + var certificateOrganizationNumber = string.Empty; + + return ValidateCertificateAndChainInternal(certificate, certificateOrganizationNumber, allowedChainCertificates); + } + + internal static CertificateValidationResult ValidateCertificateAndChainInternal(X509Certificate2 certificate, string certificateOrganizationNumber, X509Certificate2Collection allowedChainCertificates) { var sertifikatValideringsResultat = ValidateCertificate(certificate, certificateOrganizationNumber); @@ -27,6 +67,22 @@ public static CertificateValidationResult ValidateCertificateAndChain(X509Certif return certificateChainValidator.Validate(certificate); } + /// + /// Validates the certificate itself. Validates that certificate is + /// + /// Not null + /// Issued to organization number + /// Is activated + /// Not Expired + /// + /// + /// + /// Does not validate the certificate chain. Please use for including + /// chain validation + /// + /// The certificate to validate + /// The organization number the certificate is issued to + /// The result of the certificate validation public static CertificateValidationResult ValidateCertificate(X509Certificate2 certificate, string certificateOrganizationNumber) { if (certificate == null) @@ -34,11 +90,40 @@ public static CertificateValidationResult ValidateCertificate(X509Certificate2 c return NoCertificateResult(); } + if (string.IsNullOrWhiteSpace(certificateOrganizationNumber)) + { + return ValidateCertificate(certificate); + } + if (!IsIssuedToOrganizationNumber(certificate, certificateOrganizationNumber)) { return NotIssuedToOrganizationResult(certificate, certificateOrganizationNumber); } + return ValidateCertificate(certificate); + } + + /// + /// Validates the certificate itself. Validates that certificate is + /// + /// Not null + /// Is activated + /// Not Expired + /// + /// + /// + /// Does not validate the certificate chain. Please use for including + /// chain validation + /// + /// + /// + public static CertificateValidationResult ValidateCertificate(X509Certificate2 certificate) + { + if (certificate == null) + { + return NoCertificateResult(); + } + if (!IsActivatedCertificate(certificate)) { return NotActivatedResult(certificate); From 4b47c9767497025acb8316c7b0a4d70f8967acef Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Aleksander=20Aas=20Sja=CC=8Afjell?= Date: Thu, 29 Dec 2016 14:44:23 +0100 Subject: [PATCH 2/5] Oppdaterer til versjon 1.2.0 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Fordi vi har fått ny funksjonalitet som ikke brekker den gamle --- SharedAssemblyInfo.cs | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/SharedAssemblyInfo.cs b/SharedAssemblyInfo.cs index 778f456..a8b520d 100755 --- a/SharedAssemblyInfo.cs +++ b/SharedAssemblyInfo.cs @@ -4,8 +4,8 @@ [assembly: AssemblyTrademark("Direktoratet for forvaltning og IKT (Difi)")] [assembly: AssemblyProduct("Difi Felles Utility")] [assembly: AssemblyDescription("Bibliotek brukt av Difi i klientbiblioteker")] -[assembly: AssemblyVersion("1.1.0")] -[assembly: AssemblyFileVersion("1.1.0")] -[assembly: AssemblyInformationalVersion("1.1.0")] +[assembly: AssemblyVersion("1.2.0")] +[assembly: AssemblyFileVersion("1.2.0")] +[assembly: AssemblyInformationalVersion("1.2.0")] [assembly: AssemblyCopyright("© 2015-2016 Direktoratet for forvaltning og IKT (Difi)")] [assembly: AssemblyCulture("")] \ No newline at end of file From 6d7f392487e20a2d5c8d755810f4a7b9d84d2975 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Aleksander=20Aas=20Sja=CC=8Afjell?= Date: Thu, 29 Dec 2016 14:50:01 +0100 Subject: [PATCH 3/5] Oppgraderer XUnit for tester --- .../Difi.Felles.Utility.Tester.csproj | 19 ++++++++----------- Difi.Felles.Utility.Tester/packages.config | 9 +++++---- 2 files changed, 13 insertions(+), 15 deletions(-) diff --git a/Difi.Felles.Utility.Tester/Difi.Felles.Utility.Tester.csproj b/Difi.Felles.Utility.Tester/Difi.Felles.Utility.Tester.csproj index c12fe65..5895866 100755 --- a/Difi.Felles.Utility.Tester/Difi.Felles.Utility.Tester.csproj +++ b/Difi.Felles.Utility.Tester/Difi.Felles.Utility.Tester.csproj @@ -1,6 +1,5 @@  - Debug AnyCPU @@ -56,12 +55,16 @@ ..\packages\xunit.abstractions.2.0.0\lib\net35\xunit.abstractions.dll True - - ..\packages\xunit.assert.2.0.0\lib\portable-net45+win+wpa81+wp80+monotouch+monoandroid+Xamarin.iOS\xunit.assert.dll + + ..\packages\xunit.assert.2.1.0\lib\dotnet\xunit.assert.dll True - - ..\packages\xunit.extensibility.core.2.0.0\lib\portable-net45+win+wpa81+wp80+monotouch+monoandroid+Xamarin.iOS\xunit.core.dll + + ..\packages\xunit.extensibility.core.2.1.0\lib\dotnet\xunit.core.dll + True + + + ..\packages\xunit.extensibility.execution.2.1.0\lib\net45\xunit.execution.desktop.dll True @@ -134,12 +137,6 @@ - - - This project references NuGet package(s) that are missing on this computer. Use NuGet Package Restore to download them. For more information, see http://go.microsoft.com/fwlink/?LinkID=322105. The missing file is {0}. - - -