Node / meshtastic / Meshtastic-Android / files / core / takserver / src / jvmTest / kotlin / org / meshtastic / core / takserver / TakCertLegacyEncodingTest.kt

Displaying Raw • Download

T8b949e/*

* Copyright (c) 2026 Meshtastic LLC

*

* This program is free software: you can redistribute it and/or modify

* it under the terms of the GNU General Public License as published by

* the Free Software Foundation, either version 3 of the License, or

* (at your option) any later version.

*

* This program is distributed in the hope that it will be useful,

* but WITHOUT ANY WARRANTY; without even the implied warranty of

* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the

* GNU General Public License for more details.

*

* You should have received a copy of the GNU General Public License

* along with this program. If not, see <https://www.gnu.org/licenses/>.

*/

Tff7b72package T7ee787org.meshtastic.core.takserver

Tff7b72import T7ee787java.io.ByteArrayInputStream

Tff7b72import T7ee787java.security.KeyStore

Tff7b72import T7ee787java.security.PrivateKey

Tff7b72import T7ee787kotlin.test.Test

Tff7b72import T7ee787kotlin.test.assertFalse

Tff7b72import T7ee787kotlin.test.assertNotNull

Tff7b72import T7ee787kotlin.test.assertTrue

T8b949e/**

* The bundled `.p12` containers must stay encoded with legacy PKCS#12 algorithms (SHA1/3DES bags, SHA1 MAC). Android 9

* and older cannot parse PBES2/AES-encrypted containers, which breaks ATAK data package import (#6567).

*/

Tff7b72class T56d364TakCertLegacyEncodingTest Tb4b4b4{

T8b949e// DER encoding of OID 1.2.840.113549.1.5.13 (PBES2) — must NOT appear in the containers.

Tff7b72private Tff7b72val Te6edf3pbes2Oid Tff7b72=

Te6edf3byteArrayOfTb4b4b4(T79c0ff0Te6edf3x06Tb4b4b4, T79c0ff0Te6edf3x09Tb4b4b4, T79c0ff0Te6edf3x2ATb4b4b4, T79c0ff0Te6edf3x86Tb4b4b4.Te6edf3toByteTb4b4b4(Tb4b4b4)Tb4b4b4, T79c0ff0Te6edf3x48Tb4b4b4, T79c0ff0Te6edf3x86Tb4b4b4.Te6edf3toByteTb4b4b4(Tb4b4b4)Tb4b4b4, T79c0ff0Te6edf3xF7Tb4b4b4.Te6edf3toByteTb4b4b4(Tb4b4b4)Tb4b4b4, T79c0ff0Te6edf3x0DTb4b4b4, T79c0ff0Te6edf3x01Tb4b4b4, T79c0ff0Te6edf3x05Tb4b4b4, T79c0ff0Te6edf3x0DTb4b4b4)

T8b949e// DER encoding of OID 1.2.840.113549.1.12.1.3 (pbeWithSHA1And3-KeyTripleDES-CBC) — must appear.

Tff7b72private Tff7b72val Te6edf3sha1TripleDesOid Tff7b72=

Te6edf3byteArrayOfTb4b4b4(T79c0ff0Te6edf3x06Tb4b4b4, T79c0ff0Te6edf3x0ATb4b4b4, T79c0ff0Te6edf3x2ATb4b4b4, T79c0ff0Te6edf3x86Tb4b4b4.Te6edf3toByteTb4b4b4(Tb4b4b4)Tb4b4b4, T79c0ff0Te6edf3x48Tb4b4b4, T79c0ff0Te6edf3x86Tb4b4b4.Te6edf3toByteTb4b4b4(Tb4b4b4)Tb4b4b4, T79c0ff0Te6edf3xF7Tb4b4b4.Te6edf3toByteTb4b4b4(Tb4b4b4)Tb4b4b4, T79c0ff0Te6edf3x0DTb4b4b4, T79c0ff0Te6edf3x01Tb4b4b4, T79c0ff0Te6edf3x0CTb4b4b4, T79c0ff0Te6edf3x01Tb4b4b4, T79c0ff0Te6edf3x03Tb4b4b4)

T8b949e// DER prefix of the MacData DigestInfo for a SHA1 MAC: AlgorithmIdentifier(1.3.14.3.2.26, NULL)

T8b949e// followed by the 20-byte OCTET STRING header — must appear.

Tff7b72private Tff7b72val Te6edf3sha1MacDigestInfoPrefix Tff7b72=

Te6edf3byteArrayOfTb4b4b4(T79c0ff0Te6edf3x30Tb4b4b4, T79c0ff0Te6edf3x09Tb4b4b4, T79c0ff0Te6edf3x06Tb4b4b4, T79c0ff0Te6edf3x05Tb4b4b4, T79c0ff0Te6edf3x2BTb4b4b4, T79c0ff0Te6edf3x0ETb4b4b4, T79c0ff0Te6edf3x03Tb4b4b4, T79c0ff0Te6edf3x02Tb4b4b4, T79c0ff0Te6edf3x1ATb4b4b4, T79c0ff0Te6edf3x05Tb4b4b4, T79c0ff0Te6edf3x00Tb4b4b4, T79c0ff0Te6edf3x04Tb4b4b4, T79c0ff0Te6edf3x14Tb4b4b4)

Tff7b72private Tff7b72fun Te6edf3ByteArrayTb4b4b4.Td2a8ffcontainsSequenceTb4b4b4(Te6edf3needleTb4b4b4: Te6edf3ByteArrayTb4b4b4)Tb4b4b4: Tffa657Boolean Tff7b72=

Tb4b4b4(T79c0ff0.Tb4b4b4.Te6edf3size Tff7b72- Te6edf3needleTb4b4b4.Te6edf3sizeTb4b4b4)Tb4b4b4.Te6edf3any Tb4b4b4{ Te6edf3offset Tff7b72-Tff7b72> Te6edf3needleTb4b4b4.Te6edf3indicesTb4b4b4.Te6edf3all Tb4b4b4{ Tff7b72thisTff7b72[Te6edf3offset Tff7b72+ Tffa657itTff7b72] Tff7b72=Tff7b72= Te6edf3needleTff7b72[Tffa657itTff7b72] Tb4b4b4} Tb4b4b4}

Tff7b72private Tff7b72fun Td2a8ffassertLegacyEncodingTb4b4b4(Te6edf3bytesTb4b4b4: Te6edf3ByteArrayTb4b4b4, Te6edf3nameTb4b4b4: Tffa657StringTb4b4b4) Tb4b4b4{

Te6edf3assertFalseTb4b4b4(Te6edf3bytesTb4b4b4.Te6edf3containsSequenceTb4b4b4(Te6edf3pbes2OidTb4b4b4)Tb4b4b4, Ta5d6ff"Tffd700$Te6edf3nameTa5d6ff uses PBES2/AES encryption, unreadable on Android <= 9Ta5d6ff"Tb4b4b4)

Te6edf3assertTrueTb4b4b4(Te6edf3bytesTb4b4b4.Te6edf3containsSequenceTb4b4b4(Te6edf3sha1TripleDesOidTb4b4b4)Tb4b4b4, Ta5d6ff"Tffd700$Te6edf3nameTa5d6ff is missing legacy SHA1/3DES PKCS#12 encryptionTa5d6ff"Tb4b4b4)

Te6edf3assertTrueTb4b4b4(Te6edf3bytesTb4b4b4.Te6edf3containsSequenceTb4b4b4(Te6edf3sha1MacDigestInfoPrefixTb4b4b4)Tb4b4b4, Ta5d6ff"Tffd700$Te6edf3nameTa5d6ff is missing a SHA1 PKCS#12 MACTa5d6ff"Tb4b4b4)

Tb4b4b4}

Tff7b72private Tff7b72fun Td2a8ffassertLoadsAsPkcs12Tb4b4b4(Te6edf3bytesTb4b4b4: Te6edf3ByteArrayTb4b4b4, Te6edf3nameTb4b4b4: Tffa657StringTb4b4b4) Tb4b4b4{

Tff7b72val Te6edf3password Tff7b72= Te6edf3TAK_BUNDLED_CERT_PASSWORDTb4b4b4.Te6edf3toCharArrayTb4b4b4(Tb4b4b4)

Tff7b72val Te6edf3keyStore Tff7b72= Te6edf3KeyStoreTb4b4b4.Te6edf3getInstanceTb4b4b4(Ta5d6ff"Ta5d6ffPKCS12Ta5d6ff"Tb4b4b4)

Te6edf3ByteArrayInputStreamTb4b4b4(Te6edf3bytesTb4b4b4)Tb4b4b4.Te6edf3use Tb4b4b4{ Te6edf3keyStoreTb4b4b4.Te6edf3loadTb4b4b4(Tffa657itTb4b4b4, Te6edf3passwordTb4b4b4) Tb4b4b4}

Tff7b72val Te6edf3privateKeys Tff7b72= Te6edf3keyStoreTb4b4b4.Te6edf3aliasesTb4b4b4(Tb4b4b4)Tb4b4b4.Te6edf3toListTb4b4b4(Tb4b4b4)Tb4b4b4.Te6edf3mapNotNull Tb4b4b4{ Te6edf3keyStoreTb4b4b4.Te6edf3getKeyTb4b4b4(Tffa657itTb4b4b4, Te6edf3passwordTb4b4b4) Tff7b72as? Te6edf3PrivateKey Tb4b4b4}

Te6edf3assertTrueTb4b4b4(Te6edf3privateKeysTb4b4b4.Te6edf3isNotEmptyTb4b4b4(Tb4b4b4)Tb4b4b4, Ta5d6ff"Tffd700$Te6edf3nameTa5d6ff has no private key entryTa5d6ff"Tb4b4b4)

Tb4b4b4}

Tf0883e@Test

Tff7b72fun Td2a8ff`server p12 uses legacy encoding and loads`Tb4b4b4(Tb4b4b4) Tb4b4b4{

Tff7b72val Te6edf3bytes Tff7b72= Te6edf3assertNotNullTb4b4b4(Te6edf3TakCertLoaderTb4b4b4.Te6edf3getServerP12BytesTb4b4b4(Tb4b4b4)Tb4b4b4, Ta5d6ff"Ta5d6ffserver.p12 missing from classpathTa5d6ff"Tb4b4b4)

Te6edf3assertLegacyEncodingTb4b4b4(Te6edf3bytesTb4b4b4, Ta5d6ff"Ta5d6ffserver.p12Ta5d6ff"Tb4b4b4)

Te6edf3assertLoadsAsPkcs12Tb4b4b4(Te6edf3bytesTb4b4b4, Ta5d6ff"Ta5d6ffserver.p12Ta5d6ff"Tb4b4b4)

Tb4b4b4}

Tf0883e@Test

Tff7b72fun Td2a8ff`client p12 uses legacy encoding and loads`Tb4b4b4(Tb4b4b4) Tb4b4b4{

Tff7b72val Te6edf3bytes Tff7b72= Te6edf3assertNotNullTb4b4b4(Te6edf3TakCertLoaderTb4b4b4.Te6edf3getClientP12BytesTb4b4b4(Tb4b4b4)Tb4b4b4, Ta5d6ff"Ta5d6ffclient.p12 missing from classpathTa5d6ff"Tb4b4b4)

Te6edf3assertLegacyEncodingTb4b4b4(Te6edf3bytesTb4b4b4, Ta5d6ff"Ta5d6ffclient.p12Ta5d6ff"Tb4b4b4)

Te6edf3assertLoadsAsPkcs12Tb4b4b4(Te6edf3bytesTb4b4b4, Ta5d6ff"Ta5d6ffclient.p12Ta5d6ff"Tb4b4b4)

Tb4b4b4}

Tf0883e@Test

Tff7b72fun Td2a8ff`server ssl context builds from bundled certs`Tb4b4b4(Tb4b4b4) Tb4b4b4{

Te6edf3assertNotNullTb4b4b4(Te6edf3TakCertLoaderTb4b4b4.Te6edf3getServerSslContextTb4b4b4(Tb4b4b4)Tb4b4b4, Ta5d6ff"Ta5d6ffSSLContext could not be built from bundled certsTa5d6ff"Tb4b4b4)

Tb4b4b4}

Tb4b4b4}