Ticket #12264: certificate-amendment.diff

src/org/openstreetmap/josm/io/CertificateAmendment.java

@@ +1 @@
+// License: GPL. For details, see LICENSE file.
+package org.openstreetmap.josm.io;
+
+import static org.openstreetmap.josm.tools.I18n.tr;
+
+import java.io.File;
+import java.io.FileInputStream;
+import java.io.IOException;
+import java.io.InputStream;
+import java.nio.file.Paths;
+import java.security.InvalidAlgorithmParameterException;
+import java.security.KeyManagementException;
+import java.security.KeyStore;
+import java.security.KeyStoreException;
+import java.security.NoSuchAlgorithmException;
+import java.security.cert.CertificateException;
+import java.security.cert.CertificateFactory;
+import java.security.cert.PKIXParameters;
+import java.security.cert.TrustAnchor;
+import java.security.cert.X509Certificate;
+import java.util.Arrays;
+import java.util.Collection;
+import java.util.List;
+import java.util.Objects;
+
+import javax.net.ssl.SSLContext;
+import javax.net.ssl.TrustManagerFactory;
+
+import org.openstreetmap.josm.Main;
+
+/**
+ * Class to add missing root certificates to the list of trusted certificates
+ * for TLS connections.
+ *
+ * The added certificates are deemed trustworthy by the main web browsers and
+ * operating systems, but not included in some distributions of Java.
+ */
+public class CertificateAmendment {
+
+    public static final List<String> DEFAULT_CERT_AMEND = Arrays.asList(
+            "/etc/ssl/certs/DST_Root_CA_X3.pem");       // FIXME: ship file and change to resource://...
+    public static final Collection<String> CERT_AMEND =
+            Main.pref.getCollection("tls.trusted-certificates.amendments", DEFAULT_CERT_AMEND);
+
+    /**
+     * Add missing root certificates to the list of trusted certificates for TLS connections.
+     * @throws IOException if an I/O error occurs
+     */
+    public static void addMissingCertificates() throws IOException {
+        KeyStore keyStore;
+        try {
+            keyStore = KeyStore.getInstance(KeyStore.getDefaultType());
+        } catch (KeyStoreException ex) {
+            throw new IOException(ex);
+        }
+        String cacertsPath = Main.pref.get("tls.cacerts-file",
+                Paths.get(System.getProperty("java.home"), "lib", "security", "cacerts").toString());
+        String password = Main.pref.get("tls.cacerts.pw", "changeit");
+        try {
+            keyStore.load(new FileInputStream(cacertsPath), password.toCharArray());
+        } catch (NoSuchAlgorithmException ex) {
+            throw new RuntimeException(ex);
+        } catch (CertificateException ex) {
+            throw new IOException(ex);
+        }
+
+        boolean certificateAdded = false;
+        for (String certPath : CERT_AMEND) {
+            CertificateFactory cf;
+            try {
+                cf = CertificateFactory.getInstance("X.509");
+            } catch (CertificateException ex) {
+                throw new RuntimeException(ex);
+            }
+            try (CachedFile certCF = new CachedFile(certPath); InputStream certIS = certCF.getInputStream()) {
+                X509Certificate cert;
+                try {
+                    cert = (X509Certificate) cf.generateCertificate(certIS);
+                } catch (CertificateException ex) {
+                    throw new IOException(ex);
+                }
+                if (certificateIsMissing(keyStore, cert)) {
+                    Main.debug(tr("Adding certificate for TLS connections: {0}", cert.getSubjectX500Principal().getName()));
+                    String alias = "josm:" + new File(certPath).getName();
+                    try {
+                        keyStore.setCertificateEntry(alias, cert);
+                    } catch (KeyStoreException ex) {
+                        throw new AssertionError(ex);
+                    }
+                    certificateAdded = true;
+                }
+            }
+        }
+
+        if (certificateAdded) {
+            try {
+                TrustManagerFactory tmf = TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm());
+                tmf.init(keyStore);
+                SSLContext sslContext = SSLContext.getInstance("TLS");
+                sslContext.init(null, tmf.getTrustManagers(), null);
+                SSLContext.setDefault(sslContext);
+            } catch (NoSuchAlgorithmException | KeyStoreException | KeyManagementException ex) {
+                throw new RuntimeException(ex);
+            }
+        }
+    }
+
+    /**
+     * Check if the certificate is missing and needs to be added to the keystore.
+     * @param keyStore the keystore
+     * @param crt the certificate
+     * @return true, if the certificate is not contained in the keystore
+     */
+    private static boolean certificateIsMissing(KeyStore keyStore, X509Certificate crt) {
+        String id = crt.getSubjectX500Principal().getName();
+        PKIXParameters params;
+        try {
+            params = new PKIXParameters(keyStore);
+        } catch (KeyStoreException ex) {
+            throw new AssertionError(ex);
+        } catch (InvalidAlgorithmParameterException ex) {
+            throw new RuntimeException(ex);
+        }
+        for (TrustAnchor ta : params.getTrustAnchors()) {
+            X509Certificate cert = ta.getTrustedCert();
+            if (Objects.equals(id, cert.getSubjectX500Principal().getName()))
+                return false;
+        }
+        return true;
+    }
+}

src/org/openstreetmap/josm/gui/MainApplication.java

@@ -57 +57 @@
 import org.openstreetmap.josm.gui.preferences.server.OAuthAccessTokenHolder;
 import org.openstreetmap.josm.gui.preferences.server.ProxyPreference;
 import org.openstreetmap.josm.gui.util.GuiHelper;
+import org.openstreetmap.josm.io.CertificateAmendment;
 import org.openstreetmap.josm.io.DefaultProxySelector;
 import org.openstreetmap.josm.io.MessageNotifier;
 import org.openstreetmap.josm.io.OnlineResource;
@@ -400 +401 @@
             }
         }
 
+        try {
+            CertificateAmendment.addMissingCertificates();
+        } catch (IOException ex) {
+            ex.printStackTrace();
+            Main.warn(getErrorMessage(Utils.getRootCause(ex)));
+        }
         Authenticator.setDefault(DefaultAuthenticator.getInstance());
         DefaultProxySelector proxySelector = new DefaultProxySelector(ProxySelector.getDefault());
         ProxySelector.setDefault(proxySelector);