Changeset 11943 in josm for trunk

Timestamp:

2017-04-17T14:07:04+02:00 (8 years ago)

Author:

Don-vip

Message:

fix #14649 - load Dutch Government (G2 & G3) certificates from Windows keystore if not found in Java keystore

Location:

trunk

Files:

• src/org/openstreetmap/josm/io/CertificateAmendment.java (modified) (4 diffs)
• src/org/openstreetmap/josm/tools/PlatformHook.java (modified) (2 diffs)
• src/org/openstreetmap/josm/tools/PlatformHookWindows.java (modified) (3 diffs)
• test/unit/org/openstreetmap/josm/JOSMFixture.java (modified) (2 diffs)
• test/unit/org/openstreetmap/josm/io/CertificateAmendmentTest.java (modified) (2 diffs)
• test/unit/org/openstreetmap/josm/testutils/JOSMTestRules.java (modified) (6 diffs)

trunk/src/org/openstreetmap/josm/io/CertificateAmendment.java

@@ -16 +16 @@
 import java.security.KeyStoreException;
 import java.security.MessageDigest;
+import java.security.NoSuchAlgorithmException;
+import java.security.cert.CertificateEncodingException;
+import java.security.cert.CertificateException;
 import java.security.cert.CertificateFactory;
 import java.security.cert.PKIXParameters;
@@ -40 +43 @@
 public final class CertificateAmendment {
 
-    private static final String[] CERT_AMEND = {
-        "resource://data/security/DST_Root_CA_X3.pem"
+    /**
+     * A certificate amendment.
+     * @since 11940
+     */
+    public static class CertAmend {
+        private final String id;
+        private final String sha256;
+
+        CertAmend(String path, String sha256) {
+            this.id = path;
+            this.sha256 = sha256;
+        }
+
+        /**
+         * Returns the certificate identifier.
+         * @return path for JOSM embedded certificate, alias for platform certificate
+         */
+        public final String getId() {
+            return id;
+        }
+
+        /**
+         * Returns the SHA-256 hash.
+         * @return the SHA-256 hash, in hexadecimal
+         */
+        public final String getSha256() {
+            return sha256;
+        }
+    }
+
+    /**
+     * Certificates embedded in JOSM
+     */
+    private static final CertAmend[] CERT_AMEND = {
+        new CertAmend("resource://data/security/DST_Root_CA_X3.pem",
+                "0687260331a72403d909f105e69bcf0d32e1bd2493ffc6d9206d11bcd6770739")
     };
 
-    private static final String[] SHA_HASHES = {
-        "0687260331a72403d909f105e69bcf0d32e1bd2493ffc6d9206d11bcd6770739"
+    /**
+     * Certificates looked into platform native keystore and not embedded in JOSM.
+     * Identifiers must match Windows keystore aliases for efficient search.
+     */
+    private static final CertAmend[] PLATFORM_CERT_AMEND = {
+        new CertAmend("Staat der Nederlanden Root CA - G2",
+                "668c83947da63b724bece1743c31a0e6aed0db8ec5b31be377bb784f91b6716f"),
+        new CertAmend("Government of Netherlands G3",
+                "3c4fb0b95ab8b30032f432b86f535fe172c185d0fd39865837cf36187fa6f428")
     };
 
@@ -66 +110 @@
         }
 
+        MessageDigest md = MessageDigest.getInstance("SHA-256");
         CertificateFactory cf = CertificateFactory.getInstance("X.509");
         boolean certificateAdded = false;
-        for (int i = 0; i < CERT_AMEND.length; i++) {
-            try (CachedFile certCF = new CachedFile(CERT_AMEND[i])) {
-                byte[] certBytes = certCF.getByteContent();
-                ByteArrayInputStream certIS = new ByteArrayInputStream(certBytes);
-                X509Certificate cert = (X509Certificate) cf.generateCertificate(certIS);
-                MessageDigest md = MessageDigest.getInstance("SHA-256");
-                String sha1 = Utils.toHexString(md.digest(cert.getEncoded()));
-                if (!SHA_HASHES[i].equals(sha1)) {
-                    throw new IllegalStateException(
-                            tr("Error adding certificate {0} - certificate fingerprint mismatch. Expected {1}, was {2}",
-                            CERT_AMEND[i],
-                            SHA_HASHES[i],
-                            sha1
-                            ));
-                }
-                if (certificateIsMissing(keyStore, cert)) {
-                    if (Main.isDebugEnabled()) {
-                        Main.debug(tr("Adding certificate for TLS connections: {0}", cert.getSubjectX500Principal().getName()));
-                    }
-                    String alias = "josm:" + new File(CERT_AMEND[i]).getName();
-                    keyStore.setCertificateEntry(alias, cert);
+        // Add embedded certificates. Exit in case of error
+        for (CertAmend certAmend : CERT_AMEND) {
+            try (CachedFile certCF = new CachedFile(certAmend.id)) {
+                X509Certificate cert = (X509Certificate) cf.generateCertificate(
+                        new ByteArrayInputStream(certCF.getByteContent()));
+                if (checkAndAddCertificate(md, cert, certAmend, keyStore)) {
                     certificateAdded = true;
                 }
             }
+        }
+
+        try {
+            // Try to add platform certificates. Do not exit in case of error (embedded certificates may be OK)
+            for (CertAmend certAmend : PLATFORM_CERT_AMEND) {
+                X509Certificate cert = Main.platform.getX509Certificate(certAmend);
+                if (checkAndAddCertificate(md, cert, certAmend, keyStore)) {
+                    certificateAdded = true;
+                }
+            }
+        } catch (KeyStoreException | NoSuchAlgorithmException | CertificateException | IOException | IllegalStateException e) {
+            Main.error(e);
         }
 
@@ -101 +143 @@
             SSLContext.setDefault(sslContext);
         }
+    }
+
+    private static boolean checkAndAddCertificate(MessageDigest md, X509Certificate cert, CertAmend certAmend, KeyStore keyStore)
+            throws CertificateEncodingException, KeyStoreException, InvalidAlgorithmParameterException {
+        if (cert != null) {
+            String sha256 = Utils.toHexString(md.digest(cert.getEncoded()));
+            if (!certAmend.sha256.equals(sha256)) {
+                throw new IllegalStateException(
+                        tr("Error adding certificate {0} - certificate fingerprint mismatch. Expected {1}, was {2}",
+                            certAmend.id, certAmend.sha256, sha256));
+            }
+            if (certificateIsMissing(keyStore, cert)) {
+                if (Main.isDebugEnabled()) {
+                    Main.debug(tr("Adding certificate for TLS connections: {0}", cert.getSubjectX500Principal().getName()));
+                }
+                String alias = "josm:" + new File(certAmend.id).getName();
+                keyStore.setCertificateEntry(alias, cert);
+                return true;
+            }
+        }
+        return false;
     }
 

trunk/src/org/openstreetmap/josm/tools/PlatformHook.java

@@ -9 +9 @@
 import java.security.NoSuchAlgorithmException;
 import java.security.cert.CertificateException;
+import java.security.cert.X509Certificate;
 import java.util.List;
+
+import org.openstreetmap.josm.io.CertificateAmendment.CertAmend;
 
 /**
@@ -154 +157 @@
 
     /**
+     * Returns the {@code X509Certificate} matching the given certificate amendment information.
+     * @param certAmend certificate amendment
+     * @return the {@code X509Certificate} matching the given certificate amendment information, or {@code null}
+     * @throws KeyStoreException in case of error
+     * @throws IOException in case of error
+     * @throws CertificateException in case of error
+     * @throws NoSuchAlgorithmException in case of error
+     * @since 11940
+     */
+    default X509Certificate getX509Certificate(CertAmend certAmend)
+            throws KeyStoreException, NoSuchAlgorithmException, CertificateException, IOException {
+        return null;
+    }
+
+    /**
      * Returns the platform-dependent default cache directory.
      * @return the platform-dependent default cache directory

trunk/src/org/openstreetmap/josm/tools/PlatformHookWindows.java

@@ -45 +45 @@
 import java.security.KeyStore;
 import java.security.KeyStoreException;
+import java.security.MessageDigest;
 import java.security.NoSuchAlgorithmException;
 import java.security.NoSuchProviderException;
 import java.security.PublicKey;
 import java.security.SignatureException;
+import java.security.cert.Certificate;
 import java.security.cert.CertificateException;
+import java.security.cert.X509Certificate;
 import java.security.spec.InvalidKeySpecException;
 import java.security.spec.X509EncodedKeySpec;
@@ -64 +67 @@
 import org.openstreetmap.josm.Main;
 import org.openstreetmap.josm.data.Preferences;
+import org.openstreetmap.josm.io.CertificateAmendment.CertAmend;
 
 /**
-  * {@code PlatformHook} implementation for Microsoft Windows systems.
-  * @since 1023
-  */
+ * {@code PlatformHook} implementation for Microsoft Windows systems.
+ * @since 1023
+ */
 public class PlatformHookWindows implements PlatformHook {
 
@@ -351 +355 @@
         ks.setEntry(entryAlias, trustedCert, null);
         return true;
+    }
+
+    @Override
+    public X509Certificate getX509Certificate(CertAmend certAmend)
+            throws KeyStoreException, NoSuchAlgorithmException, CertificateException, IOException {
+        KeyStore ks = getRootKeystore();
+        // Search by alias (fast)
+        Certificate result = ks.getCertificate(certAmend.getId());
+        if (result instanceof X509Certificate) {
+            return (X509Certificate) result;
+        }
+        // If not found, search by SHA-256 (slower)
+        MessageDigest md = MessageDigest.getInstance("SHA-256");
+        for (Enumeration<String> aliases = ks.aliases(); aliases.hasMoreElements();) {
+            result = ks.getCertificate(aliases.nextElement());
+            if (result instanceof X509Certificate
+                    && certAmend.getSha256().equalsIgnoreCase(Utils.toHexString(md.digest(result.getEncoded())))) {
+                return (X509Certificate) result;
+            }
+        }
+        // Not found
+        return null;
     }
 

trunk/test/unit/org/openstreetmap/josm/JOSMFixture.java

@@ -22 +22 @@
 import org.openstreetmap.josm.io.OsmApi;
 import org.openstreetmap.josm.tools.I18n;
+import org.openstreetmap.josm.tools.JosmRuntimeException;
 import org.openstreetmap.josm.tools.Logging;
 
@@ -111 +112 @@
             CertificateAmendment.addMissingCertificates();
         } catch (IOException | GeneralSecurityException ex) {
-            throw new RuntimeException(ex);
+            throw new JosmRuntimeException(ex);
         }
 

trunk/test/unit/org/openstreetmap/josm/io/CertificateAmendmentTest.java

@@ -26 +26 @@
     @Rule
     @SuppressFBWarnings(value = "URF_UNREAD_PUBLIC_OR_PROTECTED_FIELD")
-    public JOSMTestRules test = new JOSMTestRules();
+    public JOSMTestRules test = new JOSMTestRules().platform().https();
 
     /**
@@ -82 +82 @@
     }
 
+    /**
+     * Test Dutch government.
+     * @throws IOException in case of I/O error
+     */
+    @Test
+    public void testDutchGovernment() throws IOException {
+        connect("https://geodata.nationaalgeoregister.nl", true);
+    }
+
     private static void connect(String url, boolean shouldWork) throws IOException {
         URLConnection connection = new URL(url).openConnection();

trunk/test/unit/org/openstreetmap/josm/testutils/JOSMTestRules.java

@@ -4 +4 @@
 import java.io.File;
 import java.io.IOException;
+import java.security.GeneralSecurityException;
 import java.text.MessageFormat;
 import java.util.TimeZone;
@@ -17 +18 @@
 import org.openstreetmap.josm.gui.mappaint.MapPaintStyles;
 import org.openstreetmap.josm.gui.util.GuiHelper;
+import org.openstreetmap.josm.io.CertificateAmendment;
 import org.openstreetmap.josm.io.OsmApi;
 import org.openstreetmap.josm.io.OsmApiInitializationException;
 import org.openstreetmap.josm.io.OsmTransferCanceledException;
 import org.openstreetmap.josm.tools.I18n;
+import org.openstreetmap.josm.tools.JosmRuntimeException;
 import org.openstreetmap.josm.tools.Logging;
 import org.openstreetmap.josm.tools.MemoryManagerTest;
@@ -46 +49 @@
     private boolean allowMemoryManagerLeaks;
     private boolean useMapStyles;
+    private boolean useHttps;
 
     /**
@@ -137 +141 @@
     public JOSMTestRules projection() {
         useProjection = true;
+        return this;
+    }
+
+    /**
+     * Set up HTTPS certificates
+     * @return this instance, for easy chaining
+     */
+    public JOSMTestRules https() {
+        useHttps = true;
         return this;
     }
@@ -222 +235 @@
         }
 
+        // Set Platform
+        if (platform) {
+            Main.determinePlatformHook();
+        }
+
+        if (useHttps) {
+            try {
+                CertificateAmendment.addMissingCertificates();
+            } catch (IOException | GeneralSecurityException ex) {
+                throw new JosmRuntimeException(ex);
+            }
+        }
+
         if (useProjection) {
             Main.setProjection(Projections.getProjectionByCode("EPSG:3857")); // Mercator
@@ -241 +267 @@
                 throw new InitializationError(e);
             }
-        }
-
-        // Set Platform
-        if (platform) {
-            Main.determinePlatformHook();
         }