Changeset 15469 in josm for trunk/src/org/openstreetmap/josm/tools/PlatformHookWindows.java

Timestamp:

2019-10-22T23:32:51+02:00 (4 years ago)

Author:

Don-vip

Message:

fix #10033, fix #15748, fix #17097 - drop remote control https support

Rationale: all modern browsers (including next version of Safari) allow mixed-content to localhost.

Cross-platform / cross-browser HTTPS support is a pain to maintain, was never completed, and is no longer needed.

File:

• trunk/src/org/openstreetmap/josm/tools/PlatformHookWindows.java (modified) (5 diffs)

trunk/src/org/openstreetmap/josm/tools/PlatformHookWindows.java

@@ -32 +32 @@
 
 import java.awt.Desktop;
-import java.awt.GraphicsEnvironment;
 import java.io.BufferedWriter;
 import java.io.File;
@@ -50 +49 @@
 import java.nio.file.InvalidPathException;
 import java.nio.file.Path;
-import java.security.InvalidKeyException;
-import java.security.KeyFactory;
 import java.security.KeyStore;
 import java.security.KeyStoreException;
 import java.security.MessageDigest;
 import java.security.NoSuchAlgorithmException;
-import java.security.NoSuchProviderException;
-import java.security.PublicKey;
-import java.security.SignatureException;
 import java.security.cert.Certificate;
 import java.security.cert.CertificateException;
 import java.security.cert.X509Certificate;
-import java.security.spec.InvalidKeySpecException;
-import java.security.spec.X509EncodedKeySpec;
 import java.text.ParseException;
 import java.util.ArrayList;
@@ -79 +71 @@
 import java.util.regex.Pattern;
 
-import javax.swing.JOptionPane;
-
 import org.openstreetmap.josm.data.Preferences;
 import org.openstreetmap.josm.data.StructUtils;
 import org.openstreetmap.josm.data.StructUtils.StructEntry;
 import org.openstreetmap.josm.data.StructUtils.WriteExplicitly;
-import org.openstreetmap.josm.gui.MainApplication;
 import org.openstreetmap.josm.io.CertificateAmendment.NativeCertAmend;
 import org.openstreetmap.josm.io.NetworkManager;
@@ -147 +136 @@
         }
     }
-
-    private static final byte[] INSECURE_PUBLIC_KEY = new byte[] {
-        0x30, (byte) 0x82, 0x1, 0x22, 0x30, 0xd, 0x6, 0x9, 0x2a, (byte) 0x86, 0x48,
-        (byte) 0x86, (byte) 0xf7, 0xd, 0x1, 0x1, 0x1, 0x5, 0x0, 0x3, (byte) 0x82, 0x1, 0xf, 0x0,
-        0x30, (byte) 0x82, 0x01, 0x0a, 0x02, (byte) 0x82, 0x01, 0x01, 0x00, (byte) 0x95, (byte) 0x95, (byte) 0x88,
-        (byte) 0x84, (byte) 0xc8, (byte) 0xd9, 0x6b, (byte) 0xc5, (byte) 0xda, 0x0b, 0x69, (byte) 0xbf, (byte) 0xfc,
-        0x7e, (byte) 0xb9, (byte) 0x96, 0x2c, (byte) 0xeb, (byte) 0x8f, (byte) 0xbc, 0x6e, 0x40, (byte) 0xe6, (byte) 0xe2,
-        (byte) 0xfc, (byte) 0xf1, 0x7f, 0x73, (byte) 0xa7, (byte) 0x9d, (byte) 0xde, (byte) 0xc7, (byte) 0x88, 0x57, 0x51,
-        (byte) 0x84, (byte) 0xed, (byte) 0x96, (byte) 0xfb, (byte) 0xe1, 0x38, (byte) 0xef, 0x08, 0x2b, (byte) 0xf3,
-        (byte) 0xc7, (byte) 0xc3, 0x5d, (byte) 0xfe, (byte) 0xf9, 0x51, (byte) 0xe6, 0x29, (byte) 0xfc, (byte) 0xe5, 0x0d,
-        (byte) 0xa1, 0x0d, (byte) 0xa8, (byte) 0xb4, (byte) 0xae, 0x26, 0x18, 0x19, 0x4d, 0x6c, 0x0c, 0x3b, 0x12, (byte) 0xba,
-        (byte) 0xbc, 0x5f, 0x32, (byte) 0xb3, (byte) 0xbe, (byte) 0x9d, 0x17, 0x0d, 0x4d, 0x2f, 0x1a, 0x48, (byte) 0xb7,
-        (byte) 0xac, (byte) 0xf7, 0x1a, 0x43, 0x01, (byte) 0x97, (byte) 0xf4, (byte) 0xf8, 0x4c, (byte) 0xbb, 0x6a, (byte) 0xbc,
-        0x33, (byte) 0xe1, 0x73, 0x1e, (byte) 0x86, (byte) 0xfb, 0x2e, (byte) 0xb1, 0x63, 0x75, (byte) 0x85, (byte) 0xdc,
-        (byte) 0x82, 0x6c, 0x28, (byte) 0xf1, (byte) 0xe3, (byte) 0x90, 0x63, (byte) 0x9d, 0x3d, 0x48, (byte) 0x8a, (byte) 0x8c,
-        0x47, (byte) 0xe2, 0x10, 0x0b, (byte) 0xef, (byte) 0x91, (byte) 0x94, (byte) 0xb0, 0x6c, 0x4c, (byte) 0x80, 0x76, 0x03,
-        (byte) 0xe1, (byte) 0xb6, (byte) 0x90, (byte) 0x87, (byte) 0xd9, (byte) 0xae, (byte) 0xf4, (byte) 0x8e, (byte) 0xe0,
-        (byte) 0x9f, (byte) 0xe7, 0x3a, 0x2c, 0x2f, 0x21, (byte) 0xd4, 0x46, (byte) 0xba, (byte) 0x95, 0x70, (byte) 0xa9, 0x5b,
-        0x20, 0x2a, (byte) 0xfa, 0x52, 0x3e, (byte) 0x9d, (byte) 0xd9, (byte) 0xef, 0x28, (byte) 0xc5, (byte) 0xd1, 0x60,
-        (byte) 0x89, 0x68, 0x6e, 0x7f, (byte) 0xd7, (byte) 0x9e, (byte) 0x89, 0x4c, (byte) 0xeb, 0x4d, (byte) 0xd2, (byte) 0xc6,
-        (byte) 0xf4, 0x2d, 0x02, 0x5d, (byte) 0xda, (byte) 0xde, 0x33, (byte) 0xfe, (byte) 0xc1, 0x7e, (byte) 0xde, 0x4f, 0x1f,
-        (byte) 0x9b, 0x6e, 0x6f, 0x0f, 0x66, 0x71, 0x19, (byte) 0xe9, 0x43, 0x3c, (byte) 0x83, 0x0a, 0x0f, 0x28, 0x21, (byte) 0xc8,
-        0x38, (byte) 0xd3, 0x4e, 0x48, (byte) 0xdf, (byte) 0xd4, (byte) 0x99, (byte) 0xb5, (byte) 0xc6, (byte) 0x8d, (byte) 0xd4,
-        (byte) 0xc1, 0x69, 0x58, 0x79, (byte) 0x82, 0x32, (byte) 0x82, (byte) 0xd4, (byte) 0x86, (byte) 0xe2, 0x04, 0x08, 0x63,
-        (byte) 0x87, (byte) 0xf0, 0x2a, (byte) 0xf6, (byte) 0xec, 0x3e, 0x51, 0x0f, (byte) 0xda, (byte) 0xb4, 0x67, 0x19, 0x5e,
-        0x16, 0x02, (byte) 0x9f, (byte) 0xf1, 0x19, 0x0c, 0x3e, (byte) 0xb8, 0x04, 0x49, 0x07, 0x53, 0x02, 0x03, 0x01, 0x00, 0x01
-    };
 
     private static final String WINDOWS_ROOT = "Windows-ROOT";
@@ -374 +336 @@
         ks.load(null, null);
         return ks;
-    }
-
-    /**
-     * Removes potential insecure certificates installed with previous versions of JOSM on Windows.
-     * @throws NoSuchAlgorithmException on unsupported signature algorithms
-     * @throws CertificateException if any of the certificates in the Windows keystore could not be loaded
-     * @throws KeyStoreException if no Provider supports a KeyStoreSpi implementation for the type "Windows-ROOT"
-     * @throws IOException if there is an I/O or format problem with the keystore data, if a password is required but not given
-     * @since 7335
-     */
-    public static void removeInsecureCertificates() throws NoSuchAlgorithmException, CertificateException, KeyStoreException, IOException {
-        // We offered before a public private key we need now to remove from Windows PCs as it might be a huge security risk (see #10230)
-        PublicKey insecurePubKey = null;
-        try {
-            insecurePubKey = KeyFactory.getInstance("RSA").generatePublic(new X509EncodedKeySpec(INSECURE_PUBLIC_KEY));
-        } catch (InvalidKeySpecException | NoSuchAlgorithmException e) {
-            Logging.error(e);
-            return;
-        }
-        KeyStore ks = getRootKeystore();
-        Enumeration<String> en = ks.aliases();
-        Collection<String> insecureCertificates = new ArrayList<>();
-        while (en.hasMoreElements()) {
-            String alias = en.nextElement();
-            // Look for certificates associated with a private key
-            if (ks.isKeyEntry(alias)) {
-                try {
-                    ks.getCertificate(alias).verify(insecurePubKey);
-                    // If no exception, this is a certificate signed with the insecure key -> remove it
-                    insecureCertificates.add(alias);
-                } catch (InvalidKeyException | NoSuchProviderException | SignatureException e) {
-                    // If exception this is not a certificate related to JOSM, just trace it
-                    Logging.trace(alias + " --> " + e.getClass().getName());
-                    Logging.trace(e);
-                }
-            }
-        }
-        // Remove insecure certificates
-        if (!insecureCertificates.isEmpty()) {
-            StringBuilder message = new StringBuilder("<html>");
-            message.append(tr("A previous version of JOSM has installed a custom certificate "+
-                    "in order to provide HTTPS support for Remote Control:"))
-                   .append("<br><ul>");
-            for (String alias : insecureCertificates) {
-                message.append("<li>")
-                       .append(alias)
-                       .append("</li>");
-            }
-            message.append("</ul>")
-                   .append(tr("It appears it could be an important <b>security risk</b>.<br><br>"+
-                    "You are now going to be prompted by Windows to remove this insecure certificate.<br>"+
-                    "For your own safety, <b>please click Yes</b> in next dialog."))
-                   .append("</html>");
-            JOptionPane.showMessageDialog(MainApplication.getMainFrame(), message.toString(), tr("Warning"), JOptionPane.WARNING_MESSAGE);
-            for (String alias : insecureCertificates) {
-                Logging.warn(tr("Removing insecure certificate from {0} keystore: {1}", WINDOWS_ROOT, alias));
-                try {
-                    ks.deleteEntry(alias);
-                } catch (KeyStoreException e) {
-                    Logging.log(Logging.LEVEL_ERROR, tr("Unable to remove insecure certificate from keystore: {0}", e.getMessage()), e);
-                }
-            }
-        }
-    }
-
-    @Override
-    public boolean setupHttpsCertificate(String entryAlias, KeyStore.TrustedCertificateEntry trustedCert)
-            throws KeyStoreException, NoSuchAlgorithmException, CertificateException, IOException {
-        KeyStore ks = getRootKeystore();
-        // Look for certificate to install
-        try {
-            String alias = ks.getCertificateAlias(trustedCert.getTrustedCertificate());
-            if (alias != null) {
-                // JOSM certificate found, return
-                Logging.debug(tr("JOSM localhost certificate found in {0} keystore: {1}", WINDOWS_ROOT, alias));
-                return false;
-            }
-        } catch (ArrayIndexOutOfBoundsException e) {
-            // catch error of JDK-8172244 as bug seems to not be fixed anytime soon
-            Logging.log(Logging.LEVEL_ERROR, "JDK-8172244 occurred. Abort HTTPS setup", e);
-            return false;
-        }
-        if (!GraphicsEnvironment.isHeadless()) {
-            // JOSM certificate not found, warn user
-            StringBuilder message = new StringBuilder("<html>");
-            message.append(tr("Remote Control is configured to provide HTTPS support.<br>"+
-                    "This requires to add a custom certificate generated by JOSM to the Windows Root CA store.<br><br>"+
-                    "You are now going to be prompted by Windows to confirm this operation.<br>"+
-                    "To enable proper HTTPS support, <b>please click Yes</b> in next dialog.<br><br>"+
-                    "If unsure, you can also click No then disable HTTPS support in Remote Control preferences."))
-                   .append("</html>");
-            JOptionPane.showMessageDialog(MainApplication.getMainFrame(), message.toString(),
-                    tr("HTTPS support in Remote Control"), JOptionPane.INFORMATION_MESSAGE);
-        }
-        // install it to Windows-ROOT keystore, used by IE, Chrome and Safari, but not by Firefox
-        Logging.info(tr("Adding JOSM localhost certificate to {0} keystore", WINDOWS_ROOT));
-        ks.setEntry(entryAlias, trustedCert, null);
-        return true;
     }