Changeset 7335 in josm for trunk/src/org/openstreetmap/josm/gui

Timestamp:

2014-07-26T03:50:31+02:00 (10 years ago)

Author:

Don-vip

Message:

see #10230, see #10033 - big rework of HTTPS support for Remote Control:

• HTTPS disabled by default, must be enabled in remote control preferences
• Old certificate and private key removed from jar and Windows keystore if found, even if remote control disabled
• New certificate generated at runtime with critical X509 extensions BasicConstraints (non-CA certificate), ExtendedKeyUsage (usage restriction for TLS server sessions)
• New passwords generated at runtime (but stored in clear in user preferences)
• Private key is no longer stored in Windows keystore (only certificate)

Location:

trunk/src/org/openstreetmap/josm/gui

Files:

• MainApplication.java (modified) (6 diffs)
• preferences/remotecontrol/RemoteControlPreference.java (modified) (5 diffs)

trunk/src/org/openstreetmap/josm/gui/MainApplication.java

@@ -13 +13 @@
 import java.awt.event.WindowEvent;
 import java.io.File;
+import java.io.IOException;
 import java.io.InputStream;
 import java.net.Authenticator;
@@ -19 +20 @@
 import java.security.AllPermission;
 import java.security.CodeSource;
+import java.security.KeyStoreException;
+import java.security.NoSuchAlgorithmException;
 import java.security.PermissionCollection;
 import java.security.Permissions;
 import java.security.Policy;
+import java.security.cert.CertificateException;
 import java.util.ArrayList;
 import java.util.Collection;
@@ -59 +63 @@
 import org.openstreetmap.josm.tools.ImageProvider;
 import org.openstreetmap.josm.tools.OsmUrlToBounds;
+import org.openstreetmap.josm.tools.PlatformHookWindows;
 import org.openstreetmap.josm.tools.Utils;
 
@@ -323 +328 @@
             // Enable JOSM debug level
             logLevel = 4;
-            // Enable debug in OAuth signpost
-            Preferences.updateSystemProperty("debug", "true");
             Main.info(tr("Printing debugging messages to console"));
         }
@@ -331 +334 @@
             // Enable JOSM debug level
             logLevel = 5;
+            // Enable debug in OAuth signpost via system preference, but only at trace level
+            Preferences.updateSystemProperty("debug", "true");
             Main.info(tr("Enabled detailed debug level (trace)"));
         }
@@ -435 +440 @@
 
         SwingUtilities.invokeLater(new GuiFinalizationWorker(args, proxySelector));
+
+        if (Main.isPlatformWindows()) {
+            try {
+                // Check for insecure certificates to remove.
+                // This is Windows-dependant code but it can't go to preStartupHook (need i18n) neither startupHook (need to be called before remote control)
+                ((PlatformHookWindows)Main.platform).removeInsecureCertificates();
+            } catch (NoSuchAlgorithmException | CertificateException | KeyStoreException | IOException e) {
+                error(e);
+            }
+        }
 
         if (RemoteControl.PROP_REMOTECONTROL_ENABLED.get()) {

trunk/src/org/openstreetmap/josm/gui/preferences/remotecontrol/RemoteControlPreference.java

@@ -28 +28 @@
 import org.openstreetmap.josm.io.remotecontrol.PermissionPrefWithDefault;
 import org.openstreetmap.josm.io.remotecontrol.RemoteControl;
+import org.openstreetmap.josm.io.remotecontrol.RemoteControlHttpsServer;
 import org.openstreetmap.josm.io.remotecontrol.handler.RequestHandler;
 import org.openstreetmap.josm.tools.GBC;
@@ -59 +60 @@
     private final Map<PermissionPrefWithDefault, JCheckBox> prefs = new LinkedHashMap<>();
     private JCheckBox enableRemoteControl;
+    private JCheckBox enableHttpsSupport;
     private JCheckBox loadInNewLayer = new JCheckBox(tr("Download objects to new layer"));
     private JCheckBox alwaysAskUserConfirm = new JCheckBox(tr("Confirm all Remote Control actions manually"));
@@ -89 +91 @@
         remote.add(wrapper, GBC.eol().fill(GBC.HORIZONTAL).insets(5, 5, 5, 5));
 
-        wrapper.add(new JLabel(tr("Permitted actions:")), GBC.eol());
+        enableHttpsSupport = new JCheckBox(tr("Enable HTTPS support"), RemoteControl.PROP_REMOTECONTROL_HTTPS_ENABLED.get());
+        wrapper.add(enableHttpsSupport, GBC.eol().fill(GBC.HORIZONTAL));
+        wrapper.add(new JSeparator(), GBC.eop().fill(GBC.HORIZONTAL).insets(15, 5, 15, 5));
+
+        wrapper.add(new JLabel(tr("Permitted actions:")), GBC.eol().insets(5, 0, 0, 0));
         for (JCheckBox p : prefs.values()) {
             wrapper.add(p, GBC.eol().insets(15, 5, 0, 0).fill(GBC.HORIZONTAL));
@@ -120 +126 @@
     public boolean ok() {
         boolean enabled = enableRemoteControl.isSelected();
+        boolean httpsEnabled = enableHttpsSupport.isSelected();
         boolean changed = RemoteControl.PROP_REMOTECONTROL_ENABLED.put(enabled);
+        boolean httpsChanged = RemoteControl.PROP_REMOTECONTROL_HTTPS_ENABLED.put(httpsEnabled);
         if (enabled) {
             for (Entry<PermissionPrefWithDefault, JCheckBox> p : prefs.entrySet()) {
@@ -134 +142 @@
                 RemoteControl.stop();
             }
+        } else if (httpsChanged) {
+            if (httpsEnabled) {
+                RemoteControlHttpsServer.restartRemoteControlHttpsServer();
+            } else {
+                RemoteControlHttpsServer.stopRemoteControlHttpsServer();
+            }
         }
         return false;