echelon/i2p.i2p
1
0
Fork 0
forked from I2P_Developers/i2p.i2p
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

* SU3File: Disable the X.509 CN checking of local certs on Android,

Browse Source 
as the javax.naming classes are not available.
   Any issues with local certs will be discovered in non-Android testing.
This commit is contained in:
zzz
2014-07-13 13:29:55 +00:00
parent 2c185ea76c
commit 9dabc75866
2 changed files with 26 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
core/java/src/net/i2p/crypto/CertUtil.java
View File

@ -18,6 +18,7 @@ import net.i2p.I2PAppContext;
import net.i2p.data.Base64; import net.i2p.data.Base64;
import net.i2p.util.Log; import net.i2p.util.Log;
import net.i2p.util.SecureFileOutputStream; import net.i2p.util.SecureFileOutputStream;
import net.i2p.util.SystemVersion;
/** /**
* Java X.509 certificate utilities, consolidated from various places. * Java X.509 certificate utilities, consolidated from various places.
@ -65,11 +66,18 @@ public class CertUtil {
} }
/** /**
* Get a value out of the subject distinguished name * Get a value out of the subject distinguished name.
*
* Warning - unsupported in Android (no javax.naming), returns null.
*
* @param type e.g. "CN" * @param type e.g. "CN"
* @return value or null if not found * @return value or null if not found
*/ */
public static String getSubjectValue(X509Certificate cert, String type) { public static String getSubjectValue(X509Certificate cert, String type) {
if (SystemVersion.isAndroid()) {
error("Don't call this in Android", new UnsupportedOperationException("I did it"));
return null;
}
type = type.toUpperCase(Locale.US); type = type.toUpperCase(Locale.US);
X500Principal p = cert.getSubjectX500Principal(); X500Principal p = cert.getSubjectX500Principal();
String subj = p.getName(); String subj = p.getName();

23
core/java/src/net/i2p/crypto/DirKeyRing.java
View File

@ -14,9 +14,11 @@ import java.security.PublicKey;
import java.security.cert.CertificateFactory; import java.security.cert.CertificateFactory;
import java.security.cert.X509Certificate; import java.security.cert.X509Certificate;
import net.i2p.util.SystemVersion;
/** /**
* Dumb storage in a directory for testing. * Simple storage of each cert in a separate file in a directory.
* No sanitization of filenames, unsafe. * Limited sanitization of filenames.
* *
* @since 0.9.9 * @since 0.9.9
*/ */
@ -30,7 +32,9 @@ class DirKeyRing implements KeyRing {
/** /**
* Cert must be in the file (escaped keyName).crt, * Cert must be in the file (escaped keyName).crt,
* and have a CN == keyName * and have a CN == keyName.
*
* CN check unsupported on Android.
*/ */
public PublicKey getKey(String keyName, String scope, SigType type) public PublicKey getKey(String keyName, String scope, SigType type)
throws GeneralSecurityException, IOException { throws GeneralSecurityException, IOException {
@ -49,14 +53,21 @@ class DirKeyRing implements KeyRing {
CertificateFactory cf = CertificateFactory.getInstance("X.509"); CertificateFactory cf = CertificateFactory.getInstance("X.509");
X509Certificate cert = (X509Certificate)cf.generateCertificate(fis); X509Certificate cert = (X509Certificate)cf.generateCertificate(fis);
cert.checkValidity(); cert.checkValidity();
String cn = CertUtil.getSubjectValue(cert, "CN"); if (!SystemVersion.isAndroid()) {
if (!keyName.equals(cn)) // getSubjectValue() unsupported on Android.
throw new GeneralSecurityException("CN mismatch: " + cn); // Any cert problems will be caught in non-Android testing.
String cn = CertUtil.getSubjectValue(cert, "CN");
if (!keyName.equals(cn))
throw new GeneralSecurityException("CN mismatch: " + cn);
}
return cert.getPublicKey(); return cert.getPublicKey();
} finally { } finally {
try { if (fis != null) fis.close(); } catch (IOException foo) {} try { if (fis != null) fis.close(); } catch (IOException foo) {}
} }
} }
/**
* Unimplemented, unused.
*/
public void setKey(String keyName, String scope, PublicKey key) {} public void setKey(String keyName, String scope, PublicKey key) {}
} }