Attachment 133137 Details for Bug 264858 – patch for allowing certificate selection via system property

Some Eclipse Foundation services are deprecated, or will be soon. Please ensure you've read this important communication.

[patch] patch for allowing certificate selection via system property

patch.txt (text/plain), 6.63 KB, created by David McKnight

on 2009-04-24 11:33:43 EDT

(hide)

Description:

Filename:

MIME Type:

Creator: David McKnight

Created: 2009-04-24 11:33:43 EDT

Size: 6.63 KB

patch

obsolete

>### Eclipse Workspace Patch 1.0
>#P org.eclipse.dstore.core
>Index: src/org/eclipse/dstore/internal/core/util/ssl/DStoreSSLContext.java
>===================================================================
>RCS file: /cvsroot/dsdp/org.eclipse.tm.rse/plugins/org.eclipse.dstore.core/src/org/eclipse/dstore/internal/core/util/ssl/DStoreSSLContext.java,v
>retrieving revision 1.5
>diff -u -r1.5 DStoreSSLContext.java
>--- src/org/eclipse/dstore/internal/core/util/ssl/DStoreSSLContext.java	21 Jan 2009 21:15:20 -0000	1.5
>+++ src/org/eclipse/dstore/internal/core/util/ssl/DStoreSSLContext.java	24 Apr 2009 15:30:41 -0000
>@@ -1,5 +1,5 @@
> /*******************************************************************************
>- * Copyright (c) 2006, 2008 IBM Corporation and others.
>+ * Copyright (c) 2006, 2009 IBM Corporation and others.
>  * All rights reserved. This program and the accompanying materials
>  * are made available under the terms of the Eclipse Public License v1.0
>  * which accompanies this distribution, and is available at
>@@ -15,6 +15,7 @@
>  * David McKnight   (IBM) - [225507][api][breaking] RSE dstore API leaks non-API types
>  * Noriaki Takatsu  (IBM) - [259905][api] Provide a facility to use its own keystore
>  * David McKnight  (IBM) - [259905][api] provide public API for getting/setting key managers for SSLContext
>+ * David McKnight  (IBM)  - [264858][dstore] OpenRSE always picks the first trusted certificate
>  *******************************************************************************/
> 
> package org.eclipse.dstore.internal.core.util.ssl;
>@@ -25,6 +26,7 @@
> import javax.net.ssl.KeyManagerFactory;
> import javax.net.ssl.SSLContext;
> import javax.net.ssl.TrustManager;
>+import javax.net.ssl.X509KeyManager;
> 
> import org.eclipse.dstore.core.util.ssl.BaseSSLContext;
> import org.eclipse.dstore.core.util.ssl.DStoreKeyStore;
>@@ -46,10 +48,27 @@
> 				KeyStore ks = DStoreKeyStore.getKeyStore(filePath, password);
> 				String keymgrAlgorithm = KeyManagerFactory.getDefaultAlgorithm();
> 				KeyManagerFactory kmf = KeyManagerFactory.getInstance(keymgrAlgorithm);
>-				kmf.init(ks, password.toCharArray());				
>-
>+				kmf.init(ks, password.toCharArray());								
>+	
> 				serverContext = SSLContext.getInstance("SSL"); //$NON-NLS-1$
>-				serverContext.init(kmf.getKeyManagers(), null, null);
>+				
>+				keyManagers = kmf.getKeyManagers();
>+				
>+				// read optional system property that indicates a default certificate alias
>+				String defaultAlias = System.getProperty("DSTORE_DEFAULT_CERTIFICATE_ALIAS"); //$NON-NLS-1$
>+				if (defaultAlias != null){
>+					KeyManager[] x509KeyManagers = new X509KeyManager[10];
>+				
>+					for(int i=0;i<keyManagers.length; i++){
>+						if(keyManagers[i] instanceof X509KeyManager){						
>+							x509KeyManagers[i] = new DStoreKeyManager((X509KeyManager)keyManagers[i], defaultAlias);
>+						}
>+					}								
>+					serverContext.init(x509KeyManagers, null, null);
>+				}
>+				else {
>+					serverContext.init(keyManagers, null, null);
>+				}
> 			}
> 			else
> 			{
>Index: src/org/eclipse/dstore/internal/core/util/ssl/DataStoreTrustManager.java
>===================================================================
>RCS file: /cvsroot/dsdp/org.eclipse.tm.rse/plugins/org.eclipse.dstore.core/src/org/eclipse/dstore/internal/core/util/ssl/DataStoreTrustManager.java,v
>retrieving revision 1.3
>diff -u -r1.3 DataStoreTrustManager.java
>--- src/org/eclipse/dstore/internal/core/util/ssl/DataStoreTrustManager.java	3 Apr 2008 14:05:47 -0000	1.3
>+++ src/org/eclipse/dstore/internal/core/util/ssl/DataStoreTrustManager.java	24 Apr 2009 15:30:41 -0000
>@@ -111,8 +111,10 @@
> 					X509Certificate tcert = (X509Certificate)_trustedCerts.get(j);
> 					try
> 					{
>-						cert.verify(tcert.getPublicKey());
>-						foundMatch = true;
>+						if (cert.getSubjectDN().equals(tcert.getIssuerDN())) {
>+							cert.verify(tcert.getPublicKey());
>+							foundMatch = true;
>+						}
> 					}
> 					catch (Exception e)
> 					{		
>Index: src/org/eclipse/dstore/internal/core/util/ssl/DStoreKeyManager.java
>===================================================================
>RCS file: src/org/eclipse/dstore/internal/core/util/ssl/DStoreKeyManager.java
>diff -N src/org/eclipse/dstore/internal/core/util/ssl/DStoreKeyManager.java
>--- /dev/null	1 Jan 1970 00:00:00 -0000
>+++ src/org/eclipse/dstore/internal/core/util/ssl/DStoreKeyManager.java	1 Jan 1970 00:00:00 -0000
>@@ -0,0 +1,69 @@
>+/********************************************************************************
>+ * Copyright (c) 2009 IBM Corporation. All rights reserved.
>+ * This program and the accompanying materials are made available under the terms
>+ * of the Eclipse Public License v1.0 which accompanies this distribution, and is 
>+ * available at http://www.eclipse.org/legal/epl-v10.html
>+ * 
>+ * Initial Contributors:
>+ * The following IBM employees contributed to the Remote System Explorer
>+ * component that contains this file: David McKnight.
>+ * 
>+ * Contributors:
>+ * David McKnight  (IBM)  - [264858][dstore] OpenRSE always picks the first trusted certificate
>+ ********************************************************************************/
>+package org.eclipse.dstore.internal.core.util.ssl;
>+
>+import java.net.Socket;
>+import java.security.Principal;
>+import java.security.PrivateKey;
>+import java.security.cert.X509Certificate;
>+
>+import javax.net.ssl.X509KeyManager;
>+
>+public class DStoreKeyManager implements X509KeyManager {
>+	
>+	private X509KeyManager _keyManager;
>+	private String _defaultAlias;
>+	
>+	public DStoreKeyManager(X509KeyManager keyManager, String defaultAlias){
>+		_keyManager = keyManager;
>+		_defaultAlias = defaultAlias;
>+	}
>+	
>+	public String chooseClientAlias(String[] keyType, Principal[] issuers,
>+			Socket socket) {
>+		if (_defaultAlias != null){
>+			return _defaultAlias;
>+		}
>+		else {
>+			return _keyManager.chooseClientAlias(keyType, issuers, socket);
>+		}
>+	}
>+
>+	public String chooseServerAlias(String keyType, Principal[] issuers,
>+			Socket socket) {
>+		if (_defaultAlias != null){
>+			return _defaultAlias;
>+		}
>+		else {
>+			return _keyManager.chooseServerAlias(keyType, issuers, socket);
>+		}
>+	}
>+
>+	public X509Certificate[] getCertificateChain(String alias) {
>+		return _keyManager.getCertificateChain(alias);
>+	}
>+
>+	public String[] getClientAliases(String keyType, Principal[] issuers) {
>+		return _keyManager.getClientAliases(keyType, issuers);
>+	}
>+
>+	public PrivateKey getPrivateKey(String alias) {
>+		return _keyManager.getPrivateKey(alias);
>+	}
>+
>+	public String[] getServerAliases(String keyType, Principal[] issuers) {
>+		return _keyManager.getServerAliases(keyType, issuers);
>+	}
>+
>+}

Actions: View | Diff

Attachments on bug 264858: 133137