Attachment 1103739 Details for Bug 1074208 – jss-Added-verifyCertificate-method.patch

[patch] jss-Added-verifyCertificate-method.patch

jss-Added-verifyCertificate-method.patch (text/plain), 14.26 KB, created by Endi Sukma Dewata on 2015-12-08 23:02:16 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Endi Sukma Dewata

Created: 2015-12-08 23:02:16 UTC

Size: 14.26 KB

patch

obsolete

>From 085c357c0e7043c6168107d30f91748fe1e2f44c Mon Sep 17 00:00:00 2001
>From: "Endi S. Dewata" <edewata@redhat.com>
>Date: Wed, 2 Dec 2015 14:16:27 +0100
>Subject: [PATCH] Added verifyCertificate() method.
>
>The private verifyCertificateNowNative() has been converted into
>a public verifyCertificate() method to provide an alternative
>for isCertValid(). If there is a certificate validation problem,
>the method will throw an exception that includes the NSS error
>message and also the exception will provide a stack trace to help
>troubleshoot validation issues.
>
>https://fedorahosted.org/pki/ticket/850
>---
> mozilla/security/jss/lib/jss.def                   |   2 +-
> .../jss/org/mozilla/jss/CryptoManager.java         |  46 +++++----
> .../security/jss/org/mozilla/jss/JSSException.java |  49 +++++++++
> mozilla/security/jss/org/mozilla/jss/PK11Finder.c  | 109 +++++++++++++--------
> .../jss/org/mozilla/jss/util/jss_exceptions.h      |   4 +
> 5 files changed, 147 insertions(+), 63 deletions(-)
> create mode 100644 mozilla/security/jss/org/mozilla/jss/JSSException.java
>
>diff --git a/mozilla/security/jss/lib/jss.def b/mozilla/security/jss/lib/jss.def
>index 2bfc18df1b6a301328e229a43b2e743f9342e9ca..71d93184fcc6fa0aab23c0c22632d39cb7bff8d1 100644
>--- a/mozilla/security/jss/lib/jss.def
>+++ b/mozilla/security/jss/lib/jss.def
>@@ -331,7 +331,7 @@ Java_org_mozilla_jss_pkcs11_PK11KeyPairGenerator_generateRSAKeyPairWithOpFlags;
> Java_org_mozilla_jss_pkcs11_PK11KeyPairGenerator_generateDSAKeyPairWithOpFlags;
> Java_org_mozilla_jss_CryptoManager_OCSPCacheSettingsNative;
> Java_org_mozilla_jss_CryptoManager_setOCSPTimeoutNative;
>-Java_org_mozilla_jss_CryptoManager_verifyCertificateNowNative;
>+Java_org_mozilla_jss_CryptoManager_verifyCertificate;
> Java_org_mozilla_jss_CryptoManager_verifyCertificateNowCUNative;
> Java_org_mozilla_jss_asn1_ASN1Util_getTagDescriptionByOid;
> Java_org_mozilla_jss_ssl_SocketBase_setSSLVersionRange;
>diff --git a/mozilla/security/jss/org/mozilla/jss/CryptoManager.java b/mozilla/security/jss/org/mozilla/jss/CryptoManager.java
>index 1fd749c5ed86d7d7f768970709a27964a4e7bee8..08aad8fe3c3a62ae8e233fc1035723690adf4581 100644
>--- a/mozilla/security/jss/org/mozilla/jss/CryptoManager.java
>+++ b/mozilla/security/jss/org/mozilla/jss/CryptoManager.java
>@@ -1515,30 +1515,36 @@ public final class CryptoManager implements TokenSupplier
>             CertificateUsage certificateUsage)
>         throws ObjectNotFoundException, InvalidNicknameException
>     {
>-        if (nickname==null) {
>-            throw new InvalidNicknameException("Nickname must be non-null");
>-        }
>-        // 0 certificate usage will get current usage
>-        // should call isCertValid() call above that returns certificate usage
>-        if ((certificateUsage == null) ||
>-                (certificateUsage == CertificateUsage.CheckAllUsages)){
>-            int currCertificateUsage = 0x0000;
>-            currCertificateUsage = verifyCertificateNowCUNative(nickname,
>-                checkSig);
>+        try {
>+            verifyCertificate(nickname, checkSig, certificateUsage);
>+            return true;
> 
>-            if (currCertificateUsage == CertificateUsage.basicCertificateUsages){ 
>-                // cert is good for nothing
>-                return false;
>-            } else
>-                return true;
>-        } else {
>-            return verifyCertificateNowNative(nickname, checkSig,
>-              certificateUsage.getUsage());
>+        } catch (ObjectNotFoundException | InvalidNicknameException e) {
>+            throw e;
>+
>+        } catch (JSSException e) {
>+            return false;
>         }
>     }
> 
>-    private native boolean verifyCertificateNowNative(String nickname,
>-        boolean checkSig, int certificateUsage) throws ObjectNotFoundException;
>+    /**
>+     * Verify a certificate that exists in the given cert database,
>+     * check if it's valid and that we trust the issuer. Verify time
>+     * against now.
>+     * @param nickname nickname of the certificate to verify.
>+     * @param checkSignature verify the signature of the certificate
>+     * @param requiredUsage see certificate usage defined to verify certificate
>+     *
>+     * @exception InvalidNicknameException If the nickname is null.
>+     * @exception ObjectNotFoundException If no certificate could be found
>+     *      with the given nickname.
>+     * @exception JSSException If certificate is invalid.
>+     */
>+    public native void verifyCertificate(
>+            String nickname,
>+            boolean checkSignature,
>+            CertificateUsage requiredUsage)
>+            throws ObjectNotFoundException, InvalidNicknameException, JSSException;
> 
>     /**
>      * note: this method calls obsolete function in NSS
>diff --git a/mozilla/security/jss/org/mozilla/jss/JSSException.java b/mozilla/security/jss/org/mozilla/jss/JSSException.java
>new file mode 100644
>index 0000000000000000000000000000000000000000..780bc01a94268d8bcb38d0f04afaba8753c85b20
>--- /dev/null
>+++ b/mozilla/security/jss/org/mozilla/jss/JSSException.java
>@@ -0,0 +1,49 @@
>+/* ***** BEGIN LICENSE BLOCK *****
>+ * Version: MPL 1.1/GPL 2.0/LGPL 2.1
>+ *
>+ * The contents of this file are subject to the Mozilla Public License Version
>+ * 1.1 (the "License"); you may not use this file except in compliance with
>+ * the License. You may obtain a copy of the License at
>+ * http://www.mozilla.org/MPL/
>+ *
>+ * Software distributed under the License is distributed on an "AS IS" basis,
>+ * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
>+ * for the specific language governing rights and limitations under the
>+ * License.
>+ *
>+ * The Original Code is the Netscape Security Services for Java.
>+ *
>+ * The Initial Developer of the Original Code is
>+ * Netscape Communications Corporation.
>+ * Portions created by the Initial Developer are Copyright (C) 1998-2000
>+ * the Initial Developer. All Rights Reserved.
>+ *
>+ * Contributor(s):
>+ *
>+ * Alternatively, the contents of this file may be used under the terms of
>+ * either the GNU General Public License Version 2 or later (the "GPL"), or
>+ * the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
>+ * in which case the provisions of the GPL or the LGPL are applicable instead
>+ * of those above. If you wish to allow use of your version of this file only
>+ * under the terms of either the GPL or the LGPL, and not to allow others to
>+ * use your version of this file under the terms of the MPL, indicate your
>+ * decision by deleting the provisions above and replace them with the notice
>+ * and other provisions required by the GPL or the LGPL. If you do not delete
>+ * the provisions above, a recipient may use your version of this file under
>+ * the terms of any one of the MPL, the GPL or the LGPL.
>+ *
>+ * ***** END LICENSE BLOCK ***** */
>+package org.mozilla.jss;
>+
>+public class JSSException extends Exception {
>+
>+    private static final long serialVersionUID = 1L;
>+
>+    public JSSException(String message) {
>+        super(message);
>+    }
>+
>+    public JSSException(String message, Throwable source) {
>+        super(message, source);
>+    }
>+}
>diff --git a/mozilla/security/jss/org/mozilla/jss/PK11Finder.c b/mozilla/security/jss/org/mozilla/jss/PK11Finder.c
>index 8c7f0b4c05b58527a41cac140dbb5dc30578570f..0020c1468bdd95a7ff90c6d20c01040888ed38f4 100644
>--- a/mozilla/security/jss/org/mozilla/jss/PK11Finder.c
>+++ b/mozilla/security/jss/org/mozilla/jss/PK11Finder.c
>@@ -1582,7 +1582,7 @@ finish:
> /***********************************************************************
>  * CryptoManager.verifyCertificateNow
>  */
>-SECStatus verifyCertificateNow(JNIEnv *env, jobject self, jstring nickString,
>+void verifyCertificateNow(JNIEnv *env, jobject self, jstring nickString,
>         jboolean checkSig, jint required_certificateUsage,
>          SECCertificateUsage *currUsage)
> {
>@@ -1591,9 +1591,15 @@ SECStatus verifyCertificateNow(JNIEnv *env, jobject self, jstring nickString,
>     CERTCertificate   *cert=NULL;
>     char *nickname=NULL;
> 
>+    if (nickString == NULL) {
>+        JSS_throwMsg(env, INVALID_NICKNAME_EXCEPTION, "Missing certificate nickname");
>+        goto finish;
>+    }
>+
>     nickname = (char *) (*env)->GetStringUTFChars(env, nickString, NULL);
>-    if( nickname == NULL ) {
>-         goto finish;
>+    if (nickname == NULL) {
>+        JSS_throwMsg(env, INVALID_NICKNAME_EXCEPTION, "Missing certificate nickname");
>+        goto finish;
>     }
> 
>     certificateUsage = required_certificateUsage;
>@@ -1601,42 +1607,52 @@ SECStatus verifyCertificateNow(JNIEnv *env, jobject self, jstring nickString,
>     cert = CERT_FindCertByNickname(CERT_GetDefaultCertDB(), nickname);
> 
>     if (cert == NULL) {
>-        JSS_throw(env, OBJECT_NOT_FOUND_EXCEPTION);
>+        char *msgBuf;
>+        msgBuf = PR_smprintf("Certificate not found: %s", nickname);
>+        JSS_throwMsg(env, OBJECT_NOT_FOUND_EXCEPTION, msgBuf);
>+        PR_Free(msgBuf);
>         goto finish;
>-    } else {
>+    }
>+
>     /* 0 for certificateUsage in call to CERT_VerifyCertificateNow will
>      * retrieve the current valid usage into currUsage
>      */
>-        rv = CERT_VerifyCertificateNow(CERT_GetDefaultCertDB(), cert,
>-            checkSig, certificateUsage, NULL, currUsage );
>-        if ((rv == SECSuccess) && certificateUsage == 0x0000) {
>-            if (*currUsage == 
>-                ( certUsageUserCertImport |
>-                certUsageVerifyCA |
>-                certUsageProtectedObjectSigner |
>-                certUsageAnyCA )) {
>+    rv = CERT_VerifyCertificateNow(CERT_GetDefaultCertDB(), cert,
>+        checkSig, certificateUsage, NULL, currUsage );
> 
>-              /* the cert is good for nothing 
>-                 The folllowing usages cannot be verified:
>-                   certUsageAnyCA
>-                   certUsageProtectedObjectSigner
>-                   certUsageUserCertImport
>-                   certUsageVerifyCA
>-                    (0x0b80) */
>-                rv =SECFailure;
>-            }
>-        }
>+    if (rv != SECSuccess) {
>+        JSS_throwMsgPrErr(env, JSS_EXCEPTION, "Invalid certificate");
>+        goto finish;
>+    }
>+
>+    if ((rv == SECSuccess) &&
>+        (certificateUsage == 0x0000) &&
>+        (*currUsage ==
>+            ( certUsageUserCertImport |
>+            certUsageVerifyCA |
>+            certUsageProtectedObjectSigner |
>+            certUsageAnyCA ))) {
>+
>+        /* The certificate is good for nothing.
>+         * The following usages cannot be verified:
>+         *   certUsageAnyCA
>+         *   certUsageProtectedObjectSigner
>+         *   certUsageUserCertImport
>+         *   certUsageVerifyCA
>+         *   (0x0b80)
>+         */
>+
>+        JSS_throwMsgPrErr(env, JSS_EXCEPTION, "Unusable certificate");
>+        goto finish;
>     }
> 
> finish:
>-    if(nickname != NULL) {
>+    if (nickname != NULL) {
>       (*env)->ReleaseStringUTFChars(env, nickString, nickname);
>     }
>-    if(cert != NULL) {
>+    if (cert != NULL) {
>        CERT_DestroyCertificate(cert);
>     }
>-
>-    return rv;
> }
> 
> /***********************************************************************
>@@ -1655,34 +1671,43 @@ JNIEXPORT jint JNICALL
> Java_org_mozilla_jss_CryptoManager_verifyCertificateNowCUNative(JNIEnv *env,
>         jobject self, jstring nickString, jboolean checkSig)
> {
>-    SECStatus VARIABLE_MAY_NOT_BE_USED rv    = SECFailure;
>     SECCertificateUsage      currUsage = 0x0000;
> 
>-    rv = verifyCertificateNow(env, self, nickString, checkSig, 0, &currUsage);
>-    /* rv is ignored */
>+    verifyCertificateNow(env, self, nickString, checkSig, 0, &currUsage);
> 
>     return currUsage;
> }
> 
> /***********************************************************************
>- * CryptoManager.verifyCertificateNowNative
>+ * CryptoManager.verifyCertificate
>  *
>- * Returns JNI_TRUE if success, JNI_FALSE otherwise
>+ * Verify a certificate that exists in the given cert database,
>+ * check if it's valid and that we trust the issuer. Verify time
>+ * against now.
>+ * @param nickname nickname of the certificate to verify.
>+ * @param checkSignature verify the signature of the certificate
>+ * @param requiredUsage see certificate usage defined to verify certificate
>+ *
>+ * @exception InvalidNicknameException If the nickname is null.
>+ * @exception ObjectNotFoundException If no certificate could be found
>+ *      with the given nickname.
>+ * @exception JSSException If certificate is invalid.
>  */
>-JNIEXPORT jboolean JNICALL
>-Java_org_mozilla_jss_CryptoManager_verifyCertificateNowNative(JNIEnv *env,
>-        jobject self, jstring nickString, jboolean checkSig, jint required_certificateUsage)
>+JNIEXPORT void JNICALL
>+Java_org_mozilla_jss_CryptoManager_verifyCertificate(JNIEnv *env,
>+        jobject self, jstring nickname, jboolean checkSignature, jobject requiredUsage)
> {
>-    SECStatus         rv    = SECFailure;
>+    jclass clazz;
>+    jmethodID methodID;
>+    jint usage;
>     SECCertificateUsage      currUsage = 0x0000;
> 
>-    rv = verifyCertificateNow(env, self, nickString, checkSig, required_certificateUsage, &currUsage);
>+    /* int usage = requiredUsage.getUsage() */
>+    clazz = (*env)->FindClass(env, "org/mozilla/jss/CryptoManager$CertificateUsage");
>+    methodID = (*env)->GetMethodID(env, clazz, "getUsage", "()I");
>+    usage = (*env)->CallIntMethod(env, requiredUsage, methodID);
> 
>-    if( rv == SECSuccess) {
>-        return JNI_TRUE;
>-    } else {
>-        return JNI_FALSE;
>-    }
>+    verifyCertificateNow(env, self, nickname, checkSignature, usage, &currUsage);
> }
> 
> /***********************************************************************
>diff --git a/mozilla/security/jss/org/mozilla/jss/util/jss_exceptions.h b/mozilla/security/jss/org/mozilla/jss/util/jss_exceptions.h
>index 4884928306223ff0699a22e7da33e3d13a904d39..5034bfe353011a0ccfc63a5f308154e91c59755e 100644
>--- a/mozilla/security/jss/org/mozilla/jss/util/jss_exceptions.h
>+++ b/mozilla/security/jss/org/mozilla/jss/util/jss_exceptions.h
>@@ -79,12 +79,16 @@ PR_BEGIN_EXTERN_C
> 
> #define INTERRUPTED_IO_EXCEPTION "java/io/InterruptedIOException"
> 
>+#define INVALID_NICKNAME_EXCEPTION "org/mozilla/jss/util/InvalidNicknameException"
>+
> #define INVALID_KEY_FORMAT_EXCEPTION "org/mozilla/jss/crypto/InvalidKeyFormatException"
> 
> #define INVALID_PARAMETER_EXCEPTION "java/security/InvalidParameterException"
> 
> #define IO_EXCEPTION "java/io/IOException"
> 
>+#define JSS_EXCEPTION "org/mozilla/jss/JSSException"
>+
> #define KEY_DATABASE_EXCEPTION "org/mozilla/jss/KeyDatabaseException"
> 
> #define KEY_EXISTS_EXCEPTION "org/mozilla/jss/crypto/KeyAlreadyImportedException"
>-- 
>2.4.3
>

Actions: View | Diff

Attachments on bug 1074208: 1103739 | 1103974 | 1104028