X-Git-Url: https://code.wpia.club/?a=blobdiff_plain;f=src%2Forg%2Fcacert%2Fgigi%2Fping%2FSSLPinger.java;h=7db5a6b16786a066cb4f3427990a2477b111c7ed;hb=c9ed09f0007fc2c813815be927a5a24b23dab83c;hp=5ad0d185d62414c3ccb2a86ed4ae8bb14f1bfcd5;hpb=080cf96c4b762dc2be5978492f247a92f9c22639;p=gigi.git

diff --git a/src/org/cacert/gigi/ping/SSLPinger.java b/src/org/cacert/gigi/ping/SSLPinger.java
index 5ad0d185..7db5a6b1 100644
--- a/src/org/cacert/gigi/ping/SSLPinger.java
+++ b/src/org/cacert/gigi/ping/SSLPinger.java
@@ -8,10 +8,10 @@ import java.net.InetSocketAddress;
 import java.net.Socket;
 import java.nio.ByteBuffer;
 import java.nio.channels.SocketChannel;
+import java.security.GeneralSecurityException;
 import java.security.KeyManagementException;
 import java.security.KeyStore;
 import java.security.KeyStoreException;
-import java.security.NoSuchAlgorithmException;
 import java.security.SecureRandom;
 import java.util.Arrays;
 
@@ -23,15 +23,24 @@ import javax.net.ssl.SSLEngineResult.HandshakeStatus;
 import javax.net.ssl.SSLEngineResult.Status;
 import javax.net.ssl.SSLException;
 import javax.net.ssl.SSLParameters;
+import javax.net.ssl.TrustManager;
 import javax.net.ssl.TrustManagerFactory;
+import javax.net.ssl.X509TrustManager;
+import javax.security.cert.CertificateException;
 import javax.security.cert.X509Certificate;
 
+import org.cacert.gigi.dbObjects.CACertificate;
 import org.cacert.gigi.dbObjects.Certificate;
+import org.cacert.gigi.dbObjects.CertificateOwner;
 import org.cacert.gigi.dbObjects.Domain;
-import org.cacert.gigi.dbObjects.User;
+
+import sun.security.x509.AVA;
+import sun.security.x509.X500Name;
 
 public class SSLPinger extends DomainPinger {
 
+    private static final String OID_EKU_serverAuth = "1.3.6.1.5.5.7.3.1";
+
     public static final String[] TYPES = new String[] {
             "xmpp", "server-xmpp", "smtp", "imap"
     };
@@ -43,13 +52,13 @@ public class SSLPinger extends DomainPinger {
     }
 
     @Override
-    public String ping(Domain domain, String configuration, User u) {
+    public void ping(Domain domain, String configuration, CertificateOwner u, int confId) {
         try (SocketChannel sch = SocketChannel.open()) {
             sch.socket().setSoTimeout(5000);
-            String[] parts = configuration.split(":", 2);
-            sch.socket().connect(new InetSocketAddress(domain.getSuffix(), Integer.parseInt(parts[0])), 5000);
-            if (parts.length == 2) {
-                switch (parts[1]) {
+            String[] parts = configuration.split(":", 4);
+            sch.socket().connect(new InetSocketAddress(domain.getSuffix(), Integer.parseInt(parts[2])), 5000);
+            if (parts.length == 4) {
+                switch (parts[3]) {
                 case "xmpp":
                     startXMPP(sch, false, domain.getSuffix());
                     break;
@@ -65,9 +74,14 @@ public class SSLPinger extends DomainPinger {
 
                 }
             }
-            return test(sch, domain.getSuffix(), u);
+            String key = parts[0];
+            String value = parts[1];
+            String res = test(sch, domain.getSuffix(), u, value);
+            enterPingResult(confId, res, res, null);
+            return;
         } catch (IOException e) {
-            return "Connecton failed";
+            enterPingResult(confId, "error", "connection Failed", null);
+            return;
         }
 
     }
@@ -146,14 +160,35 @@ public class SSLPinger extends DomainPinger {
         }
     }
 
-    private String test(SocketChannel sch, String domain, User subject) {
+    private String test(SocketChannel sch, String domain, CertificateOwner subject, String tok) {
+        System.out.println("SSL- connecting");
+
         try {
             sch.socket().setSoTimeout(5000);
             SSLContext sc = SSLContext.getInstance("SSL");
             try {
                 TrustManagerFactory tmf = TrustManagerFactory.getInstance("X509");
                 tmf.init(truststore);
-                sc.init(null, tmf.getTrustManagers(), new SecureRandom());
+                sc.init(null, new TrustManager[] {
+                        new X509TrustManager() {
+
+                            @Override
+                            public java.security.cert.X509Certificate[] getAcceptedIssuers() {
+                                return null;
+                            }
+
+                            @Override
+                            public void checkServerTrusted(java.security.cert.X509Certificate[] chain, String authType) throws java.security.cert.CertificateException {
+                                java.security.cert.X509Certificate c = chain[0];
+                                if (c.getExtendedKeyUsage() == null || !c.getExtendedKeyUsage().contains(OID_EKU_serverAuth)) {
+                                    throw new java.security.cert.CertificateException("Extended Key Usage for SSL Server Authentication missing");
+                                }
+                            }
+
+                            @Override
+                            public void checkClientTrusted(java.security.cert.X509Certificate[] chain, String authType) throws java.security.cert.CertificateException {}
+                        }
+                }, new SecureRandom());
             } catch (KeyManagementException e) {
                 e.printStackTrace();
             } catch (KeyStoreException e) {
@@ -205,17 +240,41 @@ public class SSLPinger extends DomainPinger {
                 }
 
             }
+            System.out.println("SSL- connected");
             X509Certificate[] peerCertificateChain = se.getSession().getPeerCertificateChain();
             X509Certificate first = peerCertificateChain[0];
+            if (first.getIssuerDN().equals(first.getSubjectDN())) {
+                first.verify(first.getPublicKey());
+                X500Name p = (X500Name) first.getSubjectDN();
+                X500Name n = new X500Name(p.getEncoded());
+                for (AVA i : n.allAvas()) {
+                    if (i.getObjectIdentifier().equals((Object) X500Name.orgUnitName_oid)) {
+                        String toke = i.getDerValue().getAsString();
+                        if (tok.equals(toke)) {
+                            return PING_SUCCEDED;
+                        } else {
+                            return "Self-signed certificate is wrong";
+                        }
+                    }
+                }
+            }
 
             BigInteger serial = first.getSerialNumber();
             Certificate c = Certificate.getBySerial(serial.toString(16));
+            if (c == null) {
+                return "Certificate not found: Serial " + serial.toString(16) + " missing.";
+            }
+            CACertificate p = c.getParent();
+            if ( !first.getIssuerDN().equals(p.getCertificate().getSubjectDN())) {
+                return "Broken certificate supplied";
+            }
+            first.verify(p.getCertificate().getPublicKey());
             if (c.getOwner().getId() != subject.getId()) {
                 return "Owner mismatch";
             }
             return PING_SUCCEDED;
-        } catch (NoSuchAlgorithmException e) {
-            // e.printStackTrace(); TODO log for user debugging?
+        } catch (GeneralSecurityException e) {
+            // e.printStackTrace();
             return "Security failed";
         } catch (SSLException e) {
             // e.printStackTrace(); TODO log for user debugging?
@@ -223,6 +282,9 @@ public class SSLPinger extends DomainPinger {
         } catch (IOException e) {
             // e.printStackTrace(); TODO log for user debugging?
             return "Connection closed";
+        } catch (CertificateException e) {
+            // e.printStackTrace();
+            return "Security failed";
         }
     }
 }