From 2dddf4033e5e38d37344c6793976075035b9e9fc Mon Sep 17 00:00:00 2001 From: Xue-Lei Andrew Fan Date: Wed, 2 Apr 2008 22:44:45 -0400 Subject: [PATCH] 6668231: Presence of a critical subjectAltName causes JSSE's SunX509 to fail trusted checks Make the critical extension known to end entity checker. Reviewed-by: wetmore, mullan --- .../security/validator/EndEntityChecker.java | 10 + .../CriticalSubjectAltName.java | 262 ++++++++++++++++++ .../https/HttpsURLConnection/crisubn.jks | Bin 0 -> 2794 bytes .../https/HttpsURLConnection/trusted.jks | Bin 0 -> 743 bytes 4 files changed, 272 insertions(+) create mode 100644 jdk/test/sun/security/ssl/com/sun/net/ssl/internal/www/protocol/https/HttpsURLConnection/CriticalSubjectAltName.java create mode 100644 jdk/test/sun/security/ssl/com/sun/net/ssl/internal/www/protocol/https/HttpsURLConnection/crisubn.jks create mode 100644 jdk/test/sun/security/ssl/com/sun/net/ssl/internal/www/protocol/https/HttpsURLConnection/trusted.jks diff --git a/jdk/src/share/classes/sun/security/validator/EndEntityChecker.java b/jdk/src/share/classes/sun/security/validator/EndEntityChecker.java index f0fb1787fa3..189db3dd058 100644 --- a/jdk/src/share/classes/sun/security/validator/EndEntityChecker.java +++ b/jdk/src/share/classes/sun/security/validator/EndEntityChecker.java @@ -87,6 +87,9 @@ class EndEntityChecker { // the Microsoft Server-Gated-Cryptography EKU extension OID private final static String OID_EKU_MS_SGC = "1.3.6.1.4.1.311.10.3.3"; + // the recognized extension OIDs + private final static String OID_SUBJECT_ALT_NAME = "2.5.29.17"; + private final static String NSCT_SSL_CLIENT = NetscapeCertTypeExtension.SSL_CLIENT; @@ -171,6 +174,13 @@ class EndEntityChecker { throws CertificateException { // basic constraints irrelevant in EE certs exts.remove(SimpleValidator.OID_BASIC_CONSTRAINTS); + + // If the subject field contains an empty sequence, the subjectAltName + // extension MUST be marked critical. + // We do not check the validity of the critical extension, just mark + // it recognizable here. + exts.remove(OID_SUBJECT_ALT_NAME); + if (!exts.isEmpty()) { throw new CertificateException("Certificate contains unsupported " + "critical extensions: " + exts); diff --git a/jdk/test/sun/security/ssl/com/sun/net/ssl/internal/www/protocol/https/HttpsURLConnection/CriticalSubjectAltName.java b/jdk/test/sun/security/ssl/com/sun/net/ssl/internal/www/protocol/https/HttpsURLConnection/CriticalSubjectAltName.java new file mode 100644 index 00000000000..ffd70754168 --- /dev/null +++ b/jdk/test/sun/security/ssl/com/sun/net/ssl/internal/www/protocol/https/HttpsURLConnection/CriticalSubjectAltName.java @@ -0,0 +1,262 @@ +/* + * Copyright 2001-2008 Sun Microsystems, Inc. All Rights Reserved. + * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. + * + * This code is free software; you can redistribute it and/or modify it + * under the terms of the GNU General Public License version 2 only, as + * published by the Free Software Foundation. + * + * This code is distributed in the hope that it will be useful, but WITHOUT + * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or + * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License + * version 2 for more details (a copy is included in the LICENSE file that + * accompanied this code). + * + * You should have received a copy of the GNU General Public License version + * 2 along with this work; if not, write to the Free Software Foundation, + * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA. + * + * Please contact Sun Microsystems, Inc., 4150 Network Circle, Santa Clara, + * CA 95054 USA or visit www.sun.com if you need additional information or + * have any questions. + */ + +/* + * @test + * @bug 6668231 + * @summary Presence of a critical subjectAltName causes JSSE's SunX509 to + * fail trusted checks + * @author Xuelei Fan + * + * This test depends on binary keystore, crisubn.jks and trusted.jks. Because + * JAVA keytool cannot generate X509 certificate with SubjectAltName extension, + * the certificates are generated with openssl toolkits and then imported into + * JAVA keystore. + * + * The crisubn.jks holds a private key entry and the corresponding X509 + * certificate issued with an empty Subject field, and a critical + * SubjectAltName extension. + * + * The trusted.jks holds the trusted certificate. + */ +import java.io.*; +import java.net.*; +import javax.net.ssl.*; +import java.security.cert.Certificate; + +public class CriticalSubjectAltName implements HostnameVerifier { + /* + * ============================================================= + * Set the various variables needed for the tests, then + * specify what tests to run on each side. + */ + + /* + * Should we run the client or server in a separate thread? + * Both sides can throw exceptions, but do you have a preference + * as to which side should be the main thread. + */ + static boolean separateServerThread = true; + + /* + * Where do we find the keystores? + */ + static String pathToStores = "./"; + static String keyStoreFile = "crisubn.jks"; + static String trustStoreFile = "trusted.jks"; + static String passwd = "passphrase"; + + /* + * Is the server ready to serve? + */ + volatile static boolean serverReady = false; + + /* + * Turn on SSL debugging? + */ + static boolean debug = false; + + /* + * If the client or server is doing some kind of object creation + * that the other side depends on, and that thread prematurely + * exits, you may experience a hang. The test harness will + * terminate all hung threads after its timeout has expired, + * currently 3 minutes by default, but you might try to be + * smart about it.... + */ + + /* + * Define the server side of the test. + * + * If the server prematurely exits, serverReady will be set to true + * to avoid infinite hangs. + */ + void doServerSide() throws Exception { + SSLServerSocketFactory sslssf = + (SSLServerSocketFactory) SSLServerSocketFactory.getDefault(); + SSLServerSocket sslServerSocket = + (SSLServerSocket) sslssf.createServerSocket(serverPort); + serverPort = sslServerSocket.getLocalPort(); + + /* + * Signal Client, we're ready for his connect. + */ + serverReady = true; + + SSLSocket sslSocket = (SSLSocket) sslServerSocket.accept(); + OutputStream sslOS = sslSocket.getOutputStream(); + BufferedWriter bw = new BufferedWriter(new OutputStreamWriter(sslOS)); + bw.write("HTTP/1.1 200 OK\r\n\r\n\r\n"); + bw.flush(); + Thread.sleep(5000); + sslSocket.close(); + } + + /* + * Define the client side of the test. + * + * If the server prematurely exits, serverReady will be set to true + * to avoid infinite hangs. + */ + void doClientSide() throws Exception { + + /* + * Wait for server to get started. + */ + while (!serverReady) { + Thread.sleep(50); + } + + URL url = new URL("https://localhost:"+serverPort+"/index.html"); + HttpsURLConnection urlc = (HttpsURLConnection)url.openConnection(); + urlc.setHostnameVerifier(this); + urlc.getInputStream(); + + if (urlc.getResponseCode() == -1) { + throw new RuntimeException("getResponseCode() returns -1"); + } + } + + /* + * ============================================================= + * The remainder is just support stuff + */ + + // use any free port by default + volatile int serverPort = 0; + + volatile Exception serverException = null; + volatile Exception clientException = null; + + public static void main(String[] args) throws Exception { + String keyFilename = + System.getProperty("test.src", "./") + "/" + pathToStores + + "/" + keyStoreFile; + String trustFilename = + System.getProperty("test.src", "./") + "/" + pathToStores + + "/" + trustStoreFile; + + System.setProperty("javax.net.ssl.keyStore", keyFilename); + System.setProperty("javax.net.ssl.keyStorePassword", passwd); + System.setProperty("javax.net.ssl.trustStore", trustFilename); + System.setProperty("javax.net.ssl.trustStorePassword", passwd); + + if (debug) + System.setProperty("javax.net.debug", "all"); + + /* + * Start the tests. + */ + new CriticalSubjectAltName(); + } + + Thread clientThread = null; + Thread serverThread = null; + + /* + * Primary constructor, used to drive remainder of the test. + * + * Fork off the other side, then do your work. + */ + CriticalSubjectAltName() throws Exception { + if (separateServerThread) { + startServer(true); + startClient(false); + } else { + startClient(true); + startServer(false); + } + + /* + * Wait for other side to close down. + */ + if (separateServerThread) { + serverThread.join(); + } else { + clientThread.join(); + } + + /* + * When we get here, the test is pretty much over. + * + * If the main thread excepted, that propagates back + * immediately. If the other thread threw an exception, we + * should report back. + */ + if (serverException != null) + throw serverException; + if (clientException != null) + throw clientException; + } + + void startServer(boolean newThread) throws Exception { + if (newThread) { + serverThread = new Thread() { + public void run() { + try { + doServerSide(); + } catch (Exception e) { + /* + * Our server thread just died. + * + * Release the client, if not active already... + */ + System.err.println("Server died..."); + serverReady = true; + serverException = e; + } + } + }; + serverThread.start(); + } else { + doServerSide(); + } + } + + void startClient(boolean newThread) throws Exception { + if (newThread) { + clientThread = new Thread() { + public void run() { + try { + doClientSide(); + } catch (Exception e) { + /* + * Our client thread just died. + */ + System.err.println("Client died..."); + clientException = e; + } + } + }; + clientThread.start(); + } else { + doClientSide(); + } + } + + // Simple test method to blindly agree that hostname and certname match + public boolean verify(String hostname, SSLSession session) { + return true; + } + +} diff --git a/jdk/test/sun/security/ssl/com/sun/net/ssl/internal/www/protocol/https/HttpsURLConnection/crisubn.jks b/jdk/test/sun/security/ssl/com/sun/net/ssl/internal/www/protocol/https/HttpsURLConnection/crisubn.jks new file mode 100644 index 0000000000000000000000000000000000000000..aee7d9f33792257b9c20599e198cb52e84e44303 GIT binary patch literal 2794 zcmeH}SyYqP7RSFY6DE)XhOvxArPHh)P2vH9D zK;l9Yq$IAGXgZ{+jE9Jji3vm`l1L=;Gs<{lGDI>q-!h#BW)lGl!H9!u?Px6@Yhc~z+0d)cWb1FHUdDD>v?R^y?> ze;zQg?ISZkOBt5BW<$wvqqyX$uf?nGwdz}{NU{MD?FGj2`myVMwKfS;+ss$_MmD;w znMZ>y&~qET-j`mGs#dbs-}Ha7_e|)mwZnTW8XIoBj3gleg@%wIxbtoaVHqId z+6AP?j|?jEo48OgjZNiWISS;RQ>?|Na%-rb>IXjx<5D{vkyM$F@sYUvGY?Z6rR(mn zN|aB_H~87VS!JloHElFlCGD-XGOQKk(GHxCw6wU&J=IVqLaF!Q<``QAshTBX_(7-Lwc^apJww79s*vsUTR{Wc2v zs{~p+6u0+cj|ci#)v3gxZf8&d?1&%J&u;jpZPjqKOQ+sr)a}{NMHj|`oog@vuE%;L zzfBd#&%%e(%tZ&`T^q;UyAZ8e?emoB$ka3V}*sKIu{;ZQX}67x>9%gS2ICp zH4R#hU<coWLbNTG*;N`cF;Q1{pad6})&{!wmOG3)S`#{9htC(V|1 za@LE&yR|~!tXGpSk0h}|+8iRJi6fTnsW&ZB9=u+2Y@OIwl;x$r@V$uBS9DzCIC~z| zA_fC5a7$Dc^MC1F&ahpXz{TC*d>pQ{R{1D`hu0nb)><)BVQAtGeUCPF+~<|k>MT*C zJH_F(XBW>SQg`xiFSnPxXP<8(D-Ecm>xbeTB3{%b&iHmcwd`e$LW8=G<9=@1Dzixr z<~~`Ty_~1@omDnZn5O@{`|yC(%#bI?&Y+Iuap|^Ywi^glU{~foY{8RD@z;GK& z+H77z_Loja>6F-y&16PB=8XY`3#zFJV))&BV!ms zyXOY84a^7Kwi{GCr4OU5W%m0KVrRA|?MymFD;?wZsZNuHSM+R&x$?Arm{v&A@rPUBjQ^^MfqYD8a`49%{ zpJfkby|D)IC@m!omsonVyStON9X*=PfIq7sZ5uj+85SHC2pjJ(SfRt{{JhKdhPPb( z;XbzT&<{^m1|hBA7_0&*{W*gnJ;??bH9IJE=tCBPo*WPr8%ei{fs=*@MHofXnK?)U z~3aEn!4n;G(ciyuP8 zsznt3Yrrlj+@A9!>zTzOU2`Ay>1Isn-M8#9$aki`XFzP+SZ}^DJgOMiLwn|ZS6^-! zm=EZW)_Y6+R?Z~7y1XSz+>s&@j-Aw%zQY}b{u%-P8Ug-mK>L3f0WuHHo!wu+LAs>S O7Sr#R-7eCxQu+@^S{GCR literal 0 HcmV?d00001 diff --git a/jdk/test/sun/security/ssl/com/sun/net/ssl/internal/www/protocol/https/HttpsURLConnection/trusted.jks b/jdk/test/sun/security/ssl/com/sun/net/ssl/internal/www/protocol/https/HttpsURLConnection/trusted.jks new file mode 100644 index 0000000000000000000000000000000000000000..0202bec16205771e8143c9bb2ca5d13d015dc6bf GIT binary patch literal 743 zcmezO_TO6u1_mY|W(3nLiSfyaK#n8_!;~outPy&q29`kiRR&E=%Yc}F0W%XL6B8qY z0WTY;R+~rLcV0$D7FGrWcSCLiPB!LH7B*p~&|pJh13?gnLzpW#KQ~o3xFoS8)lkrY zA0)^n%mETq@GnX?6foce2{8+^gM{+)QVrz9c?}E=jExNp4NXi;%%jA4jVugIjLe~2 z>RHq{AK4F#tPISJy$lA8olK3531z*mub}oJLyX0e!p0moXR{Jz7)>q%pMNfZZviL*$mme1+g`zUHSEQ_D zVrFDuT->C)WBL^Wc888FGF0sD&`eo6LTbCN7g*I7loNv$2 z)gZc>vuf!o>o6H@#muGF2fdlCd0csOxO$?_RBhqju)A@Zc(~x^c#j{SiX;WLe&6g+ zF0|S~clG|RP|b-sHdYIk25z4Hl||+>*Q=smy;U`LzW