Merge pull request #985 from AdoptOpenJDK/missing_root_cert_check

Handle missing root ca in signing cert chain

Author: sclassen

core/src/main/java/net/adoptopenjdk/icedteaweb/client/parts/dialogs/security/CertsInfoPane.java

@@ -69,8 +69,10 @@
 import java.lang.reflect.Method;
 import java.security.MessageDigest;
 import java.security.cert.CertPath;
+import java.security.cert.Certificate;
 import java.security.cert.X509Certificate;
 import java.util.ArrayList;
+import java.util.List;
 
 import static net.adoptopenjdk.icedteaweb.i18n.Translator.R;
 
@@ -108,37 +110,44 @@ public CertsInfoPane(SecurityDialog x, CertVerifier certVerifier) {
      * Builds the JTree out of CertPaths.
      */
     void buildTree() {
+        LOG.debug("CertsInfoPanel Build Tree");
+
         certPath = parent.getCertVerifier().getCertPath();
-        X509Certificate firstCert =
-                        ((X509Certificate) certPath.getCertificates().get(0));
-        String subjectString =
-                        SecurityUtil.getCN(firstCert.getSubjectX500Principal().getName());
-        String issuerString =
-                        SecurityUtil.getCN(firstCert.getIssuerX500Principal().getName());
-
-        DefaultMutableTreeNode top =
-                        new DefaultMutableTreeNode(subjectString
-                                + " (" + issuerString + ")");
-
-        //not self signed
-        if (!firstCert.getSubjectDN().equals(firstCert.getIssuerDN())
-                        && (certPath.getCertificates().size() > 1)) {
-            X509Certificate secondCert =
-                                ((X509Certificate) certPath.getCertificates().get(1));
-            subjectString =
-                                SecurityUtil.getCN(secondCert.getSubjectX500Principal().getName());
-            issuerString =
-                                SecurityUtil.getCN(secondCert.getIssuerX500Principal().getName());
-            top.add(new DefaultMutableTreeNode(subjectString
-                                + " (" + issuerString + ")"));
+        List<? extends Certificate> certificates = certPath.getCertificates();
+
+        if (certificates.isEmpty()) {
+            LOG.warn("No certificates found in the certificate path.");
+            return;
+        }
+
+        DefaultMutableTreeNode top = createNode((X509Certificate) certificates.get(0));
+        LOG.debug("First cert: " + top.toString() + " | Num Certs: " + certificates.size());
+
+        DefaultMutableTreeNode currentParent = top;
+        for (int i = 1; i < certificates.size(); i++) {
+            X509Certificate cert = (X509Certificate) certificates.get(i);
+            X509Certificate prevCert = (X509Certificate) certificates.get(i - 1);
+
+
+            DefaultMutableTreeNode child = createNode(cert);
+            currentParent.add(child);
+            currentParent = child;
+
+            LOG.debug("Cert level " + (i + 1) + ": " + child.toString());
+            if (cert.getSubjectDN().equals(cert.getIssuerDN())) break; // Self-signed
         }
 
         tree = new JTree(top);
-        tree.getSelectionModel().setSelectionMode
-                                (TreeSelectionModel.SINGLE_TREE_SELECTION);
+        tree.getSelectionModel().setSelectionMode(TreeSelectionModel.SINGLE_TREE_SELECTION);
         tree.addTreeSelectionListener(new TreeSelectionHandler());
     }
 
+    private DefaultMutableTreeNode createNode(X509Certificate cert) {
+        String subject = SecurityUtil.getCN(cert.getSubjectX500Principal().getName());
+        String issuer = SecurityUtil.getCN(cert.getIssuerX500Principal().getName());
+        return new DefaultMutableTreeNode(subject + " (" + issuer + ")");
+    }
+
     /**
      * Fills in certsNames, certsData with data from the certificates.
      */

core/src/main/java/net/sourceforge/jnlp/tools/JarCertVerifier.java

@@ -46,10 +46,17 @@
 import java.io.InputStream;
 import java.lang.reflect.Method;
 import java.security.CodeSigner;
+import java.security.InvalidAlgorithmParameterException;
 import java.security.KeyStore;
+import java.security.KeyStoreException;
+import java.security.NoSuchAlgorithmException;
 import java.security.Timestamp;
 import java.security.cert.CertPath;
+import java.security.cert.CertPathValidator;
+import java.security.cert.CertPathValidatorException;
 import java.security.cert.Certificate;
+import java.security.cert.PKIXParameters;
+import java.security.cert.TrustAnchor;
 import java.security.cert.X509Certificate;
 import java.time.ZoneId;
 import java.time.ZonedDateTime;
@@ -58,9 +65,11 @@
 import java.util.Date;
 import java.util.Enumeration;
 import java.util.HashMap;
+import java.util.HashSet;
 import java.util.List;
 import java.util.Map;
 import java.util.Optional;
+import java.util.Set;
 import java.util.jar.JarEntry;
 import java.util.regex.Pattern;
 import java.util.zip.ZipException;
@@ -399,7 +408,7 @@ VerifyResult verifyJarEntryCerts(final String jarPath, final boolean jarHasManif
                         }
                         if (now.isAfter(tsaNotAfter) && now.isAfter(notAfter)) {
                             certInfo.setHasExpiredCert();
-                        }  else if (expiresSoon.isAfter(tsaNotAfter)) {
+                        } else if (expiresSoon.isAfter(tsaNotAfter)) {
                             certInfo.setHasExpiringCert();
                         }
 
@@ -455,6 +464,14 @@ private boolean isTrustedTsa(CertPath certPath) {
                 }
             }
         }
+        for (final KeyStore caKeyStore : caKeyStores) {
+            try {
+                validateCertpathWhenRootCANotInChain(certPath, caKeyStore);
+                return true;
+            } catch (Exception ignore) {
+            }
+        }
+        LOG.warn("Unable to validate root ca cert in TSA certpath.");
         return false;
     }
 
@@ -500,6 +517,15 @@ private void checkTrustedCerts(final CertPath certPath) {
                     }
                 }
             }
+
+            for (final KeyStore caKeyStore : caKeyStores) {
+                try {
+                    validateCertpathWhenRootCANotInChain(certPath, caKeyStore);
+                    info.setRootInCacerts();
+                    return;
+                } catch (Exception ignore) {
+                }
+            }
         } catch (Exception e) {
             // TODO: Warn user about not being able to
             // look through their cacerts/trusted.certs
@@ -509,9 +535,30 @@ private void checkTrustedCerts(final CertPath certPath) {
         }
 
         // Otherwise a parent cert was not found to be trusted.
+        LOG.warn("Unable to validate root ca cert.");
         info.setUntrusted();
     }
 
+    private static void validateCertpathWhenRootCANotInChain(CertPath certPath, KeyStore caKeyStore) throws KeyStoreException, InvalidAlgorithmParameterException, NoSuchAlgorithmException, CertPathValidatorException {
+        final Set<TrustAnchor> anchors = new HashSet<>();
+
+        for (Enumeration<String> e = caKeyStore.aliases(); e.hasMoreElements(); ) {
+            final String alias = e.nextElement();
+            final Certificate c = caKeyStore.getCertificate(alias);
+            if (c instanceof X509Certificate) {
+                X509Certificate xc = (X509Certificate) c;
+                anchors.add(new TrustAnchor(xc, null));
+            }
+        }
+
+        final PKIXParameters params = new PKIXParameters(anchors);
+        params.setRevocationEnabled(false); // disable CRL/OCSP for this presence/anchoring check
+
+
+        final CertPathValidator validator = CertPathValidator.getInstance("PKIX");
+        validator.validate(certPath, params);
+    }
+
     public void setCurrentlyUsedCertPath(final CertPath certPath) {
         currentlyUsed = certPath;
     }
@@ -561,11 +608,11 @@ static boolean isMetaInfFile(final String name) {
         }
         return name.startsWith(META_INF) && (
                 name.endsWith(".MF") ||
-                name.endsWith(".SF") ||
-                name.endsWith(".DSA") ||
-                name.endsWith(".RSA") ||
-                name.endsWith(".EC") ||
-                SIG.matcher(name).matches()
+                        name.endsWith(".SF") ||
+                        name.endsWith(".DSA") ||
+                        name.endsWith(".RSA") ||
+                        name.endsWith(".EC") ||
+                        SIG.matcher(name).matches()
         );
     }