Package net.sourceforge.jnlp.tools

Class JarCertVerifier

  • All Implemented Interfaces:
    CertVerifier
    public class JarCertVerifier
extends java.lang.Object
implements CertVerifier
    The jar certificate verifier utility.

    • Field Summary

      Fields 
      Modifier and Type Field Description
      private AppVerifier appVerifier
      The application verifier to use by this instance
      private java.util.Map<java.security.cert.CertPath,​CertInformation> certs
      The certificates used for jar verification linked to their respective information
      private java.security.cert.CertPath currentlyUsed
      Temporary cert path hack to be used to keep track of which one a UI dialog is using
      private java.util.Map<java.lang.String,​java.lang.Integer> jarSignableEntries
      Absolute location to jars and the number of entries which are possibly signable
      private static Logger LOG  
      private static java.lang.String META_INF  
      private static java.util.regex.Pattern SIG  
      private java.util.List<java.lang.String> unverifiedJars
      All of the jar files that were not verified
      private java.util.List<java.lang.String> verifiedJars
      All of the jar files that were verified for signing

    • Constructor Summary

      Constructors 
      Constructor Description
      JarCertVerifier​(AppVerifier verifier)
      Create a new jar certificate verifier utility that uses the provided verifier for its strategy pattern.

    • Field Detail

      • LOG

        private static final Logger LOG

      • SIG

        private static final java.util.regex.Pattern SIG

      • verifiedJars

        private final java.util.List<java.lang.String> verifiedJars
        All of the jar files that were verified for signing

      • unverifiedJars

        private final java.util.List<java.lang.String> unverifiedJars
        All of the jar files that were not verified

      • certs

        private final java.util.Map<java.security.cert.CertPath,​CertInformation> certs
        The certificates used for jar verification linked to their respective information

      • jarSignableEntries

        private final java.util.Map<java.lang.String,​java.lang.Integer> jarSignableEntries
        Absolute location to jars and the number of entries which are possibly signable

      • appVerifier

        private final AppVerifier appVerifier
        The application verifier to use by this instance

      • currentlyUsed

        private java.security.cert.CertPath currentlyUsed
        Temporary cert path hack to be used to keep track of which one a UI dialog is using

    • Constructor Detail

      • JarCertVerifier

        public JarCertVerifier​(AppVerifier verifier)
        Create a new jar certificate verifier utility that uses the provided verifier for its strategy pattern.
        Parameters:
        verifier - The application verifier to be used by the new instance.

    • Method Detail

      • isTriviallySigned

        public boolean isTriviallySigned()
        Returns:
        true if there are no signable entries in the jar. This will return false if any of verified jars have content more than just META-INF/.

      • getAlreadyTrustPublisher

        public boolean getAlreadyTrustPublisher()
        Specified by:
        getAlreadyTrustPublisher in interface CertVerifier
        Returns:
        if the publisher is already trusted

      • getRootInCaCerts

        public boolean getRootInCaCerts()
        Specified by:
        getRootInCaCerts in interface CertVerifier
        Returns:
        if the root is in CA certs

      • getCertPath

        public java.security.cert.CertPath getCertPath()
        Specified by:
        getCertPath in interface CertVerifier
        Returns:
        a valid certificate path to this certificate being verified

      • getDetails

        public java.util.List<java.lang.String> getDetails​(java.security.cert.CertPath certPath)
        Specified by:
        getDetails in interface CertVerifier
        Parameters:
        certPath - certificate
        Returns:
        the details regarding issue with this certificate

      • getCertsList

        public java.util.List<java.security.cert.CertPath> getCertsList()
        Get a list of the cert paths of all signers across the app.
        Returns:
        List of CertPath vars representing each of the signers present on any jar.

      • getCertInformation

        public CertInformation getCertInformation​(java.security.cert.CertPath cPath)
        Find the information the specified cert path has with respect to this application.
        Parameters:
        cPath - certificate to provide info
        Returns:
        All the information the path has with this app.

      • isFullySigned

        public boolean isFullySigned()
        Returns whether or not the app is considered completely signed.

        An app using a JNLP is considered signed if all of the entries of its jars are signed by at least one common signer.

        An applet on the other hand only needs to have each individual jar be fully signed by a signer. The signers can differ between jars.

        Returns:
        Whether or not the app is considered signed.

      • isSigned

        private boolean isSigned()

      • isJarSigned

        public static boolean isJarSigned​(JARDesc jar,
                                  AppVerifier verifier,
                                  ResourceTracker tracker)
                           throws java.lang.Exception
        Throws:
        java.lang.Exception

      • add

        public void add​(JARDesc jar,
                ResourceTracker tracker)
         throws java.lang.Exception
        Update the verifier to consider a new jar when verifying.
        Parameters:
        jar - A new jars to be verified.
        tracker - Resource tracker used to obtain the the jars from cache
        Throws:
        java.lang.Exception - Caused by issues with obtaining the jars' entries or interacting with the tracker.

      • add

        public void add​(java.util.List<JARDesc> jars,
                ResourceTracker tracker)
         throws java.lang.Exception
        Update the verifier to consider new jars when verifying.
        Parameters:
        jars - List of new jars to be verified.
        tracker - Resource tracker used to obtain the the jars from cache
        Throws:
        java.lang.Exception - Caused by issues with obtaining the jars' entries or interacting with the tracker.

      • verifyJars

        private void verifyJars​(java.util.List<JARDesc> jars,
                        ResourceTracker tracker)
                 throws java.lang.Exception
        Verify the jars provided and update the state of this instance to match the new information.
        Parameters:
        jars - List of new jars to be verified.
        tracker - Resource tracker used to obtain the the jars from cache
        Throws:
        java.lang.Exception - Caused by issues with obtaining the jars' entries or interacting with the tracker.

      • verifyJarEntryCerts

        JarCertVerifier.VerifyResult verifyJarEntryCerts​(java.lang.String jarPath,
                                                 boolean jarHasManifest,
                                                 java.util.List<java.util.jar.JarEntry> entries)
        Checks through all the jar entries for signers, storing all the common ones in the certs hash map.
        Parameters:
        jarPath - The absolute path to the jar file.
        jarHasManifest - Whether or not the associated jar has a manifest.
        entries - The list of entries in the associated jar.
        Returns:
        If there is at least one signable entry that is not signed by a common signer, return UNSIGNED. Otherwise every signable entry is signed by at least one common signer. If the signer has no issues, return SIGNED_OK. If there are any signing issues, return SIGNED_NOT_OK.
        Throws:
        java.lang.RuntimeException - Will be thrown if there are issues with entries.

      • isTrustedTsa

        private boolean isTrustedTsa​(java.security.cert.CertPath certPath)

      • verifySigners

        private JarCertVerifier.VerifyResult verifySigners​(java.util.Map<java.security.cert.CertPath,​java.lang.Integer> jarSignCount)

      • zonedDateTime

        private java.time.ZonedDateTime zonedDateTime​(java.util.Date date)

      • checkTrustedCerts

        private void checkTrustedCerts​(java.security.cert.CertPath certPath)
        Checks the user's trusted.certs file and the cacerts file to see if a publisher's and/or CA's certificate exists there.
        Parameters:
        certPath - The cert path of the signer being checked for trust.

      • validateCertpathWhenRootCANotInChain

        private static void validateCertpathWhenRootCANotInChain​(java.security.cert.CertPath certPath,
                                                         java.security.KeyStore caKeyStore)
                                                  throws java.security.KeyStoreException,
                                                         java.security.InvalidAlgorithmParameterException,
                                                         java.security.NoSuchAlgorithmException,
                                                         java.security.cert.CertPathValidatorException
        Throws:
        java.security.KeyStoreException
        java.security.InvalidAlgorithmParameterException
        java.security.NoSuchAlgorithmException
        java.security.cert.CertPathValidatorException

      • setCurrentlyUsedCertPath

        public void setCurrentlyUsedCertPath​(java.security.cert.CertPath certPath)

      • getPublisher

        public java.security.cert.Certificate getPublisher​(java.security.cert.CertPath certPath)
        Specified by:
        getPublisher in interface CertVerifier
        Parameters:
        certPath - to be read for publisher
        Returns:
        the application's publisher's certificate.

      • getRoot

        public java.security.cert.Certificate getRoot​(java.security.cert.CertPath certPath)
        Specified by:
        getRoot in interface CertVerifier
        Parameters:
        certPath - certificate
        Returns:
        the application's root's certificate. This may return the same certificate as getPublisher(CertPath certPath) in the event that the application is self signed.

      • isMetaInfFile

        static boolean isMetaInfFile​(java.lang.String name)
        Returns whether a file is in META-INF, and thus does not require signing.

        Signature-related files under META-INF include: . META-INF/MANIFEST.MF . META-INF/SIG-* . META-INF/*.SF . META-INF/*.DSA . META-INF/*.RSA

      • checkCertUsage

        private void checkCertUsage​(java.security.cert.CertPath certPath,
                            java.security.cert.X509Certificate userCert)
        Check if userCert is designed to be a code signer
        Parameters:
        userCert - the certificate to be examined

      • hasObjectSigningBit

        static boolean hasObjectSigningBit​(byte[] netscapeEx)
        Parameters:
        netscapeEx - DER value of the Netscape cert type extension: OCTET STRING { BIT STRING }
        Returns:
        whether bit 3 (object signing) is set; false if malformed

      • allJarsSigned

        public boolean allJarsSigned()
        Returns if all jars are signed.
        Returns:
        True if all jars are signed, false if there are one or more unsigned jars

      • getJarSignableEntries

        public java.util.Map<java.lang.String,​java.lang.Integer> getJarSignableEntries()

      • getTotalJarEntries

        public static int getTotalJarEntries​(java.util.Map<java.lang.String,​java.lang.Integer> map)
        Get the total number of entries in the provided map.
        Parameters:
        map - map of all jars
        Returns:
        The number of entries.