empathicqubit/Signal-Android
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 1

Add a TrustManager that blacklists via serial numbers.

Browse source
This commit is contained in:
Moxie Marlinspike 2014-04-09 20:49:52 -07:00
parent 7b3f2c169a
commit 4438b4ae69
2 changed files with 124 additions and 13 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

50
library/src/org/whispersystems/textsecure/push/PushServiceSocket.java
View file

@ -1,3 +1,19 @@
/**
* Copyright (C) 2014 Open Whisper Systems
*
* This program is free software: you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by
* the Free Software Foundation, either version 3 of the License, or
* (at your option) any later version.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details.
*
* You should have received a copy of the GNU General Public License
* along with this program. If not, see <http://www.gnu.org/licenses/>.
*/
package org.whispersystems.textsecure.push;
import android.content.Context;
@ -10,6 +26,7 @@ import org.apache.http.conn.ssl.StrictHostnameVerifier;
import org.whispersystems.textsecure.crypto.IdentityKey;
import org.whispersystems.textsecure.storage.PreKeyRecord;
import org.whispersystems.textsecure.util.Base64;
import org.whispersystems.textsecure.util.BlacklistingTrustManager;
import org.whispersystems.textsecure.util.Util;
import java.io.File;
@ -32,8 +49,15 @@ import java.util.Set;
import javax.net.ssl.HttpsURLConnection;
import javax.net.ssl.SSLContext;
import javax.net.ssl.TrustManager;
import javax.net.ssl.TrustManagerFactory;
/**
*
* Network interface to the TextSecure server API.
*
* @author Moxie Marlinspike
*/
public class PushServiceSocket {
private static final String CREATE_ACCOUNT_SMS_PATH = "/v1/accounts/sms/code/%s";
@ -51,20 +75,20 @@ public class PushServiceSocket {
private static final boolean ENFORCE_SSL = true;
private final Context context;
private final String serviceUrl;
private final String localNumber;
private final String password;
private final TrustManagerFactory trustManagerFactory;
private final Context context;
private final String serviceUrl;
private final String localNumber;
private final String password;
private final TrustManager[] trustManagers;
public PushServiceSocket(Context context, String serviceUrl, TrustStore trustStore,
String localNumber, String password)
{
this.context = context.getApplicationContext();
this.serviceUrl = serviceUrl;
this.localNumber = localNumber;
this.password = password;
this.trustManagerFactory = initializeTrustManagerFactory(trustStore);
this.context = context.getApplicationContext();
this.serviceUrl = serviceUrl;
this.localNumber = localNumber;
this.password = password;
this.trustManagers = initializeTrustManager(trustStore);
}
public void createAccount(boolean voice) throws IOException {
@ -356,7 +380,7 @@ public class PushServiceSocket {
private HttpURLConnection getConnection(String urlFragment, String method) throws IOException {
try {
SSLContext context = SSLContext.getInstance("TLS");
context.init(null, trustManagerFactory.getTrustManagers(), null);
context.init(null, trustManagers, null);
URL url = new URL(String.format("%s%s", serviceUrl, urlFragment));
Log.w("PushServiceSocket", "Push service URL: " + serviceUrl);
@ -394,7 +418,7 @@ public class PushServiceSocket {
}
}
private TrustManagerFactory initializeTrustManagerFactory(TrustStore trustStore) {
private TrustManager[] initializeTrustManager(TrustStore trustStore) {
try {
InputStream keyStoreInputStream = trustStore.getKeyStoreInputStream();
KeyStore keyStore = KeyStore.getInstance("BKS");
@ -404,7 +428,7 @@ public class PushServiceSocket {
TrustManagerFactory trustManagerFactory = TrustManagerFactory.getInstance("X509");
trustManagerFactory.init(keyStore);
return trustManagerFactory;
return BlacklistingTrustManager.createFor(trustManagerFactory.getTrustManagers());
} catch (KeyStoreException kse) {
throw new AssertionError(kse);
} catch (CertificateException e) {

87
library/src/org/whispersystems/textsecure/util/BlacklistingTrustManager.java Normal file
View file

@ -0,0 +1,87 @@
/**
* Copyright (C) 2014 Open Whisper Systems
*
* This program is free software: you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by
* the Free Software Foundation, either version 3 of the License, or
* (at your option) any later version.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details.
*
* You should have received a copy of the GNU General Public License
* along with this program. If not, see <http://www.gnu.org/licenses/>.
*/
package org.whispersystems.textsecure.util;
import java.math.BigInteger;
import java.security.cert.CertificateException;
import java.security.cert.X509Certificate;
import java.util.LinkedList;
import java.util.List;
import javax.net.ssl.TrustManager;
import javax.net.ssl.X509TrustManager;
/**
* Trust manager that defers to a system X509 trust manager, and
* additionally rejects certificates if they have a blacklisted
* serial.
*
* @author Moxie Marlinspike
*/
public class BlacklistingTrustManager implements X509TrustManager {
private static final List<BigInteger> BLACKLIST = new LinkedList<BigInteger>() {{
add(new BigInteger("4098"));
}};
public static TrustManager[] createFor(TrustManager[] trustManagers) {
for (TrustManager trustManager : trustManagers) {
if (trustManager instanceof X509TrustManager) {
TrustManager[] results = new BlacklistingTrustManager[1];
results[0] = new BlacklistingTrustManager((X509TrustManager)trustManager);
return results;
}
}
throw new AssertionError("No X509 Trust Managers!");
}
private final X509TrustManager trustManager;
public BlacklistingTrustManager(X509TrustManager trustManager) {
this.trustManager = trustManager;
}
@Override
public void checkClientTrusted(X509Certificate[] chain, String authType)
throws CertificateException
{
trustManager.checkClientTrusted(chain, authType);
}
@Override
public void checkServerTrusted(X509Certificate[] chain, String authType)
throws CertificateException
{
trustManager.checkServerTrusted(chain, authType);
for (X509Certificate certificate : chain) {
for (BigInteger blacklistedSerial : BLACKLIST) {
if (certificate.getSerialNumber().equals(blacklistedSerial)) {
throw new CertificateException("Blacklisted Serial: " + certificate.getSerialNumber());
}
}
}
}
@Override
public X509Certificate[] getAcceptedIssuers() {
return trustManager.getAcceptedIssuers();
}
}