AGentooCat/i2p.i2p
1
0
Fork 0
forked from I2P_Developers/i2p.i2p
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Crypto: Add provider in CertUtil so we can load EdDSA certs

Browse Source 
Check cert sigs when loading, and log warning on failure
This commit is contained in:
zzz
2022-03-27 08:00:08 -04:00
parent 03e5c6c13c
commit 93493a6d15
1 changed files with 14 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
core/java/src/net/i2p/crypto/CertUtil.java
View File

@@ -38,6 +38,7 @@ import java.util.Set;
import javax.security.auth.x500.X500Principal; import javax.security.auth.x500.X500Principal;
import net.i2p.I2PAppContext; import net.i2p.I2PAppContext;
import net.i2p.crypto.provider.I2PProvider;
import net.i2p.data.Base64; import net.i2p.data.Base64;
import net.i2p.data.DataHelper; import net.i2p.data.DataHelper;
import net.i2p.data.SigningPrivateKey; import net.i2p.data.SigningPrivateKey;
@@ -57,6 +58,10 @@ public final class CertUtil {
private static final String REVOCATION_DIR = "revocations"; private static final String REVOCATION_DIR = "revocations";
private static final int LINE_LENGTH = 64; private static final int LINE_LENGTH = 64;
static {
I2PProvider.addProvider();
}
/** /**
* Write a certificate to a file in base64 format. * Write a certificate to a file in base64 format.
* *
@@ -284,6 +289,10 @@ public final class CertUtil {
* Throws if the certificate is invalid (e.g. expired). * Throws if the certificate is invalid (e.g. expired).
* *
* This does NOT check for revocation. * This does NOT check for revocation.
* This verifies the signature, assuming it is self-signed,
* but will not throw an exception,
* will log a warning only, as of 0.9.54.
* We do NOT fetch additional certs or attempt to validate a cert up the chain.
* *
* @return non-null, throws on all errors including certificate invalid * @return non-null, throws on all errors including certificate invalid
* @since 0.9.24 adapted from SU3File private method * @since 0.9.24 adapted from SU3File private method
@@ -295,6 +304,11 @@ public final class CertUtil {
CertificateFactory cf = CertificateFactory.getInstance("X.509"); CertificateFactory cf = CertificateFactory.getInstance("X.509");
X509Certificate cert = (X509Certificate)cf.generateCertificate(fis); X509Certificate cert = (X509Certificate)cf.generateCertificate(fis);
cert.checkValidity(); cert.checkValidity();
try {
cert.verify(cert.getPublicKey());
} catch (Exception e) {
System.out.println("Warning: Cert is not self-signed or has a bad signature: " + kd + " - " + e);
}
return cert; return cert;
} catch (IllegalArgumentException iae) { } catch (IllegalArgumentException iae) {
// java 1.8.0_40-b10, openSUSE // java 1.8.0_40-b10, openSUSE