|
1 | 1 | package io.sentry.transport; |
2 | 2 |
|
3 | | -import java.net.HttpURLConnection; |
4 | | -import java.security.MessageDigest; |
5 | | -import java.security.NoSuchAlgorithmException; |
6 | 3 | import java.security.cert.Certificate; |
| 4 | +import java.security.cert.X509Certificate; |
7 | 5 | import java.util.Arrays; |
8 | 6 | import java.util.HashSet; |
9 | 7 | import java.util.Set; |
10 | | -import javax.net.ssl.HttpsURLConnection; |
11 | 8 | import javax.net.ssl.SSLPeerUnverifiedException; |
| 9 | +import javax.net.ssl.SSLSocketFactory; |
| 10 | +import javax.security.auth.x500.X500Principal; |
12 | 11 | import org.jetbrains.annotations.ApiStatus; |
13 | 12 | import org.jetbrains.annotations.NotNull; |
14 | | -import org.jetbrains.annotations.Nullable; |
15 | 13 |
|
16 | 14 | /** |
17 | | - * Rejects servers whose certificate chain contains a CA certificate that is known to be compromised |
18 | | - * but still trusted by platform trust stores. |
| 15 | + * Rejects servers whose certificate was issued by a CA that is known to be compromised but still |
| 16 | + * trusted by platform trust stores. |
19 | 17 | * |
20 | 18 | * <p>Browsers block such certificates on their own and require Certificate Transparency, but {@link |
21 | | - * HttpsURLConnection} does neither. Android only updates its CA store with OS updates (or Mainline |
22 | | - * on Android 14+) and the JVM only with JDK updates, so a distrust by the root programs doesn't |
23 | | - * reach every device. |
| 19 | + * javax.net.ssl.HttpsURLConnection} does neither. Android only updates its CA store with OS updates |
| 20 | + * (or Mainline on Android 14+) and the JVM only with JDK updates, so a distrust by the root |
| 21 | + * programs doesn't reach every device. |
24 | 22 | */ |
25 | 23 | @ApiStatus.Internal |
26 | 24 | public final class DistrustedCertificates { |
27 | 25 |
|
28 | 26 | /** |
29 | | - * SHA-256 hashes of the SubjectPublicKeyInfo of the eight eMudhra intermediates whose private |
30 | | - * keys can be recovered from their certificates (CVE-2026-111943). Each key is in two |
31 | | - * certificates: one issued by eMudhra and a cross-sign by Sectigo's AAA Certificate Services |
32 | | - * root, which is trusted on every Android version. Matching the key covers both. |
| 27 | + * The eight eMudhra intermediates whose private keys can be recovered from their certificates |
| 28 | + * (CVE-2026-111943). Each key is in two certificates with the same subject: one issued by eMudhra |
| 29 | + * and a cross-sign by Sectigo's AAA Certificate Services root, which is trusted on every Android |
| 30 | + * version. |
| 31 | + * |
| 32 | + * <p>They are matched by name rather than by key because the server doesn't have to send them: |
| 33 | + * Android caches intermediates from earlier connections and completes a chain that is missing |
| 34 | + * one. The server always sends the leaf, which names its issuer, and since none of these CAs may |
| 35 | + * issue further CAs ({@code pathlen:0}), any certificate they issued is a leaf. |
33 | 36 | * |
34 | 37 | * @see <a |
35 | 38 | * href="https://groups.google.com/a/mozilla.org/g/dev-security-policy/c/0R3XLJL6FuE">Compromised |
36 | 39 | * eMudhra Intermediate Certificates</a> |
37 | 40 | */ |
38 | | - private static final Set<String> SPKI_SHA256_HASHES = |
| 41 | + private static final Set<X500Principal> DISTRUSTED_CAS = |
39 | 42 | new HashSet<>( |
40 | 43 | Arrays.asList( |
41 | | - "43bffa19d6ef651451f6841e019931e96f6f2eaeff28ab4b6f1ce4576de2717b", |
42 | | - "49dd353dc2b919a3770645117d0e60c16115e7d1bc259eefe734b00ea434fe5f", |
43 | | - "5c0660a2b164910d8ff589c18e14552e9e0ec237dcefe2cb736d41a4811f81a0", |
44 | | - "63ecefee431d49523bc1136c4e72d0206a477086caf606cd5cf025686c109cf8", |
45 | | - "92c063d67e8f14db71d288e11266ffdaf69cbf115f7bab14f3bc2f68d25e0e30", |
46 | | - "e0254c7fcdc265e2f0f8a428dabb75ab4ae039b4872d62f5ee57f0877d5a8a41", |
47 | | - "ebed6475c2c2d80fcb199f3fe8dd6e6b3ce60b77eb15d4e42c3dec0c6f5b5105", |
48 | | - "ec4ffa1ad0ac88081314b7aaffef6a91f97cd57291bb5ba686c5415f5eb4f6b6")); |
| 44 | + new X500Principal("CN=EM DV TLS CA - G3B, O=eMudhra BV, C=NL"), |
| 45 | + new X500Principal("CN=EM EV TLS CA - G3B, O=eMudhra BV, C=NL"), |
| 46 | + new X500Principal("CN=EM OV TLS CA - G3B, O=eMudhra BV, C=NL"), |
| 47 | + new X500Principal("CN=EM OV CS CA - G3B, O=eMudhra BV, C=NL"), |
| 48 | + new X500Principal("CN=EM DV TLS CA - G3C, O=eMudhra Inc, C=US"), |
| 49 | + new X500Principal("CN=EM EV TLS CA - G3C, O=eMudhra Inc, C=US"), |
| 50 | + new X500Principal("CN=EM OV TLS CA - G3C, O=eMudhra Inc, C=US"), |
| 51 | + new X500Principal("CN=EM OV CS CA - G3C, O=eMudhra Inc, C=US"))); |
49 | 52 |
|
50 | | - private static final DistrustedCertificates instance = new DistrustedCertificates(); |
| 53 | + private DistrustedCertificates() {} |
51 | 54 |
|
52 | | - public static @NotNull DistrustedCertificates getInstance() { |
53 | | - return instance; |
| 55 | + /** |
| 56 | + * Wraps {@code delegate} so that every TLS handshake of its sockets is checked, including the |
| 57 | + * ones {@link java.net.HttpURLConnection} makes on its own to retry a request on a new |
| 58 | + * connection. |
| 59 | + */ |
| 60 | + public static @NotNull SSLSocketFactory wrap(final @NotNull SSLSocketFactory delegate) { |
| 61 | + return new DistrustedCertificatesSocketFactory(delegate); |
54 | 62 | } |
55 | 63 |
|
56 | | - private DistrustedCertificates() {} |
57 | | - |
58 | 64 | /** |
59 | | - * Disconnects and throws if the server presented a distrusted certificate. |
60 | | - * |
61 | | - * <p>Call it right after {@link HttpURLConnection#connect()}: the TLS handshake is done by then, |
62 | | - * but no part of the request has been written yet. A {@link javax.net.ssl.HostnameVerifier} can't |
63 | | - * do this check, because the JVM's {@link HttpsURLConnection} only calls it when its own hostname |
64 | | - * check fails. |
| 65 | + * @param peerCertificates the certificates the server sent, leaf first |
65 | 66 | */ |
66 | | - public void verify(final @NotNull HttpURLConnection connection) |
| 67 | + static void check(final @NotNull Certificate[] peerCertificates) |
67 | 68 | throws SSLPeerUnverifiedException { |
68 | | - if (!(connection instanceof HttpsURLConnection)) { |
69 | | - return; |
70 | | - } |
71 | | - final @Nullable Certificate[] certificates = |
72 | | - ((HttpsURLConnection) connection).getServerCertificates(); |
73 | | - if (certificates == null) { |
74 | | - return; |
75 | | - } |
76 | | - for (final @NotNull Certificate certificate : certificates) { |
77 | | - if (SPKI_SHA256_HASHES.contains(spkiSha256(certificate))) { |
78 | | - connection.disconnect(); |
| 69 | + for (final Certificate certificate : peerCertificates) { |
| 70 | + if (certificate instanceof X509Certificate && isDistrusted((X509Certificate) certificate)) { |
79 | 71 | throw new SSLPeerUnverifiedException( |
80 | 72 | "The server's certificate chain contains a distrusted certificate."); |
81 | 73 | } |
82 | 74 | } |
83 | 75 | } |
84 | 76 |
|
85 | | - private static @NotNull String spkiSha256(final @NotNull Certificate certificate) { |
86 | | - final byte[] hash; |
87 | | - try { |
88 | | - hash = MessageDigest.getInstance("SHA-256").digest(certificate.getPublicKey().getEncoded()); |
89 | | - } catch (NoSuchAlgorithmException e) { |
90 | | - // Every Java and Android platform is required to support SHA-256. |
91 | | - throw new AssertionError(e); |
92 | | - } |
93 | | - final StringBuilder hex = new StringBuilder(hash.length * 2); |
94 | | - for (final byte b : hash) { |
95 | | - hex.append(Character.forDigit((b >> 4) & 0xf, 16)).append(Character.forDigit(b & 0xf, 16)); |
96 | | - } |
97 | | - return hex.toString(); |
| 77 | + private static boolean isDistrusted(final @NotNull X509Certificate certificate) { |
| 78 | + return DISTRUSTED_CAS.contains(certificate.getIssuerX500Principal()) |
| 79 | + || DISTRUSTED_CAS.contains(certificate.getSubjectX500Principal()); |
98 | 80 | } |
99 | 81 | } |
0 commit comments