[pkg-java] r16375 - in trunk/commons-httpclient/debian: . patches
Andreas Tille
tille at alioth.debian.org
Fri Dec 7 09:41:39 UTC 2012
Author: tille
Date: 2012-12-07 09:41:39 +0000 (Fri, 07 Dec 2012)
New Revision: 16375
Modified:
trunk/commons-httpclient/debian/changelog
trunk/commons-httpclient/debian/patches/06_fix_CVE-2012-5783.patch
Log:
Really fix CVE-2012-5783 (Closes: #692442)
Modified: trunk/commons-httpclient/debian/changelog
===================================================================
--- trunk/commons-httpclient/debian/changelog 2012-12-07 08:30:03 UTC (rev 16374)
+++ trunk/commons-httpclient/debian/changelog 2012-12-07 09:41:39 UTC (rev 16375)
@@ -1,3 +1,12 @@
+commons-httpclient (3.1-10.2) unstable; urgency=low
+
+ * Non-maintainer upload.
+ * Fix CVE-2012-5783 (Closes: #692442)
+ * Fix CN extraction from DN of X500 principal.
+ * Fix wildcard validation on ssl connections
+
+ -- Alberto Fernández Martínez <infjaf at gmail.com> Thu, 6 Dec 2012 14:28:00 +0100
+
commons-httpclient (3.1-10.1) unstable; urgency=low
* Non-maintainer upload.
Modified: trunk/commons-httpclient/debian/patches/06_fix_CVE-2012-5783.patch
===================================================================
--- trunk/commons-httpclient/debian/patches/06_fix_CVE-2012-5783.patch 2012-12-07 08:30:03 UTC (rev 16374)
+++ trunk/commons-httpclient/debian/patches/06_fix_CVE-2012-5783.patch 2012-12-07 09:41:39 UTC (rev 16375)
@@ -1,15 +1,21 @@
-Description: Validates the hostname requested is the same in the certificate in ssl-connections
- Fixes CVE-2012-5783, validates hostname certificate in SSL connections.
- Backported from http-client 4, and from Apache Synapse (plus some bugfixes).
+Description: Fixed CN extraction from DN of X500 principal and wildcard validation
-Author: Alberto Fernandez <infjaf at gmail.com>
+ commons-httpclient (3.1-10.2) unstable; urgency=low
+
+ * Fixed CN extraction from DN of X500 principal and wildcard validation
+
+
+Author: Alberto Fernández Martínez <infjaf at gmail.com>
+
+
+Origin: other
Bug-Debian: http://bugs.debian.org/692442
-Forwarded: no
+Forwarded: https://issues.apache.org/jira/browse/HTTPCLIENT-1265
+Last-Update: <2012-12-06>
-
--- commons-httpclient-3.1.orig/src/java/org/apache/commons/httpclient/protocol/SSLProtocolSocketFactory.java
+++ commons-httpclient-3.1/src/java/org/apache/commons/httpclient/protocol/SSLProtocolSocketFactory.java
-@@ -31,11 +31,23 @@
+@@ -31,10 +31,25 @@
package org.apache.commons.httpclient.protocol;
import java.io.IOException;
@@ -17,11 +23,6 @@
import java.net.InetAddress;
import java.net.Socket;
import java.net.UnknownHostException;
-
-+import javax.net.ssl.SSLException;
-+import javax.net.ssl.SSLSession;
-+import javax.net.ssl.SSLSocket;
- import javax.net.ssl.SSLSocketFactory;
+import java.security.cert.Certificate;
+import java.security.cert.CertificateParsingException;
+import java.security.cert.X509Certificate;
@@ -30,10 +31,17 @@
+import java.util.Iterator;
+import java.util.LinkedList;
+import java.util.List;
++import java.util.Locale;
++import java.util.StringTokenizer;
++import java.util.regex.Pattern;
++import javax.net.ssl.SSLException;
++import javax.net.ssl.SSLSession;
++import javax.net.ssl.SSLSocket;
+ import javax.net.ssl.SSLSocketFactory;
+
import org.apache.commons.httpclient.ConnectTimeoutException;
- import org.apache.commons.httpclient.params.HttpConnectionParams;
-@@ -55,6 +67,11 @@ public class SSLProtocolSocketFactory im
+@@ -55,6 +70,11 @@ public class SSLProtocolSocketFactory im
*/
private static final SSLProtocolSocketFactory factory = new SSLProtocolSocketFactory();
@@ -45,7 +53,7 @@
/**
* Gets an singleton instance of the SSLProtocolSocketFactory.
* @return a SSLProtocolSocketFactory
-@@ -79,12 +96,14 @@ public class SSLProtocolSocketFactory im
+@@ -79,12 +99,14 @@ public class SSLProtocolSocketFactory im
InetAddress clientHost,
int clientPort)
throws IOException, UnknownHostException {
@@ -61,7 +69,7 @@
}
/**
-@@ -124,16 +143,19 @@ public class SSLProtocolSocketFactory im
+@@ -124,16 +146,19 @@ public class SSLProtocolSocketFactory im
}
int timeout = params.getConnectionTimeout();
if (timeout == 0) {
@@ -86,7 +94,7 @@
}
}
-@@ -142,10 +164,12 @@ public class SSLProtocolSocketFactory im
+@@ -142,10 +167,12 @@ public class SSLProtocolSocketFactory im
*/
public Socket createSocket(String host, int port)
throws IOException, UnknownHostException {
@@ -100,7 +108,7 @@
}
/**
-@@ -157,14 +181,267 @@ public class SSLProtocolSocketFactory im
+@@ -157,13 +184,271 @@ public class SSLProtocolSocketFactory im
int port,
boolean autoClose)
throws IOException, UnknownHostException {
@@ -113,7 +121,7 @@
);
+ verifyHostName(host, (SSLSocket) sslSocket);
+ return sslSocket;
-+ }
+ }
+
+
+
@@ -169,7 +177,7 @@
+ }
+
+ Certificate[] certs = session.getPeerCertificates();
-+ verifyHostName(host.trim().toLowerCase(), (X509Certificate) certs[0]);
++ verifyHostName(host.trim().toLowerCase(Locale.US), (X509Certificate) certs[0]);
+ }
+ /**
+ * Extract the names from the certificate and tests host matches one of them
@@ -186,7 +194,7 @@
+
+ String cn = getCN(cert);
+ String[] subjectAlts = getDNSSubjectAlts(cert);
-+ verifyHostName(host, cn.toLowerCase(), subjectAlts);
++ verifyHostName(host, cn.toLowerCase(Locale.US), subjectAlts);
+
+ }
+
@@ -256,7 +264,7 @@
+ }
+
+ private static boolean verifyHostName(final String host, final String cn){
-+ if (doWildCard(cn)) {
++ if (doWildCard(cn) && !isIPAddress(host)) {
+ return matchesWildCard(cn, host);
+ }
+ return host.equalsIgnoreCase(cn);
@@ -266,34 +274,32 @@
+ // wildcard in the first block
+ // not an ipaddress (ip addres must explicitily be equal)
+ // not using 2nd level common tld : ex: not for *.co.uk
-+ return
-+ cn.indexOf("*.")>=0 &&
-+ cn.indexOf('.') > cn.indexOf("*.") &&
-+ !isIPAddress(cn) &&
-+ acceptableCountryWildcard(cn);
- }
-
-+ private static boolean isIPAddress(final String cn) {
-+ // IPv6
-+ if (cn.contains(":")) {
-+ return true;
-+ }
-+ // IPb4
-+ boolean isIP4 = true;
-+ String tld = cn;
-+ int x = cn.lastIndexOf('.');
-+ // We only bother analyzing the characters after the final dot
-+ // in the name.
-+ if (x >= 0 && x + 1 < cn.length()) {
-+ tld = cn.substring(x + 1);
-+ }
-+ for (int i = 0; i < tld.length(); i++) {
-+ if (!Character.isDigit(tld.charAt(0))) {
-+ isIP4 = false;
-+ break;
-+ }
-+ }
-+ return isIP4;
++ String parts[] = cn.split("\\.");
++ return parts.length >= 3 &&
++ parts[0].endsWith("*") &&
++ acceptableCountryWildcard(cn) &&
++ !isIPAddress(cn);
++ }
++
++
++ private static final Pattern IPV4_PATTERN =
++ Pattern.compile("^(25[0-5]|2[0-4]\\d|[0-1]?\\d?\\d)(\\.(25[0-5]|2[0-4]\\d|[0-1]?\\d?\\d)){3}$");
++
++ private static final Pattern IPV6_STD_PATTERN =
++ Pattern.compile("^(?:[0-9a-fA-F]{1,4}:){7}[0-9a-fA-F]{1,4}$");
++
++ private static final Pattern IPV6_HEX_COMPRESSED_PATTERN =
++ Pattern.compile("^((?:[0-9A-Fa-f]{1,4}(?::[0-9A-Fa-f]{1,4})*)?)::((?:[0-9A-Fa-f]{1,4}(?::[0-9A-Fa-f]{1,4})*)?)$");
++
++
++ private static boolean isIPAddress(final String hostname) {
++ return hostname != null
++ && (
++ IPV4_PATTERN.matcher(hostname).matches()
++ || IPV6_STD_PATTERN.matcher(hostname).matches()
++ || IPV6_HEX_COMPRESSED_PATTERN.matcher(hostname).matches()
++ );
++
+ }
+
+ private static boolean acceptableCountryWildcard(final String cn) {
@@ -316,20 +322,21 @@
+ final String hostName) {
+ String parts[] = cn.split("\\.");
+ boolean match = false;
-+ if (parts[0].length() > 1) {
++ String firstpart = parts[0];
++ if (firstpart.length() > 1) {
+ // server∗
-+ String prefix = parts[0].substring(0, parts[0].length() - 2);
+ // e.g. server
-+ String suffix = cn.substring(parts[0].length());
++ String prefix = firstpart.substring(0, firstpart.length() - 1);
+ // skipwildcard part from cn
-+ String hostSuffix = hostName.substring(prefix.length());
++ String suffix = cn.substring(firstpart.length());
+ // skip wildcard part from host
++ String hostSuffix = hostName.substring(prefix.length());
+ match = hostName.startsWith(prefix) && hostSuffix.endsWith(suffix);
+ } else {
+ match = hostName.endsWith(cn.substring(1));
+ }
+ if (match) {
-+ // I f we ’ r e i n s t r i c t mode ,
++ // I f we're in strict mode ,
+ // [ ∗.foo.com] is not allowed to match [a.b.foo.com]
+ match = countDots(hostName) == countDots(cn);
+ }
@@ -347,25 +354,30 @@
+ }
+
+ private static String getCN(X509Certificate cert) {
-+ // Note: toString() seems to do a better job than getName()
-+ //
-+ // For example, getName() gives me this:
-+ // 1.2.840.113549.1.9.1=#16166a756c6975736461766965734063756362632e636f6d
-+ //
-+ // whereas toString() gives me this:
-+ // EMAILADDRESS=juliusdavies at cucbc.com
++ // Note: toString() seems to do a better job than getName()
++ //
++ // For example, getName() gives me this:
++ // 1.2.840.113549.1.9.1=#16166a756c6975736461766965734063756362632e636f6d
++ //
++ // whereas toString() gives me this:
++ // EMAILADDRESS=juliusdavies at cucbc.com
+ String subjectPrincipal = cert.getSubjectX500Principal().toString();
-+ int x = subjectPrincipal.indexOf("CN=");
-+ if (x >= 0) {
-+ int y = subjectPrincipal.indexOf(',', x);
-+ // If there are no more commas, then CN= is the last entry.
-+ y = (y >= 0) ? y : subjectPrincipal.length();
-+ return subjectPrincipal.substring(x + 3, y);
-+ } else {
-+ return null;
++
++ return getCN(subjectPrincipal);
++
++ }
++ private static String getCN(String subjectPrincipal) {
++ StringTokenizer st = new StringTokenizer(subjectPrincipal, ",");
++ while(st.hasMoreTokens()) {
++ String tok = st.nextToken().trim();
++ if (tok.length() > 3) {
++ if (tok.substring(0, 3).equalsIgnoreCase("CN=")) {
++ return tok.substring(3);
++ }
++ }
+ }
++ return null;
+ }
-+
+
/**
* All instances of SSLProtocolSocketFactory are the same.
- */
More information about the pkg-java-commits
mailing list