Beware! -> (code)bugs in the "JAVA Developers Almanac"
8 Message(s) by 3 Author(s) originally posted in java security
| From: Lion-O |
Date: Thursday, November 23, 2006
|
Sometimes I wonder; do not people /read/
API (application
programming interface)docs? I guess not..I'm
current ly in the
process to build a webapplication for online
payment and naturally security and
encryption will become a major deal
for the whole project. Many examples show you how you need to use the
"-DJAVAx.net.ssl.trustStore=
<keystore file >" JAVA
parameter in order to
load your
JVM with a keystore to trust. Or they simply set the JVM
system property 'JAVAx.net.ssl.trustStore'
(JAVA.lang.System.setProperty)) to change this value.
I do not want that, my
goal was to allow a user to
dump a plain
certificate file (plain
ASCII file in
PEM format) which is then parsed
by the webapplication and used to secure the actual https connection. If
the certificate matches all is well, and if not.. etc.
Although I can find my way around the API (application programming interface)docs quite well peeking at
some examples never hurt and so I came across the 'JAVA Developers
Almanac'
website (
http://JAVAalmanac.com/) featuring free example
code .
People: BEWARE!! The author seems unable to read the API (application programming interface)docs himself
and as such certain code contains nasty bugs who's cause I can only
conclude to be plain 'PEBCAK' (Problem Exists Between Chair And
Keyboard).
Example... When working with https its rather easy to use the
'HttpsURLConnection'
class which makes working with https enabled
websites a breeze. The only possible "problem" might be the TrustManager
which demands that the "authorizing certificate" (the CA certificate
which tells you that you can trust the other party) needs to be known
somehow. In order to overcome this they show you how to create your own
trustmanager and then assign it to the used HttpsURLConnection.
They do this by setting up an
SSL Context, then initializing this using
the new truststore and finally load up the HttpsURLConnection with the
SSLSocketFactory through the SSLContext mentioned earlier.
HOWEVER... Look at this code example (source:
http://JAVAalmanac.com/egs/JAVAx.net.ssl/TrustAll.html):
// Install the all-trusting trust manager
try {
SSLContext sc = SSLContext.getInstance("SSL");
sc.init(null, trustAllCerts, new JAVA.security.SecureRandom());
HttpsURLConnection.setDefaultSSLSocketFactory(sc.getSocketFactory());
} catch (Exception e) {
}
// Now you can access an https
URL without having the certificate in
// the truststore
try {
URL url = new URL("
https://hostname/index.html");
} catch (MalformedURLException e) {
}
Notice the use of the setDefaultSSLSocketFactory()
method ... Now read
the API (application programming interface)docs for JAVAx.net.ssl.HttpsURLConnection and you will come
across: "setDefaultSSLSocketFactory - 'Sets the default SSLSocketFactory
inherited by new
instance s of this class.'".
Reading the description of the method these folks /should/ be using
(setSSLSocketFactory) shows you: "Sets the SSLSocketFactory to be used
when this instance creates sockets for secure https URL connections.".I do not get it.. Is it really /that/ hard to RTFAD (Read The 'Fine' API (application programming interface)
Doc umentation) ?
Well, I hope I might help some people with this....
--
Groetjes, Peter
.\\ PGP/GPG key:
http://www.catslair.org/pubkey.asc
| From: sgoo |
Date: Friday, November 24, 2006
|
HttpsURLConnection.setDefaultSSLSocketFactory(sc.getSocketFactory());
I do not think there's any wrong with the code in the book. Here,
setDefaultSSLSocketFactory is a *static* method that can be called on
the class name. If you want to call the none static method
setSSLSocketFactory, you need an
object (aka class instance). Where is
that object?
I've no idea how
JRE handles an https URL inside. It seems at some
phase an object of the HttpsURLConnection
type will be created to the
real connection things, and this is exactly what the doc calls "new
instances of this class".
Goo
| From: Lion-O |
Date: Saturday, November 25, 2006
|
HttpsURLConnection.setDefaultSSLSocketFactory(sc.getSocketFactory());
I do not think there's any wrong with the code in the book. Here,
setDefaultSSLSocketFactory is a *static* method that can be called on
the class name.
The setDefaultSSLSocketFactory "Sets the default SSLSocketFactory
inherited by new instances of this class.". Notice how
JAVAx.net.ssl.HttpsURLConnection is an abstract class with a protected
constructor? You do not simply "instantiate" it.
In the book example they define a
reference to it through use of the
JAVA.net.URL.
open Connection() method and casting its result to a
HttpsURLConnection object. This automaticly
implies that all further
operations will be using the /current/ object and not any optional new
instances.
Therefor you need setSSLSocketFactory() because the settings need to
apply to new sockets created by the current instance.
--
Groetjes, Peter
.\\ PGP/GPG key:
http://www.catslair.org/pubkey.asc
| From: sgoo |
Date: Saturday, November 25, 2006
|
wrote in message:
HttpsURLConnection.setDefaultSSLSocketFactory(sc.getSocketFactory());
> I do not think there's any wrong with the code in the book. Here,
> setDefaultSSLSocketFactory is a *static* method that can be called on
> the class name.The setDefaultSSLSocketFactory "Sets the default SSLSocketFactory
inherited by new instances of this class.". Notice how
JAVAx.net.ssl.HttpsURLConnection is an abstract class with a protected
constructor? You do not simply "instantiate" it.
I believe this includes new instances of
child classes of
HttpsURLConnection, which can be instantiated.
In the book example they define a reference to it through use of the
JAVA.net.URL.openConnection() method and casting its result to a
HttpsURLConnection object. This automaticly implies that all further
operations will be using the /current/ object and not any optional new
instances.
I do not see openConnection() called in the book example. Therefore I
think the example shows that by calling
HttpsURLConnection.setDefaultSSLSocketFactory(...) all URLs created
later can "automagically" use the new TrustManager. Maybe you can use
openConnection() and call setSSLSocketFactory(...) on the object you
get. That's another topic. It does not mean this example is incorrect.
Therefor you need setSSLSocketFactory() because the settings need to
apply to new sockets created by the current instance.
--
Groetjes, Peter
.\\ PGP/GPG key:http://www.catslair.org/pubkey.asc
| From: Lion-O |
Date: Saturday, November 25, 2006
|
Notice how JAVAx.net.ssl.HttpsURLConnection is an abstract class with
a protected constructor? You do not simply "instantiate" it.
I believe this includes new instances of child classes of
HttpsURLConnection, which can be instantiated.
You are right, but thats not what the book is using hence my comment.
I do not see openConnection() called in the book example. Therefore I
think the example shows that by calling
HttpsURLConnection.setDefaultSSLSocketFactory(...)
Thats incorrect. This method doesn't open a connection.
And once again, the last time I'll
repeat this, opening a connection
applies to the /current/ instance.
--
Groetjes, Peter
.\\ PGP/GPG key:
http://www.catslair.org/pubkey.asc
| From: sgoo |
Date: Saturday, November 25, 2006
|
What I mean is, there are 2 ways:
1. Call HttpsURLConnection.setDefaultSSLSocketFactory(...), and all
HTTPS URL created later can go on
2. Call
((HttpsURLConnection)(myURL.getConnection())).setSSLSocketFactory(...)
and /this/ URL can go on
Either works. You just cannot say the first is wrong if you prefer the
second one.
| From: jeff.lanzarotta |
Date: Tuesday, November 28, 2006
|
Interesting that you are building a payment application, as I am
also... I've been really struggling over this SSL stuff... Is there
any good references/examples you can
point me to?
wrote in message:
Sometimes I wonder; do not people /read/ API (application programming interface)docs? I guess not..
I'm currently in the process to build a webapplication for online
payment and naturally security and encryption will become a major deal
for the whole project. Many examples show you how you need to use the
"-DJAVAx.net.ssl.trustStore=<keystore file>" JAVA parameter in order to
load your JVM with a keystore to trust. Or they simply set the JVM
system property 'JAVAx.net.ssl.trustStore'
(JAVA.lang.System.setProperty)) to change this value.
I do not want that, my goal was to allow a user to dump a plain
certificate file (plain ASCII file in PEM format) which is then parsed
by the webapplication and used to secure the actual https connection. If
the certificate matches all is well, and if not.. etc.
Although I can find my way around the API (application programming interface)docs quite well peeking at
some examples never hurt and so I came across the 'JAVA Developers
Almanac' website (http://JAVAalmanac.com/) featuring free example code.
People: BEWARE!! The author seems unable to read the API (application programming interface)docs himself
and as such certain code contains nasty bugs who's cause I can only
conclude to be plain 'PEBCAK' (Problem Exists Between Chair And
Keyboard).
Example... When working with https its rather easy to use the
'HttpsURLConnection' class which makes working with https enabled
websites a breeze. The only possible "problem" might be the TrustManager
which demands that the "authorizing certificate" (the CA certificate
which tells you that you can trust the other party) needs to be known
somehow. In order to overcome this they show you how to create your own
trustmanager and then assign it to the used HttpsURLConnection.
They do this by setting up an SSLContext, then initializing this using
the new truststore and finally load up the HttpsURLConnection with the
SSLSocketFactory through the SSLContext mentioned earlier.
HOWEVER... Look at this code example (source:
http://JAVAalmanac.com/egs/JAVAx.net.ssl/TrustAll.html):
// Install the all-trusting trust manager
try {
SSLContext sc = SSLContext.getInstance("SSL");
sc.init(null, trustAllCerts, new JAVA.security.SecureRandom());
HttpsURLConnection.setDefaultSSLSocketFactory(sc.getSocketFactory());
} catch (Exception e) {
}
// Now you can access an https URL without having the certificate in
// the truststore
try {
URL url = new URL("https://hostname/index.html");
} catch (MalformedURLException e) {
}
Notice the use of the setDefaultSSLSocketFactory() method... Now read
the API (application programming interface)docs for JAVAx.net.ssl.HttpsURLConnection and you will come
across: "setDefaultSSLSocketFactory - 'Sets the default SSLSocketFactory
inherited by new instances of this class.'".
Reading the description of the method these folks /should/ be using
(setSSLSocketFactory) shows you: "Sets the SSLSocketFactory to be used
when this instance creates sockets for secure https URL connections.".
I do not get it.. Is it really /that/ hard to RTFAD (Read The 'Fine' API (application programming interface)
Documentation) ?
Well, I hope I might help some people with this....
--
Groetjes, Peter
.\\ PGP/GPG key: http://www.catslair.org/pubkey.asc
| From: jeff.lanzarotta |
Date: Tuesday, November 28, 2006
|
The processor that I am using gave me a URL '
https://xxx.yyy.zzz' to
connect to and a
port number. I've had no luck in finding a way to
wrote in message:
Sometimes I wonder; do not people /read/ API (application programming interface)docs? I guess not..
I'm currently in the process to build a webapplication for online
payment and naturally security and encryption will become a major deal
for the whole project. Many examples show you how you need to use the
"-DJAVAx.net.ssl.trustStore=<keystore file>" JAVA parameter in order to
load your JVM with a keystore to trust. Or they simply set the JVM
system property 'JAVAx.net.ssl.trustStore'
(JAVA.lang.System.setProperty)) to change this value.
I do not want that, my goal was to allow a user to dump a plain
certificate file (plain ASCII file in PEM format) which is then parsed
by the webapplication and used to secure the actual https connection. If
the certificate matches all is well, and if not.. etc.
Although I can find my way around the API (application programming interface)docs quite well peeking at
some examples never hurt and so I came across the 'JAVA Developers
Almanac' website (http://JAVAalmanac.com/) featuring free example code.
People: BEWARE!! The author seems unable to read the API (application programming interface)docs himself
and as such certain code contains nasty bugs who's cause I can only
conclude to be plain 'PEBCAK' (Problem Exists Between Chair And
Keyboard).
Example... When working with https its rather easy to use the
'HttpsURLConnection' class which makes working with https enabled
websites a breeze. The only possible "problem" might be the TrustManager
which demands that the "authorizing certificate" (the CA certificate
which tells you that you can trust the other party) needs to be known
somehow. In order to overcome this they show you how to create your own
trustmanager and then assign it to the used HttpsURLConnection.
They do this by setting up an SSLContext, then initializing this using
the new truststore and finally load up the HttpsURLConnection with the
SSLSocketFactory through the SSLContext mentioned earlier.
HOWEVER... Look at this code example (source:
http://JAVAalmanac.com/egs/JAVAx.net.ssl/TrustAll.html):
// Install the all-trusting trust manager
try {
SSLContext sc = SSLContext.getInstance("SSL");
sc.init(null, trustAllCerts, new JAVA.security.SecureRandom());
HttpsURLConnection.setDefaultSSLSocketFactory(sc.getSocketFactory());
} catch (Exception e) {
}
// Now you can access an https URL without having the certificate in
// the truststore
try {
URL url = new URL("https://hostname/index.html");
} catch (MalformedURLException e) {
}
Notice the use of the setDefaultSSLSocketFactory() method... Now read
the API (application programming interface)docs for JAVAx.net.ssl.HttpsURLConnection and you will come
across: "setDefaultSSLSocketFactory - 'Sets the default SSLSocketFactory
inherited by new instances of this class.'".
Reading the description of the method these folks /should/ be using
(setSSLSocketFactory) shows you: "Sets the SSLSocketFactory to be used
when this instance creates sockets for secure https URL connections.".
I do not get it.. Is it really /that/ hard to RTFAD (Read The 'Fine' API (application programming interface)
Documentation) ?
Well, I hope I might help some people with this....
--
Groetjes, Peter
.\\ PGP/GPG key: http://www.catslair.org/pubkey.asc
Next Message: Adding certificate to trusted certificates using an applet?