1 files changed, 46 insertions, 0 deletions
diff --git a/OpenKeychain/src/main/java/org/sufficientlysecure/keychain/helper/TlsHelper.java b/OpenKeychain/src/main/java/org/sufficientlysecure/keychain/helper/TlsHelper.java
index 96df7cf2f..4b09af04d 100644
--- a/OpenKeychain/src/main/java/org/sufficientlysecure/keychain/helper/TlsHelper.java
+++ b/OpenKeychain/src/main/java/org/sufficientlysecure/keychain/helper/TlsHelper.java
@@ -17,25 +17,71 @@
 
 package org.sufficientlysecure.keychain.helper;
 
+import android.content.res.AssetManager;
+import org.sufficientlysecure.keychain.Constants;
+import org.sufficientlysecure.keychain.util.Log;
+
 import javax.net.ssl.HttpsURLConnection;
 import javax.net.ssl.SSLContext;
 import javax.net.ssl.TrustManagerFactory;
 import java.io.ByteArrayInputStream;
+import java.io.ByteArrayOutputStream;
 import java.io.IOException;
+import java.io.InputStream;
 import java.net.URL;
+import java.net.URLConnection;
 import java.security.KeyManagementException;
 import java.security.KeyStore;
 import java.security.KeyStoreException;
 import java.security.NoSuchAlgorithmException;
 import java.security.cert.*;
+import java.util.HashMap;
+import java.util.Map;
 
 public class TlsHelper {
+
     public static class TlsHelperException extends Exception {
         public TlsHelperException(Exception e) {
             super(e);
         }
     }
 
+    private static Map<String, byte[]> sStaticCA = new HashMap<String, byte[]>();
+
+    public static void addStaticCA(String domain, byte[] certificate) {
+        sStaticCA.put(domain, certificate);
+    }
+
+    public static void addStaticCA(String domain, AssetManager assetManager, String name) {
+        try {
+            InputStream is = assetManager.open(name);
+            ByteArrayOutputStream baos = new ByteArrayOutputStream();
+            int reads = is.read();
+
+            while(reads != -1){
+                baos.write(reads);
+                reads = is.read();
+            }
+
+            is.close();
+
+            addStaticCA(domain, baos.toByteArray());
+        } catch (IOException e) {
+            Log.w(Constants.TAG, e);
+        }
+    }
+
+    public static URLConnection openConnection(URL url) throws IOException, TlsHelperException {
+        if (url.getProtocol().equals("https")) {
+            for (String domain : sStaticCA.keySet()) {
+                if (url.getHost().endsWith(domain)) {
+                    return openCAConnection(sStaticCA.get(domain), url);
+                }
+            }
+        }
+        return url.openConnection();
+    }
+
     /**
      * Opens a Connection that will only accept certificates signed with a specific CA and skips common name check.
      * This is required for some distributed Keyserver networks like sks-keyservers.net