diff options
Diffstat (limited to 'OpenKeychain/src/main/java/org')
| -rw-r--r-- | OpenKeychain/src/main/java/org/sufficientlysecure/keychain/KeychainApplication.java | 6 | ||||
| -rw-r--r-- | OpenKeychain/src/main/java/org/sufficientlysecure/keychain/util/OkHttpKeybaseClient.java | 45 |
2 files changed, 31 insertions, 20 deletions
diff --git a/OpenKeychain/src/main/java/org/sufficientlysecure/keychain/KeychainApplication.java b/OpenKeychain/src/main/java/org/sufficientlysecure/keychain/KeychainApplication.java index 45d81749a..56dd9a4cb 100644 --- a/OpenKeychain/src/main/java/org/sufficientlysecure/keychain/KeychainApplication.java +++ b/OpenKeychain/src/main/java/org/sufficientlysecure/keychain/KeychainApplication.java @@ -100,6 +100,12 @@ public class KeychainApplication extends Application { TlsHelper.addPinnedCertificate("hkps.pool.sks-keyservers.net", getAssets(), "hkps.pool.sks-keyservers.net.CA.cer"); TlsHelper.addPinnedCertificate("pgp.mit.edu", getAssets(), "pgp.mit.edu.cer"); + // NOTE: + // keybase.io.CA.cer only holds the CA issuing the actual keybase.io certificate, but this + // is better than no pinning! + // We are not using https://github.com/keybase/node-client/blob/master/src/ca.iced + // because it is only valid for api.keybase.io (https://github.com/keybase/keybase-issues/issues/964) + TlsHelper.addPinnedCertificate("keybase.io", getAssets(), "keybase.io.CA.cer"); TemporaryStorageProvider.cleanUp(this); diff --git a/OpenKeychain/src/main/java/org/sufficientlysecure/keychain/util/OkHttpKeybaseClient.java b/OpenKeychain/src/main/java/org/sufficientlysecure/keychain/util/OkHttpKeybaseClient.java index 7c1d9f291..32a5406e0 100644 --- a/OpenKeychain/src/main/java/org/sufficientlysecure/keychain/util/OkHttpKeybaseClient.java +++ b/OpenKeychain/src/main/java/org/sufficientlysecure/keychain/util/OkHttpKeybaseClient.java @@ -1,7 +1,3 @@ -package org.sufficientlysecure.keychain.util; - -import com.squareup.okhttp.OkHttpClient; -import com.squareup.okhttp.OkUrlFactory; /* * Copyright (C) 2015 Dominik Schürmann <dominik@dominikschuermann.de> * @@ -19,8 +15,14 @@ import com.squareup.okhttp.OkUrlFactory; * along with this program. If not, see <http://www.gnu.org/licenses/>. */ +package org.sufficientlysecure.keychain.util; + +import com.squareup.okhttp.OkHttpClient; +import com.squareup.okhttp.OkUrlFactory; import com.textuality.keybase.lib.KeybaseUrlConnectionClient; +import org.sufficientlysecure.keychain.Constants; + import java.io.IOException; import java.net.Proxy; import java.net.URL; @@ -33,25 +35,14 @@ import java.util.concurrent.TimeUnit; public class OkHttpKeybaseClient implements KeybaseUrlConnectionClient { private final OkUrlFactory factory; - private final OkUrlFactory proxyFactory; private static OkUrlFactory generateUrlFactory() { OkHttpClient client = new OkHttpClient(); - client.setConnectTimeout(5000, TimeUnit.MILLISECONDS); - client.setReadTimeout(25000, TimeUnit.MILLISECONDS); - return new OkUrlFactory(client); - } - - private static OkUrlFactory generateProxyUrlFactory() { - OkHttpClient client = new OkHttpClient(); - client.setConnectTimeout(30000, TimeUnit.MILLISECONDS); - client.setReadTimeout(40000, TimeUnit.MILLISECONDS); return new OkUrlFactory(client); } public OkHttpKeybaseClient() { factory = generateUrlFactory(); - proxyFactory = generateProxyUrlFactory(); } @Override @@ -61,14 +52,28 @@ public class OkHttpKeybaseClient implements KeybaseUrlConnectionClient { @Override public URLConnection openConnection(URL url, Proxy proxy) throws IOException { - URLConnection conn; if (proxy != null) { - proxyFactory.client().setProxy(proxy); - conn = proxyFactory.open(url); + factory.client().setProxy(proxy); + factory.client().setConnectTimeout(30000, TimeUnit.MILLISECONDS); + factory.client().setReadTimeout(40000, TimeUnit.MILLISECONDS); } else { - conn = factory.open(url); + factory.client().setConnectTimeout(5000, TimeUnit.MILLISECONDS); + factory.client().setReadTimeout(25000, TimeUnit.MILLISECONDS); } - return conn; + + factory.client().setFollowSslRedirects(false); + + // forced the usage of keybase.io pinned certificate + try { + if (!TlsHelper.usePinnedCertificateIfAvailable(factory.client(), url)) { + throw new IOException("no pinned certificate found for URL!"); + } + } catch (TlsHelper.TlsHelperException e) { + Log.e(Constants.TAG, "TlsHelper failed", e); + throw new IOException("TlsHelper failed"); + } + + return factory.open(url); } }
\ No newline at end of file |