Changeset d885e00

Timestamp:

Apr 28, 2016 10:17:27 PM (5 years ago)

Author:

zzz <zzz@…>

Branches:

master

Children:

fbeca5e

Parents:

52c9bf6

Message:

News: Verify received CRL before saving

Files:

• apps/routerconsole/java/src/net/i2p/router/update/NewsFetcher.java (modified) (4 diffs)
• core/java/src/net/i2p/crypto/CertUtil.java (modified) (1 diff)
• history.txt (modified) (1 diff)
• router/java/src/net/i2p/router/RouterVersion.java (modified) (1 diff)

apps/routerconsole/java/src/net/i2p/router/update/NewsFetcher.java

@@ -1 +1 @@
 package net.i2p.router.update;
 
+import java.io.ByteArrayInputStream;
 import java.io.BufferedWriter;
 import java.io.File;
@@ -11 +12 @@
 import java.net.URI;
 import java.net.URISyntaxException;
+import java.security.GeneralSecurityException;
 import java.text.DateFormat;
 import java.util.ArrayList;
@@ -22 +24 @@
 
 import net.i2p.app.ClientAppManager;
+import net.i2p.crypto.CertUtil;
 import net.i2p.crypto.SU3File;
 import net.i2p.crypto.TrustedUpdate;
@@ -586 +589 @@
             OutputStream out = null;
             try {
+                byte[] data = DataHelper.getUTF8(e.data);
+                // test for validity
+                CertUtil.loadCRL(new ByteArrayInputStream(data));
                 out = new SecureFileOutputStream(f);
-                out.write(DataHelper.getUTF8(e.data));
+                out.write(data);
+            } catch (GeneralSecurityException gse) {
+                _log.error("Bad CRL", gse);
             } catch (IOException ioe) {
                 _log.error("Failed to write CRL", ioe);

core/java/src/net/i2p/crypto/CertUtil.java

@@ -516 +516 @@
      *
      *  @return non-null
-     *  @since 0.9.25
-     */
-    private static X509CRL loadCRL(InputStream in) throws GeneralSecurityException {
+     *  @since 0.9.25 public since 0.9.26
+     */
+    public static X509CRL loadCRL(InputStream in) throws GeneralSecurityException {
         CertificateFactory cf = CertificateFactory.getInstance("X.509");
         return (X509CRL) cf.generateCRL(in);

history.txt

@@ +1 @@
+2016-04-28 zzz
+ * News: Parse and store CRLs in news feed
+
 2016-04-28 zzz
 Prop from i2p.i2p.zzz.gmp6-prop:

router/java/src/net/i2p/router/RouterVersion.java

@@ -19 +19 @@
     public final static String ID = "Monotone";
     public final static String VERSION = CoreVersion.VERSION;
-    public final static long BUILD = 6;
+    public final static long BUILD = 7;
 
     /** for example "-test" */