On 08/04/2014 11:10 AM, Florian Bruckner (3kraft) wrote:
Hey guys,
any feedback/comments on this?
This seems like a reasonable change to me. In order to proceed with
accepting your patch, you will first need to sign an OCA. See step 0 of
http://openjdk.java.net/contribute/
Thanks,
Sean
Just to summarize again:
KeychainStore does not load private keys when not called with a
passphrase. This is the case in various deployment scenarios (like
javaws), as a consequence identity certificates stored in Apple Keychain
are not available (i.e. being offered for selection like on Windows).
The reason for this is the implementation of KeychainStore, which uses
this API to retrieve a PKCS#12 container from apple keychain:
https://developer.apple.com/library/mac/documentation/security/Reference/keychainservices/Reference/reference.html#jumpTo_63
The API documentation says the PKCS#12 keystore being generated with
this call requires a password. This is either supplied by the caller or
the user is prompted (if a flag is set, which is not the case).
KeychainStore then goes on to extract the private key from the returned
PKCS#12 store and decrypts it with the password.
Therefore, the password passed into engineGetKey is actually used to
encrypt and decrypt only in the scope of this method. Therefore, the
approach is to create a dummy password for this use case.
Please consider these patches to fix this issue:
For jdk7u-dev:
diff -r 35aabd00a534 src/macosx/classes/apple/security/KeychainStore.java
--- a/src/macosx/classes/apple/security/KeychainStore.java Tue Jul 15
02:26:55 2014 +0400
+++ b/src/macosx/classes/apple/security/KeychainStore.java Tue Jul 15
10:52:44 2014 +0200
@@ -134,7 +134,7 @@
* password to recover it.
*
* @param alias the alias name
- * @param password the password for recovering the key
+ * @param password the password for recovering the key. This
password is not used to access the private key in KeyChain, it is used
internally only.
*
* @return the requested key, or null if the given alias does not
exist
* or does not identify a <i>key entry</i>.
@@ -148,6 +148,16 @@
throws NoSuchAlgorithmException, UnrecoverableKeyException
{
permissionCheck();
+ // An empty password is rejected by MacOS API, no private key data
+ // is exported. If no password is passed (as is the case when
+ // this implementation is used as browser keystore in various
+ // deployment scenarios like webstart, JFX and applets), create
+ // a dummy password to MacOS API is happy.
+ if (password == null || password.length ==0) {
+ // Must not be a char array with only a 0, as this is an empty
+ // string. Therefore use a single character.
+ password = new char[]{'A'}
+ }
Object entry = entries.get(alias.toLowerCase());
For jdk8u-dev:
diff -r baec3649f6c0 src/macosx/classes/apple/security/KeychainStore.java
--- a/src/macosx/classes/apple/security/KeychainStore.java Tue Jul 15
02:00:52 2014 +0400
+++ b/src/macosx/classes/apple/security/KeychainStore.java Tue Jul 15
10:54:45 2014 +0200
@@ -140,7 +140,7 @@
* password to recover it.
*
* @param alias the alias name
- * @param password the password for recovering the key
+ * @param password the password for recovering the key. This
password is not used to access the private key in KeyChain, it is used
internally only.
*
* @return the requested key, or null if the given alias does not
exist
* or does not identify a <i>key entry</i>.
@@ -154,7 +154,16 @@
throws NoSuchAlgorithmException, UnrecoverableKeyException
{
permissionCheck();
-
+ // An empty password is rejected by MacOS API, no private key data
+ // is exported. If no password is passed (as is the case when
+ // this implementation is used as browser keystore in various
+ // deployment scenarios like webstart, JFX and applets), create
+ // a dummy password to MacOS API is happy.
+ if (password == null || password.length ==0) {
+ // Must not be a char array with only a 0, as this is an empty
+ // string. Therefore use a single character.
+ password = new char[]{'A'}
+ }
Object entry = entries.get(alias.toLowerCase());
if (entry == null || !(entry instanceof KeyEntry)) {
With best regards,
Florian
