|
| 1 | +// Copyright 2025 Amazon.com, Inc. or its affiliates. All Rights Reserved. |
| 2 | +// SPDX-License-Identifier: Apache-2.0 |
| 3 | + |
| 4 | +package software.aws.toolkits.jetbrains.services.amazonq.lsp |
| 5 | + |
| 6 | +import com.intellij.util.io.DigestUtil |
| 7 | +import com.intellij.util.net.JdkProxyProvider |
| 8 | +import com.intellij.util.net.ssl.CertificateManager |
| 9 | +import org.apache.http.client.methods.RequestBuilder |
| 10 | +import org.apache.http.conn.ssl.DefaultHostnameVerifier |
| 11 | +import org.apache.http.impl.client.HttpClientBuilder |
| 12 | +import org.apache.http.impl.client.SystemDefaultCredentialsProvider |
| 13 | +import org.apache.http.impl.conn.SystemDefaultRoutePlanner |
| 14 | +import org.jetbrains.annotations.TestOnly |
| 15 | +import software.aws.toolkits.core.utils.getLogger |
| 16 | +import software.aws.toolkits.core.utils.warn |
| 17 | +import java.net.URI |
| 18 | +import java.security.KeyStore |
| 19 | +import java.security.cert.CertPathBuilder |
| 20 | +import java.security.cert.CertStore |
| 21 | +import java.security.cert.Certificate |
| 22 | +import java.security.cert.CollectionCertStoreParameters |
| 23 | +import java.security.cert.PKIXBuilderParameters |
| 24 | +import java.security.cert.PKIXCertPathBuilderResult |
| 25 | +import java.security.cert.X509CertSelector |
| 26 | +import java.security.cert.X509Certificate |
| 27 | +import java.util.Base64 |
| 28 | +import kotlin.collections.ifEmpty |
| 29 | + |
| 30 | +object TrustChainUtil { |
| 31 | + private val LOG = getLogger<TrustChainUtil>() |
| 32 | + |
| 33 | + @TestOnly |
| 34 | + fun resolveTrustChain(certs: Collection<X509Certificate>, trustAnchors: Collection<X509Certificate>) = resolveTrustChain( |
| 35 | + certs, |
| 36 | + keystoreFromCertificates(trustAnchors) |
| 37 | + ) |
| 38 | + |
| 39 | + /** |
| 40 | + * Build and validate the complete certificate chain |
| 41 | + * @param certs The end-entity certificate |
| 42 | + * @param trustAnchors The truststore containing trusted CA certificates |
| 43 | + * @return The complete certificate chain |
| 44 | + */ |
| 45 | + fun resolveTrustChain(certs: Collection<X509Certificate>, trustAnchors: KeyStore): List<X509Certificate> { |
| 46 | + try { |
| 47 | + // Create the selector for the certificate |
| 48 | + val selector = X509CertSelector() |
| 49 | + selector.certificate = certs.first() |
| 50 | + |
| 51 | + // Create the parameters for path validation |
| 52 | + val pkixParams = PKIXBuilderParameters(trustAnchors, selector) |
| 53 | + |
| 54 | + // Disable CRL checking since we just want to build the path |
| 55 | + pkixParams.isRevocationEnabled = false |
| 56 | + |
| 57 | + // Create a CertStore containing the certificate we want to validate |
| 58 | + val ccsp = CollectionCertStoreParameters(certs) |
| 59 | + val certStore = CertStore.getInstance("Collection", ccsp) |
| 60 | + pkixParams.addCertStore(certStore) |
| 61 | + |
| 62 | + // Get the certification path |
| 63 | + val builder = CertPathBuilder.getInstance("PKIX") |
| 64 | + val result = builder.build(pkixParams) as PKIXCertPathBuilderResult |
| 65 | + val certPath = result.certPath |
| 66 | + val chain = (certPath.certificates as List<X509Certificate>).toMutableList() |
| 67 | + |
| 68 | + // Add the trust anchor (root CA) to complete the chain |
| 69 | + val trustAnchorCert = result.trustAnchor.trustedCert |
| 70 | + if (trustAnchorCert != null) { |
| 71 | + chain.add(trustAnchorCert) |
| 72 | + } |
| 73 | + |
| 74 | + return chain |
| 75 | + } catch (e: Exception) { |
| 76 | + // Java PKIX is happy with leaf cert in certification path, but Node.JS will not respect in NODE_CA_CERTS |
| 77 | + LOG.warn(e) { "Could not build trust anchor via CertPathBuilder? maybe user accepted leaf cert but not intermediate" } |
| 78 | + |
| 79 | + return emptyList() |
| 80 | + } |
| 81 | + } |
| 82 | + |
| 83 | + fun getTrustChain(uri: URI): List<X509Certificate> { |
| 84 | + val proxyProvider = JdkProxyProvider.getInstance() |
| 85 | + var peerCerts: Array<Certificate> = emptyArray() |
| 86 | + val verifierDelegate = DefaultHostnameVerifier() |
| 87 | + val client = HttpClientBuilder.create() |
| 88 | + .setRoutePlanner(SystemDefaultRoutePlanner(proxyProvider.proxySelector)) |
| 89 | + .setDefaultCredentialsProvider(SystemDefaultCredentialsProvider()) |
| 90 | + .setSSLHostnameVerifier { hostname, sslSession -> |
| 91 | + peerCerts = sslSession.peerCertificates |
| 92 | + |
| 93 | + verifierDelegate.verify(hostname, sslSession) |
| 94 | + } |
| 95 | + // prompt user via modal to accept certificate if needed; otherwise need to prompt separately prior to launching flare |
| 96 | + .setSSLContext(CertificateManager.getInstance().sslContext) |
| 97 | + |
| 98 | + // client request will fail if user did not accept cert |
| 99 | + client.build().use { it.execute(RequestBuilder.options(uri).build()) } |
| 100 | + |
| 101 | + val certificates = peerCerts as Array<X509Certificate> |
| 102 | + |
| 103 | + // java default + custom system |
| 104 | + // excluding leaf cert for case where user has both leaf and issuing CA as trusted roots |
| 105 | + val allAccepted = CertificateManager.getInstance().trustManager.acceptedIssuers.toSet() - certificates.first() |
| 106 | + val ks = keystoreFromCertificates(allAccepted) |
| 107 | + |
| 108 | + // if this throws then there is a bug because it passed PKIX validation in apache client |
| 109 | + val trustChain = try { |
| 110 | + resolveTrustChain(certificates.toList(), ks) |
| 111 | + } catch (e: Exception) { |
| 112 | + // Java PKIX is happy with leaf cert in certification path, but Node.JS will not respect in NODE_CA_CERTS |
| 113 | + LOG.warn(e) { "Passed Apache PKIX verification but could not build trust anchor via CertPathBuilder? maybe user accepted leaf cert but not root" } |
| 114 | + emptyList() |
| 115 | + } |
| 116 | + |
| 117 | + // if trust chain is empty, then somehow user only trusts the leaf cert??? |
| 118 | + return trustChain.ifEmpty { |
| 119 | + // so return the served certificate chain from the server and hope that works |
| 120 | + certificates.toList() |
| 121 | + } |
| 122 | + } |
| 123 | + |
| 124 | + fun certsToPem(certs: List<X509Certificate>): String = |
| 125 | + buildList { |
| 126 | + certs.forEach { |
| 127 | + add("-----BEGIN CERTIFICATE-----") |
| 128 | + add(Base64.getMimeEncoder(64, System.lineSeparator().toByteArray()).encodeToString(it.encoded)) |
| 129 | + add("-----END CERTIFICATE-----") |
| 130 | + } |
| 131 | + }.joinToString(separator = System.lineSeparator()) |
| 132 | + |
| 133 | + private fun keystoreFromCertificates(certificates: Collection<X509Certificate>): KeyStore { |
| 134 | + val ks = KeyStore.getInstance(KeyStore.getDefaultType()) |
| 135 | + ks.load(null, null) |
| 136 | + certificates.forEachIndexed { index, cert -> |
| 137 | + ks.setCertificateEntry( |
| 138 | + cert.subjectX500Principal.toString() + "-" + DigestUtil.sha256Hex(cert.encoded), |
| 139 | + cert |
| 140 | + ) |
| 141 | + } |
| 142 | + return ks |
| 143 | + } |
| 144 | +} |
0 commit comments