include default trust store to result from get_ca_certs and cet_store_stats

Author: tomasstupka

graalpython/com.oracle.graal.python/src/com/oracle/graal/python/builtins/objects/ssl/PSSLContext.java

@@ -77,6 +77,7 @@
 import java.security.cert.X509Certificate;
 import java.util.Collection;
 import java.util.EnumSet;
+import java.util.Enumeration;
 import java.util.HashSet;
 import java.util.List;
 import java.util.Set;
@@ -124,7 +125,7 @@ public PSSLContext(Object cls, Shape instanceShape, SSLMethod method, int verify
     }
 
     @TruffleBoundary
-    public KeyStore getCAKeyStore() throws KeyStoreException, IOException, NoSuchAlgorithmException, CertificateException {
+    private KeyStore getCAKeyStore() throws KeyStoreException, IOException, NoSuchAlgorithmException, CertificateException {
         if (caKeystore == null) {
             caKeystore = KeyStore.getInstance("JKS");
 
@@ -142,6 +143,25 @@ private KeyStore getChainKeyStore() throws KeyStoreException, IOException, NoSuc
         return chainKeystore;
     }
 
+    @TruffleBoundary
+    public List<X509Certificate> getCACerts() throws KeyStoreException, NoSuchAlgorithmException {
+        List<X509Certificate> result = new ArrayList<>();
+        if (caKeystore != null) {
+            Enumeration<String> aliases = caKeystore.aliases();
+            while (aliases.hasMoreElements()) {
+                X509Certificate cert = (X509Certificate) caKeystore.getCertificate(aliases.nextElement());
+                result.add(cert);
+            }
+        }
+        if (useDefaultTrustStore) {
+            X509ExtendedTrustManager tm = getDefaultTrustManager();
+            for (X509Certificate cert : tm.getAcceptedIssuers()) {
+                result.add(cert);
+            }
+        }
+        return result;
+    }
+
     public SSLMethod getMethod() {
         return method;
     }
@@ -174,7 +194,7 @@ void setCertChain(PrivateKey pk, char[] password, X509Certificate[] certs) throw
     }
 
     void init() throws KeyStoreException, NoSuchAlgorithmException, UnrecoverableKeyException, KeyManagementException, InvalidAlgorithmParameterException, IOException, CertificateException {
-        X509ExtendedTrustManager defaultTrustManager = getDefaultTrustManagers();
+        X509ExtendedTrustManager defaultTrustManager = getDefaultTrustManager();
         X509ExtendedTrustManager trustManager = getX509ExtendedTrustManager(getTrustManagerFactory(getCAKeyStore()).getTrustManagers());
         TrustManager tm = new DelegateTrustManager(trustManager, defaultTrustManager, verifyMode);
 
@@ -188,7 +208,7 @@ void init() throws KeyStoreException, NoSuchAlgorithmException, UnrecoverableKey
         context.init(kms, new TrustManager[]{tm}, null);
     }
 
-    private X509ExtendedTrustManager getDefaultTrustManagers() throws KeyStoreException, NoSuchAlgorithmException {
+    private X509ExtendedTrustManager getDefaultTrustManager() throws KeyStoreException, NoSuchAlgorithmException {
         if (useDefaultTrustStore) {
             TrustManagerFactory tmf = getTrustManagerFactory();
             tmf.init((KeyStore) null);

graalpython/com.oracle.graal.python/src/com/oracle/graal/python/builtins/objects/ssl/SSLContextBuiltins.java

@@ -52,19 +52,16 @@
 import java.nio.charset.StandardCharsets;
 import java.security.InvalidAlgorithmParameterException;
 import java.security.KeyManagementException;
-import java.security.KeyStore;
 import java.security.KeyStoreException;
 import java.security.NoSuchAlgorithmException;
 import java.security.PrivateKey;
 import java.security.UnrecoverableKeyException;
 import java.security.cert.CRLException;
-import java.security.cert.Certificate;
 import java.security.cert.CertificateException;
 import java.security.cert.X509Certificate;
 import java.security.spec.InvalidKeySpecException;
 import java.util.ArrayList;
 import java.util.Collections;
-import java.util.Enumeration;
 import java.util.List;
 import java.util.logging.Level;
 
@@ -125,6 +122,8 @@
 import com.oracle.truffle.api.frame.VirtualFrame;
 import com.oracle.truffle.api.interop.UnsupportedMessageException;
 import com.oracle.truffle.api.library.CachedLibrary;
+import java.security.cert.CertificateEncodingException;
+import java.security.cert.CertificateParsingException;
 
 @CoreFunctions(extendClasses = PythonBuiltinClassType.PSSLContext)
 public class SSLContextBuiltins extends PythonBuiltins {
@@ -629,24 +628,15 @@ abstract static class CertStoreStatsNode extends PythonUnaryBuiltinNode {
         @Specialization
         Object storeStats(PSSLContext self) {
             try {
-                KeyStore keystore = self.getCAKeyStore();
-                Enumeration<String> aliases = keystore.aliases();
                 int x509 = 0, crl = 0, ca = 0;
-                while (aliases.hasMoreElements()) {
-                    String alias = aliases.nextElement();
-                    if (keystore.isCertificateEntry(alias)) {
-                        Certificate cert = keystore.getCertificate(alias);
-                        if (cert instanceof X509Certificate) {
-                            X509Certificate x509Cert = (X509Certificate) cert;
-                            boolean[] keyUsage = ((X509Certificate) cert).getKeyUsage();
-                            if (CertUtils.isCrl(keyUsage)) {
-                                crl++;
-                            } else {
-                                x509++;
-                                if (CertUtils.isCA(x509Cert, keyUsage)) {
-                                    ca++;
-                                }
-                            }
+                for (X509Certificate cert : self.getCACerts()) {
+                    boolean[] keyUsage = cert.getKeyUsage();
+                    if (CertUtils.isCrl(keyUsage)) {
+                        crl++;
+                    } else {
+                        x509++;
+                        if (CertUtils.isCA(cert, keyUsage)) {
+                            ca++;
                         }
                     }
                 }
@@ -995,16 +985,13 @@ abstract static class GetCACerts extends PythonBinaryClinicBuiltinNode {
         Object getCerts(PSSLContext self, @SuppressWarnings("unused") boolean binary_form) {
             try {
                 List<PDict> result = new ArrayList<>();
-                KeyStore ks = self.getCAKeyStore();
-                Enumeration<String> aliases = ks.aliases();
-                while (aliases.hasMoreElements()) {
-                    X509Certificate cert = (X509Certificate) ks.getCertificate(aliases.nextElement());
+                for (X509Certificate cert : self.getCACerts()) {
                     if (CertUtils.isCA(cert, cert.getKeyUsage())) {
                         result.add(CertUtils.decodeCertificate(cert));
                     }
                 }
                 return factory().createList(result.toArray(new Object[result.size()]));
-            } catch (KeyStoreException | IOException | NoSuchAlgorithmException | CertificateException ex) {
+            } catch (KeyStoreException | NoSuchAlgorithmException | IOException | CertificateParsingException ex) {
                 throw PRaiseSSLErrorNode.raiseUncached(this, SSLErrorCode.ERROR_SSL, ex);
             }
         }
@@ -1014,16 +1001,13 @@ Object getCerts(PSSLContext self, @SuppressWarnings("unused") boolean binary_for
         Object getCertsBinary(PSSLContext self, @SuppressWarnings("unused") boolean binary_form) {
             try {
                 List<PBytes> result = new ArrayList<>();
-                KeyStore ks = self.getCAKeyStore();
-                Enumeration<String> aliases = ks.aliases();
-                while (aliases.hasMoreElements()) {
-                    X509Certificate cert = (X509Certificate) ks.getCertificate(aliases.nextElement());
+                for (X509Certificate cert : self.getCACerts()) {
                     if (CertUtils.isCA(cert, cert.getKeyUsage())) {
                         result.add(factory().createBytes(cert.getEncoded()));
                     }
                 }
                 return factory().createList(result.toArray(new Object[result.size()]));
-            } catch (KeyStoreException | IOException | NoSuchAlgorithmException | CertificateException ex) {
+            } catch (KeyStoreException | NoSuchAlgorithmException | CertificateEncodingException ex) {
                 throw PRaiseSSLErrorNode.raiseUncached(this, SSLErrorCode.ERROR_SSL, ex);
             }
         }