Added new functionality ==> exceptions.sites

[patris70]

You can using Domain Wildcard "*" in Exception.Sites Liste for System but not for User.
A port number is required only if the default port is not used (default http port is 80 and https port is 443).

(Thanks Justin Reock, and John Saboe)

**Changes for exceptions.sites functionality:

New Class netx/net/sourceforge/jnlp/security/appletextendedsecurity/ExceptionSitesStorage.java**

Responsible for parsing exception.sites files and providing methods to check for exceptions. Can read exceptions from both regular files and files contained within .jar archives.

Exceptions can be in the form of website URL wildcard matches as well as SHA-256 certificate fingerprint matches for applets.

ExceptionSitesStorage.zip

Updates to netx/net/sourceforge/jnlp/config/DeploymentConfiguration.java

Add three new keys to pull in properties for System exception file and .jars and User exception file on line 136:

public static final String KEY_USER_SECURITY_EXCEPTION_SITES = "deployment.user.security.exception.sites"; public static final String KEY_SYSTEM_SECURITY_EXCEPTION_SITES = "deployment.system.security.exception.sites"; public static final String KEY_SYSTEM_SECURITY_EXCEPTION_SITES_JAR = "deployment.system.security.exception.sites.jar";

Updates to netx/net/sourceforge/jnlp/config/Defaults.java

Add validators and key references for exception.sites keys to configuration object array at line 192:

{ DeploymentConfiguration.KEY_SYSTEM_SECURITY_EXCEPTION_SITES, BasicValueValidators.getFilePathValidator(), null }, { DeploymentConfiguration.KEY_SYSTEM_SECURITY_EXCEPTION_SITES_JAR, BasicValueValidators.getFilePathValidator(), String.valueOf("") }, { DeploymentConfiguration.KEY_USER_SECURITY_EXCEPTION_SITES, BasicValueValidators.getFilePathValidator(), String.valueOf("") },

Updates to netx/net/sourceforge/jnlp/runtime/JNLPClassLoader.java

Add exception check to bypass Security Warning for Unsigned Applets based on certificate match or URL match on line 1143.

JNLPClassLoader.zip

Updates to netx/net/sourceforge/jnlp/runtime/ManifestAttributesChecker.java

Add exception sites check before call to Security Warning dialog for missing “permissions” attribute at line 290 and Add similar check to Security Warning for missing ALAC Attribute on line 440::

ManifestAttributesChecker.zip

Changes to netx/net/sourceforge/jnlp/tools/CertInformation.java

Allow for returning Cert fingerprint for the SHA-256 certificate matching Line 70:

private String fingerprint = "";

Getter method for fingerprint at line 159:

public String getFingerprint() { return this.fingerprint; }

Setter method for fingerprint at line 257:

public void setFingerprint(String fprint) { this.fingerprint = fprint; }

Changes to netx/net/sourceforge/jnlp/tools/JarCertVerifier.java

Changes to extract SHA-256 fingerprint from Certificate on line 144:

private static String getThumbprint(X509Certificate cert) throws NoSuchAlgorithmException, CertificateEncodingException { MessageDigest md = MessageDigest.getInstance("SHA-256"); byte[] der = cert.getEncoded(); md.update(der); byte[] digest = md.digest(); String digestHex = DatatypeConverter.printHexBinary(digest); return digestHex.toUpperCase(); }

Changes to add fingerprint to certificate information on line 407:

certInfo.setFingerprint(getThumbprint((X509Certificate) cert));

Add Site Exception Viewer to Control Panel

Adds a new panel inside the IcedTea-Web Control Panel to allow viewing of site exceptions from .jar file and/or exception.sites file:

New Class netx/net/sourceforge/jnlp/controlpanel/ExceptionsPanel.java
New class to draw the panel that views the site exceptions:

ExceptionsPanel.zip

**Localization Changes – Add English, Czech, German, and Polish panel titles:

Changes to netx/net/sourceforge/jnlp/resources/Messages.properties:**
Add English Title for Exceptions Panel at line 665:

CPTabExceptions=Exception Sites

Changes to netx/net/sourceforge/jnlp/resources/Messages_cs.properties:
Add Czech Title for Exceptions Panel at line 621

CPTabExceptions=Stranky Vyjimek

Changes to netx/net/sourceforge/jnlp/resources/Messages_de.properties:
Add German Title for Exceptions Panel at line 620

CPTabExceptions=Ausnahmeliste

Changes to netx/net/sourceforge/jnlp/resources/Messages_pl.properties:
Add Polish Title for Exceptions Panel at line 463

CPTabExceptions=Witryny Wyjatkow

Changes to netx/net/sourceforge/jnlp/controlpanel/ControlPanel.java

Add new panel at line 258:

private JPanel createExceptionsPanel() { return new ExceptionsPanel(); }

Screenshot:

System Exception.Sites:

User Exception.Sites

[hendrikebbers]

Hi @patris70 can you do a Pull Request instead of adding classes as Zips? If you do not know how to create a Pull Request just ping me and I can give you an introduction :)

[patris70]

Hi @hendrikebbers,
Yes, please help me, i do not know. :)

Thanks

[Archimedes5000]

Is this really a Pull Request ? The Classes are still for ITW 1.7 / 1.8. In my opinion patris70 needs help to integrate this classes into ITW 2.0. See also case #392.

[StewartK613]

So, by modifying the files noted above (and adding one as well) this will give the functionality of vetting SHA256 signed JAR files to run? Newbie here, thanks

[patris70]

Hi @StewartK613,
yes, but you can add SHA256 in SYSTEM EXCEPTION file NOT in USER EXCEPTION.
hope to help
Regards

[StewartK613]

Thats perfect. I may have a few more questions, if thats OK. I'll start making the modifications
Thanks patris70

[patris70]

@StewartK613,
you cal always write you questions.

Regads

[StewartK613]

Quick question, the line numbers you have indicated above, I am to replace that line with the information you have given? In some cases, it looks as tho I will be breaking the syntax of the current line
Thanks

[patris70]

@StewartK613,

please use my zip files.

Regards

[StewartK613]

OK thanks

[StewartK613]

Do you have the other ZIP files available (JarCertVerifier.java , CertInformation.java, etc)
And again, thanks for your time

[StewartK613]

how do I get the itweb wettings to recognize the new settings in netx.src?
Thanks

[sid9var]

Hello All. I have a QQ on the public availability of ITW 2.0

Is there a date set already for this? Thanks!

[sclassen]

No, there is currently nobody working on setting up a build for creating an executable binary and an installer.
There exists https://openwebstart.com which is based on the 2.0 branch

[dhirenjoshi]

Hi Team,
I will be starting to work on the DeploymentRuleSet. Before I start, I wanted to check with all if any part has been partially been started/completed by any team members. patris70 had worked on it to some extent as I can see from comments above.
I have connected with sclassen in emails back and forth .
@patris70, Can you please explain what all functionality did you end up implementing ? Thanks

DeploymentRuleSet functionality as I understand :

1. XML based file which gets saved to signed jar.
2. Provide a panel to upload the signed jar.
3. Provide checks to verify medium and low security access is provided to vetted sites added in DeploymentRuleSet.
4. For number 3, I will need help finding which code in jdk or sun packages will help me implement this ?
   With these 4 items, DeploymentRuleSet can be implemented .Please feel free to add to this requirement to make it better if I missed any parts of the DeploymentRuleSet as I understand it.

[patris70]

Hi @dhirenjoshi,

1. File name is ExceptionSites.jar and path name is C:\Windows\Sun\Java\Deployment
2. No, why do you need panel for upload ExceptionSites.jar file?
3. Same function (not %100) as Oracle DeploymentRuleset
4. This code is not on jdk Source Code (oracle has this code), my code is in Icedtea-Web source code

hope to help

[dhirenjoshi]

I have several questions and would be grateful if u can provide me some answers to them. 1.So for exception site, how does one implement it as a signed jar? 2.What xml or delimited format does the file need to have and ? 3.How can this signed jar be controlled so that only the signer can update the new exception sites? 4.Does exception site whitelusting permit low medium security web sites accessubility as well? All these questions r answered the way Oracle implemented DeploymentRuleset. Thanks Dhiren

…

On Tue, Feb 23, 2021, 3:53 AM patris70 ***@***.***> wrote: Hi @dhirenjoshi <https://github.com/dhirenjoshi>, 1. File name is ExceptionSites.jar and path name is C:\Windows\Sun\Java\Deployment 2. No, why do you need panel for upload ExceptionSites.jar file? 3. Same function (not %100) as Oracle DeploymentRuleset 4. This code is not on jdk Source Code (oracle has this code), my code is in Icedtea-Web source code hope to help — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#394 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/ABZX4USKVYE7SQ23IPBMPGDTAN3IZANCNFSM4ITFDLWA> .