On Thu, 2 Mar 2023 13:33:53 GMT, Matthias Baesken <mbaes...@openjdk.org> wrote:
> After 8278449, we seem to ignore in the call
>
> ` if (SecTrustSettingsCopyTrustSettings(certRef,
> kSecTrustSettingsDomainUser, &trustSettings) == errSecItemNotFound) `
>
> all trusted certs from admin and system domains, so a lot more certs are
> ignored than necessary.
> Probably we should take at least the certs with trust settings from
> kSecTrustSettingsDomainUser, kSecTrustSettingsDomainAdmin and
> kSecTrustSettingsDomainSystem domains .
I'd like to contribute a test.
/*
* Copyright (c) 2023, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License version 2 only, as
* published by the Free Software Foundation.
*
* This code is distributed in the hope that it will be useful, but WITHOUT
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* version 2 for more details (a copy is included in the LICENSE file that
* accompanied this code).
*
* You should have received a copy of the GNU General Public License version
* 2 along with this work; if not, write to the Free Software Foundation,
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
*
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
* or visit www.oracle.com if you need additional information or have any
* questions.
*/
import jdk.test.lib.process.OutputAnalyzer;
import jdk.test.lib.process.ProcessTools;
import java.security.KeyStore;
import java.util.ArrayList;
import java.util.List;
/*
* @test
* @bug 8303465
* @library /test/lib
* @requires os.family == "mac"
* @summary list more trusted certificates
*/
public class ListKeyChain {
public static void main(String[] args) throws Throwable {
List<String> trusted = new ArrayList<>();
populate(true, trusted);
populate(false, trusted);
System.out.println(trusted);
KeyStore ks = KeyStore.getInstance("KEYCHAINSTORE");
ks.load(null, null);
for (String alias : trusted) {
if (!ks.containsAlias(alias)) {
throw new RuntimeException("Not found: " + alias);
}
}
}
static void populate(boolean admin, List<String> trusted) throws Throwable {
OutputAnalyzer output = admin
? ProcessTools.executeProcess("security", "dump-trust-setting",
"-d")
: ProcessTools.executeProcess("security", "dump-trust-setting");
String certName = null;
for (String line : output.shouldHaveExitValue(0).asLines()) {
if (line.startsWith("Cert ")) {
certName = line.split(":", 2)[1].trim().toLowerCase();
} else if (line.contains("Number of trust settings :")) {
if (line.endsWith(": 0")) { // we only list trusted-for-all
certs
trusted.add(certName);
}
}
}
}
}
-------------
PR: https://git.openjdk.org/jdk/pull/12829
