cthrace/open-keychain
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Okhttp3 cleanups, docs, and fix timeouts for default client

Browse Source
This commit is contained in:
Dominik Schürmann
2016-04-09 11:53:37 +02:00
parent 4edb805ba1
commit 2d762e55da
5 changed files with 41 additions and 29 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
OpenKeychain/src/main/java/org/sufficientlysecure/keychain/linked/LinkedTokenResource.java
View File

@@ -241,11 +241,11 @@ public abstract class LinkedTokenResource extends LinkedResource {
public static String getResponseBody(Request request, String... pins) public static String getResponseBody(Request request, String... pins)
throws IOException, HttpStatusException { throws IOException, HttpStatusException {
Log.d("Connection to: "+request.url().url().getHost(),""); Log.d("Connection to: " + request.url().url().getHost(), "");
OkHttpClient client; OkHttpClient client;
if(pins !=null){ if (pins != null) {
client = OkHttpClientFactory.getPinnedSimpleClient(getCertificatePinner(request.url().url().getHost(),pins)); client = OkHttpClientFactory.getPinnedSimpleClient(getCertificatePinner(request.url().url().getHost(), pins));
}else{ } else {
client = OkHttpClientFactory.getSimpleClient(); client = OkHttpClientFactory.getSimpleClient();
} }

2
OpenKeychain/src/main/java/org/sufficientlysecure/keychain/ui/dialog/AddEditKeyserverDialogFragment.java
View File

@@ -356,7 +356,7 @@ public class AddEditKeyserverDialogFragment extends DialogFragment implements On
OkHttpClient client = OkHttpClientFactory.getPinnedClient(newKeyserver.toURL(), proxy); OkHttpClient client = OkHttpClientFactory.getPinnedClient(newKeyserver.toURL(), proxy);
if (onlyTrustedKeyserver if (onlyTrustedKeyserver
&& TlsHelper.getPinnedSslSocketFactory(newKeyserver.toURL())==null) { && TlsHelper.getPinnedSslSocketFactory(newKeyserver.toURL()) == null) {
Log.w(Constants.TAG, "No pinned certificate for this host in OpenKeychain's assets."); Log.w(Constants.TAG, "No pinned certificate for this host in OpenKeychain's assets.");
reason = FailureReason.NO_PINNED_CERTIFICATE; reason = FailureReason.NO_PINNED_CERTIFICATE;
return reason; return reason;

51
OpenKeychain/src/main/java/org/sufficientlysecure/keychain/util/OkHttpClientFactory.java
View File

@@ -1,57 +1,74 @@
package org.sufficientlysecure.keychain.util; /*
* Copyright (C) 2016 Michał Kępkowski
*
* This program is free software: you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by
* the Free Software Foundation, either version 3 of the License, or
* (at your option) any later version.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details.
*
* You should have received a copy of the GNU General Public License
* along with this program. If not, see <http://www.gnu.org/licenses/>.
*/
import okhttp3.CertificatePinner; package org.sufficientlysecure.keychain.util;
import okhttp3.OkHttpClient;
import org.sufficientlysecure.keychain.Constants;
import java.io.IOException; import java.io.IOException;
import java.net.Proxy; import java.net.Proxy;
import java.net.URL; import java.net.URL;
import java.util.concurrent.TimeUnit; import java.util.concurrent.TimeUnit;
/** import okhttp3.CertificatePinner;
* Created by Michał Kępkowski on 11/03/16. import okhttp3.OkHttpClient;
*/
public class OkHttpClientFactory { public class OkHttpClientFactory {
private static OkHttpClient client; private static OkHttpClient client;
public static OkHttpClient getSimpleClient(){ public static OkHttpClient getSimpleClient() {
if(client == null){ if (client == null) {
client = new OkHttpClient.Builder() client = new OkHttpClient.Builder()
.connectTimeout(30000, TimeUnit.MILLISECONDS) .connectTimeout(5000, TimeUnit.MILLISECONDS)
.readTimeout(45000, TimeUnit.MILLISECONDS) .readTimeout(25000, TimeUnit.MILLISECONDS)
.build(); .build();
} }
return client; return client;
} }
public static OkHttpClient getPinnedSimpleClient(CertificatePinner pinner){ public static OkHttpClient getPinnedSimpleClient(CertificatePinner pinner) {
return new OkHttpClient.Builder() return new OkHttpClient.Builder()
.connectTimeout(30000, TimeUnit.MILLISECONDS) .connectTimeout(5000, TimeUnit.MILLISECONDS)
.readTimeout(45000, TimeUnit.MILLISECONDS) .readTimeout(25000, TimeUnit.MILLISECONDS)
.certificatePinner(pinner) .certificatePinner(pinner)
.build(); .build();
} }
public static OkHttpClient getPinnedClient(URL url, Proxy proxy) throws IOException, TlsHelper.TlsHelperException { public static OkHttpClient getPinnedClient(URL url, Proxy proxy) throws IOException, TlsHelper.TlsHelperException {
return new OkHttpClient.Builder() return new OkHttpClient.Builder()
// don't follow any redirects for keyservers, as discussed in the security audit
.followRedirects(false) .followRedirects(false)
.followSslRedirects(false) .followSslRedirects(false)
.proxy(proxy) .proxy(proxy)
// higher timeouts for Tor
.connectTimeout(30000, TimeUnit.MILLISECONDS) .connectTimeout(30000, TimeUnit.MILLISECONDS)
.readTimeout(45000, TimeUnit.MILLISECONDS) .readTimeout(45000, TimeUnit.MILLISECONDS)
// use pinned cert with SocketFactory
.sslSocketFactory(TlsHelper.getPinnedSslSocketFactory(url)) .sslSocketFactory(TlsHelper.getPinnedSslSocketFactory(url))
.build(); .build();
} }
public static OkHttpClient getClient( Proxy proxy) throws IOException, TlsHelper.TlsHelperException { public static OkHttpClient getClient(Proxy proxy) throws IOException, TlsHelper.TlsHelperException {
return new OkHttpClient.Builder() return new OkHttpClient.Builder()
// don't follow any redirects for keyservers, as discussed in the security audit
.followRedirects(false) .followRedirects(false)
.followSslRedirects(false) .followSslRedirects(false)
.proxy(proxy) .proxy(proxy)
// higher timeouts for Tor
.connectTimeout(30000, TimeUnit.MILLISECONDS) .connectTimeout(30000, TimeUnit.MILLISECONDS)
.readTimeout(45000, TimeUnit.MILLISECONDS) .readTimeout(45000, TimeUnit.MILLISECONDS)
.build(); .build();

5
OpenKeychain/src/main/java/org/sufficientlysecure/keychain/util/OkHttpKeybaseClient.java
View File

@@ -24,6 +24,7 @@ import okhttp3.OkHttpClient;
import okhttp3.OkUrlFactory; import okhttp3.OkUrlFactory;
import okhttp3.Request; import okhttp3.Request;
import okhttp3.Response; import okhttp3.Response;
import org.sufficientlysecure.keychain.Constants; import org.sufficientlysecure.keychain.Constants;
import java.io.IOException; import java.io.IOException;
@@ -36,8 +37,6 @@ import java.net.URLConnection;
*/ */
public class OkHttpKeybaseClient implements KeybaseUrlConnectionClient { public class OkHttpKeybaseClient implements KeybaseUrlConnectionClient {
@Override @Override
public Response getUrlResponse(URL url, Proxy proxy, boolean isKeybase) throws IOException { public Response getUrlResponse(URL url, Proxy proxy, boolean isKeybase) throws IOException {
OkHttpClient client = null; OkHttpClient client = null;
@@ -58,7 +57,7 @@ public class OkHttpKeybaseClient implements KeybaseUrlConnectionClient {
Request request = new Request.Builder() Request request = new Request.Builder()
.url(url).build(); .url(url).build();
okhttp3.Response okResponse = client.newCall(request).execute(); okhttp3.Response okResponse = client.newCall(request).execute();
return new Response(okResponse.body().byteStream(),okResponse.code(),okResponse.message(), okResponse.headers().toMultimap()); return new Response(okResponse.body().byteStream(), okResponse.code(), okResponse.message(), okResponse.headers().toMultimap());
} }
@Override @Override

4
OpenKeychain/src/main/java/org/sufficientlysecure/keychain/util/TlsHelper.java
View File

@@ -19,8 +19,6 @@ package org.sufficientlysecure.keychain.util;
import android.content.res.AssetManager; import android.content.res.AssetManager;
import okhttp3.OkHttpClient;
import org.sufficientlysecure.keychain.Constants; import org.sufficientlysecure.keychain.Constants;
import java.io.ByteArrayInputStream; import java.io.ByteArrayInputStream;
@@ -93,7 +91,6 @@ public class TlsHelper {
* Therefore a builder that is pinned this way should be used to only make requests to URLs with passed certificate. * Therefore a builder that is pinned this way should be used to only make requests to URLs with passed certificate.
* *
* @param certificate certificate to pin * @param certificate certificate to pin
* @param builder OkHttpBuilder to enforce pinning on
* @throws TlsHelperException * @throws TlsHelperException
* @throws IOException * @throws IOException
*/ */
@@ -125,7 +122,6 @@ public class TlsHelper {
context.init(null, tmf.getTrustManagers(), null); context.init(null, tmf.getTrustManagers(), null);
return context.getSocketFactory(); return context.getSocketFactory();
//builder.sslSocketFactory(context.getSocketFactory());
} catch (CertificateException | KeyStoreException | KeyManagementException | NoSuchAlgorithmException e) { } catch (CertificateException | KeyStoreException | KeyManagementException | NoSuchAlgorithmException e) {
throw new TlsHelperException(e); throw new TlsHelperException(e);
} }