feat(app): Schloss-Symbol fuer die Verbindung + abgelaufenes Zertifikat erlaubbar
Neben dem Zahnrad zeigt ein Schloss, wie sicher die Verbindung zu ARIA ist: Schloss = verschluesselt und in Ordnung, Schloss mit ! = Zertifikat-Problem (abgelaufen oder abgelehnt), durchgestrichen = unverschluesselt (TLS-Fallback oder so eingestellt). Antippen erklaert es in einfachen Worten; einmal pro App-Start kommt ein Hinweis, wenn das Zertifikat abgelaufen ist. Einstellungen → Verbindung: "Abgelaufenes Zertifikat akzeptieren". Toleriert GENAU das Ablaufdatum: die Kette wird zum Zeitpunkt kurz vor dem Ablauf gegen die System-CAs geprueft, der Hostname weiter von OkHttp. Selbstsignierte oder fremde Zertifikate kommen auch mit Schalter nicht durch (gegen das echte, abgelaufene RVS-Zertifikat und badssl.com getestet). Gilt fuer WebSocket und fetch (z.B. App-Update vom RVS). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This commit is contained in:
Claude Opus 5.5
@@ -26,6 +26,7 @@ class MainApplication : Application(), ReactApplication {
|
||||
add(PhoneCallPackage())
|
||||
add(BackgroundAudioPackage())
|
||||
add(ShareIntentPackage())
|
||||
add(TlsTrustPackage())
|
||||
}
|
||||
|
||||
override fun getJSMainModuleName(): String = "index"
|
||||
@@ -42,6 +43,8 @@ class MainApplication : Application(), ReactApplication {
|
||||
override fun onCreate() {
|
||||
super.onCreate()
|
||||
SoLoader.init(this, false)
|
||||
// Vor der ersten Verbindung: Zertifikatspruefung (abgelaufen erlaubt?)
|
||||
TlsTrust.install(this)
|
||||
if (BuildConfig.IS_NEW_ARCHITECTURE_ENABLED) {
|
||||
// If you opted-in for the New Architecture, we load the native entry point for this app.
|
||||
load()
|
||||
|
||||
@@ -0,0 +1,185 @@
|
||||
package com.ariacockpit
|
||||
|
||||
import android.content.Context
|
||||
import com.facebook.react.bridge.Arguments
|
||||
import com.facebook.react.bridge.Promise
|
||||
import com.facebook.react.bridge.ReactApplicationContext
|
||||
import com.facebook.react.bridge.ReactContextBaseJavaModule
|
||||
import com.facebook.react.bridge.ReactMethod
|
||||
import com.facebook.react.modules.network.NetworkingModule
|
||||
import com.facebook.react.modules.websocket.WebSocketModule
|
||||
import java.net.Socket
|
||||
import java.security.KeyStore
|
||||
import java.security.cert.CertPathValidator
|
||||
import java.security.cert.CertificateException
|
||||
import java.security.cert.CertificateExpiredException
|
||||
import java.security.cert.CertificateFactory
|
||||
import java.security.cert.PKIXParameters
|
||||
import java.security.cert.X509Certificate
|
||||
import java.util.Date
|
||||
import javax.net.ssl.SSLContext
|
||||
import javax.net.ssl.SSLEngine
|
||||
import javax.net.ssl.TrustManagerFactory
|
||||
import javax.net.ssl.X509ExtendedTrustManager
|
||||
import javax.net.ssl.X509TrustManager
|
||||
|
||||
/**
|
||||
* Zertifikatspruefung fuer RVS-Verbindung (WebSocket) und fetch.
|
||||
*
|
||||
* Normal pruefen wir wie Android selbst. Mit dem Schalter "Abgelaufenes
|
||||
* Zertifikat akzeptieren" wird GENAU EIN Fehler toleriert: das Ablaufdatum.
|
||||
* Kette und Aussteller werden dann zum Zeitpunkt kurz vor dem Ablauf geprueft
|
||||
* (war das Zertifikat damals gueltig, ist es echt), der Hostname prueft OkHttp
|
||||
* ohnehin separat. Ein fremdes oder selbstgebautes Zertifikat kommt also auch
|
||||
* mit Schalter nicht durch — sonst koennte sich jeder dazwischenhaengen.
|
||||
*
|
||||
* Nebenbei merkt sich das Modul, wie die letzte Pruefung ausging, damit die
|
||||
* App das Schloss-Symbol richtig zeigen kann.
|
||||
*/
|
||||
object TlsTrust {
|
||||
private const val PREFS = "aria_tls"
|
||||
private const val KEY_ALLOW_EXPIRED = "allow_expired"
|
||||
|
||||
// ok | expired_accepted | expired | invalid | unknown
|
||||
@Volatile var lastStatus: String = "unknown"
|
||||
@Volatile var lastDetail: String = ""
|
||||
@Volatile var lastNotAfter: Long = 0
|
||||
@Volatile var lastSubject: String = ""
|
||||
@Volatile var allowExpired: Boolean = false
|
||||
private set
|
||||
|
||||
private var appContext: Context? = null
|
||||
|
||||
fun install(context: Context) {
|
||||
appContext = context.applicationContext
|
||||
allowExpired = context.getSharedPreferences(PREFS, Context.MODE_PRIVATE)
|
||||
.getBoolean(KEY_ALLOW_EXPIRED, false)
|
||||
try {
|
||||
val tm = ExpiryTolerantTrustManager(defaultTrustManager())
|
||||
val ssl = SSLContext.getInstance("TLS").apply { init(null, arrayOf(tm), null) }
|
||||
val factory = ssl.socketFactory
|
||||
WebSocketModule.setCustomClientBuilder { b -> b.sslSocketFactory(factory, tm) }
|
||||
NetworkingModule.setCustomClientBuilder { b -> b.sslSocketFactory(factory, tm) }
|
||||
} catch (e: Exception) {
|
||||
// Lieber normale Pruefung als gar keine Verbindung
|
||||
android.util.Log.w("TlsTrust", "Eigene Zertifikatspruefung nicht aktiv: ${e.message}")
|
||||
}
|
||||
}
|
||||
|
||||
fun saveAllowExpired(value: Boolean) {
|
||||
allowExpired = value
|
||||
appContext?.getSharedPreferences(PREFS, Context.MODE_PRIVATE)
|
||||
?.edit()?.putBoolean(KEY_ALLOW_EXPIRED, value)?.apply()
|
||||
}
|
||||
|
||||
private fun defaultTrustManager(): X509TrustManager {
|
||||
val tmf = TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm())
|
||||
tmf.init(null as KeyStore?)
|
||||
return tmf.trustManagers.filterIsInstance<X509TrustManager>().first()
|
||||
}
|
||||
|
||||
private fun remember(status: String, chain: Array<X509Certificate>?, detail: String = "") {
|
||||
lastStatus = status
|
||||
lastDetail = detail
|
||||
val leaf = chain?.firstOrNull()
|
||||
lastNotAfter = leaf?.notAfter?.time ?: 0
|
||||
lastSubject = leaf?.subjectX500Principal?.name ?: ""
|
||||
}
|
||||
|
||||
private fun isExpired(chain: Array<X509Certificate>): Boolean =
|
||||
chain.any { c ->
|
||||
try { c.checkValidity(); false } catch (_: CertificateExpiredException) { true } catch (_: Exception) { false }
|
||||
}
|
||||
|
||||
/** Kette gegen die System-Zertifizierungsstellen pruefen — zum Zeitpunkt
|
||||
* kurz vor dem fruehesten Ablauf in der Kette. */
|
||||
private fun chainValidBeforeExpiry(chain: Array<X509Certificate>) {
|
||||
val ks = KeyStore.getInstance("AndroidCAStore").apply { load(null) }
|
||||
val params = PKIXParameters(ks).apply {
|
||||
isRevocationEnabled = false
|
||||
date = Date(chain.minOf { it.notAfter.time } - 60_000)
|
||||
}
|
||||
// Mitgeschickte Wurzel (selbstsigniert) gehoert nicht in den Pfad — aber NIE
|
||||
// das Server-Zertifikat selbst: ein leerer Pfad gilt als gueltig, ein
|
||||
// selbstgebautes Zertifikat kaeme sonst durch.
|
||||
if (chain.isEmpty()) throw CertificateException("Leere Zertifikatskette")
|
||||
val path = listOf(chain[0]) + chain.drop(1).filter { it.subjectX500Principal != it.issuerX500Principal }
|
||||
val certPath = CertificateFactory.getInstance("X.509").generateCertPath(path)
|
||||
CertPathValidator.getInstance("PKIX").validate(certPath, params)
|
||||
}
|
||||
|
||||
private class ExpiryTolerantTrustManager(private val inner: X509TrustManager) : X509ExtendedTrustManager() {
|
||||
private val ext = inner as? X509ExtendedTrustManager
|
||||
|
||||
private fun check(chain: Array<X509Certificate>, run: () -> Unit) {
|
||||
try {
|
||||
run()
|
||||
remember("ok", chain)
|
||||
} catch (e: CertificateException) {
|
||||
if (!isExpired(chain)) {
|
||||
remember("invalid", chain, e.message ?: "")
|
||||
throw e
|
||||
}
|
||||
if (!allowExpired) {
|
||||
remember("expired", chain, e.message ?: "")
|
||||
throw e
|
||||
}
|
||||
try {
|
||||
chainValidBeforeExpiry(chain)
|
||||
} catch (inner: Exception) {
|
||||
// Abgelaufen UND sonst nicht in Ordnung → nicht akzeptieren
|
||||
remember("invalid", chain, inner.message ?: "")
|
||||
throw e
|
||||
}
|
||||
remember("expired_accepted", chain)
|
||||
}
|
||||
}
|
||||
|
||||
override fun checkServerTrusted(chain: Array<X509Certificate>, authType: String) =
|
||||
check(chain) { inner.checkServerTrusted(chain, authType) }
|
||||
|
||||
override fun checkServerTrusted(chain: Array<X509Certificate>, authType: String, socket: Socket?) =
|
||||
check(chain) {
|
||||
if (ext != null) ext.checkServerTrusted(chain, authType, socket)
|
||||
else inner.checkServerTrusted(chain, authType)
|
||||
}
|
||||
|
||||
override fun checkServerTrusted(chain: Array<X509Certificate>, authType: String, engine: SSLEngine?) =
|
||||
check(chain) {
|
||||
if (ext != null) ext.checkServerTrusted(chain, authType, engine)
|
||||
else inner.checkServerTrusted(chain, authType)
|
||||
}
|
||||
|
||||
override fun checkClientTrusted(chain: Array<X509Certificate>, authType: String) =
|
||||
inner.checkClientTrusted(chain, authType)
|
||||
|
||||
override fun checkClientTrusted(chain: Array<X509Certificate>, authType: String, socket: Socket?) =
|
||||
if (ext != null) ext.checkClientTrusted(chain, authType, socket) else inner.checkClientTrusted(chain, authType)
|
||||
|
||||
override fun checkClientTrusted(chain: Array<X509Certificate>, authType: String, engine: SSLEngine?) =
|
||||
if (ext != null) ext.checkClientTrusted(chain, authType, engine) else inner.checkClientTrusted(chain, authType)
|
||||
|
||||
override fun getAcceptedIssuers(): Array<X509Certificate> = inner.acceptedIssuers
|
||||
}
|
||||
}
|
||||
|
||||
class TlsTrustModule(reactContext: ReactApplicationContext) : ReactContextBaseJavaModule(reactContext) {
|
||||
override fun getName() = "TlsTrust"
|
||||
|
||||
@ReactMethod
|
||||
fun setAllowExpired(value: Boolean, promise: Promise) {
|
||||
TlsTrust.saveAllowExpired(value)
|
||||
promise.resolve(value)
|
||||
}
|
||||
|
||||
@ReactMethod
|
||||
fun getStatus(promise: Promise) {
|
||||
val m = Arguments.createMap()
|
||||
m.putString("status", TlsTrust.lastStatus)
|
||||
m.putString("detail", TlsTrust.lastDetail)
|
||||
m.putDouble("notAfter", TlsTrust.lastNotAfter.toDouble())
|
||||
m.putString("subject", TlsTrust.lastSubject)
|
||||
m.putBoolean("allowExpired", TlsTrust.allowExpired)
|
||||
promise.resolve(m)
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,16 @@
|
||||
package com.ariacockpit
|
||||
|
||||
import com.facebook.react.ReactPackage
|
||||
import com.facebook.react.bridge.NativeModule
|
||||
import com.facebook.react.bridge.ReactApplicationContext
|
||||
import com.facebook.react.uimanager.ViewManager
|
||||
|
||||
class TlsTrustPackage : ReactPackage {
|
||||
override fun createNativeModules(reactContext: ReactApplicationContext): List<NativeModule> {
|
||||
return listOf(TlsTrustModule(reactContext))
|
||||
}
|
||||
|
||||
override fun createViewManagers(reactContext: ReactApplicationContext): List<ViewManager<*, *>> {
|
||||
return emptyList()
|
||||
}
|
||||
}
|
||||
Reference in New Issue
Block a user