zaproxy / zaproxy/zaproxy

ZAP 2.12 ActivClient Issue

Open
#7,895 9 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

add-on bug in:network
Dominant language
Java
Stars
15.8k
Forks
2.6k
Avg merge
13h 16m
Merged PRs (30d)
17

Description

Describe the bug

With ZAP 2.10 we were able to add CAC/PIV certificates in the keystore by adding the PCKS#11 driver for ActivClient.

ZAP 2.12 displays an error that the driver or password is wrong, the previous functionality is lost.

Steps to reproduce the behavior

Go to Options, Network, Client Certificates, Check "Use Certificate", select PKCS#11, Manage, Add, Select the acpkcs211.dll ActivClient library. Select the driver you just added and enter the CAC pin number, add to keystore.
An error will be displayed: Error, Maybe your PIN or library is wrong.

The same process will work in version 2.10 but not in 2.12

Expected behavior

Expecting ZAP to successfully add the certificate to keystore

Software versions

ZAP 2.12

Screenshots

No response

Errors from the zap.log file
2023-06-06 13:20:12,300 [AWT-EventQueue-0] ERROR ClientCertificatesOptionsPanel - Couldn't add key from ActivClient
java.lang.IllegalAccessException: class org.zaproxy.addon.network.internal.client.KeyStores cannot access class sun.security.pkcs11.SunPKCS11 (in module jdk.crypto.cryptoki) because module jdk.crypto.cryptoki does not export sun.security.pkcs11 to unnamed module @21de929d
	at jdk.internal.reflect.Reflection.newIllegalAccessException(Reflection.java:392) ~[?:?]
	at java.lang.reflect.AccessibleObject.checkAccess(AccessibleObject.java:674) ~[?:?]
	at java.lang.reflect.Method.invoke(Method.java:560) ~[?:?]
	at org.zaproxy.addon.network.internal.client.KeyStores.createPkcs11Provider(KeyStores.java:157) ~[?:?]
	at org.zaproxy.addon.network.internal.client.KeyStores.addPkcs11KeyStore(KeyStores.java:134) ~[?:?]
	at org.zaproxy.addon.network.ClientCertificatesOptionsPanel$KeyStorePanel.addPkcs11KeyStore(ClientCertificatesOptionsPanel.java:708) ~[?:?]
	at org.zaproxy.addon.network.ClientCertificatesOptionsPanel$Pkcs11Panel.lambda$new$2(ClientCertificatesOptionsPanel.java:371) ~[?:?]
	at javax.swing.AbstractButton.fireActionPerformed(AbstractButton.java:1972) ~[?:?]
	at javax.swing.AbstractButton$Handler.actionPerformed(AbstractButton.java:2313) ~[?:?]
	at javax.swing.DefaultButtonModel.fireActionPerformed(DefaultButtonModel.java:405) ~[?:?]
	at javax.swing.DefaultButtonModel.setPressed(DefaultButtonModel.java:262) ~[?:?]
	at javax.swing.plaf.basic.BasicButtonListener.mouseReleased(BasicButtonListener.java:279) ~[?:?]
	at java.awt.Component.processMouseEvent(Component.java:6626) ~[?:?]
	at javax.swing.JComponent.processMouseEvent(JComponent.java:3389) ~[?:?]
	at java.awt.Component.processEvent(Component.java:6391) ~[?:?]
	at java.awt.Container.processEvent(Container.java:2266) ~[?:?]
	at java.awt.Component.dispatchEventImpl(Component.java:5001) ~[?:?]
	at java.awt.Container.dispatchEventImpl(Container.java:2324) ~[?:?]
	at java.awt.Component.dispatchEvent(Component.java:4833) ~[?:?]
	at java.awt.LightweightDispatcher.retargetMouseEvent(Container.java:4948) ~[?:?]
	at java.awt.LightweightDispatcher.processMouseEvent(Container.java:4575) ~[?:?]
	at java.awt.LightweightDispatcher.dispatchEvent(Container.java:4516) ~[?:?]
	at java.awt.Container.dispatchEventImpl(Container.java:2310) ~[?:?]
	at java.awt.Window.dispatchEventImpl(Window.java:2780) ~[?:?]
	at java.awt.Component.dispatchEvent(Component.java:4833) ~[?:?]
	at java.awt.EventQueue.dispatchEventImpl(EventQueue.java:773) ~[?:?]
	at java.awt.EventQueue$4.run(EventQueue.java:722) ~[?:?]
	at java.awt.EventQueue$4.run(EventQueue.java:716) ~[?:?]
	at java.security.AccessController.doPrivileged(AccessController.java:399) ~[?:?]
	at java.security.ProtectionDomain$JavaSecurityAccessImpl.doIntersectionPrivilege(ProtectionDomain.java:86) ~[?:?]
	at java.security.ProtectionDomain$JavaSecurityAccessImpl.doIntersectionPrivilege(ProtectionDomain.java:97) ~[?:?]
	at java.awt.EventQueue$5.run(EventQueue.java:746) ~[?:?]
	at java.awt.EventQueue$5.run(EventQueue.java:744) ~[?:?]
	at java.security.AccessController.doPrivileged(AccessController.java:399) ~[?:?]
	at java.security.ProtectionDomain$JavaSecurityAccessImpl.doIntersectionPrivilege(ProtectionDomain.java:86) ~[?:?]
	at java.awt.EventQueue.dispatchEvent(EventQueue.java:743) ~[?:?]
	at java.awt.EventDispatchThread.pumpOneEventForFilters(EventDispatchThread.java:203) ~[?:?]
	at java.awt.EventDispatchThread.pumpEventsForFilter(EventDispatchThread.java:124) ~[?:?]
	at java.awt.EventDispatchThread.pumpEventsForFilter(EventDispatchThread.java:117) ~[?:?]
	at java.awt.WaitDispatchSupport$2.run(WaitDispatchSupport.java:191) ~[?:?]
	at java.awt.WaitDispatchSupport$4.run(WaitDispatchSupport.java:236) ~[?:?]
	at java.awt.WaitDispatchSupport$4.run(WaitDispatchSupport.java:234) ~[?:?]
	at java.security.AccessController.doPrivileged(AccessController.java:318) ~[?:?]
	at java.awt.WaitDispatchSupport.enter(WaitDispatchSupport.java:234) ~[?:?]
	at java.awt.Dialog.show(Dialog.java:1080) ~[?:?]
	at java.awt.Component.show(Component.java:1728) ~[?:?]
	at java.awt.Component.setVisible(Component.java:1675) ~[?:?]
	at java.awt.Window.setVisible(Window.java:1036) ~[?:?]
	at java.awt.Dialog.setVisible(Dialog.java:1016) ~[?:?]
	at org.parosproxy.paros.extension.AbstractDialog.setVisible(AbstractDialog.java:136) ~[zap-2.12.0.jar:2.12.0]
	at org.parosproxy.paros.view.AbstractParamDialog.showDialog(AbstractParamDialog.java:445) ~[zap-2.12.0.jar:2.12.0]
	at org.parosproxy.paros.control.MenuToolsControl.options(MenuToolsControl.java:74) ~[zap-2.12.0.jar:2.12.0]
	at org.parosproxy.paros.control.MenuToolsControl.options(MenuToolsControl.java:65) ~[zap-2.12.0.jar:2.12.0]
	at org.zaproxy.zap.view.MainToolbarPanel$8.actionPerformed(MainToolbarPanel.java:453) ~[zap-2.12.0.jar:2.12.0]
	at javax.swing.AbstractButton.fireActionPerformed(AbstractButton.java:1972) ~[?:?]
	at javax.swing.AbstractButton$Handler.actionPerformed(AbstractButton.java:2313) ~[?:?]
	at javax.swing.DefaultButtonModel.fireActionPerformed(DefaultButtonModel.java:405) ~[?:?]
	at javax.swing.DefaultButtonModel.setPressed(DefaultButtonModel.java:262) ~[?:?]
	at javax.swing.plaf.basic.BasicButtonListener.mouseReleased(BasicButtonListener.java:279) ~[?:?]
	at java.awt.AWTEventMulticaster.mouseReleased(AWTEventMulticaster.java:297) ~[?:?]
	at java.awt.Component.processMouseEvent(Component.java:6626) ~[?:?]
	at javax.swing.JComponent.processMouseEvent(JComponent.java:3389) ~[?:?]
	at java.awt.Component.processEvent(Component.java:6391) ~[?:?]
	at java.awt.Container.processEvent(Container.java:2266) ~[?:?]
	at java.awt.Component.dispatchEventImpl(Component.java:5001) ~[?:?]
	at java.awt.Container.dispatchEventImpl(Container.java:2324) ~[?:?]
	at java.awt.Component.dispatchEvent(Component.java:4833) ~[?:?]
	at java.awt.LightweightDispatcher.retargetMouseEvent(Container.java:4948) ~[?:?]
	at java.awt.LightweightDispatcher.processMouseEvent(Container.java:4575) ~[?:?]
	at java.awt.LightweightDispatcher.dispatchEvent(Container.java:4516) ~[?:?]
	at java.awt.Container.dispatchEventImpl(Container.java:2310) ~[?:?]
	at java.awt.Window.dispatchEventImpl(Window.java:2780) ~[?:?]
	at java.awt.Component.dispatchEvent(Component.java:4833) ~[?:?]
	at java.awt.EventQueue.dispatchEventImpl(EventQueue.java:773) ~[?:?]
	at java.awt.EventQueue$4.run(EventQueue.java:722) ~[?:?]
	at java.awt.EventQueue$4.run(EventQueue.java:716) ~[?:?]
	at java.security.AccessController.doPrivileged(AccessController.java:399) ~[?:?]
	at java.security.ProtectionDomain$JavaSecurityAccessImpl.doIntersectionPrivilege(ProtectionDomain.java:86) ~[?:?]
	at java.security.ProtectionDomain$JavaSecurityAccessImpl.doIntersectionPrivilege(ProtectionDomain.java:97) ~[?:?]
	at java.awt.EventQueue$5.run(EventQueue.java:746) ~[?:?]
	at java.awt.EventQueue$5.run(EventQueue.java:744) ~[?:?]
	at java.security.AccessController.doPrivileged(AccessController.java:399) ~[?:?]
	at java.security.ProtectionDomain$JavaSecurityAccessImpl.doIntersectionPrivilege(ProtectionDomain.java:86) ~[?:?]
	at java.awt.EventQueue.dispatchEvent(EventQueue.java:743) ~[?:?]
	at java.awt.EventDispatchThread.pumpOneEventForFilters(EventDispatchThread.java:203) ~[?:?]
	at java.awt.EventDispatchThread.pumpEventsForFilter(EventDispatchThread.java:124) ~[?:?]
	at java.awt.EventDispatchThread.pumpEventsForHierarchy(EventDispatchThread.java:113) ~[?:?]
	at java.awt.EventDispatchThread.pumpEvents(EventDispatchThread.java:109) ~[?:?]
	at java.awt.EventDispatchThread.pumpEvents(EventDispatchThread.java:101) ~[?:?]
	at java.awt.EventDispatchThread.run(EventDispatchThread.java:90) ~[?:?]
Additional context

No response

Would you like to help fix this issue?
  • Yes

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start in the stack-traced createPkcs11Provider method in the network add-on's KeyStores.java, then inspect addPkcs11KeyStore and the ClientCertificatesOptionsPanel call site. Reproduce the ActivClient PKCS#11 flow on ZAP 2.12 and investigate the Java module access error. Done means a CAC/PIV certificate can be added to the keystore without the reported driver-or-password error.

Written by the indexing model from the issue text.

Assessment

Tech stack
java
Domain
authentication, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.