JOGL Applet Security

Could some of you test the following link ?

jogltest

It should start an applet (signed by me) that should install the JOGL natives in a $user.home subdirectory, and show a simple black rect with a small yellow triangle inside…

I’ve used the same format as JWS (a subdirectory nativelibs at the codebase, and the three native libs in jar format inside)

The next launch should be much faster as the native lib is cached…

I’ve tested it successfully on MacOs 10.3 and WinXP

Waiting for your feedback !!

Lilian

Hi, works for me witha Win2000 configuration, nice job!

Even better !! I’ve just splited the signed jars in two (signed launcher/ unsigned sub-applet) and guess what ? everything works as expected !

I mean, the security checks are still valid on that unsigned jar (System.setProperty() on that side throws a security exception) and the sub-applet is yet able to create a GLCanvas and invoke open gl from that untrusted side !! There’s no need to add a new classloader/security manager.

So with a little refinement, this launcher applet could be part of JOGL (or LWJGL) and benefit from the more trusted Sun certificate…

I’ll improve a little bit and post the code (still waiting for other testers…)

Lilian (happy day :smiley: )

Works fine on NT4 SP6 with JRE 1.4.2_03
This is definitely a nice solution to the applet deployment problem.

Soory to report, the “jogltest” applet did not load for me ( Windows XP). The Java console reported the following errors:

Exception in thread “AWT-EventQueue-4” java.lang.UnsatisfiedLinkError: JAWT_GetAWT0
at net.java.games.jogl.impl.JAWTFactory.JAWT_GetAWT0(Native Method)
at net.java.games.jogl.impl.JAWTFactory.JAWT_GetAWT(JAWTFactory.java:37)
at net.java.games.jogl.impl.windows.WindowsGLContext.getJAWT(WindowsGLContext.java:282)
at net.java.games.jogl.impl.windows.WindowsOnscreenGLContext.lockSurface(WindowsOnscreenGLContext.java:167)
at net.java.games.jogl.impl.windows.WindowsOnscreenGLContext.makeCurrent(WindowsOnscreenGLContext.java:126)
at net.java.games.jogl.impl.GLContext.invokeGL(GLContext.java:248)
at net.java.games.jogl.impl.windows.WindowsOnscreenGLContext.invokeGL(WindowsOnscreenGLContext.java:76)
at net.java.games.jogl.GLCanvas.maybeDoSingleThreadedWorkaround(GLCanvas.java:236)
at net.java.games.jogl.GLCanvas.display(GLCanvas.java:77)
at net.java.games.jogl.GLCanvas.paint(GLCanvas.java:86)
at sun.awt.RepaintArea.paintComponent(Unknown Source)
at sun.awt.RepaintArea.paint(Unknown Source)
at sun.awt.windows.WComponentPeer.handleEvent(Unknown Source)
at java.awt.Component.dispatchEventImpl(Unknown Source)
at java.awt.Component.dispatchEvent(Unknown Source)
at java.awt.EventQueue.dispatchEvent(Unknown Source)
at java.awt.EventDispatchThread.pumpOneEventForHierarchy(Unknown Source)
at java.awt.EventDispatchThread.pumpEventsForHierarchy(Unknown Source)
at java.awt.EventDispatchThread.pumpEvents(Unknown Source)
at java.awt.EventDispatchThread.pumpEvents(Unknown Source)
at java.awt.EventDispatchThread.run(Unknown Source)
stop
stop
destroy
destroy
applet installer init
starting installer
started!
applet installer async refresh
loading lib C:\Documents and Settings\moyerc.jogl_ext\1.1.1\jogl.dll
JOGL START
Exception in thread “AWT-EventQueue-5” java.lang.UnsatisfiedLinkError: JAWT_GetAWT0
at net.java.games.jogl.impl.JAWTFactory.JAWT_GetAWT0(Native Method)
at net.java.games.jogl.impl.JAWTFactory.JAWT_GetAWT(JAWTFactory.java:37)
at net.java.games.jogl.impl.windows.WindowsGLContext.getJAWT(WindowsGLContext.java:282)
at net.java.games.jogl.impl.windows.WindowsOnscreenGLContext.lockSurface(WindowsOnscreenGLContext.java:167)
at net.java.games.jogl.impl.windows.WindowsOnscreenGLContext.makeCurrent(WindowsOnscreenGLContext.java:126)
at net.java.games.jogl.impl.GLContext.invokeGL(GLContext.java:248)
at net.java.games.jogl.impl.windows.WindowsOnscreenGLContext.invokeGL(WindowsOnscreenGLContext.java:76)
at net.java.games.jogl.GLCanvas.maybeDoSingleThreadedWorkaround(GLCanvas.java:236)
at net.java.games.jogl.GLCanvas.display(GLCanvas.java:77)
at net.java.games.jogl.GLCanvas.paint(GLCanvas.java:86)
at sun.awt.RepaintArea.paintComponent(Unknown Source)
at sun.awt.RepaintArea.paint(Unknown Source)
at sun.awt.windows.WComponentPeer.handleEvent(Unknown Source)
at java.awt.Component.dispatchEventImpl(Unknown Source)
at java.awt.Component.dispatchEvent(Unknown Source)
at java.awt.EventQueue.dispatchEvent(Unknown Source)
at java.awt.EventDispatchThread.pumpOneEventForHierarchy(Unknown Source)
at java.awt.EventDispatchThread.pumpEventsForHierarchy(Unknown Source)
at java.awt.EventDispatchThread.pumpEvents(Unknown Source)
at java.awt.EventDispatchThread.pumpEvents(Unknown Source)
at java.awt.EventDispatchThread.run(Unknown Source)
Exception in thread “AWT-EventQueue-5” java.lang.UnsatisfiedLinkError: JAWT_GetAWT0
at net.java.games.jogl.impl.JAWTFactory.JAWT_GetAWT0(Native Method)
at net.java.games.jogl.impl.JAWTFactory.JAWT_GetAWT(JAWTFactory.java:37)
at net.java.games.jogl.impl.windows.WindowsGLContext.getJAWT(WindowsGLContext.java:282)
at net.java.games.jogl.impl.windows.WindowsOnscreenGLContext.lockSurface(WindowsOnscreenGLContext.java:167)
at net.java.games.jogl.impl.windows.WindowsOnscreenGLContext.makeCurrent(WindowsOnscreenGLContext.java:126)
at net.java.games.jogl.impl.GLContext.invokeGL(GLContext.java:248)
at net.java.games.jogl.impl.windows.WindowsOnscreenGLContext.invokeGL(WindowsOnscreenGLContext.java:76)
at net.java.games.jogl.GLCanvas.maybeDoSingleThreadedWorkaround(GLCanvas.java:236)
at net.java.games.jogl.GLCanvas.reshape(GLCanvas.java:133)
at java.awt.Component.setBounds(Unknown Source)
at java.awt.BorderLayout.layoutContainer(Unknown Source)
at java.awt.Container.layout(Unknown Source)
at java.awt.Container.doLayout(Unknown Source)
at java.awt.Container.validateTree(Unknown Source)
at java.awt.Container.validate(Unknown Source)
at joglapplet.JOGLAppletInstaller.joglStart(JOGLAppletInstaller.java:165)
at joglapplet.JOGLAppletInstaller$2.run(JOGLAppletInstaller.java:134)
at java.awt.event.InvocationEvent.dispatch(Unknown Source)
at java.awt.EventQueue.dispatchEvent(Unknown Source)
at java.awt.EventDispatchThread.pumpOneEventForHierarchy(Unknown Source)
at java.awt.EventDispatchThread.pumpEventsForHierarchy(Unknown Source)
at java.awt.EventDispatchThread.pumpEvents(Unknown Source)
at java.awt.EventDispatchThread.pumpEvents(Unknown Source)
at java.awt.EventDispatchThread.run(Unknown Source)

Fantastic work! Works well on Windows XP SP1 with 1.5.0_02, on Linux with 1.4.2, and on Mac OS X with 1.4.2. On Linux closing the applet seems to cause the browser to exit though this could be a bug in Mozilla (I’m running an ancient pre-1.0 copy on that machine).

Would you be willing to contribute this to the community under the BSD license?

Yes of course…

Let me an hour or two to polish the code and I’d be glad to contribute.

I hope you’ll include it (once validated/patched) in the signed jogl.jar.

By the way… where shalI I post the code (here ?)

Lilian

I’ve updated the demo and provided the source code of the JOGLAppletInstaller…

JOGLAppletInstaller.java

Still some work to do to allow better customization… any comments are welcome.

Lilian

I’ve updated the source code to allow access for getAppletContext() from the child applet… haven’t tried getCodeBase() yet.

That means applet parameters should work and are transmitted transparently to the child applet.

the new link is here (explanations on the applet behaviour and implementation, demo page and source code.

Any ideas for improvements are welcome…

Lilian

Hi Lilian,
That works! Congrats.

@platform Windows XP SP2/Netscape Browser 8.04 (IE&Firefox)/Java 5 Version 1.5.0 (build 1.5.0_05-b05)

Suggestion: Have the demos in the demo page link to its own applet. -AK77

I’m sorry I don’t understand what you mean …

Lilian

So now what’s the next step Ken ? Will this applet (or an updated form) be added to the jogl.jar in the near future ? That would resolve the whole signing issue and deployement for simple yet powerful applet games…

Lilian

Thank you very much, however, the applets does not work on my Windows XP.

The applet crashed and I get this exception when running the applet:


Java vendor: Sun Microsystems Inc.
Java version: 1.5.0_02

type 'h' for help

--
Image cache enabled
Audio cache: enabled
ClassLoader cache size: 10
Accept: false
java.lang.NoClassDefFoundError: net/java/games/jogl/GLEventListener
	at java.lang.ClassLoader.defineClass1(Native Method)
	at java.lang.ClassLoader.defineClass(Unknown Source)
	at java.security.SecureClassLoader.defineClass(Unknown Source)
	at java.net.URLClassLoader.defineClass(Unknown Source)
	at java.net.URLClassLoader.access$100(Unknown Source)
	at java.net.URLClassLoader$1.run(Unknown Source)
	at java.security.AccessController.doPrivileged(Native Method)
	at java.net.URLClassLoader.findClass(Unknown Source)
	at java.lang.ClassLoader.loadClass(Unknown Source)
	at java.lang.ClassLoader.loadClass(Unknown Source)
	at java.lang.ClassLoader.loadClassInternal(Unknown Source)
	at java.lang.Class.forName0(Native Method)
	at java.lang.Class.forName(Unknown Source)
	at joglapplet.JOGLAppletInstaller.init(JOGLAppletInstaller.java:107)
	at com.opera.PluginPanel.run(PluginPanel.java:441)
	at java.lang.Thread.run(Unknown Source)

I’m using Opera.

Btw, can you make the links stand out more in the installer page. I missed the demo the first time because I did not notice the gray “here” text on the bottom of the page.

Strange… I’ll try it with opera tomorrow … are there known issues with multiple jar files ? the jogl.jar is the second in the list…

And I’ll highlight the link :wink:

I’ll also make an html page with the java plug-in instead of the applet tag, just in case…

Lilian

It’s may be related to your config, have you specfied in the control panel to use java 1.5 for the applet tag of your brower ?

Lilian

Could you please sign and fax in the Contributor Agreement linked to from the JOGL home page? I’ll PM you the fax number.

Once that’s done we’ll be glad to include this in the standard JOGL distribution. I think it will be fantastic to be able to run JOGL-based applets with no separate installation step necessary (and without interfering with other installations…). We may need some internal security review of the code, etc.

This reply is in regard to my earlier post of Nov. 4, reporting that I was unable to load the jogltest applet (unsatisfied link error…). It seems the problem stemmed from my placing the Jogl files in the JRE directories. After removing them, the applet launched sucessfully. This same problem may be confounding other users, since I am sure I am not the only one guilty of putting Jogl files in the JRE.

I’d also like to take this opportunity to thank everyone responsible for this breakthrough, especially Lilian. I am amazed at how quickly the Jogl community responded with an elegant solution to this vexing problem. Congratulations, and keep up the good work!

I did not find any jogl.jar files in the jre directories.

Thanks ! and great news ! Seems like we’ll need to have a “troubleshooting installation” specific to this applet somewhere easily reachable…

There is however still a security issue I’m trying to fix : currently the native libraries are downloaded and installed from the signed part of the applet, but there is nothing granting the native libs are themselves properly signed. So someone could replace them with custom malicious code and bypass the sandbox security.

There are two ways of solving this problem :

    • adding the native*jars properly signed in the archive list of the applet (that will increase the download size of 200/300kb), and adding the installer code in these jar files.
      That way, the installation will occur only through safe code/signed jar, it’s certainly the easiest way.
    • implementing the verification of the native jar files from the applet installer.

[edit] I’m not trying the 2) part, too much work… I’d rather use the integrated jar verification provided by 1). Stay tuned, more on this today.

Lilian