Update to version 2.0.0 (pom, handbook, etc.)

Handbook usage updated (TSL example added)
Update TSL handling

3 files changed, 230 insertions, 160 deletions

diff --git a/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/tsl/connector/TSLConnector.java b/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/tsl/connector/TSLConnector.java
index 07da0a998..3a004a81d 100644
--- a/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/tsl/connector/TSLConnector.java
+++ b/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/tsl/connector/TSLConnector.java
@@ -1,6 +1,7 @@
 package at.gv.egovernment.moa.spss.tsl.connector;

 

 import iaik.asn1.ObjectID;

+

 import iaik.util._;

 import iaik.util.logging._l;

 import iaik.utils.RFC2253NameParser;

diff --git a/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/tsl/timer/TSLUpdaterTimerTask.java b/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/tsl/timer/TSLUpdaterTimerTask.java
index 5456701c0..e06abe44d 100644
--- a/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/tsl/timer/TSLUpdaterTimerTask.java
+++ b/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/tsl/timer/TSLUpdaterTimerTask.java
@@ -46,7 +46,9 @@ public class TSLUpdaterTimerTask extends TimerTask {
 	public void run() {

 		

 		try {

+			Logger.info("Start TSL Update");

 			update();

+			Logger.info("Finished TSL Update");

 		} catch (TSLEngineDiedException e) {

 			MessageProvider msg = MessageProvider.getInstance();

 			Logger.error(new LogMsg(msg.getMessage("tsl.00", null)), e);

@@ -172,33 +174,33 @@ public class TSLUpdaterTimerTask extends TimerTask {
 						

 				        // convert ArrayList<File> to X509Certificate[]						

 				        if (tsl_certs == null) {

-				        	Logger.error("No certificates from TSL imported.");

-				        	throw new TSLSearchException("No certificates from TSL imported.");

+				        	Logger.warn("No certificates from TSL imported.");

+				        	//throw new TSLSearchException("No certificates from TSL imported.");

 				        }

+				        else {

 				        

-						X509Certificate[] addCertificatesTSL = new X509Certificate[tsl_certs.size()];

-						Iterator itcert = tsl_certs.iterator();

-						i = 0;

-						File f = null;

-						while(itcert.hasNext()) {

-							f = (File)itcert.next();

-							FileInputStream fis = new FileInputStream(f);

-							X509Certificate cert = new X509Certificate(fis);

-							addCertificatesTSL[i] = cert;

+				        	X509Certificate[] addCertificatesTSL = new X509Certificate[tsl_certs.size()];

+				        	Iterator itcert = tsl_certs.iterator();

+				        	i = 0;

+				        	File f = null;

+				        	while(itcert.hasNext()) {

+				        		f = (File)itcert.next();

+				        		FileInputStream fis = new FileInputStream(f);

+				        		X509Certificate cert = new X509Certificate(fis);

+				        		addCertificatesTSL[i] = cert;

 								

-							i++;

-							fis.close();

-						}

+				        		i++;

+				        		fis.close();

+				        	}

 						  

-						Logger.debug(new LogMsg("Add " + addCertificatesTSL.length + " certificates."));

-						storeUpdater.addCertificatesToTrustStores(addCertificatesTSL, tid);

-						storeUpdater.addCertificatesToCertStores(addCertificatesTSL, tid);

+				        	Logger.debug(new LogMsg("Add " + addCertificatesTSL.length + " certificates."));

+				        	storeUpdater.addCertificatesToTrustStores(addCertificatesTSL, tid);

+				        	storeUpdater.addCertificatesToCertStores(addCertificatesTSL, tid);

 						

-						Logger.debug(new LogMsg("Add " + addCertificates.length + " certificates."));

-						storeUpdater.addCertificatesToTrustStores(addCertificates, tid);

-						storeUpdater.addCertificatesToCertStores(addCertificates, tid);

-			

-			            

+				        	Logger.debug(new LogMsg("Add " + addCertificates.length + " certificates."));

+				        	storeUpdater.addCertificatesToTrustStores(addCertificates, tid);

+				        	storeUpdater.addCertificatesToCertStores(addCertificates, tid);

+				        }			            

 					}

 				}

 			}

diff --git a/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/tsl/utils/TSLImportFromFileContext.java b/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/tsl/utils/TSLImportFromFileContext.java
index f0dbd779e..492d10eda 100644
--- a/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/tsl/utils/TSLImportFromFileContext.java
+++ b/spss/server/serverlib/src/main/java/at/gv/egovernment/moa/spss/tsl/utils/TSLImportFromFileContext.java
@@ -1,6 +1,7 @@
 package at.gv.egovernment.moa.spss.tsl.utils;

 

 import iaik.util.logging._l;

+

 import iaik.util.logging.Log.MultiThreadLoggingGroup;

 import iaik.utils.RFC2253NameParserException;

 import iaik.utils.Util;

@@ -15,6 +16,7 @@ import iaik.xml.crypto.tsl.TSLOpenURIException;
 import iaik.xml.crypto.tsl.TSLThreadContext;

 import iaik.xml.crypto.tsl.ValidationFixupFilter;

 import iaik.xml.crypto.tsl.ValidationFixupFilter.AttributeValueFixup;

+import iaik.xml.crypto.tsl.ValidationFixupFilter.DeleteAttrFixup;

 import iaik.xml.crypto.tsl.ValidationFixupFilter.ElementStringValueFixup;

 import iaik.xml.crypto.tsl.ValidationFixupFilter.FixedSaxLevelValidationExcption;

 import iaik.xml.crypto.tsl.ValidationFixupFilter.Fixup;

@@ -97,44 +99,34 @@ public class TSLImportFromFileContext extends iaik.xml.crypto.tsl.TSLImportFromF
 	  trustAnchorsWrongOnEuTsl_;

 

 	public TSLImportFromFileContext(

-		Countries expectedTerritory,

-		URL url,

-		Number otherTslPointerId,

-		String workingdirectory,

-		boolean sqlMultithreaded,

-		boolean throwExceptions,

-		boolean logExceptions,

-		boolean throwWarnings,

-		boolean logWarnings,

-		boolean nullRedundancies,

-		String baseuri,

-		Map <Countries, ListIterator<X509Certificate>> trustAnchorsWrongOnEuTsl, 

-		TSLThreadContext parentContext) {

-		super(

-			expectedTerritory,

-			url,

-			otherTslPointerId,

-			workingdirectory,

-			sqlMultithreaded,

-			throwExceptions,

-			logExceptions,

-			throwWarnings,

-			logWarnings,

-			nullRedundancies,

-			parentContext);

-		baseuri_ = baseuri;

-		trustAnchorsWrongOnEuTsl_ = trustAnchorsWrongOnEuTsl;

-	}

-	

-	public List<ThrowableAndLocatorAndMitigation> getErrorsAndWarnings() {

-		List<ThrowableAndLocatorAndMitigation> errorsAndWarnings = new ArrayList<ThrowableAndLocatorAndMitigation>();

-		errorsAndWarnings.addAll(this.fatals_);

-		errorsAndWarnings.addAll(this.faildTransactions_);

-		errorsAndWarnings.addAll(this.warnings_);

-		

-		return errorsAndWarnings;

-	}

-	

+			Countries expectedTerritory,

+			URL url,

+			Number otherTslPointerId,

+			String workingdirectory,

+			boolean sqlMultithreaded,

+			boolean throwExceptions,

+			boolean logExceptions,

+			boolean throwWarnings,

+			boolean logWarnings,

+			boolean nullRedundancies,

+			String baseuri,

+			Map <Countries, ListIterator<X509Certificate>> trustAnchorsWrongOnEuTsl, 

+			TSLThreadContext parentContext) {

+			super(

+				expectedTerritory,

+				url,

+				otherTslPointerId,

+				workingdirectory,

+				sqlMultithreaded,

+				throwExceptions,

+				logExceptions,

+				throwWarnings,

+				logWarnings,

+				nullRedundancies,

+				parentContext);

+			baseuri_ = baseuri;

+			trustAnchorsWrongOnEuTsl_ = trustAnchorsWrongOnEuTsl;

+		}

 	/* (non-Javadoc)

 	 * @see iaik.xml.crypto.tsl.TSLImportFromFileContext#getbaseURI()

 	 */

@@ -142,67 +134,80 @@ public class TSLImportFromFileContext extends iaik.xml.crypto.tsl.TSLImportFromF
 	public String getbaseURI() {

 		return this.baseuri_;

 	}

-	

+

+

+

+

 	//@Override

-	protected RuntimeException wrapException(Throwable t, Locator l, Mitigation m) {

-		return super.wrapException(t, l, m);

-	}

+		protected RuntimeException wrapException(Throwable t, Locator l, Mitigation m) {

+			return super.wrapException(t, l, m);

+		}

 

 	@Override

-	public synchronized void throwException(Throwable e) {

+  public

+	synchronized void throwException(Throwable e) {

 

 		if (e instanceof TSLValidationException) {

 			// we do not throw dom validation errors for testing

 			// and just collect them

 			wrapException(e);

-			

 		} else if (e instanceof TSLVerificationException) {

+			

+			boolean corrected = false;

 			// we do not throw verification errors for testing

 			// and just collect them

 			

-			if (Boolean.valueOf(_.getSysProperty(TSLSecurityException.Type.NO_TSL_SIGNATURE

-			    .getClass().getName(), "true"))

-			    && ((TSLVerificationException) e).getType() == TSLSecurityException.Type.NO_TSL_SIGNATURE) {

-				

-				//TSL with no signature are ignored!!!!

-				l.warn("TSL IS NOT SIGNED! " 

-						+ this.expectedTerritory_.name() + " TSL ignored.");

-			}

-			

-			if (Boolean.valueOf(_.getSysProperty(TSLSecurityException.Type.NON_CONFORMANT_REFERENCE_IN_TSL_SIGNATURE

-			    .getClass().getName(), "true"))

-			    && ((TSLVerificationException) e).getType() == TSLSecurityException.Type.NON_CONFORMANT_REFERENCE_IN_TSL_SIGNATURE) {

-				((TSLVerificationException) e).setMitigation(Mitigation.IGNORED);

-			}

-			

-			if (Boolean.valueOf(_.getSysProperty(TSLSecurityException.Type.NON_CONFORMANT_TRANSFORMS_IN_TSL_SIGNATURE

-			    .getClass().getName(), "true"))

-			    && ((TSLVerificationException) e).getType() == TSLSecurityException.Type.NON_CONFORMANT_TRANSFORMS_IN_TSL_SIGNATURE) {

-				((TSLVerificationException) e).setMitigation(Mitigation.IGNORED);

-			}

-			

-			if (Boolean.valueOf(_.getSysProperty(TSLSecurityException.Type.NON_CONFORMANT_TRANSFORM_IN_TSL_SIGNATURE

-			    .getClass().getName(), "true"))

-			    && ((TSLVerificationException) e).getType() == TSLSecurityException.Type.NON_CONFORMANT_TRANSFORM_IN_TSL_SIGNATURE) {

-				((TSLVerificationException) e).setMitigation(Mitigation.IGNORED);

-			}

-			

-			if (Boolean.valueOf(_.getSysProperty(TSLSecurityException.Type.NON_CONFORMANT_C14N_IN_TSL_SIGNATURE

-			    .getClass().getName(), "true"))

-			    && ((TSLVerificationException) e).getType() == TSLSecurityException.Type.NON_CONFORMANT_C14N_IN_TSL_SIGNATURE) {

-				((TSLVerificationException) e).setMitigation(Mitigation.IGNORED);

-			}

+//			// NEVER DO THIS! unless you want to import TSLs without signatures.

+//			if (Boolean.valueOf(_.getSysProperty(TSLSecurityException.Type.NO_TSL_SIGNATURE

+//			    .getClass().getName(), "true"))

+//			    && ((TSLVerificationException) e).getType() == TSLSecurityException.Type.NO_TSL_SIGNATURE) {

+//				((TSLVerificationException) e).setMitigation(Mitigation.IGNORED);

+//			}

+//			

+//			if (Boolean.valueOf(_.getSysProperty(TSLSecurityException.Type.NON_CONFORMANT_REFERENCE_IN_TSL_SIGNATURE

+//			    .getClass().getName(), "true"))

+//			    && ((TSLVerificationException) e).getType() == TSLSecurityException.Type.NON_CONFORMANT_REFERENCE_IN_TSL_SIGNATURE) {

+//				((TSLVerificationException) e).setMitigation(Mitigation.IGNORED);

+//			}

 			

-			wrapException(e);

+//			if (Boolean.valueOf(_.getSysProperty(TSLSecurityException.Type.NON_CONFORMANT_TRANSFORMS_IN_TSL_SIGNATURE

+//			    .getClass().getName(), "true"))

+//			    && ((TSLVerificationException) e).getType() == TSLSecurityException.Type.NON_CONFORMANT_TRANSFORMS_IN_TSL_SIGNATURE) {

+//				((TSLVerificationException) e).setMitigation(Mitigation.IGNORED);

+//				

+//				corrected = true;

+//			}

+//			

+//			

+//			if (Boolean.valueOf(_.getSysProperty(TSLSecurityException.Type.NON_CONFORMANT_TRANSFORM_IN_TSL_SIGNATURE

+//			    .getClass().getName(), "true"))

+//			    && ((TSLVerificationException) e).getType() == TSLSecurityException.Type.NON_CONFORMANT_TRANSFORM_IN_TSL_SIGNATURE) {

+//				((TSLVerificationException) e).setMitigation(Mitigation.IGNORED);

+//

+//				corrected = true;

+//			}

+//			

+//			if (Boolean.valueOf(_.getSysProperty(TSLSecurityException.Type.NON_CONFORMANT_C14N_IN_TSL_SIGNATURE

+//			    .getClass().getName(), "true"))

+//			    && ((TSLVerificationException) e).getType() == TSLSecurityException.Type.NON_CONFORMANT_C14N_IN_TSL_SIGNATURE) {

+//				((TSLVerificationException) e).setMitigation(Mitigation.IGNORED);

+//				

+//				corrected = true;

+//			}

+//			

+//			if (corrected)

+//				wrapException(e);

+//			else

+//				super.throwException(e);

+

+			super.throwException(e);

 			

 		} else if (e instanceof FileNotFoundException) {

 			// we do not stop and continue processing

 			wrapException(e);

-			

 		} else if (e instanceof IllegalArgumentException) {

 			// we do not stop and continue processing

 			wrapException(e);

-			

 		} else {

 			// all other errors are treated as per default

 			super.throwException(e);

@@ -221,9 +226,6 @@ public class TSLImportFromFileContext extends iaik.xml.crypto.tsl.TSLImportFromF
 			if(

 				e instanceof FixedSaxLevelValidationExcption &&

 				enclosingMethod.getDeclaringClass().equals(ValidationFixupFilter.class)){

-				

-				

-				

 				wrapException(e,

 					((LocatorAspect) e).getLocator(),

 					new FixedValidationMitigation("Performed SAX Level Fixup."));

@@ -247,7 +249,7 @@ public class TSLImportFromFileContext extends iaik.xml.crypto.tsl.TSLImportFromF
 				if (parameters[0] instanceof DOMError) {

 					DOMError domError = (DOMError) parameters[0];

 

-					l.info(""+domError.getRelatedData());

+					_l.warn(""+domError.getRelatedData());

 

 					//					domError.getRelatedData().getClass().getField("")

 

@@ -308,6 +310,7 @@ public class TSLImportFromFileContext extends iaik.xml.crypto.tsl.TSLImportFromF
 							}

 						});

 						return mitigatedResult;

+						

 					}

 				}

 

@@ -378,11 +381,43 @@ public class TSLImportFromFileContext extends iaik.xml.crypto.tsl.TSLImportFromF
 					}

 				}

 

-				l.error("Ignoring download error using old: " + parameters[0], null);

+				_l.err("Ignoring download error using old: " + parameters[0], null);

 				wrapException(e);

 				return parameters[1];

 			}

 

+//		if (

+//		expectedTerritory_ == Countries.PL &&(

+//			(e.getCause() instanceof java.io.EOFException ||

+//				e.getCause() instanceof iaik.security.ssl.SSLException) &&

+//				parameters[0] instanceof URL &&

+//				((URL)parameters[0]).getProtocol().equalsIgnoreCase("https")

+//		)){

+//		File f = null;

+//		System.setProperty("sun.security.ssl.allowUnsafeRenegotiation", "true");

+//		TLS.register("TLSv1");

+//		try {

+//			f = (File) enclosingMethod.invoke(thisObject, parameters);

+//		} catch (IllegalAccessException e1) {

+//			wrapException(e1);

+//		} catch (InvocationTargetException e1) {

+//			wrapException(e1);

+//		}

+//

+//		//					System.setProperty("sun.security.ssl.allowUnsafeRenegotiation", null);

+//		TLS.register();

+//

+//		if (f != null){

+//			wrapException(e, null, new Mitigation() {

+//				@Override

+//				public String getReport() {

+//					return "Trying TLSv1 and sun.security.ssl.allowUnsafeRenegotiation=true";

+//				}

+//			});

+//			return f;

+//		}

+//	}

+

 			if (

 				e instanceof TSLSecurityException &&

 				enclosingMethod.getDeclaringClass().equals(TSLContext.class) &&

@@ -406,14 +441,14 @@ public class TSLImportFromFileContext extends iaik.xml.crypto.tsl.TSLImportFromF
 						wrapException(e1);

 					}

 					wrapException(e, getLocator(),

-						new iaik.xml.crypto.tsl.ex.SeverityAspect.Mitigation(){

-						@Override

-						public String getReport() {

-							return "make an exception for " + expectedTerritory_ + " who have the wrong certificate in " +

-							"the EU TSL and allow the certificate " +

-							parameters[1];

-						}

-					});

+							new iaik.xml.crypto.tsl.ex.SeverityAspect.Mitigation(){

+							@Override

+							public String getReport() {

+								return "make an exception for " + expectedTerritory_ + " who have the wrong certificate in " +

+								"the EU TSL and allow the certificate " +

+								parameters[1];

+							}

+						});

 					return null;

 				}

 				X509Certificate crt = (X509Certificate)parameters[1];

@@ -530,47 +565,45 @@ public class TSLImportFromFileContext extends iaik.xml.crypto.tsl.TSLImportFromF
 				}

 			}

 			

-//			//TODO: CONSIDER, IF WE REALLY WANT THIS PART OF CODE!

-//			//ugly hack to accept a certificate which uses a crazy X509SubjectName!!

-//			if	( expectedTerritory_ == Countries.DK && 

-//					e instanceof KeySelectorException &&

-//					parameters[0] instanceof X509DataImpl){

-//				if (e.getMessage().equals("KeyInfo X509SubjectName (CN=Adam Arndt                Digst,serialNumber=CVR:34051178-RID:25902029,O=Digitaliseringsstyrelsen // CVR:34051178,C=DK) does not match SubjectDN (serialNumber=CVR:34051178-RID:25902029+CN=Adam Arndt                Digst,O=Digitaliseringsstyrelsen // CVR:34051178,C=DK) of KeyInfo X509Certificate.\n"+

-//						"Any X509IssuerSerial, X509SKI, and X509SubjectName elements that appear MUST refer to the certificate or certificates containing the validation key.")) {

-//						

-//			    	X509DataImpl x509DataImpl = (X509DataImpl) parameters[0];

-//

-//			    	Node child = x509DataImpl.getNode().getFirstChild().getNextSibling();

-//			    	Node child1 = x509DataImpl.getNode().getFirstChild();

-//			    	

-//			    	x509DataImpl.getNode().removeChild(child);

-//			    	x509DataImpl.getNode().removeChild(child1);

-//			    	

-//			    	

-//			    	parameters[0] = (X509Data) x509DataImpl

-//			    				    				    	

-//						Object mitigatedResult = null;

-//						try {

-//

-//							mitigatedResult = enclosingMethod.invoke(thisObject, parameters);

-//						} catch (IllegalAccessException e1) {

-//							wrapException(e1);

-//						} catch (InvocationTargetException e1) {

-//							wrapException(e1);

-//						}

-//

-//						if (mitigatedResult != null){

-//							wrapException(e, null, new Mitigation(null) {

-//								@Override

-//								public String getReport() {

-//									return "Deleted wrong X509SubjectName from XMLDSIG Signature.";

-//								}

-//							});

-//							return mitigatedResult;

-//						}

-//					}

-//			}

-			

+			if	( expectedTerritory_ == Countries.DK && 

+					e instanceof KeySelectorException &&

+					parameters[0] instanceof X509DataImpl){

+				if (e.getMessage().equals("KeyInfo X509SubjectName (CN=Adam Arndt                Digst,serialNumber=CVR:34051178-RID:25902029,O=Digitaliseringsstyrelsen // CVR:34051178,C=DK) does not match SubjectDN (serialNumber=CVR:34051178-RID:25902029+CN=Adam Arndt                Digst,O=Digitaliseringsstyrelsen // CVR:34051178,C=DK) of KeyInfo X509Certificate.\n"+

+						"Any X509IssuerSerial, X509SKI, and X509SubjectName elements that appear MUST refer to the certificate or certificates containing the validation key.")) {

+						

+			    	X509DataImpl x509DataImpl = (X509DataImpl) parameters[0];

+			    		

+			    	ListIterator li = x509DataImpl.getContent().listIterator();

+			    	li.next();

+			    	String sn = (String) li.next();

+			    	

+			    	_l.err(sn, null);

+			    	

+			    	System.exit(1);

+			    	

+						Object mitigatedResult = null;

+						try {

+

+							mitigatedResult = enclosingMethod.invoke(thisObject, parameters);

+						} catch (IllegalAccessException e1) {

+							wrapException(e1);

+						} catch (InvocationTargetException e1) {

+							wrapException(e1);

+						}

+

+						if (mitigatedResult != null){

+							wrapException(e, null, new iaik.xml.crypto.tsl.ex.SeverityAspect.Mitigation() {

+								@Override

+								public String getReport() {

+									return "Deleted wrong X509SubjectName from XMLDSIG Signature.";

+								}

+							});

+							return mitigatedResult;

+							

+						}

+					}

+			}

+

 

 		} else {

 			if (e instanceof MitigatedTSLSecurityException){

@@ -578,7 +611,6 @@ public class TSLImportFromFileContext extends iaik.xml.crypto.tsl.TSLImportFromF
 				// and collect them

 				wrapException(e);

 				return null;

-				

 			} else if (e instanceof FixedSaxLevelValidationExcption) {

 				// we allow to mitigate Sax Level Fixup for testing

 				// and collect them

@@ -607,7 +639,11 @@ public class TSLImportFromFileContext extends iaik.xml.crypto.tsl.TSLImportFromF
 		if(expectedTerritory_ == Countries.EL){

 			//fix the whitespace in Greece TSL

 			status = status.trim();

-		}

+		}		

+		if (status != null && status.startsWith("http://uri.etsi.org/TrstSvc/TrustedList/Svcstatus/")) {

+		        status = status.substring("http://uri.etsi.org/TrstSvc/TrustedList/Svcstatus/".length());

+		      }

+

 		return super.compressStatus(status);

 	}

 

@@ -625,6 +661,37 @@ public class TSLImportFromFileContext extends iaik.xml.crypto.tsl.TSLImportFromF
 	@Override

 	public iaik.xml.crypto.tsl.ValidationFixupFilter.Fixup getSaxLevelValidationFixup(SAXParseException e) {

 

+		if (expectedTerritory_ == Countries.AT){

+			if (e.getMessage().equals("cvc-type.3.1.1: Element 'tsl:URI' is a simple type, so it cannot have attributes, excepting those whose namespace name is identical to 'http://www.w3.org/2001/XMLSchema-instance' and whose [local name] is one of 'type', 'nil', 'schemaLocation' or 'noNamespaceSchemaLocation'. However, the attribute, 'xml:lang' was found.")){

+				return new DeleteAttrFixup("http://www.w3.org/XML/1998/namespace","lang", e, this);

+			}

+		}

+		

+		if (expectedTerritory_ == Countries.CZ){

+			if (e.getMessage().equals("cvc-type.3.1.1: Element 'tsl:URI' is a simple type, so it cannot have attributes, excepting those whose namespace name is identical to 'http://www.w3.org/2001/XMLSchema-instance' and whose [local name] is one of 'type', 'nil', 'schemaLocation' or 'noNamespaceSchemaLocation'. However, the attribute, 'xml:lang' was found.")){

+				return new DeleteAttrFixup("http://www.w3.org/XML/1998/namespace","lang", e, this);

+			}

+		}

+		

+		if (expectedTerritory_ == Countries.FR){

+			if (e.getMessage().equals("cvc-type.3.1.1: Element 'tsl:URI' is a simple type, so it cannot have attributes, excepting those whose namespace name is identical to 'http://www.w3.org/2001/XMLSchema-instance' and whose [local name] is one of 'type', 'nil', 'schemaLocation' or 'noNamespaceSchemaLocation'. However, the attribute, 'xml:lang' was found.")){

+				return new DeleteAttrFixup("http://www.w3.org/XML/1998/namespace","lang", e, this);

+			}

+		}

+		

+		if (expectedTerritory_ == Countries.NO){

+			if (e.getMessage().equals("cvc-type.3.1.1: Element 'tsl:URI' is a simple type, so it cannot have attributes, excepting those whose namespace name is identical to 'http://www.w3.org/2001/XMLSchema-instance' and whose [local name] is one of 'type', 'nil', 'schemaLocation' or 'noNamespaceSchemaLocation'. However, the attribute, 'xml:lang' was found.")){

+				return new DeleteAttrFixup("http://www.w3.org/XML/1998/namespace","lang", e, this);

+			}

+		}

+		

+		if (expectedTerritory_ == Countries.SK){

+			if (e.getMessage().equals("cvc-type.3.1.1: Element 'tsl:URI' is a simple type, so it cannot have attributes, excepting those whose namespace name is identical to 'http://www.w3.org/2001/XMLSchema-instance' and whose [local name] is one of 'type', 'nil', 'schemaLocation' or 'noNamespaceSchemaLocation'. However, the attribute, 'xml:lang' was found.")){

+				return new DeleteAttrFixup("http://www.w3.org/XML/1998/namespace","lang", e, this);

+			}

+		}

+		

+

 		if (expectedTerritory_ == Countries.ES && getDownloadLocation().toString().contains(".es/")){

 			if (e.getMessage().equals("cvc-complex-type.2.4.c: The matching wildcard is strict, but no declaration can be found for element 'tslx:CertSubjectDNAttributeType'.")){

 				return new LocalNameFixup("CertSubjectDNAttributeType","CertSubjectDNAttribute",e, this);

@@ -734,7 +801,7 @@ public class TSLImportFromFileContext extends iaik.xml.crypto.tsl.TSLImportFromF
 

 		String msg = e.getMessage();

 

-		l.info(msg);

+		_l.info(msg);

 		return(

 			msg.startsWith("["+SQLiteErrorCode.SQLITE_CONSTRAINT.name()+"]") &&

 			msg.contains("column " + DbTables.TSLDownload.C.rawHash + " is not unique")

@@ -748,7 +815,7 @@ public class TSLImportFromFileContext extends iaik.xml.crypto.tsl.TSLImportFromF
 	@Override

 	protected long howLongWaitForThreads() {

 		// TODO Auto-generated method stub

-		return 10000;

+		return 100000;

 	}

 	

 	@Override

@@ -768,7 +835,7 @@ public class TSLImportFromFileContext extends iaik.xml.crypto.tsl.TSLImportFromF
 			synchronized (log) {

 				parentContext_.print("<" + ncName + " state=\"" + currentThread.getState()

 				    + "\" " + " id=\"" + currentThread.getId() + "\">\n" + log.toString() + "</"

-				    + ncName + ">\n");

+				    + ncName + ">" + _.LB);

 				parentContext_.flushLog();

 				log.setLength(0);

 			}