Skip to content

Commit 310b30a

Browse files
dghgitdghgit
committed
added cap on size of subject alt name extension reviewer will accept.
1 parent 8e4ba6e commit 310b30a

File tree

3 files changed

+131
-81
lines changed

3 files changed

+131
-81
lines changed

‎pkix/src/main/java/org/bouncycastle/pkix/jcajce/PKIXCertPathReviewer.java‎

Lines changed: 8 additions & 81 deletions
Original file line numberDiff line numberDiff line change
@@ -89,6 +89,8 @@ public class PKIXCertPathReviewer extends CertPathValidatorUtilities
8989

9090
private static final String RESOURCE_NAME = "org.bouncycastle.pkix.CertPathReviewerMessages";
9191

92+
private static final int NAME_CHECK_MAX = (1 << 10);
93+
9294
// input parameters
9395

9496
protected CertPath certPath;
@@ -501,6 +503,12 @@ private void checkNameConstraints()
501503

502504
if (altName != null)
503505
{
506+
if (altName.size() > NAME_CHECK_MAX)
507+
{
508+
ErrorBundle msg = createErrorBundle("CertPathReviewer.subjAltNameExtError");
509+
throw new CertPathReviewerException(msg,certPath,index);
510+
}
511+
504512
for (int j = 0; j < altName.size(); j++)
505513
{
506514
GeneralName name = GeneralName.getInstance(altName.getObjectAt(j));
@@ -516,87 +524,6 @@ private void checkNameConstraints()
516524
new Object[] {new UntrustedInput(name)});
517525
throw new CertPathReviewerException(msg,cpve,certPath,index);
518526
}
519-
// switch(o.getTagNo()) TODO - move resources to PKIXNameConstraints
520-
// {
521-
// case 1:
522-
// String email = ASN1IA5String.getInstance(o, true).getString();
523-
//
524-
// try
525-
// {
526-
// checkPermittedEmail(permittedSubtreesEmail, email);
527-
// }
528-
// catch (CertPathValidatorException cpve)
529-
// {
530-
// ErrorBundle msg = createErrorBundle("CertPathReviewer.notPermittedEmail",
531-
// new Object[] {new UntrustedInput(email)});
532-
// throw new CertPathReviewerException(msg,cpve,certPath,index);
533-
// }
534-
//
535-
// try
536-
// {
537-
// checkExcludedEmail(excludedSubtreesEmail, email);
538-
// }
539-
// catch (CertPathValidatorException cpve)
540-
// {
541-
// ErrorBundle msg = createErrorBundle("CertPathReviewer.excludedEmail",
542-
// new Object[] {new UntrustedInput(email)});
543-
// throw new CertPathReviewerException(msg,cpve,certPath,index);
544-
// }
545-
//
546-
// break;
547-
// case 4:
548-
// ASN1Sequence altDN = ASN1Sequence.getInstance(o, true);
549-
//
550-
// try
551-
// {
552-
// checkPermittedDN(permittedSubtreesDN, altDN);
553-
// }
554-
// catch (CertPathValidatorException cpve)
555-
// {
556-
// X509Name altDNName = new X509Name(altDN);
557-
// ErrorBundle msg = createErrorBundle("CertPathReviewer.notPermittedDN",
558-
// new Object[] {new UntrustedInput(altDNName)});
559-
// throw new CertPathReviewerException(msg,cpve,certPath,index);
560-
// }
561-
//
562-
// try
563-
// {
564-
// checkExcludedDN(excludedSubtreesDN, altDN);
565-
// }
566-
// catch (CertPathValidatorException cpve)
567-
// {
568-
// X509Name altDNName = new X509Name(altDN);
569-
// ErrorBundle msg = createErrorBundle("CertPathReviewer.excludedDN",
570-
// new Object[] {new UntrustedInput(altDNName)});
571-
// throw new CertPathReviewerException(msg,cpve,certPath,index);
572-
// }
573-
//
574-
// break;
575-
// case 7:
576-
// byte[] ip = ASN1OctetString.getInstance(o, true).getOctets();
577-
//
578-
// try
579-
// {
580-
// checkPermittedIP(permittedSubtreesIP, ip);
581-
// }
582-
// catch (CertPathValidatorException cpve)
583-
// {
584-
// ErrorBundle msg = createErrorBundle("CertPathReviewer.notPermittedIP",
585-
// new Object[] {IPtoString(ip)});
586-
// throw new CertPathReviewerException(msg,cpve,certPath,index);
587-
// }
588-
//
589-
// try
590-
// {
591-
// checkExcludedIP(excludedSubtreesIP, ip);
592-
// }
593-
// catch (CertPathValidatorException cpve)
594-
// {
595-
// ErrorBundle msg = createErrorBundle("CertPathReviewer.excludedIP",
596-
// new Object[] {IPtoString(ip)});
597-
// throw new CertPathReviewerException(msg,cpve,certPath,index);
598-
// }
599-
// }
600527
}
601528
}
602529
}

‎pkix/src/test/java/org/bouncycastle/pkix/test/AllTests.java‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -22,6 +22,7 @@ public static Test suite()
2222

2323
suite.addTestSuite(CheckerTest.class);
2424
suite.addTestSuite(RevocationTest.class);
25+
suite.addTestSuite(CheckNameConstraintsTest.class);
2526

2627
return new BCTestSetup(suite);
2728
}

‎pkix/src/test/java/org/bouncycastle/pkix/test/CheckNameConstraintsTest.java‎

Lines changed: 122 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,122 @@
1+
package org.bouncycastle.pkix.test;
2+
3+
import java.security.Security;
4+
import java.security.cert.CertPath;
5+
import java.security.cert.CertPathBuilder;
6+
import java.security.cert.CertPathValidator;
7+
import java.security.cert.CertStore;
8+
import java.security.cert.CertificateFactory;
9+
import java.security.cert.CollectionCertStoreParameters;
10+
import java.security.cert.PKIXBuilderParameters;
11+
import java.security.cert.PKIXCertPathBuilderResult;
12+
import java.security.cert.PKIXParameters;
13+
import java.security.cert.TrustAnchor;
14+
import java.security.cert.X509CertSelector;
15+
import java.security.cert.X509Certificate;
16+
import java.util.ArrayList;
17+
import java.util.Collections;
18+
import java.util.Date;
19+
import java.util.HashSet;
20+
import java.util.List;
21+
import java.util.Set;
22+
23+
import junit.framework.TestCase;
24+
import org.bouncycastle.jce.provider.BouncyCastleProvider;
25+
import org.bouncycastle.pkix.jcajce.PKIXCertPathReviewer;
26+
import org.bouncycastle.test.TestResourceFinder;
27+
28+
public class CheckNameConstraintsTest
29+
extends TestCase
30+
{
31+
public void testPKIXCertPathReviewer()
32+
throws Exception
33+
{
34+
Security.addProvider(new BouncyCastleProvider());
35+
36+
CertificateFactory cf = CertificateFactory.getInstance("X.509", "BC");
37+
38+
X509Certificate root = (X509Certificate) cf.generateCertificate(TestResourceFinder.findTestResource("pkix", "mal-root.crt"));
39+
X509Certificate ca1 = (X509Certificate) cf.generateCertificate(TestResourceFinder.findTestResource("pkix", "mal-ca1.crt"));
40+
X509Certificate ca2 = (X509Certificate) cf.generateCertificate(TestResourceFinder.findTestResource("pkix", "mal-ca2.crt"));
41+
X509Certificate leaf = (X509Certificate) cf.generateCertificate(TestResourceFinder.findTestResource("pkix", "mal-leaf.crt"));
42+
43+
List certchain = new ArrayList();
44+
certchain.add(root);
45+
certchain.add(ca1);
46+
certchain.add(ca2);
47+
certchain.add(leaf);
48+
49+
CertPath cp = cf.generateCertPath(certchain);
50+
51+
Set trust = new HashSet();
52+
trust.add(new TrustAnchor(root, null));
53+
PKIXParameters param = new PKIXParameters(trust);
54+
55+
PKIXCertPathReviewer certPathReviewer = new PKIXCertPathReviewer();
56+
certPathReviewer.init(cp, param);
57+
58+
assertFalse(certPathReviewer.isValidCertPath()); // hit
59+
}
60+
61+
public void testPKIXCertPathBuilder()
62+
throws Exception
63+
{
64+
Security.addProvider(new BouncyCastleProvider());
65+
66+
CertificateFactory cf = CertificateFactory.getInstance("X.509", "BC");
67+
X509Certificate rootCert = (X509Certificate) cf.generateCertificate(TestResourceFinder.findTestResource("pkix", "mal-root.crt"));
68+
X509Certificate endCert = (X509Certificate) cf.generateCertificate(TestResourceFinder.findTestResource("pkix", "mal-ca1.crt"));
69+
70+
// create CertStore to support path building
71+
List list = new ArrayList();
72+
list.add(endCert);
73+
74+
CollectionCertStoreParameters params = new CollectionCertStoreParameters(list);
75+
CertStore store = CertStore.getInstance("Collection", params, "BC");
76+
77+
// build the path
78+
CertPathBuilder builder = CertPathBuilder.getInstance("PKIX", "BC");
79+
X509CertSelector pathConstraints = new X509CertSelector();
80+
81+
pathConstraints.setCertificate(endCert);
82+
83+
PKIXBuilderParameters buildParams = new PKIXBuilderParameters(Collections.singleton(new TrustAnchor(rootCert, null)), pathConstraints);
84+
85+
buildParams.addCertStore(store);
86+
buildParams.setDate(new Date());
87+
buildParams.setRevocationEnabled(false);
88+
89+
PKIXCertPathBuilderResult result = (PKIXCertPathBuilderResult)builder.build(buildParams);
90+
CertPath path = result.getCertPath();
91+
92+
if (path.getCertificates().size() != 1)
93+
{
94+
fail("wrong number of certs in testPKIXCertPathBuilder path");
95+
}
96+
}
97+
98+
public void testPKIXCertPathValidator()
99+
throws Exception
100+
{
101+
Security.addProvider(new BouncyCastleProvider());
102+
103+
CertificateFactory cf = CertificateFactory.getInstance("X.509", "BC");
104+
105+
X509Certificate rootCert = (X509Certificate) cf.generateCertificate(TestResourceFinder.findTestResource("pkix", "mal-root.crt"));
106+
X509Certificate endCert = (X509Certificate) cf.generateCertificate(TestResourceFinder.findTestResource("pkix", "mal-ca1.crt"));
107+
108+
List list = new ArrayList();
109+
list.add(endCert);
110+
111+
CertPath certPath = cf.generateCertPath(list);
112+
113+
Set trust = new HashSet();
114+
trust.add(new TrustAnchor(rootCert, null));
115+
116+
CertPathValidator cpv = CertPathValidator.getInstance("PKIX", "BC");
117+
PKIXParameters param = new PKIXParameters(trust);
118+
param.setRevocationEnabled(false);
119+
120+
cpv.validate(certPath, param);
121+
}
122+
}

0 commit comments

Comments
 (0)