You are viewing a plain text version of this content. The canonical link for it is here.
Posted to wss4j-dev@ws.apache.org by "Patrick J Kobly (JIRA)" <ji...@apache.org> on 2007/12/10 22:14:43 UTC
[jira] Created: (WSS-97) Merlin passes invalid OID to
getExtensionValue
Merlin passes invalid OID to getExtensionValue
----------------------------------------------
Key: WSS-97
URL: https://issues.apache.org/jira/browse/WSS-97
Project: WSS4J
Issue Type: Bug
Reporter: Patrick J Kobly
Assignee: Ruchith Udayanga Fernando
>From org.apache.ws.security.components.crypto.Merlin:
public boolean validateCertPath(X509Certificate[] certs)
...
while (cacertsAliases.hasMoreElements()) {
String alias = (String) cacertsAliases.nextElement();
X509Certificate cert = (X509Certificate) this.cacerts
.getCertificate(alias);
TrustAnchor anchor = new TrustAnchor(cert, cert
.getExtensionValue("NameConstraints"));
set.add(anchor);
}
// Add certificates from the keystore
Enumeration aliases = this.keystore.aliases();
while (aliases.hasMoreElements()) {
String alias = (String) aliases.nextElement();
X509Certificate cert = (X509Certificate) this.keystore
.getCertificate(alias);
TrustAnchor anchor = new TrustAnchor(cert, cert
.getExtensionValue("NameConstraints"));
set.add(anchor);
}
>From J2SE API docs:
http://java.sun.com/j2se/1.5.0/docs/api/java/security/cert/X509Extension.html#getExtensionValue(java.lang.String)
getExtensionValue(String oid) expects its parameter to be an OID (in this case, "2.5.29.30"). It appears that the default JCE provider simply returns null (indicating extension not present). However, this behaviour is not always the case. Notably, the Bouncy Castle JCE provider will throw the (unchecked) exception IllegalArgumentException if the argument does not appear to be an OID. This will cause cert path validation to fail with an exception on any JVM configured to use such a JCE provider (whether or not name constraints are used on any certs in the chain to be validated).
In addition, when used with a JCE that does not exhibit this behaviour, the code will identify some invalid cert paths as valid. i.e. if a cert in the path has a naming constraint and is used to sign a cert which the name constraints would disallow, the path will still be seen as valid.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
---------------------------------------------------------------------
To unsubscribe, e-mail: wss4j-dev-unsubscribe@ws.apache.org
For additional commands, e-mail: wss4j-dev-help@ws.apache.org
[jira] Commented: (WSS-97) Merlin passes invalid OID to
getExtensionValue
Posted by "Fred Dushin (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/WSS-97?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=12588118#action_12588118 ]
Fred Dushin commented on WSS-97:
--------------------------------
Applied patch, but I did not submit a test case for this code change. It's does not look strightforward to create a CA certificate in openssl that contains any name constraints.
If anyone has done this before, please include instructions here, and perhaps we can add a basic test case for this feature (to reduce the possibility of a regression.
I am fairly confident that the code fix is correct, though, reading the JDK docs Patrick referenced.
Thanks!
> Merlin passes invalid OID to getExtensionValue
> ----------------------------------------------
>
> Key: WSS-97
> URL: https://issues.apache.org/jira/browse/WSS-97
> Project: WSS4J
> Issue Type: Bug
> Reporter: Patrick J Kobly
> Assignee: Ruchith Udayanga Fernando
> Attachments: WSS-97.patch
>
>
> From org.apache.ws.security.components.crypto.Merlin:
> public boolean validateCertPath(X509Certificate[] certs)
> ...
> while (cacertsAliases.hasMoreElements()) {
> String alias = (String) cacertsAliases.nextElement();
> X509Certificate cert = (X509Certificate) this.cacerts
> .getCertificate(alias);
> TrustAnchor anchor = new TrustAnchor(cert, cert
> .getExtensionValue("NameConstraints"));
> set.add(anchor);
> }
> // Add certificates from the keystore
> Enumeration aliases = this.keystore.aliases();
> while (aliases.hasMoreElements()) {
> String alias = (String) aliases.nextElement();
> X509Certificate cert = (X509Certificate) this.keystore
> .getCertificate(alias);
> TrustAnchor anchor = new TrustAnchor(cert, cert
> .getExtensionValue("NameConstraints"));
> set.add(anchor);
> }
> From J2SE API docs:
> http://java.sun.com/j2se/1.5.0/docs/api/java/security/cert/X509Extension.html#getExtensionValue(java.lang.String)
> getExtensionValue(String oid) expects its parameter to be an OID (in this case, "2.5.29.30"). It appears that the default JCE provider simply returns null (indicating extension not present). However, this behaviour is not always the case. Notably, the Bouncy Castle JCE provider will throw the (unchecked) exception IllegalArgumentException if the argument does not appear to be an OID. This will cause cert path validation to fail with an exception on any JVM configured to use such a JCE provider (whether or not name constraints are used on any certs in the chain to be validated).
> In addition, when used with a JCE that does not exhibit this behaviour, the code will identify some invalid cert paths as valid. i.e. if a cert in the path has a naming constraint and is used to sign a cert which the name constraints would disallow, the path will still be seen as valid.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
---------------------------------------------------------------------
To unsubscribe, e-mail: wss4j-dev-unsubscribe@ws.apache.org
For additional commands, e-mail: wss4j-dev-help@ws.apache.org
[jira] Assigned: (WSS-97) Merlin passes invalid OID to
getExtensionValue
Posted by "Fred Dushin (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/WSS-97?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Fred Dushin reassigned WSS-97:
------------------------------
Assignee: Fred Dushin (was: Ruchith Udayanga Fernando)
> Merlin passes invalid OID to getExtensionValue
> ----------------------------------------------
>
> Key: WSS-97
> URL: https://issues.apache.org/jira/browse/WSS-97
> Project: WSS4J
> Issue Type: Bug
> Reporter: Patrick J Kobly
> Assignee: Fred Dushin
> Attachments: WSS-97.patch
>
>
> From org.apache.ws.security.components.crypto.Merlin:
> public boolean validateCertPath(X509Certificate[] certs)
> ...
> while (cacertsAliases.hasMoreElements()) {
> String alias = (String) cacertsAliases.nextElement();
> X509Certificate cert = (X509Certificate) this.cacerts
> .getCertificate(alias);
> TrustAnchor anchor = new TrustAnchor(cert, cert
> .getExtensionValue("NameConstraints"));
> set.add(anchor);
> }
> // Add certificates from the keystore
> Enumeration aliases = this.keystore.aliases();
> while (aliases.hasMoreElements()) {
> String alias = (String) aliases.nextElement();
> X509Certificate cert = (X509Certificate) this.keystore
> .getCertificate(alias);
> TrustAnchor anchor = new TrustAnchor(cert, cert
> .getExtensionValue("NameConstraints"));
> set.add(anchor);
> }
> From J2SE API docs:
> http://java.sun.com/j2se/1.5.0/docs/api/java/security/cert/X509Extension.html#getExtensionValue(java.lang.String)
> getExtensionValue(String oid) expects its parameter to be an OID (in this case, "2.5.29.30"). It appears that the default JCE provider simply returns null (indicating extension not present). However, this behaviour is not always the case. Notably, the Bouncy Castle JCE provider will throw the (unchecked) exception IllegalArgumentException if the argument does not appear to be an OID. This will cause cert path validation to fail with an exception on any JVM configured to use such a JCE provider (whether or not name constraints are used on any certs in the chain to be validated).
> In addition, when used with a JCE that does not exhibit this behaviour, the code will identify some invalid cert paths as valid. i.e. if a cert in the path has a naming constraint and is used to sign a cert which the name constraints would disallow, the path will still be seen as valid.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
---------------------------------------------------------------------
To unsubscribe, e-mail: wss4j-dev-unsubscribe@ws.apache.org
For additional commands, e-mail: wss4j-dev-help@ws.apache.org
[jira] Updated: (WSS-97) Merlin passes invalid OID to
getExtensionValue
Posted by "Patrick J Kobly (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/WSS-97?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Patrick J Kobly updated WSS-97:
-------------------------------
Attachment: WSS-97.patch
As requested...
> Merlin passes invalid OID to getExtensionValue
> ----------------------------------------------
>
> Key: WSS-97
> URL: https://issues.apache.org/jira/browse/WSS-97
> Project: WSS4J
> Issue Type: Bug
> Reporter: Patrick J Kobly
> Assignee: Ruchith Udayanga Fernando
> Attachments: WSS-97.patch
>
>
> From org.apache.ws.security.components.crypto.Merlin:
> public boolean validateCertPath(X509Certificate[] certs)
> ...
> while (cacertsAliases.hasMoreElements()) {
> String alias = (String) cacertsAliases.nextElement();
> X509Certificate cert = (X509Certificate) this.cacerts
> .getCertificate(alias);
> TrustAnchor anchor = new TrustAnchor(cert, cert
> .getExtensionValue("NameConstraints"));
> set.add(anchor);
> }
> // Add certificates from the keystore
> Enumeration aliases = this.keystore.aliases();
> while (aliases.hasMoreElements()) {
> String alias = (String) aliases.nextElement();
> X509Certificate cert = (X509Certificate) this.keystore
> .getCertificate(alias);
> TrustAnchor anchor = new TrustAnchor(cert, cert
> .getExtensionValue("NameConstraints"));
> set.add(anchor);
> }
> From J2SE API docs:
> http://java.sun.com/j2se/1.5.0/docs/api/java/security/cert/X509Extension.html#getExtensionValue(java.lang.String)
> getExtensionValue(String oid) expects its parameter to be an OID (in this case, "2.5.29.30"). It appears that the default JCE provider simply returns null (indicating extension not present). However, this behaviour is not always the case. Notably, the Bouncy Castle JCE provider will throw the (unchecked) exception IllegalArgumentException if the argument does not appear to be an OID. This will cause cert path validation to fail with an exception on any JVM configured to use such a JCE provider (whether or not name constraints are used on any certs in the chain to be validated).
> In addition, when used with a JCE that does not exhibit this behaviour, the code will identify some invalid cert paths as valid. i.e. if a cert in the path has a naming constraint and is used to sign a cert which the name constraints would disallow, the path will still be seen as valid.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
---------------------------------------------------------------------
To unsubscribe, e-mail: wss4j-dev-unsubscribe@ws.apache.org
For additional commands, e-mail: wss4j-dev-help@ws.apache.org
[jira] Commented: (WSS-97) Merlin passes invalid OID to
getExtensionValue
Posted by "Patrick J Kobly (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/WSS-97?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=12571082#action_12571082 ]
Patrick J Kobly commented on WSS-97:
------------------------------------
Suggest the following patch (against trunk) or similar:
diff -ur a/org/apache/ws/security/components/Merlin.java b/org/apache/ws/security/components/Merlin.java
--- a/org/apache/ws/security/components/Merlin.java 2008-02-21 08:44:20.015625000 -0700
+++ b/org/apache/ws/security/components/Merlin.java 2008-02-21 08:53:39.187500000 -0700
@@ -49,6 +49,13 @@
public class Merlin extends AbstractCrypto {
/**
+ * OID For the NameConstraints Extension to X.509
+ *
+ * http://java.sun.com/j2se/1.4.2/docs/api/
+ * http://www.ietf.org/rfc/rfc3280.txt (s. 4.2.1.11)
+ */
+ public static final String NAME_CONSTRAINTS_OID = "2.5.29.30";
+ /**
* Constructor. <p/>
*
* @param properties
@@ -150,7 +157,7 @@
X509Certificate cert = (X509Certificate) this.cacerts
.getCertificate(alias);
TrustAnchor anchor = new TrustAnchor(cert, cert
- .getExtensionValue("NameConstraints"));
+ .getExtensionValue(NAME_CONSTRAINTS_OID));
set.add(anchor);
}
@@ -161,7 +168,7 @@
X509Certificate cert = (X509Certificate) this.keystore
.getCertificate(alias);
TrustAnchor anchor = new TrustAnchor(cert, cert
- .getExtensionValue("NameConstraints"));
+ .getExtensionValue(NAME_CONSTRAINTS_OID));
set.add(anchor);
}
> Merlin passes invalid OID to getExtensionValue
> ----------------------------------------------
>
> Key: WSS-97
> URL: https://issues.apache.org/jira/browse/WSS-97
> Project: WSS4J
> Issue Type: Bug
> Reporter: Patrick J Kobly
> Assignee: Ruchith Udayanga Fernando
>
> From org.apache.ws.security.components.crypto.Merlin:
> public boolean validateCertPath(X509Certificate[] certs)
> ...
> while (cacertsAliases.hasMoreElements()) {
> String alias = (String) cacertsAliases.nextElement();
> X509Certificate cert = (X509Certificate) this.cacerts
> .getCertificate(alias);
> TrustAnchor anchor = new TrustAnchor(cert, cert
> .getExtensionValue("NameConstraints"));
> set.add(anchor);
> }
> // Add certificates from the keystore
> Enumeration aliases = this.keystore.aliases();
> while (aliases.hasMoreElements()) {
> String alias = (String) aliases.nextElement();
> X509Certificate cert = (X509Certificate) this.keystore
> .getCertificate(alias);
> TrustAnchor anchor = new TrustAnchor(cert, cert
> .getExtensionValue("NameConstraints"));
> set.add(anchor);
> }
> From J2SE API docs:
> http://java.sun.com/j2se/1.5.0/docs/api/java/security/cert/X509Extension.html#getExtensionValue(java.lang.String)
> getExtensionValue(String oid) expects its parameter to be an OID (in this case, "2.5.29.30"). It appears that the default JCE provider simply returns null (indicating extension not present). However, this behaviour is not always the case. Notably, the Bouncy Castle JCE provider will throw the (unchecked) exception IllegalArgumentException if the argument does not appear to be an OID. This will cause cert path validation to fail with an exception on any JVM configured to use such a JCE provider (whether or not name constraints are used on any certs in the chain to be validated).
> In addition, when used with a JCE that does not exhibit this behaviour, the code will identify some invalid cert paths as valid. i.e. if a cert in the path has a naming constraint and is used to sign a cert which the name constraints would disallow, the path will still be seen as valid.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
---------------------------------------------------------------------
To unsubscribe, e-mail: wss4j-dev-unsubscribe@ws.apache.org
For additional commands, e-mail: wss4j-dev-help@ws.apache.org
[jira] Commented: (WSS-97) Merlin passes invalid OID to
getExtensionValue
Posted by "Patrick J Kobly (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/WSS-97?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=12588656#action_12588656 ]
Patrick J Kobly commented on WSS-97:
------------------------------------
There are likely to be a couple of test cases to exercise this patch... We actually ran across this issue with a cert that didn't have NameConstraints. The first test case is going to involve a valid cert without NameConstraints anywhere in the chain, and a JCE provider config that uses BouncyCastle - i.e. with such a config., _no_ cert paths were seen as valid prior to this patch... The second test case will involve a CA with NameConstraints signing a cert whose name would not be permitted by the NameConstraints...
I can provide a rough approach to testing (including the relevant test certs / keystores, generation instructions, and configs), but am unfamiliar with the project's testing infrastructure - so producing a case for inclusion in your regression suite will take some time...
> Merlin passes invalid OID to getExtensionValue
> ----------------------------------------------
>
> Key: WSS-97
> URL: https://issues.apache.org/jira/browse/WSS-97
> Project: WSS4J
> Issue Type: Bug
> Reporter: Patrick J Kobly
> Assignee: Ruchith Udayanga Fernando
> Attachments: WSS-97.patch
>
>
> From org.apache.ws.security.components.crypto.Merlin:
> public boolean validateCertPath(X509Certificate[] certs)
> ...
> while (cacertsAliases.hasMoreElements()) {
> String alias = (String) cacertsAliases.nextElement();
> X509Certificate cert = (X509Certificate) this.cacerts
> .getCertificate(alias);
> TrustAnchor anchor = new TrustAnchor(cert, cert
> .getExtensionValue("NameConstraints"));
> set.add(anchor);
> }
> // Add certificates from the keystore
> Enumeration aliases = this.keystore.aliases();
> while (aliases.hasMoreElements()) {
> String alias = (String) aliases.nextElement();
> X509Certificate cert = (X509Certificate) this.keystore
> .getCertificate(alias);
> TrustAnchor anchor = new TrustAnchor(cert, cert
> .getExtensionValue("NameConstraints"));
> set.add(anchor);
> }
> From J2SE API docs:
> http://java.sun.com/j2se/1.5.0/docs/api/java/security/cert/X509Extension.html#getExtensionValue(java.lang.String)
> getExtensionValue(String oid) expects its parameter to be an OID (in this case, "2.5.29.30"). It appears that the default JCE provider simply returns null (indicating extension not present). However, this behaviour is not always the case. Notably, the Bouncy Castle JCE provider will throw the (unchecked) exception IllegalArgumentException if the argument does not appear to be an OID. This will cause cert path validation to fail with an exception on any JVM configured to use such a JCE provider (whether or not name constraints are used on any certs in the chain to be validated).
> In addition, when used with a JCE that does not exhibit this behaviour, the code will identify some invalid cert paths as valid. i.e. if a cert in the path has a naming constraint and is used to sign a cert which the name constraints would disallow, the path will still be seen as valid.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
---------------------------------------------------------------------
To unsubscribe, e-mail: wss4j-dev-unsubscribe@ws.apache.org
For additional commands, e-mail: wss4j-dev-help@ws.apache.org
[jira] Resolved: (WSS-97) Merlin passes invalid OID to
getExtensionValue
Posted by "Fred Dushin (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/WSS-97?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Fred Dushin resolved WSS-97.
----------------------------
Resolution: Fixed
Patch applied.
> Merlin passes invalid OID to getExtensionValue
> ----------------------------------------------
>
> Key: WSS-97
> URL: https://issues.apache.org/jira/browse/WSS-97
> Project: WSS4J
> Issue Type: Bug
> Reporter: Patrick J Kobly
> Assignee: Fred Dushin
> Attachments: WSS-97.patch
>
>
> From org.apache.ws.security.components.crypto.Merlin:
> public boolean validateCertPath(X509Certificate[] certs)
> ...
> while (cacertsAliases.hasMoreElements()) {
> String alias = (String) cacertsAliases.nextElement();
> X509Certificate cert = (X509Certificate) this.cacerts
> .getCertificate(alias);
> TrustAnchor anchor = new TrustAnchor(cert, cert
> .getExtensionValue("NameConstraints"));
> set.add(anchor);
> }
> // Add certificates from the keystore
> Enumeration aliases = this.keystore.aliases();
> while (aliases.hasMoreElements()) {
> String alias = (String) aliases.nextElement();
> X509Certificate cert = (X509Certificate) this.keystore
> .getCertificate(alias);
> TrustAnchor anchor = new TrustAnchor(cert, cert
> .getExtensionValue("NameConstraints"));
> set.add(anchor);
> }
> From J2SE API docs:
> http://java.sun.com/j2se/1.5.0/docs/api/java/security/cert/X509Extension.html#getExtensionValue(java.lang.String)
> getExtensionValue(String oid) expects its parameter to be an OID (in this case, "2.5.29.30"). It appears that the default JCE provider simply returns null (indicating extension not present). However, this behaviour is not always the case. Notably, the Bouncy Castle JCE provider will throw the (unchecked) exception IllegalArgumentException if the argument does not appear to be an OID. This will cause cert path validation to fail with an exception on any JVM configured to use such a JCE provider (whether or not name constraints are used on any certs in the chain to be validated).
> In addition, when used with a JCE that does not exhibit this behaviour, the code will identify some invalid cert paths as valid. i.e. if a cert in the path has a naming constraint and is used to sign a cert which the name constraints would disallow, the path will still be seen as valid.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
---------------------------------------------------------------------
To unsubscribe, e-mail: wss4j-dev-unsubscribe@ws.apache.org
For additional commands, e-mail: wss4j-dev-help@ws.apache.org
[jira] Commented: (WSS-97) Merlin passes invalid OID to
getExtensionValue
Posted by "Fred Dushin (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/WSS-97?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=12587664#action_12587664 ]
Fred Dushin commented on WSS-97:
--------------------------------
Hi Patrick,
Could you please submit this patch as an attachment, and additionally, grant ASF the right to use it?
If you have a test case, please submit that, as well!
Thanks!
> Merlin passes invalid OID to getExtensionValue
> ----------------------------------------------
>
> Key: WSS-97
> URL: https://issues.apache.org/jira/browse/WSS-97
> Project: WSS4J
> Issue Type: Bug
> Reporter: Patrick J Kobly
> Assignee: Ruchith Udayanga Fernando
>
> From org.apache.ws.security.components.crypto.Merlin:
> public boolean validateCertPath(X509Certificate[] certs)
> ...
> while (cacertsAliases.hasMoreElements()) {
> String alias = (String) cacertsAliases.nextElement();
> X509Certificate cert = (X509Certificate) this.cacerts
> .getCertificate(alias);
> TrustAnchor anchor = new TrustAnchor(cert, cert
> .getExtensionValue("NameConstraints"));
> set.add(anchor);
> }
> // Add certificates from the keystore
> Enumeration aliases = this.keystore.aliases();
> while (aliases.hasMoreElements()) {
> String alias = (String) aliases.nextElement();
> X509Certificate cert = (X509Certificate) this.keystore
> .getCertificate(alias);
> TrustAnchor anchor = new TrustAnchor(cert, cert
> .getExtensionValue("NameConstraints"));
> set.add(anchor);
> }
> From J2SE API docs:
> http://java.sun.com/j2se/1.5.0/docs/api/java/security/cert/X509Extension.html#getExtensionValue(java.lang.String)
> getExtensionValue(String oid) expects its parameter to be an OID (in this case, "2.5.29.30"). It appears that the default JCE provider simply returns null (indicating extension not present). However, this behaviour is not always the case. Notably, the Bouncy Castle JCE provider will throw the (unchecked) exception IllegalArgumentException if the argument does not appear to be an OID. This will cause cert path validation to fail with an exception on any JVM configured to use such a JCE provider (whether or not name constraints are used on any certs in the chain to be validated).
> In addition, when used with a JCE that does not exhibit this behaviour, the code will identify some invalid cert paths as valid. i.e. if a cert in the path has a naming constraint and is used to sign a cert which the name constraints would disallow, the path will still be seen as valid.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
---------------------------------------------------------------------
To unsubscribe, e-mail: wss4j-dev-unsubscribe@ws.apache.org
For additional commands, e-mail: wss4j-dev-help@ws.apache.org