Skip to content

Commit d3051a7

Browse files
wangweijwangweij
committed
8296736: Some PKCS9Attribute can be created but cannot be encoded
Reviewed-by: xuelei, valeriep
1 parent decb1b7 commit d3051a7

File tree

3 files changed

+78
-47
lines changed

3 files changed

+78
-47
lines changed

‎src/java.base/share/classes/sun/security/pkcs/PKCS9Attribute.java‎

Lines changed: 18 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -378,6 +378,12 @@ private void init(ObjectIdentifier oid, Object value)
378378
this.oid = oid;
379379
index = indexOf(oid, PKCS9_OIDS, 1);
380380
Class<?> clazz = index == -1 ? BYTE_ARRAY_CLASS: VALUE_CLASSES[index];
381+
if (clazz == null) {
382+
throw new IllegalArgumentException(
383+
"No value class supported " +
384+
" for attribute " + oid +
385+
" constructing PKCS9Attribute");
386+
}
381387
if (!clazz.isInstance(value)) {
382388
throw new IllegalArgumentException(
383389
"Wrong value class " +
@@ -597,20 +603,20 @@ public void encode(DerOutputStream out) throws IOException {
597603
break;
598604

599605
case 9: // extended-certificate attribute -- not supported
600-
throw new IOException("PKCS9 extended-certificate " +
606+
throw new IllegalArgumentException("PKCS9 extended-certificate " +
601607
"attribute not supported.");
602608
// break unnecessary
603609
case 10: // issuerAndserialNumber attribute -- not supported
604-
throw new IOException("PKCS9 IssuerAndSerialNumber " +
610+
throw new IllegalArgumentException("PKCS9 IssuerAndSerialNumber " +
605611
"attribute not supported.");
606612
// break unnecessary
607613
case 11: // RSA DSI proprietary
608614
case 12: // RSA DSI proprietary
609-
throw new IOException("PKCS9 RSA DSI attributes " +
615+
throw new IllegalArgumentException("PKCS9 RSA DSI attributes " +
610616
"11 and 12, not supported.");
611617
// break unnecessary
612618
case 13: // S/MIME unused attribute
613-
throw new IOException("PKCS9 attribute #13 not supported.");
619+
throw new IllegalArgumentException("PKCS9 attribute #13 not supported.");
614620
// break unnecessary
615621

616622
case 14: // ExtensionRequest
@@ -622,14 +628,17 @@ public void encode(DerOutputStream out) throws IOException {
622628
}
623629
break;
624630
case 15: // SMIMECapability
625-
throw new IOException("PKCS9 attribute #15 not supported.");
631+
throw new IllegalArgumentException("PKCS9 attribute #15 not supported.");
626632
// break unnecessary
627633

628634
case 16: // SigningCertificate
629-
throw new IOException(
630-
"PKCS9 SigningCertificate attribute not supported.");
631-
// break unnecessary
632-
635+
{
636+
DerOutputStream temp2 = new DerOutputStream();
637+
SigningCertificateInfo info = (SigningCertificateInfo)value;
638+
temp2.writeBytes(info.toByteArray());
639+
temp.write(DerValue.tag_Set, temp2.toByteArray());
640+
}
641+
break;
633642
case 17: // SignatureTimestampToken
634643
case 18: // CMSAlgorithmProtection
635644
temp.write(DerValue.tag_Set, (byte[])value);

‎src/java.base/share/classes/sun/security/pkcs/SigningCertificateInfo.java‎

Lines changed: 43 additions & 35 deletions
Original file line numberDiff line numberDiff line change
@@ -79,14 +79,21 @@
7979
* @since 1.5
8080
* @author Vincent Ryan
8181
*/
82-
public class SigningCertificateInfo {
82+
class SigningCertificateInfo {
8383

84+
private byte[] ber;
8485
private ESSCertId[] certId = null;
8586

86-
public SigningCertificateInfo(byte[] ber) throws IOException {
87+
SigningCertificateInfo(byte[] ber) throws IOException {
8788
parse(ber);
89+
this.ber = ber;
8890
}
8991

92+
byte[] toByteArray() {
93+
return ber;
94+
}
95+
96+
@Override
9097
public String toString() {
9198
StringBuilder sb = new StringBuilder();
9299
sb.append("[\n");
@@ -99,7 +106,7 @@ public String toString() {
99106
return sb.toString();
100107
}
101108

102-
public void parse(byte[] bytes) throws IOException {
109+
private void parse(byte[] bytes) throws IOException {
103110

104111
// Parse signingCertificate
105112
DerValue derValue = new DerValue(bytes);
@@ -122,45 +129,46 @@ public void parse(byte[] bytes) throws IOException {
122129
}
123130
}
124131
}
125-
}
126132

127-
class ESSCertId {
133+
static class ESSCertId {
128134

129-
private static volatile HexDumpEncoder hexDumper;
135+
private static volatile HexDumpEncoder hexDumper;
130136

131-
private final byte[] certHash;
132-
private final GeneralNames issuer;
133-
private final SerialNumber serialNumber;
137+
private final byte[] certHash;
138+
private final GeneralNames issuer;
139+
private final SerialNumber serialNumber;
134140

135-
ESSCertId(DerValue certId) throws IOException {
136-
// Parse certHash
137-
certHash = certId.data.getDerValue().toByteArray();
141+
ESSCertId(DerValue certId) throws IOException {
142+
// Parse certHash
143+
certHash = certId.data.getDerValue().toByteArray();
138144

139-
// Parse issuerSerial, if present
140-
if (certId.data.available() > 0) {
141-
DerValue issuerSerial = certId.data.getDerValue();
142-
// Parse issuer
143-
issuer = new GeneralNames(issuerSerial.data.getDerValue());
144-
// Parse serialNumber
145-
serialNumber = new SerialNumber(issuerSerial.data.getDerValue());
146-
} else {
147-
issuer = null;
148-
serialNumber = null;
145+
// Parse issuerSerial, if present
146+
if (certId.data.available() > 0) {
147+
DerValue issuerSerial = certId.data.getDerValue();
148+
// Parse issuer
149+
issuer = new GeneralNames(issuerSerial.data.getDerValue());
150+
// Parse serialNumber
151+
serialNumber = new SerialNumber(issuerSerial.data.getDerValue());
152+
} else {
153+
issuer = null;
154+
serialNumber = null;
155+
}
149156
}
150-
}
151157

152-
public String toString() {
153-
StringBuilder sb = new StringBuilder();
154-
sb.append("[\n\tCertificate hash (SHA-1):\n");
155-
if (hexDumper == null) {
156-
hexDumper = new HexDumpEncoder();
157-
}
158-
sb.append(hexDumper.encode(certHash));
159-
if (issuer != null && serialNumber != null) {
160-
sb.append("\n\tIssuer: " + issuer + "\n");
161-
sb.append("\t" + serialNumber);
158+
@Override
159+
public String toString() {
160+
StringBuilder sb = new StringBuilder();
161+
sb.append("[\n\tCertificate hash (SHA-1):\n");
162+
if (hexDumper == null) {
163+
hexDumper = new HexDumpEncoder();
164+
}
165+
sb.append(hexDumper.encode(certHash));
166+
if (issuer != null && serialNumber != null) {
167+
sb.append("\n\tIssuer: " + issuer + "\n");
168+
sb.append("\t" + serialNumber);
169+
}
170+
sb.append("\n]");
171+
return sb.toString();
162172
}
163-
sb.append("\n]");
164-
return sb.toString();
165173
}
166174
}

‎test/jdk/sun/security/pkcs/pkcs9/PKCS9AttrTypeTests.java‎

Lines changed: 17 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright (c) 2020, Oracle and/or its affiliates. All rights reserved.
2+
* Copyright (c) 2020, 2022, Oracle and/or its affiliates. All rights reserved.
33
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
44
*
55
* This code is free software; you can redistribute it and/or modify it
@@ -23,7 +23,7 @@
2323

2424
/*
2525
* @test
26-
* @bug 8239950
26+
* @bug 8239950 8296736
2727
* @summary Update PKCS9 Attributes to PKCS#9 v2.0 Encodings
2828
* @library /test/lib
2929
* @modules java.base/sun.security.pkcs
@@ -33,6 +33,7 @@
3333
import java.io.IOException;
3434
import java.util.*;
3535
import sun.security.pkcs.PKCS9Attribute;
36+
import sun.security.util.DerOutputStream;
3637
import sun.security.util.DerValue;
3738
import jdk.test.lib.Utils;
3839

@@ -123,6 +124,9 @@ public class PKCS9AttrTypeTests {
123124
put("signingTime as GeneralizedTime",
124125
"301e06092a864886f70d010905311118" +
125126
"0f32303530303533313132303030305a");
127+
128+
put("SigningCertificateInfo",
129+
"3018060b2a864886f70d010910020c3109300730053003040100");
126130
}};
127131

128132
static final Map<String, String> TEST_INPUT_BAD =
@@ -162,10 +166,20 @@ public static void main(String[] args) throws Exception {
162166
try {
163167
System.out.print("Test - " + entry.getKey() + ": ");
164168

165-
// Decode each Base64 test vector into DER and place into
169+
// Decode each HEX test vector into DER and place into
166170
// a DerValue object to be consumed by PKCS9Attribute.
167171
PKCS9Attribute p9Attr = new PKCS9Attribute(
168172
new DerValue(Utils.toByteArray(entry.getValue())));
173+
174+
// There is a value inside
175+
if (p9Attr.getValue() == null) {
176+
throw new IOException("Empty attribute");
177+
}
178+
179+
// Encoding is supported
180+
DerOutputStream dos = new DerOutputStream();
181+
p9Attr.encode(dos);
182+
169183
System.out.println("PASS");
170184
System.out.println("---------------");
171185
System.out.println(p9Attr);

0 commit comments

Comments
 (0)