stan/jdk-24
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

6899503: Security code issue using Verisign root certificate

Browse Source 
Add support for reordering out-of-order certificate chains

Reviewed-by: vinnie, xuelei
This commit is contained in:
Sean Mullan 2009-11-23 12:36:54 -05:00
parent 4da1e67db3
commit 3932bb1884
1 changed files with 11 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
jdk/src/share/classes/sun/security/validator/PKIXValidator.java
View File

@ -150,9 +150,17 @@ public final class PKIXValidator extends Validator {
("null or zero-length certificate chain"); ("null or zero-length certificate chain");
} }
if (TRY_VALIDATOR) { if (TRY_VALIDATOR) {
// check if chain contains trust anchor // check that chain is in correct order and check if chain contains
// trust anchor
X500Principal prevIssuer = null;
for (int i = 0; i < chain.length; i++) { for (int i = 0; i < chain.length; i++) {
if (trustedCerts.contains(chain[i])) { X509Certificate cert = chain[i];
if (i != 0 &&
!cert.getSubjectX500Principal().equals(prevIssuer)) {
// chain is not ordered correctly, call builder instead
return doBuild(chain, otherCerts);
}
if (trustedCerts.contains(cert)) {
if (i == 0) { if (i == 0) {
return new X509Certificate[] {chain[0]}; return new X509Certificate[] {chain[0]};
} }
@ -161,6 +169,7 @@ public final class PKIXValidator extends Validator {
System.arraycopy(chain, 0, newChain, 0, i); System.arraycopy(chain, 0, newChain, 0, i);
return doValidate(newChain); return doValidate(newChain);
} }
prevIssuer = cert.getIssuerX500Principal();
} }
// apparently issued by trust anchor? // apparently issued by trust anchor?
@ -303,5 +312,4 @@ public final class PKIXValidator extends Validator {
("PKIX path building failed: " + e.toString(), e); ("PKIX path building failed: " + e.toString(), e);
} }
} }
} }