Attachment 1472828 Details for Bug 1608375 – patch to resolve possible encoding mismatch between the actual CA cert and the X500Name gleaned from the CMC revocation request

[patch] patch to resolve possible encoding mismatch between the actual CA cert and the X500Name gleaned from the CMC revocation request

0001-Bug1608375-CMC-Revocations-throws-exception-with-sam.patch (text/plain), 3.94 KB, created by Christina Fu on 2018-08-02 23:27:47 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Christina Fu

Created: 2018-08-02 23:27:47 UTC

Size: 3.94 KB

patch

obsolete

>From 0183b1f16db70acbbcd8f9a4cf696a85bb8dc098 Mon Sep 17 00:00:00 2001
>From: Christina Fu <cfu@redhat.com>
>Date: Thu, 2 Aug 2018 09:31:50 -0700
>Subject: [PATCH] Bug1608375 - CMC Revocations throws exception with same
> reqIssuer & certissuer
>
>This patch resolves the possible encoding mismatch between the actual CA cert
>and the X500Name gleaned from the CMC revocation request.
>
>Change-Id: I220f5d656a69c90fa02ba38fa21b069ed7d15a9d
>---
> .../cms/authentication/CMCUserSignedAuth.java       | 21 ++++++++++++++++++---
> 1 file changed, 18 insertions(+), 3 deletions(-)
>
>diff --git a/base/server/cms/src/com/netscape/cms/authentication/CMCUserSignedAuth.java b/base/server/cms/src/com/netscape/cms/authentication/CMCUserSignedAuth.java
>index 8360d8bfe..b3136a02d 100644
>--- a/base/server/cms/src/com/netscape/cms/authentication/CMCUserSignedAuth.java
>+++ b/base/server/cms/src/com/netscape/cms/authentication/CMCUserSignedAuth.java
>@@ -82,6 +82,7 @@ import com.netscape.certsrv.base.EBaseException;
> import com.netscape.certsrv.base.IConfigStore;
> import com.netscape.certsrv.base.IExtendedPluginInfo;
> import com.netscape.certsrv.base.SessionContext;
>+import com.netscape.certsrv.ca.ICertificateAuthority;
> import com.netscape.certsrv.logging.ILogger;
> import com.netscape.certsrv.logging.event.CMCUserSignedRequestSigVerifyEvent;
> import com.netscape.certsrv.profile.EProfileException;
>@@ -496,13 +497,27 @@ public class CMCUserSignedAuth implements IAuthManager, IExtendedPluginInfo,
>                                     // to CMCOutputTemplate so that we can
>                                     // have a chance to capture user identification info
>                                     if (issuerANY != null) {
>+                                        // get CA signing cert
>+                                        ICertificateAuthority ca = null;
>+                                        ca = (ICertificateAuthority) CMS.getSubsystem("ca");
>+                                        X500Name caName = ca.getX500Name();
>+
>                                         try {
>                                             byte[] issuerBytes = issuerANY.getEncoded();
>-                                            X500Name issuerName = new X500Name(issuerBytes);
>-                                            CMS.debug(method + "revRequest issuer name = " + issuerName.toString());
>+                                            X500Name reqIssuerName = new X500Name(issuerBytes);
>+                                            String reqIssuerNameStr = reqIssuerName.getName();
>+                                            CMS.debug(method + "revRequest issuer name = " + reqIssuerNameStr);
>+                                            if (reqIssuerNameStr.equalsIgnoreCase(caName.getName())) {
>+                                                // making sure it's identical, even in encoding
>+                                                reqIssuerName = caName;
>+                                            } else {
>+                                                // not this CA; will be bumped off later;
>+                                                // make a note in debug anyway
>+                                                CMS.debug(method + "revRequest issuer name doesn't match our CA; will be bumped off later;");
>+                                            }
>                                             // capture issuer principal to be checked against
>                                             // cert issuer principal later in CMCOutputTemplate
>-                                            auditContext.put(SessionContext.CMC_ISSUER_PRINCIPAL, issuerName);
>+                                            auditContext.put(SessionContext.CMC_ISSUER_PRINCIPAL, reqIssuerName);
>                                         } catch (Exception e) {
>                                             CMS.debug(method + "failed getting issuer from RevokeRequest:" + e.toString());
>                                         }
>-- 
>2.14.4
>

Actions: View | Diff

Attachments on bug 1608375: 1472828