Skip to content

fix(provider): validate peer chain before invoking SpiffeIdVerifier #449

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
bcleenders wants to merge 1 commit into
base: main
Choose a base branch
from
+24 −7
Open

fix(provider): validate peer chain before invoking SpiffeIdVerifier #449

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
14 changes: 7 additions & 7 deletions java-spiffe-provider/src/main/java/io/spiffe/provider/SpiffeTrustManager.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -162,19 +162,19 @@ public void checkServerTrusted(X509Certificate[] chain, final String authType, f
checkServerTrusted(chain, authType);
}

// Check that the SPIFFE ID in the peer's certificate is accepted and the chain can be validated with a
// root CA in the bundle source
// Check that the peer's certificate chain can be validated with a root CA in the bundle source
// and that the SPIFFE ID in the peer's certificate is accepted.
private void validatePeerChain(final X509Certificate... chain) throws CertificateException {
SpiffeId spiffeId = CertificateUtils.getSpiffeId(chain[0]);
try {
spiffeIdVerifier.verify(spiffeId, chain);
} catch (SpiffeVerificationException e) {
X509SvidValidator.verifyChain(Arrays.asList(chain), x509BundleSource);
} catch (BundleNotFoundException e) {
throw new CertificateException(e.getMessage(), e);
}

SpiffeId spiffeId = CertificateUtils.getSpiffeId(chain[0]);
try {
X509SvidValidator.verifyChain(Arrays.asList(chain), x509BundleSource);
} catch (BundleNotFoundException e) {
spiffeIdVerifier.verify(spiffeId, chain);
} catch (SpiffeVerificationException e) {
throw new CertificateException(e.getMessage(), e);
}
}
Expand Down
17 changes: 17 additions & 0 deletions java-spiffe-provider/src/test/java/io/spiffe/provider/SpiffeTrustManagerTest.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -29,6 +29,7 @@
import static io.spiffe.utils.X509CertificateTestUtils.createCertificate;
import static io.spiffe.utils.X509CertificateTestUtils.createRootCA;
import static org.junit.jupiter.api.Assertions.assertEquals;
import static org.junit.jupiter.api.Assertions.assertFalse;
import static org.junit.jupiter.api.Assertions.fail;
import static org.mockito.Mockito.when;

Expand Down Expand Up @@ -366,6 +367,22 @@ void checkServerTrusted_verifierResult_ThrowCertificateException() throws Bundle
}
}

@Test
void checkServerTrusted_untrustedChain_verifierNotInvoked() throws BundleNotFoundException {
when(bundleSource.getBundleForTrustDomain(TrustDomain.parse("example.org"))).thenReturn(bundleUnknown);
final AtomicBoolean verifierInvoked = new AtomicBoolean(false);
final SpiffeIdVerifier verifier = (spiffeId, verifiedChain) -> verifierInvoked.set(true);

SpiffeTrustManager spiffeTrustManager = new SpiffeTrustManager(bundleSource, verifier);
try {
spiffeTrustManager.checkServerTrusted(chain, "");
fail("CertificateException was expected");
} catch (CertificateException e) {
assertEquals("Cert chain cannot be verified", e.getMessage());
}
assertFalse(verifierInvoked.get(), "verifier must not be invoked when the chain cannot be verified");
}

@Test
void getAcceptedIssuers() {
X509Certificate[] acceptedIssuers = spiffeTrustManager.getAcceptedIssuers();
Expand Down