Skip to content

Commit 2f917f0

Browse files
dghgitdghgit
committed
BJA-503 fixed email policy issue
BJA-496 removed dependency on BC in JVM provider table BJA-500/501 CMP/OCSP enhancements reversed out PKCS10 check for attributes setting, minor updates/refactoring
1 parent d9baaad commit 2f917f0

15 files changed

Lines changed: 214 additions & 63 deletions

File tree

‎CONTRIBUTORS.html‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -363,6 +363,7 @@
363363
<li>KB Sriram&lt;mail_kb&#064yahoo.com&gt; testing for odd encodings for PGP User Attribute Subpackets.</li>
364364
<li>Marco Schulze&lt;marco&#064nightlabs.de&gt; Reported verification bug in GenericSigner.</li>
365365
<li>Martin Schaef&lt;https://github.com/martinschaef&gt; contributed a code-cleanup patch.</li>
366+
<li>Lijun Liao&lt;&jun.liao&#064gmail.comgt; addition of getSignatureAlgorithmID to BasicOCSPResp.</li>
366367
</ul>
367368
</body>
368369
</html>

‎bc-build.properties‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11

2-
release.suffix: 151
3-
release.name: 1.51
4-
release.version: 1.51.0
2+
release.suffix: 152b01
3+
release.name: 1.52b01
4+
release.version: 1.52.0.1
55
release.debug: false
66

77
mail.jar.home: /opt/javamail/mail.jar

‎core/src/main/java/org/bouncycastle/asn1/cmp/CMPCertificate.java‎

Lines changed: 60 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,7 @@
11
package org.bouncycastle.asn1.cmp;
22

3+
import java.io.IOException;
4+
35
import org.bouncycastle.asn1.ASN1Choice;
46
import org.bouncycastle.asn1.ASN1Object;
57
import org.bouncycastle.asn1.ASN1Primitive;
@@ -14,14 +16,31 @@ public class CMPCertificate
1416
implements ASN1Choice
1517
{
1618
private Certificate x509v3PKCert;
17-
private AttributeCertificate x509v2AttrCert;
19+
20+
private int otherTagValue;
21+
private ASN1Object otherCert;
1822

1923
/**
20-
* Note: the addition of attribute certificates is a BC extension.
24+
* Note: the addition of attribute certificates is a BC extension. If you use this constructor they
25+
* will be added with a tag value of 1.
26+
* @deprecated use (type. otherCert) constructor
2127
*/
2228
public CMPCertificate(AttributeCertificate x509v2AttrCert)
2329
{
24-
this.x509v2AttrCert = x509v2AttrCert;
30+
this(1, x509v2AttrCert);
31+
}
32+
33+
/**
34+
* Note: the addition of other certificates is a BC extension. If you use this constructor they
35+
* will be added with an explicit tag value of type.
36+
*
37+
* @param type the type of the certificate (used as a tag value).
38+
* @param otherCert the object representing the certificate
39+
*/
40+
public CMPCertificate(int type, ASN1Object otherCert)
41+
{
42+
this.otherTagValue = type;
43+
this.otherCert = otherCert;
2544
}
2645

2746
public CMPCertificate(Certificate x509v3PKCert)
@@ -41,14 +60,28 @@ public static CMPCertificate getInstance(Object o)
4160
return (CMPCertificate)o;
4261
}
4362

44-
if (o instanceof ASN1Sequence || o instanceof byte[])
63+
if (o instanceof byte[])
64+
{
65+
try
66+
{
67+
o = ASN1Primitive.fromByteArray((byte[])o);
68+
}
69+
catch (IOException e)
70+
{
71+
throw new IllegalArgumentException("Invalid encoding in CMPCertificate");
72+
}
73+
}
74+
75+
if (o instanceof ASN1Sequence)
4576
{
4677
return new CMPCertificate(Certificate.getInstance(o));
4778
}
4879

4980
if (o instanceof ASN1TaggedObject)
5081
{
51-
return new CMPCertificate(AttributeCertificate.getInstance(((ASN1TaggedObject)o).getObject()));
82+
ASN1TaggedObject taggedObject = (ASN1TaggedObject)o;
83+
84+
return new CMPCertificate(taggedObject.getTagNo(), taggedObject.getObject());
5285
}
5386

5487
throw new IllegalArgumentException("Invalid object: " + o.getClass().getName());
@@ -64,27 +97,43 @@ public Certificate getX509v3PKCert()
6497
return x509v3PKCert;
6598
}
6699

100+
/**
101+
* Return an AttributeCertificate interpretation of otherCert.
102+
* @deprecated use getOtherCert and getOtherTag to make sure message is really what it should be.
103+
*
104+
* @return an AttributeCertificate
105+
*/
67106
public AttributeCertificate getX509v2AttrCert()
68107
{
69-
return x509v2AttrCert;
108+
return AttributeCertificate.getInstance(otherCert);
109+
}
110+
111+
public int getOtherCertTag()
112+
{
113+
return otherTagValue;
114+
}
115+
116+
public ASN1Object getOtherCert()
117+
{
118+
return otherCert;
70119
}
71120

72121
/**
73122
* <pre>
74123
* CMPCertificate ::= CHOICE {
75-
* x509v3PKCert Certificate
76-
* x509v2AttrCert [1] AttributeCertificate
124+
* x509v3PKCert Certificate
125+
* otherCert [tag] EXPLICIT ANY DEFINED BY tag
77126
* }
78127
* </pre>
79-
* Note: the addition of attribute certificates is a BC extension.
128+
* Note: the addition of the explicit tagging is a BC extension. We apologise for the warped syntax, but hopefully you get the idea.
80129
*
81130
* @return a basic ASN.1 object representation.
82131
*/
83132
public ASN1Primitive toASN1Primitive()
84133
{
85-
if (x509v2AttrCert != null)
134+
if (otherCert != null)
86135
{ // explicit following CMP conventions
87-
return new DERTaggedObject(true, 1, x509v2AttrCert);
136+
return new DERTaggedObject(true, otherTagValue, otherCert);
88137
}
89138

90139
return x509v3PKCert.toASN1Primitive();

‎core/src/main/java/org/bouncycastle/asn1/pkcs/CertificationRequestInfo.java‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -71,7 +71,7 @@ public CertificationRequestInfo(
7171
SubjectPublicKeyInfo pkInfo,
7272
ASN1Set attributes)
7373
{
74-
if ((subject == null) || (pkInfo == null) || (attributes == null))
74+
if ((subject == null) || (pkInfo == null))
7575
{
7676
throw new IllegalArgumentException("Not all mandatory fields set in CertificationRequestInfo generator.");
7777
}
@@ -89,7 +89,7 @@ public CertificationRequestInfo(
8989
SubjectPublicKeyInfo pkInfo,
9090
ASN1Set attributes)
9191
{
92-
if ((subject == null) || (pkInfo == null) || (attributes == null))
92+
if ((subject == null) || (pkInfo == null))
9393
{
9494
throw new IllegalArgumentException("Not all mandatory fields set in CertificationRequestInfo generator.");
9595
}

‎mail/src/main/java/org/bouncycastle/mail/smime/SMIMECompressedGenerator.java‎

Lines changed: 15 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -38,20 +38,25 @@ public class SMIMECompressedGenerator
3838

3939
static
4040
{
41-
final MailcapCommandMap mc = (MailcapCommandMap)CommandMap.getDefaultCommandMap();
41+
CommandMap commandMap = CommandMap.getDefaultCommandMap();
4242

43-
mc.addMailcap("application/pkcs7-mime;; x-java-content-handler=org.bouncycastle.mail.smime.handlers.pkcs7_mime");
44-
mc.addMailcap("application/x-pkcs7-mime;; x-java-content-handler=org.bouncycastle.mail.smime.handlers.x_pkcs7_mime");
45-
46-
AccessController.doPrivileged(new PrivilegedAction()
43+
if (commandMap instanceof MailcapCommandMap)
4744
{
48-
public Object run()
45+
final MailcapCommandMap mc = (MailcapCommandMap)commandMap;
46+
47+
mc.addMailcap("application/pkcs7-mime;; x-java-content-handler=org.bouncycastle.mail.smime.handlers.pkcs7_mime");
48+
mc.addMailcap("application/x-pkcs7-mime;; x-java-content-handler=org.bouncycastle.mail.smime.handlers.x_pkcs7_mime");
49+
50+
AccessController.doPrivileged(new PrivilegedAction()
4951
{
50-
CommandMap.setDefaultCommandMap(mc);
52+
public Object run()
53+
{
54+
CommandMap.setDefaultCommandMap(mc);
5155

52-
return null;
53-
}
54-
});
56+
return null;
57+
}
58+
});
59+
}
5560
}
5661

5762
/**

‎mail/src/main/java/org/bouncycastle/mail/smime/SMIMEEnvelopedGenerator.java‎

Lines changed: 13 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -76,17 +76,20 @@ public class SMIMEEnvelopedGenerator
7676
{
7777
public Object run()
7878
{
79-
CommandMap.setDefaultCommandMap(addCommands(CommandMap.getDefaultCommandMap()));
79+
CommandMap commandMap = CommandMap.getDefaultCommandMap();
80+
81+
if (commandMap instanceof MailcapCommandMap)
82+
{
83+
CommandMap.setDefaultCommandMap(addCommands((MailcapCommandMap)commandMap));
84+
}
8085

8186
return null;
8287
}
8388
});
8489
}
8590

86-
private static MailcapCommandMap addCommands(CommandMap cm)
91+
private static MailcapCommandMap addCommands(MailcapCommandMap mc)
8792
{
88-
MailcapCommandMap mc = (MailcapCommandMap)cm;
89-
9093
mc.addMailcap("application/pkcs7-signature;; x-java-content-handler=org.bouncycastle.mail.smime.handlers.pkcs7_signature");
9194
mc.addMailcap("application/pkcs7-mime;; x-java-content-handler=org.bouncycastle.mail.smime.handlers.pkcs7_mime");
9295
mc.addMailcap("application/x-pkcs7-signature;; x-java-content-handler=org.bouncycastle.mail.smime.handlers.x_pkcs7_signature");
@@ -217,7 +220,12 @@ public void write(OutputStream out)
217220
encrypted = fact.regenerate(out, _encryptor);
218221
}
219222

220-
_content.getDataHandler().setCommandMap(addCommands(CommandMap.getDefaultCommandMap()));
223+
CommandMap commandMap = CommandMap.getDefaultCommandMap();
224+
225+
if (commandMap instanceof MailcapCommandMap)
226+
{
227+
_content.getDataHandler().setCommandMap(addCommands((MailcapCommandMap)commandMap));
228+
}
221229

222230
_content.writeTo(encrypted);
223231

‎mail/src/main/java/org/bouncycastle/mail/smime/SMIMESignedGenerator.java‎

Lines changed: 13 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -104,10 +104,8 @@ public class SMIMESignedGenerator
104104
public static final Map RFC5751_MICALGS;
105105
public static final Map STANDARD_MICALGS;
106106

107-
private static MailcapCommandMap addCommands(CommandMap cm)
107+
private static MailcapCommandMap addCommands(MailcapCommandMap mc)
108108
{
109-
MailcapCommandMap mc = (MailcapCommandMap)cm;
110-
111109
mc.addMailcap("application/pkcs7-signature;; x-java-content-handler=org.bouncycastle.mail.smime.handlers.pkcs7_signature");
112110
mc.addMailcap("application/pkcs7-mime;; x-java-content-handler=org.bouncycastle.mail.smime.handlers.pkcs7_mime");
113111
mc.addMailcap("application/x-pkcs7-signature;; x-java-content-handler=org.bouncycastle.mail.smime.handlers.x_pkcs7_signature");
@@ -123,7 +121,12 @@ private static MailcapCommandMap addCommands(CommandMap cm)
123121
{
124122
public Object run()
125123
{
126-
CommandMap.setDefaultCommandMap(addCommands(CommandMap.getDefaultCommandMap()));
124+
CommandMap commandMap = CommandMap.getDefaultCommandMap();
125+
126+
if (commandMap instanceof MailcapCommandMap)
127+
{
128+
CommandMap.setDefaultCommandMap(addCommands((MailcapCommandMap)commandMap));
129+
}
127130

128131
return null;
129132
}
@@ -593,7 +596,12 @@ public void write(OutputStream out)
593596
}
594597
else
595598
{
596-
content.getDataHandler().setCommandMap(addCommands(CommandMap.getDefaultCommandMap()));
599+
CommandMap commandMap = CommandMap.getDefaultCommandMap();
600+
601+
if (commandMap instanceof MailcapCommandMap)
602+
{
603+
content.getDataHandler().setCommandMap(addCommands((MailcapCommandMap)commandMap));
604+
}
597605

598606
content.writeTo(signingStream);
599607
}

‎mail/src/main/java/org/bouncycastle/mail/smime/SMIMESignedParser.java‎

Lines changed: 18 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -125,23 +125,28 @@ private static CMSTypedStream getSignedInputStream(
125125

126126
static
127127
{
128-
final MailcapCommandMap mc = (MailcapCommandMap)CommandMap.getDefaultCommandMap();
128+
CommandMap commandMap = CommandMap.getDefaultCommandMap();
129129

130-
mc.addMailcap("application/pkcs7-signature;; x-java-content-handler=org.bouncycastle.mail.smime.handlers.pkcs7_signature");
131-
mc.addMailcap("application/pkcs7-mime;; x-java-content-handler=org.bouncycastle.mail.smime.handlers.pkcs7_mime");
132-
mc.addMailcap("application/x-pkcs7-signature;; x-java-content-handler=org.bouncycastle.mail.smime.handlers.x_pkcs7_signature");
133-
mc.addMailcap("application/x-pkcs7-mime;; x-java-content-handler=org.bouncycastle.mail.smime.handlers.x_pkcs7_mime");
134-
mc.addMailcap("multipart/signed;; x-java-content-handler=org.bouncycastle.mail.smime.handlers.multipart_signed");
135-
136-
AccessController.doPrivileged(new PrivilegedAction()
130+
if (commandMap instanceof MailcapCommandMap)
137131
{
138-
public Object run()
132+
final MailcapCommandMap mc = (MailcapCommandMap)commandMap;
133+
134+
mc.addMailcap("application/pkcs7-signature;; x-java-content-handler=org.bouncycastle.mail.smime.handlers.pkcs7_signature");
135+
mc.addMailcap("application/pkcs7-mime;; x-java-content-handler=org.bouncycastle.mail.smime.handlers.pkcs7_mime");
136+
mc.addMailcap("application/x-pkcs7-signature;; x-java-content-handler=org.bouncycastle.mail.smime.handlers.x_pkcs7_signature");
137+
mc.addMailcap("application/x-pkcs7-mime;; x-java-content-handler=org.bouncycastle.mail.smime.handlers.x_pkcs7_mime");
138+
mc.addMailcap("multipart/signed;; x-java-content-handler=org.bouncycastle.mail.smime.handlers.multipart_signed");
139+
140+
AccessController.doPrivileged(new PrivilegedAction()
139141
{
140-
CommandMap.setDefaultCommandMap(mc);
142+
public Object run()
143+
{
144+
CommandMap.setDefaultCommandMap(mc);
141145

142-
return null;
143-
}
144-
});
146+
return null;
147+
}
148+
});
149+
}
145150
}
146151

147152
/**

‎pkix/src/main/java/org/bouncycastle/cert/ocsp/BasicOCSPResp.java‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,7 @@
1212
import org.bouncycastle.asn1.ocsp.BasicOCSPResponse;
1313
import org.bouncycastle.asn1.ocsp.ResponseData;
1414
import org.bouncycastle.asn1.ocsp.SingleResponse;
15+
import org.bouncycastle.asn1.x509.AlgorithmIdentifier;
1516
import org.bouncycastle.asn1.x509.Certificate;
1617
import org.bouncycastle.asn1.x509.Extension;
1718
import org.bouncycastle.asn1.x509.Extensions;
@@ -58,6 +59,16 @@ public byte[] getTBSResponseData()
5859
}
5960
}
6061

62+
/**
63+
* Return the algorithm identifier describing the signature used in the response.
64+
*
65+
* @return an AlgorithmIdentifier
66+
*/
67+
public AlgorithmIdentifier getSignatureAlgorithmID()
68+
{
69+
return resp.getSignatureAlgorithm();
70+
}
71+
6172
public int getVersion()
6273
{
6374
return data.getVersion().getValue().intValue() + 1;

‎pkix/src/test/java/org/bouncycastle/cms/test/BcSignedDataTest.java‎

Lines changed: 14 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -38,6 +38,7 @@
3838
import org.bouncycastle.cert.jcajce.JcaCRLStore;
3939
import org.bouncycastle.cert.jcajce.JcaCertStore;
4040
import org.bouncycastle.cert.jcajce.JcaX509CRLHolder;
41+
import org.bouncycastle.cert.jcajce.JcaX509CertificateConverter;
4142
import org.bouncycastle.cert.jcajce.JcaX509CertificateHolder;
4243
import org.bouncycastle.cms.CMSAbsentContent;
4344
import org.bouncycastle.cms.CMSAlgorithm;
@@ -57,8 +58,11 @@
5758
import org.bouncycastle.cms.jcajce.JcaSignerInfoGeneratorBuilder;
5859
import org.bouncycastle.cms.jcajce.JcaSimpleSignerInfoGeneratorBuilder;
5960
import org.bouncycastle.cms.jcajce.JcaSimpleSignerInfoVerifierBuilder;
61+
import org.bouncycastle.crypto.digests.SHA1Digest;
6062
import org.bouncycastle.crypto.params.AsymmetricKeyParameter;
63+
import org.bouncycastle.crypto.signers.RSADigestSigner;
6164
import org.bouncycastle.crypto.util.PrivateKeyFactory;
65+
import org.bouncycastle.crypto.util.PublicKeyFactory;
6266
import org.bouncycastle.jcajce.provider.config.ConfigurableProvider;
6367
import org.bouncycastle.jce.provider.BouncyCastleProvider;
6468
import org.bouncycastle.operator.BufferingContentSigner;
@@ -1436,7 +1440,16 @@ public void testUnsortedAttributes()
14361440
Iterator certIt = certCollection.iterator();
14371441
X509CertificateHolder cert = (X509CertificateHolder)certIt.next();
14381442

1439-
assertEquals(true, signer.verify(new JcaSimpleSignerInfoVerifierBuilder().setProvider(BC).build(cert)));
1443+
assertEquals(false, signer.verify(new JcaSimpleSignerInfoVerifierBuilder().setProvider(BC).build(cert)));
1444+
1445+
RSADigestSigner sig = new RSADigestSigner(new SHA1Digest());
1446+
1447+
sig.init(false, PublicKeyFactory.createKey(cert.getSubjectPublicKeyInfo()));
1448+
1449+
byte[] encoded = signer.toASN1Structure().getAuthenticatedAttributes().getEncoded();
1450+
sig.update(encoded, 0, encoded.length);
1451+
1452+
assertEquals(true, sig.verifySignature(signer.getSignature()));
14401453
}
14411454
}
14421455

0 commit comments

Comments
 (0)