Damans227 commented on code in PR #13787:
URL: https://github.com/apache/cloudstack/pull/13787#discussion_r4199718302
##########
plugins/ca/root-ca/src/main/java/org/apache/cloudstack/ca/provider/RootCACustomTrustManager.java:
##########
@@ -39,21 +41,36 @@ public final class RootCACustomTrustManager implements
X509TrustManager {
private String clientAddress = "Unknown";
private boolean authStrictness = true;
private boolean allowExpiredCertificate = true;
+ private boolean certSignatureVerification = false;
private CrlDao crlDao;
private List<X509Certificate> caCertificates;
private Map<String, X509Certificate> activeCertMap;
- public RootCACustomTrustManager(final String clientAddress, final boolean
authStrictness, final boolean allowExpiredCertificate, final Map<String,
X509Certificate> activeCertMap, final List<X509Certificate> caCertificates,
final CrlDao crlDao) {
+ public RootCACustomTrustManager(final String clientAddress, final boolean
authStrictness, final boolean allowExpiredCertificate, final boolean
certSignatureVerification,
+ final Map<String, X509Certificate> activeCertMap, final
List<X509Certificate> caCertificates, final CrlDao crlDao) {
if (StringUtils.isNotEmpty(clientAddress)) {
this.clientAddress = clientAddress.replace("/", "").split(":")[0];
}
this.authStrictness = authStrictness;
this.allowExpiredCertificate = allowExpiredCertificate;
+ this.certSignatureVerification = certSignatureVerification;
this.activeCertMap = activeCertMap;
this.caCertificates = caCertificates;
this.crlDao = crlDao;
}
+ private boolean isSignedByAnyRootCA(final X509Certificate certificate) {
+ for (final X509Certificate ca : caCertificates) {
+ try {
+ certificate.verify(ca.getPublicKey());
+ return true;
+ } catch (final GeneralSecurityException e) {
+ // try the next CA certificate
Review Comment:
logged at debug with the CA and the reason, in 57d842d. debug since one miss
is normal when there are several CAs
##########
plugins/ca/root-ca/src/main/java/org/apache/cloudstack/ca/provider/RootCAProvider.java:
##########
@@ -596,6 +605,30 @@ public boolean
isManagementCertificate(java.security.cert.Certificate certificat
}
X509Certificate x509Certificate = (X509Certificate) certificate;
+ // When signature verification is enabled, confirm the certificate was
issued by one of our root CAs
+ // before trusting its SAN. Otherwise any self-signed certificate
carrying the management SAN
+ // would qualify as a peer management node.
+ if (rootCACertSignatureVerification.value()) {
+ if (CollectionUtils.isEmpty(caCertificates)) {
+ logger.warn("Cannot verify management certificate signature
because no root CA certificate is available");
+ return false;
+ }
+ boolean signedByCA = false;
+ for (final X509Certificate ca : caCertificates) {
+ try {
+ x509Certificate.verify(ca.getPublicKey());
+ signedByCA = true;
+ break;
+ } catch (final GeneralSecurityException e) {
+ // try the next CA certificate
Review Comment:
same here, in 57d842d
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
