Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
fix: PKCS12 ephemeral key and non-encrypted MAC are not supported mac…
…OS (#124) Fix bugs for PKCS12 certificates on macOS: - doesn't support ephemeral key - doesn't support non-encrypted MAC Test on Linux, macOS, Windows Signed-off-by: Junjie Gao <junjiegao@microsoft.com> --------- Signed-off-by: Junjie Gao <junjiegao@microsoft.com>
- Loading branch information
Showing
9 changed files
with
121 additions
and
4 deletions.
There are no files selected for viewing
1 change: 0 additions & 1 deletion
1
Notation.Plugin.AzureKeyVault.Tests/Certificate/CertificateChainTests.cs
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
50 changes: 50 additions & 0 deletions
50
Notation.Plugin.AzureKeyVault.Tests/Certificate/Pkcs12Tests.cs
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,50 @@ | ||
| using System.IO; | ||
| using System.Security.Cryptography.Pkcs; | ||
| using Notation.Plugin.Protocol; | ||
| using Xunit; | ||
|
|
||
| namespace Notation.Plugin.AzureKeyVault.Certificate.Tests | ||
| { | ||
| public class Pkcs12Tests | ||
| { | ||
| [Fact] | ||
| public void ReEncode() | ||
| { | ||
| // read the pfx file | ||
| byte[] data = File.ReadAllBytes(Path.Combine(Directory.GetCurrentDirectory(), "TestData", "cert_chain.pfx")); | ||
| Pkcs12Info originPfx = Pkcs12Info.Decode(data, out _); | ||
| Assert.True(originPfx.IntegrityMode == Pkcs12IntegrityMode.Password); | ||
|
|
||
| // re-encode the pfx file | ||
| byte[] newData = Pkcs12.ReEncode(data); | ||
| Pkcs12Info pfxWithoutMac = Pkcs12Info.Decode(newData, out _); | ||
| Assert.True(pfxWithoutMac.IntegrityMode == Pkcs12IntegrityMode.None); | ||
| } | ||
|
|
||
| [Fact] | ||
| public void ReEncode_WithInvalidMac() | ||
| { | ||
| // read the pfx file | ||
| byte[] data = File.ReadAllBytes(Path.Combine(Directory.GetCurrentDirectory(), "TestData", "cert_invalid_mac.pfx")); | ||
| Pkcs12Info originPfx = Pkcs12Info.Decode(data, out _); | ||
| Assert.True(originPfx.IntegrityMode == Pkcs12IntegrityMode.Password); | ||
|
|
||
| // re-encode the pfx file | ||
| Assert.Throws<ValidationException>(() => Pkcs12.ReEncode(data)); | ||
| } | ||
|
|
||
| [Fact] | ||
| public void ReEncode_withoutMac(){ | ||
| // read the pfx file | ||
| byte[] data = File.ReadAllBytes(Path.Combine(Directory.GetCurrentDirectory(), "TestData", "cert_without_mac.pfx")); | ||
| Pkcs12Info originPfx = Pkcs12Info.Decode(data, out _); | ||
| Assert.True(originPfx.IntegrityMode == Pkcs12IntegrityMode.None); | ||
|
|
||
| // re-encode the pfx file | ||
| byte[] newData = Pkcs12.ReEncode(data); | ||
| Pkcs12Info pfxWithoutMac = Pkcs12Info.Decode(newData, out _); | ||
| Assert.True(pfxWithoutMac.IntegrityMode == Pkcs12IntegrityMode.None); | ||
|
|
||
| } | ||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Binary file not shown.
Binary file not shown.
2 changes: 0 additions & 2 deletions
2
Notation.Plugin.AzureKeyVault/Certificate/CertificateChain.cs
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,51 @@ | ||
| using System.Security.Cryptography.Pkcs; | ||
| using Notation.Plugin.Protocol; | ||
|
|
||
| namespace Notation.Plugin.AzureKeyVault.Certificate | ||
| { | ||
| static class Pkcs12 | ||
| { | ||
| /// <summary> | ||
| /// Re-encode the PKCS12 data to remove the MAC and keys. | ||
| /// The macOS doesn't support PKCS12 with non-encrypted MAC. | ||
| /// </summary> | ||
| /// <param name="data"></param> | ||
| /// <returns></returns> | ||
| /// <exception cref="ValidationException"></exception> | ||
| public static byte[] ReEncode(byte[] data) | ||
| { | ||
| Pkcs12Info pfx = Pkcs12Info.Decode(data, out _); | ||
| // only remove the MAC if it is password protected | ||
| if (pfx.IntegrityMode != Pkcs12IntegrityMode.Password) | ||
| { | ||
| return data; | ||
| } | ||
| // verify the MAC with null password | ||
| if (!pfx.VerifyMac(null)) | ||
| { | ||
| throw new ValidationException("Invalid MAC or the MAC password is not null"); | ||
| } | ||
|
|
||
| // re-build PFX without MAC and keys | ||
| Pkcs12Builder pfxBuilder = new Pkcs12Builder(); | ||
| foreach (var safeContent in pfx.AuthenticatedSafe) | ||
| { | ||
| // decrypt with null password | ||
| safeContent.Decrypt((byte[]?)null); | ||
|
|
||
| // create a newSafeContent and only contains the certificate bag | ||
| var newSafeContent = new Pkcs12SafeContents(); | ||
| foreach (var bag in safeContent.GetBags()) | ||
| { | ||
| if (bag is Pkcs12CertBag) | ||
| { | ||
| newSafeContent.AddSafeBag(bag); | ||
| } | ||
| } | ||
| pfxBuilder.AddSafeContentsUnencrypted(newSafeContent); | ||
| } | ||
| pfxBuilder.SealWithoutIntegrity(); | ||
| return pfxBuilder.Encode(); | ||
| } | ||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters