(SERVER-119) Properly sign puppet extension values #51
Conversation
dankreek
force-pushed
the
SERVER-119/sign-puppet-extensions-properly
branch
from
4398a28 to
dcbaf8f
Compare
|
It'd be great if the commit message for 4943604 contained at least the following information: The behavior of the system without the patch applied, why this is a problem, and how the change resolves the problem. |
| @@ -189,28 +196,43 @@ public static X509Certificate signCertificate(String issuerDn, | |||
| String subjectDn, | |||
| PublicKey subjectPublicKey, | |||
| List<Map<String, Object>> extensions) | |||
| throws IOException, OperatorCreationException, CertificateException, NoSuchAlgorithmException, SignatureException, InvalidKeyException { | |||
| X509V3CertificateGenerator certGen = new X509V3CertificateGenerator(); | |||
There was a problem hiding this comment.
Oh sweet, so we were able to get rid of using this deprecated class? Finally. Looks like we can get rid of the import statement for this class (surprised IDEA didn't take care of that).
|
I'm 👍 on this barring @jeffmccune's comment about the commit message. My knowledge of this is limited, however, so someone else should definitely take a look at it. |
|
I've got no other comments either, I'm 👍 except the housekeeping comment. Looks good. |
|
If ya'lls ready to merge, let me know and I can amend that commit message before merge |
Currently, this library signs all custom extensions as binary data wrapped in a DER Octet String, which is the same way the Ruby Puppet Master does it. According to RFC 5280, the values of all X.509 extensions must be a valid DER encoded structure contained within a DER Octet String, so the current method is technically incorrect. The Bouncy Castle library assumes adherence to this standard, so trying to exactly mimic the way MRI Puppet signs trusted facts has proven to be very unwieldy and brittle. Other extensions which contain a simple string as a value will use a UTF8String type and then wrap it inside of a DER Octet String.
Did this just to maintain uniformity in our test fixtures.
dankreek
force-pushed
the
SERVER-119/sign-puppet-extensions-properly
branch
from
dcbaf8f to
23ce8ef
Compare
No description provided.