summary refs log tree commit diff
path: root/crypto/src
diff options
context:
space:
mode:
authorPeter Dettman <peter.dettman@bouncycastle.org>2018-04-17 13:32:41 +0700
committerPeter Dettman <peter.dettman@bouncycastle.org>2018-04-17 13:32:41 +0700
commitc1fe1982e3a7d0748e98ec4e4c54d098e74fc658 (patch)
tree00cc1ede3d38d257525270495a054d26cabe723d /crypto/src
parentPKIX: explicit validation of version number and extension repeats (diff)
downloadBouncyCastle.NET-ed25519-c1fe1982e3a7d0748e98ec4e4c54d098e74fc658.tar.xz
PKIX: Allow a V0 TA to appear at end of the cert path.
Diffstat (limited to 'crypto/src')
-rw-r--r--crypto/src/pkix/PkixAttrCertPathBuilder.cs2
-rw-r--r--crypto/src/pkix/PkixCertPathBuilder.cs2
-rw-r--r--crypto/src/pkix/PkixCertPathValidator.cs4
-rw-r--r--crypto/src/pkix/PkixCertPathValidatorUtilities.cs14
4 files changed, 20 insertions, 2 deletions
diff --git a/crypto/src/pkix/PkixAttrCertPathBuilder.cs b/crypto/src/pkix/PkixAttrCertPathBuilder.cs
index 646cc5db5..3d5fa18e3 100644
--- a/crypto/src/pkix/PkixAttrCertPathBuilder.cs
+++ b/crypto/src/pkix/PkixAttrCertPathBuilder.cs
@@ -143,7 +143,7 @@ namespace Org.BouncyCastle.Pkix
 			try
 			{
 				// check whether the issuer of <tbvCert> is a TrustAnchor
-				if (PkixCertPathValidatorUtilities.FindTrustAnchor(tbvCert, pkixParams.GetTrustAnchors()) != null)
+				if (PkixCertPathValidatorUtilities.IsIssuerTrustAnchor(tbvCert, pkixParams.GetTrustAnchors()))
 				{
 					PkixCertPath certPath = new PkixCertPath(tbvPath);
 					PkixCertPathValidatorResult result;
diff --git a/crypto/src/pkix/PkixCertPathBuilder.cs b/crypto/src/pkix/PkixCertPathBuilder.cs
index fa38a5ec0..37a1c8c9c 100644
--- a/crypto/src/pkix/PkixCertPathBuilder.cs
+++ b/crypto/src/pkix/PkixCertPathBuilder.cs
@@ -118,7 +118,7 @@ namespace Org.BouncyCastle.Pkix
 			try
 			{
 				// check whether the issuer of <tbvCert> is a TrustAnchor
-				if (PkixCertPathValidatorUtilities.FindTrustAnchor(tbvCert, pkixParams.GetTrustAnchors()) != null)
+				if (PkixCertPathValidatorUtilities.IsIssuerTrustAnchor(tbvCert, pkixParams.GetTrustAnchors()))
 				{
 					// exception message from possibly later tried certification
 					// chains
diff --git a/crypto/src/pkix/PkixCertPathValidator.cs b/crypto/src/pkix/PkixCertPathValidator.cs
index 1d7c00d7d..64039f9f1 100644
--- a/crypto/src/pkix/PkixCertPathValidator.cs
+++ b/crypto/src/pkix/PkixCertPathValidator.cs
@@ -289,6 +289,10 @@ namespace Org.BouncyCastle.Pkix
                 {
                     if (cert != null && cert.Version == 1)
                     {
+                        // we've found the trust anchor at the top of the path, ignore and keep going
+                        if ((i == 1) && cert.Equals(trust.TrustedCert))
+                            continue;
+
                         throw new PkixCertPathValidatorException(
 							"Version 1 certificates can't be used as CA ones.", null, certPath, index);
                     }
diff --git a/crypto/src/pkix/PkixCertPathValidatorUtilities.cs b/crypto/src/pkix/PkixCertPathValidatorUtilities.cs
index a2704a746..2ccaa32ce 100644
--- a/crypto/src/pkix/PkixCertPathValidatorUtilities.cs
+++ b/crypto/src/pkix/PkixCertPathValidatorUtilities.cs
@@ -143,6 +143,20 @@ namespace Org.BouncyCastle.Pkix
 			return trust;
 		}
 
+        internal static bool IsIssuerTrustAnchor(
+            X509Certificate cert,
+            ISet trustAnchors)
+        {
+            try
+            {
+                return FindTrustAnchor(cert, trustAnchors) != null;
+            }
+            catch (Exception e)
+            {
+                return false;
+            }
+        }
+
 		internal static void AddAdditionalStoresFromAltNames(
 			X509Certificate	cert,
 			PkixParameters	pkixParams)