Commits on Sep 20, 2024

1. Fix possible infinite loop when loading cert chains from Java P11KeyS… …

   …tore
   
   When HSM contains certificate chains, the JDK P11KeyStore
   tries to load the full chain within loadChain() method.
   
   This action is performed in a while(true) loop as:
   
     while (true) {
       CK_ATTRIBUTE[] attrs = new CK_ATTRIBUTE[] {
         ATTR_TOKEN_TRUE,
         ATTR_CLASS_CERT,
         new CK_ATTRIBUTE(CKA_SUBJECT,
             next.getIssuerX500Principal().getEncoded()) };
       long[] ch = findObjects(session, attrs);
       if (ch == null || ch.length == 0) {
           // done
           break;
       } else {
           // Just take the first
           next = loadCert(session, ch[0]);
           lChain.add(next);
           if (next.getSubjectX500Principal().equals
                 (next.getIssuerX500Principal())) {
               // self signed
               break;
           }
       }
     }
   
   Here, supporting filtering certificates by CKA_SUBJECT is crucial
   otherwise the while true loop would continue forever (until findObjects
   returns some certificates and first one is not self signed)
   
   Signed-off-by: Alberto Panizzo <[email protected]>

   

   amsalby committed Sep 20, 2024
   Configuration menu

   • View commit details
   • Copy full SHA for 3269137
   • Browse repository at this point

   Copy the full SHA

   3269137 View commit details

   Browse the repository at this point in the history