Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Revert "[7.x] [RHPAM-4504] Update KeyStoreHelper signature fails on i… #4877

Merged
merged 1 commit into from
Dec 16, 2022
Merged

Revert "[7.x] [RHPAM-4504] Update KeyStoreHelper signature fails on i… #4877

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
33 changes: 11 additions & 22 deletions drools-core/src/main/java/org/drools/core/util/KeyStoreHelper.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -32,8 +32,6 @@
import javax.crypto.SecretKey;

import org.drools.core.RuleBaseConfiguration;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;

import static org.drools.core.util.KeyStoreConstants.KEY_CERTIFICATE_TYPE;
import static org.drools.core.util.KeyStoreConstants.KEY_PASSWORD_TYPE;
Expand Down Expand Up @@ -62,8 +60,6 @@
*/
public class KeyStoreHelper {

private final Logger logger = LoggerFactory.getLogger(KeyStoreHelper.class);

private static final String SHA512WITH_RSA = "SHA512withRSA";
private static final String MD5WITH_RSA = "MD5withRSA";

Expand Down Expand Up @@ -237,26 +233,19 @@ public boolean checkDataWithPublicKey(final String publicKeyAlias,
Signature sig = Signature.getInstance( SHA512WITH_RSA );
sig.initVerify( cert.getPublicKey() );
sig.update( data );
boolean result = false;
try {
result = sig.verify(signature); // IBM JDK 1.8 returns false without SignatureException
return sig.verify( signature );
} catch (SignatureException e) {
logger.warn("Exception while verifying signature", e);
}
return result || verifyWithFallbackAlgorithmIfAllowed(cert, data, signature);
}

private boolean verifyWithFallbackAlgorithmIfAllowed(Certificate cert, byte[] data, byte[] signature) throws NoSuchAlgorithmException, InvalidKeyException, SignatureException {
if (allowVerifyOldSignAlgo) {
// Fallback for old sign algorithm
Signature sig = Signature.getInstance(MD5WITH_RSA);
sig.initVerify(cert.getPublicKey());
sig.update(data);
return sig.verify(signature);
} else {
logger.warn("Failed to verify signature. If you call this method for data signed by old Drools version," +
" set system property \"" + KeyStoreConstants.PROP_VERIFY_OLD_SIGN + "\" to true");
return false;
if (allowVerifyOldSignAlgo) {
// Fallback for old sign algorithm
sig = Signature.getInstance(MD5WITH_RSA);
sig.initVerify(cert.getPublicKey());
sig.update(data);
return sig.verify(signature);
} else {
throw new RuntimeException("Failed to verify signature. If you call this method for data signed by old Drools version," +
" set system property \"" + KeyStoreConstants.PROP_VERIFY_OLD_SIGN + "\" to true" , e);
}
}
}

Expand Down