ExternalVendorCode/HIRS
1
0
Fork 0
mirror of https://github.com/nsacyber/HIRS.git synced 2025-03-22 12:05:59 +00:00
Code Issues Actions 3 Packages Projects Releases Wiki Activity

Updated the Rim Validator to remove direct object parameters from the

Browse Source 
database and pass in the information the methods needed to function
This commit is contained in:
Cyrus 2023-10-31 10:48:37 -04:00
parent 071e89a44f
commit 1867e00301
3 changed files with 34 additions and 25 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

31
HIRS_AttestationCA/src/main/java/hirs/attestationca/persist/validation/FirmwareScvValidator.java
View File

@ -90,7 +90,7 @@ public class FirmwareScvValidator extends SupplyChainCredentialValidator {
// verify signatures // verify signatures
ReferenceManifestValidator referenceManifestValidator = ReferenceManifestValidator referenceManifestValidator =
new ReferenceManifestValidator(); new ReferenceManifestValidator();
referenceManifestValidator.setRim(baseReferenceManifest); referenceManifestValidator.setRim(baseReferenceManifest.getRimBytes());
//Validate signing cert //Validate signing cert
List<CertificateAuthorityCredential> allCerts = caCredentialRepository.findAll(); List<CertificateAuthorityCredential> allCerts = caCredentialRepository.findAll();
@ -99,23 +99,28 @@ public class FirmwareScvValidator extends SupplyChainCredentialValidator {
signingCert = cert; signingCert = cert;
KeyStore keyStore = ValidationService.getCaChain(signingCert, KeyStore keyStore = ValidationService.getCaChain(signingCert,
caCredentialRepository); caCredentialRepository);
if (referenceManifestValidator.validateXmlSignature(signingCert)) { try {
try { if (referenceManifestValidator.validateXmlSignature(signingCert.getX509Certificate().getPublicKey(),
if (!SupplyChainCredentialValidator.verifyCertificate( signingCert.getSubjectKeyIdString(), signingCert.getEncodedPublicKey())) {
try {
if (!SupplyChainCredentialValidator.verifyCertificate(
signingCert.getX509Certificate(), keyStore)) { signingCert.getX509Certificate(), keyStore)) {
passed = false; passed = false;
fwStatus = new AppraisalStatus(FAIL,
"Firmware validation failed: invalid certificate path.");
validationObject = baseReferenceManifest;
}
} catch (IOException ioEx) {
log.error("Error getting X509 cert from manager: " + ioEx.getMessage());
} catch (SupplyChainValidatorException scvEx) {
log.error("Error validating cert against keystore: " + scvEx.getMessage());
fwStatus = new AppraisalStatus(FAIL, fwStatus = new AppraisalStatus(FAIL,
"Firmware validation failed: invalid certificate path."); "Firmware validation failed: invalid certificate path.");
validationObject = baseReferenceManifest;
} }
} catch (IOException ioEx) { break;
log.error("Error getting X509 cert from manager: " + ioEx.getMessage());
} catch (SupplyChainValidatorException scvEx) {
log.error("Error validating cert against keystore: " + scvEx.getMessage());
fwStatus = new AppraisalStatus(FAIL,
"Firmware validation failed: invalid certificate path.");
} }
break; } catch (IOException ioEx) {
log.error("Error getting X509 cert from manager: " + ioEx.getMessage());
} }
} }

5
HIRS_AttestationCAPortal/src/main/java/hirs/attestationca/portal/page/controllers/ReferenceManifestDetailsPageController.java
View File

@ -272,7 +272,7 @@ public class ReferenceManifestDetailsPageController extends PageController<Refer
} }
// going to have to pull the filename and grab that from the DB // going to have to pull the filename and grab that from the DB
// to get the id to make the link // to get the id to make the link
RIM_VALIDATOR.setRim(baseRim); RIM_VALIDATOR.setRim(baseRim.getRimBytes());
for (SwidResource swidRes : resources) { for (SwidResource swidRes : resources) {
if (support != null && swidRes.getHashValue() if (support != null && swidRes.getHashValue()
.equalsIgnoreCase(support.getHexDecHash())) { .equalsIgnoreCase(support.getHexDecHash())) {
@ -300,7 +300,8 @@ public class ReferenceManifestDetailsPageController extends PageController<Refer
data.put("signatureValid", false); data.put("signatureValid", false);
for (CertificateAuthorityCredential cert : certificates) { for (CertificateAuthorityCredential cert : certificates) {
KeyStore keystore = ValidationService.getCaChain(cert, caCertificateRepository); KeyStore keystore = ValidationService.getCaChain(cert, caCertificateRepository);
if (RIM_VALIDATOR.validateXmlSignature(cert)) { if (RIM_VALIDATOR.validateXmlSignature(cert.getX509Certificate().getPublicKey(),
cert.getSubjectKeyIdString(), cert.getEncodedPublicKey())) {
try { try {
if (SupplyChainCredentialValidator.verifyCertificate( if (SupplyChainCredentialValidator.verifyCertificate(
cert.getX509Certificate(), keystore)) { cert.getX509Certificate(), keystore)) {

23
HIRS_Utils/src/main/java/hirs/utils/rim/ReferenceManifestValidator.java
View File

@ -1,6 +1,5 @@
package hirs.utils.rim; package hirs.utils.rim;
import hirs.utils.CertificateAuthorityCredential;
import jakarta.xml.bind.JAXBContext; import jakarta.xml.bind.JAXBContext;
import jakarta.xml.bind.JAXBException; import jakarta.xml.bind.JAXBException;
import jakarta.xml.bind.UnmarshalException; import jakarta.xml.bind.UnmarshalException;
@ -78,12 +77,12 @@ public class ReferenceManifestValidator {
* Setter for the RIM to be validated. The ReferenceManifest object is converted into a * Setter for the RIM to be validated. The ReferenceManifest object is converted into a
* Document for processing. * Document for processing.
* *
* @param rim ReferenceManifest object * @param rimBytes ReferenceManifest object bytes
*/ */
public void setRim(final ReferenceManifest rim) { public void setRim(final byte[] rimBytes) {
try { try {
Document doc = validateSwidtagSchema(removeXMLWhitespace(new StreamSource( Document doc = validateSwidtagSchema(removeXMLWhitespace(new StreamSource(
new ByteArrayInputStream(rim.getRimBytes())))); new ByteArrayInputStream(rimBytes))));
this.rim = doc; this.rim = doc;
} catch (IOException e) { } catch (IOException e) {
log.error("Error while unmarshalling rim bytes: " + e.getMessage()); log.error("Error while unmarshalling rim bytes: " + e.getMessage());
@ -152,11 +151,15 @@ public class ReferenceManifestValidator {
* or the RIM's subject key identifier. If the cert is matched then validation proceeds, * or the RIM's subject key identifier. If the cert is matched then validation proceeds,
* otherwise validation ends. * otherwise validation ends.
* *
* @param cert the cert to be checked against the RIM * @param publicKey public key from the CA credential
* @param subjectKeyIdString string version of the subjet key id of the CA credential
* @param encodedPublicKey the encoded public key
* @return true if the signature element is validated, false otherwise * @return true if the signature element is validated, false otherwise
*/ */
@SuppressWarnings("magicnumber") @SuppressWarnings("magicnumber")
public boolean validateXmlSignature(final CertificateAuthorityCredential cert) { public boolean validateXmlSignature(final PublicKey publicKey,
final String subjectKeyIdString,
final byte[] encodedPublicKey) {
DOMValidateContext context = null; DOMValidateContext context = null;
try { try {
NodeList nodes = rim.getElementsByTagNameNS(XMLSignature.XMLNS, "Signature"); NodeList nodes = rim.getElementsByTagNameNS(XMLSignature.XMLNS, "Signature");
@ -171,19 +174,19 @@ public class ReferenceManifestValidator {
if (embeddedCert != null) { if (embeddedCert != null) {
subjectKeyIdentifier = getCertificateSubjectKeyIdentifier(embeddedCert); subjectKeyIdentifier = getCertificateSubjectKeyIdentifier(embeddedCert);
if (Arrays.equals(embeddedCert.getPublicKey().getEncoded(), if (Arrays.equals(embeddedCert.getPublicKey().getEncoded(),
cert.getEncodedPublicKey())) { encodedPublicKey)) {
context = new DOMValidateContext(new X509KeySelector(), nodes.item(0)); context = new DOMValidateContext(new X509KeySelector(), nodes.item(0));
} }
} }
} else { } else {
subjectKeyIdentifier = getKeyName(rim); subjectKeyIdentifier = getKeyName(rim);
if (subjectKeyIdentifier.equals(cert.getSubjectKeyIdString())) { if (subjectKeyIdentifier.equals(subjectKeyIdString)) {
context = new DOMValidateContext(cert.getX509Certificate().getPublicKey(), context = new DOMValidateContext(publicKey,
nodes.item(0)); nodes.item(0));
} }
} }
if (context != null) { if (context != null) {
publicKey = cert.getX509Certificate().getPublicKey(); this.publicKey = publicKey;
signatureValid = validateSignedXMLDocument(context); signatureValid = validateSignedXMLDocument(context);
return signatureValid; return signatureValid;
} }