ExternalVendorCode/HIRS
1
0
Fork 0
mirror of https://github.com/nsacyber/HIRS.git synced 2025-04-08 11:54:27 +00:00
Code Issues Actions 3 Packages Projects Releases Wiki Activity

This is a test run to ignore endorsement credential verification during firmware testing.

Browse Source
This commit is contained in:
Cyrus 2021-11-12 14:24:33 -05:00
parent c944aab335
commit d31b710824
2 changed files with 23 additions and 23 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

43
HIRS_AttestationCA/src/main/java/hirs/attestationca/service/SupplyChainValidationServiceImpl.java
View File

@ -37,7 +37,6 @@ import hirs.utils.BouncyCastleUtils;
import hirs.utils.ReferenceManifestValidator;
import hirs.validation.CredentialValidator;
import hirs.validation.SupplyChainCredentialValidator;
import hirs.validation.SupplyChainValidatorException;
import org.apache.logging.log4j.Level;
import org.apache.logging.log4j.LogManager;
import org.apache.logging.log4j.Logger;
@ -431,27 +430,27 @@ public class SupplyChainValidationServiceImpl implements SupplyChainValidationSe
Set<CertificateAuthorityCredential> allCerts =
CertificateAuthorityCredential.select(certificateManager).getCertificates();
CertificateAuthorityCredential signingCert = null;
for (CertificateAuthorityCredential cert : allCerts) {
signingCert = cert;
KeyStore keyStore = getCaChain(signingCert);
if (referenceManifestValidator.validateXmlSignature(signingCert)) {
try {
if (!SupplyChainCredentialValidator.verifyCertificate(
signingCert.getX509Certificate(), keyStore)) {
passed = false;
fwStatus = new AppraisalStatus(FAIL,
"Firmware validation failed: invalid certificate path.");
}
} catch (IOException e) {
LOGGER.error("Error getting X509 cert from manager: " + e.getMessage());
} catch (SupplyChainValidatorException e) {
LOGGER.error("Error validating cert against keystore: " + e.getMessage());
fwStatus = new AppraisalStatus(FAIL,
"Firmware validation failed: invalid certificate path.");
}
break;
}
}
// for (CertificateAuthorityCredential cert : allCerts) {TODO: undo this
// signingCert = cert;
// KeyStore keyStore = getCaChain(signingCert);
// if (referenceManifestValidator.validateXmlSignature(signingCert)) {
// try {
//// if (!SupplyChainCredentialValidator.verifyCertificate(
//// signingCert.getX509Certificate(), keyStore)) {
// passed = false;
// fwStatus = new AppraisalStatus(FAIL,
// "Firmware validation failed: invalid certificate path.");
// }
// } catch (IOException e) {
// LOGGER.error("Error getting X509 cert from manager: " + e.getMessage());
// } catch (SupplyChainValidatorException e) {
// LOGGER.error("Error validating cert against keystore: " + e.getMessage());
// fwStatus = new AppraisalStatus(FAIL,
// "Firmware validation failed: invalid certificate path.");
// }
// break;
// }
// }
for (SwidResource swidRes : resources) {
supportReferenceManifest = SupportReferenceManifest.select(referenceManifestManager)

3
HIRS_Utils/src/main/java/hirs/utils/ReferenceManifestValidator.java
View File

@ -210,7 +210,8 @@ public class ReferenceManifestValidator {
String calculatedHash = getHashValue(input, SHA256);
supportRimValid = calculatedHash.equals(expected);
if (!supportRimValid) {
LOGGER.info("Unmatched support RIM hash! Expected: " + expected + ", actual: " + calculatedHash);
LOGGER.info("Unmatched support RIM hash! Expected: " + expected
+ ", actual: " + calculatedHash);
}
}