ExternalVendorCode/HIRS
1
0
Fork 0
mirror of https://github.com/nsacyber/HIRS.git synced 2025-02-06 11:10:15 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Fixed a certificate conversion issue.

Browse Source
This commit is contained in:
iadgovuser29 2021-08-17 17:21:32 -04:00
parent dc7301e8a6
commit f54e1a15d0
2 changed files with 17 additions and 14 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

24
HIRS_Utils/src/main/java/hirs/validation/SupplyChainCredentialValidator.java
View File

@ -40,7 +40,6 @@ import java.security.NoSuchProviderException;
import java.security.PublicKey; import java.security.PublicKey;
import java.security.Security; import java.security.Security;
import java.security.SignatureException; import java.security.SignatureException;
import java.security.cert.CertificateEncodingException;
import java.security.cert.CertificateException; import java.security.cert.CertificateException;
import java.security.cert.CertificateExpiredException; import java.security.cert.CertificateExpiredException;
import java.security.cert.CertificateNotYetValidException; import java.security.cert.CertificateNotYetValidException;
@ -1348,26 +1347,29 @@ public final class SupplyChainCredentialValidator implements CredentialValidator
final String intCAError = "Intermediate signing cert found, check for CA cert"; final String intCAError = "Intermediate signing cert found, check for CA cert";
String foundRootOfCertChain = ""; String foundRootOfCertChain = "";
X509AttributeCertificateHolder startOfChain = cert; X509AttributeCertificateHolder startOfChain = cert;
X509Certificate nextInChain = null;
do { do {
for (X509Certificate trustedCert : additionalCerts) { for (X509Certificate trustedCert : additionalCerts) {
boolean issuerMatchesSubject = issuerMatchesSubjectDN(startOfChain, trustedCert); boolean issuerMatchesSubject = false;
boolean signatureMatchesPublicKey = signatureMatchesPublicKey(startOfChain, boolean signatureMatchesPublicKey = false;
if (nextInChain != null) {
issuerMatchesSubject = issuerMatchesSubjectDN(nextInChain, trustedCert);
signatureMatchesPublicKey = signatureMatchesPublicKey(nextInChain,
trustedCert); trustedCert);
} else {
issuerMatchesSubject = issuerMatchesSubjectDN(startOfChain, trustedCert);
signatureMatchesPublicKey = signatureMatchesPublicKey(startOfChain,
trustedCert);
}
if (issuerMatchesSubject && signatureMatchesPublicKey) { if (issuerMatchesSubject && signatureMatchesPublicKey) {
if (isSelfSigned(trustedCert)) { if (isSelfSigned(trustedCert)) {
LOGGER.info("CA Root found."); LOGGER.info("CA Root found.");
return ""; return "";
} else { } else {
foundRootOfCertChain = intCAError; foundRootOfCertChain = intCAError;
try { nextInChain = trustedCert;
startOfChain = new X509AttributeCertificateHolder(
trustedCert.getEncoded());
} catch (IOException | CertificateEncodingException e) {
LOGGER.error("Error checking cert chain: " + e.getMessage());
throw new SupplyChainValidatorException("Error checking cert chain: "
+ e.getMessage());
}
break; break;
} }
} else { } else {

5
HIRS_Utils/src/test/java/hirs/validation/SupplyChainCredentialValidatorTest.java
View File

@ -312,10 +312,11 @@ public class SupplyChainCredentialValidatorTest {
PlatformCredential pc = new PlatformCredential(certBytes); PlatformCredential pc = new PlatformCredential(certBytes);
// The test certificate has expired. Test will accept expired certs.
AppraisalStatus result = supplyChainCredentialValidator.validatePlatformCredential( AppraisalStatus result = supplyChainCredentialValidator.validatePlatformCredential(
pc, keyStore, true); pc, keyStore, true);
// Assert.assertEquals(result.getAppStatus(), AppraisalStatus.Status.PASS);
Assert.assertEquals(result.getAppStatus(), AppraisalStatus.Status.FAIL); Assert.assertEquals(result.getAppStatus(), AppraisalStatus.Status.PASS);
Assert.assertEquals(result.getMessage(), SupplyChainCredentialValidator.PLATFORM_VALID); Assert.assertEquals(result.getMessage(), SupplyChainCredentialValidator.PLATFORM_VALID);
} finally { } finally {
keyStore.deleteEntry("Intel Intermediate Cert"); keyStore.deleteEntry("Intel Intermediate Cert");