Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add length check during verify cert chain #2718

Merged
merged 1 commit into from
Jun 13, 2024
Merged

Add length check during verify cert chain #2718

merged 1 commit into from
Jun 13, 2024

Conversation

rw8896
Copy link
Contributor

@rw8896 rw8896 commented Jun 3, 2024

Resolve #2701

@steven-bellock
Copy link
Contributor

If possible the comparison should be exact.

  1. Calculate the size of the entire certificate chain via x509 parsing.
  2. If the size in step 1 is not equal to the size reported by the SPDM message then validation fails, else it passes.

@rw8896
Copy link
Contributor Author

rw8896 commented Jun 12, 2024

If possible the comparison should be exact.

  1. Calculate the size of the entire certificate chain via x509 parsing.
  2. If the size in step 1 is not equal to the size reported by the SPDM message then validation fails, else it passes.

I think this commit already did exact checking:

  1. During iterating the cert chain, check the x509 parsed length of each cert and make sure no cert will exceed the cert chain.
  2. After parsing all the certificates, check if there is any remaining data left in the cert chain.

Hence the total cert size can't exceed or be less than the whole cert chain length and must be exact the same as the cert chain length.

@jyao1 jyao1 merged commit 076c740 into DMTF:main Jun 13, 2024
97 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
enhancement New feature or request
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Add length check when traverse certchain in libspdm_x509_verify_cert_chain
3 participants