Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

when the time source is not trusted, verify the valid field of certificates make no sense. #59

Open
longlongyang opened this issue Mar 22, 2024 · 0 comments

Comments

@longlongyang
Copy link
Collaborator

We may need a feature control whether to verify the valid field of certificates or not.

#[cfg(any(target_os = "uefi", target_os = "none"))]
let timestamp = {
if let Some(ts) = sys_time::get_sys_time() {
ts as u64
} else {
return Err(SPDM_STATUS_INVALID_STATE_LOCAL);
}
};
#[cfg(not(any(target_os = "uefi", target_os = "none")))]
let timestamp = {
extern crate std;
if let Ok(ds) = std::time::SystemTime::now().duration_since(std::time::UNIX_EPOCH) {
ds.as_secs()
} else {
return Err(SPDM_STATUS_INVALID_STATE_LOCAL);
}
};
let time = webpki::Time::from_seconds_since_unix_epoch(timestamp);
let cert = if let Ok(eec) = webpki::EndEntityCert::try_from(ee) {
eec
} else {
return Err(SPDM_STATUS_INVALID_CERT);
};
// we cannot call verify_is_valid_tls_server_cert because it will check verify_cert::EKU_SERVER_AUTH.
if cert
.verify_cert_chain_with_eku(EKU_SPDM_RESPONDER_AUTH, ALL_SIGALGS, &anchors, inters, time)
.is_ok()

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant