Secure your code as it's written. Use Snyk Code to scan source code in minutes - no build needed - and fix issues immediately.
function _check_certificate_validity(certificate) {
// Is the signature on the SoftwareCertificate valid .?
if (!certificate) {
// missing certificate
return StatusCodes.BadSecurityChecksFailed;
}
//-- const split_der = require("node-opcua-crypto").crypto_explore_certificate.split_der;
//-- const chain = split_der(securityHeader.senderCertificate);
//-- //xx console.log("xxx NB CERTIFICATE IN CHAIN = ".red,chain.length);
// Has SoftwareCertificate passed its issue date and has it not expired ?
// check dates
const cert = crypto_utils.exploreCertificateInfo(certificate);
const now = new Date();
if (cert.notBefore.getTime() > now.getTime()) {
// certificate is not active yet
console.log(
" Sender certificate is invalid : certificate is not active yet !".red +
" not before date =" +
cert.notBefore
);
return StatusCodes.BadCertificateTimeInvalid;
}
if (cert.notAfter.getTime() <= now.getTime()) {
// certificate is obsolete
console.log(
" Sender certificate is invalid : certificate has expired !".red + " not after date =" + cert.notAfter
decryptedBuffer.copy(binaryStream.buffer, binaryStream.length);
// adjust length
binaryStream.buffer = binaryStream.buffer.slice(0, binaryStream.length + decryptedBuffer.length);
/* istanbul ignore next */
if (doDebug) {
debugLog(chalk.cyan("DE-----------------------------"));
// debugLog(hexDump(binaryStream.buffer));
debugLog(chalk.cyan("-------------------------------"));
const thumbprint = makeSHA1Thumbprint(asymmetricAlgorithmSecurityHeader.senderCertificate);
debugLog("Certificate thumbprint:", thumbprint.toString("hex"));
}
}
const cert = exploreCertificateInfo(asymmetricAlgorithmSecurityHeader.senderCertificate);
// then verify the signature
const signatureLength = cert.publicKeyLength; // 1024 bits = 128Bytes or 2048=256Bytes or 3072 or 4096
assert(signatureLength === 128 ||
signatureLength === 256 ||
signatureLength === 384 ||
signatureLength === 512);
const chunk = binaryStream.buffer;
const signatureIsOK = asymmetricVerifyChunk(this.cryptoFactory, chunk, asymmetricAlgorithmSecurityHeader.senderCertificate);
if (!signatureIsOK) {
/* istanbul ignore next */
if (doDebug) {
debugLog(hexDump(binaryStream.buffer));
}
public getSignatureLength(): PublicKeyLength {
const chain = this.getCertificateChain();
const firstCertificateInChain = split_der(chain)[0];
const cert = exploreCertificateInfo(firstCertificateInChain);
return cert.publicKeyLength; // 1024 bits = 128Bytes or 2048=256Bytes
}
export function asymmetricVerifyChunk(self: CryptoFactory, chunk: Buffer, certificate: Certificate): boolean {
assert(chunk instanceof Buffer);
assert(certificate instanceof Buffer);
// let's get the signatureLength by checking the size
// of the certificate's public key
const cert = exploreCertificateInfo(certificate);
const signatureLength = cert.publicKeyLength; // 1024 bits = 128Bytes or 2048=256Bytes
const blockToVerify = chunk.slice(0, chunk.length - signatureLength);
const signature = chunk.slice(chunk.length - signatureLength);
return self.asymmetricVerify(blockToVerify, signature, certificate);
}
function asymmetricVerifyChunk(chunk, certificate) {
const crypto_factory = this;
assert(chunk instanceof Buffer);
assert(certificate instanceof Buffer);
// let's get the signatureLength by checking the size
// of the certificate's public key
const cert = crypto_utils.exploreCertificateInfo(certificate);
const signatureLength = cert.publicKeyLength; // 1024 bits = 128Bytes or 2048=256Bytes
const block_to_verify = chunk.slice(0, chunk.length - signatureLength);
const signature = chunk.slice(chunk.length - signatureLength);
return crypto_factory.asymmetricVerify(block_to_verify, signature, certificate);
}