|
3 | 3 | #pragma once |
4 | 4 |
|
5 | 5 | #include "ccf/crypto/cose_verifier.h" |
| 6 | +#include "ccf/ds/x509_time_fmt.h" |
6 | 7 | #include "ccf/pal/locking.h" |
7 | 8 | #include "ccf/service/tables/nodes.h" |
8 | 9 | #include "ccf/service/tables/service.h" |
|
15 | 16 | #include "endian.h" |
16 | 17 | #include "kv/kv_types.h" |
17 | 18 | #include "kv/store.h" |
| 19 | +#include "node/cose_common.h" |
18 | 20 | #include "node_signature_verify.h" |
19 | 21 | #include "service/tables/signatures.h" |
20 | 22 | #include "tasks/basic_task.h" |
@@ -805,8 +807,37 @@ namespace ccf |
805 | 807 |
|
806 | 808 | std::vector<uint8_t> root_hash{ |
807 | 809 | root.h.data(), root.h.data() + root.h.size()}; |
808 | | - return cose_verifier_cached(service_info->cert) |
809 | | - ->verify_detached(cose_sig.value(), root_hash); |
| 810 | + if (!cose_verifier_cached(service_info->cert) |
| 811 | + ->verify_detached(cose_sig.value(), root_hash)) |
| 812 | + { |
| 813 | + return false; |
| 814 | + } |
| 815 | + |
| 816 | + if (ccf::logger::config::ok(LoggerLevel::DEBUG)) |
| 817 | + { |
| 818 | + try |
| 819 | + { |
| 820 | + auto receipt = ccf::cose::decode_ccf_receipt( |
| 821 | + cose_sig.value(), /* recompute_root */ false); |
| 822 | + if (receipt.phdr.cwt.iat.has_value()) |
| 823 | + { |
| 824 | + LOG_DEBUG_FMT( |
| 825 | + "Verified COSE signature for TxID {}, issued at {}", |
| 826 | + receipt.phdr.ccf.txid, |
| 827 | + ccf::ds::to_x509_time_string( |
| 828 | + std::chrono::system_clock::from_time_t( |
| 829 | + receipt.phdr.cwt.iat.value()))); |
| 830 | + } |
| 831 | + } |
| 832 | + catch (const std::exception& e) |
| 833 | + { |
| 834 | + LOG_DEBUG_FMT( |
| 835 | + "Failed to decode COSE protected header for debug logging: {}", |
| 836 | + e.what()); |
| 837 | + } |
| 838 | + } |
| 839 | + |
| 840 | + return true; |
810 | 841 | } |
811 | 842 |
|
812 | 843 | std::vector<uint8_t> serialise_tree(size_t to) override |
|
0 commit comments