ExternalVendorCode/HIRS
1
0
Fork 0
mirror of https://github.com/nsacyber/HIRS.git synced 2024-12-18 20:47:58 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Merge branch 'master' into java_xml_timestamp

Browse Source
This commit is contained in:
chubtub 2022-09-08 20:37:26 -04:00
commit 25e77a6173
24 changed files with 815 additions and 368 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

25
.ci/docker/Dockerfile.acaimage Normal file
View File

@ -0,0 +1,25 @@
FROM centos:7
# Install packages for installing HIRS ACA
RUN yum -y update && yum clean all
# install build tools for TPM2 provisioner
RUN yum install -y epel-release cmake make git gcc-c++ doxygen graphviz protobuf-compiler cppcheck python libssh2-devel openssl libcurl-devel log4cplus-devel protobuf-devel re2-devel tpm2-tss-devel tpm2-abrmd-devel && yum clean all
# install build tools for ACA
RUN yum install -y sudo yum install java-1.8.0-openjdk-devel protobuf-compiler rpm-build epel-release cmake make git gcc-c++ doxygen graphviz cppcheck python libssh2-devel openssl libcurl-devel log4cplus-devel protobuf-devel re2-devel tpm2-tss-devel tpm2-abrmd-devel trousers-devel && yum clean all
# install run time dependencies
RUN yum install -y mariadb-server openssl tomcat java-1.8.0-openjdk-headless rpmdevtools coreutils initscripts chkconfig sed grep wget which firewalld policycoreutils net-tools git rpm-build && yum clean all
# Remove TLSv1, TLSv1.1, references to prevent java security from stopping tomcat launch
RUN sed -i 's/TLSv1,//' /usr/lib/jvm/java-1.8.0-openjdk-1.8.0*/jre/lib/security/java.security
RUN sed -i 's/TLSv1.1,//' /usr/lib/jvm/java-1.8.0-openjdk-1.8.0*/jre/lib/security/java.security
RUN mkdir /hirs
# Expose ACA Port
EXPOSE 8443 8080
COPY ../../package/rpm/RPMS/noarch/HIRS_AttestationCA*.el7.noarch.rpm /
COPY ../../scripts/aca_image_setup.sh /
CMD ["sh","/aca_image_setup.sh"]
RUN yum install -y HIRS_AttestationCA*.el7.noarch.rpm

64
.github/workflows/build_aca_image.yml vendored Normal file
View File

@ -0,0 +1,64 @@
name: ACA Docker Image Build
on:
release:
types: [ published ]
workflow_dispatch:
inputs:
imagename:
description: 'ACA Docker Image Name'
default: 'aca-centos7'
required: false
type: string
jobs:
# run the package script for HIRS ACA, Provisioners, tcg_rim_tool, and tcg_eventlog_tool
Package:
runs-on: ubuntu-latest
permissions:
contents: read
packages: write
steps:
- uses: actions/checkout@v2
- name: Set up JDK 11
uses: actions/setup-java@v2
with:
java-version: '8'
distribution: 'adopt'
server-id: github # Value of the distributionManagement/repository/id field of the pom.xml
settings-path: ${{ github.workspace }} # location for the settings.xml file
package_centos:
runs-on: ubuntu-latest
permissions:
contents: read
packages: write
steps:
- uses: actions/checkout@v2
- name: directory setup
run: |
mkdir -p artifacts/jars
mkdir -p artifacts/wars
mkdir -p artifacts/rpms
- name: Create HIRS packages
run: |
echo ${{ secrets.GITHUB_TOKEN }} | docker login ghcr.io -u $ --password-stdin
docker run --rm \
-v $(pwd):/HIRS hirs/hirs-ci:centos7 /bin/bash \
-c 'pushd /HIRS; \
sh package/package.centos.sh; \
cp /HIRS/package/rpm/RPMS/noarch/* /.; \
cp /HIRS/package/rpm/RPMS/x86_64/* /.; \
cp /HIRS/scripts/aca_image_setup.sh /.; \
popd;' \
- name: Build and publish a release Docker image for ${{ github.repository }}
if: github.event_name == 'release'
uses: macbre/push-to-ghcr@master
with:
image_name: nsacyber/hirs/aca-centos7
github_token: ${{ secrets.GITHUB_TOKEN }}
dockerfile: "./.ci/docker/Dockerfile.acaimage"
- name: Build and publish a Docker image for ${{ github.repository }}
if: github.event_name == 'workflow_dispatch'
uses: macbre/push-to-ghcr@master
with:
image_name: nsacyber/hirs/${{ inputs.imagename }}
github_token: ${{ secrets.GITHUB_TOKEN }}
dockerfile: "./.ci/docker/Dockerfile.acaimage"

21
HIRS_Utils/src/main/java/hirs/tpm/eventlog/TpmPcrEvent.java
View File

@ -121,10 +121,11 @@ public class TpmPcrEvent {
* This can be SHA1 for older event structures or any algorithm for newer structure.
*
* @param digestData cryptographic hash
* @param digestLength length of the cryptographic hash
*/
protected void setEventDigest(final byte[] digestData) {
protected void setEventDigest(final byte[] digestData, final int digestLength) {
digest = new byte[digestLength];
System.arraycopy(digestData, 0, digest, 0, this.digestLength);
System.arraycopy(digestData, 0, digest, 0, digestLength);
}
/**
@ -469,23 +470,31 @@ public class TpmPcrEvent {
* @param event the byte array holding the event data.
* @param eventContent the byte array holding the event content.
* @param eventNumber event position within the event log.
* @param hashName name of the hash algorithm used by the event log
* @return String description of the event.
* @throws CertificateException if the event contains an event that cannot be processed.
* @throws NoSuchAlgorithmException if an event contains an unsupported algorithm.
* @throws IOException if the event cannot be parsed.
*/
public String processEvent(final byte[] event, final byte[] eventContent, final int eventNumber)
throws CertificateException, NoSuchAlgorithmException, IOException {
public String processEvent(final byte[] event, final byte[] eventContent, final int eventNumber,
final String hashName)
throws CertificateException, NoSuchAlgorithmException, IOException {
int eventID = (int) eventType;
this.eventNumber = eventNumber;
description += "Event# " + eventNumber + ": ";
description += "Index PCR[" + getPcrIndex() + "]\n";
description += "Event Type: 0x" + Long.toHexString(eventType) + " " + eventString(eventID);
description += "\n";
if (logFormat == 1) { // Digest
if (hashName.compareToIgnoreCase("TPM_ALG_SHA1") == 0) { // Digest
description += "digest (SHA-1): " + Hex.encodeHexString(this.digest);
} else {
} else if (hashName.compareToIgnoreCase("TPM_ALG_SHA256") == 0) { // Digest
description += "digest (SHA256): " + Hex.encodeHexString(this.digest);
} else if (hashName.compareToIgnoreCase("TPM_ALG_SHA384") == 0) { // Digest
description += "digest (SHA384): " + Hex.encodeHexString(this.digest);
} else if (hashName.compareToIgnoreCase("TPM_ALG_SHA512") == 0) { // Digest
description += "digest (SHA512): " + Hex.encodeHexString(this.digest);
} else {
description += "Unsupported Hash Algorithm encoutered";
}
if (eventID != UefiConstants.SIZE_4) {
description += "\n";

7
HIRS_Utils/src/main/java/hirs/tpm/eventlog/TpmPcrEvent1.java
View File

@ -49,15 +49,16 @@ public class TpmPcrEvent1 extends TpmPcrEvent {
byte[] rawEventSize = new byte[UefiConstants.SIZE_4];
byte[] eventDigest = new byte[EvConstants.SHA1_LENGTH];
byte[] eventContent = null;
int digestSize = EvConstants.SHA1_LENGTH;
int eventSize = 0;
String hashName = "TPM_ALG_SHA1";
if (is.available() > UefiConstants.SIZE_32) {
is.read(rawIndex);
setPcrIndex(rawIndex);
is.read(rawType);
setEventType(rawType);
is.read(eventDigest);
setEventDigest(eventDigest);
setEventDigest(eventDigest, digestSize);
is.read(rawEventSize);
eventSize = HexUtils.leReverseInt(rawEventSize);
eventContent = new byte[eventSize];
@ -78,7 +79,7 @@ public class TpmPcrEvent1 extends TpmPcrEvent {
offset += rawEventSize.length;
setEventData(event);
//System.arraycopy(eventContent, 0, event, offset, eventContent.length);
this.processEvent(event, eventContent, eventNumber);
this.processEvent(event, eventContent, eventNumber, hashName);
}
}
}

13
HIRS_Utils/src/main/java/hirs/tpm/eventlog/TpmPcrEvent2.java
View File

@ -78,12 +78,14 @@ public class TpmPcrEvent2 extends TpmPcrEvent {
setDigestLength(EvConstants.SHA256_LENGTH);
setLogFormat(2);
/** Event data. */
int eventDigestLength = 0;
String hashName = "";
byte[] event;
byte[] rawIndex = new byte[UefiConstants.SIZE_4];
byte[] algCountBytes = new byte[UefiConstants.SIZE_4];
byte[] rawType = new byte[UefiConstants.SIZE_4];
byte[] rawEventSize = new byte[UefiConstants.SIZE_4];
byte[] eventDigest = new byte[EvConstants.SHA256_LENGTH];
byte[] eventDigest = null;
byte[] eventContent = null;
TcgTpmtHa hashAlg = null;
int eventSize = 0;
@ -99,10 +101,10 @@ public class TpmPcrEvent2 extends TpmPcrEvent {
// Process TPMT_HA,
for (int i = 0; i < algCount; i++) {
hashAlg = new TcgTpmtHa(is);
hashName = hashAlg.getHashName();
hashlist.add(hashAlg);
if (hashAlg.getHashName().compareToIgnoreCase("TPM_ALG_SHA256") == 0) {
setEventDigest(hashAlg.getDigest());
}
eventDigest = new byte[hashAlg.getHashLength()];
setEventDigest(hashAlg.getDigest(), hashAlg.getHashLength());
}
is.read(rawEventSize);
eventSize = HexUtils.leReverseInt(rawEventSize);
@ -126,7 +128,8 @@ public class TpmPcrEvent2 extends TpmPcrEvent {
offset += rawEventSize.length;
//System.arraycopy(eventContent, 0, event, offset, eventContent.length);
setEventData(event);
this.processEvent(event, eventContent, eventNumber);
//setDigestLength(eventDigestLength);
this.processEvent(event, eventContent, eventNumber, hashName);
}
}
}

2
HIRS_Utils/src/main/java/hirs/tpm/eventlog/events/EvConstants.java
View File

@ -21,6 +21,8 @@ public final class EvConstants {
public static final int SHA1_LENGTH = 20;
/** Event Type (byte array). */
public static final int SHA256_LENGTH = 32;
/** Event Type (byte array). */
public static final int SHA384_LENGTH = 48;
/** Each PCR bank holds 24 registers. */
public static final int PCR_COUNT = 24;
// Event IDs

2
VERSION
View File

@ -1 +1 @@
2.1.2
2.1.3

19
scripts/aca_image_setup.sh Normal file
View File

@ -0,0 +1,19 @@
#!/bin/bash
# Setup db
if [[ $(pgrep -c -u mysql mysqld) -ne 0 ]]; then
echo "shutting down ..."
usr/bin/mysqladmin -u root shutdown -p;
fi
/usr/libexec/mariadb-prepare-db-dir
nohup /usr/bin/mysqld_safe --basedir=/usr &>/dev/null &
MYSQLD_PID=$(pgrep -u mysql mysqld)
/usr/libexec/mariadb-wait-ready $MYSQLD_PID
mysql -fu root < /opt/hirs/scripts/common/db_create.sql.el7
mysql -fu root < /opt/hirs/scripts/common/secure_mysql.sql
# Start tomcat
/usr/libexec/tomcat/server start

11
tools/tcg_eventlog_tool/build.gradle
View File

@ -65,11 +65,12 @@ buildscript {
// Produce packages
ospackage {
def gitCommitHash = 'git rev-parse --verify --short HEAD'.execute().text.trim()
packageName = 'tcg_eventlog_tool'
os = LINUX
arch = NOARCH
arch = X86_64
version = '2.1.0'
release = '1'
release = gitCommitHash
into '/opt/hirs/eventlog'
user 'root'
@ -104,7 +105,7 @@ ospackage {
details.file.name.endsWith('.md')
}
into './'
link("/usr/local/bin/elt", "/opt/hirs/eventlog/scripts/eventlog.sh", 0x755)
link("/usr/bin/elt", "/opt/hirs/eventlog/scripts/eventlog.sh", 0x755)
}
into('/tmp/') {
@ -118,9 +119,9 @@ ospackage {
postInstall file('scripts/vendor-table.sh')
buildRpm {
arch = I386
arch = X86_64
}
buildDeb {
arch = I386
arch = X86_64
}
}

190
tools/tcg_eventlog_tool/src/main/java/hirs/tcg_eventlog/Commander.java
View File

@ -23,7 +23,7 @@ public class Commander {
private static final String PCR_STRING = "pcr";
private static final String VERIFY_STRING = "Verify";
private static final String VERSION_STRING = "version";
private static final String VERSION_NUMBER = "1.0";
private static final String VERSION_NUMBER = "2.1";
private static final String REGEX = "[0-9]+";
private boolean hasArguments = false;
@ -63,7 +63,6 @@ public class Commander {
defualtArgs[0] = "-e";
hasArguments = true;
parseArguments(defualtArgs);
// printHelp("");
}
}
@ -75,15 +74,16 @@ public class Commander {
*/
public final void parseArguments(final String[] args) {
String tempValue;
for (int i = 0; i < args.length; i++) {
tempValue = args[i];
if (bDone) {
break;
}
if (args.length == 0) { // Process default params if none were given
bEventIds = true;
} else {
switch (tempValue) {
case FULL_COMMAND_PREFIX + CONTENT_STRING:
case FULL_COMMAND_PREFIX + EVENTIDS_STRING:
case COMMAND_PREFIX + "e":
if (i < args.length - 1) { // Check for a filter following the -e
@ -92,12 +92,16 @@ public class Commander {
if (eventFilter.matches(REGEX)) {
eventNumber = Integer.parseInt(eventFilter);
} else {
System.out.println("invalid parameter following -e: " + eventFilter);
printHelp("Invalid parameter following -e: " + eventFilter
+ "\n");
bValidArgs = false;
bDone = true;
}
}
}
bEventIds = true;
break;
case FULL_COMMAND_PREFIX + CONTENT_STRING:
case COMMAND_PREFIX + "ec":
bContentHex = true;
break;
@ -109,10 +113,10 @@ public class Commander {
case COMMAND_PREFIX + "d":
if ((args.length < i + 2 + 1) || (args[i + 1].charAt(0) == '-')
|| (args[i + 2].charAt(0) == '-')) {
System.out.print("tcg_eventlog_tool command line error:"
+ " 2 or 3 parameters needed for -diff.\n");
System.out.print("usage: elt -d logFile1 logFile2 pcr#");
printHelp("tcg_eventlog_tool command line error:"
+ " 2 parameters needed for -diff." + "\n");
bValidArgs = false;
bDone = true;
} else {
inFile = args[i++ + 1];
inFile2 = args[i++ + 1];
@ -121,18 +125,36 @@ public class Commander {
break;
case FULL_COMMAND_PREFIX + FILE_STRING:
case COMMAND_PREFIX + "f":
bFile = true;
inFile = args[++i];
if (i == args.length - 1) {
printHelp("No output file specified with the " + tempValue
+ " option" + "\n");
bValidArgs = false;
bDone = true;
} else if (args[i + 1].charAt(0) == '-') {
printHelp("No output file specified with the " + tempValue
+ "option" + "\n");
bValidArgs = false;
bDone = true;
} else {
bFile = true;
inFile = args[++i];
}
break;
case FULL_COMMAND_PREFIX + OUTPUT_STRING:
case COMMAND_PREFIX + "o":
if (i < args.length - 1) { // Check for a filter following the -o
if (!args[i + 1].startsWith("-")) {
outFile = args[i++ + 1];
} else {
System.out.print("no output file specified with -o option");
bValidArgs = false;
}
if (i == args.length - 1) {
printHelp("No output file specified with the " + tempValue
+ " option" + "\n");
bValidArgs = false;
bDone = true;
} else {
outFile = args[i++ + 1];
if (outFile.isEmpty()) {
printHelp("No output file specified with the " + tempValue
+ "option" + "\n");
bValidArgs = false;
bDone = true;
}
}
bOutput = true;
break;
@ -144,7 +166,10 @@ public class Commander {
if (pcrFilter.matches(REGEX)) {
pcrNumber = Integer.parseInt(pcrFilter);
} else {
System.out.println("invalid parameter following -p: " + pcrFilter);
printHelp("Invalid parameter following -p: "
+ pcrFilter + "\n");
bValidArgs = false;
bDone = true;
}
}
}
@ -168,11 +193,15 @@ public class Commander {
bHelp = true;
break;
default:
printHelp("");
//System.out.print("Unknown option: " + tempValue + "\n");
bValidArgs = false;
bDone = true;
printHelp("Unknown option: " + tempValue + "\n");
}
}
}
checkForInvalidOptions();
checkDefaults();
}
/**
@ -316,6 +345,41 @@ public class Commander {
public final int getPcrNumber() {
return pcrNumber;
}
/**
* Setter for the input associated with the EventIds flag.
*/
public final void setEventIdsFlag() {
bEventIds = true;
}
/**
* Check for invalid option combinations.
* @return false is an invalid combination was found
*/
public final boolean checkForInvalidOptions() {
if (!bEventIds && (bEventHex || bContentHex)) {
bValidArgs = false;
} else if (bHex && (bEventHex || bContentHex)) {
bValidArgs = false;
} else {
bValidArgs = true;
}
return bValidArgs;
}
/**
* Check for situations where default values need to be set.
*/
public final void checkDefaults() {
if (bFile) {
if (!bHex && !bEventIds && !bContentHex && !bPCRs) {
bEventIds = true;
}
}
if (bOutput) {
if (!bHex && !bEventIds && !bContentHex && !bPCRs) {
bEventIds = true;
}
}
}
/**
* This method is used to inform the user of the allowed functionality of the program.
* @param message message caller specific message to print before listing the help.
@ -324,70 +388,52 @@ public class Commander {
StringBuilder sb = new StringBuilder();
String os = System.getProperty("os.name").toLowerCase();
if ((message != null) && (!message.isEmpty())) {
sb.append("\n\n" + message);
sb.append("\n" + message);
}
sb.append("\nTCG Log Parser ");
if (os.compareToIgnoreCase("linux") == 0) {
sb.append("Usage: sh elt.sh [OPTION]...-f [FILE]...\n");
sb.append("Usage: elt [OPTION]... [OPTION]... and Options\n");
} else {
sb.append("Usage: ./elt.ps1 [OPTION]...-f [FILE]...\n");
sb.append("Usage: ./elt.ps1 [OPTION]... [OPTION]...\n");
}
sb.append("Options:\n"
+ " -f\t--file\t\t Use specific Event Log file. "
+ "\n\t\t\t Following parameter MUST be a path and file name."
+ "\n\t\t\t The local Event Log file will be used if this option is not present."
+ "\n\t\t\t Note: Access to the local Event Log may require admin privileges.\n"
+ " -e\t--event\t Display event descriptions (including event content) in "
+ "human readable form."
+ "\n\t\t\t Following optional parameter is a single event number used to filter"
+ " the output."
+ "\n\t\t\t All events will be displayed if the optional parameter is not +"
+ "provided.\n"
+ " -ec\t--contenthex\t Displays event content"
+ " in eventhex format when -event is used.\n"
+ " -ex\t--eventhex\t Displays event in hex format when -event is used.\n"
+ " -d\t--diff\t\t Compares two TCG Event Logs and outputs a list of events"
+ " of the second log that differred.\n"
+ " -o\t--output\t Output to a file. "
+ "\n\t\t\t Following parameter MUST be a relative path and file name.\n"
+ " -p\t--pcr\t\t Output expected PCR value calculated from the "
+ "TCG Log (for PCR Replay)."
+ "\n\t\t\t Following parameter MAY be a PCR number used to specify a single pcr."
+ "\n\t\t\t No following parameters will display all PCRs.\n"
+ " -v\t--version\t Parser Version.\n"
// + " -V\t--Verify\t Attempts to verify the log file against values."
+ " -x\t--hex\t\t Displays event in hex format. Use with -ec to get content."
+ "\n\t\t\t Use -e -ec and -ex options to filter output."
+ "\n\t\t\t All output will be human readble form if not present."
sb.append("\nOptions:\n"
+ " -f\t--file\t\t Use a specific Event Log file. "
+ "\n\t\t\t example: elt [-f|--file] /path/to/eventlogfile\n"
+ " -e\t--event\t\t Display all event details for a specific event"
+ "\n\t\t\t example: elt [-e|--event] 30"
+ "\n\t\t\t No event specified will default to all events"
+ "\n\t\t\t example: elt [-e|--event]\n"
+ " -ec\t--contenthex\t Include event content in hex format."
+ " Only valid with -e option.\n"
+ " -ex\t--eventhex\t Include event only (no content) in hex format."
+ " Only valid with -e option.\n"
+ " -d\t--diff\t\t Compares two TCG Event Logs and displays events from second"
+ " file that do not match."
+ "\n\t\t\t example: elt [-d|--diff] /path/to/eventlogfile1 "
+ "/path/to/eventlogfile2\n"
+ " -o\t--output\t Redirect output to a specified path/file."
+ "\n\t\t\t example: elt [-o|--output] /path/to/outputfile\n"
+ " -p\t--pcr\t\t Display all expected PCR values calculated from the TCG Log "
+ "(for PCR Replay)."
+ "\n\t\t\t Specify a PCR number to filter on a single PCR."
+ "\n\t\t\t example: elt [-p|--pcr] 5\n"
+ " -v\t--version\t Version info.\n"
+ " -x\t--hex\t\t Event only (no content) in hex format."
+ "\n\n");
if (os.compareToIgnoreCase("linux") == 0) {
sb.append("\nIf no FILE parameter is provided then the standard Linux TCGEventLog path "
+ "\n(/sys/kernel/security/tpm0/binary_bios_measurements) is used."
+ "\n Note admin privileges may be required (e.g. use sudo when running the "
+ " script).\n"
+ "All OPTIONS must be seperated by a space delimiter, no concatenation"
+ " of OPTIONS is currently supported.\n"
+ "\nExamples: (run from the script directory)\n"
+ "1. Display all events from the binary_bios_measurements.bin test pattern:\n"
+ " sh elt.sh -f ../test/testdata/binary_bios_measurements_Dell_Fedora30.bin "
+ " -e\n"
+ "2. Display only the event with an index of 0 (e.g event that extend PCR 0):\n"
+ " sh scripts/elt.sh -f "
+ "../test/testdata/binary_bios_measurements_Dell_Fedora30.bin -p 0\n"
sb.append("\nTo run this tool it may require root privileges due to the permissions set "
+ "on the event log file. \nRun without options to display all event details for "
+ "/sys/kernel/security/tpm0/binary_bios_measurements. "
+ "\nAll options must be separated by a space delimiter as concatenation of "
+ "options is currently not supported.\n"
);
} else { //windows
sb.append("\nIf no FILE parameter is provided then the "
+ "standard Windows TCGEventLog path (C:\\Windows\\Logs\\MeasuredBoot) is used"
sb.append("\nIf no file parameter is provided then the "
+ "standard Windows TCGEventLog path (C:\\Windows\\Logs\\MeasuredBoot) is used"
+ "\nIf no parameter is given then the -e option will be used as default."
+ "\n Note admin privileges may be required (e.g. run as Administrator).\n"
+ "All OPTIONS must be seperated by a space delimiter, "
+ "no concatenation of OPTIONS is currently supported.\n"
+ "\nExamples:(run from the script directory)\n"
+ "1. Display all events from the binary_bios_measurements.bin test pattern:\n"
+ " ./elt.ps1 -f "
+ "..\\test\\testdata\\binary_bios_measurements_Dell_Fedora30.bin -e\n"
+ "2. Display only the event with an index of 0 (e.g event that extend PCR 0):\n"
+ " ./elt.ps1 -f "
+ "..\\test\\testdata\\binary_bios_measurements_Dell_Fedora30.bin -p 0\n"
+ "no concatenation of options is not supported.\n"
);
}
System.out.println(sb.toString());

48
tools/tcg_eventlog_tool/src/main/java/hirs/tcg_eventlog/Main.java
View File

@ -1,6 +1,5 @@
package hirs.tcg_eventlog;
import java.io.FileNotFoundException;
import java.io.FileOutputStream;
import java.io.IOException;
import java.nio.charset.Charset;
@ -12,7 +11,6 @@ import java.security.cert.CertificateException;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.Collection;
import hirs.tpm.eventlog.TCGEventLog;
import hirs.tpm.eventlog.TpmPcrEvent;
import hirs.utils.HexUtils;
@ -35,9 +33,10 @@ final class Main {
public static void main(final String[] args) {
commander = new Commander(args);
if (!commander.getValidityFlag()) {
System.out.print("Program exiting without processs due to issues with"
+ " parameters provided.");
System.exit(1);
System.out.print("\nProgram exiting without processs due to issues with"
+ " parameters provided.\n");
commander.printHelp("");
System.exit(0);
}
if (commander.hasArguments()) {
if (commander.getDoneFlag()) {
@ -50,15 +49,14 @@ final class Main {
if (commander.getOutputFlag()) {
try {
outputStream = new FileOutputStream(commander.getOutputFileName());
} catch (FileNotFoundException e) {
System.out.print("Writing to output file: " + commander.getOutputFileName()
+ "\n");
} catch (Exception e) {
System.out.print("Error opening output file" + commander.getOutputFileName()
+ "\nError was " + e.getMessage());
System.exit(1);
}
}
if (commander.getFileFlag()) {
eventLog = openLog(commander.getInFileName());
}
if (commander.getContentFlag()) {
bContentFlag = true;
}
@ -91,10 +89,8 @@ final class Main {
} // End commander processing
try {
if (eventLog == null) {
eventLog = openLog("");
}
// Main Event processing
eventLog = openLog(commander.getInFileName());
// Main Event processing
TCGEventLog evLog = new TCGEventLog(eventLog, bEventFlag, bContentFlag, bHexEvent);
if (bPcrFlag) {
String[] pcrs = evLog.getExpectedPCRValues();
@ -116,9 +112,8 @@ final class Main {
writeOut("\n----------------- End PCR Values ----------------- \n\n");
}
}
// General event log output
if (bEventFlag) {
if ((bEventFlag || bHexFlag) && !bPcrFlag) {
if (!bHexFlag) {
if (evLog.isCryptoAgile()) {
writeOut("\nEvent Log follows the \"Crypto Agile\" format and has "
@ -135,7 +130,7 @@ final class Main {
if ((commander.getPcrNumber() == event.getPcrIndex())
|| commander.getPcrNumber() == -1) {
if (bHexFlag) {
if (bEventFlag || bHexEvent) {
if (bHexFlag || bHexEvent) {
writeOut(HexUtils.byteArrayToHexString(event.getEvent())
+ "\n");
}
@ -178,7 +173,6 @@ final class Main {
boolean bDefault = false;
bHexFlag = commander.getHexFlag();
try {
if (fileName.isEmpty()) {
if (os.compareToIgnoreCase("linux") == 0) { // need to find Windows path
fName = "/sys/kernel/security/tpm0/binary_bios_measurements";
@ -196,9 +190,9 @@ final class Main {
} catch (Exception e) {
String error = "Error reading event Log File: " + e.toString();
if (bDefault) {
error += "\nTry using the -f option to specify an Event Log File";
error += "\nTry using the -f option to specify an Event Log File\n";
}
writeOut(error);
System.out.print(error);
System.exit(1);
}
return rawLog;
@ -218,6 +212,8 @@ final class Main {
System.out.print(dataNoNull); // output to the console
}
} catch (IOException e) {
System.out.print("Error writing to output file: " + commander.getOutputFileName()
+ "\n error was: " + e.toString() + "\n");
e.printStackTrace();
}
}
@ -247,7 +243,8 @@ final class Main {
ArrayList<TpmPcrEvent> errors = diffEventLogs(eventLog1.getEventList(),
eventLog2.getEventList(), commander.getPcrNumber());
if (errors.isEmpty() && !bHexFlag) {
sb.append("\nEvent Log " + logFileName1 + " MATCHED EventLog " + logFileName2);
sb.append("\nEvent Log " + logFileName1 + " MATCHED EventLog " + logFileName2
+ "\n");
} else {
if (!errors.isEmpty() && !bHexFlag) {
sb.append("\nEvent Log " + logFileName1
@ -332,4 +329,15 @@ final class Main {
}
return matchFound;
}
/**
* Diagnostic method for detecting flag settings.
*/
public static void dumpFlags() {
System.out.print("Event Flag is " + commander.getEventIdsFlag() + "\n");
System.out.print("Hex Flag is " + commander.getEventHexFlag() + "\n");
System.out.print("Context Flag is " + commander.getContentFlag() + "\n");
System.out.print("PCR Flag is " + commander.getPCRFlag() + "\n");
System.out.print("Output File Flag is " + commander.getFileFlag() + "\n");
System.out.print("Output Flag is " + commander.getOutputFlag() + "\n");
}
}

4
tools/tcg_rim_tool/build.gradle
View File

@ -9,6 +9,10 @@ dependencies {
testCompile 'org.testng:testng:6.8.8'
}
test {
testLogging.showStandardStreams true
}
jar {
manifest {
attributes("Main-Class": "hirs.swid.Main",

23
tools/tcg_rim_tool/src/main/java/hirs/swid/CredentialParser.java
View File

@ -65,7 +65,7 @@ public class CredentialParser {
}
public void parsePEMCredentials(String certificateFile, String privateKeyFile)
throws CertificateException, FileNotFoundException {
throws Exception {
certificate = parsePEMCertificates(certificateFile).get(0);
if (certificate.getIssuerX500Principal().equals(certificate.getSubjectX500Principal())) {
throw new CertificateException("Signing certificate cannot be self-signed!");
@ -125,7 +125,8 @@ public class CredentialParser {
CertificateFactory certificateFactory = CertificateFactory.getInstance(X509);
while (bis.available() > 0) {
certificates = (List<X509Certificate>) certificateFactory.generateCertificates(bis);
certificates =
(List<X509Certificate>) certificateFactory.generateCertificates(bis);
}
if (certificates.size() < 1) {
@ -160,10 +161,11 @@ public class CredentialParser {
* @param filename
* @return
*/
private PrivateKey parsePEMPrivateKey(String filename, String algorithm) {
private PrivateKey parsePEMPrivateKey(String filename, String algorithm) throws Exception {
PrivateKey privateKey = null;
FileInputStream fis = null;
DataInputStream dis = null;
String errorMessage = "";
try {
File file = new File(filename);
fis = new FileInputStream(file);
@ -186,15 +188,15 @@ public class CredentialParser {
privateKey = keyFactory.generatePrivate(spec);
}
} catch (FileNotFoundException e) {
System.out.println("Unable to locate private key file: " + filename);
errorMessage += "Unable to locate private key file: " + filename;
} catch (DecoderException e) {
System.out.println("Failed to parse uploaded pem file: " + e.getMessage());
errorMessage += "Failed to parse uploaded pem file: " + e.getMessage();
} catch (NoSuchAlgorithmException e) {
System.out.println("Unable to instantiate KeyFactory with algorithm: " + algorithm);
errorMessage += "Unable to instantiate KeyFactory with algorithm: " + algorithm;
} catch (IOException e) {
System.out.println("IOException: " + e.getMessage());
errorMessage += "IOException: " + e.getMessage();
} catch (InvalidKeySpecException e) {
System.out.println("Error instantiating PKCS8EncodedKeySpec object: " + e.getMessage());
errorMessage += "Error instantiating PKCS8EncodedKeySpec object: " + e.getMessage();
} finally {
try {
if (fis != null) {
@ -204,7 +206,10 @@ public class CredentialParser {
dis.close();
}
} catch (IOException e) {
System.out.println("Error closing input stream: " + e.getMessage());
errorMessage += "Error closing input stream: " + e.getMessage();
}
if (!errorMessage.isEmpty()) {
throw new Exception("Error parsing private key: " + errorMessage);
}
}

4
tools/tcg_rim_tool/src/main/java/hirs/swid/Main.java
View File

@ -49,6 +49,7 @@ public class Main {
String jksTruststoreFile = commander.getTruststoreFile();
String certificateFile = commander.getPublicCertificate();
String privateKeyFile = commander.getPrivateKeyFile();
boolean embeddedCert = commander.isEmbedded();
boolean defaultKey = commander.isDefaultKey();
String rimEventLog = commander.getRimEventLog();
switch (createType) {
@ -63,6 +64,9 @@ public class Main {
gateway.setDefaultCredentials(false);
gateway.setPemCertificateFile(certificateFile);
gateway.setPemPrivateKeyFile(privateKeyFile);
if (embeddedCert) {
gateway.setEmbeddedCert(true);
}
} else if (defaultKey){
gateway.setDefaultCredentials(true);
gateway.setJksTruststoreFile(SwidTagConstants.DEFAULT_KEYSTORE_FILE);

2
tools/tcg_rim_tool/src/main/java/hirs/swid/SwidTagConstants.java
View File

@ -15,7 +15,7 @@ public class SwidTagConstants {
public static final String DEFAULT_KEYSTORE_FILE = "/opt/hirs/rimtool/keystore.jks";
public static final String DEFAULT_KEYSTORE_PASSWORD = "password";
public static final String DEFAULT_PRIVATE_KEY_ALIAS = "selfsigned";
public static final String DEFAULT_ATTRIBUTES_FILE = "rim_fields.json";
public static final String DEFAULT_ATTRIBUTES_FILE = "/opt/hirs/rimtool/rim_fields.json";
public static final String DEFAULT_ENGLISH = "en";
public static final String SIGNATURE_ALGORITHM_RSA_SHA256 = "http://www.w3.org/2001/04/xmldsig-more#rsa-sha256";

230
tools/tcg_rim_tool/src/main/java/hirs/swid/SwidTagGateway.java
View File

@ -12,6 +12,7 @@ import org.w3c.dom.Document;
import org.w3c.dom.Element;
import javax.json.Json;
import javax.json.JsonException;
import javax.json.JsonObject;
import javax.json.JsonReader;
import javax.xml.bind.JAXBContext;
@ -58,6 +59,7 @@ import java.io.IOException;
import java.io.InputStream;
import java.math.BigInteger;
import java.security.InvalidAlgorithmParameterException;
import java.security.KeyException;
import java.security.NoSuchAlgorithmException;
import java.security.PrivateKey;
import java.security.cert.CertificateException;
@ -82,7 +84,9 @@ public class SwidTagGateway {
private String jksTruststoreFile;
private String pemPrivateKeyFile;
private String pemCertificateFile;
private boolean embeddedCert;
private String rimEventLog;
private String errorRequiredFields;
/**
* Default constructor initializes jaxbcontext, marshaller, and unmarshaller
@ -94,7 +98,9 @@ public class SwidTagGateway {
attributesFile = SwidTagConstants.DEFAULT_ATTRIBUTES_FILE;
defaultCredentials = true;
pemCertificateFile = "";
embeddedCert = false;
rimEventLog = "";
errorRequiredFields = "";
} catch (JAXBException e) {
System.out.println("Error initializing jaxbcontext: " + e.getMessage());
}
@ -105,7 +111,7 @@ public class SwidTagGateway {
*
* @param attributesFile
*/
public void setAttributesFile(String attributesFile) {
public void setAttributesFile(final String attributesFile) {
this.attributesFile = attributesFile;
}
@ -115,7 +121,7 @@ public class SwidTagGateway {
* @param defaultCredentials
* @return
*/
public void setDefaultCredentials(boolean defaultCredentials) {
public void setDefaultCredentials(final boolean defaultCredentials) {
this.defaultCredentials = defaultCredentials;
}
@ -124,7 +130,7 @@ public class SwidTagGateway {
*
* @param jksTruststoreFile
*/
public void setJksTruststoreFile(String jksTruststoreFile) {
public void setJksTruststoreFile(final String jksTruststoreFile) {
this.jksTruststoreFile = jksTruststoreFile;
}
@ -133,7 +139,7 @@ public class SwidTagGateway {
*
* @param pemPrivateKeyFile
*/
public void setPemPrivateKeyFile(String pemPrivateKeyFile) {
public void setPemPrivateKeyFile(final String pemPrivateKeyFile) {
this.pemPrivateKeyFile = pemPrivateKeyFile;
}
@ -142,16 +148,25 @@ public class SwidTagGateway {
*
* @param pemCertificateFile
*/
public void setPemCertificateFile(String pemCertificateFile) {
public void setPemCertificateFile(final String pemCertificateFile) {
this.pemCertificateFile = pemCertificateFile;
}
/**
* Setter to embed certificate file in signature block
*
* @param embeddedCert
*/
public void setEmbeddedCert(final boolean embeddedCert) {
this.embeddedCert = embeddedCert;
}
/**
* Setter for event log support RIM
*
* @param rimEventLog
*/
public void setRimEventLog(String rimEventLog) {
public void setRimEventLog(final String rimEventLog) {
this.rimEventLog = rimEventLog;
}
@ -182,33 +197,44 @@ public class SwidTagGateway {
JAXBElement<SoftwareMeta> meta = objectFactory.createSoftwareIdentityMeta(
createSoftwareMeta(configProperties.getJsonObject(SwidTagConstants.META)));
swidTag.getEntityOrEvidenceOrLink().add(meta);
//Payload
ResourceCollection payload = createPayload(
configProperties.getJsonObject(SwidTagConstants.PAYLOAD));
//Directory
Directory directory = createDirectory(
configProperties.getJsonObject(SwidTagConstants.PAYLOAD)
.getJsonObject(SwidTagConstants.DIRECTORY));
//File
hirs.swid.xjc.File file = createFile(
configProperties.getJsonObject(SwidTagConstants.PAYLOAD)
.getJsonObject(SwidTagConstants.DIRECTORY)
.getJsonObject(SwidTagConstants.FILE));
//Directory
Directory directory = createDirectory(
configProperties.getJsonObject(SwidTagConstants.PAYLOAD)
.getJsonObject(SwidTagConstants.DIRECTORY));
//Nest File in Directory in Payload
directory.getDirectoryOrFile().add(file);
//Payload
ResourceCollection payload = createPayload(
configProperties.getJsonObject(SwidTagConstants.PAYLOAD));
payload.getDirectoryOrFileOrProcess().add(directory);
JAXBElement<ResourceCollection> jaxbPayload =
objectFactory.createSoftwareIdentityPayload(payload);
swidTag.getEntityOrEvidenceOrLink().add(jaxbPayload);
//Signature
if (errorRequiredFields.isEmpty()) {
Document signedSoftwareIdentity = signXMLDocument(
objectFactory.createSoftwareIdentity(swidTag));
writeSwidTagFile(signedSoftwareIdentity, filename);
} else {
System.out.println("The following fields cannot be empty or null: "
+ errorRequiredFields.substring(0, errorRequiredFields.length()-2));
System.exit(1);
}
} catch (JsonException e) {
System.out.println("Error reading JSON attributes: " + e.getMessage());
System.exit(1);
} catch (FileNotFoundException e) {
System.out.println("File does not exist or cannot be read: " + e.getMessage());
System.exit(1);
} catch (Exception e) {
System.out.println(e.getMessage());
System.exit(1);
}
Document signedSoftwareIdentity = signXMLDocument(
objectFactory.createSoftwareIdentity(swidTag));
writeSwidTagFile(signedSoftwareIdentity, filename);
}
/**
@ -216,7 +242,7 @@ public class SwidTagGateway {
*
* @param swidTag
*/
public void writeSwidTagFile(Document swidTag, String output) {
public void writeSwidTagFile(final Document swidTag, final String output) {
try {
TransformerFactory tf = TransformerFactory.newInstance();
Transformer transformer = tf.newTransformer();
@ -244,27 +270,31 @@ public class SwidTagGateway {
* @param jsonObject the Properties object containing parameters from file
* @return SoftwareIdentity object created from the properties
*/
private SoftwareIdentity createSwidTag(JsonObject jsonObject) {
private SoftwareIdentity createSwidTag(final JsonObject jsonObject) {
SoftwareIdentity swidTag = objectFactory.createSoftwareIdentity();
swidTag.setLang(SwidTagConstants.DEFAULT_ENGLISH);
String name = jsonObject.getString(SwidTagConstants.NAME, "");
if (!name.isEmpty()) {
swidTag.setName(name);
}
String tagId = jsonObject.getString(SwidTagConstants.TAGID, "");
if (!tagId.isEmpty()) {
swidTag.setTagId(tagId);
}
swidTag.setTagVersion(new BigInteger(
jsonObject.getString(SwidTagConstants.TAGVERSION, "0")));
swidTag.setVersion(jsonObject.getString(SwidTagConstants.VERSION, "0.0"));
swidTag.setCorpus(jsonObject.getBoolean(SwidTagConstants.CORPUS, false));
swidTag.setPatch(jsonObject.getBoolean(SwidTagConstants.PATCH, false));
swidTag.setSupplemental(jsonObject.getBoolean(SwidTagConstants.SUPPLEMENTAL, false));
if (!swidTag.isCorpus() && !swidTag.isPatch()
&& !swidTag.isSupplemental() && swidTag.getVersion() != "0.0") {
swidTag.setVersionScheme(
jsonObject.getString(SwidTagConstants.VERSION_SCHEME, "multipartnumeric"));
if (jsonObject == null) {
errorRequiredFields += SwidTagConstants.SOFTWARE_IDENTITY + ", ";
} else {
swidTag.setLang(SwidTagConstants.DEFAULT_ENGLISH);
String name = jsonObject.getString(SwidTagConstants.NAME, "");
if (!name.isEmpty()) {
swidTag.setName(name);
}
String tagId = jsonObject.getString(SwidTagConstants.TAGID, "");
if (!tagId.isEmpty()) {
swidTag.setTagId(tagId);
}
swidTag.setTagVersion(new BigInteger(
jsonObject.getString(SwidTagConstants.TAGVERSION, "0")));
swidTag.setVersion(jsonObject.getString(SwidTagConstants.VERSION, "0.0"));
swidTag.setCorpus(jsonObject.getBoolean(SwidTagConstants.CORPUS, false));
swidTag.setPatch(jsonObject.getBoolean(SwidTagConstants.PATCH, false));
swidTag.setSupplemental(jsonObject.getBoolean(SwidTagConstants.SUPPLEMENTAL, false));
if (!swidTag.isCorpus() && !swidTag.isPatch()
&& !swidTag.isSupplemental() && swidTag.getVersion() != "0.0") {
swidTag.setVersionScheme(
jsonObject.getString(SwidTagConstants.VERSION_SCHEME, "multipartnumeric"));
}
}
return swidTag;
@ -277,33 +307,38 @@ public class SwidTagGateway {
* @param jsonObject the Properties object containing parameters from file
* @return Entity object created from the properties
*/
private Entity createEntity(JsonObject jsonObject) {
private Entity createEntity(final JsonObject jsonObject) {
boolean isTagCreator = false;
Entity entity = objectFactory.createEntity();
String name = jsonObject.getString(SwidTagConstants.NAME, "");
if (!name.isEmpty()) {
entity.setName(name);
}
String[] roles = jsonObject.getString(SwidTagConstants.ROLE, "").split(",");
for (int i = 0; i < roles.length; i++) {
entity.getRole().add(roles[i]);
if (roles[i].equals("tagCreator")) {
isTagCreator = true;
}
}
if (isTagCreator) {
String regid = jsonObject.getString(SwidTagConstants.REGID, "");
if (regid.isEmpty()) {
//throw exception that regid is required
} else {
entity.setRegid(regid);
}
if (jsonObject == null) {
errorRequiredFields += SwidTagConstants.ENTITY + ", ";
} else {
entity.setRegid(jsonObject.getString(SwidTagConstants.REGID, "invalid.unavailable"));
}
String thumbprint = jsonObject.getString(SwidTagConstants.THUMBPRINT, "");
if (!thumbprint.isEmpty()) {
entity.setThumbprint(thumbprint);
String name = jsonObject.getString(SwidTagConstants.NAME, "");
if (!name.isEmpty()) {
entity.setName(name);
}
String[] roles = jsonObject.getString(SwidTagConstants.ROLE, "").split(",");
for (int i = 0; i < roles.length; i++) {
entity.getRole().add(roles[i]);
if (roles[i].equals("tagCreator")) {
isTagCreator = true;
}
}
if (isTagCreator) {
String regid = jsonObject.getString(SwidTagConstants.REGID, "");
if (regid.isEmpty()) {
//throw exception that regid is required
} else {
entity.setRegid(regid);
}
} else {
entity.setRegid(jsonObject.getString(SwidTagConstants.REGID,
"invalid.unavailable"));
}
String thumbprint = jsonObject.getString(SwidTagConstants.THUMBPRINT, "");
if (!thumbprint.isEmpty()) {
entity.setThumbprint(thumbprint);
}
}
return entity;
}
@ -315,7 +350,7 @@ public class SwidTagGateway {
* @param jsonObject the Properties object containing parameters from file
* @return Link element created from the properties
*/
private Link createLink(JsonObject jsonObject) {
private Link createLink(final JsonObject jsonObject) {
Link link = objectFactory.createLink();
String href = jsonObject.getString(SwidTagConstants.HREF, "");
if (!href.isEmpty()) {
@ -336,7 +371,7 @@ public class SwidTagGateway {
* @param jsonObject the Properties object containing parameters from file
* @return the Meta element created from the properties
*/
private SoftwareMeta createSoftwareMeta(JsonObject jsonObject) {
private SoftwareMeta createSoftwareMeta(final JsonObject jsonObject) {
SoftwareMeta softwareMeta = objectFactory.createSoftwareMeta();
Map<QName, String> attributes = softwareMeta.getOtherAttributes();
addNonNullAttribute(attributes, SwidTagConstants._COLLOQUIAL_VERSION,
@ -350,11 +385,11 @@ public class SwidTagGateway {
addNonNullAttribute(attributes, SwidTagConstants._PAYLOAD_TYPE,
jsonObject.getString(SwidTagConstants.PAYLOAD_TYPE, ""));
addNonNullAttribute(attributes, SwidTagConstants._PLATFORM_MANUFACTURER_STR,
jsonObject.getString(SwidTagConstants.PLATFORM_MANUFACTURER_STR, ""));
jsonObject.getString(SwidTagConstants.PLATFORM_MANUFACTURER_STR, ""), true);
addNonNullAttribute(attributes, SwidTagConstants._PLATFORM_MANUFACTURER_ID,
jsonObject.getString(SwidTagConstants.PLATFORM_MANUFACTURER_ID, ""));
jsonObject.getString(SwidTagConstants.PLATFORM_MANUFACTURER_ID, ""), true);
addNonNullAttribute(attributes, SwidTagConstants._PLATFORM_MODEL,
jsonObject.getString(SwidTagConstants.PLATFORM_MODEL, ""));
jsonObject.getString(SwidTagConstants.PLATFORM_MODEL, ""), true);
addNonNullAttribute(attributes, SwidTagConstants._PLATFORM_VERSION,
jsonObject.getString(SwidTagConstants.PLATFORM_VERSION, ""));
addNonNullAttribute(attributes, SwidTagConstants._FIRMWARE_MANUFACTURER_STR,
@ -385,15 +420,19 @@ public class SwidTagGateway {
* @param jsonObject the Properties object containing parameters from file
* @return the Payload object created
*/
private ResourceCollection createPayload(JsonObject jsonObject) {
private ResourceCollection createPayload(final JsonObject jsonObject) {
ResourceCollection payload = objectFactory.createResourceCollection();
Map<QName, String> attributes = payload.getOtherAttributes();
addNonNullAttribute(attributes, SwidTagConstants._N8060_ENVVARPREFIX,
jsonObject.getString(SwidTagConstants._N8060_ENVVARPREFIX.getLocalPart(), ""));
addNonNullAttribute(attributes, SwidTagConstants._N8060_ENVVARSUFFIX,
jsonObject.getString(SwidTagConstants._N8060_ENVVARSUFFIX.getLocalPart(), ""));
addNonNullAttribute(attributes, SwidTagConstants._N8060_PATHSEPARATOR,
jsonObject.getString(SwidTagConstants._N8060_PATHSEPARATOR.getLocalPart(), ""));
if (jsonObject == null) {
errorRequiredFields += SwidTagConstants.PAYLOAD + ", ";
} else {
addNonNullAttribute(attributes, SwidTagConstants._N8060_ENVVARPREFIX,
jsonObject.getString(SwidTagConstants._N8060_ENVVARPREFIX.getLocalPart(), ""));
addNonNullAttribute(attributes, SwidTagConstants._N8060_ENVVARSUFFIX,
jsonObject.getString(SwidTagConstants._N8060_ENVVARSUFFIX.getLocalPart(), ""));
addNonNullAttribute(attributes, SwidTagConstants._N8060_PATHSEPARATOR,
jsonObject.getString(SwidTagConstants._N8060_PATHSEPARATOR.getLocalPart(), ""));
}
return payload;
}
@ -404,7 +443,7 @@ public class SwidTagGateway {
* @param jsonObject the Properties object containing parameters from file
* @return Directory object created from the properties
*/
private Directory createDirectory(JsonObject jsonObject) {
private Directory createDirectory(final JsonObject jsonObject) {
Directory directory = objectFactory.createDirectory();
directory.setName(jsonObject.getString(SwidTagConstants.NAME, ""));
Map<QName, String> attributes = directory.getOtherAttributes();
@ -434,7 +473,7 @@ public class SwidTagGateway {
* @param jsonObject the Properties object containing parameters from file
* @return File object created from the properties
*/
private hirs.swid.xjc.File createFile(JsonObject jsonObject) {
private hirs.swid.xjc.File createFile(JsonObject jsonObject) throws Exception {
hirs.swid.xjc.File file = objectFactory.createFile();
file.setName(jsonObject.getString(SwidTagConstants.NAME, ""));
Map<QName, String> attributes = file.getOtherAttributes();
@ -454,11 +493,21 @@ public class SwidTagGateway {
jsonObject.getString(SwidTagConstants.SUPPORT_RIM_URI_GLOBAL, ""));
File rimEventLogFile = new File(rimEventLog);
file.setSize(new BigInteger(Long.toString(rimEventLogFile.length())));
addNonNullAttribute(attributes, SwidTagConstants._SHA256_HASH, HashSwid.get256Hash(rimEventLog));
addNonNullAttribute(attributes, SwidTagConstants._SHA256_HASH,
jsonObject.getString(SwidTagConstants.HASH,
HashSwid.get256Hash(rimEventLog)), true);
return file;
}
private void addNonNullAttribute(Map<QName, String> attributes, QName key, String value,
boolean required) {
if (required && value.isEmpty()) {
errorRequiredFields += key.getLocalPart() + ", ";
} else {
addNonNullAttribute(attributes, key, value);
}
}
/**
* This utility method checks if an attribute value is empty before adding it to the map.
*
@ -466,7 +515,8 @@ public class SwidTagGateway {
* @param key
* @param value
*/
private void addNonNullAttribute(Map<QName, String> attributes, QName key, String value) {
private void addNonNullAttribute(final Map<QName, String> attributes,
final QName key, String value) {
if (!value.isEmpty()) {
attributes.put(key, value);
}
@ -476,7 +526,7 @@ public class SwidTagGateway {
* This method signs a SoftwareIdentity with an xmldsig in compatibility mode.
* Current assumptions: digest method SHA256, signature method SHA256, enveloped signature
*/
private Document signXMLDocument(JAXBElement<SoftwareIdentity> swidTag) {
private Document signXMLDocument(JAXBElement<SoftwareIdentity> swidTag) throws Exception {
Document doc = null;
try {
doc = DocumentBuilderFactory.newInstance().newDocumentBuilder().newDocument();
@ -486,7 +536,8 @@ public class SwidTagGateway {
Reference documentRef = sigFactory.newReference(
"",
sigFactory.newDigestMethod(DigestMethod.SHA256, null),
Collections.singletonList(sigFactory.newTransform(Transform.ENVELOPED, (TransformParameterSpec) null)),
Collections.singletonList(sigFactory.newTransform(Transform.ENVELOPED,
(TransformParameterSpec) null)),
null,
null
);
@ -534,11 +585,15 @@ public class SwidTagGateway {
cp.parsePEMCredentials(pemCertificateFile, pemPrivateKeyFile);
X509Certificate certificate = cp.getCertificate();
privateKey = cp.getPrivateKey();
ArrayList<Object> x509Content = new ArrayList<Object>();
x509Content.add(certificate.getSubjectX500Principal().getName());
x509Content.add(certificate);
X509Data data = kiFactory.newX509Data(x509Content);
keyInfoElements.add(data);
if (embeddedCert) {
ArrayList<Object> x509Content = new ArrayList<Object>();
x509Content.add(certificate.getSubjectX500Principal().getName());
x509Content.add(certificate);
X509Data data = kiFactory.newX509Data(x509Content);
keyInfoElements.add(data);
} else {
keyInfoElements.add(kiFactory.newKeyValue(certificate.getPublicKey()));
}
}
KeyInfo keyinfo = kiFactory.newKeyInfo(keyInfoElements);
@ -564,6 +619,9 @@ public class SwidTagGateway {
System.out.println("Error marshaling signed swidtag: " + e.getMessage());
} catch (MarshalException | XMLSignatureException e) {
System.out.println("Error while signing SoftwareIdentity: " + e.getMessage());
} catch (KeyException e) {
System.out.println("Public key algorithm not recognized or supported: "
+ e.getMessage());
}
return doc;

335
tools/tcg_rim_tool/src/main/java/hirs/swid/SwidTagValidator.java
View File

@ -4,7 +4,6 @@ import hirs.swid.utils.HashSwid;
import org.bouncycastle.jce.provider.BouncyCastleProvider;
import org.w3c.dom.Document;
import org.w3c.dom.Element;
import org.w3c.dom.Node;
import org.w3c.dom.NodeList;
import org.xml.sax.SAXException;
@ -25,6 +24,7 @@ import javax.xml.crypto.dsig.XMLSignatureException;
import javax.xml.crypto.dsig.XMLSignatureFactory;
import javax.xml.crypto.dsig.dom.DOMValidateContext;
import javax.xml.crypto.dsig.keyinfo.KeyInfo;
import javax.xml.crypto.dsig.keyinfo.KeyValue;
import javax.xml.crypto.dsig.keyinfo.X509Data;
import javax.xml.transform.Source;
import javax.xml.transform.Transformer;
@ -39,10 +39,9 @@ import java.io.File;
import java.io.FileNotFoundException;
import java.io.IOException;
import java.io.InputStream;
import java.math.BigInteger;
import java.security.InvalidKeyException;
import java.security.Key;
import java.security.KeyFactory;
import java.security.KeyException;
import java.security.NoSuchAlgorithmException;
import java.security.NoSuchProviderException;
import java.security.PublicKey;
@ -51,9 +50,7 @@ import java.security.SignatureException;
import java.security.cert.CertificateException;
import java.security.cert.X509Certificate;
import java.security.spec.InvalidKeySpecException;
import java.security.spec.RSAPublicKeySpec;
import java.util.Arrays;
import java.util.Base64;
import java.util.Iterator;
import java.util.List;
@ -65,6 +62,7 @@ public class SwidTagValidator {
private String rimEventLog;
private String certificateFile;
private String trustStoreFile;
private List<X509Certificate> trustStore;
/**
* Ensure that BouncyCastle is configured as a javax.security.Security provider, as this
@ -116,7 +114,12 @@ public class SwidTagValidator {
si.append("SoftwareIdentity tagId: " + softwareIdentity.getAttribute("tagId") + "\n");
System.out.println(si.toString());
Element file = (Element) document.getElementsByTagName("File").item(0);
validateFile(file);
try {
validateFile(file);
} catch (Exception e) {
System.out.println(e.getMessage());
return false;
}
System.out.println("Signature core validity: " + validateSignedXMLDocument(document));
return true;
}
@ -124,7 +127,7 @@ public class SwidTagValidator {
/**
* This method validates a hirs.swid.xjc.File from an indirect payload
*/
private boolean validateFile(Element file) {
private boolean validateFile(Element file) throws Exception {
String filepath;
if (!rimEventLog.isEmpty()) {
filepath = rimEventLog;
@ -158,40 +161,49 @@ public class SwidTagValidator {
DOMValidateContext context;
CredentialParser cp = new CredentialParser();
X509Certificate signingCert = null;
List<X509Certificate> trustStore = cp.parseCertsFromPEM(trustStoreFile);
trustStore = cp.parseCertsFromPEM(trustStoreFile);
X509KeySelector keySelector = new X509KeySelector();
NodeList nodes = doc.getElementsByTagNameNS(XMLSignature.XMLNS, "Signature");
if (nodes.getLength() == 0) {
throw new Exception("Signature element not found!");
}
NodeList embeddedCert = doc.getElementsByTagName("X509Certificate");
if (embeddedCert.getLength() > 0) {
context = new DOMValidateContext(new X509KeySelector(), nodes.item(0));
signingCert = cp.parseCertFromPEMString(embeddedCert.item(0).getTextContent());
} else {
String skId = doc.getElementsByTagName("KeyName").item(0).getTextContent();
for (X509Certificate trustedCert : trustStore) {
String trustedSkId = cp.getCertificateSubjectKeyIdentifier(trustedCert);
if (skId.equals(trustedSkId)) {
signingCert = trustedCert;
break;
context = new DOMValidateContext(keySelector, nodes.item(0));
}
NodeList keyName = doc.getElementsByTagName("KeyName");
if (keyName.getLength() > 0) {
String skId = keyName.item(0).getTextContent();
if (skId != null && !skId.isEmpty()) {
for (X509Certificate trustedCert : trustStore) {
String trustedSkId = cp.getCertificateSubjectKeyIdentifier(trustedCert);
if (skId.equals(trustedSkId)) {
signingCert = trustedCert;
break;
}
}
}
if (signingCert == null) {
System.out.println("Issuer certificate with subject key identifier = "
+ skId + " not found");
if (signingCert != null) {
context = new DOMValidateContext(signingCert.getPublicKey(),
nodes.item(0));
} else {
System.out.println("Issuer certificate with subject key identifier = "
+ skId + " not found");
System.exit(1);
}
} else {
System.out.println("Base RIM must have a non-empty, non-null " +
"Subject Key Identifier (SKID) in the <KeyName> element");
System.exit(1);
}
context = new DOMValidateContext(signingCert.getPublicKey(), nodes.item(0));
}
cp.setCertificate(signingCert);
System.out.println(cp.getCertificateAuthorityInfoAccess());
XMLSignatureFactory sigFactory = XMLSignatureFactory.getInstance("DOM");
XMLSignature signature = sigFactory.unmarshalXMLSignature(context);
boolean signatureIsValid = signature.validate(context);
boolean certChainIsValid = validateCertChain(signingCert, trustStore);
System.out.println("Signature validity: " + signatureIsValid);
System.out.println("Cert chain validity: " + certChainIsValid);
return signatureIsValid && certChainIsValid;
if (signingCert == null) {
signingCert = keySelector.getSigningCert();
}
cp.setCertificate(signingCert);
System.out.println(System.lineSeparator() + cp.getCertificateAuthorityInfoAccess());
return signatureIsValid;
} catch (FileNotFoundException e) {
System.out.println("Error parsing truststore: " + e.getMessage());
} catch (NoSuchAlgorithmException e) {
@ -208,112 +220,21 @@ public class SwidTagValidator {
return false;
}
/**
* This method validates the cert chain for a given certificate. The truststore is iterated
* over until a root CA is found, otherwise an error is returned.
* @param cert the certificate at the start of the chain
* @param trustStore from which to find the chain of intermediate and root CAs
* @return true if the chain is valid
* @throws Exception if a valid chain is not found in the truststore
*/
private boolean validateCertChain(final X509Certificate cert,
final List<X509Certificate> trustStore)
throws Exception {
if (cert == null || trustStore == null) {
throw new Exception("Null certificate or truststore received");
} else if (trustStore.size() == 0) {
throw new Exception("Truststore is empty");
}
final String INT_CA_ERROR = "Intermediate CA found, searching for root CA";
String errorMessage = "";
X509Certificate startOfChain = cert;
do {
for (X509Certificate trustedCert : trustStore) {
boolean isIssuer = areYouMyIssuer(startOfChain, trustedCert);
boolean isSigner = areYouMySigner(startOfChain, trustedCert);
if (isIssuer && isSigner) {
if (isSelfSigned(trustedCert)) {
return true;
} else {
startOfChain = trustedCert;
errorMessage = INT_CA_ERROR;
break;
}
} else {
if (!isIssuer) {
errorMessage = "Issuer cert not found";
} else if (!isSigner) {
errorMessage = "Signing cert not found";
}
}
}
} while (errorMessage.equals(INT_CA_ERROR));
throw new Exception("Error while validating cert chain: " + errorMessage);
}
/**
* This method checks if cert's issuerDN matches issuer's subjectDN.
* @param cert the signed certificate
* @param issuer the signing certificate
* @return true if they match, false if not
* @throws Exception if either argument is null
*/
private boolean areYouMyIssuer(final X509Certificate cert, final X509Certificate issuer)
throws Exception {
if (cert == null || issuer == null) {
throw new Exception("Cannot verify issuer, null certificate received");
}
X500Principal issuerDN = new X500Principal(cert.getIssuerX500Principal().getName());
return issuer.getSubjectX500Principal().equals(issuerDN);
}
/**
* This method checks if cert's signature matches signer's public key.
* @param cert the signed certificate
* @param signer the signing certificate
* @return true if they match
* @throws Exception if an error occurs or there is no match
*/
private boolean areYouMySigner(final X509Certificate cert, final X509Certificate signer)
throws Exception {
if (cert == null || signer == null) {
throw new Exception("Cannot verify signature, null certificate received");
}
try {
cert.verify(signer.getPublicKey(), BouncyCastleProvider.PROVIDER_NAME);
return true;
} catch (NoSuchAlgorithmException e) {
throw new Exception("Signing algorithm in signing cert not supported");
} catch (InvalidKeyException e) {
throw new Exception("Signing certificate key does not match signature");
} catch (NoSuchProviderException e) {
throw new Exception("Error with BouncyCastleProvider: " + e.getMessage());
} catch (SignatureException e) {
String error = "Error with signature: " + e.getMessage()
+ System.lineSeparator()
+ "Certificate needed for verification is missing: "
+ signer.getSubjectX500Principal().getName();
throw new Exception(error);
} catch (CertificateException e) {
throw new Exception("Encoding error: " + e.getMessage());
}
}
/**
* This method checks if a given certificate is self signed or not.
* @param cert the cert to check
* @return true if self signed, false if not
*/
private boolean isSelfSigned(final X509Certificate cert) {
return cert.getIssuerX500Principal().equals(cert.getSubjectX500Principal());
}
/**
* This internal class handles parsing the public key from a KeyInfo element.
*/
public class X509KeySelector extends KeySelector {
PublicKey publicKey;
X509Certificate signingCert;
public PublicKey getPublicKey() {
return publicKey;
}
public X509Certificate getSigningCert() {
return signingCert;
}
/**
* This method extracts a public key from either an X509Certificate element
* or a KeyValue element. If the public key's algorithm matches the declared
@ -339,12 +260,41 @@ public class SwidTagValidator {
while (dataItr.hasNext()) {
Object object = dataItr.next();
if (object instanceof X509Certificate) {
final PublicKey publicKey = ((X509Certificate) object).getPublicKey();
if (areAlgorithmsEqual(algorithm.getAlgorithm(), publicKey.getAlgorithm())) {
return new SwidTagValidator.X509KeySelector.RIMKeySelectorResult(publicKey);
X509Certificate embeddedCert = (X509Certificate) object;
try {
if (isCertChainValid(embeddedCert)) {
publicKey = ((X509Certificate) embeddedCert).getPublicKey();
signingCert = embeddedCert;
System.out.println("Certificate chain validity: true");
}
} catch (Exception e) {
System.out.println("Certificate chain invalid: "
+ e.getMessage());
}
}
}
} else if (element instanceof KeyValue) {
try {
PublicKey pk = ((KeyValue) element).getPublicKey();
if (isPublicKeyTrusted(pk)) {
publicKey = pk;
try {
System.out.println("Certificate chain validity: "
+ isCertChainValid(signingCert));
} catch (Exception e) {
System.out.println("Certificate chain invalid: "
+ e.getMessage());
}
}
} catch (KeyException e) {
System.out.println("Unable to convert KeyValue data to PK.");
}
}
if (publicKey != null) {
if (areAlgorithmsEqual(algorithm.getAlgorithm(), publicKey.getAlgorithm())) {
return new
SwidTagValidator.X509KeySelector.RIMKeySelectorResult(publicKey);
}
}
}
throw new KeySelectorException("No key found!");
@ -361,6 +311,123 @@ public class SwidTagValidator {
&& name.equalsIgnoreCase("RSA");
}
/**
* This method validates the cert chain for a given certificate. The truststore is iterated
* over until a root CA is found, otherwise an error is returned.
* @param cert the certificate at the start of the chain
* @return true if the chain is valid
* @throws Exception if a valid chain is not found in the truststore
*/
private boolean isCertChainValid(final X509Certificate cert)
throws Exception {
if (cert == null || trustStore == null) {
throw new Exception("Null certificate or truststore received");
} else if (trustStore.size() == 0) {
throw new Exception("Truststore is empty");
}
final String INT_CA_ERROR = "Intermediate CA found, searching for root CA";
String errorMessage = "";
X509Certificate startOfChain = cert;
do {
for (X509Certificate trustedCert : trustStore) {
boolean isIssuer = areYouMyIssuer(startOfChain, trustedCert);
boolean isSigner = areYouMySigner(startOfChain, trustedCert);
if (isIssuer && isSigner) {
if (isSelfSigned(trustedCert)) {
return true;
} else {
startOfChain = trustedCert;
errorMessage = INT_CA_ERROR;
break;
}
} else {
if (!isIssuer) {
errorMessage = "Issuer cert not found";
} else if (!isSigner) {
errorMessage = "Signing cert not found";
}
}
}
} while (errorMessage.equals(INT_CA_ERROR));
throw new Exception("Error while validating cert chain: " + errorMessage);
}
/**
* This method checks if cert's issuerDN matches issuer's subjectDN.
* @param cert the signed certificate
* @param issuer the signing certificate
* @return true if they match, false if not
* @throws Exception if either argument is null
*/
private boolean areYouMyIssuer(final X509Certificate cert, final X509Certificate issuer)
throws Exception {
if (cert == null || issuer == null) {
throw new Exception("Cannot verify issuer, null certificate received");
}
X500Principal issuerDN = new X500Principal(cert.getIssuerX500Principal().getName());
return issuer.getSubjectX500Principal().equals(issuerDN);
}
/**
* This method checks if cert's signature matches signer's public key.
* @param cert the signed certificate
* @param signer the signing certificate
* @return true if they match
* @throws Exception if an error occurs or there is no match
*/
private boolean areYouMySigner(final X509Certificate cert, final X509Certificate signer)
throws Exception {
if (cert == null || signer == null) {
throw new Exception("Cannot verify signature, null certificate received");
}
try {
cert.verify(signer.getPublicKey(), BouncyCastleProvider.PROVIDER_NAME);
return true;
} catch (NoSuchAlgorithmException e) {
throw new Exception("Signing algorithm in signing cert not supported");
} catch (InvalidKeyException e) {
throw new Exception("Signing certificate key does not match signature");
} catch (NoSuchProviderException e) {
throw new Exception("Error with BouncyCastleProvider: " + e.getMessage());
} catch (SignatureException e) {
String error = "Error with signature: " + e.getMessage()
+ System.lineSeparator()
+ "Certificate needed for verification is missing: "
+ signer.getSubjectX500Principal().getName();
throw new Exception(error);
} catch (CertificateException e) {
throw new Exception("Encoding error: " + e.getMessage());
}
}
/**
* This method checks if a given certificate is self signed or not.
* @param cert the cert to check
* @return true if self signed, false if not
*/
private boolean isSelfSigned(final X509Certificate cert) {
return cert.getIssuerX500Principal().equals(cert.getSubjectX500Principal());
}
/**
* This method compares a public key against those in the truststore.
* @param pk a public key
* @return true if pk is found in the trust store, false otherwise
*/
private boolean isPublicKeyTrusted(final PublicKey pk) {
for (X509Certificate trustedCert : trustStore) {
if (Arrays.equals(trustedCert.getPublicKey().getEncoded(),
pk.getEncoded())) {
signingCert = trustedCert;
return true;
}
}
return false;
}
private class RIMKeySelectorResult implements KeySelectorResult {
private Key key;

18
tools/tcg_rim_tool/src/main/java/hirs/swid/utils/Commander.java
View File

@ -36,10 +36,13 @@ public class Commander {
description = "The public key certificate to embed in the base RIM created by "
+ "this tool.")
private String publicCertificate = "";
@Parameter(names = {"-d", "--default-key"},
@Parameter(names = {"-e", "--embed-cert"}, order = 7,
description = "Embed the provided certificate in the signed swidtag.")
private boolean embedded = false;
@Parameter(names = {"-d", "--default-key"}, order = 8,
description = "Use default signing credentials.")
private boolean defaultKey = false;
@Parameter(names = {"-l", "--rimel <path>"}, order = 7,
@Parameter(names = {"-l", "--rimel <path>"}, order = 9,
description = "The TCG eventlog file to use as a support RIM.")
private String rimEventLog = "";
@ -73,6 +76,8 @@ public class Commander {
return publicCertificate;
}
public boolean isEmbedded() { return embedded; }
public boolean isDefaultKey() { return defaultKey; }
public String getRimEventLog() { return rimEventLog; }
@ -82,11 +87,12 @@ public class Commander {
sb.append("Create a base RIM using the values in attributes.json; " +
"sign it with the default keystore; ");
sb.append("and write the data to base_rim.swidtag:\n\n");
sb.append("\t\t-c base -a attributes.json -d -l support_rim.bin -o base_rim.swidtag\n\n\n");
sb.append("\t\t-c base -a attributes.json -d -l support_rim.bin -o base_rim.swidtag" +
"\n\n\n");
sb.append("Create a base RIM using the default attribute values; ");
sb.append("sign it using privateKey.pem; embed cert.pem in the signature block; ");
sb.append("and write the data to console output:\n\n");
sb.append("\t\t-c base -l support_rim.bin -k privateKey.pem -p cert.pem\n\n\n");
sb.append("\t\t-c base -l support_rim.bin -k privateKey.pem -p cert.pem -e\n\n\n");
sb.append("Validate a base RIM using an external support RIM to override the ");
sb.append("payload file:\n\n");
sb.append("\t\t-v base_rim.swidtag -l support_rim.bin\n\n\n");
@ -107,7 +113,9 @@ public class Commander {
} else if (!this.getPrivateKeyFile().isEmpty() &&
!this.getPublicCertificate().isEmpty()) {
sb.append("Private key file: " + this.getPrivateKeyFile() + System.lineSeparator());
sb.append("Public certificate: " + this.getPublicCertificate() + System.lineSeparator());
sb.append("Public certificate: " + this.getPublicCertificate()
+ System.lineSeparator());
sb.append("Embedded certificate: " + this.isEmbedded() + System.lineSeparator());
} else if (this.isDefaultKey()){
sb.append("Truststore file: default (" + SwidTagConstants.DEFAULT_KEYSTORE_FILE + ")"
+ System.lineSeparator());

21
tools/tcg_rim_tool/src/main/java/hirs/swid/utils/HashSwid.java
View File

@ -26,7 +26,7 @@ public class HashSwid {
* @param filepath the file to hash.
* @return
*/
public static String get256Hash(String filepath) {
public static String get256Hash(String filepath) throws Exception {
return getHashValue(filepath, SHA256);
}
@ -35,7 +35,7 @@ public class HashSwid {
* @param filepath the file to hash.
* @return
*/
public String get384Hash(String filepath) {
public String get384Hash(String filepath) throws Exception {
return getHashValue(filepath, SHA384);
}
@ -44,7 +44,7 @@ public class HashSwid {
* @param filepath the file to hash.
* @return
*/
public String get512Hash(String filepath) {
public String get512Hash(String filepath) throws Exception {
return getHashValue(filepath, SHA512);
}
@ -60,7 +60,7 @@ public class HashSwid {
* @param sha the algorithm to use for the hash
* @return
*/
private static String getHashValue(String filepath, String sha) {
private static String getHashValue(String filepath, String sha) throws Exception {
String resultString = null;
try {
MessageDigest md = MessageDigest.getInstance(sha);
@ -71,10 +71,15 @@ public class HashSwid {
sb.append(Integer.toString((bytes[i] & 0xff) + 0x100, 16).substring(1));
}
resultString = sb.toString();
} catch (UnsupportedEncodingException | NoSuchAlgorithmException grex) {
System.out.println(grex.getMessage());
} catch (IOException e) {
System.out.println("Error reading in file to hash: " + e.getMessage());
} catch (NoSuchAlgorithmException | IOException e) {
String errorMessage = "Error hashing file " + filepath + ": ";
if (e instanceof UnsupportedEncodingException ||
e instanceof NoSuchAlgorithmException) {
errorMessage += ((Exception) e).getMessage();
} else if (e instanceof IOException) {
errorMessage += "error reading file.";
}
throw new Exception(errorMessage);
}
return resultString;

60
tools/tcg_rim_tool/src/test/java/hirs/swid/TestSwidTagGateway.java
View File

@ -14,13 +14,21 @@ public class TestSwidTagGateway {
private SwidTagGateway gateway;
private SwidTagValidator validator;
private final String DEFAULT_OUTPUT = "generated_swidTag.swidtag";
private final String DEFAULT_WITH_CERT = "generated_with_cert.swidtag";
private final String DEFAULT_NO_CERT = "generated_no_cert.swidtag";
private final String ATTRIBUTES_FILE = TestSwidTagGateway.class.getClassLoader().getResource("rim_fields.json").getPath();
private final String JKS_KEYSTORE_FILE = TestSwidTagGateway.class.getClassLoader().getResource("keystore.jks").getPath();
private final String SIGNING_CERT_FILE = TestSwidTagGateway.class.getClassLoader().getResource("RimSignCert.pem").getPath();
private final String PRIVATE_KEY_FILE = TestSwidTagGateway.class.getClassLoader().getResource("privateRimKey.pem").getPath();
private final String SUPPORT_RIM_FILE = TestSwidTagGateway.class.getClassLoader().getResource("TpmLog.bin").getPath();
private final String BASE_USER_CERT = "generated_user_cert.swidtag";
private final String BASE_USER_CERT_EMBED = "generated_user_cert_embed.swidtag";
private final String BASE_DEFAULT_CERT = "generated_default_cert.swidtag";
private final String ATTRIBUTES_FILE = TestSwidTagGateway.class.getClassLoader()
.getResource("rim_fields.json").getPath();
private final String JKS_KEYSTORE_FILE = TestSwidTagGateway.class.getClassLoader()
.getResource("keystore.jks").getPath();
private final String SIGNING_CERT_FILE = TestSwidTagGateway.class.getClassLoader()
.getResource("RimSignCert.pem").getPath();
private final String PRIVATE_KEY_FILE = TestSwidTagGateway.class.getClassLoader()
.getResource("privateRimKey.pem").getPath();
private final String CA_CHAIN_FILE = TestSwidTagGateway.class.getClassLoader()
.getResource("RimCertChain.pem").getPath();
private final String SUPPORT_RIM_FILE = TestSwidTagGateway.class.getClassLoader()
.getResource("TpmLog.bin").getPath();
private InputStream expectedFile;
@BeforeClass
@ -30,6 +38,7 @@ public class TestSwidTagGateway {
gateway.setAttributesFile(ATTRIBUTES_FILE);
validator = new SwidTagValidator();
validator.setRimEventLog(SUPPORT_RIM_FILE);
validator.setTrustStoreFile(CA_CHAIN_FILE);
}
@AfterClass
@ -45,13 +54,35 @@ public class TestSwidTagGateway {
* where RimSignCert.pem has the AIA extension.
*/
@Test
public void testCreateBaseWithCert() {
public void testCreateBaseUserCertNotEmbedded() {
gateway.setDefaultCredentials(false);
gateway.setPemCertificateFile(SIGNING_CERT_FILE);
gateway.setPemPrivateKeyFile(PRIVATE_KEY_FILE);
gateway.setEmbeddedCert(false);
gateway.generateSwidTag(DEFAULT_OUTPUT);
expectedFile = TestSwidTagGateway.class.getClassLoader().getResourceAsStream(DEFAULT_WITH_CERT);
expectedFile = TestSwidTagGateway.class.getClassLoader()
.getResourceAsStream(BASE_USER_CERT);
Assert.assertTrue(compareFileBytesToExpectedFile(DEFAULT_OUTPUT));
Assert.assertTrue(validator.validateSwidTag(DEFAULT_OUTPUT));
}
/**
* This test creates the following base RIM:
* -c base -l TpmLog.bin -k privateRimKey.pem -p RimSignCert.pem -e
* And then validates it:
* -v [base RIM] -l TpmLog.bin -t RimCertChain.pem
*/
@Test
public void testCreateBaseUserCertEmbedded() {
gateway.setDefaultCredentials(false);
gateway.setPemCertificateFile(SIGNING_CERT_FILE);
gateway.setPemPrivateKeyFile(PRIVATE_KEY_FILE);
gateway.setEmbeddedCert(true);
gateway.generateSwidTag(DEFAULT_OUTPUT);
expectedFile = TestSwidTagGateway.class.getClassLoader()
.getResourceAsStream(BASE_USER_CERT_EMBED);
Assert.assertTrue(compareFileBytesToExpectedFile(DEFAULT_OUTPUT));
Assert.assertTrue(validator.validateSwidTag(DEFAULT_OUTPUT));
}
/**
@ -59,21 +90,24 @@ public class TestSwidTagGateway {
* -c base -l TpmLog.bin
*/
@Test
public void testCreateBaseWithoutCert() {
public void testCreateBaseDefaultCert() {
gateway.setDefaultCredentials(true);
gateway.setJksTruststoreFile(JKS_KEYSTORE_FILE);
gateway.generateSwidTag(DEFAULT_OUTPUT);
expectedFile = TestSwidTagGateway.class.getClassLoader().getResourceAsStream(DEFAULT_NO_CERT);
expectedFile = TestSwidTagGateway.class.getClassLoader()
.getResourceAsStream(BASE_DEFAULT_CERT);
Assert.assertTrue(compareFileBytesToExpectedFile(DEFAULT_OUTPUT));
Assert.assertTrue(validator.validateSwidTag(DEFAULT_OUTPUT));
}
/**
* This test corresponds to the arguments:
* -v <path>
*/
@Test
public void testValidateSwidTag() {
String filepath = TestSwidTagGateway.class.getClassLoader().getResource(DEFAULT_WITH_CERT).getPath();
String filepath = TestSwidTagGateway.class.getClassLoader()
.getResource(BASE_USER_CERT).getPath();
System.out.println("Validating file at " + filepath);
Assert.assertTrue(validator.validateSwidTag(filepath));
}

43
tools/tcg_rim_tool/src/test/resources/RimCertChain.pem Normal file
View File

@ -0,0 +1,43 @@
-----BEGIN CERTIFICATE-----
MIIDjDCCAnSgAwIBAgIJALEA1Q472tZoMA0GCSqGSIb3DQEBCwUAMFMxCzAJBgNV
BAYTAlVTMQswCQYDVQQIDAJWQTEQMA4GA1UECgwHRXhhbXBsZTERMA8GA1UECwwI
UENDbGllbnQxEjAQBgNVBAMMCUV4YW1wbGVDQTAeFw0yMDAyMTAxNzI2MDdaFw0y
OTEyMTkxNzI2MDdaMFMxCzAJBgNVBAYTAlVTMQswCQYDVQQIDAJWQTEQMA4GA1UE
CgwHRXhhbXBsZTERMA8GA1UECwwIUENDbGllbnQxEjAQBgNVBAMMCUV4YW1wbGVD
QTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAPN0k+ULqFxdHZ14CCio
HAvn56T1Ca4t3ClmZoHSAiKsqzLV+rErk5SbMTIdi0vHQ+3sPYf9Opy0EeUXzh4J
g6CeGdDn247has1k135KBD9iJCaErJfZPnJ22CjKey8rvJM8fH3CAR7M/5uwYcPH
yRICwGAJMA/Qss4nsMRQpfZg4ReKVW+kAoa9eekG3q1sLu/QlCb0NC766X0ANP+8
AuGuHJmNV22fjvwSNfWbsJElcMrLbK4kliPyy05YVs19p+cBM1ADxGw2fJqsNsUy
34SXL1ATqOp7VCslRR5TJBzhxfM56xZbszry7BaqTSFDRGn1FuMw/4+qtPMAB88u
eXECAwEAAaNjMGEwHQYDVR0OBBYEFEahuO3bpnFf0NLneoo8XW6aw5Y4MB8GA1Ud
IwQYMBaAFEahuO3bpnFf0NLneoo8XW6aw5Y4MA8GA1UdEwEB/wQFMAMBAf8wDgYD
VR0PAQH/BAQDAgGGMA0GCSqGSIb3DQEBCwUAA4IBAQCwCUSV6VjOR+v85z18q5UX
bla0gEsfbc2mx0kGtNqi2im2Xt8UoSJDnfMXzfQq3IP3en943mqgIeYUl3f9UQBT
KgGfyHNbEfa0FzqfKpxJdT37C9ilSQ85GtThffc4I50QgBHaRXOvwBdrGpU2O11V
x35VLyYoycIlg+CizVywEX53aoMil1hEbv0TPtbNnFZGwM/fxvere65GeQld9gEP
9krGtSXYlMktvr66cqPzmG0ciA6dMBZN8dpTgUopmYNz8HVoHDq/KBmXYA7CMzrX
pVNx4kMW/KxA+XAHT82xE7PCiLIJx4z9uPn0O4PBDw0tQ0mxuDpeoi1i9PuBfe6Y
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
MIIDoTCCAomgAwIBAgIJAIKly+6bklZlMA0GCSqGSIb3DQEBCwUAMFMxCzAJBgNV
BAYTAlVTMQswCQYDVQQIDAJWQTEQMA4GA1UECgwHRXhhbXBsZTERMA8GA1UECwwI
UENDbGllbnQxEjAQBgNVBAMMCUV4YW1wbGVDQTAeFw0yMDA2MTExNjUzMDFaFw0z
MDA0MjAxNjUzMDFaMFwxCzAJBgNVBAYTAlVTMQswCQYDVQQIDAJWQTEQMA4GA1UE
CgwHRXhhbXBsZTERMA8GA1UECwwIUENDbGllbnQxGzAZBgNVBAMMEmV4YW1wbGUu
UklNLnNpZ25lcjCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAKd1lWGk
SRuxAAY2wHag2GVxUk1dZx2PTpfQOflvLeccAVwa8mQhlsRERq+QK8ilj8Xfqs44
/nBaccZDOjdfIxIUCMfwhGXjxCaqZbgTucNsExDnu4arTGraoAwzHg0cVLiKT/Cx
j9NL4dcMgxRXsPdHfXb0923C7xYd2t2qfW05umgaj7qeQl6c68CFNsGX4JA8rWFQ
ZvvGx5DGlK4KTcjPuQQINs5fxasNKqLY2hq+z82x/rqwr2hmyizD6FpFSyIABPEM
PfB036GEhRwu1WEMkq8yIp2jgRUoFYke9pB3ph9pVow0Hh4mNFSKD4pP41VSKY1n
us83mdkuukPy5o0CAwEAAaNvMG0wHQYDVR0OBBYEFC/euOfQMKIgnaoBhhqWT+3s
8rzBMB8GA1UdIwQYMBaAFEahuO3bpnFf0NLneoo8XW6aw5Y4MAkGA1UdEwQCMAAw
CwYDVR0PBAQDAgbAMBMGA1UdJQQMMAoGCCsGAQUFBwMDMA0GCSqGSIb3DQEBCwUA
A4IBAQC1mG0naE0W4E9vujPhygf7LXHMFkMPs5uWyvkxe4zWgTg0RHTClbOFJQJ+
pGLOcthSG6vIC6xYJxT5EKtB9rzRlEYHOi4MxuwXz9rLWQhA2zdbSo54Fb/BPoca
5K9kxvAanRltEfqEFhCcRmqIX1i6mpOWiZsrdMs7IflHKBsylUTn+v636BAz3p2H
8/lpJbF4LUFUxFU5FWB3tLuasxYTsbeE6YyNAnQIS95ML7c5H8z2aEQs5TCNHZJD
yc0PZT2aPOuEj5lGv9oyBHbYDitszUWSVxF7z86uVGmYR/2oTIj6tqb+IwuvFtnO
wiXFRS5ctLCdESr3SjdQF5wmIN4n
-----END CERTIFICATE-----

0
tools/tcg_rim_tool/src/test/resources/generated_no_cert.swidtag → tools/tcg_rim_tool/src/test/resources/generated_default_cert.swidtag
View File

41
tools/tcg_rim_tool/src/test/resources/generated_user_cert.swidtag Normal file
View File

@ -0,0 +1,41 @@
<?xml version="1.0" encoding="UTF-8" standalone="no"?>
<SoftwareIdentity xmlns="http://standards.iso.org/iso/19770/-2/2015/schema.xsd" xmlns:ns2="http://www.w3.org/2000/09/xmldsig#" corpus="false" name="Example.com BIOS" patch="false" supplemental="false" tagId="94f6b457-9ac9-4d35-9b3f-78804173b65as" tagVersion="0" version="01" versionScheme="multipartnumeric" xml:lang="en">
<Entity name="Example Inc" regid="http://Example.com" role="softwareCreator tagCreator"/>
<Link href="https://Example.com/support/ProductA/firmware/installfiles" rel="installationmedia"/>
<Meta xmlns:n8060="http://csrc.nist.gov/ns/swid/2015-extensions/1.0" xmlns:rim="https://trustedcomputinggroup.org/wp-content/uploads/TCG_RIM_Model" n8060:colloquialVersion="Firmware_2019" n8060:edition="12" n8060:product="ProductA" n8060:revision="r2" rim:BindingSpec="PC Client RIM" rim:BindingSpecVersion="1.2" rim:PayloadType="direct" rim:firmwareManufacturerId="00213022" rim:firmwareManufacturerStr="BIOSVendorA" rim:firmwareModel="A0" rim:firmwareVersion="12" rim:pcURIGlobal="https://Example.com/support/ProductA/" rim:pcURILocal="/boot/tcg/manifest/switag/" rim:platformManufacturerId="00201234" rim:platformManufacturerStr="Example.com" rim:platformModel="ProductA" rim:platformVersion="01"/>
<Payload>
<Directory name="rim">
<File xmlns:SHA256="http://www.w3.org/2001/04/xmlenc#sha256" SHA256:hash="4479ca722623f8c47b703996ced3cbd981b06b1ae8a897db70137e0b7c546848" name="Example.com.BIOS.01.rimel" size="7549"/>
</Directory>
</Payload>
<Signature xmlns="http://www.w3.org/2000/09/xmldsig#">
<SignedInfo>
<CanonicalizationMethod Algorithm="http://www.w3.org/TR/2001/REC-xml-c14n-20010315"/>
<SignatureMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#rsa-sha256"/>
<Reference URI="">
<Transforms>
<Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"/>
</Transforms>
<DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"/>
<DigestValue>K3XoBeYvgJBAKl8z273sL7z38qLLVBKLfUPt/gPUzBI=</DigestValue>
</Reference>
</SignedInfo>
<SignatureValue>cIl1gPsUyEj2gDv3HTWNFDVxtcBjz4Revxxf2LJejtOXQW8mGepZH8CnvgO7zCAbZYlYUZXjYZ9M&#13;
jONVv8dcsAjVHRnP6YHywFfmSm8LUCwxsfuZQqn5jClqzu5VaqLzBhuJYvCpiEdIDJwDINQuORUB&#13;
nzul1CWc3Sm1Ms2wjlIq5ctWWJcddhdyIOjl8/oD4EC5E2rOSfNcRMZxldXtie9iinFGVbr0YNE+&#13;
+lQ7hAU+SyV8RMx9tGnnsO8otwV4ddF+OfemcbzWGYBenLs3A8ZqWZyTvWphCgGqDUbOLssYciCC&#13;
mnYm5QOeh4QcE9H2kqTgZvcyCgPL/hDC7xhyjQ==</SignatureValue>
<KeyInfo>
<KeyValue>
<RSAKeyValue>
<Modulus>p3WVYaRJG7EABjbAdqDYZXFSTV1nHY9Ol9A5+W8t5xwBXBryZCGWxERGr5AryKWPxd+qzjj+cFpx&#13;
xkM6N18jEhQIx/CEZePEJqpluBO5w2wTEOe7hqtMatqgDDMeDRxUuIpP8LGP00vh1wyDFFew90d9&#13;
dvT3bcLvFh3a3ap9bTm6aBqPup5CXpzrwIU2wZfgkDytYVBm+8bHkMaUrgpNyM+5BAg2zl/Fqw0q&#13;
otjaGr7PzbH+urCvaGbKLMPoWkVLIgAE8Qw98HTfoYSFHC7VYQySrzIinaOBFSgViR72kHemH2lW&#13;
jDQeHiY0VIoPik/jVVIpjWe6zzeZ2S66Q/LmjQ==</Modulus>
<Exponent>AQAB</Exponent>
</RSAKeyValue>
</KeyValue>
</KeyInfo>
</Signature>
</SoftwareIdentity>

0
tools/tcg_rim_tool/src/test/resources/generated_with_cert.swidtag → tools/tcg_rim_tool/src/test/resources/generated_user_cert_embed.swidtag
View File