ExternalVendorCode/HIRS
1
0
Fork 0
mirror of https://github.com/nsacyber/HIRS.git synced 2025-04-07 19:34:27 +00:00
Code Issues Actions 3 Packages Projects Releases Wiki Activity

Updated the new polices after doing a bit of testing to make sure that they do ignore when there is a failure on that specific bit.

Browse Source
This commit is contained in:
Cyrus 2021-11-10 07:27:33 -05:00
parent f0ea84d199
commit 2d9fb19d38
3 changed files with 7 additions and 13 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
HIRS_AttestationCA/src/main/java/hirs/attestationca/service/SupplyChainValidationServiceImpl.java
View File

@ -543,11 +543,6 @@ public class SupplyChainValidationServiceImpl implements SupplyChainValidationSe
eventValueMap.put(rdv.getDigestValue(), rdv);
}
// for (TpmPcrEvent tpe : tcgMeasurementLog.getEventList()) {
// if (!eventValueMap.containsKey(tpe.getEventDigestStr())) {
// tpmPcrEvents.add(tpe);
// }
// }
tpmPcrEvents.addAll(pcrPolicy.validateTpmEvents(
tcgMeasurementLog, eventValueMap));
}

7
HIRS_AttestationCAPortal/src/main/java/hirs/attestationca/portal/page/controllers/PolicyPageController.java
View File

@ -866,16 +866,17 @@ public class PolicyPageController extends PageController<NoPageParams> {
// set the policy option and create success message
if (ignoreOsEvtOptionEnabled) {
policy.getPcrPolicy().setEnableIgnoreOsEvt(true);
successMessage = "Ignore GPT enabled";
policy.getPcrPolicy().setEnableIgnoreGpt(true);
successMessage = "Ignore OS Events enabled";
} else {
policy.getPcrPolicy().setEnableIgnoreOsEvt(false);
successMessage = "Ignore GPT disabled";
successMessage = "Ignore OS Events disabled";
}
savePolicyAndApplySuccessMessage(ppModel, model, messages, successMessage, policy);
} catch (PolicyManagerException e) {
handlePolicyManagerUpdateError(model, messages, e,
"Error changing ACA Os Events ignore policy",
"Error changing ACA OS Events ignore policy",
"Error updating policy. \n" + e.getMessage());
}

8
HIRS_Utils/src/main/java/hirs/data/persist/PCRPolicy.java
View File

@ -129,11 +129,8 @@ public final class PCRPolicy extends Policy {
final Map<String, ReferenceDigestValue> eventValueMap) {
List<TpmPcrEvent> tpmPcrEvents = new LinkedList<>();
for (TpmPcrEvent tpe : tcgMeasurementLog.getEventList()) {
if (enableIgnoreIma && tpe.getPcrIndex() == IMA_PCR) {
LOGGER.info(String.format("IMA Ignored -> %s", tpe));
} else if (enableIgnoreGpt && tpe.getPcrIndex() == GPT_PCR) {
LOGGER.info(String.format("GPT Ignored -> %s", tpe));
} else if (enableIgnoretBoot && (tpe.getPcrIndex() >= TBOOT_PCR_START
&& tpe.getPcrIndex() <= TBOOT_PCR_END)) {
LOGGER.info(String.format("TBOOT Ignored -> %s", tpe));
@ -141,8 +138,9 @@ public final class PCRPolicy extends Policy {
&& tpe.getPcrIndex() <= PXE_PCR_END)) {
LOGGER.info(String.format("OS Evt Ignored -> %s", tpe));
} else {
if (enableIgnoreOsEvt && (tpe.getEventTypeStr().contains(EVT_EFI_BOOT)
|| tpe.getEventTypeStr().contains(EVT_EFI_GPT)
if (enableIgnoreGpt && tpe.getEventTypeStr().contains(EVT_EFI_GPT)) {
LOGGER.info(String.format("GPT Ignored -> %s", tpe));
} else if (enableIgnoreOsEvt && (tpe.getEventTypeStr().contains(EVT_EFI_BOOT)
|| tpe.getEventTypeStr().contains(EVT_EFI_VAR))) {
LOGGER.info(String.format("OS Evt Ignored -> %s", tpe));
} else if (enableIgnoreOsEvt && (tpe.getEventTypeStr().contains(EVT_EFI_CFG)