mirror of
https://github.com/nsacyber/HIRS.git
synced 2025-01-31 00:24:00 +00:00
After some code review, there are changes and removals for the
provisioning process. IdentityRequest is an old structure for the provisioner and it has been removed and some preliminary code file renames.
This commit is contained in:
Cyrus
parent
31066694ee
commit
4de125c0f8
@ -8,9 +8,8 @@ import hirs.attestationca.persist.entity.manager.PolicyRepository;
|
||||
import hirs.attestationca.persist.entity.manager.ReferenceDigestValueRepository;
|
||||
import hirs.attestationca.persist.entity.manager.ReferenceManifestRepository;
|
||||
import hirs.attestationca.persist.entity.manager.TPM2ProvisionerStateRepository;
|
||||
import hirs.attestationca.persist.provision.CertificateRequestHandler;
|
||||
import hirs.attestationca.persist.provision.IdentityClaimHandler;
|
||||
import hirs.attestationca.persist.provision.IdentityRequestHandler;
|
||||
import hirs.attestationca.persist.provision.CertificateRequestProcessor;
|
||||
import hirs.attestationca.persist.provision.IdentityClaimProcessor;
|
||||
import hirs.attestationca.persist.service.SupplyChainValidationService;
|
||||
import hirs.structs.converters.StructConverter;
|
||||
import lombok.extern.log4j.Log4j2;
|
||||
@ -62,9 +61,8 @@ public abstract class AttestationCertificateAuthority {
|
||||
private final PolicyRepository policyRepository;
|
||||
private final TPM2ProvisionerStateRepository tpm2ProvisionerStateRepository;
|
||||
|
||||
private CertificateRequestHandler certificateRequestHandler;
|
||||
private IdentityClaimHandler identityClaimHandler;
|
||||
private IdentityRequestHandler identityRequestHandler;
|
||||
private CertificateRequestProcessor certificateRequestHandler;
|
||||
private IdentityClaimProcessor identityClaimHandler;
|
||||
|
||||
/**
|
||||
* Constructor.
|
||||
@ -109,19 +107,13 @@ public abstract class AttestationCertificateAuthority {
|
||||
this.policyRepository = policyRepository;
|
||||
this.tpm2ProvisionerStateRepository = tpm2ProvisionerStateRepository;
|
||||
|
||||
this.certificateRequestHandler = new CertificateRequestHandler(supplyChainValidationService,
|
||||
this.certificateRequestHandler = new CertificateRequestProcessor(supplyChainValidationService,
|
||||
certificateRepository, deviceRepository,
|
||||
privateKey, acaCertificate, validDays, tpm2ProvisionerStateRepository);
|
||||
this.identityClaimHandler = new IdentityClaimHandler(supplyChainValidationService,
|
||||
this.identityClaimHandler = new IdentityClaimProcessor(supplyChainValidationService,
|
||||
certificateRepository, referenceManifestRepository,
|
||||
referenceDigestValueRepository,
|
||||
deviceRepository, tpm2ProvisionerStateRepository, policyRepository);
|
||||
this.identityRequestHandler = new IdentityRequestHandler(structConverter, certificateRepository,
|
||||
deviceRepository, supplyChainValidationService, privateKey, validDays, acaCertificate);
|
||||
}
|
||||
|
||||
byte[] processIdentityRequest(final byte[] identityRequest) {
|
||||
return this.identityRequestHandler.processIdentityRequest(identityRequest);
|
||||
}
|
||||
|
||||
byte[] processIdentityClaimTpm2(final byte[] identityClaim) {
|
||||
|
||||
@ -71,28 +71,6 @@ public class RestfulAttestationCertificateAuthority extends AttestationCertifica
|
||||
referenceDigestValueRepository, policyRepository, tpm2ProvisionerStateRepository);
|
||||
}
|
||||
|
||||
/**
|
||||
* Processes a given IdentityRequestEnvelope and
|
||||
* generates a IdentityResponseEnvelope. In most cases,
|
||||
* a client will generate the request using the TPM "Collate Identity" process.
|
||||
*
|
||||
* Wrap the {@link AttestationCertificateAuthority#processIdentityRequest(byte[])}
|
||||
* with a Spring {@link org.springframework.web.bind.annotation.RequestMapping}. Effectively, this method then will allow spring to
|
||||
* serialize and deserialize the request and responses on method invocation and
|
||||
* return, respectively.
|
||||
*
|
||||
* @param identityRequest generated during the collate identity process with a Tpm
|
||||
* @return response for the request
|
||||
*/
|
||||
@Override
|
||||
@ResponseBody
|
||||
@RequestMapping(value = "/identity-request/process",
|
||||
method = RequestMethod.POST,
|
||||
consumes = MediaType.APPLICATION_OCTET_STREAM_VALUE)
|
||||
public byte[] processIdentityRequest(@RequestBody final byte[] identityRequest) {
|
||||
return super.processIdentityRequest(identityRequest);
|
||||
}
|
||||
|
||||
/**
|
||||
* Listener for identity requests from TPM 2.0 provisioning.
|
||||
*
|
||||
|
||||
@ -5,8 +5,6 @@ package hirs.attestationca.persist;
|
||||
*/
|
||||
public interface RestfulInterface {
|
||||
|
||||
byte[] processIdentityRequest(byte[] identityRequest);
|
||||
|
||||
byte[] processIdentityClaimTpm2(byte[] identityClaim);
|
||||
|
||||
byte[] processCertificateRequest(byte[] certificateRequest);
|
||||
|
||||
@ -60,5 +60,4 @@ public class AppraisalStatus {
|
||||
this.message = message;
|
||||
this.additionalInfo = additionalInfo;
|
||||
}
|
||||
|
||||
}
|
||||
|
||||
@ -41,7 +41,7 @@ import java.util.List;
|
||||
|
||||
@Log4j2
|
||||
@NoArgsConstructor
|
||||
public class AbstractRequestHandler {
|
||||
public class AbstractProcessor {
|
||||
|
||||
@Getter
|
||||
private int validDays;
|
||||
@ -51,8 +51,8 @@ public class AbstractRequestHandler {
|
||||
@Getter
|
||||
private PolicyRepository policyRepository;
|
||||
|
||||
public AbstractRequestHandler(final PrivateKey privateKey,
|
||||
final int validDays) {
|
||||
public AbstractProcessor(final PrivateKey privateKey,
|
||||
final int validDays) {
|
||||
this.privateKey = privateKey;
|
||||
this.validDays = validDays;
|
||||
}
|
||||
@ -27,7 +27,7 @@ import java.security.interfaces.RSAPublicKey;
|
||||
import java.util.List;
|
||||
|
||||
@Log4j2
|
||||
public class CertificateRequestHandler extends AbstractRequestHandler {
|
||||
public class CertificateRequestProcessor extends AbstractProcessor {
|
||||
|
||||
private SupplyChainValidationService supplyChainValidationService;
|
||||
private CertificateRepository certificateRepository;
|
||||
@ -42,13 +42,13 @@ public class CertificateRequestHandler extends AbstractRequestHandler {
|
||||
* @param validDays int for the time in which a certificate is valid.
|
||||
* @param tpm2ProvisionerStateRepository db connector for provisioner state.
|
||||
*/
|
||||
public CertificateRequestHandler(final SupplyChainValidationService supplyChainValidationService,
|
||||
final CertificateRepository certificateRepository,
|
||||
final DeviceRepository deviceRepository,
|
||||
final PrivateKey privateKey,
|
||||
final X509Certificate acaCertificate,
|
||||
final int validDays,
|
||||
final TPM2ProvisionerStateRepository tpm2ProvisionerStateRepository) {
|
||||
public CertificateRequestProcessor(final SupplyChainValidationService supplyChainValidationService,
|
||||
final CertificateRepository certificateRepository,
|
||||
final DeviceRepository deviceRepository,
|
||||
final PrivateKey privateKey,
|
||||
final X509Certificate acaCertificate,
|
||||
final int validDays,
|
||||
final TPM2ProvisionerStateRepository tpm2ProvisionerStateRepository) {
|
||||
super(privateKey, validDays);
|
||||
this.supplyChainValidationService = supplyChainValidationService;
|
||||
this.certificateRepository = certificateRepository;
|
||||
@ -57,7 +57,7 @@ import java.util.regex.Matcher;
|
||||
import java.util.regex.Pattern;
|
||||
|
||||
@Log4j2
|
||||
public class IdentityClaimHandler extends AbstractRequestHandler {
|
||||
public class IdentityClaimProcessor extends AbstractProcessor {
|
||||
private static final String PCR_QUOTE_MASK = "0,1,2,3,4,5,6,7,8,9,10,11,12,13,"
|
||||
+ "14,15,16,17,18,19,20,21,22,23";
|
||||
|
||||
@ -78,7 +78,7 @@ public class IdentityClaimHandler extends AbstractRequestHandler {
|
||||
/**
|
||||
* Constructor
|
||||
*/
|
||||
public IdentityClaimHandler(
|
||||
public IdentityClaimProcessor(
|
||||
final SupplyChainValidationService supplyChainValidationService,
|
||||
final CertificateRepository certificateRepository,
|
||||
final ReferenceManifestRepository referenceManifestRepository,
|
||||
@ -1,345 +0,0 @@
|
||||
package hirs.attestationca.persist.provision;
|
||||
|
||||
import hirs.attestationca.persist.entity.manager.CertificateRepository;
|
||||
import hirs.attestationca.persist.entity.manager.DeviceRepository;
|
||||
import hirs.attestationca.persist.entity.userdefined.Certificate;
|
||||
import hirs.attestationca.persist.entity.userdefined.Device;
|
||||
import hirs.attestationca.persist.entity.userdefined.SupplyChainValidationSummary;
|
||||
import hirs.attestationca.persist.entity.userdefined.certificate.EndorsementCredential;
|
||||
import hirs.attestationca.persist.entity.userdefined.certificate.PlatformCredential;
|
||||
import hirs.attestationca.persist.entity.userdefined.report.DeviceInfoReport;
|
||||
import hirs.attestationca.persist.enums.AppraisalStatus;
|
||||
import hirs.attestationca.persist.exceptions.IdentityProcessingException;
|
||||
import hirs.attestationca.persist.provision.helper.CredentialManagementHelper;
|
||||
import hirs.attestationca.persist.provision.helper.ProvisionUtils;
|
||||
import hirs.attestationca.persist.service.SupplyChainValidationService;
|
||||
import hirs.structs.converters.SimpleStructBuilder;
|
||||
import hirs.structs.converters.StructConverter;
|
||||
import hirs.structs.elements.aca.IdentityRequestEnvelope;
|
||||
import hirs.structs.elements.aca.IdentityResponseEnvelope;
|
||||
import hirs.structs.elements.aca.SymmetricAttestation;
|
||||
import hirs.structs.elements.tpm.EncryptionScheme;
|
||||
import hirs.structs.elements.tpm.IdentityProof;
|
||||
import hirs.structs.elements.tpm.IdentityRequest;
|
||||
import hirs.structs.elements.tpm.SymmetricKey;
|
||||
import hirs.structs.elements.tpm.SymmetricKeyParams;
|
||||
import lombok.extern.log4j.Log4j2;
|
||||
import org.apache.commons.lang3.ArrayUtils;
|
||||
import org.apache.commons.lang3.SerializationUtils;
|
||||
|
||||
import java.io.IOException;
|
||||
import java.math.BigInteger;
|
||||
import java.security.PrivateKey;
|
||||
import java.security.PublicKey;
|
||||
import java.security.cert.X509Certificate;
|
||||
import java.util.LinkedList;
|
||||
import java.util.List;
|
||||
|
||||
@Log4j2
|
||||
public class IdentityRequestHandler extends AbstractRequestHandler {
|
||||
|
||||
/**
|
||||
* Container wired ACA private key.
|
||||
*/
|
||||
private final PrivateKey privateKey;
|
||||
private int validDays;
|
||||
private StructConverter structConverter;
|
||||
private CertificateRepository certificateRepository;
|
||||
private DeviceRepository deviceRepository;
|
||||
private SupplyChainValidationService supplyChainValidationService;
|
||||
private X509Certificate acaCertificate;
|
||||
|
||||
/**
|
||||
* Constructor.
|
||||
* @param structConverter the struct converter
|
||||
* @param certificateRepository
|
||||
* @param deviceRepository
|
||||
* @param supplyChainValidationService the supply chain service
|
||||
* @param privateKey
|
||||
* @param validDays int for the time in which a certificate is valid.
|
||||
* @param acaCertificate object holding the x509 certificate
|
||||
*/
|
||||
public IdentityRequestHandler(final StructConverter structConverter,
|
||||
final CertificateRepository certificateRepository,
|
||||
final DeviceRepository deviceRepository,
|
||||
final SupplyChainValidationService supplyChainValidationService,
|
||||
final PrivateKey privateKey,
|
||||
final int validDays, final X509Certificate acaCertificate) {
|
||||
super(privateKey, validDays);
|
||||
this.structConverter = structConverter;
|
||||
this.certificateRepository = certificateRepository;
|
||||
this.deviceRepository = deviceRepository;
|
||||
this.supplyChainValidationService = supplyChainValidationService;
|
||||
this.privateKey = privateKey;
|
||||
this.acaCertificate = acaCertificate;
|
||||
}
|
||||
|
||||
/**
|
||||
* Basic implementation of the ACA processIdentityRequest method.
|
||||
*
|
||||
* @param identityRequest cannot be null
|
||||
* @return an identity response for the specified request
|
||||
*/
|
||||
public byte[] processIdentityRequest(final byte[] identityRequest) {
|
||||
log.info("Identity Request Received...");
|
||||
if (ArrayUtils.isEmpty(identityRequest)) {
|
||||
throw new IllegalArgumentException("The IdentityRequest sent by the client"
|
||||
+ " cannot be null or empty.");
|
||||
}
|
||||
|
||||
log.debug("received request to process identity request");
|
||||
|
||||
// translate the bytes into the challenge
|
||||
IdentityRequestEnvelope challenge =
|
||||
structConverter.convert(identityRequest, IdentityRequestEnvelope.class);
|
||||
|
||||
byte[] identityProof = unwrapIdentityRequest(structConverter.convert(challenge.getRequest(),
|
||||
IdentityRequest.class));
|
||||
// the decrypted symmetric blob should be in the format of an IdentityProof. Use the
|
||||
// struct converter to generate it.
|
||||
IdentityProof proof = structConverter.convert(identityProof, IdentityProof.class);
|
||||
|
||||
// convert the credential into an actual key.
|
||||
log.debug("assembling public endorsement key");
|
||||
PublicKey ekPublicKey = null;
|
||||
|
||||
// attempt to find an endorsement credential to validate
|
||||
EndorsementCredential endorsementCredential = null;
|
||||
|
||||
// first check the identity request for the endorsement credential
|
||||
byte[] ecBytesFromIdentityRequest = proof.getEndorsementCredential();
|
||||
if (ArrayUtils.isNotEmpty(ecBytesFromIdentityRequest)) {
|
||||
endorsementCredential = CredentialManagementHelper.storeEndorsementCredential(
|
||||
this.certificateRepository, ecBytesFromIdentityRequest, "");
|
||||
try {
|
||||
BigInteger publicKeyModulus = Certificate.getPublicKeyModulus(
|
||||
endorsementCredential.getX509Certificate());
|
||||
if (publicKeyModulus != null) {
|
||||
ekPublicKey = ProvisionUtils.assemblePublicKey(publicKeyModulus.toByteArray());
|
||||
} else {
|
||||
throw new IdentityProcessingException("TPM 1.2 Provisioning requires EK "
|
||||
+ "Credentials to be created with RSA");
|
||||
}
|
||||
} catch (IOException ioEx) {
|
||||
log.error("Could not retrieve the public key modulus from the EK cert");
|
||||
}
|
||||
} else if (ArrayUtils.isNotEmpty(challenge.getEndorsementCredentialModulus())) {
|
||||
log.warn("EKC was not in the identity proof from the client. Checking for uploads.");
|
||||
// Check if the EC was uploaded
|
||||
ekPublicKey =
|
||||
ProvisionUtils.assemblePublicKey(new String(challenge.getEndorsementCredentialModulus()));
|
||||
endorsementCredential = getEndorsementCredential(ekPublicKey);
|
||||
} else {
|
||||
log.warn("Zero-length endorsement credential received in identity request.");
|
||||
}
|
||||
|
||||
// get platform credential from the identity request
|
||||
List<PlatformCredential> platformCredentials = new LinkedList<>();
|
||||
byte[] pcBytesFromIdentityRequest = proof.getPlatformCredential();
|
||||
if (ArrayUtils.isNotEmpty(pcBytesFromIdentityRequest)) {
|
||||
platformCredentials.add(CredentialManagementHelper.storePlatformCredential(
|
||||
this.certificateRepository, pcBytesFromIdentityRequest));
|
||||
} else if (endorsementCredential != null) {
|
||||
// if none in the identity request, look for uploaded platform credentials
|
||||
log.warn("PC was not in the identity proof from the client. Checking for uploads.");
|
||||
platformCredentials.addAll(getPlatformCredentials(endorsementCredential));
|
||||
} else {
|
||||
// if none in the identity request, look for uploaded platform credentials
|
||||
log.warn("Zero-length platform credential received in identity request.");
|
||||
}
|
||||
|
||||
log.debug("Processing serialized device info report structure of length {}",
|
||||
challenge.getDeviceInfoReportLength());
|
||||
|
||||
DeviceInfoReport deviceInfoReport = (DeviceInfoReport)
|
||||
SerializationUtils.deserialize(challenge.getDeviceInfoReport());
|
||||
|
||||
if (deviceInfoReport == null) {
|
||||
log.error("Failed to deserialize Device Info Report");
|
||||
throw new IdentityProcessingException("Device Info Report failed to deserialize "
|
||||
+ "from Identity Request");
|
||||
}
|
||||
|
||||
log.info("Processing Device Info Report");
|
||||
// store device and device info report.
|
||||
String deviceName = deviceInfoReport.getNetworkInfo().getHostname();
|
||||
Device device = this.deviceRepository.findByName(deviceName);
|
||||
device.setDeviceInfo(deviceInfoReport);
|
||||
|
||||
// perform supply chain validation. Note: It's possible that this should be done earlier
|
||||
// in this method.
|
||||
SupplyChainValidationSummary summary =
|
||||
supplyChainValidationService.validateSupplyChain(endorsementCredential,
|
||||
platformCredentials, device);
|
||||
|
||||
// update the validation result in the device
|
||||
device.setSupplyChainValidationStatus(summary.getOverallValidationResult());
|
||||
deviceRepository.save(device);
|
||||
// check if supply chain validation succeeded.
|
||||
// If it did not, do not provide the IdentityResponseEnvelope
|
||||
if (summary.getOverallValidationResult() == AppraisalStatus.Status.PASS) {
|
||||
IdentityResponseEnvelope identityResponse =
|
||||
generateIdentityResponseEnvelopeAndStoreIssuedCert(challenge,
|
||||
ekPublicKey, endorsementCredential, platformCredentials, device);
|
||||
|
||||
return structConverter.convert(identityResponse);
|
||||
} else {
|
||||
log.error("Supply chain validation did not succeed. Result is: "
|
||||
+ summary.getOverallValidationResult());
|
||||
return new byte[]{};
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Given a successful supply chain validation, generate an Identity Response envelope and
|
||||
* the issued certificate. The issued cert is stored in the database. The identity response
|
||||
* envelope is returned, and sent back to the client using the struct converter.
|
||||
* @param challenge the identity request envelope
|
||||
* @param ekPublicKey the EK public key
|
||||
* @param endorsementCredential the endorsement credential
|
||||
* @param platformCredentials the set of platform credentials
|
||||
* @param device the device associated
|
||||
* @return the identity response envelope
|
||||
*/
|
||||
private IdentityResponseEnvelope generateIdentityResponseEnvelopeAndStoreIssuedCert(
|
||||
final IdentityRequestEnvelope challenge, final PublicKey ekPublicKey,
|
||||
final EndorsementCredential endorsementCredential,
|
||||
final List<PlatformCredential> platformCredentials, final Device device) {
|
||||
// decrypt the asymmetric / symmetric blobs
|
||||
log.debug("unwrapping identity request");
|
||||
byte[] identityProof = unwrapIdentityRequest(
|
||||
structConverter.convert(challenge.getRequest(), IdentityRequest.class));
|
||||
|
||||
// the decrypted symmetric blob should be in the format of an IdentityProof. Use the
|
||||
// struct converter to generate it.
|
||||
IdentityProof proof = structConverter.convert(identityProof, IdentityProof.class);
|
||||
|
||||
// generate a session key and convert to byte array
|
||||
log.debug("generating symmetric key for response");
|
||||
SymmetricKey sessionKey = ProvisionUtils.generateSymmetricKey();
|
||||
|
||||
// generate the asymmetric contents for the identity response
|
||||
log.debug("generating asymmetric contents for response");
|
||||
byte[] asymmetricContents = ProvisionUtils.generateAsymmetricContents(
|
||||
structConverter.convert(proof.getIdentityKey()),
|
||||
structConverter.convert(sessionKey), ekPublicKey);
|
||||
|
||||
// generate the identity credential
|
||||
log.debug("generating credential from identity proof");
|
||||
|
||||
// transform the public key struct into a public key
|
||||
PublicKey publicKey = ProvisionUtils.assemblePublicKey(proof.getIdentityKey().getStorePubKey().getKey());
|
||||
X509Certificate credential = generateCredential(publicKey, endorsementCredential,
|
||||
platformCredentials, device.getDeviceInfo()
|
||||
.getNetworkInfo()
|
||||
.getIpAddress()
|
||||
.getHostName(), acaCertificate);
|
||||
|
||||
// generate the attestation using the credential and the key for this session
|
||||
log.debug("generating symmetric response");
|
||||
SymmetricAttestation attestation = ProvisionUtils.generateAttestation(credential, sessionKey);
|
||||
|
||||
// construct the response with the both the asymmetric contents and the CA attestation
|
||||
IdentityResponseEnvelope identityResponse =
|
||||
new SimpleStructBuilder<>(IdentityResponseEnvelope.class)
|
||||
.set("asymmetricContents", asymmetricContents)
|
||||
.set("symmetricAttestation", attestation).build();
|
||||
|
||||
// save new attestation certificate
|
||||
byte[] derEncodedAttestationCertificate = ProvisionUtils.getDerEncodedCertificate(credential);
|
||||
saveAttestationCertificate(this.certificateRepository, derEncodedAttestationCertificate,
|
||||
endorsementCredential, platformCredentials, device);
|
||||
|
||||
return identityResponse;
|
||||
}
|
||||
|
||||
/**
|
||||
* Unwraps a given identityRequest. That is to say, decrypt the asymmetric portion of a data
|
||||
* structure to determine the method to decrypt the symmetric portion.
|
||||
*
|
||||
* @param request
|
||||
* to be decrypted
|
||||
* @return the decrypted symmetric portion of an identity request.
|
||||
*/
|
||||
private byte[] unwrapIdentityRequest(final IdentityRequest request) {
|
||||
// in case the TPM did not specify the IV, it must be extracted from the symmetric blob.
|
||||
// the IV will then be the the first block of the cipher text.
|
||||
final byte[] iv;
|
||||
SymmetricKeyParams symmetricKeyParams = request.getSymmetricAlgorithm();
|
||||
if (symmetricKeyParams != null && symmetricKeyParams.getParams() != null) {
|
||||
iv = symmetricKeyParams.getParams().getIv();
|
||||
} else {
|
||||
iv = ProvisionUtils.extractInitialValue(request);
|
||||
}
|
||||
|
||||
// determine the encryption scheme from the algorithm
|
||||
EncryptionScheme asymmetricScheme =
|
||||
EncryptionScheme.fromInt(request.getAsymmetricAlgorithm().getEncryptionScheme());
|
||||
|
||||
// decrypt the asymmetric blob
|
||||
byte[] decryptedAsymmetricBlob =
|
||||
ProvisionUtils.decryptAsymmetricBlob(request.getAsymmetricBlob(), asymmetricScheme, getPrivateKey());
|
||||
|
||||
// construct our symmetric key structure from the decrypted asymmetric blob
|
||||
SymmetricKey symmetricKey =
|
||||
structConverter.convert(decryptedAsymmetricBlob, SymmetricKey.class);
|
||||
|
||||
byte[] decryptedSymmetricBlob =
|
||||
ProvisionUtils.decryptSymmetricBlob(request.getSymmetricBlob(), symmetricKey.getKey(), iv,
|
||||
"AES/CBC/PKCS5Padding");
|
||||
|
||||
// decrypt the symmetric blob
|
||||
return decryptedSymmetricBlob;
|
||||
}
|
||||
|
||||
/**
|
||||
* Gets the Endorsement Credential from the DB given the EK public key.
|
||||
* @param ekPublicKey the EK public key
|
||||
* @return the Endorsement credential, if found, otherwise null
|
||||
*/
|
||||
private EndorsementCredential getEndorsementCredential(final PublicKey ekPublicKey) {
|
||||
log.debug("Searching for endorsement credential based on public key: " + ekPublicKey);
|
||||
|
||||
if (ekPublicKey == null) {
|
||||
throw new IllegalArgumentException("Cannot look up an EC given a null public key");
|
||||
}
|
||||
|
||||
EndorsementCredential credential = null;
|
||||
|
||||
try {
|
||||
credential = certificateRepository.findByPublicKeyModulusHexValue(Certificate
|
||||
.getPublicKeyModulus(ekPublicKey)
|
||||
.toString());
|
||||
} catch (IOException ioEx) {
|
||||
log.error("Could not extract public key modulus", ioEx);
|
||||
}
|
||||
|
||||
if (credential == null) {
|
||||
log.warn("Unable to find endorsement credential for public key.");
|
||||
} else {
|
||||
log.debug("Endorsement credential found.");
|
||||
}
|
||||
|
||||
return credential;
|
||||
}
|
||||
|
||||
private List<PlatformCredential> getPlatformCredentials(final EndorsementCredential ec) {
|
||||
List<PlatformCredential> credentials = null;
|
||||
|
||||
if (ec == null) {
|
||||
log.warn("Cannot look for platform credential(s). Endorsement credential was null.");
|
||||
} else {
|
||||
log.debug("Searching for platform credential(s) based on holder serial number: "
|
||||
+ ec.getSerialNumber());
|
||||
credentials = this.certificateRepository.getByHolderSerialNumber(ec.getSerialNumber());
|
||||
if (credentials == null || credentials.isEmpty()) {
|
||||
log.warn("No platform credential(s) found");
|
||||
} else {
|
||||
log.debug("Platform Credential(s) found: " + credentials.size());
|
||||
}
|
||||
}
|
||||
|
||||
return credentials;
|
||||
}
|
||||
|
||||
}
|
||||
@ -113,7 +113,7 @@ public class SupplyChainValidationService {
|
||||
// Validate the Endorsement Credential
|
||||
if (getPolicySettings().isEcValidationEnabled()) {
|
||||
log.info("Beginning Endorsement Credential Validation...");
|
||||
validations.add(ValidationManager.evaluateEndorsementCredentialStatus(ec, this.caCredentialRepository, acceptExpiredCerts));
|
||||
validations.add(ValidationService.evaluateEndorsementCredentialStatus(ec, this.caCredentialRepository, acceptExpiredCerts));
|
||||
// store the device with the credential
|
||||
if (ec != null) {
|
||||
ec.setDeviceId(device.getId());
|
||||
@ -131,8 +131,8 @@ public class SupplyChainValidationService {
|
||||
pcErrorMessage = "Platform credential(s) missing\n";
|
||||
} else {
|
||||
for (PlatformCredential pc : pcs) {
|
||||
KeyStore trustedCa = ValidationManager.getCaChain(pc, caCredentialRepository);
|
||||
platformScv = ValidationManager.evaluatePlatformCredentialStatus(
|
||||
KeyStore trustedCa = ValidationService.getCaChain(pc, caCredentialRepository);
|
||||
platformScv = ValidationService.evaluatePlatformCredentialStatus(
|
||||
pc, trustedCa, acceptExpiredCerts);
|
||||
|
||||
if (platformScv.getValidationResult() == AppraisalStatus.Status.FAIL) {
|
||||
@ -147,6 +147,7 @@ public class SupplyChainValidationService {
|
||||
chkDeltas = true;
|
||||
deltaMapping.put(pc, null);
|
||||
}
|
||||
pc.setEndorsementCredential(ec);
|
||||
pc.setDeviceId(device.getId());
|
||||
pc.setDeviceName(device.getDeviceInfo().getNetworkInfo().getHostname());
|
||||
this.certificateRepository.save(pc);
|
||||
@ -196,7 +197,7 @@ public class SupplyChainValidationService {
|
||||
// need to check if there are deltas, if not then just verify
|
||||
// components of the base
|
||||
if (baseCredential == null) {
|
||||
validations.add(ValidationManager.buildValidationRecord(
|
||||
validations.add(ValidationService.buildValidationRecord(
|
||||
SupplyChainValidation.ValidationType.PLATFORM_CREDENTIAL,
|
||||
AppraisalStatus.Status.FAIL,
|
||||
"Base Platform credential missing."
|
||||
@ -209,7 +210,7 @@ public class SupplyChainValidationService {
|
||||
while (it.hasNext()) {
|
||||
PlatformCredential pc = it.next();
|
||||
if (pc != null && !pc.isPlatformBase()) {
|
||||
attributeScv = ValidationManager.evaluateDeltaAttributesStatus(
|
||||
attributeScv = ValidationService.evaluateDeltaAttributesStatus(
|
||||
pc, device.getDeviceInfo(),
|
||||
baseCredential, deltaMapping, certificateRepository);
|
||||
if (attributeScv.getValidationResult() == AppraisalStatus.Status.FAIL) {
|
||||
@ -222,7 +223,7 @@ public class SupplyChainValidationService {
|
||||
aes.add(baseCredential);
|
||||
validations.remove(platformScv);
|
||||
// if there are no deltas, just check base credential
|
||||
platformScv = ValidationManager.evaluatePCAttributesStatus(
|
||||
platformScv = ValidationService.evaluatePCAttributesStatus(
|
||||
baseCredential, device.getDeviceInfo(), ec,
|
||||
certificateRepository, componentResultRepository);
|
||||
validations.add(new SupplyChainValidation(
|
||||
@ -243,7 +244,7 @@ public class SupplyChainValidationService {
|
||||
log.info("Beginning Firmware Validation...");
|
||||
// may need to associated with device to pull the correct info
|
||||
// compare tpm quote with what is pulled from RIM associated file
|
||||
validations.add(ValidationManager.evaluateFirmwareStatus(device, getPolicySettings(),
|
||||
validations.add(ValidationService.evaluateFirmwareStatus(device, getPolicySettings(),
|
||||
referenceManifestRepository, referenceDigestValueRepository,
|
||||
caCredentialRepository));
|
||||
}
|
||||
@ -329,7 +330,7 @@ public class SupplyChainValidationService {
|
||||
log.error(ex);
|
||||
}
|
||||
|
||||
quoteScv = ValidationManager.buildValidationRecord(SupplyChainValidation
|
||||
quoteScv = ValidationService.buildValidationRecord(SupplyChainValidation
|
||||
.ValidationType.FIRMWARE,
|
||||
fwStatus.getAppStatus(), fwStatus.getMessage(), eventLog, level);
|
||||
|
||||
@ -339,7 +340,7 @@ public class SupplyChainValidationService {
|
||||
= this.supplyChainValidationSummaryRepository.findByDevice(deviceName);
|
||||
for (SupplyChainValidation scv : previous.getValidations()) {
|
||||
if (scv.getValidationType() != SupplyChainValidation.ValidationType.FIRMWARE) {
|
||||
validations.add(ValidationManager.buildValidationRecord(scv.getValidationType(),
|
||||
validations.add(ValidationService.buildValidationRecord(scv.getValidationType(),
|
||||
scv.getValidationResult(), scv.getMessage(),
|
||||
scv.getCertificatesUsed().get(0), Level.INFO));
|
||||
}
|
||||
|
||||
@ -38,7 +38,7 @@ import java.util.Map;
|
||||
import java.util.Set;
|
||||
|
||||
@Log4j2
|
||||
public class ValidationManager {
|
||||
public class ValidationService {
|
||||
|
||||
public static SupplyChainValidation evaluateEndorsementCredentialStatus(
|
||||
final EndorsementCredential ec,
|
||||
@ -1,24 +1,21 @@
|
||||
package hirs.attestationca.persist.validation;
|
||||
|
||||
import hirs.attestationca.persist.entity.manager.CACredentialRepository;
|
||||
import hirs.attestationca.persist.entity.manager.CertificateRepository;
|
||||
import hirs.attestationca.persist.entity.manager.ReferenceDigestValueRepository;
|
||||
import hirs.attestationca.persist.entity.manager.ReferenceManifestRepository;
|
||||
import hirs.attestationca.persist.entity.userdefined.Device;
|
||||
import hirs.attestationca.persist.entity.userdefined.PolicySettings;
|
||||
import hirs.attestationca.persist.entity.userdefined.ReferenceManifest;
|
||||
import hirs.attestationca.persist.entity.userdefined.SupplyChainValidation;
|
||||
import hirs.attestationca.persist.entity.userdefined.certificate.CertificateAuthorityCredential;
|
||||
import hirs.attestationca.persist.entity.userdefined.rim.BaseReferenceManifest;
|
||||
import hirs.attestationca.persist.entity.userdefined.rim.EventLogMeasurements;
|
||||
import hirs.attestationca.persist.entity.userdefined.rim.ReferenceDigestValue;
|
||||
import hirs.attestationca.persist.enums.AppraisalStatus;
|
||||
import hirs.attestationca.persist.service.ValidationManager;
|
||||
import hirs.attestationca.persist.service.ValidationService;
|
||||
import hirs.utils.SwidResource;
|
||||
import hirs.utils.tpm.eventlog.TCGEventLog;
|
||||
import hirs.utils.tpm.eventlog.TpmPcrEvent;
|
||||
import lombok.extern.log4j.Log4j2;
|
||||
import org.apache.logging.log4j.Level;
|
||||
|
||||
import java.io.IOException;
|
||||
import java.security.KeyStore;
|
||||
@ -99,7 +96,7 @@ public class FirmwareScvValidator extends SupplyChainCredentialValidator {
|
||||
CertificateAuthorityCredential signingCert = null;
|
||||
for (CertificateAuthorityCredential cert : allCerts) {
|
||||
signingCert = cert;
|
||||
KeyStore keyStore = ValidationManager.getCaChain(signingCert,
|
||||
KeyStore keyStore = ValidationService.getCaChain(signingCert,
|
||||
caCredentialRepository);
|
||||
if (referenceManifestValidator.validateXmlSignature(signingCert)) {
|
||||
try {
|
||||
|
||||
@ -389,14 +389,14 @@ public class CertificatePageController extends PageController<NoPageParams> {
|
||||
for (PlatformCredential pc : sharedCertificates) {
|
||||
if (!pc.isPlatformBase()) {
|
||||
pc.archive();
|
||||
certificateRepository.delete(pc);
|
||||
certificateRepository.save(pc);
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
certificate.archive();
|
||||
certificateRepository.delete(certificate);
|
||||
certificateRepository.save(certificate);
|
||||
|
||||
String deleteCompletedMessage = "Certificate successfully deleted";
|
||||
messages.addInfo(deleteCompletedMessage);
|
||||
|
||||
@ -11,7 +11,7 @@ import hirs.attestationca.persist.entity.userdefined.rim.BaseReferenceManifest;
|
||||
import hirs.attestationca.persist.entity.userdefined.rim.EventLogMeasurements;
|
||||
import hirs.attestationca.persist.entity.userdefined.rim.ReferenceDigestValue;
|
||||
import hirs.attestationca.persist.entity.userdefined.rim.SupportReferenceManifest;
|
||||
import hirs.attestationca.persist.service.ValidationManager;
|
||||
import hirs.attestationca.persist.service.ValidationService;
|
||||
import hirs.attestationca.persist.validation.ReferenceManifestValidator;
|
||||
import hirs.attestationca.persist.validation.SupplyChainCredentialValidator;
|
||||
import hirs.attestationca.persist.validation.SupplyChainValidatorException;
|
||||
@ -298,7 +298,7 @@ public class ReferenceManifestDetailsPageController extends PageController<Refer
|
||||
//Report invalid signature unless RIM_VALIDATOR validates it and cert path is valid
|
||||
data.put("signatureValid", false);
|
||||
for (CertificateAuthorityCredential cert : certificates) {
|
||||
KeyStore keystore = ValidationManager.getCaChain(cert, caCertificateRepository);
|
||||
KeyStore keystore = ValidationService.getCaChain(cert, caCertificateRepository);
|
||||
if (RIM_VALIDATOR.validateXmlSignature(cert)) {
|
||||
try {
|
||||
if (SupplyChainCredentialValidator.verifyCertificate(
|
||||
|
||||
Loading…
x
Reference in New Issue
Block a user