ExternalVendorCode/HIRS
1
0
Fork 0
mirror of https://github.com/nsacyber/HIRS.git synced 2025-01-18 02:39:56 +00:00
Code Issues Actions 6 Packages Projects Releases Wiki Activity

file name refactor

Browse Source
This commit is contained in:
iadgovuser26 2022-01-26 12:08:29 -05:00
parent 1d114490ec
commit 56bf20246f
8 changed files with 46 additions and 52 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
.ci/docker/docker-compose-system-test.yml
View File

@ -9,7 +9,7 @@ services:
ports:
- "${HIRS_ACA_PORTAL_PORT}:${HIRS_ACA_PORTAL_CONTAINER_PORT}"
entrypoint: /bin/bash -c
command: [HIRS/.ci/setup/setup-aca.sh]
command: [HIRS/.ci/setup/setup_aca.sh]
hostname: ${HIRS_ACA_HOSTNAME}
networks:
hirs_aca_system_tests:

0
.ci/setup/setup-aca.sh → .ci/setup/setup_aca.sh
View File

55
.ci/setup/setup-tpm2provisioner.sh → .ci/setup/setup_tpm2provisioner.sh
View File

@ -15,32 +15,32 @@ function installProvisioner {
mkdir -p /HIRS/logs/provisioner/
sh package/package.centos.sh &> /HIRS/logs/provisioner/provisioner_build.log
echo "Installing the HIRS Provisioner ..."
yum install -y package/rpm/RPMS/x86_64/HIRS_Provisioner_TPM_2_0*.el7.x86_64.rpm
popd > /dev/null
yum install -y package/rpm/RPMS/x86_64/HIRS_Provisioner_TPM_2_0*.el7.x86_64.rpm
popd > /dev/null
}
# use ibm tss to properly clear tpm pcr values
function setTpmPcrValues {
mkdir /ibmtss
pushd /ibmtss > /dev/null
echo "Installing IBM TSS to set the TPM simulator intial values correctly..."
wget --no-check-certificate https://downloads.sourceforge.net/project/ibmtpm20tss/ibmtss1.5.0.tar.gz > /dev/null
tar -zxvf ibmtss1.5.0.tar.gz > /dev/null
cd utils
make -f makefiletpmc > /dev/null
cd ../utils
./startup
popd > /dev/null
mkdir /ibmtss
pushd /ibmtss > /dev/null
echo "Installing IBM TSS to set the TPM simulator intial values correctly..."
wget --no-check-certificate https://downloads.sourceforge.net/project/ibmtpm20tss/ibmtss1.5.0.tar.gz > /dev/null
tar -zxvf ibmtss1.5.0.tar.gz > /dev/null
cd utils
make -f makefiletpmc > /dev/null
cd ../utils
./startup
popd > /dev/null
}
# Set default values tcg_boot_properties
function setTcgProperties {
propFile="/etc/hirs/tcg_boot.properties";
propFile="/etc/hirs/tcg_boot.properties";
echo "tcg.rim.dir=/boot/tcg/manifest/rim/" > $propFile;
echo "tcg.swidtag.dir=/boot/tcg/manifest/swidtag/" >> $propFile;
echo "tcg.cert.dir=/boot/tcg/cert/platform/" >> $propFile;
echo "tcg.event.file=/sys/kernel/security/tpm0/binary_bios_measurements" >> $propFile;
echo "tcg.rim.dir=/boot/tcg/manifest/rim/" > $propFile;
echo "tcg.swidtag.dir=/boot/tcg/manifest/swidtag/" >> $propFile;
echo "tcg.cert.dir=/boot/tcg/cert/platform/" >> $propFile;
echo "tcg.event.file=/sys/kernel/security/tpm0/binary_bios_measurements" >> $propFile;
}
# Function to initialize the TPM 2.0 Emulator
@ -144,12 +144,12 @@ DEFAULT_SITE_CONFIG_FILE
function waitForAca {
# Wait for ACA to boot
echo "Waiting for ACA to spin up at address ${HIRS_ACA_PORTAL_IP} on port ${HIRS_ACA_PORTAL_PORT} ..."
until [ "`curl --silent --connect-timeout 1 -I -k https://${HIRS_ACA_PORTAL_IP}:${HIRS_ACA_PORTAL_PORT}/HIRS_AttestationCAPortal | grep '302 Found'`" != "" ]; do
sleep 1;
echo "Waiting for ACA to spin up at address ${HIRS_ACA_PORTAL_IP} on port ${HIRS_ACA_PORTAL_PORT} ..."
until [ "`curl --silent --connect-timeout 1 -I -k https://${HIRS_ACA_PORTAL_IP}:${HIRS_ACA_PORTAL_PORT}/HIRS_AttestationCAPortal | grep '302 Found'`" != "" ]; do
sleep 1;
#echo "Checking on the ACA..."
done
echo "ACA is up!"
done
echo "ACA is up!"
}
#Wait for the ACA to spin up, if it hasnt already
@ -158,14 +158,9 @@ waitForAca
# Install packages
installProvisioner
# Test to see if provisioner config were set up
echo "TPM2 Provisioner container running:"
echo "Contents of /etc/hirs is $(ls -al /etc/hirs)";
# set location of tcg artifacts
setTcgProperties
echo "TPM2 Provisioner container running:"
echo "Contents of /etc/hirs is $(ls -al /etc/hirs)";
#echo "Contents of /etc/hirs is $(ls -al /etc/hirs)";
# Install TPM 2.0 Emulator
initTpm2Emulator
@ -179,4 +174,4 @@ tpm2_nvlist
echo ""
echo "===========HIRS ACA TPM 2.0 Provisioner Setup Complete!==========="
popd
popd > /dev/null

0
.ci/setup/setup-tpmprovisioner.sh → .ci/setup/setup_tpmprovisioner.sh
View File

28
.ci/system-tests/aca_policy_tests.sh
View File

@ -10,37 +10,37 @@ failedTests=0;
# Start ACA Policy Tests
# provision_tpm takes 1 parameter (the expected result): "pass" or "fail"
write_to_logs "### ACA POLICY TEST 1: Test ACA default policy ###"
writeToLogs "### ACA POLICY TEST 1: Test ACA default policy ###"
setPlatformCerts "laptop" "empty"
provision_tpm2 "pass"
provisionTpm2 "pass"
write_to_logs "### ACA POLICY TEST 2: Test EK cert Only Validation Policy without a EK Issuer Cert in the trust store ###"
writeToLogs "### ACA POLICY TEST 2: Test EK cert Only Validation Policy without a EK Issuer Cert in the trust store ###"
setPolicyEkOnly
provision_tpm2 "fail"
provisionTpm2 "fail"
write_to_logs "### ACA POLICY TEST 3: Test EK Only Validation Policy ###"
writeToLogs "### ACA POLICY TEST 3: Test EK Only Validation Policy ###"
uploadTrustedCerts
provision_tpm2 "pass"
provisionTpm2 "pass"
write_to_logs "### ACA POLICY TEST 4: Test PC Validation Policy with no PC ###"
writeToLogs "### ACA POLICY TEST 4: Test PC Validation Policy with no PC ###"
setPolicyEkPc_noAttCheck
provision_tpm2 "fail"
provisionTpm2 "fail"
write_to_logs "### ACA POLICY TEST 5: Test FW and PC Validation Policy with no PC ###"
writeToLogs "### ACA POLICY TEST 5: Test FW and PC Validation Policy with no PC ###"
setPolicyEkPcFw
provision_tpm2 "fail"
provisionTpm2 "fail"
write_to_logs "### ACA POLICY TEST 6: Test PC Validation Policy with valid PC ###"
writeToLogs "### ACA POLICY TEST 6: Test PC Validation Policy with valid PC ###"
clearAcaDb
setPolicyEkPc
uploadTrustedCerts
setPlatformCerts "laptop" "default"
provision_tpm2 "pass"
provisionTpm2 "pass"
write_to_logs "### ACA POLICY TEST 7: Test PC with RIM Validation Policy with valid PC and RIM ###"
writeToLogs "### ACA POLICY TEST 7: Test PC with RIM Validation Policy with valid PC and RIM ###"
setPolicyEkPcFw
setRims "laptop" "default"
provision_tpm2 "pass"
provisionTpm2 "pass"
# Process Test Results, any single failure will send back a failed result.
if [[ $failedTests != 0 ]]; then

3
.ci/system-tests/run-system-tests.sh → .ci/system-tests/run_system_tests.sh
View File

@ -31,7 +31,7 @@ echo "ACA Container info: $(checkContainerStatus $aca_container)";
echo "TPM2 Provisioner Container info: $(checkContainerStatus $tpm2_container)";
# Install HIRS provioner and setup tpm2 emulator
docker exec $tpm2_container /HIRS/.ci/setup/setup-tpm2provisioner.sh
docker exec $tpm2_container /HIRS/.ci/setup/setup_tpm2provisioner.sh
# ********* Execute system tests here, add tests as needed *************
echo "******** Setup Complete Begin HIRS System Tests ******** "
@ -53,7 +53,6 @@ docker exec $tpm2_container chmod -R 777 /HIRS/logs/;
# Display container log
echo ""
echo "===========HIRS Tests and Log collection complete ==========="
#docker logs $tpm2_container_id
echo ""
echo "End of System Tests for TPM 2.0, cleaning up..."

4
.ci/system-tests/sys_test_common.sh
View File

@ -73,7 +73,7 @@ popd > /dev/null
# provision_tpm2 takes one parameter which is the expected result of the provion: "pass" or "fail"
# updates totalTests and failedTests counts
# provision_tpm2 <expected_results>
provision_tpm2() {
provisionTpm2() {
expected_result=$1
((totalTests++))
provisionOutput=$(docker exec $tpm2_container tpm_aca_provision);
@ -114,7 +114,7 @@ docker exec $tpm2_container sh /HIRS/.ci/system-tests/container/rim_setup.sh $1
# Writes to the Action ouput, ACA log, and Provisioner Log
# Used for marking the start of system tests and noting the result
# write_to_logs <log statement>
write_to_logs() {
writeTologs() {
line=$1
echo $line;
docker exec $aca_container sh -c "echo '$line' >> /var/log/tomcat/HIRS_AttestationCA.log"

6
.github/workflows/system_test.yml vendored
View File

@ -29,7 +29,7 @@ jobs:
run: |
sudo apt-get install -y curl
echo ${{ secrets.DOCKER_HUB_ACCESS_TOKEN }} | docker login -u ${{ secrets.DOCKER_HUB_USERNAME }} --password-stdin
bash .ci/system-tests/run-system-tests.sh
bash .ci/system-tests/run_system_tests.sh
- name: Archive System Test Log files
uses: actions/upload-artifact@v2
with:
@ -42,5 +42,5 @@ jobs:
if [ ${TEST_STATUS} == "0" ]; then
exit 0;
else
exit 1;
fi
exit 1;
fi