ExternalVendorCode/HIRS
1
0
Fork 0
mirror of https://github.com/nsacyber/HIRS.git synced 2025-01-18 02:39:56 +00:00
Code Issues Actions 6 Packages Projects Releases Wiki Activity

Merge pull request #417 from nsacyber/issue-404

Browse Source 
[#404] PXE Policy options
This commit is contained in:
Cyrus 2021-11-10 10:05:52 -05:00 committed by GitHub
commit 70d92c4b38
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
6 changed files with 207 additions and 14 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
HIRS_AttestationCA/src/main/java/hirs/attestationca/service/SupplyChainValidationServiceImpl.java
View File

@ -543,11 +543,8 @@ public class SupplyChainValidationServiceImpl implements SupplyChainValidationSe
eventValueMap.put(rdv.getDigestValue(), rdv);
}
for (TpmPcrEvent tpe : tcgMeasurementLog.getEventList()) {
if (!eventValueMap.containsKey(tpe.getEventDigestStr())) {
tpmPcrEvents.add(tpe);
}
}
tpmPcrEvents.addAll(pcrPolicy.validateTpmEvents(
tcgMeasurementLog, eventValueMap));
}
} catch (CertificateException cEx) {
LOGGER.error(cEx);
@ -579,14 +576,15 @@ public class SupplyChainValidationServiceImpl implements SupplyChainValidationSe
fwStatus = new AppraisalStatus(FAIL, "The RIM baseline could not be found.");
}
}
EventLogMeasurements eventLog = (EventLogMeasurements) measurement;
eventLog.setOverallValidationResult(fwStatus.getAppStatus());
this.referenceManifestManager.update(eventLog);
} else {
fwStatus = new AppraisalStatus(FAIL, String.format("Firmware Validation failed: "
+ "%s for %s can not be found", failedString, manufacturer));
}
EventLogMeasurements eventLog = (EventLogMeasurements) measurement;
eventLog.setOverallValidationResult(fwStatus.getAppStatus());
this.referenceManifestManager.update(eventLog);
return buildValidationRecord(SupplyChainValidation.ValidationType.FIRMWARE,
fwStatus.getAppStatus(), fwStatus.getMessage(), validationObject, level);
}

39
HIRS_AttestationCAPortal/src/main/java/hirs/attestationca/portal/model/PolicyPageModel.java
View File

@ -20,6 +20,7 @@ public class PolicyPageModel {
private boolean enableIgnoreIma;
private boolean enableIgnoreTboot;
private boolean enableIgnoreGpt;
private boolean enableIgnoreOsEvt;
// Variables to get policy settings from page
private String pcValidate;
@ -36,6 +37,7 @@ public class PolicyPageModel {
private String ignoreIma;
private String ignoretBoot;
private String ignoreGpt;
private String ignoreOsEvt;
private String expirationValue;
private String devIdExpirationValue;
private String thresholdValue;
@ -60,6 +62,7 @@ public class PolicyPageModel {
this.enableIgnoreIma = policy.isIgnoreImaEnabled();
this.enableIgnoreTboot = policy.isIgnoreTbootEnabled();
this.enableIgnoreGpt = policy.isIgnoreGptEnabled();
this.enableIgnoreOsEvt = policy.isIgnoreOsEvtEnabled();
this.expirationValue = policy.getValidityDays();
this.thresholdValue = policy.getReissueThreshold();
this.devIdExpirationValue = policy.getDevIdValidityDays();
@ -160,6 +163,14 @@ public class PolicyPageModel {
return enableIgnoreGpt;
}
/**
* Gets the Enable Ignore Os Events state.
* @return the validation state.
*/
public boolean getEnableIgnoreOsEvt() {
return enableIgnoreOsEvt;
}
/**
* Gets the EC Validation value.
*
@ -268,6 +279,15 @@ public class PolicyPageModel {
return ignoreGpt;
}
/**
* Gets the Ignore Os Evt validation value.
*
* @return the model string representation of this field (checked or unchecked)
*/
public String getIgnoreOsEvt() {
return ignoreOsEvt;
}
/**
* Sets the EC Validation state.
*
@ -359,6 +379,15 @@ public class PolicyPageModel {
this.enableIgnoreGpt = enableIgnoreGpt;
}
/**
* Sets the Enable Ignore Os Events state.
*
* @param enableIgnoreOsEvt true if performing validation, false otherwise
*/
public void setEnableIgnoreOsEvt(final boolean enableIgnoreOsEvt) {
this.enableIgnoreOsEvt = enableIgnoreOsEvt;
}
/**
* Sets the Platform Certificate Validation state.
*
@ -497,6 +526,15 @@ public class PolicyPageModel {
this.ignoreGpt = ignoreGpt;
}
/**
* Sets the Ignore Os Events state.
*
* @param ignoreOsEvt "checked" if enabling validation, false otherwise
*/
public void setIgnoreOsEvt(final String ignoreOsEvt) {
this.ignoreOsEvt = ignoreOsEvt;
}
/**
* Getter for the expiration value.
* @return the value
@ -577,6 +615,7 @@ public class PolicyPageModel {
+ ", enableIgnoreIma=" + enableIgnoreIma
+ ", enableIgnoreTboot=" + enableIgnoreTboot
+ ", enableIgnoreGpt=" + enableIgnoreGpt
+ ", enableIgnoreOsEvt=" + enableIgnoreOsEvt
+ ", expirationValue=" + expirationValue
+ ", thresholdValue=" + thresholdValue
+ ", devIdExpirationValue=" + devIdExpirationValue

58
HIRS_AttestationCAPortal/src/main/java/hirs/attestationca/portal/page/controllers/PolicyPageController.java
View File

@ -90,7 +90,6 @@ public class PolicyPageController extends PageController<NoPageParams> {
ModelAndView mav = getBaseModelAndView();
SupplyChainPolicy policy = getDefaultPolicy();
PolicyPageModel pageModel = new PolicyPageModel(policy);
mav.addObject(INITIAL_DATA, pageModel);
@ -662,6 +661,7 @@ public class PolicyPageController extends PageController<NoPageParams> {
policy.setFirmwareValidationEnabled(false);
policy.getPcrPolicy().setEnableIgnoreIma(false);
policy.getPcrPolicy().setEnableIgnoretBoot(false);
policy.setIgnoreOsEvtEnabled(false);
successMessage = "Firmware validation disabled";
}
@ -805,7 +805,7 @@ public class PolicyPageController extends PageController<NoPageParams> {
//If Ignore TBoot is enabled without firmware, disallow change
if (ignoreGptOptionEnabled && !policy.isFirmwareValidationEnabled()) {
handleUserError(model, messages,
"Ignore TBoot can not be "
"Ignore GPT Events can not be "
+ "enabled without Firmware Validation policy enabled.");
return redirectToSelf(new NoPageParams(), model, attr);
}
@ -830,6 +830,60 @@ public class PolicyPageController extends PageController<NoPageParams> {
return redirectToSelf(new NoPageParams(), model, attr);
}
/**
* Updates the ignore Os Events policy setting and
* redirects back to the original page.
*
* @param ppModel The data posted by the form mapped into an object.
* @param attr RedirectAttributes used to forward data back to the original
* page.
* @return View containing the url and parameters
* @throws URISyntaxException if malformed URI
*/
@RequestMapping(value = "update-os-evt-ignore", method = RequestMethod.POST)
public RedirectView updateIgnoreOsEvents(
@ModelAttribute final PolicyPageModel ppModel,
final RedirectAttributes attr)
throws URISyntaxException {
// set the data received to be populated back into the form
Map<String, Object> model = new HashMap<>();
PageMessages messages = new PageMessages();
String successMessage;
boolean ignoreOsEvtOptionEnabled = ppModel.getIgnoreOsEvt()
.equalsIgnoreCase(ENABLED_CHECKED_PARAMETER_VALUE);
try {
SupplyChainPolicy policy = getDefaultPolicyAndSetInModel(ppModel, model);
//If Ignore TBoot is enabled without firmware, disallow change
if (ignoreOsEvtOptionEnabled && !policy.isFirmwareValidationEnabled()) {
handleUserError(model, messages,
"Ignore Os Events can not be "
+ "enabled without Firmware Validation policy enabled.");
return redirectToSelf(new NoPageParams(), model, attr);
}
// set the policy option and create success message
if (ignoreOsEvtOptionEnabled) {
policy.getPcrPolicy().setEnableIgnoreOsEvt(true);
policy.getPcrPolicy().setEnableIgnoreGpt(true);
successMessage = "Ignore OS Events enabled";
} else {
policy.getPcrPolicy().setEnableIgnoreOsEvt(false);
successMessage = "Ignore OS Events disabled";
}
savePolicyAndApplySuccessMessage(ppModel, model, messages, successMessage, policy);
} catch (PolicyManagerException e) {
handlePolicyManagerUpdateError(model, messages, e,
"Error changing ACA OS Events ignore policy",
"Error updating policy. \n" + e.getMessage());
}
// return the redirect
return redirectToSelf(new NoPageParams(), model, attr);
}
private void handlePolicyManagerUpdateError(final Map<String, Object> model,
final PageMessages messages,
final PolicyManagerException e,

14
HIRS_AttestationCAPortal/src/main/webapp/WEB-INF/jsp/policy.jsp
View File

@ -107,7 +107,19 @@
<label><input id="gptTop" type="radio" name="ignoreGpt" ${initialData.enableIgnoreGpt ? 'checked' : ''} value="checked"/> Ignore GPT enabled</label>
</div>
<div class="radio">
<label><input id="gptBot" type="radio" name="ignoreGpt" ${initialData.enableIgnoreGpt ? '' : 'checked'} value="unchecked"/> Ignore GPT disabled</label>
<label><input id="gptBot" type="radio" name="ignoreGpt" ${initialData.enableIgnoreGpt ? '' : 'checked'} value="unchecked"/> Ignore GPT disabled</label>
</div>
</my:editor>
</li>
</form:form>
<form:form method="POST" modelAttribute="initialData" action="policy/update-os-evt-ignore">
<li>Ignore OS Events: ${initialData.enableIgnoreOsEvt ? 'Enabled' : 'Disabled'}
<my:editor id="ignoreOsEvtPolicyEditor" label="Edit Settings">
<div class="radio">
<label><input id="osTop" type="radio" name="ignoreOsEvt" ${initialData.enableIgnoreOsEvt ? 'checked' : ''} value="checked"/> Ignore Os Events enabled</label>
</div>
<div class="radio">
<label><input id="osBot" type="radio" name="ignoreOsEvt" ${initialData.enableIgnoreOsEvt ? '' : 'checked'} value="unchecked"/> Ignore Os Events disabled</label>
</div>
</my:editor>
</li>

79
HIRS_Utils/src/main/java/hirs/data/persist/PCRPolicy.java
View File

@ -3,6 +3,8 @@ package hirs.data.persist;
import hirs.data.persist.tpm.PcrComposite;
import hirs.data.persist.tpm.PcrInfoShort;
import hirs.data.persist.tpm.PcrSelection;
import hirs.tpm.eventlog.TCGEventLog;
import hirs.tpm.eventlog.TpmPcrEvent;
import org.apache.commons.codec.DecoderException;
import org.apache.commons.codec.binary.Hex;
import org.apache.logging.log4j.Logger;
@ -12,6 +14,9 @@ import javax.persistence.Entity;
import java.nio.charset.StandardCharsets;
import java.security.NoSuchAlgorithmException;
import java.util.Arrays;
import java.util.LinkedList;
import java.util.List;
import java.util.Map;
import static org.apache.logging.log4j.LogManager.getLogger;
@ -24,14 +29,24 @@ public final class PCRPolicy extends Policy {
private static final Logger LOGGER = getLogger(PCRPolicy.class);
private static final int NUM_TO_SKIP = 1;
private static final int NUM_OF_TBOOT_PCR = 3;
// PCR 5-16
private static final int PXE_PCR_START = 5;
private static final int PXE_PCR_END = 16;
// PCR 10
private static final int IMA_PCR = 10;
// PCR 17-19
private static final int TBOOT_PCR = 17;
private static final int NUM_OF_TBOOT_PCR = 3;
private static final int TBOOT_PCR_START = 17;
private static final int TBOOT_PCR_END = 19;
// PCR 5
private static final int GPT_PCR = 5;
// Event Log Event Types
private static final String EVT_EFI_BOOT = "EV_EFI_BOOT_SERVICES_APPLICATION";
private static final String EVT_EFI_VAR = "EV_EFI_VARIABLE_BOOT";
private static final String EVT_EFI_GPT = "EV_EFI_GPT_EVENT";
private static final String EVT_EFI_CFG = "EV_EFI_VARIABLE_DRIVER_CONFIG";
@Column(nullable = false)
private boolean enableIgnoreIma = false;
@Column(nullable = false)
@ -40,6 +55,8 @@ public final class PCRPolicy extends Policy {
private boolean linuxOs = false;
@Column(nullable = false)
private boolean enableIgnoreGpt = true;
@Column(nullable = false)
private boolean enableIgnoreOsEvt = false;
private String[] baselinePcrs;
@ -81,7 +98,7 @@ public final class PCRPolicy extends Policy {
i += NUM_TO_SKIP;
}
if (enableIgnoretBoot && i == TBOOT_PCR) {
if (enableIgnoretBoot && i == TBOOT_PCR_START) {
LOGGER.info("PCR Policy TBoot Ignore enabled.");
i += NUM_OF_TBOOT_PCR;
}
@ -101,6 +118,45 @@ public final class PCRPolicy extends Policy {
return sb;
}
/**
* Checks that the expected FM events occurring. There are policy options that
* will ignore certin PCRs, Event Types and Event Variables present.
* @param tcgMeasurementLog Measurement log from the client
* @param eventValueMap The events stored as baseline to compare
* @return the events that didn't pass
*/
public List<TpmPcrEvent> validateTpmEvents(final TCGEventLog tcgMeasurementLog,
final Map<String, ReferenceDigestValue> eventValueMap) {
List<TpmPcrEvent> tpmPcrEvents = new LinkedList<>();
for (TpmPcrEvent tpe : tcgMeasurementLog.getEventList()) {
if (enableIgnoreIma && tpe.getPcrIndex() == IMA_PCR) {
LOGGER.info(String.format("IMA Ignored -> %s", tpe));
} else if (enableIgnoretBoot && (tpe.getPcrIndex() >= TBOOT_PCR_START
&& tpe.getPcrIndex() <= TBOOT_PCR_END)) {
LOGGER.info(String.format("TBOOT Ignored -> %s", tpe));
} else if (enableIgnoreOsEvt && (tpe.getPcrIndex() >= PXE_PCR_START
&& tpe.getPcrIndex() <= PXE_PCR_END)) {
LOGGER.info(String.format("OS Evt Ignored -> %s", tpe));
} else {
if (enableIgnoreGpt && tpe.getEventTypeStr().contains(EVT_EFI_GPT)) {
LOGGER.info(String.format("GPT Ignored -> %s", tpe));
} else if (enableIgnoreOsEvt && (tpe.getEventTypeStr().contains(EVT_EFI_BOOT)
|| tpe.getEventTypeStr().contains(EVT_EFI_VAR))) {
LOGGER.info(String.format("OS Evt Ignored -> %s", tpe));
} else if (enableIgnoreOsEvt && (tpe.getEventTypeStr().contains(EVT_EFI_CFG)
&& tpe.getEventContentStr().contains("SecureBoot"))) {
LOGGER.info(String.format("OS Evt Config Ignored -> %s", tpe));
} else {
if (!eventValueMap.containsKey(tpe.getEventDigestStr())) {
tpmPcrEvents.add(tpe);
}
}
}
}
return tpmPcrEvents;
}
/**
* Compares hashs to validate the quote from the client.
*
@ -122,6 +178,7 @@ public final class PCRPolicy extends Policy {
} catch (DecoderException deEx) {
LOGGER.error(deEx);
}
PcrSelection pcrSelection = new PcrSelection(PcrSelection.ALL_PCRS_ON);
PcrComposite pcrComposite = new PcrComposite(
pcrSelection,
@ -211,6 +268,22 @@ public final class PCRPolicy extends Policy {
this.enableIgnoreGpt = enableIgnoreGpt;
}
/**
* Getter for the Os Events ignore flag.
* @return true if Os Events is to be ignored.
*/
public boolean isEnableIgnoreOsEvt() {
return enableIgnoreOsEvt;
}
/**
* Setter for the Os Evt ignore flag.
* @param enableIgnoreOsEvt true if Os Evt is to be ignored.
*/
public void setEnableIgnoreOsEvt(final boolean enableIgnoreOsEvt) {
this.enableIgnoreOsEvt = enableIgnoreOsEvt;
}
/**
* Getter for a flag to indicate the type of OS.
* @return true if the system is linux.

17
HIRS_Utils/src/main/java/hirs/data/persist/SupplyChainPolicy.java
View File

@ -226,6 +226,15 @@ public class SupplyChainPolicy extends Policy {
return this.pcrPolicy.isEnableIgnoreGpt();
}
/**
* Returns whether or not to validate the ignore Os Events on the device.
*
* @return whether or not to validate the ignore Os Events
*/
public boolean isIgnoreOsEvtEnabled() {
return this.pcrPolicy.isEnableIgnoreOsEvt();
}
/**
* Sets whether or not validate the ignore GPT on the device.
* @param enableIgnoreGpt whether or not to validate the ignore GPT
@ -234,6 +243,14 @@ public class SupplyChainPolicy extends Policy {
this.pcrPolicy.setEnableIgnoreGpt(enableIgnoreGpt);
}
/**
* Sets whether or not validate the ignore Os Events on the device.
* @param enableIgnoreOsEvt whether or not to validate the ignore Os Events
*/
public void setIgnoreOsEvtEnabled(final boolean enableIgnoreOsEvt) {
this.pcrPolicy.setEnableIgnoreOsEvt(enableIgnoreOsEvt);
}
/**
* Returns whether or not to allow expired credentials and certificates to be considered
* valid if their supply chain is otherwise verified.