@@ -633,6 +634,9 @@
Platform Components
+
+
+
diff --git a/HIRS_AttestationCAPortal/src/main/webapp/common/certificate_details.css b/HIRS_AttestationCAPortal/src/main/webapp/common/certificate_details.css
index 5cafa466..40b707a7 100644
--- a/HIRS_AttestationCAPortal/src/main/webapp/common/certificate_details.css
+++ b/HIRS_AttestationCAPortal/src/main/webapp/common/certificate_details.css
@@ -63,4 +63,31 @@
margin: 4px 2px;
cursor: pointer;
border-radius: 2px;
+}
+
+/* Tooltip container */
+.tooltip {
+ position: relative;
+ display: inline-block;
+ border-bottom: 1px dotted black; /* If you want dots under the hoverable text */
+}
+
+/* Tooltip text */
+.tooltip .tooltiptext {
+ visibility: hidden;
+ width: 120px;
+ background-color: black;
+ color: #fff;
+ text-align: center;
+ padding: 5px 0;
+ border-radius: 6px;
+
+ /* Position the tooltip text - see examples below! */
+ position: absolute;
+ z-index: 1;
+}
+
+/* Show the tooltip text when you mouse over the tooltip container */
+.tooltip:hover .tooltiptext {
+ visibility: visible;
}
\ No newline at end of file
diff --git a/HIRS_Utils/src/main/java/hirs/data/persist/certificate/PlatformCredential.java b/HIRS_Utils/src/main/java/hirs/data/persist/certificate/PlatformCredential.java
index 9dd07a52..a639367d 100644
--- a/HIRS_Utils/src/main/java/hirs/data/persist/certificate/PlatformCredential.java
+++ b/HIRS_Utils/src/main/java/hirs/data/persist/certificate/PlatformCredential.java
@@ -255,6 +255,8 @@ public class PlatformCredential extends DeviceAssociatedCertificate {
@Column(length = MAX_MESSAGE_LENGTH)
private String componentFailures = Strings.EMPTY;
+ @Column(length = MAX_MESSAGE_LENGTH)
+ private String componentFailureMessage = Strings.EMPTY;
@Transient
private EndorsementCredential endorsementCredential = null;
@@ -736,6 +738,22 @@ public class PlatformCredential extends DeviceAssociatedCertificate {
this.componentFailures = componentFailures;
}
+ /**
+ * Getter for the component failures message.
+ * @return string of failures.
+ */
+ public String getComponentFailureMessage() {
+ return componentFailureMessage;
+ }
+
+ /**
+ * Setter for the component failure message instance.
+ * @param componentFailureMessage a string of failures.
+ */
+ public void setComponentFailureMessage(final String componentFailureMessage) {
+ this.componentFailureMessage = componentFailureMessage;
+ }
+
/**
* Get the Platform Configuration Attribute from the Platform Certificate.
* @return a map with all the attributes
From 1adedfefe1c76db4bb22875fcabed5570858c409 Mon Sep 17 00:00:00 2001
From: Cyrus <24922493+cyrus-dev@users.noreply.github.com>
Date: Fri, 31 Mar 2023 10:16:30 -0400
Subject: [PATCH 02/15] Added missing 'does NOT' to the even summary page [no
ci]
---
.../src/main/webapp/WEB-INF/jsp/rim-details.jsp | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/HIRS_AttestationCAPortal/src/main/webapp/WEB-INF/jsp/rim-details.jsp b/HIRS_AttestationCAPortal/src/main/webapp/WEB-INF/jsp/rim-details.jsp
index e4503d4c..ad100208 100644
--- a/HIRS_AttestationCAPortal/src/main/webapp/WEB-INF/jsp/rim-details.jsp
+++ b/HIRS_AttestationCAPortal/src/main/webapp/WEB-INF/jsp/rim-details.jsp
@@ -161,10 +161,10 @@
- - This Support RIM file covers the following critical items:
+ - This Support RIM file does NOT covers the following critical items:
- - This Event Log file covers the following critical items:
+ - This Event Log file does NOT covers the following critical items:
From fe5a509f9aee3f3357cb29b5b1ef1fa5d04583b2 Mon Sep 17 00:00:00 2001
From: Cyrus <24922493+cyrus-dev@users.noreply.github.com>
Date: Fri, 31 Mar 2023 10:43:36 -0400
Subject: [PATCH 03/15] Added additional check for crtm for the event summary
section of the support rim details page using EV_EFI_PLATFORM_FIRMWARE_BLOB
---
.../controllers/ReferenceManifestDetailsPageController.java | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/HIRS_AttestationCAPortal/src/main/java/hirs/attestationca/portal/page/controllers/ReferenceManifestDetailsPageController.java b/HIRS_AttestationCAPortal/src/main/java/hirs/attestationca/portal/page/controllers/ReferenceManifestDetailsPageController.java
index 83365ca2..6b27e9f6 100644
--- a/HIRS_AttestationCAPortal/src/main/java/hirs/attestationca/portal/page/controllers/ReferenceManifestDetailsPageController.java
+++ b/HIRS_AttestationCAPortal/src/main/java/hirs/attestationca/portal/page/controllers/ReferenceManifestDetailsPageController.java
@@ -442,7 +442,8 @@ public class ReferenceManifestDetailsPageController
for (TpmPcrEvent tpe : eventList) {
contentStr = tpe.getEventContentStr();
// check for specific events
- if (contentStr.contains("CRTM")) {
+ if (contentStr.contains("CRTM")
+ || tpe.getEventTypeStr().contains("EV_EFI_PLATFORM_FIRMWARE_BLOB")) {
crtm = true;
} else if (contentStr.contains("shimx64.efi")
|| contentStr.contains("bootmgfw.efi")) {
From 3fb3cf7669f183d0eb645b034176ed05b561adf2 Mon Sep 17 00:00:00 2001
From: Cyrus <24922493+cyrus-dev@users.noreply.github.com>
Date: Thu, 6 Apr 2023 09:15:12 -0400
Subject: [PATCH 04/15] This set up code begins the setup of adding information
to the component result. However this is thought to putting this stuff in a
report or separate page like the RIM event log page does. [no ci]
---
...stractAttestationCertificateAuthority.java | 5 +
.../SupplyChainValidationServiceImpl.java | 4 +
...ctAttestationCertificateAuthorityTest.java | 2 +-
.../SupplyChainValidationServiceImplTest.java | 11 ++
.../CertificateDetailsPageController.java | 9 +-
.../util/CertificateStringMapBuilder.java | 5 +-
.../main/webapp/WEB-INF/jsp/rim-details.jsp | 4 +-
.../persist/certificate/ComponentResult.java | 111 ++++++++++++
.../hirs/persist/ComponentResultManager.java | 61 +++++++
.../persist/DBComponentResultManager.java | 163 ++++++++++++++++++
.../hirs/persist/DBReferenceEventManager.java | 2 +-
.../persist/PersistenceConfiguration.java | 12 ++
.../SupplyChainCredentialValidator.java | 42 +++--
.../SupplyChainCredentialValidatorTest.java | 9 +-
14 files changed, 417 insertions(+), 23 deletions(-)
create mode 100644 HIRS_Utils/src/main/java/hirs/data/persist/certificate/ComponentResult.java
create mode 100644 HIRS_Utils/src/main/java/hirs/persist/ComponentResultManager.java
create mode 100644 HIRS_Utils/src/main/java/hirs/persist/DBComponentResultManager.java
diff --git a/HIRS_AttestationCA/src/main/java/hirs/attestationca/AbstractAttestationCertificateAuthority.java b/HIRS_AttestationCA/src/main/java/hirs/attestationca/AbstractAttestationCertificateAuthority.java
index a492997b..26a09332 100644
--- a/HIRS_AttestationCA/src/main/java/hirs/attestationca/AbstractAttestationCertificateAuthority.java
+++ b/HIRS_AttestationCA/src/main/java/hirs/attestationca/AbstractAttestationCertificateAuthority.java
@@ -29,6 +29,7 @@ import hirs.data.persist.info.OSInfo;
import hirs.data.persist.info.TPMInfo;
import hirs.data.service.DeviceRegister;
import hirs.persist.CertificateManager;
+import hirs.persist.ComponentResultManager;
import hirs.persist.DBManager;
import hirs.persist.DeviceManager;
import hirs.persist.ReferenceDigestManager;
@@ -176,6 +177,7 @@ public abstract class AbstractAttestationCertificateAuthority
*/
private Integer validDays = 1;
+ private final ComponentResultManager componentResultManager;
private final CertificateManager certificateManager;
private final ReferenceManifestManager referenceManifestManager;
private final DeviceRegister deviceRegister;
@@ -192,6 +194,7 @@ public abstract class AbstractAttestationCertificateAuthority
* @param privateKey the ACA private key
* @param acaCertificate the ACA certificate
* @param structConverter the struct converter
+ * @param componentResultManager the component result manager
* @param certificateManager the certificate manager
* @param referenceManifestManager the Reference Manifest manager
* @param deviceRegister the device register
@@ -206,6 +209,7 @@ public abstract class AbstractAttestationCertificateAuthority
final SupplyChainValidationService supplyChainValidationService,
final PrivateKey privateKey, final X509Certificate acaCertificate,
final StructConverter structConverter,
+ final ComponentResultManager componentResultManager,
final CertificateManager certificateManager,
final ReferenceManifestManager referenceManifestManager,
final DeviceRegister deviceRegister, final int validDays,
@@ -217,6 +221,7 @@ public abstract class AbstractAttestationCertificateAuthority
this.privateKey = privateKey;
this.acaCertificate = acaCertificate;
this.structConverter = structConverter;
+ this.componentResultManager = componentResultManager;
this.certificateManager = certificateManager;
this.referenceManifestManager = referenceManifestManager;
this.deviceRegister = deviceRegister;
diff --git a/HIRS_AttestationCA/src/main/java/hirs/attestationca/service/SupplyChainValidationServiceImpl.java b/HIRS_AttestationCA/src/main/java/hirs/attestationca/service/SupplyChainValidationServiceImpl.java
index 31a25e69..c36dc763 100644
--- a/HIRS_AttestationCA/src/main/java/hirs/attestationca/service/SupplyChainValidationServiceImpl.java
+++ b/HIRS_AttestationCA/src/main/java/hirs/attestationca/service/SupplyChainValidationServiceImpl.java
@@ -23,6 +23,7 @@ import hirs.data.persist.certificate.EndorsementCredential;
import hirs.data.persist.certificate.PlatformCredential;
import hirs.persist.AppraiserManager;
import hirs.persist.CertificateManager;
+import hirs.persist.ComponentResultManager;
import hirs.persist.CrudManager;
import hirs.persist.DBManagerException;
import hirs.persist.PersistenceConfiguration;
@@ -82,6 +83,7 @@ public class SupplyChainValidationServiceImpl implements SupplyChainValidationSe
private ReferenceDigestManager referenceDigestManager;
private ReferenceEventManager referenceEventManager;
private CertificateManager certificateManager;
+ private ComponentResultManager componentResultManager;
private CredentialValidator supplyChainCredentialValidator;
private CrudManager supplyChainValidatorSummaryManager;
@@ -115,6 +117,7 @@ public class SupplyChainValidationServiceImpl implements SupplyChainValidationSe
public SupplyChainValidationServiceImpl(
final PolicyManager policyManager, final AppraiserManager appraiserManager,
final CertificateManager certificateManager,
+ final ComponentResultManager componentResultManager,
final ReferenceManifestManager referenceManifestManager,
final CrudManager supplyChainValidatorSummaryManager,
final CredentialValidator supplyChainCredentialValidator,
@@ -123,6 +126,7 @@ public class SupplyChainValidationServiceImpl implements SupplyChainValidationSe
this.policyManager = policyManager;
this.appraiserManager = appraiserManager;
this.certificateManager = certificateManager;
+ this.componentResultManager = componentResultManager;
this.referenceManifestManager = referenceManifestManager;
this.supplyChainValidatorSummaryManager = supplyChainValidatorSummaryManager;
this.supplyChainCredentialValidator = supplyChainCredentialValidator;
diff --git a/HIRS_AttestationCA/src/test/java/hirs/attestationca/AbstractAttestationCertificateAuthorityTest.java b/HIRS_AttestationCA/src/test/java/hirs/attestationca/AbstractAttestationCertificateAuthorityTest.java
index d51547a0..10422069 100644
--- a/HIRS_AttestationCA/src/test/java/hirs/attestationca/AbstractAttestationCertificateAuthorityTest.java
+++ b/HIRS_AttestationCA/src/test/java/hirs/attestationca/AbstractAttestationCertificateAuthorityTest.java
@@ -131,7 +131,7 @@ public class AbstractAttestationCertificateAuthorityTest {
@BeforeTest
public void setup() {
aca = new AbstractAttestationCertificateAuthority(null, keyPair.getPrivate(),
- null, null, null, null, null, 1,
+ null, null, null, null, null, null, 1,
null, null, null, null) {
};
}
diff --git a/HIRS_AttestationCA/src/test/java/hirs/attestationca/service/SupplyChainValidationServiceImplTest.java b/HIRS_AttestationCA/src/test/java/hirs/attestationca/service/SupplyChainValidationServiceImplTest.java
index b716de05..7538decd 100644
--- a/HIRS_AttestationCA/src/test/java/hirs/attestationca/service/SupplyChainValidationServiceImplTest.java
+++ b/HIRS_AttestationCA/src/test/java/hirs/attestationca/service/SupplyChainValidationServiceImplTest.java
@@ -16,6 +16,7 @@ import hirs.data.persist.certificate.EndorsementCredential;
import hirs.data.persist.certificate.PlatformCredential;
import hirs.persist.AppraiserManager;
import hirs.persist.CertificateManager;
+import hirs.persist.ComponentResultManager;
import hirs.persist.CrudManager;
import hirs.persist.DBCertificateManager;
import hirs.persist.DBDeviceGroupManager;
@@ -85,6 +86,9 @@ public class SupplyChainValidationServiceImplTest extends SpringPersistenceTest
@Mock
private CertificateManager certificateManager;
+ @Mock
+ private ComponentResultManager componentResultManager;
+
@Mock
private CredentialValidator supplyChainCredentialValidator;
@@ -449,6 +453,7 @@ public class SupplyChainValidationServiceImplTest extends SpringPersistenceTest
policyManager,
appraiserManager,
realCertMan,
+ componentResultManager,
null,
supplyChainValidationSummaryDBManager,
supplyChainCredentialValidator,
@@ -511,6 +516,7 @@ public class SupplyChainValidationServiceImplTest extends SpringPersistenceTest
policyManager,
appraiserManager,
realCertMan,
+ componentResultManager,
null,
supplyChainValidationSummaryDBManager,
supplyChainCredentialValidator,
@@ -559,6 +565,7 @@ public class SupplyChainValidationServiceImplTest extends SpringPersistenceTest
policyManager,
appraiserManager,
realCertMan,
+ componentResultManager,
null,
supplyChainValidationSummaryDBManager,
supplyChainCredentialValidator,
@@ -597,6 +604,7 @@ public class SupplyChainValidationServiceImplTest extends SpringPersistenceTest
policyManager,
appraiserManager,
realCertMan,
+ componentResultManager,
null,
supplyChainValidationSummaryDBManager,
supplyChainCredentialValidator,
@@ -659,6 +667,7 @@ public class SupplyChainValidationServiceImplTest extends SpringPersistenceTest
policyManager,
appraiserManager,
realCertMan,
+ componentResultManager,
null,
supplyChainValidationSummaryDBManager,
supplyChainCredentialValidator,
@@ -707,6 +716,7 @@ public class SupplyChainValidationServiceImplTest extends SpringPersistenceTest
policyManager,
appraiserManager,
realCertMan,
+ componentResultManager,
null,
supplyChainValidationSummaryDBManager,
supplyChainCredentialValidator,
@@ -760,6 +770,7 @@ public class SupplyChainValidationServiceImplTest extends SpringPersistenceTest
policyManager,
appraiserManager,
realCertMan,
+ componentResultManager,
null,
supplyChainValidationSummaryDBManager,
new SupplyChainCredentialValidator(),
diff --git a/HIRS_AttestationCAPortal/src/main/java/hirs/attestationca/portal/page/controllers/CertificateDetailsPageController.java b/HIRS_AttestationCAPortal/src/main/java/hirs/attestationca/portal/page/controllers/CertificateDetailsPageController.java
index 26a66611..58b3fb60 100644
--- a/HIRS_AttestationCAPortal/src/main/java/hirs/attestationca/portal/page/controllers/CertificateDetailsPageController.java
+++ b/HIRS_AttestationCAPortal/src/main/java/hirs/attestationca/portal/page/controllers/CertificateDetailsPageController.java
@@ -5,6 +5,7 @@ import hirs.attestationca.portal.page.PageMessages;
import hirs.attestationca.portal.page.params.CertificateDetailsPageParams;
import hirs.attestationca.portal.util.CertificateStringMapBuilder;
import hirs.persist.CertificateManager;
+import hirs.persist.ComponentResultManager;
import org.apache.logging.log4j.LogManager;
import org.apache.logging.log4j.Logger;
import org.springframework.beans.factory.annotation.Autowired;
@@ -32,16 +33,20 @@ public class CertificateDetailsPageController extends PageController getPlatformInformation(final UUID uuid,
- final CertificateManager certificateManager)
+ final CertificateManager certificateManager,
+ final ComponentResultManager componentResultManager)
throws IllegalArgumentException, IOException {
HashMap data = new HashMap<>();
PlatformCredential certificate = PlatformCredential
diff --git a/HIRS_AttestationCAPortal/src/main/webapp/WEB-INF/jsp/rim-details.jsp b/HIRS_AttestationCAPortal/src/main/webapp/WEB-INF/jsp/rim-details.jsp
index ad100208..b9a87e5b 100644
--- a/HIRS_AttestationCAPortal/src/main/webapp/WEB-INF/jsp/rim-details.jsp
+++ b/HIRS_AttestationCAPortal/src/main/webapp/WEB-INF/jsp/rim-details.jsp
@@ -161,10 +161,10 @@
- - This Support RIM file does NOT covers the following critical items:
+ - This Support RIM file does NOT cover the following critical items:
- - This Event Log file does NOT covers the following critical items:
+ - This Event Log file does NOT cover the following critical items:
diff --git a/HIRS_Utils/src/main/java/hirs/data/persist/certificate/ComponentResult.java b/HIRS_Utils/src/main/java/hirs/data/persist/certificate/ComponentResult.java
new file mode 100644
index 00000000..10b53051
--- /dev/null
+++ b/HIRS_Utils/src/main/java/hirs/data/persist/certificate/ComponentResult.java
@@ -0,0 +1,111 @@
+package hirs.data.persist.certificate;
+
+import hirs.data.persist.AbstractEntity;
+
+import javax.persistence.Entity;
+import java.util.Objects;
+import java.util.UUID;
+
+/**
+ *
+ */
+@Entity
+public class ComponentResult extends AbstractEntity {
+
+ private UUID certificateId;
+ private int componentHash;
+ private String expected;
+ private String actual;
+ private boolean mismatched;
+
+ /**
+ * Hibernate default constructor
+ */
+ protected ComponentResult() {
+ }
+
+ /**
+ * Default constructor that initializes the parameters and mismatched flag
+ * is set based on expected vs actual.
+ * @param certificateId associated certificate
+ * @param componentHash int value of the component hash
+ * @param expected the string for the expected
+ * @param actual the string for the actual
+ */
+ public ComponentResult(final UUID certificateId, final int componentHash,
+ final String expected, final String actual) {
+ this.certificateId = certificateId;
+ this.componentHash = componentHash;
+ this.expected = expected;
+ this.actual = actual;
+ this.mismatched = Objects.equals(expected, actual);
+ }
+
+ /**
+ * Getter for the associated certificate UUID.
+ * @return the UUID idea value
+ */
+ public UUID getCertificateId() {
+ return certificateId;
+ }
+
+ /**
+ * Getter for the component hash.
+ * @return int value hash
+ */
+ public int getComponentHash() {
+ return componentHash;
+ }
+
+ /**
+ * Getter for the expected string.
+ * @return the expected value
+ */
+ public String getExpected() {
+ return expected;
+ }
+
+ /**
+ * Getter for the actual string.
+ * @return the actual value
+ */
+ public String getActual() {
+ return actual;
+ }
+
+ /**
+ * The flag for the actual and expected matching vs or not.
+ * @return the flag for the values
+ */
+ public boolean isMismatched() {
+ return mismatched;
+ }
+
+ @Override
+ public boolean equals(Object o) {
+ if (this == o) return true;
+ if (o == null || getClass() != o.getClass()) return false;
+ if (!super.equals(o)) return false;
+ ComponentResult that = (ComponentResult) o;
+ return componentHash == that.componentHash
+ && mismatched == that.mismatched
+ && Objects.equals(certificateId, that.certificateId)
+ && Objects.equals(expected, that.expected)
+ && Objects.equals(actual, that.actual);
+ }
+
+ @Override
+ public int hashCode() {
+ return Objects.hash(super.hashCode(), certificateId, componentHash,
+ expected, actual, mismatched);
+ }
+
+ /**
+ * A string format of the expected and actual.
+ * @return a formatted string
+ */
+ public String toString() {
+ return String.format("ComponentResult[%d]: expected=[%s] actual=[%s]",
+ componentHash, expected, actual);
+ }
+}
diff --git a/HIRS_Utils/src/main/java/hirs/persist/ComponentResultManager.java b/HIRS_Utils/src/main/java/hirs/persist/ComponentResultManager.java
new file mode 100644
index 00000000..f1489f10
--- /dev/null
+++ b/HIRS_Utils/src/main/java/hirs/persist/ComponentResultManager.java
@@ -0,0 +1,61 @@
+package hirs.persist;
+
+import hirs.data.persist.certificate.ComponentResult;
+
+import java.util.Set;
+import java.util.UUID;
+
+/**
+ * This class facilitates the persistence of {@link hirs.data.persist.certificate.ComponentResult}s
+ * including storage, retrieval, and deletion.
+ */
+public interface ComponentResultManager extends OrderedListQuerier {
+ /**
+ * Persists a new Component Identifier Result.
+ *
+ * @param componentResult the ComponentResult
+ * @return the persisted ComponentResult
+ */
+ ComponentResult saveResult(ComponentResult componentResult);
+
+ /**
+ * Persists a new Component Identifier Result.
+ *
+ * @param componentResult the ComponentResult
+ * @return the persisted ComponentResult
+ */
+ ComponentResult getResult(ComponentResult componentResult);
+
+ /**
+ * Persists a new Component Identifier Result.
+ *
+ * @param componentId the component id
+ * @return the persisted ComponentResult
+ */
+ ComponentResult getResultById(UUID componentId);
+
+ /**
+ * Returns a list of all ComponentResult
s that are ordered by a column
+ * and direction (ASC, DESC) that is provided by the user. This method
+ * helps support the server-side processing in the JQuery DataTables.
+ *
+ * @return FilteredRecordsList object with fields for DataTables
+ */
+ Set getComponentResultList();
+
+ /**
+ * Returns a list of all ComponentResult
s that are
+ * associated with the certificate
+ *
+ * @return FilteredRecordsList object with fields for DataTables
+ */
+ Set getComponentResultsByCertificate(UUID certificateId);
+
+ /**
+ * Delete the given value.
+ *
+ * @param componentResult the component result delete
+ * @return true if the deletion succeeded, false otherwise.
+ */
+ boolean deleteResult(ComponentResult componentResult);
+}
diff --git a/HIRS_Utils/src/main/java/hirs/persist/DBComponentResultManager.java b/HIRS_Utils/src/main/java/hirs/persist/DBComponentResultManager.java
new file mode 100644
index 00000000..af9bfcad
--- /dev/null
+++ b/HIRS_Utils/src/main/java/hirs/persist/DBComponentResultManager.java
@@ -0,0 +1,163 @@
+package hirs.persist;
+
+import hirs.data.persist.certificate.ComponentResult;
+import org.apache.logging.log4j.LogManager;
+import org.apache.logging.log4j.Logger;
+import org.hibernate.Session;
+import org.hibernate.SessionFactory;
+import org.hibernate.Transaction;
+import org.hibernate.criterion.Restrictions;
+
+import java.util.HashSet;
+import java.util.List;
+import java.util.Set;
+import java.util.UUID;
+
+/**
+ * This class is used to persist and retrieve {@link hirs.data.persist.certificate.ComponentResult}s into
+ * and from the database.
+ */
+public class DBComponentResultManager extends DBManager
+ implements ComponentResultManager {
+
+ private static final Logger LOGGER = LogManager.getLogger(DBComponentResultManager.class);
+
+ /**
+ * Default Constructor.
+ *
+ * @param sessionFactory session factory used to access database connections
+ */
+ public DBComponentResultManager(final SessionFactory sessionFactory) {
+ super(ComponentResult.class, sessionFactory);
+ }
+
+ @Override
+ public ComponentResult saveResult(final ComponentResult componentResult) {
+ LOGGER.debug("saving event digest value: {}", componentResult);
+
+ try {
+ return save(componentResult);
+ } catch (DBManagerException dbMEx) {
+ throw new RuntimeException(dbMEx);
+ }
+ }
+
+ @Override
+ public ComponentResult getResult(final ComponentResult componentResult) {
+ LOGGER.debug("Getting record for {}", componentResult);
+ if (componentResult == null) {
+ LOGGER.error("null componentResult argument");
+ return null;
+ }
+
+ ComponentResult dbRecord;
+ Transaction tx = null;
+ Session session = getFactory().getCurrentSession();
+ try {
+ LOGGER.debug("retrieving componentResult from db");
+ tx = session.beginTransaction();
+ dbRecord = (ComponentResult) session.createCriteria(ComponentResult.class)
+ .add(Restrictions.eq("componentHash",
+ componentResult.getComponentHash()))
+ .add(Restrictions.eq("certificateId",
+ componentResult.getCertificateId()))
+ .uniqueResult();
+ tx.commit();
+ } catch (Exception ex) {
+ final String msg = "unable to retrieve object";
+ LOGGER.error(msg, ex);
+ if (tx != null) {
+ LOGGER.debug("rolling back transaction");
+ tx.rollback();
+ }
+ throw new DBManagerException(msg, ex);
+ }
+ return dbRecord;
+ }
+
+ @Override
+ public ComponentResult getResultById(final UUID certificateId) {
+ LOGGER.debug("Getting record associated with {}", certificateId);
+ if (certificateId == null) {
+ LOGGER.error("null certificateId argument");
+ return null;
+ }
+
+ ComponentResult dbRecord;
+ Transaction tx = null;
+ Session session = getFactory().getCurrentSession();
+ try {
+ LOGGER.debug("retrieving componentResult from db");
+ tx = session.beginTransaction();
+ dbRecord = (ComponentResult) session.createCriteria(ComponentResult.class)
+ .add(Restrictions.eq("certificateId",
+ certificateId))
+ .uniqueResult();
+ tx.commit();
+ } catch (Exception ex) {
+ final String msg = "unable to retrieve object";
+ LOGGER.error(msg, ex);
+ if (tx != null) {
+ LOGGER.debug("rolling back transaction");
+ tx.rollback();
+ }
+ throw new DBManagerException(msg, ex);
+ }
+ return dbRecord;
+ }
+
+ @Override
+ public Set getComponentResultList() {
+ LOGGER.debug("getting ComponentResult list");
+
+ try {
+ final List results = super.getList(ComponentResult.class);
+ return new HashSet<>(results);
+ } catch (DBManagerException e) {
+ throw new DeviceManagerException(e);
+ }
+ }
+
+ @Override
+ public Set getComponentResultsByCertificate(final UUID certificateId) {
+ LOGGER.debug("Getting record associated with {}", certificateId);
+ if (certificateId == null) {
+ LOGGER.error("null certificateId argument");
+ return null;
+ }
+
+ Set dbRecord;
+ Transaction tx = null;
+ Session session = getFactory().getCurrentSession();
+ try {
+ LOGGER.debug("retrieving componentResult from db");
+ tx = session.beginTransaction();
+ dbRecord = new HashSet(session.createCriteria(ComponentResult.class)
+ .add(Restrictions.eq("certificateId",
+ certificateId)).list());
+ tx.commit();
+ } catch (Exception ex) {
+ final String msg = "unable to retrieve object";
+ LOGGER.error(msg, ex);
+ if (tx != null) {
+ LOGGER.debug("rolling back transaction");
+ tx.rollback();
+ }
+ throw new DBManagerException(msg, ex);
+ }
+ return dbRecord;
+ }
+
+ @Override
+ public boolean deleteResult(ComponentResult componentResult) {
+ boolean result;
+ LOGGER.info(String.format("Deleting component result to %s",
+ componentResult.getId()));
+ try {
+ result = super.delete(componentResult);
+ } catch (DBManagerException dbMEx) {
+ throw new RuntimeException(dbMEx);
+ }
+ return result;
+ }
+}
diff --git a/HIRS_Utils/src/main/java/hirs/persist/DBReferenceEventManager.java b/HIRS_Utils/src/main/java/hirs/persist/DBReferenceEventManager.java
index 09d08d6a..f84ea29b 100644
--- a/HIRS_Utils/src/main/java/hirs/persist/DBReferenceEventManager.java
+++ b/HIRS_Utils/src/main/java/hirs/persist/DBReferenceEventManager.java
@@ -22,7 +22,7 @@ import java.util.UUID;
* This class is used to persist and retrieve {@link hirs.data.persist.ReferenceDigestValue}s into
* and from the database.
*/
-public class DBReferenceEventManager extends DBManager
+public class DBReferenceEventManager extends DBManager
implements ReferenceEventManager {
private static final Logger LOGGER = LogManager.getLogger(DBReferenceDigestManager.class);
diff --git a/HIRS_Utils/src/main/java/hirs/persist/PersistenceConfiguration.java b/HIRS_Utils/src/main/java/hirs/persist/PersistenceConfiguration.java
index 408687d1..6a9e555e 100644
--- a/HIRS_Utils/src/main/java/hirs/persist/PersistenceConfiguration.java
+++ b/HIRS_Utils/src/main/java/hirs/persist/PersistenceConfiguration.java
@@ -141,6 +141,18 @@ public class PersistenceConfiguration {
return manager;
}
+ /**
+ * Creates a {@link ComponentResultManager} ready to use.
+ *
+ * @return {@link ComponentResultManager}
+ */
+ @Bean
+ public ComponentResultManager componentResultManager() {
+ DBComponentResultManager manager = new DBComponentResultManager(sessionFactory.getObject());
+ setDbManagerRetrySettings(manager);
+ return manager;
+ }
+
/**
* Creates a {@link ReferenceManifestManager} ready to use.
*
diff --git a/HIRS_Utils/src/main/java/hirs/validation/SupplyChainCredentialValidator.java b/HIRS_Utils/src/main/java/hirs/validation/SupplyChainCredentialValidator.java
index 9588e5b5..7d259d5c 100644
--- a/HIRS_Utils/src/main/java/hirs/validation/SupplyChainCredentialValidator.java
+++ b/HIRS_Utils/src/main/java/hirs/validation/SupplyChainCredentialValidator.java
@@ -7,6 +7,7 @@ import hirs.data.persist.AppraisalStatus;
import hirs.data.persist.ArchivableEntity;
import hirs.data.persist.DeviceInfoReport;
import hirs.data.persist.SupplyChainValidation;
+import hirs.data.persist.certificate.ComponentResult;
import hirs.data.persist.certificate.EndorsementCredential;
import hirs.data.persist.certificate.PlatformCredential;
import hirs.data.persist.certificate.attributes.ComponentIdentifier;
@@ -58,6 +59,7 @@ import java.util.List;
import java.util.Map;
import java.util.Optional;
import java.util.Set;
+import java.util.UUID;
import java.util.stream.Collectors;
import static hirs.data.persist.AppraisalStatus.Status.ERROR;
@@ -346,7 +348,7 @@ public final class SupplyChainCredentialValidator implements CredentialValidator
List origPcComponents
= new LinkedList<>(basePlatformCredential.getComponentIdentifiers());
- return validateDeltaAttributesChainV2p0(deviceInfoReport,
+ return validateDeltaAttributesChainV2p0(basePlatformCredential.getId(), deviceInfoReport,
deltaMapping, origPcComponents);
}
@@ -439,7 +441,6 @@ public final class SupplyChainCredentialValidator implements CredentialValidator
+ " did not match the Certificate's Serial Number";
LOGGER.error(message);
status = new AppraisalStatus(FAIL, message);
-
}
}
}
@@ -458,7 +459,6 @@ public final class SupplyChainCredentialValidator implements CredentialValidator
final DeviceInfoReport deviceInfoReport) {
boolean passesValidation = true;
StringBuilder resultMessage = new StringBuilder();
-
HardwareInfo hardwareInfo = deviceInfoReport.getHardwareInfo();
boolean fieldValidation;
@@ -550,7 +550,7 @@ public final class SupplyChainCredentialValidator implements CredentialValidator
List componentInfoList
= getComponentInfoFromPaccorOutput(paccorOutputString);
unmatchedComponents = validateV2p0PlatformCredentialComponentsExpectingExactMatch(
- validPcComponents, componentInfoList);
+ platformCredential.getId(), validPcComponents, componentInfoList);
fieldValidation &= unmatchedComponents.isEmpty();
} catch (IOException e) {
final String baseErrorMessage = "Error parsing JSON output from PACCOR: ";
@@ -597,7 +597,7 @@ public final class SupplyChainCredentialValidator implements CredentialValidator
* @return Appraisal Status of delta being validated.
*/
@SuppressWarnings("methodlength")
- static AppraisalStatus validateDeltaAttributesChainV2p0(
+ static AppraisalStatus validateDeltaAttributesChainV2p0(final UUID certificateId,
final DeviceInfoReport deviceInfoReport,
final Map deltaMapping,
final List origPcComponents) {
@@ -715,6 +715,7 @@ public final class SupplyChainCredentialValidator implements CredentialValidator
List componentInfoList = getV2PaccorOutput(paccorOutputString);
// this is what I want to rewrite
unmatchedComponents = validateV2PlatformCredentialAttributes(
+ certificateId,
baseCompList,
componentInfoList);
fieldValidation &= unmatchedComponents.isEmpty();
@@ -750,6 +751,7 @@ public final class SupplyChainCredentialValidator implements CredentialValidator
}
private static String validateV2PlatformCredentialAttributes(
+ final UUID certificateId,
final List fullDeltaChainComponents,
final List allDeviceInfoComponents) {
ComponentIdentifierV2 ciV2;
@@ -765,11 +767,11 @@ public final class SupplyChainCredentialValidator implements CredentialValidator
ciV2 = (ComponentIdentifierV2) cId;
if (cInfo.getComponentClass().contains(
ciV2.getComponentClass().getValue())
- && isMatch(cId, cInfo)) {
- subCompIdList.remove(cId);
- subCompInfoList.remove(cInfo);
+ && isMatch(certificateId, cId, cInfo)) {
+ subCompIdList.remove(cId);
+ subCompInfoList.remove(cInfo);
}
- }
+ } // I have to get the unmatched from here, maybe create a list of component result and use that TDM
}
if (subCompIdList.isEmpty()) {
@@ -810,6 +812,7 @@ public final class SupplyChainCredentialValidator implements CredentialValidator
* @return true if validation passes
*/
private static String validateV2p0PlatformCredentialComponentsExpectingExactMatch(
+ final UUID certificateId,
final List untrimmedPcComponents,
final List allDeviceInfoComponents) {
// For each manufacturer listed in the platform credential, create two lists:
@@ -881,7 +884,7 @@ public final class SupplyChainCredentialValidator implements CredentialValidator
if (first.isPresent()) {
ComponentInfo potentialMatch = first.get();
- if (isMatch(pcComponent, potentialMatch)) {
+ if (isMatch(certificateId, pcComponent, potentialMatch)) {
pcComponentsFromManufacturer.remove(pcComponent);
deviceInfoComponentsFromManufacturer.remove(potentialMatch);
}
@@ -909,7 +912,7 @@ public final class SupplyChainCredentialValidator implements CredentialValidator
if (first.isPresent()) {
ComponentInfo potentialMatch = first.get();
- if (isMatch(pcComponent, potentialMatch)) {
+ if (isMatch(certificateId, pcComponent, potentialMatch)) {
pcComponentsFromManufacturer.remove(pcComponent);
deviceInfoComponentsFromManufacturer.remove(potentialMatch);
}
@@ -923,7 +926,7 @@ public final class SupplyChainCredentialValidator implements CredentialValidator
= deviceInfoComponentsFromManufacturer.iterator();
while (diComponentIter.hasNext()) {
ComponentInfo potentialMatch = diComponentIter.next();
- if (isMatch(ci, potentialMatch)) {
+ if (isMatch(certificateId, ci, potentialMatch)) {
pcComponentsFromManufacturer.remove(ci);
diComponentIter.remove();
}
@@ -1063,29 +1066,42 @@ public final class SupplyChainCredentialValidator implements CredentialValidator
* @param potentialMatch the component info from a device info report
* @return true if the fields match exactly (null is considered the same as an empty string)
*/
- static boolean isMatch(final ComponentIdentifier pcComponent,
+ static boolean isMatch(final UUID certificateId, final ComponentIdentifier pcComponent,
final ComponentInfo potentialMatch) {
boolean matchesSoFar = true;
+ ComponentResult componentResult;
matchesSoFar &= isMatchOrEmptyInPlatformCert(
potentialMatch.getComponentManufacturer(),
pcComponent.getComponentManufacturer()
);
+ componentResult = new ComponentResult(certificateId, pcComponent.hashCode(),
+ potentialMatch.getComponentManufacturer(),
+ pcComponent.getComponentManufacturer().getString());
matchesSoFar &= isMatchOrEmptyInPlatformCert(
potentialMatch.getComponentModel(),
pcComponent.getComponentModel()
);
+ componentResult = new ComponentResult(certificateId, pcComponent.hashCode(),
+ potentialMatch.getComponentModel(),
+ pcComponent.getComponentModel().getString());
matchesSoFar &= isMatchOrEmptyInPlatformCert(
potentialMatch.getComponentSerial(),
pcComponent.getComponentSerial()
);
+ componentResult = new ComponentResult(certificateId, pcComponent.hashCode(),
+ potentialMatch.getComponentSerial(),
+ pcComponent.getComponentSerial().getString());
matchesSoFar &= isMatchOrEmptyInPlatformCert(
potentialMatch.getComponentRevision(),
pcComponent.getComponentRevision()
);
+ componentResult = new ComponentResult(certificateId, pcComponent.hashCode(),
+ potentialMatch.getComponentRevision(),
+ pcComponent.getComponentRevision().getString());
return matchesSoFar;
}
diff --git a/HIRS_Utils/src/test/java/hirs/validation/SupplyChainCredentialValidatorTest.java b/HIRS_Utils/src/test/java/hirs/validation/SupplyChainCredentialValidatorTest.java
index a6903420..97bad208 100644
--- a/HIRS_Utils/src/test/java/hirs/validation/SupplyChainCredentialValidatorTest.java
+++ b/HIRS_Utils/src/test/java/hirs/validation/SupplyChainCredentialValidatorTest.java
@@ -1444,7 +1444,8 @@ public class SupplyChainCredentialValidatorTest {
);
Assert.assertTrue(
- SupplyChainCredentialValidator.isMatch(pcComponentIdentifier, nicComponentInfo)
+ SupplyChainCredentialValidator.isMatch(null, pcComponentIdentifier,
+ nicComponentInfo)
);
pcComponentIdentifier = new ComponentIdentifier(
@@ -1458,7 +1459,8 @@ public class SupplyChainCredentialValidatorTest {
);
Assert.assertFalse(
- SupplyChainCredentialValidator.isMatch(pcComponentIdentifier, nicComponentInfo)
+ SupplyChainCredentialValidator.isMatch(null, pcComponentIdentifier,
+ nicComponentInfo)
);
pcComponentIdentifier = new ComponentIdentifier(
@@ -1472,7 +1474,8 @@ public class SupplyChainCredentialValidatorTest {
);
Assert.assertTrue(
- SupplyChainCredentialValidator.isMatch(pcComponentIdentifier, nicComponentInfo)
+ SupplyChainCredentialValidator.isMatch(null, pcComponentIdentifier,
+ nicComponentInfo)
);
}
From 7c14f821e1ac07d1dd1913a0abb1bc4e18153000 Mon Sep 17 00:00:00 2001
From: Cyrus <24922493+cyrus-dev@users.noreply.github.com>
Date: Thu, 6 Apr 2023 14:23:41 -0400
Subject: [PATCH 05/15] Added the page handler code that pulls, the potentially
saved information.
---
.../SupplyChainValidationServiceImpl.java | 5 ++
.../util/CertificateStringMapBuilder.java | 38 ++++++++------
.../WEB-INF/jsp/certificate-details.jsp | 5 +-
.../hirs/validation/CredentialValidator.java | 9 ++++
.../SupplyChainCredentialValidator.java | 50 +++++++++++++------
5 files changed, 76 insertions(+), 31 deletions(-)
diff --git a/HIRS_AttestationCA/src/main/java/hirs/attestationca/service/SupplyChainValidationServiceImpl.java b/HIRS_AttestationCA/src/main/java/hirs/attestationca/service/SupplyChainValidationServiceImpl.java
index c36dc763..6e1593c0 100644
--- a/HIRS_AttestationCA/src/main/java/hirs/attestationca/service/SupplyChainValidationServiceImpl.java
+++ b/HIRS_AttestationCA/src/main/java/hirs/attestationca/service/SupplyChainValidationServiceImpl.java
@@ -19,6 +19,7 @@ import hirs.data.persist.SwidResource;
import hirs.data.persist.TPMMeasurementRecord;
import hirs.data.persist.certificate.Certificate;
import hirs.data.persist.certificate.CertificateAuthorityCredential;
+import hirs.data.persist.certificate.ComponentResult;
import hirs.data.persist.certificate.EndorsementCredential;
import hirs.data.persist.certificate.PlatformCredential;
import hirs.persist.AppraiserManager;
@@ -787,6 +788,10 @@ public class SupplyChainValidationServiceImpl implements SupplyChainValidationSe
pc.setComponentFailures(result.getAdditionalInfo());
pc.setComponentFailureMessage(result.getMessage());
this.certificateManager.update(pc);
+ for (ComponentResult componentResult
+ : supplyChainCredentialValidator.getComponentResultList()) {
+ this.componentResultManager.saveResult(componentResult);
+ }
}
return buildValidationRecord(validationType, AppraisalStatus.Status.FAIL,
result.getMessage(), pc, Level.WARN);
diff --git a/HIRS_AttestationCAPortal/src/main/java/hirs/attestationca/portal/util/CertificateStringMapBuilder.java b/HIRS_AttestationCAPortal/src/main/java/hirs/attestationca/portal/util/CertificateStringMapBuilder.java
index 2c8c360a..031cc3ae 100644
--- a/HIRS_AttestationCAPortal/src/main/java/hirs/attestationca/portal/util/CertificateStringMapBuilder.java
+++ b/HIRS_AttestationCAPortal/src/main/java/hirs/attestationca/portal/util/CertificateStringMapBuilder.java
@@ -1,31 +1,31 @@
package hirs.attestationca.portal.util;
+import hirs.data.persist.certificate.Certificate;
+import hirs.data.persist.certificate.CertificateAuthorityCredential;
+import hirs.data.persist.certificate.ComponentResult;
+import hirs.data.persist.certificate.EndorsementCredential;
+import hirs.data.persist.certificate.IssuedAttestationCertificate;
+import hirs.data.persist.certificate.PlatformCredential;
+import hirs.data.persist.certificate.attributes.ComponentIdentifier;
+import hirs.data.persist.certificate.attributes.PlatformConfiguration;
+import hirs.persist.CertificateManager;
import hirs.persist.ComponentResultManager;
+import hirs.utils.BouncyCastleUtils;
import org.apache.logging.log4j.LogManager;
import org.apache.logging.log4j.Logger;
+import org.bouncycastle.util.encoders.Hex;
import java.io.IOException;
import java.math.BigInteger;
import java.util.Arrays;
+import java.util.Collections;
+import java.util.Comparator;
import java.util.HashMap;
import java.util.HashSet;
-import java.util.Set;
import java.util.List;
-import java.util.Comparator;
-import java.util.stream.Collectors;
+import java.util.Set;
import java.util.UUID;
-import hirs.data.persist.certificate.Certificate;
-import hirs.data.persist.certificate.CertificateAuthorityCredential;
-import hirs.data.persist.certificate.EndorsementCredential;
-import hirs.data.persist.certificate.PlatformCredential;
-import hirs.data.persist.certificate.IssuedAttestationCertificate;
-import hirs.data.persist.certificate.attributes.ComponentIdentifier;
-import hirs.data.persist.certificate.attributes.PlatformConfiguration;
-import hirs.persist.CertificateManager;
-import hirs.utils.BouncyCastleUtils;
-import org.bouncycastle.util.encoders.Hex;
-
-import java.util.Collections;
+import java.util.stream.Collectors;
/**
* Utility class for mapping certificate information in to string maps. These are used to display
@@ -376,6 +376,14 @@ public final class CertificateStringMapBuilder {
if (!certificate.getComponentFailures().isEmpty()) {
data.put("failures", certificate.getComponentFailures());
+ HashMap results = new HashMap<>();
+ for (ComponentResult componentResult : componentResultManager
+ .getComponentResultList()) {
+ if (componentResult.getId().equals(certificate.getId())) {
+ results.put(componentResult.getComponentHash(), componentResult.getExpected());
+ }
+ }
+ data.put("componentResults", results);
data.put("failureMessages", certificate.getComponentFailureMessage());
}
diff --git a/HIRS_AttestationCAPortal/src/main/webapp/WEB-INF/jsp/certificate-details.jsp b/HIRS_AttestationCAPortal/src/main/webapp/WEB-INF/jsp/certificate-details.jsp
index 2490af27..9a4954f1 100644
--- a/HIRS_AttestationCAPortal/src/main/webapp/WEB-INF/jsp/certificate-details.jsp
+++ b/HIRS_AttestationCAPortal/src/main/webapp/WEB-INF/jsp/certificate-details.jsp
@@ -614,13 +614,14 @@