ExternalVendorCode/HIRS
1
0
Fork 0
mirror of https://github.com/nsacyber/HIRS.git synced 2024-12-19 21:17:59 +00:00
Code Issues Actions 3 Packages Projects Releases Wiki Activity

IdentityClaimProcessor rename dbBaseRim -> baseRim. Checkstyle changes.

Browse Source
This commit is contained in:
chubtub 2024-10-30 11:23:02 -04:00
parent 775ab4acc6
commit b0712958b9
1 changed files with 68 additions and 64 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

132
HIRS_AttestationCA/src/main/java/hirs/attestationca/persist/provision/IdentityClaimProcessor.java
View File

@ -1,6 +1,5 @@
package hirs.attestationca.persist.provision; package hirs.attestationca.persist.provision;
import com.fasterxml.jackson.databind.ser.Serializers;
import com.google.protobuf.ByteString; import com.google.protobuf.ByteString;
import hirs.attestationca.configuration.provisionerTpm2.ProvisionerTpm2; import hirs.attestationca.configuration.provisionerTpm2.ProvisionerTpm2;
import hirs.attestationca.persist.entity.manager.CertificateRepository; import hirs.attestationca.persist.entity.manager.CertificateRepository;
@ -69,24 +68,23 @@ import java.util.regex.Pattern;
@Log4j2 @Log4j2
public class IdentityClaimProcessor extends AbstractProcessor { public class IdentityClaimProcessor extends AbstractProcessor {
private static final String PCR_QUOTE_MASK = "0,1,2,3,4,5,6,7,8,9,10,11,12,13,"
+ "14,15,16,17,18,19,20,21,22,23";
private static final int NUM_OF_VARIABLES = 5;
/** /**
* Number of bytes to include in the TPM2.0 nonce. * Number of bytes to include in the TPM2.0 nonce.
*/ */
public static final int NONCE_LENGTH = 20; public static final int NONCE_LENGTH = 20;
private static final String PCR_QUOTE_MASK = "0,1,2,3,4,5,6,7,8,9,10,11,12,13,"
+ "14,15,16,17,18,19,20,21,22,23";
private static final int NUM_OF_VARIABLES = 5;
private static final int MAC_BYTES = 6; private static final int MAC_BYTES = 6;
private SupplyChainValidationService supplyChainValidationService; private final SupplyChainValidationService supplyChainValidationService;
private CertificateRepository certificateRepository; private final CertificateRepository certificateRepository;
private ComponentResultRepository componentResultRepository; private final ComponentResultRepository componentResultRepository;
private ComponentInfoRepository componentInfoRepository; private final ComponentInfoRepository componentInfoRepository;
private ReferenceManifestRepository referenceManifestRepository; private final ReferenceManifestRepository referenceManifestRepository;
private ReferenceDigestValueRepository referenceDigestValueRepository; private final ReferenceDigestValueRepository referenceDigestValueRepository;
private DeviceRepository deviceRepository; private final DeviceRepository deviceRepository;
private TPM2ProvisionerStateRepository tpm2ProvisionerStateRepository; private final TPM2ProvisionerStateRepository tpm2ProvisionerStateRepository;
/** /**
* Constructor. * Constructor.
@ -116,8 +114,8 @@ public class IdentityClaimProcessor extends AbstractProcessor {
* Basic implementation of the ACA processIdentityClaimTpm2 method. Parses the claim, * Basic implementation of the ACA processIdentityClaimTpm2 method. Parses the claim,
* stores the device info, performs supply chain validation, generates a nonce, * stores the device info, performs supply chain validation, generates a nonce,
* and wraps that nonce with the make credential process before returning it to the client. * and wraps that nonce with the make credential process before returning it to the client.
* attCert.setPcrValues(pcrValues); * attCert.setPcrValues(pcrValues);
*
* @param identityClaim the request to process, cannot be null * @param identityClaim the request to process, cannot be null
* @return an identity claim response for the specified request containing a wrapped blob * @return an identity claim response for the specified request containing a wrapped blob
*/ */
@ -147,7 +145,7 @@ public class IdentityClaimProcessor extends AbstractProcessor {
} }
} }
ByteString blobStr = ByteString.copyFrom(new byte[]{}); ByteString blobStr = ByteString.copyFrom(new byte[] {});
if (validationResult == AppraisalStatus.Status.PASS) { if (validationResult == AppraisalStatus.Status.PASS) {
RSAPublicKey akPub = ProvisionUtils.parsePublicKey(claim.getAkPublicArea().toByteArray()); RSAPublicKey akPub = ProvisionUtils.parsePublicKey(claim.getAkPublicArea().toByteArray());
byte[] nonce = ProvisionUtils.generateRandomBytes(NONCE_LENGTH); byte[] nonce = ProvisionUtils.generateRandomBytes(NONCE_LENGTH);
@ -195,7 +193,8 @@ public class IdentityClaimProcessor extends AbstractProcessor {
private AppraisalStatus.Status doSupplyChainValidation( private AppraisalStatus.Status doSupplyChainValidation(
final ProvisionerTpm2.IdentityClaim claim, final PublicKey ekPub) { final ProvisionerTpm2.IdentityClaim claim, final PublicKey ekPub) {
// attempt to find an endorsement credential to validate // attempt to find an endorsement credential to validate
EndorsementCredential endorsementCredential = parseEcFromIdentityClaim(claim, ekPub, certificateRepository); EndorsementCredential endorsementCredential =
parseEcFromIdentityClaim(claim, ekPub, certificateRepository);
// attempt to find platform credentials to validate // attempt to find platform credentials to validate
List<PlatformCredential> platformCredentials = parsePcsFromIdentityClaim(claim, List<PlatformCredential> platformCredentials = parsePcsFromIdentityClaim(claim,
@ -283,6 +282,7 @@ public class IdentityClaimProcessor extends AbstractProcessor {
/** /**
* Converts a protobuf DeviceInfo object to a HIRS Utils DeviceInfoReport object. * Converts a protobuf DeviceInfo object to a HIRS Utils DeviceInfoReport object.
*
* @param claim the protobuf serialized identity claim containing the device info * @param claim the protobuf serialized identity claim containing the device info
* @return a HIRS Utils DeviceInfoReport representation of device info * @return a HIRS Utils DeviceInfoReport representation of device info
*/ */
@ -348,7 +348,7 @@ public class IdentityClaimProcessor extends AbstractProcessor {
String defaultClientName = String.format("%s_%s", String defaultClientName = String.format("%s_%s",
dv.getHw().getManufacturer(), dv.getHw().getManufacturer(),
dv.getHw().getProductName()); dv.getHw().getProductName());
BaseReferenceManifest dbBaseRim = null; BaseReferenceManifest baseRim = null;
SupportReferenceManifest support = null; SupportReferenceManifest support = null;
EventLogMeasurements measurements; EventLogMeasurements measurements;
boolean isReplacement = false; boolean isReplacement = false;
@ -357,60 +357,60 @@ public class IdentityClaimProcessor extends AbstractProcessor {
String fileName = ""; String fileName = "";
Pattern pattern = Pattern.compile("([^\\s]+(\\.(?i)(rimpcr|rimel|bin|log))$)"); Pattern pattern = Pattern.compile("([^\\s]+(\\.(?i)(rimpcr|rimel|bin|log))$)");
Matcher matcher; Matcher matcher;
MessageDigest messageDigest = MessageDigest.getInstance("SHA-256"); MessageDigest messageDigest = MessageDigest.getInstance("SHA-256");
if (dv.getSwidfileCount() > 0) { if (dv.getSwidfileCount() > 0) {
for (ByteString swidFile : dv.getSwidfileList()) { for (ByteString swidFile : dv.getSwidfileList()) {
try { try {
dbBaseRim = (BaseReferenceManifest) referenceManifestRepository baseRim = (BaseReferenceManifest) referenceManifestRepository
.findByBase64Hash(Base64.getEncoder() .findByBase64Hash(Base64.getEncoder()
.encodeToString(messageDigest .encodeToString(messageDigest
.digest(swidFile.toByteArray()))); .digest(swidFile.toByteArray())));
if (dbBaseRim == null) { if (baseRim == null) {
/* /*
Either the swidFile does not have a corresponding base RIM in the backend Either the swidFile does not have a corresponding base RIM in the backend
or it was deleted. Check if there is a replacement by comparing tagId against or it was deleted. Check if there is a replacement by comparing tagId against
all other base RIMs, and then set the corresponding support rim's deviceName. all other base RIMs, and then set the corresponding support rim's deviceName.
*/ */
dbBaseRim = new BaseReferenceManifest( baseRim = new BaseReferenceManifest(
String.format("%s.swidtag", String.format("%s.swidtag",
defaultClientName), defaultClientName),
swidFile.toByteArray()); swidFile.toByteArray());
List<BaseReferenceManifest> baseRims = referenceManifestRepository.findAllBaseRims(); List<BaseReferenceManifest> baseRims = referenceManifestRepository.findAllBaseRims();
for (BaseReferenceManifest bRim : baseRims) { for (BaseReferenceManifest bRim : baseRims) {
if (bRim.getTagId().equals(dbBaseRim.getTagId())) { if (bRim.getTagId().equals(baseRim.getTagId())) {
dbBaseRim = bRim; baseRim = bRim;
replacementRimId = dbBaseRim.getAssociatedRim().toString(); replacementRimId = baseRim.getAssociatedRim().toString();
isReplacement = true; isReplacement = true;
break; break;
} }
} }
dbBaseRim.setDeviceName(dv.getNw().getHostname()); baseRim.setDeviceName(dv.getNw().getHostname());
this.referenceManifestRepository.save(dbBaseRim); this.referenceManifestRepository.save(baseRim);
} else if (dbBaseRim.isArchived()) { } else if (baseRim.isArchived()) {
/* /*
This block accounts for RIMs that may have been soft-deleted (archived) This block accounts for RIMs that may have been soft-deleted (archived)
in an older version of the ACA. in an older version of the ACA.
*/ */
List<ReferenceManifest> rims = referenceManifestRepository.findByArchiveFlag(false); List<ReferenceManifest> rims = referenceManifestRepository.findByArchiveFlag(false);
for (ReferenceManifest rim : rims) { for (ReferenceManifest rim : rims) {
if (rim.isBase() && rim.getTagId().equals(dbBaseRim.getTagId()) && if (rim.isBase() && rim.getTagId().equals(baseRim.getTagId()) &&
rim.getCreateTime().after(dbBaseRim.getCreateTime())) { rim.getCreateTime().after(baseRim.getCreateTime())) {
dbBaseRim.setDeviceName(null); baseRim.setDeviceName(null);
dbBaseRim = (BaseReferenceManifest) rim; baseRim = (BaseReferenceManifest) rim;
dbBaseRim.setDeviceName(dv.getNw().getHostname()); baseRim.setDeviceName(dv.getNw().getHostname());
} }
} }
if (dbBaseRim.isArchived()) { if (baseRim.isArchived()) {
throw new Exception("Unable to locate an unarchived base RIM."); throw new Exception("Unable to locate an unarchived base RIM.");
} else { } else {
this.referenceManifestRepository.save(dbBaseRim); this.referenceManifestRepository.save(baseRim);
} }
} else { } else {
dbBaseRim.setDeviceName(dv.getNw().getHostname()); baseRim.setDeviceName(dv.getNw().getHostname());
this.referenceManifestRepository.save(dbBaseRim); this.referenceManifestRepository.save(baseRim);
} }
tagId = dbBaseRim.getTagId(); tagId = baseRim.getTagId();
} catch (UnmarshalException e) { } catch (UnmarshalException e) {
log.error(e); log.error(e);
} catch (Exception ex) { } catch (Exception ex) {
@ -425,9 +425,10 @@ public class IdentityClaimProcessor extends AbstractProcessor {
if (dv.getLogfileCount() > 0) { if (dv.getLogfileCount() > 0) {
for (ByteString logFile : dv.getLogfileList()) { for (ByteString logFile : dv.getLogfileList()) {
try { try {
support = (SupportReferenceManifest) referenceManifestRepository.findByHexDecHashAndRimType( support =
(SupportReferenceManifest) referenceManifestRepository.findByHexDecHashAndRimType(
Hex.encodeHexString(messageDigest.digest(logFile.toByteArray())), Hex.encodeHexString(messageDigest.digest(logFile.toByteArray())),
ReferenceManifest.SUPPORT_RIM); ReferenceManifest.SUPPORT_RIM);
if (support == null) { if (support == null) {
/* /*
Either the logFile does not have a corresponding support RIM in the backend Either the logFile does not have a corresponding support RIM in the backend
@ -496,39 +497,41 @@ public class IdentityClaimProcessor extends AbstractProcessor {
//update Support RIMs and Base RIMs. //update Support RIMs and Base RIMs.
for (ByteString swidFile : dv.getSwidfileList()) { for (ByteString swidFile : dv.getSwidfileList()) {
dbBaseRim = (BaseReferenceManifest) referenceManifestRepository baseRim = (BaseReferenceManifest) referenceManifestRepository
.findByBase64Hash(Base64.getEncoder().encodeToString(messageDigest.digest( .findByBase64Hash(Base64.getEncoder().encodeToString(messageDigest.digest(
swidFile.toByteArray()))); swidFile.toByteArray())));
if (dbBaseRim != null) { if (baseRim != null) {
// get file name to use // get file name to use
for (SwidResource swid : dbBaseRim.getFileResources()) { for (SwidResource swid : baseRim.getFileResources()) {
matcher = pattern.matcher(swid.getName()); matcher = pattern.matcher(swid.getName());
if (matcher.matches()) { if (matcher.matches()) {
//found the file name //found the file name
int dotIndex = swid.getName().lastIndexOf("."); int dotIndex = swid.getName().lastIndexOf(".");
fileName = swid.getName().substring(0, dotIndex); fileName = swid.getName().substring(0, dotIndex);
dbBaseRim.setFileName(String.format("%s.swidtag", baseRim.setFileName(String.format("%s.swidtag",
fileName)); fileName));
} }
// now update support rim // now update support rim
SupportReferenceManifest dbSupport = (SupportReferenceManifest) referenceManifestRepository SupportReferenceManifest dbSupport =
.findByHexDecHashAndRimType(swid.getHashValue(), ReferenceManifest.SUPPORT_RIM); (SupportReferenceManifest) referenceManifestRepository
.findByHexDecHashAndRimType(swid.getHashValue(),
ReferenceManifest.SUPPORT_RIM);
if (dbSupport != null) { if (dbSupport != null) {
dbSupport.setFileName(swid.getName()); dbSupport.setFileName(swid.getName());
dbSupport.setSwidTagVersion(dbBaseRim.getSwidTagVersion()); dbSupport.setSwidTagVersion(baseRim.getSwidTagVersion());
dbSupport.setTagId(dbBaseRim.getTagId()); dbSupport.setTagId(baseRim.getTagId());
dbSupport.setSwidTagVersion(dbBaseRim.getSwidTagVersion()); dbSupport.setSwidTagVersion(baseRim.getSwidTagVersion());
dbSupport.setSwidVersion(dbBaseRim.getSwidVersion()); dbSupport.setSwidVersion(baseRim.getSwidVersion());
dbSupport.setSwidPatch(dbBaseRim.isSwidPatch()); dbSupport.setSwidPatch(baseRim.isSwidPatch());
dbSupport.setSwidSupplemental(dbBaseRim.isSwidSupplemental()); dbSupport.setSwidSupplemental(baseRim.isSwidSupplemental());
dbBaseRim.setAssociatedRim(dbSupport.getId()); baseRim.setAssociatedRim(dbSupport.getId());
dbSupport.setUpdated(true); dbSupport.setUpdated(true);
dbSupport.setAssociatedRim(dbBaseRim.getId()); dbSupport.setAssociatedRim(baseRim.getId());
this.referenceManifestRepository.save(dbSupport); this.referenceManifestRepository.save(dbSupport);
} }
} }
this.referenceManifestRepository.save(dbBaseRim); this.referenceManifestRepository.save(baseRim);
} }
} }
@ -564,15 +567,15 @@ public class IdentityClaimProcessor extends AbstractProcessor {
this.referenceManifestRepository.save(measurements); this.referenceManifestRepository.save(measurements);
for (BaseReferenceManifest baseRim : baseRims) { for (BaseReferenceManifest bRim : baseRims) {
if (baseRim != null) { if (bRim != null) {
// pull the base versions of the swidtag and rimel and set the // pull the base versions of the swidtag and rimel and set the
// event log hash for use during provision // event log hash for use during provision
SupportReferenceManifest sBaseRim = referenceManifestRepository SupportReferenceManifest sBaseRim = referenceManifestRepository
.getSupportRimEntityById(baseRim.getAssociatedRim()); .getSupportRimEntityById(bRim.getAssociatedRim());
baseRim.setEventLogHash(temp.getHexDecHash()); bRim.setEventLogHash(temp.getHexDecHash());
sBaseRim.setEventLogHash(temp.getHexDecHash()); sBaseRim.setEventLogHash(temp.getHexDecHash());
referenceManifestRepository.save(baseRim); referenceManifestRepository.save(bRim);
referenceManifestRepository.save(sBaseRim); referenceManifestRepository.save(sBaseRim);
} }
} }
@ -584,7 +587,7 @@ public class IdentityClaimProcessor extends AbstractProcessor {
dv.getNw().getHostname())); dv.getNw().getHostname()));
} }
// Get TPM info, currently unimplemented // Get TPM info, currently unimplemented
TPMInfo tpmInfo = new TPMInfo(DeviceInfoEnums.NOT_SPECIFIED, TPMInfo tpmInfo = new TPMInfo(DeviceInfoEnums.NOT_SPECIFIED,
(short) 0, (short) 0,
(short) 0, (short) 0,
@ -628,7 +631,8 @@ public class IdentityClaimProcessor extends AbstractProcessor {
} }
if (baseSupportRim != null if (baseSupportRim != null
&& referenceDigestValueRepository.findBySupportRimHash(baseSupportRim.getHexDecHash()).isEmpty()) { && referenceDigestValueRepository.findBySupportRimHash(baseSupportRim.getHexDecHash())
.isEmpty()) {
try { try {
TCGEventLog logProcessor = new TCGEventLog(baseSupportRim.getRimBytes()); TCGEventLog logProcessor = new TCGEventLog(baseSupportRim.getRimBytes());
ReferenceDigestValue rdv; ReferenceDigestValue rdv;
@ -688,7 +692,7 @@ public class IdentityClaimProcessor extends AbstractProcessor {
log.error(String.format("Patching value does not exist (%s)", log.error(String.format("Patching value does not exist (%s)",
patchedValue)); patchedValue));
} else { } else {
// WIP - Until we get patch examples // WIP - Until we get patch examples
dbRdv.setPatched(true); dbRdv.setPatched(true);
} }
} }
@ -721,7 +725,7 @@ public class IdentityClaimProcessor extends AbstractProcessor {
} }
private int handleDeviceComponents(final String hostName, final String paccorString) { private int handleDeviceComponents(final String hostName, final String paccorString) {
int deviceComponents = 0 ; int deviceComponents = 0;
Map<Integer, ComponentInfo> componentInfoMap = new HashMap<>(); Map<Integer, ComponentInfo> componentInfoMap = new HashMap<>();
try { try {
List<ComponentInfo> componentInfos = SupplyChainCredentialValidator List<ComponentInfo> componentInfos = SupplyChainCredentialValidator