mirror of
https://github.com/nsacyber/HIRS.git
synced 2024-12-18 12:46:30 +00:00
Detect replacement RIM bundle and process accordingly during FW provisioning
Handle replacement base and support RIMs in their respective logic blocks
This commit is contained in:
chubtub
parent
a123acc743
commit
c37dd127d3
@ -62,6 +62,8 @@ import java.util.HashMap;
|
||||
import java.util.LinkedList;
|
||||
import java.util.List;
|
||||
import java.util.Map;
|
||||
import java.util.Optional;
|
||||
import java.util.UUID;
|
||||
import java.util.regex.Matcher;
|
||||
import java.util.regex.Pattern;
|
||||
|
||||
@ -347,14 +349,79 @@ public class IdentityClaimProcessor extends AbstractProcessor {
|
||||
dv.getHw().getManufacturer(),
|
||||
dv.getHw().getProductName());
|
||||
BaseReferenceManifest dbBaseRim = null;
|
||||
SupportReferenceManifest support;
|
||||
SupportReferenceManifest support = null;
|
||||
EventLogMeasurements measurements;
|
||||
boolean isReplacement = false;
|
||||
String replacementRimId = "";
|
||||
String tagId = "";
|
||||
String fileName = "";
|
||||
Pattern pattern = Pattern.compile("([^\\s]+(\\.(?i)(rimpcr|rimel|bin|log))$)");
|
||||
Matcher matcher;
|
||||
MessageDigest messageDigest = MessageDigest.getInstance("SHA-256");
|
||||
|
||||
if (dv.getSwidfileCount() > 0) {
|
||||
for (ByteString swidFile : dv.getSwidfileList()) {
|
||||
try {
|
||||
dbBaseRim = (BaseReferenceManifest) referenceManifestRepository
|
||||
.findByBase64Hash(Base64.getEncoder()
|
||||
.encodeToString(messageDigest
|
||||
.digest(swidFile.toByteArray())));
|
||||
if (dbBaseRim == null) {
|
||||
/*
|
||||
Either the swidFile does not have a corresponding base RIM in the backend
|
||||
or it was deleted. Check if there is a replacement by comparing tagId against
|
||||
all other base RIMs, and then set the corresponding support rim's deviceName.
|
||||
*/
|
||||
dbBaseRim = new BaseReferenceManifest(
|
||||
String.format("%s.swidtag",
|
||||
defaultClientName),
|
||||
swidFile.toByteArray());
|
||||
List<BaseReferenceManifest> baseRims = referenceManifestRepository.findAllBaseRims();
|
||||
for (BaseReferenceManifest bRim : baseRims) {
|
||||
if (bRim.getTagId().equals(dbBaseRim.getTagId())) {
|
||||
dbBaseRim = bRim;
|
||||
replacementRimId = dbBaseRim.getAssociatedRim().toString();
|
||||
isReplacement = true;
|
||||
break;
|
||||
}
|
||||
}
|
||||
dbBaseRim.setDeviceName(dv.getNw().getHostname());
|
||||
this.referenceManifestRepository.save(dbBaseRim);
|
||||
} else if (dbBaseRim.isArchived()) {
|
||||
/*
|
||||
This block accounts for RIMs that may have been soft-deleted (archived)
|
||||
in an older version of the ACA.
|
||||
*/
|
||||
List<ReferenceManifest> rims = referenceManifestRepository.findByArchiveFlag(false);
|
||||
for (ReferenceManifest rim : rims) {
|
||||
if (rim.isBase() && rim.getTagId().equals(dbBaseRim.getTagId()) &&
|
||||
rim.getCreateTime().after(dbBaseRim.getCreateTime())) {
|
||||
dbBaseRim.setDeviceName(null);
|
||||
dbBaseRim = (BaseReferenceManifest) rim;
|
||||
dbBaseRim.setDeviceName(dv.getNw().getHostname());
|
||||
}
|
||||
}
|
||||
if (dbBaseRim.isArchived()) {
|
||||
throw new Exception("Unable to locate an unarchived base RIM.");
|
||||
} else {
|
||||
this.referenceManifestRepository.save(dbBaseRim);
|
||||
}
|
||||
} else {
|
||||
dbBaseRim.setDeviceName(dv.getNw().getHostname());
|
||||
this.referenceManifestRepository.save(dbBaseRim);
|
||||
}
|
||||
tagId = dbBaseRim.getTagId();
|
||||
} catch (UnmarshalException e) {
|
||||
log.error(e);
|
||||
} catch (Exception ex) {
|
||||
log.error(String.format("Failed to load base rim: %s", ex.getMessage()));
|
||||
}
|
||||
}
|
||||
} else {
|
||||
log.warn(String.format("%s did not send swid tag file...",
|
||||
dv.getNw().getHostname()));
|
||||
}
|
||||
|
||||
if (dv.getLogfileCount() > 0) {
|
||||
for (ByteString logFile : dv.getLogfileList()) {
|
||||
try {
|
||||
@ -362,21 +429,41 @@ public class IdentityClaimProcessor extends AbstractProcessor {
|
||||
Hex.encodeHexString(messageDigest.digest(logFile.toByteArray())),
|
||||
ReferenceManifest.SUPPORT_RIM);
|
||||
if (support == null) {
|
||||
support = new SupportReferenceManifest(
|
||||
String.format("%s.rimel",
|
||||
defaultClientName),
|
||||
logFile.toByteArray());
|
||||
// this is a validity check
|
||||
new TCGEventLog(support.getRimBytes());
|
||||
// no issues, continue
|
||||
support.setPlatformManufacturer(dv.getHw().getManufacturer());
|
||||
support.setPlatformModel(dv.getHw().getProductName());
|
||||
support.setFileName(String.format("%s_[%s].rimel", defaultClientName,
|
||||
support.getHexDecHash().substring(
|
||||
support.getHexDecHash().length() - NUM_OF_VARIABLES)));
|
||||
/*
|
||||
Either the logFile does not have a corresponding support RIM in the backend
|
||||
or it was deleted. The support RIM for a replacement base RIM is handled
|
||||
in the previous loop block.
|
||||
*/
|
||||
if (isReplacement) {
|
||||
Optional<ReferenceManifest> replacementRim =
|
||||
referenceManifestRepository.findById(UUID.fromString(replacementRimId));
|
||||
if (replacementRim.isPresent()) {
|
||||
support = (SupportReferenceManifest) replacementRim.get();
|
||||
support.setDeviceName(dv.getNw().getHostname());
|
||||
} else {
|
||||
throw new Exception("Unable to locate support RIM " + replacementRimId);
|
||||
}
|
||||
} else {
|
||||
support = new SupportReferenceManifest(
|
||||
String.format("%s.rimel",
|
||||
defaultClientName),
|
||||
logFile.toByteArray());
|
||||
// this is a validity check
|
||||
new TCGEventLog(support.getRimBytes());
|
||||
// no issues, continue
|
||||
support.setPlatformManufacturer(dv.getHw().getManufacturer());
|
||||
support.setPlatformModel(dv.getHw().getProductName());
|
||||
support.setFileName(String.format("%s_[%s].rimel", defaultClientName,
|
||||
support.getHexDecHash().substring(
|
||||
support.getHexDecHash().length() - NUM_OF_VARIABLES)));
|
||||
}
|
||||
support.setDeviceName(dv.getNw().getHostname());
|
||||
this.referenceManifestRepository.save(support);
|
||||
} else if (support.isArchived()) {
|
||||
/*
|
||||
This block accounts for RIMs that may have been soft-deleted (archived)
|
||||
in an older version of the ACA.
|
||||
*/
|
||||
List<ReferenceManifest> rims = referenceManifestRepository.findByArchiveFlag(false);
|
||||
for (ReferenceManifest rim : rims) {
|
||||
if (rim.isSupport() &&
|
||||
@ -392,6 +479,9 @@ public class IdentityClaimProcessor extends AbstractProcessor {
|
||||
} else {
|
||||
this.referenceManifestRepository.save(support);
|
||||
}
|
||||
} else {
|
||||
support.setDeviceName(dv.getNw().getHostname());
|
||||
this.referenceManifestRepository.save(support);
|
||||
}
|
||||
} catch (IOException ioEx) {
|
||||
log.error(ioEx);
|
||||
@ -404,46 +494,6 @@ public class IdentityClaimProcessor extends AbstractProcessor {
|
||||
dv.getNw().getHostname()));
|
||||
}
|
||||
|
||||
if (dv.getSwidfileCount() > 0) {
|
||||
for (ByteString swidFile : dv.getSwidfileList()) {
|
||||
try {
|
||||
dbBaseRim = (BaseReferenceManifest) referenceManifestRepository
|
||||
.findByBase64Hash(Base64.getEncoder()
|
||||
.encodeToString(messageDigest
|
||||
.digest(swidFile.toByteArray())));
|
||||
if (dbBaseRim == null) {
|
||||
dbBaseRim = new BaseReferenceManifest(
|
||||
String.format("%s.swidtag",
|
||||
defaultClientName),
|
||||
swidFile.toByteArray());
|
||||
dbBaseRim.setDeviceName(dv.getNw().getHostname());
|
||||
this.referenceManifestRepository.save(dbBaseRim);
|
||||
} else if (dbBaseRim.isArchived()) {
|
||||
List<ReferenceManifest> rims = referenceManifestRepository.findByArchiveFlag(false);
|
||||
for (ReferenceManifest rim : rims) {
|
||||
if (rim.isBase() && rim.getTagId().equals(dbBaseRim.getTagId()) &&
|
||||
rim.getCreateTime().after(dbBaseRim.getCreateTime())) {
|
||||
dbBaseRim.setDeviceName(null);
|
||||
dbBaseRim = (BaseReferenceManifest) rim;
|
||||
dbBaseRim.setDeviceName(dv.getNw().getHostname());
|
||||
}
|
||||
}
|
||||
if (dbBaseRim.isArchived()) {
|
||||
throw new Exception("Unable to locate an unarchived base RIM.");
|
||||
}
|
||||
}
|
||||
tagId = dbBaseRim.getTagId();
|
||||
} catch (UnmarshalException e) {
|
||||
log.error(e);
|
||||
} catch (Exception ex) {
|
||||
log.error(String.format("Failed to load base rim: %s", ex.getMessage()));
|
||||
}
|
||||
}
|
||||
} else {
|
||||
log.warn(String.format("%s did not send swid tag file...",
|
||||
dv.getNw().getHostname()));
|
||||
}
|
||||
|
||||
//update Support RIMs and Base RIMs.
|
||||
for (ByteString swidFile : dv.getSwidfileList()) {
|
||||
dbBaseRim = (BaseReferenceManifest) referenceManifestRepository
|
||||
|
||||
@ -239,9 +239,7 @@ public class ReferenceManifestPageController extends PageController<NoPageParams
|
||||
messages.addError(notFoundMessage);
|
||||
log.warn(notFoundMessage);
|
||||
} else {
|
||||
// if support rim, update associated events
|
||||
referenceManifest.archive();
|
||||
referenceManifestRepository.save(referenceManifest);
|
||||
referenceManifestRepository.delete(referenceManifest);
|
||||
String deleteCompletedMessage = "RIM successfully deleted";
|
||||
messages.addInfo(deleteCompletedMessage);
|
||||
log.info(deleteCompletedMessage);
|
||||
|
||||
Loading…
Reference in New Issue
Block a user