mirror of
https://github.com/nsacyber/HIRS.git
synced 2025-04-07 11:26:51 +00:00
Some additional minor changes that are to address the event log being the object that is linked when the firmware validation passes.
This commit is contained in:
Cyrus
parent
9c060dec55
commit
c523dda558
@ -578,29 +578,34 @@ public class SupplyChainValidationServiceImpl implements SupplyChainValidationSe
|
||||
// check if the policy is enabled
|
||||
if (policy.isFirmwareValidationEnabled()) {
|
||||
String[] baseline = new String[Integer.SIZE];
|
||||
String manufacturer = device.getDeviceInfo()
|
||||
.getHardwareInfo().getManufacturer();
|
||||
String deviceName = device.getDeviceInfo()
|
||||
.getNetworkInfo().getHostname();
|
||||
|
||||
try {
|
||||
sRim = SupportReferenceManifest.select(
|
||||
this.referenceManifestManager)
|
||||
.byManufacturer(manufacturer).getRIM();
|
||||
Set<SupportReferenceManifest> supportRims = SupportReferenceManifest
|
||||
.select(this.referenceManifestManager)
|
||||
.byDeviceName(deviceName).getRIMs();
|
||||
for (SupportReferenceManifest support : supportRims) {
|
||||
if (support.isBaseSupport()) {
|
||||
sRim = support;
|
||||
}
|
||||
}
|
||||
eventLog = EventLogMeasurements
|
||||
.select(this.referenceManifestManager)
|
||||
.byManufacturer(manufacturer).getRIM();
|
||||
.byDeviceName(deviceName).getRIM();
|
||||
|
||||
if (sRim == null) {
|
||||
fwStatus = new AppraisalStatus(FAIL,
|
||||
String.format("Firmware Quote validation failed: "
|
||||
+ "No associated Support RIM file "
|
||||
+ "could be found for %s",
|
||||
manufacturer));
|
||||
deviceName));
|
||||
} else if (eventLog == null) {
|
||||
fwStatus = new AppraisalStatus(FAIL,
|
||||
String.format("Firmware Quote validation failed: "
|
||||
+ "No associated Client Log file "
|
||||
+ "could be found for %s",
|
||||
manufacturer));
|
||||
deviceName));
|
||||
} else {
|
||||
baseline = sRim.getExpectedPCRList();
|
||||
String[] storedPcrs = eventLog.getExpectedPCRList();
|
||||
@ -618,13 +623,13 @@ public class SupplyChainValidationServiceImpl implements SupplyChainValidationSe
|
||||
fwStatus.setMessage("Firmware validation of TPM Quote failed."
|
||||
+ "\nPCR hash and Quote hash do not match.");
|
||||
}
|
||||
eventLog.setOverallValidationResult(fwStatus.getAppStatus());
|
||||
this.referenceManifestManager.update(eventLog);
|
||||
}
|
||||
} catch (Exception ex) {
|
||||
LOGGER.error(ex);
|
||||
}
|
||||
|
||||
eventLog.setOverallValidationResult(fwStatus.getAppStatus());
|
||||
this.referenceManifestManager.update(eventLog);
|
||||
quoteScv = buildValidationRecord(SupplyChainValidation
|
||||
.ValidationType.FIRMWARE,
|
||||
fwStatus.getAppStatus(), fwStatus.getMessage(), eventLog, level);
|
||||
@ -639,6 +644,10 @@ public class SupplyChainValidationServiceImpl implements SupplyChainValidationSe
|
||||
validations.add(buildValidationRecord(scv.getValidationType(),
|
||||
scv.getResult(), scv.getMessage(),
|
||||
scv.getCertificatesUsed().get(0), Level.INFO));
|
||||
} else {
|
||||
validations.add(buildValidationRecord(scv.getValidationType(),
|
||||
scv.getResult(), scv.getMessage(),
|
||||
quoteScv.getCertificatesUsed().get(0), Level.INFO));
|
||||
}
|
||||
}
|
||||
validations.add(quoteScv);
|
||||
|
||||
@ -34,6 +34,7 @@ import java.security.NoSuchAlgorithmException;
|
||||
import java.security.cert.CertificateException;
|
||||
import java.util.ArrayList;
|
||||
import java.util.Arrays;
|
||||
import java.util.Collection;
|
||||
import java.util.HashMap;
|
||||
import java.util.LinkedList;
|
||||
import java.util.List;
|
||||
@ -378,20 +379,6 @@ public class ReferenceManifestDetailsPageController
|
||||
data.put("associatedRim", support.getAssociatedRim());
|
||||
data.put("rimType", support.getRimType());
|
||||
data.put("tagId", support.getTagId());
|
||||
boolean crtm = false;
|
||||
boolean bootManager = false;
|
||||
boolean osLoader = false;
|
||||
boolean osKernel = false;
|
||||
boolean acpiTables = false;
|
||||
boolean smbiosTables = false;
|
||||
boolean gptTable = false;
|
||||
boolean bootOrder = false;
|
||||
boolean defaultBootDevice = false;
|
||||
boolean secureBoot = false;
|
||||
boolean pk = false;
|
||||
boolean kek = false;
|
||||
boolean sigDb = false;
|
||||
boolean forbiddenDbx = false;
|
||||
|
||||
TCGEventLog logProcessor = new TCGEventLog(support.getRimBytes());
|
||||
LinkedList<TpmPcrEvent> tpmPcrEvents = new LinkedList<>();
|
||||
@ -417,8 +404,29 @@ public class ReferenceManifestDetailsPageController
|
||||
data.put("events", logProcessor.getEventList());
|
||||
}
|
||||
|
||||
getEventSummary(data, logProcessor.getEventList());
|
||||
return data;
|
||||
}
|
||||
|
||||
private static void getEventSummary(final HashMap<String, Object> data,
|
||||
final Collection<TpmPcrEvent> eventList) {
|
||||
boolean crtm = false;
|
||||
boolean bootManager = false;
|
||||
boolean osLoader = false;
|
||||
boolean osKernel = false;
|
||||
boolean acpiTables = false;
|
||||
boolean smbiosTables = false;
|
||||
boolean gptTable = false;
|
||||
boolean bootOrder = false;
|
||||
boolean defaultBootDevice = false;
|
||||
boolean secureBoot = false;
|
||||
boolean pk = false;
|
||||
boolean kek = false;
|
||||
boolean sigDb = false;
|
||||
boolean forbiddenDbx = false;
|
||||
|
||||
String contentStr;
|
||||
for (TpmPcrEvent tpe : logProcessor.getEventList()) {
|
||||
for (TpmPcrEvent tpe : eventList) {
|
||||
contentStr = tpe.getEventContentStr();
|
||||
// check for specific events
|
||||
if (contentStr.contains("CRTM")) {
|
||||
@ -471,8 +479,6 @@ public class ReferenceManifestDetailsPageController
|
||||
data.put("kek", kek);
|
||||
data.put("sigDb", sigDb);
|
||||
data.put("forbiddenDbx", forbiddenDbx);
|
||||
|
||||
return data;
|
||||
}
|
||||
|
||||
/**
|
||||
@ -503,10 +509,11 @@ public class ReferenceManifestDetailsPageController
|
||||
|
||||
data.put("supportFilename", "Blank");
|
||||
data.put("supportId", "");
|
||||
data.put("baseId", "");
|
||||
data.put("associatedRim", "");
|
||||
data.put("rimType", measurements.getRimType());
|
||||
data.put("hostName", measurements.getDeviceName());
|
||||
data.put("validationResult", measurements.getOverallValidationResult());
|
||||
data.put("swidBase", true);
|
||||
|
||||
if (measurements.getDeviceName() != null) {
|
||||
digestRecords = referenceDigestManager
|
||||
@ -532,7 +539,7 @@ public class ReferenceManifestDetailsPageController
|
||||
data.put("tagId", baseSupport.getTagId());
|
||||
|
||||
if (base != null) {
|
||||
data.put("baseId", base.getId());
|
||||
data.put("associatedRim", base.getId());
|
||||
}
|
||||
}
|
||||
}
|
||||
@ -587,7 +594,10 @@ public class ReferenceManifestDetailsPageController
|
||||
data.put("eventTypeMap", baselineLogEvents);
|
||||
}
|
||||
|
||||
TCGEventLog logProcessor = new TCGEventLog(measurements.getRimBytes());
|
||||
data.put("livelogEvents", livelogEvents);
|
||||
data.put("events", logProcessor.getEventList());
|
||||
getEventSummary(data, logProcessor.getEventList());
|
||||
|
||||
return data;
|
||||
}
|
||||
|
||||
@ -114,7 +114,7 @@
|
||||
<div>Not Before: <span>${initialData.beginValidity}</span></div>
|
||||
<div>Not After: <span>${initialData.endValidity}</span></div>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
</c:if>
|
||||
<div class="row">
|
||||
<div class="col-md-1 col-md-offset-1"><span class="colHeader">Signature</span></div><div id="signatureSection" class="col col-md-8">
|
||||
@ -736,7 +736,7 @@
|
||||
<span class="fieldHeader">Name:</span>
|
||||
<span class="fieldValue">${property.getPropertyName()}</span><br/>
|
||||
<span class="fieldHeader">Value:</span>
|
||||
<span class="fieldValue">${property.getPropertyValue()}</span><br/>
|
||||
<span class="fieldValue" style="word-wrap: break-word">${property.getPropertyValue()}</span><br/>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
@ -27,16 +27,23 @@
|
||||
<c:choose>
|
||||
<c:when test="${initialData.rimType=='Support' || (initialData.rimType=='Measurement' && initialData.validationResult=='PASS')}">
|
||||
<div class="row">
|
||||
<div class="col-md-1 col-md-offset-1"><span class="colHeader">Base RIM</span></div>
|
||||
<div class="col-md-1 col-md-offset-1"><span class="colHeader">Additional<br />RIM Info</span></div>
|
||||
<div id="baseRim" class="col col-md-8">
|
||||
<c:choose>
|
||||
<c:when test="${not empty initialData.associatedRim}">
|
||||
<a href="${portal}/rim-details?id=${initialData.associatedRim}">
|
||||
${initialData.tagId}
|
||||
</a>
|
||||
<c:if test="${not empty initialData.hostName}">
|
||||
<div>Device: <span>${initialData.hostName}</span></div>
|
||||
</c:if>
|
||||
<c:if test="${not empty initialData.supportId}">
|
||||
<div>Support: <span><a href="${portal}/rim-details?id=${initialData.supportId}">${initialData.supportFilename}</a></span>
|
||||
</div>
|
||||
</c:if>
|
||||
</c:when>
|
||||
<c:otherwise>
|
||||
<div class="component col col-md-10" style="color: red; padding-left: 20px">Base RIM not uploaded from the ACA RIM Page</div>
|
||||
<div class="component col col-md-10" style="color: red; padding-left: 20px">RIM not uploaded from the ACA RIM Page</div>
|
||||
</c:otherwise>
|
||||
</c:choose>
|
||||
</div>
|
||||
@ -242,11 +249,11 @@
|
||||
<div class="col-md-1 col-md-offset-1"><span class="colHeader">Base/Support</span></div>
|
||||
<div id="measurements" class="col col-md-8">
|
||||
<c:if test="${not empty initialData.hostName}">
|
||||
<div><span>${initialData.hostName}</span>
|
||||
<div>Device: <span>${initialData.hostName}</span>
|
||||
</div>
|
||||
</c:if>
|
||||
<c:if test="${not empty initialData.tagId}">
|
||||
<div>Base: <span><a href="${portal}/rim-details?id=${initialData.baseId}">${initialData.tagId}</a></span>
|
||||
<div>Base: <span><a href="${portal}/rim-details?id=${initialData.associatedRim}">${initialData.tagId}</a></span>
|
||||
</div>
|
||||
</c:if>
|
||||
<c:if test="${not empty initialData.supportId}">
|
||||
@ -273,7 +280,7 @@
|
||||
<div style="display: flex;">
|
||||
<div class="mappedButton">
|
||||
Baseline Events of Type:<br />
|
||||
<a role="button" data-toggle="collapse" href="#eventContent${iterator}">${lEvent.getEventTypeString()}</a>
|
||||
<span style="word-wrap: break-word"><a role="button" data-toggle="collapse" href="#eventContent${iterator}">${lEvent.getEventTypeString()}</a></span>
|
||||
</div>
|
||||
<div id="eventContent${iterator}" class="panel-collapse collapse in" style="flex: 2">
|
||||
<c:forEach items="${initialData.eventTypeMap}" var="mappedDigest">
|
||||
|
||||
Loading…
x
Reference in New Issue
Block a user