diff --git a/HIRS_AttestationCAPortal/src/main/webapp/WEB-INF/jsp/policy.jsp b/HIRS_AttestationCAPortal/src/main/webapp/WEB-INF/jsp/policy.jsp index a4e3409f..677d3eb0 100644 --- a/HIRS_AttestationCAPortal/src/main/webapp/WEB-INF/jsp/policy.jsp +++ b/HIRS_AttestationCAPortal/src/main/webapp/WEB-INF/jsp/policy.jsp @@ -12,6 +12,22 @@ diff --git a/HIRS_Utils/src/main/java/hirs/validation/SupplyChainCredentialValidator.java b/HIRS_Utils/src/main/java/hirs/validation/SupplyChainCredentialValidator.java index fca96339..dcc0e74d 100644 --- a/HIRS_Utils/src/main/java/hirs/validation/SupplyChainCredentialValidator.java +++ b/HIRS_Utils/src/main/java/hirs/validation/SupplyChainCredentialValidator.java @@ -55,6 +55,7 @@ import java.util.stream.Collectors; import static hirs.data.persist.AppraisalStatus.Status.ERROR; import static hirs.data.persist.AppraisalStatus.Status.FAIL; import static hirs.data.persist.AppraisalStatus.Status.PASS; +import org.apache.logging.log4j.util.Strings; /** @@ -450,11 +451,13 @@ public final class SupplyChainCredentialValidator implements CredentialValidator .collect(Collectors.toList()); String paccorOutputString = deviceInfoReport.getPaccorOutputString(); + String unmatchedComponents; try { List componentInfoList = getComponentInfoFromPaccorOutput(paccorOutputString); - fieldValidation &= validateV2p0PlatformCredentialComponentsExpectingExactMatch( + unmatchedComponents = validateV2p0PlatformCredentialComponentsExpectingExactMatch( validPcComponents, componentInfoList); + fieldValidation &= unmatchedComponents.isEmpty(); } catch (IOException e) { final String baseErrorMessage = "Error parsing JSON output from PACCOR: "; LOGGER.error(baseErrorMessage + e.toString()); @@ -463,7 +466,8 @@ public final class SupplyChainCredentialValidator implements CredentialValidator } if (!fieldValidation) { - resultMessage.append("There are unmatched components\n"); + resultMessage.append("There are unmatched components:\n"); + resultMessage.append(unmatchedComponents); } passesValidation &= fieldValidation; @@ -485,7 +489,7 @@ public final class SupplyChainCredentialValidator implements CredentialValidator * @param allDeviceInfoComponents the device info report components * @return true if validation passes */ - private static boolean validateV2p0PlatformCredentialComponentsExpectingExactMatch( + private static String validateV2p0PlatformCredentialComponentsExpectingExactMatch( final List untrimmedPcComponents, final List allDeviceInfoComponents) { // For each manufacturer listed in the platform credential, create two lists: @@ -559,8 +563,7 @@ public final class SupplyChainCredentialValidator implements CredentialValidator = deviceInfoComponentsFromManufacturer.stream() .filter(componentInfo -> StringUtils.isNotEmpty(componentInfo.getComponentSerial())) - .filter(componentInfo - -> componentInfo.getComponentSerial() + .filter(componentInfo -> componentInfo.getComponentSerial() .equals(pcComponent.getComponentSerial().getString())) .findFirst(); @@ -589,10 +592,8 @@ public final class SupplyChainCredentialValidator implements CredentialValidator : pcComponentsFromManufacturerWithRevision) { Optional first = deviceInfoComponentsFromManufacturer.stream() - .filter(info - -> StringUtils.isNotEmpty(info.getComponentRevision())) - .filter(info - -> info.getComponentRevision() + .filter(info -> StringUtils.isNotEmpty(info.getComponentRevision())) + .filter(info -> info.getComponentRevision() .equals(pcComponent.getComponentRevision().getString())) .findFirst(); @@ -624,18 +625,21 @@ public final class SupplyChainCredentialValidator implements CredentialValidator } if (!pcUnmatchedComponents.isEmpty()) { - LOGGER.error(String.format( - "Platform Credential contained %d unmatched components:", + StringBuilder sb = new StringBuilder(); + LOGGER.error(String.format("Platform Credential contained %d unmatched components:", pcUnmatchedComponents.size())); int umatchedComponentCounter = 1; for (ComponentIdentifier unmatchedComponent : pcUnmatchedComponents) { LOGGER.error("Unmatched component " + umatchedComponentCounter++ + ": " + unmatchedComponent); + sb.append(String.format("Manufacturer=%s, Model=%s%n", + unmatchedComponent.getComponentManufacturer(), + unmatchedComponent.getComponentModel())); } - return false; + return sb.toString(); } - return true; + return Strings.EMPTY; } /** diff --git a/HIRS_Utils/src/test/java/hirs/validation/SupplyChainCredentialValidatorTest.java b/HIRS_Utils/src/test/java/hirs/validation/SupplyChainCredentialValidatorTest.java index 61af4f5c..2be1db33 100644 --- a/HIRS_Utils/src/test/java/hirs/validation/SupplyChainCredentialValidatorTest.java +++ b/HIRS_Utils/src/test/java/hirs/validation/SupplyChainCredentialValidatorTest.java @@ -491,7 +491,7 @@ public class SupplyChainCredentialValidatorTest { + "Platform model did not match\n" + "Platform version did not match\n" + "Platform serial did not match\n" - + "There are unmatched components\n"; + + "There are unmatched components:\n"; AppraisalStatus result = supplyChainCredentialValidator.validatePlatformCredentialAttributes( @@ -1112,7 +1112,8 @@ public class SupplyChainCredentialValidatorTest { + "Platform model did not match\n" + "Platform version did not match\n" + "Platform serial did not match\n" - + "There are unmatched components\n"; + + "There are unmatched components:\n" + + "Manufacturer=Intel, Model=platform2018\n"; AppraisalStatus result = supplyChainCredentialValidator.validatePlatformCredentialAttributes( @@ -1239,7 +1240,7 @@ public class SupplyChainCredentialValidatorTest { + "Platform model did not match\n" + "Platform version did not match\n" + "Platform serial did not match\n" - + "There are unmatched components\n"; + + "There are unmatched components:\n"; AppraisalStatus result = supplyChainCredentialValidator.validatePlatformCredentialAttributes( @@ -1755,7 +1756,8 @@ public class SupplyChainCredentialValidatorTest { deviceInfoReport); Assert.assertEquals(result.getAppStatus(), AppraisalStatus.Status.FAIL); Assert.assertEquals(result.getMessage(), "Component manufacturer is empty\n" - + "There are unmatched components\n"); + + "There are unmatched components:\n" + + "Manufacturer=, Model=Core i7\n"); platformCredential = setupMatchingPlatformCredential(deviceInfoReport); result = SupplyChainCredentialValidator @@ -1810,7 +1812,8 @@ public class SupplyChainCredentialValidatorTest { .validatePlatformCredentialAttributesV2p0(platformCredential, deviceInfoReport); Assert.assertEquals(result.getAppStatus(), AppraisalStatus.Status.FAIL); - Assert.assertEquals(result.getMessage(), "There are unmatched components\n"); + Assert.assertEquals(result.getMessage(), "There are unmatched components:\n" + + "Manufacturer=ACME, Model=TNT\n"); } /** @@ -1872,7 +1875,8 @@ public class SupplyChainCredentialValidatorTest { deviceInfoReport); Assert.assertEquals(result.getAppStatus(), AppraisalStatus.Status.FAIL); Assert.assertEquals(result.getMessage(), "Component manufacturer is empty\n" - + "There are unmatched components\n"); + + "There are unmatched components:\n" + + "Manufacturer=, Model=Core i7\n"); platformCredential = setupMatchingPlatformCredential(deviceInfoReport); result = SupplyChainCredentialValidator