ExternalVendorCode/HIRS
1
0
Fork 0
mirror of https://github.com/nsacyber/HIRS.git synced 2024-12-21 13:57:56 +00:00
Code Issues Actions 3 Packages Projects Releases Wiki Activity

Updated the code to now display the var swidtag and rimel. However there are issues with the examples. This commit has fixes for how the pcr values are pulled for display on the base RIM page.

Browse Source
This commit is contained in:
Cyrus 2021-04-02 06:34:47 -04:00
parent 4911742c7a
commit ea5b85b703
5 changed files with 107 additions and 90 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

106
HIRS_AttestationCA/src/main/java/hirs/attestationca/AbstractAttestationCertificateAuthority.java
View File

@ -94,11 +94,9 @@ import java.security.interfaces.RSAPublicKey;
import java.security.spec.InvalidKeySpecException; import java.security.spec.InvalidKeySpecException;
import java.security.spec.MGF1ParameterSpec; import java.security.spec.MGF1ParameterSpec;
import java.security.spec.RSAPublicKeySpec; import java.security.spec.RSAPublicKeySpec;
import java.util.ArrayList;
import java.util.Calendar; import java.util.Calendar;
import java.util.Date; import java.util.Date;
import java.util.HashSet; import java.util.HashSet;
import java.util.List;
import java.util.Set; import java.util.Set;
import java.util.regex.Matcher; import java.util.regex.Matcher;
import java.util.regex.Pattern; import java.util.regex.Pattern;
@ -773,10 +771,10 @@ public abstract class AbstractAttestationCertificateAuthority
} }
// check for RIM Base and Support files, if they don't exists in the database, load them // check for RIM Base and Support files, if they don't exists in the database, load them
String clientName = String.format("%s_%s", String defaultClientName = String.format("%s_%s",
dv.getHw().getManufacturer(), dv.getHw().getManufacturer(),
dv.getHw().getProductName()); dv.getHw().getProductName());
ReferenceManifest dbBaseRim = null; BaseReferenceManifest dbBaseRim = null;
ReferenceManifest support; ReferenceManifest support;
EventLogMeasurements measurements; EventLogMeasurements measurements;
String tagId = ""; String tagId = "";
@ -805,19 +803,21 @@ public abstract class AbstractAttestationCertificateAuthority
if (support == null) { if (support == null) {
support = new SupportReferenceManifest( support = new SupportReferenceManifest(
String.format("%s.rimel", String.format("%s.rimel",
clientName), defaultClientName),
logFile.toByteArray()); logFile.toByteArray());
support.setPlatformManufacturer(dv.getHw().getManufacturer()); support.setPlatformManufacturer(dv.getHw().getManufacturer());
support.setPlatformModel(dv.getHw().getProductName()); support.setPlatformModel(dv.getHw().getProductName());
support.setFileName(String.format("%s_[%s].rimel", clientName, support.setFileName(String.format("%s_[%s].rimel", defaultClientName,
support.getRimHash().substring( support.getRimHash().substring(
support.getRimHash().length() - NUM_OF_VARIABLES))); support.getRimHash().length() - NUM_OF_VARIABLES)));
this.referenceManifestManager.save(support); this.referenceManifestManager.save(support);
} else { } else {
LOG.info("Client provided Support RIM already loaded in database."); LOG.info("Client provided Support RIM already loaded in database.");
support.restore(); if (support.isArchived()) {
support.resetCreateTime(); support.restore();
this.referenceManifestManager.update(support); support.resetCreateTime();
this.referenceManifestManager.update(support);
}
} }
} catch (IOException ioEx) { } catch (IOException ioEx) {
LOG.error(ioEx); LOG.error(ioEx);
@ -827,9 +827,9 @@ public abstract class AbstractAttestationCertificateAuthority
LOG.warn("Device did not send support RIM file..."); LOG.warn("Device did not send support RIM file...");
} }
List<String> archie = new ArrayList<>();
if (dv.getSwidfileCount() > 0) { if (dv.getSwidfileCount() > 0) {
for (ByteString swidFile : dv.getSwidfileList()) { for (ByteString swidFile : dv.getSwidfileList()) {
fileName = "";
try { try {
dbBaseRim = BaseReferenceManifest.select(referenceManifestManager) dbBaseRim = BaseReferenceManifest.select(referenceManifestManager)
.includeArchived() .includeArchived()
@ -838,91 +838,79 @@ public abstract class AbstractAttestationCertificateAuthority
.getRIM(); .getRIM();
if (dbBaseRim == null) { if (dbBaseRim == null) {
/**
* This has to change, each log file can't have the same name
*/
dbBaseRim = new BaseReferenceManifest( dbBaseRim = new BaseReferenceManifest(
String.format("%s.swidtag", String.format("%s.swidtag",
clientName), defaultClientName),
swidFile.toByteArray()); swidFile.toByteArray());
BaseReferenceManifest base = (BaseReferenceManifest) dbBaseRim; // get file name to use
for (SwidResource swid : base.parseResource()) { for (SwidResource swid : dbBaseRim.parseResource()) {
matcher = pattern.matcher(swid.getName()); matcher = pattern.matcher(swid.getName());
if (matcher.matches()) { if (matcher.matches()) {
//found the file name //found the file name
int dotIndex = swid.getName().lastIndexOf("."); int dotIndex = swid.getName().lastIndexOf(".");
clientName = swid.getName().substring(0, dotIndex); fileName = swid.getName().substring(0, dotIndex);
dbBaseRim = new BaseReferenceManifest( dbBaseRim = new BaseReferenceManifest(
String.format("%s.swidtag", String.format("%s.swidtag",
clientName), fileName),
swidFile.toByteArray()); swidFile.toByteArray());
} }
// now update support rim // now update support rim
SupportReferenceManifest dbSupport = SupportReferenceManifest SupportReferenceManifest dbSupport = SupportReferenceManifest
.select(referenceManifestManager) .select(referenceManifestManager)
.byRimHash(swid.getHashValue()).getRIM(); .byRimHash(swid.getHashValue()).getRIM();
if (dbSupport == null) {
LOG.error("Why is this happening?");
// I could do this, and then when the actual
// support comes in just update the byte field
}
if (dbSupport != null && !dbSupport.isUpdated()) { if (dbSupport != null && !dbSupport.isUpdated()) {
LOG.error("We found the old support");
dbSupport.setFileName(swid.getName()); dbSupport.setFileName(swid.getName());
dbSupport.setSwidTagVersion(base.getSwidTagVersion()); dbSupport.setSwidTagVersion(dbBaseRim.getSwidTagVersion());
// I might create a get for the bytes of the swidtag file // I might create a get for the bytes of the swidtag file
// so that I can set that instead of the rim ID // so that I can set that instead of the rim ID
dbSupport.setTagId(base.getTagId()); dbSupport.setTagId(dbBaseRim.getTagId());
dbSupport.setSwidTagVersion(dbBaseRim.getSwidTagVersion());
dbSupport.setSwidVersion(dbBaseRim.getSwidVersion());
dbSupport.setSwidPatch(dbBaseRim.isSwidPatch()); dbSupport.setSwidPatch(dbBaseRim.isSwidPatch());
dbSupport.setSwidSupplemental(dbBaseRim.isSwidSupplemental()); dbSupport.setSwidSupplemental(dbBaseRim.isSwidSupplemental());
// might want to expand so that the record digest value know dbBaseRim.setAssociatedRim(dbSupport.getId());
// if it was a patch or supplemental
dbSupport.setUpdated(true); dbSupport.setUpdated(true);
this.referenceManifestManager.update(dbSupport); this.referenceManifestManager.update(dbSupport);
break;
} }
} }
this.referenceManifestManager.save(dbBaseRim); this.referenceManifestManager.save(dbBaseRim);
} else { } else {
LOG.error("Client provided Base RIM already loaded in database."); LOG.info("Client provided Base RIM already loaded in database.");
dbBaseRim.restore(); /**
dbBaseRim.resetCreateTime(); * Leaving this as is for now, however can there be a condition
this.referenceManifestManager.update(dbBaseRim); * in which the provisioner sends swidtags without support rims?
*/
if (dbBaseRim.isArchived()) {
dbBaseRim.restore();
dbBaseRim.resetCreateTime();
this.referenceManifestManager.update(dbBaseRim);
}
} }
tagId = dbBaseRim.getTagId();
} catch (IOException ioEx) { } catch (IOException ioEx) {
LOG.error(ioEx); LOG.error(ioEx);
} }
} }
for (ByteString swidFile : dv.getSwidfileList()) {
String hashStr = swidFile.toString();
LOG.error(SupportReferenceManifest.select(referenceManifestManager)
.includeArchived()
.byHashCode(Hex.encodeHexString(messageDigest.digest(
swidFile.toByteArray())))
.getRIM());
}
} else { } else {
LOG.warn("Device did not send swid tag file..."); LOG.warn("Device did not send swid tag file...");
} }
if (true) { Set<SupportReferenceManifest> dbSupportRims = SupportReferenceManifest
Set<SupportReferenceManifest> dbSupportRims = SupportReferenceManifest
.select(referenceManifestManager).getRIMs(); .select(referenceManifestManager).getRIMs();
for (SupportReferenceManifest dbSupport : dbSupportRims) { for (SupportReferenceManifest dbSupport : dbSupportRims) {
// all of this has to be moved somewhere else /**
/** * Because the log file we get isn't promised to be the baseline support rim.
* Because the log file we get isn't promised to be the baseline support rim. * If it is a patch of supplemental we have to check that the baseline
* If it is a patch of supplemental we have to check that the baseline * has been done
* has been done * and those entries can't become the baseline
* and those entries can't become the baseline *
* * However, we don't know which log file is what until we link them to a swidtag
* However, we don't know which log file is what until we link them to a swidtag */
*/ if (!dbSupport.isSwidPatch() && !dbSupport.isSwidSupplemental()) {
ReferenceDigestRecord dbObj = new ReferenceDigestRecord(dbSupport, ReferenceDigestRecord dbObj = new ReferenceDigestRecord(dbSupport,
hw.getManufacturer(), hw.getProductName()); hw.getManufacturer(), hw.getProductName());
// this is where we update or create the log // this is where we update or create the log
@ -952,13 +940,19 @@ public abstract class AbstractAttestationCertificateAuthority
e.printStackTrace(); e.printStackTrace();
} }
} }
} else {
// what to do about patch and supplemental
LOG.error(String.format("%s is a patch? %b", dbSupport.getFileName(),
dbSupport.isSwidPatch()));
LOG.error(String.format("%s is a supplemental? %b", dbSupport.getFileName(),
dbSupport.isSwidSupplemental()));
} }
} }
if (dv.hasLivelog()) { if (dv.hasLivelog()) {
LOG.info("Device sent bios measurement log..."); LOG.info("Device sent bios measurement log...");
fileName = String.format("%s.measurement", fileName = String.format("%s.measurement",
clientName); defaultClientName);
try { try {
// find previous version. If it exists, delete it // find previous version. If it exists, delete it
measurements = EventLogMeasurements.select(referenceManifestManager) measurements = EventLogMeasurements.select(referenceManifestManager)

33
HIRS_AttestationCAPortal/src/main/java/hirs/attestationca/portal/page/controllers/ReferenceManifestDetailsPageController.java
View File

@ -99,7 +99,9 @@ public class ReferenceManifestDetailsPageController
LOGGER.error(uuidError, iaEx); LOGGER.error(uuidError, iaEx);
} catch (Exception ioEx) { } catch (Exception ioEx) {
LOGGER.error(ioEx); LOGGER.error(ioEx);
LOGGER.trace(ioEx); for (StackTraceElement ste : ioEx.getStackTrace()) {
LOGGER.debug(ste.toString());
}
} }
if (data.isEmpty()) { if (data.isEmpty()) {
String notFoundMessage = "Unable to find RIM with ID: " + params.getId(); String notFoundMessage = "Unable to find RIM with ID: " + params.getId();
@ -185,8 +187,16 @@ public class ReferenceManifestDetailsPageController
} else { } else {
data.put("swidCorpus", "False"); data.put("swidCorpus", "False");
} }
data.put("swidPatch", baseRim.isSwidPatch()); if (baseRim.isSwidPatch()) {
data.put("swidSupplemental", baseRim.isSwidSupplemental()); data.put("swidPatch", "True");
} else {
data.put("swidPatch", "False");
}
if (baseRim.isSwidSupplemental()) {
data.put("swidSupplemental", "True");
} else {
data.put("swidSupplemental", "False");
}
data.put("swidTagId", baseRim.getTagId()); data.put("swidTagId", baseRim.getTagId());
// Entity // Entity
data.put("entityName", baseRim.getEntityName()); data.put("entityName", baseRim.getEntityName());
@ -195,9 +205,16 @@ public class ReferenceManifestDetailsPageController
data.put("entityThumbprint", baseRim.getEntityThumbprint()); data.put("entityThumbprint", baseRim.getEntityThumbprint());
// Link // Link
data.put("linkHref", baseRim.getLinkHref()); data.put("linkHref", baseRim.getLinkHref());
for (BaseReferenceManifest bRim : BaseReferenceManifest
.select(referenceManifestManager).getRIMs()) {
if (baseRim.getLinkHref().contains(bRim.getTagId())) {
data.put("linkHrefLink", bRim.getId().toString());
break;
} else {
data.put("linkHrefLink", "");
}
}
data.put("linkRel", baseRim.getLinkRel()); data.put("linkRel", baseRim.getLinkRel());
data.put("supportRimId", "");
data.put("supportRimTagId", "");
data.put("platformManufacturer", baseRim.getPlatformManufacturer()); data.put("platformManufacturer", baseRim.getPlatformManufacturer());
data.put("platformManufacturerId", baseRim.getPlatformManufacturerId()); data.put("platformManufacturerId", baseRim.getPlatformManufacturerId());
data.put("platformModel", baseRim.getPlatformModel()); data.put("platformModel", baseRim.getPlatformModel());
@ -216,7 +233,7 @@ public class ReferenceManifestDetailsPageController
List<SwidResource> resources = baseRim.parseResource(); List<SwidResource> resources = baseRim.parseResource();
TCGEventLog logProcessor = null; TCGEventLog logProcessor = null;
ReferenceManifest support = null; SupportReferenceManifest support = null;
if (baseRim.getAssociatedRim() == null) { if (baseRim.getAssociatedRim() == null) {
support = SupportReferenceManifest.select(referenceManifestManager) support = SupportReferenceManifest.select(referenceManifestManager)
@ -249,6 +266,10 @@ public class ReferenceManifestDetailsPageController
data.put("associatedRim", baseRim.getAssociatedRim()); data.put("associatedRim", baseRim.getAssociatedRim());
data.put("swidFiles", resources); data.put("swidFiles", resources);
if (support != null && (!baseRim.isSwidSupplemental()
&& !baseRim.isSwidPatch())) {
data.put("pcrList", support.getExpectedPCRList());
}
RIM_VALIDATOR.validateXmlSignature(new ByteArrayInputStream(baseRim.getRimBytes())); RIM_VALIDATOR.validateXmlSignature(new ByteArrayInputStream(baseRim.getRimBytes()));
data.put("signatureValid", RIM_VALIDATOR.isSignatureValid()); data.put("signatureValid", RIM_VALIDATOR.isSignatureValid());

16
HIRS_AttestationCAPortal/src/main/webapp/WEB-INF/jsp/rim-details.jsp
View File

@ -326,7 +326,7 @@
<div class="col-md-1 col-md-offset-1"><span class="colHeader">Link</span></div> <div class="col-md-1 col-md-offset-1"><span class="colHeader">Link</span></div>
<div id="link" class="col col-md-8"> <div id="link" class="col col-md-8">
<c:if test="${not empty initialData.linkHref}"> <c:if test="${not empty initialData.linkHref}">
<div><span><a href="${initialData.linkHref}" rel="${initialData.linkRel}">${initialData.linkHref}</a></span> <div><span><a href="${portal}/rim-details?id=${initialData.linkHrefLink}" rel="${initialData.linkRel}">${initialData.linkHref}</a></span>
</div> </div>
<div>Rel:&nbsp;<span>${initialData.linkRel}</span> <div>Rel:&nbsp;<span>${initialData.linkRel}</span>
</div> </div>
@ -410,7 +410,7 @@
</span> </span>
</div> </div>
<c:choose> <c:choose>
<c:when test="${not empty resource.getPcrValues()}"> <c:when test="${not empty initialData.pcrList}">
<div class="component col col-md-10"> <div class="component col col-md-10">
<span class="fieldHeader">File Size:</span> <span class="fieldHeader">File Size:</span>
<span class="fieldValue">${resource.getSize()}</span><br/> <span class="fieldValue">${resource.getSize()}</span><br/>
@ -428,7 +428,7 @@
<span class="fieldHeader">URI Global:</span> <span class="fieldHeader">URI Global:</span>
<span class="fieldValue">${resource.getRimUriGlobal()}</span><br/> <span class="fieldValue">${resource.getRimUriGlobal()}</span><br/>
</c:if> </c:if>
<c:if test="${not empty resource.getPcrValues()}"> <c:if test="${not empty initialData.pcrList}">
<div class="panel-body"> <div class="panel-body">
<div class="component" role="tab" id="pcrValues"> <div class="component" role="tab" id="pcrValues">
<a role="button" data-toggle="collapse" data-parent="#directorycollapse" class="collapsed" <a role="button" data-toggle="collapse" data-parent="#directorycollapse" class="collapsed"
@ -438,13 +438,15 @@
</div> </div>
<div id="pcrscollapse" class="panel-collapse collapse" role="tabpanel" aria-labelledby="headingThree" aria-expanded="true"> <div id="pcrscollapse" class="panel-collapse collapse" role="tabpanel" aria-labelledby="headingThree" aria-expanded="true">
<div> <div>
<c:forEach items="${resource.getPcrMap()}" var="pcrValue"> <c:set var="count" value="0" scope="page"/>
<c:forEach items="${initialData.pcrList}" var="pcrValue">
<div id="componentIdentifier" class="row"> <div id="componentIdentifier" class="row">
<div> <div>
<span>${pcrValue.key}</span> <span>PCR ${count} - </span>
<span style="overflow-wrap: break-word">${pcrValue.value}</span> <span style="overflow-wrap: break-word">${pcrValue}</span>
</div> </div>
</div> </div>
<c:set var="count" value="${count + 1}" scope="page"/>
</c:forEach> </c:forEach>
</div> </div>
</div> </div>

22
HIRS_Utils/src/main/java/hirs/data/persist/BaseReferenceManifest.java
View File

@ -41,8 +41,6 @@ public class BaseReferenceManifest extends ReferenceManifest {
@Column @Column
private String swidName = null; private String swidName = null;
@Column @Column
private String swidVersion = null;
@Column
private int swidCorpus = 0; private int swidCorpus = 0;
@Column @Column
private String colloquialVersion = null; private String colloquialVersion = null;
@ -157,7 +155,7 @@ public class BaseReferenceManifest extends ReferenceManifest {
this.swidCorpus = si.isCorpus() ? 1 : 0; this.swidCorpus = si.isCorpus() ? 1 : 0;
this.setSwidPatch(si.isPatch()); this.setSwidPatch(si.isPatch());
this.setSwidSupplemental(si.isSupplemental()); this.setSwidSupplemental(si.isSupplemental());
this.swidVersion = si.getVersion(); this.setSwidVersion(si.getVersion());
if (si.getTagVersion() != null) { if (si.getTagVersion() != null) {
this.setSwidTagVersion(si.getTagVersion().toString()); this.setSwidTagVersion(si.getTagVersion().toString());
} }
@ -435,24 +433,6 @@ public class BaseReferenceManifest extends ReferenceManifest {
this.swidName = swidName; this.swidName = swidName;
} }
/**
* Getter for the SWID version.
*
* @return string of the version number
*/
public String getSwidVersion() {
return swidVersion;
}
/**
* Setter for the SWID version.
*
* @param swidVersion string of the version
*/
public void setSwidVersion(final String swidVersion) {
this.swidVersion = swidVersion;
}
/** /**
* Getter for the corpus flag. * Getter for the corpus flag.
* *

20
HIRS_Utils/src/main/java/hirs/data/persist/ReferenceManifest.java
View File

@ -89,6 +89,8 @@ public abstract class ReferenceManifest extends ArchivableEntity {
@Column @Column
private String swidTagVersion = null; private String swidTagVersion = null;
@Column @Column
private String swidVersion = null;
@Column
private String platformModel = null; private String platformModel = null;
@Column(nullable = false) @Column(nullable = false)
private String fileName = null; private String fileName = null;
@ -245,6 +247,24 @@ public abstract class ReferenceManifest extends ArchivableEntity {
this.swidTagVersion = swidTagVersion; this.swidTagVersion = swidTagVersion;
} }
/**
* Getter for the SWID version.
*
* @return string of the version number
*/
public String getSwidVersion() {
return swidVersion;
}
/**
* Setter for the SWID version.
*
* @param swidVersion string of the version
*/
public void setSwidVersion(final String swidVersion) {
this.swidVersion = swidVersion;
}
/** /**
* Getter for the RIM Tag ID. * Getter for the RIM Tag ID.
* *