Commit Graph

112 Commits

Author SHA1 Message Date
Cyrus
c66f4f7648
Merge pull request #334 from nsacyber/Unmatched-component-refactor
Unmatched component refactor
2021-03-09 13:07:16 -05:00
Cyrus
4b6bcccf85 Attempting to merge into master 2021-03-09 13:04:56 -05:00
Cyrus
c4741b869c Removed unused import 2021-03-09 07:27:35 -05:00
Cyrus
85e29529ae Modified a catch clause 2021-03-09 06:46:51 -05:00
Cyrus
bd5bca58ea I have modified the code to correct handle the situation in which the device has more components than the certificate and I have taken steps to make the system test GOOD pass for test A6, A7 and A8. 2021-03-05 15:36:29 -05:00
Cyrus
763dcbd975 These are changes that were made in the system-tests-test that resolved the issues in the first TPM 2.0 system tests on travis. 2021-03-04 08:01:18 -05:00
Cyrus
8a571f1788 When a delta has the component that is bad, not the base, it wasn't highlighting. This is because the component failures wasn't be updated and then the certificate needed to be updated as well. 2021-02-25 06:59:56 -05:00
Cyrus
a5184f5a5b Final changes that adds in the additional setting for the renewal period threshold. This value indicates that if the end validity has been reached for the current issued attestation certificate, then don't generate one. However if we are within the number of days set by the threshold, then generate the certificate before it expires. The default is 1 year from the end validity. 2021-02-23 10:17:56 -05:00
Cyrus
dcf0ec8101 Merge branch 'master' into aic-policy-rule 2021-02-11 14:13:28 -05:00
Cyrus
7912ff2f2e refactored some code around the SCV objects that should never be null. 2021-02-10 12:24:00 -05:00
Cyrus
9917fadef7 On a previous commit, I removed a piece of code that checked the base credential first. Because the delta fixed a problem in the base, the base failed before the delta was checked. This was completely removed. On a test that we had previously done, the test passes when it should fail because there is only a base, so that check isn't being done. This change reintroduces the check but in a different location with flags for when there is a delta present. 2021-02-09 13:30:37 -05:00
Cyrus
7b79ceb07a Found the issue with the component being removed that doesn't have a proper serial number and adding one with it. The code was revalidating the base in the attributes enabled flag. This was unncessary. 2021-02-08 14:25:10 -05:00
Cyrus
4999c96685 Updated code to correct situations that were not linking up with properly for delta and platform certificate component validation. 2021-02-05 16:10:15 -05:00
Cyrus
677716fa08 Merge branch 'master' into Unmatched-component-refactor 2021-02-04 08:51:31 -05:00
Cyrus
5589096443 Cleaned up some stuff I found during code compare in github. 2021-01-20 13:23:51 -05:00
chubtub
88015df551 Checkstyle: unused import 2021-01-14 13:19:17 -05:00
Cyrus
859fdbef83 Added a null check for the platformCredentials in the issued certificate attribute helper so that NPEs aren't thrown. 2021-01-14 12:48:53 -05:00
Cyrus
164a43f056 These are unit tests that were not run on the merge request #327 for issue 308. The unit tests uses certificate (EC and 2 CAs) that don't match for SKI to AKI or issuer string fields. The O= field isn't required and the code in #327 was changed to use SKI first then a sorted RDN list. See #327. A note was left in the unit tests that the test certs need to be updated.` 2021-01-14 12:41:29 -05:00
Cyrus
beb1ccbee3 Updated a supply chain validation check for delta certificates. Updated the check for duplicate base platform certificates when storing them for the same device and updated the begin validity date for the delta vs the base check. 2021-01-12 12:26:54 -05:00
Cyrus
058c58d208 Updated the begin validity date check for the base and delta so that it is only an error if the delta begin date is older than the platform. Equal is allowed. 2021-01-07 12:51:01 -05:00
Cyrus
85254d9c44 Removed null assignment that isn't used 2021-01-05 08:14:18 -05:00
Cyrus
7028810707 This latest push should have the code that'll highlight the components based on a string rather than the serial number. This also adds additional checks for the validity begin date of the delta not matching or being before the base. It also checks that they don't have the same certificate serial number. 2020-12-30 08:41:47 -05:00
Cyrus
6dd948c828 Added a null check for the endorsement credential for the tpm 1.2 2020-12-18 06:58:18 -05:00
Cyrus
a7eae2fd77 Test out an potential exception 2020-12-17 13:09:03 -05:00
Cyrus
f38fa87013 Undid some code I took out 2020-12-17 09:31:39 -05:00
Cyrus
1db52cebf9 This is a stopping point because the code can't be fully worked out because the data (certificates) aren't correct. 2020-12-17 07:24:51 -05:00
Cyrus
62c7ca2d90 This PR is to address issue #308. The ACA was pulling Issuer Certificates using the organization RDN of the subject string and getting this from the issuer string of the EC or PC. This presents a problem because it isn't a required field. The organization field cannot be null or empty. Pulling objects from a DB using null or empty would produce bad results. The main change of this issue (which has not been full tested) is pulling using the AKI for the db lookup. If this fails, instead of falling back on potentially left out fields like the O= RDN, the ACA takes the issuer/subject fields, breaks them apart and sorts them based on the key. It also changes the case. This way the lookup can be assured to match in case of some random situation in which the issuer or subject field don't match because RDN keys are just in different positions of the string. 2020-12-11 14:47:46 -05:00
Cyrus
209024c12a Cleaned up some comments and code. 2020-12-07 09:47:54 -05:00
Cyrus
a3de35ed27 The issue with the tpm 1.2 system test failing had to do with the string to integer conversion using getInteger instead of parseInt. 2020-12-07 07:44:48 -05:00
Cyrus
11f238f671 Testing system tests 2020-12-04 08:36:42 -05:00
Cyrus
e64c6cf772 Merge branch 'master' into aic-policy-rule 2020-12-03 13:34:29 -05:00
Cyrus
e32e9412d8 Merge branch 'master' into Unmatched-component-refactor 2020-12-03 13:20:12 -05:00
Cyrus
a07fbbd847 In a previous pull request, the reference manifest manager was not called to update the unarchived base rim. So it appears to never have been uploaded. 2020-12-02 11:46:42 -05:00
Cyrus
7d49f63a9b Merge branch 'master' into multiple-rim-upload 2020-12-02 11:05:12 -05:00
Cyrus
70662bddec Updated how the bios measurement file is uploaded. Changed the code to pull the string from the properties file instead of a hard link in the code. 2020-12-01 11:13:41 -05:00
Cyrus
9534d6650f Merge branch 'master' into platform_cert_missing_fix 2020-12-01 09:47:45 -05:00
Cyrus
a32d3a5f02 Remove comments 2020-12-01 09:46:05 -05:00
Cyrus
6eefb393a3 Updated the code to pull all the files from a swid tag file directory and a rim log file directory, instead of a single file. 2020-11-30 14:16:57 -05:00
Cyrus
857f1eb0ff There was a pull for an object that would be null without any RIMs uploaded. 2020-11-30 10:11:25 -05:00
Cyrus
749a3a2317 When the provisioner sends the rim swidtag and the rimel and they already exists in the db but are archived, they don't unarchive them so they never show up on the RIM page. This change fixes that. 2020-11-25 10:06:56 -05:00
Cyrus
9433c97dc9 The code now uses a combination of the class value and the platform manufacturer and model to identify mismatches. This now highlights the failured components 2020-11-25 08:02:45 -05:00
Cyrus
fbdcf83840 Continued refactoring to update the failed components part of the attribute validation. The delta mapping needs to be reworked to not use serials. 2020-11-23 14:46:29 -05:00
Cyrus
2b41720ded Merge branch 'master' into update-component-failure-highlight 2020-11-17 15:24:27 -05:00
Cyrus
ea03737234 Testing travis 2020-11-16 14:49:53 -05:00
Cyrus
4291059142 Updated the break line option for failed string during firmware validation. 2020-11-16 12:39:57 -05:00
Cyrus
3a3919d9bc Added null checks for the SupplyChainPolicy object 2020-11-13 08:41:33 -05:00
Cyrus
6eeb630a75 This PR addresses the bugs identified in #314. Due to previous changes to the RIM upload process, the suppor RIM was not being updated properly when manually uploaded.
Closes #314
2020-11-12 13:45:38 -05:00
Cyrus
67b70a386d Added method to combine the manufacturer and the model as an identifier for the component. 2020-11-10 10:04:46 -05:00
Cyrus
e8f5107137 Updating code to use a different format for identifying failed components. 2020-11-09 13:59:19 -05:00
Cyrus
967d9a0030 Merge branch 'master' into aic-policy-rule 2020-11-09 07:24:33 -05:00