Cyrus
27e55ab2c7
Updated the RIM details page to search for the associated support rim if
...
the base doesn't have it. This is a temp measure before completing #526 [no ci]
2023-06-29 07:38:57 -04:00
Cyrus
5ff5650be1
Small addition [no ci]
2023-06-29 07:38:57 -04:00
Cyrus
57632e0923
the DN compare of bouncy castle utils throws and exception if the object
...
is null. Added additional condition to the if statement to check null
status.
2023-06-29 07:38:57 -04:00
Cyrus
2d5836b8b6
Merge pull request #541 from nsacyber/v3_filestore-bean-removal
...
Filestore Service Removal
2023-06-23 07:05:37 -04:00
Cyrus
520c18fcdf
This check in updates the code to list the certificates on their
...
specific page, rather than all on any of them. Next will be introducing
the new parsing code for RIM and TLS so that Trust Chains show up [no ci]
2023-06-21 16:12:26 -04:00
Cyrus
17e01d4e72
Removed FileStorageService autowiring
2023-06-16 13:48:12 -04:00
Cyrus
6dbbee1420
Fixed display issue on PlatformCredentials page and included 'fn' tag
...
reference on details pages. Removed additional files that are not being
used. [no ci]
2023-06-16 07:51:30 -04:00
Cyrus
9fe89232a8
Second commit mainly containing new files
2023-06-13 10:12:25 -04:00
Cyrus
3a72583836
First commit with modified files [no ci]
2023-06-13 09:29:29 -04:00
Cyrus
0f8f266569
Missed small updates to imports and implementation lines in the
...
build.gradle. [no ci]
2023-04-26 08:32:45 -04:00
Cyrus
7d9f3d72f4
Updating the branch with additional code. The ACA loads, however
...
trust-chain does not. I backed out x509 Certificate changes. [no ci]
2023-04-21 10:30:51 -04:00
Cyrus
17a8732908
added in finished files
2023-03-06 20:56:34 -05:00
Cyrus
72aa426018
This is a complete refactor. This uses Hibernate 6, Springboot Framework
...
3, Java 17, Jakarta
2023-02-14 07:30:16 -05:00
iadgovuser26
0917b9a872
Merge pull request #460 from nsacyber/issue-448
...
[#448 ] Visual Updates for Firmware Validation
2022-04-29 12:36:26 -04:00
Cyrus
0b91c1e39a
Updated the link from a failed validation to the base rim when the path
...
for the measurement can't be found.
2022-04-04 14:21:44 -04:00
Cyrus
f6bcb0c9ed
Due to some testing, in situations were the client doesn't seen certain
...
files, this causes null pointers
2022-03-24 15:18:34 -04:00
Cyrus
dea58b1f07
The issue was resolved with the code changes. Removing comments
2022-03-21 14:43:52 -04:00
Cyrus
308064089c
Checking git hub action error
2022-03-21 14:29:48 -04:00
Cyrus
6f71f48ad2
Removed comments and updated notes for Patching values
2022-03-21 10:11:23 -04:00
Cyrus
2e26823fc1
Did some testing on manual/curl uploading. This produced an error
...
because device name was being used to pull objects in the validation
quote part of the provision. This was changed. The event log is
deleted each time so that only one event log per device is maintained.
2022-03-21 09:51:32 -04:00
Cyrus
d4c35e09ab
Updated the code to correctly include the supplemental digestvalues in
...
the firmware validation.
2022-03-16 09:06:04 -04:00
iadgovuser26
65471c87f1
Merge pull request #447 from nsacyber/issue-442
...
[#442 ] Provisioning Status Impl
2022-03-02 08:31:32 -05:00
Cyrus
6a8c0f47c0
Removed unused variables
2022-03-02 06:22:58 -05:00
Cyrus
7738a47b99
Updated the provisioner to respond to failed status instead of blank
...
certificates. Updated the proto to use enum instead of bytes
2022-02-28 14:18:48 -05:00
Cyrus
acef2ea5b8
Added the new status for the state of the provision
2022-02-18 10:16:32 -05:00
chubtub
1fced3aa61
Resolve merge conflicts
2022-02-18 09:59:45 -05:00
chubtub
bf989bbee7
Merge branch 'issue-395' of github.com:nsacyber/HIRS into issue-395
2022-02-17 16:55:59 -05:00
Cyrus
470e6eccdf
Refactored the Reference Digest code so that the ReferenceDigestValue
...
table is accessible and upated the contoller for the getOrderedList.
2022-02-17 16:48:08 -05:00
Cyrus
10915bdc3b
Prelminary changes to remove ReferenceDigestRecord as a database object.
2022-02-17 13:11:41 -05:00
Cyrus
6abd87a192
Removed debug statements
2022-02-15 13:43:33 -05:00
Cyrus
99ba840a54
Fixed debug statement
2022-02-15 11:25:25 -05:00
Cyrus
0f839ebd08
This is a test commit. Changes will be removed.
2022-02-15 11:17:07 -05:00
Cyrus
e16f009294
Removed if check for the matching file name of the support RIM from the
...
Base RIMs meta data. Only keying off hash.
2022-02-15 10:03:25 -05:00
Cyrus
caa2a7c55b
Removed the RIM controller tests
2022-02-14 10:26:07 -05:00
Cyrus
fc3f59adce
Updated RIM lookup to use manufacturer and model instead of deviceName
2022-02-11 09:09:39 -05:00
Cyrus
1f2be7ce18
Updated the live log information if the base and support rim are not
...
uploaded together.
2022-02-11 08:01:28 -05:00
Cyrus
2db5b86da1
Some minor updates. Fixed a null pointer exception in the
...
SupplyChainValidationServiceImpl. Updated warnings when files are
missing from the device claim
2022-02-11 07:32:07 -05:00
chubtub
ea6bb48d06
Merge branch 'master' into issue-395
2022-01-27 10:58:16 -05:00
chubtub
c4b6aca667
Merge branch 'issue-395' of github.com:nsacyber/HIRS into issue-395
2022-01-24 14:35:01 -05:00
Cyrus
f503457bd4
Refactored the Reference Digest code so that the ReferenceDigestValue
...
table is accessible and upated the contoller for the getOrderedList.
2022-01-21 06:29:53 -05:00
Cyrus
6d8392da45
Prelminary changes to remove ReferenceDigestRecord as a database object.
2022-01-11 10:02:38 -05:00
Cyrus
5858e36313
Updated the implementation to return a blank identity claim response.
...
The provisioner tests the blob and if it is empty, exit
2022-01-05 16:49:27 -05:00
Cyrus
139e4c8972
Added null pointer check to RDR variable.
2021-11-24 14:27:15 -05:00
iadgovuser29
95c5e40f89
Utilize protobuf to parse claim response. Work on array handling on ACA.
2021-11-23 22:01:16 -05:00
Cyrus
cf4e641273
Added log statement for quote.
2021-11-23 09:40:11 -05:00
Cyrus
4c46758d9a
This commit is a feature update. The IMA PCR enable/diable is being enhanced to update the mask the provisioner uses to pull the quote from the TPM. This code will send down a string range of PCR values that excludes PCR 10. The quote that is returned should be a composite without the PCR 10. There will be a log statement in this commit that should be removed.
2021-11-23 09:36:00 -05:00
chubtub
d183504a3f
Merge branch 'master' into issue-381
2021-11-10 10:08:42 -05:00
Cyrus
2d9fb19d38
Updated the new polices after doing a bit of testing to make sure that they do ignore when there is a failure on that specific bit.
2021-11-10 07:27:33 -05:00
chubtub
e0a1e53d93
Handle an exception thrown when the provisioner fails to send RIM files to the ACA
2021-11-08 14:51:38 -05:00
chubtub
962ca45bb7
Modify ACA RIM validation to search for a signing cert if the base RIM does not have an embedded cert. Validate the ca chain of the found signing cert.
2021-11-08 14:46:04 -05:00
Cyrus
fe617ea948
Updated the policy code to ignore based on the TPM Log Event. Added in the code for OS Events.
2021-10-29 20:24:46 -04:00
Cyrus
c77ad68c08
The variable pcrValues in Abstract Attestation CA class didn't need to be global, this was removed and set to a local variable with an empty string.
2021-10-20 14:29:53 -04:00
Cyrus
f8a3ccd962
This is an initial commit updates the policy page. Adds additional policies for generating a DevID. The underlying code doesn't actually generate one yet. But the SupplyChainPolicy holds the flags.
2021-09-17 07:55:44 -04:00
iadgovuser29
85759dcf3f
Fixed a couple errors in Impl.java and tests
2021-08-16 11:59:19 -04:00
Cyrus
bbed43c524
This is to resolve a merge conflict from the previous push
2021-06-28 12:21:54 -04:00
Cyrus
5c448057d4
Merge branch 'master' into fm-validation-pass-link
2021-06-28 12:15:47 -04:00
Cyrus
bdbe9332bc
Resolved the merge conflicts.
2021-06-28 12:04:54 -04:00
chubtub
d1f0eb5d88
Check for an empty truststore during cert path validation. Removed the recursion in SupplyChainCredentialValidator.validateCertChain.
2021-06-25 11:40:08 -04:00
chubtub
93f212a193
Modify ReferenceManifestDetailsPageController class to include cert path check in reporting RIM signature validity.
2021-06-25 11:40:08 -04:00
chubtub
68c6447760
Add cert path validation to SupplyChainValidationServiceImpl class. Errors of this nature will be reported to the ACA under firmware.
2021-06-25 11:40:08 -04:00
Cyrus
be3cd2bd32
Removed the validation of the PCRs line by line for the expected PCR values.
2021-06-24 11:46:01 -04:00
Cyrus
b06025a71f
Updated the Event Log Measurements class to use a hash for lookup
2021-06-17 12:52:28 -04:00
Cyrus
cd206f870c
These changes may be removed because the issue is becoming more involved and I may need to rethink how this will work.
2021-06-16 08:52:40 -04:00
Cyrus
c523dda558
Some additional minor changes that are to address the event log being the object that is linked when the firmware validation passes.
2021-06-15 09:15:55 -04:00
Cyrus
9c060dec55
Updated event log measurements to pass in the overall result status. However display isn't printing out correctly.
2021-06-09 11:07:11 -04:00
Cyrus
0e8e88b536
This commit has updated changes that save both a base64 and a hex dec value of the RIM file hash to the database. Depending on what is needed, they are used to pull either the base or support RIM. Also fixed the link for the rimlinkhash on the details page.
2021-05-27 13:46:43 -04:00
Cyrus
8fbd6e1a39
Changed up some of the encoded for the rim byte array
2021-05-25 13:11:57 -04:00
Cyrus
7c86b6d0db
Changed the pcr value check from the baseline expected pcr values to the measurement live log
2021-05-20 15:24:28 -04:00
Cyrus
65d596a756
Some additional updates that included deviceNames as a means to pull RIM information. In addition updated the display of the failures, adding filters for like events from the baseline.
2021-05-20 06:26:07 -04:00
Cyrus
ddc36d81f4
This set of code changes deals with the displaying of failed digests values from the validation process. The way there were displayed before was going to be unsustainable because event numbers will never match up. There for a direct compare to a failed event would never be accurate.
2021-05-17 12:44:03 -04:00
Cyrus
3b33bd60b8
The main change in this commit adjusts how the base and support rim are pulled for validation in the environment with multiple Base and Support RIMs per device/manufacturer/model.
2021-05-11 09:44:10 -04:00
Cyrus
1b06d956b4
Updated how the swidtags and support files are updated when imported.
2021-05-07 10:57:19 -04:00
Cyrus
5acc393541
This commit adds several changes that updates how the RIM files are accessed and made accessible from the DB as well as what is shown visually when there is a validation failure and the measurement log is shown.
2021-05-06 08:43:26 -04:00
Cyrus
61c4c81b77
Removed comments
2021-04-14 12:18:05 -04:00
Cyrus
5a82e48b61
Merge branch 'master' into event-digest-update
2021-04-13 08:50:42 -04:00
Cyrus
e70e019c6b
This commit has some changes to how patch and supplemental are handled. It adds some flags to the Record and Value objects to note that data has been processed so that multiple entries aren't created.
2021-04-13 07:45:52 -04:00
Cyrus
760f246096
Merge pull request #342 from nsacyber/rim_digest_store
...
[#341 ] RIM Event Digest Store
2021-04-13 07:45:17 -04:00
Cyrus
39e2ab30d3
Corrected error.
2021-04-07 13:35:02 -04:00
Cyrus
29257695c1
Updated the code with some additional messaging information for the provisioner when it fails. I added a bit of code that eliminates the portal having an error when a support rim is failing, this doesn't allow it to ingest the rim into the database.
2021-04-07 10:53:09 -04:00
Cyrus
ea5b85b703
Updated the code to now display the var swidtag and rimel. However there are issues with the examples. This commit has fixes for how the pcr values are pulled for display on the base RIM page.
2021-04-02 06:34:47 -04:00
Cyrus
4911742c7a
This is a checkout of some changes to the resource management for swid tags so that the file name listed is associated with the stored support RIMS.
2021-03-30 06:35:14 -04:00
Cyrus
a6c6fbfb31
Made some changes for using just the RIM Hash to pull support rims from the database to associated with the swid tag. Changed the rim hash from and int to a string.
2021-03-25 13:28:31 -04:00
Cyrus
c290ba25be
Modified how unmatched log events are tested. Now it uses the reference event value from the database.
2021-03-23 13:13:17 -04:00
Cyrus
2110b7e94d
Merge branch 'rim_digest_store' into event-digest-update
2021-03-23 11:31:42 -04:00
Cyrus
3e18ed8abb
This small update changes where the string array of pcrs is pulled in the validation of the quote. Previously it is from the device info report but now it is from the bios measurement log file from the client.
2021-03-23 11:27:30 -04:00
Cyrus
30113c463a
This is a quick fix for a null pointer exception that is occuring because the parsed values from the device's pcr list is not populated. They did have something but they didn't match what is in the RIM. Therefore, there should be a failure.
2021-03-22 09:52:26 -04:00
Cyrus
108748fb2a
Undid some code and change the Digest Value class into a table in the database. This code then updates those values when a provision is initiated. At this time, that is all it does.
2021-03-19 11:01:25 -04:00
Cyrus
53cb300063
This is an initial commit with changes that add new classes for digest reference matching.
2021-03-17 10:23:08 -04:00
Cyrus
c66f4f7648
Merge pull request #334 from nsacyber/Unmatched-component-refactor
...
Unmatched component refactor
2021-03-09 13:07:16 -05:00
Cyrus
4b6bcccf85
Attempting to merge into master
2021-03-09 13:04:56 -05:00
Cyrus
c4741b869c
Removed unused import
2021-03-09 07:27:35 -05:00
Cyrus
85e29529ae
Modified a catch clause
2021-03-09 06:46:51 -05:00
Cyrus
bd5bca58ea
I have modified the code to correct handle the situation in which the device has more components than the certificate and I have taken steps to make the system test GOOD pass for test A6, A7 and A8.
2021-03-05 15:36:29 -05:00
Cyrus
763dcbd975
These are changes that were made in the system-tests-test that resolved the issues in the first TPM 2.0 system tests on travis.
2021-03-04 08:01:18 -05:00
Cyrus
8a571f1788
When a delta has the component that is bad, not the base, it wasn't highlighting. This is because the component failures wasn't be updated and then the certificate needed to be updated as well.
2021-02-25 06:59:56 -05:00
Cyrus
a5184f5a5b
Final changes that adds in the additional setting for the renewal period threshold. This value indicates that if the end validity has been reached for the current issued attestation certificate, then don't generate one. However if we are within the number of days set by the threshold, then generate the certificate before it expires. The default is 1 year from the end validity.
2021-02-23 10:17:56 -05:00
Cyrus
dcf0ec8101
Merge branch 'master' into aic-policy-rule
2021-02-11 14:13:28 -05:00
Cyrus
7912ff2f2e
refactored some code around the SCV objects that should never be null.
2021-02-10 12:24:00 -05:00
Cyrus
9917fadef7
On a previous commit, I removed a piece of code that checked the base credential first. Because the delta fixed a problem in the base, the base failed before the delta was checked. This was completely removed. On a test that we had previously done, the test passes when it should fail because there is only a base, so that check isn't being done. This change reintroduces the check but in a different location with flags for when there is a delta present.
2021-02-09 13:30:37 -05:00
Cyrus
7b79ceb07a
Found the issue with the component being removed that doesn't have a proper serial number and adding one with it. The code was revalidating the base in the attributes enabled flag. This was unncessary.
2021-02-08 14:25:10 -05:00
Cyrus
4999c96685
Updated code to correct situations that were not linking up with properly for delta and platform certificate component validation.
2021-02-05 16:10:15 -05:00
Cyrus
677716fa08
Merge branch 'master' into Unmatched-component-refactor
2021-02-04 08:51:31 -05:00
Cyrus
5589096443
Cleaned up some stuff I found during code compare in github.
2021-01-20 13:23:51 -05:00
chubtub
88015df551
Checkstyle: unused import
2021-01-14 13:19:17 -05:00
Cyrus
859fdbef83
Added a null check for the platformCredentials in the issued certificate attribute helper so that NPEs aren't thrown.
2021-01-14 12:48:53 -05:00
Cyrus
164a43f056
These are unit tests that were not run on the merge request #327 for issue 308. The unit tests uses certificate (EC and 2 CAs) that don't match for SKI to AKI or issuer string fields. The O= field isn't required and the code in #327 was changed to use SKI first then a sorted RDN list. See #327 . A note was left in the unit tests that the test certs need to be updated.`
2021-01-14 12:41:29 -05:00
Cyrus
beb1ccbee3
Updated a supply chain validation check for delta certificates. Updated the check for duplicate base platform certificates when storing them for the same device and updated the begin validity date for the delta vs the base check.
2021-01-12 12:26:54 -05:00
Cyrus
058c58d208
Updated the begin validity date check for the base and delta so that it is only an error if the delta begin date is older than the platform. Equal is allowed.
2021-01-07 12:51:01 -05:00
Cyrus
85254d9c44
Removed null assignment that isn't used
2021-01-05 08:14:18 -05:00
Cyrus
7028810707
This latest push should have the code that'll highlight the components based on a string rather than the serial number. This also adds additional checks for the validity begin date of the delta not matching or being before the base. It also checks that they don't have the same certificate serial number.
2020-12-30 08:41:47 -05:00
Cyrus
6dd948c828
Added a null check for the endorsement credential for the tpm 1.2
2020-12-18 06:58:18 -05:00
Cyrus
a7eae2fd77
Test out an potential exception
2020-12-17 13:09:03 -05:00
Cyrus
f38fa87013
Undid some code I took out
2020-12-17 09:31:39 -05:00
Cyrus
1db52cebf9
This is a stopping point because the code can't be fully worked out because the data (certificates) aren't correct.
2020-12-17 07:24:51 -05:00
Cyrus
62c7ca2d90
This PR is to address issue #308 . The ACA was pulling Issuer Certificates using the organization RDN of the subject string and getting this from the issuer string of the EC or PC. This presents a problem because it isn't a required field. The organization field cannot be null or empty. Pulling objects from a DB using null or empty would produce bad results. The main change of this issue (which has not been full tested) is pulling using the AKI for the db lookup. If this fails, instead of falling back on potentially left out fields like the O= RDN, the ACA takes the issuer/subject fields, breaks them apart and sorts them based on the key. It also changes the case. This way the lookup can be assured to match in case of some random situation in which the issuer or subject field don't match because RDN keys are just in different positions of the string.
2020-12-11 14:47:46 -05:00
Cyrus
209024c12a
Cleaned up some comments and code.
2020-12-07 09:47:54 -05:00
Cyrus
a3de35ed27
The issue with the tpm 1.2 system test failing had to do with the string to integer conversion using getInteger instead of parseInt.
2020-12-07 07:44:48 -05:00
Cyrus
11f238f671
Testing system tests
2020-12-04 08:36:42 -05:00
Cyrus
e64c6cf772
Merge branch 'master' into aic-policy-rule
2020-12-03 13:34:29 -05:00
Cyrus
e32e9412d8
Merge branch 'master' into Unmatched-component-refactor
2020-12-03 13:20:12 -05:00
Cyrus
a07fbbd847
In a previous pull request, the reference manifest manager was not called to update the unarchived base rim. So it appears to never have been uploaded.
2020-12-02 11:46:42 -05:00
Cyrus
7d49f63a9b
Merge branch 'master' into multiple-rim-upload
2020-12-02 11:05:12 -05:00
Cyrus
70662bddec
Updated how the bios measurement file is uploaded. Changed the code to pull the string from the properties file instead of a hard link in the code.
2020-12-01 11:13:41 -05:00
Cyrus
9534d6650f
Merge branch 'master' into platform_cert_missing_fix
2020-12-01 09:47:45 -05:00
Cyrus
a32d3a5f02
Remove comments
2020-12-01 09:46:05 -05:00
Cyrus
6eefb393a3
Updated the code to pull all the files from a swid tag file directory and a rim log file directory, instead of a single file.
2020-11-30 14:16:57 -05:00
Cyrus
857f1eb0ff
There was a pull for an object that would be null without any RIMs uploaded.
2020-11-30 10:11:25 -05:00
Cyrus
749a3a2317
When the provisioner sends the rim swidtag and the rimel and they already exists in the db but are archived, they don't unarchive them so they never show up on the RIM page. This change fixes that.
2020-11-25 10:06:56 -05:00
Cyrus
9433c97dc9
The code now uses a combination of the class value and the platform manufacturer and model to identify mismatches. This now highlights the failured components
2020-11-25 08:02:45 -05:00
Cyrus
fbdcf83840
Continued refactoring to update the failed components part of the attribute validation. The delta mapping needs to be reworked to not use serials.
2020-11-23 14:46:29 -05:00
Cyrus
2b41720ded
Merge branch 'master' into update-component-failure-highlight
2020-11-17 15:24:27 -05:00
Cyrus
ea03737234
Testing travis
2020-11-16 14:49:53 -05:00
Cyrus
4291059142
Updated the break line option for failed string during firmware validation.
2020-11-16 12:39:57 -05:00
Cyrus
3a3919d9bc
Added null checks for the SupplyChainPolicy object
2020-11-13 08:41:33 -05:00
Cyrus
6eeb630a75
This PR addresses the bugs identified in #314 . Due to previous changes to the RIM upload process, the suppor RIM was not being updated properly when manually uploaded.
...
Closes #314
2020-11-12 13:45:38 -05:00
Cyrus
67b70a386d
Added method to combine the manufacturer and the model as an identifier for the component.
2020-11-10 10:04:46 -05:00
Cyrus
e8f5107137
Updating code to use a different format for identifying failed components.
2020-11-09 13:59:19 -05:00
Cyrus
967d9a0030
Merge branch 'master' into aic-policy-rule
2020-11-09 07:24:33 -05:00
Cyrus
9aa2c6a46d
Merge branch 'master' into client-display-log-mismatch
2020-11-06 09:17:38 -05:00
Cyrus
ed7dea3706
Merge branch 'master' into aic-policy-rule
2020-11-06 06:42:44 -05:00
chubtub
623da2ce80
Overload RIM validator class for faster signature checking
2020-11-05 14:13:50 -05:00
Cyrus
c7ffb1c57d
Merge branch 'master' into client-display-log-mismatch
2020-11-05 12:39:35 -05:00
chubtub
d096aebe12
Add support RIM and signature validation checks to SupplyChainValidationServiceImpl class
2020-11-05 11:27:41 -05:00
Cyrus
e1c3a1fc0f
Initial Commit
2020-10-29 08:58:37 -04:00
Cyrus
24e460e0c4
This is a refactore that changes BiosMeasurements into EventLogMeasurements for evolving naming convention updates.
2020-10-26 11:09:26 -04:00
Cyrus
d7ade70b5c
This branch takes the validated status of a failed event log matching from the bios measurements on the client and displays what failed on the support RIM page and the fail validation icon, if log mismatch, links to a bios measurments page that displays the events that didn't match next to baseline.
2020-10-22 13:32:30 -04:00
Cyrus
3df6eff549
Removed debug code
2020-10-19 13:20:27 -04:00
Cyrus
96970142cb
This commit includes a completed rewrite of the ReferenceManifestSelector framework. Like the previous rewrite, it was easier and made more sense to create addition classes ands that are specific to a type of RIM (base, support, measurement) for referencing in the DB. Once this was rewritten the code was modified to validate the measurement against the support rim.
2020-10-19 13:06:44 -04:00
Cyrus
2c97666bb9
This commit adds code to pull the bios measurements file to the ACA
2020-10-13 13:51:14 -04:00
Cyrus
f9b0ce413d
This commit adds minor tweaks. The first updates the post install script to overwrite, rather than append, the file names to the tcg boot properties file. The next tweak properly loads the Base and Support RIM from the provisioning process into the DB.
2020-10-13 11:42:50 -04:00
