ExternalVendorCode/HIRS
1
0
Fork 0
mirror of https://github.com/nsacyber/HIRS.git synced 2024-12-21 05:53:27 +00:00
Code Issues Actions 3 Packages Projects Releases Wiki Activity
1,602 Commits 260 Branches 0 Tags 287 MiB
6d9863f693
Commit Graph

369 Commits

Author SHA1 Message Date
Cyrus
0f839ebd08 This is a test commit. Changes will be removed. 2022-02-15 11:17:07 -05:00
Cyrus
e16f009294 Removed if check for the matching file name of the support RIM from the 
Base RIMs meta data.  Only keying off hash.
 2022-02-15 10:03:25 -05:00
Cyrus
caa2a7c55b Removed the RIM controller tests 2022-02-14 10:26:07 -05:00
Cyrus
fc3f59adce Updated RIM lookup to use manufacturer and model instead of deviceName 2022-02-11 09:09:39 -05:00
Cyrus
1f2be7ce18 Updated the live log information if the base and support rim are not 
uploaded together.
 2022-02-11 08:01:28 -05:00
Cyrus
2db5b86da1 Some minor updates. Fixed a null pointer exception in the 
SupplyChainValidationServiceImpl.  Updated warnings when files are
missing from the device claim
 2022-02-11 07:32:07 -05:00
chubtub
ea6bb48d06 Merge branch 'master' into issue-395 2022-01-27 10:58:16 -05:00
chubtub
c4b6aca667 Merge branch 'issue-395' of github.com:nsacyber/HIRS into issue-395 2022-01-24 14:35:01 -05:00
Cyrus
f503457bd4 Refactored the Reference Digest code so that the ReferenceDigestValue 
table is accessible and upated the contoller for the getOrderedList.
 2022-01-21 06:29:53 -05:00
Cyrus
6d8392da45 Prelminary changes to remove ReferenceDigestRecord as a database object. 2022-01-11 10:02:38 -05:00
Cyrus
5858e36313 Updated the implementation to return a blank identity claim response. 
The provisioner tests the blob and if it is empty, exit
 2022-01-05 16:49:27 -05:00
Cyrus
139e4c8972 Added null pointer check to RDR variable. 2021-11-24 14:27:15 -05:00
iadgovuser29
95c5e40f89 Utilize protobuf to parse claim response. Work on array handling on ACA. 2021-11-23 22:01:16 -05:00
Cyrus
cf4e641273 Added log statement for quote. 2021-11-23 09:40:11 -05:00
Cyrus
4c46758d9a This commit is a feature update. The IMA PCR enable/diable is being enhanced to update the mask the provisioner uses to pull the quote from the TPM. This code will send down a string range of PCR values that excludes PCR 10. The quote that is returned should be a composite without the PCR 10. There will be a log statement in this commit that should be removed. 2021-11-23 09:36:00 -05:00
chubtub
d183504a3f Merge branch 'master' into issue-381 2021-11-10 10:08:42 -05:00
Cyrus
2d9fb19d38 Updated the new polices after doing a bit of testing to make sure that they do ignore when there is a failure on that specific bit. 2021-11-10 07:27:33 -05:00
chubtub
e0a1e53d93 Handle an exception thrown when the provisioner fails to send RIM files to the ACA 2021-11-08 14:51:38 -05:00
chubtub
962ca45bb7 Modify ACA RIM validation to search for a signing cert if the base RIM does not have an embedded cert. Validate the ca chain of the found signing cert. 2021-11-08 14:46:04 -05:00
Cyrus
fe617ea948 Updated the policy code to ignore based on the TPM Log Event. Added in the code for OS Events. 2021-10-29 20:24:46 -04:00
Cyrus
c77ad68c08 The variable pcrValues in Abstract Attestation CA class didn't need to be global, this was removed and set to a local variable with an empty string. 2021-10-20 14:29:53 -04:00
Cyrus
f8a3ccd962 This is an initial commit updates the policy page. Adds additional policies for generating a DevID. The underlying code doesn't actually generate one yet. But the SupplyChainPolicy holds the flags. 2021-09-17 07:55:44 -04:00
iadgovuser29
85759dcf3f Fixed a couple errors in Impl.java and tests 2021-08-16 11:59:19 -04:00
Cyrus
bbed43c524 This is to resolve a merge conflict from the previous push 2021-06-28 12:21:54 -04:00
Cyrus
5c448057d4
Merge branch 'master' into fm-validation-pass-link 2021-06-28 12:15:47 -04:00
Cyrus
bdbe9332bc Resolved the merge conflicts. 2021-06-28 12:04:54 -04:00
chubtub
d1f0eb5d88 Check for an empty truststore during cert path validation. Removed the recursion in SupplyChainCredentialValidator.validateCertChain. 2021-06-25 11:40:08 -04:00
chubtub
93f212a193 Modify ReferenceManifestDetailsPageController class to include cert path check in reporting RIM signature validity. 2021-06-25 11:40:08 -04:00
chubtub
68c6447760 Add cert path validation to SupplyChainValidationServiceImpl class. Errors of this nature will be reported to the ACA under firmware. 2021-06-25 11:40:08 -04:00
Cyrus
be3cd2bd32 Removed the validation of the PCRs line by line for the expected PCR values. 2021-06-24 11:46:01 -04:00
Cyrus
b06025a71f Updated the Event Log Measurements class to use a hash for lookup 2021-06-17 12:52:28 -04:00
Cyrus
cd206f870c These changes may be removed because the issue is becoming more involved and I may need to rethink how this will work. 2021-06-16 08:52:40 -04:00
Cyrus
c523dda558 Some additional minor changes that are to address the event log being the object that is linked when the firmware validation passes. 2021-06-15 09:15:55 -04:00
Cyrus
9c060dec55 Updated event log measurements to pass in the overall result status. However display isn't printing out correctly. 2021-06-09 11:07:11 -04:00
Cyrus
0e8e88b536 This commit has updated changes that save both a base64 and a hex dec value of the RIM file hash to the database. Depending on what is needed, they are used to pull either the base or support RIM. Also fixed the link for the rimlinkhash on the details page. 2021-05-27 13:46:43 -04:00
Cyrus
8fbd6e1a39 Changed up some of the encoded for the rim byte array 2021-05-25 13:11:57 -04:00
Cyrus
7c86b6d0db Changed the pcr value check from the baseline expected pcr values to the measurement live log 2021-05-20 15:24:28 -04:00
Cyrus
65d596a756 Some additional updates that included deviceNames as a means to pull RIM information. In addition updated the display of the failures, adding filters for like events from the baseline. 2021-05-20 06:26:07 -04:00
Cyrus
ddc36d81f4 This set of code changes deals with the displaying of failed digests values from the validation process. The way there were displayed before was going to be unsustainable because event numbers will never match up. There for a direct compare to a failed event would never be accurate. 2021-05-17 12:44:03 -04:00
Cyrus
3b33bd60b8 The main change in this commit adjusts how the base and support rim are pulled for validation in the environment with multiple Base and Support RIMs per device/manufacturer/model. 2021-05-11 09:44:10 -04:00
Cyrus
1b06d956b4 Updated how the swidtags and support files are updated when imported. 2021-05-07 10:57:19 -04:00
Cyrus
5acc393541 This commit adds several changes that updates how the RIM files are accessed and made accessible from the DB as well as what is shown visually when there is a validation failure and the measurement log is shown. 2021-05-06 08:43:26 -04:00
Cyrus
61c4c81b77 Removed comments 2021-04-14 12:18:05 -04:00
Cyrus
5a82e48b61 Merge branch 'master' into event-digest-update 2021-04-13 08:50:42 -04:00
Cyrus
e70e019c6b This commit has some changes to how patch and supplemental are handled. It adds some flags to the Record and Value objects to note that data has been processed so that multiple entries aren't created. 2021-04-13 07:45:52 -04:00
Cyrus
760f246096
Merge pull request #342 from nsacyber/rim_digest_store 
[#341] RIM Event Digest Store
 2021-04-13 07:45:17 -04:00
Cyrus
39e2ab30d3 Corrected error. 2021-04-07 13:35:02 -04:00
Cyrus
29257695c1 Updated the code with some additional messaging information for the provisioner when it fails. I added a bit of code that eliminates the portal having an error when a support rim is failing, this doesn't allow it to ingest the rim into the database. 2021-04-07 10:53:09 -04:00
Cyrus
ea5b85b703 Updated the code to now display the var swidtag and rimel. However there are issues with the examples. This commit has fixes for how the pcr values are pulled for display on the base RIM page. 2021-04-02 06:34:47 -04:00
Cyrus
4911742c7a This is a checkout of some changes to the resource management for swid tags so that the file name listed is associated with the stored support RIMS. 2021-03-30 06:35:14 -04:00
Cyrus
a6c6fbfb31 Made some changes for using just the RIM Hash to pull support rims from the database to associated with the swid tag. Changed the rim hash from and int to a string. 2021-03-25 13:28:31 -04:00
Cyrus
c290ba25be Modified how unmatched log events are tested. Now it uses the reference event value from the database. 2021-03-23 13:13:17 -04:00
Cyrus
2110b7e94d Merge branch 'rim_digest_store' into event-digest-update 2021-03-23 11:31:42 -04:00
Cyrus
3e18ed8abb This small update changes where the string array of pcrs is pulled in the validation of the quote. Previously it is from the device info report but now it is from the bios measurement log file from the client. 2021-03-23 11:27:30 -04:00
Cyrus
30113c463a This is a quick fix for a null pointer exception that is occuring because the parsed values from the device's pcr list is not populated. They did have something but they didn't match what is in the RIM. Therefore, there should be a failure. 2021-03-22 09:52:26 -04:00
Cyrus
108748fb2a Undid some code and change the Digest Value class into a table in the database. This code then updates those values when a provision is initiated. At this time, that is all it does. 2021-03-19 11:01:25 -04:00
Cyrus
53cb300063 This is an initial commit with changes that add new classes for digest reference matching. 2021-03-17 10:23:08 -04:00
Cyrus
c66f4f7648
Merge pull request #334 from nsacyber/Unmatched-component-refactor 
Unmatched component refactor
 2021-03-09 13:07:16 -05:00
Cyrus
4b6bcccf85 Attempting to merge into master 2021-03-09 13:04:56 -05:00
Cyrus
c4741b869c Removed unused import 2021-03-09 07:27:35 -05:00
Cyrus
85e29529ae Modified a catch clause 2021-03-09 06:46:51 -05:00
Cyrus
bd5bca58ea I have modified the code to correct handle the situation in which the device has more components than the certificate and I have taken steps to make the system test GOOD pass for test A6, A7 and A8. 2021-03-05 15:36:29 -05:00
Cyrus
763dcbd975 These are changes that were made in the system-tests-test that resolved the issues in the first TPM 2.0 system tests on travis. 2021-03-04 08:01:18 -05:00
Cyrus
8a571f1788 When a delta has the component that is bad, not the base, it wasn't highlighting. This is because the component failures wasn't be updated and then the certificate needed to be updated as well. 2021-02-25 06:59:56 -05:00
Cyrus
a5184f5a5b Final changes that adds in the additional setting for the renewal period threshold. This value indicates that if the end validity has been reached for the current issued attestation certificate, then don't generate one. However if we are within the number of days set by the threshold, then generate the certificate before it expires. The default is 1 year from the end validity. 2021-02-23 10:17:56 -05:00
Cyrus
dcf0ec8101 Merge branch 'master' into aic-policy-rule 2021-02-11 14:13:28 -05:00
Cyrus
7912ff2f2e refactored some code around the SCV objects that should never be null. 2021-02-10 12:24:00 -05:00
Cyrus
9917fadef7 On a previous commit, I removed a piece of code that checked the base credential first. Because the delta fixed a problem in the base, the base failed before the delta was checked. This was completely removed. On a test that we had previously done, the test passes when it should fail because there is only a base, so that check isn't being done. This change reintroduces the check but in a different location with flags for when there is a delta present. 2021-02-09 13:30:37 -05:00
Cyrus
7b79ceb07a Found the issue with the component being removed that doesn't have a proper serial number and adding one with it. The code was revalidating the base in the attributes enabled flag. This was unncessary. 2021-02-08 14:25:10 -05:00
Cyrus
4999c96685 Updated code to correct situations that were not linking up with properly for delta and platform certificate component validation. 2021-02-05 16:10:15 -05:00
Cyrus
677716fa08 Merge branch 'master' into Unmatched-component-refactor 2021-02-04 08:51:31 -05:00
Cyrus
5589096443 Cleaned up some stuff I found during code compare in github. 2021-01-20 13:23:51 -05:00
chubtub
88015df551 Checkstyle: unused import 2021-01-14 13:19:17 -05:00
Cyrus
859fdbef83 Added a null check for the platformCredentials in the issued certificate attribute helper so that NPEs aren't thrown. 2021-01-14 12:48:53 -05:00
Cyrus
164a43f056 These are unit tests that were not run on the merge request #327 for issue 308. The unit tests uses certificate (EC and 2 CAs) that don't match for SKI to AKI or issuer string fields. The O= field isn't required and the code in #327 was changed to use SKI first then a sorted RDN list. See #327. A note was left in the unit tests that the test certs need to be updated.` 2021-01-14 12:41:29 -05:00
Cyrus
beb1ccbee3 Updated a supply chain validation check for delta certificates. Updated the check for duplicate base platform certificates when storing them for the same device and updated the begin validity date for the delta vs the base check. 2021-01-12 12:26:54 -05:00
Cyrus
058c58d208 Updated the begin validity date check for the base and delta so that it is only an error if the delta begin date is older than the platform. Equal is allowed. 2021-01-07 12:51:01 -05:00
Cyrus
85254d9c44 Removed null assignment that isn't used 2021-01-05 08:14:18 -05:00
Cyrus
7028810707 This latest push should have the code that'll highlight the components based on a string rather than the serial number. This also adds additional checks for the validity begin date of the delta not matching or being before the base. It also checks that they don't have the same certificate serial number. 2020-12-30 08:41:47 -05:00
Cyrus
6dd948c828 Added a null check for the endorsement credential for the tpm 1.2 2020-12-18 06:58:18 -05:00
Cyrus
a7eae2fd77 Test out an potential exception 2020-12-17 13:09:03 -05:00
Cyrus
f38fa87013 Undid some code I took out 2020-12-17 09:31:39 -05:00
Cyrus
1db52cebf9 This is a stopping point because the code can't be fully worked out because the data (certificates) aren't correct. 2020-12-17 07:24:51 -05:00
Cyrus
62c7ca2d90 This PR is to address issue #308. The ACA was pulling Issuer Certificates using the organization RDN of the subject string and getting this from the issuer string of the EC or PC. This presents a problem because it isn't a required field. The organization field cannot be null or empty. Pulling objects from a DB using null or empty would produce bad results. The main change of this issue (which has not been full tested) is pulling using the AKI for the db lookup. If this fails, instead of falling back on potentially left out fields like the O= RDN, the ACA takes the issuer/subject fields, breaks them apart and sorts them based on the key. It also changes the case. This way the lookup can be assured to match in case of some random situation in which the issuer or subject field don't match because RDN keys are just in different positions of the string. 2020-12-11 14:47:46 -05:00
Cyrus
209024c12a Cleaned up some comments and code. 2020-12-07 09:47:54 -05:00
Cyrus
a3de35ed27 The issue with the tpm 1.2 system test failing had to do with the string to integer conversion using getInteger instead of parseInt. 2020-12-07 07:44:48 -05:00
Cyrus
11f238f671 Testing system tests 2020-12-04 08:36:42 -05:00
Cyrus
e64c6cf772 Merge branch 'master' into aic-policy-rule 2020-12-03 13:34:29 -05:00
Cyrus
e32e9412d8 Merge branch 'master' into Unmatched-component-refactor 2020-12-03 13:20:12 -05:00
Cyrus
a07fbbd847 In a previous pull request, the reference manifest manager was not called to update the unarchived base rim. So it appears to never have been uploaded. 2020-12-02 11:46:42 -05:00
Cyrus
7d49f63a9b Merge branch 'master' into multiple-rim-upload 2020-12-02 11:05:12 -05:00
Cyrus
70662bddec Updated how the bios measurement file is uploaded. Changed the code to pull the string from the properties file instead of a hard link in the code. 2020-12-01 11:13:41 -05:00
Cyrus
9534d6650f Merge branch 'master' into platform_cert_missing_fix 2020-12-01 09:47:45 -05:00
Cyrus
a32d3a5f02 Remove comments 2020-12-01 09:46:05 -05:00
Cyrus
6eefb393a3 Updated the code to pull all the files from a swid tag file directory and a rim log file directory, instead of a single file. 2020-11-30 14:16:57 -05:00
Cyrus
857f1eb0ff There was a pull for an object that would be null without any RIMs uploaded. 2020-11-30 10:11:25 -05:00
Cyrus
749a3a2317 When the provisioner sends the rim swidtag and the rimel and they already exists in the db but are archived, they don't unarchive them so they never show up on the RIM page. This change fixes that. 2020-11-25 10:06:56 -05:00
Cyrus
9433c97dc9 The code now uses a combination of the class value and the platform manufacturer and model to identify mismatches. This now highlights the failured components 2020-11-25 08:02:45 -05:00
Cyrus
fbdcf83840 Continued refactoring to update the failed components part of the attribute validation. The delta mapping needs to be reworked to not use serials. 2020-11-23 14:46:29 -05:00
Cyrus
2b41720ded Merge branch 'master' into update-component-failure-highlight 2020-11-17 15:24:27 -05:00
Cyrus
ea03737234 Testing travis 2020-11-16 14:49:53 -05:00
Cyrus
4291059142 Updated the break line option for failed string during firmware validation. 2020-11-16 12:39:57 -05:00
Cyrus
3a3919d9bc Added null checks for the SupplyChainPolicy object 2020-11-13 08:41:33 -05:00
Cyrus
6eeb630a75 This PR addresses the bugs identified in #314. Due to previous changes to the RIM upload process, the suppor RIM was not being updated properly when manually uploaded. 
Closes #314
 2020-11-12 13:45:38 -05:00
Cyrus
67b70a386d Added method to combine the manufacturer and the model as an identifier for the component. 2020-11-10 10:04:46 -05:00
Cyrus
e8f5107137 Updating code to use a different format for identifying failed components. 2020-11-09 13:59:19 -05:00
Cyrus
967d9a0030 Merge branch 'master' into aic-policy-rule 2020-11-09 07:24:33 -05:00
Cyrus
9aa2c6a46d Merge branch 'master' into client-display-log-mismatch 2020-11-06 09:17:38 -05:00
Cyrus
ed7dea3706 Merge branch 'master' into aic-policy-rule 2020-11-06 06:42:44 -05:00
chubtub
623da2ce80 Overload RIM validator class for faster signature checking 2020-11-05 14:13:50 -05:00
Cyrus
c7ffb1c57d Merge branch 'master' into client-display-log-mismatch 2020-11-05 12:39:35 -05:00
chubtub
d096aebe12 Add support RIM and signature validation checks to SupplyChainValidationServiceImpl class 2020-11-05 11:27:41 -05:00
Cyrus
e1c3a1fc0f Initial Commit 2020-10-29 08:58:37 -04:00
Cyrus
24e460e0c4 This is a refactore that changes BiosMeasurements into EventLogMeasurements for evolving naming convention updates. 2020-10-26 11:09:26 -04:00
Cyrus
d7ade70b5c This branch takes the validated status of a failed event log matching from the bios measurements on the client and displays what failed on the support RIM page and the fail validation icon, if log mismatch, links to a bios measurments page that displays the events that didn't match next to baseline. 2020-10-22 13:32:30 -04:00
Cyrus
3df6eff549 Removed debug code 2020-10-19 13:20:27 -04:00
Cyrus
96970142cb This commit includes a completed rewrite of the ReferenceManifestSelector framework. Like the previous rewrite, it was easier and made more sense to create addition classes ands that are specific to a type of RIM (base, support, measurement) for referencing in the DB. Once this was rewritten the code was modified to validate the measurement against the support rim. 2020-10-19 13:06:44 -04:00
Cyrus
2c97666bb9 This commit adds code to pull the bios measurements file to the ACA 2020-10-13 13:51:14 -04:00
Cyrus
f9b0ce413d This commit adds minor tweaks. The first updates the post install script to overwrite, rather than append, the file names to the tcg boot properties file. The next tweak properly loads the Base and Support RIM from the provisioning process into the DB. 2020-10-13 11:42:50 -04:00
Cyrus
4b0bb2df91 This commit updates the provisioner to pull the rim and swidtag locations from a properties file that will be created during the post install process. The provisioner then pulls the values and sends them to the ACA. The ACA currently just prints out the content and saves the swidtag. 2020-10-09 10:48:17 -04:00
Cyrus
3f57b0ab81 This is the initial code set up to pull the log file from the provisioner and send it to the ACA. Task 1 of #238. 2020-10-07 09:37:53 -04:00
Cyrus
17728d3019 Updated the error message for no associated RIM not found, cleaned up display of the event content and adjusted the column of the digest display. 2020-10-06 07:42:15 -04:00
Cyrus
b42dfb577f The manufacturer look up for a RIM was inadequate. This change pulls down all RIMs and searches for the base RIM that matches instead of just pulling down a RIM by Manufacturer. 2020-10-05 11:37:38 -04:00
Cyrus
89fbaa0517 PCR policy matching wasn't propertly failing because the baseline from the support RIM was not properly populating. 2020-10-05 10:44:18 -04:00
Cyrus
653acd270e With the changes to how the ReferenceManifest is represented in the code and the previous firmware validation PR update, this branch wasn't properly updated for quote validation. The code was still pulling information for the baseline from an old source that wouldn't work anymore. Therefore all validations for the quote failed. The update now pulls the baseline information from the support RIM which is now stored in the database. 2020-10-01 12:14:29 -04:00
Cyrus
cb4dc0aa7f Corrected checkstyles warning 2020-09-30 12:26:46 -04:00
Cyrus
35dcc226a6 Updated and fixed the difference in the code from the master branch merge 2020-09-30 11:33:28 -04:00
Cyrus
89dd2084c2 Merge branch 'master' into rimel-delete-details 2020-09-30 10:03:27 -04:00
Cyrus
f4aed453f8 Additional visual changes 2020-09-30 10:02:33 -04:00
Cyrus
2b57207445 Updated the Tag Version and version fields for Base and Support rims. In addition, adjusted the lay out of the support rim table so that the events column isn't as long. Instead, the full content shows up in an hover action. 2020-09-30 07:51:27 -04:00
Cyrus
3636782987 This commit adds functionality to display tpm even log information to the support RIM display page. Outstanding issues to implement: 1) add link to base from support RIM, 2) make event table scrollable 2020-09-24 09:58:10 -04:00
Cyrus
1ed02e72b2 This last commit corrects the database error. The code attempts to save a new supplychainvalidationsummary it needs to be a supplychainvalidation recreation to create new primary keys. 2020-09-09 07:03:31 -04:00
Cyrus
0291b96ca8 Updated code should be able to print one summary 2020-08-28 14:02:40 -04:00
Cyrus
792a248ba0 This code finishes up validating the pcrs against the provided tpm quote. However this will cause a second summary object to display if firmware validation is enabled. This is because the summary manager isn't able to get or update the previously saved summary. 2020-08-28 12:24:02 -04:00
Cyrus
5fe19c5904 Updated the code to compare the composite hash and the calculated value. 2020-08-28 07:14:27 -04:00
Cyrus
0ab91b9b41 All bugs are fixed. The SupplyChainValidationSummary wasn't getting pulled from the DB. 2020-08-27 12:11:12 -04:00
Cyrus
905f12052d This is the next stage of changes that doesn't cause a 404 error. This has a compile error because the PCRPolicy class references PCRComposite and PCRInfoShort. Both of the later classes had changes to add new constructors, and these new constructors are the source of the problem. 2020-08-26 07:54:39 -04:00
Cyrus
ee294e4562 SupplyCahinValidationService did not like the additions of a method returning a SupplyChainValidation, switched to Summary and it worked. This was the cause of the DB crashing. 2020-08-25 11:36:37 -04:00
Cyrus
48f4f9a654 This could was not tested against a tpm 1.2 environment. The branch was failing on Travis because there was a timeout request from the provision to the aca, however no error from the aca could be shown. However the problem is occurring when the tpm 1.2 provision is attempting to save an issued attestation certificate. This part of the code touches the code changes for the 2.0 updates. The variable pcrValues is null when the 1.2 process is called and therefore when Files.write method is called, the pcrValues.getBytes call is throwing a null pointer exception. This code checks for that condition before operating over the code. 2020-07-29 13:54:41 -04:00
Cyrus
2e4ecb6829 Updated code for the device pcrs. The provisioner now sends everything associated with the tpm_pcrlist. The ACA stores the full list in a flat file then pulls that file when validating the firmware policy is enabled. 2020-07-27 13:58:22 -04:00
Cyrus
3e9d26f598 This code changes how the ACA handles a pcr list provided by the provisioner. The provisioner also is changed to send all supported algorithms and no longer delimits them with a + sign. The ACA is now set up to cycle through the entire list until is matches the baseline found in the rim associated log file. Currently the code is having issues saving the larger list of pcr values. It is too big for the database. 2020-07-17 12:44:31 -04:00
Cyrus
5b43e41292 Updated firmware validation method to not check for AIC if there is no RIM. 2020-07-02 12:13:10 -04:00
Cyrus
c7f796d1a3 Updated status error checking for validating firmware. 2020-06-26 09:47:04 -04:00
Cyrus
d41cb46468
[#260] RIM validation report page links (#264) 
* Made some minor tweaks to investigate supply chain validation report bug.  The bug doesn't save the summary report for some unknown reason (no error currently appears).  This change uses the device object to retrieve a RIM.  Still need Attestation Certificate to pull PCRs from quote.  A follow up issue will be created to move that functionality to a different object from the provisioner.
 2020-06-23 13:24:34 -04:00
Cyrus
6a62002b05
[#265] IMA/TBoot PCR ignore policy (#271) 
* Updated code to include an official policy to ignore IMA and TBoot.  The policies will disable if firmware validation is disabled.
 2020-06-23 12:48:06 -04:00
Cyrus
16f38751ca
[#265] Skip ima pcr (#267) 
* Added temp code edit to ignore IMA pcr during firmware validation

* Removed redundant check
 2020-06-17 13:33:02 -04:00
Cyrus
49e4ce4db4
Validation bug (#263) 
* Updated code to correctly match up the PCR to the baseline PCR.  Also updated values of error messages and reduced firmware error message.
 2020-06-15 11:55:05 -04:00
Cyrus
da5bc217ef
[#236] Firmware validation update part 2 (#259) 
* Modified the hirs.data.persist package to have better fidelity into the objects necessary to create and maintain a baseline.  the info objects will be next.
 2020-06-10 11:17:45 -04:00
Cyrus
2805df9f8b
[#236] Firmware validation update part 1 (#243) 
* This commit includes changes to the provisioner for what is sent up.  Originally only SHA256 was being used, this change includes both.
* This last commit cover the items 2-4 in issue #236.  The Provisioner sends up and updated list of pcrs that include 256, not just sha1.  The validation and policy pages have been updated.  A second pull request will be created to address parsing the information into a baseline.
 2020-03-27 10:13:37 -04:00
Cyrus
4a6115f443
[#212] Added functionality to process and display RIM files. (#226) 
* Some initial additions to the details page for displaying Rim information.

* Initial changes for uploading a rim file.

* This is an update to the display of the Reference Integrity Manifest code base that'll allow a user to upload a swidtag.  This code includes some additions from #217, slightly modified.

* This code update include changes to import, archive and delete a swidtag into the RIM object.

* This commit consolidated the SwidTagGatway code and Constants into Reference Manifest.

* This is the final main push of code that will upload, process, store, retrive/delete and display the contents of a RIM swid tag.

* Interim commit for demo purposes.

* Updated Unit Tests

* This commit adds the unit tests that weren't added in the previous commit

* Updated code to reduce execution time when processing reference manifest objects.

* Updated code for better GUI performance.

* Removed previously added suppression entries.
 2020-02-21 11:16:46 -05:00
Cyrus
81e13831b2
[#202] Certificate fail to save upon deletion during provisioning FIXED (#206) 
* This commit fixes an error produced when provisioning when the certificate from a previous provision is deleted from the ACA.  The error involves doing a look up for an existing certificate and getting nothing however this is due to not using the 'includeArchived' attribute for the Certificate Selector.  Include Archived is used when manually uploading a certificate.
 2020-01-06 08:17:04 -05:00
Cyrus
0ede7191ad
[#191] ACA Processing TPM Quote/PCRs from Certificate Request (#197) 
* Updated the ACA to verify that the quote and pcrlist exist before trying to parse them.

* Removed unused methods for the tpmquote process.
 2019-10-29 09:34:06 -04:00
Cyrus
f73d65c952
[#181] Delta holder validation (#186) 
* This is a quick fix to ensure that a delta that is being uploaded has a holder serial number that exists in the database.

* Fixed syntax issues.

* Through further testing with delta certificates that had differing begin validity dates, the code to test the sorting failed.  This push includes a fix that places the deltas in the proper order.

In addition, this code includes a placeholder for deltas that don't have an existing holder certificate in the database.

* Findbugs is a cumbersome COTS product that generates more hassle than help.  Upon indicating 'dodgy' code about redundant null checks, that didn't exist, it then didn't like using non-short circuit operators to verify that both objects are not null.  It then spells out what non-shorting curcuit operators do, without acknowledges that's what you mean to do.
 2019-08-29 13:35:41 -04:00
Cyrus
9318c22549
[#167] Component color failure (#185) 
* Initial changes to pull down the serial from the validation reports page and transfer them to the certificates details page.  This will then allow the certificate details page to reference the serial numbers that are in failure.

* This is an attempt to transfer data from page to page via the certificate manager.

* Previous attempt didn't work, the manager isn't saving the summary.  Switching to augmenting the database by adding a new column for platform credentials.

* These changes add identifying color to the components that fail validation in the base certificate.  This code however does change the database by adding a new column to track the fails and pass to the classes that display the information.

* Updated the jsp display of the highlighted component to red background with a white foreground.  Updated the index of the string parse to not use magic numbers.
 2019-08-29 11:45:22 -04:00
Cyrus
2e07d2cfd7
The validation page was not showing an error icon for attributes failures. This was due to the retained validation type for attributes. This has been removed and the code was additionally updated with logic to handle showing just one icon for both policy checks for the platform credential. (#184) 2019-08-27 10:40:55 -04:00
Cyrus
c3e02825f4
[#181] Validation systemcheck fix (#182) 
* The base certificate is getting a failure when the delta fixed the problem.  The code is being modified to ignore the attribute validation of the base certificate and redo the trust chain check.  The code now has a cleaner platform evaluation set up and store.
 2019-08-21 10:52:40 -04:00
Cyrus
7cfabe756d
[#166] Validation icon swap (#173) 
* This pull request contains 2 main changes, the first is transferring the status text from the attributes failure to the icon specifically for platform trust chain validation.  Then this removes the third column on the validation page that singles out the icons for the attribute status.  In addition, this status is also rolled up to the summary status icon and displays the text there as well for all that have failed.  This last change meant a change to the sizes of the columns in the database.

The validation of a single base certificate with an error was not handled in the code base.  Due to the changes with the introduction of delta certifications, the validation was modified and only handled changes presented by the deltas and ignored errors in the base certificate.  This commit modifies the code that if there is just a single base certificate that is bad and error is thrown.
 2019-08-02 09:41:44 -04:00
Cyrus
f4bfe47c9c
Clean up (#172) 
* This is a test build to determine code to block script base certificate upload if one already exists.

* Added null check

* Fixed checkstyle error
 2019-07-25 09:32:33 -04:00
Cyrus
a8e2c5cc6e
[#163] Delta issuer validation (#164) 
* This code change will add in the delta certficates to the platform validation check.  The current base passes the policy check as long as the base is valid.  The deltas are ignored.  This is because the validation pulls in what is associated with a particular EK associated with the machine provisioning.
 2019-06-24 13:01:32 -04:00
Cyrus
157dcb649d
[#109] Delta Chain Validation (#151) 
* This code adds functionality to check the delta certificates in a chain. The main operation validates that the delta belongs in that chain and then that the chain establishes correct component modification. No removes before an add, no add to a component that exists, no remove to a component that doesn't exist. The unit test was updated to not use any flat file certificate.

Closes #109

* Changes were made to the validation of a delta certificate based on newer information.  There can be multiple bases and multiple leaves in a tree of associated certificates.  However currently we don't have certificates to validate the entirety of the code to test.

* Updated the code to treat the platform attributes policy, if v2, against all in the chain rather than one at a time.
 2019-06-04 14:07:35 -04:00
chubtub
86f2cddb22 [#108] Validity Check for Base and Delta Certs (#126) 
* Added methods and placeholders for checking the supply chain for base and delta credentials according to the new TCG spec

Checkstyle changes

Created a new SupplyChainValidation.ValidationType for delta credential attributes. The existing PLATFORM_CREDENTIAL
ValidationType will be used for both base and delta platform credentials from spec 1.1.

* Checkstyle error: trailing spaces
 2019-05-02 07:15:43 -04:00
apldev4
0586afb9d8
[#41] Provisioners use PACCOR for device info collection. (#45) 
The provisioners used to shell out using different tools
to collect device info. Now they both use PACCOR instead.
 2018-11-07 14:54:48 -05:00
apldev3
ce380db48c [#38] ACA checks uploaded EK Certs if one is not provided during provisioning 2018-11-01 09:30:01 -04:00
apldev3
87be5a396b [#25] Make ACA exception handling more descriptive 2018-10-31 09:26:20 -04:00
apldev3
f192ce5826 [#23] Update HIRS Utils and ACA to handle certificate padding (#26) 2018-10-18 14:34:52 -04:00
Taruan Matthews
cc12a02c53 This change forces the supply chain validation service to verify that the Platform Credential has a status of PASS. If it does not, no matter the outcome of the Attributes validation, the status of the Attributes can not be PASS. 
Added an additional null check for a platform supply validation.  Added a mapping object for platform credential to the associated attributes during validations.

Added an additional null check for a platform supply validation.  Added a mapping object for platform credential to the associated attributes during validations. Missed import statement.
 2018-10-15 10:38:21 -04:00
apldev3
bdbc85ef4d [#3] Ensure ACA and TPM2 Provisioner handle versioning correctly 2018-09-17 12:28:05 -04:00
apldev3
12f770080a [#1] Add support for processing ECC certificates as part of the trust chain 2018-09-13 13:09:48 -04:00
apldev4
d7e44b8310 Initial release 2018-09-06 09:47:33 -04:00