370 Commits

Author	SHA1	Message	Date
Cyrus	035efad9d2	Updated code allows the tpm event table to be searched and information ... updated when the swidtag is added.	2022-01-31 14:11:36 -05:00
chubtub	c4b6aca667	Merge branch 'issue-395' of github.com:nsacyber/HIRS into issue-395	2022-01-24 14:35:01 -05:00
Cyrus	f503457bd4	Refactored the Reference Digest code so that the ReferenceDigestValue ... table is accessible and upated the contoller for the getOrderedList.	2022-01-21 06:29:53 -05:00
Cyrus	6d8392da45	Prelminary changes to remove ReferenceDigestRecord as a database object.	2022-01-11 10:02:38 -05:00
chubtub	fc7d8b5dd1	Merge branch 'master' into issue-395	2022-01-07 09:36:50 -05:00
chubtub	a71e7130ab	WIP: frontend hangs while getting records from backend	2022-01-04 11:07:18 -05:00
iadgovuser26	bf8ef387c1	Merge pull request #407 from nsacyber/issue-381 ... [#381] Update RIM validation in ACA	2021-12-16 10:39:58 -05:00
iadgovuser29	da9c8469ba	Re-creating the componentidentifer here lost important information.	2021-12-10 20:58:44 -05:00
iadgovuser29	e22d95c2e6	Modified so PCI ID translation will highlight delta certs and show in Tooltips	2021-12-10 09:07:28 -05:00
Cyrus	9b790cb805	checking for class cast now. Highlighting appears.	2021-12-03 17:01:18 -05:00
Cyrus	6337367ba9	Added Pci IDs translate to the HIRS_Util module for the supply chain validator process so that the hash can match up for highlighting failed components.	2021-12-03 16:01:04 -05:00
iadgovuser29	95c5e40f89	Utilize protobuf to parse claim response. Work on array handling on ACA.	2021-11-23 22:01:16 -05:00
Cyrus	483099a273	Updated the policy code to modify the measurement array length and ignore PCR 10 as well.	2021-11-23 10:06:21 -05:00
Cyrus	4c46758d9a	This commit is a feature update. The IMA PCR enable/diable is being enhanced to update the mask the provisioner uses to pull the quote from the TPM. This code will send down a string range of PCR values that excludes PCR 10. The quote that is returned should be a composite without the PCR 10. There will be a log statement in this commit that should be removed.	2021-11-23 09:36:00 -05:00
chubtub	1eca360a4d	Modify log messages so that validation failures from certs in the keystore that are not actually in the chain do not raise undue attention	2021-11-19 01:50:05 -05:00
5B96790E3664F40075A67E6ADF737EDB15B4408DBC91A81228B31537B0CE3E26	3f091a3827	Merge pull request #415 from nsacyber/issue/414 ... [#414] Handle MODIFIED component without serial number	2021-11-18 08:54:09 -05:00
chubtub	23a086c925	Merge branch 'issue-381' of github.com:nsacyber/HIRS into issue-381	2021-11-17 10:06:58 -05:00
chubtub	d5fcd06902	Add error handling to clarify endorsement validation error	2021-11-16 16:59:56 -05:00
Cyrus	d31b710824	This is a test run to ignore endorsement credential verification during firmware testing.	2021-11-12 14:24:33 -05:00
Cyrus	c944aab335	Added a log statement to get more information about the certificate that is failing signature verification.	2021-11-12 11:31:00 -05:00
chubtub	d183504a3f	Merge branch 'master' into issue-381	2021-11-10 10:08:42 -05:00
Cyrus	0934b3106f	Merge pull request #420 from nsacyber/base-rim-link-fix ... RimLinkHash Fix	2021-11-10 10:06:11 -05:00
Cyrus	70d92c4b38	Merge pull request #417 from nsacyber/issue-404 ... [#404] PXE Policy options	2021-11-10 10:05:52 -05:00
Cyrus	04b050de15	The rimlinkhash meta information wasn't linking up with the associated swidtag. This is because the wrong hash look up was being used. Previously when the hexDecHash and base64Hash were implemented, the main focus was on the rimel and not the swidtag.	2021-11-10 09:50:17 -05:00
Cyrus	2d9fb19d38	Updated the new polices after doing a bit of testing to make sure that they do ignore when there is a failure on that specific bit.	2021-11-10 07:27:33 -05:00
chubtub	0c233ae771	Set signature validity so that the ACA can report accurately	2021-11-08 14:51:38 -05:00
chubtub	3a6be133eb	Checkstyle changes	2021-11-08 14:51:38 -05:00
chubtub	bc7e07583f	Match only the actual extension bytes of the SKID	2021-11-08 14:51:38 -05:00
chubtub	962ca45bb7	Modify ACA RIM validation to search for a signing cert if the base RIM does not have an embedded cert. Validate the ca chain of the found signing cert.	2021-11-08 14:46:04 -05:00
Cyrus	f0ea84d199	I added code to do different masks on the pcr selection, but that was not needed. So I just uncommented the one section of ignore not being used.	2021-11-05 16:11:28 -04:00
chubtub	7bb9d8698d	Merge pull request #408 from nsacyber/support-rim-filename-correction ... Support RIM Filename Fix	2021-11-05 08:57:06 -04:00
Cyrus	e82de12341	Updated the ignore OS events check with the last rule for #404	2021-11-01 09:35:36 -04:00
Cyrus	fe617ea948	Updated the policy code to ignore based on the TPM Log Event. Added in the code for OS Events.	2021-10-29 20:24:46 -04:00
Cyrus	aae6845730	Initial Commit. This adds the visual object to the policy page.	2021-10-29 14:55:23 -04:00
iadgovuser29	4403a98b3b	[#414] Handle MODIFIED component without serial number	2021-10-29 09:02:56 -04:00
iadgovuser29	867833dc9d	[#411] Changed assumption regarding Delta cert components with ADDED status.	2021-10-27 14:14:09 -04:00
iadgovuser29	647c88d16b	[#409] Fixed one problem with delta component checking.	2021-10-26 15:53:05 -04:00
Cyrus	bb6ec6cc4b	The rim hash validation icon is coming up red when both base and support RIMs are loaded. This fixes that issue.	2021-10-26 11:09:36 -04:00
chubtub	0b4febf53b	WIP: frontend hangs while getting records from backend	2021-10-20 14:57:52 -04:00
iadgovuser29	e8085aae0f	[#401] Changed instanceof check and error message.	2021-10-17 21:51:29 -04:00
chubtub	324865b434	Merge branch 'master' into issue-395	2021-10-06 15:01:02 -04:00
chubtub	84a2ff723c	Controller class for returning TPM Event data to jsp	2021-10-06 15:00:23 -04:00
Cyrus	f8a3ccd962	This is an initial commit updates the policy page. Adds additional policies for generating a DevID. The underlying code doesn't actually generate one yet. But the SupplyChainPolicy holds the flags.	2021-09-17 07:55:44 -04:00
Cyrus	14ecd9832e	Updated unit tested to correct the failures that were occurring because of the updated code changes.	2021-08-30 11:44:37 -04:00
Cyrus	cf5472242b	Merge pull request #393 from nsacyber/uefi-test-update ... Checkstyle fix on a Unit Test	2021-08-24 09:42:12 -04:00
Cyrus	5a26093d57	Missed and update for a method that was updated with a new exception thrown.	2021-08-20 13:47:20 -04:00
iadgovuser26	71666542c1	Merge pull request #392 from nsacyber/uefi-test-update ... UEFI Unit Test Update	2021-08-20 12:16:35 -04:00
iadgovuser26	761fb6aaa9	Merge pull request #391 from nsacyber/fix-certificatetest-testisissuer ... Fix for faulty logic in CertificateTest.testIsIssuer	2021-08-20 12:16:23 -04:00
iadgovuser26	793d21ae5b	Merge pull request #390 from nsacyber/fix-testappraiser-name ... Fixing one unit test revealed additional test updates.	2021-08-20 12:16:04 -04:00
iadgovuser26	3132a590e1	Merge pull request #388 from nsacyber/ignore-tpmbaselinegeneratortest-csvgeneratortest ... Ignore tests from TPMBaselineGeneratorTest and ima.CSVGeneratorTest.	2021-08-20 12:15:35 -04:00
Cyrus	61497809f5	Updated the UefiGuid to have the vendor json file get passed in. This updates the unit test and fixes the issue.	2021-08-20 09:19:01 -04:00
iadgovuser26	9fbbf81ada	Merge pull request #389 from nsacyber/eventLogTesFix ... updated TCGEventLogEventsTest	2021-08-18 16:20:16 -04:00
iadgovuser29	7e3eaf4c5c	Fix for faulty logic in CertificateTest.testIsIssuer	2021-08-18 14:09:27 -04:00
iadgovuser29	f9a32e3f52	Fixing one unit test revealed additional test updates.	2021-08-18 13:29:49 -04:00
chubtub	c76a8a074e	Minor code clean up	2021-08-18 09:15:59 -04:00
iadgovuser29	b8741039a9	Ignore tests from TPMBaselineGeneratorTest and ima.CSVGeneratorTest.	2021-08-17 17:59:34 -04:00
lareine	32887eb598	updated TCGEventLogEventsTest	2021-08-17 17:30:45 -04:00
iadgovuser29	f54e1a15d0	Fixed a certificate conversion issue.	2021-08-17 17:21:32 -04:00
chubtub	dc7301e8a6	Update overloaded validateCertChain to check cert chain consistently	2021-08-17 14:41:00 -04:00
chubtub	6e849d601c	Merge branch 'master' into issue-345	2021-07-02 16:49:26 -04:00
chubtub	3b621770d5	Modify SupplyChainCredentialValidator.validateCertChain to thoroughly validate cert path.	2021-07-02 13:45:32 -04:00
Cyrus	e7cdba07c4	Merge pull request #377 from nsacyber/component-class-revision ... Component Class Bug Fix	2021-07-01 14:29:21 -04:00
Cyrus	cac913af11	Updated the component class to no longer use ints but instead use only Strings	2021-07-01 12:49:35 -04:00
chubtub	e86d1efbbf	One line change to SupplyChainCredentialValidator to loop fully through truststore.	2021-07-01 10:50:53 -04:00
Cyrus	a555fac716	Finished updating the unit test. The value of being passed in wasn't of a format that the component class could handle.	2021-06-29 20:33:59 -04:00
Cyrus	3269e81783	All components were failing on tests specifically set up to match components and pass. This happened because the int value of the component class value was being translated with SHORT.size. This is odd because it worked before but stopped.	2021-06-29 12:04:22 -04:00
Cyrus	5c448057d4	Merge branch 'master' into fm-validation-pass-link	2021-06-28 12:15:47 -04:00
chubtub	d1f0eb5d88	Check for an empty truststore during cert path validation. Removed the recursion in SupplyChainCredentialValidator.validateCertChain.	2021-06-25 11:40:08 -04:00
Cyrus	be3cd2bd32	Removed the validation of the PCRs line by line for the expected PCR values.	2021-06-24 11:46:01 -04:00
Cyrus	adb93dbd94	Updated the unit tests	2021-06-21 10:32:44 -04:00
Cyrus	e8d84b88f5	Updated the component class values for SMBIOS	2021-06-17 14:32:49 -04:00
Cyrus	132a336549	Updated the print out of the the component string to leave out Unkown and Other for display. Instead it'll just show nothing.	2021-06-17 13:12:26 -04:00
Cyrus	b06025a71f	Updated the Event Log Measurements class to use a hash for lookup	2021-06-17 12:52:28 -04:00
Cyrus	cd206f870c	These changes may be removed because the issue is becoming more involved and I may need to rethink how this will work.	2021-06-16 08:52:40 -04:00
Cyrus	9c060dec55	Updated event log measurements to pass in the overall result status. However display isn't printing out correctly.	2021-06-09 11:07:11 -04:00
Cyrus	218002a3c2	Merge remote-tracking branch 'origin/digest-implement-final' into fm-validation-pass-link	2021-06-08 22:19:52 -04:00
Cyrus	13043856ef	These changes update the component class object to handled SMBIOS components along with the TCG ones presented originally. The unit tests also were updated to use the new structure of the class and added additional tests for the SMBIOS entries	2021-06-07 13:46:47 -04:00
Cyrus	8a258f2b76	Updated some text associated with the rimType	2021-05-28 08:48:40 -04:00
Cyrus	0e8e88b536	This commit has updated changes that save both a base64 and a hex dec value of the RIM file hash to the database. Depending on what is needed, they are used to pull either the base or support RIM. Also fixed the link for the rimlinkhash on the details page.	2021-05-27 13:46:43 -04:00
Cyrus	8fbd6e1a39	Changed up some of the encoded for the rim byte array	2021-05-25 13:11:57 -04:00
Cyrus	65d596a756	Some additional updates that included deviceNames as a means to pull RIM information. In addition updated the display of the failures, adding filters for like events from the baseline.	2021-05-20 06:26:07 -04:00
Cyrus	ddc36d81f4	This set of code changes deals with the displaying of failed digests values from the validation process. The way there were displayed before was going to be unsustainable because event numbers will never match up. There for a direct compare to a failed event would never be accurate.	2021-05-17 12:44:03 -04:00
Cyrus	5acc393541	This commit adds several changes that updates how the RIM files are accessed and made accessible from the DB as well as what is shown visually when there is a validation failure and the measurement log is shown.	2021-05-06 08:43:26 -04:00
Cyrus	1d33054577	Merge pull request #350 from nsacyber/ignore-gpt-events ... [#349] Ignore GPT PCR	2021-05-04 10:14:53 -04:00
Cyrus	c7fb94d7b4	Merge pull request #352 from nsacyber/event-digest-update ... [#343] Event digest update (UI)	2021-04-23 08:45:13 -04:00
Cyrus	46c9640cbe	Updated the code with additional OIDs for the algorithms that certificates use for the signatures. And updated the isIssuer method to not use the hard coded algorithm string.	2021-04-15 14:15:11 -04:00
Cyrus	b52b8101a6	The new policy setting is supposed to be default on.	2021-04-14 14:23:43 -04:00
Cyrus	523bae8f9d	This set of code adds an additional policy to the page for the GPT PCR. Details for the change can be found in issue #349.	2021-04-14 13:55:52 -04:00
Cyrus	5a82e48b61	Merge branch 'master' into event-digest-update	2021-04-13 08:50:42 -04:00
Cyrus	e70e019c6b	This commit has some changes to how patch and supplemental are handled. It adds some flags to the Record and Value objects to note that data has been processed so that multiple entries aren't created.	2021-04-13 07:45:52 -04:00
Cyrus	760f246096	Merge pull request #342 from nsacyber/rim_digest_store ... [#341] RIM Event Digest Store	2021-04-13 07:45:17 -04:00
Cyrus	c46aa2b48b	Merge pull request #348 from nsacyber/certificate-failure-fidelity ... Certificate Failure Fidelity	2021-04-09 14:15:43 -04:00
Cyrus	ea5b85b703	Updated the code to now display the var swidtag and rimel. However there are issues with the examples. This commit has fixes for how the pcr values are pulled for display on the base RIM page.	2021-04-02 06:34:47 -04:00
Cyrus	2abb13d99d	This change is to update the code to the values listed in Table 13 of Registry of Reserved TPM 2.0 Handles and Localities for Platform Class Values.	2021-03-30 06:54:10 -04:00
Cyrus	4911742c7a	This is a checkout of some changes to the resource management for swid tags so that the file name listed is associated with the stored support RIMS.	2021-03-30 06:35:14 -04:00
Cyrus	f2308f2955	Updated the isIssuer and the containsAll to allow the reason for the platform certificate failure isn't that the issuer is missing but that the issuer available fails the public key on the details page for certificates	2021-03-26 10:32:19 -04:00
Cyrus	a6c6fbfb31	Made some changes for using just the RIM Hash to pull support rims from the database to associated with the swid tag. Changed the rim hash from and int to a string.	2021-03-25 13:28:31 -04:00
Cyrus	c290ba25be	Modified how unmatched log events are tested. Now it uses the reference event value from the database.	2021-03-23 13:13:17 -04:00
Cyrus	108748fb2a	Undid some code and change the Digest Value class into a table in the database. This code then updates those values when a provision is initiated. At this time, that is all it does.	2021-03-19 11:01:25 -04:00
Cyrus	53cb300063	This is an initial commit with changes that add new classes for digest reference matching.	2021-03-17 10:23:08 -04:00
Cyrus	9134e2ab9d	Merge branch 'master' into rim_digest_store	2021-03-12 07:33:47 -05:00
Cyrus	accbc422e7	This adds the additional classes	2021-03-11 10:56:19 -05:00
Cyrus	19aa3c27a1	initial commit with the structures that are to be set up	2021-03-11 10:55:22 -05:00
Cyrus	c66f4f7648	Merge pull request #334 from nsacyber/Unmatched-component-refactor ... Unmatched component refactor	2021-03-09 13:07:16 -05:00
Cyrus	9008972fbc	Cleared all build errors	2021-03-08 06:43:10 -05:00
Cyrus	0e3eabc34f	Removed unused import	2021-03-08 06:31:31 -05:00
Cyrus	bd5bca58ea	I have modified the code to correct handle the situation in which the device has more components than the certificate and I have taken steps to make the system test GOOD pass for test A6, A7 and A8.	2021-03-05 15:36:29 -05:00
Cyrus	763dcbd975	These are changes that were made in the system-tests-test that resolved the issues in the first TPM 2.0 system tests on travis.	2021-03-04 08:01:18 -05:00
Cyrus	8a571f1788	When a delta has the component that is bad, not the base, it wasn't highlighting. This is because the component failures wasn't be updated and then the certificate needed to be updated as well.	2021-02-25 06:59:56 -05:00
Cyrus	a5184f5a5b	Final changes that adds in the additional setting for the renewal period threshold. This value indicates that if the end validity has been reached for the current issued attestation certificate, then don't generate one. However if we are within the number of days set by the threshold, then generate the certificate before it expires. The default is 1 year from the end validity.	2021-02-23 10:17:56 -05:00
Cyrus	dcf0ec8101	Merge branch 'master' into aic-policy-rule	2021-02-11 14:13:28 -05:00
Cyrus	9917fadef7	On a previous commit, I removed a piece of code that checked the base credential first. Because the delta fixed a problem in the base, the base failed before the delta was checked. This was completely removed. On a test that we had previously done, the test passes when it should fail because there is only a base, so that check isn't being done. This change reintroduces the check but in a different location with flags for when there is a delta present.	2021-02-09 13:30:37 -05:00
Cyrus	69cd06df3b	Merging error didn't include the update to Assert.State	2021-02-09 06:54:31 -05:00
Cyrus	5e4dc8ce82	Merge branch 'master' into Unmatched-component-refactor	2021-02-08 15:23:21 -05:00
Cyrus	7b79ceb07a	Found the issue with the component being removed that doesn't have a proper serial number and adding one with it. The code was revalidating the base in the attributes enabled flag. This was unncessary.	2021-02-08 14:25:10 -05:00
Cyrus	4999c96685	Updated code to correct situations that were not linking up with properly for delta and platform certificate component validation.	2021-02-05 16:10:15 -05:00
Cyrus	677716fa08	Merge branch 'master' into Unmatched-component-refactor	2021-02-04 08:51:31 -05:00
Cyrus	447c817839	Updated the lists for the left over components.	2021-02-02 12:57:55 -05:00
Cyrus	2d9bbe1bd7	initial commit	2021-02-01 11:24:20 -05:00
Cyrus	8d6a697a23	Removed some unnecessary comments	2021-01-28 08:08:12 -05:00
Cyrus	653bfddc6d	Updated some code and took out things that didin't need to be in the official build for unit tests	2021-01-21 07:40:55 -05:00
Cyrus	5589096443	Cleaned up some stuff I found during code compare in github.	2021-01-20 13:23:51 -05:00
Cyrus	acc022d784	Finalized clean up.	2021-01-20 13:05:43 -05:00
Cyrus	e9eef0e5b3	Updated the code to go through the serial numbers that are valid numbers verus generic filler. Tested against the provisioner.	2021-01-20 08:00:24 -05:00
Cyrus	fa12614221	Testing out new code	2021-01-14 10:34:27 -05:00
Cyrus	beb1ccbee3	Updated a supply chain validation check for delta certificates. Updated the check for duplicate base platform certificates when storing them for the same device and updated the begin validity date for the delta vs the base check.	2021-01-12 12:26:54 -05:00
Cyrus	fcb496686c	This includes some refactoring of the component identifier.	2021-01-11 13:24:49 -05:00
Cyrus	7028810707	This latest push should have the code that'll highlight the components based on a string rather than the serial number. This also adds additional checks for the validity begin date of the delta not matching or being before the base. It also checks that they don't have the same certificate serial number.	2020-12-30 08:41:47 -05:00
Cyrus	1db52cebf9	This is a stopping point because the code can't be fully worked out because the data (certificates) aren't correct.	2020-12-17 07:24:51 -05:00
Cyrus	8fa5dfdd9e	Removed unused imports	2020-12-14 10:57:35 -05:00
Cyrus	62c7ca2d90	This PR is to address issue #308. The ACA was pulling Issuer Certificates using the organization RDN of the subject string and getting this from the issuer string of the EC or PC. This presents a problem because it isn't a required field. The organization field cannot be null or empty. Pulling objects from a DB using null or empty would produce bad results. The main change of this issue (which has not been full tested) is pulling using the AKI for the db lookup. If this fails, instead of falling back on potentially left out fields like the O= RDN, the ACA takes the issuer/subject fields, breaks them apart and sorts them based on the key. It also changes the case. This way the lookup can be assured to match in case of some random situation in which the issuer or subject field don't match because RDN keys are just in different positions of the string.	2020-12-11 14:47:46 -05:00
Cyrus	e64c6cf772	Merge branch 'master' into aic-policy-rule	2020-12-03 13:34:29 -05:00
Cyrus	e32e9412d8	Merge branch 'master' into Unmatched-component-refactor	2020-12-03 13:20:12 -05:00
Cyrus	a32d3a5f02	Remove comments	2020-12-01 09:46:05 -05:00
Cyrus	29b7d466cd	Updated wording in validation for failed trust store	2020-11-30 09:23:10 -05:00
Cyrus	9433c97dc9	The code now uses a combination of the class value and the platform manufacturer and model to identify mismatches. This now highlights the failured components	2020-11-25 08:02:45 -05:00
Cyrus	ffbcebbf11	Found the issue with the isMatch class not working. The component class string for the class value has a pound sign.	2020-11-24 09:12:00 -05:00
Cyrus	fbdcf83840	Continued refactoring to update the failed components part of the attribute validation. The delta mapping needs to be reworked to not use serials.	2020-11-23 14:46:29 -05:00
Cyrus	2b41720ded	Merge branch 'master' into update-component-failure-highlight	2020-11-17 15:24:27 -05:00
chubtub	e3b5d164a3	Add SKI to front end. Extract PK from base RIM to validate signature if not found in db	2020-11-16 16:43:11 -08:00
Cyrus	e8f5107137	Updating code to use a different format for identifying failed components.	2020-11-09 13:59:19 -05:00
Cyrus	bdb32d13ad	initial commit	2020-11-09 12:45:36 -05:00
Cyrus	967d9a0030	Merge branch 'master' into aic-policy-rule	2020-11-09 07:24:33 -05:00
Cyrus	9aa2c6a46d	Merge branch 'master' into client-display-log-mismatch	2020-11-06 09:17:38 -05:00
Cyrus	ed7dea3706	Merge branch 'master' into aic-policy-rule	2020-11-06 06:42:44 -05:00
Cyrus	6130f29dfa	Merge branch 'master' into aic-policy-rule	2020-11-05 14:47:52 -05:00
chubtub	623da2ce80	Overload RIM validator class for faster signature checking	2020-11-05 14:13:50 -05:00
Cyrus	c7ffb1c57d	Merge branch 'master' into client-display-log-mismatch	2020-11-05 12:39:35 -05:00
chubtub	302ffd81ee	Load Schema object in ReferenceManifestValidator class with controller class instantiation to save time	2020-11-05 11:07:17 -05:00
chubtub	24cf71642d	Add validation for support RIM hash and base RIM signature.	2020-11-05 11:07:17 -05:00