ExternalVendorCode/go-attestation
1
0
Fork 0
mirror of https://github.com/google/go-attestation.git synced 2025-05-30 14:04:24 +00:00
Code Issues Actions 2 Packages Projects Releases Wiki Activity

Make possibly-missing WBCL values ternary-typed (#226)

Browse Source
This commit is contained in:
Tom D 2021-06-21 14:10:45 -07:00 committed by GitHub
parent 0a3c6e82bf
commit 1b4849d2c3
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
2 changed files with 24 additions and 11 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

31
attest/win_events.go
View File

@ -146,6 +146,16 @@ const (
BitlockerStatusRecovery = 0x40 BitlockerStatusRecovery = 0x40
) )
// Ternary describes a boolean value that can additionally be unknown.
type Ternary uint8
// Valid Ternary values.
const (
TernaryUnknown Ternary = iota
TernaryTrue
TernaryFalse
)
// WinEvents describes information from the event log recorded during // WinEvents describes information from the event log recorded during
// bootup of Microsoft Windows. // bootup of Microsoft Windows.
type WinEvents struct { type WinEvents struct {
@ -169,19 +179,16 @@ type WinEvents struct {
KernelDebugEnabled bool KernelDebugEnabled bool
// DEPEnabled is true if NX (Data Execution Prevention) was consistently // DEPEnabled is true if NX (Data Execution Prevention) was consistently
// reported as enabled. // reported as enabled.
DEPEnabled bool DEPEnabled Ternary
// CodeIntegrityEnabled is true if code integrity was consistently // CodeIntegrityEnabled is true if code integrity was consistently
// reported as enabled. // reported as enabled.
CodeIntegrityEnabled bool CodeIntegrityEnabled Ternary
// TestSigningEnabled is true if test-mode signature verification was // TestSigningEnabled is true if test-mode signature verification was
// ever reported as enabled. // ever reported as enabled.
TestSigningEnabled bool TestSigningEnabled bool
// BitlockerUnlocks reports the bitlocker status for every instance of // BitlockerUnlocks reports the bitlocker status for every instance of
// a disk unlock, where bitlocker was used to secure the disk. // a disk unlock, where bitlocker was used to secure the disk.
BitlockerUnlocks []BitlockerStatus BitlockerUnlocks []BitlockerStatus
seenDep bool
seenCodeIntegrity bool
} }
// WinModuleLoad describes a module which was loaded while // WinModuleLoad describes a module which was loaded while
@ -346,8 +353,11 @@ func (w *WinEvents) readBooleanInt64Event(header microsoftEventHeader, r *bytes.
// Boolean signals that latch off if the are ever false (ie: attributes // Boolean signals that latch off if the are ever false (ie: attributes
// that represent a stronger security state when set). // that represent a stronger security state when set).
case dataExecutionPrevention: case dataExecutionPrevention:
w.DEPEnabled = isSet && !(w.DEPEnabled != isSet && w.seenDep) if isSet && w.DEPEnabled == TernaryUnknown {
w.seenDep = true w.DEPEnabled = TernaryTrue
} else if !isSet {
w.DEPEnabled = TernaryFalse
}
} }
return nil return nil
} }
@ -375,8 +385,11 @@ func (w *WinEvents) readBooleanByteEvent(header microsoftEventHeader, r *bytes.R
// Boolean signals that latch off if the are ever false (ie: attributes // Boolean signals that latch off if the are ever false (ie: attributes
// that represent a stronger security state when set). // that represent a stronger security state when set).
case codeIntegrity: case codeIntegrity:
w.CodeIntegrityEnabled = isSet && !(w.CodeIntegrityEnabled != isSet && w.seenCodeIntegrity) if isSet && w.CodeIntegrityEnabled == TernaryUnknown {
w.seenCodeIntegrity = true w.CodeIntegrityEnabled = TernaryTrue
} else if !isSet {
w.CodeIntegrityEnabled = TernaryFalse
}
} }
return nil return nil
} }

4
attest/win_events_test.go
View File

@ -27,8 +27,8 @@ func TestParseWinEvents(t *testing.T) {
want := &WinEvents{ want := &WinEvents{
ColdBoot: true, ColdBoot: true,
BootCount: 4, BootCount: 4,
DEPEnabled: true, DEPEnabled: TernaryTrue,
CodeIntegrityEnabled: true, CodeIntegrityEnabled: TernaryTrue,
BitlockerUnlocks: []BitlockerStatus{0, 0}, BitlockerUnlocks: []BitlockerStatus{0, 0},
LoadedModules: map[string]WinModuleLoad{ LoadedModules: map[string]WinModuleLoad{
"0fdce7d71936f79445e7d2c84cbeb97c948d3730e0b839166b0a4e625c2d4547": WinModuleLoad{ "0fdce7d71936f79445e7d2c84cbeb97c948d3730e0b839166b0a4e625c2d4547": WinModuleLoad{