Examples with TlsPolicy com.intel.mtwilson.tls.TlsPolicy used on opensource projects

Example 1 with TlsPolicy

use of com.intel.mtwilson.tls.TlsPolicy in project OpenAttestation by OpenAttestation.

the class HostAgentFactory method getHostAgent.

/**
     * BUG #497   given a host record, this method creates an appropriate HostAgent
     * object (for vmware, citrix, or intel hosts) and its TLS Policy. 
     * Currently only our vmware code implements HostAgent, need to implement it
     * also in our citrix and intel code. 
     * @param txtHost must have Name, AddOnConnectionInfo, SSLPolicy, and SSLCertificate fields set
     * @return 
     */
public HostAgent getHostAgent(TblHosts host) {
    try {
        // switching from Hostname to InternetAddress (better support for both hostname and ip address)
        InternetAddress hostAddress = new InternetAddress(host.getName());
        // here we figure out if it's vmware or intel  and ensure we have a valid connection string starting with the vendor scheme.  XXX TODO should not be here, everyone should have valid connection strings like vmware:*, intel:*, citrix:*, etc. 
        // no special case for citrix, since that support was added recently they should always come with citrix: prepended.
        String connectionString = getConnectionString(host);
        TlsPolicy tlsPolicy = getTlsPolicy(host);
        // XXX TODO need to have a way for the agent using trust-first-certificate to save a new certificate to the TblHosts record... right now it is lost.
        return getHostAgent(hostAddress, connectionString, tlsPolicy);
    } catch (Exception e) {
        throw new IllegalArgumentException("Cannot create Host Agent for " + host.getName() + ": " + e.toString(), e);
    }
}

Example 2 with TlsPolicy

use of com.intel.mtwilson.tls.TlsPolicy in project OpenAttestation by OpenAttestation.

the class HostAgentFactory method getManifest.

/**
     * XXX TODO this method is moved here from the previous interface ManifestStrategy.
     * It's currently here to minimize code changes for the current release
     * but its functionality needs to be moved somewhere else - the trust utils
     * library should not know about the mt wilson database structure.
     * This implementation is a combination of getHostAgent and code from the original getManifest.
     * @param host
     * @return 
     */
public HashMap<String, ? extends IManifest> getManifest(TblHosts host) {
    try {
        InternetAddress hostAddress = new InternetAddress(host.getName());
        String connectionString = getConnectionString(host);
        // txtHost.getTlsPolicy();  // XXX TODO TxtHost doesn't have this field yet
        String tlsPolicyName = host.getTlsPolicyName() == null ? "TRUST_FIRST_CERTIFICATE" : host.getTlsPolicyName();
        //            ByteArrayResource resource = new ByteArrayResource(host.getTlsKeystore() == null ? new byte[0] : host.getTlsKeystore()); // XXX TODO it's the responsibility of the caller to save the TblHosts record after calling this method if the policy is trust first certificate ; we need to get tie the keystore to the database, especially for TRUST_FIRST_CERTIFICATE, so if it's the first connection we can save the certificate back to the database after connecting
        // XXX TODO uh oh... opening a keystore requires a password, so we can verify its signed contents, which is important. putting the password in the txthost record won't be secure.  password needs to  come from attestation service configuration - or from the user.  this isn't an issue for the factory because the factory is supposed to get the keystore AFTER it has been opened with the password.  but when this code moves to the JPA/DAO/Repository layer, we'll need to have a password from somewhere.         
        String password = "password";
        // XXX TODO see above commment about password;  the per-host trusted certificates keystore has to either be protected by a password known to all mt wilson instances (stored in database or sync'd across each server's configuration files) or it has to be protected by a group secret known to all authorized clients (and then we need a mechanism for the api client to send us the secret in the request, and a way get secrets in and out of api client's keystore so it can be sync'd across the authorized group of clients) or we can just not store it encrypted and use a pem-format keystore instead of a java KeyStore 
        SimpleKeystore tlsKeystore = new SimpleKeystore(host.getTlsKeystoreResource(), password);
        // XXX TODO not sure that this belongs in the http-authorization package, because policy names are an application-level thing (allowed configurations), and creating the right repository is an application-level thing too (mutable vs immutable, and underlying implementation - keystore, array, cms of pem-list.
        TlsPolicy tlsPolicy = getTlsPolicy(tlsPolicyName, tlsKeystore);
        HostAgent hostAgent = getHostAgent(hostAddress, connectionString, tlsPolicy);
        HashMap<String, ? extends IManifest> manifest = hostAgent.getManifest();
        //            host.setTlsKeystore(resource.toByteArray()); // if the tls policy is TRUST_FIRST_CERTIFICATE then it's possible a new cert has been saved in it and we have to make sure it gets saved to the host record;  for all other tls policies there would be no change so this is a no-op -  the byte array will be the same as the one we started with
        return manifest;
    } catch (Exception e) {
        throw new IllegalArgumentException("Cannot get manifest for " + host.getName() + ": " + e.toString(), e);
    }
}

Example 3 with TlsPolicy

use of com.intel.mtwilson.tls.TlsPolicy in project OpenAttestation by OpenAttestation.

the class HostAgentFactory method getTlsPolicy.

public TlsPolicy getTlsPolicy(String tlsPolicyName, Resource resource) throws KeyManagementException {
    // XXX TODO uh oh... opening a keystore requires a password, so we can verify its signed contents, which is important. putting the password in the txthost record won't be secure.  password needs to  come from attestation service configuration - or from the user.  this isn't an issue for the factory because the factory is supposed to get the keystore AFTER it has been opened with the password.  but when this code moves to the JPA/DAO/Repository layer, we'll need to have a password from somewhere.         
    String password = "password";
    // XXX TODO only because txthost doesn't have the field yet... we should get the keystore from the txthost object
    SimpleKeystore tlsKeystore = new SimpleKeystore(resource, password);
    // XXX TODO not sure that this belongs in the http-authorization package, because policy names are an application-level thing (allowed configurations), and creating the right repository is an application-level thing too (mutable vs immutable, and underlying implementation - keystore, array, cms of pem-list.
    TlsPolicy tlsPolicy = getTlsPolicy(tlsPolicyName, tlsKeystore);
    return tlsPolicy;
}

Example 4 with TlsPolicy

use of com.intel.mtwilson.tls.TlsPolicy in project OpenAttestation by OpenAttestation.

the class CitrixAgentStrategy method getManifest.

@Override
public HashMap<String, ? extends IManifest> getManifest(TblHosts host) throws Exception {
    String pcrList = getPcrList(host);
    HostAgentFactory factory = new HostAgentFactory();
    TlsPolicy tlsPolicy = factory.getTlsPolicy(host.getTlsPolicyName(), host.getTlsKeystoreResource());
    CitrixClient client = new CitrixClient(new TlsConnection(host.getAddOnConnectionInfo(), tlsPolicy));
    return client.getQuoteInformationForHost(pcrList);
}