2 * Copyright (C) 2011-2014 Andreas Steffen
3 * HSR Hochschule fuer Technik Rapperswil
5 * This program is free software; you can redistribute it and/or modify it
6 * under the terms of the GNU General Public License as published by the
7 * Free Software Foundation; either version 2 of the License, or (at your
8 * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
10 * This program is distributed in the hope that it will be useful, but
11 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
12 * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
16 #include "imc_os_state.h"
18 #include <imc/imc_agent.h>
19 #include <imc/imc_msg.h>
20 #include <imc/imc_os_info.h>
21 #include <ietf/ietf_attr.h>
22 #include <ietf/ietf_attr_attr_request.h>
23 #include <ietf/ietf_attr_default_pwd_enabled.h>
24 #include <ietf/ietf_attr_fwd_enabled.h>
25 #include <ietf/ietf_attr_installed_packages.h>
26 #include <ietf/ietf_attr_numeric_version.h>
27 #include <ietf/ietf_attr_op_status.h>
28 #include <ietf/ietf_attr_product_info.h>
29 #include <ietf/ietf_attr_string_version.h>
30 #include <ita/ita_attr.h>
31 #include <ita/ita_attr_get_settings.h>
32 #include <ita/ita_attr_settings.h>
33 #include <ita/ita_attr_device_id.h>
35 #include <tncif_pa_subtypes.h>
38 #include <utils/debug.h>
42 static const char imc_name
[] = "OS";
44 static pen_type_t msg_types
[] = {
45 { PEN_IETF
, PA_SUBTYPE_IETF_OPERATING_SYSTEM
}
48 static imc_agent_t
*imc_os
;
49 static imc_os_info_t
*os
;
52 * see section 3.8.1 of TCG TNC IF-IMC Specification 1.3
54 TNC_Result TNC_IMC_API
TNC_IMC_Initialize(TNC_IMCID imc_id
,
55 TNC_Version min_version
,
56 TNC_Version max_version
,
57 TNC_Version
*actual_version
)
61 DBG1(DBG_IMC
, "IMC \"%s\" has already been initialized", imc_name
);
62 return TNC_RESULT_ALREADY_INITIALIZED
;
64 imc_os
= imc_agent_create(imc_name
, msg_types
, countof(msg_types
),
65 imc_id
, actual_version
);
68 return TNC_RESULT_FATAL
;
71 os
= imc_os_info_create();
74 imc_os
->destroy(imc_os
);
77 return TNC_RESULT_FATAL
;
80 if (min_version
> TNC_IFIMC_VERSION_1
|| max_version
< TNC_IFIMC_VERSION_1
)
82 DBG1(DBG_IMC
, "no common IF-IMC version");
83 return TNC_RESULT_NO_COMMON_VERSION
;
85 return TNC_RESULT_SUCCESS
;
89 * see section 3.8.2 of TCG TNC IF-IMC Specification 1.3
91 TNC_Result TNC_IMC_API
TNC_IMC_NotifyConnectionChange(TNC_IMCID imc_id
,
92 TNC_ConnectionID connection_id
, TNC_ConnectionState new_state
)
98 DBG1(DBG_IMC
, "IMC \"%s\" has not been initialized", imc_name
);
99 return TNC_RESULT_NOT_INITIALIZED
;
103 case TNC_CONNECTION_STATE_CREATE
:
104 state
= imc_os_state_create(connection_id
);
105 return imc_os
->create_state(imc_os
, state
);
106 case TNC_CONNECTION_STATE_HANDSHAKE
:
107 if (imc_os
->change_state(imc_os
, connection_id
, new_state
,
108 &state
) != TNC_RESULT_SUCCESS
)
110 return TNC_RESULT_FATAL
;
112 state
->set_result(state
, imc_id
,
113 TNC_IMV_EVALUATION_RESULT_DONT_KNOW
);
114 return TNC_RESULT_SUCCESS
;
115 case TNC_CONNECTION_STATE_DELETE
:
116 return imc_os
->delete_state(imc_os
, connection_id
);
118 return imc_os
->change_state(imc_os
, connection_id
,
124 * Add IETF Product Information attribute to the send queue
126 static void add_product_info(imc_msg_t
*msg
)
130 pen_t vendor_id
= PEN_IETF
;
133 typedef struct vendor_pen_t
{
138 vendor_pen_t vendor_pens
[] = {
139 { OS_TYPE_DEBIAN
, PEN_DEBIAN
},
140 { OS_TYPE_UBUNTU
, PEN_CANONICAL
},
141 { OS_TYPE_FEDORA
, PEN_FEDORA
},
142 { OS_TYPE_REDHAT
, PEN_REDHAT
},
143 { OS_TYPE_ANDROID
, PEN_GOOGLE
}
146 os_type
= os
->get_type(os
);
147 for (i
= 0; i
< countof(vendor_pens
); i
++)
149 if (os_type
== vendor_pens
[i
].os_type
)
151 vendor_id
= vendor_pens
[i
].pen
;
155 attr
= ietf_attr_product_info_create(vendor_id
, 0, os
->get_name(os
));
156 msg
->add_attribute(msg
, attr
);
160 * Add IETF Numeric Version attribute to the send queue
162 static void add_numeric_version(imc_msg_t
*msg
)
165 u_int32_t major
, minor
;
167 os
->get_numeric_version(os
, &major
, &minor
);
168 DBG1(DBG_IMC
, "operating system numeric version is %d.%d",
171 attr
= ietf_attr_numeric_version_create(major
, minor
, 0, 0, 0);
172 msg
->add_attribute(msg
, attr
);
176 * Add IETF String Version attribute to the send queue
178 static void add_string_version(imc_msg_t
*msg
)
182 attr
= ietf_attr_string_version_create(os
->get_version(os
),
183 chunk_empty
, chunk_empty
);
184 msg
->add_attribute(msg
, attr
);
188 * Add IETF Operational Status attribute to the send queue
190 static void add_op_status(imc_msg_t
*msg
)
193 time_t uptime
, last_boot
;
195 uptime
= os
->get_uptime(os
);
196 last_boot
= uptime ?
time(NULL
) - uptime
: UNDEFINED_TIME
;
197 if (last_boot
!= UNDEFINED_TIME
)
199 DBG1(DBG_IMC
, "last boot: %T, %u s ago", &last_boot
, TRUE
, uptime
);
201 attr
= ietf_attr_op_status_create(OP_STATUS_OPERATIONAL
,
202 OP_RESULT_SUCCESSFUL
, last_boot
);
203 msg
->add_attribute(msg
, attr
);
207 * Add IETF Forwarding Enabled attribute to the send queue
209 static void add_fwd_enabled(imc_msg_t
*msg
)
212 os_fwd_status_t fwd_status
;
214 fwd_status
= os
->get_fwd_status(os
);
215 DBG1(DBG_IMC
, "IPv4 forwarding is %N",
216 os_fwd_status_names
, fwd_status
);
217 attr
= ietf_attr_fwd_enabled_create(fwd_status
);
218 msg
->add_attribute(msg
, attr
);
222 * Add IETF Factory Default Password Enabled attribute to the send queue
224 static void add_default_pwd_enabled(imc_msg_t
*msg
)
228 DBG1(DBG_IMC
, "factory default password is disabled");
229 attr
= ietf_attr_default_pwd_enabled_create(FALSE
);
230 msg
->add_attribute(msg
, attr
);
234 * Add ITA Device ID attribute to the send queue
236 static void add_device_id(imc_msg_t
*msg
)
239 chunk_t value
= chunk_empty
, keyid
;
240 char *name
, *device_id
, *cert_path
;
241 certificate_t
*cert
= NULL
;
242 public_key_t
*pubkey
;
244 /* Get the device ID as a character string */
245 device_id
= lib
->settings
->get_str(lib
->settings
,
246 "%s.plugins.imc-os.device_id", NULL
, lib
->ns
);
249 value
= chunk_clone(chunk_from_str(device_id
));
254 /* Derive the device ID from a raw public key */
255 cert_path
= lib
->settings
->get_str(lib
->settings
,
256 "%s.plugins.imc-os.device_pubkey", NULL
, lib
->ns
);
259 cert
= lib
->creds
->create(lib
->creds
, CRED_CERTIFICATE
,
260 CERT_TRUSTED_PUBKEY
, BUILD_FROM_FILE
,
261 cert_path
, BUILD_END
);
264 DBG2(DBG_IMC
, "loaded device public key from '%s'", cert_path
);
268 DBG1(DBG_IMC
, "loading device public key from '%s' failed",
275 /* Derive the device ID from the public key contained in a certificate */
276 cert_path
= lib
->settings
->get_str(lib
->settings
,
277 "%s.plugins.imc-os.device_cert", NULL
, lib
->ns
);
280 cert
= lib
->creds
->create(lib
->creds
, CRED_CERTIFICATE
,
281 CERT_X509
, BUILD_FROM_FILE
,
282 cert_path
, BUILD_END
);
285 DBG2(DBG_IMC
, "loaded device certificate from '%s'", cert_path
);
289 DBG1(DBG_IMC
, "loading device certificate from '%s' failed",
295 /* Compute the SHA-1 keyid of the retrieved device public key */
298 pubkey
= cert
->get_public_key(cert
);
301 if (pubkey
->get_fingerprint(pubkey
, KEYID_PUBKEY_INFO_SHA1
,
304 value
= chunk_to_hex(keyid
, NULL
, FALSE
);
306 pubkey
->destroy(pubkey
);
314 /* Derive the device ID from some unique OS settings */
315 name
= os
->get_type(os
) == OS_TYPE_ANDROID ?
316 "android_id" : "/var/lib/dbus/machine-id";
317 value
= os
->get_setting(os
, name
);
319 /* Trim trailing newline character */
320 if (value
.len
> 0 && value
.ptr
[value
.len
- 1] == '\n')
328 DBG1(DBG_IMC
, "no device ID available");
332 DBG1(DBG_IMC
, "device ID is %.*s", value
.len
, value
.ptr
);
333 attr
= ita_attr_device_id_create(value
);
334 msg
->add_attribute(msg
, attr
);
339 * Add an IETF Installed Packages attribute to the send queue
341 static void add_installed_packages(imc_state_t
*state
, imc_msg_t
*msg
)
344 ietf_attr_installed_packages_t
*attr_cast
;
345 enumerator_t
*enumerator
;
346 chunk_t name
, version
;
348 attr
= ietf_attr_installed_packages_create();
350 enumerator
= os
->create_package_enumerator(os
);
351 while (enumerator
->enumerate(enumerator
, &name
, &version
))
353 DBG2(DBG_IMC
, "package '%.*s' (%.*s)",
354 name
.len
, name
.ptr
, version
.len
, version
.ptr
);
355 attr_cast
= (ietf_attr_installed_packages_t
*)attr
;
356 attr_cast
->add(attr_cast
, name
, version
);
358 enumerator
->destroy(enumerator
);
360 msg
->add_attribute(msg
, attr
);
364 * Add ITA Settings attribute to the send queue
366 static void add_settings(enumerator_t
*enumerator
, imc_msg_t
*msg
)
368 pa_tnc_attr_t
*attr
= NULL
;
369 ita_attr_settings_t
*attr_cast
;
374 while (enumerator
->enumerate(enumerator
, &name
))
376 DBG1(DBG_IMC
, "setting '%s'", name
);
378 value
= os
->get_setting(os
, name
);
385 attr
= ita_attr_settings_create();
388 attr_cast
= (ita_attr_settings_t
*)attr
;
389 attr_cast
->add(attr_cast
, name
, value
);
395 msg
->add_attribute(msg
, attr
);
400 * see section 3.8.3 of TCG TNC IF-IMC Specification 1.3
402 TNC_Result TNC_IMC_API
TNC_IMC_BeginHandshake(TNC_IMCID imc_id
,
403 TNC_ConnectionID connection_id
)
407 TNC_Result result
= TNC_RESULT_SUCCESS
;
411 DBG1(DBG_IMC
, "IMC \"%s\" has not been initialized", imc_name
);
412 return TNC_RESULT_NOT_INITIALIZED
;
414 if (!imc_os
->get_state(imc_os
, connection_id
, &state
))
416 return TNC_RESULT_FATAL
;
418 if (lib
->settings
->get_bool(lib
->settings
,
419 "%s.plugins.imc-os.push_info", TRUE
, lib
->ns
))
421 out_msg
= imc_msg_create(imc_os
, state
, connection_id
, imc_id
,
422 TNC_IMVID_ANY
, msg_types
[0]);
423 add_product_info(out_msg
);
424 add_string_version(out_msg
);
425 add_numeric_version(out_msg
);
426 add_op_status(out_msg
);
427 add_fwd_enabled(out_msg
);
428 add_default_pwd_enabled(out_msg
);
429 add_device_id(out_msg
);
431 /* send PA-TNC message with the excl flag not set */
432 result
= out_msg
->send(out_msg
, FALSE
);
433 out_msg
->destroy(out_msg
);
439 static TNC_Result
receive_message(imc_state_t
*state
, imc_msg_t
*in_msg
)
442 enumerator_t
*enumerator
;
446 bool fatal_error
= FALSE
;
448 /* generate an outgoing PA-TNC message - we might need it */
449 out_msg
= imc_msg_create_as_reply(in_msg
);
451 /* parse received PA-TNC message and handle local and remote errors */
452 result
= in_msg
->receive(in_msg
, out_msg
, &fatal_error
);
453 if (result
!= TNC_RESULT_SUCCESS
)
455 out_msg
->destroy(out_msg
);
459 /* analyze PA-TNC attributes */
460 enumerator
= in_msg
->create_attribute_enumerator(in_msg
);
461 while (enumerator
->enumerate(enumerator
, &attr
))
463 type
= attr
->get_type(attr
);
465 if (type
.vendor_id
== PEN_IETF
)
467 if (type
.type
== IETF_ATTR_ATTRIBUTE_REQUEST
)
469 ietf_attr_attr_request_t
*attr_cast
;
473 attr_cast
= (ietf_attr_attr_request_t
*)attr
;
475 e
= attr_cast
->create_enumerator(attr_cast
);
476 while (e
->enumerate(e
, &entry
))
478 if (entry
->vendor_id
== PEN_IETF
)
482 case IETF_ATTR_PRODUCT_INFORMATION
:
483 add_product_info(out_msg
);
485 case IETF_ATTR_STRING_VERSION
:
486 add_string_version(out_msg
);
488 case IETF_ATTR_NUMERIC_VERSION
:
489 add_numeric_version(out_msg
);
491 case IETF_ATTR_OPERATIONAL_STATUS
:
492 add_op_status(out_msg
);
494 case IETF_ATTR_FORWARDING_ENABLED
:
495 add_fwd_enabled(out_msg
);
497 case IETF_ATTR_FACTORY_DEFAULT_PWD_ENABLED
:
498 add_default_pwd_enabled(out_msg
);
500 case IETF_ATTR_INSTALLED_PACKAGES
:
501 add_installed_packages(state
, out_msg
);
507 else if (entry
->vendor_id
== PEN_ITA
)
511 case ITA_ATTR_DEVICE_ID
:
512 add_device_id(out_msg
);
522 else if (type
.vendor_id
== PEN_ITA
&& type
.type
== ITA_ATTR_GET_SETTINGS
)
524 ita_attr_get_settings_t
*attr_cast
;
527 attr_cast
= (ita_attr_get_settings_t
*)attr
;
529 e
= attr_cast
->create_enumerator(attr_cast
);
530 add_settings(e
, out_msg
);
534 enumerator
->destroy(enumerator
);
538 result
= TNC_RESULT_FATAL
;
542 /* send PA-TNC message with the EXCL flag set */
543 result
= out_msg
->send(out_msg
, TRUE
);
545 out_msg
->destroy(out_msg
);
551 * see section 3.8.4 of TCG TNC IF-IMC Specification 1.3
554 TNC_Result TNC_IMC_API
TNC_IMC_ReceiveMessage(TNC_IMCID imc_id
,
555 TNC_ConnectionID connection_id
,
556 TNC_BufferReference msg
,
558 TNC_MessageType msg_type
)
566 DBG1(DBG_IMC
, "IMC \"%s\" has not been initialized", imc_name
);
567 return TNC_RESULT_NOT_INITIALIZED
;
569 if (!imc_os
->get_state(imc_os
, connection_id
, &state
))
571 return TNC_RESULT_FATAL
;
573 in_msg
= imc_msg_create_from_data(imc_os
, state
, connection_id
, msg_type
,
574 chunk_create(msg
, msg_len
));
575 result
= receive_message(state
, in_msg
);
576 in_msg
->destroy(in_msg
);
582 * see section 3.8.6 of TCG TNC IF-IMV Specification 1.3
584 TNC_Result TNC_IMC_API
TNC_IMC_ReceiveMessageLong(TNC_IMCID imc_id
,
585 TNC_ConnectionID connection_id
,
586 TNC_UInt32 msg_flags
,
587 TNC_BufferReference msg
,
589 TNC_VendorID msg_vid
,
590 TNC_MessageSubtype msg_subtype
,
591 TNC_UInt32 src_imv_id
,
592 TNC_UInt32 dst_imc_id
)
600 DBG1(DBG_IMC
, "IMC \"%s\" has not been initialized", imc_name
);
601 return TNC_RESULT_NOT_INITIALIZED
;
603 if (!imc_os
->get_state(imc_os
, connection_id
, &state
))
605 return TNC_RESULT_FATAL
;
607 in_msg
= imc_msg_create_from_long_data(imc_os
, state
, connection_id
,
608 src_imv_id
, dst_imc_id
,msg_vid
, msg_subtype
,
609 chunk_create(msg
, msg_len
));
610 result
=receive_message(state
, in_msg
);
611 in_msg
->destroy(in_msg
);
617 * see section 3.8.7 of TCG TNC IF-IMC Specification 1.3
619 TNC_Result TNC_IMC_API
TNC_IMC_BatchEnding(TNC_IMCID imc_id
,
620 TNC_ConnectionID connection_id
)
624 DBG1(DBG_IMC
, "IMC \"%s\" has not been initialized", imc_name
);
625 return TNC_RESULT_NOT_INITIALIZED
;
627 return TNC_RESULT_SUCCESS
;
631 * see section 3.8.8 of TCG TNC IF-IMC Specification 1.3
633 TNC_Result TNC_IMC_API
TNC_IMC_Terminate(TNC_IMCID imc_id
)
637 DBG1(DBG_IMC
, "IMC \"%s\" has not been initialized", imc_name
);
638 return TNC_RESULT_NOT_INITIALIZED
;
640 imc_os
->destroy(imc_os
);
646 return TNC_RESULT_SUCCESS
;
650 * see section 4.2.8.1 of TCG TNC IF-IMC Specification 1.3
652 TNC_Result TNC_IMC_API
TNC_IMC_ProvideBindFunction(TNC_IMCID imc_id
,
653 TNC_TNCC_BindFunctionPointer bind_function
)
657 DBG1(DBG_IMC
, "IMC \"%s\" has not been initialized", imc_name
);
658 return TNC_RESULT_NOT_INITIALIZED
;
660 return imc_os
->bind_functions(imc_os
, bind_function
);