2 * Copyright (C) 2012 Andreas Steffen
3 * HSR Hochschule fuer Technik Rapperswil
5 * This program is free software; you can redistribute it and/or modify it
6 * under the terms of the GNU General Public License as published by the
7 * Free Software Foundation; either version 2 of the License, or (at your
8 * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
10 * This program is distributed in the hope that it will be useful, but
11 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
12 * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
16 #include "imv_os_state.h"
17 #include "imv_os_database.h"
19 #include <imv/imv_agent.h>
20 #include <imv/imv_msg.h>
21 #include <ietf/ietf_attr.h>
22 #include <ietf/ietf_attr_attr_request.h>
23 #include <ietf/ietf_attr_default_pwd_enabled.h>
24 #include <ietf/ietf_attr_fwd_enabled.h>
25 #include <ietf/ietf_attr_installed_packages.h>
26 #include <ietf/ietf_attr_numeric_version.h>
27 #include <ietf/ietf_attr_op_status.h>
28 #include <ietf/ietf_attr_pa_tnc_error.h>
29 #include <ietf/ietf_attr_product_info.h>
30 #include <ietf/ietf_attr_remediation_instr.h>
31 #include <ietf/ietf_attr_string_version.h>
32 #include <ita/ita_attr.h>
33 #include <ita/ita_attr_get_settings.h>
34 #include <ita/ita_attr_settings.h>
35 #include <ita/ita_attr_angel.h>
37 #include <tncif_names.h>
38 #include <tncif_pa_subtypes.h>
41 #include <collections/linked_list.h>
42 #include <utils/debug.h>
43 #include <utils/lexparser.h>
47 static const char imv_name
[] = "OS";
49 static pen_type_t msg_types
[] = {
50 { PEN_IETF
, PA_SUBTYPE_IETF_OPERATING_SYSTEM
}
53 static imv_agent_t
*imv_os
;
58 static imv_os_database_t
*os_db
;
61 * see section 3.8.1 of TCG TNC IF-IMV Specification 1.3
63 TNC_Result
TNC_IMV_Initialize(TNC_IMVID imv_id
,
64 TNC_Version min_version
,
65 TNC_Version max_version
,
66 TNC_Version
*actual_version
)
72 DBG1(DBG_IMV
, "IMV \"%s\" has already been initialized", imv_name
);
73 return TNC_RESULT_ALREADY_INITIALIZED
;
75 imv_os
= imv_agent_create(imv_name
, msg_types
, countof(msg_types
),
76 imv_id
, actual_version
);
79 return TNC_RESULT_FATAL
;
81 if (min_version
> TNC_IFIMV_VERSION_1
|| max_version
< TNC_IFIMV_VERSION_1
)
83 DBG1(DBG_IMV
, "no common IF-IMV version");
84 return TNC_RESULT_NO_COMMON_VERSION
;
87 /* attach OS database */
88 uri
= lib
->settings
->get_str(lib
->settings
,
89 "libimcv.plugins.imv-os.database", NULL
);
92 os_db
= imv_os_database_create(uri
);
95 return TNC_RESULT_SUCCESS
;
99 * see section 3.8.2 of TCG TNC IF-IMV Specification 1.3
101 TNC_Result
TNC_IMV_NotifyConnectionChange(TNC_IMVID imv_id
,
102 TNC_ConnectionID connection_id
,
103 TNC_ConnectionState new_state
)
109 DBG1(DBG_IMV
, "IMV \"%s\" has not been initialized", imv_name
);
110 return TNC_RESULT_NOT_INITIALIZED
;
114 case TNC_CONNECTION_STATE_CREATE
:
115 state
= imv_os_state_create(connection_id
);
116 return imv_os
->create_state(imv_os
, state
);
117 case TNC_CONNECTION_STATE_DELETE
:
118 return imv_os
->delete_state(imv_os
, connection_id
);
120 return imv_os
->change_state(imv_os
, connection_id
,
126 * print multi-line values to debug output
128 static void dbg_imv_multi_line(chunk_t value
)
132 while (extract_token(&line
, '\n', &value
))
134 DBG2(DBG_IMV
, " %.*s", line
.len
, line
.ptr
);
138 DBG2(DBG_IMV
, " %.*s", value
.len
, value
.ptr
);
142 static TNC_Result
receive_message(imv_state_t
*state
, imv_msg_t
*in_msg
)
145 imv_os_state_t
*os_state
;
146 enumerator_t
*enumerator
;
150 chunk_t os_name
= chunk_empty
;
151 chunk_t os_version
= chunk_empty
;
152 bool fatal_error
= FALSE
, assessment
= FALSE
;
154 os_state
= (imv_os_state_t
*)state
;
156 /* parse received PA-TNC message and handle local and remote errors */
157 result
= in_msg
->receive(in_msg
, &fatal_error
);
158 if (result
!= TNC_RESULT_SUCCESS
)
163 out_msg
= imv_msg_create_as_reply(in_msg
);
165 /* analyze PA-TNC attributes */
166 enumerator
= in_msg
->create_attribute_enumerator(in_msg
);
167 while (enumerator
->enumerate(enumerator
, &attr
))
169 type
= attr
->get_type(attr
);
171 if (type
.vendor_id
== PEN_IETF
)
175 case IETF_ATTR_PRODUCT_INFORMATION
:
177 ietf_attr_product_info_t
*attr_cast
;
180 attr_cast
= (ietf_attr_product_info_t
*)attr
;
181 os_name
= attr_cast
->get_info(attr_cast
, &vendor_id
, NULL
);
182 if (vendor_id
!= PEN_IETF
)
184 DBG1(DBG_IMV
, "operating system name is '%.*s' "
185 "from vendor %N", os_name
.len
, os_name
.ptr
,
186 pen_names
, vendor_id
);
190 DBG1(DBG_IMV
, "operating system name is '%.*s'",
191 os_name
.len
, os_name
.ptr
);
195 case IETF_ATTR_STRING_VERSION
:
197 ietf_attr_string_version_t
*attr_cast
;
199 attr_cast
= (ietf_attr_string_version_t
*)attr
;
200 os_version
= attr_cast
->get_version(attr_cast
, NULL
, NULL
);
203 DBG1(DBG_IMV
, "operating system version is '%.*s'",
204 os_version
.len
, os_version
.ptr
);
208 case IETF_ATTR_NUMERIC_VERSION
:
210 ietf_attr_numeric_version_t
*attr_cast
;
211 u_int32_t major
, minor
;
213 attr_cast
= (ietf_attr_numeric_version_t
*)attr
;
214 attr_cast
->get_version(attr_cast
, &major
, &minor
);
215 DBG1(DBG_IMV
, "operating system numeric version is %d.%d",
219 case IETF_ATTR_OPERATIONAL_STATUS
:
221 ietf_attr_op_status_t
*attr_cast
;
222 op_status_t op_status
;
223 op_result_t op_result
;
226 attr_cast
= (ietf_attr_op_status_t
*)attr
;
227 op_status
= attr_cast
->get_status(attr_cast
);
228 op_result
= attr_cast
->get_result(attr_cast
);
229 last_boot
= attr_cast
->get_last_use(attr_cast
);
230 DBG1(DBG_IMV
, "operational status: %N, result: %N",
231 op_status_names
, op_status
, op_result_names
, op_result
);
232 DBG1(DBG_IMV
, "last boot: %T", &last_boot
, TRUE
);
235 case IETF_ATTR_FORWARDING_ENABLED
:
237 ietf_attr_fwd_enabled_t
*attr_cast
;
238 os_fwd_status_t fwd_status
;
240 attr_cast
= (ietf_attr_fwd_enabled_t
*)attr
;
241 fwd_status
= attr_cast
->get_status(attr_cast
);
242 DBG1(DBG_IMV
, "IPv4 forwarding status: %N",
243 os_fwd_status_names
, fwd_status
);
246 case IETF_ATTR_FACTORY_DEFAULT_PWD_ENABLED
:
248 ietf_attr_default_pwd_enabled_t
*attr_cast
;
249 bool default_pwd_status
;
251 attr_cast
= (ietf_attr_default_pwd_enabled_t
*)attr
;
252 default_pwd_status
= attr_cast
->get_status(attr_cast
);
253 DBG1(DBG_IMV
, "factory default password: %sabled",
254 default_pwd_status ?
"en":"dis");
257 case IETF_ATTR_INSTALLED_PACKAGES
:
259 ietf_attr_installed_packages_t
*attr_cast
;
263 /* Received at least one Installed Packages attribute */
264 os_state
->set_package_request(os_state
, FALSE
);
270 attr_cast
= (ietf_attr_installed_packages_t
*)attr
;
272 e
= attr_cast
->create_enumerator(attr_cast
);
273 status
= os_db
->check_packages(os_db
, os_state
, e
);
279 state
->set_recommendation(state
,
280 TNC_IMV_ACTION_RECOMMENDATION_ISOLATE
,
281 TNC_IMV_EVALUATION_RESULT_NONCOMPLIANT_MINOR
);
285 state
->set_recommendation(state
,
286 TNC_IMV_ACTION_RECOMMENDATION_NO_RECOMMENDATION
,
287 TNC_IMV_EVALUATION_RESULT_ERROR
);
299 else if (type
.vendor_id
== PEN_ITA
)
303 case ITA_ATTR_SETTINGS
:
305 ita_attr_settings_t
*attr_cast
;
310 attr_cast
= (ita_attr_settings_t
*)attr
;
311 e
= attr_cast
->create_enumerator(attr_cast
);
312 while (e
->enumerate(e
, &name
, &value
))
314 DBG1(DBG_IMV
, "setting '%s'", name
);
315 dbg_imv_multi_line(value
);
320 case ITA_ATTR_START_ANGEL
:
321 os_state
->set_angel_count(os_state
, TRUE
);
323 case ITA_ATTR_STOP_ANGEL
:
324 os_state
->set_angel_count(os_state
, FALSE
);
331 enumerator
->destroy(enumerator
);
333 if (os_name
.len
&& os_version
.len
)
337 char *uri
= "http://remediation.strongswan.org/fix-it/";
338 char *string
= "use a Linux operating system instead of Windows 1.2.3";
339 char *lang_code
= "en";
341 os_type
= os_type_from_name(os_name
);
342 os_state
->set_info(os_state
,os_type
, os_name
, os_version
);
343 product_info
= os_state
->get_info(os_state
, NULL
, NULL
, NULL
);
345 if (streq(product_info
, "Windows 1.2.3"))
347 DBG1(DBG_IMV
, "OS '%s' is not supported", product_info
);
349 attr
= ietf_attr_remediation_instr_create_from_string(
350 chunk_create(string
, strlen(string
)),
351 chunk_create(lang_code
, strlen(lang_code
)));
352 out_msg
->add_attribute(out_msg
, attr
);
353 attr
= ietf_attr_remediation_instr_create_from_uri(
354 chunk_create(uri
, strlen(uri
)));
355 out_msg
->add_attribute(out_msg
, attr
);
357 state
->set_recommendation(state
,
358 TNC_IMV_ACTION_RECOMMENDATION_ISOLATE
,
359 TNC_IMV_EVALUATION_RESULT_NONCOMPLIANT_MINOR
);
364 ita_attr_get_settings_t
*attr_cast
;
366 DBG1(DBG_IMV
, "requesting installed packages for '%s'",
368 os_state
->set_package_request(os_state
, TRUE
);
369 attr
= ietf_attr_attr_request_create(PEN_IETF
,
370 IETF_ATTR_INSTALLED_PACKAGES
);
371 out_msg
->add_attribute(out_msg
, attr
);
373 /* requesting Android or Linux settings */
374 attr
= ita_attr_get_settings_create();
375 attr_cast
= (ita_attr_get_settings_t
*)attr
;
377 if (os_type
== OS_TYPE_ANDROID
)
379 attr_cast
->add(attr_cast
, "android_id");
380 attr_cast
->add(attr_cast
, "install_non_market_apps");
384 attr_cast
->add(attr_cast
, "/proc/sys/kernel/random/boot_id");
385 attr_cast
->add(attr_cast
, "/proc/sys/kernel/tainted");
387 out_msg
->add_attribute(out_msg
, attr
);
393 state
->set_recommendation(state
,
394 TNC_IMV_ACTION_RECOMMENDATION_NO_RECOMMENDATION
,
395 TNC_IMV_EVALUATION_RESULT_ERROR
);
399 /* If all Installed Packages attributes were received, go to assessment */
401 !os_state
->get_package_request(os_state
) &&
402 !os_state
->get_angel_count(os_state
))
404 state
->set_recommendation(state
, TNC_IMV_ACTION_RECOMMENDATION_ALLOW
,
405 TNC_IMV_EVALUATION_RESULT_COMPLIANT
);
411 result
= out_msg
->send_assessment(out_msg
);
412 out_msg
->destroy(out_msg
);
413 if (result
!= TNC_RESULT_SUCCESS
)
417 return imv_os
->provide_recommendation(imv_os
, state
);
420 /* send PA-TNC message with excl flag set */
421 result
= out_msg
->send(out_msg
, TRUE
);
422 out_msg
->destroy(out_msg
);
428 * see section 3.8.4 of TCG TNC IF-IMV Specification 1.3
430 TNC_Result
TNC_IMV_ReceiveMessage(TNC_IMVID imv_id
,
431 TNC_ConnectionID connection_id
,
432 TNC_BufferReference msg
,
434 TNC_MessageType msg_type
)
442 DBG1(DBG_IMV
, "IMV \"%s\" has not been initialized", imv_name
);
443 return TNC_RESULT_NOT_INITIALIZED
;
445 if (!imv_os
->get_state(imv_os
, connection_id
, &state
))
447 return TNC_RESULT_FATAL
;
449 in_msg
= imv_msg_create_from_data(imv_os
, state
, connection_id
, msg_type
,
450 chunk_create(msg
, msg_len
));
451 result
= receive_message(state
, in_msg
);
452 in_msg
->destroy(in_msg
);
458 * see section 3.8.6 of TCG TNC IF-IMV Specification 1.3
460 TNC_Result
TNC_IMV_ReceiveMessageLong(TNC_IMVID imv_id
,
461 TNC_ConnectionID connection_id
,
462 TNC_UInt32 msg_flags
,
463 TNC_BufferReference msg
,
465 TNC_VendorID msg_vid
,
466 TNC_MessageSubtype msg_subtype
,
467 TNC_UInt32 src_imc_id
,
468 TNC_UInt32 dst_imv_id
)
476 DBG1(DBG_IMV
, "IMV \"%s\" has not been initialized", imv_name
);
477 return TNC_RESULT_NOT_INITIALIZED
;
479 if (!imv_os
->get_state(imv_os
, connection_id
, &state
))
481 return TNC_RESULT_FATAL
;
483 in_msg
= imv_msg_create_from_long_data(imv_os
, state
, connection_id
,
484 src_imc_id
, dst_imv_id
, msg_vid
, msg_subtype
,
485 chunk_create(msg
, msg_len
));
486 result
=receive_message(state
, in_msg
);
487 in_msg
->destroy(in_msg
);
493 * see section 3.8.7 of TCG TNC IF-IMV Specification 1.3
495 TNC_Result
TNC_IMV_SolicitRecommendation(TNC_IMVID imv_id
,
496 TNC_ConnectionID connection_id
)
502 DBG1(DBG_IMV
, "IMV \"%s\" has not been initialized", imv_name
);
503 return TNC_RESULT_NOT_INITIALIZED
;
505 if (!imv_os
->get_state(imv_os
, connection_id
, &state
))
507 return TNC_RESULT_FATAL
;
509 return imv_os
->provide_recommendation(imv_os
, state
);
513 * see section 3.8.8 of TCG TNC IF-IMV Specification 1.3
515 TNC_Result
TNC_IMV_BatchEnding(TNC_IMVID imv_id
,
516 TNC_ConnectionID connection_id
)
519 imv_os_state_t
*os_state
;
520 TNC_Result result
= TNC_RESULT_SUCCESS
;
524 DBG1(DBG_IMV
, "IMV \"%s\" has not been initialized", imv_name
);
525 return TNC_RESULT_NOT_INITIALIZED
;
527 if (!imv_os
->get_state(imv_os
, connection_id
, &state
))
529 return TNC_RESULT_FATAL
;
531 os_state
= (imv_os_state_t
*)state
;
533 if (os_state
->get_info(os_state
, NULL
, NULL
, NULL
) == NULL
)
537 ietf_attr_attr_request_t
*attr_cast
;
539 out_msg
= imv_msg_create(imv_os
, state
, connection_id
, imv_id
,
540 TNC_IMCID_ANY
, msg_types
[0]);
541 attr
= ietf_attr_attr_request_create(PEN_IETF
,
542 IETF_ATTR_PRODUCT_INFORMATION
);
543 attr_cast
= (ietf_attr_attr_request_t
*)attr
;
544 attr_cast
->add(attr_cast
, PEN_IETF
, IETF_ATTR_STRING_VERSION
);
545 attr_cast
->add(attr_cast
, PEN_IETF
, IETF_ATTR_NUMERIC_VERSION
);
546 attr_cast
->add(attr_cast
, PEN_IETF
, IETF_ATTR_OPERATIONAL_STATUS
);
547 attr_cast
->add(attr_cast
, PEN_IETF
, IETF_ATTR_FORWARDING_ENABLED
);
548 attr_cast
->add(attr_cast
, PEN_IETF
, IETF_ATTR_FACTORY_DEFAULT_PWD_ENABLED
);
549 out_msg
->add_attribute(out_msg
, attr
);
551 /* send PA-TNC message with excl flag not set */
552 result
= out_msg
->send(out_msg
, FALSE
);
553 out_msg
->destroy(out_msg
);
560 * see section 3.8.9 of TCG TNC IF-IMV Specification 1.3
562 TNC_Result
TNC_IMV_Terminate(TNC_IMVID imv_id
)
566 DBG1(DBG_IMV
, "IMV \"%s\" has not been initialized", imv_name
);
567 return TNC_RESULT_NOT_INITIALIZED
;
571 imv_os
->destroy(imv_os
);
574 return TNC_RESULT_SUCCESS
;
578 * see section 4.2.8.1 of TCG TNC IF-IMV Specification 1.3
580 TNC_Result
TNC_IMV_ProvideBindFunction(TNC_IMVID imv_id
,
581 TNC_TNCS_BindFunctionPointer bind_function
)
585 DBG1(DBG_IMV
, "IMV \"%s\" has not been initialized", imv_name
);
586 return TNC_RESULT_NOT_INITIALIZED
;
588 return imv_os
->bind_functions(imv_os
, bind_function
);