src/libimcv/plugins/imv_os/imv_os.c

   1 /*
   2  * Copyright (C) 2012 Andreas Steffen
   3  * HSR Hochschule fuer Technik Rapperswil
   4  *
   5  * This program is free software; you can redistribute it and/or modify it
   6  * under the terms of the GNU General Public License as published by the
   7  * Free Software Foundation; either version 2 of the License, or (at your
   8  * option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
   9  *
  10  * This program is distributed in the hope that it will be useful, but
  11  * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
  12  * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
  13  * for more details.
  14  */
  15
  16 #include "imv_os_state.h"
  17 #include "imv_os_database.h"
  18
  19 #include <imv/imv_agent.h>
  20 #include <imv/imv_msg.h>
  21 #include <ietf/ietf_attr.h>
  22 #include <ietf/ietf_attr_attr_request.h>
  23 #include <ietf/ietf_attr_default_pwd_enabled.h>
  24 #include <ietf/ietf_attr_fwd_enabled.h>
  25 #include <ietf/ietf_attr_installed_packages.h>
  26 #include <ietf/ietf_attr_numeric_version.h>
  27 #include <ietf/ietf_attr_op_status.h>
  28 #include <ietf/ietf_attr_pa_tnc_error.h>
  29 #include <ietf/ietf_attr_product_info.h>
  30 #include <ietf/ietf_attr_remediation_instr.h>
  31 #include <ietf/ietf_attr_string_version.h>
  32 #include <ita/ita_attr.h>
  33 #include <ita/ita_attr_get_settings.h>
  34 #include <ita/ita_attr_settings.h>
  35 #include <ita/ita_attr_angel.h>
  36
  37 #include <tncif_names.h>
  38 #include <tncif_pa_subtypes.h>
  39
  40 #include <pen/pen.h>
  41 #include <collections/linked_list.h>
  42 #include <utils/debug.h>
  43 #include <utils/lexparser.h>
  44
  45 /* IMV definitions */
  46
  47 static const char imv_name[] = "OS";
  48
  49 static pen_type_t msg_types[] = {
  50         { PEN_IETF, PA_SUBTYPE_IETF_OPERATING_SYSTEM }
  51 };
  52
  53 static imv_agent_t *imv_os;
  54
  55 /**
  56  * IMV OS database
  57  */
  58 static imv_os_database_t *os_db;
  59
  60 /*
  61  * see section 3.8.1 of TCG TNC IF-IMV Specification 1.3
  62  */
  63 TNC_Result TNC_IMV_Initialize(TNC_IMVID imv_id,
  64                                                           TNC_Version min_version,
  65                                                           TNC_Version max_version,
  66                                                           TNC_Version *actual_version)
  67 {
  68         char *uri;
  69
  70         if (imv_os)
  71         {
  72                 DBG1(DBG_IMV, "IMV \"%s\" has already been initialized", imv_name);
  73                 return TNC_RESULT_ALREADY_INITIALIZED;
  74         }
  75         imv_os = imv_agent_create(imv_name, msg_types, countof(msg_types),
  76                                                           imv_id, actual_version);
  77         if (!imv_os)
  78         {
  79                 return TNC_RESULT_FATAL;
  80         }
  81         if (min_version > TNC_IFIMV_VERSION_1 || max_version < TNC_IFIMV_VERSION_1)
  82         {
  83                 DBG1(DBG_IMV, "no common IF-IMV version");
  84                 return TNC_RESULT_NO_COMMON_VERSION;
  85         }
  86
  87         /* attach OS database */
  88         uri = lib->settings->get_str(lib->settings,
  89                                 "libimcv.plugins.imv-os.database", NULL);
  90         if (uri)
  91         {
  92                 os_db = imv_os_database_create(uri);
  93         }
  94
  95         return TNC_RESULT_SUCCESS;
  96 }
  97
  98 /**
  99  * see section 3.8.2 of TCG TNC IF-IMV Specification 1.3
 100  */
 101 TNC_Result TNC_IMV_NotifyConnectionChange(TNC_IMVID imv_id,
 102                                                                                   TNC_ConnectionID connection_id,
 103                                                                                   TNC_ConnectionState new_state)
 104 {
 105         imv_state_t *state;
 106
 107         if (!imv_os)
 108         {
 109                 DBG1(DBG_IMV, "IMV \"%s\" has not been initialized", imv_name);
 110                 return TNC_RESULT_NOT_INITIALIZED;
 111         }
 112         switch (new_state)
 113         {
 114                 case TNC_CONNECTION_STATE_CREATE:
 115                         state = imv_os_state_create(connection_id);
 116                         return imv_os->create_state(imv_os, state);
 117                 case TNC_CONNECTION_STATE_DELETE:
 118                         return imv_os->delete_state(imv_os, connection_id);
 119                 default:
 120                         return imv_os->change_state(imv_os, connection_id,
 121                                                                                          new_state, NULL);
 122         }
 123 }
 124
 125 /**
 126  * print multi-line values to debug output
 127  */
 128 static void dbg_imv_multi_line(chunk_t value)
 129 {
 130         chunk_t line;
 131
 132         while (extract_token(&line, '\n', &value))
 133         {
 134                 DBG2(DBG_IMV, "  %.*s", line.len, line.ptr);
 135         }
 136         if (value.len)
 137         {
 138                 DBG2(DBG_IMV, "  %.*s", value.len, value.ptr);
 139         }
 140 }
 141
 142 static TNC_Result receive_message(imv_state_t *state, imv_msg_t *in_msg)
 143 {
 144         imv_msg_t *out_msg;
 145         imv_os_state_t *os_state;
 146         enumerator_t *enumerator;
 147         pa_tnc_attr_t *attr;
 148         pen_type_t type;
 149         TNC_Result result;
 150         chunk_t os_name = chunk_empty;
 151         chunk_t os_version = chunk_empty;
 152         bool fatal_error = FALSE, assessment = FALSE;
 153
 154         os_state = (imv_os_state_t*)state;
 155
 156         /* parse received PA-TNC message and handle local and remote errors */
 157         result = in_msg->receive(in_msg, &fatal_error);
 158         if (result != TNC_RESULT_SUCCESS)
 159         {
 160                 return result;
 161         }
 162
 163         out_msg = imv_msg_create_as_reply(in_msg);
 164
 165         /* analyze PA-TNC attributes */
 166         enumerator = in_msg->create_attribute_enumerator(in_msg);
 167         while (enumerator->enumerate(enumerator, &attr))
 168         {
 169                 type = attr->get_type(attr);
 170
 171                 if (type.vendor_id == PEN_IETF)
 172                 {
 173                         switch (type.type)
 174                         {
 175                                 case IETF_ATTR_PRODUCT_INFORMATION:
 176                                 {
 177                                         ietf_attr_product_info_t *attr_cast;
 178                                         pen_t vendor_id;
 179
 180                                         attr_cast = (ietf_attr_product_info_t*)attr;
 181                                         os_name = attr_cast->get_info(attr_cast, &vendor_id, NULL);
 182                                         if (vendor_id != PEN_IETF)
 183                                         {
 184                                                 DBG1(DBG_IMV, "operating system name is '%.*s' "
 185                                                                           "from vendor %N", os_name.len, os_name.ptr,
 186                                                                            pen_names, vendor_id);
 187                                         }
 188                                         else
 189                                         {
 190                                                 DBG1(DBG_IMV, "operating system name is '%.*s'",
 191                                                                            os_name.len, os_name.ptr);
 192                                         }
 193                                         break;
 194                                 }
 195                                 case IETF_ATTR_STRING_VERSION:
 196                                 {
 197                                         ietf_attr_string_version_t *attr_cast;
 198
 199                                         attr_cast = (ietf_attr_string_version_t*)attr;
 200                                         os_version = attr_cast->get_version(attr_cast, NULL, NULL);
 201                                         if (os_version.len)
 202                                         {
 203                                                 DBG1(DBG_IMV, "operating system version is '%.*s'",
 204                                                                            os_version.len, os_version.ptr);
 205                                         }
 206                                         break;
 207                                 }
 208                                 case IETF_ATTR_NUMERIC_VERSION:
 209                                 {
 210                                         ietf_attr_numeric_version_t *attr_cast;
 211                                         u_int32_t major, minor;
 212
 213                                         attr_cast = (ietf_attr_numeric_version_t*)attr;
 214                                         attr_cast->get_version(attr_cast, &major, &minor);
 215                                         DBG1(DBG_IMV, "operating system numeric version is %d.%d",
 216                                                                    major, minor);
 217                                         break;
 218                                 }
 219                                 case IETF_ATTR_OPERATIONAL_STATUS:
 220                                 {
 221                                         ietf_attr_op_status_t *attr_cast;
 222                                         op_status_t op_status;
 223                                         op_result_t op_result;
 224                                         time_t last_boot;
 225
 226                                         attr_cast = (ietf_attr_op_status_t*)attr;
 227                                         op_status = attr_cast->get_status(attr_cast);
 228                                         op_result = attr_cast->get_result(attr_cast);
 229                                         last_boot = attr_cast->get_last_use(attr_cast);
 230                                         DBG1(DBG_IMV, "operational status: %N, result: %N",
 231                                                  op_status_names, op_status, op_result_names, op_result);
 232                                         DBG1(DBG_IMV, "last boot: %T", &last_boot, TRUE);
 233                                         break;
 234                                 }
 235                                 case IETF_ATTR_FORWARDING_ENABLED:
 236                                 {
 237                                         ietf_attr_fwd_enabled_t *attr_cast;
 238                                         os_fwd_status_t fwd_status;
 239
 240                                         attr_cast = (ietf_attr_fwd_enabled_t*)attr;
 241                                         fwd_status = attr_cast->get_status(attr_cast);
 242                                         DBG1(DBG_IMV, "IPv4 forwarding status: %N",
 243                                                                    os_fwd_status_names, fwd_status);
 244                                         break;
 245                                 }
 246                                 case IETF_ATTR_FACTORY_DEFAULT_PWD_ENABLED:
 247                                 {
 248                                         ietf_attr_default_pwd_enabled_t *attr_cast;
 249                                         bool default_pwd_status;
 250
 251                                         attr_cast = (ietf_attr_default_pwd_enabled_t*)attr;
 252                                         default_pwd_status = attr_cast->get_status(attr_cast);
 253                                         DBG1(DBG_IMV, "factory default password: %sabled",
 254                                                                    default_pwd_status ? "en":"dis");
 255                                         break;
 256                                 }
 257                                 case IETF_ATTR_INSTALLED_PACKAGES:
 258                                 {
 259                                         ietf_attr_installed_packages_t *attr_cast;
 260                                         enumerator_t *e;
 261                                         status_t status;
 262
 263                                         /* Received at least one Installed Packages attribute */
 264                                         os_state->set_package_request(os_state, FALSE);
 265
 266                                         if (!os_db)
 267                                         {
 268                                                 break;
 269                                         }
 270                                         attr_cast = (ietf_attr_installed_packages_t*)attr;
 271
 272                                         e = attr_cast->create_enumerator(attr_cast);
 273                                         status = os_db->check_packages(os_db, os_state, e);
 274                                         e->destroy(e);
 275
 276                                         switch (status)
 277                                         {
 278                                                 case VERIFY_ERROR:
 279                                                         state->set_recommendation(state,
 280                                                                 TNC_IMV_ACTION_RECOMMENDATION_ISOLATE,
 281                                                                 TNC_IMV_EVALUATION_RESULT_NONCOMPLIANT_MINOR);
 282                                                         assessment = TRUE;
 283                                                         break;
 284                                                 case FAILED:
 285                                                         state->set_recommendation(state,
 286                                                                 TNC_IMV_ACTION_RECOMMENDATION_NO_RECOMMENDATION,
 287                                                                 TNC_IMV_EVALUATION_RESULT_ERROR);
 288                                                         assessment = TRUE;
 289                                                         break;
 290                                                 default:
 291                                                         break;
 292                                         }
 293                                         break;
 294                                 }
 295                                 default:
 296                                         break;
 297                         }
 298                 }
 299                 else if (type.vendor_id == PEN_ITA)
 300                 {
 301                         switch (type.type)
 302                         {
 303                                 case ITA_ATTR_SETTINGS:
 304                                 {
 305                                         ita_attr_settings_t *attr_cast;
 306                                         enumerator_t *e;
 307                                         char *name;
 308                                         chunk_t value;
 309
 310                                         attr_cast = (ita_attr_settings_t*)attr;
 311                                         e = attr_cast->create_enumerator(attr_cast);
 312                                         while (e->enumerate(e, &name, &value))
 313                                         {
 314                                                 DBG1(DBG_IMV, "setting '%s'", name);
 315                                                 dbg_imv_multi_line(value);
 316                                         }
 317                                         e->destroy(e);
 318                                         break;
 319                                 }
 320                                 case ITA_ATTR_START_ANGEL:
 321                                         os_state->set_angel_count(os_state, TRUE);
 322                                         break;
 323                                 case ITA_ATTR_STOP_ANGEL:
 324                                         os_state->set_angel_count(os_state, FALSE);
 325                                         break;
 326                                 default:
 327                                         break;
 328                         }
 329                 }
 330         }
 331         enumerator->destroy(enumerator);
 332
 333         if (os_name.len && os_version.len)
 334         {
 335                 os_type_t os_type;
 336                 char *product_info;
 337                 char *uri = "http://remediation.strongswan.org/fix-it/";
 338                 char *string = "use a Linux operating system instead of Windows 1.2.3";
 339                 char *lang_code = "en";
 340
 341                 os_type = os_type_from_name(os_name);
 342                 os_state->set_info(os_state,os_type, os_name, os_version);
 343                 product_info = os_state->get_info(os_state, NULL, NULL, NULL);
 344
 345                 if (streq(product_info, "Windows 1.2.3"))
 346                 {
 347                         DBG1(DBG_IMV, "OS '%s' is not supported", product_info);
 348
 349                         attr = ietf_attr_remediation_instr_create_from_string(
 350                                                                 chunk_create(string, strlen(string)),
 351                                                                 chunk_create(lang_code, strlen(lang_code)));
 352                         out_msg->add_attribute(out_msg, attr);
 353                         attr = ietf_attr_remediation_instr_create_from_uri(
 354                                                                 chunk_create(uri, strlen(uri)));
 355                         out_msg->add_attribute(out_msg, attr);
 356
 357                         state->set_recommendation(state,
 358                                                                 TNC_IMV_ACTION_RECOMMENDATION_ISOLATE,
 359                                                                 TNC_IMV_EVALUATION_RESULT_NONCOMPLIANT_MINOR);
 360                         assessment = TRUE;
 361                 }
 362                 else
 363                 {
 364                         ita_attr_get_settings_t *attr_cast;
 365
 366                         DBG1(DBG_IMV, "requesting installed packages for '%s'",
 367                                                    product_info);
 368                         os_state->set_package_request(os_state, TRUE);
 369                         attr = ietf_attr_attr_request_create(PEN_IETF,
 370                                                                 IETF_ATTR_INSTALLED_PACKAGES);
 371                         out_msg->add_attribute(out_msg, attr);
 372
 373                         /* requesting Android or Linux settings */
 374                         attr = ita_attr_get_settings_create();
 375                         attr_cast = (ita_attr_get_settings_t*)attr;
 376
 377                         if (os_type == OS_TYPE_ANDROID)
 378                         {
 379                                 attr_cast->add(attr_cast, "android_id");
 380                                 attr_cast->add(attr_cast, "install_non_market_apps");
 381                         }
 382                         else
 383                         {
 384                                 attr_cast->add(attr_cast, "/proc/sys/kernel/random/boot_id");
 385                                 attr_cast->add(attr_cast, "/proc/sys/kernel/tainted");
 386                         }
 387                         out_msg->add_attribute(out_msg, attr);
 388                 }
 389         }
 390
 391         if (fatal_error)
 392         {
 393                 state->set_recommendation(state,
 394                                                                 TNC_IMV_ACTION_RECOMMENDATION_NO_RECOMMENDATION,
 395                                                                 TNC_IMV_EVALUATION_RESULT_ERROR);
 396                 assessment = TRUE;
 397         }
 398
 399         /* If all Installed Packages attributes were received, go to assessment */
 400         if (!assessment &&
 401                 !os_state->get_package_request(os_state) &&
 402                 !os_state->get_angel_count(os_state))
 403         {
 404                 state->set_recommendation(state, TNC_IMV_ACTION_RECOMMENDATION_ALLOW,
 405                                                                                  TNC_IMV_EVALUATION_RESULT_COMPLIANT);
 406                 assessment = TRUE;
 407         }
 408
 409         if (assessment)
 410         {
 411                 result = out_msg->send_assessment(out_msg);
 412                 out_msg->destroy(out_msg);
 413                 if (result != TNC_RESULT_SUCCESS)
 414                 {
 415                         return result;
 416                 }
 417                 return imv_os->provide_recommendation(imv_os, state);
 418         }
 419
 420         /* send PA-TNC message with excl flag set */
 421         result = out_msg->send(out_msg, TRUE);
 422         out_msg->destroy(out_msg);
 423
 424         return result;
 425  }
 426
 427 /**
 428  * see section 3.8.4 of TCG TNC IF-IMV Specification 1.3
 429  */
 430 TNC_Result TNC_IMV_ReceiveMessage(TNC_IMVID imv_id,
 431                                                                   TNC_ConnectionID connection_id,
 432                                                                   TNC_BufferReference msg,
 433                                                                   TNC_UInt32 msg_len,
 434                                                                   TNC_MessageType msg_type)
 435 {
 436         imv_state_t *state;
 437         imv_msg_t *in_msg;
 438         TNC_Result result;
 439
 440         if (!imv_os)
 441         {
 442                 DBG1(DBG_IMV, "IMV \"%s\" has not been initialized", imv_name);
 443                 return TNC_RESULT_NOT_INITIALIZED;
 444         }
 445         if (!imv_os->get_state(imv_os, connection_id, &state))
 446         {
 447                 return TNC_RESULT_FATAL;
 448         }
 449         in_msg = imv_msg_create_from_data(imv_os, state, connection_id, msg_type,
 450                                                                           chunk_create(msg, msg_len));
 451         result = receive_message(state, in_msg);
 452         in_msg->destroy(in_msg);
 453
 454         return result;
 455 }
 456
 457 /**
 458  * see section 3.8.6 of TCG TNC IF-IMV Specification 1.3
 459  */
 460 TNC_Result TNC_IMV_ReceiveMessageLong(TNC_IMVID imv_id,
 461                                                                           TNC_ConnectionID connection_id,
 462                                                                           TNC_UInt32 msg_flags,
 463                                                                           TNC_BufferReference msg,
 464                                                                           TNC_UInt32 msg_len,
 465                                                                           TNC_VendorID msg_vid,
 466                                                                           TNC_MessageSubtype msg_subtype,
 467                                                                           TNC_UInt32 src_imc_id,
 468                                                                           TNC_UInt32 dst_imv_id)
 469 {
 470         imv_state_t *state;
 471         imv_msg_t *in_msg;
 472         TNC_Result result;
 473
 474         if (!imv_os)
 475         {
 476                 DBG1(DBG_IMV, "IMV \"%s\" has not been initialized", imv_name);
 477                 return TNC_RESULT_NOT_INITIALIZED;
 478         }
 479         if (!imv_os->get_state(imv_os, connection_id, &state))
 480         {
 481                 return TNC_RESULT_FATAL;
 482         }
 483         in_msg = imv_msg_create_from_long_data(imv_os, state, connection_id,
 484                                                                 src_imc_id, dst_imv_id, msg_vid, msg_subtype,
 485                                                                 chunk_create(msg, msg_len));
 486         result =receive_message(state, in_msg);
 487         in_msg->destroy(in_msg);
 488
 489         return result;
 490 }
 491
 492 /**
 493  * see section 3.8.7 of TCG TNC IF-IMV Specification 1.3
 494  */
 495 TNC_Result TNC_IMV_SolicitRecommendation(TNC_IMVID imv_id,
 496                                                                                  TNC_ConnectionID connection_id)
 497 {
 498         imv_state_t *state;
 499
 500         if (!imv_os)
 501         {
 502                 DBG1(DBG_IMV, "IMV \"%s\" has not been initialized", imv_name);
 503                 return TNC_RESULT_NOT_INITIALIZED;
 504         }
 505         if (!imv_os->get_state(imv_os, connection_id, &state))
 506         {
 507                 return TNC_RESULT_FATAL;
 508         }
 509         return imv_os->provide_recommendation(imv_os, state);
 510 }
 511
 512 /**
 513  * see section 3.8.8 of TCG TNC IF-IMV Specification 1.3
 514  */
 515 TNC_Result TNC_IMV_BatchEnding(TNC_IMVID imv_id,
 516                                                            TNC_ConnectionID connection_id)
 517 {
 518         imv_state_t *state;
 519         imv_os_state_t *os_state;
 520         TNC_Result result = TNC_RESULT_SUCCESS;
 521
 522         if (!imv_os)
 523         {
 524                 DBG1(DBG_IMV, "IMV \"%s\" has not been initialized", imv_name);
 525                 return TNC_RESULT_NOT_INITIALIZED;
 526         }
 527         if (!imv_os->get_state(imv_os, connection_id, &state))
 528         {
 529                 return TNC_RESULT_FATAL;
 530         }
 531         os_state = (imv_os_state_t*)state;
 532
 533         if (os_state->get_info(os_state, NULL, NULL, NULL) == NULL)
 534         {
 535                 imv_msg_t *out_msg;
 536                 pa_tnc_attr_t *attr;
 537                 ietf_attr_attr_request_t *attr_cast;
 538
 539                 out_msg = imv_msg_create(imv_os, state, connection_id, imv_id,
 540                                                                  TNC_IMCID_ANY, msg_types[0]);
 541                 attr = ietf_attr_attr_request_create(PEN_IETF,
 542                                                                                          IETF_ATTR_PRODUCT_INFORMATION);
 543                 attr_cast = (ietf_attr_attr_request_t*)attr;
 544                 attr_cast->add(attr_cast, PEN_IETF, IETF_ATTR_STRING_VERSION);
 545                 attr_cast->add(attr_cast, PEN_IETF, IETF_ATTR_NUMERIC_VERSION);
 546                 attr_cast->add(attr_cast, PEN_IETF, IETF_ATTR_OPERATIONAL_STATUS);
 547                 attr_cast->add(attr_cast, PEN_IETF, IETF_ATTR_FORWARDING_ENABLED);
 548                 attr_cast->add(attr_cast, PEN_IETF, IETF_ATTR_FACTORY_DEFAULT_PWD_ENABLED);
 549                 out_msg->add_attribute(out_msg, attr);
 550
 551                 /* send PA-TNC message with excl flag not set */
 552                 result = out_msg->send(out_msg, FALSE);
 553                 out_msg->destroy(out_msg);
 554         }
 555
 556         return result;
 557 }
 558
 559 /**
 560  * see section 3.8.9 of TCG TNC IF-IMV Specification 1.3
 561  */
 562 TNC_Result TNC_IMV_Terminate(TNC_IMVID imv_id)
 563 {
 564         if (!imv_os)
 565         {
 566                 DBG1(DBG_IMV, "IMV \"%s\" has not been initialized", imv_name);
 567                 return TNC_RESULT_NOT_INITIALIZED;
 568         }
 569         DESTROY_IF(os_db);
 570
 571         imv_os->destroy(imv_os);
 572         imv_os = NULL;
 573
 574         return TNC_RESULT_SUCCESS;
 575 }
 576
 577 /**
 578  * see section 4.2.8.1 of TCG TNC IF-IMV Specification 1.3
 579  */
 580 TNC_Result TNC_IMV_ProvideBindFunction(TNC_IMVID imv_id,
 581                                                                            TNC_TNCS_BindFunctionPointer bind_function)
 582 {
 583         if (!imv_os)
 584         {
 585                 DBG1(DBG_IMV, "IMV \"%s\" has not been initialized", imv_name);
 586                 return TNC_RESULT_NOT_INITIALIZED;
 587         }
 588         return imv_os->bind_functions(imv_os, bind_function);
 589 }