src/libimcv/plugins/imv_os/imv_os.c

   1 /*
   2  * Copyright (C) 2012 Andreas Steffen
   3  * HSR Hochschule fuer Technik Rapperswil
   4  *
   5  * This program is free software; you can redistribute it and/or modify it
   6  * under the terms of the GNU General Public License as published by the
   7  * Free Software Foundation; either version 2 of the License, or (at your
   8  * option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
   9  *
  10  * This program is distributed in the hope that it will be useful, but
  11  * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
  12  * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
  13  * for more details.
  14  */
  15
  16 #include "imv_os_state.h"
  17
  18 #include <imv/imv_agent.h>
  19 #include <imv/imv_msg.h>
  20 #include <ietf/ietf_attr.h>
  21 #include <ietf/ietf_attr_attr_request.h>
  22 #include <ietf/ietf_attr_default_pwd_enabled.h>
  23 #include <ietf/ietf_attr_fwd_enabled.h>
  24 #include <ietf/ietf_attr_installed_packages.h>
  25 #include <ietf/ietf_attr_op_status.h>
  26 #include <ietf/ietf_attr_pa_tnc_error.h>
  27 #include <ietf/ietf_attr_product_info.h>
  28 #include <ietf/ietf_attr_remediation_instr.h>
  29 #include <ietf/ietf_attr_string_version.h>
  30 #include <os_info/os_info.h>
  31
  32 #include <tncif_names.h>
  33 #include <tncif_pa_subtypes.h>
  34
  35 #include <pen/pen.h>
  36 #include <utils/linked_list.h>
  37 #include <debug.h>
  38
  39 /* IMV definitions */
  40
  41 static const char imv_name[] = "OS";
  42
  43 static pen_type_t msg_types[] = {
  44         { PEN_IETF, PA_SUBTYPE_IETF_OPERATING_SYSTEM }
  45 };
  46
  47 static imv_agent_t *imv_os;
  48
  49 /*
  50  * see section 3.8.1 of TCG TNC IF-IMV Specification 1.3
  51  */
  52 TNC_Result TNC_IMV_Initialize(TNC_IMVID imv_id,
  53                                                           TNC_Version min_version,
  54                                                           TNC_Version max_version,
  55                                                           TNC_Version *actual_version)
  56 {
  57         if (imv_os)
  58         {
  59                 DBG1(DBG_IMV, "IMV \"%s\" has already been initialized", imv_name);
  60                 return TNC_RESULT_ALREADY_INITIALIZED;
  61         }
  62         imv_os = imv_agent_create(imv_name, msg_types, 1, imv_id, actual_version);
  63         if (!imv_os)
  64         {
  65                 return TNC_RESULT_FATAL;
  66         }
  67         if (min_version > TNC_IFIMV_VERSION_1 || max_version < TNC_IFIMV_VERSION_1)
  68         {
  69                 DBG1(DBG_IMV, "no common IF-IMV version");
  70                 return TNC_RESULT_NO_COMMON_VERSION;
  71         }
  72
  73         return TNC_RESULT_SUCCESS;
  74 }
  75
  76 /**
  77  * see section 3.8.2 of TCG TNC IF-IMV Specification 1.3
  78  */
  79 TNC_Result TNC_IMV_NotifyConnectionChange(TNC_IMVID imv_id,
  80                                                                                   TNC_ConnectionID connection_id,
  81                                                                                   TNC_ConnectionState new_state)
  82 {
  83         imv_state_t *state;
  84
  85         if (!imv_os)
  86         {
  87                 DBG1(DBG_IMV, "IMV \"%s\" has not been initialized", imv_name);
  88                 return TNC_RESULT_NOT_INITIALIZED;
  89         }
  90         switch (new_state)
  91         {
  92                 case TNC_CONNECTION_STATE_CREATE:
  93                         state = imv_os_state_create(connection_id);
  94                         return imv_os->create_state(imv_os, state);
  95                 case TNC_CONNECTION_STATE_DELETE:
  96                         return imv_os->delete_state(imv_os, connection_id);
  97                 default:
  98                         return imv_os->change_state(imv_os, connection_id,
  99                                                                                          new_state, NULL);
 100         }
 101 }
 102
 103 static TNC_Result receive_message(imv_state_t *state, imv_msg_t *in_msg)
 104 {
 105         imv_msg_t *out_msg;
 106         imv_os_state_t *os_state;
 107         enumerator_t *enumerator;
 108         pa_tnc_attr_t *attr;
 109         pen_type_t type;
 110         TNC_Result result;
 111         chunk_t os_name = chunk_empty;
 112         chunk_t os_version = chunk_empty;
 113         bool fatal_error = FALSE, assessment = FALSE;
 114
 115
 116         /* parse received PA-TNC message and handle local and remote errors */
 117         result = in_msg->receive(in_msg, &fatal_error);
 118         if (result != TNC_RESULT_SUCCESS)
 119         {
 120                 return result;
 121         }
 122
 123         out_msg = imv_msg_create_as_reply(in_msg);
 124
 125         /* analyze PA-TNC attributes */
 126         enumerator = in_msg->create_attribute_enumerator(in_msg);
 127         while (enumerator->enumerate(enumerator, &attr))
 128         {
 129                 type = attr->get_type(attr);
 130
 131                 if (type.vendor_id != PEN_IETF)
 132                 {
 133                         continue;
 134                 }
 135                 switch (type.type)
 136                 {
 137                         case IETF_ATTR_PRODUCT_INFORMATION:
 138                         {
 139                                 ietf_attr_product_info_t *attr_cast;
 140
 141                                 attr_cast = (ietf_attr_product_info_t*)attr;
 142                                 os_name = attr_cast->get_info(attr_cast, NULL, NULL);
 143                                 DBG1(DBG_IMV, "operating system name is '%.*s'",
 144                                                            os_name.len, os_name.ptr);
 145                                 break;
 146                         }
 147                         case IETF_ATTR_STRING_VERSION:
 148                         {
 149                                 ietf_attr_string_version_t *attr_cast;
 150
 151                                 attr_cast = (ietf_attr_string_version_t*)attr;
 152                                 os_version = attr_cast->get_version(attr_cast, NULL, NULL);
 153                                 if (os_version.len)
 154                                 {
 155                                         DBG1(DBG_IMV, "operating system version is '%.*s'",
 156                                                                    os_version.len, os_version.ptr);
 157                                 }
 158                                 break;
 159                         }
 160                         case IETF_ATTR_OPERATIONAL_STATUS:
 161                         {
 162                                 ietf_attr_op_status_t *attr_cast;
 163                                 op_status_t op_status;
 164                                 op_result_t op_result;
 165                                 time_t last_boot;
 166
 167                                 attr_cast = (ietf_attr_op_status_t*)attr;
 168                                 op_status = attr_cast->get_status(attr_cast);
 169                                 op_result = attr_cast->get_result(attr_cast);
 170                                 last_boot = attr_cast->get_last_use(attr_cast);
 171                                 DBG1(DBG_IMV, "operational status: %N, result: %N",
 172                                          op_status_names, op_status, op_result_names, op_result);
 173                                 DBG1(DBG_IMV, "last boot: %T", &last_boot, TRUE);
 174                                 break;
 175                         }
 176                         case IETF_ATTR_FORWARDING_ENABLED:
 177                         {
 178                                 ietf_attr_fwd_enabled_t *attr_cast;
 179                                 os_fwd_status_t fwd_status;
 180
 181                                 attr_cast = (ietf_attr_fwd_enabled_t*)attr;
 182                                 fwd_status = attr_cast->get_status(attr_cast);
 183                                 DBG1(DBG_IMV, "IPv4 forwarding status: %N",
 184                                                            os_fwd_status_names, fwd_status);
 185                                 break;
 186                         }
 187                         case IETF_ATTR_FACTORY_DEFAULT_PWD_ENABLED:
 188                         {
 189                                 ietf_attr_default_pwd_enabled_t *attr_cast;
 190                                 bool default_pwd_status;
 191
 192                                 attr_cast = (ietf_attr_default_pwd_enabled_t*)attr;
 193                                 default_pwd_status = attr_cast->get_status(attr_cast);
 194                                 DBG1(DBG_IMV, "factory default password: %sabled",
 195                                                            default_pwd_status ? "en":"dis");
 196                                 break;
 197                         }
 198                         case IETF_ATTR_INSTALLED_PACKAGES:
 199                         {
 200                                 ietf_attr_installed_packages_t *attr_cast;
 201                                 enumerator_t *e;
 202                                 chunk_t name, version;
 203
 204                                 attr_cast = (ietf_attr_installed_packages_t*)attr;
 205                                 e = attr_cast->create_enumerator(attr_cast);
 206                                 while (e->enumerate(e, &name, &version))
 207                                 {
 208                                         DBG1(DBG_IMV, "package '%.*s' %.*s", name.len, name.ptr,
 209                                                                    version.len, version.ptr);
 210                                 }
 211                                 e->destroy(e);
 212
 213                                 state->set_recommendation(state,
 214                                                                           TNC_IMV_ACTION_RECOMMENDATION_ALLOW,
 215                                                                           TNC_IMV_EVALUATION_RESULT_COMPLIANT);
 216                                 assessment = TRUE;
 217                                 break;
 218                         }
 219                         default:
 220                                 break;
 221                 }
 222         }
 223         enumerator->destroy(enumerator);
 224
 225         if (os_name.len && os_version.len)
 226         {
 227                 char *product_info;
 228                 char *uri = "http://remediation.strongswan.org/fix-it/";
 229                 char *string = "use a Linux operating system instead of Windows 1.2.3";
 230                 char *lang_code = "en";
 231
 232                 os_state = (imv_os_state_t*)state;
 233                 os_state->set_info(os_state, os_name, os_version);
 234                 product_info = os_state->get_info(os_state);
 235
 236                 if (streq(product_info, "Windows 1.2.3"))
 237                 {
 238                         DBG1(DBG_IMV, "OS '%s' is not supported", product_info);
 239
 240                         attr = ietf_attr_remediation_instr_create_from_string(
 241                                                                 chunk_create(string, strlen(string)),
 242                                                                 chunk_create(lang_code, strlen(lang_code)));
 243                         out_msg->add_attribute(out_msg, attr);
 244                         attr = ietf_attr_remediation_instr_create_from_uri(
 245                                                                 chunk_create(uri, strlen(uri)));
 246                         out_msg->add_attribute(out_msg, attr);
 247
 248                         state->set_recommendation(state,
 249                                                                 TNC_IMV_ACTION_RECOMMENDATION_ISOLATE,
 250                                                                 TNC_IMV_EVALUATION_RESULT_NONCOMPLIANT_MINOR);
 251                         assessment = TRUE;
 252                 }
 253                 else
 254                 {
 255                         DBG1(DBG_IMV, "requesting installed packages for '%s'",
 256                                                    product_info);
 257                         attr = ietf_attr_attr_request_create(PEN_IETF,
 258                                                                 IETF_ATTR_INSTALLED_PACKAGES);
 259                         out_msg->add_attribute(out_msg, attr);
 260                 }
 261         }
 262
 263         if (fatal_error)
 264         {
 265                 state->set_recommendation(state,
 266                                                                 TNC_IMV_ACTION_RECOMMENDATION_NO_RECOMMENDATION,
 267                                                                 TNC_IMV_EVALUATION_RESULT_ERROR);
 268                 assessment = TRUE;
 269         }
 270
 271         if (assessment)
 272         {
 273                 result = out_msg->send_assessment(out_msg);
 274                 out_msg->destroy(out_msg);
 275                 if (result != TNC_RESULT_SUCCESS)
 276                 {
 277                         return result;
 278                 }
 279                 return imv_os->provide_recommendation(imv_os, state);
 280         }
 281
 282         /* send PA-TNC message with excl flag set */
 283         result = out_msg->send(out_msg, TRUE);
 284         out_msg->destroy(out_msg);
 285
 286         return result;
 287  }
 288
 289 /**
 290  * see section 3.8.4 of TCG TNC IF-IMV Specification 1.3
 291  */
 292 TNC_Result TNC_IMV_ReceiveMessage(TNC_IMVID imv_id,
 293                                                                   TNC_ConnectionID connection_id,
 294                                                                   TNC_BufferReference msg,
 295                                                                   TNC_UInt32 msg_len,
 296                                                                   TNC_MessageType msg_type)
 297 {
 298         imv_state_t *state;
 299         imv_msg_t *in_msg;
 300         TNC_Result result;
 301
 302         if (!imv_os)
 303         {
 304                 DBG1(DBG_IMV, "IMV \"%s\" has not been initialized", imv_name);
 305                 return TNC_RESULT_NOT_INITIALIZED;
 306         }
 307         if (!imv_os->get_state(imv_os, connection_id, &state))
 308         {
 309                 return TNC_RESULT_FATAL;
 310         }
 311         in_msg = imv_msg_create_from_data(imv_os, state, connection_id, msg_type,
 312                                                                           chunk_create(msg, msg_len));
 313         result = receive_message(state, in_msg);
 314         in_msg->destroy(in_msg);
 315
 316         return result;
 317 }
 318
 319 /**
 320  * see section 3.8.6 of TCG TNC IF-IMV Specification 1.3
 321  */
 322 TNC_Result TNC_IMV_ReceiveMessageLong(TNC_IMVID imv_id,
 323                                                                           TNC_ConnectionID connection_id,
 324                                                                           TNC_UInt32 msg_flags,
 325                                                                           TNC_BufferReference msg,
 326                                                                           TNC_UInt32 msg_len,
 327                                                                           TNC_VendorID msg_vid,
 328                                                                           TNC_MessageSubtype msg_subtype,
 329                                                                           TNC_UInt32 src_imc_id,
 330                                                                           TNC_UInt32 dst_imv_id)
 331 {
 332         imv_state_t *state;
 333         imv_msg_t *in_msg;
 334         TNC_Result result;
 335
 336         if (!imv_os)
 337         {
 338                 DBG1(DBG_IMV, "IMV \"%s\" has not been initialized", imv_name);
 339                 return TNC_RESULT_NOT_INITIALIZED;
 340         }
 341         if (!imv_os->get_state(imv_os, connection_id, &state))
 342         {
 343                 return TNC_RESULT_FATAL;
 344         }
 345         in_msg = imv_msg_create_from_long_data(imv_os, state, connection_id,
 346                                                                 src_imc_id, dst_imv_id, msg_vid, msg_subtype,
 347                                                                 chunk_create(msg, msg_len));
 348         result =receive_message(state, in_msg);
 349         in_msg->destroy(in_msg);
 350
 351         return result;
 352 }
 353
 354 /**
 355  * see section 3.8.7 of TCG TNC IF-IMV Specification 1.3
 356  */
 357 TNC_Result TNC_IMV_SolicitRecommendation(TNC_IMVID imv_id,
 358                                                                                  TNC_ConnectionID connection_id)
 359 {
 360         imv_state_t *state;
 361
 362         if (!imv_os)
 363         {
 364                 DBG1(DBG_IMV, "IMV \"%s\" has not been initialized", imv_name);
 365                 return TNC_RESULT_NOT_INITIALIZED;
 366         }
 367         if (!imv_os->get_state(imv_os, connection_id, &state))
 368         {
 369                 return TNC_RESULT_FATAL;
 370         }
 371         return imv_os->provide_recommendation(imv_os, state);
 372 }
 373
 374 /**
 375  * see section 3.8.8 of TCG TNC IF-IMV Specification 1.3
 376  */
 377 TNC_Result TNC_IMV_BatchEnding(TNC_IMVID imv_id,
 378                                                            TNC_ConnectionID connection_id)
 379 {
 380         imv_state_t *state;
 381         imv_os_state_t *os_state;
 382         TNC_Result result = TNC_RESULT_SUCCESS;
 383
 384         if (!imv_os)
 385         {
 386                 DBG1(DBG_IMV, "IMV \"%s\" has not been initialized", imv_name);
 387                 return TNC_RESULT_NOT_INITIALIZED;
 388         }
 389         if (!imv_os->get_state(imv_os, connection_id, &state))
 390         {
 391                 return TNC_RESULT_FATAL;
 392         }
 393         os_state = (imv_os_state_t*)state;
 394
 395         if (os_state->get_info(os_state) == NULL)
 396         {
 397                 imv_msg_t *out_msg;
 398                 pa_tnc_attr_t *attr;
 399                 ietf_attr_attr_request_t *attr_cast;
 400
 401                 out_msg = imv_msg_create(imv_os, state, connection_id, imv_id,
 402                                                                  TNC_IMCID_ANY, msg_types[0]);
 403                 attr = ietf_attr_attr_request_create(PEN_IETF,
 404                                                                                          IETF_ATTR_PRODUCT_INFORMATION);
 405                 attr_cast = (ietf_attr_attr_request_t*)attr;
 406                 attr_cast->add(attr_cast, PEN_IETF, IETF_ATTR_STRING_VERSION);
 407                 attr_cast->add(attr_cast, PEN_IETF, IETF_ATTR_OPERATIONAL_STATUS);
 408                 attr_cast->add(attr_cast, PEN_IETF, IETF_ATTR_FORWARDING_ENABLED);
 409                 attr_cast->add(attr_cast, PEN_IETF, IETF_ATTR_FACTORY_DEFAULT_PWD_ENABLED);
 410                 out_msg->add_attribute(out_msg, attr);
 411
 412                 /* send PA-TNC message with excl flag not set */
 413                 result = out_msg->send(out_msg, FALSE);
 414                 out_msg->destroy(out_msg);
 415         }
 416
 417         return result;
 418 }
 419
 420 /**
 421  * see section 3.8.9 of TCG TNC IF-IMV Specification 1.3
 422  */
 423 TNC_Result TNC_IMV_Terminate(TNC_IMVID imv_id)
 424 {
 425         if (!imv_os)
 426         {
 427                 DBG1(DBG_IMV, "IMV \"%s\" has not been initialized", imv_name);
 428                 return TNC_RESULT_NOT_INITIALIZED;
 429         }
 430         imv_os->destroy(imv_os);
 431         imv_os = NULL;
 432
 433         return TNC_RESULT_SUCCESS;
 434 }
 435
 436 /**
 437  * see section 4.2.8.1 of TCG TNC IF-IMV Specification 1.3
 438  */
 439 TNC_Result TNC_IMV_ProvideBindFunction(TNC_IMVID imv_id,
 440                                                                            TNC_TNCS_BindFunctionPointer bind_function)
 441 {
 442         if (!imv_os)
 443         {
 444                 DBG1(DBG_IMV, "IMV \"%s\" has not been initialized", imv_name);
 445                 return TNC_RESULT_NOT_INITIALIZED;
 446         }
 447         return imv_os->bind_functions(imv_os, bind_function);
 448 }