de0ed623024011d236b80fb23ed1057f57f7199d
[strongswan.git] / src / libimcv / plugins / imv_scanner / imv_scanner_state.c
1 /*
2 * Copyright (C) 2011-2013 Andreas Steffen
3 * HSR Hochschule fuer Technik Rapperswil
4 *
5 * This program is free software; you can redistribute it and/or modify it
6 * under the terms of the GNU General Public License as published by the
7 * Free Software Foundation; either version 2 of the License, or (at your
8 * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
9 *
10 * This program is distributed in the hope that it will be useful, but
11 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
12 * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
13 * for more details.
14 */
15
16 #include "imv_scanner_state.h"
17 #include "imv/imv_lang_string.h"
18 #include "imv/imv_reason_string.h"
19 #include "imv/imv_remediation_string.h"
20
21 #include <tncif_policy.h>
22
23 #include <utils/lexparser.h>
24 #include <utils/debug.h>
25
26 typedef struct private_imv_scanner_state_t private_imv_scanner_state_t;
27
28 /**
29 * Private data of an imv_scanner_state_t object.
30 */
31 struct private_imv_scanner_state_t {
32
33 /**
34 * Public members of imv_scanner_state_t
35 */
36 imv_scanner_state_t public;
37
38 /**
39 * TNCCS connection ID
40 */
41 TNC_ConnectionID connection_id;
42
43 /**
44 * TNCCS connection state
45 */
46 TNC_ConnectionState state;
47
48 /**
49 * Does the TNCCS connection support long message types?
50 */
51 bool has_long;
52
53 /**
54 * Does the TNCCS connection support exclusive delivery?
55 */
56 bool has_excl;
57
58 /**
59 * Maximum PA-TNC message size for this TNCCS connection
60 */
61 u_int32_t max_msg_len;
62
63 /**
64 * Access Requestor ID Type
65 */
66 u_int32_t ar_id_type;
67
68 /**
69 * Access Requestor ID Value
70 */
71 chunk_t ar_id_value;
72
73 /**
74 * IMV database session associatied with TNCCS connection
75 */
76 imv_session_t *session;
77
78 /**
79 * IMV action recommendation
80 */
81 TNC_IMV_Action_Recommendation rec;
82
83 /**
84 * IMV evaluation result
85 */
86 TNC_IMV_Evaluation_Result eval;
87
88 /**
89 * List with ports that should be closed
90 */
91 linked_list_t *violating_ports;
92
93 /**
94 * TNC Reason String
95 */
96 imv_reason_string_t *reason_string;
97
98 /**
99 * IETF Remediation Instructions String
100 */
101 imv_remediation_string_t *remediation_string;
102
103 };
104
105 /**
106 * Supported languages
107 */
108 static char* languages[] = { "en", "de", "fr", "pl" };
109
110 /**
111 * Reason strings for "Port Filter"
112 */
113 static imv_lang_string_t reasons[] = {
114 { "en", "Open server ports were detected" },
115 { "de", "Offene Serverports wurden festgestellt" },
116 { "fr", "Il y a des ports du serveur ouverts" },
117 { "pl", "Są otwarte porty serwera" },
118 { NULL, NULL }
119 };
120
121 /**
122 * Instruction strings for "Port Filters"
123 */
124 static imv_lang_string_t instr_ports_title[] = {
125 { "en", "Open Server Ports" },
126 { "de", "Offene Server Ports" },
127 { "fr", "Ports ouverts du serveur" },
128 { "pl", "Otwarte Porty Serwera" },
129 { NULL, NULL }
130 };
131
132 static imv_lang_string_t instr_ports_descr[] = {
133 { "en", "Open Internet ports have been detected" },
134 { "de", "Offenen Internet-Ports wurden festgestellt" },
135 { "fr", "Il y'a des ports Internet ouverts" },
136 { "pl", "Porty internetowe są otwarte" },
137 { NULL, NULL }
138 };
139
140 static imv_lang_string_t instr_ports_header[] = {
141 { "en", "Please close the following server ports:" },
142 { "de", "Bitte schliessen Sie die folgenden Serverports:" },
143 { "fr", "Fermez les ports du serveur suivants s'il vous plait:" },
144 { "pl", "Proszę zamknąć następujące porty serwera:" },
145 { NULL, NULL }
146 };
147
148 METHOD(imv_state_t, get_connection_id, TNC_ConnectionID,
149 private_imv_scanner_state_t *this)
150 {
151 return this->connection_id;
152 }
153
154 METHOD(imv_state_t, has_long, bool,
155 private_imv_scanner_state_t *this)
156 {
157 return this->has_long;
158 }
159
160 METHOD(imv_state_t, has_excl, bool,
161 private_imv_scanner_state_t *this)
162 {
163 return this->has_excl;
164 }
165
166 METHOD(imv_state_t, set_flags, void,
167 private_imv_scanner_state_t *this, bool has_long, bool has_excl)
168 {
169 this->has_long = has_long;
170 this->has_excl = has_excl;
171 }
172
173 METHOD(imv_state_t, set_max_msg_len, void,
174 private_imv_scanner_state_t *this, u_int32_t max_msg_len)
175 {
176 this->max_msg_len = max_msg_len;
177 }
178
179 METHOD(imv_state_t, get_max_msg_len, u_int32_t,
180 private_imv_scanner_state_t *this)
181 {
182 return this->max_msg_len;
183 }
184
185 METHOD(imv_state_t, set_ar_id, void,
186 private_imv_scanner_state_t *this, u_int32_t id_type, chunk_t id_value)
187 {
188 this->ar_id_type = id_type;
189 this->ar_id_value = chunk_clone(id_value);
190 }
191
192 METHOD(imv_state_t, get_ar_id, chunk_t,
193 private_imv_scanner_state_t *this, u_int32_t *id_type)
194 {
195 if (id_type)
196 {
197 *id_type = this->ar_id_type;
198 }
199 return this->ar_id_value;
200 }
201
202 METHOD(imv_state_t, set_session, void,
203 private_imv_scanner_state_t *this, imv_session_t *session)
204 {
205 this->session = session;
206 }
207
208 METHOD(imv_state_t, get_session, imv_session_t*,
209 private_imv_scanner_state_t *this)
210 {
211 return this->session;
212 }
213
214 METHOD(imv_state_t, change_state, void,
215 private_imv_scanner_state_t *this, TNC_ConnectionState new_state)
216 {
217 this->state = new_state;
218 }
219
220 METHOD(imv_state_t, get_recommendation, void,
221 private_imv_scanner_state_t *this, TNC_IMV_Action_Recommendation *rec,
222 TNC_IMV_Evaluation_Result *eval)
223 {
224 *rec = this->rec;
225 *eval = this->eval;
226 }
227
228 METHOD(imv_state_t, set_recommendation, void,
229 private_imv_scanner_state_t *this, TNC_IMV_Action_Recommendation rec,
230 TNC_IMV_Evaluation_Result eval)
231 {
232 this->rec = rec;
233 this->eval = eval;
234 }
235
236 METHOD(imv_state_t, update_recommendation, void,
237 private_imv_scanner_state_t *this, TNC_IMV_Action_Recommendation rec,
238 TNC_IMV_Evaluation_Result eval)
239 {
240 this->rec = tncif_policy_update_recommendation(this->rec, rec);
241 this->eval = tncif_policy_update_evaluation(this->eval, eval);
242 }
243
244 METHOD(imv_state_t, get_reason_string, bool,
245 private_imv_scanner_state_t *this, enumerator_t *language_enumerator,
246 chunk_t *reason_string, char **reason_language)
247 {
248 if (!this->violating_ports)
249 {
250 return FALSE;
251 }
252 *reason_language = imv_lang_string_select_lang(language_enumerator,
253 languages, countof(languages));
254
255 /* Instantiate a TNC Reason String object */
256 DESTROY_IF(this->reason_string);
257 this->reason_string = imv_reason_string_create(*reason_language);
258 this->reason_string->add_reason(this->reason_string, reasons);
259 *reason_string = this->reason_string->get_encoding(this->reason_string);
260
261 return TRUE;
262 }
263
264 METHOD(imv_state_t, get_remediation_instructions, bool,
265 private_imv_scanner_state_t *this, enumerator_t *language_enumerator,
266 chunk_t *string, char **lang_code, char **uri)
267 {
268 if (!this->violating_ports)
269 {
270 return FALSE;
271 }
272 *lang_code = imv_lang_string_select_lang(language_enumerator,
273 languages, countof(languages));
274
275 /* Instantiate an IETF Remediation Instructions String object */
276 DESTROY_IF(this->remediation_string);
277 this->remediation_string = imv_remediation_string_create(
278 TRUE, *lang_code); /* TODO get os_type */
279
280 this->remediation_string->add_instruction(this->remediation_string,
281 instr_ports_title,
282 instr_ports_descr,
283 instr_ports_header,
284 this->violating_ports);
285 *string = this->remediation_string->get_encoding(this->remediation_string);
286 *uri = lib->settings->get_str(lib->settings,
287 "libimcv.plugins.imv-scanner.remediation_uri", NULL);
288
289 return TRUE;
290 }
291
292 METHOD(imv_state_t, destroy, void,
293 private_imv_scanner_state_t *this)
294 {
295 DESTROY_IF(this->session);
296 DESTROY_IF(this->reason_string);
297 DESTROY_IF(this->remediation_string);
298 this->violating_ports->destroy_function(this->violating_ports, free);
299 free(this->ar_id_value.ptr);
300 free(this);
301 }
302
303 METHOD(imv_scanner_state_t, add_violating_port, void,
304 private_imv_scanner_state_t *this, char *port)
305 {
306 this->violating_ports->insert_last(this->violating_ports, port);
307 }
308
309 /**
310 * Described in header.
311 */
312 imv_state_t *imv_scanner_state_create(TNC_ConnectionID connection_id)
313 {
314 private_imv_scanner_state_t *this;
315
316 INIT(this,
317 .public = {
318 .interface = {
319 .get_connection_id = _get_connection_id,
320 .has_long = _has_long,
321 .has_excl = _has_excl,
322 .set_flags = _set_flags,
323 .set_max_msg_len = _set_max_msg_len,
324 .get_max_msg_len = _get_max_msg_len,
325 .set_ar_id = _set_ar_id,
326 .get_ar_id = _get_ar_id,
327 .set_session = _set_session,
328 .get_session= _get_session,
329 .change_state = _change_state,
330 .get_recommendation = _get_recommendation,
331 .set_recommendation = _set_recommendation,
332 .update_recommendation = _update_recommendation,
333 .get_reason_string = _get_reason_string,
334 .get_remediation_instructions = _get_remediation_instructions,
335 .destroy = _destroy,
336 },
337 .add_violating_port = _add_violating_port,
338 },
339 .state = TNC_CONNECTION_STATE_CREATE,
340 .rec = TNC_IMV_ACTION_RECOMMENDATION_NO_RECOMMENDATION,
341 .eval = TNC_IMV_EVALUATION_RESULT_DONT_KNOW,
342 .connection_id = connection_id,
343 .violating_ports = linked_list_create(),
344 );
345
346 return &this->public.interface;
347 }
348
349