src/libpts/plugins/imv_attestation/attest.c

   1 /*
   2  * Copyright (C) 2011-2012 Andreas Steffen
   3  * HSR Hochschule fuer Technik Rapperswil
   4  *
   5  * This program is free software; you can redistribute it and/or modify it
   6  * under the terms of the GNU General Public License as published by the
   7  * Free Software Foundation; either version 2 of the License, or (at your
   8  * option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
   9  *
  10  * This program is distributed in the hope that it will be useful, but
  11  * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
  12  * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
  13  * for more details.
  14  */
  15
  16 #define _GNU_SOURCE
  17 #include <getopt.h>
  18 #include <unistd.h>
  19 #include <stdio.h>
  20 #include <string.h>
  21 #include <errno.h>
  22 #include <syslog.h>
  23
  24 #include <library.h>
  25 #include <utils/debug.h>
  26
  27 #include <imcv.h>
  28 #include <libpts.h>
  29 #include <pts/pts_meas_algo.h>
  30
  31 #include "attest_db.h"
  32 #include "attest_usage.h"
  33
  34 /**
  35  * global debug output variables
  36  */
  37 static int debug_level = 1;
  38 static bool stderr_quiet = TRUE;
  39
  40 /**
  41  * attest dbg function
  42  */
  43 static void attest_dbg(debug_t group, level_t level, char *fmt, ...)
  44 {
  45         int priority = LOG_INFO;
  46         char buffer[8192];
  47         char *current = buffer, *next;
  48         va_list args;
  49
  50         if (level <= debug_level)
  51         {
  52                 if (!stderr_quiet)
  53                 {
  54                         va_start(args, fmt);
  55                         vfprintf(stderr, fmt, args);
  56                         fprintf(stderr, "\n");
  57                         va_end(args);
  58                 }
  59
  60                 /* write in memory buffer first */
  61                 va_start(args, fmt);
  62                 vsnprintf(buffer, sizeof(buffer), fmt, args);
  63                 va_end(args);
  64
  65                 /* do a syslog with every line */
  66                 while (current)
  67                 {
  68                         next = strchr(current, '\n');
  69                         if (next)
  70                         {
  71                                 *(next++) = '\0';
  72                         }
  73                         syslog(priority, "%s\n", current);
  74                         current = next;
  75                 }
  76         }
  77 }
  78
  79 /**
  80  * global attestation database object
  81  */
  82 attest_db_t *attest;
  83
  84 /**
  85  * atexit handler to close db on shutdown
  86  */
  87 static void cleanup(void)
  88 {
  89         attest->destroy(attest);
  90         libpts_deinit();
  91         libimcv_deinit();
  92         closelog();
  93 }
  94
  95 static void do_args(int argc, char *argv[])
  96 {
  97         enum {
  98                 OP_UNDEF,
  99                 OP_USAGE,
 100                 OP_KEYS,
 101                 OP_COMPONENTS,
 102                 OP_DEVICES,
 103                 OP_FILES,
 104                 OP_HASHES,
 105                 OP_MEASUREMENTS,
 106                 OP_PACKAGES,
 107                 OP_PRODUCTS,
 108                 OP_ADD,
 109                 OP_DEL,
 110         } op = OP_UNDEF;
 111
 112         /* reinit getopt state */
 113         optind = 0;
 114
 115         while (TRUE)
 116         {
 117                 int c;
 118
 119                 struct option long_opts[] = {
 120                         { "help", no_argument, NULL, 'h' },
 121                         { "components", no_argument, NULL, 'c' },
 122                         { "devices", no_argument, NULL, 'e' },
 123                         { "files", no_argument, NULL, 'f' },
 124                         { "keys", no_argument, NULL, 'k' },
 125                         { "packages", no_argument, NULL, 'g' },
 126                         { "products", no_argument, NULL, 'p' },
 127                         { "hashes", no_argument, NULL, 'H' },
 128                         { "measurements", no_argument, NULL, 'm' },
 129                         { "add", no_argument, NULL, 'a' },
 130                         { "delete", no_argument, NULL, 'd' },
 131                         { "del", no_argument, NULL, 'd' },
 132                         { "aik", required_argument, NULL, 'A' },
 133                         { "blacklist", no_argument, NULL, 'B' },
 134                         { "component", required_argument, NULL, 'C' },
 135                         { "comp", required_argument, NULL, 'C' },
 136                         { "directory", required_argument, NULL, 'D' },
 137                         { "dir", required_argument, NULL, 'D' },
 138                         { "file", required_argument, NULL, 'F' },
 139                         { "sha1-ima", no_argument, NULL, 'I' },
 140                         { "package", required_argument, NULL, 'G' },
 141                         { "key", required_argument, NULL, 'K' },
 142                         { "owner", required_argument, NULL, 'O' },
 143                         { "product", required_argument, NULL, 'P' },
 144                         { "relative", no_argument, NULL, 'R' },
 145                         { "rel", no_argument, NULL, 'R' },
 146                         { "sequence", required_argument, NULL, 'S' },
 147                         { "seq", required_argument, NULL, 'S' },
 148                         { "version", required_argument, NULL, 'V' },
 149                         { "security", no_argument, NULL, 'Y' },
 150                         { "sha1", no_argument, NULL, '1' },
 151                         { "sha256", no_argument, NULL, '2' },
 152                         { "sha384", no_argument, NULL, '3' },
 153                         { "did", required_argument, NULL, '4' },
 154                         { "fid", required_argument, NULL, '5' },
 155                         { "pid", required_argument, NULL, '6' },
 156                         { "cid", required_argument, NULL, '7' },
 157                         { "kid", required_argument, NULL, '8' },
 158                         { "gid", required_argument, NULL, '9' },
 159                         { 0,0,0,0 }
 160                 };
 161
 162                 c = getopt_long(argc, argv, "", long_opts, NULL);
 163                 switch (c)
 164                 {
 165                         case EOF:
 166                                 break;
 167                         case 'h':
 168                                 op = OP_USAGE;
 169                                 break;
 170                         case 'c':
 171                                 op = OP_COMPONENTS;
 172                                 continue;
 173                         case 'e':
 174                                 op = OP_DEVICES;
 175                                 continue;
 176                         case 'f':
 177                                 op = OP_FILES;
 178                                 continue;
 179                         case 'g':
 180                                 op = OP_PACKAGES;
 181                                 continue;
 182                         case 'k':
 183                                 op = OP_KEYS;
 184                                 continue;
 185                         case 'p':
 186                                 op = OP_PRODUCTS;
 187                                 continue;
 188                         case 'H':
 189                                 op = OP_HASHES;
 190                                 continue;
 191                         case 'm':
 192                                 op = OP_MEASUREMENTS;
 193                                 continue;
 194                         case 'a':
 195                                 op = OP_ADD;
 196                                 continue;
 197                         case 'd':
 198                                 op = OP_DEL;
 199                                 continue;
 200                         case 'A':
 201                         {
 202                                 certificate_t *aik_cert;
 203                                 public_key_t *aik_key;
 204                                 chunk_t aik;
 205
 206                                 aik_cert = lib->creds->create(lib->creds, CRED_CERTIFICATE,
 207                                                                 CERT_X509, BUILD_FROM_FILE, optarg, BUILD_END);
 208                                 if (!aik_cert)
 209                                 {
 210                                         printf("AIK certificate '%s' could not be loaded\n", optarg);
 211                                         exit(EXIT_FAILURE);
 212                                 }
 213                                 aik_key = aik_cert->get_public_key(aik_cert);
 214                                 aik_cert->destroy(aik_cert);
 215
 216                                 if (!aik_key)
 217                                 {
 218                                         printf("AIK public key could not be retrieved\n");
 219                                         exit(EXIT_FAILURE);
 220                                 }
 221                                 if (!aik_key->get_fingerprint(aik_key, KEYID_PUBKEY_INFO_SHA1,
 222                                                                                           &aik))
 223                                 {
 224                                         printf("AIK fingerprint could not be computed\n");
 225                                         aik_key->destroy(aik_key);
 226                                         exit(EXIT_FAILURE);
 227                                 }
 228                                 aik = chunk_clone(aik);
 229                                 aik_key->destroy(aik_key);
 230
 231                                 if (!attest->set_key(attest, aik, op == OP_ADD))
 232                                 {
 233                                         exit(EXIT_FAILURE);
 234                                 }
 235                                 continue;
 236                         }
 237                         case 'B':
 238                                 attest->set_security(attest, OS_PACKAGE_STATE_BLACKLIST);
 239                                 continue;
 240                         case 'C':
 241                                 if (!attest->set_component(attest, optarg, op == OP_ADD))
 242                                 {
 243                                         exit(EXIT_FAILURE);
 244                                 }
 245                                 continue;
 246                         case 'D':
 247                                 if (!attest->set_directory(attest, optarg, op == OP_ADD))
 248                                 {
 249                                         exit(EXIT_FAILURE);
 250                                 }
 251                                 continue;
 252                         case 'F':
 253                                 if (!attest->set_file(attest, optarg, op == OP_ADD))
 254                                 {
 255                                         exit(EXIT_FAILURE);
 256                                 }
 257                                 continue;
 258                         case 'G':
 259                                 if (!attest->set_package(attest, optarg, op == OP_ADD))
 260                                 {
 261                                         exit(EXIT_FAILURE);
 262                                 }
 263                                 continue;
 264                         case 'I':
 265                                 attest->set_algo(attest, PTS_MEAS_ALGO_SHA1_IMA);
 266                                 continue;
 267                         case 'K':
 268                         {
 269                                 chunk_t aik;
 270
 271                                 aik = chunk_from_hex(chunk_create(optarg, strlen(optarg)), NULL);
 272                                 if (!attest->set_key(attest, aik, op == OP_ADD))
 273                                 {
 274                                         exit(EXIT_FAILURE);
 275                                 }
 276                                 continue;
 277                         }
 278                         case 'O':
 279                                 attest->set_owner(attest, optarg);
 280                                 continue;
 281                         case 'P':
 282                                 if (!attest->set_product(attest, optarg, op == OP_ADD))
 283                                 {
 284                                         exit(EXIT_FAILURE);
 285                                 }
 286                                 continue;
 287                         case 'R':
 288                                 attest->set_relative(attest);
 289                                 continue;
 290                         case 'S':
 291                                 attest->set_sequence(attest, atoi(optarg));
 292                                 continue;
 293                         case 'V':
 294                                 if (!attest->set_version(attest, optarg))
 295                                 {
 296                                         exit(EXIT_FAILURE);
 297                                 }
 298                                 continue;
 299                         case 'Y':
 300                                 attest->set_security(attest, OS_PACKAGE_STATE_SECURITY);
 301                                 continue;
 302                         case '1':
 303                                 attest->set_algo(attest, PTS_MEAS_ALGO_SHA1);
 304                                 continue;
 305                         case '2':
 306                                 attest->set_algo(attest, PTS_MEAS_ALGO_SHA256);
 307                                 continue;
 308                         case '3':
 309                                 attest->set_algo(attest, PTS_MEAS_ALGO_SHA384);
 310                                 continue;
 311                         case '4':
 312                                 if (!attest->set_did(attest, atoi(optarg)))
 313                                 {
 314                                         exit(EXIT_FAILURE);
 315                                 }
 316                                 continue;
 317                         case '5':
 318                                 if (!attest->set_fid(attest, atoi(optarg)))
 319                                 {
 320                                         exit(EXIT_FAILURE);
 321                                 }
 322                                 continue;
 323                         case '6':
 324                                 if (!attest->set_pid(attest, atoi(optarg)))
 325                                 {
 326                                         exit(EXIT_FAILURE);
 327                                 }
 328                                 continue;
 329                         case '7':
 330                                 if (!attest->set_cid(attest, atoi(optarg)))
 331                                 {
 332                                         exit(EXIT_FAILURE);
 333                                 }
 334                                 continue;
 335                         case '8':
 336                                 if (!attest->set_kid(attest, atoi(optarg)))
 337                                 {
 338                                         exit(EXIT_FAILURE);
 339                                 }
 340                                 continue;
 341                         case '9':
 342                                 if (!attest->set_gid(attest, atoi(optarg)))
 343                                 {
 344                                         exit(EXIT_FAILURE);
 345                                 }
 346                                 continue;
 347                 }
 348                 break;
 349         }
 350
 351         switch (op)
 352         {
 353                 case OP_USAGE:
 354                         usage();
 355                         break;
 356                 case OP_PACKAGES:
 357                         attest->list_packages(attest);
 358                         break;
 359                 case OP_PRODUCTS:
 360                         attest->list_products(attest);
 361                         break;
 362                 case OP_KEYS:
 363                         attest->list_keys(attest);
 364                         break;
 365                 case OP_COMPONENTS:
 366                         attest->list_components(attest);
 367                         break;
 368                 case OP_DEVICES:
 369                         attest->list_devices(attest);
 370                         break;
 371                 case OP_FILES:
 372                         attest->list_files(attest);
 373                         break;
 374                 case OP_HASHES:
 375                         attest->list_hashes(attest);
 376                         break;
 377                 case OP_MEASUREMENTS:
 378                         attest->list_measurements(attest);
 379                         break;
 380                 case OP_ADD:
 381                         attest->add(attest);
 382                         break;
 383                 case OP_DEL:
 384                         attest->delete(attest);
 385                         break;
 386                 default:
 387                         usage();
 388                         exit(EXIT_FAILURE);
 389         }
 390 }
 391
 392 int main(int argc, char *argv[])
 393 {
 394         char *uri;
 395
 396         /* enable attest debugging hook */
 397         dbg = attest_dbg;
 398         openlog("attest", 0, LOG_DEBUG);
 399
 400         atexit(library_deinit);
 401
 402         /* initialize library */
 403         if (!library_init(NULL))
 404         {
 405                 exit(SS_RC_LIBSTRONGSWAN_INTEGRITY);
 406         }
 407         if (!lib->plugins->load(lib->plugins, NULL,
 408                         lib->settings->get_str(lib->settings, "attest.load", PLUGINS)))
 409         {
 410                 exit(SS_RC_INITIALIZATION_FAILED);
 411         }
 412
 413         uri = lib->settings->get_str(lib->settings, "attest.database", NULL);
 414         if (!uri)
 415         {
 416                 fprintf(stderr, "database URI attest.database not set.\n");
 417                 exit(SS_RC_INITIALIZATION_FAILED);
 418         }
 419         attest = attest_db_create(uri);
 420         if (!attest)
 421         {
 422                 exit(SS_RC_INITIALIZATION_FAILED);
 423         }
 424         atexit(cleanup);
 425         libimcv_init();
 426         libpts_init();
 427
 428         do_args(argc, argv);
 429
 430         exit(EXIT_SUCCESS);
 431 }
 432