ipsec attest now can measure all files in a directory
[strongswan.git] / src / libpts / plugins / imv_attestation / attest.c
1 /*
2 * Copyright (C) 2011-2012 Andreas Steffen
3 * HSR Hochschule fuer Technik Rapperswil
4 *
5 * This program is free software; you can redistribute it and/or modify it
6 * under the terms of the GNU General Public License as published by the
7 * Free Software Foundation; either version 2 of the License, or (at your
8 * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
9 *
10 * This program is distributed in the hope that it will be useful, but
11 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
12 * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
13 * for more details.
14 */
15
16 #define _GNU_SOURCE
17 #include <getopt.h>
18 #include <unistd.h>
19 #include <stdio.h>
20 #include <string.h>
21 #include <errno.h>
22 #include <syslog.h>
23
24 #include <library.h>
25 #include <debug.h>
26
27 #include <imcv.h>
28 #include <libpts.h>
29 #include <pts/pts_meas_algo.h>
30
31 #include "attest_db.h"
32 #include "attest_usage.h"
33
34 /**
35 * global debug output variables
36 */
37 static int debug_level = 2;
38 static bool stderr_quiet = TRUE;
39
40 /**
41 * attest dbg function
42 */
43 static void attest_dbg(debug_t group, level_t level, char *fmt, ...)
44 {
45 int priority = LOG_INFO;
46 char buffer[8192];
47 char *current = buffer, *next;
48 va_list args;
49
50 if (level <= debug_level)
51 {
52 if (!stderr_quiet)
53 {
54 va_start(args, fmt);
55 vfprintf(stderr, fmt, args);
56 fprintf(stderr, "\n");
57 va_end(args);
58 }
59
60 /* write in memory buffer first */
61 va_start(args, fmt);
62 vsnprintf(buffer, sizeof(buffer), fmt, args);
63 va_end(args);
64
65 /* do a syslog with every line */
66 while (current)
67 {
68 next = strchr(current, '\n');
69 if (next)
70 {
71 *(next++) = '\0';
72 }
73 syslog(priority, "%s\n", current);
74 current = next;
75 }
76 }
77 }
78
79 /**
80 * global attestation database object
81 */
82 attest_db_t *attest;
83
84 /**
85 * atexit handler to close db on shutdown
86 */
87 static void cleanup(void)
88 {
89 attest->destroy(attest);
90 libpts_deinit();
91 libimcv_deinit();
92 closelog();
93 }
94
95 static void do_args(int argc, char *argv[])
96 {
97 enum {
98 OP_UNDEF,
99 OP_USAGE,
100 OP_KEYS,
101 OP_COMPONENTS,
102 OP_FILES,
103 OP_HASHES,
104 OP_MEASUREMENTS,
105 OP_PRODUCTS,
106 OP_ADD,
107 OP_DEL,
108 } op = OP_UNDEF;
109
110 /* reinit getopt state */
111 optind = 0;
112
113 while (TRUE)
114 {
115 int c;
116
117 struct option long_opts[] = {
118 { "help", no_argument, NULL, 'h' },
119 { "components", no_argument, NULL, 'c' },
120 { "files", no_argument, NULL, 'f' },
121 { "keys", no_argument, NULL, 'k' },
122 { "products", no_argument, NULL, 'p' },
123 { "hashes", no_argument, NULL, 'H' },
124 { "measurements", no_argument, NULL, 'm' },
125 { "add", no_argument, NULL, 'a' },
126 { "delete", no_argument, NULL, 'd' },
127 { "del", no_argument, NULL, 'd' },
128 { "aik", required_argument, NULL, 'A' },
129 { "component", required_argument, NULL, 'C' },
130 { "comp", required_argument, NULL, 'C' },
131 { "directory", required_argument, NULL, 'D' },
132 { "dir", required_argument, NULL, 'D' },
133 { "file", required_argument, NULL, 'F' },
134 { "ima", no_argument, NULL, 'I' },
135 { "key", required_argument, NULL, 'K' },
136 { "owner", required_argument, NULL, 'O' },
137 { "product", required_argument, NULL, 'P' },
138 { "relative", no_argument, NULL, 'R' },
139 { "sha1", no_argument, NULL, '1' },
140 { "sha256", no_argument, NULL, '2' },
141 { "sha384", no_argument, NULL, '3' },
142 { "did", required_argument, NULL, '4' },
143 { "fid", required_argument, NULL, '5' },
144 { "pid", required_argument, NULL, '6' },
145 { "cid", required_argument, NULL, '7' },
146 { "kid", required_argument, NULL, '8' },
147 { 0,0,0,0 }
148 };
149
150 c = getopt_long(argc, argv, "", long_opts, NULL);
151 switch (c)
152 {
153 case EOF:
154 break;
155 case 'h':
156 op = OP_USAGE;
157 break;
158 case 'c':
159 op = OP_COMPONENTS;
160 continue;
161 case 'f':
162 op = OP_FILES;
163 continue;
164 case 'k':
165 op = OP_KEYS;
166 continue;
167 case 'p':
168 op = OP_PRODUCTS;
169 continue;
170 case 'H':
171 op = OP_HASHES;
172 continue;
173 case 'm':
174 op = OP_MEASUREMENTS;
175 continue;
176 case 'a':
177 op = OP_ADD;
178 continue;
179 case 'd':
180 op = OP_DEL;
181 continue;
182 case 'A':
183 {
184 certificate_t *aik_cert;
185 public_key_t *aik_key;
186 chunk_t aik;
187
188 aik_cert = lib->creds->create(lib->creds, CRED_CERTIFICATE,
189 CERT_X509, BUILD_FROM_FILE, optarg, BUILD_END);
190 if (!aik_cert)
191 {
192 printf("AIK certificate '%s' could not be loaded\n", optarg);
193 exit(EXIT_FAILURE);
194 }
195 aik_key = aik_cert->get_public_key(aik_cert);
196 aik_cert->destroy(aik_cert);
197
198 if (!aik_key)
199 {
200 printf("AIK public key could not be retrieved\n");
201 exit(EXIT_FAILURE);
202 }
203 if (!aik_key->get_fingerprint(aik_key, KEYID_PUBKEY_INFO_SHA1,
204 &aik))
205 {
206 printf("AIK fingerprint could not be computed\n");
207 aik_key->destroy(aik_key);
208 exit(EXIT_FAILURE);
209 }
210 aik = chunk_clone(aik);
211 aik_key->destroy(aik_key);
212
213 if (!attest->set_key(attest, aik, op == OP_ADD))
214 {
215 exit(EXIT_FAILURE);
216 }
217 continue;
218 }
219 case 'C':
220 if (!attest->set_component(attest, optarg, op == OP_ADD))
221 {
222 exit(EXIT_FAILURE);
223 }
224 continue;
225 case 'D':
226 if (!attest->set_directory(attest, optarg, op == OP_ADD))
227 {
228 exit(EXIT_FAILURE);
229 }
230 continue;
231 case 'F':
232 if (!attest->set_file(attest, optarg, op == OP_ADD))
233 {
234 exit(EXIT_FAILURE);
235 }
236 continue;
237 case 'I':
238 attest->set_ima(attest);
239 continue;
240 case 'K':
241 {
242 chunk_t aik;
243
244 aik = chunk_from_hex(chunk_create(optarg, strlen(optarg)), NULL);
245 if (!attest->set_key(attest, aik, op == OP_ADD))
246 {
247 exit(EXIT_FAILURE);
248 }
249 continue;
250 }
251 case 'O':
252 attest->set_owner(attest, optarg);
253 continue;
254 case 'P':
255 if (!attest->set_product(attest, optarg, op == OP_ADD))
256 {
257 exit(EXIT_FAILURE);
258 }
259 continue;
260 case 'R':
261 attest->set_relative(attest);
262 continue;
263 case '1':
264 attest->set_algo(attest, PTS_MEAS_ALGO_SHA1);
265 continue;
266 case '2':
267 attest->set_algo(attest, PTS_MEAS_ALGO_SHA256);
268 continue;
269 case '3':
270 attest->set_algo(attest, PTS_MEAS_ALGO_SHA384);
271 continue;
272 case '4':
273 if (!attest->set_did(attest, atoi(optarg)))
274 {
275 exit(EXIT_FAILURE);
276 }
277 continue;
278 case '5':
279 if (!attest->set_fid(attest, atoi(optarg)))
280 {
281 exit(EXIT_FAILURE);
282 }
283 continue;
284 case '6':
285 if (!attest->set_pid(attest, atoi(optarg)))
286 {
287 exit(EXIT_FAILURE);
288 }
289 continue;
290 case '7':
291 if (!attest->set_cid(attest, atoi(optarg)))
292 {
293 exit(EXIT_FAILURE);
294 }
295 continue;
296 case '8':
297 if (!attest->set_kid(attest, atoi(optarg)))
298 {
299 exit(EXIT_FAILURE);
300 }
301 continue;
302 }
303 break;
304 }
305
306 switch (op)
307 {
308 case OP_USAGE:
309 usage();
310 break;
311 case OP_PRODUCTS:
312 attest->list_products(attest);
313 break;
314 case OP_KEYS:
315 attest->list_keys(attest);
316 break;
317 case OP_COMPONENTS:
318 attest->list_components(attest);
319 break;
320 case OP_FILES:
321 attest->list_files(attest);
322 break;
323 case OP_HASHES:
324 attest->list_hashes(attest);
325 break;
326 case OP_MEASUREMENTS:
327 attest->list_measurements(attest);
328 break;
329 case OP_ADD:
330 attest->add(attest);
331 break;
332 case OP_DEL:
333 attest->delete(attest);
334 break;
335 default:
336 usage();
337 exit(EXIT_FAILURE);
338 }
339 }
340
341 int main(int argc, char *argv[])
342 {
343 char *uri;
344
345 /* enable attest debugging hook */
346 dbg = attest_dbg;
347 openlog("attest", 0, LOG_DEBUG);
348
349 atexit(library_deinit);
350
351 /* initialize library */
352 if (!library_init(NULL))
353 {
354 exit(SS_RC_LIBSTRONGSWAN_INTEGRITY);
355 }
356 if (!lib->plugins->load(lib->plugins, NULL,
357 lib->settings->get_str(lib->settings, "attest.load", PLUGINS)))
358 {
359 exit(SS_RC_INITIALIZATION_FAILED);
360 }
361
362 uri = lib->settings->get_str(lib->settings, "attest.database", NULL);
363 if (!uri)
364 {
365 fprintf(stderr, "database URI attest.database not set.\n");
366 exit(SS_RC_INITIALIZATION_FAILED);
367 }
368 attest = attest_db_create(uri);
369 if (!attest)
370 {
371 exit(SS_RC_INITIALIZATION_FAILED);
372 }
373 atexit(cleanup);
374 libimcv_init();
375 libpts_init();
376
377 do_args(argc, argv);
378
379 exit(EXIT_SUCCESS);
380 }
381