src/libpts/plugins/imv_attestation/imv_attestation_state.c

   1 /*
   2  * Copyright (C) 2011-2012 Sansar Choinyambuu, Andreas Steffen
   3  * HSR Hochschule fuer Technik Rapperswil
   4  *
   5  * This program is free software; you can redistribute it and/or modify it
   6  * under the terms of the GNU General Public License as published by the
   7  * Free Software Foundation; either version 2 of the License, or (at your
   8  * option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
   9  *
  10  * This program is distributed in the hope that it will be useful, but
  11  * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
  12  * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
  13  * for more details.
  14  */
  15
  16 #include "imv_attestation_state.h"
  17
  18 #include <libpts.h>
  19
  20 #include <imv/imv_lang_string.h>
  21 #include "imv/imv_reason_string.h"
  22
  23 #include <utils/lexparser.h>
  24 #include <collections/linked_list.h>
  25 #include <utils/debug.h>
  26
  27 typedef struct private_imv_attestation_state_t private_imv_attestation_state_t;
  28 typedef struct file_meas_request_t file_meas_request_t;
  29 typedef struct func_comp_t func_comp_t;
  30
  31 /**
  32  * Private data of an imv_attestation_state_t object.
  33  */
  34 struct private_imv_attestation_state_t {
  35
  36         /**
  37          * Public members of imv_attestation_state_t
  38          */
  39         imv_attestation_state_t public;
  40
  41         /**
  42          * TNCCS connection ID
  43          */
  44         TNC_ConnectionID connection_id;
  45
  46         /**
  47          * TNCCS connection state
  48          */
  49         TNC_ConnectionState state;
  50
  51         /**
  52          * Does the TNCCS connection support long message types?
  53          */
  54         bool has_long;
  55
  56         /**
  57          * Does the TNCCS connection support exclusive delivery?
  58          */
  59         bool has_excl;
  60
  61         /**
  62          * Maximum PA-TNC message size for this TNCCS connection
  63          */
  64         u_int32_t max_msg_len;
  65
  66         /**
  67          * IMV Attestation handshake state
  68          */
  69         imv_attestation_handshake_state_t handshake_state;
  70
  71         /**
  72          * IMV action recommendation
  73          */
  74         TNC_IMV_Action_Recommendation rec;
  75
  76         /**
  77          * IMV evaluation result
  78          */
  79         TNC_IMV_Evaluation_Result eval;
  80
  81         /**
  82          * File Measurement Request counter
  83          */
  84         u_int16_t file_meas_request_counter;
  85
  86         /**
  87          * List of PTS File/Directory Measurement requests
  88          */
  89         linked_list_t *file_meas_requests;
  90
  91         /**
  92          * List of Functional Components
  93          */
  94         linked_list_t *components;
  95
  96         /**
  97          * PTS object
  98          */
  99         pts_t *pts;
 100
 101         /**
 102          * Measurement error flags
 103          */
 104         u_int32_t measurement_error;
 105
 106         /**
 107          * TNC Reason String
 108          */
 109         imv_reason_string_t *reason_string;
 110
 111 };
 112
 113 /**
 114  * PTS File/Directory Measurement request entry
 115  */
 116 struct file_meas_request_t {
 117         u_int16_t id;
 118         int file_id;
 119         bool is_dir;
 120 };
 121
 122 /**
 123  * PTS Functional Component entry
 124  */
 125 struct func_comp_t {
 126         pts_component_t *comp;
 127         u_int8_t qualifier;
 128 };
 129
 130 /**
 131  * Frees a func_comp_t object
 132  */
 133 static void free_func_comp(func_comp_t *this)
 134 {
 135         this->comp->destroy(this->comp);
 136         free(this);
 137 }
 138
 139 /**
 140  * Supported languages
 141  */
 142 static char* languages[] = { "en", "mn", "de" };
 143
 144 /**
 145  * Table of reason strings
 146  */
 147 static imv_lang_string_t reason_file_meas_fail[] = {
 148         { "en", "Incorrect file measurement" },
 149         { "de", "Falsche Dateimessung" },
 150         { "mn", "Буруу байгаа файл" },
 151         { NULL, NULL }
 152 };
 153
 154 static imv_lang_string_t reason_file_meas_pend[] = {
 155         { "en", "Pending file measurement" },
 156         { "de", "Ausstehende Dateimessung" },
 157         { "mn", "Xүлээгдэж байгаа файл" },
 158         { NULL, NULL }
 159 };
 160
 161 static imv_lang_string_t reason_comp_evid_fail[] = {
 162         { "en", "Incorrect component evidence" },
 163         { "de", "Falsche Komponenten-Evidenz" },
 164         { "mn", "Буруу компонент хэмжилт" },
 165         { NULL, NULL }
 166 };
 167
 168 static imv_lang_string_t reason_comp_evid_pend[] = {
 169         { "en", "Pending component evidence" },
 170         { "de", "Ausstehende Komponenten-Evidenz" },
 171         { "mn", "Xүлээгдэж компонент хэмжилт" },
 172         { NULL, NULL }
 173 };
 174
 175 static imv_lang_string_t reason_tpm_quote_fail[] = {
 176         { "en", "Invalid TPM Quote signature received" },
 177         { "de", "Falsche TPM Quote Signature erhalten" },
 178         { "mn", "Буруу TPM Quote гарын үсэг" },
 179         { NULL, NULL }
 180 };
 181
 182 METHOD(imv_state_t, get_connection_id, TNC_ConnectionID,
 183         private_imv_attestation_state_t *this)
 184 {
 185         return this->connection_id;
 186 }
 187
 188 METHOD(imv_state_t, has_long, bool,
 189         private_imv_attestation_state_t *this)
 190 {
 191         return this->has_long;
 192 }
 193
 194 METHOD(imv_state_t, has_excl, bool,
 195         private_imv_attestation_state_t *this)
 196 {
 197         return this->has_excl;
 198 }
 199
 200 METHOD(imv_state_t, set_flags, void,
 201         private_imv_attestation_state_t *this, bool has_long, bool has_excl)
 202 {
 203         this->has_long = has_long;
 204         this->has_excl = has_excl;
 205 }
 206
 207 METHOD(imv_state_t, set_max_msg_len, void,
 208         private_imv_attestation_state_t *this, u_int32_t max_msg_len)
 209 {
 210         this->max_msg_len = max_msg_len;
 211 }
 212
 213 METHOD(imv_state_t, get_max_msg_len, u_int32_t,
 214         private_imv_attestation_state_t *this)
 215 {
 216         return this->max_msg_len;
 217 }
 218
 219 METHOD(imv_state_t, change_state, void,
 220         private_imv_attestation_state_t *this, TNC_ConnectionState new_state)
 221 {
 222         this->state = new_state;
 223 }
 224
 225 METHOD(imv_state_t, get_recommendation, void,
 226         private_imv_attestation_state_t *this, TNC_IMV_Action_Recommendation *rec,
 227                                                                         TNC_IMV_Evaluation_Result *eval)
 228 {
 229         *rec = this->rec;
 230         *eval = this->eval;
 231 }
 232
 233 METHOD(imv_state_t, set_recommendation, void,
 234         private_imv_attestation_state_t *this, TNC_IMV_Action_Recommendation rec,
 235                                                                         TNC_IMV_Evaluation_Result eval)
 236 {
 237         this->rec = rec;
 238         this->eval = eval;
 239 }
 240
 241 METHOD(imv_state_t, get_reason_string, bool,
 242         private_imv_attestation_state_t *this, enumerator_t *language_enumerator,
 243         chunk_t *reason_string, char **reason_language)
 244 {
 245         *reason_language = imv_lang_string_select_lang(language_enumerator,
 246                                                                                           languages, countof(languages));
 247
 248         /* Instantiate a TNC Reason String object */
 249         DESTROY_IF(this->reason_string);
 250         this->reason_string = imv_reason_string_create(*reason_language);
 251
 252         if (this->measurement_error & IMV_ATTESTATION_ERROR_FILE_MEAS_FAIL)
 253         {
 254                 this->reason_string->add_reason(this->reason_string,
 255                                                                                 reason_file_meas_fail);
 256         }
 257         if (this->measurement_error & IMV_ATTESTATION_ERROR_FILE_MEAS_PEND)
 258         {
 259                 this->reason_string->add_reason(this->reason_string,
 260                                                                                 reason_file_meas_pend);
 261         }
 262         if (this->measurement_error & IMV_ATTESTATION_ERROR_COMP_EVID_FAIL)
 263         {
 264                 this->reason_string->add_reason(this->reason_string,
 265                                                                                 reason_comp_evid_fail);
 266         }
 267         if (this->measurement_error & IMV_ATTESTATION_ERROR_COMP_EVID_PEND)
 268         {
 269                 this->reason_string->add_reason(this->reason_string,
 270                                                                                 reason_comp_evid_pend);
 271         }
 272         if (this->measurement_error & IMV_ATTESTATION_ERROR_TPM_QUOTE_FAIL)
 273         {
 274                 this->reason_string->add_reason(this->reason_string,
 275                                                                                 reason_tpm_quote_fail);
 276         }
 277         *reason_string = this->reason_string->get_encoding(this->reason_string);
 278
 279         return TRUE;
 280 }
 281
 282 METHOD(imv_state_t, get_remediation_instructions, bool,
 283         private_imv_attestation_state_t *this, enumerator_t *language_enumerator,
 284         chunk_t *string, char **lang_code, char **uri)
 285 {
 286         return FALSE;
 287 }
 288
 289 METHOD(imv_state_t, destroy, void,
 290         private_imv_attestation_state_t *this)
 291 {
 292         DESTROY_IF(this->reason_string);
 293         this->file_meas_requests->destroy_function(this->file_meas_requests, free);
 294         this->components->destroy_function(this->components, (void *)free_func_comp);
 295         this->pts->destroy(this->pts);
 296         free(this);
 297 }
 298
 299 METHOD(imv_attestation_state_t, get_handshake_state,
 300            imv_attestation_handshake_state_t, private_imv_attestation_state_t *this)
 301 {
 302         return this->handshake_state;
 303 }
 304
 305 METHOD(imv_attestation_state_t, set_handshake_state, void,
 306         private_imv_attestation_state_t *this,
 307         imv_attestation_handshake_state_t new_state)
 308 {
 309         this->handshake_state = new_state;
 310 }
 311
 312 METHOD(imv_attestation_state_t, get_pts, pts_t*,
 313         private_imv_attestation_state_t *this)
 314 {
 315         return this->pts;
 316 }
 317
 318 METHOD(imv_attestation_state_t, add_file_meas_request, u_int16_t,
 319         private_imv_attestation_state_t *this, int file_id, bool is_dir)
 320 {
 321         file_meas_request_t *request;
 322
 323         request = malloc_thing(file_meas_request_t);
 324         request->id = ++this->file_meas_request_counter;
 325         request->file_id = file_id;
 326         request->is_dir = is_dir;
 327         this->file_meas_requests->insert_last(this->file_meas_requests, request);
 328
 329         return this->file_meas_request_counter;
 330 }
 331
 332 METHOD(imv_attestation_state_t, check_off_file_meas_request, bool,
 333         private_imv_attestation_state_t *this, u_int16_t id, int *file_id,
 334         bool* is_dir)
 335 {
 336         enumerator_t *enumerator;
 337         file_meas_request_t *request;
 338         bool found = FALSE;
 339
 340         enumerator = this->file_meas_requests->create_enumerator(this->file_meas_requests);
 341         while (enumerator->enumerate(enumerator, &request))
 342         {
 343                 if (request->id == id)
 344                 {
 345                         found = TRUE;
 346                         *file_id = request->file_id;
 347                         *is_dir = request->is_dir;
 348                         this->file_meas_requests->remove_at(this->file_meas_requests, enumerator);
 349                         free(request);
 350                         break;
 351                 }
 352         }
 353         enumerator->destroy(enumerator);
 354         return found;
 355 }
 356
 357 METHOD(imv_attestation_state_t, get_file_meas_request_count, int,
 358         private_imv_attestation_state_t *this)
 359 {
 360         return this->file_meas_requests->get_count(this->file_meas_requests);
 361 }
 362
 363 METHOD(imv_attestation_state_t, create_component, pts_component_t*,
 364         private_imv_attestation_state_t *this, pts_comp_func_name_t *name,
 365         u_int32_t depth, pts_database_t *pts_db)
 366 {
 367         enumerator_t *enumerator;
 368         func_comp_t *entry, *new_entry;
 369         pts_component_t *component;
 370         bool found = FALSE;
 371
 372         enumerator = this->components->create_enumerator(this->components);
 373         while (enumerator->enumerate(enumerator, &entry))
 374         {
 375                 if (name->equals(name, entry->comp->get_comp_func_name(entry->comp)))
 376                 {
 377                         found = TRUE;
 378                         break;
 379                 }
 380         }
 381         enumerator->destroy(enumerator);
 382
 383         if (found)
 384         {
 385                 if (name->get_qualifier(name) == entry->qualifier)
 386                 {
 387                         /* duplicate entry */
 388                         return NULL;
 389                 }
 390                 new_entry = malloc_thing(func_comp_t);
 391                 new_entry->qualifier = name->get_qualifier(name);
 392                 new_entry->comp = entry->comp->get_ref(entry->comp);
 393                 this->components->insert_last(this->components, new_entry);
 394                 return entry->comp;
 395         }
 396         else
 397         {
 398                 component = pts_components->create(pts_components, name, depth, pts_db);
 399                 if (!component)
 400                 {
 401                         /* unsupported component */
 402                         return NULL;
 403                 }
 404                 new_entry = malloc_thing(func_comp_t);
 405                 new_entry->qualifier = name->get_qualifier(name);
 406                 new_entry->comp = component;
 407                 this->components->insert_last(this->components, new_entry);
 408                 return component;
 409         }
 410 }
 411
 412 METHOD(imv_attestation_state_t, get_component, pts_component_t*,
 413         private_imv_attestation_state_t *this, pts_comp_func_name_t *name)
 414 {
 415         enumerator_t *enumerator;
 416         func_comp_t *entry;
 417         pts_component_t *found = NULL;
 418
 419         enumerator = this->components->create_enumerator(this->components);
 420         while (enumerator->enumerate(enumerator, &entry))
 421         {
 422                 if (name->equals(name, entry->comp->get_comp_func_name(entry->comp)) &&
 423                         name->get_qualifier(name) == entry->qualifier)
 424                 {
 425                         found = entry->comp;
 426                         break;
 427                 }
 428         }
 429         enumerator->destroy(enumerator);
 430         return found;
 431 }
 432
 433 METHOD(imv_attestation_state_t, get_measurement_error, u_int32_t,
 434         private_imv_attestation_state_t *this)
 435 {
 436         return this->measurement_error;
 437 }
 438
 439 METHOD(imv_attestation_state_t, set_measurement_error, void,
 440         private_imv_attestation_state_t *this, u_int32_t error)
 441 {
 442         this->measurement_error |= error;
 443 }
 444
 445 METHOD(imv_attestation_state_t, finalize_components, void,
 446         private_imv_attestation_state_t *this)
 447 {
 448         func_comp_t *entry;
 449
 450         while (this->components->remove_last(this->components,
 451                                                                                 (void**)&entry) == SUCCESS)
 452         {
 453                 if (!entry->comp->finalize(entry->comp, entry->qualifier))
 454                 {
 455                         set_measurement_error(this, IMV_ATTESTATION_ERROR_COMP_EVID_PEND);
 456                 }
 457                 free_func_comp(entry);
 458         }
 459 }
 460
 461 METHOD(imv_attestation_state_t, components_finalized, bool,
 462         private_imv_attestation_state_t *this)
 463 {
 464         return this->components->get_count(this->components) == 0;
 465 }
 466
 467 /**
 468  * Described in header.
 469  */
 470 imv_state_t *imv_attestation_state_create(TNC_ConnectionID connection_id)
 471 {
 472         private_imv_attestation_state_t *this;
 473
 474         INIT(this,
 475                 .public = {
 476                         .interface = {
 477                                 .get_connection_id = _get_connection_id,
 478                                 .has_long = _has_long,
 479                                 .has_excl = _has_excl,
 480                                 .set_flags = _set_flags,
 481                                 .set_max_msg_len = _set_max_msg_len,
 482                                 .get_max_msg_len = _get_max_msg_len,
 483                                 .change_state = _change_state,
 484                                 .get_recommendation = _get_recommendation,
 485                                 .set_recommendation = _set_recommendation,
 486                                 .get_reason_string = _get_reason_string,
 487                                 .get_remediation_instructions = _get_remediation_instructions,
 488                                 .destroy = _destroy,
 489                         },
 490                         .get_handshake_state = _get_handshake_state,
 491                         .set_handshake_state = _set_handshake_state,
 492                         .get_pts = _get_pts,
 493                         .add_file_meas_request = _add_file_meas_request,
 494                         .check_off_file_meas_request = _check_off_file_meas_request,
 495                         .get_file_meas_request_count = _get_file_meas_request_count,
 496                         .create_component = _create_component,
 497                         .get_component = _get_component,
 498                         .finalize_components = _finalize_components,
 499                         .components_finalized = _components_finalized,
 500                         .get_measurement_error = _get_measurement_error,
 501                         .set_measurement_error = _set_measurement_error,
 502                 },
 503                 .connection_id = connection_id,
 504                 .state = TNC_CONNECTION_STATE_CREATE,
 505                 .handshake_state = IMV_ATTESTATION_STATE_INIT,
 506                 .rec = TNC_IMV_ACTION_RECOMMENDATION_NO_RECOMMENDATION,
 507                 .eval = TNC_IMV_EVALUATION_RESULT_DONT_KNOW,
 508                 .file_meas_requests = linked_list_create(),
 509                 .components = linked_list_create(),
 510                 .pts = pts_create(FALSE),
 511         );
 512
 513         return &this->public.interface;
 514 }