denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

implemented first TCG-PTS error attribute

Browse Source
This commit is contained in:
Andreas Steffen
2011-09-08 12:08:15 +02:00
parent e21c829861
commit 3d0699595b
5 changed files with 138 additions and 68 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libimcv/ietf/ietf_attr_pa_tnc_error.c
+70 -48
View File
@@ -34,7 +34,6 @@ typedef struct private_ietf_attr_pa_tnc_error_t private_ietf_attr_pa_tnc_error_t
* *
* 1 2 3 * 1 2 3
* 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 * 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
*
* +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
* | Reserved | PA-TNC Error Code Vendor ID | * | Reserved | PA-TNC Error Code Vendor ID |
* +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
@@ -48,7 +47,7 @@ typedef struct private_ietf_attr_pa_tnc_error_t private_ietf_attr_pa_tnc_error_t
#define PA_ERROR_RESERVED 0x00 #define PA_ERROR_RESERVED 0x00
/** /**
* All Error Types return the first 8 bytes of the erroneous PA-TNC message * All IETF Error Types return the first 8 bytes of the erroneous PA-TNC message
* *
* 1 2 3 * 1 2 3
* 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 * 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
@@ -60,6 +59,7 @@ typedef struct private_ietf_attr_pa_tnc_error_t private_ietf_attr_pa_tnc_error_t
*/ */
#define PA_ERROR_MSG_INFO_SIZE 8 #define PA_ERROR_MSG_INFO_SIZE 8
#define PA_ERROR_MSG_INFO_MAX_SIZE 1024
/** /**
* "Invalid Parameter" Error Code * "Invalid Parameter" Error Code
@@ -198,23 +198,25 @@ METHOD(pa_tnc_attr_t, build, void,
writer->write_uint32(writer, this->error_code); writer->write_uint32(writer, this->error_code);
writer->write_data (writer, this->msg_info); writer->write_data (writer, this->msg_info);
switch (this->error_code) if (this->error_vendor_id == PEN_IETF)
{ {
case PA_ERROR_INVALID_PARAMETER: switch (this->error_code)
writer->write_uint32(writer, this->error_offset); {
break; case PA_ERROR_INVALID_PARAMETER:
case PA_ERROR_VERSION_NOT_SUPPORTED: writer->write_uint32(writer, this->error_offset);
writer->write_uint8 (writer, PA_TNC_VERSION); break;
writer->write_uint8 (writer, PA_TNC_VERSION); case PA_ERROR_VERSION_NOT_SUPPORTED:
writer->write_uint16(writer, PA_ERROR_VERSION_RESERVED); writer->write_uint8 (writer, PA_TNC_VERSION);
break; writer->write_uint8 (writer, PA_TNC_VERSION);
case PA_ERROR_ATTR_TYPE_NOT_SUPPORTED: writer->write_uint16(writer, PA_ERROR_VERSION_RESERVED);
writer->write_data(writer, this->attr_info); break;
break; case PA_ERROR_ATTR_TYPE_NOT_SUPPORTED:
default: writer->write_data(writer, this->attr_info);
break; break;
default:
break;
}
} }
this->value = chunk_clone(writer->get_buf(writer)); this->value = chunk_clone(writer->get_buf(writer));
writer->destroy(writer); writer->destroy(writer);
} }
@@ -225,10 +227,9 @@ METHOD(pa_tnc_attr_t, process, status_t,
bio_reader_t *reader; bio_reader_t *reader;
u_int8_t reserved; u_int8_t reserved;
if (this->value.len < PA_ERROR_HEADER_SIZE + PA_ERROR_MSG_INFO_SIZE) if (this->value.len < PA_ERROR_HEADER_SIZE)
{ {
DBG1(DBG_TNC, "insufficient data for PA-TNC error header and " DBG1(DBG_TNC, "insufficient data for PA-TNC error header");
"error information");
*offset = 0; *offset = 0;
return FAILED; return FAILED;
} }
@@ -236,34 +237,49 @@ METHOD(pa_tnc_attr_t, process, status_t,
reader->read_uint8 (reader, &reserved); reader->read_uint8 (reader, &reserved);
reader->read_uint24(reader, &this->error_vendor_id); reader->read_uint24(reader, &this->error_vendor_id);
reader->read_uint32(reader, &this->error_code); reader->read_uint32(reader, &this->error_code);
reader->read_data (reader, PA_ERROR_MSG_INFO_SIZE, &this->msg_info);
this->msg_info = chunk_clone(this->msg_info);
switch (this->error_code) if (this->error_vendor_id == PEN_IETF)
{ {
case PA_ERROR_INVALID_PARAMETER: if (!reader->read_data(reader, PA_ERROR_MSG_INFO_SIZE, &this->msg_info))
if (!reader->read_uint32(reader, &this->error_offset)) {
{ reader->destroy(reader);
reader->destroy(reader); DBG1(DBG_TNC, "insufficient data for IETF error information");
DBG1(DBG_TNC, "insufficient data for error offset field"); *offset = PA_ERROR_HEADER_SIZE;
*offset = PA_ERROR_HEADER_SIZE + PA_ERROR_MSG_INFO_SIZE; return FAILED;
return FAILED; }
} this->msg_info = chunk_clone(this->msg_info);
break;
case PA_ERROR_ATTR_TYPE_NOT_SUPPORTED: switch (this->error_code)
if (!reader->read_data(reader, PA_ERROR_ATTR_INFO_SIZE, {
&this->attr_info)) case PA_ERROR_INVALID_PARAMETER:
{ if (!reader->read_uint32(reader, &this->error_offset))
reader->destroy(reader); {
DBG1(DBG_TNC, "insufficient data for unsupported attribute " reader->destroy(reader);
"information"); DBG1(DBG_TNC, "insufficient data for error offset field");
*offset = PA_ERROR_HEADER_SIZE + PA_ERROR_MSG_INFO_SIZE; *offset = PA_ERROR_HEADER_SIZE + PA_ERROR_MSG_INFO_SIZE;
return FAILED; return FAILED;
} }
this->attr_info = chunk_clone(this->attr_info); break;
break; case PA_ERROR_ATTR_TYPE_NOT_SUPPORTED:
default: if (!reader->read_data(reader, PA_ERROR_ATTR_INFO_SIZE,
break; &this->attr_info))
{
reader->destroy(reader);
DBG1(DBG_TNC, "insufficient data for unsupported attribute "
"information");
*offset = PA_ERROR_HEADER_SIZE + PA_ERROR_MSG_INFO_SIZE;
return FAILED;
}
this->attr_info = chunk_clone(this->attr_info);
break;
default:
break;
}
}
else
{
reader->read_data(reader, reader->remaining(reader), &this->msg_info);
this->msg_info = chunk_clone(this->msg_info);
} }
reader->destroy(reader); reader->destroy(reader);
@@ -334,8 +350,14 @@ pa_tnc_attr_t *ietf_attr_pa_tnc_error_create(pen_t vendor_id,
{ {
private_ietf_attr_pa_tnc_error_t *this; private_ietf_attr_pa_tnc_error_t *this;
/* the first 8 bytes of the erroneous PA-TNC message are sent back */ if (vendor_id == PEN_IETF)
msg_info.len = PA_ERROR_MSG_INFO_SIZE; {
msg_info.len = PA_ERROR_MSG_INFO_SIZE;
}
else if (msg_info.len > PA_ERROR_MSG_INFO_MAX_SIZE)
{
msg_info.len = PA_ERROR_MSG_INFO_MAX_SIZE;
}
INIT(this, INIT(this,
.public = { .public = {
src/libimcv/plugins/imc_attestation/imc_attestation.c
+8 -7
View File
@@ -20,6 +20,8 @@
#include <ietf/ietf_attr.h> #include <ietf/ietf_attr.h>
#include <ietf/ietf_attr_pa_tnc_error.h> #include <ietf/ietf_attr_pa_tnc_error.h>
#include <tcg/pts/pts_error.h>
#include <tcg/tcg_pts_attr_proto_caps.h> #include <tcg/tcg_pts_attr_proto_caps.h>
#include <tcg/tcg_pts_attr_meas_algo.h> #include <tcg/tcg_pts_attr_meas_algo.h>
#include <tcg/tcg_pts_attr_get_tpm_version_info.h> #include <tcg/tcg_pts_attr_get_tpm_version_info.h>
@@ -38,7 +40,6 @@
#include <pen/pen.h> #include <pen/pen.h>
#include <debug.h> #include <debug.h>
#include <utils/linked_list.h> #include <utils/linked_list.h>
#include <crypto/hashers/hasher.h>
/* IMC definitions */ /* IMC definitions */
@@ -241,19 +242,21 @@ TNC_Result TNC_IMC_ReceiveMessage(TNC_IMCID imc_id,
pts->set_meas_algorithm(pts, PTS_MEAS_ALGO_SHA384); pts->set_meas_algorithm(pts, PTS_MEAS_ALGO_SHA384);
} }
else if ((supported_algorithms & PTS_MEAS_ALGO_SHA256) && else if ((supported_algorithms & PTS_MEAS_ALGO_SHA256) &&
(selected_algorithm & PTS_MEAS_ALGO_SHA256)) (selected_algorithm & PTS_MEAS_ALGO_SHA256))
{ {
pts->set_meas_algorithm(pts, PTS_MEAS_ALGO_SHA256); pts->set_meas_algorithm(pts, PTS_MEAS_ALGO_SHA256);
} }
else if ((supported_algorithms & PTS_MEAS_ALGO_SHA1) && else if ((supported_algorithms & PTS_MEAS_ALGO_SHA1) &&
(selected_algorithm & PTS_MEAS_ALGO_SHA1)) (selected_algorithm & PTS_MEAS_ALGO_SHA1))
{ {
pts->set_meas_algorithm(pts, PTS_MEAS_ALGO_SHA1); pts->set_meas_algorithm(pts, PTS_MEAS_ALGO_SHA1);
} }
else else
{ {
/* TODO send a TCG_PTS_H_ALG_NOT_SUPPORTED error */ attr = pts_hash_alg_error_create(supported_algorithms);
attr_list->insert_last(attr_list, attr);
break;
} }
/* Send Measurement Algorithm Selection attribute */ /* Send Measurement Algorithm Selection attribute */
@@ -287,7 +290,7 @@ TNC_Result TNC_IMC_ReceiveMessage(TNC_IMCID imc_id,
if (!pts->get_aik(pts, &aik, &is_naked_key)) if (!pts->get_aik(pts, &aik, &is_naked_key))
{ {
DBG1(DBG_IMC,"Obtaining AIK Certificate failed"); DBG1(DBG_IMC, "Obtaining AIK Certificate failed");
break; break;
} }
@@ -360,8 +363,6 @@ TNC_Result TNC_IMC_ReceiveMessage(TNC_IMCID imc_id,
tcg_attr_names, attr->get_type(attr)); tcg_attr_names, attr->get_type(attr));
break; break;
} }
} }
} }
enumerator->destroy(enumerator); enumerator->destroy(enumerator);
src/libimcv/plugins/imv_attestation/imv_attestation.c
+26 -13
View File
@@ -21,6 +21,7 @@
#include <ietf/ietf_attr_pa_tnc_error.h> #include <ietf/ietf_attr_pa_tnc_error.h>
#include <tcg/pts/pts_database.h> #include <tcg/pts/pts_database.h>
#include <tcg/pts/pts_error.h>
#include <tcg/tcg_attr.h> #include <tcg/tcg_attr.h>
#include <tcg/tcg_pts_attr_proto_caps.h> #include <tcg/tcg_pts_attr_proto_caps.h>
@@ -331,28 +332,40 @@ TNC_Result TNC_IMV_ReceiveMessage(TNC_IMVID imv_id,
attr->get_type(attr) == IETF_ATTR_PA_TNC_ERROR) attr->get_type(attr) == IETF_ATTR_PA_TNC_ERROR)
{ {
ietf_attr_pa_tnc_error_t *error_attr; ietf_attr_pa_tnc_error_t *error_attr;
pen_t error_vendor_id;
pa_tnc_error_code_t error_code; pa_tnc_error_code_t error_code;
chunk_t msg_info, attr_info; chunk_t msg_info, attr_info;
u_int32_t offset; u_int32_t offset;
error_attr = (ietf_attr_pa_tnc_error_t*)attr; error_attr = (ietf_attr_pa_tnc_error_t*)attr;
error_vendor_id = error_attr->get_vendor_id(error_attr);
error_code = error_attr->get_error_code(error_attr); error_code = error_attr->get_error_code(error_attr);
msg_info = error_attr->get_msg_info(error_attr); msg_info = error_attr->get_msg_info(error_attr);
DBG1(DBG_IMV, "received PA-TNC error '%N' concerning message %#B", if (error_vendor_id == PEN_IETF)
pa_tnc_error_code_names, error_code, &msg_info);
switch (error_code)
{ {
case PA_ERROR_INVALID_PARAMETER: DBG1(DBG_IMV, "received PA-TNC error '%N' concerning message %#B",
offset = error_attr->get_offset(error_attr); pa_tnc_error_code_names, error_code, &msg_info);
DBG1(DBG_IMV, " occurred at offset of %u bytes", offset);
break; switch (error_code)
case PA_ERROR_ATTR_TYPE_NOT_SUPPORTED: {
attr_info = error_attr->get_attr_info(error_attr); case PA_ERROR_INVALID_PARAMETER:
DBG1(DBG_IMV, " unsupported attribute %#B", &attr_info); offset = error_attr->get_offset(error_attr);
break; DBG1(DBG_IMV, " occurred at offset of %u bytes", offset);
default: break;
break; case PA_ERROR_ATTR_TYPE_NOT_SUPPORTED:
attr_info = error_attr->get_attr_info(error_attr);
DBG1(DBG_IMV, " unsupported attribute %#B", &attr_info);
break;
default:
break;
}
}
else if (error_vendor_id == PEN_TCG)
{
DBG1(DBG_IMV, "received TCG-PTS error '%N'",
pts_error_code_names, error_code);
DBG1(DBG_IMV, "error information: %B", &msg_info);
} }
fatal_error = TRUE; fatal_error = TRUE;
} }
src/libimcv/tcg/pts/pts_error.c
+23
View File
@@ -15,6 +15,9 @@
#include "pts_error.h" #include "pts_error.h"
#include <bio/bio_writer.h>
#include <ietf/ietf_attr_pa_tnc_error.h>
ENUM(pts_error_code_names, TCG_PTS_RESERVED_ERROR, TCG_PTS_UNABLE_DET_PCR, ENUM(pts_error_code_names, TCG_PTS_RESERVED_ERROR, TCG_PTS_UNABLE_DET_PCR,
"Reserved Error", "Reserved Error",
"Hash Algorithm Not Supported", "Hash Algorithm Not Supported",
@@ -34,3 +37,23 @@ ENUM(pts_error_code_names, TCG_PTS_RESERVED_ERROR, TCG_PTS_UNABLE_DET_PCR,
"Unable To Determine Transitive Trust Chain", "Unable To Determine Transitive Trust Chain",
"Unable To Determine PCR" "Unable To Determine PCR"
); );
/**
* Described in header.
*/
pa_tnc_attr_t* pts_hash_alg_error_create(pts_meas_algorithms_t algorithms)
{
bio_writer_t *writer;
chunk_t msg_info;
pa_tnc_attr_t *attr;
writer = bio_writer_create(4);
writer->write_uint16(writer, 0x0000);
writer->write_uint16(writer, algorithms);
msg_info = writer->get_buf(writer);
attr = ietf_attr_pa_tnc_error_create(PEN_TCG, TCG_PTS_HASH_ALG_NOT_SUPPORTED,
msg_info);
writer->destroy(writer);
return attr;
}
src/libimcv/tcg/pts/pts_error.h
+11
View File
@@ -23,6 +23,9 @@
typedef enum pts_error_code_t pts_error_code_t; typedef enum pts_error_code_t pts_error_code_t;
#include "pts_meas_algo.h"
#include "pa_tnc/pa_tnc_attr.h"
#include <library.h> #include <library.h>
/** /**
@@ -54,4 +57,12 @@ enum pts_error_code_t {
*/ */
extern enum_name_t *pts_error_code_names; extern enum_name_t *pts_error_code_names;
/**
* Creates a PTS Hash Algorithm Not Supported Error Attribute
* see section 4.2.2 of PTS Protocol: Binding to TNC IF-M Specification
*
* @param algorithms supported measurement hash algorithms
*/
pa_tnc_attr_t* pts_hash_alg_error_create(pts_meas_algorithms_t algorithms);
#endif /** PTS_ERROR_H_ @}*/ #endif /** PTS_ERROR_H_ @}*/