denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

libimcv: Update database to ISO 19770-2:2015 SWID standard

Browse Source
This commit is contained in:
Andreas Steffen
2017-07-08 23:19:51 +02:00
parent 88b941939f
commit 60da0153ee
6 changed files with 257 additions and 155 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libimcv/imv/data.sql
+68 -50
View File
@@ -652,114 +652,120 @@ INSERT INTO algorithms (
8192, 'SHA384' 8192, 'SHA384'
); );
INSERT INTO algorithms (
id, name
) VALUES (
4096, 'SHA512'
);
/* File Hashes */ /* File Hashes */
INSERT INTO file_hashes ( INSERT INTO file_hashes (
product, file, algo, hash version, file, algo, hash
) VALUES ( ) VALUES (
28, 2, 32768, X'6c6f8e12f6cbfba612e780374c4cdcd40f20968a' 2, 2, 32768, '6c6f8e12f6cbfba612e780374c4cdcd40f20968a'
); );
INSERT INTO file_hashes ( INSERT INTO file_hashes (
product, file, algo, hash version, file, algo, hash
) VALUES ( ) VALUES (
28, 2, 16384, X'dbcecd19d59310183cf5c31ddee29e8d7bec64d3f9583aad074330a1b3024b07' 2, 2, 16384, 'dbcecd19d59310183cf5c31ddee29e8d7bec64d3f9583aad074330a1b3024b07'
); );
INSERT INTO file_hashes ( INSERT INTO file_hashes (
product, file, algo, hash version, file, algo, hash
) VALUES ( ) VALUES (
28, 2, 8192, X'197c5385e5853003188833d4f991136c1b0875fa416a60b1159f64e57e457b3184762c884a802a2bda194c058e3bd953' 2, 2, 8192, '197c5385e5853003188833d4f991136c1b0875fa416a60b1159f64e57e457b3184762c884a802a2bda194c058e3bd953'
); );
INSERT INTO file_hashes ( INSERT INTO file_hashes (
product, file, algo, hash version, file, algo, hash
) VALUES ( ) VALUES (
28, 4, 32768, X'3ad204f99eb7262efab79cfca02628870ea76361' 2, 4, 32768, '3ad204f99eb7262efab79cfca02628870ea76361'
); );
INSERT INTO file_hashes ( INSERT INTO file_hashes (
product, file, algo, hash version, file, algo, hash
) VALUES ( ) VALUES (
28, 4, 16384, X'3a2170aad92fdd58b55e0e199822bc873cf587b2d1eb1ed7ed8dcea97ae86376' 2, 4, 16384, '3a2170aad92fdd58b55e0e199822bc873cf587b2d1eb1ed7ed8dcea97ae86376'
); );
INSERT INTO file_hashes ( INSERT INTO file_hashes (
product, file, algo, hash version, file, algo, hash
) VALUES ( ) VALUES (
28, 4, 8192, X'f778076baa876b5e4b502494a3db081fb09dd870dee6991d54104a74b7e009c58fe261db5ffd13c11e08ef0cefcfa59f' 2, 4, 8192, 'f778076baa876b5e4b502494a3db081fb09dd870dee6991d54104a74b7e009c58fe261db5ffd13c11e08ef0cefcfa59f'
); );
INSERT INTO file_hashes ( INSERT INTO file_hashes (
product, file, algo, hash version, file, algo, hash
) VALUES ( ) VALUES (
28, 5, 32768, X'ecd9c7076cc0572724c7a67db7f19c2831e0445f' 4, 5, 32768, 'ecd9c7076cc0572724c7a67db7f19c2831e0445f'
); );
INSERT INTO file_hashes ( INSERT INTO file_hashes (
product, file, algo, hash version, file, algo, hash
) VALUES ( ) VALUES (
28, 5, 16384, X'28f3ea5afd34444c8232ea75003131e294a0c9b847de300e4b205d38c1a41305' 4, 5, 16384, '28f3ea5afd34444c8232ea75003131e294a0c9b847de300e4b205d38c1a41305'
); );
INSERT INTO file_hashes ( INSERT INTO file_hashes (
product, file, algo, hash version, file, algo, hash
) VALUES ( ) VALUES (
28, 5, 8192, X'51921a8b9322f2d3f06d55002ff40a79da67e70cb563b2a50977642d603dfac2ccbb68b3d32a8bb350769b75d6254208' 4, 5, 8192, '51921a8b9322f2d3f06d55002ff40a79da67e70cb563b2a50977642d603dfac2ccbb68b3d32a8bb350769b75d6254208'
); );
INSERT INTO file_hashes ( INSERT INTO file_hashes (
product, file, algo, hash version, file, algo, hash
) VALUES ( ) VALUES (
18, 1, 32768, X'd9309b9e45928239d7a7b18711e690792632cce4' 5, 1, 32768, 'd9309b9e45928239d7a7b18711e690792632cce4'
); );
INSERT INTO file_hashes ( INSERT INTO file_hashes (
product, file, algo, hash version, file, algo, hash
) VALUES ( ) VALUES (
18, 1, 16384, X'dbfa1856d278d8707c4989b30dd065b4bcd309908f0f2e6e66ff2aa83ff93f59' 5, 1, 16384, 'dbfa1856d278d8707c4989b30dd065b4bcd309908f0f2e6e66ff2aa83ff93f59'
); );
INSERT INTO file_hashes ( INSERT INTO file_hashes (
product, file, algo, hash version, file, algo, hash
) VALUES ( ) VALUES (
18, 1, 8192, X'fb8d027f03bb5ebb47741ed247eb9e174127b714d20229885feb37e0979aeb14a1b74020cded891d680441093625729c' 5, 1, 8192, 'fb8d027f03bb5ebb47741ed247eb9e174127b714d20229885feb37e0979aeb14a1b74020cded891d680441093625729c'
); );
INSERT INTO file_hashes ( INSERT INTO file_hashes (
product, file, algo, hash version, file, algo, hash
) VALUES ( ) VALUES (
18, 3, 32768, X'3715f2f94016a91fab5bbc503f0f1d43c5a9fc2b' 5, 3, 32768, '3715f2f94016a91fab5bbc503f0f1d43c5a9fc2b'
); );
INSERT INTO file_hashes ( INSERT INTO file_hashes (
product, file, algo, hash version, file, algo, hash
) VALUES ( ) VALUES (
18, 3, 16384, X'c03a5296b5decb87b01517f9927a8b2349dfb29ff9f5ba084f994c155ca5d4be' 5, 3, 16384, 'c03a5296b5decb87b01517f9927a8b2349dfb29ff9f5ba084f994c155ca5d4be'
); );
INSERT INTO file_hashes ( INSERT INTO file_hashes (
product, file, algo, hash version, file, algo, hash
) VALUES ( ) VALUES (
18, 3, 8192, X'b8bc345f56115235cc6091f61e312ce43ea54a5b99e7295002ae7b415fd35e06ec4c731ab70ad00d784bb53a318a2fa0' 5, 3, 8192, 'b8bc345f56115235cc6091f61e312ce43ea54a5b99e7295002ae7b415fd35e06ec4c731ab70ad00d784bb53a318a2fa0'
); );
INSERT INTO file_hashes ( INSERT INTO file_hashes (
product, file, algo, hash version, file, algo, hash
) VALUES ( ) VALUES (
18, 5, 32768, X'e59602f4edf24c1b36199588886d06665d4adcd7' 6, 5, 32768, 'e59602f4edf24c1b36199588886d06665d4adcd7'
); );
INSERT INTO file_hashes ( INSERT INTO file_hashes (
product, file, algo, hash version, file, algo, hash
) VALUES ( ) VALUES (
18, 5, 16384, X'090e1b77bda7fe665e498c6b5e09dbb7ddc5cfe57f213de48f4fb6736484f500' 6, 5, 16384, '090e1b77bda7fe665e498c6b5e09dbb7ddc5cfe57f213de48f4fb6736484f500'
); );
INSERT INTO file_hashes ( INSERT INTO file_hashes (
product, file, algo, hash version, file, algo, hash
) VALUES ( ) VALUES (
18, 5, 8192, X'7cbdb4612a13443dba910ecdef5161f2213e52c9b4a2eef14bcee5d287e9df931cd022e9e9715518ad9c9b6e3384a668' 6, 5, 8192, '7cbdb4612a13443dba910ecdef5161f2213e52c9b4a2eef14bcee5d287e9df931cd022e9e9715518ad9c9b6e3384a668'
); );
/* Packages */ /* Packages */
@@ -790,30 +796,42 @@ INSERT INTO packages ( /* 4 */
/* Versions */ /* Versions */
INSERT INTO versions ( INSERT INTO versions ( /* 1 */
package, product, release, time package, product, release, time
) VALUES ( ) VALUES (
1, 28, '1.0.1e-2', 1366531494 1, 28, '1.0.1e-2', 1366531494
); );
INSERT INTO versions ( INSERT INTO versions ( /* 2 */
package, product, release, time package, product, release, time
) VALUES ( ) VALUES (
2, 28, '1.0.1e-2', 1366531494 2, 28, '1.0.1e-2', 1366531494
); );
INSERT INTO versions ( INSERT INTO versions ( /* 3 */
package, product, release, time package, product, release, time
) VALUES ( ) VALUES (
3, 28, '1.0.1e-2', 1366531494 3, 28, '1.0.1e-2', 1366531494
); );
INSERT INTO versions ( INSERT INTO versions ( /* 4 */
package, product, release, time package, product, release, time
) VALUES ( ) VALUES (
4, 28, '1.0.1e-2', 1366531494 4, 28, '1.0.1e-2', 1366531494
); );
INSERT INTO versions ( /* 5 */
package, product, time
) VALUES (
2, 18, 1350544774
);
INSERT INTO versions ( /* 6 */
package, product, time
) VALUES (
4, 18, 1350544774
);
/* Components */ /* Components */
INSERT INTO components ( INSERT INTO components (
@@ -1681,59 +1699,59 @@ INSERT INTO enforcements ( /* 18 */
INSERT INTO "swid_entities" ( /* 1 */ INSERT INTO "swid_entities" ( /* 1 */
"name", "regid" "name", "regid"
) VALUES ( ) VALUES (
'strongSwan Project', 'regid.2004-03.org.strongswan' 'strongSwan Project', 'strongswan.org'
); );
INSERT INTO swid_entities ( /* 2 */ INSERT INTO swid_entities ( /* 2 */
"name", "regid" "name", "regid"
) VALUES ( ) VALUES (
'Adobe Systems Inc.', 'regid.1986-12.com.adobe' 'Adobe Systems Inc.', 'adobe.com'
); );
INSERT INTO swid_entities ( /* 3 */ INSERT INTO swid_entities ( /* 3 */
"name", "regid" "name", "regid"
) VALUES ( ) VALUES (
'Microsoft Corporation', 'regid.1991-06.com.microsoft' 'Microsoft Corporation', 'microsoft.com'
); );
INSERT INTO swid_entities ( /* 4 */ INSERT INTO swid_entities ( /* 4 */
"name", "regid" "name", "regid"
) VALUES ( ) VALUES (
'Ubuntu Project', 'regid.2004-05.com.ubuntu' 'Ubuntu Project', 'ubuntu.com'
); );
INSERT INTO swid_entities ( /* 5 */ INSERT INTO swid_entities ( /* 5 */
"name", "regid" "name", "regid"
) VALUES ( ) VALUES (
'Apache Software Foundation', 'regid.1995-04.org.apache' 'Apache Software Foundation', 'apache.org'
); );
INSERT INTO swid_entities ( /* 6 */ INSERT INTO swid_entities ( /* 6 */
"name", "regid" "name", "regid"
) VALUES ( ) VALUES (
'Debian Project', 'regid.1999-03.org.debian' 'Debian Project', 'debian.org'
); );
INSERT INTO swid_entities ( /* 7 */ INSERT INTO swid_entities ( /* 7 */
"name", "regid" "name", "regid"
) VALUES ( ) VALUES (
'Internet Systems Consortium', 'regid.1994-04.org.isc' 'Internet Systems Consortium', 'isc.org'
); );
INSERT INTO swid_entities ( /* 8 */ INSERT INTO swid_entities ( /* 8 */
"name", "regid" "name", "regid"
) VALUES ( ) VALUES (
'OpenSSL Project', 'regid.1998-12.org.openssl' 'OpenSSL Project', 'openssl.org'
); );
INSERT INTO swid_entities ( /* 9 */ INSERT INTO swid_entities ( /* 9 */
"name", "regid" "name", "regid"
) VALUES ( ) VALUES (
'Samba Project', 'regid.1998-01.org.samba' 'Samba Project', 'samba.org'
); );
INSERT INTO swid_entities ( /* 10 */ INSERT INTO swid_entities ( /* 10 */
"name", "regid" "name", "regid"
) VALUES ( ) VALUES (
'SQLite Project', 'regid.2002-08.org.sqlite' 'SQLite Project', 'sqlite.org'
); );
src/libimcv/imv/tables.sql
+7 -5
View File
@@ -41,10 +41,12 @@ DROP TABLE IF EXISTS file_hashes;
CREATE TABLE file_hashes ( CREATE TABLE file_hashes (
id INTEGER NOT NULL PRIMARY KEY AUTOINCREMENT, id INTEGER NOT NULL PRIMARY KEY AUTOINCREMENT,
file INTEGER NOT NULL REFERENCES files(id), file INTEGER NOT NULL REFERENCES files(id),
product INTEGER NOT NULL REFERENCES products(id), version INTEGER REFERENCES versions(id),
device INTEGER DEFAULT 0 REFERENCES devices(id), device INTEGER REFERENCES devices(id),
size INTEGER,
algo INTEGER NOT NULL REFERENCES algorithms(id), algo INTEGER NOT NULL REFERENCES algorithms(id),
hash BLOB NOT NULL hash VARCHAR(64) NOT NULL,
mutable INTEGER DEFAULT 0
); );
DROP TABLE IF EXISTS groups; DROP TABLE IF EXISTS groups;
@@ -177,9 +179,9 @@ CREATE INDEX packages_name ON packages (
DROP TABLE IF EXISTS versions; DROP TABLE IF EXISTS versions;
CREATE TABLE versions ( CREATE TABLE versions (
id INTEGER NOT NULL PRIMARY KEY AUTOINCREMENT, id INTEGER NOT NULL PRIMARY KEY AUTOINCREMENT,
package INTEGER NOT NULL REFERENCES packages(id),
product INTEGER NOT NULL REFERENCES products(id), product INTEGER NOT NULL REFERENCES products(id),
release TEXT NOT NULL, package INTEGER NOT NULL REFERENCES packages(id),
release TEXT,
security INTEGER DEFAULT 0, security INTEGER DEFAULT 0,
blacklist INTEGER DEFAULT 0, blacklist INTEGER DEFAULT 0,
time INTEGER DEFAULT 0 time INTEGER DEFAULT 0
src/libimcv/plugins/imv_attestation/attest_db.c
+155 -84
View File
@@ -1,5 +1,5 @@
/* /*
* Copyright (C) 2011-2014 Andreas Steffen * Copyright (C) 2011-2017 Andreas Steffen
* HSR Hochschule fuer Technik Rapperswil * HSR Hochschule fuer Technik Rapperswil
* *
* This program is free software; you can redistribute it and/or modify it * This program is free software; you can redistribute it and/or modify it
@@ -133,6 +133,11 @@ struct private_attest_db_t {
*/ */
char *version; char *version;
/**
* Primary key of software package version to be queried
*/
int vid;
/** /**
* TRUE if version has been set * TRUE if version has been set
*/ */
@@ -975,7 +980,7 @@ METHOD(attest_db_t, list_files, void,
{ {
while (e->enumerate(e, &fid, &file)) while (e->enumerate(e, &fid, &file))
{ {
printf("%4d: %s\n", fid, file); printf("%6d: %s\n", fid, file);
count++; count++;
} }
e->destroy(e); e->destroy(e);
@@ -996,10 +1001,10 @@ METHOD(attest_db_t, list_files, void,
{ {
if (did != last_did) if (did != last_did)
{ {
printf("%4d: %s\n", did, dir); printf("%6d: %s\n", did, dir);
last_did = did; last_did = did;
} }
printf("%4d: %s\n", fid, file); printf("%6d: %s\n", fid, file);
count++; count++;
} }
e->destroy(e); e->destroy(e);
@@ -1182,24 +1187,24 @@ METHOD(attest_db_t, list_hashes, void,
private_attest_db_t *this) private_attest_db_t *this)
{ {
enumerator_t *e; enumerator_t *e;
chunk_t hash; char *file, *dir, *product, *hash;
char *file, *dir, *product;
int id, fid, fid_old = 0, did, did_old = 0, pid, pid_old = 0, count = 0; int id, fid, fid_old = 0, did, did_old = 0, pid, pid_old = 0, count = 0;
if (this->pid && this->fid && this->did) if (this->pid && this->fid && this->did)
{ {
printf("%4d: %s\n", this->did, this->dir); printf("%6d: %s\n", this->did, this->dir);
printf("%4d: %s\n", this->fid, this->file); printf("%6d: %s\n", this->fid, this->file);
e = this->db->query(this->db, e = this->db->query(this->db,
"SELECT id, hash FROM file_hashes " "SELECT h.id, h.hash FROM file_hashes AS h "
"WHERE algo = ? AND file = ? AND product = ?", "JOIN versions AS v ON h.version = v.id "
"WHERE h.algo = ? AND h.file = ? AND v.product = ?",
DB_INT, this->algo, DB_INT, this->fid, DB_INT, this->pid, DB_INT, this->algo, DB_INT, this->fid, DB_INT, this->pid,
DB_INT, DB_BLOB); DB_INT, DB_TEXT);
if (e) if (e)
{ {
while (e->enumerate(e, &id, &hash)) while (e->enumerate(e, &id, &hash))
{ {
printf("%4d: %#B\n", id, &hash); printf("%6d: %s\n", id, hash);
count++; count++;
} }
e->destroy(e); e->destroy(e);
@@ -1216,25 +1221,26 @@ METHOD(attest_db_t, list_hashes, void,
"FROM file_hashes AS h " "FROM file_hashes AS h "
"JOIN files AS f ON h.file = f.id " "JOIN files AS f ON h.file = f.id "
"JOIN directories AS d ON f.dir = d.id " "JOIN directories AS d ON f.dir = d.id "
"WHERE h.algo = ? AND h.product = ? AND f.name = ? " "JOIN versions AS v ON h.version = v.id "
"WHERE h.algo = ? AND v.product = ? AND f.name = ? "
"ORDER BY d.path, f.name, h.hash", "ORDER BY d.path, f.name, h.hash",
DB_INT, this->algo, DB_INT, this->pid, DB_TEXT, this->file, DB_INT, this->algo, DB_INT, this->pid, DB_TEXT, this->file,
DB_INT, DB_BLOB, DB_INT, DB_INT, DB_TEXT); DB_INT, DB_TEXT, DB_INT, DB_INT, DB_TEXT);
if (e) if (e)
{ {
while (e->enumerate(e, &id, &hash, &fid, &did, &dir)) while (e->enumerate(e, &id, &hash, &fid, &did, &dir))
{ {
if (did != did_old) if (did != did_old)
{ {
printf("%4d: %s\n", did, dir); printf("%6d: %s\n", did, dir);
did_old = did; did_old = did;
} }
if (fid != fid_old) if (fid != fid_old)
{ {
printf("%4d: %s\n", fid, this->file); printf("%6d: %s\n", fid, this->file);
fid_old = fid; fid_old = fid;
} }
printf("%4d: %#B\n", id, &hash); printf("%6d: %s\n", id, hash);
count++; count++;
} }
e->destroy(e); e->destroy(e);
@@ -1246,25 +1252,26 @@ METHOD(attest_db_t, list_hashes, void,
} }
else if (this->pid && this->did) else if (this->pid && this->did)
{ {
printf("%4d: %s\n", this->did, this->dir); printf("%6d: %s\n", this->did, this->dir);
e = this->db->query(this->db, e = this->db->query(this->db,
"SELECT h.id, h.hash, f.id, f.name " "SELECT h.id, h.hash, f.id, f.name "
"FROM file_hashes AS h " "FROM file_hashes AS h "
"JOIN files AS f ON h.file = f.id " "JOIN files AS f ON h.file = f.id "
"WHERE h.algo = ? AND h.product = ? AND f.dir = ? " "JOIN versions AS v ON h.version = v.id "
"WHERE h.algo = ? AND v.product = ? AND f.dir = ? "
"ORDER BY f.name, h.hash", "ORDER BY f.name, h.hash",
DB_INT, this->algo, DB_INT, this->pid, DB_INT, this->did, DB_INT, this->algo, DB_INT, this->pid, DB_INT, this->did,
DB_INT, DB_BLOB, DB_INT, DB_TEXT); DB_INT, DB_TEXT, DB_INT, DB_TEXT);
if (e) if (e)
{ {
while (e->enumerate(e, &id, &hash, &fid, &file)) while (e->enumerate(e, &id, &hash, &fid, &file))
{ {
if (fid != fid_old) if (fid != fid_old)
{ {
printf("%4d: %s\n", fid, file); printf("%6d: %s\n", fid, file);
fid_old = fid; fid_old = fid;
} }
printf("%4d: %#B\n", id, &hash); printf("%6d: %s\n", id, hash);
count++; count++;
} }
e->destroy(e); e->destroy(e);
@@ -1281,25 +1288,26 @@ METHOD(attest_db_t, list_hashes, void,
"FROM file_hashes AS h " "FROM file_hashes AS h "
"JOIN files AS f ON h.file = f.id " "JOIN files AS f ON h.file = f.id "
"JOIN directories AS d ON f.dir = d.id " "JOIN directories AS d ON f.dir = d.id "
"WHERE h.algo = ? AND h.product = ? " "JOIN versions AS v ON h.version = v.id "
"WHERE h.algo = ? AND v.product = ? "
"ORDER BY d.path, f.name, h.hash", "ORDER BY d.path, f.name, h.hash",
DB_INT, this->algo, DB_INT, this->pid, DB_INT, this->algo, DB_INT, this->pid,
DB_INT, DB_BLOB, DB_INT, DB_TEXT, DB_INT, DB_TEXT); DB_INT, DB_TEXT, DB_INT, DB_TEXT, DB_INT, DB_TEXT);
if (e) if (e)
{ {
while (e->enumerate(e, &id, &hash, &fid, &file, &did, &dir)) while (e->enumerate(e, &id, &hash, &fid, &file, &did, &dir))
{ {
if (did != did_old) if (did != did_old)
{ {
printf("%4d: %s\n", did, dir); printf("%6d: %s\n", did, dir);
did_old = did; did_old = did;
} }
if (fid != fid_old) if (fid != fid_old)
{ {
printf("%4d: %s\n", fid, file); printf("%6d: %s\n", fid, file);
fid_old = fid; fid_old = fid;
} }
printf("%4d: %#B\n", id, &hash); printf("%6d: %s\n", id, hash);
count++; count++;
} }
e->destroy(e); e->destroy(e);
@@ -1313,21 +1321,22 @@ METHOD(attest_db_t, list_hashes, void,
{ {
e = this->db->query(this->db, e = this->db->query(this->db,
"SELECT h.id, h.hash, p.id, p.name FROM file_hashes AS h " "SELECT h.id, h.hash, p.id, p.name FROM file_hashes AS h "
"JOIN products AS p ON h.product = p.id " "JOIN versions AS v ON h.version = v.id "
"JOIN products AS p ON v.product = p.id "
"WHERE h.algo = ? AND h.file = ? " "WHERE h.algo = ? AND h.file = ? "
"ORDER BY p.name, h.hash", "ORDER BY p.name, h.hash",
DB_INT, this->algo, DB_INT, this->fid, DB_INT, this->algo, DB_INT, this->fid,
DB_INT, DB_BLOB, DB_INT, DB_TEXT); DB_INT, DB_TEXT, DB_INT, DB_TEXT);
if (e) if (e)
{ {
while (e->enumerate(e, &id, &hash, &pid, &product)) while (e->enumerate(e, &id, &hash, &pid, &product))
{ {
if (pid != pid_old) if (pid != pid_old)
{ {
printf("%4d: %s\n", pid, product); printf("%6d: %s\n", pid, product);
pid_old = pid; pid_old = pid;
} }
printf("%4d: %#B\n", id, &hash); printf("%6d: %s\n", id, hash);
count++; count++;
} }
e->destroy(e); e->destroy(e);
@@ -1345,32 +1354,33 @@ METHOD(attest_db_t, list_hashes, void,
"FROM file_hashes AS h " "FROM file_hashes AS h "
"JOIN files AS f ON h.file = f.id " "JOIN files AS f ON h.file = f.id "
"JOIN directories AS d ON f.dir = d.id " "JOIN directories AS d ON f.dir = d.id "
"JOIN products AS p ON h.product = p.id " "JOIN versions AS v ON h.version = v.id "
"JOIN products AS p ON v.product = p.id "
"WHERE h.algo = ? AND f.name = ? " "WHERE h.algo = ? AND f.name = ? "
"ORDER BY d.path, f.name, p.name, h.hash", "ORDER BY d.path, f.name, p.name, h.hash",
DB_INT, this->algo, DB_TEXT, this->file, DB_INT, this->algo, DB_TEXT, this->file,
DB_INT, DB_BLOB, DB_INT, DB_INT, DB_TEXT, DB_INT, DB_TEXT); DB_INT, DB_TEXT, DB_INT, DB_INT, DB_TEXT, DB_INT, DB_TEXT);
if (e) if (e)
{ {
while (e->enumerate(e, &id, &hash, &fid, &did, &dir, &pid, &product)) while (e->enumerate(e, &id, &hash, &fid, &did, &dir, &pid, &product))
{ {
if (did != did_old) if (did != did_old)
{ {
printf("%4d: %s\n", did, dir); printf("%6d: %s\n", did, dir);
did_old = did; did_old = did;
} }
if (fid != fid_old) if (fid != fid_old)
{ {
printf("%4d: %s\n", fid, this->file); printf("%6d: %s\n", fid, this->file);
fid_old = fid; fid_old = fid;
pid_old = 0; pid_old = 0;
} }
if (pid != pid_old) if (pid != pid_old)
{ {
printf("%4d: %s\n", pid, product); printf("%6d: %s\n", pid, product);
pid_old = pid; pid_old = pid;
} }
printf("%4d: %#B\n", id, &hash); printf("%6d: %s\n", id, hash);
count++; count++;
} }
e->destroy(e); e->destroy(e);
@@ -1386,27 +1396,28 @@ METHOD(attest_db_t, list_hashes, void,
"SELECT h.id, h.hash, f.id, f.name, p.id, p.name " "SELECT h.id, h.hash, f.id, f.name, p.id, p.name "
"FROM file_hashes AS h " "FROM file_hashes AS h "
"JOIN files AS f ON h.file = f.id " "JOIN files AS f ON h.file = f.id "
"JOIN products AS p ON h.product = p.id " "JOIN versions AS v ON h.version = v.id "
"JOIN products AS p ON v.product = p.id "
"WHERE h.algo = ? AND f.dir = ? " "WHERE h.algo = ? AND f.dir = ? "
"ORDER BY f.name, p.name, h.hash", "ORDER BY f.name, p.name, h.hash",
DB_INT, this->algo, DB_INT, this->did, DB_INT, this->algo, DB_INT, this->did,
DB_INT, DB_BLOB, DB_INT, DB_TEXT, DB_INT, DB_TEXT); DB_INT, DB_TEXT, DB_INT, DB_TEXT, DB_INT, DB_TEXT);
if (e) if (e)
{ {
while (e->enumerate(e, &id, &hash, &fid, &file, &pid, &product)) while (e->enumerate(e, &id, &hash, &fid, &file, &pid, &product))
{ {
if (fid != fid_old) if (fid != fid_old)
{ {
printf("%4d: %s\n", fid, file); printf("%6d: %s\n", fid, file);
fid_old = fid; fid_old = fid;
pid_old = 0; pid_old = 0;
} }
if (pid != pid_old) if (pid != pid_old)
{ {
printf("%4d: %s\n", pid, product); printf("%6d: %s\n", pid, product);
pid_old = pid; pid_old = pid;
} }
printf("%4d: %#B\n", id, &hash); printf("%6d: %s\n", id, hash);
count++; count++;
} }
e->destroy(e); e->destroy(e);
@@ -1423,10 +1434,11 @@ METHOD(attest_db_t, list_hashes, void,
"FROM file_hashes AS h " "FROM file_hashes AS h "
"JOIN files AS f ON h.file = f.id " "JOIN files AS f ON h.file = f.id "
"JOIN directories AS d ON f.dir = d.id " "JOIN directories AS d ON f.dir = d.id "
"JOIN products AS p on h.product = p.id " "JOIN versions AS v ON h.version = v.id "
"JOIN products AS p on v.product = p.id "
"WHERE h.algo = ? " "WHERE h.algo = ? "
"ORDER BY d.path, f.name, p.name, h.hash", "ORDER BY d.path, f.name, p.name, h.hash",
DB_INT, this->algo, DB_INT, DB_BLOB, DB_INT, DB_TEXT, DB_INT, this->algo, DB_INT, DB_TEXT, DB_INT, DB_TEXT,
DB_INT, DB_TEXT, DB_INT, DB_TEXT); DB_INT, DB_TEXT, DB_INT, DB_TEXT);
if (e) if (e)
{ {
@@ -1435,21 +1447,21 @@ METHOD(attest_db_t, list_hashes, void,
{ {
if (did != did_old) if (did != did_old)
{ {
printf("%4d: %s\n", did, dir); printf("%6d: %s\n", did, dir);
did_old = did; did_old = did;
} }
if (fid != fid_old) if (fid != fid_old)
{ {
printf("%4d: %s\n", fid, file); printf("%6d: %s\n", fid, file);
fid_old = fid; fid_old = fid;
pid_old = 0; pid_old = 0;
} }
if (pid != pid_old) if (pid != pid_old)
{ {
printf("%4d: %s\n", pid, product); printf("%6d: %s\n", pid, product);
pid_old = pid; pid_old = pid;
} }
printf("%4d: %#B\n", id, &hash); printf("%6d: %s\n", id, hash);
count++; count++;
} }
e->destroy(e); e->destroy(e);
@@ -1610,28 +1622,32 @@ static bool insert_file_hash(private_attest_db_t *this,
int *hashes_added, int *hashes_updated) int *hashes_added, int *hashes_updated)
{ {
enumerator_t *e; enumerator_t *e;
chunk_t hash; uint8_t hex_measurement_buf[2*HASH_SIZE_SHA512 + 1];
uint8_t *hex_hash_buf;
chunk_t hex_hash, hex_measurement;
char *label; char *label;
bool insert = TRUE, update = FALSE; bool insert = TRUE, update = FALSE;
label = "could not be created"; label = "could not be created";
e = this->db->query(this->db, e = this->db->query(this->db,
"SELECT hash FROM file_hashes WHERE algo = ? " "SELECT hash FROM file_hashes "
"AND file = ? AND product = ? AND device = 0", "WHERE algo = ? AND file = ? AND version = ?",
DB_INT, algo, DB_UINT, fid, DB_UINT, this->pid, DB_BLOB); DB_INT, algo, DB_UINT, fid, DB_UINT, this->vid, DB_TEXT);
if (!e) if (!e)
{ {
printf("file_hashes query failed\n"); printf("file_hashes query failed\n");
return FALSE; return FALSE;
} }
hex_measurement = chunk_to_hex(measurement, hex_measurement_buf, FALSE);
while (e->enumerate(e, &hash)) while (e->enumerate(e, &hex_hash_buf))
{ {
update = TRUE; update = TRUE;
hex_hash = chunk_from_str(hex_hash_buf);
if (chunk_equals(measurement, hash)) if (chunk_equals(hex_measurement, hex_hash))
{ {
label = "exists and equals"; label = "exists and equals";
insert = FALSE; insert = FALSE;
@@ -1644,10 +1660,10 @@ static bool insert_file_hash(private_attest_db_t *this,
{ {
if (this->db->execute(this->db, NULL, if (this->db->execute(this->db, NULL,
"INSERT INTO file_hashes " "INSERT INTO file_hashes "
"(file, product, device, algo, hash) " "(file, version, algo, hash) "
"VALUES (?, ?, 0, ?, ?)", "VALUES (?, ?, ?, ?)",
DB_UINT, fid, DB_UINT, this->pid, DB_UINT, fid, DB_UINT, this->vid,
DB_INT, algo, DB_BLOB, measurement) != 1) DB_INT, algo, DB_TEXT, hex_measurement) != 1)
{ {
printf("file_hash insertion failed\n"); printf("file_hash insertion failed\n");
return FALSE; return FALSE;
@@ -1667,6 +1683,75 @@ static bool insert_file_hash(private_attest_db_t *this,
return TRUE; return TRUE;
} }
/**
* Add a package version
*/
static bool add_version(private_attest_db_t *this)
{
int vid, security_old, security, blacklist_old, blacklist;
time_t t = time(NULL);
enumerator_t *e;
bool success;
security = this->package_state == OS_PACKAGE_STATE_SECURITY;
blacklist = this->package_state == OS_PACKAGE_STATE_BLACKLIST;
e = this->db->query(this->db,
"SELECT id, security, blacklist FROM versions "
"WHERE package = ? AND product = ? AND release = ?",
DB_UINT, this->gid, DB_UINT, this->pid, DB_TEXT, this->version,
DB_INT, DB_INT, DB_INT, DB_INT);
if (e)
{
if (e->enumerate(e, &vid, &security_old, &blacklist_old))
{
this->vid = vid;
}
e->destroy(e);
}
if (this->vid)
{
if (security != security_old || blacklist != blacklist_old)
{
/* update security and/or blacklist flag */
success = this->db->execute(this->db, NULL, "UPDATE versions "
"SET security = ?, blacklist = ?, time = ? WHERE id = ?",
DB_INT, security, DB_INT, blacklist, DB_INT, t,
DB_INT, this->vid) == 1;
printf("'%s' package %s (%s)%N %s updated in database\n",
this->product, this->package, this->version,
os_package_state_names, this->package_state,
success ? "" : "could not be ");
}
else
{
success = TRUE;
printf("'%s' package %s (%s)%N exists in database\n",
this->product, this->package, this->version,
os_package_state_names, this->package_state);
}
return success;
}
/* create a new version */
success = this->db->execute(this->db, NULL,
"INSERT INTO versions "
"(package, product, release, security, blacklist, time) "
"VALUES (?, ?, ?, ?, ?, ?)",
DB_UINT, this->gid, DB_INT, this->pid, DB_TEXT,
this->version, DB_INT, security, DB_INT, blacklist,
DB_INT, t) == 1;
printf("'%s' package %s (%s)%N %sinserted into database\n",
this->product, this->package, this->version,
os_package_state_names, this->package_state,
success ? "" : "could not be ");
return success;
}
/** /**
* Add hash measurement for a single file or all files in a directory * Add hash measurement for a single file or all files in a directory
*/ */
@@ -1771,7 +1856,14 @@ static bool add_hash(private_attest_db_t *this)
METHOD(attest_db_t, add, bool, METHOD(attest_db_t, add, bool,
private_attest_db_t *this) private_attest_db_t *this)
{ {
bool success = FALSE; /* insert package version */
if (this->version_set && this->gid && this->pid)
{
if (!add_version(this))
{
return FALSE;
}
}
/* add directory or file hash measurement for a given product */ /* add directory or file hash measurement for a given product */
if (this->did && this->pid) if (this->did && this->pid)
@@ -1779,29 +1871,7 @@ METHOD(attest_db_t, add, bool,
return add_hash(this); return add_hash(this);
} }
/* insert package version */ return FALSE;
if (this->version_set && this->gid && this->pid)
{
time_t t = time(NULL);
int security, blacklist;
security = this->package_state == OS_PACKAGE_STATE_SECURITY;
blacklist = this->package_state == OS_PACKAGE_STATE_BLACKLIST;
success = this->db->execute(this->db, NULL,
"INSERT INTO versions "
"(package, product, release, security, blacklist, time) "
"VALUES (?, ?, ?, ?, ?, ?)",
DB_UINT, this->gid, DB_INT, this->pid, DB_TEXT,
this->version, DB_INT, security, DB_INT, blacklist,
DB_INT, t) == 1;
printf("'%s' package %s (%s)%N %sinserted into database\n",
this->product, this->package, this->version,
os_package_state_names, this->package_state,
success ? "" : "could not be ");
}
return success;
} }
METHOD(attest_db_t, delete, bool, METHOD(attest_db_t, delete, bool,
@@ -1816,8 +1886,9 @@ METHOD(attest_db_t, delete, bool,
if (this->algo && this->pid && this->fid) if (this->algo && this->pid && this->fid)
{ {
success = this->db->execute(this->db, NULL, success = this->db->execute(this->db, NULL,
"DELETE FROM file_hashes " "DELETE FROM file_hashes AS h "
"WHERE algo = ? AND product = ? AND file = ?", "JOIN versions AS v ON h.version = v.id "
"WHERE h.algo = ? AND v.product = ? AND h.file = ?",
DB_UINT, this->algo, DB_UINT, this->pid, DB_UINT, this->algo, DB_UINT, this->pid,
DB_UINT, this->fid) > 0; DB_UINT, this->fid) > 0;
src/libimcv/plugins/imv_attestation/attest_usage.c
+4 -3
View File
@@ -1,5 +1,5 @@
/* /*
* Copyright (C) 2011-2014 Andreas Steffen * Copyright (C) 2011-2017 Andreas Steffen
* HSR Hochschule fuer Technik Rapperswil * HSR Hochschule fuer Technik Rapperswil
* *
* This program is free software; you can redistribute it and/or modify it * This program is free software; you can redistribute it and/or modify it
@@ -77,8 +77,9 @@ Usage:\n\
ipsec attest --add [--owner <name>] --key <digest>|--aik <path>\n\ ipsec attest --add [--owner <name>] --key <digest>|--aik <path>\n\
Add an AIK public key digest entry preceded by an optional owner name\n\ Add an AIK public key digest entry preceded by an optional owner name\n\
\n\ \n\
ipsec attest --add --product <name>|--pid <id> --sha1|--sha1-ima|--sha256|--sha384\n\ ipsec attest --add --product <name>|--pid <id> --sha1|--sha256|--sha384\n\
[--relative|--rel] --dir <path>|--file <path>\n\ [--relative|--rel] [--package <name> --version <string>]\n\
--dir <path>|--file <path>\n\
Add hashes of a single file or all files in a directory under absolute or relative filenames\n\ Add hashes of a single file or all files in a directory under absolute or relative filenames\n\
\n\ \n\
ipsec attest --add --key <digest|--kid <id> --component <cfn>|--cid <id> --sequence <no>|--seq <no>\n\ ipsec attest --add --key <digest|--kid <id> --component <cfn>|--cid <id> --sequence <no>|--seq <no>\n\
src/libimcv/pts/components/ita/ita_comp_ima.c
+6 -3
View File
@@ -1,5 +1,5 @@
/* /*
* Copyright (C) 2011-2014 Andreas Steffen * Copyright (C) 2011-2017 Andreas Steffen
* HSR Hochschule fuer Technik Rapperswil * HSR Hochschule fuer Technik Rapperswil
* *
* This program is free software; you can redistribute it and/or modify it * This program is free software; you can redistribute it and/or modify it
@@ -667,7 +667,8 @@ METHOD(pts_component_t, verify, status_t,
case IMA_STATE_RUNTIME: case IMA_STATE_RUNTIME:
{ {
uint8_t hash_buf[HASH_SIZE_SHA512]; uint8_t hash_buf[HASH_SIZE_SHA512];
chunk_t digest, hash; uint8_t digest_buf[HASH_SIZE_SHA512], *hex_digest_buf;
chunk_t hex_digest, digest, hash;
enumerator_t *e; enumerator_t *e;
this->count++; this->count++;
@@ -685,8 +686,10 @@ METHOD(pts_component_t, verify, status_t,
hash_algo, ima_name); hash_algo, ima_name);
if (e) if (e)
{ {
while (e->enumerate(e, &digest)) while (e->enumerate(e, &hex_digest_buf))
{ {
hex_digest = chunk_from_str(hex_digest_buf);
digest = chunk_from_hex(hex_digest, digest_buf);
if (!ima_hash(digest, ima_algo, ima_name, if (!ima_hash(digest, ima_algo, ima_name,
FALSE, algo, hash_buf)) FALSE, algo, hash_buf))
{ {
src/libimcv/pts/pts_database.c
+17 -10
View File
@@ -1,6 +1,6 @@
/* /*
* Copyright (C) 2011-2012 Sansar Choinyambuu * Copyright (C) 2011-2012 Sansar Choinyambuu
* Copyright (C) 2012-2014 Andreas Steffen * Copyright (C) 2012-2017 Andreas Steffen
* HSR Hochschule fuer Technik Rapperswil * HSR Hochschule fuer Technik Rapperswil
* *
* This program is free software; you can redistribute it and/or modify it * This program is free software; you can redistribute it and/or modify it
@@ -104,17 +104,19 @@ METHOD(pts_database_t, create_file_hash_enumerator, enumerator_t*,
"SELECT f.id, f.name, fh.hash FROM file_hashes AS fh " "SELECT f.id, f.name, fh.hash FROM file_hashes AS fh "
"JOIN files AS f ON f.id = fh.file " "JOIN files AS f ON f.id = fh.file "
"JOIN directories as d ON d.id = f.dir " "JOIN directories as d ON d.id = f.dir "
"WHERE fh.product = ? AND fh.algo = ? AND d.id = ? " "JOIN versions as v ON v.id = fh.version "
"WHERE v.product = ? AND fh.algo = ? AND d.id = ? "
"ORDER BY f.name", "ORDER BY f.name",
DB_INT, pid, DB_INT, algo, DB_INT, id, DB_INT, DB_TEXT, DB_BLOB); DB_INT, pid, DB_INT, algo, DB_INT, id, DB_INT, DB_TEXT, DB_TEXT);
} }
else else
{ {
e = this->db->query(this->db, e = this->db->query(this->db,
"SELECT f.id, f.name, fh.hash FROM file_hashes AS fh " "SELECT f.id, f.name, fh.hash FROM file_hashes AS fh "
"JOIN files AS f ON f.id = fh.file " "JOIN files AS f ON f.id = fh.file "
"WHERE fh.product = ? AND fh.algo = ? AND fh.file = ?", "JOIN versions AS v ON v.id = fh.version "
DB_INT, pid, DB_INT, algo, DB_INT, id, DB_INT, DB_TEXT, DB_BLOB); "WHERE v.product = ? AND fh.algo = ? AND fh.file = ?",
DB_INT, pid, DB_INT, algo, DB_INT, id, DB_INT, DB_TEXT, DB_TEXT);
} }
return e; return e;
} }
@@ -179,7 +181,8 @@ METHOD(pts_database_t, add_file_measurement, status_t,
/* does hash measurement value already exist? */ /* does hash measurement value already exist? */
e = this->db->query(this->db, e = this->db->query(this->db,
"SELECT fh.id, fh.hash FROM file_hashes AS fh " "SELECT fh.id, fh.hash FROM file_hashes AS fh "
"WHERE fh.product = ? AND fh.algo = ? AND fh.file = ?", "JOIN versions AS v ON v.id = fh.version "
"WHERE v.product = ? AND fh.algo = ? AND fh.file = ?",
DB_INT, pid, DB_INT, algo, DB_INT, fid, DB_INT, DB_BLOB); DB_INT, pid, DB_INT, algo, DB_INT, fid, DB_INT, DB_BLOB);
if (!e) if (!e)
{ {
@@ -235,8 +238,10 @@ METHOD(pts_database_t, create_file_meas_enumerator, enumerator_t*,
e = this->db->query(this->db, e = this->db->query(this->db,
"SELECT fh.hash FROM file_hashes AS fh " "SELECT fh.hash FROM file_hashes AS fh "
"JOIN files AS f ON f.id = fh.file " "JOIN files AS f ON f.id = fh.file "
"WHERE fh.product = ? AND f.name = ? AND fh.algo = ?", "JOIN versions AS v ON v.id = fh.version "
DB_INT, pid, DB_TEXT, file, DB_INT, algo, DB_BLOB); "WHERE v.product = ? AND f.name = ? AND fh.algo = ? "
"ORDER BY v.time DESC",
DB_INT, pid, DB_TEXT, file, DB_INT, algo, DB_TEXT);
} }
else else
{ /* absolute pathname */ { /* absolute pathname */
@@ -256,8 +261,10 @@ METHOD(pts_database_t, create_file_meas_enumerator, enumerator_t*,
e = this->db->query(this->db, e = this->db->query(this->db,
"SELECT fh.hash FROM file_hashes AS fh " "SELECT fh.hash FROM file_hashes AS fh "
"JOIN files AS f ON f.id = fh.file " "JOIN files AS f ON f.id = fh.file "
"WHERE fh.product = ? AND f.dir = ? AND f.name = ? AND fh.algo = ?", "JOIN versions AS v ON v.id = fh.version "
DB_INT, pid, DB_INT, did, DB_TEXT, file, DB_INT, algo, DB_BLOB); "WHERE v.product = ? AND f.dir = ? AND f.name = ? AND fh.algo = ? "
"ORDER BY v.time DESC",
DB_INT, pid, DB_INT, did, DB_TEXT, file, DB_INT, algo, DB_TEXT);
} }
err: err: