implemented Linux IMA functional component

src/libpts/pts/components/ita/ita_comp_func_name.c

@@ -36,9 +36,10 @@ ENUM_NEXT(pts_ita_qualifier_type_names, PTS_ITA_QUALIFIER_TYPE_ALL,
 ENUM_END(pts_ita_qualifier_type_names, PTS_ITA_QUALIFIER_TYPE_ALL);
 
 ENUM(pts_ita_comp_func_names, PTS_ITA_COMP_FUNC_NAME_IGNORE,
-							  PTS_ITA_COMP_FUNC_NAME_TBOOT,
+							  PTS_ITA_COMP_FUNC_NAME_IMA,
 	"Ignore",
 	"Trusted GRUB Boot Loader",
-	"Trusted Boot"
+	"Trusted Boot",
+	"Linux IMA"
 );
 

src/libpts/pts/components/ita/ita_comp_func_name.h

@@ -76,6 +76,8 @@ enum pts_ita_comp_func_name_t {
 	PTS_ITA_COMP_FUNC_NAME_TGRUB =				0x0001,
 	/** Trusted Boot */
 	PTS_ITA_COMP_FUNC_NAME_TBOOT =				0x0002,
+	/** Linux Integrity Measurement Architecture */
+	PTS_ITA_COMP_FUNC_NAME_IMA =				0x0003,
 };
 
 extern enum_name_t *pts_ita_comp_func_names;

src/libpts/pts/components/ita/ita_comp_ima.c

@@ -0,0 +1,331 @@
+/*
+ * Copyright (C) 2011 Andreas Steffen
+ *
+ * HSR Hochschule fuer Technik Rapperswil
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the
+ * Free Software Foundation; either version 2 of the License, or (at your
+ * option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
+ * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * for more details.
+ */
+
+#include "ita_comp_ima.h"
+#include "ita_comp_func_name.h"
+
+#include "pts/components/pts_component.h"
+
+#include <debug.h>
+#include <pen/pen.h>
+
+#include <sys/types.h>
+#include <sys/stat.h>
+#include <unistd.h>
+#include <fcntl.h>
+#include <errno.h>
+
+#define IMA_SECURITY_DIR			"/sys/kernel/security/tpm0/"
+#define IMA_BIOS_MEASUREMENT_PATH	IMA_SECURITY_DIR "binary_bios_measurements"
+#define IMA_PCR_MAX					8
+#define IMA_SEQUENCE				126
+
+typedef struct pts_ita_comp_ima_t pts_ita_comp_ima_t;
+
+/**
+ * Private data of a pts_ita_comp_ima_t object.
+ *
+ */
+struct pts_ita_comp_ima_t {
+
+	/**
+	 * Public pts_component_t interface.
+	 */
+	pts_component_t public;
+
+	/**
+	 * Component Functional Name
+	 */
+	pts_comp_func_name_t *name;
+
+	/**
+	 * Sub-component depth
+	 */
+	u_int32_t depth;
+
+	/**
+     * IMA BIOS measurement time
+	 */
+	time_t bios_measurement_time;
+
+	/**
+     * IMA BIOS measurements
+	 */
+	linked_list_t *list;
+
+	/**
+	 * Measurement sequence number
+	 */
+	int seq_no;
+
+	/**
+	 * Shadow PCR registers
+	 */
+	chunk_t pcrs[IMA_PCR_MAX];
+};
+
+typedef struct entry_t entry_t;
+
+/**
+ * Linux IMA measurement entry
+ */
+struct entry_t {
+
+	/**
+	 * PCR register
+	 */
+	u_int32_t pcr;
+
+	/**
+	 * SHA1 measurement hash
+	 */	
+	chunk_t measurement;
+};
+
+/**
+ * Free an entry_t object
+ */
+static void free_entry(entry_t *this)
+{
+	free(this->measurement.ptr);
+	free(this);
+}
+
+/**
+ * Load a PCR measurement file and determine the creation date
+ */
+static bool load_measurements(char *file, linked_list_t *list, time_t *created)
+{
+	u_int32_t pcr, num, len;
+	entry_t *entry;
+	struct stat st;
+	ssize_t res;
+	int fd;
+
+	fd = open(file, O_RDONLY);
+	if (fd == -1)
+	{
+		DBG1(DBG_PTS, "  opening '%s' failed: %s", file, strerror(errno));
+		return FALSE;
+	}
+
+	if (fstat(fd, &st) == -1)
+	{
+		DBG1(DBG_PTS, "  getting statistics of '%s' failed: %s", file,
+			 strerror(errno));
+		close(fd);
+		return FALSE;
+	}
+	*created = st.st_ctime;
+
+	while (TRUE)
+	{
+		res = read(fd, &pcr, 4);
+		if (res == 0)
+		{
+			DBG2(DBG_PTS, "loaded bios measurements '%s' (%d entries)",
+						   file, list->get_count(list));
+			close(fd);
+			return TRUE;
+		}
+
+		entry = malloc_thing(entry_t);
+		entry->pcr = pcr;
+		entry->measurement = chunk_alloc(HASH_SIZE_SHA1);
+
+		if (res != 4)
+		{
+			break;
+		}
+		if (read(fd, &num, 4) != 4)
+		{
+			break;
+		}
+		if (read(fd, entry->measurement.ptr, HASH_SIZE_SHA1) != HASH_SIZE_SHA1)
+		{
+			break;
+		}
+		if (read(fd, &len, 4) != 4)
+		{
+			break;
+		}
+		if (lseek(fd, len, SEEK_CUR) == -1)
+		{
+			break;
+		}
+		list->insert_last(list, entry);
+	}
+
+	DBG1(DBG_PTS, "loading bios measurements '%s' failed: %s",
+				   file, strerror(errno));
+	close(fd);
+	return FALSE;
+}
+
+METHOD(pts_component_t, get_comp_func_name, pts_comp_func_name_t*,
+	pts_ita_comp_ima_t *this)
+{
+	return this->name;
+}
+
+METHOD(pts_component_t, get_evidence_flags, u_int8_t,
+	pts_ita_comp_ima_t *this)
+{
+	return PTS_REQ_FUNC_COMP_EVID_PCR;
+}
+
+METHOD(pts_component_t, get_depth, u_int32_t,
+	pts_ita_comp_ima_t *this)
+{
+	return this->depth;
+}
+
+METHOD(pts_component_t, measure, status_t,
+	pts_ita_comp_ima_t *this, pts_t *pts, pts_comp_evidence_t **evidence)
+{
+	pts_comp_evidence_t *evid;
+	chunk_t pcr_before, pcr_after;
+	pts_pcr_transform_t pcr_transform;
+	pts_meas_algorithms_t hash_algo;
+	size_t pcr_len;
+	entry_t *entry;
+	hasher_t *hasher;
+
+	hash_algo = PTS_MEAS_ALGO_SHA1;
+	pcr_len = pts->get_pcr_len(pts);   
+	pcr_transform = pts_meas_algo_to_pcr_transform(hash_algo, pcr_len);
+
+	if (this->list->get_count(this->list) == 0)
+	{
+		if (!load_measurements(IMA_BIOS_MEASUREMENT_PATH, this->list,
+							   &this->bios_measurement_time))
+		{
+			return FAILED;
+		}
+	}
+	
+	if (this->list->remove_first(this->list, (void**)&entry) != SUCCESS)
+	{
+		DBG1(DBG_PTS, "could not retrieve measurement entry");
+		return FAILED;
+	}
+	
+	pcr_before = chunk_clone(this->pcrs[entry->pcr]);
+	
+	hasher = lib->crypto->create_hasher(lib->crypto, HASH_SHA1);
+	hasher->get_hash(hasher, pcr_before, NULL);
+	hasher->get_hash(hasher, entry->measurement, this->pcrs[entry->pcr].ptr);
+	hasher->destroy(hasher);
+
+	pcr_after = chunk_clone(this->pcrs[entry->pcr]);
+
+	evid = *evidence = pts_comp_evidence_create(this->name->clone(this->name),
+							this->depth, entry->pcr, hash_algo, pcr_transform,
+							this->bios_measurement_time, entry->measurement);
+	evid->set_pcr_info(evid, pcr_before, pcr_after);
+
+	free(entry);
+
+	return (this->list->get_count(this->list)) ? NEED_MORE : SUCCESS;
+}
+
+METHOD(pts_component_t, verify, status_t,
+	pts_ita_comp_ima_t *this, pts_t *pts, pts_database_t *pts_db,
+	pts_comp_evidence_t *evidence)
+{
+	bool has_pcr_info;
+	char *platform_info;
+	u_int32_t extended_pcr;
+	pts_meas_algorithms_t algo;
+	pts_pcr_transform_t transform;
+	time_t measurement_time;
+	chunk_t measurement, pcr_before, pcr_after;
+
+	platform_info = pts->get_platform_info(pts);
+	if (!pts_db || !platform_info)
+	{
+		DBG1(DBG_PTS, "%s%s%s not available",
+					  (pts_db) ? "" : "pts database",
+					  (!pts_db && !platform_info) ? "and" : "",
+					  (platform_info) ? "" : "platform info");
+		return FAILED;
+	}
+	measurement = evidence->get_measurement(evidence, &extended_pcr,
+									&algo, &transform, &measurement_time);
+
+	if (pts_db->check_comp_measurement(pts_db, measurement, this->name,
+	 		platform_info, ++this->seq_no, extended_pcr, algo) != SUCCESS)
+	{
+		return FAILED;
+	}
+
+	has_pcr_info = evidence->get_pcr_info(evidence, &pcr_before, &pcr_after);
+	if (has_pcr_info)
+	{
+		if (!pts->add_pcr(pts, extended_pcr, pcr_before, pcr_after))
+		{
+			return FAILED;
+		}
+	}
+
+	return (this->seq_no < IMA_SEQUENCE) ? NEED_MORE : SUCCESS;
+}
+
+METHOD(pts_component_t, destroy, void,
+	pts_ita_comp_ima_t *this)
+{
+	int i;
+
+	for (i = 0; i < IMA_PCR_MAX; i++)
+	{
+		free(this->pcrs[i].ptr);
+	}
+	this->list->destroy_function(this->list, (void *)free_entry);
+	this->name->destroy(this->name);
+	free(this);
+}
+
+/**
+ * See header
+ */
+pts_component_t *pts_ita_comp_ima_create(u_int8_t qualifier, u_int32_t depth)
+{
+	pts_ita_comp_ima_t *this;
+	int i;
+
+	INIT(this,
+		.public = {
+			.get_comp_func_name = _get_comp_func_name,
+			.get_evidence_flags = _get_evidence_flags,
+			.get_depth = _get_depth,
+			.measure = _measure,
+			.verify = _verify,
+			.destroy = _destroy,
+		},
+		.name = pts_comp_func_name_create(PEN_ITA, PTS_ITA_COMP_FUNC_NAME_IMA,
+										  qualifier),
+		.depth = depth,
+		.list = linked_list_create(),
+	);
+
+	for (i = 0; i < IMA_PCR_MAX; i++)
+	{
+		this->pcrs[i] = chunk_alloc(HASH_SIZE_SHA1);
+		memset(this->pcrs[i].ptr, 0x00, HASH_SIZE_SHA1);
+	}
+	return &this->public;
+}
+

src/libpts/pts/components/ita/ita_comp_ima.h

@@ -0,0 +1,34 @@
+/*
+ * Copyright (C) 2011 Andreas Steffen
+ * HSR Hochschule fuer Technik Rapperswil
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the
+ * Free Software Foundation; either version 2 of the License, or (at your
+ * option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
+ * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * for more details.
+ */
+
+/**
+ * @defgroup pts_ita_comp_func_name pts_ita_comp_func_name
+ * @{ @ingroup pts
+ */
+
+#ifndef PTS_ITA_COMP_IMA_H_
+#define PTS_ITA_COMP_IMA_H_
+
+#include "pts/components/pts_component.h"
+
+/**
+ * Create a PTS ITS Functional Component object
+ *
+ * @param qualifier		PTS Component Functional Name Qualifier
+ *
+ */
+pts_component_t* pts_ita_comp_ima_create(u_int8_t qualifier, u_int32_t depth);
+
+#endif /** PTS_ITA_COMP_IMA_H_ @}*/

src/libpts/pts/components/ita/ita_comp_tboot.c

@@ -23,6 +23,8 @@
 #include <debug.h>
 #include <pen/pen.h>
 
+#define TBOOT_SEQUENCE		2
+
 typedef struct pts_ita_comp_tboot_t pts_ita_comp_tboot_t;
 
 /**
@@ -46,16 +48,16 @@ struct pts_ita_comp_tboot_t {
 	 */
 	u_int32_t depth;
 
-	/**
-	 * Extended PCR last handled
-	 */
-	u_int32_t extended_pcr;
-
 	/**
 	 * Time of TBOOT measurement
 	 */
 	time_t measurement_time;
 
+	/**
+	 * Measurement sequence number
+	 */
+	int seq_no;
+
 };
 
 METHOD(pts_component_t, get_comp_func_name, pts_comp_func_name_t*,
@@ -83,10 +85,11 @@ METHOD(pts_component_t, measure, status_t,
 	char *meas_hex, *pcr_before_hex, *pcr_after_hex;
 	chunk_t measurement, pcr_before, pcr_after;
 	size_t hash_size, pcr_len;
+	u_int32_t extended_pcr;
 	pts_pcr_transform_t pcr_transform;
 	pts_meas_algorithms_t hash_algo;
 	
-	switch (this->extended_pcr)
+	switch (this->seq_no++)
 	{
 		case 0:
 			/* dummy data since currently the TBOOT log is not retrieved */
@@ -97,9 +100,9 @@ METHOD(pts_component_t, measure, status_t,
 						"libimcv.plugins.imc-attestation.pcr17_before", NULL);
 			pcr_after_hex = lib->settings->get_str(lib->settings,
 						"libimcv.plugins.imc-attestation.pcr17_after", NULL);
-			this->extended_pcr = PCR_TBOOT_POLICY;
+			extended_pcr = PCR_TBOOT_POLICY;
 			break;
-		case PCR_TBOOT_POLICY:
+		case 1:
 			/* dummy data since currently the TBOOT log is not retrieved */
 			meas_hex = lib->settings->get_str(lib->settings,
 						"libimcv.plugins.imc-attestation.pcr18_meas", NULL);
@@ -107,7 +110,7 @@ METHOD(pts_component_t, measure, status_t,
 						"libimcv.plugins.imc-attestation.pcr18_before", NULL);
 			pcr_after_hex = lib->settings->get_str(lib->settings,
 						"libimcv.plugins.imc-attestation.pcr18_after", NULL);
-			this->extended_pcr = PCR_TBOOT_MLE;
+			extended_pcr = PCR_TBOOT_MLE;
 			break;
 		default:
 			return FAILED;
@@ -136,12 +139,12 @@ METHOD(pts_component_t, measure, status_t,
 	}
 
 	evid = *evidence = pts_comp_evidence_create(this->name->clone(this->name),
-								this->depth, this->extended_pcr,
+								this->depth, extended_pcr,
 								hash_algo, pcr_transform,
 								this->measurement_time, measurement);
 	evid->set_pcr_info(evid, pcr_before, pcr_after);
 
-	return (this->extended_pcr == PCR_TBOOT_MLE) ? SUCCESS : NEED_MORE;
+	return (this->seq_no < TBOOT_SEQUENCE) ? NEED_MORE : SUCCESS;
 }
 
 METHOD(pts_component_t, verify, status_t,
@@ -149,14 +152,12 @@ METHOD(pts_component_t, verify, status_t,
 	pts_comp_evidence_t *evidence)
 {
 	bool has_pcr_info;
+	char *platform_info;
 	u_int32_t extended_pcr;
 	pts_meas_algorithms_t algo;
 	pts_pcr_transform_t transform;
 	time_t measurement_time;
 	chunk_t measurement, pcr_before, pcr_after, hash;
-	enumerator_t *enumerator;
-	char *file, *platform_info;
-	status_t status = NOT_FOUND;
 
 	platform_info = pts->get_platform_info(pts);
 	if (!pts_db || !platform_info)
@@ -167,58 +168,12 @@ METHOD(pts_component_t, verify, status_t,
 					  (platform_info) ? "" : "platform info");
 		return FAILED;
 	}
-
-	switch (this->extended_pcr)
-	{
-		case 0:
-			this->extended_pcr = PCR_TBOOT_POLICY;
-			file = "pcr17";
-			break;
-		case PCR_TBOOT_POLICY:
-			this->extended_pcr = PCR_TBOOT_MLE;
-			file = "pcr18";
-			break;
-		default:
-			return FAILED;
-	}
-
 	measurement = evidence->get_measurement(evidence, &extended_pcr,
-											&algo, &transform, &measurement_time);
-	if (extended_pcr != this->extended_pcr)
-	{
-		DBG1(DBG_PTS, "expected PCR %2d but received measurement for PCR %2d",
-					   this->extended_pcr, extended_pcr);
-		return FAILED;
-	}
-	
-	/* check measurement in database */
-	enumerator = pts_db->create_comp_hash_enumerator(pts_db, file,
-								platform_info, this->name, TRUSTED_HASH_ALGO);
-	while (enumerator->enumerate(enumerator, &hash))
-	{
-		if (chunk_equals(hash, measurement))
-		{
-			DBG2(DBG_PTS, "PCR %2d matching TBOOT component measurement "
-						  "found in database", this->extended_pcr);
-			status = SUCCESS;
-			break;
-		}
-		else
-		{
-			DBG1(DBG_PTS, "PCR %2d no matching TBOOT component measurement "
-						  "found in database", this->extended_pcr);
-			DBG1(DBG_PTS, "  expected: %#B", &hash);
-			DBG1(DBG_PTS, "  received: %#B", &measurement);
-			status = FAILED;
-			break;
-		}
-	}
-	enumerator->destroy(enumerator);
+								&algo, &transform, &measurement_time);
 
-	if (status == NOT_FOUND)
+	if (pts_db->check_comp_measurement(pts_db, measurement, this->name,
+			platform_info,	++this->seq_no, extended_pcr, algo) != SUCCESS)
 	{
-		DBG1(DBG_PTS, "PCR %2d no measurement found in database",
-					   this->extended_pcr);
 		return FAILED;
 	}
 
@@ -231,7 +186,7 @@ METHOD(pts_component_t, verify, status_t,
 		}
 	}
 
-	return (this->extended_pcr == PCR_TBOOT_MLE) ? SUCCESS : NEED_MORE;
+	return (this->seq_no < TBOOT_SEQUENCE) ? NEED_MORE : SUCCESS;
 }
 
 METHOD(pts_component_t, destroy, void,

src/libpts/pts/pts.c

@@ -626,7 +626,7 @@ static bool file_metadata(char *pathname, pts_file_metadata_t **entry)
 
 	if (stat(pathname, &st))
 	{
-		DBG1(DBG_PTS, "Unable to obtain statistics about '%s'", pathname);
+		DBG1(DBG_PTS, "unable to obtain statistics about '%s'", pathname);
 		return FALSE;
 	}
 

src/libpts/pts/pts_database.c

@@ -80,7 +80,7 @@ METHOD(pts_database_t, create_comp_evid_enumerator, enumerator_t*,
  				"FROM components AS c "
 				"JOIN product_component AS pc ON c.id = pc.component "
 				"JOIN products AS p ON p.id = pc.product "
-				"WHERE p.name = ? ORDER BY pc.sequence",
+				"WHERE p.name = ? ORDER BY pc.seq_no",
 				DB_TEXT, product, DB_INT, DB_INT, DB_INT, DB_INT);
 	return e;
 }
@@ -114,26 +114,60 @@ METHOD(pts_database_t, create_file_hash_enumerator, enumerator_t*,
 	return e;
 }
 
-METHOD(pts_database_t, create_comp_hash_enumerator, enumerator_t*,
-	private_pts_database_t *this, char *file, char *product,
-	pts_comp_func_name_t *comp_name, pts_meas_algorithms_t algo)
+METHOD(pts_database_t, check_comp_measurement, status_t,
+	private_pts_database_t *this, chunk_t measurement,
+	pts_comp_func_name_t *comp_name,  char *product,
+	int seq_no, int pcr, pts_meas_algorithms_t algo)
 {
 	enumerator_t *e;
+	chunk_t hash;
+	status_t status = NOT_FOUND;
 	
 	e = this->db->query(this->db,
-				"SELECT fh.hash FROM file_hashes AS fh "
-				"JOIN files AS f ON fh.file = f.id "
-				"JOIN products AS p ON fh.product = p.id "
-				"JOIN components AS c ON fh.component = c.id "
-				"WHERE f.path = ? AND p.name = ? AND c.vendor_id = ? "
-				"AND c.name = ? AND c.qualifier = ? AND fh.algo = ? ",
-				DB_TEXT, file, DB_TEXT, product,
-				DB_INT, comp_name->get_vendor_id(comp_name),
-				DB_INT, comp_name->get_name(comp_name),
-				DB_INT, comp_name->get_qualifier(comp_name),
-				DB_INT, algo, DB_BLOB);
+			"SELECT ch.hash FROM component_hashes AS ch "
+			"JOIN products AS p ON ch.product = p.id "
+			"JOIN components AS c ON ch.component = c.id "
+			"WHERE c.vendor_id = ?  AND c.name = ? AND c.qualifier = ? "
+			"AND p.name = ? AND ch.seq_no = ? AND ch.pcr = ? AND ch.algo = ? ",
+			DB_INT, comp_name->get_vendor_id(comp_name),
+			DB_INT, comp_name->get_name(comp_name),
+			DB_INT, comp_name->get_qualifier(comp_name),
+			DB_TEXT, product, DB_INT, seq_no, DB_INT, pcr, DB_INT, algo,
+			DB_BLOB);
+	if (!e)
+	{
+		DBG1(DBG_PTS, "no database query enumerator returned"); 
+		return FAILED;
+	}
 
-	return e;
+	while (e->enumerate(e, &hash))
+	{
+		if (chunk_equals(hash, measurement))
+		{
+			DBG2(DBG_PTS, "PCR %2d matching component measurement #%d "
+						  "found in database", pcr, seq_no);
+			status = SUCCESS;
+			break;
+		}
+		else
+		{
+			DBG1(DBG_PTS, "PCR %2d no matching component measurement #%d "
+						  "found in database", pcr, seq_no);
+			DBG1(DBG_PTS, "  expected: %#B", &hash);
+			DBG1(DBG_PTS, "  received: %#B", &measurement);
+			status = FAILED;
+			break;
+		}
+	}
+	e->destroy(e);
+
+	if (status == NOT_FOUND)
+	{
+		DBG1(DBG_PTS, "PCR %2d no measurement #%d "
+					  "found in database", pcr, seq_no);
+	}
+
+	return status;
 }
 
 METHOD(pts_database_t, destroy, void,
@@ -156,7 +190,7 @@ pts_database_t *pts_database_create(char *uri)
 			.create_file_meta_enumerator = _create_file_meta_enumerator,
 			.create_comp_evid_enumerator = _create_comp_evid_enumerator,
 			.create_file_hash_enumerator = _create_file_hash_enumerator,
-			.create_comp_hash_enumerator = _create_comp_hash_enumerator,
+			.check_comp_measurement = _check_comp_measurement,
 			.destroy = _destroy,
 		},
 		.db = lib->db->create(lib->db, uri),

src/libpts/pts/pts_database.h

@@ -36,8 +36,8 @@ struct pts_database_t {
 	/**
 	* Get files/directories to be measured by PTS
 	*
-	* @param product		software product (os, vpn client, etc.)
-	* @return				enumerator over all matching files/directories
+	* @param product		Software product (os, vpn client, etc.)
+	* @return				Enumerator over all matching files/directories
 	*/
 	enumerator_t* (*create_file_meas_enumerator)(pts_database_t *this,
 												 char *product);
@@ -45,8 +45,8 @@ struct pts_database_t {
 	/**
 	* Get files/directories to request metadata of
 	*
-	* @param product		software product (os, vpn client, etc.)
-	* @return				enumerator over all matching files/directories
+	* @param product		Software product (os, vpn client, etc.)
+	* @return				Enumerator over all matching files/directories
 	*/
 	enumerator_t* (*create_file_meta_enumerator)(pts_database_t *this,
 												 char *product);
@@ -54,8 +54,8 @@ struct pts_database_t {
 	/**
 	* Get functional components to request evidence of
 	*
-	* @param product		software product (os, vpn client, etc.)
-	* @return				enumerator over all matching components
+	* @param product		Software product (os, vpn client, etc.)
+	* @return				Enumerator over all matching components
 	*/
 	enumerator_t* (*create_comp_evid_enumerator)(pts_database_t *this,
 												 char *product);
@@ -63,29 +63,30 @@ struct pts_database_t {
 	/**
 	* Get stored measurement hash for single file or directory entries
 	*
-	* @param product		software product (os, vpn client, etc.)
-	* @param algo			hash algorithm used for measurement
-	* @param id				primary key of measured file/directory
+	* @param product		Software product (os, vpn client, etc.)
+	* @param algo			Hash algorithm used for measurement
+	* @param id				Primary key of measured file/directory
 	* @param is_dir			TRUE if directory was measured
-	* @return				enumerator over all matching measurement hashes
+	* @return				Enumerator over all matching measurement hashes
 	*/
 	enumerator_t* (*create_file_hash_enumerator)(pts_database_t *this,
 								char *product, pts_meas_algorithms_t algo,
 								int id, bool is_dir);
 
 	/**
-	* Get stored measurement hash for functional component entries
+	* Check a functional component measurement against value stored in database
 	*
-	* @param file			file path in files table
-	* @param product		software product (os, vpn client, etc.)
-	* @param algo			hash algorithm used for measurement
-	* @param comp_name		functional component name object
-	* @return				enumerator over all matching measurement hashes
+	* @param measurement	measurement hash
+	* @param comp_name		Component Functional Name
+	* @param product		Software product (os, vpn client, etc.)
+	* @param seq_no			Measurement sequence number
+	* @param prc			Number of the PCR the measurement was extended into
+	* @param algo			Hash algorithm used for measurement
+	* @return				return code
 	*/
-	enumerator_t* (*create_comp_hash_enumerator)(pts_database_t *this,
-						char *file, char *product,
-						pts_comp_func_name_t *comp_name,
-						pts_meas_algorithms_t algo);
+	status_t (*check_comp_measurement)(pts_database_t *this, chunk_t measurement,
+							pts_comp_func_name_t *comp_name, char *product,
+							int seq_no, int pcr, pts_meas_algorithms_t algo);
 
 	/**
 	* Destroys a pts_database_t object.