denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fixed memory leaks

Browse Source
This commit is contained in:
Sansar Choinyambuu
2011-11-28 14:34:20 +01:00
committed by Andreas Steffen
parent 2f229f10b1
commit 97ebeaa45c
4 changed files with 112 additions and 107 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libimcv/plugins/imc_attestation/imc_attestation.c
+33 -30
View File
@@ -72,7 +72,7 @@ static pts_dh_group_t supported_dh_groups = 0;
* High Entropy Random Data * High Entropy Random Data
* used in calculation of shared secret for the assessment session * used in calculation of shared secret for the assessment session
*/ */
static chunk_t responder_nonce; static char *responder_nonce = NULL;
/** /**
* see section 3.7.1 of TCG TNC IF-IMC Specification 1.2 * see section 3.7.1 of TCG TNC IF-IMC Specification 1.2
@@ -82,6 +82,8 @@ TNC_Result TNC_IMC_Initialize(TNC_IMCID imc_id,
TNC_Version max_version, TNC_Version max_version,
TNC_Version *actual_version) TNC_Version *actual_version)
{ {
rng_t *rng;
if (imc_attestation) if (imc_attestation)
{ {
DBG1(DBG_IMC, "IMC \"%s\" has already been initialized", imc_name); DBG1(DBG_IMC, "IMC \"%s\" has already been initialized", imc_name);
@@ -104,6 +106,15 @@ TNC_Result TNC_IMC_Initialize(TNC_IMCID imc_id,
libpts_init(); libpts_init();
/* create a responder nonce */
responder_nonce = (char*)malloc(NONCE_LEN);
rng = lib->crypto->create_rng(lib->crypto, RNG_WEAK);
if (rng)
{
rng->get_bytes(rng, NONCE_LEN, responder_nonce);
rng->destroy(rng);
}
if (min_version > TNC_IFIMC_VERSION_1 || max_version < TNC_IFIMC_VERSION_1) if (min_version > TNC_IFIMC_VERSION_1 || max_version < TNC_IFIMC_VERSION_1)
{ {
DBG1(DBG_IMC, "no common IF-IMC version"); DBG1(DBG_IMC, "no common IF-IMC version");
@@ -296,10 +307,8 @@ TNC_Result TNC_IMC_ReceiveMessage(TNC_IMCID imc_id,
tcg_pts_attr_dh_nonce_params_req_t *attr_cast; tcg_pts_attr_dh_nonce_params_req_t *attr_cast;
u_int8_t min_nonce_len; u_int8_t min_nonce_len;
pts_dh_group_t offered_dh_groups, selected_dh_group; pts_dh_group_t offered_dh_groups, selected_dh_group;
rng_t *rng;
chunk_t responder_pub_val; chunk_t responder_pub_val;
char buf[NONCE_LEN];
attr_cast = (tcg_pts_attr_dh_nonce_params_req_t*)attr; attr_cast = (tcg_pts_attr_dh_nonce_params_req_t*)attr;
min_nonce_len = attr_cast->get_min_nonce_len(attr_cast); min_nonce_len = attr_cast->get_min_nonce_len(attr_cast);
if (NONCE_LEN < min_nonce_len || NONCE_LEN <= 16) if (NONCE_LEN < min_nonce_len || NONCE_LEN <= 16)
@@ -310,7 +319,7 @@ TNC_Result TNC_IMC_ReceiveMessage(TNC_IMCID imc_id,
attr_list->insert_last(attr_list, attr); attr_list->insert_last(attr_list, attr);
break; break;
} }
offered_dh_groups = attr_cast->get_dh_groups(attr_cast); offered_dh_groups = attr_cast->get_dh_groups(attr_cast);
if ((supported_dh_groups & PTS_DH_GROUP_IKE20) && if ((supported_dh_groups & PTS_DH_GROUP_IKE20) &&
@@ -354,19 +363,11 @@ TNC_Result TNC_IMC_ReceiveMessage(TNC_IMCID imc_id,
return TNC_RESULT_FATAL; return TNC_RESULT_FATAL;
} }
responder_pub_val = pts->get_my_pub_val(pts); responder_pub_val = pts->get_my_pub_val(pts);
/* create a responder nonce */
rng = lib->crypto->create_rng(lib->crypto, RNG_WEAK);
if (rng)
{
rng->get_bytes(rng, sizeof(buf), buf);
rng->destroy(rng);
}
responder_nonce = chunk_create(buf, sizeof(buf));
attr = tcg_pts_attr_dh_nonce_params_resp_create(NONCE_LEN, attr = tcg_pts_attr_dh_nonce_params_resp_create(NONCE_LEN,
selected_dh_group, supported_algorithms, selected_dh_group, supported_algorithms,
responder_nonce, responder_pub_val); chunk_create(responder_nonce, NONCE_LEN),
responder_pub_val);
attr_list->insert_last(attr_list, attr); attr_list->insert_last(attr_list, attr);
break; break;
} }
@@ -375,7 +376,7 @@ TNC_Result TNC_IMC_ReceiveMessage(TNC_IMCID imc_id,
tcg_pts_attr_dh_nonce_finish_t *attr_cast; tcg_pts_attr_dh_nonce_finish_t *attr_cast;
u_int8_t nonce_len; u_int8_t nonce_len;
pts_meas_algorithms_t selected_algorithm; pts_meas_algorithms_t selected_algorithm;
chunk_t initiator_nonce, initiator_pub_val; chunk_t initiator_nonce, initiator_pub_val, responder_non;
attr_cast = (tcg_pts_attr_dh_nonce_finish_t*)attr; attr_cast = (tcg_pts_attr_dh_nonce_finish_t*)attr;
nonce_len = attr_cast->get_nonce_len(attr_cast); nonce_len = attr_cast->get_nonce_len(attr_cast);
@@ -391,16 +392,18 @@ TNC_Result TNC_IMC_ReceiveMessage(TNC_IMCID imc_id,
selected_algorithm = attr_cast->get_hash_algo(attr_cast); selected_algorithm = attr_cast->get_hash_algo(attr_cast);
initiator_pub_val = attr_cast->get_initiator_pub_val(attr_cast); initiator_pub_val = attr_cast->get_initiator_pub_val(attr_cast);
initiator_nonce = attr_cast->get_initiator_nonce(attr_cast); initiator_nonce = attr_cast->get_initiator_nonce(attr_cast);
responder_non = chunk_create(responder_nonce, NONCE_LEN);
DBG3(DBG_IMC, "Initiator nonce: %B", &initiator_nonce); DBG3(DBG_IMC, "Initiator nonce: %B", &initiator_nonce);
DBG3(DBG_IMC, "Responder nonce: %B", &responder_nonce); DBG3(DBG_IMC, "Responder nonce: %B", &responder_non);
pts->set_other_pub_val(pts, initiator_pub_val); pts->set_other_pub_val(pts, initiator_pub_val);
if (!pts->calculate_secret(pts, initiator_nonce, if (!pts->calculate_secret(pts, initiator_nonce,
responder_nonce, selected_algorithm)) responder_non, selected_algorithm))
{ {
return TNC_RESULT_FATAL; return TNC_RESULT_FATAL;
} }
break; break;
} }
case TCG_PTS_MEAS_ALGO: case TCG_PTS_MEAS_ALGO:
@@ -489,7 +492,7 @@ TNC_Result TNC_IMC_ReceiveMessage(TNC_IMCID imc_id,
u_int8_t family; u_int8_t family;
pts_qualifier_t qualifier; pts_qualifier_t qualifier;
pts_funct_comp_name_t name; pts_funct_comp_name_t name;
attr_info = attr->get_value(attr); attr_info = attr->get_value(attr);
attr_cast = (tcg_pts_attr_req_funct_comp_evid_t*)attr; attr_cast = (tcg_pts_attr_req_funct_comp_evid_t*)attr;
negotiated_caps = pts->get_proto_caps(pts); negotiated_caps = pts->get_proto_caps(pts);
@@ -535,7 +538,7 @@ TNC_Result TNC_IMC_ReceiveMessage(TNC_IMCID imc_id,
"sub component measurement deeper than 1. " "sub component measurement deeper than 1. "
"Measuring top level component only."); "Measuring top level component only.");
} }
comp_name_vendor_id = attr_cast->get_comp_funct_name_vendor_id(attr_cast); comp_name_vendor_id = attr_cast->get_comp_funct_name_vendor_id(attr_cast);
if (comp_name_vendor_id != PEN_TCG) if (comp_name_vendor_id != PEN_TCG)
{ {
@@ -543,7 +546,7 @@ TNC_Result TNC_IMC_ReceiveMessage(TNC_IMCID imc_id,
"only functional component namings by TCG "); "only functional component namings by TCG ");
break; break;
} }
family = attr_cast->get_family(attr_cast); family = attr_cast->get_family(attr_cast);
if (family) if (family)
{ {
@@ -571,7 +574,7 @@ TNC_Result TNC_IMC_ReceiveMessage(TNC_IMCID imc_id,
{ {
/* TODO: Implement what todo with received qualifier */ /* TODO: Implement what todo with received qualifier */
} }
name = attr_cast->get_comp_funct_name(attr_cast); name = attr_cast->get_comp_funct_name(attr_cast);
switch (name) switch (name)
{ {
@@ -593,14 +596,14 @@ TNC_Result TNC_IMC_ReceiveMessage(TNC_IMCID imc_id,
break; break;
} }
} }
break; break;
} }
case TCG_PTS_GEN_ATTEST_EVID: case TCG_PTS_GEN_ATTEST_EVID:
{ {
pts_simple_evid_final_flag_t flags; pts_simple_evid_final_flag_t flags;
/* TODO: TPM quote operation over included PCR's */ /* TODO: TPM quote operation over included PCR's */
/* Send Simple Evidence Final attribute */ /* Send Simple Evidence Final attribute */
flags = PTS_SIMPLE_EVID_FINAL_FLAG_NO; flags = PTS_SIMPLE_EVID_FINAL_FLAG_NO;
attr = tcg_pts_attr_simple_evid_final_create(flags, 0, attr = tcg_pts_attr_simple_evid_final_create(flags, 0,
@@ -646,7 +649,7 @@ TNC_Result TNC_IMC_ReceiveMessage(TNC_IMCID imc_id,
is_directory ? "directory" : "file", is_directory ? "directory" : "file",
pathname); pathname);
metadata = pts->get_metadata(pts, pathname, is_directory); metadata = pts->get_metadata(pts, pathname, is_directory);
if (!metadata) if (!metadata)
{ {
/* TODO handle error codes from measurements */ /* TODO handle error codes from measurements */
@@ -655,7 +658,7 @@ TNC_Result TNC_IMC_ReceiveMessage(TNC_IMCID imc_id,
attr = tcg_pts_attr_unix_file_meta_create(metadata); attr = tcg_pts_attr_unix_file_meta_create(metadata);
attr->set_noskip_flag(attr, TRUE); attr->set_noskip_flag(attr, TRUE);
attr_list->insert_last(attr_list, attr); attr_list->insert_last(attr_list, attr);
break; break;
} }
case TCG_PTS_REQ_FILE_MEAS: case TCG_PTS_REQ_FILE_MEAS:
@@ -674,7 +677,7 @@ TNC_Result TNC_IMC_ReceiveMessage(TNC_IMCID imc_id,
delimiter = attr_cast->get_delimiter(attr_cast); delimiter = attr_cast->get_delimiter(attr_cast);
pathname = attr_cast->get_pathname(attr_cast); pathname = attr_cast->get_pathname(attr_cast);
valid_path = pts->is_path_valid(pts, pathname, &pts_error); valid_path = pts->is_path_valid(pts, pathname, &pts_error);
if (valid_path && pts_error) if (valid_path && pts_error)
{ {
attr_info = attr->get_value(attr); attr_info = attr->get_value(attr);
@@ -792,7 +795,7 @@ TNC_Result TNC_IMC_Terminate(TNC_IMCID imc_id)
return TNC_RESULT_NOT_INITIALIZED; return TNC_RESULT_NOT_INITIALIZED;
} }
free(responder_nonce.ptr); free(responder_nonce);
libpts_deinit(); libpts_deinit();
imc_attestation->destroy(imc_attestation); imc_attestation->destroy(imc_attestation);
src/libimcv/plugins/imv_attestation/imv_attestation.c
+65 -63
View File
@@ -76,7 +76,7 @@ static pts_dh_group_t supported_dh_groups = 0;
* High Entropy Random Data * High Entropy Random Data
* used in calculation of shared secret for the assessment session * used in calculation of shared secret for the assessment session
*/ */
static chunk_t initiator_nonce; static char *initiator_nonce = NULL;
/** /**
* PTS file measurement database * PTS file measurement database
@@ -107,6 +107,7 @@ TNC_Result TNC_IMV_Initialize(TNC_IMVID imv_id,
TNC_Version *actual_version) TNC_Version *actual_version)
{ {
char *hash_alg, *dh_group, *uri, *cadir; char *hash_alg, *dh_group, *uri, *cadir;
rng_t *rng;
if (imv_attestation) if (imv_attestation)
{ {
@@ -129,6 +130,15 @@ TNC_Result TNC_IMV_Initialize(TNC_IMVID imv_id,
} }
libpts_init(); libpts_init();
/* Create a initiator nonce */
initiator_nonce = (char*)malloc(NONCE_LEN);
rng = lib->crypto->create_rng(lib->crypto, RNG_WEAK);
if (rng)
{
rng->get_bytes(rng, NONCE_LEN, initiator_nonce);
rng->destroy(rng);
}
if (min_version > TNC_IFIMV_VERSION_1 || max_version < TNC_IFIMV_VERSION_1) if (min_version > TNC_IFIMV_VERSION_1 || max_version < TNC_IFIMV_VERSION_1)
{ {
@@ -227,9 +237,9 @@ TNC_Result TNC_IMV_NotifyConnectionChange(TNC_IMVID imv_id,
return result; return result;
} }
attestation_state = (imv_attestation_state_t*)state; attestation_state = (imv_attestation_state_t*)state;
/* TODO: Get some configurations */ /* TODO: Get some configurations */
return TNC_RESULT_SUCCESS; return TNC_RESULT_SUCCESS;
default: default:
return imv_attestation->change_state(imv_attestation, connection_id, return imv_attestation->change_state(imv_attestation, connection_id,
@@ -246,7 +256,7 @@ static TNC_Result send_message(TNC_ConnectionID connection_id)
imv_attestation_state_t *attestation_state; imv_attestation_state_t *attestation_state;
imv_attestation_handshake_state_t handshake_state; imv_attestation_handshake_state_t handshake_state;
TNC_Result result; TNC_Result result;
if (!imv_attestation->get_state(imv_attestation, connection_id, &state)) if (!imv_attestation->get_state(imv_attestation, connection_id, &state))
{ {
return TNC_RESULT_FATAL; return TNC_RESULT_FATAL;
@@ -254,10 +264,18 @@ static TNC_Result send_message(TNC_ConnectionID connection_id)
attestation_state = (imv_attestation_state_t*)state; attestation_state = (imv_attestation_state_t*)state;
handshake_state = attestation_state->get_handshake_state(attestation_state); handshake_state = attestation_state->get_handshake_state(attestation_state);
pts = attestation_state->get_pts(attestation_state); pts = attestation_state->get_pts(attestation_state);
msg = pa_tnc_msg_create(); msg = pa_tnc_msg_create();
switch_state: /* Jump to Measurement state if IMC has no TPM */
if (handshake_state == IMV_ATTESTATION_STATE_TPM_INIT &&
!(pts->get_proto_caps(pts) & PTS_PROTO_CAPS_T))
{
handshake_state = IMV_ATTESTATION_STATE_MEAS;
DBG3(DBG_IMV, "TPM is not available on IMC side, ",
"jumping to measurement phase");
}
/* Switch on the attribute type IMV has received */ /* Switch on the attribute type IMV has received */
switch (handshake_state) switch (handshake_state)
{ {
@@ -270,7 +288,7 @@ static TNC_Result send_message(TNC_ConnectionID connection_id)
attr = tcg_pts_attr_proto_caps_create(flags, TRUE); attr = tcg_pts_attr_proto_caps_create(flags, TRUE);
attr->set_noskip_flag(attr, TRUE); attr->set_noskip_flag(attr, TRUE);
msg->add_attribute(msg, attr); msg->add_attribute(msg, attr);
/* Send Measurement Algorithms attribute */ /* Send Measurement Algorithms attribute */
attr = tcg_pts_attr_meas_algo_create(supported_algorithms, FALSE); attr = tcg_pts_attr_meas_algo_create(supported_algorithms, FALSE);
attr->set_noskip_flag(attr, TRUE); attr->set_noskip_flag(attr, TRUE);
@@ -282,15 +300,6 @@ static TNC_Result send_message(TNC_ConnectionID connection_id)
} }
case IMV_ATTESTATION_STATE_TPM_INIT: case IMV_ATTESTATION_STATE_TPM_INIT:
{ {
/* Jump to Measurement state if IMC has no TPM */
if(!(pts->get_proto_caps(pts) & PTS_PROTO_CAPS_T))
{
handshake_state = IMV_ATTESTATION_STATE_MEAS;
DBG3(DBG_IMV, "TPM is not available on IMC side, ",
"jumping to measurement phase");
goto switch_state;
}
if (!dh_nonce_req_sent) if (!dh_nonce_req_sent)
{ {
/* Send DH nonce parameters request attribute */ /* Send DH nonce parameters request attribute */
@@ -308,7 +317,8 @@ static TNC_Result send_message(TNC_ConnectionID connection_id)
selected_algorithm = pts->get_meas_algorithm(pts); selected_algorithm = pts->get_meas_algorithm(pts);
initiator_pub_val = pts->get_my_pub_val(pts); initiator_pub_val = pts->get_my_pub_val(pts);
attr = tcg_pts_attr_dh_nonce_finish_create(NONCE_LEN, attr = tcg_pts_attr_dh_nonce_finish_create(NONCE_LEN,
selected_algorithm, initiator_nonce, selected_algorithm,
chunk_create(initiator_nonce, NONCE_LEN),
initiator_pub_val); initiator_pub_val);
attr->set_noskip_flag(attr, TRUE); attr->set_noskip_flag(attr, TRUE);
msg->add_attribute(msg, attr); msg->add_attribute(msg, attr);
@@ -331,7 +341,7 @@ static TNC_Result send_message(TNC_ConnectionID connection_id)
} }
case IMV_ATTESTATION_STATE_MEAS: case IMV_ATTESTATION_STATE_MEAS:
{ {
enumerator_t *enumerator; enumerator_t *enumerator;
u_int32_t delimiter = SOLIDUS_UTF; u_int32_t delimiter = SOLIDUS_UTF;
char *platform_info, *pathname; char *platform_info, *pathname;
@@ -387,7 +397,7 @@ static TNC_Result send_message(TNC_ConnectionID connection_id)
u_int32_t sub_comp_depth; u_int32_t sub_comp_depth;
pts_qualifier_t qualifier; pts_qualifier_t qualifier;
pts_funct_comp_name_t name; pts_funct_comp_name_t name;
attestation_state->set_handshake_state(attestation_state, attestation_state->set_handshake_state(attestation_state,
IMV_ATTESTATION_STATE_END); IMV_ATTESTATION_STATE_END);
@@ -397,7 +407,7 @@ static TNC_Result send_message(TNC_ConnectionID connection_id)
qualifier.sub_component = FALSE; qualifier.sub_component = FALSE;
qualifier.type = PTS_FUNC_COMP_TYPE_ALL; qualifier.type = PTS_FUNC_COMP_TYPE_ALL;
name = PTS_FUNC_COMP_NAME_BIOS; name = PTS_FUNC_COMP_NAME_BIOS;
/* Send Request Functional Component Evidence attribute */ /* Send Request Functional Component Evidence attribute */
attr = tcg_pts_attr_req_funct_comp_evid_create(flags, sub_comp_depth, attr = tcg_pts_attr_req_funct_comp_evid_create(flags, sub_comp_depth,
PEN_TCG, qualifier, name); PEN_TCG, qualifier, name);
@@ -407,7 +417,7 @@ static TNC_Result send_message(TNC_ConnectionID connection_id)
attr = tcg_pts_attr_gen_attest_evid_create(); attr = tcg_pts_attr_gen_attest_evid_create();
attr->set_noskip_flag(attr, TRUE); attr->set_noskip_flag(attr, TRUE);
msg->add_attribute(msg, attr); msg->add_attribute(msg, attr);
break; break;
} }
default: default:
@@ -415,12 +425,12 @@ static TNC_Result send_message(TNC_ConnectionID connection_id)
handshake_state); handshake_state);
return TNC_RESULT_FATAL; return TNC_RESULT_FATAL;
} }
msg->build(msg); msg->build(msg);
result = imv_attestation->send_message(imv_attestation, connection_id, result = imv_attestation->send_message(imv_attestation, connection_id,
msg->get_encoding(msg)); msg->get_encoding(msg));
msg->destroy(msg); msg->destroy(msg);
return result; return result;
} }
@@ -527,7 +537,7 @@ TNC_Result TNC_IMV_ReceiveMessage(TNC_IMVID imv_id,
attr_cast = (ietf_attr_product_info_t*)attr; attr_cast = (ietf_attr_product_info_t*)attr;
platform_info = attr_cast->get_info(attr_cast, NULL, NULL); platform_info = attr_cast->get_info(attr_cast, NULL, NULL);
pts->set_platform_info(pts, platform_info); pts->set_platform_info(pts, platform_info);
} }
} }
else if (attr->get_vendor_id(attr) == PEN_TCG) else if (attr->get_vendor_id(attr) == PEN_TCG)
@@ -538,7 +548,7 @@ TNC_Result TNC_IMV_ReceiveMessage(TNC_IMVID imv_id,
{ {
tcg_pts_attr_proto_caps_t *attr_cast; tcg_pts_attr_proto_caps_t *attr_cast;
pts_proto_caps_flag_t flags; pts_proto_caps_flag_t flags;
attr_cast = (tcg_pts_attr_proto_caps_t*)attr; attr_cast = (tcg_pts_attr_proto_caps_t*)attr;
flags = attr_cast->get_flags(attr_cast); flags = attr_cast->get_flags(attr_cast);
pts->set_proto_caps(pts, flags); pts->set_proto_caps(pts, flags);
@@ -548,7 +558,7 @@ TNC_Result TNC_IMV_ReceiveMessage(TNC_IMVID imv_id,
{ {
tcg_pts_attr_meas_algo_t *attr_cast; tcg_pts_attr_meas_algo_t *attr_cast;
pts_meas_algorithms_t selected_algorithm; pts_meas_algorithms_t selected_algorithm;
attr_cast = (tcg_pts_attr_meas_algo_t*)attr; attr_cast = (tcg_pts_attr_meas_algo_t*)attr;
selected_algorithm = attr_cast->get_algorithms(attr_cast); selected_algorithm = attr_cast->get_algorithms(attr_cast);
pts->set_meas_algorithm(pts, selected_algorithm); pts->set_meas_algorithm(pts, selected_algorithm);
@@ -560,13 +570,10 @@ TNC_Result TNC_IMV_ReceiveMessage(TNC_IMVID imv_id,
u_int8_t nonce_len; u_int8_t nonce_len;
pts_dh_group_t dh_group; pts_dh_group_t dh_group;
pts_meas_algorithms_t offered_algorithms, selected_algorithm; pts_meas_algorithms_t offered_algorithms, selected_algorithm;
chunk_t responder_nonce; chunk_t responder_nonce, initiator_non, responder_pub_val;
chunk_t responder_pub_val;
rng_t *rng;
char buf[NONCE_LEN];
attr_cast = (tcg_pts_attr_dh_nonce_params_resp_t*)attr; attr_cast = (tcg_pts_attr_dh_nonce_params_resp_t*)attr;
nonce_len = attr_cast->get_nonce_len(attr_cast); nonce_len = attr_cast->get_nonce_len(attr_cast);
if (nonce_len < 0 || nonce_len <= 16) if (nonce_len < 0 || nonce_len <= 16)
{ {
@@ -576,9 +583,9 @@ TNC_Result TNC_IMV_ReceiveMessage(TNC_IMVID imv_id,
attr_list->insert_last(attr_list, attr); attr_list->insert_last(attr_list, attr);
break; break;
} }
dh_group = attr_cast->get_dh_group(attr_cast); dh_group = attr_cast->get_dh_group(attr_cast);
offered_algorithms = attr_cast->get_hash_algo_set(attr_cast); offered_algorithms = attr_cast->get_hash_algo_set(attr_cast);
if ((supported_algorithms & PTS_MEAS_ALGO_SHA384) && if ((supported_algorithms & PTS_MEAS_ALGO_SHA384) &&
(offered_algorithms & PTS_MEAS_ALGO_SHA384)) (offered_algorithms & PTS_MEAS_ALGO_SHA384))
@@ -606,27 +613,19 @@ TNC_Result TNC_IMV_ReceiveMessage(TNC_IMVID imv_id,
selected_algorithm = pts->get_meas_algorithm(pts); selected_algorithm = pts->get_meas_algorithm(pts);
responder_nonce = attr_cast->get_responder_nonce(attr_cast); responder_nonce = attr_cast->get_responder_nonce(attr_cast);
responder_pub_val = attr_cast->get_responder_pub_val(attr_cast); responder_pub_val = attr_cast->get_responder_pub_val(attr_cast);
initiator_non = chunk_create(initiator_nonce, NONCE_LEN);
/* Calculate secret assessment value */ /* Calculate secret assessment value */
if (!pts->create_dh(pts, dh_group)) if (!pts->create_dh(pts, dh_group))
{ {
return TNC_RESULT_FATAL; return TNC_RESULT_FATAL;
} }
pts->set_other_pub_val(pts, responder_pub_val); pts->set_other_pub_val(pts, responder_pub_val);
/* Create a initiator nonce */ DBG3(DBG_IMV, "Initiator nonce: %B", &initiator_non);
rng = lib->crypto->create_rng(lib->crypto, RNG_WEAK);
if (rng)
{
rng->get_bytes(rng, sizeof(buf), buf);
rng->destroy(rng);
}
initiator_nonce = chunk_create(buf, sizeof(buf));
DBG3(DBG_IMV, "Initiator nonce: %B", &initiator_nonce);
DBG3(DBG_IMV, "Responder nonce: %B", &responder_nonce); DBG3(DBG_IMV, "Responder nonce: %B", &responder_nonce);
if (!pts->calculate_secret(pts, initiator_nonce, if (!pts->calculate_secret(pts, initiator_non,
responder_nonce, selected_algorithm)) responder_nonce, selected_algorithm))
{ {
return TNC_RESULT_FATAL; return TNC_RESULT_FATAL;
} }
@@ -636,7 +635,7 @@ TNC_Result TNC_IMV_ReceiveMessage(TNC_IMVID imv_id,
{ {
tcg_pts_attr_tpm_version_info_t *attr_cast; tcg_pts_attr_tpm_version_info_t *attr_cast;
chunk_t tpm_version_info; chunk_t tpm_version_info;
attr_cast = (tcg_pts_attr_tpm_version_info_t*)attr; attr_cast = (tcg_pts_attr_tpm_version_info_t*)attr;
tpm_version_info = attr_cast->get_tpm_version_info(attr_cast); tpm_version_info = attr_cast->get_tpm_version_info(attr_cast);
pts->set_tpm_version_info(pts, tpm_version_info); pts->set_tpm_version_info(pts, tpm_version_info);
@@ -676,24 +675,24 @@ TNC_Result TNC_IMV_ReceiveMessage(TNC_IMVID imv_id,
pts->set_aik(pts, aik); pts->set_aik(pts, aik);
break; break;
} }
/* PTS-based Attestation Evidence */ /* PTS-based Attestation Evidence */
case TCG_PTS_SIMPLE_COMP_EVID: case TCG_PTS_SIMPLE_COMP_EVID:
{ {
/** TODO: Implement saving the PCR number, Hash Algo = communicated one, /** TODO: Implement saving the PCR number, Hash Algo = communicated one,
* PCR transform (truncate SHA256, SHA384), PCR before and after values * PCR transform (truncate SHA256, SHA384), PCR before and after values
*/ */
break; break;
} }
case TCG_PTS_SIMPLE_EVID_FINAL: case TCG_PTS_SIMPLE_EVID_FINAL:
{ {
/** TODO: Implement construct Quote structure over saved values from /** TODO: Implement construct Quote structure over saved values from
* TCG_PTS_SIMPLE_COMP_EVID and compare with received one * TCG_PTS_SIMPLE_COMP_EVID and compare with received one
*/ */
break; break;
} }
case TCG_PTS_FILE_MEAS: case TCG_PTS_FILE_MEAS:
{ {
tcg_pts_attr_file_meas_t *attr_cast; tcg_pts_attr_file_meas_t *attr_cast;
@@ -723,12 +722,12 @@ TNC_Result TNC_IMV_ReceiveMessage(TNC_IMVID imv_id,
if (!attestation_state->check_off_request(attestation_state, if (!attestation_state->check_off_request(attestation_state,
request_id, &file_id, &is_dir)) request_id, &file_id, &is_dir))
{ {
DBG1(DBG_IMV, " no entry found for this request"); DBG1(DBG_IMV, " no entry found for this request");
break; break;
} }
/* check hashes from database against measurements */ /* check hashes from database against measurements */
e_hash = pts_db->create_hash_enumerator(pts_db, e_hash = pts_db->create_hash_enumerator(pts_db,
platform_info, algo, file_id, is_dir); platform_info, algo, file_id, is_dir);
if (!measurements->verify(measurements, e_hash, is_dir)) if (!measurements->verify(measurements, e_hash, is_dir))
{ {
@@ -764,12 +763,12 @@ TNC_Result TNC_IMV_ReceiveMessage(TNC_IMVID imv_id,
DBG1(DBG_IMV, " owner id: %d", entry->owner_id); DBG1(DBG_IMV, " owner id: %d", entry->owner_id);
DBG1(DBG_IMV, " group id: %d", entry->group_id); DBG1(DBG_IMV, " group id: %d", entry->group_id);
} }
e->destroy(e); e->destroy(e);
break; break;
} }
/* TODO: Not implemented yet */ /* TODO: Not implemented yet */
case TCG_PTS_INTEG_MEAS_LOG: case TCG_PTS_INTEG_MEAS_LOG:
/* Attributes using XML */ /* Attributes using XML */
@@ -802,7 +801,7 @@ TNC_Result TNC_IMV_ReceiveMessage(TNC_IMVID imv_id,
} }
enumerator->destroy(enumerator); enumerator->destroy(enumerator);
pa_tnc_msg->destroy(pa_tnc_msg); pa_tnc_msg->destroy(pa_tnc_msg);
if (fatal_error) if (fatal_error)
{ {
@@ -827,10 +826,13 @@ TNC_Result TNC_IMV_ReceiveMessage(TNC_IMVID imv_id,
pa_tnc_msg->build(pa_tnc_msg); pa_tnc_msg->build(pa_tnc_msg);
result = imv_attestation->send_message(imv_attestation, connection_id, result = imv_attestation->send_message(imv_attestation, connection_id,
pa_tnc_msg->get_encoding(pa_tnc_msg)); pa_tnc_msg->get_encoding(pa_tnc_msg));
pa_tnc_msg->destroy(pa_tnc_msg); pa_tnc_msg->destroy(pa_tnc_msg);
attr_list->destroy(attr_list); attr_list->destroy(attr_list);
return result; return result;
} }
DESTROY_IF(attr_list);
if (attestation_state->get_handshake_state(attestation_state) & if (attestation_state->get_handshake_state(attestation_state) &
IMV_ATTESTATION_STATE_END) IMV_ATTESTATION_STATE_END)
@@ -856,7 +858,7 @@ TNC_Result TNC_IMV_ReceiveMessage(TNC_IMVID imv_id,
return imv_attestation->provide_recommendation(imv_attestation, return imv_attestation->provide_recommendation(imv_attestation,
connection_id); connection_id);
} }
return send_message(connection_id); return send_message(connection_id);
} }
@@ -921,7 +923,7 @@ TNC_Result TNC_IMV_Terminate(TNC_IMVID imv_id)
} }
DESTROY_IF(pts_db); DESTROY_IF(pts_db);
DESTROY_IF(pts_credmgr); DESTROY_IF(pts_credmgr);
free(initiator_nonce.ptr); free(initiator_nonce);
libpts_deinit(); libpts_deinit();
@@ -943,4 +945,4 @@ TNC_Result TNC_IMV_ProvideBindFunction(TNC_IMVID imv_id,
return TNC_RESULT_NOT_INITIALIZED; return TNC_RESULT_NOT_INITIALIZED;
} }
return imv_attestation->bind_functions(imv_attestation, bind_function); return imv_attestation->bind_functions(imv_attestation, bind_function);
} }
src/libpts/pts/pts.c
+10 -10
View File
@@ -186,7 +186,7 @@ METHOD(pts_t, calculate_secret, bool,
hash_algorithm_t hash_alg; hash_algorithm_t hash_alg;
u_char output[HASH_SIZE_SHA384]; u_char output[HASH_SIZE_SHA384];
chunk_t shared_secret; chunk_t shared_secret;
/* Create a hasher */ /* Create a hasher */
hash_alg = pts_meas_to_hash_algorithm(algorithm); hash_alg = pts_meas_to_hash_algorithm(algorithm);
hasher = lib->crypto->create_hasher(lib->crypto, hash_alg); hasher = lib->crypto->create_hasher(lib->crypto, hash_alg);
@@ -195,7 +195,7 @@ METHOD(pts_t, calculate_secret, bool,
DBG1(DBG_PTS, " hasher %N not available", hash_algorithm_names, hash_alg); DBG1(DBG_PTS, " hasher %N not available", hash_algorithm_names, hash_alg);
return FALSE; return FALSE;
} }
if (this->dh->get_shared_secret(this->dh, &shared_secret) != SUCCESS) if (this->dh->get_shared_secret(this->dh, &shared_secret) != SUCCESS)
{ {
DBG1(DBG_PTS, "Shared secret couldn't be calculated"); DBG1(DBG_PTS, "Shared secret couldn't be calculated");
@@ -214,7 +214,7 @@ METHOD(pts_t, calculate_secret, bool,
*/ */
this->secret = chunk_create(output, HASH_SIZE_SHA1); this->secret = chunk_create(output, HASH_SIZE_SHA1);
DBG3(DBG_PTS, "Secret assessment value: %B", &this->secret); DBG3(DBG_PTS, "Secret assessment value: %B", &this->secret);
hasher->destroy(hasher); hasher->destroy(hasher);
return TRUE; return TRUE;
} }
@@ -389,9 +389,9 @@ METHOD(pts_t, is_path_valid, bool, private_pts_t *this, char *path,
pts_error_code_t *error_code) pts_error_code_t *error_code)
{ {
struct stat st; struct stat st;
*error_code = 0; *error_code = 0;
if (!stat(path, &st)) if (!stat(path, &st))
{ {
return TRUE; return TRUE;
@@ -501,13 +501,13 @@ static bool file_metadata(char *pathname, pts_file_metadata_t **entry)
pts_file_metadata_t *tmp; pts_file_metadata_t *tmp;
tmp = malloc_thing(pts_file_metadata_t); tmp = malloc_thing(pts_file_metadata_t);
if (stat(pathname, &st)) if (stat(pathname, &st))
{ {
DBG1(DBG_PTS, "Unable to obtain statistical information about %s", pathname); DBG1(DBG_PTS, "Unable to obtain statistical information about %s", pathname);
return FALSE; return FALSE;
} }
tmp->filename = strdup(pathname); tmp->filename = strdup(pathname);
tmp->meta_length = PTS_FILE_METADATA_SIZE + strlen(tmp->filename); tmp->meta_length = PTS_FILE_METADATA_SIZE + strlen(tmp->filename);
@@ -543,7 +543,7 @@ static bool file_metadata(char *pathname, pts_file_metadata_t **entry)
{ {
tmp->type = PTS_FILE_OTHER; tmp->type = PTS_FILE_OTHER;
} }
tmp->filesize = (u_int64_t)st.st_size; tmp->filesize = (u_int64_t)st.st_size;
tmp->create_time = st.st_ctime; tmp->create_time = st.st_ctime;
tmp->last_modify_time = st.st_mtime; tmp->last_modify_time = st.st_mtime;
@@ -561,7 +561,7 @@ METHOD(pts_t, get_metadata, pts_file_meta_t*,
{ {
pts_file_meta_t *metadata; pts_file_meta_t *metadata;
pts_file_metadata_t *entry; pts_file_metadata_t *entry;
/* Create a metadata object */ /* Create a metadata object */
metadata = pts_file_meta_create(); metadata = pts_file_meta_create();
@@ -598,7 +598,7 @@ METHOD(pts_t, get_metadata, pts_file_meta_t*,
DBG3(DBG_PTS, " last accessed: %s", ctime(&entry->last_access_time)); DBG3(DBG_PTS, " last accessed: %s", ctime(&entry->last_access_time));
DBG3(DBG_PTS, " owner id: %d", entry->owner_id); DBG3(DBG_PTS, " owner id: %d", entry->owner_id);
DBG3(DBG_PTS, " group id: %d", entry->group_id); DBG3(DBG_PTS, " group id: %d", entry->group_id);
metadata->add(metadata, entry); metadata->add(metadata, entry);
} }
} }
src/libpts/pts/pts.h
+4 -4
View File
@@ -159,14 +159,14 @@ struct pts_t {
* @param info chunk containing a TPM_CAP_VERSION_INFO struct * @param info chunk containing a TPM_CAP_VERSION_INFO struct
*/ */
void (*set_tpm_version_info)(pts_t *this, chunk_t info); void (*set_tpm_version_info)(pts_t *this, chunk_t info);
/** /**
* Get Attestation Identity Certificate or Public Key * Get Attestation Identity Certificate or Public Key
* *
* @return AIK Certificate or Public Key * @return AIK Certificate or Public Key
*/ */
certificate_t* (*get_aik)(pts_t *this); certificate_t* (*get_aik)(pts_t *this);
/** /**
* Set Attestation Identity Certificate or Public Key * Set Attestation Identity Certificate or Public Key
* *
@@ -204,7 +204,7 @@ struct pts_t {
* @return PTS File Metadata or NULL if FAILED * @return PTS File Metadata or NULL if FAILED
*/ */
pts_file_meta_t* (*get_metadata)(pts_t *this, char *pathname, bool is_directory); pts_file_meta_t* (*get_metadata)(pts_t *this, char *pathname, bool is_directory);
/** /**
* Destroys a pts_t object. * Destroys a pts_t object.
*/ */
@@ -219,4 +219,4 @@ struct pts_t {
*/ */
pts_t* pts_create(bool is_imc); pts_t* pts_create(bool is_imc);
#endif /** PTS_H_ @}*/ #endif /** PTS_H_ @}*/