denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Set recommendation in the case of PCR measurement failures

Browse Source
This commit is contained in:
Andreas Steffen
2013-10-13 22:17:18 +02:00
parent b0761f1f0a
commit a37ab690cc
3 changed files with 27 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libpts/plugins/imv_attestation/imv_attestation_agent.c
+10
View File
@@ -502,8 +502,11 @@ METHOD(imv_agent_if_t, solicit_recommendation, TNC_Result,
if (session)
{
TNC_IMV_Evaluation_Result eval;
TNC_IMV_Action_Recommendation rec;
imv_workitem_t *workitem;
enumerator_t *enumerator;
char *result_str;
int pending_file_meas = 0;
enumerator = session->create_workitem_enumerator(session);
@@ -521,6 +524,13 @@ METHOD(imv_agent_if_t, solicit_recommendation, TNC_Result,
case IMV_WORKITEM_FILE_MEAS:
case IMV_WORKITEM_DIR_REF_MEAS:
case IMV_WORKITEM_DIR_MEAS:
session->remove_workitem(session, enumerator);
result_str = "pending file measurements";
eval = TNC_IMV_EVALUATION_RESULT_ERROR;
rec = workitem->set_result(workitem, result_str, eval);
state->update_recommendation(state, rec, eval);
imcv_db->finalize_workitem(imcv_db, workitem);
workitem->destroy(workitem);
pending_file_meas++;
break;
default:
src/libpts/plugins/imv_attestation/imv_attestation_process.c
+14 -6
View File
@@ -380,6 +380,9 @@ bool imv_attestation_process(pa_tnc_attr_t *attr, imv_msg_t *out_msg,
if (comp->verify(comp, name->get_qualifier(name), pts,
evidence) != SUCCESS)
{
state->update_recommendation(state,
TNC_IMV_ACTION_RECOMMENDATION_ISOLATE,
TNC_IMV_EVALUATION_RESULT_NONCOMPLIANT_MINOR);
attestation_state->set_measurement_error(attestation_state,
IMV_ATTESTATION_ERROR_COMP_EVID_FAIL);
name->log(name, " measurement mismatch for ");
@@ -417,23 +420,28 @@ bool imv_attestation_process(pa_tnc_attr_t *attr, imv_msg_t *out_msg,
{
DBG1(DBG_IMV, "received PCR Composite does not match "
"constructed one");
state->update_recommendation(state,
TNC_IMV_ACTION_RECOMMENDATION_ISOLATE,
TNC_IMV_EVALUATION_RESULT_NONCOMPLIANT_MINOR);
attestation_state->set_measurement_error(attestation_state,
IMV_ATTESTATION_ERROR_TPM_QUOTE_FAIL);
free(pcr_composite.ptr);
free(quote_info.ptr);
break;
goto quote_error;
}
DBG2(DBG_IMV, "received PCR Composite matches constructed one");
free(pcr_composite.ptr);
if (!pts->verify_quote_signature(pts, quote_info, tpm_quote_sig))
{
state->update_recommendation(state,
TNC_IMV_ACTION_RECOMMENDATION_ISOLATE,
TNC_IMV_EVALUATION_RESULT_NONCOMPLIANT_MINOR);
attestation_state->set_measurement_error(attestation_state,
IMV_ATTESTATION_ERROR_TPM_QUOTE_FAIL);
free(quote_info.ptr);
break;
goto quote_error;
}
DBG2(DBG_IMV, "TPM Quote Info signature verification successful");
quote_error:
free(pcr_composite.ptr);
free(quote_info.ptr);
/**
src/libpts/plugins/imv_attestation/imv_attestation_state.c
+3
View File
@@ -461,6 +461,9 @@ METHOD(imv_attestation_state_t, finalize_components, void,
if (!entry->comp->finalize(entry->comp, entry->qualifier))
{
set_measurement_error(this, IMV_ATTESTATION_ERROR_COMP_EVID_PEND);
update_recommendation(this,
TNC_IMV_ACTION_RECOMMENDATION_ISOLATE,
TNC_IMV_EVALUATION_RESULT_ERROR);
}
free_func_comp(entry);
}