implemented blacklisting of software packages

src/libimcv/plugins/imv_os/imv_os.c

@@ -150,7 +150,6 @@ static TNC_Result receive_message(imv_state_t *state, imv_msg_t *in_msg)
 	chunk_t os_name = chunk_empty;
 	chunk_t os_version = chunk_empty;
 	bool fatal_error = FALSE, assessment = FALSE;
-	int count, count_bad, count_ok;
 
 	os_state = (imv_os_state_t*)state;
 
@@ -391,11 +390,15 @@ static TNC_Result receive_message(imv_state_t *state, imv_msg_t *in_msg)
 		!os_state->get_package_request(os_state) &&
 		!os_state->get_angel_count(os_state))
 	{
-		os_state->get_count(os_state, &count, &count_bad, &count_ok);
-		DBG1(DBG_IMV, "processed %d packages: %d bad, %d ok, %d not found",
-			count, count_bad, count_ok, count - count_bad - count_ok);
+		int count, count_update, count_blacklist, count_ok;
 
-		if (count_bad)
+		os_state->get_count(os_state, &count, &count_update, &count_blacklist,
+									  &count_ok);
+		DBG1(DBG_IMV, "processed %d packages: %d not updated, %d blacklisted, "
+			 "%d ok, %d not found", count, count_update, count_blacklist,
+			 count_ok, count - count_update - count_blacklist - count_ok);
+
+		if (count_update || count_blacklist)
 		{
 			state->set_recommendation(state,
 								TNC_IMV_ACTION_RECOMMENDATION_ISOLATE,

src/libimcv/plugins/imv_os/imv_os_database.c

@@ -46,8 +46,9 @@ METHOD(imv_os_database_t, check_packages, status_t,
 	chunk_t os_name, os_version, name, version;
 	os_type_t os_type;
 	size_t os_version_len;
-	int pid, gid, security;
-	int count = 0, count_ok = 0, count_no_match = 0;
+	os_package_state_t package_state;
+	int pid, gid;
+	int count = 0, count_ok = 0, count_no_match = 0, count_blacklist = 0;
 	enumerator_t *e;
 	status_t status = SUCCESS;
 	bool found, match;
@@ -139,10 +140,10 @@ METHOD(imv_os_database_t, check_packages, status_t,
 		found = FALSE;
 		match = FALSE;
 
-		while (e->enumerate(e, &cur_release, &security))
+		while (e->enumerate(e, &cur_release, &package_state))
 		{
 			found = TRUE;
-			if (streq(release, cur_release))
+			if (streq(release, cur_release) || streq("*", cur_release))
 			{
 				match = TRUE;
 				break;
@@ -154,15 +155,25 @@ METHOD(imv_os_database_t, check_packages, status_t,
 		{
 			if (match)
 			{
-				DBG2(DBG_IMV, "package '%s' (%s)%s is ok", package, release,
-							   security ? " [s]" : "");
-				count_ok++;
+				if (package_state == OS_PACKAGE_STATE_BLACKLIST)
+				{
+					DBG2(DBG_IMV, "package '%s' (%s) is blacklisted",
+								   package, release);
+					count_blacklist++;
+					state->add_bad_package(state, package, package_state);
+				}
+				else
+				{
+					DBG2(DBG_IMV, "package '%s' (%s)%N is ok", package, release,
+								   os_package_state_names, package_state);
+					count_ok++;
+				}
 			}
 			else
 			{
 				DBG1(DBG_IMV, "package '%s' (%s) no match", package, release);
 				count_no_match++;
-				state->add_bad_package(state, package);
+				state->add_bad_package(state, package, package_state);
 			}
 		}
 		else
@@ -173,7 +184,7 @@ METHOD(imv_os_database_t, check_packages, status_t,
 		free(release);
 	}
 	free(product);
-	state->set_count(state, count, count_no_match, count_ok);
+	state->set_count(state, count, count_no_match, count_blacklist, count_ok);
 
 	return status;
 }

src/libimcv/plugins/imv_os/imv_os_state.c

@@ -19,6 +19,9 @@
 #include <collections/linked_list.h>
 
 typedef struct private_imv_os_state_t private_imv_os_state_t;
+typedef struct package_entry_t package_entry_t;
+typedef struct reason_entry_t reason_entry_t;
+typedef struct instruction_entry_t instruction_entry_t;
 
 /**
  * Private data of an imv_os_state_t object.
@@ -101,9 +104,14 @@ struct private_imv_os_state_t {
 	int count;
 
 	/**
-	 * Number of blacklisted or not updated packages
+	 * Number of not updated packages
 	 */
-	int count_bad;
+	int count_update;
+
+	/**
+	 * Number of blacklisted packages
+	 */
+	int count_blacklist;
 
 	/**
 	 * Number of whitelisted packages
@@ -122,12 +130,27 @@ struct private_imv_os_state_t {
 
 };
 
-typedef struct entry_t entry_t;
+/**
+ * Store a bad package entry
+ */
+struct package_entry_t {
+	char *name;
+	os_package_state_t state;
+};
+
+/**
+ * Free a bad package entry
+ */
+static void free_package_entry(package_entry_t *this)
+{
+	free(this->name);
+	free(this);
+}
 
 /**
  * Define an internal reason string entry
  */
-struct entry_t {
+struct reason_entry_t {
 	char *lang;
 	char *string;
 };
@@ -135,18 +158,30 @@ struct entry_t {
 /**
  * Table of multi-lingual reason string entries
  */
-static entry_t reasons[] = {
+static reason_entry_t reasons[] = {
 	{ "en", "Vulnerable or blacklisted software packages were found" },
 	{ "de", "Schwachstellenbehaftete oder gesperrte Softwarepakete wurden gefunden" },
 };
 
 /**
- * Table of multi-lingual remediation instruction string entries
+ * Define a remediation instruction string entry
  */
-static entry_t instructions [] = {
-	{ "en", "Please update the following software packages:\n" },
-	{ "de", "Bitte updaten Sie die folgenden Softwarepakete\n" },
-	{ "pl", "Proszę zaktualizować następujące pakiety:\n" }
+struct instruction_entry_t {
+	char *lang;
+	char *update_string;
+	char *removal_string;
+};
+
+/**
+ * Tables of multi-lingual remediation instruction string entries
+ */
+static instruction_entry_t instructions [] = {
+	{ "en", "Please update the following software packages:\n",
+			"Please remove the following software packages:\n" },
+	{ "de", "Bitte updaten Sie die folgenden Softwarepakete\n",
+			"Bitte entfernen Sie die folgenden Softwarepakete\n" },
+	{ "pl", "Proszę zaktualizować następujące pakiety:\n",
+			"Proszę usunąć następujące pakiety:\n" }
 };
 
 METHOD(imv_state_t, get_connection_id, TNC_ConnectionID,
@@ -216,7 +251,7 @@ METHOD(imv_state_t, get_reason_string, bool,
 	char *lang;
 	int i;
 
-	if (!this->count_bad)
+	if (!this->count_update && !this->count_blacklist)
 	{
 		return FALSE;
 	}
@@ -254,17 +289,14 @@ METHOD(imv_state_t, get_remediation_instructions, bool,
 	bool match = FALSE;
 	char *lang, *package, *pos;
 	enumerator_t *enumerator;
-	int i, len;
+	package_entry_t *entry;
+	int i, i_chosen = 0, len = 0;
 
-	if (!this->count_bad)
+	if (!this->count_update && !this->count_blacklist)
 	{
 		return FALSE;
 	}
 
-	/* set the default language */
-	*lang_code = instructions[0].lang;
-	*string    = instructions[0].string;
-
 	while (language_enumerator->enumerate(language_enumerator, &lang))
 	{
 		for (i = 0; i < countof(instructions); i++)
@@ -272,8 +304,7 @@ METHOD(imv_state_t, get_remediation_instructions, bool,
 			if (streq(lang, instructions[i].lang))
 			{
 				match = TRUE;
-				*lang_code = instructions[i].lang;
-				*string    = instructions[i].string;
+				i_chosen = i;
 				break;
 			}
 		}
@@ -282,31 +313,67 @@ METHOD(imv_state_t, get_remediation_instructions, bool,
 			break;
 		}
 	}
+	*lang_code = instructions[i_chosen].lang;
 
 	/* Compute the size of the remediation string */
-	len = strlen(*string);
+	if (this->count_update)
+	{
+		len += strlen(instructions[i_chosen].update_string);
+	}
+	if (this->count_blacklist)
+	{
+		len += strlen(instructions[i_chosen].removal_string);
+	}
 
 	enumerator = this->bad_packages->create_enumerator(this->bad_packages);
-	while (enumerator->enumerate(enumerator, &package))
+	while (enumerator->enumerate(enumerator, &entry))
 	{
-		len += strlen(package) + 1;
+		len += strlen(entry->name) + 1;
 	}
 	enumerator->destroy(enumerator);
 
+	/* Allocate memory for the remediation instructions */
 	pos = this->instructions = malloc(len + 1);
-	strcpy(pos, *string);
-	pos += strlen(*string);
 
-	enumerator = this->bad_packages->create_enumerator(this->bad_packages);
-	while (enumerator->enumerate(enumerator, &package))
+	/* List of blacklisted packages, if any */
+	if (this->count_blacklist)
 	{
-		strcpy(pos, package);
-		pos += strlen(package);
-		*pos++ = '\n';
-	}
-	enumerator->destroy(enumerator);
-	*pos = '\0';
+		strcpy(pos, instructions[i_chosen].removal_string);
+		pos += strlen(instructions[i_chosen].removal_string);
 
+		enumerator = this->bad_packages->create_enumerator(this->bad_packages);
+		while (enumerator->enumerate(enumerator, &entry))
+		{
+			if (entry->state == OS_PACKAGE_STATE_BLACKLIST)
+			{
+				strcpy(pos, entry->name);
+				pos += strlen(entry->name);
+				*pos++ = '\n';
+			}
+		}
+		enumerator->destroy(enumerator);
+	}
+
+	/* List of packages in need of an update, if any */
+	if (this->count_update)
+	{
+		strcpy(pos, instructions[i_chosen].update_string);
+		pos += strlen(instructions[i_chosen].update_string);
+
+		enumerator = this->bad_packages->create_enumerator(this->bad_packages);
+		while (enumerator->enumerate(enumerator, &entry))
+		{
+			if (entry->state != OS_PACKAGE_STATE_BLACKLIST)
+			{
+				strcpy(pos, entry->name);
+				pos += strlen(entry->name);
+				*pos++ = '\n';
+			}
+		}
+		enumerator->destroy(enumerator);
+	}
+
+	*pos = '\0';
 	*string = this->instructions;
 	*uri = lib->settings->get_str(lib->settings,
 				"libimcv.plugins.imv-os.remediation_uri", NULL);
@@ -317,7 +384,8 @@ METHOD(imv_state_t, get_remediation_instructions, bool,
 METHOD(imv_state_t, destroy, void,
 	private_imv_os_state_t *this)
 {
-	this->bad_packages->destroy_function(this->bad_packages, free);
+	this->bad_packages->destroy_function(this->bad_packages,
+										(void*)free_package_entry);
 	free(this->instructions);
 	free(this->info);
 	free(this->name.ptr);
@@ -360,23 +428,30 @@ METHOD(imv_os_state_t, get_info, char*,
 }
 
 METHOD(imv_os_state_t, set_count, void,
-	private_imv_os_state_t *this, int count, int count_bad, int count_ok)
+	private_imv_os_state_t *this, int count, int count_update,
+	int count_blacklist, int count_ok)
 {
-	this->count     += count;
-	this->count_bad += count_bad;
-	this->count_ok  += count_ok;
+	this->count           += count;
+	this->count_update    += count_update;
+	this->count_blacklist += count_blacklist;
+	this->count_ok        += count_ok;
 }
 
 METHOD(imv_os_state_t, get_count, void,
-	private_imv_os_state_t *this, int *count, int *count_bad, int *count_ok)
+	private_imv_os_state_t *this, int *count, int *count_update,
+	int *count_blacklist, int *count_ok)
 {
 	if (count)
 	{
 		*count = this->count;
 	}
-	if (count_bad)
+	if (count_update)
 	{
-		*count_bad = this->count_bad;
+		*count_update = this->count_update;
+	}
+	if (count_blacklist)
+	{
+		*count_blacklist = this->count_blacklist;
 	}
 	if (count_ok)
 	{
@@ -409,9 +484,15 @@ METHOD(imv_os_state_t, get_angel_count, int,
 }
 
 METHOD(imv_os_state_t, add_bad_package, void,
-	private_imv_os_state_t *this, char *package)
+	private_imv_os_state_t *this, char *package,
+	os_package_state_t package_state)
 {
-	this->bad_packages->insert_last(this->bad_packages, strdup(package));
+	package_entry_t *entry;
+
+	entry = malloc_thing(package_entry_t);
+	entry->name = strdup(package);
+	entry->state = package_state;
+	this->bad_packages->insert_last(this->bad_packages, entry);
 }
 
 /**

src/libimcv/plugins/imv_os/imv_os_state.h

@@ -62,22 +62,24 @@ struct imv_os_state_t {
 	/**
 	 * Set [or with multiple attributes increment] package counters
 	 *
-	 * @param count			Number of processed packages
-	 * @param count_bad		Number of blacklisted or not updated packages
-	 * @param count_ok		Number of whitelisted packages
+	 * @param count				Number of processed packages
+	 * @param count_update		Number of not updated packages
+	 * @param count_blacklist	Number of blacklisted packages
+	 * @param count_ok			Number of whitelisted packages
 	 */
-	void (*set_count)(imv_os_state_t *this, int count, int count_bad,
-					  int count_ok);
+	void (*set_count)(imv_os_state_t *this, int count, int count_update,
+					  int count_blacklist, int count_ok);
 
 	/**
 	 * Set [or with multiple attributes increment] package counters
 	 *
-	 * @param count			Number of processed packages
-	 * @param count_bad		Number of blacklisted or not updated packages
-	 * @param count_ok		Number of whitelisted packages
+	 * @param count				Number of processed packages
+	 * @param count_update		Number of not updated packages
+	 * @param count_blacklist	Number of blacklisted packages
+	 * @param count_ok			Number of whitelisted packages
 	 */
-	void (*get_count)(imv_os_state_t *this, int *count, int *count_bad,
-					  int *count_ok);
+	void (*get_count)(imv_os_state_t *this, int *count, int *count_update,
+					  int *count_blacklist, int *count_ok);
 	/**
 	 * Set/reset OS Installed Packages request status
 	 *
@@ -110,8 +112,10 @@ struct imv_os_state_t {
 	 * Store a bad package that has to be updated or removed
 	 *
 	 * @param package		Name of software package
+	 * @param package_state	Security state of software package
 	 */
-	void (*add_bad_package)(imv_os_state_t *this, char *package);
+	void (*add_bad_package)(imv_os_state_t *this, char *package,
+							os_package_state_t package_state);
 
 };
 

src/libimcv/plugins/imv_os/pacman.c

@@ -22,6 +22,8 @@
 #include <syslog.h>
 #include <time.h>
 
+#include "imv_os_state.h"
+
 #include <library.h>
 #include <utils/debug.h>