denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Introduced workitems to Attestation IMV

Browse Source
This commit is contained in:
Andreas Steffen
2013-06-21 23:25:23 +02:00
parent 7e9bdd20aa
commit b1da8368d0
20 changed files with 777 additions and 471 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libpts/plugins/imv_attestation/imv_attestation_agent.c
+212 -86
View File
@@ -34,6 +34,8 @@
#include <pts/pts_creds.h>
#include <tcg/tcg_attr.h>
#include <tcg/tcg_pts_attr_req_file_meas.h>
#include <tcg/tcg_pts_attr_req_file_meta.h>
#include <tncif_pa_subtypes.h>
@@ -116,31 +118,6 @@ METHOD(imv_agent_if_t, notify_connection_change, TNC_Result,
}
}
/**
* Build a message to be sent
*/
static TNC_Result send_message(private_imv_attestation_agent_t *this,
imv_state_t *state, imv_msg_t *out_msg)
{
imv_attestation_state_t *attestation_state;
TNC_Result result;
attestation_state = (imv_attestation_state_t*)state;
if (imv_attestation_build(out_msg, attestation_state,
this->supported_algorithms,
this->supported_dh_groups, this->pts_db))
{
result = out_msg->send(out_msg, TRUE);
}
else
{
result = TNC_RESULT_FATAL;
}
return result;
}
/**
* Process a received message
*/
@@ -197,8 +174,7 @@ static TNC_Result receive_msg(private_imv_attestation_agent_t *this,
DBG1(DBG_IMV, "received TCG-PTS error '%N'",
pts_error_code_names, error_code.type);
DBG1(DBG_IMV, "error information: %B", &msg_info);
result = TNC_RESULT_FATAL;
fatal_error = TRUE;
}
break;
}
@@ -224,7 +200,7 @@ static TNC_Result receive_msg(private_imv_attestation_agent_t *this,
}
else if (type.vendor_id == PEN_TCG)
{
if (!imv_attestation_process(attr, out_msg, attestation_state,
if (!imv_attestation_process(attr, out_msg, state,
this->supported_algorithms, this->supported_dh_groups,
this->pts_db, this->pts_credmgr))
{
@@ -235,6 +211,10 @@ static TNC_Result receive_msg(private_imv_attestation_agent_t *this,
}
enumerator->destroy(enumerator);
/**
* The IETF Product Information and String Version attributes
* are supposed to arrive in the same PA-TNC message
*/
if (os_name.len && os_version.len)
{
pts->set_platform_info(pts, os_name, os_version);
@@ -256,64 +236,9 @@ static TNC_Result receive_msg(private_imv_attestation_agent_t *this,
/* send PA-TNC message with excl flag set */
result = out_msg->send(out_msg, TRUE);
if (result != TNC_RESULT_SUCCESS)
{
out_msg->destroy(out_msg);
return result;
}
/* check the IMV state for the next PA-TNC attributes to send */
result = send_message(this, state, out_msg);
if (result != TNC_RESULT_SUCCESS)
{
state->set_recommendation(state,
TNC_IMV_ACTION_RECOMMENDATION_NO_RECOMMENDATION,
TNC_IMV_EVALUATION_RESULT_ERROR);
result = out_msg->send_assessment(out_msg);
out_msg->destroy(out_msg);
if (result != TNC_RESULT_SUCCESS)
{
return result;
}
return this->agent->provide_recommendation(this->agent, state);
}
if (attestation_state->get_handshake_state(attestation_state) ==
IMV_ATTESTATION_STATE_END)
{
if (attestation_state->get_file_meas_request_count(attestation_state))
{
DBG1(DBG_IMV, "failure due to %d pending file measurements",
attestation_state->get_file_meas_request_count(attestation_state));
attestation_state->set_measurement_error(attestation_state,
IMV_ATTESTATION_ERROR_FILE_MEAS_PEND);
}
if (attestation_state->get_measurement_error(attestation_state))
{
state->set_recommendation(state,
TNC_IMV_ACTION_RECOMMENDATION_ISOLATE,
TNC_IMV_EVALUATION_RESULT_NONCOMPLIANT_MAJOR);
}
else
{
state->set_recommendation(state,
TNC_IMV_ACTION_RECOMMENDATION_ALLOW,
TNC_IMV_EVALUATION_RESULT_COMPLIANT);
}
result = out_msg->send_assessment(out_msg);
out_msg->destroy(out_msg);
if (result != TNC_RESULT_SUCCESS)
{
return result;
}
return this->agent->provide_recommendation(this->agent, state);
}
out_msg->destroy(out_msg);
return result;
}
METHOD(imv_agent_if_t, receive_message, TNC_Result,
@@ -354,24 +279,224 @@ METHOD(imv_agent_if_t, receive_message_long, TNC_Result,
in_msg->destroy(in_msg);
return result;
}
METHOD(imv_agent_if_t, batch_ending, TNC_Result,
private_imv_attestation_agent_t *this, TNC_ConnectionID id)
{
return TNC_RESULT_SUCCESS;
imv_msg_t *out_msg;
imv_state_t *state;
imv_session_t *session;
imv_attestation_state_t *attestation_state;
TNC_IMVID imv_id;
TNC_Result result = TNC_RESULT_SUCCESS;
pts_t *pts;
char *platform_info;
if (!this->agent->get_state(this->agent, id, &state))
{
return TNC_RESULT_FATAL;
}
attestation_state = (imv_attestation_state_t*)state;
pts = attestation_state->get_pts(attestation_state);
platform_info = pts->get_platform_info(pts);
session = state->get_session(state);
imv_id = this->agent->get_id(this->agent);
/* create an empty out message - we might need it */
out_msg = imv_msg_create(this->agent, state, id, imv_id, TNC_IMCID_ANY,
msg_types[0]);
if (platform_info && session &&
(state->get_action_flags(state) & IMV_ATTESTATION_FLAG_ALGO) &&
!(state->get_action_flags(state) & IMV_ATTESTATION_FLAG_FILE_MEAS))
{
imv_workitem_t *workitem;
bool is_dir, no_workitems = TRUE;
u_int32_t delimiter = SOLIDUS_UTF;
u_int16_t request_id;
pa_tnc_attr_t *attr;
char *pathname;
enumerator_t *enumerator;
enumerator = session->create_workitem_enumerator(session);
if (enumerator)
{
while (enumerator->enumerate(enumerator, &workitem))
{
if (workitem->get_imv_id(workitem) != TNC_IMVID_ANY)
{
continue;
}
switch (workitem->get_type(workitem))
{
case IMV_WORKITEM_FILE_REF_MEAS:
case IMV_WORKITEM_FILE_MEAS:
case IMV_WORKITEM_FILE_META:
is_dir = FALSE;
break;
case IMV_WORKITEM_DIR_REF_MEAS:
case IMV_WORKITEM_DIR_MEAS:
case IMV_WORKITEM_DIR_META:
is_dir = TRUE;
break;
default:
continue;
}
pathname = this->pts_db->get_pathname(this->pts_db, is_dir,
workitem->get_arg_int(workitem));
if (!pathname)
{
continue;
}
workitem->set_imv_id(workitem, imv_id);
no_workitems = FALSE;
if (workitem->get_type(workitem) == IMV_WORKITEM_FILE_META)
{
TNC_IMV_Action_Recommendation rec;
TNC_IMV_Evaluation_Result eval;
DBG2(DBG_IMV, "IMV %d requests metadata for %s '%s'",
imv_id, is_dir ? "directory" : "file", pathname);
attr = tcg_pts_attr_req_file_meta_create(is_dir,
delimiter, pathname);
/* currently just fire and forget metadata requests */
eval = TNC_IMV_EVALUATION_RESULT_COMPLIANT;
session->remove_workitem(session, enumerator);
rec = workitem->set_result(workitem, "", eval);
state->update_recommendation(state, rec, eval);
imcv_db->finalize_workitem(imcv_db, workitem);
workitem->destroy(workitem);
}
else
{
/* use lower 16 bits of the workitem ID as request ID */
request_id = workitem->get_id(workitem) & 0xffff;
DBG2(DBG_IMV, "IMV %d requests measurement %d for %s '%s'",
imv_id, request_id, is_dir ? "directory" : "file",
pathname);
attr = tcg_pts_attr_req_file_meas_create(is_dir, request_id,
delimiter, pathname);
}
free(pathname);
attr->set_noskip_flag(attr, TRUE);
out_msg->add_attribute(out_msg, attr);
}
enumerator->destroy(enumerator);
/* sent all file and directory measurement and metadata requests */
state->set_action_flags(state, IMV_ATTESTATION_FLAG_FILE_MEAS);
if (no_workitems)
{
DBG2(DBG_IMV, "IMV %d has no workitems - "
"no evaluation requested", imv_id);
state->set_recommendation(state,
TNC_IMV_ACTION_RECOMMENDATION_ALLOW,
TNC_IMV_EVALUATION_RESULT_DONT_KNOW);
}
}
}
/* check the IMV state for the next PA-TNC attributes to send */
if (!imv_attestation_build(out_msg, attestation_state,
this->supported_algorithms,
this->supported_dh_groups, this->pts_db))
{
state->set_recommendation(state,
TNC_IMV_ACTION_RECOMMENDATION_NO_RECOMMENDATION,
TNC_IMV_EVALUATION_RESULT_ERROR);
result = out_msg->send_assessment(out_msg);
out_msg->destroy(out_msg);
if (result != TNC_RESULT_SUCCESS)
{
return result;
}
return this->agent->provide_recommendation(this->agent, state);
}
/* finalized all workitems? */
if (session && session->get_workitem_count(session, imv_id) == 0 &&
attestation_state->get_handshake_state(attestation_state) ==
IMV_ATTESTATION_STATE_END)
{
result = out_msg->send_assessment(out_msg);
out_msg->destroy(out_msg);
if (result != TNC_RESULT_SUCCESS)
{
return result;
}
return this->agent->provide_recommendation(this->agent, state);
}
/* send non-empty PA-TNC message with excl flag not set */
if (out_msg->get_attribute_count(out_msg))
{
result = out_msg->send(out_msg, FALSE);
}
out_msg->destroy(out_msg);
return result;
}
METHOD(imv_agent_if_t, solicit_recommendation, TNC_Result,
private_imv_attestation_agent_t *this, TNC_ConnectionID id)
{
TNC_IMVID imv_id;
imv_state_t *state;
imv_attestation_state_t *attestation_state;
imv_session_t *session;
if (!this->agent->get_state(this->agent, id, &state))
{
return TNC_RESULT_FATAL;
}
attestation_state = (imv_attestation_state_t*)state;
session = state->get_session(state);
imv_id = this->agent->get_id(this->agent);
if (session)
{
imv_workitem_t *workitem;
enumerator_t *enumerator;
int pending_file_meas = 0;
enumerator = session->create_workitem_enumerator(session);
if (enumerator)
{
while (enumerator->enumerate(enumerator, &workitem))
{
if (workitem->get_imv_id(workitem) != imv_id)
{
continue;
}
switch (workitem->get_type(workitem))
{
case IMV_WORKITEM_FILE_REF_MEAS:
case IMV_WORKITEM_FILE_MEAS:
case IMV_WORKITEM_DIR_REF_MEAS:
case IMV_WORKITEM_DIR_MEAS:
pending_file_meas++;
break;
default:
break;
}
}
enumerator->destroy(enumerator);
if (pending_file_meas)
{
DBG1(DBG_IMV, "failure due to %d pending file measurements",
pending_file_meas);
attestation_state->set_measurement_error(attestation_state,
IMV_ATTESTATION_ERROR_FILE_MEAS_PEND);
}
}
}
return this->agent->provide_recommendation(this->agent, state);
}
@@ -406,7 +531,6 @@ imv_agent_if_t *imv_attestation_agent_create(const char *name, TNC_IMVID id,
"libimcv.plugins.imv-attestation.dh_group", "ecp256");
cadir = lib->settings->get_str(lib->settings,
"libimcv.plugins.imv-attestation.cadir", NULL);
libpts_init();
INIT(this,
.public = {
@@ -427,6 +551,8 @@ imv_agent_if_t *imv_attestation_agent_create(const char *name, TNC_IMVID id,
.pts_db = pts_database_create(imcv_db),
);
libpts_init();
if (!this->agent ||
!pts_meas_algo_probe(&this->supported_algorithms) ||
!pts_dh_group_probe(&this->supported_dh_groups) ||
src/libpts/plugins/imv_attestation/imv_attestation_build.c
+6 -82
View File
@@ -24,8 +24,6 @@
#include <tcg/tcg_pts_attr_get_aik.h>
#include <tcg/tcg_pts_attr_req_func_comp_evid.h>
#include <tcg/tcg_pts_attr_gen_attest_evid.h>
#include <tcg/tcg_pts_attr_req_file_meas.h>
#include <tcg/tcg_pts_attr_req_file_meta.h>
#include <utils/debug.h>
@@ -49,8 +47,7 @@ bool imv_attestation_build(imv_msg_t *out_msg,
if (handshake_state == IMV_ATTESTATION_STATE_NONCE_REQ &&
!(pts->get_proto_caps(pts) & PTS_PROTO_CAPS_D))
{
DBG2(DBG_IMV, "PTS-IMC does not support DH Nonce negotiation - "
"advancing to TPM Initialization");
DBG2(DBG_IMV, "PTS-IMC does not support DH Nonce negotiation");
handshake_state = IMV_ATTESTATION_STATE_TPM_INIT;
}
@@ -61,9 +58,8 @@ bool imv_attestation_build(imv_msg_t *out_msg,
if (handshake_state == IMV_ATTESTATION_STATE_TPM_INIT &&
!(pts->get_proto_caps(pts) & PTS_PROTO_CAPS_T))
{
DBG2(DBG_IMV, "PTS-IMC made no TPM available - "
"advancing to File Measurements");
handshake_state = IMV_ATTESTATION_STATE_MEAS;
DBG2(DBG_IMV, "PTS-IMC made no TPM available");
handshake_state = IMV_ATTESTATION_STATE_END;
}
switch (handshake_state)
@@ -129,83 +125,9 @@ bool imv_attestation_build(imv_msg_t *out_msg,
attr->set_noskip_flag(attr, TRUE);
out_msg->add_attribute(out_msg, attr);
attestation_state->set_handshake_state(attestation_state,
IMV_ATTESTATION_STATE_MEAS);
break;
}
case IMV_ATTESTATION_STATE_MEAS:
{
enumerator_t *enumerator;
u_int32_t delimiter = SOLIDUS_UTF;
char *platform_info, *pathname;
u_int16_t request_id;
int id, type;
bool is_dir, have_request = FALSE;
attestation_state->set_handshake_state(attestation_state,
IMV_ATTESTATION_STATE_COMP_EVID);
/* Get Platform and OS of the PTS-IMC */
platform_info = pts->get_platform_info(pts);
if (!pts_db || !platform_info)
{
DBG1(DBG_IMV, "%s%s%s not available",
(pts_db) ? "" : "pts database",
(!pts_db && !platform_info) ? "and" : "",
(platform_info) ? "" : "platform info");
break;
}
DBG1(DBG_IMV, "platform is '%s'", platform_info);
/* Send Request File Metadata attribute */
enumerator = pts_db->create_file_meta_enumerator(pts_db,
platform_info);
if (!enumerator)
{
break;
}
while (enumerator->enumerate(enumerator, &type, &pathname))
{
is_dir = (type != 0);
DBG2(DBG_IMV, "metadata request for %s '%s'",
is_dir ? "directory" : "file", pathname);
attr = tcg_pts_attr_req_file_meta_create(is_dir, delimiter,
pathname);
attr->set_noskip_flag(attr, TRUE);
out_msg->add_attribute(out_msg, attr);
have_request = TRUE;
}
enumerator->destroy(enumerator);
/* Send Request File Measurement attribute */
enumerator = pts_db->create_file_meas_enumerator(pts_db,
platform_info);
if (!enumerator)
{
break;
}
while (enumerator->enumerate(enumerator, &id, &type, &pathname))
{
is_dir = (type != 0);
request_id = attestation_state->add_file_meas_request(
attestation_state, id, is_dir);
DBG2(DBG_IMV, "measurement request %d for %s '%s'",
request_id, is_dir ? "directory" : "file", pathname);
attr = tcg_pts_attr_req_file_meas_create(is_dir, request_id,
delimiter, pathname);
attr->set_noskip_flag(attr, TRUE);
out_msg->add_attribute(out_msg, attr);
have_request = TRUE;
}
enumerator->destroy(enumerator);
/* do we have any file metadata or measurement requests? */
if (have_request)
{
break;
}
/* fall through to next state */
break;
}
case IMV_ATTESTATION_STATE_COMP_EVID:
{
@@ -304,6 +226,8 @@ bool imv_attestation_build(imv_msg_t *out_msg,
}
break;
case IMV_ATTESTATION_STATE_END:
attestation_state->set_handshake_state(attestation_state,
IMV_ATTESTATION_STATE_END);
break;
}
return TRUE;
src/libpts/plugins/imv_attestation/imv_attestation_process.c
+97 -24
View File
@@ -1,5 +1,5 @@
/*
* Copyright (C) 2011-2012 Sansar Choinyambuu, Andreas Steffen
* Copyright (C) 2011-2013 Sansar Choinyambuu, Andreas Steffen
* HSR Hochschule fuer Technik Rapperswil
*
* This program is free software; you can redistribute it and/or modify it
@@ -15,6 +15,7 @@
#include "imv_attestation_process.h"
#include <imcv.h>
#include <ietf/ietf_attr_pa_tnc_error.h>
#include <pts/pts.h>
@@ -35,15 +36,17 @@
#include <inttypes.h>
bool imv_attestation_process(pa_tnc_attr_t *attr, imv_msg_t *out_msg,
imv_attestation_state_t *attestation_state,
imv_state_t *state,
pts_meas_algorithms_t supported_algorithms,
pts_dh_group_t supported_dh_groups,
pts_database_t *pts_db,
credential_manager_t *pts_credmgr)
{
imv_attestation_state_t *attestation_state;
pen_type_t attr_type;
pts_t *pts;
attestation_state = (imv_attestation_state_t*)state;
pts = attestation_state->get_pts(attestation_state);
attr_type = attr->get_type(attr);
@@ -73,6 +76,7 @@ bool imv_attestation_process(pa_tnc_attr_t *attr, imv_msg_t *out_msg,
return FALSE;
}
pts->set_meas_algorithm(pts, selected_algorithm);
state->set_action_flags(state, IMV_ATTESTATION_FLAG_ALGO);
break;
}
case TCG_PTS_DH_NONCE_PARAMS_RESP:
@@ -190,28 +194,26 @@ bool imv_attestation_process(pa_tnc_attr_t *attr, imv_msg_t *out_msg,
}
case TCG_PTS_FILE_MEAS:
{
TNC_IMV_Evaluation_Result eval;
TNC_IMV_Action_Recommendation rec;
tcg_pts_attr_file_meas_t *attr_cast;
u_int16_t request_id;
int file_count, file_id;
int arg_int, file_count;
pts_meas_algorithms_t algo;
pts_file_meas_t *measurements;
imv_session_t *session;
imv_workitem_t *workitem, *found = NULL;
imv_workitem_type_t type;
char *platform_info;
enumerator_t *e_hash;
bool is_dir;
enumerator_t *enumerator;
eval = TNC_IMV_EVALUATION_RESULT_COMPLIANT;
session = state->get_session(state);
algo = pts->get_meas_algorithm(pts);
platform_info = pts->get_platform_info(pts);
if (!pts_db || !platform_info)
{
DBG1(DBG_IMV, "%s%s%s not available",
(pts_db) ? "" : "pts database",
(!pts_db && !platform_info) ? "and" : "",
(platform_info) ? "" : "platform info");
break;
}
attr_cast = (tcg_pts_attr_file_meas_t*)attr;
measurements = attr_cast->get_measurements(attr_cast);
algo = pts->get_meas_algorithm(pts);
request_id = measurements->get_request_id(measurements);
file_count = measurements->get_file_count(measurements);
@@ -220,23 +222,94 @@ bool imv_attestation_process(pa_tnc_attr_t *attr, imv_msg_t *out_msg,
if (request_id)
{
if (!attestation_state->check_off_file_meas_request(
attestation_state, request_id, &file_id, &is_dir))
enumerator = session->create_workitem_enumerator(session);
while (enumerator->enumerate(enumerator, &workitem))
{
/* request ID consist of lower 16 bits of workitem ID */
if ((workitem->get_id(workitem) & 0xffff) == request_id)
{
found = workitem;
break;
}
}
if (!found)
{
DBG1(DBG_IMV, " no entry found for file measurement "
"request %d", request_id);
enumerator->destroy(enumerator);
break;
}
/* check hashes from database against measurements */
e_hash = pts_db->create_file_hash_enumerator(pts_db,
platform_info, algo, file_id, is_dir);
if (!measurements->verify(measurements, e_hash, is_dir))
type = found->get_type(found);
arg_int = found->get_arg_int(found);
switch (type)
{
attestation_state->set_measurement_error(attestation_state,
IMV_ATTESTATION_ERROR_FILE_MEAS_FAIL);
default:
case IMV_WORKITEM_FILE_REF_MEAS:
case IMV_WORKITEM_FILE_MEAS:
is_dir = FALSE;
break;
case IMV_WORKITEM_DIR_REF_MEAS:
case IMV_WORKITEM_DIR_MEAS:
is_dir = TRUE;
}
e_hash->destroy(e_hash);
switch (type)
{
case IMV_WORKITEM_FILE_MEAS:
case IMV_WORKITEM_DIR_MEAS:
{
enumerator_t *e;
/* check hashes from database against measurements */
e = pts_db->create_file_hash_enumerator(pts_db,
platform_info, algo, is_dir, arg_int);
if (!e)
{
eval = TNC_IMV_EVALUATION_RESULT_ERROR;
break;
}
if (!measurements->verify(measurements, e, is_dir))
{
attestation_state->set_measurement_error(
attestation_state,
IMV_ATTESTATION_ERROR_FILE_MEAS_FAIL);
eval = TNC_IMV_EVALUATION_RESULT_NONCOMPLIANT_MINOR;
}
e->destroy(e);
break;
}
case IMV_WORKITEM_FILE_REF_MEAS:
case IMV_WORKITEM_DIR_REF_MEAS:
{
enumerator_t *e;
char *filename;
chunk_t measurement;
e = measurements->create_enumerator(measurements);
while (e->enumerate(e, &filename, &measurement))
{
if (pts_db->add_file_measurement(pts_db,
platform_info, algo, measurement, filename,
is_dir, arg_int) != SUCCESS)
{
eval = TNC_IMV_EVALUATION_RESULT_ERROR;
}
}
e->destroy(e);
break;
}
default:
break;
}
session->remove_workitem(session, enumerator);
enumerator->destroy(enumerator);
rec = found->set_result(found, "", eval);
state->update_recommendation(state, rec, eval);
imcv_db->finalize_workitem(imcv_db, found);
found->destroy(found);
}
else
{
src/libpts/plugins/imv_attestation/imv_attestation_process.h
+2 -2
View File
@@ -40,7 +40,7 @@
*
* @param attr PA-TNC attribute to be processed
* @param out_msg PA-TNC message containing error messages
* @param attestation_state attestation state of a given connection
* @param state state of a given connection
* @param supported_algorithms supported PTS measurement algorithms
* @param supported_dh_groups supported DH groups
* @param pts_db PTS configuration database
@@ -48,7 +48,7 @@
* @return TRUE if successful
*/
bool imv_attestation_process(pa_tnc_attr_t *attr, imv_msg_t *out_msg,
imv_attestation_state_t *attestation_state,
imv_state_t *state,
pts_meas_algorithms_t supported_algorithms,
pts_dh_group_t supported_dh_groups,
pts_database_t *pts_db,
src/libpts/plugins/imv_attestation/imv_attestation_state.c
+19 -69
View File
@@ -65,6 +65,11 @@ struct private_imv_attestation_state_t {
*/
u_int32_t max_msg_len;
/**
* Flags set for completed actions
*/
u_int32_t action_flags;
/**
* Access Requestor ID Type
*/
@@ -95,16 +100,6 @@ struct private_imv_attestation_state_t {
*/
TNC_IMV_Evaluation_Result eval;
/**
* File Measurement Request counter
*/
u_int16_t file_meas_request_counter;
/**
* List of PTS File/Directory Measurement requests
*/
linked_list_t *file_meas_requests;
/**
* List of Functional Components
*/
@@ -127,15 +122,6 @@ struct private_imv_attestation_state_t {
};
/**
* PTS File/Directory Measurement request entry
*/
struct file_meas_request_t {
u_int16_t id;
int file_id;
bool is_dir;
};
/**
* PTS Functional Component entry
*/
@@ -233,6 +219,18 @@ METHOD(imv_state_t, get_max_msg_len, u_int32_t,
return this->max_msg_len;
}
METHOD(imv_state_t, set_action_flags, void,
private_imv_attestation_state_t *this, u_int32_t flags)
{
this->action_flags |= flags;
}
METHOD(imv_state_t, get_action_flags, u_int32_t,
private_imv_attestation_state_t *this)
{
return this->action_flags;
}
METHOD(imv_state_t, set_ar_id, void,
private_imv_attestation_state_t *this, u_int32_t id_type, chunk_t id_value)
{
@@ -345,7 +343,6 @@ METHOD(imv_state_t, destroy, void,
{
DESTROY_IF(this->session);
DESTROY_IF(this->reason_string);
this->file_meas_requests->destroy_function(this->file_meas_requests, free);
this->components->destroy_function(this->components, (void *)free_func_comp);
this->pts->destroy(this->pts);
free(this->ar_id_value.ptr);
@@ -371,51 +368,6 @@ METHOD(imv_attestation_state_t, get_pts, pts_t*,
return this->pts;
}
METHOD(imv_attestation_state_t, add_file_meas_request, u_int16_t,
private_imv_attestation_state_t *this, int file_id, bool is_dir)
{
file_meas_request_t *request;
request = malloc_thing(file_meas_request_t);
request->id = ++this->file_meas_request_counter;
request->file_id = file_id;
request->is_dir = is_dir;
this->file_meas_requests->insert_last(this->file_meas_requests, request);
return this->file_meas_request_counter;
}
METHOD(imv_attestation_state_t, check_off_file_meas_request, bool,
private_imv_attestation_state_t *this, u_int16_t id, int *file_id,
bool* is_dir)
{
enumerator_t *enumerator;
file_meas_request_t *request;
bool found = FALSE;
enumerator = this->file_meas_requests->create_enumerator(this->file_meas_requests);
while (enumerator->enumerate(enumerator, &request))
{
if (request->id == id)
{
found = TRUE;
*file_id = request->file_id;
*is_dir = request->is_dir;
this->file_meas_requests->remove_at(this->file_meas_requests, enumerator);
free(request);
break;
}
}
enumerator->destroy(enumerator);
return found;
}
METHOD(imv_attestation_state_t, get_file_meas_request_count, int,
private_imv_attestation_state_t *this)
{
return this->file_meas_requests->get_count(this->file_meas_requests);
}
METHOD(imv_attestation_state_t, create_component, pts_component_t*,
private_imv_attestation_state_t *this, pts_comp_func_name_t *name,
u_int32_t depth, pts_database_t *pts_db)
@@ -536,6 +488,8 @@ imv_state_t *imv_attestation_state_create(TNC_ConnectionID connection_id)
.set_flags = _set_flags,
.set_max_msg_len = _set_max_msg_len,
.get_max_msg_len = _get_max_msg_len,
.set_action_flags = _set_action_flags,
.get_action_flags = _get_action_flags,
.set_ar_id = _set_ar_id,
.get_ar_id = _get_ar_id,
.set_session = _set_session,
@@ -551,9 +505,6 @@ imv_state_t *imv_attestation_state_create(TNC_ConnectionID connection_id)
.get_handshake_state = _get_handshake_state,
.set_handshake_state = _set_handshake_state,
.get_pts = _get_pts,
.add_file_meas_request = _add_file_meas_request,
.check_off_file_meas_request = _check_off_file_meas_request,
.get_file_meas_request_count = _get_file_meas_request_count,
.create_component = _create_component,
.get_component = _get_component,
.finalize_components = _finalize_components,
@@ -566,7 +517,6 @@ imv_state_t *imv_attestation_state_create(TNC_ConnectionID connection_id)
.handshake_state = IMV_ATTESTATION_STATE_INIT,
.rec = TNC_IMV_ACTION_RECOMMENDATION_NO_RECOMMENDATION,
.eval = TNC_IMV_EVALUATION_RESULT_DONT_KNOW,
.file_meas_requests = linked_list_create(),
.components = linked_list_create(),
.pts = pts_create(FALSE),
);
src/libpts/plugins/imv_attestation/imv_attestation_state.h
+9 -29
View File
@@ -31,9 +31,18 @@
#include <library.h>
typedef struct imv_attestation_state_t imv_attestation_state_t;
typedef enum imv_attestation_flag_t imv_attestation_flag_t;
typedef enum imv_attestation_handshake_state_t imv_attestation_handshake_state_t;
typedef enum imv_meas_error_t imv_meas_error_t;
/**
* IMV Attestation Flags set for completed actions
*/
enum imv_attestation_flag_t {
IMV_ATTESTATION_FLAG_ALGO = (1<<0),
IMV_ATTESTATION_FLAG_FILE_MEAS = (1<<1)
};
/**
* IMV Attestation Handshake States (state machine)
*/
@@ -41,7 +50,6 @@ enum imv_attestation_handshake_state_t {
IMV_ATTESTATION_STATE_INIT,
IMV_ATTESTATION_STATE_NONCE_REQ,
IMV_ATTESTATION_STATE_TPM_INIT,
IMV_ATTESTATION_STATE_MEAS,
IMV_ATTESTATION_STATE_COMP_EVID,
IMV_ATTESTATION_STATE_EVID_FINAL,
IMV_ATTESTATION_STATE_END,
@@ -91,34 +99,6 @@ struct imv_attestation_state_t {
*/
pts_t* (*get_pts)(imv_attestation_state_t *this);
/**
* Add an entry to the list of pending file/directory measurement requests
*
* @param file_id primary key into file table
* @param is_dir TRUE if directory
* @return unique request ID
*/
u_int16_t (*add_file_meas_request)(imv_attestation_state_t *this,
int file_id, bool is_dir);
/**
* Returns the number of pending file/directory measurement requests
*
* @return number of pending requests
*/
int (*get_file_meas_request_count)(imv_attestation_state_t *this);
/**
* Check for presence of request_id and if found remove it from the list
*
* @param id unique request ID
* @param file_id primary key into file table
* @param is_dir return TRUE if request was for a directory
* @return TRUE if request ID found, FALSE otherwise
*/
bool (*check_off_file_meas_request)(imv_attestation_state_t *this,
u_int16_t id, int *file_id, bool *is_dir);
/**
* Create and add an entry to the list of Functional Components
*