denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

refactored simple component evidence

Browse Source
This commit is contained in:
Andreas Steffen
2011-11-28 21:22:01 +01:00
parent 21b4efc097
commit cb3ecd5aa5
15 changed files with 851 additions and 839 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libimcv/plugins/imc_attestation/imc_attestation.c
+1 -6
View File
@@ -182,8 +182,6 @@ TNC_Result TNC_IMC_BeginHandshake(TNC_IMCID imc_id,
pa_tnc_msg->destroy(pa_tnc_msg);
}
evidences = linked_list_create();
return result;
}
@@ -202,7 +200,6 @@ TNC_Result TNC_IMC_ReceiveMessage(TNC_IMCID imc_id,
imc_state_t *state;
imc_attestation_state_t *attestation_state;
enumerator_t *enumerator;
pts_t *pts;
TNC_Result result;
if (!imc_attestation)
@@ -217,7 +214,6 @@ TNC_Result TNC_IMC_ReceiveMessage(TNC_IMCID imc_id,
return TNC_RESULT_FATAL;
}
attestation_state = (imc_attestation_state_t*)state;
pts = attestation_state->get_pts(attestation_state);
/* parse received PA-TNC message and automatically handle any errors */
result = imc_attestation->receive_message(imc_attestation, connection_id,
@@ -269,7 +265,7 @@ TNC_Result TNC_IMC_ReceiveMessage(TNC_IMCID imc_id,
else if (attr->get_vendor_id(attr) == PEN_TCG)
{
if (!imc_attestation_process(attr, attr_list, attestation_state,
supported_algorithms, supported_dh_groups, evidences))
supported_algorithms, supported_dh_groups))
{
result = TNC_RESULT_FATAL;
}
@@ -324,7 +320,6 @@ TNC_Result TNC_IMC_Terminate(TNC_IMCID imc_id)
return TNC_RESULT_NOT_INITIALIZED;
}
DESTROY_IF(evidences);
libpts_deinit();
imc_attestation->destroy(imc_attestation);
src/libimcv/plugins/imc_attestation/imc_attestation_process.c
+39 -205
View File
@@ -22,6 +22,8 @@
#include "imc_attestation_process.h"
#include <ietf/ietf_attr_pa_tnc_error.h>
#include <libpts.h>
#include <pts/pts.h>
#include <tcg/tcg_pts_attr_proto_caps.h>
@@ -47,132 +49,10 @@
#define DEFAULT_NONCE_LEN 20
/**
* Set parameters of Simple Component Evidence
*/
static bool set_simple_comp_evid_params(pts_t *pts, pts_comp_func_name_t *name,
u_int8_t sequence, tcg_pts_attr_simple_comp_evid_params_t *out)
{
tcg_pts_attr_simple_comp_evid_params_t params;
time_t measurement_time_t;
struct tm *time_now;
char *utc_time;
params.name = name;
params.pcr_info_included = TRUE;
params.flags = PTS_SIMPLE_COMP_EVID_FLAG_NO_VALID;
params.depth = 0;
/* The measurements done by tboot and trustedGRUB are SHA1 hashes */
params.hash_algorithm = TRUSTED_HASH_ALGO;
params.transformation = PTS_PCR_TRANSFORM_NO;
measurement_time_t = time(NULL);
if (!measurement_time_t)
{
params.measurement_time = chunk_create("0000-00-00T00:00:00Z", 20);
params.measurement_time = chunk_clone(params.measurement_time);
}
else
{
time_now = localtime(&measurement_time_t);
if (asprintf(&utc_time,
"%d-%.2d-%.2dT%.2d:%.2d:%.2dZ",
time_now->tm_year + 1900,
time_now->tm_mon + 1,
time_now->tm_mday,
time_now->tm_hour,
time_now->tm_min,
time_now->tm_sec) < 0)
{
DBG1(DBG_IMC, "could not format local time to UTC");
return FALSE;
}
params.measurement_time = chunk_create(utc_time, 20);
params.measurement_time = chunk_clone(params.measurement_time);
free(utc_time);
}
params.policy_uri = chunk_empty;
/* Provisional/temporal implementation for components except tboot */
if (params.name->get_name(params.name) == PTS_ITA_COMP_FUNC_NAME_TGRUB)
{
params.extended_pcr = PCR_DEBUG;
params.measurement = chunk_alloc(HASH_SIZE_SHA1);
memset(params.measurement.ptr, 0, HASH_SIZE_SHA1);
params.pcr_before = chunk_alloc(PCR_LEN);
memset(params.pcr_before.ptr, 0, PCR_LEN);
if(!pts->read_pcr(pts, params.extended_pcr, &params.pcr_after))
{
DBG1(DBG_IMC, "error occured while reading PCR: %d",
params.extended_pcr);
return FALSE;
}
}
/* Set parameters which varies from component to component */
else if (params.name->get_name(params.name) == PTS_ITA_COMP_FUNC_NAME_TBOOT)
{
char *measurement, *pcr_before, *pcr_after;
if (sequence == 1)
{
params.extended_pcr = PCR_TBOOT_POLICY;
measurement = lib->settings->get_str(lib->settings,
"libimcv.plugins.imc-attestation.pcr17_meas", NULL);
pcr_before = lib->settings->get_str(lib->settings,
"libimcv.plugins.imc-attestation.pcr17_before", NULL);
pcr_after = lib->settings->get_str(lib->settings,
"libimcv.plugins.imc-attestation.pcr17_after", NULL);
}
else
{
params.extended_pcr = PCR_TBOOT_MLE;
measurement = lib->settings->get_str(lib->settings,
"libimcv.plugins.imc-attestation.pcr18_meas", NULL);
pcr_before = lib->settings->get_str(lib->settings,
"libimcv.plugins.imc-attestation.pcr18_before", NULL);
pcr_after = lib->settings->get_str(lib->settings,
"libimcv.plugins.imc-attestation.pcr18_after", NULL);
}
if (!measurement || !pcr_before || !pcr_after)
{
DBG1(DBG_IMC, "tboot: configure measurement, before and after value"
" for PCR%d", params.extended_pcr);
return FALSE;
}
params.measurement = chunk_from_hex(
chunk_create(measurement, strlen(measurement)), NULL);
params.pcr_before = chunk_from_hex(
chunk_create(pcr_before, strlen(pcr_before)), NULL);
params.pcr_after = chunk_from_hex(
chunk_create(pcr_after, strlen(pcr_after)), NULL);
}
else
{
DBG1(DBG_IMC, "unsupported Functional Component Name: Vendor ID: %d"
" Name: %d, Qualifier: %d",
params.name->get_vendor_id(params.name),
params.name->get_name(params.name),
params.name->get_qualifier(params.name));
return FALSE;
}
*out = params;
return TRUE;
}
bool imc_attestation_process(pa_tnc_attr_t *attr, linked_list_t *attr_list,
imc_attestation_state_t *attestation_state,
pts_meas_algorithms_t supported_algorithms,
pts_dh_group_t supported_dh_groups,
linked_list_t *evidences)
pts_dh_group_t supported_dh_groups)
{
chunk_t attr_info;
pts_t *pts;
@@ -441,8 +321,11 @@ bool imc_attestation_process(pa_tnc_attr_t *attr, linked_list_t *attr_list,
tcg_pts_attr_req_func_comp_evid_t *attr_cast;
pts_proto_caps_flag_t negotiated_caps;
pts_comp_func_name_t *name;
pts_comp_evidence_t *evid;
pts_component_t *comp;
u_int32_t depth;
u_int8_t flags;
status_t status;
enumerator_t *e;
attr_info = attr->get_value(attr);
@@ -454,7 +337,7 @@ bool imc_attestation_process(pa_tnc_attr_t *attr, linked_list_t *attr_list,
e = attr_cast->create_enumerator(attr_cast);
while (e->enumerate(e, &flags, &depth, &name))
{
name->log(name, " ");
name->log(name, "* ");
negotiated_caps = pts->get_proto_caps(pts);
if (flags & PTS_REQ_FUNC_COMP_FLAG_TTC)
@@ -488,107 +371,64 @@ bool imc_attestation_process(pa_tnc_attr_t *attr, linked_list_t *attr_list,
attr_list->insert_last(attr_list, attr);
break;
}
if (depth != 0)
if (depth > 0)
{
DBG1(DBG_IMC, "current version of Attestation IMC does not "
"support sub component measurement deeper than "
"zero. Measuring top level component only.");
DBG1(DBG_IMC, "the Attestation IMC currently does not "
"support sub component measurements");
return FALSE;
}
/* Check if Unknown or Wildcard was set for qualifier */
if (name->get_qualifier(name) & PTS_QUALIFIER_WILDCARD)
name = name->clone(name);
comp = pts_components->create(pts_components, name);
if (!comp)
{
DBG2(DBG_IMC, "wildcard was set for the qualifier of functional"
" component. Identifying the component with "
"name binary enumeration");
DBG2(DBG_IMC, " not registered: no evidence provided");
name->destroy(name);
continue;
}
else if (name->get_qualifier(name) & PTS_QUALIFIER_UNKNOWN)
{
DBG2(DBG_IMC, "unknown was set for the qualifier of functional"
" component. Identifying the component with "
"name binary enumeration");
}
else if ((name->get_qualifier(name) >> PTS_ITA_QUALIFIER_TYPE_SIZE)
& PTS_ITA_QUALIFIER_TYPE_TRUSTED)
{
tcg_pts_attr_simple_comp_evid_params_t params;
if (name->get_name(name) == PTS_ITA_COMP_FUNC_NAME_TBOOT)
/* do the component evidence measurement[s] */
do
{
status = comp->measure(comp, pts, &evid);
if (status == FAILED)
{
u_int8_t i;
for (i = 1; i <= TBOOT_SEQUENCE_COUNT; i++)
{
/* Set parameters of Simple Component Evidence */
if (!set_simple_comp_evid_params(pts, name, i, &params))
{
DBG1(DBG_IMC, "error occured while setting "
" parameters for Simple Component Evidence");
return FALSE;
}
/* Buffer Simple Component Evidence attribute */
attr = tcg_pts_attr_simple_comp_evid_create(params);
evidences->insert_last(evidences, attr);
}
break;
}
else
{
/* Set parameters of Simple Component Evidence */
if (!set_simple_comp_evid_params(pts, name, 0, &params))
{
DBG1(DBG_IMC, "error occured while setting parameters"
"for Simple Component Evidence");
return FALSE;
}
/* Buffer Simple Component Evidence attribute */
attr = tcg_pts_attr_simple_comp_evid_create(params);
evidences->insert_last(evidences, attr);
break;
}
attestation_state->add_evidence(attestation_state, evid);
}
else
{
DBG1(DBG_IMC, "Functional Component with unsupported type: %d"
"was requested for evidence",
(name->get_qualifier(name) >> PTS_ITA_QUALIFIER_TYPE_SIZE));
break;
}
while (status == NEED_MORE);
comp->destroy(comp);
}
e->destroy(e);
break;
}
case TCG_PTS_GEN_ATTEST_EVID:
{
enumerator_t *e;
pts_simple_evid_final_flag_t flags;
pts_meas_algorithms_t composite_algorithm = 0;
pts_comp_evidence_t *evidence;
chunk_t pcr_composite, quote_signature;
u_int32_t num_of_evidences, i = 0;
u_int32_t i, evid_count, extended_pcr;
u_int32_t *pcrs;
bool use_quote2;
/* Send buffered Simple Component Evidences */
num_of_evidences = evidences->get_count(evidences);
pcrs = (u_int32_t*)malloc(sizeof(u_int32_t)*num_of_evidences);
evid_count = attestation_state->get_evid_count(attestation_state);
pcrs = (u_int32_t*)malloc(sizeof(u_int32_t)*evid_count);
e = evidences->create_enumerator(evidences);
while (e->enumerate(e, &attr))
for (i = 0; i < evid_count; i++)
{
tcg_pts_attr_simple_comp_evid_t *attr_cast;
u_int32_t extended_pcr;
evidence = attestation_state->next_evidence(attestation_state);
extended_pcr = evidence->get_extended_pcr(evidence);
attr_cast = (tcg_pts_attr_simple_comp_evid_t*)attr;
extended_pcr = attr_cast->get_extended_pcr(attr_cast);
/* Add extended PCR number to PCR list to quote */
/* Duplicated PCR numbers have no influence */
/**
* Add extended PCR number to PCR list to quote
* Duplicated PCR numbers have no influence
*/
pcrs[i] = extended_pcr;
i++;
/* Send Simple Compoenent Evidence */
/* Send Simple Component Evidence */
attr = tcg_pts_attr_simple_comp_evid_create(evidence);
attr_list->insert_last(attr_list, attr);
}
@@ -597,12 +437,10 @@ bool imc_attestation_process(pa_tnc_attr_t *attr, linked_list_t *attr_list,
FALSE : TRUE;
/* Quote */
if (!pts->quote_tpm(pts, use_quote2, pcrs, num_of_evidences,
if (!pts->quote_tpm(pts, use_quote2, pcrs, evid_count,
&pcr_composite, &quote_signature))
{
DBG1(DBG_IMC, "error occured during TPM quote operation");
DESTROY_IF(e);
DESTROY_IF(evidences);
return FALSE;
}
@@ -615,10 +453,6 @@ bool imc_attestation_process(pa_tnc_attr_t *attr, linked_list_t *attr_list,
composite_algorithm, pcr_composite,
quote_signature, chunk_empty);
attr_list->insert_last(attr_list, attr);
DESTROY_IF(e);
DESTROY_IF(evidences);
break;
}
/* TODO: Not implemented yet */
src/libimcv/plugins/imc_attestation/imc_attestation_process.h
+1 -4
View File
@@ -25,7 +25,6 @@
#include "imc_attestation_state.h"
#include <library.h>
#include <utils/linked_list.h>
#include <pa_tnc/pa_tnc_attr.h>
@@ -40,13 +39,11 @@
* @param attestation_state attestation state of a given connection
* @param supported_algorithms supported PTS measurement algorithms
* @param supported_dh_groups supported DH groups
* @param evidences evidence
* @return TRUE if successful
*/
bool imc_attestation_process(pa_tnc_attr_t *attr, linked_list_t *attr_list,
imc_attestation_state_t *attestation_state,
pts_meas_algorithms_t supported_algorithms,
pts_dh_group_t supported_dh_groups,
linked_list_t *evidences);
pts_dh_group_t supported_dh_groups);
#endif /** IMC_ATTESTATION_PROCESS_H_ @}*/
src/libimcv/plugins/imc_attestation/imc_attestation_state.c
+38
View File
@@ -15,6 +15,7 @@
#include "imc_attestation_state.h"
#include <utils/linked_list.h>
#include <debug.h>
typedef struct private_imc_attestation_state_t private_imc_attestation_state_t;
@@ -44,6 +45,11 @@ struct private_imc_attestation_state_t {
*/
pts_t *pts;
/**
* PTS Component Evidence list
*/
linked_list_t *list;
};
METHOD(imc_state_t, get_connection_id, TNC_ConnectionID,
@@ -58,10 +64,12 @@ METHOD(imc_state_t, change_state, void,
this->state = new_state;
}
METHOD(imc_state_t, destroy, void,
private_imc_attestation_state_t *this)
{
this->pts->destroy(this->pts);
this->list->destroy_offset(this->list, offsetof(pts_comp_evidence_t, destroy));
free(this);
}
@@ -71,6 +79,32 @@ METHOD(imc_attestation_state_t, get_pts, pts_t*,
return this->pts;
}
METHOD(imc_attestation_state_t, add_evidence, void,
private_imc_attestation_state_t *this, pts_comp_evidence_t *evidence)
{
this->list->insert_last(this->list, evidence);
}
METHOD(imc_attestation_state_t, get_evid_count, int,
private_imc_attestation_state_t *this)
{
return this->list->get_count(this->list);
}
METHOD(imc_attestation_state_t, next_evidence, pts_comp_evidence_t*,
private_imc_attestation_state_t *this)
{
pts_comp_evidence_t *evidence;
if (this->list->remove_first(this->list, (void**)&evidence) == SUCCESS)
{
return evidence;
}
else
{
return NULL;
}
}
/**
* Described in header.
*/
@@ -87,10 +121,14 @@ imc_state_t *imc_attestation_state_create(TNC_ConnectionID connection_id)
.destroy = _destroy,
},
.get_pts = _get_pts,
.add_evidence = _add_evidence,
.get_evid_count = _get_evid_count,
.next_evidence = _next_evidence,
},
.connection_id = connection_id,
.state = TNC_CONNECTION_STATE_CREATE,
.pts = pts_create(TRUE),
.list = linked_list_create(),
);
platform_info = lib->settings->get_str(lib->settings,
src/libimcv/plugins/imc_attestation/imc_attestation_state.h
+22
View File
@@ -24,6 +24,7 @@
#include <imc/imc_state.h>
#include <pts/pts.h>
#include <pts/components/pts_comp_evidence.h>
#include <library.h>
typedef struct imc_attestation_state_t imc_attestation_state_t;
@@ -45,6 +46,27 @@ struct imc_attestation_state_t {
*/
pts_t* (*get_pts)(imc_attestation_state_t *this);
/**
* Add an entry to the Component Evidence list
*
* @param entry Component Evidence entry
*/
void (*add_evidence)(imc_attestation_state_t *this, pts_comp_evidence_t *entry);
/**
* Get the number of entries in the Component Evidence list
*
* @return number of Component Evidence entries
*/
int (*get_evid_count)(imc_attestation_state_t *this);
/**
* Removes next Component Evidence entry from list and returns it
*
* @return Next Component Evidence entry
*/
pts_comp_evidence_t* (*next_evidence)(imc_attestation_state_t *this);
};
/**
src/libimcv/plugins/imv_attestation/imv_attestation.c
-11
View File
@@ -177,8 +177,6 @@ TNC_Result TNC_IMV_NotifyConnectionChange(TNC_IMVID imv_id,
TNC_ConnectionState new_state)
{
imv_state_t *state;
imv_attestation_state_t *attestation_state;
TNC_Result result;
if (!imv_attestation)
{
@@ -193,15 +191,6 @@ TNC_Result TNC_IMV_NotifyConnectionChange(TNC_IMVID imv_id,
case TNC_CONNECTION_STATE_DELETE:
return imv_attestation->delete_state(imv_attestation, connection_id);
case TNC_CONNECTION_STATE_HANDSHAKE:
result = imv_attestation->change_state(imv_attestation,
connection_id, new_state, &state);
if (result != TNC_RESULT_SUCCESS)
{
return result;
}
attestation_state = (imv_attestation_state_t*)state;
return TNC_RESULT_SUCCESS;
default:
return imv_attestation->change_state(imv_attestation, connection_id,
new_state, NULL);
src/libimcv/plugins/imv_attestation/imv_attestation_process.c
+21 -130
View File
@@ -263,148 +263,39 @@ bool imv_attestation_process(pa_tnc_attr_t *attr, linked_list_t *attr_list,
case TCG_PTS_SIMPLE_COMP_EVID:
{
tcg_pts_attr_simple_comp_evid_t *attr_cast;
bool pcr_info_inclided, component_meas_found = FALSE;
pts_attr_simple_comp_evid_flag_t flags;
u_int32_t depth, extended_pcr;
u_int8_t measurement_type;
pts_comp_func_name_t *name;
pts_component_t *component;
pts_meas_algorithms_t hash_algorithm;
pts_pcr_transform_t transformation;
chunk_t measurement_time, policy_uri;
chunk_t pcr_before, pcr_after, measurement, comp_hash;
enumerator_t *enumerator;
char *platform_info;
pts_comp_evidence_t *evidence;
pts_component_t *comp;
u_int32_t depth;
status_t status;
attr_cast = (tcg_pts_attr_simple_comp_evid_t*)attr;
attr_info = attr->get_value(attr);
evidence = attr_cast->get_comp_evidence(attr_cast);
name = evidence->get_comp_func_name(evidence, &depth);
pcr_info_inclided = attr_cast->is_pcr_info_included(attr_cast);
flags = attr_cast->get_flags(attr_cast);
depth = attr_cast->get_sub_component_depth(attr_cast);
if (depth != 0)
{
DBG1(DBG_IMV, "Current version of Attestation IMV does not"
" support sub component measurement deeper than zero");
}
name = attr_cast->get_comp_func_name(attr_cast);
if (name->get_vendor_id(name) != PEN_ITA)
{
DBG1(DBG_IMV, "Current version of Attestation IMV supports"
"only functional component namings by ITA ");
break;
}
/* Check Family */
if (name->get_qualifier(name) & PTS_SIMPLE_COMP_EVID_FAMILY_MASK)
{
attr = ietf_attr_pa_tnc_error_create(PEN_TCG,
TCG_PTS_INVALID_NAME_FAM, attr_info);
attr_list->insert_last(attr_list, attr);
break;
}
/* Check if Unknown or Wildcard was set for qualifier */
if (name->get_qualifier(name) & PTS_QUALIFIER_WILDCARD)
{
DBG1(DBG_IMV, "Wildcard was set for the qualifier "
"of functional component");
return FALSE;
}
else if (name->get_qualifier(name) & PTS_QUALIFIER_UNKNOWN)
{
DBG1(DBG_IMV, "Unknown feature was set for the qualifier "
"of functional component");
return FALSE;
}
component = attestation_state->check_off_component(attestation_state,
name);
if (!component)
comp = attestation_state->check_off_component(attestation_state, name);
if (!comp)
{
DBG1(DBG_IMV, " no entry found for component evidence request");
evidence->destroy(evidence);
break;
}
component->verify(component);
component->destroy(component);
measurement_type = attr_cast->get_measurement_type(attr_cast);
hash_algorithm = attr_cast->get_hash_algorithm(attr_cast);
transformation = attr_cast->get_pcr_trans(attr_cast);
measurement_time = attr_cast->get_measurement_time(attr_cast);
measurement = attr_cast->get_comp_measurement(attr_cast);
platform_info = pts->get_platform_info(pts);
if (!pts_db || !platform_info)
{
DBG1(DBG_IMV, "%s%s%s not available",
(pts_db) ? "" : "pts database",
(!pts_db && !platform_info) ? "and" : "",
(platform_info) ? "" : "platform info");
break;
}
if (name->get_name(name) != PTS_ITA_COMP_FUNC_NAME_TBOOT &&
name->get_name(name) != PTS_ITA_COMP_FUNC_NAME_TGRUB)
{
DBG1(DBG_IMV, "Unknown functional component name: \"%d\"",
name->get_name(name));
return FALSE;
}
status = comp->verify(comp, pts, pts_db, evidence);
enumerator = pts_db->create_comp_hash_enumerator(pts_db,
platform_info, PTS_MEAS_ALGO_SHA1, name);
if (!enumerator)
switch (status)
{
break;
}
while (enumerator->enumerate(enumerator, &comp_hash))
{
if (chunk_equals(comp_hash, measurement))
{
DBG2(DBG_IMV, "Matching Functional Component Measurement:"
"%B", &measurement);
component_meas_found = TRUE;
default:
case FAILED:
attestation_state->set_measurement_error(attestation_state);
/* fall through to next case */
case SUCCESS:
comp->destroy(comp);
break;
}
case NEED_MORE:
/* re-enter component into list */
attestation_state->add_component(attestation_state, comp);
}
enumerator->destroy(enumerator);
if (!component_meas_found)
{
DBG1(DBG_IMV, "Unmatching Functional Component Measurement:"
"%B, expected: %B", &measurement, &comp_hash);
attestation_state->set_measurement_error(attestation_state);
}
/* Call getters of optional fields when corresponding flag is set */
if (pcr_info_inclided)
{
pcr_entry_t *entry;
extended_pcr = attr_cast->get_extended_pcr(attr_cast);
pcr_before = attr_cast->get_pcr_before_value(attr_cast);
pcr_after = attr_cast->get_pcr_after_value(attr_cast);
DBG3(DBG_IMV,"PCR: %d was extended with %B",
extended_pcr, &measurement);
DBG3(DBG_IMV,"PCR: %d before value: %B",
extended_pcr, &pcr_before);
DBG3(DBG_IMV,"PCR: %d after value: %B",
extended_pcr, &pcr_after);
entry = malloc_thing(pcr_entry_t);
entry->pcr_number = extended_pcr;
memcpy(entry->pcr_value, pcr_after.ptr, PCR_LEN);
pts->add_pcr_entry(pts, entry);
}
if (flags != PTS_SIMPLE_COMP_EVID_FLAG_NO_VALID)
{
policy_uri = attr_cast->get_policy_uri(attr_cast);
DBG1(DBG_IMV, "This version of Attestation IMV can not handle"
" Verification Policies");
}
evidence->destroy(evidence);
break;
}
case TCG_PTS_SIMPLE_EVID_FINAL: