denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Introduced workitems to Scanner IMV

Browse Source
This commit is contained in:
Andreas Steffen
2013-06-21 23:25:24 +02:00
parent adf8a05a3d
commit e5dd8a1d34
7 changed files with 320 additions and 196 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libimcv/imv/data.sql
+1 -1
View File
@@ -689,7 +689,7 @@ INSERT INTO policies ( /* 8 */
INSERT INTO policies ( /* 9 */
type, name, rec_fail, rec_noresult
) VALUES (
12, 'No Open UDP Ports', 1, 1
13, 'No Open UDP Ports', 1, 1
);
INSERT INTO policies ( /* 10 */
src/libimcv/imv/imv_workitem.c
+5 -3
View File
@@ -20,7 +20,7 @@
typedef struct private_imv_workitem_t private_imv_workitem_t;
ENUM(imv_workitem_type_names, IMV_WORKITEM_PACKAGES, IMV_WORKITEM_UDP_SCAN,
ENUM(imv_workitem_type_names, IMV_WORKITEM_PACKAGES, IMV_WORKITEM_UDP_PORT_BLOCK,
"PCKGS",
"UNSRC",
"FWDEN",
@@ -31,8 +31,10 @@ ENUM(imv_workitem_type_names, IMV_WORKITEM_PACKAGES, IMV_WORKITEM_UDP_SCAN,
"DREFM",
"DMEAS",
"DMETA",
"TCPSC",
"UDPSC"
"TCPOP",
"TCPBL",
"UDPOP",
"UDPBL"
);
/**
src/libimcv/imv/imv_workitem.h
+14 -12
View File
@@ -30,18 +30,20 @@ typedef struct imv_workitem_t imv_workitem_t;
typedef enum imv_workitem_type_t imv_workitem_type_t;
enum imv_workitem_type_t {
IMV_WORKITEM_PACKAGES = 1,
IMV_WORKITEM_UNKNOWN_SOURCE = 2,
IMV_WORKITEM_FORWARDING = 3,
IMV_WORKITEM_DEFAULT_PWD = 4,
IMV_WORKITEM_FILE_REF_MEAS = 5,
IMV_WORKITEM_FILE_MEAS = 6,
IMV_WORKITEM_FILE_META = 7,
IMV_WORKITEM_DIR_REF_MEAS = 8,
IMV_WORKITEM_DIR_MEAS = 9,
IMV_WORKITEM_DIR_META = 10,
IMV_WORKITEM_TCP_SCAN = 11,
IMV_WORKITEM_UDP_SCAN = 12
IMV_WORKITEM_PACKAGES = 1,
IMV_WORKITEM_UNKNOWN_SOURCE = 2,
IMV_WORKITEM_FORWARDING = 3,
IMV_WORKITEM_DEFAULT_PWD = 4,
IMV_WORKITEM_FILE_REF_MEAS = 5,
IMV_WORKITEM_FILE_MEAS = 6,
IMV_WORKITEM_FILE_META = 7,
IMV_WORKITEM_DIR_REF_MEAS = 8,
IMV_WORKITEM_DIR_MEAS = 9,
IMV_WORKITEM_DIR_META = 10,
IMV_WORKITEM_TCP_PORT_OPEN = 11,
IMV_WORKITEM_TCP_PORT_BLOCK = 12,
IMV_WORKITEM_UDP_PORT_OPEN = 13,
IMV_WORKITEM_UDP_PORT_BLOCK = 14
};
extern enum_name_t *imv_workitem_type_names;
src/libimcv/plugins/imv_os/imv_os_agent.c
+2 -1
View File
@@ -396,6 +396,7 @@ static TNC_Result receive_msg(private_imv_os_agent_t *this, imv_state_t *state,
if (assessment)
{
os_state->set_handshake_state(os_state, IMV_OS_STATE_END);
result = out_msg->send_assessment(out_msg);
out_msg->destroy(out_msg);
if (result != TNC_RESULT_SUCCESS)
@@ -601,7 +602,6 @@ METHOD(imv_agent_if_t, batch_ending, TNC_Result,
{
continue;
}
no_workitems = FALSE;
switch (workitem->get_type(workitem))
{
@@ -621,6 +621,7 @@ METHOD(imv_agent_if_t, batch_ending, TNC_Result,
continue;
}
workitem->set_imv_id(workitem, imv_id);
no_workitems = FALSE;
}
enumerator->destroy(enumerator);
src/libimcv/plugins/imv_scanner/imv_scanner_agent.c
+257 -177
View File
@@ -16,6 +16,7 @@
#include "imv_scanner_agent.h"
#include "imv_scanner_state.h"
#include <imcv.h>
#include <imv/imv_agent.h>
#include <imv/imv_msg.h>
#include <ietf/ietf_attr.h>
@@ -37,86 +38,6 @@ static pen_type_t msg_types[] = {
{ PEN_IETF, PA_SUBTYPE_IETF_VPN }
};
/**
* Flag set when corresponding attribute has been received
*/
typedef enum imv_scanner_attr_t imv_scanner_attr_t;
enum imv_scanner_attr_t {
IMV_SCANNER_ATTR_PORT_FILTER = (1<<0)
};
typedef struct port_range_t port_range_t;
struct port_range_t {
u_int16_t start, stop;
};
/**
* Default port policy
*
* TRUE: all server ports on the TNC client must be closed
* FALSE: any server port on the TNC client is allowed to be open
*/
static bool closed_port_policy = TRUE;
/**
* List of TCP and UDP port ranges
*
* TRUE: server ports on the TNC client that are allowed to be open
* FALSE: server ports on the TNC client that must be closed
*/
static linked_list_t *tcp_ports, *udp_ports;
/**
* Get a TCP or UDP port list from strongswan.conf
*/
static linked_list_t* get_port_list(char *label)
{
char key[40], *value;
linked_list_t *list;
chunk_t port_list, port_item, port_start;
port_range_t *port_range;
list = linked_list_create();
snprintf(key, sizeof(key), "libimcv.plugins.imv-scanner.%s_ports", label);
value = lib->settings->get_str(lib->settings, key, NULL);
if (!value)
{
DBG1(DBG_IMV, "%s not defined", key);
return list;
}
port_list = chunk_create(value, strlen(value));
DBG2(DBG_IMV, "list of %s ports that %s:", label,
closed_port_policy ? "are allowed to be open" : "must be closed");
while (eat_whitespace(&port_list))
{
if (!extract_token(&port_item, ' ', &port_list))
{
/* reached last port item */
port_item = port_list;
port_list = chunk_empty;
}
port_range = malloc_thing(port_range_t);
port_range->start = atoi(port_item.ptr);
if (extract_token(&port_start, '-', &port_item) && port_item.len)
{
port_range->stop = atoi(port_item.ptr);
}
else
{
port_range->stop = port_range->start;
}
DBG2(DBG_IMV, "%5u - %5u", port_range->start, port_range->stop);
list->insert_last(list, port_range);
}
return list;
}
/**
* Private data of an imv_scanner_agent_t object.
*/
@@ -165,10 +86,12 @@ static TNC_Result receive_msg(private_imv_scanner_agent_t *this,
imv_state_t *state, imv_msg_t *in_msg)
{
imv_msg_t *out_msg;
imv_scanner_state_t *scanner_state;
enumerator_t *enumerator;
pa_tnc_attr_t *attr;
pen_type_t type;
TNC_Result result;
ietf_attr_port_filter_t *port_filter_attr;
bool fatal_error = FALSE;
/* parse received PA-TNC message and handle local and remote errors */
@@ -186,70 +109,9 @@ static TNC_Result receive_msg(private_imv_scanner_agent_t *this,
if (type.vendor_id == PEN_IETF && type.type == IETF_ATTR_PORT_FILTER)
{
imv_scanner_state_t *scanner_state;
ietf_attr_port_filter_t *attr_port_filter;
enumerator_t *enumerator;
u_int8_t protocol;
u_int16_t port;
bool blocked, compliant = TRUE;
state->set_action_flags(state, IMV_SCANNER_ATTR_PORT_FILTER);
scanner_state = (imv_scanner_state_t*)state;
attr_port_filter = (ietf_attr_port_filter_t*)attr;
enumerator = attr_port_filter->create_port_enumerator(attr_port_filter);
while (enumerator->enumerate(enumerator, &blocked, &protocol, &port))
{
enumerator_t *e;
port_range_t *port_range;
bool passed, found = FALSE;
char buf[20];
if (blocked)
{
/* ignore closed ports */
continue;
}
e = (protocol == IPPROTO_TCP) ?
tcp_ports->create_enumerator(tcp_ports) :
udp_ports->create_enumerator(udp_ports);
while (e->enumerate(e, &port_range))
{
if (port >= port_range->start && port <= port_range->stop)
{
found = TRUE;
break;
}
}
e->destroy(e);
passed = (closed_port_policy == found);
DBG2(DBG_IMV, "%s port %5u %s: %s",
(protocol == IPPROTO_TCP) ? "tcp" : "udp", port,
blocked ? "closed" : "open", passed ? "ok" : "fatal");
if (!passed)
{
compliant = FALSE;
snprintf(buf, sizeof(buf), "%s/%u",
(protocol == IPPROTO_TCP) ? "tcp" : "udp", port);
scanner_state->add_violating_port(scanner_state, strdup(buf));
}
}
enumerator->destroy(enumerator);
if (compliant)
{
state->set_recommendation(state,
TNC_IMV_ACTION_RECOMMENDATION_ALLOW,
TNC_IMV_EVALUATION_RESULT_COMPLIANT);
}
else
{
state->set_recommendation(state,
TNC_IMV_ACTION_RECOMMENDATION_NO_ACCESS,
TNC_IMV_EVALUATION_RESULT_NONCOMPLIANT_MAJOR);
}
port_filter_attr = (ietf_attr_port_filter_t*)attr->get_ref(attr);
scanner_state->set_port_filter_attr(scanner_state, port_filter_attr);
}
}
enumerator->destroy(enumerator);
@@ -259,16 +121,17 @@ static TNC_Result receive_msg(private_imv_scanner_agent_t *this,
state->set_recommendation(state,
TNC_IMV_ACTION_RECOMMENDATION_NO_RECOMMENDATION,
TNC_IMV_EVALUATION_RESULT_ERROR);
out_msg = imv_msg_create_as_reply(in_msg);
result = out_msg->send_assessment(out_msg);
out_msg->destroy(out_msg);
if (result != TNC_RESULT_SUCCESS)
{
return result;
}
return this->agent->provide_recommendation(this->agent, state);
}
out_msg = imv_msg_create_as_reply(in_msg);
result = out_msg->send_assessment(out_msg);
out_msg->destroy(out_msg);
if (result != TNC_RESULT_SUCCESS)
{
return result;
}
return this->agent->provide_recommendation(this->agent, state);
return TNC_RESULT_SUCCESS;
}
METHOD(imv_agent_if_t, receive_message, TNC_Result,
@@ -312,33 +175,262 @@ METHOD(imv_agent_if_t, receive_message_long, TNC_Result,
}
typedef struct port_range_t port_range_t;
struct port_range_t {
u_int16_t start, stop;
};
/**
* Parse a TCP or UDP port list from an argument string
*/
static linked_list_t* get_port_list(u_int8_t protocol_family,
bool closed_port_policy, char *arg_str)
{
chunk_t port_list, port_item, port_start;
port_range_t *port_range;
linked_list_t *list;
list = linked_list_create();
port_list = chunk_from_str(arg_str);
DBG2(DBG_IMV, "list of %s ports that %s:",
(protocol_family == IPPROTO_TCP) ? "tcp" : "udp",
closed_port_policy ? "are allowed to be open" : "must be closed");
while (eat_whitespace(&port_list))
{
if (!extract_token(&port_item, ' ', &port_list))
{
/* reached last port item */
port_item = port_list;
port_list = chunk_empty;
}
port_range = malloc_thing(port_range_t);
port_range->start = atoi(port_item.ptr);
if (extract_token(&port_start, '-', &port_item) && port_item.len)
{
port_range->stop = atoi(port_item.ptr);
}
else
{
port_range->stop = port_range->start;
}
DBG2(DBG_IMV, "%5u - %5u", port_range->start, port_range->stop);
list->insert_last(list, port_range);
}
return list;
}
METHOD(imv_agent_if_t, batch_ending, TNC_Result,
private_imv_scanner_agent_t *this, TNC_ConnectionID id)
{
imv_state_t *state;
imv_msg_t *out_msg;
imv_state_t *state;
imv_session_t *session;
imv_workitem_t *workitem;
imv_scanner_state_t *scanner_state;
imv_scanner_handshake_state_t handshake_state;
pa_tnc_attr_t *attr;
TNC_IMV_Action_Recommendation rec;
TNC_IMV_Evaluation_Result eval;
ietf_attr_port_filter_t *port_filter_attr;
TNC_IMVID imv_id;
TNC_Result result = TNC_RESULT_SUCCESS;
bool no_workitems = TRUE;
enumerator_t *enumerator;
if (!this->agent->get_state(this->agent, id, &state))
{
return TNC_RESULT_FATAL;
}
state->get_recommendation(state, &rec, &eval);
if (rec == TNC_IMV_ACTION_RECOMMENDATION_NO_RECOMMENDATION)
{
out_msg = imv_msg_create(this->agent, state, id,
this->agent->get_id(this->agent),
TNC_IMCID_ANY, msg_types[0]);
attr = ietf_attr_attr_request_create(PEN_IETF, IETF_ATTR_PORT_FILTER);
out_msg->add_attribute(out_msg, attr);
scanner_state = (imv_scanner_state_t*)state;
handshake_state = scanner_state->get_handshake_state(scanner_state);
port_filter_attr = scanner_state->get_port_filter_attr(scanner_state);
session = state->get_session(state);
imv_id = this->agent->get_id(this->agent);
/* send PA-TNC message with excl flag not set */
result = out_msg->send(out_msg, FALSE);
out_msg->destroy(out_msg);
if (handshake_state == IMV_SCANNER_STATE_END)
{
return TNC_RESULT_SUCCESS;
}
if (!session)
{
DBG2(DBG_IMV, "no workitems available - no evaluation possible");
state->set_recommendation(state,
TNC_IMV_ACTION_RECOMMENDATION_ALLOW,
TNC_IMV_EVALUATION_RESULT_DONT_KNOW);
scanner_state->set_handshake_state(scanner_state,
IMV_SCANNER_STATE_END);
return TNC_RESULT_SUCCESS;
}
/* create an empty out message - we might need it */
out_msg = imv_msg_create(this->agent, state, id, imv_id, TNC_IMCID_ANY,
msg_types[0]);
if (handshake_state == IMV_SCANNER_STATE_INIT)
{
enumerator = session->create_workitem_enumerator(session);
if (enumerator)
{
while (enumerator->enumerate(enumerator, &workitem))
{
if (workitem->get_imv_id(workitem) != TNC_IMVID_ANY)
{
continue;
}
switch (workitem->get_type(workitem))
{
case IMV_WORKITEM_TCP_PORT_OPEN:
case IMV_WORKITEM_TCP_PORT_BLOCK:
case IMV_WORKITEM_UDP_PORT_OPEN:
case IMV_WORKITEM_UDP_PORT_BLOCK:
if (!port_filter_attr &&
handshake_state != IMV_SCANNER_STATE_ATTR_REQ)
{
attr = ietf_attr_attr_request_create(PEN_IETF,
IETF_ATTR_PORT_FILTER);
out_msg->add_attribute(out_msg, attr);
handshake_state = IMV_SCANNER_STATE_ATTR_REQ;
}
break;
default:
continue;
}
workitem->set_imv_id(workitem, imv_id);
no_workitems = FALSE;
}
enumerator->destroy(enumerator);
if (no_workitems)
{
DBG2(DBG_IMV, "IMV %d has no workitems - "
"no evaluation requested", imv_id);
state->set_recommendation(state,
TNC_IMV_ACTION_RECOMMENDATION_ALLOW,
TNC_IMV_EVALUATION_RESULT_DONT_KNOW);
}
handshake_state = IMV_SCANNER_STATE_WORKITEMS;
scanner_state->set_handshake_state(scanner_state, handshake_state);
}
}
if (handshake_state == IMV_SCANNER_STATE_WORKITEMS && port_filter_attr)
{
TNC_IMV_Evaluation_Result eval;
TNC_IMV_Action_Recommendation rec;
u_int8_t protocol_family, protocol;
u_int16_t port;
bool closed_port_policy, blocked;
linked_list_t *port_list;
enumerator_t *e1, *e2;
enumerator = session->create_workitem_enumerator(session);
while (enumerator->enumerate(enumerator, &workitem))
{
if (workitem->get_imv_id(workitem) != imv_id)
{
continue;
}
eval = TNC_IMV_EVALUATION_RESULT_COMPLIANT;
switch (workitem->get_type(workitem))
{
case IMV_WORKITEM_TCP_PORT_OPEN:
protocol_family = IPPROTO_TCP;
closed_port_policy = TRUE;
break;
case IMV_WORKITEM_TCP_PORT_BLOCK:
protocol_family = IPPROTO_TCP;
closed_port_policy = FALSE;
break;
case IMV_WORKITEM_UDP_PORT_OPEN:
protocol_family = IPPROTO_UDP;
closed_port_policy = TRUE;
break;
case IMV_WORKITEM_UDP_PORT_BLOCK:
protocol_family = IPPROTO_UDP;
closed_port_policy = FALSE;
break;
default:
continue;
}
port_list = get_port_list(protocol_family, closed_port_policy,
workitem->get_arg_str(workitem));
e1 = port_filter_attr->create_port_enumerator(port_filter_attr);
while (e1->enumerate(e1, &blocked, &protocol, &port))
{
port_range_t *port_range;
bool passed, found = FALSE;
char buf[20];
if (blocked)
{
/* ignore closed ports */
continue;
}
e2 = port_list->create_enumerator(port_list);
while (e2->enumerate(e2, &port_range))
{
if (port >= port_range->start && port <= port_range->stop)
{
found = TRUE;
break;
}
}
e2->destroy(e2);
passed = (closed_port_policy == found);
DBG2(DBG_IMV, "%s port %5u open: %s",
(protocol == IPPROTO_TCP) ? "tcp" : "udp", port,
passed ? "ok" : "fatal");
if (!passed)
{
eval = TNC_IMV_EVALUATION_RESULT_NONCOMPLIANT_MINOR;
snprintf(buf, sizeof(buf), "%s/%u",
(protocol == IPPROTO_TCP) ? "tcp" : "udp", port);
scanner_state->add_violating_port(scanner_state, strdup(buf));
}
}
e1->destroy(e1);
port_list->destroy(port_list);
session->remove_workitem(session, enumerator);
rec = workitem->set_result(workitem, "", eval);
state->update_recommendation(state, rec, eval);
imcv_db->finalize_workitem(imcv_db, workitem);
workitem->destroy(workitem);
}
enumerator->destroy(enumerator);
/* finalized all workitems ? */
if (session->get_workitem_count(session, imv_id) == 0)
{
scanner_state->set_handshake_state(scanner_state,
IMV_SCANNER_STATE_END);
result = out_msg->send_assessment(out_msg);
out_msg->destroy(out_msg);
if (result != TNC_RESULT_SUCCESS)
{
return result;
}
return this->agent->provide_recommendation(this->agent, state);
}
}
/* send non-empty PA-TNC message with excl flag not set */
if (out_msg->get_attribute_count(out_msg))
{
result = out_msg->send(out_msg, FALSE);
}
out_msg->destroy(out_msg);
return result;
}
@@ -357,8 +449,6 @@ METHOD(imv_agent_if_t, solicit_recommendation, TNC_Result,
METHOD(imv_agent_if_t, destroy, void,
private_imv_scanner_agent_t *this)
{
tcp_ports->destroy_function(tcp_ports, free);
udp_ports->destroy_function(udp_ports, free);
this->agent->destroy(this->agent);
free(this);
}
@@ -392,16 +482,6 @@ imv_agent_if_t *imv_scanner_agent_create(const char *name, TNC_IMVID id,
.agent = agent,
);
/* set the default port policy to closed (TRUE) or open (FALSE) */
closed_port_policy = lib->settings->get_bool(lib->settings,
"libimcv.plugins.imv-scanner.closed_port_policy", TRUE);
DBG2(DBG_IMV, "default port policy is %s ports",
closed_port_policy ? "closed" : "open");
/* get the list of open|closed ports */
tcp_ports = get_port_list("tcp");
udp_ports = get_port_list("udp");
return &this->public;
}
src/libimcv/plugins/imv_scanner/imv_scanner_state.c
+21
View File
@@ -95,6 +95,11 @@ struct private_imv_scanner_state_t {
*/
imv_scanner_handshake_state_t handshake_state;
/**
* Copy of the received IEEE Port Filter attribute
*/
ietf_attr_port_filter_t *port_filter_attr;
/**
* List with ports that should be closed
*/
@@ -317,6 +322,7 @@ METHOD(imv_state_t, destroy, void,
DESTROY_IF(this->session);
DESTROY_IF(this->reason_string);
DESTROY_IF(this->remediation_string);
DESTROY_IF(&this->port_filter_attr->pa_tnc_attribute);
this->violating_ports->destroy_function(this->violating_ports, free);
free(this->ar_id_value.ptr);
free(this);
@@ -334,6 +340,19 @@ METHOD(imv_scanner_state_t, get_handshake_state, imv_scanner_handshake_state_t,
return this->handshake_state;
}
METHOD(imv_scanner_state_t, set_port_filter_attr, void,
private_imv_scanner_state_t *this, ietf_attr_port_filter_t *attr)
{
DESTROY_IF(&this->port_filter_attr->pa_tnc_attribute);
this->port_filter_attr = attr;
}
METHOD(imv_scanner_state_t, get_port_filter_attr, ietf_attr_port_filter_t*,
private_imv_scanner_state_t *this)
{
return this->port_filter_attr;
}
METHOD(imv_scanner_state_t, add_violating_port, void,
private_imv_scanner_state_t *this, char *port)
{
@@ -372,6 +391,8 @@ imv_state_t *imv_scanner_state_create(TNC_ConnectionID connection_id)
},
.set_handshake_state = _set_handshake_state,
.get_handshake_state = _get_handshake_state,
.set_port_filter_attr = _set_port_filter_attr,
.get_port_filter_attr = _get_port_filter_attr,
.add_violating_port = _add_violating_port,
},
.state = TNC_CONNECTION_STATE_CREATE,
src/libimcv/plugins/imv_scanner/imv_scanner_state.h
+20 -2
View File
@@ -25,6 +25,8 @@
#define IMV_SCANNER_STATE_H_
#include <imv/imv_state.h>
#include <ietf/ietf_attr_port_filter.h>
#include <library.h>
typedef struct imv_scanner_state_t imv_scanner_state_t;
@@ -35,8 +37,9 @@ typedef enum imv_scanner_handshake_state_t imv_scanner_handshake_state_t;
*/
enum imv_scanner_handshake_state_t {
IMV_SCANNER_STATE_INIT,
IMV_SCANNER_STATE_POLICY_START,
IMV_SCANNER_STATE_WORKITEMS
IMV_SCANNER_STATE_ATTR_REQ,
IMV_SCANNER_STATE_WORKITEMS,
IMV_SCANNER_STATE_END
};
/**
@@ -64,6 +67,21 @@ struct imv_scanner_state_t {
*/
imv_scanner_handshake_state_t (*get_handshake_state)(imv_scanner_state_t *this);
/**
* Store an IETF Port Filter attribute for later evaluation
*
* @param attr IETF Port Filter attribute
*/
void (*set_port_filter_attr)(imv_scanner_state_t *this,
ietf_attr_port_filter_t *attr);
/**
* Get the stored IETF Port Filter attribute
*
* @return IETF Port Filter attribute
*/
ietf_attr_port_filter_t* (*get_port_filter_attr)(imv_scanner_state_t *this);
/**
* add a violating TCP or UDP port
*/