diff options
Diffstat (limited to 'src/libimcv/plugins/imv_scanner')
| -rw-r--r-- | src/libimcv/plugins/imv_scanner/Makefile.am | 13 | ||||
| -rw-r--r-- | src/libimcv/plugins/imv_scanner/Makefile.in | 87 | ||||
| -rw-r--r-- | src/libimcv/plugins/imv_scanner/imv_scanner.c | 430 | ||||
| -rw-r--r-- | src/libimcv/plugins/imv_scanner/imv_scanner_agent.c | 526 | ||||
| -rw-r--r-- | src/libimcv/plugins/imv_scanner/imv_scanner_agent.h | 36 | ||||
| -rw-r--r-- | src/libimcv/plugins/imv_scanner/imv_scanner_state.c | 103 | ||||
| -rw-r--r-- | src/libimcv/plugins/imv_scanner/imv_scanner_state.h | 46 |
7 files changed, 778 insertions, 463 deletions
diff --git a/src/libimcv/plugins/imv_scanner/Makefile.am b/src/libimcv/plugins/imv_scanner/Makefile.am index df2158e72..625e62316 100644 --- a/src/libimcv/plugins/imv_scanner/Makefile.am +++ b/src/libimcv/plugins/imv_scanner/Makefile.am @@ -1,15 +1,18 @@ - -INCLUDES = -I$(top_srcdir)/src/libstrongswan -I$(top_srcdir)/src/libtncif \ +AM_CPPFLAGS = \ + -I$(top_srcdir)/src/libstrongswan \ + -I$(top_srcdir)/src/libtncif \ -I$(top_srcdir)/src/libimcv -AM_CFLAGS = -rdynamic +AM_CFLAGS = \ + -rdynamic imcv_LTLIBRARIES = imv-scanner.la imv_scanner_la_LIBADD = $(top_builddir)/src/libimcv/libimcv.la \ $(top_builddir)/src/libstrongswan/libstrongswan.la -imv_scanner_la_SOURCES = imv_scanner.c imv_scanner_state.h imv_scanner_state.c +imv_scanner_la_SOURCES = \ + imv_scanner.c imv_scanner_state.h imv_scanner_state.c \ + imv_scanner_agent.h imv_scanner_agent.c imv_scanner_la_LDFLAGS = -module -avoid-version - diff --git a/src/libimcv/plugins/imv_scanner/Makefile.in b/src/libimcv/plugins/imv_scanner/Makefile.in index cfd4463a2..e336b86bb 100644 --- a/src/libimcv/plugins/imv_scanner/Makefile.in +++ b/src/libimcv/plugins/imv_scanner/Makefile.in @@ -62,7 +62,7 @@ am__aclocal_m4_deps = $(top_srcdir)/m4/config/libtool.m4 \ $(top_srcdir)/m4/macros/with.m4 \ $(top_srcdir)/m4/macros/enable-disable.m4 \ $(top_srcdir)/m4/macros/add-plugin.m4 \ - $(top_srcdir)/configure.in + $(top_srcdir)/configure.ac am__configure_deps = $(am__aclocal_m4_deps) $(CONFIGURE_DEPENDENCIES) \ $(ACLOCAL_M4) mkinstalldirs = $(install_sh) -d @@ -100,24 +100,42 @@ am__installdirs = "$(DESTDIR)$(imcvdir)" LTLIBRARIES = $(imcv_LTLIBRARIES) imv_scanner_la_DEPENDENCIES = $(top_builddir)/src/libimcv/libimcv.la \ $(top_builddir)/src/libstrongswan/libstrongswan.la -am_imv_scanner_la_OBJECTS = imv_scanner.lo imv_scanner_state.lo +am_imv_scanner_la_OBJECTS = imv_scanner.lo imv_scanner_state.lo \ + imv_scanner_agent.lo imv_scanner_la_OBJECTS = $(am_imv_scanner_la_OBJECTS) -imv_scanner_la_LINK = $(LIBTOOL) --tag=CC $(AM_LIBTOOLFLAGS) \ - $(LIBTOOLFLAGS) --mode=link $(CCLD) $(AM_CFLAGS) $(CFLAGS) \ - $(imv_scanner_la_LDFLAGS) $(LDFLAGS) -o $@ +AM_V_lt = $(am__v_lt_@AM_V@) +am__v_lt_ = $(am__v_lt_@AM_DEFAULT_V@) +am__v_lt_0 = --silent +imv_scanner_la_LINK = $(LIBTOOL) $(AM_V_lt) --tag=CC \ + $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=link $(CCLD) \ + $(AM_CFLAGS) $(CFLAGS) $(imv_scanner_la_LDFLAGS) $(LDFLAGS) -o \ + $@ DEFAULT_INCLUDES = -I.@am__isrc@ -I$(top_builddir) depcomp = $(SHELL) $(top_srcdir)/depcomp am__depfiles_maybe = depfiles am__mv = mv -f COMPILE = $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) \ $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -LTCOMPILE = $(LIBTOOL) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) \ - --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) \ - $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) +LTCOMPILE = $(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) \ + $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) \ + $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) \ + $(AM_CFLAGS) $(CFLAGS) +AM_V_CC = $(am__v_CC_@AM_V@) +am__v_CC_ = $(am__v_CC_@AM_DEFAULT_V@) +am__v_CC_0 = @echo " CC " $@; +AM_V_at = $(am__v_at_@AM_V@) +am__v_at_ = $(am__v_at_@AM_DEFAULT_V@) +am__v_at_0 = @ CCLD = $(CC) -LINK = $(LIBTOOL) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) \ - --mode=link $(CCLD) $(AM_CFLAGS) $(CFLAGS) $(AM_LDFLAGS) \ - $(LDFLAGS) -o $@ +LINK = $(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) \ + $(LIBTOOLFLAGS) --mode=link $(CCLD) $(AM_CFLAGS) $(CFLAGS) \ + $(AM_LDFLAGS) $(LDFLAGS) -o $@ +AM_V_CCLD = $(am__v_CCLD_@AM_V@) +am__v_CCLD_ = $(am__v_CCLD_@AM_DEFAULT_V@) +am__v_CCLD_0 = @echo " CCLD " $@; +AM_V_GEN = $(am__v_GEN_@AM_V@) +am__v_GEN_ = $(am__v_GEN_@AM_DEFAULT_V@) +am__v_GEN_0 = @echo " GEN " $@; SOURCES = $(imv_scanner_la_SOURCES) DIST_SOURCES = $(imv_scanner_la_SOURCES) am__can_run_installinfo = \ @@ -131,6 +149,7 @@ DISTFILES = $(DIST_COMMON) $(DIST_SOURCES) $(TEXINFOS) $(EXTRA_DIST) ACLOCAL = @ACLOCAL@ ALLOCA = @ALLOCA@ AMTAR = @AMTAR@ +AM_DEFAULT_VERBOSITY = @AM_DEFAULT_VERBOSITY@ AR = @AR@ AUTOCONF = @AUTOCONF@ AUTOHEADER = @AUTOHEADER@ @@ -143,6 +162,8 @@ CCDEPMODE = @CCDEPMODE@ CFLAGS = @CFLAGS@ CHECK_CFLAGS = @CHECK_CFLAGS@ CHECK_LIBS = @CHECK_LIBS@ +COVERAGE_CFLAGS = @COVERAGE_CFLAGS@ +COVERAGE_LDFLAGS = @COVERAGE_LDFLAGS@ CPP = @CPP@ CPPFLAGS = @CPPFLAGS@ CYGPATH_W = @CYGPATH_W@ @@ -158,6 +179,7 @@ ECHO_T = @ECHO_T@ EGREP = @EGREP@ EXEEXT = @EXEEXT@ FGREP = @FGREP@ +GENHTML = @GENHTML@ GPERF = @GPERF@ GPRBUILD = @GPRBUILD@ GREP = @GREP@ @@ -166,6 +188,7 @@ INSTALL_DATA = @INSTALL_DATA@ INSTALL_PROGRAM = @INSTALL_PROGRAM@ INSTALL_SCRIPT = @INSTALL_SCRIPT@ INSTALL_STRIP_PROGRAM = @INSTALL_STRIP_PROGRAM@ +LCOV = @LCOV@ LD = @LD@ LDFLAGS = @LDFLAGS@ LEX = @LEX@ @@ -212,6 +235,7 @@ SET_MAKE = @SET_MAKE@ SHELL = @SHELL@ SOCKLIB = @SOCKLIB@ STRIP = @STRIP@ +UNWINDLIB = @UNWINDLIB@ VERSION = @VERSION@ YACC = @YACC@ YFLAGS = @YFLAGS@ @@ -240,6 +264,7 @@ charon_natt_port = @charon_natt_port@ charon_plugins = @charon_plugins@ charon_udp_port = @charon_udp_port@ clearsilver_LIBS = @clearsilver_LIBS@ +cmd_plugins = @cmd_plugins@ datadir = @datadir@ datarootdir = @datarootdir@ dbusservicedir = @dbusservicedir@ @@ -317,15 +342,22 @@ top_srcdir = @top_srcdir@ urandom_device = @urandom_device@ xml_CFLAGS = @xml_CFLAGS@ xml_LIBS = @xml_LIBS@ -INCLUDES = -I$(top_srcdir)/src/libstrongswan -I$(top_srcdir)/src/libtncif \ +AM_CPPFLAGS = \ + -I$(top_srcdir)/src/libstrongswan \ + -I$(top_srcdir)/src/libtncif \ -I$(top_srcdir)/src/libimcv -AM_CFLAGS = -rdynamic +AM_CFLAGS = \ + -rdynamic + imcv_LTLIBRARIES = imv-scanner.la imv_scanner_la_LIBADD = $(top_builddir)/src/libimcv/libimcv.la \ $(top_builddir)/src/libstrongswan/libstrongswan.la -imv_scanner_la_SOURCES = imv_scanner.c imv_scanner_state.h imv_scanner_state.c +imv_scanner_la_SOURCES = \ + imv_scanner.c imv_scanner_state.h imv_scanner_state.c \ + imv_scanner_agent.h imv_scanner_agent.c + imv_scanner_la_LDFLAGS = -module -avoid-version all: all-am @@ -394,7 +426,7 @@ clean-imcvLTLIBRARIES: rm -f "$${dir}/so_locations"; \ done imv-scanner.la: $(imv_scanner_la_OBJECTS) $(imv_scanner_la_DEPENDENCIES) $(EXTRA_imv_scanner_la_DEPENDENCIES) - $(imv_scanner_la_LINK) -rpath $(imcvdir) $(imv_scanner_la_OBJECTS) $(imv_scanner_la_LIBADD) $(LIBS) + $(AM_V_CCLD)$(imv_scanner_la_LINK) -rpath $(imcvdir) $(imv_scanner_la_OBJECTS) $(imv_scanner_la_LIBADD) $(LIBS) mostlyclean-compile: -rm -f *.$(OBJEXT) @@ -403,28 +435,29 @@ distclean-compile: -rm -f *.tab.c @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/imv_scanner.Plo@am__quote@ +@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/imv_scanner_agent.Plo@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/imv_scanner_state.Plo@am__quote@ .c.o: -@am__fastdepCC_TRUE@ $(COMPILE) -MT $@ -MD -MP -MF $(DEPDIR)/$*.Tpo -c -o $@ $< -@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Po -@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='$<' object='$@' libtool=no @AMDEPBACKSLASH@ +@am__fastdepCC_TRUE@ $(AM_V_CC)$(COMPILE) -MT $@ -MD -MP -MF $(DEPDIR)/$*.Tpo -c -o $@ $< +@am__fastdepCC_TRUE@ $(AM_V_at)$(am__mv) $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Po +@AMDEP_TRUE@@am__fastdepCC_FALSE@ $(AM_V_CC)source='$<' object='$@' libtool=no @AMDEPBACKSLASH@ @AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@ -@am__fastdepCC_FALSE@ $(COMPILE) -c $< +@am__fastdepCC_FALSE@ $(AM_V_CC@am__nodep@)$(COMPILE) -c $< .c.obj: -@am__fastdepCC_TRUE@ $(COMPILE) -MT $@ -MD -MP -MF $(DEPDIR)/$*.Tpo -c -o $@ `$(CYGPATH_W) '$<'` -@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Po -@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='$<' object='$@' libtool=no @AMDEPBACKSLASH@ +@am__fastdepCC_TRUE@ $(AM_V_CC)$(COMPILE) -MT $@ -MD -MP -MF $(DEPDIR)/$*.Tpo -c -o $@ `$(CYGPATH_W) '$<'` +@am__fastdepCC_TRUE@ $(AM_V_at)$(am__mv) $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Po +@AMDEP_TRUE@@am__fastdepCC_FALSE@ $(AM_V_CC)source='$<' object='$@' libtool=no @AMDEPBACKSLASH@ @AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@ -@am__fastdepCC_FALSE@ $(COMPILE) -c `$(CYGPATH_W) '$<'` +@am__fastdepCC_FALSE@ $(AM_V_CC@am__nodep@)$(COMPILE) -c `$(CYGPATH_W) '$<'` .c.lo: -@am__fastdepCC_TRUE@ $(LTCOMPILE) -MT $@ -MD -MP -MF $(DEPDIR)/$*.Tpo -c -o $@ $< -@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Plo -@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='$<' object='$@' libtool=yes @AMDEPBACKSLASH@ +@am__fastdepCC_TRUE@ $(AM_V_CC)$(LTCOMPILE) -MT $@ -MD -MP -MF $(DEPDIR)/$*.Tpo -c -o $@ $< +@am__fastdepCC_TRUE@ $(AM_V_at)$(am__mv) $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Plo +@AMDEP_TRUE@@am__fastdepCC_FALSE@ $(AM_V_CC)source='$<' object='$@' libtool=yes @AMDEPBACKSLASH@ @AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@ -@am__fastdepCC_FALSE@ $(LTCOMPILE) -c -o $@ $< +@am__fastdepCC_FALSE@ $(AM_V_CC@am__nodep@)$(LTCOMPILE) -c -o $@ $< mostlyclean-libtool: -rm -f *.lo diff --git a/src/libimcv/plugins/imv_scanner/imv_scanner.c b/src/libimcv/plugins/imv_scanner/imv_scanner.c index 16ce0863f..6f5e82355 100644 --- a/src/libimcv/plugins/imv_scanner/imv_scanner.c +++ b/src/libimcv/plugins/imv_scanner/imv_scanner.c @@ -1,5 +1,5 @@ /* - * Copyright (C) 2011-2012 Andreas Steffen + * Copyright (C) 2013 Andreas Steffen * HSR Hochschule fuer Technik Rapperswil * * This program is free software; you can redistribute it and/or modify it @@ -13,432 +13,12 @@ * for more details. */ -#include "imv_scanner_state.h" - -#include <imv/imv_agent.h> -#include <imv/imv_msg.h> -#include <ietf/ietf_attr.h> -#include <ietf/ietf_attr_attr_request.h> -#include <ietf/ietf_attr_pa_tnc_error.h> -#include <ietf/ietf_attr_port_filter.h> - -#include <tncif_names.h> -#include <tncif_pa_subtypes.h> - -#include <pen/pen.h> -#include <collections/linked_list.h> -#include <utils/lexparser.h> -#include <utils/debug.h> - -/* IMV definitions */ +#include "imv_scanner_agent.h" static const char imv_name[] = "Scanner"; +static const imv_agent_create_t imv_agent_create = imv_scanner_agent_create; -static pen_type_t msg_types[] = { - { PEN_IETF, PA_SUBTYPE_IETF_VPN } -}; - -static imv_agent_t *imv_scanner; - -typedef struct port_range_t port_range_t; - -struct port_range_t { - u_int16_t start, stop; -}; - - -/** - * Default port policy - * - * TRUE: all server ports on the TNC client must be closed - * FALSE: any server port on the TNC client is allowed to be open - */ -static bool closed_port_policy = TRUE; - -/** - * List of TCP and UDP port ranges - * - * TRUE: server ports on the TNC client that are allowed to be open - * FALSE: server ports on the TNC client that must be closed - */ -static linked_list_t *tcp_ports, *udp_ports; - -/** - * Get a TCP or UDP port list from strongswan.conf - */ -static linked_list_t* get_port_list(char *label) -{ - char key[40], *value; - linked_list_t *list; - chunk_t port_list, port_item, port_start; - port_range_t *port_range; - - list = linked_list_create(); - - snprintf(key, sizeof(key), "libimcv.plugins.imv-scanner.%s_ports", label); - value = lib->settings->get_str(lib->settings, key, NULL); - if (!value) - { - DBG1(DBG_IMV, "%s not defined", key); - return list; - } - port_list = chunk_create(value, strlen(value)); - DBG2(DBG_IMV, "list of %s ports that %s:", label, - closed_port_policy ? "are allowed to be open" : "must be closed"); - - while (eat_whitespace(&port_list)) - { - if (!extract_token(&port_item, ' ', &port_list)) - { - /* reached last port item */ - port_item = port_list; - port_list = chunk_empty; - } - port_range = malloc_thing(port_range_t); - port_range->start = atoi(port_item.ptr); - - if (extract_token(&port_start, '-', &port_item) && port_item.len) - { - port_range->stop = atoi(port_item.ptr); - } - else - { - port_range->stop = port_range->start; - } - DBG2(DBG_IMV, "%5u - %5u", port_range->start, port_range->stop); - list->insert_last(list, port_range); - } - - return list; -} - - -/* - * see section 3.8.1 of TCG TNC IF-IMV Specification 1.3 - */ -TNC_Result TNC_IMV_Initialize(TNC_IMVID imv_id, - TNC_Version min_version, - TNC_Version max_version, - TNC_Version *actual_version) -{ - if (imv_scanner) - { - DBG1(DBG_IMV, "IMV \"%s\" has already been initialized", imv_name); - return TNC_RESULT_ALREADY_INITIALIZED; - } - imv_scanner = imv_agent_create(imv_name, msg_types, countof(msg_types), - imv_id, actual_version); - if (!imv_scanner) - { - return TNC_RESULT_FATAL; - } - if (min_version > TNC_IFIMV_VERSION_1 || max_version < TNC_IFIMV_VERSION_1) - { - DBG1(DBG_IMV, "no common IF-IMV version"); - return TNC_RESULT_NO_COMMON_VERSION; - } - - /* set the default port policy to closed (TRUE) or open (FALSE) */ - closed_port_policy = lib->settings->get_bool(lib->settings, - "libimcv.plugins.imv-scanner.closed_port_policy", TRUE); - DBG2(DBG_IMV, "default port policy is %s ports", - closed_port_policy ? "closed" : "open"); - - /* get the list of open|closed ports */ - tcp_ports = get_port_list("tcp"); - udp_ports = get_port_list("udp"); - - return TNC_RESULT_SUCCESS; -} - -/** - * see section 3.8.2 of TCG TNC IF-IMV Specification 1.3 - */ -TNC_Result TNC_IMV_NotifyConnectionChange(TNC_IMVID imv_id, - TNC_ConnectionID connection_id, - TNC_ConnectionState new_state) -{ - imv_state_t *state; - - if (!imv_scanner) - { - DBG1(DBG_IMV, "IMV \"%s\" has not been initialized", imv_name); - return TNC_RESULT_NOT_INITIALIZED; - } - switch (new_state) - { - case TNC_CONNECTION_STATE_CREATE: - state = imv_scanner_state_create(connection_id); - return imv_scanner->create_state(imv_scanner, state); - case TNC_CONNECTION_STATE_DELETE: - return imv_scanner->delete_state(imv_scanner, connection_id); - default: - return imv_scanner->change_state(imv_scanner, connection_id, - new_state, NULL); - } -} - -static TNC_Result receive_message(imv_state_t *state, imv_msg_t *in_msg) -{ - imv_msg_t *out_msg; - enumerator_t *enumerator; - pa_tnc_attr_t *attr; - pen_type_t type; - TNC_Result result; - bool fatal_error = FALSE; +/* include generic TGC TNC IF-IMV API code below */ - /* parse received PA-TNC message and handle local and remote errors */ - result = in_msg->receive(in_msg, &fatal_error); - if (result != TNC_RESULT_SUCCESS) - { - return result; - } +#include <imv/imv_if.h> - /* analyze PA-TNC attributes */ - enumerator = in_msg->create_attribute_enumerator(in_msg); - while (enumerator->enumerate(enumerator, &attr)) - { - type = attr->get_type(attr); - - if (type.vendor_id == PEN_IETF && type.type == IETF_ATTR_PORT_FILTER) - { - imv_scanner_state_t *imv_scanner_state; - ietf_attr_port_filter_t *attr_port_filter; - enumerator_t *enumerator; - u_int8_t protocol; - u_int16_t port; - bool blocked, compliant = TRUE; - - - imv_scanner_state = (imv_scanner_state_t*)state; - attr_port_filter = (ietf_attr_port_filter_t*)attr; - enumerator = attr_port_filter->create_port_enumerator(attr_port_filter); - while (enumerator->enumerate(enumerator, &blocked, &protocol, &port)) - { - enumerator_t *e; - port_range_t *port_range; - bool passed, found = FALSE; - char buf[20]; - - if (blocked) - { - /* ignore closed ports */ - continue; - } - - e = (protocol == IPPROTO_TCP) ? - tcp_ports->create_enumerator(tcp_ports) : - udp_ports->create_enumerator(udp_ports); - while (e->enumerate(e, &port_range)) - { - if (port >= port_range->start && port <= port_range->stop) - { - found = TRUE; - break; - } - } - e->destroy(e); - - passed = (closed_port_policy == found); - DBG2(DBG_IMV, "%s port %5u %s: %s", - (protocol == IPPROTO_TCP) ? "tcp" : "udp", port, - blocked ? "closed" : "open", passed ? "ok" : "fatal"); - if (!passed) - { - compliant = FALSE; - snprintf(buf, sizeof(buf), "%s/%u", - (protocol == IPPROTO_TCP) ? "tcp" : "udp", port); - imv_scanner_state->add_violating_port(imv_scanner_state, - strdup(buf)); - } - } - enumerator->destroy(enumerator); - - if (compliant) - { - state->set_recommendation(state, - TNC_IMV_ACTION_RECOMMENDATION_ALLOW, - TNC_IMV_EVALUATION_RESULT_COMPLIANT); - } - else - { - state->set_recommendation(state, - TNC_IMV_ACTION_RECOMMENDATION_NO_ACCESS, - TNC_IMV_EVALUATION_RESULT_NONCOMPLIANT_MAJOR); - } - } - } - enumerator->destroy(enumerator); - - if (fatal_error) - { - state->set_recommendation(state, - TNC_IMV_ACTION_RECOMMENDATION_NO_RECOMMENDATION, - TNC_IMV_EVALUATION_RESULT_ERROR); - } - - out_msg = imv_msg_create_as_reply(in_msg); - result = out_msg->send_assessment(out_msg); - out_msg->destroy(out_msg); - if (result != TNC_RESULT_SUCCESS) - { - return result; - } - return imv_scanner->provide_recommendation(imv_scanner, state); - } - -/** - * see section 3.8.4 of TCG TNC IF-IMV Specification 1.3 - */ -TNC_Result TNC_IMV_ReceiveMessage(TNC_IMVID imv_id, - TNC_ConnectionID connection_id, - TNC_BufferReference msg, - TNC_UInt32 msg_len, - TNC_MessageType msg_type) -{ - imv_state_t *state; - imv_msg_t *in_msg; - TNC_Result result; - - if (!imv_scanner) - { - DBG1(DBG_IMV, "IMV \"%s\" has not been initialized", imv_name); - return TNC_RESULT_NOT_INITIALIZED; - } - if (!imv_scanner->get_state(imv_scanner, connection_id, &state)) - { - return TNC_RESULT_FATAL; - } - - in_msg = imv_msg_create_from_data(imv_scanner, state, connection_id, msg_type, - chunk_create(msg, msg_len)); - result = receive_message(state, in_msg); - in_msg->destroy(in_msg); - - return result; -} - -/** - * see section 3.8.6 of TCG TNC IF-IMV Specification 1.3 - */ -TNC_Result TNC_IMV_ReceiveMessageLong(TNC_IMVID imv_id, - TNC_ConnectionID connection_id, - TNC_UInt32 msg_flags, - TNC_BufferReference msg, - TNC_UInt32 msg_len, - TNC_VendorID msg_vid, - TNC_MessageSubtype msg_subtype, - TNC_UInt32 src_imc_id, - TNC_UInt32 dst_imv_id) -{ - imv_state_t *state; - imv_msg_t *in_msg; - TNC_Result result; - - if (!imv_scanner) - { - DBG1(DBG_IMV, "IMV \"%s\" has not been initialized", imv_name); - return TNC_RESULT_NOT_INITIALIZED; - } - if (!imv_scanner->get_state(imv_scanner, connection_id, &state)) - { - return TNC_RESULT_FATAL; - } - in_msg = imv_msg_create_from_long_data(imv_scanner, state, connection_id, - src_imc_id, dst_imv_id, msg_vid, msg_subtype, - chunk_create(msg, msg_len)); - result =receive_message(state, in_msg); - in_msg->destroy(in_msg); - - return result; -} - -/** - * see section 3.8.7 of TCG TNC IF-IMV Specification 1.3 - */ -TNC_Result TNC_IMV_SolicitRecommendation(TNC_IMVID imv_id, - TNC_ConnectionID connection_id) -{ - imv_state_t *state; - - if (!imv_scanner) - { - DBG1(DBG_IMV, "IMV \"%s\" has not been initialized", imv_name); - return TNC_RESULT_NOT_INITIALIZED; - } - if (!imv_scanner->get_state(imv_scanner, connection_id, &state)) - { - return TNC_RESULT_FATAL; - } - return imv_scanner->provide_recommendation(imv_scanner, state); -} - -/** - * see section 3.8.8 of TCG TNC IF-IMV Specification 1.3 - */ -TNC_Result TNC_IMV_BatchEnding(TNC_IMVID imv_id, - TNC_ConnectionID connection_id) -{ - imv_state_t *state; - imv_msg_t *out_msg; - pa_tnc_attr_t *attr; - TNC_IMV_Action_Recommendation rec; - TNC_IMV_Evaluation_Result eval; - TNC_Result result = TNC_RESULT_SUCCESS; - - if (!imv_scanner) - { - DBG1(DBG_IMV, "IMV \"%s\" has not been initialized", imv_name); - return TNC_RESULT_NOT_INITIALIZED; - } - if (!imv_scanner->get_state(imv_scanner, connection_id, &state)) - { - return TNC_RESULT_FATAL; - } - state->get_recommendation(state, &rec, &eval); - if (rec == TNC_IMV_ACTION_RECOMMENDATION_NO_RECOMMENDATION) - { - out_msg = imv_msg_create(imv_scanner, state, connection_id, imv_id, - TNC_IMCID_ANY, msg_types[0]); - attr = ietf_attr_attr_request_create(PEN_IETF, IETF_ATTR_PORT_FILTER); - out_msg->add_attribute(out_msg, attr); - - /* send PA-TNC message with excl flag not set */ - result = out_msg->send(out_msg, FALSE); - out_msg->destroy(out_msg); - - } - return result; -} - -/** - * see section 3.8.9 of TCG TNC IF-IMV Specification 1.3 - */ -TNC_Result TNC_IMV_Terminate(TNC_IMVID imv_id) -{ - if (!imv_scanner) - { - DBG1(DBG_IMV, "IMV \"%s\" has not been initialized", imv_name); - return TNC_RESULT_NOT_INITIALIZED; - } - tcp_ports->destroy_function(tcp_ports, free); - udp_ports->destroy_function(udp_ports, free); - imv_scanner->destroy(imv_scanner); - imv_scanner = NULL; - - return TNC_RESULT_SUCCESS; -} - -/** - * see section 4.2.8.1 of TCG TNC IF-IMV Specification 1.3 - */ -TNC_Result TNC_IMV_ProvideBindFunction(TNC_IMVID imv_id, - TNC_TNCS_BindFunctionPointer bind_function) -{ - if (!imv_scanner) - { - DBG1(DBG_IMV, "IMV \"%s\" has not been initialized", imv_name); - return TNC_RESULT_NOT_INITIALIZED; - } - return imv_scanner->bind_functions(imv_scanner, bind_function); -} diff --git a/src/libimcv/plugins/imv_scanner/imv_scanner_agent.c b/src/libimcv/plugins/imv_scanner/imv_scanner_agent.c new file mode 100644 index 000000000..d1e093137 --- /dev/null +++ b/src/libimcv/plugins/imv_scanner/imv_scanner_agent.c @@ -0,0 +1,526 @@ +/* + * Copyright (C) 2013 Andreas Steffen + * HSR Hochschule fuer Technik Rapperswil + * + * This program is free software; you can redistribute it and/or modify it + * under the terms of the GNU General Public License as published by the + * Free Software Foundation; either version 2 of the License, or (at your + * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>. + * + * This program is distributed in the hope that it will be useful, but + * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY + * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License + * for more details. + */ + +#include "imv_scanner_agent.h" +#include "imv_scanner_state.h" + +#include <imcv.h> +#include <imv/imv_agent.h> +#include <imv/imv_msg.h> +#include <ietf/ietf_attr.h> +#include <ietf/ietf_attr_attr_request.h> +#include <ietf/ietf_attr_pa_tnc_error.h> +#include <ietf/ietf_attr_port_filter.h> + +#include <tncif_names.h> +#include <tncif_pa_subtypes.h> + +#include <pen/pen.h> +#include <utils/debug.h> +#include <utils/lexparser.h> + +typedef struct private_imv_scanner_agent_t private_imv_scanner_agent_t; + +/* Subscribed PA-TNC message subtypes */ +static pen_type_t msg_types[] = { + { PEN_IETF, PA_SUBTYPE_IETF_VPN } +}; + +/** + * Private data of an imv_scanner_agent_t object. + */ +struct private_imv_scanner_agent_t { + + /** + * Public members of imv_scanner_agent_t + */ + imv_agent_if_t public; + + /** + * IMV agent responsible for generic functions + */ + imv_agent_t *agent; + +}; + +METHOD(imv_agent_if_t, bind_functions, TNC_Result, + private_imv_scanner_agent_t *this, TNC_TNCS_BindFunctionPointer bind_function) +{ + return this->agent->bind_functions(this->agent, bind_function); +} + +METHOD(imv_agent_if_t, notify_connection_change, TNC_Result, + private_imv_scanner_agent_t *this, TNC_ConnectionID id, + TNC_ConnectionState new_state) +{ + imv_state_t *state; + + switch (new_state) + { + case TNC_CONNECTION_STATE_CREATE: + state = imv_scanner_state_create(id); + return this->agent->create_state(this->agent, state); + case TNC_CONNECTION_STATE_DELETE: + return this->agent->delete_state(this->agent, id); + default: + return this->agent->change_state(this->agent, id, new_state, NULL); + } +} + +/** + * Process a received message + */ +static TNC_Result receive_msg(private_imv_scanner_agent_t *this, + imv_state_t *state, imv_msg_t *in_msg) +{ + imv_msg_t *out_msg; + imv_scanner_state_t *scanner_state; + enumerator_t *enumerator; + pa_tnc_attr_t *attr; + pen_type_t type; + TNC_Result result; + ietf_attr_port_filter_t *port_filter_attr; + bool fatal_error = FALSE; + + /* parse received PA-TNC message and handle local and remote errors */ + result = in_msg->receive(in_msg, &fatal_error); + if (result != TNC_RESULT_SUCCESS) + { + return result; + } + + /* analyze PA-TNC attributes */ + enumerator = in_msg->create_attribute_enumerator(in_msg); + while (enumerator->enumerate(enumerator, &attr)) + { + type = attr->get_type(attr); + + if (type.vendor_id == PEN_IETF && type.type == IETF_ATTR_PORT_FILTER) + { + scanner_state = (imv_scanner_state_t*)state; + port_filter_attr = (ietf_attr_port_filter_t*)attr->get_ref(attr); + scanner_state->set_port_filter_attr(scanner_state, port_filter_attr); + } + } + enumerator->destroy(enumerator); + + if (fatal_error) + { + state->set_recommendation(state, + TNC_IMV_ACTION_RECOMMENDATION_NO_RECOMMENDATION, + TNC_IMV_EVALUATION_RESULT_ERROR); + out_msg = imv_msg_create_as_reply(in_msg); + result = out_msg->send_assessment(out_msg); + out_msg->destroy(out_msg); + if (result != TNC_RESULT_SUCCESS) + { + return result; + } + return this->agent->provide_recommendation(this->agent, state); + } + + return TNC_RESULT_SUCCESS; +} + +METHOD(imv_agent_if_t, receive_message, TNC_Result, + private_imv_scanner_agent_t *this, TNC_ConnectionID id, + TNC_MessageType msg_type, chunk_t msg) +{ + imv_state_t *state; + imv_msg_t *in_msg; + TNC_Result result; + + if (!this->agent->get_state(this->agent, id, &state)) + { + return TNC_RESULT_FATAL; + } + in_msg = imv_msg_create_from_data(this->agent, state, id, msg_type, msg); + result = receive_msg(this, state, in_msg); + in_msg->destroy(in_msg); + + return result; +} + +METHOD(imv_agent_if_t, receive_message_long, TNC_Result, + private_imv_scanner_agent_t *this, TNC_ConnectionID id, + TNC_UInt32 src_imc_id, TNC_UInt32 dst_imv_id, + TNC_VendorID msg_vid, TNC_MessageSubtype msg_subtype, chunk_t msg) +{ + imv_state_t *state; + imv_msg_t *in_msg; + TNC_Result result; + + if (!this->agent->get_state(this->agent, id, &state)) + { + return TNC_RESULT_FATAL; + } + in_msg = imv_msg_create_from_long_data(this->agent, state, id, + src_imc_id, dst_imv_id, msg_vid, msg_subtype, msg); + result = receive_msg(this, state, in_msg); + in_msg->destroy(in_msg); + + return result; + +} + +typedef struct port_range_t port_range_t; + +struct port_range_t { + u_int16_t start, stop; +}; + +/** + * Parse a TCP or UDP port list from an argument string + */ +static linked_list_t* get_port_list(u_int8_t protocol_family, + bool closed_port_policy, char *arg_str) +{ + chunk_t port_list, port_item, port_start; + port_range_t *port_range; + linked_list_t *list; + + list = linked_list_create(); + + port_list = chunk_from_str(arg_str); + DBG2(DBG_IMV, "list of %s ports that %s:", + (protocol_family == IPPROTO_TCP) ? "tcp" : "udp", + closed_port_policy ? "are allowed to be open" : "must be closed"); + + while (eat_whitespace(&port_list)) + { + if (!extract_token(&port_item, ' ', &port_list)) + { + /* reached last port item */ + port_item = port_list; + port_list = chunk_empty; + } + port_range = malloc_thing(port_range_t); + port_range->start = atoi(port_item.ptr); + + if (extract_token(&port_start, '-', &port_item) && port_item.len) + { + port_range->stop = atoi(port_item.ptr); + } + else + { + port_range->stop = port_range->start; + } + DBG2(DBG_IMV, "%5u - %5u", port_range->start, port_range->stop); + list->insert_last(list, port_range); + } + + return list; +} + +METHOD(imv_agent_if_t, batch_ending, TNC_Result, + private_imv_scanner_agent_t *this, TNC_ConnectionID id) +{ + imv_msg_t *out_msg; + imv_state_t *state; + imv_session_t *session; + imv_workitem_t *workitem; + imv_scanner_state_t *scanner_state; + imv_scanner_handshake_state_t handshake_state; + pa_tnc_attr_t *attr; + ietf_attr_port_filter_t *port_filter_attr; + TNC_IMVID imv_id; + TNC_Result result = TNC_RESULT_SUCCESS; + bool no_workitems = TRUE; + enumerator_t *enumerator; + + if (!this->agent->get_state(this->agent, id, &state)) + { + return TNC_RESULT_FATAL; + } + scanner_state = (imv_scanner_state_t*)state; + handshake_state = scanner_state->get_handshake_state(scanner_state); + port_filter_attr = scanner_state->get_port_filter_attr(scanner_state); + session = state->get_session(state); + imv_id = this->agent->get_id(this->agent); + + if (handshake_state == IMV_SCANNER_STATE_END) + { + return TNC_RESULT_SUCCESS; + } + + /* create an empty out message - we might need it */ + out_msg = imv_msg_create(this->agent, state, id, imv_id, TNC_IMCID_ANY, + msg_types[0]); + + if (!session) + { + DBG2(DBG_IMV, "no workitems available - no evaluation possible"); + state->set_recommendation(state, + TNC_IMV_ACTION_RECOMMENDATION_ALLOW, + TNC_IMV_EVALUATION_RESULT_DONT_KNOW); + result = out_msg->send_assessment(out_msg); + out_msg->destroy(out_msg); + scanner_state->set_handshake_state(scanner_state, IMV_SCANNER_STATE_END); + + if (result != TNC_RESULT_SUCCESS) + { + return result; + } + return this->agent->provide_recommendation(this->agent, state); + } + + if (handshake_state == IMV_SCANNER_STATE_INIT) + { + enumerator = session->create_workitem_enumerator(session); + if (enumerator) + { + while (enumerator->enumerate(enumerator, &workitem)) + { + if (workitem->get_imv_id(workitem) != TNC_IMVID_ANY) + { + continue; + } + + switch (workitem->get_type(workitem)) + { + case IMV_WORKITEM_TCP_PORT_OPEN: + case IMV_WORKITEM_TCP_PORT_BLOCK: + case IMV_WORKITEM_UDP_PORT_OPEN: + case IMV_WORKITEM_UDP_PORT_BLOCK: + if (!port_filter_attr && + handshake_state != IMV_SCANNER_STATE_ATTR_REQ) + { + attr = ietf_attr_attr_request_create(PEN_IETF, + IETF_ATTR_PORT_FILTER); + out_msg->add_attribute(out_msg, attr); + handshake_state = IMV_SCANNER_STATE_ATTR_REQ; + } + break; + default: + continue; + } + workitem->set_imv_id(workitem, imv_id); + no_workitems = FALSE; + } + enumerator->destroy(enumerator); + + if (no_workitems) + { + DBG2(DBG_IMV, "IMV %d has no workitems - " + "no evaluation requested", imv_id); + state->set_recommendation(state, + TNC_IMV_ACTION_RECOMMENDATION_ALLOW, + TNC_IMV_EVALUATION_RESULT_DONT_KNOW); + } + handshake_state = IMV_SCANNER_STATE_WORKITEMS; + scanner_state->set_handshake_state(scanner_state, handshake_state); + } + } + + if (handshake_state == IMV_SCANNER_STATE_WORKITEMS && port_filter_attr) + { + TNC_IMV_Evaluation_Result eval; + TNC_IMV_Action_Recommendation rec; + u_int8_t protocol_family, protocol; + u_int16_t port; + bool closed_port_policy, blocked, first; + char result_str[BUF_LEN], *pos, *protocol_str; + size_t len; + int written; + linked_list_t *port_list; + enumerator_t *e1, *e2; + + enumerator = session->create_workitem_enumerator(session); + while (enumerator->enumerate(enumerator, &workitem)) + { + if (workitem->get_imv_id(workitem) != imv_id) + { + continue; + } + eval = TNC_IMV_EVALUATION_RESULT_COMPLIANT; + + switch (workitem->get_type(workitem)) + { + case IMV_WORKITEM_TCP_PORT_OPEN: + protocol_family = IPPROTO_TCP; + closed_port_policy = TRUE; + break; + case IMV_WORKITEM_TCP_PORT_BLOCK: + protocol_family = IPPROTO_TCP; + closed_port_policy = FALSE; + break; + case IMV_WORKITEM_UDP_PORT_OPEN: + protocol_family = IPPROTO_UDP; + closed_port_policy = TRUE; + break; + case IMV_WORKITEM_UDP_PORT_BLOCK: + protocol_family = IPPROTO_UDP; + closed_port_policy = FALSE; + break; + default: + continue; + } + port_list = get_port_list(protocol_family, closed_port_policy, + workitem->get_arg_str(workitem)); + protocol_str = (protocol_family == IPPROTO_TCP) ? "tcp" : "udp"; + result_str[0] = '\0'; + pos = result_str; + len = BUF_LEN; + first = TRUE; + + e1 = port_filter_attr->create_port_enumerator(port_filter_attr); + while (e1->enumerate(e1, &blocked, &protocol, &port)) + { + port_range_t *port_range; + bool passed, found = FALSE; + char buf[20]; + + if (blocked || protocol != protocol_family) + { + /* ignore closed ports or non-matching protocols */ + continue; + } + + e2 = port_list->create_enumerator(port_list); + while (e2->enumerate(e2, &port_range)) + { + if (port >= port_range->start && port <= port_range->stop) + { + found = TRUE; + break; + } + } + e2->destroy(e2); + + passed = (closed_port_policy == found); + DBG2(DBG_IMV, "%s port %5u open: %s", protocol_str, port, + passed ? "ok" : "fatal"); + if (!passed) + { + eval = TNC_IMV_EVALUATION_RESULT_NONCOMPLIANT_MINOR; + snprintf(buf, sizeof(buf), "%s/%u", protocol_str, port); + scanner_state->add_violating_port(scanner_state, strdup(buf)); + if (first) + { + written = snprintf(pos, len, "violating %s ports:", + protocol_str); + if (written > 0 && written < len) + { + pos += written; + len -= written; + } + first = FALSE; + } + written = snprintf(pos, len, " %u", port); + if (written < 0 || written >= len) + { + pos += len - 1; + *pos = '\0'; + } + else + { + pos += written; + len -= written; + } + } + } + e1->destroy(e1); + + if (first) + { + snprintf(pos, len, "no violating %s ports", protocol_str); + } + port_list->destroy(port_list); + + session->remove_workitem(session, enumerator); + rec = workitem->set_result(workitem, result_str, eval); + state->update_recommendation(state, rec, eval); + imcv_db->finalize_workitem(imcv_db, workitem); + workitem->destroy(workitem); + } + enumerator->destroy(enumerator); + } + + /* finalized all workitems ? */ + if (handshake_state == IMV_SCANNER_STATE_WORKITEMS && + session->get_workitem_count(session, imv_id) == 0) + { + result = out_msg->send_assessment(out_msg); + out_msg->destroy(out_msg); + scanner_state->set_handshake_state(scanner_state, IMV_SCANNER_STATE_END); + + if (result != TNC_RESULT_SUCCESS) + { + return result; + } + return this->agent->provide_recommendation(this->agent, state); + } + + /* send non-empty PA-TNC message with excl flag not set */ + if (out_msg->get_attribute_count(out_msg)) + { + result = out_msg->send(out_msg, FALSE); + } + out_msg->destroy(out_msg); + + return result; +} + +METHOD(imv_agent_if_t, solicit_recommendation, TNC_Result, + private_imv_scanner_agent_t *this, TNC_ConnectionID id) +{ + imv_state_t *state; + + if (!this->agent->get_state(this->agent, id, &state)) + { + return TNC_RESULT_FATAL; + } + return this->agent->provide_recommendation(this->agent, state); +} + +METHOD(imv_agent_if_t, destroy, void, + private_imv_scanner_agent_t *this) +{ + this->agent->destroy(this->agent); + free(this); +} + +/** + * Described in header. + */ +imv_agent_if_t *imv_scanner_agent_create(const char *name, TNC_IMVID id, + TNC_Version *actual_version) +{ + private_imv_scanner_agent_t *this; + imv_agent_t *agent; + + agent = imv_agent_create(name, msg_types, countof(msg_types), id, + actual_version); + if (!agent) + { + return NULL; + } + + INIT(this, + .public = { + .bind_functions = _bind_functions, + .notify_connection_change = _notify_connection_change, + .receive_message = _receive_message, + .receive_message_long = _receive_message_long, + .batch_ending = _batch_ending, + .solicit_recommendation = _solicit_recommendation, + .destroy = _destroy, + }, + .agent = agent, + ); + + return &this->public; +} + diff --git a/src/libimcv/plugins/imv_scanner/imv_scanner_agent.h b/src/libimcv/plugins/imv_scanner/imv_scanner_agent.h new file mode 100644 index 000000000..155453363 --- /dev/null +++ b/src/libimcv/plugins/imv_scanner/imv_scanner_agent.h @@ -0,0 +1,36 @@ +/* + * Copyright (C) 2013 Andreas Steffen + * HSR Hochschule fuer Technik Rapperswil + * + * This program is free software; you can redistribute it and/or modify it + * under the terms of the GNU General Public License as published by the + * Free Software Foundation; either version 2 of the License, or (at your + * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>. + * + * This program is distributed in the hope that it will be useful, but + * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY + * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License + * for more details. + */ + +/** + * @defgroup imv_scanner_agent_t imv_scanner_agent + * @{ @ingroup imv_scanner + */ + +#ifndef IMV_SCANNER_AGENT_H_ +#define IMV_SCANNER_AGENT_H_ + +#include <imv/imv_agent_if.h> + +/** + * Creates a Scanner IMV agent + * + * @param name Name of the IMV + * @param id ID of the IMV + * @param actual_version TNC IF-IMV version + */ +imv_agent_if_t* imv_scanner_agent_create(const char* name, TNC_IMVID id, + TNC_Version *actual_version); + +#endif /** IMV_SCANNER_AGENT_H_ @}*/ diff --git a/src/libimcv/plugins/imv_scanner/imv_scanner_state.c b/src/libimcv/plugins/imv_scanner/imv_scanner_state.c index 2123af7a8..4c570c46a 100644 --- a/src/libimcv/plugins/imv_scanner/imv_scanner_state.c +++ b/src/libimcv/plugins/imv_scanner/imv_scanner_state.c @@ -18,6 +18,8 @@ #include "imv/imv_reason_string.h" #include "imv/imv_remediation_string.h" +#include <tncif_policy.h> + #include <utils/lexparser.h> #include <utils/debug.h> @@ -59,6 +61,11 @@ struct private_imv_scanner_state_t { u_int32_t max_msg_len; /** + * Flags set for completed actions + */ + u_int32_t action_flags; + + /** * Access Requestor ID Type */ u_int32_t ar_id_type; @@ -69,6 +76,11 @@ struct private_imv_scanner_state_t { chunk_t ar_id_value; /** + * IMV database session associatied with TNCCS connection + */ + imv_session_t *session; + + /** * IMV action recommendation */ TNC_IMV_Action_Recommendation rec; @@ -79,6 +91,16 @@ struct private_imv_scanner_state_t { TNC_IMV_Evaluation_Result eval; /** + * IMV Scanner handshake state + */ + imv_scanner_handshake_state_t handshake_state; + + /** + * Copy of the received IEEE Port Filter attribute + */ + ietf_attr_port_filter_t *port_filter_attr; + + /** * List with ports that should be closed */ linked_list_t *violating_ports; @@ -175,6 +197,18 @@ METHOD(imv_state_t, get_max_msg_len, u_int32_t, return this->max_msg_len; } +METHOD(imv_state_t, set_action_flags, void, + private_imv_scanner_state_t *this, u_int32_t flags) +{ + this->action_flags |= flags; +} + +METHOD(imv_state_t, get_action_flags, u_int32_t, + private_imv_scanner_state_t *this) +{ + return this->action_flags; +} + METHOD(imv_state_t, set_ar_id, void, private_imv_scanner_state_t *this, u_int32_t id_type, chunk_t id_value) { @@ -192,6 +226,18 @@ METHOD(imv_state_t, get_ar_id, chunk_t, return this->ar_id_value; } +METHOD(imv_state_t, set_session, void, + private_imv_scanner_state_t *this, imv_session_t *session) +{ + this->session = session; +} + +METHOD(imv_state_t, get_session, imv_session_t*, + private_imv_scanner_state_t *this) +{ + return this->session; +} + METHOD(imv_state_t, change_state, void, private_imv_scanner_state_t *this, TNC_ConnectionState new_state) { @@ -200,7 +246,7 @@ METHOD(imv_state_t, change_state, void, METHOD(imv_state_t, get_recommendation, void, private_imv_scanner_state_t *this, TNC_IMV_Action_Recommendation *rec, - TNC_IMV_Evaluation_Result *eval) + TNC_IMV_Evaluation_Result *eval) { *rec = this->rec; *eval = this->eval; @@ -208,17 +254,25 @@ METHOD(imv_state_t, get_recommendation, void, METHOD(imv_state_t, set_recommendation, void, private_imv_scanner_state_t *this, TNC_IMV_Action_Recommendation rec, - TNC_IMV_Evaluation_Result eval) + TNC_IMV_Evaluation_Result eval) { this->rec = rec; this->eval = eval; } +METHOD(imv_state_t, update_recommendation, void, + private_imv_scanner_state_t *this, TNC_IMV_Action_Recommendation rec, + TNC_IMV_Evaluation_Result eval) +{ + this->rec = tncif_policy_update_recommendation(this->rec, rec); + this->eval = tncif_policy_update_evaluation(this->eval, eval); +} + METHOD(imv_state_t, get_reason_string, bool, private_imv_scanner_state_t *this, enumerator_t *language_enumerator, chunk_t *reason_string, char **reason_language) { - if (!this->violating_ports) + if (this->violating_ports->get_count(this->violating_ports) == 0) { return FALSE; } @@ -228,7 +282,10 @@ METHOD(imv_state_t, get_reason_string, bool, /* Instantiate a TNC Reason String object */ DESTROY_IF(this->reason_string); this->reason_string = imv_reason_string_create(*reason_language); - this->reason_string->add_reason(this->reason_string, reasons); + if (this->rec != TNC_IMV_ACTION_RECOMMENDATION_NO_RECOMMENDATION) + { + this->reason_string->add_reason(this->reason_string, reasons); + } *reason_string = this->reason_string->get_encoding(this->reason_string); return TRUE; @@ -238,7 +295,7 @@ METHOD(imv_state_t, get_remediation_instructions, bool, private_imv_scanner_state_t *this, enumerator_t *language_enumerator, chunk_t *string, char **lang_code, char **uri) { - if (!this->violating_ports) + if (this->violating_ports->get_count(this->violating_ports) == 0) { return FALSE; } @@ -265,13 +322,40 @@ METHOD(imv_state_t, get_remediation_instructions, bool, METHOD(imv_state_t, destroy, void, private_imv_scanner_state_t *this) { + DESTROY_IF(this->session); DESTROY_IF(this->reason_string); DESTROY_IF(this->remediation_string); + DESTROY_IF(&this->port_filter_attr->pa_tnc_attribute); this->violating_ports->destroy_function(this->violating_ports, free); free(this->ar_id_value.ptr); free(this); } +METHOD(imv_scanner_state_t, set_handshake_state, void, + private_imv_scanner_state_t *this, imv_scanner_handshake_state_t new_state) +{ + this->handshake_state = new_state; +} + +METHOD(imv_scanner_state_t, get_handshake_state, imv_scanner_handshake_state_t, + private_imv_scanner_state_t *this) +{ + return this->handshake_state; +} + +METHOD(imv_scanner_state_t, set_port_filter_attr, void, + private_imv_scanner_state_t *this, ietf_attr_port_filter_t *attr) +{ + DESTROY_IF(&this->port_filter_attr->pa_tnc_attribute); + this->port_filter_attr = attr; +} + +METHOD(imv_scanner_state_t, get_port_filter_attr, ietf_attr_port_filter_t*, + private_imv_scanner_state_t *this) +{ + return this->port_filter_attr; +} + METHOD(imv_scanner_state_t, add_violating_port, void, private_imv_scanner_state_t *this, char *port) { @@ -294,15 +378,24 @@ imv_state_t *imv_scanner_state_create(TNC_ConnectionID connection_id) .set_flags = _set_flags, .set_max_msg_len = _set_max_msg_len, .get_max_msg_len = _get_max_msg_len, + .set_action_flags = _set_action_flags, + .get_action_flags = _get_action_flags, .set_ar_id = _set_ar_id, .get_ar_id = _get_ar_id, + .set_session = _set_session, + .get_session= _get_session, .change_state = _change_state, .get_recommendation = _get_recommendation, .set_recommendation = _set_recommendation, + .update_recommendation = _update_recommendation, .get_reason_string = _get_reason_string, .get_remediation_instructions = _get_remediation_instructions, .destroy = _destroy, }, + .set_handshake_state = _set_handshake_state, + .get_handshake_state = _get_handshake_state, + .set_port_filter_attr = _set_port_filter_attr, + .get_port_filter_attr = _get_port_filter_attr, .add_violating_port = _add_violating_port, }, .state = TNC_CONNECTION_STATE_CREATE, diff --git a/src/libimcv/plugins/imv_scanner/imv_scanner_state.h b/src/libimcv/plugins/imv_scanner/imv_scanner_state.h index a15eb0778..7f147f864 100644 --- a/src/libimcv/plugins/imv_scanner/imv_scanner_state.h +++ b/src/libimcv/plugins/imv_scanner/imv_scanner_state.h @@ -1,5 +1,6 @@ /* - * Copyright (C) 2011 Andreas Steffen, HSR Hochschule fuer Technik Rapperswil + * Copyright (C) 2011-2013 Andreas Steffen + * HSR Hochschule fuer Technik Rapperswil * * This program is free software; you can redistribute it and/or modify it * under the terms of the GNU General Public License as published by the @@ -24,9 +25,22 @@ #define IMV_SCANNER_STATE_H_ #include <imv/imv_state.h> +#include <ietf/ietf_attr_port_filter.h> + #include <library.h> typedef struct imv_scanner_state_t imv_scanner_state_t; +typedef enum imv_scanner_handshake_state_t imv_scanner_handshake_state_t; + +/** + * IMV Scanner Handshake States (state machine) + */ +enum imv_scanner_handshake_state_t { + IMV_SCANNER_STATE_INIT, + IMV_SCANNER_STATE_ATTR_REQ, + IMV_SCANNER_STATE_WORKITEMS, + IMV_SCANNER_STATE_END +}; /** * Internal state of an imv_scanner_t connection instance @@ -39,6 +53,36 @@ struct imv_scanner_state_t { imv_state_t interface; /** + * Set state of the handshake + * + * @param new_state the handshake state of IMV + */ + void (*set_handshake_state)(imv_scanner_state_t *this, + imv_scanner_handshake_state_t new_state); + + /** + * Get state of the handshake + * + * @return the handshake state of IMV + */ + imv_scanner_handshake_state_t (*get_handshake_state)(imv_scanner_state_t *this); + + /** + * Store an IETF Port Filter attribute for later evaluation + * + * @param attr IETF Port Filter attribute + */ + void (*set_port_filter_attr)(imv_scanner_state_t *this, + ietf_attr_port_filter_t *attr); + + /** + * Get the stored IETF Port Filter attribute + * + * @return IETF Port Filter attribute + */ + ietf_attr_port_filter_t* (*get_port_filter_attr)(imv_scanner_state_t *this); + + /** * add a violating TCP or UDP port */ void (*add_violating_port)(imv_scanner_state_t *this, char *port); |