diff options
Diffstat (limited to 'src/libimcv')
121 files changed, 19084 insertions, 2224 deletions
diff --git a/src/libimcv/Makefile.am b/src/libimcv/Makefile.am index fae9fd662..e1e6541aa 100644 --- a/src/libimcv/Makefile.am +++ b/src/libimcv/Makefile.am @@ -1,5 +1,6 @@ - -INCLUDES = -I$(top_srcdir)/src/libstrongswan -I$(top_srcdir)/src/libtncif +AM_CPPFLAGS = \ + -I$(top_srcdir)/src/libstrongswan \ + -I$(top_srcdir)/src/libtncif ipseclib_LTLIBRARIES = libimcv.la @@ -8,17 +9,53 @@ libimcv_la_LIBADD = $(top_builddir)/src/libtncif/libtncif.la libimcv_la_SOURCES = \ imcv.h imcv.c \ imc/imc_agent.h imc/imc_agent.c imc/imc_state.h \ + imc/imc_msg.h imc/imc_msg.c \ imv/imv_agent.h imv/imv_agent.c imv/imv_state.h \ + imv/imv_agent_if.h imv/imv_if.h \ + imv/imv_database.h imv/imv_database.c \ + imv/imv_msg.h imv/imv_msg.c \ + imv/imv_lang_string.h imv/imv_lang_string.c \ + imv/imv_reason_string.h imv/imv_reason_string.c \ + imv/imv_remediation_string.h imv/imv_remediation_string.c \ + imv/imv_session.h imv/imv_session.c \ + imv/imv_workitem.h imv/imv_workitem.c \ + imv/tables.sql imv/data.sql \ ietf/ietf_attr.h ietf/ietf_attr.c \ + ietf/ietf_attr_assess_result.h ietf/ietf_attr_assess_result.c \ + ietf/ietf_attr_attr_request.h ietf/ietf_attr_attr_request.c \ + ietf/ietf_attr_fwd_enabled.h ietf/ietf_attr_fwd_enabled.c \ + ietf/ietf_attr_default_pwd_enabled.h ietf/ietf_attr_default_pwd_enabled.c \ + ietf/ietf_attr_installed_packages.h ietf/ietf_attr_installed_packages.c \ + ietf/ietf_attr_numeric_version.h ietf/ietf_attr_numeric_version.c \ + ietf/ietf_attr_op_status.h ietf/ietf_attr_op_status.c \ ietf/ietf_attr_pa_tnc_error.h ietf/ietf_attr_pa_tnc_error.c \ ietf/ietf_attr_port_filter.h ietf/ietf_attr_port_filter.c \ ietf/ietf_attr_product_info.h ietf/ietf_attr_product_info.c \ + ietf/ietf_attr_remediation_instr.h ietf/ietf_attr_remediation_instr.c \ + ietf/ietf_attr_string_version.h ietf/ietf_attr_string_version.c \ ita/ita_attr.h ita/ita_attr.c \ ita/ita_attr_command.h ita/ita_attr_command.c \ + ita/ita_attr_dummy.h ita/ita_attr_dummy.c \ + ita/ita_attr_get_settings.h ita/ita_attr_get_settings.c \ + ita/ita_attr_settings.h ita/ita_attr_settings.c \ + ita/ita_attr_angel.h ita/ita_attr_angel.c \ + ita/ita_attr_device_id.h ita/ita_attr_device_id.c \ + os_info/os_info.h os_info/os_info.c \ pa_tnc/pa_tnc_attr.h \ pa_tnc/pa_tnc_msg.h pa_tnc/pa_tnc_msg.c \ pa_tnc/pa_tnc_attr_manager.h pa_tnc/pa_tnc_attr_manager.c +ipsec_SCRIPTS = imv/_imv_policy +EXTRA_DIST = imv/_imv_policy + +ipsec_PROGRAMS = imv_policy_manager +imv_policy_manager_SOURCES = \ + imv/imv_policy_manager.c \ + imv/imv_policy_manager_usage.h imv/imv_policy_manager_usage.c +imv_policy_manager_LDADD = \ + $(top_builddir)/src/libstrongswan/libstrongswan.la +#imv/imv_policy_manager.o : $(top_builddir)/config.status + SUBDIRS = . if USE_IMC_TEST @@ -35,4 +72,12 @@ endif if USE_IMV_SCANNER SUBDIRS += plugins/imv_scanner -endif +endif + +if USE_IMC_OS + SUBDIRS += plugins/imc_os +endif + +if USE_IMV_OS + SUBDIRS += plugins/imv_os +endif diff --git a/src/libimcv/Makefile.in b/src/libimcv/Makefile.in index 7e90a7aca..296f422fe 100644 --- a/src/libimcv/Makefile.in +++ b/src/libimcv/Makefile.in @@ -1,9 +1,9 @@ -# Makefile.in generated by automake 1.11.1 from Makefile.am. +# Makefile.in generated by automake 1.11.6 from Makefile.am. # @configure_input@ # Copyright (C) 1994, 1995, 1996, 1997, 1998, 1999, 2000, 2001, 2002, -# 2003, 2004, 2005, 2006, 2007, 2008, 2009 Free Software Foundation, -# Inc. +# 2003, 2004, 2005, 2006, 2007, 2008, 2009, 2010, 2011 Free Software +# Foundation, Inc. # This Makefile.in is free software; the Free Software Foundation # gives unlimited permission to copy and/or distribute it, # with or without modifications, as long as this notice is preserved. @@ -15,7 +15,26 @@ @SET_MAKE@ + + VPATH = @srcdir@ +am__make_dryrun = \ + { \ + am__dry=no; \ + case $$MAKEFLAGS in \ + *\\[\ \ ]*) \ + echo 'am--echo: ; @echo "AM" OK' | $(MAKE) -f - 2>/dev/null \ + | grep '^AM OK$$' >/dev/null || am__dry=yes;; \ + *) \ + for am__flg in $$MAKEFLAGS; do \ + case $$am__flg in \ + *=*|--*) ;; \ + *n*) am__dry=yes; break;; \ + esac; \ + done;; \ + esac; \ + test $$am__dry = yes; \ + } pkgdatadir = $(datadir)/@PACKAGE@ pkgincludedir = $(includedir)/@PACKAGE@ pkglibdir = $(libdir)/@PACKAGE@ @@ -34,10 +53,13 @@ PRE_UNINSTALL = : POST_UNINSTALL = : build_triplet = @build@ host_triplet = @host@ +ipsec_PROGRAMS = imv_policy_manager$(EXEEXT) @USE_IMC_TEST_TRUE@am__append_1 = plugins/imc_test @USE_IMV_TEST_TRUE@am__append_2 = plugins/imv_test @USE_IMC_SCANNER_TRUE@am__append_3 = plugins/imc_scanner @USE_IMV_SCANNER_TRUE@am__append_4 = plugins/imv_scanner +@USE_IMC_OS_TRUE@am__append_5 = plugins/imc_os +@USE_IMV_OS_TRUE@am__append_6 = plugins/imv_os subdir = src/libimcv DIST_COMMON = $(srcdir)/Makefile.am $(srcdir)/Makefile.in ACLOCAL_M4 = $(top_srcdir)/aclocal.m4 @@ -49,10 +71,11 @@ am__aclocal_m4_deps = $(top_srcdir)/m4/config/libtool.m4 \ $(top_srcdir)/m4/macros/with.m4 \ $(top_srcdir)/m4/macros/enable-disable.m4 \ $(top_srcdir)/m4/macros/add-plugin.m4 \ - $(top_srcdir)/configure.in + $(top_srcdir)/configure.ac am__configure_deps = $(am__aclocal_m4_deps) $(CONFIGURE_DEPENDENCIES) \ $(ACLOCAL_M4) mkinstalldirs = $(install_sh) -d +CONFIG_HEADER = $(top_builddir)/config.h CONFIG_CLEAN_FILES = CONFIG_CLEAN_VPATH_FILES = am__vpath_adj_setup = srcdirstrip=`echo "$(srcdir)" | sed 's|.|.|g'`; @@ -76,29 +99,69 @@ am__nobase_list = $(am__nobase_strip_setup); \ am__base_list = \ sed '$$!N;$$!N;$$!N;$$!N;$$!N;$$!N;$$!N;s/\n/ /g' | \ sed '$$!N;$$!N;$$!N;$$!N;s/\n/ /g' -am__installdirs = "$(DESTDIR)$(ipseclibdir)" +am__uninstall_files_from_dir = { \ + test -z "$$files" \ + || { test ! -d "$$dir" && test ! -f "$$dir" && test ! -r "$$dir"; } \ + || { echo " ( cd '$$dir' && rm -f" $$files ")"; \ + $(am__cd) "$$dir" && rm -f $$files; }; \ + } +am__installdirs = "$(DESTDIR)$(ipseclibdir)" "$(DESTDIR)$(ipsecdir)" \ + "$(DESTDIR)$(ipsecdir)" LTLIBRARIES = $(ipseclib_LTLIBRARIES) libimcv_la_DEPENDENCIES = $(top_builddir)/src/libtncif/libtncif.la -am_libimcv_la_OBJECTS = imcv.lo imc_agent.lo imv_agent.lo ietf_attr.lo \ - ietf_attr_pa_tnc_error.lo ietf_attr_port_filter.lo \ - ietf_attr_product_info.lo ita_attr.lo ita_attr_command.lo \ +am_libimcv_la_OBJECTS = imcv.lo imc_agent.lo imc_msg.lo imv_agent.lo \ + imv_database.lo imv_msg.lo imv_lang_string.lo \ + imv_reason_string.lo imv_remediation_string.lo imv_session.lo \ + imv_workitem.lo ietf_attr.lo ietf_attr_assess_result.lo \ + ietf_attr_attr_request.lo ietf_attr_fwd_enabled.lo \ + ietf_attr_default_pwd_enabled.lo \ + ietf_attr_installed_packages.lo ietf_attr_numeric_version.lo \ + ietf_attr_op_status.lo ietf_attr_pa_tnc_error.lo \ + ietf_attr_port_filter.lo ietf_attr_product_info.lo \ + ietf_attr_remediation_instr.lo ietf_attr_string_version.lo \ + ita_attr.lo ita_attr_command.lo ita_attr_dummy.lo \ + ita_attr_get_settings.lo ita_attr_settings.lo \ + ita_attr_angel.lo ita_attr_device_id.lo os_info.lo \ pa_tnc_msg.lo pa_tnc_attr_manager.lo libimcv_la_OBJECTS = $(am_libimcv_la_OBJECTS) -DEFAULT_INCLUDES = -I.@am__isrc@ +AM_V_lt = $(am__v_lt_@AM_V@) +am__v_lt_ = $(am__v_lt_@AM_DEFAULT_V@) +am__v_lt_0 = --silent +PROGRAMS = $(ipsec_PROGRAMS) +am_imv_policy_manager_OBJECTS = imv_policy_manager.$(OBJEXT) \ + imv_policy_manager_usage.$(OBJEXT) +imv_policy_manager_OBJECTS = $(am_imv_policy_manager_OBJECTS) +imv_policy_manager_DEPENDENCIES = \ + $(top_builddir)/src/libstrongswan/libstrongswan.la +SCRIPTS = $(ipsec_SCRIPTS) +DEFAULT_INCLUDES = -I.@am__isrc@ -I$(top_builddir) depcomp = $(SHELL) $(top_srcdir)/depcomp am__depfiles_maybe = depfiles am__mv = mv -f COMPILE = $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) \ $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -LTCOMPILE = $(LIBTOOL) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) \ - --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) \ - $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) +LTCOMPILE = $(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) \ + $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) \ + $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) \ + $(AM_CFLAGS) $(CFLAGS) +AM_V_CC = $(am__v_CC_@AM_V@) +am__v_CC_ = $(am__v_CC_@AM_DEFAULT_V@) +am__v_CC_0 = @echo " CC " $@; +AM_V_at = $(am__v_at_@AM_V@) +am__v_at_ = $(am__v_at_@AM_DEFAULT_V@) +am__v_at_0 = @ CCLD = $(CC) -LINK = $(LIBTOOL) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) \ - --mode=link $(CCLD) $(AM_CFLAGS) $(CFLAGS) $(AM_LDFLAGS) \ - $(LDFLAGS) -o $@ -SOURCES = $(libimcv_la_SOURCES) -DIST_SOURCES = $(libimcv_la_SOURCES) +LINK = $(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) \ + $(LIBTOOLFLAGS) --mode=link $(CCLD) $(AM_CFLAGS) $(CFLAGS) \ + $(AM_LDFLAGS) $(LDFLAGS) -o $@ +AM_V_CCLD = $(am__v_CCLD_@AM_V@) +am__v_CCLD_ = $(am__v_CCLD_@AM_DEFAULT_V@) +am__v_CCLD_0 = @echo " CCLD " $@; +AM_V_GEN = $(am__v_GEN_@AM_V@) +am__v_GEN_ = $(am__v_GEN_@AM_DEFAULT_V@) +am__v_GEN_0 = @echo " GEN " $@; +SOURCES = $(libimcv_la_SOURCES) $(imv_policy_manager_SOURCES) +DIST_SOURCES = $(libimcv_la_SOURCES) $(imv_policy_manager_SOURCES) RECURSIVE_TARGETS = all-recursive check-recursive dvi-recursive \ html-recursive info-recursive install-data-recursive \ install-dvi-recursive install-exec-recursive \ @@ -106,6 +169,11 @@ RECURSIVE_TARGETS = all-recursive check-recursive dvi-recursive \ install-pdf-recursive install-ps-recursive install-recursive \ installcheck-recursive installdirs-recursive pdf-recursive \ ps-recursive uninstall-recursive +am__can_run_installinfo = \ + case $$AM_UPDATE_INFO_DIR in \ + n|no|NO) false;; \ + *) (install-info --version) >/dev/null 2>&1;; \ + esac RECURSIVE_CLEAN_TARGETS = mostlyclean-recursive clean-recursive \ distclean-recursive maintainer-clean-recursive AM_RECURSIVE_TARGETS = $(RECURSIVE_TARGETS:-recursive=) \ @@ -114,7 +182,7 @@ AM_RECURSIVE_TARGETS = $(RECURSIVE_TARGETS:-recursive=) \ ETAGS = etags CTAGS = ctags DIST_SUBDIRS = . plugins/imc_test plugins/imv_test plugins/imc_scanner \ - plugins/imv_scanner + plugins/imv_scanner plugins/imc_os plugins/imv_os DISTFILES = $(DIST_COMMON) $(DIST_SOURCES) $(TEXINFOS) $(EXTRA_DIST) am__relativize = \ dir0=`pwd`; \ @@ -144,21 +212,28 @@ am__relativize = \ ACLOCAL = @ACLOCAL@ ALLOCA = @ALLOCA@ AMTAR = @AMTAR@ +AM_DEFAULT_VERBOSITY = @AM_DEFAULT_VERBOSITY@ AR = @AR@ AUTOCONF = @AUTOCONF@ AUTOHEADER = @AUTOHEADER@ AUTOMAKE = @AUTOMAKE@ AWK = @AWK@ +BFDLIB = @BFDLIB@ BTLIB = @BTLIB@ CC = @CC@ CCDEPMODE = @CCDEPMODE@ CFLAGS = @CFLAGS@ +CHECK_CFLAGS = @CHECK_CFLAGS@ +CHECK_LIBS = @CHECK_LIBS@ +COVERAGE_CFLAGS = @COVERAGE_CFLAGS@ +COVERAGE_LDFLAGS = @COVERAGE_LDFLAGS@ CPP = @CPP@ CPPFLAGS = @CPPFLAGS@ CYGPATH_W = @CYGPATH_W@ DEFS = @DEFS@ DEPDIR = @DEPDIR@ DLLIB = @DLLIB@ +DLLTOOL = @DLLTOOL@ DSYMUTIL = @DSYMUTIL@ DUMPBIN = @DUMPBIN@ ECHO_C = @ECHO_C@ @@ -167,13 +242,16 @@ ECHO_T = @ECHO_T@ EGREP = @EGREP@ EXEEXT = @EXEEXT@ FGREP = @FGREP@ +GENHTML = @GENHTML@ GPERF = @GPERF@ +GPRBUILD = @GPRBUILD@ GREP = @GREP@ INSTALL = @INSTALL@ INSTALL_DATA = @INSTALL_DATA@ INSTALL_PROGRAM = @INSTALL_PROGRAM@ INSTALL_SCRIPT = @INSTALL_SCRIPT@ INSTALL_STRIP_PROGRAM = @INSTALL_STRIP_PROGRAM@ +LCOV = @LCOV@ LD = @LD@ LDFLAGS = @LDFLAGS@ LEX = @LEX@ @@ -186,6 +264,7 @@ LIPO = @LIPO@ LN_S = @LN_S@ LTLIBOBJS = @LTLIBOBJS@ MAKEINFO = @MAKEINFO@ +MANIFEST_TOOL = @MANIFEST_TOOL@ MKDIR_P = @MKDIR_P@ MYSQLCFLAG = @MYSQLCFLAG@ MYSQLCONFIG = @MYSQLCONFIG@ @@ -213,11 +292,13 @@ RANLIB = @RANLIB@ RTLIB = @RTLIB@ RUBY = @RUBY@ RUBYINCLUDE = @RUBYINCLUDE@ +RUBYLIB = @RUBYLIB@ SED = @SED@ SET_MAKE = @SET_MAKE@ SHELL = @SHELL@ SOCKLIB = @SOCKLIB@ STRIP = @STRIP@ +UNWINDLIB = @UNWINDLIB@ VERSION = @VERSION@ YACC = @YACC@ YFLAGS = @YFLAGS@ @@ -225,6 +306,7 @@ abs_builddir = @abs_builddir@ abs_srcdir = @abs_srcdir@ abs_top_builddir = @abs_top_builddir@ abs_top_srcdir = @abs_top_srcdir@ +ac_ct_AR = @ac_ct_AR@ ac_ct_CC = @ac_ct_CC@ ac_ct_DUMPBIN = @ac_ct_DUMPBIN@ am__include = @am__include@ @@ -233,8 +315,6 @@ am__quote = @am__quote@ am__tar = @am__tar@ am__untar = @am__untar@ attest_plugins = @attest_plugins@ -axis2c_CFLAGS = @axis2c_CFLAGS@ -axis2c_LIBS = @axis2c_LIBS@ bindir = @bindir@ build = @build@ build_alias = @build_alias@ @@ -243,14 +323,19 @@ build_os = @build_os@ build_vendor = @build_vendor@ builddir = @builddir@ c_plugins = @c_plugins@ +charon_natt_port = @charon_natt_port@ +charon_plugins = @charon_plugins@ +charon_udp_port = @charon_udp_port@ clearsilver_LIBS = @clearsilver_LIBS@ +cmd_plugins = @cmd_plugins@ datadir = @datadir@ datarootdir = @datarootdir@ dbusservicedir = @dbusservicedir@ -default_pkcs11 = @default_pkcs11@ +dev_headers = @dev_headers@ docdir = @docdir@ dvidir = @dvidir@ exec_prefix = @exec_prefix@ +fips_mode = @fips_mode@ gtk_CFLAGS = @gtk_CFLAGS@ gtk_LIBS = @gtk_LIBS@ h_plugins = @h_plugins@ @@ -264,17 +349,17 @@ imcvdir = @imcvdir@ includedir = @includedir@ infodir = @infodir@ install_sh = @install_sh@ +ipsec_script = @ipsec_script@ +ipsec_script_upper = @ipsec_script_upper@ ipsecdir = @ipsecdir@ ipsecgroup = @ipsecgroup@ ipseclibdir = @ipseclibdir@ ipsecuser = @ipsecuser@ -libcharon_plugins = @libcharon_plugins@ libdir = @libdir@ libexecdir = @libexecdir@ linux_headers = @linux_headers@ localedir = @localedir@ localstatedir = @localstatedir@ -lt_ECHO = @lt_ECHO@ maemo_CFLAGS = @maemo_CFLAGS@ maemo_LIBS = @maemo_LIBS@ manager_plugins = @manager_plugins@ @@ -284,16 +369,15 @@ mkdir_p = @mkdir_p@ nm_CFLAGS = @nm_CFLAGS@ nm_LIBS = @nm_LIBS@ nm_ca_dir = @nm_ca_dir@ +nm_plugins = @nm_plugins@ oldincludedir = @oldincludedir@ openac_plugins = @openac_plugins@ -p_plugins = @p_plugins@ pcsclite_CFLAGS = @pcsclite_CFLAGS@ pcsclite_LIBS = @pcsclite_LIBS@ pdfdir = @pdfdir@ piddir = @piddir@ pki_plugins = @pki_plugins@ plugindir = @plugindir@ -pluto_plugins = @pluto_plugins@ pool_plugins = @pool_plugins@ prefix = @prefix@ program_transform_name = @program_transform_name@ @@ -321,25 +405,63 @@ top_srcdir = @top_srcdir@ urandom_device = @urandom_device@ xml_CFLAGS = @xml_CFLAGS@ xml_LIBS = @xml_LIBS@ -INCLUDES = -I$(top_srcdir)/src/libstrongswan -I$(top_srcdir)/src/libtncif +AM_CPPFLAGS = \ + -I$(top_srcdir)/src/libstrongswan \ + -I$(top_srcdir)/src/libtncif + ipseclib_LTLIBRARIES = libimcv.la libimcv_la_LIBADD = $(top_builddir)/src/libtncif/libtncif.la libimcv_la_SOURCES = \ imcv.h imcv.c \ imc/imc_agent.h imc/imc_agent.c imc/imc_state.h \ + imc/imc_msg.h imc/imc_msg.c \ imv/imv_agent.h imv/imv_agent.c imv/imv_state.h \ + imv/imv_agent_if.h imv/imv_if.h \ + imv/imv_database.h imv/imv_database.c \ + imv/imv_msg.h imv/imv_msg.c \ + imv/imv_lang_string.h imv/imv_lang_string.c \ + imv/imv_reason_string.h imv/imv_reason_string.c \ + imv/imv_remediation_string.h imv/imv_remediation_string.c \ + imv/imv_session.h imv/imv_session.c \ + imv/imv_workitem.h imv/imv_workitem.c \ + imv/tables.sql imv/data.sql \ ietf/ietf_attr.h ietf/ietf_attr.c \ + ietf/ietf_attr_assess_result.h ietf/ietf_attr_assess_result.c \ + ietf/ietf_attr_attr_request.h ietf/ietf_attr_attr_request.c \ + ietf/ietf_attr_fwd_enabled.h ietf/ietf_attr_fwd_enabled.c \ + ietf/ietf_attr_default_pwd_enabled.h ietf/ietf_attr_default_pwd_enabled.c \ + ietf/ietf_attr_installed_packages.h ietf/ietf_attr_installed_packages.c \ + ietf/ietf_attr_numeric_version.h ietf/ietf_attr_numeric_version.c \ + ietf/ietf_attr_op_status.h ietf/ietf_attr_op_status.c \ ietf/ietf_attr_pa_tnc_error.h ietf/ietf_attr_pa_tnc_error.c \ ietf/ietf_attr_port_filter.h ietf/ietf_attr_port_filter.c \ ietf/ietf_attr_product_info.h ietf/ietf_attr_product_info.c \ + ietf/ietf_attr_remediation_instr.h ietf/ietf_attr_remediation_instr.c \ + ietf/ietf_attr_string_version.h ietf/ietf_attr_string_version.c \ ita/ita_attr.h ita/ita_attr.c \ ita/ita_attr_command.h ita/ita_attr_command.c \ + ita/ita_attr_dummy.h ita/ita_attr_dummy.c \ + ita/ita_attr_get_settings.h ita/ita_attr_get_settings.c \ + ita/ita_attr_settings.h ita/ita_attr_settings.c \ + ita/ita_attr_angel.h ita/ita_attr_angel.c \ + ita/ita_attr_device_id.h ita/ita_attr_device_id.c \ + os_info/os_info.h os_info/os_info.c \ pa_tnc/pa_tnc_attr.h \ pa_tnc/pa_tnc_msg.h pa_tnc/pa_tnc_msg.c \ pa_tnc/pa_tnc_attr_manager.h pa_tnc/pa_tnc_attr_manager.c +ipsec_SCRIPTS = imv/_imv_policy +EXTRA_DIST = imv/_imv_policy +imv_policy_manager_SOURCES = \ + imv/imv_policy_manager.c \ + imv/imv_policy_manager_usage.h imv/imv_policy_manager_usage.c + +imv_policy_manager_LDADD = \ + $(top_builddir)/src/libstrongswan/libstrongswan.la + +#imv/imv_policy_manager.o : $(top_builddir)/config.status SUBDIRS = . $(am__append_1) $(am__append_2) $(am__append_3) \ - $(am__append_4) + $(am__append_4) $(am__append_5) $(am__append_6) all: all-recursive .SUFFIXES: @@ -376,7 +498,6 @@ $(ACLOCAL_M4): $(am__aclocal_m4_deps) $(am__aclocal_m4_deps): install-ipseclibLTLIBRARIES: $(ipseclib_LTLIBRARIES) @$(NORMAL_INSTALL) - test -z "$(ipseclibdir)" || $(MKDIR_P) "$(DESTDIR)$(ipseclibdir)" @list='$(ipseclib_LTLIBRARIES)'; test -n "$(ipseclibdir)" || list=; \ list2=; for p in $$list; do \ if test -f $$p; then \ @@ -384,6 +505,8 @@ install-ipseclibLTLIBRARIES: $(ipseclib_LTLIBRARIES) else :; fi; \ done; \ test -z "$$list2" || { \ + echo " $(MKDIR_P) '$(DESTDIR)$(ipseclibdir)'"; \ + $(MKDIR_P) "$(DESTDIR)$(ipseclibdir)" || exit 1; \ echo " $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=install $(INSTALL) $(INSTALL_STRIP_FLAG) $$list2 '$(DESTDIR)$(ipseclibdir)'"; \ $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=install $(INSTALL) $(INSTALL_STRIP_FLAG) $$list2 "$(DESTDIR)$(ipseclibdir)"; \ } @@ -405,8 +528,92 @@ clean-ipseclibLTLIBRARIES: echo "rm -f \"$${dir}/so_locations\""; \ rm -f "$${dir}/so_locations"; \ done -libimcv.la: $(libimcv_la_OBJECTS) $(libimcv_la_DEPENDENCIES) - $(LINK) -rpath $(ipseclibdir) $(libimcv_la_OBJECTS) $(libimcv_la_LIBADD) $(LIBS) +libimcv.la: $(libimcv_la_OBJECTS) $(libimcv_la_DEPENDENCIES) $(EXTRA_libimcv_la_DEPENDENCIES) + $(AM_V_CCLD)$(LINK) -rpath $(ipseclibdir) $(libimcv_la_OBJECTS) $(libimcv_la_LIBADD) $(LIBS) +install-ipsecPROGRAMS: $(ipsec_PROGRAMS) + @$(NORMAL_INSTALL) + @list='$(ipsec_PROGRAMS)'; test -n "$(ipsecdir)" || list=; \ + if test -n "$$list"; then \ + echo " $(MKDIR_P) '$(DESTDIR)$(ipsecdir)'"; \ + $(MKDIR_P) "$(DESTDIR)$(ipsecdir)" || exit 1; \ + fi; \ + for p in $$list; do echo "$$p $$p"; done | \ + sed 's/$(EXEEXT)$$//' | \ + while read p p1; do if test -f $$p || test -f $$p1; \ + then echo "$$p"; echo "$$p"; else :; fi; \ + done | \ + sed -e 'p;s,.*/,,;n;h' -e 's|.*|.|' \ + -e 'p;x;s,.*/,,;s/$(EXEEXT)$$//;$(transform);s/$$/$(EXEEXT)/' | \ + sed 'N;N;N;s,\n, ,g' | \ + $(AWK) 'BEGIN { files["."] = ""; dirs["."] = 1 } \ + { d=$$3; if (dirs[d] != 1) { print "d", d; dirs[d] = 1 } \ + if ($$2 == $$4) files[d] = files[d] " " $$1; \ + else { print "f", $$3 "/" $$4, $$1; } } \ + END { for (d in files) print "f", d, files[d] }' | \ + while read type dir files; do \ + if test "$$dir" = .; then dir=; else dir=/$$dir; fi; \ + test -z "$$files" || { \ + echo " $(INSTALL_PROGRAM_ENV) $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=install $(INSTALL_PROGRAM) $$files '$(DESTDIR)$(ipsecdir)$$dir'"; \ + $(INSTALL_PROGRAM_ENV) $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=install $(INSTALL_PROGRAM) $$files "$(DESTDIR)$(ipsecdir)$$dir" || exit $$?; \ + } \ + ; done + +uninstall-ipsecPROGRAMS: + @$(NORMAL_UNINSTALL) + @list='$(ipsec_PROGRAMS)'; test -n "$(ipsecdir)" || list=; \ + files=`for p in $$list; do echo "$$p"; done | \ + sed -e 'h;s,^.*/,,;s/$(EXEEXT)$$//;$(transform)' \ + -e 's/$$/$(EXEEXT)/' `; \ + test -n "$$list" || exit 0; \ + echo " ( cd '$(DESTDIR)$(ipsecdir)' && rm -f" $$files ")"; \ + cd "$(DESTDIR)$(ipsecdir)" && rm -f $$files + +clean-ipsecPROGRAMS: + @list='$(ipsec_PROGRAMS)'; test -n "$$list" || exit 0; \ + echo " rm -f" $$list; \ + rm -f $$list || exit $$?; \ + test -n "$(EXEEXT)" || exit 0; \ + list=`for p in $$list; do echo "$$p"; done | sed 's/$(EXEEXT)$$//'`; \ + echo " rm -f" $$list; \ + rm -f $$list +imv_policy_manager$(EXEEXT): $(imv_policy_manager_OBJECTS) $(imv_policy_manager_DEPENDENCIES) $(EXTRA_imv_policy_manager_DEPENDENCIES) + @rm -f imv_policy_manager$(EXEEXT) + $(AM_V_CCLD)$(LINK) $(imv_policy_manager_OBJECTS) $(imv_policy_manager_LDADD) $(LIBS) +install-ipsecSCRIPTS: $(ipsec_SCRIPTS) + @$(NORMAL_INSTALL) + @list='$(ipsec_SCRIPTS)'; test -n "$(ipsecdir)" || list=; \ + if test -n "$$list"; then \ + echo " $(MKDIR_P) '$(DESTDIR)$(ipsecdir)'"; \ + $(MKDIR_P) "$(DESTDIR)$(ipsecdir)" || exit 1; \ + fi; \ + for p in $$list; do \ + if test -f "$$p"; then d=; else d="$(srcdir)/"; fi; \ + if test -f "$$d$$p"; then echo "$$d$$p"; echo "$$p"; else :; fi; \ + done | \ + sed -e 'p;s,.*/,,;n' \ + -e 'h;s|.*|.|' \ + -e 'p;x;s,.*/,,;$(transform)' | sed 'N;N;N;s,\n, ,g' | \ + $(AWK) 'BEGIN { files["."] = ""; dirs["."] = 1; } \ + { d=$$3; if (dirs[d] != 1) { print "d", d; dirs[d] = 1 } \ + if ($$2 == $$4) { files[d] = files[d] " " $$1; \ + if (++n[d] == $(am__install_max)) { \ + print "f", d, files[d]; n[d] = 0; files[d] = "" } } \ + else { print "f", d "/" $$4, $$1 } } \ + END { for (d in files) print "f", d, files[d] }' | \ + while read type dir files; do \ + if test "$$dir" = .; then dir=; else dir=/$$dir; fi; \ + test -z "$$files" || { \ + echo " $(INSTALL_SCRIPT) $$files '$(DESTDIR)$(ipsecdir)$$dir'"; \ + $(INSTALL_SCRIPT) $$files "$(DESTDIR)$(ipsecdir)$$dir" || exit $$?; \ + } \ + ; done + +uninstall-ipsecSCRIPTS: + @$(NORMAL_UNINSTALL) + @list='$(ipsec_SCRIPTS)'; test -n "$(ipsecdir)" || exit 0; \ + files=`for p in $$list; do echo "$$p"; done | \ + sed -e 's,.*/,,;$(transform)'`; \ + dir='$(DESTDIR)$(ipsecdir)'; $(am__uninstall_files_from_dir) mostlyclean-compile: -rm -f *.$(OBJEXT) @@ -415,107 +622,321 @@ distclean-compile: -rm -f *.tab.c @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/ietf_attr.Plo@am__quote@ +@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/ietf_attr_assess_result.Plo@am__quote@ +@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/ietf_attr_attr_request.Plo@am__quote@ +@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/ietf_attr_default_pwd_enabled.Plo@am__quote@ +@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/ietf_attr_fwd_enabled.Plo@am__quote@ +@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/ietf_attr_installed_packages.Plo@am__quote@ +@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/ietf_attr_numeric_version.Plo@am__quote@ +@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/ietf_attr_op_status.Plo@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/ietf_attr_pa_tnc_error.Plo@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/ietf_attr_port_filter.Plo@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/ietf_attr_product_info.Plo@am__quote@ +@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/ietf_attr_remediation_instr.Plo@am__quote@ +@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/ietf_attr_string_version.Plo@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/imc_agent.Plo@am__quote@ +@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/imc_msg.Plo@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/imcv.Plo@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/imv_agent.Plo@am__quote@ +@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/imv_database.Plo@am__quote@ +@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/imv_lang_string.Plo@am__quote@ +@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/imv_msg.Plo@am__quote@ +@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/imv_policy_manager.Po@am__quote@ +@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/imv_policy_manager_usage.Po@am__quote@ +@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/imv_reason_string.Plo@am__quote@ +@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/imv_remediation_string.Plo@am__quote@ +@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/imv_session.Plo@am__quote@ +@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/imv_workitem.Plo@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/ita_attr.Plo@am__quote@ +@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/ita_attr_angel.Plo@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/ita_attr_command.Plo@am__quote@ +@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/ita_attr_device_id.Plo@am__quote@ +@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/ita_attr_dummy.Plo@am__quote@ +@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/ita_attr_get_settings.Plo@am__quote@ +@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/ita_attr_settings.Plo@am__quote@ +@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/os_info.Plo@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/pa_tnc_attr_manager.Plo@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/pa_tnc_msg.Plo@am__quote@ .c.o: -@am__fastdepCC_TRUE@ $(COMPILE) -MT $@ -MD -MP -MF $(DEPDIR)/$*.Tpo -c -o $@ $< -@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Po -@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='$<' object='$@' libtool=no @AMDEPBACKSLASH@ +@am__fastdepCC_TRUE@ $(AM_V_CC)$(COMPILE) -MT $@ -MD -MP -MF $(DEPDIR)/$*.Tpo -c -o $@ $< +@am__fastdepCC_TRUE@ $(AM_V_at)$(am__mv) $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Po +@AMDEP_TRUE@@am__fastdepCC_FALSE@ $(AM_V_CC)source='$<' object='$@' libtool=no @AMDEPBACKSLASH@ @AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@ -@am__fastdepCC_FALSE@ $(COMPILE) -c $< +@am__fastdepCC_FALSE@ $(AM_V_CC@am__nodep@)$(COMPILE) -c $< .c.obj: -@am__fastdepCC_TRUE@ $(COMPILE) -MT $@ -MD -MP -MF $(DEPDIR)/$*.Tpo -c -o $@ `$(CYGPATH_W) '$<'` -@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Po -@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='$<' object='$@' libtool=no @AMDEPBACKSLASH@ +@am__fastdepCC_TRUE@ $(AM_V_CC)$(COMPILE) -MT $@ -MD -MP -MF $(DEPDIR)/$*.Tpo -c -o $@ `$(CYGPATH_W) '$<'` +@am__fastdepCC_TRUE@ $(AM_V_at)$(am__mv) $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Po +@AMDEP_TRUE@@am__fastdepCC_FALSE@ $(AM_V_CC)source='$<' object='$@' libtool=no @AMDEPBACKSLASH@ @AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@ -@am__fastdepCC_FALSE@ $(COMPILE) -c `$(CYGPATH_W) '$<'` +@am__fastdepCC_FALSE@ $(AM_V_CC@am__nodep@)$(COMPILE) -c `$(CYGPATH_W) '$<'` .c.lo: -@am__fastdepCC_TRUE@ $(LTCOMPILE) -MT $@ -MD -MP -MF $(DEPDIR)/$*.Tpo -c -o $@ $< -@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Plo -@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='$<' object='$@' libtool=yes @AMDEPBACKSLASH@ +@am__fastdepCC_TRUE@ $(AM_V_CC)$(LTCOMPILE) -MT $@ -MD -MP -MF $(DEPDIR)/$*.Tpo -c -o $@ $< +@am__fastdepCC_TRUE@ $(AM_V_at)$(am__mv) $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Plo +@AMDEP_TRUE@@am__fastdepCC_FALSE@ $(AM_V_CC)source='$<' object='$@' libtool=yes @AMDEPBACKSLASH@ @AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@ -@am__fastdepCC_FALSE@ $(LTCOMPILE) -c -o $@ $< +@am__fastdepCC_FALSE@ $(AM_V_CC@am__nodep@)$(LTCOMPILE) -c -o $@ $< imc_agent.lo: imc/imc_agent.c -@am__fastdepCC_TRUE@ $(LIBTOOL) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT imc_agent.lo -MD -MP -MF $(DEPDIR)/imc_agent.Tpo -c -o imc_agent.lo `test -f 'imc/imc_agent.c' || echo '$(srcdir)/'`imc/imc_agent.c -@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/imc_agent.Tpo $(DEPDIR)/imc_agent.Plo -@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='imc/imc_agent.c' object='imc_agent.lo' libtool=yes @AMDEPBACKSLASH@ +@am__fastdepCC_TRUE@ $(AM_V_CC)$(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT imc_agent.lo -MD -MP -MF $(DEPDIR)/imc_agent.Tpo -c -o imc_agent.lo `test -f 'imc/imc_agent.c' || echo '$(srcdir)/'`imc/imc_agent.c +@am__fastdepCC_TRUE@ $(AM_V_at)$(am__mv) $(DEPDIR)/imc_agent.Tpo $(DEPDIR)/imc_agent.Plo +@AMDEP_TRUE@@am__fastdepCC_FALSE@ $(AM_V_CC)source='imc/imc_agent.c' object='imc_agent.lo' libtool=yes @AMDEPBACKSLASH@ @AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@ -@am__fastdepCC_FALSE@ $(LIBTOOL) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o imc_agent.lo `test -f 'imc/imc_agent.c' || echo '$(srcdir)/'`imc/imc_agent.c +@am__fastdepCC_FALSE@ $(AM_V_CC@am__nodep@)$(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o imc_agent.lo `test -f 'imc/imc_agent.c' || echo '$(srcdir)/'`imc/imc_agent.c + +imc_msg.lo: imc/imc_msg.c +@am__fastdepCC_TRUE@ $(AM_V_CC)$(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT imc_msg.lo -MD -MP -MF $(DEPDIR)/imc_msg.Tpo -c -o imc_msg.lo `test -f 'imc/imc_msg.c' || echo '$(srcdir)/'`imc/imc_msg.c +@am__fastdepCC_TRUE@ $(AM_V_at)$(am__mv) $(DEPDIR)/imc_msg.Tpo $(DEPDIR)/imc_msg.Plo +@AMDEP_TRUE@@am__fastdepCC_FALSE@ $(AM_V_CC)source='imc/imc_msg.c' object='imc_msg.lo' libtool=yes @AMDEPBACKSLASH@ +@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@ +@am__fastdepCC_FALSE@ $(AM_V_CC@am__nodep@)$(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o imc_msg.lo `test -f 'imc/imc_msg.c' || echo '$(srcdir)/'`imc/imc_msg.c imv_agent.lo: imv/imv_agent.c -@am__fastdepCC_TRUE@ $(LIBTOOL) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT imv_agent.lo -MD -MP -MF $(DEPDIR)/imv_agent.Tpo -c -o imv_agent.lo `test -f 'imv/imv_agent.c' || echo '$(srcdir)/'`imv/imv_agent.c -@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/imv_agent.Tpo $(DEPDIR)/imv_agent.Plo -@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='imv/imv_agent.c' object='imv_agent.lo' libtool=yes @AMDEPBACKSLASH@ +@am__fastdepCC_TRUE@ $(AM_V_CC)$(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT imv_agent.lo -MD -MP -MF $(DEPDIR)/imv_agent.Tpo -c -o imv_agent.lo `test -f 'imv/imv_agent.c' || echo '$(srcdir)/'`imv/imv_agent.c +@am__fastdepCC_TRUE@ $(AM_V_at)$(am__mv) $(DEPDIR)/imv_agent.Tpo $(DEPDIR)/imv_agent.Plo +@AMDEP_TRUE@@am__fastdepCC_FALSE@ $(AM_V_CC)source='imv/imv_agent.c' object='imv_agent.lo' libtool=yes @AMDEPBACKSLASH@ @AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@ -@am__fastdepCC_FALSE@ $(LIBTOOL) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o imv_agent.lo `test -f 'imv/imv_agent.c' || echo '$(srcdir)/'`imv/imv_agent.c +@am__fastdepCC_FALSE@ $(AM_V_CC@am__nodep@)$(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o imv_agent.lo `test -f 'imv/imv_agent.c' || echo '$(srcdir)/'`imv/imv_agent.c + +imv_database.lo: imv/imv_database.c +@am__fastdepCC_TRUE@ $(AM_V_CC)$(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT imv_database.lo -MD -MP -MF $(DEPDIR)/imv_database.Tpo -c -o imv_database.lo `test -f 'imv/imv_database.c' || echo '$(srcdir)/'`imv/imv_database.c +@am__fastdepCC_TRUE@ $(AM_V_at)$(am__mv) $(DEPDIR)/imv_database.Tpo $(DEPDIR)/imv_database.Plo +@AMDEP_TRUE@@am__fastdepCC_FALSE@ $(AM_V_CC)source='imv/imv_database.c' object='imv_database.lo' libtool=yes @AMDEPBACKSLASH@ +@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@ +@am__fastdepCC_FALSE@ $(AM_V_CC@am__nodep@)$(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o imv_database.lo `test -f 'imv/imv_database.c' || echo '$(srcdir)/'`imv/imv_database.c + +imv_msg.lo: imv/imv_msg.c +@am__fastdepCC_TRUE@ $(AM_V_CC)$(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT imv_msg.lo -MD -MP -MF $(DEPDIR)/imv_msg.Tpo -c -o imv_msg.lo `test -f 'imv/imv_msg.c' || echo '$(srcdir)/'`imv/imv_msg.c +@am__fastdepCC_TRUE@ $(AM_V_at)$(am__mv) $(DEPDIR)/imv_msg.Tpo $(DEPDIR)/imv_msg.Plo +@AMDEP_TRUE@@am__fastdepCC_FALSE@ $(AM_V_CC)source='imv/imv_msg.c' object='imv_msg.lo' libtool=yes @AMDEPBACKSLASH@ +@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@ +@am__fastdepCC_FALSE@ $(AM_V_CC@am__nodep@)$(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o imv_msg.lo `test -f 'imv/imv_msg.c' || echo '$(srcdir)/'`imv/imv_msg.c + +imv_lang_string.lo: imv/imv_lang_string.c +@am__fastdepCC_TRUE@ $(AM_V_CC)$(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT imv_lang_string.lo -MD -MP -MF $(DEPDIR)/imv_lang_string.Tpo -c -o imv_lang_string.lo `test -f 'imv/imv_lang_string.c' || echo '$(srcdir)/'`imv/imv_lang_string.c +@am__fastdepCC_TRUE@ $(AM_V_at)$(am__mv) $(DEPDIR)/imv_lang_string.Tpo $(DEPDIR)/imv_lang_string.Plo +@AMDEP_TRUE@@am__fastdepCC_FALSE@ $(AM_V_CC)source='imv/imv_lang_string.c' object='imv_lang_string.lo' libtool=yes @AMDEPBACKSLASH@ +@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@ +@am__fastdepCC_FALSE@ $(AM_V_CC@am__nodep@)$(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o imv_lang_string.lo `test -f 'imv/imv_lang_string.c' || echo '$(srcdir)/'`imv/imv_lang_string.c + +imv_reason_string.lo: imv/imv_reason_string.c +@am__fastdepCC_TRUE@ $(AM_V_CC)$(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT imv_reason_string.lo -MD -MP -MF $(DEPDIR)/imv_reason_string.Tpo -c -o imv_reason_string.lo `test -f 'imv/imv_reason_string.c' || echo '$(srcdir)/'`imv/imv_reason_string.c +@am__fastdepCC_TRUE@ $(AM_V_at)$(am__mv) $(DEPDIR)/imv_reason_string.Tpo $(DEPDIR)/imv_reason_string.Plo +@AMDEP_TRUE@@am__fastdepCC_FALSE@ $(AM_V_CC)source='imv/imv_reason_string.c' object='imv_reason_string.lo' libtool=yes @AMDEPBACKSLASH@ +@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@ +@am__fastdepCC_FALSE@ $(AM_V_CC@am__nodep@)$(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o imv_reason_string.lo `test -f 'imv/imv_reason_string.c' || echo '$(srcdir)/'`imv/imv_reason_string.c + +imv_remediation_string.lo: imv/imv_remediation_string.c +@am__fastdepCC_TRUE@ $(AM_V_CC)$(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT imv_remediation_string.lo -MD -MP -MF $(DEPDIR)/imv_remediation_string.Tpo -c -o imv_remediation_string.lo `test -f 'imv/imv_remediation_string.c' || echo '$(srcdir)/'`imv/imv_remediation_string.c +@am__fastdepCC_TRUE@ $(AM_V_at)$(am__mv) $(DEPDIR)/imv_remediation_string.Tpo $(DEPDIR)/imv_remediation_string.Plo +@AMDEP_TRUE@@am__fastdepCC_FALSE@ $(AM_V_CC)source='imv/imv_remediation_string.c' object='imv_remediation_string.lo' libtool=yes @AMDEPBACKSLASH@ +@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@ +@am__fastdepCC_FALSE@ $(AM_V_CC@am__nodep@)$(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o imv_remediation_string.lo `test -f 'imv/imv_remediation_string.c' || echo '$(srcdir)/'`imv/imv_remediation_string.c + +imv_session.lo: imv/imv_session.c +@am__fastdepCC_TRUE@ $(AM_V_CC)$(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT imv_session.lo -MD -MP -MF $(DEPDIR)/imv_session.Tpo -c -o imv_session.lo `test -f 'imv/imv_session.c' || echo '$(srcdir)/'`imv/imv_session.c +@am__fastdepCC_TRUE@ $(AM_V_at)$(am__mv) $(DEPDIR)/imv_session.Tpo $(DEPDIR)/imv_session.Plo +@AMDEP_TRUE@@am__fastdepCC_FALSE@ $(AM_V_CC)source='imv/imv_session.c' object='imv_session.lo' libtool=yes @AMDEPBACKSLASH@ +@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@ +@am__fastdepCC_FALSE@ $(AM_V_CC@am__nodep@)$(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o imv_session.lo `test -f 'imv/imv_session.c' || echo '$(srcdir)/'`imv/imv_session.c + +imv_workitem.lo: imv/imv_workitem.c +@am__fastdepCC_TRUE@ $(AM_V_CC)$(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT imv_workitem.lo -MD -MP -MF $(DEPDIR)/imv_workitem.Tpo -c -o imv_workitem.lo `test -f 'imv/imv_workitem.c' || echo '$(srcdir)/'`imv/imv_workitem.c +@am__fastdepCC_TRUE@ $(AM_V_at)$(am__mv) $(DEPDIR)/imv_workitem.Tpo $(DEPDIR)/imv_workitem.Plo +@AMDEP_TRUE@@am__fastdepCC_FALSE@ $(AM_V_CC)source='imv/imv_workitem.c' object='imv_workitem.lo' libtool=yes @AMDEPBACKSLASH@ +@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@ +@am__fastdepCC_FALSE@ $(AM_V_CC@am__nodep@)$(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o imv_workitem.lo `test -f 'imv/imv_workitem.c' || echo '$(srcdir)/'`imv/imv_workitem.c ietf_attr.lo: ietf/ietf_attr.c -@am__fastdepCC_TRUE@ $(LIBTOOL) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT ietf_attr.lo -MD -MP -MF $(DEPDIR)/ietf_attr.Tpo -c -o ietf_attr.lo `test -f 'ietf/ietf_attr.c' || echo '$(srcdir)/'`ietf/ietf_attr.c -@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/ietf_attr.Tpo $(DEPDIR)/ietf_attr.Plo -@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='ietf/ietf_attr.c' object='ietf_attr.lo' libtool=yes @AMDEPBACKSLASH@ +@am__fastdepCC_TRUE@ $(AM_V_CC)$(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT ietf_attr.lo -MD -MP -MF $(DEPDIR)/ietf_attr.Tpo -c -o ietf_attr.lo `test -f 'ietf/ietf_attr.c' || echo '$(srcdir)/'`ietf/ietf_attr.c +@am__fastdepCC_TRUE@ $(AM_V_at)$(am__mv) $(DEPDIR)/ietf_attr.Tpo $(DEPDIR)/ietf_attr.Plo +@AMDEP_TRUE@@am__fastdepCC_FALSE@ $(AM_V_CC)source='ietf/ietf_attr.c' object='ietf_attr.lo' libtool=yes @AMDEPBACKSLASH@ +@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@ +@am__fastdepCC_FALSE@ $(AM_V_CC@am__nodep@)$(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o ietf_attr.lo `test -f 'ietf/ietf_attr.c' || echo '$(srcdir)/'`ietf/ietf_attr.c + +ietf_attr_assess_result.lo: ietf/ietf_attr_assess_result.c +@am__fastdepCC_TRUE@ $(AM_V_CC)$(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT ietf_attr_assess_result.lo -MD -MP -MF $(DEPDIR)/ietf_attr_assess_result.Tpo -c -o ietf_attr_assess_result.lo `test -f 'ietf/ietf_attr_assess_result.c' || echo '$(srcdir)/'`ietf/ietf_attr_assess_result.c +@am__fastdepCC_TRUE@ $(AM_V_at)$(am__mv) $(DEPDIR)/ietf_attr_assess_result.Tpo $(DEPDIR)/ietf_attr_assess_result.Plo +@AMDEP_TRUE@@am__fastdepCC_FALSE@ $(AM_V_CC)source='ietf/ietf_attr_assess_result.c' object='ietf_attr_assess_result.lo' libtool=yes @AMDEPBACKSLASH@ +@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@ +@am__fastdepCC_FALSE@ $(AM_V_CC@am__nodep@)$(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o ietf_attr_assess_result.lo `test -f 'ietf/ietf_attr_assess_result.c' || echo '$(srcdir)/'`ietf/ietf_attr_assess_result.c + +ietf_attr_attr_request.lo: ietf/ietf_attr_attr_request.c +@am__fastdepCC_TRUE@ $(AM_V_CC)$(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT ietf_attr_attr_request.lo -MD -MP -MF $(DEPDIR)/ietf_attr_attr_request.Tpo -c -o ietf_attr_attr_request.lo `test -f 'ietf/ietf_attr_attr_request.c' || echo '$(srcdir)/'`ietf/ietf_attr_attr_request.c +@am__fastdepCC_TRUE@ $(AM_V_at)$(am__mv) $(DEPDIR)/ietf_attr_attr_request.Tpo $(DEPDIR)/ietf_attr_attr_request.Plo +@AMDEP_TRUE@@am__fastdepCC_FALSE@ $(AM_V_CC)source='ietf/ietf_attr_attr_request.c' object='ietf_attr_attr_request.lo' libtool=yes @AMDEPBACKSLASH@ +@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@ +@am__fastdepCC_FALSE@ $(AM_V_CC@am__nodep@)$(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o ietf_attr_attr_request.lo `test -f 'ietf/ietf_attr_attr_request.c' || echo '$(srcdir)/'`ietf/ietf_attr_attr_request.c + +ietf_attr_fwd_enabled.lo: ietf/ietf_attr_fwd_enabled.c +@am__fastdepCC_TRUE@ $(AM_V_CC)$(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT ietf_attr_fwd_enabled.lo -MD -MP -MF $(DEPDIR)/ietf_attr_fwd_enabled.Tpo -c -o ietf_attr_fwd_enabled.lo `test -f 'ietf/ietf_attr_fwd_enabled.c' || echo '$(srcdir)/'`ietf/ietf_attr_fwd_enabled.c +@am__fastdepCC_TRUE@ $(AM_V_at)$(am__mv) $(DEPDIR)/ietf_attr_fwd_enabled.Tpo $(DEPDIR)/ietf_attr_fwd_enabled.Plo +@AMDEP_TRUE@@am__fastdepCC_FALSE@ $(AM_V_CC)source='ietf/ietf_attr_fwd_enabled.c' object='ietf_attr_fwd_enabled.lo' libtool=yes @AMDEPBACKSLASH@ +@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@ +@am__fastdepCC_FALSE@ $(AM_V_CC@am__nodep@)$(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o ietf_attr_fwd_enabled.lo `test -f 'ietf/ietf_attr_fwd_enabled.c' || echo '$(srcdir)/'`ietf/ietf_attr_fwd_enabled.c + +ietf_attr_default_pwd_enabled.lo: ietf/ietf_attr_default_pwd_enabled.c +@am__fastdepCC_TRUE@ $(AM_V_CC)$(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT ietf_attr_default_pwd_enabled.lo -MD -MP -MF $(DEPDIR)/ietf_attr_default_pwd_enabled.Tpo -c -o ietf_attr_default_pwd_enabled.lo `test -f 'ietf/ietf_attr_default_pwd_enabled.c' || echo '$(srcdir)/'`ietf/ietf_attr_default_pwd_enabled.c +@am__fastdepCC_TRUE@ $(AM_V_at)$(am__mv) $(DEPDIR)/ietf_attr_default_pwd_enabled.Tpo $(DEPDIR)/ietf_attr_default_pwd_enabled.Plo +@AMDEP_TRUE@@am__fastdepCC_FALSE@ $(AM_V_CC)source='ietf/ietf_attr_default_pwd_enabled.c' object='ietf_attr_default_pwd_enabled.lo' libtool=yes @AMDEPBACKSLASH@ +@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@ +@am__fastdepCC_FALSE@ $(AM_V_CC@am__nodep@)$(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o ietf_attr_default_pwd_enabled.lo `test -f 'ietf/ietf_attr_default_pwd_enabled.c' || echo '$(srcdir)/'`ietf/ietf_attr_default_pwd_enabled.c + +ietf_attr_installed_packages.lo: ietf/ietf_attr_installed_packages.c +@am__fastdepCC_TRUE@ $(AM_V_CC)$(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT ietf_attr_installed_packages.lo -MD -MP -MF $(DEPDIR)/ietf_attr_installed_packages.Tpo -c -o ietf_attr_installed_packages.lo `test -f 'ietf/ietf_attr_installed_packages.c' || echo '$(srcdir)/'`ietf/ietf_attr_installed_packages.c +@am__fastdepCC_TRUE@ $(AM_V_at)$(am__mv) $(DEPDIR)/ietf_attr_installed_packages.Tpo $(DEPDIR)/ietf_attr_installed_packages.Plo +@AMDEP_TRUE@@am__fastdepCC_FALSE@ $(AM_V_CC)source='ietf/ietf_attr_installed_packages.c' object='ietf_attr_installed_packages.lo' libtool=yes @AMDEPBACKSLASH@ +@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@ +@am__fastdepCC_FALSE@ $(AM_V_CC@am__nodep@)$(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o ietf_attr_installed_packages.lo `test -f 'ietf/ietf_attr_installed_packages.c' || echo '$(srcdir)/'`ietf/ietf_attr_installed_packages.c + +ietf_attr_numeric_version.lo: ietf/ietf_attr_numeric_version.c +@am__fastdepCC_TRUE@ $(AM_V_CC)$(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT ietf_attr_numeric_version.lo -MD -MP -MF $(DEPDIR)/ietf_attr_numeric_version.Tpo -c -o ietf_attr_numeric_version.lo `test -f 'ietf/ietf_attr_numeric_version.c' || echo '$(srcdir)/'`ietf/ietf_attr_numeric_version.c +@am__fastdepCC_TRUE@ $(AM_V_at)$(am__mv) $(DEPDIR)/ietf_attr_numeric_version.Tpo $(DEPDIR)/ietf_attr_numeric_version.Plo +@AMDEP_TRUE@@am__fastdepCC_FALSE@ $(AM_V_CC)source='ietf/ietf_attr_numeric_version.c' object='ietf_attr_numeric_version.lo' libtool=yes @AMDEPBACKSLASH@ +@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@ +@am__fastdepCC_FALSE@ $(AM_V_CC@am__nodep@)$(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o ietf_attr_numeric_version.lo `test -f 'ietf/ietf_attr_numeric_version.c' || echo '$(srcdir)/'`ietf/ietf_attr_numeric_version.c + +ietf_attr_op_status.lo: ietf/ietf_attr_op_status.c +@am__fastdepCC_TRUE@ $(AM_V_CC)$(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT ietf_attr_op_status.lo -MD -MP -MF $(DEPDIR)/ietf_attr_op_status.Tpo -c -o ietf_attr_op_status.lo `test -f 'ietf/ietf_attr_op_status.c' || echo '$(srcdir)/'`ietf/ietf_attr_op_status.c +@am__fastdepCC_TRUE@ $(AM_V_at)$(am__mv) $(DEPDIR)/ietf_attr_op_status.Tpo $(DEPDIR)/ietf_attr_op_status.Plo +@AMDEP_TRUE@@am__fastdepCC_FALSE@ $(AM_V_CC)source='ietf/ietf_attr_op_status.c' object='ietf_attr_op_status.lo' libtool=yes @AMDEPBACKSLASH@ @AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@ -@am__fastdepCC_FALSE@ $(LIBTOOL) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o ietf_attr.lo `test -f 'ietf/ietf_attr.c' || echo '$(srcdir)/'`ietf/ietf_attr.c +@am__fastdepCC_FALSE@ $(AM_V_CC@am__nodep@)$(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o ietf_attr_op_status.lo `test -f 'ietf/ietf_attr_op_status.c' || echo '$(srcdir)/'`ietf/ietf_attr_op_status.c ietf_attr_pa_tnc_error.lo: ietf/ietf_attr_pa_tnc_error.c -@am__fastdepCC_TRUE@ $(LIBTOOL) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT ietf_attr_pa_tnc_error.lo -MD -MP -MF $(DEPDIR)/ietf_attr_pa_tnc_error.Tpo -c -o ietf_attr_pa_tnc_error.lo `test -f 'ietf/ietf_attr_pa_tnc_error.c' || echo '$(srcdir)/'`ietf/ietf_attr_pa_tnc_error.c -@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/ietf_attr_pa_tnc_error.Tpo $(DEPDIR)/ietf_attr_pa_tnc_error.Plo -@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='ietf/ietf_attr_pa_tnc_error.c' object='ietf_attr_pa_tnc_error.lo' libtool=yes @AMDEPBACKSLASH@ +@am__fastdepCC_TRUE@ $(AM_V_CC)$(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT ietf_attr_pa_tnc_error.lo -MD -MP -MF $(DEPDIR)/ietf_attr_pa_tnc_error.Tpo -c -o ietf_attr_pa_tnc_error.lo `test -f 'ietf/ietf_attr_pa_tnc_error.c' || echo '$(srcdir)/'`ietf/ietf_attr_pa_tnc_error.c +@am__fastdepCC_TRUE@ $(AM_V_at)$(am__mv) $(DEPDIR)/ietf_attr_pa_tnc_error.Tpo $(DEPDIR)/ietf_attr_pa_tnc_error.Plo +@AMDEP_TRUE@@am__fastdepCC_FALSE@ $(AM_V_CC)source='ietf/ietf_attr_pa_tnc_error.c' object='ietf_attr_pa_tnc_error.lo' libtool=yes @AMDEPBACKSLASH@ @AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@ -@am__fastdepCC_FALSE@ $(LIBTOOL) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o ietf_attr_pa_tnc_error.lo `test -f 'ietf/ietf_attr_pa_tnc_error.c' || echo '$(srcdir)/'`ietf/ietf_attr_pa_tnc_error.c +@am__fastdepCC_FALSE@ $(AM_V_CC@am__nodep@)$(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o ietf_attr_pa_tnc_error.lo `test -f 'ietf/ietf_attr_pa_tnc_error.c' || echo '$(srcdir)/'`ietf/ietf_attr_pa_tnc_error.c ietf_attr_port_filter.lo: ietf/ietf_attr_port_filter.c -@am__fastdepCC_TRUE@ $(LIBTOOL) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT ietf_attr_port_filter.lo -MD -MP -MF $(DEPDIR)/ietf_attr_port_filter.Tpo -c -o ietf_attr_port_filter.lo `test -f 'ietf/ietf_attr_port_filter.c' || echo '$(srcdir)/'`ietf/ietf_attr_port_filter.c -@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/ietf_attr_port_filter.Tpo $(DEPDIR)/ietf_attr_port_filter.Plo -@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='ietf/ietf_attr_port_filter.c' object='ietf_attr_port_filter.lo' libtool=yes @AMDEPBACKSLASH@ +@am__fastdepCC_TRUE@ $(AM_V_CC)$(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT ietf_attr_port_filter.lo -MD -MP -MF $(DEPDIR)/ietf_attr_port_filter.Tpo -c -o ietf_attr_port_filter.lo `test -f 'ietf/ietf_attr_port_filter.c' || echo '$(srcdir)/'`ietf/ietf_attr_port_filter.c +@am__fastdepCC_TRUE@ $(AM_V_at)$(am__mv) $(DEPDIR)/ietf_attr_port_filter.Tpo $(DEPDIR)/ietf_attr_port_filter.Plo +@AMDEP_TRUE@@am__fastdepCC_FALSE@ $(AM_V_CC)source='ietf/ietf_attr_port_filter.c' object='ietf_attr_port_filter.lo' libtool=yes @AMDEPBACKSLASH@ @AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@ -@am__fastdepCC_FALSE@ $(LIBTOOL) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o ietf_attr_port_filter.lo `test -f 'ietf/ietf_attr_port_filter.c' || echo '$(srcdir)/'`ietf/ietf_attr_port_filter.c +@am__fastdepCC_FALSE@ $(AM_V_CC@am__nodep@)$(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o ietf_attr_port_filter.lo `test -f 'ietf/ietf_attr_port_filter.c' || echo '$(srcdir)/'`ietf/ietf_attr_port_filter.c ietf_attr_product_info.lo: ietf/ietf_attr_product_info.c -@am__fastdepCC_TRUE@ $(LIBTOOL) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT ietf_attr_product_info.lo -MD -MP -MF $(DEPDIR)/ietf_attr_product_info.Tpo -c -o ietf_attr_product_info.lo `test -f 'ietf/ietf_attr_product_info.c' || echo '$(srcdir)/'`ietf/ietf_attr_product_info.c -@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/ietf_attr_product_info.Tpo $(DEPDIR)/ietf_attr_product_info.Plo -@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='ietf/ietf_attr_product_info.c' object='ietf_attr_product_info.lo' libtool=yes @AMDEPBACKSLASH@ +@am__fastdepCC_TRUE@ $(AM_V_CC)$(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT ietf_attr_product_info.lo -MD -MP -MF $(DEPDIR)/ietf_attr_product_info.Tpo -c -o ietf_attr_product_info.lo `test -f 'ietf/ietf_attr_product_info.c' || echo '$(srcdir)/'`ietf/ietf_attr_product_info.c +@am__fastdepCC_TRUE@ $(AM_V_at)$(am__mv) $(DEPDIR)/ietf_attr_product_info.Tpo $(DEPDIR)/ietf_attr_product_info.Plo +@AMDEP_TRUE@@am__fastdepCC_FALSE@ $(AM_V_CC)source='ietf/ietf_attr_product_info.c' object='ietf_attr_product_info.lo' libtool=yes @AMDEPBACKSLASH@ @AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@ -@am__fastdepCC_FALSE@ $(LIBTOOL) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o ietf_attr_product_info.lo `test -f 'ietf/ietf_attr_product_info.c' || echo '$(srcdir)/'`ietf/ietf_attr_product_info.c +@am__fastdepCC_FALSE@ $(AM_V_CC@am__nodep@)$(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o ietf_attr_product_info.lo `test -f 'ietf/ietf_attr_product_info.c' || echo '$(srcdir)/'`ietf/ietf_attr_product_info.c + +ietf_attr_remediation_instr.lo: ietf/ietf_attr_remediation_instr.c +@am__fastdepCC_TRUE@ $(AM_V_CC)$(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT ietf_attr_remediation_instr.lo -MD -MP -MF $(DEPDIR)/ietf_attr_remediation_instr.Tpo -c -o ietf_attr_remediation_instr.lo `test -f 'ietf/ietf_attr_remediation_instr.c' || echo '$(srcdir)/'`ietf/ietf_attr_remediation_instr.c +@am__fastdepCC_TRUE@ $(AM_V_at)$(am__mv) $(DEPDIR)/ietf_attr_remediation_instr.Tpo $(DEPDIR)/ietf_attr_remediation_instr.Plo +@AMDEP_TRUE@@am__fastdepCC_FALSE@ $(AM_V_CC)source='ietf/ietf_attr_remediation_instr.c' object='ietf_attr_remediation_instr.lo' libtool=yes @AMDEPBACKSLASH@ +@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@ +@am__fastdepCC_FALSE@ $(AM_V_CC@am__nodep@)$(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o ietf_attr_remediation_instr.lo `test -f 'ietf/ietf_attr_remediation_instr.c' || echo '$(srcdir)/'`ietf/ietf_attr_remediation_instr.c + +ietf_attr_string_version.lo: ietf/ietf_attr_string_version.c +@am__fastdepCC_TRUE@ $(AM_V_CC)$(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT ietf_attr_string_version.lo -MD -MP -MF $(DEPDIR)/ietf_attr_string_version.Tpo -c -o ietf_attr_string_version.lo `test -f 'ietf/ietf_attr_string_version.c' || echo '$(srcdir)/'`ietf/ietf_attr_string_version.c +@am__fastdepCC_TRUE@ $(AM_V_at)$(am__mv) $(DEPDIR)/ietf_attr_string_version.Tpo $(DEPDIR)/ietf_attr_string_version.Plo +@AMDEP_TRUE@@am__fastdepCC_FALSE@ $(AM_V_CC)source='ietf/ietf_attr_string_version.c' object='ietf_attr_string_version.lo' libtool=yes @AMDEPBACKSLASH@ +@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@ +@am__fastdepCC_FALSE@ $(AM_V_CC@am__nodep@)$(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o ietf_attr_string_version.lo `test -f 'ietf/ietf_attr_string_version.c' || echo '$(srcdir)/'`ietf/ietf_attr_string_version.c ita_attr.lo: ita/ita_attr.c -@am__fastdepCC_TRUE@ $(LIBTOOL) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT ita_attr.lo -MD -MP -MF $(DEPDIR)/ita_attr.Tpo -c -o ita_attr.lo `test -f 'ita/ita_attr.c' || echo '$(srcdir)/'`ita/ita_attr.c -@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/ita_attr.Tpo $(DEPDIR)/ita_attr.Plo -@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='ita/ita_attr.c' object='ita_attr.lo' libtool=yes @AMDEPBACKSLASH@ +@am__fastdepCC_TRUE@ $(AM_V_CC)$(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT ita_attr.lo -MD -MP -MF $(DEPDIR)/ita_attr.Tpo -c -o ita_attr.lo `test -f 'ita/ita_attr.c' || echo '$(srcdir)/'`ita/ita_attr.c +@am__fastdepCC_TRUE@ $(AM_V_at)$(am__mv) $(DEPDIR)/ita_attr.Tpo $(DEPDIR)/ita_attr.Plo +@AMDEP_TRUE@@am__fastdepCC_FALSE@ $(AM_V_CC)source='ita/ita_attr.c' object='ita_attr.lo' libtool=yes @AMDEPBACKSLASH@ @AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@ -@am__fastdepCC_FALSE@ $(LIBTOOL) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o ita_attr.lo `test -f 'ita/ita_attr.c' || echo '$(srcdir)/'`ita/ita_attr.c +@am__fastdepCC_FALSE@ $(AM_V_CC@am__nodep@)$(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o ita_attr.lo `test -f 'ita/ita_attr.c' || echo '$(srcdir)/'`ita/ita_attr.c ita_attr_command.lo: ita/ita_attr_command.c -@am__fastdepCC_TRUE@ $(LIBTOOL) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT ita_attr_command.lo -MD -MP -MF $(DEPDIR)/ita_attr_command.Tpo -c -o ita_attr_command.lo `test -f 'ita/ita_attr_command.c' || echo '$(srcdir)/'`ita/ita_attr_command.c -@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/ita_attr_command.Tpo $(DEPDIR)/ita_attr_command.Plo -@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='ita/ita_attr_command.c' object='ita_attr_command.lo' libtool=yes @AMDEPBACKSLASH@ +@am__fastdepCC_TRUE@ $(AM_V_CC)$(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT ita_attr_command.lo -MD -MP -MF $(DEPDIR)/ita_attr_command.Tpo -c -o ita_attr_command.lo `test -f 'ita/ita_attr_command.c' || echo '$(srcdir)/'`ita/ita_attr_command.c +@am__fastdepCC_TRUE@ $(AM_V_at)$(am__mv) $(DEPDIR)/ita_attr_command.Tpo $(DEPDIR)/ita_attr_command.Plo +@AMDEP_TRUE@@am__fastdepCC_FALSE@ $(AM_V_CC)source='ita/ita_attr_command.c' object='ita_attr_command.lo' libtool=yes @AMDEPBACKSLASH@ +@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@ +@am__fastdepCC_FALSE@ $(AM_V_CC@am__nodep@)$(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o ita_attr_command.lo `test -f 'ita/ita_attr_command.c' || echo '$(srcdir)/'`ita/ita_attr_command.c + +ita_attr_dummy.lo: ita/ita_attr_dummy.c +@am__fastdepCC_TRUE@ $(AM_V_CC)$(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT ita_attr_dummy.lo -MD -MP -MF $(DEPDIR)/ita_attr_dummy.Tpo -c -o ita_attr_dummy.lo `test -f 'ita/ita_attr_dummy.c' || echo '$(srcdir)/'`ita/ita_attr_dummy.c +@am__fastdepCC_TRUE@ $(AM_V_at)$(am__mv) $(DEPDIR)/ita_attr_dummy.Tpo $(DEPDIR)/ita_attr_dummy.Plo +@AMDEP_TRUE@@am__fastdepCC_FALSE@ $(AM_V_CC)source='ita/ita_attr_dummy.c' object='ita_attr_dummy.lo' libtool=yes @AMDEPBACKSLASH@ +@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@ +@am__fastdepCC_FALSE@ $(AM_V_CC@am__nodep@)$(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o ita_attr_dummy.lo `test -f 'ita/ita_attr_dummy.c' || echo '$(srcdir)/'`ita/ita_attr_dummy.c + +ita_attr_get_settings.lo: ita/ita_attr_get_settings.c +@am__fastdepCC_TRUE@ $(AM_V_CC)$(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT ita_attr_get_settings.lo -MD -MP -MF $(DEPDIR)/ita_attr_get_settings.Tpo -c -o ita_attr_get_settings.lo `test -f 'ita/ita_attr_get_settings.c' || echo '$(srcdir)/'`ita/ita_attr_get_settings.c +@am__fastdepCC_TRUE@ $(AM_V_at)$(am__mv) $(DEPDIR)/ita_attr_get_settings.Tpo $(DEPDIR)/ita_attr_get_settings.Plo +@AMDEP_TRUE@@am__fastdepCC_FALSE@ $(AM_V_CC)source='ita/ita_attr_get_settings.c' object='ita_attr_get_settings.lo' libtool=yes @AMDEPBACKSLASH@ +@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@ +@am__fastdepCC_FALSE@ $(AM_V_CC@am__nodep@)$(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o ita_attr_get_settings.lo `test -f 'ita/ita_attr_get_settings.c' || echo '$(srcdir)/'`ita/ita_attr_get_settings.c + +ita_attr_settings.lo: ita/ita_attr_settings.c +@am__fastdepCC_TRUE@ $(AM_V_CC)$(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT ita_attr_settings.lo -MD -MP -MF $(DEPDIR)/ita_attr_settings.Tpo -c -o ita_attr_settings.lo `test -f 'ita/ita_attr_settings.c' || echo '$(srcdir)/'`ita/ita_attr_settings.c +@am__fastdepCC_TRUE@ $(AM_V_at)$(am__mv) $(DEPDIR)/ita_attr_settings.Tpo $(DEPDIR)/ita_attr_settings.Plo +@AMDEP_TRUE@@am__fastdepCC_FALSE@ $(AM_V_CC)source='ita/ita_attr_settings.c' object='ita_attr_settings.lo' libtool=yes @AMDEPBACKSLASH@ +@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@ +@am__fastdepCC_FALSE@ $(AM_V_CC@am__nodep@)$(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o ita_attr_settings.lo `test -f 'ita/ita_attr_settings.c' || echo '$(srcdir)/'`ita/ita_attr_settings.c + +ita_attr_angel.lo: ita/ita_attr_angel.c +@am__fastdepCC_TRUE@ $(AM_V_CC)$(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT ita_attr_angel.lo -MD -MP -MF $(DEPDIR)/ita_attr_angel.Tpo -c -o ita_attr_angel.lo `test -f 'ita/ita_attr_angel.c' || echo '$(srcdir)/'`ita/ita_attr_angel.c +@am__fastdepCC_TRUE@ $(AM_V_at)$(am__mv) $(DEPDIR)/ita_attr_angel.Tpo $(DEPDIR)/ita_attr_angel.Plo +@AMDEP_TRUE@@am__fastdepCC_FALSE@ $(AM_V_CC)source='ita/ita_attr_angel.c' object='ita_attr_angel.lo' libtool=yes @AMDEPBACKSLASH@ +@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@ +@am__fastdepCC_FALSE@ $(AM_V_CC@am__nodep@)$(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o ita_attr_angel.lo `test -f 'ita/ita_attr_angel.c' || echo '$(srcdir)/'`ita/ita_attr_angel.c + +ita_attr_device_id.lo: ita/ita_attr_device_id.c +@am__fastdepCC_TRUE@ $(AM_V_CC)$(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT ita_attr_device_id.lo -MD -MP -MF $(DEPDIR)/ita_attr_device_id.Tpo -c -o ita_attr_device_id.lo `test -f 'ita/ita_attr_device_id.c' || echo '$(srcdir)/'`ita/ita_attr_device_id.c +@am__fastdepCC_TRUE@ $(AM_V_at)$(am__mv) $(DEPDIR)/ita_attr_device_id.Tpo $(DEPDIR)/ita_attr_device_id.Plo +@AMDEP_TRUE@@am__fastdepCC_FALSE@ $(AM_V_CC)source='ita/ita_attr_device_id.c' object='ita_attr_device_id.lo' libtool=yes @AMDEPBACKSLASH@ @AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@ -@am__fastdepCC_FALSE@ $(LIBTOOL) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o ita_attr_command.lo `test -f 'ita/ita_attr_command.c' || echo '$(srcdir)/'`ita/ita_attr_command.c +@am__fastdepCC_FALSE@ $(AM_V_CC@am__nodep@)$(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o ita_attr_device_id.lo `test -f 'ita/ita_attr_device_id.c' || echo '$(srcdir)/'`ita/ita_attr_device_id.c + +os_info.lo: os_info/os_info.c +@am__fastdepCC_TRUE@ $(AM_V_CC)$(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT os_info.lo -MD -MP -MF $(DEPDIR)/os_info.Tpo -c -o os_info.lo `test -f 'os_info/os_info.c' || echo '$(srcdir)/'`os_info/os_info.c +@am__fastdepCC_TRUE@ $(AM_V_at)$(am__mv) $(DEPDIR)/os_info.Tpo $(DEPDIR)/os_info.Plo +@AMDEP_TRUE@@am__fastdepCC_FALSE@ $(AM_V_CC)source='os_info/os_info.c' object='os_info.lo' libtool=yes @AMDEPBACKSLASH@ +@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@ +@am__fastdepCC_FALSE@ $(AM_V_CC@am__nodep@)$(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o os_info.lo `test -f 'os_info/os_info.c' || echo '$(srcdir)/'`os_info/os_info.c pa_tnc_msg.lo: pa_tnc/pa_tnc_msg.c -@am__fastdepCC_TRUE@ $(LIBTOOL) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT pa_tnc_msg.lo -MD -MP -MF $(DEPDIR)/pa_tnc_msg.Tpo -c -o pa_tnc_msg.lo `test -f 'pa_tnc/pa_tnc_msg.c' || echo '$(srcdir)/'`pa_tnc/pa_tnc_msg.c -@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/pa_tnc_msg.Tpo $(DEPDIR)/pa_tnc_msg.Plo -@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='pa_tnc/pa_tnc_msg.c' object='pa_tnc_msg.lo' libtool=yes @AMDEPBACKSLASH@ +@am__fastdepCC_TRUE@ $(AM_V_CC)$(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT pa_tnc_msg.lo -MD -MP -MF $(DEPDIR)/pa_tnc_msg.Tpo -c -o pa_tnc_msg.lo `test -f 'pa_tnc/pa_tnc_msg.c' || echo '$(srcdir)/'`pa_tnc/pa_tnc_msg.c +@am__fastdepCC_TRUE@ $(AM_V_at)$(am__mv) $(DEPDIR)/pa_tnc_msg.Tpo $(DEPDIR)/pa_tnc_msg.Plo +@AMDEP_TRUE@@am__fastdepCC_FALSE@ $(AM_V_CC)source='pa_tnc/pa_tnc_msg.c' object='pa_tnc_msg.lo' libtool=yes @AMDEPBACKSLASH@ @AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@ -@am__fastdepCC_FALSE@ $(LIBTOOL) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o pa_tnc_msg.lo `test -f 'pa_tnc/pa_tnc_msg.c' || echo '$(srcdir)/'`pa_tnc/pa_tnc_msg.c +@am__fastdepCC_FALSE@ $(AM_V_CC@am__nodep@)$(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o pa_tnc_msg.lo `test -f 'pa_tnc/pa_tnc_msg.c' || echo '$(srcdir)/'`pa_tnc/pa_tnc_msg.c pa_tnc_attr_manager.lo: pa_tnc/pa_tnc_attr_manager.c -@am__fastdepCC_TRUE@ $(LIBTOOL) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT pa_tnc_attr_manager.lo -MD -MP -MF $(DEPDIR)/pa_tnc_attr_manager.Tpo -c -o pa_tnc_attr_manager.lo `test -f 'pa_tnc/pa_tnc_attr_manager.c' || echo '$(srcdir)/'`pa_tnc/pa_tnc_attr_manager.c -@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/pa_tnc_attr_manager.Tpo $(DEPDIR)/pa_tnc_attr_manager.Plo -@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='pa_tnc/pa_tnc_attr_manager.c' object='pa_tnc_attr_manager.lo' libtool=yes @AMDEPBACKSLASH@ +@am__fastdepCC_TRUE@ $(AM_V_CC)$(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT pa_tnc_attr_manager.lo -MD -MP -MF $(DEPDIR)/pa_tnc_attr_manager.Tpo -c -o pa_tnc_attr_manager.lo `test -f 'pa_tnc/pa_tnc_attr_manager.c' || echo '$(srcdir)/'`pa_tnc/pa_tnc_attr_manager.c +@am__fastdepCC_TRUE@ $(AM_V_at)$(am__mv) $(DEPDIR)/pa_tnc_attr_manager.Tpo $(DEPDIR)/pa_tnc_attr_manager.Plo +@AMDEP_TRUE@@am__fastdepCC_FALSE@ $(AM_V_CC)source='pa_tnc/pa_tnc_attr_manager.c' object='pa_tnc_attr_manager.lo' libtool=yes @AMDEPBACKSLASH@ +@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@ +@am__fastdepCC_FALSE@ $(AM_V_CC@am__nodep@)$(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o pa_tnc_attr_manager.lo `test -f 'pa_tnc/pa_tnc_attr_manager.c' || echo '$(srcdir)/'`pa_tnc/pa_tnc_attr_manager.c + +imv_policy_manager.o: imv/imv_policy_manager.c +@am__fastdepCC_TRUE@ $(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT imv_policy_manager.o -MD -MP -MF $(DEPDIR)/imv_policy_manager.Tpo -c -o imv_policy_manager.o `test -f 'imv/imv_policy_manager.c' || echo '$(srcdir)/'`imv/imv_policy_manager.c +@am__fastdepCC_TRUE@ $(AM_V_at)$(am__mv) $(DEPDIR)/imv_policy_manager.Tpo $(DEPDIR)/imv_policy_manager.Po +@AMDEP_TRUE@@am__fastdepCC_FALSE@ $(AM_V_CC)source='imv/imv_policy_manager.c' object='imv_policy_manager.o' libtool=no @AMDEPBACKSLASH@ +@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@ +@am__fastdepCC_FALSE@ $(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o imv_policy_manager.o `test -f 'imv/imv_policy_manager.c' || echo '$(srcdir)/'`imv/imv_policy_manager.c + +imv_policy_manager.obj: imv/imv_policy_manager.c +@am__fastdepCC_TRUE@ $(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT imv_policy_manager.obj -MD -MP -MF $(DEPDIR)/imv_policy_manager.Tpo -c -o imv_policy_manager.obj `if test -f 'imv/imv_policy_manager.c'; then $(CYGPATH_W) 'imv/imv_policy_manager.c'; else $(CYGPATH_W) '$(srcdir)/imv/imv_policy_manager.c'; fi` +@am__fastdepCC_TRUE@ $(AM_V_at)$(am__mv) $(DEPDIR)/imv_policy_manager.Tpo $(DEPDIR)/imv_policy_manager.Po +@AMDEP_TRUE@@am__fastdepCC_FALSE@ $(AM_V_CC)source='imv/imv_policy_manager.c' object='imv_policy_manager.obj' libtool=no @AMDEPBACKSLASH@ +@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@ +@am__fastdepCC_FALSE@ $(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o imv_policy_manager.obj `if test -f 'imv/imv_policy_manager.c'; then $(CYGPATH_W) 'imv/imv_policy_manager.c'; else $(CYGPATH_W) '$(srcdir)/imv/imv_policy_manager.c'; fi` + +imv_policy_manager_usage.o: imv/imv_policy_manager_usage.c +@am__fastdepCC_TRUE@ $(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT imv_policy_manager_usage.o -MD -MP -MF $(DEPDIR)/imv_policy_manager_usage.Tpo -c -o imv_policy_manager_usage.o `test -f 'imv/imv_policy_manager_usage.c' || echo '$(srcdir)/'`imv/imv_policy_manager_usage.c +@am__fastdepCC_TRUE@ $(AM_V_at)$(am__mv) $(DEPDIR)/imv_policy_manager_usage.Tpo $(DEPDIR)/imv_policy_manager_usage.Po +@AMDEP_TRUE@@am__fastdepCC_FALSE@ $(AM_V_CC)source='imv/imv_policy_manager_usage.c' object='imv_policy_manager_usage.o' libtool=no @AMDEPBACKSLASH@ +@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@ +@am__fastdepCC_FALSE@ $(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o imv_policy_manager_usage.o `test -f 'imv/imv_policy_manager_usage.c' || echo '$(srcdir)/'`imv/imv_policy_manager_usage.c + +imv_policy_manager_usage.obj: imv/imv_policy_manager_usage.c +@am__fastdepCC_TRUE@ $(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT imv_policy_manager_usage.obj -MD -MP -MF $(DEPDIR)/imv_policy_manager_usage.Tpo -c -o imv_policy_manager_usage.obj `if test -f 'imv/imv_policy_manager_usage.c'; then $(CYGPATH_W) 'imv/imv_policy_manager_usage.c'; else $(CYGPATH_W) '$(srcdir)/imv/imv_policy_manager_usage.c'; fi` +@am__fastdepCC_TRUE@ $(AM_V_at)$(am__mv) $(DEPDIR)/imv_policy_manager_usage.Tpo $(DEPDIR)/imv_policy_manager_usage.Po +@AMDEP_TRUE@@am__fastdepCC_FALSE@ $(AM_V_CC)source='imv/imv_policy_manager_usage.c' object='imv_policy_manager_usage.obj' libtool=no @AMDEPBACKSLASH@ @AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@ -@am__fastdepCC_FALSE@ $(LIBTOOL) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o pa_tnc_attr_manager.lo `test -f 'pa_tnc/pa_tnc_attr_manager.c' || echo '$(srcdir)/'`pa_tnc/pa_tnc_attr_manager.c +@am__fastdepCC_FALSE@ $(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o imv_policy_manager_usage.obj `if test -f 'imv/imv_policy_manager_usage.c'; then $(CYGPATH_W) 'imv/imv_policy_manager_usage.c'; else $(CYGPATH_W) '$(srcdir)/imv/imv_policy_manager_usage.c'; fi` mostlyclean-libtool: -rm -f *.lo @@ -690,13 +1111,10 @@ distdir: $(DISTFILES) done @list='$(DIST_SUBDIRS)'; for subdir in $$list; do \ if test "$$subdir" = .; then :; else \ - test -d "$(distdir)/$$subdir" \ - || $(MKDIR_P) "$(distdir)/$$subdir" \ - || exit 1; \ - fi; \ - done - @list='$(DIST_SUBDIRS)'; for subdir in $$list; do \ - if test "$$subdir" = .; then :; else \ + $(am__make_dryrun) \ + || test -d "$(distdir)/$$subdir" \ + || $(MKDIR_P) "$(distdir)/$$subdir" \ + || exit 1; \ dir1=$$subdir; dir2="$(distdir)/$$subdir"; \ $(am__relativize); \ new_distdir=$$reldir; \ @@ -718,10 +1136,10 @@ distdir: $(DISTFILES) done check-am: all-am check: check-recursive -all-am: Makefile $(LTLIBRARIES) +all-am: Makefile $(LTLIBRARIES) $(PROGRAMS) $(SCRIPTS) installdirs: installdirs-recursive installdirs-am: - for dir in "$(DESTDIR)$(ipseclibdir)"; do \ + for dir in "$(DESTDIR)$(ipseclibdir)" "$(DESTDIR)$(ipsecdir)" "$(DESTDIR)$(ipsecdir)"; do \ test -z "$$dir" || $(MKDIR_P) "$$dir"; \ done install: install-recursive @@ -734,10 +1152,15 @@ install-am: all-am installcheck: installcheck-recursive install-strip: - $(MAKE) $(AM_MAKEFLAGS) INSTALL_PROGRAM="$(INSTALL_STRIP_PROGRAM)" \ - install_sh_PROGRAM="$(INSTALL_STRIP_PROGRAM)" INSTALL_STRIP_FLAG=-s \ - `test -z '$(STRIP)' || \ - echo "INSTALL_PROGRAM_ENV=STRIPPROG='$(STRIP)'"` install + if test -z '$(STRIP)'; then \ + $(MAKE) $(AM_MAKEFLAGS) INSTALL_PROGRAM="$(INSTALL_STRIP_PROGRAM)" \ + install_sh_PROGRAM="$(INSTALL_STRIP_PROGRAM)" INSTALL_STRIP_FLAG=-s \ + install; \ + else \ + $(MAKE) $(AM_MAKEFLAGS) INSTALL_PROGRAM="$(INSTALL_STRIP_PROGRAM)" \ + install_sh_PROGRAM="$(INSTALL_STRIP_PROGRAM)" INSTALL_STRIP_FLAG=-s \ + "INSTALL_PROGRAM_ENV=STRIPPROG='$(STRIP)'" install; \ + fi mostlyclean-generic: clean-generic: @@ -751,8 +1174,8 @@ maintainer-clean-generic: @echo "it deletes files that may require special tools to rebuild." clean: clean-recursive -clean-am: clean-generic clean-ipseclibLTLIBRARIES clean-libtool \ - mostlyclean-am +clean-am: clean-generic clean-ipsecPROGRAMS clean-ipseclibLTLIBRARIES \ + clean-libtool mostlyclean-am distclean: distclean-recursive -rm -rf ./$(DEPDIR) @@ -772,7 +1195,8 @@ info: info-recursive info-am: -install-data-am: install-ipseclibLTLIBRARIES +install-data-am: install-ipsecPROGRAMS install-ipsecSCRIPTS \ + install-ipseclibLTLIBRARIES install-dvi: install-dvi-recursive @@ -818,26 +1242,29 @@ ps: ps-recursive ps-am: -uninstall-am: uninstall-ipseclibLTLIBRARIES +uninstall-am: uninstall-ipsecPROGRAMS uninstall-ipsecSCRIPTS \ + uninstall-ipseclibLTLIBRARIES .MAKE: $(RECURSIVE_CLEAN_TARGETS) $(RECURSIVE_TARGETS) ctags-recursive \ install-am install-strip tags-recursive .PHONY: $(RECURSIVE_CLEAN_TARGETS) $(RECURSIVE_TARGETS) CTAGS GTAGS \ all all-am check check-am clean clean-generic \ - clean-ipseclibLTLIBRARIES clean-libtool ctags ctags-recursive \ - distclean distclean-compile distclean-generic \ - distclean-libtool distclean-tags distdir dvi dvi-am html \ - html-am info info-am install install-am install-data \ - install-data-am install-dvi install-dvi-am install-exec \ - install-exec-am install-html install-html-am install-info \ - install-info-am install-ipseclibLTLIBRARIES install-man \ + clean-ipsecPROGRAMS clean-ipseclibLTLIBRARIES clean-libtool \ + ctags ctags-recursive distclean distclean-compile \ + distclean-generic distclean-libtool distclean-tags distdir dvi \ + dvi-am html html-am info info-am install install-am \ + install-data install-data-am install-dvi install-dvi-am \ + install-exec install-exec-am install-html install-html-am \ + install-info install-info-am install-ipsecPROGRAMS \ + install-ipsecSCRIPTS install-ipseclibLTLIBRARIES install-man \ install-pdf install-pdf-am install-ps install-ps-am \ install-strip installcheck installcheck-am installdirs \ installdirs-am maintainer-clean maintainer-clean-generic \ mostlyclean mostlyclean-compile mostlyclean-generic \ mostlyclean-libtool pdf pdf-am ps ps-am tags tags-recursive \ - uninstall uninstall-am uninstall-ipseclibLTLIBRARIES + uninstall uninstall-am uninstall-ipsecPROGRAMS \ + uninstall-ipsecSCRIPTS uninstall-ipseclibLTLIBRARIES # Tell versions [3.59,3.63) of GNU make to not export all variables. diff --git a/src/libimcv/ietf/ietf_attr.c b/src/libimcv/ietf/ietf_attr.c index 89c6fc8db..2f3819898 100644 --- a/src/libimcv/ietf/ietf_attr.c +++ b/src/libimcv/ietf/ietf_attr.c @@ -1,5 +1,6 @@ /* - * Copyright (C) 2011 Andreas Steffen, HSR Hochschule fuer Technik Rapperswil + * Copyright (C) 2011-2012 Andreas Steffen + * HSR Hochschule fuer Technik Rapperswil * * This program is free software; you can redistribute it and/or modify it * under the terms of the GNU General Public License as published by the @@ -13,9 +14,19 @@ */ #include "ietf_attr.h" +#include "ietf/ietf_attr_assess_result.h" +#include "ietf/ietf_attr_attr_request.h" +#include "ietf/ietf_attr_fwd_enabled.h" +#include "ietf/ietf_attr_default_pwd_enabled.h" +#include "ietf/ietf_attr_installed_packages.h" +#include "ietf/ietf_attr_numeric_version.h" +#include "ietf/ietf_attr_op_status.h" #include "ietf/ietf_attr_pa_tnc_error.h" #include "ietf/ietf_attr_port_filter.h" #include "ietf/ietf_attr_product_info.h" +#include "ietf/ietf_attr_remediation_instr.h" +#include "ietf/ietf_attr_string_version.h" + ENUM(ietf_attr_names, IETF_ATTR_TESTING, IETF_ATTR_FACTORY_DEFAULT_PWD_ENABLED, "Testing", @@ -40,22 +51,31 @@ pa_tnc_attr_t* ietf_attr_create_from_data(u_int32_t type, chunk_t value) { switch (type) { - case IETF_ATTR_PORT_FILTER: - return ietf_attr_port_filter_create_from_data(value); - case IETF_ATTR_PA_TNC_ERROR: - return ietf_attr_pa_tnc_error_create_from_data(value); + case IETF_ATTR_ATTRIBUTE_REQUEST: + return ietf_attr_attr_request_create_from_data(value); case IETF_ATTR_PRODUCT_INFORMATION: return ietf_attr_product_info_create_from_data(value); - case IETF_ATTR_TESTING: - case IETF_ATTR_ATTRIBUTE_REQUEST: case IETF_ATTR_NUMERIC_VERSION: + return ietf_attr_numeric_version_create_from_data(value); case IETF_ATTR_STRING_VERSION: + return ietf_attr_string_version_create_from_data(value); case IETF_ATTR_OPERATIONAL_STATUS: + return ietf_attr_op_status_create_from_data(value); + case IETF_ATTR_PORT_FILTER: + return ietf_attr_port_filter_create_from_data(value); case IETF_ATTR_INSTALLED_PACKAGES: + return ietf_attr_installed_packages_create_from_data(value); + case IETF_ATTR_PA_TNC_ERROR: + return ietf_attr_pa_tnc_error_create_from_data(value); case IETF_ATTR_ASSESSMENT_RESULT: + return ietf_attr_assess_result_create_from_data(value); case IETF_ATTR_REMEDIATION_INSTRUCTIONS: + return ietf_attr_remediation_instr_create_from_data(value); case IETF_ATTR_FORWARDING_ENABLED: + return ietf_attr_fwd_enabled_create_from_data(value); case IETF_ATTR_FACTORY_DEFAULT_PWD_ENABLED: + return ietf_attr_default_pwd_enabled_create_from_data(value); + case IETF_ATTR_TESTING: case IETF_ATTR_RESERVED: default: return NULL; diff --git a/src/libimcv/ietf/ietf_attr.h b/src/libimcv/ietf/ietf_attr.h index a1ba42565..d22175d94 100644 --- a/src/libimcv/ietf/ietf_attr.h +++ b/src/libimcv/ietf/ietf_attr.h @@ -14,8 +14,8 @@ */ /** - * @defgroup ietf_attrt ietf_attr - * @{ @ingroup ietf_attr + * @defgroup ietf_attr ietf_attr + * @{ @ingroup libimcv */ #ifndef IETF_ATTR_H_ diff --git a/src/libimcv/ietf/ietf_attr_assess_result.c b/src/libimcv/ietf/ietf_attr_assess_result.c new file mode 100644 index 000000000..55226e3bb --- /dev/null +++ b/src/libimcv/ietf/ietf_attr_assess_result.c @@ -0,0 +1,211 @@ +/* + * Copyright (C) 2012 Andreas Steffen + * HSR Hochschule fuer Technik Rapperswil + * + * This program is free software; you can redistribute it and/or modify it + * under the terms of the GNU General Public License as published by the + * Free Software Foundation; either version 2 of the License, or (at your + * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>. + * + * This program is distributed in the hope that it will be useful, but + * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY + * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License + * for more details. + */ + +#include "ietf_attr_assess_result.h" + +#include <pa_tnc/pa_tnc_msg.h> +#include <bio/bio_writer.h> +#include <bio/bio_reader.h> +#include <utils/debug.h> + +typedef struct private_ietf_attr_assess_result_t private_ietf_attr_assess_result_t; + +/** + * PA-TNC Product Information type (see section 4.2.2 of RFC 5792) + * + * 1 2 3 + * 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 + * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ + * | Assessment Result | + * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ + */ + +#define ASSESS_RESULT_SIZE 4 + +/** + * Private data of an ietf_attr_assess_result_t object. + */ +struct private_ietf_attr_assess_result_t { + + /** + * Public members of ietf_attr_assess_result_t + */ + ietf_attr_assess_result_t public; + + /** + * Vendor-specific attribute type + */ + pen_type_t type; + + /** + * Attribute value + */ + chunk_t value; + + /** + * Noskip flag + */ + bool noskip_flag; + + /** + * Assessment Result + */ + u_int32_t result; + + /** + * Reference count + */ + refcount_t ref; +}; + +METHOD(pa_tnc_attr_t, get_type, pen_type_t, + private_ietf_attr_assess_result_t *this) +{ + return this->type; +} + +METHOD(pa_tnc_attr_t, get_value, chunk_t, + private_ietf_attr_assess_result_t *this) +{ + return this->value; +} + +METHOD(pa_tnc_attr_t, get_noskip_flag, bool, + private_ietf_attr_assess_result_t *this) +{ + return this->noskip_flag; +} + +METHOD(pa_tnc_attr_t, set_noskip_flag,void, + private_ietf_attr_assess_result_t *this, bool noskip) +{ + this->noskip_flag = noskip; +} + +METHOD(pa_tnc_attr_t, build, void, + private_ietf_attr_assess_result_t *this) +{ + bio_writer_t *writer; + + if (this->value.ptr) + { + return; + } + + writer = bio_writer_create(ASSESS_RESULT_SIZE); + writer->write_uint32(writer, this->result); + this->value = writer->extract_buf(writer); + writer->destroy(writer); +} + +METHOD(pa_tnc_attr_t, process, status_t, + private_ietf_attr_assess_result_t *this, u_int32_t *offset) +{ + bio_reader_t *reader; + + if (this->value.len < ASSESS_RESULT_SIZE) + { + DBG1(DBG_TNC, "insufficient data for IETF assessment result"); + *offset = 0; + return FAILED; + } + reader = bio_reader_create(this->value); + reader->read_uint32(reader, &this->result); + reader->destroy(reader); + + return SUCCESS; +} + +METHOD(pa_tnc_attr_t, get_ref, pa_tnc_attr_t*, + private_ietf_attr_assess_result_t *this) +{ + ref_get(&this->ref); + return &this->public.pa_tnc_attribute; +} + +METHOD(pa_tnc_attr_t, destroy, void, + private_ietf_attr_assess_result_t *this) +{ + if (ref_put(&this->ref)) + { + free(this->value.ptr); + free(this); + } +} + +METHOD(ietf_attr_assess_result_t, get_result, u_int32_t, + private_ietf_attr_assess_result_t *this) +{ + return this->result; +} + +/** + * Described in header. + */ +pa_tnc_attr_t *ietf_attr_assess_result_create(u_int32_t result) +{ + private_ietf_attr_assess_result_t *this; + + INIT(this, + .public = { + .pa_tnc_attribute = { + .get_type = _get_type, + .get_value = _get_value, + .get_noskip_flag = _get_noskip_flag, + .set_noskip_flag = _set_noskip_flag, + .build = _build, + .process = _process, + .get_ref = _get_ref, + .destroy = _destroy, + }, + .get_result = _get_result, + }, + .type = { PEN_IETF, IETF_ATTR_ASSESSMENT_RESULT }, + .result = result, + .ref = 1, + ); + + return &this->public.pa_tnc_attribute; +} + +/** + * Described in header. + */ +pa_tnc_attr_t *ietf_attr_assess_result_create_from_data(chunk_t data) +{ + private_ietf_attr_assess_result_t *this; + + INIT(this, + .public = { + .pa_tnc_attribute = { + .get_type = _get_type, + .get_value = _get_value, + .get_noskip_flag = _get_noskip_flag, + .set_noskip_flag = _set_noskip_flag, + .build = _build, + .process = _process, + .get_ref = _get_ref, + .destroy = _destroy, + }, + .get_result = _get_result, + }, + .type = { PEN_IETF, IETF_ATTR_ASSESSMENT_RESULT }, + .value = chunk_clone(data), + .ref = 1, + ); + + return &this->public.pa_tnc_attribute; +} + diff --git a/src/libimcv/ietf/ietf_attr_assess_result.h b/src/libimcv/ietf/ietf_attr_assess_result.h new file mode 100644 index 000000000..e94b57b88 --- /dev/null +++ b/src/libimcv/ietf/ietf_attr_assess_result.h @@ -0,0 +1,63 @@ +/* + * Copyright (C) 2012 Andreas Steffen + * HSR Hochschule fuer Technik Rapperswil + * + * This program is free software; you can redistribute it and/or modify it + * under the terms of the GNU General Public License as published by the + * Free Software Foundation; either version 2 of the License, or (at your + * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>. + * + * This program is distributed in the hope that it will be useful, but + * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY + * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License + * for more details. + */ + +/** + * @defgroup ietf_attr_assess_resultt ietf_attr_assess_result + * @{ @ingroup ietf_attr + */ + +#ifndef IETF_ATTR_ASSESS_RESULT_H_ +#define IETF_ATTR_ASSESS_RESULT_H_ + +typedef struct ietf_attr_assess_result_t ietf_attr_assess_result_t; + +#include "ietf_attr.h" +#include "pa_tnc/pa_tnc_attr.h" + + +/** + * Class implementing the IETF PA-TNC Assessment Result attribute. + * + */ +struct ietf_attr_assess_result_t { + + /** + * Public PA-TNC attribute interface + */ + pa_tnc_attr_t pa_tnc_attribute; + + /** + * Get the assessment result + * + * @return Assessment Result + */ + u_int32_t (*get_result)(ietf_attr_assess_result_t *this); + +}; + +/** + * Creates an ietf_attr_assess_result_t object + * + */ +pa_tnc_attr_t* ietf_attr_assess_result_create(u_int32_t result); + +/** + * Creates an ietf_attr_assess_result_t object from received data + * + * @param value unparsed attribute value + */ +pa_tnc_attr_t* ietf_attr_assess_result_create_from_data(chunk_t value); + +#endif /** IETF_ATTR_ASSESS_RESULT_H_ @}*/ diff --git a/src/libimcv/ietf/ietf_attr_attr_request.c b/src/libimcv/ietf/ietf_attr_attr_request.c new file mode 100644 index 000000000..3b4fd26cd --- /dev/null +++ b/src/libimcv/ietf/ietf_attr_attr_request.c @@ -0,0 +1,276 @@ +/* + * Copyright (C) 2012 Andreas Steffen + * HSR Hochschule fuer Technik Rapperswil + * + * This program is free software; you can redistribute it and/or modify it + * under the terms of the GNU General Public License as published by the + * Free Software Foundation; either version 2 of the License, or (at your + * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>. + * + * This program is distributed in the hope that it will be useful, but + * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY + * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License + * for more details. + */ + +#include "imcv.h" +#include "ietf_attr_attr_request.h" + +#include <pa_tnc/pa_tnc_msg.h> +#include <bio/bio_writer.h> +#include <bio/bio_reader.h> +#include <collections/linked_list.h> + +#include <utils/debug.h> + +typedef struct private_ietf_attr_attr_request_t private_ietf_attr_attr_request_t; + +/** + * PA-TNC Attribute Request type (see section 4.2.1 of RFC 5792) + * + * 1 2 3 + * 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 + * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ + * | Reserved | PA-TNC Attribute Vendor ID | + * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ + * | PA-TNC Attribute Type | + * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ + * | Reserved | PA-TNC Attribute Vendor ID | + * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ + * | PA-TNC Attribute Type | + * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ + */ + +#define ATTR_REQUEST_ENTRY_SIZE 8 + +/** + * Private data of an ietf_attr_attr_request_t object. + */ +struct private_ietf_attr_attr_request_t { + + /** + * Public members of ietf_attr_attr_request_t + */ + ietf_attr_attr_request_t public; + + /** + * Vendor-specific attribute type + */ + pen_type_t type; + + /** + * Attribute value + */ + chunk_t value; + + /** + * Noskip flag + */ + bool noskip_flag; + + /** + * List of requested attribute types + */ + linked_list_t *list; + + /** + * Reference count + */ + refcount_t ref; +}; + +METHOD(pa_tnc_attr_t, get_type, pen_type_t, + private_ietf_attr_attr_request_t *this) +{ + return this->type; +} + +METHOD(pa_tnc_attr_t, get_value, chunk_t, + private_ietf_attr_attr_request_t *this) +{ + return this->value; +} + +METHOD(pa_tnc_attr_t, get_noskip_flag, bool, + private_ietf_attr_attr_request_t *this) +{ + return this->noskip_flag; +} + +METHOD(pa_tnc_attr_t, set_noskip_flag,void, + private_ietf_attr_attr_request_t *this, bool noskip) +{ + this->noskip_flag = noskip; +} + +METHOD(pa_tnc_attr_t, build, void, + private_ietf_attr_attr_request_t *this) +{ + bio_writer_t *writer; + enumerator_t *enumerator; + pen_type_t *entry; + + if (this->value.ptr) + { + return; + } + writer = bio_writer_create(ATTR_REQUEST_ENTRY_SIZE * + this->list->get_count(this->list)); + + enumerator = this->list->create_enumerator(this->list); + while (enumerator->enumerate(enumerator, &entry)) + { + writer->write_uint32(writer, entry->vendor_id); + writer->write_uint32(writer, entry->type); + } + enumerator->destroy(enumerator); + + this->value = writer->extract_buf(writer); + writer->destroy(writer); +} + +METHOD(ietf_attr_attr_request_t, add, void, + private_ietf_attr_attr_request_t *this, pen_t vendor_id, u_int32_t type) +{ + pen_type_t *entry; + + entry = malloc_thing(pen_type_t); + entry->vendor_id = vendor_id; + entry->type = type; + this->list->insert_last(this->list, entry); +} + +METHOD(pa_tnc_attr_t, process, status_t, + private_ietf_attr_attr_request_t *this, u_int32_t *offset) +{ + bio_reader_t *reader; + enum_name_t *pa_attr_names; + pen_t vendor_id; + u_int32_t type; + u_int8_t reserved; + int count; + + count = this->value.len / ATTR_REQUEST_ENTRY_SIZE; + if (this->value.len != ATTR_REQUEST_ENTRY_SIZE * count) + { + DBG1(DBG_TNC, "incorrect attribute length for IETF attribute request"); + *offset = 0; + return FAILED; + } + + reader = bio_reader_create(this->value); + while (count--) + { + reader->read_uint8 (reader, &reserved); + reader->read_uint24(reader, &vendor_id); + reader->read_uint32(reader, &type); + + pa_attr_names = imcv_pa_tnc_attributes->get_names(imcv_pa_tnc_attributes, + vendor_id); + if (pa_attr_names) + { + DBG2(DBG_TNC, " 0x%06x/0x%08x '%N/%N'", vendor_id, type, + pen_names, vendor_id, pa_attr_names, type); + } + else + { + DBG2(DBG_TNC, " 0x%06x/0x%08x '%N'", vendor_id, type, + pen_names, vendor_id); + } + add(this, vendor_id, type); + } + reader->destroy(reader); + + return SUCCESS; +} + +METHOD(pa_tnc_attr_t, get_ref, pa_tnc_attr_t*, + private_ietf_attr_attr_request_t *this) +{ + ref_get(&this->ref); + return &this->public.pa_tnc_attribute; +} + +METHOD(pa_tnc_attr_t, destroy, void, + private_ietf_attr_attr_request_t *this) +{ + if (ref_put(&this->ref)) + { + this->list->destroy_function(this->list, free); + free(this->value.ptr); + free(this); + } +} + +METHOD(ietf_attr_attr_request_t, create_enumerator, enumerator_t*, + private_ietf_attr_attr_request_t *this) +{ + return this->list->create_enumerator(this->list); +} + +/** + * Described in header. + */ +pa_tnc_attr_t *ietf_attr_attr_request_create(pen_t vendor_id, u_int32_t type) +{ + private_ietf_attr_attr_request_t *this; + + INIT(this, + .public = { + .pa_tnc_attribute = { + .get_type = _get_type, + .get_value = _get_value, + .get_noskip_flag = _get_noskip_flag, + .set_noskip_flag = _set_noskip_flag, + .build = _build, + .process = _process, + .get_ref = _get_ref, + .destroy = _destroy, + }, + .add = _add, + .create_enumerator = _create_enumerator, + }, + .type = { PEN_IETF, IETF_ATTR_ATTRIBUTE_REQUEST }, + .list = linked_list_create(), + .ref = 1, + ); + + if (vendor_id != PEN_RESERVED) + { + add(this, vendor_id, type); + } + + return &this->public.pa_tnc_attribute; +} + +/** + * Described in header. + */ +pa_tnc_attr_t *ietf_attr_attr_request_create_from_data(chunk_t data) +{ + private_ietf_attr_attr_request_t *this; + + INIT(this, + .public = { + .pa_tnc_attribute = { + .get_type = _get_type, + .get_value = _get_value, + .get_noskip_flag = _get_noskip_flag, + .set_noskip_flag = _set_noskip_flag, + .build = _build, + .process = _process, + .get_ref = _get_ref, + .destroy = _destroy, + }, + .add = _add, + .create_enumerator = _create_enumerator, + }, + .type = { PEN_IETF, IETF_ATTR_ATTRIBUTE_REQUEST }, + .value = chunk_clone(data), + .list = linked_list_create(), + .ref = 1, + ); + + return &this->public.pa_tnc_attribute; +} + diff --git a/src/libimcv/ietf/ietf_attr_attr_request.h b/src/libimcv/ietf/ietf_attr_attr_request.h new file mode 100644 index 000000000..fc9e08676 --- /dev/null +++ b/src/libimcv/ietf/ietf_attr_attr_request.h @@ -0,0 +1,71 @@ +/* + * Copyright (C) 2012 Andreas Steffen + * HSR Hochschule fuer Technik Rapperswil + * + * This program is free software; you can redistribute it and/or modify it + * under the terms of the GNU General Public License as published by the + * Free Software Foundation; either version 2 of the License, or (at your + * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>. + * + * This program is distributed in the hope that it will be useful, but + * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY + * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License + * for more details. + */ + +/** + * @defgroup ietf_attr_attr_requestt ietf_attr_attr_request + * @{ @ingroup ietf_attr + */ + +#ifndef IETF_ATTR_ATTR_REQUEST_H_ +#define IETF_ATTR_ATTR_REQUEST_H_ + +typedef struct ietf_attr_attr_request_t ietf_attr_attr_request_t; + +#include "ietf_attr.h" +#include "pa_tnc/pa_tnc_attr.h" + + +/** + * Class implementing the IETF PA-TNC Attribute Request attribute. + * + */ +struct ietf_attr_attr_request_t { + + /** + * Public PA-TNC attribute interface + */ + pa_tnc_attr_t pa_tnc_attribute; + + /** + * Adds another attribute type to the attribute request + * + * @param vendor_id Attribute Vendor ID + * @param type Attribute Type + */ + void (*add)(ietf_attr_attr_request_t *this, pen_t vendor_id, u_int32_t type); + + /** + * Creates an enumerator over all attribute types contained + * in the attribute request + * + * @return Attribute Type enumerator returns { vendor ID, type } + */ + enumerator_t* (*create_enumerator)(ietf_attr_attr_request_t *this); +}; + +/** + * Creates an ietf_attr_attr_request_t object + * + */ +pa_tnc_attr_t* ietf_attr_attr_request_create(pen_t vendor_id, u_int32_t type); + +/** + * Creates an ietf_attr_attr_request_t object from received data + * + * @param value unparsed attribute value + */ +pa_tnc_attr_t* ietf_attr_attr_request_create_from_data(chunk_t value); + +#endif /** IETF_ATTR_ATTR_REQUEST_H_ @}*/ diff --git a/src/libimcv/ietf/ietf_attr_default_pwd_enabled.c b/src/libimcv/ietf/ietf_attr_default_pwd_enabled.c new file mode 100644 index 000000000..2c6b3d542 --- /dev/null +++ b/src/libimcv/ietf/ietf_attr_default_pwd_enabled.c @@ -0,0 +1,222 @@ +/* + * Copyright (C) 2012 Andreas Steffen + * HSR Hochschule fuer Technik Rapperswil + * + * This program is free software; you can redistribute it and/or modify it + * under the terms of the GNU General Public License as published by the + * Free Software Foundation; either version 2 of the License, or (at your + * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>. + * + * This program is distributed in the hope that it will be useful, but + * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY + * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License + * for more details. + */ + +#include "ietf_attr_default_pwd_enabled.h" + +#include <pa_tnc/pa_tnc_msg.h> +#include <bio/bio_writer.h> +#include <bio/bio_reader.h> +#include <utils/debug.h> + +typedef struct private_ietf_attr_default_pwd_enabled_t private_ietf_attr_default_pwd_enabled_t; + +/** + * PA-TNC Factory Default Password Enabled type (see section 4.2.12 of RFC 5792) + * + * 1 2 3 + * 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 + * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ + * | Factory Default Password Enabled | + * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ + */ + +#define DEFAULT_PWD_ENABLED_SIZE 4 + +/** + * Private data of an ietf_attr_default_pwd_enabled_t object. + */ +struct private_ietf_attr_default_pwd_enabled_t { + + /** + * Public members of ietf_attr_default_pwd_enabled_t + */ + ietf_attr_default_pwd_enabled_t public; + + /** + * Vendor-specific attribute type + */ + pen_type_t type; + + /** + * Attribute value + */ + chunk_t value; + + /** + * Noskip flag + */ + bool noskip_flag; + + /** + * Factory Default Password Enabled status + */ + bool status; + + /** + * Reference count + */ + refcount_t ref; +}; + +METHOD(pa_tnc_attr_t, get_type, pen_type_t, + private_ietf_attr_default_pwd_enabled_t *this) +{ + return this->type; +} + +METHOD(pa_tnc_attr_t, get_value, chunk_t, + private_ietf_attr_default_pwd_enabled_t *this) +{ + return this->value; +} + +METHOD(pa_tnc_attr_t, get_noskip_flag, bool, + private_ietf_attr_default_pwd_enabled_t *this) +{ + return this->noskip_flag; +} + +METHOD(pa_tnc_attr_t, set_noskip_flag,void, + private_ietf_attr_default_pwd_enabled_t *this, bool noskip) +{ + this->noskip_flag = noskip; +} + +METHOD(pa_tnc_attr_t, build, void, + private_ietf_attr_default_pwd_enabled_t *this) +{ + bio_writer_t *writer; + + if (this->value.ptr) + { + return; + } + writer = bio_writer_create(DEFAULT_PWD_ENABLED_SIZE); + writer->write_uint32(writer, this->status); + + this->value = writer->extract_buf(writer); + writer->destroy(writer); +} + +METHOD(pa_tnc_attr_t, process, status_t, + private_ietf_attr_default_pwd_enabled_t *this, u_int32_t *offset) +{ + bio_reader_t *reader; + u_int32_t status; + + *offset = 0; + + if (this->value.len != DEFAULT_PWD_ENABLED_SIZE) + { + DBG1(DBG_TNC, "incorrect size for IETF factory default password " + "enabled attribute"); + return FAILED; + } + reader = bio_reader_create(this->value); + reader->read_uint32(reader, &status); + reader->destroy(reader); + + if (status > TRUE) + { + DBG1(DBG_TNC, "IETF factory default password enabled field " + "has unknown value %u", status); + return FAILED; + } + this->status = status; + + return SUCCESS; +} + +METHOD(pa_tnc_attr_t, get_ref, pa_tnc_attr_t*, + private_ietf_attr_default_pwd_enabled_t *this) +{ + ref_get(&this->ref); + return &this->public.pa_tnc_attribute; +} + +METHOD(pa_tnc_attr_t, destroy, void, + private_ietf_attr_default_pwd_enabled_t *this) +{ + if (ref_put(&this->ref)) + { + free(this->value.ptr); + free(this); + } +} + +METHOD(ietf_attr_default_pwd_enabled_t, get_status, bool, + private_ietf_attr_default_pwd_enabled_t *this) +{ + return this->status; +} + +/** + * Described in header. + */ +pa_tnc_attr_t *ietf_attr_default_pwd_enabled_create(bool status) +{ + private_ietf_attr_default_pwd_enabled_t *this; + + INIT(this, + .public = { + .pa_tnc_attribute = { + .get_type = _get_type, + .get_value = _get_value, + .get_noskip_flag = _get_noskip_flag, + .set_noskip_flag = _set_noskip_flag, + .build = _build, + .process = _process, + .get_ref = _get_ref, + .destroy = _destroy, + }, + .get_status = _get_status, + }, + .type = { PEN_IETF, IETF_ATTR_FACTORY_DEFAULT_PWD_ENABLED }, + .status = status, + .ref = 1, + ); + + return &this->public.pa_tnc_attribute; +} + +/** + * Described in header. + */ +pa_tnc_attr_t *ietf_attr_default_pwd_enabled_create_from_data(chunk_t data) +{ + private_ietf_attr_default_pwd_enabled_t *this; + + INIT(this, + .public = { + .pa_tnc_attribute = { + .get_type = _get_type, + .get_value = _get_value, + .get_noskip_flag = _get_noskip_flag, + .set_noskip_flag = _set_noskip_flag, + .build = _build, + .process = _process, + .get_ref = _get_ref, + .destroy = _destroy, + }, + .get_status = _get_status, + }, + .type = { PEN_IETF, IETF_ATTR_FACTORY_DEFAULT_PWD_ENABLED }, + .value = chunk_clone(data), + .ref = 1, + ); + + return &this->public.pa_tnc_attribute; +} + diff --git a/src/libimcv/ietf/ietf_attr_default_pwd_enabled.h b/src/libimcv/ietf/ietf_attr_default_pwd_enabled.h new file mode 100644 index 000000000..6fe1a02b1 --- /dev/null +++ b/src/libimcv/ietf/ietf_attr_default_pwd_enabled.h @@ -0,0 +1,63 @@ +/* + * Copyright (C) 2012 Andreas Steffen + * HSR Hochschule fuer Technik Rapperswil + * + * This program is free software; you can redistribute it and/or modify it + * under the terms of the GNU General Public License as published by the + * Free Software Foundation; either version 2 of the License, or (at your + * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>. + * + * This program is distributed in the hope that it will be useful, but + * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY + * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License + * for more details. + */ + +/** + * @defgroup ietf_attr_default_pwd_enabled ietf_attr_default_pwd_enabled + * @{ @ingroup ietf_attr + */ + +#ifndef IETF_ATTR_PWD_ENABLED_H_ +#define IETF_ATTR_PWD_ENABLED_H_ + +typedef struct ietf_attr_default_pwd_enabled_t ietf_attr_default_pwd_enabled_t; + +#include "ietf_attr.h" +#include "pa_tnc/pa_tnc_attr.h" + +/** + * Class implementing the IETF PA-TNC Factory Default Password Enabled attribute. + * + */ +struct ietf_attr_default_pwd_enabled_t { + + /** + * Public PA-TNC attribute interface + */ + pa_tnc_attr_t pa_tnc_attribute; + + /** + * Gets the Factory Default Password Enabled status + * + * @return Factory Default Password Enabled status + */ + bool (*get_status)(ietf_attr_default_pwd_enabled_t *this); + +}; + +/** + * Creates an ietf_attr_default_pwd_enabled_t object + * + * @param status Factory Default Password Enabled status + */ +pa_tnc_attr_t* ietf_attr_default_pwd_enabled_create(bool status); + +/** + * Creates an ietf_attr_default_pwd_enabled_t object from received data + * + * @param value unparsed attribute value + */ +pa_tnc_attr_t* ietf_attr_default_pwd_enabled_create_from_data(chunk_t value); + +#endif /** IETF_ATTR_PWD_ENABLED_H_ @}*/ diff --git a/src/libimcv/ietf/ietf_attr_fwd_enabled.c b/src/libimcv/ietf/ietf_attr_fwd_enabled.c new file mode 100644 index 000000000..a906b2258 --- /dev/null +++ b/src/libimcv/ietf/ietf_attr_fwd_enabled.c @@ -0,0 +1,221 @@ +/* + * Copyright (C) 2012 Andreas Steffen + * HSR Hochschule fuer Technik Rapperswil + * + * This program is free software; you can redistribute it and/or modify it + * under the terms of the GNU General Public License as published by the + * Free Software Foundation; either version 2 of the License, or (at your + * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>. + * + * This program is distributed in the hope that it will be useful, but + * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY + * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License + * for more details. + */ + +#include "ietf_attr_fwd_enabled.h" + +#include <pa_tnc/pa_tnc_msg.h> +#include <bio/bio_writer.h> +#include <bio/bio_reader.h> +#include <utils/debug.h> + +typedef struct private_ietf_attr_fwd_enabled_t private_ietf_attr_fwd_enabled_t; + +/** + * PA-TNC Forwarding Enabled type (see section 4.2.11 of RFC 5792) + * + * 1 2 3 + * 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 + * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ + * | Forwarding Enabled | + * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ + */ + +#define FORWARDING_ENABLED_SIZE 4 + +/** + * Private data of an ietf_attr_fwd_enabled_t object. + */ +struct private_ietf_attr_fwd_enabled_t { + + /** + * Public members of ietf_attr_fwd_enabled_t + */ + ietf_attr_fwd_enabled_t public; + + /** + * Vendor-specific attribute type + */ + pen_type_t type; + + /** + * Attribute value + */ + chunk_t value; + + /** + * Noskip flag + */ + bool noskip_flag; + + /** + * Forwarding Enabled status + */ + os_fwd_status_t fwd_status; + + /** + * Reference count + */ + refcount_t ref; +}; + +METHOD(pa_tnc_attr_t, get_type, pen_type_t, + private_ietf_attr_fwd_enabled_t *this) +{ + return this->type; +} + +METHOD(pa_tnc_attr_t, get_value, chunk_t, + private_ietf_attr_fwd_enabled_t *this) +{ + return this->value; +} + +METHOD(pa_tnc_attr_t, get_noskip_flag, bool, + private_ietf_attr_fwd_enabled_t *this) +{ + return this->noskip_flag; +} + +METHOD(pa_tnc_attr_t, set_noskip_flag,void, + private_ietf_attr_fwd_enabled_t *this, bool noskip) +{ + this->noskip_flag = noskip; +} + +METHOD(pa_tnc_attr_t, build, void, + private_ietf_attr_fwd_enabled_t *this) +{ + bio_writer_t *writer; + + if (this->value.ptr) + { + return; + } + writer = bio_writer_create(FORWARDING_ENABLED_SIZE); + writer->write_uint32(writer, this->fwd_status); + + this->value = writer->extract_buf(writer); + writer->destroy(writer); +} + +METHOD(pa_tnc_attr_t, process, status_t, + private_ietf_attr_fwd_enabled_t *this, u_int32_t *offset) +{ + bio_reader_t *reader; + u_int32_t fwd_status; + + *offset = 0; + + if (this->value.len != FORWARDING_ENABLED_SIZE) + { + DBG1(DBG_TNC, "incorrect size for IETF forwarding enabled attribute"); + return FAILED; + } + reader = bio_reader_create(this->value); + reader->read_uint32(reader, &fwd_status); + reader->destroy(reader); + + if (fwd_status > OS_FWD_UNKNOWN) + { + DBG1(DBG_TNC, "IETF forwarding enabled field has unknown value %u", + fwd_status); + return FAILED; + } + this->fwd_status = fwd_status; + + return SUCCESS; +} + +METHOD(pa_tnc_attr_t, get_ref, pa_tnc_attr_t*, + private_ietf_attr_fwd_enabled_t *this) +{ + ref_get(&this->ref); + return &this->public.pa_tnc_attribute; +} + +METHOD(pa_tnc_attr_t, destroy, void, + private_ietf_attr_fwd_enabled_t *this) +{ + if (ref_put(&this->ref)) + { + free(this->value.ptr); + free(this); + } +} + +METHOD(ietf_attr_fwd_enabled_t, get_status, os_fwd_status_t, + private_ietf_attr_fwd_enabled_t *this) +{ + return this->fwd_status; +} + +/** + * Described in header. + */ +pa_tnc_attr_t *ietf_attr_fwd_enabled_create(os_fwd_status_t fwd_status) +{ + private_ietf_attr_fwd_enabled_t *this; + + INIT(this, + .public = { + .pa_tnc_attribute = { + .get_type = _get_type, + .get_value = _get_value, + .get_noskip_flag = _get_noskip_flag, + .set_noskip_flag = _set_noskip_flag, + .build = _build, + .process = _process, + .get_ref = _get_ref, + .destroy = _destroy, + }, + .get_status = _get_status, + }, + .type = { PEN_IETF, IETF_ATTR_FORWARDING_ENABLED }, + .fwd_status = fwd_status, + .ref = 1, + ); + + return &this->public.pa_tnc_attribute; +} + +/** + * Described in header. + */ +pa_tnc_attr_t *ietf_attr_fwd_enabled_create_from_data(chunk_t data) +{ + private_ietf_attr_fwd_enabled_t *this; + + INIT(this, + .public = { + .pa_tnc_attribute = { + .get_type = _get_type, + .get_value = _get_value, + .get_noskip_flag = _get_noskip_flag, + .set_noskip_flag = _set_noskip_flag, + .build = _build, + .process = _process, + .get_ref = _get_ref, + .destroy = _destroy, + }, + .get_status = _get_status, + }, + .type = { PEN_IETF, IETF_ATTR_FORWARDING_ENABLED }, + .value = chunk_clone(data), + .ref = 1, + ); + + return &this->public.pa_tnc_attribute; +} + diff --git a/src/libimcv/ietf/ietf_attr_fwd_enabled.h b/src/libimcv/ietf/ietf_attr_fwd_enabled.h new file mode 100644 index 000000000..41714380e --- /dev/null +++ b/src/libimcv/ietf/ietf_attr_fwd_enabled.h @@ -0,0 +1,64 @@ +/* + * Copyright (C) 2012 Andreas Steffen + * HSR Hochschule fuer Technik Rapperswil + * + * This program is free software; you can redistribute it and/or modify it + * under the terms of the GNU General Public License as published by the + * Free Software Foundation; either version 2 of the License, or (at your + * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>. + * + * This program is distributed in the hope that it will be useful, but + * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY + * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License + * for more details. + */ + +/** + * @defgroup ietf_attr_fwd_enabled ietf_attr_fwd_enabled + * @{ @ingroup ietf_attr + */ + +#ifndef IETF_ATTR_FWD_ENABLED_H_ +#define IETF_ATTR_FWD_ENABLED_H_ + +typedef struct ietf_attr_fwd_enabled_t ietf_attr_fwd_enabled_t; + +#include "ietf_attr.h" +#include "pa_tnc/pa_tnc_attr.h" +#include "os_info/os_info.h" + +/** + * Class implementing the IETF PA-TNC Forwarding Enabled attribute. + * + */ +struct ietf_attr_fwd_enabled_t { + + /** + * Public PA-TNC attribute interface + */ + pa_tnc_attr_t pa_tnc_attribute; + + /** + * Gets the Forwarding Enabled status + * + * @return Forwarding Enabled status + */ + os_fwd_status_t (*get_status)(ietf_attr_fwd_enabled_t *this); + +}; + +/** + * Creates an ietf_attr_fwd_enabled_t object + * + * @param fwd_status Forwarding Enabled status + */ +pa_tnc_attr_t* ietf_attr_fwd_enabled_create(os_fwd_status_t fwd_status); + +/** + * Creates an ietf_attr_fwd_enabled_t object from received data + * + * @param value unparsed attribute value + */ +pa_tnc_attr_t* ietf_attr_fwd_enabled_create_from_data(chunk_t value); + +#endif /** IETF_ATTR_FWD_ENABLED_H_ @}*/ diff --git a/src/libimcv/ietf/ietf_attr_installed_packages.c b/src/libimcv/ietf/ietf_attr_installed_packages.c new file mode 100644 index 000000000..462805e38 --- /dev/null +++ b/src/libimcv/ietf/ietf_attr_installed_packages.c @@ -0,0 +1,335 @@ +/* + * Copyright (C) 2012 Andreas Steffen + * HSR Hochschule fuer Technik Rapperswil + * + * This program is free software; you can redistribute it and/or modify it + * under the terms of the GNU General Public License as published by the + * Free Software Foundation; either version 2 of the License, or (at your + * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>. + * + * This program is distributed in the hope that it will be useful, but + * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY + * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License + * for more details. + */ + +#include "ietf_attr_installed_packages.h" + +#include <string.h> + +#include <pa_tnc/pa_tnc_msg.h> +#include <bio/bio_writer.h> +#include <bio/bio_reader.h> +#include <collections/linked_list.h> +#include <utils/debug.h> + + +typedef struct private_ietf_attr_installed_packages_t private_ietf_attr_installed_packages_t; +typedef struct package_entry_t package_entry_t; + +/** + * PA-TNC Installed Packages Type (see section 4.2.7 of RFC 5792) + * + * 1 2 3 + * 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 + * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ + * | Reserved | Package Count | + * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ + * | Pkg Name Len | Package Name (Variable Length) | + * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ + * | Version Len | Package Version Number (Variable Length) | + * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ + */ + +#define INSTALLED_PACKAGES_MIN_SIZE 4 + +/** + * Private data of an ietf_attr_installed_packages_t object. + */ +struct private_ietf_attr_installed_packages_t { + + /** + * Public members of ietf_attr_installed_packages_t + */ + ietf_attr_installed_packages_t public; + + /** + * Vendor-specific attribute type + */ + pen_type_t type; + + /** + * Attribute value + */ + chunk_t value; + + /** + * Noskip flag + */ + bool noskip_flag; + + /** + * List of Installed Package entries + */ + linked_list_t *packages; + + /** + * Reference count + */ + refcount_t ref; +}; + +/** + * Package entry + */ +struct package_entry_t { + chunk_t name; + chunk_t version; +}; + +/** + * Free a package entry + */ +static void free_package_entry(package_entry_t *entry) +{ + free(entry->name.ptr); + free(entry->version.ptr); + free(entry); +} + +METHOD(pa_tnc_attr_t, get_type, pen_type_t, + private_ietf_attr_installed_packages_t *this) +{ + return this->type; +} + +METHOD(pa_tnc_attr_t, get_value, chunk_t, + private_ietf_attr_installed_packages_t *this) +{ + return this->value; +} + +METHOD(pa_tnc_attr_t, get_noskip_flag, bool, + private_ietf_attr_installed_packages_t *this) +{ + return this->noskip_flag; +} + +METHOD(pa_tnc_attr_t, set_noskip_flag,void, + private_ietf_attr_installed_packages_t *this, bool noskip) +{ + this->noskip_flag = noskip; +} + +METHOD(pa_tnc_attr_t, build, void, + private_ietf_attr_installed_packages_t *this) +{ + bio_writer_t *writer; + enumerator_t *enumerator; + package_entry_t *entry; + + if (this->value.ptr) + { + return; + } + writer = bio_writer_create(INSTALLED_PACKAGES_MIN_SIZE); + writer->write_uint16(writer, 0x0000); + writer->write_uint16(writer, this->packages->get_count(this->packages)); + + enumerator = this->packages->create_enumerator(this->packages); + while (enumerator->enumerate(enumerator, &entry)) + { + writer->write_data8(writer, entry->name); + writer->write_data8(writer, entry->version); + } + enumerator->destroy(enumerator); + + this->value = writer->extract_buf(writer); + writer->destroy(writer); +} + +METHOD(pa_tnc_attr_t, process, status_t, + private_ietf_attr_installed_packages_t *this, u_int32_t *offset) +{ + bio_reader_t *reader; + package_entry_t *entry; + status_t status = FAILED; + chunk_t name, version; + u_int16_t reserved, count; + u_char *pos; + + *offset = 0; + + if (this->value.len < INSTALLED_PACKAGES_MIN_SIZE) + { + DBG1(DBG_TNC, "insufficient data for IETF installed packages"); + return FAILED; + } + reader = bio_reader_create(this->value); + reader->read_uint16(reader, &reserved); + reader->read_uint16(reader, &count); + *offset = INSTALLED_PACKAGES_MIN_SIZE; + + while (reader->remaining(reader)) + { + if (!reader->read_data8(reader, &name)) + { + DBG1(DBG_TNC, "insufficient data for IETF installed package name"); + goto end; + } + pos = memchr(name.ptr, '\0', name.len); + if (pos) + { + DBG1(DBG_TNC, "nul termination in IETF installed package name"); + *offset += 1 + (pos - name.ptr); + goto end; + } + *offset += 1 + name.len; + + if (!reader->read_data8(reader, &version)) + { + DBG1(DBG_TNC, "insufficient data for IETF installed package version"); + goto end; + } + pos = memchr(version.ptr, '\0', version.len); + if (pos) + { + DBG1(DBG_TNC, "nul termination in IETF installed package version"); + *offset += 1 + (pos - version.ptr); + goto end; + } + *offset += 1 + version.len; + + entry = malloc_thing(package_entry_t); + entry->name = chunk_clone(name); + entry->version = chunk_clone(version); + this->packages->insert_last(this->packages, entry); + } + + if (count != this->packages->get_count(this->packages)) + { + DBG1(DBG_TNC, "IETF installed package count unequal to " + "number of included packages"); + goto end; + } + status = SUCCESS; + +end: + reader->destroy(reader); + return status; +} + +METHOD(pa_tnc_attr_t, get_ref, pa_tnc_attr_t*, + private_ietf_attr_installed_packages_t *this) +{ + ref_get(&this->ref); + return &this->public.pa_tnc_attribute; +} + +METHOD(pa_tnc_attr_t, destroy, void, + private_ietf_attr_installed_packages_t *this) +{ + if (ref_put(&this->ref)) + { + this->packages->destroy_function(this->packages, (void*)free_package_entry); + free(this->value.ptr); + free(this); + } +} + +METHOD(ietf_attr_installed_packages_t, add, void, + private_ietf_attr_installed_packages_t *this, chunk_t name, chunk_t version) +{ + package_entry_t *entry; + + /* restrict package name and package version number fields to 255 octets */ + name.len = min(255, name.len); + version.len = min(255, version.len); + + entry = malloc_thing(package_entry_t); + entry->name = chunk_clone(name); + entry->version = chunk_clone(version); + this->packages->insert_last(this->packages, entry); +} + +/** + * Enumerate package filter entries + */ +static bool package_filter(void *null, package_entry_t **entry, chunk_t *name, + void *i2, chunk_t *version) +{ + *name = (*entry)->name; + *version = (*entry)->version; + return TRUE; +} + +METHOD(ietf_attr_installed_packages_t, create_enumerator, enumerator_t*, + private_ietf_attr_installed_packages_t *this) +{ + return enumerator_create_filter( + this->packages->create_enumerator(this->packages), + (void*)package_filter, NULL, NULL); +} + +/** + * Described in header. + */ +pa_tnc_attr_t *ietf_attr_installed_packages_create(void) +{ + private_ietf_attr_installed_packages_t *this; + + INIT(this, + .public = { + .pa_tnc_attribute = { + .get_type = _get_type, + .get_value = _get_value, + .get_noskip_flag = _get_noskip_flag, + .set_noskip_flag = _set_noskip_flag, + .build = _build, + .process = _process, + .get_ref = _get_ref, + .destroy = _destroy, + }, + .add = _add, + .create_enumerator = _create_enumerator, + }, + .type = { PEN_IETF, IETF_ATTR_INSTALLED_PACKAGES }, + .packages = linked_list_create(), + .ref = 1, + ); + + return &this->public.pa_tnc_attribute; +} + +/** + * Described in header. + */ +pa_tnc_attr_t *ietf_attr_installed_packages_create_from_data(chunk_t data) +{ + private_ietf_attr_installed_packages_t *this; + + INIT(this, + .public = { + .pa_tnc_attribute = { + .get_type = _get_type, + .get_value = _get_value, + .get_noskip_flag = _get_noskip_flag, + .set_noskip_flag = _set_noskip_flag, + .build = _build, + .process = _process, + .get_ref = _get_ref, + .destroy = _destroy, + }, + .add = _add, + .create_enumerator = _create_enumerator, + }, + .type = {PEN_IETF, IETF_ATTR_INSTALLED_PACKAGES }, + .value = chunk_clone(data), + .packages = linked_list_create(), + .ref = 1, + ); + + return &this->public.pa_tnc_attribute; +} + + diff --git a/src/libimcv/ietf/ietf_attr_installed_packages.h b/src/libimcv/ietf/ietf_attr_installed_packages.h new file mode 100644 index 000000000..b79c4040c --- /dev/null +++ b/src/libimcv/ietf/ietf_attr_installed_packages.h @@ -0,0 +1,73 @@ +/* + * Copyright (C) 2012 Andreas Steffen + * HSR Hochschule fuer Technik Rapperswil + * + * This program is free software; you can redistribute it and/or modify it + * under the terms of the GNU General Public License as published by the + * Free Software Foundation; either version 2 of the License, or (at your + * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>. + * + * This program is distributed in the hope that it will be useful, but + * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY + * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License + * for more details. + */ + +/** + * @defgroup ietf_attr_installed_packagest ietf_attr_installed_packages + * @{ @ingroup ietf_attr + */ + +#ifndef IETF_ATTR_INSTALLED_PACKAGES_H_ +#define IETF_ATTR_INSTALLED_PACKAGES_H_ + +typedef struct ietf_attr_installed_packages_t ietf_attr_installed_packages_t; + +#include "ietf_attr.h" +#include "pa_tnc/pa_tnc_attr.h" + + +/** + * Class implementing the IETF PA-TNC Installed Packages attribute. + * + */ +struct ietf_attr_installed_packages_t { + + /** + * Public PA-TNC attribute interface + */ + pa_tnc_attr_t pa_tnc_attribute; + + /** + * Add a package entry + * + * @param name package name + * @param version package version number + */ + void (*add)(ietf_attr_installed_packages_t *this, chunk_t name, + chunk_t version); + + /** + * Enumerates over all packages + * Format: chunk_t name, chunk_t version + * + * @return enumerator + */ + enumerator_t* (*create_enumerator)(ietf_attr_installed_packages_t *this); + +}; + +/** + * Creates an ietf_attr_installed_packages_t object + * + */ +pa_tnc_attr_t* ietf_attr_installed_packages_create(void); + +/** + * Creates an ietf_attr_installed_packages_t object from received data + * + * @param value unparsed attribute value + */ +pa_tnc_attr_t* ietf_attr_installed_packages_create_from_data(chunk_t value); + +#endif /** IETF_ATTR_INSTALLED_PACKAGES_H_ @}*/ diff --git a/src/libimcv/ietf/ietf_attr_numeric_version.c b/src/libimcv/ietf/ietf_attr_numeric_version.c new file mode 100644 index 000000000..739256457 --- /dev/null +++ b/src/libimcv/ietf/ietf_attr_numeric_version.c @@ -0,0 +1,282 @@ +/* + * Copyright (C) 2012 Andreas Steffen + * HSR Hochschule fuer Technik Rapperswil + * + * This program is free software; you can redistribute it and/or modify it + * under the terms of the GNU General Public License as published by the + * Free Software Foundation; either version 2 of the License, or (at your + * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>. + * + * This program is distributed in the hope that it will be useful, but + * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY + * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License + * for more details. + */ + +#include "ietf_attr_numeric_version.h" + +#include <pa_tnc/pa_tnc_msg.h> +#include <bio/bio_writer.h> +#include <bio/bio_reader.h> +#include <utils/debug.h> + +typedef struct private_ietf_attr_numeric_version_t private_ietf_attr_numeric_version_t; + +/** + * PA-TNC Numeric Version type (see section 4.2.3 of RFC 5792) + * + * 1 2 3 + * 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 + * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ + * | Major Version Number | + * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ + * | Minor Version Number | + * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ + * | Build Number | + * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ + * | Service Pack Major | Service Pack Minor | + * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ + */ + +#define NUMERIC_VERSION_SIZE 16 + +/** + * Private data of an ietf_attr_numeric_version_t object. + */ +struct private_ietf_attr_numeric_version_t { + + /** + * Public members of ietf_attr_numeric_version_t + */ + ietf_attr_numeric_version_t public; + + /** + * Vendor-specific attribute type + */ + pen_type_t type; + + /** + * Attribute value + */ + chunk_t value; + + /** + * Noskip flag + */ + bool noskip_flag; + + /** + * Major Version Number + */ + u_int32_t major_version; + + /** + * Minor Version Number + */ + u_int32_t minor_version; + + /** + * IBuild Number + */ + u_int32_t build; + + /** + * Service Pack Major Number + */ + u_int16_t service_pack_major; + + /** + * Service Pack Minor Number + */ + u_int16_t service_pack_minor; + + /** + * Reference count + */ + refcount_t ref; +}; + +METHOD(pa_tnc_attr_t, get_type, pen_type_t, + private_ietf_attr_numeric_version_t *this) +{ + return this->type; +} + +METHOD(pa_tnc_attr_t, get_value, chunk_t, + private_ietf_attr_numeric_version_t *this) +{ + return this->value; +} + +METHOD(pa_tnc_attr_t, get_noskip_flag, bool, + private_ietf_attr_numeric_version_t *this) +{ + return this->noskip_flag; +} + +METHOD(pa_tnc_attr_t, set_noskip_flag,void, + private_ietf_attr_numeric_version_t *this, bool noskip) +{ + this->noskip_flag = noskip; +} + +METHOD(pa_tnc_attr_t, build, void, + private_ietf_attr_numeric_version_t *this) +{ + bio_writer_t *writer; + + if (this->value.ptr) + { + return; + } + + writer = bio_writer_create(NUMERIC_VERSION_SIZE); + writer->write_uint32(writer, this->major_version); + writer->write_uint32(writer, this->minor_version); + writer->write_uint32(writer, this->build); + writer->write_uint16(writer, this->service_pack_major); + writer->write_uint16(writer, this->service_pack_minor); + + this->value = writer->extract_buf(writer); + writer->destroy(writer); +} + +METHOD(pa_tnc_attr_t, process, status_t, + private_ietf_attr_numeric_version_t *this, u_int32_t *offset) +{ + bio_reader_t *reader; + + if (this->value.len < NUMERIC_VERSION_SIZE) + { + DBG1(DBG_TNC, "insufficient data for IETF numeric version"); + *offset = 0; + return FAILED; + } + reader = bio_reader_create(this->value); + reader->read_uint32(reader, &this->major_version); + reader->read_uint32(reader, &this->minor_version); + reader->read_uint32(reader, &this->build); + reader->read_uint16(reader, &this->service_pack_major); + reader->read_uint16(reader, &this->service_pack_minor); + reader->destroy(reader); + + return SUCCESS; +} + +METHOD(pa_tnc_attr_t, get_ref, pa_tnc_attr_t*, + private_ietf_attr_numeric_version_t *this) +{ + ref_get(&this->ref); + return &this->public.pa_tnc_attribute; +} + +METHOD(pa_tnc_attr_t, destroy, void, + private_ietf_attr_numeric_version_t *this) +{ + if (ref_put(&this->ref)) + { + free(this->value.ptr); + free(this); + } +} + +METHOD(ietf_attr_numeric_version_t, get_version, void, + private_ietf_attr_numeric_version_t *this, u_int32_t *major, u_int32_t *minor) +{ + if (major) + { + *major = this->major_version; + } + if (minor) + { + *minor = this->minor_version; + } +} + +METHOD(ietf_attr_numeric_version_t, get_build, u_int32_t, + private_ietf_attr_numeric_version_t *this) +{ + return this->build; +} + +METHOD(ietf_attr_numeric_version_t, get_service_pack, void, + private_ietf_attr_numeric_version_t *this, u_int16_t *major, u_int16_t *minor) +{ + if (major) + { + *major = this->service_pack_major; + } + if (minor) + { + *minor = this->service_pack_minor; + } +} + +/** + * Described in header. + */ +pa_tnc_attr_t *ietf_attr_numeric_version_create(u_int32_t major, u_int32_t minor, + u_int32_t build, + u_int16_t service_pack_major, + u_int16_t service_pack_minor) +{ + private_ietf_attr_numeric_version_t *this; + + INIT(this, + .public = { + .pa_tnc_attribute = { + .get_type = _get_type, + .get_value = _get_value, + .get_noskip_flag = _get_noskip_flag, + .set_noskip_flag = _set_noskip_flag, + .build = _build, + .process = _process, + .get_ref = _get_ref, + .destroy = _destroy, + }, + .get_version = _get_version, + .get_build = _get_build, + .get_service_pack = _get_service_pack, + }, + .type = { PEN_IETF, IETF_ATTR_NUMERIC_VERSION }, + .major_version = major, + .minor_version = minor, + .build = build, + .service_pack_major = service_pack_major, + .service_pack_minor = service_pack_minor, + .ref = 1, + ); + + return &this->public.pa_tnc_attribute; +} + +/** + * Described in header. + */ +pa_tnc_attr_t *ietf_attr_numeric_version_create_from_data(chunk_t data) +{ + private_ietf_attr_numeric_version_t *this; + + INIT(this, + .public = { + .pa_tnc_attribute = { + .get_type = _get_type, + .get_value = _get_value, + .get_noskip_flag = _get_noskip_flag, + .set_noskip_flag = _set_noskip_flag, + .build = _build, + .process = _process, + .get_ref = _get_ref, + .destroy = _destroy, + }, + .get_version = _get_version, + .get_build = _get_build, + .get_service_pack = _get_service_pack, + }, + .type = { PEN_IETF, IETF_ATTR_NUMERIC_VERSION }, + .value = chunk_clone(data), + .ref = 1, + ); + + return &this->public.pa_tnc_attribute; +} diff --git a/src/libimcv/ietf/ietf_attr_numeric_version.h b/src/libimcv/ietf/ietf_attr_numeric_version.h new file mode 100644 index 000000000..bbda6b895 --- /dev/null +++ b/src/libimcv/ietf/ietf_attr_numeric_version.h @@ -0,0 +1,84 @@ +/* + * Copyright (C) 2012 Andreas Steffen + * HSR Hochschule fuer Technik Rapperswil + * + * This program is free software; you can redistribute it and/or modify it + * under the terms of the GNU General Public License as published by the + * Free Software Foundation; either version 2 of the License, or (at your + * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>. + * + * This program is distributed in the hope that it will be useful, but + * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY + * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License + * for more details. + */ + +/** + * @defgroup ietf_attr_numeric_versiont ietf_attr_numeric_version + * @{ @ingroup ietf_attr + */ + +#ifndef IETF_ATTR_NUMERIC_VERSION_H_ +#define IETF_ATTR_NUMERIC_VERSION_H_ + +typedef struct ietf_attr_numeric_version_t ietf_attr_numeric_version_t; + +#include "ietf_attr.h" +#include "pa_tnc/pa_tnc_attr.h" + + +/** + * Class implementing the IETF PA-TNC String Version attribute. + * + */ +struct ietf_attr_numeric_version_t { + + /** + * Public PA-TNC attribute interface + */ + pa_tnc_attr_t pa_tnc_attribute; + + /** + * Gets the Major and Minor Version Numbers + * + * @param major Major Version Number + * @param minor Minor Version Number + */ + void (*get_version)(ietf_attr_numeric_version_t *this, + u_int32_t *major, u_int32_t *minor); + + /** + * Gets the Build Number + * + * @param major Major Version Number + * @param minor Minor Version Number + */ + u_int32_t (*get_build)(ietf_attr_numeric_version_t *this); + + /** + * Gets the Major and Minor Numbers of the Service Pack + * + * @param major Service Pack Major Number + * @param minor Servcie Pack Minor Number + */ + void (*get_service_pack)(ietf_attr_numeric_version_t *this, + u_int16_t *major, u_int16_t *minor); +}; + +/** + * Creates an ietf_attr_numeric_version_t object + * + */ +pa_tnc_attr_t* ietf_attr_numeric_version_create(u_int32_t major, u_int32_t minor, + u_int32_t build, + u_int16_t service_pack_major, + u_int16_t service_pack_minor); + +/** + * Creates an ietf_attr_numeric_version_t object from received data + * + * @param value unparsed attribute value + */ +pa_tnc_attr_t* ietf_attr_numeric_version_create_from_data(chunk_t value); + +#endif /** IETF_ATTR_NUMERIC_VERSION_H_ @}*/ diff --git a/src/libimcv/ietf/ietf_attr_op_status.c b/src/libimcv/ietf/ietf_attr_op_status.c new file mode 100644 index 000000000..23530684a --- /dev/null +++ b/src/libimcv/ietf/ietf_attr_op_status.c @@ -0,0 +1,314 @@ +/* + * Copyright (C) 2012 Andreas Steffen + * HSR Hochschule fuer Technik Rapperswil + * + * This program is free software; you can redistribute it and/or modify it + * under the terms of the GNU General Public License as published by the + * Free Software Foundation; either version 2 of the License, or (at your + * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>. + * + * This program is distributed in the hope that it will be useful, but + * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY + * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License + * for more details. + */ + +#include "ietf_attr_op_status.h" + +#include <pa_tnc/pa_tnc_msg.h> +#include <bio/bio_writer.h> +#include <bio/bio_reader.h> +#include <utils/debug.h> + +#include <time.h> + +typedef struct private_ietf_attr_op_status_t private_ietf_attr_op_status_t; + +ENUM(op_status_names, OP_STATUS_UNKNOWN, OP_STATUS_OPERATIONAL, + "unknown", + "not installed", + "installed", + "operational" +); + +ENUM(op_result_names, OP_RESULT_UNKNOWN, OP_RESULT_UNSUCCESSFUL, + "unknown", + "successful", + "errored", + "unsuccessful" +); + +/** + * PA-TNC Operational Status type (see section 4.2.5 of RFC 5792) + * + * 1 2 3 + * 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 + * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ + * | Status | Result | Reserved | + * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ + * | Last Use | + * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ + * | Last Use (continued) | + * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ + * | Last Use (continued) | + * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ + * | Last Use (continued) | + * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ + * | Last Use (continued) | + * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ + */ + +#define OP_STATUS_SIZE 24 + +/** + * Private data of an ietf_attr_op_status_t object. + */ +struct private_ietf_attr_op_status_t { + + /** + * Public members of ietf_attr_op_status_t + */ + ietf_attr_op_status_t public; + + /** + * Vendor-specific attribute type + */ + pen_type_t type; + + /** + * Attribute value + */ + chunk_t value; + + /** + * Noskip flag + */ + bool noskip_flag; + + /** + * Status + */ + u_int8_t status; + + /** + * Result + */ + u_int8_t result; + + /** + * Last Use + */ + time_t last_use; + + /** + * Reference count + */ + refcount_t ref; +}; + +METHOD(pa_tnc_attr_t, get_type, pen_type_t, + private_ietf_attr_op_status_t *this) +{ + return this->type; +} + +METHOD(pa_tnc_attr_t, get_value, chunk_t, + private_ietf_attr_op_status_t *this) +{ + return this->value; +} + +METHOD(pa_tnc_attr_t, get_noskip_flag, bool, + private_ietf_attr_op_status_t *this) +{ + return this->noskip_flag; +} + +METHOD(pa_tnc_attr_t, set_noskip_flag,void, + private_ietf_attr_op_status_t *this, bool noskip) +{ + this->noskip_flag = noskip; +} + +METHOD(pa_tnc_attr_t, build, void, + private_ietf_attr_op_status_t *this) +{ + bio_writer_t *writer; + char last_use[24]; + struct tm t; + + if (this->value.ptr) + { + return; + } + + /* Conversion from time_t to RFC 3339 ASCII string */ + gmtime_r(&this->last_use, &t); + snprintf(last_use, 21, "%04d-%02d-%02dT%02d:%02d:%02dZ", 1900 + t.tm_year, + t.tm_mon + 1, t.tm_mday, t.tm_hour, t.tm_min, t.tm_sec); + + writer = bio_writer_create(OP_STATUS_SIZE); + writer->write_uint8 (writer, this->status); + writer->write_uint8 (writer, this->result); + writer->write_uint16(writer, 0x0000); + writer->write_data (writer, chunk_create(last_use, 20)); + + this->value = writer->extract_buf(writer); + writer->destroy(writer); +} + +METHOD(pa_tnc_attr_t, process, status_t, + private_ietf_attr_op_status_t *this, u_int32_t *offset) +{ + bio_reader_t *reader; + chunk_t last_use; + u_int16_t reserved; + struct tm t; + + *offset = 0; + + if (this->value.len != OP_STATUS_SIZE) + { + DBG1(DBG_TNC, "incorrect size for IETF operational status"); + return FAILED; + } + reader = bio_reader_create(this->value); + reader->read_uint8 (reader, &this->status); + reader->read_uint8 (reader, &this->result); + reader->read_uint16(reader, &reserved); + reader->read_data (reader, 20, &last_use); + reader->destroy(reader); + + if (this->status > OP_STATUS_ROOF) + { + DBG1(DBG_TNC, "invalid status value %c for IETF operational status", + this->status); + return FAILED; + } + + *offset = 1; + + if (this->result > OP_RESULT_ROOF) + { + DBG1(DBG_TNC, "invalid result value %c for IETF operational status", + this->result); + return FAILED; + } + + *offset = 4; + + /* Conversion from RFC 3339 ASCII string to time_t */ + if (sscanf(last_use.ptr, "%4d-%2d-%2dT%2d:%2d:%2dZ", &t.tm_year, &t.tm_mon, + &t.tm_mday, &t.tm_hour, &t.tm_min, &t.tm_sec) != 6) + { + DBG1(DBG_TNC, "invalid last_use time format in IETF operational status"); + return FAILED; + } + t.tm_year -= 1900; + t.tm_mon -= 1; + t.tm_isdst = 0; + this->last_use = mktime(&t) - timezone; + + return SUCCESS; +} + +METHOD(pa_tnc_attr_t, get_ref, pa_tnc_attr_t*, + private_ietf_attr_op_status_t *this) +{ + ref_get(&this->ref); + return &this->public.pa_tnc_attribute; +} + +METHOD(pa_tnc_attr_t, destroy, void, + private_ietf_attr_op_status_t *this) +{ + if (ref_put(&this->ref)) + { + free(this->value.ptr); + free(this); + } +} + +METHOD(ietf_attr_op_status_t, get_status, u_int8_t, + private_ietf_attr_op_status_t *this) +{ + return this->status; +} + +METHOD(ietf_attr_op_status_t, get_result, u_int8_t, + private_ietf_attr_op_status_t *this) +{ + return this->result; +} + +METHOD(ietf_attr_op_status_t, get_last_use, time_t, + private_ietf_attr_op_status_t *this) +{ + return this->last_use; +} + +/** + * Described in header. + */ +pa_tnc_attr_t *ietf_attr_op_status_create(u_int8_t status, u_int8_t result, + time_t last_use) +{ + private_ietf_attr_op_status_t *this; + + INIT(this, + .public = { + .pa_tnc_attribute = { + .get_type = _get_type, + .get_value = _get_value, + .get_noskip_flag = _get_noskip_flag, + .set_noskip_flag = _set_noskip_flag, + .build = _build, + .process = _process, + .get_ref = _get_ref, + .destroy = _destroy, + }, + .get_status = _get_status, + .get_result = _get_result, + .get_last_use = _get_last_use, + }, + .type = { PEN_IETF, IETF_ATTR_OPERATIONAL_STATUS }, + .status = status, + .result = result, + .last_use = last_use, + .ref = 1, + ); + + return &this->public.pa_tnc_attribute; +} + +/** + * Described in header. + */ +pa_tnc_attr_t *ietf_attr_op_status_create_from_data(chunk_t data) +{ + private_ietf_attr_op_status_t *this; + + INIT(this, + .public = { + .pa_tnc_attribute = { + .get_type = _get_type, + .get_value = _get_value, + .get_noskip_flag = _get_noskip_flag, + .set_noskip_flag = _set_noskip_flag, + .build = _build, + .process = _process, + .get_ref = _get_ref, + .destroy = _destroy, + }, + .get_status = _get_status, + .get_result = _get_result, + .get_last_use = _get_last_use, + }, + .type = { PEN_IETF, IETF_ATTR_OPERATIONAL_STATUS }, + .value = chunk_clone(data), + .ref = 1, + ); + + return &this->public.pa_tnc_attribute; +} + diff --git a/src/libimcv/ietf/ietf_attr_op_status.h b/src/libimcv/ietf/ietf_attr_op_status.h new file mode 100644 index 000000000..b70fab608 --- /dev/null +++ b/src/libimcv/ietf/ietf_attr_op_status.h @@ -0,0 +1,107 @@ +/* + * Copyright (C) 2012 Andreas Steffen + * HSR Hochschule fuer Technik Rapperswil + * + * This program is free software; you can redistribute it and/or modify it + * under the terms of the GNU General Public License as published by the + * Free Software Foundation; either version 2 of the License, or (at your + * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>. + * + * This program is distributed in the hope that it will be useful, but + * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY + * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License + * for more details. + */ + +/** + * @defgroup ietf_attr_op_statust ietf_attr_op_status + * @{ @ingroup ietf_attr + */ + +#ifndef IETF_ATTR_OP_STATUS_H_ +#define IETF_ATTR_OP_STATUS_H_ + +typedef struct ietf_attr_op_status_t ietf_attr_op_status_t; +typedef enum op_status_t op_status_t; +typedef enum op_result_t op_result_t; + +#include "ietf_attr.h" +#include "pa_tnc/pa_tnc_attr.h" + +/** + * Operational Status type + */ +enum op_status_t { + OP_STATUS_UNKNOWN = 0, + OP_STATUS_NOT_INSTALLED = 1, + OP_STATUS_INSTALLED = 2, + OP_STATUS_OPERATIONAL = 3, + OP_STATUS_ROOF = 3 +}; + +extern enum_name_t *op_status_names; + +/** + * Operational Result type + */ +enum op_result_t { + OP_RESULT_UNKNOWN = 0, + OP_RESULT_SUCCESSFUL = 1, + OP_RESULT_ERRORED = 2, + OP_RESULT_UNSUCCESSFUL = 3, + OP_RESULT_ROOF = 3 +}; + +extern enum_name_t *op_result_names; + +/** + * Class implementing the IETF PA-TNC Operational Status attribute. + * + */ +struct ietf_attr_op_status_t { + + /** + * Public PA-TNC attribute interface + */ + pa_tnc_attr_t pa_tnc_attribute; + + /** + * Gets the Operational Status + * + * @return Operational Status + */ + u_int8_t (*get_status)(ietf_attr_op_status_t *this); + + /** + * Gets the Operational Result + * + * @return Operational Result + */ + u_int8_t (*get_result)(ietf_attr_op_status_t *this); + + /** + * Gets the time of last use + * + * @return Time of last use + */ + time_t (*get_last_use)(ietf_attr_op_status_t *this); +}; + +/** + * Creates an ietf_attr_op_status_t object + * + * @param status Operational Status + * @param result Operational Result + * @param last_use Time of last use + */ +pa_tnc_attr_t* ietf_attr_op_status_create(u_int8_t status, u_int8_t result, + time_t last_use); + +/** + * Creates an ietf_attr_op_status_t object from received data + * + * @param value unparsed attribute value + */ +pa_tnc_attr_t* ietf_attr_op_status_create_from_data(chunk_t value); + +#endif /** IETF_ATTR_OP_STATUS_H_ @}*/ diff --git a/src/libimcv/ietf/ietf_attr_pa_tnc_error.c b/src/libimcv/ietf/ietf_attr_pa_tnc_error.c index 6daee1a77..5f20f8958 100644 --- a/src/libimcv/ietf/ietf_attr_pa_tnc_error.c +++ b/src/libimcv/ietf/ietf_attr_pa_tnc_error.c @@ -1,5 +1,6 @@ /* - * Copyright (C) 2011 Andreas Steffen, HSR Hochschule fuer Technik Rapperswil + * Copyright (C) 2011-2012 Andreas Steffen + * HSR Hochschule fuer Technik Rapperswil * * This program is free software; you can redistribute it and/or modify it * under the terms of the GNU General Public License as published by the @@ -17,7 +18,7 @@ #include <pa_tnc/pa_tnc_msg.h> #include <bio/bio_writer.h> #include <bio/bio_reader.h> -#include <debug.h> +#include <utils/debug.h> ENUM(pa_tnc_error_code_names, PA_ERROR_RESERVED, PA_ERROR_ATTR_TYPE_NOT_SUPPORTED, @@ -79,7 +80,7 @@ typedef struct private_ietf_attr_pa_tnc_error_t private_ietf_attr_pa_tnc_error_t * | Max Version | Min Version | Reserved | * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ */ - + #define PA_ERROR_VERSION_RESERVED 0x0000 /** @@ -107,14 +108,9 @@ struct private_ietf_attr_pa_tnc_error_t { ietf_attr_pa_tnc_error_t public; /** - * Attribute vendor ID - */ - pen_t vendor_id; - - /** - * Attribute type + * Vendor-specific attribute type */ - u_int32_t type; + pen_type_t type; /** * Attribute value @@ -127,14 +123,9 @@ struct private_ietf_attr_pa_tnc_error_t { bool noskip_flag; /** - * Error code vendor ID + * Vendor-specific error code */ - pen_t error_vendor_id; - - /** - * Error code - */ - u_int32_t error_code; + pen_type_t error_code; /** * First 8 bytes of erroneous PA-TNC message @@ -157,13 +148,7 @@ struct private_ietf_attr_pa_tnc_error_t { refcount_t ref; }; -METHOD(pa_tnc_attr_t, get_vendor_id, pen_t, - private_ietf_attr_pa_tnc_error_t *this) -{ - return this->vendor_id; -} - -METHOD(pa_tnc_attr_t, get_type, u_int32_t, +METHOD(pa_tnc_attr_t, get_type, pen_type_t, private_ietf_attr_pa_tnc_error_t *this) { return this->type; @@ -192,15 +177,19 @@ METHOD(pa_tnc_attr_t, build, void, { bio_writer_t *writer; + if (this->value.ptr) + { + return; + } writer = bio_writer_create(PA_ERROR_HEADER_SIZE + PA_ERROR_MSG_INFO_SIZE); writer->write_uint8 (writer, PA_ERROR_RESERVED); - writer->write_uint24(writer, this->error_vendor_id); - writer->write_uint32(writer, this->error_code); + writer->write_uint24(writer, this->error_code.vendor_id); + writer->write_uint32(writer, this->error_code.type); writer->write_data (writer, this->msg_info); - - if (this->error_vendor_id == PEN_IETF) + + if (this->error_code.vendor_id == PEN_IETF) { - switch (this->error_code) + switch (this->error_code.type) { case PA_ERROR_INVALID_PARAMETER: writer->write_uint32(writer, this->error_offset); @@ -217,7 +206,7 @@ METHOD(pa_tnc_attr_t, build, void, break; } } - this->value = chunk_clone(writer->get_buf(writer)); + this->value = writer->extract_buf(writer); writer->destroy(writer); } @@ -235,10 +224,10 @@ METHOD(pa_tnc_attr_t, process, status_t, } reader = bio_reader_create(this->value); reader->read_uint8 (reader, &reserved); - reader->read_uint24(reader, &this->error_vendor_id); - reader->read_uint32(reader, &this->error_code); + reader->read_uint24(reader, &this->error_code.vendor_id); + reader->read_uint32(reader, &this->error_code.type); - if (this->error_vendor_id == PEN_IETF) + if (this->error_code.vendor_id == PEN_IETF) { if (!reader->read_data(reader, PA_ERROR_MSG_INFO_SIZE, &this->msg_info)) { @@ -249,7 +238,7 @@ METHOD(pa_tnc_attr_t, process, status_t, } this->msg_info = chunk_clone(this->msg_info); - switch (this->error_code) + switch (this->error_code.type) { case PA_ERROR_INVALID_PARAMETER: if (!reader->read_uint32(reader, &this->error_offset)) @@ -283,7 +272,7 @@ METHOD(pa_tnc_attr_t, process, status_t, } reader->destroy(reader); - return SUCCESS; + return SUCCESS; } METHOD(pa_tnc_attr_t, get_ref, pa_tnc_attr_t*, @@ -305,13 +294,7 @@ METHOD(pa_tnc_attr_t, destroy, void, } } -METHOD(ietf_attr_pa_tnc_error_t, get_error_vendor_id, pen_t, - private_ietf_attr_pa_tnc_error_t *this) -{ - return this->error_vendor_id; -} - -METHOD(ietf_attr_pa_tnc_error_t, get_error_code, u_int32_t, +METHOD(ietf_attr_pa_tnc_error_t, get_error_code, pen_type_t, private_ietf_attr_pa_tnc_error_t *this) { return this->error_code; @@ -342,27 +325,15 @@ METHOD(ietf_attr_pa_tnc_error_t, get_offset, u_int32_t, } /** - * Described in header. + * Generic constructor */ -pa_tnc_attr_t *ietf_attr_pa_tnc_error_create(pen_t vendor_id, - u_int32_t error_code, - chunk_t msg_info) +static private_ietf_attr_pa_tnc_error_t* create_generic() { private_ietf_attr_pa_tnc_error_t *this; - if (vendor_id == PEN_IETF) - { - msg_info.len = PA_ERROR_MSG_INFO_SIZE; - } - else if (msg_info.len > PA_ERROR_MSG_INFO_MAX_SIZE) - { - msg_info.len = PA_ERROR_MSG_INFO_MAX_SIZE; - } - INIT(this, .public = { .pa_tnc_attribute = { - .get_vendor_id = _get_vendor_id, .get_type = _get_type, .get_value = _get_value, .get_noskip_flag = _get_noskip_flag, @@ -372,29 +343,47 @@ pa_tnc_attr_t *ietf_attr_pa_tnc_error_create(pen_t vendor_id, .get_ref = _get_ref, .destroy = _destroy, }, - .get_vendor_id = _get_error_vendor_id, .get_error_code = _get_error_code, .get_msg_info = _get_msg_info, .get_attr_info = _get_attr_info, .set_attr_info = _set_attr_info, .get_offset = _get_offset, }, - .vendor_id = PEN_IETF, - .type = IETF_ATTR_PA_TNC_ERROR, - .error_vendor_id = vendor_id, - .error_code = error_code, - .msg_info = chunk_clone(msg_info), + .type = { PEN_IETF, IETF_ATTR_PA_TNC_ERROR }, .ref = 1, ); + return this; +} + +/** + * Described in header. + */ +pa_tnc_attr_t *ietf_attr_pa_tnc_error_create(pen_type_t error_code, + chunk_t msg_info) +{ + private_ietf_attr_pa_tnc_error_t *this; + + if (error_code.vendor_id == PEN_IETF) + { + msg_info.len = PA_ERROR_MSG_INFO_SIZE; + } + else if (msg_info.len > PA_ERROR_MSG_INFO_MAX_SIZE) + { + msg_info.len = PA_ERROR_MSG_INFO_MAX_SIZE; + } + + this = create_generic(); + this->error_code = error_code; + this->msg_info = chunk_clone(msg_info); + return &this->public.pa_tnc_attribute; } /** * Described in header. */ -pa_tnc_attr_t *ietf_attr_pa_tnc_error_create_with_offset(pen_t vendor_id, - u_int32_t error_code, +pa_tnc_attr_t *ietf_attr_pa_tnc_error_create_with_offset(pen_type_t error_code, chunk_t msg_info, u_int32_t error_offset) { @@ -403,34 +392,10 @@ pa_tnc_attr_t *ietf_attr_pa_tnc_error_create_with_offset(pen_t vendor_id, /* the first 8 bytes of the erroneous PA-TNC message are sent back */ msg_info.len = PA_ERROR_MSG_INFO_SIZE; - INIT(this, - .public = { - .pa_tnc_attribute = { - .get_vendor_id = _get_vendor_id, - .get_type = _get_type, - .get_value = _get_value, - .get_noskip_flag = _get_noskip_flag, - .set_noskip_flag = _set_noskip_flag, - .build = _build, - .process = _process, - .get_ref = _get_ref, - .destroy = _destroy, - }, - .get_vendor_id = _get_error_vendor_id, - .get_error_code = _get_error_code, - .get_msg_info = _get_msg_info, - .get_attr_info = _get_attr_info, - .set_attr_info = _set_attr_info, - .get_offset = _get_offset, - }, - .vendor_id = PEN_IETF, - .type = IETF_ATTR_PA_TNC_ERROR, - .error_vendor_id = vendor_id, - .error_code = error_code, - .msg_info = chunk_clone(msg_info), - .error_offset = error_offset, - .ref = 1, - ); + this = create_generic(); + this->error_code = error_code; + this->msg_info = chunk_clone(msg_info); + this->error_offset = error_offset; return &this->public.pa_tnc_attribute; } @@ -442,31 +407,8 @@ pa_tnc_attr_t *ietf_attr_pa_tnc_error_create_from_data(chunk_t data) { private_ietf_attr_pa_tnc_error_t *this; - INIT(this, - .public = { - .pa_tnc_attribute = { - .get_vendor_id = _get_vendor_id, - .get_type = _get_type, - .get_value = _get_value, - .build = _build, - .process = _process, - .get_ref = _get_ref, - .destroy = _destroy, - }, - .get_vendor_id = _get_error_vendor_id, - .get_error_code = _get_error_code, - .get_msg_info = _get_msg_info, - .get_attr_info = _get_attr_info, - .set_attr_info = _set_attr_info, - .get_offset = _get_offset, - }, - .vendor_id = PEN_IETF, - .type = IETF_ATTR_PA_TNC_ERROR, - .value = chunk_clone(data), - .ref = 1, - ); + this = create_generic(); + this->value = chunk_clone(data); return &this->public.pa_tnc_attribute; } - - diff --git a/src/libimcv/ietf/ietf_attr_pa_tnc_error.h b/src/libimcv/ietf/ietf_attr_pa_tnc_error.h index 945e06c62..faa38f8f9 100644 --- a/src/libimcv/ietf/ietf_attr_pa_tnc_error.h +++ b/src/libimcv/ietf/ietf_attr_pa_tnc_error.h @@ -1,5 +1,5 @@ /* - * Copyright (C) 2011 Andreas Steffen + * Copyright (C) 2011-2012 Andreas Steffen * HSR Hochschule fuer Technik Rapperswil * * This program is free software; you can redistribute it and/or modify it @@ -15,7 +15,7 @@ /** * @defgroup ietf_attr_pa_tnc_errort ietf_attr_pa_tnc_error - * @{ @ingroup ietf_attr_pa_tnc_error + * @{ @ingroup ietf_attr */ #ifndef IETF_ATTR_PA_TNC_ERROR_H_ @@ -55,18 +55,11 @@ struct ietf_attr_pa_tnc_error_t { pa_tnc_attr_t pa_tnc_attribute; /** - * Get PA-TNC error code vendor ID - * - * @return error code vendor ID - */ - pen_t (*get_vendor_id)(ietf_attr_pa_tnc_error_t *this); - - /** - * Get PA-TNC error code + * Get Vendor-specific PA-TNC error code * * @return error code */ - pa_tnc_error_code_t (*get_error_code)(ietf_attr_pa_tnc_error_t *this); + pen_type_t (*get_error_code)(ietf_attr_pa_tnc_error_t *this); /** * Get first 8 bytes of erroneous PA-TNC message @@ -101,26 +94,22 @@ struct ietf_attr_pa_tnc_error_t { /** * Creates an ietf_attr_pa_tnc_error_t object from an error code * - * @param vendor_id PA-TNC error code vendor ID - * @param error_code PA-TNC error code + * @param error_code Vendor-specific PA-TNC error code * @param header PA-TNC message header (first 8 bytes) - * + * */ -pa_tnc_attr_t* ietf_attr_pa_tnc_error_create(pen_t vendor_id, - u_int32_t error_code, +pa_tnc_attr_t* ietf_attr_pa_tnc_error_create(pen_type_t error_code, chunk_t header); /** * Creates an ietf_attr_pa_tnc_error_t object from an error code with offset * - * @param vendor_id PA-TNC error code vendor ID - * @param error_code PA-TNC error code + * @param error_code Vendor-specifica PA-TNC error code * @param header PA-TNC message header (first 8 bytes) * @param error_offset PA-TNC error offset in bytes - * + * */ -pa_tnc_attr_t* ietf_attr_pa_tnc_error_create_with_offset(pen_t vendor_id, - u_int32_t error_code, +pa_tnc_attr_t* ietf_attr_pa_tnc_error_create_with_offset(pen_type_t error_code, chunk_t header, u_int32_t error_offset); diff --git a/src/libimcv/ietf/ietf_attr_port_filter.c b/src/libimcv/ietf/ietf_attr_port_filter.c index b53019657..1d516a51f 100644 --- a/src/libimcv/ietf/ietf_attr_port_filter.c +++ b/src/libimcv/ietf/ietf_attr_port_filter.c @@ -17,8 +17,8 @@ #include <pa_tnc/pa_tnc_msg.h> #include <bio/bio_writer.h> #include <bio/bio_reader.h> -#include <utils/linked_list.h> -#include <debug.h> +#include <collections/linked_list.h> +#include <utils/debug.h> typedef struct private_ietf_attr_port_filter_t private_ietf_attr_port_filter_t; @@ -36,8 +36,8 @@ struct port_entry_t { /** * PA-TNC Port Filter Type (see section 4.2.6 of RFC 5792) * - * 1 2 3 - * 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 + * 1 2 3 + * 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ * | Reserved |B| Protocol | Port Number | * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ @@ -58,14 +58,9 @@ struct private_ietf_attr_port_filter_t { ietf_attr_port_filter_t public; /** - * Attribute vendor ID + * Vendor-specific attribute type */ - pen_t vendor_id; - - /** - * Attribute type - */ - u_int32_t type; + pen_type_t type; /** * Attribute value @@ -88,13 +83,7 @@ struct private_ietf_attr_port_filter_t { refcount_t ref; }; -METHOD(pa_tnc_attr_t, get_vendor_id, pen_t, - private_ietf_attr_port_filter_t *this) -{ - return this->vendor_id; -} - -METHOD(pa_tnc_attr_t, get_type, u_int32_t, +METHOD(pa_tnc_attr_t, get_type, pen_type_t, private_ietf_attr_port_filter_t *this) { return this->type; @@ -125,6 +114,10 @@ METHOD(pa_tnc_attr_t, build, void, enumerator_t *enumerator; port_entry_t *entry; + if (this->value.ptr) + { + return; + } writer = bio_writer_create(this->ports->get_count(this->ports) * PORT_FILTER_ENTRY_SIZE); @@ -137,7 +130,7 @@ METHOD(pa_tnc_attr_t, build, void, } enumerator->destroy(enumerator); - this->value = chunk_clone(writer->get_buf(writer)); + this->value = writer->extract_buf(writer); writer->destroy(writer); } @@ -159,7 +152,7 @@ METHOD(pa_tnc_attr_t, process, status_t, while (reader->remaining(reader)) { - entry = malloc_thing(port_entry_t); + entry = malloc_thing(port_entry_t); reader->read_uint8 (reader, &blocked); entry->blocked = blocked & 0x01; reader->read_uint8 (reader, &entry->protocol); @@ -168,7 +161,7 @@ METHOD(pa_tnc_attr_t, process, status_t, } reader->destroy(reader); - return SUCCESS; + return SUCCESS; } METHOD(pa_tnc_attr_t, get_ref, pa_tnc_attr_t*, @@ -199,7 +192,7 @@ METHOD(ietf_attr_port_filter_t, add_port, void, entry->blocked = blocked; entry->protocol = protocol; entry->port = port; - this->ports->insert_last(this->ports, entry); + this->ports->insert_last(this->ports, entry); } /** @@ -232,7 +225,6 @@ pa_tnc_attr_t *ietf_attr_port_filter_create(void) INIT(this, .public = { .pa_tnc_attribute = { - .get_vendor_id = _get_vendor_id, .get_type = _get_type, .get_value = _get_value, .get_noskip_flag = _get_noskip_flag, @@ -245,8 +237,7 @@ pa_tnc_attr_t *ietf_attr_port_filter_create(void) .add_port = _add_port, .create_port_enumerator = _create_port_enumerator, }, - .vendor_id = PEN_IETF, - .type = IETF_ATTR_PORT_FILTER, + .type = { PEN_IETF, IETF_ATTR_PORT_FILTER }, .ports = linked_list_create(), .ref = 1, ); @@ -264,9 +255,10 @@ pa_tnc_attr_t *ietf_attr_port_filter_create_from_data(chunk_t data) INIT(this, .public = { .pa_tnc_attribute = { - .get_vendor_id = _get_vendor_id, .get_type = _get_type, .get_value = _get_value, + .get_noskip_flag = _get_noskip_flag, + .set_noskip_flag = _set_noskip_flag, .build = _build, .process = _process, .get_ref = _get_ref, @@ -275,8 +267,7 @@ pa_tnc_attr_t *ietf_attr_port_filter_create_from_data(chunk_t data) .add_port = _add_port, .create_port_enumerator = _create_port_enumerator, }, - .vendor_id = PEN_IETF, - .type = IETF_ATTR_PORT_FILTER, + .type = {PEN_IETF, IETF_ATTR_PORT_FILTER }, .value = chunk_clone(data), .ports = linked_list_create(), .ref = 1, diff --git a/src/libimcv/ietf/ietf_attr_port_filter.h b/src/libimcv/ietf/ietf_attr_port_filter.h index ad5553417..93b696e45 100644 --- a/src/libimcv/ietf/ietf_attr_port_filter.h +++ b/src/libimcv/ietf/ietf_attr_port_filter.h @@ -15,7 +15,7 @@ /** * @defgroup ietf_attr_port_filtert ietf_attr_port_filter - * @{ @ingroup ietf_attr_port_filter + * @{ @ingroup ietf_attr */ #ifndef IETF_ATTR_PORT_FILTER_H_ diff --git a/src/libimcv/ietf/ietf_attr_product_info.c b/src/libimcv/ietf/ietf_attr_product_info.c index 548793547..a107c27d3 100644 --- a/src/libimcv/ietf/ietf_attr_product_info.c +++ b/src/libimcv/ietf/ietf_attr_product_info.c @@ -17,7 +17,7 @@ #include <pa_tnc/pa_tnc_msg.h> #include <bio/bio_writer.h> #include <bio/bio_reader.h> -#include <debug.h> +#include <utils/debug.h> typedef struct private_ietf_attr_product_info_t private_ietf_attr_product_info_t; @@ -46,14 +46,9 @@ struct private_ietf_attr_product_info_t { ietf_attr_product_info_t public; /** - * Attribute vendor ID + * Vendor-specific attribute type */ - pen_t vendor_id; - - /** - * Attribute type - */ - u_int32_t type; + pen_type_t type; /** * Attribute value @@ -78,7 +73,7 @@ struct private_ietf_attr_product_info_t { /** * Product Name */ - char *product_name; + chunk_t product_name; /** * Reference count @@ -86,13 +81,7 @@ struct private_ietf_attr_product_info_t { refcount_t ref; }; -METHOD(pa_tnc_attr_t, get_vendor_id, pen_t, - private_ietf_attr_product_info_t *this) -{ - return this->vendor_id; -} - -METHOD(pa_tnc_attr_t, get_type, u_int32_t, +METHOD(pa_tnc_attr_t, get_type, pen_type_t, private_ietf_attr_product_info_t *this) { return this->type; @@ -120,16 +109,17 @@ METHOD(pa_tnc_attr_t, build, void, private_ietf_attr_product_info_t *this) { bio_writer_t *writer; - chunk_t product_name; - - product_name = chunk_create(this->product_name, strlen(this->product_name)); + if (this->value.ptr) + { + return; + } writer = bio_writer_create(PRODUCT_INFO_MIN_SIZE); writer->write_uint24(writer, this->product_vendor_id); writer->write_uint16(writer, this->product_id); - writer->write_data (writer, product_name); + writer->write_data (writer, this->product_name); - this->value = chunk_clone(writer->get_buf(writer)); + this->value = writer->extract_buf(writer); writer->destroy(writer); } @@ -151,9 +141,14 @@ METHOD(pa_tnc_attr_t, process, status_t, reader->read_data (reader, reader->remaining(reader), &product_name); reader->destroy(reader); - this->product_name = malloc(product_name.len + 1); - memcpy(this->product_name, product_name.ptr, product_name.len); - this->product_name[product_name.len] = '\0'; + if (!this->product_vendor_id && this->product_id) + { + DBG1(DBG_TNC, "IETF product information vendor ID is 0 " + "but product ID is not 0"); + *offset = 3; + return FAILED; + } + this->product_name = chunk_clone(product_name); return SUCCESS; } @@ -170,13 +165,13 @@ METHOD(pa_tnc_attr_t, destroy, void, { if (ref_put(&this->ref)) { - free(this->product_name); + free(this->product_name.ptr); free(this->value.ptr); free(this); } } -METHOD(ietf_attr_product_info_t, get_info, char*, +METHOD(ietf_attr_product_info_t, get_info, chunk_t, private_ietf_attr_product_info_t *this, pen_t *vendor_id, u_int16_t *id) { if (vendor_id) @@ -194,14 +189,13 @@ METHOD(ietf_attr_product_info_t, get_info, char*, * Described in header. */ pa_tnc_attr_t *ietf_attr_product_info_create(pen_t vendor_id, u_int16_t id, - char *name) + chunk_t name) { private_ietf_attr_product_info_t *this; INIT(this, .public = { .pa_tnc_attribute = { - .get_vendor_id = _get_vendor_id, .get_type = _get_type, .get_value = _get_value, .get_noskip_flag = _get_noskip_flag, @@ -213,11 +207,10 @@ pa_tnc_attr_t *ietf_attr_product_info_create(pen_t vendor_id, u_int16_t id, }, .get_info = _get_info, }, - .vendor_id = PEN_IETF, - .type = IETF_ATTR_PRODUCT_INFORMATION, + .type = { PEN_IETF, IETF_ATTR_PRODUCT_INFORMATION }, .product_vendor_id = vendor_id, .product_id = id, - .product_name = strdup(name), + .product_name = chunk_clone(name), .ref = 1, ); @@ -234,9 +227,10 @@ pa_tnc_attr_t *ietf_attr_product_info_create_from_data(chunk_t data) INIT(this, .public = { .pa_tnc_attribute = { - .get_vendor_id = _get_vendor_id, .get_type = _get_type, .get_value = _get_value, + .get_noskip_flag = _get_noskip_flag, + .set_noskip_flag = _set_noskip_flag, .build = _build, .process = _process, .get_ref = _get_ref, @@ -244,8 +238,7 @@ pa_tnc_attr_t *ietf_attr_product_info_create_from_data(chunk_t data) }, .get_info = _get_info, }, - .vendor_id = PEN_IETF, - .type = IETF_ATTR_PRODUCT_INFORMATION, + .type = { PEN_IETF, IETF_ATTR_PRODUCT_INFORMATION }, .value = chunk_clone(data), .ref = 1, ); diff --git a/src/libimcv/ietf/ietf_attr_product_info.h b/src/libimcv/ietf/ietf_attr_product_info.h index f1dfc3e83..d0b2d2a84 100644 --- a/src/libimcv/ietf/ietf_attr_product_info.h +++ b/src/libimcv/ietf/ietf_attr_product_info.h @@ -15,7 +15,7 @@ /** * @defgroup ietf_attr_product_infot ietf_attr_product_info - * @{ @ingroup ietf + * @{ @ingroup ietf_attr */ #ifndef IETF_ATTR_PRODUCT_INFO_H_ @@ -45,8 +45,8 @@ struct ietf_attr_product_info_t { * @param id Product ID * @return Product Name */ - char* (*get_info)(ietf_attr_product_info_t *this, - pen_t *vendor_id, u_int16_t *id); + chunk_t (*get_info)(ietf_attr_product_info_t *this, + pen_t *vendor_id, u_int16_t *id); }; @@ -55,7 +55,7 @@ struct ietf_attr_product_info_t { * */ pa_tnc_attr_t* ietf_attr_product_info_create(pen_t vendor_id, u_int16_t id, - char *name); + chunk_t name); /** * Creates an ietf_attr_product_info_t object from received data diff --git a/src/libimcv/ietf/ietf_attr_remediation_instr.c b/src/libimcv/ietf/ietf_attr_remediation_instr.c new file mode 100644 index 000000000..5d85e5d89 --- /dev/null +++ b/src/libimcv/ietf/ietf_attr_remediation_instr.c @@ -0,0 +1,359 @@ +/* + * Copyright (C) 2012 Andreas Steffen + * HSR Hochschule fuer Technik Rapperswil + * + * This program is free software; you can redistribute it and/or modify it + * under the terms of the GNU General Public License as published by the + * Free Software Foundation; either version 2 of the License, or (at your + * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>. + * + * This program is distributed in the hope that it will be useful, but + * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY + * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License + * for more details. + */ + +#include "ietf_attr_remediation_instr.h" + +#include <pa_tnc/pa_tnc_msg.h> +#include <bio/bio_writer.h> +#include <bio/bio_reader.h> +#include <utils/debug.h> + +typedef struct private_ietf_attr_remediation_instr_t private_ietf_attr_remediation_instr_t; + +/** + * PA-TNC Remediation Instructions type (see section 4.2.10 of RFC 5792) + * + * 1 2 3 + * 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 + * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ + * | Reserved | Remediation Parameters Vendor ID | + * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ + * | Remediation Parameters Type | + * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ + * | Remediation Parameters (Variable Length) | + * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ + */ + +#define REMEDIATION_INSTR_MIN_SIZE 8 +#define REMEDIATION_INSTR_RESERVED 0x00 + +/** + * IETF Remediation Parameters URI type (see section 4.2.10.1 of RFC 5792) + * + * 1 2 3 + * 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 + * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ + * | Remediation URI (Variable Length) | + * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ +*/ + +/** + * IETF Remediation Parameters String type (see section 4.2.10.2 of RFC 5792) + * + * 1 2 3 + * 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 + * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ + * | Remediation String Length | + * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ + * | Remediation String (Variable Length) | + * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ + * | Lang Code Len | Remediation String Lang Code (Variable Len) | + * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ + */ + +/** + * Private data of an ietf_attr_remediation_instr_t object. + */ +struct private_ietf_attr_remediation_instr_t { + + /** + * Public members of ietf_attr_remediation_instr_t + */ + ietf_attr_remediation_instr_t public; + + /** + * Vendor-specific attribute type + */ + pen_type_t type; + + /** + * Attribute value + */ + chunk_t value; + + /** + * Noskip flag + */ + bool noskip_flag; + + /** + * Remediation Parameters Type + */ + pen_type_t parameters_type; + + /** + * Remediation Parameters + */ + chunk_t parameters; + + /** + * Remediation String + */ + chunk_t string; + + /** + * Remediation Language Code + */ + chunk_t lang_code; + + /** + * Reference count + */ + refcount_t ref; +}; + +METHOD(pa_tnc_attr_t, get_type, pen_type_t, + private_ietf_attr_remediation_instr_t *this) +{ + return this->type; +} + +METHOD(pa_tnc_attr_t, get_value, chunk_t, + private_ietf_attr_remediation_instr_t *this) +{ + return this->value; +} + +METHOD(pa_tnc_attr_t, get_noskip_flag, bool, + private_ietf_attr_remediation_instr_t *this) +{ + return this->noskip_flag; +} + +METHOD(pa_tnc_attr_t, set_noskip_flag,void, + private_ietf_attr_remediation_instr_t *this, bool noskip) +{ + this->noskip_flag = noskip; +} + +METHOD(pa_tnc_attr_t, build, void, + private_ietf_attr_remediation_instr_t *this) +{ + bio_writer_t *writer; + + if (this->value.ptr) + { + return; + } + + writer = bio_writer_create(REMEDIATION_INSTR_MIN_SIZE); + writer->write_uint8 (writer, REMEDIATION_INSTR_RESERVED); + writer->write_uint24(writer, this->parameters_type.vendor_id); + writer->write_uint32(writer, this->parameters_type.type); + writer->write_data (writer, this->parameters); + + this->value = writer->extract_buf(writer); + writer->destroy(writer); +} + +METHOD(pa_tnc_attr_t, process, status_t, + private_ietf_attr_remediation_instr_t *this, u_int32_t *offset) +{ + bio_reader_t *reader; + u_int8_t reserved; + status_t status = SUCCESS; + u_char *pos; + + *offset = 0; + + if (this->value.len < REMEDIATION_INSTR_MIN_SIZE) + { + DBG1(DBG_TNC, "insufficient data for IETF remediation instructions"); + return FAILED; + } + reader = bio_reader_create(this->value); + reader->read_uint8 (reader, &reserved); + reader->read_uint24(reader, &this->parameters_type.vendor_id); + reader->read_uint32(reader, &this->parameters_type.type); + reader->read_data (reader, reader->remaining(reader), &this->parameters); + + this->parameters = chunk_clone(this->parameters); + reader->destroy(reader); + + if (this->parameters_type.vendor_id == PEN_IETF && + this->parameters_type.type == IETF_REMEDIATION_PARAMETERS_STRING) + { + reader = bio_reader_create(this->parameters); + status = FAILED; + *offset = 8; + + if (!reader->read_data32(reader, &this->string)) + { + DBG1(DBG_TNC, "insufficient data for IETF remediation string"); + goto end; + } + *offset += 4; + + pos = memchr(this->string.ptr, '\0', this->string.len); + if (pos) + { + DBG1(DBG_TNC, "nul termination in IETF remediation string"); + *offset += (pos - this->string.ptr); + goto end; + } + *offset += this->string.len; + + if (!reader->read_data8(reader, &this->lang_code)) + { + DBG1(DBG_TNC, "insufficient data for IETF remediation lang code"); + goto end; + } + status = SUCCESS; + +end: + reader->destroy(reader); + } + return status; +} + +METHOD(pa_tnc_attr_t, get_ref, pa_tnc_attr_t*, + private_ietf_attr_remediation_instr_t *this) +{ + ref_get(&this->ref); + return &this->public.pa_tnc_attribute; +} + +METHOD(pa_tnc_attr_t, destroy, void, + private_ietf_attr_remediation_instr_t *this) +{ + if (ref_put(&this->ref)) + { + free(this->parameters.ptr); + free(this->value.ptr); + free(this); + } +} + +METHOD(ietf_attr_remediation_instr_t, get_parameters_type, pen_type_t, + private_ietf_attr_remediation_instr_t *this) +{ + return this->parameters_type; +} + +METHOD(ietf_attr_remediation_instr_t, get_parameters, chunk_t, + private_ietf_attr_remediation_instr_t *this) +{ + return this->parameters; +} + +METHOD(ietf_attr_remediation_instr_t, get_string, chunk_t, + private_ietf_attr_remediation_instr_t *this, chunk_t *lang_code) +{ + if (lang_code) + { + *lang_code = this->lang_code; + } + return this->string; +} + +/** + * Described in header. + */ +pa_tnc_attr_t *ietf_attr_remediation_instr_create(pen_type_t parameters_type, + chunk_t parameters) +{ + private_ietf_attr_remediation_instr_t *this; + + INIT(this, + .public = { + .pa_tnc_attribute = { + .get_type = _get_type, + .get_value = _get_value, + .get_noskip_flag = _get_noskip_flag, + .set_noskip_flag = _set_noskip_flag, + .build = _build, + .process = _process, + .get_ref = _get_ref, + .destroy = _destroy, + }, + .get_parameters_type = _get_parameters_type, + .get_parameters = _get_parameters, + .get_uri = _get_parameters, + .get_string = _get_string, + }, + .type = { PEN_IETF, IETF_ATTR_REMEDIATION_INSTRUCTIONS }, + .parameters_type = parameters_type, + .parameters = chunk_clone(parameters), + .ref = 1, + ); + + return &this->public.pa_tnc_attribute; +} + +/** + * Described in header. + */ +pa_tnc_attr_t *ietf_attr_remediation_instr_create_from_uri(chunk_t uri) +{ + pen_type_t type = { PEN_IETF, IETF_REMEDIATION_PARAMETERS_URI }; + + return ietf_attr_remediation_instr_create(type, uri); +} + +/** + * Described in header. + */ +pa_tnc_attr_t *ietf_attr_remediation_instr_create_from_string(chunk_t string, + chunk_t lang_code) +{ + pa_tnc_attr_t *attr; + bio_writer_t *writer; + pen_type_t type = { PEN_IETF, IETF_REMEDIATION_PARAMETERS_STRING }; + + /* limit language code to 255 octets */ + lang_code.len = min(255, lang_code.len); + + writer = bio_writer_create(4 + string.len + 1 + lang_code.len); + writer->write_data32(writer, string); + writer->write_data8 (writer, lang_code); + + attr = ietf_attr_remediation_instr_create(type, writer->get_buf(writer)); + writer->destroy(writer); + + return attr; +} + +/** + * Described in header. + */ +pa_tnc_attr_t *ietf_attr_remediation_instr_create_from_data(chunk_t data) +{ + private_ietf_attr_remediation_instr_t *this; + + INIT(this, + .public = { + .pa_tnc_attribute = { + .get_type = _get_type, + .get_value = _get_value, + .get_noskip_flag = _get_noskip_flag, + .set_noskip_flag = _set_noskip_flag, + .build = _build, + .process = _process, + .get_ref = _get_ref, + .destroy = _destroy, + }, + .get_parameters_type = _get_parameters_type, + .get_parameters = _get_parameters, + .get_uri = _get_parameters, + .get_string = _get_string, + }, + .type = { PEN_IETF, IETF_ATTR_REMEDIATION_INSTRUCTIONS }, + .value = chunk_clone(data), + .ref = 1, + ); + + return &this->public.pa_tnc_attribute; +} + diff --git a/src/libimcv/ietf/ietf_attr_remediation_instr.h b/src/libimcv/ietf/ietf_attr_remediation_instr.h new file mode 100644 index 000000000..5c7c8891b --- /dev/null +++ b/src/libimcv/ietf/ietf_attr_remediation_instr.h @@ -0,0 +1,109 @@ +/* + * Copyright (C) 2012 Andreas Steffen + * HSR Hochschule fuer Technik Rapperswil + * + * This program is free software; you can redistribute it and/or modify it + * under the terms of the GNU General Public License as published by the + * Free Software Foundation; either version 2 of the License, or (at your + * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>. + * + * This program is distributed in the hope that it will be useful, but + * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY + * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License + * for more details. + */ + +/** + * @defgroup ietf_attr_remediation_instrt ietf_attr_remediation_instr + * @{ @ingroup ietf_attr + */ + +#ifndef IETF_ATTR_REMEDIATION_INSTR_H_ +#define IETF_ATTR_REMEDIATION_INSTR_H_ + +typedef struct ietf_attr_remediation_instr_t ietf_attr_remediation_instr_t; +typedef enum ietf_remediation_parameters_t ietf_remediation_parameters_t; + +#include "ietf_attr.h" +#include "pa_tnc/pa_tnc_attr.h" + +enum ietf_remediation_parameters_t { + IETF_REMEDIATION_PARAMETERS_URI = 1, + IETF_REMEDIATION_PARAMETERS_STRING = 2 +}; + +/** + * Class implementing the IETF PA-TNC Remediation Instructions attribute. + * + */ +struct ietf_attr_remediation_instr_t { + + /** + * Public PA-TNC attribute interface + */ + pa_tnc_attr_t pa_tnc_attribute; + + /** + * Get the Remediation Parameters Type (Vendor ID and Type) + * + * @return Remediation Parameters Type + */ + pen_type_t (*get_parameters_type)(ietf_attr_remediation_instr_t *this); + + /** + * Get the Remediation Parameters + * + * @return Remediation Parameters + */ + chunk_t (*get_parameters)(ietf_attr_remediation_instr_t *this); + + /** + * Get the Remediation URI + * + * @return Remediation URI + */ + chunk_t (*get_uri)(ietf_attr_remediation_instr_t *this); + + /** + * Get the Remediation String + * + * @param lang_code Optional Language Code + * @return Remediation String + */ + chunk_t (*get_string)(ietf_attr_remediation_instr_t *this, + chunk_t *lang_code); +}; + +/** + * Creates a general ietf_attr_remediation_instr_t object + * + * @param parameters_type Remediation Parameters Type + * @param parameters Remediation Parameters + */ +pa_tnc_attr_t* ietf_attr_remediation_instr_create(pen_type_t parameters_type, + chunk_t parameters); + +/** + * Creates an ietf_attr_remediation_instr_t object of Remediation URI Type + * + * @param uri Remediation URI + */ +pa_tnc_attr_t* ietf_attr_remediation_instr_create_from_uri(chunk_t uri); + +/** + * Creates an ietf_attr_remediation_instr_t object of Remediation String Type + * + * @param string Remediation String + * @param lang_code Remediation String Language Code + */ +pa_tnc_attr_t* ietf_attr_remediation_instr_create_from_string(chunk_t string, + chunk_t lang_code); + +/** + * Creates an ietf_attr_remediation_instr_t object from received data + * + * @param value unparsed attribute value + */ +pa_tnc_attr_t* ietf_attr_remediation_instr_create_from_data(chunk_t value); + +#endif /** IETF_ATTR_REMEDIATION_INSTR_H_ @}*/ diff --git a/src/libimcv/ietf/ietf_attr_string_version.c b/src/libimcv/ietf/ietf_attr_string_version.c new file mode 100644 index 000000000..68adde612 --- /dev/null +++ b/src/libimcv/ietf/ietf_attr_string_version.c @@ -0,0 +1,300 @@ +/* + * Copyright (C) 2012 Andreas Steffen + * HSR Hochschule fuer Technik Rapperswil + * + * This program is free software; you can redistribute it and/or modify it + * under the terms of the GNU General Public License as published by the + * Free Software Foundation; either version 2 of the License, or (at your + * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>. + * + * This program is distributed in the hope that it will be useful, but + * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY + * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License + * for more details. + */ + +#include "ietf_attr_string_version.h" + +#include <pa_tnc/pa_tnc_msg.h> +#include <bio/bio_writer.h> +#include <bio/bio_reader.h> +#include <utils/debug.h> + +typedef struct private_ietf_attr_string_version_t private_ietf_attr_string_version_t; + +/** + * PA-TNC String Version type (see section 4.2.4 of RFC 5792) + * + * 1 2 3 + * 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 + * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ + * | Version Len | Product Version Number (Variable Length) | + * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ + * | Build Num Len | Internal Build Number (Variable Length) | + * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ + * | Config. Len | Configuration Version Number (Variable Length)| + * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ + */ + +#define STRING_VERSION_MIN_SIZE 3 + +/** + * Private data of an ietf_attr_string_version_t object. + */ +struct private_ietf_attr_string_version_t { + + /** + * Public members of ietf_attr_string_version_t + */ + ietf_attr_string_version_t public; + + /** + * Vendor-specific attribute type + */ + pen_type_t type; + + /** + * Attribute value + */ + chunk_t value; + + /** + * Noskip flag + */ + bool noskip_flag; + + /** + * Product Version Number + */ + chunk_t version; + + /** + * Internal Build Number + */ + chunk_t build; + + /** + * Configuration Version Number + */ + chunk_t config; + + /** + * Reference count + */ + refcount_t ref; +}; + +METHOD(pa_tnc_attr_t, get_type, pen_type_t, + private_ietf_attr_string_version_t *this) +{ + return this->type; +} + +METHOD(pa_tnc_attr_t, get_value, chunk_t, + private_ietf_attr_string_version_t *this) +{ + return this->value; +} + +METHOD(pa_tnc_attr_t, get_noskip_flag, bool, + private_ietf_attr_string_version_t *this) +{ + return this->noskip_flag; +} + +METHOD(pa_tnc_attr_t, set_noskip_flag,void, + private_ietf_attr_string_version_t *this, bool noskip) +{ + this->noskip_flag = noskip; +} + +METHOD(pa_tnc_attr_t, build, void, + private_ietf_attr_string_version_t *this) +{ + bio_writer_t *writer; + + if (this->value.ptr) + { + return; + } + + writer = bio_writer_create(STRING_VERSION_MIN_SIZE); + writer->write_data8(writer, this->version); + writer->write_data8(writer, this->build); + writer->write_data8(writer, this->config); + + this->value = writer->extract_buf(writer); + writer->destroy(writer); +} + +METHOD(pa_tnc_attr_t, process, status_t, + private_ietf_attr_string_version_t *this, u_int32_t *offset) +{ + bio_reader_t *reader; + status_t status = FAILED; + chunk_t version, build, config; + u_char *pos; + + *offset = 0; + + if (this->value.len < STRING_VERSION_MIN_SIZE) + { + DBG1(DBG_TNC, "insufficient data for IETF string version"); + return FAILED; + } + reader = bio_reader_create(this->value); + + if (!reader->read_data8(reader, &version)) + { + DBG1(DBG_TNC, "insufficient data for IETF product version number"); + goto end; + + } + pos = memchr(version.ptr, '\0', version.len); + if (pos) + { + DBG1(DBG_TNC, "nul termination in IETF product version number"); + *offset += 1 + (pos - version.ptr); + goto end; + } + *offset += 1 + version.len; + + if (!reader->read_data8(reader, &build)) + { + DBG1(DBG_TNC, "insufficient data for IETF internal build number"); + goto end; + + } + pos = memchr(build.ptr, '\0', build.len); + if (pos) + { + DBG1(DBG_TNC, "nul termination in IETF internal build number"); + *offset += 1 + (pos - build.ptr); + goto end; + } + *offset += 1 + build.len; + + if (!reader->read_data8(reader, &config)) + { + DBG1(DBG_TNC, "insufficient data for IETF configuration version number"); + goto end; + + } + pos = memchr(config.ptr, '\0', config.len); + if (pos) + { + DBG1(DBG_TNC, "nul termination in IETF configuration version number"); + *offset += 1 + (pos - config.ptr); + goto end; + } + + this->version = chunk_clone(version); + this->build = chunk_clone(build); + this->config = chunk_clone(config); + status = SUCCESS; + +end: + reader->destroy(reader); + return status; +} + +METHOD(pa_tnc_attr_t, get_ref, pa_tnc_attr_t*, + private_ietf_attr_string_version_t *this) +{ + ref_get(&this->ref); + return &this->public.pa_tnc_attribute; +} + +METHOD(pa_tnc_attr_t, destroy, void, + private_ietf_attr_string_version_t *this) +{ + if (ref_put(&this->ref)) + { + free(this->version.ptr); + free(this->build.ptr); + free(this->config.ptr); + free(this->value.ptr); + free(this); + } +} + +METHOD(ietf_attr_string_version_t, get_version, chunk_t, + private_ietf_attr_string_version_t *this, chunk_t *build, chunk_t *config) +{ + if (build) + { + *build = this->build; + } + if (config) + { + *config = this->config; + } + return this->version; +} + +/** + * Described in header. + */ +pa_tnc_attr_t *ietf_attr_string_version_create(chunk_t version, chunk_t build, + chunk_t config) +{ + private_ietf_attr_string_version_t *this; + + /* limit version numbers to 255 octets */ + version.len = min(255, version.len); + build.len = min(255, build.len); + config.len = min(255, config.len); + + INIT(this, + .public = { + .pa_tnc_attribute = { + .get_type = _get_type, + .get_value = _get_value, + .get_noskip_flag = _get_noskip_flag, + .set_noskip_flag = _set_noskip_flag, + .build = _build, + .process = _process, + .get_ref = _get_ref, + .destroy = _destroy, + }, + .get_version = _get_version, + }, + .type = { PEN_IETF, IETF_ATTR_STRING_VERSION }, + .version = chunk_clone(version), + .build = chunk_clone(build), + .config = chunk_clone(config), + .ref = 1, + ); + + return &this->public.pa_tnc_attribute; +} + +/** + * Described in header. + */ +pa_tnc_attr_t *ietf_attr_string_version_create_from_data(chunk_t data) +{ + private_ietf_attr_string_version_t *this; + + INIT(this, + .public = { + .pa_tnc_attribute = { + .get_type = _get_type, + .get_value = _get_value, + .get_noskip_flag = _get_noskip_flag, + .set_noskip_flag = _set_noskip_flag, + .build = _build, + .process = _process, + .get_ref = _get_ref, + .destroy = _destroy, + }, + .get_version = _get_version, + }, + .type = { PEN_IETF, IETF_ATTR_STRING_VERSION }, + .value = chunk_clone(data), + .ref = 1, + ); + + return &this->public.pa_tnc_attribute; +} + diff --git a/src/libimcv/ietf/ietf_attr_string_version.h b/src/libimcv/ietf/ietf_attr_string_version.h new file mode 100644 index 000000000..9ccc1f0ee --- /dev/null +++ b/src/libimcv/ietf/ietf_attr_string_version.h @@ -0,0 +1,67 @@ +/* + * Copyright (C) 2012 Andreas Steffen + * HSR Hochschule fuer Technik Rapperswil + * + * This program is free software; you can redistribute it and/or modify it + * under the terms of the GNU General Public License as published by the + * Free Software Foundation; either version 2 of the License, or (at your + * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>. + * + * This program is distributed in the hope that it will be useful, but + * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY + * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License + * for more details. + */ + +/** + * @defgroup ietf_attr_string_versiont ietf_attr_string_version + * @{ @ingroup ietf_attr + */ + +#ifndef IETF_ATTR_STRING_VERSION_H_ +#define IETF_ATTR_STRING_VERSION_H_ + +typedef struct ietf_attr_string_version_t ietf_attr_string_version_t; + +#include "ietf_attr.h" +#include "pa_tnc/pa_tnc_attr.h" + + +/** + * Class implementing the IETF PA-TNC String Version attribute. + * + */ +struct ietf_attr_string_version_t { + + /** + * Public PA-TNC attribute interface + */ + pa_tnc_attr_t pa_tnc_attribute; + + /** + * Gets the Product Version Number and optionally the Internal Build + * and Configuration Version Numbers + * + * @param build Internal Build Number (if build != NULL) + * @param config Configuration Version Number (if config != NULL) + * @return Product Version Number + */ + chunk_t (*get_version)(ietf_attr_string_version_t *this, chunk_t *build, + chunk_t *config); +}; + +/** + * Creates an ietf_attr_string_version_t object + * + */ +pa_tnc_attr_t* ietf_attr_string_version_create(chunk_t version, chunk_t build, + chunk_t config); + +/** + * Creates an ietf_attr_string_version_t object from received data + * + * @param value unparsed attribute value + */ +pa_tnc_attr_t* ietf_attr_string_version_create_from_data(chunk_t value); + +#endif /** IETF_ATTR_STRING_VERSION_H_ @}*/ diff --git a/src/libimcv/imc/imc_agent.c b/src/libimcv/imc/imc_agent.c index de2f959a4..7dc3abddd 100644 --- a/src/libimcv/imc/imc_agent.c +++ b/src/libimcv/imc/imc_agent.c @@ -1,5 +1,6 @@ /* - * Copyright (C) 2011 Andreas Steffen, HSR Hochschule fuer Technik Rapperswil + * Copyright (C) 2011-2012 Andreas Steffen + * HSR Hochschule fuer Technik Rapperswil * * This program is free software; you can redistribute it and/or modify it * under the terms of the GNU General Public License as published by the @@ -17,8 +18,7 @@ #include <tncif_names.h> -#include <debug.h> -#include <utils/linked_list.h> +#include <utils/debug.h> #include <threading/rwlock.h> typedef struct private_imc_agent_t private_imc_agent_t; @@ -39,14 +39,14 @@ struct private_imc_agent_t { const char *name; /** - * message vendor ID of IMC + * message types registered by IMC */ - TNC_VendorID vendor_id; + pen_type_t *supported_types; /** - * message subtype of IMC + * number of message types registered by IMC */ - TNC_MessageSubtype subtype; + u_int32_t type_count; /** * ID of IMC as assigned by TNCC @@ -95,45 +95,6 @@ struct private_imc_agent_t { TNC_UInt32 type_count); /** - * Call when an IMC-IMC message is to be sent - * - * @param imc_id IMC ID assigned by TNCC - * @param connection_id network connection ID assigned by TNCC - * @param msg message to send - * @param msg_len message length in bytes - * @param msg_type message type - * @return TNC result code - */ - TNC_Result (*send_message)(TNC_IMCID imc_id, - TNC_ConnectionID connection_id, - TNC_BufferReference msg, - TNC_UInt32 msg_len, - TNC_MessageType msg_type); - - - /** - * Call when an IMC-IMC message is to be sent with long message types - * - * @param imc_id IMC ID assigned by TNCC - * @param connection_id network connection ID assigned by TNCC - * @param msg_flags message flags - * @param msg message to send - * @param msg_len message length in bytes - * @param msg_vid message vendor ID - * @param msg_subtype message subtype - * @param dst_imc_id destination IMV ID - * @return TNC result code - */ - TNC_Result (*send_message_long)(TNC_IMCID imc_id, - TNC_ConnectionID connection_id, - TNC_UInt32 msg_flags, - TNC_BufferReference msg, - TNC_UInt32 msg_len, - TNC_VendorID msg_vid, - TNC_MessageSubtype msg_subtype, - TNC_UInt32 dst_imv_id); - - /** * Get the value of an attribute associated with a connection * or with the TNCC as a whole. * @@ -205,14 +166,14 @@ METHOD(imc_agent_t, bind_functions, TNC_Result, this->public.request_handshake_retry = NULL; } if (bind_function(this->id, "TNC_TNCC_SendMessage", - (void**)&this->send_message) != TNC_RESULT_SUCCESS) + (void**)&this->public.send_message) != TNC_RESULT_SUCCESS) { - this->send_message = NULL; + this->public.send_message = NULL; } if (bind_function(this->id, "TNC_TNCC_SendMessageLong", - (void**)&this->send_message_long) != TNC_RESULT_SUCCESS) + (void**)&this->public.send_message_long) != TNC_RESULT_SUCCESS) { - this->send_message_long = NULL; + this->public.send_message_long = NULL; } if (bind_function(this->id, "TNC_TNCC_GetAttribute", (void**)&this->get_attribute) != TNC_RESULT_SUCCESS) @@ -229,22 +190,40 @@ METHOD(imc_agent_t, bind_functions, TNC_Result, { this->reserve_additional_id = NULL; } - DBG2(DBG_IMC, "IMC %u \"%s\" provided with bind function", - this->id, this->name); if (this->report_message_types_long) { - this->report_message_types_long(this->id, &this->vendor_id, - &this->subtype, 1); + TNC_VendorIDList vendor_id_list; + TNC_MessageSubtypeList subtype_list; + int i; + + vendor_id_list = malloc(this->type_count * sizeof(TNC_UInt32)); + subtype_list = malloc(this->type_count * sizeof(TNC_UInt32)); + + for (i = 0; i < this->type_count; i++) + { + vendor_id_list[i] = this->supported_types[i].vendor_id; + subtype_list[i] = this->supported_types[i].type; + } + this->report_message_types_long(this->id, vendor_id_list, subtype_list, + this->type_count); + free(vendor_id_list); + free(subtype_list); } - else if (this->report_message_types && - this->vendor_id <= TNC_VENDORID_ANY && - this->subtype <= TNC_SUBTYPE_ANY) + else if (this->report_message_types) { - TNC_MessageType type; + TNC_MessageTypeList type_list; + int i; - type = (this->vendor_id << 8) | this->subtype; - this->report_message_types(this->id, &type, 1); + type_list = malloc(this->type_count * sizeof(TNC_UInt32)); + + for (i = 0; i < this->type_count; i++) + { + type_list[i] = (this->supported_types[i].vendor_id << 8) | + (this->supported_types[i].type & 0xff); + } + this->report_message_types(this->id, type_list, this->type_count); + free(type_list); } return TNC_RESULT_SUCCESS; } @@ -333,12 +312,31 @@ static char* get_str_attribute(private_imc_agent_t *this, TNC_ConnectionID id, return NULL; } +/** + * Read an UInt32 attribute + */ +static u_int32_t get_uint_attribute(private_imc_agent_t *this, TNC_ConnectionID id, + TNC_AttributeID attribute_id) +{ + TNC_UInt32 len; + char buf[4]; + + if (this->get_attribute && + this->get_attribute(this->id, id, attribute_id, 4, buf, &len) == + TNC_RESULT_SUCCESS && len == 4) + { + return untoh32(buf); + } + return 0; + } + METHOD(imc_agent_t, create_state, TNC_Result, private_imc_agent_t *this, imc_state_t *state) { TNC_ConnectionID conn_id; char *tnccs_p = NULL, *tnccs_v = NULL, *t_p = NULL, *t_v = NULL; bool has_long = FALSE, has_excl = FALSE, has_soh = FALSE; + u_int32_t max_msg_len; conn_id = state->get_connection_id(state); if (find_connection(this, conn_id)) @@ -353,18 +351,22 @@ METHOD(imc_agent_t, create_state, TNC_Result, has_long = get_bool_attribute(this, conn_id, TNC_ATTRIBUTEID_HAS_LONG_TYPES); has_excl = get_bool_attribute(this, conn_id, TNC_ATTRIBUTEID_HAS_EXCLUSIVE); has_soh = get_bool_attribute(this, conn_id, TNC_ATTRIBUTEID_HAS_SOH); - tnccs_p = get_str_attribute(this, conn_id, TNC_ATTRIBUTEID_IFTNCCS_PROTOCOL); + tnccs_p = get_str_attribute(this, conn_id, TNC_ATTRIBUTEID_IFTNCCS_PROTOCOL); tnccs_v = get_str_attribute(this, conn_id, TNC_ATTRIBUTEID_IFTNCCS_VERSION); t_p = get_str_attribute(this, conn_id, TNC_ATTRIBUTEID_IFT_PROTOCOL); t_v = get_str_attribute(this, conn_id, TNC_ATTRIBUTEID_IFT_VERSION); + max_msg_len = get_uint_attribute(this, conn_id, TNC_ATTRIBUTEID_MAX_MESSAGE_SIZE); state->set_flags(state, has_long, has_excl); + state->set_max_msg_len(state, max_msg_len); + + DBG2(DBG_IMC, "IMC %u \"%s\" created a state for %s %s Connection ID %u: " + "%slong %sexcl %ssoh", this->id, this->name, + tnccs_p ? tnccs_p:"?", tnccs_v ? tnccs_v:"?", conn_id, + has_long ? "+":"-", has_excl ? "+":"-", has_soh ? "+":"-"); + DBG2(DBG_IMC, " over %s %s with maximum PA-TNC message size of %u bytes", + t_p ? t_p:"?", t_v ? t_v :"?", max_msg_len); - DBG2(DBG_IMC, "IMC %u \"%s\" created a state for Connection ID %u: " - "%s %s with %slong %sexcl %ssoh over %s %s", - this->id, this->name, conn_id, tnccs_p ? tnccs_p:"?", - tnccs_v ? tnccs_v:"?", has_long ? "+":"-", has_excl ? "+":"-", - has_soh ? "+":"-", t_p ? t_p:"?", t_v ? t_v :"?"); free(tnccs_p); free(tnccs_v); free(t_p); @@ -404,7 +406,7 @@ METHOD(imc_agent_t, change_state, TNC_Result, case TNC_CONNECTION_STATE_ACCESS_ISOLATED: case TNC_CONNECTION_STATE_ACCESS_NONE: state = find_connection(this, connection_id); - + if (!state) { DBG1(DBG_IMC, "IMC %u \"%s\" has no state for Connection ID %u", @@ -432,7 +434,7 @@ METHOD(imc_agent_t, change_state, TNC_Result, DBG1(DBG_IMC, "IMC %u \"%s\" was notified of unknown state %u " "for Connection ID %u", this->id, this->name, new_state, connection_id); - return TNC_RESULT_INVALID_PARAMETER; + return TNC_RESULT_INVALID_PARAMETER; } return TNC_RESULT_SUCCESS; } @@ -451,142 +453,16 @@ METHOD(imc_agent_t, get_state, bool, return TRUE; } -METHOD(imc_agent_t, send_message, TNC_Result, - private_imc_agent_t *this, TNC_ConnectionID connection_id, bool excl, - TNC_UInt32 src_imc_id, TNC_UInt32 dst_imv_id, chunk_t msg) +METHOD(imc_agent_t, get_name, const char*, + private_imc_agent_t *this) { - TNC_MessageType type; - TNC_UInt32 msg_flags; - imc_state_t *state; - - state = find_connection(this, connection_id); - if (!state) - { - DBG1(DBG_IMV, "IMC %u \"%s\" has no state for Connection ID %u", - this->id, this->name, connection_id); - return TNC_RESULT_FATAL; - } - - if (state->has_long(state) && this->send_message_long) - { - if (!src_imc_id) - { - src_imc_id = this->id; - } - msg_flags = excl ? TNC_MESSAGE_FLAGS_EXCLUSIVE : 0; - - return this->send_message_long(src_imc_id, connection_id, msg_flags, - msg.ptr, msg.len, this->vendor_id, - this->subtype, dst_imv_id); - } - if (this->send_message) - { - type = (this->vendor_id << 8) | this->subtype; - - return this->send_message(this->id, connection_id, msg.ptr, msg.len, - type); - } - return TNC_RESULT_FATAL; + return this->name; } -METHOD(imc_agent_t, receive_message, TNC_Result, - private_imc_agent_t *this, imc_state_t *state, chunk_t msg, - TNC_VendorID msg_vid, TNC_MessageSubtype msg_subtype, - TNC_UInt32 src_imv_id, TNC_UInt32 dst_imc_id, pa_tnc_msg_t **pa_tnc_msg) +METHOD(imc_agent_t, get_id, TNC_IMCID, + private_imc_agent_t *this) { - pa_tnc_msg_t *pa_msg, *error_msg; - pa_tnc_attr_t *error_attr; - enumerator_t *enumerator; - TNC_MessageType msg_type; - TNC_UInt32 msg_flags, src_imc_id, dst_imv_id; - TNC_ConnectionID connection_id; - TNC_Result result; - - connection_id = state->get_connection_id(state); - - if (state->has_long(state)) - { - if (dst_imc_id != TNC_IMCID_ANY) - { - DBG2(DBG_IMC, "IMC %u \"%s\" received message for Connection ID %u " - "from IMV %u to IMC %u", this->id, this->name, - connection_id, src_imv_id, dst_imc_id); - } - else - { - DBG2(DBG_IMC, "IMC %u \"%s\" received message for Connection ID %u " - "from IMV %u", this->id, this->name, connection_id, - src_imv_id); - } - } - else - { - DBG2(DBG_IMC, "IMC %u \"%s\" received message for Connection ID %u", - this->id, this->name, connection_id); - } - - *pa_tnc_msg = NULL; - pa_msg = pa_tnc_msg_create_from_data(msg); - - switch (pa_msg->process(pa_msg)) - { - case SUCCESS: - *pa_tnc_msg = pa_msg; - break; - case VERIFY_ERROR: - /* build error message */ - error_msg = pa_tnc_msg_create(); - enumerator = pa_msg->create_error_enumerator(pa_msg); - while (enumerator->enumerate(enumerator, &error_attr)) - { - error_msg->add_attribute(error_msg, - error_attr->get_ref(error_attr)); - } - enumerator->destroy(enumerator); - error_msg->build(error_msg); - - /* send error message */ - if (state->has_long(state) && this->send_message_long) - { - if (state->has_excl(state)) - { - msg_flags = TNC_MESSAGE_FLAGS_EXCLUSIVE; - dst_imv_id = src_imv_id; - } - else - { - msg_flags = 0; - dst_imv_id = TNC_IMVID_ANY; - } - src_imc_id = (dst_imc_id == TNC_IMCID_ANY) ? this->id - : dst_imc_id; - - result = this->send_message_long(src_imc_id, connection_id, - msg_flags, msg.ptr, msg.len, msg_vid, - msg_subtype, dst_imv_id); - } - else if (this->send_message) - { - msg_type = (msg_vid << 8) | msg_subtype; - - result = this->send_message(this->id, connection_id, - msg.ptr, msg.len, msg_type); - } - else - { - result = TNC_RESULT_FATAL; - } - - /* clean up */ - error_msg->destroy(error_msg); - pa_msg->destroy(pa_msg); - return result; - case FAILED: - default: - pa_msg->destroy(pa_msg); - return TNC_RESULT_FATAL; - } - return TNC_RESULT_SUCCESS; + return this->id; } METHOD(imc_agent_t, reserve_additional_ids, TNC_Result, @@ -651,13 +527,13 @@ METHOD(imc_agent_t, destroy, void, * Described in header. */ imc_agent_t *imc_agent_create(const char *name, - pen_t vendor_id, u_int32_t subtype, + pen_type_t *supported_types, u_int32_t type_count, TNC_IMCID id, TNC_Version *actual_version) { private_imc_agent_t *this; /* initialize or increase the reference count */ - if (!libimcv_init()) + if (!libimcv_init(FALSE)) { return NULL; } @@ -669,22 +545,22 @@ imc_agent_t *imc_agent_create(const char *name, .delete_state = _delete_state, .change_state = _change_state, .get_state = _get_state, - .send_message = _send_message, - .receive_message = _receive_message, + .get_name = _get_name, + .get_id = _get_id, .reserve_additional_ids = _reserve_additional_ids, .count_additional_ids = _count_additional_ids, .create_id_enumerator = _create_id_enumerator, .destroy = _destroy, }, .name = name, - .vendor_id = vendor_id, - .subtype = subtype, + .supported_types = supported_types, + .type_count = type_count, .id = id, .additional_ids = linked_list_create(), .connections = linked_list_create(), .connection_lock = rwlock_create(RWLOCK_TYPE_DEFAULT), ); - + *actual_version = TNC_IFIMC_VERSION_1; DBG1(DBG_IMC, "IMC %u \"%s\" initialized", this->id, this->name); diff --git a/src/libimcv/imc/imc_agent.h b/src/libimcv/imc/imc_agent.h index d1fef4d8d..0a1638f47 100644 --- a/src/libimcv/imc/imc_agent.h +++ b/src/libimcv/imc/imc_agent.h @@ -1,5 +1,6 @@ /* - * Copyright (C) 2011 Andreas Steffen, HSR Hochschule fuer Technik Rapperswil + * Copyright (C) 2011-2012 Andreas Steffen + * HSR Hochschule fuer Technik Rapperswil * * This program is free software; you can redistribute it and/or modify it * under the terms of the GNU General Public License as published by the @@ -15,7 +16,7 @@ /** * * @defgroup imc_agent_t imc_agent - * @{ @ingroup imc_agent + * @{ @ingroup libimcv_imc */ #ifndef IMC_AGENT_H_ @@ -26,6 +27,7 @@ #include <tncifimc.h> #include <pen/pen.h> +#include <collections/linked_list.h> #include <library.h> @@ -49,6 +51,44 @@ struct imc_agent_t { TNC_RetryReason reason); /** + * Call when an IMC-IMC message is to be sent + * + * @param imc_id IMC ID assigned by TNCC + * @param connection_id network connection ID assigned by TNCC + * @param msg message to send + * @param msg_len message length in bytes + * @param msg_type message type + * @return TNC result code + */ + TNC_Result (*send_message)(TNC_IMCID imc_id, + TNC_ConnectionID connection_id, + TNC_BufferReference msg, + TNC_UInt32 msg_len, + TNC_MessageType msg_type); + + /** + * Call when an IMC-IMC message is to be sent with long message types + * + * @param imc_id IMC ID assigned by TNCC + * @param connection_id network connection ID assigned by TNCC + * @param msg_flags message flags + * @param msg message to send + * @param msg_len message length in bytes + * @param msg_vid message vendor ID + * @param msg_subtype message subtype + * @param dst_imc_id destination IMV ID + * @return TNC result code + */ + TNC_Result (*send_message_long)(TNC_IMCID imc_id, + TNC_ConnectionID connection_id, + TNC_UInt32 msg_flags, + TNC_BufferReference msg, + TNC_UInt32 msg_len, + TNC_VendorID msg_vid, + TNC_MessageSubtype msg_subtype, + TNC_UInt32 dst_imv_id); + + /** * Bind TNCC functions * * @param bind_function function offered by the TNCC @@ -98,39 +138,18 @@ struct imc_agent_t { TNC_ConnectionID connection_id, imc_state_t **state); /** - * Call when an PA-TNC message is to be sent + * Get IMC name * - * @param connection_id network connection ID assigned by TNCC - * @param excl exclusive flag - * @param src_imc_id IMC ID to be set as source - * @param dst_imv_id IMV ID to be set as destination - * @param msg message to send - * @return TNC result code + * return IMC name */ - TNC_Result (*send_message)(imc_agent_t *this, - TNC_ConnectionID connection_id, bool excl, - TNC_UInt32 src_imc_id, TNC_UInt32 dst_imv_id, - chunk_t msg); + const char* (*get_name)(imc_agent_t *this); /** - * Call when a PA-TNC message was received + * Get base IMC ID * - * @param state state for current connection - * @param msg received unparsed message - * @param msg_vid message vendorID of the received message - * @param msg_subtype message subtype of the received message - * @param src_imv_id source IMV ID - * @param dst_imc_id destination IMC ID - * @param pa_tnc_message parsed PA-TNC message or NULL if an error occurred - * @return TNC result code + * return base IMC ID */ - TNC_Result (*receive_message)(imc_agent_t *this, - imc_state_t *state, chunk_t msg, - TNC_VendorID msg_vid, - TNC_MessageSubtype msg_subtype, - TNC_UInt32 src_imv_id, - TNC_UInt32 dst_imc_id, - pa_tnc_msg_t **pa_tnc_msg); + TNC_IMCID (*get_id)(imc_agent_t *this); /** * Reserve additional IMC IDs from TNCC @@ -162,14 +181,14 @@ struct imc_agent_t { * Create an imc_agent_t object * * @param name name of the IMC - * @param vendor_id vendor ID of the IMC - * @param subtype message subtype of the IMC + * @param supported_types list of message types registered by the IMC + * @param type_count number of registered message types * @param id ID of the IMC as assigned by the TNCS * @param actual_version actual version of the IF-IMC API * */ imc_agent_t *imc_agent_create(const char *name, - pen_t vendor_id, u_int32_t subtype, + pen_type_t *supported_types, u_int32_t type_count, TNC_IMCID id, TNC_Version *actual_version); #endif /** IMC_AGENT_H_ @}*/ diff --git a/src/libimcv/imc/imc_msg.c b/src/libimcv/imc/imc_msg.c new file mode 100644 index 000000000..1fc3d3be5 --- /dev/null +++ b/src/libimcv/imc/imc_msg.c @@ -0,0 +1,463 @@ +/* + * Copyright (C) 2012 Andreas Steffen + * HSR Hochschule fuer Technik Rapperswil + * + * This program is free software; you can redistribute it and/or modify it + * under the terms of the GNU General Public License as published by the + * Free Software Foundation; either version 2 of the License, or (at your + * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>. + * + * This program is distributed in the hope that it will be useful, but + * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY + * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License + * for more details. + */ + +#include "imc_msg.h" + +#include "ietf/ietf_attr.h" +#include "ietf/ietf_attr_assess_result.h" +#include "ietf/ietf_attr_remediation_instr.h" + +#include <tncif_names.h> + +#include <pen/pen.h> +#include <collections/linked_list.h> +#include <utils/debug.h> + +typedef struct private_imc_msg_t private_imc_msg_t; + +/** + * Private data of a imc_msg_t object. + * + */ +struct private_imc_msg_t { + + /** + * Public imc_msg_t interface. + */ + imc_msg_t public; + + /** + * Connection ID + */ + TNC_ConnectionID connection_id; + + /** + * source ID + */ + TNC_UInt32 src_id; + + /** + * destination ID + */ + TNC_UInt32 dst_id; + + /** + * PA-TNC message type + */ + pen_type_t msg_type; + + /** + * List of PA-TNC attributes to be sent + */ + linked_list_t *attr_list; + + /** + * PA-TNC message + */ + pa_tnc_msg_t *pa_msg; + + /** + * Assigned IMC agent + */ + imc_agent_t *agent; + + /** + * Assigned IMC state + */ + imc_state_t *state; +}; + +METHOD(imc_msg_t, get_src_id, TNC_UInt32, + private_imc_msg_t *this) +{ + return this->src_id; +} + +METHOD(imc_msg_t, get_dst_id, TNC_UInt32, + private_imc_msg_t *this) +{ + return this->dst_id; +} + +METHOD(imc_msg_t, get_msg_type, pen_type_t, + private_imc_msg_t *this) +{ + return this->msg_type; +} + +METHOD(imc_msg_t, send_, TNC_Result, + private_imc_msg_t *this, bool excl) +{ + pa_tnc_msg_t *pa_tnc_msg; + pa_tnc_attr_t *attr; + TNC_UInt32 msg_flags; + TNC_MessageType msg_type; + bool attr_added; + chunk_t msg; + enumerator_t *enumerator; + TNC_Result result = TNC_RESULT_SUCCESS; + + while (this->attr_list->get_count(this->attr_list)) + { + pa_tnc_msg = pa_tnc_msg_create(this->state->get_max_msg_len(this->state)); + attr_added = FALSE; + + enumerator = this->attr_list->create_enumerator(this->attr_list); + while (enumerator->enumerate(enumerator, &attr)) + { + if (pa_tnc_msg->add_attribute(pa_tnc_msg, attr)) + { + attr_added = TRUE; + } + else + { + if (attr_added) + { + break; + } + else + { + DBG1(DBG_IMC, "PA-TNC attribute too large to send, deleted"); + attr->destroy(attr); + } + } + this->attr_list->remove_at(this->attr_list, enumerator); + } + enumerator->destroy(enumerator); + + /* build and send the PA-TNC message via the IF-IMC interface */ + if (!pa_tnc_msg->build(pa_tnc_msg)) + { + pa_tnc_msg->destroy(pa_tnc_msg); + return TNC_RESULT_FATAL; + } + msg = pa_tnc_msg->get_encoding(pa_tnc_msg); + DBG3(DBG_IMC, "created PA-TNC message: %B", &msg); + + if (this->state->has_long(this->state) && this->agent->send_message_long) + { + excl = excl && this->state->has_excl(this->state) && + this->dst_id != TNC_IMVID_ANY; + msg_flags = excl ? TNC_MESSAGE_FLAGS_EXCLUSIVE : 0; + result = this->agent->send_message_long(this->src_id, + this->connection_id, msg_flags, msg.ptr, msg.len, + this->msg_type.vendor_id, this->msg_type.type, + this->dst_id); + } + else if (this->agent->send_message) + { + msg_type = (this->msg_type.vendor_id << 8) | + (this->msg_type.type & 0x000000ff); + result = this->agent->send_message(this->src_id, this->connection_id, + msg.ptr, msg.len, msg_type); + } + + pa_tnc_msg->destroy(pa_tnc_msg); + + if (result != TNC_RESULT_SUCCESS) + { + break; + } + } + return result; +} + +/** + * Print a clearly visible assessment header to the log + */ +static void print_assessment_header(const char *name, TNC_UInt32 id, bool *first) +{ + if (*first) + { + DBG1(DBG_IMC, "***** assessment of IMC %u \"%s\" *****", id, name); + *first = FALSE; + } +} + +/** + * Print a clearly visible assessment trailer to the log + */ +static void print_assessment_trailer(bool first) +{ + if (!first) + { + DBG1(DBG_IMC, "***** end of assessment *****"); + } +} + +METHOD(imc_msg_t, receive, TNC_Result, + private_imc_msg_t *this, bool *fatal_error) +{ + TNC_UInt32 target_imc_id; + enumerator_t *enumerator; + pa_tnc_attr_t *attr; + pen_type_t attr_type; + chunk_t msg; + bool first = TRUE; + + if (this->state->has_long(this->state)) + { + if (this->dst_id != TNC_IMCID_ANY) + { + DBG2(DBG_IMC, "IMC %u \"%s\" received message for Connection ID %u " + "from IMV %u to IMC %u", + this->agent->get_id(this->agent), + this->agent->get_name(this->agent), + this->connection_id, this->src_id, this->dst_id); + } + else + { + DBG2(DBG_IMC, "IMC %u \"%s\" received message for Connection ID %u " + "from IMV %u", this->agent->get_id(this->agent), + this->agent->get_name(this->agent), + this->connection_id, this->src_id); + } + } + else + { + DBG2(DBG_IMC, "IMC %u \"%s\" received message for Connection ID %u", + this->agent->get_id(this->agent), + this->agent->get_name(this->agent), + this->connection_id); + } + msg = this->pa_msg->get_encoding(this->pa_msg); + DBG3(DBG_IMC, "%B", &msg); + + switch (this->pa_msg->process(this->pa_msg)) + { + case SUCCESS: + break; + case VERIFY_ERROR: + { + imc_msg_t *error_msg; + TNC_Result result; + + error_msg = imc_msg_create_as_reply(&this->public); + + /* extract and copy by reference all error attributes */ + enumerator = this->pa_msg->create_error_enumerator(this->pa_msg); + while (enumerator->enumerate(enumerator, &attr)) + { + error_msg->add_attribute(error_msg, attr->get_ref(attr)); + } + enumerator->destroy(enumerator); + + /* + * send the PA-TNC message containing all error attributes + * with the excl flag set + */ + result = error_msg->send(error_msg, TRUE); + error_msg->destroy(error_msg); + return result; + } + case FAILED: + default: + return TNC_RESULT_FATAL; + } + + /* determine target IMC ID */ + target_imc_id = (this->dst_id != TNC_IMCID_ANY) ? + this->dst_id : this->agent->get_id(this->agent); + + /* preprocess any received IETF standard error attributes */ + *fatal_error = this->pa_msg->process_ietf_std_errors(this->pa_msg); + + /* preprocess any received IETF assessment result attribute */ + enumerator = this->pa_msg->create_attribute_enumerator(this->pa_msg); + while (enumerator->enumerate(enumerator, &attr)) + { + attr_type = attr->get_type(attr); + + if (attr_type.vendor_id != PEN_IETF) + { + continue; + } + if (attr_type.type == IETF_ATTR_ASSESSMENT_RESULT) + { + ietf_attr_assess_result_t *attr_cast; + TNC_IMV_Evaluation_Result result; + + attr_cast = (ietf_attr_assess_result_t*)attr; + result = attr_cast->get_result(attr_cast); + this->state->set_result(this->state, target_imc_id, result); + + print_assessment_header(this->agent->get_name(this->agent), + target_imc_id, &first); + DBG1(DBG_IMC, "assessment result is '%N'", + TNC_IMV_Evaluation_Result_names, result); + } + else if (attr_type.type == IETF_ATTR_REMEDIATION_INSTRUCTIONS) + { + ietf_attr_remediation_instr_t *attr_cast; + pen_type_t parameters_type; + chunk_t parameters, string, lang_code; + + attr_cast = (ietf_attr_remediation_instr_t*)attr; + parameters_type = attr_cast->get_parameters_type(attr_cast); + parameters = attr_cast->get_parameters(attr_cast); + + print_assessment_header(this->agent->get_name(this->agent), + target_imc_id, &first); + if (parameters_type.vendor_id == PEN_IETF) + { + switch (parameters_type.type) + { + case IETF_REMEDIATION_PARAMETERS_URI: + DBG1(DBG_IMC, "remediation uri: %.*s", + parameters.len, parameters.ptr); + break; + case IETF_REMEDIATION_PARAMETERS_STRING: + string = attr_cast->get_string(attr_cast, &lang_code); + DBG1(DBG_IMC, "remediation string: [%.*s]\n%.*s", + lang_code.len, lang_code.ptr, + string.len, string.ptr); + break; + default: + DBG1(DBG_IMC, "remediation parameters: %B", ¶meters); + } + } + else + { + DBG1(DBG_IMC, "remediation parameters: %B", ¶meters); + } + } + } + enumerator->destroy(enumerator); + + print_assessment_trailer(first); + + return TNC_RESULT_SUCCESS; +} + +METHOD(imc_msg_t, add_attribute, void, + private_imc_msg_t *this, pa_tnc_attr_t *attr) +{ + this->attr_list->insert_last(this->attr_list, attr); +} + +METHOD(imc_msg_t, create_attribute_enumerator, enumerator_t*, + private_imc_msg_t *this) +{ + return this->pa_msg->create_attribute_enumerator(this->pa_msg); +} + +METHOD(imc_msg_t, get_encoding, chunk_t, + private_imc_msg_t *this) +{ + if (this->pa_msg) + { + return this->pa_msg->get_encoding(this->pa_msg); + } + return chunk_empty; +} + +METHOD(imc_msg_t, destroy, void, + private_imc_msg_t *this) +{ + this->attr_list->destroy_offset(this->attr_list, + offsetof(pa_tnc_attr_t, destroy)); + DESTROY_IF(this->pa_msg); + free(this); +} + +/** + * See header + */ +imc_msg_t *imc_msg_create(imc_agent_t *agent, imc_state_t *state, + TNC_ConnectionID connection_id, + TNC_UInt32 src_id, TNC_UInt32 dst_id, + pen_type_t msg_type) +{ + private_imc_msg_t *this; + + INIT(this, + .public = { + .get_src_id = _get_src_id, + .get_dst_id = _get_dst_id, + .get_msg_type = _get_msg_type, + .send = _send_, + .receive = _receive, + .add_attribute = _add_attribute, + .create_attribute_enumerator = _create_attribute_enumerator, + .get_encoding = _get_encoding, + .destroy = _destroy, + }, + .connection_id = connection_id, + .src_id = src_id, + .dst_id = dst_id, + .msg_type = msg_type, + .attr_list = linked_list_create(), + .agent = agent, + .state = state, + ); + + return &this->public; +} + +/** + * See header + */ +imc_msg_t* imc_msg_create_as_reply(imc_msg_t *msg) +{ + private_imc_msg_t *in; + TNC_UInt32 src_id; + + in = (private_imc_msg_t*)msg; + src_id = (in->dst_id != TNC_IMCID_ANY) ? + in->dst_id : in->agent->get_id(in->agent); + + return imc_msg_create(in->agent, in->state, in->connection_id, src_id, + in->src_id, in->msg_type); +} + +/** + * See header + */ +imc_msg_t *imc_msg_create_from_data(imc_agent_t *agent, imc_state_t *state, + TNC_ConnectionID connection_id, + TNC_MessageType msg_type, + chunk_t msg) +{ + TNC_VendorID msg_vid; + TNC_MessageSubtype msg_subtype; + + msg_vid = msg_type >> 8; + msg_subtype = msg_type & TNC_SUBTYPE_ANY; + + return imc_msg_create_from_long_data(agent, state, connection_id, + TNC_IMVID_ANY, agent->get_id(agent), + msg_vid, msg_subtype, msg); +} + +/** + * See header + */ +imc_msg_t *imc_msg_create_from_long_data(imc_agent_t *agent, imc_state_t *state, + TNC_ConnectionID connection_id, + TNC_UInt32 src_id, + TNC_UInt32 dst_id, + TNC_VendorID msg_vid, + TNC_MessageSubtype msg_subtype, + chunk_t msg) +{ + private_imc_msg_t *this; + + this = (private_imc_msg_t*)imc_msg_create(agent, state, + connection_id, src_id, dst_id, + pen_type_create(msg_vid, msg_subtype)); + this->pa_msg = pa_tnc_msg_create_from_data(msg); + + return &this->public; +} diff --git a/src/libimcv/imc/imc_msg.h b/src/libimcv/imc/imc_msg.h new file mode 100644 index 000000000..588225dbe --- /dev/null +++ b/src/libimcv/imc/imc_msg.h @@ -0,0 +1,155 @@ +/* + * Copyright (C) 2012 Andreas Steffen + * HSR Hochschule fuer Technik Rapperswil + * + * This program is free software; you can redistribute it and/or modify it + * under the terms of the GNU General Public License as published by the + * Free Software Foundation; either version 2 of the License, or (at your + * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>. + * + * This program is distributed in the hope that it will be useful, but + * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY + * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License + * for more details. + */ + +/** + * @defgroup imc_msg imc_msg + * @{ @ingroup libimcv_imc + */ + +#ifndef IMC_MSG_H_ +#define IMC_MSG_H_ + +#include <imc/imc_agent.h> + +typedef struct imc_msg_t imc_msg_t; + +#include <library.h> + +/** + * Interface for a PA-TNC message handled by an IMC. + * + */ +struct imc_msg_t { + + /** + * Get source ID of PA-TNC message + * + * @return src ID + */ + TNC_UInt32 (*get_src_id)(imc_msg_t *this); + + /** + * Get destination ID of PA-TNC message + * + * @return destination ID + */ + TNC_UInt32 (*get_dst_id)(imc_msg_t *this); + + /** + * Get the PA-TNC message type. + * + * @return message type + */ + pen_type_t (*get_msg_type)(imc_msg_t *this); + + /** + * Sends one or multiple PA-TNC messages + * + * @param excl set the excl message flag if supported + * @return TNC result code + */ + TNC_Result (*send)(imc_msg_t *this, bool excl); + + /** + * Processes a received PA-TNC message + * + * @param fatal_error TRUE if IMV sent a fatal error message + * @return TNC result code + */ + TNC_Result (*receive)(imc_msg_t *this, bool *fatal_error); + + /** + * Add a PA-TNC attribute to the send queue + * + * @param attr PA-TNC attribute to be added + */ + void (*add_attribute)(imc_msg_t *this, pa_tnc_attr_t *attr); + + /** + * Enumerator over PA-TNC attributes contained in the PA-TNC message + * + * @return PA-TNC attribute enumerator + */ + enumerator_t* (*create_attribute_enumerator)(imc_msg_t *this); + + /** + * Get the encoding of the IMC message. + * + * @return message encoding, internal data + */ + chunk_t (*get_encoding)(imc_msg_t *this); + + /** + * Destroys a imc_msg_t object. + */ + void (*destroy)(imc_msg_t *this); +}; + +/** + * Create a wrapper for an outbound message + * + * @param agent IMC agent responsible for the message + * @param state IMC state for the given connection ID + * @param connection_id connection ID + * @param src_id source IMC ID + * @param dst_id destination IMV ID + * @param msg_type PA-TNC message type + */ +imc_msg_t* imc_msg_create(imc_agent_t *agent, imc_state_t *state, + TNC_ConnectionID connection_id, + TNC_UInt32 src_id, TNC_UInt32 dst_id, + pen_type_t msg_type); + +/** + * Create a wrapper for an outbound message based on a received message + * + * @param msg received message the reply is based on + */ +imc_msg_t* imc_msg_create_as_reply(imc_msg_t *msg); + +/** + * Create a wrapper around message data received via the legacy IF-IMC interface + * + * @param agent IMC agent responsible for the message + * @param state IMC state for the given connection ID + * @param connection_id connection ID + * @param msg_type PA-TNC message type + * @param msg received PA-TNC message blob + */ +imc_msg_t* imc_msg_create_from_data(imc_agent_t *agent, imc_state_t *state, + TNC_ConnectionID connection_id, + TNC_MessageType msg_type, + chunk_t msg); + +/** + * Create a wrapper around message data received via the long IF-IMC interface + * + * @param agent IMC agent responsible for the message + * @param state IMC state for the given connection ID + * @param connection_id connection ID + * @param src_id source IMV ID + * @param dst_id destination IMC ID + * @param msg_vid PA-TNC message vendor ID + * @param msg_subtype PA-TNC subtype + * @param msg received PA-TNC message blob + */ +imc_msg_t* imc_msg_create_from_long_data(imc_agent_t *agent, imc_state_t *state, + TNC_ConnectionID connection_id, + TNC_UInt32 src_id, TNC_UInt32 dst_id, + TNC_VendorID msg_vid, + TNC_MessageSubtype msg_subtype, + chunk_t msg); + +#endif /** IMC_MSG_H_ @}*/ diff --git a/src/libimcv/imc/imc_state.h b/src/libimcv/imc/imc_state.h index f1b0358c9..7e763fbe1 100644 --- a/src/libimcv/imc/imc_state.h +++ b/src/libimcv/imc/imc_state.h @@ -1,5 +1,6 @@ /* - * Copyright (C) 2011 Andreas Steffen, HSR Hochschule fuer Technik Rapperswil + * Copyright (C) 2011-2012 Andreas Steffen + * HSR Hochschule fuer Technik Rapperswil * * This program is free software; you can redistribute it and/or modify it * under the terms of the GNU General Public License as published by the @@ -15,13 +16,15 @@ /** * * @defgroup imc_state_t imc_state - * @{ @ingroup imc_state + * @{ @ingroup libimcv_imc */ #ifndef IMC_STATE_H_ #define IMC_STATE_H_ #include <tncif.h> +#include <tncifimv.h> +#include <tncifimc.h> #include <library.h> @@ -33,8 +36,7 @@ typedef struct imc_state_t imc_state_t; struct imc_state_t { /** - * Get the TNCS connection I -D attached to the state + * Get the TNCS connection ID attached to the state * * @return TNCS connection ID of the state */ @@ -64,6 +66,20 @@ D attached to the state void (*set_flags)(imc_state_t *this, bool has_long, bool has_excl); /** + * Set the maximum size of a PA-TNC message for this TNCCS connection + * + * @param max_msg_len maximum size of a PA-TNC message + */ + void (*set_max_msg_len)(imc_state_t *this, u_int32_t max_msg_len); + + /** + * Get the maximum size of a PA-TNC message for this TNCCS connection + * + * @return maximum size of a PA-TNC message + */ + u_int32_t (*get_max_msg_len)(imc_state_t *this); + + /** * Change the connection state * * @param new_state new connection state @@ -71,6 +87,25 @@ D attached to the state void (*change_state)(imc_state_t *this, TNC_ConnectionState new_state); /** + * Set the Assessment/Evaluation Result + * + * @param id IMC ID + * @param result Assessment/Evaluation Result + */ + void (*set_result)(imc_state_t *this, TNC_IMCID id, + TNC_IMV_Evaluation_Result result); + + /** + * Get the Assessment/Evaluation Result + * + * @param id IMC ID + * @param result Assessment/Evaluation Result + * @return TRUE if result is known + */ + bool (*get_result)(imc_state_t *this, TNC_IMCID id, + TNC_IMV_Evaluation_Result *result); + + /** * Destroys an imc_state_t object */ void (*destroy)(imc_state_t *this); diff --git a/src/libimcv/imcv.c b/src/libimcv/imcv.c index a8c0af47b..b5862daee 100644 --- a/src/libimcv/imcv.c +++ b/src/libimcv/imcv.c @@ -16,13 +16,15 @@ #include "ietf/ietf_attr.h" #include "ita/ita_attr.h" -#include <utils.h> -#include <debug.h> +#include <utils/debug.h> +#include <utils/utils.h> #include <pen/pen.h> #include <syslog.h> -#define IMCV_DEBUG_LEVEL 1 +#define IMCV_DEBUG_LEVEL 1 +#define IMCV_DEFAULT_POLICY_SCRIPT "ipsec _imv_policy" + /** * PA-TNC attribute manager @@ -30,6 +32,11 @@ pa_tnc_attr_manager_t *imcv_pa_tnc_attributes; /** + * Global IMV database + */ +imv_database_t *imcv_db; + +/** * Reference count for libimcv */ static refcount_t libimcv_ref = 0; @@ -88,7 +95,7 @@ static void imcv_dbg(debug_t group, level_t level, char *fmt, ...) /** * Described in header. */ -bool libimcv_init(void) +bool libimcv_init(bool is_imv) { /* initialize libstrongswan library only once */ if (lib) @@ -107,33 +114,49 @@ bool libimcv_init(void) return FALSE; } - if (!lib->plugins->load(lib->plugins, NULL, - "sha1 sha2 random gmp pubkey x509")) - { - library_deinit(); - return FALSE; - } - /* set the debug level and stderr output */ imcv_debug_level = lib->settings->get_int(lib->settings, "libimcv.debug_level", IMCV_DEBUG_LEVEL); imcv_stderr_quiet = lib->settings->get_int(lib->settings, "libimcv.stderr_quiet", FALSE); - + /* activate the imcv debugging hook */ dbg = imcv_dbg; openlog("imcv", 0, LOG_DAEMON); + + if (!lib->plugins->load(lib->plugins, + lib->settings->get_str(lib->settings, "libimcv.load", + "random nonce gmp pubkey x509"))) + { + library_deinit(); + return FALSE; + } } ref_get(&libstrongswan_ref); if (libimcv_ref == 0) { + char *uri, *script; + /* initialize the PA-TNC attribute manager */ imcv_pa_tnc_attributes = pa_tnc_attr_manager_create(); imcv_pa_tnc_attributes->add_vendor(imcv_pa_tnc_attributes, PEN_IETF, ietf_attr_create_from_data, ietf_attr_names); imcv_pa_tnc_attributes->add_vendor(imcv_pa_tnc_attributes, PEN_ITA, ita_attr_create_from_data, ita_attr_names); + + /* attach global IMV database */ + if (is_imv) + { + uri = lib->settings->get_str(lib->settings, + "libimcv.database", NULL); + script = lib->settings->get_str(lib->settings, + "libimcv.policy_script", IMCV_DEFAULT_POLICY_SCRIPT); + if (uri) + { + imcv_db = imv_database_create(uri, script); + } + } DBG1(DBG_LIB, "libimcv initialized"); } ref_get(&libimcv_ref); @@ -151,11 +174,13 @@ void libimcv_deinit(void) imcv_pa_tnc_attributes->remove_vendor(imcv_pa_tnc_attributes, PEN_IETF); imcv_pa_tnc_attributes->remove_vendor(imcv_pa_tnc_attributes, PEN_ITA); DESTROY_IF(imcv_pa_tnc_attributes); + imcv_pa_tnc_attributes = NULL; + DESTROY_IF(imcv_db); DBG1(DBG_LIB, "libimcv terminated"); } if (ref_put(&libstrongswan_ref)) { - library_deinit(); + library_deinit(); } } diff --git a/src/libimcv/imcv.h b/src/libimcv/imcv.h index a1a5a5f43..10c66e65a 100644 --- a/src/libimcv/imcv.h +++ b/src/libimcv/imcv.h @@ -15,7 +15,16 @@ /** * @defgroup libimcv libimcv * - * @defgroup iplugins plugins + * @defgroup libimcv_imc imc + * @ingroup libimcv + * + * @defgroup libimcv_imv imv + * @ingroup libimcv + * + * @defgroup pa_tnc pa_tnc + * @ingroup libimcv + * + * @defgroup libimcv_plugins plugins * @ingroup libimcv * * @addtogroup libimcv @@ -26,15 +35,17 @@ #define IMCV_H_ #include "pa_tnc/pa_tnc_attr_manager.h" +#include "imv/imv_database.h" #include <library.h> /** * Initialize libimcv. * + * @param is_imv TRUE if called by IMV, FALSE if by IMC * @return FALSE if initialization failed */ -bool libimcv_init(void); +bool libimcv_init(bool is_imv); /** * Deinitialize libimcv. @@ -46,4 +57,9 @@ void libimcv_deinit(void); */ extern pa_tnc_attr_manager_t* imcv_pa_tnc_attributes; +/** + * Global IMV database object + */ +extern imv_database_t* imcv_db; + #endif /** IMCV_H_ @}*/ diff --git a/src/libimcv/imv/_imv_policy b/src/libimcv/imv/_imv_policy new file mode 100755 index 000000000..68a963c27 --- /dev/null +++ b/src/libimcv/imv/_imv_policy @@ -0,0 +1,39 @@ +#! /bin/sh +# default TNC policy command script +# +# Copyright 2013 Andreas Steffen +# HSR Hochschule fuer Technik Rapperswil +# +# This program is free software; you can redistribute it and/or modify it +# under the terms of the GNU General Public License as published by the +# Free Software Foundation; either version 2 of the License, or (at your +# option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>. +# +# This program is distributed in the hope that it will be useful, but +# WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY +# or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License +# for more details. +# +# CAUTION: Installing a new version of strongSwan will install a new +# copy of this script, wiping out any custom changes you make. If +# you need changes, make a copy of this under another name, and customize +# that, and use the "libimcv.policy_script = " option in strongswan.conf +# to make strongSwan use yours instead of this default one. + +# Environment variables that this script gets +# +# TNC_SESSION_ID +# unique session ID used as a reference by the policy +# manager. +# +case "$1" in +start) + echo "start session $TNC_SESSION_ID" + ;; +stop) + echo "stop session $TNC_SESSION_ID" + ;; +*) echo "$0: unknown command '$1'" + exit 1 + ;; +esac diff --git a/src/libimcv/imv/data.sql b/src/libimcv/imv/data.sql new file mode 100644 index 000000000..35fd65753 --- /dev/null +++ b/src/libimcv/imv/data.sql @@ -0,0 +1,846 @@ +/* Products */ + +INSERT INTO products ( /* 1 */ + name +) VALUES ( + 'Debian 6.0 i686' +); + +INSERT INTO products ( /* 2 */ + name +) VALUES ( + 'Debian 6.0 x86_64' +); + +INSERT INTO products ( /* 3 */ + name +) VALUES ( + 'Debian 7.0 i686' +); + +INSERT INTO products ( /* 4 */ + name +) VALUES ( + 'Debian 7.0 x86_64' +); + +INSERT INTO products ( /* 5 */ + name +) VALUES ( + 'Debian 8.0 i686' +); + +INSERT INTO products ( /* 6 */ + name +) VALUES ( + 'Debian 8.0 x86_64' +); + +INSERT INTO products ( /* 7 */ + name +) VALUES ( + 'Ubuntu 10.04 i686' +); + +INSERT INTO products ( /* 8 */ + name +) VALUES ( + 'Ubuntu 10.04 x86_64' +); + +INSERT INTO products ( /* 9 */ + name +) VALUES ( + 'Ubuntu 10.10 i686' +); + +INSERT INTO products ( /* 10 */ + name +) VALUES ( + 'Ubuntu 10.10 x86_64' +); + +INSERT INTO products ( /* 11 */ + name +) VALUES ( + 'Ubuntu 11.04 i686' +); + +INSERT INTO products ( /* 12 */ + name +) VALUES ( + 'Ubuntu 11.04 x86_64' +); + +INSERT INTO products ( /* 13 */ + name +) VALUES ( + 'Ubuntu 11.10 i686' +); + +INSERT INTO products ( /* 14 */ + name +) VALUES ( + 'Ubuntu 11.10 x86_64' +); + +INSERT INTO products ( /* 15 */ + name +) VALUES ( + 'Ubuntu 12.04 i686' +); + +INSERT INTO products ( /* 16 */ + name +) VALUES ( + 'Ubuntu 12.04 x86_64' +); + +INSERT INTO products ( /* 17 */ + name +) VALUES ( + 'Ubuntu 12.10 i686' +); + +INSERT INTO products ( /* 18 */ + name +) VALUES ( + 'Ubuntu 12.10 x86_64' +); + +INSERT INTO products ( /* 19 */ + name +) VALUES ( + 'Ubuntu 13.04 i686' +); + +INSERT INTO products ( /* 20 */ + name +) VALUES ( + 'Ubuntu 13.04 x86_64' +); + +INSERT INTO products ( /* 21 */ + name +) VALUES ( + 'Android 4.1.1' +); + +INSERT INTO products ( /* 22 */ + name +) VALUES ( + 'Android 4.2.1' +); + +/* Directories */ + +INSERT INTO directories ( /* 1 */ + path +) VALUES ( + '/bin' +); + +INSERT INTO directories ( /* 2 */ + path +) VALUES ( + '/etc' +); + +INSERT INTO directories ( /* 3 */ + path +) VALUES ( + '/lib' +); + +INSERT INTO directories ( /* 4 */ + path +) VALUES ( + '/lib/i386-linux-gnu' +); + +INSERT INTO directories ( /* 5 */ + path +) VALUES ( + '/lib/x86_64-linux-gnu' +); + +INSERT INTO directories ( /* 6 */ + path +) VALUES ( + '/lib/xtables' +); + +INSERT INTO directories ( /* 7 */ + path +) VALUES ( + '/sbin' +); + +INSERT INTO directories ( /* 8 */ + path +) VALUES ( + '/usr/bin' +); + +INSERT INTO directories ( /* 9 */ + path +) VALUES ( + '/usr/lib' +); + +INSERT INTO directories ( /* 10 */ + path +) VALUES ( + '/usr/lib/i386-linux-gnu' +); + +INSERT INTO directories ( /* 11 */ + path +) VALUES ( + '/usr/lib/x86_64-linux-gnu' +); + +INSERT INTO directories ( /* 12 */ + path +) VALUES ( + '/usr/sbin' +); + +INSERT INTO directories ( /* 13 */ + path +) VALUES ( + '/system/bin' +); + +INSERT INTO directories ( /* 14 */ + path +) VALUES ( + '/system/lib' +); + +/* Files */ + +INSERT INTO files ( /* 1 */ + name, dir +) VALUES ( + 'libcrypto.so.1.0.0', 5 +); + +INSERT INTO files ( /* 2 */ + name, dir +) VALUES ( + 'libcrypto.so.1.0.0', 11 +); + +INSERT INTO files ( /* 3 */ + name, dir +) VALUES ( + 'libssl.so.1.0.0', 5 +); + +INSERT INTO files ( /* 4 */ + name, dir +) VALUES ( + 'libssl.so.1.0.0', 11 +); + +INSERT INTO files ( /* 5 */ + name, dir +) VALUES ( + 'openssl', 8 +); + +INSERT INTO files ( /* 6 */ + name, dir +) VALUES ( + 'tnc_config', 2 +); + +/* Algorithms */ + +INSERT INTO algorithms ( + id, name +) VALUES ( + 65536, 'SHA1-IMA' +); + +INSERT INTO algorithms ( + id, name +) VALUES ( + 32768, 'SHA1' +); + +INSERT INTO algorithms ( + id, name +) VALUES ( + 16384, 'SHA256' +); + +INSERT INTO algorithms ( + id, name +) VALUES ( + 8192, 'SHA384' +); + +/* File Hashes */ + +INSERT INTO file_hashes ( + product, file, algo, hash +) VALUES ( + 4, 2, 32768, X'6c6f8e12f6cbfba612e780374c4cdcd40f20968a' +); + +INSERT INTO file_hashes ( + product, file, algo, hash +) VALUES ( + 4, 2, 16384, X'dbcecd19d59310183cf5c31ddee29e8d7bec64d3f9583aad074330a1b3024b07' +); + +INSERT INTO file_hashes ( + product, file, algo, hash +) VALUES ( + 4, 2, 8192, X'197c5385e5853003188833d4f991136c1b0875fa416a60b1159f64e57e457b3184762c884a802a2bda194c058e3bd953' +); + +INSERT INTO file_hashes ( + product, file, algo, hash +) VALUES ( + 4, 4, 32768, X'3ad204f99eb7262efab79cfca02628870ea76361' +); + +INSERT INTO file_hashes ( + product, file, algo, hash +) VALUES ( + 4, 4, 16384, X'3a2170aad92fdd58b55e0e199822bc873cf587b2d1eb1ed7ed8dcea97ae86376' +); + +INSERT INTO file_hashes ( + product, file, algo, hash +) VALUES ( + 4, 4, 8192, X'f778076baa876b5e4b502494a3db081fb09dd870dee6991d54104a74b7e009c58fe261db5ffd13c11e08ef0cefcfa59f' +); + +INSERT INTO file_hashes ( + product, file, algo, hash +) VALUES ( + 4, 5, 32768, X'ecd9c7076cc0572724c7a67db7f19c2831e0445f' +); + +INSERT INTO file_hashes ( + product, file, algo, hash +) VALUES ( + 4, 5, 16384, X'28f3ea5afd34444c8232ea75003131e294a0c9b847de300e4b205d38c1a41305' +); + +INSERT INTO file_hashes ( + product, file, algo, hash +) VALUES ( + 4, 5, 8192, X'51921a8b9322f2d3f06d55002ff40a79da67e70cb563b2a50977642d603dfac2ccbb68b3d32a8bb350769b75d6254208' +); + +INSERT INTO file_hashes ( + product, file, algo, hash +) VALUES ( + 18, 1, 32768, X'd9309b9e45928239d7a7b18711e690792632cce4' +); + +INSERT INTO file_hashes ( + product, file, algo, hash +) VALUES ( + 18, 1, 16384, X'dbfa1856d278d8707c4989b30dd065b4bcd309908f0f2e6e66ff2aa83ff93f59' +); + +INSERT INTO file_hashes ( + product, file, algo, hash +) VALUES ( + 18, 1, 8192, X'fb8d027f03bb5ebb47741ed247eb9e174127b714d20229885feb37e0979aeb14a1b74020cded891d680441093625729c' +); + +INSERT INTO file_hashes ( + product, file, algo, hash +) VALUES ( + 18, 3, 32768, X'3715f2f94016a91fab5bbc503f0f1d43c5a9fc2b' +); + +INSERT INTO file_hashes ( + product, file, algo, hash +) VALUES ( + 18, 3, 16384, X'c03a5296b5decb87b01517f9927a8b2349dfb29ff9f5ba084f994c155ca5d4be' +); + +INSERT INTO file_hashes ( + product, file, algo, hash +) VALUES ( + 18, 3, 8192, X'b8bc345f56115235cc6091f61e312ce43ea54a5b99e7295002ae7b415fd35e06ec4c731ab70ad00d784bb53a318a2fa0' +); + +INSERT INTO file_hashes ( + product, file, algo, hash +) VALUES ( + 18, 5, 32768, X'e59602f4edf24c1b36199588886d06665d4adcd7' +); + +INSERT INTO file_hashes ( + product, file, algo, hash +) VALUES ( + 18, 5, 16384, X'090e1b77bda7fe665e498c6b5e09dbb7ddc5cfe57f213de48f4fb6736484f500' +); + +INSERT INTO file_hashes ( + product, file, algo, hash +) VALUES ( + 18, 5, 8192, X'7cbdb4612a13443dba910ecdef5161f2213e52c9b4a2eef14bcee5d287e9df931cd022e9e9715518ad9c9b6e3384a668' +); + +/* Packages */ + +INSERT INTO packages ( /* 1 */ + name +) VALUES ( + 'libssl-dev' +); + +INSERT INTO packages ( /* 2 */ + name +) VALUES ( + 'libssl1.0.0' +); + +INSERT INTO packages ( /* 3 */ + name +) VALUES ( + 'libssl1.0.0-dbg' +); + +INSERT INTO packages ( /* 4 */ + name +) VALUES ( + 'openssl' +); + +/* Versions */ + +INSERT INTO versions ( + package, product, release, time +) VALUES ( + 1, 4, '1.0.1e-2', 1366531494 +); + +INSERT INTO versions ( + package, product, release, time +) VALUES ( + 2, 4, '1.0.1e-2', 1366531494 +); + +INSERT INTO versions ( + package, product, release, time +) VALUES ( + 3, 4, '1.0.1e-2', 1366531494 +); + +INSERT INTO versions ( + package, product, release, time +) VALUES ( + 4, 4, '1.0.1e-2', 1366531494 +); + +/* Components */ + +INSERT INTO components ( + vendor_id, name, qualifier +) VALUES ( + 36906, 1, 33 /* ITA TGRUB */ +); + +INSERT INTO components ( + vendor_id, name, qualifier +) VALUES ( + 36906, 2, 33 /* ITA TBOOT */ +); + +INSERT INTO components ( + vendor_id, name, qualifier +) VALUES ( + 36906, 3, 33 /* ITA IMA - Trusted Platform */ +); + +INSERT INTO components ( + vendor_id, name, qualifier +) VALUES ( + 36906, 3, 34 /* ITA IMA - Operating System */ +); + +/* Groups */ + +INSERT INTO groups ( /* 1 */ + name +) VALUES ( + 'Default' +); + +INSERT INTO groups ( /* 2 */ + name, parent +) VALUES ( + 'Linux', 1 +); + +INSERT INTO groups ( /* 3 */ + name, parent +) VALUES ( + 'Android', 1 +); + +INSERT INTO groups ( /* 4 */ + name, parent +) VALUES ( + 'Debian i686', 2 +); + +INSERT INTO groups ( /* 5 */ + name, parent +) VALUES ( + 'Debian x86_64', 2 +); + +INSERT INTO groups ( /* 6 */ + name, parent +) VALUES ( + 'Ubuntu i686', 2 +); + +INSERT INTO groups ( /* 7 */ + name, parent +) VALUES ( + 'Ubuntu x86_64', 2 +); + +INSERT INTO groups ( /* 8 */ + name +) VALUES ( + 'Reference' +); + +INSERT INTO groups ( /* 9 */ + name, parent +) VALUES ( + 'Ref. Android', 8 +); + +INSERT INTO groups ( /* 10 */ + name, parent +) VALUES ( + 'Ref. Linux', 8 +); + +/* Default Product Groups */ + +INSERT INTO groups_product_defaults ( + group_id, product_id +) VALUES ( + 4, 1 +); + +INSERT INTO groups_product_defaults ( + group_id, product_id +) VALUES ( + 4, 3 +); + +INSERT INTO groups_product_defaults ( + group_id, product_id +) VALUES ( + 4, 5 +); + +INSERT INTO groups_product_defaults ( + group_id, product_id +) VALUES ( + 5, 2 +); + +INSERT INTO groups_product_defaults ( + group_id, product_id +) VALUES ( + 5, 4 +); + +INSERT INTO groups_product_defaults ( + group_id, product_id +) VALUES ( + 5, 6 +); + +INSERT INTO groups_product_defaults ( + group_id, product_id +) VALUES ( + 6, 7 +); + +INSERT INTO groups_product_defaults ( + group_id, product_id +) VALUES ( + 6, 9 +); + +INSERT INTO groups_product_defaults ( + group_id, product_id +) VALUES ( + 6, 11 +); + +INSERT INTO groups_product_defaults ( + group_id, product_id +) VALUES ( + 6, 13 +); + +INSERT INTO groups_product_defaults ( + group_id, product_id +) VALUES ( + 6, 15 +); + +INSERT INTO groups_product_defaults ( + group_id, product_id +) VALUES ( + 6, 17 +); + +INSERT INTO groups_product_defaults ( + group_id, product_id +) VALUES ( + 6, 19 +); + +INSERT INTO groups_product_defaults ( + group_id, product_id +) VALUES ( + 7, 8 +); + +INSERT INTO groups_product_defaults ( + group_id, product_id +) VALUES ( + 7, 10 +); + +INSERT INTO groups_product_defaults ( + group_id, product_id +) VALUES ( + 7, 12 +); + +INSERT INTO groups_product_defaults ( + group_id, product_id +) VALUES ( + 7, 14 +); + +INSERT INTO groups_product_defaults ( + group_id, product_id +) VALUES ( + 7, 16 +); + +INSERT INTO groups_product_defaults ( + group_id, product_id +) VALUES ( + 7, 18 +); + +INSERT INTO groups_product_defaults ( + group_id, product_id +) VALUES ( + 7, 20 +); + +INSERT INTO groups_product_defaults ( + group_id, product_id +) VALUES ( + 3, 21 +); + +INSERT INTO groups_product_defaults ( + group_id, product_id +) VALUES ( + 3, 22 +); + +/* Policies */ + +INSERT INTO policies ( /* 1 */ + type, name, rec_fail, rec_noresult +) VALUES ( + 1, 'Installed Packages', 2, 2 +); + +INSERT INTO policies ( /* 2 */ + type, name, rec_fail, rec_noresult +) VALUES ( + 2, 'Unknown Source', 2, 2 +); + +INSERT INTO policies ( /* 3 */ + type, name, rec_fail, rec_noresult +) VALUES ( + 3, 'IP Forwarding Enabled', 1, 1 +); + +INSERT INTO policies ( /* 4 */ + type, name, rec_fail, rec_noresult +) VALUES ( + 4, 'Default Factory Password Enabled', 1, 1 +); + +INSERT INTO policies ( /* 5 */ + type, name, file, rec_fail, rec_noresult +) VALUES ( + 6, 'Measure /lib/x86_64-linux-gnu/libcrypto.so.1.0.0', 1, 2, 2 +); + +INSERT INTO policies ( /* 6 */ + type, name, file, rec_fail, rec_noresult +) VALUES ( + 6, 'Measure /lib/x86_64-linux-gnu/libssl.so.1.0.0', 3, 2, 2 +); + +INSERT INTO policies ( /* 7 */ + type, name, file, rec_fail, rec_noresult +) VALUES ( + 6, 'Measure /usr/bin/openssl', 5, 2, 2 +); + +INSERT INTO policies ( /* 8 */ + type, name, rec_fail, rec_noresult +) VALUES ( + 11, 'No Open TCP Ports', 1, 1 +); + +INSERT INTO policies ( /* 9 */ + type, name, argument, rec_fail, rec_noresult +) VALUES ( + 13, 'Open UDP Ports', '500 4500 10000-65000', 1, 1 +); + +INSERT INTO policies ( /* 10 */ + type, name, file, rec_fail, rec_noresult +) VALUES ( + 7, 'Metadata of /etc/tnc_config', 6, 0, 0 +); + +INSERT INTO policies ( /* 11 */ + type, name, dir, rec_fail, rec_noresult +) VALUES ( + 8, 'Get /bin', 1, 0, 0 +); + +INSERT INTO policies ( /* 12 */ + type, name, file, rec_fail, rec_noresult +) VALUES ( + 6, 'Measure /usr/lib/x86_64-linux-gnu/libcrypto.so.1.0.0', 2, 2, 2 +); + +INSERT INTO policies ( /* 13 */ + type, name, file, rec_fail, rec_noresult +) VALUES ( + 6, 'Measure /usr/lib/x86_64-linux-gnu/libssl.so.1.0.0', 4, 2, 2 +); + +INSERT INTO policies ( /* 14 */ + type, name, dir, rec_fail, rec_noresult +) VALUES ( + 8, 'Get /system/bin', 13, 0, 0 +); + +INSERT INTO policies ( /* 15 */ + type, name, dir, rec_fail, rec_noresult +) VALUES ( + 8, 'Get /system/lib', 14, 0, 0 +); + +/* Enforcements */ + +INSERT INTO enforcements ( + policy, group_id, max_age +) VALUES ( + 1, 1, 86400 +); + +INSERT INTO enforcements ( + policy, group_id, max_age +) VALUES ( + 2, 3, 0 +); + +INSERT INTO enforcements ( + policy, group_id, max_age +) VALUES ( + 3, 2, 0 +); + +INSERT INTO enforcements ( + policy, group_id, max_age +) VALUES ( + 5, 7, 86400 +); + +INSERT INTO enforcements ( + policy, group_id, max_age +) VALUES ( + 6, 7, 86400 +); + +INSERT INTO enforcements ( + policy, group_id, max_age +) VALUES ( + 7, 2, 86400 +); + +INSERT INTO enforcements ( + policy, group_id, max_age +) VALUES ( + 8, 1, 60 +); + +INSERT INTO enforcements ( + policy, group_id, max_age +) VALUES ( + 9, 1, 60 +); + +INSERT INTO enforcements ( + policy, group_id, max_age +) VALUES ( + 10, 2, 60 +); + +INSERT INTO enforcements ( + policy, group_id, max_age +) VALUES ( + 11, 10, 86400 +); + +INSERT INTO enforcements ( + policy, group_id, max_age +) VALUES ( + 12, 5, 86400 +); + +INSERT INTO enforcements ( + policy, group_id, max_age +) VALUES ( + 13, 5, 86400 +); + +INSERT INTO enforcements ( + policy, group_id, max_age +) VALUES ( + 14, 9, 0 +); + +INSERT INTO enforcements ( + policy, group_id, max_age +) VALUES ( + 15, 9, 0 +); + diff --git a/src/libimcv/imv/imv_agent.c b/src/libimcv/imv/imv_agent.c index 56131c547..435c25a3c 100644 --- a/src/libimcv/imv/imv_agent.c +++ b/src/libimcv/imv/imv_agent.c @@ -1,5 +1,6 @@ /* - * Copyright (C) 2011 Andreas Steffen, HSR Hochschule fuer Technik Rapperswil + * Copyright (C) 2011-2013 Andreas Steffen + * HSR Hochschule fuer Technik Rapperswil * * This program is free software; you can redistribute it and/or modify it * under the terms of the GNU General Public License as published by the @@ -14,11 +15,16 @@ #include "imcv.h" #include "imv_agent.h" +#include "imv_session.h" + +#include "ietf/ietf_attr_assess_result.h" #include <tncif_names.h> +#include <tncif_identity.h> -#include <debug.h> -#include <utils/linked_list.h> +#include <utils/debug.h> +#include <collections/linked_list.h> +#include <bio/bio_reader.h> #include <threading/rwlock.h> typedef struct private_imv_agent_t private_imv_agent_t; @@ -39,14 +45,14 @@ struct private_imv_agent_t { const char *name; /** - * message vendor ID of IMV + * message types registered by IMV */ - TNC_VendorID vendor_id; + pen_type_t *supported_types; /** - * message subtype of IMV + * number of message types registered by IMV */ - TNC_MessageSubtype subtype; + u_int32_t type_count; /** * ID of IMV as assigned by TNCS @@ -95,44 +101,6 @@ struct private_imv_agent_t { TNC_UInt32 type_count); /** - * Call when an IMV-IMC message is to be sent - * - * @param imv_id IMV ID assigned by TNCS - * @param connection_id network connection ID assigned by TNCS - * @param msg message to send - * @param msg_len message length in bytes - * @param msg_type message type - * @return TNC result code - */ - TNC_Result (*send_message)(TNC_IMVID imv_id, - TNC_ConnectionID connection_id, - TNC_BufferReference msg, - TNC_UInt32 msg_len, - TNC_MessageType msg_type); - - /** - * Call when an IMV-IMC message is to be sent with long message types - * - * @param imv_id IMV ID assigned by TNCS - * @param connection_id network connection ID assigned by TNCS - * @param msg_flags message flags - * @param msg message to send - * @param msg_len message length in bytes - * @param msg_vid message vendor ID - * @param msg_subtype message subtype - * @param dst_imc_id destination IMC ID - * @return TNC result code - */ - TNC_Result (*send_message_long)(TNC_IMVID imv_id, - TNC_ConnectionID connection_id, - TNC_UInt32 msg_flags, - TNC_BufferReference msg, - TNC_UInt32 msg_len, - TNC_VendorID msg_vid, - TNC_MessageSubtype msg_subtype, - TNC_UInt32 dst_imc_id); - - /** * Deliver IMV Action Recommendation and IMV Evaluation Results to the TNCS * * @param imv_id IMV ID assigned by TNCS @@ -218,14 +186,14 @@ METHOD(imv_agent_t, bind_functions, TNC_Result, this->public.request_handshake_retry = NULL; } if (bind_function(this->id, "TNC_TNCS_SendMessage", - (void**)&this->send_message) != TNC_RESULT_SUCCESS) + (void**)&this->public.send_message) != TNC_RESULT_SUCCESS) { - this->send_message = NULL; + this->public.send_message = NULL; } if (bind_function(this->id, "TNC_TNCS_SendMessageLong", - (void**)&this->send_message_long) != TNC_RESULT_SUCCESS) + (void**)&this->public.send_message_long) != TNC_RESULT_SUCCESS) { - this->send_message_long = NULL; + this->public.send_message_long = NULL; } if (bind_function(this->id, "TNC_TNCS_ProvideRecommendation", (void**)&this->provide_recommendation) != TNC_RESULT_SUCCESS) @@ -247,22 +215,40 @@ METHOD(imv_agent_t, bind_functions, TNC_Result, { this->reserve_additional_id = NULL; } - DBG2(DBG_IMV, "IMV %u \"%s\" provided with bind function", - this->id, this->name); if (this->report_message_types_long) { - this->report_message_types_long(this->id, &this->vendor_id, - &this->subtype, 1); + TNC_VendorIDList vendor_id_list; + TNC_MessageSubtypeList subtype_list; + int i; + + vendor_id_list = malloc(this->type_count * sizeof(TNC_UInt32)); + subtype_list = malloc(this->type_count * sizeof(TNC_UInt32)); + + for (i = 0; i < this->type_count; i++) + { + vendor_id_list[i] = this->supported_types[i].vendor_id; + subtype_list[i] = this->supported_types[i].type; + } + this->report_message_types_long(this->id, vendor_id_list, subtype_list, + this->type_count); + free(vendor_id_list); + free(subtype_list); } - else if (this->report_message_types && - this->vendor_id <= TNC_VENDORID_ANY && - this->subtype <= TNC_SUBTYPE_ANY) + else if (this->report_message_types) { - TNC_MessageType type; + TNC_MessageTypeList type_list; + int i; + + type_list = malloc(this->type_count * sizeof(TNC_UInt32)); - type = (this->vendor_id << 8) | this->subtype; - this->report_message_types(this->id, &type, 1); + for (i = 0; i < this->type_count; i++) + { + type_list[i] = (this->supported_types[i].vendor_id << 8) | + (this->supported_types[i].type & 0xff); + } + this->report_message_types(this->id, type_list, this->type_count); + free(type_list); } return TNC_RESULT_SUCCESS; } @@ -299,6 +285,7 @@ static bool delete_connection(private_imv_agent_t *this, TNC_ConnectionID id) { enumerator_t *enumerator; imv_state_t *state; + imv_session_t *session; bool found = FALSE; this->connection_lock->write_lock(this->connection_lock); @@ -308,6 +295,11 @@ static bool delete_connection(private_imv_agent_t *this, TNC_ConnectionID id) if (id == state->get_connection_id(state)) { found = TRUE; + session = state->get_session(state); + if (session) + { + imcv_db->remove_session(imcv_db, session); + } state->destroy(state); this->connections->remove_at(this->connections, enumerator); break; @@ -351,12 +343,81 @@ static char* get_str_attribute(private_imv_agent_t *this, TNC_ConnectionID id, return NULL; } +/** + * Read an UInt32 attribute + */ +static u_int32_t get_uint_attribute(private_imv_agent_t *this, TNC_ConnectionID id, + TNC_AttributeID attribute_id) +{ + TNC_UInt32 len; + char buf[4]; + + if (this->get_attribute && + this->get_attribute(this->id, id, attribute_id, 4, buf, &len) == + TNC_RESULT_SUCCESS && len == 4) + { + return untoh32(buf); + } + return 0; + } + +/** + * Read a TNC identity attribute + */ +static linked_list_t* get_identity_attribute(private_imv_agent_t *this, + TNC_ConnectionID id, + TNC_AttributeID attribute_id) +{ + TNC_UInt32 len; + char buf[2048]; + u_int32_t count; + tncif_identity_t *tnc_id; + bio_reader_t *reader; + linked_list_t *list; + + list = linked_list_create(); + + if (!this->get_attribute || + this->get_attribute(this->id, id, attribute_id, sizeof(buf), buf, &len) + != TNC_RESULT_SUCCESS || len > sizeof(buf)) + { + return list; + } + + reader = bio_reader_create(chunk_create(buf, len)); + if (!reader->read_uint32(reader, &count)) + { + goto end; + } + while (count--) + { + tnc_id = tncif_identity_create_empty(); + if (!tnc_id->process(tnc_id, reader)) + { + tnc_id->destroy(tnc_id); + goto end; + } + list->insert_last(list, tnc_id); + } + +end: + reader->destroy(reader); + return list; + } + METHOD(imv_agent_t, create_state, TNC_Result, private_imv_agent_t *this, imv_state_t *state) { TNC_ConnectionID conn_id; char *tnccs_p = NULL, *tnccs_v = NULL, *t_p = NULL, *t_v = NULL; - bool has_long = FALSE, has_excl = FALSE, has_soh = FALSE; + bool has_long = FALSE, has_excl = FALSE, has_soh = FALSE, first = TRUE; + linked_list_t *ar_identities; + enumerator_t *enumerator; + tncif_identity_t *tnc_id; + imv_session_t *session; + u_int32_t max_msg_len; + u_int32_t ar_id_type = TNC_ID_UNKNOWN; + chunk_t ar_id_value = chunk_empty; conn_id = state->get_connection_id(state); if (find_connection(this, conn_id)) @@ -371,18 +432,74 @@ METHOD(imv_agent_t, create_state, TNC_Result, has_long = get_bool_attribute(this, conn_id, TNC_ATTRIBUTEID_HAS_LONG_TYPES); has_excl = get_bool_attribute(this, conn_id, TNC_ATTRIBUTEID_HAS_EXCLUSIVE); has_soh = get_bool_attribute(this, conn_id, TNC_ATTRIBUTEID_HAS_SOH); - tnccs_p = get_str_attribute(this, conn_id, TNC_ATTRIBUTEID_IFTNCCS_PROTOCOL); + tnccs_p = get_str_attribute(this, conn_id, TNC_ATTRIBUTEID_IFTNCCS_PROTOCOL); tnccs_v = get_str_attribute(this, conn_id, TNC_ATTRIBUTEID_IFTNCCS_VERSION); t_p = get_str_attribute(this, conn_id, TNC_ATTRIBUTEID_IFT_PROTOCOL); t_v = get_str_attribute(this, conn_id, TNC_ATTRIBUTEID_IFT_VERSION); + max_msg_len = get_uint_attribute(this, conn_id, TNC_ATTRIBUTEID_MAX_MESSAGE_SIZE); + ar_identities = get_identity_attribute(this, conn_id, TNC_ATTRIBUTEID_AR_IDENTITIES); state->set_flags(state, has_long, has_excl); + state->set_max_msg_len(state, max_msg_len); + + DBG2(DBG_IMV, "IMV %u \"%s\" created a state for %s %s Connection ID %u: " + "%slong %sexcl %ssoh", this->id, this->name, + tnccs_p ? tnccs_p:"?", tnccs_v ? tnccs_v:"?", conn_id, + has_long ? "+":"-", has_excl ? "+":"-", has_soh ? "+":"-"); + DBG2(DBG_IMV, " over %s %s with maximum PA-TNC message size of %u bytes", + t_p ? t_p:"?", t_v ? t_v :"?", max_msg_len); + + enumerator = ar_identities->create_enumerator(ar_identities); + while (enumerator->enumerate(enumerator, &tnc_id)) + { + pen_type_t id_type, subject_type, auth_type; + u_int32_t tcg_id_type, tcg_subject_type, tcg_auth_type; + chunk_t id_value; + + id_type = tnc_id->get_identity_type(tnc_id); + id_value = tnc_id->get_identity_value(tnc_id); + subject_type = tnc_id->get_subject_type(tnc_id); + auth_type = tnc_id->get_auth_type(tnc_id); + + tcg_id_type = (id_type.vendor_id == PEN_TCG) ? + id_type.type : TNC_ID_UNKNOWN; + tcg_subject_type = (subject_type.vendor_id == PEN_TCG) ? + subject_type.type : TNC_SUBJECT_UNKNOWN; + tcg_auth_type = (auth_type.vendor_id == PEN_TCG) ? + auth_type.type : TNC_AUTH_UNKNOWN; + + + DBG2(DBG_IMV, " %N AR identity '%.*s' authenticated by %N", + TNC_Subject_names, tcg_subject_type, + id_value.len, id_value.ptr, + TNC_Authentication_names, tcg_auth_type); - DBG2(DBG_IMV, "IMV %u \"%s\" created a state for Connection ID %u: " - "%s %s with %slong %sexcl %ssoh over %s %s", - this->id, this->name, conn_id, tnccs_p ? tnccs_p:"?", - tnccs_v ? tnccs_v:"?", has_long ? "+":"-", has_excl ? "+":"-", - has_soh ? "+":"-", t_p ? t_p:"?", t_v ? t_v :"?"); + if (first) + { + ar_id_type = tcg_id_type; + ar_id_value = id_value; + state->set_ar_id(state, ar_id_type, ar_id_value); + first = FALSE; + } + } + enumerator->destroy(enumerator); + + if (imcv_db) + { + session = imcv_db->add_session(imcv_db, conn_id, ar_id_type, ar_id_value); + if (session) + { + DBG2(DBG_IMV, " assigned session ID %d", + session->get_session_id(session)); + state->set_session(state, session); + } + else + { + DBG1(DBG_IMV, " no session ID assigned"); + } + } + ar_identities->destroy_offset(ar_identities, + offsetof(tncif_identity_t, destroy)); free(tnccs_p); free(tnccs_v); free(t_p); @@ -449,7 +566,7 @@ METHOD(imv_agent_t, change_state, TNC_Result, DBG1(DBG_IMV, "IMV %u \"%s\" was notified of unknown state %u " "for Connection ID %u", this->id, this->name, new_state, connection_id); - return TNC_RESULT_INVALID_PARAMETER; + return TNC_RESULT_INVALID_PARAMETER; } return TNC_RESULT_SUCCESS; } @@ -468,220 +585,16 @@ METHOD(imv_agent_t, get_state, bool, return TRUE; } -METHOD(imv_agent_t, send_message, TNC_Result, - private_imv_agent_t *this, TNC_ConnectionID connection_id, bool excl, - TNC_UInt32 src_imv_id, TNC_UInt32 dst_imc_id, chunk_t msg) -{ - TNC_MessageType type; - TNC_UInt32 msg_flags; - imv_state_t *state; - - state = find_connection(this, connection_id); - if (!state) - { - DBG1(DBG_IMV, "IMV %u \"%s\" has no state for Connection ID %u", - this->id, this->name, connection_id); - return TNC_RESULT_FATAL; - } - - if (state->has_long(state) && this->send_message_long) - { - if (!src_imv_id) - { - src_imv_id = this->id; - } - msg_flags = excl ? TNC_MESSAGE_FLAGS_EXCLUSIVE : 0; - - return this->send_message_long(src_imv_id, connection_id, msg_flags, - msg.ptr, msg.len, this->vendor_id, - this->subtype, dst_imc_id); - } - if (this->send_message) - { - type = (this->vendor_id << 8) | this->subtype; - - return this->send_message(this->id, connection_id, msg.ptr, msg.len, - type); - } - return TNC_RESULT_FATAL; -} - -METHOD(imv_agent_t, set_recommendation, TNC_Result, - private_imv_agent_t *this, TNC_ConnectionID connection_id, - TNC_IMV_Action_Recommendation rec, - TNC_IMV_Evaluation_Result eval) +METHOD(imv_agent_t, get_name, const char*, + private_imv_agent_t *this) { - imv_state_t *state; - - state = find_connection(this, connection_id); - if (!state) - { - DBG1(DBG_IMV, "IMV %u \"%s\" has no state for Connection ID %u", - this->id, this->name, connection_id); - return TNC_RESULT_FATAL; - } - - state->set_recommendation(state, rec, eval); - return this->provide_recommendation(this->id, connection_id, rec, eval); + return this->name; } -METHOD(imv_agent_t, receive_message, TNC_Result, - private_imv_agent_t *this, imv_state_t *state, chunk_t msg, - TNC_VendorID msg_vid, TNC_MessageSubtype msg_subtype, - TNC_UInt32 src_imc_id, TNC_UInt32 dst_imv_id, pa_tnc_msg_t **pa_tnc_msg) -{ - pa_tnc_msg_t *pa_msg, *error_msg; - pa_tnc_attr_t *error_attr; - enumerator_t *enumerator; - TNC_MessageType msg_type; - TNC_UInt32 msg_flags, src_imv_id, dst_imc_id; - TNC_ConnectionID connection_id; - TNC_Result result; - - connection_id = state->get_connection_id(state); - - if (state->has_long(state)) - { - if (dst_imv_id != TNC_IMVID_ANY) - { - DBG2(DBG_IMV, "IMV %u \"%s\" received message for Connection ID %u " - "from IMC %u to IMV %u", this->id, this->name, - connection_id, src_imc_id, dst_imv_id); - } - else - { - DBG2(DBG_IMV, "IMV %u \"%s\" received message for Connection ID %u " - "from IMC %u", this->id, this->name, connection_id, - src_imc_id); - } - } - else - { - DBG2(DBG_IMV, "IMV %u \"%s\" received message for Connection ID %u", - this->id, this->name, connection_id); - } - - *pa_tnc_msg = NULL; - pa_msg = pa_tnc_msg_create_from_data(msg); - - switch (pa_msg->process(pa_msg)) - { - case SUCCESS: - *pa_tnc_msg = pa_msg; - break; - case VERIFY_ERROR: - /* build error message */ - error_msg = pa_tnc_msg_create(); - enumerator = pa_msg->create_error_enumerator(pa_msg); - while (enumerator->enumerate(enumerator, &error_attr)) - { - error_msg->add_attribute(error_msg, - error_attr->get_ref(error_attr)); - } - enumerator->destroy(enumerator); - error_msg->build(error_msg); - - /* send error message */ - msg = error_msg->get_encoding(error_msg); - - if (state->has_long(state) && this->send_message_long) - { - if (state->has_excl(state)) - { - msg_flags = TNC_MESSAGE_FLAGS_EXCLUSIVE; - dst_imc_id = src_imc_id; - } - else - { - msg_flags = 0; - dst_imc_id = TNC_IMCID_ANY; - } - src_imv_id = (dst_imv_id == TNC_IMVID_ANY) ? this->id - : dst_imv_id; - - result = this->send_message_long(src_imv_id, connection_id, - msg_flags, msg.ptr, msg.len, msg_vid, - msg_subtype, dst_imc_id); - } - else if (this->send_message) - { - msg_type = (msg_vid << 8) | msg_subtype; - - result = this->send_message(this->id, connection_id, - msg.ptr, msg.len, msg_type); - } - else - { - result = TNC_RESULT_FATAL; - } - - /* clean up */ - error_msg->destroy(error_msg); - pa_msg->destroy(pa_msg); - return result; - case FAILED: - default: - pa_msg->destroy(pa_msg); - state->set_recommendation(state, - TNC_IMV_ACTION_RECOMMENDATION_NO_RECOMMENDATION, - TNC_IMV_EVALUATION_RESULT_ERROR); - return this->provide_recommendation(this->id, connection_id, - TNC_IMV_ACTION_RECOMMENDATION_NO_RECOMMENDATION, - TNC_IMV_EVALUATION_RESULT_ERROR); - } - return TNC_RESULT_SUCCESS; -} - -METHOD(imv_agent_t, provide_recommendation, TNC_Result, - private_imv_agent_t *this, TNC_ConnectionID connection_id) +METHOD(imv_agent_t, get_id, TNC_IMVID, + private_imv_agent_t *this) { - imv_state_t *state; - TNC_IMV_Action_Recommendation rec; - TNC_IMV_Evaluation_Result eval; - TNC_UInt32 lang_len; - char buf[BUF_LEN]; - chunk_t pref_lang = { buf, 0 }, reason_string, reason_lang; - - state = find_connection(this, connection_id); - if (!state) - { - DBG1(DBG_IMV, "IMV %u \"%s\" has no state for Connection ID %u", - this->id, this->name, connection_id); - return TNC_RESULT_FATAL; - } - state->get_recommendation(state, &rec, &eval); - - - /* send a reason string if action recommendation is not allow */ - if (rec != TNC_IMV_ACTION_RECOMMENDATION_ALLOW) - { - /* check if there a preferred language has been requested */ - if (this->get_attribute && - this->get_attribute(this->id, connection_id, - TNC_ATTRIBUTEID_PREFERRED_LANGUAGE, BUF_LEN, - buf, &lang_len) == TNC_RESULT_SUCCESS && - lang_len <= BUF_LEN) - { - pref_lang.len = lang_len; - DBG2(DBG_IMV, "preferred language is '%.*s'", - pref_lang.len, pref_lang.ptr); - } - - /* find a reason string for the preferred or default language and set it */ - if (this->set_attribute && - state->get_reason_string(state, pref_lang, &reason_string, - &reason_lang)) - { - this->set_attribute(this->id, connection_id, - TNC_ATTRIBUTEID_REASON_STRING, - reason_string.len, reason_string.ptr); - this->set_attribute(this->id, connection_id, - TNC_ATTRIBUTEID_REASON_LANGUAGE, - reason_lang.len, reason_lang.ptr); - } - } - - return this->provide_recommendation(this->id, connection_id, rec, eval); + return this->id; } METHOD(imv_agent_t, reserve_additional_ids, TNC_Result, @@ -729,6 +642,146 @@ METHOD(imv_agent_t, create_id_enumerator, enumerator_t*, return this->additional_ids->create_enumerator(this->additional_ids); } +typedef struct { + /** + * implements enumerator_t + */ + enumerator_t public; + + /** + * language length + */ + TNC_UInt32 lang_len; + + /** + * language buffer + */ + char lang_buf[BUF_LEN]; + + /** + * position pointer into language buffer + */ + char *lang_pos; + +} language_enumerator_t; + +/** + * Implementation of language_enumerator.destroy. + */ +static void language_enumerator_destroy(language_enumerator_t *this) +{ + free(this); +} + +/** + * Implementation of language_enumerator.enumerate + */ +static bool language_enumerator_enumerate(language_enumerator_t *this, ...) +{ + char *pos, *cur_lang, **lang; + TNC_UInt32 len; + va_list args; + + if (!this->lang_len) + { + return FALSE; + } + cur_lang = this->lang_pos; + pos = strchr(this->lang_pos, ','); + if (pos) + { + len = pos - this->lang_pos; + this->lang_pos += len + 1, + this->lang_len -= len + 1; + } + else + { + len = this->lang_len; + pos = this->lang_pos + len; + this->lang_pos = NULL; + this->lang_len = 0; + } + + /* remove preceding whitespace */ + while (*cur_lang == ' ' && len--) + { + cur_lang++; + } + + /* remove trailing whitespace */ + while (len && *(--pos) == ' ') + { + len--; + } + cur_lang[len] = '\0'; + + va_start(args, this); + lang = va_arg(args, char**); + *lang = cur_lang; + va_end(args); + + return TRUE; +} + +METHOD(imv_agent_t, create_language_enumerator, enumerator_t*, + private_imv_agent_t *this, imv_state_t *state) +{ + language_enumerator_t *e; + + /* Create a language enumerator instance */ + e = malloc_thing(language_enumerator_t); + e->public.enumerate = (void*)language_enumerator_enumerate; + e->public.destroy = (void*)language_enumerator_destroy; + + if (!this->get_attribute || + !this->get_attribute(this->id, state->get_connection_id(state), + TNC_ATTRIBUTEID_PREFERRED_LANGUAGE, BUF_LEN, + e->lang_buf, &e->lang_len) == TNC_RESULT_SUCCESS || + e->lang_len >= BUF_LEN) + { + e->lang_len = 0; + } + e->lang_buf[e->lang_len] = '\0'; + e->lang_pos = e->lang_buf; + + return (enumerator_t*)e; +} + +METHOD(imv_agent_t, provide_recommendation, TNC_Result, + private_imv_agent_t *this, imv_state_t *state) +{ + TNC_IMV_Action_Recommendation rec; + TNC_IMV_Evaluation_Result eval; + TNC_ConnectionID connection_id; + chunk_t reason_string; + char *reason_lang; + enumerator_t *e; + + state->get_recommendation(state, &rec, &eval); + connection_id = state->get_connection_id(state); + + /* send a reason string if action recommendation is not allow */ + if (rec != TNC_IMV_ACTION_RECOMMENDATION_ALLOW) + { + /* find a reason string for the preferred language and set it */ + if (this->set_attribute) + { + e = create_language_enumerator(this, state); + if (state->get_reason_string(state, e, &reason_string, &reason_lang)) + { + this->set_attribute(this->id, connection_id, + TNC_ATTRIBUTEID_REASON_STRING, + reason_string.len, reason_string.ptr); + this->set_attribute(this->id, connection_id, + TNC_ATTRIBUTEID_REASON_LANGUAGE, + strlen(reason_lang), reason_lang); + } + e->destroy(e); + } + } + return this->provide_recommendation(this->id, connection_id, rec, eval); +} + METHOD(imv_agent_t, destroy, void, private_imv_agent_t *this) { @@ -747,13 +800,13 @@ METHOD(imv_agent_t, destroy, void, * Described in header. */ imv_agent_t *imv_agent_create(const char *name, - pen_t vendor_id, u_int32_t subtype, + pen_type_t *supported_types, u_int32_t type_count, TNC_IMVID id, TNC_Version *actual_version) { private_imv_agent_t *this; /* initialize or increase the reference count */ - if (!libimcv_init()) + if (!libimcv_init(TRUE)) { return NULL; } @@ -765,18 +818,18 @@ imv_agent_t *imv_agent_create(const char *name, .delete_state = _delete_state, .change_state = _change_state, .get_state = _get_state, - .send_message = _send_message, - .receive_message = _receive_message, - .set_recommendation = _set_recommendation, - .provide_recommendation = _provide_recommendation, + .get_name = _get_name, + .get_id = _get_id, .reserve_additional_ids = _reserve_additional_ids, .count_additional_ids = _count_additional_ids, .create_id_enumerator = _create_id_enumerator, + .create_language_enumerator = _create_language_enumerator, + .provide_recommendation = _provide_recommendation, .destroy = _destroy, }, .name = name, - .vendor_id = vendor_id, - .subtype = subtype, + .supported_types = supported_types, + .type_count = type_count, .id = id, .additional_ids = linked_list_create(), .connections = linked_list_create(), diff --git a/src/libimcv/imv/imv_agent.h b/src/libimcv/imv/imv_agent.h index de70f3bc1..d58af260b 100644 --- a/src/libimcv/imv/imv_agent.h +++ b/src/libimcv/imv/imv_agent.h @@ -1,5 +1,6 @@ /* - * Copyright (C) 2011 Andreas Steffen, HSR Hochschule fuer Technik Rapperswil + * Copyright (C) 2011-2013 Andreas Steffen + * HSR Hochschule fuer Technik Rapperswil * * This program is free software; you can redistribute it and/or modify it * under the terms of the GNU General Public License as published by the @@ -15,17 +16,19 @@ /** * * @defgroup imv_agent_t imv_agent - * @{ @ingroup imv_agent + * @{ @ingroup libimcv_imv */ #ifndef IMV_AGENT_H_ #define IMV_AGENT_H_ #include "imv_state.h" +#include "imv_database.h" #include "pa_tnc/pa_tnc_msg.h" #include <tncifimv.h> #include <pen/pen.h> +#include <collections/linked_list.h> #include <library.h> @@ -49,6 +52,44 @@ struct imv_agent_t { TNC_RetryReason reason); /** + * Call when an IMV-IMC message is to be sent + * + * @param imv_id IMV ID assigned by TNCS + * @param connection_id network connection ID assigned by TNCS + * @param msg message to send + * @param msg_len message length in bytes + * @param msg_type message type + * @return TNC result code + */ + TNC_Result (*send_message)(TNC_IMVID imv_id, + TNC_ConnectionID connection_id, + TNC_BufferReference msg, + TNC_UInt32 msg_len, + TNC_MessageType msg_type); + + /** + * Call when an IMV-IMC message is to be sent with long message types + * + * @param imv_id IMV ID assigned by TNCS + * @param connection_id network connection ID assigned by TNCS + * @param msg_flags message flags + * @param msg message to send + * @param msg_len message length in bytes + * @param msg_vid message vendor ID + * @param msg_subtype message subtype + * @param dst_imc_id destination IMC ID + * @return TNC result code + */ + TNC_Result (*send_message_long)(TNC_IMVID imv_id, + TNC_ConnectionID connection_id, + TNC_UInt32 msg_flags, + TNC_BufferReference msg, + TNC_UInt32 msg_len, + TNC_VendorID msg_vid, + TNC_MessageSubtype msg_subtype, + TNC_UInt32 dst_imc_id); + + /** * Bind TNCS functions * * @param bind_function function offered by the TNCS @@ -98,61 +139,18 @@ struct imv_agent_t { TNC_ConnectionID connection_id, imv_state_t **state); /** - * Call when a PA-TNC message is to be sent - * - * @param connection_id network connection ID assigned by TNCS - * @param excl exclusive flag - * @param src_imv_id IMV ID to be set as source - * @param dst_imc_id IMD ID to be set as destination - * @param msg message to send - * @return TNC result code - */ - TNC_Result (*send_message)(imv_agent_t *this, - TNC_ConnectionID connection_id, bool excl, - TNC_UInt32 src_imv_id, TNC_UInt32 dst_imc_id, - chunk_t msg); - - /** - * Call when a PA-TNC message was received + * Get IMV name * - * @param state state for current connection - * @param msg received unparsed message - * @param msg_vid message vendorID of the received message - * @param msg_subtype message subtype of the received message - * @param src_imc_id source IMC ID - * @param dst_imv_id destination IMV ID - * @param pa_tnc_message parsed PA-TNC message or NULL if an error occurred - * @return TNC result code + * return IMV name */ - TNC_Result (*receive_message)(imv_agent_t *this, - imv_state_t *state, chunk_t msg, - TNC_VendorID msg_vid, - TNC_MessageSubtype msg_subtype, - TNC_UInt32 src_imc_id, - TNC_UInt32 dst_imv_id, - pa_tnc_msg_t **pa_tnc_msg); + const char* (*get_name)(imv_agent_t *this); /** - * Set Action Recommendation and Evaluation Result in the IMV state + * Get base IMV ID * - * @param connection_id network connection ID assigned by TNCS - * @param rec IMV action recommendation - * @param eval IMV evaluation result - * @return TNC result code - */ - TNC_Result (*set_recommendation)(imv_agent_t *this, - TNC_ConnectionID connection_id, - TNC_IMV_Action_Recommendation rec, - TNC_IMV_Evaluation_Result eval); - - /** - * Deliver IMV Action Recommendation and IMV Evaluation Result to the TNCS - * - * @param connection_id network connection ID assigned by TNCS - * @return TNC result code + * return base IMV ID */ - TNC_Result (*provide_recommendation)(imv_agent_t *this, - TNC_ConnectionID connection_id); + TNC_IMVID (*get_id)(imv_agent_t *this); /** * Reserve additional IMV IDs from TNCS @@ -175,6 +173,22 @@ struct imv_agent_t { enumerator_t* (*create_id_enumerator)(imv_agent_t *this); /** + * Create a preferred languages enumerator + * + * @param state of TNCCS connection + */ + enumerator_t* (*create_language_enumerator)(imv_agent_t *this, + imv_state_t *state); + + /** + * Deliver IMV Action Recommendation and IMV Evaluation Result to the TNCS + * + * @param state state bound to a connection ID + * @return TNC result code + */ + TNC_Result (*provide_recommendation)(imv_agent_t *this, imv_state_t* state); + + /** * Destroys an imv_agent_t object */ void (*destroy)(imv_agent_t *this); @@ -184,14 +198,14 @@ struct imv_agent_t { * Create an imv_agent_t object * * @param name name of the IMV - * @param vendor_id vendor ID of the IMV - * @param subtype message subtype of the IMV + * @param supported_types list of message types registered by the IMV + * @param type_count number of registered message types * @param id ID of the IMV as assigned by the TNCS * @param actual_version actual version of the IF-IMV API * */ imv_agent_t *imv_agent_create(const char *name, - pen_t vendor_id, u_int32_t subtype, + pen_type_t *supported_types, u_int32_t type_count, TNC_IMVID id, TNC_Version *actual_version); #endif /** IMV_AGENT_H_ @}*/ diff --git a/src/libimcv/imv/imv_agent_if.h b/src/libimcv/imv/imv_agent_if.h new file mode 100644 index 000000000..db188793a --- /dev/null +++ b/src/libimcv/imv/imv_agent_if.h @@ -0,0 +1,115 @@ +/* + * Copyright (C) 2013 Andreas Steffen + * HSR Hochschule fuer Technik Rapperswil + * + * This program is free software; you can redistribute it and/or modify it + * under the terms of the GNU General Public License as published by the + * Free Software Foundation; either version 2 of the License, or (at your + * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>. + * + * This program is distributed in the hope that it will be useful, but + * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY + * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License + * for more details. + */ + +/** + * @defgroup imv_agent_if_t imv_agent_if + * @{ @ingroup imv_os + */ + +#ifndef IMV_AGENT_IF_H_ +#define IMV_AGENT_IF_H_ + +#include <tncifimv.h> + +#include <library.h> + +typedef struct imv_agent_if_t imv_agent_if_t; + +/** + * IF-IMV interface for IMV agents + */ +struct imv_agent_if_t { + + /** + * Implements the TNC_IMV_ProvideBindFunction function of the IMV + * + * @param bind_function Function offered by the TNCS + * @return TNC result code + */ + TNC_Result (*bind_functions)(imv_agent_if_t *this, + TNC_TNCS_BindFunctionPointer bind_function); + + /** + * Implements the TNC_IMV_NotifyConnectionChange() function of the IMV + * + * @param id Network connection ID assigned by TNCS + * @param new_state New connection state to be set + * @return TNC result code + */ + TNC_Result (*notify_connection_change)(imv_agent_if_t *this, + TNC_ConnectionID id, + TNC_ConnectionState new_state); + + /** + * Implements the TNC_IMV_ReceiveMessage() function of the IMV + * + * @param id Network connection ID assigned by TNCS + * @param msg_type PA-TNC message type + * @param msg Received message + * @return TNC result code + */ + TNC_Result (*receive_message)(imv_agent_if_t *this, TNC_ConnectionID id, + TNC_MessageType msg_type, chunk_t msg); + + /** + * Implements the TNC_IMV_ReceiveMessageLong() function of the IMV + * + * @param id Network connection ID assigned by TNCS + * @param src_imc_id ID of source IMC + * @param dst_imv_id ID of destination IMV + * @param msg_vid Vendor ID of message type + * @param msg_subtype PA-TNC message subtype + * @param msg Received message + * @return TNC result code + */ + TNC_Result (*receive_message_long)(imv_agent_if_t *this, + TNC_ConnectionID id, + TNC_UInt32 src_imc_id, + TNC_UInt32 dst_imv_id, + TNC_VendorID msg_vid, + TNC_MessageSubtype msg_subtype, + chunk_t msg); + + /** + * Implements the TNC_IMV_BatchEnding() function of the IMV + * + * @param id Network connection ID assigned by TNCS + * @return TNC result code + */ + TNC_Result (*batch_ending)(imv_agent_if_t *this, TNC_ConnectionID id); + + /** + * Implements the TNC_IMV_SolicitRecommendation() function of the IMV + * + * @param id Network connection ID assigned by TNCS + * @return TNC result code + */ + TNC_Result (*solicit_recommendation)(imv_agent_if_t *this, + TNC_ConnectionID id); + + /** + * Destroys an imv_agent_if_t object + */ + void (*destroy)(imv_agent_if_t *this); + +}; + +/** + * Constructor template + */ +typedef imv_agent_if_t* (*imv_agent_create_t)(const char* name, TNC_IMVID id, + TNC_Version *actual_version); + +#endif /** IMV_AGENT_IF_H_ @}*/ diff --git a/src/libimcv/imv/imv_database.c b/src/libimcv/imv/imv_database.c new file mode 100644 index 000000000..dc7edd7aa --- /dev/null +++ b/src/libimcv/imv/imv_database.c @@ -0,0 +1,381 @@ +/* + * Copyright (C) 2013 Andreas Steffen + * HSR Hochschule fuer Technik Rapperswil + * + * This program is free software; you can redistribute it and/or modify it + * under the terms of the GNU General Public License as published by the + * Free Software Foundation; either version 2 of the License, or (at your + * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>. + * + * This program is distributed in the hope that it will be useful, but + * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY + * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License + * for more details. + */ + +#define _GNU_SOURCE + +#include <stdio.h> +#include <stdarg.h> +#include <string.h> +#include <time.h> + +#include "imv_database.h" + +#include <utils/debug.h> +#include <threading/mutex.h> + +typedef struct private_imv_database_t private_imv_database_t; + +/** + * Private data of a imv_database_t object. + */ +struct private_imv_database_t { + + /** + * Public imv_database_t interface. + */ + imv_database_t public; + + /** + * database instance + */ + database_t *db; + + /** + * policy script + */ + char *script; + + /** + * Session list + */ + linked_list_t *sessions; + + /** + * mutex used to lock session list + */ + mutex_t *mutex; + +}; + +METHOD(imv_database_t, add_session, imv_session_t*, + private_imv_database_t *this, TNC_ConnectionID conn_id, + u_int32_t ar_id_type, chunk_t ar_id_value) +{ + enumerator_t *enumerator, *e; + imv_session_t *current, *session = NULL; + int ar_id = 0, session_id; + u_int created; + + this->mutex->lock(this->mutex); + + /* check if a session has already been assigned */ + enumerator = this->sessions->create_enumerator(this->sessions); + while (enumerator->enumerate(enumerator, ¤t)) + { + if (conn_id == current->get_connection_id(current)) + { + session = current; + break; + } + } + enumerator->destroy(enumerator); + + /* session already exists */ + if (session) + { + this->mutex->unlock(this->mutex); + return session->get_ref(session); + } + + if (ar_id_value.len) + { + /* get primary key of AR identity if it exists */ + e = this->db->query(this->db, + "SELECT id FROM identities WHERE type = ? AND value = ?", + DB_INT, ar_id_type, DB_BLOB, ar_id_value, DB_INT); + if (e) + { + e->enumerate(e, &ar_id); + e->destroy(e); + } + + /* if AR identity has not been found - register it */ + if (!ar_id) + { + this->db->execute(this->db, &ar_id, + "INSERT INTO identities (type, value) VALUES (?, ?)", + DB_INT, ar_id_type, DB_BLOB, ar_id_value); + } + } + /* create a new session entry */ + created = time(NULL); + this->db->execute(this->db, &session_id, + "INSERT INTO sessions (time, connection, identity) " + "VALUES (?, ?, ?)", + DB_UINT, created, DB_INT, conn_id, DB_INT, ar_id); + session = imv_session_create(session_id, conn_id); + this->sessions->insert_last(this->sessions, session); + + this->mutex->unlock(this->mutex); + + return session; +} + +METHOD(imv_database_t, remove_session, void, + private_imv_database_t *this, imv_session_t *session) +{ + enumerator_t *enumerator; + imv_session_t *current; + + this->mutex->lock(this->mutex); + enumerator = this->sessions->create_enumerator(this->sessions); + while (enumerator->enumerate(enumerator, ¤t)) + { + if (current == session) + { + this->sessions->remove_at(this->sessions, enumerator); + break; + } + } + enumerator->destroy(enumerator); + this->mutex->unlock(this->mutex); +} + +METHOD(imv_database_t, add_product, int, + private_imv_database_t *this, imv_session_t *session, char *product) +{ + enumerator_t *e; + int pid = 0; + + /* get primary key of product info string if it exists */ + e = this->db->query(this->db, + "SELECT id FROM products WHERE name = ?", DB_TEXT, product, DB_INT); + if (e) + { + e->enumerate(e, &pid); + e->destroy(e); + } + + /* if product info string has not been found - register it */ + if (!pid) + { + this->db->execute(this->db, &pid, + "INSERT INTO products (name) VALUES (?)", DB_TEXT, product); + } + + /* add product reference to session */ + if (pid) + { + this->db->execute(this->db, NULL, + "UPDATE sessions SET product = ? WHERE id = ?", + DB_INT, pid, DB_INT, session->get_session_id(session)); + } + + return pid; +} + +METHOD(imv_database_t, add_device, int, + private_imv_database_t *this, imv_session_t *session, chunk_t device) +{ + enumerator_t *e; + char *device_str; + int pid = 0, did = 0; + + /* get primary key of product from session */ + e = this->db->query(this->db, + "SELECT product FROM sessions WHERE id = ?", + DB_INT, session->get_session_id(session), DB_INT); + if (e) + { + e->enumerate(e, &pid); + e->destroy(e); + } + + /* some IMV policy manager expect a text string */ + device_str = strndup(device.ptr, device.len); + + /* get primary key of device identification if it exists */ + e = this->db->query(this->db, + "SELECT id FROM devices WHERE value = ? AND product = ?", + DB_TEXT, device_str, DB_INT, pid, DB_INT); + if (e) + { + e->enumerate(e, &did); + e->destroy(e); + } + + /* if device identification has not been found - register it */ + if (!did) + { + this->db->execute(this->db, &did, + "INSERT INTO devices (value, product) VALUES (?, ?)", + DB_TEXT, device_str, DB_INT, pid); + } + free(device_str); + + /* add device reference to session */ + if (did) + { + this->db->execute(this->db, NULL, + "UPDATE sessions SET device = ? WHERE id = ?", + DB_INT, did, DB_INT, session->get_session_id(session)); + } + + return did; +} + +METHOD(imv_database_t, add_recommendation, void, + private_imv_database_t *this, imv_session_t *session, + TNC_IMV_Action_Recommendation rec) +{ + /* add final recommendation to session */ + this->db->execute(this->db, NULL, + "UPDATE sessions SET rec = ? WHERE id = ?", + DB_INT, rec, DB_INT, session->get_session_id(session)); +} + +METHOD(imv_database_t, policy_script, bool, + private_imv_database_t *this, imv_session_t *session, bool start) +{ + imv_workitem_t *workitem; + imv_workitem_type_t type; + int id, session_id, arg_int, rec_fail, rec_noresult; + enumerator_t *e; + char command[512], resp[128], *last, *arg_str; + FILE *shell; + + session_id = session->get_session_id(session); + + snprintf(command, sizeof(command), "2>&1 TNC_SESSION_ID='%d' %s %s", + session_id, this->script, start ? "start" : "stop"); + DBG3(DBG_IMV, "running policy script: %s", command); + + shell = popen(command, "r"); + if (shell == NULL) + { + DBG1(DBG_IMV, "could not execute policy script '%s'", + this->script); + return FALSE; + } + while (TRUE) + { + if (fgets(resp, sizeof(resp), shell) == NULL) + { + if (ferror(shell)) + { + DBG1(DBG_IMV, "error reading output from policy script"); + } + break; + } + else + { + last = resp + strlen(resp) - 1; + if (last >= resp && *last == '\n') + { + /* replace trailing '\n' */ + *last = '\0'; + } + DBG1(DBG_IMV, "policy: %s", resp); + } + } + pclose(shell); + + if (start && !session->get_policy_started(session)) + { + /* get workitem list generated by policy manager */ + e = this->db->query(this->db, + "SELECT id, type, arg_str, arg_int, rec_fail, rec_noresult " + "FROM workitems WHERE session = ?", DB_INT, session_id, + DB_INT, DB_INT, DB_TEXT, DB_INT,DB_INT, DB_INT); + if (!e) + { + DBG1(DBG_IMV, "no workitem enumerator returned"); + return FALSE; + } + while (e->enumerate(e, &id, &type, &arg_str, &arg_int, &rec_fail, + &rec_noresult)) + { + workitem = imv_workitem_create(id, type, arg_str, arg_int, rec_fail, + rec_noresult); + session->insert_workitem(session, workitem); + } + e->destroy(e); + + session->set_policy_started(session, TRUE); + } + else if (!start && session->get_policy_started(session)) + { + session->set_policy_started(session, FALSE); + } + + return TRUE; +} + +METHOD(imv_database_t, finalize_workitem, bool, + private_imv_database_t *this, imv_workitem_t *workitem) +{ + char *result; + int rec; + + rec = workitem->get_result(workitem, &result); + + return this->db->execute(this->db, NULL, + "UPDATE workitems SET result = ?, rec_final = ? WHERE id = ?", + DB_TEXT, result, DB_INT, rec, + DB_INT, workitem->get_id(workitem)) == 1; +} + +METHOD(imv_database_t, get_database, database_t*, + private_imv_database_t *this) +{ + return this->db; +} + +METHOD(imv_database_t, destroy, void, + private_imv_database_t *this) +{ + DESTROY_IF(this->db); + this->sessions->destroy_offset(this->sessions, + offsetof(imv_session_t, destroy)); + this->mutex->destroy(this->mutex); + free(this); +} + +/** + * See header + */ +imv_database_t *imv_database_create(char *uri, char *script) +{ + private_imv_database_t *this; + + INIT(this, + .public = { + .add_session = _add_session, + .remove_session = _remove_session, + .add_product = _add_product, + .add_device = _add_device, + .add_recommendation = _add_recommendation, + .policy_script = _policy_script, + .finalize_workitem = _finalize_workitem, + .get_database = _get_database, + .destroy = _destroy, + }, + .db = lib->db->create(lib->db, uri), + .script = script, + .sessions = linked_list_create(), + .mutex = mutex_create(MUTEX_TYPE_DEFAULT), + ); + + if (!this->db) + { + DBG1(DBG_IMV, + "failed to connect to IMV database '%s'", uri); + destroy(this); + return NULL; + } + + return &this->public; +} + diff --git a/src/libimcv/imv/imv_database.h b/src/libimcv/imv/imv_database.h new file mode 100644 index 000000000..48a3ded9e --- /dev/null +++ b/src/libimcv/imv/imv_database.h @@ -0,0 +1,125 @@ +/* + * Copyright (C) 2013 Andreas Steffen + * HSR Hochschule fuer Technik Rapperswil + * + * This program is free software; you can redistribute it and/or modify it + * under the terms of the GNU General Public License as published by the + * Free Software Foundation; either version 2 of the License, or (at your + * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>. + * + * This program is distributed in the hope that it will be useful, but + * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY + * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License + * for more details. + */ + +/** + * + * @defgroup imv_database_t imv_database + * @{ @ingroup libimcv_imv + */ + +#ifndef IMV_DATABASE_H_ +#define IMV_DATABASE_H_ + +#include "imv_session.h" +#include "imv_workitem.h" + +#include <tncifimv.h> + +#include <library.h> + +typedef struct imv_database_t imv_database_t; + +/** + * IMV database interface + */ +struct imv_database_t { + + /** + * Create or get a session associated with a TNCCS connection + * + * @param conn_id TNCCS Connection ID + * @param ar_id_type Access Requestor identity type + * @param ar_id_value Access Requestor identity value + * @return Session associated with TNCCS Connection + */ + imv_session_t* (*add_session)(imv_database_t *this, + TNC_ConnectionID conn_id, + u_int32_t ar_id_type, chunk_t ar_id_value); + + /** + * Remove and delete a session + * + * @param session Session + */ + void (*remove_session)(imv_database_t *this, imv_session_t *session); + + /** + * Add product information string to a session database entry + * + * @param session Session + * @param product Product information string + * @return Product ID + */ + int (*add_product)(imv_database_t *this, imv_session_t *session, + char *product); + + /** + * Add device identification to a session database entry + * + * @param session Session + * @param device Device identification + * @return Device ID + */ + int (*add_device)(imv_database_t *this, imv_session_t *session, + chunk_t device); + + /** + * Add final recommendation to a session database entry + * + * @param session Session + * @param rec Final recommendation + */ + void (*add_recommendation)(imv_database_t *this, imv_session_t *session, + TNC_IMV_Action_Recommendation rec); + + /** + * Announce session start/stop to policy script + * + * @param session Session + * @param start TRUE if session start, FALSE if session stop + * @return TRUE if command successful, FALSE otherwise + */ + bool (*policy_script)(imv_database_t *this, imv_session_t *session, + bool start); + + /** + * Finalize a workitem + * + * @param workitem Workitem to be finalized + */ + bool (*finalize_workitem)(imv_database_t *this, imv_workitem_t *workitem); + + /** + * Get database handle + * + * @return Database handle + */ + database_t* (*get_database)(imv_database_t *this); + + /** + * Destroys an imv_database_t object + */ + void (*destroy)(imv_database_t *this); +}; + +/** + * Create an imv_database_t instance + * + * @param uri Database uri + * @param script Policy Manager script + */ +imv_database_t* imv_database_create(char *uri, char *script); + +#endif /** IMV_DATABASE_H_ @}*/ diff --git a/src/libimcv/imv/imv_if.h b/src/libimcv/imv/imv_if.h new file mode 100644 index 000000000..fa9765b11 --- /dev/null +++ b/src/libimcv/imv/imv_if.h @@ -0,0 +1,167 @@ +/* + * Copyright (C) 2012-2013 Andreas Steffen + * HSR Hochschule fuer Technik Rapperswil + * + * This program is free software; you can redistribute it and/or modify it + * under the terms of the GNU General Public License as published by the + * Free Software Foundation; either version 2 of the License, or (at your + * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>. + * + * This program is distributed in the hope that it will be useful, but + * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY + * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License + * for more details. + */ + +/** + * Define the following two static constants externally: + * static const char imv_name[] = "xx"; + * static const imv_agent_create_t imv_agent_create = imv_xx_agent_create; + */ + +#include <utils/debug.h> + +static imv_agent_if_t *imv_agent; + +/* + * see section 3.8.1 of TCG TNC IF-IMV Specification 1.3 + */ +TNC_Result TNC_IMV_Initialize(TNC_IMVID imv_id, + TNC_Version min_version, + TNC_Version max_version, + TNC_Version *actual_version) +{ + if (imv_agent) + { + DBG1(DBG_IMV, "IMV \"%s\" has already been initialized", imv_name); + return TNC_RESULT_ALREADY_INITIALIZED; + } + + imv_agent = imv_agent_create(imv_name, imv_id, actual_version); + + if (!imv_agent) + { + return TNC_RESULT_FATAL; + } + if (min_version > TNC_IFIMV_VERSION_1 || max_version < TNC_IFIMV_VERSION_1) + { + DBG1(DBG_IMV, "no common IF-IMV version"); + return TNC_RESULT_NO_COMMON_VERSION; + } + return TNC_RESULT_SUCCESS; +} + +/** + * see section 3.8.2 of TCG TNC IF-IMV Specification 1.3 + */ +TNC_Result TNC_IMV_NotifyConnectionChange(TNC_IMVID imv_id, + TNC_ConnectionID connection_id, + TNC_ConnectionState new_state) +{ + if (!imv_agent) + { + DBG1(DBG_IMV, "IMV \"%s\" has not been initialized", imv_name); + return TNC_RESULT_NOT_INITIALIZED; + } + return imv_agent->notify_connection_change(imv_agent, connection_id, + new_state); +} + +/** + * see section 3.8.4 of TCG TNC IF-IMV Specification 1.3 + */ +TNC_Result TNC_IMV_ReceiveMessage(TNC_IMVID imv_id, + TNC_ConnectionID connection_id, + TNC_BufferReference msg, + TNC_UInt32 msg_len, + TNC_MessageType msg_type) +{ + if (!imv_agent) + { + DBG1(DBG_IMV, "IMV \"%s\" has not been initialized", imv_name); + return TNC_RESULT_NOT_INITIALIZED; + } + return imv_agent->receive_message(imv_agent, connection_id, msg_type, + chunk_create(msg, msg_len)); +} + +/** + * see section 3.8.6 of TCG TNC IF-IMV Specification 1.3 + */ +TNC_Result TNC_IMV_ReceiveMessageLong(TNC_IMVID imv_id, + TNC_ConnectionID connection_id, + TNC_UInt32 msg_flags, + TNC_BufferReference msg, + TNC_UInt32 msg_len, + TNC_VendorID msg_vid, + TNC_MessageSubtype msg_subtype, + TNC_UInt32 src_imc_id, + TNC_UInt32 dst_imv_id) +{ + if (!imv_agent) + { + DBG1(DBG_IMV, "IMV \"%s\" has not been initialized", imv_name); + return TNC_RESULT_NOT_INITIALIZED; + } + return imv_agent->receive_message_long(imv_agent, connection_id, + src_imc_id, dst_imv_id, + msg_vid, msg_subtype, chunk_create(msg, msg_len)); +} + +/** + * see section 3.8.7 of TCG TNC IF-IMV Specification 1.3 + */ +TNC_Result TNC_IMV_SolicitRecommendation(TNC_IMVID imv_id, + TNC_ConnectionID connection_id) +{ + + if (!imv_agent) + { + DBG1(DBG_IMV, "IMV \"%s\" has not been initialized", imv_name); + return TNC_RESULT_NOT_INITIALIZED; + } + return imv_agent->solicit_recommendation(imv_agent, connection_id); +} + +/** + * see section 3.8.8 of TCG TNC IF-IMV Specification 1.3 + */ +TNC_Result TNC_IMV_BatchEnding(TNC_IMVID imv_id, TNC_ConnectionID connection_id) +{ + if (!imv_agent) + { + DBG1(DBG_IMV, "IMV \"%s\" has not been initialized", imv_name); + return TNC_RESULT_NOT_INITIALIZED; + } + return imv_agent->batch_ending(imv_agent, connection_id); +} + +/** + * see section 3.8.9 of TCG TNC IF-IMV Specification 1.3 + */ +TNC_Result TNC_IMV_Terminate(TNC_IMVID imv_id) +{ + if (!imv_agent) + { + DBG1(DBG_IMV, "IMV \"%s\" has not been initialized", imv_name); + return TNC_RESULT_NOT_INITIALIZED; + } + imv_agent->destroy(imv_agent); + imv_agent = NULL; + + return TNC_RESULT_SUCCESS; +} + +/** + * see section 4.2.8.1 of TCG TNC IF-IMV Specification 1.3 + */ +TNC_Result TNC_IMV_ProvideBindFunction(TNC_IMVID imv_id, + TNC_TNCS_BindFunctionPointer bind_function) +{ + if (!imv_agent) + { + DBG1(DBG_IMV, "IMV \"%s\" has not been initialized", imv_name); + return TNC_RESULT_NOT_INITIALIZED; + } + return imv_agent->bind_functions(imv_agent, bind_function); +} diff --git a/src/libimcv/imv/imv_lang_string.c b/src/libimcv/imv/imv_lang_string.c new file mode 100644 index 000000000..c86fc5cd7 --- /dev/null +++ b/src/libimcv/imv/imv_lang_string.c @@ -0,0 +1,73 @@ +/* + * Copyright (C) 2012 Andreas Steffen + * HSR Hochschule fuer Technik Rapperswil + * + * This program is free software; you can redistribute it and/or modify it + * under the terms of the GNU General Public License as published by the + * Free Software Foundation; either version 2 of the License, or (at your + * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>. + * + * This program is distributed in the hope that it will be useful, but + * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY + * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License + * for more details. + */ + +#include "imv_lang_string.h" + +#include <utils/debug.h> + +/** + * Described in header. + */ +char* imv_lang_string_select_lang(enumerator_t *language_enumerator, + char* languages[], int lang_count) +{ + bool match = FALSE; + char *lang; + int i, i_chosen = 0; + + while (language_enumerator->enumerate(language_enumerator, &lang)) + { + for (i = 0; i < lang_count; i++) + { + if (streq(lang, languages[i])) + { + match = TRUE; + i_chosen = i; + break; + } + } + if (match) + { + break; + } + } + return languages[i_chosen]; +} + +/** + * Described in header. + */ +char* imv_lang_string_select_string(imv_lang_string_t lang_string[], char *lang) +{ + char *string; + int i = 0; + + if (!lang_string) + { + return NULL; + } + + string = lang_string[0].string; + while (lang_string[i].lang) + { + if (streq(lang, lang_string[i].lang)) + { + string = lang_string[i].string; + break; + } + i++; + } + return string; +} diff --git a/src/libimcv/imv/imv_lang_string.h b/src/libimcv/imv/imv_lang_string.h new file mode 100644 index 000000000..56b4572f8 --- /dev/null +++ b/src/libimcv/imv/imv_lang_string.h @@ -0,0 +1,67 @@ +/* + * Copyright (C) 2012 Andreas Steffen + * HSR Hochschule fuer Technik Rapperswil + * + * This program is free software; you can redistribute it and/or modify it + * under the terms of the GNU General Public License as published by the + * Free Software Foundation; either version 2 of the License, or (at your + * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>. + * + * This program is distributed in the hope that it will be useful, but + * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY + * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License + * for more details. + */ + +/** + * + * @defgroup imv_lang_string_t imv_lang_string + * @{ @ingroup libimcv_imv + */ + +#ifndef IMV_LANG_STRING_H_ +#define IMV_LANG_STRING_H_ + +#include <library.h> +#include <collections/enumerator.h> + +typedef struct imv_lang_string_t imv_lang_string_t; + +/** + * Define a language string entry + */ +struct imv_lang_string_t { + + /** + * language code + */ + char *lang; + + /** + * UTF-8 string in the corresponding language + */ + char *string; + +}; + +/** + * Select the preferred language + * + * @param language_enumerator enumerator over user preferred languages + * @param languages string array of available languages + * @param lang_count number of available languages + * @return selected language as a language code + */ +char* imv_lang_string_select_lang(enumerator_t *language_enumerator, + char* languages[], int lang_count); + +/** + * Select the preferred language string + * + * @param lang_string multi-lingual array of strings + * @param lang language code of preferred language + * @return selected string + */ +char* imv_lang_string_select_string(imv_lang_string_t lang_string[], char *lang); + +#endif /** IMV_LANG_STRING_H_ @}*/ diff --git a/src/libimcv/imv/imv_msg.c b/src/libimcv/imv/imv_msg.c new file mode 100644 index 000000000..642b47935 --- /dev/null +++ b/src/libimcv/imv/imv_msg.c @@ -0,0 +1,443 @@ +/* + * Copyright (C) 2012 Andreas Steffen + * HSR Hochschule fuer Technik Rapperswil + * + * This program is free software; you can redistribute it and/or modify it + * under the terms of the GNU General Public License as published by the + * Free Software Foundation; either version 2 of the License, or (at your + * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>. + * + * This program is distributed in the hope that it will be useful, but + * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY + * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License + * for more details. + */ + +#include "imv_msg.h" + +#include "ietf/ietf_attr.h" +#include "ietf/ietf_attr_assess_result.h" +#include "ietf/ietf_attr_remediation_instr.h" + +#include <tncif_names.h> + +#include <pen/pen.h> +#include <collections/linked_list.h> +#include <utils/debug.h> + +typedef struct private_imv_msg_t private_imv_msg_t; + +/** + * Private data of a imv_msg_t object. + * + */ +struct private_imv_msg_t { + + /** + * Public imv_msg_t interface. + */ + imv_msg_t public; + + /** + * Connection ID + */ + TNC_ConnectionID connection_id; + + /** + * source ID + */ + TNC_UInt32 src_id; + + /** + * destination ID + */ + TNC_UInt32 dst_id; + + /** + * PA-TNC message type + */ + pen_type_t msg_type; + + /** + * List of PA-TNC attributes to be sent + */ + linked_list_t *attr_list; + + /** + * PA-TNC message + */ + pa_tnc_msg_t *pa_msg; + + /** + * Assigned IMV agent + */ + imv_agent_t *agent; + + /** + * Assigned IMV state + */ + imv_state_t *state; +}; + +METHOD(imv_msg_t, get_src_id, TNC_UInt32, + private_imv_msg_t *this) +{ + return this->src_id; +} + +METHOD(imv_msg_t, get_dst_id, TNC_UInt32, + private_imv_msg_t *this) +{ + return this->dst_id; +} + +METHOD(imv_msg_t, set_msg_type, void, + private_imv_msg_t *this, pen_type_t msg_type) +{ + if (msg_type.vendor_id != this->msg_type.vendor_id || + msg_type.type != this->msg_type.type) + { + this->msg_type = msg_type; + this->dst_id = TNC_IMCID_ANY; + } +} + +METHOD(imv_msg_t, get_msg_type, pen_type_t, + private_imv_msg_t *this) +{ + return this->msg_type; +} + +METHOD(imv_msg_t, add_attribute, void, + private_imv_msg_t *this, pa_tnc_attr_t *attr) +{ + this->attr_list->insert_last(this->attr_list, attr); +} + +METHOD(imv_msg_t, send_, TNC_Result, + private_imv_msg_t *this, bool excl) +{ + pa_tnc_msg_t *pa_tnc_msg; + pa_tnc_attr_t *attr; + TNC_UInt32 msg_flags; + TNC_MessageType msg_type; + bool attr_added; + chunk_t msg; + enumerator_t *enumerator; + TNC_Result result = TNC_RESULT_SUCCESS; + + while (this->attr_list->get_count(this->attr_list)) + { + pa_tnc_msg = pa_tnc_msg_create(this->state->get_max_msg_len(this->state)); + attr_added = FALSE; + + enumerator = this->attr_list->create_enumerator(this->attr_list); + while (enumerator->enumerate(enumerator, &attr)) + { + if (pa_tnc_msg->add_attribute(pa_tnc_msg, attr)) + { + attr_added = TRUE; + } + else + { + if (attr_added) + { + break; + } + else + { + DBG1(DBG_IMV, "PA-TNC attribute too large to send, deleted"); + attr->destroy(attr); + } + } + this->attr_list->remove_at(this->attr_list, enumerator); + } + enumerator->destroy(enumerator); + + /* build and send the PA-TNC message via the IF-IMV interface */ + if (!pa_tnc_msg->build(pa_tnc_msg)) + { + pa_tnc_msg->destroy(pa_tnc_msg); + return TNC_RESULT_FATAL; + } + msg = pa_tnc_msg->get_encoding(pa_tnc_msg); + DBG3(DBG_IMV, "created PA-TNC message: %B", &msg); + + if (this->state->has_long(this->state) && this->agent->send_message_long) + { + excl = excl && this->state->has_excl(this->state) && + this->dst_id != TNC_IMCID_ANY; + msg_flags = excl ? TNC_MESSAGE_FLAGS_EXCLUSIVE : 0; + result = this->agent->send_message_long(this->src_id, + this->connection_id, msg_flags, msg.ptr, msg.len, + this->msg_type.vendor_id, this->msg_type.type, + this->dst_id); + } + else if (this->agent->send_message) + { + msg_type = (this->msg_type.vendor_id << 8) | + (this->msg_type.type & 0x000000ff); + result = this->agent->send_message(this->src_id, this->connection_id, + msg.ptr, msg.len, msg_type); + } + + pa_tnc_msg->destroy(pa_tnc_msg); + + if (result != TNC_RESULT_SUCCESS) + { + break; + } + } + return result; +} + +METHOD(imv_msg_t, send_assessment, TNC_Result, + private_imv_msg_t *this) +{ + TNC_IMV_Action_Recommendation rec; + TNC_IMV_Evaluation_Result eval; + pa_tnc_attr_t *attr; + chunk_t string = chunk_empty; + char *lang_code = NULL, *uri = NULL; + enumerator_t *e; + + /* Remove any attributes that have already been constructed */ + while (this->attr_list->remove_last(this->attr_list, (void**)&attr) == SUCCESS) + { + attr->destroy(attr); + } + + /* Send an IETF Assessment Result attribute if enabled */ + if (lib->settings->get_bool(lib->settings, "libimcv.assessment_result", + TRUE)) + { + this->state->get_recommendation(this->state, &rec, &eval); + attr = ietf_attr_assess_result_create(eval); + add_attribute(this, attr); + + /* Send IETF Remediation Instructions if available */ + if (eval != TNC_IMV_EVALUATION_RESULT_COMPLIANT) + { + e = this->agent->create_language_enumerator(this->agent, + this->state); + if (this->state->get_remediation_instructions(this->state, + e, &string, &lang_code, &uri)) + { + if (string.len && lang_code) + { + attr = ietf_attr_remediation_instr_create_from_string(string, + chunk_create(lang_code, strlen(lang_code))); + add_attribute(this, attr); + } + if (uri) + { + attr = ietf_attr_remediation_instr_create_from_uri( + chunk_create(uri, strlen(uri))); + add_attribute(this, attr); + } + } + e->destroy(e); + } + + /* send PA-TNC message with the excl flag set */ + return send_(this, TRUE); + } + return TNC_RESULT_SUCCESS; +} + +METHOD(imv_msg_t, receive, TNC_Result, + private_imv_msg_t *this, bool *fatal_error) +{ + enumerator_t *enumerator; + pa_tnc_attr_t *attr; + chunk_t msg; + + if (this->state->has_long(this->state)) + { + if (this->dst_id != TNC_IMVID_ANY) + { + DBG2(DBG_IMV, "IMV %u \"%s\" received message for Connection ID %u " + "from IMC %u to IMV %u", + this->agent->get_id(this->agent), + this->agent->get_name(this->agent), + this->connection_id, this->src_id, this->dst_id); + } + else + { + DBG2(DBG_IMV, "IMV %u \"%s\" received message for Connection ID %u " + "from IMC %u", this->agent->get_id(this->agent), + this->agent->get_name(this->agent), + this->connection_id, this->src_id); + } + } + else + { + DBG2(DBG_IMV, "IMV %u \"%s\" received message for Connection ID %u", + this->agent->get_id(this->agent), + this->agent->get_name(this->agent), + this->connection_id); + } + msg = this->pa_msg->get_encoding(this->pa_msg); + DBG3(DBG_IMV, "%B", &msg); + + switch (this->pa_msg->process(this->pa_msg)) + { + case SUCCESS: + break; + case VERIFY_ERROR: + { + imv_msg_t *error_msg; + TNC_Result result; + + error_msg = imv_msg_create_as_reply(&this->public); + + /* extract and copy by reference all error attributes */ + enumerator = this->pa_msg->create_error_enumerator(this->pa_msg); + while (enumerator->enumerate(enumerator, &attr)) + { + error_msg->add_attribute(error_msg, attr->get_ref(attr)); + } + enumerator->destroy(enumerator); + + /* + * send the PA-TNC message containing all error attributes + * with the excl flag set + */ + result = error_msg->send(error_msg, TRUE); + error_msg->destroy(error_msg); + return result; + } + case FAILED: + default: + return TNC_RESULT_FATAL; + } + + /* preprocess any received IETF standard error attributes */ + *fatal_error = this->pa_msg->process_ietf_std_errors(this->pa_msg); + + return TNC_RESULT_SUCCESS; +} + +METHOD(imv_msg_t, get_attribute_count, int, + private_imv_msg_t *this) +{ + return this->attr_list->get_count(this->attr_list); +} + +METHOD(imv_msg_t, create_attribute_enumerator, enumerator_t*, + private_imv_msg_t *this) +{ + return this->pa_msg->create_attribute_enumerator(this->pa_msg); +} + +METHOD(imv_msg_t, get_encoding, chunk_t, + private_imv_msg_t *this) +{ + if (this->pa_msg) + { + return this->pa_msg->get_encoding(this->pa_msg); + } + return chunk_empty; +} + +METHOD(imv_msg_t, destroy, void, + private_imv_msg_t *this) +{ + this->attr_list->destroy_offset(this->attr_list, + offsetof(pa_tnc_attr_t, destroy)); + DESTROY_IF(this->pa_msg); + free(this); +} + +/** + * See header + */ +imv_msg_t *imv_msg_create(imv_agent_t *agent, imv_state_t *state, + TNC_ConnectionID connection_id, + TNC_UInt32 src_id, TNC_UInt32 dst_id, + pen_type_t msg_type) +{ + private_imv_msg_t *this; + + INIT(this, + .public = { + .get_src_id = _get_src_id, + .get_dst_id = _get_dst_id, + .set_msg_type = _set_msg_type, + .get_msg_type = _get_msg_type, + .send = _send_, + .send_assessment = _send_assessment, + .receive = _receive, + .add_attribute = _add_attribute, + .get_attribute_count = _get_attribute_count, + .create_attribute_enumerator = _create_attribute_enumerator, + .get_encoding = _get_encoding, + .destroy = _destroy, + }, + .connection_id = connection_id, + .src_id = src_id, + .dst_id = dst_id, + .msg_type = msg_type, + .attr_list = linked_list_create(), + .agent = agent, + .state = state, + ); + + return &this->public; +} + +/** + * See header + */ +imv_msg_t* imv_msg_create_as_reply(imv_msg_t *msg) +{ + private_imv_msg_t *in; + TNC_UInt32 src_id; + + in = (private_imv_msg_t*)msg; + src_id = (in->dst_id != TNC_IMVID_ANY) ? + in->dst_id : in->agent->get_id(in->agent); + + return imv_msg_create(in->agent, in->state, in->connection_id, src_id, + in->src_id, in->msg_type); +} + +/** + * See header + */ +imv_msg_t *imv_msg_create_from_data(imv_agent_t *agent, imv_state_t *state, + TNC_ConnectionID connection_id, + TNC_MessageType msg_type, + chunk_t msg) +{ + TNC_VendorID msg_vid; + TNC_MessageSubtype msg_subtype; + + msg_vid = msg_type >> 8; + msg_subtype = msg_type & TNC_SUBTYPE_ANY; + + return imv_msg_create_from_long_data(agent, state, connection_id, + TNC_IMCID_ANY, agent->get_id(agent), + msg_vid, msg_subtype, msg); +} + +/** + * See header + */ +imv_msg_t *imv_msg_create_from_long_data(imv_agent_t *agent, imv_state_t *state, + TNC_ConnectionID connection_id, + TNC_UInt32 src_id, + TNC_UInt32 dst_id, + TNC_VendorID msg_vid, + TNC_MessageSubtype msg_subtype, + chunk_t msg) +{ + private_imv_msg_t *this; + + this = (private_imv_msg_t*)imv_msg_create(agent, state, + connection_id, src_id, dst_id, + pen_type_create(msg_vid, msg_subtype)); + this->pa_msg = pa_tnc_msg_create_from_data(msg); + + return &this->public; +} diff --git a/src/libimcv/imv/imv_msg.h b/src/libimcv/imv/imv_msg.h new file mode 100644 index 000000000..dfec169cc --- /dev/null +++ b/src/libimcv/imv/imv_msg.h @@ -0,0 +1,176 @@ +/* + * Copyright (C) 2012 Andreas Steffen + * HSR Hochschule fuer Technik Rapperswil + * + * This program is free software; you can redistribute it and/or modify it + * under the terms of the GNU General Public License as published by the + * Free Software Foundation; either version 2 of the License, or (at your + * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>. + * + * This program is distributed in the hope that it will be useful, but + * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY + * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License + * for more details. + */ + +/** + * @defgroup imv_msg_t imv_msg + * @{ @ingroup libimcv_imv + */ + +#ifndef IMV_MSG_H_ +#define IMV_MSG_H_ + +#include <imv/imv_agent.h> + +typedef struct imv_msg_t imv_msg_t; + +#include <library.h> + +/** + * Interface for a PA-TNC message handled by an IMV. + * + */ +struct imv_msg_t { + + /** + * Get source ID of PA-TNC message + * + * @return src ID + */ + TNC_UInt32 (*get_src_id)(imv_msg_t *this); + + /** + * Get destination ID of PA-TNC message + * + * @return destination ID + */ + TNC_UInt32 (*get_dst_id)(imv_msg_t *this); + + /** + * Set the type of a PA-TNC message + * + * @param msg_type message type + */ + void (*set_msg_type)(imv_msg_t *this, pen_type_t msg_type); + + /** + * Get the type of a PA-TNC message. + * + * @return message type + */ + pen_type_t (*get_msg_type)(imv_msg_t *this); + + /** + * Sends one or multiple PA-TNC messages + * + * @param excl set the excl message flag if supported + * @return TNC result code + */ + TNC_Result (*send)(imv_msg_t *this, bool excl); + + /** + * Send a PA-TNC message containing an IETF Assessment Result attribute + * + * @return TNC result code + */ + TNC_Result (*send_assessment)(imv_msg_t *this); + + /** + * Processes a received PA-TNC message + * + * @param fatal_error TRUE if IMC sent a fatal error message + * @return TNC result code + */ + TNC_Result (*receive)(imv_msg_t *this, bool *fatal_error); + + /** + * Add a PA-TNC attribute to the send queue + * + * @param attr PA-TNC attribute to be added + */ + void (*add_attribute)(imv_msg_t *this, pa_tnc_attr_t *attr); + + /** + * Get the number of PA-TNC attributes in the send queue + * + * @return number of PA-TNC attribute in send queue + */ + int (*get_attribute_count)(imv_msg_t *this); + + /** + * Enumerator over PA-TNC attributes contained in the PA-TNC message + * + * @return PA-TNC attribute enumerator + */ + enumerator_t* (*create_attribute_enumerator)(imv_msg_t *this); + + /** + * Get the full encoding of an IMV message. + * + * @return message encoding, internal data + */ + chunk_t (*get_encoding)(imv_msg_t *this); + + /** + * Destroys a imv_msg_t object. + */ + void (*destroy)(imv_msg_t *this); +}; + +/** + * Create a wrapper for an outbound message + * + * @param agent IMV agent responsible for the message + * @param state IMV state for the given connection ID + * @param connection_id connection ID + * @param src_id source IMV ID + * @param dst_id destination IMC ID + * @param msg_type PA-TNC message type + */ +imv_msg_t* imv_msg_create(imv_agent_t *agent, imv_state_t *state, + TNC_ConnectionID connection_id, + TNC_UInt32 src_id, TNC_UInt32 dst_id, + pen_type_t msg_type); + +/** + * Create a wrapper for an outbound message based on a received message + * + * @param msg received message the reply is based on + */ +imv_msg_t* imv_msg_create_as_reply(imv_msg_t *msg); + +/** + * Create a wrapper around message data received via the legacy IF-IMV interface + * + * @param agent IMV agent responsible for the message + * @param state IMV state for the given connection ID + * @param connection_id connection ID + * @param msg_type PA-TNC message type + * @param msg received PA-TNC message blob + */ +imv_msg_t* imv_msg_create_from_data(imv_agent_t *agent, imv_state_t *state, + TNC_ConnectionID connection_id, + TNC_MessageType msg_type, + chunk_t msg); + +/** + * Create a wrapper around message data received via the long IF-IMV interface + * + * @param agent IMV agent responsible for the message + * @param state IMV state for the given connection ID + * @param connection_id connection ID + * @param src_id source IMC ID + * @param dst_id destination IMV ID + * @param msg_vid PA-TNC message vendor ID + * @param msg_subtype PA-TNC subtype + * @param msg received PA-TNC message blob + */ +imv_msg_t* imv_msg_create_from_long_data(imv_agent_t *agent, imv_state_t *state, + TNC_ConnectionID connection_id, + TNC_UInt32 src_id, TNC_UInt32 dst_id, + TNC_VendorID msg_vid, + TNC_MessageSubtype msg_subtype, + chunk_t msg); + +#endif /** IMV_MSG_H_ @}*/ diff --git a/src/libimcv/imv/imv_policy_manager.c b/src/libimcv/imv/imv_policy_manager.c new file mode 100644 index 000000000..61e0cd05b --- /dev/null +++ b/src/libimcv/imv/imv_policy_manager.c @@ -0,0 +1,359 @@ +/* + * Copyright (C) 2013 Andreas Steffen + * HSR Hochschule fuer Technik Rapperswil + * + * This program is free software; you can redistribute it and/or modify it + * under the terms of the GNU General Public License as published by the + * Free Software Foundation; either version 2 of the License, or (at your + * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>. + * + * This program is distributed in the hope that it will be useful, but + * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY + * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License + * for more details. + */ + +#include "imv_policy_manager_usage.h" +#include "imv_workitem.h" + +#include <library.h> +#include <utils/debug.h> + +#include <stdlib.h> +#include <stdio.h> +#include <time.h> + +/* The default policy group #1 is assumed to always exist */ +#define DEFAULT_GROUP_ID 1 + +/** + * global debug output variables + */ +static int debug_level = 1; +static bool stderr_quiet = FALSE; + +/** + * attest dbg function + */ +static void stderr_dbg(debug_t group, level_t level, char *fmt, ...) +{ + va_list args; + + if (level <= debug_level) + { + if (!stderr_quiet) + { + va_start(args, fmt); + vfprintf(stderr, fmt, args); + fprintf(stderr, "\n"); + va_end(args); + } + } +} + +/** + * Collect all enforcements by iterating up through parent groups + */ +static bool iterate_enforcements(database_t *db, int device_id, int session_id, + int group_id) +{ + int id, type, file, dir, arg_int, parent, policy, max_age; + int p_rec_fail, p_rec_noresult, e_rec_fail, e_rec_noresult, latest_rec; + bool latest_success; + char *argument; + time_t now; + enumerator_t *e, *e1, *e2; + + now = time(NULL); + + while (group_id) + { + e1 = db->query(db, + "SELECT e.id, p.type, p.argument, p.file, p.dir, p.rec_fail, " + "p.rec_noresult, e.policy, e.max_age, e.rec_fail, e.rec_noresult " + "FROM enforcements AS e JOIN policies as p ON e.policy = p.id " + "WHERE e.group_id = ?", DB_INT, group_id, + DB_INT, DB_INT, DB_TEXT, DB_INT, DB_INT, DB_INT, DB_INT, + DB_INT, DB_INT, DB_INT, DB_INT); + if (!e1) + { + return FALSE; + } + while (e1->enumerate(e1, &id, &type, &argument, &file, &dir, + &p_rec_fail, &p_rec_noresult, &policy, &max_age, + &e_rec_fail, &e_rec_noresult)) + { + /* check if the latest measurement of the device was successful */ + latest_success = FALSE; + + if (device_id) + { + e2 = db->query(db, + "SELECT r.rec FROM results AS r " + "JOIN sessions AS s ON s.id = r.session " + "WHERE r.policy = ? AND s.device = ? AND s.time > ? " + "ORDER BY s.time DESC", + DB_INT, policy, DB_INT, device_id, + DB_UINT, now - max_age, DB_INT); + if (!e2) + { + e1->destroy(e1); + return FALSE; + } + if (e2->enumerate(e2, &latest_rec) && + latest_rec == TNC_IMV_ACTION_RECOMMENDATION_ALLOW) + { + latest_success = TRUE; + } + e2->destroy(e2); + } + + if (latest_success) + { + /*skipping enforcement */ + printf("skipping enforcment %d\n", id); + continue; + } + + /* determine arg_int */ + switch ((imv_workitem_type_t)type) + { + case IMV_WORKITEM_FILE_REF_MEAS: + case IMV_WORKITEM_FILE_MEAS: + case IMV_WORKITEM_FILE_META: + arg_int = file; + break; + case IMV_WORKITEM_DIR_REF_MEAS: + case IMV_WORKITEM_DIR_MEAS: + case IMV_WORKITEM_DIR_META: + arg_int = dir; + break; + default: + arg_int = 0; + } + + /* insert a workitem */ + if (db->execute(db, NULL, + "INSERT INTO workitems (session, enforcement, type, arg_str, " + "arg_int, rec_fail, rec_noresult) VALUES (?, ?, ?, ?, ?, ?, ?)", + DB_INT, session_id, DB_INT, id, DB_INT, type, DB_TEXT, argument, + DB_INT, arg_int, DB_INT, e_rec_fail ? e_rec_fail : p_rec_fail, + DB_INT, e_rec_noresult ? e_rec_noresult : p_rec_noresult) != 1) + { + e1->destroy(e1); + fprintf(stderr, "could not insert workitem\n"); + return FALSE; + } + } + e1->destroy(e1); + + e = db->query(db, + "SELECT parent FROM groups WHERE id = ?", + DB_INT, group_id, DB_INT); + if (!e) + { + return FALSE; + } + if (e->enumerate(e, &parent)) + { + group_id = parent; + } + else + { + fprintf(stderr, "group information not found\n"); + group_id = 0; + } + e->destroy(e); + } + return TRUE; +} + +static bool policy_start(database_t *db, int session_id) +{ + enumerator_t *e; + int device_id, product_id, gid, group_id = DEFAULT_GROUP_ID; + u_int created; + + /* get session data */ + e = db->query(db, + "SELECT s.device, s.product, d.created FROM sessions AS s " + "LEFT JOIN devices AS d ON s.device = d.id WHERE s.id = ?", + DB_INT, session_id, DB_INT, DB_INT, DB_UINT); + if (!e || !e->enumerate(e, &device_id, &product_id, &created)) + { + DESTROY_IF(e); + fprintf(stderr, "session %d not found\n", session_id); + return FALSE; + } + e->destroy(e); + + /* if a device ID with a creation date exists, get all group memberships */ + if (device_id & created) + { + e = db->query(db, + "SELECT group_id FROM groups_members WHERE device_id = ?", + DB_INT, device_id, DB_INT); + if (!e) + { + return FALSE; + } + while (e->enumerate(e, &group_id)) + { + if (!iterate_enforcements(db, device_id, session_id, group_id)) + { + e->destroy(e); + return FALSE; + } + } + e->destroy(e); + + return TRUE; + } + + /* determine if a default product group exists */ + e = db->query(db, + "SELECT group_id FROM groups_product_defaults " + "WHERE product_id = ?", DB_INT, product_id, DB_INT); + if (!e) + { + return FALSE; + } + if (e->enumerate(e, &gid)) + { + group_id = gid; + } + e->destroy(e); + + if (device_id && !created) + { + /* assign a newly created device to a default group */ + if (db->execute(db, NULL, + "INSERT INTO groups_members (device_id, group_id) " + "VALUES (?, ?)", DB_INT, device_id, DB_INT, group_id) != 1) + { + fprintf(stderr, "could not assign device to a default group\n"); + return FALSE; + } + + /* set the creation date if it hasn't been set yet */ + if (db->execute(db, NULL, + "UPDATE devices SET created = ? WHERE id = ?", + DB_UINT, time(NULL), DB_INT, device_id) != 1) + { + fprintf(stderr, "creation date of device could not be set\n"); + return FALSE; + } + } + + return iterate_enforcements(db, device_id, session_id, group_id); +} + +static bool policy_stop(database_t *db, int session_id) +{ + enumerator_t *e; + int rec, policy; + char *result; + + e = db->query(db, + "SELECT w.rec_final, w.result, e.policy FROM workitems AS w " + "JOIN enforcements AS e ON w.enforcement = e.id " + "WHERE w.session = ? AND w.result IS NOT NULL", + DB_INT, session_id, DB_INT, DB_TEXT, DB_INT); + if (e) + { + while (e->enumerate(e, &rec, &result, &policy)) + { + db->execute(db, NULL, + "INSERT INTO results (session, policy, rec, result) " + "VALUES (?, ?, ?, ?)", DB_INT, session_id, DB_INT, policy, + DB_INT, rec, DB_TEXT, result); + } + e->destroy(e); + } + return db->execute(db, NULL, + "DELETE FROM workitems WHERE session = ?", + DB_UINT, session_id) >= 0; +} + +int main(int argc, char *argv[]) +{ + database_t *db; + char *uri, *tnc_session_id; + int session_id; + bool start, success; + + /* enable attest debugging hook */ + dbg = stderr_dbg; + + atexit(library_deinit); + + /* initialize library */ + if (!library_init(NULL)) + { + exit(SS_RC_LIBSTRONGSWAN_INTEGRITY); + } + if (!lib->plugins->load(lib->plugins, + lib->settings->get_str(lib->settings, "imv_policy_manager.load", + "sqlite"))) + { + exit(SS_RC_INITIALIZATION_FAILED); + } + + if (argc < 2) + { + usage(); + exit(SS_RC_INITIALIZATION_FAILED); + } + if (streq(argv[1], "start")) + { + start = TRUE; + } + else if (streq(argv[1], "stop")) + { + start = FALSE; + } + else + { + usage(); + exit(SS_RC_INITIALIZATION_FAILED); + } + + /* get session ID */ + tnc_session_id = getenv("TNC_SESSION_ID"); + if (!tnc_session_id) + { + fprintf(stderr, "environment variable TNC_SESSION_ID is not defined\n"); + exit(SS_RC_INITIALIZATION_FAILED); + } + session_id = atoi(tnc_session_id); + + /* attach IMV database */ + uri = lib->settings->get_str(lib->settings, "libimcv.database", NULL); + if (!uri) + { + fprintf(stderr, "database uri not defined.\n"); + exit(SS_RC_INITIALIZATION_FAILED); + } + + db = lib->db->create(lib->db, uri); + if (!db) + { + fprintf(stderr, "opening database failed.\n"); + exit(SS_RC_INITIALIZATION_FAILED); + } + + if (start) + { + success = policy_start(db, session_id); + } + else + { + success = policy_stop(db, session_id); + } + db->destroy(db); + + fprintf(stderr, "imv_policy_manager %s %s\n", start ? "start" : "stop", + success ? "successful" : "failed"); + + exit(EXIT_SUCCESS); +} diff --git a/src/libimcv/imv/imv_policy_manager_usage.c b/src/libimcv/imv/imv_policy_manager_usage.c new file mode 100644 index 000000000..3167a5441 --- /dev/null +++ b/src/libimcv/imv/imv_policy_manager_usage.c @@ -0,0 +1,29 @@ +/* + * Copyright (C) 2013 Andreas Steffen + * HSR Hochschule fuer Technik Rapperswil + * + * This program is free software; you can redistribute it and/or modify it + * under the terms of the GNU General Public License as published by the + * Free Software Foundation; either version 2 of the License, or (at your + * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>. + * + * This program is distributed in the hope that it will be useful, but + * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY + * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License + * for more details. + */ + +#include <stdio.h> + +#include "imv_policy_manager_usage.h" + +/** + * print imv_policy_manager usage info + */ +void usage(void) +{ + printf("\ +Usage:\n\ + imv_policy_manager start|stop\n"); +} + diff --git a/src/libimcv/imv/imv_policy_manager_usage.h b/src/libimcv/imv/imv_policy_manager_usage.h new file mode 100644 index 000000000..9c90d40c6 --- /dev/null +++ b/src/libimcv/imv/imv_policy_manager_usage.h @@ -0,0 +1,24 @@ +/* + * Copyright (C) 2013 Andreas Steffen + * HSR Hochschule fuer Technik Rapperswil + * + * This program is free software; you can redistribute it and/or modify it + * under the terms of the GNU General Public License as published by the + * Free Software Foundation; either version 2 of the License, or (at your + * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>. + * + * This program is distributed in the hope that it will be useful, but + * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY + * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License + * for more details. + */ + +#ifndef IMV_POLICY_MANAGER_USAGE_H_ +#define IMV_POLICY_MANAGER_USAGE_H_ + +/** + * print imv_policy_manager usage info + */ +void usage(void); + +#endif /* IMV_POLICY_MANAGER_USAGE_H_ */ diff --git a/src/libimcv/imv/imv_reason_string.c b/src/libimcv/imv/imv_reason_string.c new file mode 100644 index 000000000..d1447ec35 --- /dev/null +++ b/src/libimcv/imv/imv_reason_string.c @@ -0,0 +1,95 @@ +/* + * Copyright (C) 2012 Andreas Steffen + * HSR Hochschule fuer Technik Rapperswil + * + * This program is free software; you can redistribute it and/or modify it + * under the terms of the GNU General Public License as published by the + * Free Software Foundation; either version 2 of the License, or (at your + * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>. + * + * This program is distributed in the hope that it will be useful, but + * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY + * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License + * for more details. + */ + +#include "imv_reason_string.h" + +#include <utils/debug.h> + +typedef struct private_imv_reason_string_t private_imv_reason_string_t; + +/** + * Private data of an imv_reason_string_t object. + */ +struct private_imv_reason_string_t { + + /** + * Public members of imv_reason_string_t + */ + imv_reason_string_t public; + + /** + * Preferred language + */ + char *lang; + + /** + * Contains the concatenated reasons + */ + chunk_t reasons; + +}; + +METHOD(imv_reason_string_t, add_reason, void, + private_imv_reason_string_t *this, imv_lang_string_t reason[]) +{ + char *s_reason; + + s_reason = imv_lang_string_select_string(reason, this->lang); + + if (this->reasons.len) + { + /* append any further reasons */ + this->reasons = chunk_cat("mcc", this->reasons, chunk_from_chars('\n'), + chunk_create(s_reason, strlen(s_reason))); + } + else + { + /* add the first reason */ + this->reasons = chunk_clone(chunk_create(s_reason, strlen(s_reason))); + } +} + +METHOD(imv_reason_string_t, get_encoding, chunk_t, + private_imv_reason_string_t *this) +{ + return this->reasons; +} + +METHOD(imv_reason_string_t, destroy, void, + private_imv_reason_string_t *this) +{ + free(this->reasons.ptr); + free(this); +} + +/** + * Described in header. + */ +imv_reason_string_t *imv_reason_string_create(char *lang) +{ + private_imv_reason_string_t *this; + + INIT(this, + .public = { + .add_reason = _add_reason, + .get_encoding = _get_encoding, + .destroy = _destroy, + }, + .lang = lang, + ); + + return &this->public; +} + diff --git a/src/libimcv/imv/imv_reason_string.h b/src/libimcv/imv/imv_reason_string.h new file mode 100644 index 000000000..cb4c27f93 --- /dev/null +++ b/src/libimcv/imv/imv_reason_string.h @@ -0,0 +1,64 @@ +/* + * Copyright (C) 2012 Andreas Steffen + * HSR Hochschule fuer Technik Rapperswil + * + * This program is free software; you can redistribute it and/or modify it + * under the terms of the GNU General Public License as published by the + * Free Software Foundation; either version 2 of the License, or (at your + * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>. + * + * This program is distributed in the hope that it will be useful, but + * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY + * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License + * for more details. + */ + +/** + * + * @defgroup imv_reason_string_t imv_reason_string + * @{ @ingroup libimcv_imv + */ + +#ifndef IMV_REASON_STRING_H_ +#define IMV_REASON_STRING_H_ + +#include "imv_lang_string.h" + +#include <library.h> +#include <collections/linked_list.h> + +typedef struct imv_reason_string_t imv_reason_string_t; + +/** + * Defines and builds a TNC Reason String + */ +struct imv_reason_string_t { + + /** + * Add an individual remediation instruction to the string + * + * @param reason Multi-lingual reason string + */ + void (*add_reason)(imv_reason_string_t *this, imv_lang_string_t reason[]); + + /** + * Gets encoding of the reason string + * + * @return TNC reason string + */ + chunk_t (*get_encoding)(imv_reason_string_t *this); + + /** + * Destroys an imv_reason_string_t object + */ + void (*destroy)(imv_reason_string_t *this); +}; + +/** + * Creates an Reason String object + * + * @param lang Preferred language + */ + imv_reason_string_t* imv_reason_string_create(char *lang); + +#endif /** IMV_REASON_STRING_H_ @}*/ diff --git a/src/libimcv/imv/imv_remediation_string.c b/src/libimcv/imv/imv_remediation_string.c new file mode 100644 index 000000000..af82e1cdd --- /dev/null +++ b/src/libimcv/imv/imv_remediation_string.c @@ -0,0 +1,209 @@ +/* + * Copyright (C) 2012 Andreas Steffen + * HSR Hochschule fuer Technik Rapperswil + * + * This program is free software; you can redistribute it and/or modify it + * under the terms of the GNU General Public License as published by the + * Free Software Foundation; either version 2 of the License, or (at your + * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>. + * + * This program is distributed in the hope that it will be useful, but + * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY + * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License + * for more details. + */ + +#include "imv_remediation_string.h" + +#include <utils/debug.h> + +typedef struct private_imv_remediation_string_t private_imv_remediation_string_t; + +/** + * Private data of an imv_remediation_string_t object. + */ +struct private_imv_remediation_string_t { + + /** + * Public members of imv_remediation_string_t + */ + imv_remediation_string_t public; + + /** + * XML or plaintext encoding + */ + bool as_xml; + + /** + * Preferred language + */ + char *lang; + + /** + * Contains the concatenated remediation instructions + */ + chunk_t instructions; + +}; + +METHOD(imv_remediation_string_t, add_instruction, void, + private_imv_remediation_string_t *this, imv_lang_string_t title[], + imv_lang_string_t description[], imv_lang_string_t itemsheader[], + linked_list_t *item_list) +{ + char xml_format[] = " <instruction>\n" + " <title>%s</title>\n" + " <description>%s</description>\n" + "%s%s" + " </instruction>\n"; + char *instruction, *format, *item, *pos, *header, *items; + char *s_title, *s_description, *s_itemsheader; + size_t len; + + s_title = imv_lang_string_select_string(title, this->lang); + s_description = imv_lang_string_select_string(description, this->lang); + s_itemsheader = imv_lang_string_select_string(itemsheader, this->lang); + header = NULL; + items = NULL; + + if (s_itemsheader) + { + int header_len = strlen(s_itemsheader); + char *header_format; + + if (this->as_xml) + { + header_format = " <itemsheader>%s</itemsheader>\n"; + header_len += strlen(header_format) - 2; + } + else + { + header_format = "\n %s"; + header_len += 3; + } + header = malloc(header_len + 1); + sprintf(header, header_format, s_itemsheader); + } + + if (item_list && item_list->get_count(item_list)) + { + enumerator_t *enumerator; + int items_len = 0; + + /* compute total length of all items */ + enumerator = item_list->create_enumerator(item_list); + while (enumerator->enumerate(enumerator, &item)) + { + items_len += strlen(item); + } + enumerator->destroy(enumerator); + + if (this->as_xml) + { + items_len += 12 + 20 * item_list->get_count(item_list) + 13; + + pos = items = malloc(items_len + 1); + pos += sprintf(pos, " <items>\n"); + + enumerator = item_list->create_enumerator(item_list); + while (enumerator->enumerate(enumerator, &item)) + { + pos += sprintf(pos, " <item>%s</item>\n", item); + } + enumerator->destroy(enumerator); + + pos += sprintf(pos, " </items>\n"); + } + else + { + items_len += 5 * item_list->get_count(item_list); + + pos = items = malloc(items_len + 1); + + enumerator = item_list->create_enumerator(item_list); + while (enumerator->enumerate(enumerator, &item)) + { + pos += sprintf(pos, "\n %s", item); + } + enumerator->destroy(enumerator); + } + } + + len = strlen(s_title) + strlen(s_description); + if (header) + { + len += strlen(header); + } + if (items) + { + len += strlen(items); + } + + if (this->as_xml) + { + format = xml_format; + len += strlen(xml_format) - 8; + } + else + { + format = this->instructions.len ? "\n%s\n %s%s%s" : "%s\n %s%s%s"; + len += 4; + } + instruction = malloc(len + 1); + sprintf(instruction, format, s_title, s_description, header ? header : "", + items ? items : ""); + free(header); + free(items); + this->instructions = chunk_cat("mm", this->instructions, + chunk_create(instruction, strlen(instruction))); +} + +METHOD(imv_remediation_string_t, get_encoding, chunk_t, + private_imv_remediation_string_t *this) +{ + char xml_header[] = "<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n" + "<remediationinstructions>\n"; + char xml_trailer[] = "</remediationinstructions>"; + + if (!this->instructions.len) + { + return chunk_empty; + } + if (this->as_xml) + { + this->instructions = chunk_cat("cmc", + chunk_create(xml_header, strlen(xml_header)), + this->instructions, + chunk_create(xml_trailer, strlen(xml_trailer)) + ); + } + return this->instructions; +} + +METHOD(imv_remediation_string_t, destroy, void, + private_imv_remediation_string_t *this) +{ + free(this->instructions.ptr); + free(this); +} + +/** + * Described in header. + */ +imv_remediation_string_t *imv_remediation_string_create(bool as_xml, char *lang) +{ + private_imv_remediation_string_t *this; + + INIT(this, + .public = { + .add_instruction = _add_instruction, + .get_encoding = _get_encoding, + .destroy = _destroy, + }, + .as_xml = as_xml, + .lang = lang, + ); + + return &this->public; +} + diff --git a/src/libimcv/imv/imv_remediation_string.h b/src/libimcv/imv/imv_remediation_string.h new file mode 100644 index 000000000..605013abb --- /dev/null +++ b/src/libimcv/imv/imv_remediation_string.h @@ -0,0 +1,72 @@ +/* + * Copyright (C) 2012 Andreas Steffen + * HSR Hochschule fuer Technik Rapperswil + * + * This program is free software; you can redistribute it and/or modify it + * under the terms of the GNU General Public License as published by the + * Free Software Foundation; either version 2 of the License, or (at your + * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>. + * + * This program is distributed in the hope that it will be useful, but + * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY + * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License + * for more details. + */ + +/** + * + * @defgroup imv_remediation_string_t imv_remediation_string + * @{ @ingroup libimcv_imv + */ + +#ifndef IMV_REMEDIATION_STRING_H_ +#define IMV_REMEDIATION_STRING_H_ + +#include "imv_lang_string.h" + +#include <library.h> +#include <collections/linked_list.h> + +typedef struct imv_remediation_string_t imv_remediation_string_t; + +/** + * Defines and builds an IETF Remediation Instructions String + */ +struct imv_remediation_string_t { + + /** + * Add an individual remediation instruction to the string + * + * @param title instruction title + * @param description instruction description + * @param itemsheader optional items header or NULL + * @param items optional items list or NULL + */ + void (*add_instruction)(imv_remediation_string_t *this, + imv_lang_string_t title[], + imv_lang_string_t description[], + imv_lang_string_t itemsheader[], + linked_list_t *items); + + /** + * Gets the plaintext or XML encoding of the remediation instructions + * + * @return remediation instructions string + */ + chunk_t (*get_encoding)(imv_remediation_string_t *this); + + /** + * Destroys an imv_remediation_string_t object + */ + void (*destroy)(imv_remediation_string_t *this); +}; + +/** + * Creates an IETF Remediation Instructions String object + * + * @param as_xml XML encoding if TRUE, plaintext otherwise + * @param lang Preferred language + */ + imv_remediation_string_t* imv_remediation_string_create(bool as_xml, char *lang); + +#endif /** IMV_REMEDIATION_STRING_H_ @}*/ diff --git a/src/libimcv/imv/imv_session.c b/src/libimcv/imv/imv_session.c new file mode 100644 index 000000000..754f1f74c --- /dev/null +++ b/src/libimcv/imv/imv_session.c @@ -0,0 +1,171 @@ +/* + * Copyright (C) 2013 Andreas Steffen + * HSR Hochschule fuer Technik Rapperswil + * + * This program is free software; you can redistribute it and/or modify it + * under the terms of the GNU General Public License as published by the + * Free Software Foundation; either version 2 of the License, or (at your + * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>. + * + * This program is distributed in the hope that it will be useful, but + * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY + * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License + * for more details. + */ + +#include "imv_session.h" + +#include <utils/debug.h> + +typedef struct private_imv_session_t private_imv_session_t; + +/** + * Private data of a imv_session_t object. + */ +struct private_imv_session_t { + + /** + * Public imv_session_t interface. + */ + imv_session_t public; + + /** + * Unique Session ID + */ + int session_id; + + /** + * TNCCS connection ID + */ + TNC_ConnectionID conn_id; + + /** + * Have the workitems been generated? + */ + bool policy_started; + + /** + * List of worklist items + */ + linked_list_t *workitems; + + /** + * Reference count + */ + refcount_t ref; + +}; + +METHOD(imv_session_t, get_session_id, int, + private_imv_session_t *this) +{ + return this->session_id; +} + +METHOD(imv_session_t, get_connection_id, TNC_ConnectionID, + private_imv_session_t *this) +{ + return this->conn_id; +} + +METHOD(imv_session_t, set_policy_started, void, + private_imv_session_t *this, bool start) +{ + this->policy_started = start; +} + +METHOD(imv_session_t, get_policy_started, bool, + private_imv_session_t *this) +{ + return this->policy_started; +} + +METHOD(imv_session_t, insert_workitem, void, + private_imv_session_t *this, imv_workitem_t *workitem) +{ + this->workitems->insert_last(this->workitems, workitem); +} + +METHOD(imv_session_t, remove_workitem, void, + private_imv_session_t *this, enumerator_t *enumerator) +{ + this->workitems->remove_at(this->workitems, enumerator); +} + +METHOD(imv_session_t, create_workitem_enumerator, enumerator_t*, + private_imv_session_t *this) +{ + if (!this->policy_started) + { + return NULL; + } + return this->workitems->create_enumerator(this->workitems); +} + +METHOD(imv_session_t, get_workitem_count, int, + private_imv_session_t *this, TNC_IMVID imv_id) +{ + enumerator_t *enumerator; + imv_workitem_t *workitem; + int count = 0; + + enumerator = this->workitems->create_enumerator(this->workitems); + while (enumerator->enumerate(enumerator, &workitem)) + { + if (workitem->get_imv_id(workitem) == imv_id) + { + count++; + } + } + enumerator->destroy(enumerator); + + return count; +} + +METHOD(imv_session_t, get_ref, imv_session_t*, + private_imv_session_t *this) +{ + ref_get(&this->ref); + + return &this->public; +} + +METHOD(imv_session_t, destroy, void, + private_imv_session_t *this) +{ + if (ref_put(&this->ref)) + { + this->workitems->destroy_offset(this->workitems, + offsetof(imv_workitem_t, destroy)); + free(this); + } +} + +/** + * See header + */ +imv_session_t *imv_session_create(int session_id, TNC_ConnectionID conn_id) +{ + private_imv_session_t *this; + + INIT(this, + .public = { + .get_session_id = _get_session_id, + .get_connection_id = _get_connection_id, + .set_policy_started = _set_policy_started, + .get_policy_started = _get_policy_started, + .insert_workitem = _insert_workitem, + .remove_workitem = _remove_workitem, + .create_workitem_enumerator = _create_workitem_enumerator, + .get_workitem_count = _get_workitem_count, + .get_ref = _get_ref, + .destroy = _destroy, + }, + .session_id = session_id, + .conn_id = conn_id, + .workitems = linked_list_create(), + .ref = 1, + ); + + return &this->public; +} diff --git a/src/libimcv/imv/imv_session.h b/src/libimcv/imv/imv_session.h new file mode 100644 index 000000000..6b94523b8 --- /dev/null +++ b/src/libimcv/imv/imv_session.h @@ -0,0 +1,113 @@ +/* + * Copyright (C) 2013 Andreas Steffen + * HSR Hochschule fuer Technik Rapperswil + * + * This program is free software; you can redistribute it and/or modify it + * under the terms of the GNU General Public License as published by the + * Free Software Foundation; either version 2 of the License, or (at your + * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>. + * + * This program is distributed in the hope that it will be useful, but + * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY + * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License + * for more details. + */ + +/** + * + * @defgroup imv_session_t imv_session + * @{ @ingroup libimcv_imv + */ + +#ifndef IMV_SESSION_H_ +#define IMV_SESSION_H_ + +#include "imv_workitem.h" + +#include <tncifimv.h> + +#include <library.h> + +typedef struct imv_session_t imv_session_t; + +/** + * IMV session interface + */ +struct imv_session_t { + + /** + * Get unique session ID + * + * @return Session ID + */ + int (*get_session_id)(imv_session_t *this); + + /** + * Get TNCCS Connection ID + * + * @return TNCCS Connection ID + */ + TNC_ConnectionID (*get_connection_id)(imv_session_t *this); + + /** + * Set policy_started status + * + * @param start TRUE if policy started, FALSE if policy stopped + */ + void (*set_policy_started)(imv_session_t *this, bool start); + + /** + * Get policy_started status + * + * @return TRUE if policy started, FALSE if policy stopped + */ + bool (*get_policy_started)(imv_session_t *this); + + /** + * Insert workitem into list + * + * @param workitem Workitem to be inserted + */ + void (*insert_workitem)(imv_session_t *this, imv_workitem_t *workitem); + + /** + * Remove workitem from list + * + * @param enumerator Enumerator pointing to workitem to be removed + */ + void (*remove_workitem)(imv_session_t *this, enumerator_t *enumerator); + + /** + * Create workitem enumerator + * + */ + enumerator_t* (*create_workitem_enumerator)(imv_session_t *this); + + /** + * Get number of workitem allocated to a given IMV + * + * @param imv_id IMV ID + * @return Number of workitems assigned to given IMV + */ + int (*get_workitem_count)(imv_session_t *this, TNC_IMVID imv_id); + + /** + * Get reference to session + */ + imv_session_t* (*get_ref)(imv_session_t*); + + /** + * Destroys an imv_session_t object + */ + void (*destroy)(imv_session_t *this); +}; + +/** + * Create an imv_session_t instance + * + * @param session_id Unique Session ID + * @param id Associated Connection ID + */ +imv_session_t* imv_session_create(int session_id, TNC_ConnectionID id); + +#endif /** IMV_SESSION_H_ @}*/ diff --git a/src/libimcv/imv/imv_state.h b/src/libimcv/imv/imv_state.h index 9e7a29a9f..791846bb1 100644 --- a/src/libimcv/imv/imv_state.h +++ b/src/libimcv/imv/imv_state.h @@ -1,5 +1,6 @@ /* - * Copyright (C) 2011 Andreas Steffen, HSR Hochschule fuer Technik Rapperswil + * Copyright (C) 2011-2013 Andreas Steffen + * HSR Hochschule fuer Technik Rapperswil * * This program is free software; you can redistribute it and/or modify it * under the terms of the GNU General Public License as published by the @@ -15,12 +16,14 @@ /** * * @defgroup imv_state_t imv_state - * @{ @ingroup imv_state + * @{ @ingroup libimcv_imv */ #ifndef IMV_STATE_H_ #define IMV_STATE_H_ +#include "imv_session.h" + #include <tncifimv.h> #include <library.h> @@ -33,9 +36,9 @@ typedef struct imv_state_t imv_state_t; struct imv_state_t { /** - * Get the TNCS connection ID attached to the state + * Get the TNCCS connection ID attached to the state * - * @return TNCS connection ID of the state + * @return TNCCS connection ID of the state */ TNC_ConnectionID (*get_connection_id)(imv_state_t *this); @@ -63,6 +66,65 @@ struct imv_state_t { void (*set_flags)(imv_state_t *this, bool has_long, bool has_excl); /** + * Set the maximum size of a PA-TNC message for this TNCCS connection + * + * @param max_msg_len maximum size of a PA-TNC message + */ + void (*set_max_msg_len)(imv_state_t *this, u_int32_t max_msg_len); + + /** + * Get the maximum size of a PA-TNC message for this TNCCS connection + * + * @return maximum size of a PA-TNC message + */ + u_int32_t (*get_max_msg_len)(imv_state_t *this); + + /** + * Set flags for completed actions + * + * @param flags Flags to be set + */ + void (*set_action_flags)(imv_state_t *this, u_int32_t flags); + + /** + * Get flags set for completed actions + * + * @return Flags set for completed actions + */ + u_int32_t (*get_action_flags)(imv_state_t *this); + + /** + * Set Access Requestor ID + * + * @param id_type Access Requestor TCG Standard ID Type + * @param id_value Access Requestor TCG Standard ID Value + * + */ + void (*set_ar_id)(imv_state_t *this, u_int32_t id_type, chunk_t id_value); + + /** + * Get Access Requestor ID + * + * @param id_type Access Requestor TCG Standard ID Type + * @return Access Requestor TCG Standard ID Value + */ + chunk_t (*get_ar_id)(imv_state_t *this, u_int32_t *id_type); + + /** + * Set session associated with TNCCS Connection + * + * @param session Session associated with TNCCS Connection + */ + void (*set_session)(imv_state_t *this, imv_session_t *session); + + /** + * Get session associated with TNCCS Connection + * + * @return Session associated with TNCCS Connection + */ + imv_session_t* (*get_session)(imv_state_t *this); + + /** * Change the connection state * * @param new_state new connection state @@ -92,15 +154,41 @@ struct imv_state_t { TNC_IMV_Evaluation_Result eval); /** + * Update IMV action recommendation and evaluation result + * + * @param rec IMV action recommendation + * @param eval IMV evaluation result + * + */ + void (*update_recommendation)(imv_state_t *this, + TNC_IMV_Action_Recommendation rec, + TNC_IMV_Evaluation_Result eval); + + /** * Get reason string based on the preferred language * - * @param preferred_language preferred language + * @param language_enumerator language enumerator * @param reason_string reason string - * @param language code language of the returned reason string + * @param reason_language language of the returned reason string * @return TRUE if a reason string was found */ - bool (*get_reason_string)(imv_state_t *this, chunk_t preferred_language, - chunk_t *reason_string, chunk_t *language_code); + bool (*get_reason_string)(imv_state_t *this, + enumerator_t *language_enumerator, + chunk_t *reason_string, char **reason_language); + + /** + * Get remediation instructions based on the preferred language + * + * @param language_enumerator language enumerator + * @param string remediation instruction string + * @param lang_code language of the remediation instructions + * @param uri remediation URI + * @return TRUE if remediation instructions were found + */ + bool (*get_remediation_instructions)(imv_state_t *this, + enumerator_t *language_enumerator, + chunk_t *string, char **lang_code, + char **uri); /** * Destroys an imv_state_t object diff --git a/src/libimcv/imv/imv_workitem.c b/src/libimcv/imv/imv_workitem.c new file mode 100644 index 000000000..a61a826bc --- /dev/null +++ b/src/libimcv/imv/imv_workitem.c @@ -0,0 +1,213 @@ +/* + * Copyright (C) 2013 Andreas Steffen + * HSR Hochschule fuer Technik Rapperswil + * + * This program is free software; you can redistribute it and/or modify it + * under the terms of the GNU General Public License as published by the + * Free Software Foundation; either version 2 of the License, or (at your + * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>. + * + * This program is distributed in the hope that it will be useful, but + * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY + * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License + * for more details. + */ + +#include "imv_workitem.h" + +#include <utils/debug.h> +#include <tncif_names.h> + +typedef struct private_imv_workitem_t private_imv_workitem_t; + +ENUM(imv_workitem_type_names, IMV_WORKITEM_PACKAGES, IMV_WORKITEM_UDP_PORT_BLOCK, + "PCKGS", + "UNSRC", + "FWDEN", + "PWDEN", + "FREFM", + "FMEAS", + "FMETA", + "DREFM", + "DMEAS", + "DMETA", + "TCPOP", + "TCPBL", + "UDPOP", + "UDPBL" +); + +/** + * Private data of a imv_workitem_t object. + * + */ +struct private_imv_workitem_t { + + /** + * Public imv_workitem_t interface. + */ + imv_workitem_t public; + + /** + * Primary workitem key + */ + int id; + + /** + * IMV ID + */ + TNC_IMVID imv_id; + + /** + * Workitem type + */ + imv_workitem_type_t type; + + /** + * Argument string + */ + char *arg_str; + + /** + * Argument integer + */ + int arg_int; + + /** + * Result string + */ + char *result; + + /** + * IMV action recommendation + */ + TNC_IMV_Action_Recommendation rec_fail; + + /** + * IMV action recommendation + */ + TNC_IMV_Action_Recommendation rec_noresult; + + /** + * IMV action recommendation + */ + TNC_IMV_Action_Recommendation rec_final; + +}; + +METHOD(imv_workitem_t, get_id, int, + private_imv_workitem_t *this) +{ + return this->id; +} + +METHOD(imv_workitem_t, set_imv_id, void, + private_imv_workitem_t *this, TNC_IMVID imv_id) +{ + this->imv_id = imv_id; +} + +METHOD(imv_workitem_t, get_imv_id, TNC_IMVID, + private_imv_workitem_t *this) +{ + return this->imv_id; +} + +METHOD(imv_workitem_t, get_type, imv_workitem_type_t, + private_imv_workitem_t *this) +{ + return this->type; +} + +METHOD(imv_workitem_t, get_arg_str, char*, + private_imv_workitem_t *this) +{ + return this->arg_str; +} + +METHOD(imv_workitem_t, get_arg_int, int, + private_imv_workitem_t *this) +{ + return this->arg_int; +} + +METHOD(imv_workitem_t, set_result, TNC_IMV_Action_Recommendation, + private_imv_workitem_t *this, char *result, TNC_IMV_Evaluation_Result eval) +{ + this->result = strdup(result); + switch (eval) + { + case TNC_IMV_EVALUATION_RESULT_COMPLIANT: + this->rec_final = TNC_IMV_ACTION_RECOMMENDATION_ALLOW; + break; + case TNC_IMV_EVALUATION_RESULT_NONCOMPLIANT_MINOR: + case TNC_IMV_EVALUATION_RESULT_NONCOMPLIANT_MAJOR: + this->rec_final = this->rec_fail; + break; + case TNC_IMV_EVALUATION_RESULT_ERROR: + case TNC_IMV_EVALUATION_RESULT_DONT_KNOW: + default: + this->rec_final = this->rec_noresult; + break; + } + DBG2(DBG_IMV, "IMV %d handled %N workitem %d: %N%s%s", this->imv_id, + imv_workitem_type_names, this->type, this->id, + TNC_IMV_Action_Recommendation_names, this->rec_final, + strlen(result) ? " - " : "", result); + + return this->rec_final; +} + +METHOD(imv_workitem_t, get_result, TNC_IMV_Action_Recommendation, + private_imv_workitem_t *this, char **result) +{ + if (result) + { + *result = this->result; + } + return this->rec_final; +} + +METHOD(imv_workitem_t, destroy, void, + private_imv_workitem_t *this) +{ + free(this->arg_str); + free(this->result); + free(this); +} + +/** + * See header + */ +imv_workitem_t *imv_workitem_create(int id, imv_workitem_type_t type, + char *arg_str, int arg_int, + TNC_IMV_Action_Recommendation rec_fail, + TNC_IMV_Action_Recommendation rec_noresult) +{ + private_imv_workitem_t *this; + + INIT(this, + .public = { + .get_id = _get_id, + .set_imv_id = _set_imv_id, + .get_imv_id = _get_imv_id, + .get_type = _get_type, + .get_arg_str = _get_arg_str, + .get_arg_int = _get_arg_int, + .set_result = _set_result, + .get_result = _get_result, + .destroy = _destroy, + }, + .id = id, + .imv_id = TNC_IMVID_ANY, + .type = type, + .arg_str = arg_str ? strdup(arg_str) : NULL, + .arg_int = arg_int, + .rec_fail = rec_fail, + .rec_noresult = rec_noresult, + .rec_final = TNC_IMV_ACTION_RECOMMENDATION_NO_RECOMMENDATION, + ); + + return &this->public; +} + diff --git a/src/libimcv/imv/imv_workitem.h b/src/libimcv/imv/imv_workitem.h new file mode 100644 index 000000000..f6ca3ea68 --- /dev/null +++ b/src/libimcv/imv/imv_workitem.h @@ -0,0 +1,138 @@ +/* + * Copyright (C) 2013 Andreas Steffen + * HSR Hochschule fuer Technik Rapperswil + * + * This program is free software; you can redistribute it and/or modify it + * under the terms of the GNU General Public License as published by the + * Free Software Foundation; either version 2 of the License, or (at your + * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>. + * + * This program is distributed in the hope that it will be useful, but + * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY + * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License + * for more details. + */ + +/** + * + * @defgroup imv_workitem_t imv_workitem + * @{ @ingroup libimcv_imv + */ + +#ifndef IMV_WORKITEM_H_ +#define IMV_WORKITEM_H_ + +#include <tncifimv.h> + +#include <library.h> + +typedef struct imv_workitem_t imv_workitem_t; +typedef enum imv_workitem_type_t imv_workitem_type_t; + +enum imv_workitem_type_t { + IMV_WORKITEM_PACKAGES = 1, + IMV_WORKITEM_UNKNOWN_SOURCE = 2, + IMV_WORKITEM_FORWARDING = 3, + IMV_WORKITEM_DEFAULT_PWD = 4, + IMV_WORKITEM_FILE_REF_MEAS = 5, + IMV_WORKITEM_FILE_MEAS = 6, + IMV_WORKITEM_FILE_META = 7, + IMV_WORKITEM_DIR_REF_MEAS = 8, + IMV_WORKITEM_DIR_MEAS = 9, + IMV_WORKITEM_DIR_META = 10, + IMV_WORKITEM_TCP_PORT_OPEN = 11, + IMV_WORKITEM_TCP_PORT_BLOCK = 12, + IMV_WORKITEM_UDP_PORT_OPEN = 13, + IMV_WORKITEM_UDP_PORT_BLOCK = 14 +}; + +extern enum_name_t *imv_workitem_type_names; + +/** + * IMV database interface + */ +struct imv_workitem_t { + + /** + * Get primary workitem key + * + * @return Primary workitem key + */ + int (*get_id)(imv_workitem_t *this); + + /** + * Get workitem type + * + * @return Workitem type + */ + imv_workitem_type_t (*get_type)(imv_workitem_t *this); + + /** + * Set IMV ID + * + * @param id IMV ID + */ + void (*set_imv_id)(imv_workitem_t *this, TNC_IMVID imv_id); + + /** + * Get IMV ID + * + * @return IMV ID + */ + TNC_IMVID (*get_imv_id)(imv_workitem_t *this); + + /** + * Get string argument + * + * @return Argument string + */ + char* (*get_arg_str)(imv_workitem_t *this); + + /** + * Get integer argument + * + * @return Argument integer + */ + int (*get_arg_int)(imv_workitem_t *this); + + /** + * Set result string + * + * @param result Result string + * @param eval Evaluation Result + * @return Action Recommendation + */ + TNC_IMV_Action_Recommendation (*set_result)(imv_workitem_t *this, + char *result, TNC_IMV_Evaluation_Result eval); + + /** + * Set result string + * + * @param result Result string + * @return Action Recommendatino + */ + TNC_IMV_Action_Recommendation (*get_result)(imv_workitem_t *this, + char **result); + + /** + * Destroys an imv_workitem_t object + */ + void (*destroy)(imv_workitem_t *this); +}; + +/** + * Create an imv_workitem_t instance + * + * @param id Primary workitem key + * @param type Workitem type + * @param arg_str String argument + * @param arg_int Integer argument + * @param rec_fail Recommendation with minor/major non-compliance case + * @param rec_noresult Recommendation in don't know/error case + */ +imv_workitem_t *imv_workitem_create(int id, imv_workitem_type_t type, + char *arg_str, int arg_int, + TNC_IMV_Action_Recommendation rec_fail, + TNC_IMV_Action_Recommendation rec_noresult); + +#endif /** IMV_WORKITEM_H_ @}*/ diff --git a/src/libimcv/imv/tables.sql b/src/libimcv/imv/tables.sql new file mode 100644 index 000000000..4cc959e09 --- /dev/null +++ b/src/libimcv/imv/tables.sql @@ -0,0 +1,234 @@ +/* IMV PTS SQLite database */ + +DROP TABLE IF EXISTS directories; +CREATE TABLE directories ( + id INTEGER NOT NULL PRIMARY KEY AUTOINCREMENT, + path TEXT NOT NULL +); +DROP INDEX IF EXISTS directories_path; +CREATE INDEX directories_path ON directories ( + path +); + +DROP TABLE IF EXISTS files; +CREATE TABLE files ( + id INTEGER NOT NULL PRIMARY KEY AUTOINCREMENT, + dir INTEGER DEFAULT 0 REFERENCES directories(id), + name TEXT NOT NULL +); +DROP INDEX IF EXISTS files_name; +CREATE INDEX files_name ON files ( + name +); + +DROP TABLE IF EXISTS products; +CREATE TABLE products ( + id INTEGER NOT NULL PRIMARY KEY AUTOINCREMENT, + name TEXT NOT NULL +); +DROP INDEX IF EXISTS products_name; +CREATE INDEX products_name ON products ( + name +); + +DROP TABLE IF EXISTS algorithms; +CREATE TABLE algorithms ( + id INTEGER PRIMARY KEY, + name VARCHAR(20) not NULL +); + +DROP TABLE IF EXISTS file_hashes; +CREATE TABLE file_hashes ( + id INTEGER NOT NULL PRIMARY KEY AUTOINCREMENT, + file INTEGER NOT NULL REFERENCES files(id), + product INTEGER NOT NULL REFERENCES products(id), + device INTEGER DEFAULT 0, + key INTEGER DEFAULT 0 REFERENCES keys(id), + algo INTEGER NOT NULL REFERENCES algorithms(id), + hash BLOB NOT NULL +); + +DROP TABLE IF EXISTS keys; +CREATE TABLE keys ( + id INTEGER NOT NULL PRIMARY KEY AUTOINCREMENT, + keyid BLOB NOT NULL, + owner TEXT NOT NULL +); +DROP INDEX IF EXISTS keys_keyid; +CREATE INDEX keys_keyid ON keys ( + keyid +); +DROP INDEX IF EXISTS keys_owner; +CREATE INDEX keys_owner ON keys ( + owner +); + +DROP TABLE IF EXISTS groups; +CREATE TABLE groups ( + id INTEGER NOT NULL PRIMARY KEY, + name VARCHAR(50) NOT NULL UNIQUE, + parent INTEGER +); + +DROP TABLE IF EXISTS groups_members; +CREATE TABLE groups_members ( + id INTEGER NOT NULL PRIMARY KEY AUTOINCREMENT, + group_id INTEGER NOT NULL REFERENCES groups(id), + device_id INTEGER NOT NULL REFERENCES devices(id), + UNIQUE (group_id, device_id) +); + +DROP TABLE IF EXISTS groups_product_defaults; +CREATE TABLE groups_product_defaults ( + id INTEGER NOT NULL PRIMARY KEY AUTOINCREMENT, + group_id INTEGER NOT NULL REFERENCES groups(id), + product_id INTEGER NOT NULL REFERENCES products(id), + UNIQUE (group_id, product_id) +); + +DROP TABLE IF EXISTS policies; +CREATE TABLE policies ( + id INTEGER NOT NULL PRIMARY KEY AUTOINCREMENT, + type INTEGER NOT NULL, + name VARCHAR(100) NOT NULL UNIQUE, + argument TEXT DEFAULT '' NOT NULL, + rec_fail INTEGER NOT NULL, + rec_noresult INTEGER NOT NULL, + file INTEGER DEFAULT 0 REFERENCES files(id), + dir INTEGER DEFAULT 0 REFERENCES directories(id) +); + +DROP TABLE IF EXISTS enforcements; +CREATE TABLE enforcements ( + id INTEGER NOT NULL PRIMARY KEY AUTOINCREMENT, + policy INTEGER NOT NULL REFERENCES policies(id), + group_id INTEGER NOT NULL REFERENCES groups(id), + rec_fail INTEGER, + rec_noresult INTEGER, + max_age INTEGER NOT NULL, + UNIQUE (policy, group_id) +); + +DROP TABLE IF EXISTS sessions; +CREATE TABLE sessions ( + id INTEGER NOT NULL PRIMARY KEY AUTOINCREMENT, + time INTEGER NOT NULL, + connection INTEGER NOT NULL, + identity INTEGER DEFAULT 0 REFERENCES identities(id), + device INTEGER DEFAULT 0 REFERENCES devices(id), + product INTEGER DEFAULT 0 REFERENCES products(id), + rec INTEGER DEFAULT 3 +); + +DROP TABLE IF EXISTS workitems; +CREATE TABLE workitems ( + id INTEGER NOT NULL PRIMARY KEY AUTOINCREMENT, + session INTEGER NOT NULL REFERENCES sessions(id), + enforcement INTEGER NOT NULL REFERENCES enforcements(id), + type INTEGER NOT NULL, + arg_str TEXT, + arg_int INTEGER DEFAULT 0, + rec_fail INTEGER NOT NULL, + rec_noresult INTEGER NOT NULL, + rec_final INTEGER, + result TEXT +); +DROP INDEX IF EXISTS workitems_session; +CREATE INDEX workitems_sessions ON workitems ( + session +); + +DROP TABLE IF EXISTS results; +CREATE TABLE results ( + id INTEGER NOT NULL PRIMARY KEY AUTOINCREMENT, + session INTEGER NOT NULL REFERENCES measurements(id), + policy INTEGER NOT NULL REFERENCES policies(id), + rec INTEGER NOT NULL, + result TEXT NOT NULL +); +DROP INDEX IF EXISTS results_session; +CREATE INDEX results_session ON results ( + session +); + +DROP TABLE IF EXISTS components; +CREATE TABLE components ( + id INTEGER NOT NULL PRIMARY KEY AUTOINCREMENT, + vendor_id INTEGER NOT NULL, + name INTEGER NOT NULL, + qualifier INTEGER DEFAULT 0 +); + + +DROP TABLE IF EXISTS key_component; +CREATE TABLE key_component ( + key INTEGER NOT NULL, + component INTEGER NOT NULL, + depth INTEGER DEFAULT 0, + seq_no INTEGER DEFAULT 0, + PRIMARY KEY (key, component) +); + + +DROP TABLE IF EXISTS component_hashes; +CREATE TABLE component_hashes ( + component INTEGER NOT NULL, + key INTEGER NOT NULL, + seq_no INTEGER NOT NULL, + pcr INTEGER NOT NULL, + algo INTEGER NOT NULL, + hash BLOB NOT NULL, + PRIMARY KEY(component, key, seq_no, algo) +); + +DROP TABLE IF EXISTS packages; +CREATE TABLE packages ( + id INTEGER NOT NULL PRIMARY KEY AUTOINCREMENT, + name TEXT NOT NULL, + blacklist INTEGER DEFAULT 0 +); +DROP INDEX IF EXISTS packages_name; +CREATE INDEX packages_name ON packages ( + name +); + +DROP TABLE IF EXISTS versions; +CREATE TABLE versions ( + id INTEGER NOT NULL PRIMARY KEY AUTOINCREMENT, + package INTEGER NOT NULL REFERENCES packages(id), + product INTEGER NOT NULL REFERENCES products(id), + release TEXT NOT NULL, + security INTEGER DEFAULT 0, + blacklist INTEGER DEFAULT 0, + time INTEGER DEFAULT 0 +); +DROP INDEX IF EXISTS versions_release; +CREATE INDEX versions_release ON versions ( + release +); +DROP INDEX IF EXISTS versions_package_product; +CREATE INDEX versions_package_product ON versions ( + package, product +); + +DROP TABLE IF EXISTS devices; +CREATE TABLE devices ( + id INTEGER NOT NULL PRIMARY KEY AUTOINCREMENT, + description TEXT DEFAULT '', + value TEXT NOT NULL, + product INTEGER REFERENCES products(id), + created INTEGER +); +DROP INDEX IF EXISTS devices_id; +CREATE INDEX devices_value ON devices ( + value +); + +DROP TABLE IF EXISTS identities; +CREATE TABLE identities ( + id INTEGER NOT NULL PRIMARY KEY AUTOINCREMENT, + type INTEGER NOT NULL, + value BLOB NOT NULL, + UNIQUE (type, value) +); + diff --git a/src/libimcv/ita/ita_attr.c b/src/libimcv/ita/ita_attr.c index ec23c11ea..f3956717d 100644 --- a/src/libimcv/ita/ita_attr.c +++ b/src/libimcv/ita/ita_attr.c @@ -1,5 +1,5 @@ /* - * Copyright (C) 2011 Andreas Steffen + * Copyright (C) 2011-2012 Andreas Steffen * HSR Hochschule fuer Technik Rapperswil * * This program is free software; you can redistribute it and/or modify it @@ -15,9 +15,21 @@ #include "ita_attr.h" #include "ita/ita_attr_command.h" +#include "ita/ita_attr_dummy.h" +#include "ita/ita_attr_get_settings.h" +#include "ita/ita_attr_settings.h" +#include "ita/ita_attr_angel.h" +#include "ita/ita_attr_device_id.h" -ENUM(ita_attr_names, ITA_ATTR_COMMAND, ITA_ATTR_COMMAND, +ENUM(ita_attr_names, ITA_ATTR_COMMAND, ITA_ATTR_DEVICE_ID, "Command", + "Dummy", + "Get Settings", + "Settings", + "Start Angel", + "Stop Angel", + "Echo", + "Device ID" ); /** @@ -29,6 +41,18 @@ pa_tnc_attr_t* ita_attr_create_from_data(u_int32_t type, chunk_t value) { case ITA_ATTR_COMMAND: return ita_attr_command_create_from_data(value); + case ITA_ATTR_DUMMY: + return ita_attr_dummy_create_from_data(value); + case ITA_ATTR_GET_SETTINGS: + return ita_attr_get_settings_create_from_data(value); + case ITA_ATTR_SETTINGS: + return ita_attr_settings_create_from_data(value); + case ITA_ATTR_START_ANGEL: + return ita_attr_angel_create_from_data(TRUE, value); + case ITA_ATTR_STOP_ANGEL: + return ita_attr_angel_create_from_data(FALSE, value); + case ITA_ATTR_DEVICE_ID: + return ita_attr_device_id_create_from_data(value); default: return NULL; } diff --git a/src/libimcv/ita/ita_attr.h b/src/libimcv/ita/ita_attr.h index 82debdd1e..ac5d8abaa 100644 --- a/src/libimcv/ita/ita_attr.h +++ b/src/libimcv/ita/ita_attr.h @@ -1,5 +1,5 @@ /* - * Copyright (C) 2011 Andreas Steffen + * Copyright (C) 2011-2012 Andreas Steffen * HSR Hochschule fuer Technik Rapperswil * * This program is free software; you can redistribute it and/or modify it @@ -14,8 +14,8 @@ */ /** - * @defgroup ita_attrt ita_attr - * @{ @ingroup ita_attr + * @defgroup ita_attr ita_attr + * @{ @ingroup libimcv */ #ifndef ITA_ATTR_H_ @@ -32,6 +32,13 @@ typedef enum ita_attr_t ita_attr_t; */ enum ita_attr_t { ITA_ATTR_COMMAND = 1, + ITA_ATTR_DUMMY = 2, + ITA_ATTR_GET_SETTINGS = 3, + ITA_ATTR_SETTINGS = 4, + ITA_ATTR_START_ANGEL = 5, + ITA_ATTR_STOP_ANGEL = 6, + ITA_ATTR_ECHO = 7, + ITA_ATTR_DEVICE_ID = 8 }; /** diff --git a/src/libimcv/ita/ita_attr_angel.c b/src/libimcv/ita/ita_attr_angel.c new file mode 100644 index 000000000..0e9cff0a9 --- /dev/null +++ b/src/libimcv/ita/ita_attr_angel.c @@ -0,0 +1,159 @@ +/* + * Copyright (C) 2012 Andreas Steffen + * HSR Hochschule fuer Technik Rapperswil + * + * This program is free software; you can redistribute it and/or modify it + * under the terms of the GNU General Public License as published by the + * Free Software Foundation; either version 2 of the License, or (at your + * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>. + * + * This program is distributed in the hope that it will be useful, but + * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY + * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License + * for more details. + */ + +#include "ita_attr.h" +#include "ita_attr_angel.h" + +#include <bio/bio_reader.h> +#include <bio/bio_writer.h> +#include <collections/linked_list.h> +#include <pen/pen.h> +#include <utils/debug.h> + +typedef struct private_ita_attr_angel_t private_ita_attr_angel_t; + +/** + * Private data of an ita_attr_angel_t object. + */ +struct private_ita_attr_angel_t { + + /** + * Public members of ita_attr_angel_t + */ + ita_attr_angel_t public; + + /** + * Vendor-specific attribute type + */ + pen_type_t type; + + /** + * Noskip flag + */ + bool noskip_flag; + + /** + * Reference count + */ + refcount_t ref; +}; + +METHOD(pa_tnc_attr_t, get_type, pen_type_t, + private_ita_attr_angel_t *this) +{ + return this->type; +} + +METHOD(pa_tnc_attr_t, get_value, chunk_t, + private_ita_attr_angel_t *this) +{ + return chunk_empty; +} + +METHOD(pa_tnc_attr_t, get_noskip_flag, bool, + private_ita_attr_angel_t *this) +{ + return this->noskip_flag; +} + +METHOD(pa_tnc_attr_t, set_noskip_flag,void, + private_ita_attr_angel_t *this, bool noskip) +{ + this->noskip_flag = noskip; +} + +METHOD(pa_tnc_attr_t, build, void, + private_ita_attr_angel_t *this) +{ + /* nothing to build */ +} + +METHOD(pa_tnc_attr_t, process, status_t, + private_ita_attr_angel_t *this, u_int32_t *offset) +{ + return SUCCESS; +} + +METHOD(pa_tnc_attr_t, get_ref, pa_tnc_attr_t*, + private_ita_attr_angel_t *this) +{ + ref_get(&this->ref); + return &this->public.pa_tnc_attribute; +} + +METHOD(pa_tnc_attr_t, destroy, void, + private_ita_attr_angel_t *this) +{ + if (ref_put(&this->ref)) + { + free(this); + } +} + +/** + * Described in header. + */ +pa_tnc_attr_t *ita_attr_angel_create(bool start) +{ + private_ita_attr_angel_t *this; + + INIT(this, + .public = { + .pa_tnc_attribute = { + .get_type = _get_type, + .get_value = _get_value, + .get_noskip_flag = _get_noskip_flag, + .set_noskip_flag = _set_noskip_flag, + .build = _build, + .process = _process, + .get_ref = _get_ref, + .destroy = _destroy, + }, + }, + .type = { PEN_ITA, start ? ITA_ATTR_START_ANGEL : ITA_ATTR_STOP_ANGEL }, + .ref = 1, + ); + + return &this->public.pa_tnc_attribute; +} + +/** + * Described in header. + */ +pa_tnc_attr_t *ita_attr_angel_create_from_data(bool start, chunk_t data) +{ + private_ita_attr_angel_t *this; + + INIT(this, + .public = { + .pa_tnc_attribute = { + .get_type = _get_type, + .get_value = _get_value, + .get_noskip_flag = _get_noskip_flag, + .set_noskip_flag = _set_noskip_flag, + .build = _build, + .process = _process, + .get_ref = _get_ref, + .destroy = _destroy, + }, + }, + .type = { PEN_ITA, start ? ITA_ATTR_START_ANGEL : ITA_ATTR_STOP_ANGEL }, + .ref = 1, + ); + + return &this->public.pa_tnc_attribute; +} + + diff --git a/src/libimcv/ita/ita_attr_angel.h b/src/libimcv/ita/ita_attr_angel.h new file mode 100644 index 000000000..d42e7119a --- /dev/null +++ b/src/libimcv/ita/ita_attr_angel.h @@ -0,0 +1,56 @@ +/* + * Copyright (C) 2012 Andreas Steffen + * HSR Hochschule fuer Technik Rapperswil + * + * This program is free software; you can redistribute it and/or modify it + * under the terms of the GNU General Public License as published by the + * Free Software Foundation; either version 2 of the License, or (at your + * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>. + * + * This program is distributed in the hope that it will be useful, but + * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY + * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License + * for more details. + */ + +/** + * @defgroup ita_attr_angel ita_attr_angel + * @{ @ingroup ita_attr + */ + +#ifndef ITA_ATTR_ANGEL_H_ +#define ITA_ATTR_ANGEL_H_ + +typedef struct ita_attr_angel_t ita_attr_angel_t; + +#include "pa_tnc/pa_tnc_attr.h" + +/** + * Class implementing the ITA Start/Stop Angel PA-TNC attribute. + * + */ +struct ita_attr_angel_t { + + /** + * Public PA-TNC attribute interface + */ + pa_tnc_attr_t pa_tnc_attribute; + +}; + +/** + * Creates an ita_attr_angel_t object with an empty settings list + * + * @param start TRUE for Start, FALSE for Stop Angel attribute + */ +pa_tnc_attr_t* ita_attr_angel_create(bool start); + +/** + * Creates an ita_attr_angel_t object from received data + * + * @param start TRUE for Start, FALSE for Stop Angel attribute + * @param value binary value blob + */ +pa_tnc_attr_t* ita_attr_angel_create_from_data(bool start, chunk_t value); + +#endif /** ITA_ATTR_ANGEL_H_ @}*/ diff --git a/src/libimcv/ita/ita_attr_command.c b/src/libimcv/ita/ita_attr_command.c index 5c1577a7c..f32ab2bfe 100644 --- a/src/libimcv/ita/ita_attr_command.c +++ b/src/libimcv/ita/ita_attr_command.c @@ -1,5 +1,6 @@ /* - * Copyright (C) 2011 Andreas Steffen, HSR Hochschule fuer Technik Rapperswil + * Copyright (C) 2011-2012 Andreas Steffen + * HSR Hochschule fuer Technik Rapperswil * * This program is free software; you can redistribute it and/or modify it * under the terms of the GNU General Public License as published by the @@ -16,8 +17,9 @@ #include "ita_attr_command.h" #include <pen/pen.h> +#include <utils/debug.h> -#include <debug.h> +#include <string.h> typedef struct private_ita_attr_command_t private_ita_attr_command_t; @@ -32,14 +34,9 @@ struct private_ita_attr_command_t { ita_attr_command_t public; /** - * Attribute vendor ID + * Vendor-specific attribute type */ - pen_t vendor_id; - - /** - * Attribute type - */ - u_int32_t type; + pen_type_t type; /** * Attribute value @@ -62,13 +59,7 @@ struct private_ita_attr_command_t { refcount_t ref; }; -METHOD(pa_tnc_attr_t, get_vendor_id, pen_t, - private_ita_attr_command_t *this) -{ - return this->vendor_id; -} - -METHOD(pa_tnc_attr_t, get_type, u_int32_t, +METHOD(pa_tnc_attr_t, get_type, pen_type_t, private_ita_attr_command_t *this) { return this->type; @@ -95,6 +86,10 @@ METHOD(pa_tnc_attr_t, set_noskip_flag,void, METHOD(pa_tnc_attr_t, build, void, private_ita_attr_command_t *this) { + if (this->value.ptr) + { + return; + } this->value = chunk_create(this->command, strlen(this->command)); this->value = chunk_clone(this->value); } @@ -102,11 +97,9 @@ METHOD(pa_tnc_attr_t, build, void, METHOD(pa_tnc_attr_t, process, status_t, private_ita_attr_command_t *this, u_int32_t *offset) { - this->command = malloc(this->value.len + 1); - memcpy(this->command, this->value.ptr, this->value.len); - this->command[this->value.len] = '\0'; + this->command = strndup(this->value.ptr, this->value.len); - return SUCCESS; + return SUCCESS; } METHOD(pa_tnc_attr_t, get_ref, pa_tnc_attr_t*, @@ -143,7 +136,6 @@ pa_tnc_attr_t *ita_attr_command_create(char *command) INIT(this, .public = { .pa_tnc_attribute = { - .get_vendor_id = _get_vendor_id, .get_type = _get_type, .get_value = _get_value, .get_noskip_flag = _get_noskip_flag, @@ -155,8 +147,7 @@ pa_tnc_attr_t *ita_attr_command_create(char *command) }, .get_command = _get_command, }, - .vendor_id = PEN_ITA, - .type = ITA_ATTR_COMMAND, + .type = { PEN_ITA, ITA_ATTR_COMMAND }, .command = strdup(command), .ref = 1, ); @@ -174,9 +165,10 @@ pa_tnc_attr_t *ita_attr_command_create_from_data(chunk_t data) INIT(this, .public = { .pa_tnc_attribute = { - .get_vendor_id = _get_vendor_id, .get_type = _get_type, .get_value = _get_value, + .get_noskip_flag = _get_noskip_flag, + .set_noskip_flag = _set_noskip_flag, .build = _build, .process = _process, .get_ref = _get_ref, @@ -184,8 +176,7 @@ pa_tnc_attr_t *ita_attr_command_create_from_data(chunk_t data) }, .get_command = _get_command, }, - .vendor_id = PEN_ITA, - .type = ITA_ATTR_COMMAND, + .type = {PEN_ITA, ITA_ATTR_COMMAND }, .value = chunk_clone(data), .ref = 1, ); diff --git a/src/libimcv/ita/ita_attr_command.h b/src/libimcv/ita/ita_attr_command.h index 372355197..3926c3887 100644 --- a/src/libimcv/ita/ita_attr_command.h +++ b/src/libimcv/ita/ita_attr_command.h @@ -14,8 +14,8 @@ */ /** - * @defgroup ita_attr_commandt ita_attr_command - * @{ @ingroup ita_attr_command + * @defgroup ita_attr_command ita_attr_command + * @{ @ingroup ita_attr */ #ifndef ITA_ATTR_COMMAND_H_ @@ -54,7 +54,7 @@ pa_tnc_attr_t* ita_attr_command_create(char *command); /** * Creates an ita_attr_command_t object from received data * - * @param command ITA command string + * @param value binary value blob */ pa_tnc_attr_t* ita_attr_command_create_from_data(chunk_t value); diff --git a/src/libimcv/ita/ita_attr_device_id.c b/src/libimcv/ita/ita_attr_device_id.c new file mode 100644 index 000000000..36907eb34 --- /dev/null +++ b/src/libimcv/ita/ita_attr_device_id.c @@ -0,0 +1,144 @@ +/* + * Copyright (C) 2013 Andreas Steffen + * HSR Hochschule fuer Technik Rapperswil + * + * This program is free software; you can redistribute it and/or modify it + * under the terms of the GNU General Public License as published by the + * Free Software Foundation; either version 2 of the License, or (at your + * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>. + * + * This program is distributed in the hope that it will be useful, but + * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY + * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License + * for more details. + */ + +#include "ita_attr.h" +#include "ita_attr_device_id.h" + +#include <pen/pen.h> + +#include <utils/debug.h> + +typedef struct private_ita_attr_device_id_t private_ita_attr_device_id_t; + +/** + * Private data of an ita_attr_device_id_t object. + */ +struct private_ita_attr_device_id_t { + + /** + * Public members of ita_attr_device_id_t + */ + ita_attr_device_id_t public; + + /** + * Vendor-specific attribute type + */ + pen_type_t type; + + /** + * Attribute value + */ + chunk_t value; + + /** + * Noskip flag + */ + bool noskip_flag; + + /** + * Reference count + */ + refcount_t ref; +}; + +METHOD(pa_tnc_attr_t, get_type, pen_type_t, + private_ita_attr_device_id_t *this) +{ + return this->type; +} + +METHOD(pa_tnc_attr_t, get_value, chunk_t, + private_ita_attr_device_id_t *this) +{ + return this->value; +} + +METHOD(pa_tnc_attr_t, get_noskip_flag, bool, + private_ita_attr_device_id_t *this) +{ + return this->noskip_flag; +} + +METHOD(pa_tnc_attr_t, set_noskip_flag,void, + private_ita_attr_device_id_t *this, bool noskip) +{ + this->noskip_flag = noskip; +} + +METHOD(pa_tnc_attr_t, build, void, + private_ita_attr_device_id_t *this) +{ + return; +} + +METHOD(pa_tnc_attr_t, process, status_t, + private_ita_attr_device_id_t *this, u_int32_t *offset) +{ + return SUCCESS; +} + +METHOD(pa_tnc_attr_t, get_ref, pa_tnc_attr_t*, + private_ita_attr_device_id_t *this) +{ + ref_get(&this->ref); + return &this->public.pa_tnc_attribute; +} + +METHOD(pa_tnc_attr_t, destroy, void, + private_ita_attr_device_id_t *this) +{ + if (ref_put(&this->ref)) + { + free(this->value.ptr); + free(this); + } +} + +/** + * Described in header. + */ +pa_tnc_attr_t *ita_attr_device_id_create_from_data(chunk_t value) +{ + private_ita_attr_device_id_t *this; + + INIT(this, + .public = { + .pa_tnc_attribute = { + .get_type = _get_type, + .get_value = _get_value, + .get_noskip_flag = _get_noskip_flag, + .set_noskip_flag = _set_noskip_flag, + .build = _build, + .process = _process, + .get_ref = _get_ref, + .destroy = _destroy, + }, + }, + .type = { PEN_ITA, ITA_ATTR_DEVICE_ID }, + .value = chunk_clone(value), + .ref = 1, + ); + + return &this->public.pa_tnc_attribute; +} + +/** + * Described in header. + */ +pa_tnc_attr_t *ita_attr_device_id_create(chunk_t value) +{ + return ita_attr_device_id_create_from_data(value); +} + diff --git a/src/libimcv/ita/ita_attr_device_id.h b/src/libimcv/ita/ita_attr_device_id.h new file mode 100644 index 000000000..ffacdba1e --- /dev/null +++ b/src/libimcv/ita/ita_attr_device_id.h @@ -0,0 +1,55 @@ +/* + * Copyright (C) 2013 Andreas Steffen + * HSR Hochschule fuer Technik Rapperswil + * + * This program is free software; you can redistribute it and/or modify it + * under the terms of the GNU General Public License as published by the + * Free Software Foundation; either version 2 of the License, or (at your + * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>. + * + * This program is distributed in the hope that it will be useful, but + * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY + * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License + * for more details. + */ + +/** + * @defgroup ita_attr_device_id ita_attr_device_id + * @{ @ingroup ita_attr + */ + +#ifndef ITA_ATTR_DEVICE_ID_H_ +#define ITA_ATTR_DEVICE_ID_H_ + +typedef struct ita_attr_device_id_t ita_attr_device_id_t; + +#include "pa_tnc/pa_tnc_attr.h" + +/** + * Class implementing the ITA Device ID PA-TNC attribute. + * + */ +struct ita_attr_device_id_t { + + /** + * Public PA-TNC attribute interface + */ + pa_tnc_attr_t pa_tnc_attribute; + +}; + +/** + * Creates an ita_attr_device_id_t object + * + * @param value ITA Device ID attribute value + */ +pa_tnc_attr_t* ita_attr_device_id_create(chunk_t value); + +/** + * Creates an ita_attr_device_id_t object from received data + * + * @param value binary value blob + */ +pa_tnc_attr_t* ita_attr_device_id_create_from_data(chunk_t value); + +#endif /** ITA_ATTR_DEVICE_ID_H_ @}*/ diff --git a/src/libimcv/ita/ita_attr_dummy.c b/src/libimcv/ita/ita_attr_dummy.c new file mode 100644 index 000000000..6497d4645 --- /dev/null +++ b/src/libimcv/ita/ita_attr_dummy.c @@ -0,0 +1,185 @@ +/* + * Copyright (C) 2012 Andreas Steffen + * HSR Hochschule fuer Technik Rapperswil + * + * This program is free software; you can redistribute it and/or modify it + * under the terms of the GNU General Public License as published by the + * Free Software Foundation; either version 2 of the License, or (at your + * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>. + * + * This program is distributed in the hope that it will be useful, but + * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY + * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License + * for more details. + */ + +#include "ita_attr.h" +#include "ita_attr_dummy.h" + +#include <pen/pen.h> + +#include <utils/debug.h> + +typedef struct private_ita_attr_dummy_t private_ita_attr_dummy_t; + +/** + * Private data of an ita_attr_dummy_t object. + */ +struct private_ita_attr_dummy_t { + + /** + * Public members of ita_attr_dummy_t + */ + ita_attr_dummy_t public; + + /** + * Vendor-specific attribute type + */ + pen_type_t type; + + /** + * Attribute value + */ + chunk_t value; + + /** + * Noskip flag + */ + bool noskip_flag; + + /** + * Size of the attribute value + */ + int size; + + /** + * Reference count + */ + refcount_t ref; +}; + +METHOD(pa_tnc_attr_t, get_type, pen_type_t, + private_ita_attr_dummy_t *this) +{ + return this->type; +} + +METHOD(pa_tnc_attr_t, get_value, chunk_t, + private_ita_attr_dummy_t *this) +{ + return this->value; +} + +METHOD(pa_tnc_attr_t, get_noskip_flag, bool, + private_ita_attr_dummy_t *this) +{ + return this->noskip_flag; +} + +METHOD(pa_tnc_attr_t, set_noskip_flag,void, + private_ita_attr_dummy_t *this, bool noskip) +{ + this->noskip_flag = noskip; +} + +METHOD(pa_tnc_attr_t, build, void, + private_ita_attr_dummy_t *this) +{ + if (this->value.ptr) + { + return; + } + this->value = chunk_alloc(this->size); + memset(this->value.ptr, 0xdd, this->value.len); +} + +METHOD(pa_tnc_attr_t, process, status_t, + private_ita_attr_dummy_t *this, u_int32_t *offset) +{ + this->size = this->value.len; + + return SUCCESS; +} + +METHOD(pa_tnc_attr_t, get_ref, pa_tnc_attr_t*, + private_ita_attr_dummy_t *this) +{ + ref_get(&this->ref); + return &this->public.pa_tnc_attribute; +} + +METHOD(pa_tnc_attr_t, destroy, void, + private_ita_attr_dummy_t *this) +{ + if (ref_put(&this->ref)) + { + free(this->value.ptr); + free(this); + } +} + +METHOD(ita_attr_dummy_t, get_size, int, + private_ita_attr_dummy_t *this) +{ + return this->size; +} + +/** + * Described in header. + */ +pa_tnc_attr_t *ita_attr_dummy_create(int size) +{ + private_ita_attr_dummy_t *this; + + INIT(this, + .public = { + .pa_tnc_attribute = { + .get_type = _get_type, + .get_value = _get_value, + .get_noskip_flag = _get_noskip_flag, + .set_noskip_flag = _set_noskip_flag, + .build = _build, + .process = _process, + .get_ref = _get_ref, + .destroy = _destroy, + }, + .get_size = _get_size, + }, + .type = { PEN_ITA, ITA_ATTR_DUMMY }, + .size = size, + .ref = 1, + ); + + return &this->public.pa_tnc_attribute; +} + +/** + * Described in header. + */ +pa_tnc_attr_t *ita_attr_dummy_create_from_data(chunk_t data) +{ + private_ita_attr_dummy_t *this; + + INIT(this, + .public = { + .pa_tnc_attribute = { + .get_type = _get_type, + .get_value = _get_value, + .get_noskip_flag = _get_noskip_flag, + .set_noskip_flag = _set_noskip_flag, + .build = _build, + .process = _process, + .get_ref = _get_ref, + .destroy = _destroy, + }, + .get_size = _get_size, + }, + .type = { PEN_ITA, ITA_ATTR_DUMMY }, + .value = chunk_clone(data), + .ref = 1, + ); + + return &this->public.pa_tnc_attribute; +} + + diff --git a/src/libimcv/ita/ita_attr_dummy.h b/src/libimcv/ita/ita_attr_dummy.h new file mode 100644 index 000000000..1f85ece54 --- /dev/null +++ b/src/libimcv/ita/ita_attr_dummy.h @@ -0,0 +1,61 @@ +/* + * Copyright (C) 2012 Andreas Steffen + * HSR Hochschule fuer Technik Rapperswil + * + * This program is free software; you can redistribute it and/or modify it + * under the terms of the GNU General Public License as published by the + * Free Software Foundation; either version 2 of the License, or (at your + * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>. + * + * This program is distributed in the hope that it will be useful, but + * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY + * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License + * for more details. + */ + +/** + * @defgroup ita_attr_dummy ita_attr_dummy + * @{ @ingroup ita_attr + */ + +#ifndef ITA_ATTR_DUMMY_H_ +#define ITA_ATTR_DUMMY_H_ + +typedef struct ita_attr_dummy_t ita_attr_dummy_t; + +#include "pa_tnc/pa_tnc_attr.h" + +/** + * Class implementing the ITA Dummy PA-TNC attribute. + * + */ +struct ita_attr_dummy_t { + + /** + * Public PA-TNC attribute interface + */ + pa_tnc_attr_t pa_tnc_attribute; + + /** + * Get the size the ITA Dummy attribute value + * + * @return size of dummy attribute value + */ + int (*get_size)(ita_attr_dummy_t *this); +}; + +/** + * Creates an ita_attr_dummy_t object with a given size + * + * @param size size of dummy attribute value + */ +pa_tnc_attr_t* ita_attr_dummy_create(int size); + +/** + * Creates an ita_attr_dummy_t object from received data + * + * @param value binary value blob + */ +pa_tnc_attr_t* ita_attr_dummy_create_from_data(chunk_t value); + +#endif /** ITA_ATTR_DUMMY_H_ @}*/ diff --git a/src/libimcv/ita/ita_attr_get_settings.c b/src/libimcv/ita/ita_attr_get_settings.c new file mode 100644 index 000000000..196613153 --- /dev/null +++ b/src/libimcv/ita/ita_attr_get_settings.c @@ -0,0 +1,268 @@ +/* + * Copyright (C) 2012 Andreas Steffen + * HSR Hochschule fuer Technik Rapperswil + * + * This program is free software; you can redistribute it and/or modify it + * under the terms of the GNU General Public License as published by the + * Free Software Foundation; either version 2 of the License, or (at your + * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>. + * + * This program is distributed in the hope that it will be useful, but + * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY + * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License + * for more details. + */ + +#include "ita_attr.h" +#include "ita_attr_get_settings.h" + +#include <bio/bio_reader.h> +#include <bio/bio_writer.h> +#include <collections/linked_list.h> +#include <pen/pen.h> +#include <utils/debug.h> + +#include <string.h> + +typedef struct private_ita_attr_get_settings_t private_ita_attr_get_settings_t; + +/** + * ITA Get Settings + * + * 1 2 3 + * 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 + * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ + * | Settings Count | + * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ + * | Name Length | Name (Variable Length) ~ + * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ + * ~ Name (Variable Length) ~ + * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ + * | Name Length | Name (Variable Length) ~ + * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ + * ~ Name (Variable Length) ~ + * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ + * ........................... + */ + +#define ITA_GET_SETTINGS_MIN_SIZE 4 + +/** + * Private data of an ita_attr_get_settings_t object. + */ +struct private_ita_attr_get_settings_t { + + /** + * Public members of ita_attr_get_settings_t + */ + ita_attr_get_settings_t public; + + /** + * Vendor-specific attribute type + */ + pen_type_t type; + + /** + * Attribute value + */ + chunk_t value; + + /** + * Noskip flag + */ + bool noskip_flag; + + /** + * List of requested settings + */ + linked_list_t *list; + + /** + * Reference count + */ + refcount_t ref; +}; + +METHOD(pa_tnc_attr_t, get_type, pen_type_t, + private_ita_attr_get_settings_t *this) +{ + return this->type; +} + +METHOD(pa_tnc_attr_t, get_value, chunk_t, + private_ita_attr_get_settings_t *this) +{ + return this->value; +} + +METHOD(pa_tnc_attr_t, get_noskip_flag, bool, + private_ita_attr_get_settings_t *this) +{ + return this->noskip_flag; +} + +METHOD(pa_tnc_attr_t, set_noskip_flag,void, + private_ita_attr_get_settings_t *this, bool noskip) +{ + this->noskip_flag = noskip; +} + +METHOD(pa_tnc_attr_t, build, void, + private_ita_attr_get_settings_t *this) +{ + bio_writer_t *writer; + enumerator_t *enumerator; + char *name; + + if (this->value.ptr) + { + return; + } + writer = bio_writer_create(ITA_GET_SETTINGS_MIN_SIZE); + writer->write_uint32(writer, this->list->get_count(this->list)); + + enumerator = this->list->create_enumerator(this->list); + while (enumerator->enumerate(enumerator, &name)) + { + writer->write_data16(writer, chunk_create(name, strlen(name))); + } + enumerator->destroy(enumerator); + + this->value = writer->extract_buf(writer); + writer->destroy(writer); +} + +METHOD(pa_tnc_attr_t, process, status_t, + private_ita_attr_get_settings_t *this, u_int32_t *offset) +{ + bio_reader_t *reader; + u_int32_t count; + chunk_t name; + status_t status = FAILED; + + if (this->value.len < ITA_GET_SETTINGS_MIN_SIZE) + { + DBG1(DBG_TNC, "insufficient data for ITA Get Settings attribute"); + *offset = 0; + return FAILED; + } + + reader = bio_reader_create(this->value); + reader->read_uint32(reader, &count); + + *offset = ITA_GET_SETTINGS_MIN_SIZE; + + while (count--) + { + if (!reader->read_data16(reader, &name)) + { + DBG1(DBG_TNC, "insufficient data for setting name"); + goto end; + } + *offset += 2 + name.len; + + this->list->insert_last(this->list, strndup(name.ptr, name.len)); + } + status = SUCCESS; + +end: + reader->destroy(reader); + return status; +} + +METHOD(pa_tnc_attr_t, get_ref, pa_tnc_attr_t*, + private_ita_attr_get_settings_t *this) +{ + ref_get(&this->ref); + return &this->public.pa_tnc_attribute; +} + +METHOD(pa_tnc_attr_t, destroy, void, + private_ita_attr_get_settings_t *this) +{ + if (ref_put(&this->ref)) + { + this->list->destroy_function(this->list, free); + free(this->value.ptr); + free(this); + } +} + +METHOD(ita_attr_get_settings_t, add, void, + private_ita_attr_get_settings_t *this, char *name) +{ + this->list->insert_last(this->list, strdup(name)); +} + +METHOD(ita_attr_get_settings_t, create_enumerator, enumerator_t*, + private_ita_attr_get_settings_t *this) +{ + return this->list->create_enumerator(this->list); +} + +/** + * Described in header. + */ +pa_tnc_attr_t *ita_attr_get_settings_create(char *name) +{ + private_ita_attr_get_settings_t *this; + + INIT(this, + .public = { + .pa_tnc_attribute = { + .get_type = _get_type, + .get_value = _get_value, + .get_noskip_flag = _get_noskip_flag, + .set_noskip_flag = _set_noskip_flag, + .build = _build, + .process = _process, + .get_ref = _get_ref, + .destroy = _destroy, + }, + .add = _add, + .create_enumerator = _create_enumerator, + }, + .type = { PEN_ITA, ITA_ATTR_GET_SETTINGS }, + .list = linked_list_create(), + .ref = 1, + ); + + if (name) + { + add(this, name); + } + return &this->public.pa_tnc_attribute; +} + +/** + * Described in header. + */ +pa_tnc_attr_t *ita_attr_get_settings_create_from_data(chunk_t data) +{ + private_ita_attr_get_settings_t *this; + + INIT(this, + .public = { + .pa_tnc_attribute = { + .get_type = _get_type, + .get_value = _get_value, + .get_noskip_flag = _get_noskip_flag, + .set_noskip_flag = _set_noskip_flag, + .build = _build, + .process = _process, + .get_ref = _get_ref, + .destroy = _destroy, + }, + .add = _add, + .create_enumerator = _create_enumerator, + }, + .type = { PEN_ITA, ITA_ATTR_GET_SETTINGS }, + .value = chunk_clone(data), + .list = linked_list_create(), + .ref = 1, + ); + + return &this->public.pa_tnc_attribute; +} + + diff --git a/src/libimcv/ita/ita_attr_get_settings.h b/src/libimcv/ita/ita_attr_get_settings.h new file mode 100644 index 000000000..975fd0d9d --- /dev/null +++ b/src/libimcv/ita/ita_attr_get_settings.h @@ -0,0 +1,68 @@ +/* + * Copyright (C) 2012 Andreas Steffen + * HSR Hochschule fuer Technik Rapperswil + * + * This program is free software; you can redistribute it and/or modify it + * under the terms of the GNU General Public License as published by the + * Free Software Foundation; either version 2 of the License, or (at your + * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>. + * + * This program is distributed in the hope that it will be useful, but + * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY + * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License + * for more details. + */ + +/** + * @defgroup ita_attr_get_settings ita_attr_get_settings + * @{ @ingroup ita_attr + */ + +#ifndef ITA_ATTR_GET_SETTINGS_H_ +#define ITA_ATTR_GET_SETTINGS_H_ + +typedef struct ita_attr_get_settings_t ita_attr_get_settings_t; + +#include "pa_tnc/pa_tnc_attr.h" + +/** + * Class implementing the ITA Get Settings PA-TNC attribute. + * + */ +struct ita_attr_get_settings_t { + + /** + * Public PA-TNC attribute interface + */ + pa_tnc_attr_t pa_tnc_attribute; + + /** + * Add a setting request to the list + * + * @param name name of the requested setting + */ + void (*add)(ita_attr_get_settings_t *this, char *name); + + /** + * Return an enumerator over all requested settings + * + * @return enumerator returns char *name + */ + enumerator_t* (*create_enumerator)(ita_attr_get_settings_t *this); +}; + +/** + * Creates an ita_attr_get_settings_t object with an optional first entry + * + * @param name name of the requested setting or NULL + */ +pa_tnc_attr_t* ita_attr_get_settings_create(char *name); + +/** + * Creates an ita_attr_get_settings_t object from received data + * + * @param value binary value blob + */ +pa_tnc_attr_t* ita_attr_get_settings_create_from_data(chunk_t value); + +#endif /** ITA_ATTR_GET_SETTINGS_H_ @}*/ diff --git a/src/libimcv/ita/ita_attr_settings.c b/src/libimcv/ita/ita_attr_settings.c new file mode 100644 index 000000000..9ce253d28 --- /dev/null +++ b/src/libimcv/ita/ita_attr_settings.c @@ -0,0 +1,326 @@ +/* + * Copyright (C) 2012 Andreas Steffen + * HSR Hochschule fuer Technik Rapperswil + * + * This program is free software; you can redistribute it and/or modify it + * under the terms of the GNU General Public License as published by the + * Free Software Foundation; either version 2 of the License, or (at your + * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>. + * + * This program is distributed in the hope that it will be useful, but + * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY + * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License + * for more details. + */ + +#include "ita_attr.h" +#include "ita_attr_settings.h" + +#include <bio/bio_reader.h> +#include <bio/bio_writer.h> +#include <collections/linked_list.h> +#include <pen/pen.h> +#include <utils/debug.h> + +#include <string.h> + +typedef struct private_ita_attr_settings_t private_ita_attr_settings_t; +typedef struct entry_t entry_t; + +/** + * Contains a settins name/value pair + */ +struct entry_t { + char *name; + chunk_t value; +}; + +/** + * Free an entry_t object + */ +static void free_entry(entry_t *this) +{ + free(this->name); + free(this->value.ptr); + free(this); +} + +/** + * ITA Settings + * + * 1 2 3 + * 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 + * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ + * | Settings Count | + * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ + * | Name Length | Name (Variable Length) ~ + * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ + * ~ Name (Variable Length) ~ + * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ + * | Value Length | Value (Variable Length) ~ + * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ + * ~ Value (Variable Length) ~ + * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ + * | Name Length | Name (Variable Length) ~ + * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ + * ~ Name (Variable Length) ~ + * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ + * | Value Length | Value (Variable Length) ~ + * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ + * ~ Value (Variable Length) ~ + * +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ + * ........................... + */ + +#define ITA_SETTINGS_MIN_SIZE 4 + +/** + * Private data of an ita_attr_settings_t object. + */ +struct private_ita_attr_settings_t { + + /** + * Public members of ita_attr_settings_t + */ + ita_attr_settings_t public; + + /** + * Vendor-specific attribute type + */ + pen_type_t type; + + /** + * Attribute value + */ + chunk_t value; + + /** + * Noskip flag + */ + bool noskip_flag; + + /** + * List of settings + */ + linked_list_t *list; + + /** + * Reference count + */ + refcount_t ref; +}; + +METHOD(pa_tnc_attr_t, get_type, pen_type_t, + private_ita_attr_settings_t *this) +{ + return this->type; +} + +METHOD(pa_tnc_attr_t, get_value, chunk_t, + private_ita_attr_settings_t *this) +{ + return this->value; +} + +METHOD(pa_tnc_attr_t, get_noskip_flag, bool, + private_ita_attr_settings_t *this) +{ + return this->noskip_flag; +} + +METHOD(pa_tnc_attr_t, set_noskip_flag,void, + private_ita_attr_settings_t *this, bool noskip) +{ + this->noskip_flag = noskip; +} + +METHOD(pa_tnc_attr_t, build, void, + private_ita_attr_settings_t *this) +{ + bio_writer_t *writer; + enumerator_t *enumerator; + entry_t *entry; + + if (this->value.ptr) + { + return; + } + writer = bio_writer_create(ITA_SETTINGS_MIN_SIZE); + writer->write_uint32(writer, this->list->get_count(this->list)); + + enumerator = this->list->create_enumerator(this->list); + while (enumerator->enumerate(enumerator, &entry)) + { + writer->write_data16(writer, chunk_create(entry->name, + strlen(entry->name))); + writer->write_data16(writer, entry->value); + } + enumerator->destroy(enumerator); + + this->value = writer->extract_buf(writer); + writer->destroy(writer); +} + +METHOD(pa_tnc_attr_t, process, status_t, + private_ita_attr_settings_t *this, u_int32_t *offset) +{ + bio_reader_t *reader; + u_int32_t count; + chunk_t name, value; + entry_t *entry; + status_t status = FAILED; + + if (this->value.len < ITA_SETTINGS_MIN_SIZE) + { + DBG1(DBG_TNC, "insufficient data for ITA Settings attribute"); + *offset = 0; + return FAILED; + } + + reader = bio_reader_create(this->value); + reader->read_uint32(reader, &count); + + *offset = ITA_SETTINGS_MIN_SIZE; + + while (count--) + { + if (!reader->read_data16(reader, &name)) + { + DBG1(DBG_TNC, "insufficient data for setting name"); + goto end; + } + *offset += 2 + name.len; + + if (!reader->read_data16(reader, &value)) + { + DBG1(DBG_TNC, "insufficient data for setting value"); + goto end; + } + *offset += 2 + value.len; + + /* remove a terminating newline character */ + if (value.len && value.ptr[value.len - 1] == '\n') + { + value.len--; + } + entry = malloc_thing(entry_t); + entry->name = strndup(name.ptr, name.len); + entry->value = chunk_clone(value); + this->list->insert_last(this->list, entry); + } + status = SUCCESS; + +end: + reader->destroy(reader); + return status; +} + +METHOD(pa_tnc_attr_t, get_ref, pa_tnc_attr_t*, + private_ita_attr_settings_t *this) +{ + ref_get(&this->ref); + return &this->public.pa_tnc_attribute; +} + +METHOD(pa_tnc_attr_t, destroy, void, + private_ita_attr_settings_t *this) +{ + if (ref_put(&this->ref)) + { + this->list->destroy_function(this->list, (void*)free_entry); + free(this->value.ptr); + free(this); + } +} + +METHOD(ita_attr_settings_t, add, void, + private_ita_attr_settings_t *this, char *name, chunk_t value) +{ + entry_t *entry; + + entry = malloc_thing(entry_t); + entry->name = strdup(name); + entry->value = chunk_clone(value); + this->list->insert_last(this->list, entry); +} + +/** + * Enumerate name/value pairs + */ +static bool entry_filter(void *null, entry_t **entry, char **name, + void *i2, chunk_t *value) +{ + *name = (*entry)->name; + *value = (*entry)->value; + return TRUE; +} + +METHOD(ita_attr_settings_t, create_enumerator, enumerator_t*, + private_ita_attr_settings_t *this) +{ + return enumerator_create_filter(this->list->create_enumerator(this->list), + (void*)entry_filter, NULL, NULL); +} + +/** + * Described in header. + */ +pa_tnc_attr_t *ita_attr_settings_create(void) +{ + private_ita_attr_settings_t *this; + + INIT(this, + .public = { + .pa_tnc_attribute = { + .get_type = _get_type, + .get_value = _get_value, + .get_noskip_flag = _get_noskip_flag, + .set_noskip_flag = _set_noskip_flag, + .build = _build, + .process = _process, + .get_ref = _get_ref, + .destroy = _destroy, + }, + .add = _add, + .create_enumerator = _create_enumerator, + }, + .type = { PEN_ITA, ITA_ATTR_SETTINGS }, + .list = linked_list_create(), + .ref = 1, + ); + + return &this->public.pa_tnc_attribute; +} + +/** + * Described in header. + */ +pa_tnc_attr_t *ita_attr_settings_create_from_data(chunk_t data) +{ + private_ita_attr_settings_t *this; + + INIT(this, + .public = { + .pa_tnc_attribute = { + .get_type = _get_type, + .get_value = _get_value, + .get_noskip_flag = _get_noskip_flag, + .set_noskip_flag = _set_noskip_flag, + .build = _build, + .process = _process, + .get_ref = _get_ref, + .destroy = _destroy, + }, + .add = _add, + .create_enumerator = _create_enumerator, + }, + .type = { PEN_ITA, ITA_ATTR_SETTINGS }, + .value = chunk_clone(data), + .list = linked_list_create(), + .ref = 1, + ); + + return &this->public.pa_tnc_attribute; +} + + diff --git a/src/libimcv/ita/ita_attr_settings.h b/src/libimcv/ita/ita_attr_settings.h new file mode 100644 index 000000000..eb7eedae3 --- /dev/null +++ b/src/libimcv/ita/ita_attr_settings.h @@ -0,0 +1,67 @@ +/* + * Copyright (C) 2012 Andreas Steffen + * HSR Hochschule fuer Technik Rapperswil + * + * This program is free software; you can redistribute it and/or modify it + * under the terms of the GNU General Public License as published by the + * Free Software Foundation; either version 2 of the License, or (at your + * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>. + * + * This program is distributed in the hope that it will be useful, but + * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY + * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License + * for more details. + */ + +/** + * @defgroup ita_attr_settings ita_attr_settings + * @{ @ingroup ita_attr + */ + +#ifndef ITA_ATTR_SETTINGS_H_ +#define ITA_ATTR_SETTINGS_H_ + +typedef struct ita_attr_settings_t ita_attr_settings_t; + +#include "pa_tnc/pa_tnc_attr.h" + +/** + * Class implementing the ITA Settings PA-TNC attribute. + * + */ +struct ita_attr_settings_t { + + /** + * Public PA-TNC attribute interface + */ + pa_tnc_attr_t pa_tnc_attribute; + + /** + * Add a setting to the list + * + * @param name name of the setting + * @param value value of the setting + */ + void (*add)(ita_attr_settings_t *this, char *name, chunk_t value); + + /** + * Return an enumerator over all name/value pairs + * + * @return enumerator returns char **name, chunk_t *value + */ + enumerator_t* (*create_enumerator)(ita_attr_settings_t *this); +}; + +/** + * Creates an ita_attr_settings_t object with an empty settings list + */ +pa_tnc_attr_t* ita_attr_settings_create(void); + +/** + * Creates an ita_attr_settings_t object from received data + * + * @param value binary value blob + */ +pa_tnc_attr_t* ita_attr_settings_create_from_data(chunk_t value); + +#endif /** ITA_ATTR_SETTINGS_H_ @}*/ diff --git a/src/libimcv/os_info/os_info.c b/src/libimcv/os_info/os_info.c new file mode 100644 index 000000000..17000cd27 --- /dev/null +++ b/src/libimcv/os_info/os_info.c @@ -0,0 +1,606 @@ +/* + * Copyright (C) 2012 Andreas Steffen + * HSR Hochschule fuer Technik Rapperswil + * + * This program is free software; you can redistribute it and/or modify it + * under the terms of the GNU General Public License as published by the + * Free Software Foundation; either version 2 of the License, or (at your + * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>. + * + * This program is distributed in the hope that it will be useful, but + * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY + * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License + * for more details. + */ + +#include "os_info.h" + +#include <sys/utsname.h> +#include <stdio.h> +#include <stdarg.h> + +#include <collections/linked_list.h> +#include <utils/debug.h> + +typedef struct private_os_info_t private_os_info_t; + +ENUM(os_type_names, OS_TYPE_UNKNOWN, OS_TYPE_ANDROID, + "Unknown", + "Debian", + "Ubuntu", + "Fedora", + "Red Hat", + "CentOS", + "SUSE", + "Gentoo", + "Android" +); + +ENUM(os_fwd_status_names, OS_FWD_DISABLED, OS_FWD_UNKNOWN, + "disabled", + "enabled", + "unknown" +); + +ENUM(os_package_state_names, OS_PACKAGE_STATE_UPDATE, OS_PACKAGE_STATE_BLACKLIST, + "", + " [s]", + " [b]" +); + +/** + * Private data of an os_info_t object. + * + */ +struct private_os_info_t { + + /** + * Public os_info_t interface. + */ + os_info_t public; + + /** + * OS type + */ + os_type_t type; + + /** + * OS name + */ + chunk_t name; + + /** + * OS version + */ + chunk_t version; + +}; + +METHOD(os_info_t, get_type, os_type_t, + private_os_info_t *this) +{ + return this->type; +} + +METHOD(os_info_t, get_name, chunk_t, + private_os_info_t *this) +{ + return this->name; +} + +METHOD(os_info_t, get_numeric_version, void, + private_os_info_t *this, u_int32_t *major, u_int32_t *minor) +{ + u_char *pos; + + if (major) + { + *major = atol(this->version.ptr); + } + pos = memchr(this->version.ptr, '.', this->version.len); + if (minor) + { + *minor = pos ? atol(pos + 1) : 0; + } +} + +METHOD(os_info_t, get_version, chunk_t, + private_os_info_t *this) +{ + return this->version; +} + +METHOD(os_info_t, get_fwd_status, os_fwd_status_t, + private_os_info_t *this) +{ + const char ip_forward[] = "/proc/sys/net/ipv4/ip_forward"; + char buf[2]; + FILE *file; + + os_fwd_status_t fwd_status = OS_FWD_UNKNOWN; + + file = fopen(ip_forward, "r"); + if (file) + { + if (fread(buf, 1, 1, file) == 1) + { + switch (buf[0]) + { + case '0': + fwd_status = OS_FWD_DISABLED; + break; + case '1': + fwd_status = OS_FWD_ENABLED; + break; + default: + DBG1(DBG_IMC, "\"%s\" returns invalid value ", ip_forward); + break; + } + } + else + { + DBG1(DBG_IMC, "could not read from \"%s\"", ip_forward); + } + fclose(file); + } + else + { + DBG1(DBG_IMC, "failed to open \"%s\"", ip_forward); + } + + return fwd_status; +} + +METHOD(os_info_t, get_uptime, time_t, + private_os_info_t *this) +{ + const char proc_uptime[] = "/proc/uptime"; + FILE *file; + u_int uptime; + + file = fopen(proc_uptime, "r"); + if (!file) + { + DBG1(DBG_IMC, "failed to open \"%s\"", proc_uptime); + return 0; + } + if (fscanf(file, "%u", &uptime) != 1) + { + DBG1(DBG_IMC, "failed to read file \"%s\"", proc_uptime); + uptime = 0; + } + fclose(file); + + return uptime; +} + +METHOD(os_info_t, get_setting, chunk_t, + private_os_info_t *this, char *name) +{ + FILE *file; + u_char buf[2048]; + size_t i = 0; + chunk_t value; + + if (!strpfx(name, "/etc/") && !strpfx(name, "/proc/") && + !strpfx(name, "/sys/") && !strpfx(name, "/var/")) + { + /** + * In order to guarantee privacy, only settings from the + * /etc/, /proc/ and /sys/ directories can be retrieved + */ + DBG1(DBG_IMC, "not allowed to access '%s'", name); + + return chunk_empty; + } + + file = fopen(name, "r"); + if (!file) + { + DBG1(DBG_IMC, "failed to open '%s'", name); + + return chunk_empty; + } + while (i < sizeof(buf) && fread(buf + i, 1, 1, file) == 1) + { + i++; + } + fclose(file); + + value = chunk_create(buf, i); + + return chunk_clone(value); +} + +typedef struct { + /** + * implements enumerator_t + */ + enumerator_t public; + + /** + * package info pipe stream + */ + FILE* file; + + /** + * line buffer + */ + u_char line[512]; + +} package_enumerator_t; + +/** + * Implementation of package_enumerator.destroy. + */ +static void package_enumerator_destroy(package_enumerator_t *this) +{ + pclose(this->file); + free(this); +} + +/** + * Implementation of package_enumerator.enumerate + */ +static bool package_enumerator_enumerate(package_enumerator_t *this, ...) +{ + chunk_t *name, *version; + u_char *pos; + va_list args; + + while (TRUE) + { + if (!fgets(this->line, sizeof(this->line), this->file)) + { + return FALSE; + } + + pos = strchr(this->line, '\t'); + if (!pos) + { + return FALSE; + } + *pos++ = '\0'; + + if (!streq(this->line, "install ok installed")) + { + continue; + } + va_start(args, this); + + name = va_arg(args, chunk_t*); + name->ptr = pos; + pos = strchr(pos, '\t'); + if (!pos) + { + va_end(args); + return FALSE; + } + name->len = pos++ - name->ptr; + + version = va_arg(args, chunk_t*); + version->ptr = pos; + version->len = strlen(pos) - 1; + + va_end(args); + return TRUE; + } +} + +METHOD(os_info_t, create_package_enumerator, enumerator_t*, + private_os_info_t *this) +{ + FILE *file; + const char command[] = "dpkg-query --show --showformat=" + "'${Status}\t${Package}\t${Version}\n'"; + package_enumerator_t *enumerator; + + /* Only Debian and Ubuntu package enumeration is currently supported */ + if (this->type != OS_TYPE_DEBIAN && this->type != OS_TYPE_UBUNTU) + { + return NULL; + } + + /* Open a pipe stream for reading the output of the dpkg-query commmand */ + file = popen(command, "r"); + if (!file) + { + DBG1(DBG_IMC, "failed to run dpkg command"); + return NULL; + } + + /* Create a package enumerator instance */ + enumerator = malloc_thing(package_enumerator_t); + enumerator->public.enumerate = (void*)package_enumerator_enumerate; + enumerator->public.destroy = (void*)package_enumerator_destroy; + enumerator->file = file; + + return (enumerator_t*)enumerator; +} + + +METHOD(os_info_t, destroy, void, + private_os_info_t *this) +{ + free(this->name.ptr); + free(this->version.ptr); + free(this); +} + +#define RELEASE_LSB 0 +#define RELEASE_DEBIAN 1 + +/** + * Determine Linux distribution version and hardware platform + */ +static bool extract_platform_info(os_type_t *type, chunk_t *name, + chunk_t *version) +{ + FILE *file; + u_char buf[BUF_LEN], *pos = buf; + int len = BUF_LEN - 1; + os_type_t os_type = OS_TYPE_UNKNOWN; + chunk_t os_name = chunk_empty; + chunk_t os_version = chunk_empty; + char *os_str; + struct utsname uninfo; + int i; + + /* Linux/Unix distribution release info (from http://linuxmafia.com) */ + const char* releases[] = { + "/etc/lsb-release", "/etc/debian_version", + "/etc/SuSE-release", "/etc/novell-release", + "/etc/sles-release", "/etc/redhat-release", + "/etc/fedora-release", "/etc/gentoo-release", + "/etc/slackware-version", "/etc/annvix-release", + "/etc/arch-release", "/etc/arklinux-release", + "/etc/aurox-release", "/etc/blackcat-release", + "/etc/cobalt-release", "/etc/conectiva-release", + "/etc/debian_release", "/etc/immunix-release", + "/etc/lfs-release", "/etc/linuxppc-release", + "/etc/mandrake-release", "/etc/mandriva-release", + "/etc/mandrakelinux-release", "/etc/mklinux-release", + "/etc/pld-release", "/etc/redhat_version", + "/etc/slackware-release", "/etc/e-smith-release", + "/etc/release", "/etc/sun-release", + "/etc/tinysofa-release", "/etc/turbolinux-release", + "/etc/ultrapenguin-release", "/etc/UnitedLinux-release", + "/etc/va-release", "/etc/yellowdog-release" + }; + + const char lsb_distrib_id[] = "DISTRIB_ID="; + const char lsb_distrib_release[] = "DISTRIB_RELEASE="; + + for (i = 0; i < countof(releases); i++) + { + file = fopen(releases[i], "r"); + if (!file) + { + continue; + } + + /* read release file into buffer */ + fseek(file, 0, SEEK_END); + len = min(ftell(file), len); + rewind(file); + buf[len] = '\0'; + if (fread(buf, 1, len, file) != len) + { + DBG1(DBG_IMC, "failed to read file \"%s\"", releases[i]); + fclose(file); + return FALSE; + } + fclose(file); + + DBG1(DBG_IMC, "processing \"%s\" file", releases[i]); + + switch (i) + { + case RELEASE_LSB: + { + /* Determine Distribution ID */ + pos = strstr(buf, lsb_distrib_id); + if (!pos) + { + DBG1(DBG_IMC, "failed to find begin of DISTRIB_ID field"); + return FALSE; + } + pos += strlen(lsb_distrib_id); + + os_name.ptr = pos; + + pos = strchr(pos, '\n'); + if (!pos) + { + DBG1(DBG_IMC, "failed to find end of DISTRIB_ID field"); + return FALSE; + } + os_name.len = pos - os_name.ptr; + + /* Determine Distribution Release */ + pos = strstr(buf, lsb_distrib_release); + if (!pos) + { + DBG1(DBG_IMC, "failed to find begin of DISTRIB_RELEASE field"); + return FALSE; + } + pos += strlen(lsb_distrib_release); + + os_version.ptr = pos; + + pos = strchr(pos, '\n'); + if (!pos) + { + DBG1(DBG_IMC, "failed to find end of DISTRIB_RELEASE field"); + return FALSE; + } + os_version.len = pos - os_version.ptr; + + break; + } + case RELEASE_DEBIAN: + { + os_type = OS_TYPE_DEBIAN; + + os_version.ptr = buf; + pos = strchr(buf, '\n'); + if (!pos) + { + DBG1(DBG_PTS, "failed to find end of release string"); + return FALSE; + } + + os_version.len = pos - os_version.ptr; + + break; + } + default: + { + const char str_release[] = " release "; + + os_name.ptr = buf; + + pos = strstr(buf, str_release); + if (!pos) + { + DBG1(DBG_IMC, "failed to find release keyword"); + return FALSE; + } + + os_name.len = pos - os_name.ptr; + + pos += strlen(str_release); + os_version.ptr = pos; + + pos = strchr(pos, '\n'); + if (!pos) + { + DBG1(DBG_IMC, "failed to find end of release string"); + return FALSE; + } + + os_version.len = pos - os_version.ptr; + + break; + } + } + break; + } + + if (!os_version.ptr) + { + DBG1(DBG_IMC, "no distribution release file found"); + return FALSE; + } + + if (uname(&uninfo) < 0) + { + DBG1(DBG_IMC, "could not retrieve machine architecture"); + return FALSE; + } + + /* Try to find a matching OS type based on the OS name */ + if (os_type == OS_TYPE_UNKNOWN) + { + os_type = os_type_from_name(os_name); + } + + /* If known use the official OS name */ + if (os_type != OS_TYPE_UNKNOWN) + { + os_str = enum_to_name(os_type_names, os_type); + os_name = chunk_create(os_str, strlen(os_str)); + } + + /* copy OS type */ + *type = os_type; + + /* copy OS name */ + *name = chunk_clone(os_name); + + /* copy OS version and machine architecture */ + *version = chunk_alloc(os_version.len + 1 + strlen(uninfo.machine)); + pos = version->ptr; + memcpy(pos, os_version.ptr, os_version.len); + pos += os_version.len; + *pos++ = ' '; + memcpy(pos, uninfo.machine, strlen(uninfo.machine)); + + return TRUE; +} + +/** + * See header + */ +os_type_t os_type_from_name(chunk_t name) +{ + os_type_t type; + char *name_str; + + for (type = OS_TYPE_DEBIAN; type < OS_TYPE_ROOF; type++) + { + /* name_str is a substring of name.ptr */ + name_str = enum_to_name(os_type_names, type); + if (memeq(name.ptr, name_str, min(name.len, strlen(name_str)))) + { + return type; + } + } + return OS_TYPE_UNKNOWN; +} + +/** + * See header + */ +os_info_t *os_info_create(void) +{ + private_os_info_t *this; + chunk_t name, version; + os_type_t type; + + /* As an option OS name and OS version can be configured manually */ + name.ptr = lib->settings->get_str(lib->settings, + "libimcv.os_info.name", NULL); + version.ptr = lib->settings->get_str(lib->settings, + "libimcv.os_info.version", NULL); + if (name.ptr && version.ptr) + { + name.len = strlen(name.ptr); + name = chunk_clone(name); + + version.len = strlen(version.ptr); + version = chunk_clone(version); + + type = os_type_from_name(name); + } + else + { + if (!extract_platform_info(&type, &name, &version)) + { + return NULL; + } + } + DBG1(DBG_IMC, "operating system name is '%.*s'", + name.len, name.ptr); + DBG1(DBG_IMC, "operating system version is '%.*s'", + version.len, version.ptr); + + INIT(this, + .public = { + .get_type = _get_type, + .get_name = _get_name, + .get_numeric_version = _get_numeric_version, + .get_version = _get_version, + .get_fwd_status = _get_fwd_status, + .get_uptime = _get_uptime, + .get_setting = _get_setting, + .create_package_enumerator = _create_package_enumerator, + .destroy = _destroy, + }, + .type = type, + .name = name, + .version = version, + ); + + return &this->public; +} diff --git a/src/libimcv/os_info/os_info.h b/src/libimcv/os_info/os_info.h new file mode 100644 index 000000000..f47460709 --- /dev/null +++ b/src/libimcv/os_info/os_info.h @@ -0,0 +1,153 @@ +/* + * Copyright (C) 2012 Andreas Steffen + * HSR Hochschule fuer Technik Rapperswil + * + * This program is free software; you can redistribute it and/or modify it + * under the terms of the GNU General Public License as published by the + * Free Software Foundation; either version 2 of the License, or (at your + * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>. + * + * This program is distributed in the hope that it will be useful, but + * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY + * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License + * for more details. + */ + +/** + * @defgroup os_info os_info + * @{ @ingroup libimcv + */ + +#ifndef OS_INFO_H_ +#define OS_INFO_H_ + +typedef struct os_info_t os_info_t; +typedef enum os_type_t os_type_t; +typedef enum os_fwd_status_t os_fwd_status_t; +typedef enum os_package_state_t os_package_state_t; + +#include <library.h> + +#include <time.h> + +enum os_type_t { + OS_TYPE_UNKNOWN, + OS_TYPE_DEBIAN, + OS_TYPE_UBUNTU, + OS_TYPE_FEDORA, + OS_TYPE_REDHAT, + OS_TYPE_CENTOS, + OS_TYPE_SUSE, + OS_TYPE_GENTOO, + OS_TYPE_ANDROID, + OS_TYPE_ROOF +}; + +extern enum_name_t *os_type_names; + +/** + * Defines the security state of a package stored in the database + */ +enum os_package_state_t { + OS_PACKAGE_STATE_UPDATE = 0, /* latest update */ + OS_PACKAGE_STATE_SECURITY = 1, /* latest security fix */ + OS_PACKAGE_STATE_BLACKLIST = 2 /* blacklisted package */ +}; + +extern enum_name_t *os_package_state_names; + +/** + * Defines the IPv4 forwarding status + */ +enum os_fwd_status_t { + OS_FWD_DISABLED = 0, + OS_FWD_ENABLED = 1, + OS_FWD_UNKNOWN = 2 +}; + +extern enum_name_t *os_fwd_status_names; + +/** + * Interface for the Operating System (OS) information module + */ +struct os_info_t { + + /** + * Get the OS type if it can be determined + * + * @return OS type + */ + os_type_t (*get_type)(os_info_t *this); + + /** + * Get the OS product name or distribution + * + * @return OS name + */ + chunk_t (*get_name)(os_info_t *this); + + /** + * Get the numeric OS version or release + * + * @param major OS major version number + * @param minor OS minor version number + */ + void (*get_numeric_version)(os_info_t *this, u_int32_t *major, + u_int32_t *minor); + + /** + * Get the OS version or release + * + * @return OS version + */ + chunk_t (*get_version)(os_info_t *this); + + /** + * Get the OS IPv4 forwarding status + * + * @return IP forwarding status + */ + os_fwd_status_t (*get_fwd_status)(os_info_t *this); + + /** + * Get the OS uptime in seconds + * + * @return OS uptime + */ + time_t (*get_uptime)(os_info_t *this); + + /** + * Get an OS setting (restricted to /proc, /sys, and /etc) + * + * @param name name of OS setting + * @return value of OS setting + */ + chunk_t (*get_setting)(os_info_t *this, char *name); + + /** + * Enumerates over all installed packages + * + * @return return package enumerator + */ + enumerator_t* (*create_package_enumerator)(os_info_t *this); + + /** + * Destroys an os_info_t object. + */ + void (*destroy)(os_info_t *this); +}; + +/** + * Convert an OS name into an OS enumeration type + * + * @param name OS name + * @return OS enumeration type + */ +os_type_t os_type_from_name(chunk_t name); + +/** + * Create an os_info_t object + */ +os_info_t* os_info_create(void); + +#endif /** OS_INFO_H_ @}*/ diff --git a/src/libimcv/pa_tnc/pa_tnc_attr.h b/src/libimcv/pa_tnc/pa_tnc_attr.h index b6057a70b..e2ce06ee4 100644 --- a/src/libimcv/pa_tnc/pa_tnc_attr.h +++ b/src/libimcv/pa_tnc/pa_tnc_attr.h @@ -1,5 +1,5 @@ /* - * Copyright (C) 2011 Andreas Steffen + * Copyright (C) 2011-2012 Andreas Steffen * HSR Hochschule fuer Technik Rapperswil * * This program is free software; you can redistribute it and/or modify it @@ -15,7 +15,7 @@ /** * @defgroup pa_tnc_attr pa_tnc_attr - * @{ @ingroup libimcv + * @{ @ingroup pa_tnc */ #ifndef PA_TNC_ATTR_H_ @@ -33,18 +33,11 @@ typedef struct pa_tnc_attr_t pa_tnc_attr_t; struct pa_tnc_attr_t { /** - * Get the vendor ID of an PA-TNC attribute + * Get the vendor ID/type of an PA-TNC attribute * - * @return attribute vendor ID + * @return vendor-specific attribute type */ - u_int32_t (*get_vendor_id)(pa_tnc_attr_t *this); - - /** - * Get the type of an PA-TNC attribute - * - * @return attribute type - */ - u_int32_t (*get_type)(pa_tnc_attr_t *this); + pen_type_t (*get_type)(pa_tnc_attr_t *this); /** * Get the value of an PA-TNC attribute diff --git a/src/libimcv/pa_tnc/pa_tnc_attr_manager.c b/src/libimcv/pa_tnc/pa_tnc_attr_manager.c index 1de89d87d..900a55716 100644 --- a/src/libimcv/pa_tnc/pa_tnc_attr_manager.c +++ b/src/libimcv/pa_tnc/pa_tnc_attr_manager.c @@ -16,8 +16,8 @@ #include "pa_tnc_attr_manager.h" -#include <utils/linked_list.h> -#include <debug.h> +#include <collections/linked_list.h> +#include <utils/debug.h> typedef struct private_pa_tnc_attr_manager_t private_pa_tnc_attr_manager_t; typedef struct entry_t entry_t; @@ -46,7 +46,7 @@ struct private_pa_tnc_attr_manager_t { }; METHOD(pa_tnc_attr_manager_t, add_vendor, void, - private_pa_tnc_attr_manager_t *this, pen_t vendor_id, + private_pa_tnc_attr_manager_t *this, pen_t vendor_id, pa_tnc_attr_create_t attr_create, enum_name_t *attr_names) { entry_t *entry; @@ -128,7 +128,7 @@ METHOD(pa_tnc_attr_manager_t, create, pa_tnc_attr_t*, METHOD(pa_tnc_attr_manager_t, destroy, void, private_pa_tnc_attr_manager_t *this) { - this->list->destroy_function(this->list, free); + this->list->destroy_function(this->list, free); free(this); } diff --git a/src/libimcv/pa_tnc/pa_tnc_attr_manager.h b/src/libimcv/pa_tnc/pa_tnc_attr_manager.h index 40c3ab335..121be7f90 100644 --- a/src/libimcv/pa_tnc/pa_tnc_attr_manager.h +++ b/src/libimcv/pa_tnc/pa_tnc_attr_manager.h @@ -15,7 +15,7 @@ /** * @defgroup pa_tnc_attr_manager pa_tnc_attr_manager - * @{ @ingroup libimcv + * @{ @ingroup pa_tnc */ #ifndef PA_TNC_ATTR_MANAGER_H_ @@ -56,7 +56,7 @@ struct pa_tnc_attr_manager_t { * Return the PA-TNC attribute names for a given vendor ID * * @param vendor_id Private Enterprise Number (PEN) - * @return PA-TNC attribute names if found, NULL else + * @return PA-TNC attribute names if found, NULL else */ enum_name_t* (*get_names)(pa_tnc_attr_manager_t *this, pen_t vendor_id); @@ -66,7 +66,7 @@ struct pa_tnc_attr_manager_t { * @param vendor_id Private Enterprise Number (PEN) * @param type PA-TNC attribute type * @param value PA-TNC attribute value as encoded data - * @return PA-TNC attribute object if supported, NULL else + * @return PA-TNC attribute object if supported, NULL else */ pa_tnc_attr_t* (*create)(pa_tnc_attr_manager_t *this, pen_t vendor_id, u_int32_t type, chunk_t value); diff --git a/src/libimcv/pa_tnc/pa_tnc_msg.c b/src/libimcv/pa_tnc/pa_tnc_msg.c index b5df0a5b5..140463b83 100644 --- a/src/libimcv/pa_tnc/pa_tnc_msg.c +++ b/src/libimcv/pa_tnc/pa_tnc_msg.c @@ -1,6 +1,5 @@ /* - * Copyright (C) 2011 Andreas Steffen - * + * Copyright (C) 2011-2012 Andreas Steffen * HSR Hochschule fuer Technik Rapperswil * * This program is free software; you can redistribute it and/or modify it @@ -20,9 +19,9 @@ #include <bio/bio_writer.h> #include <bio/bio_reader.h> -#include <utils/linked_list.h> +#include <collections/linked_list.h> #include <pen/pen.h> -#include <debug.h> +#include <utils/debug.h> typedef struct private_pa_tnc_msg_t private_pa_tnc_msg_t; @@ -43,7 +42,7 @@ typedef struct private_pa_tnc_msg_t private_pa_tnc_msg_t; #define PA_TNC_RESERVED 0x000000 /** - * PA-TNC attribute + * PA-TNC attribute * * 1 2 3 * 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 @@ -90,6 +89,16 @@ struct private_pa_tnc_msg_t { u_int32_t identifier; /** + * Current PA-TNC Message size + */ + size_t msg_len; + + /** + * Maximum PA-TNC Message size + */ + size_t max_msg_len; + + /** * Encoded message */ chunk_t encoding; @@ -101,75 +110,94 @@ METHOD(pa_tnc_msg_t, get_encoding, chunk_t, return this->encoding; } -METHOD(pa_tnc_msg_t, add_attribute, void, +METHOD(pa_tnc_msg_t, add_attribute, bool, private_pa_tnc_msg_t *this, pa_tnc_attr_t *attr) { + chunk_t attr_value; + size_t attr_len; + + attr->build(attr); + attr_value = attr->get_value(attr); + attr_len = PA_TNC_ATTR_HEADER_SIZE + attr_value.len; + + if (this->max_msg_len && this->msg_len + attr_len > this->max_msg_len) + { + /* attribute just does not fit into this message */ + return FALSE; + } + this->msg_len += attr_len; + this->attributes->insert_last(this->attributes, attr); + return TRUE; } -METHOD(pa_tnc_msg_t, build, void, +METHOD(pa_tnc_msg_t, build, bool, private_pa_tnc_msg_t *this) { bio_writer_t *writer; enumerator_t *enumerator; pa_tnc_attr_t *attr; enum_name_t *pa_attr_names; - pen_t vendor_id; - u_int32_t type; + pen_type_t type; u_int8_t flags; chunk_t value; - rng_t *rng; + nonce_gen_t *ng; - /* create a random message identifier */ - rng = lib->crypto->create_rng(lib->crypto, RNG_WEAK); - rng->get_bytes(rng, sizeof(this->identifier), (u_int8_t*)&this->identifier); - rng->destroy(rng); - DBG2(DBG_TNC, "creating PA-TNC message with ID 0x%08x", this->identifier); + /* generate a nonce as a message identifier */ + ng = lib->crypto->create_nonce_gen(lib->crypto); + if (!ng || !ng->get_nonce(ng, 4, (u_int8_t*)&this->identifier)) + { + DBG1(DBG_TNC, "failed to generate random PA-TNC message identifier"); + DESTROY_IF(ng); + return FALSE; + } + ng->destroy(ng); + DBG1(DBG_TNC, "creating PA-TNC message with ID 0x%08x", this->identifier); /* build message header */ - writer = bio_writer_create(PA_TNC_HEADER_SIZE); + writer = bio_writer_create(this->msg_len); writer->write_uint8 (writer, PA_TNC_VERSION); writer->write_uint24(writer, PA_TNC_RESERVED); writer->write_uint32(writer, this->identifier); - /* build and append encoding of PA-TNC attributes */ + /* append encoded value of PA-TNC attributes */ enumerator = this->attributes->create_enumerator(this->attributes); while (enumerator->enumerate(enumerator, &attr)) { - attr->build(attr); - vendor_id = attr->get_vendor_id(attr); - type = attr->get_type(attr); + type = attr->get_type(attr); value = attr->get_value(attr); flags = attr->get_noskip_flag(attr) ? PA_TNC_ATTR_FLAG_NOSKIP : PA_TNC_ATTR_FLAG_NONE; pa_attr_names = imcv_pa_tnc_attributes->get_names(imcv_pa_tnc_attributes, - vendor_id); + type.vendor_id); if (pa_attr_names) { DBG2(DBG_TNC, "creating PA-TNC attribute type '%N/%N' " - "0x%06x/0x%08x", pen_names, vendor_id, - pa_attr_names, type, vendor_id, type); + "0x%06x/0x%08x", pen_names, type.vendor_id, + pa_attr_names, type.type, type.vendor_id, type.type); } else { DBG2(DBG_TNC, "creating PA-TNC attribute type '%N' " - "0x%06x/0x%08x", pen_names, vendor_id, - vendor_id, type); + "0x%06x/0x%08x", pen_names, type.vendor_id, + type.vendor_id, type.type); } DBG3(DBG_TNC, "%B", &value); writer->write_uint8 (writer, flags); - writer->write_uint24(writer, vendor_id); - writer->write_uint32(writer, type); + writer->write_uint24(writer, type.vendor_id); + writer->write_uint32(writer, type.type); writer->write_uint32(writer, PA_TNC_ATTR_HEADER_SIZE + value.len); writer->write_data (writer, value); } enumerator->destroy(enumerator); free(this->encoding.ptr); - this->encoding = chunk_clone(writer->get_buf(writer)); + this->encoding = writer->extract_buf(writer); writer->destroy(writer); + + return TRUE; } METHOD(pa_tnc_msg_t, process, status_t, @@ -179,6 +207,7 @@ METHOD(pa_tnc_msg_t, process, status_t, pa_tnc_attr_t *error; u_int8_t version; u_int32_t reserved, offset, attr_offset; + pen_type_t error_code = { PEN_IETF, PA_ERROR_INVALID_PARAMETER }; /* process message header */ if (this->encoding.len < PA_TNC_HEADER_SIZE) @@ -191,16 +220,16 @@ METHOD(pa_tnc_msg_t, process, status_t, reader->read_uint8 (reader, &version); reader->read_uint24(reader, &reserved); reader->read_uint32(reader, &this->identifier); - DBG2(DBG_TNC, "processing PA-TNC message with ID 0x%08x", this->identifier); + DBG1(DBG_TNC, "processing PA-TNC message with ID 0x%08x", this->identifier); if (version != PA_TNC_VERSION) { DBG1(DBG_TNC, "PA-TNC version %u not supported", version); - error = ietf_attr_pa_tnc_error_create(PEN_IETF, - PA_ERROR_VERSION_NOT_SUPPORTED, this->encoding); + error_code = pen_type_create(PEN_IETF, PA_ERROR_VERSION_NOT_SUPPORTED); + error = ietf_attr_pa_tnc_error_create(error_code, this->encoding); goto err; } - + /* offset of the first PA-TNC attribute in the PA-TNC message */ offset = PA_TNC_HEADER_SIZE; @@ -241,22 +270,32 @@ METHOD(pa_tnc_msg_t, process, status_t, { DBG1(DBG_TNC, "%u bytes too small for PA-TNC attribute length", length); - error = ietf_attr_pa_tnc_error_create_with_offset(PEN_IETF, - PA_ERROR_INVALID_PARAMETER, this->encoding, - offset + PA_TNC_ATTR_INFO_SIZE); + error = ietf_attr_pa_tnc_error_create_with_offset(error_code, + this->encoding, offset + PA_TNC_ATTR_INFO_SIZE); goto err; } if (!reader->read_data(reader, length - PA_TNC_ATTR_HEADER_SIZE, &value)) { DBG1(DBG_TNC, "insufficient bytes for PA-TNC attribute value"); - error = ietf_attr_pa_tnc_error_create_with_offset(PEN_IETF, - PA_ERROR_INVALID_PARAMETER, this->encoding, - offset + PA_TNC_ATTR_INFO_SIZE); - goto err; - } + error = ietf_attr_pa_tnc_error_create_with_offset(error_code, + this->encoding, offset + PA_TNC_ATTR_INFO_SIZE); + goto err; + } DBG3(DBG_TNC, "%B", &value); + if (vendor_id == PEN_RESERVED) + { + error = ietf_attr_pa_tnc_error_create_with_offset(error_code, + this->encoding, offset + 1); + goto err; + } + if (type == IETF_ATTR_RESERVED) + { + error = ietf_attr_pa_tnc_error_create_with_offset(error_code, + this->encoding, offset + 4); + goto err; + } attr = imcv_pa_tnc_attributes->create(imcv_pa_tnc_attributes, vendor_id, type, value); if (!attr) @@ -264,8 +303,10 @@ METHOD(pa_tnc_msg_t, process, status_t, if (flags & PA_TNC_ATTR_FLAG_NOSKIP) { DBG1(DBG_TNC, "unsupported PA-TNC attribute with NOSKIP flag"); - error = ietf_attr_pa_tnc_error_create(PEN_IETF, - PA_ERROR_ATTR_TYPE_NOT_SUPPORTED, this->encoding); + error_code = pen_type_create(PEN_IETF, + PA_ERROR_ATTR_TYPE_NOT_SUPPORTED); + error = ietf_attr_pa_tnc_error_create(error_code, + this->encoding); error_attr = (ietf_attr_pa_tnc_error_t*)error; error_attr->set_attr_info(error_attr, attr_info); goto err; @@ -287,12 +328,14 @@ METHOD(pa_tnc_msg_t, process, status_t, reader->destroy(reader); return FAILED; } - error = ietf_attr_pa_tnc_error_create_with_offset(PEN_IETF, - PA_ERROR_INVALID_PARAMETER, this->encoding, + error_code = pen_type_create(PEN_IETF, + PA_ERROR_INVALID_PARAMETER); + error = ietf_attr_pa_tnc_error_create_with_offset(error_code, + this->encoding, offset + PA_TNC_ATTR_HEADER_SIZE + attr_offset); goto err; } - add_attribute(this, attr); + this->attributes->insert_last(this->attributes, attr); offset += length; } @@ -302,8 +345,8 @@ METHOD(pa_tnc_msg_t, process, status_t, return SUCCESS; } DBG1(DBG_TNC, "insufficient bytes for PA-TNC attribute header"); - error = ietf_attr_pa_tnc_error_create_with_offset(PEN_IETF, - PA_ERROR_INVALID_PARAMETER, this->encoding, offset); + error = ietf_attr_pa_tnc_error_create_with_offset(error_code, + this->encoding, offset); err: reader->destroy(reader); @@ -316,50 +359,47 @@ METHOD(pa_tnc_msg_t, process_ietf_std_errors, bool, { enumerator_t *enumerator; pa_tnc_attr_t *attr; + pen_type_t type; bool fatal_error = FALSE; enumerator = this->attributes->create_enumerator(this->attributes); while (enumerator->enumerate(enumerator, &attr)) { - if (attr->get_vendor_id(attr) == PEN_IETF && - attr->get_type(attr) == IETF_ATTR_PA_TNC_ERROR) + type = attr->get_type(attr); + + if (type.vendor_id == PEN_IETF && type.type == IETF_ATTR_PA_TNC_ERROR) { ietf_attr_pa_tnc_error_t *error_attr; - pen_t error_vendor_id; - pa_tnc_error_code_t error_code; + pen_type_t error_code; chunk_t msg_info, attr_info; u_int32_t offset; error_attr = (ietf_attr_pa_tnc_error_t*)attr; - error_vendor_id = error_attr->get_vendor_id(error_attr); error_code = error_attr->get_error_code(error_attr); msg_info = error_attr->get_msg_info(error_attr); /* skip errors from non-IETF namespaces */ - if (error_vendor_id != PEN_IETF) + if (error_code.vendor_id != PEN_IETF) { continue; } - DBG1(DBG_IMC, "received PA-TNC error '%N' concerning message " - "0x%08x/0x%08x", pa_tnc_error_code_names, error_code, + DBG1(DBG_TNC, "received PA-TNC error '%N' concerning message " + "0x%08x/0x%08x", pa_tnc_error_code_names, error_code.type, untoh32(msg_info.ptr), untoh32(msg_info.ptr + 4)); - switch (error_code) + switch (error_code.type) { case PA_ERROR_INVALID_PARAMETER: offset = error_attr->get_offset(error_attr); - DBG1(DBG_IMC, " occurred at offset of %u bytes", offset); + DBG1(DBG_TNC, " occurred at offset of %u bytes", offset); break; case PA_ERROR_ATTR_TYPE_NOT_SUPPORTED: attr_info = error_attr->get_attr_info(error_attr); - DBG1(DBG_IMC, " unsupported attribute %#B", &attr_info); + DBG1(DBG_TNC, " unsupported attribute %#B", &attr_info); break; default: break; } - - /* remove the processed IETF standard error attribute */ - this->attributes->remove_at(this->attributes, enumerator); fatal_error = TRUE; } } @@ -384,7 +424,7 @@ METHOD(pa_tnc_msg_t, destroy, void, private_pa_tnc_msg_t *this) { this->attributes->destroy_offset(this->attributes, - offsetof(pa_tnc_attr_t, destroy)); + offsetof(pa_tnc_attr_t, destroy)); this->errors->destroy_offset(this->errors, offsetof(pa_tnc_attr_t, destroy)); free(this->encoding.ptr); @@ -394,7 +434,7 @@ METHOD(pa_tnc_msg_t, destroy, void, /** * See header */ -pa_tnc_msg_t *pa_tnc_msg_create_from_data(chunk_t data) +pa_tnc_msg_t *pa_tnc_msg_create(size_t max_msg_len) { private_pa_tnc_msg_t *this; @@ -409,9 +449,10 @@ pa_tnc_msg_t *pa_tnc_msg_create_from_data(chunk_t data) .create_error_enumerator = _create_error_enumerator, .destroy = _destroy, }, - .encoding = chunk_clone(data), .attributes = linked_list_create(), .errors = linked_list_create(), + .msg_len = PA_TNC_HEADER_SIZE, + .max_msg_len = max_msg_len, ); return &this->public; @@ -420,8 +461,26 @@ pa_tnc_msg_t *pa_tnc_msg_create_from_data(chunk_t data) /** * See header */ -pa_tnc_msg_t *pa_tnc_msg_create(void) +pa_tnc_msg_t *pa_tnc_msg_create_from_data(chunk_t data) { - return pa_tnc_msg_create_from_data(chunk_empty); + private_pa_tnc_msg_t *this; + + INIT(this, + .public = { + .get_encoding = _get_encoding, + .add_attribute = _add_attribute, + .build = _build, + .process = _process, + .process_ietf_std_errors = _process_ietf_std_errors, + .create_attribute_enumerator = _create_attribute_enumerator, + .create_error_enumerator = _create_error_enumerator, + .destroy = _destroy, + }, + .encoding = chunk_clone(data), + .attributes = linked_list_create(), + .errors = linked_list_create(), + ); + + return &this->public; } diff --git a/src/libimcv/pa_tnc/pa_tnc_msg.h b/src/libimcv/pa_tnc/pa_tnc_msg.h index c3ce829d5..218d3d673 100644 --- a/src/libimcv/pa_tnc/pa_tnc_msg.h +++ b/src/libimcv/pa_tnc/pa_tnc_msg.h @@ -1,5 +1,5 @@ /* - * Copyright (C) 2011 Andreas Steffen + * Copyright (C) 2011-2012 Andreas Steffen * HSR Hochschule fuer Technik Rapperswil * * This program is free software; you can redistribute it and/or modify it @@ -15,7 +15,7 @@ /** * @defgroup pa_tnc_msg pa_tnc_msg - * @{ @ingroup libimcv + * @{ @ingroup pa_tnc */ #ifndef PA_TNC_MSG_H_ @@ -46,13 +46,16 @@ struct pa_tnc_msg_t { * Add a PA-TNC attribute * * @param attr PA-TNC attribute to be addedd + * @return TRUE if attribute fit into message and was added */ - void (*add_attribute)(pa_tnc_msg_t *this, pa_tnc_attr_t* attr); + bool (*add_attribute)(pa_tnc_msg_t *this, pa_tnc_attr_t* attr); /** * Build the PA-TNC message + * + * @return TRUE if PA-TNC message was built successfully */ - void (*build)(pa_tnc_msg_t *this); + bool (*build)(pa_tnc_msg_t *this); /** * Process the PA-TNC message @@ -62,7 +65,7 @@ struct pa_tnc_msg_t { status_t (*process)(pa_tnc_msg_t *this); /** - * Process and remove all IETF standard error PA-TNC attributes + * Process all IETF standard error PA-TNC attributes * * @return TRUE if at least one error attribute processed */ @@ -91,7 +94,7 @@ struct pa_tnc_msg_t { /** * Create an empty PA-TNC message */ -pa_tnc_msg_t* pa_tnc_msg_create(void); +pa_tnc_msg_t* pa_tnc_msg_create(size_t max_msg_len); /** * Create an unprocessed PA-TNC message from received data diff --git a/src/libimcv/plugins/imc_os/Makefile.am b/src/libimcv/plugins/imc_os/Makefile.am new file mode 100644 index 000000000..83c46558b --- /dev/null +++ b/src/libimcv/plugins/imc_os/Makefile.am @@ -0,0 +1,16 @@ +AM_CPPFLAGS = \ + -I$(top_srcdir)/src/libstrongswan \ + -I$(top_srcdir)/src/libtncif \ + -I$(top_srcdir)/src/libimcv + +AM_CFLAGS = \ + -rdynamic + +imcv_LTLIBRARIES = imc-os.la + +imc_os_la_LIBADD = $(top_builddir)/src/libimcv/libimcv.la \ + $(top_builddir)/src/libstrongswan/libstrongswan.la + +imc_os_la_SOURCES = imc_os.c imc_os_state.h imc_os_state.c + +imc_os_la_LDFLAGS = -module -avoid-version diff --git a/src/libimcv/plugins/imc_os/Makefile.in b/src/libimcv/plugins/imc_os/Makefile.in new file mode 100644 index 000000000..729fa8478 --- /dev/null +++ b/src/libimcv/plugins/imc_os/Makefile.in @@ -0,0 +1,671 @@ +# Makefile.in generated by automake 1.11.6 from Makefile.am. +# @configure_input@ + +# Copyright (C) 1994, 1995, 1996, 1997, 1998, 1999, 2000, 2001, 2002, +# 2003, 2004, 2005, 2006, 2007, 2008, 2009, 2010, 2011 Free Software +# Foundation, Inc. +# This Makefile.in is free software; the Free Software Foundation +# gives unlimited permission to copy and/or distribute it, +# with or without modifications, as long as this notice is preserved. + +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY, to the extent permitted by law; without +# even the implied warranty of MERCHANTABILITY or FITNESS FOR A +# PARTICULAR PURPOSE. + +@SET_MAKE@ + +VPATH = @srcdir@ +am__make_dryrun = \ + { \ + am__dry=no; \ + case $$MAKEFLAGS in \ + *\\[\ \ ]*) \ + echo 'am--echo: ; @echo "AM" OK' | $(MAKE) -f - 2>/dev/null \ + | grep '^AM OK$$' >/dev/null || am__dry=yes;; \ + *) \ + for am__flg in $$MAKEFLAGS; do \ + case $$am__flg in \ + *=*|--*) ;; \ + *n*) am__dry=yes; break;; \ + esac; \ + done;; \ + esac; \ + test $$am__dry = yes; \ + } +pkgdatadir = $(datadir)/@PACKAGE@ +pkgincludedir = $(includedir)/@PACKAGE@ +pkglibdir = $(libdir)/@PACKAGE@ +pkglibexecdir = $(libexecdir)/@PACKAGE@ +am__cd = CDPATH="$${ZSH_VERSION+.}$(PATH_SEPARATOR)" && cd +install_sh_DATA = $(install_sh) -c -m 644 +install_sh_PROGRAM = $(install_sh) -c +install_sh_SCRIPT = $(install_sh) -c +INSTALL_HEADER = $(INSTALL_DATA) +transform = $(program_transform_name) +NORMAL_INSTALL = : +PRE_INSTALL = : +POST_INSTALL = : +NORMAL_UNINSTALL = : +PRE_UNINSTALL = : +POST_UNINSTALL = : +build_triplet = @build@ +host_triplet = @host@ +subdir = src/libimcv/plugins/imc_os +DIST_COMMON = $(srcdir)/Makefile.am $(srcdir)/Makefile.in +ACLOCAL_M4 = $(top_srcdir)/aclocal.m4 +am__aclocal_m4_deps = $(top_srcdir)/m4/config/libtool.m4 \ + $(top_srcdir)/m4/config/ltoptions.m4 \ + $(top_srcdir)/m4/config/ltsugar.m4 \ + $(top_srcdir)/m4/config/ltversion.m4 \ + $(top_srcdir)/m4/config/lt~obsolete.m4 \ + $(top_srcdir)/m4/macros/with.m4 \ + $(top_srcdir)/m4/macros/enable-disable.m4 \ + $(top_srcdir)/m4/macros/add-plugin.m4 \ + $(top_srcdir)/configure.ac +am__configure_deps = $(am__aclocal_m4_deps) $(CONFIGURE_DEPENDENCIES) \ + $(ACLOCAL_M4) +mkinstalldirs = $(install_sh) -d +CONFIG_HEADER = $(top_builddir)/config.h +CONFIG_CLEAN_FILES = +CONFIG_CLEAN_VPATH_FILES = +am__vpath_adj_setup = srcdirstrip=`echo "$(srcdir)" | sed 's|.|.|g'`; +am__vpath_adj = case $$p in \ + $(srcdir)/*) f=`echo "$$p" | sed "s|^$$srcdirstrip/||"`;; \ + *) f=$$p;; \ + esac; +am__strip_dir = f=`echo $$p | sed -e 's|^.*/||'`; +am__install_max = 40 +am__nobase_strip_setup = \ + srcdirstrip=`echo "$(srcdir)" | sed 's/[].[^$$\\*|]/\\\\&/g'` +am__nobase_strip = \ + for p in $$list; do echo "$$p"; done | sed -e "s|$$srcdirstrip/||" +am__nobase_list = $(am__nobase_strip_setup); \ + for p in $$list; do echo "$$p $$p"; done | \ + sed "s| $$srcdirstrip/| |;"' / .*\//!s/ .*/ ./; s,\( .*\)/[^/]*$$,\1,' | \ + $(AWK) 'BEGIN { files["."] = "" } { files[$$2] = files[$$2] " " $$1; \ + if (++n[$$2] == $(am__install_max)) \ + { print $$2, files[$$2]; n[$$2] = 0; files[$$2] = "" } } \ + END { for (dir in files) print dir, files[dir] }' +am__base_list = \ + sed '$$!N;$$!N;$$!N;$$!N;$$!N;$$!N;$$!N;s/\n/ /g' | \ + sed '$$!N;$$!N;$$!N;$$!N;s/\n/ /g' +am__uninstall_files_from_dir = { \ + test -z "$$files" \ + || { test ! -d "$$dir" && test ! -f "$$dir" && test ! -r "$$dir"; } \ + || { echo " ( cd '$$dir' && rm -f" $$files ")"; \ + $(am__cd) "$$dir" && rm -f $$files; }; \ + } +am__installdirs = "$(DESTDIR)$(imcvdir)" +LTLIBRARIES = $(imcv_LTLIBRARIES) +imc_os_la_DEPENDENCIES = $(top_builddir)/src/libimcv/libimcv.la \ + $(top_builddir)/src/libstrongswan/libstrongswan.la +am_imc_os_la_OBJECTS = imc_os.lo imc_os_state.lo +imc_os_la_OBJECTS = $(am_imc_os_la_OBJECTS) +AM_V_lt = $(am__v_lt_@AM_V@) +am__v_lt_ = $(am__v_lt_@AM_DEFAULT_V@) +am__v_lt_0 = --silent +imc_os_la_LINK = $(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) \ + $(LIBTOOLFLAGS) --mode=link $(CCLD) $(AM_CFLAGS) $(CFLAGS) \ + $(imc_os_la_LDFLAGS) $(LDFLAGS) -o $@ +DEFAULT_INCLUDES = -I.@am__isrc@ -I$(top_builddir) +depcomp = $(SHELL) $(top_srcdir)/depcomp +am__depfiles_maybe = depfiles +am__mv = mv -f +COMPILE = $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) \ + $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) +LTCOMPILE = $(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) \ + $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) \ + $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) \ + $(AM_CFLAGS) $(CFLAGS) +AM_V_CC = $(am__v_CC_@AM_V@) +am__v_CC_ = $(am__v_CC_@AM_DEFAULT_V@) +am__v_CC_0 = @echo " CC " $@; +AM_V_at = $(am__v_at_@AM_V@) +am__v_at_ = $(am__v_at_@AM_DEFAULT_V@) +am__v_at_0 = @ +CCLD = $(CC) +LINK = $(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) \ + $(LIBTOOLFLAGS) --mode=link $(CCLD) $(AM_CFLAGS) $(CFLAGS) \ + $(AM_LDFLAGS) $(LDFLAGS) -o $@ +AM_V_CCLD = $(am__v_CCLD_@AM_V@) +am__v_CCLD_ = $(am__v_CCLD_@AM_DEFAULT_V@) +am__v_CCLD_0 = @echo " CCLD " $@; +AM_V_GEN = $(am__v_GEN_@AM_V@) +am__v_GEN_ = $(am__v_GEN_@AM_DEFAULT_V@) +am__v_GEN_0 = @echo " GEN " $@; +SOURCES = $(imc_os_la_SOURCES) +DIST_SOURCES = $(imc_os_la_SOURCES) +am__can_run_installinfo = \ + case $$AM_UPDATE_INFO_DIR in \ + n|no|NO) false;; \ + *) (install-info --version) >/dev/null 2>&1;; \ + esac +ETAGS = etags +CTAGS = ctags +DISTFILES = $(DIST_COMMON) $(DIST_SOURCES) $(TEXINFOS) $(EXTRA_DIST) +ACLOCAL = @ACLOCAL@ +ALLOCA = @ALLOCA@ +AMTAR = @AMTAR@ +AM_DEFAULT_VERBOSITY = @AM_DEFAULT_VERBOSITY@ +AR = @AR@ +AUTOCONF = @AUTOCONF@ +AUTOHEADER = @AUTOHEADER@ +AUTOMAKE = @AUTOMAKE@ +AWK = @AWK@ +BFDLIB = @BFDLIB@ +BTLIB = @BTLIB@ +CC = @CC@ +CCDEPMODE = @CCDEPMODE@ +CFLAGS = @CFLAGS@ +CHECK_CFLAGS = @CHECK_CFLAGS@ +CHECK_LIBS = @CHECK_LIBS@ +COVERAGE_CFLAGS = @COVERAGE_CFLAGS@ +COVERAGE_LDFLAGS = @COVERAGE_LDFLAGS@ +CPP = @CPP@ +CPPFLAGS = @CPPFLAGS@ +CYGPATH_W = @CYGPATH_W@ +DEFS = @DEFS@ +DEPDIR = @DEPDIR@ +DLLIB = @DLLIB@ +DLLTOOL = @DLLTOOL@ +DSYMUTIL = @DSYMUTIL@ +DUMPBIN = @DUMPBIN@ +ECHO_C = @ECHO_C@ +ECHO_N = @ECHO_N@ +ECHO_T = @ECHO_T@ +EGREP = @EGREP@ +EXEEXT = @EXEEXT@ +FGREP = @FGREP@ +GENHTML = @GENHTML@ +GPERF = @GPERF@ +GPRBUILD = @GPRBUILD@ +GREP = @GREP@ +INSTALL = @INSTALL@ +INSTALL_DATA = @INSTALL_DATA@ +INSTALL_PROGRAM = @INSTALL_PROGRAM@ +INSTALL_SCRIPT = @INSTALL_SCRIPT@ +INSTALL_STRIP_PROGRAM = @INSTALL_STRIP_PROGRAM@ +LCOV = @LCOV@ +LD = @LD@ +LDFLAGS = @LDFLAGS@ +LEX = @LEX@ +LEXLIB = @LEXLIB@ +LEX_OUTPUT_ROOT = @LEX_OUTPUT_ROOT@ +LIBOBJS = @LIBOBJS@ +LIBS = @LIBS@ +LIBTOOL = @LIBTOOL@ +LIPO = @LIPO@ +LN_S = @LN_S@ +LTLIBOBJS = @LTLIBOBJS@ +MAKEINFO = @MAKEINFO@ +MANIFEST_TOOL = @MANIFEST_TOOL@ +MKDIR_P = @MKDIR_P@ +MYSQLCFLAG = @MYSQLCFLAG@ +MYSQLCONFIG = @MYSQLCONFIG@ +MYSQLLIB = @MYSQLLIB@ +NM = @NM@ +NMEDIT = @NMEDIT@ +OBJDUMP = @OBJDUMP@ +OBJEXT = @OBJEXT@ +OTOOL = @OTOOL@ +OTOOL64 = @OTOOL64@ +PACKAGE = @PACKAGE@ +PACKAGE_BUGREPORT = @PACKAGE_BUGREPORT@ +PACKAGE_NAME = @PACKAGE_NAME@ +PACKAGE_STRING = @PACKAGE_STRING@ +PACKAGE_TARNAME = @PACKAGE_TARNAME@ +PACKAGE_URL = @PACKAGE_URL@ +PACKAGE_VERSION = @PACKAGE_VERSION@ +PATH_SEPARATOR = @PATH_SEPARATOR@ +PERL = @PERL@ +PKG_CONFIG = @PKG_CONFIG@ +PKG_CONFIG_LIBDIR = @PKG_CONFIG_LIBDIR@ +PKG_CONFIG_PATH = @PKG_CONFIG_PATH@ +PTHREADLIB = @PTHREADLIB@ +RANLIB = @RANLIB@ +RTLIB = @RTLIB@ +RUBY = @RUBY@ +RUBYINCLUDE = @RUBYINCLUDE@ +RUBYLIB = @RUBYLIB@ +SED = @SED@ +SET_MAKE = @SET_MAKE@ +SHELL = @SHELL@ +SOCKLIB = @SOCKLIB@ +STRIP = @STRIP@ +UNWINDLIB = @UNWINDLIB@ +VERSION = @VERSION@ +YACC = @YACC@ +YFLAGS = @YFLAGS@ +abs_builddir = @abs_builddir@ +abs_srcdir = @abs_srcdir@ +abs_top_builddir = @abs_top_builddir@ +abs_top_srcdir = @abs_top_srcdir@ +ac_ct_AR = @ac_ct_AR@ +ac_ct_CC = @ac_ct_CC@ +ac_ct_DUMPBIN = @ac_ct_DUMPBIN@ +am__include = @am__include@ +am__leading_dot = @am__leading_dot@ +am__quote = @am__quote@ +am__tar = @am__tar@ +am__untar = @am__untar@ +attest_plugins = @attest_plugins@ +bindir = @bindir@ +build = @build@ +build_alias = @build_alias@ +build_cpu = @build_cpu@ +build_os = @build_os@ +build_vendor = @build_vendor@ +builddir = @builddir@ +c_plugins = @c_plugins@ +charon_natt_port = @charon_natt_port@ +charon_plugins = @charon_plugins@ +charon_udp_port = @charon_udp_port@ +clearsilver_LIBS = @clearsilver_LIBS@ +cmd_plugins = @cmd_plugins@ +datadir = @datadir@ +datarootdir = @datarootdir@ +dbusservicedir = @dbusservicedir@ +dev_headers = @dev_headers@ +docdir = @docdir@ +dvidir = @dvidir@ +exec_prefix = @exec_prefix@ +fips_mode = @fips_mode@ +gtk_CFLAGS = @gtk_CFLAGS@ +gtk_LIBS = @gtk_LIBS@ +h_plugins = @h_plugins@ +host = @host@ +host_alias = @host_alias@ +host_cpu = @host_cpu@ +host_os = @host_os@ +host_vendor = @host_vendor@ +htmldir = @htmldir@ +imcvdir = @imcvdir@ +includedir = @includedir@ +infodir = @infodir@ +install_sh = @install_sh@ +ipsec_script = @ipsec_script@ +ipsec_script_upper = @ipsec_script_upper@ +ipsecdir = @ipsecdir@ +ipsecgroup = @ipsecgroup@ +ipseclibdir = @ipseclibdir@ +ipsecuser = @ipsecuser@ +libdir = @libdir@ +libexecdir = @libexecdir@ +linux_headers = @linux_headers@ +localedir = @localedir@ +localstatedir = @localstatedir@ +maemo_CFLAGS = @maemo_CFLAGS@ +maemo_LIBS = @maemo_LIBS@ +manager_plugins = @manager_plugins@ +mandir = @mandir@ +medsrv_plugins = @medsrv_plugins@ +mkdir_p = @mkdir_p@ +nm_CFLAGS = @nm_CFLAGS@ +nm_LIBS = @nm_LIBS@ +nm_ca_dir = @nm_ca_dir@ +nm_plugins = @nm_plugins@ +oldincludedir = @oldincludedir@ +openac_plugins = @openac_plugins@ +pcsclite_CFLAGS = @pcsclite_CFLAGS@ +pcsclite_LIBS = @pcsclite_LIBS@ +pdfdir = @pdfdir@ +piddir = @piddir@ +pki_plugins = @pki_plugins@ +plugindir = @plugindir@ +pool_plugins = @pool_plugins@ +prefix = @prefix@ +program_transform_name = @program_transform_name@ +psdir = @psdir@ +random_device = @random_device@ +resolv_conf = @resolv_conf@ +routing_table = @routing_table@ +routing_table_prio = @routing_table_prio@ +s_plugins = @s_plugins@ +sbindir = @sbindir@ +scepclient_plugins = @scepclient_plugins@ +scripts_plugins = @scripts_plugins@ +sharedstatedir = @sharedstatedir@ +soup_CFLAGS = @soup_CFLAGS@ +soup_LIBS = @soup_LIBS@ +srcdir = @srcdir@ +starter_plugins = @starter_plugins@ +strongswan_conf = @strongswan_conf@ +sysconfdir = @sysconfdir@ +systemdsystemunitdir = @systemdsystemunitdir@ +target_alias = @target_alias@ +top_build_prefix = @top_build_prefix@ +top_builddir = @top_builddir@ +top_srcdir = @top_srcdir@ +urandom_device = @urandom_device@ +xml_CFLAGS = @xml_CFLAGS@ +xml_LIBS = @xml_LIBS@ +AM_CPPFLAGS = \ + -I$(top_srcdir)/src/libstrongswan \ + -I$(top_srcdir)/src/libtncif \ + -I$(top_srcdir)/src/libimcv + +AM_CFLAGS = \ + -rdynamic + +imcv_LTLIBRARIES = imc-os.la +imc_os_la_LIBADD = $(top_builddir)/src/libimcv/libimcv.la \ + $(top_builddir)/src/libstrongswan/libstrongswan.la + +imc_os_la_SOURCES = imc_os.c imc_os_state.h imc_os_state.c +imc_os_la_LDFLAGS = -module -avoid-version +all: all-am + +.SUFFIXES: +.SUFFIXES: .c .lo .o .obj +$(srcdir)/Makefile.in: $(srcdir)/Makefile.am $(am__configure_deps) + @for dep in $?; do \ + case '$(am__configure_deps)' in \ + *$$dep*) \ + ( cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh ) \ + && { if test -f $@; then exit 0; else break; fi; }; \ + exit 1;; \ + esac; \ + done; \ + echo ' cd $(top_srcdir) && $(AUTOMAKE) --gnu src/libimcv/plugins/imc_os/Makefile'; \ + $(am__cd) $(top_srcdir) && \ + $(AUTOMAKE) --gnu src/libimcv/plugins/imc_os/Makefile +.PRECIOUS: Makefile +Makefile: $(srcdir)/Makefile.in $(top_builddir)/config.status + @case '$?' in \ + *config.status*) \ + cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh;; \ + *) \ + echo ' cd $(top_builddir) && $(SHELL) ./config.status $(subdir)/$@ $(am__depfiles_maybe)'; \ + cd $(top_builddir) && $(SHELL) ./config.status $(subdir)/$@ $(am__depfiles_maybe);; \ + esac; + +$(top_builddir)/config.status: $(top_srcdir)/configure $(CONFIG_STATUS_DEPENDENCIES) + cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh + +$(top_srcdir)/configure: $(am__configure_deps) + cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh +$(ACLOCAL_M4): $(am__aclocal_m4_deps) + cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh +$(am__aclocal_m4_deps): +install-imcvLTLIBRARIES: $(imcv_LTLIBRARIES) + @$(NORMAL_INSTALL) + @list='$(imcv_LTLIBRARIES)'; test -n "$(imcvdir)" || list=; \ + list2=; for p in $$list; do \ + if test -f $$p; then \ + list2="$$list2 $$p"; \ + else :; fi; \ + done; \ + test -z "$$list2" || { \ + echo " $(MKDIR_P) '$(DESTDIR)$(imcvdir)'"; \ + $(MKDIR_P) "$(DESTDIR)$(imcvdir)" || exit 1; \ + echo " $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=install $(INSTALL) $(INSTALL_STRIP_FLAG) $$list2 '$(DESTDIR)$(imcvdir)'"; \ + $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=install $(INSTALL) $(INSTALL_STRIP_FLAG) $$list2 "$(DESTDIR)$(imcvdir)"; \ + } + +uninstall-imcvLTLIBRARIES: + @$(NORMAL_UNINSTALL) + @list='$(imcv_LTLIBRARIES)'; test -n "$(imcvdir)" || list=; \ + for p in $$list; do \ + $(am__strip_dir) \ + echo " $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=uninstall rm -f '$(DESTDIR)$(imcvdir)/$$f'"; \ + $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=uninstall rm -f "$(DESTDIR)$(imcvdir)/$$f"; \ + done + +clean-imcvLTLIBRARIES: + -test -z "$(imcv_LTLIBRARIES)" || rm -f $(imcv_LTLIBRARIES) + @list='$(imcv_LTLIBRARIES)'; for p in $$list; do \ + dir="`echo $$p | sed -e 's|/[^/]*$$||'`"; \ + test "$$dir" != "$$p" || dir=.; \ + echo "rm -f \"$${dir}/so_locations\""; \ + rm -f "$${dir}/so_locations"; \ + done +imc-os.la: $(imc_os_la_OBJECTS) $(imc_os_la_DEPENDENCIES) $(EXTRA_imc_os_la_DEPENDENCIES) + $(AM_V_CCLD)$(imc_os_la_LINK) -rpath $(imcvdir) $(imc_os_la_OBJECTS) $(imc_os_la_LIBADD) $(LIBS) + +mostlyclean-compile: + -rm -f *.$(OBJEXT) + +distclean-compile: + -rm -f *.tab.c + +@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/imc_os.Plo@am__quote@ +@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/imc_os_state.Plo@am__quote@ + +.c.o: +@am__fastdepCC_TRUE@ $(AM_V_CC)$(COMPILE) -MT $@ -MD -MP -MF $(DEPDIR)/$*.Tpo -c -o $@ $< +@am__fastdepCC_TRUE@ $(AM_V_at)$(am__mv) $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Po +@AMDEP_TRUE@@am__fastdepCC_FALSE@ $(AM_V_CC)source='$<' object='$@' libtool=no @AMDEPBACKSLASH@ +@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@ +@am__fastdepCC_FALSE@ $(AM_V_CC@am__nodep@)$(COMPILE) -c $< + +.c.obj: +@am__fastdepCC_TRUE@ $(AM_V_CC)$(COMPILE) -MT $@ -MD -MP -MF $(DEPDIR)/$*.Tpo -c -o $@ `$(CYGPATH_W) '$<'` +@am__fastdepCC_TRUE@ $(AM_V_at)$(am__mv) $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Po +@AMDEP_TRUE@@am__fastdepCC_FALSE@ $(AM_V_CC)source='$<' object='$@' libtool=no @AMDEPBACKSLASH@ +@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@ +@am__fastdepCC_FALSE@ $(AM_V_CC@am__nodep@)$(COMPILE) -c `$(CYGPATH_W) '$<'` + +.c.lo: +@am__fastdepCC_TRUE@ $(AM_V_CC)$(LTCOMPILE) -MT $@ -MD -MP -MF $(DEPDIR)/$*.Tpo -c -o $@ $< +@am__fastdepCC_TRUE@ $(AM_V_at)$(am__mv) $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Plo +@AMDEP_TRUE@@am__fastdepCC_FALSE@ $(AM_V_CC)source='$<' object='$@' libtool=yes @AMDEPBACKSLASH@ +@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@ +@am__fastdepCC_FALSE@ $(AM_V_CC@am__nodep@)$(LTCOMPILE) -c -o $@ $< + +mostlyclean-libtool: + -rm -f *.lo + +clean-libtool: + -rm -rf .libs _libs + +ID: $(HEADERS) $(SOURCES) $(LISP) $(TAGS_FILES) + list='$(SOURCES) $(HEADERS) $(LISP) $(TAGS_FILES)'; \ + unique=`for i in $$list; do \ + if test -f "$$i"; then echo $$i; else echo $(srcdir)/$$i; fi; \ + done | \ + $(AWK) '{ files[$$0] = 1; nonempty = 1; } \ + END { if (nonempty) { for (i in files) print i; }; }'`; \ + mkid -fID $$unique +tags: TAGS + +TAGS: $(HEADERS) $(SOURCES) $(TAGS_DEPENDENCIES) \ + $(TAGS_FILES) $(LISP) + set x; \ + here=`pwd`; \ + list='$(SOURCES) $(HEADERS) $(LISP) $(TAGS_FILES)'; \ + unique=`for i in $$list; do \ + if test -f "$$i"; then echo $$i; else echo $(srcdir)/$$i; fi; \ + done | \ + $(AWK) '{ files[$$0] = 1; nonempty = 1; } \ + END { if (nonempty) { for (i in files) print i; }; }'`; \ + shift; \ + if test -z "$(ETAGS_ARGS)$$*$$unique"; then :; else \ + test -n "$$unique" || unique=$$empty_fix; \ + if test $$# -gt 0; then \ + $(ETAGS) $(ETAGSFLAGS) $(AM_ETAGSFLAGS) $(ETAGS_ARGS) \ + "$$@" $$unique; \ + else \ + $(ETAGS) $(ETAGSFLAGS) $(AM_ETAGSFLAGS) $(ETAGS_ARGS) \ + $$unique; \ + fi; \ + fi +ctags: CTAGS +CTAGS: $(HEADERS) $(SOURCES) $(TAGS_DEPENDENCIES) \ + $(TAGS_FILES) $(LISP) + list='$(SOURCES) $(HEADERS) $(LISP) $(TAGS_FILES)'; \ + unique=`for i in $$list; do \ + if test -f "$$i"; then echo $$i; else echo $(srcdir)/$$i; fi; \ + done | \ + $(AWK) '{ files[$$0] = 1; nonempty = 1; } \ + END { if (nonempty) { for (i in files) print i; }; }'`; \ + test -z "$(CTAGS_ARGS)$$unique" \ + || $(CTAGS) $(CTAGSFLAGS) $(AM_CTAGSFLAGS) $(CTAGS_ARGS) \ + $$unique + +GTAGS: + here=`$(am__cd) $(top_builddir) && pwd` \ + && $(am__cd) $(top_srcdir) \ + && gtags -i $(GTAGS_ARGS) "$$here" + +distclean-tags: + -rm -f TAGS ID GTAGS GRTAGS GSYMS GPATH tags + +distdir: $(DISTFILES) + @srcdirstrip=`echo "$(srcdir)" | sed 's/[].[^$$\\*]/\\\\&/g'`; \ + topsrcdirstrip=`echo "$(top_srcdir)" | sed 's/[].[^$$\\*]/\\\\&/g'`; \ + list='$(DISTFILES)'; \ + dist_files=`for file in $$list; do echo $$file; done | \ + sed -e "s|^$$srcdirstrip/||;t" \ + -e "s|^$$topsrcdirstrip/|$(top_builddir)/|;t"`; \ + case $$dist_files in \ + */*) $(MKDIR_P) `echo "$$dist_files" | \ + sed '/\//!d;s|^|$(distdir)/|;s,/[^/]*$$,,' | \ + sort -u` ;; \ + esac; \ + for file in $$dist_files; do \ + if test -f $$file || test -d $$file; then d=.; else d=$(srcdir); fi; \ + if test -d $$d/$$file; then \ + dir=`echo "/$$file" | sed -e 's,/[^/]*$$,,'`; \ + if test -d "$(distdir)/$$file"; then \ + find "$(distdir)/$$file" -type d ! -perm -700 -exec chmod u+rwx {} \;; \ + fi; \ + if test -d $(srcdir)/$$file && test $$d != $(srcdir); then \ + cp -fpR $(srcdir)/$$file "$(distdir)$$dir" || exit 1; \ + find "$(distdir)/$$file" -type d ! -perm -700 -exec chmod u+rwx {} \;; \ + fi; \ + cp -fpR $$d/$$file "$(distdir)$$dir" || exit 1; \ + else \ + test -f "$(distdir)/$$file" \ + || cp -p $$d/$$file "$(distdir)/$$file" \ + || exit 1; \ + fi; \ + done +check-am: all-am +check: check-am +all-am: Makefile $(LTLIBRARIES) +installdirs: + for dir in "$(DESTDIR)$(imcvdir)"; do \ + test -z "$$dir" || $(MKDIR_P) "$$dir"; \ + done +install: install-am +install-exec: install-exec-am +install-data: install-data-am +uninstall: uninstall-am + +install-am: all-am + @$(MAKE) $(AM_MAKEFLAGS) install-exec-am install-data-am + +installcheck: installcheck-am +install-strip: + if test -z '$(STRIP)'; then \ + $(MAKE) $(AM_MAKEFLAGS) INSTALL_PROGRAM="$(INSTALL_STRIP_PROGRAM)" \ + install_sh_PROGRAM="$(INSTALL_STRIP_PROGRAM)" INSTALL_STRIP_FLAG=-s \ + install; \ + else \ + $(MAKE) $(AM_MAKEFLAGS) INSTALL_PROGRAM="$(INSTALL_STRIP_PROGRAM)" \ + install_sh_PROGRAM="$(INSTALL_STRIP_PROGRAM)" INSTALL_STRIP_FLAG=-s \ + "INSTALL_PROGRAM_ENV=STRIPPROG='$(STRIP)'" install; \ + fi +mostlyclean-generic: + +clean-generic: + +distclean-generic: + -test -z "$(CONFIG_CLEAN_FILES)" || rm -f $(CONFIG_CLEAN_FILES) + -test . = "$(srcdir)" || test -z "$(CONFIG_CLEAN_VPATH_FILES)" || rm -f $(CONFIG_CLEAN_VPATH_FILES) + +maintainer-clean-generic: + @echo "This command is intended for maintainers to use" + @echo "it deletes files that may require special tools to rebuild." +clean: clean-am + +clean-am: clean-generic clean-imcvLTLIBRARIES clean-libtool \ + mostlyclean-am + +distclean: distclean-am + -rm -rf ./$(DEPDIR) + -rm -f Makefile +distclean-am: clean-am distclean-compile distclean-generic \ + distclean-tags + +dvi: dvi-am + +dvi-am: + +html: html-am + +html-am: + +info: info-am + +info-am: + +install-data-am: install-imcvLTLIBRARIES + +install-dvi: install-dvi-am + +install-dvi-am: + +install-exec-am: + +install-html: install-html-am + +install-html-am: + +install-info: install-info-am + +install-info-am: + +install-man: + +install-pdf: install-pdf-am + +install-pdf-am: + +install-ps: install-ps-am + +install-ps-am: + +installcheck-am: + +maintainer-clean: maintainer-clean-am + -rm -rf ./$(DEPDIR) + -rm -f Makefile +maintainer-clean-am: distclean-am maintainer-clean-generic + +mostlyclean: mostlyclean-am + +mostlyclean-am: mostlyclean-compile mostlyclean-generic \ + mostlyclean-libtool + +pdf: pdf-am + +pdf-am: + +ps: ps-am + +ps-am: + +uninstall-am: uninstall-imcvLTLIBRARIES + +.MAKE: install-am install-strip + +.PHONY: CTAGS GTAGS all all-am check check-am clean clean-generic \ + clean-imcvLTLIBRARIES clean-libtool ctags distclean \ + distclean-compile distclean-generic distclean-libtool \ + distclean-tags distdir dvi dvi-am html html-am info info-am \ + install install-am install-data install-data-am install-dvi \ + install-dvi-am install-exec install-exec-am install-html \ + install-html-am install-imcvLTLIBRARIES install-info \ + install-info-am install-man install-pdf install-pdf-am \ + install-ps install-ps-am install-strip installcheck \ + installcheck-am installdirs maintainer-clean \ + maintainer-clean-generic mostlyclean mostlyclean-compile \ + mostlyclean-generic mostlyclean-libtool pdf pdf-am ps ps-am \ + tags uninstall uninstall-am uninstall-imcvLTLIBRARIES + + +# Tell versions [3.59,3.63) of GNU make to not export all variables. +# Otherwise a system limit (for SysV at least) may be exceeded. +.NOEXPORT: diff --git a/src/libimcv/plugins/imc_os/imc_os.c b/src/libimcv/plugins/imc_os/imc_os.c new file mode 100644 index 000000000..2558be9f8 --- /dev/null +++ b/src/libimcv/plugins/imc_os/imc_os.c @@ -0,0 +1,628 @@ +/* + * Copyright (C) 2011-2012 Andreas Steffen + * HSR Hochschule fuer Technik Rapperswil + * + * This program is free software; you can redistribute it and/or modify it + * under the terms of the GNU General Public License as published by the + * Free Software Foundation; either version 2 of the License, or (at your + * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>. + * + * This program is distributed in the hope that it will be useful, but + * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY + * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License + * for more details. + */ + +#include "imc_os_state.h" + +#include <imc/imc_agent.h> +#include <imc/imc_msg.h> +#include <ietf/ietf_attr.h> +#include <ietf/ietf_attr_attr_request.h> +#include <ietf/ietf_attr_default_pwd_enabled.h> +#include <ietf/ietf_attr_fwd_enabled.h> +#include <ietf/ietf_attr_installed_packages.h> +#include <ietf/ietf_attr_numeric_version.h> +#include <ietf/ietf_attr_op_status.h> +#include <ietf/ietf_attr_product_info.h> +#include <ietf/ietf_attr_string_version.h> +#include <ita/ita_attr.h> +#include <ita/ita_attr_get_settings.h> +#include <ita/ita_attr_settings.h> +#include <ita/ita_attr_angel.h> +#include <ita/ita_attr_device_id.h> +#include <os_info/os_info.h> + +#include <tncif_pa_subtypes.h> + +#include <pen/pen.h> +#include <utils/debug.h> + +/* IMC definitions */ + +static const char imc_name[] = "OS"; + +static pen_type_t msg_types[] = { + { PEN_IETF, PA_SUBTYPE_IETF_OPERATING_SYSTEM } +}; + +static imc_agent_t *imc_os; +static os_info_t *os; + +/** + * see section 3.8.1 of TCG TNC IF-IMC Specification 1.3 + */ +TNC_Result TNC_IMC_Initialize(TNC_IMCID imc_id, + TNC_Version min_version, + TNC_Version max_version, + TNC_Version *actual_version) +{ + if (imc_os) + { + DBG1(DBG_IMC, "IMC \"%s\" has already been initialized", imc_name); + return TNC_RESULT_ALREADY_INITIALIZED; + } + imc_os = imc_agent_create(imc_name, msg_types, countof(msg_types), + imc_id, actual_version); + if (!imc_os) + { + return TNC_RESULT_FATAL; + } + + os = os_info_create(); + if (!os) + { + imc_os->destroy(imc_os); + imc_os = NULL; + + return TNC_RESULT_FATAL; + } + + if (min_version > TNC_IFIMC_VERSION_1 || max_version < TNC_IFIMC_VERSION_1) + { + DBG1(DBG_IMC, "no common IF-IMC version"); + return TNC_RESULT_NO_COMMON_VERSION; + } + return TNC_RESULT_SUCCESS; +} + +/** + * see section 3.8.2 of TCG TNC IF-IMC Specification 1.3 + */ +TNC_Result TNC_IMC_NotifyConnectionChange(TNC_IMCID imc_id, + TNC_ConnectionID connection_id, + TNC_ConnectionState new_state) +{ + imc_state_t *state; + + if (!imc_os) + { + DBG1(DBG_IMC, "IMC \"%s\" has not been initialized", imc_name); + return TNC_RESULT_NOT_INITIALIZED; + } + switch (new_state) + { + case TNC_CONNECTION_STATE_CREATE: + state = imc_os_state_create(connection_id); + return imc_os->create_state(imc_os, state); + case TNC_CONNECTION_STATE_HANDSHAKE: + if (imc_os->change_state(imc_os, connection_id, new_state, + &state) != TNC_RESULT_SUCCESS) + { + return TNC_RESULT_FATAL; + } + state->set_result(state, imc_id, + TNC_IMV_EVALUATION_RESULT_DONT_KNOW); + return TNC_RESULT_SUCCESS; + case TNC_CONNECTION_STATE_DELETE: + return imc_os->delete_state(imc_os, connection_id); + default: + return imc_os->change_state(imc_os, connection_id, + new_state, NULL); + } +} + +/** + * Add IETF Product Information attribute to the send queue + */ +static void add_product_info(imc_msg_t *msg) +{ + pa_tnc_attr_t *attr; + os_type_t os_type; + pen_t vendor_id = PEN_IETF; + int i; + + typedef struct vendor_pen_t { + os_type_t os_type; + pen_t pen; + } vendor_pen_t; + + vendor_pen_t vendor_pens[] = { + { OS_TYPE_DEBIAN, PEN_DEBIAN }, + { OS_TYPE_UBUNTU, PEN_CANONICAL }, + { OS_TYPE_FEDORA, PEN_FEDORA }, + { OS_TYPE_REDHAT, PEN_REDHAT }, + { OS_TYPE_ANDROID, PEN_GOOGLE } + }; + + os_type = os->get_type(os); + for (i = 0; i < countof(vendor_pens); i++) + { + if (os_type == vendor_pens[i].os_type) + { + vendor_id = vendor_pens[i].pen; + break; + } + } + attr = ietf_attr_product_info_create(vendor_id, 0, os->get_name(os)); + msg->add_attribute(msg, attr); +} + +/** + * Add IETF Numeric Version attribute to the send queue + */ +static void add_numeric_version(imc_msg_t *msg) +{ + pa_tnc_attr_t *attr; + u_int32_t major, minor; + + os->get_numeric_version(os, &major, &minor); + DBG1(DBG_IMC, "operating system numeric version is %d.%d", + major, minor); + + attr = ietf_attr_numeric_version_create(major, minor, 0, 0, 0); + msg->add_attribute(msg, attr); +} + +/** + * Add IETF String Version attribute to the send queue + */ +static void add_string_version(imc_msg_t *msg) +{ + pa_tnc_attr_t *attr; + + attr = ietf_attr_string_version_create(os->get_version(os), + chunk_empty, chunk_empty); + msg->add_attribute(msg, attr); +} + +/** + * Add IETF Operational Status attribute to the send queue + */ +static void add_op_status(imc_msg_t *msg) +{ + pa_tnc_attr_t *attr; + time_t uptime, last_boot; + + uptime = os->get_uptime(os); + last_boot = uptime ? time(NULL) - uptime : UNDEFINED_TIME; + if (last_boot != UNDEFINED_TIME) + { + DBG1(DBG_IMC, "last boot: %T, %u s ago", &last_boot, TRUE, uptime); + } + attr = ietf_attr_op_status_create(OP_STATUS_OPERATIONAL, + OP_RESULT_SUCCESSFUL, last_boot); + msg->add_attribute(msg, attr); +} + +/** + * Add IETF Forwarding Enabled attribute to the send queue + */ +static void add_fwd_enabled(imc_msg_t *msg) +{ + pa_tnc_attr_t *attr; + os_fwd_status_t fwd_status; + + fwd_status = os->get_fwd_status(os); + DBG1(DBG_IMC, "IPv4 forwarding is %N", + os_fwd_status_names, fwd_status); + attr = ietf_attr_fwd_enabled_create(fwd_status); + msg->add_attribute(msg, attr); +} + +/** + * Add IETF Factory Default Password Enabled attribute to the send queue + */ +static void add_default_pwd_enabled(imc_msg_t *msg) +{ + pa_tnc_attr_t *attr; + + DBG1(DBG_IMC, "factory default password is disabled"); + attr = ietf_attr_default_pwd_enabled_create(FALSE); + msg->add_attribute(msg, attr); +} + +/** + * Add ITA Device ID attribute to the send queue + */ +static void add_device_id(imc_msg_t *msg) +{ + pa_tnc_attr_t *attr; + chunk_t value; + char *name; + + name = os->get_type(os) == OS_TYPE_ANDROID ? + "android_id" : "/var/lib/dbus/machine-id"; + value = os->get_setting(os, name); + + if (value.len == 0) + { + DBG1(DBG_IMC, "no device ID available"); + return; + } + + /* trim trailing newline character */ + if (value.ptr[value.len - 1] == '\n') + { + value.len--; + } + + DBG1(DBG_IMC, "device ID is %.*s", value.len, value.ptr); + attr = ita_attr_device_id_create(value); + msg->add_attribute(msg, attr); + free(value.ptr); +} + +/** + * Add an IETF Installed Packages attribute to the send queue + */ +static void add_installed_packages(imc_state_t *state, imc_msg_t *msg) +{ + pa_tnc_attr_t *attr = NULL, *attr_angel; + ietf_attr_installed_packages_t *attr_cast; + enumerator_t *enumerator; + chunk_t name, version; + size_t max_attr_size, attr_size, entry_size; + bool first = TRUE; + + /** + * Compute the maximum IETF Installed Packages attribute size + * leaving space for an additional ITA Angel attribute + */ + max_attr_size = state->get_max_msg_len(state) - 8 - 12; + + /* At least one IETF Installed Packages attribute is sent */ + attr = ietf_attr_installed_packages_create(); + attr_size = 12 + 4; + + enumerator = os->create_package_enumerator(os); + if (enumerator) + { + while (enumerator->enumerate(enumerator, &name, &version)) + { + DBG2(DBG_IMC, "package '%.*s' (%.*s)", + name.len, name.ptr, version.len, version.ptr); + + entry_size = 2 + name.len + version.len; + if (attr_size + entry_size > max_attr_size) + { + if (first) + { + /** + * Send an ITA Start Angel attribute to the IMV signalling + * that multiple ITA Installed Package attributes follow. + */ + attr_angel = ita_attr_angel_create(TRUE); + msg->add_attribute(msg, attr_angel); + first = FALSE; + } + msg->add_attribute(msg, attr); + + /* create the next IETF Installed Packages attribute */ + attr = ietf_attr_installed_packages_create(); + attr_size = 12 + 4; + } + attr_cast = (ietf_attr_installed_packages_t*)attr; + attr_cast->add(attr_cast, name, version); + attr_size += entry_size; + } + enumerator->destroy(enumerator); + } + msg->add_attribute(msg, attr); + + if (!first) + { + /** + * If we sent an ITA Start Angel attribute in the first place, + * terminate by appending a matching ITA Stop Angel attribute. + */ + attr_angel = ita_attr_angel_create(FALSE); + msg->add_attribute(msg, attr_angel); + } +} + +/** + * Add ITA Settings attribute to the send queue + */ +static void add_settings(enumerator_t *enumerator, imc_msg_t *msg) +{ + pa_tnc_attr_t *attr = NULL; + ita_attr_settings_t *attr_cast; + chunk_t value; + char *name; + bool first = TRUE; + + while (enumerator->enumerate(enumerator, &name)) + { + DBG1(DBG_IMC, "setting '%s'", name); + + value = os->get_setting(os, name); + if (!value.ptr) + { + continue; + } + if (first) + { + attr = ita_attr_settings_create(); + first = FALSE; + } + attr_cast = (ita_attr_settings_t*)attr; + attr_cast->add(attr_cast, name, value); + chunk_free(&value); + } + + if (attr) + { + msg->add_attribute(msg, attr); + } +} + +/** + * see section 3.8.3 of TCG TNC IF-IMC Specification 1.3 + */ +TNC_Result TNC_IMC_BeginHandshake(TNC_IMCID imc_id, + TNC_ConnectionID connection_id) +{ + imc_state_t *state; + imc_msg_t *out_msg; + TNC_Result result = TNC_RESULT_SUCCESS; + + if (!imc_os) + { + DBG1(DBG_IMC, "IMC \"%s\" has not been initialized", imc_name); + return TNC_RESULT_NOT_INITIALIZED; + } + if (!imc_os->get_state(imc_os, connection_id, &state)) + { + return TNC_RESULT_FATAL; + } + if (lib->settings->get_bool(lib->settings, + "libimcv.plugins.imc-os.push_info", TRUE)) + { + out_msg = imc_msg_create(imc_os, state, connection_id, imc_id, + TNC_IMVID_ANY, msg_types[0]); + add_product_info(out_msg); + add_string_version(out_msg); + add_numeric_version(out_msg); + add_op_status(out_msg); + add_fwd_enabled(out_msg); + add_default_pwd_enabled(out_msg); + add_device_id(out_msg); + + /* send PA-TNC message with the excl flag not set */ + result = out_msg->send(out_msg, FALSE); + out_msg->destroy(out_msg); + } + + return result; +} + +static TNC_Result receive_message(imc_state_t *state, imc_msg_t *in_msg) +{ + imc_msg_t *out_msg; + enumerator_t *enumerator; + pa_tnc_attr_t *attr; + pen_type_t type; + TNC_Result result; + bool fatal_error = FALSE; + + /* parse received PA-TNC message and handle local and remote errors */ + result = in_msg->receive(in_msg, &fatal_error); + if (result != TNC_RESULT_SUCCESS) + { + return result; + } + out_msg = imc_msg_create_as_reply(in_msg); + + /* analyze PA-TNC attributes */ + enumerator = in_msg->create_attribute_enumerator(in_msg); + while (enumerator->enumerate(enumerator, &attr)) + { + type = attr->get_type(attr); + + if (type.vendor_id == PEN_IETF) + { + if (type.type == IETF_ATTR_ATTRIBUTE_REQUEST) + { + ietf_attr_attr_request_t *attr_cast; + pen_type_t *entry; + enumerator_t *e; + + attr_cast = (ietf_attr_attr_request_t*)attr; + + e = attr_cast->create_enumerator(attr_cast); + while (e->enumerate(e, &entry)) + { + if (entry->vendor_id == PEN_IETF) + { + switch (entry->type) + { + case IETF_ATTR_PRODUCT_INFORMATION: + add_product_info(out_msg); + break; + case IETF_ATTR_STRING_VERSION: + add_string_version(out_msg); + break; + case IETF_ATTR_NUMERIC_VERSION: + add_numeric_version(out_msg); + break; + case IETF_ATTR_OPERATIONAL_STATUS: + add_op_status(out_msg); + break; + case IETF_ATTR_FORWARDING_ENABLED: + add_fwd_enabled(out_msg); + break; + case IETF_ATTR_FACTORY_DEFAULT_PWD_ENABLED: + add_default_pwd_enabled(out_msg); + break; + case IETF_ATTR_INSTALLED_PACKAGES: + add_installed_packages(state, out_msg); + break; + default: + break; + } + } + else if (entry->vendor_id == PEN_ITA) + { + switch (entry->type) + { + case ITA_ATTR_DEVICE_ID: + add_device_id(out_msg); + break; + default: + break; + } + } + } + e->destroy(e); + } + } + else if (type.vendor_id == PEN_ITA && type.type == ITA_ATTR_GET_SETTINGS) + { + ita_attr_get_settings_t *attr_cast; + enumerator_t *e; + + attr_cast = (ita_attr_get_settings_t*)attr; + + e = attr_cast->create_enumerator(attr_cast); + add_settings(e, out_msg); + e->destroy(e); + } + } + enumerator->destroy(enumerator); + + if (fatal_error) + { + result = TNC_RESULT_FATAL; + } + else + { + result = out_msg->send(out_msg, TRUE); + } + out_msg->destroy(out_msg); + + return result; +} + +/** + * see section 3.8.4 of TCG TNC IF-IMC Specification 1.3 + + */ +TNC_Result TNC_IMC_ReceiveMessage(TNC_IMCID imc_id, + TNC_ConnectionID connection_id, + TNC_BufferReference msg, + TNC_UInt32 msg_len, + TNC_MessageType msg_type) +{ + imc_state_t *state; + imc_msg_t *in_msg; + TNC_Result result; + + if (!imc_os) + { + DBG1(DBG_IMC, "IMC \"%s\" has not been initialized", imc_name); + return TNC_RESULT_NOT_INITIALIZED; + } + if (!imc_os->get_state(imc_os, connection_id, &state)) + { + return TNC_RESULT_FATAL; + } + in_msg = imc_msg_create_from_data(imc_os, state, connection_id, msg_type, + chunk_create(msg, msg_len)); + result = receive_message(state, in_msg); + in_msg->destroy(in_msg); + + return result; +} + +/** + * see section 3.8.6 of TCG TNC IF-IMV Specification 1.3 + */ +TNC_Result TNC_IMC_ReceiveMessageLong(TNC_IMCID imc_id, + TNC_ConnectionID connection_id, + TNC_UInt32 msg_flags, + TNC_BufferReference msg, + TNC_UInt32 msg_len, + TNC_VendorID msg_vid, + TNC_MessageSubtype msg_subtype, + TNC_UInt32 src_imv_id, + TNC_UInt32 dst_imc_id) +{ + imc_state_t *state; + imc_msg_t *in_msg; + TNC_Result result; + + if (!imc_os) + { + DBG1(DBG_IMC, "IMC \"%s\" has not been initialized", imc_name); + return TNC_RESULT_NOT_INITIALIZED; + } + if (!imc_os->get_state(imc_os, connection_id, &state)) + { + return TNC_RESULT_FATAL; + } + in_msg = imc_msg_create_from_long_data(imc_os, state, connection_id, + src_imv_id, dst_imc_id,msg_vid, msg_subtype, + chunk_create(msg, msg_len)); + result =receive_message(state, in_msg); + in_msg->destroy(in_msg); + + return result; +} + +/** + * see section 3.8.7 of TCG TNC IF-IMC Specification 1.3 + */ +TNC_Result TNC_IMC_BatchEnding(TNC_IMCID imc_id, + TNC_ConnectionID connection_id) +{ + if (!imc_os) + { + DBG1(DBG_IMC, "IMC \"%s\" has not been initialized", imc_name); + return TNC_RESULT_NOT_INITIALIZED; + } + return TNC_RESULT_SUCCESS; +} + +/** + * see section 3.8.8 of TCG TNC IF-IMC Specification 1.3 + */ +TNC_Result TNC_IMC_Terminate(TNC_IMCID imc_id) +{ + if (!imc_os) + { + DBG1(DBG_IMC, "IMC \"%s\" has not been initialized", imc_name); + return TNC_RESULT_NOT_INITIALIZED; + } + imc_os->destroy(imc_os); + imc_os = NULL; + + os->destroy(os); + os = NULL; + + return TNC_RESULT_SUCCESS; +} + +/** + * see section 4.2.8.1 of TCG TNC IF-IMC Specification 1.3 + */ +TNC_Result TNC_IMC_ProvideBindFunction(TNC_IMCID imc_id, + TNC_TNCC_BindFunctionPointer bind_function) +{ + if (!imc_os) + { + DBG1(DBG_IMC, "IMC \"%s\" has not been initialized", imc_name); + return TNC_RESULT_NOT_INITIALIZED; + } + return imc_os->bind_functions(imc_os, bind_function); +} diff --git a/src/libimcv/plugins/imc_os/imc_os_state.c b/src/libimcv/plugins/imc_os/imc_os_state.c new file mode 100644 index 000000000..f49959ab9 --- /dev/null +++ b/src/libimcv/plugins/imc_os/imc_os_state.c @@ -0,0 +1,162 @@ +/* + * Copyright (C) 2012 Andreas Steffen + * HSR Hochschule fuer Technik Rapperswil + * + * This program is free software; you can redistribute it and/or modify it + * under the terms of the GNU General Public License as published by the + * Free Software Foundation; either version 2 of the License, or (at your + * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>. + * + * This program is distributed in the hope that it will be useful, but + * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY + * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License + * for more details. + */ + +#include "imc_os_state.h" + +#include <tncif_names.h> + +#include <utils/debug.h> + +typedef struct private_imc_os_state_t private_imc_os_state_t; + +/** + * Private data of an imc_os_state_t object. + */ +struct private_imc_os_state_t { + + /** + * Public members of imc_os_state_t + */ + imc_os_state_t public; + + /** + * TNCCS connection ID + */ + TNC_ConnectionID connection_id; + + /** + * TNCCS connection state + */ + TNC_ConnectionState state; + + /** + * Assessment/Evaluation Result + */ + TNC_IMV_Evaluation_Result result; + + /** + * Does the TNCCS connection support long message types? + */ + bool has_long; + + /** + * Does the TNCCS connection support exclusive delivery? + */ + bool has_excl; + + /** + * Maximum PA-TNC message size for this TNCCS connection + */ + u_int32_t max_msg_len; +}; + +METHOD(imc_state_t, get_connection_id, TNC_ConnectionID, + private_imc_os_state_t *this) +{ + return this->connection_id; +} + +METHOD(imc_state_t, has_long, bool, + private_imc_os_state_t *this) +{ + return this->has_long; +} + +METHOD(imc_state_t, has_excl, bool, + private_imc_os_state_t *this) +{ + return this->has_excl; +} + +METHOD(imc_state_t, set_flags, void, + private_imc_os_state_t *this, bool has_long, bool has_excl) +{ + this->has_long = has_long; + this->has_excl = has_excl; +} + +METHOD(imc_state_t, set_max_msg_len, void, + private_imc_os_state_t *this, u_int32_t max_msg_len) +{ + this->max_msg_len = max_msg_len; +} + +METHOD(imc_state_t, get_max_msg_len, u_int32_t, + private_imc_os_state_t *this) +{ + return this->max_msg_len; +} + +METHOD(imc_state_t, change_state, void, + private_imc_os_state_t *this, TNC_ConnectionState new_state) +{ + this->state = new_state; +} + +METHOD(imc_state_t, set_result, void, + private_imc_os_state_t *this, TNC_IMCID id, + TNC_IMV_Evaluation_Result result) +{ + this->result = result; +} + +METHOD(imc_state_t, get_result, bool, + private_imc_os_state_t *this, TNC_IMCID id, + TNC_IMV_Evaluation_Result *result) +{ + if (result) + { + *result = this->result; + } + return this->result != TNC_IMV_EVALUATION_RESULT_DONT_KNOW; +} + +METHOD(imc_state_t, destroy, void, + private_imc_os_state_t *this) +{ + free(this); +} + +/** + * Described in header. + */ +imc_state_t *imc_os_state_create(TNC_ConnectionID connection_id) +{ + private_imc_os_state_t *this; + + INIT(this, + .public = { + .interface = { + .get_connection_id = _get_connection_id, + .has_long = _has_long, + .has_excl = _has_excl, + .set_flags = _set_flags, + .set_max_msg_len = _set_max_msg_len, + .get_max_msg_len = _get_max_msg_len, + .change_state = _change_state, + .set_result = _set_result, + .get_result = _get_result, + .destroy = _destroy, + }, + }, + .state = TNC_CONNECTION_STATE_CREATE, + .result = TNC_IMV_EVALUATION_RESULT_DONT_KNOW, + .connection_id = connection_id, + ); + + return &this->public.interface; +} + + diff --git a/src/libimcv/plugins/imc_os/imc_os_state.h b/src/libimcv/plugins/imc_os/imc_os_state.h new file mode 100644 index 000000000..366e2b60c --- /dev/null +++ b/src/libimcv/plugins/imc_os/imc_os_state.h @@ -0,0 +1,50 @@ +/* + * Copyright (C) 2012 Andreas Steffen + * HSR Hochschule fuer Technik Rapperswil + * + * This program is free software; you can redistribute it and/or modify it + * under the terms of the GNU General Public License as published by the + * Free Software Foundation; either version 2 of the License, or (at your + * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>. + * + * This program is distributed in the hope that it will be useful, but + * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY + * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License + * for more details. + */ + +/** + * @defgroup imc_os imc_os + * @ingroup libimcv_plugins + * + * @defgroup imc_os_state_t imc_os_state + * @{ @ingroup imc_os + */ + +#ifndef IMC_OS_STATE_H_ +#define IMC_OS_STATE_H_ + +#include <imc/imc_state.h> +#include <library.h> + +typedef struct imc_os_state_t imc_os_state_t; + +/** + * Internal state of an imc_os_t connection instance + */ +struct imc_os_state_t { + + /** + * imc_state_t interface + */ + imc_state_t interface; +}; + +/** + * Create an imc_os_state_t instance + * + * @param id connection ID + */ +imc_state_t* imc_os_state_create(TNC_ConnectionID id); + +#endif /** IMC_OS_STATE_H_ @}*/ diff --git a/src/libimcv/plugins/imc_scanner/Makefile.am b/src/libimcv/plugins/imc_scanner/Makefile.am index f27d73b67..b294541c4 100644 --- a/src/libimcv/plugins/imc_scanner/Makefile.am +++ b/src/libimcv/plugins/imc_scanner/Makefile.am @@ -1,8 +1,10 @@ - -INCLUDES = -I$(top_srcdir)/src/libstrongswan -I$(top_srcdir)/src/libtncif \ +AM_CPPFLAGS = \ + -I$(top_srcdir)/src/libstrongswan \ + -I$(top_srcdir)/src/libtncif \ -I$(top_srcdir)/src/libimcv -AM_CFLAGS = -rdynamic +AM_CFLAGS = \ + -rdynamic imcv_LTLIBRARIES = imc-scanner.la @@ -12,4 +14,3 @@ imc_scanner_la_LIBADD = $(top_builddir)/src/libimcv/libimcv.la \ imc_scanner_la_SOURCES = imc_scanner.c imc_scanner_state.h imc_scanner_state.c imc_scanner_la_LDFLAGS = -module -avoid-version - diff --git a/src/libimcv/plugins/imc_scanner/Makefile.in b/src/libimcv/plugins/imc_scanner/Makefile.in index 497d317d5..39d3ae685 100644 --- a/src/libimcv/plugins/imc_scanner/Makefile.in +++ b/src/libimcv/plugins/imc_scanner/Makefile.in @@ -1,9 +1,9 @@ -# Makefile.in generated by automake 1.11.1 from Makefile.am. +# Makefile.in generated by automake 1.11.6 from Makefile.am. # @configure_input@ # Copyright (C) 1994, 1995, 1996, 1997, 1998, 1999, 2000, 2001, 2002, -# 2003, 2004, 2005, 2006, 2007, 2008, 2009 Free Software Foundation, -# Inc. +# 2003, 2004, 2005, 2006, 2007, 2008, 2009, 2010, 2011 Free Software +# Foundation, Inc. # This Makefile.in is free software; the Free Software Foundation # gives unlimited permission to copy and/or distribute it, # with or without modifications, as long as this notice is preserved. @@ -16,6 +16,23 @@ @SET_MAKE@ VPATH = @srcdir@ +am__make_dryrun = \ + { \ + am__dry=no; \ + case $$MAKEFLAGS in \ + *\\[\ \ ]*) \ + echo 'am--echo: ; @echo "AM" OK' | $(MAKE) -f - 2>/dev/null \ + | grep '^AM OK$$' >/dev/null || am__dry=yes;; \ + *) \ + for am__flg in $$MAKEFLAGS; do \ + case $$am__flg in \ + *=*|--*) ;; \ + *n*) am__dry=yes; break;; \ + esac; \ + done;; \ + esac; \ + test $$am__dry = yes; \ + } pkgdatadir = $(datadir)/@PACKAGE@ pkgincludedir = $(includedir)/@PACKAGE@ pkglibdir = $(libdir)/@PACKAGE@ @@ -45,10 +62,11 @@ am__aclocal_m4_deps = $(top_srcdir)/m4/config/libtool.m4 \ $(top_srcdir)/m4/macros/with.m4 \ $(top_srcdir)/m4/macros/enable-disable.m4 \ $(top_srcdir)/m4/macros/add-plugin.m4 \ - $(top_srcdir)/configure.in + $(top_srcdir)/configure.ac am__configure_deps = $(am__aclocal_m4_deps) $(CONFIGURE_DEPENDENCIES) \ $(ACLOCAL_M4) mkinstalldirs = $(install_sh) -d +CONFIG_HEADER = $(top_builddir)/config.h CONFIG_CLEAN_FILES = CONFIG_CLEAN_VPATH_FILES = am__vpath_adj_setup = srcdirstrip=`echo "$(srcdir)" | sed 's|.|.|g'`; @@ -72,51 +90,86 @@ am__nobase_list = $(am__nobase_strip_setup); \ am__base_list = \ sed '$$!N;$$!N;$$!N;$$!N;$$!N;$$!N;$$!N;s/\n/ /g' | \ sed '$$!N;$$!N;$$!N;$$!N;s/\n/ /g' +am__uninstall_files_from_dir = { \ + test -z "$$files" \ + || { test ! -d "$$dir" && test ! -f "$$dir" && test ! -r "$$dir"; } \ + || { echo " ( cd '$$dir' && rm -f" $$files ")"; \ + $(am__cd) "$$dir" && rm -f $$files; }; \ + } am__installdirs = "$(DESTDIR)$(imcvdir)" LTLIBRARIES = $(imcv_LTLIBRARIES) imc_scanner_la_DEPENDENCIES = $(top_builddir)/src/libimcv/libimcv.la \ $(top_builddir)/src/libstrongswan/libstrongswan.la am_imc_scanner_la_OBJECTS = imc_scanner.lo imc_scanner_state.lo imc_scanner_la_OBJECTS = $(am_imc_scanner_la_OBJECTS) -imc_scanner_la_LINK = $(LIBTOOL) --tag=CC $(AM_LIBTOOLFLAGS) \ - $(LIBTOOLFLAGS) --mode=link $(CCLD) $(AM_CFLAGS) $(CFLAGS) \ - $(imc_scanner_la_LDFLAGS) $(LDFLAGS) -o $@ -DEFAULT_INCLUDES = -I.@am__isrc@ +AM_V_lt = $(am__v_lt_@AM_V@) +am__v_lt_ = $(am__v_lt_@AM_DEFAULT_V@) +am__v_lt_0 = --silent +imc_scanner_la_LINK = $(LIBTOOL) $(AM_V_lt) --tag=CC \ + $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=link $(CCLD) \ + $(AM_CFLAGS) $(CFLAGS) $(imc_scanner_la_LDFLAGS) $(LDFLAGS) -o \ + $@ +DEFAULT_INCLUDES = -I.@am__isrc@ -I$(top_builddir) depcomp = $(SHELL) $(top_srcdir)/depcomp am__depfiles_maybe = depfiles am__mv = mv -f COMPILE = $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) \ $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -LTCOMPILE = $(LIBTOOL) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) \ - --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) \ - $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) +LTCOMPILE = $(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) \ + $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) \ + $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) \ + $(AM_CFLAGS) $(CFLAGS) +AM_V_CC = $(am__v_CC_@AM_V@) +am__v_CC_ = $(am__v_CC_@AM_DEFAULT_V@) +am__v_CC_0 = @echo " CC " $@; +AM_V_at = $(am__v_at_@AM_V@) +am__v_at_ = $(am__v_at_@AM_DEFAULT_V@) +am__v_at_0 = @ CCLD = $(CC) -LINK = $(LIBTOOL) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) \ - --mode=link $(CCLD) $(AM_CFLAGS) $(CFLAGS) $(AM_LDFLAGS) \ - $(LDFLAGS) -o $@ +LINK = $(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) \ + $(LIBTOOLFLAGS) --mode=link $(CCLD) $(AM_CFLAGS) $(CFLAGS) \ + $(AM_LDFLAGS) $(LDFLAGS) -o $@ +AM_V_CCLD = $(am__v_CCLD_@AM_V@) +am__v_CCLD_ = $(am__v_CCLD_@AM_DEFAULT_V@) +am__v_CCLD_0 = @echo " CCLD " $@; +AM_V_GEN = $(am__v_GEN_@AM_V@) +am__v_GEN_ = $(am__v_GEN_@AM_DEFAULT_V@) +am__v_GEN_0 = @echo " GEN " $@; SOURCES = $(imc_scanner_la_SOURCES) DIST_SOURCES = $(imc_scanner_la_SOURCES) +am__can_run_installinfo = \ + case $$AM_UPDATE_INFO_DIR in \ + n|no|NO) false;; \ + *) (install-info --version) >/dev/null 2>&1;; \ + esac ETAGS = etags CTAGS = ctags DISTFILES = $(DIST_COMMON) $(DIST_SOURCES) $(TEXINFOS) $(EXTRA_DIST) ACLOCAL = @ACLOCAL@ ALLOCA = @ALLOCA@ AMTAR = @AMTAR@ +AM_DEFAULT_VERBOSITY = @AM_DEFAULT_VERBOSITY@ AR = @AR@ AUTOCONF = @AUTOCONF@ AUTOHEADER = @AUTOHEADER@ AUTOMAKE = @AUTOMAKE@ AWK = @AWK@ +BFDLIB = @BFDLIB@ BTLIB = @BTLIB@ CC = @CC@ CCDEPMODE = @CCDEPMODE@ CFLAGS = @CFLAGS@ +CHECK_CFLAGS = @CHECK_CFLAGS@ +CHECK_LIBS = @CHECK_LIBS@ +COVERAGE_CFLAGS = @COVERAGE_CFLAGS@ +COVERAGE_LDFLAGS = @COVERAGE_LDFLAGS@ CPP = @CPP@ CPPFLAGS = @CPPFLAGS@ CYGPATH_W = @CYGPATH_W@ DEFS = @DEFS@ DEPDIR = @DEPDIR@ DLLIB = @DLLIB@ +DLLTOOL = @DLLTOOL@ DSYMUTIL = @DSYMUTIL@ DUMPBIN = @DUMPBIN@ ECHO_C = @ECHO_C@ @@ -125,13 +178,16 @@ ECHO_T = @ECHO_T@ EGREP = @EGREP@ EXEEXT = @EXEEXT@ FGREP = @FGREP@ +GENHTML = @GENHTML@ GPERF = @GPERF@ +GPRBUILD = @GPRBUILD@ GREP = @GREP@ INSTALL = @INSTALL@ INSTALL_DATA = @INSTALL_DATA@ INSTALL_PROGRAM = @INSTALL_PROGRAM@ INSTALL_SCRIPT = @INSTALL_SCRIPT@ INSTALL_STRIP_PROGRAM = @INSTALL_STRIP_PROGRAM@ +LCOV = @LCOV@ LD = @LD@ LDFLAGS = @LDFLAGS@ LEX = @LEX@ @@ -144,6 +200,7 @@ LIPO = @LIPO@ LN_S = @LN_S@ LTLIBOBJS = @LTLIBOBJS@ MAKEINFO = @MAKEINFO@ +MANIFEST_TOOL = @MANIFEST_TOOL@ MKDIR_P = @MKDIR_P@ MYSQLCFLAG = @MYSQLCFLAG@ MYSQLCONFIG = @MYSQLCONFIG@ @@ -171,11 +228,13 @@ RANLIB = @RANLIB@ RTLIB = @RTLIB@ RUBY = @RUBY@ RUBYINCLUDE = @RUBYINCLUDE@ +RUBYLIB = @RUBYLIB@ SED = @SED@ SET_MAKE = @SET_MAKE@ SHELL = @SHELL@ SOCKLIB = @SOCKLIB@ STRIP = @STRIP@ +UNWINDLIB = @UNWINDLIB@ VERSION = @VERSION@ YACC = @YACC@ YFLAGS = @YFLAGS@ @@ -183,6 +242,7 @@ abs_builddir = @abs_builddir@ abs_srcdir = @abs_srcdir@ abs_top_builddir = @abs_top_builddir@ abs_top_srcdir = @abs_top_srcdir@ +ac_ct_AR = @ac_ct_AR@ ac_ct_CC = @ac_ct_CC@ ac_ct_DUMPBIN = @ac_ct_DUMPBIN@ am__include = @am__include@ @@ -191,8 +251,6 @@ am__quote = @am__quote@ am__tar = @am__tar@ am__untar = @am__untar@ attest_plugins = @attest_plugins@ -axis2c_CFLAGS = @axis2c_CFLAGS@ -axis2c_LIBS = @axis2c_LIBS@ bindir = @bindir@ build = @build@ build_alias = @build_alias@ @@ -201,14 +259,19 @@ build_os = @build_os@ build_vendor = @build_vendor@ builddir = @builddir@ c_plugins = @c_plugins@ +charon_natt_port = @charon_natt_port@ +charon_plugins = @charon_plugins@ +charon_udp_port = @charon_udp_port@ clearsilver_LIBS = @clearsilver_LIBS@ +cmd_plugins = @cmd_plugins@ datadir = @datadir@ datarootdir = @datarootdir@ dbusservicedir = @dbusservicedir@ -default_pkcs11 = @default_pkcs11@ +dev_headers = @dev_headers@ docdir = @docdir@ dvidir = @dvidir@ exec_prefix = @exec_prefix@ +fips_mode = @fips_mode@ gtk_CFLAGS = @gtk_CFLAGS@ gtk_LIBS = @gtk_LIBS@ h_plugins = @h_plugins@ @@ -222,17 +285,17 @@ imcvdir = @imcvdir@ includedir = @includedir@ infodir = @infodir@ install_sh = @install_sh@ +ipsec_script = @ipsec_script@ +ipsec_script_upper = @ipsec_script_upper@ ipsecdir = @ipsecdir@ ipsecgroup = @ipsecgroup@ ipseclibdir = @ipseclibdir@ ipsecuser = @ipsecuser@ -libcharon_plugins = @libcharon_plugins@ libdir = @libdir@ libexecdir = @libexecdir@ linux_headers = @linux_headers@ localedir = @localedir@ localstatedir = @localstatedir@ -lt_ECHO = @lt_ECHO@ maemo_CFLAGS = @maemo_CFLAGS@ maemo_LIBS = @maemo_LIBS@ manager_plugins = @manager_plugins@ @@ -242,16 +305,15 @@ mkdir_p = @mkdir_p@ nm_CFLAGS = @nm_CFLAGS@ nm_LIBS = @nm_LIBS@ nm_ca_dir = @nm_ca_dir@ +nm_plugins = @nm_plugins@ oldincludedir = @oldincludedir@ openac_plugins = @openac_plugins@ -p_plugins = @p_plugins@ pcsclite_CFLAGS = @pcsclite_CFLAGS@ pcsclite_LIBS = @pcsclite_LIBS@ pdfdir = @pdfdir@ piddir = @piddir@ pki_plugins = @pki_plugins@ plugindir = @plugindir@ -pluto_plugins = @pluto_plugins@ pool_plugins = @pool_plugins@ prefix = @prefix@ program_transform_name = @program_transform_name@ @@ -279,10 +341,14 @@ top_srcdir = @top_srcdir@ urandom_device = @urandom_device@ xml_CFLAGS = @xml_CFLAGS@ xml_LIBS = @xml_LIBS@ -INCLUDES = -I$(top_srcdir)/src/libstrongswan -I$(top_srcdir)/src/libtncif \ +AM_CPPFLAGS = \ + -I$(top_srcdir)/src/libstrongswan \ + -I$(top_srcdir)/src/libtncif \ -I$(top_srcdir)/src/libimcv -AM_CFLAGS = -rdynamic +AM_CFLAGS = \ + -rdynamic + imcv_LTLIBRARIES = imc-scanner.la imc_scanner_la_LIBADD = $(top_builddir)/src/libimcv/libimcv.la \ $(top_builddir)/src/libstrongswan/libstrongswan.la @@ -325,7 +391,6 @@ $(ACLOCAL_M4): $(am__aclocal_m4_deps) $(am__aclocal_m4_deps): install-imcvLTLIBRARIES: $(imcv_LTLIBRARIES) @$(NORMAL_INSTALL) - test -z "$(imcvdir)" || $(MKDIR_P) "$(DESTDIR)$(imcvdir)" @list='$(imcv_LTLIBRARIES)'; test -n "$(imcvdir)" || list=; \ list2=; for p in $$list; do \ if test -f $$p; then \ @@ -333,6 +398,8 @@ install-imcvLTLIBRARIES: $(imcv_LTLIBRARIES) else :; fi; \ done; \ test -z "$$list2" || { \ + echo " $(MKDIR_P) '$(DESTDIR)$(imcvdir)'"; \ + $(MKDIR_P) "$(DESTDIR)$(imcvdir)" || exit 1; \ echo " $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=install $(INSTALL) $(INSTALL_STRIP_FLAG) $$list2 '$(DESTDIR)$(imcvdir)'"; \ $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=install $(INSTALL) $(INSTALL_STRIP_FLAG) $$list2 "$(DESTDIR)$(imcvdir)"; \ } @@ -354,8 +421,8 @@ clean-imcvLTLIBRARIES: echo "rm -f \"$${dir}/so_locations\""; \ rm -f "$${dir}/so_locations"; \ done -imc-scanner.la: $(imc_scanner_la_OBJECTS) $(imc_scanner_la_DEPENDENCIES) - $(imc_scanner_la_LINK) -rpath $(imcvdir) $(imc_scanner_la_OBJECTS) $(imc_scanner_la_LIBADD) $(LIBS) +imc-scanner.la: $(imc_scanner_la_OBJECTS) $(imc_scanner_la_DEPENDENCIES) $(EXTRA_imc_scanner_la_DEPENDENCIES) + $(AM_V_CCLD)$(imc_scanner_la_LINK) -rpath $(imcvdir) $(imc_scanner_la_OBJECTS) $(imc_scanner_la_LIBADD) $(LIBS) mostlyclean-compile: -rm -f *.$(OBJEXT) @@ -367,25 +434,25 @@ distclean-compile: @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/imc_scanner_state.Plo@am__quote@ .c.o: -@am__fastdepCC_TRUE@ $(COMPILE) -MT $@ -MD -MP -MF $(DEPDIR)/$*.Tpo -c -o $@ $< -@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Po -@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='$<' object='$@' libtool=no @AMDEPBACKSLASH@ +@am__fastdepCC_TRUE@ $(AM_V_CC)$(COMPILE) -MT $@ -MD -MP -MF $(DEPDIR)/$*.Tpo -c -o $@ $< +@am__fastdepCC_TRUE@ $(AM_V_at)$(am__mv) $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Po +@AMDEP_TRUE@@am__fastdepCC_FALSE@ $(AM_V_CC)source='$<' object='$@' libtool=no @AMDEPBACKSLASH@ @AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@ -@am__fastdepCC_FALSE@ $(COMPILE) -c $< +@am__fastdepCC_FALSE@ $(AM_V_CC@am__nodep@)$(COMPILE) -c $< .c.obj: -@am__fastdepCC_TRUE@ $(COMPILE) -MT $@ -MD -MP -MF $(DEPDIR)/$*.Tpo -c -o $@ `$(CYGPATH_W) '$<'` -@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Po -@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='$<' object='$@' libtool=no @AMDEPBACKSLASH@ +@am__fastdepCC_TRUE@ $(AM_V_CC)$(COMPILE) -MT $@ -MD -MP -MF $(DEPDIR)/$*.Tpo -c -o $@ `$(CYGPATH_W) '$<'` +@am__fastdepCC_TRUE@ $(AM_V_at)$(am__mv) $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Po +@AMDEP_TRUE@@am__fastdepCC_FALSE@ $(AM_V_CC)source='$<' object='$@' libtool=no @AMDEPBACKSLASH@ @AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@ -@am__fastdepCC_FALSE@ $(COMPILE) -c `$(CYGPATH_W) '$<'` +@am__fastdepCC_FALSE@ $(AM_V_CC@am__nodep@)$(COMPILE) -c `$(CYGPATH_W) '$<'` .c.lo: -@am__fastdepCC_TRUE@ $(LTCOMPILE) -MT $@ -MD -MP -MF $(DEPDIR)/$*.Tpo -c -o $@ $< -@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Plo -@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='$<' object='$@' libtool=yes @AMDEPBACKSLASH@ +@am__fastdepCC_TRUE@ $(AM_V_CC)$(LTCOMPILE) -MT $@ -MD -MP -MF $(DEPDIR)/$*.Tpo -c -o $@ $< +@am__fastdepCC_TRUE@ $(AM_V_at)$(am__mv) $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Plo +@AMDEP_TRUE@@am__fastdepCC_FALSE@ $(AM_V_CC)source='$<' object='$@' libtool=yes @AMDEPBACKSLASH@ @AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@ -@am__fastdepCC_FALSE@ $(LTCOMPILE) -c -o $@ $< +@am__fastdepCC_FALSE@ $(AM_V_CC@am__nodep@)$(LTCOMPILE) -c -o $@ $< mostlyclean-libtool: -rm -f *.lo @@ -492,10 +559,15 @@ install-am: all-am installcheck: installcheck-am install-strip: - $(MAKE) $(AM_MAKEFLAGS) INSTALL_PROGRAM="$(INSTALL_STRIP_PROGRAM)" \ - install_sh_PROGRAM="$(INSTALL_STRIP_PROGRAM)" INSTALL_STRIP_FLAG=-s \ - `test -z '$(STRIP)' || \ - echo "INSTALL_PROGRAM_ENV=STRIPPROG='$(STRIP)'"` install + if test -z '$(STRIP)'; then \ + $(MAKE) $(AM_MAKEFLAGS) INSTALL_PROGRAM="$(INSTALL_STRIP_PROGRAM)" \ + install_sh_PROGRAM="$(INSTALL_STRIP_PROGRAM)" INSTALL_STRIP_FLAG=-s \ + install; \ + else \ + $(MAKE) $(AM_MAKEFLAGS) INSTALL_PROGRAM="$(INSTALL_STRIP_PROGRAM)" \ + install_sh_PROGRAM="$(INSTALL_STRIP_PROGRAM)" INSTALL_STRIP_FLAG=-s \ + "INSTALL_PROGRAM_ENV=STRIPPROG='$(STRIP)'" install; \ + fi mostlyclean-generic: clean-generic: diff --git a/src/libimcv/plugins/imc_scanner/imc_scanner.c b/src/libimcv/plugins/imc_scanner/imc_scanner.c index b24c39c3a..c87e827cd 100644 --- a/src/libimcv/plugins/imc_scanner/imc_scanner.c +++ b/src/libimcv/plugins/imc_scanner/imc_scanner.c @@ -1,5 +1,6 @@ /* - * Copyright (C) 2011 Andreas Steffen, HSR Hochschule fuer Technik Rapperswil + * Copyright (C) 2011-2012 Andreas Steffen + * HSR Hochschule fuer Technik Rapperswil * * This program is free software; you can redistribute it and/or modify it * under the terms of the GNU General Public License as published by the @@ -15,17 +16,16 @@ #include "imc_scanner_state.h" #include <imc/imc_agent.h> -#include <pa_tnc/pa_tnc_msg.h> +#include <imc/imc_msg.h> #include <ietf/ietf_attr.h> -#include <ietf/ietf_attr_pa_tnc_error.h> +#include <ietf/ietf_attr_attr_request.h> #include <ietf/ietf_attr_port_filter.h> -#include <tncif_names.h> #include <tncif_pa_subtypes.h> #include <pen/pen.h> #include <utils/lexparser.h> -#include <debug.h> +#include <utils/debug.h> #include <stdio.h> @@ -33,11 +33,12 @@ static const char imc_name[] = "Scanner"; -#define IMC_VENDOR_ID PEN_ITA -#define IMC_SUBTYPE PA_SUBTYPE_ITA_SCANNER +static pen_type_t msg_types[] = { + { PEN_IETF, PA_SUBTYPE_IETF_VPN } +}; static imc_agent_t *imc_scanner; - + /** * see section 3.8.1 of TCG TNC IF-IMC Specification 1.3 */ @@ -51,8 +52,8 @@ TNC_Result TNC_IMC_Initialize(TNC_IMCID imc_id, DBG1(DBG_IMC, "IMC \"%s\" has already been initialized", imc_name); return TNC_RESULT_ALREADY_INITIALIZED; } - imc_scanner = imc_agent_create(imc_name, IMC_VENDOR_ID, IMC_SUBTYPE, - imc_id, actual_version); + imc_scanner = imc_agent_create(imc_name, msg_types, countof(msg_types), + imc_id, actual_version); if (!imc_scanner) { return TNC_RESULT_FATAL; @@ -84,6 +85,15 @@ TNC_Result TNC_IMC_NotifyConnectionChange(TNC_IMCID imc_id, case TNC_CONNECTION_STATE_CREATE: state = imc_scanner_state_create(connection_id); return imc_scanner->create_state(imc_scanner, state); + case TNC_CONNECTION_STATE_HANDSHAKE: + if (imc_scanner->change_state(imc_scanner, connection_id, new_state, + &state) != TNC_RESULT_SUCCESS) + { + return TNC_RESULT_FATAL; + } + state->set_result(state, imc_id, + TNC_IMV_EVALUATION_RESULT_DONT_KNOW); + return TNC_RESULT_SUCCESS; case TNC_CONNECTION_STATE_DELETE: return imc_scanner->delete_state(imc_scanner, connection_id); default: @@ -102,6 +112,7 @@ static bool do_netstat(ietf_attr_port_filter_t *attr) chunk_t line, token; int n = 0; bool success = FALSE; + const char system_v4[] = "127.0.1.1"; const char loopback_v4[] = "127.0.0.1"; const char loopback_v6[] = "::1"; @@ -109,12 +120,12 @@ static bool do_netstat(ietf_attr_port_filter_t *attr) file = popen("/bin/netstat -n -l -p -4 -6 --inet", "r"); if (!file) { - DBG1(DBG_IMC, "Failed to run netstat command"); + DBG1(DBG_IMC, "failed to run netstat command"); return FALSE; } /* Read the output a line at a time */ - while (fgets(buf, BUF_LEN-1, file)) + while (fgets(buf, sizeof(buf), file)) { u_char *pos; u_int8_t new_protocol, protocol; @@ -123,7 +134,7 @@ static bool do_netstat(ietf_attr_port_filter_t *attr) enumerator_t *enumerator; bool allowed, found = FALSE; - DBG2(DBG_IMC, "%.*s", strlen(buf)-1, buf); + DBG2(DBG_IMC, "%.*s", (int)(strlen(buf)-1), buf); if (n++ < 2) { @@ -135,7 +146,7 @@ static bool do_netstat(ietf_attr_port_filter_t *attr) /* Extract the IP protocol type */ if (!extract_token(&token, ' ', &line)) { - DBG1(DBG_IMC, "Protocol field in netstat output not found"); + DBG1(DBG_IMC, "protocol field in netstat output not found"); goto end; } if (match("tcp", &token) || match("tcp6", &token)) @@ -148,7 +159,7 @@ static bool do_netstat(ietf_attr_port_filter_t *attr) } else { - DBG1(DBG_IMC, "Skipped unknown IP protocol in netstat output"); + DBG1(DBG_IMC, "skipped unknown IP protocol in netstat output"); continue; } @@ -163,7 +174,7 @@ static bool do_netstat(ietf_attr_port_filter_t *attr) } if (token.len == 0) { - DBG1(DBG_IMC, "Local Address field in netstat output not found"); + DBG1(DBG_IMC, "local address field in netstat output not found"); goto end; } @@ -172,13 +183,16 @@ static bool do_netstat(ietf_attr_port_filter_t *attr) while (*--pos != ':' && --token.len); if (*pos != ':') { - DBG1(DBG_IMC, "Local port field in netstat output not found"); + DBG1(DBG_IMC, "local port field in netstat output not found"); goto end; } token.len--; - /* ignore ports of IPv4 and IPv6 loopback interfaces */ - if ((token.len == strlen(loopback_v4) && + /* ignore ports of IPv4 and IPv6 loopback interfaces + and the internal system IPv4 address */ + if ((token.len == strlen(system_v4) && + memeq(system_v4, token.ptr, token.len)) || + (token.len == strlen(loopback_v4) && memeq(loopback_v4, token.ptr, token.len)) || (token.len == strlen(loopback_v6) && memeq(loopback_v6, token.ptr, token.len))) @@ -199,7 +213,7 @@ static bool do_netstat(ietf_attr_port_filter_t *attr) } } enumerator->destroy(enumerator); - + /* Skip the duplicate port entry */ if (found) { @@ -219,12 +233,13 @@ end: return success; } -static TNC_Result send_message(TNC_ConnectionID connection_id) +/** + * Add IETF Port Filter attribute to the send queue + */ +static TNC_Result add_port_filter(imc_msg_t *msg) { - pa_tnc_msg_t *msg; pa_tnc_attr_t *attr; ietf_attr_port_filter_t *attr_port_filter; - TNC_Result result; attr = ietf_attr_port_filter_create(); attr->set_noskip_flag(attr, TRUE); @@ -234,14 +249,9 @@ static TNC_Result send_message(TNC_ConnectionID connection_id) attr->destroy(attr); return TNC_RESULT_FATAL; } - msg = pa_tnc_msg_create(); msg->add_attribute(msg, attr); - msg->build(msg); - result = imc_scanner->send_message(imc_scanner, connection_id, FALSE, 0, - TNC_IMVID_ANY, msg->get_encoding(msg)); - msg->destroy(msg); - return result; + return TNC_RESULT_SUCCESS; } /** @@ -250,60 +260,108 @@ static TNC_Result send_message(TNC_ConnectionID connection_id) TNC_Result TNC_IMC_BeginHandshake(TNC_IMCID imc_id, TNC_ConnectionID connection_id) { - if (!imc_scanner) - { - DBG1(DBG_IMC, "IMC \"%s\" has not been initialized", imc_name); - return TNC_RESULT_NOT_INITIALIZED; - } - return send_message(connection_id); -} - -static TNC_Result receive_message(TNC_IMCID imc_id, - TNC_ConnectionID connection_id, - TNC_UInt32 msg_flags, - chunk_t msg, - TNC_VendorID msg_vid, - TNC_MessageSubtype msg_subtype, - TNC_UInt32 src_imv_id, - TNC_UInt32 dst_imc_id) -{ - pa_tnc_msg_t *pa_tnc_msg; imc_state_t *state; - TNC_Result result; - bool fatal_error; + imc_msg_t *out_msg; + TNC_Result result = TNC_RESULT_SUCCESS; if (!imc_scanner) { DBG1(DBG_IMC, "IMC \"%s\" has not been initialized", imc_name); return TNC_RESULT_NOT_INITIALIZED; } - - /* get current IMC state */ if (!imc_scanner->get_state(imc_scanner, connection_id, &state)) { return TNC_RESULT_FATAL; } + if (lib->settings->get_bool(lib->settings, + "libimcv.plugins.imc-scanner.push_info", TRUE)) + { + out_msg = imc_msg_create(imc_scanner, state, connection_id, imc_id, + TNC_IMVID_ANY, msg_types[0]); + result = add_port_filter(out_msg); + if (result == TNC_RESULT_SUCCESS) + { + /* send PA-TNC message with the excl flag not set */ + result = out_msg->send(out_msg, FALSE); + } + out_msg->destroy(out_msg); + } - /* parse received PA-TNC message and automatically handle any errors */ - result = imc_scanner->receive_message(imc_scanner, state, msg, msg_vid, - msg_subtype, src_imv_id, dst_imc_id, &pa_tnc_msg); + return result; +} + +static TNC_Result receive_message(imc_msg_t *in_msg) +{ + imc_msg_t *out_msg; + enumerator_t *enumerator; + pa_tnc_attr_t *attr; + pen_type_t attr_type; + TNC_Result result = TNC_RESULT_SUCCESS; + bool fatal_error = FALSE; - /* no parsed PA-TNC attributes available if an error occurred */ - if (!pa_tnc_msg) + /* parse received PA-TNC message and handle local and remote errors */ + result = in_msg->receive(in_msg, &fatal_error); + if (result != TNC_RESULT_SUCCESS) { return result; } + out_msg = imc_msg_create_as_reply(in_msg); - /* preprocess any IETF standard error attributes */ - fatal_error = pa_tnc_msg->process_ietf_std_errors(pa_tnc_msg); - pa_tnc_msg->destroy(pa_tnc_msg); + /* analyze PA-TNC attributes */ + enumerator = in_msg->create_attribute_enumerator(in_msg); + while (enumerator->enumerate(enumerator, &attr)) + { + attr_type = attr->get_type(attr); - /* if no error occurred then always return the same response */ - return fatal_error ? TNC_RESULT_FATAL : send_message(connection_id); + if (attr_type.vendor_id != PEN_IETF) + { + continue; + } + if (attr_type.type == IETF_ATTR_ATTRIBUTE_REQUEST) + { + ietf_attr_attr_request_t *attr_cast; + pen_type_t *entry; + enumerator_t *e; + + attr_cast = (ietf_attr_attr_request_t*)attr; + + e = attr_cast->create_enumerator(attr_cast); + while (e->enumerate(e, &entry)) + { + if (entry->vendor_id != PEN_IETF) + { + continue; + } + switch (entry->type) + { + case IETF_ATTR_PORT_FILTER: + result = add_port_filter(out_msg); + break; + default: + break; + } + } + e->destroy(e); + } + } + enumerator->destroy(enumerator); + + if (fatal_error) + { + result = TNC_RESULT_FATAL; + } + else if (result == TNC_RESULT_SUCCESS) + { + result = out_msg->send(out_msg, TRUE); + } + out_msg->destroy(out_msg); + + return result; } /** * see section 3.8.4 of TCG TNC IF-IMC Specification 1.3 + */ TNC_Result TNC_IMC_ReceiveMessage(TNC_IMCID imc_id, TNC_ConnectionID connection_id, @@ -311,14 +369,26 @@ TNC_Result TNC_IMC_ReceiveMessage(TNC_IMCID imc_id, TNC_UInt32 msg_len, TNC_MessageType msg_type) { - TNC_VendorID msg_vid; - TNC_MessageSubtype msg_subtype; + imc_state_t *state; + imc_msg_t *in_msg; + TNC_Result result; - msg_vid = msg_type >> 8; - msg_subtype = msg_type & TNC_SUBTYPE_ANY; + if (!imc_scanner) + { + DBG1(DBG_IMC, "IMC \"%s\" has not been initialized", imc_name); + return TNC_RESULT_NOT_INITIALIZED; + } + if (!imc_scanner->get_state(imc_scanner, connection_id, &state)) + { + return TNC_RESULT_FATAL; + } + + in_msg = imc_msg_create_from_data(imc_scanner, state, connection_id, + msg_type, chunk_create(msg, msg_len)); + result = receive_message(in_msg); + in_msg->destroy(in_msg); - return receive_message(imc_id, connection_id, 0, chunk_create(msg, msg_len), - msg_vid, msg_subtype, 0, TNC_IMCID_ANY); + return result; } /** @@ -334,9 +404,26 @@ TNC_Result TNC_IMC_ReceiveMessageLong(TNC_IMCID imc_id, TNC_UInt32 src_imv_id, TNC_UInt32 dst_imc_id) { - return receive_message(imc_id, connection_id, msg_flags, - chunk_create(msg, msg_len), msg_vid, msg_subtype, - src_imv_id, dst_imc_id); + imc_state_t *state; + imc_msg_t *in_msg; + TNC_Result result; + + if (!imc_scanner) + { + DBG1(DBG_IMC, "IMC \"%s\" has not been initialized", imc_name); + return TNC_RESULT_NOT_INITIALIZED; + } + if (!imc_scanner->get_state(imc_scanner, connection_id, &state)) + { + return TNC_RESULT_FATAL; + } + in_msg = imc_msg_create_from_long_data(imc_scanner, state, connection_id, + src_imv_id, dst_imc_id, msg_vid, msg_subtype, + chunk_create(msg, msg_len)); + result = receive_message(in_msg); + in_msg->destroy(in_msg); + + return result; } /** diff --git a/src/libimcv/plugins/imc_scanner/imc_scanner_state.c b/src/libimcv/plugins/imc_scanner/imc_scanner_state.c index 563105548..b5a6cdd20 100644 --- a/src/libimcv/plugins/imc_scanner/imc_scanner_state.c +++ b/src/libimcv/plugins/imc_scanner/imc_scanner_state.c @@ -1,5 +1,6 @@ /* - * Copyright (C) 2011 Andreas Steffen, HSR Hochschule fuer Technik Rapperswil + * Copyright (C) 2011-2012 Andreas Steffen + * HSR Hochschule fuer Technik Rapperswil * * This program is free software; you can redistribute it and/or modify it * under the terms of the GNU General Public License as published by the @@ -14,7 +15,9 @@ #include "imc_scanner_state.h" -#include <debug.h> +#include <tncif_names.h> + +#include <utils/debug.h> typedef struct private_imc_scanner_state_t private_imc_scanner_state_t; @@ -39,6 +42,11 @@ struct private_imc_scanner_state_t { TNC_ConnectionState state; /** + * Assessment/Evaluation Result + */ + TNC_IMV_Evaluation_Result result; + + /** * Does the TNCCS connection support long message types? */ bool has_long; @@ -48,6 +56,10 @@ struct private_imc_scanner_state_t { */ bool has_excl; + /** + * Maximum PA-TNC message size for this TNCCS connection + */ + u_int32_t max_msg_len; }; METHOD(imc_state_t, get_connection_id, TNC_ConnectionID, @@ -75,12 +87,42 @@ METHOD(imc_state_t, set_flags, void, this->has_excl = has_excl; } +METHOD(imc_state_t, set_max_msg_len, void, + private_imc_scanner_state_t *this, u_int32_t max_msg_len) +{ + this->max_msg_len = max_msg_len; +} + +METHOD(imc_state_t, get_max_msg_len, u_int32_t, + private_imc_scanner_state_t *this) +{ + return this->max_msg_len; +} + METHOD(imc_state_t, change_state, void, private_imc_scanner_state_t *this, TNC_ConnectionState new_state) { this->state = new_state; } +METHOD(imc_state_t, set_result, void, + private_imc_scanner_state_t *this, TNC_IMCID id, + TNC_IMV_Evaluation_Result result) +{ + this->result = result; +} + +METHOD(imc_state_t, get_result, bool, + private_imc_scanner_state_t *this, TNC_IMCID id, + TNC_IMV_Evaluation_Result *result) +{ + if (result) + { + *result = this->result; + } + return this->result != TNC_IMV_EVALUATION_RESULT_DONT_KNOW; +} + METHOD(imc_state_t, destroy, void, private_imc_scanner_state_t *this) { @@ -101,14 +143,19 @@ imc_state_t *imc_scanner_state_create(TNC_ConnectionID connection_id) .has_long = _has_long, .has_excl = _has_excl, .set_flags = _set_flags, + .set_max_msg_len = _set_max_msg_len, + .get_max_msg_len = _get_max_msg_len, .change_state = _change_state, + .set_result = _set_result, + .get_result = _get_result, .destroy = _destroy, }, }, .state = TNC_CONNECTION_STATE_CREATE, + .result = TNC_IMV_EVALUATION_RESULT_DONT_KNOW, .connection_id = connection_id, ); - + return &this->public.interface; } diff --git a/src/libimcv/plugins/imc_scanner/imc_scanner_state.h b/src/libimcv/plugins/imc_scanner/imc_scanner_state.h index 76aa4165b..3b40575e3 100644 --- a/src/libimcv/plugins/imc_scanner/imc_scanner_state.h +++ b/src/libimcv/plugins/imc_scanner/imc_scanner_state.h @@ -13,9 +13,11 @@ */ /** + * @defgroup imc_scanner imc_scanner + * @ingroup libimcv_plugins * * @defgroup imc_scanner_state_t imc_scanner_state - * @{ @ingroup imc_scanner_state + * @{ @ingroup imc_scanner */ #ifndef IMC_SCANNER_STATE_H_ diff --git a/src/libimcv/plugins/imc_test/Makefile.am b/src/libimcv/plugins/imc_test/Makefile.am index b55e7bcd4..b1a719ab4 100644 --- a/src/libimcv/plugins/imc_test/Makefile.am +++ b/src/libimcv/plugins/imc_test/Makefile.am @@ -1,8 +1,10 @@ - -INCLUDES = -I$(top_srcdir)/src/libstrongswan -I$(top_srcdir)/src/libtncif \ +AM_CPPFLAGS = \ + -I$(top_srcdir)/src/libstrongswan \ + -I$(top_srcdir)/src/libtncif \ -I$(top_srcdir)/src/libimcv -AM_CFLAGS = -rdynamic +AM_CFLAGS = \ + -rdynamic imcv_LTLIBRARIES = imc-test.la @@ -12,4 +14,3 @@ imc_test_la_LIBADD = $(top_builddir)/src/libimcv/libimcv.la \ imc_test_la_SOURCES = imc_test.c imc_test_state.h imc_test_state.c imc_test_la_LDFLAGS = -module -avoid-version - diff --git a/src/libimcv/plugins/imc_test/Makefile.in b/src/libimcv/plugins/imc_test/Makefile.in index b4e3f8ae0..5cc1f0d7b 100644 --- a/src/libimcv/plugins/imc_test/Makefile.in +++ b/src/libimcv/plugins/imc_test/Makefile.in @@ -1,9 +1,9 @@ -# Makefile.in generated by automake 1.11.1 from Makefile.am. +# Makefile.in generated by automake 1.11.6 from Makefile.am. # @configure_input@ # Copyright (C) 1994, 1995, 1996, 1997, 1998, 1999, 2000, 2001, 2002, -# 2003, 2004, 2005, 2006, 2007, 2008, 2009 Free Software Foundation, -# Inc. +# 2003, 2004, 2005, 2006, 2007, 2008, 2009, 2010, 2011 Free Software +# Foundation, Inc. # This Makefile.in is free software; the Free Software Foundation # gives unlimited permission to copy and/or distribute it, # with or without modifications, as long as this notice is preserved. @@ -16,6 +16,23 @@ @SET_MAKE@ VPATH = @srcdir@ +am__make_dryrun = \ + { \ + am__dry=no; \ + case $$MAKEFLAGS in \ + *\\[\ \ ]*) \ + echo 'am--echo: ; @echo "AM" OK' | $(MAKE) -f - 2>/dev/null \ + | grep '^AM OK$$' >/dev/null || am__dry=yes;; \ + *) \ + for am__flg in $$MAKEFLAGS; do \ + case $$am__flg in \ + *=*|--*) ;; \ + *n*) am__dry=yes; break;; \ + esac; \ + done;; \ + esac; \ + test $$am__dry = yes; \ + } pkgdatadir = $(datadir)/@PACKAGE@ pkgincludedir = $(includedir)/@PACKAGE@ pkglibdir = $(libdir)/@PACKAGE@ @@ -45,10 +62,11 @@ am__aclocal_m4_deps = $(top_srcdir)/m4/config/libtool.m4 \ $(top_srcdir)/m4/macros/with.m4 \ $(top_srcdir)/m4/macros/enable-disable.m4 \ $(top_srcdir)/m4/macros/add-plugin.m4 \ - $(top_srcdir)/configure.in + $(top_srcdir)/configure.ac am__configure_deps = $(am__aclocal_m4_deps) $(CONFIGURE_DEPENDENCIES) \ $(ACLOCAL_M4) mkinstalldirs = $(install_sh) -d +CONFIG_HEADER = $(top_builddir)/config.h CONFIG_CLEAN_FILES = CONFIG_CLEAN_VPATH_FILES = am__vpath_adj_setup = srcdirstrip=`echo "$(srcdir)" | sed 's|.|.|g'`; @@ -72,51 +90,85 @@ am__nobase_list = $(am__nobase_strip_setup); \ am__base_list = \ sed '$$!N;$$!N;$$!N;$$!N;$$!N;$$!N;$$!N;s/\n/ /g' | \ sed '$$!N;$$!N;$$!N;$$!N;s/\n/ /g' +am__uninstall_files_from_dir = { \ + test -z "$$files" \ + || { test ! -d "$$dir" && test ! -f "$$dir" && test ! -r "$$dir"; } \ + || { echo " ( cd '$$dir' && rm -f" $$files ")"; \ + $(am__cd) "$$dir" && rm -f $$files; }; \ + } am__installdirs = "$(DESTDIR)$(imcvdir)" LTLIBRARIES = $(imcv_LTLIBRARIES) imc_test_la_DEPENDENCIES = $(top_builddir)/src/libimcv/libimcv.la \ $(top_builddir)/src/libstrongswan/libstrongswan.la am_imc_test_la_OBJECTS = imc_test.lo imc_test_state.lo imc_test_la_OBJECTS = $(am_imc_test_la_OBJECTS) -imc_test_la_LINK = $(LIBTOOL) --tag=CC $(AM_LIBTOOLFLAGS) \ +AM_V_lt = $(am__v_lt_@AM_V@) +am__v_lt_ = $(am__v_lt_@AM_DEFAULT_V@) +am__v_lt_0 = --silent +imc_test_la_LINK = $(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) \ $(LIBTOOLFLAGS) --mode=link $(CCLD) $(AM_CFLAGS) $(CFLAGS) \ $(imc_test_la_LDFLAGS) $(LDFLAGS) -o $@ -DEFAULT_INCLUDES = -I.@am__isrc@ +DEFAULT_INCLUDES = -I.@am__isrc@ -I$(top_builddir) depcomp = $(SHELL) $(top_srcdir)/depcomp am__depfiles_maybe = depfiles am__mv = mv -f COMPILE = $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) \ $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -LTCOMPILE = $(LIBTOOL) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) \ - --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) \ - $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) +LTCOMPILE = $(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) \ + $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) \ + $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) \ + $(AM_CFLAGS) $(CFLAGS) +AM_V_CC = $(am__v_CC_@AM_V@) +am__v_CC_ = $(am__v_CC_@AM_DEFAULT_V@) +am__v_CC_0 = @echo " CC " $@; +AM_V_at = $(am__v_at_@AM_V@) +am__v_at_ = $(am__v_at_@AM_DEFAULT_V@) +am__v_at_0 = @ CCLD = $(CC) -LINK = $(LIBTOOL) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) \ - --mode=link $(CCLD) $(AM_CFLAGS) $(CFLAGS) $(AM_LDFLAGS) \ - $(LDFLAGS) -o $@ +LINK = $(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) \ + $(LIBTOOLFLAGS) --mode=link $(CCLD) $(AM_CFLAGS) $(CFLAGS) \ + $(AM_LDFLAGS) $(LDFLAGS) -o $@ +AM_V_CCLD = $(am__v_CCLD_@AM_V@) +am__v_CCLD_ = $(am__v_CCLD_@AM_DEFAULT_V@) +am__v_CCLD_0 = @echo " CCLD " $@; +AM_V_GEN = $(am__v_GEN_@AM_V@) +am__v_GEN_ = $(am__v_GEN_@AM_DEFAULT_V@) +am__v_GEN_0 = @echo " GEN " $@; SOURCES = $(imc_test_la_SOURCES) DIST_SOURCES = $(imc_test_la_SOURCES) +am__can_run_installinfo = \ + case $$AM_UPDATE_INFO_DIR in \ + n|no|NO) false;; \ + *) (install-info --version) >/dev/null 2>&1;; \ + esac ETAGS = etags CTAGS = ctags DISTFILES = $(DIST_COMMON) $(DIST_SOURCES) $(TEXINFOS) $(EXTRA_DIST) ACLOCAL = @ACLOCAL@ ALLOCA = @ALLOCA@ AMTAR = @AMTAR@ +AM_DEFAULT_VERBOSITY = @AM_DEFAULT_VERBOSITY@ AR = @AR@ AUTOCONF = @AUTOCONF@ AUTOHEADER = @AUTOHEADER@ AUTOMAKE = @AUTOMAKE@ AWK = @AWK@ +BFDLIB = @BFDLIB@ BTLIB = @BTLIB@ CC = @CC@ CCDEPMODE = @CCDEPMODE@ CFLAGS = @CFLAGS@ +CHECK_CFLAGS = @CHECK_CFLAGS@ +CHECK_LIBS = @CHECK_LIBS@ +COVERAGE_CFLAGS = @COVERAGE_CFLAGS@ +COVERAGE_LDFLAGS = @COVERAGE_LDFLAGS@ CPP = @CPP@ CPPFLAGS = @CPPFLAGS@ CYGPATH_W = @CYGPATH_W@ DEFS = @DEFS@ DEPDIR = @DEPDIR@ DLLIB = @DLLIB@ +DLLTOOL = @DLLTOOL@ DSYMUTIL = @DSYMUTIL@ DUMPBIN = @DUMPBIN@ ECHO_C = @ECHO_C@ @@ -125,13 +177,16 @@ ECHO_T = @ECHO_T@ EGREP = @EGREP@ EXEEXT = @EXEEXT@ FGREP = @FGREP@ +GENHTML = @GENHTML@ GPERF = @GPERF@ +GPRBUILD = @GPRBUILD@ GREP = @GREP@ INSTALL = @INSTALL@ INSTALL_DATA = @INSTALL_DATA@ INSTALL_PROGRAM = @INSTALL_PROGRAM@ INSTALL_SCRIPT = @INSTALL_SCRIPT@ INSTALL_STRIP_PROGRAM = @INSTALL_STRIP_PROGRAM@ +LCOV = @LCOV@ LD = @LD@ LDFLAGS = @LDFLAGS@ LEX = @LEX@ @@ -144,6 +199,7 @@ LIPO = @LIPO@ LN_S = @LN_S@ LTLIBOBJS = @LTLIBOBJS@ MAKEINFO = @MAKEINFO@ +MANIFEST_TOOL = @MANIFEST_TOOL@ MKDIR_P = @MKDIR_P@ MYSQLCFLAG = @MYSQLCFLAG@ MYSQLCONFIG = @MYSQLCONFIG@ @@ -171,11 +227,13 @@ RANLIB = @RANLIB@ RTLIB = @RTLIB@ RUBY = @RUBY@ RUBYINCLUDE = @RUBYINCLUDE@ +RUBYLIB = @RUBYLIB@ SED = @SED@ SET_MAKE = @SET_MAKE@ SHELL = @SHELL@ SOCKLIB = @SOCKLIB@ STRIP = @STRIP@ +UNWINDLIB = @UNWINDLIB@ VERSION = @VERSION@ YACC = @YACC@ YFLAGS = @YFLAGS@ @@ -183,6 +241,7 @@ abs_builddir = @abs_builddir@ abs_srcdir = @abs_srcdir@ abs_top_builddir = @abs_top_builddir@ abs_top_srcdir = @abs_top_srcdir@ +ac_ct_AR = @ac_ct_AR@ ac_ct_CC = @ac_ct_CC@ ac_ct_DUMPBIN = @ac_ct_DUMPBIN@ am__include = @am__include@ @@ -191,8 +250,6 @@ am__quote = @am__quote@ am__tar = @am__tar@ am__untar = @am__untar@ attest_plugins = @attest_plugins@ -axis2c_CFLAGS = @axis2c_CFLAGS@ -axis2c_LIBS = @axis2c_LIBS@ bindir = @bindir@ build = @build@ build_alias = @build_alias@ @@ -201,14 +258,19 @@ build_os = @build_os@ build_vendor = @build_vendor@ builddir = @builddir@ c_plugins = @c_plugins@ +charon_natt_port = @charon_natt_port@ +charon_plugins = @charon_plugins@ +charon_udp_port = @charon_udp_port@ clearsilver_LIBS = @clearsilver_LIBS@ +cmd_plugins = @cmd_plugins@ datadir = @datadir@ datarootdir = @datarootdir@ dbusservicedir = @dbusservicedir@ -default_pkcs11 = @default_pkcs11@ +dev_headers = @dev_headers@ docdir = @docdir@ dvidir = @dvidir@ exec_prefix = @exec_prefix@ +fips_mode = @fips_mode@ gtk_CFLAGS = @gtk_CFLAGS@ gtk_LIBS = @gtk_LIBS@ h_plugins = @h_plugins@ @@ -222,17 +284,17 @@ imcvdir = @imcvdir@ includedir = @includedir@ infodir = @infodir@ install_sh = @install_sh@ +ipsec_script = @ipsec_script@ +ipsec_script_upper = @ipsec_script_upper@ ipsecdir = @ipsecdir@ ipsecgroup = @ipsecgroup@ ipseclibdir = @ipseclibdir@ ipsecuser = @ipsecuser@ -libcharon_plugins = @libcharon_plugins@ libdir = @libdir@ libexecdir = @libexecdir@ linux_headers = @linux_headers@ localedir = @localedir@ localstatedir = @localstatedir@ -lt_ECHO = @lt_ECHO@ maemo_CFLAGS = @maemo_CFLAGS@ maemo_LIBS = @maemo_LIBS@ manager_plugins = @manager_plugins@ @@ -242,16 +304,15 @@ mkdir_p = @mkdir_p@ nm_CFLAGS = @nm_CFLAGS@ nm_LIBS = @nm_LIBS@ nm_ca_dir = @nm_ca_dir@ +nm_plugins = @nm_plugins@ oldincludedir = @oldincludedir@ openac_plugins = @openac_plugins@ -p_plugins = @p_plugins@ pcsclite_CFLAGS = @pcsclite_CFLAGS@ pcsclite_LIBS = @pcsclite_LIBS@ pdfdir = @pdfdir@ piddir = @piddir@ pki_plugins = @pki_plugins@ plugindir = @plugindir@ -pluto_plugins = @pluto_plugins@ pool_plugins = @pool_plugins@ prefix = @prefix@ program_transform_name = @program_transform_name@ @@ -279,10 +340,14 @@ top_srcdir = @top_srcdir@ urandom_device = @urandom_device@ xml_CFLAGS = @xml_CFLAGS@ xml_LIBS = @xml_LIBS@ -INCLUDES = -I$(top_srcdir)/src/libstrongswan -I$(top_srcdir)/src/libtncif \ +AM_CPPFLAGS = \ + -I$(top_srcdir)/src/libstrongswan \ + -I$(top_srcdir)/src/libtncif \ -I$(top_srcdir)/src/libimcv -AM_CFLAGS = -rdynamic +AM_CFLAGS = \ + -rdynamic + imcv_LTLIBRARIES = imc-test.la imc_test_la_LIBADD = $(top_builddir)/src/libimcv/libimcv.la \ $(top_builddir)/src/libstrongswan/libstrongswan.la @@ -325,7 +390,6 @@ $(ACLOCAL_M4): $(am__aclocal_m4_deps) $(am__aclocal_m4_deps): install-imcvLTLIBRARIES: $(imcv_LTLIBRARIES) @$(NORMAL_INSTALL) - test -z "$(imcvdir)" || $(MKDIR_P) "$(DESTDIR)$(imcvdir)" @list='$(imcv_LTLIBRARIES)'; test -n "$(imcvdir)" || list=; \ list2=; for p in $$list; do \ if test -f $$p; then \ @@ -333,6 +397,8 @@ install-imcvLTLIBRARIES: $(imcv_LTLIBRARIES) else :; fi; \ done; \ test -z "$$list2" || { \ + echo " $(MKDIR_P) '$(DESTDIR)$(imcvdir)'"; \ + $(MKDIR_P) "$(DESTDIR)$(imcvdir)" || exit 1; \ echo " $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=install $(INSTALL) $(INSTALL_STRIP_FLAG) $$list2 '$(DESTDIR)$(imcvdir)'"; \ $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=install $(INSTALL) $(INSTALL_STRIP_FLAG) $$list2 "$(DESTDIR)$(imcvdir)"; \ } @@ -354,8 +420,8 @@ clean-imcvLTLIBRARIES: echo "rm -f \"$${dir}/so_locations\""; \ rm -f "$${dir}/so_locations"; \ done -imc-test.la: $(imc_test_la_OBJECTS) $(imc_test_la_DEPENDENCIES) - $(imc_test_la_LINK) -rpath $(imcvdir) $(imc_test_la_OBJECTS) $(imc_test_la_LIBADD) $(LIBS) +imc-test.la: $(imc_test_la_OBJECTS) $(imc_test_la_DEPENDENCIES) $(EXTRA_imc_test_la_DEPENDENCIES) + $(AM_V_CCLD)$(imc_test_la_LINK) -rpath $(imcvdir) $(imc_test_la_OBJECTS) $(imc_test_la_LIBADD) $(LIBS) mostlyclean-compile: -rm -f *.$(OBJEXT) @@ -367,25 +433,25 @@ distclean-compile: @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/imc_test_state.Plo@am__quote@ .c.o: -@am__fastdepCC_TRUE@ $(COMPILE) -MT $@ -MD -MP -MF $(DEPDIR)/$*.Tpo -c -o $@ $< -@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Po -@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='$<' object='$@' libtool=no @AMDEPBACKSLASH@ +@am__fastdepCC_TRUE@ $(AM_V_CC)$(COMPILE) -MT $@ -MD -MP -MF $(DEPDIR)/$*.Tpo -c -o $@ $< +@am__fastdepCC_TRUE@ $(AM_V_at)$(am__mv) $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Po +@AMDEP_TRUE@@am__fastdepCC_FALSE@ $(AM_V_CC)source='$<' object='$@' libtool=no @AMDEPBACKSLASH@ @AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@ -@am__fastdepCC_FALSE@ $(COMPILE) -c $< +@am__fastdepCC_FALSE@ $(AM_V_CC@am__nodep@)$(COMPILE) -c $< .c.obj: -@am__fastdepCC_TRUE@ $(COMPILE) -MT $@ -MD -MP -MF $(DEPDIR)/$*.Tpo -c -o $@ `$(CYGPATH_W) '$<'` -@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Po -@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='$<' object='$@' libtool=no @AMDEPBACKSLASH@ +@am__fastdepCC_TRUE@ $(AM_V_CC)$(COMPILE) -MT $@ -MD -MP -MF $(DEPDIR)/$*.Tpo -c -o $@ `$(CYGPATH_W) '$<'` +@am__fastdepCC_TRUE@ $(AM_V_at)$(am__mv) $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Po +@AMDEP_TRUE@@am__fastdepCC_FALSE@ $(AM_V_CC)source='$<' object='$@' libtool=no @AMDEPBACKSLASH@ @AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@ -@am__fastdepCC_FALSE@ $(COMPILE) -c `$(CYGPATH_W) '$<'` +@am__fastdepCC_FALSE@ $(AM_V_CC@am__nodep@)$(COMPILE) -c `$(CYGPATH_W) '$<'` .c.lo: -@am__fastdepCC_TRUE@ $(LTCOMPILE) -MT $@ -MD -MP -MF $(DEPDIR)/$*.Tpo -c -o $@ $< -@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Plo -@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='$<' object='$@' libtool=yes @AMDEPBACKSLASH@ +@am__fastdepCC_TRUE@ $(AM_V_CC)$(LTCOMPILE) -MT $@ -MD -MP -MF $(DEPDIR)/$*.Tpo -c -o $@ $< +@am__fastdepCC_TRUE@ $(AM_V_at)$(am__mv) $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Plo +@AMDEP_TRUE@@am__fastdepCC_FALSE@ $(AM_V_CC)source='$<' object='$@' libtool=yes @AMDEPBACKSLASH@ @AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@ -@am__fastdepCC_FALSE@ $(LTCOMPILE) -c -o $@ $< +@am__fastdepCC_FALSE@ $(AM_V_CC@am__nodep@)$(LTCOMPILE) -c -o $@ $< mostlyclean-libtool: -rm -f *.lo @@ -492,10 +558,15 @@ install-am: all-am installcheck: installcheck-am install-strip: - $(MAKE) $(AM_MAKEFLAGS) INSTALL_PROGRAM="$(INSTALL_STRIP_PROGRAM)" \ - install_sh_PROGRAM="$(INSTALL_STRIP_PROGRAM)" INSTALL_STRIP_FLAG=-s \ - `test -z '$(STRIP)' || \ - echo "INSTALL_PROGRAM_ENV=STRIPPROG='$(STRIP)'"` install + if test -z '$(STRIP)'; then \ + $(MAKE) $(AM_MAKEFLAGS) INSTALL_PROGRAM="$(INSTALL_STRIP_PROGRAM)" \ + install_sh_PROGRAM="$(INSTALL_STRIP_PROGRAM)" INSTALL_STRIP_FLAG=-s \ + install; \ + else \ + $(MAKE) $(AM_MAKEFLAGS) INSTALL_PROGRAM="$(INSTALL_STRIP_PROGRAM)" \ + install_sh_PROGRAM="$(INSTALL_STRIP_PROGRAM)" INSTALL_STRIP_FLAG=-s \ + "INSTALL_PROGRAM_ENV=STRIPPROG='$(STRIP)'" install; \ + fi mostlyclean-generic: clean-generic: diff --git a/src/libimcv/plugins/imc_test/imc_test.c b/src/libimcv/plugins/imc_test/imc_test.c index fe005ed4a..c97d41628 100644 --- a/src/libimcv/plugins/imc_test/imc_test.c +++ b/src/libimcv/plugins/imc_test/imc_test.c @@ -1,5 +1,6 @@ /* - * Copyright (C) 2011 Andreas Steffen, HSR Hochschule fuer Technik Rapperswil + * Copyright (C) 2011-2012 Andreas Steffen + * HSR Hochschule fuer Technik Rapperswil * * This program is free software; you can redistribute it and/or modify it * under the terms of the GNU General Public License as published by the @@ -15,27 +16,27 @@ #include "imc_test_state.h" #include <imc/imc_agent.h> -#include <pa_tnc/pa_tnc_msg.h> +#include <imc/imc_msg.h> #include <ietf/ietf_attr.h> -#include <ietf/ietf_attr_pa_tnc_error.h> #include <ita/ita_attr.h> #include <ita/ita_attr_command.h> +#include <ita/ita_attr_dummy.h> -#include <tncif_names.h> #include <tncif_pa_subtypes.h> #include <pen/pen.h> -#include <debug.h> +#include <utils/debug.h> /* IMC definitions */ static const char imc_name[] = "Test"; -#define IMC_VENDOR_ID PEN_ITA -#define IMC_SUBTYPE PA_SUBTYPE_ITA_TEST +static pen_type_t msg_types[] = { + { PEN_ITA, PA_SUBTYPE_ITA_TEST } +}; static imc_agent_t *imc_test; - + /** * see section 3.8.1 of TCG TNC IF-IMC Specification 1.3 */ @@ -49,7 +50,7 @@ TNC_Result TNC_IMC_Initialize(TNC_IMCID imc_id, DBG1(DBG_IMC, "IMC \"%s\" has already been initialized", imc_name); return TNC_RESULT_ALREADY_INITIALIZED; } - imc_test = imc_agent_create(imc_name, IMC_VENDOR_ID, IMC_SUBTYPE, + imc_test = imc_agent_create(imc_name, msg_types, countof(msg_types), imc_id, actual_version); if (!imc_test) { @@ -73,9 +74,12 @@ TNC_Result TNC_IMC_NotifyConnectionChange(TNC_IMCID imc_id, imc_state_t *state; imc_test_state_t *test_state; TNC_Result result; + TNC_UInt32 additional_id; char *command; bool retry; - int additional_ids; + void *pointer; + enumerator_t *enumerator; + int dummy_size, additional_ids; if (!imc_test) { @@ -88,9 +92,12 @@ TNC_Result TNC_IMC_NotifyConnectionChange(TNC_IMCID imc_id, case TNC_CONNECTION_STATE_CREATE: command = lib->settings->get_str(lib->settings, "libimcv.plugins.imc-test.command", "none"); + dummy_size = lib->settings->get_int(lib->settings, + "libimcv.plugins.imc-test.dummy_size", 0); retry = lib->settings->get_bool(lib->settings, "libimcv.plugins.imc-test.retry", FALSE); - state = imc_test_state_create(connection_id, command, retry); + state = imc_test_state_create(connection_id, command, dummy_size, + retry); result = imc_test->create_state(imc_test, state); if (result != TNC_RESULT_SUCCESS) @@ -124,6 +131,26 @@ TNC_Result TNC_IMC_NotifyConnectionChange(TNC_IMCID imc_id, test_state->get_command(test_state)); test_state->set_command(test_state, command); } + + state->set_result(state, imc_id, TNC_IMV_EVALUATION_RESULT_DONT_KNOW); + + /* Exit if there are no additional IMC IDs */ + if (!imc_test->count_additional_ids(imc_test)) + { + return result; + } + + enumerator = imc_test->create_id_enumerator(imc_test); + while (enumerator->enumerate(enumerator, &pointer)) + { + /* interpret pointer as scalar value */ + additional_id = (TNC_UInt32)pointer; + + state->set_result(state, additional_id, + TNC_IMV_EVALUATION_RESULT_DONT_KNOW); + } + enumerator->destroy(enumerator); + return TNC_RESULT_SUCCESS; case TNC_CONNECTION_STATE_DELETE: @@ -154,29 +181,24 @@ TNC_Result TNC_IMC_NotifyConnectionChange(TNC_IMCID imc_id, } } -static TNC_Result send_message(imc_state_t *state, TNC_UInt32 src_imc_id, - TNC_UInt32 dst_imv_id) +static TNC_Result send_message(imc_state_t *state, imc_msg_t *out_msg) { imc_test_state_t *test_state; - pa_tnc_msg_t *msg; pa_tnc_attr_t *attr; - bool excl; - TNC_ConnectionID connection_id; - TNC_Result result; - connection_id = state->get_connection_id(state); test_state = (imc_test_state_t*)state; + if (test_state->get_dummy_size(test_state)) + { + attr = ita_attr_dummy_create(test_state->get_dummy_size(test_state)); + attr->set_noskip_flag(attr, TRUE); + out_msg->add_attribute(out_msg, attr); + } attr = ita_attr_command_create(test_state->get_command(test_state)); attr->set_noskip_flag(attr, TRUE); - msg = pa_tnc_msg_create(); - msg->add_attribute(msg, attr); - msg->build(msg); - excl = dst_imv_id != TNC_IMVID_ANY; - result = imc_test->send_message(imc_test, connection_id, excl, src_imc_id, - dst_imv_id, msg->get_encoding(msg)); - msg->destroy(msg); + out_msg->add_attribute(out_msg, attr); - return result; + /* send PA-TNC message with the excl flag set */ + return out_msg->send(out_msg, TRUE); } /** @@ -186,6 +208,7 @@ TNC_Result TNC_IMC_BeginHandshake(TNC_IMCID imc_id, TNC_ConnectionID connection_id) { imc_state_t *state; + imc_msg_t *out_msg; enumerator_t *enumerator; void *pointer; TNC_UInt32 additional_id; @@ -196,15 +219,16 @@ TNC_Result TNC_IMC_BeginHandshake(TNC_IMCID imc_id, DBG1(DBG_IMC, "IMC \"%s\" has not been initialized", imc_name); return TNC_RESULT_NOT_INITIALIZED; } - - /* get current IMC state */ if (!imc_test->get_state(imc_test, connection_id, &state)) { return TNC_RESULT_FATAL; } /* send PA message for primary IMC ID */ - result = send_message(state, imc_id, TNC_IMVID_ANY); + out_msg = imc_msg_create(imc_test, state, connection_id, imc_id, + TNC_IMVID_ANY, msg_types[0]); + result = send_message(state, out_msg); + out_msg->destroy(out_msg); /* Exit if there are no additional IMC IDs */ if (!imc_test->count_additional_ids(imc_test)) @@ -227,74 +251,76 @@ TNC_Result TNC_IMC_BeginHandshake(TNC_IMCID imc_id, { /* interpret pointer as scalar value */ additional_id = (TNC_UInt32)pointer; - result = send_message(state, additional_id, TNC_IMVID_ANY); + out_msg = imc_msg_create(imc_test, state, connection_id, additional_id, + TNC_IMVID_ANY, msg_types[0]); + result = send_message(state, out_msg); + out_msg->destroy(out_msg); } enumerator->destroy(enumerator); return result; } -static TNC_Result receive_message(TNC_IMCID imc_id, - TNC_ConnectionID connection_id, - TNC_UInt32 msg_flags, - chunk_t msg, - TNC_VendorID msg_vid, - TNC_MessageSubtype msg_subtype, - TNC_UInt32 src_imv_id, - TNC_UInt32 dst_imc_id) +static TNC_Result receive_message(imc_state_t *state, imc_msg_t *in_msg) { - pa_tnc_msg_t *pa_tnc_msg; - pa_tnc_attr_t *attr; - imc_state_t *state; + imc_msg_t *out_msg; enumerator_t *enumerator; + pa_tnc_attr_t *attr; + pen_type_t attr_type; TNC_Result result; bool fatal_error = FALSE; - if (!imc_test) - { - DBG1(DBG_IMC, "IMC \"%s\" has not been initialized", imc_name); - return TNC_RESULT_NOT_INITIALIZED; - } - - /* get current IMC state */ - if (!imc_test->get_state(imc_test, connection_id, &state)) - { - return TNC_RESULT_FATAL; - } - - /* parse received PA-TNC message and automatically handle any errors */ - result = imc_test->receive_message(imc_test, state, msg, msg_vid, - msg_subtype, src_imv_id, dst_imc_id, &pa_tnc_msg); - - /* no parsed PA-TNC attributes available if an error occurred */ - if (!pa_tnc_msg) + /* parse received PA-TNC message and handle local and remote errors */ + result = in_msg->receive(in_msg, &fatal_error); + if (result != TNC_RESULT_SUCCESS) { return result; } - /* preprocess any IETF standard error attributes */ - fatal_error = pa_tnc_msg->process_ietf_std_errors(pa_tnc_msg); - /* analyze PA-TNC attributes */ - enumerator = pa_tnc_msg->create_attribute_enumerator(pa_tnc_msg); + enumerator = in_msg->create_attribute_enumerator(in_msg); while (enumerator->enumerate(enumerator, &attr)) { - if (attr->get_vendor_id(attr) == PEN_ITA && - attr->get_type(attr) == ITA_ATTR_COMMAND) + attr_type = attr->get_type(attr); + + if (attr_type.vendor_id != PEN_ITA) + { + continue; + } + if (attr_type.type == ITA_ATTR_COMMAND) { ita_attr_command_t *ita_attr; - char *command; - + ita_attr = (ita_attr_command_t*)attr; - command = ita_attr->get_command(ita_attr); + DBG1(DBG_IMC, "received command '%s'", + ita_attr->get_command(ita_attr)); + } + else if (attr_type.type == ITA_ATTR_DUMMY) + { + ita_attr_dummy_t *ita_attr; + + ita_attr = (ita_attr_dummy_t*)attr; + DBG1(DBG_IMC, "received dummy attribute value (%d bytes)", + ita_attr->get_size(ita_attr)); } } enumerator->destroy(enumerator); - pa_tnc_msg->destroy(pa_tnc_msg); - /* if no error occurred then always return the same response */ - return fatal_error ? TNC_RESULT_FATAL : - send_message(state, dst_imc_id, src_imv_id); + if (fatal_error) + { + return TNC_RESULT_FATAL; + } + + /* if no assessment result is known then repeat the measurement */ + if (state->get_result(state, in_msg->get_dst_id(in_msg), NULL)) + { + return TNC_RESULT_SUCCESS; + } + out_msg = imc_msg_create_as_reply(in_msg); + result = send_message(state, out_msg); + out_msg->destroy(out_msg); + + return result; } /** @@ -306,14 +332,26 @@ TNC_Result TNC_IMC_ReceiveMessage(TNC_IMCID imc_id, TNC_UInt32 msg_len, TNC_MessageType msg_type) { - TNC_VendorID msg_vid; - TNC_MessageSubtype msg_subtype; + imc_state_t *state; + imc_msg_t *in_msg; + TNC_Result result; - msg_vid = msg_type >> 8; - msg_subtype = msg_type & TNC_SUBTYPE_ANY; + if (!imc_test) + { + DBG1(DBG_IMC, "IMC \"%s\" has not been initialized", imc_name); + return TNC_RESULT_NOT_INITIALIZED; + } + if (!imc_test->get_state(imc_test, connection_id, &state)) + { + return TNC_RESULT_FATAL; + } - return receive_message(imc_id, connection_id, 0, chunk_create(msg, msg_len), - msg_vid, msg_subtype, 0, TNC_IMCID_ANY); + in_msg = imc_msg_create_from_data(imc_test, state, connection_id, msg_type, + chunk_create(msg, msg_len)); + result = receive_message(state, in_msg); + in_msg->destroy(in_msg); + + return result; } /** @@ -329,9 +367,26 @@ TNC_Result TNC_IMC_ReceiveMessageLong(TNC_IMCID imc_id, TNC_UInt32 src_imv_id, TNC_UInt32 dst_imc_id) { - return receive_message(imc_id, connection_id, msg_flags, - chunk_create(msg, msg_len), msg_vid, msg_subtype, - src_imv_id, dst_imc_id); + imc_state_t *state; + imc_msg_t *in_msg; + TNC_Result result; + + if (!imc_test) + { + DBG1(DBG_IMC, "IMC \"%s\" has not been initialized", imc_name); + return TNC_RESULT_NOT_INITIALIZED; + } + if (!imc_test->get_state(imc_test, connection_id, &state)) + { + return TNC_RESULT_FATAL; + } + in_msg = imc_msg_create_from_long_data(imc_test, state, connection_id, + src_imv_id, dst_imc_id, msg_vid, msg_subtype, + chunk_create(msg, msg_len)); + result =receive_message(state, in_msg); + in_msg->destroy(in_msg); + + return result; } /** diff --git a/src/libimcv/plugins/imc_test/imc_test_state.c b/src/libimcv/plugins/imc_test/imc_test_state.c index 2adfd7d64..e7beca0aa 100644 --- a/src/libimcv/plugins/imc_test/imc_test_state.c +++ b/src/libimcv/plugins/imc_test/imc_test_state.c @@ -1,5 +1,6 @@ /* - * Copyright (C) 2011 Andreas Steffen, HSR Hochschule fuer Technik Rapperswil + * Copyright (C) 2011-2012 Andreas Steffen + * HSR Hochschule fuer Technik Rapperswil * * This program is free software; you can redistribute it and/or modify it * under the terms of the GNU General Public License as published by the @@ -14,10 +15,13 @@ #include "imc_test_state.h" -#include <debug.h> -#include <utils/linked_list.h> +#include <tncif_names.h> + +#include <utils/debug.h> +#include <collections/linked_list.h> typedef struct private_imc_test_state_t private_imc_test_state_t; +typedef struct entry_t entry_t; /** * Private data of an imc_test_state_t object. @@ -40,6 +44,11 @@ struct private_imc_test_state_t { TNC_ConnectionState state; /** + * Assessment/Evaluation Results for all IMC IDs + */ + linked_list_t *results; + + /** * Does the TNCCS connection support long message types? */ bool has_long; @@ -50,11 +59,21 @@ struct private_imc_test_state_t { bool has_excl; /** + * Maximum PA-TNC message size for this TNCCS connection + */ + u_int32_t max_msg_len; + + /** * Command to transmit to IMV */ char *command; /** + * Size of the dummy attribute value to transmit to IMV + */ + int dummy_size; + + /** * Is it the first handshake? */ bool first_handshake; @@ -63,7 +82,15 @@ struct private_imc_test_state_t { * Do a handshake retry */ bool handshake_retry; - + +}; + +/** + * Stores the Assessment/Evaluation Result for a given IMC ID + */ +struct entry_t { + TNC_IMCID id; + TNC_IMV_Evaluation_Result result; }; METHOD(imc_state_t, get_connection_id, TNC_ConnectionID, @@ -91,15 +118,83 @@ METHOD(imc_state_t, set_flags, void, this->has_excl = has_excl; } +METHOD(imc_state_t, set_max_msg_len, void, + private_imc_test_state_t *this, u_int32_t max_msg_len) +{ + this->max_msg_len = max_msg_len; +} + +METHOD(imc_state_t, get_max_msg_len, u_int32_t, + private_imc_test_state_t *this) +{ + return this->max_msg_len; +} + METHOD(imc_state_t, change_state, void, private_imc_test_state_t *this, TNC_ConnectionState new_state) { this->state = new_state; } +METHOD(imc_state_t, set_result, void, + private_imc_test_state_t *this, TNC_IMCID id, + TNC_IMV_Evaluation_Result result) +{ + enumerator_t *enumerator; + entry_t *entry; + bool found = FALSE; + + enumerator = this->results->create_enumerator(this->results); + while (enumerator->enumerate(enumerator, &entry)) + { + if (entry->id == id) + { + entry->result = result; + found = TRUE; + break; + } + } + enumerator->destroy(enumerator); + + if (!found) + { + entry = malloc_thing(entry_t); + entry->id = id; + entry->result = result; + this->results->insert_last(this->results, entry); + } +} + +METHOD(imc_state_t, get_result, bool, + private_imc_test_state_t *this, TNC_IMCID id, + TNC_IMV_Evaluation_Result *result) +{ + enumerator_t *enumerator; + entry_t *entry; + TNC_IMV_Evaluation_Result eval = TNC_IMV_EVALUATION_RESULT_DONT_KNOW; + + enumerator = this->results->create_enumerator(this->results); + while (enumerator->enumerate(enumerator, &entry)) + { + if (entry->id == id) + { + eval = entry->result; + break; + } + } + enumerator->destroy(enumerator); + + if (result) + { + *result = eval; + } + return eval != TNC_IMV_EVALUATION_RESULT_DONT_KNOW; +} + METHOD(imc_state_t, destroy, void, private_imc_test_state_t *this) { + this->results->destroy_function(this->results, free); free(this->command); free(this); } @@ -120,6 +215,13 @@ METHOD(imc_test_state_t, set_command, void, free(old_command); } +METHOD(imc_test_state_t, get_dummy_size, int, + private_imc_test_state_t *this) +{ + return this->dummy_size; +} + + METHOD(imc_test_state_t, is_first_handshake, bool, private_imc_test_state_t *this) { @@ -146,7 +248,7 @@ METHOD(imc_test_state_t, do_handshake_retry, bool, * Described in header. */ imc_state_t *imc_test_state_create(TNC_ConnectionID connection_id, - char *command, bool retry) + char *command, int dummy_size, bool retry) { private_imc_test_state_t *this; @@ -157,22 +259,28 @@ imc_state_t *imc_test_state_create(TNC_ConnectionID connection_id, .has_long = _has_long, .has_excl = _has_excl, .set_flags = _set_flags, + .set_max_msg_len = _set_max_msg_len, + .get_max_msg_len = _get_max_msg_len, .change_state = _change_state, + .set_result = _set_result, + .get_result = _get_result, .destroy = _destroy, }, .get_command = _get_command, .set_command = _set_command, + .get_dummy_size = _get_dummy_size, .is_first_handshake = _is_first_handshake, .do_handshake_retry = _do_handshake_retry, }, .state = TNC_CONNECTION_STATE_CREATE, + .results = linked_list_create(), .connection_id = connection_id, .command = strdup(command), + .dummy_size = dummy_size, .first_handshake = TRUE, .handshake_retry = retry, ); - + return &this->public.interface; } - diff --git a/src/libimcv/plugins/imc_test/imc_test_state.h b/src/libimcv/plugins/imc_test/imc_test_state.h index d9160df94..5f9ee2537 100644 --- a/src/libimcv/plugins/imc_test/imc_test_state.h +++ b/src/libimcv/plugins/imc_test/imc_test_state.h @@ -13,9 +13,11 @@ */ /** + * @defgroup imc_test imc_test + * @ingroup libimcv_plugins * * @defgroup imc_test_state_t imc_test_state - * @{ @ingroup imc_test_state + * @{ @ingroup imc_test */ #ifndef IMC_TEST_STATE_H_ @@ -52,6 +54,13 @@ struct imc_test_state_t { void (*set_command)(imc_test_state_t *this, char *command); /** + * get the value size of a dummy attribute to send to IMV + * + * @return size of the dummy attribute value to send to IMV + */ + int (*get_dummy_size)(imc_test_state_t *this); + + /** * Test and reset the first handshake flag * * @return TRUE if first handshake @@ -70,11 +79,12 @@ struct imc_test_state_t { /** * Create an imc_test_state_t instance * - * @param id connection ID - * @param command command to send to IMV - * @param retry TRUE if a handshake retry should be done + * @param id connection ID + * @param command command to send to IMV + * @param dummy_size size of the dummy attribute to send (only if > 0) + * @param retry TRUE if a handshake retry should be done */ imc_state_t* imc_test_state_create(TNC_ConnectionID id, char* command, - bool retry); + int dummy_size, bool retry); #endif /** IMC_TEST_STATE_H_ @}*/ diff --git a/src/libimcv/plugins/imv_os/Makefile.am b/src/libimcv/plugins/imv_os/Makefile.am new file mode 100644 index 000000000..4713b0913 --- /dev/null +++ b/src/libimcv/plugins/imv_os/Makefile.am @@ -0,0 +1,26 @@ +AM_CPPFLAGS = \ + -I$(top_srcdir)/src/libstrongswan \ + -I$(top_srcdir)/src/libtncif \ + -I$(top_srcdir)/src/libimcv + +AM_CFLAGS = \ + -rdynamic + +imcv_LTLIBRARIES = imv-os.la + +imv_os_la_LIBADD = $(top_builddir)/src/libimcv/libimcv.la \ + $(top_builddir)/src/libstrongswan/libstrongswan.la + +imv_os_la_SOURCES = \ + imv_os.c imv_os_state.h imv_os_state.c \ + imv_os_agent.h imv_os_agent.c \ + imv_os_database.c imv_os_database.h + +imv_os_la_LDFLAGS = -module -avoid-version + +ipsec_PROGRAMS = pacman +pacman_SOURCES = pacman.c +pacman_LDADD = $(top_builddir)/src/libstrongswan/libstrongswan.la +pacman.o : $(top_builddir)/config.status + +EXTRA_DIST = pacman.sh diff --git a/src/libimcv/plugins/imv_os/Makefile.in b/src/libimcv/plugins/imv_os/Makefile.in new file mode 100644 index 000000000..1718be000 --- /dev/null +++ b/src/libimcv/plugins/imv_os/Makefile.in @@ -0,0 +1,741 @@ +# Makefile.in generated by automake 1.11.6 from Makefile.am. +# @configure_input@ + +# Copyright (C) 1994, 1995, 1996, 1997, 1998, 1999, 2000, 2001, 2002, +# 2003, 2004, 2005, 2006, 2007, 2008, 2009, 2010, 2011 Free Software +# Foundation, Inc. +# This Makefile.in is free software; the Free Software Foundation +# gives unlimited permission to copy and/or distribute it, +# with or without modifications, as long as this notice is preserved. + +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY, to the extent permitted by law; without +# even the implied warranty of MERCHANTABILITY or FITNESS FOR A +# PARTICULAR PURPOSE. + +@SET_MAKE@ + + +VPATH = @srcdir@ +am__make_dryrun = \ + { \ + am__dry=no; \ + case $$MAKEFLAGS in \ + *\\[\ \ ]*) \ + echo 'am--echo: ; @echo "AM" OK' | $(MAKE) -f - 2>/dev/null \ + | grep '^AM OK$$' >/dev/null || am__dry=yes;; \ + *) \ + for am__flg in $$MAKEFLAGS; do \ + case $$am__flg in \ + *=*|--*) ;; \ + *n*) am__dry=yes; break;; \ + esac; \ + done;; \ + esac; \ + test $$am__dry = yes; \ + } +pkgdatadir = $(datadir)/@PACKAGE@ +pkgincludedir = $(includedir)/@PACKAGE@ +pkglibdir = $(libdir)/@PACKAGE@ +pkglibexecdir = $(libexecdir)/@PACKAGE@ +am__cd = CDPATH="$${ZSH_VERSION+.}$(PATH_SEPARATOR)" && cd +install_sh_DATA = $(install_sh) -c -m 644 +install_sh_PROGRAM = $(install_sh) -c +install_sh_SCRIPT = $(install_sh) -c +INSTALL_HEADER = $(INSTALL_DATA) +transform = $(program_transform_name) +NORMAL_INSTALL = : +PRE_INSTALL = : +POST_INSTALL = : +NORMAL_UNINSTALL = : +PRE_UNINSTALL = : +POST_UNINSTALL = : +build_triplet = @build@ +host_triplet = @host@ +ipsec_PROGRAMS = pacman$(EXEEXT) +subdir = src/libimcv/plugins/imv_os +DIST_COMMON = $(srcdir)/Makefile.am $(srcdir)/Makefile.in +ACLOCAL_M4 = $(top_srcdir)/aclocal.m4 +am__aclocal_m4_deps = $(top_srcdir)/m4/config/libtool.m4 \ + $(top_srcdir)/m4/config/ltoptions.m4 \ + $(top_srcdir)/m4/config/ltsugar.m4 \ + $(top_srcdir)/m4/config/ltversion.m4 \ + $(top_srcdir)/m4/config/lt~obsolete.m4 \ + $(top_srcdir)/m4/macros/with.m4 \ + $(top_srcdir)/m4/macros/enable-disable.m4 \ + $(top_srcdir)/m4/macros/add-plugin.m4 \ + $(top_srcdir)/configure.ac +am__configure_deps = $(am__aclocal_m4_deps) $(CONFIGURE_DEPENDENCIES) \ + $(ACLOCAL_M4) +mkinstalldirs = $(install_sh) -d +CONFIG_HEADER = $(top_builddir)/config.h +CONFIG_CLEAN_FILES = +CONFIG_CLEAN_VPATH_FILES = +am__vpath_adj_setup = srcdirstrip=`echo "$(srcdir)" | sed 's|.|.|g'`; +am__vpath_adj = case $$p in \ + $(srcdir)/*) f=`echo "$$p" | sed "s|^$$srcdirstrip/||"`;; \ + *) f=$$p;; \ + esac; +am__strip_dir = f=`echo $$p | sed -e 's|^.*/||'`; +am__install_max = 40 +am__nobase_strip_setup = \ + srcdirstrip=`echo "$(srcdir)" | sed 's/[].[^$$\\*|]/\\\\&/g'` +am__nobase_strip = \ + for p in $$list; do echo "$$p"; done | sed -e "s|$$srcdirstrip/||" +am__nobase_list = $(am__nobase_strip_setup); \ + for p in $$list; do echo "$$p $$p"; done | \ + sed "s| $$srcdirstrip/| |;"' / .*\//!s/ .*/ ./; s,\( .*\)/[^/]*$$,\1,' | \ + $(AWK) 'BEGIN { files["."] = "" } { files[$$2] = files[$$2] " " $$1; \ + if (++n[$$2] == $(am__install_max)) \ + { print $$2, files[$$2]; n[$$2] = 0; files[$$2] = "" } } \ + END { for (dir in files) print dir, files[dir] }' +am__base_list = \ + sed '$$!N;$$!N;$$!N;$$!N;$$!N;$$!N;$$!N;s/\n/ /g' | \ + sed '$$!N;$$!N;$$!N;$$!N;s/\n/ /g' +am__uninstall_files_from_dir = { \ + test -z "$$files" \ + || { test ! -d "$$dir" && test ! -f "$$dir" && test ! -r "$$dir"; } \ + || { echo " ( cd '$$dir' && rm -f" $$files ")"; \ + $(am__cd) "$$dir" && rm -f $$files; }; \ + } +am__installdirs = "$(DESTDIR)$(imcvdir)" "$(DESTDIR)$(ipsecdir)" +LTLIBRARIES = $(imcv_LTLIBRARIES) +imv_os_la_DEPENDENCIES = $(top_builddir)/src/libimcv/libimcv.la \ + $(top_builddir)/src/libstrongswan/libstrongswan.la +am_imv_os_la_OBJECTS = imv_os.lo imv_os_state.lo imv_os_agent.lo \ + imv_os_database.lo +imv_os_la_OBJECTS = $(am_imv_os_la_OBJECTS) +AM_V_lt = $(am__v_lt_@AM_V@) +am__v_lt_ = $(am__v_lt_@AM_DEFAULT_V@) +am__v_lt_0 = --silent +imv_os_la_LINK = $(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) \ + $(LIBTOOLFLAGS) --mode=link $(CCLD) $(AM_CFLAGS) $(CFLAGS) \ + $(imv_os_la_LDFLAGS) $(LDFLAGS) -o $@ +PROGRAMS = $(ipsec_PROGRAMS) +am_pacman_OBJECTS = pacman.$(OBJEXT) +pacman_OBJECTS = $(am_pacman_OBJECTS) +pacman_DEPENDENCIES = \ + $(top_builddir)/src/libstrongswan/libstrongswan.la +DEFAULT_INCLUDES = -I.@am__isrc@ -I$(top_builddir) +depcomp = $(SHELL) $(top_srcdir)/depcomp +am__depfiles_maybe = depfiles +am__mv = mv -f +COMPILE = $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) \ + $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) +LTCOMPILE = $(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) \ + $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) \ + $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) \ + $(AM_CFLAGS) $(CFLAGS) +AM_V_CC = $(am__v_CC_@AM_V@) +am__v_CC_ = $(am__v_CC_@AM_DEFAULT_V@) +am__v_CC_0 = @echo " CC " $@; +AM_V_at = $(am__v_at_@AM_V@) +am__v_at_ = $(am__v_at_@AM_DEFAULT_V@) +am__v_at_0 = @ +CCLD = $(CC) +LINK = $(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) \ + $(LIBTOOLFLAGS) --mode=link $(CCLD) $(AM_CFLAGS) $(CFLAGS) \ + $(AM_LDFLAGS) $(LDFLAGS) -o $@ +AM_V_CCLD = $(am__v_CCLD_@AM_V@) +am__v_CCLD_ = $(am__v_CCLD_@AM_DEFAULT_V@) +am__v_CCLD_0 = @echo " CCLD " $@; +AM_V_GEN = $(am__v_GEN_@AM_V@) +am__v_GEN_ = $(am__v_GEN_@AM_DEFAULT_V@) +am__v_GEN_0 = @echo " GEN " $@; +SOURCES = $(imv_os_la_SOURCES) $(pacman_SOURCES) +DIST_SOURCES = $(imv_os_la_SOURCES) $(pacman_SOURCES) +am__can_run_installinfo = \ + case $$AM_UPDATE_INFO_DIR in \ + n|no|NO) false;; \ + *) (install-info --version) >/dev/null 2>&1;; \ + esac +ETAGS = etags +CTAGS = ctags +DISTFILES = $(DIST_COMMON) $(DIST_SOURCES) $(TEXINFOS) $(EXTRA_DIST) +ACLOCAL = @ACLOCAL@ +ALLOCA = @ALLOCA@ +AMTAR = @AMTAR@ +AM_DEFAULT_VERBOSITY = @AM_DEFAULT_VERBOSITY@ +AR = @AR@ +AUTOCONF = @AUTOCONF@ +AUTOHEADER = @AUTOHEADER@ +AUTOMAKE = @AUTOMAKE@ +AWK = @AWK@ +BFDLIB = @BFDLIB@ +BTLIB = @BTLIB@ +CC = @CC@ +CCDEPMODE = @CCDEPMODE@ +CFLAGS = @CFLAGS@ +CHECK_CFLAGS = @CHECK_CFLAGS@ +CHECK_LIBS = @CHECK_LIBS@ +COVERAGE_CFLAGS = @COVERAGE_CFLAGS@ +COVERAGE_LDFLAGS = @COVERAGE_LDFLAGS@ +CPP = @CPP@ +CPPFLAGS = @CPPFLAGS@ +CYGPATH_W = @CYGPATH_W@ +DEFS = @DEFS@ +DEPDIR = @DEPDIR@ +DLLIB = @DLLIB@ +DLLTOOL = @DLLTOOL@ +DSYMUTIL = @DSYMUTIL@ +DUMPBIN = @DUMPBIN@ +ECHO_C = @ECHO_C@ +ECHO_N = @ECHO_N@ +ECHO_T = @ECHO_T@ +EGREP = @EGREP@ +EXEEXT = @EXEEXT@ +FGREP = @FGREP@ +GENHTML = @GENHTML@ +GPERF = @GPERF@ +GPRBUILD = @GPRBUILD@ +GREP = @GREP@ +INSTALL = @INSTALL@ +INSTALL_DATA = @INSTALL_DATA@ +INSTALL_PROGRAM = @INSTALL_PROGRAM@ +INSTALL_SCRIPT = @INSTALL_SCRIPT@ +INSTALL_STRIP_PROGRAM = @INSTALL_STRIP_PROGRAM@ +LCOV = @LCOV@ +LD = @LD@ +LDFLAGS = @LDFLAGS@ +LEX = @LEX@ +LEXLIB = @LEXLIB@ +LEX_OUTPUT_ROOT = @LEX_OUTPUT_ROOT@ +LIBOBJS = @LIBOBJS@ +LIBS = @LIBS@ +LIBTOOL = @LIBTOOL@ +LIPO = @LIPO@ +LN_S = @LN_S@ +LTLIBOBJS = @LTLIBOBJS@ +MAKEINFO = @MAKEINFO@ +MANIFEST_TOOL = @MANIFEST_TOOL@ +MKDIR_P = @MKDIR_P@ +MYSQLCFLAG = @MYSQLCFLAG@ +MYSQLCONFIG = @MYSQLCONFIG@ +MYSQLLIB = @MYSQLLIB@ +NM = @NM@ +NMEDIT = @NMEDIT@ +OBJDUMP = @OBJDUMP@ +OBJEXT = @OBJEXT@ +OTOOL = @OTOOL@ +OTOOL64 = @OTOOL64@ +PACKAGE = @PACKAGE@ +PACKAGE_BUGREPORT = @PACKAGE_BUGREPORT@ +PACKAGE_NAME = @PACKAGE_NAME@ +PACKAGE_STRING = @PACKAGE_STRING@ +PACKAGE_TARNAME = @PACKAGE_TARNAME@ +PACKAGE_URL = @PACKAGE_URL@ +PACKAGE_VERSION = @PACKAGE_VERSION@ +PATH_SEPARATOR = @PATH_SEPARATOR@ +PERL = @PERL@ +PKG_CONFIG = @PKG_CONFIG@ +PKG_CONFIG_LIBDIR = @PKG_CONFIG_LIBDIR@ +PKG_CONFIG_PATH = @PKG_CONFIG_PATH@ +PTHREADLIB = @PTHREADLIB@ +RANLIB = @RANLIB@ +RTLIB = @RTLIB@ +RUBY = @RUBY@ +RUBYINCLUDE = @RUBYINCLUDE@ +RUBYLIB = @RUBYLIB@ +SED = @SED@ +SET_MAKE = @SET_MAKE@ +SHELL = @SHELL@ +SOCKLIB = @SOCKLIB@ +STRIP = @STRIP@ +UNWINDLIB = @UNWINDLIB@ +VERSION = @VERSION@ +YACC = @YACC@ +YFLAGS = @YFLAGS@ +abs_builddir = @abs_builddir@ +abs_srcdir = @abs_srcdir@ +abs_top_builddir = @abs_top_builddir@ +abs_top_srcdir = @abs_top_srcdir@ +ac_ct_AR = @ac_ct_AR@ +ac_ct_CC = @ac_ct_CC@ +ac_ct_DUMPBIN = @ac_ct_DUMPBIN@ +am__include = @am__include@ +am__leading_dot = @am__leading_dot@ +am__quote = @am__quote@ +am__tar = @am__tar@ +am__untar = @am__untar@ +attest_plugins = @attest_plugins@ +bindir = @bindir@ +build = @build@ +build_alias = @build_alias@ +build_cpu = @build_cpu@ +build_os = @build_os@ +build_vendor = @build_vendor@ +builddir = @builddir@ +c_plugins = @c_plugins@ +charon_natt_port = @charon_natt_port@ +charon_plugins = @charon_plugins@ +charon_udp_port = @charon_udp_port@ +clearsilver_LIBS = @clearsilver_LIBS@ +cmd_plugins = @cmd_plugins@ +datadir = @datadir@ +datarootdir = @datarootdir@ +dbusservicedir = @dbusservicedir@ +dev_headers = @dev_headers@ +docdir = @docdir@ +dvidir = @dvidir@ +exec_prefix = @exec_prefix@ +fips_mode = @fips_mode@ +gtk_CFLAGS = @gtk_CFLAGS@ +gtk_LIBS = @gtk_LIBS@ +h_plugins = @h_plugins@ +host = @host@ +host_alias = @host_alias@ +host_cpu = @host_cpu@ +host_os = @host_os@ +host_vendor = @host_vendor@ +htmldir = @htmldir@ +imcvdir = @imcvdir@ +includedir = @includedir@ +infodir = @infodir@ +install_sh = @install_sh@ +ipsec_script = @ipsec_script@ +ipsec_script_upper = @ipsec_script_upper@ +ipsecdir = @ipsecdir@ +ipsecgroup = @ipsecgroup@ +ipseclibdir = @ipseclibdir@ +ipsecuser = @ipsecuser@ +libdir = @libdir@ +libexecdir = @libexecdir@ +linux_headers = @linux_headers@ +localedir = @localedir@ +localstatedir = @localstatedir@ +maemo_CFLAGS = @maemo_CFLAGS@ +maemo_LIBS = @maemo_LIBS@ +manager_plugins = @manager_plugins@ +mandir = @mandir@ +medsrv_plugins = @medsrv_plugins@ +mkdir_p = @mkdir_p@ +nm_CFLAGS = @nm_CFLAGS@ +nm_LIBS = @nm_LIBS@ +nm_ca_dir = @nm_ca_dir@ +nm_plugins = @nm_plugins@ +oldincludedir = @oldincludedir@ +openac_plugins = @openac_plugins@ +pcsclite_CFLAGS = @pcsclite_CFLAGS@ +pcsclite_LIBS = @pcsclite_LIBS@ +pdfdir = @pdfdir@ +piddir = @piddir@ +pki_plugins = @pki_plugins@ +plugindir = @plugindir@ +pool_plugins = @pool_plugins@ +prefix = @prefix@ +program_transform_name = @program_transform_name@ +psdir = @psdir@ +random_device = @random_device@ +resolv_conf = @resolv_conf@ +routing_table = @routing_table@ +routing_table_prio = @routing_table_prio@ +s_plugins = @s_plugins@ +sbindir = @sbindir@ +scepclient_plugins = @scepclient_plugins@ +scripts_plugins = @scripts_plugins@ +sharedstatedir = @sharedstatedir@ +soup_CFLAGS = @soup_CFLAGS@ +soup_LIBS = @soup_LIBS@ +srcdir = @srcdir@ +starter_plugins = @starter_plugins@ +strongswan_conf = @strongswan_conf@ +sysconfdir = @sysconfdir@ +systemdsystemunitdir = @systemdsystemunitdir@ +target_alias = @target_alias@ +top_build_prefix = @top_build_prefix@ +top_builddir = @top_builddir@ +top_srcdir = @top_srcdir@ +urandom_device = @urandom_device@ +xml_CFLAGS = @xml_CFLAGS@ +xml_LIBS = @xml_LIBS@ +AM_CPPFLAGS = \ + -I$(top_srcdir)/src/libstrongswan \ + -I$(top_srcdir)/src/libtncif \ + -I$(top_srcdir)/src/libimcv + +AM_CFLAGS = \ + -rdynamic + +imcv_LTLIBRARIES = imv-os.la +imv_os_la_LIBADD = $(top_builddir)/src/libimcv/libimcv.la \ + $(top_builddir)/src/libstrongswan/libstrongswan.la + +imv_os_la_SOURCES = \ + imv_os.c imv_os_state.h imv_os_state.c \ + imv_os_agent.h imv_os_agent.c \ + imv_os_database.c imv_os_database.h + +imv_os_la_LDFLAGS = -module -avoid-version +pacman_SOURCES = pacman.c +pacman_LDADD = $(top_builddir)/src/libstrongswan/libstrongswan.la +EXTRA_DIST = pacman.sh +all: all-am + +.SUFFIXES: +.SUFFIXES: .c .lo .o .obj +$(srcdir)/Makefile.in: $(srcdir)/Makefile.am $(am__configure_deps) + @for dep in $?; do \ + case '$(am__configure_deps)' in \ + *$$dep*) \ + ( cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh ) \ + && { if test -f $@; then exit 0; else break; fi; }; \ + exit 1;; \ + esac; \ + done; \ + echo ' cd $(top_srcdir) && $(AUTOMAKE) --gnu src/libimcv/plugins/imv_os/Makefile'; \ + $(am__cd) $(top_srcdir) && \ + $(AUTOMAKE) --gnu src/libimcv/plugins/imv_os/Makefile +.PRECIOUS: Makefile +Makefile: $(srcdir)/Makefile.in $(top_builddir)/config.status + @case '$?' in \ + *config.status*) \ + cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh;; \ + *) \ + echo ' cd $(top_builddir) && $(SHELL) ./config.status $(subdir)/$@ $(am__depfiles_maybe)'; \ + cd $(top_builddir) && $(SHELL) ./config.status $(subdir)/$@ $(am__depfiles_maybe);; \ + esac; + +$(top_builddir)/config.status: $(top_srcdir)/configure $(CONFIG_STATUS_DEPENDENCIES) + cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh + +$(top_srcdir)/configure: $(am__configure_deps) + cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh +$(ACLOCAL_M4): $(am__aclocal_m4_deps) + cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh +$(am__aclocal_m4_deps): +install-imcvLTLIBRARIES: $(imcv_LTLIBRARIES) + @$(NORMAL_INSTALL) + @list='$(imcv_LTLIBRARIES)'; test -n "$(imcvdir)" || list=; \ + list2=; for p in $$list; do \ + if test -f $$p; then \ + list2="$$list2 $$p"; \ + else :; fi; \ + done; \ + test -z "$$list2" || { \ + echo " $(MKDIR_P) '$(DESTDIR)$(imcvdir)'"; \ + $(MKDIR_P) "$(DESTDIR)$(imcvdir)" || exit 1; \ + echo " $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=install $(INSTALL) $(INSTALL_STRIP_FLAG) $$list2 '$(DESTDIR)$(imcvdir)'"; \ + $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=install $(INSTALL) $(INSTALL_STRIP_FLAG) $$list2 "$(DESTDIR)$(imcvdir)"; \ + } + +uninstall-imcvLTLIBRARIES: + @$(NORMAL_UNINSTALL) + @list='$(imcv_LTLIBRARIES)'; test -n "$(imcvdir)" || list=; \ + for p in $$list; do \ + $(am__strip_dir) \ + echo " $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=uninstall rm -f '$(DESTDIR)$(imcvdir)/$$f'"; \ + $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=uninstall rm -f "$(DESTDIR)$(imcvdir)/$$f"; \ + done + +clean-imcvLTLIBRARIES: + -test -z "$(imcv_LTLIBRARIES)" || rm -f $(imcv_LTLIBRARIES) + @list='$(imcv_LTLIBRARIES)'; for p in $$list; do \ + dir="`echo $$p | sed -e 's|/[^/]*$$||'`"; \ + test "$$dir" != "$$p" || dir=.; \ + echo "rm -f \"$${dir}/so_locations\""; \ + rm -f "$${dir}/so_locations"; \ + done +imv-os.la: $(imv_os_la_OBJECTS) $(imv_os_la_DEPENDENCIES) $(EXTRA_imv_os_la_DEPENDENCIES) + $(AM_V_CCLD)$(imv_os_la_LINK) -rpath $(imcvdir) $(imv_os_la_OBJECTS) $(imv_os_la_LIBADD) $(LIBS) +install-ipsecPROGRAMS: $(ipsec_PROGRAMS) + @$(NORMAL_INSTALL) + @list='$(ipsec_PROGRAMS)'; test -n "$(ipsecdir)" || list=; \ + if test -n "$$list"; then \ + echo " $(MKDIR_P) '$(DESTDIR)$(ipsecdir)'"; \ + $(MKDIR_P) "$(DESTDIR)$(ipsecdir)" || exit 1; \ + fi; \ + for p in $$list; do echo "$$p $$p"; done | \ + sed 's/$(EXEEXT)$$//' | \ + while read p p1; do if test -f $$p || test -f $$p1; \ + then echo "$$p"; echo "$$p"; else :; fi; \ + done | \ + sed -e 'p;s,.*/,,;n;h' -e 's|.*|.|' \ + -e 'p;x;s,.*/,,;s/$(EXEEXT)$$//;$(transform);s/$$/$(EXEEXT)/' | \ + sed 'N;N;N;s,\n, ,g' | \ + $(AWK) 'BEGIN { files["."] = ""; dirs["."] = 1 } \ + { d=$$3; if (dirs[d] != 1) { print "d", d; dirs[d] = 1 } \ + if ($$2 == $$4) files[d] = files[d] " " $$1; \ + else { print "f", $$3 "/" $$4, $$1; } } \ + END { for (d in files) print "f", d, files[d] }' | \ + while read type dir files; do \ + if test "$$dir" = .; then dir=; else dir=/$$dir; fi; \ + test -z "$$files" || { \ + echo " $(INSTALL_PROGRAM_ENV) $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=install $(INSTALL_PROGRAM) $$files '$(DESTDIR)$(ipsecdir)$$dir'"; \ + $(INSTALL_PROGRAM_ENV) $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=install $(INSTALL_PROGRAM) $$files "$(DESTDIR)$(ipsecdir)$$dir" || exit $$?; \ + } \ + ; done + +uninstall-ipsecPROGRAMS: + @$(NORMAL_UNINSTALL) + @list='$(ipsec_PROGRAMS)'; test -n "$(ipsecdir)" || list=; \ + files=`for p in $$list; do echo "$$p"; done | \ + sed -e 'h;s,^.*/,,;s/$(EXEEXT)$$//;$(transform)' \ + -e 's/$$/$(EXEEXT)/' `; \ + test -n "$$list" || exit 0; \ + echo " ( cd '$(DESTDIR)$(ipsecdir)' && rm -f" $$files ")"; \ + cd "$(DESTDIR)$(ipsecdir)" && rm -f $$files + +clean-ipsecPROGRAMS: + @list='$(ipsec_PROGRAMS)'; test -n "$$list" || exit 0; \ + echo " rm -f" $$list; \ + rm -f $$list || exit $$?; \ + test -n "$(EXEEXT)" || exit 0; \ + list=`for p in $$list; do echo "$$p"; done | sed 's/$(EXEEXT)$$//'`; \ + echo " rm -f" $$list; \ + rm -f $$list +pacman$(EXEEXT): $(pacman_OBJECTS) $(pacman_DEPENDENCIES) $(EXTRA_pacman_DEPENDENCIES) + @rm -f pacman$(EXEEXT) + $(AM_V_CCLD)$(LINK) $(pacman_OBJECTS) $(pacman_LDADD) $(LIBS) + +mostlyclean-compile: + -rm -f *.$(OBJEXT) + +distclean-compile: + -rm -f *.tab.c + +@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/imv_os.Plo@am__quote@ +@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/imv_os_agent.Plo@am__quote@ +@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/imv_os_database.Plo@am__quote@ +@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/imv_os_state.Plo@am__quote@ +@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/pacman.Po@am__quote@ + +.c.o: +@am__fastdepCC_TRUE@ $(AM_V_CC)$(COMPILE) -MT $@ -MD -MP -MF $(DEPDIR)/$*.Tpo -c -o $@ $< +@am__fastdepCC_TRUE@ $(AM_V_at)$(am__mv) $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Po +@AMDEP_TRUE@@am__fastdepCC_FALSE@ $(AM_V_CC)source='$<' object='$@' libtool=no @AMDEPBACKSLASH@ +@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@ +@am__fastdepCC_FALSE@ $(AM_V_CC@am__nodep@)$(COMPILE) -c $< + +.c.obj: +@am__fastdepCC_TRUE@ $(AM_V_CC)$(COMPILE) -MT $@ -MD -MP -MF $(DEPDIR)/$*.Tpo -c -o $@ `$(CYGPATH_W) '$<'` +@am__fastdepCC_TRUE@ $(AM_V_at)$(am__mv) $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Po +@AMDEP_TRUE@@am__fastdepCC_FALSE@ $(AM_V_CC)source='$<' object='$@' libtool=no @AMDEPBACKSLASH@ +@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@ +@am__fastdepCC_FALSE@ $(AM_V_CC@am__nodep@)$(COMPILE) -c `$(CYGPATH_W) '$<'` + +.c.lo: +@am__fastdepCC_TRUE@ $(AM_V_CC)$(LTCOMPILE) -MT $@ -MD -MP -MF $(DEPDIR)/$*.Tpo -c -o $@ $< +@am__fastdepCC_TRUE@ $(AM_V_at)$(am__mv) $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Plo +@AMDEP_TRUE@@am__fastdepCC_FALSE@ $(AM_V_CC)source='$<' object='$@' libtool=yes @AMDEPBACKSLASH@ +@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@ +@am__fastdepCC_FALSE@ $(AM_V_CC@am__nodep@)$(LTCOMPILE) -c -o $@ $< + +mostlyclean-libtool: + -rm -f *.lo + +clean-libtool: + -rm -rf .libs _libs + +ID: $(HEADERS) $(SOURCES) $(LISP) $(TAGS_FILES) + list='$(SOURCES) $(HEADERS) $(LISP) $(TAGS_FILES)'; \ + unique=`for i in $$list; do \ + if test -f "$$i"; then echo $$i; else echo $(srcdir)/$$i; fi; \ + done | \ + $(AWK) '{ files[$$0] = 1; nonempty = 1; } \ + END { if (nonempty) { for (i in files) print i; }; }'`; \ + mkid -fID $$unique +tags: TAGS + +TAGS: $(HEADERS) $(SOURCES) $(TAGS_DEPENDENCIES) \ + $(TAGS_FILES) $(LISP) + set x; \ + here=`pwd`; \ + list='$(SOURCES) $(HEADERS) $(LISP) $(TAGS_FILES)'; \ + unique=`for i in $$list; do \ + if test -f "$$i"; then echo $$i; else echo $(srcdir)/$$i; fi; \ + done | \ + $(AWK) '{ files[$$0] = 1; nonempty = 1; } \ + END { if (nonempty) { for (i in files) print i; }; }'`; \ + shift; \ + if test -z "$(ETAGS_ARGS)$$*$$unique"; then :; else \ + test -n "$$unique" || unique=$$empty_fix; \ + if test $$# -gt 0; then \ + $(ETAGS) $(ETAGSFLAGS) $(AM_ETAGSFLAGS) $(ETAGS_ARGS) \ + "$$@" $$unique; \ + else \ + $(ETAGS) $(ETAGSFLAGS) $(AM_ETAGSFLAGS) $(ETAGS_ARGS) \ + $$unique; \ + fi; \ + fi +ctags: CTAGS +CTAGS: $(HEADERS) $(SOURCES) $(TAGS_DEPENDENCIES) \ + $(TAGS_FILES) $(LISP) + list='$(SOURCES) $(HEADERS) $(LISP) $(TAGS_FILES)'; \ + unique=`for i in $$list; do \ + if test -f "$$i"; then echo $$i; else echo $(srcdir)/$$i; fi; \ + done | \ + $(AWK) '{ files[$$0] = 1; nonempty = 1; } \ + END { if (nonempty) { for (i in files) print i; }; }'`; \ + test -z "$(CTAGS_ARGS)$$unique" \ + || $(CTAGS) $(CTAGSFLAGS) $(AM_CTAGSFLAGS) $(CTAGS_ARGS) \ + $$unique + +GTAGS: + here=`$(am__cd) $(top_builddir) && pwd` \ + && $(am__cd) $(top_srcdir) \ + && gtags -i $(GTAGS_ARGS) "$$here" + +distclean-tags: + -rm -f TAGS ID GTAGS GRTAGS GSYMS GPATH tags + +distdir: $(DISTFILES) + @srcdirstrip=`echo "$(srcdir)" | sed 's/[].[^$$\\*]/\\\\&/g'`; \ + topsrcdirstrip=`echo "$(top_srcdir)" | sed 's/[].[^$$\\*]/\\\\&/g'`; \ + list='$(DISTFILES)'; \ + dist_files=`for file in $$list; do echo $$file; done | \ + sed -e "s|^$$srcdirstrip/||;t" \ + -e "s|^$$topsrcdirstrip/|$(top_builddir)/|;t"`; \ + case $$dist_files in \ + */*) $(MKDIR_P) `echo "$$dist_files" | \ + sed '/\//!d;s|^|$(distdir)/|;s,/[^/]*$$,,' | \ + sort -u` ;; \ + esac; \ + for file in $$dist_files; do \ + if test -f $$file || test -d $$file; then d=.; else d=$(srcdir); fi; \ + if test -d $$d/$$file; then \ + dir=`echo "/$$file" | sed -e 's,/[^/]*$$,,'`; \ + if test -d "$(distdir)/$$file"; then \ + find "$(distdir)/$$file" -type d ! -perm -700 -exec chmod u+rwx {} \;; \ + fi; \ + if test -d $(srcdir)/$$file && test $$d != $(srcdir); then \ + cp -fpR $(srcdir)/$$file "$(distdir)$$dir" || exit 1; \ + find "$(distdir)/$$file" -type d ! -perm -700 -exec chmod u+rwx {} \;; \ + fi; \ + cp -fpR $$d/$$file "$(distdir)$$dir" || exit 1; \ + else \ + test -f "$(distdir)/$$file" \ + || cp -p $$d/$$file "$(distdir)/$$file" \ + || exit 1; \ + fi; \ + done +check-am: all-am +check: check-am +all-am: Makefile $(LTLIBRARIES) $(PROGRAMS) +installdirs: + for dir in "$(DESTDIR)$(imcvdir)" "$(DESTDIR)$(ipsecdir)"; do \ + test -z "$$dir" || $(MKDIR_P) "$$dir"; \ + done +install: install-am +install-exec: install-exec-am +install-data: install-data-am +uninstall: uninstall-am + +install-am: all-am + @$(MAKE) $(AM_MAKEFLAGS) install-exec-am install-data-am + +installcheck: installcheck-am +install-strip: + if test -z '$(STRIP)'; then \ + $(MAKE) $(AM_MAKEFLAGS) INSTALL_PROGRAM="$(INSTALL_STRIP_PROGRAM)" \ + install_sh_PROGRAM="$(INSTALL_STRIP_PROGRAM)" INSTALL_STRIP_FLAG=-s \ + install; \ + else \ + $(MAKE) $(AM_MAKEFLAGS) INSTALL_PROGRAM="$(INSTALL_STRIP_PROGRAM)" \ + install_sh_PROGRAM="$(INSTALL_STRIP_PROGRAM)" INSTALL_STRIP_FLAG=-s \ + "INSTALL_PROGRAM_ENV=STRIPPROG='$(STRIP)'" install; \ + fi +mostlyclean-generic: + +clean-generic: + +distclean-generic: + -test -z "$(CONFIG_CLEAN_FILES)" || rm -f $(CONFIG_CLEAN_FILES) + -test . = "$(srcdir)" || test -z "$(CONFIG_CLEAN_VPATH_FILES)" || rm -f $(CONFIG_CLEAN_VPATH_FILES) + +maintainer-clean-generic: + @echo "This command is intended for maintainers to use" + @echo "it deletes files that may require special tools to rebuild." +clean: clean-am + +clean-am: clean-generic clean-imcvLTLIBRARIES clean-ipsecPROGRAMS \ + clean-libtool mostlyclean-am + +distclean: distclean-am + -rm -rf ./$(DEPDIR) + -rm -f Makefile +distclean-am: clean-am distclean-compile distclean-generic \ + distclean-tags + +dvi: dvi-am + +dvi-am: + +html: html-am + +html-am: + +info: info-am + +info-am: + +install-data-am: install-imcvLTLIBRARIES install-ipsecPROGRAMS + +install-dvi: install-dvi-am + +install-dvi-am: + +install-exec-am: + +install-html: install-html-am + +install-html-am: + +install-info: install-info-am + +install-info-am: + +install-man: + +install-pdf: install-pdf-am + +install-pdf-am: + +install-ps: install-ps-am + +install-ps-am: + +installcheck-am: + +maintainer-clean: maintainer-clean-am + -rm -rf ./$(DEPDIR) + -rm -f Makefile +maintainer-clean-am: distclean-am maintainer-clean-generic + +mostlyclean: mostlyclean-am + +mostlyclean-am: mostlyclean-compile mostlyclean-generic \ + mostlyclean-libtool + +pdf: pdf-am + +pdf-am: + +ps: ps-am + +ps-am: + +uninstall-am: uninstall-imcvLTLIBRARIES uninstall-ipsecPROGRAMS + +.MAKE: install-am install-strip + +.PHONY: CTAGS GTAGS all all-am check check-am clean clean-generic \ + clean-imcvLTLIBRARIES clean-ipsecPROGRAMS clean-libtool ctags \ + distclean distclean-compile distclean-generic \ + distclean-libtool distclean-tags distdir dvi dvi-am html \ + html-am info info-am install install-am install-data \ + install-data-am install-dvi install-dvi-am install-exec \ + install-exec-am install-html install-html-am \ + install-imcvLTLIBRARIES install-info install-info-am \ + install-ipsecPROGRAMS install-man install-pdf install-pdf-am \ + install-ps install-ps-am install-strip installcheck \ + installcheck-am installdirs maintainer-clean \ + maintainer-clean-generic mostlyclean mostlyclean-compile \ + mostlyclean-generic mostlyclean-libtool pdf pdf-am ps ps-am \ + tags uninstall uninstall-am uninstall-imcvLTLIBRARIES \ + uninstall-ipsecPROGRAMS + +pacman.o : $(top_builddir)/config.status + +# Tell versions [3.59,3.63) of GNU make to not export all variables. +# Otherwise a system limit (for SysV at least) may be exceeded. +.NOEXPORT: diff --git a/src/libimcv/plugins/imv_os/imv_os.c b/src/libimcv/plugins/imv_os/imv_os.c new file mode 100644 index 000000000..ba0fa8153 --- /dev/null +++ b/src/libimcv/plugins/imv_os/imv_os.c @@ -0,0 +1,24 @@ +/* + * Copyright (C) 2013 Andreas Steffen + * HSR Hochschule fuer Technik Rapperswil + * + * This program is free software; you can redistribute it and/or modify it + * under the terms of the GNU General Public License as published by the + * Free Software Foundation; either version 2 of the License, or (at your + * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>. + * + * This program is distributed in the hope that it will be useful, but + * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY + * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License + * for more details. + */ + +#include "imv_os_agent.h" + +static const char imv_name[] = "OS"; +static const imv_agent_create_t imv_agent_create = imv_os_agent_create; + +/* include generic TGC TNC IF-IMV API code below */ + +#include <imv/imv_if.h> + diff --git a/src/libimcv/plugins/imv_os/imv_os_agent.c b/src/libimcv/plugins/imv_os/imv_os_agent.c new file mode 100644 index 000000000..ba3f3afc6 --- /dev/null +++ b/src/libimcv/plugins/imv_os/imv_os_agent.c @@ -0,0 +1,805 @@ +/* + * Copyright (C) 2013 Andreas Steffen + * HSR Hochschule fuer Technik Rapperswil + * + * This program is free software; you can redistribute it and/or modify it + * under the terms of the GNU General Public License as published by the + * Free Software Foundation; either version 2 of the License, or (at your + * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>. + * + * This program is distributed in the hope that it will be useful, but + * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY + * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License + * for more details. + */ + +#define _GNU_SOURCE +#include <stdio.h> + +#include "imv_os_agent.h" +#include "imv_os_state.h" +#include "imv_os_database.h" + +#include <imcv.h> +#include <imv/imv_agent.h> +#include <imv/imv_msg.h> +#include <ietf/ietf_attr.h> +#include <ietf/ietf_attr_attr_request.h> +#include <ietf/ietf_attr_default_pwd_enabled.h> +#include <ietf/ietf_attr_fwd_enabled.h> +#include <ietf/ietf_attr_installed_packages.h> +#include <ietf/ietf_attr_numeric_version.h> +#include <ietf/ietf_attr_op_status.h> +#include <ietf/ietf_attr_pa_tnc_error.h> +#include <ietf/ietf_attr_product_info.h> +#include <ietf/ietf_attr_remediation_instr.h> +#include <ietf/ietf_attr_string_version.h> +#include <ita/ita_attr.h> +#include <ita/ita_attr_get_settings.h> +#include <ita/ita_attr_settings.h> +#include <ita/ita_attr_angel.h> +#include <ita/ita_attr_device_id.h> + +#include <tncif_names.h> +#include <tncif_pa_subtypes.h> + +#include <pen/pen.h> +#include <utils/debug.h> + +typedef struct private_imv_os_agent_t private_imv_os_agent_t; +typedef enum imv_os_attr_t imv_os_attr_t; + +/* Subscribed PA-TNC message subtypes */ +static pen_type_t msg_types[] = { + { PEN_IETF, PA_SUBTYPE_IETF_OPERATING_SYSTEM } +}; + +static char unknown_source_str[] = "install_non_market_apps"; + +/** + * Flag set when corresponding attribute has been received + */ +enum imv_os_attr_t { + IMV_OS_ATTR_PRODUCT_INFORMATION = (1<<0), + IMV_OS_ATTR_STRING_VERSION = (1<<1), + IMV_OS_ATTR_NUMERIC_VERSION = (1<<2), + IMV_OS_ATTR_OPERATIONAL_STATUS = (1<<3), + IMV_OS_ATTR_FORWARDING_ENABLED = (1<<4), + IMV_OS_ATTR_FACTORY_DEFAULT_PWD_ENABLED = (1<<5), + IMV_OS_ATTR_DEVICE_ID = (1<<6), + IMV_OS_ATTR_MUST = (1<<7)-1, + IMV_OS_ATTR_INSTALLED_PACKAGES = (1<<7), + IMV_OS_ATTR_SETTINGS = (1<<8) +}; + +/** + * Private data of an imv_os_agent_t object. + */ +struct private_imv_os_agent_t { + + /** + * Public members of imv_os_agent_t + */ + imv_agent_if_t public; + + /** + * IMV agent responsible for generic functions + */ + imv_agent_t *agent; + + /** + * IMV OS database + */ + imv_os_database_t *db; + +}; + +METHOD(imv_agent_if_t, bind_functions, TNC_Result, + private_imv_os_agent_t *this, TNC_TNCS_BindFunctionPointer bind_function) +{ + return this->agent->bind_functions(this->agent, bind_function); +} + +METHOD(imv_agent_if_t, notify_connection_change, TNC_Result, + private_imv_os_agent_t *this, TNC_ConnectionID id, + TNC_ConnectionState new_state) +{ + TNC_IMV_Action_Recommendation rec; + imv_state_t *state; + imv_session_t *session; + + switch (new_state) + { + case TNC_CONNECTION_STATE_CREATE: + state = imv_os_state_create(id); + return this->agent->create_state(this->agent, state); + case TNC_CONNECTION_STATE_DELETE: + return this->agent->delete_state(this->agent, id); + case TNC_CONNECTION_STATE_ACCESS_ALLOWED: + case TNC_CONNECTION_STATE_ACCESS_ISOLATED: + case TNC_CONNECTION_STATE_ACCESS_NONE: + if (imcv_db && this->agent->get_state(this->agent, id, &state)) + { + switch (new_state) + { + case TNC_CONNECTION_STATE_ACCESS_ALLOWED: + rec = TNC_IMV_ACTION_RECOMMENDATION_ALLOW; + break; + case TNC_CONNECTION_STATE_ACCESS_ISOLATED: + rec = TNC_IMV_ACTION_RECOMMENDATION_ISOLATE; + break; + case TNC_CONNECTION_STATE_ACCESS_NONE: + default: + rec = TNC_IMV_ACTION_RECOMMENDATION_NO_ACCESS; + } + session = state->get_session(state); + imcv_db->add_recommendation(imcv_db, session, rec); + imcv_db->policy_script(imcv_db, session, FALSE); + } + /* fall through to default state */ + default: + return this->agent->change_state(this->agent, id, new_state, NULL); + } +} + +/** + * Process a received message + */ +static TNC_Result receive_msg(private_imv_os_agent_t *this, imv_state_t *state, + imv_msg_t *in_msg) +{ + imv_msg_t *out_msg; + imv_os_state_t *os_state; + enumerator_t *enumerator; + pa_tnc_attr_t *attr; + pen_type_t type; + TNC_Result result; + chunk_t os_name = chunk_empty; + chunk_t os_version = chunk_empty; + bool fatal_error = FALSE, assessment = FALSE; + + os_state = (imv_os_state_t*)state; + + /* parse received PA-TNC message and handle local and remote errors */ + result = in_msg->receive(in_msg, &fatal_error); + if (result != TNC_RESULT_SUCCESS) + { + return result; + } + + out_msg = imv_msg_create_as_reply(in_msg); + + /* analyze PA-TNC attributes */ + enumerator = in_msg->create_attribute_enumerator(in_msg); + while (enumerator->enumerate(enumerator, &attr)) + { + type = attr->get_type(attr); + + if (type.vendor_id == PEN_IETF) + { + switch (type.type) + { + case IETF_ATTR_PRODUCT_INFORMATION: + { + ietf_attr_product_info_t *attr_cast; + pen_t vendor_id; + + state->set_action_flags(state, + IMV_OS_ATTR_PRODUCT_INFORMATION); + attr_cast = (ietf_attr_product_info_t*)attr; + os_name = attr_cast->get_info(attr_cast, &vendor_id, NULL); + if (vendor_id != PEN_IETF) + { + DBG1(DBG_IMV, "operating system name is '%.*s' " + "from vendor %N", os_name.len, os_name.ptr, + pen_names, vendor_id); + } + else + { + DBG1(DBG_IMV, "operating system name is '%.*s'", + os_name.len, os_name.ptr); + } + break; + } + case IETF_ATTR_STRING_VERSION: + { + ietf_attr_string_version_t *attr_cast; + + state->set_action_flags(state, + IMV_OS_ATTR_STRING_VERSION); + attr_cast = (ietf_attr_string_version_t*)attr; + os_version = attr_cast->get_version(attr_cast, NULL, NULL); + if (os_version.len) + { + DBG1(DBG_IMV, "operating system version is '%.*s'", + os_version.len, os_version.ptr); + } + break; + } + case IETF_ATTR_NUMERIC_VERSION: + { + ietf_attr_numeric_version_t *attr_cast; + u_int32_t major, minor; + + state->set_action_flags(state, + IMV_OS_ATTR_NUMERIC_VERSION); + attr_cast = (ietf_attr_numeric_version_t*)attr; + attr_cast->get_version(attr_cast, &major, &minor); + DBG1(DBG_IMV, "operating system numeric version is %d.%d", + major, minor); + break; + } + case IETF_ATTR_OPERATIONAL_STATUS: + { + ietf_attr_op_status_t *attr_cast; + op_status_t op_status; + op_result_t op_result; + time_t last_boot; + + state->set_action_flags(state, + IMV_OS_ATTR_OPERATIONAL_STATUS); + attr_cast = (ietf_attr_op_status_t*)attr; + op_status = attr_cast->get_status(attr_cast); + op_result = attr_cast->get_result(attr_cast); + last_boot = attr_cast->get_last_use(attr_cast); + DBG1(DBG_IMV, "operational status: %N, result: %N", + op_status_names, op_status, op_result_names, op_result); + DBG1(DBG_IMV, "last boot: %T", &last_boot, TRUE); + break; + } + case IETF_ATTR_FORWARDING_ENABLED: + { + ietf_attr_fwd_enabled_t *attr_cast; + os_fwd_status_t fwd_status; + + state->set_action_flags(state, + IMV_OS_ATTR_FORWARDING_ENABLED); + attr_cast = (ietf_attr_fwd_enabled_t*)attr; + fwd_status = attr_cast->get_status(attr_cast); + DBG1(DBG_IMV, "IPv4 forwarding is %N", + os_fwd_status_names, fwd_status); + if (fwd_status == OS_FWD_ENABLED) + { + os_state->set_os_settings(os_state, + OS_SETTINGS_FWD_ENABLED); + } + break; + } + case IETF_ATTR_FACTORY_DEFAULT_PWD_ENABLED: + { + ietf_attr_default_pwd_enabled_t *attr_cast; + bool default_pwd_status; + + state->set_action_flags(state, + IMV_OS_ATTR_FACTORY_DEFAULT_PWD_ENABLED); + attr_cast = (ietf_attr_default_pwd_enabled_t*)attr; + default_pwd_status = attr_cast->get_status(attr_cast); + DBG1(DBG_IMV, "factory default password is %sabled", + default_pwd_status ? "en":"dis"); + if (default_pwd_status) + { + os_state->set_os_settings(os_state, + OS_SETTINGS_DEFAULT_PWD_ENABLED); + } + break; + } + case IETF_ATTR_INSTALLED_PACKAGES: + { + ietf_attr_installed_packages_t *attr_cast; + enumerator_t *e; + status_t status; + + state->set_action_flags(state, + IMV_OS_ATTR_INSTALLED_PACKAGES); + if (!this->db) + { + break; + } + attr_cast = (ietf_attr_installed_packages_t*)attr; + + e = attr_cast->create_enumerator(attr_cast); + status = this->db->check_packages(this->db, os_state, e); + e->destroy(e); + + if (status == FAILED) + { + state->set_recommendation(state, + TNC_IMV_ACTION_RECOMMENDATION_NO_RECOMMENDATION, + TNC_IMV_EVALUATION_RESULT_ERROR); + assessment = TRUE; + } + break; + } + default: + break; + } + } + else if (type.vendor_id == PEN_ITA) + { + switch (type.type) + { + case ITA_ATTR_SETTINGS: + { + ita_attr_settings_t *attr_cast; + enumerator_t *e; + char *name; + chunk_t value; + + state->set_action_flags(state, IMV_OS_ATTR_SETTINGS); + + attr_cast = (ita_attr_settings_t*)attr; + e = attr_cast->create_enumerator(attr_cast); + while (e->enumerate(e, &name, &value)) + { + if (streq(name, unknown_source_str) && + chunk_equals(value, chunk_from_chars('1'))) + { + os_state->set_os_settings(os_state, + OS_SETTINGS_UNKNOWN_SOURCE); + } + DBG1(DBG_IMV, "setting '%s'\n %.*s", + name, value.len, value.ptr); + } + e->destroy(e); + break; + } + case ITA_ATTR_DEVICE_ID: + { + chunk_t value; + + state->set_action_flags(state, IMV_OS_ATTR_DEVICE_ID); + + value = attr->get_value(attr); + os_state->set_device_id(os_state, value); + DBG1(DBG_IMV, "device ID is %.*s", value.len, value.ptr); + break; + } + case ITA_ATTR_START_ANGEL: + os_state->set_angel_count(os_state, TRUE); + break; + case ITA_ATTR_STOP_ANGEL: + os_state->set_angel_count(os_state, FALSE); + break; + default: + break; + } + } + } + enumerator->destroy(enumerator); + + /** + * The IETF Product Information and String Version attributes + * are supposed to arrive in the same PA-TNC message + */ + if (os_name.len && os_version.len) + { + os_type_t os_type; + + /* set the OS type, name and version */ + os_type = os_type_from_name(os_name); + os_state->set_info(os_state,os_type, os_name, os_version); + + if (imcv_db) + { + imcv_db->add_product(imcv_db, state->get_session(state), + os_state->get_info(os_state, NULL, NULL, NULL)); + } + } + + if (fatal_error) + { + state->set_recommendation(state, + TNC_IMV_ACTION_RECOMMENDATION_NO_RECOMMENDATION, + TNC_IMV_EVALUATION_RESULT_ERROR); + assessment = TRUE; + } + + if (assessment) + { + os_state->set_handshake_state(os_state, IMV_OS_STATE_END); + result = out_msg->send_assessment(out_msg); + out_msg->destroy(out_msg); + if (result != TNC_RESULT_SUCCESS) + { + return result; + } + return this->agent->provide_recommendation(this->agent, state); + } + + /* send PA-TNC message with excl flag set */ + result = out_msg->send(out_msg, TRUE); + out_msg->destroy(out_msg); + + return result; + } + +METHOD(imv_agent_if_t, receive_message, TNC_Result, + private_imv_os_agent_t *this, TNC_ConnectionID id, + TNC_MessageType msg_type, chunk_t msg) +{ + imv_state_t *state; + imv_msg_t *in_msg; + TNC_Result result; + + if (!this->agent->get_state(this->agent, id, &state)) + { + return TNC_RESULT_FATAL; + } + in_msg = imv_msg_create_from_data(this->agent, state, id, msg_type, msg); + result = receive_msg(this, state, in_msg); + in_msg->destroy(in_msg); + + return result; +} + +METHOD(imv_agent_if_t, receive_message_long, TNC_Result, + private_imv_os_agent_t *this, TNC_ConnectionID id, + TNC_UInt32 src_imc_id, TNC_UInt32 dst_imv_id, + TNC_VendorID msg_vid, TNC_MessageSubtype msg_subtype, chunk_t msg) +{ + imv_state_t *state; + imv_msg_t *in_msg; + TNC_Result result; + + if (!this->agent->get_state(this->agent, id, &state)) + { + return TNC_RESULT_FATAL; + } + in_msg = imv_msg_create_from_long_data(this->agent, state, id, + src_imc_id, dst_imv_id, msg_vid, msg_subtype, msg); + result = receive_msg(this, state, in_msg); + in_msg->destroy(in_msg); + + return result; + +} + +/** + * Build an IETF Attribute Request attribute for missing attributes + */ +static pa_tnc_attr_t* build_attr_request(u_int32_t received) +{ + pa_tnc_attr_t *attr; + ietf_attr_attr_request_t *attr_cast; + + attr = ietf_attr_attr_request_create(PEN_RESERVED, 0); + attr_cast = (ietf_attr_attr_request_t*)attr; + + if (!(received & IMV_OS_ATTR_PRODUCT_INFORMATION) || + !(received & IMV_OS_ATTR_STRING_VERSION)) + { + attr_cast->add(attr_cast, PEN_IETF, IETF_ATTR_PRODUCT_INFORMATION); + attr_cast->add(attr_cast, PEN_IETF, IETF_ATTR_STRING_VERSION); + } + if (!(received & IMV_OS_ATTR_NUMERIC_VERSION)) + { + attr_cast->add(attr_cast, PEN_IETF, IETF_ATTR_NUMERIC_VERSION); + } + if (!(received & IMV_OS_ATTR_OPERATIONAL_STATUS)) + { + attr_cast->add(attr_cast, PEN_IETF, IETF_ATTR_OPERATIONAL_STATUS); + } + if (!(received & IMV_OS_ATTR_FORWARDING_ENABLED)) + { + attr_cast->add(attr_cast, PEN_IETF, IETF_ATTR_FORWARDING_ENABLED); + } + if (!(received & IMV_OS_ATTR_FACTORY_DEFAULT_PWD_ENABLED)) + { + attr_cast->add(attr_cast, PEN_IETF, + IETF_ATTR_FACTORY_DEFAULT_PWD_ENABLED); + } + if (!(received & IMV_OS_ATTR_DEVICE_ID)) + { + attr_cast->add(attr_cast, PEN_ITA, ITA_ATTR_DEVICE_ID); + } + + return attr; +} + +METHOD(imv_agent_if_t, batch_ending, TNC_Result, + private_imv_os_agent_t *this, TNC_ConnectionID id) +{ + imv_msg_t *out_msg; + imv_state_t *state; + imv_session_t *session; + imv_workitem_t *workitem; + imv_os_state_t *os_state; + imv_os_handshake_state_t handshake_state; + pa_tnc_attr_t *attr; + TNC_IMVID imv_id; + TNC_Result result = TNC_RESULT_SUCCESS; + bool no_workitems = TRUE; + enumerator_t *enumerator; + u_int32_t received; + + if (!this->agent->get_state(this->agent, id, &state)) + { + return TNC_RESULT_FATAL; + } + os_state = (imv_os_state_t*)state; + handshake_state = os_state->get_handshake_state(os_state); + received = state->get_action_flags(state); + session = state->get_session(state); + imv_id = this->agent->get_id(this->agent); + + if (handshake_state == IMV_OS_STATE_END) + { + return TNC_RESULT_SUCCESS; + } + + /* create an empty out message - we might need it */ + out_msg = imv_msg_create(this->agent, state, id, imv_id, TNC_IMCID_ANY, + msg_types[0]); + + if (handshake_state == IMV_OS_STATE_INIT) + { + if ((received & IMV_OS_ATTR_MUST) != IMV_OS_ATTR_MUST) + { + /* create attribute request for missing mandatory attributes */ + out_msg->add_attribute(out_msg, build_attr_request(received)); + } + } + + if (handshake_state < IMV_OS_STATE_POLICY_START) + { + if (((received & IMV_OS_ATTR_PRODUCT_INFORMATION) && + (received & IMV_OS_ATTR_STRING_VERSION)) && + ((received & IMV_OS_ATTR_DEVICE_ID) || + (handshake_state == IMV_OS_STATE_ATTR_REQ))) + { + if (imcv_db) + { + imcv_db->add_device(imcv_db, session, + os_state->get_device_id(os_state)); + + /* trigger the policy manager */ + imcv_db->policy_script(imcv_db, session, TRUE); + } + else + { + DBG2(DBG_IMV, "no workitems available - no evaluation possible"); + state->set_recommendation(state, + TNC_IMV_ACTION_RECOMMENDATION_ALLOW, + TNC_IMV_EVALUATION_RESULT_DONT_KNOW); + } + handshake_state = IMV_OS_STATE_POLICY_START; + } + else if (handshake_state == IMV_OS_STATE_ATTR_REQ) + { + /** + * both the IETF Product Information and IETF String Version + * attribute should have been present + */ + state->set_recommendation(state, + TNC_IMV_ACTION_RECOMMENDATION_NO_RECOMMENDATION, + TNC_IMV_EVALUATION_RESULT_ERROR); + + /* send assessment */ + result = out_msg->send_assessment(out_msg); + out_msg->destroy(out_msg); + + if (result != TNC_RESULT_SUCCESS) + { + return result; + } + return this->agent->provide_recommendation(this->agent, state); + } + else + { + handshake_state = IMV_OS_STATE_ATTR_REQ; + } + os_state->set_handshake_state(os_state, handshake_state); + } + + if (handshake_state == IMV_OS_STATE_POLICY_START && session) + { + enumerator = session->create_workitem_enumerator(session); + if (enumerator) + { + while (enumerator->enumerate(enumerator, &workitem)) + { + if (workitem->get_imv_id(workitem) != TNC_IMVID_ANY) + { + continue; + } + + switch (workitem->get_type(workitem)) + { + case IMV_WORKITEM_PACKAGES: + attr = ietf_attr_attr_request_create(PEN_IETF, + IETF_ATTR_INSTALLED_PACKAGES); + out_msg->add_attribute(out_msg, attr); + break; + case IMV_WORKITEM_UNKNOWN_SOURCE: + attr = ita_attr_get_settings_create(unknown_source_str); + out_msg->add_attribute(out_msg, attr); + break; + case IMV_WORKITEM_FORWARDING: + case IMV_WORKITEM_DEFAULT_PWD: + break; + default: + continue; + } + workitem->set_imv_id(workitem, imv_id); + no_workitems = FALSE; + } + enumerator->destroy(enumerator); + + if (no_workitems) + { + DBG2(DBG_IMV, "IMV %d has no workitems - " + "no evaluation requested", imv_id); + state->set_recommendation(state, + TNC_IMV_ACTION_RECOMMENDATION_ALLOW, + TNC_IMV_EVALUATION_RESULT_DONT_KNOW); + } + handshake_state = IMV_OS_STATE_WORKITEMS; + os_state->set_handshake_state(os_state, handshake_state); + } + } + + if (handshake_state == IMV_OS_STATE_WORKITEMS && session) + { + TNC_IMV_Evaluation_Result eval; + TNC_IMV_Action_Recommendation rec; + char result_str[BUF_LEN]; + bool fail; + + enumerator = session->create_workitem_enumerator(session); + while (enumerator->enumerate(enumerator, &workitem)) + { + if (workitem->get_imv_id(workitem) != imv_id) + { + continue; + } + eval = TNC_IMV_EVALUATION_RESULT_DONT_KNOW; + + switch (workitem->get_type(workitem)) + { + case IMV_WORKITEM_PACKAGES: + { + int count, count_update, count_blacklist, count_ok; + + if (!(received & IMV_OS_ATTR_INSTALLED_PACKAGES) || + os_state->get_angel_count(os_state)) + { + continue; + } + os_state->get_count(os_state, &count, &count_update, + &count_blacklist, &count_ok); + fail = count_update || count_blacklist; + eval = fail ? TNC_IMV_EVALUATION_RESULT_NONCOMPLIANT_MINOR : + TNC_IMV_EVALUATION_RESULT_COMPLIANT; + snprintf(result_str, BUF_LEN, "processed %d packages: " + "%d not updated, %d blacklisted, %d ok, " + "%d not found", + count, count_update, count_blacklist, count_ok, + count - count_update - count_blacklist - count_ok); + break; + } + case IMV_WORKITEM_UNKNOWN_SOURCE: + if (!(received & IMV_OS_ATTR_SETTINGS)) + { + continue; + } + fail = os_state->get_os_settings(os_state) & + OS_SETTINGS_UNKNOWN_SOURCE; + eval = fail ? TNC_IMV_EVALUATION_RESULT_NONCOMPLIANT_MINOR : + TNC_IMV_EVALUATION_RESULT_COMPLIANT; + snprintf(result_str, BUF_LEN, "unknown sources%s enabled", + fail ? "" : " not"); + break; + case IMV_WORKITEM_FORWARDING: + if (!(received & IMV_OS_ATTR_FORWARDING_ENABLED)) + { + continue; + } + fail = os_state->get_os_settings(os_state) & + OS_SETTINGS_FWD_ENABLED; + eval = fail ? TNC_IMV_EVALUATION_RESULT_NONCOMPLIANT_MAJOR : + TNC_IMV_EVALUATION_RESULT_COMPLIANT; + snprintf(result_str, BUF_LEN, "forwarding%s enabled", + fail ? "" : " not"); + break; + case IMV_WORKITEM_DEFAULT_PWD: + if (!(received & IMV_OS_ATTR_FACTORY_DEFAULT_PWD_ENABLED)) + { + continue; + } + fail = os_state->get_os_settings(os_state) & + OS_SETTINGS_DEFAULT_PWD_ENABLED; + eval = fail ? TNC_IMV_EVALUATION_RESULT_NONCOMPLIANT_MAJOR : + TNC_IMV_EVALUATION_RESULT_COMPLIANT; + snprintf(result_str, BUF_LEN, "factory default password%s enabled", + fail ? "" : " not"); + break; + default: + continue; + } + if (eval != TNC_IMV_EVALUATION_RESULT_DONT_KNOW) + { + session->remove_workitem(session, enumerator); + rec = workitem->set_result(workitem, result_str, eval); + state->update_recommendation(state, rec, eval); + imcv_db->finalize_workitem(imcv_db, workitem); + workitem->destroy(workitem); + } + } + enumerator->destroy(enumerator); + + /* finalized all workitems ? */ + if (session->get_workitem_count(session, imv_id) == 0) + { + os_state->set_handshake_state(os_state, IMV_OS_STATE_END); + + result = out_msg->send_assessment(out_msg); + out_msg->destroy(out_msg); + if (result != TNC_RESULT_SUCCESS) + { + return result; + } + return this->agent->provide_recommendation(this->agent, state); + } + } + + /* send non-empty PA-TNC message with excl flag not set */ + if (out_msg->get_attribute_count(out_msg)) + { + result = out_msg->send(out_msg, FALSE); + } + out_msg->destroy(out_msg); + + return result; +} + +METHOD(imv_agent_if_t, solicit_recommendation, TNC_Result, + private_imv_os_agent_t *this, TNC_ConnectionID id) +{ + imv_state_t *state; + + if (!this->agent->get_state(this->agent, id, &state)) + { + return TNC_RESULT_FATAL; + } + return this->agent->provide_recommendation(this->agent, state); +} + +METHOD(imv_agent_if_t, destroy, void, + private_imv_os_agent_t *this) +{ + DESTROY_IF(this->agent); + DESTROY_IF(this->db); + free(this); +} + +/** + * Described in header. + */ +imv_agent_if_t *imv_os_agent_create(const char *name, TNC_IMVID id, + TNC_Version *actual_version) +{ + private_imv_os_agent_t *this; + + INIT(this, + .public = { + .bind_functions = _bind_functions, + .notify_connection_change = _notify_connection_change, + .receive_message = _receive_message, + .receive_message_long = _receive_message_long, + .batch_ending = _batch_ending, + .solicit_recommendation = _solicit_recommendation, + .destroy = _destroy, + }, + .agent = imv_agent_create(name, msg_types, countof(msg_types), id, + actual_version), + .db = imv_os_database_create(imcv_db), + ); + + if (!this->agent) + { + destroy(this); + return NULL; + } + return &this->public; +} + diff --git a/src/libimcv/plugins/imv_os/imv_os_agent.h b/src/libimcv/plugins/imv_os/imv_os_agent.h new file mode 100644 index 000000000..cec1b1f20 --- /dev/null +++ b/src/libimcv/plugins/imv_os/imv_os_agent.h @@ -0,0 +1,36 @@ +/* + * Copyright (C) 2013 Andreas Steffen + * HSR Hochschule fuer Technik Rapperswil + * + * This program is free software; you can redistribute it and/or modify it + * under the terms of the GNU General Public License as published by the + * Free Software Foundation; either version 2 of the License, or (at your + * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>. + * + * This program is distributed in the hope that it will be useful, but + * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY + * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License + * for more details. + */ + +/** + * @defgroup imv_os_agent_t imv_os_agent + * @{ @ingroup imv_os + */ + +#ifndef IMV_OS_AGENT_H_ +#define IMV_OS_AGENT_H_ + +#include <imv/imv_agent_if.h> + +/** + * Creates an OS IMV agent + * + * @param name Name of the IMV + * @param id ID of the IMV + * @param actual_version TNC IF-IMV version + */ +imv_agent_if_t* imv_os_agent_create(const char* name, TNC_IMVID id, + TNC_Version *actual_version); + +#endif /** IMV_OS_AGENT_H_ @}*/ diff --git a/src/libimcv/plugins/imv_os/imv_os_database.c b/src/libimcv/plugins/imv_os/imv_os_database.c new file mode 100644 index 000000000..d2a08b0fa --- /dev/null +++ b/src/libimcv/plugins/imv_os/imv_os_database.c @@ -0,0 +1,215 @@ +/* + * Copyright (C) 2012 Andreas Steffen + * HSR Hochschule fuer Technik Rapperswil + * + * This program is free software; you can redistribute it and/or modify it + * under the terms of the GNU General Public License as published by the + * Free Software Foundation; either version 2 of the License, or (at your + * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>. + * + * This program is distributed in the hope that it will be useful, but + * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY + * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License + * for more details. + */ + +#include "imv_os_database.h" + +#include <utils/debug.h> + +#include <string.h> + +typedef struct private_imv_os_database_t private_imv_os_database_t; + +/** + * Private data of a imv_os_database_t object. + * + */ +struct private_imv_os_database_t { + + /** + * Public imv_os_database_t interface. + */ + imv_os_database_t public; + + /** + * database instance + */ + database_t *db; + +}; + +METHOD(imv_os_database_t, check_packages, status_t, + private_imv_os_database_t *this, imv_os_state_t *state, + enumerator_t *package_enumerator) +{ + char *product, *package, *release, *cur_release; + chunk_t name, version; + os_type_t os_type; + int pid, gid, security, blacklist; + int count = 0, count_ok = 0, count_no_match = 0, count_blacklist = 0; + enumerator_t *e; + status_t status = SUCCESS; + bool found, match; + + product = state->get_info(state, &os_type, NULL, NULL); + + if (os_type == OS_TYPE_ANDROID) + { + /*no package dependency on Android version */ + product = enum_to_name(os_type_names, os_type); + } + DBG1(DBG_IMV, "processing installed '%s' packages", product); + + /* Get primary key of product */ + e = this->db->query(this->db, + "SELECT id FROM products WHERE name = ?", + DB_TEXT, product, DB_INT); + if (!e) + { + return FAILED; + } + if (!e->enumerate(e, &pid)) + { + e->destroy(e); + return NOT_FOUND; + } + e->destroy(e); + + while (package_enumerator->enumerate(package_enumerator, &name, &version)) + { + /* Convert package name chunk to a string */ + package = strndup(name.ptr, name.len); + count++; + + /* Get primary key of package */ + e = this->db->query(this->db, + "SELECT id FROM packages WHERE name = ?", + DB_TEXT, package, DB_INT); + if (!e) + { + free(package); + return FAILED; + } + if (!e->enumerate(e, &gid)) + { + /* package not present in database for any product - skip */ + if (os_type == OS_TYPE_ANDROID) + { + DBG2(DBG_IMV, "package '%s' (%.*s) not found", + package, version.len, version.ptr); + } + free(package); + e->destroy(e); + continue; + } + e->destroy(e); + + /* Convert package version chunk to a string */ + release = strndup(version.ptr, version.len); + + /* Enumerate over all acceptable versions */ + e = this->db->query(this->db, + "SELECT release, security, blacklist FROM versions " + "WHERE product = ? AND package = ?", + DB_INT, pid, DB_INT, gid, DB_TEXT, DB_INT, DB_INT); + if (!e) + { + free(package); + free(release); + return FAILED; + } + found = FALSE; + match = FALSE; + + while (e->enumerate(e, &cur_release, &security, &blacklist)) + { + found = TRUE; + if (streq(release, cur_release) || streq("*", cur_release)) + { + match = TRUE; + break; + } + } + e->destroy(e); + + if (found) + { + if (match) + { + if (blacklist) + { + DBG2(DBG_IMV, "package '%s' (%s) is blacklisted", + package, release); + count_blacklist++; + state->add_bad_package(state, package, + OS_PACKAGE_STATE_BLACKLIST); + } + else + { + DBG2(DBG_IMV, "package '%s' (%s)%s is ok", package, release, + security ? " [s]" : ""); + count_ok++; + } + } + else + { + DBG1(DBG_IMV, "package '%s' (%s) no match", package, release); + count_no_match++; + state->add_bad_package(state, package, + OS_PACKAGE_STATE_SECURITY); + } + } + else + { + /* package not present in database for this product - skip */ + } + free(package); + free(release); + } + state->set_count(state, count, count_no_match, count_blacklist, count_ok); + + return status; +} + +METHOD(imv_os_database_t, set_device_info, void, + private_imv_os_database_t *this, int session_id, int count, + int count_update, int count_blacklist, u_int flags) +{ + this->db->execute(this->db, NULL, + "INSERT INTO device_infos (session, count, count_update, " + "count_blacklist, flags) VALUES (?, ?, ?, ?, ?)", + DB_INT, session_id, DB_INT, count, DB_INT, count_update, + DB_INT, count_blacklist, DB_UINT, flags); +} + +METHOD(imv_os_database_t, destroy, void, + private_imv_os_database_t *this) +{ + free(this); +} + +/** + * See header + */ +imv_os_database_t *imv_os_database_create(imv_database_t *imv_db) +{ + private_imv_os_database_t *this; + + if (!imv_db) + { + return NULL; + } + + INIT(this, + .public = { + .check_packages = _check_packages, + .set_device_info = _set_device_info, + .destroy = _destroy, + }, + .db = imv_db->get_database(imv_db), + ); + + return &this->public; +} + diff --git a/src/libimcv/plugins/imv_os/imv_os_database.h b/src/libimcv/plugins/imv_os/imv_os_database.h new file mode 100644 index 000000000..7b9ef3c33 --- /dev/null +++ b/src/libimcv/plugins/imv_os/imv_os_database.h @@ -0,0 +1,71 @@ +/* + * Copyright (C) 2012 Andreas Steffen + * HSR Hochschule fuer Technik Rapperswil + * + * This program is free software; you can redistribute it and/or modify it + * under the terms of the GNU General Public License as published by the + * Free Software Foundation; either version 2 of the License, or (at your + * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>. + * + * This program is distributed in the hope that it will be useful, but + * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY + * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License + * for more details. + */ + +/** + * @defgroup imv_os_database_t imv_os_database + * @{ @ingroup imv_os + */ + +#ifndef IMV_OS_DATABASE_H_ +#define IMV_OS_DATABASE_H_ + +#include "imv_os_state.h" +#include "imv/imv_database.h" + +#include <library.h> + +typedef struct imv_os_database_t imv_os_database_t; + +/** + * Internal state of an imv_os_database_t instance + */ +struct imv_os_database_t { + + /** + * Check Installed Packages for a given OS + * + * @param state OS IMV state + * @param package_enumerator enumerates over installed packages + */ + status_t (*check_packages)(imv_os_database_t *this, imv_os_state_t *state, + enumerator_t *package_enumerator); + + /** + * Set health infos for a given device + * + * @param sesson_id Session ID + * @param count Number of installed packages + * @param count_update Number of packages to be updated + * @param count_blacklist Number of blacklisted packages + * @param flags Various flags, e.g. illegal OS settings + */ + void (*set_device_info)(imv_os_database_t *this, int session_id, int count, + int count_update, int count_blacklist, u_int flags); + + /** + * Destroys an imv_os_database_t object. + */ + void (*destroy)(imv_os_database_t *this); + +}; + +/** + * Create an imv_os_database_t instance + * + * @param imv_db Already attached IMV database + */ +imv_os_database_t* imv_os_database_create(imv_database_t *imv_db); + +#endif /** IMV_OS_DATABASE_H_ @}*/ diff --git a/src/libimcv/plugins/imv_os/imv_os_state.c b/src/libimcv/plugins/imv_os/imv_os_state.c new file mode 100644 index 000000000..f6d904c3c --- /dev/null +++ b/src/libimcv/plugins/imv_os/imv_os_state.c @@ -0,0 +1,703 @@ +/* + * Copyright (C) 2012-2013 Andreas Steffen + * HSR Hochschule fuer Technik Rapperswil + * + * This program is free software; you can redistribute it and/or modify it + * under the terms of the GNU General Public License as published by the + * Free Software Foundation; either version 2 of the License, or (at your + * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>. + * + * This program is distributed in the hope that it will be useful, but + * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY + * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License + * for more details. + */ + +#include "imv_os_state.h" + +#include "imv/imv_lang_string.h" +#include "imv/imv_reason_string.h" +#include "imv/imv_remediation_string.h" + +#include <tncif_policy.h> + +#include <utils/debug.h> +#include <collections/linked_list.h> + +typedef struct private_imv_os_state_t private_imv_os_state_t; +typedef struct package_entry_t package_entry_t; +typedef struct entry_t entry_t; +typedef struct instruction_entry_t instruction_entry_t; + +/** + * Private data of an imv_os_state_t object. + */ +struct private_imv_os_state_t { + + /** + * Public members of imv_os_state_t + */ + imv_os_state_t public; + + /** + * TNCCS connection ID + */ + TNC_ConnectionID connection_id; + + /** + * TNCCS connection state + */ + TNC_ConnectionState state; + + /** + * Does the TNCCS connection support long message types? + */ + bool has_long; + + /** + * Does the TNCCS connection support exclusive delivery? + */ + bool has_excl; + + /** + * Maximum PA-TNC message size for this TNCCS connection + */ + u_int32_t max_msg_len; + + /** + * Flags set for completed actions + */ + u_int32_t action_flags; + + /** + * Access Requestor ID Type + */ + u_int32_t ar_id_type; + + /** + * Access Requestor ID Value + */ + chunk_t ar_id_value; + + /** + * IMV database session associated with TNCCS connection + */ + imv_session_t *session; + + /** + * IMV action recommendation + */ + TNC_IMV_Action_Recommendation rec; + + /** + * IMV evaluation result + */ + TNC_IMV_Evaluation_Result eval; + + /** + * IMV OS handshake state + */ + imv_os_handshake_state_t handshake_state; + + /** + * OS Product Information (concatenation of OS Name and Version) + */ + char *info; + + /** + * OS Type + */ + os_type_t type; + + /** + * OS Name + */ + chunk_t name; + + /** + * OS Version + */ + chunk_t version; + + /** + * List of blacklisted packages to be removed + */ + linked_list_t *remove_packages; + + /** + * List of vulnerable packages to be updated + */ + linked_list_t *update_packages; + + /** + * TNC Reason String + */ + imv_reason_string_t *reason_string; + + /** + * IETF Remediation Instructions String + */ + imv_remediation_string_t *remediation_string; + + /** + * Dgevice ID + */ + chunk_t device_id; + + /** + * Number of processed packages + */ + int count; + + /** + * Number of not updated packages + */ + int count_update; + + /** + * Number of blacklisted packages + */ + int count_blacklist; + + /** + * Number of whitelisted packages + */ + int count_ok; + + /** + * OS Settings + */ + u_int os_settings; + + /** + * Angel count + */ + int angel_count; + +}; + +/** + * Supported languages + */ +static char* languages[] = { "en", "de", "pl" }; + +/** + * Reason strings for "OS settings" + */ +static imv_lang_string_t reason_settings[] = { + { "en", "Improper OS settings were detected" }, + { "de", "Unzulässige OS Einstellungen wurden festgestellt" }, + { "pl", "Stwierdzono niewłaściwe ustawienia OS" }, + { NULL, NULL } +}; + +/** + * Reason strings for "installed software packages" + */ +static imv_lang_string_t reason_packages[] = { + { "en", "Vulnerable or blacklisted software packages were found" }, + { "de", "Schwachstellenbehaftete oder gesperrte Softwarepakete wurden gefunden" }, + { "pl", "Znaleziono pakiety podatne na atak lub będące na czarnej liście" }, + { NULL, NULL } +}; + +/** + * Instruction strings for "Software Security Updates" + */ +static imv_lang_string_t instr_update_packages_title[] = { + { "en", "Software Security Updates" }, + { "de", "Software Sicherheitsupdates" }, + { "pl", "Aktualizacja softwaru zabezpieczającego" }, + { NULL, NULL } +}; + +static imv_lang_string_t instr_update_packages_descr[] = { + { "en", "Packages with security vulnerabilities were found" }, + { "de", "Softwarepakete mit Sicherheitsschwachstellen wurden gefunden" }, + { "pl", "Znaleziono pakiety podatne na atak" }, + { NULL, NULL } +}; + +static imv_lang_string_t instr_update_packages_header[] = { + { "en", "Please update the following software packages:" }, + { "de", "Bitte updaten Sie die folgenden Softwarepakete:" }, + { "pl", "Proszę zaktualizować następujące pakiety:" }, + { NULL, NULL } +}; + +/** + * Instruction strings for "Blacklisted Software Packages" + */ +static imv_lang_string_t instr_remove_packages_title[] = { + { "en", "Blacklisted Software Packages" }, + { "de", "Gesperrte Softwarepakete" }, + { "pl", "Pakiety będące na czarnej liście" }, + { NULL, NULL } +}; + +static imv_lang_string_t instr_remove_packages_descr[] = { + { "en", "Dangerous software packages were found" }, + { "de", "Gefährliche Softwarepakete wurden gefunden" }, + { "pl", "Znaleziono niebezpieczne pakiety" }, + { NULL, NULL } +}; + +static imv_lang_string_t instr_remove_packages_header[] = { + { "en", "Please remove the following software packages:" }, + { "de", "Bitte entfernen Sie die folgenden Softwarepakete:" }, + { "pl", "Proszę usunąć następujące pakiety:" }, + { NULL, NULL } +}; + +;/** + * Instruction strings for "Forwarding Enabled" + */ +static imv_lang_string_t instr_fwd_enabled_title[] = { + { "en", "IP Packet Forwarding" }, + { "de", "Weiterleitung von IP Paketen" }, + { "pl", "Przekazywanie pakietów IP" }, + { NULL, NULL } +}; + +static imv_lang_string_t instr_fwd_enabled_descr[] = { + { "en", "Please disable the forwarding of IP packets" }, + { "de", "Bitte deaktivieren Sie das Forwarding von IP Paketen" }, + { "pl", "Proszę zdezaktywować przekazywanie pakietów IP" }, + { NULL, NULL } +}; + +/** + * Instruction strings for "Default Password Enabled" + */ +static imv_lang_string_t instr_default_pwd_enabled_title[] = { + { "en", "Default Password" }, + { "de", "Default Passwort" }, + { "pl", "Hasło domyślne" }, + { NULL, NULL } +}; + +static imv_lang_string_t instr_default_pwd_enabled_descr[] = { + { "en", "Please change the default password" }, + { "de", "Bitte ändern Sie das Default Passwort" }, + { "pl", "Proszę zmienić domyślne hasło" }, + { NULL, NULL } +}; + +/** + * Instruction strings for "Unknown Source" + */ +static imv_lang_string_t instr_unknown_source_title[] = { + { "en", "Unknown Software Origin" }, + { "de", "Unbekannte Softwareherkunft" }, + { "pl", "Nieznane pochodzenie softwaru" }, + { NULL, NULL } +}; + +static imv_lang_string_t instr_unknown_source_descr[] = { + { "en", "Do not allow the installation of apps from unknown sources" }, + { "de", "Erlauben Sie nicht die Installation von Apps aus unbekannten Quellen" }, + { "pl", "Proszę nie dopuszczać do instalacji Apps z nieznanych źródeł" }, + { NULL, NULL } +}; + +METHOD(imv_state_t, get_connection_id, TNC_ConnectionID, + private_imv_os_state_t *this) +{ + return this->connection_id; +} + +METHOD(imv_state_t, has_long, bool, + private_imv_os_state_t *this) +{ + return this->has_long; +} + +METHOD(imv_state_t, has_excl, bool, + private_imv_os_state_t *this) +{ + return this->has_excl; +} + +METHOD(imv_state_t, set_flags, void, + private_imv_os_state_t *this, bool has_long, bool has_excl) +{ + this->has_long = has_long; + this->has_excl = has_excl; +} + +METHOD(imv_state_t, set_max_msg_len, void, + private_imv_os_state_t *this, u_int32_t max_msg_len) +{ + this->max_msg_len = max_msg_len; +} + +METHOD(imv_state_t, get_max_msg_len, u_int32_t, + private_imv_os_state_t *this) +{ + return this->max_msg_len; +} + +METHOD(imv_state_t, set_action_flags, void, + private_imv_os_state_t *this, u_int32_t flags) +{ + this->action_flags |= flags; +} + +METHOD(imv_state_t, get_action_flags, u_int32_t, + private_imv_os_state_t *this) +{ + return this->action_flags; +} + +METHOD(imv_state_t, set_ar_id, void, + private_imv_os_state_t *this, u_int32_t id_type, chunk_t id_value) +{ + this->ar_id_type = id_type; + this->ar_id_value = chunk_clone(id_value); +} + +METHOD(imv_state_t, get_ar_id, chunk_t, + private_imv_os_state_t *this, u_int32_t *id_type) +{ + if (id_type) + { + *id_type = this->ar_id_type; + } + return this->ar_id_value; +} + +METHOD(imv_state_t, set_session, void, + private_imv_os_state_t *this, imv_session_t *session) +{ + this->session = session; +} + +METHOD(imv_state_t, get_session, imv_session_t*, + private_imv_os_state_t *this) +{ + return this->session; +} + +METHOD(imv_state_t, get_recommendation, void, + private_imv_os_state_t *this, TNC_IMV_Action_Recommendation *rec, + TNC_IMV_Evaluation_Result *eval) +{ + *rec = this->rec; + *eval = this->eval; +} + +METHOD(imv_state_t, set_recommendation, void, + private_imv_os_state_t *this, TNC_IMV_Action_Recommendation rec, + TNC_IMV_Evaluation_Result eval) +{ + this->rec = rec; + this->eval = eval; +} + +METHOD(imv_state_t, update_recommendation, void, + private_imv_os_state_t *this, TNC_IMV_Action_Recommendation rec, + TNC_IMV_Evaluation_Result eval) +{ + this->rec = tncif_policy_update_recommendation(this->rec, rec); + this->eval = tncif_policy_update_evaluation(this->eval, eval); +} + +METHOD(imv_state_t, change_state, void, + private_imv_os_state_t *this, TNC_ConnectionState new_state) +{ + this->state = new_state; +} + +METHOD(imv_state_t, get_reason_string, bool, + private_imv_os_state_t *this, enumerator_t *language_enumerator, + chunk_t *reason_string, char **reason_language) +{ + if (!this->count_update && !this->count_blacklist & !this->os_settings) + { + return FALSE; + } + *reason_language = imv_lang_string_select_lang(language_enumerator, + languages, countof(languages)); + + /* Instantiate a TNC Reason String object */ + DESTROY_IF(this->reason_string); + this->reason_string = imv_reason_string_create(*reason_language); + + if (this->count_update || this->count_blacklist) + { + this->reason_string->add_reason(this->reason_string, reason_packages); + } + if (this->os_settings) + { + this->reason_string->add_reason(this->reason_string, reason_settings); + } + *reason_string = this->reason_string->get_encoding(this->reason_string); + + return TRUE; +} + +METHOD(imv_state_t, get_remediation_instructions, bool, + private_imv_os_state_t *this, enumerator_t *language_enumerator, + chunk_t *string, char **lang_code, char **uri) +{ + if (!this->count_update && !this->count_blacklist & !this->os_settings) + { + return FALSE; + } + *lang_code = imv_lang_string_select_lang(language_enumerator, + languages, countof(languages)); + + /* Instantiate an IETF Remediation Instructions String object */ + DESTROY_IF(this->remediation_string); + this->remediation_string = imv_remediation_string_create( + this->type == OS_TYPE_ANDROID, *lang_code); + + /* List of blacklisted packages to be removed, if any */ + if (this->count_blacklist) + { + this->remediation_string->add_instruction(this->remediation_string, + instr_remove_packages_title, + instr_remove_packages_descr, + instr_remove_packages_header, + this->remove_packages); + } + + /* List of packages in need of an update, if any */ + if (this->count_update) + { + this->remediation_string->add_instruction(this->remediation_string, + instr_update_packages_title, + instr_update_packages_descr, + instr_update_packages_header, + this->update_packages); + } + + /* Add instructions concerning improper OS settings */ + if (this->os_settings & OS_SETTINGS_FWD_ENABLED) + { + this->remediation_string->add_instruction(this->remediation_string, + instr_fwd_enabled_title, + instr_fwd_enabled_descr, NULL, NULL); + } + if (this->os_settings & OS_SETTINGS_DEFAULT_PWD_ENABLED) + { + this->remediation_string->add_instruction(this->remediation_string, + instr_default_pwd_enabled_title, + instr_default_pwd_enabled_descr, NULL, NULL); + } + if (this->os_settings & OS_SETTINGS_UNKNOWN_SOURCE) + { + this->remediation_string->add_instruction(this->remediation_string, + instr_unknown_source_title, + instr_unknown_source_descr, NULL, NULL); + } + + *string = this->remediation_string->get_encoding(this->remediation_string); + *uri = lib->settings->get_str(lib->settings, + "libimcv.plugins.imv-os.remediation_uri", NULL); + + return TRUE; +} + +METHOD(imv_state_t, destroy, void, + private_imv_os_state_t *this) +{ + DESTROY_IF(this->session); + DESTROY_IF(this->reason_string); + DESTROY_IF(this->remediation_string); + this->update_packages->destroy_function(this->update_packages, free); + this->remove_packages->destroy_function(this->remove_packages, free); + free(this->info); + free(this->name.ptr); + free(this->version.ptr); + free(this->ar_id_value.ptr); + free(this->device_id.ptr); + free(this); +} + +METHOD(imv_os_state_t, set_handshake_state, void, + private_imv_os_state_t *this, imv_os_handshake_state_t new_state) +{ + this->handshake_state = new_state; +} + +METHOD(imv_os_state_t, get_handshake_state, imv_os_handshake_state_t, + private_imv_os_state_t *this) +{ + return this->handshake_state; +} + +METHOD(imv_os_state_t, set_info, void, + private_imv_os_state_t *this, os_type_t type, chunk_t name, chunk_t version) +{ + int len = name.len + 1 + version.len + 1; + + /* OS info is a concatenation of OS name and OS version */ + free(this->info); + this->info = malloc(len); + snprintf(this->info, len, "%.*s %.*s", (int)name.len, name.ptr, + (int)version.len, version.ptr); + this->type = type; + this->name = chunk_clone(name); + this->version = chunk_clone(version); +} + +METHOD(imv_os_state_t, get_info, char*, + private_imv_os_state_t *this, os_type_t *type, chunk_t *name, + chunk_t *version) +{ + if (type) + { + *type = this->type; + } + if (name) + { + *name = this->name; + } + if (version) + { + *version = this->version; + } + return this->info; +} + +METHOD(imv_os_state_t, set_count, void, + private_imv_os_state_t *this, int count, int count_update, + int count_blacklist, int count_ok) +{ + this->count += count; + this->count_update += count_update; + this->count_blacklist += count_blacklist; + this->count_ok += count_ok; +} + +METHOD(imv_os_state_t, get_count, void, + private_imv_os_state_t *this, int *count, int *count_update, + int *count_blacklist, int *count_ok) +{ + if (count) + { + *count = this->count; + } + if (count_update) + { + *count_update = this->count_update; + } + if (count_blacklist) + { + *count_blacklist = this->count_blacklist; + } + if (count_ok) + { + *count_ok = this->count_ok; + } +} + +METHOD(imv_os_state_t, set_device_id, void, + private_imv_os_state_t *this, chunk_t id) +{ + this->device_id = chunk_clone(id); +} + +METHOD(imv_os_state_t, get_device_id, chunk_t, + private_imv_os_state_t *this) +{ + return this->device_id; +} + +METHOD(imv_os_state_t, set_os_settings, void, + private_imv_os_state_t *this, u_int settings) +{ + this->os_settings |= settings; +} + +METHOD(imv_os_state_t, get_os_settings, u_int, + private_imv_os_state_t *this) +{ + return this->os_settings; +} + +METHOD(imv_os_state_t, set_angel_count, void, + private_imv_os_state_t *this, bool start) +{ + this->angel_count += start ? 1 : -1; +} + +METHOD(imv_os_state_t, get_angel_count, int, + private_imv_os_state_t *this) +{ + return this->angel_count; +} + +METHOD(imv_os_state_t, add_bad_package, void, + private_imv_os_state_t *this, char *package, + os_package_state_t package_state) +{ + package = strdup(package); + + if (package_state == OS_PACKAGE_STATE_BLACKLIST) + { + this->remove_packages->insert_last(this->remove_packages, package); + } + else + { + this->update_packages->insert_last(this->update_packages, package); + } +} + +/** + * Described in header. + */ +imv_state_t *imv_os_state_create(TNC_ConnectionID connection_id) +{ + private_imv_os_state_t *this; + + INIT(this, + .public = { + .interface = { + .get_connection_id = _get_connection_id, + .has_long = _has_long, + .has_excl = _has_excl, + .set_flags = _set_flags, + .set_max_msg_len = _set_max_msg_len, + .get_max_msg_len = _get_max_msg_len, + .set_action_flags = _set_action_flags, + .get_action_flags = _get_action_flags, + .set_ar_id = _set_ar_id, + .get_ar_id = _get_ar_id, + .set_session = _set_session, + .get_session = _get_session, + .change_state = _change_state, + .get_recommendation = _get_recommendation, + .set_recommendation = _set_recommendation, + .update_recommendation = _update_recommendation, + .get_reason_string = _get_reason_string, + .get_remediation_instructions = _get_remediation_instructions, + .destroy = _destroy, + }, + .set_handshake_state = _set_handshake_state, + .get_handshake_state = _get_handshake_state, + .set_info = _set_info, + .get_info = _get_info, + .set_count = _set_count, + .get_count = _get_count, + .set_device_id = _set_device_id, + .get_device_id = _get_device_id, + .set_os_settings = _set_os_settings, + .get_os_settings = _get_os_settings, + .set_angel_count = _set_angel_count, + .get_angel_count = _get_angel_count, + .add_bad_package = _add_bad_package, + }, + .state = TNC_CONNECTION_STATE_CREATE, + .rec = TNC_IMV_ACTION_RECOMMENDATION_NO_RECOMMENDATION, + .eval = TNC_IMV_EVALUATION_RESULT_DONT_KNOW, + .connection_id = connection_id, + .update_packages = linked_list_create(), + .remove_packages = linked_list_create(), + ); + + return &this->public.interface; +} + + diff --git a/src/libimcv/plugins/imv_os/imv_os_state.h b/src/libimcv/plugins/imv_os/imv_os_state.h new file mode 100644 index 000000000..97f695319 --- /dev/null +++ b/src/libimcv/plugins/imv_os/imv_os_state.h @@ -0,0 +1,183 @@ +/* + * Copyright (C) 2012 Andreas Steffen + * HSR Hochschule fuer Technik Rapperswil + * + * This program is free software; you can redistribute it and/or modify it + * under the terms of the GNU General Public License as published by the + * Free Software Foundation; either version 2 of the License, or (at your + * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>. + * + * This program is distributed in the hope that it will be useful, but + * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY + * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License + * for more details. + */ + +/** + * @defgroup imv_os imv_os + * @ingroup libimcv_plugins + * + * @defgroup imv_os_state_t imv_os_state + * @{ @ingroup imv_os + */ + +#ifndef IMV_OS_STATE_H_ +#define IMV_OS_STATE_H_ + +#include "os_info/os_info.h" +#include <imv/imv_state.h> +#include <library.h> + +typedef struct imv_os_state_t imv_os_state_t; +typedef enum imv_os_handshake_state_t imv_os_handshake_state_t; +typedef enum os_settings_t os_settings_t; + +/** + * IMV OS Handshake States (state machine) + */ +enum imv_os_handshake_state_t { + IMV_OS_STATE_INIT, + IMV_OS_STATE_ATTR_REQ, + IMV_OS_STATE_POLICY_START, + IMV_OS_STATE_WORKITEMS, + IMV_OS_STATE_END +}; + +/** + * Flags for detected OS Settings + */ +enum os_settings_t { + OS_SETTINGS_FWD_ENABLED = (1<<0), + OS_SETTINGS_DEFAULT_PWD_ENABLED = (1<<1), + OS_SETTINGS_UNKNOWN_SOURCE = (1<<2) +}; + +/** + * Internal state of an imv_os_t connection instance + */ +struct imv_os_state_t { + + /** + * imv_state_t interface + */ + imv_state_t interface; + + /** + * Set state of the handshake + * + * @param new_state the handshake state of IMV + */ + void (*set_handshake_state)(imv_os_state_t *this, + imv_os_handshake_state_t new_state); + + /** + * Get state of the handshake + * + * @return the handshake state of IMV + */ + imv_os_handshake_state_t (*get_handshake_state)(imv_os_state_t *this); + + /** + * Set OS Product Information + * + * @param type OS type (enumerated) + * @param name OS name (string) + * @param version OS version + */ + void (*set_info)(imv_os_state_t *this, os_type_t os_type, + chunk_t name, chunk_t version); + + /** + * Get OS Product Information + * + * @param type OS type (enumerated) + * @param name OS name (string) + * @param version OS version + * @return OS name & version as a concatenated string + */ + char* (*get_info)(imv_os_state_t *this, os_type_t *os_type, + chunk_t *name, chunk_t *version); + + /** + * Set [or with multiple attributes increment] package counters + * + * @param count Number of processed packages + * @param count_update Number of not updated packages + * @param count_blacklist Number of blacklisted packages + * @param count_ok Number of whitelisted packages + */ + void (*set_count)(imv_os_state_t *this, int count, int count_update, + int count_blacklist, int count_ok); + + /** + * Set [or with multiple attributes increment] package counters + * + * @param count Number of processed packages + * @param count_update Number of not updated packages + * @param count_blacklist Number of blacklisted packages + * @param count_ok Number of whitelisted packages + */ + void (*get_count)(imv_os_state_t *this, int *count, int *count_update, + int *count_blacklist, int *count_ok); + + /** + * Set device ID + * + * @param device_id Device ID + */ + void (*set_device_id)(imv_os_state_t *this, chunk_t id); + + /** + * Get device ID + * + * @return Device ID + */ + chunk_t (*get_device_id)(imv_os_state_t *this); + + /** + * Set OS settings + * + * @param settings OS settings + */ + void (*set_os_settings)(imv_os_state_t *this, u_int settings); + + /** + * Get OS settings + * + * @return OS settings + */ + u_int (*get_os_settings)(imv_os_state_t *this); + + /** + * Increase/Decrease the ITA Angel count + * + * @param start TRUE increases and FALSE decreases count by one + */ + void (*set_angel_count)(imv_os_state_t *this, bool start); + + /** + * Get the ITA Angel count + * + * @return ITA Angel count + */ + int (*get_angel_count)(imv_os_state_t *this); + + /** + * Store a bad package that has to be updated or removed + * + * @param package Name of software package + * @param package_state Security state of software package + */ + void (*add_bad_package)(imv_os_state_t *this, char *package, + os_package_state_t package_state); + +}; + +/** + * Create an imv_os_state_t instance + * + * @param id connection ID + */ +imv_state_t* imv_os_state_create(TNC_ConnectionID id); + +#endif /** IMV_OS_STATE_H_ @}*/ diff --git a/src/libimcv/plugins/imv_os/pacman.c b/src/libimcv/plugins/imv_os/pacman.c new file mode 100644 index 000000000..57cc62a08 --- /dev/null +++ b/src/libimcv/plugins/imv_os/pacman.c @@ -0,0 +1,482 @@ +/* + * Copyright (C) 2012 Andreas Steffen + * HSR Hochschule fuer Technik Rapperswil + * + * This program is free software; you can redistribute it and/or modify it + * under the terms of the GNU General Public License as published by the + * Free Software Foundation; either version 2 of the License, or (at your + * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>. + * + * This program is distributed in the hope that it will be useful, but + * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY + * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License + * for more details. + */ + +#define _GNU_SOURCE +#include <getopt.h> +#include <unistd.h> +#include <stdio.h> +#include <string.h> +#include <errno.h> +#include <syslog.h> +#include <time.h> +#include <sys/stat.h> + +#include "imv_os_state.h" + +#include <library.h> +#include <utils/debug.h> + +typedef enum pacman_state_t pacman_state_t; + +enum pacman_state_t { + PACMAN_STATE_BEGIN_PACKAGE, + PACMAN_STATE_VERSION, + PACMAN_STATE_END_PACKAGE +}; + +typedef struct stats_t stats_t; + +struct stats_t { + time_t release; + int product; + int packages; + int new_packages; + int new_versions; + int updated_versions; + int deleted_versions; +}; + +/** + * global debug output variables + */ +static int debug_level = 1; +static bool stderr_quiet = TRUE; + +/** + * pacman dbg function + */ +static void pacman_dbg(debug_t group, level_t level, char *fmt, ...) +{ + int priority = LOG_INFO; + char buffer[8192]; + char *current = buffer, *next; + va_list args; + + if (level <= debug_level) + { + if (!stderr_quiet) + { + va_start(args, fmt); + vfprintf(stderr, fmt, args); + fprintf(stderr, "\n"); + va_end(args); + } + + /* write in memory buffer first */ + va_start(args, fmt); + vsnprintf(buffer, sizeof(buffer), fmt, args); + va_end(args); + + /* do a syslog with every line */ + while (current) + { + next = strchr(current, '\n'); + if (next) + { + *(next++) = '\0'; + } + syslog(priority, "%s\n", current); + current = next; + } + } +} + +/** + * atexit handler to close everything on shutdown + */ +static void cleanup(void) +{ + closelog(); + library_deinit(); +} + +static void usage(void) +{ + printf("Usage:\n" + "ipsec pacman --product <name> --file <filename> [--update]\n"); +} + +/** + * Update the package database + */ +static bool update_database(database_t *db, char *package, char *version, + bool security, stats_t *stats) +{ + char *cur_version, *version_update = NULL, *version_delete = NULL; + int cur_security, security_update = 0, security_delete = 0; + int pac_id = 0, vid = 0, vid_update = 0, vid_delete = 0; + u_int cur_time; + bool add_version = TRUE; + enumerator_t *e; + + /* increment package count */ + stats->packages++; + + /* check if package is already in database */ + e = db->query(db, "SELECT id FROM packages WHERE name = ?", + DB_TEXT, package, DB_INT); + if (!e) + { + return FALSE; + } + if (!e->enumerate(e, &pac_id)) + { + pac_id = 0; + } + e->destroy(e); + + if (!pac_id && security) + { + if (db->execute(db, &pac_id, "INSERT INTO packages (name) VALUES (?)", + DB_TEXT, package) != 1) + { + fprintf(stderr, "could not store package '%s' to database\n", + package); + return FALSE; + } + stats->new_packages++; + } + + /* check for package versions already in database */ + e = db->query(db, + "SELECT id, release, security, time FROM versions " + "WHERE package = ? AND product = ?", DB_INT, pac_id, + DB_INT, stats->product, DB_INT, DB_TEXT, DB_INT, DB_UINT); + if (!e) + { + return FALSE; + } + + while (e->enumerate(e, &vid, &cur_version, &cur_security, &cur_time)) + { + if (streq(version, cur_version)) + { + /* already in data base */ + add_version = FALSE; + break; + } + else if (stats->release >= cur_time) + { + if (security) + { + if (cur_security) + { + vid_update = vid; + version_update = strdup(cur_version); + security_update = cur_security; + } + else + { + vid_delete = vid; + version_delete = strdup(cur_version); + security_delete = cur_security; + } + } + else + { + if (!cur_security) + { + vid_update = vid; + version_update = strdup(cur_version); + security_update = cur_security; + } + } + } + else + { + if (security == cur_security) + { + add_version = FALSE; + } + } + } + e->destroy(e); + + if ((!vid && !security) || (vid && !add_version)) + { + free(version_update); + free(version_delete); + return TRUE; + } + + if ((!vid && security) || (vid && !vid_update)) + { + printf("%s (%s) %s\n", package, version, security ? "[s]" : ""); + + if (db->execute(db, &vid, + "INSERT INTO versions " + "(package, product, release, security, time) " + "VALUES (?, ?, ?, ?, ?)", DB_INT, pac_id, DB_INT, stats->product, + DB_TEXT, version, DB_INT, security, DB_INT, stats->release) != 1) + { + fprintf(stderr, "could not store version '%s' to database\n", + version); + free(version_update); + free(version_delete); + return FALSE; + } + stats->new_versions++; + } + else + { + printf("%s (%s) %s updated by\n", + package, version_update, security_update ? "[s]" : ""); + printf("%s (%s) %s\n", package, version, security ? "[s]" : ""); + + if (db->execute(db, NULL, + "UPDATE versions SET release = ?, time = ? WHERE id = ?", + DB_TEXT, version, DB_INT, stats->release, DB_INT, vid_update) <= 0) + { + fprintf(stderr, "could not update version '%s' to database\n", + version); + free(version_update); + free(version_delete); + return FALSE; + } + stats->updated_versions++; + } + + if (vid_delete) + { + printf("%s (%s) %s deleted\n", + package, version_delete, security_delete ? "[s]" : ""); + if (db->execute(db, NULL, + "DELETE FROM versions WHERE id = ?", + DB_INT, vid_delete) <= 0) + { + fprintf(stderr, "could not delete version '%s' from database\n", + version_delete); + free(version_update); + free(version_delete); + return FALSE; + } + stats->deleted_versions++; + } + free(version_update); + free(version_delete); + + return TRUE; +} + +/** + * Process a package file and store updates in the database + */ +static void process_packages(char *filename, char *product, bool security) +{ + char *uri, line[BUF_LEN], *pos, *package = NULL, *version = NULL; + pacman_state_t pacman_state; + enumerator_t *e; + database_t *db; + int pid; + FILE *file; + stats_t stats; + bool success; + + /* initialize statistics */ + memset(&stats, 0x00, sizeof(stats_t)); + + /* Set release date to current time */ + stats.release = time(NULL); + + /* opening package file */ + printf("loading\"%s\"\n", filename); + file = fopen(filename, "r"); + if (!file) + { + fprintf(stderr, "could not open \"%s\"\n", filename); + exit(EXIT_FAILURE); + } + + /* connect package database */ + uri = lib->settings->get_str(lib->settings, "pacman.database", NULL); + if (!uri) + { + fprintf(stderr, "database URI pacman.database not set\n"); + fclose(file); + exit(EXIT_FAILURE); + } + db = lib->db->create(lib->db, uri); + if (!db) + { + fprintf(stderr, "could not connect to database '%s'\n", uri); + fclose(file); + exit(EXIT_FAILURE); + } + + /* check if product is already in database */ + e = db->query(db, "SELECT id FROM products WHERE name = ?", + DB_TEXT, product, DB_INT); + if (e) + { + if (e->enumerate(e, &pid)) + { + stats.product = pid; + } + e->destroy(e); + } + if (!stats.product) + { + if (db->execute(db, &pid, "INSERT INTO products (name) VALUES (?)", + DB_TEXT, product) != 1) + { + fprintf(stderr, "could not store product '%s' to database\n", + product); + fclose(file); + db->destroy(db); + exit(EXIT_FAILURE); + } + stats.product = pid; + } + + pacman_state = PACMAN_STATE_BEGIN_PACKAGE; + + while (fgets(line, sizeof(line), file)) + { + /* set read pointer to beginning of line */ + pos = line; + + switch (pacman_state) + { + case PACMAN_STATE_BEGIN_PACKAGE: + pos = strstr(pos, "Package: "); + if (!pos) + { + continue; + } + pos += 9; + package = pos; + pos = strchr(pos, '\n'); + if (pos) + { + package = strndup(package, pos - package); + pacman_state = PACMAN_STATE_VERSION; + } + break; + case PACMAN_STATE_VERSION: + pos = strstr(pos, "Version: "); + if (!pos) + { + continue; + } + pos += 9; + version = pos; + pos = strchr(pos, '\n'); + if (pos) + { + version = strndup(version, pos - version); + pacman_state = PACMAN_STATE_END_PACKAGE; + } + break; + case PACMAN_STATE_END_PACKAGE: + if (*pos != '\n') + { + continue; + } + success = update_database(db, package, version, security, &stats); + free(package); + free(version); + if (!success) + { + fclose(file); + db->destroy(db); + exit(EXIT_FAILURE); + } + pacman_state = PACMAN_STATE_BEGIN_PACKAGE; + } + } + fclose(file); + db->destroy(db); + + printf("processed %d packages, %d new packages, %d new versions, " + "%d updated versions, %d deleted versions\n", + stats.packages, stats.new_packages, stats.new_versions, + stats.updated_versions, stats.deleted_versions); +} + +static void do_args(int argc, char *argv[]) +{ + char *filename = NULL, *product = NULL; + bool security = FALSE; + + /* reinit getopt state */ + optind = 0; + + while (TRUE) + { + int c; + + struct option long_opts[] = { + { "help", no_argument, NULL, 'h' }, + { "file", required_argument, NULL, 'f' }, + { "product", required_argument, NULL, 'p' }, + { "security", no_argument, NULL, 's' }, + { 0,0,0,0 } + }; + + c = getopt_long(argc, argv, "", long_opts, NULL); + switch (c) + { + case EOF: + break; + case 'h': + usage(); + exit(EXIT_SUCCESS); + case 'f': + filename = optarg; + continue; + case 'p': + product = optarg; + continue; + case 's': + security = TRUE; + continue; + } + break; + } + + if (filename && product) + { + process_packages(filename, product, security); + } + else + { + usage(); + exit(EXIT_FAILURE); + } +} + +int main(int argc, char *argv[]) +{ + /* enable attest debugging hook */ + dbg = pacman_dbg; + openlog("pacman", 0, LOG_DEBUG); + + atexit(cleanup); + + /* initialize library */ + if (!library_init(NULL)) + { + exit(SS_RC_LIBSTRONGSWAN_INTEGRITY); + } + if (!lib->plugins->load(lib->plugins, + lib->settings->get_str(lib->settings, "attest.load", "sqlite"))) + { + exit(SS_RC_INITIALIZATION_FAILED); + } + do_args(argc, argv); + + exit(EXIT_SUCCESS); +} + diff --git a/src/libimcv/plugins/imv_os/pacman.sh b/src/libimcv/plugins/imv_os/pacman.sh new file mode 100755 index 000000000..e99de0cb5 --- /dev/null +++ b/src/libimcv/plugins/imv_os/pacman.sh @@ -0,0 +1,160 @@ +#!/bin/sh + +DIR="/etc/pts" +DATE=`date +%Y%m%d-%H%M` +UBUNTU="http://security.ubuntu.com/ubuntu/dists" +UBUNTU_VERSIONS="raring quantal precise lucid" +UBUNTU_DIRS="main multiverse restricted universe" +UBUNTU_ARCH="binary-amd64 binary-i386" +DEBIAN="http://security.debian.org/dists" +DEBIAN_VERSIONS="jessie wheezy squeeze" +DEBIAN_DIRS="main contrib non-free" +DEBIAN_ARCH="binary-amd64 binary-i386" +PACMAN=/usr/libexec/ipsec/pacman +PACMAN_LOG="$DIR/$DATE-pacman.log" + +cd $DIR/dists + +for v in $UBUNTU_VERSIONS +do + for a in $UBUNTU_ARCH + do + mkdir -p $v-security/$a $v-updates/$a + for d in $UBUNTU_DIRS + do + wget $UBUNTU/$v-security/$d/$a/Packages.bz2 -O $v-security/$a/Packages-$d.bz2 + bunzip2 -f $v-security/$a/Packages-$d.bz2 + wget $UBUNTU/$v-updates/$d/$a/Packages.bz2 -O $v-updates/$a/Packages-$d.bz2 + bunzip2 -f $v-updates/$a/Packages-$d.bz2 + done + done +done + +for v in $DEBIAN_VERSIONS +do + for a in $DEBIAN_ARCH + do + mkdir -p $v-updates/$a + for d in $DEBIAN_DIRS + do + wget $DEBIAN/$v/updates/$d/$a/Packages.bz2 -O $v-updates/$a/Packages-$d.bz2 + bunzip2 -f $v-updates/$a/Packages-$d.bz2 + done + done +done + +for f in raring-security/binary-amd64/* +do + $PACMAN --product "Ubuntu 13.04 x86_64" --file $f --security >> $PACMAN_LOG +done +echo +for f in raring-updates/binary-amd64/* +do + $PACMAN --product "Ubuntu 13.04 x86_64" --file $f >> $PACMAN_LOG +done +echo +for f in raring-security/binary-i386/* +do + $PACMAN --product "Ubuntu 13.04 i686" --file $f --security >> $PACMAN_LOG +done +echo +for f in raring-updates/binary-i386/* +do + $PACMAN --product "Ubuntu 13.04 i686" --file $f >> $PACMAN_LOG +done +echo + +for f in quantal-security/binary-amd64/* +do + $PACMAN --product "Ubuntu 12.10 x86_64" --file $f --security >> $PACMAN_LOG +done +echo +for f in quantal-updates/binary-amd64/* +do + $PACMAN --product "Ubuntu 12.10 x86_64" --file $f >> $PACMAN_LOG +done +echo +for f in quantal-security/binary-i386/* +do + $PACMAN --product "Ubuntu 12.10 i686" --file $f --security >> $PACMAN_LOG +done +echo +for f in quantal-updates/binary-i386/* +do + $PACMAN --product "Ubuntu 12.10 i686" --file $f >> $PACMAN_LOG +done +echo + +for f in precise-security/binary-amd64/* +do + $PACMAN --product "Ubuntu 12.04 x86_64" --file $f --security >> $PACMAN_LOG +done +echo +for f in precise-updates/binary-amd64/* +do + $PACMAN --product "Ubuntu 12.04 x86_64" --file $f >> $PACMAN_LOG +done +echo +for f in precise-security/binary-i386/* +do + $PACMAN --product "Ubuntu 12.04 i686" --file $f --security >> $PACMAN_LOG +done +echo +for f in precise-updates/binary-i386/* +do + $PACMAN --product "Ubuntu 12.04 i686" --file $f >> $PACMAN_LOG +done +echo + +for f in lucid-security/binary-amd64/* +do + $PACMAN --product "Ubuntu 10.04 x86_64" --file $f --security >> $PACMAN_LOG +done +echo +for f in lucid-updates/binary-amd64/* +do + $PACMAN --product "Ubuntu 10.04 x86_64" --file $f >> $PACMAN_LOG +done +echo +for f in lucid-security/binary-i386/* +do + $PACMAN --product "Ubuntu 10.04 i686" --file $f --security >> $PACMAN_LOG +done +echo +for f in lucid-updates/binary-i386/* +do + $PACMAN --product "Ubuntu 10.04 i686" --file $f >> $PACMAN_LOG +done +echo + +for f in jessie-updates/binary-amd64/* +do + $PACMAN --product "Debian 8.0 x86_64" --file $f --security >> $PACMAN_LOG +done +echo +for f in jessie-updates/binary-i386/* +do + $PACMAN --product "Debian 8.0 i686" --file $f --security >> $PACMAN_LOG +done + +for f in wheezy-updates/binary-amd64/* +do + $PACMAN --product "Debian 7.0 x86_64" --file $f --security >> $PACMAN_LOG +done +echo +for f in wheezy-updates/binary-i386/* +do + $PACMAN --product "Debian 7.0 i686" --file $f --security >> $PACMAN_LOG +done + +for f in squeeze-updates/binary-amd64/* +do + $PACMAN --product "Debian 6.0 x86_64" --file $f --security >> $PACMAN_LOG +done +echo +for f in squeeze-updates/binary-i386/* +do + $PACMAN --product "Debian 6.0 i686" --file $f --security >> $PACMAN_LOG +done + +cp $DIR/config.db $DIR/config.db-$DATE diff --git a/src/libimcv/plugins/imv_scanner/Makefile.am b/src/libimcv/plugins/imv_scanner/Makefile.am index df2158e72..625e62316 100644 --- a/src/libimcv/plugins/imv_scanner/Makefile.am +++ b/src/libimcv/plugins/imv_scanner/Makefile.am @@ -1,15 +1,18 @@ - -INCLUDES = -I$(top_srcdir)/src/libstrongswan -I$(top_srcdir)/src/libtncif \ +AM_CPPFLAGS = \ + -I$(top_srcdir)/src/libstrongswan \ + -I$(top_srcdir)/src/libtncif \ -I$(top_srcdir)/src/libimcv -AM_CFLAGS = -rdynamic +AM_CFLAGS = \ + -rdynamic imcv_LTLIBRARIES = imv-scanner.la imv_scanner_la_LIBADD = $(top_builddir)/src/libimcv/libimcv.la \ $(top_builddir)/src/libstrongswan/libstrongswan.la -imv_scanner_la_SOURCES = imv_scanner.c imv_scanner_state.h imv_scanner_state.c +imv_scanner_la_SOURCES = \ + imv_scanner.c imv_scanner_state.h imv_scanner_state.c \ + imv_scanner_agent.h imv_scanner_agent.c imv_scanner_la_LDFLAGS = -module -avoid-version - diff --git a/src/libimcv/plugins/imv_scanner/Makefile.in b/src/libimcv/plugins/imv_scanner/Makefile.in index 63602c707..e336b86bb 100644 --- a/src/libimcv/plugins/imv_scanner/Makefile.in +++ b/src/libimcv/plugins/imv_scanner/Makefile.in @@ -1,9 +1,9 @@ -# Makefile.in generated by automake 1.11.1 from Makefile.am. +# Makefile.in generated by automake 1.11.6 from Makefile.am. # @configure_input@ # Copyright (C) 1994, 1995, 1996, 1997, 1998, 1999, 2000, 2001, 2002, -# 2003, 2004, 2005, 2006, 2007, 2008, 2009 Free Software Foundation, -# Inc. +# 2003, 2004, 2005, 2006, 2007, 2008, 2009, 2010, 2011 Free Software +# Foundation, Inc. # This Makefile.in is free software; the Free Software Foundation # gives unlimited permission to copy and/or distribute it, # with or without modifications, as long as this notice is preserved. @@ -16,6 +16,23 @@ @SET_MAKE@ VPATH = @srcdir@ +am__make_dryrun = \ + { \ + am__dry=no; \ + case $$MAKEFLAGS in \ + *\\[\ \ ]*) \ + echo 'am--echo: ; @echo "AM" OK' | $(MAKE) -f - 2>/dev/null \ + | grep '^AM OK$$' >/dev/null || am__dry=yes;; \ + *) \ + for am__flg in $$MAKEFLAGS; do \ + case $$am__flg in \ + *=*|--*) ;; \ + *n*) am__dry=yes; break;; \ + esac; \ + done;; \ + esac; \ + test $$am__dry = yes; \ + } pkgdatadir = $(datadir)/@PACKAGE@ pkgincludedir = $(includedir)/@PACKAGE@ pkglibdir = $(libdir)/@PACKAGE@ @@ -45,10 +62,11 @@ am__aclocal_m4_deps = $(top_srcdir)/m4/config/libtool.m4 \ $(top_srcdir)/m4/macros/with.m4 \ $(top_srcdir)/m4/macros/enable-disable.m4 \ $(top_srcdir)/m4/macros/add-plugin.m4 \ - $(top_srcdir)/configure.in + $(top_srcdir)/configure.ac am__configure_deps = $(am__aclocal_m4_deps) $(CONFIGURE_DEPENDENCIES) \ $(ACLOCAL_M4) mkinstalldirs = $(install_sh) -d +CONFIG_HEADER = $(top_builddir)/config.h CONFIG_CLEAN_FILES = CONFIG_CLEAN_VPATH_FILES = am__vpath_adj_setup = srcdirstrip=`echo "$(srcdir)" | sed 's|.|.|g'`; @@ -72,51 +90,87 @@ am__nobase_list = $(am__nobase_strip_setup); \ am__base_list = \ sed '$$!N;$$!N;$$!N;$$!N;$$!N;$$!N;$$!N;s/\n/ /g' | \ sed '$$!N;$$!N;$$!N;$$!N;s/\n/ /g' +am__uninstall_files_from_dir = { \ + test -z "$$files" \ + || { test ! -d "$$dir" && test ! -f "$$dir" && test ! -r "$$dir"; } \ + || { echo " ( cd '$$dir' && rm -f" $$files ")"; \ + $(am__cd) "$$dir" && rm -f $$files; }; \ + } am__installdirs = "$(DESTDIR)$(imcvdir)" LTLIBRARIES = $(imcv_LTLIBRARIES) imv_scanner_la_DEPENDENCIES = $(top_builddir)/src/libimcv/libimcv.la \ $(top_builddir)/src/libstrongswan/libstrongswan.la -am_imv_scanner_la_OBJECTS = imv_scanner.lo imv_scanner_state.lo +am_imv_scanner_la_OBJECTS = imv_scanner.lo imv_scanner_state.lo \ + imv_scanner_agent.lo imv_scanner_la_OBJECTS = $(am_imv_scanner_la_OBJECTS) -imv_scanner_la_LINK = $(LIBTOOL) --tag=CC $(AM_LIBTOOLFLAGS) \ - $(LIBTOOLFLAGS) --mode=link $(CCLD) $(AM_CFLAGS) $(CFLAGS) \ - $(imv_scanner_la_LDFLAGS) $(LDFLAGS) -o $@ -DEFAULT_INCLUDES = -I.@am__isrc@ +AM_V_lt = $(am__v_lt_@AM_V@) +am__v_lt_ = $(am__v_lt_@AM_DEFAULT_V@) +am__v_lt_0 = --silent +imv_scanner_la_LINK = $(LIBTOOL) $(AM_V_lt) --tag=CC \ + $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=link $(CCLD) \ + $(AM_CFLAGS) $(CFLAGS) $(imv_scanner_la_LDFLAGS) $(LDFLAGS) -o \ + $@ +DEFAULT_INCLUDES = -I.@am__isrc@ -I$(top_builddir) depcomp = $(SHELL) $(top_srcdir)/depcomp am__depfiles_maybe = depfiles am__mv = mv -f COMPILE = $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) \ $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -LTCOMPILE = $(LIBTOOL) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) \ - --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) \ - $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) +LTCOMPILE = $(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) \ + $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) \ + $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) \ + $(AM_CFLAGS) $(CFLAGS) +AM_V_CC = $(am__v_CC_@AM_V@) +am__v_CC_ = $(am__v_CC_@AM_DEFAULT_V@) +am__v_CC_0 = @echo " CC " $@; +AM_V_at = $(am__v_at_@AM_V@) +am__v_at_ = $(am__v_at_@AM_DEFAULT_V@) +am__v_at_0 = @ CCLD = $(CC) -LINK = $(LIBTOOL) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) \ - --mode=link $(CCLD) $(AM_CFLAGS) $(CFLAGS) $(AM_LDFLAGS) \ - $(LDFLAGS) -o $@ +LINK = $(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) \ + $(LIBTOOLFLAGS) --mode=link $(CCLD) $(AM_CFLAGS) $(CFLAGS) \ + $(AM_LDFLAGS) $(LDFLAGS) -o $@ +AM_V_CCLD = $(am__v_CCLD_@AM_V@) +am__v_CCLD_ = $(am__v_CCLD_@AM_DEFAULT_V@) +am__v_CCLD_0 = @echo " CCLD " $@; +AM_V_GEN = $(am__v_GEN_@AM_V@) +am__v_GEN_ = $(am__v_GEN_@AM_DEFAULT_V@) +am__v_GEN_0 = @echo " GEN " $@; SOURCES = $(imv_scanner_la_SOURCES) DIST_SOURCES = $(imv_scanner_la_SOURCES) +am__can_run_installinfo = \ + case $$AM_UPDATE_INFO_DIR in \ + n|no|NO) false;; \ + *) (install-info --version) >/dev/null 2>&1;; \ + esac ETAGS = etags CTAGS = ctags DISTFILES = $(DIST_COMMON) $(DIST_SOURCES) $(TEXINFOS) $(EXTRA_DIST) ACLOCAL = @ACLOCAL@ ALLOCA = @ALLOCA@ AMTAR = @AMTAR@ +AM_DEFAULT_VERBOSITY = @AM_DEFAULT_VERBOSITY@ AR = @AR@ AUTOCONF = @AUTOCONF@ AUTOHEADER = @AUTOHEADER@ AUTOMAKE = @AUTOMAKE@ AWK = @AWK@ +BFDLIB = @BFDLIB@ BTLIB = @BTLIB@ CC = @CC@ CCDEPMODE = @CCDEPMODE@ CFLAGS = @CFLAGS@ +CHECK_CFLAGS = @CHECK_CFLAGS@ +CHECK_LIBS = @CHECK_LIBS@ +COVERAGE_CFLAGS = @COVERAGE_CFLAGS@ +COVERAGE_LDFLAGS = @COVERAGE_LDFLAGS@ CPP = @CPP@ CPPFLAGS = @CPPFLAGS@ CYGPATH_W = @CYGPATH_W@ DEFS = @DEFS@ DEPDIR = @DEPDIR@ DLLIB = @DLLIB@ +DLLTOOL = @DLLTOOL@ DSYMUTIL = @DSYMUTIL@ DUMPBIN = @DUMPBIN@ ECHO_C = @ECHO_C@ @@ -125,13 +179,16 @@ ECHO_T = @ECHO_T@ EGREP = @EGREP@ EXEEXT = @EXEEXT@ FGREP = @FGREP@ +GENHTML = @GENHTML@ GPERF = @GPERF@ +GPRBUILD = @GPRBUILD@ GREP = @GREP@ INSTALL = @INSTALL@ INSTALL_DATA = @INSTALL_DATA@ INSTALL_PROGRAM = @INSTALL_PROGRAM@ INSTALL_SCRIPT = @INSTALL_SCRIPT@ INSTALL_STRIP_PROGRAM = @INSTALL_STRIP_PROGRAM@ +LCOV = @LCOV@ LD = @LD@ LDFLAGS = @LDFLAGS@ LEX = @LEX@ @@ -144,6 +201,7 @@ LIPO = @LIPO@ LN_S = @LN_S@ LTLIBOBJS = @LTLIBOBJS@ MAKEINFO = @MAKEINFO@ +MANIFEST_TOOL = @MANIFEST_TOOL@ MKDIR_P = @MKDIR_P@ MYSQLCFLAG = @MYSQLCFLAG@ MYSQLCONFIG = @MYSQLCONFIG@ @@ -171,11 +229,13 @@ RANLIB = @RANLIB@ RTLIB = @RTLIB@ RUBY = @RUBY@ RUBYINCLUDE = @RUBYINCLUDE@ +RUBYLIB = @RUBYLIB@ SED = @SED@ SET_MAKE = @SET_MAKE@ SHELL = @SHELL@ SOCKLIB = @SOCKLIB@ STRIP = @STRIP@ +UNWINDLIB = @UNWINDLIB@ VERSION = @VERSION@ YACC = @YACC@ YFLAGS = @YFLAGS@ @@ -183,6 +243,7 @@ abs_builddir = @abs_builddir@ abs_srcdir = @abs_srcdir@ abs_top_builddir = @abs_top_builddir@ abs_top_srcdir = @abs_top_srcdir@ +ac_ct_AR = @ac_ct_AR@ ac_ct_CC = @ac_ct_CC@ ac_ct_DUMPBIN = @ac_ct_DUMPBIN@ am__include = @am__include@ @@ -191,8 +252,6 @@ am__quote = @am__quote@ am__tar = @am__tar@ am__untar = @am__untar@ attest_plugins = @attest_plugins@ -axis2c_CFLAGS = @axis2c_CFLAGS@ -axis2c_LIBS = @axis2c_LIBS@ bindir = @bindir@ build = @build@ build_alias = @build_alias@ @@ -201,14 +260,19 @@ build_os = @build_os@ build_vendor = @build_vendor@ builddir = @builddir@ c_plugins = @c_plugins@ +charon_natt_port = @charon_natt_port@ +charon_plugins = @charon_plugins@ +charon_udp_port = @charon_udp_port@ clearsilver_LIBS = @clearsilver_LIBS@ +cmd_plugins = @cmd_plugins@ datadir = @datadir@ datarootdir = @datarootdir@ dbusservicedir = @dbusservicedir@ -default_pkcs11 = @default_pkcs11@ +dev_headers = @dev_headers@ docdir = @docdir@ dvidir = @dvidir@ exec_prefix = @exec_prefix@ +fips_mode = @fips_mode@ gtk_CFLAGS = @gtk_CFLAGS@ gtk_LIBS = @gtk_LIBS@ h_plugins = @h_plugins@ @@ -222,17 +286,17 @@ imcvdir = @imcvdir@ includedir = @includedir@ infodir = @infodir@ install_sh = @install_sh@ +ipsec_script = @ipsec_script@ +ipsec_script_upper = @ipsec_script_upper@ ipsecdir = @ipsecdir@ ipsecgroup = @ipsecgroup@ ipseclibdir = @ipseclibdir@ ipsecuser = @ipsecuser@ -libcharon_plugins = @libcharon_plugins@ libdir = @libdir@ libexecdir = @libexecdir@ linux_headers = @linux_headers@ localedir = @localedir@ localstatedir = @localstatedir@ -lt_ECHO = @lt_ECHO@ maemo_CFLAGS = @maemo_CFLAGS@ maemo_LIBS = @maemo_LIBS@ manager_plugins = @manager_plugins@ @@ -242,16 +306,15 @@ mkdir_p = @mkdir_p@ nm_CFLAGS = @nm_CFLAGS@ nm_LIBS = @nm_LIBS@ nm_ca_dir = @nm_ca_dir@ +nm_plugins = @nm_plugins@ oldincludedir = @oldincludedir@ openac_plugins = @openac_plugins@ -p_plugins = @p_plugins@ pcsclite_CFLAGS = @pcsclite_CFLAGS@ pcsclite_LIBS = @pcsclite_LIBS@ pdfdir = @pdfdir@ piddir = @piddir@ pki_plugins = @pki_plugins@ plugindir = @plugindir@ -pluto_plugins = @pluto_plugins@ pool_plugins = @pool_plugins@ prefix = @prefix@ program_transform_name = @program_transform_name@ @@ -279,15 +342,22 @@ top_srcdir = @top_srcdir@ urandom_device = @urandom_device@ xml_CFLAGS = @xml_CFLAGS@ xml_LIBS = @xml_LIBS@ -INCLUDES = -I$(top_srcdir)/src/libstrongswan -I$(top_srcdir)/src/libtncif \ +AM_CPPFLAGS = \ + -I$(top_srcdir)/src/libstrongswan \ + -I$(top_srcdir)/src/libtncif \ -I$(top_srcdir)/src/libimcv -AM_CFLAGS = -rdynamic +AM_CFLAGS = \ + -rdynamic + imcv_LTLIBRARIES = imv-scanner.la imv_scanner_la_LIBADD = $(top_builddir)/src/libimcv/libimcv.la \ $(top_builddir)/src/libstrongswan/libstrongswan.la -imv_scanner_la_SOURCES = imv_scanner.c imv_scanner_state.h imv_scanner_state.c +imv_scanner_la_SOURCES = \ + imv_scanner.c imv_scanner_state.h imv_scanner_state.c \ + imv_scanner_agent.h imv_scanner_agent.c + imv_scanner_la_LDFLAGS = -module -avoid-version all: all-am @@ -325,7 +395,6 @@ $(ACLOCAL_M4): $(am__aclocal_m4_deps) $(am__aclocal_m4_deps): install-imcvLTLIBRARIES: $(imcv_LTLIBRARIES) @$(NORMAL_INSTALL) - test -z "$(imcvdir)" || $(MKDIR_P) "$(DESTDIR)$(imcvdir)" @list='$(imcv_LTLIBRARIES)'; test -n "$(imcvdir)" || list=; \ list2=; for p in $$list; do \ if test -f $$p; then \ @@ -333,6 +402,8 @@ install-imcvLTLIBRARIES: $(imcv_LTLIBRARIES) else :; fi; \ done; \ test -z "$$list2" || { \ + echo " $(MKDIR_P) '$(DESTDIR)$(imcvdir)'"; \ + $(MKDIR_P) "$(DESTDIR)$(imcvdir)" || exit 1; \ echo " $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=install $(INSTALL) $(INSTALL_STRIP_FLAG) $$list2 '$(DESTDIR)$(imcvdir)'"; \ $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=install $(INSTALL) $(INSTALL_STRIP_FLAG) $$list2 "$(DESTDIR)$(imcvdir)"; \ } @@ -354,8 +425,8 @@ clean-imcvLTLIBRARIES: echo "rm -f \"$${dir}/so_locations\""; \ rm -f "$${dir}/so_locations"; \ done -imv-scanner.la: $(imv_scanner_la_OBJECTS) $(imv_scanner_la_DEPENDENCIES) - $(imv_scanner_la_LINK) -rpath $(imcvdir) $(imv_scanner_la_OBJECTS) $(imv_scanner_la_LIBADD) $(LIBS) +imv-scanner.la: $(imv_scanner_la_OBJECTS) $(imv_scanner_la_DEPENDENCIES) $(EXTRA_imv_scanner_la_DEPENDENCIES) + $(AM_V_CCLD)$(imv_scanner_la_LINK) -rpath $(imcvdir) $(imv_scanner_la_OBJECTS) $(imv_scanner_la_LIBADD) $(LIBS) mostlyclean-compile: -rm -f *.$(OBJEXT) @@ -364,28 +435,29 @@ distclean-compile: -rm -f *.tab.c @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/imv_scanner.Plo@am__quote@ +@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/imv_scanner_agent.Plo@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/imv_scanner_state.Plo@am__quote@ .c.o: -@am__fastdepCC_TRUE@ $(COMPILE) -MT $@ -MD -MP -MF $(DEPDIR)/$*.Tpo -c -o $@ $< -@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Po -@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='$<' object='$@' libtool=no @AMDEPBACKSLASH@ +@am__fastdepCC_TRUE@ $(AM_V_CC)$(COMPILE) -MT $@ -MD -MP -MF $(DEPDIR)/$*.Tpo -c -o $@ $< +@am__fastdepCC_TRUE@ $(AM_V_at)$(am__mv) $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Po +@AMDEP_TRUE@@am__fastdepCC_FALSE@ $(AM_V_CC)source='$<' object='$@' libtool=no @AMDEPBACKSLASH@ @AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@ -@am__fastdepCC_FALSE@ $(COMPILE) -c $< +@am__fastdepCC_FALSE@ $(AM_V_CC@am__nodep@)$(COMPILE) -c $< .c.obj: -@am__fastdepCC_TRUE@ $(COMPILE) -MT $@ -MD -MP -MF $(DEPDIR)/$*.Tpo -c -o $@ `$(CYGPATH_W) '$<'` -@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Po -@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='$<' object='$@' libtool=no @AMDEPBACKSLASH@ +@am__fastdepCC_TRUE@ $(AM_V_CC)$(COMPILE) -MT $@ -MD -MP -MF $(DEPDIR)/$*.Tpo -c -o $@ `$(CYGPATH_W) '$<'` +@am__fastdepCC_TRUE@ $(AM_V_at)$(am__mv) $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Po +@AMDEP_TRUE@@am__fastdepCC_FALSE@ $(AM_V_CC)source='$<' object='$@' libtool=no @AMDEPBACKSLASH@ @AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@ -@am__fastdepCC_FALSE@ $(COMPILE) -c `$(CYGPATH_W) '$<'` +@am__fastdepCC_FALSE@ $(AM_V_CC@am__nodep@)$(COMPILE) -c `$(CYGPATH_W) '$<'` .c.lo: -@am__fastdepCC_TRUE@ $(LTCOMPILE) -MT $@ -MD -MP -MF $(DEPDIR)/$*.Tpo -c -o $@ $< -@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Plo -@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='$<' object='$@' libtool=yes @AMDEPBACKSLASH@ +@am__fastdepCC_TRUE@ $(AM_V_CC)$(LTCOMPILE) -MT $@ -MD -MP -MF $(DEPDIR)/$*.Tpo -c -o $@ $< +@am__fastdepCC_TRUE@ $(AM_V_at)$(am__mv) $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Plo +@AMDEP_TRUE@@am__fastdepCC_FALSE@ $(AM_V_CC)source='$<' object='$@' libtool=yes @AMDEPBACKSLASH@ @AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@ -@am__fastdepCC_FALSE@ $(LTCOMPILE) -c -o $@ $< +@am__fastdepCC_FALSE@ $(AM_V_CC@am__nodep@)$(LTCOMPILE) -c -o $@ $< mostlyclean-libtool: -rm -f *.lo @@ -492,10 +564,15 @@ install-am: all-am installcheck: installcheck-am install-strip: - $(MAKE) $(AM_MAKEFLAGS) INSTALL_PROGRAM="$(INSTALL_STRIP_PROGRAM)" \ - install_sh_PROGRAM="$(INSTALL_STRIP_PROGRAM)" INSTALL_STRIP_FLAG=-s \ - `test -z '$(STRIP)' || \ - echo "INSTALL_PROGRAM_ENV=STRIPPROG='$(STRIP)'"` install + if test -z '$(STRIP)'; then \ + $(MAKE) $(AM_MAKEFLAGS) INSTALL_PROGRAM="$(INSTALL_STRIP_PROGRAM)" \ + install_sh_PROGRAM="$(INSTALL_STRIP_PROGRAM)" INSTALL_STRIP_FLAG=-s \ + install; \ + else \ + $(MAKE) $(AM_MAKEFLAGS) INSTALL_PROGRAM="$(INSTALL_STRIP_PROGRAM)" \ + install_sh_PROGRAM="$(INSTALL_STRIP_PROGRAM)" INSTALL_STRIP_FLAG=-s \ + "INSTALL_PROGRAM_ENV=STRIPPROG='$(STRIP)'" install; \ + fi mostlyclean-generic: clean-generic: diff --git a/src/libimcv/plugins/imv_scanner/imv_scanner.c b/src/libimcv/plugins/imv_scanner/imv_scanner.c index dba3fd632..6f5e82355 100644 --- a/src/libimcv/plugins/imv_scanner/imv_scanner.c +++ b/src/libimcv/plugins/imv_scanner/imv_scanner.c @@ -1,5 +1,6 @@ /* - * Copyright (C) 2011 Andreas Steffen, HSR Hochschule fuer Technik Rapperswil + * Copyright (C) 2013 Andreas Steffen + * HSR Hochschule fuer Technik Rapperswil * * This program is free software; you can redistribute it and/or modify it * under the terms of the GNU General Public License as published by the @@ -12,398 +13,12 @@ * for more details. */ -#include "imv_scanner_state.h" - -#include <imv/imv_agent.h> -#include <pa_tnc/pa_tnc_msg.h> -#include <ietf/ietf_attr.h> -#include <ietf/ietf_attr_pa_tnc_error.h> -#include <ietf/ietf_attr_port_filter.h> - -#include <tncif_names.h> -#include <tncif_pa_subtypes.h> - -#include <pen/pen.h> -#include <utils/linked_list.h> -#include <utils/lexparser.h> -#include <debug.h> - -/* IMV definitions */ +#include "imv_scanner_agent.h" static const char imv_name[] = "Scanner"; +static const imv_agent_create_t imv_agent_create = imv_scanner_agent_create; -#define IMV_VENDOR_ID PEN_ITA -#define IMV_SUBTYPE PA_SUBTYPE_ITA_SCANNER - -static imv_agent_t *imv_scanner; - -typedef struct port_range_t port_range_t; - -struct port_range_t { - u_int16_t start, stop; -}; - - -/** - * Default port policy - * - * TRUE: all server ports on the TNC client must be closed - * FALSE: any server port on the TNC client is allowed to be open - */ -static bool closed_port_policy = TRUE; - -/** - * List of TCP and UDP port ranges - * - * TRUE: server ports on the TNC client that are allowed to be open - * FALSE: server ports on the TNC client that must be closed - */ -static linked_list_t *tcp_ports, *udp_ports; - -/** - * Get a TCP or UDP port list from strongswan.conf - */ -static linked_list_t* get_port_list(char *label) -{ - char key[40], *value; - linked_list_t *list; - chunk_t port_list, port_item, port_start; - port_range_t *port_range; - - list = linked_list_create(); - - snprintf(key, sizeof(key), "libimcv.plugins.imv-scanner.%s_ports", label); - value = lib->settings->get_str(lib->settings, key, NULL); - if (!value) - { - DBG1(DBG_IMV, "%s not defined", key); - return list; - } - port_list = chunk_create(value, strlen(value)); - DBG2(DBG_IMV, "list of %s ports that %s:", label, - closed_port_policy ? "are allowed to be open" : "must be closed"); - - while (eat_whitespace(&port_list)) - { - if (!extract_token(&port_item, ' ', &port_list)) - { - /* reached last port item */ - port_item = port_list; - port_list = chunk_empty; - } - port_range = malloc_thing(port_range_t); - port_range->start = atoi(port_item.ptr); - - if (extract_token(&port_start, '-', &port_item) && port_item.len) - { - port_range->stop = atoi(port_item.ptr); - } - else - { - port_range->stop = port_range->start; - } - DBG2(DBG_IMV, "%5u - %5u", port_range->start, port_range->stop); - list->insert_last(list, port_range); - } - - return list; -} - - -/* - * see section 3.8.1 of TCG TNC IF-IMV Specification 1.3 - */ -TNC_Result TNC_IMV_Initialize(TNC_IMVID imv_id, - TNC_Version min_version, - TNC_Version max_version, - TNC_Version *actual_version) -{ - if (imv_scanner) - { - DBG1(DBG_IMV, "IMV \"%s\" has already been initialized", imv_name); - return TNC_RESULT_ALREADY_INITIALIZED; - } - imv_scanner = imv_agent_create(imv_name, IMV_VENDOR_ID, IMV_SUBTYPE, - imv_id, actual_version); - if (!imv_scanner) - { - return TNC_RESULT_FATAL; - } - if (min_version > TNC_IFIMV_VERSION_1 || max_version < TNC_IFIMV_VERSION_1) - { - DBG1(DBG_IMV, "no common IF-IMV version"); - return TNC_RESULT_NO_COMMON_VERSION; - } - - /* set the default port policy to closed (TRUE) or open (FALSE) */ - closed_port_policy = lib->settings->get_bool(lib->settings, - "libimcv.plugins.imv-scanner.closed_port_policy", TRUE); - DBG2(DBG_IMV, "default port policy is %s ports", - closed_port_policy ? "closed" : "open"); - - /* get the list of open|closed ports */ - tcp_ports = get_port_list("tcp"); - udp_ports = get_port_list("udp"); - - return TNC_RESULT_SUCCESS; -} - -/** - * see section 3.8.2 of TCG TNC IF-IMV Specification 1.3 - */ -TNC_Result TNC_IMV_NotifyConnectionChange(TNC_IMVID imv_id, - TNC_ConnectionID connection_id, - TNC_ConnectionState new_state) -{ - imv_state_t *state; - - if (!imv_scanner) - { - DBG1(DBG_IMV, "IMV \"%s\" has not been initialized", imv_name); - return TNC_RESULT_NOT_INITIALIZED; - } - switch (new_state) - { - case TNC_CONNECTION_STATE_CREATE: - state = imv_scanner_state_create(connection_id); - return imv_scanner->create_state(imv_scanner, state); - case TNC_CONNECTION_STATE_DELETE: - return imv_scanner->delete_state(imv_scanner, connection_id); - default: - return imv_scanner->change_state(imv_scanner, connection_id, - new_state, NULL); - } -} - -static TNC_Result receive_message(TNC_IMVID imv_id, - TNC_ConnectionID connection_id, - TNC_UInt32 msg_flags, - chunk_t msg, - TNC_VendorID msg_vid, - TNC_MessageSubtype msg_subtype, - TNC_UInt32 src_imc_id, - TNC_UInt32 dst_imv_id) -{ - pa_tnc_msg_t *pa_tnc_msg; - pa_tnc_attr_t *attr; - imv_state_t *state; - enumerator_t *enumerator; - TNC_Result result; - bool fatal_error; - - if (!imv_scanner) - { - DBG1(DBG_IMV, "IMV \"%s\" has not been initialized", imv_name); - return TNC_RESULT_NOT_INITIALIZED; - } - - /* get current IMV state */ - if (!imv_scanner->get_state(imv_scanner, connection_id, &state)) - { - return TNC_RESULT_FATAL; - } - - /* parse received PA-TNC message and automatically handle any errors */ - result = imv_scanner->receive_message(imv_scanner, state, msg, msg_vid, - msg_subtype, src_imc_id, dst_imv_id, &pa_tnc_msg); - - /* no parsed PA-TNC attributes available if an error occurred */ - if (!pa_tnc_msg) - { - return result; - } - - /* preprocess any IETF standard error attributes */ - fatal_error = pa_tnc_msg->process_ietf_std_errors(pa_tnc_msg); - - /* analyze PA-TNC attributes */ - enumerator = pa_tnc_msg->create_attribute_enumerator(pa_tnc_msg); - while (enumerator->enumerate(enumerator, &attr)) - { - if (attr->get_vendor_id(attr) == PEN_IETF && - attr->get_type(attr) == IETF_ATTR_PORT_FILTER) - { - ietf_attr_port_filter_t *attr_port_filter; - enumerator_t *enumerator; - u_int8_t protocol; - u_int16_t port; - char buf[BUF_LEN], *pos = buf; - size_t len = BUF_LEN; - bool blocked, compliant = TRUE; - - attr_port_filter = (ietf_attr_port_filter_t*)attr; - enumerator = attr_port_filter->create_port_enumerator(attr_port_filter); - while (enumerator->enumerate(enumerator, &blocked, &protocol, &port)) - { - enumerator_t *e; - port_range_t *port_range; - bool passed, found = FALSE; - int written = 0; - - if (blocked) - { - /* ignore closed ports */ - continue; - } - - e = (protocol == IPPROTO_TCP) ? - tcp_ports->create_enumerator(tcp_ports) : - udp_ports->create_enumerator(udp_ports); - while (e->enumerate(e, &port_range)) - { - if (port >= port_range->start && port <= port_range->stop) - { - found = TRUE; - break; - } - } - e->destroy(e); - - passed = (closed_port_policy == found); - DBG2(DBG_IMV, "%s port %5u %s: %s", - (protocol == IPPROTO_TCP) ? "tcp" : "udp", port, - blocked ? "closed" : "open", passed ? "ok" : "fatal"); - if (!passed) - { - compliant = FALSE; - written = snprintf(pos, len, " %s/%u", - (protocol == IPPROTO_TCP) ? "tcp" : "udp", - port); - if (written < 0 || written >= len) - { - break; - } - pos += written; - len -= written; - } - } - enumerator->destroy(enumerator); - - if (compliant) - { - state->set_recommendation(state, - TNC_IMV_ACTION_RECOMMENDATION_ALLOW, - TNC_IMV_EVALUATION_RESULT_COMPLIANT); - } - else - { - imv_scanner_state_t *imv_scanner_state; - - imv_scanner_state = (imv_scanner_state_t*)state; - imv_scanner_state->set_violating_ports(imv_scanner_state, buf); - state->set_recommendation(state, - TNC_IMV_ACTION_RECOMMENDATION_NO_ACCESS, - TNC_IMV_EVALUATION_RESULT_NONCOMPLIANT_MAJOR); - } - } - } - enumerator->destroy(enumerator); - pa_tnc_msg->destroy(pa_tnc_msg); - - if (fatal_error) - { - state->set_recommendation(state, - TNC_IMV_ACTION_RECOMMENDATION_NO_RECOMMENDATION, - TNC_IMV_EVALUATION_RESULT_ERROR); - return imv_scanner->provide_recommendation(imv_scanner, connection_id); - } +/* include generic TGC TNC IF-IMV API code below */ - return imv_scanner->provide_recommendation(imv_scanner, connection_id); - } +#include <imv/imv_if.h> -/** - * see section 3.8.4 of TCG TNC IF-IMV Specification 1.3 - */ -TNC_Result TNC_IMV_ReceiveMessage(TNC_IMVID imv_id, - TNC_ConnectionID connection_id, - TNC_BufferReference msg, - TNC_UInt32 msg_len, - TNC_MessageType msg_type) -{ - TNC_VendorID msg_vid; - TNC_MessageSubtype msg_subtype; - - msg_vid = msg_type >> 8; - msg_subtype = msg_type & TNC_SUBTYPE_ANY; - - return receive_message(imv_id, connection_id, 0, chunk_create(msg, msg_len), - msg_vid, msg_subtype, 0, TNC_IMVID_ANY); -} - -/** - * see section 3.8.6 of TCG TNC IF-IMV Specification 1.3 - */ -TNC_Result TNC_IMV_ReceiveMessageLong(TNC_IMVID imv_id, - TNC_ConnectionID connection_id, - TNC_UInt32 msg_flags, - TNC_BufferReference msg, - TNC_UInt32 msg_len, - TNC_VendorID msg_vid, - TNC_MessageSubtype msg_subtype, - TNC_UInt32 src_imc_id, - TNC_UInt32 dst_imv_id) -{ - return receive_message(imv_id, connection_id, msg_flags, - chunk_create(msg, msg_len), msg_vid, msg_subtype, - src_imc_id, dst_imv_id); -} - -/** - * see section 3.8.7 of TCG TNC IF-IMV Specification 1.3 - */ -TNC_Result TNC_IMV_SolicitRecommendation(TNC_IMVID imv_id, - TNC_ConnectionID connection_id) -{ - if (!imv_scanner) - { - DBG1(DBG_IMV, "IMV \"%s\" has not been initialized", imv_name); - return TNC_RESULT_NOT_INITIALIZED; - } - return imv_scanner->provide_recommendation(imv_scanner, connection_id); -} - -/** - * see section 3.8.8 of TCG TNC IF-IMV Specification 1.3 - */ -TNC_Result TNC_IMV_BatchEnding(TNC_IMVID imv_id, - TNC_ConnectionID connection_id) -{ - if (!imv_scanner) - { - DBG1(DBG_IMV, "IMV \"%s\" has not been initialized", imv_name); - return TNC_RESULT_NOT_INITIALIZED; - } - return TNC_RESULT_SUCCESS; -} - -/** - * see section 3.8.9 of TCG TNC IF-IMV Specification 1.3 - */ -TNC_Result TNC_IMV_Terminate(TNC_IMVID imv_id) -{ - if (!imv_scanner) - { - DBG1(DBG_IMV, "IMV \"%s\" has not been initialized", imv_name); - return TNC_RESULT_NOT_INITIALIZED; - } - tcp_ports->destroy_function(tcp_ports, free); - udp_ports->destroy_function(udp_ports, free); - imv_scanner->destroy(imv_scanner); - imv_scanner = NULL; - - return TNC_RESULT_SUCCESS; -} - -/** - * see section 4.2.8.1 of TCG TNC IF-IMV Specification 1.3 - */ -TNC_Result TNC_IMV_ProvideBindFunction(TNC_IMVID imv_id, - TNC_TNCS_BindFunctionPointer bind_function) -{ - if (!imv_scanner) - { - DBG1(DBG_IMV, "IMV \"%s\" has not been initialized", imv_name); - return TNC_RESULT_NOT_INITIALIZED; - } - return imv_scanner->bind_functions(imv_scanner, bind_function); -} diff --git a/src/libimcv/plugins/imv_scanner/imv_scanner_agent.c b/src/libimcv/plugins/imv_scanner/imv_scanner_agent.c new file mode 100644 index 000000000..d1e093137 --- /dev/null +++ b/src/libimcv/plugins/imv_scanner/imv_scanner_agent.c @@ -0,0 +1,526 @@ +/* + * Copyright (C) 2013 Andreas Steffen + * HSR Hochschule fuer Technik Rapperswil + * + * This program is free software; you can redistribute it and/or modify it + * under the terms of the GNU General Public License as published by the + * Free Software Foundation; either version 2 of the License, or (at your + * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>. + * + * This program is distributed in the hope that it will be useful, but + * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY + * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License + * for more details. + */ + +#include "imv_scanner_agent.h" +#include "imv_scanner_state.h" + +#include <imcv.h> +#include <imv/imv_agent.h> +#include <imv/imv_msg.h> +#include <ietf/ietf_attr.h> +#include <ietf/ietf_attr_attr_request.h> +#include <ietf/ietf_attr_pa_tnc_error.h> +#include <ietf/ietf_attr_port_filter.h> + +#include <tncif_names.h> +#include <tncif_pa_subtypes.h> + +#include <pen/pen.h> +#include <utils/debug.h> +#include <utils/lexparser.h> + +typedef struct private_imv_scanner_agent_t private_imv_scanner_agent_t; + +/* Subscribed PA-TNC message subtypes */ +static pen_type_t msg_types[] = { + { PEN_IETF, PA_SUBTYPE_IETF_VPN } +}; + +/** + * Private data of an imv_scanner_agent_t object. + */ +struct private_imv_scanner_agent_t { + + /** + * Public members of imv_scanner_agent_t + */ + imv_agent_if_t public; + + /** + * IMV agent responsible for generic functions + */ + imv_agent_t *agent; + +}; + +METHOD(imv_agent_if_t, bind_functions, TNC_Result, + private_imv_scanner_agent_t *this, TNC_TNCS_BindFunctionPointer bind_function) +{ + return this->agent->bind_functions(this->agent, bind_function); +} + +METHOD(imv_agent_if_t, notify_connection_change, TNC_Result, + private_imv_scanner_agent_t *this, TNC_ConnectionID id, + TNC_ConnectionState new_state) +{ + imv_state_t *state; + + switch (new_state) + { + case TNC_CONNECTION_STATE_CREATE: + state = imv_scanner_state_create(id); + return this->agent->create_state(this->agent, state); + case TNC_CONNECTION_STATE_DELETE: + return this->agent->delete_state(this->agent, id); + default: + return this->agent->change_state(this->agent, id, new_state, NULL); + } +} + +/** + * Process a received message + */ +static TNC_Result receive_msg(private_imv_scanner_agent_t *this, + imv_state_t *state, imv_msg_t *in_msg) +{ + imv_msg_t *out_msg; + imv_scanner_state_t *scanner_state; + enumerator_t *enumerator; + pa_tnc_attr_t *attr; + pen_type_t type; + TNC_Result result; + ietf_attr_port_filter_t *port_filter_attr; + bool fatal_error = FALSE; + + /* parse received PA-TNC message and handle local and remote errors */ + result = in_msg->receive(in_msg, &fatal_error); + if (result != TNC_RESULT_SUCCESS) + { + return result; + } + + /* analyze PA-TNC attributes */ + enumerator = in_msg->create_attribute_enumerator(in_msg); + while (enumerator->enumerate(enumerator, &attr)) + { + type = attr->get_type(attr); + + if (type.vendor_id == PEN_IETF && type.type == IETF_ATTR_PORT_FILTER) + { + scanner_state = (imv_scanner_state_t*)state; + port_filter_attr = (ietf_attr_port_filter_t*)attr->get_ref(attr); + scanner_state->set_port_filter_attr(scanner_state, port_filter_attr); + } + } + enumerator->destroy(enumerator); + + if (fatal_error) + { + state->set_recommendation(state, + TNC_IMV_ACTION_RECOMMENDATION_NO_RECOMMENDATION, + TNC_IMV_EVALUATION_RESULT_ERROR); + out_msg = imv_msg_create_as_reply(in_msg); + result = out_msg->send_assessment(out_msg); + out_msg->destroy(out_msg); + if (result != TNC_RESULT_SUCCESS) + { + return result; + } + return this->agent->provide_recommendation(this->agent, state); + } + + return TNC_RESULT_SUCCESS; +} + +METHOD(imv_agent_if_t, receive_message, TNC_Result, + private_imv_scanner_agent_t *this, TNC_ConnectionID id, + TNC_MessageType msg_type, chunk_t msg) +{ + imv_state_t *state; + imv_msg_t *in_msg; + TNC_Result result; + + if (!this->agent->get_state(this->agent, id, &state)) + { + return TNC_RESULT_FATAL; + } + in_msg = imv_msg_create_from_data(this->agent, state, id, msg_type, msg); + result = receive_msg(this, state, in_msg); + in_msg->destroy(in_msg); + + return result; +} + +METHOD(imv_agent_if_t, receive_message_long, TNC_Result, + private_imv_scanner_agent_t *this, TNC_ConnectionID id, + TNC_UInt32 src_imc_id, TNC_UInt32 dst_imv_id, + TNC_VendorID msg_vid, TNC_MessageSubtype msg_subtype, chunk_t msg) +{ + imv_state_t *state; + imv_msg_t *in_msg; + TNC_Result result; + + if (!this->agent->get_state(this->agent, id, &state)) + { + return TNC_RESULT_FATAL; + } + in_msg = imv_msg_create_from_long_data(this->agent, state, id, + src_imc_id, dst_imv_id, msg_vid, msg_subtype, msg); + result = receive_msg(this, state, in_msg); + in_msg->destroy(in_msg); + + return result; + +} + +typedef struct port_range_t port_range_t; + +struct port_range_t { + u_int16_t start, stop; +}; + +/** + * Parse a TCP or UDP port list from an argument string + */ +static linked_list_t* get_port_list(u_int8_t protocol_family, + bool closed_port_policy, char *arg_str) +{ + chunk_t port_list, port_item, port_start; + port_range_t *port_range; + linked_list_t *list; + + list = linked_list_create(); + + port_list = chunk_from_str(arg_str); + DBG2(DBG_IMV, "list of %s ports that %s:", + (protocol_family == IPPROTO_TCP) ? "tcp" : "udp", + closed_port_policy ? "are allowed to be open" : "must be closed"); + + while (eat_whitespace(&port_list)) + { + if (!extract_token(&port_item, ' ', &port_list)) + { + /* reached last port item */ + port_item = port_list; + port_list = chunk_empty; + } + port_range = malloc_thing(port_range_t); + port_range->start = atoi(port_item.ptr); + + if (extract_token(&port_start, '-', &port_item) && port_item.len) + { + port_range->stop = atoi(port_item.ptr); + } + else + { + port_range->stop = port_range->start; + } + DBG2(DBG_IMV, "%5u - %5u", port_range->start, port_range->stop); + list->insert_last(list, port_range); + } + + return list; +} + +METHOD(imv_agent_if_t, batch_ending, TNC_Result, + private_imv_scanner_agent_t *this, TNC_ConnectionID id) +{ + imv_msg_t *out_msg; + imv_state_t *state; + imv_session_t *session; + imv_workitem_t *workitem; + imv_scanner_state_t *scanner_state; + imv_scanner_handshake_state_t handshake_state; + pa_tnc_attr_t *attr; + ietf_attr_port_filter_t *port_filter_attr; + TNC_IMVID imv_id; + TNC_Result result = TNC_RESULT_SUCCESS; + bool no_workitems = TRUE; + enumerator_t *enumerator; + + if (!this->agent->get_state(this->agent, id, &state)) + { + return TNC_RESULT_FATAL; + } + scanner_state = (imv_scanner_state_t*)state; + handshake_state = scanner_state->get_handshake_state(scanner_state); + port_filter_attr = scanner_state->get_port_filter_attr(scanner_state); + session = state->get_session(state); + imv_id = this->agent->get_id(this->agent); + + if (handshake_state == IMV_SCANNER_STATE_END) + { + return TNC_RESULT_SUCCESS; + } + + /* create an empty out message - we might need it */ + out_msg = imv_msg_create(this->agent, state, id, imv_id, TNC_IMCID_ANY, + msg_types[0]); + + if (!session) + { + DBG2(DBG_IMV, "no workitems available - no evaluation possible"); + state->set_recommendation(state, + TNC_IMV_ACTION_RECOMMENDATION_ALLOW, + TNC_IMV_EVALUATION_RESULT_DONT_KNOW); + result = out_msg->send_assessment(out_msg); + out_msg->destroy(out_msg); + scanner_state->set_handshake_state(scanner_state, IMV_SCANNER_STATE_END); + + if (result != TNC_RESULT_SUCCESS) + { + return result; + } + return this->agent->provide_recommendation(this->agent, state); + } + + if (handshake_state == IMV_SCANNER_STATE_INIT) + { + enumerator = session->create_workitem_enumerator(session); + if (enumerator) + { + while (enumerator->enumerate(enumerator, &workitem)) + { + if (workitem->get_imv_id(workitem) != TNC_IMVID_ANY) + { + continue; + } + + switch (workitem->get_type(workitem)) + { + case IMV_WORKITEM_TCP_PORT_OPEN: + case IMV_WORKITEM_TCP_PORT_BLOCK: + case IMV_WORKITEM_UDP_PORT_OPEN: + case IMV_WORKITEM_UDP_PORT_BLOCK: + if (!port_filter_attr && + handshake_state != IMV_SCANNER_STATE_ATTR_REQ) + { + attr = ietf_attr_attr_request_create(PEN_IETF, + IETF_ATTR_PORT_FILTER); + out_msg->add_attribute(out_msg, attr); + handshake_state = IMV_SCANNER_STATE_ATTR_REQ; + } + break; + default: + continue; + } + workitem->set_imv_id(workitem, imv_id); + no_workitems = FALSE; + } + enumerator->destroy(enumerator); + + if (no_workitems) + { + DBG2(DBG_IMV, "IMV %d has no workitems - " + "no evaluation requested", imv_id); + state->set_recommendation(state, + TNC_IMV_ACTION_RECOMMENDATION_ALLOW, + TNC_IMV_EVALUATION_RESULT_DONT_KNOW); + } + handshake_state = IMV_SCANNER_STATE_WORKITEMS; + scanner_state->set_handshake_state(scanner_state, handshake_state); + } + } + + if (handshake_state == IMV_SCANNER_STATE_WORKITEMS && port_filter_attr) + { + TNC_IMV_Evaluation_Result eval; + TNC_IMV_Action_Recommendation rec; + u_int8_t protocol_family, protocol; + u_int16_t port; + bool closed_port_policy, blocked, first; + char result_str[BUF_LEN], *pos, *protocol_str; + size_t len; + int written; + linked_list_t *port_list; + enumerator_t *e1, *e2; + + enumerator = session->create_workitem_enumerator(session); + while (enumerator->enumerate(enumerator, &workitem)) + { + if (workitem->get_imv_id(workitem) != imv_id) + { + continue; + } + eval = TNC_IMV_EVALUATION_RESULT_COMPLIANT; + + switch (workitem->get_type(workitem)) + { + case IMV_WORKITEM_TCP_PORT_OPEN: + protocol_family = IPPROTO_TCP; + closed_port_policy = TRUE; + break; + case IMV_WORKITEM_TCP_PORT_BLOCK: + protocol_family = IPPROTO_TCP; + closed_port_policy = FALSE; + break; + case IMV_WORKITEM_UDP_PORT_OPEN: + protocol_family = IPPROTO_UDP; + closed_port_policy = TRUE; + break; + case IMV_WORKITEM_UDP_PORT_BLOCK: + protocol_family = IPPROTO_UDP; + closed_port_policy = FALSE; + break; + default: + continue; + } + port_list = get_port_list(protocol_family, closed_port_policy, + workitem->get_arg_str(workitem)); + protocol_str = (protocol_family == IPPROTO_TCP) ? "tcp" : "udp"; + result_str[0] = '\0'; + pos = result_str; + len = BUF_LEN; + first = TRUE; + + e1 = port_filter_attr->create_port_enumerator(port_filter_attr); + while (e1->enumerate(e1, &blocked, &protocol, &port)) + { + port_range_t *port_range; + bool passed, found = FALSE; + char buf[20]; + + if (blocked || protocol != protocol_family) + { + /* ignore closed ports or non-matching protocols */ + continue; + } + + e2 = port_list->create_enumerator(port_list); + while (e2->enumerate(e2, &port_range)) + { + if (port >= port_range->start && port <= port_range->stop) + { + found = TRUE; + break; + } + } + e2->destroy(e2); + + passed = (closed_port_policy == found); + DBG2(DBG_IMV, "%s port %5u open: %s", protocol_str, port, + passed ? "ok" : "fatal"); + if (!passed) + { + eval = TNC_IMV_EVALUATION_RESULT_NONCOMPLIANT_MINOR; + snprintf(buf, sizeof(buf), "%s/%u", protocol_str, port); + scanner_state->add_violating_port(scanner_state, strdup(buf)); + if (first) + { + written = snprintf(pos, len, "violating %s ports:", + protocol_str); + if (written > 0 && written < len) + { + pos += written; + len -= written; + } + first = FALSE; + } + written = snprintf(pos, len, " %u", port); + if (written < 0 || written >= len) + { + pos += len - 1; + *pos = '\0'; + } + else + { + pos += written; + len -= written; + } + } + } + e1->destroy(e1); + + if (first) + { + snprintf(pos, len, "no violating %s ports", protocol_str); + } + port_list->destroy(port_list); + + session->remove_workitem(session, enumerator); + rec = workitem->set_result(workitem, result_str, eval); + state->update_recommendation(state, rec, eval); + imcv_db->finalize_workitem(imcv_db, workitem); + workitem->destroy(workitem); + } + enumerator->destroy(enumerator); + } + + /* finalized all workitems ? */ + if (handshake_state == IMV_SCANNER_STATE_WORKITEMS && + session->get_workitem_count(session, imv_id) == 0) + { + result = out_msg->send_assessment(out_msg); + out_msg->destroy(out_msg); + scanner_state->set_handshake_state(scanner_state, IMV_SCANNER_STATE_END); + + if (result != TNC_RESULT_SUCCESS) + { + return result; + } + return this->agent->provide_recommendation(this->agent, state); + } + + /* send non-empty PA-TNC message with excl flag not set */ + if (out_msg->get_attribute_count(out_msg)) + { + result = out_msg->send(out_msg, FALSE); + } + out_msg->destroy(out_msg); + + return result; +} + +METHOD(imv_agent_if_t, solicit_recommendation, TNC_Result, + private_imv_scanner_agent_t *this, TNC_ConnectionID id) +{ + imv_state_t *state; + + if (!this->agent->get_state(this->agent, id, &state)) + { + return TNC_RESULT_FATAL; + } + return this->agent->provide_recommendation(this->agent, state); +} + +METHOD(imv_agent_if_t, destroy, void, + private_imv_scanner_agent_t *this) +{ + this->agent->destroy(this->agent); + free(this); +} + +/** + * Described in header. + */ +imv_agent_if_t *imv_scanner_agent_create(const char *name, TNC_IMVID id, + TNC_Version *actual_version) +{ + private_imv_scanner_agent_t *this; + imv_agent_t *agent; + + agent = imv_agent_create(name, msg_types, countof(msg_types), id, + actual_version); + if (!agent) + { + return NULL; + } + + INIT(this, + .public = { + .bind_functions = _bind_functions, + .notify_connection_change = _notify_connection_change, + .receive_message = _receive_message, + .receive_message_long = _receive_message_long, + .batch_ending = _batch_ending, + .solicit_recommendation = _solicit_recommendation, + .destroy = _destroy, + }, + .agent = agent, + ); + + return &this->public; +} + diff --git a/src/libimcv/plugins/imv_scanner/imv_scanner_agent.h b/src/libimcv/plugins/imv_scanner/imv_scanner_agent.h new file mode 100644 index 000000000..155453363 --- /dev/null +++ b/src/libimcv/plugins/imv_scanner/imv_scanner_agent.h @@ -0,0 +1,36 @@ +/* + * Copyright (C) 2013 Andreas Steffen + * HSR Hochschule fuer Technik Rapperswil + * + * This program is free software; you can redistribute it and/or modify it + * under the terms of the GNU General Public License as published by the + * Free Software Foundation; either version 2 of the License, or (at your + * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>. + * + * This program is distributed in the hope that it will be useful, but + * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY + * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License + * for more details. + */ + +/** + * @defgroup imv_scanner_agent_t imv_scanner_agent + * @{ @ingroup imv_scanner + */ + +#ifndef IMV_SCANNER_AGENT_H_ +#define IMV_SCANNER_AGENT_H_ + +#include <imv/imv_agent_if.h> + +/** + * Creates a Scanner IMV agent + * + * @param name Name of the IMV + * @param id ID of the IMV + * @param actual_version TNC IF-IMV version + */ +imv_agent_if_t* imv_scanner_agent_create(const char* name, TNC_IMVID id, + TNC_Version *actual_version); + +#endif /** IMV_SCANNER_AGENT_H_ @}*/ diff --git a/src/libimcv/plugins/imv_scanner/imv_scanner_state.c b/src/libimcv/plugins/imv_scanner/imv_scanner_state.c index 422cb980d..4c570c46a 100644 --- a/src/libimcv/plugins/imv_scanner/imv_scanner_state.c +++ b/src/libimcv/plugins/imv_scanner/imv_scanner_state.c @@ -1,5 +1,6 @@ /* - * Copyright (C) 2011 Andreas Steffen, HSR Hochschule fuer Technik Rapperswil + * Copyright (C) 2011-2013 Andreas Steffen + * HSR Hochschule fuer Technik Rapperswil * * This program is free software; you can redistribute it and/or modify it * under the terms of the GNU General Public License as published by the @@ -13,9 +14,14 @@ */ #include "imv_scanner_state.h" +#include "imv/imv_lang_string.h" +#include "imv/imv_reason_string.h" +#include "imv/imv_remediation_string.h" + +#include <tncif_policy.h> #include <utils/lexparser.h> -#include <debug.h> +#include <utils/debug.h> typedef struct private_imv_scanner_state_t private_imv_scanner_state_t; @@ -50,6 +56,31 @@ struct private_imv_scanner_state_t { bool has_excl; /** + * Maximum PA-TNC message size for this TNCCS connection + */ + u_int32_t max_msg_len; + + /** + * Flags set for completed actions + */ + u_int32_t action_flags; + + /** + * Access Requestor ID Type + */ + u_int32_t ar_id_type; + + /** + * Access Requestor ID Value + */ + chunk_t ar_id_value; + + /** + * IMV database session associatied with TNCCS connection + */ + imv_session_t *session; + + /** * IMV action recommendation */ TNC_IMV_Action_Recommendation rec; @@ -60,34 +91,73 @@ struct private_imv_scanner_state_t { TNC_IMV_Evaluation_Result eval; /** - * String with list of ports that should be closed + * IMV Scanner handshake state + */ + imv_scanner_handshake_state_t handshake_state; + + /** + * Copy of the received IEEE Port Filter attribute + */ + ietf_attr_port_filter_t *port_filter_attr; + + /** + * List with ports that should be closed */ - char *violating_ports; + linked_list_t *violating_ports; /** - * Local copy of the reason string + * TNC Reason String */ - chunk_t reason_string; + imv_reason_string_t *reason_string; + + /** + * IETF Remediation Instructions String + */ + imv_remediation_string_t *remediation_string; + }; -typedef struct entry_t entry_t; +/** + * Supported languages + */ +static char* languages[] = { "en", "de", "fr", "pl" }; /** - * Define an internal reason string entry + * Reason strings for "Port Filter" */ -struct entry_t { - char *lang; - char *string; +static imv_lang_string_t reasons[] = { + { "en", "Open server ports were detected" }, + { "de", "Offene Serverports wurden festgestellt" }, + { "fr", "Il y a des ports du serveur ouverts" }, + { "pl", "Są otwarte porty serwera" }, + { NULL, NULL } }; /** - * Table of multi-lingual reason string entries + * Instruction strings for "Port Filters" */ -static entry_t reasons[] = { - { "en", "The following ports are open:" }, - { "de", "Die folgenden Ports sind offen" }, - { "fr", "Les ports suivants sont ouverts:" }, - { "pl", "Następujące porty sa otwarte:" } +static imv_lang_string_t instr_ports_title[] = { + { "en", "Open Server Ports" }, + { "de", "Offene Server Ports" }, + { "fr", "Ports ouverts du serveur" }, + { "pl", "Otwarte Porty Serwera" }, + { NULL, NULL } +}; + +static imv_lang_string_t instr_ports_descr[] = { + { "en", "Open Internet ports have been detected" }, + { "de", "Offenen Internet-Ports wurden festgestellt" }, + { "fr", "Il y'a des ports Internet ouverts" }, + { "pl", "Porty internetowe są otwarte" }, + { NULL, NULL } +}; + +static imv_lang_string_t instr_ports_header[] = { + { "en", "Please close the following server ports:" }, + { "de", "Bitte schliessen Sie die folgenden Serverports:" }, + { "fr", "Fermez les ports du serveur suivants s'il vous plait:" }, + { "pl", "Proszę zamknąć następujące porty serwera:" }, + { NULL, NULL } }; METHOD(imv_state_t, get_connection_id, TNC_ConnectionID, @@ -115,6 +185,59 @@ METHOD(imv_state_t, set_flags, void, this->has_excl = has_excl; } +METHOD(imv_state_t, set_max_msg_len, void, + private_imv_scanner_state_t *this, u_int32_t max_msg_len) +{ + this->max_msg_len = max_msg_len; +} + +METHOD(imv_state_t, get_max_msg_len, u_int32_t, + private_imv_scanner_state_t *this) +{ + return this->max_msg_len; +} + +METHOD(imv_state_t, set_action_flags, void, + private_imv_scanner_state_t *this, u_int32_t flags) +{ + this->action_flags |= flags; +} + +METHOD(imv_state_t, get_action_flags, u_int32_t, + private_imv_scanner_state_t *this) +{ + return this->action_flags; +} + +METHOD(imv_state_t, set_ar_id, void, + private_imv_scanner_state_t *this, u_int32_t id_type, chunk_t id_value) +{ + this->ar_id_type = id_type; + this->ar_id_value = chunk_clone(id_value); +} + +METHOD(imv_state_t, get_ar_id, chunk_t, + private_imv_scanner_state_t *this, u_int32_t *id_type) +{ + if (id_type) + { + *id_type = this->ar_id_type; + } + return this->ar_id_value; +} + +METHOD(imv_state_t, set_session, void, + private_imv_scanner_state_t *this, imv_session_t *session) +{ + this->session = session; +} + +METHOD(imv_state_t, get_session, imv_session_t*, + private_imv_scanner_state_t *this) +{ + return this->session; +} + METHOD(imv_state_t, change_state, void, private_imv_scanner_state_t *this, TNC_ConnectionState new_state) { @@ -123,7 +246,7 @@ METHOD(imv_state_t, change_state, void, METHOD(imv_state_t, get_recommendation, void, private_imv_scanner_state_t *this, TNC_IMV_Action_Recommendation *rec, - TNC_IMV_Evaluation_Result *eval) + TNC_IMV_Evaluation_Result *eval) { *rec = this->rec; *eval = this->eval; @@ -131,82 +254,112 @@ METHOD(imv_state_t, get_recommendation, void, METHOD(imv_state_t, set_recommendation, void, private_imv_scanner_state_t *this, TNC_IMV_Action_Recommendation rec, - TNC_IMV_Evaluation_Result eval) + TNC_IMV_Evaluation_Result eval) { this->rec = rec; this->eval = eval; } -METHOD(imv_state_t, get_reason_string, bool, - private_imv_scanner_state_t *this, chunk_t preferred_language, - chunk_t *reason_string, chunk_t *reason_language) +METHOD(imv_state_t, update_recommendation, void, + private_imv_scanner_state_t *this, TNC_IMV_Action_Recommendation rec, + TNC_IMV_Evaluation_Result eval) { - chunk_t pref_lang, lang; - u_char *pos; - int i; + this->rec = tncif_policy_update_recommendation(this->rec, rec); + this->eval = tncif_policy_update_evaluation(this->eval, eval); +} - if (!this->violating_ports) +METHOD(imv_state_t, get_reason_string, bool, + private_imv_scanner_state_t *this, enumerator_t *language_enumerator, + chunk_t *reason_string, char **reason_language) +{ + if (this->violating_ports->get_count(this->violating_ports) == 0) { return FALSE; } + *reason_language = imv_lang_string_select_lang(language_enumerator, + languages, countof(languages)); - while (eat_whitespace(&preferred_language)) + /* Instantiate a TNC Reason String object */ + DESTROY_IF(this->reason_string); + this->reason_string = imv_reason_string_create(*reason_language); + if (this->rec != TNC_IMV_ACTION_RECOMMENDATION_NO_RECOMMENDATION) { - if (!extract_token(&pref_lang, ',', &preferred_language)) - { - /* last entry in a comma-separated list or single entry */ - pref_lang = preferred_language; - } - - /* eat trailing whitespace */ - pos = pref_lang.ptr + pref_lang.len - 1; - while (pref_lang.len && *pos-- == ' ') - { - pref_lang.len--; - } - - for (i = 0 ; i < countof(reasons); i++) - { - lang = chunk_create(reasons[i].lang, strlen(reasons[i].lang)); - if (chunk_equals(lang, pref_lang)) - { - this->reason_string = chunk_cat("cc", - chunk_create(reasons[i].string, - strlen(reasons[i].string)), - chunk_create(this->violating_ports, - strlen(this->violating_ports))); - *reason_string = this->reason_string; - *reason_language = lang; - return TRUE; - } - } + this->reason_string->add_reason(this->reason_string, reasons); } + *reason_string = this->reason_string->get_encoding(this->reason_string); - /* no preferred language match found - use the default language */ + return TRUE; +} + +METHOD(imv_state_t, get_remediation_instructions, bool, + private_imv_scanner_state_t *this, enumerator_t *language_enumerator, + chunk_t *string, char **lang_code, char **uri) +{ + if (this->violating_ports->get_count(this->violating_ports) == 0) + { + return FALSE; + } + *lang_code = imv_lang_string_select_lang(language_enumerator, + languages, countof(languages)); + + /* Instantiate an IETF Remediation Instructions String object */ + DESTROY_IF(this->remediation_string); + this->remediation_string = imv_remediation_string_create( + TRUE, *lang_code); /* TODO get os_type */ + + this->remediation_string->add_instruction(this->remediation_string, + instr_ports_title, + instr_ports_descr, + instr_ports_header, + this->violating_ports); + *string = this->remediation_string->get_encoding(this->remediation_string); + *uri = lib->settings->get_str(lib->settings, + "libimcv.plugins.imv-scanner.remediation_uri", NULL); - this->reason_string = chunk_cat("cc", - chunk_create(reasons[0].string, - strlen(reasons[0].string)), - chunk_create(this->violating_ports, - strlen(this->violating_ports))); - *reason_string = this->reason_string; - *reason_language = chunk_create(reasons[0].lang, - strlen(reasons[0].lang)); return TRUE; } METHOD(imv_state_t, destroy, void, private_imv_scanner_state_t *this) { - free(this->violating_ports); - free(this->reason_string.ptr); + DESTROY_IF(this->session); + DESTROY_IF(this->reason_string); + DESTROY_IF(this->remediation_string); + DESTROY_IF(&this->port_filter_attr->pa_tnc_attribute); + this->violating_ports->destroy_function(this->violating_ports, free); + free(this->ar_id_value.ptr); free(this); } -METHOD(imv_scanner_state_t, set_violating_ports, void, - private_imv_scanner_state_t *this, char *ports) +METHOD(imv_scanner_state_t, set_handshake_state, void, + private_imv_scanner_state_t *this, imv_scanner_handshake_state_t new_state) +{ + this->handshake_state = new_state; +} + +METHOD(imv_scanner_state_t, get_handshake_state, imv_scanner_handshake_state_t, + private_imv_scanner_state_t *this) +{ + return this->handshake_state; +} + +METHOD(imv_scanner_state_t, set_port_filter_attr, void, + private_imv_scanner_state_t *this, ietf_attr_port_filter_t *attr) { - this->violating_ports = strdup(ports); + DESTROY_IF(&this->port_filter_attr->pa_tnc_attribute); + this->port_filter_attr = attr; +} + +METHOD(imv_scanner_state_t, get_port_filter_attr, ietf_attr_port_filter_t*, + private_imv_scanner_state_t *this) +{ + return this->port_filter_attr; +} + +METHOD(imv_scanner_state_t, add_violating_port, void, + private_imv_scanner_state_t *this, char *port) +{ + this->violating_ports->insert_last(this->violating_ports, port); } /** @@ -223,20 +376,35 @@ imv_state_t *imv_scanner_state_create(TNC_ConnectionID connection_id) .has_long = _has_long, .has_excl = _has_excl, .set_flags = _set_flags, + .set_max_msg_len = _set_max_msg_len, + .get_max_msg_len = _get_max_msg_len, + .set_action_flags = _set_action_flags, + .get_action_flags = _get_action_flags, + .set_ar_id = _set_ar_id, + .get_ar_id = _get_ar_id, + .set_session = _set_session, + .get_session= _get_session, .change_state = _change_state, .get_recommendation = _get_recommendation, .set_recommendation = _set_recommendation, + .update_recommendation = _update_recommendation, .get_reason_string = _get_reason_string, + .get_remediation_instructions = _get_remediation_instructions, .destroy = _destroy, }, - .set_violating_ports = _set_violating_ports, + .set_handshake_state = _set_handshake_state, + .get_handshake_state = _get_handshake_state, + .set_port_filter_attr = _set_port_filter_attr, + .get_port_filter_attr = _get_port_filter_attr, + .add_violating_port = _add_violating_port, }, .state = TNC_CONNECTION_STATE_CREATE, .rec = TNC_IMV_ACTION_RECOMMENDATION_NO_RECOMMENDATION, .eval = TNC_IMV_EVALUATION_RESULT_DONT_KNOW, .connection_id = connection_id, + .violating_ports = linked_list_create(), ); - + return &this->public.interface; } diff --git a/src/libimcv/plugins/imv_scanner/imv_scanner_state.h b/src/libimcv/plugins/imv_scanner/imv_scanner_state.h index 716ddfea0..7f147f864 100644 --- a/src/libimcv/plugins/imv_scanner/imv_scanner_state.h +++ b/src/libimcv/plugins/imv_scanner/imv_scanner_state.h @@ -1,5 +1,6 @@ /* - * Copyright (C) 2011 Andreas Steffen, HSR Hochschule fuer Technik Rapperswil + * Copyright (C) 2011-2013 Andreas Steffen + * HSR Hochschule fuer Technik Rapperswil * * This program is free software; you can redistribute it and/or modify it * under the terms of the GNU General Public License as published by the @@ -13,18 +14,33 @@ */ /** + * @defgroup imv_scanner imv_scanner + * @ingroup libimcv_plugins * * @defgroup imv_scanner_state_t imv_scanner_state - * @{ @ingroup imv_scanner_state + * @{ @ingroup imv_scanner */ #ifndef IMV_SCANNER_STATE_H_ #define IMV_SCANNER_STATE_H_ #include <imv/imv_state.h> +#include <ietf/ietf_attr_port_filter.h> + #include <library.h> typedef struct imv_scanner_state_t imv_scanner_state_t; +typedef enum imv_scanner_handshake_state_t imv_scanner_handshake_state_t; + +/** + * IMV Scanner Handshake States (state machine) + */ +enum imv_scanner_handshake_state_t { + IMV_SCANNER_STATE_INIT, + IMV_SCANNER_STATE_ATTR_REQ, + IMV_SCANNER_STATE_WORKITEMS, + IMV_SCANNER_STATE_END +}; /** * Internal state of an imv_scanner_t connection instance @@ -37,9 +53,39 @@ struct imv_scanner_state_t { imv_state_t interface; /** - * list of violating TCP and UDP ports + * Set state of the handshake + * + * @param new_state the handshake state of IMV + */ + void (*set_handshake_state)(imv_scanner_state_t *this, + imv_scanner_handshake_state_t new_state); + + /** + * Get state of the handshake + * + * @return the handshake state of IMV + */ + imv_scanner_handshake_state_t (*get_handshake_state)(imv_scanner_state_t *this); + + /** + * Store an IETF Port Filter attribute for later evaluation + * + * @param attr IETF Port Filter attribute + */ + void (*set_port_filter_attr)(imv_scanner_state_t *this, + ietf_attr_port_filter_t *attr); + + /** + * Get the stored IETF Port Filter attribute + * + * @return IETF Port Filter attribute + */ + ietf_attr_port_filter_t* (*get_port_filter_attr)(imv_scanner_state_t *this); + + /** + * add a violating TCP or UDP port */ - void (*set_violating_ports)(imv_scanner_state_t *this, char *ports); + void (*add_violating_port)(imv_scanner_state_t *this, char *port); }; /** diff --git a/src/libimcv/plugins/imv_test/Makefile.am b/src/libimcv/plugins/imv_test/Makefile.am index 4ca5b852b..34922867e 100644 --- a/src/libimcv/plugins/imv_test/Makefile.am +++ b/src/libimcv/plugins/imv_test/Makefile.am @@ -1,15 +1,18 @@ - -INCLUDES = -I$(top_srcdir)/src/libstrongswan -I$(top_srcdir)/src/libtncif \ +AM_CPPFLAGS = \ + -I$(top_srcdir)/src/libstrongswan \ + -I$(top_srcdir)/src/libtncif \ -I$(top_srcdir)/src/libimcv -AM_CFLAGS = -rdynamic +AM_CFLAGS = \ + -rdynamic imcv_LTLIBRARIES = imv-test.la imv_test_la_LIBADD = $(top_builddir)/src/libimcv/libimcv.la \ $(top_builddir)/src/libstrongswan/libstrongswan.la -imv_test_la_SOURCES = imv_test.c imv_test_state.h imv_test_state.c +imv_test_la_SOURCES = \ + imv_test.c imv_test_state.h imv_test_state.c \ + imv_test_agent.h imv_test_agent.c imv_test_la_LDFLAGS = -module -avoid-version - diff --git a/src/libimcv/plugins/imv_test/Makefile.in b/src/libimcv/plugins/imv_test/Makefile.in index e51ad9afd..e77573395 100644 --- a/src/libimcv/plugins/imv_test/Makefile.in +++ b/src/libimcv/plugins/imv_test/Makefile.in @@ -1,9 +1,9 @@ -# Makefile.in generated by automake 1.11.1 from Makefile.am. +# Makefile.in generated by automake 1.11.6 from Makefile.am. # @configure_input@ # Copyright (C) 1994, 1995, 1996, 1997, 1998, 1999, 2000, 2001, 2002, -# 2003, 2004, 2005, 2006, 2007, 2008, 2009 Free Software Foundation, -# Inc. +# 2003, 2004, 2005, 2006, 2007, 2008, 2009, 2010, 2011 Free Software +# Foundation, Inc. # This Makefile.in is free software; the Free Software Foundation # gives unlimited permission to copy and/or distribute it, # with or without modifications, as long as this notice is preserved. @@ -16,6 +16,23 @@ @SET_MAKE@ VPATH = @srcdir@ +am__make_dryrun = \ + { \ + am__dry=no; \ + case $$MAKEFLAGS in \ + *\\[\ \ ]*) \ + echo 'am--echo: ; @echo "AM" OK' | $(MAKE) -f - 2>/dev/null \ + | grep '^AM OK$$' >/dev/null || am__dry=yes;; \ + *) \ + for am__flg in $$MAKEFLAGS; do \ + case $$am__flg in \ + *=*|--*) ;; \ + *n*) am__dry=yes; break;; \ + esac; \ + done;; \ + esac; \ + test $$am__dry = yes; \ + } pkgdatadir = $(datadir)/@PACKAGE@ pkgincludedir = $(includedir)/@PACKAGE@ pkglibdir = $(libdir)/@PACKAGE@ @@ -45,10 +62,11 @@ am__aclocal_m4_deps = $(top_srcdir)/m4/config/libtool.m4 \ $(top_srcdir)/m4/macros/with.m4 \ $(top_srcdir)/m4/macros/enable-disable.m4 \ $(top_srcdir)/m4/macros/add-plugin.m4 \ - $(top_srcdir)/configure.in + $(top_srcdir)/configure.ac am__configure_deps = $(am__aclocal_m4_deps) $(CONFIGURE_DEPENDENCIES) \ $(ACLOCAL_M4) mkinstalldirs = $(install_sh) -d +CONFIG_HEADER = $(top_builddir)/config.h CONFIG_CLEAN_FILES = CONFIG_CLEAN_VPATH_FILES = am__vpath_adj_setup = srcdirstrip=`echo "$(srcdir)" | sed 's|.|.|g'`; @@ -72,51 +90,86 @@ am__nobase_list = $(am__nobase_strip_setup); \ am__base_list = \ sed '$$!N;$$!N;$$!N;$$!N;$$!N;$$!N;$$!N;s/\n/ /g' | \ sed '$$!N;$$!N;$$!N;$$!N;s/\n/ /g' +am__uninstall_files_from_dir = { \ + test -z "$$files" \ + || { test ! -d "$$dir" && test ! -f "$$dir" && test ! -r "$$dir"; } \ + || { echo " ( cd '$$dir' && rm -f" $$files ")"; \ + $(am__cd) "$$dir" && rm -f $$files; }; \ + } am__installdirs = "$(DESTDIR)$(imcvdir)" LTLIBRARIES = $(imcv_LTLIBRARIES) imv_test_la_DEPENDENCIES = $(top_builddir)/src/libimcv/libimcv.la \ $(top_builddir)/src/libstrongswan/libstrongswan.la -am_imv_test_la_OBJECTS = imv_test.lo imv_test_state.lo +am_imv_test_la_OBJECTS = imv_test.lo imv_test_state.lo \ + imv_test_agent.lo imv_test_la_OBJECTS = $(am_imv_test_la_OBJECTS) -imv_test_la_LINK = $(LIBTOOL) --tag=CC $(AM_LIBTOOLFLAGS) \ +AM_V_lt = $(am__v_lt_@AM_V@) +am__v_lt_ = $(am__v_lt_@AM_DEFAULT_V@) +am__v_lt_0 = --silent +imv_test_la_LINK = $(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) \ $(LIBTOOLFLAGS) --mode=link $(CCLD) $(AM_CFLAGS) $(CFLAGS) \ $(imv_test_la_LDFLAGS) $(LDFLAGS) -o $@ -DEFAULT_INCLUDES = -I.@am__isrc@ +DEFAULT_INCLUDES = -I.@am__isrc@ -I$(top_builddir) depcomp = $(SHELL) $(top_srcdir)/depcomp am__depfiles_maybe = depfiles am__mv = mv -f COMPILE = $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) \ $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -LTCOMPILE = $(LIBTOOL) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) \ - --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) \ - $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) +LTCOMPILE = $(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) \ + $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) \ + $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) \ + $(AM_CFLAGS) $(CFLAGS) +AM_V_CC = $(am__v_CC_@AM_V@) +am__v_CC_ = $(am__v_CC_@AM_DEFAULT_V@) +am__v_CC_0 = @echo " CC " $@; +AM_V_at = $(am__v_at_@AM_V@) +am__v_at_ = $(am__v_at_@AM_DEFAULT_V@) +am__v_at_0 = @ CCLD = $(CC) -LINK = $(LIBTOOL) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) \ - --mode=link $(CCLD) $(AM_CFLAGS) $(CFLAGS) $(AM_LDFLAGS) \ - $(LDFLAGS) -o $@ +LINK = $(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) \ + $(LIBTOOLFLAGS) --mode=link $(CCLD) $(AM_CFLAGS) $(CFLAGS) \ + $(AM_LDFLAGS) $(LDFLAGS) -o $@ +AM_V_CCLD = $(am__v_CCLD_@AM_V@) +am__v_CCLD_ = $(am__v_CCLD_@AM_DEFAULT_V@) +am__v_CCLD_0 = @echo " CCLD " $@; +AM_V_GEN = $(am__v_GEN_@AM_V@) +am__v_GEN_ = $(am__v_GEN_@AM_DEFAULT_V@) +am__v_GEN_0 = @echo " GEN " $@; SOURCES = $(imv_test_la_SOURCES) DIST_SOURCES = $(imv_test_la_SOURCES) +am__can_run_installinfo = \ + case $$AM_UPDATE_INFO_DIR in \ + n|no|NO) false;; \ + *) (install-info --version) >/dev/null 2>&1;; \ + esac ETAGS = etags CTAGS = ctags DISTFILES = $(DIST_COMMON) $(DIST_SOURCES) $(TEXINFOS) $(EXTRA_DIST) ACLOCAL = @ACLOCAL@ ALLOCA = @ALLOCA@ AMTAR = @AMTAR@ +AM_DEFAULT_VERBOSITY = @AM_DEFAULT_VERBOSITY@ AR = @AR@ AUTOCONF = @AUTOCONF@ AUTOHEADER = @AUTOHEADER@ AUTOMAKE = @AUTOMAKE@ AWK = @AWK@ +BFDLIB = @BFDLIB@ BTLIB = @BTLIB@ CC = @CC@ CCDEPMODE = @CCDEPMODE@ CFLAGS = @CFLAGS@ +CHECK_CFLAGS = @CHECK_CFLAGS@ +CHECK_LIBS = @CHECK_LIBS@ +COVERAGE_CFLAGS = @COVERAGE_CFLAGS@ +COVERAGE_LDFLAGS = @COVERAGE_LDFLAGS@ CPP = @CPP@ CPPFLAGS = @CPPFLAGS@ CYGPATH_W = @CYGPATH_W@ DEFS = @DEFS@ DEPDIR = @DEPDIR@ DLLIB = @DLLIB@ +DLLTOOL = @DLLTOOL@ DSYMUTIL = @DSYMUTIL@ DUMPBIN = @DUMPBIN@ ECHO_C = @ECHO_C@ @@ -125,13 +178,16 @@ ECHO_T = @ECHO_T@ EGREP = @EGREP@ EXEEXT = @EXEEXT@ FGREP = @FGREP@ +GENHTML = @GENHTML@ GPERF = @GPERF@ +GPRBUILD = @GPRBUILD@ GREP = @GREP@ INSTALL = @INSTALL@ INSTALL_DATA = @INSTALL_DATA@ INSTALL_PROGRAM = @INSTALL_PROGRAM@ INSTALL_SCRIPT = @INSTALL_SCRIPT@ INSTALL_STRIP_PROGRAM = @INSTALL_STRIP_PROGRAM@ +LCOV = @LCOV@ LD = @LD@ LDFLAGS = @LDFLAGS@ LEX = @LEX@ @@ -144,6 +200,7 @@ LIPO = @LIPO@ LN_S = @LN_S@ LTLIBOBJS = @LTLIBOBJS@ MAKEINFO = @MAKEINFO@ +MANIFEST_TOOL = @MANIFEST_TOOL@ MKDIR_P = @MKDIR_P@ MYSQLCFLAG = @MYSQLCFLAG@ MYSQLCONFIG = @MYSQLCONFIG@ @@ -171,11 +228,13 @@ RANLIB = @RANLIB@ RTLIB = @RTLIB@ RUBY = @RUBY@ RUBYINCLUDE = @RUBYINCLUDE@ +RUBYLIB = @RUBYLIB@ SED = @SED@ SET_MAKE = @SET_MAKE@ SHELL = @SHELL@ SOCKLIB = @SOCKLIB@ STRIP = @STRIP@ +UNWINDLIB = @UNWINDLIB@ VERSION = @VERSION@ YACC = @YACC@ YFLAGS = @YFLAGS@ @@ -183,6 +242,7 @@ abs_builddir = @abs_builddir@ abs_srcdir = @abs_srcdir@ abs_top_builddir = @abs_top_builddir@ abs_top_srcdir = @abs_top_srcdir@ +ac_ct_AR = @ac_ct_AR@ ac_ct_CC = @ac_ct_CC@ ac_ct_DUMPBIN = @ac_ct_DUMPBIN@ am__include = @am__include@ @@ -191,8 +251,6 @@ am__quote = @am__quote@ am__tar = @am__tar@ am__untar = @am__untar@ attest_plugins = @attest_plugins@ -axis2c_CFLAGS = @axis2c_CFLAGS@ -axis2c_LIBS = @axis2c_LIBS@ bindir = @bindir@ build = @build@ build_alias = @build_alias@ @@ -201,14 +259,19 @@ build_os = @build_os@ build_vendor = @build_vendor@ builddir = @builddir@ c_plugins = @c_plugins@ +charon_natt_port = @charon_natt_port@ +charon_plugins = @charon_plugins@ +charon_udp_port = @charon_udp_port@ clearsilver_LIBS = @clearsilver_LIBS@ +cmd_plugins = @cmd_plugins@ datadir = @datadir@ datarootdir = @datarootdir@ dbusservicedir = @dbusservicedir@ -default_pkcs11 = @default_pkcs11@ +dev_headers = @dev_headers@ docdir = @docdir@ dvidir = @dvidir@ exec_prefix = @exec_prefix@ +fips_mode = @fips_mode@ gtk_CFLAGS = @gtk_CFLAGS@ gtk_LIBS = @gtk_LIBS@ h_plugins = @h_plugins@ @@ -222,17 +285,17 @@ imcvdir = @imcvdir@ includedir = @includedir@ infodir = @infodir@ install_sh = @install_sh@ +ipsec_script = @ipsec_script@ +ipsec_script_upper = @ipsec_script_upper@ ipsecdir = @ipsecdir@ ipsecgroup = @ipsecgroup@ ipseclibdir = @ipseclibdir@ ipsecuser = @ipsecuser@ -libcharon_plugins = @libcharon_plugins@ libdir = @libdir@ libexecdir = @libexecdir@ linux_headers = @linux_headers@ localedir = @localedir@ localstatedir = @localstatedir@ -lt_ECHO = @lt_ECHO@ maemo_CFLAGS = @maemo_CFLAGS@ maemo_LIBS = @maemo_LIBS@ manager_plugins = @manager_plugins@ @@ -242,16 +305,15 @@ mkdir_p = @mkdir_p@ nm_CFLAGS = @nm_CFLAGS@ nm_LIBS = @nm_LIBS@ nm_ca_dir = @nm_ca_dir@ +nm_plugins = @nm_plugins@ oldincludedir = @oldincludedir@ openac_plugins = @openac_plugins@ -p_plugins = @p_plugins@ pcsclite_CFLAGS = @pcsclite_CFLAGS@ pcsclite_LIBS = @pcsclite_LIBS@ pdfdir = @pdfdir@ piddir = @piddir@ pki_plugins = @pki_plugins@ plugindir = @plugindir@ -pluto_plugins = @pluto_plugins@ pool_plugins = @pool_plugins@ prefix = @prefix@ program_transform_name = @program_transform_name@ @@ -279,15 +341,22 @@ top_srcdir = @top_srcdir@ urandom_device = @urandom_device@ xml_CFLAGS = @xml_CFLAGS@ xml_LIBS = @xml_LIBS@ -INCLUDES = -I$(top_srcdir)/src/libstrongswan -I$(top_srcdir)/src/libtncif \ +AM_CPPFLAGS = \ + -I$(top_srcdir)/src/libstrongswan \ + -I$(top_srcdir)/src/libtncif \ -I$(top_srcdir)/src/libimcv -AM_CFLAGS = -rdynamic +AM_CFLAGS = \ + -rdynamic + imcv_LTLIBRARIES = imv-test.la imv_test_la_LIBADD = $(top_builddir)/src/libimcv/libimcv.la \ $(top_builddir)/src/libstrongswan/libstrongswan.la -imv_test_la_SOURCES = imv_test.c imv_test_state.h imv_test_state.c +imv_test_la_SOURCES = \ + imv_test.c imv_test_state.h imv_test_state.c \ + imv_test_agent.h imv_test_agent.c + imv_test_la_LDFLAGS = -module -avoid-version all: all-am @@ -325,7 +394,6 @@ $(ACLOCAL_M4): $(am__aclocal_m4_deps) $(am__aclocal_m4_deps): install-imcvLTLIBRARIES: $(imcv_LTLIBRARIES) @$(NORMAL_INSTALL) - test -z "$(imcvdir)" || $(MKDIR_P) "$(DESTDIR)$(imcvdir)" @list='$(imcv_LTLIBRARIES)'; test -n "$(imcvdir)" || list=; \ list2=; for p in $$list; do \ if test -f $$p; then \ @@ -333,6 +401,8 @@ install-imcvLTLIBRARIES: $(imcv_LTLIBRARIES) else :; fi; \ done; \ test -z "$$list2" || { \ + echo " $(MKDIR_P) '$(DESTDIR)$(imcvdir)'"; \ + $(MKDIR_P) "$(DESTDIR)$(imcvdir)" || exit 1; \ echo " $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=install $(INSTALL) $(INSTALL_STRIP_FLAG) $$list2 '$(DESTDIR)$(imcvdir)'"; \ $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=install $(INSTALL) $(INSTALL_STRIP_FLAG) $$list2 "$(DESTDIR)$(imcvdir)"; \ } @@ -354,8 +424,8 @@ clean-imcvLTLIBRARIES: echo "rm -f \"$${dir}/so_locations\""; \ rm -f "$${dir}/so_locations"; \ done -imv-test.la: $(imv_test_la_OBJECTS) $(imv_test_la_DEPENDENCIES) - $(imv_test_la_LINK) -rpath $(imcvdir) $(imv_test_la_OBJECTS) $(imv_test_la_LIBADD) $(LIBS) +imv-test.la: $(imv_test_la_OBJECTS) $(imv_test_la_DEPENDENCIES) $(EXTRA_imv_test_la_DEPENDENCIES) + $(AM_V_CCLD)$(imv_test_la_LINK) -rpath $(imcvdir) $(imv_test_la_OBJECTS) $(imv_test_la_LIBADD) $(LIBS) mostlyclean-compile: -rm -f *.$(OBJEXT) @@ -364,28 +434,29 @@ distclean-compile: -rm -f *.tab.c @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/imv_test.Plo@am__quote@ +@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/imv_test_agent.Plo@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/imv_test_state.Plo@am__quote@ .c.o: -@am__fastdepCC_TRUE@ $(COMPILE) -MT $@ -MD -MP -MF $(DEPDIR)/$*.Tpo -c -o $@ $< -@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Po -@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='$<' object='$@' libtool=no @AMDEPBACKSLASH@ +@am__fastdepCC_TRUE@ $(AM_V_CC)$(COMPILE) -MT $@ -MD -MP -MF $(DEPDIR)/$*.Tpo -c -o $@ $< +@am__fastdepCC_TRUE@ $(AM_V_at)$(am__mv) $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Po +@AMDEP_TRUE@@am__fastdepCC_FALSE@ $(AM_V_CC)source='$<' object='$@' libtool=no @AMDEPBACKSLASH@ @AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@ -@am__fastdepCC_FALSE@ $(COMPILE) -c $< +@am__fastdepCC_FALSE@ $(AM_V_CC@am__nodep@)$(COMPILE) -c $< .c.obj: -@am__fastdepCC_TRUE@ $(COMPILE) -MT $@ -MD -MP -MF $(DEPDIR)/$*.Tpo -c -o $@ `$(CYGPATH_W) '$<'` -@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Po -@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='$<' object='$@' libtool=no @AMDEPBACKSLASH@ +@am__fastdepCC_TRUE@ $(AM_V_CC)$(COMPILE) -MT $@ -MD -MP -MF $(DEPDIR)/$*.Tpo -c -o $@ `$(CYGPATH_W) '$<'` +@am__fastdepCC_TRUE@ $(AM_V_at)$(am__mv) $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Po +@AMDEP_TRUE@@am__fastdepCC_FALSE@ $(AM_V_CC)source='$<' object='$@' libtool=no @AMDEPBACKSLASH@ @AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@ -@am__fastdepCC_FALSE@ $(COMPILE) -c `$(CYGPATH_W) '$<'` +@am__fastdepCC_FALSE@ $(AM_V_CC@am__nodep@)$(COMPILE) -c `$(CYGPATH_W) '$<'` .c.lo: -@am__fastdepCC_TRUE@ $(LTCOMPILE) -MT $@ -MD -MP -MF $(DEPDIR)/$*.Tpo -c -o $@ $< -@am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Plo -@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='$<' object='$@' libtool=yes @AMDEPBACKSLASH@ +@am__fastdepCC_TRUE@ $(AM_V_CC)$(LTCOMPILE) -MT $@ -MD -MP -MF $(DEPDIR)/$*.Tpo -c -o $@ $< +@am__fastdepCC_TRUE@ $(AM_V_at)$(am__mv) $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Plo +@AMDEP_TRUE@@am__fastdepCC_FALSE@ $(AM_V_CC)source='$<' object='$@' libtool=yes @AMDEPBACKSLASH@ @AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@ -@am__fastdepCC_FALSE@ $(LTCOMPILE) -c -o $@ $< +@am__fastdepCC_FALSE@ $(AM_V_CC@am__nodep@)$(LTCOMPILE) -c -o $@ $< mostlyclean-libtool: -rm -f *.lo @@ -492,10 +563,15 @@ install-am: all-am installcheck: installcheck-am install-strip: - $(MAKE) $(AM_MAKEFLAGS) INSTALL_PROGRAM="$(INSTALL_STRIP_PROGRAM)" \ - install_sh_PROGRAM="$(INSTALL_STRIP_PROGRAM)" INSTALL_STRIP_FLAG=-s \ - `test -z '$(STRIP)' || \ - echo "INSTALL_PROGRAM_ENV=STRIPPROG='$(STRIP)'"` install + if test -z '$(STRIP)'; then \ + $(MAKE) $(AM_MAKEFLAGS) INSTALL_PROGRAM="$(INSTALL_STRIP_PROGRAM)" \ + install_sh_PROGRAM="$(INSTALL_STRIP_PROGRAM)" INSTALL_STRIP_FLAG=-s \ + install; \ + else \ + $(MAKE) $(AM_MAKEFLAGS) INSTALL_PROGRAM="$(INSTALL_STRIP_PROGRAM)" \ + install_sh_PROGRAM="$(INSTALL_STRIP_PROGRAM)" INSTALL_STRIP_FLAG=-s \ + "INSTALL_PROGRAM_ENV=STRIPPROG='$(STRIP)'" install; \ + fi mostlyclean-generic: clean-generic: diff --git a/src/libimcv/plugins/imv_test/imv_test.c b/src/libimcv/plugins/imv_test/imv_test.c index 0afd81aec..964faef65 100644 --- a/src/libimcv/plugins/imv_test/imv_test.c +++ b/src/libimcv/plugins/imv_test/imv_test.c @@ -1,5 +1,6 @@ /* - * Copyright (C) 2011 Andreas Steffen, HSR Hochschule fuer Technik Rapperswil + * Copyright (C) 2013 Andreas Steffen + * HSR Hochschule fuer Technik Rapperswil * * This program is free software; you can redistribute it and/or modify it * under the terms of the GNU General Public License as published by the @@ -12,304 +13,12 @@ * for more details. */ -#include "imv_test_state.h" - -#include <imv/imv_agent.h> -#include <pa_tnc/pa_tnc_msg.h> -#include <ietf/ietf_attr.h> -#include <ietf/ietf_attr_pa_tnc_error.h> -#include <ita/ita_attr.h> -#include <ita/ita_attr_command.h> - -#include <tncif_names.h> -#include <tncif_pa_subtypes.h> - -#include <pen/pen.h> -#include <debug.h> - -/* IMV definitions */ +#include "imv_test_agent.h" static const char imv_name[] = "Test"; +static const imv_agent_create_t imv_agent_create = imv_test_agent_create; -#define IMV_VENDOR_ID PEN_ITA -#define IMV_SUBTYPE PA_SUBTYPE_ITA_TEST - -static imv_agent_t *imv_test; - -/** - * see section 3.8.1 of TCG TNC IF-IMV Specification 1.3 - */ -TNC_Result TNC_IMV_Initialize(TNC_IMVID imv_id, - TNC_Version min_version, - TNC_Version max_version, - TNC_Version *actual_version) -{ - if (imv_test) - { - DBG1(DBG_IMV, "IMV \"%s\" has already been initialized", imv_name); - return TNC_RESULT_ALREADY_INITIALIZED; - } - imv_test = imv_agent_create(imv_name, IMV_VENDOR_ID, IMV_SUBTYPE, - imv_id, actual_version); - if (!imv_test) - { - return TNC_RESULT_FATAL; - } - if (min_version > TNC_IFIMV_VERSION_1 || max_version < TNC_IFIMV_VERSION_1) - { - DBG1(DBG_IMV, "no common IF-IMV version"); - return TNC_RESULT_NO_COMMON_VERSION; - } - return TNC_RESULT_SUCCESS; -} - -/** - * see section 3.8.2 of TCG TNC IF-IMV Specification 1.3 - */ -TNC_Result TNC_IMV_NotifyConnectionChange(TNC_IMVID imv_id, - TNC_ConnectionID connection_id, - TNC_ConnectionState new_state) -{ - imv_state_t *state; - - if (!imv_test) - { - DBG1(DBG_IMV, "IMV \"%s\" has not been initialized", imv_name); - return TNC_RESULT_NOT_INITIALIZED; - } - switch (new_state) - { - case TNC_CONNECTION_STATE_CREATE: - state = imv_test_state_create(connection_id); - return imv_test->create_state(imv_test, state); - case TNC_CONNECTION_STATE_DELETE: - return imv_test->delete_state(imv_test, connection_id); - default: - return imv_test->change_state(imv_test, connection_id, - new_state, NULL); - } -} - -static TNC_Result receive_message(TNC_IMVID imv_id, - TNC_ConnectionID connection_id, - TNC_UInt32 msg_flags, - chunk_t msg, - TNC_VendorID msg_vid, - TNC_MessageSubtype msg_subtype, - TNC_UInt32 src_imc_id, - TNC_UInt32 dst_imv_id) -{ - pa_tnc_msg_t *pa_tnc_msg; - pa_tnc_attr_t *attr; - imv_state_t *state; - imv_test_state_t *test_state; - enumerator_t *enumerator; - TNC_Result result; - int rounds; - bool fatal_error, retry = FALSE; - - if (!imv_test) - { - DBG1(DBG_IMV, "IMV \"%s\" has not been initialized", imv_name); - return TNC_RESULT_NOT_INITIALIZED; - } - - /* get current IMV state */ - if (!imv_test->get_state(imv_test, connection_id, &state)) - { - return TNC_RESULT_FATAL; - } - test_state = (imv_test_state_t*)state; - - /* parse received PA-TNC message and automatically handle any errors */ - result = imv_test->receive_message(imv_test, state, msg, msg_vid, - msg_subtype, src_imc_id, dst_imv_id, &pa_tnc_msg); - - /* no parsed PA-TNC attributes available if an error occurred */ - if (!pa_tnc_msg) - { - return result; - } - - /* preprocess any IETF standard error attributes */ - fatal_error = pa_tnc_msg->process_ietf_std_errors(pa_tnc_msg); - - /* add any new IMC and set its number of rounds */ - rounds = lib->settings->get_int(lib->settings, - "libimcv.plugins.imv-test.rounds", 0); - test_state->add_imc(test_state, src_imc_id, rounds); - - /* analyze PA-TNC attributes */ - enumerator = pa_tnc_msg->create_attribute_enumerator(pa_tnc_msg); - while (enumerator->enumerate(enumerator, &attr)) - { - if (attr->get_vendor_id(attr) == PEN_ITA && - attr->get_type(attr) == ITA_ATTR_COMMAND) - { - ita_attr_command_t *ita_attr; - char *command; - - ita_attr = (ita_attr_command_t*)attr; - command = ita_attr->get_command(ita_attr); +/* include generic TGC TNC IF-IMV API code below */ - if (streq(command, "allow")) - { - state->set_recommendation(state, - TNC_IMV_ACTION_RECOMMENDATION_ALLOW, - TNC_IMV_EVALUATION_RESULT_COMPLIANT); - } - else if (streq(command, "isolate")) - { - state->set_recommendation(state, - TNC_IMV_ACTION_RECOMMENDATION_ISOLATE, - TNC_IMV_EVALUATION_RESULT_NONCOMPLIANT_MINOR); - } - else if (streq(command, "block") || streq(command, "none")) - { - state->set_recommendation(state, - TNC_IMV_ACTION_RECOMMENDATION_NO_ACCESS, - TNC_IMV_EVALUATION_RESULT_NONCOMPLIANT_MAJOR); - } - else if (streq(command, "retry")) - { - retry = TRUE; - } - else - { - DBG1(DBG_IMV, "unsupported ITA Command '%s'", command); - state->set_recommendation(state, - TNC_IMV_ACTION_RECOMMENDATION_NO_RECOMMENDATION, - TNC_IMV_EVALUATION_RESULT_ERROR); - } - } - } - enumerator->destroy(enumerator); - pa_tnc_msg->destroy(pa_tnc_msg); +#include <imv/imv_if.h> - if (fatal_error) - { - state->set_recommendation(state, - TNC_IMV_ACTION_RECOMMENDATION_NO_RECOMMENDATION, - TNC_IMV_EVALUATION_RESULT_ERROR); - return imv_test->provide_recommendation(imv_test, connection_id); - } - - /* request a handshake retry ? */ - if (retry) - { - test_state->set_rounds(test_state, rounds); - return imv_test->request_handshake_retry(imv_id, connection_id, - TNC_RETRY_REASON_IMV_SERIOUS_EVENT); - } - - /* repeat the measurement ? */ - if (test_state->another_round(test_state, src_imc_id)) - { - attr = ita_attr_command_create("repeat"); - pa_tnc_msg = pa_tnc_msg_create(); - pa_tnc_msg->add_attribute(pa_tnc_msg, attr); - pa_tnc_msg->build(pa_tnc_msg); - result = imv_test->send_message(imv_test, connection_id, TRUE, imv_id, - src_imc_id, pa_tnc_msg->get_encoding(pa_tnc_msg)); - pa_tnc_msg->destroy(pa_tnc_msg); - - return result; - } - - return imv_test->provide_recommendation(imv_test, connection_id); -} - -/** - * see section 3.8.4 of TCG TNC IF-IMV Specification 1.3 - */ -TNC_Result TNC_IMV_ReceiveMessage(TNC_IMVID imv_id, - TNC_ConnectionID connection_id, - TNC_BufferReference msg, - TNC_UInt32 msg_len, - TNC_MessageType msg_type) -{ - TNC_VendorID msg_vid; - TNC_MessageSubtype msg_subtype; - - msg_vid = msg_type >> 8; - msg_subtype = msg_type & TNC_SUBTYPE_ANY; - - return receive_message(imv_id, connection_id, 0, chunk_create(msg, msg_len), - msg_vid, msg_subtype, 0, TNC_IMVID_ANY); -} - -/** - * see section 3.8.6 of TCG TNC IF-IMV Specification 1.3 - */ -TNC_Result TNC_IMV_ReceiveMessageLong(TNC_IMVID imv_id, - TNC_ConnectionID connection_id, - TNC_UInt32 msg_flags, - TNC_BufferReference msg, - TNC_UInt32 msg_len, - TNC_VendorID msg_vid, - TNC_MessageSubtype msg_subtype, - TNC_UInt32 src_imc_id, - TNC_UInt32 dst_imv_id) -{ - return receive_message(imv_id, connection_id, msg_flags, - chunk_create(msg, msg_len), msg_vid, msg_subtype, - src_imc_id, dst_imv_id); -} - -/** - * see section 3.8.7 of TCG TNC IF-IMV Specification 1.3 - */ -TNC_Result TNC_IMV_SolicitRecommendation(TNC_IMVID imv_id, - TNC_ConnectionID connection_id) -{ - if (!imv_test) - { - DBG1(DBG_IMV, "IMV \"%s\" has not been initialized", imv_name); - return TNC_RESULT_NOT_INITIALIZED; - } - return imv_test->provide_recommendation(imv_test, connection_id); -} - -/** - * see section 3.8.8 of TCG TNC IF-IMV Specification 1.3 - */ -TNC_Result TNC_IMV_BatchEnding(TNC_IMVID imv_id, - TNC_ConnectionID connection_id) -{ - if (!imv_test) - { - DBG1(DBG_IMV, "IMV \"%s\" has not been initialized", imv_name); - return TNC_RESULT_NOT_INITIALIZED; - } - return TNC_RESULT_SUCCESS; -} - -/** - * see section 3.8.9 of TCG TNC IF-IMV Specification 1.3 - */ -TNC_Result TNC_IMV_Terminate(TNC_IMVID imv_id) -{ - if (!imv_test) - { - DBG1(DBG_IMV, "IMV \"%s\" has not been initialized", imv_name); - return TNC_RESULT_NOT_INITIALIZED; - } - imv_test->destroy(imv_test); - imv_test = NULL; - - return TNC_RESULT_SUCCESS; -} - -/** - * see section 4.2.8.1 of TCG TNC IF-IMV Specification 1.3 - */ -TNC_Result TNC_IMV_ProvideBindFunction(TNC_IMVID imv_id, - TNC_TNCS_BindFunctionPointer bind_function) -{ - if (!imv_test) - { - DBG1(DBG_IMV, "IMV \"%s\" has not been initialized", imv_name); - return TNC_RESULT_NOT_INITIALIZED; - } - return imv_test->bind_functions(imv_test, bind_function); -} diff --git a/src/libimcv/plugins/imv_test/imv_test_agent.c b/src/libimcv/plugins/imv_test/imv_test_agent.c new file mode 100644 index 000000000..87d69373f --- /dev/null +++ b/src/libimcv/plugins/imv_test/imv_test_agent.c @@ -0,0 +1,321 @@ +/* + * Copyright (C) 2013 Andreas Steffen + * HSR Hochschule fuer Technik Rapperswil + * + * This program is free software; you can redistribute it and/or modify it + * under the terms of the GNU General Public License as published by the + * Free Software Foundation; either version 2 of the License, or (at your + * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>. + * + * This program is distributed in the hope that it will be useful, but + * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY + * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License + * for more details. + */ + +#include "imv_test_agent.h" +#include "imv_test_state.h" + +#include <imv/imv_agent.h> +#include <imv/imv_msg.h> +#include <ietf/ietf_attr.h> +#include <ietf/ietf_attr_pa_tnc_error.h> +#include <ita/ita_attr.h> +#include <ita/ita_attr_get_settings.h> +#include <ita/ita_attr_command.h> +#include <ita/ita_attr_dummy.h> + +#include <tncif_names.h> +#include <tncif_pa_subtypes.h> + +#include <pen/pen.h> +#include <utils/debug.h> + +typedef struct private_imv_test_agent_t private_imv_test_agent_t; + +/* Subscribed PA-TNC message subtypes */ +static pen_type_t msg_types[] = { + { PEN_ITA, PA_SUBTYPE_ITA_TEST } +}; + +/** + * Private data of an imv_test_agent_t object. + */ +struct private_imv_test_agent_t { + + /** + * Public members of imv_test_agent_t + */ + imv_agent_if_t public; + + /** + * IMV agent responsible for generic functions + */ + imv_agent_t *agent; + +}; + +METHOD(imv_agent_if_t, bind_functions, TNC_Result, + private_imv_test_agent_t *this, TNC_TNCS_BindFunctionPointer bind_function) +{ + return this->agent->bind_functions(this->agent, bind_function); +} + +METHOD(imv_agent_if_t, notify_connection_change, TNC_Result, + private_imv_test_agent_t *this, TNC_ConnectionID id, + TNC_ConnectionState new_state) +{ + imv_state_t *state; + + switch (new_state) + { + case TNC_CONNECTION_STATE_CREATE: + state = imv_test_state_create(id); + return this->agent->create_state(this->agent, state); + case TNC_CONNECTION_STATE_DELETE: + return this->agent->delete_state(this->agent, id); + default: + return this->agent->change_state(this->agent, id, new_state, NULL); + } +} + +/** + * Process a received message + */ +static TNC_Result receive_msg(private_imv_test_agent_t *this, imv_state_t *state, + imv_msg_t *in_msg) +{ + imv_msg_t *out_msg; + imv_test_state_t *test_state; + enumerator_t *enumerator; + pa_tnc_attr_t *attr; + pen_type_t attr_type; + TNC_Result result; + int rounds; + bool fatal_error = FALSE, received_command = FALSE, retry = FALSE; + + /* parse received PA-TNC message and handle local and remote errors */ + result = in_msg->receive(in_msg, &fatal_error); + if (result != TNC_RESULT_SUCCESS) + { + return result; + } + + /* add any new IMC and set its number of rounds */ + rounds = lib->settings->get_int(lib->settings, + "libimcv.plugins.imv-test.rounds", 0); + test_state = (imv_test_state_t*)state; + test_state->add_imc(test_state, in_msg->get_src_id(in_msg), rounds); + + /* analyze PA-TNC attributes */ + enumerator = in_msg->create_attribute_enumerator(in_msg); + while (enumerator->enumerate(enumerator, &attr)) + { + attr_type = attr->get_type(attr); + + if (attr_type.vendor_id != PEN_ITA) + { + continue; + } + if (attr_type.type == ITA_ATTR_COMMAND) + { + ita_attr_command_t *ita_attr; + char *command; + + received_command = TRUE; + ita_attr = (ita_attr_command_t*)attr; + command = ita_attr->get_command(ita_attr); + + if (streq(command, "allow")) + { + state->set_recommendation(state, + TNC_IMV_ACTION_RECOMMENDATION_ALLOW, + TNC_IMV_EVALUATION_RESULT_COMPLIANT); + } + else if (streq(command, "isolate")) + { + state->set_recommendation(state, + TNC_IMV_ACTION_RECOMMENDATION_ISOLATE, + TNC_IMV_EVALUATION_RESULT_NONCOMPLIANT_MINOR); + } + else if (streq(command, "block") || streq(command, "none")) + { + state->set_recommendation(state, + TNC_IMV_ACTION_RECOMMENDATION_NO_ACCESS, + TNC_IMV_EVALUATION_RESULT_NONCOMPLIANT_MAJOR); + } + else if (streq(command, "retry")) + { + retry = TRUE; + } + else + { + DBG1(DBG_IMV, "unsupported ITA Command '%s'", command); + state->set_recommendation(state, + TNC_IMV_ACTION_RECOMMENDATION_NO_RECOMMENDATION, + TNC_IMV_EVALUATION_RESULT_ERROR); + } + } + else if (attr_type.type == ITA_ATTR_DUMMY) + { + ita_attr_dummy_t *ita_attr; + + ita_attr = (ita_attr_dummy_t*)attr; + DBG1(DBG_IMV, "received dummy attribute value (%d bytes)", + ita_attr->get_size(ita_attr)); + } + } + enumerator->destroy(enumerator); + + if (fatal_error) + { + state->set_recommendation(state, + TNC_IMV_ACTION_RECOMMENDATION_NO_RECOMMENDATION, + TNC_IMV_EVALUATION_RESULT_ERROR); + out_msg = imv_msg_create_as_reply(in_msg); + result = out_msg->send_assessment(out_msg); + out_msg->destroy(out_msg); + if (result != TNC_RESULT_SUCCESS) + { + return result; + } + return this->agent->provide_recommendation(this->agent, state); + } + + /* request a handshake retry ? */ + if (retry) + { + test_state->set_rounds(test_state, rounds); + return this->agent->request_handshake_retry( + this->agent->get_id(this->agent), + state->get_connection_id(state), + TNC_RETRY_REASON_IMV_SERIOUS_EVENT); + } + + /* repeat the measurement ? */ + if (test_state->another_round(test_state, in_msg->get_src_id(in_msg))) + { + out_msg = imv_msg_create_as_reply(in_msg); + attr = ita_attr_command_create("repeat"); + out_msg->add_attribute(out_msg, attr); + + /* send PA-TNC message with excl flag set */ + result = out_msg->send(out_msg, TRUE); + out_msg->destroy(out_msg); + + return result; + } + + if (received_command) + { + out_msg = imv_msg_create_as_reply(in_msg); + result = out_msg->send_assessment(out_msg); + out_msg->destroy(out_msg); + if (result != TNC_RESULT_SUCCESS) + { + return result; + } + return this->agent->provide_recommendation(this->agent, state); + } + else + { + return TNC_RESULT_SUCCESS; + } + } + +METHOD(imv_agent_if_t, receive_message, TNC_Result, + private_imv_test_agent_t *this, TNC_ConnectionID id, + TNC_MessageType msg_type, chunk_t msg) +{ + imv_state_t *state; + imv_msg_t *in_msg; + TNC_Result result; + + if (!this->agent->get_state(this->agent, id, &state)) + { + return TNC_RESULT_FATAL; + } + in_msg = imv_msg_create_from_data(this->agent, state, id, msg_type, msg); + result = receive_msg(this, state, in_msg); + in_msg->destroy(in_msg); + + return result; +} + +METHOD(imv_agent_if_t, receive_message_long, TNC_Result, + private_imv_test_agent_t *this, TNC_ConnectionID id, + TNC_UInt32 src_imc_id, TNC_UInt32 dst_imv_id, + TNC_VendorID msg_vid, TNC_MessageSubtype msg_subtype, chunk_t msg) +{ + imv_state_t *state; + imv_msg_t *in_msg; + TNC_Result result; + + if (!this->agent->get_state(this->agent, id, &state)) + { + return TNC_RESULT_FATAL; + } + in_msg = imv_msg_create_from_long_data(this->agent, state, id, + src_imc_id, dst_imv_id, msg_vid, msg_subtype, msg); + result = receive_msg(this, state, in_msg); + in_msg->destroy(in_msg); + + return result; + +} + +METHOD(imv_agent_if_t, batch_ending, TNC_Result, + private_imv_test_agent_t *this, TNC_ConnectionID id) +{ + return TNC_RESULT_SUCCESS; +} + +METHOD(imv_agent_if_t, solicit_recommendation, TNC_Result, + private_imv_test_agent_t *this, TNC_ConnectionID id) +{ + imv_state_t *state; + + if (!this->agent->get_state(this->agent, id, &state)) + { + return TNC_RESULT_FATAL; + } + return this->agent->provide_recommendation(this->agent, state); +} + +METHOD(imv_agent_if_t, destroy, void, + private_imv_test_agent_t *this) +{ + DESTROY_IF(this->agent); + free(this); +} + +/** + * Described in header. + */ +imv_agent_if_t *imv_test_agent_create(const char *name, TNC_IMVID id, + TNC_Version *actual_version) +{ + private_imv_test_agent_t *this; + + INIT(this, + .public = { + .bind_functions = _bind_functions, + .notify_connection_change = _notify_connection_change, + .receive_message = _receive_message, + .receive_message_long = _receive_message_long, + .batch_ending = _batch_ending, + .solicit_recommendation = _solicit_recommendation, + .destroy = _destroy, + }, + .agent = imv_agent_create(name, msg_types, countof(msg_types), id, + actual_version), + ); + + if (!this->agent) + { + destroy(this); + return NULL; + } + return &this->public; +} + diff --git a/src/libimcv/plugins/imv_test/imv_test_agent.h b/src/libimcv/plugins/imv_test/imv_test_agent.h new file mode 100644 index 000000000..15508d375 --- /dev/null +++ b/src/libimcv/plugins/imv_test/imv_test_agent.h @@ -0,0 +1,36 @@ +/* + * Copyright (C) 2013 Andreas Steffen + * HSR Hochschule fuer Technik Rapperswil + * + * This program is free software; you can redistribute it and/or modify it + * under the terms of the GNU General Public License as published by the + * Free Software Foundation; either version 2 of the License, or (at your + * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>. + * + * This program is distributed in the hope that it will be useful, but + * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY + * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License + * for more details. + */ + +/** + * @defgroup imv_test_agent_t imv_test_agent + * @{ @ingroup imv_test + */ + +#ifndef IMV_TEST_AGENT_H_ +#define IMV_TEST_AGENT_H_ + +#include <imv/imv_agent_if.h> + +/** + * Creates a Test IMV agent + * + * @param name Name of the IMV + * @param id ID of the IMV + * @param actual_version TNC IF-IMV version + */ +imv_agent_if_t* imv_test_agent_create(const char* name, TNC_IMVID id, + TNC_Version *actual_version); + +#endif /** IMV_TEST_AGENT_H_ @}*/ diff --git a/src/libimcv/plugins/imv_test/imv_test_state.c b/src/libimcv/plugins/imv_test/imv_test_state.c index 530090af7..0da09df67 100644 --- a/src/libimcv/plugins/imv_test/imv_test_state.c +++ b/src/libimcv/plugins/imv_test/imv_test_state.c @@ -1,5 +1,6 @@ /* - * Copyright (C) 2011 Andreas Steffen, HSR Hochschule fuer Technik Rapperswil + * Copyright (C) 2011-2013 Andreas Steffen + * HSR Hochschule fuer Technik Rapperswil * * This program is free software; you can redistribute it and/or modify it * under the terms of the GNU General Public License as published by the @@ -13,10 +14,14 @@ */ #include "imv_test_state.h" +#include "imv/imv_lang_string.h" +#include "imv/imv_reason_string.h" + +#include <tncif_policy.h> #include <utils/lexparser.h> -#include <utils/linked_list.h> -#include <debug.h> +#include <collections/linked_list.h> +#include <utils/debug.h> typedef struct private_imv_test_state_t private_imv_test_state_t; @@ -51,6 +56,26 @@ struct private_imv_test_state_t { bool has_excl; /** + * Maximum PA-TNC message size for this TNCCS connection + */ + u_int32_t max_msg_len; + + /** + * Access Requestor ID Type + */ + u_int32_t ar_id_type; + + /** + * Access Requestor ID Value + */ + chunk_t ar_id_value; + + /** + * IMV database session associated with TNCCS connection + */ + imv_session_t *session; + + /** * IMV action recommendation */ TNC_IMV_Action_Recommendation rec; @@ -61,6 +86,11 @@ struct private_imv_test_state_t { TNC_IMV_Evaluation_Result eval; /** + * TNC Reason String + */ + imv_reason_string_t *reason_string; + + /** * List of IMCs */ linked_list_t *imcs; @@ -77,24 +107,20 @@ struct imc_entry_t { int rounds; }; -typedef struct entry_t entry_t; - /** - * Define an internal reason string entry + * Supported languages */ -struct entry_t { - char *lang; - char *string; -}; +static char* languages[] = { "en", "de", "fr", "pl" }; /** - * Table of multi-lingual reason string entries + * Table of reason strings */ -static entry_t reasons[] = { +static imv_lang_string_t reasons[] = { { "en", "IMC Test was not configured with \"command = allow\"" }, { "de", "IMC Test wurde nicht mit \"command = allow\" konfiguriert" }, { "fr", "IMC Test n'etait pas configuré avec \"command = allow\"" }, - { "pl", "IMC Test nie zostało skonfigurowany z \"command = allow\"" } + { "pl", "IMC Test nie zostało skonfigurowany z \"command = allow\"" }, + { NULL, NULL } }; METHOD(imv_state_t, get_connection_id, TNC_ConnectionID, @@ -122,6 +148,47 @@ METHOD(imv_state_t, set_flags, void, this->has_excl = has_excl; } +METHOD(imv_state_t, set_max_msg_len, void, + private_imv_test_state_t *this, u_int32_t max_msg_len) +{ + this->max_msg_len = max_msg_len; +} + +METHOD(imv_state_t, get_max_msg_len, u_int32_t, + private_imv_test_state_t *this) +{ + return this->max_msg_len; +} + +METHOD(imv_state_t, set_ar_id, void, + private_imv_test_state_t *this, u_int32_t id_type, chunk_t id_value) +{ + this->ar_id_type = id_type; + this->ar_id_value = chunk_clone(id_value); +} + +METHOD(imv_state_t, get_ar_id, chunk_t, + private_imv_test_state_t *this, u_int32_t *id_type) +{ + if (id_type) + { + *id_type = this->ar_id_type; + } + return this->ar_id_value; +} + +METHOD(imv_state_t, set_session, void, + private_imv_test_state_t *this, imv_session_t *session) +{ + this->session = session; +} + +METHOD(imv_state_t, get_session, imv_session_t*, + private_imv_test_state_t *this) +{ + return this->session; +} + METHOD(imv_state_t, change_state, void, private_imv_test_state_t *this, TNC_ConnectionState new_state) { @@ -144,54 +211,44 @@ METHOD(imv_state_t, set_recommendation, void, this->eval = eval; } -METHOD(imv_state_t, get_reason_string, bool, - private_imv_test_state_t *this, chunk_t preferred_language, - chunk_t *reason_string, chunk_t *reason_language) +METHOD(imv_state_t, update_recommendation, void, + private_imv_test_state_t *this, TNC_IMV_Action_Recommendation rec, + TNC_IMV_Evaluation_Result eval) { - chunk_t pref_lang, lang; - u_char *pos; - int i; - - while (eat_whitespace(&preferred_language)) - { - if (!extract_token(&pref_lang, ',', &preferred_language)) - { - /* last entry in a comma-separated list or single entry */ - pref_lang = preferred_language; - } + this->rec = tncif_policy_update_recommendation(this->rec, rec); + this->eval = tncif_policy_update_evaluation(this->eval, eval); +} - /* eat trailing whitespace */ - pos = pref_lang.ptr + pref_lang.len - 1; - while (pref_lang.len && *pos-- == ' ') - { - pref_lang.len--; - } +METHOD(imv_state_t, get_reason_string, bool, + private_imv_test_state_t *this, enumerator_t *language_enumerator, + chunk_t *reason_string, char **reason_language) +{ + *reason_language = imv_lang_string_select_lang(language_enumerator, + languages, countof(languages)); - for (i = 0 ; i < countof(reasons); i++) - { - lang = chunk_create(reasons[i].lang, strlen(reasons[i].lang)); - if (chunk_equals(lang, pref_lang)) - { - *reason_language = lang; - *reason_string = chunk_create(reasons[i].string, - strlen(reasons[i].string)); - return TRUE; - } - } - } + /* Instantiate a TNC Reason String object */ + DESTROY_IF(this->reason_string); + this->reason_string = imv_reason_string_create(*reason_language); + this->reason_string->add_reason(this->reason_string, reasons); + *reason_string = this->reason_string->get_encoding(this->reason_string); - /* no preferred language match found - use the default language */ - *reason_string = chunk_create(reasons[0].string, - strlen(reasons[0].string)); - *reason_language = chunk_create(reasons[0].lang, - strlen(reasons[0].lang)); return TRUE; } +METHOD(imv_state_t, get_remediation_instructions, bool, + private_imv_test_state_t *this, enumerator_t *language_enumerator, + chunk_t *string, char **lang_code, char **uri) +{ + return FALSE; +} + METHOD(imv_state_t, destroy, void, private_imv_test_state_t *this) { + DESTROY_IF(this->session); + DESTROY_IF(this->reason_string); this->imcs->destroy_function(this->imcs, free); + free(this->ar_id_value.ptr); free(this); } @@ -256,8 +313,8 @@ METHOD(imv_test_state_t, another_round, bool, } } enumerator->destroy(enumerator); - - return not_finished; + + return not_finished; } /** @@ -274,10 +331,18 @@ imv_state_t *imv_test_state_create(TNC_ConnectionID connection_id) .has_long = _has_long, .has_excl = _has_excl, .set_flags = _set_flags, + .set_max_msg_len = _set_max_msg_len, + .get_max_msg_len = _get_max_msg_len, + .set_ar_id = _set_ar_id, + .get_ar_id = _get_ar_id, + .set_session = _set_session, + .get_session = _get_session, .change_state = _change_state, .get_recommendation = _get_recommendation, .set_recommendation = _set_recommendation, + .update_recommendation = _update_recommendation, .get_reason_string = _get_reason_string, + .get_remediation_instructions = _get_remediation_instructions, .destroy = _destroy, }, .add_imc = _add_imc, @@ -290,7 +355,7 @@ imv_state_t *imv_test_state_create(TNC_ConnectionID connection_id) .connection_id = connection_id, .imcs = linked_list_create(), ); - + return &this->public.interface; } diff --git a/src/libimcv/plugins/imv_test/imv_test_state.h b/src/libimcv/plugins/imv_test/imv_test_state.h index af78d1470..2de5b6ffc 100644 --- a/src/libimcv/plugins/imv_test/imv_test_state.h +++ b/src/libimcv/plugins/imv_test/imv_test_state.h @@ -13,9 +13,11 @@ */ /** + * @defgroup imv_test imv_test + * @ingroup libimcv_plugins * * @defgroup imv_test_state_t imv_test_state - * @{ @ingroup imv_test_state + * @{ @ingroup imv_test */ #ifndef IMV_TEST_STATE_H_ |