![[BACK]](/icons/cvsweb/back.gif){kind=icon}
Return to imv_scanner_agent.c CVS log ![[TXT]](/icons/cvsweb/text.gif){kind=icon}
![[DIR]](/icons/cvsweb/dir.gif){kind=icon}
Up to [ELWIX - Embedded LightWeight unIX -] / embedaddon / strongswan / src / libimcv / plugins / imv_scanner|
Return to imv_scanner_agent.c CVS log | Up to [ELWIX - Embedded LightWeight unIX -] / embedaddon / strongswan / src / libimcv / plugins / imv_scanner |
1.1 misho 1: /*
2: * Copyright (C) 2013-2015 Andreas Steffen
3: * HSR Hochschule fuer Technik Rapperswil
4: *
5: * This program is free software; you can redistribute it and/or modify it
6: * under the terms of the GNU General Public License as published by the
7: * Free Software Foundation; either version 2 of the License, or (at your
8: * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
9: *
10: * This program is distributed in the hope that it will be useful, but
11: * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
12: * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
13: * for more details.
14: */
15:
16: #include "imv_scanner_agent.h"
17: #include "imv_scanner_state.h"
18:
19: #include <imcv.h>
20: #include <imv/imv_agent.h>
21: #include <imv/imv_msg.h>
22: #include <ietf/ietf_attr.h>
23: #include <ietf/ietf_attr_attr_request.h>
24: #include <ietf/ietf_attr_pa_tnc_error.h>
25: #include <ietf/ietf_attr_port_filter.h>
26:
27: #include <tncif_names.h>
28: #include <tncif_pa_subtypes.h>
29:
30: #include <pen/pen.h>
31: #include <utils/debug.h>
32: #include <utils/lexparser.h>
33:
34: typedef struct private_imv_scanner_agent_t private_imv_scanner_agent_t;
35:
36: /* Subscribed PA-TNC message subtypes */
37: static pen_type_t msg_types[] = {
38: { PEN_IETF, PA_SUBTYPE_IETF_FIREWALL }
39: };
40:
41: /**
42: * Private data of an imv_scanner_agent_t object.
43: */
44: struct private_imv_scanner_agent_t {
45:
46: /**
47: * Public members of imv_scanner_agent_t
48: */
49: imv_agent_if_t public;
50:
51: /**
52: * IMV agent responsible for generic functions
53: */
54: imv_agent_t *agent;
55:
56: };
57:
58: METHOD(imv_agent_if_t, bind_functions, TNC_Result,
59: private_imv_scanner_agent_t *this, TNC_TNCS_BindFunctionPointer bind_function)
60: {
61: return this->agent->bind_functions(this->agent, bind_function);
62: }
63:
64: METHOD(imv_agent_if_t, notify_connection_change, TNC_Result,
65: private_imv_scanner_agent_t *this, TNC_ConnectionID id,
66: TNC_ConnectionState new_state)
67: {
68: imv_state_t *state;
69:
70: switch (new_state)
71: {
72: case TNC_CONNECTION_STATE_CREATE:
73: state = imv_scanner_state_create(id);
74: return this->agent->create_state(this->agent, state);
75: case TNC_CONNECTION_STATE_DELETE:
76: return this->agent->delete_state(this->agent, id);
77: default:
78: return this->agent->change_state(this->agent, id, new_state, NULL);
79: }
80: }
81:
82: /**
83: * Process a received message
84: */
85: static TNC_Result receive_msg(private_imv_scanner_agent_t *this,
86: imv_state_t *state, imv_msg_t *in_msg)
87: {
88: imv_msg_t *out_msg;
89: imv_scanner_state_t *scanner_state;
90: enumerator_t *enumerator;
91: pa_tnc_attr_t *attr;
92: pen_type_t type;
93: TNC_Result result;
94: ietf_attr_port_filter_t *port_filter_attr;
95: bool fatal_error = FALSE;
96:
97: /* generate an outgoing PA-TNC message - we might need it */
98: out_msg = imv_msg_create_as_reply(in_msg);
99:
100: /* parse received PA-TNC message and handle local and remote errors */
101: result = in_msg->receive(in_msg, out_msg, &fatal_error);
102: if (result != TNC_RESULT_SUCCESS)
103: {
104: out_msg->destroy(out_msg);
105: return result;
106: }
107:
108: /* analyze PA-TNC attributes */
109: enumerator = in_msg->create_attribute_enumerator(in_msg);
110: while (enumerator->enumerate(enumerator, &attr))
111: {
112: type = attr->get_type(attr);
113:
114: if (type.vendor_id == PEN_IETF && type.type == IETF_ATTR_PORT_FILTER)
115: {
116: scanner_state = (imv_scanner_state_t*)state;
117: port_filter_attr = (ietf_attr_port_filter_t*)attr->get_ref(attr);
118: scanner_state->set_port_filter_attr(scanner_state, port_filter_attr);
119: }
120: }
121: enumerator->destroy(enumerator);
122:
123: if (fatal_error)
124: {
125: state->set_recommendation(state,
126: TNC_IMV_ACTION_RECOMMENDATION_NO_RECOMMENDATION,
127: TNC_IMV_EVALUATION_RESULT_ERROR);
128: result = out_msg->send_assessment(out_msg);
129: if (result == TNC_RESULT_SUCCESS)
130: {
131: result = this->agent->provide_recommendation(this->agent, state);
132: }
133: }
134: else
135: {
136: /* send PA-TNC message with the EXCL flag set */
137: result = out_msg->send(out_msg, TRUE);
138: }
139: out_msg->destroy(out_msg);
140:
141: return result;
142: }
143:
144: METHOD(imv_agent_if_t, receive_message, TNC_Result,
145: private_imv_scanner_agent_t *this, TNC_ConnectionID id,
146: TNC_MessageType msg_type, chunk_t msg)
147: {
148: imv_state_t *state;
149: imv_msg_t *in_msg;
150: TNC_Result result;
151:
152: if (!this->agent->get_state(this->agent, id, &state))
153: {
154: return TNC_RESULT_FATAL;
155: }
156: in_msg = imv_msg_create_from_data(this->agent, state, id, msg_type, msg);
157: result = receive_msg(this, state, in_msg);
158: in_msg->destroy(in_msg);
159:
160: return result;
161: }
162:
163: METHOD(imv_agent_if_t, receive_message_long, TNC_Result,
164: private_imv_scanner_agent_t *this, TNC_ConnectionID id,
165: TNC_UInt32 src_imc_id, TNC_UInt32 dst_imv_id,
166: TNC_VendorID msg_vid, TNC_MessageSubtype msg_subtype, chunk_t msg)
167: {
168: imv_state_t *state;
169: imv_msg_t *in_msg;
170: TNC_Result result;
171:
172: if (!this->agent->get_state(this->agent, id, &state))
173: {
174: return TNC_RESULT_FATAL;
175: }
176: in_msg = imv_msg_create_from_long_data(this->agent, state, id,
177: src_imc_id, dst_imv_id, msg_vid, msg_subtype, msg);
178: result = receive_msg(this, state, in_msg);
179: in_msg->destroy(in_msg);
180:
181: return result;
182:
183: }
184:
185: typedef struct port_range_t port_range_t;
186:
187: struct port_range_t {
188: uint16_t start, stop;
189: };
190:
191: /**
192: * Parse a TCP or UDP port list from an argument string
193: */
194: static linked_list_t* get_port_list(uint8_t protocol_family,
195: bool closed_port_policy, char *arg_str)
196: {
197: chunk_t port_list, port_item, port_start;
198: port_range_t *port_range;
199: linked_list_t *list;
200:
201: list = linked_list_create();
202:
203: port_list = chunk_from_str(arg_str);
204: DBG2(DBG_IMV, "list of %s ports that %s:",
205: (protocol_family == IPPROTO_TCP) ? "tcp" : "udp",
206: closed_port_policy ? "are allowed to be open" : "must be closed");
207:
208: while (eat_whitespace(&port_list))
209: {
210: if (!extract_token(&port_item, ' ', &port_list))
211: {
212: /* reached last port item */
213: port_item = port_list;
214: port_list = chunk_empty;
215: }
216: port_range = malloc_thing(port_range_t);
217: port_range->start = atoi(port_item.ptr);
218:
219: if (extract_token(&port_start, '-', &port_item) && port_item.len)
220: {
221: port_range->stop = atoi(port_item.ptr);
222: }
223: else
224: {
225: port_range->stop = port_range->start;
226: }
227: DBG2(DBG_IMV, "%5u - %5u", port_range->start, port_range->stop);
228: list->insert_last(list, port_range);
229: }
230:
231: return list;
232: }
233:
234: METHOD(imv_agent_if_t, batch_ending, TNC_Result,
235: private_imv_scanner_agent_t *this, TNC_ConnectionID id)
236: {
237: imv_msg_t *out_msg;
238: imv_state_t *state;
239: imv_session_t *session;
240: imv_workitem_t *workitem;
241: imv_scanner_state_t *scanner_state;
242: imv_scanner_handshake_state_t handshake_state;
243: pa_tnc_attr_t *attr;
244: ietf_attr_port_filter_t *port_filter_attr;
245: TNC_IMVID imv_id;
246: TNC_Result result = TNC_RESULT_SUCCESS;
247: bool no_workitems = TRUE;
248: enumerator_t *enumerator;
249:
250: if (!this->agent->get_state(this->agent, id, &state))
251: {
252: return TNC_RESULT_FATAL;
253: }
254: scanner_state = (imv_scanner_state_t*)state;
255: handshake_state = scanner_state->get_handshake_state(scanner_state);
256: port_filter_attr = scanner_state->get_port_filter_attr(scanner_state);
257: session = state->get_session(state);
258: imv_id = this->agent->get_id(this->agent);
259:
260: if (handshake_state == IMV_SCANNER_STATE_END)
261: {
262: return TNC_RESULT_SUCCESS;
263: }
264:
265: /* create an empty out message - we might need it */
266: out_msg = imv_msg_create(this->agent, state, id, imv_id, TNC_IMCID_ANY,
267: msg_types[0]);
268:
269: if (!imcv_db)
270: {
271: DBG2(DBG_IMV, "no workitems available - no evaluation possible");
272: state->set_recommendation(state,
273: TNC_IMV_ACTION_RECOMMENDATION_ALLOW,
274: TNC_IMV_EVALUATION_RESULT_DONT_KNOW);
275: result = out_msg->send_assessment(out_msg);
276: out_msg->destroy(out_msg);
277: scanner_state->set_handshake_state(scanner_state, IMV_SCANNER_STATE_END);
278:
279: if (result != TNC_RESULT_SUCCESS)
280: {
281: return result;
282: }
283: return this->agent->provide_recommendation(this->agent, state);
284: }
285:
286: if (handshake_state == IMV_SCANNER_STATE_INIT &&
287: session->get_policy_started(session))
288: {
289: enumerator = session->create_workitem_enumerator(session);
290: if (enumerator)
291: {
292: while (enumerator->enumerate(enumerator, &workitem))
293: {
294: if (workitem->get_imv_id(workitem) != TNC_IMVID_ANY)
295: {
296: continue;
297: }
298:
299: switch (workitem->get_type(workitem))
300: {
301: case IMV_WORKITEM_TCP_PORT_OPEN:
302: case IMV_WORKITEM_TCP_PORT_BLOCK:
303: case IMV_WORKITEM_UDP_PORT_OPEN:
304: case IMV_WORKITEM_UDP_PORT_BLOCK:
305: if (!port_filter_attr &&
306: handshake_state != IMV_SCANNER_STATE_ATTR_REQ)
307: {
308: attr = ietf_attr_attr_request_create(PEN_IETF,
309: IETF_ATTR_PORT_FILTER);
310: out_msg->add_attribute(out_msg, attr);
311: handshake_state = IMV_SCANNER_STATE_ATTR_REQ;
312: }
313: break;
314: default:
315: continue;
316: }
317: workitem->set_imv_id(workitem, imv_id);
318: no_workitems = FALSE;
319: }
320: enumerator->destroy(enumerator);
321:
322: if (no_workitems)
323: {
324: DBG2(DBG_IMV, "IMV %d has no workitems - "
325: "no evaluation requested", imv_id);
326: state->set_recommendation(state,
327: TNC_IMV_ACTION_RECOMMENDATION_ALLOW,
328: TNC_IMV_EVALUATION_RESULT_DONT_KNOW);
329: }
330: handshake_state = IMV_SCANNER_STATE_WORKITEMS;
331: scanner_state->set_handshake_state(scanner_state, handshake_state);
332: }
333: }
334:
335: if (handshake_state == IMV_SCANNER_STATE_WORKITEMS && port_filter_attr)
336: {
337: TNC_IMV_Evaluation_Result eval;
338: TNC_IMV_Action_Recommendation rec;
339: uint8_t protocol_family, protocol;
340: uint16_t port;
341: bool closed_port_policy, blocked, first;
342: char result_str[BUF_LEN], *pos, *protocol_str;
343: size_t len;
344: int written;
345: linked_list_t *port_list;
346: enumerator_t *e1, *e2;
347:
348: enumerator = session->create_workitem_enumerator(session);
349: while (enumerator->enumerate(enumerator, &workitem))
350: {
351: if (workitem->get_imv_id(workitem) != imv_id)
352: {
353: continue;
354: }
355: eval = TNC_IMV_EVALUATION_RESULT_COMPLIANT;
356:
357: switch (workitem->get_type(workitem))
358: {
359: case IMV_WORKITEM_TCP_PORT_OPEN:
360: protocol_family = IPPROTO_TCP;
361: closed_port_policy = TRUE;
362: break;
363: case IMV_WORKITEM_TCP_PORT_BLOCK:
364: protocol_family = IPPROTO_TCP;
365: closed_port_policy = FALSE;
366: break;
367: case IMV_WORKITEM_UDP_PORT_OPEN:
368: protocol_family = IPPROTO_UDP;
369: closed_port_policy = TRUE;
370: break;
371: case IMV_WORKITEM_UDP_PORT_BLOCK:
372: protocol_family = IPPROTO_UDP;
373: closed_port_policy = FALSE;
374: break;
375: default:
376: continue;
377: }
378: port_list = get_port_list(protocol_family, closed_port_policy,
379: workitem->get_arg_str(workitem));
380: protocol_str = (protocol_family == IPPROTO_TCP) ? "tcp" : "udp";
381: result_str[0] = '\0';
382: pos = result_str;
383: len = BUF_LEN;
384: first = TRUE;
385:
386: e1 = port_filter_attr->create_port_enumerator(port_filter_attr);
387: while (e1->enumerate(e1, &blocked, &protocol, &port))
388: {
389: port_range_t *port_range;
390: bool passed, found = FALSE;
391: char buf[20];
392:
393: if (blocked || protocol != protocol_family)
394: {
395: /* ignore closed ports or non-matching protocols */
396: continue;
397: }
398:
399: e2 = port_list->create_enumerator(port_list);
400: while (e2->enumerate(e2, &port_range))
401: {
402: if (port >= port_range->start && port <= port_range->stop)
403: {
404: found = TRUE;
405: break;
406: }
407: }
408: e2->destroy(e2);
409:
410: passed = (closed_port_policy == found);
411: DBG2(DBG_IMV, "%s port %5u open: %s", protocol_str, port,
412: passed ? "ok" : "fatal");
413: if (!passed)
414: {
415: eval = TNC_IMV_EVALUATION_RESULT_NONCOMPLIANT_MINOR;
416: snprintf(buf, sizeof(buf), "%s/%u", protocol_str, port);
417: scanner_state->add_violating_port(scanner_state, strdup(buf));
418: if (first)
419: {
420: written = snprintf(pos, len, "violating %s ports:",
421: protocol_str);
422: if (written > 0 && written < len)
423: {
424: pos += written;
425: len -= written;
426: }
427: first = FALSE;
428: }
429: written = snprintf(pos, len, " %u", port);
430: if (written < 0 || written >= len)
431: {
432: pos += len - 1;
433: *pos = '\0';
434: }
435: else
436: {
437: pos += written;
438: len -= written;
439: }
440: }
441: }
442: e1->destroy(e1);
443:
444: if (first)
445: {
446: snprintf(pos, len, "no violating %s ports", protocol_str);
447: }
448: port_list->destroy(port_list);
449:
450: session->remove_workitem(session, enumerator);
451: rec = workitem->set_result(workitem, result_str, eval);
452: state->update_recommendation(state, rec, eval);
453: imcv_db->finalize_workitem(imcv_db, workitem);
454: workitem->destroy(workitem);
455: }
456: enumerator->destroy(enumerator);
457: }
458:
459: /* finalized all workitems ? */
460: if (handshake_state == IMV_SCANNER_STATE_WORKITEMS &&
461: session->get_workitem_count(session, imv_id) == 0)
462: {
463: result = out_msg->send_assessment(out_msg);
464: out_msg->destroy(out_msg);
465: scanner_state->set_handshake_state(scanner_state, IMV_SCANNER_STATE_END);
466:
467: if (result != TNC_RESULT_SUCCESS)
468: {
469: return result;
470: }
471: return this->agent->provide_recommendation(this->agent, state);
472: }
473:
474: /* send non-empty PA-TNC message with excl flag not set */
475: if (out_msg->get_attribute_count(out_msg))
476: {
477: result = out_msg->send(out_msg, FALSE);
478: }
479: out_msg->destroy(out_msg);
480:
481: return result;
482: }
483:
484: METHOD(imv_agent_if_t, solicit_recommendation, TNC_Result,
485: private_imv_scanner_agent_t *this, TNC_ConnectionID id)
486: {
487: imv_state_t *state;
488:
489: if (!this->agent->get_state(this->agent, id, &state))
490: {
491: return TNC_RESULT_FATAL;
492: }
493: return this->agent->provide_recommendation(this->agent, state);
494: }
495:
496: METHOD(imv_agent_if_t, destroy, void,
497: private_imv_scanner_agent_t *this)
498: {
499: this->agent->destroy(this->agent);
500: free(this);
501: }
502:
503: /**
504: * Described in header.
505: */
506: imv_agent_if_t *imv_scanner_agent_create(const char *name, TNC_IMVID id,
507: TNC_Version *actual_version)
508: {
509: private_imv_scanner_agent_t *this;
510: imv_agent_t *agent;
511:
512: agent = imv_agent_create(name, msg_types, countof(msg_types), id,
513: actual_version);
514: if (!agent)
515: {
516: return NULL;
517: }
518:
519: INIT(this,
520: .public = {
521: .bind_functions = _bind_functions,
522: .notify_connection_change = _notify_connection_change,
523: .receive_message = _receive_message,
524: .receive_message_long = _receive_message_long,
525: .batch_ending = _batch_ending,
526: .solicit_recommendation = _solicit_recommendation,
527: .destroy = _destroy,
528: },
529: .agent = agent,
530: );
531:
532: return &this->public;
533: }
534: