2 * Copyright (C) 2011-2013 Sansar Choinyambuu, Andreas Steffen
3 * HSR Hochschule fuer Technik Rapperswil
5 * This program is free software; you can redistribute it and/or modify it
6 * under the terms of the GNU General Public License as published by the
7 * Free Software Foundation; either version 2 of the License, or (at your
8 * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
10 * This program is distributed in the hope that it will be useful, but
11 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
12 * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
16 #include "imv_attestation_process.h"
19 #include <ietf/ietf_attr_pa_tnc_error.h>
23 #include <tcg/pts/tcg_pts_attr_aik.h>
24 #include <tcg/pts/tcg_pts_attr_dh_nonce_params_resp.h>
25 #include <tcg/pts/tcg_pts_attr_file_meas.h>
26 #include <tcg/pts/tcg_pts_attr_meas_algo.h>
27 #include <tcg/pts/tcg_pts_attr_proto_caps.h>
28 #include <tcg/pts/tcg_pts_attr_simple_comp_evid.h>
29 #include <tcg/pts/tcg_pts_attr_simple_evid_final.h>
30 #include <tcg/pts/tcg_pts_attr_tpm_version_info.h>
31 #include <tcg/pts/tcg_pts_attr_unix_file_meta.h>
33 #include <utils/debug.h>
34 #include <crypto/hashers/hasher.h>
38 bool imv_attestation_process(pa_tnc_attr_t
*attr
, imv_msg_t
*out_msg
,
40 pts_meas_algorithms_t supported_algorithms
,
41 pts_dh_group_t supported_dh_groups
,
42 pts_database_t
*pts_db
,
43 credential_manager_t
*pts_credmgr
)
45 imv_attestation_state_t
*attestation_state
;
49 attestation_state
= (imv_attestation_state_t
*)state
;
50 pts
= attestation_state
->get_pts(attestation_state
);
51 attr_type
= attr
->get_type(attr
);
53 switch (attr_type
.type
)
55 case TCG_PTS_PROTO_CAPS
:
57 tcg_pts_attr_proto_caps_t
*attr_cast
;
58 pts_proto_caps_flag_t flags
;
60 attr_cast
= (tcg_pts_attr_proto_caps_t
*)attr
;
61 flags
= attr_cast
->get_flags(attr_cast
);
62 pts
->set_proto_caps(pts
, flags
);
65 case TCG_PTS_MEAS_ALGO_SELECTION
:
67 tcg_pts_attr_meas_algo_t
*attr_cast
;
68 pts_meas_algorithms_t selected_algorithm
;
70 attr_cast
= (tcg_pts_attr_meas_algo_t
*)attr
;
71 selected_algorithm
= attr_cast
->get_algorithms(attr_cast
);
72 if (!(selected_algorithm
& supported_algorithms
))
74 DBG1(DBG_IMV
, "PTS-IMC selected unsupported"
75 " measurement algorithm");
78 pts
->set_meas_algorithm(pts
, selected_algorithm
);
79 state
->set_action_flags(state
, IMV_ATTESTATION_FLAG_ALGO
);
82 case TCG_PTS_DH_NONCE_PARAMS_RESP
:
84 tcg_pts_attr_dh_nonce_params_resp_t
*attr_cast
;
85 int nonce_len
, min_nonce_len
;
86 pts_dh_group_t dh_group
;
87 pts_meas_algorithms_t offered_algorithms
, selected_algorithm
;
88 chunk_t responder_value
, responder_nonce
;
90 attr_cast
= (tcg_pts_attr_dh_nonce_params_resp_t
*)attr
;
91 responder_nonce
= attr_cast
->get_responder_nonce(attr_cast
);
93 /* check compliance of responder nonce length */
94 min_nonce_len
= lib
->settings
->get_int(lib
->settings
,
95 "libimcv.plugins.imv-attestation.min_nonce_len", 0);
96 nonce_len
= responder_nonce
.len
;
97 if (nonce_len
< PTS_MIN_NONCE_LEN
||
98 (min_nonce_len
> 0 && nonce_len
< min_nonce_len
))
100 attr
= pts_dh_nonce_error_create(
101 max(PTS_MIN_NONCE_LEN
, min_nonce_len
),
103 out_msg
->add_attribute(out_msg
, attr
);
107 dh_group
= attr_cast
->get_dh_group(attr_cast
);
108 if (!(dh_group
& supported_dh_groups
))
110 DBG1(DBG_IMV
, "PTS-IMC selected unsupported DH group");
114 offered_algorithms
= attr_cast
->get_hash_algo_set(attr_cast
);
115 selected_algorithm
= pts_meas_algo_select(supported_algorithms
,
117 if (selected_algorithm
== PTS_MEAS_ALGO_NONE
)
119 attr
= pts_hash_alg_error_create(supported_algorithms
);
120 out_msg
->add_attribute(out_msg
, attr
);
123 pts
->set_dh_hash_algorithm(pts
, selected_algorithm
);
125 if (!pts
->create_dh_nonce(pts
, dh_group
, nonce_len
))
130 responder_value
= attr_cast
->get_responder_value(attr_cast
);
131 pts
->set_peer_public_value(pts
, responder_value
,
134 /* Calculate secret assessment value */
135 if (!pts
->calculate_secret(pts
))
141 case TCG_PTS_TPM_VERSION_INFO
:
143 tcg_pts_attr_tpm_version_info_t
*attr_cast
;
144 chunk_t tpm_version_info
;
146 attr_cast
= (tcg_pts_attr_tpm_version_info_t
*)attr
;
147 tpm_version_info
= attr_cast
->get_tpm_version_info(attr_cast
);
148 pts
->set_tpm_version_info(pts
, tpm_version_info
);
153 tcg_pts_attr_aik_t
*attr_cast
;
154 certificate_t
*aik
, *issuer
;
155 public_key_t
*public;
158 bool trusted
= FALSE
;
160 attr_cast
= (tcg_pts_attr_aik_t
*)attr
;
161 aik
= attr_cast
->get_aik(attr_cast
);
164 DBG1(DBG_IMV
, "AIK unavailable");
167 if (aik
->get_type(aik
) == CERT_X509
)
169 public = aik
->get_public_key(aik
);
170 public->get_fingerprint(public, KEYID_PUBKEY_INFO_SHA1
, &keyid
);
171 DBG1(DBG_IMV
, "verifying AIK certificate with keyid %#B", &keyid
);
172 public->destroy(public);
174 e
= pts_credmgr
->create_trusted_enumerator(pts_credmgr
,
175 KEY_ANY
, aik
->get_issuer(aik
), FALSE
);
176 while (e
->enumerate(e
, &issuer
))
178 if (aik
->issued_by(aik
, issuer
, NULL
))
185 DBG1(DBG_IMV
, "AIK certificate is %strusted",
186 trusted
? "" : "not ");
192 pts
->set_aik(pts
, aik
);
195 case TCG_PTS_FILE_MEAS
:
197 TNC_IMV_Evaluation_Result eval
;
198 TNC_IMV_Action_Recommendation rec
;
199 tcg_pts_attr_file_meas_t
*attr_cast
;
200 u_int16_t request_id
;
201 int arg_int
, file_count
;
202 pts_meas_algorithms_t algo
;
203 pts_file_meas_t
*measurements
;
204 imv_session_t
*session
;
205 imv_workitem_t
*workitem
, *found
= NULL
;
206 imv_workitem_type_t type
;
207 char result_str
[BUF_LEN
], *platform_info
;
208 bool is_dir
, correct
;
209 enumerator_t
*enumerator
;
211 eval
= TNC_IMV_EVALUATION_RESULT_COMPLIANT
;
212 session
= state
->get_session(state
);
213 algo
= pts
->get_meas_algorithm(pts
);
214 platform_info
= pts
->get_platform_info(pts
);
215 attr_cast
= (tcg_pts_attr_file_meas_t
*)attr
;
216 measurements
= attr_cast
->get_measurements(attr_cast
);
217 request_id
= measurements
->get_request_id(measurements
);
218 file_count
= measurements
->get_file_count(measurements
);
220 DBG1(DBG_IMV
, "measurement request %d returned %d file%s:",
221 request_id
, file_count
, (file_count
== 1) ? "":"s");
225 enumerator
= session
->create_workitem_enumerator(session
);
226 while (enumerator
->enumerate(enumerator
, &workitem
))
228 /* request ID consist of lower 16 bits of workitem ID */
229 if ((workitem
->get_id(workitem
) & 0xffff) == request_id
)
238 DBG1(DBG_IMV
, " no entry found for file measurement "
239 "request %d", request_id
);
240 enumerator
->destroy(enumerator
);
243 type
= found
->get_type(found
);
244 arg_int
= found
->get_arg_int(found
);
249 case IMV_WORKITEM_FILE_REF_MEAS
:
250 case IMV_WORKITEM_FILE_MEAS
:
253 case IMV_WORKITEM_DIR_REF_MEAS
:
254 case IMV_WORKITEM_DIR_MEAS
:
260 case IMV_WORKITEM_FILE_MEAS
:
261 case IMV_WORKITEM_DIR_MEAS
:
265 /* check hashes from database against measurements */
266 e
= pts_db
->create_file_hash_enumerator(pts_db
,
267 platform_info
, algo
, is_dir
, arg_int
);
270 eval
= TNC_IMV_EVALUATION_RESULT_ERROR
;
273 correct
= measurements
->verify(measurements
, e
, is_dir
);
276 attestation_state
->set_measurement_error(
278 IMV_ATTESTATION_ERROR_FILE_MEAS_FAIL
);
279 eval
= TNC_IMV_EVALUATION_RESULT_NONCOMPLIANT_MINOR
;
283 snprintf(result_str
, BUF_LEN
, "%s measurement%s correct",
284 is_dir
? "directory" : "file",
285 correct
? "" : " not");
288 case IMV_WORKITEM_FILE_REF_MEAS
:
289 case IMV_WORKITEM_DIR_REF_MEAS
:
295 e
= measurements
->create_enumerator(measurements
);
296 while (e
->enumerate(e
, &filename
, &measurement
))
298 if (pts_db
->add_file_measurement(pts_db
,
299 platform_info
, algo
, measurement
, filename
,
300 is_dir
, arg_int
) != SUCCESS
)
302 eval
= TNC_IMV_EVALUATION_RESULT_ERROR
;
306 snprintf(result_str
, BUF_LEN
, "%s reference measurement "
307 "successful", is_dir
? "directory" : "file");
314 session
->remove_workitem(session
, enumerator
);
315 enumerator
->destroy(enumerator
);
316 rec
= found
->set_result(found
, result_str
, eval
);
317 state
->update_recommendation(state
, rec
, eval
);
318 imcv_db
->finalize_workitem(imcv_db
, found
);
319 found
->destroy(found
);
323 measurements
->check(measurements
, pts_db
, platform_info
, algo
);
327 case TCG_PTS_UNIX_FILE_META
:
329 tcg_pts_attr_file_meta_t
*attr_cast
;
331 pts_file_meta_t
*metadata
;
332 pts_file_metadata_t
*entry
;
333 time_t created
, modified
, accessed
;
337 attr_cast
= (tcg_pts_attr_file_meta_t
*)attr
;
338 metadata
= attr_cast
->get_metadata(attr_cast
);
339 file_count
= metadata
->get_file_count(metadata
);
341 DBG1(DBG_IMV
, "metadata request returned %d file%s:",
342 file_count
, (file_count
== 1) ? "":"s");
344 e
= metadata
->create_enumerator(metadata
);
345 while (e
->enumerate(e
, &entry
))
347 DBG1(DBG_IMV
, " '%s' (%"PRIu64
" bytes)"
348 " owner %"PRIu64
", group %"PRIu64
", type %N",
349 entry
->filename
, entry
->filesize
, entry
->owner
,
350 entry
->group
, pts_file_type_names
, entry
->type
);
352 created
= entry
->created
;
353 modified
= entry
->modified
;
354 accessed
= entry
->accessed
;
356 DBG1(DBG_IMV
, " created %T, modified %T, accessed %T",
357 &created
, utc
, &modified
, utc
, &accessed
, utc
);
362 case TCG_PTS_SIMPLE_COMP_EVID
:
364 tcg_pts_attr_simple_comp_evid_t
*attr_cast
;
365 pts_comp_func_name_t
*name
;
366 pts_comp_evidence_t
*evidence
;
367 pts_component_t
*comp
;
370 attr_cast
= (tcg_pts_attr_simple_comp_evid_t
*)attr
;
371 evidence
= attr_cast
->get_comp_evidence(attr_cast
);
372 name
= evidence
->get_comp_func_name(evidence
, &depth
);
374 comp
= attestation_state
->get_component(attestation_state
, name
);
377 DBG1(DBG_IMV
, " no entry found for component evidence request");
380 if (comp
->verify(comp
, name
->get_qualifier(name
), pts
,
381 evidence
) != SUCCESS
)
383 attestation_state
->set_measurement_error(attestation_state
,
384 IMV_ATTESTATION_ERROR_COMP_EVID_FAIL
);
385 name
->log(name
, " measurement mismatch for ");
389 case TCG_PTS_SIMPLE_EVID_FINAL
:
391 tcg_pts_attr_simple_evid_final_t
*attr_cast
;
393 pts_meas_algorithms_t comp_hash_algorithm
;
394 chunk_t pcr_comp
, tpm_quote_sig
, evid_sig
;
395 chunk_t pcr_composite
, quote_info
;
396 bool use_quote2
, use_ver_info
;
398 attr_cast
= (tcg_pts_attr_simple_evid_final_t
*)attr
;
399 flags
= attr_cast
->get_quote_info(attr_cast
, &comp_hash_algorithm
,
400 &pcr_comp
, &tpm_quote_sig
);
402 if (flags
!= PTS_SIMPLE_EVID_FINAL_NO
)
404 use_quote2
= (flags
== PTS_SIMPLE_EVID_FINAL_QUOTE_INFO2
||
405 flags
== PTS_SIMPLE_EVID_FINAL_QUOTE_INFO2_CAP_VER
);
406 use_ver_info
= (flags
== PTS_SIMPLE_EVID_FINAL_QUOTE_INFO2_CAP_VER
);
408 /* Construct PCR Composite and TPM Quote Info structures */
409 if (!pts
->get_quote_info(pts
, use_quote2
, use_ver_info
,
410 comp_hash_algorithm
, &pcr_composite
, "e_info
))
412 DBG1(DBG_IMV
, "unable to construct TPM Quote Info");
416 if (!chunk_equals(pcr_comp
, pcr_composite
))
418 DBG1(DBG_IMV
, "received PCR Composite does not match "
420 attestation_state
->set_measurement_error(attestation_state
,
421 IMV_ATTESTATION_ERROR_TPM_QUOTE_FAIL
);
422 free(pcr_composite
.ptr
);
423 free(quote_info
.ptr
);
426 DBG2(DBG_IMV
, "received PCR Composite matches constructed one");
427 free(pcr_composite
.ptr
);
429 if (!pts
->verify_quote_signature(pts
, quote_info
, tpm_quote_sig
))
431 attestation_state
->set_measurement_error(attestation_state
,
432 IMV_ATTESTATION_ERROR_TPM_QUOTE_FAIL
);
433 free(quote_info
.ptr
);
436 DBG2(DBG_IMV
, "TPM Quote Info signature verification successful");
437 free(quote_info
.ptr
);
440 * Finalize any pending measurement registrations and check
441 * if all expected component measurements were received
443 attestation_state
->finalize_components(attestation_state
);
446 if (attr_cast
->get_evid_sig(attr_cast
, &evid_sig
))
448 /** TODO: What to do with Evidence Signature */
449 DBG1(DBG_IMV
, "this version of the Attestation IMV can not "
450 "handle Evidence Signatures");
455 /* TODO: Not implemented yet */
456 case TCG_PTS_INTEG_MEAS_LOG
:
457 /* Attributes using XML */
458 case TCG_PTS_TEMPL_REF_MANI_SET_META
:
459 case TCG_PTS_VERIFICATION_RESULT
:
460 case TCG_PTS_INTEG_REPORT
:
462 case TCG_PTS_WIN_FILE_META
:
463 case TCG_PTS_REGISTRY_VALUE
:
464 /* Received on IMC side only*/
465 case TCG_PTS_REQ_PROTO_CAPS
:
466 case TCG_PTS_DH_NONCE_PARAMS_REQ
:
467 case TCG_PTS_DH_NONCE_FINISH
:
468 case TCG_PTS_MEAS_ALGO
:
469 case TCG_PTS_GET_TPM_VERSION_INFO
:
470 case TCG_PTS_REQ_TEMPL_REF_MANI_SET_META
:
471 case TCG_PTS_UPDATE_TEMPL_REF_MANI
:
472 case TCG_PTS_GET_AIK
:
473 case TCG_PTS_REQ_FUNC_COMP_EVID
:
474 case TCG_PTS_GEN_ATTEST_EVID
:
475 case TCG_PTS_REQ_FILE_META
:
476 case TCG_PTS_REQ_FILE_MEAS
:
477 case TCG_PTS_REQ_INTEG_MEAS_LOG
:
479 DBG1(DBG_IMV
, "received unsupported attribute '%N'",
480 tcg_attr_names
, attr
->get_type(attr
));