c8719a073d
libimcv: Fix harcoded IMCV_DEFAULT_POLICY_SCRIPT name
...
I came across an issue with src/libimcv/imcv.c where
IMCV_DEFAULT_POLICY_SCRIPT is hardcoded.
It fails where ipsec_script is renamed to, for example, strongswan from
default ipsec.
2014-10-13 16:15:33 +02:00
8b812065f0
Support of multiple directed segmentation contracts
2014-10-11 14:50:08 +02:00
ab99939628
unit-tests: Updated Makefile
2014-10-11 14:50:08 +02:00
a05ca71d07
unit-tests: Added test for seg_contract_manager
2014-10-11 14:50:08 +02:00
4af020be37
Updated build-database.sh script to 3.13.0-37 kernel
2014-10-11 11:40:43 +02:00
b95b664644
Incremental parsing fixes
2014-10-05 22:52:59 +02:00
1bea00651d
Added add_segment() method to TCG/PTS attributes
2014-10-05 19:43:27 +02:00
01be87d086
Added add_segment() method to TCG/SEG attributes
2014-10-05 19:14:38 +02:00
a5dfe7a29a
OS IMV proposes IF-M segmentation contract
...
The OS IMV sends a TCG IF-M Segmentation contract request.
All IETF standard attributes support segmentation. Additionally
the IETF Installed Packages standard attributes supports
incremental processing while segments are received.
2014-10-05 18:43:55 +02:00
fc47211740
SWID IMC proposes IF-M segmentation contracts
2014-10-05 18:43:55 +02:00
30774ee5d6
unit-tests: Updated libimcv test suite
2014-10-05 18:43:54 +02:00
9a515a8856
Added add_segment() method to IETF attributes
2014-10-05 18:43:54 +02:00
97ec4cb055
Added add_segment() method to ITA attributes
2014-10-05 18:43:54 +02:00
903a427008
Implemented incremental processing of SWID tag [ID] inventory attribute
2014-10-05 18:43:54 +02:00
eba0cbcee3
Implemented add_segment method for PA-TNC attributes
2014-10-05 12:55:38 +02:00
e77df5a1f6
Added total length parameter in PA-TNC attribute constructor
2014-10-05 12:55:38 +02:00
ebfd8278f9
Assignment of flags starts with bit 0
2014-10-05 12:55:38 +02:00
95e1524a64
Register the reception of the AIK attribute
2014-10-05 12:55:38 +02:00
4f5b435fe9
Unit tests for libimcv
2014-10-05 12:55:38 +02:00
e23cad3564
Compacted chunk creation in ita_attr_command constructor
2014-10-05 12:55:38 +02:00
d6fb2cc6e3
Merged libpts into libimcv
2014-10-05 12:55:37 +02:00
c4d0987609
Added out message queue for imv_msg receive method
2014-10-05 12:55:37 +02:00
e911ac9a5f
Implemented IF-M segmentation
2014-10-05 12:55:37 +02:00
89d12654b3
Added request variable to get_info_string method
2014-10-03 22:25:09 +02:00
f50968976b
Implemented IF-M segmentation contracts
2014-10-03 22:25:09 +02:00
38b5f527e2
Allow to treat specified Attribute-Type-Not-Supported errors as non-fatal
2014-10-03 22:25:09 +02:00
eafe8795ca
Added Debian 7.6 to IMV database
2014-08-06 08:04:42 +02:00
78ec8c6085
unused os_info_t object removed
2014-08-06 07:55:54 +02:00
3b96147353
Determine type of unsupported PA-TNC attribute in error message
2014-07-16 15:57:15 +02:00
644fc4e1ff
Added Android 4.4.4 to IMV database
2014-06-27 08:27:28 +02:00
d82aa931db
Auxiliary swid_tagstats table boosts performance
2014-06-23 13:32:50 +02:00
927dff2366
The policy_started check is not needed any more
2014-06-18 14:01:02 +02:00
8fc0eae37b
Added Android 4.3 and 4.4.3 to imv database
2014-06-10 16:19:00 +02:00
35e08cde3c
android: Add all Android.mk files to the tarball
2014-06-06 10:12:26 +02:00
fc50731376
imv: Provide database table scheme for MySQL
2014-06-04 15:53:10 +02:00
ecc6c2e8a4
libimcv: Pass TNC_SESSION_ID as argument instead as a environment variable
...
Doing so works on Windows as well.
2014-06-04 15:53:10 +02:00
9b7d1a3b33
libimcv: Be a little more verbose about the Windows system reported
2014-06-04 15:53:10 +02:00
ede10dd974
imv: Return an empty enumerator instead of null, as expected by callers
2014-06-04 15:53:10 +02:00
5388389bef
imc-os: Add missing TNC_IMC_API definitions, fixes warnings on Windows
2014-06-04 15:53:10 +02:00
0c512610cc
imv-os: Don't build pacman on Windows
2014-06-04 15:53:09 +02:00
1cd9bb49d8
libimcv: Use TNC_IMV_API prefix on TNC functions for correct declspec
2014-06-04 15:53:07 +02:00
6b98c00285
libimcv: Silence integer to pointer cast warnings
2014-06-04 15:53:07 +02:00
9bac2c9e40
libimcv: Port os_info (partially) to Windows
2014-06-04 15:53:06 +02:00
09e5f15a13
libimcv: Disable default syslog() logging if not supported
2014-06-04 15:53:06 +02:00
fb7cb97d6e
libimcv: Link against ws_w32 on Windows
2014-06-04 15:53:06 +02:00
4163421f91
plugins: Don't link with -rdynamic on Windows
2014-06-04 15:53:02 +02:00
32cb700cd0
Added Debian 7.5 product and all Debian armv6l products
2014-05-31 20:37:56 +02:00
7b05b0bc28
Fixed typo in tables.sql
2014-05-31 20:37:56 +02:00
a123f470f0
Additional index to improve performance
2014-05-31 20:37:56 +02:00
ba6c27f063
Added all SWID tables and example regids
2014-05-21 14:00:31 +02:00
887a88d55b
Similar statistics for packages and file measurements
2014-05-01 09:17:33 +02:00
289456d26a
libimcv: Updated Android.mk
2014-04-25 14:26:31 +02:00
f5a1cfe3f8
pacman.sh now fetches Ubuntu 14.04 security updates
2014-04-24 09:08:07 +02:00
1d7324133b
Indicate IMV in assessment log statement
2014-04-15 09:21:06 +02:00
3e7044b45e
Implemented segmented SWID tag attributes on IMV side
2014-04-15 09:21:06 +02:00
8c40609f96
Use python-based swidGenerator to generated SWID tags
2014-04-15 09:21:06 +02:00
8505ce1cc6
Updated imv database templates
2014-04-15 09:21:05 +02:00
40e8c67392
Use cached pid for product-based package access
2014-04-15 09:21:05 +02:00
48f37c448c
Make Attestation IMV independent of OS IMV
2014-04-15 09:21:05 +02:00
4894bfa227
Separated IMV session management from IMV policy database
2014-04-15 09:21:05 +02:00
c54c26dd17
Implemented configurable Device ID in OS IMC
2014-04-15 09:21:05 +02:00
37ef086ea7
Added Ubuntu 14.04 to IMV database
2014-03-31 22:22:58 +02:00
a21d4096e5
Use logical AND function
2014-02-23 16:44:32 +01:00
ab13364c65
uclibc only defines strndup(3) if _GNU_SOURCE is defined
...
References #516 .
2014-02-19 16:11:47 +01:00
f03441c4dd
pacman.sh creates /etc/pts/dists directory if it doesn't exist yet
2014-02-13 13:21:47 +01:00
1ec3476398
libimcv: Move settings to <ns>.imcv and <ns>.plugins with fallback
2014-02-12 14:34:34 +01:00
34d3bfcf14
lib: Add global config namespace
2014-02-12 14:34:31 +01:00
de7f5305d9
libimcv: Install SQL files in /usr/share/strongswan/templates/database
2014-02-12 14:08:34 +01:00
d6804e3041
Added missing semicolon in SQL statements
2014-02-05 10:15:56 +01:00
523c2874fb
Added Android 4.3.1 to products database table
2014-02-04 19:49:34 +01:00
2a43f7fd9e
Added new Android versions to PTS database
2014-02-04 06:59:01 +01:00
eeaa8a2417
Added TPMRA workitem support in PTS database
2014-01-16 01:46:55 +01:00
81d49c5cfd
Allow reason strings to be used as workitem result string
2014-01-13 12:06:17 +01:00
6009b6e0dd
Attestation IMV processes TPMRA workitem
2014-01-13 12:06:17 +01:00
3254f8b00a
Added TPM Remote Attestation (TPMRA) workitem
2014-01-10 11:55:21 +01:00
20c99edab9
android: Remove dependency on libvstr
2013-11-13 11:40:47 +01:00
b891c22aa9
Updated and split data.sql
2013-10-23 00:26:02 +02:00
50d7a55c96
Support Ubuntu 13.10 measurements
2013-10-21 21:33:30 +02:00
be8179abd2
Build all IMC/IMVs with -no-undefined
2013-09-12 01:44:50 +02:00
9af44ef5d9
Build all shared libraries with -no-undefined and link them properly
...
The flag is required to convince libtool on Cygwin to build DLLs. But on
Windows these shared libraries can not have undefined symbols, so we have to
link them explicitly to the libraries they reference.
For plugins this is currently not done, so only the monolithic build is
supported. The plugin loader wouldn't be able to load DLLs anyway, as
it tries to load files that don't exist on Cygwin.
2013-09-12 01:44:49 +02:00
5ec08a6a05
Make sure libstrongswan is initialized first in IMCs and IMVs
2013-09-11 20:58:18 +02:00
9b8137fdd3
Added tags table and some tag samples
2013-09-05 11:29:23 +02:00
86f00e6aff
Added regids table and some sample reqid data
2013-09-02 12:00:47 +02:00
70a80ef5d4
Output handler of a given workitem
2013-08-16 14:14:13 +02:00
b38d9d5a54
Implemented SWID prototype IMC/IMV pair
2013-08-15 23:34:23 +02:00
e5455e9413
imv-os: check_packages() fails if product query fails
2013-07-24 16:17:22 +02:00
346a4a1fc2
imv-scanner: Properly check snprintf() return value
2013-07-24 16:17:22 +02:00
0ceb288815
Fix various API doc issues and typos
...
Partially based on an old patch by Adrian-Ken Rueegsegger.
2013-07-18 18:30:36 +02:00
19cb07b890
automake: replace INCLUDES by AM_CPPFLAGS
...
INCLUDES are now deprecated and throw warnings when using automake 1.13.
We now also differentiate AM_CPPFLAGS and AM_CFLAGS, where includes and
defines are passed to AM_CPPFLAGS only.
2013-07-18 14:59:19 +02:00
d27f225d9a
Use strpfx() helper where appropriate
2013-07-08 18:49:30 +02:00
6bce8e1cfb
libimcv: Properly deinitialize libimcv
...
Other users of imcv_pa_tnc_attributes (libpts) check if it is NULL before
removing vendor IDs.
2013-07-08 18:49:28 +02:00
2c693364a8
imv-scanner: Only add a reason string if there is something to report
2013-07-08 18:49:26 +02:00
1973743443
libimcv: Android.mk added
2013-07-08 18:49:25 +02:00
51bc6a6e74
Cosmetics
2013-07-08 17:58:14 +02:00
34f894b6cc
Scanner IMV without workitems provides immediate recommendation, too
2013-07-08 17:53:05 +02:00
ea6ab9fb49
skip enforcement if a recent measurement was successful
2013-07-08 16:08:05 +02:00
69c4e34859
Always return a result string for a processed workitem
2013-07-04 22:55:58 +02:00
9844f240f8
Register packages under Debian 7.0 x86_64
2013-07-04 22:53:41 +02:00
6c969fee94
Don't backup old package lists
2013-07-01 10:00:43 +02:00
b18a531715
plugin-loader: Removed unused path argument of load() method
...
Multiple additional search paths can be added with the add_path()
method.
2013-06-28 10:44:15 +02:00
71c7b43541
Support blacklist field in PTS database
2013-06-26 12:07:09 +02:00
de8de88fa7
Updated PTS demo database
2013-06-26 10:14:25 +02:00
f4dcbe3bf2
Device can be member of multiple groups
2013-06-25 18:43:07 +02:00
72631301eb
Some IMV policy managers expect a TEXT string
2013-06-25 12:47:07 +02:00
59c9ec107f
Assign default group to newly created devices
2013-06-25 11:49:32 +02:00
632e5b0b99
Set device creation date if it hasn't been set yet
2013-06-24 20:18:16 +02:00
69c4715bf8
Send PA-TNC assessment result even if no workitems are available
2013-06-24 00:22:38 +02:00
02497901d0
Some pacman fixes
2013-06-23 16:23:19 +02:00
6b081a4c21
Some PTS database fixes
2013-06-21 23:25:25 +02:00
45eb318ed4
Implemented pacman in a more reliable way
2013-06-21 23:25:25 +02:00
4fe7294bb3
Define protocol string
2013-06-21 23:25:25 +02:00
41dabbad41
Generate result string for port scan workitems
2013-06-21 23:25:25 +02:00
8fbfe03e4e
Ignore non-matching protocols
2013-06-21 23:25:25 +02:00
e5dd8a1d34
Introduced workitems to Scanner IMV
2013-06-21 23:25:24 +02:00
da99df1443
Added ITA components to database
2013-06-21 23:25:24 +02:00
4cf568a785
Shortened names of default policy groups
2013-06-21 23:25:24 +02:00
19ce03be73
Store device with product ID
2013-06-21 23:25:24 +02:00
bf250acb06
Database changes needed to integrate Cygnet backend
2013-06-21 23:25:24 +02:00
01afff71cb
Implemented get|set_action_flag() methods
2013-06-21 23:25:24 +02:00
a45a2c9291
Implemented hierarchical policy groups
2013-06-21 23:25:24 +02:00
b1da8368d0
Introduced workitems to Attestation IMV
2013-06-21 23:25:23 +02:00
c174c116fe
Converted all IMVs to use generic IF-IMV API
2013-06-21 23:25:23 +02:00
ea2663ec03
Remove the constructor from the IMV agent interface
2013-06-21 23:25:23 +02:00
97f0a7ea77
Defined a generic IMV agent interface
2013-06-21 23:25:23 +02:00
7513a09ee5
Moved all functionality into imv_os_agent_t class turning imv_os_t into an IF-IMV skeleton
2013-06-21 23:25:23 +02:00
99c6a5f8a4
Moved batch_ending into separate source file
2013-06-21 23:25:23 +02:00
e1db511bbd
do not process workitems with NULL result
2013-06-21 23:25:23 +02:00
c219d7e31f
fixed enumeration of workitems for a given session
2013-06-21 23:25:23 +02:00
65148217b0
generate workitems based on group policy
2013-06-21 23:25:23 +02:00
0fca778254
Added file and directory reference measurements to workitems
2013-06-21 23:25:22 +02:00
2964562199
add overall recommendation to session database entry
2013-06-21 23:25:22 +02:00
4f6bf1a843
don't define a default database URI
2013-06-21 23:25:22 +02:00
1ecff25917
created a simple IMV Policy Manager
2013-06-21 23:25:22 +02:00
1571a11fa4
register received scanner attributes
2013-06-21 23:25:22 +02:00
a6266485be
refactored IMV policy management
2013-06-21 23:25:22 +02:00
4f9aabbfd7
implemented policy rules for OS IMV
2013-06-21 23:25:22 +02:00
7daf6d8cc5
check for zero-length device ID
2013-06-21 23:25:22 +02:00
033834719d
ITA-HSR/Device ID attribute & IMV OS state machine
2013-06-21 23:25:22 +02:00
bb9d8b1853
execute an _imv_policy script
2013-06-21 23:25:22 +02:00
b8db66de15
implemented IMV session control
2013-06-21 23:25:21 +02:00
71d740cac6
Make plugins in standalone libimcv configurable
2013-05-24 12:56:21 +02:00
70a7917e72
destroy SQL query
2013-04-21 16:00:23 +02:00
acbe87787b
pacman: Define gen_time out of the loop
...
It gets assigned if count==3 but only used later when count >= 7.
2013-03-25 17:13:49 +01:00
a1bc67d6c9
Switch encoding of AR Identity Value from binary to UTF-8
2013-03-22 10:37:49 +01:00
6e58f0a34f
activate logging before loading plugins
2013-03-21 18:04:31 +01:00
f361a85ebb
added ITA Echo PA-TNC Subtype and ITA Echo Attribute type
2013-03-11 09:30:20 +01:00
a498c7a9c3
moved ar_id from imv_agent to imv_state
2013-03-11 08:54:02 +01:00
1a9dee5d22
instead of cloning use extract_buf() method
2013-03-04 23:21:21 +01:00
c88104aa25
make TNC Access Requestor ID available to IMVs
2013-03-03 17:18:09 +01:00
eeb69761ae
third parameter was not copied
2013-03-02 22:03:07 +01:00
11adf114c1
Fixed Doxygen comments after scanning complete src directory
2013-03-02 18:31:53 +01:00
371b752f00
treat IF-M and IF-TNCCS remediation instructions/parameters in an equal way
2013-02-19 20:00:57 +01:00
2c1219c217
removed superfluous debug output
2013-02-15 15:19:16 +01:00
d20a2cc5f3
Add IF-M message subtype getter to IMC/IMV messages
2013-02-14 17:18:24 +01:00
bbe9261bbf
Use a generic constructor to create PA-TNC error attributes
2013-02-14 17:18:00 +01:00
bd1ee5bdc4
make AR identities available to IMVs via IF-IMV 1.4 draft
2013-02-11 15:30:44 +01:00
98063d8187
Don't use a time_t variable with fscanf when parsing uptime
...
Because "%u" is used as format string in the fscanf call that parses the
uptime and because the length of time_t varies on different platforms
and architectures the value was not written properly if time_t was longer
than an unsigned int and depending on how the target variable was aligned
on the stack. Since there is no conversion specifier to properly parse a
time_t value we use the appropriate integer type instead.
2013-02-08 11:33:13 +01:00
ba62be506a
improved control when an attribute request is sent
2013-02-03 20:48:05 +01:00
818fe7c024
send an error attribute if vendor ID or type of received attribute is reserved
2013-02-03 18:52:03 +01:00
677812dc66
Cast first argument for %.*s to int
2013-01-24 23:35:42 +01:00
39896d92ed
Try to determine OS type if name and version are configured
2013-01-24 19:13:41 +01:00
24cdf5340e
Add missing va_end() call
2013-01-24 19:13:41 +01:00
8d631ebabd
Encode IETF Numeric Version Service Pack Version with two byte words
2013-01-22 14:45:56 +01:00
1c65b6c305
make pacman.sh run under cron
2012-12-26 09:28:17 +01:00
6be6a52405
deleted newly constructed attributes in send_assessment
2012-12-24 12:06:12 +01:00
965fce31c3
newer releases of dpkg-query does not have PackageSpec
2012-12-09 13:55:22 +01:00
4037bb5288
ignore ports of the 127.0.1.1 internal system address
2012-12-09 13:26:34 +01:00
7e45257f7d
Reuse generic constructor in IMV/IMC message
2012-11-30 15:49:12 +01:00
a6722e5653
Add getters for the raw encoding in IMV/IMC messages
2012-11-30 15:49:07 +01:00
2a433075e2
Clean up whitespaces in IMC/IMV messages
2012-11-30 15:49:03 +01:00
fdce28c49c
Don't remove IETF standard errors while parsing IMC/IMV messages
2012-11-30 15:48:55 +01:00
18bb1a1540
Remove unused get_vendor_id() method in IETF error IF-M attributes
2012-11-30 15:48:44 +01:00
55b323c224
Check os_version when reading release file, os_name is not set for Debian
2012-11-30 15:48:39 +01:00
2b61f7baa3
store detected improper OS settings in database
2012-11-30 00:12:48 +01:00
7b6cc33eb2
store collected device information in database
2012-11-28 10:51:11 +01:00
ac6dd7d404
store unique device_id in database
2012-11-27 23:48:40 +01:00
710d89f07d
completed Polish language version
2012-11-23 21:45:04 +01:00
2810d934e5
cosmetics
2012-11-23 18:31:44 +01:00
9cbdfdb988
implemented output of item lists in remediation instructions
2012-11-23 18:30:00 +01:00
ee6aeca892
refactored reason string and remediation instructions framework
2012-11-23 12:30:33 +01:00
bf1cecdb6b
strndup() requires string.h header file
2012-11-18 19:41:03 +01:00
c1c98f5f4a
generate reason strings and remediation instructions for improper OS settings
2012-11-18 11:44:03 +01:00
3294cbd61e
fixed a memory leak in pacman
2012-11-17 08:16:53 +01:00
aa3061d432
removed unused variable
2012-11-17 08:16:23 +01:00
bacffb890e
discovered the use of strndup()
2012-11-15 11:48:57 +01:00
a95959cce6
implemented blacklisting of software packages
2012-11-14 11:38:45 +01:00
f94d32dba9
fixed remediation instructions output
2012-11-13 07:15:46 +01:00
e6a2de344d
fixed memory leak
2012-11-12 13:08:58 +01:00
a40372d82d
fixed typo in strcpy() function call
2012-11-12 12:31:26 +01:00
e6b117491f
implemented reason string and remediation instructions for OS IMV
2012-11-12 10:45:38 +01:00
742722e2f5
updated strongswan.conf man page
2012-11-12 10:45:38 +01:00
3de9a31a49
centralized processing of assessment information
2012-11-12 10:45:38 +01:00
af83700f88
implemented get_remediation_instructions()
2012-11-10 23:47:06 +01:00
b217e16f7e
removed debug output
2012-11-10 21:37:33 +01:00
db15c6dac1
implement a preferred language enumerator
2012-11-10 21:35:46 +01:00
84f9b9f9bd
corrected debug class
2012-11-09 15:50:10 +01:00
236eb5851a
added missing method assignments
2012-11-09 15:08:14 +01:00
d425f30e80
added missing --update parameter
2012-11-08 11:02:17 +01:00
da72eb388a
created packman daily update script
2012-11-08 09:19:10 +01:00
b18b924b2f
pacman supports differential security updates
2012-11-07 22:20:39 +01:00
Avesh Agarwal