Internet DRAFT - draft-ietf-nea-pa-tnc
draft-ietf-nea-pa-tnc
Network Working Group P. Sangster
Internet Draft Symantec Corporation
Intended status: Proposed Standard K. Narayan
Expires: April 2009 Cisco Systems
October 6, 2008
PA-TNC: A Posture Attribute Protocol (PA) Compatible with TNC
draft-ietf-nea-pa-tnc-02.txt
Status of this Memo
By submitting this Internet-Draft, each author represents that
any applicable patent or other IPR claims of which he or she is
aware have been or will be disclosed, and any of which he or she
becomes aware will be disclosed, in accordance with Section 6 of
BCP 79.
Internet-Drafts are working documents of the Internet
Engineering Task Force (IETF), its areas, and its working
groups. Note that other groups may also distribute working
documents as Internet-Drafts.
Internet-Drafts are draft documents valid for a maximum of six
months and may be updated, replaced, or obsoleted by other
documents at any time. It is inappropriate to use Internet-
Drafts as reference material or to cite them other than as "work
in progress."
The list of current Internet-Drafts can be accessed at
http://www.ietf.org/ietf/1id-abstracts.txt
The list of Internet-Draft Shadow Directories can be accessed at
http://www.ietf.org/shadow.html
This Internet-Draft will expire on January 6, 2009.
Copyright Notice
Copyright (C) The IETF Trust (2008).
Abstract
This document specifies PA-TNC, a Posture Attribute Protocol
identical to the Trusted Computing Group's IF-M 1.0 protocol.
The document then evaluates PA-TNC against the requirements
defined in the NEA Requirements specification.
Sangster & Narayan Expires April 6, 2009 [Page 1]
Internet-Draft PA-TNC October 2008
Conventions used in this document
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL
NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and
"OPTIONAL" in this document are to be interpreted as described
in RFC 2119 [1].
Table of Contents
1. Introduction.................................................3
1.1. Relationship to Trusted Network Connect..................3
1.2. Prerequisites............................................4
1.3. Message Diagram Conventions..............................4
2. Design Considerations........................................4
2.1. Standard Attribute Namespace for Interoperability........4
2.2. Vendor Defined Namespace for Differentiation and Agility 5
2.3. Use of TLV Based Encoding for Efficiency.................5
3. PA-TNC Message Protocol......................................6
3.1. PA-TNC Messaging Model...................................6
3.2. PA-TNC Relationship to PB-TNC............................7
3.3. PA-PB Posture Collector and Posture Validator Identifiers8
3.4. PA-TNC Messages in PB-TNC................................9
3.5. IETF Standard PA Subtypes................................9
3.6. PA-TNC Field Types......................................10
3.7. PA-TNC Message Header Format............................10
4. PA-TNC Attributes...........................................11
4.1. PA-TNC Attribute Header.................................11
4.2. IETF Standard PA-TNC Attribute Types....................13
4.2.1. Attribute Request..................................15
4.2.2. Product Information................................16
4.2.3. Numeric Version....................................17
4.2.4. String Version.....................................19
4.2.5. Operational Status.................................21
4.2.6. Port Filter........................................22
4.2.7. Installed Packages.................................24
4.2.8. PA-TNC Error.......................................26
4.2.8.1. Invalid Parameter Error Code...................27
4.2.8.2. Version Not Supported Error Code...............28
4.2.8.3. Attribute Type Not Supported Error Code........29
4.2.9. Assessment Result..................................30
4.2.10. Remediation Instructions..........................31
4.2.10.1. IETF Standard PA-TNC Remediation Parameters
Types..................................................32
4.2.11. Forwarding Enabled................................33
4.2.12. Factory Default Password Enabled..................34
4.3. Vendor-Defined Attributes...............................35
5. Evaluation Against NEA Requirements.........................35
Sangster & Narayan Expires April 6, 2009 [Page 2]
Internet-Draft PA-TNC October 2008
5.1. Evaluation Against Requirement C-1......................35
5.2. Evaluation Against Requirement C-2......................36
5.3. Evaluation Against Requirement C-3......................36
5.4. Evaluation Against Requirement C-4......................36
5.5. Evaluation Against Requirement C-5......................36
5.6. Evaluation Against Requirement C-6......................36
5.7. Evaluation Against Requirement C-7......................37
5.8. Evaluation Against Requirement C-8......................37
5.9. Evaluation Against Requirement C-9......................37
5.10. Evaluation Against Requirement C-10....................38
5.11. Evaluation Against Requirement C-11....................38
5.12. Evaluation Against Requirement PA-1....................38
5.13. Evaluation Against Requirement PA-2....................38
5.14. Evaluation Against Requirement PA-3....................39
5.15. Evaluation Against Requirement PA-4....................39
5.16. Evaluation Against Requirement PA-5....................39
5.17. Evaluation Against Requirement PA-6....................40
6. Security Considerations.....................................40
6.1. Trust Relationships.....................................40
6.1.1. Posture Collector..................................40
6.1.2. Posture Validator..................................40
6.1.3. Posture Broker Client, Posture Broker Server.......41
6.2. Security Threats........................................41
6.2.1. Attribute Theft....................................41
6.2.2. Message Fabrication................................42
6.2.3. Attribute Modification.............................42
6.2.4. Attribute Replay...................................42
6.2.5. Attribute Insertion................................42
6.2.6. Denial of Service..................................43
7. Privacy Considerations......................................43
8. IANA Considerations.........................................44
8.1. IETF Standard PA Subtypes...............................44
8.2. Registry for IETF Standard PA-TNC Attribute Types.......44
8.3. Registry for IETF Standard PA-TNC Error Codes...........45
8.4. Registry for IETF Standard Remediation Parameter Types..45
9. Acknowledgments.............................................46
10. References.................................................46
10.1. Normative References...................................46
10.2. Informative References.................................46
Appendix A: Use Cases..........................................46
A.1. Initial Client triggered assessment.....................46
A.1.1. Message Contents...................................48
A.1.1.1. N/W Join.......................................48
A.1.1.2. Request Posture (Req Post.)....................48
A.1.1.3. Vendor X Patch Posture (VndrX Patch Posture)...48
A.1.1.4. OS Posture.....................................49
A.1.1.5. Posture Report.................................49
Sangster & Narayan Expires April 6, 2009 [Page 3]
Internet-Draft PA-TNC October 2008
A.1.1.6. Verify Posture.................................49
A.1.1.7. OS Posture Result (OS Reslt)...................50
A.1.1.8. Vendor X Patch Result (VndrX Patch Result).....50
A.1.1.9. Assessment Result (Assess Result)..............50
A.1.1.10. Posture Result (OS PRslt & Vndr X Post PResult)50
A.2. Server initiated Assessment with Remediation............51
A.2.1. Message Contents...................................52
A.2.1.1. N/W Join.......................................52
A.2.1.2. Create Posture Request (Create Posture Req.)...52
A.2.1.3. Vendor Y AV Posture Request (Vndr Y AV Posture
Req)...................................................53
A.2.1.4. Vendor X AV Posture Request (Vndr X AV Posture
Req)...................................................53
A.2.1.5. Posture Request................................54
A.2.1.6. Posture Request (Vndr X AV Post Req & Vndr Y AV
Post Req)...............................................54
A.2.1.7. Vendor Y AV Posture (Vndr Y AV Posture)........54
A.2.1.8. Vendor X AV Posture (Vndr X AV Posture)........54
A.2.1.9. Posture Response...............................55
A.2.1.10. Verify Posture................................55
A.2.1.11. Vendor Y AV Posture Result (Vndr Y AV Post
Result)................................................55
A.2.1.12. Vendor X AV Posture Result (Vndr X AV Post Reslt)
.......................................................56
A.2.1.13. Assessment Result (Assess Result).............56
A.2.1.14. Posture Result (Vndr X AV Post Reslt & Vndr Y AV
Post Reslt).............................................56
A.3. Client triggered re-assessment..........................56
A.3.1. Message Contents...................................58
A.3.1.1. Enable VPN Client (Enble)......................58
A.3.1.2. Notify Status Change (VPN Status Change).......58
A.3.1.3. Notify Posture Change (Posture Change).........58
A.3.1.4. Request Posture (Req. Post)....................58
A.3.1.5. Inspect/Request Info (Ins/Rq Info).............58
A.3.1.6. Vendor X VPN Posture (VPNX Post)...............58
A.3.1.7. Vendor Y VPN Posture (VPNY Post)...............59
A.3.1.8. Posture Report.................................60
A.3.1.9. Verify Posture (Vrfy Post.)....................60
A.3.1.10. VPN Posture Result (VPN PRslt)................60
A.3.1.11. Assessment Result (Assess Result).............61
A.3.1.12. Posture Result (VPN PRslt)....................61
Author's Address...............................................61
Intellectual Property Statement................................61
Disclaimer of Validity.........................................61
Sangster & Narayan Expires April 6, 2009 [Page 4]
Internet-Draft PA-TNC October 2008
1. Introduction
This document specifies PA-TNC, a Posture Attribute Protocol
(PA) identical to the Trusted Computing Group's IF-M 1.0
protocol [6]. The document then evaluates PA-TNC against the
requirements defined in the NEA Requirements specification [7].
1.1. Relationship to Trusted Network Connect
Starting in 2004, the Trusted Computing Group (TCG) has defined
and published the Trusted Network Connect (TNC) architecture and
standards for network access control. These standards enable
multi-vendor interoperability throughout the TNC architecture
and have been widely adopted and deployed. In order to avoid
the development of multiple incompatible standards in this area,
the TCG offered several of its TNC standards to the IETF as
candidates for standardization in the IETF also. This document
is one of those standards, known in the IETF as PA-TNC and in
the TCG as IF-M 1.0. PA-TNC and IF-M 1.0 are equivalent.
Consistent with IETF's requirements for standards track
documents, the TCG has authorized the editors of this document
to offer the specification to the IETF without restriction. As
with other Internet-Drafts, the IETF Trust owns the copyright to
this document. The IETF may modify this document, ignore it,
publish it as an RFC, or take any other action. If the IETF
decides to adopt a version of this document as an RFC, the TCG
plans to publish a specification for an equivalent TNC protocol
to ensure continued compatibility.
1.2. Prerequisites
This document does not define an architecture or reference
model. Instead, it defines a protocol that works within the
reference model described in the NEA Overview and Requirements
specification. The reader is assumed to be thoroughly familiar
with that document. No familiarity with TCG specifications is
assumed.
1.3. Message Diagram Conventions
This specification defines the syntax of PA-TNC messages using
diagrams. Each diagram depicts the format and size of each
field in bits. Implementations MUST send the bits in each
diagram as they are shown, traversing the diagram from top to
bottom and then from left to right within each line (which
Sangster & Narayan Expires April 6, 2009 [Page 5]
Internet-Draft PA-TNC October 2008
represents a 32-bit quantity). Multi-byte fields representing
numeric values must be sent in network (big endian) byte order.
Descriptions of bit field (e.g. flag) values are described
referring to the position of the bit within the field. These
bit positions are numbered from the most significant bit through
the least significant bit so a one octet field with only bit 0
set has the value 0x80.
2. Design Considerations
This section discusses some of the key design considerations for
the PA protocol.
2.1. Standard Attribute Namespace for Interoperability
The PA protocol requires the use of two categories of
namespaces: component types (AKA PA Subtypes) and attributes.
Each of these namespace categories needs to contain well known,
interoperable names with defined syntax and semantics co-
existing with names for vendor defined private extensions.
Similarly, each namespace category needs to be readily
extensible without repeated coordination yet avoids naming
conflicts.
The PA-TNC and PB-TNC protocols provide for multiple orthogonal
namespaces for each category that exist without overlap by
including a SMI Private Enterprise Number (PEN) field to
identify the definer of namespace of the associated field. This
allows the IETF NEA WG to define a set of standard component
types and attribute types while allowing vendors to each create
additional names outside of the IETF standard namespace. Over
time, vendor defined names might be proposed for standardization
and thus migration into the IETF namespace.
The PB-TNC protocol defines an IETF standard namespace (using
vendor-id=0) that allows for definition of standard component
types (e.g. Operating System, Firewall, Anti-Virus) using the PA
Subtype field (see section 3.2. Similarly, PA-TNC defines a set
of standard attributes in section 4.2. that represent the most
common capabilities (attributes) of these types of components
across a variety of vendor implementations. The standard
namespace allows NEA deployments with both open source and
vendor provided NEA implementations to support a consistent set
of policies across their environment based on these standard
attributes. The standard attributes can be used with a variety
of endpoints (hosts, printers, mobile devices) that are running
Sangster & Narayan Expires April 6, 2009 [Page 6]
Internet-Draft PA-TNC October 2008
applications and operating systems (defined by the PA Subtypes)
from a variety of vendors.
2.2. Vendor Defined Namespace for Differentiation and Agility
The endpoint is a very dynamic environment in terms of rate of
new features being deployed and attacks that are crafted against
existing and new applications such as: viruses, worms, malware,
and spyware. It is difficult to imagine the standard namespaces
to being able to keep pace with this rapidly changing
environment. Vendors typically differentiate themselves by
moving rapidly to provide unique mechanisms to address such
threats and their ability to deal with changes in an agile
manner. The PA-TNC and PB-TNC protocols allows for creation of
vendor defined namespace(s) where each namespace allows use of
vendor defined PA Subtypes to identify non-standard applications
or operating system variants and vendor defined attributes
describing new aspects of each type of component. The vendor
namespaces will allow NEA deployments to craft compliance
policies using a mixture of attributes from both the IETF
standard namespace and vendor defined namespaces that may
include multiple vendors representing the various hardware and
software components present on the endpoints.
The PA-TNC protocol's use of vendor-id to identify the namespace
of each attribute allows Posture Collectors to support some or
all of the IETF standard attributes plus optionally a set of
vendor defined attributes (potentially from more then one
vendor-id namespace). For instance, an open source anti-virus
Posture Collector might be written that supports all of the IETF
standard attributes used to describe a local anti-virus
component and a subset of multiple anti-virus manufacturers'
vendor defined attributes. This Posture Collector might
therefore be able to interoperate with Posture Validators from
multiple vendors. Conversely, a simple Posture Collector might
be written to ignore any vendor defined attributes requested and
only return standard attributes that it supports. If the vendor
provided Posture Validator's policy allows for this subset to be
considered compliant, then these simple Posture Collectors can
be used to perform a successful assessment.
2.3. Use of TLV Based Encoding for Efficiency
The PA-TNC protocol has chosen to employ a binary encoding using
a type-length-value (TLV) structure. TLV encoding was preferred
over the use of a textual encoding format such as XML to provide
a more efficient utilization of the potentially constrained
Sangster & Narayan Expires April 6, 2009 [Page 7]
Internet-Draft PA-TNC October 2008
bandwidth available between the NEA Client and NEA Server (see
NEA Overview and Architecture [7]). Efficiency was a primary
criteria for this choice with consideration given to both:
1. Optimization of the bits-on-the-wire to accommodate NEA
requirements for assessment over low bandwidth or high
latency links (C-8) and allow for the PT protocol to run
over existing network access protocols (PT-4, C-11) that
are constrained by packet size.
2. Optimization of CPU utilization on the endpoint to
accommodate for low power endpoints such as mobile devices.
The choice of TLV encoding does not preclude the use of XML-
based attribute values within the vendor namespaces or future
standard attributes. It is conceivable that certain vendors may
utilize XML encoding for extensibility within their namespace
when the above considerations are less applicable to their
technologies. Attributes encoded within the vendor defined
namespace using alternate encoding such as XML will be opaque to
NEA software only supporting standard attributes and will be
processed primarily by the vendor defined components
(collector/validator).
3. PA-TNC Message Protocol
This section discusses the use of the PA-TNC message and its
attributes, and specifies the syntax and semantics for the PA-
TNC message header. The details of each attribute included
within the PA-TNC payload are specified in section 4.2.
3.1. PA-TNC Messaging Model
PA-TNC messages are carried by the PB-TNC protocol [5], which
provides a multi-roundtrip reliable transport and end-to-end
message delivery to subscribed (interested) parties using a
variety of underlying network protocols. PA-TNC is unaware of
these underlying PT transport protocols being used below PB-TNC.
The interested parties consist of Posture Collectors on the NEA
Client and Posture Validators associated with the NEA Server
that have registered to receive messages about particular types
of components (e.g. anti-virus) during an assessment. The PA-
TNC messaging protocol operates synchronously within an
assessment session, with Posture Collectors and Posture
Validators taking turns sending one or more messages to each
other. Each PA-TNC message may contain one or more attributes
Sangster & Narayan Expires April 6, 2009 [Page 8]
Internet-Draft PA-TNC October 2008
associated with the functional component identified in the
component type (PA Subtype) of the PB protocol.
Posture Collectors may only send PA-TNC messages to Posture
Validators and vice versa. No Posture Collector to Posture
Collector or Posture Validator to Posture Validator messaging is
allowed to occur. Each Posture Collector or Posture Validator
may send several PA-TNC messages in succession before indicating
that it has completed its response to the Posture Broker Client
or Posture Broker Server respectively. As necessary, the
Posture Broker Client and Posture Broker Server will batch these
messages prior to sending them over the network.
PB-TNC provides a publish/subscribe model of message exchange.
This means that, at any given point in time, zero or more
subscribers for a particular type of message may be present on a
Posture Broker Client or Posture Broker Server. This is
beneficial, since it allows one Posture Collector or Posture
Validator to combine multiple functions (like anti-virus and
personal firewall) by subscribing to both TNC standard component
types. It also allows multiple Posture Collectors or Posture
Validators to support the same components, such as two anti-
virus Posture Validators that are each used to manage their own
respective anti-virus client software.
However, this publish/subscribe model has some possible negative
side effects. When a Posture Collector or Posture Validator
initially sends a PA-TNC message, it does not know whether it
will receive many, one, or no PA-TNC messages from the other
side. For many types of assessments, this is acceptable, but in
some cases a more direct channel binding between a particular
Posture Collector and Posture Validator pair is necessary. For
example, a Posture Validator may wish to provide remediation
instructions to a particular Posture Collector that it knows is
capable of remediating a non-compliant component. This can be
accomplished using the exclusive delivery PB-TNC capability to
limit distribution of a message to a single Posture Collector by
including the target Posture Collector Identifier in the PA-PB
header.
3.2. PA-TNC Relationship to PB-TNC
This section summarizes the major elements of a PA-TNC message
as they might appear inside of a PB-TNC message. The double
line (===) in the diagram below indicates the separation between
the PB-TNC and PA-TNC protocols. The PA-TNC portion of the
message is delivered to each Posture Collector or Posture
Sangster & Narayan Expires April 6, 2009 [Page 9]
Internet-Draft PA-TNC October 2008
Validator registered to receive messages containing a particular
message type. Note that PB-TNC is capable of carrying multiple
PB-TNC and PA-TNC messages in a single PB-TNC batch. See the
PB-TNC specification [5] for more information on its
capabilities.
One important linkage between the PA-TNC and PB-TNC protocols is
the PA message type (PA Message Vendor ID and PA Subtype) that
is used by the Posture Broker Client and Posture Broker Server
to route messages to interested Posture Collectors and Posture
Validators. The message type indicates the software component
(component type) that is associated with the attributes included
inside the PA-TNC message. Therefore, Posture Collectors and
Posture Validators written to support an assessment of a
particular component can register to receive messages about the
component and thus participate in its assessment. Each Posture
Collector and Posture Validator MUST only send PA-TNC messages
containing attributes that pertain to the software component
defined in the message type of the message. This ensures that
only the appropriate Posture Collectors and Posture Validators
that support a particular type of component will receive
attributes related to that component. If a PA-TNC message
contained a mix of attributes about different components and a
message type of only one of those components, the message would
only be delivered to parties interested in the component type
included in the message type, so other interested recipients
wouldn't see those attributes.
The message type is comprised of 2 fields: a PA Message Vendor
ID and a PA Subtype. The PA Message Vendor ID identifies the
vendor or other organization that defined this message type.
The PA Subtype identifies the message type more specifically
within the set of message types defined by that vendor. This
specification defines several IETF Standard PA Subtypes to be
used with a PA Message Vendor ID of zero (0). Within this
specification, the PA Subtype field is used to indicate the type
of component (e.g. firewall) involved with the message's
attributes. Therefore for clarity the PA subtype will be
referred to as the "component type" in this specification.
Vendor-defined name spaces may use other semantics for the PA
Subtype field as this is outside the scope of this
specification.
Sangster & Narayan Expires April 6, 2009 [Page 10]
Internet-Draft PA-TNC October 2008
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| PB-TNC Header |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| PB-TNC Message of type PB-PA-Message |
|(includes: PA Message Vendor ID, PA Subtype, and other fields|
| used by Posture Broker Client and Posture Broker Server for |
| routing) |
===============================================================
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| PA-TNC Message Header |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| PA-TNC Attribute |
| (e.g. Product Information) |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| PA-TNC Attribute |
| (e.g. Operational Status) |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Figure 1 Overview: PB-TNC batch that contains a PA-TNC Message
For example, if a Posture Broker Client sent a PB-TNC batch that
contained a PA-TNC message with a message type indicating
firewall component, this message would be routed by the Posture
Broker Server to Posture Validators registered to assess
firewalls. Each registered Posture Validator would receive a
copy of the PA-TNC message including the PA-TNC header and set
of attributes. It is important that each of the attributes
included in the PA-TNC message be associated with the firewall
component because only the Posture Collector and Posture
Validator interested in firewalls will receive such messages.
If the above message contained both firewall and operating
system attributes inside a PA-TNC message with a component type
of firewall, then any Posture Collector and Posture Validator
registered to receive operating system messages would not
receive those attributes, as the messages would only be
delivered to those registered for firewall messages.
3.3. PA-PB Posture Collector and Posture Validator Identifiers
The PA-PB header contains several fields important to the
processing of a received PA message. The PA Vendor ID and Subtype
are described in the PB-TNC specification and above in section
3.2. Also present in the PA-PB header is a pair of fields that
identify the Posture Collector and/or Posture Validator involved
in the exchange. These fields are used for performing exclusive
Sangster & Narayan Expires April 6, 2009 [Page 11]
Internet-Draft PA-TNC October 2008
delivery of messages as described in section 3.1 and as an
indicator for correlation of received attributes.
Correlation of attributes is necessary when the sending Posture
Collector provides posture for multiple implementations of a
single type of component during an assessment, so the recipient
Posture Validators need to know which attributes are describing
the same implementation.
For example, a single Posture Collector might report attributes
on two installed VPN implementations on the endpoint. Because
the individual attributes do not include an indication of which
VPN product they are describing, the recipient needs something to
perform this correlation. Therefore, for this example, the VPN
Posture Collector would need to obtain two Posture Collector
Identifiers from the Posture Broker Client and consistently use
one with each of the implementations during an assessment. The
VPN Posture Collector would group all the attributes associated
with a particular VPN implementation into a single PA-PB message
and send the message using the Posture Collector Identifier it
designates as going with the particular implementation. This
approach allows the recipient to recognize when attributes in
future assessment messages also describe the same component
implementation.
3.4. PA-TNC Messages in PB-TNC
As depicted in section 3.2. a PA-TNC message consists of a PA-
TNC header followed by a sequence of one or more attributes.
The PA-TNC message header (described in section 3.6. and the
header for each of the PA-TNC attributes (specified in section
4.1) have a fixed type-length-value (TLV) format. Each PA-TNC
message MAY contain a mixture of standards-based and vendor-
defined attributes identifiable using the type portion of the
attribute header. All Posture Collectors and Posture Validators
compliant with this specification MUST be capable of processing
multiple attributes in a received PA-TNC message. A Posture
Collector or Posture Validator that receives a PA-TNC message
can use the attribute header's length field to skip any
attributes that it does not understand, unless the attribute is
marked as mandatory to process.
3.5. IETF Standard PA Subtypes
This section defines several IETF Standard PA Subtypes. Each PA
subtype defined here identifies a specific component relevant to
the endpoint's posture. This allows a small set of generic PA-
TNC attributes (e.g. Product Information) to be used to describe
Sangster & Narayan Expires April 6, 2009 [Page 12]
Internet-Draft PA-TNC October 2008
a large number of different components (e.g. operating system,
anti-virus, etc.). It also allows Posture Collectors and
Posture Validators to specialize in a particular component and
only receive PA-TNC messages relevant to that component.
Value Name Definition
----- ---- ----------
0 Testing Reserved for use in specification
examples, experimentation and
testing.
1 Operating System Operating system running on the
endpoint
2 Anti-Virus Host-based anti-virus software
3 Anti-Spyware Host-based anti-spyware software
4 Anti-Malware Host-based anti-malware (e.g. anti-
bot) software not included within
anti-virus or anti-spyware components
5 Firewall Host-based firewall
6 IDPS Host-based Intrusion Detection and/or
Prevention Software (IDPS)
7 VPN Host-based Virtual Private Networking
(VPN) software
8 NEA Client NEA client software
These PA subtypes must be used in a PB-PA message with a PA
Message Vendor ID of zero (0) indicating an IETF standard type
of component (as described in the PB-TNC specification [5]). If
these PA subtype values are used with a different PA Message
Vendor ID, they have a completely different meaning that is not
defined in this specification.
3.6. PA-TNC Field Types
This section describes some commonly used primitive types found
in the value field of attributes. The value field for each
attribute is typically a structure composed of several data
items. Many of these data items share a common syntax and/or
encoding. In order to consolidate the description of these
Sangster & Narayan Expires April 6, 2009 [Page 13]
Internet-Draft PA-TNC October 2008
common syntax or encoding rules, this section defines type
definitions that are to be applied.
Type Name Description
--------- -----------
OctetArray Variable number of octets containing binary
data.
Integer 32-bit unsigned value in network (big endian)
byte order
String OctetArray that contains a human readable text
encoded in UTF-8 transformation format [2]
IPv4Address OctetArray composed of 4 octets starting with
the most significant octet.
IPv6Address OctetArray composed of 16 octets starting with
the most significant octet.
TimeString An RFC 3339 [4] compliant ASCII string expressed
in Coordinated Universal Time (UTC) time.
VersionNum OctetArray composed of 2 Integer typed values
where the initial Integer contains the major
version and the second contains the minor
version.
3.7. PA-TNC Message Header Format
This section describes the format and semantics of the PA-TNC
header. Every PA-TNC message MUST start with a PA-TNC header.
The PA-TNC header provides a common context applying to all of
the attributes contained within the PA-TNC payload. The payload
consists of a sequence of assessment attributes described in
section 4.2.
Sangster & Narayan Expires April 6, 2009 [Page 14]
Internet-Draft PA-TNC October 2008
1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Version | Reserved |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Message Identifier |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Version
This field indicates the version of the format for the PA-TNC
message. This version is intended to allow for evolution of
the PA-TNC message header and payload in a manner that can
easily be detected by message recipients.
PA-TNC message senders MUST set this field to 0x01 for all
PA-TNC messages that comply with formats and requirements
described in version 1.0 of this specification.
Implementations responding to a PA-TNC message containing a
supported version SHOULD use the same Version number to
minimize the risk of version incompatibility.
Message senders MAY send an empty PA-TNC message with the
Version value set to 0 in order to discover the PA-TNC
protocol versions supported by peer recipients, for more
information see PA-TNC Error Code description in section
4.2.8. Message recipients MUST NOT support version 0 and
MUST NOT interpret the contents (after the Version field) of
a PA-TNC message containing a version number that the
recipient does not support. Message recipients MUST respond
to a PA-TNC message with an unsupported version by sending a
Version Not Supported error code in a PA-TNC Error attribute.
PA-TNC message initiators supporting multiple PA-TNC protocol
versions SHOULD be able to alter which version of PA-TNC
message they send based on prior message exchanges with a
particular peer Posture Collector or Posture Validator.
Reserved
Reserved for future use. This field MUST be set to 0 on
transmission and ignored upon reception.
Message Identifier
This field contains a value that uniquely identifies this
message, differentiating it from others sent by a particular
Sangster & Narayan Expires April 6, 2009 [Page 15]
Internet-Draft PA-TNC October 2008
PA-TNC message sender within this assessment. This value can
be included in a response message to indicate which message
was received and caused the response. For example, this
field is included in the PA-TNC error messages so the party
who receives the error message can determine which of the
messages they had sent caused the error.
PA-TNC message senders MUST NOT send the same message
identifier more than once during an assessment. Message
identifiers may be randomly generated or sequenced as long as
values are not repeated during an assessment message
exchange. PA-TNC message recipients are not required to
check for duplicate message identifiers.
4. PA-TNC Attributes
This section defines the PA-TNC attributes that can be carried
within a PA-TNC message. The initial section defines the
standard attribute header that appears at the start of each
attribute in a PA-TNC message. The second section defines each
of the IETF Standard PA-TNC attributes and the final section
discusses how vendor-defined PA-TNC attributes can be used
within a PA-TNC message. Vendor-defined PA-TNC attributes use
the vendor's SMI Private Enterprise Number in the Attribute Type
field.
A PA-TNC message MUST contain a PA-TNC header (defined in
section 3.7. followed by a sequence of zero or more PA-TNC
attributes. All PA-TNC attributes MUST begin with a standard
PA-TNC attribute header, as defined in section 4.1. The
contents of PA-TNC attributes vary widely, depending on their
attribute type. Section 4.2. defines the IETF Standard PA-TNC
Attributes. Section 4.3. discusses how vendor-specific PA-TNC
attributes can be defined.
4.1. PA-TNC Attribute Header
Following the PA-TNC message header is a sequence of zero or
more attributes. All PA-TNC attributes MUST begin with the
standard PA-TNC attribute header defined in this subsection.
Each attribute described in this specification is represented by
a TLV tuple. The TLV tuple includes an attribute identifier
comprised of the Vendor ID and Attribute Type (type), the TLV
tuple's overall length and finally the attribute's value. The
use of TLV representation was chosen due to its flexibility and
extensibility and use in other standards. Recipients of an
attribute can use the attribute type fields to determine the
Sangster & Narayan Expires April 6, 2009 [Page 16]
Internet-Draft PA-TNC October 2008
precise syntax and semantics of the attribute value field and
the length to skip over an unrecognized attribute. The length
field is also beneficial when a variable length attribute value
is provided.
The TLV format does not contain an explicit TLV format version
number, so every attribute included in a particular PA-TNC
message MUST use the same TLV format. Using the PA-TNC message
version number to indicate the format of all TLV attributes
within a PA-TNC message allows for future versioning of the TLV
format in a manner detectable by PA-TNC message recipients.
Similarly, requiring all TLV attribute formats to be the same
within a PA-TNC message also assures that recipients compliant
with a particular PA-TNC message version can at least parse
every attribute header and use the length to skip over
unrecognized attributes. Finally all attribute TLVs within a
PA-TNC message MUST pertain to the same implementation of the
component. This restriction is relevant when a single Posture
Collector is reporting on multiple implementations of a
component, so must send multiple PA-TNC messages each including
only the attributes describing a single implementation. For
more information on how Posture Collectors should handle
multiple implementations see section 3.3.
Every PA-TNC 1.0 compliant TLV attribute MUST use the following
TLV format:
1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Flags | PA-TNC Attribute Vendor ID |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| PA-TNC Attribute Type |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| PA-TNC Attribute Length |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Attribute Value (Variable Length) |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Flags
This field defines flags impacting the processing of the
associated attribute.
Bit 0 (0x80) is the NOSKIP flag. Any Posture Collector or
Posture Validator that receives an attribute with this flag
set to 1 but does not support this attribute MUST NOT process
Sangster & Narayan Expires April 6, 2009 [Page 17]
Internet-Draft PA-TNC October 2008
any part of the PA-TNC message and SHOULD respond with an
Attribute Type Not Supported error in a PA-TNC error message.
In order to avoid taking action on a subset of the attributes
only to later find an unsupported attribute with the NOSKIP
flag set, recipients of a multi-attribute PA-TNC message
might need to scan all of the attributes prior to acting upon
any attribute.
When the NOSKIP flag is set to 0, recipients SHOULD skip any
unsupported attributes and continue processing the next
attribute.
Bit 1-7 are reserved for future use. These bits MUST be set
to 0 on transmission and ignored upon reception.
PA-TNC Attribute Vendor ID
This field indicates the owner of the name space associated
with the PA-TNC Attribute Type. This is accomplished by
specifying the 24 bit SMI Private Enterprise Number Vendor ID
of the party who owns the Attribute Type name space. IETF
Standard PA-TNC Attribute Types MUST use zero (0) in this
field.
The PA-TNC Attribute Vendor ID 0xffffff is reserved. Posture
Collectors and Posture Verifiers MUST NOT send PA-TNC
messages in which the PA-TNC Attribute Vendor ID has this
reserved value (0xffffff). If a Posture Collector or Posture
Verifier receives a message in which the PA-TNC Attribute
Vendor ID has this reserved value (0xffffff), it SHOULD
respond with an Invalid Parameter error code in a PA-TNC
Error attribute.
PA-TNC Attribute Type
This field defines the type of the attribute included in the
Attribute Value field. This field is qualified by the PA-TNC
Attribute Vendor ID field so that a particular PA-TNC
Attribute Type value (e.g. 327) has a completely different
meaning depending on the value in the PA-TNC Attribute Vendor
ID field.
If the PA-TNC Attribute Vendor ID field has the value zero
(0) then the PA-TNC Attribute Type field contains an IETF
Standard PA-TNC Attribute Type, as listed in the IANA
Sangster & Narayan Expires April 6, 2009 [Page 18]
Internet-Draft PA-TNC October 2008
registry. Section 4.2. of this specification defines the
initial set of IETF Standard PA-TNC Attribute Types.
The PA-TNC Attribute Type 0xffffffff is reserved. Posture
Collectors and Posture Verifiers MUST NOT send PA-TNC
messages in which the PA-TNC Attribute Type has this reserved
value (0xffffffff). If a Posture Collector or Posture
Verifier receives a message in which the PA-TNC Attribute
Type has this reserved value (0xffffffff), it SHOULD respond
with an Invalid Parameter error code in a PA-TNC Error
attribute.
PA-TNC Attribute Length
This field contains the length in octets of the entire PA-TNC
Attribute including the PA-TNC Attribute Header (the fields
Flags, PA-TNC Attribute Vendor ID, PA-TNC Attribute Type, and
PA-TNC Attribute Length). Therefore, this value MUST always
be at least 12. Any Posture Collector or Posture Verifier
that receives a message with a PA-TNC Attribute Length field
whose value is less than 12 SHOULD respond with an Invalid
Parameter PA-TNC error code.
Implementations that do not support the specified PA-TNC
Attribute Type can use this length to skip over this
attribute to the next attribute. Note that while this field
is 4 octets the maximum usable attribute length is likely to
be less than 2^32-1 due to limitations of the underlying
protocol stack specifically PB-TNC's length field includes 32
bytes of other headers which reduce the maximum size
available to PA-TNC since they both use 4 octet length
fields.
Attribute Value
This field varies depending on the particular type of
attribute being expressed. The contents of this field for
each of the IETF Standard PA-TNC Attribute Types are defined
in section 4.2.
4.2. IETF Standard PA-TNC Attribute Types
This section defines an initial set of IETF Standard PA-TNC
Attribute Types. These Attribute Types MUST always be used with
a PA-TNC Vendor ID of zero (0). If these PA-TNC Attribute Type
values are used with a different PA-TNC Vendor ID, they have a
Sangster & Narayan Expires April 6, 2009 [Page 19]
Internet-Draft PA-TNC October 2008
completely different meaning that is not defined in this
specification.
The following table briefly describes each attribute and defines
the numeric value to be used in the PA-TNC Attribute Type field
of the PA-TNC Attribute Header. Later subsections provide
detailed specifications for each PA-TNC Attribute Value.
Number Name Description
------ ---- -----------
0 Testing Reserved for use in
specification examples,
experimentation and testing.
1 Attribute Request Contains a list of attribute
type values defining the
attributes desired from the
Posture Collectors.
2 Product Information Manufacturer and product
information for the component.
3 Numeric Version Numeric version of the
component.
4 String Version String version of the
component.
5 Operational Status Describes whether the component
is running on the endpoint.
6 Port Filter Lists the set of ports (e.g.
TCP port 80 for HTTP) that are
allowed or blocked on the
endpoint.
7 Installed Packages List of software packages
installed on endpoint that
provide the requested
component.
8 PA-TNC Error PA-TNC message or attribute
processing error.
9 Assessment Result Result of the assessment
performed by a Posture
Validator.
Sangster & Narayan Expires April 6, 2009 [Page 20]
Internet-Draft PA-TNC October 2008
10 Remediation Instructions for remediation
Instructions generated by a Posture
Validator.
11 Forwarding Enabled Indicates whether packet
forwarding has been enabled
between different interfaces on
the endpoint.
12 Factory Default Indicates whether the endpoint
Password has a factory default password
enabled.
The following subsections discuss the usage, format and semantics
of the Attribute Value field for each IETF Standard PA-TNC
Attribute Type.
4.2.1. Attribute Request
This PA-TNC Attribute Type allows a Posture Validator to request
certain attributes from the registered set of Posture
Collectors.
All Posture Collectors that implement any of the IETF Standard
PA Subtypes defined in this specification SHOULD support
receiving and processing this attribute type for at least those
PA subtypes. Posture Collectors that receive and process this
attribute MAY choose to send all, a subset or none of the
requested attributes but MUST NOT send attributes that were not
requested (except error attributes). All Posture Validators
that implement any of the IETF Standard PA Subtypes defined in
this specification SHOULD support sending this attribute type
for at least those PA subtypes.
Posture Verifiers MUST NOT include this attribute type in an
Attribute Request attribute. It does not make sense for a
Posture Verifier to request that a Posture Collector send an
Attribute Request attribute.
For this attribute type, the PA-TNC Attribute Vendor ID field
MUST be set to zero (0) and the PA-TNC Attribute Type field MUST
be set to 1.
Sangster & Narayan Expires April 6, 2009 [Page 21]
Internet-Draft PA-TNC October 2008
The following diagram illustrates the format and contents of the
Attribute Value field for this attribute type. The text after
this diagram describes the fields shown here.
Note that this diagram shows two attribute types. The actual
number of attribute types included in an Attribute Request
attribute can vary from one to a large number (limited only by
the maximum message and length supported by the underlying PT
transport protocol). However, each Attribute Request MUST
contain at least one attribute type. Because the length of a
PA-TNC Attribute Vendor ID paired with a PA-TNC Attribute Type
and a one octet Reserved field is always 8 octets, the number of
requested attributes can be easily computed using the PA-TNC
Attribute Length field by subtracting the number of octets in
the PA-TNC Attribute Header and dividing by 8. If the PA-TNC
Attribute Length field is invalid, Posture Collectors SHOULD
respond with an Invalid Parameter PA-TNC error code.
1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Reserved | PA-TNC Attribute Vendor ID |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| PA-TNC Attribute Type |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Reserved | PA-TNC Attribute Vendor ID |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| PA-TNC Attribute Type |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Reserved
Reserved for future use. This field MUST be set to 0 on
transmission and ignored upon reception.
PA-TNC Attribute Vendor ID
This field contains the SMI Private Enterprise Number of the
organization that controls the name space for the following
PA-TNC Attribute Type. This field enables IETF Standard PA-
TNC Attributes and vendor-defined PA-TNC Attributes to be
used without potential collisions.
Any IETF Standard PA-TNC Attribute Types defined in section
4.2. MUST use zero (0) in this field. Vendor-defined
Sangster & Narayan Expires April 6, 2009 [Page 22]
Internet-Draft PA-TNC October 2008
attributes MUST use the SMI Private Enterprise Number of the
organization that defined the attribute.
PA-TNC Attribute Type
The PA-TNC Attribute Type field (together with the PA-TNC
Vendor ID field) indicates the specific attribute requested.
Some IETF Standard PA-TNC Attribute Types MUST NOT be
requested using this field (e.g. requesting a PA-TNC Error
attribute). This is explicitly indicated in the description
of those PA-TNC Attribute Types. Any Posture Collector or
Posture Validator that receives an Attribute Request
containing one of the prohibited Attribute Types SHOULD
respond with an Invalid Parameter error in a PA-TNC error
message.
4.2.2. Product Information
This PA-TNC Attribute Type contains identifying information
about a product that implements the component specified in the
PA Subtype field, as described in section 3.5. For example, if
the PA Subtype is Anti-Virus, this attribute would contain
information identifying an anti-virus product installed on the
endpoint.
All Posture Collectors that implement any of the IETF Standard
PA Subtypes defined in this specification MUST support sending
this attribute type, at least for those PA subtypes. Whether a
particular Posture Collector actually sends this attribute type
SHOULD still be governed by local privacy and security policies.
All Posture Validators that implement any of the IETF Standard
PA Subtypes defined in this specification MUST support receiving
this attribute type, at least for those PA subtypes. Posture
Validators MUST NOT send this attribute type.
For this attribute type, the PA-TNC Attribute Vendor ID field
MUST be set to zero (0) and the PA-TNC Attribute Type field MUST
be set to 2. The value in the PA-TNC Attribute Length field
will vary, depending on the length of the Product Name field.
However, the value in the PA-TNC Attribute Length field MUST be
at least 17 because this is the length of the fixed size fields
in the PA-TNC Attribute Header and the fixed size fields in this
attribute type. If the PA-TNC Attribute Length field is less
than the size of these fixed length fields, implementations
SHOULD respond with an Invalid Parameter PA-TNC error code.
Sangster & Narayan Expires April 6, 2009 [Page 23]
Internet-Draft PA-TNC October 2008
This attribute type includes both numeric and textual
identifiers for the organization that created the product (the
"product creator") and for the product itself. For automated
processing, numeric identifiers are superior because they are
less ambiguous and more efficient. However, numeric identifiers
are only available if the product creator has assigned them.
Therefore, a textual identifier is also included. This textual
identifier has the additional benefit that it may be easier for
humans to read (although this benefit is minimal since the
primary purpose of this attribute is automated assessment).
The following diagram illustrates the format and contents of the
Attribute Value field for this attribute type. The text after
this diagram describes the fields shown here.
1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Product Vendor ID | Product ID |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Product ID | Product Name (Variable Length) |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Product Vendor ID
This field contains the SMI Private Enterprise Number for the
product creator. If the SMI PEN for the product creator is
unknown or if the product creator does not have an SMI PEN,
the Product Vendor ID field MUST be set to 0 and the identity
of the product creator SHOULD be included in the Product Name
along with the name of the product.
Product ID
This field identifies the product using a numeric identifier
assigned by the product creator. If this Product ID value is
unknown or if the product creator has not assigned such a
value, this field MUST be set to 0. If the Product Vendor ID
is 0, this field MUST be set to 0. In any case, the name of
the product SHOULD be included in the Product Name field.
Note that a particular Product ID value (e.g. 635) will have
completely different meanings depending on the Product Vendor
ID. Each Product Vendor ID defines a different space of
Product ID values. Product creators are encouraged to
publish lists of Product ID values for their products.
Sangster & Narayan Expires April 6, 2009 [Page 24]
Internet-Draft PA-TNC October 2008
Product Name
This variable length field contains a UTF-8 [2] string
identifying the product (e.g. "Symantec Norton AntiVirus(TM)
2008") in enough detail to unambiguously distinguish it from
other products from the product creator. Products whose
creator is known, but does not have a registered SMI Private
Enterprise Number, SHOULD be represented using a combination
of the creator name and full product name (e.g. "Ubuntu(R)
IPtables" for the IPtables firewall in the Ubuntu
distribution of Linux). If the product creator's SMI Private
Enterprise Number is included in the Product Vendor ID field,
the product creator's name may be omitted from this field.
The length of this field can be determined by starting with
the value in the PA-TNC Attribute Length field in the PA-TNC
Attribute Header and subtracting the size of the fixed length
fields in that header (12) and the size of the fixed length
fields in this attribute (5). If the PA-TNC Attribute Length
field is less than the size of these fixed length fields,
implementations SHOULD respond with an Invalid Parameter PA-
TNC error code.
4.2.3. Numeric Version
This PA-TNC Attribute Type contains numeric version information
for a product on the endpoint that implements the component
specified in the PA Subtype field, as described in section 3.5.
For example, if the PA Subtype is Operating System, this
attribute would contain numeric version information for the
operating system installed on the endpoint. The version
information in this attribute is associated with a particular
product, so Posture Validators are expected to also possess the
corresponding Product Information attribute when interpreting
this attribute.
All Posture Collectors that implement the IETF Standard PA
Subtype for Operating System SHOULD support sending this
attribute type, at least for the Operating System PA subtype.
Other Posture Collectors MAY support sending this attribute
type. Whether a particular Posture Collector actually sends
this attribute type SHOULD still be governed by local privacy
and security policies. All Posture Validators that implement
the IETF Standard PA Subtype for Operating System SHOULD support
receiving this attribute type, at least for the Operating System
PA subtype. Other Posture Validators MAY support receiving this
attribute type. A Posture Validator that does not support
Sangster & Narayan Expires April 6, 2009 [Page 25]
Internet-Draft PA-TNC October 2008
receiving this attribute type SHOULD simply ignore attributes
with this type. Posture Validators MUST NOT send this attribute
type.
For this attribute type, the PA-TNC Attribute Vendor ID field
MUST be set to zero (0) and the PA-TNC Attribute Type field MUST
be set to 3. The value in the PA-TNC Attribute Length field
MUST be 28. If the PA-TNC Attribute Length field is less than
the size of these fixed length fields, implementations SHOULD
respond with an Invalid Parameter PA-TNC error code.
This attribute type includes numeric values for the product
version information, enabling Posture Validators to do
comparative operations on the version. Some Posture Collectors
may not be able to determine some or all of this information for
a product. However, this attribute can be especially useful for
describing the version of the operating system, where numeric
version numbers are generally available.
The following diagram illustrates the format and contents of the
Attribute Value field for this attribute type. The text after
this diagram describes the fields shown here.
1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Major Version Number |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Minor Version Number |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Build Number |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Service Pack Major | Service Pack Minor |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Major Version Number
This field contains the major version number for the product,
if applicable. If unused or unknown, this field SHOULD be set
to 0.
Minor Version Number
This field contains the minor version number for the product,
if applicable. If unused or unknown, this field SHOULD be set
to 0.
Sangster & Narayan Expires April 6, 2009 [Page 26]
Internet-Draft PA-TNC October 2008
Build Number
This field contains the build number for the product, if
applicable. This may provide more granularity than the minor
version number, as many builds may occur leading up to an
official release, and all these builds may share a single
major and minor version number. If unused or unknown, this
field SHOULD be set to 0.
Service Pack Major
This field contains the major version number of the service
pack for the product, if applicable. If unused or unknown,
this field SHOULD be set to 0.
Service Pack Minor
This field contains the minor version number of the service
pack for the product, if applicable. If unused or unknown,
this field SHOULD be set to 0.
4.2.4. String Version
This PA-TNC Attribute Type contains string version information
for a product on the endpoint that implements the component
specified in the PA Subtype field, as described in section 3.5.
For example, if the PA Subtype is Firewall, this attribute would
contain string version information for a host-based firewall
product installed on the endpoint (if any). The version
information in this attribute is associated with a particular
product, so Posture Validators are expected to also possess the
corresponding Product Information attribute when interpreting
this attribute.
All Posture Collectors that implement any of the IETF Standard
PA Subtypes defined in this document MUST support sending this
attribute type, at least for those PA subtypes. Other Posture
Collectors MAY support sending this attribute type. Whether a
particular Posture Collector actually sends this attribute type
SHOULD still be governed by local privacy and security policies.
All Posture Validators that implement any of the IETF Standard
PA Subtypes defined in this document MUST support receiving this
attribute type, at least for those PA subtypes. Other Posture
Validators MAY support receiving this attribute type. Posture
Validators MUST NOT send this attribute type.
Sangster & Narayan Expires April 6, 2009 [Page 27]
Internet-Draft PA-TNC October 2008
For this attribute type, the PA-TNC Attribute Vendor ID field
MUST be set to zero (0) and the PA-TNC Attribute Type field MUST
be set to 4. The value in the PA-TNC Attribute Length field
will vary, depending on the length of the Component Version
Number, Internal Build Number, and Configuration Version Number
fields. However, the value in the PA-TNC Attribute Length field
MUST be at least 15 because this is the length of the fixed size
fields in the PA-TNC Attribute Header and the fixed size fields
in this attribute type. If the PA-TNC Attribute Length field is
less than the size of these fixed length fields or does not
match the length indicated by the sum of the fixed length and
variable length fields, implementations SHOULD respond with an
Invalid Parameter PA-TNC error code.
The following diagram illustrates the format and contents of the
Attribute Value field for this attribute type. The text after
this diagram describes the fields shown here.
1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Version Len | Product Version Number (Variable Length) |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Build Num Len | Internal Build Number (Variable Length) |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Config. Len | Configuration Version Number (Variable Length)|
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Version Len
This field defines the number of octets in the Product
Version Number field. If the product version number is
unavailable or unknown, this field MUST be set to 0 and the
Product Version Number field will be zero length (effectively
not present).
Product Version Number
This field contains a UTF-8 string identifying the version of
the component (e.g. "1.12.23.114"). This field MUST be sized
to fit the version string and MUST NOT include extra octets
for padding or NUL character termination.
Various products use a wide range of different formats and
semantics for version strings. Some use alphabetic
characters, white space, and punctuation. Some consider
version "1.21" to be later than version "1.3" and some
Sangster & Narayan Expires April 6, 2009 [Page 28]
Internet-Draft PA-TNC October 2008
earlier. Therefore, the syntax and semantics of this string
are not defined.
Build Num Len
This field defines the number of octets in the Internal Build
Number field. For products where the internal build number
is unavailable or unknown, this field MUST be set to 0 and
the Internal Build Number field will be zero length
(effectively not present).
Internal Build Number
This field contains a UTF-8 string identifying the
engineering build number of the product. This field MUST be
sized to fit the build number string and MUST NOT include
extra octets for padding or NUL character termination. The
syntax and semantics of this string are not defined.
Config. Len
This field defines the number of octets in the Configuration
Version Number field. If the product version number is
unavailable or unknown, this field MUST be set to 0 and the
Product Version Number field will be zero length (effectively
not present).
Configuration Version Number
This field contains a UTF-8 string identifying the version of
the configuration used by the component. This version SHOULD
represent the overall configuration version even if several
configuration policy files or settings are used. Posture
Collectors MAY include multiple version numbers in this
single string if a single version is not practical. This
field MUST be sized to fit the version string and MUST NOT
include extra octets for padding or NUL character
termination.
Various products use a wide range of different formats for
version strings. Some use alphabetic characters, white
space, and punctuation. Some consider version "1.21" to be
later than version "1.3" and some earlier. In addition, some
Posture Collectors may place multiple configuration version
numbers in this single string. Therefore, the syntax and
semantics of this string are not defined.
Sangster & Narayan Expires April 6, 2009 [Page 29]
Internet-Draft PA-TNC October 2008
4.2.5. Operational Status
This PA-TNC Attribute Type describes the operational status of a
product that can implement the component specified in the PA
Subtype field, as described in section 3.5. For example, if the
PA Subtype is Anti-Spyware, this attribute would contain
information about the operational status of a host-based anti-
spyware product that may or may not be installed on the
endpoint.
Posture Collectors that implement the IETF Standard PA Subtype
for Operating System or VPN MAY support sending this attribute
type for those PA subtypes. Posture Collectors that implement
other IETF Standard PA Subtypes defined in this specification
SHOULD support sending this attribute type for those PA
subtypes. Other Posture Collectors MAY support sending this
attribute type. Whether a particular Posture Collector actually
sends this attribute type SHOULD still be governed by local
privacy and security policies. Posture Validators that
implement the IETF Standard PA Subtype for Operating System or
VPN MAY support receiving this attribute type, at least for
those PA subtypes. Posture Validators that implement other IETF
Standard PA Subtypes defined in this specification SHOULD
support receiving this attribute type, at least for those PA
subtypes. Other Posture Validators MAY support receiving this
attribute type. A Posture Validator that does not support
receiving this attribute type SHOULD simply ignore attributes
with this type. Posture Validators MUST NOT send this attribute
type.
For this attribute type, the PA-TNC Attribute Vendor ID field
MUST be set to zero (0) and the PA-TNC Attribute Type field MUST
be set to 5. The value in the PA-TNC Attribute Length field
MUST be 36. If the PA-TNC Attribute Length field does not have
this value, implementations SHOULD respond with an Invalid
Parameter PA-TNC error code.
The following diagram illustrates the format and contents of the
Attribute Value field for this attribute type. The text after
this diagram describes the fields shown here.
Sangster & Narayan Expires April 6, 2009 [Page 30]
Internet-Draft PA-TNC October 2008
1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Status | Result | Reserved |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Last Use |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Last Use (continued) |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Last Use (continued) |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Last Use (continued) |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Last Use (continued) |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Status
This field gives the operational status of the product. The
following table lists the values currently defined for this
field. As described in section 8. the IANA maintains a
registry of valid values for this field so that new values
can be defined.
Value Description
----- -----------
0 Unknown or other
1 Not installed
2 Installed but not operational
3 Operational
If a Posture Validator receives a value for this field that
it does not recognize, it SHOULD treat this value as
equivalent to the value 0.
Result
This field contains the result of the last use of the
product. The following table lists the values currently
defined for this field. As described in section 8. the IANA
maintains a registry of valid values for this field so that
new values can be defined.
Sangster & Narayan Expires April 6, 2009 [Page 31]
Internet-Draft PA-TNC October 2008
Value Description
----- -----------
0 Unknown or other
1 Successful use with no errors detected
2 Successful use with one or more errors detected
3 Unsuccessful use (e.g. aborted)
Posture Collectors SHOULD set this field to 0 if the Status
field contains a value of 1 (Not installed) or 2 (Installed
but not operational). If a Posture Validator receives a
value for this field that it does not recognize, it SHOULD
treat this value as equivalent to the value 0.
Reserved
This field is reserved for future use. The field MUST be set
to 0 on transmission and ignored upon reception.
Last Use
This field contains the date and time of the last use of the
component. The Last Use date and time MUST be represented as
an RFC 3339 [4] compliant ASCII string in Coordinated
Universal Time (UTC) time with the additional restrictions
that the 't' delimiter and the 'z' suffix MUST be capitalized
and fractional seconds (time-secfrac) MUST NOT be included.
Leap seconds are permitted and Posture Validators MUST
support them. The last use string MUST NOT be NUL terminated
or padded in any way. If the last use time is not known, not
applicable, or cannot be represented in this format, the
Posture Collector MUST set this field to the value "0000-00-
00T00:00:00Z" (allowing this field to be fixed length). Not
that this particular reserved value is NOT a valid RFC 3339
date and time and MUST NOT be used for any other purpose in
this field.
This encoding produces a string that is easy to read, parse,
and interpret. The format (more precisely defined in RFC
3339) is YYYY-MM-DDTHH:MM:SSZ, resulting in one and only one
representation for each second in UTC time from year 0000 to
year 9999. For example, 9:05:00AM EST (GMT-0500) on January
19, 1995 can be represented as "1995-01-19T14:05:00Z". The
length of this field is always 20 octets.
Sangster & Narayan Expires April 6, 2009 [Page 32]
Internet-Draft PA-TNC October 2008
4.2.6. Port Filter
This PA-TNC Attribute Type provides the list of port numbers and
associated protocols (e.g. TCP and UDP) that are currently
blocked or allowed by a host-based firewall on the endpoint.
Posture Collectors that implement the IETF Standard PA Subtype
for Firewall or VPN SHOULD support sending this attribute type
for those PA subtypes. Posture Collectors that implement other
IETF Standard PA Subtypes defined in this specification MUST NOT
support sending this attribute type for those PA subtypes.
Other Posture Collectors MAY support sending this attribute
type, if it is appropriate to their PA subtype. Whether a
particular Posture Collector actually sends this attribute type
SHOULD still be governed by local privacy and security policies.
Posture Validators that implement the IETF Standard PA Subtype
for Firewall or VPN SHOULD support receiving this attribute
type, at least for those PA subtypes. Posture Validators that
implement other IETF Standard PA Subtypes defined in this
specification MUST NOT support receiving this attribute type for
those PA subtypes. Other Posture Validators MAY support
receiving this attribute type. A Posture Validator that does
not support receiving this attribute type SHOULD simply ignore
attributes with this type. Posture Validators MUST NOT send
this attribute type.
For this attribute type, the PA-TNC Attribute Vendor ID field
MUST be set to zero (0) and the PA-TNC Attribute Type field MUST
be set to 6.
The following diagram illustrates the format and contents of the
Attribute Value field for this attribute type. The text after
this diagram describes the fields shown here.
Note that this diagram shows two Protocol/Port Number pairs. The
actual number of Protocol/Port Number pairs included in a Port
Filter attribute can vary from one to a large number (limited
only by the maximum message and length supported by the
underlying PT transport protocol). However, each Port Filter
attribute MUST contain at least one Protocol/Port Number pair.
Because the length of a Protocol/Port Number pair with the
Reserved field and B flag is always 4 octets, the number of
Protocol/Port Number pairs can be easily computed using the PA-
TNC Attribute Length field by subtracting the number of octets
in the PA-TNC Attribute Header and dividing by 4. If the PA-TNC
Attribute Length field is invalid, Posture Validators SHOULD
respond with an Invalid Parameter PA-TNC error code.
Sangster & Narayan Expires April 6, 2009 [Page 33]
Internet-Draft PA-TNC October 2008
1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Reserved |B| Protocol | Port Number |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Reserved |B| Protocol | Port Number |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Reserved
This field is reserved for future use. It MUST be set to 0
on transmission and ignored upon reception.
B Flag (Blocked or Allowed Port)
This single bit field indicates whether the following port is
blocked or allowed. This bit MUST be set to 1 if the
protocol and port combination is blocked. Otherwise this
field MUST be set to 0. This field was provided to allow for
more abbreviated reporting of the port filtering policy (e.g.
when all ports are blocked except a few, the Posture
Collector can just list the few that are allowed).
Posture Collectors MUST NOT provide a mixed list of block and
non-blocked ports for a particular protocol. To be more
precise, a Posture Collector MUST NOT include two
Protocol/Port Number pairs in a single Port Filter attribute
where the protocol number is the same but the B flag is
different. Also, Posture Collectors MUST NOT list the same
Protocol and Port Number combination twice in a Port List
attribute.
Posture Collectors MAY list all blocked ports for one
protocol and all allowed ports for a different protocol in a
single Port List attribute, using the B flag to indicate
whether each entry is blocked. For example, a Posture
Collector might list all the blocked TCP ports but only list
the allowed UDP ports. However it MUST NOT list some blocked
TCP ports and some other allowed TCP ports.
Protocol
This field contains the protocol number being blocked or
allowed. The values used in this field are the same ones used
in the IPv4 Protocol and IPv6 Next Header fields. The IANA
already maintains a registry of these values.
Sangster & Narayan Expires April 6, 2009 [Page 34]
Internet-Draft PA-TNC October 2008
Port Number
This field contains the port number being blocked or allowed.
The values used in this field are specific to the protocol
identified by the Protocol field. The IANA maintains
registries for TCP and UDP port numbers.
4.2.7. Installed Packages
This PA-TNC Attribute Type contains a list of the installed
packages that comprise a product on the endpoint that implements
the component specified in the PA Subtype field, as described in
section 3.5. This allows a Posture Validator to check which
packages are installed for a particular product and which
versions of those packages are installed.
Posture Collectors that implement any of the IETF Standard PA
Subtypes defined in this document SHOULD support sending this
attribute type for those PA subtypes. Other Posture Collectors
MAY support sending this attribute type, if it is appropriate to
their PA subtype. Whether a particular Posture Collector
actually sends this attribute type SHOULD still be governed by
local privacy and security policies. Posture Validators that
implement any of the IETF Standard PA Subtypes defined in this
document SHOULD support receiving this attribute type, at least
for those PA subtypes. Other Posture Validators MAY support
receiving this attribute type. A Posture Validator that does
not support receiving this attribute type SHOULD simply ignore
attributes with this type. Posture Validators MUST NOT send
this attribute type.
This attribute type can be quite long, especially for the
Operating System PA subtype. This can cause problems, especially
with 802.1X and other limited transport protocols. Therefore,
Posture Collectors SHOULD NOT send this attribute unless
specifically requested to do so using the Attribute Request
attribute or otherwise configured to do so. Also, Posture
Validators SHOULD NOT request this attribute unless the
transport protocol in use can support the large amount of data
that may be sent in response.
For this attribute type, the PA-TNC Attribute Vendor ID field
MUST be set to zero (0) and the PA-TNC Attribute Type field MUST
be set to 7. The value in the PA-TNC Attribute Length field
will vary, depending on the number of packages and the length of
the Package Name and Package Version Number fields for those
packages. However, the value in the PA-TNC Attribute Length
Sangster & Narayan Expires April 6, 2009 [Page 35]
Internet-Draft PA-TNC October 2008
field MUST be at least 16 because this is the length of the
fixed size fields in the PA-TNC Attribute Header and the fixed
size fields in this attribute type. If the PA-TNC Attribute
Length field is less than the size of these fixed length fields
or does not match the length indicated by the sum of the fixed
length and variable length fields, implementations SHOULD
respond with an Invalid Parameter PA-TNC error code.
The following diagram illustrates the format and contents of the
Attribute Value field for this attribute type. The text after
this diagram describes the fields shown here.
Note that this diagram shows an attribute containing information
on one package. The actual number of package descriptions
included in an Installed Packages attribute is indicated by the
Package Count field. This value may vary from zero to a large
number (up to 65535, if the underlying PT transport protocol can
support that many). If this number is not sufficient,
specialized patch management software should be employed which
can simply report compliance with a pre-established patch
policy.
1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Reserved | Package Count |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Pkg Name Len | Package Name (Variable Length) |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Version Len | Package Version Number (Variable Length) |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Reserved
This field is reserved for future use. The field MUST be set
to 0 on transmission and ignored upon reception.
Package Count
This field is an unsigned 16-bit integer that indicates the
number of packages listed in this attribute. For each
package so indicated, a Pkg Name Len, Package Name, Version
Len, and Package Version Number field is included in the
attribute.
Pkg Name Len
Sangster & Narayan Expires April 6, 2009 [Page 36]
Internet-Draft PA-TNC October 2008
This field is an unsigned 8-bit integer that indicates the
length of the Package Name field in octets. This field may be
zero if a Package Name is not available.
Package Name
This field contains the name of the package associated with
the product. This field is a UTF-8 encoded character string
whose octet length is given by the Pkg Name Len field. This
field MUST NOT include extra octets for padding or NUL
character termination. The syntax and semantics of this name
are not specified in this document, since they may vary
across products and/or operating systems. Posture Collectors
MAY list two packages with the same name in a single
Installed Packages attribute. The meaning of doing so is not
defined here.
Version Len
This field is an unsigned 8-bit integer that indicates the
length of the Package Version Number field in octets. This
field may be zero if a Package Version Number is not
available.
Package Version Number
This field contains the version string for the package named
in the previous Package Name field. This field is a UTF-8
encoded character string whose octet length is given by the
Version Len field. This field MUST NOT include extra octets
for padding or NUL character termination. The syntax and
semantics of this version string are not specified in this
document, since they may vary across products and/or
operating systems. Posture Collectors MAY list two packages
with the same Package Version Number (and even the same
Package Name and Package Version Number) in a single
Installed Packages attribute. The meaning of doing so is not
defined here.
4.2.8. PA-TNC Error
This PA-TNC Attribute Type contains an error code and
supplemental information regarding an error pertaining to PA-
TNC.
All Posture Collectors and Posture Validators that implement any
of the IETF Standard PA Subtypes defined in this specification
Sangster & Narayan Expires April 6, 2009 [Page 37]
Internet-Draft PA-TNC October 2008
MUST support sending and receiving this attribute type, at least
for those PA subtypes.
For this attribute type, the PA-TNC Attribute Vendor ID field
MUST be set to zero (0) and the PA-TNC Attribute Type field MUST
be set to 8. The value in the PA-TNC Attribute Length field
will vary, depending on the length of the Error Information
field. However, the value in the PA-TNC Attribute Length field
MUST be at least 20 because this is the length of the fixed
size fields in the PA-TNC Attribute Header and the fixed size
fields in this attribute type.
A PA-TNC error code SHOULD be sent with the same PA Message
Vendor ID and PA Subtype used by the PA-TNC message that caused
the error so that the error code is sent to the party who sent
the offending PA-TNC message. Other measures (such as setting
PB-TNC's EXCL flag and Posture Collector Identifier or Posture
Validator Identifier fields) SHOULD also be taken to attempt to
ensure that only the party who sent the offending message
receives the error.
When a PA-TNC error code is received, the recipient MUST NOT
respond with a PA-TNC error code because this could result in an
infinite loop of errors. Instead, the recipient MAY log the
error, modify its behavior to attempt to avoid the error
(attempting to avoid loops or long strings of errors), ignore
the error, terminate the assessment, or take other action as
appropriate (as long as it is consistent with the requirements
of this specification).
Posture Verifiers MUST NOT include this attribute type in an
Attribute Request attribute. It does not make sense for a
Posture Verifier to request that a Posture Collector send a PA-
TNC Error attribute.
The following diagram illustrates the format and contents of the
Attribute Value field for this attribute type. The text after
this diagram describes the fields shown here.
Sangster & Narayan Expires April 6, 2009 [Page 38]
Internet-Draft PA-TNC October 2008
1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Reserved | PA-TNC Error Code Vendor ID |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| PA-TNC Error Code |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Error Information (Variable Length) |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Reserved
This field is reserved for future use. This field MUST be
set to 0 on transmission and ignored upon reception.
PA-TNC Error Code Vendor ID
This field contains the SMI Private Enterprise Number for the
organization that defined the PA-TNC Error Code that is being
used in the attribute. For IETF Standard PA-TNC Error Code
values this field MUST be set to zero (0).
PA-TNC Error Code
This field contains the PA-TNC Error Code being reported in
this attribute. Note that a particular PA-TNC Error Code
value will have completely different meanings depending on
the PA-TNC Error Code Vendor ID. Each PA-TNC Error Code
Vendor ID defines a different space of PA-TNC Error Code
values.
When the PA-TNC Error Code Vendor ID is set to zero (0), the
PA-TNC Error Code is an IETF Standard PA-TNC Error Code. The
IANA maintains a registry for these values. The following
table lists the IETF Standard PA-TNC Error Codes defined in
this specification:
Value Description
----- -----------
0 Reserved
1 Invalid Parameter
2 Version Not Supported
3 Attribute Type Not Supported
The next few subsections of this document provide detailed
definitions of these error codes.
Sangster & Narayan Expires April 6, 2009 [Page 39]
Internet-Draft PA-TNC October 2008
Error Information
This field provides additional context for the error. The
contents of this field vary based on the PA-TNC Error Code
Vendor ID and PA-TNC Error Code. Therefore, whenever a PA-TNC
Error Code is defined, the format of this field for that
error code must also be defined. The definitions of IETF
Standard PA-TNC Error Codes on the next few pages provide
good examples of such definitions.
The length of this field can be determined by the recipient
using the PA-TNC Attribute Length field by subtracting the
length of the fixed-length fields in the PA-TNC Attribute
Header and the fixed-length fields in this attribute.
4.2.8.1. Invalid Parameter Error Code
The Invalid Parameter error code is an IETF Standard PA-TNC
Error Code (value 1) that indicates that the sender of this
error code has detected an invalid value in a PA-TNC message
sent by the recipient of this error code in the current
assessment.
For this error code, the Error Information field contains the
first 8 octets of the PA-TNC message that contained the invalid
parameter and an offset indicating the position within that
message of the invalid parameter.
The following diagram illustrates the format and contents of the
Error Information field for this error code. The text after
this diagram describes the fields shown here.
1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Version | Reserved |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Message Identifier |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Offset |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Version
This field MUST contain an exact copy of the Version field in
the PA-TNC Message Header of the PA-TNC message that caused
this error.
Sangster & Narayan Expires April 6, 2009 [Page 40]
Internet-Draft PA-TNC October 2008
Reserved
This field MUST contain an exact copy of the Reserved field
in the PA-TNC Message Header of the PA-TNC message that
caused this error.
Message Identifier
This field MUST contain an exact copy of the Message
Identifier field in the PA-TNC Message Header of the PA-TNC
message that caused this error.
Offset
This field MUST contain an octet offset from the start of the
PA-TNC Message Header of the PA-TNC message that caused this
error to the start of the value that caused this error. For
instance, if the first PA-TNC attribute in the message had an
invalid PA-TNC Attribute Length (e.g. 0), this value would be
16.
4.2.8.2. Version Not Supported Error Code
The Version Not Supported error code is an IETF Standard PA-TNC
Error Code (value 2) that indicates that the sender of this
error code does not support the PA-TNC version number included
in the PA-TNC Message Header of a PA-TNC message sent by the
recipient of this error code in the current assessment.
For this error code, the Error Information field contains the
first 8 octets of the PA-TNC message that contained the
unsupported version as well as Max Version and Min Version
fields that indicate which PA-TNC version numbers are supported
by the sender of the error code.
The sender MUST support all PA-TNC versions between the Min
Version and the Max Version, inclusive (i.e. including the Min
Version and the Max Version). When possible, recipients of this
error code SHOULD send future messages to the Posture Collector
or Posture Validator that originated this error message with a
PA-TNC version number within the stated range.
Any party that is sending the Version Not Supported error code
SHOULD include that error code as the only PA-TNC attribute in a
PA-TNC message with version number 1. All parties that send PA-
TNC messages SHOULD be able to properly process a message that
meets this description, even if they cannot process any other
Sangster & Narayan Expires April 6, 2009 [Page 41]
Internet-Draft PA-TNC October 2008
aspect of PA-TNC version 1. This ensures that a PA-TNC version
exchange can proceed properly, no matter what versions of PA-TNC
the parties implement.
The following diagram illustrates the format and contents of the
Error Information field for this error code. The text after
this diagram describes the fields shown here.
1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Version | Copy of Reserved |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Message Identifier |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Max Version | Min Version | Reserved |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Version
This field MUST contain an exact copy of the Version field in
the PA-TNC Message Header of the PA-TNC message that caused
this error.
Copy of Reserved
This field MUST contain an exact copy of the Reserved field
in the PA-TNC Message Header of the PA-TNC message that
caused this error.
Message Identifier
This field MUST contain an exact copy of the Message
Identifier field in the PA-TNC Message Header of the PA-TNC
message that caused this error.
Max Version
This field MUST contain the maximum PA-TNC version supported
by the sender of this error code.
Min Version
This field MUST contain the minimum PA-TNC version supported
by the sender of this error code.
Reserved
Sangster & Narayan Expires April 6, 2009 [Page 42]
Internet-Draft PA-TNC October 2008
Reserved for future use. This field MUST be set to 0 on
transmission and ignored upon reception.
4.2.8.3. Attribute Type Not Supported Error Code
The Attribute Type Not Supported error code is an IETF Standard
PA-TNC Error Code (value 3) that indicates that the sender of
this error code does not support the PA-TNC Attribute Type
included in the Error Information field. This PA-TNC Attribute
Type was included in a PA-TNC message sent by the recipient of
this error code in the current assessment.
For this error code, the Error Information field contains the
first 8 octets of the PA-TNC message that contained the
unsupported attribute type as well as a copy of the attribute
type that caused the problem.
The following diagram illustrates the format and contents of the
Error Information field for this error code. The text after
this diagram describes the fields shown here.
1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Version | Reserved |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Message Identifier |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Flags | PA-TNC Attribute Vendor ID |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| PA-TNC Attribute Type |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Version
This field MUST contain an exact copy of the Version field in
the PA-TNC Message Header of the PA-TNC message that caused
this error.
Copy of Reserved
This field MUST contain an exact copy of the Reserved field
in the PA-TNC Message Header of the PA-TNC message that
caused this error.
Message Identifier
Sangster & Narayan Expires April 6, 2009 [Page 43]
Internet-Draft PA-TNC October 2008
This field MUST contain an exact copy of the Message
Identifier field in the PA-TNC Message Header of the PA-TNC
message that caused this error.
Flags
This field MUST contain an exact copy of the Flags field in
the PA-TNC Attribute Header of the PA-TNC attribute that
caused this error.
PA-TNC Attribute Vendor ID
This field MUST contain an exact copy of the PA-TNC Attribute
Vendor ID field in the PA-TNC Attribute Header of the PA-TNC
attribute that caused this error.
PA-TNC Attribute Type
This field MUST contain an exact copy of the PA-TNC Attribute
Type field in the PA-TNC Attribute Header of the PA-TNC
attribute that caused this error.
4.2.9. Assessment Result
This PA-TNC attribute contains the final assessment result from a
particular Posture Validator. This attribute might be returned to
a Posture Collector for information purposes such as when an
endpoint is compliant. Similarly, the Assessment Result attribute
could be sent to indicate a non-compliant result where specific
actions are needed to bring an endpoint into compliance with the
network's policies. These actions could be defined in other PA-
TNC attributes such as Remediation Instructions sent to the
Posture Collector.
All Posture Collectors that support an IETF standard PA Subtype
defined in this specification SHOULD support receiving and
processing the Assessment Result attribute. All Posture
Validators that implement an IETF standard PA Subtype defined in
this specification SHOULD support sending the Assessment Result
attribute.
For this attribute type, the PA-TNC Attribute Vendor ID field
MUST be set to zero (0) and the PA-TNC Attribute Type field MUST
be set to 9.
Sangster & Narayan Expires April 6, 2009 [Page 44]
Internet-Draft PA-TNC October 2008
The following diagram illustrates the format and contents of the
Attribute Value field for this attribute type. The text after
this diagram describes the fields shown here.
1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Assessment Result |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Assessment Result
This 32-bit field MUST contain one of the following values
Value Description
----- -----------
0 Posture Validator assessed the endpoint component to
be compliant with policy
1 Posture Validator assessed the endpoint component to
be non-compliant with policy but the difference from
compliant was minor.
2 Posture Validator assessed the endpoint component to
be non-compliant with policy and the assessed
difference was very significant.
3 Posture Validator was unable to determine policy
compliance of an endpoint component due to an error.
4 Posture Validator was unable to determine whether the
assessed endpoint component was compliant with policy
based on the attributes provided by the Posture
Collector(s)
4.2.10. Remediation Instructions
This PA-TNC attribute sent by the Posture Validator to the Posture
Collector(s) contains remediation instructions for updating a
particular component to make the endpoint compliant with the
assessment policies. A Posture Validator might choose to send
more then one Remediation Instructions attributes in some
circumstances (e.g. both a URI and a human readable message are
necessary) to remediate one or more components. This attribute
supports the inclusion of either an IETF Standard or vendor
specific remediation instruction.
Sangster & Narayan Expires April 6, 2009 [Page 45]
Internet-Draft PA-TNC October 2008
All Posture Collectors that implement an IETF standard PA
Subtype defined in this specification SHOULD support receiving
and processing the Remediation Instructions attribute. All
Posture Validators that implement an IETF standard PA Subtype
defined in this specification SHOULD support sending this
attribute type. Posture Collectors and Posture Validators
supporting other non-IETF standard components MAY support this
attribute.
For this attribute type, the PA-TNC Attribute Vendor ID field
MUST be set to zero (0) and the PA-TNC Attribute Type field MUST
be set to 10.
The following diagram illustrates the format and contents of the
Attribute Value field for this attribute type. The text after
this diagram describes the fields shown here.
1 2 3
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Reserved | Remediation Parameters Vendor ID |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Remediation Parameters Type |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Remediation Parameters (Variable Length) |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
Reserved (8 bits)
The Reserved bits MUST be set to 0 on transmission and ignored
on reception.
Remediation Parameters Vendor ID (24 bits)
The Remediation Parameters Vendor ID field identifies a vendor
by using the SMI Private Enterprise Number (PEN). Any
organization can receive its own unique PEN from IANA, the
Internet Assigned Numbers Authority. The Remediation Parameters
Vendor ID qualifies the Remediation Parameters Type field so
that each vendor has 2^32 separate Remediation Parameters Types
available for its use. Remediation Parameters Types
standardized by the IETF are always used with the value zero (0)
in this field.
Remediation Parameters Type (32 bits)
The Remediation Parameters Type field identifies the different
types of remediation instructions that can be contained in the
Sangster & Narayan Expires April 6, 2009 [Page 46]
Internet-Draft PA-TNC October 2008
Remediation Parameters field. IANA maintains a registry of IETF
Standard PA-TNC Remediation Parameters Types. A list of IETF
Standard PA-TNC Remediation Parameters Types defined in this
specification appears later in this section.
New vendor-specific remediation instructions can be created by
adding new Remediation Parameters Types (those used with a non-
zero Remediation Parameters vendor ID) without IETF or IANA
involvement.
Remediation Parameters (variable length)
The Remediation Parameters field contains the actual remediation
instructions for the Posture Collector.
4.2.10.1. IETF Standard PA-TNC Remediation Parameters Types
This subsection defines several PA-TNC Remediation Parameters
Types that have been standardized by the IETF.
Remediation-URI
Posture Validators can include a Remediation-URI in the PA
message by creating a Remediation Instructions attribute with:
Remediation Parameters Vendor ID = 0
Remediation Parameters Type = 1
Remediation Parameters = URI
The Remediation Parameters field in the Remediation Instructions
attribute MUST contain a URI, as described in RFC 3986 [9].
This URI SHOULD contain instructions t
