denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Make access requestor IP address available to TNC server

Browse Source
This commit is contained in:
Andreas Steffen
2015-03-08 17:17:11 +01:00
parent 8b2af616ac
commit 00cd79b678
24 changed files with 550 additions and 244 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libtnccs/plugins/tnc_tnccs/tnc_tnccs_manager.c
+39 -9
View File
@@ -1,5 +1,5 @@
/*
* Copyright (C) 2010-2013 Andreas Steffen
* Copyright (C) 2010-2015 Andreas Steffen
* HSR Hochschule fuer Technik Rapperswil
*
* This program is free software; you can redistribute it and/or modify it
@@ -169,8 +169,8 @@ METHOD(tnccs_manager_t, remove_method, void,
METHOD(tnccs_manager_t, create_instance, tnccs_t*,
private_tnc_tnccs_manager_t *this, tnccs_type_t type, bool is_server,
identification_t *server, identification_t *peer, tnc_ift_type_t transport,
tnccs_cb_t cb)
identification_t *server_id, identification_t *peer_id, host_t *server_ip,
host_t *peer_ip, tnc_ift_type_t transport, tnccs_cb_t cb)
{
enumerator_t *enumerator;
tnccs_entry_t *entry;
@@ -182,7 +182,8 @@ METHOD(tnccs_manager_t, create_instance, tnccs_t*,
{
if (type == entry->type)
{
protocol = entry->constructor(is_server, server, peer, transport, cb);
protocol = entry->constructor(is_server, server_id, peer_id,
server_ip, peer_ip, transport, cb);
if (protocol)
{
break;
@@ -716,7 +717,8 @@ METHOD(tnccs_manager_t, get_attribute, TNC_Result,
case TNC_ATTRIBUTEID_AR_IDENTITIES:
{
linked_list_t *list;
identification_t *peer;
identification_t *peer_id;
host_t *peer_ip;
tnccs_t *tnccs;
tncif_identity_t *tnc_id;
u_int32_t id_type, subject_type;
@@ -726,10 +728,11 @@ METHOD(tnccs_manager_t, get_attribute, TNC_Result,
list = linked_list_create();
tnccs = entry->tnccs;
peer = tnccs->tls.get_peer_id(&tnccs->tls);
if (peer)
peer_id = tnccs->tls.get_peer_id(&tnccs->tls);
if (peer_id)
{
switch (peer->get_type(peer))
switch (peer_id->get_type(peer_id))
{
case ID_IPV4_ADDR:
id_type = TNC_ID_IPV4_ADDR;
@@ -756,7 +759,7 @@ METHOD(tnccs_manager_t, get_attribute, TNC_Result,
subject_type = TNC_SUBJECT_UNKNOWN;
}
if (id_type != TNC_ID_UNKNOWN &&
asprintf(&id_str, "%Y", peer) >= 0)
asprintf(&id_str, "%Y", peer_id) >= 0)
{
id_value = chunk_from_str(id_str);
tnc_id = tncif_identity_create(
@@ -767,6 +770,33 @@ METHOD(tnccs_manager_t, get_attribute, TNC_Result,
list->insert_last(list, tnc_id);
}
}
peer_ip = tnccs->get_peer_ip(tnccs);
if (peer_ip)
{
switch (peer_ip->get_family(peer_ip))
{
case AF_INET:
id_type = TNC_ID_IPV4_ADDR;
break;
case AF_INET6:
id_type = TNC_ID_IPV6_ADDR;
break;
default:
id_type = TNC_ID_UNKNOWN;
}
if (id_type != TNC_ID_UNKNOWN &&
asprintf(&id_str, "%H", peer_ip) >= 0)
{
id_value = chunk_from_str(id_str);
tnc_id = tncif_identity_create(
pen_type_create(PEN_TCG, id_type), id_value,
pen_type_create(PEN_TCG, TNC_SUBJECT_MACHINE),
pen_type_create(PEN_TCG, TNC_AUTH_UNKNOWN));
list->insert_last(list, tnc_id);
}
}
result = identity_attribute(buffer_len, buffer, value_len, list);
list->destroy_offset(list, offsetof(tncif_identity_t, destroy));
return result;
src/libtnccs/plugins/tnccs_11/tnccs_11.c
+43 -14
View File
@@ -1,5 +1,5 @@
/*
* Copyright (C) 2010-2013 Andreas Steffen
* Copyright (C) 2010-2015 Andreas Steffen
* HSR Hochschule fuer Technik Rapperswil
*
* This program is free software; you can redistribute it and/or modify it
@@ -54,12 +54,22 @@ struct private_tnccs_11_t {
/**
* Server identity
*/
identification_t *server;
identification_t *server_id;
/**
* Client identity
*/
identification_t *peer;
identification_t *peer_id;
/**
* Server IP address
*/
host_t *server_ip;
/**
* Client IP address
*/
host_t *peer_ip;
/**
* Underlying TNC IF-T transport protocol
@@ -527,20 +537,20 @@ METHOD(tls_t, is_server, bool,
METHOD(tls_t, get_server_id, identification_t*,
private_tnccs_11_t *this)
{
return this->server;
return this->server_id;
}
METHOD(tls_t, set_peer_id, void,
private_tnccs_11_t *this, identification_t *id)
{
DESTROY_IF(this->peer);
this->peer = id->clone(id);
DESTROY_IF(this->peer_id);
this->peer_id = id->clone(id);
}
METHOD(tls_t, get_peer_id, identification_t*,
private_tnccs_11_t *this)
{
return this->peer;
return this->peer_id;
}
METHOD(tls_t, get_purpose, tls_purpose_t,
@@ -578,14 +588,28 @@ METHOD(tls_t, destroy, void,
{
tnc->tnccs->remove_connection(tnc->tnccs, this->connection_id,
this->is_server);
this->server->destroy(this->server);
this->peer->destroy(this->peer);
this->server_id->destroy(this->server_id);
this->peer_id->destroy(this->peer_id);
this->server_ip->destroy(this->server_ip);
this->peer_ip->destroy(this->peer_ip);
this->mutex->destroy(this->mutex);
DESTROY_IF(this->batch);
free(this);
}
}
METHOD(tnccs_t, get_server_ip, host_t*,
private_tnccs_11_t *this)
{
return this->server_ip;
}
METHOD(tnccs_t, get_peer_ip, host_t*,
private_tnccs_11_t *this)
{
return this->peer_ip;
}
METHOD(tnccs_t, get_transport, tnc_ift_type_t,
private_tnccs_11_t *this)
{
@@ -628,9 +652,10 @@ METHOD(tnccs_t, get_ref, tnccs_t*,
/**
* See header
*/
tnccs_t* tnccs_11_create(bool is_server,
identification_t *server, identification_t *peer,
tnc_ift_type_t transport, tnccs_cb_t cb)
tnccs_t* tnccs_11_create(bool is_server, identification_t *server_id,
identification_t *peer_id, host_t *server_ip,
host_t *peer_ip, tnc_ift_type_t transport,
tnccs_cb_t cb)
{
private_tnccs_11_t *this;
@@ -648,6 +673,8 @@ tnccs_t* tnccs_11_create(bool is_server,
.get_eap_msk = _get_eap_msk,
.destroy = _destroy,
},
.get_server_ip = _get_server_ip,
.get_peer_ip = _get_peer_ip,
.get_transport = _get_transport,
.set_transport = _set_transport,
.get_auth_type = _get_auth_type,
@@ -656,8 +683,10 @@ tnccs_t* tnccs_11_create(bool is_server,
.get_ref = _get_ref,
},
.is_server = is_server,
.server = server->clone(server),
.peer = peer->clone(peer),
.server_id = server_id->clone(server_id),
.peer_id = peer_id->clone(peer_id),
.server_ip = server_ip->clone(server_ip),
.peer_ip = peer_ip->clone(peer_ip),
.transport = transport,
.callback = cb,
.mutex = mutex_create(MUTEX_TYPE_DEFAULT),
src/libtnccs/plugins/tnccs_11/tnccs_11.h
+9 -6
View File
@@ -1,5 +1,5 @@
/*
* Copyright (C) 2010-2013 Andreas Steffen
* Copyright (C) 2010-2015 Andreas Steffen
* HSR Hochschule fuer Technik Rapperswil
*
* This program is free software; you can redistribute it and/or modify it
@@ -29,14 +29,17 @@
* Create an instance of the TNC IF-TNCCS 1.1 protocol handler.
*
* @param is_server TRUE to act as TNC Server, FALSE for TNC Client
* @param server Server identity
* @param peer Client identity
* @param server_id Server identity
* @param peer_id Client identity
* @param server_ip Server IP address
* @param peer_ip Client IP address
* @param transport Underlying IF-T transport protocol
* @param cb Callback function if TNC Server, NULL if TNC Client
* @return TNC_IF_TNCCS 1.1 protocol stack
*/
tnccs_t* tnccs_11_create(bool is_server,
identification_t *server, identification_t *peer,
tnc_ift_type_t transport, tnccs_cb_t cb);
tnccs_t* tnccs_11_create(bool is_server, identification_t *server_id,
identification_t *peer_id, host_t *server_ip,
host_t *peer_ip, tnc_ift_type_t transport,
tnccs_cb_t cb);
#endif /** TNCCS_11_H_ @}*/
src/libtnccs/plugins/tnccs_20/tnccs_20.c
+43 -14
View File
@@ -1,6 +1,6 @@
/*
* Copyright (C) 2010 Sansar Choinyanbuu
* Copyright (C) 2010-2013 Andreas Steffen
* Copyright (C) 2010-2015 Andreas Steffen
* HSR Hochschule fuer Technik Rapperswil
*
* This program is free software; you can redistribute it and/or modify it
@@ -60,12 +60,22 @@ struct private_tnccs_20_t {
/**
* Server identity
*/
identification_t *server;
identification_t *server_id;
/**
* Client identity
*/
identification_t *peer;
identification_t *peer_id;
/**
* Server IP address
*/
host_t *server_ip;
/**
* Client IP address
*/
host_t *peer_ip;
/**
* Underlying TNC IF-T transport protocol
@@ -923,20 +933,20 @@ METHOD(tls_t, is_server, bool,
METHOD(tls_t, get_server_id, identification_t*,
private_tnccs_20_t *this)
{
return this->server;
return this->server_id;
}
METHOD(tls_t, set_peer_id, void,
private_tnccs_20_t *this, identification_t *id)
{
DESTROY_IF(this->peer);
this->peer = id->clone(id);
DESTROY_IF(this->peer_id);
this->peer_id = id->clone(id);
}
METHOD(tls_t, get_peer_id, identification_t*,
private_tnccs_20_t *this)
{
return this->peer;
return this->peer_id;
}
METHOD(tls_t, get_purpose, tls_purpose_t,
@@ -974,8 +984,10 @@ METHOD(tls_t, destroy, void,
{
tnc->tnccs->remove_connection(tnc->tnccs, this->connection_id,
this->is_server);
this->server->destroy(this->server);
this->peer->destroy(this->peer);
this->server_id->destroy(this->server_id);
this->peer_id->destroy(this->peer_id);
this->server_ip->destroy(this->server_ip);
this->peer_ip->destroy(this->peer_ip);
this->state_machine->destroy(this->state_machine);
this->mutex->destroy(this->mutex);
this->messages->destroy_offset(this->messages,
@@ -985,6 +997,18 @@ METHOD(tls_t, destroy, void,
}
}
METHOD(tnccs_t, get_server_ip, host_t*,
private_tnccs_20_t *this)
{
return this->server_ip;
}
METHOD(tnccs_t, get_peer_ip, host_t*,
private_tnccs_20_t *this)
{
return this->peer_ip;
}
METHOD(tnccs_t, get_transport, tnc_ift_type_t,
private_tnccs_20_t *this)
{
@@ -1027,9 +1051,10 @@ METHOD(tnccs_t, get_ref, tnccs_t*,
/**
* See header
*/
tnccs_t* tnccs_20_create(bool is_server,
identification_t *server, identification_t *peer,
tnc_ift_type_t transport, tnccs_cb_t cb)
tnccs_t* tnccs_20_create(bool is_server, identification_t *server_id,
identification_t *peer_id, host_t *server_ip,
host_t *peer_ip, tnc_ift_type_t transport,
tnccs_cb_t cb)
{
private_tnccs_20_t *this;
size_t max_batch_size, default_max_batch_size;
@@ -1079,6 +1104,8 @@ tnccs_t* tnccs_20_create(bool is_server,
.get_eap_msk = _get_eap_msk,
.destroy = _destroy,
},
.get_server_ip = _get_server_ip,
.get_peer_ip = _get_peer_ip,
.get_transport = _get_transport,
.set_transport = _set_transport,
.get_auth_type = _get_auth_type,
@@ -1087,8 +1114,10 @@ tnccs_t* tnccs_20_create(bool is_server,
.get_ref = _get_ref,
},
.is_server = is_server,
.server = server->clone(server),
.peer = peer->clone(peer),
.server_id = server_id->clone(server_id),
.peer_id = peer_id->clone(peer_id),
.server_ip = server_ip->clone(server_ip),
.peer_ip = peer_ip->clone(peer_ip),
.transport = transport,
.callback = cb,
.state_machine = pb_tnc_state_machine_create(is_server),
src/libtnccs/plugins/tnccs_20/tnccs_20.h
+9 -6
View File
@@ -1,5 +1,5 @@
/*
* Copyright (C) 2010-2013 Andreas Steffen
* Copyright (C) 2010-2015 Andreas Steffen
* HSR Hochschule fuer Technik Rapperswil
*
* This program is free software; you can redistribute it and/or modify it
@@ -29,14 +29,17 @@
* Create an instance of the TNC IF-TNCCS 2.0 protocol handler.
*
* @param is_server TRUE to act as TNC Server, FALSE for TNC Client
* @param server Server identity
* @param peer Client identity
* @param server_id Server identity
* @param peer_id Client identity
* @param server_ip Server IP address
* @param peer_ip Client IP address
* @param transport Underlying IF-T transport protocol
* @param cb Callback function if TNC Server, NULL if TNC Client
* @return TNC_IF_TNCCS 2.0 protocol stack
*/
tnccs_t* tnccs_20_create(bool is_server,
identification_t *server, identification_t *peer,
tnc_ift_type_t transport, tnccs_cb_t cb);
tnccs_t* tnccs_20_create(bool is_server, identification_t *server_id,
identification_t *peer_id, host_t *server_ip,
host_t *peer_ip, tnc_ift_type_t transport,
tnccs_cb_t cb);
#endif /** TNCCS_20_H_ @}*/
src/libtnccs/plugins/tnccs_dynamic/tnccs_dynamic.c
+45 -16
View File
@@ -1,5 +1,5 @@
/*
* Copyright (C) 2011-2013 Andreas Steffen
* Copyright (C) 2011-2015 Andreas Steffen
* HSR Hochschule fuer Technik Rapperswil
*
* This program is free software; you can redistribute it and/or modify it
@@ -34,12 +34,22 @@ struct private_tnccs_dynamic_t {
/**
* Server identity
*/
identification_t *server;
identification_t *server_id;
/**
* Client identity
*/
identification_t *peer;
identification_t *peer_id;
/**
* Server IP address
*/
host_t *server_ip;
/**
* Client IP address
*/
host_t *peer_ip;
/**
* Detected TNC IF-TNCCS stack
@@ -109,8 +119,8 @@ METHOD(tls_t, process, status_t,
DBG1(DBG_TNC, "%N protocol detected dynamically",
tnccs_type_names, type);
tnccs = tnc->tnccs->create_instance(tnc->tnccs, type, TRUE,
this->server, this->peer, this->transport,
this->callback);
this->server_id, this->peer_id, this->server_ip,
this->peer_ip, this->transport, this->callback);
if (!tnccs)
{
DBG1(DBG_TNC, "N% protocol not supported", tnccs_type_names, type);
@@ -137,14 +147,14 @@ METHOD(tls_t, is_server, bool,
METHOD(tls_t, get_server_id, identification_t*,
private_tnccs_dynamic_t *this)
{
return this->server;
return this->server_id;
}
METHOD(tls_t, set_peer_id, void,
private_tnccs_dynamic_t *this, identification_t *id)
{
DESTROY_IF(this->peer);
this->peer = id->clone(id);
DESTROY_IF(this->peer_id);
this->peer_id = id->clone(id);
if (this->tls)
{
this->tls->set_peer_id(this->tls, id);
@@ -154,7 +164,7 @@ METHOD(tls_t, set_peer_id, void,
METHOD(tls_t, get_peer_id, identification_t*,
private_tnccs_dynamic_t *this)
{
return this->peer;
return this->peer_id;
}
METHOD(tls_t, get_purpose, tls_purpose_t,
@@ -181,12 +191,26 @@ METHOD(tls_t, destroy, void,
if (ref_put(&this->ref))
{
DESTROY_IF(this->tls);
this->server->destroy(this->server);
this->peer->destroy(this->peer);
this->server_id->destroy(this->server_id);
this->peer_id->destroy(this->peer_id);
this->server_ip->destroy(this->server_ip);
this->peer_ip->destroy(this->peer_ip);
free(this);
}
}
METHOD(tnccs_t, get_server_ip, host_t*,
private_tnccs_dynamic_t *this)
{
return this->server_ip;
}
METHOD(tnccs_t, get_peer_ip, host_t*,
private_tnccs_dynamic_t *this)
{
return this->peer_ip;
}
METHOD(tnccs_t, get_transport, tnc_ift_type_t,
private_tnccs_dynamic_t *this)
{
@@ -229,9 +253,10 @@ METHOD(tnccs_t, get_ref, tnccs_t*,
/**
* See header
*/
tnccs_t* tnccs_dynamic_create(bool is_server,
identification_t *server, identification_t *peer,
tnc_ift_type_t transport, tnccs_cb_t cb)
tnccs_t* tnccs_dynamic_create(bool is_server, identification_t *server_id,
identification_t *peer_id, host_t *server_ip,
host_t *peer_ip, tnc_ift_type_t transport,
tnccs_cb_t cb)
{
private_tnccs_dynamic_t *this;
@@ -249,6 +274,8 @@ tnccs_t* tnccs_dynamic_create(bool is_server,
.get_eap_msk = _get_eap_msk,
.destroy = _destroy,
},
.get_server_ip = _get_server_ip,
.get_peer_ip = _get_peer_ip,
.get_transport = _get_transport,
.set_transport = _set_transport,
.get_auth_type = _get_auth_type,
@@ -256,8 +283,10 @@ tnccs_t* tnccs_dynamic_create(bool is_server,
.get_pdp_server = _get_pdp_server,
.get_ref = _get_ref,
},
.server = server->clone(server),
.peer = peer->clone(peer),
.server_id = server_id->clone(server_id),
.peer_id = peer_id->clone(peer_id),
.server_ip = server_ip->clone(server_ip),
.peer_ip = peer_ip->clone(peer_ip),
.transport = transport,
.callback = cb,
.ref = 1,
src/libtnccs/plugins/tnccs_dynamic/tnccs_dynamic.h
+9 -6
View File
@@ -1,5 +1,5 @@
/*
* Copyright (C) 2011-2013 Andreas Steffen
* Copyright (C) 2011-2015 Andreas Steffen
* HSR Hochschule fuer Technik Rapperswil
*
* This program is free software; you can redistribute it and/or modify it
@@ -29,14 +29,17 @@
* Create an instance of a dynamic TNC IF-TNCCS protocol handler.
*
* @param is_server TRUE to act as TNC Server, FALSE for TNC Client
* @param server Server identity
* @param peer Client identity
* @param server_id Server identity
* @param peer_id Client identity
* @param server_ip Server IP address
* @param peer_ip Client IP address
* @param transport Underlying IF-T transport protocol
* @param cb Callback function if TNC Server, NULL if TNC Client
* @return dynamic TNC IF-TNCCS protocol stack
*/
tnccs_t* tnccs_dynamic_create(bool is_server,
identification_t *server, identification_t *peer,
tnc_ift_type_t transport, tnccs_cb_t cb);
tnccs_t* tnccs_dynamic_create(bool is_server, identification_t *server_id,
identification_t *peer_id, host_t *server_ip,
host_t *peer_ip, tnc_ift_type_t transport,
tnccs_cb_t cb);
#endif /** TNCCS_DYNAMIC_H_ @}*/
src/libtnccs/tnc/tnccs/tnccs.h
+23 -5
View File
@@ -1,5 +1,5 @@
/*
* Copyright (C) 2010-2013 Andreas Steffen
* Copyright (C) 2010-2015 Andreas Steffen
* HSR Hochschule fuer Technik Rapperswil
*
* This program is free software; you can redistribute it and/or modify it
@@ -86,6 +86,20 @@ struct tnccs_t {
*/
tls_t tls;
/**
* Get server IP address
*
* @return Server IP address
*/
host_t* (*get_server_ip)(tnccs_t *this);
/**
* Get peer IP address
*
* @return Peer IP address
*/
host_t* (*get_peer_ip)(tnccs_t *this);
/**
* Get underlying TNC IF-T transport protocol
*
@@ -135,15 +149,19 @@ struct tnccs_t {
* Constructor definition for a pluggable TNCCS protocol implementation.
*
* @param is_server TRUE if TNC Server, FALSE if TNC Client
* @param server Server identity
* @param peer Client identity
* @param server_id Server identity
* @param peer_id Client identity
* @param server_ip Server IP address
* @param peer_ip Client IP address
* @param transport Underlying TNC IF-T transport protocol used
* @param cb Callback function if TNC Server, NULL if TNC Client
* @return implementation of the tnccs_t interface
*/
typedef tnccs_t *(*tnccs_constructor_t)(bool is_server,
identification_t *server,
identification_t *peer,
identification_t *server_id,
identification_t *peer_id,
host_t *server_ip,
host_t *peer_ip,
tnc_ift_type_t transport,
tnccs_cb_t cb);
src/libtnccs/tnc/tnccs/tnccs_manager.h
+9 -6
View File
@@ -1,5 +1,5 @@
/*
* Copyright (C) 2010-2013 Andreas Steffen
* Copyright (C) 2010-2015 Andreas Steffen
* HSR Hochschule fuer Technik Rapperswil
*
* This program is free software; you can redistribute it and/or modify it
@@ -56,16 +56,19 @@ struct tnccs_manager_t {
*
* @param type type of the TNCCS protocol
* @param is_server TRUE if TNC Server, FALSE if TNC Client
* @param server Server identity
* @param peer Client identity
* @param server_id Server identity
* @param peer_id Client identity
* @param server_ip Server IP address
* @param peer_ip Client IP address
* @param transport Underlying TNC IF-T transport protocol used
* @param cb Callback function if TNC Server, NULL if TNC Client
* @return TNCCS protocol instance, NULL if no constructor found
*/
tnccs_t* (*create_instance)(tnccs_manager_t *this, tnccs_type_t type,
bool is_server, identification_t *server,
identification_t *peer,
tnc_ift_type_t transport, tnccs_cb_t cb);
bool is_server, identification_t *server_id,
identification_t *peer_id, host_t *server_ip,
host_t *peer_ip, tnc_ift_type_t transport,
tnccs_cb_t cb);
/**
* Create a TNCCS connection and assign a unique connection ID as well a