denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

moved tnc_imv plugin to libtnccs thanks to recommendation callback function

Browse Source
This commit is contained in:
Andreas Steffen
2013-08-15 23:34:22 +02:00
parent 9d8c28e2f5
commit 12b3db5006
28 changed files with 164 additions and 130 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libcharon/plugins/eap_tnc/eap_tnc.c
+61 -2
View File
@@ -22,6 +22,7 @@
#include <daemon.h>
#include <tncifimv.h>
#include <tncif_names.h>
/**
* Maximum size of an EAP-TNC message
@@ -62,6 +63,63 @@ struct private_eap_tnc_t {
};
/**
* Callback function to get recommendation from TNCCS connection
*/
static bool enforce_recommendation(TNC_IMV_Action_Recommendation rec,
TNC_IMV_Evaluation_Result eval)
{
char *group;
identification_t *id;
ike_sa_t *ike_sa;
auth_cfg_t *auth;
bool no_access = FALSE;
DBG1(DBG_TNC, "final recommendation is '%N' and evaluation is '%N'",
TNC_IMV_Action_Recommendation_names, rec,
TNC_IMV_Evaluation_Result_names, eval);
switch (rec)
{
case TNC_IMV_ACTION_RECOMMENDATION_ALLOW:
group = "allow";
break;
case TNC_IMV_ACTION_RECOMMENDATION_ISOLATE:
group = "isolate";
break;
case TNC_IMV_ACTION_RECOMMENDATION_NO_ACCESS:
case TNC_IMV_ACTION_RECOMMENDATION_NO_RECOMMENDATION:
default:
group = "no access";
no_access = TRUE;
break;
}
ike_sa = charon->bus->get_sa(charon->bus);
if (!ike_sa)
{
DBG1(DBG_TNC, "policy enforcement point did not find IKE_SA");
return FALSE;
}
id = ike_sa->get_other_id(ike_sa);
DBG0(DBG_TNC, "policy enforced on peer '%Y' is '%s'", id, group);
if (no_access)
{
return FALSE;
}
else
{
auth = ike_sa->get_auth_cfg(ike_sa, FALSE);
id = identification_create_from_string(group);
auth->add(auth, AUTH_RULE_GROUP, id);
DBG1(DBG_TNC, "policy enforcement point added group membership '%s'",
group);
}
return TRUE;
}
METHOD(eap_method_t, initiate, status_t,
private_eap_tnc_t *this, eap_payload_t **out)
{
@@ -224,8 +282,9 @@ static eap_tnc_t *eap_tnc_create(identification_t *server,
free(this);
return NULL;
}
this->tnccs = tnc->tnccs->create_instance(tnc->tnccs, type, is_server,
server, peer, TNC_IFT_EAP_1_1);
this->tnccs = tnc->tnccs->create_instance(tnc->tnccs, type,
is_server, server, peer, TNC_IFT_EAP_1_1,
is_server ? enforce_recommendation : NULL);
this->tls_eap = tls_eap_create(EAP_TNC, &this->tnccs->tls,
EAP_TNC_MAX_MESSAGE_LEN,
max_msg_count, FALSE);
src/libcharon/plugins/tnc_imv/Makefile.am
-26
View File
@@ -1,26 +0,0 @@
AM_CPPFLAGS = \
-I$(top_srcdir)/src/libstrongswan \
-I$(top_srcdir)/src/libhydra \
-I$(top_srcdir)/src/libcharon \
-I$(top_srcdir)/src/libtncif \
-I$(top_srcdir)/src/libtnccs \
-I$(top_srcdir)/src/libtls
AM_CFLAGS = \
-rdynamic
if MONOLITHIC
noinst_LTLIBRARIES = libstrongswan-tnc-imv.la
else
plugin_LTLIBRARIES = libstrongswan-tnc-imv.la
libstrongswan_tnc_imv_la_LIBADD = \
$(top_builddir)/src/libtncif/libtncif.la \
$(top_builddir)/src/libtnccs/libtnccs.la
endif
libstrongswan_tnc_imv_la_SOURCES = \
tnc_imv_plugin.h tnc_imv_plugin.c tnc_imv.h tnc_imv.c \
tnc_imv_manager.h tnc_imv_manager.c tnc_imv_bind_function.c \
tnc_imv_recommendations.h tnc_imv_recommendations.c
libstrongswan_tnc_imv_la_LDFLAGS = -module -avoid-version
src/libcharon/plugins/tnc_imv/tnc_imv.c
-426
View File
@@ -1,426 +0,0 @@
/*
* Copyright (C) 2006 Mike McCauley
* Copyright (C) 2010-2011 Andreas Steffen,
* HSR Hochschule fuer Technik Rapperswil
*
* This program is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License as published by the
* Free Software Foundation; either version 2 of the License, or (at your
* option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
*
* This program is distributed in the hope that it will be useful, but
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* for more details.
*/
#include "tnc_imv.h"
#include <dlfcn.h>
#include <tncif_pa_subtypes.h>
#include <utils/debug.h>
#include <daemon.h>
#include <library.h>
#include <collections/linked_list.h>
#include <threading/mutex.h>
typedef struct private_tnc_imv_t private_tnc_imv_t;
/**
* Private data of an imv_t object.
*/
struct private_tnc_imv_t {
/**
* Public members of imv_t.
*/
imv_t public;
/**
* Name of loaded IMV
*/
char *name;
/**
* Handle of loaded IMV
*/
void *handle;
/**
* ID of loaded IMV
*/
TNC_IMVID id;
/**
* List of additional IMV IDs
*/
linked_list_t *additional_ids;
/**
* List of message types supported by IMV - Vendor ID part
*/
TNC_VendorIDList supported_vids;
/**
* List of message types supported by IMV - Subtype part
*/
TNC_MessageSubtypeList supported_subtypes;
/**
* Number of supported message types
*/
TNC_UInt32 type_count;
/**
* mutex to lock the imv_t object
*/
mutex_t *mutex;
};
METHOD(imv_t, set_id, void,
private_tnc_imv_t *this, TNC_IMVID id)
{
this->id = id;
}
METHOD(imv_t, get_id, TNC_IMVID,
private_tnc_imv_t *this)
{
return this->id;
}
METHOD(imv_t, add_id, void,
private_tnc_imv_t *this, TNC_IMVID id)
{
TNC_IMVID *new_id;
new_id = malloc_thing(TNC_IMVID);
*new_id = id;
this->additional_ids->insert_last(this->additional_ids, new_id);
}
METHOD(imv_t, has_id, bool,
private_tnc_imv_t *this, TNC_IMVID id)
{
enumerator_t *enumerator;
TNC_IMVID *additional_id;
bool found = FALSE;
/* check primary IMV ID */
if (id == this->id)
{
return TRUE;
}
/* return if there are no additional IMV IDs */
if (this->additional_ids->get_count(this->additional_ids) == 0)
{
return FALSE;
}
/* check additional IMV IDs */
enumerator = this->additional_ids->create_enumerator(this->additional_ids);
while (enumerator->enumerate(enumerator, &additional_id))
{
if (id == *additional_id)
{
found = TRUE;
break;
}
}
enumerator->destroy(enumerator);
return found;
}
METHOD(imv_t, get_name, char*,
private_tnc_imv_t *this)
{
return this->name;
}
METHOD(imv_t, set_message_types, void,
private_tnc_imv_t *this, TNC_MessageTypeList supported_types,
TNC_UInt32 type_count)
{
char buf[BUF_LEN];
char *pos = buf;
int len = sizeof(buf);
int i, written;
size_t size;
TNC_VendorID vid;
TNC_MessageSubtype subtype;
enum_name_t *pa_subtype_names;
/* lock the imv_t instance */
this->mutex->lock(this->mutex);
/* Free existing VendorID and MessageSubtype lists */
free(this->supported_vids);
this->supported_vids = NULL;
free(this->supported_subtypes);
this->supported_subtypes = NULL;
/* Store the new MessageType list */
this->type_count = type_count;
if (type_count && supported_types)
{
size = type_count * sizeof(TNC_VendorID);
this->supported_vids = malloc(size);
size = type_count * sizeof(TNC_MessageSubtype);
this->supported_subtypes = malloc(size);
for (i = 0; i < type_count; i++)
{
vid = (supported_types[i] >> 8) & TNC_VENDORID_ANY;
subtype = supported_types[i] & TNC_SUBTYPE_ANY;
pa_subtype_names = get_pa_subtype_names(vid);
if (pa_subtype_names)
{
written = snprintf(pos, len," '%N/%N' 0x%06x/0x%02x",
pen_names, vid, pa_subtype_names, subtype,
vid, subtype);
}
else
{
written = snprintf(pos, len," '%N' 0x%06x/0x%02x",
pen_names, vid, vid, subtype);
}
if (written >= len)
{
break;
}
pos += written;
len -= written;
this->supported_vids[i] = vid;
this->supported_subtypes[i] = subtype;
}
}
*pos = '\0';
DBG2(DBG_TNC, "IMV %u supports %u message type%s:%s",
this->id, type_count, (type_count == 1) ? "":"s", buf);
/* unlock the imv_t instance */
this->mutex->unlock(this->mutex);
}
METHOD(imv_t, set_message_types_long, void,
private_tnc_imv_t *this, TNC_VendorIDList supported_vids,
TNC_MessageSubtypeList supported_subtypes, TNC_UInt32 type_count)
{
char buf[BUF_LEN];
char *pos = buf;
int len = sizeof(buf);
int i, written;
size_t size;
TNC_VendorID vid;
TNC_MessageSubtype subtype;
enum_name_t *pa_subtype_names;
/* lock the imv_t instance */
this->mutex->lock(this->mutex);
/* Free existing VendorID and MessageSubtype lists */
free(this->supported_vids);
this->supported_vids = NULL;
free(this->supported_subtypes);
this->supported_subtypes = NULL;
/* Store the new MessageType list */
this->type_count = type_count;
if (type_count && supported_vids && supported_subtypes)
{
size = type_count * sizeof(TNC_VendorID);
this->supported_vids = malloc(size);
memcpy(this->supported_vids, supported_vids, size);
size = type_count * sizeof(TNC_MessageSubtype);
this->supported_subtypes = malloc(size);
memcpy(this->supported_subtypes, supported_subtypes, size);
for (i = 0; i < type_count; i++)
{
vid = supported_vids[i];
subtype = supported_subtypes[i];
pa_subtype_names = get_pa_subtype_names(vid);
if (pa_subtype_names)
{
written = snprintf(pos, len," '%N/%N' 0x%06x/0x%08x",
pen_names, vid, pa_subtype_names, subtype,
vid, subtype);
}
else
{
written = snprintf(pos, len," '%N' 0x%06x/0x%08x",
pen_names, vid, vid, subtype);
}
if (written >= len)
{
break;
}
pos += written;
len -= written;
}
}
*pos = '\0';
DBG2(DBG_TNC, "IMV %u supports %u message type%s:%s",
this->id, type_count, (type_count == 1) ? "":"s", buf);
/* unlock the imv_t instance */
this->mutex->unlock(this->mutex);
}
METHOD(imv_t, type_supported, bool,
private_tnc_imv_t *this, TNC_VendorID msg_vid, TNC_MessageSubtype msg_subtype)
{
TNC_VendorID vid;
TNC_MessageSubtype subtype;
int i;
for (i = 0; i < this->type_count; i++)
{
vid = this->supported_vids[i];
subtype = this->supported_subtypes[i];
if ((vid == TNC_VENDORID_ANY && subtype == TNC_SUBTYPE_ANY) ||
(vid == msg_vid && (subtype == TNC_SUBTYPE_ANY ||
subtype == msg_subtype)))
{
return TRUE;
}
}
return FALSE;
}
METHOD(imv_t, destroy, void,
private_tnc_imv_t *this)
{
if (this->handle && lib->settings->get_bool(lib->settings,
"%s.plugins.tnc-imv.dlclose", TRUE, charon->name))
{
dlclose(this->handle);
}
this->mutex->destroy(this->mutex);
this->additional_ids->destroy_function(this->additional_ids, free);
free(this->supported_vids);
free(this->supported_subtypes);
free(this->name);
free(this);
}
/**
* Generic constructor.
*/
static private_tnc_imv_t* tnc_imv_create_empty(char *name)
{
private_tnc_imv_t *this;
INIT(this,
.public = {
.set_id = _set_id,
.get_id = _get_id,
.add_id = _add_id,
.has_id = _has_id,
.get_name = _get_name,
.set_message_types = _set_message_types,
.set_message_types_long = _set_message_types_long,
.type_supported = _type_supported,
.destroy = _destroy,
},
.name = strdup(name),
.additional_ids = linked_list_create(),
.mutex = mutex_create(MUTEX_TYPE_DEFAULT),
);
return this;
}
/**
* Described in header.
*/
imv_t* tnc_imv_create(char *name, char *path)
{
private_tnc_imv_t *this;
this = tnc_imv_create_empty(name);
this->handle = dlopen(path, RTLD_LAZY);
if (!this->handle)
{
DBG1(DBG_TNC, "IMV \"%s\" failed to load: %s", name, dlerror());
destroy(this);
return NULL;
}
this->public.initialize = dlsym(this->handle, "TNC_IMV_Initialize");
if (!this->public.initialize)
{
DBG1(DBG_TNC, "could not resolve TNC_IMV_Initialize in %s: %s\n",
path, dlerror());
destroy(this);
return NULL;
}
this->public.notify_connection_change =
dlsym(this->handle, "TNC_IMV_NotifyConnectionChange");
this->public.solicit_recommendation =
dlsym(this->handle, "TNC_IMV_SolicitRecommendation");
if (!this->public.solicit_recommendation)
{
DBG1(DBG_TNC, "could not resolve TNC_IMV_SolicitRecommendation in %s: %s\n",
path, dlerror());
destroy(this);
return NULL;
}
this->public.receive_message =
dlsym(this->handle, "TNC_IMV_ReceiveMessage");
this->public.receive_message_long =
dlsym(this->handle, "TNC_IMV_ReceiveMessageLong");
this->public.batch_ending =
dlsym(this->handle, "TNC_IMV_BatchEnding");
this->public.terminate =
dlsym(this->handle, "TNC_IMV_Terminate");
this->public.provide_bind_function =
dlsym(this->handle, "TNC_IMV_ProvideBindFunction");
if (!this->public.provide_bind_function)
{
DBG1(DBG_TNC, "could not resolve TNC_IMV_ProvideBindFunction in %s: %s\n",
path, dlerror());
destroy(this);
return NULL;
}
return &this->public;
}
/**
* Described in header.
*/
imv_t* tnc_imv_create_from_functions(char *name,
TNC_IMV_InitializePointer initialize,
TNC_IMV_NotifyConnectionChangePointer notify_connection_change,
TNC_IMV_ReceiveMessagePointer receive_message,
TNC_IMV_ReceiveMessageLongPointer receive_message_long,
TNC_IMV_SolicitRecommendationPointer solicit_recommendation,
TNC_IMV_BatchEndingPointer batch_ending,
TNC_IMV_TerminatePointer terminate,
TNC_IMV_ProvideBindFunctionPointer provide_bind_function)
{
private_tnc_imv_t *this;
this = tnc_imv_create_empty(name);
this->public.initialize = initialize;
this->public.notify_connection_change = notify_connection_change;
this->public.receive_message = receive_message;
this->public.receive_message_long = receive_message_long;
this->public.solicit_recommendation = solicit_recommendation;
this->public.batch_ending = batch_ending;
this->public.terminate = terminate;
this->public.provide_bind_function = provide_bind_function;
return &this->public;
}
src/libcharon/plugins/tnc_imv/tnc_imv.h
-60
View File
@@ -1,60 +0,0 @@
/*
* Copyright (C) 2010 Andreas Steffen
* HSR Hochschule fuer Technik Rapperswil
*
* This program is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License as published by the
* Free Software Foundation; either version 2 of the License, or (at your
* option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
*
* This program is distributed in the hope that it will be useful, but
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* for more details.
*/
/**
*
* @defgroup tnc_imv_t tnc_imv
* @{ @ingroup tnc_imv
*/
#ifndef TNC_IMV_H_
#define TNC_IMV_H_
#include <tnc/imv/imv.h>
/**
* Create an Integrity Measurement Verifier loaded from a library.
*
* @param name name of the IMV
* @param filename path to the dynamic IMV library
* @return instance of the imv_t interface
*/
imv_t* tnc_imv_create(char *name, char *filename);
/**
* Create an Integrity Measurement Verifier from a set of IMV functions.
*
* @param name name of the IMV
* @param initialize TNC_IMV_InitializePointer
* @param notify_connection_change TNC_IMV_NotifyConnectionChangePointer
* @param receive_message TNC_IMV_ReceiveMessagePointer
* @param receive_message_long TNC_IMV_ReceiveMessageLongPointer
* @param solicit_recommendation TNC_IMV_SolicitRecommendationPointer
* @param batch_ending TNC_IMV_BatchEndingPointer
* @param terminate TNC_IMV_TerminatePointer
* @param provide_bind_function TNC_IMV_ProvideBindFunctionPointer
* @return instance of the imv_t interface
*/
imv_t* tnc_imv_create_from_functions(char *name,
TNC_IMV_InitializePointer initialize,
TNC_IMV_NotifyConnectionChangePointer notify_connection_change,
TNC_IMV_ReceiveMessagePointer receive_message,
TNC_IMV_ReceiveMessageLongPointer receive_message_long,
TNC_IMV_SolicitRecommendationPointer solicit_recommendation,
TNC_IMV_BatchEndingPointer batch_ending,
TNC_IMV_TerminatePointer terminate,
TNC_IMV_ProvideBindFunctionPointer provide_bind_function);
#endif /** TNC_IMV_H_ @}*/
src/libcharon/plugins/tnc_imv/tnc_imv_bind_function.c
-246
View File
@@ -1,246 +0,0 @@
/*
* Copyright (C) 2006 Mike McCauley
* Copyright (C) 2010-2011 Andreas Steffen
* HSR Hochschule fuer Technik Rapperswil
*
* This program is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License as published by the
* Free Software Foundation; either version 2 of the License, or (at your
* option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
*
* This program is distributed in the hope that it will be useful, but
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* for more details.
*/
#include <tnc/tnc.h>
#include <tnc/imv/imv_manager.h>
#include <tnc/tnccs/tnccs_manager.h>
#include <utils/debug.h>
/**
* Called by the IMV to inform a TNCS about the set of message types the IMV
* is able to receive
*/
TNC_Result TNC_TNCS_ReportMessageTypes(TNC_IMVID imv_id,
TNC_MessageTypeList supported_types,
TNC_UInt32 type_count)
{
if (!tnc->imvs->is_registered(tnc->imvs, imv_id))
{
DBG1(DBG_TNC, "ignoring ReportMessageTypes() from unregistered IMV %u",
imv_id);
return TNC_RESULT_INVALID_PARAMETER;
}
return tnc->imvs->set_message_types(tnc->imvs, imv_id, supported_types,
type_count);
}
/**
* Called by the IMV to inform a TNCS about the set of message types the IMV
* is able to receive. This function supports long message types.
*/
TNC_Result TNC_TNCS_ReportMessageTypesLong(TNC_IMVID imv_id,
TNC_VendorIDList supported_vids,
TNC_MessageSubtypeList supported_subtypes,
TNC_UInt32 type_count)
{
if (!tnc->imvs->is_registered(tnc->imvs, imv_id))
{
DBG1(DBG_TNC, "ignoring ReportMessageTypesLong() from unregistered IMV %u",
imv_id);
return TNC_RESULT_INVALID_PARAMETER;
}
return tnc->imvs->set_message_types_long(tnc->imvs, imv_id, supported_vids,
supported_subtypes, type_count);
}
/**
* Called by the IMV to ask a TNCS to retry an Integrity Check Handshake
*/
TNC_Result TNC_TNCS_RequestHandshakeRetry(TNC_IMVID imv_id,
TNC_ConnectionID connection_id,
TNC_RetryReason reason)
{
if (!tnc->imvs->is_registered(tnc->imvs, imv_id))
{
DBG1(DBG_TNC, "ignoring RequestHandshakeRetry() from unregistered IMV %u",
imv_id);
return TNC_RESULT_INVALID_PARAMETER;
}
return tnc->tnccs->request_handshake_retry(tnc->tnccs, FALSE, imv_id,
connection_id, reason);
}
/**
* Called by the IMV when an IMV-IMC message is to be sent
*/
TNC_Result TNC_TNCS_SendMessage(TNC_IMVID imv_id,
TNC_ConnectionID connection_id,
TNC_BufferReference msg,
TNC_UInt32 msg_len,
TNC_MessageType msg_type)
{
TNC_VendorID msg_vid;
TNC_MessageSubtype msg_subtype;
if (!tnc->imvs->is_registered(tnc->imvs, imv_id))
{
DBG1(DBG_TNC, "ignoring SendMessage() from unregistered IMV %u",
imv_id);
return TNC_RESULT_INVALID_PARAMETER;
}
msg_vid = (msg_type >> 8) & TNC_VENDORID_ANY;
msg_subtype = msg_type & TNC_SUBTYPE_ANY;
return tnc->tnccs->send_message(tnc->tnccs, TNC_IMCID_ANY, imv_id,
connection_id, 0, msg, msg_len, msg_vid, msg_subtype);
}
/**
* Called by the IMV when an IMV-IMC message is to be sent over IF-TNCCS 2.0
*/
TNC_Result TNC_TNCS_SendMessageLong(TNC_IMVID imv_id,
TNC_ConnectionID connection_id,
TNC_UInt32 msg_flags,
TNC_BufferReference msg,
TNC_UInt32 msg_len,
TNC_VendorID msg_vid,
TNC_MessageSubtype msg_subtype,
TNC_UInt32 imc_id)
{
if (!tnc->imvs->is_registered(tnc->imvs, imv_id))
{
DBG1(DBG_TNC, "ignoring SendMessageLong() from unregistered IMV %u",
imv_id);
return TNC_RESULT_INVALID_PARAMETER;
}
return tnc->tnccs->send_message(tnc->tnccs, imc_id, imv_id, connection_id,
msg_flags, msg, msg_len, msg_vid, msg_subtype);
}
/**
* Called by the IMV to deliver its IMV Action Recommendation and IMV Evaluation
* Result to the TNCS
*/
TNC_Result TNC_TNCS_ProvideRecommendation(TNC_IMVID imv_id,
TNC_ConnectionID connection_id,
TNC_IMV_Action_Recommendation recommendation,
TNC_IMV_Evaluation_Result evaluation)
{
if (!tnc->imvs->is_registered(tnc->imvs, imv_id))
{
DBG1(DBG_TNC, "ignoring ProvideRecommendation() from unregistered IMV %u",
imv_id);
return TNC_RESULT_INVALID_PARAMETER;
}
return tnc->tnccs->provide_recommendation(tnc->tnccs, imv_id, connection_id,
recommendation, evaluation);
}
/**
* Called by the IMV to get the value of an attribute associated with a
* connection or with the TNCS as a whole.
*/
TNC_Result TNC_TNCS_GetAttribute(TNC_IMVID imv_id,
TNC_ConnectionID connection_id,
TNC_AttributeID attribute_id,
TNC_UInt32 buffer_len,
TNC_BufferReference buffer,
TNC_UInt32 *out_value_len)
{
if (!tnc->imvs->is_registered(tnc->imvs, imv_id))
{
DBG1(DBG_TNC, "ignoring GetAttribute() from unregistered IMV %u",
imv_id);
return TNC_RESULT_INVALID_PARAMETER;
}
return tnc->tnccs->get_attribute(tnc->tnccs, FALSE, imv_id, connection_id,
attribute_id, buffer_len, buffer, out_value_len);
}
/**
* Called by the IMV to set the value of an attribute associated with a
* connection or with the TNCS as a whole.
*/
TNC_Result TNC_TNCS_SetAttribute(TNC_IMVID imv_id,
TNC_ConnectionID connection_id,
TNC_AttributeID attribute_id,
TNC_UInt32 buffer_len,
TNC_BufferReference buffer)
{
if (!tnc->imvs->is_registered(tnc->imvs, imv_id))
{
DBG1(DBG_TNC, "ignoring SetAttribute() from unregistered IMV %u",
imv_id);
return TNC_RESULT_INVALID_PARAMETER;
}
return tnc->tnccs->set_attribute(tnc->tnccs, FALSE, imv_id, connection_id,
attribute_id, buffer_len, buffer);
}
/**
* Called by the IMV when it wants to reserve an additional IMV ID for itself
*/
TNC_Result TNC_TNCS_ReserveAdditionalIMVID(TNC_IMVID imv_id, TNC_UInt32 *new_id)
{
if (tnc->imvs->reserve_id(tnc->imvs, imv_id, new_id))
{
return TNC_RESULT_SUCCESS;
}
DBG1(DBG_TNC, "ignoring ReserveAdditionalIMVID() from unregistered IMV %u",
imv_id);
return TNC_RESULT_INVALID_PARAMETER;
}
/**
* Called by the IMV when it needs a function pointer
*/
TNC_Result TNC_TNCS_BindFunction(TNC_IMVID id,
char *function_name,
void **function_pointer)
{
if (streq(function_name, "TNC_TNCS_ReportMessageTypes"))
{
*function_pointer = (void*)TNC_TNCS_ReportMessageTypes;
}
else if (streq(function_name, "TNC_TNCS_ReportMessageTypesLong"))
{
*function_pointer = (void*)TNC_TNCS_ReportMessageTypesLong;
}
else if (streq(function_name, "TNC_TNCS_RequestHandshakeRetry"))
{
*function_pointer = (void*)TNC_TNCS_RequestHandshakeRetry;
}
else if (streq(function_name, "TNC_TNCS_SendMessage"))
{
*function_pointer = (void*)TNC_TNCS_SendMessage;
}
else if (streq(function_name, "TNC_TNCS_SendMessageLong"))
{
*function_pointer = (void*)TNC_TNCS_SendMessageLong;
}
else if (streq(function_name, "TNC_TNCS_ProvideRecommendation"))
{
*function_pointer = (void*)TNC_TNCS_ProvideRecommendation;
}
else if (streq(function_name, "TNC_TNCS_GetAttribute"))
{
*function_pointer = (void*)TNC_TNCS_GetAttribute;
}
else if (streq(function_name, "TNC_TNCS_SetAttribute"))
{
*function_pointer = (void*)TNC_TNCS_SetAttribute;
}
else if (streq(function_name, "TNC_TNCS_ReserveAdditionalIMVID"))
{
*function_pointer = (void*)TNC_TNCS_ReserveAdditionalIMVID;
}
else
{
return TNC_RESULT_INVALID_PARAMETER;
}
return TNC_RESULT_SUCCESS;
}
src/libcharon/plugins/tnc_imv/tnc_imv_manager.c
-530
View File
@@ -1,530 +0,0 @@
/*
* Copyright (C) 2006 Mike McCauley
* Copyright (C) 2010-2011 Andreas Steffen
* HSR Hochschule fuer Technik Rapperswil
*
* This program is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License as published by the
* Free Software Foundation; either version 2 of the License, or (at your
* option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
*
* This program is distributed in the hope that it will be useful, but
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* for more details.
*/
#include "tnc_imv_manager.h"
#include "tnc_imv.h"
#include "tnc_imv_recommendations.h"
#include <tncifimv.h>
#include <tncif_names.h>
#include <sys/types.h>
#include <sys/stat.h>
#include <sys/mman.h>
#include <unistd.h>
#include <errno.h>
#include <fcntl.h>
#include <daemon.h>
#include <utils/debug.h>
#include <threading/rwlock.h>
#include <threading/mutex.h>
#include <collections/linked_list.h>
typedef struct private_tnc_imv_manager_t private_tnc_imv_manager_t;
/**
* Private data of an imv_manager_t object.
*/
struct private_tnc_imv_manager_t {
/**
* Public members of imv_manager_t.
*/
imv_manager_t public;
/**
* Linked list of IMVs
*/
linked_list_t *imvs;
/**
* Lock for IMV list
*/
rwlock_t *lock;
/**
* Next IMV ID to be assigned
*/
TNC_IMVID next_imv_id;
/**
* Mutex to access next IMV ID
*/
mutex_t *id_mutex;
/**
* Policy defining how to derive final recommendation from individual ones
*/
recommendation_policy_t policy;
};
METHOD(imv_manager_t, add, bool,
private_tnc_imv_manager_t *this, imv_t *imv)
{
TNC_Version version;
TNC_IMVID imv_id;
this->id_mutex->lock(this->id_mutex);
imv_id = this->next_imv_id++;
this->id_mutex->unlock(this->id_mutex);
imv->set_id(imv, imv_id);
if (imv->initialize(imv_id, TNC_IFIMV_VERSION_1,
TNC_IFIMV_VERSION_1, &version) != TNC_RESULT_SUCCESS)
{
DBG1(DBG_TNC, "IMV \"%s\" failed to initialize", imv->get_name(imv));
return FALSE;
}
this->lock->write_lock(this->lock);
this->imvs->insert_last(this->imvs, imv);
this->lock->unlock(this->lock);
if (imv->provide_bind_function(imv->get_id(imv),
TNC_TNCS_BindFunction) != TNC_RESULT_SUCCESS)
{
if (imv->terminate)
{
imv->terminate(imv->get_id(imv));
}
DBG1(DBG_TNC, "IMV \"%s\" failed to obtain bind function",
imv->get_name(imv));
this->lock->write_lock(this->lock);
this->imvs->remove_last(this->imvs, (void**)&imv);
this->lock->unlock(this->lock);
return FALSE;
}
return TRUE;
}
METHOD(imv_manager_t, remove_, imv_t*,
private_tnc_imv_manager_t *this, TNC_IMVID id)
{
enumerator_t *enumerator;
imv_t *imv, *removed_imv = NULL;
this->lock->write_lock(this->lock);
enumerator = this->imvs->create_enumerator(this->imvs);
while (enumerator->enumerate(enumerator, &imv))
{
if (id == imv->get_id(imv))
{
this->imvs->remove_at(this->imvs, enumerator);
removed_imv = imv;
break;
}
}
enumerator->destroy(enumerator);
this->lock->unlock(this->lock);
return removed_imv;
}
METHOD(imv_manager_t, load, bool,
private_tnc_imv_manager_t *this, char *name, char *path)
{
imv_t *imv;
imv = tnc_imv_create(name, path);
if (!imv)
{
return FALSE;
}
if (!add(this, imv))
{
imv->destroy(imv);
return FALSE;
}
DBG1(DBG_TNC, "IMV %u \"%s\" loaded from '%s'", imv->get_id(imv), name, path);
return TRUE;
}
METHOD(imv_manager_t, load_from_functions, bool,
private_tnc_imv_manager_t *this, char *name,
TNC_IMV_InitializePointer initialize,
TNC_IMV_NotifyConnectionChangePointer notify_connection_change,
TNC_IMV_ReceiveMessagePointer receive_message,
TNC_IMV_ReceiveMessageLongPointer receive_message_long,
TNC_IMV_SolicitRecommendationPointer solicit_recommendation,
TNC_IMV_BatchEndingPointer batch_ending,
TNC_IMV_TerminatePointer terminate,
TNC_IMV_ProvideBindFunctionPointer provide_bind_function)
{
imv_t *imv;
imv = tnc_imv_create_from_functions(name,
initialize,notify_connection_change,
receive_message, receive_message_long,
solicit_recommendation, batch_ending,
terminate, provide_bind_function);
if (!imv)
{
return FALSE;
}
if (!add(this, imv))
{
imv->destroy(imv);
return FALSE;
}
DBG1(DBG_TNC, "IMV %u \"%s\" loaded", imv->get_id(imv), name);
return TRUE;
}
METHOD(imv_manager_t, is_registered, bool,
private_tnc_imv_manager_t *this, TNC_IMVID id)
{
enumerator_t *enumerator;
imv_t *imv;
bool found = FALSE;
this->lock->read_lock(this->lock);
enumerator = this->imvs->create_enumerator(this->imvs);
while (enumerator->enumerate(enumerator, &imv))
{
if (imv->has_id(imv, id))
{
found = TRUE;
break;
}
}
enumerator->destroy(enumerator);
this->lock->unlock(this->lock);
return found;
}
METHOD(imv_manager_t, reserve_id, bool,
private_tnc_imv_manager_t *this, TNC_IMVID id, TNC_UInt32 *new_id)
{
enumerator_t *enumerator;
imv_t *imv;
bool found = FALSE;
this->lock->read_lock(this->lock);
enumerator = this->imvs->create_enumerator(this->imvs);
while (enumerator->enumerate(enumerator, &imv))
{
if (id == imv->get_id(imv))
{
found = TRUE;
this->id_mutex->lock(this->id_mutex);
*new_id = this->next_imv_id++;
this->id_mutex->unlock(this->id_mutex);
imv->add_id(imv, *new_id);
DBG2(DBG_TNC, "additional ID %u reserved for IMV with primary ID %u",
*new_id, id);
break;
}
}
enumerator->destroy(enumerator);
this->lock->unlock(this->lock);
return found;
}
METHOD(imv_manager_t, get_recommendation_policy, recommendation_policy_t,
private_tnc_imv_manager_t *this)
{
return this->policy;
}
METHOD(imv_manager_t, create_recommendations, recommendations_t*,
private_tnc_imv_manager_t *this)
{
return tnc_imv_recommendations_create(this->imvs);
}
METHOD(imv_manager_t, enforce_recommendation, bool,
private_tnc_imv_manager_t *this, TNC_IMV_Action_Recommendation rec,
TNC_IMV_Evaluation_Result eval)
{
char *group;
identification_t *id;
ike_sa_t *ike_sa;
auth_cfg_t *auth;
bool no_access = FALSE;
DBG1(DBG_TNC, "final recommendation is '%N' and evaluation is '%N'",
TNC_IMV_Action_Recommendation_names, rec,
TNC_IMV_Evaluation_Result_names, eval);
switch (rec)
{
case TNC_IMV_ACTION_RECOMMENDATION_ALLOW:
group = "allow";
break;
case TNC_IMV_ACTION_RECOMMENDATION_ISOLATE:
group = "isolate";
break;
case TNC_IMV_ACTION_RECOMMENDATION_NO_ACCESS:
case TNC_IMV_ACTION_RECOMMENDATION_NO_RECOMMENDATION:
default:
group = "no access";
no_access = TRUE;
break;
}
ike_sa = charon->bus->get_sa(charon->bus);
if (!ike_sa)
{
DBG1(DBG_TNC, "policy enforcement point did not find IKE_SA");
return FALSE;
}
id = ike_sa->get_other_id(ike_sa);
DBG0(DBG_TNC, "policy enforced on peer '%Y' is '%s'", id, group);
if (no_access)
{
return FALSE;
}
else
{
auth = ike_sa->get_auth_cfg(ike_sa, FALSE);
id = identification_create_from_string(group);
auth->add(auth, AUTH_RULE_GROUP, id);
DBG1(DBG_TNC, "policy enforcement point added group membership '%s'",
group);
}
return TRUE;
}
METHOD(imv_manager_t, notify_connection_change, void,
private_tnc_imv_manager_t *this, TNC_ConnectionID id,
TNC_ConnectionState state)
{
enumerator_t *enumerator;
imv_t *imv;
this->lock->read_lock(this->lock);
enumerator = this->imvs->create_enumerator(this->imvs);
while (enumerator->enumerate(enumerator, &imv))
{
if (imv->notify_connection_change)
{
imv->notify_connection_change(imv->get_id(imv), id, state);
}
}
enumerator->destroy(enumerator);
this->lock->unlock(this->lock);
}
METHOD(imv_manager_t, set_message_types, TNC_Result,
private_tnc_imv_manager_t *this, TNC_IMVID id,
TNC_MessageTypeList supported_types,
TNC_UInt32 type_count)
{
enumerator_t *enumerator;
imv_t *imv;
TNC_Result result = TNC_RESULT_FATAL;
this->lock->read_lock(this->lock);
enumerator = this->imvs->create_enumerator(this->imvs);
while (enumerator->enumerate(enumerator, &imv))
{
if (id == imv->get_id(imv))
{
imv->set_message_types(imv, supported_types, type_count);
result = TNC_RESULT_SUCCESS;
break;
}
}
enumerator->destroy(enumerator);
this->lock->unlock(this->lock);
return result;
}
METHOD(imv_manager_t, set_message_types_long, TNC_Result,
private_tnc_imv_manager_t *this, TNC_IMVID id,
TNC_VendorIDList supported_vids,
TNC_MessageSubtypeList supported_subtypes,
TNC_UInt32 type_count)
{
enumerator_t *enumerator;
imv_t *imv;
TNC_Result result = TNC_RESULT_FATAL;
this->lock->read_lock(this->lock);
enumerator = this->imvs->create_enumerator(this->imvs);
while (enumerator->enumerate(enumerator, &imv))
{
if (id == imv->get_id(imv))
{
imv->set_message_types_long(imv, supported_vids, supported_subtypes,
type_count);
result = TNC_RESULT_SUCCESS;
break;
}
}
enumerator->destroy(enumerator);
this->lock->unlock(this->lock);
return result;
}
METHOD(imv_manager_t, solicit_recommendation, void,
private_tnc_imv_manager_t *this, TNC_ConnectionID id)
{
enumerator_t *enumerator;
imv_t *imv;
this->lock->read_lock(this->lock);
enumerator = this->imvs->create_enumerator(this->imvs);
while (enumerator->enumerate(enumerator, &imv))
{
imv->solicit_recommendation(imv->get_id(imv), id);
}
enumerator->destroy(enumerator);
this->lock->unlock(this->lock);
}
METHOD(imv_manager_t, receive_message, void,
private_tnc_imv_manager_t *this, TNC_ConnectionID connection_id,
bool excl,
TNC_BufferReference msg,
TNC_UInt32 msg_len,
TNC_VendorID msg_vid,
TNC_MessageSubtype msg_subtype,
TNC_UInt32 src_imc_id,
TNC_UInt32 dst_imv_id)
{
bool type_supported = FALSE;
TNC_MessageType msg_type;
TNC_UInt32 msg_flags;
enumerator_t *enumerator;
imv_t *imv;
msg_type = (msg_vid << 8) | msg_subtype;
this->lock->read_lock(this->lock);
enumerator = this->imvs->create_enumerator(this->imvs);
while (enumerator->enumerate(enumerator, &imv))
{
if (imv->type_supported(imv, msg_vid, msg_subtype) &&
(!excl || (excl && imv->has_id(imv, dst_imv_id))))
{
if (imv->receive_message_long && src_imc_id)
{
type_supported = TRUE;
msg_flags = excl ? TNC_MESSAGE_FLAGS_EXCLUSIVE : 0;
imv->receive_message_long(imv->get_id(imv), connection_id,
msg_flags, msg, msg_len, msg_vid, msg_subtype,
src_imc_id, dst_imv_id);
}
else if (imv->receive_message && msg_vid <= TNC_VENDORID_ANY &&
msg_subtype <= TNC_SUBTYPE_ANY)
{
type_supported = TRUE;
msg_type = (msg_vid << 8) | msg_subtype;
imv->receive_message(imv->get_id(imv), connection_id,
msg, msg_len, msg_type);
}
}
}
enumerator->destroy(enumerator);
this->lock->unlock(this->lock);
if (!type_supported)
{
DBG2(DBG_TNC, "message type 0x%06x/0x%08x not supported by any IMV",
msg_vid, msg_subtype);
}
}
METHOD(imv_manager_t, batch_ending, void,
private_tnc_imv_manager_t *this, TNC_ConnectionID id)
{
enumerator_t *enumerator;
imv_t *imv;
this->lock->read_lock(this->lock);
enumerator = this->imvs->create_enumerator(this->imvs);
while (enumerator->enumerate(enumerator, &imv))
{
if (imv->batch_ending)
{
imv->batch_ending(imv->get_id(imv), id);
}
}
enumerator->destroy(enumerator);
this->lock->unlock(this->lock);
}
METHOD(imv_manager_t, destroy, void,
private_tnc_imv_manager_t *this)
{
imv_t *imv;
while (this->imvs->remove_last(this->imvs, (void**)&imv) == SUCCESS)
{
if (imv->terminate &&
imv->terminate(imv->get_id(imv)) != TNC_RESULT_SUCCESS)
{
DBG1(DBG_TNC, "IMV \"%s\" not terminated successfully",
imv->get_name(imv));
}
imv->destroy(imv);
}
this->imvs->destroy(this->imvs);
this->lock->destroy(this->lock);
this->id_mutex->destroy(this->id_mutex);
free(this);
}
/**
* Described in header.
*/
imv_manager_t* tnc_imv_manager_create(void)
{
private_tnc_imv_manager_t *this;
recommendation_policy_t policy;
INIT(this,
.public = {
.add = _add,
.remove = _remove_, /* avoid name conflict with stdio.h */
.load = _load,
.load_from_functions = _load_from_functions,
.is_registered = _is_registered,
.reserve_id = _reserve_id,
.get_recommendation_policy = _get_recommendation_policy,
.create_recommendations = _create_recommendations,
.enforce_recommendation = _enforce_recommendation,
.notify_connection_change = _notify_connection_change,
.set_message_types = _set_message_types,
.set_message_types_long = _set_message_types_long,
.solicit_recommendation = _solicit_recommendation,
.receive_message = _receive_message,
.batch_ending = _batch_ending,
.destroy = _destroy,
},
.imvs = linked_list_create(),
.lock = rwlock_create(RWLOCK_TYPE_DEFAULT),
.id_mutex = mutex_create(MUTEX_TYPE_DEFAULT),
.next_imv_id = 1,
);
policy = enum_from_name(recommendation_policy_names,
lib->settings->get_str(lib->settings,
"%s.plugins.tnc-imv.recommendation_policy", "default",
charon->name));
this->policy = (policy != -1) ? policy : RECOMMENDATION_POLICY_DEFAULT;
DBG1(DBG_TNC, "TNC recommendation policy is '%N'",
recommendation_policy_names, this->policy);
return &this->public;
}
src/libcharon/plugins/tnc_imv/tnc_imv_manager.h
-32
View File
@@ -1,32 +0,0 @@
/*
* Copyright (C) 2010 Andreas Steffen
* HSR Hochschule fuer Technik Rapperswil
*
* This program is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License as published by the
* Free Software Foundation; either version 2 of the License, or (at your
* option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
*
* This program is distributed in the hope that it will be useful, but
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* for more details.
*/
/**
*
* @defgroup tnc_imv_manager tnc_imv_manager
* @{ @ingroup tnc_imv
*/
#ifndef TNC_IMV_MANAGER_H_
#define TNC_IMV_MANAGER_H_
#include <tnc/imv/imv_manager.h>
/**
* Create an IMV manager instance.
*/
imv_manager_t *tnc_imv_manager_create();
#endif /** TNC_IMV_MANAGER_H_ @}*/
src/libcharon/plugins/tnc_imv/tnc_imv_plugin.c
-83
View File
@@ -1,83 +0,0 @@
/*
* Copyright (C) 2010-2011 Andreas Steffen
* HSR Hochschule fuer Technik Rapperswil
*
* This program is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License as published by the
* Free Software Foundation; either version 2 of the License, or (at your
* option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
*
* This program is distributed in the hope that it will be useful, but
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* for more details.
*/
#include "tnc_imv_plugin.h"
#include "tnc_imv_manager.h"
#include <tnc/tnc.h>
typedef struct private_tnc_imv_plugin_t private_tnc_imv_plugin_t;
/**
* Private data of a tnc_imv_plugin_t object.
*/
struct private_tnc_imv_plugin_t {
/**
* Public interface.
*/
tnc_imv_plugin_t public;
};
METHOD(plugin_t, get_name, char*,
tnc_imv_plugin_t *this)
{
return "tnc-imv";
}
METHOD(plugin_t, get_features, int,
private_tnc_imv_plugin_t *this, plugin_feature_t *features[])
{
static plugin_feature_t f[] = {
PLUGIN_CALLBACK(tnc_manager_register, tnc_imv_manager_create),
PLUGIN_PROVIDE(CUSTOM, "imv-manager"),
PLUGIN_DEPENDS(CUSTOM, "tnccs-manager"),
PLUGIN_SDEPEND(CERT_DECODE, CERT_X509),
PLUGIN_SDEPEND(CERT_DECODE, CERT_TRUSTED_PUBKEY),
PLUGIN_SDEPEND(DATABASE, DB_ANY),
};
*features = f;
return countof(f);
}
METHOD(plugin_t, destroy, void,
private_tnc_imv_plugin_t *this)
{
free(this);
}
/*
* see header file
*/
plugin_t *tnc_imv_plugin_create()
{
private_tnc_imv_plugin_t *this;
INIT(this,
.public = {
.plugin = {
.get_name = _get_name,
.get_features = _get_features,
.destroy = _destroy,
},
},
);
return &this->public.plugin;
}
src/libcharon/plugins/tnc_imv/tnc_imv_plugin.h
-42
View File
@@ -1,42 +0,0 @@
/*
* Copyright (C) 2010 Andreas Steffen
* HSR Hochschule fuer Technik Rapperswil
*
* This program is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License as published by the
* Free Software Foundation; either version 2 of the License, or (at your
* option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
*
* This program is distributed in the hope that it will be useful, but
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* for more details.
*/
/**
* @defgroup tnc_imv tnc_imv
* @ingroup cplugins
*
* @defgroup tnc_imv_plugin tnc_imv_plugin
* @{ @ingroup tnc_imv
*/
#ifndef TNC_IMV_PLUGIN_H_
#define TNC_IMV_PLUGIN_H_
#include <plugins/plugin.h>
typedef struct tnc_imv_plugin_t tnc_imv_plugin_t;
/**
* TNC IMV plugin
*/
struct tnc_imv_plugin_t {
/**
* implements plugin interface
*/
plugin_t plugin;
};
#endif /** TNC_IMV_PLUGIN_H_ @}*/
src/libcharon/plugins/tnc_imv/tnc_imv_recommendations.c
-406
View File
@@ -1,406 +0,0 @@
/*
* Copyright (C) 2010-2012 Andreas Steffen
* HSR Hochschule fuer Technik Rapperswil
*
* This program is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License as published by the
* Free Software Foundation; either version 2 of the License, or (at your
* option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
*
* This program is distributed in the hope that it will be useful, but
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* for more details.
*/
#include <tncifimv.h>
#include <tncif_names.h>
#include <tncif_policy.h>
#include <tnc/tnc.h>
#include <tnc/imv/imv.h>
#include <tnc/imv/imv_manager.h>
#include <tnc/imv/imv_recommendations.h>
#include <utils/debug.h>
#include <collections/linked_list.h>
typedef struct private_tnc_imv_recommendations_t private_tnc_imv_recommendations_t;
typedef struct recommendation_entry_t recommendation_entry_t;
/**
* Recommendation entry
*/
struct recommendation_entry_t {
/**
* IMV ID
*/
TNC_IMVID id;
/**
* Received a recommendation message from this IMV?
*/
bool have_recommendation;
/**
* Action Recommendation provided by IMV instance
*/
TNC_IMV_Action_Recommendation rec;
/**
* Evaluation Result provided by IMV instance
*/
TNC_IMV_Evaluation_Result eval;
/**
* Reason string provided by IMV instance
*/
chunk_t reason;
/**
* Reason language provided by IMV instance
*/
chunk_t reason_language;
};
/**
* Private data of a recommendations_t object.
*/
struct private_tnc_imv_recommendations_t {
/**
* Public members of recommendations_t.
*/
recommendations_t public;
/**
* list of recommendations and evaluations provided by IMVs
*/
linked_list_t *recs;
/**
* Preferred language for remediation messages
*/
chunk_t preferred_language;
};
METHOD(recommendations_t, provide_recommendation, TNC_Result,
private_tnc_imv_recommendations_t* this, TNC_IMVID id,
TNC_IMV_Action_Recommendation rec,
TNC_IMV_Evaluation_Result eval)
{
enumerator_t *enumerator;
recommendation_entry_t *entry;
bool found = FALSE;
DBG2(DBG_TNC, "IMV %u provides recommendation '%N' and evaluation '%N'", id,
TNC_IMV_Action_Recommendation_names, rec,
TNC_IMV_Evaluation_Result_names, eval);
enumerator = this->recs->create_enumerator(this->recs);
while (enumerator->enumerate(enumerator, &entry))
{
if (entry->id == id)
{
found = TRUE;
entry->have_recommendation = TRUE;
entry->rec = rec;
entry->eval = eval;
break;
}
}
enumerator->destroy(enumerator);
return found ? TNC_RESULT_SUCCESS : TNC_RESULT_FATAL;
}
METHOD(recommendations_t, have_recommendation, bool,
private_tnc_imv_recommendations_t *this, TNC_IMV_Action_Recommendation *rec,
TNC_IMV_Evaluation_Result *eval)
{
enumerator_t *enumerator;
recommendation_entry_t *entry;
recommendation_policy_t policy;
TNC_IMV_Action_Recommendation final_rec;
TNC_IMV_Evaluation_Result final_eval;
bool first = TRUE, incomplete = FALSE;
final_rec = TNC_IMV_ACTION_RECOMMENDATION_NO_RECOMMENDATION;
final_eval = TNC_IMV_EVALUATION_RESULT_DONT_KNOW;
if (rec && eval)
{
*rec = final_rec;
*eval = final_eval;
}
if (this->recs->get_count(this->recs) == 0)
{
DBG1(DBG_TNC, "there are no IMVs to make a recommendation");
return TRUE;
}
policy = tnc->imvs->get_recommendation_policy(tnc->imvs);
enumerator = this->recs->create_enumerator(this->recs);
while (enumerator->enumerate(enumerator, &entry))
{
if (!entry->have_recommendation)
{
incomplete = TRUE;
break;
}
if (first)
{
final_rec = entry->rec;
final_eval = entry->eval;
first = FALSE;
continue;
}
switch (policy)
{
case RECOMMENDATION_POLICY_DEFAULT:
final_rec = tncif_policy_update_recommendation(final_rec,
entry->rec);
final_eval = tncif_policy_update_evaluation(final_eval,
entry->eval);
break;
case RECOMMENDATION_POLICY_ALL:
if (entry->rec != final_rec)
{
final_rec = TNC_IMV_ACTION_RECOMMENDATION_NO_RECOMMENDATION;
}
if (entry->eval != final_eval)
{
final_eval = TNC_IMV_EVALUATION_RESULT_DONT_KNOW;
}
break;
case RECOMMENDATION_POLICY_ANY:
switch (entry->rec)
{
case TNC_IMV_ACTION_RECOMMENDATION_ALLOW:
final_rec = entry->rec;
break;
case TNC_IMV_ACTION_RECOMMENDATION_ISOLATE:
if (final_rec != TNC_IMV_ACTION_RECOMMENDATION_ALLOW)
{
final_rec = entry->rec;
};
break;
case TNC_IMV_ACTION_RECOMMENDATION_NO_ACCESS:
if (final_rec == TNC_IMV_ACTION_RECOMMENDATION_NO_RECOMMENDATION)
{
final_rec = entry->rec;
};
break;
case TNC_IMV_ACTION_RECOMMENDATION_NO_RECOMMENDATION:
break;
}
switch (entry->eval)
{
case TNC_IMV_EVALUATION_RESULT_COMPLIANT:
final_eval = entry->eval;
break;
case TNC_IMV_EVALUATION_RESULT_NONCOMPLIANT_MINOR:
if (final_eval != TNC_IMV_EVALUATION_RESULT_COMPLIANT)
{
final_eval = entry->eval;
}
break;
case TNC_IMV_EVALUATION_RESULT_NONCOMPLIANT_MAJOR:
if (final_eval != TNC_IMV_EVALUATION_RESULT_COMPLIANT &&
final_eval != TNC_IMV_EVALUATION_RESULT_NONCOMPLIANT_MINOR)
{
final_eval = entry->eval;
}
break;
case TNC_IMV_EVALUATION_RESULT_ERROR:
if (final_eval == TNC_IMV_EVALUATION_RESULT_DONT_KNOW)
{
final_eval = entry->eval;
}
break;
case TNC_IMV_EVALUATION_RESULT_DONT_KNOW:
break;
}
}
}
enumerator->destroy(enumerator);
if (incomplete)
{
return FALSE;
}
if (rec && eval)
{
*rec = final_rec;
*eval = final_eval;
}
return TRUE;
}
METHOD(recommendations_t, clear_recommendation, void,
private_tnc_imv_recommendations_t *this)
{
enumerator_t *enumerator;
recommendation_entry_t *entry;
enumerator = this->recs->create_enumerator(this->recs);
while (enumerator->enumerate(enumerator, &entry))
{
entry->have_recommendation = FALSE;
entry->rec = TNC_IMV_ACTION_RECOMMENDATION_NO_RECOMMENDATION;
entry->eval = TNC_IMV_EVALUATION_RESULT_DONT_KNOW;
chunk_clear(&entry->reason);
chunk_clear(&entry->reason_language);
}
enumerator->destroy(enumerator);
}
METHOD(recommendations_t, get_preferred_language, chunk_t,
private_tnc_imv_recommendations_t *this)
{
return this->preferred_language;
}
METHOD(recommendations_t, set_preferred_language, void,
private_tnc_imv_recommendations_t *this, chunk_t pref_lang)
{
free(this->preferred_language.ptr);
this->preferred_language = chunk_clone(pref_lang);
}
METHOD(recommendations_t, set_reason_string, TNC_Result,
private_tnc_imv_recommendations_t *this, TNC_IMVID id, chunk_t reason)
{
enumerator_t *enumerator;
recommendation_entry_t *entry;
bool found = FALSE;
DBG2(DBG_TNC, "IMV %u is setting reason string to '%.*s'",
id, (int)reason.len, reason.ptr);
enumerator = this->recs->create_enumerator(this->recs);
while (enumerator->enumerate(enumerator, &entry))
{
if (entry->id == id)
{
found = TRUE;
free(entry->reason.ptr);
entry->reason = chunk_clone(reason);
break;
}
}
enumerator->destroy(enumerator);
return found ? TNC_RESULT_SUCCESS : TNC_RESULT_INVALID_PARAMETER;
}
METHOD(recommendations_t, set_reason_language, TNC_Result,
private_tnc_imv_recommendations_t *this, TNC_IMVID id, chunk_t reason_lang)
{
enumerator_t *enumerator;
recommendation_entry_t *entry;
bool found = FALSE;
DBG2(DBG_TNC, "IMV %u is setting reason language to '%.*s'",
id, (int)reason_lang.len, reason_lang.ptr);
enumerator = this->recs->create_enumerator(this->recs);
while (enumerator->enumerate(enumerator, &entry))
{
if (entry->id == id)
{
found = TRUE;
free(entry->reason_language.ptr);
entry->reason_language = chunk_clone(reason_lang);
break;
}
}
enumerator->destroy(enumerator);
return found ? TNC_RESULT_SUCCESS : TNC_RESULT_INVALID_PARAMETER;
}
/**
* Enumerate reason and reason_language, not recommendation entries
*/
static bool reason_filter(void *null, recommendation_entry_t **entry,
TNC_IMVID *id, void *i2, chunk_t *reason, void *i3,
chunk_t *reason_language)
{
if ((*entry)->reason.len)
{
*id = (*entry)->id;
*reason = (*entry)->reason;
*reason_language = (*entry)->reason_language;
return TRUE;
}
else
{
return FALSE;
}
}
METHOD(recommendations_t, create_reason_enumerator, enumerator_t*,
private_tnc_imv_recommendations_t *this)
{
return enumerator_create_filter(this->recs->create_enumerator(this->recs),
(void*)reason_filter, NULL, NULL);
}
METHOD(recommendations_t, destroy, void,
private_tnc_imv_recommendations_t *this)
{
recommendation_entry_t *entry;
while (this->recs->remove_last(this->recs, (void**)&entry) == SUCCESS)
{
free(entry->reason.ptr);
free(entry->reason_language.ptr);
free(entry);
}
this->recs->destroy(this->recs);
free(this->preferred_language.ptr);
free(this);
}
/**
* Described in header.
*/
recommendations_t* tnc_imv_recommendations_create(linked_list_t *imv_list)
{
private_tnc_imv_recommendations_t *this;
recommendation_entry_t *entry;
enumerator_t *enumerator;
imv_t *imv;
INIT(this,
.public = {
.provide_recommendation = _provide_recommendation,
.have_recommendation = _have_recommendation,
.clear_recommendation = _clear_recommendation,
.get_preferred_language = _get_preferred_language,
.set_preferred_language = _set_preferred_language,
.set_reason_string = _set_reason_string,
.set_reason_language = _set_reason_language,
.create_reason_enumerator = _create_reason_enumerator,
.destroy = _destroy,
},
.recs = linked_list_create(),
);
enumerator = imv_list->create_enumerator(imv_list);
while (enumerator->enumerate(enumerator, &imv))
{
entry = malloc_thing(recommendation_entry_t);
entry->id = imv->get_id(imv);
entry->have_recommendation = FALSE;
entry->rec = TNC_IMV_ACTION_RECOMMENDATION_NO_RECOMMENDATION;
entry->eval = TNC_IMV_EVALUATION_RESULT_DONT_KNOW;
entry->reason = chunk_empty;
entry->reason_language = chunk_empty;
this->recs->insert_last(this->recs, entry);
}
enumerator->destroy(enumerator);
return &this->public;
}
src/libcharon/plugins/tnc_imv/tnc_imv_recommendations.h
-33
View File
@@ -1,33 +0,0 @@
/*
* Copyright (C) 2010 Andreas Steffen
* HSR Hochschule fuer Technik Rapperswil
*
* This program is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License as published by the
* Free Software Foundation; either version 2 of the License, or (at your
* option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
*
* This program is distributed in the hope that it will be useful, but
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* for more details.
*/
/**
*
* @defgroup tnc_imv_manager tnc_imv_manager
* @{ @ingroup tnc_imv
*/
#ifndef TNC_IMV_RECOMMENDATIONS_H_
#define TNC_IMV_RECOMMENDATIONS_H_
#include <tnc/imv/imv_recommendations.h>
#include <collections/linked_list.h>
/**
* Create an IMV empty recommendations instance
*/
recommendations_t *tnc_imv_recommendations_create();
#endif /** TNC_IMV_RECOMMENDATIONS_H_ @}*/
src/libcharon/plugins/tnc_pdp/tnc_pdp.c
+18 -1
View File
@@ -26,6 +26,9 @@
#include <tnc/tnc.h>
#include <tncifimv.h>
#include <tncif_names.h>
#include <daemon.h>
#include <utils/debug.h>
#include <pen/pen.h>
@@ -562,6 +565,19 @@ end:
}
}
/**
* Callback function to get recommendation from TNCCS connection
*/
static bool get_recommendation(TNC_IMV_Action_Recommendation rec,
TNC_IMV_Evaluation_Result eval)
{
DBG1(DBG_TNC, "final recommendation is '%N' and evaluation is '%N'",
TNC_IMV_Action_Recommendation_names, rec,
TNC_IMV_Evaluation_Result_names, eval);
return TRUE;
}
/**
* Get more data on a PT-TLS connection
*/
@@ -607,7 +623,8 @@ static bool pt_tls_receive(private_tnc_pdp_t *this, int fd, watcher_event_t even
peer = identification_create_from_encoding(ID_ANY, chunk_empty),
tnccs = tnc->tnccs->create_instance(tnc->tnccs, TNCCS_2_0, TRUE,
this->server, peer, TNC_IFT_TLS_2_0);
this->server, peer, TNC_IFT_TLS_2_0,
(tnccs_cb_t)get_recommendation);
peer->destroy(peer);
if (!tnccs)