rapid PT-TLS AR/PDP prototype

src/libpttls/pt_tls.h

@@ -37,6 +37,11 @@
  */
 #define PT_TLS_HEADER_LEN 16
 
+/**
+ * Default PT-TLS port
+ */
+#define PT_TLS_PORT	 271
+
 typedef enum pt_tls_message_type_t pt_tls_message_type_t;
 typedef enum pt_tls_sasl_result_t pt_tls_sasl_result_t;
 typedef enum pt_tls_auth_t pt_tls_auth_t;

src/libpttls/pt_tls_client.c

@@ -437,19 +437,26 @@ METHOD(pt_tls_client_t, run_assessment, status_t,
 {
 	if (!this->tls)
 	{
+		DBG1(DBG_TNC, "entering PT-TLS setup phase");
 		if (!make_connection(this))
 		{
 			return FAILED;
 		}
 	}
+
+	DBG1(DBG_TNC, "entering PT-TLS negotiation phase");
 	if (!negotiate_version(this))
 	{
 		return FAILED;
 	}
+
+	DBG1(DBG_TNC, "doing SASL client authentication");
 	if (!authenticate(this))
 	{
 		return FAILED;
 	}
+
+	DBG1(DBG_TNC, "entering PT-TLS data transport phase");
 	if (!assess(this, (tls_t*)tnccs))
 	{
 		return FAILED;

src/libpttls/pt_tls_dispatcher.c

@@ -185,7 +185,7 @@ pt_tls_dispatcher_t *pt_tls_dispatcher_create(host_t *address,
 			.dispatch = _dispatch,
 			.destroy = _destroy,
 		},
-		.server = id,
+		.server = id->clone(id),
 		/* we currently don't authenticate the peer, use %any identity */
 		.peer = identification_create_from_encoding(ID_ANY, chunk_empty),
 		.fd = -1,
@@ -194,11 +194,9 @@ pt_tls_dispatcher_t *pt_tls_dispatcher_create(host_t *address,
 
 	if (!open_socket(this, address))
 	{
-		address->destroy(address);
 		destroy(this);
 		return NULL;
 	}
-	address->destroy(address);
 
 	return &this->public;
 }

src/libpttls/pt_tls_server.c

@@ -478,7 +478,7 @@ METHOD(pt_tls_server_t, handle, status_t,
 			}
 			DBG1(DBG_TNC, "negotiated PT-TLS version %d", PT_TLS_VERSION);
 			this->state = PT_TLS_SERVER_AUTH;
-			break;
+			/* fall through to next state */
 		case PT_TLS_SERVER_AUTH:
 			if (!authenticate(this))
 			{