denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Process PB-TNC batches received via PT-TLS asynchronously

Browse Source
This commit is contained in:
Andreas Steffen
2013-08-19 09:52:12 +02:00
parent 9dc3b2053d
commit 1e92d5f114
2 changed files with 61 additions and 68 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libcharon/plugins/tnc_pdp/tnc_pdp.c
+1 -4
View File
@@ -587,8 +587,7 @@ static bool pt_tls_receive_more(pt_tls_server_t *this, int fd,
switch (this->handle(this)) switch (this->handle(this))
{ {
case NEED_MORE: case NEED_MORE:
DBG1(DBG_TNC, "PT-TLS connection needs more"); return TRUE;
break;
case FAILED: case FAILED:
case SUCCESS: case SUCCESS:
default: default:
@@ -597,8 +596,6 @@ static bool pt_tls_receive_more(pt_tls_server_t *this, int fd,
close(fd); close(fd);
return FALSE; return FALSE;
} }
return TRUE;
} }
/** /**
src/libpttls/pt_tls_server.c
+60 -64
View File
@@ -400,75 +400,66 @@ static bool authenticate(private_pt_tls_server_t *this)
/** /**
* Perform assessment * Perform assessment
*/ */
static bool assess(private_pt_tls_server_t *this, tls_t *tnccs) static status_t assess(private_pt_tls_server_t *this, tls_t *tnccs)
{ {
while (TRUE) size_t msglen;
{ size_t buflen = PT_TLS_MAX_MESSAGE_LEN;
size_t msglen; char buf[buflen];
size_t buflen = PT_TLS_MAX_MESSAGE_LEN; bio_reader_t *reader;
char buf[buflen]; u_int32_t vendor, type, identifier;
bio_reader_t *reader; chunk_t data;
u_int32_t vendor, type, identifier; status_t status;
chunk_t data;
switch (tnccs->build(tnccs, buf, &buflen, &msglen)) reader = pt_tls_read(this->tls, &vendor, &type, &identifier);
if (!reader)
{
return FAILED;
}
if (vendor == 0)
{
if (type == PT_TLS_ERROR)
{
DBG1(DBG_TNC, "received PT-TLS error");
reader->destroy(reader);
return FAILED;
}
if (type != PT_TLS_PB_TNC_BATCH)
{
DBG1(DBG_TNC, "unexpected PT-TLS message: %d", type);
reader->destroy(reader);
return FAILED;
}
data = reader->peek(reader);
switch (tnccs->process(tnccs, data.ptr, data.len))
{ {
case SUCCESS: case SUCCESS:
return tnccs->is_complete(tnccs); reader->destroy(reader);
case ALREADY_DONE: return tnccs->is_complete(tnccs) ? SUCCESS : FAILED;
data = chunk_create(buf, buflen);
if (!pt_tls_write(this->tls, PT_TLS_PB_TNC_BATCH,
this->identifier++, data))
{
return FALSE;
}
break;
case INVALID_STATE:
break;
case FAILED: case FAILED:
default: default:
return FALSE;
}
reader = pt_tls_read(this->tls, &vendor, &type, &identifier);
if (!reader)
{
return FALSE;
}
if (vendor == 0)
{
if (type == PT_TLS_ERROR)
{
DBG1(DBG_TNC, "received PT-TLS error");
reader->destroy(reader); reader->destroy(reader);
return FALSE; return FALSE;
} case NEED_MORE:
if (type != PT_TLS_PB_TNC_BATCH) break;
{
DBG1(DBG_TNC, "unexpected PT-TLS message: %d", type);
reader->destroy(reader);
return FALSE;
}
data = reader->peek(reader);
switch (tnccs->process(tnccs, data.ptr, data.len))
{
case SUCCESS:
reader->destroy(reader);
return tnccs->is_complete(tnccs);
case FAILED:
default:
reader->destroy(reader);
return FALSE;
case NEED_MORE:
break;
}
} }
else
{
DBG1(DBG_TNC, "ignoring vendor specific PT-TLS message");
}
reader->destroy(reader);
} }
else
{
DBG1(DBG_TNC, "ignoring vendor specific PT-TLS message");
}
reader->destroy(reader);
status = tnccs->build(tnccs, buf, &buflen, &msglen);
if (status == ALREADY_DONE)
{
data = chunk_create(buf, buflen);
if (!pt_tls_write(this->tls, PT_TLS_PB_TNC_BATCH,
this->identifier++, data))
{
return FAILED;
}
}
return status;
} }
METHOD(pt_tls_server_t, handle, status_t, METHOD(pt_tls_server_t, handle, status_t,
@@ -492,15 +483,20 @@ METHOD(pt_tls_server_t, handle, status_t,
return FAILED; return FAILED;
} }
this->state = PT_TLS_SERVER_TNCCS; this->state = PT_TLS_SERVER_TNCCS;
DBG1(DBG_TNC, "entering PT-TLS data transport phase");
break; break;
case PT_TLS_SERVER_TNCCS: case PT_TLS_SERVER_TNCCS:
DBG1(DBG_TNC, "entering PT-TLS data transport phase"); switch (assess(this, (tls_t*)this->tnccs))
if (!assess(this, (tls_t*)this->tnccs))
{ {
return FAILED; case SUCCESS:
this->state = PT_TLS_SERVER_END;
return SUCCESS;
case FAILED:
return FAILED;
default:
break;
} }
this->state = PT_TLS_SERVER_END; break;
return SUCCESS;
default: default:
return FAILED; return FAILED;
} }