denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

reformulated recommendation policies

Browse Source
This commit is contained in:
Andreas Steffen
2010-11-16 11:00:40 +01:00
parent e66420566c
commit 2fe06d33c3
1 changed files with 97 additions and 67 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libcharon/plugins/tnc_imv/tnc_imv_recommendations.c
+97 -67
View File
@@ -31,6 +31,11 @@ struct recommendation_entry_t {
*/ */
TNC_IMVID id; TNC_IMVID id;
/**
* Received a recommendation message from this IMV?
*/
bool have_recommendation;
/** /**
* Action Recommendation provided by IMV instance * Action Recommendation provided by IMV instance
*/ */
@@ -76,6 +81,7 @@ METHOD(recommendations_t, provide_recommendation, TNC_Result,
if (entry->id == id) if (entry->id == id)
{ {
found = TRUE; found = TRUE;
entry->have_recommendation = TRUE;
entry->rec = rec; entry->rec = rec;
entry->eval = eval; entry->eval = eval;
break; break;
@@ -109,8 +115,7 @@ METHOD(recommendations_t, have_recommendation, bool,
enumerator = this->recs->create_enumerator(this->recs); enumerator = this->recs->create_enumerator(this->recs);
while (enumerator->enumerate(enumerator, &entry)) while (enumerator->enumerate(enumerator, &entry))
{ {
if (entry->rec == TNC_IMV_ACTION_RECOMMENDATION_NO_RECOMMENDATION || if (!entry->have_recommendation)
entry->eval == TNC_IMV_EVALUATION_RESULT_DONT_KNOW)
{ {
incomplete = TRUE; incomplete = TRUE;
break; break;
@@ -120,94 +125,118 @@ METHOD(recommendations_t, have_recommendation, bool,
final_rec = entry->rec; final_rec = entry->rec;
final_eval = entry->eval; final_eval = entry->eval;
first = FALSE; first = FALSE;
continue;
} }
switch (policy) switch (policy)
{ {
case RECOMMENDATION_POLICY_DEFAULT: case RECOMMENDATION_POLICY_DEFAULT:
/* Consolidate action recommendations */ switch (entry->rec)
if (entry->rec == TNC_IMV_ACTION_RECOMMENDATION_NO_ACCESS)
{ {
final_rec = TNC_IMV_ACTION_RECOMMENDATION_NO_ACCESS; case TNC_IMV_ACTION_RECOMMENDATION_NO_ACCESS:
final_rec = entry->rec;
break;
case TNC_IMV_ACTION_RECOMMENDATION_ISOLATE:
if (final_rec != TNC_IMV_ACTION_RECOMMENDATION_NO_ACCESS)
{
final_rec = entry->rec;
};
break;
case TNC_IMV_ACTION_RECOMMENDATION_ALLOW:
if (final_rec == TNC_IMV_ACTION_RECOMMENDATION_NO_RECOMMENDATION)
{
final_rec = entry->rec;
};
break;
case TNC_IMV_ACTION_RECOMMENDATION_NO_RECOMMENDATION:
break;
} }
else if (entry->rec == TNC_IMV_ACTION_RECOMMENDATION_ISOLATE && switch (entry->eval)
final_rec != TNC_IMV_ACTION_RECOMMENDATION_NO_ACCESS)
{ {
final_rec = TNC_IMV_ACTION_RECOMMENDATION_ISOLATE; case TNC_IMV_EVALUATION_RESULT_ERROR:
} final_eval = entry->eval;
else break;
{ case TNC_IMV_EVALUATION_RESULT_NONCOMPLIANT_MAJOR:
final_rec = TNC_IMV_ACTION_RECOMMENDATION_ALLOW; if (final_eval != TNC_IMV_EVALUATION_RESULT_ERROR)
} {
final_eval = entry->eval;
/* Consolidate evaluation results */ }
if (entry->eval == TNC_IMV_EVALUATION_RESULT_ERROR) break;
{ case TNC_IMV_EVALUATION_RESULT_NONCOMPLIANT_MINOR:
final_eval = TNC_IMV_EVALUATION_RESULT_ERROR; if (final_eval != TNC_IMV_EVALUATION_RESULT_ERROR &&
} final_eval != TNC_IMV_EVALUATION_RESULT_NONCOMPLIANT_MAJOR)
else if (entry->eval == TNC_IMV_EVALUATION_RESULT_NONCOMPLIANT_MAJOR && {
final_eval != TNC_IMV_EVALUATION_RESULT_ERROR) final_eval = entry->eval;
{ }
final_eval = TNC_IMV_EVALUATION_RESULT_NONCOMPLIANT_MAJOR; break;
} case TNC_IMV_EVALUATION_RESULT_COMPLIANT:
else if (entry->eval == TNC_IMV_EVALUATION_RESULT_NONCOMPLIANT_MINOR && if (final_eval == TNC_IMV_EVALUATION_RESULT_DONT_KNOW)
final_eval != TNC_IMV_EVALUATION_RESULT_ERROR && {
final_eval != TNC_IMV_EVALUATION_RESULT_NONCOMPLIANT_MAJOR) final_eval = entry->eval;
{ }
final_eval = TNC_IMV_EVALUATION_RESULT_NONCOMPLIANT_MINOR; break;
} case TNC_IMV_EVALUATION_RESULT_DONT_KNOW:
else if (entry->eval == TNC_IMV_EVALUATION_RESULT_COMPLIANT) break;
{
final_eval = TNC_IMV_EVALUATION_RESULT_COMPLIANT;
} }
break; break;
case RECOMMENDATION_POLICY_ALL: case RECOMMENDATION_POLICY_ALL:
/* Consolidate action recommendations */
if (entry->rec != final_rec) if (entry->rec != final_rec)
{ {
final_rec = TNC_IMV_ACTION_RECOMMENDATION_NO_RECOMMENDATION; final_rec = TNC_IMV_ACTION_RECOMMENDATION_NO_RECOMMENDATION;
} }
/* Consolidate evaluation results */
if (entry->eval != final_eval) if (entry->eval != final_eval)
{ {
final_eval = TNC_IMV_EVALUATION_RESULT_DONT_KNOW; final_eval = TNC_IMV_EVALUATION_RESULT_DONT_KNOW;
} }
break; break;
case RECOMMENDATION_POLICY_ANY:
/* Consolidate action recommendations */
if (entry->rec == TNC_IMV_ACTION_RECOMMENDATION_ALLOW)
{
final_rec = TNC_IMV_ACTION_RECOMMENDATION_ALLOW;
}
else if (entry->rec == TNC_IMV_ACTION_RECOMMENDATION_ISOLATE &&
final_rec != TNC_IMV_ACTION_RECOMMENDATION_ALLOW)
{
final_rec = TNC_IMV_ACTION_RECOMMENDATION_ISOLATE;
}
else
{
final_rec = TNC_IMV_ACTION_RECOMMENDATION_NO_ACCESS;
}
/* Consolidate evaluation results */ case RECOMMENDATION_POLICY_ANY:
if (entry->eval == TNC_IMV_EVALUATION_RESULT_COMPLIANT) switch (entry->rec)
{ {
final_eval = TNC_IMV_EVALUATION_RESULT_COMPLIANT; case TNC_IMV_ACTION_RECOMMENDATION_ALLOW:
final_rec = entry->rec;
break;
case TNC_IMV_ACTION_RECOMMENDATION_ISOLATE:
if (final_rec != TNC_IMV_ACTION_RECOMMENDATION_ALLOW)
{
final_rec = entry->rec;
};
break;
case TNC_IMV_ACTION_RECOMMENDATION_NO_ACCESS:
if (final_rec == TNC_IMV_ACTION_RECOMMENDATION_NO_RECOMMENDATION)
{
final_rec = entry->rec;
};
break;
case TNC_IMV_ACTION_RECOMMENDATION_NO_RECOMMENDATION:
break;
} }
else if (entry->eval == TNC_IMV_EVALUATION_RESULT_NONCOMPLIANT_MINOR && switch (entry->eval)
final_eval != TNC_IMV_EVALUATION_RESULT_COMPLIANT)
{ {
final_eval = TNC_IMV_EVALUATION_RESULT_NONCOMPLIANT_MINOR; case TNC_IMV_EVALUATION_RESULT_COMPLIANT:
} final_eval = entry->eval;
else if (entry->eval == TNC_IMV_EVALUATION_RESULT_NONCOMPLIANT_MAJOR && break;
final_eval != TNC_IMV_EVALUATION_RESULT_COMPLIANT && case TNC_IMV_EVALUATION_RESULT_NONCOMPLIANT_MINOR:
final_eval != TNC_IMV_EVALUATION_RESULT_NONCOMPLIANT_MINOR) if (final_eval != TNC_IMV_EVALUATION_RESULT_COMPLIANT)
{ {
final_eval = TNC_IMV_EVALUATION_RESULT_NONCOMPLIANT_MAJOR; final_eval = entry->eval;
} }
else if (entry->eval == TNC_IMV_EVALUATION_RESULT_ERROR) break;
{ case TNC_IMV_EVALUATION_RESULT_NONCOMPLIANT_MAJOR:
final_eval = TNC_IMV_EVALUATION_RESULT_ERROR; if (final_eval != TNC_IMV_EVALUATION_RESULT_COMPLIANT &&
final_eval != TNC_IMV_EVALUATION_RESULT_NONCOMPLIANT_MINOR)
{
final_eval = entry->eval;
}
break;
case TNC_IMV_EVALUATION_RESULT_ERROR:
if (final_eval == TNC_IMV_EVALUATION_RESULT_DONT_KNOW)
{
final_eval = entry->eval;
}
break;
case TNC_IMV_EVALUATION_RESULT_DONT_KNOW:
break;
} }
} }
} }
@@ -254,6 +283,7 @@ recommendations_t* tnc_imv_recommendations_create(linked_list_t *imv_list)
{ {
entry = malloc_thing(recommendation_entry_t); entry = malloc_thing(recommendation_entry_t);
entry->id = imv->get_id(imv); entry->id = imv->get_id(imv);
entry->have_recommendation = FALSE;
entry->rec = TNC_IMV_ACTION_RECOMMENDATION_NO_RECOMMENDATION; entry->rec = TNC_IMV_ACTION_RECOMMENDATION_NO_RECOMMENDATION;
entry->eval = TNC_IMV_EVALUATION_RESULT_DONT_KNOW; entry->eval = TNC_IMV_EVALUATION_RESULT_DONT_KNOW;
this->recs->insert_last(this->recs, entry); this->recs->insert_last(this->recs, entry);