check if TNC client has a valid and registered AIK

src/libpts/plugins/imv_attestation/imv_attestation.c

@@ -354,6 +354,14 @@ static TNC_Result receive_message(TNC_IMVID imv_id,
 
 	/* check the IMV state for the next PA-TNC attributes to send */
 	result = send_message(connection_id);
+	if (result != TNC_RESULT_SUCCESS)
+	{
+		state->set_recommendation(state,
+								TNC_IMV_ACTION_RECOMMENDATION_NO_RECOMMENDATION,
+								TNC_IMV_EVALUATION_RESULT_ERROR);
+		return imv_attestation->provide_recommendation(imv_attestation,
+													   connection_id);
+	}
 
 	if (attestation_state->get_handshake_state(attestation_state) ==
 		IMV_ATTESTATION_STATE_END)

src/libpts/plugins/imv_attestation/imv_attestation_build.c

@@ -207,7 +207,7 @@ bool imv_attestation_build(linked_list_t *attr_list,
 			pts_component_t *comp;
 			pts_comp_func_name_t *comp_name;
 			chunk_t keyid;
-			int vid, name, qualifier;
+			int kid, vid, name, qualifier;
 			u_int8_t flags;
 			u_int32_t depth;
 			bool first = TRUE, first_component = TRUE;
@@ -224,15 +224,19 @@ bool imv_attestation_build(linked_list_t *attr_list,
 			}
 			if (!pts->get_aik_keyid(pts, &keyid))
 			{
-				break;
+				DBG1(DBG_IMV, "retrieval of AIK keyid failed");
+				return FALSE;
 			}
 			if (!pts_db)
 			{
-				DBG1(DBG_PTS, "pts database not available");
+				DBG1(DBG_IMV, "pts database not available");
 				break;
 			}
-			
-			enumerator = pts_db->create_comp_evid_enumerator(pts_db, keyid);
+			if (pts_db->check_aik_keyid(pts_db, keyid, &kid) != SUCCESS)
+			{
+				return FALSE;
+			}
+			enumerator = pts_db->create_comp_evid_enumerator(pts_db, kid);
 			if (!enumerator)
 			{
 				break;

src/libpts/plugins/imv_attestation/imv_attestation_process.c

@@ -178,6 +178,10 @@ bool imv_attestation_process(pa_tnc_attr_t *attr, linked_list_t *attr_list,
 				e->destroy(e);
 				DBG1(DBG_IMV, "AIK certificate is %strusted",
 							   trusted ? "" : "not ");
+				if (!trusted)
+				{
+					return FALSE;
+				}
 			}
 			pts->set_aik(pts, aik);
 			break;