denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

introduced sending of standard IETF Assessment Result PA-TNC attribute by IMVs

Browse Source
This commit is contained in:
Andreas Steffen
2012-09-09 05:13:50 +02:00
parent bcf8cdd556
commit 6f93927b6c
21 changed files with 639 additions and 84 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libimcv/plugins/imc_scanner/imc_scanner.c
+40 -3
View File
@@ -20,8 +20,8 @@
#include <ietf/ietf_attr.h>
#include <ietf/ietf_attr_pa_tnc_error.h>
#include <ietf/ietf_attr_port_filter.h>
#include <ietf/ietf_attr_assess_result.h>
#include <tncif_names.h>
#include <tncif_pa_subtypes.h>
#include <pen/pen.h>
@@ -85,6 +85,15 @@ TNC_Result TNC_IMC_NotifyConnectionChange(TNC_IMCID imc_id,
case TNC_CONNECTION_STATE_CREATE:
state = imc_scanner_state_create(connection_id);
return imc_scanner->create_state(imc_scanner, state);
case TNC_CONNECTION_STATE_HANDSHAKE:
if (imc_scanner->change_state(imc_scanner, connection_id, new_state,
&state) != TNC_RESULT_SUCCESS)
{
return TNC_RESULT_FATAL;
}
state->set_result(state, imc_id,
TNC_IMV_EVALUATION_RESULT_DONT_KNOW);
return TNC_RESULT_SUCCESS;
case TNC_CONNECTION_STATE_DELETE:
return imc_scanner->delete_state(imc_scanner, connection_id);
default:
@@ -268,7 +277,10 @@ static TNC_Result receive_message(TNC_IMCID imc_id,
TNC_UInt32 dst_imc_id)
{
pa_tnc_msg_t *pa_tnc_msg;
pa_tnc_attr_t *attr;
pen_type_t attr_type;
imc_state_t *state;
enumerator_t *enumerator;
TNC_Result result;
bool fatal_error;
@@ -296,14 +308,39 @@ static TNC_Result receive_message(TNC_IMCID imc_id,
/* preprocess any IETF standard error attributes */
fatal_error = pa_tnc_msg->process_ietf_std_errors(pa_tnc_msg);
/* analyze PA-TNC attributes */
enumerator = pa_tnc_msg->create_attribute_enumerator(pa_tnc_msg);
while (enumerator->enumerate(enumerator, &attr))
{
attr_type = attr->get_type(attr);
if (attr_type.vendor_id == PEN_IETF &&
attr_type.type == IETF_ATTR_ASSESSMENT_RESULT)
{
ietf_attr_assess_result_t *ietf_attr;
ietf_attr = (ietf_attr_assess_result_t*)attr;
state->set_result(state, dst_imc_id,
ietf_attr->get_result(ietf_attr));
}
}
enumerator->destroy(enumerator);
pa_tnc_msg->destroy(pa_tnc_msg);
/* if no error occurred then always return the same response */
return fatal_error ? TNC_RESULT_FATAL : send_message(connection_id);
if (fatal_error)
{
return TNC_RESULT_FATAL;
}
/* if no assessment result is known then repeat the measurement */
return state->get_result(state, dst_imc_id, NULL) ?
TNC_RESULT_SUCCESS : send_message(connection_id);
}
/**
* see section 3.8.4 of TCG TNC IF-IMC Specification 1.3
*/
TNC_Result TNC_IMC_ReceiveMessage(TNC_IMCID imc_id,
TNC_ConnectionID connection_id,
src/libimcv/plugins/imc_scanner/imc_scanner_state.c
+30
View File
@@ -15,6 +15,8 @@
#include "imc_scanner_state.h"
#include <tncif_names.h>
#include <debug.h>
typedef struct private_imc_scanner_state_t private_imc_scanner_state_t;
@@ -39,6 +41,11 @@ struct private_imc_scanner_state_t {
*/
TNC_ConnectionState state;
/**
* Assessment/Evaluation Result
*/
TNC_IMV_Evaluation_Result result;
/**
* Does the TNCCS connection support long message types?
*/
@@ -98,6 +105,26 @@ METHOD(imc_state_t, change_state, void,
this->state = new_state;
}
METHOD(imc_state_t, set_result, void,
private_imc_scanner_state_t *this, TNC_IMCID id,
TNC_IMV_Evaluation_Result result)
{
DBG1(DBG_IMC, "set assessment result for IMC %u to '%N'",
id, TNC_IMV_Evaluation_Result_names, result);
this->result = result;
}
METHOD(imc_state_t, get_result, bool,
private_imc_scanner_state_t *this, TNC_IMCID id,
TNC_IMV_Evaluation_Result *result)
{
if (result)
{
*result = this->result;
}
return this->result != TNC_IMV_EVALUATION_RESULT_DONT_KNOW;
}
METHOD(imc_state_t, destroy, void,
private_imc_scanner_state_t *this)
{
@@ -121,10 +148,13 @@ imc_state_t *imc_scanner_state_create(TNC_ConnectionID connection_id)
.set_max_msg_len = _set_max_msg_len,
.get_max_msg_len = _get_max_msg_len,
.change_state = _change_state,
.set_result = _set_result,
.get_result = _get_result,
.destroy = _destroy,
},
},
.state = TNC_CONNECTION_STATE_CREATE,
.result = TNC_IMV_EVALUATION_RESULT_DONT_KNOW,
.connection_id = connection_id,
);
src/libimcv/plugins/imc_test/imc_test.c
+53 -18
View File
@@ -19,11 +19,11 @@
#include <pa_tnc/pa_tnc_msg.h>
#include <ietf/ietf_attr.h>
#include <ietf/ietf_attr_pa_tnc_error.h>
#include <ietf/ietf_attr_assess_result.h>
#include <ita/ita_attr.h>
#include <ita/ita_attr_command.h>
#include <ita/ita_attr_dummy.h>
#include <tncif_names.h>
#include <tncif_pa_subtypes.h>
#include <pen/pen.h>
@@ -75,8 +75,11 @@ TNC_Result TNC_IMC_NotifyConnectionChange(TNC_IMCID imc_id,
imc_state_t *state;
imc_test_state_t *test_state;
TNC_Result result;
TNC_UInt32 additional_id;
char *command;
bool retry;
void *pointer;
enumerator_t *enumerator;
int dummy_size, additional_ids;
if (!imc_test)
@@ -129,6 +132,26 @@ TNC_Result TNC_IMC_NotifyConnectionChange(TNC_IMCID imc_id,
test_state->get_command(test_state));
test_state->set_command(test_state, command);
}
state->set_result(state, imc_id, TNC_IMV_EVALUATION_RESULT_DONT_KNOW);
/* Exit if there are no additional IMC IDs */
if (!imc_test->count_additional_ids(imc_test))
{
return result;
}
enumerator = imc_test->create_id_enumerator(imc_test);
while (enumerator->enumerate(enumerator, &pointer))
{
/* interpret pointer as scalar value */
additional_id = (TNC_UInt32)pointer;
state->set_result(state, additional_id,
TNC_IMV_EVALUATION_RESULT_DONT_KNOW);
}
enumerator->destroy(enumerator);
return TNC_RESULT_SUCCESS;
case TNC_CONNECTION_STATE_DELETE:
@@ -294,33 +317,45 @@ static TNC_Result receive_message(TNC_IMCID imc_id,
{
attr_type = attr->get_type(attr);
if (attr_type.vendor_id != PEN_ITA)
if (attr_type.vendor_id == PEN_IETF)
{
continue;
}
if (attr_type.type == ITA_ATTR_COMMAND)
{
ita_attr_command_t *ita_attr;
ietf_attr_assess_result_t *ietf_attr;
ita_attr = (ita_attr_command_t*)attr;
DBG1(DBG_IMC, "received command '%s'",
ita_attr->get_command(ita_attr));
ietf_attr = (ietf_attr_assess_result_t*)attr;
state->set_result(state, dst_imc_id,
ietf_attr->get_result(ietf_attr));
}
else if (attr_type.type == ITA_ATTR_DUMMY)
else if (attr_type.vendor_id == PEN_ITA)
{
ita_attr_dummy_t *ita_attr;
if (attr_type.type == ITA_ATTR_COMMAND)
{
ita_attr_command_t *ita_attr;
ita_attr = (ita_attr_dummy_t*)attr;
DBG1(DBG_IMC, "received dummy attribute value (%d bytes)",
ita_attr->get_size(ita_attr));
ita_attr = (ita_attr_command_t*)attr;
DBG1(DBG_IMC, "received command '%s'",
ita_attr->get_command(ita_attr));
}
else if (attr_type.type == ITA_ATTR_DUMMY)
{
ita_attr_dummy_t *ita_attr;
ita_attr = (ita_attr_dummy_t*)attr;
DBG1(DBG_IMC, "received dummy attribute value (%d bytes)",
ita_attr->get_size(ita_attr));
}
}
}
enumerator->destroy(enumerator);
pa_tnc_msg->destroy(pa_tnc_msg);
/* if no error occurred then always return the same response */
return fatal_error ? TNC_RESULT_FATAL :
send_message(state, dst_imc_id, src_imv_id);
if (fatal_error)
{
return TNC_RESULT_FATAL;
}
/* if no assessment result is known then repeat the measurement */
return state->get_result(state, dst_imc_id, NULL) ?
TNC_RESULT_SUCCESS : send_message(state, dst_imc_id, src_imv_id);
}
/**
src/libimcv/plugins/imc_test/imc_test_state.c
+78
View File
@@ -15,10 +15,13 @@
#include "imc_test_state.h"
#include <tncif_names.h>
#include <debug.h>
#include <utils/linked_list.h>
typedef struct private_imc_test_state_t private_imc_test_state_t;
typedef struct entry_t entry_t;
/**
* Private data of an imc_test_state_t object.
@@ -40,6 +43,11 @@ struct private_imc_test_state_t {
*/
TNC_ConnectionState state;
/**
* Assessment/Evaluation Results for all IMC IDs
*/
linked_list_t *results;
/**
* Does the TNCCS connection support long message types?
*/
@@ -77,6 +85,14 @@ struct private_imc_test_state_t {
};
/**
* Stores the Assessment/Evaluation Result for a given IMC ID
*/
struct entry_t {
TNC_IMCID id;
TNC_IMV_Evaluation_Result result;
};
METHOD(imc_state_t, get_connection_id, TNC_ConnectionID,
private_imc_test_state_t *this)
{
@@ -120,9 +136,68 @@ METHOD(imc_state_t, change_state, void,
this->state = new_state;
}
METHOD(imc_state_t, set_result, void,
private_imc_test_state_t *this, TNC_IMCID id,
TNC_IMV_Evaluation_Result result)
{
enumerator_t *enumerator;
entry_t *entry;
bool found = FALSE;
DBG1(DBG_IMC, "set assessment result for IMC %u to '%N'",
id, TNC_IMV_Evaluation_Result_names, result);
enumerator = this->results->create_enumerator(this->results);
while (enumerator->enumerate(enumerator, &entry))
{
if (entry->id == id)
{
entry->result = result;
found = TRUE;
break;
}
}
enumerator->destroy(enumerator);
if (!found)
{
entry = malloc_thing(entry_t);
entry->id = id;
entry->result = result;
this->results->insert_last(this->results, entry);
}
}
METHOD(imc_state_t, get_result, bool,
private_imc_test_state_t *this, TNC_IMCID id,
TNC_IMV_Evaluation_Result *result)
{
enumerator_t *enumerator;
entry_t *entry;
TNC_IMV_Evaluation_Result eval = TNC_IMV_EVALUATION_RESULT_DONT_KNOW;
enumerator = this->results->create_enumerator(this->results);
while (enumerator->enumerate(enumerator, &entry))
{
if (entry->id == id)
{
eval = entry->result;
break;
}
}
enumerator->destroy(enumerator);
if (result)
{
*result = eval;
}
return eval != TNC_IMV_EVALUATION_RESULT_DONT_KNOW;
}
METHOD(imc_state_t, destroy, void,
private_imc_test_state_t *this)
{
this->results->destroy_function(this->results, free);
free(this->command);
free(this);
}
@@ -190,6 +265,8 @@ imc_state_t *imc_test_state_create(TNC_ConnectionID connection_id,
.set_max_msg_len = _set_max_msg_len,
.get_max_msg_len = _get_max_msg_len,
.change_state = _change_state,
.set_result = _set_result,
.get_result = _get_result,
.destroy = _destroy,
},
.get_command = _get_command,
@@ -199,6 +276,7 @@ imc_state_t *imc_test_state_create(TNC_ConnectionID connection_id,
.do_handshake_retry = _do_handshake_retry,
},
.state = TNC_CONNECTION_STATE_CREATE,
.results = linked_list_create(),
.connection_id = connection_id,
.command = strdup(command),
.dummy_size = dummy_size,
src/libimcv/plugins/imv_scanner/imv_scanner.c
+4 -4
View File
@@ -308,10 +308,9 @@ static TNC_Result receive_message(TNC_IMVID imv_id,
state->set_recommendation(state,
TNC_IMV_ACTION_RECOMMENDATION_NO_RECOMMENDATION,
TNC_IMV_EVALUATION_RESULT_ERROR);
return imv_scanner->provide_recommendation(imv_scanner, connection_id);
}
return imv_scanner->provide_recommendation(imv_scanner, connection_id);
return imv_scanner->provide_recommendation(imv_scanner, connection_id,
src_imc_id);
}
/**
@@ -362,7 +361,8 @@ TNC_Result TNC_IMV_SolicitRecommendation(TNC_IMVID imv_id,
DBG1(DBG_IMV, "IMV \"%s\" has not been initialized", imv_name);
return TNC_RESULT_NOT_INITIALIZED;
}
return imv_scanner->provide_recommendation(imv_scanner, connection_id);
return imv_scanner->provide_recommendation(imv_scanner, connection_id,
TNC_IMCID_ANY);
}
/**
src/libimcv/plugins/imv_test/imv_test.c
+6 -5
View File
@@ -209,7 +209,8 @@ static TNC_Result receive_message(TNC_IMVID imv_id,
state->set_recommendation(state,
TNC_IMV_ACTION_RECOMMENDATION_NO_RECOMMENDATION,
TNC_IMV_EVALUATION_RESULT_ERROR);
return imv_test->provide_recommendation(imv_test, connection_id);
return imv_test->provide_recommendation(imv_test, connection_id,
src_imc_id);
}
/* request a handshake retry ? */
@@ -233,9 +234,8 @@ static TNC_Result receive_message(TNC_IMVID imv_id,
return result;
}
return received_command ?
imv_test->provide_recommendation(imv_test, connection_id) :
TNC_RESULT_SUCCESS;
return received_command ? imv_test->provide_recommendation(imv_test,
connection_id, src_imc_id) : TNC_RESULT_SUCCESS;
}
/**
@@ -286,7 +286,8 @@ TNC_Result TNC_IMV_SolicitRecommendation(TNC_IMVID imv_id,
DBG1(DBG_IMV, "IMV \"%s\" has not been initialized", imv_name);
return TNC_RESULT_NOT_INITIALIZED;
}
return imv_test->provide_recommendation(imv_test, connection_id);
return imv_test->provide_recommendation(imv_test, connection_id,
TNC_IMCID_ANY);
}
/**