introduced sending of standard IETF Assessment Result PA-TNC attribute by IMVs

src/libimcv/plugins/imc_scanner/imc_scanner.c

@@ -20,8 +20,8 @@
 #include <ietf/ietf_attr.h>
 #include <ietf/ietf_attr_pa_tnc_error.h>
 #include <ietf/ietf_attr_port_filter.h>
+#include <ietf/ietf_attr_assess_result.h>
 
-#include <tncif_names.h>
 #include <tncif_pa_subtypes.h>
 
 #include <pen/pen.h>
@@ -85,6 +85,15 @@ TNC_Result TNC_IMC_NotifyConnectionChange(TNC_IMCID imc_id,
 		case TNC_CONNECTION_STATE_CREATE:
 			state = imc_scanner_state_create(connection_id);
 			return imc_scanner->create_state(imc_scanner, state);
+		case TNC_CONNECTION_STATE_HANDSHAKE:
+			if (imc_scanner->change_state(imc_scanner, connection_id, new_state,
+				&state) != TNC_RESULT_SUCCESS)
+			{
+				return TNC_RESULT_FATAL;
+			}
+			state->set_result(state, imc_id,
+							  TNC_IMV_EVALUATION_RESULT_DONT_KNOW);
+			return TNC_RESULT_SUCCESS;
 		case TNC_CONNECTION_STATE_DELETE:
 			return imc_scanner->delete_state(imc_scanner, connection_id);
 		default:
@@ -268,7 +277,10 @@ static TNC_Result receive_message(TNC_IMCID imc_id,
 								  TNC_UInt32 dst_imc_id)
 {
 	pa_tnc_msg_t *pa_tnc_msg;
+	pa_tnc_attr_t *attr;
+	pen_type_t attr_type;
 	imc_state_t *state;
+	enumerator_t *enumerator;
 	TNC_Result result;
 	bool fatal_error;
 
@@ -296,14 +308,39 @@ static TNC_Result receive_message(TNC_IMCID imc_id,
 
 	/* preprocess any IETF standard error attributes */
 	fatal_error = pa_tnc_msg->process_ietf_std_errors(pa_tnc_msg);
+
+	/* analyze PA-TNC attributes */
+	enumerator = pa_tnc_msg->create_attribute_enumerator(pa_tnc_msg);
+	while (enumerator->enumerate(enumerator, &attr))
+	{
+		attr_type = attr->get_type(attr);
+
+		if (attr_type.vendor_id == PEN_IETF &&
+			attr_type.type == IETF_ATTR_ASSESSMENT_RESULT)
+		{
+			ietf_attr_assess_result_t *ietf_attr;
+
+			ietf_attr = (ietf_attr_assess_result_t*)attr;
+			state->set_result(state, dst_imc_id,
+							  ietf_attr->get_result(ietf_attr));
+		}
+	}
+	enumerator->destroy(enumerator);
 	pa_tnc_msg->destroy(pa_tnc_msg);
 
-	/* if no error occurred then always return the same response */
-	return fatal_error ? TNC_RESULT_FATAL : send_message(connection_id);
+	if (fatal_error)
+	{
+		return TNC_RESULT_FATAL;
+	}
+
+	/* if no assessment result is known then repeat the measurement */
+	return state->get_result(state, dst_imc_id, NULL) ?
+		   TNC_RESULT_SUCCESS : send_message(connection_id);
 }
 
 /**
  * see section 3.8.4 of TCG TNC IF-IMC Specification 1.3
+
  */
 TNC_Result TNC_IMC_ReceiveMessage(TNC_IMCID imc_id,
 								  TNC_ConnectionID connection_id,

src/libimcv/plugins/imc_scanner/imc_scanner_state.c

@@ -15,6 +15,8 @@
 
 #include "imc_scanner_state.h"
 
+#include <tncif_names.h>
+
 #include <debug.h>
 
 typedef struct private_imc_scanner_state_t private_imc_scanner_state_t;
@@ -39,6 +41,11 @@ struct private_imc_scanner_state_t {
 	 */
 	TNC_ConnectionState state;
 
+	/**
+	 * Assessment/Evaluation Result
+	 */
+	TNC_IMV_Evaluation_Result result;
+
 	/**
 	 * Does the TNCCS connection support long message types?
 	 */
@@ -98,6 +105,26 @@ METHOD(imc_state_t, change_state, void,
 	this->state = new_state;
 }
 
+METHOD(imc_state_t, set_result, void,
+	private_imc_scanner_state_t *this, TNC_IMCID id,
+	TNC_IMV_Evaluation_Result result)
+{
+	DBG1(DBG_IMC, "set assessment result for IMC %u to '%N'",
+		 id, TNC_IMV_Evaluation_Result_names, result);
+	this->result = result;
+}
+
+METHOD(imc_state_t, get_result, bool,
+	private_imc_scanner_state_t *this, TNC_IMCID id,
+	TNC_IMV_Evaluation_Result *result)
+{
+	if (result)
+	{
+		*result = this->result;
+	}
+	return this->result != TNC_IMV_EVALUATION_RESULT_DONT_KNOW;
+}
+
 METHOD(imc_state_t, destroy, void,
 	private_imc_scanner_state_t *this)
 {
@@ -121,10 +148,13 @@ imc_state_t *imc_scanner_state_create(TNC_ConnectionID connection_id)
 				.set_max_msg_len = _set_max_msg_len,
 				.get_max_msg_len = _get_max_msg_len,
 				.change_state = _change_state,
+				.set_result = _set_result,
+				.get_result = _get_result,
 				.destroy = _destroy,
 			},
 		},
 		.state = TNC_CONNECTION_STATE_CREATE,
+		.result = TNC_IMV_EVALUATION_RESULT_DONT_KNOW,
 		.connection_id = connection_id,
 	);