denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Implemented incremental processing of SWID tag [ID] inventory attribute

Browse Source
This commit is contained in:
Andreas Steffen
2014-10-05 18:43:54 +02:00
parent eba0cbcee3
commit 903a427008
8 changed files with 254 additions and 200 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libimcv/plugins/imc_swid/imc_swid.c
+6 -62
View File
@@ -17,8 +17,6 @@
#include <imc/imc_agent.h>
#include <imc/imc_msg.h>
#include <ita/ita_attr.h>
#include <ita/ita_attr_angel.h>
#include "tcg/swid/tcg_swid_attr_req.h"
#include "tcg/swid/tcg_swid_attr_tag_inv.h"
#include "tcg/swid/tcg_swid_attr_tag_id_inv.h"
@@ -133,13 +131,12 @@ static bool add_swid_inventory(imc_state_t *state, imc_msg_t *msg,
uint32_t request_id, bool full_tags,
swid_inventory_t *targets)
{
pa_tnc_attr_t *attr, *attr_angel, *attr_error;
pa_tnc_attr_t *attr, *attr_error;
imc_swid_state_t *swid_state;
swid_inventory_t *swid_inventory;
char *swid_directory, *swid_generator;
uint32_t eid_epoch;
size_t max_attr_size, attr_size, entry_size;
bool first = TRUE, swid_pretty, swid_full;
bool swid_pretty, swid_full;
enumerator_t *enumerator;
swid_directory = lib->settings->get_str(lib->settings,
@@ -172,63 +169,19 @@ static bool add_swid_inventory(imc_state_t *state, imc_msg_t *msg,
swid_state = (imc_swid_state_t*)state;
eid_epoch = swid_state->get_eid_epoch(swid_state);
/**
* Compute the maximum TCG SWID Tag [ID] Inventory attribute size
* leaving space for an additional ITA Angel attribute
*/
max_attr_size = state->get_max_msg_len(state) -
PA_TNC_HEADER_SIZE - PA_TNC_ATTR_HEADER_SIZE;
if (full_tags)
{
tcg_swid_attr_tag_inv_t *swid_attr;
swid_tag_t *tag;
chunk_t encoding, instance_id;
/* At least one TCG Tag Inventory attribute is sent */
attr_size = PA_TNC_ATTR_HEADER_SIZE + TCG_SWID_TAG_INV_MIN_SIZE;
/* Send a TCG SWID Tag Inventory attribute */
attr = tcg_swid_attr_tag_inv_create(request_id, eid_epoch, 1);
swid_attr = (tcg_swid_attr_tag_inv_t*)attr;
enumerator = swid_inventory->create_enumerator(swid_inventory);
while (enumerator->enumerate(enumerator, &tag))
{
instance_id = tag->get_instance_id(tag);
encoding = tag->get_encoding(tag);
entry_size = 2 + instance_id.len + 4 + encoding.len;
/* Check for oversize tags that cannot be transported */
if (PA_TNC_ATTR_HEADER_SIZE + TCG_SWID_TAG_INV_MIN_SIZE +
entry_size > max_attr_size)
{
attr_error = swid_error_create(TCG_SWID_RESPONSE_TOO_LARGE,
request_id, max_attr_size,
"oversize SWID tag omitted");
msg->add_attribute(msg, attr_error);
continue;
}
if (attr_size + entry_size > max_attr_size)
{
if (first)
{
/**
* Send an ITA Start Angel attribute to the IMV signalling
* that multiple TGC SWID Tag Inventory attributes follow
*/
attr_angel = ita_attr_angel_create(TRUE);
msg->add_attribute(msg, attr_angel);
first = FALSE;
}
msg->add_attribute(msg, attr);
/* create the next TCG SWID Tag Inventory attribute */
attr_size = PA_TNC_ATTR_HEADER_SIZE +
TCG_SWID_TAG_INV_MIN_SIZE;
attr = tcg_swid_attr_tag_inv_create(request_id, eid_epoch, 1);
}
swid_attr = (tcg_swid_attr_tag_inv_t*)attr;
swid_attr->add(swid_attr, tag->get_ref(tag));
attr_size += entry_size;
}
enumerator->destroy(enumerator);
}
@@ -237,7 +190,7 @@ static bool add_swid_inventory(imc_state_t *state, imc_msg_t *msg,
tcg_swid_attr_tag_id_inv_t *swid_id_attr;
swid_tag_id_t *tag_id;
/* Send a TCG Tag ID Inventory attribute */
/* Send a TCG SWID Tag ID Inventory attribute */
attr = tcg_swid_attr_tag_id_inv_create(request_id, eid_epoch, 1);
swid_id_attr = (tcg_swid_attr_tag_id_inv_t*)attr;
@@ -248,19 +201,10 @@ static bool add_swid_inventory(imc_state_t *state, imc_msg_t *msg,
}
enumerator->destroy(enumerator);
}
msg->add_attribute(msg, attr);
swid_inventory->destroy(swid_inventory);
if (!first)
{
/**
* If we sent an ITA Start Angel attribute in the first place,
* terminate by appending a matching ITA Stop Angel attribute.
*/
attr_angel = ita_attr_angel_create(FALSE);
msg->add_attribute(msg, attr_angel);
}
return TRUE;
}
src/libimcv/plugins/imv_swid/imv_swid_agent.c
+18 -25
View File
@@ -24,8 +24,6 @@
#include <imv/imv_agent.h>
#include <imv/imv_msg.h>
#include <ietf/ietf_attr_pa_tnc_error.h>
#include <ita/ita_attr.h>
#include <ita/ita_attr_angel.h>
#include "tcg/seg/tcg_seg_attr_max_size.h"
#include "tcg/seg/tcg_seg_attr_seg_env.h"
#include "tcg/swid/tcg_swid_attr_req.h"
@@ -185,20 +183,6 @@ static TNC_Result receive_msg(private_imv_swid_agent_t *this,
reader->destroy(reader);
}
}
else if (type.vendor_id == PEN_ITA)
{
switch (type.type)
{
case ITA_ATTR_START_ANGEL:
swid_state->set_angel_count(swid_state, TRUE);
continue;
case ITA_ATTR_STOP_ANGEL:
swid_state->set_angel_count(swid_state, FALSE);
continue;
default:
continue;
}
}
else if (type.vendor_id != PEN_TCG)
{
continue;
@@ -209,6 +193,7 @@ static TNC_Result receive_msg(private_imv_swid_agent_t *this,
case TCG_SWID_TAG_ID_INVENTORY:
{
tcg_swid_attr_tag_id_inv_t *attr_cast;
uint32_t missing;
int tag_id_count;
state->set_action_flags(state, IMV_SWID_ATTR_TAG_ID_INV);
@@ -218,11 +203,14 @@ static TNC_Result receive_msg(private_imv_swid_agent_t *this,
last_eid = attr_cast->get_last_eid(attr_cast, &eid_epoch);
inventory = attr_cast->get_inventory(attr_cast);
tag_id_count = inventory->get_count(inventory);
missing = attr_cast->get_tag_id_count(attr_cast);
swid_state->set_missing(swid_state, missing);
DBG2(DBG_IMV, "received SWID tag ID inventory with %d item%s "
"for request %d at eid %d of epoch 0x%08x",
tag_id_count, (tag_id_count == 1) ? "" : "s",
request_id, last_eid, eid_epoch);
"for request %d at eid %d of epoch 0x%08x, %d item%s to "
"follow", tag_id_count, (tag_id_count == 1) ? "" : "s",
request_id, last_eid, eid_epoch, missing,
(missing == 1) ? "" : "s");
if (request_id == swid_state->get_request_id(swid_state))
{
@@ -234,6 +222,7 @@ static TNC_Result receive_msg(private_imv_swid_agent_t *this,
DBG1(DBG_IMV, "no workitem found for SWID tag ID inventory "
"with request ID %d", request_id);
}
attr_cast->clear_inventory(attr_cast);
break;
}
case TCG_SWID_TAG_INVENTORY:
@@ -243,6 +232,7 @@ static TNC_Result receive_msg(private_imv_swid_agent_t *this,
chunk_t tag_encoding;
json_object *jobj, *jarray, *jstring;
char *tag_str;
uint32_t missing;
int tag_count;
enumerator_t *e;
@@ -253,12 +243,13 @@ static TNC_Result receive_msg(private_imv_swid_agent_t *this,
last_eid = attr_cast->get_last_eid(attr_cast, &eid_epoch);
inventory = attr_cast->get_inventory(attr_cast);
tag_count = inventory->get_count(inventory);
missing = attr_cast->get_tag_count(attr_cast);
swid_state->set_missing(swid_state, missing);
DBG2(DBG_IMV, "received SWID tag inventory with %d item%s for "
"request %d at eid %d of epoch 0x%08x",
tag_count, (tag_count == 1) ? "" : "s",
request_id, last_eid, eid_epoch);
"request %d at eid %d of epoch 0x%08x, %d item%s to follow",
tag_count, (tag_count == 1) ? "" : "s", request_id,
last_eid, eid_epoch, missing, (missing == 1) ? "" : "s");
if (request_id == swid_state->get_request_id(swid_state))
{
@@ -295,9 +286,11 @@ static TNC_Result receive_msg(private_imv_swid_agent_t *this,
DBG1(DBG_IMV, "no workitem found for SWID tag inventory "
"with request ID %d", request_id);
}
attr_cast->clear_inventory(attr_cast);
break;
}
default:
continue;
break;
}
}
enumerator->destroy(enumerator);
@@ -498,7 +491,7 @@ METHOD(imv_agent_if_t, batch_ending, TNC_Result,
if (handshake_state == IMV_SWID_STATE_WORKITEMS &&
(received & (IMV_SWID_ATTR_TAG_INV|IMV_SWID_ATTR_TAG_ID_INV)) &&
swid_state->get_angel_count(swid_state) <= 0)
swid_state->get_missing(swid_state) == 0)
{
TNC_IMV_Evaluation_Result eval;
TNC_IMV_Action_Recommendation rec;
src/libimcv/plugins/imv_swid/imv_swid_state.c
+19 -19
View File
@@ -117,6 +117,11 @@ struct private_imv_swid_state_t {
*/
int tag_count;
/**
* Number of missing SWID Tags or Tag IDs
*/
uint32_t missing;
/**
* Top level JSON object
*/
@@ -127,11 +132,6 @@ struct private_imv_swid_state_t {
*/
json_object *jarray;
/**
* Angel count
*/
int angel_count;
};
METHOD(imv_state_t, get_connection_id, TNC_ConnectionID,
@@ -313,6 +313,18 @@ METHOD(imv_swid_state_t, get_swid_inventory, json_object*,
return this->jobj;
}
METHOD(imv_swid_state_t, set_missing, void,
private_imv_swid_state_t *this, uint32_t count)
{
this->missing = count;
}
METHOD(imv_swid_state_t, get_missing, uint32_t,
private_imv_swid_state_t *this)
{
return this->missing;
}
METHOD(imv_swid_state_t, set_count, void,
private_imv_swid_state_t *this, int tag_id_count, int tag_count)
{
@@ -333,18 +345,6 @@ METHOD(imv_swid_state_t, get_count, void,
}
}
METHOD(imv_swid_state_t, set_angel_count, void,
private_imv_swid_state_t *this, bool start)
{
this->angel_count += start ? 1 : -1;
}
METHOD(imv_swid_state_t, get_angel_count, int,
private_imv_swid_state_t *this)
{
return this->angel_count;
}
/**
* Described in header.
*/
@@ -380,10 +380,10 @@ imv_state_t *imv_swid_state_create(TNC_ConnectionID connection_id)
.get_request_id = _get_request_id,
.set_swid_inventory = _set_swid_inventory,
.get_swid_inventory = _get_swid_inventory,
.set_missing = _set_missing,
.get_missing = _get_missing,
.set_count = _set_count,
.get_count = _get_count,
.set_angel_count = _set_angel_count,
.get_angel_count = _get_angel_count,
},
.state = TNC_CONNECTION_STATE_CREATE,
.rec = TNC_IMV_ACTION_RECOMMENDATION_NO_RECOMMENDATION,
src/libimcv/plugins/imv_swid/imv_swid_state.h
+14 -15
View File
@@ -95,6 +95,20 @@ struct imv_swid_state_t {
*/
json_object* (*get_swid_inventory)(imv_swid_state_t *this);
/**
* Set the number of still missing SWID Tags or Tag IDs
*
* @param count Number of missing SWID Tags or Tag IDs
*/
void (*set_missing)(imv_swid_state_t *this, uint32_t count);
/**
* Get the number of still missing SWID Tags or Tag IDs
*
* @result Number of missing SWID Tags or Tag IDs
*/
uint32_t (*get_missing)(imv_swid_state_t *this);
/**
* Set [or with multiple attributes increment] SWID Tag [ID] counters
*
@@ -110,21 +124,6 @@ struct imv_swid_state_t {
* @param tag_count Number of received SWID Tags
*/
void (*get_count)(imv_swid_state_t *this, int *tag_id_count, int *tag_count);
/**
* Increase/Decrease the ITA Angel count
*
* @param start TRUE increases and FALSE decreases count by one
*/
void (*set_angel_count)(imv_swid_state_t *this, bool start);
/**
* Get the ITA Angel count
*
* @return ITA Angel count
*/
int (*get_angel_count)(imv_swid_state_t *this);
};
/**