denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

restrict PA-TNC messages to maximum size

Browse Source
This commit is contained in:
Andreas Steffen
2012-07-12 21:26:18 +02:00
parent c5d2e61802
commit 968c83cdeb
15 changed files with 243 additions and 29 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libcharon/plugins/tnc_tnccs/tnc_tnccs_manager.c
+13 -5
View File
@@ -74,6 +74,11 @@ struct tnccs_connection_entry_t {
*/
bool *request_handshake_retry;
/**
* Maximum size of a PA-TNC message
*/
u_int32_t max_msg_len;
/**
* collection of IMV recommendations
*/
@@ -181,7 +186,7 @@ METHOD(tnccs_manager_t, create_instance, tnccs_t*,
METHOD(tnccs_manager_t, create_connection, TNC_ConnectionID,
private_tnc_tnccs_manager_t *this, tnccs_type_t type, tnccs_t *tnccs,
tnccs_send_message_t send_message, bool* request_handshake_retry,
recommendations_t **recs)
u_int32_t max_msg_len, recommendations_t **recs)
{
tnccs_connection_entry_t *entry;
@@ -190,6 +195,7 @@ METHOD(tnccs_manager_t, create_connection, TNC_ConnectionID,
entry->tnccs = tnccs;
entry->send_message = send_message;
entry->request_handshake_retry = request_handshake_retry;
entry->max_msg_len = max_msg_len;
if (recs)
{
/* we assume a TNC Server needing recommendations from IMVs */
@@ -564,16 +570,18 @@ METHOD(tnccs_manager_t, get_attribute, TNC_Result,
return TNC_RESULT_SUCCESS;
}
case TNC_ATTRIBUTEID_MAX_ROUND_TRIPS:
return uint_attribute(buffer_len, buffer, value_len, 0xffffffff);
return uint_attribute(buffer_len, buffer, value_len,
0xffffffff);
case TNC_ATTRIBUTEID_MAX_MESSAGE_SIZE:
return uint_attribute(buffer_len, buffer, value_len, 0x00000000);
return uint_attribute(buffer_len, buffer, value_len,
entry->max_msg_len);
case TNC_ATTRIBUTEID_HAS_LONG_TYPES:
case TNC_ATTRIBUTEID_HAS_EXCLUSIVE:
return bool_attribute(buffer_len, buffer, value_len,
entry->type == TNCCS_2_0);
entry->type == TNCCS_2_0);
case TNC_ATTRIBUTEID_HAS_SOH:
return bool_attribute(buffer_len, buffer, value_len,
entry->type == TNCCS_SOH);
entry->type == TNCCS_SOH);
case TNC_ATTRIBUTEID_IFTNCCS_PROTOCOL:
{
char *protocol;
src/libcharon/plugins/tnccs_11/Makefile.am
+2
View File
@@ -1,6 +1,8 @@
INCLUDES = \
-I$(top_srcdir)/src/libstrongswan \
-I$(top_srcdir)/src/libcharon \
-I$(top_srcdir)/src/libhydra \
-I$(top_srcdir)/src/libtls \
-I$(top_srcdir)/src/libtncif \
-I$(top_srcdir)/src/libtnccs \
src/libcharon/plugins/tnccs_11/tnccs_11.c
+14 -3
View File
@@ -32,6 +32,7 @@
#include <tnc/tnccs/tnccs_manager.h>
#include <debug.h>
#include <daemon.h>
#include <threading/mutex.h>
typedef struct private_tnccs_11_t private_tnccs_11_t;
@@ -66,6 +67,11 @@ struct private_tnccs_11_t {
*/
tnccs_batch_t *batch;
/**
* Maximum PA-TNC message size
*/
size_t max_msg_len;
/**
* Mutex locking the batch in construction
*/
@@ -289,8 +295,9 @@ METHOD(tls_t, process, status_t,
if (this->is_server && !this->connection_id)
{
this->connection_id = tnc->tnccs->create_connection(tnc->tnccs,
TNCCS_1_1, (tnccs_t*)this, _send_msg,
&this->request_handshake_retry, &this->recs);
TNCCS_1_1, (tnccs_t*)this, _send_msg,
&this->request_handshake_retry,
this->max_msg_len, &this->recs);
if (!this->connection_id)
{
return FAILED;
@@ -416,7 +423,8 @@ METHOD(tls_t, build, status_t,
this->connection_id = tnc->tnccs->create_connection(tnc->tnccs,
TNCCS_1_1, (tnccs_t*)this, _send_msg,
&this->request_handshake_retry, NULL);
&this->request_handshake_retry,
this->max_msg_len, NULL);
if (!this->connection_id)
{
return FAILED;
@@ -545,6 +553,9 @@ tls_t *tnccs_11_create(bool is_server)
},
.is_server = is_server,
.mutex = mutex_create(MUTEX_TYPE_DEFAULT),
.max_msg_len = lib->settings->get_int(lib->settings,
"%s.plugins.tnccs-11.max_msg_size", 45000,
charon->name),
);
return &this->public;
src/libcharon/plugins/tnccs_20/tnccs_20.c
+14 -4
View File
@@ -78,10 +78,15 @@ struct private_tnccs_20_t {
pb_tnc_batch_type_t batch_type;
/**
* Maximum PA-TNC batch size
* Maximum PB-TNC batch size
*/
size_t max_batch_len;
/**
* Maximum PA-TNC message size
*/
size_t max_msg_len;
/**
* Mutex locking the batch in construction
*/
@@ -407,8 +412,9 @@ METHOD(tls_t, process, status_t,
if (this->is_server && !this->connection_id)
{
this->connection_id = tnc->tnccs->create_connection(tnc->tnccs,
TNCCS_2_0, (tnccs_t*)this, _send_msg,
&this->request_handshake_retry, &this->recs);
TNCCS_2_0, (tnccs_t*)this, _send_msg,
&this->request_handshake_retry,
this->max_msg_len, &this->recs);
if (!this->connection_id)
{
return FAILED;
@@ -583,7 +589,8 @@ METHOD(tls_t, build, status_t,
this->connection_id = tnc->tnccs->create_connection(tnc->tnccs,
TNCCS_2_0, (tnccs_t*)this, _send_msg,
&this->request_handshake_retry, NULL);
&this->request_handshake_retry,
this->max_msg_len, NULL);
if (!this->connection_id)
{
return FAILED;
@@ -797,6 +804,9 @@ tls_t *tnccs_20_create(bool is_server)
.max_batch_len = lib->settings->get_int(lib->settings,
"%s.plugins.tnccs-20.max_batch_size", 65522,
charon->name),
.max_msg_len = lib->settings->get_int(lib->settings,
"%s.plugins.tnccs-20.max_msg_size", 65490,
charon->name),
);
return &this->public;