denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

OS IMV proposes IF-M segmentation contract

Browse Source 
The OS IMV sends a TCG IF-M Segmentation contract request.
All IETF standard attributes support segmentation. Additionally
the IETF Installed Packages standard attributes supports
incremental processing while segments are received.
This commit is contained in:
Andreas Steffen
2014-10-05 18:43:55 +02:00
parent fc47211740
commit a5dfe7a29a
6 changed files with 153 additions and 108 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libimcv/plugins/imc_os/imc_os.c
+8 -54
View File
@@ -30,7 +30,6 @@
#include <ita/ita_attr.h>
#include <ita/ita_attr_get_settings.h>
#include <ita/ita_attr_settings.h>
#include <ita/ita_attr_angel.h>
#include <ita/ita_attr_device_id.h>
#include <tncif_pa_subtypes.h>
@@ -341,69 +340,24 @@ static void add_device_id(imc_msg_t *msg)
*/
static void add_installed_packages(imc_state_t *state, imc_msg_t *msg)
{
pa_tnc_attr_t *attr = NULL, *attr_angel;
pa_tnc_attr_t *attr;
ietf_attr_installed_packages_t *attr_cast;
enumerator_t *enumerator;
chunk_t name, version;
size_t max_attr_size, attr_size, entry_size;
bool first = TRUE;
/**
* Compute the maximum IETF Installed Packages attribute size
* leaving space for an additional ITA Angel attribute
*/
max_attr_size = state->get_max_msg_len(state) -
PA_TNC_HEADER_SIZE - PA_TNC_ATTR_HEADER_SIZE;
/* At least one IETF Installed Packages attribute is sent */
attr = ietf_attr_installed_packages_create();
attr_size = PA_TNC_ATTR_HEADER_SIZE + IETF_INSTALLED_PACKAGES_MIN_SIZE;
enumerator = os->create_package_enumerator(os);
if (enumerator)
while (enumerator->enumerate(enumerator, &name, &version))
{
while (enumerator->enumerate(enumerator, &name, &version))
{
DBG2(DBG_IMC, "package '%.*s' (%.*s)",
name.len, name.ptr, version.len, version.ptr);
entry_size = 2 + name.len + version.len;
if (attr_size + entry_size > max_attr_size)
{
if (first)
{
/**
* Send an ITA Start Angel attribute to the IMV signalling
* that multiple ITA Installed Package attributes follow.
*/
attr_angel = ita_attr_angel_create(TRUE);
msg->add_attribute(msg, attr_angel);
first = FALSE;
}
msg->add_attribute(msg, attr);
/* create the next IETF Installed Packages attribute */
attr = ietf_attr_installed_packages_create();
attr_size = PA_TNC_ATTR_HEADER_SIZE +
IETF_INSTALLED_PACKAGES_MIN_SIZE;
}
attr_cast = (ietf_attr_installed_packages_t*)attr;
attr_cast->add(attr_cast, name, version);
attr_size += entry_size;
}
enumerator->destroy(enumerator);
DBG2(DBG_IMC, "package '%.*s' (%.*s)",
name.len, name.ptr, version.len, version.ptr);
attr_cast = (ietf_attr_installed_packages_t*)attr;
attr_cast->add(attr_cast, name, version);
}
enumerator->destroy(enumerator);
msg->add_attribute(msg, attr);
if (!first)
{
/**
* If we sent an ITA Start Angel attribute in the first place,
* terminate by appending a matching ITA Stop Angel attribute.
*/
attr_angel = ita_attr_angel_create(FALSE);
msg->add_attribute(msg, attr_angel);
}
}
/**
src/libimcv/plugins/imv_os/imv_os_agent.c
+33 -8
View File
@@ -37,8 +37,9 @@
#include <ita/ita_attr.h>
#include <ita/ita_attr_get_settings.h>
#include <ita/ita_attr_settings.h>
#include <ita/ita_attr_angel.h>
#include <ita/ita_attr_device_id.h>
#include "tcg/seg/tcg_seg_attr_max_size.h"
#include "tcg/seg/tcg_seg_attr_seg_env.h"
#include <tncif_names.h>
#include <tncif_pa_subtypes.h>
@@ -46,6 +47,8 @@
#include <pen/pen.h>
#include <utils/debug.h>
#define INSTALLED_PACKAGES_MAX_ATTR_SIZE 100000000
typedef struct private_imv_os_agent_t private_imv_os_agent_t;
typedef enum imv_os_attr_t imv_os_attr_t;
@@ -166,6 +169,7 @@ static TNC_Result receive_msg(private_imv_os_agent_t *this, imv_state_t *state,
chunk_t os_name = chunk_empty;
chunk_t os_version = chunk_empty;
bool fatal_error = FALSE, assessment = FALSE;
uint16_t missing;
os_state = (imv_os_state_t*)state;
session = state->get_session(state);
@@ -325,6 +329,9 @@ static TNC_Result receive_msg(private_imv_os_agent_t *this, imv_state_t *state,
TNC_IMV_EVALUATION_RESULT_ERROR);
assessment = TRUE;
}
missing = attr_cast->get_count(attr_cast);
os_state->set_missing(os_state, missing);
attr_cast->clear_packages(attr_cast);
break;
}
default:
@@ -371,12 +378,6 @@ static TNC_Result receive_msg(private_imv_os_agent_t *this, imv_state_t *state,
session->set_device_id(session, value);
break;
}
case ITA_ATTR_START_ANGEL:
os_state->set_angel_count(os_state, TRUE);
break;
case ITA_ATTR_STOP_ANGEL:
os_state->set_angel_count(os_state, FALSE);
break;
default:
break;
}
@@ -531,6 +532,30 @@ METHOD(imv_agent_if_t, batch_ending, TNC_Result,
if (handshake_state == IMV_OS_STATE_INIT)
{
size_t max_attr_size = INSTALLED_PACKAGES_MAX_ATTR_SIZE;
size_t max_seg_size;
seg_contract_t *contract;
seg_contract_manager_t *contracts;
char buf[BUF_LEN];
/* Determine maximum PA-TNC attribute segment size */
max_seg_size = state->get_max_msg_len(state)
- PA_TNC_HEADER_SIZE
- PA_TNC_ATTR_HEADER_SIZE
- TCG_SEG_ATTR_SEG_ENV_HEADER
- PA_TNC_ATTR_HEADER_SIZE
- TCG_SEG_ATTR_MAX_SIZE_SIZE;
/* Announce support of PA-TNC segmentation to IMC */
contract = seg_contract_create(msg_types[0], max_attr_size,
max_seg_size, TRUE, imv_id, FALSE);
contract->get_info_string(contract, buf, BUF_LEN, TRUE);
DBG2(DBG_IMV, "%s", buf);
contracts = state->get_contracts(state);
contracts->add_contract(contracts, contract);
attr = tcg_seg_attr_max_size_create(max_attr_size, max_seg_size, TRUE);
out_msg->add_attribute(out_msg, attr);
if ((received & IMV_OS_ATTR_MUST) != IMV_OS_ATTR_MUST)
{
/* create attribute request for missing mandatory attributes */
@@ -673,7 +698,7 @@ METHOD(imv_agent_if_t, batch_ending, TNC_Result,
int count, count_update, count_blacklist, count_ok;
if (!(received & IMV_OS_ATTR_INSTALLED_PACKAGES) ||
os_state->get_angel_count(os_state) > 0)
os_state->get_missing(os_state) > 0)
{
continue;
}
src/libimcv/plugins/imv_os/imv_os_state.c
+9 -9
View File
@@ -141,9 +141,9 @@ struct private_imv_os_state_t {
u_int os_settings;
/**
* Angel count
* Number of installed packages still missing
*/
int angel_count;
uint16_t missing;
};
@@ -535,16 +535,16 @@ METHOD(imv_os_state_t, get_os_settings, u_int,
return this->os_settings;
}
METHOD(imv_os_state_t, set_angel_count, void,
private_imv_os_state_t *this, bool start)
METHOD(imv_os_state_t, set_missing, void,
private_imv_os_state_t *this, uint16_t missing)
{
this->angel_count += start ? 1 : -1;
this->missing = missing;
}
METHOD(imv_os_state_t, get_angel_count, int,
METHOD(imv_os_state_t, get_missing, uint16_t,
private_imv_os_state_t *this)
{
return this->angel_count;
return this->missing;
}
METHOD(imv_os_state_t, add_bad_package, void,
@@ -598,8 +598,8 @@ imv_state_t *imv_os_state_create(TNC_ConnectionID connection_id)
.get_count = _get_count,
.set_os_settings = _set_os_settings,
.get_os_settings = _get_os_settings,
.set_angel_count = _set_angel_count,
.get_angel_count = _get_angel_count,
.set_missing = _set_missing,
.get_missing = _get_missing,
.add_bad_package = _add_bad_package,
},
.state = TNC_CONNECTION_STATE_CREATE,
src/libimcv/plugins/imv_os/imv_os_state.h
+6 -6
View File
@@ -114,18 +114,18 @@ struct imv_os_state_t {
u_int (*get_os_settings)(imv_os_state_t *this);
/**
* Increase/Decrease the ITA Angel count
* Set number of installed packages still missing
*
* @param start TRUE increases and FALSE decreases count by one
* @param missing Number of missing installed packages
*/
void (*set_angel_count)(imv_os_state_t *this, bool start);
void (*set_missing)(imv_os_state_t *this, uint16_t missing);
/**
* Get the ITA Angel count
* Get number of installed packages still missing
*
* @return ITA Angel count
* @return Number of missing installed packages
*/
int (*get_angel_count)(imv_os_state_t *this);
uint16_t (*get_missing)(imv_os_state_t *this);
/**
* Store a bad package that has to be updated or removed