denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

generalized tls_eap_t to support EAP_TNC wrapping the TNC_IF_TNCCS protocol

Browse Source
This commit is contained in:
Andreas Steffen
2010-09-08 11:01:53 +02:00
parent 7b3c01845f
commit d2b1d4378e
9 changed files with 290 additions and 130 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libtls/tls.h
+2
View File
@@ -98,6 +98,8 @@ enum tls_purpose_t {
TLS_PURPOSE_EAP_TTLS,
/** non-EAP TLS */
TLS_PURPOSE_GENERIC,
/** EAP binding for TNC */
TLS_PURPOSE_EAP_TNC
};
/**
src/libtls/tls_eap.c
+33 -26
View File
@@ -71,6 +71,9 @@ typedef enum {
EAP_TTLS_VERSION = (0x07),
} eap_tls_flags_t;
#define EAP_TTLS_SUPPORTED_VERSION 0
#define EAP_TNC_SUPPORTED_VERSION 1
/**
* EAP-TLS/TTLS packet format
*/
@@ -92,6 +95,17 @@ METHOD(tls_eap_t, initiate, status_t,
.code = EAP_REQUEST,
.flags = EAP_TLS_START,
};
switch (this->type)
{
case EAP_TTLS:
pkt.flags |= EAP_TTLS_SUPPORTED_VERSION;
break;
case EAP_TNC:
pkt.flags |= EAP_TNC_SUPPORTED_VERSION;
break;
default:
break;
}
htoun16(&pkt.length, sizeof(eap_tls_packet_t));
do
{ /* start with non-zero random identifier */
@@ -154,9 +168,21 @@ static status_t build_pkt(private_tls_eap_t *this,
pkt->type = this->type;
pkt->flags = 0;
switch (this->type)
{
case EAP_TTLS:
pkt->flags |= EAP_TTLS_SUPPORTED_VERSION;
break;
case EAP_TNC:
pkt->flags |= EAP_TNC_SUPPORTED_VERSION;
break;
default:
break;
}
if (this->first_fragment)
{
pkt->flags = EAP_TLS_LENGTH;
pkt->flags |= EAP_TLS_LENGTH;
len = sizeof(buf) - sizeof(eap_tls_packet_t) - sizeof(u_int32_t);
status = this->tls->build(this->tls, buf + sizeof(eap_tls_packet_t) +
sizeof(u_int32_t), &len, &reclen);
@@ -235,9 +261,9 @@ METHOD(tls_eap_t, process, status_t,
}
if (pkt->flags & EAP_TLS_START)
{
if (this->type == EAP_TTLS)
if (this->type == EAP_TTLS || this->type == EAP_TNC)
{
DBG1(DBG_TLS, "EAP-TTLS version is v%u",
DBG1(DBG_TLS, "%N version is v%u", eap_type_names, this->type,
pkt->flags & EAP_TTLS_VERSION);
}
}
@@ -295,24 +321,9 @@ METHOD(tls_eap_t, destroy, void,
/**
* See header
*/
tls_eap_t *tls_eap_create(eap_type_t type, bool is_server,
identification_t *server, identification_t *peer,
tls_application_t *application, size_t frag_size)
tls_eap_t *tls_eap_create(eap_type_t type, tls_t *tls, size_t frag_size)
{
private_tls_eap_t *this;
tls_purpose_t purpose;
switch (type)
{
case EAP_TLS:
purpose = TLS_PURPOSE_EAP_TLS;
break;
case EAP_TTLS:
purpose = TLS_PURPOSE_EAP_TTLS;
break;
default:
return NULL;
};
INIT(this,
.public = {
@@ -322,15 +333,11 @@ tls_eap_t *tls_eap_create(eap_type_t type, bool is_server,
.destroy = _destroy,
},
.type = type,
.is_server = is_server,
.is_server = tls->is_server(tls),
.first_fragment = TRUE,
.frag_size = frag_size,
.tls = tls_create(is_server, server, peer, purpose, application),
.tls = tls,
);
if (!this->tls)
{
free(this);
return NULL;
}
return &this->public;
}
src/libtls/tls_eap.h
+5 -10
View File
@@ -25,7 +25,7 @@ typedef struct tls_eap_t tls_eap_t;
#include <eap/eap.h>
#include "tls_application.h"
#include "tls.h"
/**
* TLS over EAP helper, as used by EAP-TLS and EAP-TTLS.
@@ -33,7 +33,7 @@ typedef struct tls_eap_t tls_eap_t;
struct tls_eap_t {
/**
* Initiate TLS over EAP exchange (as client).
* Initiate TLS/TTLS/TNC over EAP exchange (as client).
*
* @param out allocated EAP packet data to send
* @return
@@ -43,7 +43,7 @@ struct tls_eap_t {
status_t (*initiate)(tls_eap_t *this, chunk_t *out);
/**
* Process a received EAP-TLS/TTLS packet, create response.
* Process a received EAP-TLS/TTLS/TNC packet, create response.
*
* @param in EAP packet data to process
* @param out allocated EAP packet data to send
@@ -71,14 +71,9 @@ struct tls_eap_t {
* Create a tls_eap instance.
*
* @param type EAP type, EAP-TLS or EAP-TTLS
* @param is_server role
* @param server server identity
* @param peer peer identity, NULL to omit peer authentication
* @param application TLS application layer, if any
* @param tls TLS implementation
* @param frag_size maximum size of a TLS fragment we send
*/
tls_eap_t *tls_eap_create(eap_type_t type, bool is_server,
identification_t *server, identification_t *peer,
tls_application_t *application, size_t frag_size);
tls_eap_t *tls_eap_create(eap_type_t type, tls_t *tls, size_t frag_size);
#endif /** TLS_EAP_H_ @}*/