denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Implemented IF-M segmentation contracts

Browse Source
This commit is contained in:
Andreas Steffen
2014-10-03 22:25:09 +02:00
parent 38b5f527e2
commit f50968976b
32 changed files with 1354 additions and 63 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libimcv/imc/imc_msg.c
+101 -19
View File
@@ -20,6 +20,10 @@
#include "ietf/ietf_attr_remediation_instr.h"
#include <tncif_names.h>
#include <tncif_pa_subtypes.h>
#include <tcg/seg/tcg_seg_attr_max_size.h>
#include <tcg/seg/tcg_seg_attr_seg_env.h>
#include <pen/pen.h>
#include <collections/linked_list.h>
@@ -208,7 +212,7 @@ static void print_assessment_trailer(bool first)
}
METHOD(imc_msg_t, receive, TNC_Result,
private_imc_msg_t *this, bool *fatal_error)
private_imc_msg_t *this, imc_msg_t *out_msg, bool *fatal_error)
{
linked_list_t *non_fatal_types;
TNC_UInt32 target_imc_id;
@@ -252,32 +256,110 @@ METHOD(imc_msg_t, receive, TNC_Result,
break;
case VERIFY_ERROR:
{
imc_msg_t *error_msg;
TNC_Result result;
error_msg = imc_msg_create_as_reply(&this->public);
/* extract and copy by reference all error attributes */
enumerator = this->pa_msg->create_error_enumerator(this->pa_msg);
while (enumerator->enumerate(enumerator, &attr))
{
error_msg->add_attribute(error_msg, attr->get_ref(attr));
out_msg->add_attribute(out_msg, attr->get_ref(attr));
}
enumerator->destroy(enumerator);
/*
* send the PA-TNC message containing all error attributes
* with the excl flag set
*/
result = error_msg->send(error_msg, TRUE);
error_msg->destroy(error_msg);
return result;
return TNC_RESULT_SUCCESS;
}
case FAILED:
default:
return TNC_RESULT_FATAL;
}
/* process any IF-M segmentation contracts */
enumerator = this->pa_msg->create_attribute_enumerator(this->pa_msg);
while (enumerator->enumerate(enumerator, &attr))
{
tcg_seg_attr_max_size_t *attr_cast;
uint32_t max_attr_size, max_seg_size, my_max_attr_size, my_max_seg_size;
seg_contract_t *contract;
seg_contract_manager_t *contracts;
char buf[BUF_LEN];
pen_type_t type;
type = attr->get_type(attr);
if (type.vendor_id != PEN_TCG)
{
continue;
}
if (type.type == TCG_SEG_MAX_ATTR_SIZE_REQ)
{
attr_cast = (tcg_seg_attr_max_size_t*)attr;
attr_cast->get_attr_size(attr_cast, &max_attr_size, &max_seg_size);
contracts = this->state->get_contracts(this->state);
contract = contracts->get_contract(contracts, this->msg_type, FALSE);
if (contract)
{
contract->set_max_size(contract, max_attr_size, max_seg_size);
}
else
{
contract = seg_contract_create(this->msg_type, max_attr_size,
max_seg_size, FALSE, this->src_id, TRUE);
contracts->add_contract(contracts, contract);
}
contract->get_info_string(contract, buf, BUF_LEN);
DBG2(DBG_IMC, "%s", buf);
/* Determine maximum PA-TNC attribute segment size */
my_max_seg_size = this->state->get_max_msg_len(this->state)
- PA_TNC_HEADER_SIZE
- PA_TNC_ATTR_HEADER_SIZE
- TCG_SEG_ATTR_SEG_ENV_HEADER
- PA_TNC_ATTR_HEADER_SIZE
- TCG_SEG_ATTR_MAX_SIZE_SIZE;
/* If segmentation is not prohibited select lower segment size */
if (max_seg_size != SEG_CONTRACT_NO_FRAGMENTATION &&
max_seg_size > my_max_seg_size)
{
max_seg_size = my_max_seg_size;
contract->set_max_size(contract, max_attr_size, max_seg_size);
DBG2(DBG_IMC, " lowered maximum segment size to %u bytes",
max_seg_size);
}
/* Add Maximum Attribute Size Response attribute */
attr = tcg_seg_attr_max_size_create(max_attr_size,
max_seg_size, FALSE);
out_msg->add_attribute(out_msg, attr);
}
else if (type.type == TCG_SEG_MAX_ATTR_SIZE_RESP)
{
attr_cast = (tcg_seg_attr_max_size_t*)attr;
attr_cast->get_attr_size(attr_cast, &max_attr_size, &max_seg_size);
contracts = this->state->get_contracts(this->state);
contract = contracts->get_contract(contracts, this->msg_type, TRUE);
if (contract)
{
contract->get_max_size(contract, &my_max_attr_size,
&my_max_seg_size);
if (my_max_seg_size != SEG_CONTRACT_NO_FRAGMENTATION &&
my_max_seg_size > max_seg_size)
{
my_max_seg_size = max_seg_size;
contract->set_max_size(contract, my_max_attr_size,
my_max_seg_size);
contract->get_info_string(contract, buf, BUF_LEN);
DBG2(DBG_IMC, "%s", buf);
}
}
else
{
/* TODO no request pending */
}
}
}
enumerator->destroy(enumerator);
/* determine target IMC ID */
target_imc_id = (this->dst_id != TNC_IMCID_ANY) ?
this->dst_id : this->agent->get_id(this->agent);
@@ -300,16 +382,16 @@ METHOD(imc_msg_t, receive, TNC_Result,
if (attr_type.type == IETF_ATTR_ASSESSMENT_RESULT)
{
ietf_attr_assess_result_t *attr_cast;
TNC_IMV_Evaluation_Result result;
TNC_IMV_Evaluation_Result res;
attr_cast = (ietf_attr_assess_result_t*)attr;
result = attr_cast->get_result(attr_cast);
this->state->set_result(this->state, target_imc_id, result);
res = attr_cast->get_result(attr_cast);
this->state->set_result(this->state, target_imc_id, res);
print_assessment_header(this->agent->get_name(this->agent),
target_imc_id, this->src_id, &first);
DBG1(DBG_IMC, "assessment result is '%N'",
TNC_IMV_Evaluation_Result_names, result);
TNC_IMV_Evaluation_Result_names, res);
}
else if (attr_type.type == IETF_ATTR_REMEDIATION_INSTRUCTIONS)
{
src/libimcv/imc/imc_msg.h
+3 -1
View File
@@ -65,10 +65,12 @@ struct imc_msg_t {
/**
* Processes a received PA-TNC message
*
* @param out_msg outgoing PA-TN message
* @param fatal_error TRUE if IMV sent a fatal error message
* @return TNC result code
*/
TNC_Result (*receive)(imc_msg_t *this, bool *fatal_error);
TNC_Result (*receive)(imc_msg_t *this, imc_msg_t *out_msg,
bool *fatal_error);
/**
* Add a PA-TNC attribute to the send queue
src/libimcv/imc/imc_state.h
+10 -1
View File
@@ -1,5 +1,5 @@
/*
* Copyright (C) 2011-2012 Andreas Steffen
* Copyright (C) 2011-2014 Andreas Steffen
* HSR Hochschule fuer Technik Rapperswil
*
* This program is free software; you can redistribute it and/or modify it
@@ -22,6 +22,8 @@
#ifndef IMC_STATE_H_
#define IMC_STATE_H_
#include "seg_contract/seg_contract_manager.h"
#include <tncif.h>
#include <tncifimv.h>
#include <tncifimc.h>
@@ -79,6 +81,13 @@ struct imc_state_t {
*/
u_int32_t (*get_max_msg_len)(imc_state_t *this);
/**
* Get attribute segmentation contracts associated with TNCCS Connection
*
* @return contracts associated with TNCCS Connection
*/
seg_contract_manager_t* (*get_contracts)(imc_state_t *this);
/**
* Change the connection state
*