Added add_segment() method to IETF attributes
[strongswan.git] / src / libimcv / imv / imv_msg.c
1 /*
2 * Copyright (C) 2012-2014 Andreas Steffen
3 * HSR Hochschule fuer Technik Rapperswil
4 *
5 * This program is free software; you can redistribute it and/or modify it
6 * under the terms of the GNU General Public License as published by the
7 * Free Software Foundation; either version 2 of the License, or (at your
8 * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
9 *
10 * This program is distributed in the hope that it will be useful, but
11 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
12 * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
13 * for more details.
14 */
15
16 #include "imv_msg.h"
17
18 #include "ietf/ietf_attr.h"
19 #include "ietf/ietf_attr_assess_result.h"
20 #include "ietf/ietf_attr_remediation_instr.h"
21 #include "tcg/seg/tcg_seg_attr_max_size.h"
22 #include "tcg/seg/tcg_seg_attr_seg_env.h"
23 #include "tcg/seg/tcg_seg_attr_next_seg.h"
24
25 #include <tncif_names.h>
26 #include <tncif_pa_subtypes.h>
27
28 #include <pen/pen.h>
29 #include <collections/linked_list.h>
30 #include <utils/debug.h>
31
32 typedef struct private_imv_msg_t private_imv_msg_t;
33
34 /**
35 * Private data of a imv_msg_t object.
36 *
37 */
38 struct private_imv_msg_t {
39
40 /**
41 * Public imv_msg_t interface.
42 */
43 imv_msg_t public;
44
45 /**
46 * Connection ID
47 */
48 TNC_ConnectionID connection_id;
49
50 /**
51 * source ID
52 */
53 TNC_UInt32 src_id;
54
55 /**
56 * destination ID
57 */
58 TNC_UInt32 dst_id;
59
60 /**
61 * PA-TNC message type
62 */
63 pen_type_t msg_type;
64
65 /**
66 * List of PA-TNC attributes to be sent
67 */
68 linked_list_t *attr_list;
69
70 /**
71 * PA-TNC message
72 */
73 pa_tnc_msg_t *pa_msg;
74
75 /**
76 * Assigned IMV agent
77 */
78 imv_agent_t *agent;
79
80 /**
81 * Assigned IMV state
82 */
83 imv_state_t *state;
84 };
85
86 METHOD(imv_msg_t, get_src_id, TNC_UInt32,
87 private_imv_msg_t *this)
88 {
89 return this->src_id;
90 }
91
92 METHOD(imv_msg_t, get_dst_id, TNC_UInt32,
93 private_imv_msg_t *this)
94 {
95 return this->dst_id;
96 }
97
98 METHOD(imv_msg_t, set_msg_type, void,
99 private_imv_msg_t *this, pen_type_t msg_type)
100 {
101 if (msg_type.vendor_id != this->msg_type.vendor_id ||
102 msg_type.type != this->msg_type.type)
103 {
104 this->msg_type = msg_type;
105 this->dst_id = TNC_IMCID_ANY;
106 }
107 }
108
109 METHOD(imv_msg_t, get_msg_type, pen_type_t,
110 private_imv_msg_t *this)
111 {
112 return this->msg_type;
113 }
114
115 METHOD(imv_msg_t, add_attribute, void,
116 private_imv_msg_t *this, pa_tnc_attr_t *attr)
117 {
118 this->attr_list->insert_last(this->attr_list, attr);
119 }
120
121 METHOD(imv_msg_t, send_, TNC_Result,
122 private_imv_msg_t *this, bool excl)
123 {
124 pa_tnc_msg_t *pa_tnc_msg;
125 pa_tnc_attr_t *attr;
126 TNC_UInt32 msg_flags;
127 TNC_MessageType msg_type;
128 bool attr_added, oversize;
129 chunk_t msg;
130 seg_contract_t *contract;
131 seg_contract_manager_t *contracts;
132 enumerator_t *enumerator;
133 TNC_Result result = TNC_RESULT_SUCCESS;
134
135 /* Get IF-M segmentation contract for this subtype if any */
136 contracts = this->state->get_contracts(this->state);
137 contract = contracts->get_contract(contracts, this->msg_type, FALSE);
138
139 while (this->attr_list->get_count(this->attr_list))
140 {
141 pa_tnc_msg = pa_tnc_msg_create(this->state->get_max_msg_len(this->state));
142 attr_added = FALSE;
143
144 enumerator = this->attr_list->create_enumerator(this->attr_list);
145 while (enumerator->enumerate(enumerator, &attr))
146 {
147 if (contract && contract->check_size(contract, attr, &oversize))
148 {
149 if (oversize)
150 {
151 /* TODO generate SWID error msg */
152 }
153 else
154 {
155 attr = contract->first_segment(contract, attr);
156 }
157 }
158 if (pa_tnc_msg->add_attribute(pa_tnc_msg, attr))
159 {
160 attr_added = TRUE;
161 }
162 else
163 {
164 if (attr_added)
165 {
166 break;
167 }
168 else
169 {
170 DBG1(DBG_IMV, "PA-TNC attribute too large to send, deleted");
171 attr->destroy(attr);
172 }
173 }
174 this->attr_list->remove_at(this->attr_list, enumerator);
175 }
176 enumerator->destroy(enumerator);
177
178 /* build and send the PA-TNC message via the IF-IMV interface */
179 if (!pa_tnc_msg->build(pa_tnc_msg))
180 {
181 pa_tnc_msg->destroy(pa_tnc_msg);
182 return TNC_RESULT_FATAL;
183 }
184 msg = pa_tnc_msg->get_encoding(pa_tnc_msg);
185 DBG3(DBG_IMV, "created PA-TNC message: %B", &msg);
186
187 if (this->state->has_long(this->state) && this->agent->send_message_long)
188 {
189 excl = excl && this->state->has_excl(this->state) &&
190 this->dst_id != TNC_IMCID_ANY;
191 msg_flags = excl ? TNC_MESSAGE_FLAGS_EXCLUSIVE : 0;
192 result = this->agent->send_message_long(this->src_id,
193 this->connection_id, msg_flags, msg.ptr, msg.len,
194 this->msg_type.vendor_id, this->msg_type.type,
195 this->dst_id);
196 }
197 else if (this->agent->send_message)
198 {
199 msg_type = (this->msg_type.vendor_id << 8) |
200 (this->msg_type.type & 0x000000ff);
201 result = this->agent->send_message(this->src_id, this->connection_id,
202 msg.ptr, msg.len, msg_type);
203 }
204
205 pa_tnc_msg->destroy(pa_tnc_msg);
206
207 if (result != TNC_RESULT_SUCCESS)
208 {
209 break;
210 }
211 }
212 return result;
213 }
214
215 METHOD(imv_msg_t, send_assessment, TNC_Result,
216 private_imv_msg_t *this)
217 {
218 TNC_IMV_Action_Recommendation rec;
219 TNC_IMV_Evaluation_Result eval;
220 pa_tnc_attr_t *attr;
221 chunk_t string = chunk_empty;
222 char *lang_code = NULL, *uri = NULL;
223 enumerator_t *e;
224
225 /* Remove any attributes that have already been constructed */
226 while (this->attr_list->remove_last(this->attr_list, (void**)&attr) == SUCCESS)
227 {
228 attr->destroy(attr);
229 }
230
231 /* Send an IETF Assessment Result attribute if enabled */
232 if (lib->settings->get_bool(lib->settings, "%s.imcv.assessment_result",
233 TRUE, lib->ns))
234 {
235 this->state->get_recommendation(this->state, &rec, &eval);
236 attr = ietf_attr_assess_result_create(eval);
237 add_attribute(this, attr);
238
239 /* Send IETF Remediation Instructions if available */
240 if (eval != TNC_IMV_EVALUATION_RESULT_COMPLIANT)
241 {
242 e = this->agent->create_language_enumerator(this->agent,
243 this->state);
244 if (this->state->get_remediation_instructions(this->state,
245 e, &string, &lang_code, &uri))
246 {
247 if (string.len && lang_code)
248 {
249 attr = ietf_attr_remediation_instr_create_from_string(string,
250 chunk_create(lang_code, strlen(lang_code)));
251 add_attribute(this, attr);
252 }
253 if (uri)
254 {
255 attr = ietf_attr_remediation_instr_create_from_uri(
256 chunk_create(uri, strlen(uri)));
257 add_attribute(this, attr);
258 }
259 }
260 e->destroy(e);
261 }
262
263 /* send PA-TNC message with the excl flag set */
264 return send_(this, TRUE);
265 }
266 return TNC_RESULT_SUCCESS;
267 }
268
269 METHOD(imv_msg_t, receive, TNC_Result,
270 private_imv_msg_t *this, imv_msg_t *out_msg, bool *fatal_error)
271 {
272 TNC_Result result = TNC_RESULT_SUCCESS;
273 linked_list_t *non_fatal_types;
274 enumerator_t *enumerator;
275 pa_tnc_attr_t *attr;
276 chunk_t msg;
277
278 if (this->state->has_long(this->state))
279 {
280 if (this->dst_id != TNC_IMVID_ANY)
281 {
282 DBG2(DBG_IMV, "IMV %u \"%s\" received message for Connection ID %u "
283 "from IMC %u to IMV %u",
284 this->agent->get_id(this->agent),
285 this->agent->get_name(this->agent),
286 this->connection_id, this->src_id, this->dst_id);
287 }
288 else
289 {
290 DBG2(DBG_IMV, "IMV %u \"%s\" received message for Connection ID %u "
291 "from IMC %u", this->agent->get_id(this->agent),
292 this->agent->get_name(this->agent),
293 this->connection_id, this->src_id);
294 }
295 }
296 else
297 {
298 DBG2(DBG_IMV, "IMV %u \"%s\" received message for Connection ID %u",
299 this->agent->get_id(this->agent),
300 this->agent->get_name(this->agent),
301 this->connection_id);
302 }
303 msg = this->pa_msg->get_encoding(this->pa_msg);
304 DBG3(DBG_IMV, "%B", &msg);
305
306 switch (this->pa_msg->process(this->pa_msg))
307 {
308 case SUCCESS:
309 break;
310 case VERIFY_ERROR:
311 {
312 /* extract and copy by reference all error attributes */
313 enumerator = this->pa_msg->create_error_enumerator(this->pa_msg);
314 while (enumerator->enumerate(enumerator, &attr))
315 {
316 out_msg->add_attribute(out_msg, attr->get_ref(attr));
317 }
318 enumerator->destroy(enumerator);
319 }
320 case FAILED:
321 default:
322 return TNC_RESULT_FATAL;
323 }
324
325 /* process IF-M segmentation attributes */
326 enumerator = this->pa_msg->create_attribute_enumerator(this->pa_msg);
327 while (enumerator->enumerate(enumerator, &attr))
328 {
329 uint32_t max_attr_size, max_seg_size, my_max_attr_size, my_max_seg_size;
330 seg_contract_manager_t *contracts;
331 seg_contract_t *contract;
332 char buf[BUF_LEN];
333 pen_type_t type;
334
335 type = attr->get_type(attr);
336
337 if (type.vendor_id != PEN_TCG)
338 {
339 continue;
340 }
341
342 contracts = this->state->get_contracts(this->state);
343
344 switch (type.type)
345 {
346 case TCG_SEG_MAX_ATTR_SIZE_REQ:
347 {
348 tcg_seg_attr_max_size_t *attr_cast;
349
350 attr_cast = (tcg_seg_attr_max_size_t*)attr;
351 attr_cast->get_attr_size(attr_cast, &max_attr_size,
352 &max_seg_size);
353 contract = contracts->get_contract(contracts, this->msg_type,
354 FALSE);
355 if (contract)
356 {
357 contract->set_max_size(contract, max_attr_size,
358 max_seg_size);
359 }
360 else
361 {
362 contract = seg_contract_create(this->msg_type, max_attr_size,
363 max_seg_size, FALSE, this->src_id, FALSE);
364 contracts->add_contract(contracts, contract);
365 }
366 contract->get_info_string(contract, buf, BUF_LEN, TRUE);
367 DBG2(DBG_IMV, "%s", buf);
368
369 /* Determine maximum PA-TNC attribute segment size */
370 my_max_seg_size = this->state->get_max_msg_len(this->state)
371 - PA_TNC_HEADER_SIZE
372 - PA_TNC_ATTR_HEADER_SIZE
373 - TCG_SEG_ATTR_SEG_ENV_HEADER
374 - PA_TNC_ATTR_HEADER_SIZE
375 - TCG_SEG_ATTR_MAX_SIZE_SIZE;
376
377 /* If segmentation is possible select lower segment size */
378 if (max_seg_size != SEG_CONTRACT_NO_FRAGMENTATION &&
379 max_seg_size > my_max_seg_size)
380 {
381 max_seg_size = my_max_seg_size;
382 contract->set_max_size(contract, max_attr_size,
383 max_seg_size);
384 DBG2(DBG_IMV, " lowered maximum segment size to %u bytes",
385 max_seg_size);
386 }
387
388 /* Add Maximum Attribute Size Response attribute */
389 attr = tcg_seg_attr_max_size_create(max_attr_size,
390 max_seg_size, FALSE);
391 out_msg->add_attribute(out_msg, attr);
392 break;
393 }
394 case TCG_SEG_MAX_ATTR_SIZE_RESP:
395 {
396 tcg_seg_attr_max_size_t *attr_cast;
397
398 attr_cast = (tcg_seg_attr_max_size_t*)attr;
399 attr_cast->get_attr_size(attr_cast, &max_attr_size,
400 &max_seg_size);
401 contract = contracts->get_contract(contracts, this->msg_type,
402 TRUE);
403 if (contract)
404 {
405 contract->get_max_size(contract, &my_max_attr_size,
406 &my_max_seg_size);
407 if (my_max_seg_size != SEG_CONTRACT_NO_FRAGMENTATION &&
408 my_max_seg_size > max_seg_size)
409 {
410 my_max_seg_size = max_seg_size;
411 contract->set_max_size(contract, my_max_attr_size,
412 my_max_seg_size);
413 }
414 contract->get_info_string(contract, buf, BUF_LEN, FALSE);
415 DBG2(DBG_IMV, "%s", buf);
416 }
417 else
418 {
419 /* TODO no request pending */
420 DBG1(DBG_IMV, "no contract for this PA message type found");
421 }
422 break;
423 }
424 case TCG_SEG_ATTR_SEG_ENV:
425 {
426 tcg_seg_attr_seg_env_t *seg_env_attr;
427 pa_tnc_attr_t *error;
428 uint32_t base_attr_id;
429 bool more;
430
431 seg_env_attr = (tcg_seg_attr_seg_env_t*)attr;
432 base_attr_id = seg_env_attr->get_base_attr_id(seg_env_attr);
433
434 contract = contracts->get_contract(contracts, this->msg_type,
435 TRUE);
436 if (!contract)
437 {
438 DBG2(DBG_IMV, "no contract for received attribute segment "
439 "with base attribute ID %u", base_attr_id);
440 continue;
441 }
442 attr = contract->add_segment(contract, attr, &error, &more);
443 if (error)
444 {
445 out_msg->add_attribute(out_msg, error);
446 }
447 if (attr)
448 {
449 this->pa_msg->add_attribute(this->pa_msg, attr);
450 }
451 if (more)
452 {
453 /* Send Next Segment Request */
454 attr = tcg_seg_attr_next_seg_create(base_attr_id, FALSE);
455 out_msg->add_attribute(out_msg, attr);
456 }
457 break;
458 }
459 case TCG_SEG_NEXT_SEG_REQ:
460 {
461 tcg_seg_attr_next_seg_t *attr_cast;
462 uint32_t base_attr_id;
463
464 attr_cast = (tcg_seg_attr_next_seg_t*)attr;
465 base_attr_id = attr_cast->get_base_attr_id(attr_cast);
466
467 contract = contracts->get_contract(contracts, this->msg_type,
468 FALSE);
469 if (!contract)
470 {
471 /* TODO no contract - generate error message */
472 DBG1(DBG_IMV, "no contract for received next segment "
473 "request with base attribute ID %u", base_attr_id);
474 continue;
475 }
476 attr = contract->next_segment(contract, base_attr_id);
477 if (attr)
478 {
479 out_msg->add_attribute(out_msg, attr);
480 }
481 else
482 {
483 /* TODO no more segments - generate error message */
484 DBG1(DBG_IMV, "no more segments found for "
485 "base attribute ID %u", base_attr_id);
486 }
487 break;
488 }
489 default:
490 break;
491 }
492 }
493 enumerator->destroy(enumerator);
494
495 /* preprocess any received IETF standard error attributes */
496 non_fatal_types = this->agent->get_non_fatal_attr_types(this->agent);
497 *fatal_error = this->pa_msg->process_ietf_std_errors(this->pa_msg,
498 non_fatal_types);
499
500 return result;
501 }
502
503 METHOD(imv_msg_t, get_attribute_count, int,
504 private_imv_msg_t *this)
505 {
506 return this->attr_list->get_count(this->attr_list);
507 }
508
509 METHOD(imv_msg_t, create_attribute_enumerator, enumerator_t*,
510 private_imv_msg_t *this)
511 {
512 return this->pa_msg->create_attribute_enumerator(this->pa_msg);
513 }
514
515 METHOD(imv_msg_t, get_encoding, chunk_t,
516 private_imv_msg_t *this)
517 {
518 if (this->pa_msg)
519 {
520 return this->pa_msg->get_encoding(this->pa_msg);
521 }
522 return chunk_empty;
523 }
524
525 METHOD(imv_msg_t, destroy, void,
526 private_imv_msg_t *this)
527 {
528 this->attr_list->destroy_offset(this->attr_list,
529 offsetof(pa_tnc_attr_t, destroy));
530 DESTROY_IF(this->pa_msg);
531 free(this);
532 }
533
534 /**
535 * See header
536 */
537 imv_msg_t *imv_msg_create(imv_agent_t *agent, imv_state_t *state,
538 TNC_ConnectionID connection_id,
539 TNC_UInt32 src_id, TNC_UInt32 dst_id,
540 pen_type_t msg_type)
541 {
542 private_imv_msg_t *this;
543
544 INIT(this,
545 .public = {
546 .get_src_id = _get_src_id,
547 .get_dst_id = _get_dst_id,
548 .set_msg_type = _set_msg_type,
549 .get_msg_type = _get_msg_type,
550 .send = _send_,
551 .send_assessment = _send_assessment,
552 .receive = _receive,
553 .add_attribute = _add_attribute,
554 .get_attribute_count = _get_attribute_count,
555 .create_attribute_enumerator = _create_attribute_enumerator,
556 .get_encoding = _get_encoding,
557 .destroy = _destroy,
558 },
559 .connection_id = connection_id,
560 .src_id = src_id,
561 .dst_id = dst_id,
562 .msg_type = msg_type,
563 .attr_list = linked_list_create(),
564 .agent = agent,
565 .state = state,
566 );
567
568 return &this->public;
569 }
570
571 /**
572 * See header
573 */
574 imv_msg_t* imv_msg_create_as_reply(imv_msg_t *msg)
575 {
576 private_imv_msg_t *in;
577 TNC_UInt32 src_id;
578
579 in = (private_imv_msg_t*)msg;
580 src_id = (in->dst_id != TNC_IMVID_ANY) ?
581 in->dst_id : in->agent->get_id(in->agent);
582
583 return imv_msg_create(in->agent, in->state, in->connection_id, src_id,
584 in->src_id, in->msg_type);
585 }
586
587 /**
588 * See header
589 */
590 imv_msg_t *imv_msg_create_from_data(imv_agent_t *agent, imv_state_t *state,
591 TNC_ConnectionID connection_id,
592 TNC_MessageType msg_type,
593 chunk_t msg)
594 {
595 TNC_VendorID msg_vid;
596 TNC_MessageSubtype msg_subtype;
597
598 msg_vid = msg_type >> 8;
599 msg_subtype = msg_type & TNC_SUBTYPE_ANY;
600
601 return imv_msg_create_from_long_data(agent, state, connection_id,
602 TNC_IMCID_ANY, agent->get_id(agent),
603 msg_vid, msg_subtype, msg);
604 }
605
606 /**
607 * See header
608 */
609 imv_msg_t *imv_msg_create_from_long_data(imv_agent_t *agent, imv_state_t *state,
610 TNC_ConnectionID connection_id,
611 TNC_UInt32 src_id,
612 TNC_UInt32 dst_id,
613 TNC_VendorID msg_vid,
614 TNC_MessageSubtype msg_subtype,
615 chunk_t msg)
616 {
617 private_imv_msg_t *this;
618
619 this = (private_imv_msg_t*)imv_msg_create(agent, state,
620 connection_id, src_id, dst_id,
621 pen_type_create(msg_vid, msg_subtype));
622 this->pa_msg = pa_tnc_msg_create_from_data(msg);
623
624 return &this->public;
625 }