Corrected use of PB-TNC CRETRY and SRETRY batches

The PB-TNC finite state machine according to section 3.2 of RFC 5793
was not correctly implemented when sending either a CRETRY or SRETRY
batch. These batches can only be sent in the "Decided" state and a
CRETRY batch can immediately carry all messages usually transported
by a CDATA batch. strongSwan currently is not able to send a SRETRY
batch since full-duplex mode for PT-TLS isn't supported yet.

diff --git a/NEWS b/NEWS
index 384f2dcb0586d6dfb2a7c41d25949bb32119e1ce..a9dec6ad6bd5040766964773a834cc628028a5c2 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -3,6 +3,13 @@ strongswan-5.8.0
 
 - The openssl plugin supports ChaCha20-Poly1305 when built with OpenSSL 1.1.0.
 
+- The PB-TNC finite state machine according to section 3.2 of RFC 5793 was not
+  correctly implemented when sending either a CRETRY or SRETRY batch. These
+  batches can only be sent in the "Decided" state and a CRETRY batch can
+  immediately carry all messages usually transported by a CDATA batch. It is
+  currently not possible to send a SRETRY batch since full-duplex mode for
+  PT-TLS transport is not supported.
+
 
 strongswan-5.7.2
 ----------------

diff --git a/src/libtnccs/plugins/tnccs_20/state_machine/pb_tnc_state_machine.c b/src/libtnccs/plugins/tnccs_20/state_machine/pb_tnc_state_machine.c
index 43f1854403aaddf23c478f5d97c7dd4022a410ab..51ce384532dc6637880c18834da55d7b4fffdbe2 100644 (file)
--- a/src/libtnccs/plugins/tnccs_20/state_machine/pb_tnc_state_machine.c
+++ b/src/libtnccs/plugins/tnccs_20/state_machine/pb_tnc_state_machine.c
@@ -134,15 +134,12 @@ METHOD(pb_tnc_state_machine_t, receive_batch, bool,
                        }
                        return FALSE;
                case PB_STATE_CLIENT_WORKING:
-                       if (this->is_server && type == PB_BATCH_CDATA)
+                       if (this->is_server &&
+                                       (type == PB_BATCH_CDATA || type == PB_BATCH_CRETRY))
                        {
                                this->state = PB_STATE_SERVER_WORKING;
                                break;
                        }
-                       if (this->is_server && type == PB_BATCH_CRETRY)
-                       {
-                               break;
-                       }
                        if (type == PB_BATCH_CLOSE)
                        {
                                this->state = PB_STATE_END;

diff --git a/src/libtnccs/plugins/tnccs_20/tnccs_20_client.c b/src/libtnccs/plugins/tnccs_20/tnccs_20_client.c
index 04e404225e4bd83a68f441fae74e89b0ce5e9ddb..c8fdf0d30bb7ba8b6f8ed281e046df0c803bbf72 100644 (file)
--- a/src/libtnccs/plugins/tnccs_20/tnccs_20_client.c
+++ b/src/libtnccs/plugins/tnccs_20/tnccs_20_client.c
@@ -538,9 +538,19 @@ METHOD(tnccs_20_handler_t, build, status_t,
 
        if (this->request_handshake_retry)
        {
-               if (state != PB_STATE_INIT)
+               if (state == PB_STATE_DECIDED)
                {
+
                        build_retry_batch(this);
+
+                       /* Restart the measurements */
+                       tnc->imcs->notify_connection_change(tnc->imcs,
+                                               this->connection_id, TNC_CONNECTION_STATE_HANDSHAKE);
+                       this->send_msg = TRUE;
+                       this->mutex->unlock(this->mutex);
+                       tnc->imcs->begin_handshake(tnc->imcs, this->connection_id);
+                       this->mutex->lock(this->mutex);
+                       this->send_msg = FALSE;
                }
 
                /* Reset the flag for the next handshake retry request */
@@ -714,7 +724,7 @@ METHOD(tnccs_20_handler_t, add_msg, void,
        {
                this->batch_type = PB_BATCH_CDATA;
        }
-       if (this->batch_type == PB_BATCH_CDATA)
+       if (this->batch_type == PB_BATCH_CDATA || this->batch_type == PB_BATCH_CRETRY)
        {
                this->messages->insert_last(this->messages, msg);
        }

diff --git a/src/libtnccs/plugins/tnccs_20/tnccs_20_server.c b/src/libtnccs/plugins/tnccs_20/tnccs_20_server.c
index 32d950297c4a2569c018fe4f3590de5e5774da6c..44889d7e9cb53d230e0a18870b1683cb29f215c6 100644 (file)
--- a/src/libtnccs/plugins/tnccs_20/tnccs_20_server.c
+++ b/src/libtnccs/plugins/tnccs_20/tnccs_20_server.c
@@ -282,11 +282,6 @@ static void build_retry_batch(private_tnccs_20_server_t *this)
                return;
        }
        change_batch_type(this, PB_BATCH_SRETRY);
-
-       this->recs->clear_recommendation(this->recs);
-
-       /* Handshake will be retried with next incoming CDATA batch */
-       this->retry_handshake = TRUE;
 }
 
 METHOD(tnccs_20_handler_t, process, status_t,
@@ -307,22 +302,13 @@ METHOD(tnccs_20_handler_t, process, status_t,
                pb_tnc_msg_t *msg;
                bool empty = TRUE;
 
-               if (batch_type == PB_BATCH_CDATA)
-               {
-                       /* retry handshake after a previous SRETRY batch */
-                       if (this->retry_handshake)
-                       {
-                               tnc->imvs->notify_connection_change(tnc->imvs,
-                                               this->connection_id, TNC_CONNECTION_STATE_HANDSHAKE);
-                               this->retry_handshake = FALSE;
-                       }
-               }
-               else if (batch_type == PB_BATCH_CRETRY)
+               if (batch_type == PB_BATCH_CRETRY ||
+                  (batch_type == PB_BATCH_CDATA && this->retry_handshake))
                {
-                       /* Send an SRETRY batch in response */
-                       this->mutex->lock(this->mutex);
-                       build_retry_batch(this);
-                       this->mutex->unlock(this->mutex);
+                       this->recs->clear_recommendation(this->recs);
+                       tnc->imvs->notify_connection_change(tnc->imvs,
+                                       this->connection_id, TNC_CONNECTION_STATE_HANDSHAKE);
+                       this->retry_handshake = FALSE;
                }
 
                enumerator = batch->create_msg_enumerator(batch);
@@ -441,9 +427,12 @@ METHOD(tnccs_20_handler_t, build, status_t,
 
        if (this->request_handshake_retry)
        {
-               if (state != PB_STATE_INIT)
+               if (state == PB_STATE_DECIDED)
                {
                        build_retry_batch(this);
+
+                       /* Handshake will be retried with next incoming CDATA batch */
+                       this->retry_handshake = TRUE;
                }
 
                /* Reset the flag for the next handshake retry request */