log TNC PEP decision with level 0

diff --git a/src/libcharon/plugins/tnc_imv/tnc_imv_manager.c b/src/libcharon/plugins/tnc_imv/tnc_imv_manager.c
index 559de86d044b4f79bab2e12b3531e36964e88a76..cfbda184683bac9d0878a912a5dcf81570cbfe79 100644 (file)
--- a/src/libcharon/plugins/tnc_imv/tnc_imv_manager.c
+++ b/src/libcharon/plugins/tnc_imv/tnc_imv_manager.c
@@ -112,36 +112,56 @@ METHOD(imv_manager_t, create_recommendations, recommendations_t*,
 }
 
 METHOD(imv_manager_t, enforce_recommendation, bool,
-       private_tnc_imv_manager_t *this, TNC_IMV_Action_Recommendation rec)
+       private_tnc_imv_manager_t *this, TNC_IMV_Action_Recommendation rec,
+                                                                        TNC_IMV_Evaluation_Result eval)
 {
        char *group;
        identification_t *id;
        ike_sa_t *ike_sa;
        auth_cfg_t *auth;
+       bool no_access = FALSE;
+
+       DBG1(DBG_TNC, "final recommendation is '%N' and evaluation is '%N'",
+                TNC_IMV_Action_Recommendation_names, rec,
+                TNC_IMV_Evaluation_Result_names, eval);
 
        switch (rec)
        {
                case TNC_IMV_ACTION_RECOMMENDATION_ALLOW:
-                       DBG1(DBG_TNC, "TNC recommendation is allow");
                        group = "allow";
                        break;
                case TNC_IMV_ACTION_RECOMMENDATION_ISOLATE:
-                       DBG1(DBG_TNC, "TNC recommendation is isolate");
                        group = "isolate";
                        break;
                case TNC_IMV_ACTION_RECOMMENDATION_NO_ACCESS:
                case TNC_IMV_ACTION_RECOMMENDATION_NO_RECOMMENDATION:
                default:
-                       DBG1(DBG_TNC, "TNC recommendation is none");
-                       return FALSE;
+                       group = "no access";
+                       no_access = TRUE;
+                       break;
        }
+
        ike_sa = charon->bus->get_sa(charon->bus);
-       if (ike_sa)
+       if (!ike_sa)
+       {
+               DBG1(DBG_TNC, "policy enforcement point did not find IKE_SA");
+               return FALSE;
+       }
+
+       id = ike_sa->get_other_id(ike_sa);
+       DBG0(DBG_TNC, "policy enforced on peer '%Y' is '%s'", id, group);
+
+       if (no_access)
        {
+               return FALSE;
+       }
+       else
+       {       
                auth = ike_sa->get_auth_cfg(ike_sa, FALSE);
                id = identification_create_from_string(group);
                auth->add(auth, AUTH_RULE_GROUP, id);
-               DBG1(DBG_TNC, "TNC added group membership '%s'", group);
+               DBG1(DBG_TNC, "policy enforcement point added group membership '%s'",
+                        group);
        }
        return TRUE;
 }

diff --git a/src/libcharon/plugins/tnccs_11/tnccs_11.c b/src/libcharon/plugins/tnccs_11/tnccs_11.c
index 67ee565c765378709cf364c84d46063f1fdd3861..9d8f00ea8bfee806c8c80da0ad36c4836881442e 100644 (file)
--- a/src/libcharon/plugins/tnccs_11/tnccs_11.c
+++ b/src/libcharon/plugins/tnccs_11/tnccs_11.c
@@ -437,11 +437,7 @@ METHOD(tls_t, is_complete, bool,
 
        if (this->recs && this->recs->have_recommendation(this->recs, &rec, &eval))
        {
-               DBG2(DBG_TNC, "Final recommendation is '%N' and evaluation is '%N'",
-                        TNC_IMV_Action_Recommendation_names, rec,
-                        TNC_IMV_Evaluation_Result_names, eval);
-
-               return charon->imvs->enforce_recommendation(charon->imvs, rec);
+               return charon->imvs->enforce_recommendation(charon->imvs, rec, eval);
        }
        else
        {

diff --git a/src/libcharon/plugins/tnccs_20/tnccs_20.c b/src/libcharon/plugins/tnccs_20/tnccs_20.c
index d8fe57017cc14e6d84e10fe6b7b186484724c704..38ed3aa9b695b515d1dff8083837a3001673b2b1 100644 (file)
--- a/src/libcharon/plugins/tnccs_20/tnccs_20.c
+++ b/src/libcharon/plugins/tnccs_20/tnccs_20.c
@@ -608,11 +608,7 @@ METHOD(tls_t, is_complete, bool,
 
        if (this->recs && this->recs->have_recommendation(this->recs, &rec, &eval))
        {
-               DBG2(DBG_TNC, "Final recommendation is '%N' and evaluation is '%N'",
-                        TNC_IMV_Action_Recommendation_names, rec,
-                        TNC_IMV_Evaluation_Result_names, eval);
-
-               return charon->imvs->enforce_recommendation(charon->imvs, rec);
+               return charon->imvs->enforce_recommendation(charon->imvs, rec, eval);
        }
        else
        {

diff --git a/src/libcharon/tnc/imv/imv_manager.h b/src/libcharon/tnc/imv/imv_manager.h
index b5c581a7538d174e2d130d3fa912db5929111f3f..724d4dcc2fb0264e118996dd89732e9dff8e1512 100644 (file)
--- a/src/libcharon/tnc/imv/imv_manager.h
+++ b/src/libcharon/tnc/imv/imv_manager.h
@@ -67,11 +67,13 @@ struct imv_manager_t {
         * Enforce the TNC recommendation on the IKE_SA by either inserting an
         * allow|isolate group membership rule (TRUE) or by blocking access (FALSE)
         *
-        * @param void                          TNC action recommendation
+        * @param rec                           TNC action recommendation
+        * @param eval                          TNC evaluation result
         * @return                                      TRUE for allow|isolate, FALSE for none
         */
        bool (*enforce_recommendation)(imv_manager_t *this,
-                                                                  TNC_IMV_Action_Recommendation rec);
+                                                                  TNC_IMV_Action_Recommendation rec,
+                                                                  TNC_IMV_Evaluation_Result eval);
 
        /**
         * Notify all IMV instances