Project

General

Profile

Software Inventory Message and Attributes for PA-TNC (SWIMA)

Configuring a PT-TLS SWIMA Client

The following HOWTO describes the installation and configuration of a PT-TLS-based SW Client on an Ubuntu 16.04 platform.

Configuring a PT-TLS SWIMA Server

The following HOWTO describes the installation and configuration of a PT-TLS-based Server Daemon on an Ubuntu 16.04 platform.

Starting PT-TLS Server Daemon

The PT-TLS server based on the strongSwan systemd daemon is usually started automatically at boot time with the command

systemctl start strongswan-swanctl

First all the PA-TNC attribute definitions from the IETF, TCG, ITA-HSR and PWG namespaces are loaded. The IMVs to by dynamically loaded are read from /etc/tnc_config.

Jun 22 12:31:28 koala systemd[1]: Starting strongSwan IPsec IKEv1/IKEv2 daemon using swanctl...
Jun 22 12:31:28 koala charon-systemd[12088]: TNC recommendation policy is 'default'
Jun 22 12:31:28 koala charon-systemd[12088]: loading IMVs from '/etc/tnc_config'
Jun 22 12:31:28 koala charon-systemd[12088]: added IETF attributes
Jun 22 12:31:28 koala charon-systemd[12088]: added ITA-HSR attributes
Jun 22 12:31:28 koala charon-systemd[12088]: added PWG attributes
Jun 22 12:31:28 koala charon-systemd[12088]: added TCG attributes
Jun 22 12:31:28 koala charon-systemd[12088]: libimcv initialized

The OS IMV is loaded as a dynamic library and attached to the TNC server.

Jun 22 12:31:28 koala charon-systemd[12088]: IMV 1 "OS" initialized
Jun 22 12:31:28 koala charon-systemd[12088]: IMV 1 supports 1 message type: 'IETF/Operating System' 0x000000/0x00000001
Jun 22 12:31:28 koala charon-systemd[12088]: IMV 1 "OS" loaded from '/usr/lib/ipsec/imcvs/imv-os.so'

The SWIMA IMV is loaded as a dynamic library and attached to the TNC server.

Jun 22 12:31:28 koala charon-systemd[12088]: IMV 2 "SWIMA" initialized
Jun 22 12:31:28 koala charon-systemd[12088]: IMV 2 supports 1 message type: 'IETF/Software' 0x000000/0x00000009
Jun 22 12:31:28 koala charon-systemd[12088]: IMV 2 "SWIMA" loaded from '/usr/lib/ipsec/imcvs/imv-swima.so'

The strongSwan daemon loads all required plugins and goes into multi-threading mode so that multiple PT-TLS connections can be handled

Jun 22 12:31:28 koala charon-systemd[12088]: loaded plugins: charon-systemd charon-systemd random nonce x509 tpm openssl revocation constraints pubkey pkcs1 pkcs8 pkcs12 pem tnc-imv tnc-pdp tnc-tnccs tnccs-20 kernel-netlink socket-default sqlite curl vici
Jun 22 12:31:28 koala charon-systemd[12088]: spawning 16 worker threads

Multiple PT-TLS server and CA certificates are loaded into the daemon

Jun 22 12:31:28 koala charon-systemd[12088]: loaded certificate 'C=CH, O=MSE, OU=TSM_ITSec, CN=mse2.strongswan.org'
Jun 22 12:31:28 koala charon-systemd[12088]: loaded certificate 'C=CH, O=strongSec GmbH, CN=koala.strongsec.com'
Jun 22 12:31:28 koala charon-systemd[12088]: loaded certificate 'C=CH, O=strongSec GmbH, CN=koala.strongsec.com'
Jun 22 12:31:28 koala charon-systemd[12088]: loaded certificate 'C=CH, O=strongSec GmbH, CN=strongSec 2016 Root CA'
Jun 22 12:31:28 koala charon-systemd[12088]: loaded certificate 'C=CH, O=MSE, OU=TSM_ITSec, CN=MSE CA'

The actual loading is done by the swanctl command line tool which transfers the certificates to the daemon via a Unix socket.

Jun 22 12:31:29 koala swanctl[12107]: loaded certificate from '/etc/swanctl/x509/MSE2_Cert.pem'
Jun 22 12:31:29 koala swanctl[12107]: loaded certificate from '/etc/swanctl/x509/koala_AIK_ECC_Cert.pem'
Jun 22 12:31:29 koala swanctl[12107]: loaded certificate from '/etc/swanctl/x509/koala_AIK_RSA_Cert.pem'
Jun 22 12:31:29 koala swanctl[12107]: loaded certificate from '/etc/swanctl/x509ca/strongsecCaCert.pem'
Jun 22 12:31:29 koala swanctl[12107]: loaded certificate from '/etc/swanctl/x509ca/MSE_CA_Cert.pem'

The first server certificate has a matching ECDSA private key loaded from file

Jun 22 12:31:28 koala charon-systemd[12088]: loaded ECDSA private key

The second server certificate has a matching ECDSA key protected by a TPM 2.0

Jun 22 12:31:28 koala charon-systemd[12088]: TPM 2.0 - algorithms: RSA SHA1 HMAC AES MGF1 KEYEDHASH XOR SHA256 RSASSA RSAES RSAPSS OAEP ECDSA ECDH SM2 ECMQV KDF1_SP800_108 ECC SYMCIPHER CTR OFB CBC CFB ECB
Jun 22 12:31:28 koala charon-systemd[12088]: TPM 2.0 - ECC curves: NIST_P256 BN_P256
Jun 22 12:31:28 koala charon-systemd[12088]: TPM 2.0 via TSS2 available
Jun 22 12:31:29 koala charon-systemd[12088]: AIK signature algorithm is ECDSA with SHA256 hash
Jun 22 12:31:29 koala charon-systemd[12088]: loaded ECDSA private key from token

The third server certificate has a matching RSA key protected by a TPM 2.0

Jun 22 12:31:29 koala charon-systemd[12088]: TPM 2.0 - algorithms: RSA SHA1 HMAC AES MGF1 KEYEDHASH XOR SHA256 RSASSA RSAES RSAPSS OAEP ECDSA ECDH SM2 ECMQV KDF1_SP800_108 ECC SYMCIPHER CTR OFB CBC CFB ECB
Jun 22 12:31:29 koala charon-systemd[12088]: TPM 2.0 - ECC curves: NIST_P256 BN_P256
Jun 22 12:31:29 koala charon-systemd[12088]: TPM 2.0 via TSS2 available
Jun 22 12:31:29 koala charon-systemd[12088]: AIK signature algorithm is RSASSA with SHA256 hash
Jun 22 12:31:29 koala charon-systemd[12088]: loaded RSA private key from token

Again it is the swanctl tool which loads the private keys or determines the IDs of keys residing on smartcard or TPM devices.

Jun 22 12:31:29 koala swanctl[12107]: loaded ecdsa key from '/etc/swanctl/ecdsa/MSE2_Key.pem'
Jun 22 12:31:29 koala swanctl[12107]: loaded key token_ak_ecc from token [keyid: 8e70ca6665cd2e6c7893e407cb9a7cd6264d714f]
Jun 22 12:31:29 koala swanctl[12107]: loaded key token_ak_rsa from token [keyid: ce431f647d549f759267422f4097c874e2eca547]

The PT-TLS server is now up and ready to accept connections on the default TCP port 271.

Jun 22 12:31:29 koala systemd[1]: Started strongSwan IPsec IKEv1/IKEv2 daemon using swanctl.

Accepting PT-TLS Client Connection

A PT-TLS client connects to the PT-TLS server and does a TLS 1.2 handshake to establish a secure socket

Jun 22 12:34:56 koala charon-systemd[12088]: accepting PT-TLS stream from 46.126.238.39
Jun 22 12:34:56 koala charon-systemd[12088]: entering PT-TLS negotiation phase
Jun 22 12:34:56 koala charon-systemd[12088]: negotiated TLS 1.2 using suite TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256
Jun 22 12:34:56 koala charon-systemd[12088]: sending TLS server certificate 'C=CH, O=MSE, OU=TSM_ITSec, CN=mse2.strongswan.org'
Jun 22 12:34:56 koala charon-systemd[12088]: sending TLS cert request for 'C=CH, O=MSE, OU=TSM_ITSec, CN=MSE CA'
Jun 22 12:34:56 koala charon-systemd[12088]: sending TLS cert request for 'C=CH, O=strongSec GmbH, CN=strongSec 2016 Root CA'
Jun 22 12:34:56 koala charon-systemd[12088]: received TLS peer certificate 'C=CH, O=strongSec GmbH, CN=brisbane.strongsec.com'
Jun 22 12:34:56 koala charon-systemd[12088]:   using certificate "C=CH, O=strongSec GmbH, CN=brisbane.strongsec.com" 
Jun 22 12:34:56 koala charon-systemd[12088]:   using trusted ca certificate "C=CH, O=strongSec GmbH, CN=strongSec 2016 Root CA" 
Jun 22 12:34:56 koala charon-systemd[12088]: checking certificate status of "C=CH, O=strongSec GmbH, CN=brisbane.strongsec.com" 
Jun 22 12:34:56 koala charon-systemd[12088]:   using trusted certificate "C=CH, O=strongSec GmbH, CN=strongSec 2016 Root CA" 
Jun 22 12:34:56 koala charon-systemd[12088]:   crl correctly signed by "C=CH, O=strongSec GmbH, CN=strongSec 2016 Root CA" 
Jun 22 12:34:56 koala charon-systemd[12088]:   crl is valid: until Jun 25 10:00:01 2017
Jun 22 12:34:56 koala charon-systemd[12088]:   using cached crl
Jun 22 12:34:56 koala charon-systemd[12088]:   using trusted certificate "C=CH, O=strongSec GmbH, CN=strongSec 2016 Root CA" 
Jun 22 12:34:56 koala charon-systemd[12088]:   crl correctly signed by "C=CH, O=strongSec GmbH, CN=strongSec 2016 Root CA" 
Jun 22 12:34:56 koala charon-systemd[12088]:   crl is valid: until Jun 23 10:00:01 2017
Jun 22 12:34:56 koala charon-systemd[12088]:   using cached crl
Jun 22 12:34:56 koala charon-systemd[12088]: certificate status is good
Jun 22 12:34:56 koala charon-systemd[12088]:   reached self-signed root ca with a path length of 0

The PT-TLS protocol is started skipping SASL-based client authentication because the client already authenticated itself during the TLS handshake.

Jun 22 12:34:56 koala charon-systemd[12088]: received PT-TLS message #0 of type 'Version Request' (20 bytes)
Jun 22 12:34:56 koala charon-systemd[12088]: sending PT-TLS message #0 of type 'Version Response' (20 bytes)
Jun 22 12:34:56 koala charon-systemd[12088]: negotiated PT-TLS version 1
Jun 22 12:34:56 koala charon-systemd[12088]: doing SASL client authentication
Jun 22 12:34:56 koala charon-systemd[12088]: skipping SASL, client already authenticated by TLS certificate
Jun 22 12:34:56 koala charon-systemd[12088]: sending PT-TLS message #1 of type 'SASL Mechanisms' (16 bytes)

The PT-TLS protocol switches to the data transport phase and a TNCCS (PB-TNC) connection is instantiated

Jun 22 12:34:56 koala charon-systemd[12088]: entering PT-TLS data transport phase
Jun 22 12:34:57 koala charon-systemd[12088]: received PT-TLS message #1 of type 'PB-TNC Batch' (337 bytes)
Jun 22 12:34:57 koala charon-systemd[12088]: assigned TNCCS Connection ID 1

An OS IMV instance is created for this PB-TNC connection

Jun 22 12:34:57 koala charon-systemd[12088]: IMV 1 "OS" created a state for IF-TNCCS 2.0 Connection ID 1: +long +excl -soh
Jun 22 12:34:57 koala charon-systemd[12088]:   over IF-T for TLS 2.0 with maximum PA-TNC message size of 131024 bytes
Jun 22 12:34:57 koala charon-systemd[12088]:   user AR identity 'C=CH, O=strongSec GmbH, CN=brisbane.strongsec.com' of type X.500 DN authenticated by certificate
Jun 22 12:34:57 koala charon-systemd[12088]:   machine AR identity '46.126.238.39' of type IPv4 address authenticated by unknown method

A SWIMA IMV instance is created for this PB-TNC connection

Jun 22 12:34:57 koala charon-systemd[12088]: IMV 2 "SWIMA" created a state for IF-TNCCS 2.0 Connection ID 1: +long +excl -soh
Jun 22 12:34:57 koala charon-systemd[12088]:   over IF-T for TLS 2.0 with maximum PA-TNC message size of 131024 bytes

The PB-TNC connection is now initialized and goes into Handshake mode

Jun 22 12:34:57 koala charon-systemd[12088]: IMV 1 "OS" changed state of Connection ID 1 to 'Handshake'
Jun 22 12:34:57 koala charon-systemd[12088]: IMV 2 "SWIMA" changed state of Connection ID 1 to 'Handshake'

The first PB-TNC client batch is received containing two PA-TNC messages

Jun 22 12:34:57 koala charon-systemd[12088]: received TNCCS batch (321 bytes)
Jun 22 12:34:57 koala charon-systemd[12088]: TNC server is handling inbound connection
Jun 22 12:34:57 koala charon-systemd[12088]: processing PB-TNC CDATA batch for Connection ID 1
Jun 22 12:34:57 koala charon-systemd[12088]: PB-TNC state transition from 'Init' to 'Server Working'
Jun 22 12:34:57 koala charon-systemd[12088]: processing IETF/PB-Language-Preference message (31 bytes)
Jun 22 12:34:57 koala charon-systemd[12088]: processing IETF/PB-PA message (230 bytes)
Jun 22 12:34:57 koala charon-systemd[12088]: processing IETF/PB-PA message (52 bytes)
Jun 22 12:34:57 koala charon-systemd[12088]: setting language preference to 'en'

The first PA-TNC message is of type IETF / Operating System and contains some IETF standard attributes sent by the OS IMC

Jun 22 12:34:57 koala charon-systemd[12088]: handling PB-PA message type 'IETF/Operating System' 0x000000/0x00000001
Jun 22 12:34:57 koala charon-systemd[12088]: IMV 1 "OS" received message for Connection ID 1 from IMC 1
Jun 22 12:34:57 koala charon-systemd[12088]: => 206 bytes @ 0x7ff810004f10
                                                0: 01 00 00 00 6F 69 67 01 00 00 00 00 00 00 00 02  ....oig.........
                                               16: 00 00 00 17 00 71 32 00 00 55 62 75 6E 74 75 00  .....q2..Ubuntu.
                                               32: 00 00 00 00 00 00 04 00 00 00 1B 0C 31 36 2E 30  ............16.0
                                               48: 34 20 78 38 36 5F 36 34 00 00 00 00 00 00 00 00  4 x86_64........
                                               64: 00 03 00 00 00 1C 00 00 00 10 00 00 00 04 00 00  ................
                                               80: 00 00 00 00 00 00 00 00 00 00 00 00 00 05 00 00  ................
                                               96: 00 24 03 01 00 00 32 30 31 37 2D 30 36 2D 31 39  .$....2017-06-19
                                              112: 54 31 34 3A 31 38 3A 33 35 5A 00 00 00 00 00 00  T14:18:35Z......
                                              128: 00 0B 00 00 00 10 00 00 00 01 00 00 00 00 00 00  ................
                                              144: 00 0C 00 00 00 10 00 00 00 00 00 00 90 2A 00 00  .............*..
                                              160: 00 08 00 00 00 34 35 64 39 35 30 32 31 33 39 36  .....45d95021396
                                              176: 64 32 34 31 35 65 35 63 35 33 63 61 32 64 65 61  d2415e5c53ca2dea
                                              192: 36 66 62 63 31 63 32 33 38 37 63 35 36 61        6fbc1c2387c56a
Jun 22 12:34:57 koala charon-systemd[12088]: processing PA-TNC message with ID 0x6f696701
Jun 22 12:34:57 koala charon-systemd[12088]: processing PA-TNC attribute type 'IETF/Product Information' 0x000000/0x00000002
Jun 22 12:34:57 koala charon-systemd[12088]: processing PA-TNC attribute type 'IETF/String Version' 0x000000/0x00000004
Jun 22 12:34:57 koala charon-systemd[12088]: processing PA-TNC attribute type 'IETF/Numeric Version' 0x000000/0x00000003
Jun 22 12:34:57 koala charon-systemd[12088]: processing PA-TNC attribute type 'IETF/Operational Status' 0x000000/0x00000005
Jun 22 12:34:57 koala charon-systemd[12088]: processing PA-TNC attribute type 'IETF/Forwarding Enabled' 0x000000/0x0000000b
Jun 22 12:34:57 koala charon-systemd[12088]: processing PA-TNC attribute type 'IETF/Factory Default Password Enabled' 0x000000/0x0000000c
Jun 22 12:34:57 koala charon-systemd[12088]: processing PA-TNC attribute type 'ITA-HSR/Device ID' 0x00902a/0x00000008

This is the OS information contained in the PA-TNC attributes

Jun 22 12:34:57 koala charon-systemd[12088]: operating system name is 'Ubuntu' from vendor Canonical
Jun 22 12:34:57 koala charon-systemd[12088]: operating system version is '16.04 x86_64'
Jun 22 12:34:57 koala charon-systemd[12088]: operating system numeric version is 16.4
Jun 22 12:34:57 koala charon-systemd[12088]: operational status: operational, result: successful
Jun 22 12:34:57 koala charon-systemd[12088]: last boot: Jun 19 14:18:35 UTC 2017
Jun 22 12:34:57 koala charon-systemd[12088]: IPv4 forwarding is enabled
Jun 22 12:34:57 koala charon-systemd[12088]: factory default password is disabled
Jun 22 12:34:57 koala charon-systemd[12088]: device ID is 5d95021396d2415e5c53ca2dea6fbc1c2387c56a

The second PA-TNC message is of type IETF / Software and contains a PA-TNC segmentation contract request

Jun 22 12:34:57 koala charon-systemd[12088]: handling PB-PA message type 'IETF/Software' 0x000000/0x00000009
Jun 22 12:34:57 koala charon-systemd[12088]: IMV 2 "SWIMA" received message for Connection ID 1 from IMC 2
Jun 22 12:34:57 koala charon-systemd[12088]: => 28 bytes @ 0x7ff810005860
                                                0: 01 00 00 00 19 74 B7 4E 00 00 55 97 00 00 00 21  .....t.N..U....!
                                               16: 00 00 00 14 00 98 96 80 00 01 FF B8              ............
Jun 22 12:34:57 koala charon-systemd[12088]: processing PA-TNC message with ID 0x1974b74e
Jun 22 12:34:57 koala charon-systemd[12088]: processing PA-TNC attribute type 'TCG/Max Attribute Size Request' 0x005597/0x00000021

This is the decoded segmentation contract request

Jun 22 12:34:57 koala charon-systemd[12088]: IMV 2 received a segmentation contract request from IMC 2 for PA message type 'IETF/Software' 0x000000/0x00000009
                                               maximum attribute size of 10000000 bytes with maximum segment size of 131000 bytes

Jun 22 12:34:57 koala charon-systemd[12088]: creating PA-TNC message with ID 0xa41e0787
Jun 22 12:34:57 koala charon-systemd[12088]: creating PA-TNC attribute type 'TCG/Max Attribute Size Response' 0x005597/0x00000022
Jun 22 12:34:57 koala charon-systemd[12088]: created PA-TNC message: => 28 bytes @ 0x7ff810000a00
                                                0: 01 00 00 00 A4 1E 07 87 00 00 55 97 00 00 00 22  ..........U...." 
                                               16: 00 00 00 14 00 98 96 80 00 01 FF B8              ............
Jun 22 12:34:57 koala charon-systemd[12088]: creating PB-PA message type 'IETF/Software' 0x000000/0x00000009

The OS IMV also sends a segmentation contract request for PA message type IETF / Operating System

Jun 22 12:34:57 koala charon-systemd[12088]: IMV 1 requests a segmentation contract for PA message type 'IETF/Operating System' 0x000000/0x00000001
                                               maximum attribute size of 100000000 bytes with maximum segment size of 131000 bytes

The strongTNC policy manager assigns a session ID and issues a single SWIDT workitem

Jun 22 12:34:57 koala charon-systemd[12088]: assigned session ID 2 to Connection ID 1
Jun 22 12:34:57 koala charon-systemd[12088]: running policy script: 2>&1 ipsec imv_policy_manager start 2
Jun 22 12:34:57 koala charon-systemd[12088]: policy: imv_policy_manager start successful
Jun 22 12:34:57 koala charon-systemd[12088]: SWIDT workitem 9

The OS IMV has not been assigned any work items by the policy manager and therefore terminates gracefully

Jun 22 12:34:57 koala charon-systemd[12088]: IMV 1 has no workitems - no evaluation requested
Jun 22 12:34:57 koala charon-systemd[12088]: creating PA-TNC message with ID 0x916d188f
Jun 22 12:34:57 koala charon-systemd[12088]: creating PA-TNC attribute type 'IETF/Assessment Result' 0x000000/0x00000009
Jun 22 12:34:57 koala charon-systemd[12088]: creating PA-TNC attribute type 'IETF/Remediation Instructions' 0x000000/0x0000000a
Jun 22 12:34:57 koala charon-systemd[12088]: created PA-TNC message: => 117 bytes @ 0x7ff810004f20
                                                0: 01 00 00 00 91 6D 18 8F 00 00 00 00 00 00 00 09  .....m..........
                                               16: 00 00 00 10 00 00 00 04 00 00 00 00 00 00 00 0A  ................
                                               32: 00 00 00 5D 00 00 00 00 00 00 00 02 00 00 00 42  ...]...........B
                                               48: 49 50 20 50 61 63 6B 65 74 20 46 6F 72 77 61 72  IP Packet Forwar
                                               64: 64 69 6E 67 0A 20 20 50 6C 65 61 73 65 20 64 69  ding.  Please di
                                               80: 73 61 62 6C 65 20 74 68 65 20 66 6F 72 77 61 72  sable the forwar
                                               96: 64 69 6E 67 20 6F 66 20 49 50 20 70 61 63 6B 65  ding of IP packe
                                              112: 74 73 02 65 6E                                   ts.en
Jun 22 12:34:57 koala charon-systemd[12088]: creating PB-PA message type 'IETF/Operating System' 0x000000/0x00000001
Jun 22 12:34:57 koala charon-systemd[12088]: IMV 1 provides recommendation 'allow' and evaluation 'don't know'

The SWIMA IMV sends a segmentation contract request for PA message type IETF / Software as well

Jun 22 12:34:57 koala charon-systemd[12088]: IMV 2 requests a segmentation contract for PA message type 'IETF/Software' 0x000000/0x00000009
                                               maximum attribute size of 10000000 bytes with maximum segment size of 131000 bytes

Sending IETF SW Request Attribute

The SWIMA IMV is responsible for the SWIDT workitem and issues an IETF / SW Request attribute

Jun 22 12:34:57 koala charon-systemd[12088]: IMV 2 handles SWIDT workitem 9
Jun 22 12:34:57 koala charon-systemd[12088]: IMV 2 issues sw request 9
Jun 22 12:34:57 koala charon-systemd[12088]: creating PA-TNC message with ID 0xeaeacdc3
Jun 22 12:34:57 koala charon-systemd[12088]: creating PA-TNC attribute type 'TCG/Max Attribute Size Request' 0x005597/0x00000021
Jun 22 12:34:57 koala charon-systemd[12088]: creating PA-TNC attribute type 'IETF/SW Request' 0x000000/0x00000011
Jun 22 12:34:57 koala charon-systemd[12088]: created PA-TNC message: => 52 bytes @ 0x7ff810005550
                                                0: 01 00 00 00 EA EA CD C3 00 00 55 97 00 00 00 21  ..........U....!
                                               16: 00 00 00 14 00 98 96 80 00 01 FF B8 00 00 00 00  ................
                                               32: 00 00 00 11 00 00 00 18 20 00 00 00 00 00 00 09  ........ .......
                                               48: 00 00 00 00                                      ....
Jun 22 12:34:57 koala charon-systemd[12088]: creating PB-PA message type 'IETF/Software' 0x000000/0x00000009

The first Server DATA batch is sent to the TNC Client

Jun 22 12:34:57 koala charon-systemd[12088]: TNC server is handling outbound connection
Jun 22 12:34:57 koala charon-systemd[12088]: PB-TNC state transition from 'Server Working' to 'Client Working'
Jun 22 12:34:57 koala charon-systemd[12088]: creating PB-TNC SDATA batch
Jun 22 12:34:57 koala charon-systemd[12088]: adding IETF/PB-PA message
Jun 22 12:34:57 koala charon-systemd[12088]: adding IETF/PB-PA message
Jun 22 12:34:57 koala charon-systemd[12088]: adding IETF/PB-PA message
Jun 22 12:34:57 koala charon-systemd[12088]: sending PB-TNC SDATA batch (277 bytes) for Connection ID 1
Jun 22 12:34:57 koala charon-systemd[12088]: sending PT-TLS message #2 of type 'PB-TNC Batch' (293 bytes)

Receiving IETF SW Identity Inventory Attribute

A Client DATA batch has been received

Jun 22 12:34:57 koala charon-systemd[12088]: received PT-TLS message #2 of type 'PB-TNC Batch' (131072 bytes)
Jun 22 12:34:57 koala charon-systemd[12088]: received TNCCS batch (131056 bytes)
Jun 22 12:34:57 koala charon-systemd[12088]: TNC server is handling inbound connection
Jun 22 12:34:57 koala charon-systemd[12088]: processing PB-TNC CDATA batch for Connection ID 1
Jun 22 12:34:57 koala charon-systemd[12088]: PB-TNC state transition from 'Client Working' to 'Server Working'
Jun 22 12:34:57 koala charon-systemd[12088]: processing IETF/PB-PA message (131048 bytes)
Jun 22 12:34:57 koala charon-systemd[12088]: handling PB-PA message type 'IETF/Software' 0x000000/0x00000009
Jun 22 12:34:57 koala charon-systemd[12088]: IMV 2 "SWIMA" received message for Connection ID 1 from IMC 2 to IMV 2
Jun 22 12:34:57 koala charon-systemd[12088]: => 131024 bytes @ 0x7ff820090960
                                                  0: 01 00 00 00 AC 4D 42 7A 00 00 55 97 00 00 00 22  .....MBz..U...." 
                                                 16: 00 00 00 14 00 98 96 80 00 01 FF B8 00 00 55 97  ..............U.
                                                 32: 00 00 00 23 00 01 FF B4 C0 00 00 01 00 00 00 00  ...#............
                                                 48: 00 00 00 12 00 02 88 84 00 00 08 01 00 00 00 09  ................
                                                 64: 3B 8A 77 A3 00 00 00 A1 00 00 0A CF 00 00 00 01  ;.w.............
                                                 80: 01 00 00 52 73 74 72 6F 6E 67 73 77 61 6E 2E 6F  ...Rstrongswan.o
                                                 96: 72 67 5F 5F 55 62 75 6E 74 75 5F 31 36 2E 30 34  rg__Ubuntu_16.04
                                                112: 2D 78 38 36 5F 36 34 2D 61 31 31 79 2D 70 72 6F  -x86_64-a11y-pro
                                                128: 66 69 6C 65 2D 6D 61 6E 61 67 65 72 2D 69 6E 64  file-manager-ind
                                                144: 69 63 61 74 6F 72 2D 30 2E 31 2E 31 30 2D 30 75  icator-0.1.10-0u
                                                160: 62 75 6E 74 75 33 00 00 00 00 0A D0 00 00 00 01  buntu3..........
                                                176: 01 00 00 58 73 74 72 6F 6E 67 73 77 61 6E 2E 6F  ...Xstrongswan.o
                                                192: 72 67 5F 5F 55 62 75 6E 74 75 5F 31 36 2E 30 34  rg__Ubuntu_16.04
                                                208: 2D 78 38 36 5F 36 34 2D 61 63 63 6F 75 6E 74 2D  -x86_64-account-
                                                224: 70 6C 75 67 69 6E 2D 66 61 63 65 62 6F 6F 6B 2D  plugin-facebook-
                                                240: 30 2E 31 32 7E 31 36 2E 30 34 2E 32 30 31 36 30  0.12~16.04.20160
                                                256: 31 32 36 2D 30 75 62 75 6E 74 75 31 00 00 00 00  126-0ubuntu1....
                                                272: 0A D1 00 00 00 01 01 00 00 56 73 74 72 6F 6E 67  .........Vstrong
                                                288: 73 77 61 6E 2E 6F 72 67 5F 5F 55 62 75 6E 74 75  swan.org__Ubuntu
                                                304: 5F 31 36 2E 30 34 2D 78 38 36 5F 36 34 2D 61 63  _16.04-x86_64-ac
                                                320: 63 6F 75 6E 74 2D 70 6C 75 67 69 6E 2D 66 6C 69  count-plugin-fli
                                                336: 63 6B 72 2D 30 2E 31 32 7E 31 36 2E 30 34 2E 32  ckr-0.12~16.04.2
                                                352: 30 31 36 30 31 32 36 2D 30 75 62 75 6E 74 75 31  0160126-0ubuntu1
                                                368: 00 00 00 00 0A D2 00 00 00 01 01 00 00 56 73 74  .............Vst
                                                384: 72 6F 6E 67 73 77 61 6E 2E 6F 72 67 5F 5F 55 62  rongswan.org__Ub
                                                400: 75 6E 74 75 5F 31 36 2E 30 34 2D 78 38 36 5F 36  untu_16.04-x86_6
                                                416: 34 2D 61 63 63 6F 75 6E 74 2D 70 6C 75 67 69 6E  4-account-plugin
                                                432: 2D 67 6F 6F 67 6C 65 2D 30 2E 31 32 7E 31 36 2E  -google-0.12~16.
                                                448: 30 34 2E 32 30 31 36 30 31 32 36 2D 30 75 62 75  04.20160126-0ubu
                                                464: 6E 74 75 31 00 00 00 00 06 2E 00 00 00 01 01 00  ntu1............
                                                ...
                                             130656: 00 00 00 01 01 00 00 4A 73 74 72 6F 6E 67 73 77  .......Jstrongsw
                                             130672: 61 6E 2E 6F 72 67 5F 5F 55 62 75 6E 74 75 5F 31  an.org__Ubuntu_1
                                             130688: 36 2E 30 34 2D 78 38 36 5F 36 34 2D 70 72 69 6E  6.04-x86_64-prin
                                             130704: 74 65 72 2D 64 72 69 76 65 72 2D 68 70 63 75 70  ter-driver-hpcup
                                             130720: 73 2D 33 2E 31 36 2E 33 7E 72 65 70 61 63 6B 30  s-3.16.3~repack0
                                             130736: 2D 31 00 00 00 00 0E D8 00 00 00 01 01 00 00 43  -1.............C
                                             130752: 73 74 72 6F 6E 67 73 77 61 6E 2E 6F 72 67 5F 5F  strongswan.org__
                                             130768: 55 62 75 6E 74 75 5F 31 36 2E 30 34 2D 78 38 36  Ubuntu_16.04-x86
                                             130784: 5F 36 34 2D 70 72 69 6E 74 65 72 2D 64 72 69 76  _64-printer-driv
                                             130800: 65 72 2D 6D 69 6E 31 32 78 78 77 2D 30 2E 30 2E  er-min12xxw-0.0.
                                             130816: 39 2D 39 00 00 00 00 0E D9 00 00 00 01 01 00 00  9-9.............
                                             130832: 4F 73 74 72 6F 6E 67 73 77 61 6E 2E 6F 72 67 5F  Ostrongswan.org_
                                             130848: 5F 55 62 75 6E 74 75 5F 31 36 2E 30 34 2D 78 38  _Ubuntu_16.04-x8
                                             130864: 36 5F 36 34 2D 70 72 69 6E 74 65 72 2D 64 72 69  6_64-printer-dri
                                             130880: 76 65 72 2D 70 6E 6D 32 70 70 61 2D 31 2E 31 33  ver-pnm2ppa-1.13
                                             130896: 7E 6E 6F 6E 64 62 73 2D 30 75 62 75 6E 74 75 35  ~nondbs-0ubuntu5
                                             130912: 00 00 00 00 0E DA 00 00 00 01 01 00 00 51 73 74  .............Qst
                                             130928: 72 6F 6E 67 73 77 61 6E 2E 6F 72 67 5F 5F 55 62  rongswan.org__Ub
                                             130944: 75 6E 74 75 5F 31 36 2E 30 34 2D 78 38 36 5F 36  untu_16.04-x86_6
                                             130960: 34 2D 70 72 69 6E 74 65 72 2D 64 72 69 76 65 72  4-printer-driver
                                             130976: 2D 70 6F 73 74 73 63 72 69 70 74 2D 68 70 2D 33  -postscript-hp-3
                                             130992: 2E 31 36 2E 33 7E 72 65 70 61 63 6B 30 2D 31 00  .16.3~repack0-1.
                                             131008: 00 00 00 0E DB 00 00 00 01 01 00 00 3F 73 74 72  ............?str
Jun 22 12:34:57 koala charon-systemd[12088]: processing PA-TNC message with ID 0xac4d427a
Jun 22 12:34:57 koala charon-systemd[12088]: processing PA-TNC attribute type 'TCG/Max Attribute Size Response' 0x005597/0x00000022
Jun 22 12:34:57 koala charon-systemd[12088]: processing PA-TNC attribute type 'TCG/Attribute Segment Envelope' 0x005597/0x00000023

The SWIMA IMC accepted the segmentation contract

Jun 22 12:34:57 koala charon-systemd[12088]: IMV 2 received a segmentation contract response from IMC 2 for PA message type 'IETF/Software' 0x000000/0x00000009
                                               maximum attribute size of 10000000 bytes with maximum segment size of 131000 bytes

The first 128k segment of an IETF / Software message has been received

Jun 22 12:34:57 koala charon-systemd[12088]: received first segment for base attribute ID 1 (130980 bytes)
Jun 22 12:34:57 koala charon-systemd[12088]: processing PA-TNC attribute type 'IETF/SW Identifier Inventory' 0x000000/0x00000012
Jun 22 12:34:57 koala charon-systemd[12088]: 3 bytes insufficient to parse 63 bytes of data

1646 complete software identifiers including their record ID were received in the first segment, 424 identifiers are to follow

Jun 22 12:34:57 koala charon-systemd[12088]: received software identity inventory with 1625 items for request 9 at eid 161 of epoch 0x3b8a77a3, 424 items to follow
Jun 22 12:34:57 koala charon-systemd[12088]:   2767: strongswan.org__Ubuntu_16.04-x86_64-a11y-profile-manager-indicator-0.1.10-0ubuntu3
Jun 22 12:34:57 koala charon-systemd[12088]:   2768: strongswan.org__Ubuntu_16.04-x86_64-account-plugin-facebook-0.12~16.04.20160126-0ubuntu1
Jun 22 12:34:57 koala charon-systemd[12088]:   2769: strongswan.org__Ubuntu_16.04-x86_64-account-plugin-flickr-0.12~16.04.20160126-0ubuntu1
Jun 22 12:34:57 koala charon-systemd[12088]:   2770: strongswan.org__Ubuntu_16.04-x86_64-account-plugin-google-0.12~16.04.20160126-0ubuntu1
...
Jun 22 12:34:57 koala charon-systemd[12088]:   3799: strongswan.org__Ubuntu_16.04-x86_64-printer-driver-hpcups-3.16.3~repack0-1
Jun 22 12:34:57 koala charon-systemd[12088]:   3800: strongswan.org__Ubuntu_16.04-x86_64-printer-driver-min12xxw-0.0.9-9
Jun 22 12:34:57 koala charon-systemd[12088]:   3801: strongswan.org__Ubuntu_16.04-x86_64-printer-driver-pnm2ppa-1.13~nondbs-0ubuntu5
Jun 22 12:34:57 koala charon-systemd[12088]:   3802: strongswan.org__Ubuntu_16.04-x86_64-printer-driver-postscript-hp-3.16.3~repack0-1

The SWIMA IMV requests the next segment of the IETF / Software message

Jun 22 12:34:57 koala charon-systemd[12088]: creating PA-TNC message with ID 0x41ff7fe5
Jun 22 12:34:57 koala charon-systemd[12088]: creating PA-TNC attribute type 'TCG/Next Segment Request' 0x005597/0x00000024
Jun 22 12:34:57 koala charon-systemd[12088]: created PA-TNC message: => 24 bytes @ 0x7ff82015ae30
                                                0: 01 00 00 00 41 FF 7F E5 00 00 55 97 00 00 00 24  ....A.....U....$
                                               16: 00 00 00 10 00 00 00 01                          ........
Jun 22 12:34:57 koala charon-systemd[12088]: creating PB-PA message type 'IETF/Software' 0x000000/0x00000009
Jun 22 12:34:57 koala charon-systemd[12088]: TNC server is handling outbound connection
Jun 22 12:34:57 koala charon-systemd[12088]: PB-TNC state transition from 'Server Working' to 'Client Working'
Jun 22 12:34:57 koala charon-systemd[12088]: creating PB-TNC SDATA batch
Jun 22 12:34:57 koala charon-systemd[12088]: adding IETF/PB-PA message
Jun 22 12:34:57 koala charon-systemd[12088]: sending PB-TNC SDATA batch (56 bytes) for Connection ID 1
Jun 22 12:34:57 koala charon-systemd[12088]: sending PT-TLS message #3 of type 'PB-TNC Batch' (72 bytes)

The second and last segment of the IETF / Software message has been received

Jun 22 12:34:57 koala charon-systemd[12088]: received PT-TLS message #3 of type 'PB-TNC Batch' (35112 bytes)
Jun 22 12:34:57 koala charon-systemd[12088]: received TNCCS batch (35096 bytes)
Jun 22 12:34:57 koala charon-systemd[12088]: TNC server is handling inbound connection
Jun 22 12:34:57 koala charon-systemd[12088]: processing PB-TNC CDATA batch for Connection ID 1
Jun 22 12:34:57 koala charon-systemd[12088]: PB-TNC state transition from 'Client Working' to 'Server Working'
Jun 22 12:34:57 koala charon-systemd[12088]: processing IETF/PB-PA message (35088 bytes)
Jun 22 12:34:57 koala charon-systemd[12088]: handling PB-PA message type 'IETF/Software' 0x000000/0x00000009
Jun 22 12:34:57 koala charon-systemd[12088]: IMV 2 "SWIMA" received message for Connection ID 1 from IMC 2 to IMV 2
Jun 22 12:34:57 koala charon-systemd[12088]: => 35064 bytes @ 0x7ff81802afa0
                                                 0: 01 00 00 00 C4 99 91 00 00 00 55 97 00 00 00 23  ..........U....#
                                                16: 00 00 88 F0 00 00 00 01 6F 6E 67 73 77 61 6E 2E  ........ongswan.
                                                32: 6F 72 67 5F 5F 55 62 75 6E 74 75 5F 31 36 2E 30  org__Ubuntu_16.0
                                                48: 34 2D 78 38 36 5F 36 34 2D 70 72 69 6E 74 65 72  4-x86_64-printer
                                                64: 2D 64 72 69 76 65 72 2D 70 74 6F 75 63 68 2D 31  -driver-ptouch-1
                                                80: 2E 34 2D 31 00 00 00 00 0E DC 00 00 00 01 01 00  .4-1............
                                                96: 00 46 73 74 72 6F 6E 67 73 77 61 6E 2E 6F 72 67  .Fstrongswan.org
                                               112: 5F 5F 55 62 75 6E 74 75 5F 31 36 2E 30 34 2D 78  __Ubuntu_16.04-x
                                               128: 38 36 5F 36 34 2D 70 72 69 6E 74 65 72 2D 64 72  86_64-printer-dr
                                               144: 69 76 65 72 2D 70 78 6C 6A 72 2D 31 2E 34 7E 72  iver-pxljr-1.4~r
                                               160: 65 70 61 63 6B 30 2D 34 00 00 00 00 0E DD 00 00  epack0-4........
                                               176: 00 01 01 00 00 47 73 74 72 6F 6E 67 73 77 61 6E  .....Gstrongswan
                                               192: 2E 6F 72 67 5F 5F 55 62 75 6E 74 75 5F 31 36 2E  .org__Ubuntu_16.
                                               208: 30 34 2D 78 38 36 5F 36 34 2D 70 72 69 6E 74 65  04-x86_64-printe
                                               224: 72 2D 64 72 69 76 65 72 2D 73 61 67 2D 67 64 69  r-driver-sag-gdi
                                               240: 2D 30 2E 31 2D 34 75 62 75 6E 74 75 31 00 00 00  -0.1-4ubuntu1...
                                               256: 00 0E DE 00 00 00 01 01 00 00 50 73 74 72 6F 6E  ..........Pstron
                                               272: 67 73 77 61 6E 2E 6F 72 67 5F 5F 55 62 75 6E 74  gswan.org__Ubunt
                                               288: 75 5F 31 36 2E 30 34 2D 78 38 36 5F 36 34 2D 70  u_16.04-x86_64-p
                                               304: 72 69 6E 74 65 72 2D 64 72 69 76 65 72 2D 73 70  rinter-driver-sp
                                               320: 6C 69 78 2D 32 2E 30 2E 30 7E 73 76 6E 33 31 35  lix-2.0.0~svn315
                                               336: 2D 34 66 61 6B 65 73 79 6E 63 31 00 00 00 00 06  -4fakesync1.....
                                               ...                                               
                                             34688: 75 32 00 00 00 00 0F E0 00 00 00 01 01 00 00 43  u2.............C
                                             34704: 73 74 72 6F 6E 67 73 77 61 6E 2E 6F 72 67 5F 5F  strongswan.org__
                                             34720: 55 62 75 6E 74 75 5F 31 36 2E 30 34 2D 78 38 36  Ubuntu_16.04-x86
                                             34736: 5F 36 34 2D 7A 65 6E 69 74 79 2D 63 6F 6D 6D 6F  _64-zenity-commo
                                             34752: 6E 2D 33 2E 31 38 2E 31 2E 31 2D 31 75 62 75 6E  n-3.18.1.1-1ubun
                                             34768: 74 75 32 00 00 00 00 0F E1 00 00 00 01 01 00 00  tu2.............
                                             34784: 2E 73 74 72 6F 6E 67 73 77 61 6E 2E 6F 72 67 5F  .strongswan.org_
                                             34800: 5F 55 62 75 6E 74 75 5F 31 36 2E 30 34 2D 78 38  _Ubuntu_16.04-x8
                                             34816: 36 5F 36 34 2D 7A 69 70 2D 33 2E 30 2D 31 31 00  6_64-zip-3.0-11.
                                             34832: 00 00 00 09 D2 00 00 00 01 01 00 00 42 73 74 72  ............Bstr
                                             34848: 6F 6E 67 73 77 61 6E 2E 6F 72 67 5F 5F 55 62 75  ongswan.org__Ubu
                                             34864: 6E 74 75 5F 31 36 2E 30 34 2D 78 38 36 5F 36 34  ntu_16.04-x86_64
                                             34880: 2D 7A 6C 69 62 31 67 2D 31 7E 31 2E 32 2E 38 2E  -zlib1g-1~1.2.8.
                                             34896: 64 66 73 67 2D 32 75 62 75 6E 74 75 34 2E 31 00  dfsg-2ubuntu4.1.
                                             34912: 00 00 00 09 D9 00 00 00 01 01 00 00 46 73 74 72  ............Fstr
                                             34928: 6F 6E 67 73 77 61 6E 2E 6F 72 67 5F 5F 55 62 75  ongswan.org__Ubu
                                             34944: 6E 74 75 5F 31 36 2E 30 34 2D 78 38 36 5F 36 34  ntu_16.04-x86_64
                                             34960: 2D 7A 6C 69 62 31 67 2D 64 65 76 2D 31 7E 31 2E  -zlib1g-dev-1~1.
                                             34976: 32 2E 38 2E 64 66 73 67 2D 32 75 62 75 6E 74 75  2.8.dfsg-2ubuntu
                                             34992: 34 2E 31 00 00 00 00 00 00 00 00 00 01 02 00 00  4.1.............
                                             35008: 20 73 74 72 6F 6E 67 73 77 61 6E 2E 6F 72 67 5F   strongswan.org_
                                             35024: 5F 73 74 72 6F 6E 67 53 77 61 6E 2D 35 2D 35 2D  _strongSwan-5-5-
                                             35040: 33 00 15 2F 75 73 72 2F 73 68 61 72 65 2F 73 74  3../usr/share/st
                                             35056: 72 6F 6E 67 73 77 61 6E                          rongswan
Jun 22 12:34:57 koala charon-systemd[12088]: processing PA-TNC message with ID 0xc4999100
Jun 22 12:34:57 koala charon-systemd[12088]: processing PA-TNC attribute type 'TCG/Attribute Segment Envelope' 0x005597/0x00000023
Jun 22 12:34:57 koala charon-systemd[12088]: received last segment for base attribute ID 1 (35040 bytes)

The remaining software identifiers have been received. The IETF / Software Identifier Inventory attribute is complete

Jun 22 12:34:57 koala charon-systemd[12088]: received software identity inventory with 424 items for request 9 at eid 161 of epoch 0x3b8a77a3, 0 items to follow
Jun 22 12:34:57 koala charon-systemd[12088]:   3803: strongswan.org__Ubuntu_16.04-x86_64-printer-driver-ptouch-1.4-1
Jun 22 12:34:57 koala charon-systemd[12088]:   3804: strongswan.org__Ubuntu_16.04-x86_64-printer-driver-pxljr-1.4~repack0-4
Jun 22 12:34:57 koala charon-systemd[12088]:   3805: strongswan.org__Ubuntu_16.04-x86_64-printer-driver-sag-gdi-0.1-4ubuntu1
Jun 22 12:34:57 koala charon-systemd[12088]:   3806: strongswan.org__Ubuntu_16.04-x86_64-printer-driver-splix-2.0.0~svn315-4fakesync1
...
Jun 22 12:34:57 koala charon-systemd[12088]:   4064: strongswan.org__Ubuntu_16.04-x86_64-zenity-common-3.18.1.1-1ubuntu2
Jun 22 12:34:57 koala charon-systemd[12088]:   4065: strongswan.org__Ubuntu_16.04-x86_64-zip-3.0-11
Jun 22 12:34:57 koala charon-systemd[12088]:   2514: strongswan.org__Ubuntu_16.04-x86_64-zlib1g-1~1.2.8.dfsg-2ubuntu4.1
Jun 22 12:34:57 koala charon-systemd[12088]:   2521: strongswan.org__Ubuntu_16.04-x86_64-zlib1g-dev-1~1.2.8.dfsg-2ubuntu4.1
Jun 22 12:34:57 koala charon-systemd[12088]:      0: strongswan.org__strongSwan-5-5-3 @ /usr/share/strongswan

Sending IETF [Targeted] SW Request Attribute

All software identifiers are sent to the strongTNC policy manager via a REST-ful interface. The policy manager checks all software identifiers in its database and finds that it does not have a SWID tag for the strongSwan-5.5.3 software

Jun 22 12:34:57 koala charon-systemd[12088]:   sending request to 'https://admin-user:xxxxxxxxxx!@tnc.strongswan.org/api/sessions/2/swid-measurement/'...
Jun 22 12:34:57 koala charon-systemd[12088]: 1 SWID tag target
Jun 22 12:34:57 koala charon-systemd[12088]:   strongswan.org__strongSwan-5-5-3

A targeted IETF / SW Request attribute is sent in Server DATA batch

Jun 22 12:34:57 koala charon-systemd[12088]: creating PA-TNC message with ID 0x6d9f210a
Jun 22 12:34:57 koala charon-systemd[12088]: creating PA-TNC attribute type 'IETF/SW Request' 0x000000/0x00000011
Jun 22 12:34:57 koala charon-systemd[12088]: created PA-TNC message: => 66 bytes @ 0x7ff8180036c0
                                                0: 01 00 00 00 6D 9F 21 0A 00 00 00 00 00 00 00 11  ....m.!.........
                                               16: 00 00 00 3A 00 00 00 01 00 00 00 09 00 00 00 00  ...:............
                                               32: 00 20 73 74 72 6F 6E 67 73 77 61 6E 2E 6F 72 67  . strongswan.org
                                               48: 5F 5F 73 74 72 6F 6E 67 53 77 61 6E 2D 35 2D 35  __strongSwan-5-5
                                               64: 2D 33                                            -3
Jun 22 12:34:57 koala charon-systemd[12088]: creating PB-PA message type 'IETF/Software' 0x000000/0x00000009
Jun 22 12:34:57 koala charon-systemd[12088]: TNC server is handling outbound connection
Jun 22 12:34:57 koala charon-systemd[12088]: PB-TNC state transition from 'Server Working' to 'Client Working'
Jun 22 12:34:57 koala charon-systemd[12088]: creating PB-TNC SDATA batch
Jun 22 12:34:57 koala charon-systemd[12088]: adding IETF/PB-PA message
Jun 22 12:34:57 koala charon-systemd[12088]: sending PB-TNC SDATA batch (98 bytes) for Connection ID 1
Jun 22 12:34:57 koala charon-systemd[12088]: sending PT-TLS message #4 of type 'PB-TNC Batch' (114 bytes)

Receiving IETF SW Inventory Attribute

Jun 22 12:34:58 koala charon-systemd[12088]: received PT-TLS message #4 of type 'PB-TNC Batch' (508 bytes)
Jun 22 12:34:58 koala charon-systemd[12088]: received TNCCS batch (492 bytes)
Jun 22 12:34:58 koala charon-systemd[12088]: TNC server is handling inbound connection
Jun 22 12:34:58 koala charon-systemd[12088]: processing PB-TNC CDATA batch for Connection ID 1
Jun 22 12:34:58 koala charon-systemd[12088]: PB-TNC state transition from 'Client Working' to 'Server Working'
Jun 22 12:34:58 koala charon-systemd[12088]: processing IETF/PB-PA message (484 bytes)
Jun 22 12:34:58 koala charon-systemd[12088]: handling PB-PA message type 'IETF/Software' 0x000000/0x00000009
Jun 22 12:34:58 koala charon-systemd[12088]: IMV 2 "SWIMA" received message for Connection ID 1 from IMC 2 to IMV 2
Jun 22 12:34:58 koala charon-systemd[12088]: => 460 bytes @ 0x7ff83c003ef0
                                                0: 01 00 00 00 9A 73 D4 63 00 00 00 00 00 00 00 14  .....s.c........
                                               16: 00 00 01 C4 00 00 00 01 00 00 00 09 11 22 33 44  ............."3D
                                               32: 00 00 00 01 00 00 00 00 00 00 00 01 02 00 00 20  ............... 
                                               48: 73 74 72 6F 6E 67 73 77 61 6E 2E 6F 72 67 5F 5F  strongswan.org__
                                               64: 73 74 72 6F 6E 67 53 77 61 6E 2D 35 2D 35 2D 33  strongSwan-5-5-3
                                               80: 00 15 2F 75 73 72 2F 73 68 61 72 65 2F 73 74 72  ../usr/share/str
                                               96: 6F 6E 67 73 77 61 6E 00 00 01 61 3C 3F 78 6D 6C  ongswan...a<?xml
                                              112: 20 76 65 72 73 69 6F 6E 3D 22 31 2E 30 22 20 65   version="1.0" e
                                              128: 6E 63 6F 64 69 6E 67 3D 22 75 74 66 2D 38 22 3F  ncoding="utf-8"?
                                              144: 3E 0A 0A 3C 53 6F 66 74 77 61 72 65 49 64 65 6E  >..<SoftwareIden
                                              160: 74 69 74 79 0A 20 20 6E 61 6D 65 3D 22 73 74 72  tity.  name="str
                                              176: 6F 6E 67 53 77 61 6E 22 0A 20 20 74 61 67 49 64  ongSwan".  tagId
                                              192: 3D 22 73 74 72 6F 6E 67 53 77 61 6E 2D 35 2D 35  ="strongSwan-5-5
                                              208: 2D 33 22 0A 20 20 76 65 72 73 69 6F 6E 3D 22 35  -3".  version="5
                                              224: 2E 35 2E 33 22 20 76 65 72 73 69 6F 6E 53 63 68  .5.3" versionSch
                                              240: 65 6D 65 3D 22 61 6C 70 68 61 6E 75 6D 65 72 69  eme="alphanumeri
                                              256: 63 22 0A 20 20 78 6D 6C 6E 73 3D 22 68 74 74 70  c".  xmlns="http
                                              272: 3A 2F 2F 73 74 61 6E 64 61 72 64 73 2E 69 73 6F  ://standards.iso
                                              288: 2E 6F 72 67 2F 69 73 6F 2F 31 39 37 37 30 2F 2D  .org/iso/19770/-
                                              304: 32 2F 32 30 31 35 2F 73 63 68 65 6D 61 2E 78 73  2/2015/schema.xs
                                              320: 64 22 3E 0A 20 20 3C 45 6E 74 69 74 79 0A 20 20  d">.  <Entity.  
                                              336: 20 20 6E 61 6D 65 3D 22 73 74 72 6F 6E 67 53 77    name="strongSw
                                              352: 61 6E 20 50 72 6F 6A 65 63 74 22 0A 20 20 20 20  an Project".    
                                              368: 72 65 67 69 64 3D 22 73 74 72 6F 6E 67 73 77 61  regid="strongswa
                                              384: 6E 2E 6F 72 67 22 0A 20 20 20 20 72 6F 6C 65 3D  n.org".    role=
                                              400: 22 73 6F 66 74 77 61 72 65 43 72 65 61 74 6F 72  "softwareCreator
                                              416: 20 6C 69 63 65 6E 73 6F 72 20 74 61 67 43 72 65   licensor tagCre
                                              432: 61 74 6F 72 22 2F 3E 0A 3C 2F 53 6F 66 74 77 61  ator"/>.</Softwa
                                              448: 72 65 49 64 65 6E 74 69 74 79 3E 0A              reIdentity>.
Jun 22 12:34:58 koala charon-systemd[12088]: processing PA-TNC message with ID 0x9a73d463
Jun 22 12:34:58 koala charon-systemd[12088]: processing PA-TNC attribute type 'IETF/SW Inventory' 0x000000/0x00000014
Jun 22 12:34:58 koala charon-systemd[12088]: received software inventory with 1 item for request 9 at eid 161 of epoch 0x3b8a77a3, 0 items to follow

The XML-encoded ISO-17770-2:2015 SWID tag for the strongswan-5-5-3 software

Jun 22 12:34:58 koala charon-systemd[12088]: <?xml version="1.0" encoding="utf-8"?>                                             
                                             <SoftwareIdentity
                                               name="strongSwan" 
                                               tagId="strongSwan-5-5-3" 
                                               version="5.5.3" versionScheme="alphanumeric" 
                                               xmlns="http://standards.iso.org/iso/19770/-2/2015/schema.xsd">
                                               <Entity
                                                 name="strongSwan Project" 
                                                 regid="strongswan.org" 
                                                 role="softwareCreator licensor tagCreator"/>
                                             </SoftwareIdentity>

The SWID tag is uploaded to the strongTNC policy manager via the REST-ful API. Then the complete software identifier inventory is reposted

Jun 22 12:34:58 koala charon-systemd[12088]:   sending request to 'https://admin-user:xxxxxxxxxx!@tnc.strongswan.org/api/swid/add-tags/'...
Jun 22 12:34:58 koala charon-systemd[12088]:   sending request to 'https://admin-user:xxxxxxxxxx!@tnc.strongswan.org/api/sessions/2/swid-measurement/'...

Terminating PT-TLS Client Connection

The PT-TLS client session is terminated

Jun 22 12:34:58 koala charon-systemd[12088]: IMV 2 handled SWIDT workitem 9: allow - received inventory of 2049 SWID tag IDs and 1 SWID tag
Jun 22 12:34:58 koala charon-systemd[12088]: creating PA-TNC message with ID 0xf63cbcf4
Jun 22 12:34:58 koala charon-systemd[12088]: creating PA-TNC attribute type 'IETF/Assessment Result' 0x000000/0x00000009
Jun 22 12:34:58 koala charon-systemd[12088]: created PA-TNC message: => 24 bytes @ 0x7ff83c000f50
                                                0: 01 00 00 00 F6 3C BC F4 00 00 00 00 00 00 00 09  .....<..........
                                               16: 00 00 00 10 00 00 00 00                          ........
Jun 22 12:34:58 koala charon-systemd[12088]: creating PB-PA message type 'IETF/Software' 0x000000/0x00000009
Jun 22 12:34:58 koala charon-systemd[12088]: IMV 2 provides recommendation 'allow' and evaluation 'compliant'
Jun 22 12:34:58 koala charon-systemd[12088]: TNC server is handling outbound connection
Jun 22 12:34:58 koala charon-systemd[12088]: running policy script: 2>&1 ipsec imv_policy_manager stop 2
Jun 22 12:34:58 koala charon-systemd[12088]: policy: recommendation for access requestor 46.126.238.39 is allow
Jun 22 12:34:58 koala charon-systemd[12088]: policy: imv_policy_manager stop successful
Jun 22 12:34:58 koala charon-systemd[12088]: IMV 1 "OS" changed state of Connection ID 1 to 'Allowed'
Jun 22 12:34:58 koala charon-systemd[12088]: IMV 2 "SWIMA" changed state of Connection ID 1 to 'Allowed'
Jun 22 12:34:58 koala charon-systemd[12088]: PB-TNC state transition from 'Server Working' to 'Decided'
Jun 22 12:34:58 koala charon-systemd[12088]: creating PB-TNC RESULT batch
Jun 22 12:34:58 koala charon-systemd[12088]: adding IETF/PB-PA message
Jun 22 12:34:58 koala charon-systemd[12088]: adding IETF/PB-Assessment-Result message
Jun 22 12:34:58 koala charon-systemd[12088]: adding IETF/PB-Access-Recommendation message
Jun 22 12:34:58 koala charon-systemd[12088]: sending PB-TNC RESULT batch (88 bytes) for Connection ID 1
Jun 22 12:34:58 koala charon-systemd[12088]: sending PT-TLS message #5 of type 'PB-TNC Batch' (104 bytes)
Jun 22 12:34:58 koala charon-systemd[12088]: received PT-TLS message #5 of type 'PB-TNC Batch' (24 bytes)
Jun 22 12:34:58 koala charon-systemd[12088]: received TNCCS batch (8 bytes)
Jun 22 12:34:58 koala charon-systemd[12088]: TNC server is handling inbound connection
Jun 22 12:34:58 koala charon-systemd[12088]: processing PB-TNC CLOSE batch for Connection ID 1
Jun 22 12:34:58 koala charon-systemd[12088]: PB-TNC state transition from 'Decided' to 'End'
Jun 22 12:34:58 koala charon-systemd[12088]: final recommendation is 'allow' and evaluation is 'compliant'
Jun 22 12:34:58 koala charon-systemd[12088]: PT-TLS connection terminates
Jun 22 12:34:58 koala charon-systemd[12088]: IMV 1 "OS" deleted the state of Connection ID 1
Jun 22 12:34:58 koala charon-systemd[12088]: IMV 2 "SWIMA" deleted the state of Connection ID 1
Jun 22 12:34:58 koala charon-systemd[12088]: removed TNCCS Connection ID 1
Jun 22 12:34:58 koala charon-systemd[12088]: sending TLS close notify

Stopping PT-TLS Daemon

The strongSwan PT-TLS server daemon can be stopped using the following systemd command

systemctl stop strongswan-swanctl

Jun 22 14:11:43 koala charon-systemd[12088]: SIGTERM received, shutting down
Jun 22 14:11:43 koala systemd[1]: Stopping strongSwan IPsec IKEv1/IKEv2 daemon using swanctl...
Jun 22 14:11:43 koala charon-systemd[12088]: IMV 2 "SWIMA" terminated
Jun 22 14:11:43 koala charon-systemd[12088]: IMV 1 "OS" terminated
Jun 22 14:11:43 koala charon-systemd[12088]: removed IETF attributes
Jun 22 14:11:43 koala charon-systemd[12088]: removed ITA-HSR attributes
Jun 22 14:11:43 koala charon-systemd[12088]: removed PWG attributes
Jun 22 14:11:43 koala charon-systemd[12088]: removed TCG attributes
Jun 22 14:11:43 koala charon-systemd[12088]: libimcv terminated
Jun 22 14:11:43 koala systemd[1]: Stopped strongSwan IPsec IKEv1/IKEv2 daemon using swanctl.